@kylecheng3146/agent-ops 0.3.7 → 0.4.1

package/dist/runtime/src/install/uninstall.js

@@ -6,6 +6,7 @@ import { formatInstallManifest, parseInstallManifest } from "../fs/manifest.js";
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { FileTransaction } from "../fs/transaction.js";
 import { planHookRemoval } from "./hooks.js";
+import { applyPreauth, planPreauth } from "./preauth.js";
 import { assertExpectedManagedBlock, assertSupportedManifestOwnership } from "./ownership.js";
 import { isOpencodeManagedPlugin } from "../adapters/opencode/config.js";
 import { isHarnessId } from "./harness.js";
@@ -207,7 +208,7 @@ async function planArtifactRemoval(root, artifact) {
         expectedHash: current.hash
     };
 }
-async function createFullUninstallPlan(root) {
+async function createFullUninstallPlan(root, options = {}) {
     const currentManifest = await readCurrentFile(root, MANIFEST_PATH);
     if (currentManifest === null) {
         return {
@@ -262,11 +263,19 @@ async function createFullUninstallPlan(root) {
         path: MANIFEST_PATH,
         expectedHash: currentManifest.hash
     });
+    const preauthorization = await planPreauth({
+        root,
+        scope: manifest.scope,
+        harness: manifest.harness,
+        desired: false,
+        ...(options.codexHome === undefined ? {} : { codexHome: options.codexHome })
+    });
     return {
         installed: true,
         manifest,
         manifestHash: currentManifest.hash,
-        operations
+        operations,
+        ...(preauthorization.length === 0 ? {} : { preauthorization })
     };
 }
 async function planLoopMarkerUpdate(root, marker, expected, remaining) {
@@ -300,7 +309,7 @@ async function planLoopMarkerUpdate(root, marker, expected, remaining) {
             }
     };
 }
-async function planSelectiveUninstall(root, currentManifest, manifest, expectedMarkers, selectedHarnesses) {
+async function planSelectiveUninstall(root, currentManifest, manifest, expectedMarkers, selectedHarnesses, planOptions = {}) {
     if (selectedHarnesses.length === 0 ||
         selectedHarnesses.some((id) => !isHarnessId(id)) ||
         new Set(selectedHarnesses).size !== selectedHarnesses.length ||
@@ -310,7 +319,7 @@ async function planSelectiveUninstall(root, currentManifest, manifest, expectedM
     const selected = selectedSet(selectedHarnesses);
     const remaining = manifest.harness.filter((id) => !selected.has(id));
     if (remaining.length === 0) {
-        return await createFullUninstallPlan(root);
+        return await createFullUninstallPlan(root, planOptions);
     }
     const operations = [];
     const removedArtifacts = manifest.artifacts.filter((artifact) => shouldRemove(artifactOwners(manifest, artifact), selected));
@@ -398,26 +407,34 @@ async function planSelectiveUninstall(root, currentManifest, manifest, expectedM
         content: formatInstallManifest(resultingManifest),
         expectedHash: currentManifest.hash
     });
+    const preauthorization = await planPreauth({
+        root,
+        scope: manifest.scope,
+        harness: selectedHarnesses,
+        desired: false,
+        ...(planOptions.codexHome === undefined ? {} : { codexHome: planOptions.codexHome })
+    });
     return {
         installed: true,
         manifest,
         manifestHash: currentManifest.hash,
         operations,
         selectedHarnesses,
-        resultingManifest
+        resultingManifest,
+        ...(preauthorization.length === 0 ? {} : { preauthorization })
     };
 }
-export async function createUninstallPlan(root, selectedHarnesses) {
+export async function createUninstallPlan(root, selectedHarnesses, options = {}) {
     if (selectedHarnesses === undefined) {
-        return await createFullUninstallPlan(root);
+        return await createFullUninstallPlan(root, options);
     }
     const currentManifest = await readCurrentFile(root, MANIFEST_PATH);
     if (currentManifest === null) {
-        return await createFullUninstallPlan(root);
+        return await createFullUninstallPlan(root, options);
     }
     const manifest = parseInstallManifest(currentManifest.content);
     const expectedMarkers = assertSupportedManifestOwnership(manifest, root);
-    return await planSelectiveUninstall(root, currentManifest, manifest, expectedMarkers, selectedHarnesses);
+    return await planSelectiveUninstall(root, currentManifest, manifest, expectedMarkers, selectedHarnesses, options);
 }
 function allowedPaths(plan) {
     if (plan.manifest === null) {
@@ -559,9 +576,9 @@ async function validateUninstalled(root, manifest, resultingManifest) {
         throw new AgentOpsError("UNINSTALL_VALIDATION_FAILED", "Installation manifest still exists.");
     }
 }
-export async function applyUninstallPlan(root, plan) {
+export async function applyUninstallPlan(root, plan, options = {}) {
     assertUninstallPlan(plan);
-    const currentPlan = await createUninstallPlan(root, plan.selectedHarnesses);
+    const currentPlan = await createUninstallPlan(root, plan.selectedHarnesses, options);
     if (JSON.stringify(currentPlan) !== JSON.stringify(plan)) {
         throw new AgentOpsError("INVALID_UNINSTALL_PLAN", "Uninstall plan no longer matches the current managed installation.");
     }
@@ -571,4 +588,5 @@ export async function applyUninstallPlan(root, plan) {
     }
     const transaction = new FileTransaction(root);
     await transaction.apply({ operations: plan.operations }, async () => await validateUninstalled(root, manifest, plan.resultingManifest));
+    await applyPreauth(plan.preauthorization ?? []);
 }

package/dist/runtime/src/install/update.js

@@ -124,6 +124,7 @@ export async function createUpdatePlan(options) {
             value: configPreview.migrated,
             sourceHash: configPreview.sourceHash
         },
+        ...(options.codexHome === undefined ? {} : { codexHome: options.codexHome }),
         ...(options.worktree === undefined
             ? {}
             : { worktree: options.worktree })

package/dist/runtime/src/parallel/enter.js

@@ -0,0 +1,43 @@
+import { readdir } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { canonicalPath } from "./guard.js";
+import { readWorktreeRecord, WORKTREE_DIRECTORY } from "./service.js";
+/**
+ * Whether Claude's EnterWorktree may switch this session into `path`. Only the
+ * worktree agent-ops recorded for the session is answered for the host, so an
+ * allow never lets the session move its permission root to a directory it did
+ * not get from `worktree add`.
+ */
+export async function evaluateWorktreeEnter(mainRoot, path, sessionId) {
+    if (sessionId === undefined) {
+        return { action: "continue", status: "UNKNOWN", code: "WORKTREE_ENTER_UNJUDGED" };
+    }
+    const directory = join(mainRoot, WORKTREE_DIRECTORY);
+    const target = await canonicalPath(path);
+    const name = relative(directory, target).split(sep)[0] ?? "";
+    const inside = !target.startsWith(`${directory}${sep}`) ? false : target === join(directory, name);
+    if (inside && (await readWorktreeRecord(target))?.sessionId === sessionId) {
+        return {
+            action: "continue",
+            status: "PASS",
+            code: "WORKTREE_ENTER_ALLOWED",
+            remedy: `${target} is the worktree agent-ops recorded for this session.`,
+            decision: "allow"
+        };
+    }
+    const owned = [];
+    for (const entry of await readdir(directory).catch(() => [])) {
+        if ((await readWorktreeRecord(join(directory, entry)))?.sessionId === sessionId) {
+            owned.push(join(directory, entry));
+        }
+    }
+    return {
+        action: "block",
+        status: "FAIL",
+        code: "WORKTREE_ENTER_DENIED",
+        remedy: `EnterWorktree may enter only a worktree this session owns. ` +
+            (owned.length > 0
+                ? `Yours: ${owned.join(", ")}.`
+                : `None yet: run agent-ops worktree add <name> --session ${sessionId} from ${mainRoot}.`)
+    };
+}

package/dist/runtime/src/parallel/finish.js

@@ -251,7 +251,8 @@ export async function finishWorktree(deps, options) {
                 await deps.tasks(record.path, base).complete(task.task.id, {});
             }
             catch (error) {
-                throw finishError("WORKTREE_TASK_INCOMPLETE", `Task ${task.task.id} (${task.task.title}) could not be completed against ${base}: ${error instanceof Error ? error.message : String(error)}`);
+                throw finishError("WORKTREE_TASK_INCOMPLETE", `Task ${task.task.id} (${task.task.title}) could not be completed against ${base}: ${error instanceof Error ? error.message : String(error)} ` +
+                    "A task another session left here is not this session's to archive: its owner finishes or archives it, and finish never does.");
             }
         }
         const worktreeGate = await deps.gate(record.path, worktreeConfig);

package/dist/runtime/src/parallel/guard.js

@@ -1,6 +1,6 @@
 import { realpath } from "node:fs/promises";
 import { basename, dirname, join, relative, sep } from "node:path";
-import { insideWorktreeDirectory } from "./service.js";
+import { insideWorktreeDirectory, readWorktreeRecord, WORKTREE_DIRECTORY } from "./service.js";
 /** The main checkout of the repository `runner` runs in, or null. */
 export async function resolveMainRoot(runner) {
     const result = await runner.run(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
@@ -47,6 +47,25 @@ ensureWorktree) {
     for (const path of paths) {
         const target = await canonicalPath(path);
         const inMain = target === mainRoot || target.startsWith(`${mainRoot}${sep}`);
+        if (inMain && insideWorktreeDirectory(mainRoot, target) && sessionId !== undefined) {
+            // A worktree belongs to the session that made it: writing into another
+            // session's mixes two tasks' changes into one review and one merge.
+            const name = relative(join(mainRoot, WORKTREE_DIRECTORY), target).split(sep)[0] ?? "";
+            const owner = (await readWorktreeRecord(join(mainRoot, WORKTREE_DIRECTORY, name)))?.sessionId;
+            if (owner !== undefined && owner !== sessionId) {
+                let own = "";
+                if (ensureWorktree !== undefined) {
+                    own = await ensureWorktree(sessionId).then((worktree) => ` Your own worktree is ${worktree}: edit there instead.`, () => "");
+                }
+                return {
+                    action: "block",
+                    status: "FAIL",
+                    code: "WORKTREE_OWNED_BY_OTHER_SESSION",
+                    remedy: `${join(mainRoot, WORKTREE_DIRECTORY, name)} belongs to another session (${owner}); ` +
+                        `this session is ${sessionId}.${own || " Run agent-ops worktree add <name> --session " + sessionId + " from " + mainRoot + " and edit in the printed path."}`
+                };
+            }
+        }
         if (inMain && !insideWorktreeDirectory(mainRoot, target)) {
             let failure = "";
             if (sessionId !== undefined && ensureWorktree !== undefined) {

package/dist/runtime/src/parallel/manage.js

@@ -154,6 +154,44 @@ export async function resumeWorktree(deps, options) {
     await bindSession(deps, record, mainConfig, RESUMED_BASELINE);
     return record;
 }
+/**
+ * Commits everything in the calling session's own worktree. Git runs from
+ * here rather than the shell, where a host cannot prove a command stays inside
+ * the worktree; that is also why it refuses anything that is not the caller's.
+ *
+ * ponytail: stages all changes, so an untracked file Git does not ignore goes
+ * in too; narrow it with a path list if that ever commits something unwanted.
+ */
+export async function commitWorktree(deps, options) {
+    const { mainRoot, currentRoot } = await resolveCheckouts(deps, options.cwd);
+    if (currentRoot === mainRoot) {
+        throw manageError("WORKTREE_COMMIT_MAIN", `worktree commit works only inside an agent-ops worktree; this is the main checkout (${mainRoot}).`);
+    }
+    const record = await readWorktreeRecord(currentRoot);
+    if (record === null) {
+        throw manageError("WORKTREE_COMMIT_UNRECORDED", `${currentRoot} is not an agent-ops worktree; see agent-ops worktree list.`);
+    }
+    if (options.sessionId === undefined) {
+        throw manageError("WORKTREE_COMMIT_SESSION_REQUIRED", "Cannot tell which session is committing; pass --session <id> or set AGENT_OPS_SESSION_ID.");
+    }
+    if (record.sessionId !== options.sessionId) {
+        throw manageError("WORKTREE_COMMIT_FOREIGN", `${record.path} belongs to session ${record.sessionId}, not ${options.sessionId}.`);
+    }
+    const step = async (args, code, message) => {
+        const result = await deps.git(record.path, args);
+        if (result.exitCode !== 0) {
+            const detail = result.stderr.trim().split("\n")[0];
+            throw manageError(code, detail === undefined || detail === "" ? message : `${message} ${detail}`);
+        }
+        return result.stdout.trim();
+    };
+    await step(["add", "-A"], "WORKTREE_COMMIT_FAILED", "Git could not stage the worktree.");
+    if ((await deps.git(record.path, ["diff", "--cached", "--quiet"])).exitCode === 0) {
+        throw manageError("WORKTREE_COMMIT_NOTHING", `${record.path} has no changes to commit.`);
+    }
+    await step(["commit", "-m", options.message], "WORKTREE_COMMIT_FAILED", "Git refused the commit.");
+    return { record, commit: await step(["rev-parse", "HEAD"], "WORKTREE_COMMIT_FAILED", "Git could not read the new commit.") };
+}
 /**
  * Deletes a worktree and its branch. Work that exists nowhere else — an
  * uncommitted change or a commit the target lacks — needs `force`.

package/dist/runtime/src/parallel/service.js

@@ -291,7 +291,9 @@ export async function addWorktree(deps, options) {
     const mainTrust = await deps.trust.status(mainRoot, mainConfig);
     const setupSteps = mainConfig.worktree?.setup ?? [];
     if (setupSteps.length > 0 && mainTrust !== "TRUSTED") {
-        throw worktreeError("WORKTREE_SETUP_UNTRUSTED", "worktree.setup runs repository commands; run agent-ops trust grant in the main checkout first.");
+        throw worktreeError("WORKTREE_SETUP_UNTRUSTED", "worktree.setup runs repository commands and the main checkout is not trusted: trust is bound to the config hash, " +
+            "so a hand edit of .agent-ops/config.json (adding worktree.setup, say) leaves it untrusted. " +
+            "Trust is the user's to grant, once: run agent-ops update in the main checkout, which lists the commands it will trust and asks.");
     }
     await ensureExcluded(deps, mainRoot, commonDir);
     await git(deps, mainRoot, ["worktree", "add", "-b", branch, path, base], "WORKTREE_ADD_FAILED", "Git could not create the worktree.");

package/dist/runtime/src/review/batch-guard.js

@@ -0,0 +1,11 @@
+import { collectChangeSurface, resolveGitCommit } from "../verify/change-surface.js";
+/**
+ * Remembers HEAD now and answers whether the batch may go on: HEAD is still
+ * that commit and the working tree has no change. The first answer doubles as
+ * the clean-tree check, since a batch reviews committed ranges only.
+ */
+export async function createSourceGuard(runner) {
+    const head = await resolveGitCommit(runner, "HEAD");
+    return async () => await resolveGitCommit(runner, "HEAD") === head &&
+        (await collectChangeSurface(runner)).paths.length === 0;
+}

package/dist/runtime/src/review/batch-select.js

@@ -0,0 +1,37 @@
+import { AgentOpsError } from "../fs/paths.js";
+/**
+ * The tasks one `batch --parent` covers: the parent's active subtasks in
+ * creation order, then the parent itself. Archived and completed tasks, and
+ * tasks under another parent, are left out.
+ */
+export function selectBatchTasks(records, parentId) {
+    const parent = records.find((record) => record.task.id === parentId);
+    if (parent === undefined) {
+        throw new AgentOpsError("BATCH_PARENT_NOT_FOUND", `Parent task not found: ${parentId}`);
+    }
+    if (parent.status !== "active") {
+        throw new AgentOpsError("BATCH_PARENT_NOT_ACTIVE", `Parent task is not active: ${parentId}`);
+    }
+    const subtasks = records
+        .filter((record) => record.task.parentTaskId === parentId && record.status === "active")
+        .sort((left, right) => left.createdAt.localeCompare(right.createdAt) || left.task.id.localeCompare(right.task.id));
+    return [...subtasks, parent];
+}
+/**
+ * An explicit flag wins, then the commit the task's last PASS review measured
+ * against (so a rerun reproduces the same fingerprint), then the worktree base.
+ * A parent's base is a human choice that cannot be derived from the repository.
+ */
+export function resolveBatchBase(record, isParent, input) {
+    const flag = isParent ? input.parentBase : input.base;
+    if (flag !== undefined) {
+        return { base: flag, source: "flag" };
+    }
+    if (record.reviewBase !== undefined) {
+        return { base: record.reviewBase, source: "recorded" };
+    }
+    if (input.worktreeBase !== undefined) {
+        return { base: input.worktreeBase, source: "worktree" };
+    }
+    throw new AgentOpsError("BATCH_BASE_UNKNOWN", `No base for task ${record.task.id}: pass ${isParent ? "--parent-base" : "--base"} or run from an agent-ops worktree.`);
+}

package/dist/runtime/src/review/batch.js

@@ -0,0 +1,202 @@
+import { AgentOpsError } from "../fs/paths.js";
+/**
+ * NOT_RUN reasons that mean the reviewer was briefly unavailable. Anything
+ * else (a sandboxed host, stale verification, a changed policy) fails the same
+ * way on a second attempt, so it is reported instead of retried.
+ */
+export const TRANSIENT_REVIEW_REASONS = new Set([
+    "probe-failed",
+    "stalled",
+    "timeout",
+    "quota-exhausted",
+    "network-unreachable"
+]);
+/** Reviews allowed at once when the caller names no width. */
+export const DEFAULT_BATCH_WIDTH = 2;
+/**
+ * Verify runs one task at a time (a full test run per task; several at once
+ * starve each other of CPU and fake a failure). Each task's review starts as
+ * soon as its own verify has passed, so the next verify overlaps it. Reviews
+ * run up to `width` at a time; a transient NOT_RUN drops the width to 1 for
+ * good and that task gets one more try alone after everything else finished.
+ */
+export async function runBatch(ids, deps, options) {
+    if (!Number.isInteger(options.width) || options.width < 1) {
+        throw new AgentOpsError("BATCH_INVALID_WIDTH", "Batch width must be a positive integer.");
+    }
+    const progress = options.onProgress ?? (() => { });
+    const controller = new AbortController();
+    const outer = options.signal;
+    if (outer?.aborted === true) {
+        controller.abort();
+    }
+    else {
+        outer?.addEventListener("abort", () => controller.abort(), { once: true });
+    }
+    const slots = new Map(ids.map((id) => [
+        id,
+        { id, verify: "not-run", review: null, retried: false }
+    ]));
+    const slot = (id) => slots.get(id);
+    const stop = (why) => {
+        if (!controller.signal.aborted) {
+            progress(why);
+            controller.abort();
+        }
+    };
+    const guard = async () => {
+        try {
+            return await deps.guard();
+        }
+        catch {
+            return false;
+        }
+    };
+    let width = options.width;
+    let running = 0;
+    let verifying = true;
+    const ready = [];
+    const retry = [];
+    let finish;
+    const done = new Promise((resolve) => {
+        finish = resolve;
+    });
+    const review = async (id, final) => {
+        if (!await guard()) {
+            stop("source changed; aborting the batch");
+            return;
+        }
+        const entry = slot(id);
+        if (final) {
+            entry.retried = true;
+        }
+        let result;
+        try {
+            result = await deps.review(id, controller.signal);
+        }
+        catch (error) {
+            progress(`review ${id} failed to run: ${error instanceof Error ? error.message : String(error)}`);
+            result = { status: "NOT_RUN", reason: "review-error" };
+        }
+        if (controller.signal.aborted) {
+            return;
+        }
+        entry.review = result;
+        if (!final &&
+            result.status === "NOT_RUN" &&
+            result.reason !== undefined &&
+            TRANSIENT_REVIEW_REASONS.has(result.reason)) {
+            if (width > 1) {
+                width = 1;
+                progress(`degrade: review width -> 1 (${id}: ${result.reason})`);
+            }
+            retry.push(id);
+        }
+    };
+    const pump = () => {
+        while (!controller.signal.aborted && running < width && ready.length > 0) {
+            const id = ready.shift();
+            running += 1;
+            void review(id, false).finally(() => {
+                running -= 1;
+                pump();
+            });
+        }
+        if (!verifying && running === 0 && (ready.length === 0 || controller.signal.aborted)) {
+            finish();
+        }
+    };
+    const fresh = await Promise.all(ids.map((id) => deps.isVerified(id).catch(() => false)));
+    const stale = [];
+    ids.forEach((id, index) => {
+        if (fresh[index] === true) {
+            slot(id).verify = "skipped";
+            ready.push(id);
+        }
+        else {
+            stale.push(id);
+        }
+    });
+    const verifyAll = async () => {
+        for (const id of stale) {
+            if (controller.signal.aborted) {
+                break;
+            }
+            if (!await guard()) {
+                stop("source changed; aborting the batch");
+                break;
+            }
+            let status;
+            try {
+                status = await deps.verify(id, controller.signal);
+            }
+            catch (error) {
+                progress(`verify ${id} failed to run: ${error instanceof Error ? error.message : String(error)}`);
+                status = "FAIL";
+            }
+            if (controller.signal.aborted) {
+                break;
+            }
+            slot(id).verify = status;
+            if (status === "PASS") {
+                ready.push(id);
+                pump();
+            }
+        }
+        verifying = false;
+        pump();
+    };
+    void verifyAll();
+    pump();
+    await done;
+    if (!controller.signal.aborted) {
+        for (const id of retry) {
+            if (controller.signal.aborted) {
+                break;
+            }
+            await review(id, true);
+        }
+    }
+    const interrupted = controller.signal.aborted;
+    return ids.map((id) => {
+        const entry = slot(id);
+        const pendingRetry = retry.includes(id) && !entry.retried;
+        const unfinished = entry.review === null
+            ? entry.verify !== "FAIL"
+            : pendingRetry;
+        return {
+            id,
+            verify: entry.verify,
+            review: entry.review,
+            retried: entry.retried,
+            aborted: interrupted && unfinished
+        };
+    });
+}
+/**
+ * One probe per target for a whole batch. Concurrent callers share the probe
+ * in flight and a success is kept, but a failure is forgotten so the retry of
+ * a task re-probes instead of inheriting the failure.
+ */
+export function memoizePreflight(probe) {
+    const cache = new Map();
+    return (target, budget) => {
+        const cached = cache.get(target);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const pending = probe(target, budget);
+        cache.set(target, pending);
+        const forget = () => {
+            if (cache.get(target) === pending) {
+                cache.delete(target);
+            }
+        };
+        pending.then((answer) => {
+            if ((typeof answer === "string" ? answer : answer.result) !== "ok") {
+                forget();
+            }
+        }, forget);
+        return pending;
+    };
+}

package/dist/runtime/src/review/execute.js

@@ -8,7 +8,7 @@ import { answeredNothing, conversationIdOf, deniedToolsOf, extractFinalMessage,
 import { buildTargetInvocation } from "./invocation.js";
 import { reviewReportResults, reviewReportStatus, validateReviewReport } from "./report.js";
 import { detectHostTarget, planReviewTargets } from "./roles.js";
-import { detectHostRestriction, isNetworkFailure } from "./host-sandbox.js";
+import { detectHostRestriction, isLoginFailure, isNetworkFailure } from "./host-sandbox.js";
 import { buildAdversarialPrompt, buildReviewPrompt } from "./runner.js";
 import { MAX_ADVERSARIAL_PROMPT_BYTES } from "./runner.js";
 import { extractUsage, sumUsage } from "./usage.js";
@@ -149,6 +149,8 @@ function preflightUnavailableReason(result) {
             return "capability-unavailable";
         case "capability-unavailable":
             return "capability-unavailable";
+        case "probe-failed":
+            return "probe-failed";
     }
 }
 /**
@@ -157,7 +159,7 @@ function preflightUnavailableReason(result) {
  * suppressed under `--json`: a machine consumer would otherwise be left with
  * the bare authentication guess this exists to qualify. Never evidence.
  */
-function firstComplaint(...streams) {
+export function firstComplaint(...streams) {
     for (const stream of streams) {
         const line = redactSecrets(stream)
             .split(/\r?\n/u)
@@ -176,9 +178,7 @@ function rejectedCallReason(output) {
     if (isNetworkFailure(output)) {
         return "network-unreachable";
     }
-    if (/\b(?:not logged in|login required|log in to|authentication required|unauthenticated|unauthorized)\b/iu.test(output) ||
-        /\b(?:invalid|expired)\s+(?:api key|token|credential)/iu.test(output) ||
-        /\b401\b/u.test(output)) {
+    if (isLoginFailure(output)) {
         return "login-required";
     }
     return "capability-unavailable";
@@ -740,15 +740,18 @@ export function createReviewExecutor(options) {
                         attempts: []
                     };
                 }
-                const result = await options.preflightTarget(target, {
+                const answer = await options.preflightTarget(target, {
                     timeoutMs: Math.max(1, remainingMs())
                 });
+                const result = typeof answer === "string" ? answer : answer.result;
                 if (result === "ok") {
                     preflight.push({ target, status: "PASS" });
                     continue;
                 }
                 const reason = preflightUnavailableReason(result);
-                const diagnostic = `target preflight returned ${result}`;
+                const complaint = typeof answer === "string" ? undefined : answer.diagnostic;
+                const diagnostic = `target preflight returned ${result}` +
+                    (complaint === undefined ? "" : `: ${complaint}`);
                 preflight.push({ target, status: "NOT_RUN", reason, diagnostic });
                 report(`${target}: preflight ${reason} (${diagnostic})`);
                 return {

package/dist/runtime/src/review/host-sandbox.js

@@ -11,6 +11,15 @@ const NETWORK_FAILURE = /\b(?:ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AG
 export function isNetworkFailure(output) {
     return NETWORK_FAILURE.test(output);
 }
+/**
+ * Only output that says so is a login problem. A CLI that dies for any other
+ * reason (a sandbox denying its state directory, a crash) used to be reported
+ * as "not logged in" too, which sent users to re-login a working install.
+ */
+const LOGIN_FAILURE = /\b(?:not logged in|login required|log in to|authentication required|unauthenticated|unauthorized)\b|\b(?:invalid|expired)\s+(?:api key|token|credential)|\b401\b/iu;
+export function isLoginFailure(output) {
+    return LOGIN_FAILURE.test(output);
+}
 /** The host each reviewer talks to, so a reachability check tests its real path. */
 export const TARGET_API_HOST = {
     agy: "cloudcode-pa.googleapis.com",

package/dist/runtime/src/review/invocation.js

@@ -161,11 +161,24 @@ export function buildTargetInvocation(request) {
     };
 }
 /** A deep doctor probe uses stdin but keeps its simple text response contract. */
+/**
+ * What the probe runs with where it differs from a review. The probe asks for
+ * one word, not a review, and agy's plan mode tells the model to research the
+ * task first: on a real project it explores, runs a command the headless user
+ * never allowed, is soft-denied, and prints nothing, which reads as
+ * `probe-failed`. In 40 replays, plan mode failed 4 of 20 and without it all 20
+ * answered in exactly two model calls. Only the probe drops it; a review keeps
+ * `READ_ONLY_ARGS`, and the sandbox stays on for both.
+ */
+const PROBE_ARGS = {
+    agy: ["--sandbox"]
+};
 export function buildProbeInvocation(request) {
-    const readOnly = READ_ONLY_ARGS[request.target];
-    if (readOnly === undefined || readOnly.length === 0) {
+    const eligible = READ_ONLY_ARGS[request.target];
+    if (eligible === undefined || eligible.length === 0) {
         return undefined;
     }
+    const readOnly = PROBE_ARGS[request.target] ?? eligible;
     if (request.target === "codex") {
         return {
             command: "codex",