@kal-elsam/kairo-runtime 0.16.0 → 0.17.0

package/src/global/conversation/bootstrap-analyzer-adapters.js

@@ -0,0 +1,251 @@
+// A neutral contract for Bootstrap Analysis, so conversation/service.js's
+// runBootstrapAnalysis doesn't special-case providers inline — each real
+// provider gets its own adapter, and adding a new one (Cursor, a future
+// verified Claude boundary, etc.) means adding a factory here, not
+// branching inside runBootstrapAnalysis.
+//
+// Every adapter exposes:
+//   adapterId, modelId
+//   checkEligibility(): Promise<{ eligible, reason?, isolation, canaryTested }>
+//     isolation and canaryTested are separate axes — WHO enforces the
+//     boundary is not the same question as WHETHER it's been proven:
+//       isolation: "verified" | "restricted" | "unverified" — WHO enforces
+//         it. "verified" = an OS/kernel-enforced boundary (Codex's
+//         sandbox-exec, see codex-sandbox.js) that holds even if the CLI's
+//         own logic has a bug. "restricted" = an application-enforced
+//         boundary — the provider's own CLI/tool-permission logic (Claude's
+//         --restricted). "unverified" = no real boundary available.
+//       canaryTested: boolean — WHETHER that boundary has actually been
+//         empirically proven (a real canary read outside it was attempted
+//         and denied), as opposed to merely documented/assumed from
+//         --help text or a vendor's own claim. Both Codex's and Claude's
+//         adapters are canaryTested: true today; a provider could in
+//         principle be "restricted" but NOT canaryTested if its isolation
+//         claim were never independently checked — never conflate the two.
+//   analyze({ question, snapshotRoot, timeoutMs }): Promise<{status, answer, error}>
+//     same response shape intelligence/quick-ask.js's askProvider already
+//     returns, so callers don't need to branch on adapter type downstream.
+//
+// This module only wires the providers that already have a real
+// implementation (Codex, Claude). Requesting an adapterId with no real
+// implementation yet returns an honest "not implemented" ineligible
+// adapter — never a silent fallback to a provider the caller didn't ask
+// for.
+
+import { askProvider as defaultAskProvider } from "../intelligence/quick-ask.js";
+import {
+  getCodexIsolationStatus as defaultGetCodexIsolationStatus,
+  runCodexSandboxedBootstrap as defaultRunCodexSandboxedBootstrap
+} from "./codex-sandbox.js";
+import { verifyClaudeSubscriptionAuth as defaultVerifyClaudeSubscriptionAuth } from "../runtime/execution-adapters/claude.js";
+import { readClaudeModels as defaultReadClaudeModels } from "../observability/claude-models.js";
+import { readCursorModels as defaultReadCursorModels } from "../observability/cursor-models.js";
+import { probeCursorAuth as defaultProbeCursorAuth } from "../observability/cursor-auth.js";
+import {
+  getCursorIsolationStatus as defaultGetCursorIsolationStatus,
+  runCursorSandboxedBootstrap as defaultRunCursorSandboxedBootstrap
+} from "./cursor-sandbox.js";
+
+export function createCodexBootstrapAnalyzerAdapter({ modelId, deps = {} } = {}) {
+  const runSandboxed = deps.runCodexSandboxedBootstrap ?? defaultRunCodexSandboxedBootstrap;
+  const getIsolation = deps.getCodexIsolationStatus ?? defaultGetCodexIsolationStatus;
+  return {
+    adapterId: "codex",
+    modelId,
+    async checkEligibility() {
+      const isolation = await getIsolation(deps.isolationDeps ?? {});
+      return {
+        eligible: isolation.available,
+        reason: isolation.available ? undefined : isolation.reason,
+        isolation: isolation.available ? "verified" : "unverified",
+        // The sandbox-exec mechanism itself was empirically canary-tested
+        // (a real absolute-path read outside the confined root was denied,
+        // see codex-sandbox.js's own header) — `available` reflects that
+        // the same proven mechanism is usable here (platform + binary
+        // present), not a fresh proof on every call.
+        canaryTested: isolation.available
+      };
+    },
+    async analyze({ question, snapshotRoot, timeoutMs }) {
+      return runSandboxed({ question, model: modelId, snapshotRoot, timeoutMs, deps: deps.isolationDeps ?? {} });
+    }
+  };
+}
+
+export function createClaudeBootstrapAnalyzerAdapter({ modelId, deps = {} } = {}) {
+  const ask = deps.askProvider ?? defaultAskProvider;
+  const verifyAuth = deps.verifyClaudeSubscriptionAuth ?? defaultVerifyClaudeSubscriptionAuth;
+  const listModels = deps.readClaudeModels ?? defaultReadClaudeModels;
+  return {
+    adapterId: "claude",
+    modelId,
+    // Real, integral eligibility — not a hardcoded claim:
+    //  1. CLI + authentication: reuses execution-adapters/claude.js's own
+    //     `claude auth status` check (the same real one gating a Claude
+    //     execution run) — an unauthenticated or missing CLI fails here,
+    //     never silently reported eligible.
+    //  2. Model availability: checked against Claude's documented model
+    //     catalog (observability/claude-models.js). Claude's CLI has no
+    //     live model-discovery command (verified via its own --help, see
+    //     that module's own header) — this catches an unknown/typo'd
+    //     modelId, though it can't prove live per-account entitlement the
+    //     way Codex/OpenCode's live catalogs can.
+    //  3. isolation: "restricted" (application-enforced, by the claude
+    //     CLI's own in-process tool-permission logic — not an OS kernel
+    //     sandbox like Codex's sandbox-exec, so a bug in that logic could
+    //     theoretically be bypassed, unlike a kernel boundary).
+    //     canaryTested: true — --restricted's actual confinement was
+    //     empirically canary-tested (not assumed): a real absolute-path
+    //     read outside cwd came back in the JSON output's own
+    //     `permission_denials` array (Claude's Read tool itself refused
+    //     it), while an in-bounds read succeeded with an empty
+    //     `permission_denials`. That proof is WHETHER it was tested, not
+    //     WHO enforces it — it does not make this "verified"; only a
+    //     kernel-enforced boundary earns that label.
+    async checkEligibility() {
+      try {
+        await verifyAuth({});
+      } catch (error) {
+        return { eligible: false, reason: error?.message ?? String(error), isolation: "unverified", canaryTested: false };
+      }
+      if (modelId) {
+        const catalog = listModels();
+        const known = catalog.models.some((m) => m.id === modelId);
+        if (!known) {
+          return { eligible: false, reason: `"${modelId}" is not in Claude's documented model catalog.`, isolation: "unverified", canaryTested: false };
+        }
+      }
+      return { eligible: true, isolation: "restricted", canaryTested: true };
+    },
+    async analyze({ question, snapshotRoot, timeoutMs }) {
+      return ask({ provider: "claude", question, model: modelId, cwd: snapshotRoot, timeoutMs });
+    }
+  };
+}
+
+const CURSOR_AUTO_IDS = new Set(["auto", "cursor:auto", "cursor-auto"]);
+const CURSOR_AUTO_CANONICAL = "cursor:auto";
+const CURSOR_ANALYZE_TIMEOUT_MS = 180_000;
+
+export function createCursorBootstrapAnalyzerAdapter({ modelId, deps = {} } = {}) {
+  const listModels = deps.readCursorModels ?? defaultReadCursorModels;
+  const probeAuth = deps.probeCursorAuth ?? defaultProbeCursorAuth;
+  const getIsolation = deps.getCursorIsolationStatus ?? defaultGetCursorIsolationStatus;
+  const runSandboxed = deps.runCursorSandboxedBootstrap ?? defaultRunCursorSandboxedBootstrap;
+  const isAuto = modelId != null && CURSOR_AUTO_IDS.has(String(modelId).toLowerCase());
+  // Cursor Auto is a distinct, real candidate identity, never an implicit
+  // default for a missing selection — its own outcomes are ALWAYS
+  // attributed to this canonical "cursor:auto" id, never to a guessed
+  // inner model (Cursor never discloses which model actually answered in
+  // Auto mode). A caller must explicitly choose it.
+  const normalizedModelId = isAuto ? CURSOR_AUTO_CANONICAL : modelId;
+  return {
+    adapterId: "cursor",
+    modelId: normalizedModelId,
+    // Real eligibility — currently, honestly, negative. Real gates, none
+    // skipped or assumed:
+    //  1. A modelId must actually be provided — either a real explicit
+    //     model or the canonical "cursor:auto" opaque-router candidate;
+    //     an absent selection is never silently defaulted to either.
+    //  2. For an EXPLICIT model: checked against the real per-account
+    //     catalog (observability/cursor-models.js's readCursorModels — a
+    //     real `cursor-agent models` call, exit-status-checked). Cursor
+    //     Auto is exempt from this specific check (it's a routing mode,
+    //     not a listed catalog model) — but exempting the catalog check
+    //     must never also exempt authentication: `cursor-agent status`/
+    //     `whoami` do NOT reliably reflect whether a real invocation will
+    //     work (verified empirically — status can report "Logged in"
+    //     while a real -p call still fails with "Authentication
+    //     required"), so Auto is separately gated on
+    //     observability/cursor-auth.js's probeCursorAuth, a real
+    //     invocation-based probe, not the unreliable status/whoami claim.
+    //  3. Isolation proof, for BOTH explicit models and Cursor Auto alike:
+    //     Cursor's OWN --sandbox enabled does NOT confine reads (verified
+    //     empirically — a real out-of-bounds absolute-path read under
+    //     --sandbox enabled alone succeeded and disclosed real content).
+    //     The real boundary is cursor-sandbox.js's external macOS
+    //     sandbox-exec wrapper (mirroring codex-sandbox.js), independently
+    //     canary-tested and proven to hold: an in-bounds read succeeds, an
+    //     out-of-bounds one is denied ("Permission denied"). isolation:
+    //     "verified" + canaryTested: true only when that mechanism is
+    //     actually available (macOS + sandbox-exec present) — never on
+    //     any other platform, and never via Cursor's own --sandbox flag.
+    async checkEligibility() {
+      if (!modelId) {
+        return {
+          eligible: false,
+          reason: "No Cursor model selection was provided — pass an explicit model or \"cursor:auto\".",
+          isolation: "unverified", canaryTested: false
+        };
+      }
+      if (!isAuto) {
+        const catalog = await listModels();
+        if (catalog.status !== "measured") {
+          return {
+            eligible: false, reason: `Could not read Cursor's real model catalog: ${catalog.error ?? catalog.status}`,
+            isolation: "unverified", canaryTested: false
+          };
+        }
+        if (catalog.models.length === 0) {
+          return { eligible: false, reason: "No models are enabled for this Cursor account.", isolation: "unverified", canaryTested: false };
+        }
+        if (!catalog.models.some((m) => m.id === modelId)) {
+          return {
+            eligible: false, reason: `"${modelId}" is not in this account's real Cursor model catalog.`,
+            isolation: "unverified", canaryTested: false
+          };
+        }
+      } else {
+        const auth = await probeAuth();
+        if (auth.status !== "measured") {
+          return {
+            eligible: false, reason: `Could not determine whether Cursor Auto can actually be invoked: ${auth.reason ?? auth.status}`,
+            isolation: "unverified", canaryTested: false
+          };
+        }
+        if (!auth.authenticated) {
+          return { eligible: false, reason: auth.reason, isolation: "unverified", canaryTested: false };
+        }
+      }
+      const isolation = await getIsolation(deps.isolationDeps ?? {});
+      if (!isolation.available) {
+        return { eligible: false, reason: isolation.reason, isolation: "unverified", canaryTested: false };
+      }
+      return { eligible: true, isolation: "verified", canaryTested: true };
+    },
+    // Routed through cursor-sandbox.js's external sandbox-exec wrapper —
+    // never a bare `cursor-agent` spawn, since Cursor's own --sandbox
+    // enabled does not confine reads (see that module's header for the
+    // full empirical finding). Cursor Auto omits a model id; the wrapper
+    // itself omits --model entirely for that case.
+    async analyze({ question, snapshotRoot, timeoutMs = CURSOR_ANALYZE_TIMEOUT_MS }) {
+      return runSandboxed({
+        question, model: isAuto ? null : modelId, snapshotRoot, timeoutMs, deps: deps.isolationDeps ?? {}
+      });
+    }
+  };
+}
+
+const ADAPTER_FACTORIES = Object.freeze({
+  codex: createCodexBootstrapAnalyzerAdapter,
+  claude: createClaudeBootstrapAnalyzerAdapter,
+  cursor: createCursorBootstrapAnalyzerAdapter
+});
+
+/**
+ * @param {string} adapterId
+ * @param {{modelId: string, deps?: object}} [options]
+ * @returns {{adapterId: string, modelId: string, checkEligibility: Function, analyze: Function}}
+ */
+export function createBootstrapAnalyzerAdapter(adapterId, { modelId, deps = {} } = {}) {
+  const factory = ADAPTER_FACTORIES[adapterId];
+  if (!factory) {
+    const reason = `No Bootstrap Analyzer adapter implemented for "${adapterId}" yet.`;
+    return {
+      adapterId, modelId,
+      checkEligibility() { return { eligible: false, reason, isolation: "unverified", canaryTested: false }; },
+      async analyze() { throw new Error(reason); }
+    };
+  }
+  return factory({ modelId, deps });
+}

package/src/global/conversation/cli.js

@@ -0,0 +1,53 @@
+import { createConversationService } from "./service.js";
+import { printJson } from "../json-output.js";
+
+/**
+ * The scripted CLI's own preview/confirm contract, mirroring the cockpit
+ * and browser local UI exactly: no `--confirm` is always a read-only
+ * preview (service.planExecution — never reserves quota or starts a run);
+ * `--confirm` re-fetches that same preview fresh, right before executing,
+ * and executes exactly what it shows. PROJECT TEAM is the sole authority
+ * for execution — `--role` is required (never inferred from task text),
+ * and there is no `--model`/`--agent` override left to bypass it; only a
+ * confirmed `confirmationTarget` from the fresh preview ever reaches
+ * executePlan.
+ * @param {ReturnType<typeof createConversationService>} service
+ * @param {object} options
+ */
+async function runExecuteAction(service, options) {
+  if (!options.role) {
+    throw new Error(`Missing --role. PROJECT TEAM is the sole authority for execution — pick the real role this task is for (see /project or 'conversation snapshot' for the active team's roles).`);
+  }
+  const preview = await service.planExecution({ cwd: options.cwd, taskId: options.taskId, role: options.role });
+  if (!options.confirm) return preview;
+
+  if (!preview.confirmationTarget) {
+    throw new Error(`Cannot execute "${options.taskId}": ${preview.why}`);
+  }
+  return service.executePlan({ cwd: options.cwd, taskId: options.taskId, confirmationTarget: preview.confirmationTarget });
+}
+
+export async function runConversationCli(options, deps = {}) {
+  const service = deps.service ?? createConversationService(deps);
+  const action = options.conversationAction ?? "snapshot";
+  let result;
+  if (action === "snapshot") result = await service.snapshot({ cwd: options.cwd });
+  else if (action === "architect") {
+    result = await service.submitArchitecture({ cwd: options.cwd, task: options.task, model: options.model });
+  } else if (action === "show") {
+    result = await service.showPlan({ cwd: options.cwd, taskId: options.taskId });
+  } else if (action === "approve" || action === "reject") {
+    result = await service.decidePlan({
+      cwd: options.cwd,
+      taskId: options.taskId,
+      decision: action === "approve" ? "approved" : "rejected"
+    });
+  } else if (action === "execute") {
+    result = await runExecuteAction(service, options);
+  } else if (action === "cancel") {
+    result = await service.cancelExecution({ cwd: options.cwd, taskId: options.taskId });
+  } else throw new Error(`Unknown conversation action "${action}".`);
+  if (options.json) printJson(result);
+  else console.log(JSON.stringify(result, null, 2));
+  return result;
+}

package/src/global/conversation/codex-sandbox.js

@@ -0,0 +1,230 @@
+// Real OS-level filesystem confinement for the Codex CLI, used ONLY for
+// Bootstrap Analysis (conversation/service.js's runBootstrapAnalysis) —
+// general ASK (intelligence/quick-ask.js's askProvider) keeps using
+// Codex's own `--sandbox read-only`, which is NOT read-confining (see
+// sanitized-snapshot.js's header: it blocks writes only, a real absolute
+// path outside cwd is still readable). This module closes that specific
+// gap with an OS-enforced boundary instead of relying on redaction alone.
+//
+// Mechanism: wrap `codex exec` in an external `sandbox-exec` (macOS SBPL)
+// profile, and pass Codex `--dangerously-bypass-approvals-and-sandbox` so
+// Codex's OWN internal sandboxing is off — Codex's `--sandbox read-only`
+// internally re-invokes sandbox-exec per tool call, and nesting an outer
+// sandbox-exec around that breaks every tool call outright (verified
+// empirically: every Codex tool invocation failed with a sandbox_apply
+// error). With Codex's own sandbox disabled, the external profile becomes
+// the sole enforcement layer.
+//
+// Empirically proven, not assumed (see engram memory
+// "Codex sandbox-exec confinement proven for Bootstrap Analyst
+// isolation"): under this exact wrapper, a real `codex exec` run reads a
+// file inside the confined root correctly, and is denied
+// ("Operation not permitted") reading a file outside it via an absolute
+// path.
+//
+// HONEST LIMIT: SBPL applies uniformly to a sandboxed process and every
+// child it execs — there is no SBPL primitive that grants Codex's own
+// process read/write access to CODEX_HOME while denying that same access
+// to tools Codex spawns. Both are required: Codex fails hard ("failed to
+// initialize in-process app-server client: Operation not permitted",
+// verified empirically) without WRITE access to CODEX_HOME too, not just
+// read. So CODEX_HOME is fully readable and writable by the whole
+// confined tree, not just Codex's top-level process. This does not
+// weaken the actual isolation goal (nothing in that tree can escape the
+// snapshot boundary either way) — it only means a per-process auth/tool
+// split, as asked for in review, cannot be built on sandbox-exec alone.
+//
+// macOS only. Any other platform returns { available: false }; callers
+// must fail closed (isolation_unavailable) and never silently fall back
+// to Codex's own non-confining --sandbox read-only for Bootstrap Analysis.
+
+import { spawn as defaultSpawn } from "node:child_process";
+import { access, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { tmpdir, homedir } from "node:os";
+import { join } from "node:path";
+
+const SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+
+// Bootstrap Analysis is a real project investigation, not a quick
+// question — mirrors service.js's own BOOTSTRAP_ANALYST_TIMEOUT_MS.
+const DEFAULT_TIMEOUT_MS = 180_000;
+
+const SAFE_ENV_KEYS = Object.freeze([
+  "PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "LC_CTYPE",
+  "TMPDIR", "TERM", "CODEX_HOME", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+  "http_proxy", "https_proxy", "no_proxy", "NODE_EXTRA_CA_CERTS"
+]);
+
+function buildSandboxedCodexEnv(sourceEnv = process.env) {
+  const env = Object.create(null);
+  for (const key of SAFE_ENV_KEYS) {
+    if (sourceEnv[key] != null && sourceEnv[key] !== "") env[key] = sourceEnv[key];
+  }
+  return env;
+}
+
+function unknown(error) {
+  return { status: "error", answer: null, error: String(error) };
+}
+
+export async function isCodexSandboxSupported(deps = {}) {
+  if ((deps.platform ?? process.platform) !== "darwin") return false;
+  try {
+    await (deps.access ?? access)(SANDBOX_EXEC_PATH, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Real, checkable isolation status for Codex — never a hardcoded claim.
+ * `boundaryVerified` reflects that the sandbox-exec mechanism itself has
+ * been empirically proven (canary-denial test) on this platform, not that
+ * this specific call was independently re-verified.
+ */
+export async function getCodexIsolationStatus(deps = {}) {
+  const available = await isCodexSandboxSupported(deps);
+  return {
+    available,
+    platform: deps.platform ?? process.platform,
+    boundaryVerified: available,
+    reason: available
+      ? null
+      : "OS-level read confinement for Codex (sandbox-exec) is only implemented for macOS; Codex is not eligible for isolated Bootstrap Analysis on this platform."
+  };
+}
+
+async function resolvedForms(path, deps) {
+  const forms = new Set([path]);
+  try {
+    forms.add(await (deps.realpath ?? realpath)(path));
+  } catch {
+    // path may not exist yet — the literal form alone still covers it
+  }
+  return [...forms];
+}
+
+function subpathRules(paths) {
+  return paths.map((p) => `  (subpath "${p}")`).join("\n");
+}
+
+/**
+ * Builds a real SBPL profile confining reads/writes to `snapshotRoot` (the
+ * sanitized-snapshot.js temp copy the analyst investigates) plus
+ * `codexHome` (Codex's own auth config — without it the CLI can't
+ * authenticate at all) and the minimal system paths Codex needs to run.
+ * Resolves both the given path and its real path (handles macOS's
+ * /tmp -> /private/tmp and /var -> /private/var symlinks automatically,
+ * rather than hardcoding either form).
+ */
+export async function buildCodexSandboxProfile({ snapshotRoot, codexHome = join(homedir(), ".codex") }, deps = {}) {
+  const snapshotForms = await resolvedForms(snapshotRoot, deps);
+  const codexHomeForms = await resolvedForms(codexHome, deps);
+  const readableExtra = [
+    "/usr", "/System", "/bin", "/sbin", "/private/var/db/dyld", "/Library", "/opt", "/private/etc"
+  ];
+  return `(version 1)
+(deny default)
+(allow process-fork)
+(allow process-exec)
+(allow file-read-metadata (subpath "/"))
+(allow file-read-data (literal "/"))
+(allow file-read*
+${subpathRules([...snapshotForms, ...codexHomeForms, ...readableExtra])}
+  (literal "/dev/null")
+  (literal "/dev/urandom")
+  (literal "/dev/tty"))
+(allow file-write*
+${subpathRules([...snapshotForms, ...codexHomeForms, "/private/var/folders", "/private/tmp"])})
+(allow file-read-metadata (subpath "/private/var/folders"))
+(allow sysctl-read)
+(allow mach-lookup)
+(allow signal (target self))
+(allow network*)
+(allow system-socket)
+`;
+}
+
+/**
+ * Runs a real, OS-sandboxed Codex Bootstrap Analysis question. The ONLY
+ * intended caller is conversation/service.js's runBootstrapAnalysis.
+ * Fails closed with `status: "error", error: "isolation_unavailable"`
+ * (never a silent fallback to Codex's own non-confining --sandbox
+ * read-only) when this platform has no verified boundary.
+ * @param {object} args
+ * @param {string} args.question
+ * @param {string|null} [args.model]
+ * @param {string} args.snapshotRoot - sanitized-snapshot.js's temp copy
+ * @param {string} [args.codexHome]
+ */
+export async function runCodexSandboxedBootstrap({
+  question, model = null, snapshotRoot, codexHome = join(homedir(), ".codex"),
+  spawn = defaultSpawn, timeoutMs = DEFAULT_TIMEOUT_MS, sourceEnv = process.env, deps = {}
+}) {
+  const isolation = await getCodexIsolationStatus(deps);
+  if (!isolation.available) {
+    return { status: "error", answer: null, error: "isolation_unavailable", isolation };
+  }
+
+  let workDir;
+  try {
+    workDir = await (deps.mkdtemp ?? mkdtemp)(join(tmpdir(), "kairo-codex-sandbox-"));
+  } catch (error) {
+    return { ...unknown(error?.message ?? error), isolation };
+  }
+  const profilePath = join(workDir, "bootstrap.sb");
+  const outFile = join(workDir, "answer.txt");
+
+  try {
+    const profile = await buildCodexSandboxProfile({ snapshotRoot, codexHome }, deps);
+    await (deps.writeFile ?? writeFile)(profilePath, profile, "utf8");
+
+    // --skip-git-repo-check: snapshotRoot deliberately excludes .git.
+    // --ephemeral: no session files persisted to disk for this run.
+    // --ignore-user-config: doesn't load $CODEX_HOME/config.toml (auth
+    // itself still resolves via CODEX_HOME, per `codex exec --help`).
+    const args = [
+      "-f", profilePath, "codex", "exec",
+      "--dangerously-bypass-approvals-and-sandbox",
+      "--skip-git-repo-check", "--ephemeral", "--ignore-user-config",
+      "-o", outFile
+    ];
+    if (model) args.push("--model", model);
+    args.push(question);
+
+    const env = buildSandboxedCodexEnv(sourceEnv);
+    const result = await new Promise((resolve) => {
+      let child;
+      try {
+        child = spawn("sandbox-exec", args, { cwd: snapshotRoot, env, stdio: ["ignore", "pipe", "pipe"] });
+      } catch (error) {
+        resolve(unknown(error?.message ?? error));
+        return;
+      }
+      let finished = false;
+      const timer = setTimeout(() => finish(unknown("sandboxed codex exec timed out")), timeoutMs);
+      function finish(res) {
+        if (finished) return;
+        finished = true;
+        clearTimeout(timer);
+        try { child.kill?.(); } catch { /* best effort */ }
+        resolve(res);
+      }
+      child.once?.("error", (error) => finish(unknown(error?.message ?? error)));
+      child.once?.("close", async () => {
+        try {
+          const text = (await (deps.readFile ?? readFile)(outFile, "utf8")).trim();
+          if (!text) return finish(unknown("sandboxed codex exec produced no final message"));
+          finish({ status: "answered", answer: text, error: null });
+        } catch (error) {
+          finish(unknown(error?.message ?? error));
+        }
+      });
+    });
+    return { ...result, isolation };
+  } finally {
+    await (deps.rm ?? rm)(workDir, { recursive: true, force: true }).catch(() => {});
+  }
+}