@tiangong-ai/cli 0.0.20 → 0.0.22

package/dist/research/workspace/executor.js

@@ -1,47 +1,156 @@
 import { spawn } from "node:child_process";
-import { access, mkdir, realpath, writeFile } from "node:fs/promises";
 import { constants as fsConstants } from "node:fs";
-import { homedir, platform } from "node:os";
-import { isAbsolute, join } from "node:path";
+import { access, chmod, copyFile, lstat, mkdir, readFile, realpath, writeFile, } from "node:fs/promises";
+import { arch, homedir, platform } from "node:os";
+import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { CliError } from "../../errors.js";
+import { configuredResearchSecrets, isSensitiveEnvironmentName, sanitizeResearchText, } from "./sanitization.js";
+import { isObject, sha256File } from "./storage.js";
 const MAX_CAPTURE_BYTES = 5 * 1024 * 1024;
-const CREDENTIAL_ENV_NAME = /(^|[_-])(authorization|auth|cookie|credential|password|passwd|private[_-]?key|secret|token|access[_-]?key|api[_-]?key)([_-]|$)/i;
+const MIN_CAPTURE_BYTES = 64 * 1024;
+const BYTES_PER_OUTPUT_TOKEN = 16;
+const EXECUTOR_WRAPPER_PATH = fileURLToPath(import.meta.url);
+const WRAPPER_TARGET_ENV = "TIANGONG_RESEARCH_AGENT_BINARY";
+const CODEX_DISABLED_FEATURES = [
+    "apps",
+    "auth_elicitation",
+    "browser_use",
+    "computer_use",
+    "goals",
+    "guardian_approval",
+    "hooks",
+    "image_generation",
+    "in_app_browser",
+    "mentions_v2",
+    "multi_agent",
+    "personality",
+    "plugins",
+    "remote_plugin",
+    "skill_mcp_dependency_install",
+    "skill_search",
+    "tool_call_mcp_elicitation",
+    "tool_suggest",
+    "workspace_dependencies",
+];
+const ROUTE_AUTH_ENVIRONMENT = {
+    codex: ["OPENAI_API_KEY"],
+    claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"],
+};
+const CLAUDE_SETTINGS_ENVIRONMENT = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+];
+const DEFAULT_AGENT_EFFORT = "low";
+const DEFAULT_CODEX_VERBOSITY = "low";
 export async function executeAgent(request) {
     validateAgentBinary(request.route);
+    if (!Number.isInteger(request.maxOutputTokens) || request.maxOutputTokens < 1) {
+        throw new CliError("Agent max output tokens must be a positive integer.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    if (!Number.isInteger(request.maxTurns) || request.maxTurns < 1) {
+        throw new CliError("Agent max turns must be a positive integer.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
     const temporaryDirectory = join(request.capsuleRoot, "tmp");
     await mkdir(temporaryDirectory, { recursive: true, mode: 0o700 });
-    const secrets = configuredSecrets(request.environment);
-    const invocation = await buildInvocation(request.route, request.prompt, request.brokerUrl, request.capsuleRoot);
-    const sandboxed = await sandboxInvocation(invocation.binary, invocation.args, request.capsuleRoot, request.projectRoot, request.workspaceRoot);
+    const executables = await resolveAgentExecutables(request.route, request.environment.PATH);
+    const runtime = await fingerprintResolvedBinary(request.route, executables.launcher, executables.target, request.environment.PATH);
+    if (request.expectedRuntime && !sameRuntimeFingerprint(runtime, request.expectedRuntime)) {
+        throw new CliError(`Configured ${request.route.agent} runtime drifted after the successful doctor smoke.`, {
+            code: "RESEARCH_EXECUTOR_DRIFT",
+            exitCode: 3,
+            details: {
+                agent: request.route.agent,
+                expectedBinarySha256: request.expectedRuntime.binarySha256,
+                actualBinarySha256: runtime.binarySha256,
+                expectedWrapperSha256: request.expectedRuntime.wrapperSha256,
+                actualWrapperSha256: runtime.wrapperSha256,
+                expectedAdapterSha256: request.expectedRuntime.adapterSha256,
+                actualAdapterSha256: runtime.adapterSha256,
+            },
+        });
+    }
+    const capsuleHome = join(request.capsuleRoot, "home");
+    const capsuleAuth = await prepareCapsuleHome(request.route, capsuleHome, request.environment);
+    const secrets = [...configuredResearchSecrets(request.environment), ...capsuleAuth.secrets];
+    const invocation = await buildInvocation(request, executables.launcher, join(request.capsuleRoot, `${request.purpose}-output-schema.json`));
+    const sandboxed = await sandboxInvocation(invocation.binary, invocation.args, request.capsuleRoot, request.projectRoot, request.workspaceRoot, executables.target);
     const started = process.hrtime.bigint();
-    const completed = await spawnCaptured({
-        binary: sandboxed.binary,
-        args: sandboxed.args,
-        cwd: request.projectRoot,
-        env: sanitizedEnvironment(request.environment, temporaryDirectory),
-        timeoutMs: request.timeoutSeconds * 1000,
-    });
+    let completed;
+    try {
+        completed = await spawnCaptured({
+            binary: sandboxed.binary,
+            args: sandboxed.args,
+            cwd: request.projectRoot,
+            env: sanitizedEnvironment(request.environment, temporaryDirectory, capsuleHome, request.route, executables.target, capsuleAuth.environment),
+            timeoutMs: request.timeoutSeconds * 1000,
+            maxCaptureBytes: Math.min(MAX_CAPTURE_BYTES, Math.max(MIN_CAPTURE_BYTES, request.maxOutputTokens * BYTES_PER_OUTPUT_TOKEN)),
+        });
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new CliError(`Configured ${request.route.agent} executable is unavailable.`, {
+                code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+                exitCode: 3,
+            });
+        }
+        throw error;
+    }
     const wallSeconds = Number(process.hrtime.bigint() - started) / 1_000_000_000;
-    const parsed = parseAgentResult(request.route.agent, completed.stdout, completed.stderr);
+    const parsed = parseAgentResult(request.route, completed.stdout, completed.stderr);
     const redacted = redactResult(parsed.stdout, parsed.stderr, secrets);
     const exitCode = redacted.exposed
         ? 86
-        : completed.exitCode !== 0
-            ? completed.exitCode
-            : parsed.parseFailed
-                ? 3
-                : 0;
+        : completed.captureExceeded
+            ? 75
+            : completed.exitCode !== 0
+                ? completed.exitCode
+                : parsed.parseFailed
+                    ? 3
+                    : 0;
+    const inputTokens = redacted.exposed ? 0 : parsed.inputTokens;
+    const cachedInputTokens = redacted.exposed ? 0 : parsed.cachedInputTokens;
+    const outputTokens = redacted.exposed ? 0 : parsed.outputTokens;
+    const tokens = inputTokens + cachedInputTokens + outputTokens;
+    const providerCost = redacted.exposed ? 0 : parsed.costUsd;
+    const costUsd = providerCost > 0 ? providerCost : estimateCost(request.route, parsed);
     return {
         exitCode,
         stdout: redacted.stdout,
-        stderr: redacted.stderr,
-        tokens: redacted.exposed ? 0 : parsed.tokens,
-        costUsd: redacted.exposed ? 0 : parsed.costUsd,
+        stderr: completed.captureExceeded
+            ? `${redacted.stderr}\nagent output exceeded the configured capture limit`.trim()
+            : redacted.stderr,
+        tokens,
+        inputTokens,
+        cachedInputTokens,
+        outputTokens,
+        costUsd,
         wallSeconds,
+        model: parsed.model ?? request.route.model,
+        runtime: { ...runtime, model: parsed.model ?? request.route.model },
+        telemetry: sanitizeExecutionTelemetry(parsed.telemetry, secrets),
     };
 }
-async function buildInvocation(route, prompt, brokerUrl, capsuleRoot) {
-    if (route.agent === "codex") {
+export async function fingerprintAgentRoute(route, environment) {
+    validateAgentBinary(route);
+    const executables = await resolveAgentExecutables(route, environment.PATH);
+    return fingerprintResolvedBinary(route, executables.launcher, executables.target, environment.PATH);
+}
+async function buildInvocation(request, resolvedBinary, outputSchemaPath) {
+    await writeFile(outputSchemaPath, `${JSON.stringify(request.outputSchema, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    if (request.route.agent === "codex") {
+        const toolPolicy = request.toolPolicy ?? "workspace-read";
         const args = [
             "exec",
             "--ignore-user-config",
@@ -52,67 +161,90 @@ async function buildInvocation(route, prompt, brokerUrl, capsuleRoot) {
             "--color",
             "never",
             "--sandbox",
-            "workspace-write",
+            "read-only",
             "-c",
             'web_search="disabled"',
+            "--output-schema",
+            outputSchemaPath,
             "--json",
         ];
-        if (brokerUrl) {
-            args.push("-c", `mcp_servers.research_broker.url=${JSON.stringify(brokerUrl)}`, "-c", "mcp_servers.research_broker.required=true", "-c", 'mcp_servers.research_broker.enabled_tools=["fetch_candidate_source"]');
+        for (const feature of CODEX_DISABLED_FEATURES)
+            args.push("--disable", feature);
+        if (toolPolicy === "none")
+            args.push("--disable", "shell_tool", "--disable", "unified_exec");
+        args.push("-c", "include_apps_instructions=false", "-c", "include_collaboration_mode_instructions=false", "-c", "include_environment_context=false", "-c", "include_permissions_instructions=false", "-c", `model_reasoning_effort=${JSON.stringify(request.route.effort ?? DEFAULT_AGENT_EFFORT)}`, "-c", `model_verbosity=${JSON.stringify(request.route.verbosity ?? DEFAULT_CODEX_VERBOSITY)}`);
+        if (request.brokerUrl) {
+            args.push("-c", `mcp_servers.research_broker.url=${JSON.stringify(request.brokerUrl)}`, "-c", "mcp_servers.research_broker.required=true", "-c", 'mcp_servers.research_broker.enabled_tools=["fetch_candidate_source"]');
         }
-        if (route.model)
-            args.push("--model", route.model);
-        args.push(prompt);
-        return { binary: route.binary, args };
+        if (request.route.model)
+            args.push("--model", request.route.model);
+        args.push(request.prompt);
+        return { binary: resolvedBinary, args };
     }
+    const toolPolicy = request.toolPolicy ?? "workspace-read";
     const args = [
         "-p",
-        prompt,
+        request.prompt,
         "--output-format",
         "json",
         "--permission-mode",
-        "acceptEdits",
+        "default",
         "--no-session-persistence",
+        "--max-turns",
+        String(request.maxTurns),
         "--setting-sources",
         "",
         "--no-chrome",
         "--disable-slash-commands",
         "--tools",
-        "Read,Write,Edit,Glob,Grep",
+        toolPolicy === "none" ? "" : "Read,Glob,Grep",
+        "--effort",
+        request.route.effort ?? DEFAULT_AGENT_EFFORT,
     ];
-    const allowedTools = ["Read", "Write", "Edit", "Glob", "Grep"];
-    if (brokerUrl) {
-        const mcpConfigPath = join(capsuleRoot, "research-mcp.json");
+    if (request.purpose !== "repair") {
+        args.splice(4, 0, "--json-schema", JSON.stringify(request.outputSchema));
+    }
+    const allowedTools = toolPolicy === "none" ? [] : ["Read", "Glob", "Grep"];
+    if (request.brokerUrl) {
+        const mcpConfigPath = join(request.capsuleRoot, "research-mcp.json");
         await writeFile(mcpConfigPath, `${JSON.stringify({
             mcpServers: {
-                research_broker: { type: "http", url: brokerUrl },
+                research_broker: { type: "http", url: request.brokerUrl },
             },
         })}\n`, { encoding: "utf8", mode: 0o600 });
         allowedTools.push("mcp__research_broker__fetch_candidate_source");
         args.push("--strict-mcp-config", "--mcp-config", mcpConfigPath);
     }
     args.push("--allowedTools", allowedTools.join(","));
-    if (route.model)
-        args.push("--model", route.model);
-    return { binary: route.binary, args };
+    if (request.maxCostUsd > 0)
+        args.push("--max-budget-usd", String(request.maxCostUsd));
+    if (request.route.model)
+        args.push("--model", request.route.model);
+    return { binary: resolvedBinary, args };
 }
-async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspaceRoot) {
+async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspaceRoot, targetBinary) {
     const configuredCredentialPath = join(workspaceRoot, ".tiangong-research", ".env");
     const workspaceCredentialPath = await realpath(configuredCredentialPath).catch(() => configuredCredentialPath);
     if (platform() === "darwin") {
         const sandbox = "/usr/bin/sandbox-exec";
         await requireExecutable(sandbox, "macOS sandbox-exec");
         const profile = join(capsuleRoot, "execution.sb");
+        const canonicalCapsuleRoot = await realpath(capsuleRoot);
+        const readRoots = await existingReadRoots(binary, targetBinary, canonicalCapsuleRoot);
+        const readClauses = readRoots.map((path) => `(subpath ${sandboxString(path)})`).join(" ");
         const policy = [
             "(version 1)",
             "(deny default)",
             "(allow process*)",
             "(allow network*)",
-            `(allow file-read* (require-not (literal ${sandboxString(workspaceCredentialPath)})))`,
+            "(allow file-read-metadata)",
+            `(allow file-read* ${readClauses} (literal "/") (literal "/var") (literal "/dev/dtracehelper") (literal "/dev/null") (literal "/dev/urandom"))`,
+            `(deny file-read* (literal ${sandboxString(workspaceCredentialPath)}))`,
+            '(allow file-ioctl (literal "/dev/dtracehelper"))',
             "(allow sysctl-read)",
             "(allow mach-lookup)",
             "(allow ipc-posix*)",
-            `(allow file-write* (literal "/dev/null") (subpath ${sandboxString(capsuleRoot)}))`,
+            `(allow file-write* (literal "/dev/dtracehelper") (literal "/dev/null") (subpath ${sandboxString(canonicalCapsuleRoot)}))`,
             "",
         ].join("\n");
         await writeFile(profile, policy, { encoding: "utf8", mode: 0o600 });
@@ -130,44 +262,244 @@ async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspa
                 exitCode: 3,
             });
         }
-        const sandboxArgs = [
-            "--die-with-parent",
-            "--new-session",
-            "--ro-bind",
-            "/",
-            "/",
-            "--bind",
-            capsuleRoot,
-            capsuleRoot,
-            "--proc",
-            "/proc",
-            "--dev",
-            "/dev",
-            "--chdir",
-            projectRoot,
+        const sandboxArgs = ["--die-with-parent", "--new-session"];
+        const systemRoots = await existingLinuxSystemRoots();
+        for (const path of systemRoots) {
+            sandboxArgs.push("--ro-bind", path, path);
+        }
+        const createdDirectories = new Set(systemRoots);
+        const runtimeRoots = [
+            executableReadRoot(binary),
+            executableReadRoot(targetBinary),
+            executableReadRoot(process.execPath),
         ];
-        if (await pathIsReadable(workspaceCredentialPath)) {
+        for (const runtimeRoot of [...new Set(runtimeRoots)]) {
+            if (runtimeRoot.startsWith(`${capsuleRoot}/`) ||
+                systemRoots.some((root) => runtimeRoot === root || runtimeRoot.startsWith(`${root}/`))) {
+                continue;
+            }
+            await appendBubblewrapParentDirectories(sandboxArgs, runtimeRoot, createdDirectories);
+            sandboxArgs.push("--ro-bind", runtimeRoot, runtimeRoot);
+            createdDirectories.add(runtimeRoot);
+        }
+        await appendBubblewrapParentDirectories(sandboxArgs, capsuleRoot, createdDirectories);
+        sandboxArgs.push("--bind", capsuleRoot, capsuleRoot, "--proc", "/proc", "--dev", "/dev", "--chdir", projectRoot);
+        if (workspaceCredentialPath.startsWith(`${capsuleRoot}/`) &&
+            (await pathIsReadable(workspaceCredentialPath))) {
             sandboxArgs.push("--ro-bind", "/dev/null", workspaceCredentialPath);
         }
         sandboxArgs.push(binary, ...args);
-        return {
-            binary: bubblewrap,
-            args: sandboxArgs,
-        };
+        return { binary: bubblewrap, args: sandboxArgs };
     }
     throw new CliError(`Unsupported research execution platform: ${platform()}`, {
         code: "RESEARCH_SANDBOX_UNAVAILABLE",
         exitCode: 3,
     });
 }
-async function pathIsReadable(path) {
+async function prepareCapsuleHome(route, capsuleHome, environment) {
+    await mkdir(capsuleHome, { recursive: true, mode: 0o700 });
+    const sourceHome = environment.HOME && isAbsolute(environment.HOME) ? environment.HOME : homedir();
+    const claudeConfigRoot = environment.CLAUDE_CONFIG_DIR && isAbsolute(environment.CLAUDE_CONFIG_DIR)
+        ? environment.CLAUDE_CONFIG_DIR
+        : join(sourceHome, ".claude");
+    const candidates = route.agent === "codex"
+        ? [
+            {
+                source: join(environment.CODEX_HOME && isAbsolute(environment.CODEX_HOME)
+                    ? environment.CODEX_HOME
+                    : join(sourceHome, ".codex"), "auth.json"),
+                destination: join(capsuleHome, ".codex", "auth.json"),
+            },
+        ]
+        : [
+            {
+                source: join(claudeConfigRoot, ".credentials.json"),
+                destination: join(capsuleHome, ".claude", ".credentials.json"),
+            },
+        ];
+    const secrets = [];
+    for (const candidate of candidates) {
+        const info = await lstat(candidate.source).catch(() => undefined);
+        if (!info)
+            continue;
+        if (!info.isFile() || info.isSymbolicLink()) {
+            throw new CliError(`Configured ${route.agent} authentication material is not a regular file.`, {
+                code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+                exitCode: 3,
+            });
+        }
+        assertOwnerOnlyAuthenticationFile(info.mode, route.agent);
+        await mkdir(dirname(candidate.destination), { recursive: true, mode: 0o700 });
+        await copyFile(candidate.source, candidate.destination, fsConstants.COPYFILE_EXCL);
+        await chmod(candidate.destination, 0o600);
+        secrets.push(...authSecretValues(await readFile(candidate.destination, "utf8")));
+    }
+    const settingsEnvironment = route.agent === "claude"
+        ? await readClaudeSettingsEnvironment(join(claudeConfigRoot, "settings.json"))
+        : {};
+    for (const name of ROUTE_AUTH_ENVIRONMENT[route.agent]) {
+        const value = settingsEnvironment[name];
+        if (value && value.length >= 8)
+            secrets.push(value);
+    }
+    return {
+        secrets: [...new Set(secrets)].sort((left, right) => right.length - left.length),
+        environment: settingsEnvironment,
+    };
+}
+async function readClaudeSettingsEnvironment(path) {
+    const info = await lstat(path).catch(() => undefined);
+    if (!info)
+        return {};
+    if (!info.isFile() || info.isSymbolicLink()) {
+        throw new CliError("Claude settings authentication source is not a regular file.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+    let value;
     try {
-        await access(path, fsConstants.R_OK);
-        return true;
+        value = JSON.parse(await readFile(path, "utf8"));
     }
     catch {
-        return false;
+        throw new CliError("Claude settings authentication source is not valid JSON.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+    if (!isObject(value) || !isObject(value.env))
+        return {};
+    const selected = {};
+    for (const name of CLAUDE_SETTINGS_ENVIRONMENT) {
+        const candidate = value.env[name];
+        if (candidate === undefined)
+            continue;
+        if (typeof candidate !== "string" || candidate.length === 0) {
+            throw new CliError(`Claude settings ${name} must be a non-empty string.`, {
+                code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+                exitCode: 3,
+            });
+        }
+        if (ROUTE_AUTH_ENVIRONMENT.claude.includes(name) && candidate.length < 8) {
+            throw new CliError(`Claude settings ${name} is too short to be valid.`, {
+                code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+                exitCode: 3,
+            });
+        }
+        if (name === "ANTHROPIC_BASE_URL")
+            assertSafeClaudeBaseUrl(candidate);
+        selected[name] = candidate;
+    }
+    if (Object.keys(selected).some((name) => ROUTE_AUTH_ENVIRONMENT.claude.includes(name))) {
+        assertOwnerOnlyAuthenticationFile(info.mode, "claude");
+    }
+    return selected;
+}
+function assertSafeClaudeBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliError("Claude ANTHROPIC_BASE_URL must be a valid HTTPS URL.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new CliError("Claude ANTHROPIC_BASE_URL must use HTTPS without embedded credentials.", {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+}
+function assertOwnerOnlyAuthenticationFile(mode, agent) {
+    if (platform() !== "win32" && (mode & 0o077) !== 0) {
+        throw new CliError(`Configured ${agent} authentication material must be owner-only (0600).`, {
+            code: "RESEARCH_EXECUTOR_AUTH_INVALID",
+            exitCode: 3,
+        });
+    }
+}
+async function fingerprintResolvedBinary(route, launcher, target, pathValue) {
+    const versionEnvironment = {
+        PATH: pathValue ?? process.env.PATH,
+        NO_COLOR: "1",
+    };
+    if (route.wrapperTargetBinary)
+        versionEnvironment[WRAPPER_TARGET_ENV] = target;
+    const version = await spawnCaptured({
+        binary: launcher,
+        args: ["--version"],
+        cwd: dirname(launcher),
+        env: versionEnvironment,
+        timeoutMs: 10_000,
+        maxCaptureBytes: 64 * 1024,
+    }).catch((error) => {
+        throw new CliError(`Could not inspect the configured ${route.agent} executable.`, {
+            code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+            exitCode: 3,
+            details: {
+                error: sanitizeResearchText(error instanceof Error ? error.message : String(error)),
+            },
+        });
+    });
+    const binaryVersion = `${version.stdout}\n${version.stderr}`.trim().split(/\r?\n/, 1)[0] ?? "";
+    if (version.exitCode !== 0 || !binaryVersion) {
+        throw new CliError(`Configured ${route.agent} executable did not report a version.`, {
+            code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+            exitCode: 3,
+        });
+    }
+    return {
+        agent: route.agent,
+        model: route.model,
+        effort: route.effort ?? DEFAULT_AGENT_EFFORT,
+        verbosity: route.agent === "codex" ? (route.verbosity ?? DEFAULT_CODEX_VERBOSITY) : null,
+        binarySha256: await sha256File(target),
+        wrapperSha256: await sha256File(launcher),
+        adapterSha256: await sha256File(EXECUTOR_WRAPPER_PATH),
+        binaryVersion: sanitizeResearchText(binaryVersion).slice(0, 300),
+        platform: platform(),
+        architecture: arch(),
+    };
+}
+async function resolveAgentExecutables(route, pathValue) {
+    const launcher = await resolveExecutable(route.binary, pathValue);
+    const target = route.wrapperTargetBinary
+        ? await resolveExecutable(route.wrapperTargetBinary, pathValue)
+        : launcher;
+    if (launcher === target && route.wrapperTargetBinary) {
+        throw new CliError("Agent wrapper and wrapper target resolve to the same executable.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    return { launcher, target };
+}
+async function resolveExecutable(binary, pathValue) {
+    const candidates = isAbsolute(binary)
+        ? [binary]
+        : (pathValue ?? process.env.PATH ?? "")
+            .split(delimiter)
+            .filter(Boolean)
+            .map((directory) => resolve(directory, binary));
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, fsConstants.X_OK);
+            const info = await lstat(candidate);
+            if (!info.isFile() && !info.isSymbolicLink())
+                continue;
+            return await realpath(candidate);
+        }
+        catch {
+            continue;
+        }
     }
+    throw new CliError(`Configured executable is unavailable: ${binary}`, {
+        code: "RESEARCH_EXECUTOR_UNAVAILABLE",
+        exitCode: 3,
+    });
 }
 async function spawnCaptured(input) {
     return new Promise((resolvePromise, reject) => {
@@ -181,6 +513,7 @@ async function spawnCaptured(input) {
         const stdout = [];
         const stderr = [];
         let capturedBytes = 0;
+        let captureExceeded = false;
         let settled = false;
         const terminate = () => {
             if (!child.pid)
@@ -198,7 +531,8 @@ async function spawnCaptured(input) {
         const timer = setTimeout(() => terminate(), input.timeoutMs);
         const capture = (target, chunk) => {
             capturedBytes += chunk.length;
-            if (capturedBytes > MAX_CAPTURE_BYTES) {
+            if (capturedBytes > input.maxCaptureBytes) {
+                captureExceeded = true;
                 terminate();
                 return;
             }
@@ -223,25 +557,50 @@ async function spawnCaptured(input) {
                 exitCode: typeof code === "number" ? code : 70,
                 stdout: Buffer.concat(stdout).toString("utf8"),
                 stderr: `${Buffer.concat(stderr).toString("utf8")}${detail}`,
+                captureExceeded,
             });
         });
     });
 }
-function parseAgentResult(agent, stdout, stderr) {
-    if (agent === "codex") {
-        let tokens = 0;
+function parseAgentResult(route, stdout, stderr) {
+    if (route.agent === "codex") {
+        let inputTokens = 0;
+        let cachedInputTokens = 0;
+        let outputTokens = 0;
+        let model = route.model;
         const messages = [];
         let parsedEvents = 0;
+        const eventCounts = {};
+        const itemCounts = {};
+        let toolCalls = 0;
+        let reasoningOutputTokens = 0;
+        const providerErrors = [];
         for (const line of stdout.split(/\r?\n/)) {
             if (!line.trim())
                 continue;
             try {
                 const event = JSON.parse(line);
                 parsedEvents += 1;
-                if (event.type === "turn.completed" && isRecord(event.usage)) {
-                    tokens = numeric(event.usage.input_tokens) + numeric(event.usage.output_tokens);
+                if (typeof event.type === "string")
+                    incrementCount(eventCounts, event.type);
+                if (event.type === "error")
+                    appendProviderError(providerErrors, event);
+                if (event.type === "turn.completed" && isObject(event.usage)) {
+                    cachedInputTokens = numeric(event.usage.cached_input_tokens);
+                    inputTokens = Math.max(0, numeric(event.usage.input_tokens) - cachedInputTokens);
+                    outputTokens = numeric(event.usage.output_tokens);
+                    reasoningOutputTokens = numeric(event.usage.reasoning_output_tokens);
                 }
-                if (event.type === "item.completed" && isRecord(event.item)) {
+                if (typeof event.model === "string")
+                    model = event.model;
+                if (event.type === "item.completed" && isObject(event.item)) {
+                    if (typeof event.item.type === "string") {
+                        incrementCount(itemCounts, event.item.type);
+                        if (isToolItemType(event.item.type))
+                            toolCalls += 1;
+                        if (event.item.type === "error")
+                            appendProviderError(providerErrors, event.item);
+                    }
                     if (event.item.type === "agent_message" && typeof event.item.text === "string") {
                         messages.push(event.item.text);
                     }
@@ -252,63 +611,217 @@ function parseAgentResult(agent, stdout, stderr) {
             }
         }
         return {
-            stdout: messages.length ? messages.join("\n") : stdout,
+            stdout: messages.at(-1) ?? stdout,
             stderr,
-            tokens,
+            inputTokens,
+            cachedInputTokens,
+            outputTokens,
             costUsd: 0,
-            parseFailed: parsedEvents === 0,
+            model,
+            parseFailed: parsedEvents === 0 || messages.length === 0,
+            telemetry: {
+                eventCounts,
+                itemCounts,
+                toolCalls,
+                providerTurns: eventCounts["turn.completed"] ?? eventCounts["turn.started"] ?? null,
+                reasoningOutputTokens,
+                providerErrors,
+            },
         };
     }
     try {
         const value = JSON.parse(stdout);
-        const usage = isRecord(value.usage) ? value.usage : {};
+        const usage = isObject(value.usage) ? value.usage : {};
         return {
             stdout: typeof value.result === "string" ? value.result : stdout,
             stderr,
-            tokens: numeric(usage.input_tokens) +
-                numeric(usage.output_tokens) +
-                numeric(usage.cache_creation_input_tokens) +
-                numeric(usage.cache_read_input_tokens),
+            inputTokens: numeric(usage.input_tokens),
+            cachedInputTokens: numeric(usage.cache_creation_input_tokens) + numeric(usage.cache_read_input_tokens),
+            outputTokens: numeric(usage.output_tokens),
             costUsd: numeric(value.total_cost_usd),
-            parseFailed: false,
+            model: typeof value.model === "string" ? value.model : route.model,
+            parseFailed: typeof value.result !== "string",
+            telemetry: {
+                eventCounts: { result: 1 },
+                itemCounts: {},
+                toolCalls: 0,
+                providerTurns: numeric(value.num_turns) || null,
+                reasoningOutputTokens: numeric(usage.reasoning_output_tokens),
+                providerErrors: [],
+            },
         };
     }
     catch {
-        return { stdout, stderr, tokens: 0, costUsd: 0, parseFailed: true };
+        return {
+            stdout,
+            stderr,
+            inputTokens: 0,
+            cachedInputTokens: 0,
+            outputTokens: 0,
+            costUsd: 0,
+            model: route.model,
+            parseFailed: true,
+            telemetry: {
+                eventCounts: {},
+                itemCounts: {},
+                toolCalls: 0,
+                providerTurns: null,
+                reasoningOutputTokens: 0,
+                providerErrors: [],
+            },
+        };
     }
 }
-function sanitizedEnvironment(source, temporaryDirectory) {
+function sanitizedEnvironment(source, temporaryDirectory, capsuleHome, route, targetBinary, capsuleAuthEnvironment) {
     const environment = {};
     for (const [name, value] of Object.entries(source)) {
-        if (!value || CREDENTIAL_ENV_NAME.test(name))
+        if (!value || isSensitiveEnvironmentName(name))
+            continue;
+        if (name === "HOME" ||
+            name === "CODEX_HOME" ||
+            name === "CLAUDE_CONFIG_DIR" ||
+            name === WRAPPER_TARGET_ENV) {
             continue;
+        }
         environment[name] = value;
     }
-    environment.HOME = homedir();
+    for (const [name, value] of Object.entries(capsuleAuthEnvironment)) {
+        if (value)
+            environment[name] = value;
+    }
+    const explicitRouteEnvironment = route.agent === "claude" ? CLAUDE_SETTINGS_ENVIRONMENT : ROUTE_AUTH_ENVIRONMENT[route.agent];
+    for (const name of explicitRouteEnvironment) {
+        const value = source[name];
+        if (value)
+            environment[name] = value;
+    }
+    environment.HOME = capsuleHome;
+    if (route.agent === "codex") {
+        environment.CODEX_HOME = join(capsuleHome, ".codex");
+    }
+    else {
+        environment.CLAUDE_CONFIG_DIR = join(capsuleHome, ".claude");
+        environment.CLAUDE_TMPDIR = temporaryDirectory;
+        environment.CLAUDE_CODE_TMPDIR = temporaryDirectory;
+        environment.BUN_TMPDIR = temporaryDirectory;
+    }
     environment.NO_COLOR = "1";
+    if (route.wrapperTargetBinary)
+        environment[WRAPPER_TARGET_ENV] = targetBinary;
     environment.TMPDIR = temporaryDirectory;
     environment.TMP = temporaryDirectory;
     environment.TEMP = temporaryDirectory;
     return environment;
 }
-function configuredSecrets(source) {
-    return [
-        ...new Set(Object.entries(source)
-            .filter(([name, value]) => CREDENTIAL_ENV_NAME.test(name) && typeof value === "string" && value.length >= 8)
-            .map(([, value]) => value)),
-    ].sort((left, right) => right.length - left.length);
-}
 function redactResult(stdout, stderr, secrets) {
-    let safeStdout = stdout;
-    let safeStderr = stderr;
     let exposed = false;
     for (const secret of secrets) {
-        if (safeStdout.includes(secret) || safeStderr.includes(secret))
+        if (stdout.includes(secret) || stderr.includes(secret))
             exposed = true;
-        safeStdout = safeStdout.replaceAll(secret, "[REDACTED]");
-        safeStderr = safeStderr.replaceAll(secret, "[REDACTED]");
     }
-    return { stdout: safeStdout, stderr: safeStderr, exposed };
+    return {
+        stdout: sanitizeResearchText(stdout, secrets),
+        stderr: sanitizeResearchText(stderr, secrets),
+        exposed,
+    };
+}
+function estimateCost(route, usage) {
+    if (!route.pricing)
+        return 0;
+    return roundMoney((usage.inputTokens * route.pricing.inputUsdPerMillionTokens +
+        usage.cachedInputTokens * route.pricing.cachedInputUsdPerMillionTokens +
+        usage.outputTokens * route.pricing.outputUsdPerMillionTokens) /
+        1_000_000);
+}
+function authSecretValues(content) {
+    try {
+        const value = JSON.parse(content);
+        const secrets = new Set();
+        collectSensitiveJsonValues(value, "", secrets);
+        return [...secrets].sort((left, right) => right.length - left.length);
+    }
+    catch {
+        return [];
+    }
+}
+function collectSensitiveJsonValues(value, key, target) {
+    if (typeof value === "string") {
+        if (isSensitiveEnvironmentName(key) && value.length >= 8)
+            target.add(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectSensitiveJsonValues(item, key, target);
+        return;
+    }
+    if (!isObject(value))
+        return;
+    for (const [childKey, item] of Object.entries(value)) {
+        collectSensitiveJsonValues(item, childKey, target);
+    }
+}
+async function existingReadRoots(launcher, target, capsuleRoot) {
+    const candidates = [
+        capsuleRoot,
+        "/System",
+        "/usr",
+        "/bin",
+        "/sbin",
+        "/private/etc/hosts",
+        "/private/etc/resolv.conf",
+        "/private/etc/ssl",
+        "/private/var/db/timezone",
+        "/private/var/run",
+        "/private/var/select",
+        executableReadRoot(launcher),
+        executableReadRoot(target),
+        executableReadRoot(process.execPath),
+    ];
+    const result = [];
+    for (const candidate of candidates) {
+        if (result.some((root) => candidate === root || candidate.startsWith(`${root}/`)))
+            continue;
+        if (await lstat(candidate).catch(() => undefined))
+            result.push(candidate);
+    }
+    return result;
+}
+function executableReadRoot(binary) {
+    const parent = dirname(binary);
+    return dirname(parent);
+}
+async function existingLinuxSystemRoots() {
+    const candidates = ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc", "/opt"];
+    const roots = [];
+    for (const candidate of candidates) {
+        if (await lstat(candidate).catch(() => undefined))
+            roots.push(candidate);
+    }
+    return roots;
+}
+async function appendBubblewrapParentDirectories(args, target, created) {
+    const parts = resolve(target).split("/").filter(Boolean);
+    let current = "";
+    for (const part of parts.slice(0, -1)) {
+        current += `/${part}`;
+        if (!(await lstat(current).catch(() => undefined)))
+            continue;
+        if ([...created].some((directory) => current === directory || current.startsWith(`${directory}/`))) {
+            continue;
+        }
+        args.push("--dir", current);
+        created.add(current);
+    }
+}
+async function pathIsReadable(path) {
+    try {
+        await access(path, fsConstants.R_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
 function validateAgentBinary(route) {
     if (!isAbsolute(route.binary) && route.binary !== route.agent) {
@@ -317,6 +830,19 @@ function validateAgentBinary(route) {
             exitCode: 2,
         });
     }
+    if (route.wrapperTargetBinary &&
+        (!isAbsolute(route.binary) || !isAbsolute(route.wrapperTargetBinary))) {
+        throw new CliError("An agent wrapper and its wrapperTargetBinary must both use explicit absolute paths.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
+    if (route.wrapperTargetBinary === route.binary) {
+        throw new CliError("Agent wrapperTargetBinary must differ from the wrapper path.", {
+            code: "RESEARCH_EXECUTOR_INVALID",
+            exitCode: 2,
+        });
+    }
 }
 async function requireExecutable(path, label) {
     try {
@@ -344,10 +870,57 @@ async function firstExecutable(candidates) {
 function sandboxString(value) {
     return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
 }
-function isRecord(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
 function numeric(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
+function roundMoney(value) {
+    return Math.round(value * 1_000_000) / 1_000_000;
+}
+function incrementCount(target, key) {
+    target[key] = (target[key] ?? 0) + 1;
+}
+function appendProviderError(target, value) {
+    if (target.length >= 10)
+        return;
+    const candidate = [value.message, value.error, value.detail]
+        .map((item) => {
+        if (typeof item === "string")
+            return item;
+        if (isObject(item))
+            return JSON.stringify(item);
+        return "";
+    })
+        .find(Boolean);
+    if (!candidate)
+        return;
+    const bounded = candidate.slice(0, 1_000);
+    if (!target.includes(bounded))
+        target.push(bounded);
+}
+function sanitizeExecutionTelemetry(telemetry, secrets) {
+    return {
+        ...telemetry,
+        providerErrors: telemetry.providerErrors.map((error) => sanitizeResearchText(error, secrets).slice(0, 1_000)),
+    };
+}
+function isToolItemType(value) {
+    return (value === "command_execution" ||
+        value === "mcp_tool_call" ||
+        value === "web_search" ||
+        value === "dynamic_tool_call" ||
+        value === "tool_call" ||
+        value.endsWith("_tool_call"));
+}
+function sameRuntimeFingerprint(actual, expected) {
+    return (actual.agent === expected.agent &&
+        actual.model === expected.model &&
+        actual.effort === expected.effort &&
+        actual.verbosity === expected.verbosity &&
+        actual.binarySha256 === expected.binarySha256 &&
+        actual.wrapperSha256 === expected.wrapperSha256 &&
+        actual.adapterSha256 === expected.adapterSha256 &&
+        actual.binaryVersion === expected.binaryVersion &&
+        actual.platform === expected.platform &&
+        actual.architecture === expected.architecture);
+}
 //# sourceMappingURL=executor.js.map