@lyupro/codex-bridge 0.6.2 → 0.6.5

package/src/home/lib/budgets.mjs

@@ -0,0 +1,64 @@
+/**
+ * Resolves every role's wall-clock budget into a map of phase names to minutes.
+ *
+ * A run gets a hard wall-clock budget, because the caller's timeout is not a run contract:
+ * on 2026-08-03 one order restarted six times and spent 170,293 accounted tokens while four
+ * killed callers left their Codex processes and token spend unrecorded. Plan_59 D2 made the
+ * phase a runner concept: a number is shorthand for one `default` phase, and it is expanded
+ * here and nowhere else, so no consumer ever has to ask which of the two shapes it holds.
+ */
+import { AGENTS } from './agents.mjs';
+
+export function resolveBudgets(file, overrides = {}, registry = AGENTS) {
+  const roles = Object.values(registry).map(({ role }) => role);
+  if (!overrides || typeof overrides !== 'object' || Array.isArray(overrides)) {
+    throw new Error(`${file}: key “budgets” must be an object keyed by ${roles.join(', ')}, ` +
+      `each holding a positive number of minutes or a phase map, not ${JSON.stringify(overrides)}`);
+  }
+  const normalize = (budget, key, defaults) => {
+    if (typeof budget === 'string' && !budget.trim()) {
+      throw new Error(`${file}: key “${key}” is empty; remove the field to use the default, ` +
+        'or give it a positive number of minutes or a phase map');
+    }
+    const scalar = typeof budget === 'number';
+    // A number for a role with named phases would replace its whole map with `default`: the
+    // config would read cleanly and every run of that role would then be refused.
+    if (scalar && defaults && Object.keys(defaults).some((phase) => phase !== 'default')) {
+      throw new Error(`${file}: key “${key}” must be a phase map for this role, ` +
+        `e.g. {${Object.keys(defaults).map((phase) => `"${phase}": ${defaults[phase]}`).join(', ')}}, ` +
+        `not ${JSON.stringify(budget)}`);
+    }
+    if (scalar) budget = { default: budget };
+    if (!budget || typeof budget !== 'object' || Array.isArray(budget)) {
+      throw new Error(`${file}: key “${key}” must be a positive number of minutes or a phase map, ` +
+        `not ${JSON.stringify(budget)}`);
+    }
+    for (const [phase, minutes] of Object.entries(budget)) {
+      if (!phase.trim()) throw new Error(`${file}: key “${key}” has an empty phase name`);
+      if (defaults && !scalar && !Object.hasOwn(defaults, phase)) {
+        throw new Error(`${file}: key “${key}” has unknown phase “${phase}”. ` +
+          `Only ${Object.keys(defaults).join(', ')} are allowed`);
+      }
+      if (!Number.isFinite(minutes) || minutes <= 0) {
+        throw new Error(`${file}: key “${key}.${phase}” must be a positive number of minutes, ` +
+          `not ${JSON.stringify(minutes)}`);
+      }
+    }
+    // D2: a scalar is a default-only budget; only an object requests a partial phase override.
+    return { ...(scalar ? {} : defaults), ...budget };
+  };
+  const budgets = Object.fromEntries(Object.values(registry).map(({ role, budget }) => {
+    const phases = normalize(budget, `budgets.${role}`);
+    if (!Object.keys(phases).length) {
+      throw new Error(`${file}: key “budgets.${role}” must declare at least one phase`);
+    }
+    return [role, phases];
+  }));
+  for (const [role, budget] of Object.entries(overrides)) {
+    if (!roles.includes(role)) {
+      throw new Error(`${file}: key “budgets” has unknown role “${role}”. Only ${roles.join(', ')} are allowed`);
+    }
+    budgets[role] = normalize(budget, `budgets.${role}`, budgets[role]);
+  }
+  return budgets;
+}

package/src/home/lib/config-validate.mjs

@@ -1,5 +1,6 @@
 /** Shared by reading and editing so Plan_56 D27 cannot persist an unreadable config. */
 import { AGENTS } from './agents.mjs';
+import { resolveBudgets } from './budgets.mjs';
 
 const BUDGET_KEY = 'budgets';
 export const ROLES = Object.values(AGENTS).map(({ role }) => role);
@@ -31,7 +32,7 @@ export const DEFAULTS = {
   hooks: false,
   plugins: false,
   models: {},
-  budgets: Object.fromEntries(Object.values(AGENTS).map(({ role, budget }) => [role, budget])),
+  budgets: resolveBudgets('agent registry'),
   retention: DEFAULT_RETENTION,
   environmentPaths: DEFAULT_ENVIRONMENT_PATHS,
   answerLanguage: 'English',
@@ -88,43 +89,6 @@ function readRetention(file, value) {
   return { enabled: true, days: value.days };
 }
 
-/**
- * A run gets a hard wall-clock budget, because the caller's timeout is not a run contract:
- * on 2026-08-03 one order restarted six times and spent 170,293 accounted tokens while four
- * killed callers left their Codex processes and token spend unrecorded.
- */
-function readBudgets(file, value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(
-      `${file}: key “${BUDGET_KEY}” must be an object keyed by ${ROLES.join(', ')}, ` +
-        `each holding a positive number of minutes, not ${JSON.stringify(value)}`,
-    );
-  }
-  const budgets = { ...DEFAULTS.budgets };
-  for (const [role, minutes] of Object.entries(value)) {
-    if (!ROLES.includes(role)) {
-      throw new Error(
-        `${file}: key “${BUDGET_KEY}” has unknown role “${role}”. ` +
-          `Only ${ROLES.join(', ')} are allowed`,
-      );
-    }
-    if (typeof minutes === 'string' && !minutes.trim()) {
-      throw new Error(
-        `${file}: key “${BUDGET_KEY}.${role}” is empty; remove the field to use the default ` +
-          `(${DEFAULTS.budgets[role]} minutes), or give it a positive number of minutes`,
-      );
-    }
-    if (typeof minutes !== 'number' || !Number.isFinite(minutes) || minutes <= 0) {
-      throw new Error(
-        `${file}: key “${BUDGET_KEY}.${role}” must be a positive number of minutes, ` +
-          `not ${JSON.stringify(minutes)}`,
-      );
-    }
-    budgets[role] = minutes;
-  }
-  return budgets;
-}
-
 export function validateRunConfig(file, parsed) {
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
     throw new Error(`${file} must contain an object like {"hooks": false, "plugins": false}`);
@@ -145,7 +109,7 @@ export function validateRunConfig(file, parsed) {
       continue;
     }
     if (key === BUDGET_KEY) {
-      config[key] = readBudgets(file, value);
+      config[key] = resolveBudgets(file, value);
       continue;
     }
     if (key === RETENTION_KEY) {

package/src/home/lib/meta/advice-status.mjs

@@ -0,0 +1,61 @@
+/** Converts a finished advisor run into judge inputs because schemas accept well-formed agreement; Plan_59 D3/D4/D5/D10 require the judge to reject it. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { DEFAULTS } from '../run-config.mjs';
+import { judgeAdvice } from './advice-verdict.mjs';
+import { readJson } from './paths.mjs';
+
+function contractReason(reasons) {
+  const message = `advice contract broken (${reasons.length}): ${reasons.slice(0, 2).join('; ')}`;
+  return message.length <= 200 ? message : `${message.slice(0, 197)}...`;
+}
+
+export function adviceGap(runDir, result, eventData) {
+  const worker = readJson(path.join(runDir, 'worker.json')) || {};
+  const status = readJson(path.join(runDir, 'status.json')) || {};
+  const env = readJson(path.join(runDir, 'env.json')) || {};
+  const phase = worker.phase ?? status.phase;
+  const taskFile = path.join(runDir, 'advisor-task.json');
+  const task = readJson(taskFile);
+  const reasons = [];
+
+  if (!fs.existsSync(taskFile)) reasons.push('advisor-task.json is missing');
+  else if (!Array.isArray(task?.options) || !Array.isArray(task?.paths)) {
+    reasons.push('advisor-task.json is missing parsed options or paths');
+  }
+  if (phase !== 'scope' && phase !== 'advise') reasons.push('worker.json/status.json is missing a valid advisor phase');
+  if (typeof status.repo !== 'string' || !status.repo) reasons.push('status.json#repo is missing');
+  if (!Number.isInteger(eventData?.commands_executed) || eventData.commands_executed < 0) {
+    reasons.push('eventData.commands_executed is missing or invalid');
+  }
+  if (!result || typeof result !== 'object' || Array.isArray(result)) reasons.push('result.json is missing or is not an object');
+
+  let scopeResult;
+  if (phase === 'advise') {
+    if (typeof status.continued_from !== 'string' || !status.continued_from) {
+      reasons.push('status.json#continued_from for the phase-1 result is missing');
+    } else {
+      const scopeFile = path.join(path.dirname(runDir), status.continued_from, 'result.json');
+      scopeResult = readJson(scopeFile);
+      if (!scopeResult || typeof scopeResult !== 'object' || !Array.isArray(scopeResult.predicted_risks)) {
+        reasons.push('phase-1 result.json or its predicted_risks is missing');
+      }
+    }
+  }
+  if (reasons.length) return contractReason(reasons);
+
+  try {
+    const verdict = judgeAdvice({
+      phase,
+      result,
+      task,
+      repoRoot: status.repo,
+      commandsRun: eventData.commands_executed,
+      language: env.answerLanguage ?? DEFAULTS.answerLanguage,
+      scopeResult,
+    });
+    return verdict.ok ? null : contractReason(verdict.reasons);
+  } catch (error) {
+    return contractReason([`result.json is missing required fields or has an unexpected shape (${error.message})`]);
+  }
+}

package/src/home/lib/meta/advice-verdict.mjs

@@ -0,0 +1,226 @@
+/** Judges advisor evidence and independent decisions so Plan_59 D3/D4/D5/D10 failures cannot pass as advice. */
+import fs from 'node:fs';
+import path from 'node:path';
+
+const BACKSTOPS = {
+  English: ['both options are good', 'it depends on preference', 'you know better', 'either works'],
+  Russian: ['оба варианта хороши', 'зависит от предпочтений', 'вам виднее', 'подойдёт любой'],
+};
+const ADDRESS_TOKEN = /(?<![\p{L}\p{N}_./\\:~-])(?:[a-zA-Z]:)?[\p{L}\p{N}_@!$~.%+/\\-]+:\d+(?:-\d+)?(?![\p{L}\p{N}_:\d-])/gu;
+const QUOTED_ADDRESS = /`([^`\r\n]+:\d+(?:-\d+)?)`|"([^"\r\n]+:\d+(?:-\d+)?)"|'([^'\r\n]+:\d+(?:-\d+)?)'/u;
+const ADDRESS = new RegExp(`${QUOTED_ADDRESS.source}|(${ADDRESS_TOKEN.source})`, 'gu');
+
+function* strings(value, field = '') {
+  if (typeof value === 'string') yield { field, value };
+  else if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) yield* strings(item, `${field}[${index}]`);
+  } else if (value && typeof value === 'object') {
+    for (const [key, item] of Object.entries(value)) {
+      yield* strings(item, field ? `${field}.${key}` : key);
+    }
+  }
+}
+
+function backstopPattern(phrase) {
+  // Plan_59 D5 ignores punctuation within words as well as between words, without matching word prefixes.
+  const words = phrase.split(' ').map((word) => [...word].join('[\\p{P}\\p{S}]*'));
+  return new RegExp(`(?<![\\p{L}\\p{N}])${words.join('[\\s\\p{P}\\p{S}]+')}(?![\\p{L}\\p{N}])`, 'iu');
+}
+
+function isInside(root, absolute) {
+  const relative = path.relative(root, absolute);
+  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+function entryInRepo(root, raw) {
+  const normalized = raw.replace(/\\/g, '/').replace(/^(?:\.\/)+/, '');
+  if (path.posix.isAbsolute(normalized) || /^[a-z]:/i.test(normalized)) return null;
+  const absolute = path.resolve(root, normalized);
+  if (!isInside(root, absolute)) return null;
+  try {
+    // Plan_59 D3 requires real containment: a repository symlink cannot authorize outside evidence.
+    if (!isInside(fs.realpathSync(root), fs.realpathSync(absolute))) return null;
+    const stat = fs.statSync(absolute);
+    return {
+      absolute,
+      relative: path.relative(root, absolute).replace(/\\/g, '/'),
+      isFile: stat.isFile(),
+      isDirectory: stat.isDirectory(),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function lineCount(absolute) {
+  const text = fs.readFileSync(absolute, 'utf8');
+  if (!text) return 0;
+  const lines = text.split(/\r\n|\n|\r/);
+  return lines.length - (lines.at(-1) === '' ? 1 : 0);
+}
+
+function* addressesIn(value, root) {
+  for (const match of value.matchAll(ADDRESS)) {
+    const address = match.slice(1).find(Boolean);
+    if (!match[4]) {
+      // Plan_59 D3 must distinguish a quoted path with spaces from prose quoting several citations.
+      const embedded = [...address.matchAll(ADDRESS_TOKEN)].map((token) => token[0]);
+      const file = address.match(/^(.+):\d+(?:-\d+)?$/)[1];
+      if (embedded.length && !entryInRepo(root, file)?.isFile &&
+        (embedded.length > 1 || !/^[^\s]*[/\\]/.test(address))) {
+        yield* embedded;
+        continue;
+      }
+    }
+    yield address;
+  }
+}
+
+function citationProblem(raw, root, allowed) {
+  const match = raw.match(/^(.+):(\d+)(?:-(\d+))?$/);
+  if (!match) return 'use a repository-relative path:line or path:line-line address';
+  const entry = entryInRepo(root, match[1]);
+  if (!entry?.isFile) return 'cite an existing file under repoRoot';
+  let count;
+  try {
+    count = lineCount(entry.absolute);
+  } catch {
+    return 'cite a readable file under repoRoot';
+  }
+  const start = Number(match[2]);
+  const end = match[3] === undefined ? start : Number(match[3]);
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 1 || end < start || end > count) {
+    return `use an ascending line range within this file's ${count} lines`;
+  }
+  if (!allowed.some((scope) => entry.relative === scope.relative ||
+    (scope.isDirectory && (!scope.relative || entry.relative.startsWith(`${scope.relative}/`))))) {
+    return 'cite a task path or a scope missing_paths entry';
+  }
+  return null;
+}
+
+function checkCitations({ phase, result, task, repoRoot, scopeResult }, reasons) {
+  const root = path.resolve(repoRoot);
+  const allowed = [...task.paths, ...(phase === 'scope' ? result.missing_paths : scopeResult?.missing_paths ?? [])]
+    .map((raw) => entryInRepo(root, raw)).filter(Boolean);
+  const check = (field, address) => {
+    const problem = citationProblem(address, root, allowed);
+    if (problem) reasons.push(`D3 ${field} ${JSON.stringify(address)}: ${problem}.`);
+  };
+  const checkAddress = (field, raw) => {
+    const trimmed = raw.trim();
+    check(field, /^`.*`$/.test(trimmed) ? trimmed.slice(1, -1) : trimmed);
+  };
+  // D3 covers every address anywhere in the answer. A list of prose fields had to be edited by
+  // hand when `falsifier` became `pre_mortem`, and each new field would have joined it unchecked.
+  // Fields that ARE an address are checked whole below, so they are skipped here.
+  for (const { field, value } of strings(result)) {
+    if (/\.address$|\.early_check\.target$/.test(field)) continue;
+    for (const address of addressesIn(value, root)) check(field, address);
+  }
+  if (result.independent_checks) {
+    for (const [index, item] of result.independent_checks.entries()) {
+      checkAddress(`independent_checks[${index}].address`, item.address);
+    }
+  }
+  if (phase === 'advise') {
+    for (const [index, item] of result.assumptions.entries()) {
+      if (item.rating === 'VERIFIED' || item.address !== '') {
+        checkAddress(`assumptions[${index}].address`, item.address);
+      }
+    }
+    for (const [index, item] of result.pre_mortem.entries()) {
+      if (item.early_check.kind === 'inspect') {
+        checkAddress(`pre_mortem[${index}].early_check.target`, item.early_check.target);
+      }
+    }
+    // An outcome's address is evidence whether or not the phase-1 answer is at hand.
+    for (const [index, item] of result.risk_outcomes.entries()) {
+      checkAddress(`risk_outcomes[${index}].address`, item.address);
+    }
+  }
+}
+
+export function judgeAdvice({ phase, result, task, repoRoot, commandsRun, language, scopeResult }) {
+  if (phase !== 'scope' && phase !== 'advise') throw new RangeError('phase must be "scope" or "advise".');
+  if (!Number.isInteger(commandsRun) || commandsRun < 0) {
+    throw new TypeError('commandsRun must be a non-negative integer.');
+  }
+  if (typeof language !== 'string') throw new TypeError('language must be a string.');
+  if (typeof repoRoot !== 'string' || !repoRoot) throw new TypeError('repoRoot must be a non-empty path.');
+  if (!result || !Array.isArray(task?.options) || !Array.isArray(task?.paths)) {
+    throw new TypeError('result and a parsed advisor task are required.');
+  }
+  const reasons = [];
+  if (commandsRun === 0) reasons.push('D4 commandsRun 0: inspect repository evidence before answering.');
+  if (phase === 'scope') {
+    if (!result.taken_on_trust.length) {
+      reasons.push('D4 taken_on_trust []: name at least one assumption taken on trust.');
+    }
+    if (result.sufficient === false && !result.missing_paths.length) {
+      reasons.push('D4 missing_paths [] with sufficient false: name the paths needed for advice.');
+    }
+    if (result.sufficient === true && result.missing_paths.length) {
+      reasons.push(`D4 missing_paths ${JSON.stringify(result.missing_paths)} with sufficient true: resolve the scope contradiction.`);
+    }
+    const riskIds = new Set();
+    for (const [index, item] of result.predicted_risks.entries()) {
+      if (riskIds.has(item.id)) {
+        reasons.push(`D10 predicted_risks[${index}].id ${JSON.stringify(item.id)}: use a unique predicted risk id.`);
+      }
+      riskIds.add(item.id);
+    }
+  } else {
+    const ids = new Set(task.options.map(({ id }) => id));
+    const chosen = result.recommendation.option_id;
+    if (!ids.has(chosen) && chosen !== 'none-of-these') {
+      reasons.push(`D5 recommendation.option_id ${JSON.stringify(chosen)}: choose a task option id.`);
+    }
+    if (chosen === 'none-of-these') {
+      if (result.unlisted_option === 'none' || [...result.unlisted_option.trim()].length < 40) {
+        reasons.push(`D10 unlisted_option ${JSON.stringify(result.unlisted_option)}: describe an unlisted option in at least 40 characters.`);
+      }
+      const rejected = new Set(result.rejected.map(({ option_id }) => option_id));
+      const missing = [...ids].filter((id) => !rejected.has(id));
+      if (missing.length) {
+        reasons.push(`D10 rejected ${JSON.stringify(missing)}: reject every task option when recommending "none-of-these".`);
+      }
+    } else if (ids.has(chosen) && result.unlisted_option !== 'none') {
+      reasons.push(`D10 unlisted_option ${JSON.stringify(result.unlisted_option)}: use "none" when recommending a task option.`);
+    }
+    for (const [index, item] of result.rejected.entries()) {
+      if (!ids.has(item.option_id)) {
+        reasons.push(`D5 rejected[${index}].option_id ${JSON.stringify(item.option_id)}: use a task option id.`);
+      }
+      if (item.option_id === chosen) {
+        reasons.push(`D5 rejected[${index}].option_id ${JSON.stringify(chosen)}: do not reject the recommended option.`);
+      }
+    }
+    if (scopeResult !== undefined) {
+      const riskIds = new Set(scopeResult.predicted_risks.map(({ id }) => id));
+      for (const [index, item] of result.risk_outcomes.entries()) {
+        if (!riskIds.has(item.risk_id)) {
+          reasons.push(`D10 risk_outcomes[${index}].risk_id ${JSON.stringify(item.risk_id)}: use a scope predicted risk id.`);
+        }
+      }
+      for (const id of riskIds) {
+        const count = result.risk_outcomes.filter(({ risk_id }) => risk_id === id).length;
+        if (count !== 1) {
+          reasons.push(`D10 risk_outcomes ${JSON.stringify(id)} count ${count}: provide exactly one outcome per predicted risk.`);
+        }
+      }
+    }
+  }
+  checkCitations({ phase, result, task, repoRoot, scopeResult }, reasons);
+  const phrases = Object.hasOwn(BACKSTOPS, language) ? BACKSTOPS[language] : Object.values(BACKSTOPS).flat();
+  const patterns = phrases.map((phrase) => [phrase, backstopPattern(phrase)]);
+  for (const { field, value } of strings(result)) {
+    for (const [phrase, pattern] of patterns) {
+      const match = value.normalize('NFKC').match(pattern);
+      if (match) {
+        reasons.push(`D5 ${field} ${JSON.stringify(match[0])}: replace backstop phrase ${JSON.stringify(phrase)} with a decision.`);
+      }
+    }
+  }
+  return { ok: reasons.length === 0, reasons };
+}

package/src/home/lib/meta/advisor-task.mjs

@@ -0,0 +1,69 @@
+/** Parses blind advisor task choices so Plan_59 D5 rejects biased or ambiguous inputs before review. */
+const OPTION = /^\s*-\s+([a-z0-9][a-z0-9-]*):\s*(.*)$/;
+const PREFERENCE = /recommend|prefer|рекоменд|предпочт|\(✓\)|★/iu;
+
+function sections(text) {
+  if (typeof text !== 'string') throw new TypeError('Advisor task text must be a string.');
+  const found = { options: { header: null, lines: [] }, paths: { header: null, lines: [] } };
+  let current = null;
+  for (const [index, value] of text.split(/\r\n|\n|\r/).entries()) {
+    const line = { number: index + 1, value };
+    const heading = value.match(/^\s{0,3}(#{1,2})\s+(.+?)\s*$/);
+    if (heading) {
+      const name = heading[2].replace(/\s+#+$/, '').toLowerCase();
+      current = heading[1] === '##' && Object.hasOwn(found, name) ? found[name] : null;
+      if (current && !current.header) current.header = line;
+    } else if (current) {
+      current.lines.push(line);
+    }
+  }
+  return found;
+}
+
+function optionsFrom(lines) {
+  return lines.flatMap(({ value }) => {
+    const match = value.match(OPTION);
+    return match ? [{ id: match[1], description: match[2].trim() }] : [];
+  });
+}
+
+function pathsFrom(lines) {
+  return lines.flatMap(({ value }) => {
+    const match = value.match(/^\s*-\s+(.+?)\s*$/);
+    return match && match[1].trim() ? [match[1].trim()] : [];
+  });
+}
+
+export function parseAdvisorTask(text) {
+  const { options, paths } = sections(text);
+  return { options: optionsFrom(options.lines), paths: pathsFrom(paths.lines) };
+}
+
+function at(line) {
+  return `line ${line.number} ${JSON.stringify(line.value)}`;
+}
+
+export function advisorTaskRefusal(text) {
+  const { options, paths } = sections(text);
+  if (!options.header) return 'Options: add a "## Options" section with at least two options.';
+  const ids = new Set();
+  for (const line of options.lines) {
+    const preference = line.value.match(PREFERENCE);
+    if (preference) {
+      return `Options ${at(line)}: remove preference marker ${JSON.stringify(preference[0])} (D5).`;
+    }
+    if (!/^\s*[-*+](?:\s|$)/.test(line.value)) continue;
+    const match = line.value.match(OPTION);
+    if (!match) {
+      return `Options ${at(line)}: use "- option-id: description" with id matching [a-z0-9][a-z0-9-]*.`;
+    }
+    if (ids.has(match[1])) return `Options ${at(line)}: replace duplicate option id "${match[1]}".`;
+    ids.add(match[1]);
+  }
+  if (ids.size < 2) return `Options ${at(options.header)}: provide at least two distinct options.`;
+  if (!paths.header) return 'Paths: add a "## Paths" section with repository-relative paths.';
+  if (!pathsFrom(paths.lines).length) {
+    return `Paths ${at(paths.header)}: add at least one repository-relative path as a list item.`;
+  }
+  return null;
+}

package/src/home/lib/meta/events.mjs

@@ -157,6 +157,10 @@ export function readEvents(runDir) {
     // not an archived run.
     hasStream: exists,
     hasEvents: events.length > 0,
+    // The 2026-09-16 dead sandbox rejected every command; refused calls never enter the
+    // stream. Only completed items prove execution, including commands with nonzero exits.
+    commands_executed: events.filter((event) =>
+      event.type === 'item.completed' && event.item?.type === 'command_execution').length,
     tokens: accounting.tokens,
     usage: accounting.usage,
     session_id: started ? String(started.thread_id) : null,

package/src/home/lib/meta/launch-rows.mjs

@@ -0,0 +1,45 @@
+/** Reply rows about facts the launcher recorded in status.json before the run began. */
+import path from 'node:path';
+import { line, readJson } from './paths.mjs';
+
+function formatBytes(bytes) {
+  const units = ['B', 'KB', 'MB', 'GB'];
+  let value = bytes;
+  let index = 0;
+  while (value >= 1024 && index < units.length - 1) {
+    value /= 1024;
+    index += 1;
+  }
+  return `${value.toFixed(1)} ${units[index]}`;
+}
+
+function retentionReply(runDir) {
+  const retention = readJson(path.join(runDir, 'status.json'))?.retention;
+  const bytes = Number(retention?.bytes_freed);
+  const runs = Number(retention?.runs);
+  const days = Number(retention?.days);
+  if (!Number.isFinite(bytes) || bytes <= 0 || !Number.isFinite(runs) || runs <= 0
+    || !Number.isFinite(days) || days <= 0) return null;
+  return `Retention: freed ${formatBytes(bytes)} from ${runs} runs older than ${days} days`;
+}
+
+// Five copies of Retention missed writeFailure(), so both reply assemblers share this point.
+// The 2026-09-16 dead Codex sandbox incident is why the launcher probes the sandbox at all.
+export function launchRows(runDir) {
+  const retention = retentionReply(runDir);
+  const rows = retention ? [retention] : [];
+  const probe = readJson(path.join(runDir, 'status.json'))?.sandbox_probe;
+  if (probe?.outcome === 'inconclusive') {
+    const reason = line(probe.reason, 160) || 'no reason recorded';
+    rows.push(`Sandbox probe: inconclusive — ${reason} The run started without a sandbox check.`);
+  }
+  return rows;
+}
+
+export function withLaunchRows(rows, runDir) {
+  const launch = launchRows(runDir);
+  if (!launch.length) return rows;
+  let at = rows.findIndex((row) => row.includes('Log: '));
+  if (at === -1) at = rows.findIndex((row) => row.startsWith('Run: '));
+  return at === -1 ? [...rows, ...launch] : [...rows.slice(0, at), ...launch, ...rows.slice(at)];
+}