devlyn-cli 4.3.17 → 4.3.20

package/config/skills/_shared/unattended-tools.py

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""Launch-only tool restrictions for delegated Codex and drain Claude children."""
+from __future__ import annotations
+
+import contextlib
+import json
+import os
+from pathlib import Path
+import re
+import runpy
+import shutil
+import subprocess
+import tempfile
+
+
+PLATFORM = runpy.run_path(str(Path(__file__).with_name("platform-support.py")))
+LOADS = runpy.run_path(str(Path(__file__).with_name("expected-contract.py")))["loads_strict_json"]
+CODEX_FEATURES = ("apps", "plugins", "remote_plugin", "computer_use", "browser_use",
+                  "browser_use_external", "in_app_browser")
+
+
+class PolicyError(ValueError):
+    pass
+
+
+def deny_names(engine):
+    path = Path.home() / ".devlyn/unattended-tools.json"
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return []
+    except (OSError, UnicodeError) as exc:
+        raise PolicyError(f"unattended tools: cannot read {path}: {exc}") from exc
+    try:
+        value = LOADS(raw)
+        if not isinstance(value, dict) or set(value) - {"codex", "claude"}:
+            raise ValueError("expected an object with codex/claude server-name arrays")
+        for names in value.values():
+            if not isinstance(names, list) or any(not isinstance(n, str) or not n.strip() for n in names):
+                raise ValueError("codex/claude must be arrays of nonempty server names")
+        return value.get(engine, [])
+    except ValueError as exc:
+        raise PolicyError(f"unattended tools: invalid {path}: {exc}") from exc
+
+
+def probe(command, cwd, label, env=None):
+    try:
+        result = subprocess.run(command, cwd=cwd, env=env, stdin=subprocess.DEVNULL,
+                                capture_output=True, text=True, encoding="utf-8", timeout=30)
+    except (OSError, UnicodeError, subprocess.TimeoutExpired) as exc:
+        raise PolicyError(f"unattended tools: {label} failed: {exc}") from exc
+    if result.returncode:
+        raise PolicyError(f"unattended tools: {label} exited {result.returncode}: {result.stderr.strip()}")
+    return result.stdout
+
+
+def listed(command, cwd, label, key, env=None):
+    raw = probe(command, cwd, label, env)
+    try:
+        value = LOADS(raw)
+        if not isinstance(value, list) or any(
+            not isinstance(item, dict) or not isinstance(item.get(key), str) or not item[key].strip()
+            or not isinstance(item.get("enabled"), bool) for item in value
+        ):
+            raise ValueError(f"expected an array of objects with {key} and boolean enabled")
+        return value
+    except ValueError as exc:
+        raise PolicyError(f"unattended tools: malformed {label} output: {exc}") from exc
+
+
+def codex_launch(binary, argv):
+    denied = {"node_repl", "computer-use", *deny_names("codex")}
+    resolved = shutil.which(binary)
+    if resolved is None:
+        raise PolicyError(f"unattended tools: Codex executable unavailable: {binary}")
+    native = PLATFORM["native_argv"]([str(Path(resolved).absolute())])
+    cwd, config, profile = Path.cwd(), [], []
+    # Only configuration inputs belong in discovery; prompt/model/output arguments do not.
+    values = {"-c", "--config", "-p", "--profile", "--enable", "--disable", "-C", "--cd",
+              "-m", "--model", "-s", "--sandbox", "-o", "--output-last-message", "--output-schema",
+              "--color", "--add-dir", "-i", "--image", "--local-provider", "--thread-source",
+              "--cyber-access-program"}
+    index = 0
+    while index < len(argv) and argv[index] != "--":
+        token = argv[index]
+        if token[:2] in {"-c", "-C", "-p"} and len(token) > 2:
+            key, equal, value = token[:2], "=", token[2:]
+            if value.startswith("="):
+                value = value[1:]
+        else:
+            key, equal, value = token.partition("=")
+        if key in values:
+            if not equal:
+                index += 1
+                if index == len(argv):
+                    raise PolicyError(f"unattended tools: {key} requires a value")
+                value = argv[index]
+            if key in {"-C", "--cd"}:
+                cwd = Path(value).absolute()
+            elif key in {"-p", "--profile"}:
+                profile.extend([key, value])
+            elif key in {"-c", "--config", "--enable", "--disable"}:
+                config.extend([key, value])
+        elif token in {"--ignore-user-config", "--strict-config"}:
+            config.append(token)
+        index += 1
+    shutdown = [part for feature in CODEX_FEATURES for part in ("--disable", feature)]
+    try:
+        # Codex 0.164 accepts profiles on mcp, but not on features list.
+        raw = probe([*native, "features", "list", *shutdown, *config], cwd, "Codex feature preflight")
+        states = {}
+        for row in raw.splitlines():
+            fields = row.split()
+            if fields and fields[0] in CODEX_FEATURES:
+                if len(fields) < 3 or fields[-1] not in {"true", "false"} or fields[0] in states:
+                    raise PolicyError(f"unattended tools: malformed Codex feature row: {row}")
+                states[fields[0]] = fields[-1]
+        unsafe = [name for name in CODEX_FEATURES if states.get(name) != "false"]
+        if unsafe:
+            raise PolicyError(f"unattended tools: Codex features not disabled: {', '.join(unsafe)}")
+    except PolicyError as exc:
+        version = probe([*native, "--version"], cwd, "Codex version").strip()
+        raise PolicyError(f"{exc} (Codex version: {version})") from exc
+    command = [*native, *profile, "mcp", "list", "--json"]
+    servers = listed([*command, *shutdown, *config], cwd, "Codex mcp list --json", "name")
+    targeted = {s["name"] for s in servers} & denied
+    overrides = []
+    for name in sorted(targeted):
+        if not re.fullmatch(r"[A-Za-z0-9_-]+", name):
+            raise PolicyError(f"unattended tools: cannot safely override Codex server: {name!r}")
+        overrides.extend(["-c", f"mcp_servers.{name}.enabled=false"])
+    # Match launch order: caller overrides come after the policy. Refuse a conflict.
+    verification = listed([*command, *shutdown, *overrides, *config], cwd,
+                          "Codex mcp list --json verification", "name")
+    disabled = {s["name"] for s in verification if not s["enabled"]}
+    unsafe = (targeted - disabled) | {s["name"] for s in verification if s["enabled"] and s["name"] in denied}
+    if unsafe:
+        raise PolicyError(f"unattended tools: Codex MCP overrides did not disable: {', '.join(sorted(unsafe))}")
+    return [*shutdown, *overrides, *argv]
+
+
+def claude_namespace(name):
+    # Claude Code's MCP tool-name normalization preserves ASCII letters, digits, '_' and '-'.
+    normalized = re.sub(r"[^a-zA-Z0-9_-]", "_", name)
+    if name.startswith("claude.ai "):
+        normalized = re.sub(r"_+", "_", normalized).strip("_")
+    return normalized
+
+
+@contextlib.contextmanager
+def claude_launch(argv, cwd):
+    denied = deny_names("claude")
+    native = PLATFORM["native_argv"]([argv[0]], cwd=cwd)
+    # Refuse configuration inputs we cannot verify. Do not consume or rewrite prompt values.
+    for index, token in enumerate(argv[1:], 1):
+        key, equal, value = token.partition("=")
+        if key in {"--settings", "--setting-sources", "--plugin-dir", "--plugin-url", "--chrome"}:
+            raise PolicyError(f"unattended tools: Claude {key} is not supported for drain executors")
+        if key != "--add-dir":
+            continue
+        directories = [value] if equal else []
+        for directory in argv[index + 1:]:
+            if directory.startswith("-"):
+                break
+            directories.append(directory)
+        if not directories:
+            raise PolicyError("unattended tools: Claude --add-dir requires a directory")
+        for directory in directories:
+            for filename in ("settings.json", "settings.local.json"):
+                path = Path(cwd) / Path(directory).expanduser() / ".claude" / filename
+                try:
+                    raw = path.read_text(encoding="utf-8")
+                except FileNotFoundError:
+                    continue
+                except (OSError, UnicodeError) as exc:
+                    raise PolicyError(f"unattended tools: cannot read Claude --add-dir settings {path}: {exc}") from exc
+                try:
+                    settings = LOADS(raw)
+                    if not isinstance(settings, dict):
+                        raise ValueError("expected a settings object")
+                    if "enabledPlugins" in settings:
+                        raise ValueError("enabledPlugins cannot be verified for --add-dir")
+                except ValueError as exc:
+                    raise PolicyError(f"unattended tools: Claude --add-dir settings {path}: {exc}") from exc
+    env = {**os.environ, "ENABLE_CLAUDEAI_MCP_SERVERS": "false"}
+    plugins = listed([*native, "--no-chrome", "plugin", "list", "--json"], cwd, "Claude plugin list --json", "id", env)
+    targeted = {p["id"] for p in plugins if p["enabled"]}
+    # Claude 2.1.314 recognizes disableClaudeAiConnectors; also override settings.env.
+    settings = {"syncClaudeAiPlugins": False, "disableClaudeAiConnectors": True,
+                "env": {"ENABLE_CLAUDEAI_MCP_SERVERS": "false"},
+                "enabledPlugins": dict.fromkeys(sorted(targeted), False)}
+    with tempfile.TemporaryDirectory(prefix="devlyn-unattended-") as temporary:
+        path = Path(temporary) / "settings.json"
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            json.dump(settings, stream, ensure_ascii=False)
+        options = ["--settings", str(path)]
+        if denied:
+            options.append("--disallowedTools=" + ",".join("mcp__" + claude_namespace(n) for n in denied))
+        options.append("--no-chrome")
+        verification = listed([*native, *options, "plugin", "list", "--json"], cwd,
+                              "Claude plugin list --json verification", "id", env)
+        enabled = sorted({p["id"] for p in verification if p["enabled"]})
+        if enabled:
+            raise PolicyError(f"unattended tools: Claude plugin overrides did not disable: {', '.join(enabled)}; check managed settings")
+        yield [argv[0], *options, *argv[1:]], env

package/config/skills/devlyn-ideate/SKILL.md

@@ -110,7 +110,7 @@ Follow [loop.md](references/loop.md). The executor is the configured route, the
 
 | Executor | argv |
 |---|---|
-| Claude | `claude -p "<prompt>" --dangerously-skip-permissions --add-dir "<git dir>"` |
+| Claude | `claude -p "<prompt>" --dangerously-skip-permissions --add-dir "<git dir>"` (drain prepends `--settings <temporary-policy.json> --no-chrome` and any `--disallowedTools=<list>` denies after `claude`) |
 | Codex | `bash "<DEVLYN_SHARED_DIR>/codex-monitored.sh" --skip-git-repo-check -s workspace-write -c 'sandbox_workspace_write.writable_roots=["<git dir>","{worktree_git_dir}"]' -c 'sandbox_workspace_write.network_access=true' "<prompt>"` |
 
 Another engine needs an argv that starts one fresh non-interactive session able, without prompts, to edit, run commands and commit in its task worktree and to write the packet's submission file. `<prompt>` carries the absolute binding values, while `{packet}` stays literal for the drain to fill:

package/config/skills/devlyn-ideate/scripts/acceptance.py

@@ -17,6 +17,7 @@ import hashlib
 import json
 import os
 from pathlib import Path
+import platform
 import re
 import runpy
 import subprocess
@@ -454,7 +455,17 @@ def derive(packet, submission, result):
 
 
 class AcceptanceTests(unittest.TestCase):
+    def macho_header(self):
+        cpu = {"arm64": 0x0100000c, "x86_64": 0x01000007}[platform.machine()]
+        return bytes.fromhex("cffaedfe") + cpu.to_bytes(4, "little") + bytes(24)
+
     def setUp(self):
+        if sys.platform != "darwin" and os.name != "nt":
+            # Darwin argv tests emulate an unquarantined script; Linux has a different xattr namespace.
+            import errno
+            from unittest import mock
+            self.enterContext(mock.patch.object(errno, "ENOATTR", errno.ENODATA, create=True))
+            self.enterContext(mock.patch.object(os, "getxattr", side_effect=OSError(errno.ENOATTR, "attribute absent")))
         self.temp = tempfile.TemporaryDirectory(prefix="devlyn-acceptance ")
         self.addCleanup(self.temp.cleanup)
         self.root = Path(self.temp.name).resolve()
@@ -665,6 +676,300 @@ class AcceptanceTests(unittest.TestCase):
         self.assertNotIn("reused_from", result["commands"][0])
         self.assertEqual(((self.work / ".devlyn/count").read_text(), result["verdict"]), ("2", "ACCEPTED"))
 
+    @unittest.skipIf(os.name == "nt", "requires POSIX executable permissions and paths")
+    def test_darwin_runs_shebang_programs_through_their_interpreter(self):
+        """Prediction: Darwin's 512-byte shebang rules preserve argv and candidate spelling; unsafe rewrites
+        preserve the original command and CPython's PATH search without a shell fallback."""
+        from types import SimpleNamespace
+        from unittest import mock
+        resolve = shared("platform-support")["native_argv"]
+        with tempfile.TemporaryDirectory(prefix="devlyn-shebang-") as temporary, \
+                mock.patch.object(platform, "machine", return_value="arm64"), \
+                mock.patch.dict(resolve.__globals__, {"sys": SimpleNamespace(platform="darwin")}):
+            root = Path(temporary).resolve()
+            interpreter = root / "interpreter"
+            interpreter.write_bytes(self.macho_header()); interpreter.chmod(0o755)
+            p = os.fsencode(interpreter)
+            script = root / "s"
+            cases = [
+                ("1", b"#!" + p + b"\n", []),
+                ("2", b"#!  " + p + b"  a   b\tc  \n", ["a", "b", "c"]),
+                ("3", b"#!" + p + b" a#b c\n", ["a"]),
+                ("4", b"#!" + p + b" a  # c\n", ["a"]),
+                ("5", b"#!" + p + b" #", []),
+                ("6", b"#!" + p + b" a\r\n", ["a\r"]),
+                ("7", b"#!" + p + b"\r\n", None),
+                ("8a", b"#!" + p, None), ("8b", b"#!" + p + b" a", None),
+                ("9a", b"#!   \n", None), ("9b", b"#! #x\n", None),
+                ("10", b"#!" + p + b" a\0b c\n", None),
+                ("11", b"#!interpreter\n", None),
+                ("14", b"#!/usr/bin/env P a b\n", ["/usr/bin/env", "P", "a", "b"]),
+                ("15a", b"#!" + p + b" " * (509 - len(p)) + b"\n", []),
+                ("15b", b"#!" + p + b" " * (510 - len(p)) + b"\n", None),
+                ("17", b"plain text\n", None),
+                ("blank-limit", b"#!" + b" " * 510 + b"\n", None),
+            ]
+            for vector, header, arguments in cases:
+                with self.subTest(vector=vector):
+                    if vector == "14" and sys.platform != "darwin":
+                        self.skipTest("/usr/bin/env is a Mach-O image only on macOS")
+                    script.write_bytes(header); script.chmod(0o755)
+                    expected = [str(script), "X"] if arguments is None else [str(interpreter), *arguments, str(script), "X"]
+                    if vector == "14":
+                        expected = [*arguments, str(script), "X"]
+                    self.assertEqual(resolve([str(script), "X"]), expected)
+
+            script.write_bytes(b"#!" + p + b"\n")
+            for mode, body in ((0o644, b"binary"), (0o755, b"#!/bin/sh\n"), (0o755, b"")):
+                with self.subTest(vector="12/13", mode=mode, body=body):
+                    interpreter.write_bytes(body); interpreter.chmod(mode)
+                    self.assertEqual(resolve([str(script), "X"]), [str(script), "X"])
+            interpreter.write_bytes(self.macho_header()); interpreter.chmod(0o755)
+            for mode in (0o4755, 0o2755, 0o644):
+                with self.subTest(vector="18/17", mode=mode):
+                    script.chmod(mode)
+                    if script.stat().st_mode & 0o7777 != mode:
+                        self.skipTest("filesystem strips set-id bits")
+                    self.assertEqual(resolve([str(script), "X"]), [str(script), "X"])
+            script.chmod(0o755)
+            folder = root / "D"; folder.mkdir()
+            link = root / "link"; link.symlink_to(script)
+            for candidate in (str(root) + "/D/../x//s", str(link), "./s"):
+                with self.subTest(vector="16/23", candidate=candidate):
+                    (root / "x").mkdir(exist_ok=True)
+                    (root / "x/s").write_bytes(script.read_bytes()); (root / "x/s").chmod(0o755)
+                    self.assertEqual(resolve([candidate, "X"], cwd=root), [str(interpreter), candidate, "X"])
+
+            a, b = root / "a", root / "b"
+            a.mkdir(); b.mkdir()
+            second = b / "s"; second.write_bytes(script.read_bytes()); second.chmod(0o755)
+            first = a / "s"; first.mkdir()
+            with mock.patch.dict(os.environ, {"PATH": f"{a}:{b}"}):
+                self.assertEqual(resolve(["s", "X"], cwd=root), [str(interpreter), str(second), "X"])
+                first.rmdir(); first.write_bytes(script.read_bytes()); first.chmod(0o644)
+                self.assertEqual(resolve(["s", "X"], cwd=root), [str(interpreter), str(second), "X"])
+                first.write_bytes(b"#!/missing-interpreter\n"); first.chmod(0o755)
+                self.assertEqual(resolve(["s", "X"], cwd=root), ["s", "X"])  # 19: CPython must retry b/s.
+            for path, candidate in ((f"missing:{b}", str(second)), (f"missing::{b}", "s"), (f":{b}", "s"),
+                                    (f"b:{b}", "b/s")):
+                with self.subTest(vector="21", path=path), mock.patch.dict(os.environ, {"PATH": path}):
+                    self.assertEqual(resolve(["s", "X"], cwd=root), [str(interpreter), candidate, "X"])
+            for entry in ("/" + "x" * 1021, "/" + "é" * 511):
+                with self.subTest(vector="22", entry=entry), mock.patch.dict(os.environ, {"PATH": f"{entry}:{b}"}):
+                    self.assertEqual(resolve(["s", "X"], cwd=root), ["s", "X"])
+            with mock.patch.dict(os.environ, {"PATH": str(b)}), mock.patch.object(os, "getcwd", return_value=str(root)):
+                self.assertEqual(resolve(["./s", "X"]), [str(interpreter), "./s", "X"])
+            with mock.patch.object(os, "getcwd", side_effect=OSError("cwd unavailable")):
+                self.assertEqual(resolve(["s", "X"]), ["s", "X"])
+
+    @unittest.skipIf(os.name == "nt", "requires POSIX executable permissions and paths")
+    def test_darwin_interpreter_eligibility(self):
+        """Prediction: only executable, regular, non-set-id Mach-O interpreters with a native CPU and subtype rewrite;
+        capability bits are ignored, arm64e is accepted, and x86_64h and unknown subtypes are declined."""
+        import shutil
+        import stat
+        from types import SimpleNamespace
+        from unittest import mock
+        helper = shared("platform-support")
+        resolve = helper["native_argv"]
+        prefix = helper["darwin_script_argv"]
+        with tempfile.TemporaryDirectory(prefix="devlyn-interpreter-") as temporary, \
+                mock.patch.object(platform, "machine", return_value="arm64"), \
+                mock.patch.dict(resolve.__globals__, {"sys": SimpleNamespace(platform="darwin")}):
+            root = Path(temporary).resolve()
+            interpreter = root / "interpreter"
+            script = root / "s"
+            script.write_bytes(b"#!" + os.fsencode(interpreter) + b"\n"); script.chmod(0o755)
+            interpreter.mkdir()
+            self.assertIsNone(prefix(str(script), str(root)))
+            interpreter.rmdir()
+            for body in (b"plain text\n", b"", b"#!/bin/sh\n", b"\xcf\xfa\xed", b"\x7fELF"):
+                with self.subTest(body=body):
+                    interpreter.write_bytes(body); interpreter.chmod(0o755)
+                    self.assertIsNone(prefix(str(script), str(root)))
+                    self.assertEqual(resolve([str(script), "X"]), [str(script), "X"])
+            for machine, cpu in (("arm64", 0x0100000c), ("x86_64", 0x01000007)):
+                for magic in ("feedface", "feedfacf", "cefaedfe", "cffaedfe",
+                              "cafebabe", "bebafeca", "cafebabf", "bfbafeca"):
+                    order = "little" if magic in ("cefaedfe", "cffaedfe", "bebafeca", "bfbafeca") else "big"
+                    fat = magic in ("cafebabe", "bebafeca", "cafebabf", "bfbafeca")
+                    if fat:
+                        size = 32 if magic in ("cafebabf", "bfbafeca") else 20
+                    else:
+                        size = 32 if magic in ("feedfacf", "cffaedfe") else 28
+                    for image_cpu, subtype, accepted in ((0x01000007, 0, False), (0x01000007, 3, True), (0x01000007, 8, False),
+                                                         (0x0100000c, 0, True), (0x0100000c, 1, True),
+                                                         (0x0100000c, 0x80000002, True), (0x0100000c, 9, False)):
+                        image = bytes.fromhex(magic)
+                        if fat:
+                            image += (1).to_bytes(4, order)
+                        image += image_cpu.to_bytes(4, order) + subtype.to_bytes(4, order) + bytes(size - (8 if fat else 12))
+                        for truncated in (False, True):
+                            with self.subTest(machine=machine, magic=magic, cpu=image_cpu, subtype=subtype, truncated=truncated), \
+                                    mock.patch.object(platform, "machine", return_value=machine):
+                                interpreter.write_bytes(image[:-1] if truncated else image); interpreter.chmod(0o755)
+                                compatible = cpu == image_cpu and accepted
+                                expected = [str(interpreter), str(script)] if compatible and not truncated else None
+                                self.assertEqual(prefix(str(script), str(root)), expected)
+                                self.assertEqual(resolve([str(script), "X"]), [*expected, "X"] if expected else [str(script), "X"])
+                    if fat:
+                        # A later native slice must also be found in a universal image.
+                        universal = bytes.fromhex(magic) + (2).to_bytes(4, order)
+                        universal += b"".join(value.to_bytes(4, order) + subtype.to_bytes(4, order) + bytes(size - 8)
+                                              for value, subtype in ((0x01000007, 3), (0x0100000c, 0)))
+                        with mock.patch.object(platform, "machine", return_value=machine):
+                            interpreter.write_bytes(universal)
+                            self.assertEqual(prefix(str(script), str(root)), [str(interpreter), str(script)])
+            interpreter.write_bytes(self.macho_header())
+            interpreter.chmod(0o644)
+            self.assertIsNone(prefix(str(script), str(root)))
+            link = root / "link"; link.symlink_to(interpreter)
+            for bit in (stat.S_ISUID, stat.S_ISGID):
+                with self.subTest(set_id=oct(bit)):
+                    interpreter.chmod(0o755 | bit)
+                    if not interpreter.stat().st_mode & bit:
+                        self.skipTest(f"filesystem or sandbox strips interpreter set-id bit {oct(bit)}")
+                    for target in (interpreter, link):
+                        script.write_bytes(b"#!" + os.fsencode(target) + b"\n")
+                        self.assertIsNone(prefix(str(script), str(root)))
+                        self.assertEqual(resolve([str(script), "X"]), [str(script), "X"])
+            for kind in ("copy", "symlink"):
+                with self.subTest(shell=kind):
+                    if sys.platform != "darwin":
+                        self.skipTest("/bin/sh is a Mach-O image only on macOS")
+                    shell = root / kind
+                    if kind == "copy":
+                        shutil.copyfile("/bin/sh", shell); shell.chmod(0o755)
+                    else:
+                        shell.symlink_to("/bin/sh")
+                    script.write_bytes(b"#!" + os.fsencode(shell) + b"\n")
+                    self.assertEqual(prefix(str(script), str(root)), [str(shell), str(script)])
+                    self.assertEqual(resolve([str(script), "X"]), [str(shell), str(script), "X"])
+
+    @unittest.skipIf(os.name == "nt", "requires POSIX executable permissions and paths")
+    def test_darwin_relative_candidates_and_path_errors(self):
+        """Prediction: a cwd join exceeding PATH_MAX still rewrites; directory search errors stop PATH inspection."""
+        import contextlib
+        import errno
+        from types import SimpleNamespace
+        from unittest import mock
+        helper = shared("platform-support")
+        resolve = helper["native_argv"]
+        prefix = helper["darwin_script_argv"]
+        with tempfile.TemporaryDirectory(prefix="devlyn-relative-") as temporary, \
+                mock.patch.object(platform, "machine", return_value="arm64"), \
+                mock.patch.dict(resolve.__globals__, {"sys": SimpleNamespace(platform="darwin")}), \
+                contextlib.ExitStack() as handles:
+            root = Path(temporary).resolve()
+            interpreter = root / "interpreter"
+            interpreter.write_bytes(self.macho_header()); interpreter.chmod(0o755)
+            body = b"#!" + os.fsencode(interpreter) + b"\n"
+            directory = "d" * 100
+            candidate = directory + "/s"
+            cwd = str(root)
+            fd = os.open(cwd, os.O_RDONLY | os.O_DIRECTORY)
+            handles.callback(os.close, fd)
+            for _ in range(10):
+                os.mkdir(directory, dir_fd=fd)
+                child_fd = os.open(directory, os.O_RDONLY | os.O_DIRECTORY, dir_fd=fd)
+                handles.callback(os.close, child_fd)
+                with os.fdopen(os.open("s", os.O_WRONLY | os.O_CREAT, 0o755, dir_fd=child_fd), "wb") as stream:
+                    stream.write(body)
+                with mock.patch.dict(os.environ, {"PATH": directory}):
+                    self.assertEqual(prefix("s", cwd), [str(interpreter), candidate])
+                    self.assertEqual(resolve(["s", "X"], cwd=cwd), [str(interpreter), candidate, "X"])
+                self.assertEqual(prefix("./" + candidate, cwd), [str(interpreter), "./" + candidate])
+                if len(os.fsencode(os.path.join(cwd, candidate))) > 1024:
+                    break
+                cwd = os.path.join(cwd, directory)
+                fd = child_fd
+            else:
+                self.fail("fixture must exceed Darwin PATH_MAX")
+            if sys.platform == "darwin":
+                with self.assertRaises(OSError) as caught:
+                    os.stat(os.path.join(cwd, candidate))
+                self.assertEqual(caught.exception.errno, errno.ENAMETOOLONG)
+
+            blocked = root / "blocked"; blocked.mkdir()
+            first = blocked / "s"; first.write_bytes(body); first.chmod(0o755)
+            second = root / "s"; second.write_bytes(body); second.chmod(0o755)
+            with mock.patch.dict(os.environ, {"PATH": f"{blocked}:{root}"}):
+                self.assertEqual(prefix("s", str(root)), [str(interpreter), str(first)])
+                blocked.chmod(0o600)
+                try:
+                    if os.geteuid() == 0:
+                        self.skipTest("root bypasses directory search permission")
+                    with self.assertRaises(PermissionError):
+                        first.stat()
+                    self.assertIsNone(prefix("s", str(root)))
+                    self.assertEqual(resolve(["s", "X"], cwd=root), ["s", "X"])
+                finally:
+                    blocked.chmod(0o700)
+            # ENAMETOOLONG is not an absent candidate, even if a later PATH entry works.
+            with mock.patch.dict(os.environ, {"PATH": f"{'x' * 256}:{root}"}):
+                self.assertIsNone(prefix("s", str(root)))
+
+    @unittest.skipUnless(sys.platform == "darwin", "requires macOS quarantine attributes")
+    def test_darwin_script_quarantine(self):
+        """Prediction: quarantine presence (including empty values and symlink targets) and xattr errors decline."""
+        import errno
+        from types import SimpleNamespace
+        from unittest import mock
+        helper = shared("platform-support")
+        resolve = helper["native_argv"]
+        prefix = helper["darwin_script_argv"]
+        with tempfile.TemporaryDirectory(prefix="devlyn-quarantine-") as temporary, \
+                mock.patch.object(platform, "machine", return_value="arm64"), \
+                mock.patch.dict(resolve.__globals__, {"sys": SimpleNamespace(platform="darwin")}):
+            root = Path(temporary).resolve()
+            interpreter = root / "interpreter"
+            interpreter.write_bytes(self.macho_header()); interpreter.chmod(0o755)
+            script = root / "s"
+            script.write_bytes(b"#!" + os.fsencode(interpreter) + b"\n"); script.chmod(0o755)
+            link = root / "link"; link.symlink_to(script)
+            for value in (None, "0083;00000000;Test;", ""):
+                if value is not None:
+                    if hasattr(os, "setxattr"):
+                        os.setxattr(script, "com.apple.quarantine", value.encode())
+                    else:
+                        subprocess.run(["/usr/bin/xattr", "-w", "com.apple.quarantine", value, str(script)], check=True)
+                for target in (script, link):
+                    with self.subTest(value=value, target=target.name):
+                        expected = [str(interpreter), str(target)] if value is None else None
+                        self.assertEqual(prefix(str(target), str(root)), expected)
+                        self.assertEqual(resolve([str(target), "X"]), [*expected, "X"] if expected else [str(target), "X"])
+            # Exercise the os.getxattr branch as well, including fail-closed errors.
+            for error in (errno.ENOATTR, errno.EACCES, errno.ENOTSUP, errno.EIO):
+                with self.subTest(error=error), \
+                        mock.patch.object(os, "getxattr", create=True, side_effect=OSError(error, os.strerror(error))):
+                    expected = [str(interpreter), str(script)] if error == errno.ENOATTR else None
+                    self.assertEqual(prefix(str(script), str(root)), expected)
+            with mock.patch.object(os, "getxattr", create=True, return_value=b""):
+                self.assertIsNone(prefix(str(script), str(root)))
+
+    @unittest.skipIf(os.name == "nt", "requires POSIX executable permissions and paths")
+    def test_darwin_path_unset_uses_cpython_default(self):
+        """Prediction: unset PATH searches os.get_exec_path() in order, including os.defpath."""
+        from types import SimpleNamespace
+        from unittest import mock
+        resolve = shared("platform-support")["native_argv"]
+        with tempfile.TemporaryDirectory(prefix="devlyn-default-path-") as temporary, \
+                mock.patch.object(platform, "machine", return_value="arm64"), \
+                mock.patch.dict(resolve.__globals__, {"sys": SimpleNamespace(platform="darwin")}), \
+                mock.patch.dict(os.environ):
+            os.environ.pop("PATH", None)
+            root = Path(temporary).resolve()
+            interpreter = root / "interpreter"
+            interpreter.write_bytes(self.macho_header()); interpreter.chmod(0o755)
+            for name in ("a", "b"):
+                folder = root / name; folder.mkdir()
+                script = folder / "s"
+                script.write_bytes(b"#!" + os.fsencode(interpreter) + b"\n"); script.chmod(0o755)
+            for default in (f"{root}/a:{root}/b", f"{root}/b:{root}/a"):
+                with self.subTest(default=default), mock.patch.object(os, "defpath", default):
+                    candidate = os.path.join(os.get_exec_path()[0], "s")
+                    self.assertEqual(resolve(["s", "X"], cwd=root), [str(interpreter), candidate, "X"])
+
     def test_windows_runs_node_command_shims_without_cmd(self):
         """Windows resolution mocked: verification argv such as ["npm", "test"] runs the Node and script its command
         shim names, as cmd.exe would resolve it; any other batch file is refused with an actionable message."""
@@ -703,7 +1008,8 @@ class AcceptanceTests(unittest.TestCase):
         def npm_prefix(argv, cwd=None, **kwargs):  # what node npm-prefix.js prints, recorded with the directory it ran in
             lookups.append((argv, cwd))
             return SimpleNamespace(stdout=f"{prefix}\n")
-        windows = {"os": SimpleNamespace(name="nt"), "shutil": SimpleNamespace(which=lambda name: str(found[name]) if name in found else None),
+        windows = {"os": SimpleNamespace(name="nt"), "sys": SimpleNamespace(platform="win32"),
+                   "shutil": SimpleNamespace(which=lambda name: str(found[name]) if name in found else None),
                    "subprocess": SimpleNamespace(run=npm_prefix)}
         with mock.patch.dict(platform["native_argv"].__globals__, windows):
             resolve = platform["native_argv"]

package/config/skills/devlyn-ideate/scripts/queue.py

@@ -1243,17 +1243,30 @@ def ensure_submission(identity, packet_path, packet, executor):
     output = Path(packet["evidence_dir"])
     output.mkdir(parents=True, exist_ok=True)
     record(log, "start")
-    try:
-        # Files, never a pipe: a wrapper such as codex-monitored.sh refuses a piped stdout; stdin is empty, never the driver's.
-        with (output / "executor.stdout").open("ab") as stdout, (output / "executor.stderr").open("ab") as stderr:
-            child = subprocess.Popen(shared("platform-support")["native_argv"](argv, cwd=worktree), cwd=worktree, stdin=subprocess.DEVNULL,
-                                     stdout=stdout, stderr=stderr)
-    except OSError as exc:
-        record(log, f"not started: {one_line(str(exc))}")
-        raise LoopError(f"executor could not start: {exc}; restore the configured executable, permissions or task workspace; "
-                        "the next drain retries") from exc
-    progress(identity, f"executing; output in {output}")
-    code = child.wait()
+    with contextlib.ExitStack() as stack:
+        try:
+            env = None
+            claude_names = {"claude", "claude.exe", "claude.cmd", "claude.bat"}
+            if Path(argv[0]).name.lower() in claude_names:
+                argv, env = stack.enter_context(shared("unattended-tools")["claude_launch"](argv, worktree))
+            else:
+                paths = [Path(part.replace("\\", "/")) for part in argv]
+                node_wrapper = any(path.name.lower() in {"node", "node.exe"} for path in paths)
+                for part, path in zip(argv, paths):
+                    if path.name.lower() in claude_names or (path.name.lower() == "cli.js" and
+                            (node_wrapper or any("claude" in parent.lower() for parent in path.parts[:-1]))):
+                        raise ValueError(f"unattended tools: wrapped Claude or ambiguous Node CLI executor {argv[0]!r} via {part!r} is unsupported; "
+                                         "invoke claude directly as argv[0]")
+            # Files, never a pipe: a wrapper such as codex-monitored.sh refuses a piped stdout; stdin is empty, never the driver's.
+            with (output / "executor.stdout").open("ab") as stdout, (output / "executor.stderr").open("ab") as stderr:
+                child = subprocess.Popen(shared("platform-support")["native_argv"](argv, cwd=worktree), cwd=worktree, stdin=subprocess.DEVNULL,
+                                         stdout=stdout, stderr=stderr, env=env)
+        except (OSError, ValueError) as exc:
+            record(log, f"not started: {one_line(str(exc))}")
+            raise LoopError(f"executor could not start: {exc}; restore the configured executable, permissions or task workspace; "
+                            "the next drain retries") from exc
+        progress(identity, f"executing; output in {output}")
+        code = child.wait()
     record(log, f"exit {code} (pid {child.pid})")
     if not submission.exists():
         raise Waiting(f"executor exited {code} without a submission (see {output / 'executor.stderr'}); the next drain runs it again")

package/native/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.17",
+  "version": "4.3.20",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }

package/native/claude/skills/_shared/adapters/claude.md

@@ -7,6 +7,21 @@ A Claude executor starts as
 where `<common git dir>` is `git rev-parse --path-format=absolute --git-common-dir`:
 a linked task worktree commits there.
 
+For drain children, `queue.py` adds `--no-chrome` and a temporary `--settings`
+file (0600), sets `ENABLE_CLAUDEAI_MCP_SERVERS=false`, disables plugin sync and
+every enabled plugin (including synced plugins), and verifies the overrides
+before spawning. Discovery or verification failure refuses the launch. Normal
+user settings, including `BASH_MAX_TIMEOUT_MS`, remain loaded; interactive and
+non-drain Claude invocations are unchanged.
+The launch settings also force `env.ENABLE_CLAUDEAI_MCP_SERVERS="false"` and
+`disableClaudeAiConnectors=true` (recognized by Claude 2.1.314). Policy options
+precede all caller arguments; server denies use `--disallowedTools=<list>`.
+Drain refuses caller `--settings`, `--setting-sources`, `--plugin-dir` and
+`--plugin-url` or `--chrome` tokens (including `=<value>` forms), and `--add-dir` directories
+whose `.claude/settings.json` or `settings.local.json` contains `enabledPlugins`.
+Wrapped Claude executors must be replaced with a direct Claude argv; a shell
+command or script that starts Claude itself is not inspected.
+
 **Availability probe**: `command -v claude >/dev/null 2>&1`; record
 `claude --version` as evidence. The probe is necessary, not sufficient:
 `claude -p` needs network access to the Anthropic API, so in a network-denying

package/native/claude/skills/_shared/adapters/codex.md

@@ -12,3 +12,13 @@ denies network, which installing a new dependency needs:
 `-s workspace-write -c 'sandbox_workspace_write.writable_roots=["<git dir>","<worktree git dir>"]' -c 'sandbox_workspace_write.network_access=true'`.
 Deliver a multiline prompt as exact file bytes: set `DEVLYN_CODEX_PROMPT_FILE=<file>`
 and pass the sole prompt argument `-`.
+
+Every monitored child applies `_shared/unattended-tools.py` before recording its
+effective argv: account/plugin and browser/computer features are disabled, then
+listed desktop servers are disabled. Policy switches precede all exec arguments;
+feature states and MCP overrides are read back before launch. A still-enabled
+target, malformed output or discovery failure refuses the launch; an unsupported feature error names the installed Codex version.
+Interactive Codex and user configuration files are unchanged.
+If an exec-only configuration option (such as `--ignore-user-config` on Codex
+0.164.0) cannot be applied to `mcp list`, discovery refuses the launch; it never
+falls back to listing a different configuration.