@lyupro/codex-bridge 0.6.2 → 0.6.5

package/src/home/lib/runner/codex-cmd.mjs

@@ -11,7 +11,6 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { createHeartbeat, HEARTBEAT_INTERVAL_MS } from '../heartbeat.mjs';
-import { writeFailure } from '../write-meta.mjs';
 import { MAX_LOG } from './git-state.mjs';
 
 // Thirty seconds, not a fraction of one: after `exit` the pipe still holds whatever Codex wrote
@@ -20,6 +19,8 @@ import { MAX_LOG } from './git-state.mjs';
 // left no event". The grace exists to bound a grandchild holding stdio open forever (2026-08-06,
 // run 2026-08-06_204007_build waited 25 minutes), and thirty seconds bounds that just as well.
 const STDIO_DRAIN_GRACE_MS = 30_000;
+// Plan_57 D28: a stalled taskkill must not block probe or paid-run deadline settlement forever.
+const TASKKILL_TIMEOUT_MS = 10_000;
 
 /**
  * An argument cmd.exe cannot be handed safely, or undefined. `%` is fatal because cmd
@@ -30,6 +31,17 @@ const STDIO_DRAIN_GRACE_MS = 30_000;
 export const unsafeForCmd = (args) =>
   ['codex', ...args].find((a) => a.includes('%') || a.includes('"'));
 
+// Plan_57: preflight and paid runs must use the same Windows quoting and npm shim path.
+export function codexSpawnSpec(args, platform = process.platform) {
+  if (platform !== 'win32') return { command: 'codex', args, options: {} };
+  const cmdline = ['codex', ...args].map((a) => (/[\s&|<>^]/.test(a) ? `"${a}"` : a)).join(' ');
+  return {
+    command: process.env.ComSpec || 'cmd.exe',
+    args: ['/d', '/s', '/c', `"${cmdline}"`],
+    options: { windowsVerbatimArguments: true, windowsHide: true },
+  };
+}
+
 /**
  * Stop the process that owns the Codex invocation. On Windows that process is cmd.exe, so
  * child.kill() would reap only the shell and leave Codex spending quota as its grandchild —
@@ -44,10 +56,91 @@ export function stopCodex(child, onWindows = process.platform === 'win32') {
   const killed = spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], {
     stdio: 'ignore',
     windowsHide: true,
+    timeout: TASKKILL_TIMEOUT_MS,
   });
   if (killed.error || killed.status !== 0) child.kill();
 }
 
+// Plan_57 D28: keep spawnSync's 1 MiB default (stdout head, stderr tail); overflow is inconclusive, never dead.
+const CAPTURE_LIMIT_BYTES = 1024 * 1024;
+const CAPTURE_CLOSE_GRACE_MS = 2_000;
+const CAPTURE_STOP_GRACE_MS = 5_000;
+
+/**
+ * Plan_57 D24: async capture lets the deadline stop the whole Windows process tree,
+ * preventing the 2026-07-31 orphan that spawnSync's shell-only timeout leaves behind.
+ * Bounded pipe draining also prevents the inherited-stdio hang of 2026-08-06.
+ */
+export function spawnCaptured(command, args, options) {
+  const { timeout, encoding, shell, ...rest } = options ?? {};
+  if (typeof timeout !== 'number' || !Number.isFinite(timeout) || timeout <= 0) {
+    throw new TypeError('spawnCaptured requires a finite timeout greater than zero');
+  }
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { ...rest, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = Buffer.alloc(0);
+    let stderr = Buffer.alloc(0);
+    let captureError = null;
+    let settled = false;
+    let stopped = false;
+    let deadlineTimer;
+    let closeTimer;
+    let stopTimer;
+    const finish = (status, signal, error, destroyStreams = false) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadlineTimer);
+      clearTimeout(closeTimer);
+      clearTimeout(stopTimer);
+      if (destroyStreams) {
+        child.stdout.destroy();
+        child.stderr.destroy();
+        child.unref();
+      }
+      resolve({ status, signal, error, stdout: stdout.toString('utf8'), stderr: stderr.toString('utf8') });
+    };
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      stopCodex(child);
+    };
+    const onPipeError = (error) => {
+      if (settled) return;
+      stop();
+      finish(null, null, error, true);
+    };
+    child.stdout.on('error', onPipeError);
+    child.stderr.on('error', onPipeError);
+    child.stdout.on('data', (chunk) => {
+      const incoming = Buffer.from(chunk);
+      const room = CAPTURE_LIMIT_BYTES - stdout.length;
+      if (incoming.length > room && !captureError) {
+        captureError = Object.assign(new Error(`stdout exceeded ${CAPTURE_LIMIT_BYTES} bytes`), { code: 'ENOBUFS' });
+      }
+      if (room > 0) stdout = Buffer.concat([stdout, incoming.subarray(0, room)]);
+    });
+    child.stderr.on('data', (chunk) => {
+      stderr = Buffer.concat([stderr, Buffer.from(chunk)]);
+      if (stderr.length > CAPTURE_LIMIT_BYTES) stderr = stderr.subarray(-CAPTURE_LIMIT_BYTES);
+    });
+    child.on('error', (error) => finish(null, null, error, true));
+    child.on('close', (code, signal) => finish(code, signal, captureError));
+    child.on('exit', (code, signal) => {
+      if (settled) return;
+      clearTimeout(deadlineTimer);
+      clearTimeout(stopTimer);
+      closeTimer = setTimeout(() => finish(code, signal, captureError, true), CAPTURE_CLOSE_GRACE_MS);
+    });
+    deadlineTimer = setTimeout(() => {
+      captureError = Object.assign(new Error(`timed out after ${timeout} ms`), { code: 'ETIMEDOUT' });
+      stop();
+      if (!settled) {
+        stopTimer = setTimeout(() => finish(null, null, captureError, true), CAPTURE_STOP_GRACE_MS);
+      }
+    }, timeout);
+  });
+}
+
 /**
  * Windows npm ships `codex` as codex.cmd, and Node refuses to spawn .cmd without a
  * shell. One command line through cmd.exe keeps a single code path; every argument is
@@ -65,7 +158,7 @@ export function stopCodex(child, onWindows = process.platform === 'win32') {
 export function runCodex(args, taskText, eventsPath, budgetMinutes, graceMs = STDIO_DRAIN_GRACE_MS) {
   const onWindows = process.platform === 'win32';
   const deadlineMs =
-    typeof budgetMinutes === 'number' && Number.isFinite(budgetMinutes) && budgetMinutes > 0
+    Number.isFinite(budgetMinutes) && budgetMinutes > 0
       ? budgetMinutes * 60 * 1000
       : null;
   let exited = false;
@@ -129,21 +222,17 @@ export function runCodex(args, taskText, eventsPath, budgetMinutes, graceMs = ST
     return { append, finish };
   })();
 
-  let child;
   if (onWindows) {
     // Thrown rather than died: in the worker a bare exit would leave the run open, while a
     // throw goes through the crash handler and closes it with meta.json like any failure.
     const bad = unsafeForCmd(args);
     if (bad) throw new Error(`argument unsafe for cmd.exe (contains % or "): ${bad}`);
-    const cmdline = ['codex', ...args].map((a) => (/[\s&|<>^]/.test(a) ? `"${a}"` : a)).join(' ');
-    child = spawn(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', `"${cmdline}"`], {
-      windowsVerbatimArguments: true,
-      windowsHide: true,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-  } else {
-    child = spawn('codex', args, { stdio: ['pipe', 'pipe', 'pipe'] });
   }
+  const spec = codexSpawnSpec(args);
+  const child = spawn(spec.command, spec.args, {
+    ...spec.options,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
 
   return new Promise((resolve) => {
     let failed = false;
@@ -249,20 +338,17 @@ export function runCodex(args, taskText, eventsPath, budgetMinutes, graceMs = ST
 
 /**
  * Codex missing or not authorised is a deterministic FAIL, never a reason to improvise.
- * Runs after the folder exists so this failure is recorded like any other.
+ * Plan_58, 2026-09-19: return a reason for refusal before registration, like the dead-sandbox
+ * probe. One no-quota question must not have two answers about whether it leaves a folder.
  */
-export function requireCodex(runDir, agent) {
+export function codexUnavailableReason() {
   const probe = spawnSync(
     process.platform === 'win32' ? process.env.ComSpec || 'cmd.exe' : 'codex',
     process.platform === 'win32' ? ['/d', '/s', '/c', 'codex --version'] : ['--version'],
     { encoding: 'utf8' },
   );
   if (probe.error || probe.status !== 0) {
-    const why = (probe.stderr || probe.error?.message || 'codex --version is not responding').trim();
-    const { reply } = writeFailure(runDir, agent, `Codex CLI unavailable: ${why}`, [
-      'Operator check: codex --version (and codex login if authorization is rejected)',
-    ], true);
-    console.log(reply);
-    process.exit(1);
+    return (probe.stderr || probe.error?.message || 'codex --version is not responding').trim();
   }
+  return null;
 }

package/src/home/lib/runner/git-state.mjs

@@ -40,7 +40,12 @@ export function worktreeSnapshot(repo) {
   const skip = runsPrefixInside(repo);
   // The path is the third tab-separated field in both git outputs used here.
   const mine = (line) => Boolean(skip) && (line.split('\t')[2] || '').startsWith(skip);
-  const tracked = (git(repo, ['diff', 'HEAD', '--numstat']).stdout || '')
+  // `--no-renames` because every reader of this snapshot compares paths against a scope: with
+  // rename detection on, numstat prints one row spelled `old => new` (or `dir/{a => b}/file`),
+  // which is not a path and matches no pattern — an in-scope rename would be judged a stray, and
+  // the witness named that token at the orchestrator on 2026-09-20. Without it a rename is a
+  // deletion plus an addition: two rows, both real paths, both judged on their own merits.
+  const tracked = (git(repo, ['diff', 'HEAD', '--numstat', '--no-renames']).stdout || '')
     .split(/\r?\n/)
     .filter((line) => line.trim() && !mine(line))
     .join('\n')

package/src/home/lib/runner/launcher.mjs

@@ -15,7 +15,6 @@ import {
   writeStatus,
   markAbandoned,
   abandonedBranchDrift,
-  activeRunDetails,
   chainRuns,
   startedRuns,
   taskFingerprint,
@@ -28,18 +27,21 @@ import { parseArgs, die } from './args.mjs';
 import { settleTaskInput } from './task-input.mjs';
 import { parseContinuationGrant } from '../required-inputs.mjs';
 import { continuationRefusal } from './continuation.mjs';
-import { SCHEMAS } from './schemas.mjs';
+import { parseAdvisorTask } from '../meta/advisor-task.mjs';
+import { schemaFor } from './schemas.mjs';
 import { INSTRUCTIONS } from './prompts.mjs';
 import { git, headSha, branchName, worktreeSnapshot, reviewScope } from './git-state.mjs';
 import { agentRole } from '../agents.mjs';
 import { codexArgs, runProfile } from './codex-args.mjs';
 import { writeWorkerOrder } from './worker-order.mjs';
-import { requireCodex, unsafeForCmd } from './codex-cmd.mjs';
+import { unsafeForCmd } from './codex-cmd.mjs';
 import { runsRoot } from './runs-root.mjs';
 import { resolveProjectRunsDir } from './project-dir.mjs';
 import { cleanupRetention } from '../retention.mjs';
 import { renderConventions } from './conventions.mjs';
 import { validateScope } from './scope-check.mjs';
+import { probeSandbox, sandboxRefusal } from './sandbox-probe.mjs';
+import { preflightRefusal, resolveRunPhase, scopeRunRefusal, taskPreflight } from './preflight.mjs';
 
 /**
  * The worker is this same program re-invoked as `--worker <runDir>`, so the path spawned
@@ -86,13 +88,17 @@ export const runDirPath = (root, slug, runStamp = stamp()) => {
 /**
  * Everything a run needs before a single token of someone else's quota is spent, and every
  * refusal that costs nothing: bad arguments, an open chain without --continue, a busy
- * worktree, a missing Codex CLI. All of it happens here, in the process the caller is free
+ * worktree, a dead Codex sandbox, a missing Codex CLI. All in the process the caller is free
  * to kill — so a killed caller can only ever interrupt a run that was already paid for.
  */
 export async function launcher(argv = process.argv.slice(2)) {
   loadRunEnv();
   const opts = parseArgs(argv);
+  opts.phase = resolveRunPhase(opts, RUN_ENV.budgets);
   const taskText = settleTaskInput(opts);
+  // Plan_59 D5/D6: blind choices and design authority must be checked before the paid probe.
+  const taskGate = taskPreflight({ agent: opts.agent, taskText });
+  if (taskGate.refusal) die(taskGate.refusal, 1);
   const topLevel = git(opts.repo, ['rev-parse', '--show-toplevel']);
   const isGitRepo = topLevel.status === 0;
   const repoRoot = isGitRepo ? topLevel.stdout.trim() : opts.repo;
@@ -154,6 +160,10 @@ export async function launcher(argv = process.argv.slice(2)) {
     continuationGrant,
   );
   if (continuationError) die(continuationError);
+  // Plan_59 D14: the grant is valid by now; an advise pass may continue only an OK scope run.
+  const scopeRun = continuationGrant &&
+    scopeRunRefusal({ agent: opts.agent, phase: opts.phase, runsRoot: projectRunsRoot, grantRun: continuationGrant.run });
+  if (scopeRun) die(scopeRun, 1);
 
   // One order produced six Codex runs on 2026-08-03 because the caller's time ceiling made it
   // restart the synchronous launcher. A live same-order run is now the repeat target: attach
@@ -187,10 +197,19 @@ export async function launcher(argv = process.argv.slice(2)) {
     );
   }
 
-  // Asked before this run registers itself, so it cannot find itself. Two writing runs share
-  // one worktree with no isolation: the second one's before/after snapshot picks up the
-  // first one's edits, and an honest run gets failed for work it never did.
-  const busy = opts.agent === 'codex-build' ? activeRunDetails(projectRunsRoot, repoRoot) : null;
+  // Review 2026-09-17: the slow probe widened the window between the busy check and registration.
+  // Probe first so the busy check sees writers that registered while it waited.
+  // Keep dead refusal before retention to preserve old run artifacts.
+  const sandboxProbe = await probeSandbox({ agent: opts.agent, repo: repoRoot });
+  if (sandboxProbe.outcome === 'dead') die(sandboxRefusal(sandboxProbe));
+
+  // Everything that can refuse without touching the tree is asked here, after the probe so the
+  // busy check sees writers that registered while it waited, and before makeRunDir below: on
+  // 2026-09-19 a busy refusal left its folder inside ~/.claude and the live run's witness spent
+  // every tool call demanding the orchestrator revert a directory the tool itself had created.
+  // Exit 1, not the usage code 2: the order was correct, the host or the tree was not.
+  const preflightError = preflightRefusal({ agent: opts.agent, projectRunsRoot, repoRoot });
+  if (preflightError) die(preflightError, 1);
 
   let retention = null;
   try {
@@ -204,7 +223,7 @@ export async function launcher(argv = process.argv.slice(2)) {
   const runDir = makeRunDir(runDirPath(projectRunsRoot, opts.slug));
   setRun(runDir, opts.agent);
 
-  // Written before Codex is even probed. From here on a killed runner leaves a folder that
+  // Written before the worker can start. From here on a killed runner leaves a folder that
   // says what it was and whose pid to check, instead of a folder that says nothing — the run
   // itself takes 20-25 minutes, far longer than the caller's default timeout, so being killed
   // mid-run is the normal way for this to end, not the exotic one.
@@ -220,8 +239,10 @@ export async function launcher(argv = process.argv.slice(2)) {
     agent: opts.agent,
     slug: opts.slug,
     order_id: opts.orderId,
+    phase: opts.phase,
+    ...(taskGate.advice === undefined ? {} : { advice: taskGate.advice }),
     // Fingerprint of the order, so a later run of the same task finds this one whatever it
-    // calls itself. Written here, before Codex is probed, like everything the chain reads.
+    // calls itself. Written here, before Codex starts, like everything the chain reads.
     task_hash: taskHash,
     repo: repoRoot,
     started_at: new Date().toISOString(),
@@ -231,30 +252,13 @@ export async function launcher(argv = process.argv.slice(2)) {
     // `continued_from` is the exact run the orchestrator named; `continues` above remains the chain base.
     ...(continuationGrant ? { continued_from: continuationGrant.run } : {}),
     ...(retention ? { retention } : {}),
+    sandbox_probe: sandboxProbe,
   });
 
   // Printed before anything can go wrong: even a dispatcher that dies mid-run leaves the
   // orchestrator with a folder to look into.
   console.log(`RUN=${runDir} order-id=${opts.orderId}`);
 
-  // Before requireCodex, so a blocked run costs nothing at all.
-  if (busy) {
-    const identityNote = busy.identity === 'unverified'
-      ? '; process identity could not be confirmed'
-      : '';
-    const { reply } = writeFailure(
-      runDir,
-      opts.agent,
-      `run ${busy.run} is already active for this repository; two writing runs in one tree are prohibited${identityNote}`,
-      [`Active run: ${path.join(projectRunsRoot, busy.run)}`, 'Codex was not started; quota was not spent'],
-      true,
-    );
-    console.log(reply);
-    return 1;
-  }
-
-  requireCodex(runDir, opts.agent);
-
   const scope = opts.agent === 'codex-review' ? reviewScope(repoRoot, opts.changeset) : null;
   if (scope) {
     fs.writeFileSync(
@@ -270,6 +274,7 @@ export async function launcher(argv = process.argv.slice(2)) {
   if (opts.agent === 'codex-scout') {
     fs.writeFileSync(path.join(runDir, 'questions.json'), `${JSON.stringify(questions, null, 2)}\n`);
   }
+  if (opts.agent === 'codex-advisor') fs.writeFileSync(path.join(runDir, 'advisor-task.json'), `${JSON.stringify(parseAdvisorTask(taskText), null, 2)}\n`);
 
   if (opts.agent === 'codex-build') {
     fs.writeFileSync(path.join(runDir, 'scope.txt'), `${opts.scopePatterns.join('\n')}\n`);
@@ -315,7 +320,7 @@ export async function launcher(argv = process.argv.slice(2)) {
   fs.writeFileSync(path.join(runDir, 'task.md'), `${sections.join('\n\n')}\n`);
   fs.writeFileSync(
     path.join(runDir, 'schema.json'),
-    `${JSON.stringify(SCHEMAS[opts.agent], null, 2)}\n`,
+    `${JSON.stringify(schemaFor(opts.agent, opts.phase), null, 2)}\n`,
   );
 
   if (opts.agent === 'codex-build') {
@@ -348,7 +353,8 @@ export async function launcher(argv = process.argv.slice(2)) {
     repo: repoRoot,
     isGitRepo,
     launcherPid: process.pid,
-    budgetMinutes: RUN_ENV?.budgets?.[agentRole(opts.agent)],
+    phase: opts.phase,
+    budgetMinutes: RUN_ENV.budgets[agentRole(opts.agent)][opts.phase],
     scopeNew: opts.scopeNewPatterns,
     profile: runProfile({ ...opts, repo: repoRoot }),
     args: codexArgv,

package/src/home/lib/runner/preflight.mjs

@@ -0,0 +1,109 @@
+/**
+ * Refusals that must not touch the tree, decided before a run is registered. On 2026-09-19,
+ * a busy-tree refusal left its own folder in the live writer's witness. This boundary knows
+ * only the project runs root and existing holders, never the prospective run's directory.
+ */
+import path from 'node:path';
+import fs from 'node:fs';
+import { advisorTaskRefusal } from '../meta/advisor-task.mjs';
+import { activeRunDetails, readJson } from '../write-meta.mjs';
+import { codexUnavailableReason } from './codex-cmd.mjs';
+import { agentRole } from '../agents.mjs';
+import { die } from './args.mjs';
+
+/** Plan_59 D5/D6: settle design authority before any probe can spend quota. */
+export function taskPreflight({ agent, taskText }) {
+  const freeRefusal = (reason) => ({
+    refusal: `${reason}\nThe run folder was not created; quota was not spent.`,
+  });
+  if (agent === 'codex-advisor') {
+    const reason = advisorTaskRefusal(taskText);
+    return reason ? freeRefusal(reason) : { refusal: null };
+  }
+  if (agent !== 'codex-build') return { refusal: null };
+  const lines = taskText.split(/\r\n|\n|\r/)
+    .flatMap((line) => {
+      const match = line.match(/^\s*(?:-\s+)?advice\s*:\s*(.*?)\s*$/i);
+      return match ? [match[1]] : [];
+    });
+  const advice = lines[0];
+  if (lines.length === 1) {
+    if (['mechanical', 'revert', 'docs-only', 'test-only'].includes(advice)) {
+      return { refusal: null, advice };
+    }
+    if (path.isAbsolute(advice)) {
+      try {
+        if (fs.statSync(advice).isDirectory() &&
+            readJson(path.join(advice, 'meta.json'))?.agent === 'codex-advisor') {
+          return { refusal: null, advice };
+        }
+      } catch {
+        // Plan_59 D6: missing or unreadable evidence cannot authorize a construction.
+      }
+    }
+  }
+  return freeRefusal('codex-build requires exactly one advice: line: mechanical | revert | docs-only | test-only ' +
+    'or an absolute path to an existing advisor run directory with meta.json agent codex-advisor. ' +
+    'An order that invents a construction needs a second opinion first; only work with no design choice may skip it.');
+}
+
+/** Plan_59 D14: an advice pass may continue only a completed, successful advisor scope run. */
+export function scopeRunRefusal({ agent, phase, runsRoot, grantRun }) {
+  if (agent !== 'codex-advisor' || phase !== 'advise') return null;
+  let meta;
+  try {
+    meta = readJson(path.join(runsRoot, grantRun, 'meta.json'));
+  } catch {
+    meta = null;
+  }
+  const failed = [
+    meta?.agent === 'codex-advisor' ? null : "agent must be 'codex-advisor'",
+    meta?.phase === 'scope' ? null : "phase must be 'scope'",
+    meta?.status === 'OK' ? null : "status must be 'OK'",
+  ].filter(Boolean);
+  if (!failed.length) return null;
+  return `continued run meta.json failed ${failed.join(', ')}. The run folder was not created; quota was not spent.`;
+}
+
+/** D2: phase mistakes must refuse before even the sandbox probe can spend quota. */
+export function resolveRunPhase({ agent, phase, continue: isContinue }, budgets) {
+  // Plan_59 D7: phase 2 must retain the scope run's predictions before quota is spent.
+  if (agent === 'codex-advisor' && phase === 'advise' && !isContinue) {
+    die('codex-advisor --phase advise requires --continue: phase 2 continues the scope run of the same order ' +
+      'so it can settle the risks phase 1 predicted. The run folder was not created; quota was not spent.');
+  }
+  const phases = budgets[agentRole(agent)];
+  const names = Object.keys(phases);
+  if (phase === undefined && names.length === 1 && names[0] === 'default') return 'default';
+  if (phase !== undefined && Object.hasOwn(phases, phase)) return phase;
+  die(`${phase === undefined ? '--phase is required' : `undeclared --phase ${JSON.stringify(phase)}`} ` +
+    `for ${agent}. Action: pass --phase <name>; allowed phases: ${names.join(', ')}. ` +
+    'The run folder was not created; quota was not spent.');
+}
+
+export function preflightRefusal({ agent, projectRunsRoot, repoRoot }) {
+  // Two writing runs share one tree: the second snapshot would include the first one's edits.
+  const busy = agent === 'codex-build' ? activeRunDetails(projectRunsRoot, repoRoot) : null;
+  if (busy) {
+    const identityNote = busy.identity === 'unverified'
+      ? '; process identity could not be confirmed'
+      : '';
+    return [
+      `run ${busy.run} is already active for this repository; two writing runs in one tree are prohibited${identityNote}`,
+      `Active run: ${path.join(projectRunsRoot, busy.run)}`,
+      // One sentence, the same one every other pre-flight refusal ends with. The older wording
+      // said the identical thing twice, which is how two copies of a rule start to drift.
+      'The run folder was not created; quota was not spent.',
+    ].join('\n');
+  }
+
+  const why = codexUnavailableReason();
+  if (why !== null) {
+    return [
+      `Codex CLI unavailable: ${why}`,
+      'Operator check: codex --version (and codex login if authorization is rejected)',
+      'The run folder was not created; quota was not spent.',
+    ].join('\n');
+  }
+  return null;
+}

package/src/home/lib/runner/prompts.mjs

@@ -8,6 +8,45 @@
 import { DEFAULTS } from '../run-config.mjs';
 import { RUN_ENV } from './run-env.mjs';
 const BODIES = {
+  // Plan_59 D3-D5/D7/D10: independent design advice needs explicit lenses and a risk ledger.
+  'codex-advisor': (opts) => {
+    if (opts.phase !== 'scope' && opts.phase !== 'advise') {
+      throw new RangeError('codex-advisor instructions require phase scope or advise.');
+    }
+    return `Judge a DESIGN before code exists.
+
+Rules for both phases:
+- Read ONLY the paths listed under \`## Paths\`, plus \`git log\` / \`git show\` on those paths.
+- Write nothing. Do your own reading and checks; do not spawn or delegate to other agents.
+- Every claim about code must carry a \`path:line\` address inside those paths. Addresses are
+  machine-checked for existence; do not invent addresses or treat an unchecked claim as evidence.
+- Do not guess which option the caller prefers: the task carries no preference on purpose.
+- Two failure modes are forbidden: agreeing without independent checks ("both options are good",
+  "you know better"), and disagreeing to look independent. A disagreement without an address is
+  an opinion, not advice. Agreeing is fine when your own checks support it.
+${opts.phase === 'scope' ? `
+Scope phase:
+- BEFORE reading in depth, name 3-5 predicted_risks with ids r1..r5: where this design most likely
+  breaks. Record those predictions first, then read; do not replace them with hindsight.
+- Answer sufficient, missing_paths (concrete repository paths you still need), and taken_on_trust
+  (facts accepted from the task without checking, never empty), together with predicted_risks.
+` : `
+Advise phase:
+- Settle every predicted risk from the scope run in risk_outcomes: its risk_id, an outcome of
+  confirmed or refuted, and an address supporting that outcome.
+- Give ONE recommendation by task option_id, or none-of-these with a described unlisted_option.
+  Put every rejected task option in rejected with its cost; for none-of-these this means EVERY
+  task option. Set unlisted_option to "none" when recommending a listed option.
+- Each field is a distinct lens: strongest_counterargument comes from a skeptic;
+  pre_mortem comes from the executor who has only this advice and the repository. Give each
+  scenario an early_check of kind test | command | inspect with a target; inspect requires an address.
+- question_defect comes from the requester who needs the problem solved, not an option picked.
+- Rate assumptions VERIFIED (requires an address) | REASONABLE | FRAGILE. Anything the requester
+  could refute with knowledge you lack belongs in open_questions, not why.
+- independent_checks lists what you verified yourself, with addresses. Ground why in those checks
+  and state confidence honestly.
+`}`;
+  },
   'codex-scout': (opts, scope, questions = []) => `Response rules:
 - You are working in read-only mode: do not try to write or edit anything.
 - Answer from your own reading: do not spawn or delegate to other agents.

package/src/home/lib/runner/sandbox-probe.mjs

@@ -0,0 +1,109 @@
+/** Checks whether this host's Codex sandbox can start a process before a run spends quota. */
+import { performance } from 'node:perf_hooks';
+import { sandboxModeFor } from './codex-args.mjs';
+import { codexSpawnSpec, spawnCaptured } from './codex-cmd.mjs';
+import { platformSandboxArgs } from './sandbox-flags.mjs';
+
+export const SANDBOX_PROBE_MARKER = 'codex-bridge-sandbox-ok';
+// Plan_57 D12/D19: a platform is judged only after both outcomes were seen live. Linux joined on
+// 2026-09-17: dead on an Ubuntu 24.04 VPS (bwrap without a user namespace, exit 1, no marker), alive
+// on the same host after the AppArmor repair. macOS has never been observed.
+export const PROBED_PLATFORMS = new Set(['win32', 'linux']);
+
+// Ubuntu 23.10+ forbids unprivileged user namespaces unless an AppArmor profile allows bwrap; that
+// is the ordinary state of a fresh server, not an accident like the corrupted Windows state file.
+const LINUX_REPAIR = [
+  'On Ubuntu 23.10 and later this usually means AppArmor does not let bubblewrap create a user namespace.',
+  'Official repair: https://learn.chatgpt.com/docs/sandboxing — the bwrap-userns-restrict AppArmor profile',
+  '(Ubuntu 24.04) or the bubblewrap package (25.04 and later). Do not set',
+  'kernel.apparmor_restrict_unprivileged_userns=0: it lifts the restriction for every program on the host.',
+].join(' ');
+
+const echoArgs = (platform) => platform === 'win32'
+  ? ['cmd', '/d', '/c', 'echo', SANDBOX_PROBE_MARKER]
+  : ['echo', SANDBOX_PROBE_MARKER];
+
+function inconclusiveReason(result, form) {
+  if (result.error) {
+    return result.error.code === 'ETIMEDOUT'
+      ? `The ${form} sandbox probe timed out.`
+      : `The ${form} sandbox probe could not start or complete.`;
+  }
+  if (result.signal) return `The ${form} sandbox probe was terminated by ${result.signal}.`;
+  if (result.status === 2) return `Codex rejected the ${form} sandbox probe arguments.`;
+  if (result.status == null) return `The ${form} sandbox probe returned no exit status.`;
+  return null;
+}
+
+export async function probeSandbox({
+  agent, repo, platform = process.platform, run = spawnCaptured, timeoutMs = 30_000,
+}) {
+  if (!PROBED_PLATFORMS.has(platform)) return { outcome: 'skipped' };
+  const sandbox = sandboxModeFor(agent);
+  if (typeof repo !== 'string' || !repo) throw new Error('sandbox probe requires a repository path');
+  const echo = echoArgs(platform);
+  const attempts = [];
+  const finish = (outcome, reason) => ({ outcome, reason, attempts });
+  const attempt = async (form, args) => {
+    const spec = codexSpawnSpec(args, platform);
+    const started = performance.now();
+    const result = await run(spec.command, spec.args, {
+      ...spec.options, cwd: repo, encoding: 'utf8', timeout: timeoutMs,
+    });
+    const marker = String(result.stdout ?? '').includes(SANDBOX_PROBE_MARKER);
+    attempts.push({
+      form, status: result.status ?? null, marker,
+      ms: Math.round(performance.now() - started),
+      // D2: stderr is evidence for the operator, never input to the verdict.
+      stderrTail: String(result.stderr ?? '').slice(-300),
+    });
+    return { ...result, marker };
+  };
+
+  // On 2026-09-16 a corrupt deny_read_acl_state.json made every paid run unable to start tools.
+  // On 2026-09-17, -C required --permission-profile instead: cwd must be a process option.
+  // D16: no single failure exit code proves a dead sandbox; both forms and a live CLI must agree.
+  const flagged = await attempt('flagged', [
+    'sandbox', ...platformSandboxArgs(platform), '-c', `sandbox_mode=${sandbox}`, '--', ...echo,
+  ]);
+  const flaggedReason = inconclusiveReason(flagged, 'flagged');
+  if (flaggedReason) return finish('inconclusive', flaggedReason);
+  if (flagged.status === 0 && flagged.marker) {
+    return finish('alive', 'The Codex sandbox started a process.');
+  }
+  // D16: the marker proves a process started, so a nonzero exit cannot prove a dead sandbox.
+  if (flagged.marker) {
+    return finish('inconclusive', `The flagged sandbox probe printed the marker but exited ${flagged.status}.`);
+  }
+
+  const control = await attempt('control', ['sandbox', '--', ...echo]);
+  const controlReason = inconclusiveReason(control, 'control');
+  if (controlReason) return finish('inconclusive', controlReason);
+  if (control.marker) {
+    return finish('inconclusive', 'This version of Codex no longer accepts the package sandbox flags.');
+  }
+
+  const version = await attempt('version', ['--version']);
+  if (version.error || version.signal || version.status !== 0) {
+    // codexUnavailableReason() owns the refusal for an unavailable CLI, in the same pre-flight pass.
+    return finish('inconclusive', 'Codex CLI is unavailable.');
+  }
+  return finish('dead', 'The Codex sandbox on this host cannot start a process.');
+}
+
+export function sandboxRefusal(result, platform = process.platform) {
+  const control = ['codex', 'sandbox', '--', ...echoArgs(platform)].join(' ');
+  const stderr = result.attempts
+    .filter(({ form }) => form === 'flagged' || form === 'control')
+    .map(({ form, stderrTail }) =>
+      `${form} stderr:\n> ${(stderrTail || '(empty)').replace(/\r\n?/g, '\n').replace(/\n/g, '\n> ')}`);
+  // Only a dead result is refused, and its reason already is the headline; printing both said it twice.
+  return [
+    result.reason,
+    'Repair the host sandbox; do not rewrite or retry the order.',
+    ...(platform === 'linux' ? [LINUX_REPAIR] : []),
+    `Operator check (run from the repository directory): ${control}`,
+    ...stderr,
+    'The run folder was not created; quota was not spent.',
+  ].join('\n\n');
+}