@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/bin/internal-cli.js

@@ -1,63 +1,123 @@
 #!/usr/bin/env node
+import { formatTaskViewDiagnostic, guardTaskOperation, resolveSandboxControlTransport, TaskViewOperationError } from '../lib/internal/task-operation-registry.js';
+import { INTERNAL_HANDLER_ROUTE_SELECTORS } from '../lib/internal/cli-route-inventory.js';
+import { hostControlRequestForCommand, requestHostControl, HostControlClientError, HOST_CONTROL_TEST_ENVIRONMENT_KEYS } from '../lib/host-control/client.js';
+import { resolveHostControlEndpoint, readHostControlWorkerToken } from '../lib/host-control/path.js';
 const [major = 0, minor = 0] = process.versions.node.split('.').map((part) => parseInt(part, 10));
 if (major < 22 || (major === 22 && minor < 9)) {
     process.stderr.write(`agent-infra-internal requires Node.js >= 22.9.0 (current: ${process.version})\n`);
     process.exit(1);
 }
 const command = process.argv[2] || '';
+const internalRouteRegistered = Object.hasOwn(INTERNAL_HANDLER_ROUTE_SELECTORS, command);
 const taskControlCommand = command === 'task-lifecycle' || command === 'task-orchestration' || command === 'task-finalization';
-function taskControlTransportFailure(message) {
+const taskWorkflowCommand = command === 'task-artifact'
+    || command === 'task-review'
+    || command === 'task-event'
+    || command === 'task-ledger'
+    || command === 'task-invalidation'
+    || command === 'task-warning';
+const manualValidationWorkflowCommand = command === 'manual-validation';
+const localTaskControlHelp = taskControlCommand
+    && (process.argv[3] === '--help' || process.argv[3] === '-h')
+    && !process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT;
+let taskViewGuardFailed = false;
+try {
+    const guard = guardTaskOperation('internal', command, process.argv.slice(3));
+    if (guard.taskView && guard.descriptor.effect === 'diagnostic') {
+        process.stderr.write(formatTaskViewDiagnostic(guard.taskView));
+    }
+}
+catch (error) {
+    taskViewGuardFailed = true;
+    if (error instanceof TaskViewOperationError) {
+        process.stderr.write(`${error.message}\n`);
+        process.exitCode = error.exitCode;
+    }
+    else {
+        throw error;
+    }
+}
+function taskControlTransportFailure(message, code = 'TASK_CONTROL_TRANSPORT_INVALID', changed = false) {
     process.stdout.write(`${JSON.stringify({
-        status: 'failed', changed: false,
-        error: { code: 'TASK_CONTROL_TRANSPORT_INVALID', message }
+        status: 'failed', changed,
+        error: { code, message }
     })}\n`);
     process.exit(1);
 }
-if (taskControlCommand) {
-    const env = process.env;
-    const executorMarked = Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
-    const controlKeys = [
-        'AGENT_INFRA_CONTROL_TOKEN', 'AGENT_INFRA_CONTROL_GENERATION',
-        'AGENT_INFRA_CONTROL_DIR', 'AGENT_INFRA_CONTROL_STATUS_DIR'
-    ];
-    const hasControlMarker = controlKeys.some((key) => Boolean(env[key]))
-        || Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING);
-    const taskBindingMarker = hasControlMarker && Boolean(env.AGENT_INFRA_TASK_ID);
-    const hasCompleteClientConfig = controlKeys.every((key) => Boolean(env[key]))
-        && !env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING
-        && (!taskBindingMarker || Boolean(env.AGENT_INFRA_RUNTIME_DIR));
-    if (executorMarked) {
-        taskControlTransportFailure('executor context is only valid for sandbox-control execute');
+async function runHostControlCommand(commandName, args) {
+    let response;
+    try {
+        const testEndpoint = process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT;
+        const forwardedEnvironment = testEndpoint
+            ? Object.fromEntries(HOST_CONTROL_TEST_ENVIRONMENT_KEYS.flatMap((key) => process.env[key] === undefined ? [] : [[key, process.env[key]]]))
+            : {};
+        response = await requestHostControl({
+            request: hostControlRequestForCommand(commandName, args, process.cwd(), forwardedEnvironment),
+            endpoint: process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT ?? resolveHostControlEndpoint()
+        });
     }
-    if ((hasControlMarker || taskBindingMarker) && !hasCompleteClientConfig) {
-        taskControlTransportFailure('sandbox client control configuration is incomplete or conflicting');
+    catch (error) {
+        if (error instanceof HostControlClientError) {
+            taskControlTransportFailure(error.message, error.changed === false
+                ? 'SANDBOX_CONTROL_HOST_AUTHORITY_UNAVAILABLE' : error.code, error.changed);
+        }
+        throw error;
     }
-    if (hasCompleteClientConfig) {
-        const { sandboxControl } = await import('../lib/internal/sandbox-control.js');
-        await sandboxControl(['client', command, ...process.argv.slice(3)]);
+    process.stdout.write(response.stdout);
+    process.stderr.write(response.stderr);
+    process.exitCode = response.exitCode;
+}
+const hostWorkerRequested = process.env.AGENT_INFRA_HOST_CONTROL_WORKER === '1';
+const hostWorker = hostWorkerRequested && (() => {
+    try {
+        const endpoint = process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT ?? resolveHostControlEndpoint();
+        return process.env.AGENT_INFRA_HOST_CONTROL_WORKER_TOKEN === readHostControlWorkerToken(endpoint);
     }
-    else {
-        switch (command) {
-            case 'task-orchestration': {
-                const { taskOrchestration } = await import('../lib/internal/task-orchestration.js');
-                await taskOrchestration(process.argv.slice(3));
-                break;
-            }
-            case 'task-lifecycle': {
-                const { taskLifecycle } = await import('../lib/internal/task-lifecycle.js');
-                await taskLifecycle(process.argv.slice(3));
-                break;
-            }
-            case 'task-finalization': {
-                const { taskFinalization } = await import('../lib/internal/task-finalization.js');
-                await taskFinalization(process.argv.slice(3));
-                break;
-            }
+    catch {
+        return false;
+    }
+})();
+if (hostWorkerRequested && !hostWorker && (taskControlCommand || taskWorkflowCommand || manualValidationWorkflowCommand)) {
+    taskControlTransportFailure('host-control worker authorization is invalid', 'SANDBOX_CONTROL_HOST_AUTHORITY_UNAVAILABLE');
+}
+let controlRouted = false;
+if (!taskViewGuardFailed && (taskControlCommand || taskWorkflowCommand || manualValidationWorkflowCommand) && !hostWorker && !localTaskControlHelp) {
+    const transport = resolveSandboxControlTransport(process.env);
+    switch (transport.kind) {
+        case 'fail-closed': {
+            const reason = transport.reasonCode ?? 'TASK_CONTROL_TRANSPORT_INVALID';
+            taskControlTransportFailure(reason, reason.startsWith('SANDBOX_CONTROL_IDENTITY_') ? reason : undefined);
+            break;
+        }
+        case 'direct-host':
+            await runHostControlCommand(command, process.argv.slice(3));
+            break;
+        case 'broker-client': {
+            const { sandboxControl } = await import('../lib/internal/sandbox-control.js');
+            await sandboxControl(['client', ...(taskControlCommand ? [command] : ['task-workflow', command]), ...process.argv.slice(3)]);
+            break;
         }
     }
+    controlRouted = true;
 }
-else
+if (!controlRouted && !taskViewGuardFailed && internalRouteRegistered)
     switch (command) {
+        case 'task-orchestration': {
+            const { taskOrchestration } = await import('../lib/internal/task-orchestration.js');
+            await taskOrchestration(process.argv.slice(3));
+            break;
+        }
+        case 'task-lifecycle': {
+            const { taskLifecycle } = await import('../lib/internal/task-lifecycle.js');
+            await taskLifecycle(process.argv.slice(3));
+            break;
+        }
+        case 'task-finalization': {
+            const { taskFinalization } = await import('../lib/internal/task-finalization.js');
+            await taskFinalization(process.argv.slice(3));
+            break;
+        }
         case 'task-create': {
             const { taskCreate } = await import('../lib/internal/task-create.js');
             await taskCreate(process.argv.slice(3));
@@ -68,6 +128,11 @@ else
             await sandboxControl(process.argv.slice(3));
             break;
         }
+        case 'host-control': {
+            const { hostControl } = await import('../lib/internal/host-control.js');
+            await hostControl(process.argv.slice(3));
+            break;
+        }
         case 'agent-client': {
             const { agentClient } = await import('../lib/internal/agent-client.js');
             agentClient(process.argv.slice(3));
@@ -138,6 +203,16 @@ else
             await platformChecks(process.argv.slice(3));
             break;
         }
+        case 'platform-security': {
+            const { platformSecurity } = await import('../lib/internal/platform-security.js');
+            await platformSecurity(process.argv.slice(3));
+            break;
+        }
+        case 'platform-metadata': {
+            const { platformMetadata } = await import('../lib/internal/platform-metadata.js');
+            await platformMetadata(process.argv.slice(3));
+            break;
+        }
         case 'task-context': {
             const { taskContext } = await import('../lib/internal/task-context.js');
             taskContext(process.argv.slice(3));
@@ -148,6 +223,11 @@ else
             await taskLedger(process.argv.slice(3));
             break;
         }
+        case 'task-qualification': {
+            const { taskQualification } = await import('../lib/internal/task-qualification.js');
+            await taskQualification(process.argv.slice(3));
+            break;
+        }
         case 'task-warning': {
             const { taskWarning } = await import('../lib/internal/task-warning.js');
             await taskWarning(process.argv.slice(3));
@@ -218,6 +298,11 @@ else
             taskValidate(process.argv.slice(3));
             break;
         }
+        case 'manual-validation': {
+            const { manualValidation } = await import('../lib/internal/manual-validation.js');
+            await manualValidation(process.argv.slice(3));
+            break;
+        }
         default:
             process.stdout.write(`${JSON.stringify({
                 status: 'failed',
@@ -226,5 +311,4 @@ else
             })}\n`);
             process.exitCode = 1;
     }
-export {};
 //# sourceMappingURL=internal-cli.js.map

package/dist/lib/agent-client.js

@@ -6,6 +6,8 @@ import { listAgentClientAdapters } from './agent-clients/registry.js';
 import { AGENT_CLIENT_IDS, isAgentClientId } from './agent-clients/types.js';
 import { closePrompt, multiSelect } from './prompt.js';
 import { resolveTemplateDir } from './paths.js';
+import { PUBLIC_CLI_ROUTE_SELECTORS } from './internal/cli-route-inventory.js';
+const AGENT_CLIENT_OPERATIONS = PUBLIC_CLI_ROUTE_SELECTORS['agent-client'];
 const USAGE = `Usage: ai agent-client <operation>
 
 Operations:
@@ -79,6 +81,9 @@ async function cmdAgentClient(args) {
         process.stdout.write(USAGE);
         return 0;
     }
+    if (!AGENT_CLIENT_OPERATIONS.includes(operation)) {
+        throw new AgentClientCommandError('AGENT_CLIENT_OPERATION_INVALID', `Unknown operation '${operation}'`);
+    }
     if (operation === 'list') {
         if (args.length !== 1) {
             throw new AgentClientCommandError('AGENT_CLIENT_ARGUMENT_INVALID', 'list accepts no arguments');

package/dist/lib/agent-clients/adapters/codex-lifecycle/capability-store.js

@@ -89,6 +89,21 @@ function provenanceDetail(record, expected) {
 function exactKeys(value, keys) {
     return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
+function isRecoveryPhase(value) {
+    return value === 'orchestration.prepare'
+        || value === 'artifact.finalize-local'
+        || value === 'task-event.completed';
+}
+function isRecoveryPhaseRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const phase = value;
+    return exactKeys(phase, ['phase', 'requestId', 'state'])
+        && isRecoveryPhase(phase.phase)
+        && typeof phase.requestId === 'string'
+        && /^[a-f0-9-]{16,64}$/u.test(phase.requestId)
+        && (phase.state === 'issued' || phase.state === 'consumed');
+}
 function isCodexControllerBinding(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
@@ -176,18 +191,26 @@ function createCodexCapabilityStore(options = {}) {
     const root = options.root
         ?? resolveAgentRuntimeStoreRoot({ store: 'capabilities' });
     const now = options.now ?? Date.now;
-    const createToken = options.token ?? (() => crypto.randomBytes(32).toString('base64url'));
+    const createReference = options.reference ?? (() => crypto.randomBytes(32).toString('base64url'));
     const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
     const tombstoneMs = options.tombstoneMs ?? DEFAULT_TOMBSTONE_MS;
     const maxRecords = options.maxRecords ?? DEFAULT_MAX_RECORDS;
     fs.mkdirSync(root, { recursive: true, mode: 0o700 });
     fs.chmodSync(root, 0o700);
-    function fileFor(token) {
-        return path.join(root, `${digest(token)}.json`);
+    function fileFor(capabilityRef) {
+        return path.join(root, `${digest(capabilityRef)}.json`);
     }
     function read(file) {
         const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-        if (value.schemaVersion !== 1 || !Number.isSafeInteger(value.revision) || value.revision < 1) {
+        const keys = Object.keys(value).sort().join(',');
+        if (keys !== 'armedAt,attestedAt,buildIdentity,capabilityRefDigest,consumedAt,controller,expiresAt,hookDefinitionHash,recoveryOperationId,recoveryPhases,recoveryState,reservedAt,revision,schemaVersion,sessionId,status,taskId,toolUseId,turnId'
+            || value.schemaVersion !== 2 || !Number.isSafeInteger(value.revision) || value.revision < 1
+            || typeof value.capabilityRefDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(value.capabilityRefDigest)
+            || !['unreserved', 'reserved', 'consumed'].includes(value.recoveryState)
+            || (value.recoveryOperationId !== null && typeof value.recoveryOperationId !== 'string')
+            || (value.reservedAt !== null && !Number.isSafeInteger(value.reservedAt))
+            || !Array.isArray(value.recoveryPhases)
+            || !value.recoveryPhases.every((phase) => isRecoveryPhaseRecord(phase))) {
             throw capabilityError('CODEX_CAPABILITY_STATE_INVALID', 'capability record schema is invalid');
         }
         return value;
@@ -294,17 +317,21 @@ function createCodexCapabilityStore(options = {}) {
     }
     function arm(input) {
         sweep();
-        const token = createToken();
-        const file = fileFor(token);
+        const capabilityRef = createReference();
+        const file = fileFor(capabilityRef);
         if (fs.existsSync(file))
             throw capabilityError('CODEX_CAPABILITY_TOKEN_COLLISION', 'capability token already exists');
         const timestamp = now();
         const record = Object.freeze({
-            schemaVersion: 1,
+            schemaVersion: 2,
             revision: 1,
-            tokenDigest: digest(token),
+            capabilityRefDigest: digest(capabilityRef),
             taskId: input.taskId,
             status: 'armed',
+            recoveryOperationId: null,
+            recoveryState: 'unreserved',
+            reservedAt: null,
+            recoveryPhases: Object.freeze([]),
             buildIdentity: input.buildIdentity,
             controller: input.controller ?? null,
             sessionId: null,
@@ -317,26 +344,27 @@ function createCodexCapabilityStore(options = {}) {
             consumedAt: null
         });
         write(file, record, 0);
-        return Object.freeze({
+        const result = {
             ...record,
-            token,
+            capabilityRef,
             path: file,
-            marker: `agent-infra-codex-capability:${token}`
-        });
+            marker: `agent-infra-codex-capability:${capabilityRef}`
+        };
+        return Object.freeze(result);
     }
-    function loadActive(token) {
-        const file = fileFor(token);
+    function loadActive(capabilityRef, options = {}) {
+        const file = fileFor(capabilityRef);
         if (!fs.existsSync(file)) {
             throw capabilityError('CODEX_CAPABILITY_MISSING', 'capability token was not found');
         }
         const record = expire(read(file), file, now());
-        if (record.status === 'expired') {
+        if (record.status === 'expired' && !options.allowExpiredReserved) {
             throw capabilityError('CODEX_CAPABILITY_EXPIRED', 'capability token expired');
         }
         return { file, record };
     }
-    function attest(input) {
-        const { file, record } = loadActive(input.token);
+    function attestByReference(input) {
+        const { file, record } = loadActive(input.capabilityRef);
         if (record.status !== 'armed') {
             throw capabilityError(record.status === 'consumed' ? 'CODEX_CAPABILITY_REPLAY' : 'CODEX_CAPABILITY_STATE_INVALID', `capability is ${record.status}, expected armed`);
         }
@@ -362,11 +390,14 @@ function createCodexCapabilityStore(options = {}) {
         write(file, next, record.revision);
         return next;
     }
-    function validateRecord(record, expected) {
+    function validateRecord(record, expected, options = {}) {
         if (record.status === 'consumed') {
             throw capabilityError('CODEX_CAPABILITY_REPLAY', 'capability token was already consumed');
         }
-        if (record.status !== 'attested') {
+        const expiredReserved = options.allowExpiredReserved
+            && record.status === 'expired'
+            && record.recoveryState === 'reserved';
+        if (record.status !== 'attested' && !expiredReserved) {
             throw capabilityError('CODEX_CAPABILITY_NOT_ATTESTED', 'capability token has no current-session hook attestation');
         }
         const identity = record.buildIdentity && typeof record.buildIdentity === 'object'
@@ -380,28 +411,135 @@ function createCodexCapabilityStore(options = {}) {
         }
         return record;
     }
-    function validate(token, expected) {
+    function validateReference(capabilityRef, expected) {
         sweep();
-        const { record } = loadActive(token);
+        const { record } = loadActive(capabilityRef);
         return validateRecord(record, expected);
     }
-    function consume(token, expected) {
+    function consumeReference(capabilityRef, operationId, expected, options = {}) {
         sweep();
-        const { file, record } = loadActive(token);
-        validateRecord(record, expected);
+        if (!operationId || /[\r\n]/u.test(operationId)) {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'recovery operation id is invalid');
+        }
+        const { file, record } = loadActive(capabilityRef, options);
+        if (record.status === 'consumed' && record.recoveryState === 'consumed' && record.recoveryOperationId === operationId) {
+            return record;
+        }
+        validateRecord(record, expected, options);
+        if (record.recoveryState === 'consumed') {
+            if (record.recoveryOperationId === operationId)
+                return record;
+            throw capabilityError('CODEX_CAPABILITY_REPLAY', 'capability recovery operation was already consumed');
+        }
+        if (record.recoveryState !== 'reserved' || record.recoveryOperationId !== operationId) {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'capability must be reserved by this operation before consumption');
+        }
         const next = Object.freeze({
             ...record,
             revision: record.revision + 1,
             status: 'consumed',
+            recoveryState: 'consumed',
             consumedAt: now()
         });
         write(file, next, record.revision);
         return next;
     }
-    function inspect(token) {
-        return loadActive(token).record;
+    function reserveRecoveryPhase(capabilityRef, operationId, phase, requestId, expected) {
+        if (!operationId || /[\r\n]/u.test(operationId) || !isRecoveryPhase(phase)
+            || !/^[a-f0-9-]{16,64}$/u.test(requestId)) {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'recovery phase identity is invalid');
+        }
+        sweep();
+        const { file, record } = loadActive(capabilityRef);
+        validateRecord(record, expected);
+        if (record.recoveryState !== 'reserved' || record.recoveryOperationId !== operationId) {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'capability must be reserved by this operation before phase reservation');
+        }
+        if (record.recoveryPhases.some((entry) => entry.phase === phase)) {
+            throw capabilityError('CODEX_CAPABILITY_PHASE_REPLAY', 'recovery phase was already reserved');
+        }
+        const next = Object.freeze({
+            ...record,
+            revision: record.revision + 1,
+            recoveryPhases: Object.freeze([
+                ...record.recoveryPhases,
+                Object.freeze({ phase, requestId, state: 'issued' })
+            ])
+        });
+        write(file, next, record.revision);
+        return next;
+    }
+    function consumeRecoveryPhase(capabilityRef, operationId, phase, requestId, expected, options = {}) {
+        if (!operationId || /[\r\n]/u.test(operationId) || !isRecoveryPhase(phase)
+            || !/^[a-f0-9-]{16,64}$/u.test(requestId)) {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'recovery phase identity is invalid');
+        }
+        sweep();
+        const { file, record } = loadActive(capabilityRef, options);
+        validateRecord(record, expected, options);
+        if (record.recoveryState !== 'reserved' && record.recoveryState !== 'consumed') {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'capability has no reserved recovery operation');
+        }
+        if (record.recoveryOperationId !== operationId) {
+            throw capabilityError('CODEX_CAPABILITY_REPLAY', 'capability recovery operation does not match');
+        }
+        const current = record.recoveryPhases.find((entry) => entry.phase === phase);
+        if (!current || current.requestId !== requestId) {
+            throw capabilityError('CODEX_CAPABILITY_PHASE_REPLAY', 'recovery phase identity does not match');
+        }
+        if (current.state === 'consumed')
+            return record;
+        const next = Object.freeze({
+            ...record,
+            revision: record.revision + 1,
+            recoveryPhases: Object.freeze(record.recoveryPhases.map((entry) => entry.phase === phase ? Object.freeze({ ...entry, state: 'consumed' }) : entry))
+        });
+        write(file, next, record.revision);
+        return next;
+    }
+    function reserveReference(capabilityRef, operationId, expected) {
+        if (!operationId || /[\r\n]/u.test(operationId)) {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'recovery operation id is invalid');
+        }
+        sweep();
+        const { file, record } = loadActive(capabilityRef);
+        validateRecord(record, expected);
+        if (record.recoveryState === 'reserved') {
+            if (record.recoveryOperationId === operationId)
+                return record;
+            throw capabilityError('CODEX_CAPABILITY_BUSY', 'capability is reserved by another recovery operation');
+        }
+        if (record.recoveryState === 'consumed') {
+            if (record.recoveryOperationId === operationId)
+                return record;
+            throw capabilityError('CODEX_CAPABILITY_REPLAY', 'capability recovery operation was already consumed');
+        }
+        const next = Object.freeze({
+            ...record,
+            revision: record.revision + 1,
+            recoveryOperationId: operationId,
+            recoveryState: 'reserved',
+            reservedAt: now()
+        });
+        write(file, next, record.revision);
+        return next;
+    }
+    function inspectReference(capabilityRef) {
+        return loadActive(capabilityRef).record;
+    }
+    function findByRecoveryOperation(operationId) {
+        if (!operationId || /[\r\n]/u.test(operationId)) {
+            throw capabilityError('CODEX_CAPABILITY_RECOVERY_INVALID', 'recovery operation id is invalid');
+        }
+        return Object.freeze(files()
+            .map((file) => read(file))
+            .filter((record) => record.recoveryOperationId === operationId));
     }
-    return Object.freeze({ arm, attest, consume, inspect, validate, sweep });
+    return Object.freeze({
+        arm, attestByReference, reserveReference, reserveRecoveryPhase, consumeRecoveryPhase,
+        consumeReference, inspectReference,
+        findByRecoveryOperation, validateReference, sweep
+    });
 }
 export { createCodexCapabilityStore };
 export { isCodexCapabilityProvenanceDetail };

package/dist/lib/agent-clients/adapters/codex-lifecycle/sandbox-controller.js

@@ -274,9 +274,10 @@ function prepareCodexSandboxController(input, options = {}) {
         const shimDir = path.join(home, 'bin');
         fs.mkdirSync(shimDir, { mode: 0o700 });
         const internalCli = path.resolve(process.argv[1] ?? path.join(repoRoot, 'bin', 'internal-cli.ts'));
+        const launcherPrefix = ['#!/bin/sh', 'set -eu', 'unset NODE_OPTIONS NODE_PATH'].join('\n') + '\n';
         const source = internalCli.endsWith('.ts')
-            ? `#!/bin/sh\nexec ${shellQuote(process.execPath)} --experimental-strip-types ${shellQuote(internalCli)} "$@"\n`
-            : `#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(internalCli)} "$@"\n`;
+            ? `${launcherPrefix}exec ${shellQuote(process.execPath)} --experimental-strip-types ${shellQuote(internalCli)} "$@"\n`
+            : `${launcherPrefix}exec ${shellQuote(process.execPath)} ${shellQuote(internalCli)} "$@"\n`;
         fs.writeFileSync(path.join(shimDir, 'agent-infra-internal'), source, { mode: 0o700 });
         const policy = [
             input.executorModel ? `--executor-model ${input.executorModel}` : '',