@phnx-labs/agents-cli 1.22.41 → 1.22.43

package/dist/lib/github/pr-mergeable.js

@@ -0,0 +1,157 @@
+/**
+ * List this user's mergeable PRs across registered project repos.
+ *
+ * The built-in `pr-merge-on-green` monitor used to run `gh pr list --author @me`
+ * with no `--repo`. `gh` then infers the repository from the working directory,
+ * and the daemon's cwd is not a git repo, so every poll returned empty.
+ *
+ * This helper:
+ *   1. Collects GitHub slugs from `~/.agents/projects/*.yaml` (`repo` / `repos[].slug`).
+ *   2. Canonicalizes each slug (`gh repo view` — `phnx-labs/agents-cli` lists
+ *      nothing; the live name is `phnx-labs/agi-cli`).
+ *   3. Runs `gh pr list --repo <slug> --author @me` (cwd-independent).
+ *   4. Keeps CI-green PRs with a merge-guard verdict (formal APPROVED review
+ *      OR an APPROVE comment on THIS PR).
+ *
+ * Stdout is a single line of `owner/repo#n` refs (or empty). Empty is a silent
+ * observation under `condition.mode: every` — do not write to stderr on the
+ * no-match path, or command.ts will treat stderr as the observation and fire.
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { listProjectDefs } from '../projects.js';
+import { formatMergeableRef, hasApproveVerdict, isCiGreen, } from './pr-verdict.js';
+const execFileAsync = promisify(execFile);
+/**
+ * `gh --json` is not color-safe when this fleet exports FORCE_COLOR /
+ * CLICOLOR_FORCE: gh paints the payload and JSON.parse / jq die on the ANSI
+ * prefix (live miss on the sibling poll script). Strip the force vars and
+ * pin GH_NO_COLOR for every gh spawn.
+ */
+function ghEnv() {
+    const env = { ...process.env };
+    env.CLICOLOR = '0';
+    env.NO_COLOR = '1';
+    env.GH_NO_COLOR = '1';
+    env.GH_PAGER = 'cat';
+    delete env.CLICOLOR_FORCE;
+    delete env.FORCE_COLOR;
+    delete env.GH_FORCE_TTY;
+    return env;
+}
+/** Default runner: `gh` with a 30s timeout. Non-zero exit throws. */
+export async function ghExec(args) {
+    const { stdout } = await execFileAsync('gh', args, {
+        timeout: 30_000,
+        maxBuffer: 8 * 1024 * 1024,
+        encoding: 'utf-8',
+        env: ghEnv(),
+    });
+    return String(stdout ?? '');
+}
+/** Unique GitHub slugs declared on project definitions. */
+export function projectRepoSlugs(defs) {
+    const slugs = new Set();
+    for (const d of defs) {
+        if (d.repo)
+            slugs.add(d.repo);
+        for (const r of d.repos ?? []) {
+            if (r.slug)
+                slugs.add(r.slug);
+        }
+    }
+    return [...slugs].sort();
+}
+/**
+ * Resolve a slug to GitHub's current `nameWithOwner`. A renamed repo
+ * (`phnx-labs/agents-cli` → `phnx-labs/agi-cli`) lists zero PRs under the old
+ * name; `gh repo view` returns the live one. On error, keep the input slug.
+ */
+export async function canonicalizeRepo(slug, gh) {
+    try {
+        const out = (await gh([
+            'repo', 'view', slug, '--json', 'nameWithOwner', '--jq', '.nameWithOwner',
+        ])).trim();
+        return out || slug;
+    }
+    catch {
+        return slug;
+    }
+}
+async function fetchVerdict(repo, number, gh) {
+    const [reviewsRaw, commentsRaw] = await Promise.all([
+        gh(['api', `repos/${repo}/pulls/${number}/reviews`, '--cache', '60s']),
+        gh(['api', `repos/${repo}/issues/${number}/comments`, '--cache', '60s']),
+    ]);
+    const reviews = JSON.parse(reviewsRaw);
+    const comments = JSON.parse(commentsRaw);
+    return {
+        reviews: Array.isArray(reviews) ? reviews : [],
+        comments: Array.isArray(comments) ? comments : [],
+    };
+}
+/**
+ * Given PRs already listed for one repo, attach verdict payloads only for the
+ * CI-green ones that lack a formal APPROVED reviewDecision, then select.
+ */
+export async function selectListedMergeable(repo, listed, gh) {
+    const candidates = [];
+    for (const row of listed) {
+        if (!isCiGreen(row.statusCheckRollup))
+            continue;
+        const base = {
+            number: row.number,
+            repo,
+            reviewDecision: row.reviewDecision ?? '',
+            statusCheckRollup: row.statusCheckRollup,
+            reviews: [],
+            comments: [],
+        };
+        if (base.reviewDecision === 'APPROVED') {
+            candidates.push(base);
+            continue;
+        }
+        try {
+            const extra = await fetchVerdict(repo, row.number, gh);
+            candidates.push({ ...base, ...extra });
+        }
+        catch {
+            // A single PR's reviews/comments probe failed — skip it, keep the rest.
+            continue;
+        }
+    }
+    return candidates.filter((pr) => pr.reviewDecision === 'APPROVED' || hasApproveVerdict(pr.reviews, pr.comments));
+}
+/** List mergeable `owner/repo#n` refs, space-separated. Empty string if none. */
+export async function listMergeableRefs(opts) {
+    const gh = opts?.gh ?? ghExec;
+    const slugs = opts?.repos ?? projectRepoSlugs(opts?.defs ?? listProjectDefs());
+    const seen = new Set();
+    const refs = [];
+    for (const raw of slugs) {
+        const repo = await canonicalizeRepo(raw, gh);
+        if (seen.has(repo))
+            continue;
+        seen.add(repo);
+        let listed = [];
+        try {
+            const rawList = await gh([
+                'pr', 'list',
+                '--repo', repo,
+                '--author', '@me',
+                '--state', 'open',
+                '--limit', '50',
+                '--json', 'number,reviewDecision,statusCheckRollup',
+            ]);
+            const parsed = JSON.parse(rawList);
+            listed = Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            continue;
+        }
+        const mergeable = await selectListedMergeable(repo, listed, gh);
+        for (const pr of mergeable)
+            refs.push(formatMergeableRef(pr));
+    }
+    return refs.join(' ');
+}

package/dist/lib/github/pr-verdict.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Non-author PR approval + CI-green checks for merge-on-green.
+ *
+ * Verdict rules are copied from merge-guard.sh (the PreToolUse hook in
+ * phnx-labs/.agents-system `rules/subrules/gh-merge-guard/merge-guard.sh`).
+ * That hook accepts EITHER a formal GitHub `APPROVED` review OR an APPROVE
+ * verdict comment on THIS PR, and rejects a comment that only cites another
+ * PR ("carried from #N" / "APPROVE on #N") — the #2736 laundering pattern.
+ *
+ * Do not invent a third rule. If the hook's regexes change, change these in
+ * the same delivery.
+ */
+/** A GitHub pull-request review, shaped after `GET .../pulls/{n}/reviews`. */
+export interface PrReview {
+    state?: string;
+}
+/** An issue comment on a PR, shaped after `GET .../issues/{n}/comments`. */
+export interface PrComment {
+    body?: string;
+}
+/**
+ * One status-check rollup item from `gh pr list --json statusCheckRollup`.
+ * `gh` exposes conclusion/state/status under those names; empty fields are
+ * pending/in-progress.
+ */
+export interface StatusCheck {
+    conclusion?: string;
+    state?: string;
+    status?: string;
+}
+/** One open PR with the fields the mergeable selector reads. */
+export interface MergeablePrInput {
+    number: number;
+    /** `owner/repo`. Required so a daemon with no git cwd can still merge. */
+    repo: string;
+    reviewDecision?: string | null;
+    statusCheckRollup?: StatusCheck[] | null;
+    reviews?: PrReview[] | null;
+    comments?: PrComment[] | null;
+}
+/**
+ * True when a non-author verdict exists ON this PR.
+ *
+ * Mirrors merge-guard.sh: a GitHub review with `state == "APPROVED"`, or an
+ * issue comment whose body contains `\bAPPROVE\b` and is not a carried-from
+ * citation (`\bcarried\s+(?:over\s+)?from\b` or `\bAPPROVE\s+(?:on|from)\s+#\d+`).
+ */
+export declare function hasApproveVerdict(reviews: readonly PrReview[] | null | undefined, comments: readonly PrComment[] | null | undefined): boolean;
+/**
+ * True when every check is a terminal success-class conclusion.
+ *
+ * Matches the built-in monitor's original jq: SUCCESS / NEUTRAL / SKIPPED
+ * (ascii-uppercased conclusion, else state, else status). An empty rollup
+ * is green — jq `all([])` is true, and a PR with no checks is mergeable
+ * from this filter's point of view.
+ */
+export declare function isCiGreen(rollup: readonly StatusCheck[] | null | undefined): boolean;
+/**
+ * Keep PRs that are CI-green AND non-author-approved.
+ *
+ * `reviewDecision == "APPROVED"` is sufficient (a formal review). When that
+ * field is empty — the fleet convention: reviewers post an APPROVE *comment*
+ * rather than a GitHub review — fall through to {@link hasApproveVerdict}.
+ */
+export declare function selectMergeablePrs(prs: readonly MergeablePrInput[]): MergeablePrInput[];
+/** `owner/repo#n` — the poll observation the merge action can parse without a cwd. */
+export declare function formatMergeableRef(pr: Pick<MergeablePrInput, 'repo' | 'number'>): string;

package/dist/lib/github/pr-verdict.js

@@ -0,0 +1,72 @@
+/**
+ * Non-author PR approval + CI-green checks for merge-on-green.
+ *
+ * Verdict rules are copied from merge-guard.sh (the PreToolUse hook in
+ * phnx-labs/.agents-system `rules/subrules/gh-merge-guard/merge-guard.sh`).
+ * That hook accepts EITHER a formal GitHub `APPROVED` review OR an APPROVE
+ * verdict comment on THIS PR, and rejects a comment that only cites another
+ * PR ("carried from #N" / "APPROVE on #N") — the #2736 laundering pattern.
+ *
+ * Do not invent a third rule. If the hook's regexes change, change these in
+ * the same delivery.
+ */
+/**
+ * True when a non-author verdict exists ON this PR.
+ *
+ * Mirrors merge-guard.sh: a GitHub review with `state == "APPROVED"`, or an
+ * issue comment whose body contains `\bAPPROVE\b` and is not a carried-from
+ * citation (`\bcarried\s+(?:over\s+)?from\b` or `\bAPPROVE\s+(?:on|from)\s+#\d+`).
+ */
+export function hasApproveVerdict(reviews, comments) {
+    if (Array.isArray(reviews) && reviews.some((r) => r?.state === 'APPROVED')) {
+        return true;
+    }
+    if (!Array.isArray(comments))
+        return false;
+    for (const c of comments) {
+        const body = c?.body ?? '';
+        if (!/\bAPPROVE\b/.test(body))
+            continue;
+        // A verdict that only points at another PR is laundering, not review.
+        if (/\bcarried\s+(?:over\s+)?from\b|\bAPPROVE\s+(?:on|from)\s+#\d+/.test(body)) {
+            continue;
+        }
+        return true;
+    }
+    return false;
+}
+/**
+ * True when every check is a terminal success-class conclusion.
+ *
+ * Matches the built-in monitor's original jq: SUCCESS / NEUTRAL / SKIPPED
+ * (ascii-uppercased conclusion, else state, else status). An empty rollup
+ * is green — jq `all([])` is true, and a PR with no checks is mergeable
+ * from this filter's point of view.
+ */
+export function isCiGreen(rollup) {
+    const items = rollup ?? [];
+    return items.every((c) => {
+        const v = (c.conclusion || c.state || c.status || '').toUpperCase();
+        return v === 'SUCCESS' || v === 'NEUTRAL' || v === 'SKIPPED';
+    });
+}
+/**
+ * Keep PRs that are CI-green AND non-author-approved.
+ *
+ * `reviewDecision == "APPROVED"` is sufficient (a formal review). When that
+ * field is empty — the fleet convention: reviewers post an APPROVE *comment*
+ * rather than a GitHub review — fall through to {@link hasApproveVerdict}.
+ */
+export function selectMergeablePrs(prs) {
+    return prs.filter((pr) => {
+        if (!isCiGreen(pr.statusCheckRollup))
+            return false;
+        if (pr.reviewDecision === 'APPROVED')
+            return true;
+        return hasApproveVerdict(pr.reviews, pr.comments);
+    });
+}
+/** `owner/repo#n` — the poll observation the merge action can parse without a cwd. */
+export function formatMergeableRef(pr) {
+    return `${pr.repo}#${pr.number}`;
+}

package/dist/lib/harness/adapter.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Harness adapter registry — the behavior axis of a supported harness.
+ *
+ * The declarative FLAG table lives in `AGENTS` (lib/agents.ts): what a harness
+ * *is* (cliCommand, configDir, capabilities). A HarnessAdapter carries what a
+ * harness *does* at the execution boundary — the per-harness quirks that four
+ * call sites otherwise each re-express as a `if (agent === 'x') … else if …`
+ * name-chain:
+ *
+ *   - config-dir env pins        → exec.ts buildExecEnv + shims.ts shim script
+ *   - launch-arg quirks          → exec.ts buildExecCommand + runner.ts buildJobCommand
+ *
+ * One adapter per harness is the single source of truth for that harness's
+ * behavior across every consuming site, mirroring the ChannelProvider
+ * (lib/channels/registry.ts), HostProvider (lib/hosts/types.ts), and
+ * AccountProviderAdapter (lib/account-provider-registry.ts) registries this repo
+ * already proves.
+ *
+ * NOT here: transcript parsing and live team-event normalization. Those are
+ * registry-dispatched too — a `Record` table in `session/parse.ts`
+ * (`TRANSCRIPT_PARSERS`) and one in `teams/parsers.ts` (`TEAM_EVENT_NORMALIZERS`)
+ * — but kept beside the parser functions they dispatch (which live in those
+ * files) rather than on this `AgentId` registry, because their id domains differ:
+ * the offline transcript reader keys on `SessionAgentId` (which includes `rush`,
+ * not an `AgentId`), and the live team-event normalizer keys on the teams
+ * `AgentType`. They stay separate functions — offline transcript vs live team
+ * events — deliberately.
+ */
+import type { AgentId, Mode } from '../types.js';
+import type { JobConfig } from '../scheduling/routines.js';
+/**
+ * Context for the exec-time config-env pin (mapping A, exec.ts side). The caller
+ * resolves the interactive/version facts once; the adapter only expresses the
+ * harness-specific env manipulation, operating on the accumulating `result` env
+ * exactly as the old per-agent branch did.
+ */
+export interface ExecConfigEnvCtx {
+    agent: AgentId;
+    /** The version to pin, pre-resolved by the caller (null = unresolved/not installed). */
+    version: string | null;
+    /** That version's home, pre-resolved by the caller (null when version is null). */
+    versionHome: string | null;
+    /** resolveInteractive(options) — computed once by the caller. */
+    interactive: boolean;
+    /**
+     * claude-account-token's resolveClaudeSetupToken, injected. The adapters MUST
+     * stay import-leaf: claude-account-token pulls in the secrets stack, which
+     * transitively imports sqlite.ts (top-level await). Importing it inside an
+     * adapter drags that into shims.ts's module graph (shims imports the harness
+     * barrel), and subprocess-spawning tests that load shims via tsx then fail the
+     * cjs transform. Only claude uses it.
+     */
+    resolveClaudeSetupToken: (versionHome: string) => string | null;
+}
+/** Context for the shim-script config-env block (mapping A, shims.ts side). */
+export interface ShimConfigEnvCtx {
+    /**
+     * The config-dir path relative to `$HOME` (e.g. `.claude`, or the nested
+     * `.gemini/antigravity-cli`), derived by the caller from the AGENTS registry.
+     */
+    configDirName: string;
+}
+/**
+ * Context for the exec-time launch-arg quirks (mapping B, exec.ts side). Mirrors
+ * the locals buildExecCommand already computed at the emission point.
+ */
+export interface ExecLaunchArgsCtx {
+    resolvedMode: Mode;
+    interactive: boolean;
+    cwd: string;
+    /** Extra writable roots (`--add-dir`) requested for this run, home-expanded. */
+    addDirs: string[];
+}
+/**
+ * Context for the routine (daemon-job) launch-arg quirks (mapping B, runner.ts
+ * side). This idiom mutates a token array baked from AGENT_COMMANDS
+ * (bakeRoutineArgv), distinct from buildExecCommand's declarative modeFlags —
+ * so it is a separate method on the same adapter, one source of truth per
+ * harness across both.
+ */
+export interface RoutineLaunchCtx {
+    /** normalizeMode(config.mode) — the canonicalized mode. */
+    mode: Mode;
+    config: JobConfig;
+    /**
+     * exec.ts resolveHeadlessMode, injected to avoid an import cycle (exec.ts
+     * imports this registry). Kimi calls it for its plan→auto downgrade warning.
+     */
+    resolveHeadlessMode: (agent: AgentId, mode: Mode, interactive: boolean) => void;
+}
+export interface HarnessAdapter {
+    id: AgentId;
+    /**
+     * Apply this harness's config-dir env pins to the live process env for an
+     * `agents run` invocation (exec.ts buildExecEnv). Mutates `result` in place,
+     * exactly as the old per-agent branch did. The caller has already stripped the
+     * shared config-dir keys (CONFIG_DIR_ENV_KEYS), so an adapter only sets its own
+     * vars (plus any harness-specific extra it must delete, e.g. Claude's inherited
+     * OAuth token). Omitted for a harness with no config-dir env (the old `else`).
+     */
+    applyExecConfigEnv?(result: NodeJS.ProcessEnv, ctx: ExecConfigEnvCtx): void;
+    /**
+     * The config-env bash block for this harness's generated shim (shims.ts). The
+     * returned string is spliced verbatim into the shim script. Omitted (⇒ '') for
+     * a harness with no managed config-dir env.
+     */
+    shimConfigEnvBash?(ctx: ShimConfigEnvCtx): string;
+    /**
+     * Launch args appended to this harness's shim `exec` line (shims.ts). Codex
+     * pins `check_for_update_on_startup=false` + its edit-profile policy args here.
+     * Returns '' for a harness with no shim launch args.
+     */
+    shimLaunchArgs?(): string;
+    /**
+     * The shim's `exec` tail for this harness (shims.ts). Codex resolves the repo's
+     * `.agents` dir from `$PWD` at run time and appends `--add-dir`. Omitted ⇒ the
+     * default `exec "$BINARY"<launchArgs> "$@"`.
+     */
+    shimExecTail?(launchArgs: string): string;
+    /**
+     * Additive launch args emitted BEFORE mode-flag resolution in buildExecCommand
+     * (exec.ts). Cursor's `--trust` for a configured headless edit lives here.
+     * Returns undefined when this harness adds nothing.
+     */
+    execPreModeArgs?(ctx: ExecLaunchArgsCtx): string[] | undefined;
+    /**
+     * This harness's mode-flag emission for buildExecCommand (exec.ts), overriding
+     * the generic `template.modeFlags` / resume-subcommand path. Codex returns its
+     * policy args; Kimi returns [] for a headless run (and throws on an invariant
+     * violation). Returns undefined to defer to the generic path.
+     */
+    execModeArgs?(ctx: ExecLaunchArgsCtx): string[] | undefined;
+    /**
+     * This harness's routine (daemon-job) launch-arg quirks for buildJobCommand
+     * (runner.ts). Mutates the bakeRoutineArgv token array in place, exactly as
+     * the old per-agent arm did; runner appends model/reasoning flags after.
+     * Omitted for a harness with no routine launch quirks.
+     */
+    routineModeArgs?(cmd: string[], ctx: RoutineLaunchCtx): void;
+}
+/**
+ * The four config-dir env keys a harness pins to its version home. Every
+ * per-harness branch in the old buildExecEnv deleted the ones it does NOT set,
+ * so its own config pointer never leaks into a foreign harness's invocation.
+ * (XDG_CONFIG_HOME / XDG_DATA_HOME — Muse/Cursor — are deliberately absent: the
+ * old code sets them but never strips them, and this preserves that exactly.)
+ */
+export declare const CONFIG_DIR_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_HOME", "COPILOT_HOME", "KIMI_CODE_HOME"];
+/**
+ * Strip every config-dir env key except the one(s) this harness sets. `keep=[]`
+ * (the default / no-config-dir harness) deletes all four — the old `else` arm.
+ */
+export declare function stripForeignConfigDir(result: NodeJS.ProcessEnv, keep?: readonly string[]): void;
+export declare function registerHarnessAdapter(adapter: HarnessAdapter): void;
+/**
+ * The behavior adapter for a harness. Every `AgentId` resolves to an adapter —
+ * one with real behavior when registered, else the id-only default (the old
+ * `else` arm). Callers therefore never name-check a harness.
+ */
+export declare function resolveHarnessAdapter(id: AgentId): HarnessAdapter;
+export declare function listHarnessAdapters(): AgentId[];

package/dist/lib/harness/adapter.js

@@ -0,0 +1,47 @@
+/**
+ * The four config-dir env keys a harness pins to its version home. Every
+ * per-harness branch in the old buildExecEnv deleted the ones it does NOT set,
+ * so its own config pointer never leaks into a foreign harness's invocation.
+ * (XDG_CONFIG_HOME / XDG_DATA_HOME — Muse/Cursor — are deliberately absent: the
+ * old code sets them but never strips them, and this preserves that exactly.)
+ */
+export const CONFIG_DIR_ENV_KEYS = [
+    'CLAUDE_CONFIG_DIR',
+    'CODEX_HOME',
+    'COPILOT_HOME',
+    'KIMI_CODE_HOME',
+];
+/**
+ * Strip every config-dir env key except the one(s) this harness sets. `keep=[]`
+ * (the default / no-config-dir harness) deletes all four — the old `else` arm.
+ */
+export function stripForeignConfigDir(result, keep = []) {
+    for (const key of CONFIG_DIR_ENV_KEYS) {
+        if (!keep.includes(key))
+            delete result[key];
+    }
+}
+const REGISTRY = new Map();
+/**
+ * The no-behavior adapter — a harness with no managed config-dir env and no
+ * launch-arg quirks. buildExecEnv strips all four config-dir keys for it (the old
+ * `else` arm) by falling back to {@link stripForeignConfigDir} when an adapter
+ * omits `applyExecConfigEnv`.
+ */
+function defaultAdapter(id) {
+    return { id };
+}
+export function registerHarnessAdapter(adapter) {
+    REGISTRY.set(adapter.id, adapter);
+}
+/**
+ * The behavior adapter for a harness. Every `AgentId` resolves to an adapter —
+ * one with real behavior when registered, else the id-only default (the old
+ * `else` arm). Callers therefore never name-check a harness.
+ */
+export function resolveHarnessAdapter(id) {
+    return REGISTRY.get(id) ?? defaultAdapter(id);
+}
+export function listHarnessAdapters() {
+    return [...REGISTRY.keys()].sort();
+}

package/dist/lib/harness/adapters/claude.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const claudeAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/claude.js

@@ -0,0 +1,110 @@
+import * as path from 'path';
+import { stripForeignConfigDir } from '../adapter.js';
+export const claudeAdapter = {
+    id: 'claude',
+    applyExecConfigEnv(result, ctx) {
+        const { versionHome } = ctx;
+        // The per-account `claude setup-token` only resolves when there is a version
+        // home to key it to; version===null (claude unresolved / not installed) yields
+        // null, exactly as the routines path treats it (`runner.ts:1017-1021`). The
+        // token decision below runs even then, so an ambient inherited value is stripped
+        // on the routines/provisioned path regardless of whether a version resolved.
+        // resolveClaudeSetupToken is injected (see ExecConfigEnvCtx) to keep this
+        // adapter import-leaf — importing claude-account-token here would drag the
+        // secrets/sqlite graph into shims.ts.
+        const setupToken = versionHome ? ctx.resolveClaudeSetupToken(versionHome) : null;
+        if (versionHome) {
+            result.CLAUDE_CONFIG_DIR = path.join(versionHome, '.claude');
+            // A managed pin lives in a per-version dir; Claude Code's own background
+            // auto-updater would rewrite that pinned binary in place (and has left it
+            // half-swapped and broken). Disable it so a pin stays a pin. Honor an
+            // explicit user value — from process.env (already in result) or from
+            // options.env (spread over result below).
+            if (result.DISABLE_AUTOUPDATER === undefined) {
+                result.DISABLE_AUTOUPDATER = '1';
+            }
+        }
+        // The `auth` bundle's setup-token exists so a run with NO human present
+        // authenticates without the Touch-ID-gated login item — usage probes,
+        // routines, dispatched runs (claude-account-token.ts). An interactive run
+        // has a human at the TTY, and their own per-version login is the credential
+        // they established and expect; overriding it made `/status` report
+        // `Auth token: CLAUDE_CODE_OAUTH_TOKEN` on a personal machine and took every
+        // hand-driven session off that login. macOS cannot cheaply confirm a home's
+        // login first (probing the Keychain raises an authorization sheet per
+        // installed version on the `agents run` hot path — agents.ts
+        // `isClaudeCredentialFileBlank`), so interactive simply defers to Claude
+        // Code, which prompts a present human to log in if the login is missing.
+        if (ctx.interactive) {
+            // Drop an INHERITED copy of OUR OWN setup-token: an interactive launch from
+            // inside a headless agent's shell inherits that agent's injected value via
+            // sanitizeProcessEnv(process.env) and would keep authenticating as it.
+            // Matched by VALUE, so a token the user exported deliberately is a different
+            // string and is left alone (#2383). This is NARROWER than the non-interactive
+            // path below, which overwrites-or-deletes unconditionally and never inspects
+            // the inherited value — a DIFFERENT account's inherited setup-token passing
+            // through this equality check is the adjacent hole RUSH-2360 leaves as
+            // follow-up (it does not silently run on a *shared, rotating* token, which is
+            // what caused the RUSH-1822 logout storm).
+            if (setupToken && result.CLAUDE_CODE_OAUTH_TOKEN === setupToken) {
+                delete result.CLAUDE_CODE_OAUTH_TOKEN;
+            }
+        }
+        else {
+            // Non-interactive (routines, dispatched, provisioned box): mirror the routines
+            // path (`runner.ts:1017-1021`) UNCONDITIONALLY. Inject the per-account
+            // setup-token when one resolves — it replaces any ambient shared value
+            // inherited from the launcher. When NONE resolves, STRIP the ambient
+            // CLAUDE_CODE_OAUTH_TOKEN so a run on a provisioned box can never silently
+            // authenticate as the shared, rotating token an earlier version of this path
+            // let through — the RUSH-1822 fleet-wide-logout hazard, tracked by RUSH-2360.
+            // A missing login then fails loud (401) against this home's own credential
+            // instead of quietly borrowing another's. options.env still wins below for an
+            // explicit caller override.
+            if (setupToken) {
+                result.CLAUDE_CODE_OAUTH_TOKEN = setupToken;
+            }
+            else {
+                delete result.CLAUDE_CODE_OAUTH_TOKEN;
+            }
+        }
+        stripForeignConfigDir(result, ['CLAUDE_CONFIG_DIR']);
+    },
+    shimConfigEnvBash(ctx) {
+        return `
+# Claude stores OAuth credentials in the macOS keychain. Scope them to the
+# selected version's config directory so switching versions also switches the
+# live Claude account.
+export CLAUDE_CONFIG_DIR="$VERSION_DIR/home/${ctx.configDirName}"
+# Managed installs are pinned in a per-version dir; Claude Code's background
+# auto-updater would rewrite the pinned binary in place. Disable it so a pin
+# stays a pin. An explicit user value always wins.
+export DISABLE_AUTOUPDATER="\${DISABLE_AUTOUPDATER:-1}"
+# On Linux sandboxes (no keychain), fall back to a per-version token file.
+# The env var always wins if already set; no-op on macOS.
+if [ "\$(uname -s)" = "Linux" ] && [ -z "\${CLAUDE_CODE_OAUTH_TOKEN:-}" ] && [ -f "\$CLAUDE_CONFIG_DIR/.oauth_token" ]; then
+  CLAUDE_CODE_OAUTH_TOKEN=\$(cat "\$CLAUDE_CONFIG_DIR/.oauth_token")
+  export CLAUDE_CODE_OAUTH_TOKEN
+fi
+`;
+    },
+    routineModeArgs(cmd, ctx) {
+        const mode = ctx.mode;
+        if (mode === 'edit') {
+            const planIndex = cmd.indexOf('plan');
+            if (planIndex !== -1)
+                cmd[planIndex] = 'acceptEdits';
+        }
+        else if (mode === 'auto') {
+            const planIndex = cmd.indexOf('plan');
+            if (planIndex !== -1)
+                cmd[planIndex] = 'auto';
+        }
+        else if (mode === 'skip') {
+            // Replace --permission-mode plan with --dangerously-skip-permissions
+            const pmIndex = cmd.indexOf('--permission-mode');
+            if (pmIndex !== -1)
+                cmd.splice(pmIndex, 2, '--dangerously-skip-permissions');
+        }
+    },
+};

package/dist/lib/harness/adapters/codex.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const codexAdapter: HarnessAdapter;