@triflux/remote 10.43.0 → 10.44.0

package/hub/team/worktree-lifecycle.mjs

@@ -4,8 +4,16 @@
 // Remote support: host option → SSH-based git operations via remote-session.mjs.
 
 import { execFile } from "node:child_process";
-import { access, mkdir, readdir, realpath, rm } from "node:fs/promises";
-import { normalize, relative, resolve } from "node:path";
+import {
+  access,
+  mkdir,
+  mkdtemp,
+  readdir,
+  realpath,
+  rm,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, normalize, relative, resolve } from "node:path";
 import { remoteGit, validateHost } from "./remote-session.mjs";
 
 const SWARM_ROOT = ".codex-swarm";
@@ -327,24 +335,23 @@ export async function rebaseShardOntoIntegration({
     }
   }
 
-  // #127 BUG-E: capture caller's branch BEFORE any checkout. Without
-  // restoring it in finally, this function leaks main repo HEAD onto
-  // integrationBranch and every subsequent Edit/commit lands on the swarm
-  // temp branch silently (observed 2026-04-20: probe + edits + commits all
-  // ended up on swarm/.../merge while user thought they were on main).
-  let originalBranch = null;
-  try {
-    const head = await git(["rev-parse", "--abbrev-ref", "HEAD"], rootDir);
-    if (head && head !== "HEAD") originalBranch = head;
-  } catch {
-    /* detached HEAD or unknown — skip restore */
-  }
-
-  // Backup integration HEAD for rollback
+  // #127 BUG-E accident history: this function used to checkout the
+  // integration branch in rootDir, leak rootDir HEAD, and redirect later user
+  // edits/commits into swarm/.../merge. Integration now happens exclusively in
+  // a disposable worktree, so rootDir HEAD never moves and needs no restore.
+  //
+  // #129 BUG-J accident history: checkout failure was followed by a blind
+  // reset --hard (or branch -f rollback) against rootDir, which rewound the
+  // caller branch. Rollback now resets only the disposable worktree; there is
+  // no rootDir reset path and therefore no stash-create last-resort path.
   const backupCommit = await git(["rev-parse", integrationBranch], rootDir);
 
   let shaList = [];
   let ffError = null;
+  let integrationWorktreeAdded = false;
+  const integrationWorktree = await mkdtemp(
+    join(tmpdir(), "tfx-swarm-integration-"),
+  );
 
   try {
     const log = await git(
@@ -361,11 +368,15 @@ export async function rebaseShardOntoIntegration({
       .map((s) => s.trim())
       .filter(Boolean);
 
-    await git(["checkout", integrationBranch], rootDir);
+    await git(
+      ["worktree", "add", "--quiet", integrationWorktree, integrationBranch],
+      rootDir,
+    );
+    integrationWorktreeAdded = true;
 
     try {
-      await git(["merge", "--ff-only", shardBranch], rootDir);
-      const headCommit = await git(["rev-parse", "HEAD"], rootDir);
+      await git(["merge", "--ff-only", shardBranch], integrationWorktree);
+      const headCommit = await git(["rev-parse", "HEAD"], integrationWorktree);
       return {
         ok: true,
         headCommit,
@@ -376,12 +387,15 @@ export async function rebaseShardOntoIntegration({
     } catch (err) {
       ffError = err;
       try {
-        await git(["merge", "--abort"], rootDir);
+        await git(["merge", "--abort"], integrationWorktree);
       } catch {
         /* ff-only usually leaves no merge state */
       }
       try {
-        await git(["reset", "--hard", backupCommit], rootDir);
+        // Safe destructive operation: this cwd is the disposable integration
+        // worktree, never rootDir. It restores the integration ref before the
+        // cherry-pick fallback without touching user files.
+        await git(["reset", "--hard", backupCommit], integrationWorktree);
       } catch {
         /* fallback below will report if cherry-pick also fails */
       }
@@ -391,10 +405,10 @@ export async function rebaseShardOntoIntegration({
     // fail when histories diverge or a shard branch is checked out by a swarm
     // worktree. Cherry-pick reads commits without moving the shard branch ref.
     for (const sha of shaList) {
-      await git(["cherry-pick", sha], rootDir);
+      await git(["cherry-pick", sha], integrationWorktree);
     }
 
-    const headCommit = await git(["rev-parse", "HEAD"], rootDir);
+    const headCommit = await git(["rev-parse", "HEAD"], integrationWorktree);
     return {
       ok: true,
       headCommit,
@@ -406,42 +420,17 @@ export async function rebaseShardOntoIntegration({
         : "cherry-pick fallback",
     };
   } catch (err) {
-    try {
-      await git(["cherry-pick", "--abort"], rootDir);
-    } catch {
-      /* already clean */
-    }
-
-    // #129 BUG-J: Roll back integrationBranch without mutating whatever
-    // branch HEAD currently points at. The previous implementation did a
-    // blind `reset --hard backupCommit` on current HEAD — if the earlier
-    // `git checkout integrationBranch` inside the try block failed (e.g.
-    // integrationBranch was already checked out by a swarm worktree) the
-    // caller's branch silently rewound to integrationBranch's backup commit.
-    // Observed 2026-04-20: fix branch tree lost to main HEAD during swarm
-    // probe, requiring `git merge --ff-only origin/<branch>` recovery.
-    let currentBranch = null;
-    try {
-      const head = await git(["rev-parse", "--abbrev-ref", "HEAD"], rootDir);
-      if (head && head !== "HEAD") currentBranch = head;
-    } catch {
-      /* detached — fall through to ref-only update */
-    }
-
-    if (currentBranch === integrationBranch) {
-      // HEAD is on integrationBranch — reset advances this branch only.
+    if (integrationWorktreeAdded) {
       try {
-        await git(["reset", "--hard", backupCommit], rootDir);
+        await git(["cherry-pick", "--abort"], integrationWorktree);
       } catch {
-        /* best-effort */
+        /* already clean */
       }
-    } else {
-      // HEAD is elsewhere (originalBranch, detached, or another branch).
-      // Update the integrationBranch ref directly; never touch current HEAD.
       try {
-        await git(["branch", "-f", integrationBranch, backupCommit], rootDir);
+        // #129 rollback is now local to the disposable integration worktree.
+        await git(["reset", "--hard", backupCommit], integrationWorktree);
       } catch {
-        /* best-effort: branch may be checked out in another worktree */
+        /* best-effort */
       }
     }
 
@@ -453,14 +442,22 @@ export async function rebaseShardOntoIntegration({
       fallbackReason: ffError?.message || null,
     };
   } finally {
-    // Always restore caller's branch. Skip if originalBranch is null
-    // (detached HEAD case) or already on target.
-    if (originalBranch) {
+    if (integrationWorktreeAdded) {
       try {
-        await git(["checkout", originalBranch], rootDir);
+        await git(
+          ["worktree", "remove", "--force", integrationWorktree],
+          rootDir,
+        );
       } catch {
-        /* best-effort — caller will see HEAD on integrationBranch */
+        await rm(integrationWorktree, { recursive: true, force: true });
+        try {
+          await git(["worktree", "prune"], rootDir);
+        } catch {
+          /* best-effort metadata cleanup */
+        }
       }
+    } else {
+      await rm(integrationWorktree, { recursive: true, force: true });
     }
   }
 }

package/hub/tools.mjs

@@ -2,6 +2,11 @@
 // register/status/publish/ask/poll/handoff/HITL + team proxy
 // 모든 도구 응답: { ok: boolean, error?: { code, message }, data?: ... }
 
+import {
+  DEFAULT_ASSIGN_TIMEOUT_MS,
+  DEFAULT_ASSIGN_TTL_MS,
+  DEFAULT_HANDOFF_TTL_MS,
+} from "@triflux/core/hub/lib/timeout-defaults.mjs";
 import { createPipeline, ensurePipelineTable } from "@triflux/core/hub/pipeline/index.mjs";
 import {
   initPipelineState,
@@ -10,7 +15,6 @@ import {
 } from "@triflux/core/hub/pipeline/state.mjs";
 import { sendInputToConductorSession } from "./team/conductor-registry.mjs";
 import { getTeamBridge } from "@triflux/core/hub/team-bridge.mjs";
-import { DEFAULT_ASSIGN_TIMEOUT_MS, DEFAULT_ASSIGN_TTL_MS, DEFAULT_HANDOFF_TTL_MS } from "@triflux/core/hub/lib/timeout-defaults.mjs";
 
 const TEAM_BRIDGE_NOT_REGISTERED = "bridge_not_registered";
 
@@ -149,6 +153,14 @@ export function createTools(store, router, hitl, pipe = null) {
           },
           topics: { type: "array", items: { type: "string" }, maxItems: 64 },
           metadata: { type: "object" },
+          project_id: { type: "string", pattern: "^prj_[A-Za-z0-9_-]{22}$" },
+          session_id: { type: "string", minLength: 1, maxLength: 256 },
+          host_id: { type: "string", pattern: "^hst_[A-Za-z0-9_-]+$" },
+          transport_locators_json: {
+            description:
+              "tfx.transport-locator.v1 객체 배열 또는 그 JSON 문자열",
+            oneOf: [{ type: "array", items: { type: "object" } }, { type: "string" }],
+          },
           heartbeat_ttl_ms: {
             type: "integer",
             minimum: 10000,

package/hub/workers/codex-mcp.mjs

@@ -146,9 +146,11 @@ export function resolveCodexProfileConfig(profileName) {
   } catch {
     // Profile file absent (non-file alias). Derive effort from the naming
     // convention; leave model unset so codex uses its config.toml default.
-    const suffix = /_(xhigh|high|med|medium|low)$/.exec(profileName);
+    const suffix = /_(ultra|max|xhigh|high|med|medium|low)$/.exec(profileName);
     if (suffix) {
       const map = {
+        ultra: "ultra",
+        max: "max",
         xhigh: "xhigh",
         high: "high",
         med: "medium",
@@ -193,16 +195,27 @@ export function buildCodexArguments(prompt, opts = {}) {
   // profile effort merges on top of any opts.config.
   if (typeof opts.profile === "string" && opts.profile) {
     const resolved = resolveCodexProfileConfig(opts.profile);
-    if (resolved.model && typeof args.model !== "string") {
-      args.model = resolved.model;
+    const profileDerivedUltra =
+      resolved.reasoningEffort?.toLowerCase() === "ultra";
+    if (typeof args.model !== "string") {
+      if (profileDerivedUltra) args.model = "gpt-5.6-sol";
+      else if (resolved.model) args.model = resolved.model;
     }
     if (resolved.reasoningEffort) {
       args.config = {
         ...(args.config || {}),
-        model_reasoning_effort: resolved.reasoningEffort,
+        model_reasoning_effort: profileDerivedUltra
+          ? "max"
+          : resolved.reasoningEffort,
       };
     }
   }
+  if (typeof opts.reasoningEffort === "string" && opts.reasoningEffort) {
+    args.config = {
+      ...(args.config || {}),
+      model_reasoning_effort: opts.reasoningEffort,
+    };
+  }
 
   return args;
 }
@@ -694,6 +707,9 @@ function parseCliArgs(argv) {
       case "--model":
         options.model = next();
         break;
+      case "--reasoning-effort":
+        options.reasoningEffort = next();
+        break;
       case "--approval-policy":
         options.approvalPolicy = next();
         break;

package/hub/workers/delegator-mcp.mjs

@@ -11,6 +11,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import * as z from "zod";
+import { resolveCodexAgentPolicy } from "@triflux/core/scripts/lib/agent-route-policy.mjs";
 import { resolveBashExecutable } from "@triflux/core/hub/lib/bash-path.mjs";
 import { runHeadlessWithCleanup } from "../team/headless.mjs";
 import { buildWorkerSandboxEnv } from "../team/worker-sandbox.mjs";
@@ -33,57 +34,11 @@ const { buildPromptHint, getCodexMcpConfig, SUPPORTED_MCP_PROFILES } =
   await import(pathToFileURL(mcpFilterPath).href);
 const SERVER_INFO = { name: "triflux-delegator", version: "1.0.0" };
 const DEFAULT_CONTEXT_BYTES = 32 * 1024;
-const DEFAULT_ROUTE_TIMEOUT_SEC = 120;
 const DIRECT_PROGRESS_START = 5;
 const DIRECT_PROGRESS_RUNNING = 60;
 const DIRECT_PROGRESS_DONE = 100;
 const SEARCH_ENGINE_CACHE_PATH = [".omc", "state", "search-engines.json"];
 
-const AGENT_TIMEOUT_SEC = Object.freeze({
-  executor: 1080,
-  "build-fixer": 540,
-  debugger: 900,
-  "deep-executor": 3600,
-  architect: 3600,
-  planner: 3600,
-  critic: 3600,
-  analyst: 3600,
-  "code-reviewer": 1800,
-  "security-reviewer": 1800,
-  "quality-reviewer": 1800,
-  scientist: 1440,
-  "scientist-deep": 3600,
-  "document-specialist": 1440,
-  designer: 900,
-  writer: 900,
-  explore: 300,
-  verifier: 1200,
-  "test-engineer": 300,
-  "qa-tester": 300,
-  spark: 180,
-});
-
-const CODEX_PROFILE_BY_AGENT = Object.freeze({
-  executor: "gpt56_terra_high",
-  "build-fixer": "gpt56_luna_low",
-  debugger: "gpt56_sol_xhigh",
-  "deep-executor": "gpt56_sol_xhigh",
-  architect: "gpt56_sol_xhigh",
-  planner: "gpt56_sol_xhigh",
-  critic: "gpt56_sol_xhigh",
-  analyst: "gpt56_sol_xhigh",
-  "code-reviewer": "gpt56_terra_high",
-  "security-reviewer": "gpt56_sol_xhigh",
-  "quality-reviewer": "gpt56_terra_high",
-  scientist: "gpt56_terra_high",
-  "scientist-deep": "gpt56_sol_xhigh",
-  "document-specialist": "gpt56_terra_high",
-  verifier: "gpt56_terra_high",
-  designer: "gpt56_sol_xhigh",
-  writer: "gpt56_luna_low",
-  spark: "gpt56_luna_low",
-});
-
 const REVIEW_INSTRUCTION_BY_AGENT = Object.freeze({
   "code-reviewer":
     "코드 리뷰 모드로 동작하라. 버그, 리스크, 회귀, 테스트 누락을 우선 식별하라.",
@@ -137,7 +92,7 @@ function resolveRouteScript(explicitPath, cwd = process.cwd()) {
 }
 
 function resolveCodexProfile(agentType) {
-  return CODEX_PROFILE_BY_AGENT[agentType] || "high";
+  return resolveCodexAgentPolicy(agentType).profile;
 }
 
 function normalizeProvider(provider = "auto") {
@@ -154,8 +109,7 @@ function resolveTimeoutMs(agentType, timeoutMs) {
     return Math.trunc(timeoutMs);
   }
 
-  const timeoutSec = AGENT_TIMEOUT_SEC[agentType] || DEFAULT_ROUTE_TIMEOUT_SEC;
-  return timeoutSec * 1000;
+  return resolveCodexAgentPolicy(agentType).timeoutSec * 1000;
 }
 
 function resolveTimeoutSec(agentType, timeoutMs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triflux/remote",
-  "version": "10.43.0",
+  "version": "10.44.0",
   "description": "triflux remote — team mode, psmux, MCP workers, SQLite store.",
   "type": "module",
   "main": "hub/index.mjs",

package/scripts/lib/agent-route-policy.mjs

@@ -0,0 +1,307 @@
+// Canonical Codex role policy. Concrete model IDs stay in profile config files.
+
+import { resolveCodexProfileConfigValues } from "./codex-profile-config.mjs";
+
+const policy = {
+  executor: {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1080,
+    runMode: "fg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  codex: {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1080,
+    runMode: "fg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  "build-fixer": {
+    profile: "gpt56_luna_low",
+    timeoutSec: 540,
+    runMode: "fg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  cleanup: {
+    profile: "gpt56_terra_med",
+    timeoutSec: 540,
+    runMode: "fg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  deslop: {
+    profile: "gpt56_terra_med",
+    timeoutSec: 540,
+    runMode: "fg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  debugger: {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 900,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  "deep-executor": {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 3600,
+    runMode: "bg",
+    opusOversight: true,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  architect: {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 3600,
+    runMode: "bg",
+    opusOversight: true,
+    mcpHint: "analyze",
+    subcommand: "exec",
+  },
+  critic: {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 3600,
+    runMode: "bg",
+    opusOversight: true,
+    mcpHint: "analyze",
+    subcommand: "exec",
+  },
+  planner: {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 3600,
+    runMode: "fg",
+    opusOversight: true,
+    mcpHint: "analyze",
+    subcommand: "exec",
+  },
+  analyst: {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 3600,
+    runMode: "fg",
+    opusOversight: true,
+    mcpHint: "analyze",
+    subcommand: "exec",
+  },
+  "code-reviewer": {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1800,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "review",
+    subcommand: "review",
+  },
+  "quality-reviewer": {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1800,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "review",
+    subcommand: "review",
+  },
+  "security-reviewer": {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 1800,
+    runMode: "bg",
+    opusOversight: true,
+    mcpHint: "review",
+    subcommand: "review",
+  },
+  scientist: {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1440,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "analyze",
+    subcommand: "exec",
+  },
+  "document-specialist": {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1440,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "analyze",
+    subcommand: "exec",
+  },
+  "scientist-deep": {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 3600,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "analyze",
+    subcommand: "exec",
+  },
+  verifier: {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1200,
+    runMode: "fg",
+    opusOversight: false,
+    mcpHint: "review",
+    subcommand: "review",
+  },
+  "test-engineer": {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1200,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  "qa-tester": {
+    profile: "gpt56_terra_high",
+    timeoutSec: 1200,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "review",
+    subcommand: "review",
+  },
+  spark: {
+    profile: "gpt56_luna_low",
+    timeoutSec: 180,
+    runMode: "fg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  // These entries are only for explicit direct-Codex overrides. agent-map.json
+  // remains the provider-selection authority for their normal execution.
+  designer: {
+    profile: "gpt56_sol_xhigh",
+    timeoutSec: 900,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+  writer: {
+    profile: "gpt56_luna_low",
+    timeoutSec: 900,
+    runMode: "bg",
+    opusOversight: false,
+    mcpHint: "implement",
+    subcommand: "exec",
+  },
+};
+
+function freezePolicy(entry) {
+  return Object.freeze({ ...entry });
+}
+
+export const CODEX_AGENT_POLICY = Object.freeze(
+  Object.fromEntries(
+    Object.entries(policy).map(([agent, entry]) => [
+      agent,
+      freezePolicy(entry),
+    ]),
+  ),
+);
+export const DEFAULT_CODEX_AGENT = "executor";
+
+export const CANONICAL_CODEX_PROFILE_OVERRIDES = Object.freeze(
+  new Set([
+    "gpt56_luna_low", "gpt56_terra_med", "gpt56_terra_high", "gpt56_sol_xhigh",
+    "gpt56_sol_max", "gpt56_sol_ultra",
+  ]),
+);
+export const ULTRA_ELIGIBLE_CODEX_AGENTS = Object.freeze(
+  new Set(["deep-executor", "scientist-deep"]),
+);
+const NESTED_GLOBAL_PROFILE_OVERRIDES = new Set([
+  "max", "ultra", "gpt56_sol_max", "gpt56_sol_ultra",
+]);
+
+export function resolveCodexAgentPolicy(agent) {
+  return freezePolicy(
+    CODEX_AGENT_POLICY[agent] ?? CODEX_AGENT_POLICY[DEFAULT_CODEX_AGENT],
+  );
+}
+
+export function resolveCodexAgentProfile(
+  agent,
+  { profileOverride = "auto", retryProfile = null, nested = false, allowCustom = false } = {},
+) {
+  const defaultProfile = resolveCodexAgentPolicy(agent).profile;
+  const retryRequested = String(retryProfile ?? "").trim();
+  const requested = retryRequested || String(profileOverride || "auto").trim();
+  if (!requested || requested === "auto") return defaultProfile;
+  const canonical = requested === "max" ? "gpt56_sol_max" : requested === "ultra" ? "gpt56_sol_ultra" : requested;
+  if (!CANONICAL_CODEX_PROFILE_OVERRIDES.has(canonical)) {
+    if (allowCustom) return requested;
+    throw new Error(`[agent-route-policy] unsupported profile override: ${requested}`);
+  }
+  if (canonical !== "gpt56_sol_ultra") return canonical;
+  return nested || !ULTRA_ELIGIBLE_CODEX_AGENTS.has(agent) ? "gpt56_sol_max" : canonical;
+}
+
+export function resolveNestedCodexAgentProfile(
+  agent,
+  { profileOverride = "auto", globalProfile = "auto", retryProfile = null, codexHome } = {},
+) {
+  const explicitProfile = String(profileOverride || "auto").trim();
+  const globalOverride = String(globalProfile || "auto").trim();
+  const effectiveOverride = explicitProfile !== "auto" ? explicitProfile : NESTED_GLOBAL_PROFILE_OVERRIDES.has(globalOverride) ? globalOverride : "auto";
+  const fallback = resolveCodexAgentProfile(agent);
+  const candidate = resolveCodexAgentProfile(agent, { profileOverride: effectiveOverride, retryProfile, nested: true, allowCustom: true });
+  const { effort } = resolveCodexProfileConfigValues(candidate, { codexHome });
+  if (!effort) return fallback;
+  return effort.toLowerCase() === "ultra" ? "gpt56_sol_max" : candidate;
+}
+
+export function describeCodexAgentPolicy() {
+  return {
+    defaultAgent: DEFAULT_CODEX_AGENT,
+    agents: Object.keys(CODEX_AGENT_POLICY),
+  };
+}
+
+function parseCliArgs(argv) {
+  const args = [...argv];
+  let format = "json";
+  let agent = DEFAULT_CODEX_AGENT;
+  while (args.length > 0) {
+    const flag = args.shift();
+    if (flag === "--format") format = args.shift() || "";
+    else if (flag === "--agent") agent = args.shift() || "";
+    else throw new Error(`unknown argument: ${flag}`);
+  }
+  if (!new Set(["json", "tsv"]).has(format)) {
+    throw new Error(`unsupported format: ${format}`);
+  }
+  return { format, agent };
+}
+
+function runCli() {
+  const { format, agent } = parseCliArgs(process.argv.slice(2));
+  const resolved = resolveCodexAgentPolicy(agent);
+  if (format === "tsv") {
+    process.stdout.write(
+      [
+        resolved.profile,
+        resolved.timeoutSec,
+        resolved.runMode,
+        resolved.opusOversight,
+        resolved.mcpHint,
+        resolved.subcommand,
+      ].join("\t"),
+    );
+    return;
+  }
+  process.stdout.write(`${JSON.stringify(resolved)}\n`);
+}
+
+if (import.meta.url === new URL(process.argv[1], "file:").href) {
+  try {
+    runCli();
+  } catch (error) {
+    process.stderr.write(`[agent-route-policy] ${error.message}\n`);
+    process.exitCode = 1;
+  }
+}