@sweny-ai/core 0.1.142 → 0.1.144

package/dist/harness/claude-code.js

@@ -12,13 +12,15 @@ import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude
 import { createRequire } from "node:module";
 import { consoleLogger } from "../types.js";
 import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "../agent-env.js";
-import { fenceUntrustedJson } from "../untrusted.js";
 import { policyGate } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
-import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt } from "./prompts.js";
+import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt, buildNodePrompt } from "./prompts.js";
 import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } from "./tool-bridge/protocol.js";
 import { startToolBridge } from "./tool-bridge/server.js";
+import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
+import { makeAbort } from "./abort.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
+export { parseToolResultContent, summarizeToolError, makeAbort };
 let cachedSdkVersion;
 /** Version of the Claude Agent SDK this adapter drives; "unknown" when it cannot be read. */
 function claudeSdkVersion() {
@@ -72,6 +74,28 @@ export const READ_ONLY_DISALLOWED_TOOLS = [
     "Agent",
     "WebFetch",
 ];
+/**
+ * Claude Code built-in tool names per portable tool class. A node's
+ * `tools.deny` classes compile to these names on `disallowedTools`.
+ */
+export const CLAUDE_TOOLS_BY_CLASS = {
+    shell: ["Bash"],
+    write: ["Write", "NotebookEdit"],
+    edit: ["Edit", "MultiEdit"],
+    net: ["WebFetch", "WebSearch"],
+    subagent: ["Task", "Agent"],
+};
+/** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
+export function compileClaudeCodeDeny(policy, legacy = []) {
+    return [
+        ...new Set([
+            ...legacy,
+            ...(policy.nativeDeny ?? []),
+            ...policy.deny.flatMap((c) => CLAUDE_TOOLS_BY_CLASS[c] ?? []),
+            ...(policy.readOnly ? READ_ONLY_DISALLOWED_TOOLS : []),
+        ]),
+    ];
+}
 /**
  * Decide which auth credentials survive into the Claude Code subprocess env.
  *
@@ -131,56 +155,6 @@ export function resolveAuthEnv(env, opts = {}) {
     opts.logger?.debug?.(`[sweny] auth mode: ${mode}`);
     return out;
 }
-/**
- * Wire an optional timeout + caller signal onto a single AbortController.
- *
- * Returns undefined when neither a timeout nor a signal is supplied so the
- * default code path (no abortController, no timer) is byte-for-byte unchanged.
- *
- * `reason()` reports whether the abort came from the timeout timer or an
- * external signal, so callers can log a distinct timeout message.
- */
-export function makeAbort(timeoutMs, signal) {
-    if (!timeoutMs && !signal)
-        return undefined;
-    const controller = new AbortController();
-    let reason;
-    let timer;
-    const onSignalAbort = () => {
-        if (controller.signal.aborted)
-            return;
-        reason = "signal";
-        controller.abort();
-    };
-    if (signal) {
-        if (signal.aborted) {
-            reason = "signal";
-            controller.abort();
-        }
-        else {
-            signal.addEventListener("abort", onSignalAbort, { once: true });
-        }
-    }
-    if (timeoutMs && timeoutMs > 0 && !controller.signal.aborted) {
-        timer = setTimeout(() => {
-            if (controller.signal.aborted)
-                return;
-            reason = "timeout";
-            controller.abort();
-        }, timeoutMs);
-        // Don't keep the event loop alive just for the abort timer.
-        timer?.unref?.();
-    }
-    return {
-        controller,
-        reason: () => reason,
-        clear: () => {
-            if (timer)
-                clearTimeout(timer);
-            signal?.removeEventListener("abort", onSignalAbort);
-        },
-    };
-}
 /**
  * Best-effort interrupt of an SDK query stream. Called from `finally` so an
  * early return / timeout / throw does not leak the underlying subprocess.
@@ -290,20 +264,44 @@ export class ClaudeCodeHarness {
         return { ok: true, version: claudeSdkVersion() };
     }
     /**
-     * Run a node. The query itself is unchanged by the harness seam; this only
-     * runs {@link policyGate} (always `degraded: []` for Claude Code) and tags
-     * the result with the harness id and version.
+     * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
+     * Code), compiles the policy to native options, and tags the result with the
+     * harness id and version.
+     *
+     * Policy compile (#365): `policy.readOnly` (or the legacy `readOnly` flag)
+     * is a read-only run; `policy.deny` classes become native `disallowedTools`
+     * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
+     * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
+     * write-capable node.
      */
     async run(req) {
         const policy = req.policy ?? {
             readOnly: !!req.readOnly,
-            deny: [],
+            deny: req.deny ?? [],
             nativeDeny: req.disallowedTools,
             egress: req.agentAccess?.domains ?? [],
             strict: false,
         };
         const gate = policyGate(this.capabilities, policy);
-        const result = await this.runQuery(req);
+        if (gate.refuse) {
+            this.logger.error(gate.refuse);
+            return {
+                status: "failed",
+                // `refused` keeps fail_soft from softening a policy refusal (executor.ts).
+                data: { error: gate.refuse, refused: true },
+                toolCalls: [],
+                harness: this.info(),
+                degraded: gate.degraded,
+            };
+        }
+        const readOnly = !!req.readOnly || policy.readOnly;
+        const disallowedTools = compileClaudeCodeDeny(policy, req.disallowedTools ?? []);
+        const result = await this.runQuery({
+            ...req,
+            readOnly,
+            disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
+            strictMcp: readOnly || policy.strict,
+        });
         return { ...result, harness: this.info(), degraded: gate.degraded };
     }
     async runQuery(opts) {
@@ -371,15 +369,7 @@ export class ClaudeCodeHarness {
         let bridge;
         // Build prompt. Context (workflow input such as issues/alerts, plus prior
         // node outputs) is fenced as untrusted data (#360).
-        const prompt = [
-            `## Instruction\n\n${instruction}`,
-            `## Context\n\n${fenceUntrustedJson(context, "context")}`,
-            outputSchema
-                ? `## Required Output\n\nYou MUST end with a JSON object matching this schema:\n\`\`\`json\n${JSON.stringify(outputSchema, null, 2)}\n\`\`\``
-                : "",
-        ]
-            .filter(Boolean)
-            .join("\n\n");
+        const prompt = buildNodePrompt(instruction, context, outputSchema);
         const env = this.buildEnv(agentAccess?.envVars);
         let response = "";
         // CC-08: when the SDK populates typed structured output (because we passed
@@ -438,7 +428,8 @@ export class ClaudeCodeHarness {
                     // project and local settings, including their MCP servers (and
                     // project .mcp.json, plugins). strictMcpConfig limits MCP to the
                     // servers passed above, which under readOnly is only sweny-core.
-                    ...(readOnly ? { strictMcpConfig: true } : {}),
+                    // A strict policy (#365) makes it exclusive for write nodes too.
+                    ...(readOnly || opts.strictMcp ? { strictMcpConfig: true } : {}),
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed
@@ -749,112 +740,6 @@ export function coreToolToSdkTool(coreTool, defaultCtx) {
         }
     });
 }
-/**
- * Best-effort recovery of typed output from a tool_result's `content`.
- *
- * The MCP protocol sends tool results as string content. Our in-process
- * wrapper JSON-stringifies structured output before returning; external
- * MCP servers generally do the same for JSON payloads. If the string
- * looks like a JSON object or array and parses, return the parsed value
- * so verify's output-path walks work against typed data.
- *
- * Raw strings are preserved verbatim. JSON-primitive strings (e.g. the
- * literal four characters `"42"`) are intentionally NOT parsed - we
- * cannot distinguish a tool that returned the number 42 (wrapper sends
- * `"42"`) from a tool that returned the string "42" (wrapper also sends
- * `"42"`). Preserving the string is safer than guessing.
- */
-export function parseToolResultContent(content) {
-    // The Anthropic tool_result `content` field can be a block array
-    // (e.g. [{type:"text",text:"..."}, ...]) rather than a string. When it is,
-    // concatenate the text of every {type:"text"} block (recursing through any
-    // nested content), then run the same object/array JSON-parse logic on the
-    // joined string. This keeps `call.output` the actual payload instead of the
-    // raw wrapper array that eval/route logic would otherwise have to walk.
-    if (Array.isArray(content)) {
-        const text = collectBlockText(content);
-        return parseJsonObjectOrArray(text);
-    }
-    if (typeof content !== "string")
-        return content;
-    return parseJsonObjectOrArray(content);
-}
-/**
- * Parse a string only when it is an unambiguous JSON object or array.
- *
- * Strings, numbers, booleans, and null would all corrupt or discard
- * information (we cannot distinguish the literal text `"42"` from the number
- * 42), so non-object/array inputs are preserved verbatim.
- */
-function parseJsonObjectOrArray(content) {
-    const trimmed = content.trim();
-    if (trimmed.length === 0)
-        return content;
-    const first = trimmed[0];
-    if (first !== "{" && first !== "[")
-        return content;
-    try {
-        return JSON.parse(trimmed);
-    }
-    catch {
-        return content;
-    }
-}
-/**
- * Concatenate the text of an array of content blocks. Handles {type:"text"}
- * blocks and recurses into any nested `content` array so deeply-wrapped tool
- * results still flatten to their underlying text.
- */
-function collectBlockText(blocks) {
-    const parts = [];
-    for (const block of blocks) {
-        if (typeof block === "string") {
-            parts.push(block);
-            continue;
-        }
-        if (!block || typeof block !== "object")
-            continue;
-        const b = block;
-        if (b.type === "text" && typeof b.text === "string") {
-            parts.push(b.text);
-        }
-        else if (Array.isArray(b.content)) {
-            parts.push(collectBlockText(b.content));
-        }
-        else if (typeof b.text === "string") {
-            // Some producers omit an explicit type but still carry text.
-            parts.push(b.text);
-        }
-    }
-    return parts.join("");
-}
-/**
- * Produce a short, single-line description of a tool-error payload suitable
- * for the CI log stream. The full parsed value stays on the ToolCall for
- * verify and downstream tooling - this is only for inline observability.
- *
- * Collapses newlines, trims whitespace, and caps to 300 chars so a huge
- * API response body doesn't flood the log.
- */
-export function summarizeToolError(parsed) {
-    let raw;
-    if (typeof parsed === "string") {
-        raw = parsed;
-    }
-    else if (parsed && typeof parsed === "object") {
-        try {
-            raw = JSON.stringify(parsed);
-        }
-        catch {
-            raw = String(parsed);
-        }
-    }
-    else {
-        raw = String(parsed);
-    }
-    const collapsed = raw.replace(/\s+/g, " ").trim();
-    return collapsed.length > 300 ? collapsed.slice(0, 297) + "..." : collapsed;
-}
 /** Strip MCP server prefix: "mcp__server__tool" → "tool" */
 function stripMcpPrefix(name) {
     const parts = name.split("__");
@@ -862,142 +747,3 @@ function stripMcpPrefix(name) {
         return parts.slice(2).join("__");
     return name;
 }
-// ─── JSON extraction ────────────────────────────────────────────
-/**
- * Extract a JSON object from Claude's text response.
- *
- * Strategy (in order):
- * 1. LAST ```json code block``` - models put their real final answer last, so
- *    a prompt-injected fake fenced block placed earlier must not win.
- * 2. Last brace-delimited `{...}` block - handles inline JSON at end of text
- * 3. Full text parse - for responses that are pure JSON
- * 4. Empty object - safe fallback
- *
- * When `outputSchema` is supplied, the parsed object is checked against it.
- * A mismatch is logged (warning) rather than silently accepted, so a
- * non-conforming model answer is at least attributable.
- */
-function tryParseJSON(text, outputSchema, logger) {
-    if (!text)
-        return {};
-    const finalize = (parsed) => {
-        if (outputSchema) {
-            const problems = schemaMismatches(parsed, outputSchema);
-            if (problems.length > 0) {
-                logger?.warn?.(`Claude output did not conform to outputSchema: ${problems.join("; ")}`);
-            }
-        }
-        return parsed;
-    };
-    // 1. Code block - scan ALL fenced blocks, prefer the LAST that parses.
-    const fences = [...text.matchAll(/```(?:json)?\s*([\s\S]*?)```/g)];
-    for (let i = fences.length - 1; i >= 0; i--) {
-        try {
-            const parsed = JSON.parse(fences[i][1].trim());
-            if (typeof parsed === "object" && parsed !== null)
-                return finalize(parsed);
-        }
-        catch {
-            /* try the next-earlier fence, then fall through to brace scan */
-        }
-    }
-    // 2. Last brace-delimited block (scan backwards for matching braces)
-    const lastBrace = text.lastIndexOf("}");
-    if (lastBrace !== -1) {
-        let depth = 0;
-        for (let i = lastBrace; i >= 0; i--) {
-            if (text[i] === "}")
-                depth++;
-            else if (text[i] === "{")
-                depth--;
-            if (depth === 0) {
-                try {
-                    const parsed = JSON.parse(text.slice(i, lastBrace + 1));
-                    if (typeof parsed === "object" && parsed !== null)
-                        return finalize(parsed);
-                }
-                catch {
-                    /* try next strategy */
-                }
-                break;
-            }
-        }
-    }
-    // 3. Full text parse
-    try {
-        const parsed = JSON.parse(text.trim());
-        if (typeof parsed === "object" && parsed !== null)
-            return finalize(parsed);
-    }
-    catch {
-        /* fall through */
-    }
-    return {};
-}
-/**
- * Lightweight structural check of a parsed object against a JSON Schema.
- *
- * Deliberately shallow: it verifies `required` keys are present and that the
- * top-level `type` and each declared property `type` match. It does NOT do
- * full JSON Schema validation (no `$ref`, `oneOf`, formats, nested arrays).
- * The contract here is "flag an obviously non-conforming object" so a mismatch
- * is logged rather than silently accepted; it is not a validation gate.
- *
- * Returns a list of human-readable problems; empty means no detected mismatch.
- */
-function schemaMismatches(value, schema) {
-    const problems = [];
-    const s = schema;
-    if (s.type === "object" || s.properties || s.required) {
-        if (typeof value !== "object" || value === null || Array.isArray(value)) {
-            return [`expected an object, got ${Array.isArray(value) ? "array" : typeof value}`];
-        }
-        const obj = value;
-        const required = Array.isArray(s.required) ? s.required : [];
-        for (const key of required) {
-            if (!(key in obj) || obj[key] === undefined) {
-                problems.push(`missing required property "${key}"`);
-            }
-        }
-        const props = s.properties ?? {};
-        for (const [key, propSchema] of Object.entries(props)) {
-            if (!(key in obj) || obj[key] === undefined || obj[key] === null)
-                continue;
-            const expected = propSchema?.type;
-            if (typeof expected === "string" && !jsonTypeMatches(obj[key], expected)) {
-                problems.push(`property "${key}" expected ${expected}, got ${jsonTypeOf(obj[key])}`);
-            }
-        }
-    }
-    else if (typeof s.type === "string" && !jsonTypeMatches(value, s.type)) {
-        problems.push(`expected ${s.type}, got ${jsonTypeOf(value)}`);
-    }
-    return problems;
-}
-function jsonTypeOf(value) {
-    if (value === null)
-        return "null";
-    if (Array.isArray(value))
-        return "array";
-    return typeof value;
-}
-function jsonTypeMatches(value, expected) {
-    switch (expected) {
-        case "object":
-            return typeof value === "object" && value !== null && !Array.isArray(value);
-        case "array":
-            return Array.isArray(value);
-        case "string":
-            return typeof value === "string";
-        case "number":
-            return typeof value === "number";
-        case "integer":
-            return typeof value === "number" && Number.isInteger(value);
-        case "boolean":
-            return typeof value === "boolean";
-        case "null":
-            return value === null;
-        default:
-            return true; // unknown/unsupported type keyword - don't flag
-    }
-}

package/dist/harness/codex.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Codex harness (#331): runs a node on OpenAI Codex through `codex exec --json`.
+ *
+ * Interfaces used, all read from openai/codex at rust-v0.159.2:
+ * - `codex-rs/exec/src/cli.rs`: `exec --json`, `--output-schema <file>`,
+ *   `--ignore-user-config`, `--ignore-rules`, `--ephemeral`,
+ *   `--skip-git-repo-check`, `--sandbox`, `--cd`, `--model`, `-c key=value`,
+ *   prompt on stdin with `-`.
+ * - `codex-rs/exec/src/exec_events.rs`: the JSONL events (`thread.started`,
+ *   `turn.started|completed|failed`, `item.started|updated|completed`,
+ *   `error`) and item kinds.
+ * - `sdk/typescript/src/exec.ts`: how the official SDK spawns the same CLI
+ *   (config overrides as TOML values, stdin prompt, exit handling).
+ * - `codex-rs/core/config.schema.json`: `features.*`, `web_search`,
+ *   `agents.enabled`, `sandbox_workspace_write.network_access`,
+ *   `mcp_servers.<id>.{command,args,env,env_vars,url,http_headers,...}`.
+ * - `codex-rs/rmcp-client/src/utils.rs`: an MCP stdio server gets only a
+ *   small default env plus the names listed in `env_vars`, so the tool
+ *   bridge token travels by name, never in argv.
+ *
+ * Every sweny opinion in the Codex column of the enforcement matrix is
+ * enforced natively here, kept by sweny (watchdog, fencing, env scoping,
+ * output validation), reported in `degraded`, or refused under strict policy
+ * by `policyGate`. Nothing is dropped silently.
+ */
+import type { Logger, McpServerConfig, ToolContext } from "../types.js";
+import { type SandboxMode } from "../agent-env.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import { CODEX_CAPABILITIES } from "./capabilities.js";
+import { type HarnessPolicyMode } from "./policy.js";
+import { type SandboxWrapper } from "./sandbox-wrapper.js";
+export { CODEX_CAPABILITIES };
+/** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
+export declare const MIN_CODEX_VERSION = "0.159.0";
+/**
+ * Codex features sweny always turns off, so a node sees only the tools sweny
+ * gave it: ChatGPT apps and plugins (their own MCP servers), tool suggestions,
+ * browser and computer use, lifecycle hooks, and image generation. Keys from
+ * `codex-rs/features/src/lib.rs` at rust-v0.159.2.
+ */
+export declare const CODEX_ISOLATION_FEATURES_OFF: readonly ["apps", "plugins", "tool_suggest", "browser_use", "computer_use", "hooks", "image_generation"];
+/**
+ * Hosts Codex itself needs (its model API and ChatGPT sign-in), always allowed
+ * through the sandbox wrapper, plus the host of `OPENAI_BASE_URL` when set.
+ */
+export declare function codexBackendHosts(env?: Record<string, string | undefined>): string[];
+export interface CodexHarnessOptions {
+    /** Model override (`--model`). Free text; sweny has no model opinion. */
+    model?: string;
+    /** Tool-call budget the watchdog enforces when a node sets no `max_turns` (default: 20). */
+    maxTurns?: number;
+    /** Working directory (default: process.cwd()). */
+    cwd?: string;
+    logger?: Logger;
+    /** Default tool context for standalone usage (not via the executor). */
+    defaultContext?: ToolContext;
+    /** Catalog defaults, overridden by per-run skill servers and explicit mcpServers. */
+    defaultMcpServers?: Record<string, McpServerConfig>;
+    /** Explicit external MCP servers, overriding defaults and per-run skill servers. */
+    mcpServers?: Record<string, McpServerConfig>;
+    /** Extra env var names passed through (see agent-env.ts). Default: `SWENY_ENV_PASSTHROUGH`. */
+    envPassthrough?: string[];
+    /** Scope the Codex env to the allowlist. Default: `SWENY_ENV_SCOPE`, else on in CI. */
+    envScope?: boolean;
+    /**
+     * Codex sandbox for commands: `strict` = `workspace-write` or fail, `auto` =
+     * `workspace-write` when the host can sandbox, `off` = `danger-full-access`.
+     * Default: `SWENY_SANDBOX`, else `auto` in CI and `off` locally.
+     */
+    sandbox?: SandboxMode;
+    /** Sandbox preflight probe (test seam). Returns a reason when the host cannot sandbox. */
+    sandboxProbe?: () => string | undefined;
+    /**
+     * The host's process sandbox wrapper (#360 step 2). `undefined` = detect
+     * srt once per process; `null` = none (test seam).
+     */
+    sandboxWrapper?: SandboxWrapper | null;
+    /** `strict` refuses a node with unenforceable opinions. Default: {@link resolveHarnessPolicy}. */
+    policy?: HarnessPolicyMode;
+    /** The Codex CLI. Default: `SWENY_CODEX_PATH`, else `codex` on PATH. Test seam for the fake. */
+    codexCommand?: {
+        command: string;
+        args: string[];
+    };
+    /** Shim command override for the tool bridge (test seam). */
+    toolBridgeShim?: {
+        command: string;
+        args: string[];
+    };
+    /** Grace period between SIGTERM and SIGKILL when stopping Codex (default: 2000 ms). */
+    killGraceMs?: number;
+}
+/** A TOML value for `-c key=value`, as the official SDK writes it (sdk/typescript/src/exec.ts). */
+export declare function toTomlValue(value: unknown): string;
+/**
+ * Split `disallowed_tools` names into portable classes Codex can act on and
+ * the names it has no tool for.
+ */
+export declare function translateDenyNames(names?: readonly string[]): {
+    classes: ToolClass[];
+    unknown: string[];
+};
+/**
+ * Is this JSON schema accepted by OpenAI strict structured outputs? Codex
+ * sends `--output-schema` with `strict: true` (core/src/session/turn.rs), which
+ * requires `additionalProperties: false` and every property listed in
+ * `required` on every object. Not a full check; it catches the common misses.
+ */
+export declare function isStrictCompatibleSchema(schema: unknown): boolean;
+export declare class CodexHarness implements AgentHarness {
+    readonly id: "codex";
+    readonly capabilities: HarnessCapabilities;
+    /**
+     * Empty on purpose: judges use Codex's own default model. Leaving this
+     * undefined would fall back to the Claude judge model, which Codex cannot run.
+     */
+    readonly defaultJudgeModel = "";
+    readonly logger: Logger;
+    private model;
+    private maxTurns;
+    private cwd;
+    private defaultContext;
+    private mcpServers;
+    private defaultMcpServers;
+    private envPassthrough;
+    private envScope;
+    private sandboxMode;
+    private sandboxProbe;
+    private sandboxWarned;
+    private sandboxWrapper;
+    private loginWarned;
+    private policyMode;
+    private codexCommand;
+    private toolBridgeShim;
+    private killGraceMs;
+    private preflightResult;
+    private version;
+    constructor(opts?: CodexHarnessOptions);
+    info(): HarnessInfo;
+    /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
+    preflight(): Promise<{
+        ok: true;
+        version: string;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Env for the Codex process: scoped like Claude Code's, with Codex's auth vars instead of Anthropic's. */
+    private buildEnv;
+    /** The node policy after `disallowed_tools` names are translated into Codex classes. */
+    private compilePolicy;
+    /** Resolve the Codex `--sandbox` value for a normal (not read-only) run. */
+    private resolveSandbox;
+    /** argv shared by run() and complete(). */
+    private baseArgs;
+    /** `-c mcp_servers.<id>.*` for each server. Returns the args and anything Codex cannot load. */
+    private mcpArgs;
+    /** Spawn codex exec, feed the prompt on stdin, and read JSONL until it exits. */
+    private exec;
+    /**
+     * Run a node. The gate runs first: in strict mode a node whose opinions
+     * Codex cannot honor is refused before Codex starts. With a sandbox mode
+     * other than off, the whole Codex process runs inside the host's process
+     * sandbox wrapper (#360 step 2) when there is one, which also keeps the
+     * node's per-host egress allowlist that Codex cannot keep itself.
+     */
+    run(req: HarnessRunRequest): Promise<HarnessRunResult>;
+    /** Map one exec outcome onto a NodeResult with Claude Code's semantics. */
+    private toResult;
+    /**
+     * One completion: read-only sandbox, no shell, no web search, no subagents,
+     * no MCP. null when it failed (callers fail closed).
+     */
+    complete(req: HarnessCompleteRequest): Promise<string | null>;
+}