harnery 0.41.0 → 0.42.0

package/src/core/servers/net.ts

@@ -0,0 +1,283 @@
+/**
+ * Local socket and process observation for the server registry.
+ *
+ * Linux reads procfs directly (no `ss`/`lsof` dependency, works under WSL).
+ * macOS shells out to `lsof` and `ps`. Other platforms report `unsupported`
+ * so callers can say the scan did not run rather than implying it found
+ * nothing.
+ */
+
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync, readlinkSync } from "node:fs";
+
+export type ScanSupport = "procfs" | "lsof" | "unsupported";
+
+export interface ListeningSocket {
+  pid: number;
+  port: number;
+  address: string;
+}
+
+export interface ProcessInfo {
+  pid: number;
+  ppid: number | null;
+  command: string;
+  cwd: string | null;
+}
+
+export function scanSupport(): ScanSupport {
+  if (process.platform === "linux") return "procfs";
+  if (process.platform === "darwin") return "lsof";
+  return "unsupported";
+}
+
+interface ProcSocketRow {
+  localAddress: string;
+  localPort: number;
+  state: string;
+  inode: string;
+}
+
+/** Parse `/proc/net/tcp` or `/proc/net/tcp6` content. */
+export function parseProcNetTcp(content: string): ProcSocketRow[] {
+  const rows: ProcSocketRow[] = [];
+  for (const line of content.split("\n").slice(1)) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 10) continue;
+    const [address, portHex] = (fields[1] ?? "").split(":");
+    if (!address || !portHex) continue;
+    rows.push({
+      localAddress: decodeProcAddress(address),
+      localPort: Number.parseInt(portHex, 16),
+      state: fields[3] ?? "",
+      inode: fields[9] ?? "",
+    });
+  }
+  return rows;
+}
+
+function decodeProcAddress(hex: string): string {
+  if (hex.length === 8) {
+    const bytes = hex.match(/../g)?.map((pair) => Number.parseInt(pair, 16)) ?? [];
+    return bytes.reverse().join(".");
+  }
+  if (/^0+$/.test(hex)) return "::";
+  if (hex === "00000000000000000000000001000000") return "::1";
+  if (hex.startsWith("0000000000000000FFFF0000")) return decodeProcAddress(hex.slice(24));
+  return `ipv6:${hex.toLowerCase()}`;
+}
+
+function readProcSockets(): ProcSocketRow[] {
+  const rows: ProcSocketRow[] = [];
+  for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+    try {
+      rows.push(...parseProcNetTcp(readFileSync(file, "utf8")));
+    } catch {
+      // tcp6 is absent on IPv6-disabled kernels.
+    }
+  }
+  return rows;
+}
+
+/** Map socket inodes to the pids holding them (only processes we may read). */
+function socketOwners(inodes: Set<string>): Map<string, number> {
+  const owners = new Map<string, number>();
+  if (inodes.size === 0) return owners;
+  let entries: string[];
+  try {
+    entries = readdirSync("/proc");
+  } catch {
+    return owners;
+  }
+  for (const entry of entries) {
+    if (!/^\d+$/.test(entry)) continue;
+    let fds: string[];
+    try {
+      fds = readdirSync(`/proc/${entry}/fd`);
+    } catch {
+      continue;
+    }
+    for (const fd of fds) {
+      let target: string;
+      try {
+        target = readlinkSync(`/proc/${entry}/fd/${fd}`);
+      } catch {
+        continue;
+      }
+      const match = /^socket:\[(\d+)\]$/.exec(target);
+      if (match?.[1] && inodes.has(match[1]) && !owners.has(match[1])) {
+        owners.set(match[1], Number(entry));
+      }
+    }
+    if (owners.size === inodes.size) break;
+  }
+  return owners;
+}
+
+/** Listening TCP sockets whose owning process this user can see. */
+export function listListeningSockets(): ListeningSocket[] {
+  const support = scanSupport();
+  if (support === "procfs") {
+    const listening = readProcSockets().filter((row) => row.state === "0A");
+    const owners = socketOwners(new Set(listening.map((row) => row.inode)));
+    const seen = new Set<string>();
+    const sockets: ListeningSocket[] = [];
+    for (const row of listening) {
+      const pid = owners.get(row.inode);
+      if (!pid) continue;
+      const key = `${pid}:${row.localPort}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      sockets.push({ pid, port: row.localPort, address: row.localAddress });
+    }
+    return sockets.sort((a, b) => a.port - b.port);
+  }
+  if (support === "lsof") return lsofListeningSockets();
+  return [];
+}
+
+/**
+ * Every listening TCP port on this machine, including ports whose owner this
+ * user cannot see (containers, other users). Used to avoid port collisions.
+ */
+export function listListeningPorts(): Set<number> {
+  const support = scanSupport();
+  if (support === "procfs")
+    return new Set(
+      readProcSockets()
+        .filter((row) => row.state === "0A")
+        .map((row) => row.localPort),
+    );
+  if (support === "lsof") return new Set(listListeningSockets().map((socket) => socket.port));
+  return new Set();
+}
+
+/** Parse `lsof -Fpn` output for listening sockets. */
+export function parseLsofListen(output: string): ListeningSocket[] {
+  const sockets: ListeningSocket[] = [];
+  const seen = new Set<string>();
+  let pid = 0;
+  for (const line of output.split("\n")) {
+    if (line.startsWith("p")) pid = Number(line.slice(1));
+    else if (line.startsWith("n") && pid > 0) {
+      const match = /^(.*):(\d+)$/.exec(line.slice(1));
+      if (!match?.[2]) continue;
+      const port = Number(match[2]);
+      const key = `${pid}:${port}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      sockets.push({ pid, port, address: (match[1] ?? "").replace(/^\[|\]$/g, "") });
+    }
+  }
+  return sockets.sort((a, b) => a.port - b.port);
+}
+
+/**
+ * Count established server-side connections per local port. A browser tab
+ * holding a live-reload socket or keep-alive connection counts as activity.
+ */
+export function establishedConnectionCounts(ports: number[]): Map<number, number> {
+  const counts = new Map<number, number>();
+  const wanted = new Set(ports.filter((port) => Number.isInteger(port) && port > 0));
+  if (wanted.size === 0) return counts;
+  const support = scanSupport();
+  if (support === "procfs") {
+    for (const row of readProcSockets()) {
+      // 01 ESTABLISHED; 03 SYN_RECV, where a deferred-accept server parks a
+      // connected client until its first bytes arrive.
+      if ((row.state !== "01" && row.state !== "03") || !wanted.has(row.localPort)) continue;
+      counts.set(row.localPort, (counts.get(row.localPort) ?? 0) + 1);
+    }
+    return counts;
+  }
+  if (support === "lsof") return lsofConnectionCounts(wanted);
+  return counts;
+}
+
+/** Listening sockets via `lsof` (the macOS path; also runs wherever lsof exists). */
+export function lsofListeningSockets(): ListeningSocket[] {
+  return parseLsofListen(run("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-Fpn"]));
+}
+
+/** Server-side established connections per wanted local port, via `lsof`. */
+export function lsofConnectionCounts(wanted: Set<number>): Map<number, number> {
+  const counts = new Map<number, number>();
+  const output = run("lsof", ["-nP", "-iTCP", "-sTCP:ESTABLISHED", "-Fn"]);
+  for (const line of output.split("\n")) {
+    const match = /^n.*?:(\d+)->/.exec(line);
+    const port = match?.[1] ? Number(match[1]) : 0;
+    if (wanted.has(port)) counts.set(port, (counts.get(port) ?? 0) + 1);
+  }
+  return counts;
+}
+
+/** Parent, command line, and working directory via `ps` and `lsof` (the macOS path). */
+export function psProcessInfo(pid: number): ProcessInfo | null {
+  const ps = run("ps", ["-o", "ppid=,command=", "-p", String(pid)]).trim();
+  if (!ps) return null;
+  const match = /^(\d+)\s+(.*)$/.exec(ps);
+  const cwdLine = run("lsof", ["-a", "-p", String(pid), "-d", "cwd", "-Fn"])
+    .split("\n")
+    .find((line) => line.startsWith("n"));
+  return {
+    pid,
+    ppid: match?.[1] ? Number(match[1]) : null,
+    command: match?.[2] ?? ps,
+    cwd: cwdLine ? cwdLine.slice(1) : null,
+  };
+}
+
+export function readProcessInfo(pid: number): ProcessInfo | null {
+  if (process.platform === "linux") {
+    try {
+      const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+      const afterComm = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      const ppid = Number(afterComm[1]);
+      const command = readFileSync(`/proc/${pid}/cmdline`, "utf8").split("\0").join(" ").trim();
+      let cwd: string | null = null;
+      try {
+        cwd = readlinkSync(`/proc/${pid}/cwd`);
+      } catch {
+        cwd = null;
+      }
+      return { pid, ppid: Number.isInteger(ppid) ? ppid : null, command, cwd };
+    } catch {
+      return null;
+    }
+  }
+  if (process.platform === "darwin") return psProcessInfo(pid);
+  return null;
+}
+
+/** Parse `ps -o etime=` output (`[[dd-]hh:]mm:ss`) into seconds. */
+export function parseElapsed(value: string): number | null {
+  const match = /^\s*(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)\s*$/.exec(value);
+  if (!match) return null;
+  const [, days, hours, minutes, seconds] = match;
+  return (
+    Number(days ?? 0) * 86_400 + Number(hours ?? 0) * 3_600 + Number(minutes) * 60 + Number(seconds)
+  );
+}
+
+/** When a process started, from its elapsed run time; null when unavailable. */
+export function processStartedAt(pid: number, now = Date.now()): string | null {
+  if (process.platform !== "linux" && process.platform !== "darwin") return null;
+  const elapsed = parseElapsed(run("ps", ["-o", "etime=", "-p", String(pid)]));
+  return elapsed === null ? null : new Date(now - elapsed * 1_000).toISOString();
+}
+
+/** The pid followed by its ancestors, nearest first (bounded). */
+export function ancestry(pid: number, maxHops = 32): number[] {
+  const chain: number[] = [];
+  let current: number | null = pid;
+  while (current && current > 1 && chain.length < maxHops && !chain.includes(current)) {
+    chain.push(current);
+    current = readProcessInfo(current)?.ppid ?? null;
+  }
+  return chain;
+}
+
+function run(command: string, args: string[]): string {
+  const result = spawnSync(command, args, { encoding: "utf8", timeout: 10_000 });
+  return result.status === 0 || result.stdout ? (result.stdout ?? "") : "";
+}

package/src/core/servers/tunnels.ts

@@ -0,0 +1,39 @@
+/**
+ * Tunnels as registry services.
+ *
+ * `tunnel up` and `tunnel reload` register the instance; `tunnel down`
+ * removes it. Tunnels started before the registry existed are adopted the next
+ * time the registry is read, so a long-lived tunnel never shows as an
+ * unregistered listener.
+ */
+
+import { resolve } from "node:path";
+import { gateLogFile, type TunnelState } from "../../lib/tunnel/state.ts";
+import { resolveBinName } from "../config.ts";
+import type { RegisterServerInput } from "./index.ts";
+
+export function tunnelServerId(name: string): string {
+  return `tunnel-${name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-")}`;
+}
+
+/** The registry input for one tunnel instance. */
+export function tunnelServerInput(state: TunnelState, coordRoot: string): RegisterServerInput {
+  const helpers = [state.cloudflared_pid, state.provider_pid].filter(
+    (pid): pid is number => typeof pid === "number" && pid > 0,
+  );
+  return {
+    id: tunnelServerId(state.name),
+    kind: "service",
+    type: "tunnel",
+    label: `Tunnel ${state.name} → ${state.target}${state.vhost ? ` (${state.vhost})` : ""}`,
+    url: state.url,
+    port: state.gate_port,
+    pid: state.gate_pid,
+    ...(helpers.length ? { pids: helpers } : {}),
+    log: resolve(coordRoot, ".cache", "tunnel", gateLogFile(state.name)),
+    cwd: coordRoot,
+    stop_argv: [resolveBinName(coordRoot), "tunnel", "down", "--name", state.name],
+    started_at: state.started_at,
+    owner: null,
+  };
+}

package/src/core/storage/builtins.ts

@@ -476,6 +476,7 @@ function cacheFamilies(): HarneryStorageFamily[] {
     ["pid-map-cache", ".harnery/pid-map", "active native process observations"],
     ["remote-presence-cache", ".harnery/presence/remote", "presence relay observations"],
     ["event-v3-live-display", ".harnery/live/v3", "Event Ledger V3 canonical events"],
+    ["local-server-registry", ".harnery/servers", "running local server processes"],
   ] as const;
   return [
     ...definitions.map(([id, root, source]) =>

package/src/core/workflow/engine.ts

@@ -21,6 +21,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { workflowWorkerFullAccessConfig } from "../config.ts";
 import { snapshotRepo } from "../context/index.ts";
 import type {
   ExternalMutationRequest,
@@ -69,6 +70,7 @@ import type {
   BlockedInput,
   EngineOpts,
   GitAdministrativeGrant,
+  ParentAccessEvidence,
   RunReport,
   SpawnFilesystemPolicy,
   SpawnResult,
@@ -88,6 +90,11 @@ import type {
 import { WORKFLOW_DIAGNOSTIC_ADMISSION_SCHEMA_VERSION } from "./types.ts";
 import { parseStageOutput, validateAgainstSchema } from "./validate.ts";
 import { freezeWorkflowWorkContext } from "./work-context.ts";
+import {
+  decideWorkerAccess,
+  detectParentAccess,
+  parseWorkerFullAccessPolicy,
+} from "./worker-access.ts";
 import {
   attestTerminal,
   attestWorkspaceFailure,
@@ -464,6 +471,13 @@ async function executeWorkflow(
         writableRoots: [...(requestedPolicy.writableRoots ?? []), ...gitGrantRoots],
       }
     : undefined;
+  // Worker full access (ADR 0192) is decided per launch. The host policy is
+  // read once per run; the parent probe runs at most once, and only when a
+  // launch has already cleared every cheaper condition.
+  const workerFullAccess = parseWorkerFullAccessPolicy(
+    workflowWorkerFullAccessConfig(opts.coordRoot),
+  );
+  let parentAccess: ParentAccessEvidence | undefined;
   const executionRepoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(executionCwd);
   if (!resumeState) {
     writeWorkflowRunManifest({
@@ -992,6 +1006,22 @@ async function executeWorkflow(
 
     if (!spawnCountClaimed) agentsSpawned++;
 
+    const access = decideWorkerAccess({
+      adapter,
+      model: agentOpts.model,
+      effort: agentOpts.effort,
+      policy: workerFullAccess,
+      filesystemPolicy,
+      parent: () => {
+        if (!parentAccess) {
+          parentAccess = (opts.detectParentAccess ?? detectParentAccess)();
+          transcript("worker_access.parent", { ...parentAccess });
+        }
+        return parentAccess;
+      },
+    });
+    agentProof.access = access;
+
     await acquire();
     try {
       await ensureDiagnosticAdmissionObserved();
@@ -1003,7 +1033,11 @@ async function executeWorkflow(
         specialist: agentOpts.specialist ?? null,
         model: agentOpts.model ?? null,
         effort: agentOpts.effort ?? null,
+        access,
       });
+      if (access.mode === "full-access") {
+        log(`[access] ${id} ${adapter}: full access (${access.detail})`);
+      }
       log(`[${name}] ${currentStage || "(no stage)"} → ${id} [${adapter}] ${label}`);
 
       // Headless children do not reliably fire adapter hooks. The engine owns
@@ -1033,7 +1067,10 @@ async function executeWorkflow(
           runId,
           agentId: id,
           subscriptionOnly,
-          filesystemPolicy,
+          // A full-access launch has no sandbox to project a policy into.
+          ...(access.mode === "full-access"
+            ? { access: "full-access" as const }
+            : { filesystemPolicy }),
         });
         agentProof.attempts = attempt;
         agentProof.duration_ms += last.durationMs;

package/src/core/workflow/sandbox-projection.ts

@@ -14,8 +14,9 @@
  * not, which is worse than refusing and worse than never offering the feature.
  */
 
+import { builtinAdapterProfile } from "../adapters/profiles.ts";
 import type { AdapterSandboxProjection } from "../adapters/types.ts";
-import type { GitAdministrativeGrant, SpawnFilesystemPolicy } from "./types.ts";
+import type { GitAdministrativeGrant, SpawnFilesystemPolicy, SpawnRequest } from "./types.ts";
 import type { WorkspaceBinding } from "./workspaces/types.ts";
 
 export class SandboxProjectionError extends Error {
@@ -25,7 +26,9 @@ export class SandboxProjectionError extends Error {
     | "writable_roots_unrepresentable"
     | "no_projection"
     | "writable_root_escapes_workspace"
-    | "git_grant_unavailable";
+    | "git_grant_unavailable"
+    | "full_access_unrepresentable"
+    | "full_access_conflicts_with_policy";
 
   constructor(adapter: string, reason: SandboxProjectionError["reason"], message: string) {
     super(message);
@@ -148,3 +151,36 @@ export function resolveGitGrantRoots(
   // repeated writable root is noise in the rendered argv and in proof.
   return [...new Set([repository.gitdir.realpath, repository.common_dir.realpath])];
 }
+
+/**
+ * The vendor arguments for an unsandboxed launch, or undefined for an ordinary
+ * sandboxed one (ADR 0192).
+ *
+ * The engine decides whether a worker qualifies; this only renders the result,
+ * and refuses rather than degrades. An adapter with no declared full-access
+ * rendering cannot honor the request, and a request that also carries a
+ * filesystem policy asks for two contradictory things, so both fail before
+ * launch instead of silently picking one.
+ */
+export function resolveFullAccessArgv(
+  adapter: string,
+  req: Pick<SpawnRequest, "access" | "filesystemPolicy">,
+): readonly string[] | undefined {
+  if (req.access !== "full-access") return undefined;
+  if (req.filesystemPolicy) {
+    throw new SandboxProjectionError(
+      adapter,
+      "full_access_conflicts_with_policy",
+      `${adapter} was asked for full access and a "${req.filesystemPolicy.mode}" filesystem policy at once; a launch gets one or the other`,
+    );
+  }
+  const rendering = builtinAdapterProfile(adapter)?.fullAccess;
+  if (!rendering) {
+    throw new SandboxProjectionError(
+      adapter,
+      "full_access_unrepresentable",
+      `${adapter} declares no full-access mode, so a worker on it cannot run without its sandbox`,
+    );
+  }
+  return rendering.argv;
+}

package/src/core/workflow/spawn-claude.ts

@@ -23,7 +23,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { resolveSandboxProjection } from "./sandbox-projection.ts";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
@@ -56,6 +56,10 @@ export function buildClaudeInvocation(req: SpawnRequest): AdapterInvocation {
     "--max-turns",
     String(req.maxTurns),
   ];
+  // A qualified launch removes the permission prompt and the Bash sandbox
+  // (ADR 0192); an ordinary one leaves Claude Code's own settings in charge.
+  const fullAccess = resolveFullAccessArgv("claude-code", req);
+  if (fullAccess) argv.push(...fullAccess);
   if (req.model) argv.push("--model", req.model);
   if (req.effort) argv.push("--effort", req.effort);
   return { argv };

package/src/core/workflow/spawn-codex.ts

@@ -10,6 +10,8 @@
  *   experimental `--json` JSONL event stream.
  * - `--skip-git-repo-check` keeps non-repo cwds working; `--sandbox
  *   workspace-write` matches workflow-stage expectations (children may edit).
+ *   A launch the engine qualified for full access renders `--sandbox
+ *   danger-full-access` instead (ADR 0192).
  * - No per-run cost or session-id surface in this mode → both left undefined.
  * - No max-turns equivalent → `maxTurns` is accepted and ignored (documented
  *   in the CLI docs page).
@@ -24,13 +26,28 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { resolveSandboxProjection } from "./sandbox-projection.ts";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
 export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): AdapterInvocation {
   validateAdapterEffort("codex", req.effort);
   if (!resultFile) throw new Error("codex adapter requires a final-message result file");
+  const fullAccess = resolveFullAccessArgv("codex", req);
+  if (fullAccess) {
+    const argv = [
+      "codex",
+      "exec",
+      req.prompt,
+      "--output-last-message",
+      resultFile,
+      "--skip-git-repo-check",
+      ...fullAccess,
+    ];
+    if (req.model) argv.push("--model", req.model);
+    if (req.effort) argv.push("-c", `model_reasoning_effort=${JSON.stringify(req.effort)}`);
+    return { argv, resultFile };
+  }
   // Default stays workspace-write so an unprojected request is unchanged.
   const projection = req.filesystemPolicy
     ? resolveSandboxProjection(

package/src/core/workflow/spawn-cursor.ts

@@ -24,7 +24,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { resolveSandboxProjection } from "./sandbox-projection.ts";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
@@ -69,6 +69,10 @@ export function buildCursorInvocation(req: SpawnRequest): AdapterInvocation {
   // commands. Neither flag maps host policy into child tools; that capability
   // remains explicitly unsupported.
   const argv = ["cursor-agent", "-p", req.prompt, "--output-format", "json", "--trust", "--force"];
+  // A qualified launch also turns the Cursor sandbox off (ADR 0192); an
+  // ordinary one leaves the configured sandbox setting untouched.
+  const fullAccess = resolveFullAccessArgv("cursor", req);
+  if (fullAccess) argv.push(...fullAccess);
   if (req.model) argv.push("--model", req.model);
   return { argv };
 }

package/src/core/workflow/spawn-opencode.ts

@@ -22,7 +22,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
-import { resolveSandboxProjection } from "./sandbox-projection.ts";
+import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
@@ -75,6 +75,9 @@ export function buildOpenCodeInvocation(req: SpawnRequest): AdapterInvocation {
       req.filesystemPolicy,
     );
   }
+  // OpenCode declares no full-access rendering, so this refuses a full-access
+  // request instead of launching it as an ordinary one (ADR 0192).
+  resolveFullAccessArgv("opencode", req);
   // `--auto` auto-approves permissions that are not explicitly denied, which a
   // headless workflow child needs because it has no interactive approval
   // channel; it does not map host policy into child tools (unsupported).

package/src/core/workflow/types.ts

@@ -142,6 +142,9 @@ export interface WorkflowAgentProof {
    * Absent ⇒ a work failure. Recorded even when a script's parallel() swallows
    * the rejection, so the run-level class can still be derived from proof. */
   class?: SpawnFailureClass;
+  /** Which vendor sandbox mode this agent launched with and why (ADR 0192).
+   * Absent on a cached agent, which launched nothing. */
+  access?: WorkerAccessDecision;
 }
 
 export interface WorkflowRepoSnapshot {
@@ -423,6 +426,57 @@ export interface SpawnRequest {
    * is what shared-checkout runs use. An adapter that cannot represent the
    * requested projection refuses before launch rather than downgrading. */
   filesystemPolicy?: SpawnFilesystemPolicy;
+  /** Launch without the vendor sandbox (ADR 0192). Absent means sandboxed,
+   * which is the adapter's ordinary invocation. The engine sets this only after
+   * the host policy, the parent's own access, and the model floor all agree; a
+   * spawner refuses it when its adapter declares no full-access rendering, and
+   * refuses it alongside a filesystem policy, which it would contradict. */
+  access?: WorkerAccessMode;
+}
+
+/**
+ * Whether a workflow worker runs inside its vendor sandbox (ADR 0192).
+ *
+ * `sandboxed` is today's projection: read-only or workspace-write, with any
+ * declared writable roots and Git grant. `full-access` removes the vendor
+ * sandbox entirely and is only ever granted per launch, never as a run default.
+ */
+export type WorkerAccessMode = "sandboxed" | "full-access";
+
+/** Why a worker got the access mode it did. `qualified` is the only reason that
+ * accompanies `full-access`; every other reason is a sandboxed launch. */
+export type WorkerAccessReason =
+  | "qualified"
+  | "disabled"
+  | "config_invalid"
+  | "adapter_unrepresentable"
+  | "policy_read_only"
+  | "parent_sandboxed"
+  | "parent_unknown"
+  | "model_unset"
+  | "model_not_listed"
+  | "effort_unset"
+  | "effort_below_floor";
+
+/**
+ * What Harnery could prove about the access of the session that launched this
+ * run (ADR 0192). Only positive evidence yields `full-access`; a missing,
+ * unreadable, or contradictory signal is `unknown`, which is treated exactly
+ * like `sandboxed`.
+ */
+export interface ParentAccessEvidence {
+  state: "full-access" | "sandboxed" | "unknown";
+  /** Adapter session markers found in the environment, in the order checked. */
+  adapters: string[];
+  detail: string;
+}
+
+/** One launch's recorded access decision (ADR 0192). */
+export interface WorkerAccessDecision {
+  mode: WorkerAccessMode;
+  reason: WorkerAccessReason;
+  /** Plain-language explanation naming the evidence the decision rests on. */
+  detail: string;
 }
 
 /**
@@ -437,8 +491,10 @@ export interface SpawnRequest {
  */
 export type GitAdministrativeGrant = "none" | "shared-repository";
 
-/** What the host has decided the child may write. `full-access` is deliberately
- * not a mode: Harnery does not project a no-sandbox state into a vendor CLI. */
+/** What the host has decided a sandboxed child may write. There is no
+ * `full-access` mode here: removing the sandbox is a separate, per-launch
+ * decision carried by `SpawnRequest.access` (ADR 0192), because it depends on
+ * the parent's own access and the worker's model rather than on the run. */
 export interface SpawnFilesystemPolicy {
   mode: "read-only" | "workspace-write";
   /** Explicit absolute paths the child may write, declared rather than derived
@@ -608,6 +664,10 @@ export interface EngineOpts {
   allowApiBilling?: boolean;
   /** Billing-probe override for tests (default: the real probeBilling). */
   probeBilling?: BillingProber;
+  /** Parent-access probe override for tests (default: the real
+   * detectParentAccess). Consulted only when the host enables worker full
+   * access, and at most once per run (ADR 0192). */
+  detectParentAccess?: () => ParentAccessEvidence;
   /** Capability claims used to state whether adapter-native tool evidence was
    * available. Missing claims remain unknown. */
   adapterEvidence?: Readonly<Record<AdapterName, AdapterEvidenceCapability | undefined>>;