@tangle-network/agent-provider-cli-bridge 2.0.10 → 2.0.11

package/dist/sandbox/box.d.ts

@@ -20,7 +20,7 @@ export declare const BOX_NODE_IMAGE = "node:24.22.1-trixie-slim";
  */
 export declare const BOX_PINS: {
     readonly cliBridgeRepository: "drewstone/cli-bridge";
-    readonly cliBridgeCommit: "263f700dc5ca8b7b6e53b986d376102e0d82b42f";
+    readonly cliBridgeCommit: "de0ca4d7a426d77f8aa8bc373bf98e8fb92e9da2";
     readonly agentProfileMaterialize: "1.1.4";
 };
 /** The E2B template and Daytona snapshot name `pnpm build:sandbox-image` publishes for these pins. */

package/dist/sandbox/box.js

@@ -1,4 +1,4 @@
-import { HARNESSES } from "@tangle-network/cli-agent-registry";
+import { HARNESSES, MANAGED_MODEL_LADDER } from "@tangle-network/cli-agent-registry";
 /**
  * The box: one image every cloud runs, holding Node, CLI Bridge and the pinned
  * harness CLIs. The Bridge listens on {@link BRIDGE_PORT}, materializes the
@@ -20,12 +20,11 @@ export const BOX_NODE_IMAGE = "node:24.22.1-trixie-slim";
  */
 export const BOX_PINS = {
     cliBridgeRepository: "drewstone/cli-bridge",
-    cliBridgeCommit: "263f700dc5ca8b7b6e53b986d376102e0d82b42f",
+    cliBridgeCommit: "de0ca4d7a426d77f8aa8bc373bf98e8fb92e9da2",
     agentProfileMaterialize: "1.1.4",
 };
 /** The E2B template and Daytona snapshot name `pnpm build:sandbox-image` publishes for these pins. */
 export const BOX_TEMPLATE_NAME = `tangle-cli-bridge-box-${BOX_PINS.cliBridgeCommit.slice(0, 12)}`;
-const unproven = { reason: "no live Router turn in a box yet", owner: "tangle-network/agent-sdk" };
 const noBridgeBackend = { reason: `CLI Bridge ${BOX_PINS.cliBridgeCommit.slice(0, 12)} registers no backend for it`, owner: BOX_PINS.cliBridgeRepository };
 /**
  * Every Router-eligible catalog harness, as a recipe or an exclusion; the type
@@ -35,8 +34,8 @@ const noBridgeBackend = { reason: `CLI Bridge ${BOX_PINS.cliBridgeCommit.slice(0
 const BOX_ROWS = {
     // The Router authenticates a Bearer token. ANTHROPIC_API_KEY sends x-api-key, which it rejects.
     "claude-code": { bridgeBackend: "claude", npmPackage: "@anthropic-ai/claude-code", routerEnv: (router) => ({ ANTHROPIC_BASE_URL: router.baseUrl, ANTHROPIC_AUTH_TOKEN: router.key }) },
-    codex: unproven,
-    opencode: unproven,
+    codex: { bridgeBackend: "codex", npmPackage: "@openai/codex", routerEnv: (router) => ({ CODEX_TANGLE_ROUTER_URL: `${router.baseUrl}/v1`, TANGLE_API_KEY: router.key }) }, // the Bridge turns this env into a codex model_providers entry (wire_api "responses", env_key TANGLE_API_KEY) and passes the Router slug whole; the live suite pins the dial against a key-rejecting listener in the box
+    opencode: { bridgeBackend: "opencode", npmPackage: "opencode-ai", routerEnv: (router) => ({ TANGLE_API_KEY: router.key, OPENCODE_CONFIG_CONTENT: JSON.stringify({ provider: MANAGED_MODEL_LADDER.reduce((providers, { id }) => { const [provider, ...model] = id.split("/"); (providers[provider] ??= { npm: "@ai-sdk/openai-compatible", options: { baseURL: `${router.baseUrl}/v1`, apiKey: "{env:TANGLE_API_KEY}" }, models: {} }).models[model.join("/")] = { id }; return providers; }, {}) }) }) }, // opencode resolves only configured models; the Bridge merges this config under each profile's, routing every Router-servable `<provider>/<model>` through the Router's chat wire.
     pi: { reason: `CLI Bridge ${BOX_PINS.cliBridgeCommit.slice(0, 12)} runs pi only in a bubblewrap fs-jail, which a Docker box cannot create (no user namespace; unconfined, --proc /proc is denied), and takes its endpoint only from a models.json file`, owner: BOX_PINS.cliBridgeRepository },
     "kimi-code": { reason: "the catalog pins Python kimi-cli 1.49.0, which refuses the Bridge's Kimi Code argv (`--output-format stream-json` without `--print`, exit 2); it joins once the catalog ports to npm @moonshot-ai/kimi-code (ops-board#10682)", owner: "tangle-network/agent-container (cli-agent-registry)" },
     prime: { reason: "not on npm, and the catalog publishes only its version: no tarball url, hash or pythonPackages to install prime-agent from", owner: "tangle-network/agent-container (cli-agent-registry)" },

package/dist/sandbox/provider.js

@@ -9,6 +9,7 @@ import { createCliBridgeProvider, defaultCliBridgeCapabilities } from "../index.
 import { BOX_WORKSPACE_DIR, BRIDGE_PORT, BRIDGE_START_COMMAND, bridgeProcessEnv, boxHarness, boxHarnessVersion, boxVersionCommand, boxVersionProbe, } from "./box.js";
 import { assertProfileValid, declarableHarnesses, plannerLowers, refuseUnsupportedCreateInput, resolveBoxHarness, validateBoxProfile } from "./refusal.js";
 import { assertForkableCheckpoint, createVendorSnapshot, forkCreateInput, } from "./checkpoint.js";
+import { pidListScript, turnSweepScript } from "./shell.js";
 export const BRIDGE_RUN_TAG = "tangle-bridge-run";
 const DEFAULT_LIFETIME_MS = 2 * 60 * 60 * 1000;
 const DEFAULT_READY_TIMEOUT_MS = 120_000;
@@ -36,7 +37,7 @@ export function createBridgeSandboxProvider(options) {
     const routerBaseUrl = (options.router.baseUrl ?? TANGLE_ROUTER_DEFAULT_ROOT_URL).replace(/\/+$/, "");
     const lifetimeMs = options.lifetimeMs ?? DEFAULT_LIFETIME_MS;
     const readyTimeoutMs = options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
-    const providerCapabilities = (harness) => environmentCapabilities(defaultCliBridgeCapabilities(harness), vendor, harness === undefined ? false : plannerLowers(harness, "hooks"));
+    const providerCapabilities = (harness) => environmentCapabilities(defaultCliBridgeCapabilities(harness), vendor, harness);
     async function create(input, restore) {
         input.signal?.throwIfAborted();
         refuseUnsupportedCreateInput(input, vendor.support);
@@ -103,7 +104,7 @@ export function createBridgeSandboxProvider(options) {
             });
             input.signal?.throwIfAborted();
             const forkFromCheckpoint = vendor.snapshots === undefined ? undefined : (checkpoint, request, signal) => create({ ...forkCreateInput(input, request), ...(signal === undefined ? {} : { signal }) }, { snapshot: checkpoint.id });
-            return wrapEnvironment({ inner, sandbox, vendor, harness, profile, workspaceDir, dispatcher, capabilities: environmentCapabilities(inner.capabilities ?? providerCapabilities(harness), vendor, plannerLowers(harness, "hooks")), input, ...(forkFromCheckpoint === undefined ? {} : { forkFromCheckpoint }) });
+            return wrapEnvironment({ inner, sandbox, vendor, harness, profile, workspaceDir, dispatcher, capabilities: environmentCapabilities(inner.capabilities ?? providerCapabilities(harness), vendor, harness), input, ...(forkFromCheckpoint === undefined ? {} : { forkFromCheckpoint }) });
         }
         catch (error) {
             await dispatcher?.close().catch(() => undefined);
@@ -271,12 +272,12 @@ function assertGetOptionsSupported(options) {
         }
     }
 }
-/** The document for one environment: what the Bridge claims, plus the vendor sandbox's workspace and placement. */
-function environmentCapabilities(bridge, vendor, hooks) {
+/** The document for one environment: what the Bridge claims, plus the vendor sandbox's workspace and placement. The profile's hooks, permissions and subagents axes claim only what the pinned planner lowers for the harness. */
+function environmentCapabilities(bridge, vendor, harness) {
     const { retainedControl: _retained, nativeContinuation: _native, contextTransfer: _transfer, interactions: _interactions, observation: _observation, ...base } = bridge;
     return {
         ...base,
-        profile: { ...base.profile, validation: true, hooks: hooks === true },
+        profile: { ...base.profile, validation: true, ...(harness === undefined ? {} : { hooks: plannerLowers(harness, "hooks"), permissions: plannerLowers(harness, "permissions"), subagents: plannerLowers(harness, "subagents") }) },
         workspace: { read: true, write: true, exec: true, git: false, upload: false, download: false, cwdBases: { repository: true, host: false } },
         branching: { checkpoint: vendor.snapshots !== undefined, fork: vendor.snapshots !== undefined },
         placement: true,
@@ -341,6 +342,9 @@ function wrapEnvironment(args) {
         if (busy)
             throw new EnvironmentProviderError("conflict", "a turn is already running on this environment", { provider: vendor.name });
         busy = true;
+        const baseline = await sandbox.exec(pidListScript(), { timeoutMs: 15_000 })
+            .then((result) => (result.exitCode === 0 ? result.stdout.split(/\s+/).filter(Boolean) : undefined))
+            .catch(() => undefined);
         try {
             yield* projectTurn(inner, checked, checked.model ?? args.profile.model?.default);
         }
@@ -352,6 +356,8 @@ function wrapEnvironment(args) {
             throw error;
         }
         finally {
+            if (baseline !== undefined)
+                await sandbox.exec(turnSweepScript(baseline), { timeoutMs: 30_000 }).catch(() => undefined);
             busy = false;
         }
     };

package/dist/sandbox/refusal.d.ts

@@ -19,5 +19,5 @@ export declare function assertProfileValid(result: AgentProfileValidationResult)
 export declare function refuseUnsupportedCreateInput(input: CreateAgentEnvironmentInput, support: BridgeVendorSupport): void;
 /** The harnesses this module can declare. */
 export declare function declarableHarnesses(): HarnessType[];
-/** Whether the shared planner lowers this profile dimension for the harness. */
-export declare function plannerLowers(harness: HarnessType, dimension: "hooks"): boolean;
+/** Whether the box lowers this profile dimension for the harness: the planner accepts and emits it, and the runtime honors it. The planner silently drops codex hooks (no refusal, no artifact), and codex 0.164 exposes no in-turn delegation tool through the box's exec path, so hooks and subagents lower there. */
+export declare function plannerLowers(harness: HarnessType, dimension: "hooks" | "permissions" | "subagents"): boolean;

package/dist/sandbox/refusal.js

@@ -152,12 +152,12 @@ export function refuseUnsupportedCreateInput(input, support) {
 export function declarableHarnesses() {
     return Object.keys(BOX_HARNESSES);
 }
-/** Whether the shared planner lowers this profile dimension for the harness. */
+/** Whether the box lowers this profile dimension for the harness: the planner accepts and emits it, and the runtime honors it. The planner silently drops codex hooks (no refusal, no artifact), and codex 0.164 exposes no in-turn delegation tool through the box's exec path, so hooks and subagents lower there. */
 export function plannerLowers(harness, dimension) {
-    const probe = { hooks: { PostToolUse: [{ command: "true" }] } };
+    const probe = dimension === "hooks" ? { hooks: { PostToolUse: [{ command: "true" }] } } : dimension === "permissions" ? { permissions: { Write: "deny" } } : { subagents: { "probe-child": { description: "probe", prompt: "probe" } } };
     try {
         const plan = materializeProfile(probe, harness);
-        return !plan.unsupported.some((entry) => entry.dimension === dimension);
+        return !plan.unsupported.some((entry) => entry.dimension === dimension) && (dimension !== "hooks" || JSON.stringify(plan.files).includes("PostToolUse")) && (dimension !== "subagents" || harness !== "codex");
     }
     catch {
         return false;

package/dist/sandbox/shell.d.ts

@@ -14,3 +14,13 @@ export declare function envFileLaunch(command: string, { cwd, env }: {
 };
 /** For an SDK that takes no AbortSignal: an abort settles the call at once, and `late` receives a result that arrives afterwards. */
 export declare function untilAborted<T>(pending: Promise<T>, signal: AbortSignal | undefined, late?: (value: T) => Promise<unknown>): Promise<T>;
+/** The pids alive in the sandbox, one per line: the baseline a turn's processes are measured against. */
+export declare function pidListScript(): string;
+/**
+ * A harness may put tool children outside its process group (opencode's Bash tool spawns them detached), where
+ * neither the harness's exit nor the adapter's group kill reaches them. After every turn the box restores the
+ * process set it had before the turn: one pass over each live pid's /proc status file (cat skips the
+ * already-dead) TERMs, then KILLs, every pid outside the baseline that is not the sweep shell's own tree — the baseline already covers
+ * everything older than the turn, including pid 1, so orphans reparented to pid 1 are still caught.
+ */
+export declare function turnSweepScript(baseline: readonly string[]): string;

package/dist/sandbox/shell.js

@@ -48,3 +48,27 @@ export async function untilAborted(pending, signal, late) {
             void pending.then(late).catch(() => undefined);
     }
 }
+/** The pids alive in the sandbox, one per line: the baseline a turn's processes are measured against. */
+export function pidListScript() {
+    return "for d in /proc/[0-9]*; do echo ${d#/proc/}; done";
+}
+/**
+ * A harness may put tool children outside its process group (opencode's Bash tool spawns them detached), where
+ * neither the harness's exit nor the adapter's group kill reaches them. After every turn the box restores the
+ * process set it had before the turn: one pass over each live pid's /proc status file (cat skips the
+ * already-dead) TERMs, then KILLs, every pid outside the baseline that is not the sweep shell's own tree — the baseline already covers
+ * everything older than the turn, including pid 1, so orphans reparented to pid 1 are still caught.
+ */
+export function turnSweepScript(baseline) {
+    return [
+        `victims=$(cat /proc/[0-9]*/status 2>/dev/null | awk -v base=${shellQuote(` ${baseline.join(" ")} `)} -v self=$$ '`,
+        `$1 == "Pid:" { p = $2 } $1 == "PPid:" { ppid[p] = $2 }`,
+        `END {`,
+        `  split(base, b, / +/); for (i in b) if (b[i] != "") known[b[i]] = 1`,
+        `  mine[self] = 1; changed = 1`,
+        `  while (changed) { changed = 0; for (p in ppid) if (!(p in mine) && (ppid[p] in mine)) { mine[p] = 1; changed = 1 } }`,
+        `  for (p in ppid) if (!(p in known) && !(p in mine)) printf "%s ", p`,
+        `}')`,
+        `[ -z "$victims" ] && exit 0; kill -TERM $victims 2>/dev/null; sleep 1; kill -KILL $victims 2>/dev/null; true`,
+    ].join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-provider-cli-bridge",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "AgentEnvironmentProvider adapter for cli-bridge retained sessions and one-shot turns",
   "type": "module",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "undici": "8.12.3"
   },
   "devDependencies": {
-    "@tangle-network/agent-provider-testkit": "0.12.5",
+    "@tangle-network/agent-provider-testkit": "0.12.7",
     "@types/node": "26.6.5",
     "typescript": "6.0.3",
     "vitest": "5.0.5"