@quantiya/codevibe-claude-plugin 2.0.21 → 2.0.23

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/cli.js

@@ -8410,9 +8410,10 @@ function reduceSessionTaskTerminal(state, event) {
   if (terminal === null) return state;
   let taskId = "taskId" in event ? event.taskId : void 0;
   if (!taskId) return state;
-  let existing = state.sessionTasks.get(taskId), sessionTasks = new Map(state.sessionTasks);
+  let runningTasks = new Map(state.runningTasks), evictedRunningTask = runningTasks.delete(taskId), existing = state.sessionTasks.get(taskId), sessionTasks = new Map(state.sessionTasks);
   if (existing) {
-    if (existing.origin !== "single" || existing.status !== "running") return state;
+    if (existing.origin !== "single" || existing.status !== "running")
+      return evictedRunningTask ? { ...state, runningTasks } : state;
     sessionTasks.set(taskId, { ...existing, status: terminal });
   } else
     sessionTasks.set(taskId, {
@@ -8421,7 +8422,7 @@ function reduceSessionTaskTerminal(state, event) {
       status: terminal,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-  return { ...state, sessionTasks };
+  return { ...state, runningTasks, sessionTasks };
 }
 var REVIEWER_STATUS_PHASES = /* @__PURE__ */ new Set([
   "reviewers_dispatched",
@@ -8724,9 +8725,9 @@ function reduceClarificationAnswered(state, answer) {
   };
 }
 function reduceTaskLifecycle(state, task) {
-  let next = new Map(state.runningTasks);
-  task.status === "completed" || task.status === "cancelled" || task.status === "failed" ? next.delete(task.taskId) : next.set(task.taskId, task);
-  let history = new Map(state.sessionTasks), existing = state.sessionTasks.get(task.taskId), existingIsTerminal = existing?.origin === "single" && (existing.status === "completed" || existing.status === "cancelled" || existing.status === "failed"), incomingIsTerminal = task.status === "completed" || task.status === "cancelled" || task.status === "failed";
+  let existing = state.sessionTasks.get(task.taskId), existingIsTerminal = existing?.origin === "single" && (existing.status === "completed" || existing.status === "cancelled" || existing.status === "failed"), incomingIsTerminal = task.status === "completed" || task.status === "cancelled" || task.status === "failed", next = new Map(state.runningTasks);
+  incomingIsTerminal || existingIsTerminal && !incomingIsTerminal ? next.delete(task.taskId) : next.set(task.taskId, task);
+  let history = new Map(state.sessionTasks);
   return history.set(task.taskId, {
     taskId: task.taskId,
     agentKind: task.agentKind,
@@ -20276,6 +20277,37 @@ async function bindWorkingDirectory(payload){
     throw new Error('target cwd incarnation changed before launch');
   }
 }
+function holdLaunchPathAuthorities(payload){
+  const authorities=payload.launchPathAuthorities;
+  if(authorities===undefined)return [];
+  if(!Array.isArray(authorities)||authorities.length>16)throw new Error('invalid launch path authorities');
+  const held=[];
+  try{
+    for(const authority of authorities){
+      if(!authority||authority.version!==1||
+          typeof authority.canonicalPath!=='string'||!require('node:path').isAbsolute(authority.canonicalPath)||authority.canonicalPath.includes('\0')||
+          typeof authority.dev!=='string'||typeof authority.ino!=='string'||
+          typeof authority.birthtimeNs!=='string')throw new Error('invalid launch path authority');
+      const flags=fs.constants.O_RDONLY|(fs.constants.O_DIRECTORY||0)|(fs.constants.O_NOFOLLOW||0);
+      const fd=fs.openSync(authority.canonicalPath,flags);
+      held.push(fd);
+      const opened=fs.fstatSync(fd,{bigint:true});
+      const live=fs.lstatSync(authority.canonicalPath,{bigint:true});
+      const canonical=fs.realpathSync(authority.canonicalPath);
+      if(!opened.isDirectory()||!live.isDirectory()||live.isSymbolicLink()||
+          opened.dev.toString()!==authority.dev||opened.ino.toString()!==authority.ino||
+          opened.birthtimeNs.toString()!==authority.birthtimeNs||
+          live.dev.toString()!==authority.dev||live.ino.toString()!==authority.ino||
+          live.birthtimeNs.toString()!==authority.birthtimeNs||canonical!==authority.canonicalPath){
+        throw new Error('launch path authority changed before target spawn');
+      }
+    }
+    return held;
+  }catch(err){
+    for(const fd of held){try{fs.closeSync(fd);}catch{}}
+    throw err;
+  }
+}
 const hostPipe=fs.createReadStream(null,{fd:5,autoClose:false});
 for(const event of ['end','close','error'])hostPipe.once(event,killOwnGroup);
 for(const [signal] of [['SIGTERM'],['SIGINT'],['SIGHUP']])process.on(signal,killOwnGroup);
@@ -20284,9 +20316,17 @@ for(const [signal] of [['SIGTERM'],['SIGINT'],['SIGHUP']])process.on(signal,kill
   const start=await readLine(4);
   if(start!=='START')throw new Error('target start not authorized');
   await bindWorkingDirectory(payload);
+  // This is deliberately synchronous and immediately adjacent to cp.spawn:
+  // keep exact directory descriptors open across native process creation so a
+  // pathname replacement during durable-owner publication cannot be adopted.
+  const launchPathFds=holdLaunchPathAuthorities(payload);
   // No pathname cwd is passed here: the child inherits the wrapper's already-
   // authenticated kernel cwd reference, so a later rename cannot redirect it.
-  target=cp.spawn(payload.command,payload.args,{env:payload.env,stdio:['inherit','inherit','inherit'],detached:false,windowsHide:true});
+  try{
+    target=cp.spawn(payload.command,payload.args,{env:payload.env,stdio:['inherit','inherit','inherit'],detached:false,windowsHide:true});
+  }finally{
+    for(const fd of launchPathFds){try{fs.closeSync(fd);}catch{}}
+  }
   target.once('error',err=>{send({type:'target-exit',code:127,error:String(err&&err.message||err)});});
   target.once('exit',(code,signal)=>{send({type:'target-exit',code:Number.isInteger(code)?code:(signal?128:1)});});
   // Remain the authenticated group/session leader until the outside host has
@@ -20386,6 +20426,7 @@ function spawnPosixOwnedProcess(command, args, options, seams = {}) {
     args,
     cwd: targetCwd,
     cwdAuthority: seams.workingDirAuthority,
+    launchPathAuthorities: seams.launchPathAuthorities,
     env: options?.env ?? process.env,
     ...seams.cleanupTimeoutMs === void 0 ? {} : { cleanupTimeoutMs: seams.cleanupTimeoutMs }
   }), "utf8");
@@ -26408,6 +26449,38 @@ var LocalGemmaPlannerAdapter = class {
 // src/orchestration-shell/quorum-loop.ts
 var import_node_fs24 = require("node:fs");
 
+// src/diagnostics/shape-only.ts
+function outputShapeOnly(raw) {
+  if (typeof raw != "string" || raw.length === 0)
+    return {
+      bytes: 0,
+      lines: 0,
+      leadClass: "empty",
+      fenceCount: 0,
+      bulletLines: 0,
+      blankLines: 0
+    };
+  let lines = raw.split(`
+`), trimmed = raw.trim(), leadClass;
+  return trimmed.length === 0 ? leadClass = "empty" : trimmed.startsWith("{") || trimmed.startsWith("[") ? leadClass = "json-open" : trimmed.startsWith("```") ? leadClass = "fence" : /^#{1,6}\s/.test(trimmed) ? leadClass = "heading" : /^[-*+]\s/.test(trimmed) ? leadClass = "bullet" : /^\d+[.)]\s/.test(trimmed) ? leadClass = "ordinal" : /^[A-Za-z]/.test(trimmed) ? leadClass = "prose" : leadClass = "other", {
+    bytes: Buffer.byteLength(raw, "utf8"),
+    lines: lines.length,
+    leadClass,
+    fenceCount: (raw.match(/```/g) ?? []).length,
+    bulletLines: lines.filter((line) => /^\s*[-*+]\s/.test(line)).length,
+    blankLines: lines.filter((line) => line.trim().length === 0).length
+  };
+}
+function errorShapeOnly(error) {
+  let value = error, message = typeof value?.message == "string" ? value.message : "", causeCount = Array.isArray(value?.causes) ? value.causes.length : value?.cause !== void 0 ? 1 : 0;
+  return {
+    errorClass: error instanceof Error ? "error" : "non-error",
+    messageBytes: Buffer.byteLength(message, "utf8"),
+    hasCause: value?.cause !== void 0,
+    causeCount
+  };
+}
+
 // src/reduced-trust-notice.ts
 var surfacedRationales = /* @__PURE__ */ new Set();
 function noticeKey(sessionId, tier, reason) {
@@ -28103,7 +28176,8 @@ var ClassBConsumer = class {
 };
 
 // src/substrate-launch/apikey-bootstrap.ts
-var import_node_fs14 = require("node:fs"), os19 = __toESM(require("node:os")), path32 = __toESM(require("node:path")), HELPER_SCRIPT_NAME = "broker-apikey-helper.sh", TOKEN_FILE_NAME = "broker-token", CLAUDE_SETTINGS_NAME = "settings.json", CODEX_CONFIG_NAME = "config.toml", SANDBOX_BOOTSTRAP_DIR = "/codevibe/agent", SANDBOX_AGENT_CONFIG_DIR = "/codevibe/agent-config", CODEX_PROVIDER_ID = "codevibe_broker";
+var import_node_fs14 = require("node:fs"), os19 = __toESM(require("node:os")), path32 = __toESM(require("node:path"));
+var HELPER_SCRIPT_NAME = "broker-apikey-helper.sh", TOKEN_FILE_NAME = "broker-token", CLAUDE_SETTINGS_NAME = "settings.json", CODEX_CONFIG_NAME = "config.toml", SANDBOX_BOOTSTRAP_DIR = "/codevibe/agent", SANDBOX_AGENT_CONFIG_DIR = "/codevibe/agent-config", CODEX_PROVIDER_ID = "codevibe_broker";
 function helperScriptSource(tokenFileAbsPathInSandbox) {
   return `#!/bin/sh
 # CP-7 apiKeyHelper \u2014 emits the current broker token (NEVER the vendor key).
@@ -28144,12 +28218,16 @@ function isInsideOrEqual(child, parent) {
   return rel.length > 0 && !rel.startsWith("..") && !path32.isAbsolute(rel);
 }
 var ApiKeyBootstrap = class _ApiKeyBootstrap {
-  constructor(hostDir, sandboxDir, configHostDir, configSandboxDir, tokenFileHostPath) {
+  constructor(hostDir, sandboxDir, configHostDir, configSandboxDir, tokenFileHostPath, claudeScratchHostDir, claudeScratchSandboxDir, claudeScratchIdentity, beforeClaudeScratchCleanupCommit) {
     this.hostDir = hostDir;
     this.sandboxDir = sandboxDir;
     this.configHostDir = configHostDir;
     this.configSandboxDir = configSandboxDir;
     this.tokenFileHostPath = tokenFileHostPath;
+    this.claudeScratchHostDir = claudeScratchHostDir;
+    this.claudeScratchSandboxDir = claudeScratchSandboxDir;
+    this.claudeScratchIdentity = claudeScratchIdentity;
+    this.beforeClaudeScratchCleanupCommit = beforeClaudeScratchCleanupCommit;
   }
   /**
    * Materialize the bootstrap: create the host dir (0700), write the token file
@@ -28165,9 +28243,8 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
     );
     await import_node_fs14.promises.chmod(rawConfigHostDir, 448).catch(() => {
     });
-    let hostDir = await import_node_fs14.promises.realpath(rawHostDir), configHostDir = await import_node_fs14.promises.realpath(rawConfigHostDir);
+    let hostDir = await import_node_fs14.promises.realpath(rawHostDir), configHostDir = await import_node_fs14.promises.realpath(rawConfigHostDir), realWorkdir;
     if (input.workdir !== void 0) {
-      let realWorkdir;
       try {
         realWorkdir = await import_node_fs14.promises.realpath(input.workdir);
       } catch {
@@ -28204,7 +28281,7 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
         "ApiKeyBootstrap.create: provide `sandboxConfigDir` or `configDirEqualsHostDir`"
       );
     let tokenInSandbox = path32.posix.join(sandboxDir, TOKEN_FILE_NAME), helperInSandbox = path32.posix.join(sandboxDir, HELPER_SCRIPT_NAME), tokenFileHostPath = path32.join(hostDir, TOKEN_FILE_NAME);
-    return await import_node_fs14.promises.writeFile(tokenFileHostPath, input.initialToken, {
+    await import_node_fs14.promises.writeFile(tokenFileHostPath, input.initialToken, {
       encoding: "utf8",
       mode: 384
     }), await import_node_fs14.promises.writeFile(
@@ -28219,12 +28296,107 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
       path32.join(configHostDir, CODEX_CONFIG_NAME),
       codexConfig(input.sandboxBrokerUrl, helperInSandbox),
       { encoding: "utf8", mode: 384 }
-    ), new _ApiKeyBootstrap(
+    );
+    let claudeScratchHostDir = null, claudeScratchSandboxDir = null, claudeScratchIdentity = null;
+    if (input.claudeScratchHostRoot !== void 0) {
+      if (input.provider !== "anthropic" || !input.sandboxDirEqualsHostDir) {
+        let primary = new Error(
+          "ApiKeyBootstrap.create: a short Claude scratch root is valid only for the A5 anthropic path"
+        ), cleanupErrors = [];
+        for (let directory of [hostDir, configHostDir])
+          try {
+            await import_node_fs14.promises.rm(directory, { recursive: !0, force: !0 });
+          } catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+          }
+        throw cleanupErrors.length > 0 ? Object.assign(
+          new Error(
+            "ApiKeyBootstrap.create: invalid scratch configuration and cleanup did not complete"
+          ),
+          { causes: [primary, ...cleanupErrors] }
+        ) : primary;
+      }
+      let rawScratchDir = null;
+      try {
+        let canonicalScratchRoot = await import_node_fs14.promises.realpath(
+          input.claudeScratchHostRoot
+        );
+        rawScratchDir = await import_node_fs14.promises.mkdtemp(path32.join(canonicalScratchRoot, "cv"));
+        let initial = await import_node_fs14.promises.lstat(rawScratchDir, { bigint: !0 });
+        if (!initial.isDirectory() || initial.isSymbolicLink())
+          throw new Error(
+            "ApiKeyBootstrap.create: generated Claude scratch root is not a real directory"
+          );
+        await input.beforeClaudeScratchOpen?.(rawScratchDir);
+        let scratchHandle = await import_node_fs14.promises.open(
+          rawScratchDir,
+          import_node_fs14.constants.O_RDONLY | import_node_fs14.constants.O_NOFOLLOW | (typeof import_node_fs14.constants.O_DIRECTORY == "number" ? import_node_fs14.constants.O_DIRECTORY : 0)
+        );
+        try {
+          let opened = await scratchHandle.stat({ bigint: !0 });
+          if (!opened.isDirectory() || opened.dev !== initial.dev || opened.ino !== initial.ino || opened.birthtimeNs !== initial.birthtimeNs)
+            throw new Error(
+              "ApiKeyBootstrap.create: Claude scratch root changed while binding its directory handle"
+            );
+          await scratchHandle.chmod(448);
+          let sealed = await scratchHandle.stat({ bigint: !0 }), live = await import_node_fs14.promises.lstat(rawScratchDir, { bigint: !0 }), canonical = rawScratchDir, currentUid = process.getuid?.(), mode = sealed.mode & 0o777n;
+          if (!sealed.isDirectory() || !live.isDirectory() || live.isSymbolicLink() || live.dev !== sealed.dev || live.ino !== sealed.ino || live.birthtimeNs !== sealed.birthtimeNs || currentUid === void 0 || sealed.uid !== BigInt(currentUid) || mode !== 0o700n)
+            throw new Error(
+              "ApiKeyBootstrap.create: generated Claude scratch root failed its descriptor-bound private-directory identity check"
+            );
+          claudeScratchHostDir = canonical, claudeScratchSandboxDir = rawScratchDir, claudeScratchIdentity = {
+            version: 1,
+            canonicalPath: canonical,
+            dev: sealed.dev.toString(),
+            ino: sealed.ino.toString(),
+            birthtimeNs: sealed.birthtimeNs.toString()
+          };
+        } finally {
+          await scratchHandle.close();
+        }
+        if (Buffer.byteLength(rawScratchDir, "utf8") > 30)
+          throw new Error(
+            "ApiKeyBootstrap.create: generated Claude scratch path exceeds the 30-byte A5 safety bound"
+          );
+        if (realWorkdir !== void 0 && isInsideOrEqual(claudeScratchHostDir, realWorkdir))
+          throw new Error(
+            "ApiKeyBootstrap.create: Claude scratch root is inside the agent workdir (fail-closed)"
+          );
+      } catch (error) {
+        let cleanupErrors = [];
+        if (claudeScratchIdentity !== null)
+          try {
+            await anchoredRemoveTree(
+              claudeScratchIdentity.canonicalPath,
+              claudeScratchIdentity
+            );
+          } catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+          }
+        for (let directory of [hostDir, configHostDir])
+          try {
+            await import_node_fs14.promises.rm(directory, { recursive: !0, force: !0 });
+          } catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+          }
+        throw cleanupErrors.length > 0 ? Object.assign(
+          new Error(
+            "ApiKeyBootstrap.create: initialization failed and cleanup did not complete"
+          ),
+          { causes: [error, ...cleanupErrors] }
+        ) : error;
+      }
+    }
+    return new _ApiKeyBootstrap(
       hostDir,
       sandboxDir,
       configHostDir,
       sandboxConfigDir,
-      tokenFileHostPath
+      tokenFileHostPath,
+      claudeScratchHostDir,
+      claudeScratchSandboxDir,
+      claudeScratchIdentity,
+      input.beforeClaudeScratchCleanupCommit
     );
   }
   /** The `SubstrateSpec.agentBootstrap` value for this bootstrap. */
@@ -28235,6 +28407,14 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
   get configSpec() {
     return { hostDir: this.configHostDir, sandboxDir: this.configSandboxDir };
   }
+  /** The unique writable Claude scratch grant, absent on Docker/Codex paths. */
+  get claudeScratchSpec() {
+    return this.claudeScratchHostDir === null || this.claudeScratchSandboxDir === null || this.claudeScratchIdentity === null ? null : {
+      hostDir: this.claudeScratchHostDir,
+      sandboxDir: this.claudeScratchSandboxDir,
+      authority: this.claudeScratchIdentity
+    };
+  }
   /**
    * REFRESH the broker token (rotation / on a broker 401). Atomically rewrites
    * the token file (write a temp + rename) so the agent never reads a partial
@@ -28245,15 +28425,41 @@ var ApiKeyBootstrap = class _ApiKeyBootstrap {
     let tmp = `${this.tokenFileHostPath}.tmp-${process.pid}-${Date.now()}`;
     await import_node_fs14.promises.writeFile(tmp, token, { encoding: "utf8", mode: 384 }), await import_node_fs14.promises.rename(tmp, this.tokenFileHostPath);
   }
-  /** Remove the bootstrap dir (session teardown). Idempotent. */
+  /**
+   * Remove the bootstrap, config, and unique Claude scratch dirs. Scratch
+   * cleanup is identity-bound: a replaced pathname is retained and reported,
+   * never recursively removed as though it still belonged to this seat.
+   */
   async destroy() {
-    await import_node_fs14.promises.rm(this.hostDir, { recursive: !0, force: !0 }).catch(
-      () => {
+    let cleanupErrors = [];
+    if (this.claudeScratchHostDir !== null && this.claudeScratchIdentity !== null)
+      try {
+        await anchoredRemoveTree(
+          this.claudeScratchIdentity.canonicalPath,
+          this.claudeScratchIdentity,
+          {
+            ...this.beforeClaudeScratchCleanupCommit ? {
+              beforeCommit: () => this.beforeClaudeScratchCleanupCommit(
+                this.claudeScratchHostDir
+              )
+            } : {}
+          }
+        );
+      } catch (error) {
+        cleanupErrors.push(error);
       }
-    ), await import_node_fs14.promises.rm(this.configHostDir, { recursive: !0, force: !0 }).catch(
-      () => {
+    for (let directory of [this.hostDir, this.configHostDir])
+      try {
+        await import_node_fs14.promises.rm(directory, { recursive: !0, force: !0 });
+      } catch (error) {
+        cleanupErrors.push(error);
       }
-    );
+    if (cleanupErrors.length === 1) throw cleanupErrors[0];
+    if (cleanupErrors.length > 1)
+      throw Object.assign(
+        new Error("ApiKeyBootstrap.destroy: cleanup did not complete"),
+        { causes: cleanupErrors }
+      );
   }
 };
 
@@ -42775,10 +42981,7 @@ var LocalExecutorImpl = class {
     }).catch(() => {
     }), {
       args: { ...addClaudeSubstrateAuthArgs(args, result.agentConfigDir), substrate: result.substrateHandle },
-      onExit: async () => {
-        await result.teardown().catch(() => {
-        });
-      },
+      onExit: () => result.teardown(),
       // Stage-2 r3 Codex HIGH — the ONLY return that proves a real confining
       // boundary (`result.mode === 'substrate'`, not reduced_trust / no-engager /
       // pre-TaskAuthorized). The danger-sandbox authority keys on THIS boolean,
@@ -42870,7 +43073,11 @@ var LocalExecutorImpl = class {
     }
   }
   async spawnWithLifecycle(args, spawnFn, onSubstrateExit) {
-    let role = args.role, lifecycleAudit = args.lifecycleAudit ?? "active_task", lifecycleTaskId = args.taskId ?? this.taskId, lifecycleCtx = lifecycleTaskId ? { taskId: lifecycleTaskId, ...this.baseCtx } : null, full = {
+    let role = args.role, lifecycleAudit = args.lifecycleAudit ?? "active_task", lifecycleTaskId = args.taskId ?? this.taskId, lifecycleCtx = lifecycleTaskId ? { taskId: lifecycleTaskId, ...this.baseCtx } : null, substrateCleanupError, substrateCleanupPromise, cleanupSubstrate = async () => {
+      onSubstrateExit && (substrateCleanupPromise || (substrateCleanupPromise = onSubstrateExit().catch((error) => {
+        throw substrateCleanupError = error, error;
+      })), await substrateCleanupPromise);
+    }, full = {
       ...args,
       agentKind: args.agentKind ?? this.adapter,
       onProcessSpawned: async (info) => {
@@ -42884,35 +43091,51 @@ var LocalExecutorImpl = class {
         });
       },
       onProcessExited: async (info) => {
-        if (await args.onProcessExited?.(info), lifecycleAudit !== "none") {
-          let ctx = lifecycleCtx;
-          ctx !== null && await this.emitter.emitProcessExited(ctx, {
-            pid: info.pid,
-            exitCode: info.exitCode,
-            failureClass: info.failureClass,
-            occurredAt: info.exitedAt
-          });
+        try {
+          if (await args.onProcessExited?.(info), lifecycleAudit !== "none") {
+            let ctx = lifecycleCtx;
+            ctx !== null && await this.emitter.emitProcessExited(ctx, {
+              pid: info.pid,
+              exitCode: info.exitCode,
+              failureClass: info.failureClass,
+              occurredAt: info.exitedAt
+            });
+          }
+        } catch {
         }
-        onSubstrateExit && await onSubstrateExit().catch(() => {
+        await cleanupSubstrate().catch(() => {
         });
       }
     };
     try {
-      return await spawnFn(full);
+      let handle = await spawnFn(full), done = handle.done.then((info) => {
+        if (substrateCleanupError !== void 0)
+          throw Object.assign(
+            new Error("implementor substrate cleanup failed after process exit"),
+            { cause: substrateCleanupError }
+          );
+        return info;
+      });
+      return { ...handle, done };
     } catch (err) {
-      if (onSubstrateExit && await onSubstrateExit().catch(() => {
-      }), err instanceof AuthorityError) {
+      await cleanupSubstrate().catch(() => {
+      });
+      let primary = err;
+      if (err instanceof AuthorityError) {
         let safeArgv = redactAgyPrintArgv(args.argv), safeDetail = redactAgyPrintValuesFromText(err.refusal.detail, args.argv), safeError = new AuthorityError({
           ...err.refusal,
           detail: safeDetail
         });
-        throw await this.bridge.bridgeAuthorityRefusal(safeError, {
+        await this.bridge.bridgeAuthorityRefusal(safeError, {
           refusedMessageId: "spawn:" + role + ":" + Date.now(),
           shellContent: `Refused spawn (${role}): ${safeDetail}`,
           shellMetadata: { role, argv: safeArgv }
-        }), safeError;
+        }), primary = safeError;
       }
-      throw err;
+      throw substrateCleanupError !== void 0 ? Object.assign(
+        new Error("implementor spawn failed and substrate cleanup also failed"),
+        { causes: [primary, substrateCleanupError] }
+      ) : primary;
     }
   }
   // --- Hook bridge surface ---------------------------------------------------
@@ -49034,10 +49257,11 @@ var ChildProcessCommandRunner = class {
       signal: opts.signal,
       ...opts.env !== void 0 ? { env: opts.env } : {},
       ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {}
-    }, proc = opts.cwdAuthority ? spawnPosixOwnedProcess(argv[0], argv.slice(1), spawnOptions, {
-      workingDirAuthority: opts.cwdAuthority
+    }, needsOwnedProcessHost = opts.cwdAuthority !== void 0 || (opts.launchPathAuthorities?.length ?? 0) > 0, proc = needsOwnedProcessHost ? spawnPosixOwnedProcess(argv[0], argv.slice(1), spawnOptions, {
+      workingDirAuthority: opts.cwdAuthority,
+      launchPathAuthorities: opts.launchPathAuthorities
     }) : (0, import_node_child_process7.spawn)(argv[0], argv.slice(1), spawnOptions);
-    return opts.cwdAuthority && Object.defineProperty(proc, "hostProcessTreeOwnership", {
+    return needsOwnedProcessHost && Object.defineProperty(proc, "hostProcessTreeOwnership", {
       value: "posix-host",
       configurable: !1,
       enumerable: !1,
@@ -49617,13 +49841,14 @@ async function resolveOnParentPath(cmd) {
   return null;
 }
 var SandboxExecHandle = class {
-  constructor(id, runner, profilePath, sanitizedEnv, workdir, workdirAuthority, auditDir = null) {
+  constructor(id, runner, profilePath, sanitizedEnv, workdir, workdirAuthority, scratchAuthority, auditDir = null) {
     this.id = id;
     this.runner = runner;
     this.profilePath = profilePath;
     this.sanitizedEnv = sanitizedEnv;
     this.workdir = workdir;
     this.workdirAuthority = workdirAuthority;
+    this.scratchAuthority = scratchAuthority;
     this.auditDir = auditDir;
     this.egressFidelity = "coarse";
     this.tornDown = !1;
@@ -49659,13 +49884,18 @@ var SandboxExecHandle = class {
 ; exec-time agent-binary read allowance (argv0 resolution, 2026-07-03)
 ${allowLines}
 `
+    ), this.scratchAuthority && await assertWorkspaceRootAuthority(
+      this.scratchAuthority.canonicalPath,
+      this.scratchAuthority,
+      "sandbox-exec Claude scratch handoff"
     );
     let sbArgv = ["sandbox-exec", "-f", this.profilePath, resolvedArgv0, ...argv.slice(1)], proc = this.runner.spawnLong(sbArgv, {
       stdinTty: opts.stdinTty,
       signal: opts.signal,
       env: this.sanitizedEnv,
       cwd: this.workdir,
-      ...this.workdirAuthority ? { cwdAuthority: this.workdirAuthority } : {}
+      ...this.workdirAuthority ? { cwdAuthority: this.workdirAuthority } : {},
+      ...this.scratchAuthority ? { launchPathAuthorities: [this.scratchAuthority] } : {}
     });
     return this.proc = proc, proc;
   }
@@ -49723,6 +49953,22 @@ ${allowLines}
       }
       extraWriteDirs.push(configDir);
     }
+    if (spec.agentScratch) {
+      try {
+        await assertWorkspaceRootAuthority(
+          spec.agentScratch.hostDir,
+          spec.agentScratch.authority,
+          "sandbox-exec Claude scratch launch"
+        );
+      } catch (error) {
+        throw new SubstrateLaunchError(
+          "sandbox_exec",
+          "Claude scratch grant target identity could not be verified (fail-closed)",
+          error
+        );
+      }
+      extraWriteDirs.push(spec.agentScratch.authority.canonicalPath);
+    }
     let resolvedAuditDir = null;
     if (spec.auditDir) {
       resolvedAuditDir = spec.auditDir;
@@ -49763,6 +50009,17 @@ ${allowLines}
         throw await import_node_fs23.promises.rm(profilePath, { force: !0 }).catch(() => {
         }), err;
       }
+    if (spec.agentScratch)
+      try {
+        await assertWorkspaceRootAuthority(
+          spec.agentScratch.authority.canonicalPath,
+          spec.agentScratch.authority,
+          "sandbox-exec Claude scratch profile handoff"
+        );
+      } catch (err) {
+        throw await import_node_fs23.promises.rm(profilePath, { force: !0 }).catch(() => {
+        }), err;
+      }
     return new SandboxExecHandle(
       id,
       this.runner,
@@ -49770,6 +50027,7 @@ ${allowLines}
       finalEnv,
       canonicalWorkdir,
       spec.workdirAuthority,
+      spec.agentScratch?.authority,
       resolvedAuditDir
     );
   }
@@ -50396,13 +50654,13 @@ function formatReviewerError(detail) {
     case "timeout":
       return `${detail.agent} reviewer timed out after ${detail.elapsed_ms}ms`;
     case "spawn_failed":
-      return `${detail.agent} reviewer spawn failed: ${detail.reason}`;
+      return `${detail.agent} reviewer spawn failed`;
     case "parse_failure":
       return `${detail.agent} reviewer output was unparseable`;
     case "cancelled":
       return "reviewer cancelled before completion";
     case "internal_join_failure":
-      return `reviewer task internal join failure: ${detail.reason}`;
+      return "reviewer task internal join failure";
   }
 }
 
@@ -50944,22 +51202,25 @@ var CONTINUATION_EXPIRES_TTL_MS = 1440 * 60 * 1e3, ACTIVE_AGENT_KINDS = ["CLAUDE
 function isActiveAgentKind2(agent) {
   return agent === "CLAUDE" || agent === "CODEX" || agent === "ANTIGRAVITY";
 }
-var IMPLEMENTOR_TICK_MS = 1e4, TICK_SCAN_MAX_TRACKED = 5e3, TICK_SCAN_TIMEOUT_MS = 1e3, BACKGROUND_RECOVERY_ABORTED = /* @__PURE__ */ Symbol("background-recovery-aborted"), REVIEWER_ERROR_LOG_RAW_OUTPUT_CAP = 4e3;
+var IMPLEMENTOR_TICK_MS = 1e4, TICK_SCAN_MAX_TRACKED = 5e3, TICK_SCAN_TIMEOUT_MS = 1e3, BACKGROUND_RECOVERY_ABORTED = /* @__PURE__ */ Symbol("background-recovery-aborted");
 function describeReviewerErrorDetail(detail) {
   switch (detail.kind) {
     case "timeout":
       return { agent: detail.agent, elapsedMs: detail.elapsed_ms };
     case "spawn_failed":
-      return { agent: detail.agent, reason: detail.reason };
+      return {
+        agent: detail.agent,
+        reasonBytes: Buffer.byteLength(detail.reason ?? "", "utf8")
+      };
     case "parse_failure":
       return {
         agent: detail.agent,
-        rawOutput: detail.raw_output.slice(0, REVIEWER_ERROR_LOG_RAW_OUTPUT_CAP)
+        rawOutputShape: outputShapeOnly(detail.raw_output)
       };
     case "cancelled":
       return {};
     case "internal_join_failure":
-      return { reason: detail.reason };
+      return { reasonBytes: Buffer.byteLength(detail.reason ?? "", "utf8") };
   }
 }
 var REVIEWER_AGENT_DISPLAY_NAME = {
@@ -53273,8 +53534,8 @@ var QuorumLoop = class _QuorumLoop {
               taskId: args.taskId,
               trackIndex: args.validateDiffScope.trackIndex,
               exitCode: exit.exitCode,
-              stderrExcerpt: handle.stderr().slice(0, 800),
-              stdoutTail: handle.stdout().slice(-3e3)
+              stderrShape: outputShapeOnly(handle.stderr()),
+              stdoutShape: outputShapeOnly(handle.stdout())
             }
           ), await this.reportTeamTrackFailure(
             args.taskId,
@@ -53296,8 +53557,8 @@ var QuorumLoop = class _QuorumLoop {
             // exits 0 is still attributable from the log.
             exitCode: exit.exitCode,
             runtimeMs: exit.runtimeMs,
-            stdoutTail: handle.stdout().slice(-300),
-            stderrTail: handle.stderr().slice(-300)
+            stdoutShape: outputShapeOnly(handle.stdout()),
+            stderrShape: outputShapeOnly(handle.stderr())
           });
           try {
             let bundle = createSnapshotTrackBundle({
@@ -53374,8 +53635,8 @@ var QuorumLoop = class _QuorumLoop {
           exitCode: exit.exitCode,
           runtimeMs: exit.runtimeMs,
           ...files.length === 0 ? {
-            stdoutTail: handle.stdout().slice(-300),
-            stderrTail: handle.stderr().slice(-300)
+            stdoutShape: outputShapeOnly(handle.stdout()),
+            stderrShape: outputShapeOnly(handle.stderr())
           } : {}
         }), this.surfaceHalt(reason), await this.discardShadow(args.taskId);
       }
@@ -53390,15 +53651,20 @@ var QuorumLoop = class _QuorumLoop {
       }
       logger.warn("[QuorumLoop] implementor round failed", {
         gateId,
-        err: err.message
+        ...errorShapeOnly(err)
       });
       let reason = classifyImplementorRoundFailure(err);
-      this.surfaceHalt(`The task could not proceed \u2014 ${reason}.`), this.emitProgress(
-        { phase: "round_failed", round: args.roundNumber, reason, taskId: args.taskId },
-        originEpoch
-      );
+      this.surfaceHalt(`The task could not proceed \u2014 ${reason}.`);
       let reviseFeedbackId = args.reviseFeedbackId, preserveResetForRetry = submissionStarted && args.reviewScopeReset === !0 && reviseFeedbackId !== void 0 && this.reviewScopeResetTasks.has(args.taskId);
-      preserveResetForRetry && this.seenReviseFeedbackIds.delete(reviseFeedbackId), await this.discardShadow(args.taskId, void 0, {
+      this.emitProgress(
+        {
+          phase: "round_failed",
+          round: args.roundNumber,
+          reason,
+          ...preserveResetForRetry ? {} : { taskId: args.taskId }
+        },
+        originEpoch
+      ), preserveResetForRetry && this.seenReviseFeedbackIds.delete(reviseFeedbackId), await this.discardShadow(args.taskId, void 0, {
         preserveReviseContext: preserveResetForRetry
       });
     } finally {
@@ -54464,7 +54730,7 @@ var QuorumLoop = class _QuorumLoop {
       if (promptText === null) {
         logger.warn("[QuorumLoop] getReviewerPrompt exhausted \u2014 ESCALATE", {
           key,
-          err: lastErr?.message,
+          ...errorShapeOnly(lastErr),
           audit: "synthesized ESCALATE (#C1F-8): prompt_fetch_failed"
         }), await this.submitVerdict(args, this.synthesizeEscalate(args, DESKTOP_DISPATCH_ESCALATE_REASONING), sessionKey);
         return;
@@ -54499,13 +54765,13 @@ var QuorumLoop = class _QuorumLoop {
             failureReason,
             audit: "synthesized ESCALATE (#C1F-8): reviewer_substrate_engage_failed",
             ...describeReviewerErrorDetail(engageErr.detail),
-            message: engageErr.message
+            ...errorShapeOnly(engageErr)
           }), await this.submitVerdict(args, this.synthesizeEscalate(args, cleanReasoning), sessionKey);
           return;
         }
         throw engageErr;
       }
-      let verdict;
+      let verdict, evaluationError;
       try {
         verdict = await this.evaluateSeatWithTimeout(spec, args.gateId, seatSubstrate.handle);
       } catch (err) {
@@ -54533,7 +54799,7 @@ var QuorumLoop = class _QuorumLoop {
             // Audit prefix kept in LOGS only (#C1F-8) — never on the wire.
             audit: `synthesized ESCALATE (#C1F-8): reviewer_error:${err.detail.kind}`,
             ...describeReviewerErrorDetail(err.detail),
-            message: err.message,
+            ...errorShapeOnly(err),
             // 2026-08-22 (dogfood) — TIMEOUT DIAGNOSTICS, local log only.
             //
             // A live 5-minute reviewer timeout on a ONE-FILE deletion diff was
@@ -54550,16 +54816,51 @@ var QuorumLoop = class _QuorumLoop {
             ...this.describeReviewShapeForDiagnostics(args.gateId)
           }), verdict = this.synthesizeEscalate(args, cleanReasoning);
         } else
-          throw err;
-      } finally {
-        await seatSubstrate.teardown().catch(() => {
+          evaluationError = err;
+      }
+      let cleanupError;
+      try {
+        await seatSubstrate.teardown();
+      } catch (error) {
+        cleanupError = error, logger.warn("[QuorumLoop] reviewer substrate cleanup failed \u2014 forcing ESCALATE", {
+          key,
+          seatId: args.seatId,
+          role: args.role,
+          agentKind: args.agentKind,
+          ...errorShapeOnly(error),
+          audit: "synthesized ESCALATE: reviewer_substrate_cleanup_failed"
         });
       }
+      if (evaluationError !== void 0) {
+        let terminalError = cleanupError !== void 0 ? Object.assign(
+          new Error("reviewer evaluation failed and substrate cleanup also failed"),
+          { causes: [evaluationError, cleanupError] }
+        ) : Object.assign(
+          new Error("reviewer evaluation failed unexpectedly"),
+          { cause: evaluationError }
+        );
+        logger.warn("[QuorumLoop] unexpected reviewer evaluation failure \u2014 forcing ESCALATE", {
+          key,
+          seatId: args.seatId,
+          role: args.role,
+          agentKind: args.agentKind,
+          ...errorShapeOnly(terminalError),
+          audit: "synthesized ESCALATE: reviewer_evaluation_failed"
+        }), verdict = this.synthesizeEscalate(
+          args,
+          DESKTOP_DISPATCH_ESCALATE_REASONING
+        );
+      }
+      if (cleanupError !== void 0 && (verdict = this.synthesizeEscalate(
+        args,
+        DESKTOP_DISPATCH_ESCALATE_REASONING
+      )), verdict === void 0)
+        throw new Error("reviewer completed without a verdict");
       reviewScope !== null && (verdict = enforceReviewRoundScope(verdict, reviewScope)), await this.submitVerdict(args, verdict, sessionKey);
     } catch (err) {
       logger.warn("[QuorumLoop] spawnOneSeat failed \u2014 dropped", {
         key,
-        err: err.message
+        ...errorShapeOnly(err)
       });
     } finally {
       this.runningSeats.delete(key);
@@ -54652,19 +54953,18 @@ var QuorumLoop = class _QuorumLoop {
       if (e.name === REVIEWER_CREDENTIAL_MISSING)
         try {
           this.surfaceHalt(
-            `Reviewer (${seatLabel(args.agentKind, args.seatId)}) cannot start sandboxed: ${e.message}`
+            `Reviewer (${seatLabel(args.agentKind, args.seatId)}) cannot start sandboxed: the required provider credential is unavailable. Run \`codevibe vendor-key setup\`` + (args.agentKind === "codex" ? " (or `codevibe vendor-key import-codex` for a ChatGPT subscription)" : "") + ", or set CODEVIBE_SANDBOX_REVIEWERS=0 to opt out of reviewer sandboxing."
           );
         } catch {
         }
       throw new ReviewerErrorClass({
         kind: "spawn_failed",
         agent: args.agentKind,
-        reason: `CP-7: reviewer substrate engage failed for a Trusted agent \u2014 refusing the unsandboxed (ambient-cred) fallback (fail-closed): ${e.message}`,
+        reason: "CP-7: reviewer substrate engage failed for a Trusted agent \u2014 refusing the unsandboxed (ambient-cred) fallback (fail-closed)",
         failureReason: "spawn_failed"
       });
     }
-    return result.mode === "reduced_trust" ? (this.surfaceReviewerReducedTrust(args, result.reducedTrustReason), await result.teardown().catch(() => {
-    }), NO_TEARDOWN) : (result.reducedTrust && this.surfaceReviewerReducedTrust(
+    return result.mode === "reduced_trust" ? (this.surfaceReviewerReducedTrust(args, result.reducedTrustReason), await result.teardown(), NO_TEARDOWN) : (result.reducedTrust && this.surfaceReviewerReducedTrust(
       args,
       result.reducedTrustReason ?? "coarse egress (A5 sandbox-exec) \u2014 reviewer is sandboxed but loopback-only."
     ), {
@@ -54706,7 +55006,7 @@ var QuorumLoop = class _QuorumLoop {
         reason
       ), logger.warn("[QuorumLoop] reduced-trust badge surfaceHalt threw (badge is best-effort) \u2014 continuing", {
         seatId: args.seatId,
-        err: e.message
+        ...errorShapeOnly(e)
       });
     }
   }
@@ -54761,13 +55061,20 @@ var QuorumLoop = class _QuorumLoop {
         });
         if (result.mode === "substrate")
           return { mode: "substrate", handle: result.substrateHandle, teardown: () => result.teardown() };
-        await result.teardown().catch(() => {
-        });
+        try {
+          await result.teardown();
+        } catch (cleanupError) {
+          return logger.warn("[QuorumLoop] Wave B reduced-trust cleanup failed \u2014 refusing fallback", {
+            taskId,
+            agent,
+            ...errorShapeOnly(cleanupError)
+          }), { mode: "none" };
+        }
       } catch (e) {
         logger.warn("[QuorumLoop] Wave B substrate engage failed \u2014 falling through to trusted-container/none", {
           taskId,
           agent,
-          err: e.message
+          ...errorShapeOnly(e)
         });
       }
     return isTrustedContainerBoundary() ? { mode: "trusted_container", teardown: async () => {
@@ -54798,9 +55105,11 @@ var QuorumLoop = class _QuorumLoop {
         ...substrate !== void 0 ? { substrate } : {}
       });
       if (!outcome.exit_success)
-        throw new Error(
-          `class-2 resolver model call exited non-zero: ${outcome.stderr.trim().slice(0, 200)}`
-        );
+        throw logger.warn("[QuorumLoop] class-2 resolver model call exited non-zero", {
+          ownerTaskId: args.ownerTaskId,
+          stdoutShape: outputShapeOnly(outcome.stdout),
+          stderrShape: outputShapeOnly(outcome.stderr)
+        }), new Error("class-2 resolver model call exited non-zero");
       return outcome.stdout;
     };
     return {
@@ -54844,7 +55153,7 @@ var QuorumLoop = class _QuorumLoop {
         return { establishable: !0, via: "ladder_tier" };
     } catch (err) {
       logger.warn("[QuorumLoop] A1d resolver probe: ladder select failed \u2014 treating as no tier", {
-        err: err.message
+        ...errorShapeOnly(err)
       });
     }
     return (this.deps.resolverProbeDeps?.trustedContainer ?? isTrustedContainerBoundary)() ? { establishable: !0, via: "trusted_container" } : { establishable: !1 };
@@ -54975,8 +55284,8 @@ var QuorumLoop = class _QuorumLoop {
             taskId: tid,
             exitCode: exit.exitCode,
             runtimeMs: exit.runtimeMs,
-            stdoutTail: handle.stdout().slice(-2e3),
-            stderrExcerpt: handle.stderr().slice(0, 600)
+            stdoutShape: outputShapeOnly(handle.stdout()),
+            stderrShape: outputShapeOnly(handle.stderr())
           }), exit.failureClass !== null)
             throw new Error(`agentic resolver implementor failed: ${exit.failureClass}`);
         }
@@ -55039,6 +55348,7 @@ var QuorumLoop = class _QuorumLoop {
         });
         continue;
       }
+      let candidateError;
       try {
         let substrate = confinement.mode === "substrate" ? confinement.handle : void 0, spec = {
           seat_id: 0,
@@ -55061,14 +55371,27 @@ var QuorumLoop = class _QuorumLoop {
           ...pass ? {} : { reason: `final-tip Tier-2 verdict: ${verdict.verdict}` }
         };
       } catch (e) {
-        lastFailure = `final-tip Tier-2 reviewer error (${agent}): ${e.message}`, logger.warn("[QuorumLoop] final-tip Tier-2 candidate failed \u2014 trying next", {
+        candidateError = e, lastFailure = `final-tip Tier-2 reviewer ${agent} failed to produce a verdict`, logger.warn("[QuorumLoop] final-tip Tier-2 candidate failed \u2014 trying next", {
           ownerTaskId: args.ownerTaskId,
           agent,
-          err: e.message.slice(0, 300)
+          ...errorShapeOnly(e)
         });
       } finally {
-        await confinement.teardown().catch(() => {
-        });
+        try {
+          await confinement.teardown();
+        } catch (cleanupError) {
+          throw logger.warn("[QuorumLoop] final-tip Tier-2 substrate cleanup failed \u2014 failing closed", {
+            ownerTaskId: args.ownerTaskId,
+            agent,
+            ...errorShapeOnly(cleanupError)
+          }), candidateError !== void 0 ? Object.assign(
+            new Error("final-tip Tier-2 evaluation failed and substrate cleanup also failed"),
+            { causes: [candidateError, cleanupError] }
+          ) : Object.assign(
+            new Error("final-tip Tier-2 substrate cleanup failed"),
+            { cause: cleanupError }
+          );
+        }
       }
     }
     return {
@@ -65187,7 +65510,7 @@ function buildSanitizedBaseEnv(input) {
     let v = safeSource[key];
     typeof v == "string" && v.length > 0 && (env[key] = v);
   }
-  return input.provider === "anthropic" ? env.ANTHROPIC_BASE_URL = input.sandboxBrokerUrl : env.OPENAI_BASE_URL = `${input.sandboxBrokerUrl.replace(/\/+$/, "")}/v1`, input.provider === "anthropic" ? (env.CLAUDE_CONFIG_DIR = input.sandboxBootstrapDir, env.CLAUDE_CODE_TMPDIR = input.sandboxBootstrapDir) : env.CODEX_HOME = input.sandboxBootstrapDir, env;
+  return input.provider === "anthropic" ? env.ANTHROPIC_BASE_URL = input.sandboxBrokerUrl : env.OPENAI_BASE_URL = `${input.sandboxBrokerUrl.replace(/\/+$/, "")}/v1`, input.provider === "anthropic" ? (env.CLAUDE_CONFIG_DIR = input.sandboxBootstrapDir, env.CLAUDE_CODE_TMPDIR = input.claudeScratchDir ?? input.sandboxBootstrapDir) : env.CODEX_HOME = input.sandboxBootstrapDir, env;
 }
 var FORBIDDEN_KEY_PATTERNS = [
   /^ANTHROPIC_API_KEY$/i,
@@ -65313,16 +65636,36 @@ async function engageSubstrate(input) {
   try {
     ({ hostBrokerAddr } = await broker.start());
   } catch (e) {
-    throw await broker.stop().catch(() => {
-    }), new Error(
-      `CP-7: broker failed to start \u2014 refusing to launch the implementor (fail-closed): ${e.message}`
+    let primary = Object.assign(
+      new Error("CP-7: broker failed to start \u2014 refusing to launch the implementor (fail-closed)"),
+      { cause: e }
     );
+    try {
+      await broker.stop();
+    } catch (cleanupError) {
+      throw Object.assign(
+        new Error("CP-7: broker start failed and cleanup also failed"),
+        { causes: [primary, cleanupError] }
+      );
+    }
+    throw primary;
   }
   let initialTokenObj = broker.currentBrokerToken();
-  if (!initialTokenObj)
-    throw await broker.stop().catch(() => {
-    }), new Error("CP-7: broker minted no token \u2014 refusing to launch (fail-closed)");
-  let initialToken = initialTokenObj.value, sandboxBrokerUrl = selection.tier === "docker" ? `http://127.0.0.1:${RELAY_PORT}` : `http://${hostBrokerAddr}`, sandboxHome = selection.tier === "docker" ? CONTAINER_WORKDIR : input.workdir, sandboxBootstrapMount = selection.tier === "docker" ? SANDBOX_BOOTSTRAP_DIR : null, sandboxConfigMount = selection.tier === "docker" ? SANDBOX_AGENT_CONFIG_DIR : null, bootstrap, handle;
+  if (!initialTokenObj) {
+    let primary = new Error(
+      "CP-7: broker minted no token \u2014 refusing to launch (fail-closed)"
+    );
+    try {
+      await broker.stop();
+    } catch (cleanupError) {
+      throw Object.assign(
+        new Error("CP-7: broker minted no token and cleanup also failed"),
+        { causes: [primary, cleanupError] }
+      );
+    }
+    throw primary;
+  }
+  let initialToken = initialTokenObj.value, sandboxBrokerUrl = selection.tier === "docker" ? `http://127.0.0.1:${RELAY_PORT}` : `http://${hostBrokerAddr}`, sandboxHome = selection.tier === "docker" ? CONTAINER_WORKDIR : input.workdir, sandboxBootstrapMount = selection.tier === "docker" ? SANDBOX_BOOTSTRAP_DIR : null, sandboxConfigMount = selection.tier === "docker" ? SANDBOX_AGENT_CONFIG_DIR : null, bootstrap, handle, activeTeardown;
   try {
     bootstrap = await ApiKeyBootstrap.create({
       provider,
@@ -65333,6 +65676,7 @@ async function engageSubstrate(input) {
         sandboxConfigDir: sandboxConfigMount ?? SANDBOX_AGENT_CONFIG_DIR
       } : { sandboxDirEqualsHostDir: !0, configDirEqualsHostDir: !0 },
       hostRoot: input.bootstrapHostRoot,
+      ...selection.tier === "sandbox_exec" && provider === "anthropic" ? { claudeScratchHostRoot: input.claudeScratchHostRoot ?? "/tmp" } : {},
       // M-2 — fail closed if the bootstrap dir lands inside the agent's rw
       // workdir mount (the token would leak through it).
       workdir: input.workdir,
@@ -65344,11 +65688,12 @@ async function engageSubstrate(input) {
     ), agentConfigSpec = sandboxConfigMount !== null ? { hostDir: bootstrap.configHostDir, sandboxDir: sandboxConfigMount } : (
       // A5: sandbox fs == host fs → config path equals the host dir.
       { hostDir: bootstrap.configHostDir, sandboxDir: bootstrap.configHostDir }
-    ), sanitizedBase = buildSanitizedBaseEnv({
+    ), agentScratchSpec = bootstrap.claudeScratchSpec, sanitizedBase = buildSanitizedBaseEnv({
       provider,
       sandboxBrokerUrl,
       sandboxHome,
       sandboxBootstrapDir: agentConfigSpec.sandboxDir,
+      ...agentScratchSpec !== null ? { claudeScratchDir: agentScratchSpec.sandboxDir } : {},
       safeSource: input.localeSource
     });
     assertNoAmbientCreds(sanitizedBase);
@@ -65362,6 +65707,7 @@ async function engageSubstrate(input) {
       sanitizedEnv: finalEnv,
       agentBootstrap: agentBootstrapSpec,
       agentConfig: agentConfigSpec,
+      ...agentScratchSpec !== null ? { agentScratch: agentScratchSpec } : {},
       // CP-7 W3 — Stage-2 r1 HIGH. The resolved audit dir → A5 trailing deny.
       // Undefined when a test injects its own in-memory sink (no real tree).
       ...resolvedAuditDir !== null ? { auditDir: resolvedAuditDir } : {}
@@ -65370,12 +65716,30 @@ async function engageSubstrate(input) {
       `[CP-7] Substrate engaged (tier=${selection.tier}, egress=${handle.egressFidelity}) \u2014 agent is creditless, broker holds the key`,
       { taskId: input.taskId, agent: input.agentKind }
     );
-    let liveBootstrap = bootstrap, liveHandle = handle, liveBroker = broker, refreshTimer = null, teardown = async () => {
-      refreshTimer && (clearInterval(refreshTimer), refreshTimer = null), await liveHandle.teardown().catch(() => {
-      }), await liveBroker.stop().catch(() => {
-      }), await liveBootstrap.destroy().catch(() => {
-      });
-    }, launchId = `launch-${input.taskId}-${Date.now()}`, denialReason = liveHandle.egressFidelity === "strict" ? "structural_deny_network_none" : "coarse_loopback_only", postureRes;
+    let liveBootstrap = bootstrap, liveHandle = handle, liveBroker = broker, refreshTimer = null, teardownPromise, teardown = () => teardownPromise || (teardownPromise = (async () => {
+      refreshTimer && (clearInterval(refreshTimer), refreshTimer = null);
+      let failures = [];
+      for (let cleanup of [
+        () => liveHandle.teardown(),
+        () => liveBroker.stop(),
+        () => liveBootstrap.destroy()
+      ])
+        try {
+          await cleanup();
+        } catch (error) {
+          failures.push(error);
+        }
+      if (failures.length > 0)
+        throw logger.warn("[CP-7] substrate cleanup failed \u2014 task cannot pass", {
+          taskId: input.taskId,
+          failureCount: failures.length,
+          ...errorShapeOnly(failures[0])
+        }), failures.length === 1 ? failures[0] : Object.assign(new Error("CP-7 substrate cleanup failed"), {
+          causes: failures
+        });
+    })(), teardownPromise);
+    activeTeardown = teardown;
+    let launchId = `launch-${input.taskId}-${Date.now()}`, denialReason = liveHandle.egressFidelity === "strict" ? "structural_deny_network_none" : "coarse_loopback_only", postureRes;
     try {
       postureRes = await auditSink.emit("egress_denied", {
         destination: "*",
@@ -65384,13 +65748,16 @@ async function engageSubstrate(input) {
         caller_event_id: launchId
       });
     } catch (e) {
-      throw await teardown(), new Error(
-        `CP-7 W3: egress-posture audit emit THREW \u2014 refusing to launch the creditless agent (audit-before-effect fail-closed): ${e.message}`
+      throw Object.assign(
+        new Error(
+          "CP-7 W3: egress-posture audit emit failed \u2014 refusing to launch the creditless agent (audit-before-effect fail-closed)"
+        ),
+        { cause: e }
       );
     }
     if (!("ack" in postureRes))
-      throw await teardown(), new Error(
-        `CP-7 W3: egress-posture audit nack'd ("${postureRes.nack}") \u2014 refusing to launch the creditless agent (no durable egress posture \u2192 no agent).`
+      throw new Error(
+        "CP-7 W3: egress-posture audit was rejected \u2014 refusing to launch the creditless agent (no durable egress posture \u2192 no agent)"
       );
     let refreshIntervalMs = input.tokenRefreshIntervalMs ?? 600 * 1e3, inFlightRefresh = null, doRefreshOnce = async () => {
       if (!(typeof liveBroker.rotateBrokerToken == "function" && typeof liveBroker.commitBrokerTokenRotation == "function" && typeof liveBroker.rollbackBrokerTokenRotation == "function")) {
@@ -65403,10 +65770,23 @@ async function engageSubstrate(input) {
         try {
           await liveBootstrap.refresh(rotated.token.value), liveBroker.commitBrokerTokenRotation(rotated);
         } catch (e) {
-          throw liveBroker.rollbackBrokerTokenRotation(rotated), logger.warn(
+          liveBroker.rollbackBrokerTokenRotation(rotated), logger.warn(
             "[CP-7] broker-token refresh write FAILED \u2014 rolled back to the prior token and tearing down (fail-closed)",
-            { taskId: input.taskId, err: e.message }
-          ), await teardown(), e instanceof Error ? e : new Error(String(e));
+            { taskId: input.taskId, ...errorShapeOnly(e) }
+          );
+          let refreshFailure = Object.assign(
+            new Error("CP-7 broker-token refresh failed"),
+            { cause: e }
+          );
+          try {
+            await teardown();
+          } catch (cleanupError) {
+            throw Object.assign(
+              new Error("CP-7 broker-token refresh failed and cleanup also failed"),
+              { causes: [refreshFailure, cleanupError] }
+            );
+          }
+          throw refreshFailure;
         }
     }, doRefresh = async () => {
       let next = (inFlightRefresh ?? Promise.resolve()).catch(() => {
@@ -65433,10 +65813,32 @@ async function engageSubstrate(input) {
       teardown
     };
   } catch (e) {
-    throw await handle?.teardown().catch(() => {
-    }), await bootstrap?.destroy().catch(() => {
-    }), await broker.stop().catch(() => {
-    }), e instanceof Error ? e : new Error(String(e));
+    let primary = e instanceof Error ? e : new Error("CP-7 substrate launch failed"), cleanupFailures = [];
+    if (activeTeardown)
+      try {
+        await activeTeardown();
+      } catch (cleanupError) {
+        cleanupFailures.push(cleanupError);
+      }
+    else
+      for (let cleanup of [
+        ...handle ? [() => handle.teardown()] : [],
+        ...bootstrap ? [() => bootstrap.destroy()] : [],
+        () => broker.stop()
+      ])
+        try {
+          await cleanup();
+        } catch (cleanupError) {
+          cleanupFailures.push(cleanupError);
+        }
+    throw cleanupFailures.length > 0 ? (logger.warn("[CP-7] failed launch also failed cleanup", {
+      taskId: input.taskId,
+      failureCount: cleanupFailures.length,
+      ...errorShapeOnly(cleanupFailures[0])
+    }), Object.assign(
+      new Error("CP-7 substrate launch failed and cleanup also failed"),
+      { causes: [primary, ...cleanupFailures] }
+    )) : primary;
   }
 }
 var RESOLVER_AGENT_STATE_DIR_SEGMENTS = {