harnery 0.40.0 → 0.42.0

package/src/core/supervisor/hook-health.ts

@@ -1,3 +1,4 @@
+import { type EventAdapterIdV3, normalizeEventAdapterIdV3 } from "../events/v3/adapter-id.ts";
 import {
   HOOK_HEALTH_EVENT,
   HOOK_HEALTH_RECEIPT_VERSION,
@@ -18,7 +19,7 @@ export interface CompletedHookHealth {
   id: string;
   observed_at: string;
   hook_name: string;
-  adapter: "claude-code" | "codex" | "cursor" | "unknown";
+  adapter: EventAdapterIdV3 | "unknown";
   outcome: HookHealthOutcome;
   duration_ms: number;
   rss_start_bytes: number;
@@ -267,9 +268,8 @@ function token(value: unknown): string | undefined {
 }
 
 function adapterValue(value: unknown): CompletedHookHealth["adapter"] | undefined {
-  return value === "claude-code" || value === "codex" || value === "cursor" || value === "unknown"
-    ? value
-    : undefined;
+  if (value === "unknown") return value;
+  return normalizeEventAdapterIdV3(value) ?? undefined;
 }
 
 function outcomeValue(value: unknown): HookHealthOutcome | undefined {

package/src/core/supervisor/service.ts

@@ -28,6 +28,7 @@ import { readResourceServiceStatus } from "../resources/service-status.ts";
 import { resourcePaths } from "../resources/storage.ts";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.ts";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.ts";
+import { stateDirMode, stateFileMode } from "../storage/modes.ts";
 import { collectSupervisorActivitySnapshot } from "./activity.ts";
 import {
   SUPERVISOR_PRESSURE_SCHEMA_VERSION,
@@ -103,7 +104,7 @@ export async function spawnSupervisor(
   const intervalMs = normalizeInterval(options.intervalMs);
   const idleExitMs = normalizeIdleExit(options.idleExitMs);
   const paths = supervisorPaths(coordRoot);
-  mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+  mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
   rmSync(paths.stop, { force: true });
   const cliPath = fileURLToPath(
     new URL(import.meta.url.endsWith(".ts") ? "../../cli.ts" : "../../cli.js", import.meta.url),
@@ -170,7 +171,7 @@ export function requestSupervisorStop(coordRootRaw: string): SupervisorStatus {
   const coordRoot = resolve(coordRootRaw);
   const paths = supervisorPaths(coordRoot);
   const status = readSupervisorStatus(coordRoot);
-  mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+  mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
   writePrivateJsonAtomic(paths.stop, {
     requested_at: new Date().toISOString(),
     requested_by_pid: process.pid,
@@ -352,8 +353,8 @@ export async function runSupervisor(
           });
         }
         pressureHysteresis = assessment.hysteresis;
-        mkdirSync(paths.timelines, { recursive: true, mode: 0o700 });
-        mkdirSync(paths.explanations, { recursive: true, mode: 0o700 });
+        mkdirSync(paths.timelines, { recursive: true, mode: stateDirMode() });
+        mkdirSync(paths.explanations, { recursive: true, mode: stateDirMode() });
         const projectionUpdates = [
           ...findings.active.filter((finding) => !priorActiveFindingIds.has(finding.id)),
           ...findings.transitions.filter(
@@ -495,7 +496,7 @@ function observeLedgerControlState(
 
 function acquireLease(coordRoot: string, now: Date): SupervisorLease {
   const paths = supervisorPaths(coordRoot);
-  mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+  mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
   for (let attempt = 0; attempt < 2; attempt++) {
     const startToken = processStartToken(process.pid);
     const lease: SupervisorLease = {
@@ -506,7 +507,7 @@ function acquireLease(coordRoot: string, now: Date): SupervisorLease {
       created_at: now.toISOString(),
     };
     try {
-      const fd = openSync(paths.lease, "wx", 0o600);
+      const fd = openSync(paths.lease, "wx", stateFileMode());
       try {
         writeFileSync(fd, `${JSON.stringify(lease)}\n`, "utf8");
       } finally {

package/src/core/work/state.ts

@@ -17,6 +17,7 @@ import {
   appendSegmentedJsonlFile,
   readSegmentedJsonlFileSync,
 } from "../storage/durable-history.ts";
+import { stateDirMode, stateFileMode } from "../storage/modes.ts";
 import { readWorkflowApproval } from "../workflow/approvals.ts";
 import { stableDigest } from "../workflow/durable-record.ts";
 import { readWorkflowProof } from "../workflow/proof.ts";
@@ -260,9 +261,9 @@ export function createWorkItem(input: CreateWorkItemInput): WorkRecord {
     created_at: new Date().toISOString(),
   };
   const dir = workDir(coordRoot, id);
-  mkdirSync(dirname(dir), { recursive: true, mode: 0o700 });
-  mkdirSync(dir, { mode: 0o700 });
-  chmodSync(dir, 0o700);
+  mkdirSync(dirname(dir), { recursive: true, mode: stateDirMode() });
+  mkdirSync(dir, { mode: stateDirMode() });
+  chmodSync(dir, stateDirMode());
   writePrivateJson(join(dir, "intent.json"), intent, MAX_INTENT_BYTES);
   const release = acquireWorkLease(coordRoot, id);
   try {
@@ -1250,13 +1251,13 @@ function acquireWorkFileLease(
   };
   const acquire = (): boolean => {
     try {
-      const fd = openSync(path, "wx", 0o600);
+      const fd = openSync(path, "wx", stateFileMode());
       try {
         writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
       } finally {
         closeSync(fd);
       }
-      chmodSync(path, 0o600);
+      chmodSync(path, stateFileMode());
       return true;
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
@@ -1337,8 +1338,8 @@ function writePrivateJson(path: string, value: unknown, maxBytes: number): void
   const body = `${JSON.stringify(value, null, 2)}\n`;
   if (Buffer.byteLength(body) > maxBytes)
     throw new Error(`private record exceeds ${maxBytes} bytes`);
-  writeFileSync(path, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
-  chmodSync(path, 0o600);
+  writeFileSync(path, body, { encoding: "utf8", flag: "wx", mode: stateFileMode() });
+  chmodSync(path, stateFileMode());
 }
 
 function readBoundedLines(

package/src/core/workflow/adapters.ts

@@ -7,6 +7,8 @@
  * but they do drift — keep this module the single place they live.
  */
 
+import type { Adapter } from "../adapter.ts";
+import { probeBinaryVersion } from "../adapters/bench.ts";
 import { BUILTIN_ADAPTER_PROFILES } from "../adapters/profiles.ts";
 import type { AdapterName } from "./types.ts";
 
@@ -24,6 +26,19 @@ export const ADAPTER_LOGIN_HINTS: Record<string, string> = Object.fromEntries(
   Object.values(BUILTIN_ADAPTER_PROFILES).map((profile) => [profile.id, profile.loginHint]),
 );
 
+/**
+ * Adapter ids whose CLI answers a version probe on this machine's PATH, in
+ * `BUILTIN_ADAPTER_PROFILES` order. The probe is injectable so callers can keep
+ * tests deterministic instead of keying on the host's toolchain.
+ */
+export function detectInstalledAdapters(
+  probe: (binary: string) => unknown = probeBinaryVersion,
+): Adapter[] {
+  return (Object.keys(ADAPTER_BINARIES) as Adapter[]).filter(
+    (id) => probe(ADAPTER_BINARIES[id]) !== null,
+  );
+}
+
 /** One-line "it's missing, here's the fix" string for spawn adapters. */
 export function notFoundError(adapter: AdapterName): string {
   const binary = ADAPTER_BINARIES[adapter] ?? adapter;

package/src/core/workflow/approvals.ts

@@ -12,6 +12,7 @@ import {
 } from "node:fs";
 import { dirname, join } from "node:path";
 import type { PolicyEvaluation, PolicyRequestSummary, PolicyVerdict } from "../policy/index.ts";
+import { stateDirMode, stateFileMode } from "../storage/modes.ts";
 import { appendWorkflowTranscriptEvent } from "./transcript.ts";
 
 export const WORKFLOW_APPROVAL_SCHEMA_VERSION = 1 as const;
@@ -108,8 +109,8 @@ export function createWorkflowApproval(input: CreateWorkflowApprovalInput): {
     request_sha256: requestSha256,
   };
   const dir = approvalDir(input.coordRoot, id);
-  mkdirSync(dir, { recursive: true, mode: 0o700 });
-  chmodSync(dir, 0o700);
+  mkdirSync(dir, { recursive: true, mode: stateDirMode() });
+  chmodSync(dir, stateDirMode());
   const created = writeExclusiveJson(join(dir, "request.json"), record);
   const approval = readWorkflowApproval(input.coordRoot, id);
   if (
@@ -249,17 +250,17 @@ function writeExclusiveJson(path: string, value: unknown): boolean {
   if (Buffer.byteLength(body) > RECORD_LIMIT_BYTES) {
     throw new Error(`approval record exceeds ${RECORD_LIMIT_BYTES} bytes`);
   }
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   try {
-    writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
+    writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: stateFileMode() });
     try {
       linkSync(temporary, path);
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code === "EEXIST") return false;
       throw error;
     }
-    chmodSync(path, 0o600);
+    chmodSync(path, stateFileMode());
     return true;
   } finally {
     if (existsSync(temporary)) unlinkSync(temporary);

package/src/core/workflow/billing.ts

@@ -85,10 +85,7 @@ export function probeBilling(adapter: AdapterName, io: ProbeIo = {}): BillingPro
       break;
     }
     case "cursor":
-      // cursor-agent's stored-login location is not yet verified against a
-      // live install (adapter itself is pending verification); never claim
-      // presence or absence we can't prove.
-      login = "unknown";
+      login = probeCursorLogin(env, home);
       break;
     default:
       // External adapters own their authentication. The generic engine must
@@ -126,6 +123,39 @@ function probeClaudeLogin(home: string): LoginState {
   return existsSync(dir) ? "unknown" : "absent";
 }
 
+/**
+ * cursor-agent: the stored login is `auth.json` holding `accessToken` and
+ * `refreshToken`. The path follows the CLI's own resolution, read from the
+ * installed 2026.09.18 build: `$CURSOR_CONFIG_DIR` when set, else
+ * `%APPDATA%\\cursor` on Windows, `~/.cursor` on macOS, and
+ * `$XDG_CONFIG_HOME/cursor` (default `~/.config/cursor`) elsewhere.
+ * `cursor-agent status --format json` reports the same two tokens as
+ * `hasAccessToken` / `hasRefreshToken`.
+ */
+function probeCursorLogin(env: NodeJS.ProcessEnv, home: string): LoginState {
+  const authPath = join(cursorConfigDir(env, home), "auth.json");
+  if (!existsSync(authPath)) return "absent";
+  try {
+    const parsed = JSON.parse(readFileSync(authPath, "utf8")) as {
+      accessToken?: string;
+      refreshToken?: string;
+    };
+    return parsed.accessToken?.trim() || parsed.refreshToken?.trim() ? "present" : "absent";
+  } catch {
+    return "unknown";
+  }
+}
+
+function cursorConfigDir(env: NodeJS.ProcessEnv, home: string): string {
+  const override = env.CURSOR_CONFIG_DIR?.trim();
+  if (override) return override;
+  const platform = env.HARNERY_BILLING_PLATFORM?.trim() || process.platform;
+  if (platform === "win32")
+    return join(env.APPDATA?.trim() || join(home, "AppData", "Roaming"), "cursor");
+  if (platform === "darwin") return join(home, ".cursor");
+  return join(env.XDG_CONFIG_HOME?.trim() || join(home, ".config"), "cursor");
+}
+
 /** codex: auth lives at $CODEX_HOME/auth.json (default ~/.codex). A `tokens`
  * object means a ChatGPT (subscription) login; an OPENAI_API_KEY field means
  * a stored API key (`codex login --api-key`). */

package/src/core/workflow/durable-record.ts

@@ -13,6 +13,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname } from "node:path";
+import { stateDirMode, stateFileMode } from "../storage/modes.ts";
 
 const JSON_LIMIT = 512 * 1024;
 
@@ -33,18 +34,18 @@ export function writeImmutableJson(path: string, value: unknown): boolean {
   if (Buffer.byteLength(body) > JSON_LIMIT) {
     throw new Error(`immutable record exceeds ${JSON_LIMIT} bytes`);
   }
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, body, "utf8");
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
     try {
       linkSync(temporary, path);
-      chmodSync(path, 0o600);
+      chmodSync(path, stateFileMode());
       fsyncParentDirectory(path);
       return true;
     } catch (error) {

package/src/core/workflow/engine.ts

@@ -21,6 +21,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { workflowWorkerFullAccessConfig } from "../config.ts";
 import { snapshotRepo } from "../context/index.ts";
 import type {
   ExternalMutationRequest,
@@ -69,6 +70,7 @@ import type {
   BlockedInput,
   EngineOpts,
   GitAdministrativeGrant,
+  ParentAccessEvidence,
   RunReport,
   SpawnFilesystemPolicy,
   SpawnResult,
@@ -88,6 +90,11 @@ import type {
 import { WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION } from "./types.ts";
 import { parseStageOutput, validateAgainstSchema } from "./validate.ts";
 import { freezeWorkflowWorkContext } from "./work-context.ts";
+import {
+  decideWorkerAccess,
+  detectParentAccess,
+  parseWorkerFullAccessPolicy,
+} from "./worker-access.ts";
 import {
   attestTerminal,
   attestWorkspaceFailure,
@@ -464,6 +471,13 @@ async function executeWorkflow(
         writableRoots: [...(requestedPolicy.writableRoots ?? []), ...gitGrantRoots],
       }
     : undefined;
+  // Worker full access (ADR 0192) is decided per launch. The host policy is
+  // read once per run; the parent probe runs at most once, and only when a
+  // launch has already cleared every cheaper condition.
+  const workerFullAccess = parseWorkerFullAccessPolicy(
+    workflowWorkerFullAccessConfig(opts.coordRoot),
+  );
+  let parentAccess: ParentAccessEvidence | undefined;
   const executionRepoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(executionCwd);
   if (!resumeState) {
     writeWorkflowRunManifest({
@@ -992,6 +1006,22 @@ async function executeWorkflow(
 
     if (!spawnCountClaimed) agentsSpawned++;
 
+    const access = decideWorkerAccess({
+      adapter,
+      model: agentOpts.model,
+      effort: agentOpts.effort,
+      policy: workerFullAccess,
+      filesystemPolicy,
+      parent: () => {
+        if (!parentAccess) {
+          parentAccess = (opts.detectParentAccess ?? detectParentAccess)();
+          transcript("worker_access.parent", { ...parentAccess });
+        }
+        return parentAccess;
+      },
+    });
+    agentProof.access = access;
+
     await acquire();
     try {
       await ensureDiagnosticAdmissionObserved();
@@ -1003,7 +1033,11 @@ async function executeWorkflow(
         specialist: agentOpts.specialist ?? null,
         model: agentOpts.model ?? null,
         effort: agentOpts.effort ?? null,
+        access,
       });
+      if (access.mode === "full-access") {
+        log(`[access] ${id} ${adapter}: full access (${access.detail})`);
+      }
       log(`[${name}] ${currentStage || "(no stage)"} → ${id} [${adapter}] ${label}`);
 
       // Headless children do not reliably fire adapter hooks. The engine owns
@@ -1033,7 +1067,10 @@ async function executeWorkflow(
           runId,
           agentId: id,
           subscriptionOnly,
-          filesystemPolicy,
+          // A full-access launch has no sandbox to project a policy into.
+          ...(access.mode === "full-access"
+            ? { access: "full-access" as const }
+            : { filesystemPolicy }),
         });
         agentProof.attempts = attempt;
         agentProof.duration_ms += last.durationMs;

package/src/core/workflow/live-session-v3.ts

@@ -1,4 +1,4 @@
-import type { Adapter } from "../adapter.ts";
+import { type Adapter, adapterFromPlatform } from "../adapter.ts";
 import { recordLiveTaskChangeV3 } from "../agents/live-authority-v3.ts";
 import { endSessionExplicitV3 } from "../agents/session-finalizer-v3.ts";
 import {
@@ -115,8 +115,7 @@ function requireV3Route(coordRoot: string) {
 }
 
 function workflowAdapter(adapter: string | undefined): Adapter {
-  if (adapter === "codex" || adapter === "cursor" || adapter === "claude-code") return adapter;
-  return "claude-code";
+  return adapterFromPlatform(adapter, { context: "workflow-child" });
 }
 
 export { stableScopeId } from "./scope-id.ts";

package/src/core/workflow/run-state.ts

@@ -20,6 +20,7 @@ import {
   type PolicyNetworkAccess,
   policyDigest,
 } from "../policy/index.ts";
+import { stateFileMode } from "../storage/modes.ts";
 import { assertWorkflowRunId, readWorkflowApproval } from "./approvals.ts";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.ts";
 import { readJsonRecord, writeImmutableJson } from "./durable-record.ts";
@@ -205,13 +206,13 @@ export function acquireWorkflowResumeLease(coordRoot: string, runId: string): ()
 
   const acquire = (): boolean => {
     try {
-      const fd = openSync(path, "wx", 0o600);
+      const fd = openSync(path, "wx", stateFileMode());
       try {
         writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
       } finally {
         closeSync(fd);
       }
-      chmodSync(path, 0o600);
+      chmodSync(path, stateFileMode());
       return true;
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;

package/src/core/workflow/sandbox-projection.ts

@@ -14,8 +14,9 @@
  * not, which is worse than refusing and worse than never offering the feature.
  */
 
+import { builtinAdapterProfile } from "../adapters/profiles.ts";
 import type { AdapterSandboxProjection } from "../adapters/types.ts";
-import type { GitAdministrativeGrant, SpawnFilesystemPolicy } from "./types.ts";
+import type { GitAdministrativeGrant, SpawnFilesystemPolicy, SpawnRequest } from "./types.ts";
 import type { WorkspaceBinding } from "./workspaces/types.ts";
 
 export class SandboxProjectionError extends Error {
@@ -25,7 +26,9 @@ export class SandboxProjectionError extends Error {
     | "writable_roots_unrepresentable"
     | "no_projection"
     | "writable_root_escapes_workspace"
-    | "git_grant_unavailable";
+    | "git_grant_unavailable"
+    | "full_access_unrepresentable"
+    | "full_access_conflicts_with_policy";
 
   constructor(adapter: string, reason: SandboxProjectionError["reason"], message: string) {
     super(message);
@@ -148,3 +151,36 @@ export function resolveGitGrantRoots(
   // repeated writable root is noise in the rendered argv and in proof.
   return [...new Set([repository.gitdir.realpath, repository.common_dir.realpath])];
 }
+
+/**
+ * The vendor arguments for an unsandboxed launch, or undefined for an ordinary
+ * sandboxed one (ADR 0192).
+ *
+ * The engine decides whether a worker qualifies; this only renders the result,
+ * and refuses rather than degrades. An adapter with no declared full-access
+ * rendering cannot honor the request, and a request that also carries a
+ * filesystem policy asks for two contradictory things, so both fail before
+ * launch instead of silently picking one.
+ */
+export function resolveFullAccessArgv(
+  adapter: string,
+  req: Pick<SpawnRequest, "access" | "filesystemPolicy">,
+): readonly string[] | undefined {
+  if (req.access !== "full-access") return undefined;
+  if (req.filesystemPolicy) {
+    throw new SandboxProjectionError(
+      adapter,
+      "full_access_conflicts_with_policy",
+      `${adapter} was asked for full access and a "${req.filesystemPolicy.mode}" filesystem policy at once; a launch gets one or the other`,
+    );
+  }
+  const rendering = builtinAdapterProfile(adapter)?.fullAccess;
+  if (!rendering) {
+    throw new SandboxProjectionError(
+      adapter,
+      "full_access_unrepresentable",
+      `${adapter} declares no full-access mode, so a worker on it cannot run without its sandbox`,
+    );
+  }
+  return rendering.argv;
+}

package/src/core/workflow/spawn-claude.ts

@@ -23,7 +23,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { resolveSandboxProjection } from "./sandbox-projection.ts";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
@@ -56,6 +56,10 @@ export function buildClaudeInvocation(req: SpawnRequest): AdapterInvocation {
     "--max-turns",
     String(req.maxTurns),
   ];
+  // A qualified launch removes the permission prompt and the Bash sandbox
+  // (ADR 0192); an ordinary one leaves Claude Code's own settings in charge.
+  const fullAccess = resolveFullAccessArgv("claude-code", req);
+  if (fullAccess) argv.push(...fullAccess);
   if (req.model) argv.push("--model", req.model);
   if (req.effort) argv.push("--effort", req.effort);
   return { argv };

package/src/core/workflow/spawn-codex.ts

@@ -10,6 +10,8 @@
  *   experimental `--json` JSONL event stream.
  * - `--skip-git-repo-check` keeps non-repo cwds working; `--sandbox
  *   workspace-write` matches workflow-stage expectations (children may edit).
+ *   A launch the engine qualified for full access renders `--sandbox
+ *   danger-full-access` instead (ADR 0192).
  * - No per-run cost or session-id surface in this mode → both left undefined.
  * - No max-turns equivalent → `maxTurns` is accepted and ignored (documented
  *   in the CLI docs page).
@@ -24,13 +26,28 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { resolveSandboxProjection } from "./sandbox-projection.ts";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
 export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): AdapterInvocation {
   validateAdapterEffort("codex", req.effort);
   if (!resultFile) throw new Error("codex adapter requires a final-message result file");
+  const fullAccess = resolveFullAccessArgv("codex", req);
+  if (fullAccess) {
+    const argv = [
+      "codex",
+      "exec",
+      req.prompt,
+      "--output-last-message",
+      resultFile,
+      "--skip-git-repo-check",
+      ...fullAccess,
+    ];
+    if (req.model) argv.push("--model", req.model);
+    if (req.effort) argv.push("-c", `model_reasoning_effort=${JSON.stringify(req.effort)}`);
+    return { argv, resultFile };
+  }
   // Default stays workspace-write so an unprojected request is unchanged.
   const projection = req.filesystemPolicy
     ? resolveSandboxProjection(

package/src/core/workflow/spawn-cursor.ts

@@ -24,7 +24,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { resolveSandboxProjection } from "./sandbox-projection.ts";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
@@ -69,6 +69,10 @@ export function buildCursorInvocation(req: SpawnRequest): AdapterInvocation {
   // commands. Neither flag maps host policy into child tools; that capability
   // remains explicitly unsupported.
   const argv = ["cursor-agent", "-p", req.prompt, "--output-format", "json", "--trust", "--force"];
+  // A qualified launch also turns the Cursor sandbox off (ADR 0192); an
+  // ordinary one leaves the configured sandbox setting untouched.
+  const fullAccess = resolveFullAccessArgv("cursor", req);
+  if (fullAccess) argv.push(...fullAccess);
   if (req.model) argv.push("--model", req.model);
   return { argv };
 }