@quantiya/codevibe-core 2.0.76 → 2.0.77

package/dist/orchestration-shell/cli.js

@@ -749,10 +749,10 @@ ${yaml}---
 
 ${prose}`;
 }
-function getTaskDirectoryPath(taskId, homeDir = os38.homedir()) {
+function getTaskDirectoryPath(taskId, homeDir = os39.homedir()) {
   return path66.join(homeDir, ".codevibe", "tasks", taskId);
 }
-function getPacketFilePath(taskId, homeDir = os38.homedir()) {
+function getPacketFilePath(taskId, homeDir = os39.homedir()) {
   return path66.join(getTaskDirectoryPath(taskId, homeDir), "CONTINUATION.md");
 }
 async function atomicWritePacket(taskDir, finalPath, bytes, pid, ts, randHex) {
@@ -802,7 +802,7 @@ async function atomicWritePacket(taskDir, finalPath, bytes, pid, ts, randHex) {
     }
 }
 function createContinuationPacketWriter(deps) {
-  let perTaskMutex = /* @__PURE__ */ new Map(), homeDir = deps.homeDir ?? os38.homedir(), clock = deps.clock ?? Date.now, randomHex = deps.randomHex ?? defaultRandomHex, collector = deps.dirtyStateCollector ?? {
+  let perTaskMutex = /* @__PURE__ */ new Map(), homeDir = deps.homeDir ?? os39.homedir(), clock = deps.clock ?? Date.now, randomHex = deps.randomHex ?? defaultRandomHex, collector = deps.dirtyStateCollector ?? {
     collect: async () => collectRepoStates(deps.authority, [], {}).catch(() => [])
   }, getMutex = (taskId) => {
     let m = perTaskMutex.get(taskId);
@@ -871,10 +871,10 @@ function createContinuationPacketWriter(deps) {
     }
   };
 }
-var import_node_fs28, path66, os38, crypto26, import_json_freeze15, import_yaml, Mutex, WORK_NOT_ENUMERATED_SENTINEL, VERIFICATION_NOT_RECORDED_SENTINEL, init_packet_writer = __esm({
+var import_node_fs28, path66, os39, crypto26, import_json_freeze15, import_yaml, Mutex, WORK_NOT_ENUMERATED_SENTINEL, VERIFICATION_NOT_RECORDED_SENTINEL, init_packet_writer = __esm({
   "src/continuation/packet-writer.ts"() {
     "use strict";
-    import_node_fs28 = require("node:fs"), path66 = __toESM(require("node:path")), os38 = __toESM(require("node:os")), crypto26 = __toESM(require("node:crypto")), import_json_freeze15 = require("json-freeze"), import_yaml = require("yaml");
+    import_node_fs28 = require("node:fs"), path66 = __toESM(require("node:path")), os39 = __toESM(require("node:os")), crypto26 = __toESM(require("node:crypto")), import_json_freeze15 = require("json-freeze"), import_yaml = require("yaml");
     init_types();
     init_dirty_state_collector();
     Mutex = class {
@@ -943,7 +943,7 @@ var init_resolve_agent = __esm({
 
 // src/companion-mode/persist-preference.ts
 function resolveHome11() {
-  return (process.env.VITEST === "true" || process.env.NODE_ENV === "test") && process.env.CODEVIBE_HOME_OVERRIDE ? process.env.CODEVIBE_HOME_OVERRIDE : os51.homedir();
+  return (process.env.VITEST === "true" || process.env.NODE_ENV === "test") && process.env.CODEVIBE_HOME_OVERRIDE ? process.env.CODEVIBE_HOME_OVERRIDE : os52.homedir();
 }
 function companionPreferenceFilePath() {
   return path84.join(resolveHome11(), ".codevibe", "companion-preference.json");
@@ -991,10 +991,10 @@ async function persistCompanionPreference(pref) {
   } catch {
   }
 }
-var fs63, path84, os51, import_zod16, CompanionPreferenceSchema, init_persist_preference = __esm({
+var fs63, path84, os52, import_zod16, CompanionPreferenceSchema, init_persist_preference = __esm({
   "src/companion-mode/persist-preference.ts"() {
     "use strict";
-    fs63 = __toESM(require("fs/promises")), path84 = __toESM(require("path")), os51 = __toESM(require("os")), import_zod16 = require("zod");
+    fs63 = __toESM(require("fs/promises")), path84 = __toESM(require("path")), os52 = __toESM(require("os")), import_zod16 = require("zod");
     init_logger2();
     CompanionPreferenceSchema = import_zod16.z.object({
       lastAgent: import_zod16.z.union([
@@ -4319,15 +4319,15 @@ async function probeWorkspaceTreeFingerprint(workspaceRoot, options = {}) {
     ), fields = stdout.split("\0").filter((field2) => field2.length > 0), parts = [];
     for (let i = 0; i < fields.length; i++) {
       if (remaining() <= 0) return failed();
-      let xy = fields[i].slice(0, 2), relative22 = fields[i].slice(3);
+      let xy = fields[i].slice(0, 2), relative23 = fields[i].slice(3);
       /[RC]/.test(xy) && (i += 1);
       let stat13 = "absent";
       try {
-        let st = await fs10.lstat(path13.join(root, relative22));
+        let st = await fs10.lstat(path13.join(root, relative23));
         stat13 = `${st.size}:${st.mtimeMs}`;
       } catch {
       }
-      parts.push(`${xy}	${relative22}	${stat13}`);
+      parts.push(`${xy}	${relative23}	${stat13}`);
     }
     return remaining() <= 0 ? failed() : {
       kind: "fingerprint",
@@ -13151,10 +13151,10 @@ var DecisionAttemptReceiptStore = class _DecisionAttemptReceiptStore {
     }
   }
   async assertNoSymlinkComponents(target2) {
-    let relative22 = path22.relative(this.rootDir, target2);
-    if (relative22.startsWith("..") || path22.isAbsolute(relative22))
+    let relative23 = path22.relative(this.rootDir, target2);
+    if (relative23.startsWith("..") || path22.isAbsolute(relative23))
       throw new Error("DecisionAttemptReceiptStore: path escaped receipt root");
-    let components = relative22 ? relative22.split(path22.sep) : [], current = this.rootDir;
+    let components = relative23 ? relative23.split(path22.sep) : [], current = this.rootDir;
     for (let index = -1; index < components.length; index += 1) {
       index >= 0 && (current = path22.join(current, components[index]));
       try {
@@ -21244,9 +21244,9 @@ init_logger2();
 function truncate(s, max) {
   return max <= 0 ? "" : s.length <= max ? s : max === 1 ? "\u2026" : s.slice(0, max - 1) + "\u2026";
 }
-function formatProjectPath(projectPath, homedir40, maxCols) {
+function formatProjectPath(projectPath, homedir41, maxCols) {
   let p = projectPath ?? "";
-  if (homedir40 && (p === homedir40 || p.startsWith(homedir40 + "/")) && (p = "~" + p.slice(homedir40.length)), p.length > maxCols) {
+  if (homedir41 && (p === homedir41 || p.startsWith(homedir41 + "/")) && (p = "~" + p.slice(homedir41.length)), p.length > maxCols) {
     if (maxCols <= 0) return "";
     if (maxCols === 1) return "\u2026";
     p = "\u2026" + p.slice(p.length - (maxCols - 1));
@@ -21263,7 +21263,7 @@ function plannerBadge(kind, label) {
   return kind === "local_gemma_qat" ? { text: `${(label ?? "").trim() || "local model"} \xB7 local` } : kind === "local_unavailable" ? { text: `\u26A0 ${(label ?? "").trim() || "local model"} offline \u2014 NL disabled`, color: "yellow" } : kind === "hosted" ? { text: "Gemma \xB7 hosted" } : null;
 }
 function computeStatusLayout(args) {
-  let { tier, homedir: homedir40, columns, badge } = args, SEP = " \xB7 ", badgeText = badge ? truncate(badge.text, Math.max(0, columns - SEP.length - tier.length - 2)) : "", rightWidth = badgeText ? badgeText.length + 1 : 0, cwdMax = Math.max(0, columns - rightWidth - SEP.length - tier.length), cwd = formatProjectPath(args.cwd, homedir40, cwdMax), leftFull = cwd ? `${cwd}${SEP}${tier}` : tier;
+  let { tier, homedir: homedir41, columns, badge } = args, SEP = " \xB7 ", badgeText = badge ? truncate(badge.text, Math.max(0, columns - SEP.length - tier.length - 2)) : "", rightWidth = badgeText ? badgeText.length + 1 : 0, cwdMax = Math.max(0, columns - rightWidth - SEP.length - tier.length), cwd = formatProjectPath(args.cwd, homedir41, cwdMax), leftFull = cwd ? `${cwd}${SEP}${tier}` : tier;
   return { leftText: truncate(leftFull, Math.max(0, columns - rightWidth)), badgeText };
 }
 
@@ -21474,7 +21474,7 @@ async function clearRetiredPlannerCache(userId, cacheRoot = process.env.CODEVIBE
 }
 
 // src/orchestration-shell/index.ts
-var path78 = __toESM(require("path")), os47 = __toESM(require("os")), import_promises = require("node:fs/promises"), import_node_fs37 = require("node:fs"), import_node_child_process10 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
+var path78 = __toESM(require("path")), os48 = __toESM(require("os")), import_promises = require("node:fs/promises"), import_node_fs37 = require("node:fs"), import_node_child_process10 = require("node:child_process"), import_node_util3 = require("node:util"), import_node_async_hooks = require("node:async_hooks");
 
 // src/orchestration-shell/web/sanitize.ts
 function sanitizeForTerminal(input) {
@@ -32831,17 +32831,17 @@ function sniffImageMime(head) {
   return null;
 }
 var IMAGE_EXT_RE = /\.(png|jpe?g|gif|webp|bmp)$/i;
-function unescapeToken(raw, homedir40) {
+function unescapeToken(raw, homedir41) {
   let s = raw.trim(), wasQuoted = !1;
   if ((s.startsWith("'") && s.endsWith("'") || s.startsWith('"') && s.endsWith('"')) && (s = s.slice(1, -1), wasQuoted = !0), s.startsWith("file://"))
     try {
       return (0, import_node_url.fileURLToPath)(s);
     } catch {
     }
-  return wasQuoted || (s = s.replace(/\\(.)/g, "$1")), expandHome(s, homedir40);
+  return wasQuoted || (s = s.replace(/\\(.)/g, "$1")), expandHome(s, homedir41);
 }
-function expandHome(p, homedir40) {
-  return p === "~" ? homedir40 : p.startsWith("~/") ? path33.join(homedir40, p.slice(2)) : p;
+function expandHome(p, homedir41) {
+  return p === "~" ? homedir41 : p.startsWith("~/") ? path33.join(homedir41, p.slice(2)) : p;
 }
 function extractImagePathSpans(text2) {
   let spans = [], quoted = /'[^']*\.(?:png|jpe?g|gif|webp|bmp)'|"[^"]*\.(?:png|jpe?g|gif|webp|bmp)"/gi, m, masked = text2.split("");
@@ -34596,7 +34596,7 @@ function collapsedReducedTrustLine(actor) {
 }
 
 // src/orchestration-shell/quorum-loop.ts
-var path71 = __toESM(require("node:path")), os42 = __toESM(require("node:os")), nodeCrypto = __toESM(require("node:crypto")), import_uuid12 = require("uuid"), import_ulid4 = require("ulid");
+var path71 = __toESM(require("node:path")), os43 = __toESM(require("node:os")), nodeCrypto = __toESM(require("node:crypto")), import_uuid12 = require("uuid"), import_ulid4 = require("ulid");
 
 // src/audit-keys/index.ts
 var import_node_crypto26 = require("node:crypto");
@@ -36490,6 +36490,255 @@ function enforceNetwork(scope) {
 function redactSensitiveTokens(cmd) {
   return cmd.replace(/--token\s+[0-9a-fA-F]+/g, "--token [REDACTED]").replace(/mcp_servers\.codevibe_web\.args=\S+/g, "mcp_servers.codevibe_web.args=[REDACTED]");
 }
+function normalizeArgv(argv) {
+  if (!Array.isArray(argv)) return [];
+  let normalized = [];
+  for (let token4 of argv)
+    if (typeof token4 == "string")
+      if (token4.startsWith("--") && token4.includes("=")) {
+        let eqIdx = token4.indexOf("="), rawKey = token4.slice(0, eqIdx), val = token4.slice(eqIdx + 1), key = normalizeFlagName(rawKey);
+        normalized.push(key, val);
+      } else if (token4.startsWith("--"))
+        normalized.push(normalizeFlagName(token4));
+      else if (token4.startsWith("-s") && token4.length > 2) {
+        let val = token4[2] === "=" ? token4.slice(3) : token4.slice(2);
+        normalized.push("--sandbox", val);
+      } else if (token4 === "-s")
+        normalized.push("--sandbox");
+      else if (token4.startsWith("-c") && token4.length > 2 && !token4.startsWith("--")) {
+        let val = token4[2] === "=" ? token4.slice(3) : token4.slice(2);
+        normalized.push("-c", val);
+      } else
+        normalized.push(token4);
+  return normalized;
+}
+function normalizeFlagName(flag) {
+  return flag.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function parseToolRuleM8(rule) {
+  let trimmed = rule.trim();
+  if (trimmed.length === 0) return null;
+  let firstParen = trimmed.indexOf("("), lastParen = trimmed.lastIndexOf(")");
+  if (firstParen === -1 && lastParen === -1)
+    return /^[A-Za-z0-9_]+$/.test(trimmed) ? { toolName: trimmed } : null;
+  if (firstParen === -1 || lastParen <= firstParen || lastParen !== trimmed.length - 1)
+    return null;
+  let toolName = trimmed.substring(0, firstParen);
+  if (!/^[A-Za-z0-9_]+$/.test(toolName)) return null;
+  let rawContent = trimmed.substring(firstParen + 1, lastParen);
+  return { toolName, rawContent };
+}
+function vendorBu(e) {
+  let n = [];
+  for (let t of e) {
+    if (!t) continue;
+    let r = "", o = !1;
+    for (let s of t)
+      switch (s) {
+        case "(":
+          o = !0, r += s;
+          break;
+        case ")":
+          o = !1, r += s;
+          break;
+        case ",":
+          o ? r += s : (r.trim() && n.push(r.trim()), r = "");
+          break;
+        case " ":
+          o ? r += s : r.trim() && (n.push(r.trim()), r = "");
+          break;
+        default:
+          (r || s.trim()) && (r += s);
+      }
+    r.trim() && n.push(r.trim());
+  }
+  return n;
+}
+function parseAllowedToolsRules(value) {
+  let arr = Array.isArray(value) ? value : [value], rules = vendorBu(arr);
+  return rules.length > 0 ? rules : null;
+}
+var ADVISORY_FORBIDDEN_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "Bash",
+  "NotebookEditCell",
+  "KillShell"
+]), ADVISORY_PERMITTED_TOOLS = /* @__PURE__ */ new Set(["Read", "Grep", "Glob"]);
+function isStrictReadOnlyAdvisoryClaude(argv) {
+  if (!Array.isArray(argv) || argv.length === 0) return !1;
+  let norm = normalizeArgv(argv);
+  if (norm.length === 0) return !1;
+  let baseExe = path38.basename(norm[0] || "");
+  if (baseExe !== "claude" && baseExe !== "claude.exe" || norm.some(
+    (arg) => arg.startsWith("--dangerously") || arg.startsWith("--allow-dangerously") || arg === "--yolo" || arg === "--full-auto" || arg === "--approve-for-me" || arg === "--permission-mode" || arg.startsWith("--permission-mode=") || arg === "--plugin-dir" || arg.startsWith("--plugin-dir=") || arg === "--plugin-dir-no-mcp" || arg.startsWith("--plugin-dir-no-mcp=") || arg === "--plugin-url" || arg.startsWith("--plugin-url=") || arg === "--plugin" || arg.startsWith("--plugin=") || arg === "--plugins" || arg.startsWith("--plugins=") || arg === "--system-prompt" || arg.startsWith("--system-prompt=") || arg === "--append-system-prompt" || arg.startsWith("--append-system-prompt=") || arg === "--exec" || arg.startsWith("--exec=")
+  ) || norm.includes("--mcp-config") || norm.filter((a) => a === "--strict-mcp-config").length !== 1)
+    return !1;
+  let settingSourcesIndices = [];
+  for (let i = 0; i < norm.length; i++)
+    norm[i] === "--setting-sources" && settingSourcesIndices.push(i);
+  if (settingSourcesIndices.length !== 1)
+    return !1;
+  let ssIdx = settingSourcesIndices[0];
+  if (norm[ssIdx + 1] !== "user" || norm.filter((a) => a === "--tools").length !== 1 || norm.filter((a) => a === "--allowed-tools").length !== 1 || norm.filter((a) => a === "--settings").length !== 1) return !1;
+  let settingsIdx = norm.indexOf("--settings"), settingsRaw = norm[settingsIdx + 1];
+  if (!settingsRaw || !settingsRaw.startsWith("{")) return !1;
+  let settingsObj;
+  try {
+    settingsObj = JSON.parse(settingsRaw);
+  } catch {
+    return !1;
+  }
+  if (!settingsObj || typeof settingsObj != "object" || Array.isArray(settingsObj))
+    return !1;
+  let topKeys = Object.keys(settingsObj);
+  if (topKeys.length !== 1 || topKeys[0] !== "permissions")
+    return !1;
+  let permissionsObj = settingsObj.permissions;
+  if (!permissionsObj || typeof permissionsObj != "object" || Array.isArray(permissionsObj))
+    return !1;
+  for (let pk of Object.keys(permissionsObj))
+    if (pk !== "defaultMode" && pk !== "allow")
+      return !1;
+  if (permissionsObj.defaultMode !== "dontAsk" || !Array.isArray(permissionsObj.allow))
+    return !1;
+  let toolsIdx = norm.indexOf("--tools"), toolTokens = [];
+  for (let i = toolsIdx + 1; i < norm.length && !norm[i].startsWith("-"); i++)
+    toolTokens.push(norm[i]);
+  if (toolTokens.length === 0) return !1;
+  let firstTool = toolTokens[0], allowedToolsIdx = norm.indexOf("--allowed-tools");
+  if (allowedToolsIdx === -1) return !1;
+  let allowedToolsTokens = [];
+  for (let i = allowedToolsIdx + 1; i < norm.length && !norm[i].startsWith("-"); i++)
+    allowedToolsTokens.push(norm[i]);
+  if (firstTool === "")
+    return !(toolTokens.length !== 1 || allowedToolsTokens.length !== 1 || allowedToolsTokens[0] !== "" || permissionsObj.allow.length !== 0);
+  let allToolNames = toolTokens.flatMap((t) => t.split(/[\s,]+/)).map((t) => t.trim()).filter(Boolean);
+  if (allToolNames.length === 0) return !1;
+  for (let t of allToolNames)
+    if (!ADVISORY_PERMITTED_TOOLS.has(t) || ADVISORY_FORBIDDEN_TOOLS.has(t)) return !1;
+  if (allowedToolsTokens.length === 0) return !1;
+  let parsedAllowedRules = parseAllowedToolsRules(allowedToolsTokens);
+  if (!parsedAllowedRules || parsedAllowedRules.length === 0) return !1;
+  for (let rule of parsedAllowedRules) {
+    let parsed = parseToolRuleM8(rule);
+    if (!parsed || !ADVISORY_PERMITTED_TOOLS.has(parsed.toolName) || ADVISORY_FORBIDDEN_TOOLS.has(parsed.toolName) || parsed.rawContent === void 0) return !1;
+    let p = parsed.rawContent;
+    if (p === "/*" || p === "*" || !p.startsWith("//") || p === "//" || p === "//*" || p === "//**" || /[\r\n\0]/.test(p)) return !1;
+  }
+  if (permissionsObj.allow.length === 0) return !1;
+  for (let rule of permissionsObj.allow) {
+    if (typeof rule != "string") return !1;
+    let parsed = parseToolRuleM8(rule);
+    if (!parsed || !ADVISORY_PERMITTED_TOOLS.has(parsed.toolName) || ADVISORY_FORBIDDEN_TOOLS.has(parsed.toolName) || parsed.rawContent === void 0) return !1;
+    let p = parsed.rawContent;
+    if (p === "/*" || p === "*" || !p.startsWith("//") || p === "//" || p === "//*" || p === "//**" || /[\r\n\0]/.test(p)) return !1;
+  }
+  return !0;
+}
+var CODEX_LONG_OPTIONS_WITH_VALUE = /* @__PURE__ */ new Set([
+  "config",
+  "enable",
+  "disable",
+  "image",
+  "model",
+  "local-provider",
+  "profile",
+  "sandbox",
+  "cd",
+  "add-dir",
+  "thread-source",
+  "cyber-access-program",
+  "output-schema",
+  "color",
+  "output-last-message"
+]), CODEX_SHORT_OPTIONS_WITH_VALUE = /* @__PURE__ */ new Set([
+  "c",
+  "i",
+  "m",
+  "p",
+  "s",
+  "C",
+  "o"
+]);
+function extractConfigKey(cfg) {
+  let s = (cfg || "").trim();
+  s = s.replace(/^['"]|['"]$/g, "").trim(), s = s.replace(/^=+/, "").trim(), s = s.replace(/^['"]|['"]$/g, "").trim();
+  let eqIdx = s.indexOf("=");
+  return (eqIdx !== -1 ? s.slice(0, eqIdx) : s).replace(/^['"]|['"]$/g, "").trim().toLowerCase();
+}
+function isProtectedCodexConfigKey(key) {
+  return key.startsWith("sandbox") || key.includes("sandbox") || key.startsWith("permissions") || key.includes("permission") || key.startsWith("shell_environment_policy") || key.includes("shell_environment") || key.startsWith("approval_policy") || key.includes("approval");
+}
+function isStrictReadOnlyAdvisoryCodex(argv) {
+  if (!Array.isArray(argv) || argv.length === 0) return !1;
+  let baseExe = path38.basename(argv[0] || "");
+  if (baseExe !== "codex" && baseExe !== "codex.exe" || argv.some(
+    (arg) => typeof arg == "string" && (arg.includes("workspace-write") || arg.includes("danger-full-access"))
+  ))
+    return !1;
+  let delimiterFound = !1, waitingForOption = null, structuredOptions = [], positionalBeforeDelimiter = [], positionalAfterDelimiter = [];
+  for (let i = 1; i < argv.length; i++) {
+    let rawToken = argv[i];
+    if (typeof rawToken == "string") {
+      if (delimiterFound) {
+        positionalAfterDelimiter.push(rawToken);
+        continue;
+      }
+      if (waitingForOption !== null) {
+        waitingForOption.value = rawToken, waitingForOption = null;
+        continue;
+      }
+      if (rawToken === "--") {
+        delimiterFound = !0;
+        continue;
+      }
+      if (rawToken.startsWith("--"))
+        if (rawToken.includes("=")) {
+          let eqIdx = rawToken.indexOf("="), flagName = normalizeFlagName(rawToken.slice(0, eqIdx)), flagVal = rawToken.slice(eqIdx + 1);
+          structuredOptions.push({ name: flagName, value: flagVal });
+        } else {
+          let flagName = normalizeFlagName(rawToken), bareName = flagName.slice(2), optObj = { name: flagName };
+          structuredOptions.push(optObj), CODEX_LONG_OPTIONS_WITH_VALUE.has(bareName) && (waitingForOption = optObj);
+        }
+      else if (rawToken.startsWith("-") && rawToken.length > 1) {
+        let optChar = rawToken[1];
+        if (CODEX_SHORT_OPTIONS_WITH_VALUE.has(optChar)) {
+          let normOpt = optChar === "s" ? "--sandbox" : optChar === "c" ? "-c" : optChar === "C" ? "-C" : optChar === "m" ? "-m" : optChar === "o" ? "-o" : optChar === "i" ? "-i" : optChar === "p" ? "-p" : `-${optChar}`;
+          if (rawToken.length > 2) {
+            let val = rawToken[2] === "=" ? rawToken.slice(3) : rawToken.slice(2);
+            structuredOptions.push({ name: normOpt, value: val });
+          } else {
+            let optObj = { name: normOpt };
+            structuredOptions.push(optObj), waitingForOption = optObj;
+          }
+        } else
+          structuredOptions.push({ name: rawToken });
+      } else
+        positionalBeforeDelimiter.push(rawToken);
+    }
+  }
+  let isBypassFlag = (s) => s.startsWith("--dangerously") || s === "--yolo" || s === "--full-auto" || s === "--approve-for-me" || s === "--add-dir" || s === "-a" || s === "--ask-for-approval";
+  if (structuredOptions.some((opt) => isBypassFlag(opt.name)) || positionalBeforeDelimiter.some(isBypassFlag) || positionalAfterDelimiter.some(isBypassFlag) || positionalBeforeDelimiter.length > 0 && positionalBeforeDelimiter[0] !== "exec")
+    return !1;
+  for (let opt of structuredOptions) {
+    if (opt.name === "-c" || opt.name === "--config") {
+      let cfgVal = opt.value || "", cfgKey = extractConfigKey(cfgVal);
+      if (isProtectedCodexConfigKey(cfgKey))
+        return !1;
+    }
+    if (opt.name === "--enable" || opt.name === "--disable") {
+      let featVal = (opt.value || "").toLowerCase();
+      if (isProtectedCodexConfigKey(featVal))
+        return !1;
+    }
+  }
+  let sandboxOptions = structuredOptions.filter((opt) => opt.name === "--sandbox");
+  if (sandboxOptions.length === 0) return !1;
+  for (let sOpt of sandboxOptions)
+    if (sOpt.value !== "read-only") return !1;
+  return !0;
+}
 function enforceCommand(scope, argv) {
   for (let entry5 of scope.commandAllowlist) {
     let isTemplate = entry5.endsWith(" *"), containsSpace = entry5.includes(" ");
@@ -36518,6 +36767,96 @@ function enforceCommand(scope, argv) {
         let expectedSessionsDir = path38.join(os25.homedir(), ".codevibe", "sessions");
         return !!path38.resolve(remainder).startsWith(expectedSessionsDir + path38.sep);
       }
+      if (entry5.includes("--allowed-tools *")) {
+        if (argv.includes("--mcp-config") || !argv.includes("--strict-mcp-config") || argv.includes("--dangerously-skip-permissions"))
+          return !1;
+        let allowedToolsIndex = argv.indexOf("--allowed-tools");
+        if (allowedToolsIndex === -1 || allowedToolsIndex + 1 >= argv.length)
+          return !1;
+        let allowedToolsTokens = [];
+        for (let i2 = allowedToolsIndex + 1; i2 < argv.length && !argv[i2].startsWith("-"); i2++)
+          allowedToolsTokens.push(argv[i2]);
+        if (allowedToolsTokens.length === 0) return !1;
+        let parsedRules = parseAllowedToolsRules(allowedToolsTokens);
+        if (!parsedRules || parsedRules.length === 0)
+          return !1;
+        let parsedRuleSet = /* @__PURE__ */ new Set();
+        for (let rule of parsedRules) {
+          let parsed = parseToolRuleM8(rule);
+          if (!parsed || !ADVISORY_PERMITTED_TOOLS.has(parsed.toolName) || ADVISORY_FORBIDDEN_TOOLS.has(parsed.toolName) || parsed.rawContent === void 0)
+            return !1;
+          let pattern = parsed.rawContent;
+          if (pattern === "/*" || pattern === "*" || !pattern.startsWith("//") || pattern === "//" || pattern === "//*" || pattern === "//**" || /[\r\n\0]/.test(pattern))
+            return !1;
+          parsedRuleSet.add(rule);
+        }
+        let settingsTokenIdx = remainderTokens.indexOf("--settings");
+        if (settingsTokenIdx !== -1 && settingsTokenIdx + 1 < remainderTokens.length)
+          try {
+            let s = JSON.parse(remainderTokens[settingsTokenIdx + 1]);
+            if (Array.isArray(s?.permissions?.allow))
+              for (let rule of s.permissions.allow) {
+                if (typeof rule != "string") return !1;
+                let parsed = parseToolRuleM8(rule);
+                if (!parsed || !ADVISORY_PERMITTED_TOOLS.has(parsed.toolName) || ADVISORY_FORBIDDEN_TOOLS.has(parsed.toolName) || parsed.rawContent === void 0) return !1;
+                let pattern = parsed.rawContent;
+                if (pattern === "/*" || pattern === "*" || !pattern.startsWith("//") || pattern === "//" || pattern === "//*" || pattern === "//**" || /[\r\n\0]/.test(pattern)) return !1;
+              }
+          } catch {
+            return !1;
+          }
+        let seenStrictMcp = !1, seenSettings = !1, seenSettingSources = !1, i = 1;
+        for (; i < remainderTokens.length; ) {
+          let token4 = remainderTokens[i];
+          if (token4 === "--strict-mcp-config") {
+            if (seenStrictMcp) return !1;
+            seenStrictMcp = !0, i += 1;
+          } else if (token4 === "--setting-sources") {
+            if (seenSettingSources || i + 1 >= remainderTokens.length || remainderTokens[i + 1] !== "user") return !1;
+            seenSettingSources = !0, i += 2;
+          } else if (token4 === "--settings") {
+            if (seenSettings || i + 1 >= remainderTokens.length) return !1;
+            let settingsRaw = remainderTokens[i + 1];
+            if (!settingsRaw.startsWith("{"))
+              return !1;
+            let settingsObj;
+            try {
+              settingsObj = JSON.parse(settingsRaw);
+            } catch {
+              return !1;
+            }
+            if (!settingsObj || typeof settingsObj != "object" || Array.isArray(settingsObj))
+              return !1;
+            let topKeys = Object.keys(settingsObj);
+            if (topKeys.length !== 1 || topKeys[0] !== "permissions")
+              return !1;
+            let permissionsObj = settingsObj.permissions;
+            if (!permissionsObj || typeof permissionsObj != "object" || Array.isArray(permissionsObj))
+              return !1;
+            let permKeys = Object.keys(permissionsObj);
+            for (let pk of permKeys)
+              if (pk !== "defaultMode" && pk !== "allow")
+                return !1;
+            if (permissionsObj.defaultMode !== "dontAsk" || !Array.isArray(permissionsObj.allow))
+              return !1;
+            let allowList = permissionsObj.allow;
+            if (allowList.length !== parsedRuleSet.size)
+              return !1;
+            for (let r of allowList)
+              if (typeof r != "string" || !parsedRuleSet.has(r))
+                return !1;
+            seenSettings = !0, i += 2;
+          } else if (token4 === "--add-dir") {
+            if (i + 1 >= remainderTokens.length) return !1;
+            let addDirVal = remainderTokens[i + 1];
+            if (typeof addDirVal != "string" || addDirVal.length === 0 || addDirVal.startsWith("-"))
+              return !1;
+            i += 2;
+          } else
+            return !1;
+        }
+        return !(!seenStrictMcp || !seenSettings || !seenSettingSources);
+      }
       if (entry5.includes('mcp_servers.codevibe_web.command="node" *')) {
         if (remainderTokens.length !== 5 || remainderTokens[0] !== "-c" || !remainderTokens[1]?.startsWith("mcp_servers.codevibe_web.args=") || remainderTokens[2] !== "--output-last-message" || !remainderTokens[3] || remainderTokens[3].startsWith("-") || remainderTokens[4] !== "-")
           return !1;
@@ -37082,8 +37421,8 @@ async function readDirectoryBounded(dirPath, budget, label, relativePrefix = "",
         }
         if (value.type !== "entry" || typeof value.name != "string" || value.name.length === 0 || value.name === "." || value.name === ".." || value.name.includes("/") || value.name.includes("\\") || value.name.includes("\0") || !Number.isSafeInteger(value.kind))
           throw new Error(`${label} helper returned an invalid entry`);
-        let relative22 = relativePrefix ? path39.join(relativePrefix, value.name) : value.name;
-        consumeMetadataPath(budget, relative22, label);
+        let relative23 = relativePrefix ? path39.join(relativePrefix, value.name) : value.name;
+        consumeMetadataPath(budget, relative23, label);
         let stat13;
         if (opts.includeStats === !0) {
           let raw = value.stat;
@@ -38693,6 +39032,86 @@ function buildClaudeNoToolsPlanArgv() {
     capture: { kind: "stdout" }
   };
 }
+function escapeClaudePathGlob(p) {
+  return (process.platform === "win32" ? p.replace(/\\/g, "/") : p).replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/\*/g, "\\*").replace(/\?/g, "\\?");
+}
+function formatClaudePermissionPath(p) {
+  return p.startsWith("//") ? p : p.startsWith("/") ? "/" + p : p;
+}
+function buildClaudeReadOnlyAdvisoryPlanArgv(workdir, attachments) {
+  let rulesList = [], argv = ["claude", "--print", "--output-format", "json"], addDirs = [];
+  if (workdir) {
+    let resolvedWorkdir = import_node_path.default.resolve(workdir);
+    addDirs.push(resolvedWorkdir);
+    let realWorkdir = null;
+    try {
+      realWorkdir = (0, import_node_fs19.realpathSync)(resolvedWorkdir);
+    } catch {
+    }
+    let targetPatterns = /* @__PURE__ */ new Set(), escapedWorkdir = escapeClaudePathGlob(resolvedWorkdir);
+    if (targetPatterns.add(formatClaudePermissionPath(`${escapedWorkdir}/**`)), realWorkdir && realWorkdir !== resolvedWorkdir) {
+      let escapedRealWorkdir = escapeClaudePathGlob(realWorkdir);
+      targetPatterns.add(formatClaudePermissionPath(`${escapedRealWorkdir}/**`));
+    }
+    if (attachments && attachments.length > 0)
+      for (let att of attachments) {
+        let resolvedAtt = import_node_path.default.resolve(att), stat13 = null;
+        try {
+          stat13 = (0, import_node_fs19.statSync)(resolvedAtt);
+        } catch {
+        }
+        let isDir = !!stat13?.isDirectory(), escapedAtt = escapeClaudePathGlob(resolvedAtt);
+        isDir ? (targetPatterns.add(formatClaudePermissionPath(`${escapedAtt}/**`)), addDirs.push(resolvedAtt)) : targetPatterns.add(formatClaudePermissionPath(escapedAtt));
+        try {
+          let realAtt = (0, import_node_fs19.realpathSync)(resolvedAtt);
+          if (realAtt !== resolvedAtt) {
+            let escapedRealAtt = escapeClaudePathGlob(realAtt);
+            isDir ? targetPatterns.add(formatClaudePermissionPath(`${escapedRealAtt}/**`)) : targetPatterns.add(formatClaudePermissionPath(escapedRealAtt));
+          }
+        } catch {
+        }
+      }
+    let readRules = Array.from(targetPatterns).map((p) => `Read(${p})`), grepRules = Array.from(targetPatterns).map((p) => `Grep(${p})`), globRules = Array.from(targetPatterns).map((p) => `Glob(${p})`);
+    rulesList.push(...readRules, ...grepRules, ...globRules);
+  }
+  let hasRules = rulesList.length > 0, toolsValue = hasRules ? "Read,Grep,Glob" : "", allowedToolsValue = hasRules ? rulesList.join(",") : "";
+  if (hasRules) {
+    let parsedVendor = vendorBu([allowedToolsValue]);
+    if (parsedVendor.length !== rulesList.length)
+      throw new Error(
+        `Ambiguous Claude allowed-tools path serialization: vendor tokenizer split ${rulesList.length} rules into ${parsedVendor.length} tokens for path: ${workdir}`
+      );
+    for (let token4 of parsedVendor) {
+      let parsed = parseToolRuleM8(token4);
+      if (!parsed || parsed.rawContent === void 0)
+        throw new Error(
+          `Ambiguous Claude allowed-tools path serialization: vendor tokenizer produced bare tool rule '${token4}' for path: ${workdir}`
+        );
+    }
+  }
+  argv.push(
+    "--tools",
+    toolsValue,
+    "--allowed-tools",
+    allowedToolsValue,
+    "--settings",
+    JSON.stringify({
+      permissions: {
+        defaultMode: "dontAsk",
+        allow: rulesList
+      }
+    }),
+    "--setting-sources",
+    "user",
+    "--strict-mcp-config"
+  );
+  for (let d of addDirs)
+    argv.push("--add-dir", d);
+  return {
+    argv,
+    capture: { kind: "stdout" }
+  };
+}
 var AGY_MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.:/-]*$/;
 function resolveAgyModel(env = process.env) {
   let raw = env.CODEVIBE_AGY_MODEL;
@@ -38705,15 +39124,8 @@ function resolveAgyModel(env = process.env) {
 }
 var AGY_IMPLEMENTOR_PRINT_TIMEOUT = "3600s";
 function agyImplementorArgvPrefix(mode) {
-  let model = resolveAgyModel();
-  return [
-    "agy",
-    ...mode === "plan" ? ["--sandbox"] : ["--dangerously-skip-permissions"],
-    ...model !== null ? ["--model", model] : [],
-    "--print-timeout",
-    AGY_IMPLEMENTOR_PRINT_TIMEOUT,
-    "--add-dir"
-  ];
+  let model = resolveAgyModel(), argv = ["agy"];
+  return mode === "plan" ? argv.push("--mode", "plan", "--sandbox") : argv.push("--dangerously-skip-permissions"), model !== null && argv.push("--model", model), argv.push("--print-timeout", AGY_IMPLEMENTOR_PRINT_TIMEOUT, "--add-dir"), argv;
 }
 function agyImplementorAllowlistEntries() {
   return [
@@ -38961,6 +39373,8 @@ var IMPLEMENTOR_COMMAND_ALLOWLIST = [
   // is part of the fixed argv → mirrored here or the drift test fails.
   "claude --print --output-format json --allowed-tools Read,Grep,Glob",
   buildClaudeNoToolsPlanArgv().argv.join(" "),
+  buildClaudeReadOnlyAdvisoryPlanArgv().argv.join(" "),
+  "claude --print --output-format json --tools Read,Grep,Glob --allowed-tools *",
   "claude --print --bare --output-format json --allowed-tools Read,Grep,Glob --settings *",
   "claude --print --output-format json --allowed-tools Read,Grep,Glob,Edit,Write,Bash",
   // Agent web access allowlist templates (Phase 1 Claude Code)
@@ -39267,8 +39681,7 @@ var HookBridge = class {
 };
 
 // src/local-executor/local-executor-impl.ts
-var import_node_crypto34 = require("node:crypto"), syncFs = __toESM(require("node:fs"));
-var path60 = __toESM(require("node:path"));
+var import_node_crypto34 = require("node:crypto"), syncFs = __toESM(require("node:fs")), os37 = __toESM(require("node:os")), path60 = __toESM(require("node:path"));
 
 // src/local-executor/class-a-emit.ts
 var import_node_fs20 = require("node:fs"), import_ulid3 = require("ulid");
@@ -39497,17 +39910,17 @@ function pick(obj, camel, snake) {
 }
 function normalizeTrackAssignedWire(raw) {
   if (!raw || typeof raw != "object") return {};
-  let o = raw, osRaw = pick(o, "ownershipScope", "ownership_scope"), os52 = osRaw && typeof osRaw == "object" ? osRaw : {}, sharedContracts = pick(os52, "sharedContracts", "shared_contracts"), ccRaw = pick(o, "conflictContext", "conflict_context"), conflictContext = ccRaw && typeof ccRaw == "object" ? normalizeConflictContext(ccRaw) : void 0;
+  let o = raw, osRaw = pick(o, "ownershipScope", "ownership_scope"), os53 = osRaw && typeof osRaw == "object" ? osRaw : {}, sharedContracts = pick(os53, "sharedContracts", "shared_contracts"), ccRaw = pick(o, "conflictContext", "conflict_context"), conflictContext = ccRaw && typeof ccRaw == "object" ? normalizeConflictContext(ccRaw) : void 0;
   return {
     task_group_id: pick(o, "taskGroupId", "task_group_id"),
     track_index: pick(o, "trackIndex", "track_index"),
     task_id: pick(o, "taskId", "task_id"),
     implementor_agent: upperAgentKind(pick(o, "implementorAgent", "implementor_agent")),
     ownership_scope: {
-      write_paths: pick(os52, "writePaths", "write_paths"),
+      write_paths: pick(os53, "writePaths", "write_paths"),
       shared_contracts: sharedContracts,
-      test_surfaces: pick(os52, "testSurfaces", "test_surfaces"),
-      auto_modified_files: pick(os52, "autoModifiedFiles", "auto_modified_files")
+      test_surfaces: pick(os53, "testSurfaces", "test_surfaces"),
+      auto_modified_files: pick(os53, "autoModifiedFiles", "auto_modified_files")
     },
     is_shared_test_owner: pick(o, "isSharedTestOwner", "is_shared_test_owner"),
     state_dir: pick(o, "stateDir", "state_dir"),
@@ -39613,8 +40026,8 @@ function isU32(value) {
 }
 function isValidTrackAssignedPayload(payload) {
   if (!payload || typeof payload != "object" || typeof payload.task_group_id != "string" || payload.task_group_id.length === 0 || typeof payload.task_id != "string" || payload.task_id.length === 0 || typeof payload.state_dir != "string" || payload.state_dir.length === 0 || typeof payload.dispatch_id != "string" || payload.dispatch_id.length === 0 || !isU32(payload.track_index) || !isU32(payload.dispatch_generation) || typeof payload.implementor_agent != "string" || !VALID_IMPLEMENTOR_AGENTS.has(payload.implementor_agent) || typeof payload.is_shared_test_owner != "boolean") return !1;
-  let os52 = payload.ownership_scope;
-  return !(!os52 || typeof os52 != "object" || !Array.isArray(os52.write_paths) || !Array.isArray(os52.auto_modified_files) || !Array.isArray(os52.shared_contracts) || !Array.isArray(os52.test_surfaces) || !os52.write_paths.every((p) => typeof p == "string") || !os52.auto_modified_files.every((p) => typeof p == "string") || !os52.test_surfaces.every((p) => typeof p == "string"));
+  let os53 = payload.ownership_scope;
+  return !(!os53 || typeof os53 != "object" || !Array.isArray(os53.write_paths) || !Array.isArray(os53.auto_modified_files) || !Array.isArray(os53.shared_contracts) || !Array.isArray(os53.test_surfaces) || !os53.write_paths.every((p) => typeof p == "string") || !os53.auto_modified_files.every((p) => typeof p == "string") || !os53.test_surfaces.every((p) => typeof p == "string"));
 }
 function isValidMergeGateDispatchPayload(payload) {
   if (!payload || typeof payload != "object" || typeof payload.task_group_id != "string" || payload.task_group_id.length === 0 || typeof payload.merge_gate_id != "string" || payload.merge_gate_id.length === 0 || typeof payload.dispatch_id != "string" || payload.dispatch_id.length === 0 || payload.integration_check_spec === void 0 || payload.integration_check_spec === null || !isU32(payload.owner_track_index) || !isU32(payload.dispatch_generation) || payload.decision_protocol_version !== void 0 && payload.decision_protocol_version !== 1 && payload.decision_protocol_version !== 2) return !1;
@@ -41567,9 +41980,9 @@ async function main(){
 main().catch(err=>{process.stderr.write(String(err&&err.stack?err.stack:err));process.exitCode=1;});
 `;
 function safeRelative(root, candidate) {
-  let relative22 = path45.relative(root, path45.resolve(candidate));
-  if (relative22.length === 0 || path45.isAbsolute(relative22) || relative22 === ".." || relative22.startsWith(`..${path45.sep}`) || relative22.includes("\0") || relative22.split(path45.sep).some((part) => part.length === 0 || part === "." || part === "..")) throw new Error("workspace materializer path escaped its root");
-  return relative22;
+  let relative23 = path45.relative(root, path45.resolve(candidate));
+  if (relative23.length === 0 || path45.isAbsolute(relative23) || relative23 === ".." || relative23.startsWith(`..${path45.sep}`) || relative23.includes("\0") || relative23.split(path45.sep).some((part) => part.length === 0 || part === "." || part === "..")) throw new Error("workspace materializer path escaped its root");
+  return relative23;
 }
 function createWorkspaceMaterializerSession(opts) {
   assertWorkspaceRootAuthoritySchema(opts.sourceRoot), assertWorkspaceRootAuthoritySchema(opts.destinationRoot);
@@ -44184,29 +44597,29 @@ async function sealSnapshotTreeDurably(snapshotRoot, snapshotRootAuthority, env)
       }
     );
     for (let entry5 of entries) {
-      let relative22 = current.relative ? path48.join(current.relative, entry5.name) : entry5.name, absolute = path48.join(snapshotRoot, relative22), stat13 = await fs39.lstat(absolute, { bigint: !0 });
+      let relative23 = current.relative ? path48.join(current.relative, entry5.name) : entry5.name, absolute = path48.join(snapshotRoot, relative23), stat13 = await fs39.lstat(absolute, { bigint: !0 });
       if (stat13.isDirectory() && !stat13.isSymbolicLink()) {
         let enumerated = boundedDirectoryStat(entry5);
         if (!enumerated || enumerated.dev !== stat13.dev.toString() || enumerated.ino !== stat13.ino.toString())
-          throw new Error(`snapshot directory changed after enumeration: ${relative22}`);
-        pending2.push({ absolute, relative: relative22, identity: enumerated });
+          throw new Error(`snapshot directory changed after enumeration: ${relative23}`);
+        pending2.push({ absolute, relative: relative23, identity: enumerated });
         continue;
       }
       if (stat13.isSymbolicLink())
         continue;
       if (!stat13.isFile())
-        throw new Error(`snapshot durability seal refuses special file: ${relative22}`);
+        throw new Error(`snapshot durability seal refuses special file: ${relative23}`);
       let handle = await fs39.open(absolute, import_node_fs23.constants.O_RDONLY | import_node_fs23.constants.O_NOFOLLOW);
       try {
         let before = await handle.stat({ bigint: !0 });
         if (!before.isFile() || before.dev !== stat13.dev || before.ino !== stat13.ino)
-          throw new Error(`snapshot file changed before durability sync: ${relative22}`);
+          throw new Error(`snapshot file changed before durability sync: ${relative23}`);
         await env.beforeSnapshotDurabilitySync?.("file", absolute), await handle.sync();
         let [after, live] = await Promise.all([
           handle.stat({ bigint: !0 }),
           fs39.lstat(absolute, { bigint: !0 })
         ]);
-        if (!after.isFile() || !live.isFile() || live.isSymbolicLink() || after.dev !== before.dev || after.ino !== before.ino || live.dev !== before.dev || live.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) throw new Error(`snapshot file changed during durability sync: ${relative22}`);
+        if (!after.isFile() || !live.isFile() || live.isSymbolicLink() || after.dev !== before.dev || after.ino !== before.ino || live.dev !== before.dev || live.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) throw new Error(`snapshot file changed during durability sync: ${relative23}`);
       } finally {
         await handle.close().catch(() => {
         });
@@ -44715,12 +45128,12 @@ function assertStateMarkerLifecycleCapacity(marker, maxBytes) {
   }, maxBytes);
 }
 async function retireFailedCreateStateMarker(stateFile, taskId, stateRootAuthority, maxBytes) {
-  let relative22 = path48.relative(stateRootAuthority.canonicalPath, stateFile), parts = relative22.split(path48.sep);
-  if (parts.length !== 2 || parts[0] !== taskId || path48.isAbsolute(relative22) || parts.some((part) => part === ".."))
+  let relative23 = path48.relative(stateRootAuthority.canonicalPath, stateFile), parts = relative23.split(path48.sep);
+  if (parts.length !== 2 || parts[0] !== taskId || path48.isAbsolute(relative23) || parts.some((part) => part === ".."))
     throw new Error("failed-create marker is outside its state-root authority");
   let read = await anchoredReadFileWithinRoot(
     stateRootAuthority.canonicalPath,
-    relative22,
+    relative23,
     {
       maxBytes,
       expectedRoot: stateRootAuthority,
@@ -55729,14 +56142,14 @@ var LocalExecutorImpl = class {
       deps.deviceSigningKey
     )), this.bridge = new HookBridge({
       emitter: this.emitter,
-      emitShellEvent: this.emitShellEvent,
+      emitShellEvent: this.emitShellEvent ?? (async () => ({ kind: "dropped", reason: "unwired" })),
       getAuthorityScope: () => this.baseScope,
       getCurrentTaskId: () => null,
       getContextWithoutTask: () => this.baseCtx,
       adapter: this.adapter
     }), this.classBConsumer = new ClassBConsumer({
       emitter: this.emitter,
-      emitShellEvent: this.emitShellEvent,
+      emitShellEvent: this.emitShellEvent ?? (async () => ({ kind: "dropped", reason: "unwired" })),
       getContext: () => this.contextOrFallback(),
       advanceAuthorityScope: (newScope, taskId) => {
         this.scopeByTask.set(taskId, mergeAuthorityScope(this.baseScope, newScope));
@@ -55946,7 +56359,56 @@ var LocalExecutorImpl = class {
         args: launchArgs,
         onExit,
         substrateEngaged
-      } = await this.engageSubstrateForSpawn(promptBoundArgs, spawnTaskScope), outerBoundaryConfines = substrateEngaged || isTrustedContainerBoundary(), finalArgs = {
+      } = await this.engageSubstrateForSpawn(promptBoundArgs, spawnTaskScope), outerBoundaryConfines = substrateEngaged || isTrustedContainerBoundary(), claudeIsolatedConfigDir = null, claudeSecureStorageConfigDir = null, cleanupClaudeConfig = null;
+      if ((launchArgs.agentKind ?? this.adapter) === "CLAUDE" && launchArgs.role === "implementor" && launchArgs.lifecycleAudit === "none" && isStrictReadOnlyAdvisoryClaude(launchArgs.argv) && !launchArgs.envOverrides?.CLAUDE_CONFIG_DIR && !outerBoundaryConfines) {
+        claudeIsolatedConfigDir = syncFs.mkdtempSync(
+          path60.join(os37.tmpdir(), `cv-claude-cfg-${process.pid}-${(0, import_node_crypto34.randomUUID)().slice(0, 8)}-`)
+        );
+        let ambientClaudeDir = process.env.CLAUDE_CONFIG_DIR || path60.join(os37.homedir(), ".claude");
+        claudeSecureStorageConfigDir = process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR !== void 0 ? process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR : process.env.CLAUDE_CONFIG_DIR !== void 0 ? process.env.CLAUDE_CONFIG_DIR : "";
+        try {
+          let authFiles = [".credentials.json", "credentials.json", "config.json", "auth.json"];
+          for (let f of authFiles) {
+            let src = path60.join(ambientClaudeDir, f);
+            if (syncFs.existsSync(src)) {
+              let dest = path60.join(claudeIsolatedConfigDir, f);
+              try {
+                syncFs.copyFileSync(src, dest), syncFs.chmodSync(dest, 384);
+              } catch (copyErr) {
+                throw new Error(
+                  `failed to copy Claude credential file ${f}: ${copyErr?.message}`
+                );
+              }
+            }
+          }
+          let settingsIdx = launchArgs.argv.indexOf("--settings"), settingsPayload = settingsIdx !== -1 && settingsIdx + 1 < launchArgs.argv.length ? launchArgs.argv[settingsIdx + 1] : "{}";
+          syncFs.writeFileSync(
+            path60.join(claudeIsolatedConfigDir, "settings.json"),
+            settingsPayload,
+            { mode: 384 }
+          );
+        } catch (setupErr) {
+          let cleanupErr = null;
+          try {
+            syncFs.rmSync(claudeIsolatedConfigDir, { recursive: !0, force: !0 }), syncFs.existsSync(claudeIsolatedConfigDir) && (cleanupErr = new Error(`setup cleanup failed: ${claudeIsolatedConfigDir} still exists`));
+          } catch (err) {
+            cleanupErr = err;
+          }
+          throw cleanupErr ? Object.assign(
+            new Error(
+              `ephemeral Claude config setup failed (${setupErr?.message}) and cleanup also failed (${cleanupErr?.message})`
+            ),
+            { cause: setupErr, cleanupCause: cleanupErr }
+          ) : setupErr;
+        }
+        cleanupClaudeConfig = async () => {
+          if (claudeIsolatedConfigDir && syncFs.existsSync(claudeIsolatedConfigDir) && (syncFs.rmSync(claudeIsolatedConfigDir, { recursive: !0, force: !0 }), syncFs.existsSync(claudeIsolatedConfigDir)))
+            throw new Error(
+              `failed to cleanup ephemeral Claude config directory: ${claudeIsolatedConfigDir} still exists`
+            );
+        };
+      }
+      let finalArgs = {
         ...launchArgs,
         argv: applyOuterBoundarySandbox(
           relocateCodexLastMessageForSubstrate(
@@ -55956,11 +56418,24 @@ var LocalExecutorImpl = class {
           ),
           launchArgs.agentKind ?? this.adapter,
           outerBoundaryConfines
-        )
-      }, spawnScope = outerBoundaryConfines ? withBoundaryConfinedCommandAuthority(spawnTaskScope) : spawnTaskScope, handle = await this.spawnWithLifecycle(
+        ),
+        ...claudeIsolatedConfigDir ? {
+          envOverrides: {
+            ...launchArgs.envOverrides,
+            CLAUDE_CONFIG_DIR: claudeIsolatedConfigDir,
+            ...claudeSecureStorageConfigDir !== null ? { CLAUDE_SECURESTORAGE_CONFIG_DIR: claudeSecureStorageConfigDir } : {}
+          }
+        } : {}
+      }, spawnScope = outerBoundaryConfines ? withBoundaryConfinedCommandAuthority(spawnTaskScope) : spawnTaskScope, combinedOnExit = async () => {
+        try {
+          cleanupClaudeConfig && await cleanupClaudeConfig();
+        } finally {
+          onExit && await onExit();
+        }
+      }, handle = await this.spawnWithLifecycle(
         finalArgs,
         (a) => spawnImplementor(spawnScope, a),
-        onExit
+        combinedOnExit
       );
       return advisoryAdmission && this.bindAdvisorySpawn(advisoryAdmission, handle), handle;
     } catch (error) {
@@ -56063,19 +56538,59 @@ var LocalExecutorImpl = class {
    * takes the legacy path.
    */
   async engageSubstrateForSpawn(args, scope) {
+    let agentKind = args.agentKind ?? this.adapter;
     if (args.role !== "implementor" || this.substrateEngager === void 0) {
-      if (args.requireConfined)
+      if (args.requireConfined) {
+        if (args.lifecycleAudit === "none") {
+          if (agentKind === "CLAUDE" && isStrictReadOnlyAdvisoryClaude(args.argv))
+            return { args, substrateEngaged: !1 };
+          if (agentKind === "CODEX" && isStrictReadOnlyAdvisoryCodex(args.argv))
+            return { args, substrateEngaged: !1 };
+        }
         throw new SpawnConfinementUnavailable(
           "requireConfined implementor spawn but no substrate engager is wired \u2014 fail closed"
         );
+      }
       return { args, substrateEngaged: !1 };
     }
-    let agentKind = args.agentKind ?? this.adapter;
     if (args.lifecycleAudit === "none") {
-      if (args.requireConfined)
+      if (agentKind === "ANTIGRAVITY") {
+        if (args.requireConfined) {
+          if (!this.substrateEngager)
+            throw new SpawnConfinementUnavailable(
+              "requireConfined advisory spawn for ANTIGRAVITY but no substrate engager is wired \u2014 fail closed"
+            );
+          let result2 = await this.substrateEngager({
+            taskId: args.taskId ?? "advisory",
+            agentKind,
+            workdir: args.workingDir,
+            role: args.role,
+            requireConfined: !0,
+            writableWorkdir: !1,
+            ...args.processTreeId ? { processTreeId: args.processTreeId } : {}
+          });
+          if (result2.mode === "substrate")
+            return {
+              args: { ...args, substrate: result2.substrateHandle },
+              onExit: () => result2.teardown(),
+              substrateEngaged: !0
+            };
+          throw await result2.teardown().catch(() => {
+          }), new SpawnConfinementUnavailable(
+            `requireConfined advisory spawn for ${agentKind} but substrate engaged reduced_trust (${result2.reducedTrustReason}) \u2014 fail closed`
+          );
+        }
+        return { args, substrateEngaged: !1 };
+      }
+      if (args.requireConfined) {
+        if (agentKind === "CLAUDE" && isStrictReadOnlyAdvisoryClaude(args.argv))
+          return { args, substrateEngaged: !1 };
+        if (agentKind === "CODEX" && isStrictReadOnlyAdvisoryCodex(args.argv))
+          return { args, substrateEngaged: !1 };
         throw new SpawnConfinementUnavailable(
-          "requireConfined implementor spawn cannot opt out of lifecycle audit/substrate \u2014 fail closed"
+          `requireConfined advisory spawn for ${agentKind} requires a strictly validated read-only invocation \u2014 fail closed`
         );
+      }
       return { args, substrateEngaged: !1 };
     }
     let effectiveTaskId = args.taskId ?? null;
@@ -58168,7 +58683,7 @@ var NO_OP_PASS = Object.freeze({
 });
 
 // src/local-executor/durable-store.ts
-var crypto24 = __toESM(require("node:crypto")), os37 = __toESM(require("node:os")), path64 = __toESM(require("node:path"));
+var crypto24 = __toESM(require("node:crypto")), os38 = __toESM(require("node:os")), path64 = __toESM(require("node:path"));
 init_logger2();
 var DIR_MODE8 = 448, FILE_MODE10 = 384, MAX_STORE_JSON_BYTES = 64 * 1024 * 1024, MAX_PREIMAGE_BYTES = MAX_REVIEW_FILE_BYTES, MAX_PREIMAGE_AGGREGATE_BYTES = MAX_PROMOTION_PREIMAGE_AGGREGATE_BYTES, REVERT_MANIFEST_VERSION = 1, ABSENT_PREIMAGE = "ABSENT", ORPHAN_TTL_MS = 2880 * 60 * 1e3, MANIFEST_FILE = "manifest.json", JOURNAL_FILE = "journal.json", PREIMAGE_DIR = "preimages", TRACK_TIPS_FILE = "track-tips.json", TRACK_TIPS_VERSION = 1, TRACK_BUNDLES_FILE = "track-bundles.json", TRACK_BUNDLES_VERSION = 1, OWNER_LEASE_RE = /^\.codevibe-owner-[0-9a-f]{64}\.json$/, STORE_HELPER_SOURCE_ENV = "CODEVIBE_STORE_HELPER_SOURCE_B64", STORE_HELPER_BOOTSTRAP = `const k=${JSON.stringify(STORE_HELPER_SOURCE_ENV)};const s=process.env[k];delete process.env[k];if(!s)throw new Error('missing store helper source');Function(Buffer.from(s,'base64').toString('utf8'))();`, STORE_HELPER_SOURCE = String.raw`
 const fs = require('node:fs');
@@ -58380,7 +58895,7 @@ function validateTrackBundlesRecord(value, taskGroupId, limits = {
   return value;
 }
 function defaultRoot4() {
-  return path64.join(os37.homedir(), ".codevibe", "revert-state");
+  return path64.join(os38.homedir(), ".codevibe", "revert-state");
 }
 function hashContent2(content) {
   return crypto24.createHash("sha256").update(Buffer.from(content, "utf8")).digest("hex");
@@ -58641,7 +59156,7 @@ var RevertManifestStore = class {
       if (!this.rootDirectoryPromise) {
         let creation = (async () => {
           let durable = await ensureDurableDirectoryTree(root, {
-            anchorPath: root === path64.resolve(os37.homedir()) || root.startsWith(`${path64.resolve(os37.homedir())}${path64.sep}`) ? path64.resolve(os37.homedir()) : path64.dirname(root),
+            anchorPath: root === path64.resolve(os38.homedir()) || root.startsWith(`${path64.resolve(os38.homedir())}${path64.sep}`) ? path64.resolve(os38.homedir()) : path64.dirname(root),
             mode: DIR_MODE8,
             enforceTargetMode: !0,
             helperTimeoutMs: this.helperTimeoutMs,
@@ -61636,7 +62151,7 @@ function withImplementorCredentialPreflight(engage, store) {
 }
 
 // src/substrate/docker.ts
-var import_node_fs30 = require("node:fs"), os39 = __toESM(require("node:os")), path67 = __toESM(require("node:path"));
+var import_node_fs30 = require("node:fs"), os40 = __toESM(require("node:os")), path67 = __toESM(require("node:path"));
 
 // src/substrate/command-runner.ts
 var import_node_child_process9 = require("node:child_process");
@@ -61939,7 +62454,7 @@ var DockerHandle = class {
   }
 }, DockerSubstrate = class {
   constructor(deps = {}) {
-    this.runner = deps.runner ?? new ChildProcessCommandRunner(), this.forwarderFactory = deps.forwarderFactory ?? defaultForwarderFactory, this.onEgressDenied = deps.onEgressDenied ?? NOOP_EGRESS_HOOK, this.image = deps.image ?? DEFAULT_IMAGE, this.sessionRoot = deps.sessionRoot ?? os39.tmpdir(), this.acquireWorkdirLease = deps.acquireWorkdirLease ?? acquireWorkspaceRootLease;
+    this.runner = deps.runner ?? new ChildProcessCommandRunner(), this.forwarderFactory = deps.forwarderFactory ?? defaultForwarderFactory, this.onEgressDenied = deps.onEgressDenied ?? NOOP_EGRESS_HOOK, this.image = deps.image ?? DEFAULT_IMAGE, this.sessionRoot = deps.sessionRoot ?? os40.tmpdir(), this.acquireWorkdirLease = deps.acquireWorkdirLease ?? acquireWorkspaceRootLease;
   }
   async launch(spec) {
     await this.assertDockerAvailable();
@@ -62070,7 +62585,7 @@ function randomId() {
 }
 
 // src/substrate/sandbox-exec.ts
-var import_node_fs31 = require("node:fs"), os40 = __toESM(require("node:os")), path68 = __toESM(require("node:path"));
+var import_node_fs31 = require("node:fs"), os41 = __toESM(require("node:os")), path68 = __toESM(require("node:path"));
 var import_node_path2 = require("node:path");
 var NODE_PREFIXES = ["/opt/homebrew", "/usr/local", "/opt/local"], FILE_KEYCHAIN_DIR_NAME = ".codevibe", SYSCTL_READ_ALLOW = [
   '(sysctl-name-prefix "hw.")',
@@ -62109,7 +62624,12 @@ function nodeReadDirs(execPath) {
   }
   return [...dirs];
 }
-function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDirs = [], homedir40 = os40.homedir(), auditDir = null, extraWriteDirs = [], networkPosture = "loopback") {
+function isInsideOrEqual2(child, parent) {
+  if (child === parent) return !0;
+  let rel = path68.relative(parent, child);
+  return rel.length > 0 && !rel.startsWith("..") && !path68.isAbsolute(rel);
+}
+function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDirs = [], homedir41 = os41.homedir(), auditDir = null, extraWriteDirs = [], networkPosture = "loopback", writableWorkdir = !0) {
   let esc = (s) => s.replace(/"/g, '\\"'), wd = esc(workdir), lines = [
     "(version 1)",
     "(deny default)",
@@ -62221,7 +62741,14 @@ function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDir
   for (let dir of extraWriteDirs) subpathReadGrants.push(dir);
   for (let dir of subpathReadGrants)
     lines.push(`(allow file-read* (subpath "${esc(dir)}"))`);
-  lines.push(`(allow file-write* (subpath "${wd}"))`);
+  if (!writableWorkdir) {
+    for (let dir of extraWriteDirs)
+      if (isInsideOrEqual2(dir, wd))
+        throw new Error(
+          `writable runtime grant "${dir}" is inside read-only workdir "${wd}" \u2014 conflicting boundary`
+        );
+  }
+  writableWorkdir && lines.push(`(allow file-write* (subpath "${wd}"))`);
   for (let dir of extraWriteDirs)
     lines.push(`(allow file-write* (subpath "${esc(dir)}"))`);
   let litReads = /* @__PURE__ */ new Set();
@@ -62233,11 +62760,11 @@ function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDir
     `(deny file-read* (subpath "${wd}/.git"))`,
     `(deny file-write* (subpath "${wd}/.git"))`
   );
-  let fileKeychainDir = esc(path68.join(homedir40, FILE_KEYCHAIN_DIR_NAME));
+  let fileKeychainDir = esc(path68.join(homedir41, FILE_KEYCHAIN_DIR_NAME));
   if (lines.push(
     `(deny file-read* (subpath "${fileKeychainDir}"))`,
     `(deny file-write* (subpath "${fileKeychainDir}"))`
-  ), auditDir !== null) {
+  ), writableWorkdir || lines.push(`(deny file-write* (subpath "${wd}"))`), auditDir !== null) {
     let ad = esc(auditDir);
     lines.push(
       `(deny file-read* (subpath "${ad}"))`,
@@ -62246,12 +62773,12 @@ function buildSeatbeltProfile(workdir, execPath = process.execPath, extraReadDir
   }
   return networkPosture === "open" ? lines.push(
     // A1d resolver-confinement row: deny all network, then re-allow ALL
-    // OUTBOUND (inbound stays denied). The broker-less reduced-trust agent
-    // (agy/gemini) dials its vendor directly with its own file-based auth —
-    // egress is NOT pinned on this row (the engage result badges it); the
-    // row's confinement objective is the FS-write fence above.
+    // OUTBOUND (external inbound stays denied). Loopback bind/inbound is permitted
+    // for local IPC (e.g. Antigravity local RPC daemon on 127.0.0.1).
     "(deny network*)",
     "(allow network-outbound)",
+    '(allow network-bind (local ip "localhost:*"))',
+    '(allow network-inbound (local ip "localhost:*"))',
     ""
   ) : lines.push(
     // Network: deny all, then re-allow loopback ONLY (the coarse tier).
@@ -62298,12 +62825,12 @@ var SandboxExecHandle = class {
         `agent binary '${argv[0]}' not found on the host PATH \u2014 cannot exec in the sandbox`
       );
     let realArgv0 = await import_node_fs31.promises.realpath(resolvedArgv0).catch(() => resolvedArgv0), deniedRoots = [
-      path68.join(os40.homedir(), ".codevibe"),
+      path68.join(os41.homedir(), ".codevibe"),
       path68.join(this.workdir, ".git"),
       ...this.auditDir !== null ? [this.auditDir] : []
     ], overlapsDeniedRoot = (d) => deniedRoots.some(
       (root) => d === root || d.startsWith(root + path68.sep) || root.startsWith(d + path68.sep)
-    ), broadRoots = /* @__PURE__ */ new Set(["/", "/Users", "/home", os40.homedir()]), binDirs = /* @__PURE__ */ new Set([path68.dirname(resolvedArgv0), path68.dirname(realArgv0)]);
+    ), broadRoots = /* @__PURE__ */ new Set(["/", "/Users", "/home", os41.homedir()]), binDirs = /* @__PURE__ */ new Set([path68.dirname(resolvedArgv0), path68.dirname(realArgv0)]);
     for (let d of binDirs)
       if (overlapsDeniedRoot(d) || broadRoots.has(d))
         throw new SubstrateLaunchError(
@@ -62350,7 +62877,7 @@ ${allowLines}
   }
 }, SandboxExecSubstrate = class {
   constructor(deps = {}) {
-    this.runner = deps.runner ?? new ChildProcessCommandRunner(), this.profileRoot = deps.profileRoot ?? os40.tmpdir(), this.platform = deps.platform ?? process.platform;
+    this.runner = deps.runner ?? new ChildProcessCommandRunner(), this.profileRoot = deps.profileRoot ?? os41.tmpdir(), this.platform = deps.platform ?? process.platform;
   }
   async launch(spec) {
     if (this.platform !== "darwin")
@@ -62416,12 +62943,13 @@ ${allowLines}
       canonicalWorkdir,
       process.execPath,
       extraReadDirs,
-      os40.homedir(),
+      os41.homedir(),
       resolvedAuditDir,
       extraWriteDirs,
       // A1d — the resolver-confinement row threads `'open'`; absent → loopback
       // (the CP-7 broker tier, byte-identical profile).
-      spec.networkPosture ?? "loopback"
+      spec.networkPosture ?? "loopback",
+      spec.writableWorkdir !== !1
     ), profilePath = path68.join(this.profileRoot, `codevibe-seatbelt-${id5}.sb`);
     try {
       await import_node_fs31.promises.writeFile(profilePath, profile, { encoding: "utf8", mode: 384 });
@@ -63102,7 +63630,7 @@ function formatReviewerError(detail) {
 }
 
 // src/reviewer/providers/codex.ts
-var fs51 = __toESM(require("fs")), os41 = __toESM(require("os")), path70 = __toESM(require("path")), import_uuid11 = require("uuid");
+var fs51 = __toESM(require("fs")), os42 = __toESM(require("os")), path70 = __toESM(require("path")), import_uuid11 = require("uuid");
 
 // src/reviewer/output-parser.ts
 var RESIDUAL_OBSERVATIONS_HEADING = "RESIDUAL OBSERVATIONS:";
@@ -63337,7 +63865,7 @@ function trimEnd(s) {
 var FAILURE_EVENT_TYPES = /* @__PURE__ */ new Set([
   "error",
   "turn.failed"
-]), USAGE_LIMIT_RE = /usage limit|purchase more credits|try again at|rate.?limit/i, AUTH_FAILED_RE = /unauthorized|not logged in|authenticat|invalid api key|\b401\b/i;
+]), USAGE_LIMIT_RE = /(?:usage|weekly|daily|monthly|rate).?limit|purchase more credits|try again at/i, AUTH_FAILED_RE = /unauthorized|not logged in|authenticat|invalid api key|\b401\b/i;
 function classifyFailureMessage(message2) {
   return USAGE_LIMIT_RE.test(message2) ? "usage_limit" : AUTH_FAILED_RE.test(message2) ? "auth_failed" : null;
 }
@@ -63612,7 +64140,7 @@ function extractCodexUsageSnapshot(stdout, elapsedMs) {
   }) : unavailableUsageSnapshot("usage_not_reported", elapsedMs);
 }
 function makeLastMessagePath() {
-  return path70.join(os41.tmpdir(), `quorum-codex-last-${process.pid}-${(0, import_uuid11.v4)()}.txt`);
+  return path70.join(os42.tmpdir(), `quorum-codex-last-${process.pid}-${(0, import_uuid11.v4)()}.txt`);
 }
 function makeLastMessageBasename() {
   return `quorum-codex-last-${process.pid}-${(0, import_uuid11.v4)()}.txt`;
@@ -63957,7 +64485,7 @@ function classifyImplementorQuotaFailure(exitCode, text2) {
 function defaultOutageNotificationRoot() {
   if (process.env.CODEVIBE_OUTAGE_NOTIFICATION_ROOT)
     return process.env.CODEVIBE_OUTAGE_NOTIFICATION_ROOT;
-  let baseHome = process.env.CODEVIBE_HOME_OVERRIDE || os42.homedir();
+  let baseHome = process.env.CODEVIBE_HOME_OVERRIDE || os43.homedir();
   return path71.join(baseHome, ".codevibe", "outage-notifications");
 }
 function cleanDirectorySafely(dir) {
@@ -69940,7 +70468,7 @@ ${section}`);
         oursCommit,
         theirsCommit,
         baseSha
-      }), parentDir = await import_node_fs32.promises.mkdtemp(path71.join(os42.tmpdir(), "codevibe-wb2-resolve-"));
+      }), parentDir = await import_node_fs32.promises.mkdtemp(path71.join(os43.tmpdir(), "codevibe-wb2-resolve-"));
       return resolveAgenticSlot({
         realRepoDir: this.deps.workingDir,
         // canonical loop workdir == repo root
@@ -75163,10 +75691,10 @@ function destructiveConfirmationQuestion(text2) {
 }
 
 // src/orchestration-shell/advisory-attachment-journal.ts
-var import_node_crypto37 = require("node:crypto"), os43 = __toESM(require("node:os")), path72 = __toESM(require("node:path")), import_node_fs33 = require("node:fs");
+var import_node_crypto37 = require("node:crypto"), os44 = __toESM(require("node:os")), path72 = __toESM(require("node:path")), import_node_fs33 = require("node:fs");
 var JOURNAL_DIR_NAME = "advisory-attachment-authority", JOURNAL_MAX_RECORD_BYTES = 32 * 1024, JOURNAL_MAX_ENTRIES = 1e4, JOURNAL_MAX_METADATA_BYTES = 16 * 1024 * 1024, BATCH_NAME_RE = /^batch-([0-9a-f]{64})\.json$/, ATTACHMENT_NAME_RE = /^attachment-([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\.json$/i, PROCESS_NAME_RE = /^process-([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\.json$/i, RETIREMENT_NAME_RE = /^\.codevibe-retire-([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/i, UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, SHA256_RE = /^[0-9a-f]{64}$/;
 function resolveHome10() {
-  return (process.env.VITEST === "true" || process.env.NODE_ENV === "test") && process.env.CODEVIBE_HOME_OVERRIDE ? process.env.CODEVIBE_HOME_OVERRIDE : os43.homedir();
+  return (process.env.VITEST === "true" || process.env.NODE_ENV === "test") && process.env.CODEVIBE_HOME_OVERRIDE ? process.env.CODEVIBE_HOME_OVERRIDE : os44.homedir();
 }
 function advisoryAttachmentJournalRoot(home = resolveHome10()) {
   return path72.join(home, ".codevibe", JOURNAL_DIR_NAME);
@@ -75353,8 +75881,8 @@ var AdvisoryAttachmentJournal = class {
       opts.anchorPath ?? (opts.rootDir ? path72.dirname(this.rootPath) : resolveHome10())
     ), this.currentOwner = opts.currentProcessIdentityFn ?? currentProcessIdentity, this.ownerIsAlive = opts.isProcessIdentityAliveFn ?? isProcessIdentityAlive, this.retryProcessOwner = opts.retryProcessCleanupOwnerFn ?? retryProcessCleanupOwner, this.mintId = opts.newId ?? import_node_crypto37.randomUUID, this.now = opts.now ?? Date.now, this.retirementSettleMs = opts.retirementSettleMs ?? 1e3, !Number.isSafeInteger(this.retirementSettleMs) || this.retirementSettleMs < 0 || this.retirementSettleMs > 1e4)
       throw new Error("invalid advisory attachment retirement settle window");
-    let relative22 = path72.relative(this.anchorPath, this.rootPath);
-    if (relative22 === ".." || relative22.startsWith(`..${path72.sep}`) || path72.isAbsolute(relative22))
+    let relative23 = path72.relative(this.anchorPath, this.rootPath);
+    if (relative23 === ".." || relative23.startsWith(`..${path72.sep}`) || path72.isAbsolute(relative23))
       throw new Error("advisory attachment journal root escaped its private anchor");
   }
   async openRoot(create) {
@@ -76158,7 +76686,7 @@ function classifyDurableWorkspaceOutcome(event, displayedSessionId, decryptedMet
 }
 
 // src/orchestration-shell/workspace-terminal-coordinator.ts
-var crypto29 = __toESM(require("node:crypto")), import_node_fs34 = require("node:fs"), os44 = __toESM(require("node:os")), path73 = __toESM(require("node:path"));
+var crypto29 = __toESM(require("node:crypto")), import_node_fs34 = require("node:fs"), os45 = __toESM(require("node:os")), path73 = __toESM(require("node:path"));
 init_logger2();
 
 // src/orchestration-shell/emit-shell-event.ts
@@ -76781,7 +77309,7 @@ var WorkspaceTerminalCoordinator = class {
     this.operationChain = Promise.resolve();
     if (!options.session.sessionGenerationId || !UUID_RE5.test(options.session.sessionGenerationId))
       throw new Error("WorkspaceTerminalCoordinator: session generation is unavailable");
-    this.session = options.session, this.appsyncClient = options.appsyncClient, this.getSessionKey = options.getSessionKey, this.rootDir = options.rootDir ?? path73.join(os44.homedir(), ".codevibe"), this.now = options.now ?? (() => /* @__PURE__ */ new Date()), this.onSyncIssue = options.onSyncIssue;
+    this.session = options.session, this.appsyncClient = options.appsyncClient, this.getSessionKey = options.getSessionKey, this.rootDir = options.rootDir ?? path73.join(os45.homedir(), ".codevibe"), this.now = options.now ?? (() => /* @__PURE__ */ new Date()), this.onSyncIssue = options.onSyncIssue;
   }
   generation() {
     return this.session.sessionGenerationId;
@@ -77343,7 +77871,7 @@ var WorkspaceTerminalCoordinator = class {
 };
 
 // src/orchestration-shell/decision-effect.ts
-var crypto30 = __toESM(require("node:crypto")), fs55 = __toESM(require("node:fs/promises")), import_node_fs35 = require("node:fs"), os45 = __toESM(require("node:os")), path74 = __toESM(require("node:path"));
+var crypto30 = __toESM(require("node:crypto")), fs55 = __toESM(require("node:fs/promises")), import_node_fs35 = require("node:fs"), os46 = __toESM(require("node:os")), path74 = __toESM(require("node:path"));
 var RECEIPT_VERSION = 1, DIRECTORY_MODE2 = 448, FILE_MODE11 = 384, MAX_RECEIPT_BYTES2 = 64 * 1024, MAX_SESSION_RECEIPTS2 = 64, KNOWN_DECISIONS2 = /* @__PURE__ */ new Set([
   "APPROVE",
   "CANCEL",
@@ -77358,7 +77886,7 @@ function opaque(value) {
   return crypto30.createHash("sha256").update(value, "utf8").digest("hex");
 }
 function defaultRoot5() {
-  return path74.join(os45.homedir(), ".codevibe", "decision-effects");
+  return path74.join(os46.homedir(), ".codevibe", "decision-effects");
 }
 function durableResolutionDescriptorHash(resolution) {
   return crypto30.createHash("sha256").update(JSON.stringify({
@@ -77400,10 +77928,10 @@ var DecisionEffectReceiptStore = class {
     return path74.join(this.rootDir, opaque(sessionId), `${opaque(decisionClaimId)}.json`);
   }
   async assertNoSymlinkComponents(target2) {
-    let relative22 = path74.relative(this.rootDir, target2);
-    if (relative22.startsWith("..") || path74.isAbsolute(relative22))
+    let relative23 = path74.relative(this.rootDir, target2);
+    if (relative23.startsWith("..") || path74.isAbsolute(relative23))
       throw new Error("DecisionEffectReceiptStore: path escaped root");
-    let components = relative22 ? relative22.split(path74.sep) : [], current = this.rootDir;
+    let components = relative23 ? relative23.split(path74.sep) : [], current = this.rootDir;
     for (let index = -1; index < components.length; index += 1) {
       index >= 0 && (current = path74.join(current, components[index]));
       try {
@@ -79448,7 +79976,7 @@ ${notFoundMsg}`), fallbackSection && sections.push(fallbackSection);
 }
 
 // src/continuation/packet-reader.ts
-var import_node_fs36 = require("node:fs"), path76 = __toESM(require("node:path")), os46 = __toESM(require("node:os")), import_yaml2 = require("yaml");
+var import_node_fs36 = require("node:fs"), path76 = __toESM(require("node:path")), os47 = __toESM(require("node:os")), import_yaml2 = require("yaml");
 init_types();
 init_packet_writer();
 init_packet_writer();
@@ -79519,7 +80047,7 @@ async function packetHashIsInAudit(appsync, packet, packetHash) {
   }
 }
 function createContinuationPacketReader(deps) {
-  let homeDir = deps.homeDir ?? os46.homedir();
+  let homeDir = deps.homeDir ?? os47.homedir();
   return {
     async read(taskId, expectedHash) {
       let filePath = getPacketFilePath(taskId, homeDir), stat13;
@@ -83982,12 +84510,11 @@ function readOnlyAgentPrompt(args) {
 `);
   return args.agent === "ANTIGRAVITY" && args.allowRepositoryTools ? `${agyReadOnlyWorkdirPreamble(args.workingDir)}${body}` : body;
 }
-function readOnlyAdvisoryAllowsRepositoryTools(input) {
-  let text2 = input.toLowerCase(), concreteRepositoryTarget = /\b(repo|repository|codebase|workspace|source tree|working tree|pending diff|diff|files?|folders?|directories|logs?|tests?)\b/.test(text2) || /(?:^|\s)(?:\.{1,2}\/|\/|~\/)/.test(text2) || /\b[a-z0-9_-]+\.(?:ts|tsx|js|jsx|swift|kt|java|rs|py|md|json|ya?ml|toml|gradle|xml)\b/i.test(input), inspectionIntent = /\b(read|inspect|check|look at|look into|review|summarize|analyze|investigate|scan|search|find|trace|debug)\b/.test(text2) || /\bpending diff\b/.test(text2) || /\brun tests?\b/.test(text2);
-  return concreteRepositoryTarget && inspectionIntent;
+function readOnlyAdvisoryAllowsRepositoryTools(_input) {
+  return !0;
 }
-function applyReadOnlyAdvisoryToolPolicy(agent, plan, allowRepositoryTools) {
-  return allowRepositoryTools || agent !== "CLAUDE" ? plan : buildClaudeNoToolsPlanArgv();
+function applyReadOnlyAdvisoryToolPolicy(agent, plan, allowRepositoryTools, workingDir, attachments) {
+  return agent !== "CLAUDE" ? plan : allowRepositoryTools ? buildClaudeReadOnlyAdvisoryPlanArgv(workingDir, attachments) : buildClaudeNoToolsPlanArgv();
 }
 async function readPlanModeOutput(args) {
   try {
@@ -84041,7 +84568,11 @@ function syntheticReadOnlyAdvisoryTaskId() {
   return (0, import_uuid15.v4)();
 }
 function classifyClaudeResultStdoutQuota(stdout) {
-  let result = firstResultEnvelope(stdout)?.result;
+  let env = firstResultEnvelope(stdout);
+  if (!env) return !1;
+  if (env.api_error === "usage_limit_reached" || env.api_error_status === 429 || typeof env.api_error == "string" && classifyFailureMessage(env.api_error) === "usage_limit")
+    return !0;
+  let result = env.result;
   return typeof result == "string" && result.length > 0 && classifyFailureMessage(result) === "usage_limit";
 }
 function extractReadOnlyAdvisoryUsage(args) {
@@ -84093,10 +84624,14 @@ async function runReadOnlyAgentAdvisoryResult(args) {
     args.attachmentBatch,
     args.workingDir
   ) : await attachmentJournal.assertWorkspaceSafe(args.workingDir);
-  let allowRepositoryTools = readOnlyAdvisoryAllowsRepositoryTools(args.advisoryBrief), plan = applyReadOnlyAdvisoryToolPolicy(
+  let allowRepositoryTools = readOnlyAdvisoryAllowsRepositoryTools(args.advisoryBrief), attachmentPaths = [];
+  args.attachmentBatch?.value.directory.canonicalPath && attachmentPaths.push(args.attachmentBatch.value.directory.canonicalPath);
+  let plan = applyReadOnlyAdvisoryToolPolicy(
     args.agent,
     buildImplementorArgv(args.agent, "plan", args.workingDir),
-    allowRepositoryTools
+    allowRepositoryTools,
+    args.workingDir,
+    attachmentPaths
   ), processAuthority = null, bindProcessOwner = args.attachmentBatch ? async (owner) => {
     if (processAuthority)
       throw new Error("advisory process authority was already bound");
@@ -84109,13 +84644,27 @@ async function runReadOnlyAgentAdvisoryResult(args) {
       throw new Error("advisory process retirement has no durable authority");
     let authority = processAuthority;
     await attachmentJournal.retireProcess(authority, owner), processAuthority = null;
-  } : void 0, advisoryTaskId = syntheticReadOnlyAdvisoryTaskId(), handle = await args.shellArgs.localExecutor.spawnImplementor({
+  } : void 0, advisoryTaskId = syntheticReadOnlyAdvisoryTaskId(), treeBefore = await probeWorkspaceTreeFingerprint(args.workingDir);
+  if (treeBefore.kind !== "fingerprint")
+    return logger.error("[orchestration-shell] workspace fingerprint unavailable before read-only advisory turn \u2014 failing closed", {
+      agent: args.agent,
+      workingDir: args.workingDir
+    }), plan.capture.kind === "file" && await (0, import_promises.unlink)(plan.capture.path).catch(() => {
+    }), {
+      ok: !1,
+      text: readOnlyRouteFallback({ agent: args.agent }),
+      quotaWalled: !1,
+      timedOut: !1,
+      usage: unavailableUsageSnapshot("workspace_verification_unavailable")
+    };
+  let handle = await args.shellArgs.localExecutor.spawnImplementor({
     argv: plan.argv,
     workingDir: args.workingDir,
     role: "implementor",
     agentKind: args.agent,
     taskId: advisoryTaskId,
     lifecycleAudit: "none",
+    requireConfined: !0,
     timeoutMs: args.timeoutMs ?? READ_ONLY_ADVISORY_TIMEOUT_MS,
     stdinTty: !0,
     stdinPayload: readOnlyAgentPrompt({
@@ -84128,7 +84677,24 @@ async function runReadOnlyAgentAdvisoryResult(args) {
     }),
     ...bindProcessOwner ? { onCleanupOwnerReady: bindProcessOwner } : {},
     ...retireProcessOwner ? { onCleanupOwnerRetired: retireProcessOwner } : {}
-  }), exit = await handle.done, output = await readPlanModeOutput({
+  }), exit = await handle.done, treeAfter = await probeWorkspaceTreeFingerprint(args.workingDir);
+  if (treeAfter.kind !== "fingerprint" || treeAfter.value !== treeBefore.value)
+    return logger.error("[orchestration-shell] workspace mutation or verification failure detected during read-only advisory turn", {
+      agent: args.agent,
+      workingDir: args.workingDir,
+      before: treeBefore.value,
+      after: treeAfter.kind === "fingerprint" ? treeAfter.value : "probe-failed"
+    }), plan.capture.kind === "file" && await (0, import_promises.unlink)(plan.capture.path).catch(() => {
+    }), {
+      ok: !1,
+      text: readOnlyRouteFallback({ agent: args.agent }),
+      quotaWalled: !1,
+      timedOut: !1,
+      usage: unavailableUsageSnapshot(
+        treeAfter.kind === "fingerprint" ? "workspace_mutation_detected" : "workspace_verification_unavailable"
+      )
+    };
+  let output = await readPlanModeOutput({
     agent: args.agent,
     plan,
     handle,
@@ -86243,21 +86809,21 @@ async function handleShellUserInput(deps) {
       store.getState().session.sessionId
     ), store.dispatch({ type: "CLEAR_PENDING_PLANNER_OFFER" });
   }
-  let pendingForIngest = store.getState().pendingClarification, isAnsweringPending = !!pendingForIngest && pendingForIngest.rounds.length > 0 && pendingForIngest.rounds[pendingForIngest.rounds.length - 1].answer === void 0, existingAttachments = !slashCommandText.startsWith("/") && isAnsweringPending ? pendingForIngest.attachments : void 0, cwd = args.cwd ?? process.cwd(), homedir40 = os47.homedir(), runAttachmentIngest = (existing) => {
+  let pendingForIngest = store.getState().pendingClarification, isAnsweringPending = !!pendingForIngest && pendingForIngest.rounds.length > 0 && pendingForIngest.rounds[pendingForIngest.rounds.length - 1].answer === void 0, existingAttachments = !slashCommandText.startsWith("/") && isAnsweringPending ? pendingForIngest.attachments : void 0, cwd = args.cwd ?? process.cwd(), homedir41 = os48.homedir(), runAttachmentIngest = (existing) => {
     if (deps.images && deps.images.length > 0) {
       let carried = attachmentsFromPaths(
         deps.images,
         existing && existing.length ? { existing } : void 0
       ), fromText = detectImageAttachments(text2.replace(/\[Image #\d+\]/g, " "), {
         cwd,
-        homedir: homedir40,
+        homedir: homedir41,
         existing: carried.attachments
       });
       return { attachments: fromText.attachments, rejects: [...carried.rejects, ...fromText.rejects] };
     }
     return detectImageAttachments(text2, {
       cwd,
-      homedir: homedir40,
+      homedir: homedir41,
       ...existing && existing.length ? { existing } : {}
     });
   }, ingest = runAttachmentIngest(existingAttachments), turnAttachments = ingest.attachments, currentTurnIngest = existingAttachments && existingAttachments.length > 0 ? runAttachmentIngest() : ingest, currentTurnAttachments = currentTurnIngest.attachments, turnImagePaths = (deps.images ?? []).map((p) => path78.resolve(p)), teamDurableStore = typeof args.quorumLoop?.getDurableStore == "function" ? args.quorumLoop.getDurableStore() : void 0, ingestRejectsSurfaced = !1, surfaceIngestRejects = (result) => {
@@ -88140,7 +88706,7 @@ async function runStructuralSummarySessionStart(deps) {
   try {
     let optIn = await readOptIn(args.tier), discovery = await discoverRepositoryRoots({ launchDir: process.cwd() }), summary = await generator.generate({
       rootPaths: discovery.rootPaths,
-      ignoreFile: path78.join(os47.homedir(), ".codevibe", "structural-summary.ignore"),
+      ignoreFile: path78.join(os48.homedir(), ".codevibe", "structural-summary.ignore"),
       includeBodies: optIn?.bodyInclusionPaths ?? [],
       userId: args.session.userId,
       tier: args.tier
@@ -89508,7 +90074,7 @@ ${colors.green}\u2713${colors.reset} Cleared ${clearable.length} entr${clearable
 }
 
 // src/substrate-launch/engage-substrate.ts
-var import_node_fs38 = require("node:fs"), os48 = __toESM(require("node:os")), path80 = __toESM(require("node:path"));
+var import_node_fs38 = require("node:fs"), os49 = __toESM(require("node:os")), path80 = __toESM(require("node:path"));
 
 // src/credential-broker/types.ts
 var BROKER_ROUTES = [
@@ -91491,7 +92057,7 @@ function providerForAgent(agentKind) {
   return agentKind === "CLAUDE" ? "anthropic" : agentKind === "CODEX" ? "openai" : null;
 }
 var AUDIT_SEGMENT = "audit", STATE_SEGMENT = "state", CODEVIBE_DIR = ".codevibe", AUDIT_FILE_NAME = "audit.jsonl";
-function isInsideOrEqual2(child, parent) {
+function isInsideOrEqual3(child, parent) {
   if (child === parent) return !0;
   let rel = path80.relative(parent, child);
   return rel.length > 0 && !rel.startsWith("..") && !path80.isAbsolute(rel);
@@ -91540,7 +92106,7 @@ async function assertAuditOutsideWorkdir(auditPath, workdir) {
         `CP-7 W3: audit leaf "${resolvedAuditPath}" is a symlink that does not resolve (dangling) \u2014 refusing to launch (fail-closed). The audit file must be a regular file in the sibling .codevibe/audit/ tree.`
       );
     }
-  if (isInsideOrEqual2(realAuditDir, realWorkdir) || isInsideOrEqual2(resolvedAuditPath, realWorkdir) || isInsideOrEqual2(resolvedLeafTarget, realWorkdir))
+  if (isInsideOrEqual3(realAuditDir, realWorkdir) || isInsideOrEqual3(resolvedAuditPath, realWorkdir) || isInsideOrEqual3(resolvedLeafTarget, realWorkdir))
     throw new Error(
       `CP-7 W3: audit path "${resolvedAuditPath}" (resolved target "${resolvedLeafTarget}") is inside the agent workdir "${realWorkdir}" \u2014 the agent could truncate/forge the forensic record (Stage-1 r1 HIGH fail-closed). The audit MUST live in the sibling .codevibe/audit/ tree, never under .codevibe/state/<group>/<track>/.`
     );
@@ -91666,7 +92232,8 @@ async function engageSubstrate(input) {
       ...agentScratchSpec !== null ? { agentScratch: agentScratchSpec } : {},
       // CP-7 W3 — Stage-2 r1 HIGH. The resolved audit dir → A5 trailing deny.
       // Undefined when a test injects its own in-memory sink (no real tree).
-      ...resolvedAuditDir !== null ? { auditDir: resolvedAuditDir } : {}
+      ...resolvedAuditDir !== null ? { auditDir: resolvedAuditDir } : {},
+      ...input.writableWorkdir !== void 0 ? { writableWorkdir: input.writableWorkdir } : {}
     };
     handle = await selection.substrate.launch(spec), logger.info(
       `[CP-7] Substrate engaged (tier=${selection.tier}, egress=${handle.egressFidelity}) \u2014 agent is creditless, broker holds the key`,
@@ -91799,7 +92366,7 @@ async function engageSubstrate(input) {
 }
 var RESOLVER_AGENT_STATE_DIR_SEGMENTS = {
   GEMINI: [".gemini"],
-  ANTIGRAVITY: [".gemini", "antigravity-cli"]
+  ANTIGRAVITY: [".gemini"]
 };
 async function engageWriteConfinedResolverSandbox(input) {
   let agentKind = input.agentKind;
@@ -91824,14 +92391,14 @@ async function engageWriteConfinedResolverSandbox(input) {
       teardown: async () => {
       }
     };
-  let homedir40 = os48.homedir(), stateDir = path80.join(
-    homedir40,
+  let homedir41 = os49.homedir(), stateDir = path80.join(
+    homedir41,
     ...RESOLVER_AGENT_STATE_DIR_SEGMENTS[agentKind]
   );
   await import_node_fs38.promises.mkdir(stateDir, { recursive: !0 }).catch(() => {
   });
   let env = {}, nodeDir = process.execPath.slice(0, process.execPath.lastIndexOf("/"));
-  env.PATH = `${SANDBOX_DEFAULT_PATH}:${nodeDir}`, env.HOME = homedir40;
+  env.PATH = `${SANDBOX_DEFAULT_PATH}:${nodeDir}`, env.HOME = homedir41;
   let safeSource = input.localeSource ?? {};
   for (let key of SAFE_ENV_ALLOWLIST) {
     let v = safeSource[key];
@@ -91851,7 +92418,8 @@ async function engageWriteConfinedResolverSandbox(input) {
     // The agent's own auth/state home — writable, read-granted (A5: sandbox fs
     // == host fs, so sandboxDir == hostDir).
     agentConfig: { hostDir: stateDir, sandboxDir: stateDir },
-    networkPosture: "open"
+    networkPosture: "open",
+    writableWorkdir: input.writableWorkdir !== !1
   }, handle = await selection.substrate.launch(spec);
   return logger.info(
     `[A1d] Resolver-confinement row engaged (tier=sandbox_exec, egress=open) \u2014 writes fenced to the disposable workspace; ${agentKind} runs on its own file-based auth (no broker)`,
@@ -92526,8 +93094,8 @@ function isLocalModelEntitled(entitlement) {
 }
 function localModelArtifactPath(config) {
   if (!config.artifactId || !isSafeArtifactId(config.artifactId)) return null;
-  let cacheRoot = import_path5.default.resolve(config.cacheDir), artifactPath = import_path5.default.resolve(cacheRoot, config.artifactId), relative22 = import_path5.default.relative(cacheRoot, artifactPath);
-  return !relative22 || relative22.startsWith("..") || import_path5.default.isAbsolute(relative22) ? null : artifactPath;
+  let cacheRoot = import_path5.default.resolve(config.cacheDir), artifactPath = import_path5.default.resolve(cacheRoot, config.artifactId), relative23 = import_path5.default.relative(cacheRoot, artifactPath);
+  return !relative23 || relative23.startsWith("..") || import_path5.default.isAbsolute(relative23) ? null : artifactPath;
 }
 function isSafeArtifactId(artifactId) {
   return artifactId === import_path5.default.basename(artifactId) && artifactId !== "." && artifactId !== ".." && !import_path5.default.isAbsolute(artifactId);