agent-lyceum 0.27.0 → 0.29.0

package/dist/quota.js

@@ -0,0 +1,141 @@
+import { spawn } from "node:child_process";
+export function parseClaudeUsage(text) {
+    const session = text.match(/Current session:\s*(\d+(?:\.\d+)?)%\s*used\s*·\s*resets\s+(.+)/);
+    const week = text.match(/Current week(?: \([^)]*\))?:\s*(\d+(?:\.\d+)?)%\s*used\s*·\s*resets\s+(.+)/);
+    const windows = [];
+    if (session)
+        windows.push(windowOf("這 5 小時", Number(session[1]), (session[2] ?? "").trim()));
+    if (week)
+        windows.push(windowOf("本週", Number(week[1]), (week[2] ?? "").trim()));
+    return windows;
+}
+export function codexWindows(limits) {
+    return [limits.primary, limits.secondary].flatMap((window) => {
+        if (!window || window.usedPercent === undefined)
+            return [];
+        const mins = window.windowDurationMins ?? 0;
+        const resets = window.resetsAt ? new Date(window.resetsAt * 1000).toLocaleString("zh-Hant", { month: "numeric", day: "numeric", hour: "2-digit", minute: "2-digit" }) : "時間不明";
+        return [windowOf(durationLabel(mins), window.usedPercent, resets)];
+    });
+}
+function durationLabel(mins) {
+    if (mins === 300)
+        return "這 5 小時";
+    if (mins === 10080)
+        return "7 天";
+    if (mins > 0 && mins % 1440 === 0)
+        return `${mins / 1440} 天`;
+    if (mins > 0 && mins % 60 === 0)
+        return `${mins / 60} 小時`;
+    return mins > 0 ? `${mins} 分鐘` : "用量";
+}
+function windowOf(label, used, resets) {
+    const usedPercent = roundPercent(used);
+    return { label, used_percent: usedPercent, remaining_percent: roundPercent(Math.max(0, 100 - used)), resets };
+}
+function roundPercent(n) {
+    return Math.round(n * 10) / 10;
+}
+export async function claudeQuota() {
+    try {
+        const text = await capture("claude", ["-p", "--no-session-persistence", "--output-format", "text", "/usage"], 20_000);
+        const windows = parseClaudeUsage(text.stdout);
+        if (windows.length === 0)
+            return { runtime: "claude", windows: [], error: firstLine(text.stderr) || firstLine(text.stdout) || "claude /usage 沒有回傳額度。" };
+        return { runtime: "claude", windows };
+    }
+    catch (error) {
+        return { runtime: "claude", windows: [], error: missing("claude", error) };
+    }
+}
+export async function codexQuota() {
+    try {
+        const limits = await readCodexLimits();
+        return { runtime: "codex", windows: codexWindows(limits) };
+    }
+    catch (error) {
+        return { runtime: "codex", windows: [], error: missing("codex", error) };
+    }
+}
+function missing(cmd, error) {
+    const code = error.code;
+    if (code === "ENOENT")
+        return `找不到 ${cmd}。`;
+    return error.message || `${cmd} 沒有回傳額度。`;
+}
+function firstLine(text) {
+    return text.split("\n").map((line) => line.trim()).find(Boolean) ?? "";
+}
+function capture(cmd, args, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        const timer = setTimeout(() => {
+            child.kill();
+            reject(new Error(`${cmd} 超過 ${Math.round(timeoutMs / 1000)} 秒沒有回應。`));
+        }, timeoutMs);
+        child.stdout.on("data", (chunk) => (stdout += String(chunk)));
+        child.stderr.on("data", (chunk) => (stderr += String(chunk)));
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on("close", () => {
+            clearTimeout(timer);
+            resolve({ stdout, stderr });
+        });
+    });
+}
+function readCodexLimits() {
+    return new Promise((resolve, reject) => {
+        const child = spawn("codex", ["app-server", "--stdio"], { stdio: ["pipe", "pipe", "pipe"] });
+        let buf = "";
+        const timer = setTimeout(() => {
+            child.kill();
+            reject(new Error("codex 超過 20 秒沒有回應。"));
+        }, 20_000);
+        let done = false;
+        const finish = (error, limits) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            child.kill();
+            if (error)
+                reject(error);
+            else
+                resolve(limits ?? {});
+        };
+        child.on("error", (error) => finish(error));
+        child.stdout.on("data", (chunk) => {
+            buf += String(chunk);
+            let cut = buf.indexOf("\n");
+            while (cut >= 0) {
+                const line = buf.slice(0, cut).trim();
+                buf = buf.slice(cut + 1);
+                cut = buf.indexOf("\n");
+                if (!line)
+                    continue;
+                let message;
+                try {
+                    message = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (message.id === 1 && message.result) {
+                    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method: "initialized", params: {} })}\n`);
+                    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "account/rateLimits/read", params: {} })}\n`);
+                }
+                if (message.id === 2) {
+                    if (message.error)
+                        finish(new Error(message.error.message || "codex 沒有回傳額度。"));
+                    else
+                        finish(undefined, message.result?.rateLimits ?? {});
+                }
+            }
+        });
+        child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: { clientInfo: { name: "agent-lyceum", version: "0" }, capabilities: {} } })}\n`);
+    });
+}

package/dist/run-session.js

@@ -1,7 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
+import { invokeWithSandboxChecks } from "./sandbox-invocation.js";
 import { realInvoker } from "./adapters/index.js";
-import { agentForCandidate, candidatesFor, Cooldowns, defaultSleep, planAttempts, runWithFallback } from "./fallback.js";
+import { agentForCandidate, candidatesFor, Cooldowns, defaultSleep, deferredAttempts, planAttempts, runWithFallback } from "./fallback.js";
 import { briefOf, digestOf, doneContract, mergeSteps, parseSteps } from "./format.js";
 import { ProtectedGuard } from "./guard.js";
 import { listRunLocks, lockHolderAlive } from "./project-lock.js";
@@ -580,6 +581,8 @@ export class RunSession {
         const all = candidatesFor(agent, tier && agent.tiers ? modelForTier(agent.tiers, tier) : undefined);
         const chain = all.length > 1;
         const candidates = chain ? planAttempts(all, cooldowns, Date.now()) : all;
+        // Models cooling down at the start are not dropped for good: when the warm ones fail they are tried last, once recovered.
+        const deferred = chain && candidates.length < all.length ? deferredAttempts(all, cooldowns, Date.now()).filter((c) => !candidates.includes(c)) : [];
         const ceiling = must(all.find((c) => c.primary), "the agent's own model");
         const tieredFirst = all[0]?.tiered ? all[0] : undefined;
         // The model a backup's calls stand in for: the one switched away from in this wake, or the cooling-down primary it started past.
@@ -594,6 +597,7 @@ export class RunSession {
         let stoppedByCancel = false;
         const outcome = await runWithFallback({
             candidates,
+            deferred,
             legacy: !chain,
             retry: cfg.retry,
             cooldowns,
@@ -609,6 +613,12 @@ export class RunSession {
                 // The round limit (when one is set) ends the run; this message stays unread for the resume.
                 return state.max_rounds > 0 && state.rounds >= state.max_rounds ? "stop" : undefined;
             },
+            onCooldownWait: (c, ms) => {
+                if (opts.signal?.aborted)
+                    return;
+                say(`  ${agent.name}: no other model is available; waiting ${Math.ceil(ms / 1000)}s for ${modelLabel(c)} to recover`);
+                log("cooldown_wait", { agent: agent.name, model: modelLabel(c), wait_ms: ms });
+            },
             onSwitch: (from, to, kind) => {
                 if (!from.tiered)
                     replaced = from;
@@ -651,14 +661,14 @@ export class RunSession {
                 const activeHandling = unread.map((m, i) => ({ ...handling[i], digest: digestOf(m.meta.type, m.body, true) }));
                 state.active[agent.name] = { round, since: new Date(started).toISOString(), handling: activeHandling };
                 this.saveState();
-                const result = await invoke({
+                const result = await invokeWithSandboxChecks(invoke, {
                     ...base,
                     agent: runAs,
                     signal: opts.signal,
                     logDir: attemptLogDir(runDir, att.id),
                     userPrompt,
                     sessionId,
-                }).catch((e) => ({
+                }, agent, { event: (name, fields) => log(name, fields) }, attempt).catch((e) => ({
                     ok: false,
                     text: "",
                     exitCode: null,
@@ -724,6 +734,10 @@ export class RunSession {
                 fault("park:before-finish");
                 finishAttempt(runDir, att.id, "failed", { error: result.error, parked });
                 say(`  ${agent.name} failed: ${result.error ?? "unknown error"}`);
+                if (result.kind === "config" && result.error?.startsWith("sandbox refused")) {
+                    this.note(`${agent.name} attempt ${att.n} was refused before it started (${result.error}); nothing was run, so there are no side effects to undo.`);
+                    return result;
+                }
                 this.note(`${agent.name} attempt ${att.n} failed (${result.error ?? "unknown error"})${parked.length ? `; ${parked.length} output file(s) set aside in ${path.join("mail", "attempts", att.id, "outbox")}` : ""}. ` +
                     `Anything it already did outside its mailbox (file edits, commands) was not undone: side effects may have happened.`);
                 return result;

package/dist/sandbox-invocation.d.ts

@@ -0,0 +1,35 @@
+import type { WakeInput, WakeResult, Invoker } from "./adapters/types.js";
+import type { ResolvedAgent, ResolvedProject } from "./config.js";
+import { type SandboxPathConflict } from "./policy.js";
+/** Where the `sandbox` and `sandbox-refused` events go: the run's log, or stderr for `call` (spec 25.8). */
+export interface SandboxSink {
+    event(name: string, fields: Record<string, unknown>): void;
+}
+export interface ProtectedPath {
+    path: string;
+    reason: string;
+}
+/**
+ * Everything a sandbox allowance must not reach (spec 25.4.3), canonical. `deep` adds the per-invocation items: the concrete
+ * write policy's deny list, bound workspaces and the git common dir. The agent's own checkout is left out: it is already writable.
+ */
+export declare function protectedPathsFor(project: ResolvedProject, agent: ResolvedAgent, deep: boolean): ProtectedPath[];
+export declare function describeConflict(agent: string, c: SandboxPathConflict, when: "load" | "invocation"): string;
+/** Conflicts of one agent's `write`/`unix_sockets` with the protected set. */
+export declare function sandboxConflictsOf(project: ResolvedProject, agent: ResolvedAgent, deep: boolean): SandboxPathConflict[];
+/** Capability excess of each backup of `agent` over its primary (spec 25.9): `[candidate label, excess...]`. */
+export declare function fallbackCapExcess(agent: ResolvedAgent): {
+    label: string;
+    excess: string[];
+}[];
+/** The refusal, if any, for this invocation. */
+export declare function sandboxRefusal(input: WakeInput, base: ResolvedAgent): {
+    reason: string;
+    path?: string;
+} | undefined;
+/**
+ * The one entry every adapter invocation goes through (spec 25.4.3, 25.19.1): refuses (returning a `config` failure, never
+ * throwing, never spawning) when an allowance reaches a protected path or a backup would widen them; otherwise records
+ * the `sandbox` event and calls `invoke`. An agent without `sandbox`, and a policy-override wake, go straight through.
+ */
+export declare function invokeWithSandboxChecks(invoke: Invoker, input: WakeInput, base: ResolvedAgent, sink: SandboxSink, attempt: number): Promise<WakeResult>;

package/dist/sandbox-invocation.js

@@ -0,0 +1,186 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { canonicalPath } from "./paths.js";
+/**
+ * `canonicalPath` for the sandbox check: a path that is missing (ENOENT/ENOTDIR) falls back to its nearest existing ancestor as
+ * usual, but any other realpath error (EACCES, ELOOP, ...) throws so the invocation is refused (fail closed).
+ */
+function strictCanonical(p) {
+    for (let head = path.resolve(p);; head = path.dirname(head)) {
+        try {
+            fs.realpathSync.native(head);
+            break;
+        }
+        catch (e) {
+            const code = e.code;
+            if (code !== "ENOENT" && code !== "ENOTDIR")
+                throw new Error(`cannot resolve ${head} (${code ?? e.message})`);
+            if (path.dirname(head) === head)
+                break;
+        }
+    }
+    return canonicalPath(p);
+}
+import { inboxDir, memoryDirs, osSandboxAvailable, outboxDir, recordsDir, repoDirFor, repoInstructionFiles, sandboxCapExcess, sandboxCaps, sandboxPathConflicts, sharedContextFiles, writePolicy, } from "./policy.js";
+/** Whether `cwd` or a parent holds a `.git` entry (a directory, or the file of a linked worktree). */
+function insideGitCheckout(cwd) {
+    for (let d = path.resolve(cwd);; d = path.dirname(d)) {
+        if (fs.existsSync(path.join(d, ".git")))
+            return true;
+        if (path.dirname(d) === d)
+            return false;
+    }
+}
+/**
+ * `git rev-parse --git-common-dir` of `cwd`, absolute; undefined when `cwd` is not in a git checkout. Fails closed: when it is a
+ * checkout but the probe fails, throws, so the invocation is refused instead of running with the shared git dir unprotected.
+ */
+function gitCommonDir(cwd) {
+    try {
+        const out = execFileSync("git", ["rev-parse", "--git-common-dir"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 5000 }).trim();
+        if (out)
+            return path.resolve(cwd, out);
+    }
+    catch (e) {
+        if (!insideGitCheckout(cwd))
+            return undefined;
+        throw new Error(`cannot find the git common dir of ${cwd} (git rev-parse --git-common-dir failed: ${e.message.split("\n")[0]})`);
+    }
+    if (insideGitCheckout(cwd))
+        throw new Error(`cannot find the git common dir of ${cwd} (git rev-parse --git-common-dir printed nothing)`);
+    return undefined;
+}
+/**
+ * Everything a sandbox allowance must not reach (spec 25.4.3), canonical. `deep` adds the per-invocation items: the concrete
+ * write policy's deny list, bound workspaces and the git common dir. The agent's own checkout is left out: it is already writable.
+ */
+export function protectedPathsFor(project, agent, deep) {
+    const out = [];
+    const add = (p, reason) => {
+        if (p)
+            out.push({ path: canonicalPath(p), reason });
+    };
+    add(project.home, "agent-lyceum home");
+    add(project.dir, "project directory");
+    add(path.join(os.homedir(), ".claude"), "Claude Code settings");
+    add(process.env.CODEX_HOME || path.join(os.homedir(), ".codex"), "Codex settings");
+    for (const a of Object.values(project.agents)) {
+        add(a.agentMd, `AGENT.md of ${a.name}`);
+        for (const m of memoryDirs(a))
+            add(m, `memory of ${a.name}`);
+        add(outboxDir(project, a.name), `outbox of ${a.name}`);
+        add(inboxDir(project, a.name), `inbox of ${a.name}`);
+    }
+    for (const f of sharedContextFiles(project))
+        add(f, "shared context");
+    for (const f of repoInstructionFiles(project))
+        add(f, "repo instruction file");
+    add(recordsDir(project), "project records");
+    if (!deep)
+        return out;
+    for (const d of writePolicy(project, agent).deny)
+        add(d, "write-protected path");
+    if (project.run)
+        add(project.run.dir, "run directory");
+    add(path.join(project.paths.root, "worktrees"), "worktrees root");
+    const own = project.workspaces?.[agent.name];
+    for (const [name, ws] of Object.entries(project.workspaces ?? {})) {
+        if (name === agent.name)
+            continue;
+        add(ws.root, `workspace of ${name}`);
+        add(ws.gitDir, `git dir of ${name}`);
+        add(ws.commonDir, "git common dir");
+    }
+    // The agent's own checkout and git dir are already inside its write scope, so they are not listed; the shared common dir is.
+    add(own?.commonDir ?? gitCommonDir(repoDirFor(project, agent.name)), "git common dir");
+    return out;
+}
+export function describeConflict(agent, c, when) {
+    const suffix = when === "invocation" ? " (checked before invocation)" : "";
+    const rel = c.relation === "equal" ? "is" : c.relation === "inside" ? "is inside" : "contains";
+    return `agent ${agent}: sandbox.${c.key}[${c.index}] ${c.path} ${rel} protected path ${c.protectedPath} (${c.reason}); pick a different directory.${suffix}`;
+}
+/** Conflicts of one agent's `write`/`unix_sockets` with the protected set. */
+export function sandboxConflictsOf(project, agent, deep) {
+    const s = agent.sandbox;
+    if (!s)
+        return [];
+    const entries = [
+        ...s.write.map((p, index) => ({ key: "write", index, path: canonicalPath(p) })),
+        ...s.unixSockets.map((p, index) => ({ key: "unix_sockets", index, path: canonicalPath(p) })),
+    ];
+    return sandboxPathConflicts(entries, protectedPathsFor(project, agent, deep));
+}
+/** Capability excess of each backup of `agent` over its primary (spec 25.9): `[candidate label, excess...]`. */
+export function fallbackCapExcess(agent) {
+    if (!agent.sandbox || !agent.runtime)
+        return [];
+    const primary = sandboxCaps(agent, agent.runtime);
+    const out = [];
+    for (const f of agent.fallback) {
+        const excess = sandboxCapExcess(primary, sandboxCaps(agent, f.runtime));
+        if (excess.length)
+            out.push({ label: `${f.runtime}/${f.model || "(default model)"}`, excess });
+    }
+    return out;
+}
+/** The refusal, if any, for this invocation. */
+export function sandboxRefusal(input, base) {
+    const agent = input.agent;
+    if (!agent.sandbox)
+        return undefined;
+    for (const p of [...agent.sandbox.write, ...agent.sandbox.unixSockets])
+        strictCanonical(p);
+    const c = sandboxConflictsOf(input.project, agent, true)[0];
+    if (c)
+        return { reason: describeConflict(agent.name, c, "invocation"), path: c.path };
+    const f = fallbackCapExcess(base)[0];
+    if (f)
+        return { reason: `agent ${base.name}: fallback ${f.label} would apply more sandbox allowance than the primary (${f.excess.join("; ")}) (checked before invocation)` };
+    return undefined;
+}
+function applied(agent) {
+    const caps = sandboxCaps(agent);
+    const osOn = osSandboxAvailable();
+    if (!osOn)
+        return { write: agent.runtime === "claude-code" ? "tool-rules" : "none", network: "unrestricted", local_binding: "unrestricted", unix_sockets: "unrestricted" };
+    return { write: "os", network: caps.network, local_binding: caps.localBinding ? "on" : "off", unix_sockets: caps.unixSockets ? "on" : "off" };
+}
+/**
+ * The one entry every adapter invocation goes through (spec 25.4.3, 25.19.1): refuses (returning a `config` failure, never
+ * throwing, never spawning) when an allowance reaches a protected path or a backup would widen them; otherwise records
+ * the `sandbox` event and calls `invoke`. An agent without `sandbox`, and a policy-override wake, go straight through.
+ */
+export async function invokeWithSandboxChecks(invoke, input, base, sink, attempt) {
+    const agent = input.agent;
+    if (!agent.sandbox || input.policy)
+        return invoke(input);
+    const refuse = (reason) => ({ ok: false, text: "", exitCode: null, timedOut: false, error: `sandbox refused: ${reason}`, kind: "config" });
+    try {
+        const bad = sandboxRefusal(input, base);
+        if (bad) {
+            sink.event("sandbox-refused", { agent: agent.name, runtime: agent.runtime, reason: bad.reason, ...(bad.path ? { path: bad.path } : {}) });
+            return refuse(bad.reason);
+        }
+        const s = agent.sandbox;
+        sink.event("sandbox", {
+            agent: agent.name,
+            runtime: agent.runtime,
+            model: agent.model,
+            attempt,
+            write: s.write.map(canonicalPath),
+            network: s.network,
+            local_binding: s.localBinding,
+            unix_sockets: s.unixSockets.map(canonicalPath),
+            applied: applied(agent),
+        });
+    }
+    catch (e) {
+        const reason = `${agent.name}: sandbox check failed: ${e.message}`;
+        sink.event("sandbox-refused", { agent: agent.name, runtime: agent.runtime, reason });
+        return refuse(reason);
+    }
+    return invoke(input);
+}

package/dist/schema.d.ts

@@ -12,7 +12,7 @@ export declare function inferRuntime(model: string | undefined): Runtime | undef
 export declare const WEB_LEVELS: readonly ["none", "search", "fetch"];
 export type WebLevel = (typeof WEB_LEVELS)[number];
 /** Why a wake failed, as far as the CLI's output reveals; decides whether to retry, fall back, or stop. */
-export declare const ERROR_KINDS: readonly ["rate_limit", "quota", "timeout", "network", "crash", "auth", "unknown"];
+export declare const ERROR_KINDS: readonly ["rate_limit", "quota", "timeout", "network", "crash", "auth", "config", "unknown"];
 export type ErrorKind = (typeof ERROR_KINDS)[number];
 /** One link of a fallback chain after resolution: runtime and model are filled in (model "" = the runtime's own default). */
 export interface FallbackEntry {
@@ -37,6 +37,14 @@ export declare const FallbackEntryPartial: z.ZodObject<{
     }>>;
 }, z.core.$strict>;
 export type FallbackEntryPartialT = z.infer<typeof FallbackEntryPartial>;
+/** Per-agent sandbox allowances (spec 25); every key is optional and absent = none. */
+export declare const SandboxPartial: z.ZodObject<{
+    write: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    network: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    local_binding: z.ZodOptional<z.ZodBoolean>;
+    unix_sockets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type SandboxPartialT = z.infer<typeof SandboxPartial>;
 export declare const AgentPartial: z.ZodObject<{
     runtime: z.ZodOptional<z.ZodEnum<{
         "claude-code": "claude-code";
@@ -80,6 +88,12 @@ export declare const AgentPartial: z.ZodObject<{
             xhigh: "xhigh";
         }>>;
     }, z.core.$strict>>>;
+    sandbox: z.ZodOptional<z.ZodObject<{
+        write: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        network: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        local_binding: z.ZodOptional<z.ZodBoolean>;
+        unix_sockets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     owns: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strict>;
 export type AgentPartialT = z.infer<typeof AgentPartial>;
@@ -168,6 +182,12 @@ export declare const GlobalConfig: z.ZodObject<{
                 xhigh: "xhigh";
             }>>;
         }, z.core.$strict>>>;
+        sandbox: z.ZodOptional<z.ZodObject<{
+            write: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            network: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            local_binding: z.ZodOptional<z.ZodBoolean>;
+            unix_sockets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         owns: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
@@ -250,6 +270,12 @@ export declare const ProjectConfig: z.ZodObject<{
                 xhigh: "xhigh";
             }>>;
         }, z.core.$strict>>>;
+        sandbox: z.ZodOptional<z.ZodObject<{
+            write: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            network: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            local_binding: z.ZodOptional<z.ZodBoolean>;
+            unix_sockets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         owns: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;

package/dist/schema.js

@@ -21,7 +21,7 @@ export function inferRuntime(model) {
 /** How much of the web an agent may use: nothing, search only, or search plus fetching pages. Unset leaves each runtime's own default alone. */
 export const WEB_LEVELS = ["none", "search", "fetch"];
 /** Why a wake failed, as far as the CLI's output reveals; decides whether to retry, fall back, or stop. */
-export const ERROR_KINDS = ["rate_limit", "quota", "timeout", "network", "crash", "auth", "unknown"];
+export const ERROR_KINDS = ["rate_limit", "quota", "timeout", "network", "crash", "auth", "config", "unknown"];
 const Memory = z
     .object({
     global: z.string().optional(),
@@ -36,6 +36,18 @@ export const FallbackEntryPartial = z
     effort: z.enum(EFFORTS).optional(),
 })
     .strict();
+const DOMAIN_RE = /^(\*\.)?([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+/** Per-agent sandbox allowances (spec 25); every key is optional and absent = none. */
+export const SandboxPartial = z
+    .object({
+    write: z.array(z.string().trim().min(1)).optional(),
+    network: z
+        .array(z.string().trim().toLowerCase().regex(DOMAIN_RE, "expected a host name like registry.npmjs.org or *.example.com (no scheme, port, path or IP)"))
+        .optional(),
+    local_binding: z.boolean().optional(),
+    unix_sockets: z.array(z.string().trim().min(1)).optional(),
+})
+    .strict();
 export const AgentPartial = z
     .object({
     runtime: z.enum(RUNTIMES).optional(),
@@ -49,6 +61,7 @@ export const AgentPartial = z
     can_ask_user: z.boolean().optional(),
     allow_web: z.enum(WEB_LEVELS).optional(),
     fallback: z.array(FallbackEntryPartial).optional(),
+    sandbox: SandboxPartial.optional(),
     /** Removed setting: still accepted (any value) so old files load; ignored, with a warning from `validate`. */
     owns: z.unknown().optional(),
 })

package/dist/status-watch.d.ts

@@ -13,7 +13,9 @@ export type WatchFrame = {
  * A task that was running in the previous frame and has completed since is included once more, so the reader sees
  * it finish (and can toast) before it is dropped. `tracked` is that previous set; it is replaced by the ids running now.
  */
-export declare function buildWatchFrame(project: ResolvedProject, tracked: Set<string>): WatchFrame;
+export declare function buildWatchFrame(project: ResolvedProject, tracked: Set<string>, opts?: {
+    allTasks?: boolean;
+}): WatchFrame;
 export interface WatchDeps {
     /** The project, loaded again each time so config edits and new runs show up. */
     load: () => ResolvedProject;
@@ -21,6 +23,8 @@ export interface WatchDeps {
     dir: (project: ResolvedProject) => string;
     write: (line: string) => void;
     debounceMs: number;
+    /** Include finished tasks. The browser page uses this; `status --json --watch` does not. */
+    allTasks?: boolean;
     watch?: (dir: string, onChange: () => void) => {
         close: () => void;
     };

package/dist/status-watch.js

@@ -6,12 +6,14 @@ import { buildStatusReport, buildTaskListReport, isCompletedRun } from "./status
  * A task that was running in the previous frame and has completed since is included once more, so the reader sees
  * it finish (and can toast) before it is dropped. `tracked` is that previous set; it is replaced by the ids running now.
  */
-export function buildWatchFrame(project, tracked) {
+export function buildWatchFrame(project, tracked, opts) {
     const all = buildTaskListReport(project).runs;
     const running = all.filter((r) => r.state === "running").map((r) => r.run_id);
     const open = all.filter((r) => !isCompletedRun(r)).map((r) => r.run_id);
     const runs = {};
-    for (const id of new Set([...open, ...tracked]))
+    // The web page keeps every task. The terminal watch drops one after it has completed, once the finish has been seen.
+    const ids = opts?.allTasks ? all.map((r) => r.run_id) : [...open, ...tracked];
+    for (const id of new Set(ids))
         runs[id] = buildStatusReport(project, id);
     const report = buildStatusReport(project);
     tracked.clear();
@@ -39,7 +41,7 @@ export function createStatusWatcher(d) {
         let project;
         try {
             project = d.load();
-            frame = buildWatchFrame(project, tracked);
+            frame = buildWatchFrame(project, tracked, { allTasks: d.allTasks });
         }
         catch (e) {
             frame = { schema_version: 1, error: e.message };

package/dist/validate.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import { enforcementFor, memoryDirs } from "./policy.js";
+import { describeConflict, fallbackCapExcess, sandboxConflictsOf } from "./sandbox-invocation.js";
 import { isInside } from "./paths.js";
 import { inferRuntime, RUNTIME_EFFORTS, RUNTIMES } from "./schema.js";
 import { ladderIndex } from "./tiers.js";
@@ -50,6 +51,10 @@ export function validateProject(project) {
             err(`Agent "${a.name}": effort "${a.effort}" is not supported by ${a.runtime} (use ${RUNTIME_EFFORTS[a.runtime].join(", ")}).`);
         }
         validateFallback(project, a, err);
+        for (const c of sandboxConflictsOf(project, a, false))
+            err(describeConflict(a.name, c, "load"));
+        for (const f of fallbackCapExcess(a))
+            err(`agent ${a.name}: fallback ${f.label} would apply more sandbox allowance than the primary (${f.excess.join("; ")}).`);
         if (!fs.existsSync(a.agentMd))
             err(`Agent "${a.name}": AGENT.md not found at ${a.agentMd}`);
         if (!a.memory.global && !a.memory.project)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-lyceum",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Config + dispatcher for teams of Claude Code / Codex agents with scoped context and file-based mailboxes",
   "keywords": [
     "ai",
@@ -27,7 +27,9 @@
   },
   "files": [
     "dist",
-    "!dist/**/*.map"
+    "!dist/**/*.map",
+    "web/dist",
+    "!web/dist/**/*.map"
   ],
   "engines": {
     "node": ">=20"
@@ -41,7 +43,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit && npm run typecheck:plugin",
     "test": "vitest run",
     "prepare": "npm run build",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build && pnpm --dir web install --frozen-lockfile && pnpm --dir web typecheck && pnpm --dir web build",
     "release": "bash scripts/release.sh",
     "typecheck:plugin": "tsc -p plugins/status-monitor/tsconfig.ci.json",
     "check:pack": "node scripts/check-pack.mjs",