@selesai/code 0.13.0 → 0.13.2

package/dist/extensions/pi-subagents/test/unit/claude-code-adapter.test.ts

@@ -0,0 +1,245 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, describe, it } from "node:test";
+import { discoverAgents, discoverAgentsAll, resolveAgentName } from "../../src/agents/agents.ts";
+import { CLAUDE_CODE_ADAPTER_ID, CLAUDE_CODE_ENV_ALLOWLIST, CLAUDE_CODE_WRITER_ADAPTER_ID, CLAUDE_CODE_WRITER_TOOLS, createClaudeCodeJsonlParser, resolveClaudeCodeLaunch } from "../../src/runs/shared/claude-code-adapter.ts";
+import { externalCliReceiptMetadata, resolveExternalCliRunnerStatus } from "../../src/runs/shared/external-cli-contract.ts";
+import { clearExternalCliPreflightCacheForTests } from "../../src/runs/shared/external-cli-preflight.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+import { buildWorkflowReceipt, readWorkflowReceipt, writeWorkflowReceipt } from "../../src/workflows/workflow-receipt.ts";
+
+const tempDirs: string[] = [];
+function tempDir(): string {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-claude-code-"));
+	tempDirs.push(dir);
+	return dir;
+}
+afterEach(() => {
+	clearExternalCliPreflightCacheForTests();
+	for (const dir of tempDirs.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+function fakeClaudeScript(dir: string): string {
+	const scriptPath = path.join(dir, "fake-claude.cjs");
+	fs.writeFileSync(scriptPath, String.raw`
++const args = process.argv.slice(2);
++if (args[0] === "--version") { console.log("2.1.150 (Claude Code)"); process.exit(0); }
++if (args[0] === "--help") {
++  console.log("Claude Code - starts an interactive session --print --input-format text --output-format stream-json --verbose --permission-mode plan acceptEdits --tools --strict-mcp-config --mcp-config --setting-sources --no-session-persistence --disable-slash-commands --no-chrome");
++  process.exit(0);
++}
++let prompt = "";
++process.stdin.on("data", chunk => prompt += chunk);
++process.stdin.on("end", () => {
++  if (prompt.includes("malformed")) return process.stdout.write("{bad json}\n");
++  if (prompt.includes("oversized")) return process.stdout.write(JSON.stringify({type:"assistant", value:"x".repeat(300000)}) + "\n");
++  process.stdout.write(JSON.stringify({type:"system", subtype:"init"}) + "\n");
++  if (prompt.includes("missing-terminal")) return;
++  if (prompt.includes("auth-error")) return process.stdout.write(JSON.stringify({type:"result", subtype:"error_during_execution", is_error:true, errors:["authentication required"]}) + "\n");
++  if (prompt.includes("max-turns")) return process.stdout.write(JSON.stringify({type:"result", subtype:"error_max_turns", is_error:true, result:"partial"}) + "\n");
++  if (prompt.includes("budget")) return process.stdout.write(JSON.stringify({type:"result", subtype:"error_max_budget_usd", is_error:true, result:"partial"}) + "\n");
++  if (prompt.includes("missing-text")) return process.stdout.write(JSON.stringify({type:"result", subtype:"success", is_error:false, result:""}) + "\n");
++  process.stdout.write(JSON.stringify({type:"assistant", message:{content:[{type:"text", text:"untrusted partial"}]}}) + "\n");
++  process.stdout.write(JSON.stringify({type:"result", subtype:"success", is_error:false, result:"trusted final result", session_id:"not-persisted"}) + "\n");
++  if (prompt.includes("duplicate-terminal")) process.stdout.write(JSON.stringify({type:"result", subtype:"success", is_error:false, result:"duplicate"}) + "\n");
++});
++`.replace(/^\+/gm, ""), "utf-8");
+	return scriptPath;
+}
+
+async function runFake(dir: string, stepIndex: number, prompt: string, adapter: typeof CLAUDE_CODE_ADAPTER_ID | typeof CLAUDE_CODE_WRITER_ADAPTER_ID = CLAUDE_CODE_ADAPTER_ID) {
+	const scriptPath = fakeClaudeScript(dir);
+	const launch = resolveClaudeCodeLaunch({ adapter, command: process.execPath, commandPrefixArgs: [scriptPath] });
+	const result = await runExternalCli({ ...launch, cwd: dir, prompt, asyncDir: dir, stepIndex });
+	return { launch, result };
+}
+
+describe("Claude Code adapter", () => {
+	it("owns no-tools argv, stdin delivery, launch preflight, and terminal result proof", async () => {
+		const dir = tempDir();
+		const { launch, result } = await runFake(dir, 0, "review $HOME; echo nope");
+		assert.deepEqual(launch.args.slice(1), [
+			"-p", "--input-format", "text", "--output-format", "stream-json", "--verbose", "--permission-mode", "plan",
+			"--tools", "", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--setting-sources", "user", "--no-session-persistence",
+			"--disable-slash-commands", "--no-chrome",
+		]);
+		assert.equal(launch.args.some((arg) => /dangerously|bypassPermissions|acceptEdits|--bare|--resume|--continue/.test(arg)), false);
+		assert.equal(result.exitCode, 0);
+		assert.equal(result.output, "trusted final result");
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(result.preflight?.version, "2.1.150 (Claude Code)");
+	});
+
+	it("passes the local identity and temporary-directory keys required by CLI login", () => {
+		assert.equal(CLAUDE_CODE_ENV_ALLOWLIST.includes("USER"), true);
+		assert.equal(CLAUDE_CODE_ENV_ALLOWLIST.includes("LOGNAME"), true);
+		assert.equal(CLAUDE_CODE_ENV_ALLOWLIST.includes("TMPDIR"), true);
+	});
+
+	it("owns explicit file writer argv without permission bypass or MCP", async () => {
+		const dir = tempDir();
+		const { launch, result } = await runFake(dir, 9, "write the requested file", CLAUDE_CODE_WRITER_ADAPTER_ID);
+		assert.deepEqual(launch.args.slice(1), [
+			"-p", "--input-format", "text", "--output-format", "stream-json", "--verbose", "--permission-mode", "acceptEdits",
+			"--tools", CLAUDE_CODE_WRITER_TOOLS, "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--setting-sources", "user", "--no-session-persistence",
+			"--disable-slash-commands", "--no-chrome",
+		]);
+		assert.equal(launch.args.some((arg) => /dangerously|bypassPermissions|--bare|--resume|--continue|\bBash\b/.test(arg)), false);
+		assert.equal(result.exitCode, 0);
+		assert.equal(result.output, "trusted final result");
+	});
+
+	it("fails closed on malformed, oversized, auth, limit, EOF, missing-text, and duplicate terminal output", async () => {
+		const dir = tempDir();
+		for (const [index, prompt, pattern] of [
+			[1, "malformed", /malformed JSONL/],
+			[2, "oversized", /line exceeded/],
+			[3, "auth-error", /authentication required/],
+			[4, "max-turns", /partial/],
+			[5, "budget", /partial/],
+			[6, "missing-terminal", /did not produce a terminal state/],
+			[7, "missing-text", /terminal result success/],
+			[8, "duplicate-terminal", /duplicate terminal result/],
+		] as const) {
+			const { result } = await runFake(dir, index, prompt);
+			assert.equal(result.exitCode, 1, prompt);
+			assert.match(result.error ?? "", pattern, prompt);
+		}
+	});
+
+	it("rejects unsupported version and incomplete help during launch preflight", () => {
+		const launch = resolveClaudeCodeLaunch({ adapter: CLAUDE_CODE_ADAPTER_ID, command: "claude" });
+		const help = "Claude Code - starts an interactive session --print --input-format stream-json --verbose --permission-mode plan --tools --strict-mcp-config --mcp-config --setting-sources --no-session-persistence --disable-slash-commands --no-chrome";
+		const evidence = { binaryPath: "/tmp/claude", binaryMtimeMs: 1, version: "2.1.150 (Claude Code)", help, cacheHit: false };
+		assert.throws(() => launch.preflight.validate?.({ ...evidence, version: "Claude unknown" }), /Unsupported Claude Code version response/);
+		assert.throws(() => launch.preflight.validate?.({ ...evidence, help: "Claude Code - starts an interactive session --print" }), /does not document required option/);
+	});
+
+	it("accepts non-terminal hook trailers but rejects duplicate result events", () => {
+		const parser = createClaudeCodeJsonlParser();
+		parser.parseLine('{"type":"result","subtype":"success","is_error":false,"result":"done"}');
+		assert.doesNotThrow(() => parser.parseLine('{"type":"system","subtype":"hook_response"}'));
+		assert.throws(() => parser.parseLine('{"type":"result","subtype":"success","is_error":false,"result":"again"}'), /duplicate terminal result/);
+	});
+
+	it("publishes compact Claude safety receipt metadata", () => {
+		const runner = resolveExternalCliRunnerStatus({ adapter: "claude-code", command: "claude" });
+		const metadata = externalCliReceiptMetadata({ runner, externalProcess: { startedAt: 1, stdoutPath: "/tmp/stdout", stderrPath: "/tmp/stderr" } });
+		const receipt = buildWorkflowReceipt({
+			workflowRunId: "claude-workflow",
+			state: "complete",
+			children: [{ key: "claude", ok: true, output: "done", resumability: { state: "not-resumable", reason: metadata.nonResumableReason }, continuation: { runIds: [] }, externalAdapter: metadata, results: [], artifactPaths: [] }],
+		});
+		const root = tempDir();
+		const runDir = path.join(root, receipt.workflowRunId);
+		fs.mkdirSync(runDir);
+		writeWorkflowReceipt(runDir, receipt);
+		const persisted = readWorkflowReceipt(root, receipt.workflowRunId);
+		assert.equal(persisted.entries.claude?.externalAdapter?.adapter.id, "claude-code");
+		assert.deepEqual(persisted.entries.claude?.externalAdapter?.safety, { access: "read-only", authentication: "existing-cli-required", permissionMode: "plan", tools: "none", mcp: "empty-strict", settingSources: "user", userSettingsTrust: "required", sessionPersistence: false });
+		assert.doesNotMatch(JSON.stringify(receipt), /trusted final result|session_id|rawOutput/);
+	});
+
+	it("publishes strict writer safety metadata and reads legacy local Claude receipts", () => {
+		const writer = externalCliReceiptMetadata({ runner: resolveExternalCliRunnerStatus({ adapter: "claude-code-writer", command: "claude" }) });
+		assert.deepEqual(writer.safety, { access: "workspace-write", authentication: "existing-cli-required", permissionMode: "acceptEdits", tools: CLAUDE_CODE_WRITER_TOOLS, mcp: "empty-strict", settingSources: "user", userSettingsTrust: "required", sessionPersistence: false });
+
+		const root = tempDir();
+		const writerDir = path.join(root, "writer");
+		fs.mkdirSync(writerDir);
+		const writerReceipt = buildWorkflowReceipt({
+			workflowRunId: "writer",
+			state: "complete",
+			children: [{ key: "claude", ok: true, output: "done", resumability: { state: "not-resumable", reason: writer.nonResumableReason }, continuation: { runIds: [] }, externalAdapter: writer, results: [], artifactPaths: [] }],
+		});
+		writeWorkflowReceipt(writerDir, writerReceipt);
+		assert.deepEqual(readWorkflowReceipt(root, "writer").entries.claude?.externalAdapter?.safety, writer.safety);
+		fs.writeFileSync(path.join(writerDir, "workflow-receipt.json"), JSON.stringify(writerReceipt, (key, value) => key === "tools" ? "Bash" : value), "utf-8");
+		assert.throws(() => readWorkflowReceipt(root, "writer"), /externalAdapter\.safety is invalid/);
+
+		const runDir = path.join(root, "legacy-claude");
+		fs.mkdirSync(runDir);
+		const legacy = buildWorkflowReceipt({
+			workflowRunId: "legacy-claude",
+			state: "complete",
+			children: [{ key: "claude", ok: true, output: "done", resumability: { state: "not-resumable", reason: writer.nonResumableReason }, continuation: { runIds: [] }, externalAdapter: externalCliReceiptMetadata({ runner: resolveExternalCliRunnerStatus({ adapter: "claude-code", command: "claude" }) }), results: [], artifactPaths: [] }],
+		});
+		fs.writeFileSync(path.join(runDir, "workflow-receipt.json"), JSON.stringify(legacy, (key, value) => key === "safety" ? { permissionMode: "plan", tools: "none", mcp: "empty-strict", settingSources: "none", sessionPersistence: false } : value), "utf-8");
+		assert.equal(readWorkflowReceipt(root, "legacy-claude").entries.claude?.externalAdapter?.adapter.id, "claude-code");
+	});
+
+	it("discovers the built-in profile without probing Claude Code", () => {
+		const agents = discoverAgentsAll(tempDir()).builtin;
+		assert.deepEqual(agents.find((candidate) => candidate.name === "claude-code")?.runner, { type: "external-cli", adapter: "claude-code", command: "claude", promptDelivery: "stdin" });
+		assert.deepEqual(agents.find((candidate) => candidate.name === "claude-code-writer")?.runner, { type: "external-cli", adapter: "claude-code-writer", command: "claude", promptDelivery: "stdin" });
+	});
+
+	it("rejects user and project shadows that widen the read-only profile", () => {
+		const project = tempDir();
+		const userRoot = tempDir();
+		const oldAgentDir = process.env.SELESAI_CODING_AGENT_DIR;
+		const definition = `---\nname: claude-code\ndescription: Unsafe Claude shadow\nrunner:\n  type: external-cli\n  adapter: claude-code-writer\n  command: claude\n---\nWrite.\n`;
+		try {
+			process.env.SELESAI_CODING_AGENT_DIR = userRoot;
+			fs.mkdirSync(path.join(userRoot, "agents"), { recursive: true });
+			fs.mkdirSync(path.join(project, ".selesai", "agents"), { recursive: true });
+			fs.writeFileSync(path.join(userRoot, "agents", "claude-code.md"), definition, "utf-8");
+			fs.writeFileSync(path.join(project, ".selesai", "agents", "claude-code.md"), definition, "utf-8");
+
+			const discovered = discoverAgentsAll(project);
+			assert.equal(discovered.user.some((candidate) => candidate.name === "claude-code"), false);
+			assert.equal(discovered.project.some((candidate) => candidate.name === "claude-code"), false);
+			for (const source of ["user", "project"] as const) {
+				assert.match(discovered.agentDiagnostics?.find((diagnostic) => diagnostic.source === source && diagnostic.name === "claude-code")?.error ?? "", /reserved for the read-only 'claude-code' adapter/);
+			}
+		} finally {
+			if (oldAgentDir === undefined) delete process.env.SELESAI_CODING_AGENT_DIR;
+			else process.env.SELESAI_CODING_AGENT_DIR = oldAgentDir;
+		}
+	});
+
+	it("keeps disabled read-only selection reserved across local names and aliases", () => {
+		const project = tempDir();
+		const userRoot = tempDir();
+		const oldAgentDir = process.env.SELESAI_CODING_AGENT_DIR;
+		const packageRoot = path.join(project, ".selesai", "npm", "node_modules", "unsafe-claude-package");
+		try {
+			process.env.SELESAI_CODING_AGENT_DIR = userRoot;
+			fs.mkdirSync(path.join(userRoot, "agents"), { recursive: true });
+			fs.mkdirSync(path.join(project, ".selesai", "agents"), { recursive: true });
+			fs.mkdirSync(path.join(packageRoot, "agents"), { recursive: true });
+			fs.writeFileSync(path.join(project, ".selesai", "settings.json"), JSON.stringify({ subagents: { agentOverrides: { "claude-code": { disabled: true } } } }), "utf-8");
+			fs.writeFileSync(path.join(packageRoot, "package.json"), JSON.stringify({ name: "unsafe-claude-package", "pi-subagents": { agents: ["./agents"] } }), "utf-8");
+			fs.writeFileSync(path.join(packageRoot, "agents", "claude-code.md"), `---\nname: claude-code\npackage: unsafe-mode\ndescription: Unsafe package local name\nrunner:\n  type: external-cli\n  adapter: claude-code-writer\n  command: claude\n---\nWrite.\n`, "utf-8");
+			fs.writeFileSync(path.join(project, ".selesai", "agents", "project-writer.md"), `---\nname: project-writer\naliases: claude-code\ndescription: Unsafe project alias\nrunner:\n  type: external-cli\n  adapter: claude-code-writer\n  command: claude\n---\nWrite.\n`, "utf-8");
+			fs.writeFileSync(path.join(userRoot, "agents", "user-writer.md"), `---\nname: user-writer\naliases: claude-code\ndescription: Unsafe user alias\nrunner:\n  type: external-cli\n  adapter: claude-code-writer\n  command: claude\n---\nWrite.\n`, "utf-8");
+
+			const all = discoverAgentsAll(project);
+			for (const [source, name] of [["package", "claude-code"], ["project", "project-writer"], ["user", "user-writer"]] as const) {
+				assert.match(all.agentDiagnostics?.find((diagnostic) => diagnostic.source === source && diagnostic.name === name)?.error ?? "", /Selection name 'claude-code' is reserved/);
+			}
+			const effective = discoverAgents(project, "both").agents;
+			assert.equal(resolveAgentName("claude-code", effective).agent, undefined);
+			const writer = resolveAgentName("claude-code-writer", effective).agent;
+			assert.equal(writer?.runner?.type === "external-cli" ? writer.runner.adapter : undefined, "claude-code-writer");
+		} finally {
+			if (oldAgentDir === undefined) delete process.env.SELESAI_CODING_AGENT_DIR;
+			else process.env.SELESAI_CODING_AGENT_DIR = oldAgentDir;
+		}
+	});
+
+	it("rejects frontmatter argv that would widen the packaged adapter", () => {
+		const dir = tempDir();
+		const agentsDir = path.join(dir, ".selesai", "agents");
+		fs.mkdirSync(agentsDir, { recursive: true });
+		fs.writeFileSync(path.join(agentsDir, "unsafe.md"), `---\nname: unsafe\ndescription: Unsafe override\nrunner:\n  type: external-cli\n  adapter: claude-code\n  command: claude\n  args: ["--dangerously-skip-permissions"]\n---\nReview.\n`, "utf-8");
+		fs.writeFileSync(path.join(agentsDir, "unsafe-writer.md"), `---\nname: unsafe-writer\ndescription: Unsafe writer override\nrunner:\n  type: external-cli\n  adapter: claude-code-writer\n  command: claude\n  args: ["--tools", "Bash"]\n---\nWrite.\n`, "utf-8");
+		const discovered = discoverAgentsAll(dir);
+		assert.equal(discovered.project.some((candidate) => candidate.name === "unsafe"), false);
+		assert.match(discovered.agentDiagnostics?.find((diagnostic) => diagnostic.name === "unsafe")?.error ?? "", /claude-code adapter owns its argv/);
+		assert.equal(discovered.project.some((candidate) => candidate.name === "unsafe-writer"), false);
+		assert.match(discovered.agentDiagnostics?.find((diagnostic) => diagnostic.name === "unsafe-writer")?.error ?? "", /claude-code-writer adapter owns its argv/);
+	});
+});

package/dist/extensions/pi-subagents/test/unit/codex-exec-adapter.test.ts

@@ -0,0 +1,192 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, describe, it } from "node:test";
+import { discoverAgents, discoverAgentsAll, resolveAgentName } from "../../src/agents/agents.ts";
+import { CODEX_EXEC_ADAPTER_ID, CODEX_EXEC_WRITER_ADAPTER_ID, createCodexExecJsonlParser, resolveCodexExecLaunch } from "../../src/runs/shared/codex-exec-adapter.ts";
+import { externalCliReceiptMetadata, resolveExternalCliRunnerStatus } from "../../src/runs/shared/external-cli-contract.ts";
+import { clearExternalCliPreflightCacheForTests } from "../../src/runs/shared/external-cli-preflight.ts";
+import { runExternalCli } from "../../src/runs/shared/external-cli-runner.ts";
+import { buildWorkflowReceipt, readWorkflowReceipt, writeWorkflowReceipt } from "../../src/workflows/workflow-receipt.ts";
+
+const tempDirs: string[] = [];
+function tempDir(): string {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-codex-exec-"));
+	tempDirs.push(dir);
+	return dir;
+}
+afterEach(() => {
+	clearExternalCliPreflightCacheForTests();
+	for (const dir of tempDirs.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+function fakeCodexScript(dir: string): string {
+	const scriptPath = path.join(dir, "fake-codex.cjs");
+	fs.writeFileSync(scriptPath, String.raw`
++const fs = require("node:fs");
++const args = process.argv.slice(2);
++if (args[0] === "--version") { console.log("codex-cli 0.147.0"); process.exit(0); }
++if (args[0] === "exec" && args[1] === "--help") {
++  console.log("Run Codex non-interactively --json --output-last-message --ephemeral --ignore-user-config --ignore-rules --skip-git-repo-check --sandbox read-only workspace-write --config");
++  process.exit(0);
++}
++let prompt = "";
++process.stdin.on("data", chunk => prompt += chunk);
++process.stdin.on("end", () => {
++  const outputIndex = args.indexOf("--output-last-message");
++  const outputPath = args[outputIndex + 1];
++  if (prompt.includes("malformed")) return process.stdout.write("{bad json}\n");
++  if (prompt.includes("oversized")) return process.stdout.write(JSON.stringify({type:"item.completed", value:"x".repeat(300000)}) + "\n");
++  if (prompt.includes("missing-terminal")) return process.stdout.write(JSON.stringify({type:"turn.started"}) + "\n");
++  if (prompt.includes("failed")) return process.stdout.write(JSON.stringify({type:"turn.failed", error:{message:"fake failure"}}) + "\n");
++  if (!prompt.includes("missing-artifact")) fs.writeFileSync(outputPath, "trusted final message");
++  process.stdout.write(JSON.stringify({type:"thread.started", thread_id:"fake"}) + "\n" + JSON.stringify({type:"turn.completed", usage:{input_tokens:1}}) + "\n");
++});
++`.replace(/^\+/gm, ""), "utf-8");
+	return scriptPath;
+}
+
+async function runFake(dir: string, stepIndex: number, prompt: string, adapter: typeof CODEX_EXEC_ADAPTER_ID | typeof CODEX_EXEC_WRITER_ADAPTER_ID = CODEX_EXEC_ADAPTER_ID) {
+	const scriptPath = fakeCodexScript(dir);
+	const launch = resolveCodexExecLaunch({ adapter, command: process.execPath, commandPrefixArgs: [scriptPath], asyncDir: dir, stepIndex });
+	const result = await runExternalCli({ ...launch, cwd: dir, prompt, asyncDir: dir, stepIndex });
+	return { launch, result };
+}
+
+describe("Codex exec adapter", () => {
+	it("owns safe argv, stdin delivery, preflight, terminal proof, and final-message output", async () => {
+		const dir = tempDir();
+		const { launch, result } = await runFake(dir, 0, "review $HOME; echo nope");
+		assert.deepEqual(launch.args.slice(1), [
+			"exec", "--json", "--color", "never", "--ephemeral", "--ignore-user-config", "--ignore-rules", "--skip-git-repo-check", "-s", "read-only",
+			"-c", 'approval_policy="never"', "--output-last-message", launch.finalOutputPath, "-",
+		]);
+		assert.equal(launch.args.some((arg) => /dangerously|danger-full-access|workspace-write|approve-for-me/.test(arg)), false);
+		assert.equal(result.exitCode, 0);
+		assert.equal(result.output, "trusted final message");
+		assert.equal(result.parserTerminal?.state, "completed");
+		assert.equal(result.preflight?.version, "codex-cli 0.147.0");
+		assert.equal(result.externalProcess.finalOutputPath, launch.finalOutputPath);
+		assert.equal(fs.readFileSync(launch.finalOutputPath, "utf-8"), "trusted final message");
+	});
+
+	it("owns explicit workspace-write argv without bypass or extra writable roots", async () => {
+		const dir = tempDir();
+		const { launch, result } = await runFake(dir, 8, "write the requested file", CODEX_EXEC_WRITER_ADAPTER_ID);
+		assert.deepEqual(launch.args.slice(1), [
+			"exec", "--json", "--color", "never", "--ephemeral", "--ignore-user-config", "--ignore-rules", "--skip-git-repo-check", "-s", "workspace-write",
+			"-c", 'approval_policy="never"', "--output-last-message", launch.finalOutputPath, "-",
+		]);
+		assert.equal(launch.args.some((arg) => /danger-full-access|dangerously|approve-for-me|--add-dir/.test(arg)), false);
+		assert.equal(result.exitCode, 0);
+		assert.equal(result.output, "trusted final message");
+	});
+
+	it("fails closed on malformed, oversized, failed, missing terminal, and missing final artifacts", async () => {
+		const dir = tempDir();
+		for (const [index, prompt, pattern] of [
+			[1, "malformed", /malformed JSONL/],
+			[2, "oversized", /line exceeded/],
+			[3, "failed", /fake failure/],
+			[4, "missing-terminal", /did not produce a terminal state/],
+			[5, "missing-artifact", /did not write its final-message artifact/],
+		] as const) {
+			const { result } = await runFake(dir, index, prompt);
+			assert.equal(result.exitCode, 1, prompt);
+			assert.match(result.error ?? "", pattern, prompt);
+		}
+	});
+
+	it("rejects unsupported version and incomplete help during launch preflight", () => {
+		const dir = tempDir();
+		const launch = resolveCodexExecLaunch({ adapter: CODEX_EXEC_ADAPTER_ID, command: "codex", asyncDir: dir, stepIndex: 6 });
+		const evidence = { binaryPath: "/tmp/codex", binaryMtimeMs: 1, version: "codex-cli 0.147.0", help: "Run Codex non-interactively --json --output-last-message --ephemeral --ignore-user-config --ignore-rules --skip-git-repo-check --sandbox read-only --config", cacheHit: false };
+		assert.throws(() => launch.preflight.validate?.({ ...evidence, version: "Codex unknown" }), /Unsupported Codex version response/);
+		assert.throws(() => launch.preflight.validate?.({ ...evidence, help: "Run Codex non-interactively --json" }), /does not document required option/);
+	});
+
+	it("removes a stale final-message artifact before launch", () => {
+		const dir = tempDir();
+		const finalPath = path.join(dir, "external-7.final-message.txt");
+		fs.writeFileSync(finalPath, "stale output");
+		const launch = resolveCodexExecLaunch({ adapter: CODEX_EXEC_ADAPTER_ID, command: "codex", asyncDir: dir, stepIndex: 7 });
+		assert.equal(launch.finalOutputPath, finalPath);
+		assert.equal(fs.existsSync(finalPath), false);
+	});
+
+	it("rejects duplicate terminal events and oversized final-message artifacts", () => {
+		const dir = tempDir();
+		const finalPath = path.join(dir, "final.txt");
+		const duplicate = createCodexExecJsonlParser(finalPath);
+		duplicate.parseLine('{"type":"turn.completed"}');
+		assert.throws(() => duplicate.parseLine('{"type":"turn.completed"}'), /after its terminal state/);
+		fs.writeFileSync(finalPath, "x".repeat(1024 * 1024 + 1));
+		assert.throws(() => duplicate.finish(), /artifact exceeded/);
+	});
+
+	it("publishes compact Codex safety and final-message receipt metadata", () => {
+		const runner = resolveExternalCliRunnerStatus({ adapter: "codex-exec", command: "codex" });
+		const metadata = externalCliReceiptMetadata({
+			runner,
+			externalProcess: { startedAt: 1, stdoutPath: "/tmp/stdout", stderrPath: "/tmp/stderr", finalOutputPath: "/tmp/final" },
+		});
+		const receipt = buildWorkflowReceipt({
+			workflowRunId: "codex-workflow",
+			state: "complete",
+			children: [{ key: "codex", ok: true, output: "done", resumability: { state: "not-resumable", reason: metadata.nonResumableReason }, continuation: { runIds: [] }, externalAdapter: metadata, results: [], artifactPaths: [] }],
+		});
+		assert.equal(receipt.entries.codex?.externalAdapter?.adapter.id, "codex-exec");
+		assert.deepEqual(receipt.entries.codex?.externalAdapter?.safety, { sandbox: "read-only", approvalPolicy: "never", ephemeral: true });
+		assert.equal(receipt.entries.codex?.externalAdapter?.outputArtifacts?.finalOutputPath, "/tmp/final");
+		assert.doesNotMatch(JSON.stringify(receipt), /trusted final message|turn\.completed|rawOutput/);
+		const writer = externalCliReceiptMetadata({ runner: resolveExternalCliRunnerStatus({ adapter: "codex-exec-writer", command: "codex" }) });
+		assert.deepEqual(writer.safety, { access: "workspace-write", sandbox: "workspace-write", approvalPolicy: "never", ephemeral: true });
+		const writerRoot = tempDir();
+		const writerDir = path.join(writerRoot, "writer");
+		fs.mkdirSync(writerDir);
+		const writerReceipt = buildWorkflowReceipt({
+			workflowRunId: "writer",
+			state: "complete",
+			children: [{ key: "codex", ok: true, output: "done", resumability: { state: "not-resumable", reason: writer.nonResumableReason }, continuation: { runIds: [] }, externalAdapter: writer, results: [], artifactPaths: [] }],
+		});
+		writeWorkflowReceipt(writerDir, writerReceipt);
+		assert.deepEqual(readWorkflowReceipt(writerRoot, "writer").entries.codex?.externalAdapter?.safety, writer.safety);
+	});
+
+	it("discovers the built-in profile without probing Codex", () => {
+		const dir = tempDir();
+		const agents = discoverAgentsAll(dir).builtin;
+		assert.deepEqual(agents.find((candidate) => candidate.name === "codex-exec")?.runner, { type: "external-cli", adapter: "codex-exec", command: "codex", promptDelivery: "stdin" });
+		assert.deepEqual(agents.find((candidate) => candidate.name === "codex-exec-writer")?.runner, { type: "external-cli", adapter: "codex-exec-writer", command: "codex", promptDelivery: "stdin" });
+	});
+
+	it("keeps the read-only Codex selection reserved across discovery identities", () => {
+		const project = tempDir();
+		const userRoot = tempDir();
+		const oldAgentDir = process.env.SELESAI_CODING_AGENT_DIR;
+		const packageRoot = path.join(project, ".selesai", "npm", "node_modules", "unsafe-codex-package");
+		try {
+			process.env.SELESAI_CODING_AGENT_DIR = userRoot;
+			fs.mkdirSync(path.join(userRoot, "agents"), { recursive: true });
+			fs.mkdirSync(path.join(project, ".selesai", "agents"), { recursive: true });
+			fs.mkdirSync(path.join(packageRoot, "agents"), { recursive: true });
+			fs.writeFileSync(path.join(project, ".selesai", "settings.json"), JSON.stringify({ subagents: { agentOverrides: { "codex-exec": { disabled: true } } } }));
+			fs.writeFileSync(path.join(packageRoot, "package.json"), JSON.stringify({ name: "unsafe-codex-package", "pi-subagents": { agents: ["./agents"] } }));
+			fs.writeFileSync(path.join(packageRoot, "agents", "codex-exec.md"), `---\nname: codex-exec\npackage: unsafe-mode\ndescription: Unsafe package local name\nrunner:\n  type: external-cli\n  adapter: codex-exec-writer\n  command: codex\n---\nWrite.\n`);
+			fs.writeFileSync(path.join(project, ".selesai", "agents", "project-writer.md"), `---\nname: project-writer\naliases: codex-exec\ndescription: Unsafe project alias\nrunner:\n  type: external-cli\n  adapter: codex-exec-writer\n  command: codex\n---\nWrite.\n`);
+			fs.writeFileSync(path.join(userRoot, "agents", "codex-exec.md"), `---\nname: codex-exec\ndescription: Unsafe user shadow\nrunner:\n  type: external-cli\n  adapter: codex-exec-writer\n  command: codex\n---\nWrite.\n`);
+
+			const all = discoverAgentsAll(project);
+			for (const [source, name] of [["package", "codex-exec"], ["project", "project-writer"], ["user", "codex-exec"]] as const) {
+				assert.match(all.agentDiagnostics?.find((diagnostic) => diagnostic.source === source && diagnostic.name === name)?.error ?? "", /Selection name 'codex-exec' is reserved/);
+			}
+			const effective = discoverAgents(project, "both").agents;
+			assert.equal(resolveAgentName("codex-exec", effective).agent, undefined);
+			assert.equal(resolveAgentName("codex-exec-writer", effective).agent?.runner?.type === "external-cli" ? resolveAgentName("codex-exec-writer", effective).agent?.runner?.adapter : undefined, "codex-exec-writer");
+		} finally {
+			if (oldAgentDir === undefined) delete process.env.SELESAI_CODING_AGENT_DIR;
+			else process.env.SELESAI_CODING_AGENT_DIR = oldAgentDir;
+		}
+	});
+});

package/dist/extensions/pi-subagents/test/unit/compaction-resume.test.ts

@@ -68,4 +68,31 @@ describe("async compaction resume", () => {
 		execFileSync(process.execPath, ["--experimental-strip-types", "--import", "./test/support/register-loader.mjs", "--input-type=module", "--eval", script], { cwd: projectRoot, env, stdio: "pipe" });
 		assert.ok(true);
 	});
+
+	it("ignores stale cached UI context during compaction lifecycle callbacks", () => {
+		const script = String.raw`
+			import registerSubagentExtension from "./index.ts";
+			const handlers = new Map();
+			const events = { listeners: new Map(), on(name, handler) { this.listeners.set(name, handler); return () => this.listeners.delete(name); }, emit(name, payload) { this.listeners.get(name)?.(payload); } };
+			const pi = new Proxy({
+				events,
+				on(name, handler) { handlers.set(name, handler); },
+				registerTool() {}, registerCommand() {}, registerShortcut() {}, registerMessageRenderer() {},
+				sendMessage() {}, getSessionName() { return undefined; },
+			}, { get(target, prop) { return prop in target ? target[prop] : () => undefined; } });
+			let stale = false;
+			const ctx = { cwd: process.cwd(), get hasUI() { if (stale) throw new Error("This extension ctx is stale after session replacement or reload."); return true; }, ui: { setWidget() {}, requestRender() {}, onTerminalInput() { return () => {}; }, getEditorText() { return ""; }, notify() {}, theme: { fg(_name, text) { return text; }, bg(_name, text) { return text; }, bold(text) { return text; } } }, sessionManager: { getSessionId() { return "stale-context-session"; }, getSessionFile() { return null; }, getEntries() { return []; } }, modelRegistry: { getAvailable() { return []; } } };
+			registerSubagentExtension(pi);
+			handlers.get("session_start")({}, ctx);
+			events.emit("subagent:async-started", { id: "running", sessionId: "stale-context-session", mode: "single", agent: "worker", asyncDir: "/tmp/pi-stale-context-running" });
+			stale = true;
+			handlers.get("session_compact")({ reason: "threshold" });
+			handlers.get("session_before_compact")({ reason: "threshold", signal: new AbortController().signal });
+			await handlers.get("session_shutdown")();
+		`;
+		const env = { ...process.env };
+		delete env.SELESAI_SUBAGENT_CHILD;
+		execFileSync(process.execPath, ["--experimental-strip-types", "--import", "./test/support/register-loader.mjs", "--input-type=module", "--eval", script], { cwd: projectRoot, env, stdio: "pipe" });
+		assert.ok(true);
+	});
 });

package/dist/extensions/pi-subagents/test/unit/completion-evidence.test.ts

@@ -0,0 +1,150 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+	MISSING_IMPLEMENTATION_MUTATION_ERROR,
+	MISSING_IMPLEMENTATION_MUTATION_MESSAGE,
+	planCompletionEvidence,
+	projectSettlementDiagnostic,
+} from "../../src/runs/shared/completion-evidence.ts";
+
+const evidence = {
+	source: "tracked-files" as const,
+	trackedOnly: true as const,
+	changedFiles: [],
+	attemptedMutation: false,
+};
+
+describe("planCompletionEvidence", () => {
+	it("fails closed when expected mutation evidence is missing", () => {
+		const plan = planCompletionEvidence({
+			guard: { expectedMutation: true, attemptedMutation: false, triggered: true, blocked: false },
+			completionGuardEnabled: true,
+			mutationCapable: true,
+			implementationMutationExpected: true,
+			mutationAttemptObserved: false,
+			mutationEvidence: evidence,
+			agentContractV1: false,
+		});
+
+		assert.equal(plan.guardTriggered, true);
+		assert.equal(plan.legacyFailureError, MISSING_IMPLEMENTATION_MUTATION_ERROR);
+		assert.deepEqual(plan.fileMutation, {
+			status: "missing",
+			expected: true,
+			attempted: false,
+			evidence,
+			message: MISSING_IMPLEMENTATION_MUTATION_MESSAGE,
+		});
+	});
+
+	it("keeps agent contract v1 rejection in evidence without forcing execution failure", () => {
+		const plan = planCompletionEvidence({
+			guard: { expectedMutation: true, attemptedMutation: false, triggered: true, blocked: false },
+			completionGuardEnabled: true,
+			mutationCapable: true,
+			implementationMutationExpected: true,
+			mutationAttemptObserved: false,
+			agentContractV1: true,
+		});
+
+		assert.equal(plan.guardTriggered, true);
+		assert.equal(plan.fileMutation?.status, "missing");
+		assert.equal(plan.legacyFailureError, undefined);
+	});
+
+	it("projects blocked tool availability and arbiter rescue consistently", () => {
+		const blocked = planCompletionEvidence({
+			guard: { expectedMutation: true, attemptedMutation: false, triggered: false, blocked: true, message: "tools unavailable" },
+			completionGuardEnabled: true,
+			mutationCapable: false,
+			implementationMutationExpected: true,
+			mutationAttemptObserved: true,
+			agentContractV1: false,
+		});
+		assert.deepEqual(blocked.fileMutation, {
+			status: "blocked",
+			expected: true,
+			attempted: false,
+			message: "tools unavailable",
+		});
+		assert.equal(blocked.mutationAttempted, true);
+		assert.deepEqual(projectSettlementDiagnostic(blocked, {
+			terminalFailed: true,
+			finalTextPresent: false,
+			mutationObserved: true,
+		}), {
+			finalTextPresent: false,
+			mutation: { expected: true, attempted: true, observed: true },
+			afterCompactionSettlement: false,
+		});
+
+		const rescued = planCompletionEvidence({
+			guard: { expectedMutation: true, attemptedMutation: false, triggered: true, blocked: false },
+			guardTriggered: false,
+			completionGuardEnabled: true,
+			mutationCapable: true,
+			implementationMutationExpected: true,
+			mutationAttemptObserved: false,
+			arbiterRescued: true,
+			agentContractV1: false,
+		});
+		assert.deepEqual(rescued.fileMutation, {
+			status: "not-applicable",
+			expected: true,
+			attempted: false,
+			resolvedBy: "llm-intent-arbiter",
+		});
+		assert.equal(rescued.legacyFailureError, undefined);
+	});
+
+	it("derives fallback expectation when terminal failure prevents guard evaluation", () => {
+		const plan = planCompletionEvidence({
+			completionGuardEnabled: true,
+			mutationCapable: true,
+			implementationMutationExpected: true,
+			mutationAttemptObserved: false,
+			agentContractV1: false,
+		});
+		assert.equal(plan.mutationExpected, true);
+		assert.equal(plan.fileMutation, undefined);
+	});
+});
+
+describe("projectSettlementDiagnostic", () => {
+	it("emits explicit missing-output and mutation evidence on terminal failure", () => {
+		const plan = planCompletionEvidence({
+			completionGuardEnabled: true,
+			mutationCapable: true,
+			implementationMutationExpected: true,
+			mutationAttemptObserved: false,
+			agentContractV1: false,
+		});
+		assert.deepEqual(projectSettlementDiagnostic(plan, {
+			terminalFailed: true,
+			finalTextPresent: false,
+			mutationObserved: false,
+			requiredOutput: { kind: "file-only", path: "/tmp/report.md", missing: true },
+			afterCompactionSettlement: false,
+		}), {
+			finalTextPresent: false,
+			mutation: { expected: true, attempted: false, observed: false },
+			requiredOutput: { kind: "file-only", path: "/tmp/report.md", missing: true },
+			afterCompactionSettlement: false,
+		});
+	});
+
+	it("omits diagnostics for accepted completion with no guard finding", () => {
+		const plan = planCompletionEvidence({
+			completionGuardEnabled: false,
+			mutationCapable: false,
+			implementationMutationExpected: false,
+			mutationAttemptObserved: false,
+			agentContractV1: false,
+		});
+		assert.equal(projectSettlementDiagnostic(plan, {
+			terminalFailed: false,
+			finalTextPresent: true,
+			mutationObserved: false,
+		}), undefined);
+	});
+});