cdx-manager 0.25.8 → 0.26.0

package/src/ollama_remote.py

@@ -0,0 +1,175 @@
+"""Worker-owned Ollama relay and a text-only HTTP client, shipped over SSH."""
+
+import http.client
+import http.server
+import json
+import os
+import pathlib
+import signal
+import socketserver
+import subprocess
+import sys
+import tempfile
+import threading
+from contextlib import contextmanager
+
+OLLAMA_HOST = '127.0.0.1'
+OLLAMA_PORT = 11434
+MAX_BODY = 8 * 1024 * 1024
+
+CLIENT = r'''
+import http.client
+import json
+import socket
+import sys
+
+class Connection(http.client.HTTPConnection):
+    def connect(self):
+        self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        self.sock.settimeout(300)
+        self.sock.connect(sys.argv[1])
+
+try:
+    payload = json.load(sys.stdin)
+    def request(path, body):
+        connection = Connection('localhost', timeout=300)
+        try:
+            connection.request('POST', path, json.dumps(body), {'Content-Type': 'application/json'})
+            response = connection.getresponse()
+            data = json.loads(response.read(8 * 1024 * 1024))
+            if response.status != 200 or not isinstance(data, dict) or data.get('error'):
+                raise ValueError('Ollama request failed')
+            return data
+        finally:
+            connection.close()
+    model = payload['model']
+    info = request('/api/show', {'model': model})
+    if info.get('remote_host') or info.get('remote_model'):
+        raise ValueError('A local model is required')
+    if 'capabilities' in info and 'completion' not in info['capabilities']:
+        raise ValueError('Text completion is required')
+    if payload.get('probe'):
+        print('ollama-http')
+    else:
+        result = request('/api/chat', {'model': model, 'stream': False,
+                         'messages': [{'role': 'user', 'content': payload['prompt']}]})
+        if result.get('done') is not True or not isinstance(result.get('message', {}).get('content'), str):
+            raise ValueError('Incomplete Ollama response')
+        print(json.dumps(result))
+except Exception:
+    print('Ollama text generation failed: check the local model and worker loopback API.', file=sys.stderr)
+    sys.exit(1)
+'''
+
+
+@contextmanager
+def relay(directory, model):
+    """Expose only a fixed loopback destination and a fixed model over a private socket."""
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def log_message(self, *_):
+            pass
+
+        def do_POST(self):
+            try:
+                size = int(self.headers.get('Content-Length', '0'))
+                if not 0 < size <= MAX_BODY or self.headers.get('Transfer-Encoding'):
+                    raise ValueError('Invalid body')
+                self.connection.settimeout(10)
+                data = json.loads(self.rfile.read(size))
+                if not isinstance(data, dict) or data.get('model') != model:
+                    raise ValueError('Invalid model')
+                if self.path == '/api/show':
+                    allowed = set(data) == {'model'}
+                elif self.path == '/api/chat':
+                    messages = data.get('messages')
+                    allowed = (set(data) == {'model', 'stream', 'messages'} and data.get('stream') is False
+                               and isinstance(messages, list) and len(messages) == 1
+                               and isinstance(messages[0], dict) and set(messages[0]) == {'role', 'content'}
+                               and messages[0]['role'] == 'user' and isinstance(messages[0]['content'], str))
+                else:
+                    allowed = False
+                if not allowed:
+                    raise ValueError('Forbidden call')
+            except (ValueError, TypeError, OSError):
+                self.send_error(403, 'Relay call refused')
+                return
+            connection = http.client.HTTPConnection(OLLAMA_HOST, OLLAMA_PORT, timeout=300)
+            try:
+                # No proxies, redirects, forwarded headers or client-selected destination.
+                connection.request('POST', self.path, json.dumps(data), {'Content-Type': 'application/json'})
+                response = connection.getresponse()
+                body = response.read(MAX_BODY + 1)
+                if len(body) > MAX_BODY:
+                    raise ValueError('Oversized response')
+                self.send_response(response.status)
+                self.send_header('Content-Type', 'application/json')
+                self.send_header('Content-Length', str(len(body)))
+                self.end_headers()
+                self.wfile.write(body)
+            except (OSError, ValueError, http.client.HTTPException):
+                self.send_error(502, 'Ollama unavailable')
+            finally:
+                connection.close()
+
+    class Server(socketserver.ThreadingUnixStreamServer):
+        daemon_threads = True
+
+    path = str(pathlib.Path(directory) / 'api.sock')
+    with Server(path, Handler) as server:
+        os.chmod(path, 0o600)
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        try:
+            yield path
+        finally:
+            server.shutdown()
+            thread.join()
+
+
+def run(payload, sandbox_source, probe=False):
+    """Run a single HTTP completion; no shell tools or model files enter the sandbox."""
+    model = payload.get('model')
+    if not isinstance(model, str) or not model.strip():
+        raise RuntimeError('Remote Ollama requires an installed model')
+    with tempfile.TemporaryDirectory(prefix='cdx-ollama-') as directory, relay(directory, model) as path:
+        command = [sys.executable, '-I', '-c', CLIENT, path]
+        env = None
+        if payload.get('isolate_workspace'):
+            namespace = {'__name__': 'cdx_workspace_sandbox'}
+            exec(compile(sandbox_source, 'workspace_sandbox.py', 'exec'), namespace)
+            command = ['python3', '-I', '-c', CLIENT, '/run/cdx-ollama/api.sock']
+            command, env = namespace['sandbox_command'](
+                command, pathlib.Path(payload['cwd']), network=False, writable=False,
+                provider='ollama', ollama_relay=directory)
+        child = subprocess.Popen(command, cwd=payload['cwd'], env=env, stdin=subprocess.PIPE,
+                                 stdout=subprocess.PIPE, stderr=subprocess.PIPE, start_new_session=True)
+
+        def stop(*_):
+            if child.poll() is None:
+                try:
+                    os.killpg(child.pid, signal.SIGKILL)
+                except ProcessLookupError:
+                    pass
+
+        def disconnected():
+            while os.read(0, 1):
+                pass
+            stop()
+
+        previous = {sig: signal.signal(sig, stop) for sig in (signal.SIGTERM, signal.SIGHUP, signal.SIGINT)}
+        if not probe:
+            threading.Thread(target=disconnected, daemon=True).start()
+        try:
+            output, error = child.communicate(json.dumps({'model': model, 'prompt': payload.get('prompt'), 'probe': probe}).encode(),
+                                              timeout=30 if probe else None)
+            if probe:
+                sys.stdout.write(output.decode())
+            else:
+                print(json.dumps({'stream': 'stdout', 'data': output.decode()}), flush=True)
+            sys.stderr.write(error.decode())
+            return child.returncode
+        finally:
+            stop()
+            child.wait()
+            for sig, handler in previous.items():
+                signal.signal(sig, handler)

package/src/provider_runtime.py

@@ -753,6 +753,9 @@ def _build_launch_spec(session, cwd=None, env_override=None, initial_prompt=None
             "label": "claude",
         }, capture_transcript=capture_transcript, env=env)
     if session["provider"] == PROVIDER_ANTIGRAVITY:
+        from .antigravity_status import install
+
+        install(_get_auth_home(session))
         args = _launch_config_args(session)
         if initial_prompt:
             args += ["--prompt-interactive", initial_prompt]
@@ -1059,6 +1062,18 @@ def _build_headless_launch_spec(session, cwd=None, env_override=None, initial_pr
             "sensitive_args": [initial_prompt] if initial_prompt else [],
         }
 
+    if session["provider"] == PROVIDER_ANTIGRAVITY:
+        args = ["-p", initial_prompt or "", "--output-format", "json"]
+        if model:
+            args += ["--model", model]
+        args += _launch_config_args(session)
+        args += _extra_args(session)
+        return {
+            "command": "agy", "args": args,
+            "options": {"cwd": cwd, "env": {**env, **_antigravity_env_overrides(_get_auth_home(session))}},
+            "label": "antigravity", "sensitive_args": [initial_prompt] if initial_prompt else [],
+        }
+
     return _build_launch_spec(
         session,
         cwd=cwd,

package/src/remote_run.py

@@ -1,4 +1,4 @@
-"""Controller-side temporary Codex credentials and SSH transport."""
+"""Controller-owned remote provider credentials and SSH transport."""
 
 import base64
 import json
@@ -88,6 +88,7 @@ def worker_input():
                for name in ('errors', 'run_usage', 'run_observation')}
     source += 'OBSERVATION_MODULES = ' + repr(modules) + '\n'
     source += f'OBSERVATION_LIMITS = {MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_SCAN_SECONDS!r}\n'
+    source += 'OLLAMA_SOURCE = ' + repr((directory / 'ollama_remote.py').read_text()) + '\n'
     source += (directory / 'remote_worker.py').read_text()
     return json.dumps(source).encode() + b'\n'
 
@@ -109,21 +110,32 @@ def ssh_command(target, mode, remote_prefix=None):
             '-o', 'ServerAliveInterval=5', '-o', 'ServerAliveCountMax=1', target, command]
 
 
-def preflight(target, env=None, *, remote_prefix=None, isolate_workspace=False, cwd=None, network=False, writable=True):
+def preflight(target, env=None, *, remote_prefix=None, isolate_workspace=False, cwd=None, network=False, writable=True, provider="codex", model=None):
     payload = {'isolate_workspace': isolate_workspace, 'cwd': cwd, 'network': network, 'writable': writable}
+    if provider in ('ollama', 'claude', 'antigravity'):
+        payload.update(provider=provider, model=model)
+    if provider in ('claude', 'antigravity'):
+        payload['isolate_workspace'] = True
     try:
-        local = subprocess.check_output(['codex', '--version'], env=env, stderr=subprocess.DEVNULL, timeout=10).decode().strip()
+        local = ('ollama-http' if provider == 'ollama' else
+                 subprocess.check_output(['agy' if provider == 'antigravity' else provider, '--version'], env=env, stderr=subprocess.DEVNULL, timeout=10).decode().strip())
         result = subprocess.run(ssh_command(target, 'probe', remote_prefix), env=env,
                                 input=worker_input() + json.dumps(payload).encode() + b'\n',
                                 capture_output=True, timeout=30)
     except (OSError, subprocess.TimeoutExpired) as error:
-        raise CdxError('Remote worker unreachable or Codex CLI unavailable.', code='remote_unavailable') from error
+        raise CdxError('Remote worker unreachable or provider unavailable.', code='remote_unavailable') from error
     if result.returncode:
+        if provider == 'antigravity' and result.returncode == 120:
+            raise CdxError('Antigravity worker is not signed in or its session file is unsafe; sign in once on the worker.',
+                           code='antigravity_not_signed_in')
+        if provider == 'ollama':
+            raise CdxError('Remote Ollama unavailable: check the installed local model, loopback API and isolation dependencies.',
+                           code='remote_unavailable')
         message = ('Remote workspace isolation unavailable; requires bubblewrap, pasta, nftables, working namespaces and a valid checkout.'
-                   if isolate_workspace else 'Remote worker unreachable or missing Python 3, Codex or memory-backed /dev/shm.')
+                   if payload['isolate_workspace'] else 'Remote worker unreachable or missing Python 3, provider CLI or memory-backed /dev/shm.')
         raise CdxError(message, code='remote_unavailable')
     if local != result.stdout.decode().strip():
-        raise CdxError('Remote Codex CLI version mismatch; install the controller version on the worker.', code='remote_version_mismatch')
+        raise CdxError('Remote provider CLI version mismatch; install the controller version on the worker.', code='remote_version_mismatch')
     return local
 
 
@@ -149,27 +161,53 @@ def run_remote(session, target, version, cwd=None, env_override=None, initial_pr
         _route_termination_to_interrupt,
     )
 
-    home = session['authHome']
-    with remote_auth_lock(home):
-        auth = temporary_auth(home)
-        if auth['tokens'].get('refresh_token') != '':
-            raise CdxError('Refusing to send a refresh token to a worker.')
+    if session['provider'] == 'ollama':
+        launch = session.get('launch') or {}
+        spec = {'command': 'ollama-http', 'args': [], 'env': {}}
+        payload = {'provider': 'ollama', 'model': launch.get('model'), 'prompt': initial_prompt,
+                   'cwd': cwd, 'isolate_workspace': bool(launch.get('isolate_workspace'))}
+    elif session['provider'] == 'antigravity':
+        spec = _build_headless_launch_spec(session, cwd, env_override, initial_prompt)
+        payload = {'provider': 'antigravity', 'args': spec['args'], 'cwd': cwd,
+                   'version': version, 'isolate_workspace': True, 'network': False,
+                   'writable': (session.get('launch') or {}).get('permission') != 'review'}
+    elif session['provider'] == 'claude':
+        from .claude_remote_token import read_token
+        token = read_token(session)
         spec = _build_headless_launch_spec(session, cwd, env_override, initial_prompt)
-        if (session.get('launch') or {}).get('network_access'):
-            index = spec['args'].index('--') if '--' in spec['args'] else len(spec['args'])
-            spec['args'][index:index] = ['-c', 'sandbox_workspace_write.network_access=true']
-        config = nonsecret_config(home)
-        launch_text = json.dumps(spec['args']) + config
-        if any(value and value in launch_text for value in auth['tokens'].values()):
+        if token in json.dumps(spec['args']):
             raise CdxError('Refusing a credential embedded in the remote prompt or configuration.')
-        payload = {'auth': auth, 'config': config, 'args': spec['args'], 'cwd': cwd,
-                   'version': version, 'expires_at': token_expiry(auth['tokens']['access_token']),
-                   'isolate_workspace': bool((session.get('launch') or {}).get('isolate_workspace')),
+        if '--bare' in spec['args']:
+            raise CdxError('Remote Claude OAuth runs do not support --bare.')
+        index = spec['args'].index('--') if '--' in spec['args'] else len(spec['args'])
+        # Bubblewrap owns tool permissions, matching isolated local headless runs.
+        spec['args'][index:index] = ['--permission-mode', 'bypassPermissions']
+        payload = {'provider': 'claude', 'token': token, 'args': spec['args'], 'cwd': cwd,
+                   'version': version, 'isolate_workspace': True,
                    'network': bool((session.get('launch') or {}).get('network_access')),
                    'writable': (session.get('launch') or {}).get('permission') != 'review'}
-        rotating = json.loads((pathlib.Path(home) / 'auth.json').read_text())['tokens'].get('refresh_token')
-        if rotating and rotating in json.dumps(payload):
-            raise CdxError('Refusing to send a refresh token to a worker.')
+    else:
+        home = session['authHome']
+        with remote_auth_lock(home):
+            auth = temporary_auth(home)
+            if auth['tokens'].get('refresh_token') != '':
+                raise CdxError('Refusing to send a refresh token to a worker.')
+            spec = _build_headless_launch_spec(session, cwd, env_override, initial_prompt)
+            if (session.get('launch') or {}).get('network_access'):
+                index = spec['args'].index('--') if '--' in spec['args'] else len(spec['args'])
+                spec['args'][index:index] = ['-c', 'sandbox_workspace_write.network_access=true']
+            config = nonsecret_config(home)
+            launch_text = json.dumps(spec['args']) + config
+            if any(value and value in launch_text for value in auth['tokens'].values()):
+                raise CdxError('Refusing a credential embedded in the remote prompt or configuration.')
+            payload = {'auth': auth, 'config': config, 'args': spec['args'], 'cwd': cwd,
+                       'version': version, 'expires_at': token_expiry(auth['tokens']['access_token']),
+                       'isolate_workspace': bool((session.get('launch') or {}).get('isolate_workspace')),
+                       'network': bool((session.get('launch') or {}).get('network_access')),
+                       'writable': (session.get('launch') or {}).get('permission') != 'review'}
+            rotating = json.loads((pathlib.Path(home) / 'auth.json').read_text())['tokens'].get('refresh_token')
+            if rotating and rotating in json.dumps(payload):
+                raise CdxError('Refusing to send a refresh token to a worker.')
     paths = _headless_artifact_paths(session, run_id, attempt)
     paths['remote'] = target
     start = datetime.now(timezone.utc)
@@ -208,7 +246,7 @@ def run_remote(session, target, version, cwd=None, env_override=None, initial_pr
         child.stdin.flush()
         deadline = time.monotonic() + timeout_seconds if timeout_seconds else None
         while child.poll() is None:
-            if time.time() >= payload['expires_at']:
+            if time.time() >= payload.get('expires_at', float('inf')):
                 credential_expired = True
                 break
             with observation_lock:
@@ -259,7 +297,7 @@ def run_remote(session, target, version, cwd=None, env_override=None, initial_pr
         error.cancelled = True
         error.run_info = {**info, 'returncode': 130}
         raise error
-    if credential_expired or time.time() >= payload['expires_at'] or child.returncode == 123:
+    if credential_expired or time.time() >= payload.get('expires_at', float('inf')) or child.returncode == 123:
         error = CdxError('Remote temporary credential expired; start a new run from the controller.', code='remote_credential_expired')
         error.run_info = info
         raise error
@@ -269,4 +307,10 @@ def run_remote(session, target, version, cwd=None, env_override=None, initial_pr
         raise error
     if timed_out or budget_exceeded:
         info['returncode'] = 125 if budget_exceeded else 124
+    if session['provider'] == 'antigravity':
+        from .run_usage import antigravity_outcome
+        info = antigravity_outcome(info)
+        if child.returncode in (120, 121):
+            info.update(returncode=1, provider_error='antigravity_not_signed_in' if child.returncode == 120 else 'antigravity_session_busy',
+                        provider_message='Antigravity worker is not signed in.' if child.returncode == 120 else 'Antigravity worker session is busy.')
     return info

package/src/remote_worker.py

@@ -13,10 +13,12 @@ import tempfile
 import threading
 import time
 import types
+from contextlib import ExitStack
 from datetime import datetime, timezone
 
 # Supplied by the controller before this module is executed.
 SANDBOX_SOURCE = globals().get('SANDBOX_SOURCE', '')
+OLLAMA_SOURCE = globals().get('OLLAMA_SOURCE', '')
 OBSERVATION_MODULES = globals().get('OBSERVATION_MODULES', {})
 OBSERVATION_LIMITS = globals().get('OBSERVATION_LIMITS', (128 * 1024 * 1024, 1))
 
@@ -34,8 +36,8 @@ def observation_runtime():
     return sys.modules[package.__name__ + '.run_usage'], sys.modules[package.__name__ + '.run_observation']
 
 
-def version():
-    return subprocess.check_output(["codex", "--version"], stderr=subprocess.DEVNULL, timeout=10).decode().strip()
+def version(provider="codex"):
+    return subprocess.check_output(["agy" if provider == "antigravity" else provider, "--version"], stderr=subprocess.DEVNULL, timeout=10).decode().strip()
 
 
 def storage():
@@ -75,16 +77,26 @@ def isolation_probe_command(payload, home, env):
     # Execute exactly the local confinement implementation, shipped over stdin.
     namespace = {'__name__': 'cdx_workspace_sandbox'}
     exec(compile(SANDBOX_SOURCE, 'workspace_sandbox.py', 'exec'), namespace)
+    provider = payload.get('provider', 'codex')
     return namespace['sandbox_command'](
-        ['codex', '--version'], pathlib.Path(payload['cwd']), network=payload['network'],
-        writable=payload['writable'], source=env, auth_home=str(home), provider='codex',
-        observation_home=str(home / 'sessions'))
+        ['agy' if provider == 'antigravity' else provider, '--version'], pathlib.Path(payload['cwd']), network=payload['network'],
+        writable=payload['writable'], source=env, auth_home=str(home), provider=provider,
+        observation_home=str(home) if provider in ('claude', 'antigravity') else str(home / 'sessions'),
+        claude_token_stdin=provider == 'claude')
 
 
 def probe(root, payload):
     if not payload.get('isolate_workspace'):
         print(version())
         return 0
+    if payload.get('provider') == 'antigravity':
+        namespace = {'__name__': 'cdx_workspace_sandbox'}
+        exec(compile(SANDBOX_SOURCE, 'workspace_sandbox.py', 'exec'), namespace)
+        try:
+            namespace['antigravity_token']()
+        except RuntimeError:
+            print('Antigravity worker is not signed in or its session file is unsafe.', file=sys.stderr)
+            return 120
     # Exercise mounts, namespaces and the nft setup with a dummy home before
     # the controller reads or sends a credential. Binary presence is insufficient.
     with tempfile.TemporaryDirectory(prefix='probe-', dir=root) as directory:
@@ -93,7 +105,7 @@ def probe(root, payload):
         os.chmod(home / 'auth.json', 0o600)
         (home / 'sessions').mkdir()
         command, env = isolation_probe_command(payload, home, dict(os.environ))
-        result = subprocess.run(command, env=env, stdin=subprocess.DEVNULL,
+        result = subprocess.run(command, env=env, input=b'"probe-only"\n' if payload.get('provider') == 'claude' else b'',
                                 capture_output=True, timeout=20)
         if result.returncode:
             raise RuntimeError('Remote workspace isolation unavailable')
@@ -102,14 +114,21 @@ def probe(root, payload):
 
 
 def main():
-    root = storage()
     payload = json.loads(sys.stdin.buffer.readline())
+    if payload.get('provider') == 'ollama':
+        namespace = {'__name__': 'cdx_ollama_remote'}
+        exec(compile(OLLAMA_SOURCE, 'ollama_remote.py', 'exec'), namespace)
+        return namespace['run'](payload, SANDBOX_SOURCE, probe=sys.argv[-1] == 'probe')
+    root = storage()
     if sys.argv[-1] == 'probe':
         return probe(root, payload)
-    auth = payload['auth']
-    if auth['tokens'].get('refresh_token') != '':
+    provider = payload.get('provider', 'codex')
+    agy = provider == 'antigravity'
+    claude = provider == 'claude'
+    auth = payload.get('auth')
+    if not (claude or agy) and auth['tokens'].get('refresh_token') != '':
         raise RuntimeError('Refusing a rotating remote credential')
-    if version() != payload['version']:
+    if version(provider) != payload['version']:
         raise RuntimeError('Remote Codex CLI version mismatch')
     child = None
     stopped = threading.Event()
@@ -135,40 +154,70 @@ def main():
     signal.signal(signal.SIGHUP, stop)
     signal.signal(signal.SIGINT, stop)
     home, live = allocate(root)
+    auth_context = ExitStack()
     try:
         if stopped.is_set():
             return 130
         os.umask(0o077)
-        (home / 'auth.json').write_text(json.dumps(auth))
-        os.chmod(home / 'auth.json', 0o600)
-        (home / 'config.toml').write_text('cli_auth_credentials_store = "file"\n' + payload['config'])
-        env = {key: value for key, value in os.environ.items()
-               if key not in ('OPENAI_API_KEY', 'OPENAI_ACCESS_TOKEN', 'CODEX_ACCESS_TOKEN', 'CODEX_API_KEY', 'CODEX_HOME')}
-        env['CODEX_HOME'] = str(home)
-        command = ['codex', *payload['args']]
-        if payload.get('isolate_workspace'):
-            (home / 'sessions').mkdir(mode=0o700)
-            args = payload['args'][:]
-            while '-s' in args:
-                index = args.index('-s')
-                del args[index:index + 2]
-            if '--dangerously-bypass-approvals-and-sandbox' not in args:
-                index = args.index('--') if '--' in args else len(args)
-                args[index:index] = ['--dangerously-bypass-approvals-and-sandbox']
+        if agy:
+            namespace = {'__name__': 'cdx_workspace_sandbox'}
+            exec(compile(SANDBOX_SOURCE, 'workspace_sandbox.py', 'exec'), namespace)
+            try:
+                attempt_home = auth_context.enter_context(namespace['antigravity_attempt'](home))
+            except RuntimeError as error:
+                print(str(error), file=sys.stderr)
+                return 121 if 'busy' in str(error) else 120
+            command, env = namespace['sandbox_command'](
+                ['agy', *payload['args']], pathlib.Path(payload['cwd']), network=False,
+                writable=payload['writable'], source=dict(os.environ), provider='antigravity',
+                observation_home=attempt_home)
+        elif claude:
+            claude_home = home / 'claude-home'
+            claude_home.mkdir(mode=0o700)
+            if not payload.get('isolate_workspace') or '--bare' in payload['args']:
+                raise RuntimeError('Remote Claude requires isolated OAuth execution')
             namespace = {'__name__': 'cdx_workspace_sandbox'}
             exec(compile(SANDBOX_SOURCE, 'workspace_sandbox.py', 'exec'), namespace)
             command, env = namespace['sandbox_command'](
-                ['codex', *args], pathlib.Path(payload['cwd']), network=payload['network'],
-                writable=payload['writable'], source=env, auth_home=str(home), provider='codex',
-                observation_home=str(home / 'sessions'))
+                ['claude', *payload['args']], pathlib.Path(payload['cwd']), network=payload['network'],
+                writable=payload['writable'], source=dict(os.environ), provider='claude',
+                observation_home=str(claude_home), claude_token_stdin=True)
+        else:
+            (home / 'auth.json').write_text(json.dumps(auth))
+            os.chmod(home / 'auth.json', 0o600)
+            (home / 'config.toml').write_text('cli_auth_credentials_store = "file"\n' + payload['config'])
+            env = {key: value for key, value in os.environ.items()
+                   if key not in ('OPENAI_API_KEY', 'OPENAI_ACCESS_TOKEN', 'CODEX_ACCESS_TOKEN', 'CODEX_API_KEY', 'CODEX_HOME')}
+            env['CODEX_HOME'] = str(home)
+            command = ['codex', *payload['args']]
+            if payload.get('isolate_workspace'):
+                (home / 'sessions').mkdir(mode=0o700)
+                args = payload['args'][:]
+                while '-s' in args:
+                    index = args.index('-s')
+                    del args[index:index + 2]
+                if '--dangerously-bypass-approvals-and-sandbox' not in args:
+                    index = args.index('--') if '--' in args else len(args)
+                    args[index:index] = ['--dangerously-bypass-approvals-and-sandbox']
+                namespace = {'__name__': 'cdx_workspace_sandbox'}
+                exec(compile(SANDBOX_SOURCE, 'workspace_sandbox.py', 'exec'), namespace)
+                command, env = namespace['sandbox_command'](
+                    ['codex', *args], pathlib.Path(payload['cwd']), network=payload['network'],
+                    writable=payload['writable'], source=env, auth_home=str(home), provider='codex',
+                    observation_home=str(home / 'sessions'))
         started_at = datetime.now(timezone.utc).isoformat()
         child = subprocess.Popen(command, cwd=payload['cwd'], env=env,
-                                 stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                                 stdin=subprocess.PIPE if claude else subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                                  start_new_session=True)
+        if claude:
+            child.stdin.write(json.dumps(payload['token']).encode() + b'\n')
+            child.stdin.close()
         if stopped.is_set():
             stop()
         threading.Thread(target=disconnected, daemon=True).start()
-        secrets = [value for value in auth['tokens'].values() if isinstance(value, str) and value]
+        secrets = (namespace['antigravity_secrets']() if agy else
+                   [payload['token']] if claude else
+                   [value for value in auth['tokens'].values() if isinstance(value, str) and value])
 
         output_lock = threading.Lock()
         usage_reader, observation_reader = observation_runtime()
@@ -176,6 +225,8 @@ def main():
         stdout_path.touch(mode=0o600)
 
         def snapshot():
+            if claude or agy:
+                return
             # Read the same exact-thread evidence as the local supervisor before
             # volatile storage is removed. Only normalized metadata is exported.
             with output_lock:
@@ -229,7 +280,7 @@ def main():
         for thread in threads:
             thread.join()
         snapshot()
-        if time.time() >= payload['expires_at']:
+        if time.time() >= payload.get('expires_at', float('inf')):
             print('Remote temporary credential expired; start a new run from the controller.', file=sys.stderr)
             return 123
         return 130 if stopped.is_set() else result
@@ -237,6 +288,7 @@ def main():
         stop()
         shutil.rmtree(home)
         live.close()
+        auth_context.close()
 
 
 if __name__ == '__main__':
@@ -244,5 +296,5 @@ if __name__ == '__main__':
         sys.exit(main())
     except Exception:
         # Never render exception values: input and provider errors may contain credentials.
-        print('Remote worker setup or execution failed; check Python, Codex, cwd, /dev/shm and isolation dependencies.', file=sys.stderr)
+        print('Remote worker setup or execution failed; check Python, provider CLI, cwd, /dev/shm and isolation dependencies.', file=sys.stderr)
         sys.exit(126)

package/src/run_command.py

@@ -4,6 +4,7 @@ import sys
 from .cli_args import ARG_CODE_INVALID_VALUE
 from .errors import CdxArgumentError, CdxError
 from .provider_runtime import headless_permission_disables_network
+from .run_registry import final_message
 from .run_usage import cost_fields, empty_usage, estimate_cost, extract_run_observation
 
 PROMPT_STDIN = "-"
@@ -169,6 +170,9 @@ def run_launch_payload(api_schema_version, parsed, session, artifacts, cwd=None,
         "ok": True,
         "action": "run",
         "launcher": "cdx",
+        **({"execution_mode": "text_generation",
+            "execution_note": "Ollama generates text only; it is not an autonomous coding agent and does not edit the repository."}
+           if parsed.get("remote") and session and session.get("provider") == "ollama" else {}),
         **({"remote": parsed["remote"]} if parsed.get("remote") else {}),
         "project": parsed.get("project"),
         "project_source": parsed.get("project_source", "unknown"),
@@ -222,6 +226,9 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "ok": bool(ok),
         "action": "run",
         "launcher": "cdx",
+        **({"execution_mode": "text_generation",
+            "execution_note": "Ollama generates text only; it is not an autonomous coding agent and does not edit the repository."}
+           if parsed.get("remote") and session and session.get("provider") == "ollama" else {}),
         **({"remote": parsed["remote"]} if parsed.get("remote") else {}),
         "project": parsed.get("project"),
         "project_source": parsed.get("project_source", "unknown"),
@@ -242,6 +249,8 @@ def run_result_payload(api_schema_version, ok, parsed, session, run_info=None,
         "transcript_path": run_info.get("transcript_path"),
         "stdout_path": run_info.get("stdout_path"),
         "stderr_path": run_info.get("stderr_path"),
+        **({"result": final_message({"artifacts": run_info})}
+           if parsed.get("remote") and session and session.get("provider") == "ollama" else {}),
         "usage": usage,
         "usage_model": usage_model,
         "usage_models": run_info.get("usage_models", [usage_model] if usage_model else []),

package/src/run_registry.py

@@ -462,6 +462,11 @@ def _record_final_message(record):
     """The final assistant text one provider record carries, or None."""
     if not isinstance(record, dict):
         return None
+    if record.get("status") == "SUCCESS" and isinstance(record.get("response"), str):
+        return record["response"]
+    message = record.get("message")
+    if record.get("done") is True and isinstance(message, dict) and isinstance(message.get("content"), str):
+        return message["content"]
     # Claude: `--output-format json` ends with a `result` envelope.
     if record.get("type") == "result" and isinstance(record.get("result"), str):
         return record["result"]