@tiangong-ai/cli 0.0.19 → 0.0.21

package/dist/research/workspace/executor.js

@@ -0,0 +1,926 @@
+import { spawn } from "node:child_process";
+import { constants as fsConstants } from "node:fs";
+import { access, chmod, copyFile, lstat, mkdir, readFile, realpath, writeFile, } from "node:fs/promises";
+import { arch, homedir, platform } from "node:os";
+import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CliError } from "../../errors.js";
+import { configuredResearchSecrets, isSensitiveEnvironmentName, sanitizeResearchText, } from "./sanitization.js";
+import { isObject, sha256File } from "./storage.js";
+const MAX_CAPTURE_BYTES = 5 * 1024 * 1024;
+const MIN_CAPTURE_BYTES = 64 * 1024;
+const BYTES_PER_OUTPUT_TOKEN = 16;
+const EXECUTOR_WRAPPER_PATH = fileURLToPath(import.meta.url);
+const WRAPPER_TARGET_ENV = "TIANGONG_RESEARCH_AGENT_BINARY";
+const CODEX_DISABLED_FEATURES = [
+    "apps",
+    "auth_elicitation",
+    "browser_use",
+    "computer_use",
+    "goals",
+    "guardian_approval",
+    "hooks",
+    "image_generation",
+    "in_app_browser",
+    "mentions_v2",
+    "multi_agent",
+    "personality",
+    "plugins",
+    "remote_plugin",
+    "skill_mcp_dependency_install",
+    "skill_search",
+    "tool_call_mcp_elicitation",
+    "tool_suggest",
+    "workspace_dependencies",
+];
+const ROUTE_AUTH_ENVIRONMENT = {
+    codex: ["OPENAI_API_KEY"],
+    claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"],
+};
+const CLAUDE_SETTINGS_ENVIRONMENT = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+];
+const DEFAULT_AGENT_EFFORT = "low";
+const DEFAULT_CODEX_VERBOSITY = "low";
+export async function executeAgent(request) {
+    validateAgentBinary(request.route);
+    if (!Number.isInteger(request.maxOutputTokens) || request.maxOutputTokens < 1) {
+        throw new CliError("Agent max output tokens must be a positive integer.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    if (!Number.isInteger(request.maxTurns) || request.maxTurns < 1) {
+        throw new CliError("Agent max turns must be a positive integer.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    const temporaryDirectory = join(request.capsuleRoot, "tmp");
+    await mkdir(temporaryDirectory, { recursive: true, mode: 0o700 });
+    const executables = await resolveAgentExecutables(request.route, request.environment.PATH);
+    const runtime = await fingerprintResolvedBinary(request.route, executables.launcher, executables.target, request.environment.PATH);
+    if (request.expectedRuntime && !sameRuntimeFingerprint(runtime, request.expectedRuntime)) {
+        throw new CliError(`Configured ${request.route.agent} runtime drifted after the successful doctor smoke.`, {
+            code: "RESEARCH_EXECUTOR_DRIFT",
+            exitCode: 3,
+            details: {
+                agent: request.route.agent,
+                expectedBinarySha256: request.expectedRuntime.binarySha256,
+                actualBinarySha256: runtime.binarySha256,
+                expectedWrapperSha256: request.expectedRuntime.wrapperSha256,
+                actualWrapperSha256: runtime.wrapperSha256,
+                expectedAdapterSha256: request.expectedRuntime.adapterSha256,
+                actualAdapterSha256: runtime.adapterSha256,
+            },
+        });
+    }
+    const capsuleHome = join(request.capsuleRoot, "home");
+    const capsuleAuth = await prepareCapsuleHome(request.route, capsuleHome, request.environment);
+    const secrets = [...configuredResearchSecrets(request.environment), ...capsuleAuth.secrets];
+    const invocation = await buildInvocation(request, executables.launcher, join(request.capsuleRoot, `${request.purpose}-output-schema.json`));
+    const sandboxed = await sandboxInvocation(invocation.binary, invocation.args, request.capsuleRoot, request.projectRoot, request.workspaceRoot, executables.target);
+    const started = process.hrtime.bigint();
+    let completed;
+    try {
+        completed = await spawnCaptured({
+            binary: sandboxed.binary,
+            args: sandboxed.args,
+            cwd: request.projectRoot,
+            env: sanitizedEnvironment(request.environment, temporaryDirectory, capsuleHome, request.route, executables.target, capsuleAuth.environment),
+            timeoutMs: request.timeoutSeconds * 1000,
+            maxCaptureBytes: Math.min(MAX_CAPTURE_BYTES, Math.max(MIN_CAPTURE_BYTES, request.maxOutputTokens * BYTES_PER_OUTPUT_TOKEN)),
+        });
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new CliError(`Configured ${request.route.agent} executable is unavailable.`, {
+                code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+                exitCode: 3,
+            });
+        }
+        throw error;
+    }
+    const wallSeconds = Number(process.hrtime.bigint() - started) / 1_000_000_000;
+    const parsed = parseAgentResult(request.route, completed.stdout, completed.stderr);
+    const redacted = redactResult(parsed.stdout, parsed.stderr, secrets);
+    const exitCode = redacted.exposed
+        ? 86
+        : completed.captureExceeded
+            ? 75
+            : completed.exitCode !== 0
+                ? completed.exitCode
+                : parsed.parseFailed
+                    ? 3
+                    : 0;
+    const inputTokens = redacted.exposed ? 0 : parsed.inputTokens;
+    const cachedInputTokens = redacted.exposed ? 0 : parsed.cachedInputTokens;
+    const outputTokens = redacted.exposed ? 0 : parsed.outputTokens;
+    const tokens = inputTokens + cachedInputTokens + outputTokens;
+    const providerCost = redacted.exposed ? 0 : parsed.costUsd;
+    const costUsd = providerCost > 0 ? providerCost : estimateCost(request.route, parsed);
+    return {
+        exitCode,
+        stdout: redacted.stdout,
+        stderr: completed.captureExceeded
+            ? `${redacted.stderr}\nagent output exceeded the configured capture limit`.trim()
+            : redacted.stderr,
+        tokens,
+        inputTokens,
+        cachedInputTokens,
+        outputTokens,
+        costUsd,
+        wallSeconds,
+        model: parsed.model ?? request.route.model,
+        runtime: { ...runtime, model: parsed.model ?? request.route.model },
+        telemetry: sanitizeExecutionTelemetry(parsed.telemetry, secrets),
+    };
+}
+export async function fingerprintAgentRoute(route, environment) {
+    validateAgentBinary(route);
+    const executables = await resolveAgentExecutables(route, environment.PATH);
+    return fingerprintResolvedBinary(route, executables.launcher, executables.target, environment.PATH);
+}
+async function buildInvocation(request, resolvedBinary, outputSchemaPath) {
+    await writeFile(outputSchemaPath, `${JSON.stringify(request.outputSchema, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    if (request.route.agent === "codex") {
+        const toolPolicy = request.toolPolicy ?? "workspace-read";
+        const args = [
+            "exec",
+            "--ignore-user-config",
+            "--ignore-rules",
+            "--strict-config",
+            "--skip-git-repo-check",
+            "--ephemeral",
+            "--color",
+            "never",
+            "--sandbox",
+            "read-only",
+            "-c",
+            'web_search="disabled"',
+            "--output-schema",
+            outputSchemaPath,
+            "--json",
+        ];
+        for (const feature of CODEX_DISABLED_FEATURES)
+            args.push("--disable", feature);
+        if (toolPolicy === "none")
+            args.push("--disable", "shell_tool", "--disable", "unified_exec");
+        args.push("-c", "include_apps_instructions=false", "-c", "include_collaboration_mode_instructions=false", "-c", "include_environment_context=false", "-c", "include_permissions_instructions=false", "-c", `model_reasoning_effort=${JSON.stringify(request.route.effort ?? DEFAULT_AGENT_EFFORT)}`, "-c", `model_verbosity=${JSON.stringify(request.route.verbosity ?? DEFAULT_CODEX_VERBOSITY)}`);
+        if (request.brokerUrl) {
+            args.push("-c", `mcp_servers.research_broker.url=${JSON.stringify(request.brokerUrl)}`, "-c", "mcp_servers.research_broker.required=true", "-c", 'mcp_servers.research_broker.enabled_tools=["fetch_candidate_source"]');
+        }
+        if (request.route.model)
+            args.push("--model", request.route.model);
+        args.push(request.prompt);
+        return { binary: resolvedBinary, args };
+    }
+    const toolPolicy = request.toolPolicy ?? "workspace-read";
+    const args = [
+        "-p",
+        request.prompt,
+        "--output-format",
+        "json",
+        "--permission-mode",
+        "default",
+        "--no-session-persistence",
+        "--max-turns",
+        String(request.maxTurns),
+        "--setting-sources",
+        "",
+        "--no-chrome",
+        "--disable-slash-commands",
+        "--tools",
+        toolPolicy === "none" ? "" : "Read,Glob,Grep",
+        "--effort",
+        request.route.effort ?? DEFAULT_AGENT_EFFORT,
+    ];
+    if (request.purpose !== "repair") {
+        args.splice(4, 0, "--json-schema", JSON.stringify(request.outputSchema));
+    }
+    const allowedTools = toolPolicy === "none" ? [] : ["Read", "Glob", "Grep"];
+    if (request.brokerUrl) {
+        const mcpConfigPath = join(request.capsuleRoot, "research-mcp.json");
+        await writeFile(mcpConfigPath, `${JSON.stringify({
+            mcpServers: {
+                research_broker: { type: "http", url: request.brokerUrl },
+            },
+        })}\n`, { encoding: "utf8", mode: 0o600 });
+        allowedTools.push("mcp__research_broker__fetch_candidate_source");
+        args.push("--strict-mcp-config", "--mcp-config", mcpConfigPath);
+    }
+    args.push("--allowedTools", allowedTools.join(","));
+    if (request.maxCostUsd > 0)
+        args.push("--max-budget-usd", String(request.maxCostUsd));
+    if (request.route.model)
+        args.push("--model", request.route.model);
+    return { binary: resolvedBinary, args };
+}
+async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspaceRoot, targetBinary) {
+    const configuredCredentialPath = join(workspaceRoot, ".tiangong-research", ".env");
+    const workspaceCredentialPath = await realpath(configuredCredentialPath).catch(() => configuredCredentialPath);
+    if (platform() === "darwin") {
+        const sandbox = "/usr/bin/sandbox-exec";
+        await requireExecutable(sandbox, "macOS sandbox-exec");
+        const profile = join(capsuleRoot, "execution.sb");
+        const canonicalCapsuleRoot = await realpath(capsuleRoot);
+        const readRoots = await existingReadRoots(binary, targetBinary, canonicalCapsuleRoot);
+        const readClauses = readRoots.map((path) => `(subpath ${sandboxString(path)})`).join(" ");
+        const policy = [
+            "(version 1)",
+            "(deny default)",
+            "(allow process*)",
+            "(allow network*)",
+            "(allow file-read-metadata)",
+            `(allow file-read* ${readClauses} (literal "/") (literal "/var") (literal "/dev/dtracehelper") (literal "/dev/null") (literal "/dev/urandom"))`,
+            `(deny file-read* (literal ${sandboxString(workspaceCredentialPath)}))`,
+            '(allow file-ioctl (literal "/dev/dtracehelper"))',
+            "(allow sysctl-read)",
+            "(allow mach-lookup)",
+            "(allow ipc-posix*)",
+            `(allow file-write* (literal "/dev/dtracehelper") (literal "/dev/null") (subpath ${sandboxString(canonicalCapsuleRoot)}))`,
+            "",
+        ].join("\n");
+        await writeFile(profile, policy, { encoding: "utf8", mode: 0o600 });
+        return { binary: sandbox, args: ["-f", profile, binary, ...args] };
+    }
+    if (platform() === "linux") {
+        const bubblewrap = await firstExecutable([
+            "/usr/bin/bwrap",
+            "/usr/local/bin/bwrap",
+            "/bin/bwrap",
+        ]);
+        if (!bubblewrap) {
+            throw new CliError("Linux research execution requires Bubblewrap.", {
+                code: "RESEARCH_SANDBOX_UNAVAILABLE",
+                exitCode: 3,
+            });
+        }
+        const sandboxArgs = ["--die-with-parent", "--new-session"];
+        const systemRoots = await existingLinuxSystemRoots();
+        for (const path of systemRoots) {
+            sandboxArgs.push("--ro-bind", path, path);
+        }
+        const createdDirectories = new Set(systemRoots);
+        const runtimeRoots = [
+            executableReadRoot(binary),
+            executableReadRoot(targetBinary),
+            executableReadRoot(process.execPath),
+        ];
+        for (const runtimeRoot of [...new Set(runtimeRoots)]) {
+            if (runtimeRoot.startsWith(`${capsuleRoot}/`) ||
+                systemRoots.some((root) => runtimeRoot === root || runtimeRoot.startsWith(`${root}/`))) {
+                continue;
+            }
+            await appendBubblewrapParentDirectories(sandboxArgs, runtimeRoot, createdDirectories);
+            sandboxArgs.push("--ro-bind", runtimeRoot, runtimeRoot);
+            createdDirectories.add(runtimeRoot);
+        }
+        await appendBubblewrapParentDirectories(sandboxArgs, capsuleRoot, createdDirectories);
+        sandboxArgs.push("--bind", capsuleRoot, capsuleRoot, "--proc", "/proc", "--dev", "/dev", "--chdir", projectRoot);
+        if (workspaceCredentialPath.startsWith(`${capsuleRoot}/`) &&
+            (await pathIsReadable(workspaceCredentialPath))) {
+            sandboxArgs.push("--ro-bind", "/dev/null", workspaceCredentialPath);
+        }
+        sandboxArgs.push(binary, ...args);
+        return { binary: bubblewrap, args: sandboxArgs };
+    }
+    throw new CliError(`Unsupported research execution platform: ${platform()}`, {
+        code: "RESEARCH_SANDBOX_UNAVAILABLE",
+        exitCode: 3,
+    });
+}
+async function prepareCapsuleHome(route, capsuleHome, environment) {
+    await mkdir(capsuleHome, { recursive: true, mode: 0o700 });
+    const sourceHome = environment.HOME && isAbsolute(environment.HOME) ? environment.HOME : homedir();
+    const claudeConfigRoot = environment.CLAUDE_CONFIG_DIR && isAbsolute(environment.CLAUDE_CONFIG_DIR)
+        ? environment.CLAUDE_CONFIG_DIR
+        : join(sourceHome, ".claude");
+    const candidates = route.agent === "codex"
+        ? [
+            {
+                source: join(environment.CODEX_HOME && isAbsolute(environment.CODEX_HOME)
+                    ? environment.CODEX_HOME
+                    : join(sourceHome, ".codex"), "auth.json"),
+                destination: join(capsuleHome, ".codex", "auth.json"),
+            },
+        ]
+        : [
+            {
+                source: join(claudeConfigRoot, ".credentials.json"),
+                destination: join(capsuleHome, ".claude", ".credentials.json"),
+            },
+        ];
+    const secrets = [];
+    for (const candidate of candidates) {
+        const info = await lstat(candidate.source).catch(() => undefined);
+        if (!info)
+            continue;
+        if (!info.isFile() || info.isSymbolicLink()) {
+            throw new CliError(`Configured ${route.agent} authentication material is not a regular file.`, {
+                code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+                exitCode: 3,
+            });
+        }
+        assertOwnerOnlyAuthenticationFile(info.mode, route.agent);
+        await mkdir(dirname(candidate.destination), { recursive: true, mode: 0o700 });
+        await copyFile(candidate.source, candidate.destination, fsConstants.COPYFILE_EXCL);
+        await chmod(candidate.destination, 0o600);
+        secrets.push(...authSecretValues(await readFile(candidate.destination, "utf8")));
+    }
+    const settingsEnvironment = route.agent === "claude"
+        ? await readClaudeSettingsEnvironment(join(claudeConfigRoot, "settings.json"))
+        : {};
+    for (const name of ROUTE_AUTH_ENVIRONMENT[route.agent]) {
+        const value = settingsEnvironment[name];
+        if (value && value.length >= 8)
+            secrets.push(value);
+    }
+    return {
+        secrets: [...new Set(secrets)].sort((left, right) => right.length - left.length),
+        environment: settingsEnvironment,
+    };
+}
+async function readClaudeSettingsEnvironment(path) {
+    const info = await lstat(path).catch(() => undefined);
+    if (!info)
+        return {};
+    if (!info.isFile() || info.isSymbolicLink()) {
+        throw new CliError("Claude settings authentication source is not a regular file.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+    let value;
+    try {
+        value = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch {
+        throw new CliError("Claude settings authentication source is not valid JSON.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+    if (!isObject(value) || !isObject(value.env))
+        return {};
+    const selected = {};
+    for (const name of CLAUDE_SETTINGS_ENVIRONMENT) {
+        const candidate = value.env[name];
+        if (candidate === undefined)
+            continue;
+        if (typeof candidate !== "string" || candidate.length === 0) {
+            throw new CliError(`Claude settings ${name} must be a non-empty string.`, {
+                code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+                exitCode: 3,
+            });
+        }
+        if (ROUTE_AUTH_ENVIRONMENT.claude.includes(name) && candidate.length < 8) {
+            throw new CliError(`Claude settings ${name} is too short to be valid.`, {
+                code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+                exitCode: 3,
+            });
+        }
+        if (name === "ANTHROPIC_BASE_URL")
+            assertSafeClaudeBaseUrl(candidate);
+        selected[name] = candidate;
+    }
+    if (Object.keys(selected).some((name) => ROUTE_AUTH_ENVIRONMENT.claude.includes(name))) {
+        assertOwnerOnlyAuthenticationFile(info.mode, "claude");
+    }
+    return selected;
+}
+function assertSafeClaudeBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliError("Claude ANTHROPIC_BASE_URL must be a valid HTTPS URL.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new CliError("Claude ANTHROPIC_BASE_URL must use HTTPS without embedded credentials.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+}
+function assertOwnerOnlyAuthenticationFile(mode, agent) {
+    if (platform() !== "win32" && (mode & 0o077) !== 0) {
+        throw new CliError(`Configured ${agent} authentication material must be owner-only (0600).`, {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+}
+async function fingerprintResolvedBinary(route, launcher, target, pathValue) {
+    const versionEnvironment = {
+        PATH: pathValue ?? process.env.PATH,
+        NO_COLOR: "1",
+    };
+    if (route.wrapperTargetBinary)
+        versionEnvironment[WRAPPER_TARGET_ENV] = target;
+    const version = await spawnCaptured({
+        binary: launcher,
+        args: ["--version"],
+        cwd: dirname(launcher),
+        env: versionEnvironment,
+        timeoutMs: 10_000,
+        maxCaptureBytes: 64 * 1024,
+    }).catch((error) => {
+        throw new CliError(`Could not inspect the configured ${route.agent} executable.`, {
+            code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+            exitCode: 3,
+            details: {
+                error: sanitizeResearchText(error instanceof Error ? error.message : String(error)),
+            },
+        });
+    });
+    const binaryVersion = `${version.stdout}\n${version.stderr}`.trim().split(/\r?\n/, 1)[0] ?? "";
+    if (version.exitCode !== 0 || !binaryVersion) {
+        throw new CliError(`Configured ${route.agent} executable did not report a version.`, {
+            code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+            exitCode: 3,
+        });
+    }
+    return {
+        agent: route.agent,
+        model: route.model,
+        effort: route.effort ?? DEFAULT_AGENT_EFFORT,
+        verbosity: route.agent === "codex" ? (route.verbosity ?? DEFAULT_CODEX_VERBOSITY) : null,
+        binarySha256: await sha256File(target),
+        wrapperSha256: await sha256File(launcher),
+        adapterSha256: await sha256File(EXECUTOR_WRAPPER_PATH),
+        binaryVersion: sanitizeResearchText(binaryVersion).slice(0, 300),
+        platform: platform(),
+        architecture: arch(),
+    };
+}
+async function resolveAgentExecutables(route, pathValue) {
+    const launcher = await resolveExecutable(route.binary, pathValue);
+    const target = route.wrapperTargetBinary
+        ? await resolveExecutable(route.wrapperTargetBinary, pathValue)
+        : launcher;
+    if (launcher === target && route.wrapperTargetBinary) {
+        throw new CliError("Agent wrapper and wrapper target resolve to the same executable.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    return { launcher, target };
+}
+async function resolveExecutable(binary, pathValue) {
+    const candidates = isAbsolute(binary)
+        ? [binary]
+        : (pathValue ?? process.env.PATH ?? "")
+            .split(delimiter)
+            .filter(Boolean)
+            .map((directory) => resolve(directory, binary));
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, fsConstants.X_OK);
+            const info = await lstat(candidate);
+            if (!info.isFile() && !info.isSymbolicLink())
+                continue;
+            return await realpath(candidate);
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new CliError(`Configured executable is unavailable: ${binary}`, {
+        code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+        exitCode: 3,
+    });
+}
+async function spawnCaptured(input) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn(input.binary, input.args, {
+            cwd: input.cwd,
+            env: input.env,
+            shell: false,
+            detached: platform() !== "win32",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        let capturedBytes = 0;
+        let captureExceeded = false;
+        let settled = false;
+        const terminate = () => {
+            if (!child.pid)
+                return;
+            try {
+                if (platform() === "win32")
+                    child.kill("SIGKILL");
+                else
+                    process.kill(-child.pid, "SIGKILL");
+            }
+            catch {
+                child.kill("SIGKILL");
+            }
+        };
+        const timer = setTimeout(() => terminate(), input.timeoutMs);
+        const capture = (target, chunk) => {
+            capturedBytes += chunk.length;
+            if (capturedBytes > input.maxCaptureBytes) {
+                captureExceeded = true;
+                terminate();
+                return;
+            }
+            target.push(chunk);
+        };
+        child.stdout.on("data", (chunk) => capture(stdout, chunk));
+        child.stderr.on("data", (chunk) => capture(stderr, chunk));
+        child.on("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on("close", (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            const detail = signal ? `\nprocess terminated by ${signal}` : "";
+            resolvePromise({
+                exitCode: typeof code === "number" ? code : 70,
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: `${Buffer.concat(stderr).toString("utf8")}${detail}`,
+                captureExceeded,
+            });
+        });
+    });
+}
+function parseAgentResult(route, stdout, stderr) {
+    if (route.agent === "codex") {
+        let inputTokens = 0;
+        let cachedInputTokens = 0;
+        let outputTokens = 0;
+        let model = route.model;
+        const messages = [];
+        let parsedEvents = 0;
+        const eventCounts = {};
+        const itemCounts = {};
+        let toolCalls = 0;
+        let reasoningOutputTokens = 0;
+        const providerErrors = [];
+        for (const line of stdout.split(/\r?\n/)) {
+            if (!line.trim())
+                continue;
+            try {
+                const event = JSON.parse(line);
+                parsedEvents += 1;
+                if (typeof event.type === "string")
+                    incrementCount(eventCounts, event.type);
+                if (event.type === "error")
+                    appendProviderError(providerErrors, event);
+                if (event.type === "turn.completed" && isObject(event.usage)) {
+                    cachedInputTokens = numeric(event.usage.cached_input_tokens);
+                    inputTokens = Math.max(0, numeric(event.usage.input_tokens) - cachedInputTokens);
+                    outputTokens = numeric(event.usage.output_tokens);
+                    reasoningOutputTokens = numeric(event.usage.reasoning_output_tokens);
+                }
+                if (typeof event.model === "string")
+                    model = event.model;
+                if (event.type === "item.completed" && isObject(event.item)) {
+                    if (typeof event.item.type === "string") {
+                        incrementCount(itemCounts, event.item.type);
+                        if (isToolItemType(event.item.type))
+                            toolCalls += 1;
+                        if (event.item.type === "error")
+                            appendProviderError(providerErrors, event.item);
+                    }
+                    if (event.item.type === "agent_message" && typeof event.item.text === "string") {
+                        messages.push(event.item.text);
+                    }
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+        return {
+            stdout: messages.at(-1) ?? stdout,
+            stderr,
+            inputTokens,
+            cachedInputTokens,
+            outputTokens,
+            costUsd: 0,
+            model,
+            parseFailed: parsedEvents === 0 || messages.length === 0,
+            telemetry: {
+                eventCounts,
+                itemCounts,
+                toolCalls,
+                providerTurns: eventCounts["turn.completed"] ?? eventCounts["turn.started"] ?? null,
+                reasoningOutputTokens,
+                providerErrors,
+            },
+        };
+    }
+    try {
+        const value = JSON.parse(stdout);
+        const usage = isObject(value.usage) ? value.usage : {};
+        return {
+            stdout: typeof value.result === "string" ? value.result : stdout,
+            stderr,
+            inputTokens: numeric(usage.input_tokens),
+            cachedInputTokens: numeric(usage.cache_creation_input_tokens) + numeric(usage.cache_read_input_tokens),
+            outputTokens: numeric(usage.output_tokens),
+            costUsd: numeric(value.total_cost_usd),
+            model: typeof value.model === "string" ? value.model : route.model,
+            parseFailed: typeof value.result !== "string",
+            telemetry: {
+                eventCounts: { result: 1 },
+                itemCounts: {},
+                toolCalls: 0,
+                providerTurns: numeric(value.num_turns) || null,
+                reasoningOutputTokens: numeric(usage.reasoning_output_tokens),
+                providerErrors: [],
+            },
+        };
+    }
+    catch {
+        return {
+            stdout,
+            stderr,
+            inputTokens: 0,
+            cachedInputTokens: 0,
+            outputTokens: 0,
+            costUsd: 0,
+            model: route.model,
+            parseFailed: true,
+            telemetry: {
+                eventCounts: {},
+                itemCounts: {},
+                toolCalls: 0,
+                providerTurns: null,
+                reasoningOutputTokens: 0,
+                providerErrors: [],
+            },
+        };
+    }
+}
+function sanitizedEnvironment(source, temporaryDirectory, capsuleHome, route, targetBinary, capsuleAuthEnvironment) {
+    const environment = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (!value || isSensitiveEnvironmentName(name))
+            continue;
+        if (name === "HOME" ||
+            name === "CODEX_HOME" ||
+            name === "CLAUDE_CONFIG_DIR" ||
+            name === WRAPPER_TARGET_ENV) {
+            continue;
+        }
+        environment[name] = value;
+    }
+    for (const [name, value] of Object.entries(capsuleAuthEnvironment)) {
+        if (value)
+            environment[name] = value;
+    }
+    const explicitRouteEnvironment = route.agent === "claude" ? CLAUDE_SETTINGS_ENVIRONMENT : ROUTE_AUTH_ENVIRONMENT[route.agent];
+    for (const name of explicitRouteEnvironment) {
+        const value = source[name];
+        if (value)
+            environment[name] = value;
+    }
+    environment.HOME = capsuleHome;
+    if (route.agent === "codex") {
+        environment.CODEX_HOME = join(capsuleHome, ".codex");
+    }
+    else {
+        environment.CLAUDE_CONFIG_DIR = join(capsuleHome, ".claude");
+        environment.CLAUDE_TMPDIR = temporaryDirectory;
+        environment.CLAUDE_CODE_TMPDIR = temporaryDirectory;
+        environment.BUN_TMPDIR = temporaryDirectory;
+    }
+    environment.NO_COLOR = "1";
+    if (route.wrapperTargetBinary)
+        environment[WRAPPER_TARGET_ENV] = targetBinary;
+    environment.TMPDIR = temporaryDirectory;
+    environment.TMP = temporaryDirectory;
+    environment.TEMP = temporaryDirectory;
+    return environment;
+}
+function redactResult(stdout, stderr, secrets) {
+    let exposed = false;
+    for (const secret of secrets) {
+        if (stdout.includes(secret) || stderr.includes(secret))
+            exposed = true;
+    }
+    return {
+        stdout: sanitizeResearchText(stdout, secrets),
+        stderr: sanitizeResearchText(stderr, secrets),
+        exposed,
+    };
+}
+function estimateCost(route, usage) {
+    if (!route.pricing)
+        return 0;
+    return roundMoney((usage.inputTokens * route.pricing.inputUsdPerMillionTokens +
+        usage.cachedInputTokens * route.pricing.cachedInputUsdPerMillionTokens +
+        usage.outputTokens * route.pricing.outputUsdPerMillionTokens) /
+        1_000_000);
+}
+function authSecretValues(content) {
+    try {
+        const value = JSON.parse(content);
+        const secrets = new Set();
+        collectSensitiveJsonValues(value, "", secrets);
+        return [...secrets].sort((left, right) => right.length - left.length);
+    }
+    catch {
+        return [];
+    }
+}
+function collectSensitiveJsonValues(value, key, target) {
+    if (typeof value === "string") {
+        if (isSensitiveEnvironmentName(key) && value.length >= 8)
+            target.add(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectSensitiveJsonValues(item, key, target);
+        return;
+    }
+    if (!isObject(value))
+        return;
+    for (const [childKey, item] of Object.entries(value)) {
+        collectSensitiveJsonValues(item, childKey, target);
+    }
+}
+async function existingReadRoots(launcher, target, capsuleRoot) {
+    const candidates = [
+        capsuleRoot,
+        "/System",
+        "/usr",
+        "/bin",
+        "/sbin",
+        "/private/etc/hosts",
+        "/private/etc/resolv.conf",
+        "/private/etc/ssl",
+        "/private/var/db/timezone",
+        "/private/var/run",
+        "/private/var/select",
+        executableReadRoot(launcher),
+        executableReadRoot(target),
+        executableReadRoot(process.execPath),
+    ];
+    const result = [];
+    for (const candidate of candidates) {
+        if (result.some((root) => candidate === root || candidate.startsWith(`${root}/`)))
+            continue;
+        if (await lstat(candidate).catch(() => undefined))
+            result.push(candidate);
+    }
+    return result;
+}
+function executableReadRoot(binary) {
+    const parent = dirname(binary);
+    return dirname(parent);
+}
+async function existingLinuxSystemRoots() {
+    const candidates = ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc", "/opt"];
+    const roots = [];
+    for (const candidate of candidates) {
+        if (await lstat(candidate).catch(() => undefined))
+            roots.push(candidate);
+    }
+    return roots;
+}
+async function appendBubblewrapParentDirectories(args, target, created) {
+    const parts = resolve(target).split("/").filter(Boolean);
+    let current = "";
+    for (const part of parts.slice(0, -1)) {
+        current += `/${part}`;
+        if (!(await lstat(current).catch(() => undefined)))
+            continue;
+        if ([...created].some((directory) => current === directory || current.startsWith(`${directory}/`))) {
+            continue;
+        }
+        args.push("--dir", current);
+        created.add(current);
+    }
+}
+async function pathIsReadable(path) {
+    try {
+        await access(path, fsConstants.R_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function validateAgentBinary(route) {
+    if (!isAbsolute(route.binary) && route.binary !== route.agent) {
+        throw new CliError(`Configured ${route.agent} binary must be absolute or exactly '${route.agent}'.`, {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    if (route.wrapperTargetBinary &&
+        (!isAbsolute(route.binary) || !isAbsolute(route.wrapperTargetBinary))) {
+        throw new CliError("An agent wrapper and its wrapperTargetBinary must both use explicit absolute paths.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    if (route.wrapperTargetBinary === route.binary) {
+        throw new CliError("Agent wrapperTargetBinary must differ from the wrapper path.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+}
+async function requireExecutable(path, label) {
+    try {
+        await access(path, fsConstants.X_OK);
+    }
+    catch {
+        throw new CliError(`${label} is unavailable: ${path}`, {
+            code: "RESEARCH_SANDBOX_UNAVAILABLE",
+            exitCode: 3,
+        });
+    }
+}
+async function firstExecutable(candidates) {
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, fsConstants.X_OK);
+            return candidate;
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}
+function sandboxString(value) {
+    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function numeric(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function roundMoney(value) {
+    return Math.round(value * 1_000_000) / 1_000_000;
+}
+function incrementCount(target, key) {
+    target[key] = (target[key] ?? 0) + 1;
+}
+function appendProviderError(target, value) {
+    if (target.length >= 10)
+        return;
+    const candidate = [value.message, value.error, value.detail]
+        .map((item) => {
+        if (typeof item === "string")
+            return item;
+        if (isObject(item))
+            return JSON.stringify(item);
+        return "";
+    })
+        .find(Boolean);
+    if (!candidate)
+        return;
+    const bounded = candidate.slice(0, 1_000);
+    if (!target.includes(bounded))
+        target.push(bounded);
+}
+function sanitizeExecutionTelemetry(telemetry, secrets) {
+    return {
+        ...telemetry,
+        providerErrors: telemetry.providerErrors.map((error) => sanitizeResearchText(error, secrets).slice(0, 1_000)),
+    };
+}
+function isToolItemType(value) {
+    return (value === "command_execution" ||
+        value === "mcp_tool_call" ||
+        value === "web_search" ||
+        value === "dynamic_tool_call" ||
+        value === "tool_call" ||
+        value.endsWith("_tool_call"));
+}
+function sameRuntimeFingerprint(actual, expected) {
+    return (actual.agent === expected.agent &&
+        actual.model === expected.model &&
+        actual.effort === expected.effort &&
+        actual.verbosity === expected.verbosity &&
+        actual.binarySha256 === expected.binarySha256 &&
+        actual.wrapperSha256 === expected.wrapperSha256 &&
+        actual.adapterSha256 === expected.adapterSha256 &&
+        actual.binaryVersion === expected.binaryVersion &&
+        actual.platform === expected.platform &&
+        actual.architecture === expected.architecture);
+}
+//# sourceMappingURL=executor.js.map