devlyn-cli 4.3.16 → 4.3.20

package/README.md

@@ -86,6 +86,25 @@ The orchestrator is the CLI you opened (Claude Code, Codex, omp, Pi or Grok); th
 
 `/devlyn-engines` with no arguments shows the executor and the engines detected on this machine; `executor <name>` pins one and `clear` removes the pin. A pin is a promise: an unavailable pinned engine stops dispatch with `BLOCKED:<engine>-unavailable`, and a name with no executor-eligible `_shared/adapters/<name>.md` stops with `BLOCKED:invalid-engine-config`. Adapters ship with devlyn-cli releases; a reinstall replaces `_shared`.
 
+Unattended children disable owner-desktop and account drivers: every monitored
+Codex child and every `claude` drain executor (including `.exe`/`.cmd`/`.bat`)
+uses a launch-only policy. Wrapped Claude launches (such as `env … claude` or
+`node …/claude-code/cli.js`) and ambiguous `node …/cli.js` wrappers are refused;
+invoke Claude directly as argv[0]. A shell command or script that starts an engine
+itself (for example `sh -c '…'`) is not inspected.
+Other engines have no tool guard. Interactive sessions and user settings files stay
+unchanged. Add your own server denies in `~/.devlyn/unattended-tools.json`, for
+example `{"codex":["my-desktop"],"claude":["my.server"]}`; omitted keys mean no
+extra denies, and an absent file means defaults only. Malformed files refuse
+the launch. Codex only overrides names returned by its MCP list, verifies they
+are disabled, and refuses denied names outside ASCII letters, digits, `_` and `-`.
+Claude uses `--disallowedTools=mcp__<server>`: replace each character outside ASCII letters,
+digits, `_` and `-` with `_` (`my.server` → `my_server`); `claude.ai ` names also
+collapse and trim underscores, matching Claude's namespace normalization.
+See [Claude's MCP permission rules](https://code.claude.com/docs/en/permissions#mcp).
+Remote URLs are not denied by default, so workers keep remote memory MCP.
+An account server you never list remains available.
+
 ### Migration from earlier versions
 
 Reinstall with the new version to refresh instructions and skills for the selected

package/bin/skill-history.json

@@ -13,6 +13,7 @@
       "0b5c3f72d18f8eea538bfef7192b207ff5cbac25c7e0d2ce080cc725bfdaa2e2",
       "0f397a4edd6b1b3063d27f6205dc6b3d069fa616624bccf661539b174535fc7e",
       "110005e3c7052d35502186d907b169c9fc7c85d558ab7c7ad0ba2f0308aa7a5d",
+      "11ac38b21ecc139211af1b335bb3acc4f0f1bc4b5c133e81a80cafebcaaca298",
       "135f09d5382b4d375204bba3ff6fb3f6fdc34a1ec89fe88542da02d12dda0f0d",
       "1504c7a41e5f4a3206288d05e66fb48847222864f7825f05633883e2c562ec77",
       "161cb4f1b27a9f81ae1e96af6ff596399c8936578a11d601108a89cbdeea241d",
@@ -27,6 +28,7 @@
       "2692865ee864aebedb2b385384b2a8220bc780bd92310bc1cf2f56927de1e0b8",
       "27d4da7863ed4652187f6a101da0e56b1d3d18e4565c720d5f8150ad0a193402",
       "2a4361bca0a9fadc4a8e5e4578c383171cd64c65296fe882990502250df44d53",
+      "2aa0153b91573dc82ac7d21f1431862258334da30b52403434213cb0933ac38c",
       "2bcac1ab5995e474c7dd46705413982876384d8b4da704126a66c10770a1a4d2",
       "2bcae17ca31adaf306d1e5d21ad0c211bbd6f57605f68168f656e078dbf524e2",
       "326a71c447fe4d98f3460eda3fc541920b7cc2205b8288743e8622d90215a49d",
@@ -48,6 +50,7 @@
       "3e39fbe29d0bd607f4ad940f4ca40f9abf82d468e418d0362fb0fd4fa6812475",
       "3e5135877e733f1dcff3b747444228f5eece7cb047956c87a3af02a485cfaad9",
       "3feb469793d0101c2cd939684a9fcdebd333d0532c68455f0f2df33c4b312bfc",
+      "3ffbcb95d487c8847f0fc70524656280c416abcf85a227b1f59602c21807a2fd",
       "406b982f6ca0b9f5c0faa6cb50749b52aaf23545e06174ec39f831929dc929bd",
       "40f50f3c3c0d030d1efeb6955c0c6f32f518e737d8dd3bec6610ff02badebbdb",
       "430d156eb8c62c7edba3d660050f90b267f928976c3a3688e95d54f00dc34747",
@@ -142,6 +145,7 @@
       "c3a37f7502b5e2d7108845907520cf6fef2ebcd70dd59d75f42cbf5bf5f21fbe",
       "c5d2130bb864db373d36878b96dd974fee4d64b3bf3455cc722b4f6787b44c3c",
       "c86770d97e721fa796925cbd64544955c8d6f88fbb696069bbf1cf74e5e907cb",
+      "c99a7702f5f5ee88fd8bb78067d23977e5f0f77e48fec3b0c67b8c5a09eb8d11",
       "ca5af169c57dff8d038b99376a7b984a220102c43406ccdef79c9d1eadbce6fb",
       "cf13e851d0ee9b8f2f0bb44765b1e87eaec4c22a0f10aad8ad42c597c8fc0cf9",
       "d023806548fe634679cee0d31639a272e6404398415c3ac72fcfa66f924d8d00",
@@ -161,6 +165,7 @@
       "de4f504265e960cb8d81752e9ae922f664790ee026b4454f1b07252d1a6282a4",
       "e0a305cf3bf47c8bc357195d4d50b0f6177069e870c33040c258c93edae68646",
       "e115205a744fef918a59d1b3a601df09a8b6df1d3e60613b9e8b87240929f8d8",
+      "e19204055bb16fff4263f95fac092ee8f971ee9055b7a969497e5714782a454c",
       "e41013abf5e17445ef83a86974ac1de77beaa61e484e1916577ecc64bb34c220",
       "e725ec4eca42f737ee4bdaceb10c11db289414a1d4bb8be8fe103f89c89f07d5",
       "e812d02ebdbdb8d82eb85842d676e21bedddb0d00154eed99b9d29b43cb8fc02",
@@ -324,6 +329,7 @@
       "0122885c08069474ca4a0a5825f885364a62938885f0e501c09242d176c34b08",
       "05e824f63a6381e02042afb1df0f1437584e25a80de8e9db0bd9456aaeb7aab8",
       "0601ee535419b7039d5da34bd9c8e1c2b3631307214e4afaf394dd47494090c7",
+      "062fde2838c0edc0c20e6716948a2ae9fe9d8a98b01a8e8c544c5801641c7cdb",
       "0cef055580e00f9ed439eacb2dff9d238bb11619457472016095a8915162fa4b",
       "0dc69c20434966015176d83baa6f95b3421f9e13d0b1bd608a22f0560eae1049",
       "0fe9b270d670f70da9d2535969b6117684b7c1517806b3029ebaf9624da8006c",
@@ -344,6 +350,7 @@
       "65770e3f20c3a3afd2822e9acdcfc80b827f84a7737010b79332da70d431b05d",
       "65c781764633b912e5947362eba0837c8027461a904975401d79ad4fe8714084",
       "694c8920e50d92cba46dbb27eb44dd88035a89ed625d3cbf9f2bce9366d44c96",
+      "6b3143bcfe9c60a76f142d533177d85d36f856a163a226351317ed688738c05a",
       "6b403afbf5a117cc08603d3648b9dded4f9ac4ca02fc1d8e1f0035615148bb5c",
       "6c3e2e4b84b0b4f81aed3759704da7c14f3cbabf3beeb0d1654feda3a15a8675",
       "6d9df58c117165e9d297aa6be0df8d076bac1ed49dc29ae93906af1969798ab1",
@@ -362,6 +369,7 @@
       "aba66b674683935e4c28c93333896dc116ffe67e7a35fe30b3599a8be507e94e",
       "b2e4437fa981317362d03ee032e1cfd8b686316e966c6ba12ecd619a009c80a6",
       "bdd0751eea04532c050334fda3bc5c61c6b429e485d97e0b8ebb4fae154da2c7",
+      "bf302e48c189813849849563a117b412cecb627323e8af7c12dc729ea3e6e4cd",
       "c1b8e3ebf38e2be8972aa003e9614a782cb4f195c69d20b95a475ebf9aaaab9e",
       "c8e375aab574148542f392b093cbbf3f2e8dc623826b45e35df0a1a2c3862226",
       "ce282a55328c2d071cacc377670fbebea4da4b9a7fee81b25293fb26763f17c9",
@@ -774,7 +782,11 @@
     "4.3.14",
     "4.3.15",
     "4.3.16",
+    "4.3.17",
+    "4.3.18",
+    "4.3.19",
     "4.3.2",
+    "4.3.20",
     "4.3.3",
     "4.3.4",
     "4.3.5",

package/config/skills/_shared/adapters/claude.md

@@ -7,6 +7,21 @@ A Claude executor starts as
 where `<common git dir>` is `git rev-parse --path-format=absolute --git-common-dir`:
 a linked task worktree commits there.
 
+For drain children, `queue.py` adds `--no-chrome` and a temporary `--settings`
+file (0600), sets `ENABLE_CLAUDEAI_MCP_SERVERS=false`, disables plugin sync and
+every enabled plugin (including synced plugins), and verifies the overrides
+before spawning. Discovery or verification failure refuses the launch. Normal
+user settings, including `BASH_MAX_TIMEOUT_MS`, remain loaded; interactive and
+non-drain Claude invocations are unchanged.
+The launch settings also force `env.ENABLE_CLAUDEAI_MCP_SERVERS="false"` and
+`disableClaudeAiConnectors=true` (recognized by Claude 2.1.314). Policy options
+precede all caller arguments; server denies use `--disallowedTools=<list>`.
+Drain refuses caller `--settings`, `--setting-sources`, `--plugin-dir` and
+`--plugin-url` or `--chrome` tokens (including `=<value>` forms), and `--add-dir` directories
+whose `.claude/settings.json` or `settings.local.json` contains `enabledPlugins`.
+Wrapped Claude executors must be replaced with a direct Claude argv; a shell
+command or script that starts Claude itself is not inspected.
+
 **Availability probe**: `command -v claude >/dev/null 2>&1`; record
 `claude --version` as evidence. The probe is necessary, not sufficient:
 `claude -p` needs network access to the Anthropic API, so in a network-denying

package/config/skills/_shared/adapters/codex.md

@@ -12,3 +12,13 @@ denies network, which installing a new dependency needs:
 `-s workspace-write -c 'sandbox_workspace_write.writable_roots=["<git dir>","<worktree git dir>"]' -c 'sandbox_workspace_write.network_access=true'`.
 Deliver a multiline prompt as exact file bytes: set `DEVLYN_CODEX_PROMPT_FILE=<file>`
 and pass the sole prompt argument `-`.
+
+Every monitored child applies `_shared/unattended-tools.py` before recording its
+effective argv: account/plugin and browser/computer features are disabled, then
+listed desktop servers are disabled. Policy switches precede all exec arguments;
+feature states and MCP overrides are read back before launch. A still-enabled
+target, malformed output or discovery failure refuses the launch; an unsupported feature error names the installed Codex version.
+Interactive Codex and user configuration files are unchanged.
+If an exec-only configuration option (such as `--ignore-user-config` on Codex
+0.164.0) cannot be applied to `mcp list`, discovery refuses the launch; it never
+falls back to listing a different configuration.

package/config/skills/_shared/invocation-receipt.py

@@ -92,13 +92,16 @@ def file_prompt_args(argv):
         raise TransportError("file transport requires the sole prompt argument '-'; competing prompts are forbidden")
 
 
-def prepare_transport(prompt_path, command, argv, seconds):
-    path = pathlib.Path(prompt_path).resolve(strict=True)
-    with PLATFORM["open_stdin"](path) as source:
-        raw = source.read()
+def prepare_transport(prompt_path, seconds):
+    try:
+        path = pathlib.Path(prompt_path).resolve(strict=True)
+        with PLATFORM["open_stdin"](path) as source:
+            raw = source.read()
+    except (OSError, ValueError) as exc:
+        raise TransportError(f"DEVLYN_CODEX_PROMPT_FILE is not a readable prompt file: {prompt_path}") from exc
     record = {"schema_version": 1, "transport": "stdin-file",
               "prompt": {"path": str(path), "sha256": sha256(raw), "bytes": len(raw)},
-              "command": command, "argv": argv, "timeout_sec": seconds,
+              "timeout_sec": seconds,
               "status": "started", "exit_code": None}
     carrier = path.with_name(path.name + ".transport.json")
     if carrier.exists():
@@ -157,6 +160,7 @@ def monitor_descendant_regression() -> None:
         fake_codex = work / "fake-codex"
         fake_codex.write_text(
             f"#!{real_bash}\n"
+            "case \" $* \" in *' features list '*) for f in apps plugins remote_plugin computer_use browser_use browser_use_external in_app_browser; do printf '%s stable false\\n' \"$f\"; done; exit 0;; *' mcp list --json '*) printf '[]\\n'; exit 0;; esac\n"
             "printf '%s\\n' \"$$\" > \"$DEVLYN_WATCHDOG_TEST_CODEX_PID\"\n"
             "while [ ! -e \"$DEVLYN_WATCHDOG_TEST_RELEASE\" ]; do\n"
             "  \"$DEVLYN_WATCHDOG_TEST_REAL_SLEEP\" 0.01\n"
@@ -184,6 +188,7 @@ def monitor_descendant_regression() -> None:
             ):
                 env.pop(key)
         env.update({
+            "HOME": str(work), "USERPROFILE": str(work),
             "CODEX_BIN": str(fake_codex),
             "CODEX_MONITORED_HEARTBEAT": "1",
             "CODEX_MONITORED_TIMEOUT_SEC": "30",
@@ -411,11 +416,173 @@ def monitor_descendant_regression() -> None:
             raise
 
 
+def unattended_tools_regression():
+    with tempfile.TemporaryDirectory() as raw_tmp:
+        work = pathlib.Path(raw_tmp).resolve()
+        fake = work / "codex"
+        fake.write_text(f"#!{sys.executable}\n" + '''
+import json, os, pathlib, re, sys
+a = sys.argv[1:]
+with open("probes.jsonl", "a") as stream:
+    stream.write(json.dumps({"argv": a, "cwd": os.getcwd()}) + "\\n")
+features = "apps plugins remote_plugin computer_use browser_use browser_use_external in_app_browser".split()
+config, disabled = {}, set()
+i = 0
+while i < len(a):
+    token = a[i]
+    if token == "--": break
+    if token.startswith("-c") and not token.startswith("--") and len(token) > 2:
+        key, value = "-c", token[2:].removeprefix("=")
+    else:
+        key, equal, value = token.partition("=")
+        if key in ("-c", "--config", "--disable", "--enable", "-p", "--profile", "-C", "--cd") and not equal:
+            i += 1
+            value = a[i]
+    if key in ("-c", "--config"):
+        name, sep, val = value.partition("=")
+        if not sep: sys.exit("missing config value")
+        if name.startswith('mcp_servers."'): sys.exit("invalid transport in " + name)
+        config[name] = val
+    if key == "--disable": disabled.add(value)
+    i += 1
+if a == ["--version"]:
+    print("codex-fixture 1.2.3")
+elif a[:2] == ["features", "list"]:
+    if os.environ.get("FEATURE_FAIL"):
+        sys.exit("Unknown feature flag: in_app_browser")
+    for f in features:
+        mode = os.environ.get("FEATURE_MODE") if f == "apps" else None
+        if mode == "missing": continue
+        print(f, "under development", "garbled" if mode == "malformed" else str(mode == "sticky" or f not in disabled).lower())
+elif "mcp" in a:
+    assert a[a.index("mcp"):a.index("mcp") + 3] == ["mcp", "list", "--json"], a
+    verify = any(k.endswith(".enabled") for k in config)
+    if os.environ.get("LIST_FAIL") or (verify and os.environ.get("VERIFY_FAIL")):
+        sys.exit("cannot list servers")
+    raw = os.environ.get("VERIFY_SERVERS" if verify else "SERVERS", os.environ.get("SERVERS", '[{"name":"node_repl","enabled":true},{"name":"pyx-memory","enabled":true}]'))
+    try: servers = json.loads(raw)
+    except ValueError:
+        print(raw); sys.exit(0)
+    if isinstance(servers, list) and all(isinstance(s, dict) and "name" in s and isinstance(s.get("enabled"), bool) for s in servers):
+        servers = {s["name"]: s for s in servers}
+        for key in config:
+            match = re.fullmatch(r"mcp_servers\\.([A-Za-z0-9_-]+)\\.command", key)
+            if match:
+                name = match[1]
+                servers.setdefault(name, {"name": name, "enabled": True})
+        for key, val in config.items():
+            match = re.fullmatch(r"mcp_servers\\.([A-Za-z0-9_-]+)\\.(command|enabled)", key)
+            if match:
+                name, field = match.groups()
+                if field == "command": servers.setdefault(name, {"name": name, "enabled": True})
+                elif not os.environ.get("MCP_STICKY"):
+                    if name not in servers: sys.exit("invalid transport")
+                    servers[name]["enabled"] = val == "true"
+        servers = list(servers.values())
+    print(json.dumps(servers))
+else:
+    assert a[0] == "exec" and a[1:15] == [v for f in features for v in ("--disable", f)], a
+    pathlib.Path("seen.json").write_text(json.dumps(a))
+    pathlib.Path("stdin").write_bytes(sys.stdin.buffer.read())
+    sys.exit(int(os.environ.get("EXEC_CODE", "0")))
+''', encoding="utf-8")
+        fake.chmod(0o755)
+        wrapper = pathlib.Path(__file__).resolve().with_name("codex-monitored.sh")
+        env = {k: v for k, v in os.environ.items() if not k.startswith("CODEX_") and k != "DEVLYN_CODEX_PROMPT_FILE"}
+        env.update(HOME=str(work), USERPROFILE=str(work), CODEX_BIN=str(fake))
+        seen = work / "seen.json"
+        deny = work / ".devlyn/unattended-tools.json"
+        deny.parent.mkdir()
+
+        def launch(extra=None, code=0, args=None):
+            seen.unlink(missing_ok=True)
+            with (work / "stdout").open("wb") as stdout, (work / "stderr").open("wb") as stderr:
+                result = subprocess.run(["bash", str(wrapper), *(args or ["hello"])], cwd=work,
+                                        env={**env, **(extra or {})}, stdout=stdout, stderr=stderr, timeout=60)
+            error = (work / "stderr").read_text(encoding="utf-8")
+            assert result.returncode == code, (result.returncode, error)
+            if code == 2:
+                assert not seen.exists(), error
+            return error
+
+        launch(code=7, extra={"EXEC_CODE": "7"})
+        argv = json.loads(seen.read_text())
+        shutdown = [v for f in ("apps", "plugins", "remote_plugin", "computer_use", "browser_use",
+                                "browser_use_external", "in_app_browser") for v in ("--disable", f)]
+        assert argv == ["exec", *shutdown, "-c", "mcp_servers.node_repl.enabled=false", "hello"], argv
+        assert not any("computer-use" in a or "pyx-memory" in a for a in argv)
+        assert (work / "stdin").read_bytes() == b""
+
+        name = "desktop-custom"
+        deny.write_text(json.dumps({"codex": [name, "absent"]}), encoding="utf-8")
+        discovery = work / "project"
+        discovery.mkdir()
+        prompt = work / "prompt.md"
+        prompt.write_bytes(b"exact prompt\nsecond line\n")
+        launch(extra={"CODEX_BIN": "./codex", "SERVERS": json.dumps([{"name": name, "enabled": True}]),
+                      "DEVLYN_CODEX_PROMPT_FILE": str(prompt)},
+               args=["-C", str(discovery), "--config=model_reasoning_effort=high", "--", "-"])
+        argv = json.loads(seen.read_text())
+        assert f"mcp_servers.{name}.enabled=false" in argv, argv
+        assert not any("absent" in a or "node_repl" in a for a in argv)
+        assert argv[-2:] == ["--", "-"] and (work / "stdin").read_bytes() == prompt.read_bytes()
+        receipt = json.loads(prompt.with_name("prompt.md.transport.json").read_text())
+        assert receipt["command"] == ["./codex", *argv] and receipt["status"] == "completed"
+        probes = [json.loads(line) for line in (discovery / "probes.jsonl").read_text().splitlines()]
+        listing = [p for p in probes if "mcp" in p["argv"]][-1]
+        assert listing["cwd"] == str(discovery) and "model_reasoning_effort=high" in listing["argv"], listing
+
+        deny.write_text(json.dumps({"codex": ["desktop.quoted"]}), encoding="utf-8")
+        assert "desktop.quoted" in launch({"SERVERS": '[{"name":"desktop.quoted","enabled":true}]'}, code=2)
+        deny.unlink()
+        # Every accepted spelling reaches discovery, without moving or altering caller argv.
+        for option, value in (("-c", 'mcp_servers.node_repl.command="echo"'), ("--config", 'mcp_servers.node_repl.command="echo"'),
+                              ("-p", "fixture"), ("--profile", "fixture"), ("--enable", "hooks"), ("--disable", "hooks"),
+                              ("-C", str(discovery)), ("--cd", str(discovery))):
+            forms = [[option, value], [option + "=" + value]]
+            if option in {"-c", "-p", "-C"}:
+                forms.append([option + value])
+            for form in forms:
+                for log in (work / "probes.jsonl", discovery / "probes.jsonl"):
+                    log.unlink(missing_ok=True)
+                launch(args=[*form, "--", "prompt"], extra={"SERVERS": '[]'})
+                actual = json.loads(seen.read_text())
+                assert actual[-len(form) - 2:] == [*form, "--", "prompt"], actual
+                directory = discovery if option in {"-C", "--cd"} else work
+                probes = [json.loads(line) for line in (directory / "probes.jsonl").read_text().splitlines()]
+                listings = [p for p in probes if "mcp" in p["argv"]]
+                assert len(listings) == 2, listings
+                for listing in listings:
+                    assert listing["cwd"] == str(directory), listing
+                    if option not in {"-C", "--cd"}:
+                        assert [option, value] in [listing["argv"][i:i + 2] for i in range(len(listing["argv"]) - 1)], listing
+                if option in {"-c", "--config"}:
+                    assert "mcp_servers.node_repl.enabled=false" in actual, actual
+
+        for mode in ("sticky", "missing", "malformed"):
+            assert "Codex feature" in launch({"FEATURE_MODE": mode}, code=2)
+        assert "overrides did not disable" in launch({"MCP_STICKY": "1"}, code=2)
+        assert "overrides did not disable" in launch(args=["-c", "mcp_servers.node_repl.enabled=true", "hello"], code=2)
+        assert "cannot list servers" in launch({"VERIFY_FAIL": "1"}, code=2)
+        assert "malformed Codex mcp list" in launch({"VERIFY_SERVERS": "not json"}, code=2)
+
+        for bad in ('{', '[]', '{"codex": "x"}', '{"claude": [1]}', '{"codex":[],"codex":[]}'):
+            deny.write_text(bad, encoding="utf-8")
+            assert str(deny) in launch(code=2)
+        deny.unlink()
+        assert "codex-fixture 1.2.3" in launch({"FEATURE_FAIL": "1"}, code=2)
+        assert "cannot list servers" in launch({"LIST_FAIL": "1"}, code=2)
+        for bad in ('not json', '{}', '[{}]', '[{"name":"node_repl","enabled":"true"}]'):
+            assert "malformed Codex mcp list" in launch({"SERVERS": bad}, code=2)
+    print("PASS unattended Codex defaults, discovery, receipts and fail-closed refusals")
+
+
 def self_test() -> int:
     monitor_descendant_regression()
     if os.name == "nt":
         print("SKIP POSIX executable-shell wrapper fixture; native npm transport is covered by test-windows-portability.py")
         return 0
+    unattended_tools_regression()
     with tempfile.TemporaryDirectory() as raw_tmp:
         work = pathlib.Path(raw_tmp)
         fake_codex = work / "fake-codex"
@@ -442,17 +609,20 @@ def complete_dispatch(exit_code):
 
 def dispatch_codex(args):
     argv = args.argv[1:] if args.argv[:1] == ["--"] else args.argv
-    command = [args.binary, "exec", *argv]
-    actual = PLATFORM["native_argv"](command)
     prompt = os.environ.get("DEVLYN_CODEX_PROMPT_FILE")
     if prompt == "":
         raise TransportError("DEVLYN_CODEX_PROMPT_FILE must name a readable prompt file")
+    if prompt:
+        file_prompt_args(argv)
     stream, carrier, transport = None, None, None
     try:
         if prompt:
-            file_prompt_args(argv)
-            stream, carrier, transport = prepare_transport(prompt, command, actual, args.timeout)
+            stream, carrier, transport = prepare_transport(prompt, args.timeout)
+        argv = runpy.run_path(str(pathlib.Path(__file__).with_name("unattended-tools.py")))["codex_launch"](args.binary, argv)
+        command = [args.binary, "exec", *argv]
+        actual = PLATFORM["native_argv"](command)
         if transport is not None:
+            transport.update(command=command, argv=actual)
             write_transport(carrier, transport)
         if os.name != "nt":
             if stream is not None:

package/config/skills/_shared/platform-support.py

@@ -6,6 +6,7 @@ import contextlib
 import errno
 import os
 from pathlib import Path
+import platform
 import re
 import shutil
 import signal
@@ -81,7 +82,14 @@ NPM_CLI = re.compile(r'SET "(NP[MX]_CLI_JS)=%~dp0\\([^"\r\n]+)"')
 
 def native_argv(argv, cwd=None):
     """Resolve argv as Windows does, for a command that will run in cwd; a Node command shim runs its Node and script
-    directly, never cmd /c."""
+    directly, never cmd /c; on macOS avoid kernel #! exec, whose process tree keeps kernel memory for each later
+    #! exec until restart."""
+    if sys.platform == "darwin":
+        try:
+            prefix = darwin_script_argv(argv[0], cwd or os.getcwd())
+            return [*prefix, *argv[1:]] if prefix else list(argv)
+        except (OSError, ValueError, TypeError, NotImplementedError, IndexError):
+            return list(argv)  # Preserve CPython's PATH search and errors without a shell fallback.
     if os.name != "nt":
         return list(argv)
     binary = shutil.which(argv[0])
@@ -100,6 +108,99 @@ def native_argv(argv, cwd=None):
     return [node, str(script.resolve(strict=True)), *argv[1:]]
 
 
+def darwin_script_argv(program, cwd):
+    """The argv prefix macOS would build for a safely resolved script with a native interpreter, else None.
+
+    Search with CPython's os.get_exec_path(), including os.defpath when PATH is unset. A CPU-compatible
+    interpreter with an otherwise damaged image fails against the interpreter instead of retrying PATH.
+    The interpreter path is executed as it is at exec time: replacing it requires write access that
+    already lets the writer run code as the user. A set-id replacement owned by another user cannot
+    raise privilege; only root can create root-owned set-id files. Quarantined scripts are declined;
+    other exec-only MAC policies that permit reading but deny executing the script are not consulted.
+    """
+    cpu = {"arm64": 0x0100000c, "x86_64": 0x01000007}.get(platform.machine())
+    if cpu is None:
+        return None
+    subtypes = (0, 1, 2) if cpu == 0x0100000c else (3,)
+    entries = [None] if "/" in program else os.get_exec_path()
+    with contextlib.ExitStack() as handles:
+        try:
+            cwd_fd = os.open(cwd, os.O_RDONLY | os.O_DIRECTORY)
+            handles.callback(os.close, cwd_fd)
+            for entry in entries:
+                if entry is not None and len(os.fsencode(entry)) + len(os.fsencode(program)) + 2 > 1024:
+                    return None
+                candidate = program if entry is None else os.path.join(entry, program)
+                try:
+                    mode = os.stat(candidate, dir_fd=cwd_fd).st_mode
+                except (FileNotFoundError, NotADirectoryError):
+                    continue
+                if not stat.S_ISREG(mode) or not os.access(candidate, os.X_OK, dir_fd=cwd_fd, effective_ids=True):
+                    continue
+                with os.fdopen(os.open(candidate, os.O_RDONLY | os.O_NONBLOCK, dir_fd=cwd_fd), "rb") as stream:
+                    mode = os.fstat(stream.fileno()).st_mode
+                    if not stat.S_ISREG(mode) or mode & (stat.S_ISUID | stat.S_ISGID):
+                        return None
+                    try:
+                        if hasattr(os, "getxattr"):
+                            os.getxattr(stream.fileno(), "com.apple.quarantine")
+                        else:
+                            # CPython exposes os.getxattr on Linux, but macOS needs its native fd API.
+                            import ctypes
+                            getxattr = ctypes.CDLL(None, use_errno=True).fgetxattr
+                            getxattr.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_void_p, ctypes.c_size_t,
+                                                ctypes.c_uint32, ctypes.c_int]
+                            getxattr.restype = ctypes.c_ssize_t
+                            if getxattr(stream.fileno(), b"com.apple.quarantine", None, 0, 0, 0) < 0:
+                                error = ctypes.get_errno()
+                                raise OSError(error, os.strerror(error))
+                    except OSError as exc:
+                        if exc.errno != getattr(errno, "ENOATTR", None):
+                            return None
+                    else:
+                        return None
+                    header = stream.read(512)
+                if not header.startswith(b"#!"):
+                    return None
+                line = re.split(b"[#\n]", header[2:], maxsplit=1)
+                if len(line) != 2:
+                    return None
+                words = re.split(b"[ \t]+", line[0].strip(b" \t"))
+                if b"\0" in line[0] or not words[0].startswith(b"/"):
+                    return None
+                interpreter = os.fsdecode(words[0])
+                mode = os.stat(interpreter).st_mode
+                if (not stat.S_ISREG(mode) or mode & (stat.S_ISUID | stat.S_ISGID)
+                        or not os.access(interpreter, os.X_OK, effective_ids=True)):
+                    return None
+                with open_stdin(interpreter) as stream:
+                    image = stream.read(512)
+                magic = int.from_bytes(image[:4], "big")
+                if magic not in (0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe,
+                                 0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca):
+                    return None
+                order = "little" if magic in (0xcefaedfe, 0xcffaedfe, 0xbebafeca, 0xbfbafeca) else "big"
+                if magic in (0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe):
+                    size = 32 if magic in (0xfeedfacf, 0xcffaedfe) else 28
+                    if (len(image) < size or int.from_bytes(image[4:8], order) != cpu
+                            or int.from_bytes(image[8:12], order) & ~0xff000000 not in subtypes):
+                        return None
+                else:
+                    count = int.from_bytes(image[4:8], order)
+                    size = 32 if magic in (0xcafebabf, 0xbfbafeca) else 20
+                    if len(image) < 8 or count > (len(image) - 8) // size:
+                        return None
+                    if not any(int.from_bytes(image[8 + i * size:12 + i * size], order) == cpu
+                               and int.from_bytes(image[12 + i * size:16 + i * size], order) & ~0xff000000 in subtypes
+                               for i in range(count)):
+                        return None
+                return [*map(os.fsdecode, words), candidate]
+        except (OSError, ValueError, TypeError, NotImplementedError):
+            # Preserve the original exec, including PATH retries, whenever inspection is uncertain.
+            return None
+    return None
+
+
 def shim_script(shim, raw, node, cwd=None):
     """The script a Node command shim runs, as cmd.exe would resolve it, else None: the one target of an npm, pnpm
     or corepack cmd-shim that sets no environment, or for Node.js's own npm.cmd and npx.cmd the global prefix's