open-tui-orchestrator 0.9.6

package/scripts/core/contracts.mjs

@@ -0,0 +1,161 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import {spawnSync} from 'node:child_process';
+
+export const CORE_VERSION = '1.14.6';
+export const SUCCESS = new Set(['verified']);
+export const TERMINAL = new Set(['verified','failed','blocked','cancelled','awaiting-verification','preflight-failed','popup-failed','timeout','needs-reconciliation']);
+
+// 内存 → 最大并发 TUI 窗数：先由内存 GiB 换算出厂商标称内存 GB（round(GiB × 1024 ÷ 1000)），再取其 3/4（round(标称GB × 3 ÷ 4)）。
+// 例如 16G 标称 → 12 台并发，4G 标称 → 3 台；不再有固定 8 硬上限。下限由调用方以 <4G 判定为不支持。为可测试而独立成函数。
+// fresh 规划与 --resume-run 的恢复校验共用同一容量（contracts 放置以避免 recovery↔sdk 循环依赖）。
+export function computeMaxWindows(memGb) {
+  const nominalGb = Math.round((memGb * 1024) / 1000);
+  return Math.round((nominalGb * 3) / 4);
+}
+
+export function summaryComplete(sum, strict = true) {
+  if (!sum?.runId || !Array.isArray(sum.blocks) || !Array.isArray(sum.tasks) || !sum.blocks.length || !sum.tasks.length) return false;
+  const exact = (ids, obj) => ids.length === new Set(ids).size && Object.keys(obj || {}).length === ids.length && ids.every(id => Object.hasOwn(obj || {}, id));
+  if (!exact(sum.blocks.map(b=>b.key),sum.results) || !exact(sum.tasks.map(t=>t.id),sum.taskResults)) return false;
+  const statuses = strict ? SUCCESS : TERMINAL;
+  return [...Object.values(sum.results),...Object.values(sum.taskResults)].every(r=>statuses.has(r?.status));
+}
+
+export function canonicalKey(key, cwd = process.cwd()) {
+  const match = /^(file|dir):(.+)$/i.exec(String(key));
+  if (!match) return String(key);
+  const windows = /^[a-z]:[\\/]|^\\\\/i.test(match[2]) || process.platform === 'win32';
+  const api = windows ? path.win32 : path.posix;
+  let p = api.resolve(cwd, match[2]);
+  try { p = fs.realpathSync.native(p); } catch {
+    // Resolve existing ancestors too, so a not-yet-created file beneath a junction
+    // conflicts with the same target reached through its real directory.
+    let parent=p; const tail=[];
+    while (api.dirname(parent)!==parent && !fs.existsSync(parent)) {tail.unshift(api.basename(parent));parent=api.dirname(parent);}
+    try {p=api.join(fs.realpathSync.native(parent),...tail);} catch {}
+  }
+  p=p.replaceAll('\\','/').replace(/\/+$/,'');
+  return match[1].toLowerCase()+':'+(windows?p.toLowerCase():p);
+}
+export function keysOverlap(a,b) {
+  return (a||[]).some(x=>(b||[]).some(y=>{
+    x=canonicalKey(x); y=canonicalKey(y);
+    if(x===y)return true;
+    const xm=/^(file|dir):(.*)$/.exec(x),ym=/^(file|dir):(.*)$/.exec(y);
+    if(!xm||!ym)return false;
+    return xm[2]===ym[2] || (xm[1]==='dir'&&ym[2].startsWith(xm[2]+'/')) || (ym[1]==='dir'&&xm[2].startsWith(ym[2]+'/'));
+  }));
+}
+
+export function levelWaves(recs) {
+  const aliases=new Map();
+  for(const r of recs) for(const alias of [r.key,r.title,r.b?.title].filter(Boolean)) {
+    if(aliases.has(alias)&&aliases.get(alias)!==r.key)throw new Error('Ambiguous block identity: '+alias);
+    aliases.set(alias,r.key);
+  }
+  for(const r of recs) r.dependsOn=[...new Set((r.dependsOn||[]).map(d=>{
+    if(!aliases.has(d))throw new Error('Unknown dependency: '+d);
+    const key=aliases.get(d); if(key===r.key)throw new Error('Self dependency: '+key);return key;
+  }))];
+  const pending=[...recs],done=new Set(),waves=[];
+  while(pending.length) {
+    const ready=pending.filter(r=>r.dependsOn.every(d=>done.has(d)));
+    if(!ready.length)throw new Error('Cyclic dependencies: '+pending.map(r=>r.key).join(', '));
+    waves.push(ready);for(const r of ready){done.add(r.key);pending.splice(pending.indexOf(r),1);}
+  }
+  return waves;
+}
+
+export function requestTasks(request) {
+  const text=String(request),parts=[];let start=0,quote='',depth=0;
+  for(let i=0;i<text.length;i++) {
+    const c=text[i];
+    if(quote){if(c===quote&&text[i-1]!=='\\'&&text[i-1]!=='`')quote='';continue;}
+    if(c==="'"&&/[\p{L}\p{N}]/u.test(text[i-1]||'')&&/[\p{L}\p{N}]/u.test(text[i+1]||''))continue;
+    if(['"',"'",'`'].includes(c)){quote=c;continue;}
+    if('([{'.includes(c)){depth++;continue;}if(')]}'.includes(c)){depth=Math.max(0,depth-1);continue;}
+    const explicitNext=/^\s*(?:(?:项目|工程|project|proj)\s*[-/]?\s*\d+|(?:修复|优化|修改|更新|检查|创建)\s*\d{2,3}(?!\d))/i.test(text.slice(i+1));
+    if(!depth&&(/[；;\n]/.test(c)||(/[，,。]/.test(c)&&explicitNext))){parts.push(text.slice(start,i));start=i+1;}
+  }
+  parts.push(text.slice(start));
+  return parts.map(s=>s.trim()).filter(Boolean).map((prompt,i)=>({id:`T${String(i+1).padStart(3,'0')}`,prompt}));
+}
+export function bindClassifiedTasks(request,classified) {
+  const tasks=requestTasks(request),byId=new Map(tasks.map(t=>[t.id,t]));
+  if(!Array.isArray(classified)||classified.length!==tasks.length||new Set(classified.map(t=>t.id)).size!==tasks.length||classified.some(t=>!byId.has(t.id)))throw new Error('Classified task inventory mismatch');
+  return classified.map(t=>({...t,summary:byId.get(t.id).prompt,prompt:byId.get(t.id).prompt}));
+}
+export function ledgerPlan(request, candidate, capacity, compact) {
+  const tasks=requestTasks(request);
+  if(!tasks.length)throw new Error('Empty task inventory');
+  let plan=structuredClone(candidate),assigned=new Set(),valid=true;
+  for(const block of plan) for(const task of block.tasks||[]) {
+    task.sourceIds=tasks.filter(t=>String(task.prompt||'').includes(t.prompt)).map(t=>t.id);
+    if(!task.sourceIds.length)valid=false;
+    for(const id of task.sourceIds){if(assigned.has(id))valid=false;assigned.add(id);}
+  }
+  // A model's omission or paraphrase must never discard the original instructions.
+  // Retain the entire inventory in one serial block when coverage is uncertain.
+  if(!valid||assigned.size!==tasks.length) plan=[{type:'linked',title:'complete-inventory',dependsOn:[],conflictKeys:[],tasks:tasks.map(t=>({...t,title:t.id,sourceIds:[t.id]}))}];
+  plan=compact(plan,capacity);
+  const ids=plan.flatMap(b=>b.tasks.flatMap(t=>t.sourceIds||[]));
+  if(ids.length!==tasks.length||new Set(ids).size!==tasks.length)throw new Error('Task inventory mismatch');
+  levelWaves(plan.map((b,i)=>({key:`B${i+1}`,title:b.title,b,dependsOn:b.dependsOn||[]})));
+  return {plan,tasks};
+}
+
+export function sha256(file) {return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');}
+
+// 裸名可执行文件在 Windows 上会先按进程 cwd（编排器的 cwd = 任意工作区）解析，
+// 在不受信目录里运行时构成二进制投毒入口。一律锚定到 SystemRoot；锚定目标不存在才回退裸名。
+export function systemToolExe(name, env = process.env) {
+  const anchored = path.join(env.SystemRoot || env.WINDIR || 'C:\\Windows', 'System32', String(name));
+  return fs.existsSync(anchored) ? anchored : String(name);
+}
+export function powershellExe(env = process.env) {
+  const anchored = path.join(env.SystemRoot || env.WINDIR || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+  return fs.existsSync(anchored) ? anchored : 'powershell.exe';
+}
+export function verifyTask(receipt, task, checks, context) {
+  if(!receipt || receipt.runId!==context.runId || receipt.token!==context.token || receipt.id!==task.id || receipt.status!=='completed')return {status:'failed',reason:'Missing or mismatched task receipt'};
+  return verifyChecks(checks,context.workspace);
+}
+// 校验 acceptance 契约 key 与 task id 的一致性：unknown key（拼错/多余）= 直接报错；task 无 check = 告警（将停在 awaiting-verification）。
+export function acceptanceKeyDiff(checks,tasks) {
+  if(!checks||typeof checks!=='object'||Array.isArray(checks)||!Object.keys(checks).length)return null;
+  const ids=[...(new Set((tasks||[]).map(t=>t?.id).filter(Boolean)))],keys=Object.keys(checks);
+  const unknown=keys.filter(k=>!ids.includes(k)),missing=ids.filter(k=>!keys.includes(k));
+  return (unknown.length||missing.length)?{unknown,missing}:null;
+}
+
+export function verifyChecks(checks,workspace) {
+  if(!Array.isArray(checks)||!checks.length)return {status:'awaiting-verification',reason:'No parent-defined acceptance checks; window report is not proof of success'};
+  const evidence=[];
+  try {
+    for(const check of checks) {
+      if(check.type==='command') {
+        if(!check.command||!Array.isArray(check.args))throw new Error('Command acceptance requires command and args');
+        const result=spawnSync(check.command,check.args,{cwd:workspace,encoding:'utf8',windowsHide:true,shell:false,timeout:check.timeoutMs||30000});
+        if(result.error||result.status!==(check.exitCode??0))throw new Error('Acceptance command failed: '+(result.error?.message||result.status));
+        if(check.stdout!==undefined&&result.stdout.trim()!==check.stdout)throw new Error('Acceptance stdout mismatch');
+        evidence.push({type:'command',command:check.command,args:check.args,exitCode:result.status});continue;
+      }
+      const file=path.resolve(workspace,check.path);
+      if(check.type==='file') {
+        if(!fs.existsSync(file))throw new Error('Acceptance file missing: '+file+(String(check.path)!==file?' (check.path="'+check.path+'")':''));
+        if(!fs.statSync(file).isFile())throw new Error('Not a file: '+file);if(check.sha256&&sha256(file)!==check.sha256)throw new Error('Hash mismatch: '+file);}
+      else if(check.type==='json') {
+        if(!fs.existsSync(file))throw new Error('Acceptance file missing: '+file+(String(check.path)!==file?' (check.path="'+check.path+'")':''));
+        let value;try{value=JSON.parse(fs.readFileSync(file,'utf8'));}catch(e){throw new Error('Acceptance JSON parse failed: '+file+': '+e.message);}
+        for(const [key,expected] of Object.entries(check.equals||{})){
+          if(!(key in value))throw new Error('JSON field missing: '+file+' key="'+key+'" expected='+JSON.stringify(expected));
+          if(JSON.stringify(value[key])!==JSON.stringify(expected))throw new Error('JSON mismatch: '+file+' key="'+key+'" expected='+JSON.stringify(expected)+' actual='+JSON.stringify(value[key]));}}
+      else if(check.type==='absent') {if(fs.existsSync(file))throw new Error('Unexpected path: '+file);}
+      else throw new Error('Unsupported acceptance check: '+check.type);
+      evidence.push({type:check.type,path:file,sha256:check.type==='absent'?undefined:sha256(file)});
+    }
+    return {status:'verified',evidence};
+  } catch(e){return {status:'failed',reason:e.message};}
+}

package/scripts/core/host-cli.mjs

@@ -0,0 +1,204 @@
+import fs from 'node:fs';
+import { networkArgs } from './network-policy.mjs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import {resolvePiHost,piArgs} from './pi-host.mjs';
+import {resolveOpenClawHost} from './openclaw-host.mjs';
+import {resolveOpenCodeHost,opencodeArgs} from './opencode-host.mjs';
+import {resolveKimiHost,kimiArgs} from './kimi-host.mjs';
+import {resolveClaudeHost,claudeArgs} from './claude-host.mjs';
+import {resolveProfileHost,profileArgs,listProfiles,loadProfile} from './print-profile.mjs';
+import {loadUnitProfile,expandUnitArgs} from './unit-command.mjs';
+
+// Adapter contract: resolve a real CLI before any planner/window is started.
+// Additional adapters must implement planning, interactive argv and completion
+// capture together; a CLI name alone is not proof of compatibility.
+export const adapters = Object.freeze({
+  openclaw: Object.freeze({id:'openclaw',label:'OpenClaw CLI',native:false}),
+  pi: Object.freeze({id:'pi',label:'pi agent',native:false,completionMarker:'__ORCH_DONE__',verified:false}),
+  opencode: Object.freeze({id:'opencode',label:'opencode',native:false,completionMarker:'__ORCH_DONE__',verified:false}),
+  kimi: Object.freeze({id:'kimi',label:'Kimi Code CLI',native:true,completionMarker:'__ORCH_DONE__',verified:false}),
+  claude: Object.freeze({id:'claude',label:'Claude Code CLI',native:true,completionMarker:'__ORCH_DONE__',verified:false}),
+  // carrier: TUI 类宿主需要真实终端——无头模式走 ConPTY 伪终端载体（真实控制台、完全不可见）；
+  // 其余宿主为 print 类，无控制台的隐藏进程即可。载体解析与分级见 scripts/core/unit-carrier.mjs。
+  codex: Object.freeze({ id: 'codex', label: 'Codex CLI', native: true, carrier: 'pty',
+    modelEnv: 'ORCH_MODEL', effortEnv: 'ORCH_EFFORT',
+    completionMarker: '__ORCH_DONE__', verified: false }),
+});
+
+// Host markers on the Windows ancestor chain: the initiating agent is the
+// NEAREST ancestor process matching a known CLI (a nested window that starts
+// its own orchestration therefore binds to its own agent, not the outer one).
+const HOST_CHAIN_MATCHERS = Object.freeze([
+  ['kimi', Object.freeze({ name: /^kimi\.exe$/i })],
+  ['claude', Object.freeze({ name: /^claude\.exe$/i, cmd: /[\\/]@anthropic-ai[\\/]claude-code[\\/]/i })],
+  ['codex', Object.freeze({ name: /^codex\.exe$/i, cmd: /[\\/]codex\.js([\s"']|$)|[\\/]@openai[\\/]codex[\\/]/i })],
+  ['pi', Object.freeze({ cmd: /[\\/]pi-coding-agent[\\/]/i })],
+  ['opencode', Object.freeze({ name: /^opencode\.exe$/i, cmd: /[\\/]opencode-ai[\\/]/i })],
+  ['openclaw', Object.freeze({ name: /^openclaw(\.exe)?$/i, cmd: /[\\/]openclaw[\\/]openclaw\.mjs/i })],
+]);
+
+export function detectHostFromChain(chain) {
+  for (const proc of chain || []) {
+    const name = String(proc?.name || '');
+    const cmd = String(proc?.cmdline ?? proc?.commandLine ?? '');
+    for (const [id, m] of HOST_CHAIN_MATCHERS) {
+      if ((m.name && m.name.test(name)) || (m.cmd && m.cmd.test(cmd))) return id;
+    }
+  }
+  return null;
+}
+
+// One CIM snapshot walked in memory (a single PowerShell call, ~1s). Only runs
+// when no env marker identified the host; failure degrades to an empty chain.
+export function hostProcessChain({ platform = process.platform, startPid = process.ppid, env = process.env, spawn = spawnSync } = {}) {
+  if (platform !== 'win32') return [];
+  const script = '$a=@{};Get-CimInstance Win32_Process|ForEach-Object{$a[[string]$_.ProcessId]=$_};$p=$a[[string]' + (Number(startPid) || 0) + '];$g=0;while($p -and $g -lt 16){$c=if($p.CommandLine){$p.CommandLine}else{""};("{0}`t{1}`t{2}" -f $p.ProcessId,$p.Name,$c);$p=$a[[string]$p.ParentProcessId];$g++}';
+  let r;
+  try {
+    const ps = path.join(env.SystemRoot || env.WINDIR || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    r = spawn(fs.existsSync(ps) ? ps : 'powershell.exe', ['-NoProfile', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { encoding: 'utf8', windowsHide: true, shell: false, timeout: 8000 });
+  } catch { return []; }
+  if (r?.status !== 0) return [];
+  return String(r.stdout || '').split(/\r?\n/).filter(Boolean).map((line) => {
+    const [pid, name, ...rest] = line.split('\t');
+    return { pid: Number(pid), name, cmdline: rest.join('\t') };
+  });
+}
+
+export function detectHostAgent(env = process.env, { chain } = {}) {
+  const explicit = String(env.ORCH_AGENT || '').trim().toLowerCase();
+  if (explicit) return explicit;
+  if (env.CODEX_THREAD_ID || env.CODEX_SESSION_ID) return 'codex';
+  if (env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT) return 'claude';
+  // profile-class agents: env markers first, then ancestor process name/cmd patterns.
+  for (const pid of listProfiles(env)) {
+    const p = loadProfile(pid, env);
+    if (p && (p.envMarkers || []).some((m) => env[m])) return pid;
+  }
+  const procs = chain ?? hostProcessChain({ env });
+  const detected = detectHostFromChain(procs);
+  if (detected) return detected;
+  for (const pid of listProfiles(env)) {
+    const p = loadProfile(pid, env);
+    if (!p) continue;
+    let patterns = [];
+    try { patterns = (p.processNames || []).map((s) => new RegExp(s, 'i')); } catch { patterns = []; }
+    for (const proc of procs) {
+      const name = String(proc?.name || ''), cmd = String(proc?.cmdline || '');
+      if (patterns.some((re) => re.test(name) || re.test(cmd))) return pid;
+    }
+  }
+  throw new Error('HOST_UNKNOWN: set ORCH_AGENT to the initiating agent; no Codex fallback. Any agent can also bypass host identity entirely by supplying its own unit command (--unit-cmd/--unit-cmd-file, see docs/caller-driven.md).');
+}
+
+export function cliCandidates(env = process.env, platform = process.platform, {where = spawnSync} = {}) {
+  const explicit = env.ORCH_CLI || env.CODEX_EXE;
+  if (explicit) return [path.resolve(explicit)];
+  const found = [];
+  for (const dir of String(env.PATH || env.Path || '').split(path.delimiter).filter(Boolean)) {
+    found.push(path.join(dir, platform === 'win32' ? 'codex.exe' : 'codex'));
+    // npm shims are not native executables; the SDK must receive the packaged binary.
+    const modules = path.join(dir, 'node_modules', '@openai');
+    for (const base of [path.join(modules, 'codex', 'vendor'),
+      path.join(modules, 'codex', 'node_modules', '@openai', 'codex-win32-x64', 'vendor'),
+      path.join(modules, 'codex-win32-x64', 'vendor'),
+      path.join(modules, 'codex', 'node_modules', '@openai', 'codex-win32-arm64', 'vendor')]) {
+      for (const triple of ['x86_64-pc-windows-msvc', 'aarch64-pc-windows-msvc']) {
+        // npm 包把原生 exe 放在 vendor/<triple>/bin/；历史版本曾放在 vendor/<triple>/codex/。
+        for (const sub of ['bin', 'codex']) found.push(path.join(base, triple, sub, 'codex.exe'));
+      }
+    }
+  }
+  // Some desktop hosts expose neither PATH nor Path to a child process even
+  // though the native Codex installation is registered. Ask the Windows
+  // resolver for codex.exe in that case; this never installs or selects a shim.
+  if (platform === 'win32' && !found.some(file => { try { return fs.existsSync(file); } catch { return false; } })) {
+    try {
+      const whereExe = path.join(env.SystemRoot || env.WINDIR || 'C:\\Windows', 'System32', 'where.exe');
+      const result = where(whereExe, ['codex.exe'], {encoding:'utf8', windowsHide:true, shell:false, timeout:8000});
+      if (result?.status === 0) for (const line of String(result.stdout || '').split(/\r?\n/)) {
+        const candidate = line.trim();
+        if (candidate) found.push(candidate);
+      }
+    } catch { /* resolveHost reports CLI_MISSING if the native resolver is unavailable */ }
+  }
+  return [...new Set(found)];
+}
+
+export function resolveHost({ env = process.env, agent, candidates = cliCandidates,
+  probe = (file) => {
+    if (!fs.existsSync(file) || !fs.statSync(file).isFile()) return false;
+    const result = spawnSync(file, ['--version'], {
+      encoding: 'utf8', windowsHide: true, timeout: 8000, shell: false,
+    });
+    return result.status === 0 && /^codex-cli\s/m.test(result.stdout || '');
+  } } = {}) {
+  // 调用方自助通道（caller-driven）：显式给出的单元画像最高优先——不依赖宿主识别（不查进程链/env 标记）、
+  // 不 probe、无名单限制。任何 agent（含没有适配器的）都能这样调用编排器。
+  const unit = loadUnitProfile(env);
+  if (unit) return { agent: String(env.ORCH_AGENT || unit.id || 'custom').trim().toLowerCase(), config: {
+    id: unit.id, label: unit.label, bin: unit.bin, prefixArgs: [], available: true, native: true,
+    completionMarker: '__ORCH_DONE__', modelEnv: 'ORCH_MODEL', effortEnv: 'ORCH_EFFORT', carrier: unit.carrier || null, unit, reusable: true,
+  } };
+  const id = agent || detectHostAgent(env);
+  if(id==='pi')return resolvePiHost(env);
+  if(id==='openclaw')return resolveOpenClawHost(env);
+  if(id==='opencode')return resolveOpenCodeHost(env);
+  if(id==='kimi')return resolveKimiHost(env);
+  if(id==='claude')return resolveClaudeHost(env);
+  // print-class 通用适配：有画像文件（scripts/core/agent-profiles/<id>.json）的 agent
+  // 走数据驱动的通用解析；画像存在即权威（CLI 缺失时 fail-closed，不回退）。
+  const profileHost = resolveProfileHost(env,id);
+  if (profileHost) return profileHost;
+  const adapter = adapters[id];
+  if (!adapter) throw new Error(`ADAPTER_UNSUPPORTED: ${id}; no CLI adapter implemented; no fallback or automatic install. Two supported paths: (1) supply your own unit command with --unit-cmd/--unit-cmd-file (any CLI, see docs/caller-driven.md); (2) node scripts/adapt.mjs --agent ${id} for print-class auto-adaptation.`);
+  const bin = candidates(env).find(probe);
+  if (!bin) throw new Error(`CLI_MISSING: ${id}; install its CLI yourself or set ORCH_CLI to its native executable. No fallback or automatic install.`);
+  return { agent: id, config: { ...adapter, bin, available: true } };
+}
+
+export function launchArgs(config, options = {}) {
+  // 调用方自助通道：argv 完全来自单元命令模板（占位符展开），不套用任何宿主专用参数。
+  if(config?.unit)return expandUnitArgs(config.unit,{prompt:'',promptFile:'',workspace:options.cwd||process.cwd()});
+  if(config?.id==='openclaw'){
+    if(options.sandbox&&options.sandbox!=='danger-full-access')throw new Error('OPENCLAW_SANDBOX_UNSUPPORTED');
+    return [];
+  }
+  if(config?.id==='pi'){
+    if(options.sandbox&&options.sandbox!=='danger-full-access')throw new Error('PI_SANDBOX_UNSUPPORTED: pi does not implement the requested sandbox');
+    return piArgs(config,{model:process.env.ORCH_MODEL,effort:process.env.ORCH_EFFORT});
+  }
+  if(config?.id==='opencode'){
+    if(options.sandbox&&options.sandbox!=='danger-full-access')throw new Error('OPENCODE_SANDBOX_UNSUPPORTED: opencode does not implement the requested sandbox');
+    return opencodeArgs(config,{model:process.env.ORCH_MODEL,effort:process.env.ORCH_EFFORT,cwd:options.cwd||process.cwd()});
+  }
+  if(config?.id==='kimi'){
+    if(options.sandbox&&options.sandbox!=='danger-full-access')throw new Error('KIMI_SANDBOX_UNSUPPORTED: kimi does not implement the requested sandbox');
+    return kimiArgs(config,{model:process.env.ORCH_MODEL});
+  }
+  if(config?.id==='claude'){
+    if(options.sandbox&&options.sandbox!=='danger-full-access')throw new Error('CLAUDE_SANDBOX_UNSUPPORTED: claude does not implement the requested sandbox');
+    return claudeArgs(config,{model:process.env.ORCH_MODEL,effort:process.env.ORCH_EFFORT});
+  }
+  if(config?.profile){
+    if(options.sandbox&&options.sandbox!=='danger-full-access')throw new Error('PROFILE_SANDBOX_UNSUPPORTED: '+config.id+' does not implement the requested sandbox');
+    return profileArgs(config,{model:process.env.ORCH_MODEL,effort:process.env.ORCH_EFFORT});
+  }
+  if (!adapters[config?.id]) throw new Error('ADAPTER_UNSUPPORTED: refusing Codex argv for another agent.');
+  const cwd = options.cwd || process.cwd();
+  const sandbox = options.sandbox || 'danger-full-access';
+  // Codex treats --dangerously-bypass-approvals-and-sandbox as a complete
+  // authorization envelope and rejects it when -a/--ask-for-approval is also
+  // supplied. Keep the explicit no-approval flag only for restricted modes.
+  const args = ['--cd', cwd];
+  if (sandbox === 'danger-full-access') args.push('--sandbox', sandbox);
+  else args.push('-a', 'never', '--sandbox', sandbox);
+  // The orchestrator has already received the initiating window's effective
+  // authorization and normalizes it to never + danger-full-access. Carry that
+  // envelope into Codex so project trust and command confirmations cannot stop
+  // an authorized TUI window at startup. Restricted callers keep their policy.
+  if (sandbox === 'danger-full-access') args.push('--dangerously-bypass-approvals-and-sandbox');
+  args.push('-c', `projects.${JSON.stringify(cwd)}.trust_level="trusted"`, ...networkArgs());
+  return args;
+}