@prismatic-io/lux 0.0.2-preview.27 → 0.0.2-preview.29

package/src/core/harness-matrix.ts

@@ -1,6 +1,11 @@
 import { z } from "zod";
 import type { DriverRef } from "./case.js";
 import type { DriverPlugin } from "./driver.js";
+import {
+  type DriverExecution,
+  DriverExecutionSchema,
+  driverExecutionOf,
+} from "./driver-execution.js";
 import {
   type CatalogModels,
   catalogEfforts,
@@ -24,6 +29,7 @@ type CatalogEntry<C extends HarnessCatalog> = {
   models: C["models"] extends CatalogModels ? (keyof C["models"] & string)[] : string[];
   efforts?: C["efforts"][number][];
   config?: unknown;
+  execution?: DriverExecution;
 };
 
 export type BuiltInHarnessMatrixEntry = {
@@ -37,6 +43,7 @@ export type CustomHarnessMatrixEntry = {
   models?: string[];
   efforts?: ReasoningEffort[];
   config?: unknown;
+  execution?: DriverExecution;
 };
 
 export type HarnessMatrixEntry = BuiltInHarnessMatrixEntry | CustomHarnessMatrixEntry;
@@ -54,6 +61,7 @@ const catalogEntrySchema = (catalog: HarnessCatalog) => {
       models: z.array(models).min(1),
       efforts: z.array(nonEmptyEnum(catalog.efforts)).min(1).optional(),
       config: z.unknown().optional(),
+      execution: DriverExecutionSchema.optional(),
     })
     .strict()
     .superRefine((entry, ctx) => {
@@ -86,6 +94,7 @@ const CustomHarnessMatrixEntrySchema = z
     models: z.array(z.string().min(1)).min(1).optional(),
     efforts: z.array(ReasoningEffortSchema).min(1).optional(),
     config: z.unknown().optional(),
+    execution: DriverExecutionSchema.optional(),
   })
   .strict();
 
@@ -109,6 +118,7 @@ export type HarnessPermutation = {
   model?: string | undefined;
   effort?: ReasoningEffort | undefined;
   config?: unknown;
+  execution?: DriverExecution;
 };
 
 export const permutationId = (permutation: HarnessPermutation): string =>
@@ -125,6 +135,7 @@ const entryPermutation = (
   ...(model !== undefined ? { model } : {}),
   ...(effort !== undefined ? { effort } : {}),
   ...(entry.config !== undefined ? { config: entry.config } : {}),
+  ...(entry.execution !== undefined ? { execution: entry.execution } : {}),
 });
 
 const expandEntry = (entry: HarnessMatrixEntry): HarnessPermutation[] => {
@@ -294,5 +305,12 @@ export const permutationDriverRef = (
     }
     config = plugin.selectHarness(config, { model: selected.model, effort: selected.effort });
   }
-  return config === undefined ? selected.driver : { name: selected.driver, config };
+  const execution =
+    selected.execution ??
+    (fallback && driverNameOf(fallback) === selected.driver
+      ? driverExecutionOf(fallback)
+      : undefined);
+  return config === undefined && execution === undefined
+    ? selected.driver
+    : { name: selected.driver, config, ...(execution ? { execution } : {}) };
 };

package/src/drivers/antigravity/README.md

@@ -32,7 +32,7 @@ response is also retained as message evidence when it was not already streamed.
 Both `DONE` and `ERROR` tool steps close the corresponding tool call; failed
 steps retain their error message. A result with `denied_actions` is an error even
 when Antigravity reports `SUCCESS`. `WAITING` and other non-success statuses are
-also errors. Configure the required scoped permissions in Antigravity before a
+also errors. Configure the required scoped permissions for the
 headless evaluation; Lux does not retry a denial with broader permissions.
 
 Lux explicitly selects `mode: "accept-edits"` for coding tasks. Set `mode: "plan"`
@@ -41,14 +41,61 @@ workspaces read-only even when native file tools can edit them and scoped write
 grants exist. `accept-edits` permits workspace writes within the terminal sandbox;
 it does not disable that sandbox or authorize outside-sandbox execution.
 
-For sandboxed headless coding, set `sandbox: true` and configure the CLI with
-`enableTerminalSandbox: true` and `toolPermission: "proceed-in-sandbox"`.
+## Run-scoped configuration
+
+Lux can own the CLI settings for a run:
+
+```ts
+{
+  name: "antigravity",
+  config: {
+    model: "gemini-3.1-pro",
+    reasoningEffort: "low",
+    sandbox: true,
+    permissionMode: "proceed-in-sandbox",
+    permissions: { allow: ["read_url(registry.npmjs.org)"] },
+  },
+}
+```
+
+This mode gives only the child process a private home directory. Lux writes
+`enableTerminalSandbox: true`, `toolPermission: "proceed-in-sandbox"`, and the
+configured `permissions` there. It does not edit the user's settings, copy their
+history/plugins, or reuse their project records. Concurrent runs get distinct
+homes. `permissionMode: "inherit"` is the default and preserves the previous
+behavior. Scoped mode requires `sandbox: true`, rejects `skipPermissions: true`
+and a host `project`, and supports scoped `allow`, `deny`, and `ask` lists.
+
+Authentication must work in that private home. An inherited `GEMINI_API_KEY` is
+passed to the CLI. For file-based OAuth, Lux copies only the CLI's
+`antigravity-oauth-token` into the private runtime, using the normal CLI token
+path by default or an explicit `authTokenFile`. The copy has mode 0600 inside
+a mode-0700 runtime directory; token refresh cannot modify the source file.
+On macOS, `reuseKeychain: true` explicitly opts into reading Antigravity’s own
+Keychain entry (service `gemini`, account `antigravity`) when the default token
+file is absent. Lux writes that credential only to the private runtime and
+removes it on close. This option defaults to false. Do not put secret values in
+committed Lux configuration.
+
+Before deleting a private runtime, Lux snapshots native deliverables from its
+`brain` directory under `antigravity-artifacts/` in the task artifacts. This keeps
+handoff documents available to graders even when the final response only links
+to them. Hidden CLI logs, revision copies, metadata, and symlinks are excluded;
+collection fails explicitly above 500 files or 32 MiB. Existing user-home brain
+history is never scanned in inherited mode.
+
+The runtime is outside task artifacts and removed on driver close, collection,
+and startup failure. A force-killed Lux process cannot run cleanup; private
+runtime directories have the `lux-antigravity-home-` prefix in the OS temp root.
+This is configuration separation, not a complete OS security boundary; the
+driver continues declaring `isolation: false`.
+
 Grant scoped file and documentation access as needed, including read access to
-language runtimes installed outside system directories. In 1.2.10, `command(...)`
-allow rules also authorize outside-sandbox execution, and `unsandboxed(...)`
-rules are ignored. Keep command allow rules absent when outside-sandbox
-execution must remain unapproved. The terminal sandbox is not full driver
-isolation; native file tools still use the CLI's file permissions.
+language runtimes installed outside system directories. `command(...)` allow
+rules can authorize outside-sandbox execution too. Keep them absent when that
+execution must remain unapproved; `unsandboxed(...)` rules were ignored in the
+observed macOS CLI. The terminal sandbox and native file-tool permissions are
+separate. Extra CLI arguments remain caller-controlled.
 
 Each run creates a fresh Antigravity project and passes its canonical working
 directory through `--add-dir` and an explicit task-workspace prompt preamble.
@@ -60,14 +107,65 @@ permissions: Antigravity 1.2.10 can still deny workspace writes in headless mode
 bypass tool permission checks.
 
 The headless protocol carries no user questions or permission prompts, so the
-driver is not interactive and declares no isolation: Antigravity still reads
-its user settings and conversation history. Controlled experiments are not
+driver is not interactive. In inherited mode, Antigravity still reads user
+settings and conversation history. Controlled experiments are not
 declared.
 
 Regression tests cover the `ERROR` tool step followed by `SUCCESS` with denied
 actions observed in an authenticated Antigravity 1.2.10 session.
 
+## Live readiness checks
+
+From a Lux checkout, after installing locked dependencies and authenticating `agy`:
+
+```sh
+LUX_ANTIGRAVITY_MODEL=gemini-3.1-pro mise run smoke:antigravity
+```
+
+This opt-in smoke test consumes model usage. It runs four bounded checks in
+fresh artifact workspaces: a tool-free protocol response, a Node write/read
+check, native handoff-document capture, and a local HTTP server/client check. It stops on the first failure and
+retains events, fixtures, and results under `.lux-runs/antigravity-smoke/`.
+After building, select one stage with
+`LUX_ANTIGRAVITY_MODEL=gemini-3.1-pro node scripts/smoke-antigravity.mjs protocol`
+(or `workspace` / `artifact` / `loopback`); `--list` makes no model calls.
+
+The script uses `permissionMode: "proceed-in-sandbox"` with scoped read access to
+the running Node installation, plus localhost grants for the loopback stage.
+It never changes global settings. Authenticate
+with an inherited `GEMINI_API_KEY`, a normal CLI OAuth token file, or
+`LUX_ANTIGRAVITY_AUTH_TOKEN_FILE` pointing to such a file. To opt into macOS
+Keychain reuse, set `LUX_ANTIGRAVITY_REUSE_KEYCHAIN=1`. On macOS with CLI 1.2.12,
+private-runtime authentication and sandboxed file writes passed on 2026-09-29.
+The loopback check failed with `connect EPERM 127.0.0.1`; its missing fixture
+evidence correctly failed the smoke test despite normal agent completion.
+
+`--sandbox` alone does not select an execution policy: a native 1.2.12 probe on
+macOS with only `enableTerminalSandbox: true` denied the command, then returned
+`SUCCESS` with empty text and `denied_actions`. Lux correctly classifies that
+result as an error. A separate tool-free live probe passed in inherited mode;
+it does not establish private-runtime authentication.
+
+A passing protocol check establishes authentication and streaming only.
+Workspace and loopback checks require fixture-produced evidence; a completed
+agent response alone cannot pass them. These checks do not establish skill
+quality, package-install access, or complete sandbox isolation. Scoped access
+to a runtime outside system directories may also be necessary.
+
+On macOS, native 1.2.11 probes could write/build in editing mode but could
+not connect to their own loopback HTTP server: direct connections returned
+`EPERM`, and proxy requests rejected literal IPs or nonstandard HTTP ports.
+That failure occurred without Lux. Recheck the installed CLI with `loopback`
+before running suites that depend on local HTTP fixtures. Domain grants alone
+have not been shown to resolve this restriction. Keep a native reproduction
+separate from driver traces when diagnosing it; do not treat it as skill failure
+or bypass the sandbox to obtain a passing score.
+
 Protocol references:
 
 - [Antigravity CLI headless mode](https://antigravity.google/docs/cli/headless/)
 - [Antigravity CLI](https://github.com/google-antigravity/antigravity-cli)
+
+- [Antigravity terminal sandbox](https://antigravity.google/docs/sandbox?tab=cli)
+- [CLI settings reference](https://antigravity.google/docs/cli/reference/)
+- [Native artifacts](https://antigravity.google/docs/cli/artifacts/)

package/src/drivers/antigravity/artifacts.ts

@@ -0,0 +1,37 @@
+import { readFile, realpath } from "node:fs/promises";
+import { join, sep } from "node:path";
+import { writeArtifactSnapshot } from "../../core/artifact-snapshot.js";
+import { walkArtifacts } from "../shared/artifacts.js";
+
+export const captureAntigravityArtifacts = async (
+  home: string,
+  destination: string,
+): Promise<void> => {
+  const brain = join(home, ".gemini/antigravity-cli/brain");
+  let root: string;
+  try {
+    root = await realpath(brain);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+  if (!root.startsWith(`${await realpath(home)}${sep}`))
+    throw new Error("Antigravity artifact directory escaped its private runtime");
+  // Native revisions and CLI bookkeeping are not authored deliverables.
+  const artifacts = (await walkArtifacts(brain)).filter(
+    ({ path }) => !/\.(?:metadata\.json|resolved(?:\.\d+)?)$/.test(path),
+  );
+  if (!artifacts.length) return;
+  const maxBytes = 32 * 1024 * 1024;
+  if (artifacts.reduce((total, artifact) => total + (artifact.size ?? 0), 0) > maxBytes)
+    throw new Error("Antigravity native artifacts exceed the 32 MiB collection limit");
+  const files = Object.fromEntries(
+    await Promise.all(artifacts.map(async ({ path }) => [path, await readFile(join(brain, path))])),
+  );
+  await writeArtifactSnapshot({
+    artifactsDir: destination,
+    name: "antigravity-artifacts",
+    files,
+    maxBytes,
+  });
+};

package/src/drivers/antigravity/config.ts

@@ -21,6 +21,20 @@ export const AntigravityDriverConfigSchema = z
     skipPermissions: z.boolean().default(false),
     /** Enable Antigravity's terminal sandbox restrictions. */
     sandbox: z.boolean().default(false),
+    /** Own the CLI settings in a private runtime home instead of changing user settings. */
+    permissionMode: z.enum(["inherit", "proceed-in-sandbox"]).default("inherit"),
+    permissions: z
+      .object({
+        allow: z.array(z.string().min(1)).default([]),
+        deny: z.array(z.string().min(1)).default([]),
+        ask: z.array(z.string().min(1)).default([]),
+      })
+      .strict()
+      .optional(),
+    /** Optional CLI-format OAuth token file for the private runtime; never logged. */
+    authTokenFile: z.string().min(1).optional(),
+    /** Explicitly authorize copying this application's macOS Keychain credential. */
+    reuseKeychain: z.boolean().default(false),
     cwd: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
     extraArgs: z.array(z.string()).optional(),
@@ -28,6 +42,27 @@ export const AntigravityDriverConfigSchema = z
     maxLineBytes: z.number().positive().default(10_000_000),
   })
   .strict()
+  .superRefine((config, ctx) => {
+    if (config.permissionMode === "proceed-in-sandbox") {
+      if (!config.sandbox || config.skipPermissions)
+        ctx.addIssue({
+          code: "custom",
+          message: "proceed-in-sandbox requires sandbox: true and skipPermissions: false",
+        });
+      if (config.project)
+        ctx.addIssue({
+          code: "custom",
+          path: ["project"],
+          message: "A private Antigravity runtime cannot reuse a host project",
+        });
+    } else if (config.permissions || config.authTokenFile || config.reuseKeychain) {
+      ctx.addIssue({
+        code: "custom",
+        message:
+          "permissions, authTokenFile, and reuseKeychain require permissionMode: proceed-in-sandbox",
+      });
+    }
+  })
   .transform(applyCatalogEffort(antigravityCatalog));
 
 export type AntigravityDriverConfig = z.infer<typeof AntigravityDriverConfigSchema>;

package/src/drivers/antigravity/index.ts

@@ -19,12 +19,15 @@ import {
   formatAntigravityPrompt,
 } from "./config.js";
 import { makeParseEvent } from "./events.js";
+import { prepareAntigravityRuntime } from "./runtime.js";
 
 class AntigravityDriver implements AgentDriver {
   private inner: AgentDriver | null = null;
   private pendingAttach: Array<(inner: AgentDriver) => void> = [];
   private cwd: string | null = null;
   private artifactsDir: string | null = null;
+  private runtime: Awaited<ReturnType<typeof prepareAntigravityRuntime>> | null = null;
+  private started = false;
   private readonly config: AntigravityDriverConfig;
 
   constructor(config: AntigravityDriverConfig) {
@@ -42,30 +45,37 @@ class AntigravityDriver implements AgentDriver {
   }
 
   async start(ctx: StartContext): Promise<ReadyState> {
-    if (this.inner) throw new Error("Antigravity driver cannot be started twice");
+    if (this.started) throw new Error("Antigravity driver cannot be started twice");
+    this.started = true;
     this.cwd = await realpath(this.config.cwd ?? ctx.artifactsDir);
     this.artifactsDir = ctx.artifactsDir;
     const cliVersion = await discoverCliVersion(this.config.command);
-    const inner = await subprocessDriver.create({
-      command: this.config.command,
-      args: buildAntigravityArgs(this.config, this.cwd),
-      cwd: this.cwd,
-      env: this.config.env,
-      protocol: "custom",
-      parseEvent: makeParseEvent(this.config, cliVersion),
-      formatPrompt: (prompt) =>
-        formatAntigravityPrompt(
-          `The task workspace is ${JSON.stringify(this.cwd)}. Treat that directory as the current directory for this task and create task artifacts there.\n\n${prompt}`,
-        ),
-      closeStdinAfterPrompt: true,
-      idleTimeout: this.config.idleTimeout,
-      maxLineBytes: this.config.maxLineBytes,
-      maxInterrupts: 1,
-    });
-    for (const attach of this.pendingAttach) attach(inner);
-    this.pendingAttach = [];
-    this.inner = inner;
-    return inner.start(ctx);
+    this.runtime = await prepareAntigravityRuntime(this.config, ctx.isolatedHome);
+    try {
+      const inner = await subprocessDriver.create({
+        command: this.config.command,
+        args: buildAntigravityArgs(this.config, this.cwd),
+        cwd: this.cwd,
+        env: this.runtime.env,
+        protocol: "custom",
+        parseEvent: makeParseEvent(this.config, cliVersion),
+        formatPrompt: (prompt) =>
+          formatAntigravityPrompt(
+            `The task workspace is ${JSON.stringify(this.cwd)}. Treat that directory as the current directory for this task and create task artifacts there.\n\n${prompt}`,
+          ),
+        closeStdinAfterPrompt: true,
+        idleTimeout: this.config.idleTimeout,
+        maxLineBytes: this.config.maxLineBytes,
+        maxInterrupts: 1,
+      });
+      for (const attach of this.pendingAttach) attach(inner);
+      this.pendingAttach = [];
+      this.inner = inner;
+      return await inner.start(ctx);
+    } catch (error) {
+      await this.close();
+      throw error;
+    }
   }
 
   async respond(_answer: Answer): Promise<void> {
@@ -79,6 +89,11 @@ class AntigravityDriver implements AgentDriver {
   async collect(): Promise<Artifact[]> {
     await this.quiesce();
     if (!this.cwd) return [];
+    try {
+      await this.runtime?.collect(this.cwd);
+    } finally {
+      await this.runtime?.close();
+    }
     const artifacts = await walkArtifacts(this.cwd);
     return this.cwd === this.artifactsDir
       ? artifacts
@@ -86,7 +101,11 @@ class AntigravityDriver implements AgentDriver {
   }
 
   async close(): Promise<void> {
-    await this.inner?.close();
+    try {
+      await this.inner?.close();
+    } finally {
+      await this.runtime?.close();
+    }
   }
 }
 

package/src/drivers/antigravity/runtime.ts

@@ -0,0 +1,88 @@
+import { chmod, copyFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import { temporaryDirectory } from "tempy";
+import { exec } from "../../core/exec.js";
+import { captureAntigravityArtifacts } from "./artifacts.js";
+import type { AntigravityDriverConfig } from "./config.js";
+
+export const prepareAntigravityRuntime = async (
+  config: AntigravityDriverConfig,
+  isolatedHome?: string,
+): Promise<{
+  env: Record<string, string> | undefined;
+  collect: (destination: string) => Promise<void>;
+  close: () => Promise<void>;
+}> => {
+  if (config.permissionMode === "inherit")
+    return {
+      env: config.env,
+      collect: async (destination) => {
+        if (isolatedHome) await captureAntigravityArtifacts(isolatedHome, destination);
+      },
+      close: async () => {},
+    };
+
+  const runtimeHome = temporaryDirectory({ prefix: "lux-antigravity-home-" });
+  const close = () => rm(runtimeHome, { recursive: true, force: true });
+  try {
+    await chmod(runtimeHome, 0o700);
+    const cliRoot = join(runtimeHome, ".gemini", "antigravity-cli");
+    await mkdir(cliRoot, { recursive: true, mode: 0o700 });
+    await writeFile(
+      join(cliRoot, "settings.json"),
+      JSON.stringify({
+        enableTerminalSandbox: true,
+        toolPermission: "proceed-in-sandbox",
+        permissions: config.permissions,
+      }),
+      { mode: 0o600 },
+    );
+    const source =
+      config.authTokenFile ??
+      join(config.env?.HOME ?? homedir(), ".gemini", "antigravity-cli", "antigravity-oauth-token");
+    try {
+      // Copy only the CLI's own token, never settings, conversations, or plugins.
+      // A private copy prevents token refresh from mutating the caller's login.
+      const target = join(cliRoot, "antigravity-oauth-token");
+      await copyFile(source, target);
+      await chmod(target, 0o600);
+      // Reject empty files early without including credential contents in diagnostics.
+      if ((await readFile(target)).length === 0) throw new Error("Antigravity token file is empty");
+    } catch (error) {
+      if (config.authTokenFile || (error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      if (config.reuseKeychain) {
+        if (platform() !== "darwin") throw new Error("Antigravity Keychain reuse requires macOS");
+        const credential = await exec(
+          "/usr/bin/security",
+          ["find-generic-password", "-s", "gemini", "-a", "antigravity", "-w"],
+          { timeoutMs: 10_000, maxBuffer: 1_000_000 },
+        );
+        if (credential.exitCode !== 0 || credential.stdoutTruncated)
+          throw new Error("Could not read the authorized Antigravity Keychain credential");
+        let token = credential.stdout.trim();
+        if (token.startsWith("go-keyring-base64:"))
+          token = Buffer.from(token.slice("go-keyring-base64:".length), "base64").toString("utf8");
+        try {
+          const parsed = JSON.parse(token);
+          if (!parsed?.token?.refresh_token || !parsed.auth_method) throw new Error();
+        } catch {
+          throw new Error("Antigravity Keychain credential has an unsupported format");
+        }
+        await writeFile(join(cliRoot, "antigravity-oauth-token"), token, { mode: 0o600 });
+      }
+    }
+    return {
+      env: {
+        ...config.env,
+        HOME: runtimeHome,
+        ...(process.platform === "win32" ? { USERPROFILE: runtimeHome } : {}),
+      },
+      collect: (destination) => captureAntigravityArtifacts(runtimeHome, destination),
+      close,
+    };
+  } catch (error) {
+    await close();
+    throw error;
+  }
+};

package/src/drivers/copilot/README.md

@@ -22,27 +22,35 @@ and silently falls back on the rest, so the harness catalog in
 `core/harness-catalogs/copilot.ts` records the levels per model id and Lux
 rejects a level the model does not honor. Models whose levels are not published
 (Gemini, Grok, Kimi, MAI) are listed with no effort. When no effort is set, a
-model with levels runs at `low`. The session reports the requested model, not
-a confirmed one. `lux doctor` compares the catalog's model ids with
+model with levels runs at `low`. When ACP advertises a model selector, Lux
+selects and verifies the requested model; otherwise it records the model as
+requested rather than confirmed. `lux doctor` compares the catalog's model ids with
 `copilot help config` and warns when they differ.
 
 Tool permission requests arrive as ACP `session/request_permission` calls and
 become `approve` interrupts. Lux answers with the one-operation option only and
 never selects a remembered grant. `allowTools` and `denyTools` pass Copilot
 permission patterns; `allowAllTools` approves everything, which turns the
-interactive capability off. The `ask_user` tool is disabled by default because
-Copilot has no ACP wire for it; set `askUser: true` only when the harness can
-answer it another way.
-
-Copilot loads no `AGENTS.md` instructions and no bundled GitHub MCP server
-unless `customInstructions` or `builtinMcps` are enabled. Auto-update is always
-off. The driver provides no ambient-configuration isolation: Copilot still
+interactive capability off. The `ask_user` tool is disabled because Copilot has
+no ACP wire for it. `askUser: true` is rejected before launching the CLI;
+permission interrupts remain supported through the normal Lux answerer.
+
+Copilot loads its native workspace instructions and bundled GitHub MCP server
+by default, matching ordinary harness execution. Set `customInstructions: false`
+or `builtinMcps: false` to disable them for a specific evaluation. Auto-update is
+always off. The driver provides no ambient-configuration isolation: Copilot still
 reads `~/.copilot` settings, MCP configuration, and credentials. Usage and
 cost are recorded as unknown; `--usage-output-file` cannot be combined with
 `--acp`.
 
-The adapter is covered by synthetic protocol and lifecycle tests. It has not
-been validated against an authenticated Copilot session.
+The adapter has synthetic protocol and lifecycle tests plus an opt-in live
+smoke task: `mise run smoke:harnesses -- copilot` from the repository root.
+The live task uses your installed CLI, existing login, and model quota. CLI
+`1.0.83` passed the authenticated file-copy smoke on 2026-09-30 after the account
+received a Copilot seat and CLI access. A seat alone does not enable the CLI:
+check the organization's Copilot CLI policy when GitHub returns a feature-access
+403. Lux also recognizes the CLI's native authorization diagnostic as an error
+even when Copilot ends the turn normally.
 
 Protocol references:
 

package/src/drivers/copilot/config.ts

@@ -14,12 +14,12 @@ export const CopilotDriverConfigSchema = z
     denyTools: z.array(z.string().min(1)).optional(),
     /** Approve every tool without interrupts; permissions stop being evidence. */
     allowAllTools: z.boolean().default(false),
-    /** Keep the `ask_user` tool available; it is disabled by default because ACP has no wire for it. */
-    askUser: z.boolean().default(false),
+    /** ACP cannot answer ask_user requests; reject configurations that would strand the run. */
+    askUser: z.literal(false).default(false),
     /** Load AGENTS.md and related instruction files from the workspace. */
-    customInstructions: z.boolean().default(false),
+    customInstructions: z.boolean().default(true),
     /** Enable Copilot's bundled GitHub MCP server. */
-    builtinMcps: z.boolean().default(false),
+    builtinMcps: z.boolean().default(true),
     addDirs: z.array(z.string()).optional(),
     extraArgs: z.array(z.string()).optional(),
     cwd: z.string().optional(),
@@ -42,7 +42,7 @@ export const buildCopilotArgs = (config: CopilotDriverConfig): string[] => [
   "--model",
   config.model,
   ...(config.reasoningEffort ? ["--effort", config.reasoningEffort] : []),
-  ...(config.askUser ? [] : ["--no-ask-user"]),
+  "--no-ask-user",
   ...(config.customInstructions ? [] : ["--no-custom-instructions"]),
   ...(config.builtinMcps ? [] : ["--disable-builtin-mcps"]),
   ...(config.allowAllTools ? ["--allow-all-tools"] : []),

package/src/drivers/copilot/index.ts

@@ -14,6 +14,7 @@ import {
 } from "../../core/index.js";
 import { AcpEvents } from "../shared/acp-events.js";
 import { permissionAnswer, permissionRequestText, records } from "../shared/acp-interaction.js";
+import { acpModel, selectAcpModel } from "../shared/acp-session.js";
 import { AcpTransport, asRecord, type RpcId, type RpcRecord } from "../shared/acp-transport.js";
 import { walkArtifacts } from "../shared/artifacts.js";
 import {
@@ -35,6 +36,7 @@ class CopilotDriver implements AgentDriver {
   private terminal = false;
   private idleTimer: NodeJS.Timeout | undefined;
   private interruptCount = 0;
+  private responseText = "";
   private readonly interrupts = new Map<string, { id: RpcId; params: RpcRecord }>();
 
   private readonly config: CopilotDriverConfig;
@@ -91,9 +93,12 @@ class CopilotDriver implements AgentDriver {
           "Expected Copilot ACP with copilot-login authentication; check the configured command points to GitHub Copilot CLI",
         );
       }
-      const session = await this.request("session/new", { cwd: this.cwd, mcpServers: [] });
+      let session = await this.request("session/new", { cwd: this.cwd, mcpServers: [] });
       if (typeof session.sessionId !== "string") throw new Error("Copilot ACP omitted sessionId");
       this.sessionId = session.sessionId;
+      session = await selectAcpModel("Copilot", session, this.config.model, (method, params) =>
+        this.request(method, params),
+      );
       const modeId = COPILOT_MODE_IDS[this.config.mode];
       const currentModeId = asRecord(session.modes)?.currentModeId;
       if (currentModeId !== modeId) {
@@ -117,7 +122,7 @@ class CopilotDriver implements AgentDriver {
           ...(cliVersion ? { cliVersion } : {}),
           mode: this.config.mode,
           reasoningEffort: this.config.reasoningEffort,
-          modelResolution: "requested",
+          modelResolution: typeof acpModel(session) === "string" ? "reported" : "requested",
           nativeConfig: session.configOptions ?? [],
           usageAvailability: "unknown",
           isolation: "none",
@@ -143,6 +148,13 @@ class CopilotDriver implements AgentDriver {
     if (this.terminal) return;
     if (result?.stopReason !== "end_turn")
       throw new Error(`Copilot stopped with ${String(result?.stopReason ?? "unknown reason")}`);
+    // Copilot 1.0.83 emits this native auth failure as text followed by end_turn.
+    if (
+      /^Error: Authorization error\. Your credentials may be expired or invalid\.(?: \(Request ID: [^)]+\))?\s*$/.test(
+        this.responseText,
+      )
+    )
+      throw new Error("Copilot authorization failed; run 'copilot login' and retry");
     this.terminal = true;
     clearTimeout(this.idleTimer);
     await this.emitter.emit("done", {
@@ -174,7 +186,8 @@ class CopilotDriver implements AgentDriver {
       }
       if (++this.interruptCount > this.config.maxInterrupts) {
         this.transport?.write({ id, result: { outcome: { outcome: "cancelled" } } });
-        throw new Error("Copilot exceeded maxInterrupts");
+        this.fail(new Error("Copilot exceeded maxInterrupts"), "max-interactions");
+        return;
       }
       const interruptId = `copilot-${id}`;
       if (this.interrupts.has(interruptId)) throw new Error("Copilot reused a pending request ID");
@@ -191,6 +204,9 @@ class CopilotDriver implements AgentDriver {
     if (method === "session/update") {
       if (params.sessionId !== this.sessionId) return;
       const update = asRecord(params.update);
+      const content = asRecord(update?.content);
+      if (update?.sessionUpdate === "agent_message_chunk" && typeof content?.text === "string")
+        this.responseText = (this.responseText + content.text).slice(0, 8_192);
       if (update)
         for (const event of this.events.update(update)) await this.emitter.emit("progress", event);
     }
@@ -217,7 +233,7 @@ class CopilotDriver implements AgentDriver {
     );
   }
 
-  private fail(error: unknown, exitReason: "error" | "idle-timeout" = "error"): void {
+  private fail(error: unknown, exitReason: DriverEventMap["error"]["exitReason"] = "error"): void {
     if (this.terminal) return;
     this.terminal = true;
     clearTimeout(this.idleTimer);