@mrrlin-dev/mcp 0.3.10 → 0.3.11

package/dist/bin.cjs

@@ -20644,11 +20644,11 @@ var require_dist = __commonJS({
 });
 
 // src/bin.ts
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs15 = require("node:fs");
-var import_node_os12 = require("node:os");
-var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_fs14 = require("node:fs");
+var import_node_os11 = require("node:os");
+var import_node_path20 = __toESM(require("node:path"), 1);
 
 // src/install-codex.ts
 var import_promises = __toESM(require("node:fs/promises"), 1);
@@ -20933,10 +20933,10 @@ ${block}`;
 }
 
 // src/director-bridge.ts
-var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_fs10 = __toESM(require("node:fs"), 1);
 var import_node_http = __toESM(require("node:http"), 1);
-var import_node_os8 = __toESM(require("node:os"), 1);
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_os7 = __toESM(require("node:os"), 1);
+var import_node_path11 = __toESM(require("node:path"), 1);
 var import_node_child_process4 = require("node:child_process");
 var import_node_crypto5 = __toESM(require("node:crypto"), 1);
 
@@ -21326,6 +21326,8 @@ var CodexServerManager = class {
     rpcClient.onServerRequest((id, method) => {
       if (method === "requestApproval") {
         rpcClient.respond(id, { decision: "accept" });
+      } else if (method === "mcpServer/elicitation/request") {
+        rpcClient.respond(id, { action: "accept" });
       }
     });
     const notificationHandlers = /* @__PURE__ */ new Set();
@@ -21398,6 +21400,8 @@ var CodexBridgeEventMapper = class {
         return this.handleOutputDelta(notification);
       case "codex/event/error":
         return this.handleServerError(notification);
+      case "error":
+        return this.handleStreamError(notification);
       default:
         return [];
     }
@@ -21490,9 +21494,10 @@ var CodexBridgeEventMapper = class {
   }
   handleTurnCompleted(notification) {
     const events = this.flushPendingText();
-    const status = notification.params?.status ?? "completed";
+    const turn = notification.params?.turn;
+    const status = (typeof turn?.status === "string" ? turn.status : void 0) ?? notification.params?.status ?? "completed";
     if (status === "failed") {
-      const error51 = notification.params?.error;
+      const error51 = turn?.error ?? notification.params?.error;
       const content = typeof error51 === "string" ? error51 : typeof error51?.message === "string" ? String(error51.message) : "Unknown error";
       events.push({ type: "error", content });
       return events;
@@ -21504,6 +21509,18 @@ var CodexBridgeEventMapper = class {
     events.push({ type: "result", subtype: "success" });
     return events;
   }
+  /** Bare `error` notifications carry model-stream failures ({ error: { message }, willRetry }).
+   * Retryable ones (willRetry=true) are transport noise — codex is still driving the turn — so
+   * only terminal failures surface as error events. */
+  handleStreamError(notification) {
+    if (notification.params?.willRetry === true)
+      return [];
+    const events = this.flushPendingText();
+    const error51 = notification.params?.error;
+    const content = (typeof error51?.message === "string" ? error51.message : void 0) ?? (typeof error51?.additionalDetails === "string" ? error51.additionalDetails : void 0) ?? "Unknown Codex error";
+    events.push({ type: "error", content });
+    return events;
+  }
   handleServerError(notification) {
     const events = this.flushPendingText();
     const msg = notification.params?.msg;
@@ -37244,7 +37261,9 @@ var executionRunListFiltersSchema = external_exports.object({
     return value;
   }, external_exports.array(mrrlinExecutionRunStatusSchema)).optional()
 });
+var mrrlinAutoSpecApprovalSchema = external_exports.enum(["manual", "after_consensus"]);
 var mrrlinProjectSchedulerPolicySchema = external_exports.object({
+  autoSpecApproval: mrrlinAutoSpecApprovalSchema,
   cadenceSeconds: external_exports.number().int().positive().nullable(),
   createdAt: external_exports.string().datetime(),
   eligibleAutonomyLevels: external_exports.array(mrrlinAutonomyLevelSchema).min(1),
@@ -37253,6 +37272,7 @@ var mrrlinProjectSchedulerPolicySchema = external_exports.object({
   wakeFloor: external_exports.string().datetime().nullable()
 });
 var mrrlinProjectSchedulerPolicyUpsertSchema = external_exports.object({
+  autoSpecApproval: mrrlinAutoSpecApprovalSchema.optional(),
   cadenceSeconds: external_exports.number().int().positive().nullable().optional(),
   eligibleAutonomyLevels: external_exports.array(mrrlinAutonomyLevelSchema).min(1).optional(),
   wakeFloor: external_exports.string().datetime().nullable().optional()
@@ -38514,7 +38534,7 @@ Do NOT derail the current task \u2014 if the operator has an in-flight question,
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.3.10";
+var PKG_VERSION = "0.3.11";
 
 // src/api-base-url.ts
 var DEFAULT_API_BASE_URL = "http://127.0.0.1:8787";
@@ -38994,10 +39014,12 @@ var CONSUMER_BASE_INSTRUCTIONS = [
 ].join("\n");
 var EXECUTOR_BASE_INSTRUCTIONS = [
   ...BASE_INSTRUCTIONS_PREFIX,
-  "You run inside an isolated, write-authorized git worktree: you MAY create, edit, and",
-  "delete files and run git commands within this worktree to make progress. Writes outside",
-  "the worktree and reads of operator secrets are blocked by the sandbox. Be concise. When",
-  "you have made the next increment of progress, stop the turn."
+  "You run inside a git worktree dedicated to this run, with full read/write/network access to",
+  "the host (there is NO filesystem sandbox). Do your work by creating, editing, and deleting",
+  "files and running git/build/test commands WITHIN this worktree. Keep all changes inside the",
+  "worktree and do not read the operator's personal secrets or files outside it \u2014 this is a rule",
+  "you must follow, not something the environment enforces. Be concise. When you have made the",
+  "next increment of progress, stop the turn."
 ].join("\n");
 function artifactKindForEvent(event) {
   switch (event.type) {
@@ -39117,12 +39139,25 @@ async function driveTurn(deps, codex, projectSlug, runId, leaseId, threadId, inp
   };
   return deps.runExclusive(async () => {
     const pending = [];
+    let resolveTurnEnded = null;
+    const turnEnded = new Promise((resolve) => {
+      resolveTurnEnded = resolve;
+    });
+    let acceptedTurnId = null;
     const unsub = codex.onNotification((method, params) => {
       const events = mapper.mapNotification(
         { method, params },
         threadId
       );
       for (const event of events) pending.push(persist(event));
+      if (method === "turn/completed") {
+        const p = params;
+        const notifThreadId = p?.threadId;
+        const notifTurnId = p?.turn?.id;
+        const threadMatches = !notifThreadId || notifThreadId === threadId;
+        const turnMatches = !acceptedTurnId || !notifTurnId || notifTurnId === acceptedTurnId;
+        if (threadMatches && turnMatches) resolveTurnEnded?.();
+      }
     });
     const touchTimer = setInterval(() => {
       void deps.client.touchExecutionRun(projectSlug, runId, leaseId).catch(() => {
@@ -39132,7 +39167,14 @@ async function driveTurn(deps, codex, projectSlug, runId, leaseId, threadId, inp
     try {
       const timeoutMs = execTurnTimeoutMs();
       await awaitTurnWithDeadline({
-        run: () => codex.turn.start({ threadId, input: [{ type: "text", text: inputText }] }),
+        run: async () => {
+          const accepted = await codex.turn.start({
+            threadId,
+            input: [{ type: "text", text: inputText }]
+          });
+          acceptedTurnId = accepted?.turn?.id ?? null;
+          await turnEnded;
+        },
         interrupt: () => codex.turn.interrupt({ threadId }),
         timeoutMs,
         timeoutMessage: `Execution turn did not complete within ${timeoutMs}ms.`,
@@ -39203,7 +39245,7 @@ async function driveRun(deps, projectSlug, runId) {
         defaultBranch: await getDefaultBranch(projectSlug)
       });
       await deps.client.updateExecutionRun(projectSlug, runId, { worktreeId: worktreePath });
-      sandbox = null;
+      sandbox = "danger-full-access";
       turnCwd = worktreePath;
       useExecutor = true;
       if (deps.acquireExecutorCodex) {
@@ -43687,127 +43729,13 @@ var CheckoutRegistry = class {
 };
 
 // src/executor-server.ts
-var import_node_fs9 = require("node:fs");
-var import_node_os7 = require("node:os");
-var import_node_path10 = require("node:path");
-var DENY_READ_GLOBS = [
-  "**/.ssh/**",
-  "**/.aws/**",
-  "**/.config/gh/**",
-  "**/.netrc",
-  "**/.npmrc",
-  "**/.env*",
-  "**/.gnupg/**"
-];
-var ENV_ALLOWLIST = ["PATH", "LANG", "LC_ALL", "TERM", "TMPDIR", "GIT_SSH_COMMAND"];
-var DEFAULT_EGRESS_DOMAINS = [
-  "registry.npmjs.org",
-  "github.com",
-  "api.github.com",
-  "codeload.github.com"
-];
-function buildExecutorConfig(opts) {
-  const env = { HOME: opts.scratchHome };
-  for (const k of ENV_ALLOWLIST) {
-    if (process.env[k]) env[k] = process.env[k];
-  }
-  return {
-    cwd: opts.worktree,
-    env,
-    denyReadGlobs: DENY_READ_GLOBS,
-    denyReadResolvesSymlinks: true,
-    network: { allowedDomains: opts.egressDomains },
-    trustWorktreeConfig: false
-  };
-}
-function operatorSecretPaths(realHome = (0, import_node_os7.homedir)()) {
-  return [
-    (0, import_node_path10.join)(realHome, ".ssh"),
-    (0, import_node_path10.join)(realHome, ".aws"),
-    (0, import_node_path10.join)(realHome, ".config", "gh"),
-    (0, import_node_path10.join)(realHome, ".npmrc"),
-    (0, import_node_path10.join)(realHome, ".netrc"),
-    (0, import_node_path10.join)(realHome, ".gnupg"),
-    (0, import_node_path10.join)(realHome, ".kube"),
-    (0, import_node_path10.join)(realHome, ".docker", "config.json"),
-    (0, import_node_path10.join)(realHome, ".config", "gcloud")
-  ];
-}
-var SECRET_DIRECTORY_BASENAMES = /* @__PURE__ */ new Set([".ssh", ".aws", "gh", ".gnupg", ".kube", "gcloud"]);
-function isSecretDirectoryPath(p) {
-  const base = p.split(/[/\\]/).filter(Boolean).pop() ?? "";
-  return SECRET_DIRECTORY_BASENAMES.has(base);
-}
-function writeExecutorCodexHome(scratchDir, opts) {
-  const codexHome = (0, import_node_path10.join)(scratchDir, ".codex");
-  (0, import_node_fs9.mkdirSync)(codexHome, { recursive: true });
-  const hasEgress = opts.egressDomains.length > 0;
-  const networkSection = hasEgress ? [
-    "[permissions.executor.network]",
-    "enabled = true",
-    'mode = "limited"',
-    "",
-    "[permissions.executor.network.domains]",
-    ...opts.egressDomains.map((d) => `"${d}" = "allow"`)
-  ].join("\n") : [
-    "[permissions.executor.network]",
-    "enabled = false"
-  ].join("\n");
-  const absoluteDenyLines = opts.denySecretPaths.flatMap(
-    (p) => isSecretDirectoryPath(p) ? [`"${p}" = "deny"`, `"${p}/**" = "deny"`] : [`"${p}" = "deny"`]
-  ).join("\n");
-  const workspaceRootsDenyLines = [
-    '[permissions.executor.filesystem.":workspace_roots"]',
-    '"**/.env*" = "deny"'
-  ].join("\n");
-  const toml3 = [
-    'default_permissions = "executor"',
-    "",
-    "[permissions.executor]",
-    'extends = ":workspace"',
-    "",
-    "[permissions.executor.filesystem]",
-    "glob_scan_max_depth = 8",
-    absoluteDenyLines,
-    "",
-    workspaceRootsDenyLines,
-    "",
-    networkSection,
-    ""
-  ].join("\n");
-  (0, import_node_fs9.writeFileSync)((0, import_node_path10.join)(codexHome, "config.toml"), toml3, "utf8");
-  return codexHome;
-}
 async function startExecutorServer(opts) {
-  const egressDomains = opts.egressDomains ?? DEFAULT_EGRESS_DOMAINS;
-  const realHome = (0, import_node_os7.homedir)();
-  const denySecretPaths = operatorSecretPaths(realHome);
-  const scratchDir = (0, import_node_fs9.mkdtempSync)((0, import_node_path10.join)((0, import_node_os7.tmpdir)(), "mrrlin-executor-"));
-  const scratchHome = scratchDir;
-  let scratchCleaned = false;
-  const cleanScratch = () => {
-    if (scratchCleaned) return;
-    scratchCleaned = true;
-    try {
-      (0, import_node_fs9.rmSync)(scratchDir, { recursive: true, force: true });
-    } catch {
-    }
-  };
   const manager = new CodexServerManager();
   try {
-    const codexHome = writeExecutorCodexHome(scratchDir, {
-      worktree: opts.worktree,
-      egressDomains,
-      denySecretPaths
-    });
-    const cfg = buildExecutorConfig({ worktree: opts.worktree, scratchHome, egressDomains });
-    const env = { ...cfg.env, CODEX_HOME: codexHome };
     const client = await manager.acquire({
-      cwd: cfg.cwd,
-      env,
+      cwd: opts.worktree,
       approvalPolicy: "never",
-      ...opts.spawn ? { spawn: opts.spawn } : {},
-      ...opts.sandbox != null ? { sandbox: opts.sandbox } : {}
+      ...opts.spawn ? { spawn: opts.spawn } : {}
     });
     let disposed = false;
     const dispose = () => {
@@ -43817,7 +43745,6 @@ async function startExecutorServer(opts) {
         manager.shutdown();
       } catch {
       }
-      cleanScratch();
     };
     return { client, dispose };
   } catch (error51) {
@@ -43825,7 +43752,6 @@ async function startExecutorServer(opts) {
       manager.shutdown();
     } catch {
     }
-    cleanScratch();
     throw error51;
   }
 }
@@ -43835,8 +43761,10 @@ function buildVerificationPrompt(input) {
   return [
     `You are verifying a deployment. The application is live at: ${input.environmentUrl}`,
     `Run ONLY read-only HTTP checks against that URL to evaluate the verification steps below.`,
-    `You have NO repository, filesystem, or credential access and you must not attempt to mutate`,
-    `anything \u2014 only observe the deployed app over HTTP.`,
+    `Behave as if you had no repository, filesystem, or credential access: do not read or write`,
+    `files, do not use any credentials, do not contact any other host, and do not attempt to`,
+    `mutate anything \u2014 only observe the deployed app over HTTP. (This is a rule you must follow,`,
+    `not something the environment enforces.)`,
     ``,
     `Verification steps for environment "${input.env}":`,
     input.verificationSection,
@@ -43980,8 +43908,8 @@ function extractVerificationSection(markdown) {
 }
 
 // src/bridge-log.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs9 = require("node:fs");
+var import_node_path10 = require("node:path");
 
 // src/redact.ts
 var REDACTED = "[REDACTED]";
@@ -44066,14 +43994,14 @@ function resolvePromptsEnabled(env) {
 }
 function createBridgeLogger(stateDir, env = process.env) {
   if (!resolveBridgeLogEnabled(env)) return NOOP_LOGGER;
-  const logsDir = (0, import_node_path11.join)(stateDir, "logs");
+  const logsDir = (0, import_node_path10.join)(stateDir, "logs");
   try {
-    (0, import_node_fs10.mkdirSync)(logsDir, { recursive: true });
+    (0, import_node_fs9.mkdirSync)(logsDir, { recursive: true });
   } catch {
     return NOOP_LOGGER;
   }
   const includePrompts = resolvePromptsEnabled(env);
-  const fileFor = () => (0, import_node_path11.join)(logsDir, `bridge-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
+  const fileFor = () => (0, import_node_path10.join)(logsDir, `bridge-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
   const write = (dir, rec) => {
     try {
       const line = JSON.stringify({
@@ -44085,7 +44013,7 @@ function createBridgeLogger(stateDir, env = process.env) {
         ...rec.ms !== void 0 ? { ms: rec.ms } : {},
         payload: redactMessage(rec.payload, { includePrompts })
       }) + "\n";
-      (0, import_node_fs10.appendFileSync)(fileFor(), line);
+      (0, import_node_fs9.appendFileSync)(fileFor(), line);
     } catch {
     }
   };
@@ -44119,9 +44047,9 @@ function normalizeModel(value) {
   return trimmed ? trimmed : null;
 }
 function neutralCheckoutCwd(stateDir) {
-  const dir = import_node_path12.default.join(stateDir, "no-checkout");
+  const dir = import_node_path11.default.join(stateDir, "no-checkout");
   try {
-    import_node_fs11.default.mkdirSync(dir, { recursive: true });
+    import_node_fs10.default.mkdirSync(dir, { recursive: true });
   } catch {
   }
   return dir;
@@ -44278,10 +44206,11 @@ function tokenRefreshIntervalMs() {
 var COLLECTED_TURN_TIMEOUT_MS = 3e5;
 var DEFAULT_IMAGE_ONLY_PROMPT = "Look at the attached image.";
 var VERIFICATION_BASE_INSTRUCTIONS = [
-  "You are a deployment verification agent. You may ONLY make read-only HTTP requests to the",
-  "single allowlisted environment URL to confirm a deploy succeeded. You have NO repository,",
-  "filesystem, or credential access and must not attempt to modify anything. Follow the",
-  "verification steps and end with a single VERDICT line exactly as instructed."
+  "You are a deployment verification agent. Make ONLY read-only HTTP requests to the single",
+  "environment URL given in the prompt to confirm a deploy succeeded. Do not read or write any",
+  "files, do not use repository or credential access, do not contact any other host, and do not",
+  "modify anything \u2014 these are rules you must follow, not limits the environment enforces. Follow",
+  "the verification steps and end with a single VERDICT line exactly as instructed."
 ].join("\n");
 var SELF_REVIEW_BASE_INSTRUCTIONS = [
   "You are a code self-review agent. You MAY run read-only git/shell commands (e.g. `git log`,",
@@ -44292,11 +44221,14 @@ var SELF_REVIEW_BASE_INSTRUCTIONS = [
 async function runCollectedCodexTurn(client, prompt, cwd, baseInstructions) {
   const { threadId } = await acquireThread(client, {
     threadId: null,
+    // danger-full-access: collected turns (self-review reads the worktree diff; deploy
+    // verification hits the deployed env URL over the network) run unrestricted, matching
+    // the owner decision that the executor is not sandboxed. The turn's base instructions
+    // (review-only / observe-only) bound what it actually does.
     startParams: {
       cwd,
       approvalPolicy: "never",
-      sandbox: null,
-      // the executor permissions profile governs; an override would discard it
+      sandbox: "danger-full-access",
       model: null,
       baseInstructions,
       developerInstructions: null,
@@ -44308,14 +44240,34 @@ async function runCollectedCodexTurn(client, prompt, cwd, baseInstructions) {
   const mapper = new CodexBridgeEventMapper();
   mapper.reset();
   const chunks = [];
+  let acceptedTurnId = null;
+  let turnError = null;
+  let resolveTurnEnded = null;
+  const turnEnded = new Promise((resolve) => {
+    resolveTurnEnded = resolve;
+  });
   const unsub = client.onNotification((method, params) => {
     for (const ev of mapper.mapNotification({ method, params }, threadId)) {
       if (ev.type === "assistant") chunks.push(ev.content);
+      else if (ev.type === "error") turnError = ev.content;
+    }
+    if (method === "turn/completed") {
+      const p = params;
+      const threadMatches = !p?.threadId || p.threadId === threadId;
+      const turnMatches = !acceptedTurnId || !p?.turn?.id || p.turn.id === acceptedTurnId;
+      if (threadMatches && turnMatches) resolveTurnEnded?.();
     }
   });
   try {
     await awaitTurnWithDeadline({
-      run: () => client.turn.start({ threadId, input: [{ type: "text", text: prompt }] }),
+      run: async () => {
+        const accepted = await client.turn.start({
+          threadId,
+          input: [{ type: "text", text: prompt }]
+        });
+        acceptedTurnId = accepted?.turn?.id ?? null;
+        await turnEnded;
+      },
       interrupt: () => client.turn.interrupt({ threadId }),
       timeoutMs: COLLECTED_TURN_TIMEOUT_MS,
       timeoutMessage: `Collected turn did not complete within ${COLLECTED_TURN_TIMEOUT_MS}ms.`
@@ -44324,6 +44276,7 @@ async function runCollectedCodexTurn(client, prompt, cwd, baseInstructions) {
   } finally {
     unsub();
   }
+  if (turnError) throw new Error(`Collected turn failed: ${turnError}`);
   return chunks.join("");
 }
 function resolveDefaultBranch(checkoutPath) {
@@ -44362,7 +44315,7 @@ async function runOrphanWorktreeSweep(client, opts) {
   const cutoff = Date.now() - worktreeRetentionMs();
   const isReapable = (worktreePath) => {
     try {
-      return import_node_fs11.default.statSync(worktreePath).mtimeMs < cutoff;
+      return import_node_fs10.default.statSync(worktreePath).mtimeMs < cutoff;
     } catch {
       return false;
     }
@@ -44399,8 +44352,8 @@ async function runOrphanWorktreeSweep(client, opts) {
   }
 }
 function readStateDir() {
-  if (process.env.CODEX_HOME) return import_node_path12.default.join(process.env.CODEX_HOME, "mrrlin", "director-bridge");
-  return import_node_path12.default.join(import_node_os8.default.homedir(), ".mrrlin", "director-bridge");
+  if (process.env.CODEX_HOME) return import_node_path11.default.join(process.env.CODEX_HOME, "mrrlin", "director-bridge");
+  return import_node_path11.default.join(import_node_os7.default.homedir(), ".mrrlin", "director-bridge");
 }
 function readAllowedOrigins() {
   const raw = (process.env.MRRLIN_DIRECTOR_BRIDGE_ALLOWED_ORIGINS ?? "").trim();
@@ -45264,13 +45217,14 @@ async function startDirectorBridge() {
     codexCwd: config2.codexCwd,
     codexExecutable: config2.codexExecutable,
     checkoutRegistry,
-    worktreeRoot: import_node_path12.default.join(config2.stateDir, "worktrees"),
-    locksDir: import_node_path12.default.join(config2.stateDir, "locks"),
-    // Wire the profile-enforced executor server for code-execution runs. Each run gets its own
-    // sandboxed Codex instance (scrubbed env, scratch CODEX_HOME, deny-read, egress allowlist).
+    worktreeRoot: import_node_path11.default.join(config2.stateDir, "worktrees"),
+    locksDir: import_node_path11.default.join(config2.stateDir, "locks"),
+    // Wire the executor server for code-execution runs. Each run gets its own app-server
+    // process at the run worktree, running UNRESTRICTED from the real ~/.codex (owner
+    // no-sandbox decision — auth + mrrlin MCP come from the operator config).
     // The returned handle's dispose() shuts down the spawned app-server CHILD (manager.shutdown(),
-    // not the JSON-RPC-only client.close()) and removes the scratch dir — releasing the executor
-    // therefore kills the process and cleans up. driveRun owns this dispose per-run (Fix A + G).
+    // not the JSON-RPC-only client.close()) — releasing the executor therefore kills the process.
+    // driveRun owns this dispose per-run (Fix A + G).
     acquireExecutorCodex: async (worktreePath) => {
       const handle = await startExecutorServer({ worktree: worktreePath });
       return { client: handle.client, dispose: handle.dispose };
@@ -45281,15 +45235,15 @@ async function startDirectorBridge() {
     // fail. If the resolved branch does not exist on origin, createRunWorktree surfaces a
     // `default_branch_unresolved` error which the consumer routes to a clean operator handoff.
     getDefaultBranch: (projectSlug) => Promise.resolve(resolveDefaultBranch(checkoutRegistry.get(projectSlug)?.path ?? null)),
-    // ADR 0007 self-review: critique the committed diff on the executor's own sandbox before
+    // ADR 0007 self-review: critique the committed diff on the executor's own client before
     // push/PR. Reuses the verification turn-runner (acquireThread + collect assistant text).
     selfReviewTurn: createSelfReviewTurn({
       runTurn: (codexClient, cwd, prompt) => runCollectedCodexTurn(codexClient, prompt, cwd, SELF_REVIEW_BASE_INSTRUCTIONS)
     }),
     // ADR 0015 deploy gate: after a pushed run reaches dev_deploy/prod_deploy, the backstop sweep
-    // dispatches the deploy + polls + runs a DEDICATED sandboxed verification turn against the
-    // deployed env URL. The verification sandbox is network-only (egress allowlisted to ONLY the
-    // env host) with a fresh empty scratch cwd — no repo/worktree/secret access.
+    // dispatches the deploy + polls + runs a verification turn against the deployed env URL in a
+    // throwaway cwd. Per the owner no-sandbox decision the verification turn runs from the real
+    // ~/.codex like every other executor turn; its observe-only base instructions bound behaviour.
     deployGate: {
       loadVerificationSection: async (projectSlug, task) => {
         if (!task.specWikiPageId) return null;
@@ -45297,14 +45251,16 @@ async function startDirectorBridge() {
         return page?.markdownBody ? extractVerificationSection(page.markdownBody) : null;
       },
       runVerificationTurn: createRunVerificationTurn({
-        startSandbox: async (egressDomains) => {
-          const cwd = import_node_fs11.default.mkdtempSync(import_node_path12.default.join(import_node_os8.default.tmpdir(), "mrrlin-verify-"));
+        // egressDomains is retained in the seam signature (verification-turn.ts still computes the
+        // env host) but no longer constrains anything — the executor is unrestricted.
+        startSandbox: async (_egressDomains) => {
+          const cwd = import_node_fs10.default.mkdtempSync(import_node_path11.default.join(import_node_os7.default.tmpdir(), "mrrlin-verify-"));
           let handle;
           try {
-            handle = await startExecutorServer({ worktree: cwd, egressDomains });
+            handle = await startExecutorServer({ worktree: cwd });
           } catch (error51) {
             try {
-              import_node_fs11.default.rmSync(cwd, { recursive: true, force: true });
+              import_node_fs10.default.rmSync(cwd, { recursive: true, force: true });
             } catch {
             }
             throw error51;
@@ -45315,7 +45271,7 @@ async function startDirectorBridge() {
             dispose: () => {
               handle.dispose();
               try {
-                import_node_fs11.default.rmSync(cwd, { recursive: true, force: true });
+                import_node_fs10.default.rmSync(cwd, { recursive: true, force: true });
               } catch {
               }
             }
@@ -45455,7 +45411,7 @@ async function startDirectorBridge() {
   const bridgeLogger = createBridgeLogger(config2.stateDir, process.env);
   let bridgeBinShaShort = "unknown00000";
   try {
-    bridgeBinShaShort = import_node_crypto5.default.createHash("sha256").update(import_node_fs11.default.readFileSync(process.argv[1] ?? "")).digest("hex").slice(0, 12);
+    bridgeBinShaShort = import_node_crypto5.default.createHash("sha256").update(import_node_fs10.default.readFileSync(process.argv[1] ?? "")).digest("hex").slice(0, 12);
   } catch {
   }
   attachBridgeWss(server, {
@@ -45564,8 +45520,8 @@ async function startDirectorBridge() {
       enqueueRun(
         () => runOrphanWorktreeSweep(client, {
           checkoutRegistry,
-          worktreeRoot: import_node_path12.default.join(config2.stateDir, "worktrees"),
-          locksDir: import_node_path12.default.join(config2.stateDir, "locks")
+          worktreeRoot: import_node_path11.default.join(config2.stateDir, "worktrees"),
+          locksDir: import_node_path11.default.join(config2.stateDir, "locks")
         })
       );
       enqueueRun(async () => {
@@ -45777,15 +45733,15 @@ function readDispatchBody(req) {
 function readOrCreateBridgeToken(stateDir) {
   const explicit = (process.env.MRRLIN_DIRECTOR_BRIDGE_TOKEN ?? "").trim();
   if (explicit) return explicit;
-  const tokenPath = import_node_path12.default.join(stateDir, "token.txt");
+  const tokenPath = import_node_path11.default.join(stateDir, "token.txt");
   try {
-    const existing = import_node_fs11.default.readFileSync(tokenPath, "utf8").trim();
+    const existing = import_node_fs10.default.readFileSync(tokenPath, "utf8").trim();
     if (existing) return existing;
   } catch {
   }
-  import_node_fs11.default.mkdirSync(stateDir, { recursive: true, mode: 448 });
+  import_node_fs10.default.mkdirSync(stateDir, { recursive: true, mode: 448 });
   const token = import_node_crypto5.default.randomBytes(32).toString("base64url");
-  import_node_fs11.default.writeFileSync(tokenPath, `${token}
+  import_node_fs10.default.writeFileSync(tokenPath, `${token}
 `, { mode: 384 });
   return token;
 }
@@ -49169,17 +49125,17 @@ var StdioServerTransport = class {
 // src/tools.ts
 var import_node_crypto8 = require("node:crypto");
 var import_promises3 = require("node:fs/promises");
-var import_node_fs13 = require("node:fs");
-var import_node_path15 = __toESM(require("node:path"), 1);
-var import_node_os9 = __toESM(require("node:os"), 1);
+var import_node_fs12 = require("node:fs");
+var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_os8 = __toESM(require("node:os"), 1);
 var import_node_child_process7 = require("node:child_process");
 
 // ../../packages/wiki/dist/index.js
 var import_promises2 = __toESM(require("node:fs/promises"), 1);
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_path12 = __toESM(require("node:path"), 1);
 var INCLUDED_DOC_FOLDERS = /* @__PURE__ */ new Set(["_meta", "explanation", "how-to", "reference", "sdd", "tutorials"]);
 function toPosixPath(input) {
-  return input.split(import_node_path13.default.sep).join("/");
+  return input.split(import_node_path12.default.sep).join("/");
 }
 function slugifyWikiSegment(input) {
   return input.trim().toLowerCase().replace(/`/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -49193,12 +49149,12 @@ async function pathExists2(input) {
   }
 }
 async function findWorkspaceRoot(start = process.cwd()) {
-  let current = import_node_path13.default.resolve(start);
+  let current = import_node_path12.default.resolve(start);
   while (true) {
-    if (await pathExists2(import_node_path13.default.join(current, "pnpm-workspace.yaml")) && await pathExists2(import_node_path13.default.join(current, "docs"))) {
+    if (await pathExists2(import_node_path12.default.join(current, "pnpm-workspace.yaml")) && await pathExists2(import_node_path12.default.join(current, "docs"))) {
       return current;
     }
-    const parent = import_node_path13.default.dirname(current);
+    const parent = import_node_path12.default.dirname(current);
     if (parent === current) {
       throw new Error(`Unable to find Mrrlin workspace root from ${start}`);
     }
@@ -49207,28 +49163,28 @@ async function findWorkspaceRoot(start = process.cwd()) {
 }
 async function resolveDocsRoot(input) {
   if (input) {
-    return import_node_path13.default.resolve(input);
+    return import_node_path12.default.resolve(input);
   }
   if (process.env.MRRLIN_DOCS_ROOT) {
-    return import_node_path13.default.resolve(process.env.MRRLIN_DOCS_ROOT);
+    return import_node_path12.default.resolve(process.env.MRRLIN_DOCS_ROOT);
   }
-  return import_node_path13.default.join(await findWorkspaceRoot(), "docs");
+  return import_node_path12.default.join(await findWorkspaceRoot(), "docs");
 }
 async function resolveIndexPath(input) {
   if (input) {
-    return import_node_path13.default.resolve(input);
+    return import_node_path12.default.resolve(input);
   }
   if (process.env.MRRLIN_WIKI_INDEX_PATH) {
-    return import_node_path13.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
+    return import_node_path12.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
   }
   const workspaceRoot = await findWorkspaceRoot();
-  return import_node_path13.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
+  return import_node_path12.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
 }
 async function walkMarkdownFiles(root, dir = root) {
   const entries = await import_promises2.default.readdir(dir, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = import_node_path13.default.join(dir, entry.name);
+    const absolute = import_node_path12.default.join(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...await walkMarkdownFiles(root, absolute));
       continue;
@@ -49247,7 +49203,7 @@ function parseTitle(markdown, sourcePath) {
   return title;
 }
 function documentFromFile(docsRoot, absolutePath, markdown) {
-  const relativePath = toPosixPath(import_node_path13.default.relative(docsRoot, absolutePath));
+  const relativePath = toPosixPath(import_node_path12.default.relative(docsRoot, absolutePath));
   const [section, fileName] = relativePath.split("/");
   if (!section || !fileName || !INCLUDED_DOC_FOLDERS.has(section)) {
     return null;
@@ -49801,8 +49757,8 @@ function errMessage(err) {
 }
 
 // src/consensus/wiring.ts
-var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url2 = require("node:url");
 
 // src/consensus/code-gate-git.ts
@@ -50037,15 +49993,15 @@ ${res.stdout}${res.stderr}`);
 var import_meta2 = {};
 function getPersonasDir() {
   if (typeof __dirname !== "undefined") {
-    return import_node_path14.default.join(__dirname, "consensus", "personas");
+    return import_node_path13.default.join(__dirname, "consensus", "personas");
   }
-  return import_node_path14.default.join(import_node_path14.default.dirname((0, import_node_url2.fileURLToPath)(import_meta2.url)), "personas");
+  return import_node_path13.default.join(import_node_path13.default.dirname((0, import_node_url2.fileURLToPath)(import_meta2.url)), "personas");
 }
 var personaCache = /* @__PURE__ */ new Map();
 function loadPersona(name) {
   const cached2 = personaCache.get(name);
   if (cached2 !== void 0) return cached2;
-  const content = import_node_fs12.default.readFileSync(import_node_path14.default.join(getPersonasDir(), `${name}.md`), "utf8");
+  const content = import_node_fs11.default.readFileSync(import_node_path13.default.join(getPersonasDir(), `${name}.md`), "utf8");
   personaCache.set(name, content);
   return content;
 }
@@ -51905,7 +51861,7 @@ function createMrrlinTools(options) {
       "ARTIFACT_FILE_UPLOAD_FAILED",
       "Unable to upload artifact file.",
       async (c, { projectSlug, path: filePath, class: artifactClass, taskId, runId, description }) => {
-        const extension2 = import_node_path15.default.extname(filePath).toLowerCase();
+        const extension2 = import_node_path14.default.extname(filePath).toLowerCase();
         const contentType = ARTIFACT_EXTENSION_TYPES[extension2];
         if (!contentType) {
           throw new McpToolCodedError(
@@ -51933,7 +51889,7 @@ function createMrrlinTools(options) {
             "Artifact exceeds 5MB; split or summarize instead."
           );
         }
-        const filename = import_node_path15.default.basename(filePath);
+        const filename = import_node_path14.default.basename(filePath);
         const created = await c.createArtifactFile(projectSlug, {
           class: artifactClass,
           contentType,
@@ -52016,7 +51972,7 @@ function createMrrlinTools(options) {
       "Unable to register local checkout.",
       async (_c, { projectSlug, path: checkoutPath, repo }) => {
         const trimmedPath = checkoutPath.trim();
-        if (!import_node_path15.default.isAbsolute(trimmedPath)) {
+        if (!import_node_path14.default.isAbsolute(trimmedPath)) {
           throw new McpToolCodedError(
             "LOCAL_CHECKOUT_PATH_NOT_ABSOLUTE",
             `Path must be absolute, got: ${trimmedPath}`
@@ -52024,7 +51980,7 @@ function createMrrlinTools(options) {
         }
         let resolvedPath;
         try {
-          resolvedPath = (0, import_node_fs13.realpathSync)(trimmedPath);
+          resolvedPath = (0, import_node_fs12.realpathSync)(trimmedPath);
         } catch {
           throw new McpToolCodedError(
             "LOCAL_CHECKOUT_PATH_NOT_FOUND",
@@ -52051,7 +52007,7 @@ function createMrrlinTools(options) {
             `Origin remote ${remoteUrl} does not match repo ${repo}.`
           );
         }
-        const stateDir = process.env.CODEX_HOME ? import_node_path15.default.join(process.env.CODEX_HOME, "mrrlin", "director-bridge") : import_node_path15.default.join(import_node_os9.default.homedir(), ".mrrlin", "director-bridge");
+        const stateDir = process.env.CODEX_HOME ? import_node_path14.default.join(process.env.CODEX_HOME, "mrrlin", "director-bridge") : import_node_path14.default.join(import_node_os8.default.homedir(), ".mrrlin", "director-bridge");
         const registry3 = new CheckoutRegistry(stateDir);
         const confirmedAt = (/* @__PURE__ */ new Date()).toISOString();
         registry3.confirm(projectSlug, resolvedPath, confirmedAt);
@@ -52258,13 +52214,13 @@ function runSetCredential(args) {
 }
 
 // src/install-service.ts
-var import_node_os10 = __toESM(require("node:os"), 1);
-var import_node_path17 = __toESM(require("node:path"), 1);
+var import_node_os9 = __toESM(require("node:os"), 1);
+var import_node_path16 = __toESM(require("node:path"), 1);
 
 // src/service-paths.ts
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 function isWorktreePath(p) {
-  const norm = import_node_path16.default.normalize(p).split(import_node_path16.default.sep).join("/");
+  const norm = import_node_path15.default.normalize(p).split(import_node_path15.default.sep).join("/");
   return norm.includes("/.claude/worktrees/");
 }
 function resolveServiceCwd(opts) {
@@ -52318,7 +52274,7 @@ function installService(deps) {
     deps.log(resolved.reason);
     return { ok: false };
   }
-  const home = deps.env.HOME ?? import_node_os10.default.homedir();
+  const home = deps.env.HOME ?? import_node_os9.default.homedir();
   const bins = ["node", "codex", "mrrlin-mcp"].map((b) => deps.which(b));
   if (bins.some((b) => !b)) {
     deps.log("Could not resolve absolute paths for node/codex/mrrlin-mcp on PATH. Install them or fix PATH.");
@@ -52329,7 +52285,7 @@ function installService(deps) {
     return { ok: false };
   }
   const resolvedBins = bins.filter((b) => b !== null);
-  const pathEnv = Array.from(new Set(resolvedBins.map((b) => import_node_path17.default.dirname(b)))).join(":");
+  const pathEnv = Array.from(new Set(resolvedBins.map((b) => import_node_path16.default.dirname(b)))).join(":");
   const text = renderEcosystemConfig({
     cwd: resolved.cwd,
     home,
@@ -52338,7 +52294,7 @@ function installService(deps) {
     staging: deps.env.MRRLIN_STAGING === "1",
     apiBaseUrl: deps.env.MRRLIN_API_BASE_URL?.trim() || void 0
   });
-  const ecoPath = import_node_path17.default.join(home, ".mrrlin", "ecosystem.config.cjs");
+  const ecoPath = import_node_path16.default.join(home, ".mrrlin", "ecosystem.config.cjs");
   deps.writeFile(ecoPath, text);
   const start = deps.runPm2(["startOrReload", ecoPath]);
   if (start.code !== 0) {
@@ -52369,13 +52325,13 @@ function uninstallService(deps) {
 
 // src/uninstall-codex.ts
 var import_promises4 = __toESM(require("node:fs/promises"), 1);
-var import_node_os11 = __toESM(require("node:os"), 1);
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_os10 = __toESM(require("node:os"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 var toml2 = __toESM(require_toml(), 1);
 function resolveCodexHome2(options) {
   if (options.codexHome) return options.codexHome;
   if (process.env.CODEX_HOME) return process.env.CODEX_HOME;
-  return import_node_path18.default.join(options.homeDir ?? import_node_os11.default.homedir(), ".codex");
+  return import_node_path17.default.join(options.homeDir ?? import_node_os10.default.homedir(), ".codex");
 }
 async function pathExists3(target) {
   try {
@@ -52388,7 +52344,7 @@ async function pathExists3(target) {
 var MRRLIN_BLOCK_RE = /(^|\n)\[mcp_servers\.mrrlin(?:-browser)?(?:\]|\.[^\]\n]*\])[\s\S]*?(?=\n\[|$)/g;
 async function uninstallCodex(options = {}) {
   const codexHome = resolveCodexHome2(options);
-  const configPath = import_node_path18.default.join(codexHome, "config.toml");
+  const configPath = import_node_path17.default.join(codexHome, "config.toml");
   const removePrompts = async () => uninstallPrompts(codexHome, options.promptNames ?? []);
   if (!await pathExists3(configPath)) {
     return { action: "missing", configPath, prompts: await removePrompts() };
@@ -52416,10 +52372,10 @@ async function uninstallCodex(options = {}) {
 }
 async function uninstallPrompts(codexHome, names) {
   if (names.length === 0) return [];
-  const promptsDir2 = import_node_path18.default.join(codexHome, "prompts");
+  const promptsDir2 = import_node_path17.default.join(codexHome, "prompts");
   const out = [];
   for (const name of names) {
-    const promptPath = import_node_path18.default.join(promptsDir2, `${name}.md`);
+    const promptPath = import_node_path17.default.join(promptsDir2, `${name}.md`);
     try {
       await import_promises4.default.unlink(promptPath);
       out.push({ name, action: "removed", promptPath });
@@ -52436,16 +52392,16 @@ async function uninstallPrompts(codexHome, names) {
 }
 
 // src/report-issue-prompt.ts
-var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_fs13 = __toESM(require("node:fs"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 var import_node_url3 = require("node:url");
 var import_meta3 = {};
 function promptsDir() {
-  if (typeof __dirname !== "undefined") return import_node_path19.default.join(__dirname, "prompts");
-  return import_node_path19.default.join(import_node_path19.default.dirname((0, import_node_url3.fileURLToPath)(import_meta3.url)), "prompts");
+  if (typeof __dirname !== "undefined") return import_node_path18.default.join(__dirname, "prompts");
+  return import_node_path18.default.join(import_node_path18.default.dirname((0, import_node_url3.fileURLToPath)(import_meta3.url)), "prompts");
 }
 function readReportIssuePrompt() {
-  return import_node_fs14.default.readFileSync(import_node_path19.default.join(promptsDir(), "report-issue.md"), "utf8");
+  return import_node_fs13.default.readFileSync(import_node_path18.default.join(promptsDir(), "report-issue.md"), "utf8");
 }
 
 // src/bin.ts
@@ -52705,8 +52661,8 @@ async function main() {
         env: process.env,
         cwd: process.cwd(),
         writeFile: (p, c) => {
-          (0, import_node_fs15.mkdirSync)(import_node_path21.default.dirname(p), { recursive: true, mode: 448 });
-          (0, import_node_fs15.writeFileSync)(p, c, { mode: 384 });
+          (0, import_node_fs14.mkdirSync)(import_node_path20.default.dirname(p), { recursive: true, mode: 448 });
+          (0, import_node_fs14.writeFileSync)(p, c, { mode: 384 });
         },
         runPm2: pm2Runner,
         which: whichBin,
@@ -52723,35 +52679,35 @@ async function main() {
         runPm2: (a) => ({ code: pm2Runner(a).code }),
         removeFile: (p) => {
           try {
-            (0, import_node_fs15.rmSync)(p, { force: true });
+            (0, import_node_fs14.rmSync)(p, { force: true });
           } catch {
           }
         },
         purgeSecret: purge,
         secretPath: agentCredentialPath(),
         tokenPath: operatorTokenPath(),
-        ecoPath: import_node_path21.default.join(process.env.HOME ?? (0, import_node_os12.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
+        ecoPath: import_node_path20.default.join(process.env.HOME ?? (0, import_node_os11.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
         log: (m) => process.stderr.write(`[mrrlin-mcp uninstall-service] ${m}
 `)
       });
       return;
     }
     case "uninstall": {
-      const home = process.env.HOME ?? (0, import_node_os12.homedir)();
+      const home = process.env.HOME ?? (0, import_node_os11.homedir)();
       const log = (m) => process.stderr.write(`[mrrlin-mcp uninstall] ${m}
 `);
       uninstallService({
         runPm2: (a) => ({ code: pm2Runner(a).code }),
         removeFile: (p) => {
           try {
-            (0, import_node_fs15.rmSync)(p, { force: true });
+            (0, import_node_fs14.rmSync)(p, { force: true });
           } catch {
           }
         },
         purgeSecret: true,
         secretPath: agentCredentialPath(),
         tokenPath: operatorTokenPath(),
-        ecoPath: import_node_path21.default.join(home, ".mrrlin", "ecosystem.config.cjs"),
+        ecoPath: import_node_path20.default.join(home, ".mrrlin", "ecosystem.config.cjs"),
         log
       });
       let codexOk = true;
@@ -52771,7 +52727,7 @@ async function main() {
         log(`codex config NOT modified: ${error51 instanceof Error ? error51.message : String(error51)}`);
       }
       try {
-        (0, import_node_fs15.rmSync)(import_node_path21.default.join(home, ".mrrlin"), { recursive: true, force: true });
+        (0, import_node_fs14.rmSync)(import_node_path20.default.join(home, ".mrrlin"), { recursive: true, force: true });
       } catch {
       }
       log("removed ~/.mrrlin");
@@ -52812,7 +52768,7 @@ ${HELP_TEXT}`);
   }
 }
 function resolveSelfBinPath() {
-  return import_node_path20.default.resolve(process.argv[1] ?? process.execPath);
+  return import_node_path19.default.resolve(process.argv[1] ?? process.execPath);
 }
 main().catch((error51) => {
   process.stderr.write(`mrrlin-mcp fatal error: ${error51 instanceof Error ? error51.message : String(error51)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrlin-dev/mcp",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "type": "module",
   "bin": {
     "mrrlin-mcp": "dist/bin.cjs"
@@ -22,8 +22,8 @@
     "@types/ws": "^8.18.1",
     "esbuild": "^0.24.0",
     "tsx": "^4.22.3",
-    "@mrrlin/client": "0.0.0",
     "@mrrlin/codex-client": "0.0.0",
+    "@mrrlin/client": "0.0.0",
     "@mrrlin/director-e2e": "0.0.0",
     "@mrrlin/schemas": "0.0.0",
     "@mrrlin/tsconfig": "0.0.0",