lastlight 0.4.0 → 0.6.1

package/dist/engine/agent-executor.js

@@ -1,181 +1,29 @@
-import { resolve, basename, join, relative } from "path";
-import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "fs";
+import { resolve, join } from "path";
+import { mkdirSync, writeFileSync } from "fs";
+import { spawnSync } from "child_process";
 import { randomUUID } from "crypto";
-import { createTaskSandbox, setupTaskWorktree, SANDBOX_IMAGE_QA, } from "../sandbox/index.js";
+import { createTaskSandbox, setupTaskWorktree, prePopulateWorkspace, SANDBOX_IMAGE_QA, } from "../sandbox/index.js";
+import { SmolSandbox, smolAvailable, SMOL_WORKSPACE_DIR } from "../sandbox/smol.js";
 import { refreshGitAuth } from "./git-auth.js";
-import { AGENTIC_PROFILE_FOR, GITHUB_PERMISSION_PROFILES, loadAgentContext, } from "./profiles.js";
-import { AgenticShim, truncateForLog, safeStringify } from "./event-shim.js";
+import { GITHUB_PERMISSION_PROFILES, loadAgentContext, } from "./profiles.js";
+import { AgenticShim } from "./event-shim.js";
 import { projectSlugForCwd } from "../session-log.js";
-import { BuildAssetStore } from "../state/build-assets.js";
-import { ALLOW_ALL_SENTINEL, DEFAULT_ALLOWLIST, mergeAllowlist } from "../sandbox/egress-allowlist.js";
-import { getDockerSandboxOtelEnv, getOtelEnvForSandbox, recordError, recordExecutionMetrics, safeSpanAttributes, withSpan } from "../telemetry/index.js";
-import { recordPiEvent } from "../telemetry/pi-events.js";
-const DEFAULT_MODEL = "anthropic/claude-sonnet-4-6";
-const DOCKER_WORKSPACE_DIR = "/home/agent/workspace";
-// Directory holding one skill bundle per phase. Deliberately NOT named
-// `.agents/skills` (pi's auto-discovery path): we map each phase's bundle
-// explicitly via --skill / skillPaths so two phases sharing a workspace —
-// sequential today, parallel via worktrees tomorrow — can never clobber each
-// other's catalogue. The agent keeps cwd = the repo (no `cd` preamble on
-// every command); the bundle is staged at the workspace ROOT — a sibling of
-// the repo, never in its git tree — and reached by an absolute path. On
-// docker/none that root is genuinely outside the repo. gondolin mounts only
-// cwd, so there the bundle is staged under the repo and added to the
-// checkout's local `.git/info/exclude` (never committed; see `excludeFromGit`).
-const SKILL_BUNDLE_ROOT = ".lastlight-skills";
-const THINKING_LEVELS = new Set([
-    "off", "minimal", "low", "medium", "high", "xhigh",
-]);
+import { DEFAULT_ALLOWLIST, mergeAllowlist } from "../sandbox/egress-allowlist.js";
+import { getDockerSandboxOtelEnv, getOtelEnvForSandbox, safeSpanAttributes, withSpan } from "../telemetry/index.js";
+// Per-backend executors + their shared building blocks live under ./executors/.
+import { executeInProcess, executeDocker, executeSmol } from "./executors/backends.js";
+import { DEFAULT_MODEL, DOCKER_WORKSPACE_DIR, resolveSessionsDir } from "./executors/shared.js";
+// Re-exported for back-compat with existing importers (tests, dashboards).
+export { RunResultAccumulator, stageSkillBundle, excludeFromGit, detectAccountError } from "./executors/shared.js";
 /**
- * Stage this phase's declared skills into a per-phase bundle directory at
- * `<workspaceRoot>/.lastlight-skills/<phaseKey>/<basename>/` and return the
- * staged skill dirs, so the caller can point pi at them explicitly (via
- * `--skill` for docker or `skillPaths` for the in-process backends). Each
- * skill is a directory containing SKILL.md plus any `scripts/` / `references/`
- * / `assets/` — the whole tree comes along.
- *
- * Keyed by phase so concurrent phases in one workspace never touch each
- * other's bundle: only the phase's own `<phaseKey>` subtree is cleared, so a
- * clean slate per phase doesn't disturb a sibling phase mid-run.
- *
- * `mode` controls how each skill lands:
- *   - "symlink": one symlink per skill → host source. gondolin/none, where pi
- *     reads skill files host-side / through the cwd mount. Zero-copy.
- *   - "copy": recursive copy. docker, where the agent's tools run inside the
- *     container and host symlink targets wouldn't resolve; the copy lands
- *     under the bind-mounted workspace.
- *
- * Returns `undefined` when the phase declares no skills (after clearing its
- * bundle), so a phase with no `skills:` gets no catalogue at all.
+ * Shared run preparation for {@link executeAgent} and {@link executeCommand}:
+ * resolve the taskId / state dir / backend, mint the scoped GitHub token,
+ * assemble the sandbox env (git token, provider keys, OTEL), and compute the
+ * pre-populate descriptor. Both the agent and the deterministic command paths
+ * run in the same sandbox/workspace with the same git access, so they share
+ * this setup verbatim.
  */
-export function stageSkillBundle(workspaceRoot, phaseKey, skillPaths, mode) {
-    const bundleDir = join(workspaceRoot, SKILL_BUNDLE_ROOT, phaseKey);
-    if (existsSync(bundleDir)) {
-        rmSync(bundleDir, { recursive: true, force: true });
-    }
-    if (!skillPaths?.length)
-        return undefined;
-    mkdirSync(bundleDir, { recursive: true });
-    const staged = [];
-    for (const hostPath of skillPaths) {
-        const dest = join(bundleDir, basename(hostPath));
-        if (mode === "symlink") {
-            symlinkSync(hostPath, dest, "dir");
-        }
-        else {
-            cpSync(hostPath, dest, { recursive: true, dereference: true });
-        }
-        staged.push(dest);
-    }
-    return staged;
-}
-/**
- * Sanitized per-phase key for the skill bundle directory. Phase name first
- * (unique even for loop iterations like `reviewer_fix_1`), then workflow name,
- * then a constant fallback — so the bundle is always isolated per phase.
- */
-function skillBundleKey(config) {
-    const raw = config.telemetry?.phaseName || config.telemetry?.workflowName || "phase";
-    return raw.replace(/[^A-Za-z0-9_-]/g, "_") || "phase";
-}
-/**
- * Add `entry` to a checkout's local `.git/info/exclude` (idempotent) so the
- * agent's own `git add`/`commit` can never pick it up. This file lives inside
- * `.git/` — it is never tracked, committed, or pushed, and it leaves the repo's
- * real `.gitignore` untouched; the exclusion applies only to this ephemeral
- * sandbox checkout. Used for the gondolin backend, where the skill bundle must
- * be staged under cwd (the only mounted dir) rather than as an out-of-repo
- * sibling. No-op when `repoDir` isn't a git checkout (e.g. the workspace root).
- */
-export function excludeFromGit(repoDir, entry) {
-    const gitDir = join(repoDir, ".git");
-    if (!existsSync(gitDir))
-        return; // not a checkout — nothing to exclude
-    const infoDir = join(gitDir, "info");
-    const excludeFile = join(infoDir, "exclude");
-    const line = `/${entry}/`;
-    let current = "";
-    try {
-        current = readFileSync(excludeFile, "utf8");
-    }
-    catch { /* may not exist yet */ }
-    if (current.split(/\r?\n/).includes(line))
-        return;
-    mkdirSync(infoDir, { recursive: true });
-    appendFileSync(excludeFile, `${current.length && !current.endsWith("\n") ? "\n" : ""}${line}\n`);
-}
-// ── Server-mode build assets ────────────────────────────────────────
-//
-// In "server" mode the per-phase handoff docs live in the Last Light store
-// rather than being committed into the target repo. The seam is symmetric to
-// the skill bundle but bidirectional: stage the run's stored docs into the
-// repo's `.lastlight/<issueKey>/` before the agent runs (so a later phase /
-// resumed run sees prior context), and harvest whatever the phase wrote back
-// to the store afterwards. The directory is the SAME relative path as repo
-// mode (`{{issueDir}}`), so prompts are unchanged except for gating their
-// `git add .lastlight/ && commit` off — the dir is git-excluded here too as a
-// backstop against the agent's `git add -A` feature commit sweeping it in.
-const ARTIFACT_DIR_ROOT = ".lastlight";
-/**
- * Resolve the server-mode artifact context for a run, or undefined when not in
- * server mode (the default — the whole seam is then skipped and behaviour is
- * byte-for-byte repo mode). `hostRepoDir` is the host-visible repo checkout
- * (for docker that's the bind-mounted workspace path, not the in-container one).
- */
-function serverArtifacts(config, hostRepoDir) {
-    if (config.buildAssets !== "server" || !config.buildAssetsDir || !config.buildAssetsKey) {
-        return undefined;
-    }
-    const store = new BuildAssetStore(config.buildAssetsDir);
-    const ref = config.buildAssetsKey;
-    return { store, ref, dir: join(hostRepoDir, ARTIFACT_DIR_ROOT, ref.issueKey), repoDir: hostRepoDir };
-}
-/** Stage stored docs into the workspace + exclude the dir from git (server mode). */
-function stageArtifactsIn(art) {
-    if (!art)
-        return;
-    try {
-        // Stage the run's stored docs into `<repoDir>/.lastlight/<issueKey>/`. This
-        // is safe for every workflow shape here: pre-cloned workflows (build, pr-*)
-        // already have the checkout at `repoDir`, and non-pre-cloned ones (explore)
-        // clone the repo into a *subdir* — so `repoDir` is the workspace root and a
-        // `.lastlight/` there never collides with the agent's clone. (A future
-        // workflow that `git clone … .` into cwd would be the one exception.)
-        art.store.stageInto(art.ref, art.dir);
-        // Backstop the prompt-level commit gate: when this is a real checkout, keep
-        // the docs out of the agent's `git add -A` feature commit. No-op at the
-        // workspace root (no `.git`), where the docs sit outside the repo subtree
-        // and are never in the repo's git tree anyway.
-        excludeFromGit(art.repoDir, ARTIFACT_DIR_ROOT);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.warn(`[executor] Could not stage build assets: ${msg}`);
-    }
-}
-/** Persist docs the phase wrote back to the store (server mode). */
-function harvestArtifactsOut(art) {
-    if (!art)
-        return;
-    try {
-        art.store.harvestFrom(art.ref, art.dir);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.warn(`[executor] Could not harvest build assets: ${msg}`);
-    }
-}
-/**
- * Execute one workflow-phase agent task via agentic-pi.
- *
- * Sandbox backend (decided per call):
- *  1. gondolin — agentic-pi's QEMU micro-VM. cwd is the host worktree,
- *     mounted at /workspace inside the VM.
- *  2. docker — the legacy container path (`src/sandbox/docker.ts`). The
- *     entrypoint inside the container execs `agentic-pi run --sandbox none`.
- *  3. none — agentic-pi in-process with cwd = the host worktree.
- */
-export async function executeAgent(prompt, config, opts) {
+async function prepareRun(config, opts) {
     const taskId = opts?.taskId || `task-${randomUUID().slice(0, 8)}`;
     const stateDir = config.stateDir || resolve("data");
     const backend = config.sandbox ?? "gondolin";
@@ -274,6 +122,11 @@ export async function executeAgent(prompt, config, opts) {
             shallow: access.shallow,
         }
         : undefined;
+    return { taskId, stateDir, backend, ghEnv, mintedToken, prePopulate };
+}
+export async function executeAgent(prompt, config, opts) {
+    const { taskId, stateDir, backend, ghEnv, prePopulate } = await prepareRun(config, opts);
+    const access = opts?.githubAccess;
     const spanAttrs = safeSpanAttributes({
         "agent.runtime": "agentic-pi",
         "sandbox.backend": backend,
@@ -297,6 +150,16 @@ export async function executeAgent(prompt, config, opts) {
             onSessionId: opts?.onSessionId,
         }));
     }
+    if (backend === "smol") {
+        return withSpan("lastlight.agent.execute", spanAttrs, () => executeSmol(prompt, config, {
+            taskId,
+            stateDir,
+            env: ghEnv,
+            prePopulate,
+            access,
+            onSessionId: opts?.onSessionId,
+        }));
+    }
     const workDir = setupTaskWorktree({
         taskId,
         stateDir,
@@ -324,817 +187,272 @@ export async function executeAgent(prompt, config, opts) {
         onSessionId: opts?.onSessionId,
     }));
 }
-// ── In-process path (gondolin / none) ───────────────────────────────
-async function executeInProcess(prompt, config, ctx) {
-    const startTime = Date.now();
-    console.log(`  [executor] Running in-process (task: ${ctx.taskId}, sandbox: ${ctx.backend})`);
-    const model = config.model || DEFAULT_MODEL;
-    const thinking = coerceThinking(config.variant);
-    const profile = ctx.access ? AGENTIC_PROFILE_FOR[ctx.access.profile] : undefined;
-    const sessionsDir = resolveSessionsDir(config);
-    // When the harness pre-cloned the target repo, cwd is the checkout
-    // (`<workDir>/<repo>/`) so the agent's commands run inside the repo with no
-    // `cd` preamble; otherwise cwd is the workspace root and the agent clones in.
-    const agentCwd = ctx.access?.prePopulateBranch
-        ? join(ctx.workDir, ctx.access.repo)
-        : ctx.workDir;
-    // Stage this phase's skills into its own bundle and point pi at the staged
-    // dirs explicitly via `skillPaths` below. The bundle lives at the workspace
-    // root — a sibling of the repo, outside its git tree — for `none` (the host
-    // FS is fully visible in-process). gondolin mounts only cwd, so its bundle
-    // is staged under the repo and added to the checkout's local
-    // `.git/info/exclude` so the agent can't commit it.
-    const gondolin = ctx.backend === "gondolin";
-    const skillRoot = gondolin ? agentCwd : ctx.workDir;
-    let stagedSkillDirs;
-    try {
-        stagedSkillDirs = stageSkillBundle(skillRoot, skillBundleKey(config), config.skillPaths, "symlink");
-        if (stagedSkillDirs && gondolin)
-            excludeFromGit(agentCwd, SKILL_BUNDLE_ROOT);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.warn(`[executor] Could not stage skills: ${msg}`);
-    }
-    // Server-mode build assets: agentCwd is the host-visible repo checkout for
-    // the in-process backends (gondolin's cwd mount / none's host FS), so stage
-    // and harvest operate on it directly.
-    const artifacts = serverArtifacts(config, agentCwd);
-    stageArtifactsIn(artifacts);
+const SCRIPT_EXT = { js: "mjs", ts: "mts", python: "py" };
+/**
+ * Where a `type: script` source file is staged. A workspace-root sibling of
+ * {@link SKILL_BUNDLE_ROOT}, keyed per phase (`<root>/<phase>/script.<ext>`) —
+ * same convention as the skill bundle, so it sits beside the skills and is
+ * never written inside any checked-out repo's git tree.
+ */
+const SCRIPT_BUNDLE_ROOT = ".lastlight-scripts";
+/** Build the shell invocation + on-disk filename for a script spec. */
+function scriptInvocation(spec) {
+    const fileName = `script.${SCRIPT_EXT[spec.runtime]}`;
+    const run = (path) => {
+        switch (spec.runtime) {
+            case "js":
+                return `node ${path}`;
+            case "ts":
+                return `node --experimental-strip-types ${path}`;
+            case "python":
+                return `uv run ${path}`;
+        }
+    };
+    return { fileName, run };
+}
+/**
+ * Mirror a finished command into a session jsonl via the shim. Synthesizes a
+ * minimal agentic-pi event stream: session → assistant(tool_use bash) →
+ * user(tool_result) → assistant(text summary) → result. Returns the session id
+ * the shim wrote under (so the executions row can link to it).
+ */
+async function writeCommandSession(opts) {
     const shim = new AgenticShim({
-        homeDir: sessionsDir,
-        projectSlug: projectSlugForCwd(agentCwd),
-        model,
-        initialPrompt: prompt,
+        homeDir: opts.sessionsDir,
+        projectSlug: opts.projectSlug,
+        model: opts.model,
+        initialPrompt: opts.displayPrompt,
     });
-    // agentic-pi reads its own env (provider keys, App PEM, etc.) from
-    // process.env. Splice in our scoped values for the duration of the call,
-    // then restore.
-    const restore = applyEnv(ctx.env);
-    // Env forwarded INTO the sandbox so the agent's `bash` calls see it.
-    // agentic-pi auto-injects GITHUB_TOKEN/GH_TOKEN when --profile is set;
-    // git identity is set here so `git commit` works without extra setup.
-    //
-    // Notes per backend:
-    //   - gondolin: the VM's user inherits HOME from the agentic-pi process
-    //     (so the host's HOME — e.g. /Users/clifton — leaks in). We force
-    //     HOME=/root so `git config --global` and `gh auth status` write
-    //     to a real path inside the VM.
-    //   - none: agent runs on the host; do NOT override HOME (would mess
-    //     with the harness user's real config).
-    //   - docker (handled separately): the container's `agent` user has
-    //     its own HOME=/home/agent baked in by the image; no override.
-    const baseSandboxEnv = {
-        GIT_AUTHOR_NAME: "last-light[bot]",
-        GIT_AUTHOR_EMAIL: "last-light[bot]@users.noreply.github.com",
-        GIT_COMMITTER_NAME: "last-light[bot]",
-        GIT_COMMITTER_EMAIL: "last-light[bot]@users.noreply.github.com",
-        // /workspace is a bind mount from the host (host UID) into a VM running
-        // as a different UID; git refuses to operate without an explicit
-        // safe-directory. Setting it via GIT_CONFIG_* avoids needing HOME and
-        // a writeable ~/.gitconfig.
-        GIT_CONFIG_COUNT: "1",
-        GIT_CONFIG_KEY_0: "safe.directory",
-        GIT_CONFIG_VALUE_0: "*",
-    };
-    const otelSandboxEnv = config.otel?.enabled && config.otel.forwardToSandbox ? getOtelEnvForSandbox() : {};
-    const sandboxEnv = ctx.backend === "gondolin"
-        ? { ...otelSandboxEnv, ...baseSandboxEnv, HOME: "/root", USER: "root", LOGNAME: "root" }
-        : { ...otelSandboxEnv, ...baseSandboxEnv };
-    let notifiedSessionId = false;
-    let result;
-    const acc = new RunResultAccumulator();
-    try {
-        // HTTP egress allowlist. lastlight owns the policy (rather than relying
-        // on agentic-pi's bundled default) so a single source — `egress-allowlist.ts`
-        // — covers both backends. `unrestrictedEgress` opts a phase out via the
-        // `"*"` sentinel; gondolin (post the upstream allow-all patch) treats it
-        // as "allow every host".
-        const extraHosts = config.otel?.enabled && config.otel.forwardToSandbox ? config.otel.collectorHosts : [];
-        const allowedHttpHosts = config.unrestrictedEgress
-            ? [ALLOW_ALL_SENTINEL]
-            : mergeAllowlist(DEFAULT_ALLOWLIST, extraHosts);
-        // Loaded lazily: agentic-pi transitively imports pi-coding-agent, whose
-        // bundled undici writes a v8 Agent onto `Symbol.for('undici.globalDispatcher.1')`
-        // the moment its `lib/global.js` evaluates. Node's built-in fetch reads
-        // from the same symbol, so eager-loading here would poison every fetch
-        // in the harness — breaking arctic's OAuth code exchange (strict
-        // content-length validation). Dynamic import keeps the harness on
-        // Node's clean dispatcher unless an in-process sandbox actually runs.
-        const { run: agenticRun } = await import("agentic-pi");
-        result = await agenticRun({
-            model,
-            prompt,
-            thinking,
-            profile,
-            sandbox: ctx.backend === "gondolin" ? "gondolin" : "none",
-            sandboxEnv,
-            cwd: agentCwd,
-            noSession: true,
-            // Explicit per-phase skill bundle (staged above). pi loads these
-            // additively; nothing is written into the repo for the agent to commit.
-            skillPaths: stagedSkillDirs,
-            allowedHttpHosts,
-            // Explicit boolean — without it, agentic-pi auto-enables web search
-            // when any provider key is in process.env. We forwarded those keys
-            // above only for opted-in workflows, but `process.env` on the harness
-            // host carries them regardless, so we must opt-out explicitly.
-            webSearch: config.webSearch === true,
-            webSearchProvider: config.webSearchProvider,
-            onEvent: (record) => {
-                acc.feed(record);
-                shim.feed(record);
-                recordPiEvent(record, {
-                    includeContent: config.otel?.includeContent === true,
-                    surface: "agent",
-                    workflowName: config.telemetry?.workflowName,
-                    phaseName: config.telemetry?.phaseName,
-                    model,
-                });
-                if (!notifiedSessionId && ctx.onSessionId && record.type === "session" && typeof record.id === "string") {
-                    notifiedSessionId = true;
-                    ctx.onSessionId(record.id);
-                }
-            },
-            onWarn: (msg) => console.warn(`[agentic] ${msg}`),
-        });
-    }
-    catch (err) {
-        restore();
-        // Harvest even on failure so a partial plan/summary still reaches the store.
-        harvestArtifactsOut(artifacts);
-        const msg = err instanceof Error ? err.message : String(err);
-        const durationMs = Date.now() - startTime;
-        recordError("agent", err, { "sandbox.backend": ctx.backend, model, success: false, stop_reason: "error_executor", "workflow.name": config.telemetry?.workflowName, "phase.name": config.telemetry?.phaseName });
-        recordExecutionMetrics("agent", { "sandbox.backend": ctx.backend, model, success: false, stop_reason: "error_executor", durationMs });
-        const fallbackId = `exec-${basename(ctx.taskId)}`;
-        const synthesizedId = await shim
-            .finalizeWithFallback(emptyResult("error_executor", durationMs), fallbackId, msg)
-            .catch(() => null);
-        return {
-            success: false,
-            output: "",
-            turns: 0,
-            error: msg,
-            durationMs,
-            sessionId: synthesizedId ?? undefined,
-            stopReason: "error_executor",
-        };
-    }
-    restore();
-    harvestArtifactsOut(artifacts);
-    // agentic-pi's in-process `stats` is the same compaction-blind
-    // `usage_snapshot`. Prefer our per-message accumulation when it carries
-    // token data (see RunResultAccumulator.bestStats).
-    const better = acc.bestStats();
-    if (better && (better.tokens?.total ?? 0) > 0)
-        result.stats = better;
-    const finalResult = await finalizeFromRunResult(result, prompt, shim, startTime, acc.extensions(), acc.skills(), acc.toolError(), acc.endedOnToolCall());
-    recordExecutionMetrics("agent", {
-        "sandbox.backend": ctx.backend,
-        model,
-        success: finalResult.success,
-        stop_reason: finalResult.stopReason,
-        durationMs: finalResult.durationMs,
-        costUsd: finalResult.costUsd,
-        inputTokens: finalResult.inputTokens,
-        outputTokens: finalResult.outputTokens,
-        "workflow.name": config.telemetry?.workflowName,
-        "phase.name": config.telemetry?.phaseName,
+    const sessionId = randomUUID();
+    const ts = Date.now();
+    const toolCallId = `cmd_${randomUUID().slice(0, 8)}`;
+    const feed = (record) => shim.feed(record);
+    feed({ type: "session", id: sessionId, timestamp: ts });
+    feed({
+        type: "message_end",
+        sessionId,
+        timestamp: ts,
+        message: { role: "assistant", content: [{ type: "toolCall", id: toolCallId, name: opts.toolName, arguments: opts.toolInput }] },
     });
-    return finalResult;
-}
-// ── Docker path ─────────────────────────────────────────────────────
-async function executeDocker(prompt, config, ctx) {
-    // HTTP egress routing — docker analog of the gondolin allowlist.
-    // Sandbox is wired to coredns-strict by default (allowlist enforced via
-    // DNS sinkhole + nginx ssl_preread); a phase that set
-    // `unrestricted_egress: true` points at coredns-open instead.
-    // The IPs here match the static assignments in docker-compose.yml
-    // (see src/sandbox/egress-firewall-config.ts for the constants).
-    const dnsIp = config.unrestrictedEgress
-        ? (process.env.LASTLIGHT_DNS_OPEN || "172.30.0.11")
-        : (process.env.LASTLIGHT_DNS_STRICT || "172.30.0.10");
-    // A phase can opt into the browser-QA image (Playwright + Chromium baked in)
-    // with `sandbox_image: qa`. The runner only schedules such a phase when the
-    // image is actually present (see `qaImageAvailable`), so by here it's safe to
-    // request; pass undefined otherwise to use the lean default image.
-    const imageName = config.sandboxImage === "qa" ? SANDBOX_IMAGE_QA : undefined;
-    const sbx = await createTaskSandbox({
-        taskId: ctx.taskId,
-        stateDir: ctx.stateDir,
-        sandboxDir: config.sandboxDir,
-        env: ctx.env,
-        prePopulate: ctx.prePopulate,
-        dnsIp,
-        imageName,
+    const combined = opts.stderr ? `${opts.stdout}${opts.stdout && !opts.stdout.endsWith("\n") ? "\n" : ""}${opts.stderr}` : opts.stdout;
+    feed({
+        type: "tool_execution_end",
+        sessionId,
+        timestamp: ts,
+        toolCallId,
+        result: combined || `(no output, exit ${opts.exitCode})`,
+        isError: opts.exitCode !== 0,
     });
-    if (!sbx) {
-        throw new Error("LASTLIGHT_SANDBOX=docker but no docker sandbox was available. " +
-            "Install Docker and build the sandbox image, or set LASTLIGHT_SANDBOX=gondolin / none.");
-    }
-    try {
-        const md = loadAgentContext(config.agentContextDir);
-        if (md)
-            writeFileSync(join(sbx.workDir, "AGENTS.md"), md);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.warn(`[executor] Could not write docker AGENTS.md: ${msg}`);
-    }
-    const startTime = Date.now();
-    console.log(`  [executor] Running in docker sandbox (task: ${ctx.taskId})`);
-    const model = config.model || DEFAULT_MODEL;
-    const thinking = coerceThinking(config.variant);
-    const profile = ctx.access ? AGENTIC_PROFILE_FOR[ctx.access.profile] : undefined;
-    const sessionsDir = resolveSessionsDir(config);
-    // When the harness pre-cloned the repo, cwd is the checkout
-    // (`<workspace>/<repo>/`) so the agent runs inside the repo with no `cd`
-    // preamble; otherwise it's the workspace root.
-    const agentCwd = ctx.prePopulate
-        ? `${DOCKER_WORKSPACE_DIR}/${ctx.prePopulate.repo}`
-        : DOCKER_WORKSPACE_DIR;
-    // Stage this phase's skills into its own bundle at the workspace ROOT — a
-    // sibling of any repo subdir, never inside its git tree. docker bind-mounts
-    // the WHOLE workspace, so the agent reaches the bundle by an absolute
-    // `--skill` path even though cwd is the repo. Copy (not symlink) because the
-    // agent's tools run inside the container and host symlink targets don't
-    // resolve there. Map the host dests to their in-container paths for `--skill`.
-    let skillDirsInContainer = [];
-    try {
-        const staged = stageSkillBundle(sbx.workDir, skillBundleKey(config), config.skillPaths, "copy");
-        if (staged) {
-            skillDirsInContainer = staged.map((d) => `${DOCKER_WORKSPACE_DIR}/${relative(sbx.workDir, d)}`);
-        }
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.warn(`[executor] Could not stage skills in docker workspace: ${msg}`);
-    }
-    // Server-mode build assets. The host-visible repo checkout is the
-    // bind-mounted workspace path (`sbx.workDir[/<repo>]`), NOT the in-container
-    // `agentCwd`. Stage now; harvest before each `sbx.cleanup()` below (cleanup
-    // removes the workspace, taking the docs with it).
-    const hostRepoDir = ctx.prePopulate ? join(sbx.workDir, ctx.prePopulate.repo) : sbx.workDir;
-    const artifacts = serverArtifacts(config, hostRepoDir);
-    stageArtifactsIn(artifacts);
-    // The dashboard reads from <sessionsDir>/projects/<slug>/. Use the same
-    // resolved cwd for the slug so live tails land in the right project dir.
-    const shim = new AgenticShim({
-        homeDir: sessionsDir,
-        projectSlug: projectSlugForCwd(agentCwd),
-        model,
-        initialPrompt: prompt,
+    const summary = opts.exitCode === 0 ? "Command succeeded (exit 0)." : `Command failed (exit ${opts.exitCode}).`;
+    feed({
+        type: "message_end",
+        sessionId,
+        timestamp: ts,
+        message: { role: "assistant", content: [{ type: "text", text: summary }] },
     });
-    const acc = new RunResultAccumulator();
-    let notifiedSessionId = false;
-    // Identity forwarded into the sandboxed agentic-pi run inside the container.
-    // The container's `agent` user already has HOME=/home/agent set up, so we
-    // do NOT override HOME here — only git identity + safe.directory (for the
-    // host-UID bind mount). GITHUB_TOKEN/GH_TOKEN are auto-injected by
-    // agentic-pi when --profile is set.
-    const sandboxEnv = {
-        // Inner-run env for the agent's child shells. Points at the in-network
-        // collector (IP-only, no secret headers) so any OTLP a script emits is
-        // tunnelled the same way the agent's own telemetry is.
-        ...(config.otel?.enabled && config.otel.forwardToSandbox ? getDockerSandboxOtelEnv() : {}),
-        GIT_AUTHOR_NAME: "last-light[bot]",
-        GIT_AUTHOR_EMAIL: "last-light[bot]@users.noreply.github.com",
-        GIT_COMMITTER_NAME: "last-light[bot]",
-        GIT_COMMITTER_EMAIL: "last-light[bot]@users.noreply.github.com",
-        GIT_CONFIG_COUNT: "1",
-        GIT_CONFIG_KEY_0: "safe.directory",
-        GIT_CONFIG_VALUE_0: "*",
-    };
-    try {
-        await sbx.sandbox.runAgent(ctx.taskId, prompt, {
-            model,
-            thinking,
-            profile,
-            sandboxEnv,
-            agentCwd,
-            skillDirs: skillDirsInContainer,
-            webSearch: config.webSearch === true,
-            webSearchProvider: config.webSearchProvider,
-            onLine: (line) => {
-                if (!line.startsWith("{"))
-                    return;
-                let record;
-                try {
-                    record = JSON.parse(line);
-                }
-                catch {
-                    return;
-                }
-                acc.feed(record);
-                shim.feed(record);
-                recordPiEvent(record, {
-                    includeContent: config.otel?.includeContent === true,
-                    surface: "agent",
-                    workflowName: config.telemetry?.workflowName,
-                    phaseName: config.telemetry?.phaseName,
-                    model,
-                });
-                if (!notifiedSessionId && ctx.onSessionId && record.type === "session" && typeof record.id === "string") {
-                    notifiedSessionId = true;
-                    ctx.onSessionId(record.id);
-                }
-            },
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        const durationMs = Date.now() - startTime;
-        recordError("agent", err, { "sandbox.backend": "docker", model, success: false, stop_reason: "error_sandbox", "workflow.name": config.telemetry?.workflowName, "phase.name": config.telemetry?.phaseName });
-        recordExecutionMetrics("agent", { "sandbox.backend": "docker", model, success: false, stop_reason: "error_sandbox", durationMs });
-        const fallbackId = `exec-${basename(ctx.taskId)}`;
-        const synthesizedId = await shim
-            .finalizeWithFallback(emptyResult("error_sandbox", durationMs), fallbackId, msg)
-            .catch(() => null);
-        harvestArtifactsOut(artifacts);
-        await sbx.cleanup();
-        return {
-            success: false,
-            output: "",
-            turns: 0,
-            error: msg,
-            durationMs,
-            sessionId: synthesizedId ?? undefined,
-            stopReason: "error_sandbox",
-        };
-    }
-    harvestArtifactsOut(artifacts);
-    await sbx.cleanup();
-    const finalResult = await finalizeFromRunResult(acc.build(0), prompt, shim, startTime, acc.extensions(), acc.skills(), acc.toolError(), acc.endedOnToolCall());
-    recordExecutionMetrics("agent", {
-        "sandbox.backend": "docker",
-        model,
-        success: finalResult.success,
-        stop_reason: finalResult.stopReason,
-        durationMs: finalResult.durationMs,
-        costUsd: finalResult.costUsd,
-        inputTokens: finalResult.inputTokens,
-        outputTokens: finalResult.outputTokens,
-        "workflow.name": config.telemetry?.workflowName,
-        "phase.name": config.telemetry?.phaseName,
+    shim.finalize({
+        finalText: summary,
+        turns: 1,
+        costUsd: 0,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadInputTokens: 0,
+        cacheCreationInputTokens: 0,
+        stopReason: opts.exitCode === 0 ? "success" : "error_bash",
+        durationMs: opts.durationMs,
     });
-    return finalResult;
+    await shim.flush();
+    return shim.isInitialized ? sessionId : null;
 }
 /**
- * Build a RunResult-shaped tally from the JSONL event stream emitted by
- * `agentic-pi run` inside the docker sandbox. Mirrors what agentic-pi's
- * own `run()` function does in-process — minimum viable subset of
- * fields the executor cares about.
- *
- * Usage accounting accumulates each assistant `message_end`'s `usage`
- * rather than trusting the terminal `usage_snapshot`. pi's snapshot is
- * derived from `getSessionStats()`, which recomputes from the *current*
- * in-memory message window — auto-compaction replaces those messages with
- * a summary, so the snapshot reports zero tokens/cost/turns the moment a
- * phase compacts. The per-message events fire at finalization (before any
- * compaction rebuild), so summing them is compaction-proof. `bestStats()`
- * prefers the accumulation and falls back to the snapshot only when no
- * per-message usage was observed.
+ * Execute a deterministic command/script. Mirrors {@link executeDocker} /
+ * {@link executeInProcess} for sandbox setup but runs `runCommand` (docker) or
+ * `spawnSync` (gondolin/none) instead of an agent, and writes a session jsonl
+ * so the output is visible in the dashboard + CLI.
  */
-export class RunResultAccumulator {
-    sessionId;
-    finalText = "";
-    agentEnded = false;
-    toolErrors = false;
-    lastToolError;
-    // True iff the last assistant turn ended with a tool call — i.e. the agent
-    // asked for a tool and the loop terminated before it could respond to the
-    // result. That's a truncated run (pi hit its internal step cap mid-task),
-    // not a finished one. See `finalizeFromRunResult`'s truncation guard.
-    lastAssistantHadToolCall = false;
-    fatalError;
-    snapshotStats;
-    messages = [];
-    // Per-message usage accumulation (the compaction-proof source).
-    assistantMessages = 0;
-    userMessages = 0;
-    toolCalls = 0;
-    toolResults = 0;
-    msgInput = 0;
-    msgOutput = 0;
-    msgCacheRead = 0;
-    msgCacheWrite = 0;
-    msgCost = 0;
-    // Extension status events (file-search / github / web-search), keyed by
-    // extension name. Emitted once each at run start; we keep the raw payload
-    // (minus type/extension) so build() can map them onto the RunResult.
-    ext = {};
-    // Skill-loading status. agentic-pi emits a single (gated) `skills_status`
-    // event at run start; we keep the raw payload (minus type) so skills()
-    // can normalize it onto the RunResult, mirroring `ext` above for tools.
-    skillsRaw;
-    feed(r) {
-        switch (r.type) {
-            case "session":
-                if (typeof r.id === "string")
-                    this.sessionId = r.id;
-                break;
-            case "extension_status": {
-                if (typeof r.extension === "string") {
-                    const { type: _t, extension: _e, ...rest } = r;
-                    this.ext[r.extension] = rest;
+export async function executeCommand(spec, config, opts) {
+    const { taskId, stateDir, backend, ghEnv, prePopulate } = await prepareRun(config, opts);
+    const access = opts?.githubAccess;
+    const model = config.model || DEFAULT_MODEL;
+    const sessionsDir = resolveSessionsDir(config);
+    const timeoutSeconds = opts?.timeoutSeconds ?? 300;
+    const startTime = Date.now();
+    const displayPrompt = spec.kind === "bash" ? `$ ${spec.command}` : `${spec.runtime} script: ${spec.name}\n\n${spec.script}`;
+    const spanAttrs = safeSpanAttributes({
+        "agent.runtime": spec.kind,
+        "sandbox.backend": backend,
+        "task.id": taskId,
+        repo: access?.repo,
+        "github.profile": access?.profile,
+        unrestricted_egress: config.unrestrictedEgress === true,
+        "workflow.name": config.telemetry?.workflowName,
+        "phase.name": config.telemetry?.phaseName,
+    });
+    return withSpan("lastlight.command.execute", spanAttrs, async () => {
+        // Per-phase script-bundle dir, a workspace-root sibling of the skill bundle
+        // (and of any repo checkout) — so a `type: script` file is never written
+        // inside the target's git tree. `spec.name` is the (sanitized) phase name.
+        const scriptDir = spec.kind === "script" ? `${SCRIPT_BUNDLE_ROOT}/${spec.name}` : SCRIPT_BUNDLE_ROOT;
+        if (backend === "docker") {
+            const dnsIp = config.unrestrictedEgress
+                ? (process.env.LASTLIGHT_DNS_OPEN || "172.30.0.11")
+                : (process.env.LASTLIGHT_DNS_STRICT || "172.30.0.10");
+            const imageName = config.sandboxImage === "qa" ? SANDBOX_IMAGE_QA : undefined;
+            const sbx = await createTaskSandbox({
+                taskId, stateDir, sandboxDir: config.sandboxDir, env: ghEnv, prePopulate, dnsIp, imageName,
+            });
+            if (!sbx) {
+                throw new Error("LASTLIGHT_SANDBOX=docker but no docker sandbox was available for command phase.");
+            }
+            const agentCwd = prePopulate ? `${DOCKER_WORKSPACE_DIR}/${prePopulate.repo}` : DOCKER_WORKSPACE_DIR;
+            try {
+                let command;
+                let toolName;
+                let toolInput;
+                if (spec.kind === "bash") {
+                    command = spec.command;
+                    toolName = "bash";
+                    toolInput = { command: spec.command };
+                }
+                else {
+                    const { fileName, run } = scriptInvocation(spec);
+                    mkdirSync(join(sbx.workDir, scriptDir), { recursive: true });
+                    writeFileSync(join(sbx.workDir, scriptDir, fileName), spec.script);
+                    const inContainer = `${DOCKER_WORKSPACE_DIR}/${scriptDir}/${fileName}`;
+                    command = run(inContainer);
+                    toolName = "bash";
+                    toolInput = { command, runtime: spec.runtime };
                 }
-                break;
+                const res = await sbx.sandbox.runCommand(taskId, command, {
+                    cwd: agentCwd,
+                    sandboxEnv: opts?.sandboxEnv,
+                    timeoutSeconds,
+                    onLine: () => { },
+                });
+                const durationMs = Date.now() - startTime;
+                const sessionId = opts?.writeSession === false ? null : await writeCommandSession({
+                    sessionsDir, projectSlug: projectSlugForCwd(agentCwd), model,
+                    displayPrompt, toolName, toolInput,
+                    stdout: res.stdout, stderr: res.stderr, exitCode: res.exitCode, durationMs,
+                });
+                if (sessionId && opts?.onSessionId)
+                    opts.onSessionId(sessionId);
+                return buildCommandResult(res, durationMs, sessionId);
+            }
+            finally {
+                await sbx.cleanup();
             }
-            case "skills_status": {
-                const { type: _t, ...rest } = r;
-                this.skillsRaw = rest;
-                break;
+        }
+        if (backend === "smol") {
+            if (!smolAvailable()) {
+                throw new Error("LASTLIGHT_SANDBOX=smol but the smolvm CLI is not available for command phase.");
             }
-            case "message_end": {
-                const m = r.message;
-                if (m?.role === "assistant" && Array.isArray(m.content)) {
-                    const text = m.content
-                        .filter((c) => c.type === "text" && typeof c.text === "string")
-                        .map((c) => c.text)
-                        .join("");
-                    if (text)
-                        this.finalText = text;
-                    this.assistantMessages += 1;
-                    const toolCallsInTurn = m.content.filter((c) => c.type === "toolCall").length;
-                    this.toolCalls += toolCallsInTurn;
-                    // Track whether the *latest* assistant turn requested a tool. If the
-                    // run ends here (no synthesis turn follows the tool result), the
-                    // agent was cut off mid-task.
-                    this.lastAssistantHadToolCall = toolCallsInTurn > 0;
-                    this.accumulateUsage(m.usage);
+            const allowHosts = config.unrestrictedEgress
+                ? null
+                : mergeAllowlist(DEFAULT_ALLOWLIST, config.otel?.enabled && config.otel.forwardToSandbox ? config.otel.collectorHosts : []);
+            // Boot first, then provision the probed share-backed dir (see executeSmol).
+            const workDir = setupTaskWorktree({ taskId, stateDir, sandboxDir: config.sandboxDir });
+            const sandbox = new SmolSandbox({ env: ghEnv, allowHosts });
+            const machine = await sandbox.create({ taskId, worktreePath: workDir });
+            const hostWs = machine.hostWorkspace;
+            if (prePopulate)
+                prePopulateWorkspace(hostWs, prePopulate);
+            const agentCwd = prePopulate ? `${SMOL_WORKSPACE_DIR}/${prePopulate.repo}` : SMOL_WORKSPACE_DIR;
+            try {
+                let command;
+                let toolName;
+                let toolInput;
+                if (spec.kind === "bash") {
+                    command = spec.command;
+                    toolName = "bash";
+                    toolInput = { command: spec.command };
                 }
-                else if (m?.role === "user") {
-                    this.userMessages += 1;
+                else {
+                    const { fileName, run } = scriptInvocation(spec);
+                    mkdirSync(join(hostWs, scriptDir), { recursive: true });
+                    writeFileSync(join(hostWs, scriptDir, fileName), spec.script);
+                    const inGuest = `${SMOL_WORKSPACE_DIR}/${scriptDir}/${fileName}`;
+                    command = run(inGuest);
+                    toolName = "bash";
+                    toolInput = { command, runtime: spec.runtime };
                 }
-                break;
+                const res = await sandbox.runCommand(taskId, command, {
+                    cwd: agentCwd,
+                    sandboxEnv: opts?.sandboxEnv,
+                    timeoutSeconds,
+                    onLine: () => { },
+                });
+                const durationMs = Date.now() - startTime;
+                const sessionId = opts?.writeSession === false ? null : await writeCommandSession({
+                    sessionsDir, projectSlug: projectSlugForCwd(agentCwd), model,
+                    displayPrompt, toolName, toolInput,
+                    stdout: res.stdout, stderr: res.stderr, exitCode: res.exitCode, durationMs,
+                });
+                if (sessionId && opts?.onSessionId)
+                    opts.onSessionId(sessionId);
+                return buildCommandResult(res, durationMs, sessionId);
             }
-            case "tool_execution_end":
-                this.toolResults += 1;
-                if (r.isError === true) {
-                    this.toolErrors = true;
-                    // Keep the actual failure text (not just a boolean) so a run that
-                    // ends in `error_tool` can report which tool failed and why —
-                    // e.g. a provider `insufficient_quota` surfaced through an MCP
-                    // call, or a bash command's stderr. Last error wins (it's the
-                    // one that ended the run). truncate: tool output can be huge.
-                    const raw = r.error ?? r.result ?? r.output;
-                    const message = truncateForLog(typeof raw === "string" ? raw : safeStringify(raw), 4096);
-                    const tool = typeof r.tool === "string"
-                        ? r.tool
-                        : typeof r.toolName === "string"
-                            ? r.toolName
-                            : undefined;
-                    if (message)
-                        this.lastToolError = { tool, message };
-                }
-                break;
-            case "agent_end":
-                this.agentEnded = true;
-                if (Array.isArray(r.messages))
-                    this.messages = r.messages;
-                break;
-            case "usage_snapshot":
-                this.snapshotStats = r.stats;
-                break;
-            case "fatal_error":
-                this.fatalError = r.error;
-                break;
-        }
-    }
-    accumulateUsage(usage) {
-        if (!usage || typeof usage !== "object")
-            return;
-        const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
-        this.msgInput += num(usage.input);
-        this.msgOutput += num(usage.output);
-        this.msgCacheRead += num(usage.cacheRead);
-        this.msgCacheWrite += num(usage.cacheWrite);
-        const cost = usage.cost;
-        if (cost && typeof cost === "object")
-            this.msgCost += num(cost.total);
-    }
-    /** Stats summed from per-message usage, or undefined if none was seen. */
-    accumulatedStats() {
-        const total = this.msgInput + this.msgOutput + this.msgCacheRead + this.msgCacheWrite;
-        if (this.assistantMessages === 0 && total === 0)
-            return undefined;
-        return {
-            userMessages: this.userMessages,
-            assistantMessages: this.assistantMessages,
-            toolCalls: this.toolCalls,
-            toolResults: this.toolResults,
-            tokens: {
-                input: this.msgInput,
-                output: this.msgOutput,
-                cacheRead: this.msgCacheRead,
-                cacheWrite: this.msgCacheWrite,
-                total,
-            },
-            cost: this.msgCost,
-        };
-    }
-    /**
-     * Prefer the per-message accumulation (compaction-proof) over pi's
-     * terminal `usage_snapshot`. Fall back to the snapshot only when the
-     * accumulation carries no token data — e.g. a provider that doesn't
-     * report per-message usage — so a non-compacted snapshot still wins.
-     */
-    bestStats() {
-        const acc = this.accumulatedStats();
-        if (acc && acc.tokens.total > 0)
-            return acc;
-        return this.snapshotStats ?? acc;
-    }
-    build(exitCode) {
-        return {
-            exitCode: exitCode,
-            ok: exitCode === 0 && !this.fatalError,
-            agentEnded: this.agentEnded,
-            toolErrors: this.toolErrors,
-            fatalError: this.fatalError,
-            sessionId: this.sessionId,
-            finalText: this.finalText,
-            messages: this.messages,
-            stats: this.bestStats(),
-            records: [],
-            warnings: [],
-        };
-    }
-    /**
-     * Normalized extension status captured from `extension_status` events
-     * (file-search / github / web-search), or undefined if none reported.
-     * Decoupled from agentic-pi's `RunResult` type, which lags the runtime —
-     * the docker sandbox's agentic-pi emits file-search even when the harness's
-     * pinned `RunResult` type doesn't yet declare it.
-     */
-    extensions() {
-        const out = {};
-        for (const [name, v] of Object.entries(this.ext)) {
-            if (v && typeof v.status === "string") {
-                out[name] = {
-                    status: v.status,
-                    ...(typeof v.mode === "string" ? { mode: v.mode } : {}),
-                    ...(typeof v.provider === "string" ? { provider: v.provider } : {}),
-                    ...(typeof v.toolCount === "number" ? { toolCount: v.toolCount } : {}),
-                    ...(typeof v.reason === "string" ? { reason: v.reason } : {}),
-                };
+            finally {
+                await sandbox.destroy(taskId);
             }
         }
-        return Object.keys(out).length > 0 ? out : undefined;
-    }
-    /**
-     * Normalized skill-loading status from the gated `skills_status` event, or
-     * undefined if none was reported (agentic-pi suppresses it on a run that
-     * configured no skills and discovered none). The skill-loading counterpart
-     * to {@link extensions}.
-     */
-    skills() {
-        const s = this.skillsRaw;
-        if (!s || typeof s.status !== "string")
-            return undefined;
-        const skills = Array.isArray(s.skills)
-            ? s.skills
-                .filter((x) => !!x && typeof x === "object")
-                .map((x) => ({
-                name: typeof x.name === "string" ? x.name : "",
-                source: typeof x.source === "string" ? x.source : "",
-                modelInvocable: x.modelInvocable === true,
-            }))
-            : [];
-        return {
-            status: s.status,
-            discovered: typeof s.discovered === "number" ? s.discovered : skills.length,
-            skills,
-            mappedPaths: Array.isArray(s.mappedPaths)
-                ? s.mappedPaths.filter((p) => typeof p === "string")
-                : [],
-            noSkills: s.noSkills === true,
-        };
-    }
-    /**
-     * The last tool result that came back with `isError: true`, including the
-     * failure text — or undefined if no tool errored. This is what turns a
-     * bare `error_tool` stop reason into a human-readable cause.
-     */
-    toolError() {
-        return this.lastToolError;
-    }
-    /**
-     * True iff the run's final assistant turn ended on a tool call — meaning
-     * the agent intended to keep going but the loop stopped before it could
-     * respond to the tool result and write its answer. The signal a run was
-     * truncated (step-limit) rather than genuinely finished.
-     */
-    endedOnToolCall() {
-        return this.lastAssistantHadToolCall;
-    }
-}
-// ── Helpers ─────────────────────────────────────────────────────────
-/** Provider account/billing/auth failures pi may surface as error text. */
-const ACCOUNT_ERROR_MARKERS = [
-    "credit balance",
-    "insufficient_quota",
-    "insufficient quota",
-    "rate limit",
-    "unauthorized",
-    "invalid_api_key",
-];
-/**
- * Detect a provider account error (out of credit, quota, rate-limited, bad key)
- * that pi may have surfaced as plain text rather than a hard failure.
- *
- * Critically, on a **successful** run we scan ONLY the genuine provider-error
- * channel (`agentErrorMessage`, which `extractAgentError` already turns into a
- * non-success stopReason when set — so it's empty here). The agent's own output
- * (`finalText`) and tool results (`fatalError`, `toolError`) are NOT scanned on
- * success: a legitimate `verify`/`qa-test` report or a `curl` probing a 401
- * endpoint routinely contains "unauthorized" / "rate limit" as part of the task
- * itself, and folding that in would wrongly fail a genuinely successful run
- * (and drop its report). Only on a failed run do we fold those in to label why.
- */
-export function detectAccountError(opts) {
-    const combined = [
-        opts.success ? undefined : opts.fatalErrorMessage,
-        opts.agentErrorMessage,
-        opts.success ? undefined : opts.finalText,
-        opts.success ? undefined : opts.toolErrorText,
-    ]
-        .filter((s) => typeof s === "string" && s.length > 0)
-        .join("\n")
-        .toLowerCase();
-    return ACCOUNT_ERROR_MARKERS.some((m) => combined.includes(m));
-}
-function finalizeFromRunResult(result, _prompt, shim, startTime, extensions, skills, toolError, endedOnToolCall = false) {
-    const durationMs = Date.now() - startTime;
-    const stats = result.stats;
-    // pi-agent-core swallows provider API errors (insufficient_quota, rate
-    // limit, auth) inside `handleRunFailure`: it synthesizes an assistant
-    // message with stopReason "error" + errorMessage and emits a clean
-    // agent_end. Without this check the run would map to "success" and the
-    // workflow would silently advance with no output. See message scan below.
-    const agentError = extractAgentError(result);
-    let stopReason = agentError?.stopReason ?? mapStopReason(result);
-    // Truncation guard. A run that *would* map to "success" but whose final
-    // assistant turn ended on a tool call was cut off mid-task: the agent
-    // asked for a tool and the loop stopped before it could read the result
-    // and synthesize an answer (pi hit its internal step cap — agentic-pi
-    // v0.2.7 exposes no maxSteps knob to lift it). In that state `finalText`
-    // is the agent's "let me just check X" preamble, NOT an answer. Reclassify
-    // as a failure so the workflow fires `on_failure` instead of delivering
-    // the fragment as if it were the result.
-    const truncated = stopReason === "success" && !agentError && endedOnToolCall;
-    if (truncated)
-        stopReason = "error_truncated";
-    const success = stopReason === "success";
-    const truncationMessage = "Agent stopped mid-task before producing a final answer (hit the agent " +
-        "step limit). No answer was delivered.";
-    // A bare `error_tool` stop reason is useless on its own. Surface the
-    // failing tool's actual error text so the executions row and dashboard
-    // show *why* the run died (e.g. "Tool `bash` failed: insufficient_quota").
-    const toolErrorText = toolError
-        ? toolError.tool
-            ? `Tool \`${toolError.tool}\` failed: ${toolError.message}`
-            : toolError.message
-        : undefined;
-    const inputTokens = stats?.tokens.input ?? 0;
-    const outputTokens = stats?.tokens.output ?? 0;
-    const cacheRead = stats?.tokens.cacheRead ?? 0;
-    const cacheWrite = stats?.tokens.cacheWrite ?? 0;
-    const costUsd = stats?.cost ?? 0;
-    const turns = stats?.assistantMessages ?? 0;
-    const costStr = costUsd > 0 ? `, $${costUsd.toFixed(4)}` : "";
-    console.log(`  [executor] Result: ${stopReason} (${turns} turns, ${Math.round(durationMs / 1000)}s${costStr})` +
-        `${result.sessionId ? ` [session ${result.sessionId}]` : ""}`);
-    shim.finalize({
-        finalText: result.finalText,
-        turns,
-        costUsd,
-        inputTokens,
-        outputTokens,
-        cacheReadInputTokens: cacheRead,
-        cacheCreationInputTokens: cacheWrite,
-        stopReason,
-        durationMs,
-        apiErrorMessage: agentError?.errorMessage ??
-            (success ? undefined : (toolErrorText ?? (truncated ? truncationMessage : undefined))),
-    });
-    void shim.flush();
-    const accountError = detectAccountError({
-        success,
-        fatalErrorMessage: result.fatalError?.message,
-        agentErrorMessage: agentError?.errorMessage,
-        finalText: result.finalText,
-        toolErrorText,
-    });
-    const errorText = result.fatalError?.message ||
-        agentError?.errorMessage ||
-        toolErrorText ||
-        (truncated ? truncationMessage : result.finalText) ||
-        stopReason;
-    if (!success || accountError) {
-        if (accountError)
-            console.error(`  [executor] Account error: ${errorText}`);
-        else
-            console.error(`  [executor] Run failed (${stopReason}): ${errorText}`);
-    }
-    return {
-        success: success && !accountError,
-        output: result.finalText,
-        turns,
-        error: success && !accountError ? undefined : errorText,
-        durationMs,
-        sessionId: result.sessionId,
-        costUsd: costUsd > 0 ? costUsd : undefined,
-        inputTokens: inputTokens || undefined,
-        outputTokens: outputTokens || undefined,
-        cacheReadInputTokens: cacheRead || undefined,
-        cacheCreationInputTokens: cacheWrite || undefined,
-        stopReason,
-        extensions,
-        skills,
-    };
-}
-function mapStopReason(result) {
-    if (result.fatalError)
-        return "error_fatal";
-    if (result.toolErrors && result.finalText.length === 0)
-        return "error_tool";
-    if (!result.ok)
-        return `error_exit_${result.exitCode}`;
-    if (result.agentEnded || result.finalText.length > 0)
-        return "success";
-    return "unknown";
-}
-/**
- * Scan agent_end's messages for a failed assistant turn. pi-agent-core's
- * `handleRunFailure` catches provider errors, synthesizes an assistant
- * message with stopReason "error"/"aborted" + errorMessage, and emits a
- * normal agent_end — so the only signal that the run actually failed
- * lives on the last assistant message.
- */
-function extractAgentError(result) {
-    if (!Array.isArray(result.messages))
-        return undefined;
-    for (let i = result.messages.length - 1; i >= 0; i--) {
-        const m = result.messages[i];
-        if (m?.role !== "assistant")
-            continue;
-        if (m.stopReason === "error" || m.stopReason === "aborted") {
-            return {
-                stopReason: m.stopReason === "aborted" ? "error_aborted" : "error_agent",
-                errorMessage: m.errorMessage || m.stopReason,
-            };
+        // gondolin / none — run on the host worktree via spawnSync (the same
+        // degraded model those backends already use; matches the pre-existing
+        // host-side until_bash behaviour).
+        const workDir = setupTaskWorktree({ taskId, stateDir, sandboxDir: config.sandboxDir, prePopulate });
+        const agentCwd = access?.prePopulateBranch ? join(workDir, access.repo) : workDir;
+        let command;
+        let toolName = "bash";
+        let toolInput;
+        if (spec.kind === "bash") {
+            command = spec.command;
+            toolInput = { command: spec.command };
         }
-        return undefined;
-    }
-    return undefined;
-}
-function coerceThinking(raw) {
-    if (!raw)
-        return undefined;
-    const v = raw.trim().toLowerCase();
-    if (!THINKING_LEVELS.has(v)) {
-        console.warn(`[executor] Ignoring unknown thinking level "${raw}" — must be one of: ${[...THINKING_LEVELS].join(", ")}`);
-        return undefined;
-    }
-    return v;
-}
-function resolveSessionsDir(config) {
-    if (config.sessionsDir)
-        return resolve(config.sessionsDir);
-    const stateDir = config.stateDir || resolve("data");
-    return process.env.LASTLIGHT_SESSIONS_DIR
-        ? resolve(process.env.LASTLIGHT_SESSIONS_DIR)
-        : resolve(stateDir, "agent-sessions");
+        else {
+            const { fileName, run } = scriptInvocation(spec);
+            mkdirSync(join(workDir, scriptDir), { recursive: true });
+            const filePath = join(workDir, scriptDir, fileName);
+            writeFileSync(filePath, spec.script);
+            command = run(filePath);
+            toolInput = { command, runtime: spec.runtime };
+        }
+        const proc = spawnSync("sh", ["-c", command], {
+            cwd: agentCwd,
+            env: { ...process.env, ...ghEnv, ...(opts?.sandboxEnv ?? {}) },
+            encoding: "utf-8",
+            timeout: timeoutSeconds * 1000,
+            maxBuffer: 256 * 1024 * 1024,
+        });
+        const durationMs = Date.now() - startTime;
+        const exitCode = proc.status ?? (proc.signal ? 124 : 1);
+        const res = { exitCode, stdout: proc.stdout ?? "", stderr: proc.stderr ?? "", timedOut: proc.signal === "SIGTERM" };
+        const sessionId = opts?.writeSession === false ? null : await writeCommandSession({
+            sessionsDir, projectSlug: projectSlugForCwd(agentCwd), model,
+            displayPrompt, toolName, toolInput,
+            stdout: res.stdout, stderr: res.stderr, exitCode: res.exitCode, durationMs,
+        });
+        if (sessionId && opts?.onSessionId)
+            opts.onSessionId(sessionId);
+        return buildCommandResult(res, durationMs, sessionId);
+    });
 }
-function emptyResult(stopReason, durationMs) {
+/** Map a raw command result onto the ExecutionResult contract (turns 0, no cost). */
+function buildCommandResult(res, durationMs, sessionId) {
+    const success = res.exitCode === 0;
+    const combined = res.stderr ? `${res.stdout}${res.stdout && !res.stdout.endsWith("\n") ? "\n" : ""}${res.stderr}` : res.stdout;
+    // Strip the trailing newline so the value substitutes cleanly into a
+    // downstream command / `{{phaseOutputs.<name>}}` and can be forwarded as an
+    // `LL_OUT_<PHASE>` env var (mirrors archon's "trailing newline removed"). The
+    // full raw stdout/stderr is preserved verbatim in the session jsonl.
+    const output = combined.replace(/\n+$/, "");
     return {
-        finalText: "",
+        success,
+        output,
         turns: 0,
-        costUsd: 0,
-        inputTokens: 0,
-        outputTokens: 0,
-        cacheReadInputTokens: 0,
-        cacheCreationInputTokens: 0,
-        stopReason,
         durationMs,
-    };
-}
-/** Splice values into process.env for the duration of a sync block. */
-function applyEnv(env) {
-    const saved = {};
-    for (const [k, v] of Object.entries(env)) {
-        saved[k] = process.env[k];
-        process.env[k] = v;
-    }
-    return () => {
-        for (const [k, v] of Object.entries(saved)) {
-            if (v === undefined)
-                delete process.env[k];
-            else
-                process.env[k] = v;
-        }
+        sessionId: sessionId ?? undefined,
+        error: success ? undefined : res.timedOut ? `command timed out after ${Math.round(durationMs / 1000)}s` : `command exited ${res.exitCode}`,
+        stopReason: success ? "success" : res.timedOut ? "error_timeout" : "error_bash",
     };
 }
 //# sourceMappingURL=agent-executor.js.map