@tangle-network/agent-provider-cli-bridge 2.0.9 → 2.0.11

package/README.md

@@ -209,8 +209,12 @@ A vendor whose command call runs to completion, as Daytona's and computesdk's do
 - Turns run through the Bridge. `turn.timeoutMs` cancels the run and ends the stream with a failed `result` that names the timeout, an abort rejects with `AbortError`, and a second turn on a busy environment is refused with `conflict`.
 - Events carry `execution.started` with the declared model and a terminal `result` with the model the harness reported serving. The Bridge's dollar figure is the harness's catalog estimate, so events omit `usage.cost`.
 
-The box image is `renderBoxDockerfile()`: Node, CLI Bridge at the commit in `BOX_PINS`, and each harness CLI at the version `@tangle-network/cli-agent-registry` pins.
-A harness joins `BOX_HARNESSES` only after a live turn through the Router completed in a box; `claude-code` is the proven row.
+The box image is `renderBoxDockerfile()`: Node, CLI Bridge at the commit in `BOX_PINS`, and each harness CLI at the version the harness catalog pins.
+The catalog is `HARNESSES` from `@tangle-network/cli-agent-registry`, which agent-container generates from `infra/nix/agent-clis.json`, the pins the Tangle sandbox image is built from.
+The box decides only how it installs and routes each catalog harness: every Router-eligible catalog harness has a recipe in `BOX_HARNESSES` or a reason and owner in `BOX_EXCLUSIONS`, and the type fails when the registry adds a harness the box does not place.
+A harness joins `BOX_HARNESSES` only after a live turn through the Router completed in a box.
+`boxInstallScript()` is the one install step; the image build and Boat's setup script both run it.
+The image build refuses a lockfile whose registry pins differ from the latest published registry, so the box never ships older CLIs than the Tangle image.
 Build the image for a cloud with `pnpm build:sandbox-image --target e2b|daytona|docker` from the repository root.
 `@tangle-network/agent-provider-testkit` runs the live profile conformance suite against the result.
 

package/dist/sandbox/box.d.ts

@@ -20,7 +20,7 @@ export declare const BOX_NODE_IMAGE = "node:24.22.1-trixie-slim";
  */
 export declare const BOX_PINS: {
     readonly cliBridgeRepository: "drewstone/cli-bridge";
-    readonly cliBridgeCommit: "263f700dc5ca8b7b6e53b986d376102e0d82b42f";
+    readonly cliBridgeCommit: "de0ca4d7a426d77f8aa8bc373bf98e8fb92e9da2";
     readonly agentProfileMaterialize: "1.1.4";
 };
 /** The E2B template and Daytona snapshot name `pnpm build:sandbox-image` publishes for these pins. */
@@ -31,27 +31,33 @@ export interface BoxRouter {
     /** The per-run capped Router key. */
     key: string;
 }
-/**
- * A harness the box carries and routes through the Tangle Router.
- *
- * A harness joins this table only after a live turn through the Router
- * completed in a box, so the declared set is the proven set.
- */
+/** A harness the box carries and routes through the Tangle Router. */
 export interface BoxHarness {
     readonly harness: HarnessType;
     /** The Bridge backend name in `BRIDGE_BACKENDS`. */
     readonly bridgeBackend: string;
-    /** The npm package that installs the CLI. */
+    /** The npm package that installs the CLI at the catalog's version. */
     readonly npmPackage: string;
-    /** The CLI binary; `<bin> --version` prints the pinned version first. */
-    readonly bin: string;
     /** Environment that points this harness at the Router, set on the Bridge process only. */
     routerEnv(router: BoxRouter): Record<string, string>;
 }
+/** Why a catalog harness is not in the box, and who owns closing the gap. */
+export interface BoxExclusion {
+    readonly reason: string;
+    readonly owner: string;
+}
 export declare const BOX_HARNESSES: Readonly<Partial<Record<HarnessType, BoxHarness>>>;
+/** Every catalog harness the box does not carry, with the reason and its owner. */
+export declare const BOX_EXCLUSIONS: Readonly<Partial<Record<HarnessType, BoxExclusion>>>;
 export declare function boxHarness(harness: string | undefined): BoxHarness | undefined;
-/** The CLI version the harness registry pins; the box image installs exactly this. */
-export declare function boxHarnessVersion(harness: HarnessType): string;
+/** The CLI version the harness catalog pins; the box image installs exactly this. */
+export declare const boxHarnessVersion: (harness: HarnessType) => string;
+/** The catalog's command that prints the installed CLI version. */
+export declare const boxVersionCommand: (harness: HarnessType) => string;
+/** A shell test that the version command prints the pin as one token, with or without a leading `v` (`codex-cli 0.164.0`). */
+export declare function boxVersionProbe(harness: HarnessType): string;
+/** The one install step every box runs, the image build and Boat's setup script alike: the pinned CLIs and Bridge, then a version probe for each. */
+export declare function boxInstallScript(harnesses: readonly HarnessType[]): string;
 /** The command that starts the Bridge; its settings come from the process environment. */
 export declare const BRIDGE_START_COMMAND = "cli-bridge";
 /**

package/dist/sandbox/box.js

@@ -1,4 +1,4 @@
-import { NATIVE_SESSION_CONTRACTS } from "@tangle-network/cli-agent-registry/native-session-contracts";
+import { HARNESSES, MANAGED_MODEL_LADDER } from "@tangle-network/cli-agent-registry";
 /**
  * The box: one image every cloud runs, holding Node, CLI Bridge and the pinned
  * harness CLIs. The Bridge listens on {@link BRIDGE_PORT}, materializes the
@@ -20,34 +20,75 @@ export const BOX_NODE_IMAGE = "node:24.22.1-trixie-slim";
  */
 export const BOX_PINS = {
     cliBridgeRepository: "drewstone/cli-bridge",
-    cliBridgeCommit: "263f700dc5ca8b7b6e53b986d376102e0d82b42f",
+    cliBridgeCommit: "de0ca4d7a426d77f8aa8bc373bf98e8fb92e9da2",
     agentProfileMaterialize: "1.1.4",
 };
 /** The E2B template and Daytona snapshot name `pnpm build:sandbox-image` publishes for these pins. */
 export const BOX_TEMPLATE_NAME = `tangle-cli-bridge-box-${BOX_PINS.cliBridgeCommit.slice(0, 12)}`;
-export const BOX_HARNESSES = {
-    "claude-code": {
-        harness: "claude-code",
-        bridgeBackend: "claude",
-        npmPackage: "@anthropic-ai/claude-code",
-        bin: "claude",
-        // The Router authenticates a Bearer token. ANTHROPIC_API_KEY sends x-api-key, which it rejects.
-        routerEnv: (router) => ({
-            ANTHROPIC_BASE_URL: router.baseUrl,
-            ANTHROPIC_AUTH_TOKEN: router.key,
-        }),
-    },
+const noBridgeBackend = { reason: `CLI Bridge ${BOX_PINS.cliBridgeCommit.slice(0, 12)} registers no backend for it`, owner: BOX_PINS.cliBridgeRepository };
+/**
+ * Every Router-eligible catalog harness, as a recipe or an exclusion; the type
+ * fails when the registry adds a harness the box does not place. A recipe joins
+ * only after a live turn through the Router completed in a box.
+ */
+const BOX_ROWS = {
+    // The Router authenticates a Bearer token. ANTHROPIC_API_KEY sends x-api-key, which it rejects.
+    "claude-code": { bridgeBackend: "claude", npmPackage: "@anthropic-ai/claude-code", routerEnv: (router) => ({ ANTHROPIC_BASE_URL: router.baseUrl, ANTHROPIC_AUTH_TOKEN: router.key }) },
+    codex: { bridgeBackend: "codex", npmPackage: "@openai/codex", routerEnv: (router) => ({ CODEX_TANGLE_ROUTER_URL: `${router.baseUrl}/v1`, TANGLE_API_KEY: router.key }) }, // the Bridge turns this env into a codex model_providers entry (wire_api "responses", env_key TANGLE_API_KEY) and passes the Router slug whole; the live suite pins the dial against a key-rejecting listener in the box
+    opencode: { bridgeBackend: "opencode", npmPackage: "opencode-ai", routerEnv: (router) => ({ TANGLE_API_KEY: router.key, OPENCODE_CONFIG_CONTENT: JSON.stringify({ provider: MANAGED_MODEL_LADDER.reduce((providers, { id }) => { const [provider, ...model] = id.split("/"); (providers[provider] ??= { npm: "@ai-sdk/openai-compatible", options: { baseURL: `${router.baseUrl}/v1`, apiKey: "{env:TANGLE_API_KEY}" }, models: {} }).models[model.join("/")] = { id }; return providers; }, {}) }) }) }, // opencode resolves only configured models; the Bridge merges this config under each profile's, routing every Router-servable `<provider>/<model>` through the Router's chat wire.
+    pi: { reason: `CLI Bridge ${BOX_PINS.cliBridgeCommit.slice(0, 12)} runs pi only in a bubblewrap fs-jail, which a Docker box cannot create (no user namespace; unconfined, --proc /proc is denied), and takes its endpoint only from a models.json file`, owner: BOX_PINS.cliBridgeRepository },
+    "kimi-code": { reason: "the catalog pins Python kimi-cli 1.49.0, which refuses the Bridge's Kimi Code argv (`--output-format stream-json` without `--print`, exit 2); it joins once the catalog ports to npm @moonshot-ai/kimi-code (ops-board#10682)", owner: "tangle-network/agent-container (cli-agent-registry)" },
+    prime: { reason: "not on npm, and the catalog publishes only its version: no tarball url, hash or pythonPackages to install prime-agent from", owner: "tangle-network/agent-container (cli-agent-registry)" },
+    hermes: { reason: "hermes 0.22.4 has no PyPI or official npm release, and the registry publishes no install source (git repository, ref, installer) for it; after that, the Bridge's AcpBackend forwards no request model to `hermes acp`", owner: "tangle-network/agent-container (cli-agent-registry)" },
+    openclaw: { reason: `CLI Bridge ${BOX_PINS.cliBridgeCommit.slice(0, 12)} runs \`openclaw acp\`, a client of an OpenClaw Gateway the box never starts (ECONNREFUSED 127.0.0.1:18789) that also rejects per-session MCP; openclaw reads its endpoint only from an openclaw.json the Bridge never writes`, owner: BOX_PINS.cliBridgeRepository },
+    "factory-droids": noBridgeBackend,
+    grok: noBridgeBackend,
+    nanoclaw: noBridgeBackend,
+    acp: noBridgeBackend,
 };
+const rows = Object.entries(BOX_ROWS);
+export const BOX_HARNESSES = Object.fromEntries(rows.flatMap(([harness, row]) => ("npmPackage" in row ? [[harness, { harness, ...row }]] : [])));
+/** Every catalog harness the box does not carry, with the reason and its owner. */
+export const BOX_EXCLUSIONS = Object.fromEntries([
+    ...rows.filter(([, row]) => !("npmPackage" in row)),
+    ...Object.entries(HARNESSES)
+        .filter(([harness]) => !(harness in BOX_ROWS))
+        .map(([harness, { config }]) => [harness, {
+            reason: config.baseUrl === "vendor-only" ? "the catalog declares it vendor-only: no Router endpoint" : "the catalog declares no native CLI for it",
+            owner: "tangle-network/agent-container (cli-agent-registry)",
+        }]),
+]);
 export function boxHarness(harness) {
     return harness === undefined ? undefined : BOX_HARNESSES[harness];
 }
-/** The CLI version the harness registry pins; the box image installs exactly this. */
-export function boxHarnessVersion(harness) {
-    const contract = NATIVE_SESSION_CONTRACTS[harness];
-    if (contract?.cliVersion === undefined) {
-        throw new Error(`cli-agent-registry pins no CLI version for harness ${harness}`);
-    }
-    return contract.cliVersion;
+function catalogCli(harness) {
+    const session = HARNESSES[harness]?.session;
+    if (session?.kind !== "native")
+        throw new Error(`the harness catalog declares no native CLI for ${harness}`);
+    return { versionCommand: session.processProbe.versionCommand, cliVersion: session.contract.cliVersion };
+}
+/** The CLI version the harness catalog pins; the box image installs exactly this. */
+export const boxHarnessVersion = (harness) => catalogCli(harness).cliVersion;
+/** The catalog's command that prints the installed CLI version. */
+export const boxVersionCommand = (harness) => catalogCli(harness).versionCommand;
+/** A shell test that the version command prints the pin as one token, with or without a leading `v` (`codex-cli 0.164.0`). */
+export function boxVersionProbe(harness) {
+    const { versionCommand, cliVersion } = catalogCli(harness);
+    return `(${versionCommand}) 2>&1 | tr -s ' \\t' '\\n\\n' | sed 's/^v//' | grep -Fxq -- '${cliVersion}'`;
+}
+/** The one install step every box runs, the image build and Boat's setup script alike: the pinned CLIs and Bridge, then a version probe for each. */
+export function boxInstallScript(harnesses) {
+    if (harnesses.length === 0)
+        throw new Error("no harness to install; the box needs at least one");
+    const entries = harnesses.map((name) => {
+        const entry = boxHarness(name);
+        if (entry === undefined)
+            throw new Error(`harness ${name} is not in the box: ${BOX_EXCLUSIONS[name]?.reason ?? "not in the harness catalog"}`);
+        return entry;
+    });
+    const bridge = `https://github.com/${BOX_PINS.cliBridgeRepository}/archive/${BOX_PINS.cliBridgeCommit}.tar.gz`;
+    const packages = entries.map((entry) => `${entry.npmPackage}@${boxHarnessVersion(entry.harness)}`);
+    return [`npm install -g ${[...packages, bridge].join(" ")}`, ...entries.map((entry) => boxVersionProbe(entry.harness)), "command -v cli-bridge >/dev/null"].join(" \\\n    && ");
 }
 /** The command that starts the Bridge; its settings come from the process environment. */
 export const BRIDGE_START_COMMAND = "cli-bridge";

package/dist/sandbox/image.d.ts

@@ -4,8 +4,8 @@ import type { HarnessType } from "@tangle-network/agent-interface";
  *
  * Every cloud builds from this text: E2B and Daytona build their template and
  * image from it, and a local Docker build of it is the same box. Harness
- * versions come from the registry that owns the pins. `baseImage` overrides
- * the Node base for a box that carries more than the pins; the install layer
- * is unchanged, so every box keeps the same Bridge and harness versions.
+ * versions come from the harness catalog. `baseImage` overrides the Node base
+ * for a box that carries more than the pins; the install layer is unchanged,
+ * so every box keeps the same Bridge and harness versions.
  */
 export declare function renderBoxDockerfile(harnesses?: readonly HarnessType[], baseImage?: string): string;

package/dist/sandbox/image.js

@@ -1,29 +1,19 @@
-import { BOX_HARNESSES, BOX_HOME, BOX_NODE_IMAGE, BOX_PINS, BOX_WORKSPACE_DIR, boxHarnessVersion } from "./box.js";
+import { BOX_HARNESSES, BOX_HOME, BOX_NODE_IMAGE, BOX_WORKSPACE_DIR, boxInstallScript } from "./box.js";
 /**
  * The box image as one Dockerfile.
  *
  * Every cloud builds from this text: E2B and Daytona build their template and
  * image from it, and a local Docker build of it is the same box. Harness
- * versions come from the registry that owns the pins. `baseImage` overrides
- * the Node base for a box that carries more than the pins; the install layer
- * is unchanged, so every box keeps the same Bridge and harness versions.
+ * versions come from the harness catalog. `baseImage` overrides the Node base
+ * for a box that carries more than the pins; the install layer is unchanged,
+ * so every box keeps the same Bridge and harness versions.
  */
 export function renderBoxDockerfile(harnesses = Object.keys(BOX_HARNESSES), baseImage = BOX_NODE_IMAGE) {
-    const installs = harnesses.map((name) => {
-        const entry = BOX_HARNESSES[name];
-        if (entry === undefined)
-            throw new Error(`harness ${name} is not in the box harness table`);
-        return { entry, version: boxHarnessVersion(name) };
-    });
-    const bridge = `https://github.com/${BOX_PINS.cliBridgeRepository}/archive/${BOX_PINS.cliBridgeCommit}.tar.gz`;
-    const packages = installs.map(({ entry, version }) => `${entry.npmPackage}@${version}`);
-    const probes = installs.map(({ entry, version }) => `test "$(${entry.bin} --version | cut -d' ' -f1)" = "${version}"`);
     return [
         `FROM ${baseImage}`,
         "RUN apt-get update && apt-get install -y --no-install-recommends git curl ca-certificates python3 make g++ ripgrep procps \\",
         "    && rm -rf /var/lib/apt/lists/*",
-        `RUN npm install -g ${[...packages, bridge].join(" ")} \\`,
-        `    && ${[...probes, "command -v cli-bridge >/dev/null"].join(" \\\n    && ")}`,
+        `RUN ${boxInstallScript(harnesses)}`,
         `RUN mkdir -p ${BOX_WORKSPACE_DIR} && chown -R node:node ${BOX_HOME}`,
         "USER node",
         `ENV HOME=${BOX_HOME}`,

package/dist/sandbox/index.d.ts

@@ -4,5 +4,6 @@ export type { BridgeSandbox, BridgeSandboxCreateRequest, BridgeSandboxSummary, B
 export { checkpointSnapshotName } from "./checkpoint.js";
 export { validateBoxProfile } from "./refusal.js";
 export { envFileLaunch, markedExec, untilAborted } from "./shell.js";
-export { BOX_HARNESSES, BOX_HOME, BOX_PINS, BOX_TEMPLATE_NAME, BOX_WORKSPACE_DIR, BRIDGE_PORT, boxHarnessVersion, } from "./box.js";
+export type { BoxExclusion, BoxHarness } from "./box.js";
+export { BOX_EXCLUSIONS, BOX_HARNESSES, BOX_HOME, BOX_PINS, BOX_TEMPLATE_NAME, BOX_WORKSPACE_DIR, BRIDGE_PORT, boxHarnessVersion, boxInstallScript, boxVersionCommand, boxVersionProbe, } from "./box.js";
 export { renderBoxDockerfile } from "./image.js";

package/dist/sandbox/index.js

@@ -2,5 +2,5 @@ export { createBridgeSandboxProvider, BRIDGE_RUN_TAG } from "./provider.js";
 export { checkpointSnapshotName } from "./checkpoint.js";
 export { validateBoxProfile } from "./refusal.js";
 export { envFileLaunch, markedExec, untilAborted } from "./shell.js";
-export { BOX_HARNESSES, BOX_HOME, BOX_PINS, BOX_TEMPLATE_NAME, BOX_WORKSPACE_DIR, BRIDGE_PORT, boxHarnessVersion, } from "./box.js";
+export { BOX_EXCLUSIONS, BOX_HARNESSES, BOX_HOME, BOX_PINS, BOX_TEMPLATE_NAME, BOX_WORKSPACE_DIR, BRIDGE_PORT, boxHarnessVersion, boxInstallScript, boxVersionCommand, boxVersionProbe, } from "./box.js";
 export { renderBoxDockerfile } from "./image.js";

package/dist/sandbox/provider.js

@@ -6,9 +6,10 @@ import { AgentEnvironmentGetOptionsSchema, AgentTurnInputSchema, EnvironmentProv
 import { shellQuote } from "@tangle-network/agent-core/node";
 import { harnessModelSupportFor } from "@tangle-network/cli-agent-registry";
 import { createCliBridgeProvider, defaultCliBridgeCapabilities } from "../index.js";
-import { BOX_WORKSPACE_DIR, BRIDGE_PORT, BRIDGE_START_COMMAND, bridgeProcessEnv, boxHarness, boxHarnessVersion, } from "./box.js";
+import { BOX_WORKSPACE_DIR, BRIDGE_PORT, BRIDGE_START_COMMAND, bridgeProcessEnv, boxHarness, boxHarnessVersion, boxVersionCommand, boxVersionProbe, } from "./box.js";
 import { assertProfileValid, declarableHarnesses, plannerLowers, refuseUnsupportedCreateInput, resolveBoxHarness, validateBoxProfile } from "./refusal.js";
 import { assertForkableCheckpoint, createVendorSnapshot, forkCreateInput, } from "./checkpoint.js";
+import { pidListScript, turnSweepScript } from "./shell.js";
 export const BRIDGE_RUN_TAG = "tangle-bridge-run";
 const DEFAULT_LIFETIME_MS = 2 * 60 * 60 * 1000;
 const DEFAULT_READY_TIMEOUT_MS = 120_000;
@@ -36,7 +37,7 @@ export function createBridgeSandboxProvider(options) {
     const routerBaseUrl = (options.router.baseUrl ?? TANGLE_ROUTER_DEFAULT_ROOT_URL).replace(/\/+$/, "");
     const lifetimeMs = options.lifetimeMs ?? DEFAULT_LIFETIME_MS;
     const readyTimeoutMs = options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
-    const providerCapabilities = (harness) => environmentCapabilities(defaultCliBridgeCapabilities(harness), vendor, harness === undefined ? false : plannerLowers(harness, "hooks"));
+    const providerCapabilities = (harness) => environmentCapabilities(defaultCliBridgeCapabilities(harness), vendor, harness);
     async function create(input, restore) {
         input.signal?.throwIfAborted();
         refuseUnsupportedCreateInput(input, vendor.support);
@@ -103,7 +104,7 @@ export function createBridgeSandboxProvider(options) {
             });
             input.signal?.throwIfAborted();
             const forkFromCheckpoint = vendor.snapshots === undefined ? undefined : (checkpoint, request, signal) => create({ ...forkCreateInput(input, request), ...(signal === undefined ? {} : { signal }) }, { snapshot: checkpoint.id });
-            return wrapEnvironment({ inner, sandbox, vendor, harness, profile, workspaceDir, dispatcher, capabilities: environmentCapabilities(inner.capabilities ?? providerCapabilities(harness), vendor, plannerLowers(harness, "hooks")), input, ...(forkFromCheckpoint === undefined ? {} : { forkFromCheckpoint }) });
+            return wrapEnvironment({ inner, sandbox, vendor, harness, profile, workspaceDir, dispatcher, capabilities: environmentCapabilities(inner.capabilities ?? providerCapabilities(harness), vendor, harness), input, ...(forkFromCheckpoint === undefined ? {} : { forkFromCheckpoint }) });
         }
         catch (error) {
             await dispatcher?.close().catch(() => undefined);
@@ -217,12 +218,12 @@ async function waitForBridge(baseUrl, bearer, bridgeFetch, backend, timeoutMs, s
     throw new EnvironmentProviderError("provision_failed", `cli-bridge was not ready within ${timeoutMs} ms (${last})`, { secrets });
 }
 async function assertHarnessVersion(sandbox, harness, signal) {
-    const box = boxHarness(harness);
-    const pinned = boxHarnessVersion(harness);
-    const result = await sandbox.exec(`${box.bin} --version`, { ...signalOption(signal), timeoutMs: 30_000 });
-    if (result.exitCode !== 0 || result.stdout.trim().split(/\s+/)[0] !== pinned) {
-        throw new EnvironmentProviderError("materialization_failed", `${box.bin} --version reported "${result.stdout.trim() || result.stderr.trim()}" (exit ${result.exitCode}); the registry pins ${pinned}`);
-    }
+    const probe = await sandbox.exec(boxVersionProbe(harness), { ...signalOption(signal), timeoutMs: 30_000 });
+    if (probe.exitCode === 0)
+        return;
+    const command = boxVersionCommand(harness);
+    const shown = await sandbox.exec(command, { ...signalOption(signal), timeoutMs: 30_000 });
+    throw new EnvironmentProviderError("materialization_failed", `${command} reported "${(shown.stdout.trim() || shown.stderr.trim()).slice(0, 200)}" (exit ${shown.exitCode}); the harness catalog pins ${boxHarnessVersion(harness)}`);
 }
 async function cloneRepository(sandbox, input, secrets) {
     const repoUrl = input.workspace?.repoUrl;
@@ -271,12 +272,12 @@ function assertGetOptionsSupported(options) {
         }
     }
 }
-/** The document for one environment: what the Bridge claims, plus the vendor sandbox's workspace and placement. */
-function environmentCapabilities(bridge, vendor, hooks) {
+/** The document for one environment: what the Bridge claims, plus the vendor sandbox's workspace and placement. The profile's hooks, permissions and subagents axes claim only what the pinned planner lowers for the harness. */
+function environmentCapabilities(bridge, vendor, harness) {
     const { retainedControl: _retained, nativeContinuation: _native, contextTransfer: _transfer, interactions: _interactions, observation: _observation, ...base } = bridge;
     return {
         ...base,
-        profile: { ...base.profile, validation: true, hooks: hooks === true },
+        profile: { ...base.profile, validation: true, ...(harness === undefined ? {} : { hooks: plannerLowers(harness, "hooks"), permissions: plannerLowers(harness, "permissions"), subagents: plannerLowers(harness, "subagents") }) },
         workspace: { read: true, write: true, exec: true, git: false, upload: false, download: false, cwdBases: { repository: true, host: false } },
         branching: { checkpoint: vendor.snapshots !== undefined, fork: vendor.snapshots !== undefined },
         placement: true,
@@ -341,6 +342,9 @@ function wrapEnvironment(args) {
         if (busy)
             throw new EnvironmentProviderError("conflict", "a turn is already running on this environment", { provider: vendor.name });
         busy = true;
+        const baseline = await sandbox.exec(pidListScript(), { timeoutMs: 15_000 })
+            .then((result) => (result.exitCode === 0 ? result.stdout.split(/\s+/).filter(Boolean) : undefined))
+            .catch(() => undefined);
         try {
             yield* projectTurn(inner, checked, checked.model ?? args.profile.model?.default);
         }
@@ -352,6 +356,8 @@ function wrapEnvironment(args) {
             throw error;
         }
         finally {
+            if (baseline !== undefined)
+                await sandbox.exec(turnSweepScript(baseline), { timeoutMs: 30_000 }).catch(() => undefined);
             busy = false;
         }
     };

package/dist/sandbox/refusal.d.ts

@@ -19,5 +19,5 @@ export declare function assertProfileValid(result: AgentProfileValidationResult)
 export declare function refuseUnsupportedCreateInput(input: CreateAgentEnvironmentInput, support: BridgeVendorSupport): void;
 /** The harnesses this module can declare. */
 export declare function declarableHarnesses(): HarnessType[];
-/** Whether the shared planner lowers this profile dimension for the harness. */
-export declare function plannerLowers(harness: HarnessType, dimension: "hooks"): boolean;
+/** Whether the box lowers this profile dimension for the harness: the planner accepts and emits it, and the runtime honors it. The planner silently drops codex hooks (no refusal, no artifact), and codex 0.164 exposes no in-turn delegation tool through the box's exec path, so hooks and subagents lower there. */
+export declare function plannerLowers(harness: HarnessType, dimension: "hooks" | "permissions" | "subagents"): boolean;

package/dist/sandbox/refusal.js

@@ -152,12 +152,12 @@ export function refuseUnsupportedCreateInput(input, support) {
 export function declarableHarnesses() {
     return Object.keys(BOX_HARNESSES);
 }
-/** Whether the shared planner lowers this profile dimension for the harness. */
+/** Whether the box lowers this profile dimension for the harness: the planner accepts and emits it, and the runtime honors it. The planner silently drops codex hooks (no refusal, no artifact), and codex 0.164 exposes no in-turn delegation tool through the box's exec path, so hooks and subagents lower there. */
 export function plannerLowers(harness, dimension) {
-    const probe = { hooks: { PostToolUse: [{ command: "true" }] } };
+    const probe = dimension === "hooks" ? { hooks: { PostToolUse: [{ command: "true" }] } } : dimension === "permissions" ? { permissions: { Write: "deny" } } : { subagents: { "probe-child": { description: "probe", prompt: "probe" } } };
     try {
         const plan = materializeProfile(probe, harness);
-        return !plan.unsupported.some((entry) => entry.dimension === dimension);
+        return !plan.unsupported.some((entry) => entry.dimension === dimension) && (dimension !== "hooks" || JSON.stringify(plan.files).includes("PostToolUse")) && (dimension !== "subagents" || harness !== "codex");
     }
     catch {
         return false;

package/dist/sandbox/shell.d.ts

@@ -14,3 +14,13 @@ export declare function envFileLaunch(command: string, { cwd, env }: {
 };
 /** For an SDK that takes no AbortSignal: an abort settles the call at once, and `late` receives a result that arrives afterwards. */
 export declare function untilAborted<T>(pending: Promise<T>, signal: AbortSignal | undefined, late?: (value: T) => Promise<unknown>): Promise<T>;
+/** The pids alive in the sandbox, one per line: the baseline a turn's processes are measured against. */
+export declare function pidListScript(): string;
+/**
+ * A harness may put tool children outside its process group (opencode's Bash tool spawns them detached), where
+ * neither the harness's exit nor the adapter's group kill reaches them. After every turn the box restores the
+ * process set it had before the turn: one pass over each live pid's /proc status file (cat skips the
+ * already-dead) TERMs, then KILLs, every pid outside the baseline that is not the sweep shell's own tree — the baseline already covers
+ * everything older than the turn, including pid 1, so orphans reparented to pid 1 are still caught.
+ */
+export declare function turnSweepScript(baseline: readonly string[]): string;

package/dist/sandbox/shell.js

@@ -48,3 +48,27 @@ export async function untilAborted(pending, signal, late) {
             void pending.then(late).catch(() => undefined);
     }
 }
+/** The pids alive in the sandbox, one per line: the baseline a turn's processes are measured against. */
+export function pidListScript() {
+    return "for d in /proc/[0-9]*; do echo ${d#/proc/}; done";
+}
+/**
+ * A harness may put tool children outside its process group (opencode's Bash tool spawns them detached), where
+ * neither the harness's exit nor the adapter's group kill reaches them. After every turn the box restores the
+ * process set it had before the turn: one pass over each live pid's /proc status file (cat skips the
+ * already-dead) TERMs, then KILLs, every pid outside the baseline that is not the sweep shell's own tree — the baseline already covers
+ * everything older than the turn, including pid 1, so orphans reparented to pid 1 are still caught.
+ */
+export function turnSweepScript(baseline) {
+    return [
+        `victims=$(cat /proc/[0-9]*/status 2>/dev/null | awk -v base=${shellQuote(` ${baseline.join(" ")} `)} -v self=$$ '`,
+        `$1 == "Pid:" { p = $2 } $1 == "PPid:" { ppid[p] = $2 }`,
+        `END {`,
+        `  split(base, b, / +/); for (i in b) if (b[i] != "") known[b[i]] = 1`,
+        `  mine[self] = 1; changed = 1`,
+        `  while (changed) { changed = 0; for (p in ppid) if (!(p in mine) && (ppid[p] in mine)) { mine[p] = 1; changed = 1 } }`,
+        `  for (p in ppid) if (!(p in known) && !(p in mine)) printf "%s ", p`,
+        `}')`,
+        `[ -z "$victims" ] && exit 0; kill -TERM $victims 2>/dev/null; sleep 1; kill -KILL $victims 2>/dev/null; true`,
+    ].join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-provider-cli-bridge",
-  "version": "2.0.9",
+  "version": "2.0.11",
   "description": "AgentEnvironmentProvider adapter for cli-bridge retained sessions and one-shot turns",
   "type": "module",
   "license": "MIT",
@@ -38,12 +38,12 @@
   "dependencies": {
     "@tangle-network/agent-core": "^1.0.2",
     "@tangle-network/agent-interface": "^5.10.19",
-    "@tangle-network/agent-profile-materialize": "1.1.4",
-    "@tangle-network/cli-agent-registry": "^0.14.0",
+    "@tangle-network/agent-profile-materialize": "^1.1.4",
+    "@tangle-network/cli-agent-registry": "^0.15.30",
     "undici": "8.12.3"
   },
   "devDependencies": {
-    "@tangle-network/agent-provider-testkit": "0.12.4",
+    "@tangle-network/agent-provider-testkit": "0.12.7",
     "@types/node": "26.6.5",
     "typescript": "6.0.3",
     "vitest": "5.0.5"