@navels/neal 0.1.0 → 0.3.0

package/dist/neal/providers/detection.js

@@ -92,10 +92,9 @@ export function detectBuiltInProviders(options = {}) {
         cwd: options.cwd ?? process.cwd(),
         resolveOpenAICompatibleSettings: options.resolveOpenAICompatibleSettings ?? ((cwd) => getOpenAICompatibleSettings(cwd, env)),
     };
-    // generic-agentic reuses the openai-compatible settings surface
-    // (providers.openai_compatible + env fallbacks), so both providers share
-    // one resolved-settings check. Memoized so the settings resolver still
-    // runs at most once per detection pass.
+    // openai-compatible resolves from the shared settings surface
+    // (providers.openai_compatible + env fallbacks). Memoized so the settings
+    // resolver still runs at most once per detection pass.
     let sharedOpenAICompatibleDetection;
     const detectFromSharedOpenAICompatibleSettings = () => {
         sharedOpenAICompatibleDetection ??= detectOpenAICompatible(resolvedOptions);
@@ -119,9 +118,6 @@ export function detectBuiltInProviders(options = {}) {
             case 'openai-compatible':
                 detection = detectFromSharedOpenAICompatibleSettings();
                 break;
-            case 'generic-agentic':
-                detection = detectFromSharedOpenAICompatibleSettings();
-                break;
             default:
                 detection = {
                     runtimeAvailable: false,

package/dist/neal/providers/git-config-isolation.js

@@ -0,0 +1,83 @@
+/**
+ * Git-config isolation for agent subprocesses.
+ *
+ * Agents (the coder especially) run shell commands with the operator's real
+ * environment, so `git config --global ...` writes the operator's actual
+ * `~/.gitconfig`. That has happened twice: a coder model hit git identity
+ * friction inside a throwaway worktree and "fixed" it globally, clobbering the
+ * operator's `[user]` block and breaking commit signing on their machine
+ * (issue #54).
+ *
+ * The defense is environmental, not behavioral: every agent subprocess gets
+ * `GIT_CONFIG_GLOBAL` pointed at a neal-owned scratch copy of the operator's
+ * global config, and `GIT_CONFIG_SYSTEM` pointed at the null device. Reads
+ * behave identically (the copy has the operator's settings, and `includeIf`
+ * paths inside it still resolve), agent commits keep the operator's identity
+ * and signing config, and a `--global` write succeeds from the agent's point
+ * of view — it just lands in the scratch copy instead of the operator's file.
+ *
+ * One scratch copy per process, created lazily: adapters are constructed per
+ * round, and the copy must be stable across rounds so an agent's own global
+ * writes persist for the life of the run.
+ */
+import { copyFileSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { devNull, homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+import process from 'node:process';
+let cached = null;
+/** Candidate sources for the operator's global config, in git's own precedence. */
+function globalConfigSourcePaths() {
+    const fromEnv = process.env.GIT_CONFIG_GLOBAL;
+    if (fromEnv !== undefined && fromEnv !== '') {
+        return [fromEnv];
+    }
+    const xdgBase = process.env.XDG_CONFIG_HOME !== undefined && process.env.XDG_CONFIG_HOME !== ''
+        ? process.env.XDG_CONFIG_HOME
+        : join(homedir(), '.config');
+    // ~/.gitconfig wins over the XDG file when both exist, matching git.
+    return [join(homedir(), '.gitconfig'), join(xdgBase, 'git', 'config')];
+}
+export function gitConfigIsolationEnv() {
+    if (cached !== null) {
+        return cached;
+    }
+    const dir = mkdtempSync(join(tmpdir(), 'neal-git-config-'));
+    const scratch = join(dir, 'gitconfig');
+    let copied = false;
+    for (const source of globalConfigSourcePaths()) {
+        try {
+            copyFileSync(source, scratch);
+            copied = true;
+            break;
+        }
+        catch {
+            // Missing source — try the next candidate.
+        }
+    }
+    if (!copied) {
+        // No global config on this machine; give agents an empty one to write to.
+        writeFileSync(scratch, '');
+    }
+    cached = { GIT_CONFIG_GLOBAL: scratch, GIT_CONFIG_SYSTEM: devNull };
+    return cached;
+}
+/**
+ * The full environment for an agent subprocess whose SDK replaces (rather
+ * than merges with) the parent environment when `env` is provided.
+ * `undefined` entries are dropped because those SDKs type env as
+ * `Record<string, string>`.
+ */
+export function agentSubprocessEnv() {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    return { ...env, ...gitConfigIsolationEnv() };
+}
+// Test-only: drop the process-level cache so a test can point the source at a
+// fixture file. Mirrors disableAgentSettingsIsolation's teardown role.
+export function resetGitConfigIsolationForTests() {
+    cached = null;
+}

package/dist/neal/providers/openai-codex.js

@@ -1,6 +1,9 @@
 import { Codex } from '@openai/codex-sdk';
 import { runStructuredJsonProtocol } from '../agents/structured-json.js';
-import { NealProviderError } from './types.js';
+import { agentSettingsIsolated } from './agent-settings-isolation.js';
+import { agentSubprocessEnv } from './git-config-isolation.js';
+import { resolveRateCost } from './pricing.js';
+import { isContentSafetyRefusalMessage, NealProviderError } from './types.js';
 const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
 class CodexInactivityTimeoutError extends Error {
     constructor(timeoutMs) {
@@ -10,7 +13,7 @@ class CodexInactivityTimeoutError extends Error {
 }
 // In-round transient (`api_error`) retries back off exponentially: 500 ms
 // base, doubling per retry, capped at 5 s — the same schedule as the
-// generic-agentic adapter. `sleep` is injectable through the adapter options
+// openai-compatible adapter. `sleep` is injectable through the adapter options
 // so tests observe the delays without wall-clock waiting.
 const API_RETRY_BASE_DELAY_MS = 500;
 const API_RETRY_MAX_DELAY_MS = 5_000;
@@ -67,6 +70,12 @@ function inferCodexErrorKind(error, message, fallback) {
     if (error instanceof CodexInactivityTimeoutError || /\btimed out after\b/i.test(message)) {
         return 'timeout';
     }
+    // Placed before the permission check so a content-safety refusal is never
+    // misread as permission_denied when OpenAI phrases it with the word
+    // "authorized".
+    if (isContentSafetyRefusalMessage(message)) {
+        return 'content_refused';
+    }
     if (text.includes('permission') || text.includes('denied') || text.includes('forbidden') || text.includes('not authorized')) {
         return 'permission_denied';
     }
@@ -228,7 +237,21 @@ function buildCodexThreadOptions(args) {
     };
 }
 function createCodexThread(args) {
-    const codex = new Codex();
+    // Under compat qualification only, isolate from the user's interactive
+    // `notify` hook in ~/.codex/config.toml: compat runs the whole role matrix
+    // through Codex, and left alone the hook fires a desktop notification per
+    // planner/coder/reviewer turn. Override `notify` to empty (a `--config
+    // notify=[]` pass to the CLI) for that case. Normal neal runs (pipeline,
+    // local `neal go`) honor the user's config. See agent-settings-isolation.ts.
+    //
+    // `env` is always passed (the SDK stops inheriting process.env once env is
+    // provided, so it is the full environment plus the git-config isolation
+    // overrides): the Codex CLI and every shell it runs must not be able to
+    // write the operator's real global gitconfig. See git-config-isolation.ts.
+    const env = agentSubprocessEnv();
+    const codex = agentSettingsIsolated()
+        ? new Codex({ config: { notify: [] }, env })
+        : new Codex({ env });
     const threadOptions = buildCodexThreadOptions({
         cwd: args.cwd,
         model: args.model,
@@ -269,7 +292,17 @@ async function emitCodexStreamError(args) {
     });
     return true;
 }
-async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessionStarted, abortController) {
+// Shared turn consumer behind `consumeCodexTurn` (coder) and
+// `consumeCodexAdvisorTurn` (structured advisor). The two paths differ only
+// in the role stamped on emitted events and normalized errors, the
+// advisor-only `label` stamp, and the coder-only `onSessionStarted`
+// callback; everything else is identical.
+async function consumeCodexTurnWithOptions(turn, cwd, inactivityTimeoutMs, options) {
+    const { role, label, events, onSessionStarted, abortController, model } = options;
+    // The advisor path stamps `label` on every emitted event while the coder
+    // path emits events without a `label` property at all — the conditional
+    // spread preserves that own-property distinction exactly.
+    const labelFields = label === undefined ? {} : { label };
     let finalResponse = '';
     let observedFailure = null;
     let sessionHandle = null;
@@ -282,13 +315,13 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
         catch (error) {
             if (observedFailure) {
                 throw createCodexProviderErrorFromObservedFailure(observedFailure, {
-                    role: 'coder',
+                    role,
                     sessionHandle,
                     cause: error,
                 });
             }
             throw normalizeCodexProviderError(error, {
-                role: 'coder',
+                role,
                 sessionHandle,
             });
         }
@@ -302,7 +335,8 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
                 await emitProviderEvent(events, {
                     type: 'session_started',
                     provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'coder',
+                    role,
+                    ...labelFields,
                     sessionHandle: event.thread_id,
                     providerData: { sdkEventType: event.type },
                 });
@@ -312,7 +346,8 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
                 await emitProviderEvent(events, {
                     type: 'turn_started',
                     provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'coder',
+                    role,
+                    ...labelFields,
                     sessionHandle,
                     providerData: { sdkEventType: event.type },
                 });
@@ -321,7 +356,8 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
                 await emitProviderEvent(events, {
                     type: 'tool_started',
                     provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'coder',
+                    role,
+                    ...labelFields,
                     sessionHandle,
                     itemId: summarizeItem(event.item).itemId,
                     toolName: event.item.type,
@@ -332,7 +368,8 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
                 await emitProviderEvent(events, {
                     type: 'tool_progress',
                     provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'coder',
+                    role,
+                    ...labelFields,
                     sessionHandle,
                     itemId: summarizeItem(event.item).itemId,
                     toolName: event.item.type,
@@ -344,7 +381,8 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
                     await emitProviderEvent(events, {
                         type: 'command_completed',
                         provider: OPENAI_CODEX_PROVIDER_ID,
-                        role: 'coder',
+                        role,
+                        ...labelFields,
                         sessionHandle,
                         itemId: event.item.id,
                         command: event.item.command,
@@ -361,7 +399,8 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
                     await emitProviderEvent(events, {
                         type: 'file_changed',
                         provider: OPENAI_CODEX_PROVIDER_ID,
-                        role: 'coder',
+                        role,
+                        ...labelFields,
                         sessionHandle,
                         files,
                         providerData: { sdkEventType: event.type, item: summarizeItem(event.item) },
@@ -371,206 +410,41 @@ async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessio
                     finalResponse = event.item.text;
                 }
                 break;
-            case 'turn.completed':
+            case 'turn.completed': {
+                // Card-derived cost only when the turn actually carried usage. Codex
+                // advertises opportunistic usage reporting, and `computeRateCostUsd`
+                // returns 0 for absent usage, so gating on `event.usage !== undefined`
+                // (matching the usage_reported emit) keeps a usage-less turn's
+                // tokens-only shape byte-stable rather than attaching costUsd: 0. Codex
+                // has no config pricing, so cost comes from the card via the configured
+                // model only.
+                const cost = event.usage !== undefined
+                    ? (resolveRateCost({ usage: event.usage, model: model ?? null, configPricing: null }) ?? {})
+                    : {};
                 await emitProviderEvent(events, {
                     type: 'turn_completed',
                     provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'coder',
+                    role,
+                    ...labelFields,
                     sessionHandle,
                     usage: event.usage,
+                    ...cost,
                     providerData: { sdkEventType: event.type },
                 });
                 if (event.usage !== undefined) {
                     await emitProviderEvent(events, {
                         type: 'usage_reported',
                         provider: OPENAI_CODEX_PROVIDER_ID,
-                        role: 'coder',
+                        role,
+                        ...labelFields,
                         sessionHandle,
                         usage: event.usage,
+                        ...cost,
                         providerData: { sdkEventType: event.type },
                     });
                 }
                 break;
-            case 'turn.failed':
-                {
-                    const nextFailure = observeCodexFailure({
-                        message: event.error.message,
-                        source: event.type,
-                        cause: event.error,
-                    });
-                    if (shouldReplaceCodexFailure(observedFailure, nextFailure)) {
-                        observedFailure = nextFailure;
-                        await emitProviderEvent(events, {
-                            type: 'provider_error',
-                            provider: OPENAI_CODEX_PROVIDER_ID,
-                            role: 'coder',
-                            sessionHandle,
-                            message: event.error.message,
-                            providerData: { sdkEventType: event.type },
-                        });
-                    }
-                }
-                break;
-            case 'error':
-                {
-                    const nextFailure = observeCodexFailure({
-                        message: event.message,
-                        source: event.type,
-                        cause: event,
-                    });
-                    if (shouldReplaceCodexFailure(observedFailure, nextFailure)) {
-                        if (await emitCodexStreamError({
-                            events,
-                            role: 'coder',
-                            sessionHandle,
-                            message: event.message,
-                        })) {
-                            observedFailure = nextFailure;
-                        }
-                    }
-                }
-                break;
-            default:
-                break;
-        }
-    }
-    if (observedFailure) {
-        throw createCodexProviderErrorFromObservedFailure(observedFailure, {
-            role: 'coder',
-            sessionHandle,
-        });
-    }
-    return { finalResponse, sessionHandle };
-}
-async function consumeCodexAdvisorTurn(turn, cwd, label, inactivityTimeoutMs, events, abortController) {
-    let finalResponse = '';
-    let observedFailure = null;
-    let sessionHandle = null;
-    const iterator = turn.events[Symbol.asyncIterator]();
-    while (true) {
-        let next;
-        try {
-            next = await nextWithTimeout(iterator.next(), inactivityTimeoutMs, () => abortController?.abort());
-        }
-        catch (error) {
-            if (observedFailure) {
-                throw createCodexProviderErrorFromObservedFailure(observedFailure, {
-                    role: 'structured-advisor',
-                    sessionHandle,
-                    cause: error,
-                });
             }
-            throw normalizeCodexProviderError(error, {
-                role: 'structured-advisor',
-                sessionHandle,
-            });
-        }
-        if (next.done) {
-            break;
-        }
-        const event = next.value;
-        switch (event.type) {
-            case 'thread.started':
-                sessionHandle = event.thread_id;
-                await emitProviderEvent(events, {
-                    type: 'session_started',
-                    provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'structured-advisor',
-                    label,
-                    sessionHandle: event.thread_id,
-                    providerData: { sdkEventType: event.type },
-                });
-                break;
-            case 'turn.started':
-                await emitProviderEvent(events, {
-                    type: 'turn_started',
-                    provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'structured-advisor',
-                    label,
-                    sessionHandle,
-                    providerData: { sdkEventType: event.type },
-                });
-                break;
-            case 'item.started':
-                await emitProviderEvent(events, {
-                    type: 'tool_started',
-                    provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'structured-advisor',
-                    label,
-                    sessionHandle,
-                    itemId: summarizeItem(event.item).itemId,
-                    toolName: event.item.type,
-                    providerData: { sdkEventType: event.type, item: summarizeItem(event.item) },
-                });
-                break;
-            case 'item.updated':
-                await emitProviderEvent(events, {
-                    type: 'tool_progress',
-                    provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'structured-advisor',
-                    label,
-                    sessionHandle,
-                    itemId: summarizeItem(event.item).itemId,
-                    toolName: event.item.type,
-                    providerData: { sdkEventType: event.type, item: summarizeItem(event.item) },
-                });
-                break;
-            case 'item.completed':
-                if (event.item.type === 'command_execution') {
-                    await emitProviderEvent(events, {
-                        type: 'command_completed',
-                        provider: OPENAI_CODEX_PROVIDER_ID,
-                        role: 'structured-advisor',
-                        label,
-                        sessionHandle,
-                        itemId: event.item.id,
-                        command: event.item.command,
-                        status: event.item.status,
-                        exitCode: event.item.exit_code ?? null,
-                        output: event.item.aggregated_output,
-                        outputLength: event.item.aggregated_output.length,
-                        cwd,
-                        providerData: { sdkEventType: event.type, item: summarizeItem(event.item) },
-                    });
-                }
-                else if (event.item.type === 'file_change' && event.item.changes.length > 0) {
-                    const files = event.item.changes.map((change) => change.path);
-                    await emitProviderEvent(events, {
-                        type: 'file_changed',
-                        provider: OPENAI_CODEX_PROVIDER_ID,
-                        role: 'structured-advisor',
-                        label,
-                        sessionHandle,
-                        files,
-                        providerData: { sdkEventType: event.type, item: summarizeItem(event.item) },
-                    });
-                }
-                else if (event.item.type === 'agent_message') {
-                    finalResponse = event.item.text;
-                }
-                break;
-            case 'turn.completed':
-                await emitProviderEvent(events, {
-                    type: 'turn_completed',
-                    provider: OPENAI_CODEX_PROVIDER_ID,
-                    role: 'structured-advisor',
-                    label,
-                    sessionHandle,
-                    usage: event.usage,
-                    providerData: { sdkEventType: event.type },
-                });
-                if (event.usage !== undefined) {
-                    await emitProviderEvent(events, {
-                        type: 'usage_reported',
-                        provider: OPENAI_CODEX_PROVIDER_ID,
-                        role: 'structured-advisor',
-                        label,
-                        sessionHandle,
-                        usage: event.usage,
-                        providerData: { sdkEventType: event.type },
-                    });
-                }
-                break;
             case 'turn.failed':
                 {
                     const nextFailure = observeCodexFailure({
@@ -583,8 +457,8 @@ async function consumeCodexAdvisorTurn(turn, cwd, label, inactivityTimeoutMs, ev
                         await emitProviderEvent(events, {
                             type: 'provider_error',
                             provider: OPENAI_CODEX_PROVIDER_ID,
-                            role: 'structured-advisor',
-                            label,
+                            role,
+                            ...labelFields,
                             sessionHandle,
                             message: event.error.message,
                             providerData: { sdkEventType: event.type },
@@ -602,7 +476,7 @@ async function consumeCodexAdvisorTurn(turn, cwd, label, inactivityTimeoutMs, ev
                     if (shouldReplaceCodexFailure(observedFailure, nextFailure)) {
                         if (await emitCodexStreamError({
                             events,
-                            role: 'structured-advisor',
+                            role,
                             label,
                             sessionHandle,
                             message: event.message,
@@ -618,12 +492,36 @@ async function consumeCodexAdvisorTurn(turn, cwd, label, inactivityTimeoutMs, ev
     }
     if (observedFailure) {
         throw createCodexProviderErrorFromObservedFailure(observedFailure, {
-            role: 'structured-advisor',
+            role,
             sessionHandle,
         });
     }
     return { finalResponse, sessionHandle };
 }
+async function consumeCodexTurn(turn, cwd, inactivityTimeoutMs, events, onSessionStarted, abortController, 
+// Appended last so existing positional callers (including test hooks) stay
+// valid; forwards the configured slug for card-derived cost.
+model) {
+    return consumeCodexTurnWithOptions(turn, cwd, inactivityTimeoutMs, {
+        role: 'coder',
+        events,
+        onSessionStarted,
+        abortController,
+        model,
+    });
+}
+async function consumeCodexAdvisorTurn(turn, cwd, label, inactivityTimeoutMs, events, abortController, 
+// Appended last so existing positional callers (including test hooks) stay
+// valid; forwards the configured slug for card-derived cost.
+model) {
+    return consumeCodexTurnWithOptions(turn, cwd, inactivityTimeoutMs, {
+        role: 'structured-advisor',
+        label,
+        events,
+        abortController,
+        model,
+    });
+}
 function parseCodexStructuredOutput(finalResponse, label, sessionHandle) {
     try {
         return JSON.parse(finalResponse);
@@ -685,7 +583,7 @@ class OpenAICodexCoderAdapter {
                 ...(args.outputSchema ? { outputSchema: args.outputSchema } : {}),
                 signal: abortController.signal,
             });
-            const result = await consumeCodexTurn(streamedTurn, args.cwd, args.inactivityTimeoutMs, args.events, args.onSessionStarted, abortController);
+            const result = await consumeCodexTurn(streamedTurn, args.cwd, args.inactivityTimeoutMs, args.events, args.onSessionStarted, abortController, this.options.model ?? null);
             if (args.outputSchema) {
                 await emitProviderEvent(args.events, {
                     type: 'structured_output_received',
@@ -745,7 +643,7 @@ class OpenAICodexCoderAdapter {
                         const streamedTurn = await thread.runStreamed(prompt, {
                             signal: abortController.signal,
                         });
-                        const result = await consumeCodexTurn(streamedTurn, args.cwd, args.inactivityTimeoutMs, args.events, args.onSessionStarted, abortController);
+                        const result = await consumeCodexTurn(streamedTurn, args.cwd, args.inactivityTimeoutMs, args.events, args.onSessionStarted, abortController, this.options.model ?? null);
                         return {
                             assistantText: result.finalResponse,
                             sessionHandle: thread.id,
@@ -767,7 +665,7 @@ class OpenAICodexCoderAdapter {
                         const streamedTurn = await repairThread.runStreamed(prompt, {
                             signal: repairAbortController.signal,
                         });
-                        const result = await consumeCodexTurn(streamedTurn, args.cwd, args.inactivityTimeoutMs, args.events, undefined, repairAbortController);
+                        const result = await consumeCodexTurn(streamedTurn, args.cwd, args.inactivityTimeoutMs, args.events, undefined, repairAbortController, this.options.model ?? null);
                         return {
                             assistantText: result.finalResponse,
                             sessionHandle: repairThread.id,
@@ -865,7 +763,7 @@ class OpenAICodexStructuredAdvisorAdapter {
                             const streamedTurn = await thread.runStreamed(prompt, {
                                 signal: abortController.signal,
                             });
-                            const result = await consumeCodexAdvisorTurn(streamedTurn, args.cwd, args.label, args.inactivityTimeoutMs, args.events, abortController);
+                            const result = await consumeCodexAdvisorTurn(streamedTurn, args.cwd, args.label, args.inactivityTimeoutMs, args.events, abortController, this.options.model ?? null);
                             return {
                                 assistantText: result.finalResponse,
                                 sessionHandle: thread.id ?? result.sessionHandle ?? null,
@@ -883,7 +781,7 @@ class OpenAICodexStructuredAdvisorAdapter {
                             const streamedTurn = await repairThread.runStreamed(prompt, {
                                 signal: repairAbortController.signal,
                             });
-                            const result = await consumeCodexAdvisorTurn(streamedTurn, args.cwd, args.label, args.inactivityTimeoutMs, args.events, repairAbortController);
+                            const result = await consumeCodexAdvisorTurn(streamedTurn, args.cwd, args.label, args.inactivityTimeoutMs, args.events, repairAbortController, this.options.model ?? null);
                             return {
                                 assistantText: result.finalResponse,
                                 sessionHandle: repairThread.id ?? result.sessionHandle ?? null,
@@ -900,7 +798,7 @@ class OpenAICodexStructuredAdvisorAdapter {
                     });
                 }
                 const streamedTurn = await thread.runStreamed(args.prompt, buildCodexStructuredAdvisorRunOptions(args, abortController.signal));
-                const result = await consumeCodexAdvisorTurn(streamedTurn, args.cwd, args.label, args.inactivityTimeoutMs, args.events, abortController);
+                const result = await consumeCodexAdvisorTurn(streamedTurn, args.cwd, args.label, args.inactivityTimeoutMs, args.events, abortController, this.options.model ?? null);
                 const structured = parseCodexStructuredOutput(result.finalResponse, args.label, thread.id);
                 await emitProviderEvent(args.events, {
                     type: 'structured_output_received',

package/dist/neal/providers/{generic-agentic-tools.js → openai-compatible-tools.js}

@@ -1,8 +1,6 @@
 /**
- * Generic-agentic tool layer: the six neal-defined AI SDK tools, jailed to a
- * root directory. Ported from `spike/generic-agentic/src/tools.ts` (copied,
- * never imported — the spike stays a frozen historical reference) with the
- * Phase 1 hardening from the integration plan:
+ * openai-compatible provider tool layer: the six neal-defined AI SDK tools,
+ * jailed to a root directory. Key mechanics:
  *
  * - an event-emission hook so tool execution surfaces the existing provider
  *   event grammar (`tool_started`, `tool_progress`, `command_completed`,
@@ -42,6 +40,7 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { tool } from 'ai';
 import { z } from 'zod';
+import { gitConfigIsolationEnv } from './git-config-isolation.js';
 export const RESULT_BYTE_LIMIT = 16 * 1024;
 export const READ_FILE_BYTE_LIMIT = 256 * 1024;
 export const GREP_MAX_MATCHING_LINES = 200;
@@ -386,7 +385,14 @@ function gitDiffBody(rootDir, base, head, relativePath, stat) {
 }
 function runBody(rootDir, command, timeoutMs) {
     return new Promise((resolve) => {
-        exec(command, { cwd: path.resolve(rootDir), timeout: timeoutMs, maxBuffer: 10 * 1024 * 1024 }, (error, stdout, stderr) => {
+        exec(command, {
+            cwd: path.resolve(rootDir),
+            // Agent-issued shell commands must not be able to write the operator's
+            // real global gitconfig. See git-config-isolation.ts.
+            env: { ...process.env, ...gitConfigIsolationEnv() },
+            timeout: timeoutMs,
+            maxBuffer: 10 * 1024 * 1024,
+        }, (error, stdout, stderr) => {
             const timedOut = Boolean(error && error.killed);
             let exitCode;
             if (error) {