harnery 0.41.0 → 0.42.0

package/dist/core/servers/net.js

@@ -0,0 +1,270 @@
+/**
+ * Local socket and process observation for the server registry.
+ *
+ * Linux reads procfs directly (no `ss`/`lsof` dependency, works under WSL).
+ * macOS shells out to `lsof` and `ps`. Other platforms report `unsupported`
+ * so callers can say the scan did not run rather than implying it found
+ * nothing.
+ */
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync, readlinkSync } from "node:fs";
+export function scanSupport() {
+    if (process.platform === "linux")
+        return "procfs";
+    if (process.platform === "darwin")
+        return "lsof";
+    return "unsupported";
+}
+/** Parse `/proc/net/tcp` or `/proc/net/tcp6` content. */
+export function parseProcNetTcp(content) {
+    const rows = [];
+    for (const line of content.split("\n").slice(1)) {
+        const fields = line.trim().split(/\s+/);
+        if (fields.length < 10)
+            continue;
+        const [address, portHex] = (fields[1] ?? "").split(":");
+        if (!address || !portHex)
+            continue;
+        rows.push({
+            localAddress: decodeProcAddress(address),
+            localPort: Number.parseInt(portHex, 16),
+            state: fields[3] ?? "",
+            inode: fields[9] ?? "",
+        });
+    }
+    return rows;
+}
+function decodeProcAddress(hex) {
+    if (hex.length === 8) {
+        const bytes = hex.match(/../g)?.map((pair) => Number.parseInt(pair, 16)) ?? [];
+        return bytes.reverse().join(".");
+    }
+    if (/^0+$/.test(hex))
+        return "::";
+    if (hex === "00000000000000000000000001000000")
+        return "::1";
+    if (hex.startsWith("0000000000000000FFFF0000"))
+        return decodeProcAddress(hex.slice(24));
+    return `ipv6:${hex.toLowerCase()}`;
+}
+function readProcSockets() {
+    const rows = [];
+    for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+        try {
+            rows.push(...parseProcNetTcp(readFileSync(file, "utf8")));
+        }
+        catch {
+            // tcp6 is absent on IPv6-disabled kernels.
+        }
+    }
+    return rows;
+}
+/** Map socket inodes to the pids holding them (only processes we may read). */
+function socketOwners(inodes) {
+    const owners = new Map();
+    if (inodes.size === 0)
+        return owners;
+    let entries;
+    try {
+        entries = readdirSync("/proc");
+    }
+    catch {
+        return owners;
+    }
+    for (const entry of entries) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        let fds;
+        try {
+            fds = readdirSync(`/proc/${entry}/fd`);
+        }
+        catch {
+            continue;
+        }
+        for (const fd of fds) {
+            let target;
+            try {
+                target = readlinkSync(`/proc/${entry}/fd/${fd}`);
+            }
+            catch {
+                continue;
+            }
+            const match = /^socket:\[(\d+)\]$/.exec(target);
+            if (match?.[1] && inodes.has(match[1]) && !owners.has(match[1])) {
+                owners.set(match[1], Number(entry));
+            }
+        }
+        if (owners.size === inodes.size)
+            break;
+    }
+    return owners;
+}
+/** Listening TCP sockets whose owning process this user can see. */
+export function listListeningSockets() {
+    const support = scanSupport();
+    if (support === "procfs") {
+        const listening = readProcSockets().filter((row) => row.state === "0A");
+        const owners = socketOwners(new Set(listening.map((row) => row.inode)));
+        const seen = new Set();
+        const sockets = [];
+        for (const row of listening) {
+            const pid = owners.get(row.inode);
+            if (!pid)
+                continue;
+            const key = `${pid}:${row.localPort}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            sockets.push({ pid, port: row.localPort, address: row.localAddress });
+        }
+        return sockets.sort((a, b) => a.port - b.port);
+    }
+    if (support === "lsof")
+        return lsofListeningSockets();
+    return [];
+}
+/**
+ * Every listening TCP port on this machine, including ports whose owner this
+ * user cannot see (containers, other users). Used to avoid port collisions.
+ */
+export function listListeningPorts() {
+    const support = scanSupport();
+    if (support === "procfs")
+        return new Set(readProcSockets()
+            .filter((row) => row.state === "0A")
+            .map((row) => row.localPort));
+    if (support === "lsof")
+        return new Set(listListeningSockets().map((socket) => socket.port));
+    return new Set();
+}
+/** Parse `lsof -Fpn` output for listening sockets. */
+export function parseLsofListen(output) {
+    const sockets = [];
+    const seen = new Set();
+    let pid = 0;
+    for (const line of output.split("\n")) {
+        if (line.startsWith("p"))
+            pid = Number(line.slice(1));
+        else if (line.startsWith("n") && pid > 0) {
+            const match = /^(.*):(\d+)$/.exec(line.slice(1));
+            if (!match?.[2])
+                continue;
+            const port = Number(match[2]);
+            const key = `${pid}:${port}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            sockets.push({ pid, port, address: (match[1] ?? "").replace(/^\[|\]$/g, "") });
+        }
+    }
+    return sockets.sort((a, b) => a.port - b.port);
+}
+/**
+ * Count established server-side connections per local port. A browser tab
+ * holding a live-reload socket or keep-alive connection counts as activity.
+ */
+export function establishedConnectionCounts(ports) {
+    const counts = new Map();
+    const wanted = new Set(ports.filter((port) => Number.isInteger(port) && port > 0));
+    if (wanted.size === 0)
+        return counts;
+    const support = scanSupport();
+    if (support === "procfs") {
+        for (const row of readProcSockets()) {
+            // 01 ESTABLISHED; 03 SYN_RECV, where a deferred-accept server parks a
+            // connected client until its first bytes arrive.
+            if ((row.state !== "01" && row.state !== "03") || !wanted.has(row.localPort))
+                continue;
+            counts.set(row.localPort, (counts.get(row.localPort) ?? 0) + 1);
+        }
+        return counts;
+    }
+    if (support === "lsof")
+        return lsofConnectionCounts(wanted);
+    return counts;
+}
+/** Listening sockets via `lsof` (the macOS path; also runs wherever lsof exists). */
+export function lsofListeningSockets() {
+    return parseLsofListen(run("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-Fpn"]));
+}
+/** Server-side established connections per wanted local port, via `lsof`. */
+export function lsofConnectionCounts(wanted) {
+    const counts = new Map();
+    const output = run("lsof", ["-nP", "-iTCP", "-sTCP:ESTABLISHED", "-Fn"]);
+    for (const line of output.split("\n")) {
+        const match = /^n.*?:(\d+)->/.exec(line);
+        const port = match?.[1] ? Number(match[1]) : 0;
+        if (wanted.has(port))
+            counts.set(port, (counts.get(port) ?? 0) + 1);
+    }
+    return counts;
+}
+/** Parent, command line, and working directory via `ps` and `lsof` (the macOS path). */
+export function psProcessInfo(pid) {
+    const ps = run("ps", ["-o", "ppid=,command=", "-p", String(pid)]).trim();
+    if (!ps)
+        return null;
+    const match = /^(\d+)\s+(.*)$/.exec(ps);
+    const cwdLine = run("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"])
+        .split("\n")
+        .find((line) => line.startsWith("n"));
+    return {
+        pid,
+        ppid: match?.[1] ? Number(match[1]) : null,
+        command: match?.[2] ?? ps,
+        cwd: cwdLine ? cwdLine.slice(1) : null,
+    };
+}
+export function readProcessInfo(pid) {
+    if (process.platform === "linux") {
+        try {
+            const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+            const afterComm = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+            const ppid = Number(afterComm[1]);
+            const command = readFileSync(`/proc/${pid}/cmdline`, "utf8").split("\0").join(" ").trim();
+            let cwd = null;
+            try {
+                cwd = readlinkSync(`/proc/${pid}/cwd`);
+            }
+            catch {
+                cwd = null;
+            }
+            return { pid, ppid: Number.isInteger(ppid) ? ppid : null, command, cwd };
+        }
+        catch {
+            return null;
+        }
+    }
+    if (process.platform === "darwin")
+        return psProcessInfo(pid);
+    return null;
+}
+/** Parse `ps -o etime=` output (`[[dd-]hh:]mm:ss`) into seconds. */
+export function parseElapsed(value) {
+    const match = /^\s*(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)\s*$/.exec(value);
+    if (!match)
+        return null;
+    const [, days, hours, minutes, seconds] = match;
+    return (Number(days ?? 0) * 86_400 + Number(hours ?? 0) * 3_600 + Number(minutes) * 60 + Number(seconds));
+}
+/** When a process started, from its elapsed run time; null when unavailable. */
+export function processStartedAt(pid, now = Date.now()) {
+    if (process.platform !== "linux" && process.platform !== "darwin")
+        return null;
+    const elapsed = parseElapsed(run("ps", ["-o", "etime=", "-p", String(pid)]));
+    return elapsed === null ? null : new Date(now - elapsed * 1_000).toISOString();
+}
+/** The pid followed by its ancestors, nearest first (bounded). */
+export function ancestry(pid, maxHops = 32) {
+    const chain = [];
+    let current = pid;
+    while (current && current > 1 && chain.length < maxHops && !chain.includes(current)) {
+        chain.push(current);
+        current = readProcessInfo(current)?.ppid ?? null;
+    }
+    return chain;
+}
+function run(command, args) {
+    const result = spawnSync(command, args, { encoding: "utf8", timeout: 10_000 });
+    return result.status === 0 || result.stdout ? (result.stdout ?? "") : "";
+}

package/dist/core/servers/tunnels.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Tunnels as registry services.
+ *
+ * `tunnel up` and `tunnel reload` register the instance; `tunnel down`
+ * removes it. Tunnels started before the registry existed are adopted the next
+ * time the registry is read, so a long-lived tunnel never shows as an
+ * unregistered listener.
+ */
+import { type TunnelState } from "../../lib/tunnel/state.js";
+import type { RegisterServerInput } from "./index.js";
+export declare function tunnelServerId(name: string): string;
+/** The registry input for one tunnel instance. */
+export declare function tunnelServerInput(state: TunnelState, coordRoot: string): RegisterServerInput;
+//# sourceMappingURL=tunnels.d.ts.map

package/dist/core/servers/tunnels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,kDAAkD;AAClD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAmB5F"}

package/dist/core/servers/tunnels.js

@@ -0,0 +1,33 @@
+/**
+ * Tunnels as registry services.
+ *
+ * `tunnel up` and `tunnel reload` register the instance; `tunnel down`
+ * removes it. Tunnels started before the registry existed are adopted the next
+ * time the registry is read, so a long-lived tunnel never shows as an
+ * unregistered listener.
+ */
+import { resolve } from "node:path";
+import { gateLogFile } from "../../lib/tunnel/state.js";
+import { resolveBinName } from "../config.js";
+export function tunnelServerId(name) {
+    return `tunnel-${name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-")}`;
+}
+/** The registry input for one tunnel instance. */
+export function tunnelServerInput(state, coordRoot) {
+    const helpers = [state.cloudflared_pid, state.provider_pid].filter((pid) => typeof pid === "number" && pid > 0);
+    return {
+        id: tunnelServerId(state.name),
+        kind: "service",
+        type: "tunnel",
+        label: `Tunnel ${state.name} → ${state.target}${state.vhost ? ` (${state.vhost})` : ""}`,
+        url: state.url,
+        port: state.gate_port,
+        pid: state.gate_pid,
+        ...(helpers.length ? { pids: helpers } : {}),
+        log: resolve(coordRoot, ".cache", "tunnel", gateLogFile(state.name)),
+        cwd: coordRoot,
+        stop_argv: [resolveBinName(coordRoot), "tunnel", "down", "--name", state.name],
+        started_at: state.started_at,
+        owner: null,
+    };
+}

package/dist/core/storage/builtins.js

@@ -369,6 +369,7 @@ function cacheFamilies() {
         ["pid-map-cache", ".harnery/pid-map", "active native process observations"],
         ["remote-presence-cache", ".harnery/presence/remote", "presence relay observations"],
         ["event-v3-live-display", ".harnery/live/v3", "Event Ledger V3 canonical events"],
+        ["local-server-registry", ".harnery/servers", "running local server processes"],
     ];
     return [
         ...definitions.map(([id, root, source]) => family({

package/dist/core/workflow/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgDH,OAAO,KAAK,EAIV,UAAU,EAEV,SAAS,EAeV,MAAM,YAAY,CAAC;AAkDpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;CAOvF;AAED;;;;6EAI6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAUhD;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAiDH,OAAO,KAAK,EAIV,UAAU,EAGV,SAAS,EAeV,MAAM,YAAY,CAAC;AAuDpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;CAOvF;AAED;;;;6EAI6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAUhD;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}

package/dist/core/workflow/engine.js

@@ -28,6 +28,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { workflowWorkerFullAccessConfig } from "../config.js";
 import { snapshotRepo } from "../context/index.js";
 import { evaluatePolicy, normalizePolicy, PolicyDeniedError, policyDigest, summarizePolicyRequest, } from "../policy/index.js";
 import { failedWorkflowDiagnosticAdmissionObservation, observeWorkflowDiagnosticAdmission, } from "./admission.js";
@@ -45,6 +46,7 @@ import { appendWorkflowTranscriptEvent } from "./transcript.js";
 import { WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION } from "./types.js";
 import { parseStageOutput, validateAgainstSchema } from "./validate.js";
 import { freezeWorkflowWorkContext } from "./work-context.js";
+import { decideWorkerAccess, detectParentAccess, parseWorkerFullAccessPolicy, } from "./worker-access.js";
 import { attestTerminal, attestWorkspaceFailure, resolveWorkspaceBinding, } from "./workspaces/execution.js";
 import { isWorkspaceAttestation } from "./workspaces/validate.js";
 /** Proof record of the filesystem projection a run applied (ADR 0039/0040).
@@ -360,6 +362,11 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             writableRoots: [...(requestedPolicy.writableRoots ?? []), ...gitGrantRoots],
         }
         : undefined;
+    // Worker full access (ADR 0192) is decided per launch. The host policy is
+    // read once per run; the parent probe runs at most once, and only when a
+    // launch has already cleared every cheaper condition.
+    const workerFullAccess = parseWorkerFullAccessPolicy(workflowWorkerFullAccessConfig(opts.coordRoot));
+    let parentAccess;
     const executionRepoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(executionCwd);
     if (!resumeState) {
         writeWorkflowRunManifest({
@@ -836,6 +843,21 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
         }
         if (!spawnCountClaimed)
             agentsSpawned++;
+        const access = decideWorkerAccess({
+            adapter,
+            model: agentOpts.model,
+            effort: agentOpts.effort,
+            policy: workerFullAccess,
+            filesystemPolicy,
+            parent: () => {
+                if (!parentAccess) {
+                    parentAccess = (opts.detectParentAccess ?? detectParentAccess)();
+                    transcript("worker_access.parent", { ...parentAccess });
+                }
+                return parentAccess;
+            },
+        });
+        agentProof.access = access;
         await acquire();
         try {
             await ensureDiagnosticAdmissionObserved();
@@ -847,7 +869,11 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 specialist: agentOpts.specialist ?? null,
                 model: agentOpts.model ?? null,
                 effort: agentOpts.effort ?? null,
+                access,
             });
+            if (access.mode === "full-access") {
+                log(`[access] ${id} ${adapter}: full access (${access.detail})`);
+            }
             log(`[${name}] ${currentStage || "(no stage)"} → ${id} [${adapter}] ${label}`);
             // Headless children do not reliably fire adapter hooks. The engine owns
             // their canonical V3 start so every dispatched child has an auditable
@@ -875,7 +901,10 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     runId,
                     agentId: id,
                     subscriptionOnly,
-                    filesystemPolicy,
+                    // A full-access launch has no sandbox to project a policy into.
+                    ...(access.mode === "full-access"
+                        ? { access: "full-access" }
+                        : { filesystemPolicy }),
                 });
                 agentProof.attempts = attempt;
                 agentProof.duration_ms += last.durationMs;

package/dist/core/workflow/sandbox-projection.d.ts

@@ -14,11 +14,11 @@
  * not, which is worse than refusing and worse than never offering the feature.
  */
 import type { AdapterSandboxProjection } from "../adapters/types.js";
-import type { GitAdministrativeGrant, SpawnFilesystemPolicy } from "./types.js";
+import type { GitAdministrativeGrant, SpawnFilesystemPolicy, SpawnRequest } from "./types.js";
 import type { WorkspaceBinding } from "./workspaces/types.js";
 export declare class SandboxProjectionError extends Error {
     readonly adapter: string;
-    readonly reason: "mode_unrepresentable" | "writable_roots_unrepresentable" | "no_projection" | "writable_root_escapes_workspace" | "git_grant_unavailable";
+    readonly reason: "mode_unrepresentable" | "writable_roots_unrepresentable" | "no_projection" | "writable_root_escapes_workspace" | "git_grant_unavailable" | "full_access_unrepresentable" | "full_access_conflicts_with_policy";
     constructor(adapter: string, reason: SandboxProjectionError["reason"], message: string);
 }
 export interface ResolvedSandboxProjection {
@@ -54,4 +54,15 @@ export declare function assertProjectionWithinWorkspace(adapter: string, allowed
  * grant returns both rather than pretending the private half is useful alone.
  */
 export declare function resolveGitGrantRoots(grant: GitAdministrativeGrant, binding: WorkspaceBinding | undefined): readonly string[];
+/**
+ * The vendor arguments for an unsandboxed launch, or undefined for an ordinary
+ * sandboxed one (ADR 0192).
+ *
+ * The engine decides whether a worker qualifies; this only renders the result,
+ * and refuses rather than degrades. An adapter with no declared full-access
+ * rendering cannot honor the request, and a request that also carries a
+ * filesystem policy asks for two contradictory things, so both fail before
+ * launch instead of silently picking one.
+ */
+export declare function resolveFullAccessArgv(adapter: string, req: Pick<SpawnRequest, "access" | "filesystemPolicy">): readonly string[] | undefined;
 //# sourceMappingURL=sandbox-projection.d.ts.map

package/dist/core/workflow/sandbox-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-projection.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/sandbox-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EACX,sBAAsB,GACtB,gCAAgC,GAChC,eAAe,GACf,iCAAiC,GACjC,uBAAuB,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM;CAMvF;AAED,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,wBAAwB,GAAG,SAAS,EACjD,MAAM,EAAE,qBAAqB,GAC5B,yBAAyB,CAoC3B;AASD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,MAAM,EAC3B,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,IAAI,CAUN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,EAAE,gBAAgB,GAAG,SAAS,GACpC,SAAS,MAAM,EAAE,CAanB"}
+{"version":3,"file":"sandbox-projection.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/sandbox-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EACX,sBAAsB,GACtB,gCAAgC,GAChC,eAAe,GACf,iCAAiC,GACjC,uBAAuB,GACvB,6BAA6B,GAC7B,mCAAmC,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM;CAMvF;AAED,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,wBAAwB,GAAG,SAAS,EACjD,MAAM,EAAE,qBAAqB,GAC5B,yBAAyB,CAoC3B;AASD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,MAAM,EAC3B,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,IAAI,CAUN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,EAAE,gBAAgB,GAAG,SAAS,GACpC,SAAS,MAAM,EAAE,CAanB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,kBAAkB,CAAC,GACrD,SAAS,MAAM,EAAE,GAAG,SAAS,CAkB/B"}

package/dist/core/workflow/sandbox-projection.js

@@ -13,6 +13,7 @@
  * dropped would leave an operator believing a child was constrained when it was
  * not, which is worse than refusing and worse than never offering the feature.
  */
+import { builtinAdapterProfile } from "../adapters/profiles.js";
 export class SandboxProjectionError extends Error {
     adapter;
     reason;
@@ -93,3 +94,25 @@ export function resolveGitGrantRoots(grant, binding) {
     // repeated writable root is noise in the rendered argv and in proof.
     return [...new Set([repository.gitdir.realpath, repository.common_dir.realpath])];
 }
+/**
+ * The vendor arguments for an unsandboxed launch, or undefined for an ordinary
+ * sandboxed one (ADR 0192).
+ *
+ * The engine decides whether a worker qualifies; this only renders the result,
+ * and refuses rather than degrades. An adapter with no declared full-access
+ * rendering cannot honor the request, and a request that also carries a
+ * filesystem policy asks for two contradictory things, so both fail before
+ * launch instead of silently picking one.
+ */
+export function resolveFullAccessArgv(adapter, req) {
+    if (req.access !== "full-access")
+        return undefined;
+    if (req.filesystemPolicy) {
+        throw new SandboxProjectionError(adapter, "full_access_conflicts_with_policy", `${adapter} was asked for full access and a "${req.filesystemPolicy.mode}" filesystem policy at once; a launch gets one or the other`);
+    }
+    const rendering = builtinAdapterProfile(adapter)?.fullAccess;
+    if (!rendering) {
+        throw new SandboxProjectionError(adapter, "full_access_unrepresentable", `${adapter} declares no full-access mode, so a worker on it cannot run without its sandbox`);
+    }
+    return rendering.argv;
+}

package/dist/core/workflow/spawn-claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2ExE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAiB/B,CAAC"}
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CA0B1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2ExE;AAED,eAAO,MAAM,iBAAiB,EAAE,OAiB/B,CAAC"}

package/dist/core/workflow/spawn-claude.js

@@ -21,7 +21,7 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { resolveSandboxProjection } from "./sandbox-projection.js";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildClaudeInvocation(req) {
     validateAdapterEffort("claude-code", req.effort);
@@ -38,6 +38,11 @@ export function buildClaudeInvocation(req) {
         "--max-turns",
         String(req.maxTurns),
     ];
+    // A qualified launch removes the permission prompt and the Bash sandbox
+    // (ADR 0192); an ordinary one leaves Claude Code's own settings in charge.
+    const fullAccess = resolveFullAccessArgv("claude-code", req);
+    if (fullAccess)
+        argv.push(...fullAccess);
     if (req.model)
         argv.push("--model", req.model);
     if (req.effort)

package/dist/core/workflow/spawn-codex.d.ts

@@ -10,6 +10,8 @@
  *   experimental `--json` JSONL event stream.
  * - `--skip-git-repo-check` keeps non-repo cwds working; `--sandbox
  *   workspace-write` matches workflow-stage expectations (children may edit).
+ *   A launch the engine qualified for full access renders `--sandbox
+ *   danger-full-access` instead (ADR 0192).
  * - No per-run cost or session-id surface in this mode → both left undefined.
  * - No max-turns equivalent → `maxTurns` is accepted and ignored (documented
  *   in the CLI docs page).

package/dist/core/workflow/spawn-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA8B9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAwCvE;AAED,eAAO,MAAM,YAAY,EAAE,OA8B1B,CAAC"}
+{"version":3,"file":"spawn-codex.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAErE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA6C9F;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAwCvE;AAED,eAAO,MAAM,YAAY,EAAE,OA8B1B,CAAC"}

package/dist/core/workflow/spawn-codex.js

@@ -10,6 +10,8 @@
  *   experimental `--json` JSONL event stream.
  * - `--skip-git-repo-check` keeps non-repo cwds working; `--sandbox
  *   workspace-write` matches workflow-stage expectations (children may edit).
+ *   A launch the engine qualified for full access renders `--sandbox
+ *   danger-full-access` instead (ADR 0192).
  * - No per-run cost or session-id surface in this mode → both left undefined.
  * - No max-turns equivalent → `maxTurns` is accepted and ignored (documented
  *   in the CLI docs page).
@@ -22,12 +24,29 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { resolveSandboxProjection } from "./sandbox-projection.js";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 export function buildCodexInvocation(req, resultFile) {
     validateAdapterEffort("codex", req.effort);
     if (!resultFile)
         throw new Error("codex adapter requires a final-message result file");
+    const fullAccess = resolveFullAccessArgv("codex", req);
+    if (fullAccess) {
+        const argv = [
+            "codex",
+            "exec",
+            req.prompt,
+            "--output-last-message",
+            resultFile,
+            "--skip-git-repo-check",
+            ...fullAccess,
+        ];
+        if (req.model)
+            argv.push("--model", req.model);
+        if (req.effort)
+            argv.push("-c", `model_reasoning_effort=${JSON.stringify(req.effort)}`);
+        return { argv, resultFile };
+    }
     // Default stays workspace-write so an unprojected request is unchanged.
     const projection = req.filesystemPolicy
         ? resolveSandboxProjection("codex", builtinAdapterProfile("codex")?.sandboxProjection, req.filesystemPolicy)

package/dist/core/workflow/spawn-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAkB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAqDxE;AAED,eAAO,MAAM,aAAa,EAAE,OAkB3B,CAAC"}
+{"version":3,"file":"spawn-cursor.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAWA;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAsB1E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAqDxE;AAED,eAAO,MAAM,aAAa,EAAE,OAkB3B,CAAC"}

package/dist/core/workflow/spawn-cursor.js

@@ -22,7 +22,7 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { resolveSandboxProjection } from "./sandbox-projection.js";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 /** Exported for unit tests (no live binary to test against). */
 export function parseCursorOutput(stdout) {
@@ -50,6 +50,11 @@ export function buildCursorInvocation(req) {
     // commands. Neither flag maps host policy into child tools; that capability
     // remains explicitly unsupported.
     const argv = ["cursor-agent", "-p", req.prompt, "--output-format", "json", "--trust", "--force"];
+    // A qualified launch also turns the Cursor sandbox off (ADR 0192); an
+    // ordinary one leaves the configured sandbox setting untouched.
+    const fullAccess = resolveFullAccessArgv("cursor", req);
+    if (fullAccess)
+        argv.push(...fullAccess);
     if (req.model)
         argv.push("--model", req.model);
     return { argv };

package/dist/core/workflow/spawn-opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-opencode.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQrE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAoBA;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAiB5E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2C1E;AAED,eAAO,MAAM,eAAe,EAAE,OAkB7B,CAAC"}
+{"version":3,"file":"spawn-opencode.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/spawn-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQrE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAoBA;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoB5E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CA2C1E;AAED,eAAO,MAAM,eAAe,EAAE,OAkB7B,CAAC"}

package/dist/core/workflow/spawn-opencode.js

@@ -20,7 +20,7 @@ import { exec } from "../../lib/exec.js";
 import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profiles.js";
 import { notFoundError } from "./adapters.js";
 import { buildChildEnv } from "./child-env.js";
-import { resolveSandboxProjection } from "./sandbox-projection.js";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.js";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.js";
 /**
  * Parse the NDJSON `opencode run --format json` stream into the final answer
@@ -59,6 +59,9 @@ export function buildOpenCodeInvocation(req) {
         // Declared unrepresentable: refuse rather than drop it silently (ADR 0039).
         resolveSandboxProjection("opencode", builtinAdapterProfile("opencode")?.sandboxProjection, req.filesystemPolicy);
     }
+    // OpenCode declares no full-access rendering, so this refuses a full-access
+    // request instead of launching it as an ordinary one (ADR 0192).
+    resolveFullAccessArgv("opencode", req);
     // `--auto` auto-approves permissions that are not explicitly denied, which a
     // headless workflow child needs because it has no interactive approval
     // channel; it does not map host policy into child tools (unsupported).