faberun 0.26.3 → 0.28.0

package/src/harnesses/catalogue.mjs

@@ -5,6 +5,14 @@ import { canonicalProvider } from "../contract/provider.mjs";
 import { errorMessage } from "../util.mjs";
 import { ANTHROPIC_MODEL_TIERS } from "./model-tiers.mjs";
 import { spawnInvocation } from "../host/platform.mjs";
+import { declaredEnvironment as claudeEnvironment } from "./claude/index.mjs";
+import { declaredEnvironment as codexEnvironment } from "./codex/index.mjs";
+import { declaredEnvironment as agyEnvironment } from "./agy/index.mjs";
+import { declaredEnvironment as dshEnvironment } from "./dsh/index.mjs";
+import { declaredEnvironment as fxEnvironment } from "./fx/index.mjs";
+import { declaredEnvironment as zcodeEnvironment } from "./zcode/index.mjs";
+import { declaredEnvironment as execJsonlEnvironment } from "./exec-jsonl/index.mjs";
+import { declaredEnvironment as replayEnvironment } from "./replay/index.mjs";
 
 /**
  * Model catalogue report: which models each registered harness can run, the
@@ -26,17 +34,39 @@ import { spawnInvocation } from "../host/platform.mjs";
  * opt-in that reads the host.
  */
 
-/** Display order of the registered harnesses: claude, codex, agy, dsh, zcode, exec-jsonl, replay. */
+/** Display order of the registered harnesses: claude, codex, agy, dsh, fx, zcode, exec-jsonl, replay. */
 export const MODEL_HARNESS_ORDER = Object.freeze([
   "claude",
   "codex",
   "agy",
   "dsh",
+  "fx",
   "zcode",
   "exec-jsonl",
   "replay",
 ]);
 
+/**
+ * The environment names each registered adapter reads to authenticate and
+ * configure itself, keyed by harness in `MODEL_HARNESS_ORDER`. Each list is the
+ * adapter's own frozen `declaredEnvironment` export, and only bare names ever
+ * travel here, never values. The worker/judge environment builder unions these
+ * names with the base operating-system set and the runtime's env keys, so a
+ * name missing from this catalogue is a name the child process never receives.
+ *
+ * @type {Readonly<Record<string, readonly string[]>>}
+ */
+export const DECLARED_HARNESS_ENVIRONMENTS = Object.freeze({
+  claude: claudeEnvironment,
+  codex: codexEnvironment,
+  agy: agyEnvironment,
+  dsh: dshEnvironment,
+  fx: fxEnvironment,
+  zcode: zcodeEnvironment,
+  "exec-jsonl": execJsonlEnvironment,
+  replay: replayEnvironment,
+});
+
 const CLAUDE_EFFORTS = Object.freeze(["low", "medium", "high", "max"]);
 const CODEX_EFFORTS = Object.freeze(["low", "medium", "high", "xhigh"]);
 const AGY_EFFORTS = Object.freeze(["low", "medium", "high"]);
@@ -78,6 +108,11 @@ export const DECLARED_MODEL_CATALOGUES = Object.freeze({
     declaredModel("claude-fable-5", { efforts: CLAUDE_EFFORTS }),
     declaredModel("claude-fable-5-1", { efforts: CLAUDE_EFFORTS }),
     declaredModel("claude-sonnet-4-6", { efforts: CLAUDE_EFFORTS }),
+    // GLM through a runtime whose `config.base_url` names Z.ai's
+    // Anthropic-compatible endpoint. The CLI sized its own window at 200,000
+    // tokens for this model (2026-09-25 result event), and `--effort` is a
+    // Claude-model flag, so no effort is declared.
+    declaredModel("glm-5.3", { contextWindowTokens: 200_000, efforts: NO_EFFORTS }),
   ]),
   codex: Object.freeze([
     declaredModel("gpt-5.6", { efforts: CODEX_EFFORTS }),
@@ -98,6 +133,20 @@ export const DECLARED_MODEL_CATALOGUES = Object.freeze({
     declaredModel("deepseek-v4-pro", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: DSH_EFFORTS, defaultEffort: "high" }),
     declaredModel("deepseek-v4-flash-vision-exp", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: DSH_EFFORTS, defaultEffort: "high" }),
   ]),
+  // The two ids api.deepseek.com/models listed on 2026-09-24. No efforts:
+  // fx's settings carry one `effort` for the Gateway catalogue and send
+  // nothing a custom Chat Completions connection is known to honour.
+  fx: Object.freeze([
+    declaredModel("deepseek-flash", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
+    declaredModel("deepseek-v4-pro", { contextWindowTokens: DSH_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
+    // GLM through a Z.ai Chat Completions endpoint named by `config.base_url`.
+    declaredModel("glm-5.3", { contextWindowTokens: GLM_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
+    // GPT through fx's ChatGPT login (`config.provider: "codex"`). Measured
+    // 2026-09-26: fx listed these among the account's seven models, and both
+    // answered a review turn through the runner.
+    declaredModel("gpt-5.6-sol", { efforts: NO_EFFORTS }),
+    declaredModel("gpt-6-sol", { efforts: NO_EFFORTS }),
+  ]),
   zcode: Object.freeze([
     declaredModel("glm-5.3-flash", { contextWindowTokens: GLM_CONTEXT_WINDOW_TOKENS, efforts: NO_EFFORTS }),
     // No `[1m]` row: the suffix is a Claude Code convention the ZCode CLI does
@@ -115,6 +164,7 @@ const CATALOGUE_SOURCES = Object.freeze({
   claude: "declared",
   codex: "declared",
   dsh: "declared",
+  fx: "declared",
   zcode: "declared",
   "exec-jsonl": "runtime-declared",
   replay: "runtime-declared",
@@ -130,18 +180,20 @@ const EFFORT_TRANSPORT = Object.freeze({
   codex: "config.model_reasoning_effort",
   agy: "--effort",
   dsh: "--reasoning (harness reasoningEffort)",
+  fx: null,
   zcode: null,
   "exec-jsonl": null,
   replay: null,
 });
 
 /**
- * Why a harness resolves no vendor: dsh, exec-jsonl, and replay declare none.
+ * Why a harness resolves no vendor: dsh, fx, exec-jsonl, and replay declare none.
  *
  * @type {Readonly<Record<string, string>>}
  */
 const VENDOR_NOTES = Object.freeze({
   dsh: "unresolved: dsh declares no default vendor; the contract names it",
+  fx: "unresolved: fx declares no default vendor; the contract names it",
   "exec-jsonl": "unresolved: exec-jsonl declares no default vendor; the contract names it",
   replay: "unresolved: replay declares no default vendor; the contract names it",
 });

package/src/harnesses/claude/index.mjs

@@ -1,6 +1,18 @@
 import { normalizeClaudeResult, parseVersion } from "../protocol.mjs";
 import { hookSettings } from "../../host/tool-policy-hook.mjs";
 
+/**
+ * The environment names the Claude adapter reads to authenticate and configure
+ * the CLI: the provider credential the CLI resolves for API-key sign-in and the
+ * binary override `executable()` honours. Values never travel here.
+ *
+ * @type {readonly string[]}
+ */
+export const declaredEnvironment = Object.freeze([
+  "ANTHROPIC_API_KEY",
+  "FABERUN_CLAUDE_BIN",
+]);
+
 /** Built-in tools a closed-packet worker needs; every other tool is preamble. */
 export const DEFAULT_CLAUDE_TOOLS = ["Read", "Edit", "Write", "Bash", "Glob", "Grep"];
 
@@ -26,6 +38,152 @@ function claudePreambleArgs(runtime) {
   ];
 }
 
+/**
+ * The envelope this adapter returns: the shared provider envelope plus the
+ * top-level reset instant a session limit names. The field has to live here
+ * rather than in `error` so that `exhaustedUntilOf` keeps parsing the sentence
+ * against the caller's clock.
+ *
+ * @typedef {import("../index.mjs").ProviderEnvelope & {resetAt?: string}} ClaudeEnvelope
+ */
+
+/**
+ * The reset sentence a Claude quota stop writes into its error message, e.g.
+ * "You've hit your session limit · resets 6:40pm (America/Sao_Paulo)". The
+ * wall-clock form names a time and a zone but no date; an absolute form names
+ * the instant directly ("Your limit will reset at 2026-09-08 20:30:00").
+ */
+const SESSION_RESET_SENTENCE = /resets?(?:\s+at)?\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)?\s*\(([A-Za-z_]+(?:\/[A-Za-z0-9_+-]+)+|UTC|GMT)\)/iu;
+const ABSOLUTE_RESET_SENTENCE = /reset(?:s| at| on)?\s+(\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}(?:Z|[+-]\d{2}:?\d{2})?)/iu;
+
+/**
+ * The instant a Claude quota stop names, or null when its message names none.
+ *
+ * The generic availability classifier (`harnesses/index.mjs`'s
+ * `exhaustedUntilOf`) parses the same sentence for the durable refusal store,
+ * but the node's own wait decision (`engine/backoff.mjs`'s
+ * `quotaResetSchedule`) reads only a structured `resetAt`. This adapter is the
+ * protocol boundary and cannot import `harnesses/index.mjs` -- that module
+ * imports this one at load -- so the sentence is parsed here. A zone the
+ * runtime does not know names no instant, and the failover edge is taken as
+ * before.
+ *
+ * @param {string} message
+ * @param {number} [now] the instant a wall-clock sentence is read against
+ * @returns {string|null}
+ */
+function sessionResetAt(message, now = Date.now()) {
+  const absolute = ABSOLUTE_RESET_SENTENCE.exec(message);
+  if (absolute) {
+    const value = absolute[1];
+    const zoned = value.includes("T") || /(?:Z|[+-]\d{2}:?\d{2})$/u.test(value) ? value : `${value.replace(" ", "T")}Z`;
+    const parsed = Date.parse(zoned);
+    if (Number.isFinite(parsed)) return new Date(parsed).toISOString();
+  }
+  const match = SESSION_RESET_SENTENCE.exec(message);
+  if (!match) return null;
+  let hour = Number(match[1]);
+  const minute = Number(match[2] ?? "0");
+  const meridiem = match[3]?.toLowerCase();
+  if (meridiem === "pm" && hour < 12) hour += 12;
+  if (meridiem === "am" && hour === 12) hour = 0;
+  if (hour > 23 || minute > 59) return null;
+  /** @type {Intl.DateTimeFormatPart[]} */
+  let parts;
+  try {
+    parts = new Intl.DateTimeFormat("en-US", { timeZone: match[4], hourCycle: "h23", year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", second: "2-digit" }).formatToParts(new Date(now));
+  } catch {
+    // An unknown zone name is not a reset time; the caller falls back to failover.
+    return null;
+  }
+  const at = (/** @type {Intl.DateTimeFormatPartTypes} */ type) => Number(parts.find((part) => part.type === type)?.value);
+  const offset = Date.UTC(at("year"), at("month") - 1, at("day"), at("hour") % 24, at("minute"), at("second")) - Math.floor(now / 1000) * 1000;
+  let target = Date.UTC(at("year"), at("month") - 1, at("day"), hour, minute) - offset;
+  if (target <= now) target += 86_400_000;
+  return new Date(target).toISOString();
+}
+
+/**
+ * Thread a session-limit reset into the envelope so the node can wait for it.
+ * The instant rides the envelope's top-level `resetAt`, the field the node's
+ * wait decision (`engine/backoff.mjs`'s `quotaResetSchedule`) reads. It is not
+ * written into `error.resetAt`/`exhaustedUntil` on purpose: `exhaustedUntilOf`
+ * must keep parsing the sentence against the clock its caller passes, so a test
+ * or a replayed envelope can re-read the same message at a chosen instant.
+ *
+ * @param {ClaudeEnvelope} envelope
+ * @returns {ClaudeEnvelope}
+ */
+function withSessionReset(envelope) {
+  if (envelope.status !== "exhausted" || envelope.resetAt) return envelope;
+  const resetAt = sessionResetAt(String(envelope.error?.message ?? ""));
+  return resetAt ? { ...envelope, resetAt } : envelope;
+}
+
+/**
+ * The environment one runtime's CLI runs under when its contract points it at
+ * an Anthropic-compatible endpoint other than Anthropic's own, e.g. GLM on
+ * the Z.ai Coding Plan, where Claude Code is one of the supported tools:
+ *
+ *   "config": { "base_url": "https://api.z.ai/api/anthropic",
+ *               "auth_token.env_key": "ZAI_API_KEY" }
+ *
+ * The overlay travels in the invocation's own command, so it reaches only
+ * this runtime's process: a controller that also runs a Claude judge on
+ * Anthropic keeps that judge on Anthropic. The token is read from the named
+ * variable at invocation time; its value never appears in the contract.
+ *
+ * A declared endpoint with no resolvable token is refused rather than run:
+ * the CLI would fall back to the operator's own Anthropic login and send that
+ * credential to the declared host. Measured 2026-09-25 on the tiny-text
+ * campaign: two parallel GLM 5.3 judges through this CLI peaked at 599 MB,
+ * where the same judges on zcode had peaked at about 1.5 GB together with
+ * the test processes.
+ *
+ * @param {import("../index.mjs").HarnessRuntime} runtime
+ * @returns {Record<string, string|null>|undefined}
+ */
+function endpointEnv(runtime) {
+  const baseUrl = declaredBaseUrl(runtime);
+  const declared = runtime.config?.["auth_token.env_key"];
+  const tokenVar = typeof declared === "string" && declared ? declared : null;
+  if (baseUrl === null && tokenVar === null) return undefined;
+  const token = tokenVar === null ? undefined : process.env[tokenVar];
+  if (typeof token !== "string" || !token) {
+    const error = /** @type {Error & {code: string}} */ (new Error(tokenVar === null
+      ? `claude runtime declares base_url ${baseUrl} without auth_token.env_key`
+      : `claude runtime declares auth_token.env_key ${tokenVar}, which is unset`));
+    error.code = "auth_token_unresolved";
+    throw error;
+  }
+  /** @type {Record<string, string|null>} */
+  const env = {
+    ANTHROPIC_AUTH_TOKEN: token,
+    // An ambient Anthropic key outranks the bearer token in the CLI.
+    ANTHROPIC_API_KEY: null,
+  };
+  if (baseUrl !== null) {
+    env.ANTHROPIC_BASE_URL = baseUrl;
+    // The CLI sends its own background requests (titles, summaries) to the
+    // alias models; another endpoint does not serve those names, so every
+    // alias resolves to the runtime's model.
+    env.ANTHROPIC_DEFAULT_OPUS_MODEL = runtime.model;
+    env.ANTHROPIC_DEFAULT_SONNET_MODEL = runtime.model;
+    env.ANTHROPIC_DEFAULT_HAIKU_MODEL = runtime.model;
+    env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
+  }
+  return env;
+}
+
+/**
+ * @param {{config?: Record<string, unknown>}} runtime
+ * @returns {string|null}
+ */
+function declaredBaseUrl(runtime) {
+  const value = runtime.config?.base_url;
+  return typeof value === "string" && value ? value : null;
+}
+
 /**
  * @type {import("../index.mjs").HarnessAdapter}
  */
@@ -93,10 +251,27 @@ export const claudeHarness = {
     // a kill) for the one harness that can take it as a flag.
     if (typeof options.maxTurns === "number") args.push("--max-turns", String(options.maxTurns));
     if (options.schema) args.push("--json-schema", JSON.stringify(options.schema));
-    return { executable: this.executable(runtime), args, promptTransport: "stdin", input: prompt };
+    const env = endpointEnv(runtime);
+    return { executable: this.executable(runtime), args, promptTransport: "stdin", input: prompt, ...(env ? { env } : {}) };
+  },
+
+  /**
+   * The CLI's `total_cost_usd` applies Anthropic's rates to whatever model
+   * answered, so on another endpoint it is not what the turn cost: measured
+   * 2026-09-25, a GLM 5.3 review on the Z.ai Coding Plan reported $0.13.
+   * Such a runtime is priced like any harness that reports no cost.
+   *
+   * @param {{harness: string, config?: Record<string, unknown>}} runtime
+   * @returns {boolean}
+   */
+  reportsCost(runtime) {
+    return declaredBaseUrl(runtime) === null;
   },
 
-  normalize: normalizeClaudeResult,
+  /** @param {string} stdout @param {number|null} exitCode @param {string|null} signal @param {import("../index.mjs").NormalizeOptions} [options] @returns {import("../index.mjs").ProviderEnvelope} */
+  normalize(stdout, exitCode, signal, options = {}) {
+    return withSessionReset(normalizeClaudeResult(stdout, exitCode, signal, options));
+  },
 };
 
 export const harness = claudeHarness;

package/src/harnesses/codex/index.mjs

@@ -1,5 +1,20 @@
 import { normalizeCodexResult, parseVersion, toml } from "../protocol.mjs";
 
+/**
+ * The environment names the Codex adapter reads to authenticate and configure
+ * the CLI: the provider credential for API-key sign-in, the config home
+ * `codexHome()` reads when it locates the session file its usage windows come
+ * from, and the binary override `executable()` honours. Values never travel
+ * here.
+ *
+ * @type {readonly string[]}
+ */
+export const declaredEnvironment = Object.freeze([
+  "CODEX_HOME",
+  "FABERUN_CODEX_BIN",
+  "OPENAI_API_KEY",
+]);
+
 /**
  * Bound the Codex harness preamble: a closed-packet worker or a read-only judge
  * needs the shell and patch tools, not browser, computer-use, app or sub-agent

package/src/harnesses/dsh/index.mjs

@@ -1,6 +1,21 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { canonicalUsage, extractJson, failed, isQuotaText, isVerdictCandidate, parseJsonLines, parseVersion } from "../protocol.mjs";
+import { parseVersion } from "../protocol.mjs";
+import { normalizeRunnerTranscript, runnerEnvironmentOverlay, withSchema } from "../runner-transcript.mjs";
+
+/**
+ * The environment names the dsh adapter reads to authenticate and configure the
+ * harness: the provider credential the dsh CLI resolves for the declared
+ * provider and the binary override `executable()` honours. The environment
+ * overlay's `GIT_CONFIG_*` scrub is a generic pass over ambient keys, not a
+ * declared dependency. Values never travel here.
+ *
+ * @type {readonly string[]}
+ */
+export const declaredEnvironment = Object.freeze([
+  "DEEPSEEK_API_KEY",
+  "FABERUN_DSH_BIN",
+]);
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -103,7 +118,7 @@ export const dshHarness = {
       args,
       promptTransport: "stdin",
       input: withSchema(prompt, options.schema),
-      env: dshEnvironmentOverlay(process.env),
+      env: runnerEnvironmentOverlay(process.env),
     };
   },
 
@@ -115,122 +130,9 @@ export const dshHarness = {
    * @returns {import("../index.mjs").ProviderEnvelope}
    */
   normalize(stdout, exitCode, signal, options = {}) {
-    if (signal) return failed("canceled", `provider ended after ${signal}`, "canceled");
-    let events;
-    try {
-      events = parseJsonLines(stdout, "dsh");
-    } catch (error) {
-      return failed("invalid_protocol", error instanceof Error ? error.message : String(error));
-    }
-    const terminal = events.findLast((event) => event.type === "dsh.completed" || event.type === "dsh.failed");
-    if (!terminal) {
-      const detail = options.stderr?.trim();
-      return failed(
-        "incomplete_stream",
-        `dsh emitted no terminal event${detail ? `: ${detail.slice(-512)}` : ""}${exitCode === null ? "" : ` (exit ${exitCode})`}`,
-      );
-    }
-    const usage = canonicalUsage(terminal.usage);
-    if (terminal.type === "dsh.completed") {
-      const text = typeof terminal.result === "string" ? terminal.result : null;
-      const result = options.preferStructured ? extractJson(text) ?? text : text;
-      const verdicts = options.preferStructured ? countVerdicts(events) : null;
-      return {
-        status: result?.trim() ? "done" : "no-op",
-        result,
-        continuationId: null,
-        usage,
-        costUsd: null,
-        error: null,
-        ...(verdicts === null ? {} : { judgeCandidates: verdicts }),
-      };
-    }
-    const error = terminal.error && typeof terminal.error === "object" ? /** @type {Record<string, unknown>} */ (terminal.error) : {};
-    const kind = typeof terminal.kind === "string" ? terminal.kind : "error";
-    const code = typeof error.code === "string" && error.code ? error.code : kind;
-    const message = typeof error.message === "string" && error.message ? error.message : code;
-    const resetAt = resetTimestamp(error.retryAfterMs);
-    return {
-      status: statusFor(kind, `${code} ${message}`),
-      result: null,
-      continuationId: null,
-      usage,
-      costUsd: null,
-      error: { code, message, ...(resetAt ? { resetAt } : {}) },
-      ...(resetAt ? { exhaustedUntil: resetAt } : {}),
-    };
+    return normalizeRunnerTranscript("dsh", stdout, exitCode, signal, options);
   },
 };
 
-/**
- * The environment overlay every dsh turn spawns with. The Claude Code shell
- * exports `GIT_CONFIG_COUNT` with the VALUE half of each `GIT_CONFIG_{KEY,VALUE}_<n>`
- * pair but not the key half, so `git init` inside the worker fails with status
- * 128; the overlay removes the whole family. `GIT_TERMINAL_PROMPT=0` takes over
- * the prompting that family was for. A null value removes the ambient variable
- * when the gate merges the overlay over the runner environment.
- *
- * @param {NodeJS.ProcessEnv} env
- * @returns {Record<string, string|null>}
- */
-function dshEnvironmentOverlay(env) {
-  /** @type {Record<string, string|null>} */
-  const overlay = { GIT_TERMINAL_PROMPT: "0" };
-  for (const key of Object.keys(env)) {
-    if (key === "GIT_CONFIG_COUNT" || /^GIT_CONFIG_(?:KEY|VALUE)_\d+$/u.test(key)) overlay[key] = null;
-  }
-  return overlay;
-}
-
-/**
- * Append the output schema the judge prompt refers to. Codex and Claude receive
- * it through a native flag; this harness has none, so it travels in the prompt.
- *
- * @param {string} prompt
- * @param {object|undefined} schema
- * @returns {string}
- */
-function withSchema(prompt, schema) {
-  if (!schema) return prompt;
-  return `${prompt}\n\nOutput schema (the JSON object must validate against it):\n${JSON.stringify(schema)}`;
-}
-
-/**
- * Count the verdict-shaped final messages, the way the codex adapter does: two
- * verdicts in one turn must be visible at the provider boundary, because the
- * last one alone is indistinguishable from a single clean answer.
- *
- * @param {Record<string, unknown>[]} events
- * @returns {number}
- */
-function countVerdicts(events) {
-  return events.filter((event) => event.type === "dsh.message" && isVerdictCandidate(event.text)).length;
-}
-
-/**
- * @param {string} kind
- * @param {string} text
- * @returns {"done"|"no-op"|"blocked"|"failed"|"exhausted"|"stalled"|"canceled"}
- */
-function statusFor(kind, text) {
-  if (kind === "aborted") return "canceled";
-  if (kind === "blocked") return "blocked";
-  if (isQuotaText(text) || /insufficient balance/iu.test(text)) return "exhausted";
-  if (/permission|approval|sandbox/iu.test(text)) return "blocked";
-  return "failed";
-}
-
-/**
- * Turn the harness's relative retry hint into the absolute instant the
- * controller needs; without one it takes the failover edge instead of waiting.
- *
- * @param {unknown} retryAfterMs
- * @returns {string|null}
- */
-function resetTimestamp(retryAfterMs) {
-  if (typeof retryAfterMs !== "number" || !Number.isFinite(retryAfterMs) || retryAfterMs <= 0) return null;
-  return new Date(Date.now() + retryAfterMs).toISOString();
-}
-
 export const harness = dshHarness;
 export default dshHarness;

package/src/harnesses/dsh/runner.mjs

@@ -24,7 +24,7 @@
 
 import { spawn } from "node:child_process";
 import { spawnInvocation } from "../../host/platform.mjs";
-import { writeSync } from "node:fs";
+import { emit, readPrompt } from "../runner-io.mjs";
 
 const HANDSHAKE_ID = 1;
 const PROMPT_ID = 2;
@@ -65,22 +65,6 @@ function parseArgs(argv) {
   return options;
 }
 
-/**
- * Whole-line writes to fd 1: `process.exit` cannot lose an unfinished write.
- *
- * @param {Record<string, unknown>} event
- */
-function emit(event) {
-  const line = Buffer.from(`${JSON.stringify(event)}\n`, "utf8");
-  for (let written = 0; written < line.length; ) written += writeSync(1, line, written);
-}
-
-async function readPrompt() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
-}
-
 /**
  * @param {{inputTokens: number, outputTokens: number, cacheReadInputTokens: number}} totals
  * @param {unknown} usage

package/src/harnesses/exec-jsonl/index.mjs

@@ -31,6 +31,18 @@ import { finite } from "../../util.mjs";
 
 export { HARNESS_OUTPUT_LIMIT_BYTES } from "../protocol.mjs";
 
+/**
+ * The environment names the exec-jsonl adapter reads to authenticate and
+ * configure the wrapper: only the binary override `executable()` honours.
+ * Credentials belong to the wrapper the contract names, so the adapter reads
+ * none of them. Values never travel here.
+ *
+ * @type {readonly string[]}
+ */
+export const declaredEnvironment = Object.freeze([
+  "FABERUN_EXEC_JSONL_BIN",
+]);
+
 export const EXEC_JSONL_PROTOCOL = Object.freeze({
   schemaVersion: 1,
   requestType: "run.request",

package/src/harnesses/fx/home.mjs

@@ -0,0 +1,57 @@
+/**
+ * The HOME an fx worker runs under. fx reads provider connections only from
+ * `$HOME/.fx/settings.json` and has no flag or variable that names another
+ * settings file, so pointing a worker at its own usage relay means giving it
+ * its own HOME. The same boundary closes the packet: fx loads every skill it
+ * finds under `~/.fx`, `~/.claude`, `~/.codex`, `~/.agents` and
+ * `~/.config/opencode` (fx 0.0.11 `skill_runtime.zig`), none of which a closed
+ * task packet asked for.
+ *
+ * Everything else in the operator's HOME is linked in, because the worker's
+ * shell inherits this HOME: git identity, npm and toolchain caches, and
+ * version managers keep resolving to the real files.
+ */
+
+import { mkdirSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Top-level HOME entries fx scans for skills or reads as its own profile. */
+const WITHHELD = new Set([".fx", ".claude", ".codex", ".agents"]);
+/** Entries under `~/.config` fx scans for skills. */
+const WITHHELD_CONFIG = new Set(["opencode"]);
+
+/**
+ * @param {string} realHome
+ * @param {string} home an empty directory the caller owns and removes
+ * @param {Record<string, unknown>} settings the complete fx settings document
+ */
+export function prepareFxHome(realHome, home, settings) {
+  linkEntries(realHome, home, WITHHELD, ".config");
+  const config = join(home, ".config");
+  mkdirSync(config, { recursive: true });
+  linkEntries(join(realHome, ".config"), config, WITHHELD_CONFIG, null);
+  // fx on Linux refuses a profile directory others can read
+  // (`private_state_permissions_unsupported`); macOS did not check.
+  mkdirSync(join(home, ".fx"), { recursive: true, mode: 0o700 });
+  writeFileSync(join(home, ".fx", "settings.json"), `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600 });
+}
+
+/**
+ * @param {string} from
+ * @param {string} to
+ * @param {Set<string>} withheld
+ * @param {string|null} rebuilt an entry the caller recreates as a real directory
+ */
+function linkEntries(from, to, withheld, rebuilt) {
+  let entries;
+  try {
+    entries = readdirSync(from);
+  } catch {
+    // An operator without `~/.config` has nothing to link from it.
+    return;
+  }
+  for (const entry of entries) {
+    if (withheld.has(entry) || entry === rebuilt) continue;
+    symlinkSync(join(from, entry), join(to, entry));
+  }
+}