agent-dealer 0.2.0 → 1.0.0

package/bundle/server/dist/coordinator/latest-failure.js

@@ -0,0 +1,100 @@
+import { getLatestFailedWorkerSessionForIssue, getWorkerSession, } from "../repository/worker-sessions.js";
+import { eventCursor, listWorkflowEventsForIssue, workerStartedEventCursor, } from "../repository/workflow-events.js";
+import { parseErrorJsonReason } from "./failure-reason.js";
+function parsePayload(json) {
+    if (!json)
+        return null;
+    try {
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+function fromFailedEvent(event, issue, session) {
+    const payload = parsePayload(event.payloadJson);
+    const reason = (payload?.reason && payload.reason.trim()) ||
+        parseErrorJsonReason(session?.errorJson) ||
+        null;
+    if (!reason)
+        return null;
+    return {
+        reason,
+        when: event.ts,
+        role: event.actorType === "developer" || event.actorType === "reviewer" ? event.actorType : null,
+        outcome: payload?.outcome ?? null,
+        sessionId: payload?.sessionId ?? session?.id ?? event.workerSessionId,
+        logPath: session?.logPath ?? null,
+        infraAttempts: issue.infraAttempts,
+        maxInfraAttempts: issue.maxInfraAttempts,
+    };
+}
+function fromSession(session, issue) {
+    const reason = parseErrorJsonReason(session.errorJson);
+    if (!reason)
+        return null;
+    return {
+        reason,
+        when: session.completedAt ?? session.updatedAt,
+        role: session.role === "developer" || session.role === "reviewer" ? session.role : null,
+        outcome: null,
+        sessionId: session.id,
+        logPath: session.logPath,
+        infraAttempts: issue.infraAttempts,
+        maxInfraAttempts: issue.maxInfraAttempts,
+    };
+}
+/** True when a worker.completed was inserted after `afterCursor` (exclusive). Uses rowid, not ts. */
+function hasCompletedAfterCursor(events, afterCursor) {
+    for (const e of events) {
+        if (e.type !== "worker.completed")
+            continue;
+        const c = eventCursor(e.id);
+        if (c != null && c > afterCursor)
+            return true;
+    }
+    return false;
+}
+/**
+ * Prefer the latest worker.failed timeline reason; fall back to the latest session
+ * errorJson so soft-recovery / incomplete emits still surface something.
+ * Suppressed when a later worker.completed exists after that failure (stale strip).
+ *
+ * Ordering uses workflow_events.rowid via `eventCursor` / `workerStartedEventCursor` —
+ * never raw `ts` comparisons (ms collisions; see workflow-events.ts).
+ */
+export function latestSessionFailureForIssue(issue) {
+    const events = listWorkflowEventsForIssue(issue.id);
+    let lastFailed = null;
+    let lastFailedCursor = -1;
+    for (const e of events) {
+        if (e.type !== "worker.failed")
+            continue;
+        const c = eventCursor(e.id);
+        if (c == null)
+            continue;
+        if (c >= lastFailedCursor) {
+            lastFailed = e;
+            lastFailedCursor = c;
+        }
+    }
+    if (lastFailed && lastFailedCursor >= 0) {
+        if (hasCompletedAfterCursor(events, lastFailedCursor))
+            return null;
+        const payload = parsePayload(lastFailed.payloadJson);
+        const sessionId = payload?.sessionId ?? lastFailed.workerSessionId ?? null;
+        const session = sessionId ? getWorkerSession(sessionId) : null;
+        const built = fromFailedEvent(lastFailed, issue, session);
+        if (built)
+            return built;
+    }
+    const failedSession = getLatestFailedWorkerSessionForIssue(issue.id);
+    if (!failedSession)
+        return null;
+    // Anchor at this session's worker.started rowid (same convention as guidance windows).
+    // A later worker.completed (any session) clears the strip — including same-ms inserts.
+    const startedCursor = workerStartedEventCursor(failedSession.id);
+    if (startedCursor != null && hasCompletedAfterCursor(events, startedCursor))
+        return null;
+    return fromSession(failedSession, issue);
+}

package/bundle/server/dist/coordinator/latest-failure.test.js

@@ -0,0 +1,125 @@
+// packages/server/src/coordinator/latest-failure.test.ts
+import { test, before, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } from "@agent-dealer/shared";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-latest-failure-"));
+const { migrate, getDb } = await import("../db/index.js");
+const { createIssue, getIssue } = await import("../repository/issues.js");
+const { startWorkflowInstance, appendWorkflowEvent } = await import("../repository/workflow-events.js");
+const { createWorkerSession, startSession, completeSession } = await import("../repository/worker-sessions.js");
+const { latestSessionFailureForIssue } = await import("./latest-failure.js");
+const { PRESUMED_DEAD_REASON } = await import("./failure-reason.js");
+before(() => migrate());
+beforeEach(() => {
+    getDb().exec(`
+    DELETE FROM workflow_events;
+    DELETE FROM worker_sessions;
+    DELETE FROM workflow_instances;
+    DELETE FROM issues;
+  `);
+});
+function makeIssue() {
+    return createIssue({
+        title: "Latest failure strip",
+        acceptanceCriteria: "Strip works",
+        repo: "acme/app",
+        baseBranch: "main",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID
+    });
+}
+test("session-fallback strip clears when worker.completed shares the same ms timestamp (rowid > ts)", () => {
+    const issue = makeIssue();
+    const instance = startWorkflowInstance(issue.id, "dev_reviewer_v1");
+    const session = createWorkerSession({
+        issueId: issue.id,
+        role: "developer",
+        round: 1,
+        agentId: BUILTIN_AGENT_CLAUDE_ID,
+        runtime: "cursor_local"
+    });
+    startSession(session.id);
+    appendWorkflowEvent({
+        issueId: issue.id,
+        workflowInstanceId: instance.id,
+        workerSessionId: session.id,
+        type: "worker.started",
+        actorType: "developer",
+        stage: "developing",
+        round: 1,
+        payload: {}
+    });
+    // Force identical wall-clock stamps across session completion and a later handoff event —
+    // the exact collision that made `e.ts > when` leave a stale strip.
+    const stamped = "2026-09-15T12:00:00.000Z";
+    completeSession(session.id, {
+        status: "failed",
+        errorJson: JSON.stringify({ reason: PRESUMED_DEAD_REASON }),
+        logPath: "/tmp/stale-strip.log"
+    });
+    getDb()
+        .prepare("UPDATE worker_sessions SET completed_at = ?, updated_at = ? WHERE id = ?")
+        .run(stamped, stamped, session.id);
+    // No worker.failed event → session-fallback path.
+    const completed = appendWorkflowEvent({
+        issueId: issue.id,
+        workflowInstanceId: instance.id,
+        workerSessionId: session.id,
+        type: "worker.completed",
+        actorType: "developer",
+        stage: "reviewing",
+        round: 1,
+        payload: { outcome: "clean_handoff" }
+    });
+    getDb().prepare("UPDATE workflow_events SET ts = ? WHERE id = ?").run(stamped, completed.id);
+    const fresh = getIssue(issue.id);
+    // With ts-only comparison this would still show the failure (completed.ts === when).
+    assert.equal(latestSessionFailureForIssue(fresh), null);
+});
+test("worker.failed strip clears via rowid when a later completed shares the same ts", () => {
+    const issue = makeIssue();
+    const instance = startWorkflowInstance(issue.id, "dev_reviewer_v1");
+    const session = createWorkerSession({
+        issueId: issue.id,
+        role: "developer",
+        round: 1,
+        agentId: BUILTIN_AGENT_CLAUDE_ID,
+        runtime: "cursor_local"
+    });
+    startSession(session.id);
+    const stamped = "2026-09-15T12:00:00.000Z";
+    const failed = appendWorkflowEvent({
+        issueId: issue.id,
+        workflowInstanceId: instance.id,
+        workerSessionId: session.id,
+        type: "worker.failed",
+        actorType: "developer",
+        stage: "developing",
+        round: 1,
+        payload: {
+            sessionId: session.id,
+            outcome: "session_failed",
+            reason: PRESUMED_DEAD_REASON
+        }
+    });
+    const completed = appendWorkflowEvent({
+        issueId: issue.id,
+        workflowInstanceId: instance.id,
+        workerSessionId: session.id,
+        type: "worker.completed",
+        actorType: "developer",
+        stage: "reviewing",
+        round: 1,
+        payload: { outcome: "clean_handoff" }
+    });
+    getDb().prepare("UPDATE workflow_events SET ts = ? WHERE id IN (?, ?)").run(stamped, failed.id, completed.id);
+    completeSession(session.id, {
+        status: "failed",
+        errorJson: JSON.stringify({ reason: PRESUMED_DEAD_REASON }),
+        logPath: "/tmp/stale-strip.log"
+    });
+    assert.equal(latestSessionFailureForIssue(getIssue(issue.id)), null);
+});

package/bundle/server/dist/coordinator/metrics.js

@@ -0,0 +1,35 @@
+/**
+ * Human wait is the union of `[requestedAt, resolvedAt ?? now]` intervals — not a sum —
+ * so two overlapping open actions on the same issue don't double-count the overlap
+ * (design doc §"usage_events": "avoiding double-counting overlapping actions").
+ */
+export function computeHumanWaitMs(actions, now = Date.now()) {
+    const intervals = actions
+        .map((a) => ({
+        start: new Date(a.requestedAt).getTime(),
+        end: a.resolvedAt ? new Date(a.resolvedAt).getTime() : now,
+    }))
+        .filter((i) => Number.isFinite(i.start) && Number.isFinite(i.end) && i.end > i.start)
+        .sort((a, b) => a.start - b.start);
+    let totalMs = 0;
+    let curStart = -Infinity;
+    let curEnd = -Infinity;
+    for (const { start, end } of intervals) {
+        if (start > curEnd) {
+            if (curEnd > curStart)
+                totalMs += curEnd - curStart;
+            curStart = start;
+            curEnd = end;
+        }
+        else if (end > curEnd) {
+            curEnd = end;
+        }
+    }
+    if (curEnd > curStart)
+        totalMs += curEnd - curStart;
+    return totalMs;
+}
+/** Every human action ever raised for the issue — resolved or still open. */
+export function computeInterventionCount(actions) {
+    return actions.length;
+}

package/bundle/server/dist/coordinator/metrics.test.js

@@ -0,0 +1,52 @@
+// packages/server/src/coordinator/metrics.test.ts
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { computeHumanWaitMs, computeInterventionCount } from "./metrics.js";
+function action(requestedAt, resolvedAt) {
+    return {
+        id: "a",
+        issueId: "i",
+        runId: null,
+        workflowInstanceId: null,
+        actionType: "policy_escalation",
+        reason: "r",
+        question: "q",
+        evidenceJson: null,
+        responseOptionsJson: null,
+        continuationPreviewJson: null,
+        requestId: null,
+        status: resolvedAt ? "resolved" : "open",
+        resolutionJson: null,
+        resolvedBy: null,
+        requestedAt,
+        resolvedAt,
+    };
+}
+test("computeHumanWaitMs sums a single resolved interval", () => {
+    const ms = computeHumanWaitMs([action("2026-01-01T00:00:00.000Z", "2026-01-01T00:10:00.000Z")]);
+    assert.equal(ms, 10 * 60_000);
+});
+test("computeHumanWaitMs does not double-count overlapping intervals", () => {
+    const actions = [
+        action("2026-01-01T00:00:00.000Z", "2026-01-01T00:10:00.000Z"),
+        action("2026-01-01T00:05:00.000Z", "2026-01-01T00:15:00.000Z"),
+    ];
+    // Union is [00:00, 00:15] = 15 minutes, not 10+10=20.
+    assert.equal(computeHumanWaitMs(actions), 15 * 60_000);
+});
+test("computeHumanWaitMs treats a still-open action as waiting until `now`", () => {
+    const now = new Date("2026-01-01T00:20:00.000Z").getTime();
+    const ms = computeHumanWaitMs([action("2026-01-01T00:00:00.000Z", null)], now);
+    assert.equal(ms, 20 * 60_000);
+});
+test("computeHumanWaitMs sums disjoint intervals", () => {
+    const actions = [
+        action("2026-01-01T00:00:00.000Z", "2026-01-01T00:05:00.000Z"),
+        action("2026-01-01T01:00:00.000Z", "2026-01-01T01:05:00.000Z"),
+    ];
+    assert.equal(computeHumanWaitMs(actions), 10 * 60_000);
+});
+test("computeInterventionCount counts every action raised, resolved or not", () => {
+    const actions = [action("2026-01-01T00:00:00.000Z", "2026-01-01T00:05:00.000Z"), action("2026-01-01T01:00:00.000Z", null)];
+    assert.equal(computeInterventionCount(actions), 2);
+});

package/bundle/server/dist/coordinator/permissions.js

@@ -0,0 +1,127 @@
+import { parsePermissionPolicyOverride, resolvePermissionPolicy } from "@agent-dealer/shared";
+import { codexScopedConfigDeniesSendGate } from "../adapters/codex-scoped-config.js";
+export { resolvePermissionPolicy };
+/** Resolve from the serialized profile override stored on the agent / snapshot. */
+export function resolveSessionPermissionPolicy(role, permissionPolicyJson) {
+    return resolvePermissionPolicy(role, parsePermissionPolicyOverride(permissionPolicyJson));
+}
+const WRITE_TOOL_NAMES = ["Write", "Edit", "Bash", "MultiEdit", "NotebookEdit"];
+const OUTBOUND_MUTATION_TOOL = "mcp__agent-deck__call_service_tool";
+function flagValue(args, flag) {
+    const i = args.indexOf(flag);
+    return i >= 0 ? (args[i + 1] ?? null) : null;
+}
+/**
+ * Invariant check on generated CLI args: throws if a reviewer invocation could write,
+ * run shell, or reach an outbound-mutation tool. Used as a spawn preflight and asserted
+ * directly in tests so the read-only guarantee cannot silently regress.
+ *
+ * `ctx` carries the spawn's env-level isolation. Omitting it is the strict reading (no
+ * scoped CODEX_HOME), so a caller that forgets it can only ever over-reject, never
+ * under-reject.
+ */
+export function assertReviewerReadOnly(args, ctx = {}) {
+    // Dangerous permission bypasses are never allowed for a reviewer.
+    for (const arg of args) {
+        if (arg.startsWith("--dangerously")) {
+            throw new Error(`reviewer args contain a permission bypass: ${arg}`);
+        }
+    }
+    // Claude: --allowedTools alone is NOT a restriction — it only auto-approves matching
+    // calls; a tool it omits is still reachable if the active --permission-mode or any
+    // ambient .claude/settings.json would otherwise grant it (confirmed against
+    // https://code.claude.com/docs/en/agent-sdk/permissions after a PR review round found
+    // exactly this gap). So the load-bearing checks are: --tools (a hard availability
+    // list) excludes every write tool, --restricted is present (ignores ambient settings
+    // files, refuses bypassPermissions), and --permission-mode is dontAsk (auto-denies
+    // anything not pre-approved instead of falling through). --allowedTools/
+    // --disallowedTools are checked too, but only as defense-in-depth on top of those.
+    const allowedTools = (flagValue(args, "--allowedTools") ?? "").split(",").filter(Boolean);
+    const isClaude = allowedTools.length > 0;
+    if (isClaude) {
+        const hardTools = (flagValue(args, "--tools") ?? "").split(",").filter(Boolean);
+        for (const tool of WRITE_TOOL_NAMES) {
+            if (hardTools.includes(tool))
+                throw new Error(`reviewer args make a write tool available: ${tool}`);
+            if (allowedTools.includes(tool))
+                throw new Error(`reviewer args pre-approve a write tool: ${tool}`);
+        }
+        if (!args.includes("--restricted")) {
+            throw new Error("reviewer claude args do not isolate ambient settings (missing --restricted)");
+        }
+        if (flagValue(args, "--permission-mode") !== "dontAsk") {
+            throw new Error("reviewer claude args do not auto-deny un-pre-approved tools (missing --permission-mode dontAsk)");
+        }
+        const denied = (flagValue(args, "--disallowedTools") ?? "").split(",").filter(Boolean);
+        if (allowedTools.includes(OUTBOUND_MUTATION_TOOL) || !denied.includes(OUTBOUND_MUTATION_TOOL)) {
+            throw new Error("reviewer args do not deny the outbound-mutation tool");
+        }
+    }
+    // Codex: never a writable sandbox. Cursor: never without ask mode.
+    if (args.includes("workspace-write")) {
+        throw new Error("reviewer args request a writable sandbox");
+    }
+    const isCursor = args.includes("--stream-partial-output");
+    if (isCursor && !(flagValue(args, "--mode") === "ask")) {
+        throw new Error("reviewer cursor args are not constrained to ask mode");
+    }
+    // KNOWN GAP (NOT-134): cursor's outbound-mutation denial is NOT enforced here, and this
+    // comment exists so the header's promise is not silently false for this runtime.
+    // `--force` is load-bearing — headless cursor-agent rejects every MCP tool call without
+    // it, since there is no human to approve — and its own help says it force-allows
+    // "unless explicitly denied". The only deny list found is `permissions.deny` in the
+    // user-global `~/.cursor/cli-config.json` (entries shaped like `Shell(ls)`): global,
+    // shared by concurrent attempts, and the operator's own file, so a per-attempt worker
+    // must not write it. No per-invocation override flag exists (`cursor-agent --help`).
+    // Until a per-attempt mechanism is found, a cursor reviewer can reach the send gate.
+    const isCodex = args[0] === "exec";
+    if (isCodex) {
+        if (flagValue(args, "-s") !== "read-only") {
+            throw new Error("reviewer codex args are not constrained to a read-only sandbox");
+        }
+        // codex's read-only sandbox does not gate configured MCP/plugin calls, and merging a
+        // `-c mcp_servers={}` override does not clear them (verified against the installed
+        // CLI). There are exactly two ways to keep the ambient `~/.codex/config.toml`
+        // mcp_servers table out of the session, and this invariant must accept both or it
+        // rejects the one shape production actually builds (NOT-132):
+        //
+        //   * `--ignore-user-config` — skips config.toml entirely. What a deckless reviewer
+        //     gets, since it needs no MCP server at all.
+        //   * a scoped `CODEX_HOME` — codex resolves config from `$CODEX_HOME`, else `~/.codex`
+        //     (cli-env.ts), so pointing it at the per-attempt directory means the only
+        //     config.toml codex can load is the one defining the single deck-header server.
+        //     `--ignore-user-config` is deliberately NOT passed here (args.ts), because it
+        //     would skip that scoped file too and leave the reviewer with no deck at all.
+        //
+        // The second arm checks the env, not `mcpConfigPath`: the env var is what codex reads,
+        // so a future config route returning a path without exporting CODEX_HOME would leave
+        // `~/.codex/config.toml` live while looking isolated here.
+        //
+        // Neither present means the ambient table is live: reject.
+        const codexHome = ctx.mcpEnv?.CODEX_HOME;
+        const scopedCodexHome = codexHome !== undefined && codexHome === ctx.mcpConfigPath;
+        if (!args.includes("--ignore-user-config") && !scopedCodexHome) {
+            throw new Error("reviewer codex args do not isolate configured MCP servers");
+        }
+        // NOT-134. codex has no `--disallowedTools`, so the outbound-mutation denial this
+        // function's header promises can only be expressed in the scoped config.toml. While
+        // `--ignore-user-config` was in play it was satisfied vacuously (no servers loaded at
+        // all); once a deck is attached, the server is loaded and the denial must be real.
+        // Read the file codex will read rather than trusting a flag passed alongside it.
+        if (scopedCodexHome && !codexScopedConfigDeniesSendGate(codexHome)) {
+            throw new Error("reviewer codex scoped config does not deny the outbound-mutation tool");
+        }
+    }
+    if (!isClaude && !isCursor && !isCodex) {
+        throw new Error("reviewer args do not constrain the runtime to a read-only mode");
+    }
+}
+export function isReviewerReadOnly(args, ctx = {}) {
+    try {
+        assertReviewerReadOnly(args, ctx);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/bundle/server/dist/coordinator/permissions.test.js

@@ -0,0 +1,184 @@
+// packages/server/src/coordinator/permissions.test.ts
+import { after, test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { serializePermissionPolicyOverride } from "@agent-dealer/shared";
+import { buildDeveloperArgs, buildReviewerArgs } from "./args.js";
+import { assertReviewerReadOnly, isReviewerReadOnly, resolveSessionPermissionPolicy, } from "./permissions.js";
+test("reviewer role resolves to an all-off policy", () => {
+    const p = resolveSessionPermissionPolicy("reviewer", null);
+    assert.deepEqual(p, {
+        worktreeWrite: false,
+        publishReview: false,
+        outboundMutation: false,
+        resolveHumanAction: false,
+    });
+});
+test("developer role grants worktree write by default", () => {
+    const p = resolveSessionPermissionPolicy("developer", null);
+    assert.equal(p.worktreeWrite, true);
+    assert.equal(p.publishReview, false);
+});
+test("a profile override can only tighten a developer policy, never loosen a reviewer one", () => {
+    const tightened = resolveSessionPermissionPolicy("developer", serializePermissionPolicyOverride({ worktreeWrite: false }));
+    assert.equal(tightened.worktreeWrite, false);
+    const loosened = resolveSessionPermissionPolicy("reviewer", serializePermissionPolicyOverride({ worktreeWrite: true }));
+    assert.equal(loosened.worktreeWrite, false, "override cannot raise the reviewer ceiling");
+});
+test("PermissionPolicy has no push/openPr field — see profile-snapshot.ts for why", () => {
+    // A PR review round proved every push/openPr control we tried (a Bash-argv denylist,
+    // then a git-config pushurl redirect) bypassable by the very worker it restricted, once
+    // that worker already holds an unrestricted write/Bash grant. Rather than ship a policy
+    // field that promises a restriction this layer cannot enforce, it isn't modeled here.
+    const p = resolveSessionPermissionPolicy("developer", null);
+    assert.ok(!("push" in p));
+    assert.ok(!("openPr" in p));
+});
+// NOT-132: the deck-attached column is the one production always takes, and it was the
+// one never asserted. args.ts omits codex's --ignore-user-config once a scoped CODEX_HOME
+// exists; permissions.ts demanded it unconditionally. Each module's own test passed while
+// the composition threw on every real spawn, so this matrix — not a per-runtime one-off —
+// is the shape that holds the contract.
+const RUNTIMES = ["claude_code", "codex_local", "cursor_local"];
+const deckConfigFor = (runtime) => runtime === "codex_local"
+    ? "/tmp/authz/codex-home"
+    : runtime === "cursor_local"
+        ? "/tmp/wt/.cursor/mcp.json"
+        : "/tmp/authz/claude-mcp.json";
+/** Mirrors what materializeWorkerMcpConfig hands realReviewerSpawn (agent-deck-bind.ts). */
+const deckContextFor = (runtime) => {
+    if (runtime === "codex_local") {
+        // A real directory: the codex branch reads this config to check the send-gate denial,
+        // the way codex itself will (NOT-134).
+        const home = scopedCodexHome(["call_service_tool"]);
+        return { mcpConfigPath: home, mcpEnv: { CODEX_HOME: home } };
+    }
+    return { mcpConfigPath: deckConfigFor(runtime) };
+};
+test("assertReviewerReadOnly passes for generated reviewer args across every runtime, deck-attached or not", () => {
+    for (const runtime of RUNTIMES) {
+        assert.doesNotThrow(() => assertReviewerReadOnly(buildReviewerArgs(runtime, "review")), `${runtime} without a deck`);
+        const ctx = deckContextFor(runtime);
+        const args = buildReviewerArgs(runtime, "review", undefined, undefined, ctx.mcpConfigPath);
+        assert.doesNotThrow(() => assertReviewerReadOnly(args, ctx), `${runtime} with a deck`);
+    }
+});
+test("a codex reviewer with neither --ignore-user-config nor a scoped CODEX_HOME is rejected", () => {
+    // The ambient ~/.codex/config.toml mcp_servers table would be live. Passing the args
+    // without their spawn context is the strict reading, so it must still throw.
+    const codexHome = scopedCodexHome(["call_service_tool"]);
+    const args = buildReviewerArgs("codex_local", "review", undefined, undefined, codexHome);
+    assert.ok(!args.includes("--ignore-user-config"));
+    assert.throws(() => assertReviewerReadOnly(args), /isolate configured MCP servers/);
+    assert.equal(isReviewerReadOnly(args), false);
+    assert.equal(isReviewerReadOnly(args, { mcpConfigPath: codexHome, mcpEnv: { CODEX_HOME: codexHome } }), true);
+});
+test("a config path that never reached the spawn env does not count as codex isolation", () => {
+    // The whole point of taking a context: CODEX_HOME in the child env is what makes codex
+    // skip ~/.codex, so a path alone — or one that disagrees with the env — is not evidence.
+    const codexHome = "/tmp/authz/codex-home";
+    const args = buildReviewerArgs("codex_local", "review", undefined, undefined, codexHome);
+    assert.equal(isReviewerReadOnly(args, { mcpConfigPath: codexHome }), false);
+    assert.equal(isReviewerReadOnly(args, { mcpConfigPath: codexHome, mcpEnv: { CODEX_HOME: "/tmp/somewhere-else" } }), false);
+    assert.equal(isReviewerReadOnly(args, { mcpConfigPath: codexHome, mcpEnv: { SOMETHING_ELSE: codexHome } }), false);
+});
+// NOT-134. codex has no --disallowedTools, so the send-gate denial lives in the scoped
+// config.toml. Verified live against codex 0.154.0: with `disabled_tools` present the
+// session reports NOTOOL and emits no mcp_tool_call; without it the tool is exposed and
+// reachable (the call was then refused by codex's own approval policy — an accident of
+// that default, not something this codebase expresses, which is exactly why it is
+// asserted here).
+const tempHomes = [];
+after(() => {
+    for (const dir of tempHomes)
+        fs.rmSync(dir, { recursive: true, force: true });
+});
+/** A scoped home whose config auto-approves the send gate — the one entry that could
+ *  undo `disabled_tools`. Must be rejected even though the denial is present. */
+function scopedCodexHomeApprovingSendGate() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "codex-home-approve-"));
+    tempHomes.push(dir);
+    fs.writeFileSync(path.join(dir, "config.toml"), '[mcp_servers.agent-deck]\nurl = "http://127.0.0.1:1110/mcp"\n' +
+        'disabled_tools = ["call_service_tool"]\n\n' +
+        '[mcp_servers.agent-deck.tools.call_service_tool]\napproval_mode = "approve"\n');
+    return dir;
+}
+function scopedCodexHome(disabledTools) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "codex-home-"));
+    tempHomes.push(dir);
+    const denial = disabledTools ? `disabled_tools = ${JSON.stringify(disabledTools)}\n` : "";
+    fs.writeFileSync(path.join(dir, "config.toml"), `[mcp_servers.agent-deck]\nurl = "http://127.0.0.1:1110/mcp"\n${denial}`);
+    return dir;
+}
+test("a deck-attached codex reviewer must carry the send-gate denial in its scoped config", () => {
+    const args = buildReviewerArgs("codex_local", "review", undefined, undefined, "placeholder");
+    const denied = scopedCodexHome(["call_service_tool"]);
+    assert.doesNotThrow(() => assertReviewerReadOnly(args, { mcpConfigPath: denied, mcpEnv: { CODEX_HOME: denied } }));
+    const undenied = scopedCodexHome(null);
+    assert.throws(() => assertReviewerReadOnly(args, { mcpConfigPath: undenied, mcpEnv: { CODEX_HOME: undenied } }), /deny the outbound-mutation tool/);
+    const wrongTool = scopedCodexHome(["some_other_tool"]);
+    assert.throws(() => assertReviewerReadOnly(args, { mcpConfigPath: wrongTool, mcpEnv: { CODEX_HOME: wrongTool } }), /deny the outbound-mutation tool/);
+});
+test("a scoped config that auto-approves the send gate is rejected despite the denial", () => {
+    const home = scopedCodexHomeApprovingSendGate();
+    const args = buildReviewerArgs("codex_local", "review", undefined, undefined, "placeholder");
+    assert.throws(() => assertReviewerReadOnly(args, { mcpConfigPath: home, mcpEnv: { CODEX_HOME: home } }), /deny the outbound-mutation tool/);
+});
+test("an unreadable scoped codex config is treated as not denied", () => {
+    // An assertion must only ever over-reject: a config we cannot read is not evidence.
+    const missing = fs.mkdtempSync(path.join(os.tmpdir(), "codex-home-empty-"));
+    tempHomes.push(missing);
+    const args = buildReviewerArgs("codex_local", "review", undefined, undefined, "placeholder");
+    assert.throws(() => assertReviewerReadOnly(args, { mcpConfigPath: missing, mcpEnv: { CODEX_HOME: missing } }), /deny the outbound-mutation tool/);
+});
+test("a scoped CODEX_HOME does not excuse a non-read-only codex sandbox", () => {
+    // Reaches the codex branch itself: `workspace-write` would trip the earlier generic
+    // sandbox check before ever getting here, so use a value only the codex branch rejects.
+    const codexHome = "/tmp/authz/codex-home";
+    const ctx = { mcpConfigPath: codexHome, mcpEnv: { CODEX_HOME: codexHome } };
+    assert.throws(() => assertReviewerReadOnly(["exec", "--json", "-s", "danger-full-access", "review"], ctx), /read-only sandbox/);
+    // and the generic writable-sandbox check still fires first for workspace-write
+    assert.throws(() => assertReviewerReadOnly(["exec", "--json", "-s", "workspace-write", "review"], ctx), /writable sandbox/);
+});
+test("assertReviewerReadOnly rejects developer args (write tools present)", () => {
+    assert.throws(() => assertReviewerReadOnly(buildDeveloperArgs("claude_code", "implement")));
+    assert.equal(isReviewerReadOnly(buildDeveloperArgs("codex_local", "implement")), false);
+});
+test("assertReviewerReadOnly rejects a claude invocation that merely omits write tools from --allowedTools", () => {
+    // This is the exact shape NOT-60 shipped before this review round: --allowedTools
+    // omits Write/Edit/Bash, but nothing stops the active permission mode / an ambient
+    // .claude/settings.json from granting them anyway. The invariant must catch it even
+    // though --allowedTools itself "looks" read-only.
+    const looksReadOnlyButIsnt = [
+        "-p",
+        "review the diff",
+        "--output-format",
+        "stream-json",
+        "--verbose",
+        "--allowedTools",
+        "Read,Glob,Grep,Skill",
+        "--disallowedTools",
+        "mcp__agent-deck__call_service_tool",
+    ];
+    assert.throws(() => assertReviewerReadOnly(looksReadOnlyButIsnt), /--tools|--restricted|dontAsk/);
+});
+test("a tightened developer policy drops the write tools from claude args", () => {
+    const policy = resolveSessionPermissionPolicy("developer", serializePermissionPolicyOverride({ worktreeWrite: false }));
+    const args = buildDeveloperArgs("claude_code", "prompt", undefined, policy);
+    const tools = args[args.indexOf("--allowedTools") + 1].split(",");
+    assert.ok(!tools.includes("Write"));
+    assert.ok(!tools.includes("Bash"));
+});
+test("a codex reviewer invocation isolates configured MCP servers via --ignore-user-config", () => {
+    // `-c mcp_servers={}` is a no-op (codex merges overrides into config.toml rather than
+    // replacing it — verified against the installed CLI); --ignore-user-config skips
+    // config.toml, where mcp_servers is defined, entirely.
+    const args = buildReviewerArgs("codex_local", "review");
+    assert.ok(args.includes("--ignore-user-config"));
+    assert.ok(!args.includes("-c"), "no longer relies on the disproven -c mcp_servers={} override");
+    // a codex developer keeps MCP (deck reads)
+    const dev = buildDeveloperArgs("codex_local", "impl");
+    assert.ok(!dev.includes("--ignore-user-config"));
+});