@kylecheng3146/agent-ops 0.1.16 → 0.1.18

package/dist/runtime/src/review/execute.js

@@ -1,17 +1,26 @@
-import { mkdtemp, realpath, rm } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, mkdtemp, realpath, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { runVerificationCommand } from "../verify/spawn.js";
+import { redactSecrets } from "../security/redact.js";
 import { extractReviewObject } from "./extract.js";
 import { buildTargetInvocation } from "./invocation.js";
 import { reviewReportResults, reviewReportStatus, validateReviewReport } from "./report.js";
 import { detectHostTarget, orderChain } from "./roles.js";
-import { buildReviewPrompt } from "./runner.js";
-/** Full repository reviews need more headroom than the lightweight auth probe. */
-export const DEFAULT_REVIEW_TIMEOUT_MS = 300_000;
+import { buildAdversarialPrompt, buildReviewPrompt } from "./runner.js";
+/**
+ * Full repository reviews need far more headroom than the lightweight auth
+ * probe. Five minutes was not enough: reviewing a real working tree, codex and
+ * claude both exceeded it on this repository, and a timeout costs the whole
+ * review while looking like an unavailable target.
+ */
+export const DEFAULT_REVIEW_TIMEOUT_MS = 900_000;
+// USER is load-bearing, not cosmetic: a credential store keyed by account name
+// — the macOS keychain claude reads — cannot be opened without it, and its
+// absence surfaces as "Not logged in" on an install that is logged in.
 const EXECUTION_ENV = [
     "PATH", "PATHEXT", "SystemRoot", "SYSTEMROOT", "WINDIR", "COMSPEC",
-    "LANG", "LC_ALL", "TERM", "TMPDIR", "TEMP", "TMP"
+    "LANG", "LC_ALL", "TERM", "TMPDIR", "TEMP", "TMP", "USER"
 ];
 const AUTH_ENV = {
     claude: ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"],
@@ -26,7 +35,15 @@ export function isolatedReviewEnvironment(target, directory, source) {
             env[key] = value;
         }
     }
-    if (target === "agy") {
+    // claude and agy read their credentials out of the invoking user's home, so
+    // replacing it does not isolate them — it only makes them report "not logged
+    // in" on an install that is logged in. claude is isolated by its own flags
+    // instead: `--safe-mode` disables CLAUDE.md, skills, plugins, hooks, MCP
+    // servers and custom agents while explicitly keeping auth. codex keeps a
+    // replaced home because CODEX_HOME carries its credentials separately, so
+    // the isolation costs it nothing. agy uses its native sandbox and plan mode,
+    // but keeps its home because that is where its OAuth session lives.
+    if (target === "agy" || target === "claude") {
         env.HOME = source.HOME ?? directory;
         env.USERPROFILE = source.USERPROFILE ?? env.HOME;
         env.XDG_CONFIG_HOME = source.XDG_CONFIG_HOME ?? join(env.HOME, ".config");
@@ -47,17 +64,15 @@ export function isolatedReviewEnvironment(target, directory, source) {
     }
     return env;
 }
+/** Only eligible targets appear: an ineligible one never reaches this gate. */
 const REQUIRED_HELP_FLAGS = {
     claude: [
         "--add-dir", "--permission-mode", "--no-session-persistence",
         "--safe-mode", "--disable-slash-commands", "--json-schema"
     ],
+    agy: ["--add-dir", "--sandbox", "--mode", "--json-schema", "--log-file"],
     codex: [
         "--cd", "--ephemeral", "--ignore-user-config", "--ignore-rules"
-    ],
-    agy: [
-        "--add-dir", "--sandbox", "--mode", "--disable-slash-commands",
-        "--json-schema"
     ]
 };
 /**
@@ -69,133 +84,329 @@ const ADVANCING = new Set([
     "spawn-failed",
     "timeout"
 ]);
+const DIAGNOSTIC_MAX_CHARS = 200;
+/**
+ * The target's first line of complaint, redacted and clipped. It travels on the
+ * attempt record rather than only in a progress line, because progress is
+ * suppressed under `--json`: a machine consumer would otherwise be left with
+ * the bare authentication guess this exists to qualify. Never evidence.
+ */
+function firstComplaint(...streams) {
+    for (const stream of streams) {
+        const line = redactSecrets(stream)
+            .split(/\r?\n/u)
+            .map((value) => value.trim())
+            .find((value) => value.length > 0);
+        if (line !== undefined) {
+            return line.slice(0, DIAGNOSTIC_MAX_CHARS);
+        }
+    }
+    return undefined;
+}
+function rejectedCallReason(output) {
+    if (/\b(?:quota|rate limit|usage limit|too many requests)\b/iu.test(output)) {
+        return "quota-exhausted";
+    }
+    if (/\b(?:not logged in|login required|log in to|authentication required|unauthenticated|unauthorized)\b/iu.test(output) ||
+        /\b(?:invalid|expired)\s+(?:api key|token|credential)/iu.test(output) ||
+        /\b401\b/u.test(output)) {
+        return "login-required";
+    }
+    return "capability-unavailable";
+}
+async function snapshotRepository(request, destination, options) {
+    const cloned = await runVerificationCommand({
+        id: `review-snapshot-${request.label}`,
+        command: "git",
+        args: ["clone", "--no-hardlinks", "--quiet", "--", request.repositoryRoot, destination],
+        cwd: dirname(destination),
+        required: true,
+        evidence: { kind: "exit-code" },
+        timeoutMs: Math.min(options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS, 60_000)
+    }, {
+        cwd: dirname(destination),
+        ...(options.runner === undefined ? {} : { runner: options.runner })
+    });
+    if (cloned.status !== "PASS") {
+        return firstComplaint(cloned.stderr, cloned.stdout) ??
+            `git clone failed (${cloned.failureClass})`;
+    }
+    for (const path of request.changedFiles ?? []) {
+        const source = join(request.repositoryRoot, path);
+        const target = join(destination, path);
+        try {
+            const stat = await lstat(source);
+            if (!stat.isFile()) {
+                return `changed path is not a regular file: ${path}`;
+            }
+            await mkdir(dirname(target), { recursive: true });
+            await copyFile(source, target);
+            await chmod(target, stat.mode & 0o777);
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+                await rm(target, { recursive: true, force: true });
+                continue;
+            }
+            throw error;
+        }
+    }
+    return undefined;
+}
+/**
+ * One target's attempt at one prompt, in a throwaway home directory. Returns a
+ * validated report or the reason this target produced no usable verdict; the
+ * caller decides whether that reason is worth advancing past.
+ */
+async function attemptTarget(request, options) {
+    const { target } = request;
+    const skip = (reason, diagnostic, verb = "trying next target") => ({
+        kind: "skip",
+        reason,
+        diagnostic,
+        message: `${target}: ${reason} → ${verb} (${diagnostic})`
+    });
+    const attemptDirectory = await mkdtemp(join(tmpdir(), "agent-ops-review-"));
+    try {
+        const invocationRequest = {
+            target,
+            prompt: request.prompt,
+            repositoryRoot: request.repositoryRoot,
+            ...(target === "agy"
+                ? { logFile: join(attemptDirectory, "agy.log") }
+                : {}),
+            ...(options.model === undefined ? {} : { model: options.model }),
+            ...(options.effort === undefined ? {} : { effort: options.effort })
+        };
+        let invocation = buildTargetInvocation(invocationRequest);
+        let executionDirectory = attemptDirectory;
+        if (invocation === undefined) {
+            return skip("capability-unavailable", "no read-only mode is available for this target", "skipping");
+        }
+        const environment = isolatedReviewEnvironment(target, attemptDirectory, options.env ?? process.env);
+        const capability = await runVerificationCommand({
+            id: `review-capability-${request.label}`,
+            command: invocation.command,
+            args: target === "codex" ? ["exec", "--help"] : ["--help"],
+            cwd: attemptDirectory,
+            required: true,
+            evidence: { kind: "exit-code" },
+            timeoutMs: Math.min(options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS, 10_000)
+        }, {
+            cwd: attemptDirectory,
+            ...(options.runner === undefined ? {} : { runner: options.runner }),
+            env: environment,
+            replaceEnv: true
+        });
+        const help = `${capability.stdout}\n${capability.stderr}`;
+        const missingFlags = (REQUIRED_HELP_FLAGS[target] ?? []).filter((flag) => !help.includes(flag));
+        if (capability.status !== "PASS" ||
+            capability.stdoutTruncated ||
+            capability.stderrTruncated ||
+            missingFlags.length > 0) {
+            // This gate is the one a renamed upstream flag trips, so it names the
+            // flags it could not find. Without them the skip is indistinguishable
+            // from an uninstalled CLI, in the human line and in the attempt record.
+            return skip("capability-unavailable", missingFlags.length > 0
+                ? `help output is missing ${missingFlags.join(", ")}`
+                : capability.stdoutTruncated || capability.stderrTruncated
+                    ? "help output exceeded the capture limit"
+                    : firstComplaint(capability.stderr, capability.stdout) ??
+                        `help probe failed (${capability.failureClass})`, "skipping");
+        }
+        if (target === "agy") {
+            const snapshotRoot = join(attemptDirectory, "repository");
+            const snapshotError = await snapshotRepository(request, snapshotRoot, options);
+            if (snapshotError !== undefined) {
+                return skip("capability-unavailable", snapshotError, "skipping");
+            }
+            invocation = buildTargetInvocation({
+                ...invocationRequest,
+                prompt: [
+                    `Repository root: ${snapshotRoot}`,
+                    "Run every repository-relative inspection in that directory.",
+                    "For terminal commands, use only git status, git diff, git log, or git show; " +
+                        "read specific files with file-reading tools instead of ls, find, cat, or rg.",
+                    request.prompt
+                ].join("\n"),
+                repositoryRoot: snapshotRoot
+            });
+            executionDirectory = snapshotRoot;
+        }
+        if (invocation === undefined) {
+            return skip("capability-unavailable", "review invocation disappeared", "skipping");
+        }
+        const spawned = await runVerificationCommand({
+            id: `review-${request.label}`,
+            command: invocation.command,
+            args: [...invocation.args],
+            cwd: executionDirectory,
+            required: true,
+            evidence: { kind: "exit-code" },
+            timeoutMs: options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS
+        }, {
+            cwd: executionDirectory,
+            ...(options.runner === undefined ? {} : { runner: options.runner }),
+            ...(options.outputLimitBytes === undefined
+                ? {}
+                : { outputLimitBytes: options.outputLimitBytes }),
+            stdin: invocation.stdin,
+            env: environment,
+            replaceEnv: true
+        });
+        if (ADVANCING.has(spawned.failureClass)) {
+            return {
+                ...skip("missing-cli", `the process did not complete: ${spawned.failureClass}`),
+                ...(spawned.failureClass === undefined
+                    ? {}
+                    : { attemptReason: spawned.failureClass })
+            };
+        }
+        if (spawned.stdoutTruncated ||
+            (spawned.stderrTruncated && target !== "codex")) {
+            return skip("output-too-large", `${spawned.stdoutTruncated ? "stdout" : "stderr"} exceeded the capture limit`);
+        }
+        if (spawned.failureClass === "nonzero-exit") {
+            const output = `${spawned.stderr}\n${spawned.stdout}`;
+            return skip(rejectedCallReason(output), firstComplaint(spawned.stderr, spawned.stdout) ??
+                `the call was rejected with exit ${spawned.exitCode ?? "unknown"} and no output`);
+        }
+        const payload = extractReviewObject(target, spawned.stdout);
+        const parsed = payload === undefined
+            ? undefined
+            : validateReviewReport(payload, request.expectedCriterionIds, request.changedFiles);
+        if (parsed === undefined || !parsed.ok) {
+            const reason = parsed?.errors.some((error) => error.code === "INCOMPLETE_SCOPE") ? "incomplete-scope" : "unparseable-output";
+            // Which contract the answer broke, or what the target said instead of
+            // answering. Without this the skip names only the classification, and a
+            // target that runs but never returns a usable report is undebuggable.
+            const errors = parsed === undefined
+                ? ""
+                : parsed.errors
+                    .slice(0, 3)
+                    .map((error) => `${error.path}: ${error.code}`)
+                    .join("; ");
+            const fields = parsed?.errors.some((error) => error.code === "INVALID_FIELDS") &&
+                payload !== undefined
+                ? ` (fields: ${Object.keys(payload).sort().join(", ")})`
+                : "";
+            return skip(reason, errors.length > 0
+                ? `${errors}${fields}`
+                : firstComplaint(spawned.stdout, spawned.stderr) ??
+                    "the answer carried no review report");
+        }
+        return { kind: "verdict", report: parsed.value };
+    }
+    finally {
+        await rm(attemptDirectory, { recursive: true, force: true });
+    }
+}
 /**
  * Builds the `execute` callback `runIndependentReview` expects: walk the
- * configured targets in order and return the first real verdict.
+ * configured targets in order and return the first real verdict. A PASS is then
+ * handed to a different target to refute, so a single agreeable reviewer cannot
+ * wave a change through on its own.
  */
 export function createReviewExecutor(options) {
     const report = options.onProgress ?? (() => { });
     const host = detectHostTarget(options.env ?? process.env);
     const chain = orderChain(options.targets, host);
     return async (request) => {
-        const expected = request.invocation.packet.criteria.map((criterion) => criterion.id);
+        const expectedCriterionIds = request.invocation.packet.criteria.map((criterion) => criterion.id);
         const repositoryRoot = await realpath(options.cwd);
+        const shared = {
+            repositoryRoot,
+            expectedCriterionIds,
+            ...(request.invocation.scope?.changedFiles === undefined
+                ? {}
+                : { changedFiles: request.invocation.scope.changedFiles })
+        };
         const attempts = [];
         let lastReason = "missing-cli";
-        for (const [index, target] of chain.entries()) {
-            const attemptDirectory = await mkdtemp(join(tmpdir(), "agent-ops-review-"));
-            try {
-                const invocation = buildTargetInvocation({
+        /**
+         * Ask a target other than the one that passed — and other than the host —
+         * to refute the verdict. Returns undefined when no such target produced a
+         * report, which leaves the primary PASS standing unchallenged. Targets the
+         * primary pass already walked past are excluded: a CLI that could not
+         * answer the review prompt will not answer this one either.
+         */
+        const refute = async (primary, primaryTarget) => {
+            const walked = new Set(attempts.map((attempt) => attempt.target));
+            const candidates = chain.filter((target) => target !== primaryTarget && target !== host && !walked.has(target));
+            for (const [index, target] of candidates.entries()) {
+                const outcome = await attemptTarget({
+                    ...shared,
                     target,
-                    prompt: buildReviewPrompt({ ...request.invocation, harness: target }),
-                    repositoryRoot,
-                    ...(options.model === undefined ? {} : { model: options.model }),
-                    ...(options.effort === undefined ? {} : { effort: options.effort })
-                });
-                if (invocation === undefined) {
-                    lastReason = "capability-unavailable";
-                    attempts.push({ target, status: "NOT_RUN", reason: lastReason });
-                    report(`${target}: no read-only mode available → skipping`);
-                    continue;
-                }
-                if (target === host) {
-                    report(`${target}: reviewer == host; no independent target configured`);
-                }
-                const environment = isolatedReviewEnvironment(target, attemptDirectory, options.env ?? process.env);
-                const capability = await runVerificationCommand({
-                    id: `review-capability-${target}-${index}`,
-                    command: invocation.command,
-                    args: target === "codex" ? ["exec", "--help"] : ["--help"],
-                    cwd: attemptDirectory,
-                    required: true,
-                    evidence: { kind: "exit-code" },
-                    timeoutMs: Math.min(options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS, 10_000)
-                }, {
-                    cwd: attemptDirectory,
-                    ...(options.runner === undefined ? {} : { runner: options.runner }),
-                    env: environment,
-                    replaceEnv: true
-                });
-                if (capability.status !== "PASS" ||
-                    capability.stdoutTruncated ||
-                    capability.stderrTruncated ||
-                    REQUIRED_HELP_FLAGS[target].some((flag) => !`${capability.stdout}\n${capability.stderr}`.includes(flag))) {
-                    lastReason = "capability-unavailable";
-                    attempts.push({ target, status: "NOT_RUN", reason: lastReason });
-                    report(`${target}: required CLI capabilities unavailable → skipping`);
-                    continue;
-                }
-                const spawned = await runVerificationCommand({
-                    id: `review-${target}-${index}`,
-                    command: invocation.command,
-                    args: [...invocation.args],
-                    cwd: attemptDirectory,
-                    required: true,
-                    evidence: { kind: "exit-code" },
-                    timeoutMs: options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS
-                }, {
-                    cwd: attemptDirectory,
-                    ...(options.runner === undefined ? {} : { runner: options.runner }),
-                    ...(options.outputLimitBytes === undefined
-                        ? {}
-                        : { outputLimitBytes: options.outputLimitBytes }),
-                    stdin: invocation.stdin,
-                    env: environment,
-                    replaceEnv: true
-                });
-                if (ADVANCING.has(spawned.failureClass)) {
-                    lastReason = "missing-cli";
+                    label: `adversarial-${target}-${index}`,
+                    prompt: buildAdversarialPrompt({ ...request.invocation, harness: target }, primary)
+                }, options);
+                if (outcome.kind === "skip") {
+                    // Recorded, not just reported: progress is suppressed under --json,
+                    // and without this a PASS with no `adversarial` field cannot be told
+                    // apart from a PASS that had no second target to challenge it.
                     attempts.push({
                         target,
                         status: "NOT_RUN",
-                        reason: spawned.failureClass ?? lastReason
+                        reason: outcome.attemptReason ?? outcome.reason,
+                        diagnostic: outcome.diagnostic
                     });
-                    report(`${target}: ${spawned.failureClass} → trying next target`);
-                    continue;
-                }
-                if (spawned.stdoutTruncated ||
-                    (spawned.stderrTruncated && target !== "codex")) {
-                    lastReason = "output-too-large";
-                    attempts.push({ target, status: "NOT_RUN", reason: lastReason });
-                    report(`${target}: ${lastReason} → trying next target`);
-                    continue;
-                }
-                if (spawned.failureClass === "nonzero-exit") {
-                    lastReason = "login-required";
-                    attempts.push({ target, status: "NOT_RUN", reason: lastReason });
-                    report(`${target}: ${lastReason} → trying next target`);
-                    continue;
-                }
-                const payload = extractReviewObject(target, spawned.stdout);
-                const parsed = payload === undefined
-                    ? undefined
-                    : validateReviewReport(payload, expected, request.invocation.scope?.changedFiles);
-                if (parsed === undefined || !parsed.ok) {
-                    lastReason = parsed?.errors.some((error) => error.code === "INCOMPLETE_SCOPE") ? "incomplete-scope" : "unparseable-output";
-                    attempts.push({ target, status: "NOT_RUN", reason: lastReason });
-                    report(`${target}: ${lastReason} → trying next target`);
+                    report(`${target}: adversarial re-check unavailable (${outcome.reason})`);
                     continue;
                 }
-                const reportValue = parsed.value;
-                const results = reviewReportResults(reportValue);
-                const status = reviewReportStatus(reportValue);
-                attempts.push({ target, status });
-                return {
-                    status,
-                    results,
-                    report: reportValue,
-                    harness: target,
-                    attempts,
-                    independence: host === undefined
-                        ? "unknown"
-                        : host === target
-                            ? "same-target"
-                            : "different-target"
-                };
+                const refuted = reviewReportStatus(outcome.report) === "FAIL";
+                report(`${target}: adversarial re-check ${refuted ? "refuted the PASS" : "upheld the PASS"}`);
+                return { target, refuted, report: outcome.report };
+            }
+            if (candidates.length > 0) {
+                report("no independent target completed an adversarial re-check");
+            }
+            return undefined;
+        };
+        for (const [index, target] of chain.entries()) {
+            if (target === host) {
+                report(`${target}: reviewer == host; no independent target configured`);
+            }
+            const outcome = await attemptTarget({
+                ...shared,
+                target,
+                label: `${target}-${index}`,
+                prompt: buildReviewPrompt({ ...request.invocation, harness: target })
+            }, options);
+            if (outcome.kind === "skip") {
+                lastReason = outcome.reason;
+                attempts.push({
+                    target,
+                    status: "NOT_RUN",
+                    reason: outcome.attemptReason ?? outcome.reason,
+                    diagnostic: outcome.diagnostic
+                });
+                report(outcome.message);
+                continue;
             }
-            finally {
-                await rm(attemptDirectory, { recursive: true, force: true });
+            const reportValue = outcome.report;
+            const status = reviewReportStatus(reportValue);
+            attempts.push({ target, status });
+            const independence = host === undefined
+                ? "unknown"
+                : host === target
+                    ? "same-target"
+                    : "different-target";
+            const verdict = {
+                results: reviewReportResults(reportValue),
+                report: reportValue,
+                harness: target,
+                attempts,
+                independence
+            };
+            if (status === "FAIL") {
+                return { status, ...verdict };
             }
+            const adversarial = await refute(reportValue, target);
+            return {
+                status: adversarial?.refuted === true ? "FAIL" : "PASS",
+                ...verdict,
+                ...(adversarial === undefined ? {} : { adversarial })
+            };
         }
         return {
             status: "NOT_RUN",

package/dist/runtime/src/review/extract.js

@@ -21,6 +21,11 @@ function parseObject(text) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** Agy appends plan UI metadata even when native JSON Schema is enabled. */
+function withoutAgyPlanMetadata(value) {
+    const { toolAction: _toolAction, toolSummary: _toolSummary, ...report } = value;
+    return report;
+}
 /**
  * The model's answer as text, before any JSON contract is applied. Returns
  * undefined rather than throwing so the caller can report
@@ -63,7 +68,10 @@ export function extractReviewObject(target, stdout) {
     const key = target === "claude" ? "structured_output" : "response";
     const value = envelope?.[key];
     if (isRecord(value)) {
-        return value;
+        return target === "agy" ? withoutAgyPlanMetadata(value) : value;
     }
-    return typeof value === "string" ? extractJsonObject(value) : undefined;
+    const parsed = typeof value === "string" ? extractJsonObject(value) : undefined;
+    return parsed === undefined || target !== "agy"
+        ? parsed
+        : withoutAgyPlanMetadata(parsed);
 }

package/dist/runtime/src/review/invocation.js

@@ -11,8 +11,44 @@ function reviewSchemaPath() {
         ? source
         : resolve(process.cwd(), "schemas", "review-report.schema.json");
 }
+/**
+ * Removes every `pattern`. A target validates the schema with its own regex
+ * engine before it will run, and Go's RE2 — agy's — rejects constructs ECMA-262
+ * allows: it refused `/$defs/path` for a lookahead, then `/$defs/text` for a
+ * `\uXXXX` escape. Enumerating those differences is a losing game, and the
+ * schema handed to a target only shapes its answer: `validateReviewReport` is
+ * the authority and re-applies every pattern to whatever comes back, so an
+ * advisory constraint dropped here weakens nothing.
+ */
+function stripPatterns(value) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            stripPatterns(item);
+        }
+        return;
+    }
+    if (typeof value !== "object" || value === null) {
+        return;
+    }
+    const record = value;
+    delete record.pattern;
+    for (const item of Object.values(record)) {
+        stripPatterns(item);
+    }
+}
+/**
+ * The schema as a reviewer CLI will accept it. The file keeps its `$schema`
+ * declaration for this repository's own validation, but a target that resolves
+ * meta-schema references offline rejects the whole schema over it — claude
+ * answers `--json-schema is not a valid JSON Schema: no schema with key or ref
+ * "https://json-schema.org/draft/2020-12/schema"` and never starts. The draft
+ * declaration carries no constraint, so dropping it costs nothing.
+ */
 function reviewSchemaText() {
-    return readFileSync(reviewSchemaPath(), "utf8");
+    const parsed = JSON.parse(readFileSync(reviewSchemaPath(), "utf8"));
+    delete parsed.$schema;
+    stripPatterns(parsed);
+    return JSON.stringify(parsed);
 }
 /**
  * Read-only enforcement per target, verified against each CLI's own help
@@ -20,12 +56,22 @@ function reviewSchemaText() {
  * agent that can edit the code it is reviewing. This is what excludes
  * opencode, whose `--agent plan` is rejected as a subagent and silently falls
  * back to a writable agent.
+ *
+ * Agy can still mutate its cwd in sandboxed plan mode, so the executor points
+ * it at a disposable repository clone. Never combine this with
+ * `--dangerously-skip-permissions`, which overrides the permission boundary.
  */
 export const READ_ONLY_ARGS = {
     agy: ["--sandbox", "--mode", "plan"],
     claude: ["--permission-mode", "plan"],
     codex: ["-s", "read-only"]
 };
+/** Per-target customization suppression. */
+function isolationArgs(target) {
+    return target === "claude"
+        ? ["--no-session-persistence", "--safe-mode", "--disable-slash-commands"]
+        : [];
+}
 function modelArgs(target, model) {
     if (model === undefined) {
         return [];
@@ -73,15 +119,11 @@ export function buildTargetInvocation(request) {
             stdin: request.prompt
         };
     }
-    const isolation = request.target === "claude"
-        ? ["--no-session-persistence", "--safe-mode", "--disable-slash-commands"]
-        : request.target === "agy"
-            ? ["--disable-slash-commands"]
-            : [];
     return {
         command: request.target,
         args: [
             "-p",
+            ...(request.target === "agy" ? [request.prompt] : []),
             "--output-format",
             "json",
             "--json-schema",
@@ -89,10 +131,15 @@ export function buildTargetInvocation(request) {
             ...(request.repositoryRoot === undefined
                 ? []
                 : ["--add-dir", request.repositoryRoot]),
-            ...isolation,
+            ...(request.target !== "agy" || request.logFile === undefined
+                ? []
+                : ["--log-file", request.logFile]),
+            ...isolationArgs(request.target),
             ...shared
         ],
-        stdin: request.prompt
+        // Agy requires the prompt as the value of --print; a bare -p consumes the
+        // following flag. Claude accepts the prompt on stdin, keeping it out of ps.
+        stdin: request.target === "agy" ? "" : request.prompt
     };
 }
 /** A deep doctor probe uses stdin but keeps its simple text response contract. */
@@ -111,14 +158,19 @@ export function buildProbeInvocation(request) {
             stdin: request.prompt
         };
     }
-    const isolation = request.target === "claude"
-        ? ["--no-session-persistence", "--safe-mode", "--disable-slash-commands"]
-        : request.target === "agy"
-            ? ["--disable-slash-commands"]
-            : [];
     return {
         command: request.target,
-        args: ["-p", "--output-format", "json", ...isolation, ...readOnly],
-        stdin: request.prompt
+        args: [
+            "-p",
+            ...(request.target === "agy" ? [request.prompt] : []),
+            "--output-format",
+            "json",
+            ...(request.target !== "agy" || request.logFile === undefined
+                ? []
+                : ["--log-file", request.logFile]),
+            ...isolationArgs(request.target),
+            ...readOnly
+        ],
+        stdin: request.target === "agy" ? "" : request.prompt
     };
 }