@tiangong-ai/cli 0.0.60 → 0.0.62

package/dist/research/workspace/executor.js

@@ -6,8 +6,12 @@ import { arch, homedir, platform } from "node:os";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CliError } from "../../errors.js";
+import { isArtifactViewBinding, openArtifactViews, reviewNetworkPolicy, } from "./artifact-views.js";
+import { ARTIFACT_VIEW_TOOL_NAMES, startArtifactViewServer } from "./artifact-view-mcp.js";
+import { codexArtifactTrace, isPacketArtifactTool } from "./artifact-trace.js";
 import { researchPlatformCapabilities } from "./platform-capabilities.js";
 import { configuredResearchSecrets, isSensitiveEnvironmentName, sanitizeResearchText, } from "./sanitization.js";
+import { claudeCodeCompatibleSchema } from "./schema-compatibility.js";
 import { isObject, sha256File, sha256Text } from "./storage.js";
 const MAX_CAPTURE_BYTES = 5 * 1024 * 1024;
 const MIN_CAPTURE_BYTES = 64 * 1024;
@@ -36,6 +40,7 @@ const CODEX_DISABLED_FEATURES = [
     "tool_call_mcp_elicitation",
     "tool_suggest",
     "workspace_dependencies",
+    "view_image",
 ];
 const ROUTE_AUTH_ENVIRONMENT = {
     codex: ["OPENAI_API_KEY"],
@@ -48,11 +53,32 @@ const CLAUDE_SETTINGS_ENVIRONMENT = [
     "ANTHROPIC_AUTH_TOKEN",
     "CLAUDE_CODE_OAUTH_TOKEN",
     "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_MODEL",
+    "ANTHROPIC_DEFAULT_FABLE_MODEL",
+    "ANTHROPIC_DEFAULT_OPUS_MODEL",
+    "ANTHROPIC_DEFAULT_SONNET_MODEL",
+    "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+    "ANTHROPIC_SMALL_FAST_MODEL",
+    "CLAUDE_CODE_SUBAGENT_MODEL",
 ];
 const DEFAULT_AGENT_EFFORT = "low";
 const DEFAULT_CODEX_VERBOSITY = "low";
 export async function executeAgent(request) {
+    // Use the same configuration snapshot for admission and child execution.
+    request = { ...request, environment: { ...request.environment } };
     requireHeadlessAgentRoute(request.route);
+    if ((request.toolPolicy === "packet-read" &&
+        (!isArtifactViewBinding(request.artifactViews) || request.brokerUrl !== null)) ||
+        (request.artifactViews && request.toolPolicy !== "packet-read")) {
+        throw new CliError("Packet-only review requires its exact artifact index and no broker route.", { code: "RESEARCH_ARTIFACT_VIEW_INVALID", exitCode: 3 });
+    }
+    const artifactSecrets = [
+        ...configuredResearchSecrets(process.env),
+        ...configuredResearchSecrets(request.environment),
+    ];
+    const artifactViews = request.artifactViews
+        ? await openArtifactViews(request.projectRoot, request.artifactViews.index, request.artifactViews.packetSha256, artifactSecrets)
+        : null;
     validateAgentBinary(request.route);
     if (!Number.isInteger(request.maxOutputTokens) || request.maxOutputTokens < 1) {
         throw new CliError("Agent max output tokens must be a positive integer.", {
@@ -69,7 +95,9 @@ export async function executeAgent(request) {
     const temporaryDirectory = join(request.capsuleRoot, "tmp");
     await mkdir(temporaryDirectory, { recursive: true, mode: 0o700 });
     const executables = await resolveAgentExecutables(request.route, request.environment.PATH);
-    const runtime = await fingerprintResolvedBinary(request.route, executables.launcher, executables.target, request.environment.PATH);
+    const settingsEnvironment = await routeSettingsEnvironment(request.route, request.environment);
+    const providerRouting = configuredProviderRouting(request.route, request.environment, settingsEnvironment);
+    const runtime = await fingerprintResolvedBinary(request.route, executables.launcher, executables.target, request.environment.PATH, providerRouting);
     if (request.expectedRuntime && !sameRuntimeFingerprint(runtime, request.expectedRuntime)) {
         throw new CliError(`Configured ${request.route.agent} runtime drifted after the successful doctor smoke.`, {
             code: "RESEARCH_EXECUTOR_DRIFT",
@@ -82,12 +110,15 @@ export async function executeAgent(request) {
                 actualWrapperSha256: runtime.wrapperSha256,
                 expectedAdapterSha256: request.expectedRuntime.adapterSha256,
                 actualAdapterSha256: runtime.adapterSha256,
+                expectedProviderRouting: request.expectedRuntime.providerRouting ?? null,
+                actualProviderRouting: runtime.providerRouting,
             },
         });
     }
     const capsuleHome = join(request.capsuleRoot, "home");
-    const capsuleAuth = await prepareCapsuleHome(request.route, capsuleHome, request.environment);
+    const capsuleAuth = await prepareCapsuleHome(request.route, capsuleHome, request.environment, settingsEnvironment);
     const secrets = [...configuredResearchSecrets(request.environment), ...capsuleAuth.secrets];
+    artifactSecrets.push(...capsuleAuth.secrets);
     if (request.route.agent === "codex") {
         // Codex discovers project configuration by walking parent directories. Bound that
         // discovery to the isolated capsule project so a host workspace .codex/config.toml
@@ -97,11 +128,14 @@ export async function executeAgent(request) {
             mode: 0o600,
         });
     }
-    const invocation = await buildInvocation(request, executables.launcher, join(request.capsuleRoot, `${request.purpose}-output-schema.json`));
-    const sandboxed = await sandboxInvocation(invocation.binary, invocation.args, request.capsuleRoot, request.projectRoot, request.workspaceRoot, executables.target);
     const started = process.hrtime.bigint();
     let completed;
+    let sandboxed;
+    let artifactServer = null;
     try {
+        artifactServer = artifactViews ? await startArtifactViewServer(artifactViews) : null;
+        const invocation = await buildInvocation(request, executables.launcher, join(request.capsuleRoot, `${request.purpose}-output-schema.json`), artifactServer?.url);
+        sandboxed = await sandboxInvocation(invocation.binary, invocation.args, request.capsuleRoot, request.projectRoot, request.workspaceRoot, executables.target);
         completed = await spawnCaptured({
             binary: sandboxed.binary,
             args: sandboxed.args,
@@ -109,6 +143,7 @@ export async function executeAgent(request) {
             cwd: request.projectRoot,
             env: sanitizedEnvironment(request.environment, temporaryDirectory, capsuleHome, request.route, executables.target, capsuleAuth.environment),
             timeoutMs: request.timeoutSeconds * 1000,
+            compactArtifactTrace: request.route.agent === "codex" && request.toolPolicy === "packet-read",
             maxCaptureBytes: Math.min(MAX_CAPTURE_BYTES, Math.max(MIN_CAPTURE_BYTES, request.maxOutputTokens * BYTES_PER_OUTPUT_TOKEN +
                 (request.maxToolContextTokens ?? 0) * BYTES_PER_TOOL_CONTEXT_TOKEN)),
         });
@@ -123,6 +158,8 @@ export async function executeAgent(request) {
         throw error;
     }
     finally {
+        if (artifactServer)
+            await artifactServer.stop();
         secrets.push(...(await reconcileCapsuleAuthentication(capsuleAuth)));
     }
     const wallSeconds = Number(process.hrtime.bigint() - started) / 1_000_000_000;
@@ -140,15 +177,21 @@ export async function executeAgent(request) {
     }
     const parsed = parseAgentResult(request.route, completed.stdout, completed.stderr);
     const redacted = redactResult(parsed.stdout, parsed.stderr, secrets);
+    const toolPolicyViolated = request.toolPolicy === "packet-read"
+        ? (parsed.telemetry.packetReadViolations ?? 0) > 0
+        : request.toolPolicy === "none" &&
+            (parsed.telemetry.toolCalls > 0 || (parsed.telemetry.packetReadViolations ?? 0) > 0);
     const exitCode = redacted.exposed
         ? 86
         : completed.captureExceeded
             ? 75
             : completed.exitCode !== 0
                 ? completed.exitCode
-                : parsed.parseFailed
-                    ? 3
-                    : 0;
+                : toolPolicyViolated
+                    ? 78
+                    : parsed.parseFailed
+                        ? 3
+                        : 0;
     const inputTokens = redacted.exposed ? 0 : parsed.inputTokens;
     const cachedInputTokens = redacted.exposed ? 0 : parsed.cachedInputTokens;
     const outputTokens = redacted.exposed ? 0 : parsed.outputTokens;
@@ -160,16 +203,19 @@ export async function executeAgent(request) {
         stdout: redacted.stdout,
         stderr: completed.captureExceeded
             ? `${redacted.stderr}\nagent output exceeded the configured capture limit`.trim()
-            : redacted.stderr,
+            : toolPolicyViolated
+                ? `${redacted.stderr}\nreviewer tool policy violation: an unapproved I/O tool was reported`.trim()
+                : redacted.stderr,
         tokens,
         inputTokens,
         cachedInputTokens,
         outputTokens,
         costUsd,
         wallSeconds,
-        model: parsed.model ?? request.route.model,
-        runtime: { ...runtime, model: parsed.model ?? request.route.model },
-        ...(request.toolPolicy === "none" && request.brokerUrl === null
+        model: request.route.model,
+        runtime,
+        ...((request.toolPolicy === "none" || request.toolPolicy === "packet-read") &&
+            request.brokerUrl === null
             ? {
                 isolation: {
                     ...sandboxed.isolation,
@@ -179,12 +225,13 @@ export async function executeAgent(request) {
                         "private-capsule",
                     ],
                     writeScopes: ["private-capsule"],
-                    networkPolicy: "reviewer-provider-only",
-                    toolPolicy: "none",
+                    networkPolicy: reviewNetworkPolicy(request.toolPolicy),
+                    toolPolicy: request.toolPolicy,
                 },
             }
             : {}),
-        telemetry: sanitizeExecutionTelemetry(parsed.telemetry, secrets),
+        telemetry: sanitizeExecutionTelemetry({ ...parsed.telemetry, reportedModel: parsed.model }, secrets),
+        ...(artifactViews ? { artifactReads: artifactViews.receipts() } : {}),
     };
 }
 function isNestedSandboxDenial(exitCode, stderr) {
@@ -196,9 +243,11 @@ function isNestedSandboxDenial(exitCode, stderr) {
 }
 export async function fingerprintAgentRoute(route, environment) {
     requireHeadlessAgentRoute(route);
+    environment = { ...environment };
     validateAgentBinary(route);
     const executables = await resolveAgentExecutables(route, environment.PATH);
-    return fingerprintResolvedBinary(route, executables.launcher, executables.target, environment.PATH);
+    const settingsEnvironment = await routeSettingsEnvironment(route, environment);
+    return fingerprintResolvedBinary(route, executables.launcher, executables.target, environment.PATH, configuredProviderRouting(route, environment, settingsEnvironment));
 }
 export async function probeNativeCapsuleIsolation(input) {
     const probeId = randomUUID();
@@ -296,8 +345,11 @@ export async function probeNativeCapsuleIsolation(input) {
         ]);
     }
 }
-async function buildInvocation(request, resolvedBinary, outputSchemaPath) {
-    await writeFile(outputSchemaPath, `${JSON.stringify(request.outputSchema, null, 2)}\n`, {
+async function buildInvocation(request, resolvedBinary, outputSchemaPath, artifactServerUrl) {
+    const outputSchema = request.route.agent === "claude"
+        ? claudeCodeCompatibleSchema(request.outputSchema)
+        : request.outputSchema;
+    await writeFile(outputSchemaPath, `${JSON.stringify(outputSchema, null, 2)}\n`, {
         encoding: "utf8",
         mode: 0o600,
     });
@@ -324,7 +376,7 @@ async function buildInvocation(request, resolvedBinary, outputSchemaPath) {
         ];
         for (const feature of CODEX_DISABLED_FEATURES)
             args.push("--disable", feature);
-        if (toolPolicy === "none")
+        if (toolPolicy !== "workspace-read")
             args.push("--disable", "shell_tool", "--disable", "unified_exec");
         args.push("-c", "include_apps_instructions=false", "-c", "include_collaboration_mode_instructions=false", "-c", "include_environment_context=false", "-c", "include_permissions_instructions=false", "-c", `project_root_markers=[${JSON.stringify(CODEX_CAPSULE_ROOT_MARKER)}]`, "-c", `model_reasoning_effort=${JSON.stringify(request.route.effort ?? DEFAULT_AGENT_EFFORT)}`, "-c", `model_verbosity=${JSON.stringify(request.route.verbosity ?? DEFAULT_CODEX_VERBOSITY)}`);
         if (request.brokerUrl) {
@@ -332,6 +384,8 @@ async function buildInvocation(request, resolvedBinary, outputSchemaPath) {
         }
         if (request.route.model)
             args.push("--model", request.route.model);
+        if (artifactServerUrl)
+            args.push("-c", `mcp_servers.research_artifacts.url=${JSON.stringify(artifactServerUrl)}`, "-c", "mcp_servers.research_artifacts.required=true", "-c", `mcp_servers.research_artifacts.enabled_tools=${JSON.stringify(ARTIFACT_VIEW_TOOL_NAMES)}`);
         return { binary: resolvedBinary, args, stdin: request.prompt };
     }
     if (request.route.agent !== "claude") {
@@ -355,14 +409,14 @@ async function buildInvocation(request, resolvedBinary, outputSchemaPath) {
         "--no-chrome",
         "--disable-slash-commands",
         "--tools",
-        toolPolicy === "none" ? "" : "Read,Glob,Grep",
+        toolPolicy === "workspace-read" ? "Read,Glob,Grep" : "",
         "--effort",
         request.route.effort ?? DEFAULT_AGENT_EFFORT,
     ];
     if (request.purpose !== "repair") {
-        args.splice(1, 0, "--json-schema", JSON.stringify(request.outputSchema));
+        args.splice(1, 0, "--json-schema", JSON.stringify(outputSchema));
     }
-    const allowedTools = toolPolicy === "none" ? [] : ["Read", "Glob", "Grep"];
+    const allowedTools = toolPolicy === "workspace-read" ? ["Read", "Glob", "Grep"] : [];
     if (request.brokerUrl) {
         const mcpConfigPath = join(request.capsuleRoot, "research-mcp.json");
         await writeFile(mcpConfigPath, `${JSON.stringify({
@@ -373,6 +427,16 @@ async function buildInvocation(request, resolvedBinary, outputSchemaPath) {
         allowedTools.push("mcp__research_broker__fetch_candidate_source");
         args.push("--strict-mcp-config", "--mcp-config", mcpConfigPath);
     }
+    if (artifactServerUrl) {
+        const mcpConfigPath = join(request.capsuleRoot, "artifact-mcp.json");
+        await writeFile(mcpConfigPath, JSON.stringify({
+            mcpServers: {
+                research_artifacts: { type: "http", url: artifactServerUrl },
+            },
+        }), { encoding: "utf8", mode: 0o600 });
+        allowedTools.push(...ARTIFACT_VIEW_TOOL_NAMES.map((name) => `mcp__research_artifacts__${name}`));
+        args.push("--strict-mcp-config", "--mcp-config", mcpConfigPath);
+    }
     args.push("--allowedTools", allowedTools.join(","));
     if (request.maxCostUsd > 0)
         args.push("--max-budget-usd", String(request.maxCostUsd));
@@ -385,8 +449,9 @@ function requireHeadlessAgentRoute(route) {
         return;
     throw new CliError(`The ${route.agent} producer is native-host only and cannot be launched by the control plane.`, { code: "RESEARCH_EXECUTOR_INVALID", exitCode: 2 });
 }
-async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspaceRoot, targetBinary) {
+async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspaceRoot, targetBinary, mode = "review") {
     const configuredCredentialPath = join(workspaceRoot, ".tiangong-research", ".env");
+    const workspaceReal = mode === "calculation" ? await realpath(workspaceRoot) : workspaceRoot;
     const workspaceCredentialPath = await realpath(configuredCredentialPath).catch(() => configuredCredentialPath);
     const capabilities = researchPlatformCapabilities(platform());
     if (capabilities.nativeIsolationProvider === "sandbox-exec") {
@@ -400,9 +465,11 @@ async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspa
             "(version 1)",
             "(deny default)",
             "(allow process*)",
-            "(allow network*)",
+            ...(mode === "review" ? ["(allow network*)"] : []),
             "(allow file-read-metadata)",
-            `(allow file-read* ${readClauses} (literal "/") (literal "/var") (literal "/dev/dtracehelper") (literal "/dev/null") (literal "/dev/urandom"))`,
+            mode === "calculation"
+                ? `(allow file-read* (require-all (require-any ${readClauses} (literal "/") (literal "/var") (literal "/dev/dtracehelper") (literal "/dev/null") (literal "/dev/urandom")) (require-not (subpath ${sandboxString(workspaceReal)})) (require-not (literal ${sandboxString(workspaceCredentialPath)}))))`
+                : `(allow file-read* ${readClauses} (literal "/") (literal "/var") (literal "/dev/dtracehelper") (literal "/dev/null") (literal "/dev/urandom"))`,
             `(deny file-read* (literal ${sandboxString(workspaceCredentialPath)}))`,
             '(allow file-ioctl (literal "/dev/dtracehelper"))',
             "(allow sysctl-read)",
@@ -430,7 +497,13 @@ async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspa
                 exitCode: 3,
             });
         }
+        // Review keeps its original argument order verbatim (the credential
+        // /dev/null mask must stay AFTER the capsule bind, or a capsule containing
+        // the credential path would re-expose it and shift the policy hash);
+        // calculation-only branches append namespaces and the workspace mask.
         const sandboxArgs = ["--die-with-parent", "--new-session"];
+        if (mode === "calculation")
+            sandboxArgs.push("--unshare-net", "--unshare-pid");
         const systemRoots = await existingLinuxSystemRoots();
         for (const path of systemRoots) {
             sandboxArgs.push("--ro-bind", path, path);
@@ -447,12 +520,22 @@ async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspa
                 continue;
             }
             await appendBubblewrapParentDirectories(sandboxArgs, runtimeRoot, createdDirectories);
+            // Bound unconditionally: when the workspace sits beneath a runtime root,
+            // the calculation-mode workspace mask below shadows only that subtree
+            // and the rest of the runtime stays available.
             sandboxArgs.push("--ro-bind", runtimeRoot, runtimeRoot);
             createdDirectories.add(runtimeRoot);
         }
+        if (mode === "calculation") {
+            // A private read-only tmpfs hides workspace data even beneath an allowed
+            // runtime/system root. No writable host alias can populate this mask.
+            await appendBubblewrapParentDirectories(sandboxArgs, workspaceReal, createdDirectories);
+            sandboxArgs.push("--tmpfs", workspaceReal, "--remount-ro", workspaceReal);
+        }
         await appendBubblewrapParentDirectories(sandboxArgs, capsuleRoot, createdDirectories);
         sandboxArgs.push("--bind", capsuleRoot, capsuleRoot, "--proc", "/proc", "--dev", "/dev", "--chdir", projectRoot);
-        if (workspaceCredentialPath.startsWith(`${capsuleRoot}/`) &&
+        if (mode === "review" &&
+            workspaceCredentialPath.startsWith(`${capsuleRoot}/`) &&
             (await pathIsReadable(workspaceCredentialPath))) {
             sandboxArgs.push("--ro-bind", "/dev/null", workspaceCredentialPath);
         }
@@ -476,7 +559,7 @@ async function sandboxInvocation(binary, args, capsuleRoot, projectRoot, workspa
         },
     });
 }
-async function prepareCapsuleHome(route, capsuleHome, environment) {
+async function prepareCapsuleHome(route, capsuleHome, environment, settingsEnvironment) {
     await mkdir(capsuleHome, { recursive: true, mode: 0o700 });
     const sourceHome = environment.HOME && isAbsolute(environment.HOME) ? environment.HOME : homedir();
     const claudeConfigRoot = environment.CLAUDE_CONFIG_DIR && isAbsolute(environment.CLAUDE_CONFIG_DIR)
@@ -522,9 +605,6 @@ async function prepareCapsuleHome(route, capsuleHome, environment) {
         });
         secrets.push(...authSecretValues(await readFile(candidate.destination, "utf8")));
     }
-    const settingsEnvironment = route.agent === "claude"
-        ? await readClaudeSettingsEnvironment(join(claudeConfigRoot, "settings.json"))
-        : {};
     for (const name of ROUTE_AUTH_ENVIRONMENT[route.agent]) {
         const value = settingsEnvironment[name];
         if (value && value.length >= 8)
@@ -658,6 +738,88 @@ function authenticationReconciliationError(reason) {
         },
     });
 }
+async function routeSettingsEnvironment(route, environment) {
+    if (route.agent !== "claude")
+        return {};
+    const sourceHome = environment.HOME && isAbsolute(environment.HOME) ? environment.HOME : homedir();
+    const configRoot = environment.CLAUDE_CONFIG_DIR && isAbsolute(environment.CLAUDE_CONFIG_DIR)
+        ? environment.CLAUDE_CONFIG_DIR
+        : join(sourceHome, ".claude");
+    return readClaudeSettingsEnvironment(join(configRoot, "settings.json"));
+}
+function configuredProviderRouting(route, environment, settings) {
+    // This is a binding of admitted configuration, never a wire-level identity claim.
+    // Keep URL paths/queries, proxy credentials and mapped provider IDs out of receipts.
+    const selected = new Map();
+    const modelMappingSources = {};
+    const names = new Set([...Object.keys(environment), ...Object.keys(settings)]);
+    for (const name of [...names].sort()) {
+        if (isSensitiveEnvironmentName(name))
+            continue;
+        const isModel = route.agent === "claude" &&
+            (/^ANTHROPIC_(?:DEFAULT_[A-Z_]+_MODEL|MODEL|SMALL_FAST_MODEL)$/.test(name) ||
+                name === "CLAUDE_CODE_SUBAGENT_MODEL");
+        const isRouting = /^(?:https?_proxy|all_proxy|no_proxy)$/i.test(name) ||
+            (route.agent === "claude" &&
+                (/^ANTHROPIC_[A-Z_]*BASE_URL$/.test(name) || /^CLAUDE_CODE_USE_[A-Z_]+$/.test(name))) ||
+            (route.agent === "codex" && name === "OPENAI_BASE_URL");
+        if (!isModel && !isRouting)
+            continue;
+        const value = environment[name] || settings[name];
+        if (!value)
+            continue;
+        selected.set(name, value);
+        if (isModel)
+            modelMappingSources[name] = environment[name] ? "process-environment" : "claude-settings-env";
+    }
+    const endpoint = route.agent === "claude" ? selected.get("ANTHROPIC_BASE_URL") : undefined;
+    if (endpoint)
+        assertSafeClaudeBaseUrl(endpoint);
+    return {
+        schemaVersion: 1,
+        configurationSha256: sha256Text(JSON.stringify([...selected])),
+        endpointOrigin: endpoint ? new URL(endpoint).origin : null,
+        endpointSource: endpoint
+            ? environment.ANTHROPIC_BASE_URL
+                ? "process-environment"
+                : "claude-settings-env"
+            : "runtime-default",
+        modelMappingSources,
+        identityVerification: "unverified",
+        scope: "configured-routing-only",
+    };
+}
+/** Offline configuration inspection; never invokes an agent or sends material. */
+export async function inspectAgentProviderRouting(route, environment) {
+    environment = { ...environment };
+    return configuredProviderRouting(route, environment, await routeSettingsEnvironment(route, environment));
+}
+export function isAgentProviderRouting(value) {
+    if (!isObject(value) ||
+        value.schemaVersion !== 1 ||
+        typeof value.configurationSha256 !== "string" ||
+        !/^[0-9a-f]{64}$/.test(value.configurationSha256) ||
+        typeof value.endpointSource !== "string" ||
+        !["process-environment", "claude-settings-env", "runtime-default"].includes(value.endpointSource) ||
+        value.identityVerification !== "unverified" ||
+        value.scope !== "configured-routing-only" ||
+        !isObject(value.modelMappingSources))
+        return false;
+    if (value.endpointOrigin !== null) {
+        if (typeof value.endpointOrigin !== "string")
+            return false;
+        try {
+            const url = new URL(value.endpointOrigin);
+            if (url.protocol !== "https:" || url.origin !== value.endpointOrigin)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return Object.entries(value.modelMappingSources).every(([name, source]) => /^(?:ANTHROPIC_(?:DEFAULT_[A-Z_]+_MODEL|MODEL|SMALL_FAST_MODEL)|CLAUDE_CODE_SUBAGENT_MODEL)$/.test(name) &&
+        (source === "process-environment" || source === "claude-settings-env"));
+}
 async function readClaudeSettingsEnvironment(path) {
     const info = await lstat(path).catch(() => undefined);
     if (!info)
@@ -732,7 +894,7 @@ function assertOwnerOnlyAuthenticationFile(mode, agent) {
         });
     }
 }
-async function fingerprintResolvedBinary(route, launcher, target, pathValue) {
+async function fingerprintResolvedBinary(route, launcher, target, pathValue, providerRouting) {
     const versionEnvironment = {
         PATH: pathValue ?? process.env.PATH,
         NO_COLOR: "1",
@@ -773,6 +935,7 @@ async function fingerprintResolvedBinary(route, launcher, target, pathValue) {
         binaryVersion: sanitizeResearchText(binaryVersion).slice(0, 300),
         platform: platform(),
         architecture: arch(),
+        providerRouting,
     };
 }
 async function resolveAgentExecutables(route, pathValue) {
@@ -858,7 +1021,17 @@ async function spawnCaptured(input) {
             }
             target.push(chunk);
         };
-        child.stdout.on("data", (chunk) => capture(stdout, chunk));
+        const artifactTrace = input.compactArtifactTrace
+            ? codexArtifactTrace({
+                maxControlBytes: input.maxCaptureBytes,
+                line: (chunk) => capture(stdout, chunk),
+                oversized: () => {
+                    captureExceeded = true;
+                    terminate();
+                },
+            })
+            : null;
+        child.stdout.on("data", (chunk) => artifactTrace ? artifactTrace.write(chunk) : capture(stdout, chunk));
         child.stderr.on("data", (chunk) => capture(stderr, chunk));
         child.on("error", (error) => {
             if (settled)
@@ -870,6 +1043,7 @@ async function spawnCaptured(input) {
         child.on("close", (code, signal) => {
             if (settled)
                 return;
+            artifactTrace?.end();
             settled = true;
             clearTimeout(timer);
             const detail = signal ? `\nprocess terminated by ${signal}` : "";
@@ -887,12 +1061,13 @@ function parseAgentResult(route, stdout, stderr) {
         let inputTokens = 0;
         let cachedInputTokens = 0;
         let outputTokens = 0;
-        let model = route.model;
+        let model = null;
         const messages = [];
         let parsedEvents = 0;
         const eventCounts = {};
         const itemCounts = {};
         let toolCalls = 0;
+        let packetReadViolations = 0;
         let reasoningOutputTokens = 0;
         const providerErrors = [];
         for (const line of stdout.split(/\r?\n/)) {
@@ -918,6 +1093,9 @@ function parseAgentResult(route, stdout, stderr) {
                         incrementCount(itemCounts, event.item.type);
                         if (isToolItemType(event.item.type))
                             toolCalls += 1;
+                        if (event.item.type === "file_change" ||
+                            (isToolItemType(event.item.type) && !isPacketArtifactTool(event.item)))
+                            packetReadViolations += 1;
                         if (event.item.type === "error")
                             appendProviderError(providerErrors, event.item);
                     }
@@ -943,6 +1121,7 @@ function parseAgentResult(route, stdout, stderr) {
                 eventCounts,
                 itemCounts,
                 toolCalls,
+                ...(packetReadViolations ? { packetReadViolations } : {}),
                 providerTurns: eventCounts["turn.completed"] ?? eventCounts["turn.started"] ?? null,
                 reasoningOutputTokens,
                 providerErrors,
@@ -952,22 +1131,40 @@ function parseAgentResult(route, stdout, stderr) {
     try {
         const value = JSON.parse(stdout);
         const usage = isObject(value.usage) ? value.usage : {};
+        const providerFailed = value.is_error === true ||
+            (typeof value.subtype === "string" && value.subtype.startsWith("error_"));
+        const providerErrors = [];
+        if (providerFailed) {
+            if (typeof value.subtype === "string")
+                appendProviderError(providerErrors, { message: value.subtype });
+            if (Array.isArray(value.errors)) {
+                for (const error of value.errors)
+                    if (typeof error === "string")
+                        appendProviderError(providerErrors, { message: error });
+            }
+        }
+        const structured = value.structured_output !== undefined && value.structured_output !== null;
+        const answer = structured
+            ? JSON.stringify(value.structured_output)
+            : typeof value.result === "string"
+                ? value.result
+                : stdout;
         return {
-            stdout: typeof value.result === "string" ? value.result : stdout,
+            stdout: providerFailed ? "" : answer,
             stderr,
             inputTokens: numeric(usage.input_tokens),
             cachedInputTokens: numeric(usage.cache_creation_input_tokens) + numeric(usage.cache_read_input_tokens),
             outputTokens: numeric(usage.output_tokens),
             costUsd: numeric(value.total_cost_usd),
-            model: typeof value.model === "string" ? value.model : route.model,
-            parseFailed: typeof value.result !== "string",
+            model: typeof value.model === "string" ? value.model : null,
+            parseFailed: providerFailed || (!structured && typeof value.result !== "string"),
             telemetry: {
                 eventCounts: { result: 1 },
                 itemCounts: {},
                 toolCalls: 0,
                 providerTurns: numeric(value.num_turns) || null,
                 reasoningOutputTokens: numeric(usage.reasoning_output_tokens),
-                providerErrors: [],
+                providerErrors,
             },
         };
     }
@@ -979,7 +1176,7 @@ function parseAgentResult(route, stdout, stderr) {
             cachedInputTokens: 0,
             outputTokens: 0,
             costUsd: 0,
-            model: route.model,
+            model: null,
             parseFailed: true,
             telemetry: {
                 eventCounts: {},
@@ -1213,13 +1410,21 @@ function appendProviderError(target, value) {
         .find(Boolean);
     if (!candidate)
         return;
-    const bounded = candidate.slice(0, 1_000);
-    if (!target.includes(bounded))
-        target.push(bounded);
+    // Truncate only after sanitization; otherwise a boundary can leave part of a
+    // configured secret unmatched by the later exact-value redactor.
+    if (!target.includes(candidate))
+        target.push(candidate);
 }
 function sanitizeExecutionTelemetry(telemetry, secrets) {
     return {
         ...telemetry,
+        ...(telemetry.reportedModel === undefined
+            ? {}
+            : {
+                reportedModel: telemetry.reportedModel === null
+                    ? null
+                    : sanitizeResearchText(telemetry.reportedModel, secrets).slice(0, 300),
+            }),
         providerErrors: telemetry.providerErrors.map((error) => sanitizeResearchText(error, secrets).slice(0, 1_000)),
     };
 }
@@ -1231,7 +1436,7 @@ function isToolItemType(value) {
         value === "tool_call" ||
         value.endsWith("_tool_call"));
 }
-function sameRuntimeFingerprint(actual, expected) {
+export function sameRuntimeFingerprint(actual, expected) {
     return (actual.agent === expected.agent &&
         actual.model === expected.model &&
         actual.effort === expected.effort &&
@@ -1241,6 +1446,45 @@ function sameRuntimeFingerprint(actual, expected) {
         actual.adapterSha256 === expected.adapterSha256 &&
         actual.binaryVersion === expected.binaryVersion &&
         actual.platform === expected.platform &&
-        actual.architecture === expected.architecture);
+        actual.architecture === expected.architecture &&
+        actual.providerRouting?.configurationSha256 === expected.providerRouting?.configurationSha256);
+}
+function calculationUnsupported(detail) {
+    return new CliError(`This platform cannot enforce the calculation boundary: ${detail}`, {
+        code: "RESEARCH_SANDBOX_UNAVAILABLE",
+        exitCode: 3,
+    });
+}
+function covers(child, parent) {
+    return (child === parent || (parent === "/" ? child.startsWith("/") : child.startsWith(`${parent}/`)));
+}
+/**
+ * Build the confinement for one observed calculation attempt. The capsule is
+ * the only writable/readable project surface, runtime and system roots are
+ * read-only, and the workspace tree (data, holdout, external outputs) plus
+ * host network and host process view are denied. Unsupported platforms and
+ * unsupported overlaps are refused before execution; no raw fallback exists.
+ */
+export async function createCalculationSandboxInvocation(input) {
+    const provider = researchPlatformCapabilities(platform()).nativeIsolationProvider;
+    if (provider !== "sandbox-exec" && provider !== "bubblewrap")
+        throw calculationUnsupported("no sandbox-exec or Bubblewrap provider on this platform");
+    const capsuleRoot = await realpath(input.capsuleRoot).catch(() => {
+        throw calculationUnsupported("capsule root is missing or symbolic");
+    });
+    const workspaceRoot = (await realpath(input.workspaceRoot).catch(() => undefined)) ?? resolve(input.workspaceRoot);
+    const binary = await realpath(input.binary).catch(() => {
+        throw calculationUnsupported("calculation runtime is missing or symbolic");
+    });
+    if (!(await lstat(binary)).isFile())
+        throw calculationUnsupported("calculation runtime is not a regular file");
+    const runtimeRoot = executableReadRoot(binary);
+    if (runtimeRoot === "/" || covers("/", runtimeRoot))
+        throw calculationUnsupported("runtime read root would expose the whole filesystem");
+    if (covers(runtimeRoot, workspaceRoot))
+        throw calculationUnsupported("runtime distribution lives inside the denied workspace tree; masking it would break the runtime");
+    if (covers(capsuleRoot, workspaceRoot) || covers(workspaceRoot, capsuleRoot))
+        throw calculationUnsupported("use a scratch capsule outside the research workspace tree");
+    return sandboxInvocation(binary, input.args, capsuleRoot, capsuleRoot, workspaceRoot, binary, "calculation");
 }
 //# sourceMappingURL=executor.js.map