devlyn-cli 4.3.17 → 4.3.21

package/native/codex/plugins/devlyn/skills/_shared/invocation-receipt.py

@@ -92,13 +92,16 @@ def file_prompt_args(argv):
         raise TransportError("file transport requires the sole prompt argument '-'; competing prompts are forbidden")
 
 
-def prepare_transport(prompt_path, command, argv, seconds):
-    path = pathlib.Path(prompt_path).resolve(strict=True)
-    with PLATFORM["open_stdin"](path) as source:
-        raw = source.read()
+def prepare_transport(prompt_path, seconds):
+    try:
+        path = pathlib.Path(prompt_path).resolve(strict=True)
+        with PLATFORM["open_stdin"](path) as source:
+            raw = source.read()
+    except (OSError, ValueError) as exc:
+        raise TransportError(f"DEVLYN_CODEX_PROMPT_FILE is not a readable prompt file: {prompt_path}") from exc
     record = {"schema_version": 1, "transport": "stdin-file",
               "prompt": {"path": str(path), "sha256": sha256(raw), "bytes": len(raw)},
-              "command": command, "argv": argv, "timeout_sec": seconds,
+              "timeout_sec": seconds,
               "status": "started", "exit_code": None}
     carrier = path.with_name(path.name + ".transport.json")
     if carrier.exists():
@@ -157,6 +160,7 @@ def monitor_descendant_regression() -> None:
         fake_codex = work / "fake-codex"
         fake_codex.write_text(
             f"#!{real_bash}\n"
+            "case \" $* \" in *' features list '*) for f in apps plugins remote_plugin computer_use browser_use browser_use_external in_app_browser; do printf '%s stable false\\n' \"$f\"; done; exit 0;; *' mcp list --json '*) printf '[]\\n'; exit 0;; esac\n"
             "printf '%s\\n' \"$$\" > \"$DEVLYN_WATCHDOG_TEST_CODEX_PID\"\n"
             "while [ ! -e \"$DEVLYN_WATCHDOG_TEST_RELEASE\" ]; do\n"
             "  \"$DEVLYN_WATCHDOG_TEST_REAL_SLEEP\" 0.01\n"
@@ -184,6 +188,7 @@ def monitor_descendant_regression() -> None:
             ):
                 env.pop(key)
         env.update({
+            "HOME": str(work), "USERPROFILE": str(work),
             "CODEX_BIN": str(fake_codex),
             "CODEX_MONITORED_HEARTBEAT": "1",
             "CODEX_MONITORED_TIMEOUT_SEC": "30",
@@ -411,11 +416,173 @@ def monitor_descendant_regression() -> None:
             raise
 
 
+def unattended_tools_regression():
+    with tempfile.TemporaryDirectory() as raw_tmp:
+        work = pathlib.Path(raw_tmp).resolve()
+        fake = work / "codex"
+        fake.write_text(f"#!{sys.executable}\n" + '''
+import json, os, pathlib, re, sys
+a = sys.argv[1:]
+with open("probes.jsonl", "a") as stream:
+    stream.write(json.dumps({"argv": a, "cwd": os.getcwd()}) + "\\n")
+features = "apps plugins remote_plugin computer_use browser_use browser_use_external in_app_browser".split()
+config, disabled = {}, set()
+i = 0
+while i < len(a):
+    token = a[i]
+    if token == "--": break
+    if token.startswith("-c") and not token.startswith("--") and len(token) > 2:
+        key, value = "-c", token[2:].removeprefix("=")
+    else:
+        key, equal, value = token.partition("=")
+        if key in ("-c", "--config", "--disable", "--enable", "-p", "--profile", "-C", "--cd") and not equal:
+            i += 1
+            value = a[i]
+    if key in ("-c", "--config"):
+        name, sep, val = value.partition("=")
+        if not sep: sys.exit("missing config value")
+        if name.startswith('mcp_servers."'): sys.exit("invalid transport in " + name)
+        config[name] = val
+    if key == "--disable": disabled.add(value)
+    i += 1
+if a == ["--version"]:
+    print("codex-fixture 1.2.3")
+elif a[:2] == ["features", "list"]:
+    if os.environ.get("FEATURE_FAIL"):
+        sys.exit("Unknown feature flag: in_app_browser")
+    for f in features:
+        mode = os.environ.get("FEATURE_MODE") if f == "apps" else None
+        if mode == "missing": continue
+        print(f, "under development", "garbled" if mode == "malformed" else str(mode == "sticky" or f not in disabled).lower())
+elif "mcp" in a:
+    assert a[a.index("mcp"):a.index("mcp") + 3] == ["mcp", "list", "--json"], a
+    verify = any(k.endswith(".enabled") for k in config)
+    if os.environ.get("LIST_FAIL") or (verify and os.environ.get("VERIFY_FAIL")):
+        sys.exit("cannot list servers")
+    raw = os.environ.get("VERIFY_SERVERS" if verify else "SERVERS", os.environ.get("SERVERS", '[{"name":"node_repl","enabled":true},{"name":"pyx-memory","enabled":true}]'))
+    try: servers = json.loads(raw)
+    except ValueError:
+        print(raw); sys.exit(0)
+    if isinstance(servers, list) and all(isinstance(s, dict) and "name" in s and isinstance(s.get("enabled"), bool) for s in servers):
+        servers = {s["name"]: s for s in servers}
+        for key in config:
+            match = re.fullmatch(r"mcp_servers\\.([A-Za-z0-9_-]+)\\.command", key)
+            if match:
+                name = match[1]
+                servers.setdefault(name, {"name": name, "enabled": True})
+        for key, val in config.items():
+            match = re.fullmatch(r"mcp_servers\\.([A-Za-z0-9_-]+)\\.(command|enabled)", key)
+            if match:
+                name, field = match.groups()
+                if field == "command": servers.setdefault(name, {"name": name, "enabled": True})
+                elif not os.environ.get("MCP_STICKY"):
+                    if name not in servers: sys.exit("invalid transport")
+                    servers[name]["enabled"] = val == "true"
+        servers = list(servers.values())
+    print(json.dumps(servers))
+else:
+    assert a[0] == "exec" and a[1:15] == [v for f in features for v in ("--disable", f)], a
+    pathlib.Path("seen.json").write_text(json.dumps(a))
+    pathlib.Path("stdin").write_bytes(sys.stdin.buffer.read())
+    sys.exit(int(os.environ.get("EXEC_CODE", "0")))
+''', encoding="utf-8")
+        fake.chmod(0o755)
+        wrapper = pathlib.Path(__file__).resolve().with_name("codex-monitored.sh")
+        env = {k: v for k, v in os.environ.items() if not k.startswith("CODEX_") and k != "DEVLYN_CODEX_PROMPT_FILE"}
+        env.update(HOME=str(work), USERPROFILE=str(work), CODEX_BIN=str(fake))
+        seen = work / "seen.json"
+        deny = work / ".devlyn/unattended-tools.json"
+        deny.parent.mkdir()
+
+        def launch(extra=None, code=0, args=None):
+            seen.unlink(missing_ok=True)
+            with (work / "stdout").open("wb") as stdout, (work / "stderr").open("wb") as stderr:
+                result = subprocess.run(["bash", str(wrapper), *(args or ["hello"])], cwd=work,
+                                        env={**env, **(extra or {})}, stdout=stdout, stderr=stderr, timeout=60)
+            error = (work / "stderr").read_text(encoding="utf-8")
+            assert result.returncode == code, (result.returncode, error)
+            if code == 2:
+                assert not seen.exists(), error
+            return error
+
+        launch(code=7, extra={"EXEC_CODE": "7"})
+        argv = json.loads(seen.read_text())
+        shutdown = [v for f in ("apps", "plugins", "remote_plugin", "computer_use", "browser_use",
+                                "browser_use_external", "in_app_browser") for v in ("--disable", f)]
+        assert argv == ["exec", *shutdown, "-c", "mcp_servers.node_repl.enabled=false", "hello"], argv
+        assert not any("computer-use" in a or "pyx-memory" in a for a in argv)
+        assert (work / "stdin").read_bytes() == b""
+
+        name = "desktop-custom"
+        deny.write_text(json.dumps({"codex": [name, "absent"]}), encoding="utf-8")
+        discovery = work / "project"
+        discovery.mkdir()
+        prompt = work / "prompt.md"
+        prompt.write_bytes(b"exact prompt\nsecond line\n")
+        launch(extra={"CODEX_BIN": "./codex", "SERVERS": json.dumps([{"name": name, "enabled": True}]),
+                      "DEVLYN_CODEX_PROMPT_FILE": str(prompt)},
+               args=["-C", str(discovery), "--config=model_reasoning_effort=high", "--", "-"])
+        argv = json.loads(seen.read_text())
+        assert f"mcp_servers.{name}.enabled=false" in argv, argv
+        assert not any("absent" in a or "node_repl" in a for a in argv)
+        assert argv[-2:] == ["--", "-"] and (work / "stdin").read_bytes() == prompt.read_bytes()
+        receipt = json.loads(prompt.with_name("prompt.md.transport.json").read_text())
+        assert receipt["command"] == ["./codex", *argv] and receipt["status"] == "completed"
+        probes = [json.loads(line) for line in (discovery / "probes.jsonl").read_text().splitlines()]
+        listing = [p for p in probes if "mcp" in p["argv"]][-1]
+        assert listing["cwd"] == str(discovery) and "model_reasoning_effort=high" in listing["argv"], listing
+
+        deny.write_text(json.dumps({"codex": ["desktop.quoted"]}), encoding="utf-8")
+        assert "desktop.quoted" in launch({"SERVERS": '[{"name":"desktop.quoted","enabled":true}]'}, code=2)
+        deny.unlink()
+        # Every accepted spelling reaches discovery, without moving or altering caller argv.
+        for option, value in (("-c", 'mcp_servers.node_repl.command="echo"'), ("--config", 'mcp_servers.node_repl.command="echo"'),
+                              ("-p", "fixture"), ("--profile", "fixture"), ("--enable", "hooks"), ("--disable", "hooks"),
+                              ("-C", str(discovery)), ("--cd", str(discovery))):
+            forms = [[option, value], [option + "=" + value]]
+            if option in {"-c", "-p", "-C"}:
+                forms.append([option + value])
+            for form in forms:
+                for log in (work / "probes.jsonl", discovery / "probes.jsonl"):
+                    log.unlink(missing_ok=True)
+                launch(args=[*form, "--", "prompt"], extra={"SERVERS": '[]'})
+                actual = json.loads(seen.read_text())
+                assert actual[-len(form) - 2:] == [*form, "--", "prompt"], actual
+                directory = discovery if option in {"-C", "--cd"} else work
+                probes = [json.loads(line) for line in (directory / "probes.jsonl").read_text().splitlines()]
+                listings = [p for p in probes if "mcp" in p["argv"]]
+                assert len(listings) == 2, listings
+                for listing in listings:
+                    assert listing["cwd"] == str(directory), listing
+                    if option not in {"-C", "--cd"}:
+                        assert [option, value] in [listing["argv"][i:i + 2] for i in range(len(listing["argv"]) - 1)], listing
+                if option in {"-c", "--config"}:
+                    assert "mcp_servers.node_repl.enabled=false" in actual, actual
+
+        for mode in ("sticky", "missing", "malformed"):
+            assert "Codex feature" in launch({"FEATURE_MODE": mode}, code=2)
+        assert "overrides did not disable" in launch({"MCP_STICKY": "1"}, code=2)
+        assert "overrides did not disable" in launch(args=["-c", "mcp_servers.node_repl.enabled=true", "hello"], code=2)
+        assert "cannot list servers" in launch({"VERIFY_FAIL": "1"}, code=2)
+        assert "malformed Codex mcp list" in launch({"VERIFY_SERVERS": "not json"}, code=2)
+
+        for bad in ('{', '[]', '{"codex": "x"}', '{"claude": [1]}', '{"codex":[],"codex":[]}'):
+            deny.write_text(bad, encoding="utf-8")
+            assert str(deny) in launch(code=2)
+        deny.unlink()
+        assert "codex-fixture 1.2.3" in launch({"FEATURE_FAIL": "1"}, code=2)
+        assert "cannot list servers" in launch({"LIST_FAIL": "1"}, code=2)
+        for bad in ('not json', '{}', '[{}]', '[{"name":"node_repl","enabled":"true"}]'):
+            assert "malformed Codex mcp list" in launch({"SERVERS": bad}, code=2)
+    print("PASS unattended Codex defaults, discovery, receipts and fail-closed refusals")
+
+
 def self_test() -> int:
     monitor_descendant_regression()
     if os.name == "nt":
         print("SKIP POSIX executable-shell wrapper fixture; native npm transport is covered by test-windows-portability.py")
         return 0
+    unattended_tools_regression()
     with tempfile.TemporaryDirectory() as raw_tmp:
         work = pathlib.Path(raw_tmp)
         fake_codex = work / "fake-codex"
@@ -442,17 +609,20 @@ def complete_dispatch(exit_code):
 
 def dispatch_codex(args):
     argv = args.argv[1:] if args.argv[:1] == ["--"] else args.argv
-    command = [args.binary, "exec", *argv]
-    actual = PLATFORM["native_argv"](command)
     prompt = os.environ.get("DEVLYN_CODEX_PROMPT_FILE")
     if prompt == "":
         raise TransportError("DEVLYN_CODEX_PROMPT_FILE must name a readable prompt file")
+    if prompt:
+        file_prompt_args(argv)
     stream, carrier, transport = None, None, None
     try:
         if prompt:
-            file_prompt_args(argv)
-            stream, carrier, transport = prepare_transport(prompt, command, actual, args.timeout)
+            stream, carrier, transport = prepare_transport(prompt, args.timeout)
+        argv = runpy.run_path(str(pathlib.Path(__file__).with_name("unattended-tools.py")))["codex_launch"](args.binary, argv)
+        command = [args.binary, "exec", *argv]
+        actual = PLATFORM["native_argv"](command)
         if transport is not None:
+            transport.update(command=command, argv=actual)
             write_transport(carrier, transport)
         if os.name != "nt":
             if stream is not None:

package/native/codex/plugins/devlyn/skills/_shared/platform-support.py

@@ -6,6 +6,7 @@ import contextlib
 import errno
 import os
 from pathlib import Path
+import platform
 import re
 import shutil
 import signal
@@ -81,7 +82,14 @@ NPM_CLI = re.compile(r'SET "(NP[MX]_CLI_JS)=%~dp0\\([^"\r\n]+)"')
 
 def native_argv(argv, cwd=None):
     """Resolve argv as Windows does, for a command that will run in cwd; a Node command shim runs its Node and script
-    directly, never cmd /c."""
+    directly, never cmd /c; on macOS avoid kernel #! exec, whose process tree keeps kernel memory for each later
+    #! exec until restart."""
+    if sys.platform == "darwin":
+        try:
+            prefix = darwin_script_argv(argv[0], cwd or os.getcwd())
+            return [*prefix, *argv[1:]] if prefix else list(argv)
+        except (OSError, ValueError, TypeError, NotImplementedError, IndexError):
+            return list(argv)  # Preserve CPython's PATH search and errors without a shell fallback.
     if os.name != "nt":
         return list(argv)
     binary = shutil.which(argv[0])
@@ -100,6 +108,99 @@ def native_argv(argv, cwd=None):
     return [node, str(script.resolve(strict=True)), *argv[1:]]
 
 
+def darwin_script_argv(program, cwd):
+    """The argv prefix macOS would build for a safely resolved script with a native interpreter, else None.
+
+    Search with CPython's os.get_exec_path(), including os.defpath when PATH is unset. A CPU-compatible
+    interpreter with an otherwise damaged image fails against the interpreter instead of retrying PATH.
+    The interpreter path is executed as it is at exec time: replacing it requires write access that
+    already lets the writer run code as the user. A set-id replacement owned by another user cannot
+    raise privilege; only root can create root-owned set-id files. Quarantined scripts are declined;
+    other exec-only MAC policies that permit reading but deny executing the script are not consulted.
+    """
+    cpu = {"arm64": 0x0100000c, "x86_64": 0x01000007}.get(platform.machine())
+    if cpu is None:
+        return None
+    subtypes = (0, 1, 2) if cpu == 0x0100000c else (3,)
+    entries = [None] if "/" in program else os.get_exec_path()
+    with contextlib.ExitStack() as handles:
+        try:
+            cwd_fd = os.open(cwd, os.O_RDONLY | os.O_DIRECTORY)
+            handles.callback(os.close, cwd_fd)
+            for entry in entries:
+                if entry is not None and len(os.fsencode(entry)) + len(os.fsencode(program)) + 2 > 1024:
+                    return None
+                candidate = program if entry is None else os.path.join(entry, program)
+                try:
+                    mode = os.stat(candidate, dir_fd=cwd_fd).st_mode
+                except (FileNotFoundError, NotADirectoryError):
+                    continue
+                if not stat.S_ISREG(mode) or not os.access(candidate, os.X_OK, dir_fd=cwd_fd, effective_ids=True):
+                    continue
+                with os.fdopen(os.open(candidate, os.O_RDONLY | os.O_NONBLOCK, dir_fd=cwd_fd), "rb") as stream:
+                    mode = os.fstat(stream.fileno()).st_mode
+                    if not stat.S_ISREG(mode) or mode & (stat.S_ISUID | stat.S_ISGID):
+                        return None
+                    try:
+                        if hasattr(os, "getxattr"):
+                            os.getxattr(stream.fileno(), "com.apple.quarantine")
+                        else:
+                            # CPython exposes os.getxattr on Linux, but macOS needs its native fd API.
+                            import ctypes
+                            getxattr = ctypes.CDLL(None, use_errno=True).fgetxattr
+                            getxattr.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_void_p, ctypes.c_size_t,
+                                                ctypes.c_uint32, ctypes.c_int]
+                            getxattr.restype = ctypes.c_ssize_t
+                            if getxattr(stream.fileno(), b"com.apple.quarantine", None, 0, 0, 0) < 0:
+                                error = ctypes.get_errno()
+                                raise OSError(error, os.strerror(error))
+                    except OSError as exc:
+                        if exc.errno != getattr(errno, "ENOATTR", None):
+                            return None
+                    else:
+                        return None
+                    header = stream.read(512)
+                if not header.startswith(b"#!"):
+                    return None
+                line = re.split(b"[#\n]", header[2:], maxsplit=1)
+                if len(line) != 2:
+                    return None
+                words = re.split(b"[ \t]+", line[0].strip(b" \t"))
+                if b"\0" in line[0] or not words[0].startswith(b"/"):
+                    return None
+                interpreter = os.fsdecode(words[0])
+                mode = os.stat(interpreter).st_mode
+                if (not stat.S_ISREG(mode) or mode & (stat.S_ISUID | stat.S_ISGID)
+                        or not os.access(interpreter, os.X_OK, effective_ids=True)):
+                    return None
+                with open_stdin(interpreter) as stream:
+                    image = stream.read(512)
+                magic = int.from_bytes(image[:4], "big")
+                if magic not in (0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe,
+                                 0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca):
+                    return None
+                order = "little" if magic in (0xcefaedfe, 0xcffaedfe, 0xbebafeca, 0xbfbafeca) else "big"
+                if magic in (0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe):
+                    size = 32 if magic in (0xfeedfacf, 0xcffaedfe) else 28
+                    if (len(image) < size or int.from_bytes(image[4:8], order) != cpu
+                            or int.from_bytes(image[8:12], order) & ~0xff000000 not in subtypes):
+                        return None
+                else:
+                    count = int.from_bytes(image[4:8], order)
+                    size = 32 if magic in (0xcafebabf, 0xbfbafeca) else 20
+                    if len(image) < 8 or count > (len(image) - 8) // size:
+                        return None
+                    if not any(int.from_bytes(image[8 + i * size:12 + i * size], order) == cpu
+                               and int.from_bytes(image[12 + i * size:16 + i * size], order) & ~0xff000000 in subtypes
+                               for i in range(count)):
+                        return None
+                return [*map(os.fsdecode, words), candidate]
+        except (OSError, ValueError, TypeError, NotImplementedError):
+            # Preserve the original exec, including PATH retries, whenever inspection is uncertain.
+            return None
+    return None
+
+
 def shim_script(shim, raw, node, cwd=None):
     """The script a Node command shim runs, as cmd.exe would resolve it, else None: the one target of an npm, pnpm
     or corepack cmd-shim that sets no environment, or for Node.js's own npm.cmd and npx.cmd the global prefix's

package/native/codex/plugins/devlyn/skills/_shared/runtime-principles.md

@@ -13,7 +13,7 @@ This contract serves one goal: any capable engine — Claude, GPT/Codex, or a fu
 Seven rules govern every change. Cite them by name when a decision touches one.
 
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
-2. **No overengineering** — smallest change that closes the goal. New abstractions require an observed failure mode they prevent. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
+2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
 4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.

package/native/codex/plugins/devlyn/skills/_shared/unattended-tools.py

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""Launch-only tool restrictions for delegated Codex and drain Claude children."""
+from __future__ import annotations
+
+import contextlib
+import json
+import os
+from pathlib import Path
+import re
+import runpy
+import shutil
+import subprocess
+import tempfile
+
+
+PLATFORM = runpy.run_path(str(Path(__file__).with_name("platform-support.py")))
+LOADS = runpy.run_path(str(Path(__file__).with_name("expected-contract.py")))["loads_strict_json"]
+CODEX_FEATURES = ("apps", "plugins", "remote_plugin", "computer_use", "browser_use",
+                  "browser_use_external", "in_app_browser")
+
+
+class PolicyError(ValueError):
+    pass
+
+
+def deny_names(engine):
+    path = Path.home() / ".devlyn/unattended-tools.json"
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return []
+    except (OSError, UnicodeError) as exc:
+        raise PolicyError(f"unattended tools: cannot read {path}: {exc}") from exc
+    try:
+        value = LOADS(raw)
+        if not isinstance(value, dict) or set(value) - {"codex", "claude"}:
+            raise ValueError("expected an object with codex/claude server-name arrays")
+        for names in value.values():
+            if not isinstance(names, list) or any(not isinstance(n, str) or not n.strip() for n in names):
+                raise ValueError("codex/claude must be arrays of nonempty server names")
+        return value.get(engine, [])
+    except ValueError as exc:
+        raise PolicyError(f"unattended tools: invalid {path}: {exc}") from exc
+
+
+def probe(command, cwd, label, env=None):
+    try:
+        result = subprocess.run(command, cwd=cwd, env=env, stdin=subprocess.DEVNULL,
+                                capture_output=True, text=True, encoding="utf-8", timeout=30)
+    except (OSError, UnicodeError, subprocess.TimeoutExpired) as exc:
+        raise PolicyError(f"unattended tools: {label} failed: {exc}") from exc
+    if result.returncode:
+        raise PolicyError(f"unattended tools: {label} exited {result.returncode}: {result.stderr.strip()}")
+    return result.stdout
+
+
+def listed(command, cwd, label, key, env=None):
+    raw = probe(command, cwd, label, env)
+    try:
+        value = LOADS(raw)
+        if not isinstance(value, list) or any(
+            not isinstance(item, dict) or not isinstance(item.get(key), str) or not item[key].strip()
+            or not isinstance(item.get("enabled"), bool) for item in value
+        ):
+            raise ValueError(f"expected an array of objects with {key} and boolean enabled")
+        return value
+    except ValueError as exc:
+        raise PolicyError(f"unattended tools: malformed {label} output: {exc}") from exc
+
+
+def codex_launch(binary, argv):
+    denied = {"node_repl", "computer-use", *deny_names("codex")}
+    resolved = shutil.which(binary)
+    if resolved is None:
+        raise PolicyError(f"unattended tools: Codex executable unavailable: {binary}")
+    native = PLATFORM["native_argv"]([str(Path(resolved).absolute())])
+    cwd, config, profile = Path.cwd(), [], []
+    # Only configuration inputs belong in discovery; prompt/model/output arguments do not.
+    values = {"-c", "--config", "-p", "--profile", "--enable", "--disable", "-C", "--cd",
+              "-m", "--model", "-s", "--sandbox", "-o", "--output-last-message", "--output-schema",
+              "--color", "--add-dir", "-i", "--image", "--local-provider", "--thread-source",
+              "--cyber-access-program"}
+    index = 0
+    while index < len(argv) and argv[index] != "--":
+        token = argv[index]
+        if token[:2] in {"-c", "-C", "-p"} and len(token) > 2:
+            key, equal, value = token[:2], "=", token[2:]
+            if value.startswith("="):
+                value = value[1:]
+        else:
+            key, equal, value = token.partition("=")
+        if key in values:
+            if not equal:
+                index += 1
+                if index == len(argv):
+                    raise PolicyError(f"unattended tools: {key} requires a value")
+                value = argv[index]
+            if key in {"-C", "--cd"}:
+                cwd = Path(value).absolute()
+            elif key in {"-p", "--profile"}:
+                profile.extend([key, value])
+            elif key in {"-c", "--config", "--enable", "--disable"}:
+                config.extend([key, value])
+        elif token in {"--ignore-user-config", "--strict-config"}:
+            config.append(token)
+        index += 1
+    shutdown = [part for feature in CODEX_FEATURES for part in ("--disable", feature)]
+    try:
+        # Codex 0.164 accepts profiles on mcp, but not on features list.
+        raw = probe([*native, "features", "list", *shutdown, *config], cwd, "Codex feature preflight")
+        states = {}
+        for row in raw.splitlines():
+            fields = row.split()
+            if fields and fields[0] in CODEX_FEATURES:
+                if len(fields) < 3 or fields[-1] not in {"true", "false"} or fields[0] in states:
+                    raise PolicyError(f"unattended tools: malformed Codex feature row: {row}")
+                states[fields[0]] = fields[-1]
+        unsafe = [name for name in CODEX_FEATURES if states.get(name) != "false"]
+        if unsafe:
+            raise PolicyError(f"unattended tools: Codex features not disabled: {', '.join(unsafe)}")
+    except PolicyError as exc:
+        version = probe([*native, "--version"], cwd, "Codex version").strip()
+        raise PolicyError(f"{exc} (Codex version: {version})") from exc
+    command = [*native, *profile, "mcp", "list", "--json"]
+    servers = listed([*command, *shutdown, *config], cwd, "Codex mcp list --json", "name")
+    targeted = {s["name"] for s in servers} & denied
+    overrides = []
+    for name in sorted(targeted):
+        if not re.fullmatch(r"[A-Za-z0-9_-]+", name):
+            raise PolicyError(f"unattended tools: cannot safely override Codex server: {name!r}")
+        overrides.extend(["-c", f"mcp_servers.{name}.enabled=false"])
+    # Match launch order: caller overrides come after the policy. Refuse a conflict.
+    verification = listed([*command, *shutdown, *overrides, *config], cwd,
+                          "Codex mcp list --json verification", "name")
+    disabled = {s["name"] for s in verification if not s["enabled"]}
+    unsafe = (targeted - disabled) | {s["name"] for s in verification if s["enabled"] and s["name"] in denied}
+    if unsafe:
+        raise PolicyError(f"unattended tools: Codex MCP overrides did not disable: {', '.join(sorted(unsafe))}")
+    return [*shutdown, *overrides, *argv]
+
+
+def claude_namespace(name):
+    # Claude Code's MCP tool-name normalization preserves ASCII letters, digits, '_' and '-'.
+    normalized = re.sub(r"[^a-zA-Z0-9_-]", "_", name)
+    if name.startswith("claude.ai "):
+        normalized = re.sub(r"_+", "_", normalized).strip("_")
+    return normalized
+
+
+@contextlib.contextmanager
+def claude_launch(argv, cwd):
+    denied = deny_names("claude")
+    native = PLATFORM["native_argv"]([argv[0]], cwd=cwd)
+    # Refuse configuration inputs we cannot verify. Do not consume or rewrite prompt values.
+    for index, token in enumerate(argv[1:], 1):
+        key, equal, value = token.partition("=")
+        if key in {"--settings", "--setting-sources", "--plugin-dir", "--plugin-url", "--chrome"}:
+            raise PolicyError(f"unattended tools: Claude {key} is not supported for drain executors")
+        if key != "--add-dir":
+            continue
+        directories = [value] if equal else []
+        for directory in argv[index + 1:]:
+            if directory.startswith("-"):
+                break
+            directories.append(directory)
+        if not directories:
+            raise PolicyError("unattended tools: Claude --add-dir requires a directory")
+        for directory in directories:
+            for filename in ("settings.json", "settings.local.json"):
+                path = Path(cwd) / Path(directory).expanduser() / ".claude" / filename
+                try:
+                    raw = path.read_text(encoding="utf-8")
+                except FileNotFoundError:
+                    continue
+                except (OSError, UnicodeError) as exc:
+                    raise PolicyError(f"unattended tools: cannot read Claude --add-dir settings {path}: {exc}") from exc
+                try:
+                    settings = LOADS(raw)
+                    if not isinstance(settings, dict):
+                        raise ValueError("expected a settings object")
+                    if "enabledPlugins" in settings:
+                        raise ValueError("enabledPlugins cannot be verified for --add-dir")
+                except ValueError as exc:
+                    raise PolicyError(f"unattended tools: Claude --add-dir settings {path}: {exc}") from exc
+    env = {**os.environ, "ENABLE_CLAUDEAI_MCP_SERVERS": "false"}
+    plugins = listed([*native, "--no-chrome", "plugin", "list", "--json"], cwd, "Claude plugin list --json", "id", env)
+    targeted = {p["id"] for p in plugins if p["enabled"]}
+    # Claude 2.1.314 recognizes disableClaudeAiConnectors; also override settings.env.
+    settings = {"syncClaudeAiPlugins": False, "disableClaudeAiConnectors": True,
+                "env": {"ENABLE_CLAUDEAI_MCP_SERVERS": "false"},
+                "enabledPlugins": dict.fromkeys(sorted(targeted), False)}
+    with tempfile.TemporaryDirectory(prefix="devlyn-unattended-") as temporary:
+        path = Path(temporary) / "settings.json"
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            json.dump(settings, stream, ensure_ascii=False)
+        options = ["--settings", str(path)]
+        if denied:
+            options.append("--disallowedTools=" + ",".join("mcp__" + claude_namespace(n) for n in denied))
+        options.append("--no-chrome")
+        verification = listed([*native, *options, "plugin", "list", "--json"], cwd,
+                              "Claude plugin list --json verification", "id", env)
+        enabled = sorted({p["id"] for p in verification if p["enabled"]})
+        if enabled:
+            raise PolicyError(f"unattended tools: Claude plugin overrides did not disable: {', '.join(enabled)}; check managed settings")
+        yield [argv[0], *options, *argv[1:]], env

package/native/codex/plugins/devlyn/skills/devlyn-ideate/SKILL.md

@@ -110,7 +110,7 @@ Follow [loop.md](references/loop.md). The executor is the configured route, the
 
 | Executor | argv |
 |---|---|
-| Claude | `claude -p "<prompt>" --dangerously-skip-permissions --add-dir "<git dir>"` |
+| Claude | `claude -p "<prompt>" --dangerously-skip-permissions --add-dir "<git dir>"` (drain prepends `--settings <temporary-policy.json> --no-chrome` and any `--disallowedTools=<list>` denies after `claude`) |
 | Codex | `bash "<DEVLYN_SHARED_DIR>/codex-monitored.sh" --skip-git-repo-check -s workspace-write -c 'sandbox_workspace_write.writable_roots=["<git dir>","{worktree_git_dir}"]' -c 'sandbox_workspace_write.network_access=true' "<prompt>"` |
 
 Another engine needs an argv that starts one fresh non-interactive session able, without prompts, to edit, run commands and commit in its task worktree and to write the packet's submission file. `<prompt>` carries the absolute binding values, while `{packet}` stays literal for the drain to fill: