@noopolis/daimon 0.1.1 → 0.2.0

package/dist/pi/cliChildOutput.js

@@ -0,0 +1,269 @@
+import { redactCredentialText } from "../core/credentialRedaction.js";
+import { headUtf8, tailUtf8 } from "../runtime/toolResultSpill.js";
+import { decodeCodexTurnUsage } from "./codexHeadlessResult.js";
+import { terminateChild, trackCliChild } from "./cliProcess.js";
+/** Maximum assistant reply bytes retained from stdout. */
+export const CLI_ENGINE_MAX_OUTPUT_BYTES = 64 * 1024;
+/** Diagnostic bytes retained from stderr for a failed child: its head and its tail together. */
+export const CLI_ENGINE_MAX_DIAGNOSTIC_BYTES = 768;
+const CLI_ENGINE_FAILURE_SCAN_CHARS = 256;
+/**
+ * Which bound or condition failed a wake, carried on the error object itself.
+ *
+ * The caller needs this to label the usage row a failed wake still owes the
+ * ledger, and matching on the message text would make that label depend on
+ * prose. The tag is a non-enumerable symbol property, so it never widens the
+ * error's serialized form and never reaches a diagnostic string.
+ */
+const CLI_CHILD_FAILURE_REASON = Symbol("daimon.cliChildFailureReason");
+export const tagCliChildFailure = (error, reason) => {
+    if (!(error instanceof Error))
+        return error;
+    // Labelling a failure must never become a second failure: a frozen or sealed
+    // error simply goes untagged and its row reads `unknown`.
+    try {
+        Object.defineProperty(error, CLI_CHILD_FAILURE_REASON, { configurable: true, enumerable: false, value: reason, writable: true });
+    }
+    catch { /* the reason is advisory; the failure it describes is not */ }
+    return error;
+};
+export const cliChildFailureReason = (error) => error instanceof Error
+    ? error[CLI_CHILD_FAILURE_REASON]
+    : undefined;
+const redactChildOutput = (value, secretValues) => {
+    return redactCredentialText(value, secretValues, CLI_ENGINE_MAX_OUTPUT_BYTES);
+};
+/**
+ * One bounded window over a failed child's own output: its head AND its tail,
+ * with an explicit marker naming the bytes elided between them.
+ *
+ * A pure tail is the wrong end for the process this exists for. A worker that
+ * dies early prints its error first and then echoes its own input, so the tail
+ * is the echo: one live brokered turn reported 512 bytes of its own prompt
+ * read back, with the actual error already off the front and discarded. Both
+ * ends cost the same window, and the marker is the one oversized tool results
+ * already use (`toolResultSpill.ts`), so a reader meets one shape everywhere.
+ *
+ * The marker is paid for out of the same budget — it is sized against the
+ * largest count it could carry — so the result never exceeds `maxBytes`, and
+ * output that fits is returned byte-identical with no marker at all.
+ */
+export const boundedDiagnosticWindow = (value, maxBytes) => {
+    const total = Buffer.byteLength(value, "utf8");
+    if (total <= maxBytes)
+        return value;
+    const budget = Math.max(0, maxBytes - Buffer.byteLength(elisionMarker(total), "utf8"));
+    const head = headUtf8(value, Math.floor(budget / 2));
+    const tail = tailUtf8(value, budget - Buffer.byteLength(head, "utf8"));
+    const elided = total - Buffer.byteLength(head, "utf8") - Buffer.byteLength(tail, "utf8");
+    return `${head}${elisionMarker(elided)}${tail}`;
+};
+const elisionMarker = (elided) => `[… ${elided} bytes elided …]`;
+const childDiagnostic = (stdout, stderr, secretValues) => {
+    const output = stderr.trim().length > 0 ? stderr : stdout;
+    const redacted = redactCredentialText(output, secretValues, Number.MAX_SAFE_INTEGER).trim();
+    const bounded = boundedDiagnosticWindow(redacted, CLI_ENGINE_MAX_DIAGNOSTIC_BYTES).trim();
+    return bounded.length > 0 ? `: ${bounded}` : "";
+};
+export const readChild = (child, timeoutMs, secretValues, options = {}) => new Promise((resolve, reject) => {
+    trackCliChild(child);
+    const stdout = [];
+    let stdoutTail = Buffer.alloc(0);
+    let droppingStdoutLine = false;
+    // Both ends of stderr, retained as it streams: the head frozen once it is
+    // full, the tail sliding. A single sliding tail dropped the head at capture
+    // time, which is where the cause of an early death lives — no later window
+    // can recover what was never kept.
+    let stderrHead = Buffer.alloc(0);
+    let stderrTail = Buffer.alloc(0);
+    let stderrBytes = 0;
+    let stdoutBytes = 0;
+    let stdoutRemainder = Buffer.alloc(0);
+    let droppingNdjsonLine = false;
+    let ndjsonCalls = 0;
+    let settled = false;
+    let cleanupStarted = false;
+    let classifiedFailure;
+    let failureScanTail = "";
+    /**
+     * Each retained end carries its reported share PLUS one whole secret, which
+     * is the invariant that keeps exact redaction exact: a secret that reaches
+     * the reported window can extend at most its own length past that window's
+     * cut, so retaining that much more on each side means the redactor always
+     * sees the secret whole. Halving one shared budget instead broke it — a
+     * 2000-byte secret was cut in the middle and its tail fragment
+     * (`…qqq-secret-end`) reached the diagnostic verbatim.
+     */
+    const stderrSecretAllowance = Math.max(0, ...secretValues.map((secret) => Buffer.byteLength(secret, "utf8")));
+    const stderrHeadBytes = Math.floor(CLI_ENGINE_MAX_DIAGNOSTIC_BYTES / 2) + stderrSecretAllowance;
+    const stderrTailBytes = CLI_ENGINE_MAX_DIAGNOSTIC_BYTES - Math.floor(CLI_ENGINE_MAX_DIAGNOSTIC_BYTES / 2) + stderrSecretAllowance;
+    const settle = (action) => {
+        if (settled)
+            return;
+        settled = true;
+        if (timer !== undefined)
+            clearTimeout(timer);
+        action();
+    };
+    const abort = (error) => {
+        if (cleanupStarted)
+            return;
+        cleanupStarted = true;
+        void terminateChild(child).then(() => settle(() => reject(error)), (cleanupError) => settle(() => reject(cleanupError instanceof Error ? cleanupError : error)));
+    };
+    const classifyFailure = (chunk) => {
+        if (classifiedFailure !== undefined || options.failureClassifier === undefined)
+            return;
+        const diagnostic = `${failureScanTail}${chunk.toString("utf8")}`;
+        classifiedFailure = options.failureClassifier(diagnostic);
+        failureScanTail = diagnostic.slice(-CLI_ENGINE_FAILURE_SCAN_CHARS);
+    };
+    const retainStdout = (chunk) => {
+        const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        classifyFailure(value);
+        if (options.retainNdjson !== undefined) {
+            let incoming = value;
+            if (droppingNdjsonLine) {
+                const newline = incoming.indexOf(0x0a);
+                if (newline < 0)
+                    return;
+                droppingNdjsonLine = false;
+                incoming = incoming.subarray(newline + 1);
+            }
+            stdoutRemainder = Buffer.concat([stdoutRemainder, incoming]);
+            let newline;
+            while ((newline = stdoutRemainder.indexOf(0x0a)) >= 0) {
+                const line = stdoutRemainder.subarray(0, newline).toString("utf8");
+                stdoutRemainder = Buffer.from(stdoutRemainder.subarray(newline + 1));
+                let frame;
+                try {
+                    const parsed = JSON.parse(line);
+                    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+                        frame = parsed;
+                }
+                catch { /* decoder reports malformed retained protocol lines */ }
+                if (frame === undefined) {
+                    stdout.push(Buffer.from(`${line}\n`));
+                    continue;
+                }
+                if (frame.type === "thread.started" && typeof frame.thread_id === "string") {
+                    options.onCodexThreadStarted?.(frame.thread_id);
+                    continue;
+                }
+                const item = typeof frame.item === "object" && frame.item !== null && !Array.isArray(frame.item) ? frame.item : undefined;
+                if (frame.type === "item.completed" && (item?.type === "command_execution" || item?.type === "mcp_tool_call")) {
+                    ndjsonCalls += 1;
+                    stdout.push(Buffer.from(`${JSON.stringify({ type: frame.type, item: { type: item.type } })}\n`));
+                }
+                else if ((frame.type === "item.completed" && item?.type === "agent_message") || frame.type === "turn.completed" || frame.type === "turn.failed") {
+                    if (frame.type === "turn.completed") {
+                        // Decode and publish first, kill second: the ceiling breach is the
+                        // one path guaranteed to destroy this stream, so the accounting
+                        // has to leave the reader before the child does.
+                        const usage = decodeCodexTurnUsage(frame, ndjsonCalls);
+                        options.onCodexTurnCompleted?.(usage);
+                        if (options.codexTokenCeiling !== undefined && usage !== undefined && usage.total >= options.codexTokenCeiling) {
+                            abort(tagCliChildFailure(new Error(`Codex wake exceeded its ${options.codexTokenCeiling}-token per-wake ceiling (turn usage ${usage.total} tokens)`), "token_ceiling"));
+                            return;
+                        }
+                    }
+                    stdout.push(Buffer.from(`${line}\n`));
+                }
+                stdoutBytes = stdout.reduce((total, part) => total + part.length, 0);
+                if (stdoutBytes > CLI_ENGINE_MAX_OUTPUT_BYTES) {
+                    abort(tagCliChildFailure(new Error(`CLI engine output exceeded ${CLI_ENGINE_MAX_OUTPUT_BYTES} bytes`), "output_limit"));
+                    return;
+                }
+            }
+            if (stdoutRemainder.length > CLI_ENGINE_MAX_OUTPUT_BYTES) {
+                const prefix = stdoutRemainder.subarray(0, Math.min(stdoutRemainder.length, 4096)).toString("utf8");
+                if (/"type"\s*:\s*"item\.completed"/u.test(prefix)
+                    && !/"type"\s*:\s*"agent_message"/u.test(prefix)) {
+                    const toolType = prefix.match(/"type"\s*:\s*"(command_execution|mcp_tool_call)"/u)?.[1];
+                    if (toolType !== undefined) {
+                        ndjsonCalls += 1;
+                        stdout.push(Buffer.from(`${JSON.stringify({ type: "item.completed", item: { type: toolType } })}\n`));
+                    }
+                    stdoutRemainder = Buffer.alloc(0);
+                    droppingNdjsonLine = true;
+                }
+                else
+                    abort(tagCliChildFailure(new Error(`CLI engine output exceeded ${CLI_ENGINE_MAX_OUTPUT_BYTES} bytes`), "output_limit"));
+            }
+            return;
+        }
+        if (options.retainStdoutTail === true) {
+            let remainder = value;
+            if (droppingStdoutLine) {
+                const newline = remainder.indexOf(0x0a);
+                if (newline < 0)
+                    return;
+                droppingStdoutLine = false;
+                remainder = remainder.subarray(newline + 1);
+            }
+            const combined = Buffer.concat([stdoutTail, remainder]);
+            if (combined.length <= CLI_ENGINE_MAX_OUTPUT_BYTES) {
+                stdoutTail = combined;
+                return;
+            }
+            const overflow = combined.length - CLI_ENGINE_MAX_OUTPUT_BYTES;
+            if (combined[overflow - 1] === 0x0a) {
+                stdoutTail = Buffer.from(combined.subarray(overflow));
+                return;
+            }
+            const newline = combined.indexOf(0x0a, overflow);
+            stdoutTail = newline < 0 ? Buffer.alloc(0) : Buffer.from(combined.subarray(newline + 1));
+            droppingStdoutLine = newline < 0;
+            return;
+        }
+        stdoutBytes += value.length;
+        if (stdoutBytes > CLI_ENGINE_MAX_OUTPUT_BYTES) {
+            abort(tagCliChildFailure(new Error(`CLI engine output exceeded ${CLI_ENGINE_MAX_OUTPUT_BYTES} bytes`), "output_limit"));
+            return;
+        }
+        stdout.push(value);
+    };
+    const retainStderrWindow = (chunk) => {
+        const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        classifyFailure(value);
+        stderrBytes += value.length;
+        if (stderrHead.length < stderrHeadBytes)
+            stderrHead = Buffer.concat([stderrHead, value.subarray(0, stderrHeadBytes - stderrHead.length)]);
+        if (value.length >= stderrTailBytes) {
+            stderrTail = Buffer.from(value.subarray(value.length - stderrTailBytes));
+            return;
+        }
+        const overflow = stderrTail.length + value.length - stderrTailBytes;
+        stderrTail = Buffer.concat([overflow > 0 ? stderrTail.subarray(overflow) : stderrTail, value]);
+    };
+    /**
+     * The retained stderr, reassembled exactly.
+     *
+     * Nothing was elided while the whole output fitted the budget, and then the
+     * two ends overlap: they tile the stream, so dropping the overlap from the
+     * tail rebuilds it byte-identically. Above the budget the ends are joined by
+     * the marker, which names how many bytes never reached this process at all.
+     */
+    const retainedStderr = () => {
+        const elided = stderrBytes - stderrHead.length - stderrTail.length;
+        if (elided <= 0)
+            return Buffer.concat([stderrHead, stderrTail.subarray(stderrHead.length + stderrTail.length - stderrBytes)]).toString("utf8");
+        return `${stderrHead.toString("utf8")}${elisionMarker(elided)}${stderrTail.toString("utf8")}`;
+    };
+    child.stdout?.on("data", retainStdout);
+    child.stderr?.on("data", retainStderrWindow);
+    const timer = timeoutMs === undefined ? undefined : setTimeout(() => abort(tagCliChildFailure(new Error(options.timeoutErrorMessage ?? "CLI engine timed out"), "wake_timeout")), timeoutMs);
+    child.once("error", abort);
+    child.once("close", (code, signal) => {
+        if (cleanupStarted)
+            return;
+        if (options.retainNdjson !== undefined && stdoutRemainder.length > 0)
+            stdout.push(stdoutRemainder);
+        const retainedStdout = options.retainStdoutTail === true ? stdoutTail : Buffer.concat(stdout);
+        if (code === 0) {
+            settle(() => resolve(redactChildOutput(retainedStdout.toString("utf8"), secretValues).trim()));
+            return;
+        }
+        settle(() => reject(tagCliChildFailure(classifiedFailure ?? new Error(`CLI engine exited ${code ?? signal}${childDiagnostic(retainedStdout.toString("utf8"), retainedStderr(), secretValues)}`), "engine_exit")));
+    });
+});

package/dist/pi/cliEngineRun.d.ts

@@ -0,0 +1,16 @@
+import { type CliEngineKind } from "./cliSession.js";
+export interface EngineRunResult {
+    readonly durationMs: number;
+    readonly outputChars: number;
+    readonly promptChars: number;
+    readonly text: string;
+}
+export declare const runEngineDetailed: (engine: CliEngineKind, prompt: string, paths: {
+    readonly workspacePath: string;
+    readonly runtimeHomePath?: string;
+}) => Promise<EngineRunResult>;
+export declare const runEngine: (engine: CliEngineKind, prompt: string, paths: {
+    readonly workspacePath: string;
+    readonly runtimeHomePath?: string;
+}) => Promise<string>;
+//# sourceMappingURL=cliEngineRun.d.ts.map

package/dist/pi/cliEngineRun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliEngineRun.d.ts","sourceRoot":"","sources":["../../src/pi/cliEngineRun.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,KAAK,aAAa,EAAyB,MAAM,iBAAiB,CAAC;AAEzH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,aAAa,EACrB,QAAQ,MAAM,EACd,OAAO;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,KAC3E,OAAO,CAAC,eAAe,CAsBzB,CAAC;AAEF,eAAO,MAAM,SAAS,GACpB,QAAQ,aAAa,EACrB,QAAQ,MAAM,EACd,OAAO;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,KAC3E,OAAO,CAAC,MAAM,CAA0D,CAAC"}

package/dist/pi/cliEngineRun.js

@@ -0,0 +1,27 @@
+import { AGY_MAX_TOOL_TURNS, createCliSessionFactory } from "./cliSession.js";
+export const runEngineDetailed = async (engine, prompt, paths) => {
+    const startedAt = Date.now();
+    const options = engine === "agy"
+        ? { engine, maxToolTurns: AGY_MAX_TOOL_TURNS, timeoutMs: 180_000 }
+        : { engine };
+    const { session } = await createCliSessionFactory(options)({
+        cwd: paths.workspacePath,
+        runtimeHomePath: paths.runtimeHomePath
+    });
+    let text = "";
+    const unsubscribe = session.subscribe((event) => {
+        if (event.type !== "turn_end")
+            return;
+        if (!("content" in event.message))
+            return;
+        text = Array.isArray(event.message.content)
+            ? event.message.content.filter((entry) => entry.type === "text").map((entry) => entry.text).join("")
+            : event.message.content;
+    });
+    await session.prompt(prompt);
+    unsubscribe();
+    session.dispose();
+    await session.disposeAsync?.();
+    return { durationMs: Date.now() - startedAt, outputChars: text.length, promptChars: prompt.length, text };
+};
+export const runEngine = async (engine, prompt, paths) => (await runEngineDetailed(engine, prompt, paths)).text;

package/dist/pi/cliEngineSpawn.d.ts

@@ -0,0 +1,55 @@
+import { type ChildProcess } from "node:child_process";
+import type { CliEngineOptions, CliSessionInput } from "./cliSession.js";
+export declare const GROK_STRICT_SANDBOX_PROFILE = "strict";
+export declare const renderGrokSandboxArgs: (commandArgs: readonly string[] | undefined, profile: string) => string[];
+/**
+ * Codex's `--json` stream is unconditional: it is the only output shape that
+ * carries `turn.completed.usage`, and an unmetered Codex turn is one whose
+ * subscription cost is invisible. The guarded arguments make this Daimon's
+ * security and metering boundary rather than a caller-controlled format.
+ *
+ * `model`/`reasoningEffort` come from parsed, bounded organization-runtime
+ * config, but are rendered defensively anyway: each is emitted as a single
+ * `--flag=value` argv token (never a bare flag followed by a separate value
+ * token), so a value that itself looks like a flag (e.g. `--sandbox`) can
+ * never be parsed as a second, independent argument — the same shape already
+ * used below for `mcp_servers.daimon.url=`. Omitting both fields leaves Codex's
+ * model defaults unchanged.
+ *
+ * The per-wake MCP server is always enabled and required. Otherwise Codex can
+ * continue a normal turn with only built-in tools after MCP startup fails.
+ * Subscription apps and installed plugins are not caller-declared tools.
+ * Disable their discovery per invocation, including with strict config: the
+ * CLI's defaults can otherwise add them even when user config is ignored.
+ */
+export declare const renderCodexArgs: (options: Pick<CliEngineOptions, "commandArgs" | "model" | "reasoningEffort" | "codexSandbox" | "codexSandboxProtectedPaths" | "codexSandboxReadablePaths">, cwd: string, endpoint: string | undefined, sandbox?: string) => string[];
+export declare const renderCodexPermissionProfile: (profileName: string, protectedPaths: readonly string[], readablePaths?: readonly string[], workspacePath?: string) => string;
+/**
+ * AGY's headless invocation.
+ *
+ * `--output-format stream-json` is unconditional: it is the only shape that
+ * carries `result.usage`, and an AGY turn that is not metered is an AGY turn
+ * whose subscription cost is invisible (see `agyHeadlessResult.ts`).
+ *
+ * `--dangerously-skip-permissions` is required for tools to work at all. AGY's
+ * default headless permission mode is `request-review`, and there is no
+ * reviewer inside a container, so a tool call can never be approved without it;
+ * the live probe that proved AGY's MCP tool calling ran with exactly this flag
+ * and reported `permission_mode: always-proceed`. Every Daimon CLI agent mounts
+ * at least the protected bash tool (`piHarness.ts`), so there is no AGY wake
+ * for which this is unnecessary and no conditional worth forking behavior over.
+ *
+ * SECURITY: the flag also auto-approves AGY's own ~50 built-in tools —
+ * `run_command`, `write_to_file`, the browser tools — none of which Daimon
+ * mediates. Inside the container that is the exposure Codex already has
+ * (`--sandbox danger-full-access`), but unlike Grok there is no kernel-enforced
+ * per-agent profile confining it to this agent's own workspace and runtime
+ * home. `DAIMON_AGY_SANDBOX=1` opts into AGY's own terminal-restricting
+ * sandbox; it is off by default only because its interaction with the MCP
+ * transport could not be verified without spending the operator's subscription
+ * quota, and shipping an unverified default that silently disables every tool
+ * would be worse than shipping the exposure with this note on it.
+ */
+export declare const renderAgyArgs: (options: Pick<CliEngineOptions, "commandArgs" | "timeoutMs">, prompt: string, sandbox?: boolean) => string[];
+export declare const spawnEngine: (options: CliEngineOptions, prompt: string, input: CliSessionInput, endpoint: string | undefined, wakeId?: string) => ChildProcess;
+//# sourceMappingURL=cliEngineSpawn.d.ts.map

package/dist/pi/cliEngineSpawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliEngineSpawn.d.ts","sourceRoot":"","sources":["../../src/pi/cliEngineSpawn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEzE,eAAO,MAAM,2BAA2B,WAAW,CAAC;AAEpD,eAAO,MAAM,qBAAqB,GAChC,aAAa,SAAS,MAAM,EAAE,GAAG,SAAS,EAC1C,SAAS,MAAM,KACd,MAAM,EAAuE,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,IAAI,CAAC,gBAAgB,EAAE,aAAa,GAAG,OAAO,GAAG,iBAAiB,GAAG,cAAc,GAAG,4BAA4B,GAAG,2BAA2B,CAAC,EAC1J,KAAK,MAAM,EACX,UAAU,MAAM,GAAG,SAAS,EAC5B,UAAS,MAA+F,KACvG,MAAM,EAyBR,CAAC;AAEF,eAAO,MAAM,4BAA4B,GACvC,aAAa,MAAM,EACnB,gBAAgB,SAAS,MAAM,EAAE,EACjC,gBAAe,SAAS,MAAM,EAAO,EACrC,gBAAgB,MAAM,KACrB,MAUF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,IAAI,CAAC,gBAAgB,EAAE,aAAa,GAAG,WAAW,CAAC,EAC5D,QAAQ,MAAM,EACd,UAAS,OAAgD,KACxD,MAAM,EAOR,CAAC;AAEF,eAAO,MAAM,WAAW,GACtB,SAAS,gBAAgB,EACzB,QAAQ,MAAM,EACd,OAAO,eAAe,EACtB,UAAU,MAAM,GAAG,SAAS,EAC5B,SAAS,MAAM,KACd,YAyBF,CAAC"}

package/dist/pi/cliEngineSpawn.js

@@ -0,0 +1,164 @@
+import { spawn } from "node:child_process";
+import { trackCliChild } from "./cliProcess.js";
+import { cliChildEnvironment } from "./cliEnvironment.js";
+import { codexFilesystemRules } from "./codexFilesystemRules.js";
+export const GROK_STRICT_SANDBOX_PROFILE = "strict";
+export const renderGrokSandboxArgs = (commandArgs, profile) => [...assertSafeGrokCommandArgs(commandArgs), "--sandbox", profile];
+/**
+ * Codex's `--json` stream is unconditional: it is the only output shape that
+ * carries `turn.completed.usage`, and an unmetered Codex turn is one whose
+ * subscription cost is invisible. The guarded arguments make this Daimon's
+ * security and metering boundary rather than a caller-controlled format.
+ *
+ * `model`/`reasoningEffort` come from parsed, bounded organization-runtime
+ * config, but are rendered defensively anyway: each is emitted as a single
+ * `--flag=value` argv token (never a bare flag followed by a separate value
+ * token), so a value that itself looks like a flag (e.g. `--sandbox`) can
+ * never be parsed as a second, independent argument — the same shape already
+ * used below for `mcp_servers.daimon.url=`. Omitting both fields leaves Codex's
+ * model defaults unchanged.
+ *
+ * The per-wake MCP server is always enabled and required. Otherwise Codex can
+ * continue a normal turn with only built-in tools after MCP startup fails.
+ * Subscription apps and installed plugins are not caller-declared tools.
+ * Disable their discovery per invocation, including with strict config: the
+ * CLI's defaults can otherwise add them even when user config is ignored.
+ */
+export const renderCodexArgs = (options, cwd, endpoint, sandbox = options.codexSandbox?.mode ?? process.env.DAIMON_CODEX_SANDBOX ?? "danger-full-access") => {
+    const strictPolicy = options.codexSandbox;
+    if (strictPolicy !== undefined && (strictPolicy.mode !== "workspace-write" || strictPolicy.networkAccess !== false || strictPolicy.webSearch !== "disabled" || Object.keys(strictPolicy).length !== 3)) {
+        throw new Error("Codex sandbox policy is Daimon-owned and must be workspace-write with network and web search disabled");
+    }
+    const effectiveSandbox = strictPolicy?.mode ?? sandbox;
+    const profileName = "daimon-strict";
+    const policyArgs = strictPolicy === undefined ? [] : [
+        "--ignore-user-config",
+        "--ignore-rules",
+        "--strict-config",
+        "-c", "web_search=\"disabled\"",
+        "-c", `default_permissions=${JSON.stringify(profileName)}`,
+        "-c", renderCodexPermissionProfile(profileName, options.codexSandboxProtectedPaths ?? [], options.codexSandboxReadablePaths ?? [], cwd),
+        "-c", "approval_policy=\"never\"",
+        "-c", `mcp_servers={daimon={url=\"${endpoint}\",enabled=true,default_tools_approval_mode=\"approve\"}}`
+    ];
+    return [...assertSafeCodexCommandArgs(options.commandArgs, strictPolicy !== undefined), "exec", ...(strictPolicy === undefined ? ["--sandbox", effectiveSandbox] : []), ...policyArgs, "--skip-git-repo-check",
+        ...(options.model === undefined ? [] : [`--model=${options.model}`]),
+        ...(options.reasoningEffort === undefined ? [] : ["-c", `model_reasoning_effort=${options.reasoningEffort}`]),
+        "--color", "never", "--json", "-C", cwd,
+        "-c", `mcp_servers.daimon.url=${endpoint}`,
+        "-c", "features.apps=false", "-c", "features.plugins=false",
+        "-c", "mcp_servers.daimon.enabled=true",
+        "-c", "mcp_servers.daimon.required=true", "-"];
+};
+export const renderCodexPermissionProfile = (profileName, protectedPaths, readablePaths = [], workspacePath) => {
+    const filesystem = {
+        ":workspace_roots": { ".": "write" },
+        ...codexFilesystemRules(protectedPaths, readablePaths, workspacePath)
+    };
+    return `permissions=${tomlInline({ [profileName]: {
+            extends: ":workspace",
+            filesystem,
+            network: { enabled: false }
+        } })}`;
+};
+/**
+ * AGY's headless invocation.
+ *
+ * `--output-format stream-json` is unconditional: it is the only shape that
+ * carries `result.usage`, and an AGY turn that is not metered is an AGY turn
+ * whose subscription cost is invisible (see `agyHeadlessResult.ts`).
+ *
+ * `--dangerously-skip-permissions` is required for tools to work at all. AGY's
+ * default headless permission mode is `request-review`, and there is no
+ * reviewer inside a container, so a tool call can never be approved without it;
+ * the live probe that proved AGY's MCP tool calling ran with exactly this flag
+ * and reported `permission_mode: always-proceed`. Every Daimon CLI agent mounts
+ * at least the protected bash tool (`piHarness.ts`), so there is no AGY wake
+ * for which this is unnecessary and no conditional worth forking behavior over.
+ *
+ * SECURITY: the flag also auto-approves AGY's own ~50 built-in tools —
+ * `run_command`, `write_to_file`, the browser tools — none of which Daimon
+ * mediates. Inside the container that is the exposure Codex already has
+ * (`--sandbox danger-full-access`), but unlike Grok there is no kernel-enforced
+ * per-agent profile confining it to this agent's own workspace and runtime
+ * home. `DAIMON_AGY_SANDBOX=1` opts into AGY's own terminal-restricting
+ * sandbox; it is off by default only because its interaction with the MCP
+ * transport could not be verified without spending the operator's subscription
+ * quota, and shipping an unverified default that silently disables every tool
+ * would be worse than shipping the exposure with this note on it.
+ */
+export const renderAgyArgs = (options, prompt, sandbox = process.env.DAIMON_AGY_SANDBOX === "1") => [
+    ...assertSafeAgyCommandArgs(options.commandArgs),
+    "--print", prompt,
+    "--output-format", "stream-json",
+    "--dangerously-skip-permissions",
+    ...(sandbox ? ["--sandbox"] : []),
+    ...(options.timeoutMs === undefined ? [] : ["--print-timeout", `${options.timeoutMs}ms`])
+];
+export const spawnEngine = (options, prompt, input, endpoint, wakeId) => {
+    const command = options.command ?? options.engine;
+    const env = cliChildEnvironment([
+        ...(options.redactedEnvironmentNames ?? []),
+        ...(input.daimonSecretEnvironmentNames ?? [])
+    ], input.runtimeHomePath, {
+        dbusSessionBusAddress: options.engine === "agy" ? options.dbusSessionBusAddress : undefined,
+        engine: options.engine,
+        executablePath: options.command,
+        engineHomePath: options.engineHomePath,
+        wakeId
+    });
+    if (options.engine === "codex") {
+        const child = trackCliChild(spawn(command, renderCodexArgs(options, input.cwd, endpoint), { cwd: input.cwd, env, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"] }));
+        child.stdin.on("error", () => undefined);
+        child.stdin.write(prompt);
+        child.stdin.end();
+        return child;
+    }
+    // Production supplies a Daimon-owned custom profile whose enforcement and
+    // explicit realm/peer denies are verified before every Grok process.
+    const args = options.engine === "grok"
+        ? [...renderGrokSandboxArgs(options.commandArgs, options.grokSandboxProfile ?? GROK_STRICT_SANDBOX_PROFILE), "--always-approve", "--no-subagents", "--single", prompt, "--no-memory", "--disable-web-search", "--cwd", input.cwd,
+            "--output-format", "streaming-messages-json"]
+        : renderAgyArgs(options, prompt);
+    return trackCliChild(spawn(command, args, { cwd: input.cwd, env, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] }));
+};
+/**
+ * AGY's output format, permission mode, sandbox, and session continuity are
+ * Daimon-owned, exactly as Grok's sandbox and approval flags are. A caller
+ * cannot re-open the permission boundary, silence the metering stream, or turn
+ * a per-wake cold process into a resumed conversation through `commandArgs`.
+ */
+const assertSafeAgyCommandArgs = (args) => {
+    const values = args ?? [];
+    if (values.some((value) => /^(?:--dangerously-skip-permissions|--sandbox|--output-format|--print|--prompt|--prompt-interactive|--mode|--continue|--conversation|-p|-i|-c)(?:=|$)/u.test(value))) {
+        throw new Error("AGY security-boundary arguments are Daimon-owned");
+    }
+    return values;
+};
+/** Caller arguments cannot reopen Codex's sandbox, output, cwd, or config boundary. */
+const assertSafeCodexCommandArgs = (args, strictPolicy = false) => {
+    const values = args ?? [];
+    const pattern = /^(?:--json|--sandbox|--dangerously-bypass-approvals-and-sandbox|--output-last-message|--config|--ignore-user-config|--ignore-rules|--skip-git-repo-check|--color|--cd|--enable|-c|-C)(?:=|$)/u;
+    const strictPattern = /^(?:--strict-config|--profile|-p|-P|--permissions-profile|--enable|--disable|--add-dir|--search)(?:=|$)|^(?:default_permissions|permissions)(?:=|\.)/u;
+    if (values.some((value) => pattern.test(value) || (strictPolicy && strictPattern.test(value)))) {
+        throw new Error("Codex security-boundary arguments are Daimon-owned");
+    }
+    return values;
+};
+const assertSafeGrokCommandArgs = (args) => {
+    const values = args ?? [];
+    if (values.some((value) => /^(?:--sandbox|--always-approve|--permission-mode|--leader-socket)(?:=|$)/u.test(value))) {
+        throw new Error("Grok security-boundary arguments are Daimon-owned");
+    }
+    return values;
+};
+function tomlInline(value) {
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return `{${Object.entries(value).map(([key, entry]) => `${JSON.stringify(key)}=${tomlInline(entry)}`).join(",")}}`;
+    }
+    throw new Error("unsupported Codex permission profile value");
+}

package/dist/pi/cliEnvironment.d.ts

@@ -0,0 +1,12 @@
+type CliEnvironmentIntent = Readonly<{
+    dbusSessionBusAddress?: string;
+    engine?: "codex" | "grok" | "agy";
+    executablePath?: string;
+    engineHomePath?: string;
+    wakeId?: string;
+}>;
+export declare const DAIMON_WAKE_ID_ENV: "DAIMON_WAKE_ID";
+/** Build a positive child environment; agent CLIs never inherit host secrets. */
+export declare const cliChildEnvironment: (_redactedNames: readonly string[], runtimeHomePath?: string, intent?: CliEnvironmentIntent) => NodeJS.ProcessEnv;
+export {};
+//# sourceMappingURL=cliEnvironment.d.ts.map

package/dist/pi/cliEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliEnvironment.d.ts","sourceRoot":"","sources":["../../src/pi/cliEnvironment.ts"],"names":[],"mappings":"AAEA,KAAK,oBAAoB,GAAG,QAAQ,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAG,gBAAyB,CAAC;AAE5D,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,GAC9B,gBAAgB,SAAS,MAAM,EAAE,EAAE,kBAAkB,MAAM,EAAE,SAAQ,oBAAyB,KAC7F,MAAM,CAAC,UA2BT,CAAC"}

package/dist/pi/cliEnvironment.js

@@ -0,0 +1,32 @@
+import path from "node:path";
+export const DAIMON_WAKE_ID_ENV = "DAIMON_WAKE_ID";
+/** Build a positive child environment; agent CLIs never inherit host secrets. */
+export const cliChildEnvironment = (_redactedNames, runtimeHomePath, intent = {}) => {
+    if (runtimeHomePath === undefined) {
+        // This legacy branch is only used by the standalone Pi helpers, which do
+        // not claim production organization-runtime isolation.
+        return { PATH: process.env.PATH, LANG: process.env.LANG ?? "C", LC_ALL: process.env.LC_ALL ?? "C", TZ: process.env.TZ ?? "UTC" };
+    }
+    const engine = intent.engine;
+    const engineVariable = engine === "codex" ? "CODEX_HOME" : engine === "grok" ? "GROK_HOME" : engine === "agy" ? "ANTIGRAVITY_CLI_HOME" : undefined;
+    const engineHome = intent.engineHomePath;
+    const keyringBus = engine === "agy" ? localSecretServiceBus(intent.dbusSessionBusAddress) : undefined;
+    return {
+        // The executable is pinned absolutely. PATH remains only for a trusted
+        // interpreter in a local shebang (and never selects the engine itself).
+        PATH: intent.executablePath === undefined ? process.env.PATH : `${path.dirname(intent.executablePath)}${path.delimiter}${path.dirname(process.execPath)}`,
+        LANG: process.env.LANG ?? "C",
+        LC_ALL: process.env.LC_ALL ?? "C",
+        TZ: process.env.TZ ?? "UTC",
+        HOME: runtimeHomePath,
+        XDG_CONFIG_HOME: `${runtimeHomePath}/.config`,
+        XDG_DATA_HOME: `${runtimeHomePath}/.local/share`,
+        XDG_STATE_HOME: `${runtimeHomePath}/.local/state`,
+        XDG_CACHE_HOME: `${runtimeHomePath}/.cache`,
+        TMPDIR: `${runtimeHomePath}/.tmp`,
+        ...(engineVariable === undefined || engineHome === undefined ? {} : { [engineVariable]: engineHome }),
+        ...(keyringBus === undefined ? {} : { DBUS_SESSION_BUS_ADDRESS: keyringBus }),
+        ...(intent.wakeId === undefined ? {} : { [DAIMON_WAKE_ID_ENV]: intent.wakeId })
+    };
+};
+const localSecretServiceBus = (value) => value !== undefined && /^unix:(?:path|abstract)=[^;,\r\n]+$/u.test(value) ? value : undefined;