impel-cli 0.20.42 → 0.20.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.42",
+  "version": "0.20.43",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/scripts/profile-native-codex.mjs

@@ -7,14 +7,22 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import {
+  MANAGED_AGENT_MCP_SERVER,
+  NATIVE_AGENT_ANSWER_TOOL,
+  nativeToolNamespace,
+  resolveManagedCodexAgentProfile,
+} from "../src/agents.js";
 import { nativeSpawnInvocation } from "../src/nativeProcess.js";
-import { summarizeRawAttempt } from "./analyze-native-codex.mjs";
+import { parseStrictJsonLines, summarizeRawAttempt } from "./analyze-native-codex.mjs";
 
 const PROFILE_SCHEMA = "impel.native-codex-profile.v1";
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
 const DEFAULT_GRACE_MS = 5_000;
 const MAX_CAPTURE_BYTES = 256 * 1024 * 1024;
+const MAX_CONFIG_BYTES = 1024 * 1024;
 const TENANT_PREFLIGHT_RETRY_DELAYS_MS = [250, 750, 1_500];
+const ISOLATED_PROFILE_PREFIX = "impel-native-codex-benchmark-";
 
 function privateDirectory(directory) {
   if (fs.existsSync(directory) && fs.lstatSync(directory).isSymbolicLink()) {
@@ -29,6 +37,16 @@ function privateWrite(filePath, contents) {
   try { fs.chmodSync(filePath, 0o600); } catch { /* Best effort on Windows. */ }
 }
 
+function privateCopy(source, destination) {
+  const stat = fs.lstatSync(source);
+  if (!stat.isFile() || stat.size > MAX_CONFIG_BYTES) {
+    throw new Error("the selected Impel config must be a bounded regular file");
+  }
+  privateDirectory(path.dirname(destination));
+  fs.copyFileSync(source, destination, fs.constants.COPYFILE_EXCL);
+  try { fs.chmodSync(destination, 0o600); } catch { /* Best effort on Windows. */ }
+}
+
 function openPrivate(filePath) {
   const descriptor = fs.openSync(filePath, "wx", 0o600);
   try { fs.chmodSync(filePath, 0o600); } catch { /* Best effort on Windows. */ }
@@ -233,6 +251,350 @@ export async function assertExpectedTenant({ expectedTenant, impelBinary = "impe
   return actual;
 }
 
+function selectedConfigPath(environment = process.env) {
+  const home = environment.HOME || environment.USERPROFILE || os.homedir();
+  const root = environment.IMPEL_CONFIG_DIR || path.join(home, ".config", "impel");
+  return path.join(root, "config.json");
+}
+
+function isolatedBenchmarkPaths(root, tenantId) {
+  const home = path.join(root, "home");
+  const configRoot = path.join(root, "config");
+  return {
+    root,
+    home,
+    configRoot,
+    codexHome: path.join(configRoot, "cli", "tenants", tenantId, "codex"),
+    nativeCodexHome: path.join(root, "native-codex"),
+    appHome: path.join(root, "apps"),
+  };
+}
+
+function isolatedBenchmarkEnvironment(options, paths, telemetryPath, baseEnvironment) {
+  return {
+    ...baseEnvironment,
+    HOME: paths.home,
+    USERPROFILE: paths.home,
+    XDG_CONFIG_HOME: path.join(paths.home, ".config"),
+    IMPEL_CONFIG_DIR: paths.configRoot,
+    IMPEL_APP_HOME: paths.appHome,
+    // `impel codex` runs against the tenant's generated profile directory. An
+    // explicit CODEX_HOME overrides that derivation, so it must point at the
+    // isolated tenant profile; pointing it anywhere else starts Codex with no
+    // MCP servers, and the cohort silently measures model prose instead of
+    // agent latency.
+    CODEX_HOME: paths.codexHome,
+    IMPEL_SKIP_UPDATE_CHECK: "1",
+    IMPEL_NATIVE_AGENT_TELEMETRY_PATH: telemetryPath,
+    IMPEL_NATIVE_HOST: options.mode === "direct"
+      ? "codex-direct-profile"
+      : "codex-compatible-agent",
+    IMPEL_NATIVE_HOST_BUILD: options.hostBuild,
+    IMPEL_NATIVE_BENCHMARK: "1",
+  };
+}
+
+function profileEnvironmentEntry(contents, name, value) {
+  return contents.includes(`${JSON.stringify(name)} = ${JSON.stringify(value)}`);
+}
+
+function regularFileContents(filePath, missingMessage) {
+  try {
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error();
+    return fs.readFileSync(filePath, "utf8");
+  } catch {
+    throw new Error(missingMessage);
+  }
+}
+
+function tomlSection(contents, sectionName) {
+  const header = `[${sectionName}]`;
+  const lines = contents.split(/\r?\n/u);
+  const matches = lines.flatMap((line, index) => line.trim() === header ? [index] : []);
+  if (matches.length !== 1) return null;
+  const start = matches[0] + 1;
+  const relativeEnd = lines.slice(start).findIndex((line) => /^\s*\[/u.test(line));
+  return lines.slice(start, relativeEnd === -1 ? lines.length : start + relativeEnd).join("\n");
+}
+
+function tomlAssignment(section, name) {
+  if (section === null) return null;
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  const matches = [...section.matchAll(new RegExp(`^\\s*${escaped}\\s*=\\s*(.+?)\\s*$`, "gmu"))];
+  return matches.length === 1 ? matches[0][1] : null;
+}
+
+function tomlStringList(value) {
+  if (typeof value !== "string" || !/^\s*\[.*\]\s*$/su.test(value)) return null;
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) && parsed.every((entry) => typeof entry === "string")
+      ? parsed
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function assertSelectedProfileContract(contents, environment, policyFingerprint) {
+  const mcpSectionName = `mcp_servers.${MANAGED_AGENT_MCP_SERVER}`;
+  const mcpSection = tomlSection(contents, mcpSectionName);
+  if (mcpSection === null) {
+    throw new Error(`the isolated managed Codex agent profile has no [${mcpSectionName}] block`);
+  }
+  if (!tomlAssignment(mcpSection, "command") || !tomlAssignment(mcpSection, "args")) {
+    throw new Error("the isolated managed Codex agent profile has an incomplete MCP command binding");
+  }
+  if (tomlAssignment(mcpSection, "tool_timeout_sec") !== "120") {
+    throw new Error("the isolated managed Codex agent profile has no reviewed MCP tool timeout");
+  }
+  const enabledTools = tomlStringList(tomlAssignment(mcpSection, "enabled_tools"));
+  if (!enabledTools?.includes(NATIVE_AGENT_ANSWER_TOOL)) {
+    throw new Error(
+      `the isolated managed Codex agent profile does not enable ${NATIVE_AGENT_ANSWER_TOOL}`,
+    );
+  }
+  const mcpEnvironment = tomlAssignment(mcpSection, "env");
+  for (const name of [
+    "IMPEL_NATIVE_AGENT_TELEMETRY_PATH",
+    "IMPEL_NATIVE_HOST",
+    "IMPEL_NATIVE_HOST_BUILD",
+    "IMPEL_NATIVE_BENCHMARK",
+  ]) {
+    if (!profileEnvironmentEntry(mcpEnvironment || "", name, environment[name])) {
+      throw new Error(`the isolated managed Codex agent MCP env did not bake ${name}`);
+    }
+  }
+  const mcpArgs = tomlAssignment(mcpSection, "args") || "";
+  if (!mcpArgs.includes(JSON.stringify("--policy-fingerprint"))
+    || !mcpArgs.includes(JSON.stringify(policyFingerprint))) {
+    throw new Error("the isolated managed Codex agent profile lost its policy fingerprint binding");
+  }
+
+  const codeModeSection = tomlSection(contents, "features.code_mode");
+  if (tomlAssignment(codeModeSection, "enabled") !== "true") {
+    throw new Error("the isolated managed Codex agent profile does not enable reviewed code mode");
+  }
+  const namespaces = tomlStringList(
+    tomlAssignment(codeModeSection, "direct_only_tool_namespaces"),
+  );
+  if (!namespaces?.includes(nativeToolNamespace())) {
+    throw new Error(
+      `the isolated managed Codex agent profile does not bind ${nativeToolNamespace()} as a direct-only namespace`,
+    );
+  }
+}
+
+export function verifyIsolatedBenchmarkProfile({
+  codexHome,
+  expectedTenant,
+  agent,
+  environment,
+}) {
+  const manifestPath = path.join(codexHome, "agents", "impel-managed", ".manifest.json");
+  let manifest;
+  try {
+    const stat = fs.lstatSync(manifestPath);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error();
+    manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  } catch {
+    throw new Error("the isolated managed Codex agent manifest was not generated");
+  }
+  if (manifest?.client !== "codex"
+    || manifest.tenantId !== expectedTenant
+    || manifest.directProfiles !== true
+    || manifest.directCodeMode !== true
+    || manifest.nativeBenchmark !== true
+    || !Array.isArray(manifest.files)
+    || !Array.isArray(manifest.profiles)
+    || !manifest.contentDigests
+    || typeof manifest.contentDigests !== "object"
+    || Array.isArray(manifest.contentDigests)
+    || !manifest.nativeAgentTelemetryEnvironment
+    || typeof manifest.nativeAgentTelemetryEnvironment !== "object"
+    || Array.isArray(manifest.nativeAgentTelemetryEnvironment)) {
+    throw new Error("the isolated managed Codex agent manifest is missing its benchmark telemetry contract");
+  }
+  for (const name of [
+    "IMPEL_NATIVE_AGENT_TELEMETRY_PATH",
+    "IMPEL_NATIVE_HOST",
+    "IMPEL_NATIVE_HOST_BUILD",
+  ]) {
+    if (manifest.nativeAgentTelemetryEnvironment[name] !== environment[name]) {
+      throw new Error(`the isolated managed Codex agent manifest did not retain ${name}`);
+    }
+  }
+  const matches = (Array.isArray(manifest.agents) ? manifest.agents : []).filter((record) =>
+    record
+    && !record.retired
+    && [record.agentId, record.title, record.profileName].includes(agent)
+  );
+  if (matches.length !== 1) {
+    throw new Error(`the isolated managed Codex agent ${JSON.stringify(agent)} was not generated exactly once`);
+  }
+  const [record] = matches;
+  if (!/^[a-f0-9]{64}$/u.test(record.policyFingerprint || "")) {
+    throw new Error("the isolated managed Codex agent manifest has no policy fingerprint");
+  }
+  let resolved;
+  try {
+    resolved = resolveManagedCodexAgentProfile(codexHome, expectedTenant, agent);
+  } catch (error) {
+    throw new Error(`the isolated managed Codex agent profile failed its managed integrity check: ${error.message}`);
+  }
+  const profileFileName = resolved.profileFileName;
+  if (typeof profileFileName !== "string"
+    || path.basename(profileFileName) !== profileFileName
+    || !profileFileName.endsWith(".config.toml")) {
+    throw new Error("the isolated managed Codex agent profile mapping is invalid");
+  }
+  const profilePath = path.join(codexHome, profileFileName);
+  const contents = regularFileContents(
+    profilePath,
+    "the isolated managed Codex agent profile was not written as a regular file",
+  );
+  const definitionFileName = `${resolved.profileName}.toml`;
+  if (!manifest.files.includes(definitionFileName)) {
+    throw new Error("the isolated managed Codex agent definition is absent from its manifest");
+  }
+  const definitionPath = path.join(codexHome, "agents", definitionFileName);
+  const definitionContents = regularFileContents(
+    definitionPath,
+    "the isolated managed Codex agent definition was not written as a regular file",
+  );
+  if (manifest.contentDigests?.[`agents/${definitionFileName}`]
+    !== crypto.createHash("sha256").update(fs.readFileSync(definitionPath)).digest("hex")) {
+    throw new Error("the isolated managed Codex agent definition failed its managed integrity check");
+  }
+  assertSelectedProfileContract(contents, environment, record.policyFingerprint);
+  try {
+    assertSelectedProfileContract(definitionContents, environment, record.policyFingerprint);
+  } catch (error) {
+    throw new Error(error.message.replace("agent profile", "agent definition"));
+  }
+  return { manifestPath, profilePath, profileFileName, definitionPath };
+}
+
+async function generateIsolatedBenchmarkProfile(options, isolation) {
+  // `managedSkillProfiles` only emits the "Impel isolated Codex" target when a
+  // tenant is selected AND its profile directory already exists, so a fresh
+  // isolated root would otherwise generate the native profile only — leaving
+  // Codex with no impel_agent MCP server and the cohort measuring model prose.
+  const select = impelInvocation(options.impelBinary, [
+    "tenant",
+    "use",
+    options.expectedTenant,
+  ], isolation.environment);
+  const selected = await runCaptured(select.command, select.args, {
+    environment: isolation.environment,
+  });
+  if (selected.code !== 0) {
+    throw new Error(
+      `\`impel tenant use ${options.expectedTenant}\` exited with status ${selected.code ?? "unknown"}`,
+    );
+  }
+  fs.mkdirSync(isolation.codexHome, { recursive: true, mode: 0o700 });
+
+  const invocation = impelInvocation(options.impelBinary, [
+    "agents",
+    "sync",
+    "codex",
+    "--skip-apps",
+  ], isolation.environment);
+  const result = await runCaptured(invocation.command, invocation.args, {
+    environment: isolation.environment,
+  });
+  if (result.code !== 0) {
+    throw new Error(`\`impel agents sync codex\` exited with status ${result.code ?? "unknown"}`);
+  }
+}
+
+/**
+ * Run a cohort with the CLI's existing IMPEL_CONFIG_DIR override pointed at a
+ * private temporary root. Only config.json is copied in for authentication;
+ * no managed profile from the operator's config root is read or written.
+ */
+export async function withIsolatedBenchmarkProfile(options, sessionDir, callback, {
+  baseEnvironment = process.env,
+  operatorConfigPath = selectedConfigPath(baseEnvironment),
+  prepareProfile = generateIsolatedBenchmarkProfile,
+  assertTenant = assertExpectedTenant,
+  stderr = process.stderr,
+  temporaryParent = os.tmpdir(),
+} = {}) {
+  const root = fs.mkdtempSync(path.join(temporaryParent, ISOLATED_PROFILE_PREFIX));
+  const paths = isolatedBenchmarkPaths(root, options.expectedTenant);
+  const telemetryPath = path.join(sessionDir, "telemetry.jsonl");
+  const environment = isolatedBenchmarkEnvironment(
+    options,
+    paths,
+    telemetryPath,
+    baseEnvironment,
+  );
+  let removed = false;
+  const removeRoot = () => {
+    if (removed) return;
+    removed = true;
+    fs.rmSync(root, { recursive: true, force: true });
+  };
+  // Synchronous exit cleanup also covers Ctrl-C/termination paths where the
+  // event loop cannot continue far enough to unwind the async callback.
+  process.once("exit", removeRoot);
+  let prepared = false;
+  try {
+    privateDirectory(paths.home);
+    privateDirectory(paths.configRoot);
+    stderr.write(
+      `Using isolated benchmark profile ${paths.codexHome}; cohort telemetry: ${telemetryPath}\n`,
+    );
+    try {
+      privateCopy(operatorConfigPath, path.join(paths.configRoot, "config.json"));
+      // Explicit sync discovers initialized isolated CLI roots. Creating only
+      // this empty destination lets the production sync command generate the
+      // complete agent catalog without launching Codex or touching a live
+      // profile.
+      privateDirectory(paths.codexHome);
+      await assertTenant({
+        expectedTenant: options.expectedTenant,
+        impelBinary: options.impelBinary,
+        environment,
+      });
+      await prepareProfile(options, {
+        ...paths,
+        telemetryPath,
+        environment,
+      });
+      const verified = verifyIsolatedBenchmarkProfile({
+        codexHome: paths.codexHome,
+        expectedTenant: options.expectedTenant,
+        agent: options.agent,
+        environment,
+      });
+      // Profile preparation must not contribute any events to the measured
+      // cohort. The generated profile keeps pointing at this same path.
+      fs.rmSync(telemetryPath, { force: true });
+      prepared = true;
+      return await callback({
+        ...paths,
+        ...verified,
+        telemetryPath,
+        environment,
+      });
+    } catch (error) {
+      if (prepared) throw error;
+      throw new Error(
+        `could not generate the isolated benchmark profile for tenant ${JSON.stringify(options.expectedTenant)}: `
+        + `${error?.message || error}. Verify Impel auth, network access, the selected tenant, and `
+        + "that `impel agents sync codex` can fetch this tenant's agent catalog.",
+      );
+    }
+  } finally {
+    process.off("exit", removeRoot);
+    removeRoot();
+  }
+}
+
 function listRollouts(root, startedAtMs, endedAtMs) {
   if (!fs.existsSync(root)) return [];
   const results = [];
@@ -439,35 +801,141 @@ export function safeAttemptRecord({ options, index, processResult, summary, json
   };
 }
 
+export function profiledCodexAttemptOptions(options, telemetryPath, environment = process.env) {
+  return {
+    codexArgs: [
+      "codex",
+      "--benchmark",
+      ...(options.mode === "direct" ? ["--agent", options.agent] : []),
+      "exec",
+      "--json",
+      ...options.extraArgs,
+      "-",
+    ],
+    environment: {
+      ...environment,
+      IMPEL_NATIVE_AGENT_TELEMETRY_PATH: telemetryPath,
+      IMPEL_NATIVE_HOST: options.mode === "direct" ? "codex-direct-profile" : "codex-compatible-agent",
+      IMPEL_NATIVE_HOST_BUILD: options.hostBuild,
+      IMPEL_NATIVE_BENCHMARK: "1",
+    },
+  };
+}
+
+function attemptTelemetryWindow(attempt, index) {
+  const startedAtMs = attempt?.processResult?.startedAtMs ?? Date.parse(attempt?.startedAt || "");
+  const endedAtMs = attempt?.processResult?.endedAtMs ?? Date.parse(attempt?.endedAt || "");
+  if (!Number.isFinite(startedAtMs) || !Number.isFinite(endedAtMs) || endedAtMs < startedAtMs) {
+    throw new Error(`attempt ${index + 1} has an invalid telemetry window`);
+  }
+  return { index, startedAtMs, endedAtMs };
+}
+
+function eventTimestampMs(event) {
+  const value = Date.parse(event?.timestamp || "");
+  return Number.isFinite(value) ? value : null;
+}
+
+function windowOwner(windows, timestampMs) {
+  if (timestampMs === null) return null;
+  const candidates = windows.filter(({ startedAtMs, endedAtMs }) =>
+    timestampMs >= startedAtMs && timestampMs <= endedAtMs
+  );
+  if (candidates.length === 0) return null;
+  // Concurrent attempts can overlap. Prefer the attempt whose process start is
+  // closest to the event, then use input order as a stable tie breaker.
+  return candidates.sort((left, right) =>
+    (timestampMs - left.startedAtMs) - (timestampMs - right.startedAtMs)
+    || left.index - right.index
+  )[0].index;
+}
+
+/**
+ * Attribute a shared cohort telemetry stream without duplicating events.
+ * A correlation's first timestamp anchors the whole correlation to one
+ * attempt; records without a correlation ID fall back to attempt windows.
+ */
+export function splitCohortTelemetryEvents(attempts, telemetryText) {
+  const windows = attempts.map(attemptTelemetryWindow);
+  const split = attempts.map(() => []);
+  const events = telemetryText.trim()
+    ? parseStrictJsonLines(telemetryText, "native-agent cohort telemetry")
+    : [];
+  const correlationOwner = new Map();
+  for (const event of events) {
+    if (typeof event.correlationId !== "string" || !event.correlationId) continue;
+    if (!correlationOwner.has(event.correlationId)) {
+      correlationOwner.set(
+        event.correlationId,
+        windowOwner(windows, eventTimestampMs(event)),
+      );
+    } else if (correlationOwner.get(event.correlationId) === null) {
+      const owner = windowOwner(windows, eventTimestampMs(event));
+      if (owner !== null) correlationOwner.set(event.correlationId, owner);
+    }
+  }
+  for (const event of events) {
+    const owner = typeof event.correlationId === "string" && event.correlationId
+      ? correlationOwner.get(event.correlationId) ?? null
+      : windowOwner(windows, eventTimestampMs(event));
+    if (owner !== null) split[owner].push(event);
+  }
+  return split;
+}
+
+export function finalizeProfileAttempts(attempts, telemetryText) {
+  const telemetryByAttempt = splitCohortTelemetryEvents(attempts, telemetryText);
+  return attempts.map((attempt, attemptIndex) => {
+    if (attempt?.profileAttempt !== true) return attempt;
+    const attributedTelemetryText = telemetryByAttempt[attemptIndex]
+      .map((event) => JSON.stringify(event))
+      .join("\n");
+    let summary = null;
+    let parseError = null;
+    try {
+      summary = summarizeRawAttempt({
+        stdoutText: attempt.stdoutText,
+        telemetryText: attributedTelemetryText,
+        rolloutTexts: attempt.rolloutTexts,
+      });
+    } catch (error) {
+      parseError = error;
+    }
+    const record = safeAttemptRecord({
+      options: attempt.options,
+      index: attempt.index,
+      processResult: attempt.processResult,
+      summary,
+      jsonValid: parseError === null,
+      parseError,
+    });
+    privateWrite(path.join(attempt.attemptDir, "record.json"), `${JSON.stringify(record, null, 2)}\n`);
+    return record;
+  });
+}
+
 async function profileAttempt(options, sessionDir, index) {
+  const environment = options.environment || process.env;
   await assertExpectedTenant({
     expectedTenant: options.expectedTenant,
     impelBinary: options.impelBinary,
-    environment: process.env,
+    environment,
   });
   const attemptName = `${options.cohort}-${String(index + 1 + options.attemptOffset).padStart(3, "0")}`;
   const attemptDir = path.join(sessionDir, attemptName);
   privateDirectory(attemptDir);
   const stdoutPath = path.join(attemptDir, "stdout.jsonl");
   const stderrPath = path.join(attemptDir, "stderr.log");
-  const telemetryPath = path.join(attemptDir, "telemetry.jsonl");
-  const codexArgs = [
-    "codex",
-    ...(options.mode === "direct" ? ["--agent", options.agent] : []),
-    "exec",
-    "--json",
-    ...options.extraArgs,
-    "-",
-  ];
-  const invocation = impelInvocation(options.impelBinary, codexArgs, process.env);
+  const attemptOptions = profiledCodexAttemptOptions(
+    options,
+    options.telemetryPath,
+    environment,
+  );
+  const { codexArgs } = attemptOptions;
+  const invocation = impelInvocation(options.impelBinary, codexArgs, attemptOptions.environment);
   const processResult = await runProfiledProcess({
     ...invocation,
-    environment: {
-      ...process.env,
-      IMPEL_NATIVE_AGENT_TELEMETRY_PATH: telemetryPath,
-      IMPEL_NATIVE_HOST: options.mode === "direct" ? "codex-direct-profile" : "codex-compatible-agent",
-      IMPEL_NATIVE_HOST_BUILD: options.hostBuild,
-    },
+    environment: attemptOptions.environment,
     input: options.prompt,
     stdoutPath,
     stderrPath,
@@ -481,27 +949,15 @@ async function profileAttempt(options, sessionDir, index) {
     stdoutText,
     destination: path.join(attemptDir, "rollouts"),
   });
-  let summary = null;
-  let parseError = null;
-  try {
-    summary = summarizeRawAttempt({
-      stdoutText,
-      telemetryText: fs.existsSync(telemetryPath) ? fs.readFileSync(telemetryPath, "utf8") : "",
-      rolloutTexts: rolloutPaths.map((rolloutPath) => fs.readFileSync(rolloutPath, "utf8")),
-    });
-  } catch (error) {
-    parseError = error;
-  }
-  const record = safeAttemptRecord({
+  return {
+    profileAttempt: true,
     options,
     index,
+    attemptDir,
     processResult,
-    summary,
-    jsonValid: parseError === null,
-    parseError,
-  });
-  privateWrite(path.join(attemptDir, "record.json"), `${JSON.stringify(record, null, 2)}\n`);
-  return record;
+    stdoutText,
+    rolloutTexts: rolloutPaths.map((rolloutPath) => fs.readFileSync(rolloutPath, "utf8")),
+  };
 }
 
 function profilerFailureClass(error) {
@@ -514,16 +970,20 @@ function profilerFailureClass(error) {
   return "attempt-infrastructure";
 }
 
-export async function runWorkers(options, sessionDir, profileAttemptImpl = profileAttempt) {
+export async function runWorkers(options, sessionDir, profileAttemptImpl = profileAttempt, {
+  startIndex = 0,
+  endIndex = options.attempts,
+  concurrency = options.concurrency,
+} = {}) {
   const results = new Array(options.attempts);
-  let next = 0;
+  let next = startIndex;
   let abort = null;
   const worker = async () => {
     for (;;) {
       if (abort) return;
       const index = next;
       next += 1;
-      if (index >= options.attempts) return;
+      if (index >= endIndex) return;
       try {
         results[index] = await profileAttemptImpl(options, sessionDir, index);
       } catch (error) {
@@ -534,10 +994,98 @@ export async function runWorkers(options, sessionDir, profileAttemptImpl = profi
       }
     }
   };
-  await Promise.all(Array.from({ length: options.concurrency }, () => worker()));
+  const workerCount = Math.min(concurrency, Math.max(0, endIndex - startIndex));
+  await Promise.all(Array.from({ length: workerCount }, () => worker()));
   return { attempts: results.filter(Boolean), abort };
 }
 
+const MISSING_MANAGED_AGENT_MESSAGE =
+  "the isolated profile did not expose the managed agent tool; the cohort would measure model prose, not agent latency";
+
+export function firstAttemptIntegrityAbort(record) {
+  const answerCalls = record?.toolCounts?.[NATIVE_AGENT_ANSWER_TOOL] || 0;
+  const terminalResults = record?.terminalResults || 0;
+  if (answerCalls > 0 && terminalResults > 0) return null;
+  return {
+    failureClass: "managed-agent-integrity",
+    attemptId: record?.attemptId || null,
+    message: `${MISSING_MANAGED_AGENT_MESSAGE} (first attempt: ${answerCalls} ${NATIVE_AGENT_ANSWER_TOOL} call${answerCalls === 1 ? "" : "s"}, ${terminalResults} terminal result${terminalResults === 1 ? "" : "s"}); aborting remaining attempts`,
+  };
+}
+
+function readTelemetryText(telemetryPath) {
+  return fs.existsSync(telemetryPath) ? fs.readFileSync(telemetryPath, "utf8") : "";
+}
+
+/**
+ * The first attempt is deliberately run alone. Until its rollout proves that
+ * the fixed answer tool reached a terminal result, starting concurrent work
+ * would risk collecting a whole cohort of plausible-looking model prose.
+ */
+export async function runGuardedCohort(options, sessionDir, {
+  profileAttemptImpl = profileAttempt,
+  readTelemetry = readTelemetryText,
+} = {}) {
+  const first = await runWorkers(options, sessionDir, profileAttemptImpl, {
+    startIndex: 0,
+    endIndex: 1,
+    concurrency: 1,
+  });
+  const firstRecords = finalizeProfileAttempts(
+    first.attempts,
+    readTelemetry(options.telemetryPath),
+  );
+  if (first.abort) return { attempts: firstRecords, abort: first.abort };
+  const integrityAbort = firstAttemptIntegrityAbort(firstRecords[0]);
+  if (integrityAbort) return { attempts: firstRecords, abort: integrityAbort };
+  if (options.attempts === 1) return { attempts: firstRecords, abort: null };
+
+  const remaining = await runWorkers(options, sessionDir, profileAttemptImpl, {
+    startIndex: 1,
+    endIndex: options.attempts,
+    concurrency: options.concurrency,
+  });
+  const remainingRecords = finalizeProfileAttempts(
+    remaining.attempts,
+    readTelemetry(options.telemetryPath),
+  );
+  return {
+    attempts: [...firstRecords, ...remainingRecords],
+    abort: remaining.abort,
+  };
+}
+
+export function buildProfileAggregate({ sessionId, generatedAt, options, result }) {
+  const telemetryCaptured = result.attempts.some(
+    (attempt) => (attempt.telemetryEventCount || 0) > 0,
+  );
+  return {
+    schema: PROFILE_SCHEMA,
+    sessionId,
+    generatedAt,
+    tenantId: options.expectedTenant,
+    sloClass: options.sloClass,
+    mode: options.mode,
+    cohort: options.cohort,
+    cliVersion: options.hostBuild,
+    promptSha256: options.promptSha256,
+    complete: result.abort === null && result.attempts.length === options.attempts,
+    telemetryCaptured,
+    expectedAttempts: options.attempts,
+    abort: result.abort,
+    attempts: result.attempts,
+  };
+}
+
+export function telemetryCaptureWarning(aggregate) {
+  const terminalResults = aggregate.attempts.reduce(
+    (total, attempt) => total + (attempt.terminalResults || 0),
+    0,
+  );
+  if (!aggregate.complete || aggregate.telemetryCaptured || terminalResults === 0) return null;
+  return "WARNING: the cohort completed with managed-agent terminal results but captured zero telemetry events; aggregate telemetryCaptured=false";
+}
+
 async function restoreTenant(originalTenant, options) {
   let actual;
   try { actual = await currentTenant(options.impelBinary, process.env); } catch { return false; }
@@ -572,8 +1120,6 @@ async function main(argv) {
     throw new Error("could not establish the Impel CLI build under test");
   }
   options.hostBuild = version.stdout.trim();
-  const configRoot = process.env.IMPEL_CONFIG_DIR || path.join(os.homedir(), ".config", "impel");
-  options.rolloutRoot = path.join(configRoot, "cli", "tenants", options.expectedTenant, "codex", "sessions");
   const outputRoot = path.resolve(options.outputDir);
   privateDirectory(outputRoot);
   const sessionId = `codex-${new Date().toISOString().replace(/[:.]/gu, "-")}-${crypto.randomBytes(4).toString("hex")}`;
@@ -581,28 +1127,29 @@ async function main(argv) {
   privateDirectory(sessionDir);
   let restored = false;
   try {
-    const result = await runWorkers(options, sessionDir);
-    const aggregate = {
-      schema: PROFILE_SCHEMA,
+    const result = await withIsolatedBenchmarkProfile(options, sessionDir, async (isolation) => {
+      options.environment = isolation.environment;
+      options.telemetryPath = isolation.telemetryPath;
+      options.rolloutRoot = path.join(isolation.codexHome, "sessions");
+      return runGuardedCohort(options, sessionDir);
+    });
+    const aggregate = buildProfileAggregate({
       sessionId,
       generatedAt: new Date().toISOString(),
-      tenantId: options.expectedTenant,
-      sloClass: options.sloClass,
-      mode: options.mode,
-      cohort: options.cohort,
-      cliVersion: options.hostBuild,
-      promptSha256: options.promptSha256,
-      complete: result.abort === null && result.attempts.length === options.attempts,
-      expectedAttempts: options.attempts,
-      abort: result.abort,
-      attempts: result.attempts,
-    };
+      options,
+      result,
+    });
     const aggregatePath = path.join(sessionDir, "aggregate.json");
     privateWrite(aggregatePath, `${JSON.stringify(aggregate, null, 2)}\n`);
     process.stderr.write(`Private Codex profile written under ${sessionDir}\n`);
+    const telemetryWarning = telemetryCaptureWarning(aggregate);
+    if (telemetryWarning) process.stderr.write(`${telemetryWarning}\n`);
     process.stdout.write(`${JSON.stringify(aggregate)}\n`);
     if (!aggregate.complete) {
-      throw new Error(`cohort aborted (${aggregate.abort?.failureClass || "incomplete"}); partial aggregate retained`);
+      const detail = aggregate.abort?.message ? `: ${aggregate.abort.message}` : "";
+      throw new Error(
+        `cohort aborted (${aggregate.abort?.failureClass || "incomplete"})${detail}; partial aggregate retained`,
+      );
     }
   } finally {
     restored = await restoreTenant(originalTenant, options);

package/src/agents.js

@@ -21,8 +21,10 @@ import {
   IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV,
   IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
   IMPEL_NATIVE_AGENT_MCP_TARGET,
+  IMPEL_NATIVE_BENCHMARK_ENV,
   impelCliInvocation,
   impelNativeAgentMcpInvocation,
+  nativeBenchmarkHeaderValue,
 } from "./selfInvocation.js";
 import {
   adapterAnswerFaithfulCompletionGuidance,
@@ -670,6 +672,116 @@ function nativeToolName(toolName) {
   return `${nativeToolNamespace()}__${toolName}`;
 }
 
+const CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS = Object.freeze([
+  NATIVE_AGENT_ANSWER_TOOL,
+  NATIVE_AGENT_RESUME_TOOL,
+].map((tool) => nativeToolName(tool)));
+
+function parentDirectPermissionTools(renderedAgents) {
+  const trusted = new Set(CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS);
+  const tools = [...new Set(renderedAgents.flatMap((agent) =>
+    agent.parentLaunchDefinition?.tools || []
+  ))];
+  if (!tools.every((tool) => trusted.has(tool))) {
+    throw new Error("the managed Claude parent-direct permission grant is invalid");
+  }
+  return tools;
+}
+
+function priorParentDirectPermissionGrants(prior, ownsManagedProfile) {
+  const grants = ownsManagedProfile ? prior?.nativeParentDirectPermissionGrants : null;
+  const trusted = new Set(CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS);
+  if (!Array.isArray(grants)
+    || new Set(grants).size !== grants.length
+    || !grants.every((tool) => trusted.has(tool))) return [];
+  return [...grants];
+}
+
+function readClaudeSettingsForPermissions(settingsPath) {
+  let raw;
+  try {
+    const stat = fs.lstatSync(settingsPath);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new Error(`refusing to update unsafe Claude settings path ${settingsPath}`);
+    }
+    raw = fs.readFileSync(settingsPath, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return { settings: {} };
+    throw error;
+  }
+  try {
+    const settings = raw.trim() ? JSON.parse(raw) : {};
+    if (!settings || typeof settings !== "object" || Array.isArray(settings)) throw new Error();
+    return { settings };
+  } catch {
+    throw new Error(`${settingsPath} exists but isn't a valid JSON object. Fix or remove it, then re-run.`);
+  }
+}
+
+function syncClaudeParentDirectPermissions(root, desiredTools, priorGrants) {
+  if (desiredTools.length === 0 && priorGrants.length === 0) return [];
+
+  const settingsPath = path.join(root, "settings.json");
+  const { settings } = readClaudeSettingsForPermissions(settingsPath);
+  const permissionsExisted = Object.hasOwn(settings, "permissions");
+  if (permissionsExisted && (
+    !settings.permissions
+    || typeof settings.permissions !== "object"
+    || Array.isArray(settings.permissions)
+  )) {
+    throw new Error(`${settingsPath} has an invalid permissions value. Fix or remove it, then re-run.`);
+  }
+  const permissions = permissionsExisted ? { ...settings.permissions } : {};
+  if (Object.hasOwn(permissions, "allow") && (
+    !Array.isArray(permissions.allow)
+    || !permissions.allow.every((rule) => typeof rule === "string")
+  )) {
+    throw new Error(`${settingsPath} has an invalid permissions.allow value. Fix or remove it, then re-run.`);
+  }
+
+  const desired = new Set(desiredTools);
+  const previouslyManaged = new Set(priorGrants);
+  const allow = Array.isArray(permissions.allow) ? [...permissions.allow] : [];
+  const nextAllow = allow.filter((rule) => !previouslyManaged.has(rule) || desired.has(rule));
+  const managedGrants = [];
+  for (const tool of desiredTools) {
+    if (previouslyManaged.has(tool)) {
+      managedGrants.push(tool);
+      if (!nextAllow.includes(tool)) nextAllow.push(tool);
+    } else if (!nextAllow.includes(tool)) {
+      managedGrants.push(tool);
+      nextAllow.push(tool);
+    }
+  }
+
+  // permissions.allow is Claude's ordinary pre-approval surface. Record only
+  // entries this sync actually adds, so turning the experiment back off can
+  // remove them without claiming any operator-authored permission rule.
+  if (JSON.stringify(allow) !== JSON.stringify(nextAllow)) {
+    settings.permissions = { ...permissions, allow: nextAllow };
+    atomicPrivateWrite(settingsPath, `${JSON.stringify(settings, null, 2)}\n`);
+  }
+  return managedGrants;
+}
+
+function claudeParentDirectPermissionsCurrent(root, manifest) {
+  try {
+    const desiredTools = parentDirectPermissionTools(
+      Array.isArray(manifest.agents) ? manifest.agents.map((record) => ({
+        parentLaunchDefinition: record?.launchMode === "parent-direct"
+          ? record.parentLaunchDefinition
+          : null,
+      })) : [],
+    );
+    if (desiredTools.length === 0) return true;
+    const { settings } = readClaudeSettingsForPermissions(path.join(root, "settings.json"));
+    const allow = settings.permissions?.allow;
+    return Array.isArray(allow) && desiredTools.every((tool) => allow.includes(tool));
+  } catch {
+    return false;
+  }
+}
+
 function codexAdapterInstructions(tenantId, agent) {
   const contextRequirement = agent.requiredContext.length
     ? ` Required context keys are ${JSON.stringify(agent.requiredContext)}; if any are absent, ask for them before starting the run.`
@@ -814,7 +926,7 @@ function claudeParentDirectDefinition({ tenantId, agent, invocation }) {
   return {
     prompt: claudeParentDirectInstructions(tenantId, agent),
     permissionMode: "bypassPermissions",
-    tools: [NATIVE_AGENT_ANSWER_TOOL, NATIVE_AGENT_RESUME_TOOL].map((tool) => nativeToolName(tool)),
+    tools: [...CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS],
     mcpServers: [{
       [MANAGED_AGENT_MCP_SERVER]: {
         type: "stdio",
@@ -826,11 +938,35 @@ function claudeParentDirectDefinition({ tenantId, agent, invocation }) {
   };
 }
 
+function nativeAgentTelemetryEnvironment(environment = process.env) {
+  return Object.fromEntries(IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES.flatMap((name) => {
+    const value = environment?.[name];
+    return typeof value === "string" && value.length > 0 ? [[name, value]] : [];
+  }));
+}
+
+function telemetryEnvironmentMatches(recorded, expected) {
+  const normalizedRecorded = recorded === undefined ? {} : recorded;
+  return normalizedRecorded
+    && typeof normalizedRecorded === "object"
+    && !Array.isArray(normalizedRecorded)
+    && JSON.stringify(normalizedRecorded) === JSON.stringify(expected);
+}
+
 function codexInvocationEnvironment(invocation, { durableProfile = false } = {}) {
   const entries = Object.entries(invocation.env || {});
   const transient = new Set(IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES);
+  // Ordinary durable profiles must never retain a one-off telemetry path.
+  // The native Codex profiler is different: it generates a throwaway profile
+  // for the whole benchmark cohort and needs Codex's explicit MCP environment
+  // map to carry that cohort path into the server process. The isolated root is
+  // removed after the cohort, so benchmark-tagged telemetry cannot linger in
+  // an operator's managed profile.
+  const isolatedBenchmark = nativeBenchmarkHeaderValue(invocation.env || {}) !== null;
   return [
-    ...(durableProfile ? entries.filter(([key]) => !transient.has(key)) : entries),
+    ...(durableProfile && !isolatedBenchmark
+      ? entries.filter(([key]) => !transient.has(key))
+      : entries),
     [IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV, String(CODEX_NATIVE_AGENT_ATTACHMENT_WINDOW_MS)],
   ];
 }
@@ -914,6 +1050,7 @@ function boundNativeAgentInvocation(tenantId, agent, invocation, {
   policyFingerprint = nativeAgentPolicyFingerprint(agent),
   mode = usesDirectAnswer(agent) ? "answer" : "durable",
   answerToolAttribution = false,
+  environment = process.env,
 } = {}) {
   const bound = !invocation
     ? impelNativeAgentMcpInvocation({
@@ -922,7 +1059,7 @@ function boundNativeAgentInvocation(tenantId, agent, invocation, {
       scopeParam: agent.scopeParam,
       policyFingerprint,
       mode,
-    })
+    }, { environment })
     : (() => {
       const mcpIndex = invocation.args?.lastIndexOf("mcp") ?? -1;
       if (mcpIndex < 0) throw new Error("native-agent MCP invocation has no mcp command");
@@ -948,6 +1085,7 @@ function boundNativeAgentInvocation(tenantId, agent, invocation, {
 export function renderManagedAgents(client, tenantId, agents, invocation = null, {
   directCodeMode = true,
   nativeParentDirect = false,
+  environment = process.env,
 } = {}) {
   if (client !== "claude" && client !== "codex") throw new Error(`unknown agent client ${client}`);
   const normalizedTenant = normalizeTenantId(tenantId);
@@ -965,6 +1103,7 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
     const parentDirect = client === "claude" && nativeParentDirect && usesDirectAnswer(agent);
     const boundInvocation = boundNativeAgentInvocation(normalizedTenant, agent, invocation, {
       answerToolAttribution: parentDirect,
+      environment,
     });
     const claudeRendered = client === "claude" && !parentDirect
       ? renderClaudeAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation })
@@ -1059,7 +1198,10 @@ export function renderManagedClaudeSlashCommands(tenantId, agents, invocation =
   });
 }
 
-function renderRetiredManagedAgents(client, tenantId, bindings, active, invocation = null, { directCodeMode = true } = {}) {
+function renderRetiredManagedAgents(client, tenantId, bindings, active, invocation = null, {
+  directCodeMode = true,
+  environment = process.env,
+} = {}) {
   const usedNames = new Set(active.map(({ name }) => name));
   const usedFiles = new Set(active.map(({ fileName }) => fileName));
   return bindings.map((binding) => {
@@ -1097,6 +1239,7 @@ function renderRetiredManagedAgents(client, tenantId, bindings, active, invocati
     const boundInvocation = boundNativeAgentInvocation(tenantId, agent, invocation, {
       policyFingerprint: binding.policyFingerprint,
       mode: "recovery",
+      environment,
     });
     const claudeRendered = client === "claude"
       ? renderClaudeAgent({ tenantId, agent, name, invocation: boundInvocation, recoveryOnly: true })
@@ -1233,7 +1376,11 @@ function validateClaudeLaunchDefinition(record, tenantId) {
     throw new Error("the managed Claude launch definition is invalid; run `impel agents sync claude`");
   }
   const server = definition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
-  const allowedEnvironment = new Set([IMPEL_MANAGED_MCP_ENV, ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES]);
+  const allowedEnvironment = new Set([
+    IMPEL_MANAGED_MCP_ENV,
+    ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
+    IMPEL_NATIVE_BENCHMARK_ENV,
+  ]);
   if (!exactObjectKeys(server, ["type", "command", "args", "env"])
     || server.type !== "stdio"
     || typeof server.command !== "string"
@@ -1274,8 +1421,7 @@ function validateClaudeLaunchDefinition(record, tenantId) {
 
 function validateClaudeParentLaunchDefinition(record, tenantId) {
   const definition = record.parentLaunchDefinition;
-  const expectedTools = [NATIVE_AGENT_ANSWER_TOOL, NATIVE_AGENT_RESUME_TOOL]
-    .map((name) => nativeToolName(name));
+  const expectedTools = CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS;
   if (!exactObjectKeys(definition, ["prompt", "permissionMode", "tools", "mcpServers"])
     || definition.prompt !== claudeParentDirectInstructions(tenantId, record)
     || definition.permissionMode !== "bypassPermissions"
@@ -1286,7 +1432,11 @@ function validateClaudeParentLaunchDefinition(record, tenantId) {
     throw new Error("the managed Claude parent-direct definition is invalid; run `impel agents sync claude`");
   }
   const server = definition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
-  const allowedEnvironment = new Set([IMPEL_MANAGED_MCP_ENV, ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES]);
+  const allowedEnvironment = new Set([
+    IMPEL_MANAGED_MCP_ENV,
+    ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
+    IMPEL_NATIVE_BENCHMARK_ENV,
+  ]);
   if (!exactObjectKeys(server, ["type", "command", "args", "env"])
     || server.type !== "stdio"
     || typeof server.command !== "string"
@@ -1530,13 +1680,27 @@ function profileIsFresh(profile, tenantId, now, ttlMs) {
   const expectedNativeInterceptTimeoutMs = expectedNativeIntercept
     ? (profile.nativeInterceptTimeoutMs ?? nativeInterceptTimeoutMs())
     : null;
+  const expectedTelemetryEnvironment = nativeAgentTelemetryEnvironment(
+    profile.environment ?? process.env,
+  );
+  const expectedBenchmark = nativeBenchmarkHeaderValue(
+    profile.environment ?? process.env,
+  ) !== null;
   if (manifest.directProfiles !== expectedDirectProfiles
     || manifest.directCodeMode !== expectedDirectCodeMode
     || Boolean(manifest.nativeParentDirect) !== expectedNativeParentDirect
     || Boolean(manifest.nativeSlashCommands) !== expectedNativeSlashCommands
     || Boolean(manifest.nativeIntercept) !== expectedNativeIntercept
+    || !telemetryEnvironmentMatches(
+      manifest.nativeAgentTelemetryEnvironment,
+      expectedTelemetryEnvironment,
+    )
+    || Boolean(manifest.nativeBenchmark) !== expectedBenchmark
     || (expectedNativeIntercept
       && manifest.nativeInterceptTimeoutMs !== expectedNativeInterceptTimeoutMs)) return false;
+  if (expectedNativeParentDirect && !claudeParentDirectPermissionsCurrent(profile.root, manifest)) {
+    return false;
+  }
   const syncedAt = Date.parse(manifest.syncedAt || "");
   if (!Number.isFinite(syncedAt) || now - syncedAt >= ttlMs) return false;
   const artifacts = [
@@ -1569,6 +1733,8 @@ export function syncAgentProfile({
   nativeSlashCommands = client === "claude" && nativeSlashCommandsEnabled(),
   nativeIntercept = client === "claude" && nativeInterceptEnabled(),
   nativeInterceptTimeoutMs: interceptTimeoutMs = nativeIntercept ? nativeInterceptTimeoutMs() : null,
+  environment = process.env,
+  invocation = null,
   now = Date.now(),
   nativeAgentRunsRoot = path.join(CONFIG_DIR, "native-agent-runs"),
 }) {
@@ -1588,9 +1754,10 @@ export function syncAgentProfile({
     && fs.lstatSync(commandsDir).isSymbolicLink()) {
     throw new Error(`refusing to use symlinked native-agent path ${commandsDir}`);
   }
-  const active = renderManagedAgents(client, tenantId, agents, null, {
+  const active = renderManagedAgents(client, tenantId, agents, invocation, {
     directCodeMode,
     nativeParentDirect,
+    environment,
   });
   const activeBindings = new Set(active.map((agent) =>
     `${agent.agentId}\0${agent.scopeParam}\0${agent.policyFingerprint}`
@@ -1599,7 +1766,10 @@ export function syncAgentProfile({
     .filter((binding) => !activeBindings.has(
       `${binding.agentId}\0${binding.scopeParam}\0${binding.policyFingerprint}`,
     ));
-  const retired = renderRetiredManagedAgents(client, tenantId, retiredBindings, active, null, { directCodeMode });
+  const retired = renderRetiredManagedAgents(client, tenantId, retiredBindings, active, invocation, {
+    directCodeMode,
+    environment,
+  });
   const rendered = [...active, ...retired];
   const commands = client === "claude" && nativeSlashCommands
     ? renderManagedClaudeSlashCommands(tenantId, agents)
@@ -1679,6 +1849,13 @@ export function syncAgentProfile({
       }
     }
   }
+  const parentDirectPermissions = client === "claude"
+    ? syncClaudeParentDirectPermissions(
+      root,
+      parentDirectPermissionTools(rendered),
+      priorParentDirectPermissionGrants(prior, priorOwnsManagedFiles),
+    )
+    : null;
   for (const agent of rendered) {
     if (agent.fileName) atomicPrivateWrite(path.join(agentsDir, agent.fileName), agent.contents);
     if (client === "codex" && directProfiles) atomicPrivateWrite(path.join(root, agent.profileFileName), agent.profileContents);
@@ -1755,6 +1932,8 @@ export function syncAgentProfile({
     `commands/${command.fileName}`,
     contentDigest(command.contents),
   ])).sort(([left], [right]) => left.localeCompare(right)));
+  const telemetryEnvironment = nativeAgentTelemetryEnvironment(environment);
+  const benchmark = nativeBenchmarkHeaderValue(environment);
   atomicPrivateWrite(manifestPath, `${JSON.stringify({
     version: MANAGED_AGENT_MANIFEST_VERSION,
     tenantId,
@@ -1762,11 +1941,18 @@ export function syncAgentProfile({
     directProfiles: client === "codex" && directProfiles,
     directCodeMode: client === "codex" && directCodeMode,
     ...(client === "claude" && nativeParentDirect ? { nativeParentDirect: true } : {}),
+    ...(client === "claude" && parentDirectPermissions.length > 0 ? {
+      nativeParentDirectPermissionGrants: parentDirectPermissions,
+    } : {}),
     ...(client === "claude" && nativeSlashCommands ? { nativeSlashCommands: true } : {}),
     ...(client === "claude" && nativeIntercept ? {
       nativeIntercept: true,
       nativeInterceptTimeoutMs: interceptTimeoutMs,
     } : {}),
+    ...(Object.keys(telemetryEnvironment).length > 0 ? {
+      nativeAgentTelemetryEnvironment: telemetryEnvironment,
+    } : {}),
+    ...(benchmark ? { nativeBenchmark: true } : {}),
     syncedAt: new Date(now).toISOString(),
     files: [...currentFiles].sort(),
     ...(client === "claude" && nativeSlashCommands ? { commands: [...currentCommands].sort() } : {}),

package/src/cli.js

@@ -38,6 +38,7 @@ Work:
   impel claude --agent <id|exact-title> ...   Run one fixed tenant agent without a parent hop
   impel codex [args...]                       Launch Codex with an isolated Impel profile
   impel codex --agent <id|exact-title> ...    Run one fixed tenant agent without a parent hop
+  impel codex --benchmark ...                 Tag native-agent MCP calls as benchmark traffic
   impel remote handoff|dispatch|handback      Move or control provider-native sessions remotely
   impel remote status|viewer|proxy            Inspect, control, or connect to a remote run
   impel tenant list                           List accessible organizations

package/src/commands/agents.js

@@ -38,6 +38,7 @@ export function managedAgentProfiles(client, options = {}) {
       environment,
       homeDir,
     }),
+    environment,
     ...(client === "codex" ? {
       directProfiles: profile.label !== "Codex CLI (native profile)",
       directCodeMode: profile.label !== "Codex CLI (native profile)",

package/src/commands/launch.js

@@ -24,9 +24,8 @@ import { parentVerbatimRelayAppendix } from "../verbatimRelay.js";
 import { withGitEnvironment } from "../skills.js";
 import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
 import { maybePrintUpdateNotice } from "../updates.js";
-import {
-  nativeSpawnInvocation,
-} from "../nativeProcess.js";
+import { nativeSpawnInvocation } from "../nativeProcess.js";
+import { IMPEL_NATIVE_BENCHMARK_ENV } from "../selfInvocation.js";
 import { resolveReviewedVendorCliBinary } from "../vendorCliBinaries.js";
 import { PINNED_VENDOR_CLI_VERSIONS } from "../vendorCliVersions.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
@@ -305,6 +304,7 @@ function codexAgentLockedOption(argument) {
 export function parseCodexAgentLaunchArguments(argv) {
   const passthrough = [];
   let selector = null;
+  let benchmark = false;
   let literal = false;
   for (let index = 0; index < argv.length; index += 1) {
     const argument = argv[index];
@@ -317,6 +317,14 @@ export function parseCodexAgentLaunchArguments(argv) {
       passthrough.push(argument);
       continue;
     }
+    if (argument === "--benchmark") {
+      if (benchmark) throw new Error("`--benchmark` may be specified only once");
+      benchmark = true;
+      continue;
+    }
+    if (argument.startsWith("--benchmark=")) {
+      throw new Error("`--benchmark` does not accept a value");
+    }
     if (argument === "--agent" || argument.startsWith("--agent=")) {
       if (selector !== null) throw new Error("`--agent` may be specified only once");
       const value = argument === "--agent" ? argv[index += 1] : argument.slice("--agent=".length);
@@ -339,7 +347,7 @@ export function parseCodexAgentLaunchArguments(argv) {
       }
     }
   }
-  return { selector, argv: passthrough };
+  return { selector, benchmark, argv: passthrough };
 }
 
 function codexJsonOutput(argv) {
@@ -436,11 +444,16 @@ export async function cmdLaunch(tool, argv) {
   let nativeArgv = [...argv];
   let claudeAgentSelector = null;
   let codexAgentSelector = null;
+  let codexBenchmark = false;
   if (tool === "claude" && RUNTIME_BRAND.features.agents) {
     ({ selector: claudeAgentSelector, argv: nativeArgv } = parseClaudeAgentLaunchArguments(argv));
   } else if (tool === "codex") {
     try {
-      ({ selector: codexAgentSelector, argv: nativeArgv } = parseCodexAgentLaunchArguments(argv));
+      ({
+        selector: codexAgentSelector,
+        benchmark: codexBenchmark,
+        argv: nativeArgv,
+      } = parseCodexAgentLaunchArguments(argv));
     } catch (error) {
       console.error(`impel codex: ${error.message}`);
       process.exitCode = 1;
@@ -489,12 +502,18 @@ export async function cmdLaunch(tool, argv) {
     }
   }
   const environment = { ...process.env };
+  if (codexBenchmark) environment[IMPEL_NATIVE_BENCHMARK_ENV] = "1";
   environment.IMPEL_TENANT_ID = tenantId;
   let agentProfile;
 
   if (tool === "claude") {
     const profile = ensureImpelClaudeProfile(gatewayUrl, tenantId, { crossAppModels });
-    agentProfile = { client: "claude", root: profile.configDir, label: "Impel isolated Claude (impel claude)" };
+    agentProfile = {
+      client: "claude",
+      root: profile.configDir,
+      label: "Impel isolated Claude (impel claude)",
+      environment,
+    };
     deleteEnvironmentKeys(environment, CLAUDE_DIRECT_AUTH_ENV);
     delete environment.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY;
     environment.CLAUDE_CONFIG_DIR = profile.configDir;
@@ -508,7 +527,12 @@ export async function cmdLaunch(tool, argv) {
     environment.ANTHROPIC_AUTH_TOKEN = gatewayCredential;
   } else if (tool === "codex") {
     const profile = ensureImpelCodexProfile(gatewayUrl, tenantId);
-    agentProfile = { client: "codex", root: profile.codexHome, label: "Impel isolated Codex (impel codex)" };
+    agentProfile = {
+      client: "codex",
+      root: profile.codexHome,
+      label: "Impel isolated Codex (impel codex)",
+      environment,
+    };
     deleteEnvironmentKeys(environment, CODEX_DIRECT_AUTH_ENV);
     environment.CODEX_HOME = profile.codexHome;
     environment[CODEX_GATEWAY_TOKEN_ENV] = gatewayCredential;

package/src/nativeAgentTransport.js

@@ -25,6 +25,7 @@ import {
 import { extractAnswerFinalText } from "./directAnswer.js";
 import {
   IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV,
+  nativeBenchmarkHeaderValue,
 } from "./selfInvocation.js";
 import { normalizeTenantId } from "./tenants.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
@@ -40,6 +41,7 @@ export {
 export const NATIVE_AGENT_HANDLE_SCHEMA = "impel.native-agent-run.v1";
 export const NATIVE_AGENT_RESULT_SCHEMA = "impel.native-agent-result.v1";
 export const NATIVE_AGENT_RECOVERY_SCHEMA = "impel.native-agent-recovery.v1";
+export const NATIVE_AGENT_BENCHMARK_HEADER = "X-Impel-Client-Benchmark";
 export const NATIVE_AGENT_CLIENT_BUILD = `cli/${JSON.parse(
   fs.readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"),
 ).version}+manifest.v${CURRENT_CONFIG_VERSION}`;
@@ -52,8 +54,8 @@ const SAFE_FINGERPRINT_RE = /^[a-f0-9]{64}$/u;
 const SAFE_INVOCATION_RE = /^[a-f0-9-]{36}$/u;
 const DEFAULT_WAIT_SECONDS = 20;
 const MAX_WAIT_SECONDS = 35;
-const DEFAULT_ATTACHMENT_WINDOW_MS = 40_000;
-const DEFAULT_UPSTREAM_TIMEOUT_MS = 42_000;
+export const DEFAULT_ATTACHMENT_WINDOW_MS = 40_000;
+export const DEFAULT_UPSTREAM_TIMEOUT_MS = 42_000;
 const DEFAULT_ANSWER_HEDGE_MS = 38_000;
 const DEFAULT_MAX_POLLS = 8;
 const DEFAULT_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
@@ -742,6 +744,7 @@ export class NativeAgentUpstreamSession {
     answerHedgeMs = nativeAgentAnswerHedgeMs(),
     setTimeoutImpl = setTimeout,
     clearTimeoutImpl = clearTimeout,
+    environment = process.env,
   }) {
     this.endpoint = `${normalizeGatewayUrl(gatewayUrl)}/mcp`;
     this.credential = credential;
@@ -755,6 +758,7 @@ export class NativeAgentUpstreamSession {
     this.answerHedgeMs = Math.max(0, answerHedgeMs);
     this.setTimeoutImpl = setTimeoutImpl;
     this.clearTimeoutImpl = clearTimeoutImpl;
+    this.benchmarkHeaderValue = nativeBenchmarkHeaderValue(environment);
     this.sessionId = null;
     this.nextId = 1;
   }
@@ -785,6 +789,9 @@ export class NativeAgentUpstreamSession {
           Accept: "application/json, text/event-stream",
           "X-Impel-Client-Request-Id": correlationId,
           "X-Impel-Client-Build": NATIVE_AGENT_CLIENT_BUILD,
+          ...(this.benchmarkHeaderValue
+            ? { [NATIVE_AGENT_BENCHMARK_HEADER]: this.benchmarkHeaderValue }
+            : {}),
           ...(this.sessionId ? { "Mcp-Session-Id": this.sessionId } : {}),
         },
         body: JSON.stringify(message),

package/src/selfInvocation.js

@@ -82,9 +82,23 @@ export const IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES = [
   "IMPEL_NATIVE_HOST",
   "IMPEL_NATIVE_HOST_BUILD",
 ];
+export const IMPEL_NATIVE_BENCHMARK_ENV = "IMPEL_NATIVE_BENCHMARK";
 export const IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV = "IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_MS";
 export const CODEX_NATIVE_AGENT_ATTACHMENT_WINDOW_MS = 100_000;
 
+const SAFE_NATIVE_BENCHMARK_HEADER_VALUE = /^[\x21-\x7e]{1,128}$/u;
+
+export function nativeBenchmarkHeaderValue(environment = process.env) {
+  const value = environment?.[IMPEL_NATIVE_BENCHMARK_ENV];
+  if (value === undefined) return null;
+  if (typeof value !== "string"
+    || value !== "1"
+    || !SAFE_NATIVE_BENCHMARK_HEADER_VALUE.test(value)) {
+    throw new Error(`${IMPEL_NATIVE_BENCHMARK_ENV} must be exactly 1 using visible ASCII`);
+  }
+  return value;
+}
+
 function managedMcpEnvironment(environment = process.env) {
   const telemetry = Object.fromEntries(
     IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES.flatMap((name) => {
@@ -92,7 +106,12 @@ function managedMcpEnvironment(environment = process.env) {
       return typeof value === "string" && value.length > 0 ? [[name, value]] : [];
     }),
   );
-  return { [IMPEL_MANAGED_MCP_ENV]: "1", ...telemetry };
+  const benchmark = nativeBenchmarkHeaderValue(environment);
+  return {
+    [IMPEL_MANAGED_MCP_ENV]: "1",
+    ...telemetry,
+    ...(benchmark ? { [IMPEL_NATIVE_BENCHMARK_ENV]: benchmark } : {}),
+  };
 }
 
 export function impelMcpInvocation(args = [], options = {}) {