ruvnet-brain 4.5.4 → 4.5.6

package/scripts/model-native-qualification.mjs

@@ -0,0 +1,251 @@
+// Native subscription qualification: fixed plaintext tasks, never candidate code execution.
+// Protocol sequence derives from the source-bound native gateway acceptance probe.
+// Configuration identity is observable; provider/backend identity is never proved here.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn, execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { StringDecoder } from 'node:string_decoder';
+import { assertSubscriptionAuth, subscriptionEnvironment } from './model-router-dispatch.mjs';
+import { discoverNativeCodex } from './model-routing-launchers.mjs';
+
+const SELF = fileURLToPath(import.meta.url);
+const digest = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+const ID = /^[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*$/;
+const redact = (key, value) => /^(?:email|account_id|access_token|refresh_token|id_token|api_key|authorization|credentials)$/i.test(key) ? '[redacted]' : value;
+
+function binaryFor(host) {
+  const extensions = path.join(os.homedir(), '.vscode-server/extensions');
+  if (host === 'codex') return discoverNativeCodex(extensions);
+  const entries = JSON.parse(fs.readFileSync(path.join(extensions, 'extensions.json')));
+  const entry = entries.find((e) => e.identifier?.id === 'anthropic.claude-code');
+  if (!entry) throw new Error('Native Claude extension unavailable');
+  return path.join(entry.location.path, 'resources/native-binary', process.platform === 'win32' ? 'claude.exe' : 'claude');
+}
+
+export function verifyClaudeAllowance(usage, model) {
+  // Native 2.1.289 get_usage is explicitly experimental. Unknown shapes fail closed.
+  if (usage?.rate_limits_available !== true || usage.rate_limits?.extra_usage?.is_enabled !== false) throw new Error('Native Claude allowance unknown or extra usage enabled');
+  const limits = usage.rate_limits;
+  for (const key of ['five_hour', 'seven_day']) {
+    const window = limits[key];
+    if (!window || !Number.isFinite(window.utilization) || window.utilization < 0 || window.utilization >= 100 || window.locked_reason !== null) throw new Error('Native Claude ordinary allowance unavailable');
+  }
+  for (const scoped of limits.model_scoped || []) {
+    if (!Number.isFinite(scoped.utilization) || scoped.utilization < 0 || scoped.utilization >= 100 || scoped.locked_reason != null) throw new Error('Native Claude scoped allowance unavailable or unmapped');
+  }
+  for (const limit of limits.limits || []) {
+    if (!Number.isFinite(limit.percent) || limit.percent < 0 || limit.percent >= 100 || !['normal', 'warning'].includes(limit.severity)) throw new Error('Native Claude allowance unavailable or unknown');
+  }
+  return { verified: true, basis: 'native-get_usage-2.1.289', checkedAt: new Date().toISOString(), reservation: false, raceSafe: false, model };
+}
+
+class Transport {
+  constructor(child, host, fail, transcript, signal) {
+    this.child = child; this.host = host; this.fail = fail; this.transcript = transcript;
+    this.pending = new Map(); this.events = []; this.waiters = []; this.serial = 0; this.buffer = ''; this.bytes = 0; this.decoder = new StringDecoder('utf8');
+    child.stderr.on('data', () => {}); child.stdin.on('error', () => fail(new Error('Native input transport failed')));
+    child.once('error', () => fail(new Error('Native executable unavailable')));
+    child.once('exit', () => { if (!signal.aborted) fail(new Error('Native host exited before qualification')); });
+    child.stdout.on('data', (chunk) => {
+      this.bytes += chunk.length; if (this.bytes > 512 * 1024) return fail(new Error('Native transcript exceeded bound'));
+      this.buffer += this.decoder.write(chunk);
+      let at;
+      while ((at = this.buffer.indexOf('\n')) >= 0) {
+        const line = this.buffer.slice(0, at); this.buffer = this.buffer.slice(at + 1);
+        let message; try { message = JSON.parse(line); } catch { return fail(new Error('Malformed native protocol output')); }
+        transcript.push({ direction: 'native', packet: message });
+        const id = host === 'codex' ? message.id : message.type === 'control_response' ? message.response?.request_id : null;
+        const pending = this.pending.get(id);
+        if (pending) {
+          this.pending.delete(id);
+          if (message.error || (host === 'claude-code' && message.response.subtype !== 'success')) pending.reject(new Error('Native request refused'));
+          else pending.resolve(host === 'codex' ? message.result : message.response.response);
+        } else {
+          // No native tool/approval request is ever serviced by this adapter.
+          const tool = host === 'codex' ? Object.hasOwn(message, 'id') && Boolean(message.method)
+            : message.type === 'control_request' || message.message?.content?.some((p) => p.type === 'tool_use');
+          const item = message.params?.item;
+          if (tool || (item?.type && !['agentMessage', 'reasoning', 'userMessage'].includes(item.type))) return fail(new Error('Native tool inference refused'));
+          this.events.push(message);
+          for (const waiter of [...this.waiters]) if (waiter.predicate(message)) { this.waiters.splice(this.waiters.indexOf(waiter), 1); waiter.resolve(message); }
+        }
+      }
+    });
+  }
+  send(packet) { this.transcript.push({ direction: 'client', packet }); this.child.stdin.write(`${JSON.stringify(packet)}\n`); }
+  request(method, params = {}) {
+    const id = `qualification-${++this.serial}`;
+    const promise = new Promise((resolve, reject) => this.pending.set(id, { resolve, reject }));
+    this.send(this.host === 'codex' ? { id, method, params } : { type: 'control_request', request_id: id, request: { subtype: method, ...params } });
+    return promise;
+  }
+  wait(predicate, start = 0) {
+    const existing = this.events.slice(start).find(predicate); if (existing) return Promise.resolve(existing);
+    return new Promise((resolve) => this.waiters.push({ predicate, resolve }));
+  }
+}
+
+async function run(options, inspectOnly) {
+  const { host, model, effort, prompt, cwd, env = process.env, deadline = Date.now() + 60000,
+    spawnHost = spawn, versionProbe = execFileSync, authCheck = assertSubscriptionAuth, now = Date.now } = options;
+  const started = now(); const transcript = []; let child, transport;
+  const result = { completed: false, output: '', nativeModel: null, nativeEffort: null, identityBasis: null,
+    backendIdentityProved: false, nativeSubscription: false, available: false, supported: false, models: [],
+    harnessVersion: null, elapsedMs: 0, nativeSessionId: null, nativeTurnId: null, sourceReceipt: {
+      schemaVersion: 1, kind: 'native-model-qualification', host, backendIdentityProved: false,
+      adapterSha256: digest(fs.readFileSync(SELF)), nativeSettings: {}, nativeTurn: null,
+      request: inspectOnly ? null : { model, effort, promptSha256: digest(String(prompt)) }, transcriptRedactions: ['account/auth identifying fields'],
+    } };
+  const controller = new AbortController(); let abortError;
+  const fail = (error) => { if (!controller.signal.aborted) { abortError = error; controller.abort(); } };
+  const remaining = () => { const ms = deadline - now(); if (ms <= 0) throw new Error('Shared native qualification deadline exhausted'); return ms; };
+  const bounded = (promise) => new Promise((resolve, reject) => {
+    if (controller.signal.aborted) return reject(abortError);
+    const stop = () => reject(abortError); controller.signal.addEventListener('abort', stop, { once: true });
+    Promise.resolve(promise).then(resolve, reject).finally(() => controller.signal.removeEventListener('abort', stop));
+  });
+  let timer;
+  try {
+    if (!['codex', 'claude-code'].includes(host) || !Number.isFinite(deadline)) throw new Error('Supported native host and absolute deadline required');
+    remaining(); timer = setTimeout(() => fail(new Error('Shared native qualification deadline exhausted')), remaining());
+    if (!inspectOnly && (!ID.test(model || '') || !EFFORTS.has(effort) || typeof prompt !== 'string' || !prompt.trim() || Buffer.byteLength(prompt) > 16384 || !path.isAbsolute(cwd || ''))) throw new Error('Static model/effort, bounded plaintext prompt and absolute sandbox cwd required');
+    const binary = fs.realpathSync(options.binary || binaryFor(host));
+    result.sourceReceipt.binary = binary;
+    // Exact native executable bytes, without retaining executable or credentials in the receipt.
+    const hash = crypto.createHash('sha256'); const stream = fs.createReadStream(binary);
+    const stopHash = () => stream.destroy(abortError);
+    controller.signal.addEventListener('abort', stopHash, { once: true });
+    try { await bounded(new Promise((resolve, reject) => { stream.on('data', (bytes) => { try { remaining(); hash.update(bytes); } catch (e) { stream.destroy(e); } }); stream.once('error', reject); stream.once('end', resolve); })); }
+    finally { controller.signal.removeEventListener('abort', stopHash); }
+    result.sourceReceipt.nativeBinarySha256 = hash.digest('hex');
+    const clean = subscriptionEnvironment(env);
+    result.harnessVersion = String(versionProbe(binary, ['--version'], { env: clean, encoding: 'utf8', timeout: remaining(), stdio: ['ignore', 'pipe', 'pipe'] })).trim().slice(0, 128);
+    await bounded(authCheck(host, { env: clean, probe: (_command, args, opts) => versionProbe(binary, args, { ...opts, timeout: remaining() }) }));
+    result.nativeSubscription = true;
+    const args = host === 'codex' ? ['app-server', '--strict-config', '-c', 'model_provider="openai"', '-c', 'service_tier="default"', '-c', 'features.fast_mode=false',
+      '-c', 'features.shell_tool=false', '-c', 'features.unified_exec=false', '-c', 'features.code_mode=false', '-c', 'features.code_mode_host=false', '-c', 'features.multi_agent=false', '-c', 'features.plugins=false', '-c', 'web_search="disabled"', '-c', 'mcp_servers={}']
+      : ['--print', '--verbose', '--input-format', 'stream-json', '--output-format', 'stream-json', '--include-partial-messages', '--tools', '', '--mcp-config', '{"mcpServers":{}}', '--strict-mcp-config', '--no-session-persistence'];
+    remaining(); child = spawnHost(binary, args, { env: clean, cwd: cwd || os.tmpdir(), shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
+    transport = new Transport(child, host, fail, transcript, controller.signal);
+    const metadata = (promise) => {
+      const timeout = setTimeout(() => fail(new Error(`Native metadata timeout: ${result.sourceReceipt.stage}`)), Math.min(10000, remaining()));
+      return bounded(promise).finally(() => clearTimeout(timeout));
+    };
+    const request = (...params) => { result.sourceReceipt.stage = params[0]; return metadata(transport.request(...params)); };
+    if (host === 'codex') {
+      await request('initialize', { clientInfo: { name: 'native_model_qualification', version: '1' }, capabilities: { experimentalApi: true } }); transport.send({ method: 'initialized' });
+      const account = await request('account/read', { refreshToken: false });
+      if (account?.account?.type !== 'chatgpt') throw new Error('Native same-process subscription account unavailable');
+      const allowance = await request('account/rateLimits/read', { excludeResetCreditDetails: true, supportsLunaReserve: false });
+      if (allowance?.ordinaryUsageAllowed !== true) throw new Error('Native ordinary subscription allowance unavailable');
+      result.sourceReceipt.allowance = { verified: true, basis: 'native-account/rateLimits/read', reservation: false, raceSafe: false };
+      let cursor;
+      do {
+        const catalog = await request('model/list', { ...(cursor ? { cursor } : {}), includeHidden: true });
+        if (!Array.isArray(catalog?.data)) throw new Error('Native model catalog unavailable');
+        result.models.push(...catalog.data.map((m) => ({ id: m.model, efforts: (m.supportedReasoningEfforts || []).map((e) => e.reasoningEffort), inputModalities: m.inputModalities })));
+        cursor = catalog.nextCursor;
+        if (result.models.length > 1000) throw new Error('Native catalog exceeded bound');
+      } while (cursor);
+      result.available = true; result.catalogStatus = 'verified';
+      if (!inspectOnly) {
+        if (!result.models.some((m) => m.id === model && m.efforts.includes(effort))) throw new Error('Native model/effort unsupported');
+        result.supported = true;
+        const thread = await request('thread/start', { cwd, model, modelProvider: 'openai', serviceTier: 'default', sandbox: 'read-only', approvalPolicy: 'untrusted', ephemeral: true, environments: [], dynamicTools: [],
+          developerInstructions: 'Qualification: plaintext answer only. Never use tools, read files, execute code, or delegate.' });
+        const threadId = thread?.thread?.id; if (!threadId) throw new Error('Native thread identity missing');
+        result.nativeSessionId = threadId;
+        const settings = async (params) => {
+          const start = transport.events.length;
+          await request('thread/settings/update', { threadId, ...params });
+          result.sourceReceipt.stage = 'thread/settings/updated';
+          const event = await metadata(transport.wait((m) => m.method === 'thread/settings/updated' && m.params?.threadId === threadId, start));
+          const s = event.params.threadSettings;
+          if (s?.model !== model || s.effort !== effort || s.modelProvider !== 'openai' || s.serviceTier !== 'default') throw new Error('Native configured model/effort/provider mismatch');
+          return { model: s.model, effort: s.effort, provider: s.modelProvider, serviceTier: s.serviceTier, threadId };
+        };
+        result.sourceReceipt.nativeSettings.before = await settings({ model, effort, serviceTier: 'default' });
+        const accepted = await request('turn/start', { threadId, model, effort, serviceTier: 'default', input: [{ type: 'text', text: prompt }] });
+        const turnId = accepted?.turn?.id; if (!turnId) throw new Error('Native turn identity missing');
+        result.sourceReceipt.stage = 'turn/completed';
+        const end = await bounded(transport.wait((m) => m.method === 'turn/completed' && m.params?.threadId === threadId && m.params?.turn?.id === turnId));
+        if (end.params.turn.status !== 'completed') throw new Error('Native turn did not complete');
+        const items = transport.events.filter((m) => m.method === 'item/completed' && m.params?.threadId === threadId && m.params?.turnId === turnId);
+        result.output = items.filter((m) => m.params.item?.type === 'agentMessage').map((m) => m.params.item.text || '').join('\n');
+        result.nativeTurnId = turnId;
+        // Native same-value updates emit no notification. Read actual live thread
+        // metadata after completion; never infer settings from a no-op acknowledgment.
+        const observed = (await request('thread/read', { threadId, includeTurns: false }))?.thread;
+        if (observed?.id !== threadId || observed.model !== model || observed.reasoningEffort !== effort || observed.modelProvider !== 'openai') throw new Error('Native completed thread model/effort/provider mismatch');
+        result.sourceReceipt.nativeSettings.after = { model: observed.model, effort: observed.reasoningEffort, provider: observed.modelProvider, threadId, basis: 'native-thread/read' };
+        if (Object.hasOwn(observed, 'serviceTier')) {
+          if (observed.serviceTier !== 'default') throw new Error('Native completed thread service tier mismatch');
+          result.sourceReceipt.nativeSettings.after.serviceTier = observed.serviceTier;
+          result.sourceReceipt.nativeSettings.after.serviceTierBasis = 'native-thread/read';
+        } else result.sourceReceipt.nativeSettings.after.serviceTierBasis = 'pre-turn-native-settings-and-fixed-host-configuration';
+      }
+    } else {
+      if (!/^2\.1\.289 \(Claude Code\)$/.test(result.harnessVersion)) throw new Error('Experimental Claude allowance contract version unsupported');
+      const initialized = await request('initialize');
+      if (initialized?.session_state !== 'idle') throw new Error('Native Claude session not idle');
+      result.sourceReceipt.allowance = verifyClaudeAllowance(await request('get_usage', { skip_behaviors: true }), model);
+      // Native initialize.models is the extension's supportedModels() source.
+      result.catalogStatus = Array.isArray(initialized.models) ? 'verified' : 'unknown';
+      for (const m of initialized.models || []) {
+        if (typeof m.resolvedModel !== 'string') throw new Error('Native Claude model catalog malformed');
+        if (!result.models.some((entry) => entry.id === m.resolvedModel)) result.models.push({ id: m.resolvedModel,
+          efforts: m.supportsEffort === true && Array.isArray(m.supportedEffortLevels) ? m.supportedEffortLevels.filter((e) => EFFORTS.has(e)) : [] });
+      }
+      result.available = true;
+      if (!inspectOnly) {
+        if (!result.models.some((m) => m.id === model && m.efforts.includes(effort))) throw new Error('Native Claude model/effort unsupported or unknown');
+        await request('apply_flag_settings', { settings: { model, effortLevel: effort } });
+        const settings = async () => {
+          const observed = (await request('get_settings'))?.applied;
+          if (observed?.model !== model || observed.effort !== effort) throw new Error('Native Claude configured model/effort mismatch');
+          return { model: observed.model, effort: observed.effort };
+        };
+        result.sourceReceipt.nativeSettings.before = await settings(); result.supported = true;
+        transport.send({ type: 'user', uuid: crypto.randomUUID(), session_id: '', message: { role: 'user', content: [{ type: 'text', text: prompt }] }, parent_tool_use_id: null });
+        result.sourceReceipt.stage = 'result';
+        const completion = await bounded(transport.wait((m) => m.type === 'result'));
+        if (completion.is_error || completion.subtype !== 'success' || !completion.uuid || !completion.session_id || !completion.usage || !(completion.duration_api_ms > 0) || !(completion.num_turns > 0)) throw new Error('Native Claude completion identity/usage unavailable');
+        result.output = completion.result || ''; result.nativeSessionId = completion.session_id; result.nativeTurnId = completion.uuid;
+        result.sourceReceipt.nativeSettings.after = await settings();
+      }
+    }
+    if (!inspectOnly) {
+      if (typeof result.output !== 'string' || !result.output.trim() || Buffer.byteLength(result.output) > 32768) throw new Error('Native plaintext output missing or exceeded bound');
+      result.completed = true; result.nativeModel = result.sourceReceipt.nativeSettings.after.model; result.nativeEffort = result.sourceReceipt.nativeSettings.after.effort; result.identityBasis = 'native-host-confirmed-configuration';
+      result.sourceReceipt.nativeTurn = { threadId: result.nativeSessionId, turnId: result.nativeTurnId, status: 'completed', toolEvents: [],
+        turnIdBasis: host === 'codex' ? 'native-turn.id' : 'native-result.uuid' };
+      result.sourceReceipt.stage = 'completed';
+    }
+  } catch (error) { result.failure = error.message; result.completed = false; result.output = ''; }
+  finally {
+    clearTimeout(timer); controller.abort();
+    if (child) {
+      await new Promise((resolve) => {
+        const grace = setTimeout(() => { child.kill('SIGKILL'); resolve(); }, Math.max(0, Math.min(100, deadline - now())));
+        child.once('close', () => { clearTimeout(grace); resolve(); });
+        child.stdin.end(); child.kill('SIGTERM');
+      });
+    }
+    result.elapsedMs = Math.max(0, now() - started); result.checkedAt = new Date().toISOString();
+    result.transcript = transcript.map((frame) => JSON.stringify(frame, redact)).join('\n');
+    if (Buffer.byteLength(result.transcript) > 1024 * 1024) {
+      result.completed = false; result.output = ''; result.failure = 'Archived native transcript exceeded bound';
+      result.transcript = ''; result.sourceReceipt.nativeTurn = null;
+    }
+    result.transcriptSha256 = digest(result.transcript); result.sourceReceipt.transcriptSha256 = result.transcriptSha256;
+    result.sourceReceipt.harnessVersion = result.harnessVersion;
+  }
+  return result;
+}
+
+export const runNativeQualification = (options) => run(options, false);
+export const inspectNativeQualificationHost = (options) => run(options, true);

package/scripts/model-router-agent-hook.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+// Per-user PreToolUse boundary for native agent launches. Root owns host registration.
+// Codex v2 spawn_agent model/reasoning_effort/fork_turns fields checked in official source and
+// installed CLI. Claude's installed Agent schema lacks per-call effort and permits model aliases
+// only; do not invent unsupported fields. Actual rewritten dispatch requires host acceptance proof.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { readCodexAllowance } from './native-subscription-usage.mjs';
+
+const DIR = path.dirname(fileURLToPath(import.meta.url));
+const TASK_CLASSES = new Set(['fast', 'medium', 'substantial', 'hard', 'exceptional']);
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+const CODEX_AGENT = /^(?:(?:functions|collaboration|multi_agent_v2)\.)?spawn_agent$/;
+const CLAUDE_AGENT = /^(?:Agent|Task)$/;
+
+function deny(reason) {
+  return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } };
+}
+
+function advisory(reason) {
+  return { hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: reason } };
+}
+
+export function loadScope(harness, { routerDir = process.env.MODEL_ROUTER_CONFIG_DIR || path.join(os.homedir(), '.claude', 'model-router') } = {}) {
+  try {
+    const profile = JSON.parse(fs.readFileSync(process.env.MODEL_ROUTER_PROFILE || path.join(routerDir, 'profile.json'), 'utf8'));
+    const selection = JSON.parse(fs.readFileSync(process.env.MODEL_ROUTER_SELECTION || path.join(routerDir, 'routing-policy.json'), 'utf8'));
+    const user = profile.nativeAgentRouting?.[harness];
+    const reviewed = selection.nativeAgentRouting?.[harness];
+    return { enabled: user?.enabled === true && reviewed?.enabled === true,
+      strict: user?.strict === true && reviewed?.strict === true };
+  } catch { return { enabled: false, strict: false }; }
+}
+
+export function decideViaEngine(prompt, harness, { engine = process.env.MODEL_ROUTER_ENGINE || path.join(DIR, 'model-router-engine.mjs'),
+  run = execFileSync } = {}) {
+  return JSON.parse(run(process.execPath, [engine, '--harness', harness, '--policy-only', '--json'], {
+    input: prompt, encoding: 'utf8', timeout: 2000, maxBuffer: 131072,
+    // No policy errors or raw task text are emitted by this hook on child failure.
+    stdio: ['pipe', 'pipe', 'pipe'],
+  }));
+}
+
+export function loadNativeModels(file = process.env.MODEL_ROUTER_NATIVE_MODELS ||
+  path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'models_cache.json')) {
+  const cache = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (!Array.isArray(cache.models)) throw new Error('Native model support cache missing');
+  return cache.models;
+}
+
+export function routeAgentLaunch(event, { harness, decide = decideViaEngine, nativeModels = loadNativeModels, scope = loadScope, parentState = null } = {}) {
+  const tool = event?.tool_name || event?.toolName;
+  const isAgent = harness === 'codex' ? CODEX_AGENT.test(tool || '') :
+    harness === 'claude-code' ? CLAUDE_AGENT.test(tool || '') : false;
+  if (!isAgent || (event.hook_event_name && event.hook_event_name !== 'PreToolUse')) return {};
+  const routingScope = scope(harness);
+  if (!routingScope.enabled) return {};
+  const refuse = (reason) => harness === 'codex' && routingScope.strict ? deny(reason) : advisory(reason);
+  const input = event.tool_input || event.toolInput;
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return refuse('Agent launch arguments unavailable; use a classified managed worker.');
+  const prompt = harness === 'codex' ? input.message : input.prompt;
+  if (typeof prompt !== 'string' || !prompt.trim()) return refuse('Agent task unavailable for classification; use a classified managed worker.');
+  let decision;
+  try { decision = decide(prompt, harness); }
+  catch { return refuse('Current reviewed model/effort allocation unavailable; review routing policy before agent dispatch.'); }
+  if (!decision?.subscriptionCovered || decision.harness !== harness || !TASK_CLASSES.has(decision.taskClass) ||
+      !EFFORTS.has(decision.effort) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]+$/.test(decision.model || '')) {
+    return refuse('Agent routing did not produce a qualified native subscription model and effort.');
+  }
+  if (harness === 'codex' && ['xhigh', 'max'].includes(decision.effort) &&
+      (decision.taskClass !== 'exceptional' || decision.effort !== 'xhigh' || !/^[a-z][a-z0-9-]{2,79}$/.test(decision.exceptionalReason || ''))) {
+    return refuse('Exceptional native agent effort requires an explicit named reason and qualified xhigh route.');
+  }
+  if (harness === 'claude-code') {
+    return advisory(`Native Claude Agent cannot enforce this reviewed ${decision.taskClass} model and ${decision.effort} effort through its current per-call schema. Use model-router-dispatch.mjs; do not add unsupported effort fields.`);
+  }
+  // Never convert all-history forks into context-free tasks to make overrides fit.
+  if ('fork_context' in input) return refuse('Legacy fork_context dispatch is unsupported by this v2 routing hook; preserve context through a supported launch.');
+  const fork = typeof input.fork_turns === 'string' ? input.fork_turns.trim().toLowerCase() : 'all';
+  if (fork === 'all' || !fork) {
+    // Parent evidence must come from a verified host adapter, never the requested tool arguments.
+    // Current native hook has no proven effective-effort field, so main supplies no parent evidence.
+    if (parentState?.observed === true && parentState.model === decision.model && parentState.effort === decision.effort) {
+      return advisory('Full-history fork already matches the reviewed model and effort; input and inherited context preserved.');
+    }
+    return refuse('Full-history agent forks inherit parent model and effort; a matching effective parent allocation is not verified. Routing will not discard context; use an explicitly authorized bounded fork or managed worker.');
+  }
+  if (fork !== 'none' && !/^[1-9]\d*$/.test(fork)) return refuse('Invalid fork_turns; routing will not alter the context boundary.');
+  let model;
+  try { model = nativeModels().find((m) => m.slug === decision.model); }
+  catch { return refuse('Native agent model support unavailable; refresh the host model cache before dispatch.'); }
+  if (!model || model.multi_agent_version !== 'v2' ||
+      !(model.supported_reasoning_levels || []).some((entry) => entry.effort === decision.effort)) {
+    return refuse('Reviewed model/effort is not supported by this native v2 agent host.');
+  }
+  // updatedInput replaces the COMPLETE object. No context, capabilities, auth, or task fields dropped.
+  return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow',
+    updatedInput: { ...input, model: decision.model, reasoning_effort: decision.effort },
+    ...(decision.exceptionalReason ? { additionalContext: `Qualified exceptional reason: ${decision.exceptionalReason}` } : {}) } };
+}
+
+async function main(argv) {
+  const at = argv.indexOf('--harness');
+  const harness = at < 0 ? null : argv[at + 1];
+  if (!['codex', 'claude-code'].includes(harness)) throw new Error('Explicit supported --harness required');
+  let event;
+  try { event = JSON.parse(fs.readFileSync(0, 'utf8')); }
+  catch {
+    const scope = loadScope(harness);
+    const output = !scope.enabled ? {} : harness === 'codex' && scope.strict
+      ? deny('Malformed agent hook input; launch was not classified.') : advisory('Malformed agent hook input; launch was not classified.');
+    process.stdout.write(JSON.stringify(output) + '\n'); return;
+  }
+  let output = routeAgentLaunch(event, { harness });
+  if (harness === 'codex' && output.hookSpecificOutput?.permissionDecision === 'allow') {
+    try { await readCodexAllowance(); }
+    catch {
+      output = loadScope(harness).strict ? deny('Current native ordinary subscription allowance unavailable; no credit fallback authorized.')
+        : advisory('Current native ordinary subscription allowance unavailable; managed dispatch cannot proceed without fresh allowance.');
+    }
+  }
+  // The host's normal transcript records its tool input. This hook persists no task text.
+  process.stdout.write(JSON.stringify(output) + '\n');
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main(process.argv.slice(2)).catch(() => {
+    const args = process.argv.slice(2); const harness = args[args.indexOf('--harness') + 1];
+    const result = harness === 'codex' && loadScope(harness).strict ? deny('Agent routing hook failed; managed dispatch required.')
+      : advisory('Agent routing hook failed; managed dispatch remains the supported enforcement path.');
+    process.stdout.write(JSON.stringify(result) + '\n');
+  });
+}

package/scripts/model-router-dispatch.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// Managed native worker launcher. A prompt hook advises; this boundary enforces launch arguments.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { spawn, execFileSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { assertCurrentSelection, selectionEvidenceStatus, loadSelection, loadCatalog, loadProfile, applyProfile, eligibleCandidates, TASK_CLASSES } from './model-router-engine.mjs';
+
+import { readCodexAllowance } from './native-subscription-usage.mjs';
+
+const DIR = path.dirname(fileURLToPath(import.meta.url));
+const BILLING_ENV = /^(OPENAI_API_KEY|OPENAI_BASE_URL|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|ANTHROPIC_CUSTOM_HEADERS|CLAUDE_CODE_USE_BEDROCK|CLAUDE_CODE_USE_VERTEX|CLAUDE_CODE_USE_FOUNDRY|CODEX_API_KEY)$/;
+
+export function subscriptionEnvironment(env = process.env) {
+  return Object.fromEntries(Object.entries(env).filter(([key]) => !BILLING_ENV.test(key)));
+}
+
+export function assertSubscriptionAuth(harness, { env = subscriptionEnvironment(), read = fs.readFileSync,
+  probe = execFileSync } = {}) {
+  if (harness === 'codex') {
+    let auth;
+    try { auth = JSON.parse(read(path.join(env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'auth.json'), 'utf8')); }
+    catch { throw new Error('Native Codex subscription authentication unreadable; dispatch blocked'); }
+    if (!auth.tokens || auth.OPENAI_API_KEY || (auth.auth_mode && auth.auth_mode !== 'chatgpt')) {
+      throw new Error('Codex subscription OAuth authentication required; no API-key fallback');
+    }
+  } else if (harness === 'claude-code') {
+    let status;
+    try { status = JSON.parse(probe('claude', ['auth', 'status', '--json'], {
+      env, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'pipe'],
+    })); } catch { throw new Error('Native Claude subscription authentication unavailable; dispatch blocked'); }
+    if (!status.loggedIn || status.authMethod !== 'claude.ai' || status.apiProvider !== 'firstParty' || !status.subscriptionType) {
+      throw new Error('Claude native subscription authentication required; no API fallback');
+    }
+  } else throw new Error(`Unsupported harness: ${harness}`);
+}
+
+export function loadNativeCodexModels() {
+  const file = process.env.MODEL_ROUTER_NATIVE_MODELS || path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'models_cache.json');
+  try {
+    const cache = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (Array.isArray(cache.models)) return cache.models;
+  } catch { /* no inferred capability from API or catalog pricing */ }
+  throw new Error('Native Codex model support cache unavailable; refresh host metadata before dispatch');
+}
+
+export function validateDispatchDecision(decision, { selection = loadSelection(), profile = loadProfile(),
+  candidates = applyProfile(loadCatalog(), profile), nativeModels } = {}) {
+  const evidence = selectionEvidenceStatus(selection);
+  if (selection.reviewedAt !== decision.selectionReviewedAt || !evidence.routeDigest || evidence.routeDigest !== decision.selectionRouteDigest) throw new Error('Allocation changed since selection; reclassify prompt');
+  const approved = selection.routes?.[decision.harness]?.[decision.taskClass];
+  const efforts = [approved?.effort];
+  if (decision.harness === 'claude-code' && decision.taskClass === 'medium') {
+    efforts.push(selection.routes?.[decision.harness]?.codingEffort);
+  }
+  if (decision.harness === 'codex' && ['xhigh', 'max'].includes(decision.effort) &&
+      (decision.taskClass !== 'exceptional' || decision.effort !== 'xhigh' || !approved?.requiresNamedReason ||
+       !/^[a-z][a-z0-9-]{2,79}$/.test(decision.exceptionalReason || ''))) {
+    throw new Error('Exceptional xhigh dispatch requires explicit qualified route and named reason');
+  }
+  if (approved?.model !== decision.model || !efforts.includes(decision.effort) ||
+      !eligibleCandidates(candidates, profile, decision.harness).some((m) => m.id === decision.model)) {
+    throw new Error('Launch no longer satisfies reviewed native subscription allocation');
+  }
+  if (decision.harness === 'codex') {
+    const native = (nativeModels || loadNativeCodexModels()).find((m) => m.slug === decision.model);
+    if (!native || !(native.supported_reasoning_levels || []).some((m) => m.effort === decision.effort)) {
+      throw new Error('Native Codex host does not support the reviewed model/effort dispatch');
+    }
+  }
+  return evidence;
+}
+
+export function buildLaunch(decision, { cwd = process.cwd(), interactive = false } = {}) {
+  if (interactive) throw new Error('Interactive host cannot keep managed-worker prompts on stdin; use managed worker launch');
+  assertCurrentSelection({ schemaVersion: 1, reviewedAt: decision.selectionReviewedAt, maxAgeMs: decision.selectionMaxAgeMs });
+  if (!decision.subscriptionCovered || !TASK_CLASSES.includes(decision.taskClass) ||
+      !['low', 'medium', 'high', 'xhigh', 'max'].includes(decision.effort) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]+$/.test(decision.model || '')) {
+    throw new Error('Invalid or unauthorized routing decision');
+  }
+  if (decision.harness === 'codex' && decision.provider === 'openai') {
+    return { command: 'codex', args: ['exec', '--ignore-user-config',
+      '--model', decision.model, '-c', `model_reasoning_effort="${decision.effort}"`,
+      '-c', 'model_provider="openai"', '-c', 'service_tier="default"', '-c', 'features.fast_mode=false', '--cd', cwd, '-'] };
+  }
+  if (decision.harness === 'claude-code' && decision.provider === 'anthropic') {
+    // Ignore user/project API-key helpers and provider redirects. Native OAuth remains readable.
+    return { command: 'claude', args: ['--print', '--model', decision.model,
+      '--effort', decision.effort, '--setting-sources', '', '--settings', '{"apiKeyHelper":""}'] };
+  }
+  throw new Error('Decision does not target a supported native subscription host');
+}
+
+export async function dispatch(decision, prompt, { spawnWorker = spawn, checkAuth = assertSubscriptionAuth, verifyDecision = validateDispatchDecision,
+  env = process.env, cwd = process.cwd(), interactive = false, checkAllowance = readCodexAllowance,
+  receiptFile = process.env.MODEL_ROUTER_DISPATCH_RECEIPTS || path.join(os.homedir(), '.claude', 'metaharness', 'dispatch-decisions.jsonl') } = {}) {
+  const evidence = verifyDecision(decision) || selectionEvidenceStatus({ schemaVersion: 1,
+    reviewedAt: decision.selectionReviewedAt, maxAgeMs: decision.selectionMaxAgeMs });
+  const launch = buildLaunch(decision, { cwd, interactive });
+  const cleanEnv = subscriptionEnvironment(env);
+  checkAuth(decision.harness, { env: cleanEnv });
+  const allowance = decision.harness === 'codex' ? await checkAllowance({ env: cleanEnv })
+    : { checkedAt: null, ordinaryUsageAllowed: null, status: 'native-claude-allowance-not-verified' };
+  const receipt = { ts: new Date().toISOString(), harness: decision.harness, model: decision.model,
+    effort: decision.effort, taskClass: decision.taskClass, exceptionalReason: decision.exceptionalReason, subscriptionCovered: true,
+    selectionReviewedAt: evidence.reviewedAt, selectionRouteDigest: evidence.routeDigest || decision.selectionRouteDigest,
+    selectionEvidenceStale: evidence.stale,
+    status: 'launch-requested', modelObserved: false, serviceMode: decision.harness === 'codex' ? 'standard' : 'existing-claude-policy',
+    allowance: { checkedAt: allowance.checkedAt, ordinaryUsageAllowed: allowance.ordinaryUsageAllowed, reservation: false, raceSafe: false } };
+  // Durable receipt is required. It never contains the prompt or policy-supplied reason.
+  fs.mkdirSync(path.dirname(receiptFile), { recursive: true });
+  fs.appendFileSync(receiptFile, JSON.stringify(receipt) + '\n', { mode: 0o600 });
+  const child = spawnWorker(launch.command, launch.args, {
+    cwd, env: cleanEnv, shell: false, stdio: ['pipe', 'inherit', 'inherit'],
+  });
+  child.stdin.end(prompt);
+  return await new Promise((resolve, reject) => {
+    child.once('error', reject);
+    child.once('exit', (code, signal) => {
+      fs.appendFileSync(receiptFile, JSON.stringify({ ...receipt, ts: new Date().toISOString(),
+        status: code === 0 ? 'process-completed' : 'process-failed', exitCode: code, signal }) + '\n');
+      resolve(code ?? 1);
+    });
+  });
+}
+
+async function main(argv) {
+  let harness = 'codex', policy, interactive = false, dryRun = false, requestJson = false;
+  const promptParts = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--harness') harness = argv[++i];
+    else if (argv[i] === '--policy') policy = argv[++i];
+    else if (argv[i] === '--request-json') requestJson = true;
+    else if (argv[i] === '--interactive') interactive = true;
+    else if (argv[i] === '--dry-run') dryRun = true;
+    else if (argv[i] === '--') { promptParts.push(...argv.slice(i + 1)); break; }
+    else if (argv[i].startsWith('-')) throw new Error(`Unsupported launch option: ${argv[i]}`);
+    else promptParts.push(argv[i]);
+  }
+  const raw = promptParts.length ? promptParts.join(' ') : fs.readFileSync(0, 'utf8');
+  const request = requestJson ? JSON.parse(raw) : { prompt: raw };
+  const prompt = request.prompt;
+  if (typeof prompt !== 'string') throw new Error('Request prompt must be a string');
+  const args = [path.join(DIR, 'model-router-engine.mjs'), '--harness', harness, '--json'];
+  if (policy) args.push('--policy', policy);
+  if (requestJson) args.push('--request-json');
+  const decision = JSON.parse(execFileSync(process.execPath, args, {
+    input: requestJson ? JSON.stringify(request) : prompt, encoding: 'utf8', timeout: 30000, maxBuffer: 1024 * 1024,
+  }));
+  if (dryRun) {
+    validateDispatchDecision(decision);
+    const launch = buildLaunch(decision, { interactive });
+    process.stdout.write(JSON.stringify({ ...launch, model: decision.model, effort: decision.effort,
+      taskClass: decision.taskClass, executed: false }) + '\n');
+  } else process.exitCode = await dispatch(decision, prompt, { interactive });
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main(process.argv.slice(2)).catch((e) => { process.stderr.write(`model-router-dispatch: ${e.message}\n`); process.exitCode = 1; });
+}