faberun 0.26.2 → 0.27.0

package/README.md

@@ -273,10 +273,11 @@ routing policy.
 
 | Harness | Default vendor | Example model |
 | --- | --- | --- |
-| `claude` | Anthropic | `claude-sonnet` |
+| `claude` | Anthropic; another Anthropic-compatible endpoint declared per runtime | `claude-sonnet`, `claude-glm` |
 | `codex` | OpenAI | `codex-gpt` |
 | `agy` | Google | `agy-gemini` |
 | `dsh` | declared per runtime; DeepSeek in the discovery entry | `dsh-deepseek` |
+| `fx` | declared per runtime; DeepSeek, Zhipu and OpenAI in the discovery entries | `fx-deepseek`, `fx-glm`, `fx-gpt` |
 | `zcode` | Zhipu | `zcode-glm` |
 | `exec-jsonl` | declared per runtime | the model its command names |
 | `replay` | declared per runtime | the recorded model |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.26.2",
+  "version": "0.27.0",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/src/cli/setup.mjs

@@ -64,7 +64,7 @@ import { discoverSkillTargets, registerSkills } from "./skills.mjs";
 const MIN_NODE_MAJOR = 22;
 
 /** The harnesses a fresh machine can install, named in the failure hint. */
-const INSTALL_HARNESSES = ["claude", "codex", "agy", "dsh", "zcode"];
+const INSTALL_HARNESSES = ["claude", "codex", "agy", "dsh", "fx", "zcode"];
 
 /**
  * @param {SetupOptions} [options]

package/src/cli.mjs

@@ -534,7 +534,7 @@ function warnIfNoTransport() {
 }
 
 /** The harness binaries whose presence the banner counts on PATH. */
-const HARNESS_BINARIES = ["claude", "codex", "agy", "dsh", "zcode"];
+const HARNESS_BINARIES = ["claude", "codex", "agy", "dsh", "fx", "zcode"];
 
 /** Handled before verb dispatch, so they are not options of any command. */
 const HELP_FLAGS = new Set(["--help", "-h"]);

package/src/contract/index.mjs

@@ -68,7 +68,7 @@ const GATE_REVIEWS = new Set(["none", "advisory", "blocking"]);
 
 /** @typedef {{mode: "execution"|"discovery"|"autonomous", objective: string, instructions: string[], readFiles: string[], writeFiles?: string[], writeRoots?: string[], symbols: string[], scopeAcknowledged?: string[], decisions: string[], nonGoals: string[], verification: VerificationCommand[]}} TaskPacket */
 
-/** @typedef {{harness: "claude"|"codex"|"agy"|"dsh"|"zcode"|"exec-jsonl"|"replay", model: string, reasoning?: string, sandbox?: "read-only"|"workspace-write"|"danger-full-access", permissionMode?: string, config?: Record<string, unknown>, printTimeout?: string, tools?: string[], executable?: string, args?: string[], versionArgs?: string[], maxArgvPromptBytes?: number, requiredCapabilities?: CapabilityRequirements, costRank?: number, fallback?: string, vendor: string, tier?: number|string, stallTimeoutSec?: number, maxConcurrent?: number}} ValidatedRuntime */
+/** @typedef {{harness: "claude"|"codex"|"agy"|"dsh"|"fx"|"zcode"|"exec-jsonl"|"replay", model: string, reasoning?: string, sandbox?: "read-only"|"workspace-write"|"danger-full-access", permissionMode?: string, config?: Record<string, unknown>, printTimeout?: string, tools?: string[], executable?: string, args?: string[], versionArgs?: string[], maxArgvPromptBytes?: number, requiredCapabilities?: CapabilityRequirements, costRank?: number, fallback?: string, vendor: string, tier?: number|string, stallTimeoutSec?: number, maxConcurrent?: number}} ValidatedRuntime */
 
 /** @typedef {{enabled: boolean, review?: ("none"|"advisory"|"blocking"), runtime?: string, failOn?: ("minor"|"major"|"critical")[], maxRevisions?: number, requiredCapabilities?: CapabilityRequirements, skipWhen?: {verificationGreen: true, maxChangedPaths: number}}} ValidatedGate */
 

package/src/contract/runtime.mjs

@@ -11,7 +11,7 @@
  */
 import { assertObject, nonNegativeNumber, positiveInteger, positiveNumber, rejectUnknown, requireId, requireString, requireStringArray, requireTimestamp } from "./assert.mjs";
 import { composeAssignments } from "../engine/runtime-discovery.mjs";
-import { harnessCapabilities, resolvePermissionExecution, resolveVendor, validateCapabilityRequirements, writesWorkspace } from "../harnesses/index.mjs";
+import { harnessCapabilities, readOnlyModeOf, resolvePermissionExecution, resolveVendor, validateCapabilityRequirements, writesWorkspace } from "../harnesses/index.mjs";
 import { canonicalProvider } from "./provider.mjs";
 import { stableJson } from "../util.mjs";
 /** @typedef {import("./index.mjs").NodeStatus} NodeStatus */
@@ -27,7 +27,7 @@ const RUNTIME_FIELDS = new Set([
   "executable", "args", "versionArgs", "maxArgvPromptBytes", "requiredCapabilities", "costRank",
   "fallback", "vendor", "tier", "pricing", "stallTimeoutSec", "maxConcurrent",
 ]);
-const RUNTIME_HARNESSES = new Set(["claude", "codex", "agy", "dsh", "zcode", "exec-jsonl", "replay"]);
+const RUNTIME_HARNESSES = new Set(["claude", "codex", "agy", "dsh", "fx", "zcode", "exec-jsonl", "replay"]);
 
 /**
  * The strategies a routing rule may name: how a rule consumes its `prefer`
@@ -246,8 +246,9 @@ export function judgeWriteWarnings(runtimes, defaults, nodes) {
     const runtime = runtimes[/** @type {string} */ (id)];
     const execution = resolvePermissionExecution(runtime);
     if (!execution.field || runtime[execution.field] === undefined || !writesWorkspace(runtime)) return [];
-    if (writesWorkspace({ ...runtime, [execution.field]: "read-only" })) return [];
-    return [`judge runtime ${id} declares ${execution.field} ${execution.mode}; a judge's verdict reaches the gate without writing, so declare ${execution.field} read-only`];
+    const readOnlyMode = readOnlyModeOf(runtime);
+    if (readOnlyMode === null) return [];
+    return [`judge runtime ${id} declares ${execution.field} ${execution.mode}; a judge's verdict reaches the gate without writing, so declare ${execution.field} ${readOnlyMode}`];
   });
 }
 /**

package/src/engine/live-preflight.mjs

@@ -181,7 +181,7 @@ function createLivePreflightRepo() {
  */
 function safeLiveRuntime(runtime) {
   if (runtime.harness === "codex") return { ...runtime, sandbox: "read-only" };
-  if (runtime.harness === "dsh") return { ...runtime, sandbox: "read-only" };
+  if (runtime.harness === "dsh" || runtime.harness === "fx") return { ...runtime, sandbox: "read-only" };
   if (runtime.harness === "claude") return { ...runtime, permissionMode: "plan" };
   // `plan` is the ZCode mode that reads without writing; the adapter's own
   // default is `yolo`, which a preflight prompt must never reach.

package/src/engine/runtime-discovery.mjs

@@ -56,6 +56,18 @@ export { exhaustedUntilOf, normalizeProviderAvailability } from "../harnesses/in
  * @type {Readonly<Record<string, DiscoveryRuntime>>}
  */
 export const DISCOVERY_RUNTIME_DEFINITIONS = Object.freeze({
+  // Every vendor this harness reaches is declared ahead of the older harness
+  // for the same models, so fx wins each tie-break. Measured on the
+  // parseDuration benchmark (2026-09-25): 22-27 MB per fx worker against
+  // 362-422 MB for dsh, with the same scope and hidden-test results.
+  "fx-deepseek": {
+    harness: "fx",
+    model: "deepseek-flash",
+    vendor: "deepseek",
+    config: { "api_key.env_key": "DEEPSEEK_API_KEY" },
+    tier: 1,
+    costRank: 1,
+  },
   // `dsh` defaults no vendor and no provider route, so both are declared here
   // or nothing can build a command from this entry.
   "dsh-deepseek": {
@@ -66,6 +78,32 @@ export const DISCOVERY_RUNTIME_DEFINITIONS = Object.freeze({
     tier: 1,
     costRank: 1,
   },
+  // GLM 5.3 on fx through the Z.ai Coding Plan's Chat Completions endpoint.
+  // The operator chose this default knowing the plan's usage policy lists
+  // Claude Code and ZCode, not fx, and restricts or bans an account for
+  // detected third-party use; `claude-glm` below is the supported route.
+  // Measured 2026-09-26: the tiny-text campaign with a GLM worker and a
+  // DeepSeek judge, both on fx, peaked at 283 MB.
+  "fx-glm": {
+    harness: "fx",
+    model: "glm-5.3",
+    vendor: "zhipu",
+    config: { base_url: "https://api.z.ai/api/coding/paas/v4", "api_key.env_key": "ZAI_API_KEY", context_window: 200_000 },
+    tier: 1,
+    costRank: 1,
+  },
+  // GLM through Claude Code, which the Z.ai Coding Plan lists as a supported
+  // tool. Declared before zcode-glm so it wins the tie-break: measured
+  // 2026-09-25 on one review prompt, 384-392 MB per turn against 0.9-1.0 GB
+  // for zcode, and the tiny-text campaign peaked at 865 MB against 1,575 MB.
+  "claude-glm": {
+    harness: "claude",
+    model: "glm-5.3",
+    vendor: "zhipu",
+    config: { base_url: "https://api.z.ai/api/anthropic", "auth_token.env_key": "ZAI_API_KEY" },
+    tier: 1,
+    costRank: 1,
+  },
   // The flash tier, not the unsuffixed pro: measured 2026-09-24 in the judge
   // canary, glm-5.3 recalled 0.79 against glm-5.3-flash's 0.85 at about nine
   // times the price, which the owner confirmed matches the public benchmarks.
@@ -78,15 +116,19 @@ export const DISCOVERY_RUNTIME_DEFINITIONS = Object.freeze({
     costRank: 1,
   },
   "agy-gemini": { harness: "agy", model: "gemini-3.8-flash-low", vendor: "google", tier: 1, costRank: 1 },
+  // GPT on fx through fx's own ChatGPT login, which fx-faberun reads from the
+  // operator's profile (`FX_AUTH_HOME`). Measured 2026-09-26: one review turn
+  // peaked at 35-47 MB for the runner and fx together.
+  "fx-gpt": { harness: "fx", model: "gpt-5.6-sol", vendor: "openai", config: { provider: "codex" }, tier: 2, costRank: 2 },
   // Three codex rows, because the harness declares three models and an
   // account is entitled to only some of them: measured 2026-09-21 on the
   // owner's ChatGPT account, plain `gpt-5.6` answers HTTP 400 while
   // `gpt-5.6-sol` answers normally. One row meant `setup` could offer only the
   // model that account cannot use, and the operator's only way out was to hand
-  // every contract its own catalogue through `--runtimes`. Declaration order is
-  // unchanged, so the composed default is still `codex-gpt`: which of the three
-  // an account can reach is not something this file can know, and the live
-  // preflight is what reports it per id.
+  // every contract its own catalogue through `--runtimes`. `fx-gpt` above is
+  // declared first, so it is the composed tier-2 default; among these three,
+  // which an account can reach is not something this file can know, and the
+  // live preflight is what reports it per id.
   "codex-gpt": { harness: "codex", model: "gpt-5.6", vendor: "openai", tier: 2, costRank: 2 },
   "codex-sol": { harness: "codex", model: "gpt-5.6-sol", vendor: "openai", tier: 2, costRank: 2 },
   "codex-luna": { harness: "codex", model: "gpt-5.6-luna", vendor: "openai", tier: 2, costRank: 2 },

package/src/harnesses/catalogue.mjs

@@ -26,12 +26,13 @@ import { spawnInvocation } from "../host/platform.mjs";
  * opt-in that reads the host.
  */
 
-/** Display order of the registered harnesses: claude, codex, agy, dsh, zcode, exec-jsonl, replay. */
+/** Display order of the registered harnesses: claude, codex, agy, dsh, fx, zcode, exec-jsonl, replay. */
 export const MODEL_HARNESS_ORDER = Object.freeze([
   "claude",
   "codex",
   "agy",
   "dsh",
+  "fx",
   "zcode",
   "exec-jsonl",
   "replay",
@@ -78,6 +79,11 @@ export const DECLARED_MODEL_CATALOGUES = Object.freeze({
     declaredModel("claude-fable-5", { efforts: CLAUDE_EFFORTS }),
     declaredModel("claude-fable-5-1", { efforts: CLAUDE_EFFORTS }),
     declaredModel("claude-sonnet-4-6", { efforts: CLAUDE_EFFORTS }),
+    // GLM through a runtime whose `config.base_url` names Z.ai's
+    // Anthropic-compatible endpoint. The CLI sized its own window at 200,000
+    // tokens for this model (2026-09-25 result event), and `--effort` is a
+    // Claude-model flag, so no effort is declared.
+    declaredModel("glm-5.3", { contextWindowTokens: 200_000, efforts: NO_EFFORTS }),
   ]),
   codex: Object.freeze([
     declaredModel("gpt-5.6", { efforts: CODEX_EFFORTS }),
@@ -98,6 +104,20 @@ export const DECLARED_MODEL_CATALOGUES = Object.freeze({
     declaredModel("deepseek-v4-pro", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: DSH_EFFORTS, defaultEffort: "high" }),
     declaredModel("deepseek-v4-flash-vision-exp", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: DSH_EFFORTS, defaultEffort: "high" }),
   ]),
+  // The two ids api.deepseek.com/models listed on 2026-09-24. No efforts:
+  // fx's settings carry one `effort` for the Gateway catalogue and send
+  // nothing a custom Chat Completions connection is known to honour.
+  fx: Object.freeze([
+    declaredModel("deepseek-flash", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
+    declaredModel("deepseek-v4-pro", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
+    // GLM through a Z.ai Chat Completions endpoint named by `config.base_url`.
+    declaredModel("glm-5.3", { contextWindowTokens: GLM_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
+    // GPT through fx's ChatGPT login (`config.provider: "codex"`). Measured
+    // 2026-09-26: fx listed these among the account's seven models, and both
+    // answered a review turn through the runner.
+    declaredModel("gpt-5.6-sol", { efforts: NO_EFFORTS }),
+    declaredModel("gpt-6-sol", { efforts: NO_EFFORTS }),
+  ]),
   zcode: Object.freeze([
     declaredModel("glm-5.3-flash", { contextWindowTokens: GLM_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
     // No `[1m]` row: the suffix is a Claude Code convention the ZCode CLI does
@@ -115,6 +135,7 @@ const CATALOGUE_SOURCES = Object.freeze({
   claude: "declared",
   codex: "declared",
   dsh: "declared",
+  fx: "declared",
   zcode: "declared",
   "exec-jsonl": "runtime-declared",
   replay: "runtime-declared",
@@ -130,18 +151,20 @@ const EFFORT_TRANSPORT = Object.freeze({
   codex: "config.model_reasoning_effort",
   agy: "--effort",
   dsh: "--reasoning (harness reasoningEffort)",
+  fx: null,
   zcode: null,
   "exec-jsonl": null,
   replay: null,
 });
 
 /**
- * Why a harness resolves no vendor: dsh, exec-jsonl, and replay declare none.
+ * Why a harness resolves no vendor: dsh, fx, exec-jsonl, and replay declare none.
  *
  * @type {Readonly<Record<string, string>>}
  */
 const VENDOR_NOTES = Object.freeze({
   dsh: "unresolved: dsh declares no default vendor; the contract names it",
+  fx: "unresolved: fx declares no default vendor; the contract names it",
   "exec-jsonl": "unresolved: exec-jsonl declares no default vendor; the contract names it",
   replay: "unresolved: replay declares no default vendor; the contract names it",
 });

package/src/harnesses/claude/index.mjs

@@ -26,6 +26,70 @@ function claudePreambleArgs(runtime) {
   ];
 }
 
+/**
+ * The environment one runtime's CLI runs under when its contract points it at
+ * an Anthropic-compatible endpoint other than Anthropic's own, e.g. GLM on
+ * the Z.ai Coding Plan, where Claude Code is one of the supported tools:
+ *
+ *   "config": { "base_url": "https://api.z.ai/api/anthropic",
+ *               "auth_token.env_key": "ZAI_API_KEY" }
+ *
+ * The overlay travels in the invocation's own command, so it reaches only
+ * this runtime's process: a controller that also runs a Claude judge on
+ * Anthropic keeps that judge on Anthropic. The token is read from the named
+ * variable at invocation time; its value never appears in the contract.
+ *
+ * A declared endpoint with no resolvable token is refused rather than run:
+ * the CLI would fall back to the operator's own Anthropic login and send that
+ * credential to the declared host. Measured 2026-09-25 on the tiny-text
+ * campaign: two parallel GLM 5.3 judges through this CLI peaked at 599 MB,
+ * where the same judges on zcode had peaked at about 1.5 GB together with
+ * the test processes.
+ *
+ * @param {import("../index.mjs").HarnessRuntime} runtime
+ * @returns {Record<string, string|null>|undefined}
+ */
+function endpointEnv(runtime) {
+  const baseUrl = declaredBaseUrl(runtime);
+  const declared = runtime.config?.["auth_token.env_key"];
+  const tokenVar = typeof declared === "string" && declared ? declared : null;
+  if (baseUrl === null && tokenVar === null) return undefined;
+  const token = tokenVar === null ? undefined : process.env[tokenVar];
+  if (typeof token !== "string" || !token) {
+    const error = /** @type {Error & {code: string}} */ (new Error(tokenVar === null
+      ? `claude runtime declares base_url ${baseUrl} without auth_token.env_key`
+      : `claude runtime declares auth_token.env_key ${tokenVar}, which is unset`));
+    error.code = "auth_token_unresolved";
+    throw error;
+  }
+  /** @type {Record<string, string|null>} */
+  const env = {
+    ANTHROPIC_AUTH_TOKEN: token,
+    // An ambient Anthropic key outranks the bearer token in the CLI.
+    ANTHROPIC_API_KEY: null,
+  };
+  if (baseUrl !== null) {
+    env.ANTHROPIC_BASE_URL = baseUrl;
+    // The CLI sends its own background requests (titles, summaries) to the
+    // alias models; another endpoint does not serve those names, so every
+    // alias resolves to the runtime's model.
+    env.ANTHROPIC_DEFAULT_OPUS_MODEL = runtime.model;
+    env.ANTHROPIC_DEFAULT_SONNET_MODEL = runtime.model;
+    env.ANTHROPIC_DEFAULT_HAIKU_MODEL = runtime.model;
+    env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
+  }
+  return env;
+}
+
+/**
+ * @param {{config?: Record<string, unknown>}} runtime
+ * @returns {string|null}
+ */
+function declaredBaseUrl(runtime) {
+  const value = runtime.config?.base_url;
+  return typeof value === "string" && value ? value : null;
+}
+
 /**
  * @type {import("../index.mjs").HarnessAdapter}
  */
@@ -52,8 +116,11 @@ export const claudeHarness = {
     signalsProcesses: true,
   },
 
-  // Headless acceptEdits denies Bash; bypassPermissions executes commands.
-  permissionExecution: { field: "permissionMode", executingModes: ["bypassPermissions"], defaultMode: "acceptEdits" },
+  // Headless acceptEdits denies Bash; bypassPermissions executes commands;
+  // plan neither edits nor runs anything, the mode a judge or a preflight ask
+  // needs (measured 2026-09-27: an Opus judge left on the acceptEdits default
+  // edited the review it was grading and was blocked judge_protocol).
+  permissionExecution: { field: "permissionMode", executingModes: ["bypassPermissions"], defaultMode: "acceptEdits", readOnlyModes: ["plan"] },
 
   /** @param {import("../index.mjs").HarnessRuntime} runtime @returns {string} */
   executable(runtime) {
@@ -90,7 +157,21 @@ export const claudeHarness = {
     // a kill) for the one harness that can take it as a flag.
     if (typeof options.maxTurns === "number") args.push("--max-turns", String(options.maxTurns));
     if (options.schema) args.push("--json-schema", JSON.stringify(options.schema));
-    return { executable: this.executable(runtime), args, promptTransport: "stdin", input: prompt };
+    const env = endpointEnv(runtime);
+    return { executable: this.executable(runtime), args, promptTransport: "stdin", input: prompt, ...(env ? { env } : {}) };
+  },
+
+  /**
+   * The CLI's `total_cost_usd` applies Anthropic's rates to whatever model
+   * answered, so on another endpoint it is not what the turn cost: measured
+   * 2026-09-25, a GLM 5.3 review on the Z.ai Coding Plan reported $0.13.
+   * Such a runtime is priced like any harness that reports no cost.
+   *
+   * @param {{harness: string, config?: Record<string, unknown>}} runtime
+   * @returns {boolean}
+   */
+  reportsCost(runtime) {
+    return declaredBaseUrl(runtime) === null;
   },
 
   normalize: normalizeClaudeResult,

package/src/harnesses/dsh/index.mjs

@@ -1,6 +1,7 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { canonicalUsage, extractJson, failed, isQuotaText, isVerdictCandidate, parseJsonLines, parseVersion } from "../protocol.mjs";
+import { parseVersion } from "../protocol.mjs";
+import { normalizeRunnerTranscript, runnerEnvironmentOverlay, withSchema } from "../runner-transcript.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -103,7 +104,7 @@ export const dshHarness = {
       args,
       promptTransport: "stdin",
       input: withSchema(prompt, options.schema),
-      env: dshEnvironmentOverlay(process.env),
+      env: runnerEnvironmentOverlay(process.env),
     };
   },
 
@@ -115,122 +116,9 @@ export const dshHarness = {
    * @returns {import("../index.mjs").ProviderEnvelope}
    */
   normalize(stdout, exitCode, signal, options = {}) {
-    if (signal) return failed("canceled", `provider ended after ${signal}`, "canceled");
-    let events;
-    try {
-      events = parseJsonLines(stdout, "dsh");
-    } catch (error) {
-      return failed("invalid_protocol", error instanceof Error ? error.message : String(error));
-    }
-    const terminal = events.findLast((event) => event.type === "dsh.completed" || event.type === "dsh.failed");
-    if (!terminal) {
-      const detail = options.stderr?.trim();
-      return failed(
-        "incomplete_stream",
-        `dsh emitted no terminal event${detail ? `: ${detail.slice(-512)}` : ""}${exitCode === null ? "" : ` (exit ${exitCode})`}`,
-      );
-    }
-    const usage = canonicalUsage(terminal.usage);
-    if (terminal.type === "dsh.completed") {
-      const text = typeof terminal.result === "string" ? terminal.result : null;
-      const result = options.preferStructured ? extractJson(text) ?? text : text;
-      const verdicts = options.preferStructured ? countVerdicts(events) : null;
-      return {
-        status: result?.trim() ? "done" : "no-op",
-        result,
-        continuationId: null,
-        usage,
-        costUsd: null,
-        error: null,
-        ...(verdicts === null ? {} : { judgeCandidates: verdicts }),
-      };
-    }
-    const error = terminal.error && typeof terminal.error === "object" ? /** @type {Record<string, unknown>} */ (terminal.error) : {};
-    const kind = typeof terminal.kind === "string" ? terminal.kind : "error";
-    const code = typeof error.code === "string" && error.code ? error.code : kind;
-    const message = typeof error.message === "string" && error.message ? error.message : code;
-    const resetAt = resetTimestamp(error.retryAfterMs);
-    return {
-      status: statusFor(kind, `${code} ${message}`),
-      result: null,
-      continuationId: null,
-      usage,
-      costUsd: null,
-      error: { code, message, ...(resetAt ? { resetAt } : {}) },
-      ...(resetAt ? { exhaustedUntil: resetAt } : {}),
-    };
+    return normalizeRunnerTranscript("dsh", stdout, exitCode, signal, options);
   },
 };
 
-/**
- * The environment overlay every dsh turn spawns with. The Claude Code shell
- * exports `GIT_CONFIG_COUNT` with the VALUE half of each `GIT_CONFIG_{KEY,VALUE}_<n>`
- * pair but not the key half, so `git init` inside the worker fails with status
- * 128; the overlay removes the whole family. `GIT_TERMINAL_PROMPT=0` takes over
- * the prompting that family was for. A null value removes the ambient variable
- * when the gate merges the overlay over the runner environment.
- *
- * @param {NodeJS.ProcessEnv} env
- * @returns {Record<string, string|null>}
- */
-function dshEnvironmentOverlay(env) {
-  /** @type {Record<string, string|null>} */
-  const overlay = { GIT_TERMINAL_PROMPT: "0" };
-  for (const key of Object.keys(env)) {
-    if (key === "GIT_CONFIG_COUNT" || /^GIT_CONFIG_(?:KEY|VALUE)_\d+$/u.test(key)) overlay[key] = null;
-  }
-  return overlay;
-}
-
-/**
- * Append the output schema the judge prompt refers to. Codex and Claude receive
- * it through a native flag; this harness has none, so it travels in the prompt.
- *
- * @param {string} prompt
- * @param {object|undefined} schema
- * @returns {string}
- */
-function withSchema(prompt, schema) {
-  if (!schema) return prompt;
-  return `${prompt}\n\nOutput schema (the JSON object must validate against it):\n${JSON.stringify(schema)}`;
-}
-
-/**
- * Count the verdict-shaped final messages, the way the codex adapter does: two
- * verdicts in one turn must be visible at the provider boundary, because the
- * last one alone is indistinguishable from a single clean answer.
- *
- * @param {Record<string, unknown>[]} events
- * @returns {number}
- */
-function countVerdicts(events) {
-  return events.filter((event) => event.type === "dsh.message" && isVerdictCandidate(event.text)).length;
-}
-
-/**
- * @param {string} kind
- * @param {string} text
- * @returns {"done"|"no-op"|"blocked"|"failed"|"exhausted"|"stalled"|"canceled"}
- */
-function statusFor(kind, text) {
-  if (kind === "aborted") return "canceled";
-  if (kind === "blocked") return "blocked";
-  if (isQuotaText(text) || /insufficient balance/iu.test(text)) return "exhausted";
-  if (/permission|approval|sandbox/iu.test(text)) return "blocked";
-  return "failed";
-}
-
-/**
- * Turn the harness's relative retry hint into the absolute instant the
- * controller needs; without one it takes the failover edge instead of waiting.
- *
- * @param {unknown} retryAfterMs
- * @returns {string|null}
- */
-function resetTimestamp(retryAfterMs) {
-  if (typeof retryAfterMs !== "number" || !Number.isFinite(retryAfterMs) || retryAfterMs <= 0) return null;
-  return new Date(Date.now() + retryAfterMs).toISOString();
-}
-
 export const harness = dshHarness;
 export default dshHarness;

package/src/harnesses/dsh/runner.mjs

@@ -24,7 +24,7 @@
 
 import { spawn } from "node:child_process";
 import { spawnInvocation } from "../../host/platform.mjs";
-import { writeSync } from "node:fs";
+import { emit, readPrompt } from "../runner-io.mjs";
 
 const HANDSHAKE_ID = 1;
 const PROMPT_ID = 2;
@@ -65,22 +65,6 @@ function parseArgs(argv) {
   return options;
 }
 
-/**
- * Whole-line writes to fd 1: `process.exit` cannot lose an unfinished write.
- *
- * @param {Record<string, unknown>} event
- */
-function emit(event) {
-  const line = Buffer.from(`${JSON.stringify(event)}\n`, "utf8");
-  for (let written = 0; written < line.length; ) written += writeSync(1, line, written);
-}
-
-async function readPrompt() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
-}
-
 /**
  * @param {{inputTokens: number, outputTokens: number, cacheReadInputTokens: number}} totals
  * @param {unknown} usage

package/src/harnesses/fx/home.mjs

@@ -0,0 +1,57 @@
+/**
+ * The HOME an fx worker runs under. fx reads provider connections only from
+ * `$HOME/.fx/settings.json` and has no flag or variable that names another
+ * settings file, so pointing a worker at its own usage relay means giving it
+ * its own HOME. The same boundary closes the packet: fx loads every skill it
+ * finds under `~/.fx`, `~/.claude`, `~/.codex`, `~/.agents` and
+ * `~/.config/opencode` (fx 0.0.11 `skill_runtime.zig`), none of which a closed
+ * task packet asked for.
+ *
+ * Everything else in the operator's HOME is linked in, because the worker's
+ * shell inherits this HOME: git identity, npm and toolchain caches, and
+ * version managers keep resolving to the real files.
+ */
+
+import { mkdirSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Top-level HOME entries fx scans for skills or reads as its own profile. */
+const WITHHELD = new Set([".fx", ".claude", ".codex", ".agents"]);
+/** Entries under `~/.config` fx scans for skills. */
+const WITHHELD_CONFIG = new Set(["opencode"]);
+
+/**
+ * @param {string} realHome
+ * @param {string} home an empty directory the caller owns and removes
+ * @param {Record<string, unknown>} settings the complete fx settings document
+ */
+export function prepareFxHome(realHome, home, settings) {
+  linkEntries(realHome, home, WITHHELD, ".config");
+  const config = join(home, ".config");
+  mkdirSync(config, { recursive: true });
+  linkEntries(join(realHome, ".config"), config, WITHHELD_CONFIG, null);
+  // fx on Linux refuses a profile directory others can read
+  // (`private_state_permissions_unsupported`); macOS did not check.
+  mkdirSync(join(home, ".fx"), { recursive: true, mode: 0o700 });
+  writeFileSync(join(home, ".fx", "settings.json"), `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600 });
+}
+
+/**
+ * @param {string} from
+ * @param {string} to
+ * @param {Set<string>} withheld
+ * @param {string|null} rebuilt an entry the caller recreates as a real directory
+ */
+function linkEntries(from, to, withheld, rebuilt) {
+  let entries;
+  try {
+    entries = readdirSync(from);
+  } catch {
+    // An operator without `~/.config` has nothing to link from it.
+    return;
+  }
+  for (const entry of entries) {
+    if (withheld.has(entry) || entry === rebuilt) continue;
+    symlinkSync(join(from, entry), join(to, entry));
+  }
+}