ever-works-node 0.2.3 → 0.2.4

package/cli.js

@@ -3767,10 +3767,14 @@ var USER_SELECTABLE_WORK_KINDS = [
   "repo",
   "app"
 ];
-var WORK_KINDS = [...USER_SELECTABLE_WORK_KINDS, "company", "campaign", "default"];
+var WORK_KINDS = [...USER_SELECTABLE_WORK_KINDS, "company", "campaign", "project", "default"];
 var WORK_KIND_SET = new Set(WORK_KINDS);
 var GOAL_KINDS = ["metric", "delivery"];
 var GOAL_KIND_SET = new Set(GOAL_KINDS);
+var RECORD_VISIBILITIES = ["private", "team", "organization"];
+var RECORD_VISIBILITY_SET = new Set(RECORD_VISIBILITIES);
+var RECORD_LIST_VIEWS = ["mine", "shared", "organization"];
+var RECORD_LIST_VIEW_SET = new Set(RECORD_LIST_VIEWS);
 var APP_DEPENDENCY_BACKUP_OVERDUE_MS = 26 * 36e5;
 var APP_DEPENDENCY_MANAGED = {
   pgRoleConnectionLimit: 20,
@@ -7371,269 +7375,606 @@ function readPendingComputerSessions(payload) {
 }
 __name(readPendingComputerSessions, "readPendingComputerSessions");
 
-// src/core/api-base.ts
-var API_URL_ENV = "EVER_WORKS_NODE_API_URL";
-function rawPin(env) {
-  const value = env[API_URL_ENV];
-  if (typeof value !== "string") {
+// src/core/heartbeat.ts
+var systemScheduler = {
+  setTimeout: /* @__PURE__ */ __name((callback, ms) => setTimeout(callback, ms), "setTimeout"),
+  clearTimeout: /* @__PURE__ */ __name((handle) => clearTimeout(handle), "clearTimeout")
+};
+var OPTIONAL_DESCRIPTION_FIELD_TIERS = [
+  // NEWEST first. Node lifecycle + remote node limits (self-build slices
+  // AR, AS). Tiered (review): `cliVersions` goes out on EVERY beat of a
+  // node with a pinned CLI, so an upgraded node talking to a platform that
+  // predates it would otherwise drop the worker state and housekeeping
+  // along with it — losing health signals that platform DOES understand,
+  // for the life of the process. Stripping the newest tier first keeps them.
+  ["cliVersions", "maxConcurrentJobs", "maxCpuPercent", "maxMemoryMb"],
+  // Fleet health signals (EW-776) and node housekeeping (EW-803).
+  [
+    "workerState",
+    "workerStateReason",
+    "minFreeDiskBytes",
+    "workspaceCount",
+    "workspaceBytes",
+    "lastReclaimAt",
+    "lastReclaimFreedBytes"
+  ]
+];
+function untilHeartbeatAccepted(loop, shouldWait = () => true) {
+  const verdict = /* @__PURE__ */ __name((state) => {
+    if (state.state === "connected") return true;
+    if (state.state === "stopped" || !shouldWait()) return false;
     return null;
-  }
-  const trimmed = value.trim();
-  return trimmed ? trimmed : null;
+  }, "verdict");
+  const now = verdict(loop.getState());
+  if (now !== null) return Promise.resolve(now);
+  return new Promise((resolve9) => {
+    const unsubscribe = loop.onChange((state) => {
+      const settled = verdict(state);
+      if (settled === null) return;
+      unsubscribe();
+      resolve9(settled);
+    });
+  });
 }
-__name(rawPin, "rawPin");
-function readApiUrlPin(env = process.env) {
-  const raw = rawPin(env);
-  return raw === null ? null : normalizeApiUrl(raw);
+__name(untilHeartbeatAccepted, "untilHeartbeatAccepted");
+function computeBackoffDelay(intervalMs, failures, maxMs) {
+  if (failures <= 0) {
+    return intervalMs;
+  }
+  const exponent = Math.min(failures, 30);
+  const delay2 = intervalMs * 2 ** exponent;
+  return Math.min(delay2, maxMs);
 }
-__name(readApiUrlPin, "readApiUrlPin");
-function resolveApiBase(config, env = process.env) {
-  const configuredUrl = config.apiUrl;
-  const pinnedTo = readApiUrlPin(env);
-  if (pinnedTo === null) {
-    return { url: configuredUrl, source: "config", configuredUrl, pinnedTo: null, mismatch: false };
+__name(computeBackoffDelay, "computeBackoffDelay");
+var HeartbeatLoop = class {
+  static {
+    __name(this, "HeartbeatLoop");
   }
-  return {
-    url: pinnedTo,
-    source: "pin",
-    configuredUrl,
-    pinnedTo,
-    mismatch: pinnedTo !== configuredUrl
+  options;
+  scheduler;
+  now;
+  listeners = /* @__PURE__ */ new Set();
+  timer = null;
+  running = false;
+  inFlight = null;
+  /**
+   * How many optional-field TIERS (newest first) this platform has proven
+   * it predates; from then on the beat leaves those tiers out. 0 = it
+   * takes everything. Process-scoped on purpose — a platform upgrade is a
+   * restart-shaped event for the node, and re-probing on every beat would
+   * mean one wasted round trip per beat, forever, against an API that
+   * will never accept them.
+   */
+  strippedTiers = 0;
+  state = {
+    state: "idle",
+    lastHeartbeatAt: null,
+    consecutiveFailures: 0,
+    nextAttemptInMs: null,
+    lastError: null,
+    lastErrorKind: null,
+    node: null
   };
-}
-__name(resolveApiBase, "resolveApiBase");
-function describeApiBase(base) {
-  if (base.source === "config") {
-    return `${base.url} (from the enrolled config)`;
+  constructor(options) {
+    this.options = {
+      ...options,
+      intervalMs: options.intervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS,
+      maxBackoffMs: options.maxBackoffMs ?? MAX_HEARTBEAT_BACKOFF_MS
+    };
+    this.scheduler = options.scheduler ?? systemScheduler;
+    this.now = options.now ?? (() => Date.now());
+    this.options.logger?.protect(options.secret);
   }
-  if (!base.mismatch) {
-    return `${base.url} (pinned via ${API_URL_ENV}; matches the enrolled origin)`;
+  getState() {
+    return { ...this.state };
   }
-  return `${base.url} (PINNED via ${API_URL_ENV}) \u2014 enrolled against ${base.configuredUrl}. The pin does not match the enrolled origin: this node has no credential on the pinned platform, so every call will be refused with 401 until the pin is corrected or the node is re-enrolled.`;
-}
-__name(describeApiBase, "describeApiBase");
-
-// src/core/auth-client.ts
-var EVER_ID_DEVICE_SCOPE = ["openid", "email", EVER_ID_SCOPES.SESSION_EXCHANGE].join(" ");
-
-// src/core/telemetry-probe.ts
-var AGENT_CLI_CANDIDATES = ["claude", "codex", "gemini", "opencode"];
-function parseCliVersion(stdout) {
-  if (typeof stdout !== "string") return null;
-  const match = /\b(\d+\.\d+(?:\.\d+)?(?:[-+][0-9A-Za-z.-]+)?)\b/.exec(stdout);
-  return match ? match[1] : null;
-}
-__name(parseCliVersion, "parseCliVersion");
-async function detectAgentCliVersion(runner, candidates = AGENT_CLI_CANDIDATES) {
-  for (const command of candidates) {
-    try {
-      const result = await runner.run(command, ["--version"]);
-      if (result.code !== 0) continue;
-      const version = parseCliVersion(`${result.stdout ?? ""}
-${result.stderr ?? ""}`);
-      if (!version) continue;
-      return `${command} ${version}`.slice(0, FLEET_MAX_CLI_VERSION_LENGTH);
-    } catch {
-      continue;
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  /** Start beating. Resolves once the FIRST beat has settled. */
+  start() {
+    if (this.running) {
+      return this.inFlight ?? Promise.resolve();
     }
+    this.running = true;
+    return this.tick();
   }
-  return null;
-}
-__name(detectAgentCliVersion, "detectAgentCliVersion");
-async function detectDiskFreeBytes(io, path2) {
-  try {
-    const free = await io.freeBytes(path2);
-    if (typeof free !== "number" || !Number.isFinite(free) || free < 0) return null;
-    return Math.floor(free);
-  } catch {
-    return null;
+  /** Stop beating and cancel any pending timer. */
+  stop() {
+    this.running = false;
+    this.cancelTimer();
+    this.patch({ state: "stopped", nextAttemptInMs: null });
   }
-}
-__name(detectDiskFreeBytes, "detectDiskFreeBytes");
-var MODEL_IDENTITY_CACHE_TTL_MS = 5 * 6e4;
-function parseClaudeAuthStatus(stdout) {
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout.trim());
-  } catch {
-    return null;
+  /** Await the in-flight beat, if any (test/shutdown helper). */
+  async settled() {
+    await this.inFlight;
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const status = parsed;
-  if (status.loggedIn !== true) return "claude-code: not logged in";
-  const email = compactString(status.email);
-  const org = compactString(status.orgName);
-  const plan = compactString(status.subscriptionType);
-  const method = compactString(status.authMethod);
-  const who = email ?? (method ? `${method} login` : "logged in");
-  const details = [org, plan].filter((part) => part !== null);
-  return `claude-code: ${who}${details.length > 0 ? ` (${details.join(", ")})` : ""}`;
-}
-__name(parseClaudeAuthStatus, "parseClaudeAuthStatus");
-function parseCodexLoginStatus(stdout) {
-  const text = stdout.trim().toLowerCase();
-  if (!text) return null;
-  if (text.includes("not logged in")) return "codex: not logged in";
-  if (text.includes("chatgpt")) return "codex: chatgpt";
-  if (text.includes("api key")) return "codex: api-key";
-  if (text.includes("logged in")) return "codex: logged in";
-  return null;
-}
-__name(parseCodexLoginStatus, "parseCodexLoginStatus");
-function compactString(value) {
-  if (typeof value !== "string") return null;
-  const cleaned = value.replace(/[\u0000-\u001F\u007F]+/g, " ").trim();
-  return cleaned ? cleaned : null;
-}
-__name(compactString, "compactString");
-async function detectModelIdentity(runner, paths = {}) {
-  const candidates = [
-    { command: paths["claude-code"] || "claude", args: ["auth", "status", "--json"], parse: parseClaudeAuthStatus },
-    { command: paths.codex || "codex", args: ["login", "status"], parse: parseCodexLoginStatus }
-  ];
-  for (const candidate of candidates) {
+  /** Run one beat now. Exposed so the UI can offer "retry" and tests can step. */
+  tick() {
+    const run = this.runOnce().finally(() => {
+      if (this.inFlight === run) {
+        this.inFlight = null;
+      }
+    });
+    this.inFlight = run;
+    return run;
+  }
+  async runOnce() {
+    if (!this.running) {
+      return;
+    }
+    this.cancelTimer();
+    if (this.state.state !== "connected") {
+      this.patch({ state: "connecting" });
+    }
     try {
-      const result = await runner.run(candidate.command, candidate.args);
-      const stdout = result.stdout ?? "";
-      const stderr = result.stderr ?? "";
-      const label = candidate.parse(stdout) ?? candidate.parse(`${stdout}
-${stderr}`);
-      if (label) return label.slice(0, FLEET_MAX_MODEL_IDENTITY_LENGTH);
-    } catch {
-      continue;
+      const description = await this.options.describe();
+      this.onSuccess(await this.beat(description));
+    } catch (error) {
+      this.onFailure(error);
     }
+    this.scheduleNext();
   }
-  return null;
-}
-__name(detectModelIdentity, "detectModelIdentity");
-function cacheProbe(probe, ttlMs = MODEL_IDENTITY_CACHE_TTL_MS, now = Date.now) {
-  let value = null;
-  let expiresAt = Number.NEGATIVE_INFINITY;
-  let inFlight = null;
-  return async () => {
-    if (now() < expiresAt) return value;
-    if (inFlight) return inFlight;
-    inFlight = probe().then((fresh) => {
-      value = fresh;
-      expiresAt = now() + ttlMs;
-      return fresh;
-    }).finally(() => {
-      inFlight = null;
-    });
-    return inFlight;
-  };
-}
-__name(cacheProbe, "cacheProbe");
-
-// src/core/executors/model-cli.ts
-var MODEL_CLI_EMPTY_MCP_CONFIG = `${JSON.stringify({ mcpServers: {} }, null, 2)}
-`;
-function modelCliMcpIsolationEnv(provider) {
-  return provider === "claude-code" ? { ENABLE_CLAUDEAI_MCP_SERVERS: "false" } : null;
-}
-__name(modelCliMcpIsolationEnv, "modelCliMcpIsolationEnv");
-function claudeManagedMcpConfigPath(platform = process.platform) {
-  if (platform === "win32") return "C:\\Program Files\\ClaudeCode\\managed-mcp.json";
-  if (platform === "darwin") return "/Library/Application Support/ClaudeCode/managed-mcp.json";
-  return "/etc/claude-code/managed-mcp.json";
-}
-__name(claudeManagedMcpConfigPath, "claudeManagedMcpConfigPath");
-function claudeManagedMcpConfigInEffect(raw) {
-  if (typeof raw !== "string" || !raw.trim()) return false;
-  try {
-    const parsed = JSON.parse(raw);
-    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed);
-  } catch {
-    return false;
+  /**
+   * Send one beat, tolerating a platform that predates the optional
+   * self-description fields (the worker state, EW-776; the housekeeping
+   * report, EW-803).
+   *
+   * The API validates heartbeats with `whitelist + forbidNonWhitelisted`,
+   * so a field an older build does not know is not ignored — it 400s the
+   * whole request. A 400 is a FAILED beat, a failed beat backs off, and
+   * enough of them sweep the node to `offline`. Which would mean shipping
+   * a health-reporting feature whose failure mode is "every node in a
+   * mixed-version fleet goes dark": the exact class of outage this slice
+   * was written to end.
+   *
+   * So a 400 on a beat that CARRIED those fields is retried once,
+   * immediately, without them. If that succeeds the platform is simply
+   * older than this daemon; we latch, say so once, and keep reporting
+   * liveness. The retry costs one request, once per process.
+   *
+   * Inferring "the field was rejected" from a bare 400 is deliberate and
+   * has a cost worth stating: `FleetClient` never surfaces server bodies
+   * (fixed client-authored messages only), so a 400 caused by something
+   * else on such a beat also latches, and this node reports liveness only
+   * until it restarts. That is the safe direction — the node stays
+   * observable either way, and only the extra signal is lost.
+   */
+  async beat(description) {
+    const credential = { nodeId: this.options.nodeId, secret: this.options.secret };
+    let sent = stripTiers(description, this.strippedTiers);
+    try {
+      return await this.options.client.heartbeat({ ...credential, ...sent });
+    } catch (error) {
+      if (!isFieldRejection(error)) throw error;
+      let lastError = error;
+      for (let tiers = this.strippedTiers + 1; tiers <= OPTIONAL_DESCRIPTION_FIELD_TIERS.length; tiers += 1) {
+        const candidate = stripTiers(description, tiers);
+        if (Object.keys(candidate).length === Object.keys(sent).length) continue;
+        sent = candidate;
+        try {
+          const result = await this.options.client.heartbeat({ ...credential, ...candidate });
+          this.strippedTiers = tiers;
+          this.options.logger?.warn(
+            tiers >= OPTIONAL_DESCRIPTION_FIELD_TIERS.length ? "Platform rejected the optional self-description fields (worker state, housekeeping); it predates them. Reporting liveness only until this node restarts." : "Platform rejected the newest optional self-description fields (pinned CLI versions, enforced limits); it predates them. Still reporting worker state and housekeeping; the newer fields stay off until this node restarts."
+          );
+          return result;
+        } catch (retryError) {
+          if (!isFieldRejection(retryError)) throw retryError;
+          lastError = retryError;
+        }
+      }
+      throw lastError;
+    }
   }
-}
-__name(claudeManagedMcpConfigInEffect, "claudeManagedMcpConfigInEffect");
-var ModelCliCommandError = class extends Error {
-  static {
-    __name(this, "ModelCliCommandError");
+  onSuccess(result) {
+    this.patch({
+      state: "connected",
+      lastHeartbeatAt: this.now(),
+      consecutiveFailures: 0,
+      lastError: null,
+      lastErrorKind: null,
+      node: result.node
+    });
+    if (this.options.onAccepted) {
+      try {
+        this.options.onAccepted(result);
+      } catch {
+      }
+    }
   }
-  constructor(message) {
-    super(message);
-    this.name = "ModelCliCommandError";
+  onFailure(error) {
+    const kind = error instanceof FleetClientError ? error.kind : "network";
+    const raw = error instanceof Error ? error.message : String(error);
+    const message = this.options.logger?.redact(raw) ?? raw;
+    const failures = this.state.consecutiveFailures + 1;
+    this.patch({
+      // `unauthorized` is sticky and visible: the operator has to act
+      // (re-enable the node in Fleet, or re-enroll). We keep retrying at
+      // the backoff ceiling so a re-enabled node recovers on its own.
+      state: kind === "unauthorized" ? "unauthorized" : "retrying",
+      consecutiveFailures: failures,
+      lastError: message,
+      lastErrorKind: kind
+    });
+    this.options.logger?.warn(`Heartbeat failed (attempt ${failures}): ${message}`);
   }
-};
-var MODEL_CLI_STEP_ID = "model";
-var MODEL_CLI_OUTPUT_TAIL_BYTES = 8 * 1024;
-var MODEL_CLI_MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
-var ABSOLUTE_WIN32 = /^[A-Za-z]:[\\/]/;
-var UNSAFE_PATH_CHARS = /[\0\r\n"'`$&|;<>%!^]/;
-function quoteShellPath(path2, platform = process.platform) {
-  if (typeof path2 !== "string" || !path2.trim()) {
-    throw new ModelCliCommandError("Path must not be empty");
+  scheduleNext() {
+    if (!this.running) {
+      return;
+    }
+    const delay2 = computeBackoffDelay(
+      this.options.intervalMs,
+      this.state.consecutiveFailures,
+      this.options.maxBackoffMs
+    );
+    this.patch({ nextAttemptInMs: delay2 });
+    this.timer = this.scheduler.setTimeout(() => {
+      this.timer = null;
+      void this.tick();
+    }, delay2);
   }
-  if (UNSAFE_PATH_CHARS.test(path2)) {
-    throw new ModelCliCommandError("Path contains characters the shell could interpret");
+  cancelTimer() {
+    if (this.timer !== null) {
+      this.scheduler.clearTimeout(this.timer);
+      this.timer = null;
+    }
   }
-  const absolute = platform === "win32" ? ABSOLUTE_WIN32.test(path2) || path2.startsWith("\\\\") : path2.startsWith("/");
-  if (!absolute) {
-    throw new ModelCliCommandError("Path must be absolute");
+  patch(next) {
+    this.state = { ...this.state, ...next };
+    const snapshot = this.getState();
+    for (const listener of this.listeners) {
+      listener(snapshot);
+    }
   }
-  return `"${path2}"`;
-}
-__name(quoteShellPath, "quoteShellPath");
-function assertMcpServerName(name) {
-  if (typeof name !== "string" || !MCP_SERVER_NAME_PATTERN.test(name)) {
-    throw new ModelCliCommandError("MCP server name is not an opaque identifier");
+};
+function stripTiers(description, tiers) {
+  const out = {};
+  const dropped = new Set(OPTIONAL_DESCRIPTION_FIELD_TIERS.slice(0, tiers).flat());
+  for (const [key, value] of Object.entries(description)) {
+    if (value === void 0 || dropped.has(key)) continue;
+    out[key] = value;
   }
-  return name;
+  return out;
 }
-__name(assertMcpServerName, "assertMcpServerName");
-function assertLoopbackUrl(url) {
-  if (typeof url !== "string" || !MCP_LOOPBACK_URL_PATTERN.test(url)) {
-    throw new ModelCliCommandError("MCP bridge URL is not a loopback URL this node produced");
-  }
-  return url;
+__name(stripTiers, "stripTiers");
+function isFieldRejection(error) {
+  return error instanceof FleetClientError && error.kind === "invalid-request" && error.status === 400;
 }
-__name(assertLoopbackUrl, "assertLoopbackUrl");
-var MCP_SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
-var MCP_LOOPBACK_URL_PATTERN = /^http:\/\/127\.0\.0\.1:\d{1,5}\/mcp\/[a-f0-9]{8,64}$/;
-function assertModelId(model) {
-  if (model === void 0) return null;
-  if (!FLEET_AGENT_EXECUTION_MODEL_PATTERN.test(model)) {
-    throw new ModelCliCommandError("Model id is not an opaque identifier");
+__name(isFieldRejection, "isFieldRejection");
+
+// src/core/api-base.ts
+var API_URL_ENV = "EVER_WORKS_NODE_API_URL";
+function rawPin(env) {
+  const value = env[API_URL_ENV];
+  if (typeof value !== "string") {
+    return null;
   }
-  return model;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
 }
-__name(assertModelId, "assertModelId");
-var MODEL_CLI_OPTIONAL_FLAGS = {
-  "claude-code": ["--effort", "--max-budget-usd"],
-  codex: []
-};
-function unsupportedOptionalModelCliFlags(execution, supportedFlags) {
-  if (!supportedFlags) return [];
-  const wanted = [];
-  if (execution.provider === "claude-code") {
-    if (execution.effort) wanted.push("--effort");
-    if (execution.maxBudgetUsd !== void 0) wanted.push("--max-budget-usd");
+__name(rawPin, "rawPin");
+function readApiUrlPin(env = process.env) {
+  const raw = rawPin(env);
+  return raw === null ? null : normalizeApiUrl(raw);
+}
+__name(readApiUrlPin, "readApiUrlPin");
+function resolveApiBase(config, env = process.env) {
+  const configuredUrl = config.apiUrl;
+  const pinnedTo = readApiUrlPin(env);
+  if (pinnedTo === null) {
+    return { url: configuredUrl, source: "config", configuredUrl, pinnedTo: null, mismatch: false };
   }
-  const droppable = new Set(
-    MODEL_CLI_OPTIONAL_FLAGS[execution.provider] ?? []
-  );
-  return wanted.filter((flag) => droppable.has(flag) && !supportedFlags.has(flag));
+  return {
+    url: pinnedTo,
+    source: "pin",
+    configuredUrl,
+    pinnedTo,
+    mismatch: pinnedTo !== configuredUrl
+  };
 }
-__name(unsupportedOptionalModelCliFlags, "unsupportedOptionalModelCliFlags");
-function assertResumableSession(provider, sessionId) {
-  if (sessionId === void 0) return null;
-  if (!fleetAgentExecutionProviderSupportsSessionResume(provider)) {
-    throw new ModelCliCommandError(`Provider '${String(provider)}' cannot resume a CLI session on the fleet`);
+__name(resolveApiBase, "resolveApiBase");
+function describeApiBase(base) {
+  if (base.source === "config") {
+    return `${base.url} (from the enrolled config)`;
   }
-  if (!isFleetAgentModelSessionId(sessionId)) {
-    throw new ModelCliCommandError("CLI session id is not an opaque identifier");
+  if (!base.mismatch) {
+    return `${base.url} (pinned via ${API_URL_ENV}; matches the enrolled origin)`;
   }
-  return sessionId;
+  return `${base.url} (PINNED via ${API_URL_ENV}) \u2014 enrolled against ${base.configuredUrl}. The pin does not match the enrolled origin: this node has no credential on the pinned platform, so every call will be refused with 401 until the pin is corrected or the node is re-enrolled.`;
 }
-__name(assertResumableSession, "assertResumableSession");
-function formatBudget(value) {
-  if (value === void 0) return null;
-  if (!Number.isFinite(value) || value <= 0) {
-    throw new ModelCliCommandError("maxBudgetUsd must be a positive number");
-  }
-  return String(Math.round(value * 100) / 100);
+__name(describeApiBase, "describeApiBase");
+
+// src/core/auth-client.ts
+var EVER_ID_DEVICE_SCOPE = ["openid", "email", EVER_ID_SCOPES.SESSION_EXCHANGE].join(" ");
+
+// src/core/telemetry-probe.ts
+var AGENT_CLI_CANDIDATES = ["claude", "codex", "gemini", "opencode"];
+function parseCliVersion(stdout) {
+  if (typeof stdout !== "string") return null;
+  const match = /\b(\d+\.\d+(?:\.\d+)?(?:[-+][0-9A-Za-z.-]+)?)\b/.exec(stdout);
+  return match ? match[1] : null;
+}
+__name(parseCliVersion, "parseCliVersion");
+async function detectAgentCliVersion(runner, candidates = AGENT_CLI_CANDIDATES) {
+  for (const command of candidates) {
+    try {
+      const result = await runner.run(command, ["--version"]);
+      if (result.code !== 0) continue;
+      const version = parseCliVersion(`${result.stdout ?? ""}
+${result.stderr ?? ""}`);
+      if (!version) continue;
+      return `${command} ${version}`.slice(0, FLEET_MAX_CLI_VERSION_LENGTH);
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+__name(detectAgentCliVersion, "detectAgentCliVersion");
+async function detectDiskFreeBytes(io, path2) {
+  try {
+    const free = await io.freeBytes(path2);
+    if (typeof free !== "number" || !Number.isFinite(free) || free < 0) return null;
+    return Math.floor(free);
+  } catch {
+    return null;
+  }
+}
+__name(detectDiskFreeBytes, "detectDiskFreeBytes");
+var MODEL_IDENTITY_CACHE_TTL_MS = 5 * 6e4;
+function parseClaudeAuthStatus(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout.trim());
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const status = parsed;
+  if (status.loggedIn !== true) return "claude-code: not logged in";
+  const email = compactString(status.email);
+  const org = compactString(status.orgName);
+  const plan = compactString(status.subscriptionType);
+  const method = compactString(status.authMethod);
+  const who = email ?? (method ? `${method} login` : "logged in");
+  const details = [org, plan].filter((part) => part !== null);
+  return `claude-code: ${who}${details.length > 0 ? ` (${details.join(", ")})` : ""}`;
+}
+__name(parseClaudeAuthStatus, "parseClaudeAuthStatus");
+function parseCodexLoginStatus(stdout) {
+  const text = stdout.trim().toLowerCase();
+  if (!text) return null;
+  if (text.includes("not logged in")) return "codex: not logged in";
+  if (text.includes("chatgpt")) return "codex: chatgpt";
+  if (text.includes("api key")) return "codex: api-key";
+  if (text.includes("logged in")) return "codex: logged in";
+  return null;
+}
+__name(parseCodexLoginStatus, "parseCodexLoginStatus");
+function compactString(value) {
+  if (typeof value !== "string") return null;
+  const cleaned = value.replace(/[\u0000-\u001F\u007F]+/g, " ").trim();
+  return cleaned ? cleaned : null;
+}
+__name(compactString, "compactString");
+async function detectModelIdentity(runner, paths = {}) {
+  const candidates = [
+    { command: paths["claude-code"] || "claude", args: ["auth", "status", "--json"], parse: parseClaudeAuthStatus },
+    { command: paths.codex || "codex", args: ["login", "status"], parse: parseCodexLoginStatus }
+  ];
+  for (const candidate of candidates) {
+    try {
+      const result = await runner.run(candidate.command, candidate.args);
+      const stdout = result.stdout ?? "";
+      const stderr = result.stderr ?? "";
+      const label = candidate.parse(stdout) ?? candidate.parse(`${stdout}
+${stderr}`);
+      if (label) return label.slice(0, FLEET_MAX_MODEL_IDENTITY_LENGTH);
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+__name(detectModelIdentity, "detectModelIdentity");
+function cacheProbe(probe, ttlMs = MODEL_IDENTITY_CACHE_TTL_MS, now = Date.now) {
+  let value = null;
+  let expiresAt = Number.NEGATIVE_INFINITY;
+  let inFlight = null;
+  return async () => {
+    if (now() < expiresAt) return value;
+    if (inFlight) return inFlight;
+    inFlight = probe().then((fresh) => {
+      value = fresh;
+      expiresAt = now() + ttlMs;
+      return fresh;
+    }).finally(() => {
+      inFlight = null;
+    });
+    return inFlight;
+  };
+}
+__name(cacheProbe, "cacheProbe");
+
+// src/core/executors/model-cli.ts
+var MODEL_CLI_EMPTY_MCP_CONFIG = `${JSON.stringify({ mcpServers: {} }, null, 2)}
+`;
+var CODEX_SETTING_VALUE = /^[A-Za-z0-9._-]{1,64}$/;
+var TOML_STRING_ASSIGNMENT = /^([A-Za-z0-9_-]+)[ \t]*=[ \t]*(?:"([^"\\]*)"|'([^']*)')(?:[ \t]+#.*|#.*)?$/;
+var TOML_MULTILINE_VALUE_START = /^[^=#]*=[ \t]*("""|''')/;
+function readCodexUserSettings(configToml) {
+  const settings = {};
+  if (typeof configToml !== "string" || configToml.length === 0) return settings;
+  let table = "";
+  let openMultiline = null;
+  for (const raw of configToml.split(/\r?\n/)) {
+    if (openMultiline !== null) {
+      if (indexOfTomlClosingDelimiter(raw, openMultiline) !== -1) openMultiline = null;
+      continue;
+    }
+    const line = raw.trim();
+    const opening = TOML_MULTILINE_VALUE_START.exec(line);
+    if (opening) {
+      const delimiter = opening[1];
+      if (indexOfTomlClosingDelimiter(line.slice(opening[0].length), delimiter) === -1) {
+        openMultiline = delimiter;
+        continue;
+      }
+    }
+    if (line.startsWith("[")) {
+      if (line.startsWith("[[")) {
+        table = "\0array";
+      } else {
+        const close = line.indexOf("]");
+        table = close > 1 ? line.slice(1, close).trim() : "\0unknown";
+      }
+      continue;
+    }
+    const assignment = TOML_STRING_ASSIGNMENT.exec(line);
+    if (!assignment) continue;
+    const key = assignment[1];
+    const value = assignment[2] ?? assignment[3] ?? "";
+    if (!CODEX_SETTING_VALUE.test(value)) continue;
+    if (table === "" && key === "model" && settings.model === void 0) settings.model = value;
+    else if (table === "" && key === "model_reasoning_effort" && settings.reasoningEffort === void 0) {
+      settings.reasoningEffort = value;
+    } else if (table === "windows" && key === "sandbox" && settings.windowsSandbox === void 0) {
+      settings.windowsSandbox = value;
+    }
+  }
+  return settings;
+}
+__name(readCodexUserSettings, "readCodexUserSettings");
+function indexOfTomlClosingDelimiter(text, delimiter) {
+  let from = 0;
+  for (; ; ) {
+    const at = text.indexOf(delimiter, from);
+    if (at === -1 || delimiter === "'''") return at;
+    let backslashes = 0;
+    for (let i = at - 1; i >= 0 && text[i] === "\\"; i -= 1) backslashes += 1;
+    if (backslashes % 2 === 0) return at;
+    from = at + 1;
+  }
+}
+__name(indexOfTomlClosingDelimiter, "indexOfTomlClosingDelimiter");
+function assertCodexSetting(name, value) {
+  if (value === void 0) return void 0;
+  if (!CODEX_SETTING_VALUE.test(value)) {
+    throw new ModelCliCommandError(`Refusing to forward the Codex setting '${name}': not a bare identifier`);
+  }
+  return value;
+}
+__name(assertCodexSetting, "assertCodexSetting");
+function modelCliMcpIsolationEnv(provider) {
+  return provider === "claude-code" ? { ENABLE_CLAUDEAI_MCP_SERVERS: "false" } : null;
+}
+__name(modelCliMcpIsolationEnv, "modelCliMcpIsolationEnv");
+function claudeManagedMcpConfigPath(platform = process.platform) {
+  if (platform === "win32") return "C:\\Program Files\\ClaudeCode\\managed-mcp.json";
+  if (platform === "darwin") return "/Library/Application Support/ClaudeCode/managed-mcp.json";
+  return "/etc/claude-code/managed-mcp.json";
+}
+__name(claudeManagedMcpConfigPath, "claudeManagedMcpConfigPath");
+function claudeManagedMcpConfigInEffect(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return false;
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed);
+  } catch {
+    return false;
+  }
+}
+__name(claudeManagedMcpConfigInEffect, "claudeManagedMcpConfigInEffect");
+var ModelCliCommandError = class extends Error {
+  static {
+    __name(this, "ModelCliCommandError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "ModelCliCommandError";
+  }
+};
+var MODEL_CLI_STEP_ID = "model";
+var MODEL_CLI_OUTPUT_TAIL_BYTES = 8 * 1024;
+var MODEL_CLI_MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+var ABSOLUTE_WIN32 = /^[A-Za-z]:[\\/]/;
+var UNSAFE_PATH_CHARS = /[\0\r\n"'`$&|;<>%!^]/;
+function quoteShellPath(path2, platform = process.platform) {
+  if (typeof path2 !== "string" || !path2.trim()) {
+    throw new ModelCliCommandError("Path must not be empty");
+  }
+  if (UNSAFE_PATH_CHARS.test(path2)) {
+    throw new ModelCliCommandError("Path contains characters the shell could interpret");
+  }
+  const absolute = platform === "win32" ? ABSOLUTE_WIN32.test(path2) || path2.startsWith("\\\\") : path2.startsWith("/");
+  if (!absolute) {
+    throw new ModelCliCommandError("Path must be absolute");
+  }
+  return `"${path2}"`;
+}
+__name(quoteShellPath, "quoteShellPath");
+function assertMcpServerName(name) {
+  if (typeof name !== "string" || !MCP_SERVER_NAME_PATTERN.test(name)) {
+    throw new ModelCliCommandError("MCP server name is not an opaque identifier");
+  }
+  return name;
+}
+__name(assertMcpServerName, "assertMcpServerName");
+function assertLoopbackUrl(url) {
+  if (typeof url !== "string" || !MCP_LOOPBACK_URL_PATTERN.test(url)) {
+    throw new ModelCliCommandError("MCP bridge URL is not a loopback URL this node produced");
+  }
+  return url;
+}
+__name(assertLoopbackUrl, "assertLoopbackUrl");
+var MCP_SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+var MCP_LOOPBACK_URL_PATTERN = /^http:\/\/127\.0\.0\.1:\d{1,5}\/mcp\/[a-f0-9]{8,64}$/;
+function assertModelId(model) {
+  if (model === void 0) return null;
+  if (!FLEET_AGENT_EXECUTION_MODEL_PATTERN.test(model)) {
+    throw new ModelCliCommandError("Model id is not an opaque identifier");
+  }
+  return model;
+}
+__name(assertModelId, "assertModelId");
+var MODEL_CLI_OPTIONAL_FLAGS = {
+  "claude-code": ["--effort", "--max-budget-usd"],
+  codex: []
+};
+function unsupportedOptionalModelCliFlags(execution, supportedFlags) {
+  if (!supportedFlags) return [];
+  const wanted = [];
+  if (execution.provider === "claude-code") {
+    if (execution.effort) wanted.push("--effort");
+    if (execution.maxBudgetUsd !== void 0) wanted.push("--max-budget-usd");
+  }
+  const droppable = new Set(
+    MODEL_CLI_OPTIONAL_FLAGS[execution.provider] ?? []
+  );
+  return wanted.filter((flag) => droppable.has(flag) && !supportedFlags.has(flag));
+}
+__name(unsupportedOptionalModelCliFlags, "unsupportedOptionalModelCliFlags");
+function assertResumableSession(provider, sessionId) {
+  if (sessionId === void 0) return null;
+  if (!fleetAgentExecutionProviderSupportsSessionResume(provider)) {
+    throw new ModelCliCommandError(`Provider '${String(provider)}' cannot resume a CLI session on the fleet`);
+  }
+  if (!isFleetAgentModelSessionId(sessionId)) {
+    throw new ModelCliCommandError("CLI session id is not an opaque identifier");
+  }
+  return sessionId;
+}
+__name(assertResumableSession, "assertResumableSession");
+function formatBudget(value) {
+  if (value === void 0) return null;
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new ModelCliCommandError("maxBudgetUsd must be a positive number");
+  }
+  return String(Math.round(value * 100) / 100);
 }
 __name(formatBudget, "formatBudget");
 function buildModelCliCommand(input) {
@@ -7692,7 +8033,21 @@ function buildModelCliCommand(input) {
     if (roots.length > 0) args.push("--add-dir", ...roots);
   } else if (execution.provider === "codex") {
     const sandbox = permissionMode === "plan" ? "read-only" : "workspace-write";
-    args.push("exec", "--json", "--sandbox", sandbox, "-C", quoteShellPath(input.workspacePath, platform));
+    args.push(
+      "exec",
+      "--ignore-user-config",
+      "--json",
+      "--sandbox",
+      sandbox,
+      "-C",
+      quoteShellPath(input.workspacePath, platform)
+    );
+    const kept = input.codexUserSettings ?? {};
+    const windowsSandbox = assertCodexSetting("windows.sandbox", kept.windowsSandbox);
+    const reasoningEffort = assertCodexSetting("model_reasoning_effort", kept.reasoningEffort);
+    const ownerModel = assertCodexSetting("model", kept.model);
+    if (windowsSandbox) args.push("-c", `windows.sandbox=${windowsSandbox}`);
+    if (reasoningEffort) args.push("-c", `model_reasoning_effort=${reasoningEffort}`);
     if (sandbox === "workspace-write") {
       for (const root of grantedRoots(writableMounts)) args.push("--add-dir", root);
     }
@@ -7702,7 +8057,8 @@ function buildModelCliCommand(input) {
         `mcp_servers.${assertMcpServerName(mcp.serverName)}.url=${assertLoopbackUrl(mcp.serverUrl)}`
       );
     }
-    if (model) args.push("-m", model);
+    const codexModel = model ?? ownerModel;
+    if (codexModel) args.push("-m", codexModel);
     if (execution.skipPermissions === true) args.push("--dangerously-bypass-approvals-and-sandbox");
     args.push("-");
   } else {
@@ -7725,7 +8081,16 @@ function assertMountGrantsInCommand(input) {
 }
 __name(assertMountGrantsInCommand, "assertMountGrantsInCommand");
 var STRICT_MCP_CONFIG_IN_COMMAND = / --mcp-config "[^"]+" --strict-mcp-config /;
+var CODEX_IGNORE_USER_CONFIG_IN_COMMAND = / exec --ignore-user-config /;
 function assertMcpIsolationInCommand(input) {
+  if (input.execution.provider === "codex") {
+    if (!CODEX_IGNORE_USER_CONFIG_IN_COMMAND.test(input.command)) {
+      throw new ModelCliCommandError(
+        "The codex command line does not carry exec --ignore-user-config, so the run would load the machine owner's own config.toml: its MCP servers, plugins and notify hook"
+      );
+    }
+    return;
+  }
   if (input.execution.provider !== "claude-code") return;
   if (!STRICT_MCP_CONFIG_IN_COMMAND.test(input.command)) {
     throw new ModelCliCommandError(
@@ -8053,436 +8418,183 @@ var MODEL_CLI_REQUIRED_FLAGS = {
   // bridge's. A CLI without them cannot run fleet work at all, so `doctor`
   // must say INCOMPATIBLE, not "runs that need them will fail".
   "claude-code": ["-p", "--output-format", "--permission-mode", "--mcp-config", "--strict-mcp-config"],
-  codex: ["--json", "--sandbox", "-C"]
+  codex: ["--json", "--sandbox", "-C", "--ignore-user-config"]
 };
 var MODEL_CLI_CONDITIONAL_FLAGS = {
-  "claude-code": [
-    "--model",
-    "--add-dir",
-    "--allowedTools",
-    "--dangerously-skip-permissions",
-    "--verbose",
-    "--resume",
-    "--fork-session"
-  ],
-  codex: ["--add-dir", "-c", "-m", "--dangerously-bypass-approvals-and-sandbox"]
-};
-var MODEL_CLI_COMPAT_UNSTAMPED_TTL_MS = 10 * 6e4;
-var MODEL_CLI_COMPAT_STAMPED_MAX_AGE_MS = 60 * 6e4;
-var MODEL_CLI_COMPAT_INCOMPLETE_RETRY_MS = 6e4;
-var ModelCliCompatibilityProbe = class {
-  constructor(options) {
-    this.options = options;
-    this.now = options.now ?? (() => Date.now());
-    this.unstampedTtlMs = options.unstampedTtlMs ?? MODEL_CLI_COMPAT_UNSTAMPED_TTL_MS;
-    this.incompleteRetryMs = options.incompleteRetryMs ?? MODEL_CLI_COMPAT_INCOMPLETE_RETRY_MS;
-    this.stampedMaxAgeMs = options.stampedMaxAgeMs ?? MODEL_CLI_COMPAT_STAMPED_MAX_AGE_MS;
-  }
-  options;
-  static {
-    __name(this, "ModelCliCompatibilityProbe");
-  }
-  cache = /* @__PURE__ */ new Map();
-  inFlight = /* @__PURE__ */ new Map();
-  now;
-  unstampedTtlMs;
-  incompleteRetryMs;
-  stampedMaxAgeMs;
-  /** One pinned binary. */
-  async probe(provider, executable) {
-    const stamp = await this.stamp(executable);
-    const key = `${provider}|${executable}|${stamp ? `${stamp.mtimeMs}:${stamp.size}` : "unstamped"}`;
-    const cached = this.cache.get(`${provider}|${executable}`);
-    if (cached && cached.key === key && this.now() - cached.probedAt < cached.ttlMs) {
-      return cached.result;
-    }
-    const pending = this.inFlight.get(key);
-    if (pending) return pending;
-    const run = this.run(provider, executable).then(({ result, answered }) => {
-      this.cache.set(`${provider}|${executable}`, {
-        key,
-        // A COMPLETE answer from a stamped file is kept until the file
-        // changes or, at the latest, for `stampedMaxAgeMs` (an upgrade
-        // behind a stable wrapper does not change the stamp). An
-        // incomplete one is retried soon, and an unstamped one on the
-        // ten-minute clock.
-        ttlMs: !answered ? this.incompleteRetryMs : stamp !== null ? this.stampedMaxAgeMs : this.unstampedTtlMs,
-        probedAt: this.now(),
-        result
-      });
-      return result;
-    }).finally(() => {
-      this.inFlight.delete(key);
-    });
-    this.inFlight.set(key, run);
-    return run;
-  }
-  /** Every pinned binary in `paths`, in provider order. Unpinned providers are skipped. */
-  async probeAll(paths) {
-    const out = [];
-    for (const provider of MODEL_CLI_PROVIDERS) {
-      const executable = paths?.[provider];
-      if (typeof executable !== "string" || !executable.trim()) continue;
-      out.push(await this.probe(provider, executable));
-    }
-    return out;
-  }
-  async stamp(executable) {
-    if (!this.options.statFile) return null;
-    try {
-      const stamp = await this.options.statFile(executable);
-      return stamp && Number.isFinite(stamp.mtimeMs) && Number.isFinite(stamp.size) ? stamp : null;
-    } catch {
-      return null;
-    }
-  }
-  async run(provider, executable) {
-    const command = this.commandFor(executable);
-    const versionOutput = await this.ask(command, ["--version"]);
-    const version = versionOutput === null ? null : parseCliVersion(versionOutput);
-    const help = await this.ask(command, [...HELP_ARGS[provider]]);
-    return {
-      result: judgeModelCliHelp(provider, executable, version, help),
-      // "Answered" = both invocations produced output. An UNRECOGNISED
-      // help text is still an answer — deterministic for that file — and
-      // re-asking every minute would learn nothing.
-      answered: versionOutput !== null && help !== null
-    };
-  }
-  /**
-   * The runner on Windows goes through `cmd.exe` (`shell: true`), which
-   * splits an unquoted `C:\Program Files\…` at the space.
-   */
-  commandFor(executable) {
-    return this.options.platform === "win32" && /\s/.test(executable) && !executable.startsWith('"') ? `"${executable}"` : executable;
-  }
-  /** stdout+stderr of one invocation, or null when it could not be run at all. */
-  async ask(command, args) {
-    try {
-      const result = await this.options.runner.run(command, args);
-      if (result.timedOut) return null;
-      const text = `${result.stdout ?? ""}
-${result.stderr ?? ""}`;
-      return result.code === 0 || text.trim() ? text : null;
-    } catch {
-      return null;
-    }
-  }
-};
-function parseAdvertisedFlags(help) {
-  const flags = /* @__PURE__ */ new Set();
-  const pattern = /(?:^|[\s,[(|])(--?[A-Za-z][A-Za-z0-9-]*)(?=$|[\s,=<[\])|.:])/gm;
-  for (const match of help.matchAll(pattern)) {
-    flags.add(match[1]);
-  }
-  return flags;
-}
-__name(parseAdvertisedFlags, "parseAdvertisedFlags");
-function judgeModelCliHelp(provider, executable, version, help) {
-  const required = MODEL_CLI_REQUIRED_FLAGS[provider];
-  const base = {
-    provider,
-    executable,
-    version,
-    supportedFlags: null,
-    missingRequiredFlags: [],
-    missingConditionalFlags: [],
-    unsupportedOptionalFlags: [],
-    note: null
-  };
-  if (help === null) {
-    return { ...base, note: "the binary did not answer --help; nothing is dropped" };
-  }
-  const advertised = parseAdvertisedFlags(help);
-  if (!required.some((flag) => advertised.has(flag))) {
-    return {
-      ...base,
-      note: `the help text lists none of the flags this node always passes (${required.join(", ")}); its format is not recognised, so nothing is dropped`
-    };
-  }
-  const missing = /* @__PURE__ */ __name((list) => list.filter((flag) => !advertised.has(flag)), "missing");
-  return {
-    ...base,
-    supportedFlags: advertised,
-    missingRequiredFlags: missing(required),
-    missingConditionalFlags: missing(MODEL_CLI_CONDITIONAL_FLAGS[provider]),
-    unsupportedOptionalFlags: missing(MODEL_CLI_OPTIONAL_FLAGS[provider])
-  };
-}
-__name(judgeModelCliHelp, "judgeModelCliHelp");
-function isModelCliCompatible(compat) {
-  return compat.missingRequiredFlags.length === 0;
-}
-__name(isModelCliCompatible, "isModelCliCompatible");
-function describeCliVersions(results) {
-  return results.map((result) => `${result.provider} ${result.version ?? "unknown"}`.slice(0, FLEET_MAX_CLI_VERSION_LENGTH)).slice(0, FLEET_MAX_CLI_VERSIONS);
-}
-__name(describeCliVersions, "describeCliVersions");
-var LEGACY_COMMAND_NAME = {
-  "claude-code": "claude",
-  codex: "codex"
-};
-function primaryPinnedCliVersion(results) {
-  const first = results.find((result) => result.version !== null);
-  return first ? `${LEGACY_COMMAND_NAME[first.provider]} ${first.version}`.slice(0, FLEET_MAX_CLI_VERSION_LENGTH) : null;
-}
-__name(primaryPinnedCliVersion, "primaryPinnedCliVersion");
-
-// src/core/worker-loop.ts
-var import_node_perf_hooks = require("node:perf_hooks");
-
-// src/core/heartbeat.ts
-var systemScheduler = {
-  setTimeout: /* @__PURE__ */ __name((callback, ms) => setTimeout(callback, ms), "setTimeout"),
-  clearTimeout: /* @__PURE__ */ __name((handle) => clearTimeout(handle), "clearTimeout")
-};
-var OPTIONAL_DESCRIPTION_FIELD_TIERS = [
-  // NEWEST first. Node lifecycle + remote node limits (self-build slices
-  // AR, AS). Tiered (review): `cliVersions` goes out on EVERY beat of a
-  // node with a pinned CLI, so an upgraded node talking to a platform that
-  // predates it would otherwise drop the worker state and housekeeping
-  // along with it — losing health signals that platform DOES understand,
-  // for the life of the process. Stripping the newest tier first keeps them.
-  ["cliVersions", "maxConcurrentJobs", "maxCpuPercent", "maxMemoryMb"],
-  // Fleet health signals (EW-776) and node housekeeping (EW-803).
-  [
-    "workerState",
-    "workerStateReason",
-    "minFreeDiskBytes",
-    "workspaceCount",
-    "workspaceBytes",
-    "lastReclaimAt",
-    "lastReclaimFreedBytes"
-  ]
-];
-function computeBackoffDelay(intervalMs, failures, maxMs) {
-  if (failures <= 0) {
-    return intervalMs;
-  }
-  const exponent = Math.min(failures, 30);
-  const delay2 = intervalMs * 2 ** exponent;
-  return Math.min(delay2, maxMs);
-}
-__name(computeBackoffDelay, "computeBackoffDelay");
-var HeartbeatLoop = class {
-  static {
-    __name(this, "HeartbeatLoop");
-  }
-  options;
-  scheduler;
-  now;
-  listeners = /* @__PURE__ */ new Set();
-  timer = null;
-  running = false;
-  inFlight = null;
-  /**
-   * How many optional-field TIERS (newest first) this platform has proven
-   * it predates; from then on the beat leaves those tiers out. 0 = it
-   * takes everything. Process-scoped on purpose — a platform upgrade is a
-   * restart-shaped event for the node, and re-probing on every beat would
-   * mean one wasted round trip per beat, forever, against an API that
-   * will never accept them.
-   */
-  strippedTiers = 0;
-  state = {
-    state: "idle",
-    lastHeartbeatAt: null,
-    consecutiveFailures: 0,
-    nextAttemptInMs: null,
-    lastError: null,
-    lastErrorKind: null,
-    node: null
-  };
-  constructor(options) {
-    this.options = {
-      ...options,
-      intervalMs: options.intervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS,
-      maxBackoffMs: options.maxBackoffMs ?? MAX_HEARTBEAT_BACKOFF_MS
-    };
-    this.scheduler = options.scheduler ?? systemScheduler;
-    this.now = options.now ?? (() => Date.now());
-    this.options.logger?.protect(options.secret);
-  }
-  getState() {
-    return { ...this.state };
-  }
-  onChange(listener) {
-    this.listeners.add(listener);
-    return () => {
-      this.listeners.delete(listener);
-    };
-  }
-  /** Start beating. Resolves once the FIRST beat has settled. */
-  start() {
-    if (this.running) {
-      return this.inFlight ?? Promise.resolve();
-    }
-    this.running = true;
-    return this.tick();
-  }
-  /** Stop beating and cancel any pending timer. */
-  stop() {
-    this.running = false;
-    this.cancelTimer();
-    this.patch({ state: "stopped", nextAttemptInMs: null });
-  }
-  /** Await the in-flight beat, if any (test/shutdown helper). */
-  async settled() {
-    await this.inFlight;
-  }
-  /** Run one beat now. Exposed so the UI can offer "retry" and tests can step. */
-  tick() {
-    const run = this.runOnce().finally(() => {
-      if (this.inFlight === run) {
-        this.inFlight = null;
-      }
-    });
-    this.inFlight = run;
-    return run;
-  }
-  async runOnce() {
-    if (!this.running) {
-      return;
-    }
-    this.cancelTimer();
-    if (this.state.state !== "connected") {
-      this.patch({ state: "connecting" });
-    }
-    try {
-      const description = await this.options.describe();
-      this.onSuccess(await this.beat(description));
-    } catch (error) {
-      this.onFailure(error);
-    }
-    this.scheduleNext();
-  }
-  /**
-   * Send one beat, tolerating a platform that predates the optional
-   * self-description fields (the worker state, EW-776; the housekeeping
-   * report, EW-803).
-   *
-   * The API validates heartbeats with `whitelist + forbidNonWhitelisted`,
-   * so a field an older build does not know is not ignored — it 400s the
-   * whole request. A 400 is a FAILED beat, a failed beat backs off, and
-   * enough of them sweep the node to `offline`. Which would mean shipping
-   * a health-reporting feature whose failure mode is "every node in a
-   * mixed-version fleet goes dark": the exact class of outage this slice
-   * was written to end.
-   *
-   * So a 400 on a beat that CARRIED those fields is retried once,
-   * immediately, without them. If that succeeds the platform is simply
-   * older than this daemon; we latch, say so once, and keep reporting
-   * liveness. The retry costs one request, once per process.
-   *
-   * Inferring "the field was rejected" from a bare 400 is deliberate and
-   * has a cost worth stating: `FleetClient` never surfaces server bodies
-   * (fixed client-authored messages only), so a 400 caused by something
-   * else on such a beat also latches, and this node reports liveness only
-   * until it restarts. That is the safe direction — the node stays
-   * observable either way, and only the extra signal is lost.
-   */
-  async beat(description) {
-    const credential = { nodeId: this.options.nodeId, secret: this.options.secret };
-    let sent = stripTiers(description, this.strippedTiers);
-    try {
-      return await this.options.client.heartbeat({ ...credential, ...sent });
-    } catch (error) {
-      if (!isFieldRejection(error)) throw error;
-      let lastError = error;
-      for (let tiers = this.strippedTiers + 1; tiers <= OPTIONAL_DESCRIPTION_FIELD_TIERS.length; tiers += 1) {
-        const candidate = stripTiers(description, tiers);
-        if (Object.keys(candidate).length === Object.keys(sent).length) continue;
-        sent = candidate;
-        try {
-          const result = await this.options.client.heartbeat({ ...credential, ...candidate });
-          this.strippedTiers = tiers;
-          this.options.logger?.warn(
-            tiers >= OPTIONAL_DESCRIPTION_FIELD_TIERS.length ? "Platform rejected the optional self-description fields (worker state, housekeeping); it predates them. Reporting liveness only until this node restarts." : "Platform rejected the newest optional self-description fields (pinned CLI versions, enforced limits); it predates them. Still reporting worker state and housekeeping; the newer fields stay off until this node restarts."
-          );
-          return result;
-        } catch (retryError) {
-          if (!isFieldRejection(retryError)) throw retryError;
-          lastError = retryError;
-        }
-      }
-      throw lastError;
-    }
+  "claude-code": [
+    "--model",
+    "--add-dir",
+    "--allowedTools",
+    "--dangerously-skip-permissions",
+    "--verbose",
+    "--resume",
+    "--fork-session"
+  ],
+  codex: ["--add-dir", "-c", "-m", "--dangerously-bypass-approvals-and-sandbox"]
+};
+var MODEL_CLI_COMPAT_UNSTAMPED_TTL_MS = 10 * 6e4;
+var MODEL_CLI_COMPAT_STAMPED_MAX_AGE_MS = 60 * 6e4;
+var MODEL_CLI_COMPAT_INCOMPLETE_RETRY_MS = 6e4;
+var ModelCliCompatibilityProbe = class {
+  constructor(options) {
+    this.options = options;
+    this.now = options.now ?? (() => Date.now());
+    this.unstampedTtlMs = options.unstampedTtlMs ?? MODEL_CLI_COMPAT_UNSTAMPED_TTL_MS;
+    this.incompleteRetryMs = options.incompleteRetryMs ?? MODEL_CLI_COMPAT_INCOMPLETE_RETRY_MS;
+    this.stampedMaxAgeMs = options.stampedMaxAgeMs ?? MODEL_CLI_COMPAT_STAMPED_MAX_AGE_MS;
   }
-  onSuccess(result) {
-    this.patch({
-      state: "connected",
-      lastHeartbeatAt: this.now(),
-      consecutiveFailures: 0,
-      lastError: null,
-      lastErrorKind: null,
-      node: result.node
-    });
-    if (this.options.onAccepted) {
-      try {
-        this.options.onAccepted(result);
-      } catch {
-      }
-    }
+  options;
+  static {
+    __name(this, "ModelCliCompatibilityProbe");
   }
-  onFailure(error) {
-    const kind = error instanceof FleetClientError ? error.kind : "network";
-    const raw = error instanceof Error ? error.message : String(error);
-    const message = this.options.logger?.redact(raw) ?? raw;
-    const failures = this.state.consecutiveFailures + 1;
-    this.patch({
-      // `unauthorized` is sticky and visible: the operator has to act
-      // (re-enable the node in Fleet, or re-enroll). We keep retrying at
-      // the backoff ceiling so a re-enabled node recovers on its own.
-      state: kind === "unauthorized" ? "unauthorized" : "retrying",
-      consecutiveFailures: failures,
-      lastError: message,
-      lastErrorKind: kind
+  cache = /* @__PURE__ */ new Map();
+  inFlight = /* @__PURE__ */ new Map();
+  now;
+  unstampedTtlMs;
+  incompleteRetryMs;
+  stampedMaxAgeMs;
+  /** One pinned binary. */
+  async probe(provider, executable) {
+    const stamp = await this.stamp(executable);
+    const key = `${provider}|${executable}|${stamp ? `${stamp.mtimeMs}:${stamp.size}` : "unstamped"}`;
+    const cached = this.cache.get(`${provider}|${executable}`);
+    if (cached && cached.key === key && this.now() - cached.probedAt < cached.ttlMs) {
+      return cached.result;
+    }
+    const pending = this.inFlight.get(key);
+    if (pending) return pending;
+    const run = this.run(provider, executable).then(({ result, answered }) => {
+      this.cache.set(`${provider}|${executable}`, {
+        key,
+        // A COMPLETE answer from a stamped file is kept until the file
+        // changes or, at the latest, for `stampedMaxAgeMs` (an upgrade
+        // behind a stable wrapper does not change the stamp). An
+        // incomplete one is retried soon, and an unstamped one on the
+        // ten-minute clock.
+        ttlMs: !answered ? this.incompleteRetryMs : stamp !== null ? this.stampedMaxAgeMs : this.unstampedTtlMs,
+        probedAt: this.now(),
+        result
+      });
+      return result;
+    }).finally(() => {
+      this.inFlight.delete(key);
     });
-    this.options.logger?.warn(`Heartbeat failed (attempt ${failures}): ${message}`);
+    this.inFlight.set(key, run);
+    return run;
   }
-  scheduleNext() {
-    if (!this.running) {
-      return;
+  /** Every pinned binary in `paths`, in provider order. Unpinned providers are skipped. */
+  async probeAll(paths) {
+    const out = [];
+    for (const provider of MODEL_CLI_PROVIDERS) {
+      const executable = paths?.[provider];
+      if (typeof executable !== "string" || !executable.trim()) continue;
+      out.push(await this.probe(provider, executable));
     }
-    const delay2 = computeBackoffDelay(
-      this.options.intervalMs,
-      this.state.consecutiveFailures,
-      this.options.maxBackoffMs
-    );
-    this.patch({ nextAttemptInMs: delay2 });
-    this.timer = this.scheduler.setTimeout(() => {
-      this.timer = null;
-      void this.tick();
-    }, delay2);
+    return out;
   }
-  cancelTimer() {
-    if (this.timer !== null) {
-      this.scheduler.clearTimeout(this.timer);
-      this.timer = null;
+  async stamp(executable) {
+    if (!this.options.statFile) return null;
+    try {
+      const stamp = await this.options.statFile(executable);
+      return stamp && Number.isFinite(stamp.mtimeMs) && Number.isFinite(stamp.size) ? stamp : null;
+    } catch {
+      return null;
     }
   }
-  patch(next) {
-    this.state = { ...this.state, ...next };
-    const snapshot = this.getState();
-    for (const listener of this.listeners) {
-      listener(snapshot);
+  async run(provider, executable) {
+    const command = this.commandFor(executable);
+    const versionOutput = await this.ask(command, ["--version"]);
+    const version = versionOutput === null ? null : parseCliVersion(versionOutput);
+    const help = await this.ask(command, [...HELP_ARGS[provider]]);
+    return {
+      result: judgeModelCliHelp(provider, executable, version, help),
+      // "Answered" = both invocations produced output. An UNRECOGNISED
+      // help text is still an answer — deterministic for that file — and
+      // re-asking every minute would learn nothing.
+      answered: versionOutput !== null && help !== null
+    };
+  }
+  /**
+   * The runner on Windows goes through `cmd.exe` (`shell: true`), which
+   * splits an unquoted `C:\Program Files\…` at the space.
+   */
+  commandFor(executable) {
+    return this.options.platform === "win32" && /\s/.test(executable) && !executable.startsWith('"') ? `"${executable}"` : executable;
+  }
+  /** stdout+stderr of one invocation, or null when it could not be run at all. */
+  async ask(command, args) {
+    try {
+      const result = await this.options.runner.run(command, args);
+      if (result.timedOut) return null;
+      const text = `${result.stdout ?? ""}
+${result.stderr ?? ""}`;
+      return result.code === 0 || text.trim() ? text : null;
+    } catch {
+      return null;
     }
   }
 };
-function stripTiers(description, tiers) {
-  const out = {};
-  const dropped = new Set(OPTIONAL_DESCRIPTION_FIELD_TIERS.slice(0, tiers).flat());
-  for (const [key, value] of Object.entries(description)) {
-    if (value === void 0 || dropped.has(key)) continue;
-    out[key] = value;
+function parseAdvertisedFlags(help) {
+  const flags = /* @__PURE__ */ new Set();
+  const pattern = /(?:^|[\s,[(|])(--?[A-Za-z][A-Za-z0-9-]*)(?=$|[\s,=<[\])|.:])/gm;
+  for (const match of help.matchAll(pattern)) {
+    flags.add(match[1]);
   }
-  return out;
+  return flags;
 }
-__name(stripTiers, "stripTiers");
-function isFieldRejection(error) {
-  return error instanceof FleetClientError && error.kind === "invalid-request" && error.status === 400;
+__name(parseAdvertisedFlags, "parseAdvertisedFlags");
+function judgeModelCliHelp(provider, executable, version, help) {
+  const required = MODEL_CLI_REQUIRED_FLAGS[provider];
+  const base = {
+    provider,
+    executable,
+    version,
+    supportedFlags: null,
+    missingRequiredFlags: [],
+    missingConditionalFlags: [],
+    unsupportedOptionalFlags: [],
+    note: null
+  };
+  if (help === null) {
+    return { ...base, note: "the binary did not answer --help; nothing is dropped" };
+  }
+  const advertised = parseAdvertisedFlags(help);
+  if (!required.some((flag) => advertised.has(flag))) {
+    return {
+      ...base,
+      note: `the help text lists none of the flags this node always passes (${required.join(", ")}); its format is not recognised, so nothing is dropped`
+    };
+  }
+  const missing = /* @__PURE__ */ __name((list) => list.filter((flag) => !advertised.has(flag)), "missing");
+  return {
+    ...base,
+    supportedFlags: advertised,
+    missingRequiredFlags: missing(required),
+    missingConditionalFlags: missing(MODEL_CLI_CONDITIONAL_FLAGS[provider]),
+    unsupportedOptionalFlags: missing(MODEL_CLI_OPTIONAL_FLAGS[provider])
+  };
 }
-__name(isFieldRejection, "isFieldRejection");
+__name(judgeModelCliHelp, "judgeModelCliHelp");
+function isModelCliCompatible(compat) {
+  return compat.missingRequiredFlags.length === 0;
+}
+__name(isModelCliCompatible, "isModelCliCompatible");
+function describeCliVersions(results) {
+  return results.map((result) => `${result.provider} ${result.version ?? "unknown"}`.slice(0, FLEET_MAX_CLI_VERSION_LENGTH)).slice(0, FLEET_MAX_CLI_VERSIONS);
+}
+__name(describeCliVersions, "describeCliVersions");
+var LEGACY_COMMAND_NAME = {
+  "claude-code": "claude",
+  codex: "codex"
+};
+function primaryPinnedCliVersion(results) {
+  const first = results.find((result) => result.version !== null);
+  return first ? `${LEGACY_COMMAND_NAME[first.provider]} ${first.version}`.slice(0, FLEET_MAX_CLI_VERSION_LENGTH) : null;
+}
+__name(primaryPinnedCliVersion, "primaryPinnedCliVersion");
+
+// src/core/worker-loop.ts
+var import_node_perf_hooks = require("node:perf_hooks");
 
 // src/core/resource-limits.ts
 var ADMIT = { admit: true, reason: null };
@@ -13096,6 +13208,11 @@ async function runModelStep(jobId, execution, workspacePath, mounts, bridgeSpec,
       emptyMcpConfigPath = mcpConfigPath;
     }
     const droppedFlags = await optionalFlagsToDrop(jobId, execution, executable, io);
+    const codexUserSettings = execution.provider === "codex" ? await readOwnerCodexSettings(
+      jobId,
+      io,
+      effectiveCodexHome(io, modelEnvOverlay, execution.envPassthrough, execution.envGrants)
+    ) : void 0;
     const invoke = /* @__PURE__ */ __name(async (instructions, resumeSessionId) => {
       await scratchFs.writeFile(scratch.instructionsPath, instructions);
       let command;
@@ -13108,6 +13225,7 @@ async function runModelStep(jobId, execution, workspacePath, mounts, bridgeSpec,
           ...mounts && mounts.length > 0 ? { mounts } : {},
           ...bridge.cli ? { mcp: bridge.cli } : {},
           ...emptyMcpConfigPath ? { emptyMcpConfigPath } : {},
+          ...codexUserSettings ? { codexUserSettings } : {},
           ...resumeSessionId ? { resumeSessionId } : {},
           ...io.platform ? { platform: io.platform } : {},
           ...streamClaude ? { stream: true } : {},
@@ -13326,6 +13444,32 @@ function resolveRealHomeDir(io) {
   return (0, import_os2.homedir)();
 }
 __name(resolveRealHomeDir, "resolveRealHomeDir");
+async function readOwnerCodexSettings(jobId, io, codexHome) {
+  const read = io.sessionConfigFs?.readFile?.bind(io.sessionConfigFs);
+  if (!read) return {};
+  try {
+    return readCodexUserSettings(await read((0, import_path4.join)(codexHome, "config.toml")));
+  } catch (error) {
+    io.logger?.warn(
+      `[fleet-node] job ${jobId}: could not read the Codex config to keep its sandbox and model defaults; the run uses Codex's own defaults (still under --ignore-user-config): ${describeContainmentError(error)}`
+    );
+    return {};
+  }
+}
+__name(readOwnerCodexSettings, "readOwnerCodexSettings");
+function effectiveCodexHome(io, envOverlay, envPassthrough, envGrants) {
+  const isCodexHome = /* @__PURE__ */ __name((name) => name.toUpperCase() === "CODEX_HOME", "isCodexHome");
+  const childEnv = buildNodeCheckEnv(
+    envPassthrough?.filter(isCodexHome) ?? null,
+    io.parentEnv,
+    envGrants?.filter(isCodexHome) ?? null,
+    envOverlay
+  );
+  const key = Object.keys(childEnv).find(isCodexHome);
+  const value = key === void 0 ? void 0 : childEnv[key];
+  return typeof value === "string" && value.trim() ? value.trim() : (0, import_path4.join)(resolveRealHomeDir(io), ".codex");
+}
+__name(effectiveCodexHome, "effectiveCodexHome");
 function describeContainmentError(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -15137,10 +15281,14 @@ var USER_SELECTABLE_WORK_KINDS2 = [
   "repo",
   "app"
 ];
-var WORK_KINDS2 = [...USER_SELECTABLE_WORK_KINDS2, "company", "campaign", "default"];
+var WORK_KINDS2 = [...USER_SELECTABLE_WORK_KINDS2, "company", "campaign", "project", "default"];
 new Set(WORK_KINDS2);
 var GOAL_KINDS2 = ["metric", "delivery"];
 new Set(GOAL_KINDS2);
+var RECORD_VISIBILITIES2 = ["private", "team", "organization"];
+new Set(RECORD_VISIBILITIES2);
+var RECORD_LIST_VIEWS2 = ["mine", "shared", "organization"];
+new Set(RECORD_LIST_VIEWS2);
 var VERSION2 = "1.0.0";
 var GTM_SKILLS2 = [
   // ── research ────────────────────────────────────────────────────────
@@ -19451,10 +19599,14 @@ var USER_SELECTABLE_WORK_KINDS3 = [
   "repo",
   "app"
 ];
-var WORK_KINDS3 = [...USER_SELECTABLE_WORK_KINDS3, "company", "campaign", "default"];
+var WORK_KINDS3 = [...USER_SELECTABLE_WORK_KINDS3, "company", "campaign", "project", "default"];
 new Set(WORK_KINDS3);
 var GOAL_KINDS3 = ["metric", "delivery"];
 new Set(GOAL_KINDS3);
+var RECORD_VISIBILITIES3 = ["private", "team", "organization"];
+new Set(RECORD_VISIBILITIES3);
+var RECORD_LIST_VIEWS3 = ["mine", "shared", "organization"];
+new Set(RECORD_LIST_VIEWS3);
 var VERSION3 = "1.0.0";
 var GTM_SKILLS3 = [
   // ── research ────────────────────────────────────────────────────────
@@ -23170,14 +23322,47 @@ async function runStart(deps, options) {
     });
   }
   await loop.start();
-  if (worker) {
-    await worker.start();
-  }
-  if (attendedWorker) {
-    await attendedWorker.start();
-    deps.out(
-      runtime.attended?.captureBackend ? "Live view enabled \u2014 the owner can watch this machine from the dashboard (screen and terminal)" : "Live view enabled \u2014 terminal only: no browser was found here to show a screen"
-    );
+  let shuttingDown = false;
+  const startLanes = /* @__PURE__ */ __name(async () => {
+    if (worker) {
+      await worker.start();
+    }
+    if (attendedWorker) {
+      await attendedWorker.start();
+      deps.out(
+        runtime.attended?.captureBackend ? "Live view enabled \u2014 the owner can watch this machine from the dashboard (screen and terminal)" : "Live view enabled \u2014 terminal only: no browser was found here to show a screen"
+      );
+    }
+  }, "startLanes");
+  let lanesStarted = Promise.resolve();
+  let laneStartFailed = false;
+  let laneStartFailure = void 0;
+  if (worker || attendedWorker) {
+    if (loop.getState().state === "connected") {
+      await startLanes();
+    } else {
+      deps.out(
+        "Waiting for the platform to accept a heartbeat before leasing work (its answer carries this node\u2019s limits and version verdict)"
+      );
+      lanesStarted = startLanesAfterAcceptedHeartbeat(
+        loop,
+        async () => {
+          deps.io.logger.info("Heartbeat accepted \u2014 starting the worker lanes");
+          await startLanes();
+        },
+        () => !shuttingDown
+      ).then((outcome) => {
+        if (!outcome.failed) return;
+        laneStartFailed = true;
+        laneStartFailure = outcome.error;
+        deps.io.logger.error(
+          `Worker lanes failed to start after the first accepted heartbeat: ${describeError4(
+            outcome.error
+          )} \u2014 shutting down`
+        );
+        requestShutdown();
+      });
+    }
   }
   const reaper = worker && runtime.workspaceRoot ? startWorkspaceReaperTimer({
     rootPath: runtime.workspaceRoot,
@@ -23215,8 +23400,10 @@ async function runStart(deps, options) {
   }
   await (deps.waitForShutdown?.() ?? (deps.signals ? signalled : Promise.resolve()));
   reaper?.stop();
+  shuttingDown = true;
   loop.stop();
   await loop.settled();
+  await lanesStarted;
   if (attendedWorker) {
     for (const jobId of attendedWorker.getState().activeJobIds) {
       attendedWorker.cancelJob(jobId, "This machine is shutting down");
@@ -23229,8 +23416,29 @@ async function runStart(deps, options) {
     deps.out(`Worker host stopped (completed ${state.completed}, failed ${state.failed}).`);
   }
   deps.out("Stopped.");
+  if (laneStartFailed) {
+    throw new CliError(
+      `Worker lanes failed to start after the first accepted heartbeat: ${describeError4(laneStartFailure)}`,
+      EXIT_FAILURE
+    );
+  }
 }
 __name(runStart, "runStart");
+async function startLanesAfterAcceptedHeartbeat(loop, startLanes, shouldWait) {
+  const accepted = await untilHeartbeatAccepted(loop, shouldWait);
+  if (!accepted || !shouldWait()) return { started: false, failed: false };
+  try {
+    await startLanes();
+    return { started: true, failed: false };
+  } catch (error) {
+    return { started: false, failed: true, error };
+  }
+}
+__name(startLanesAfterAcceptedHeartbeat, "startLanesAfterAcceptedHeartbeat");
+function describeError4(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+__name(describeError4, "describeError");
 function parseConcurrency(raw) {
   if (raw === void 0) return void 0;
   const parsed = Number.parseInt(raw, 10);
@@ -23897,7 +24105,7 @@ function createLogger(options = {}) {
 __name(createLogger, "createLogger");
 
 // src/version.ts
-var NODE_APP_VERSION = "0.2.3";
+var NODE_APP_VERSION = "0.2.4";
 
 // src/cli.ts
 function buildDeps() {