ruvnet-brain 4.5.5 → 4.5.7

package/scripts/claude-terminal-mod.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+// Materialize the sandboxed native mod and bridge it to the existing reviewed policy engine.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { classify } from '../config/model-router/policy.default.mjs';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+export const MOD_SOURCE = path.join(ROOT, 'config/model-router/claude-terminal-mod');
+export function terminalModDigest(pluginRoot) {
+  const hash = crypto.createHash('sha256');
+  for (const relative of ['.claude-plugin/plugin.json', 'hooks/hooks.json', 'hooks/register.js', 'hooks/routing.js', 'hooks/policy.default.mjs', 'hooks/runtime.js']) {
+    hash.update(relative); hash.update('\0'); hash.update(fs.readFileSync(path.join(pluginRoot, relative))); hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+export function prepareClaudeTerminalMod({ destination, nodePath = process.execPath,
+  helperPath = fileURLToPath(import.meta.url), enginePath = path.join(ROOT, 'scripts/model-router-engine.mjs') } = {}) {
+  if (!destination || !path.isAbsolute(destination)) throw new Error('Absolute mod destination required');
+  for (const file of [nodePath, helperPath, enginePath]) if (!path.isAbsolute(file) || !fs.existsSync(file)) throw new Error('Native mod dependency unavailable');
+  fs.mkdirSync(destination, { recursive: true, mode: 0o700 });
+  for (const part of ['.claude-plugin/plugin.json', 'hooks/hooks.json', 'hooks/register.js', 'hooks/routing.js']) {
+    const dest = path.join(destination, part);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.copyFileSync(path.join(MOD_SOURCE, part), dest);
+  }
+  const policyPath = path.join(destination, 'hooks/policy.default.mjs');
+  fs.copyFileSync(path.join(ROOT, 'config/model-router/policy.default.mjs'), policyPath);
+  fs.writeFileSync(path.join(destination, 'hooks/runtime.js'), `export default ${JSON.stringify({ nodePath, helperPath, enginePath, policyPath })};\n`, { mode: 0o600 });
+  return { pluginDir: destination, policyPath, modDigest: terminalModDigest(destination) };
+}
+export function validateDecision(decision, now = Date.now()) {
+  const age = now - Date.parse(decision?.selectionReviewedAt);
+  const maxAge = decision?.selectionMaxAgeMs;
+  if (decision?.harness !== 'claude-code' || decision.provider !== 'anthropic' || decision.subscriptionCovered !== true ||
+      !/^claude-[a-z0-9][a-z0-9.-]*$/.test(decision.model || '') || !['fast', 'medium', 'hard'].includes(decision.taskClass) ||
+      !['low', 'medium', 'high', 'xhigh', 'max'].includes(decision.effort) ||
+      !Number.isSafeInteger(maxAge) || maxAge <= 0 || maxAge > 604800000 || !Number.isFinite(age) || age < 0 ||
+      !/^[a-f0-9]{64}$/.test(decision.selectionRouteDigest || '')) throw new Error('Native terminal routing decision invalid; no fallback');
+  return decision;
+}
+export function routeNativePrompt({ prompt, turnId, minimumClass, enginePath = path.join(ROOT, 'scripts/model-router-engine.mjs'),
+  policyPath = path.join(ROOT, 'config/model-router/policy.default.mjs'), env = process.env } = {}) {
+  if (typeof prompt !== 'string' || !prompt.trim() || prompt.length > 200000) throw new Error('Native routing requires a bounded text prompt');
+  if (minimumClass !== undefined && !['fast', 'medium', 'hard'].includes(minimumClass)) throw new Error('Invalid class floor');
+  const codeFences = Math.floor((prompt.match(/```/g) || []).length / 2);
+  const hasCode = codeFences > 0 || /\b(function|const|let|def|class|import|=>|SELECT|async)\b/.test(prompt) || /[{};]\s*$/m.test(prompt);
+  const rank = { fast: 0, medium: 1, hard: 2 };
+  const canonicalFloor = classify({ taskHints: prompt, hasCode }, 'claude-code');
+  const floor = rank[minimumClass] > rank[canonicalFloor] ? minimumClass : canonicalFloor;
+  const classificationPrompt = floor === 'hard' ? 'final substantive review\n' + prompt : prompt;
+  // Let the engine honor the user's policy.mjs; the bundled copy is only the
+  // deterministic classification floor used by the sandboxed hook.
+  const result = spawnSync(process.execPath, [enginePath, '--harness', 'claude-code', '--request-json', '--policy-only', '--json'],
+    { input: JSON.stringify({ prompt: classificationPrompt }), encoding: 'utf8', env, timeout: 8000, maxBuffer: 262144 });
+  if (result.error || result.status !== 0) throw new Error('Reviewed native routing policy unavailable; no fallback');
+  const d = validateDecision(JSON.parse(result.stdout));
+  if (rank[d.taskClass] < rank[floor]) throw new Error('Reviewed native routing policy below canonical floor; no fallback');
+  // No prompt, reasoning, credentials, or arbitrary engine output crosses back to the sandbox.
+  return { schemaVersion: 1, turnId: typeof turnId === 'string' ? turnId : null, model: d.model, effort: d.effort,
+    taskClass: d.taskClass, expiresAt: Date.parse(d.selectionReviewedAt) + d.selectionMaxAgeMs,
+    subscriptionCovered: true, routeDigest: d.selectionRouteDigest };
+}
+export function writeReadinessReceipt({ nonce, receiptPath, pluginRoot, version, sessionId, status = 'ready' } = {}) {
+  if (!/^[a-f0-9]{64}$/.test(nonce || '') || !path.isAbsolute(receiptPath || '') ||
+      !path.isAbsolute(pluginRoot || '') || (!/^2\.1\.\d+$/.test(version || '') || Number(version.split('.')[2]) < 287) || typeof sessionId !== 'string' ||
+      !['ready', 'health'].includes(status)) throw new Error('Invalid native mod readiness request');
+  const receipt = { schemaVersion: 1, nonce, pluginRoot: fs.realpathSync(pluginRoot), nativeVersion: version,
+    sessionId, status, modDigest: terminalModDigest(pluginRoot), observedAt: new Date().toISOString(), pid: process.ppid,
+    scope: 'hook activation only; native load failure or worker crash can skip hooks' };
+  const parent = path.dirname(receiptPath);
+  if (!fs.existsSync(parent)) throw new Error('Readiness directory must be prepared by launcher');
+  const temporary = path.join(parent, `.rnb-ready-${crypto.randomBytes(16).toString('hex')}`);
+  fs.writeFileSync(temporary, JSON.stringify(receipt), { mode: 0o600, flag: 'wx' });
+  fs.renameSync(temporary, receiptPath);
+  return receipt;
+}
+async function main() {
+  const mode = process.argv[2];
+  const request = JSON.parse(fs.readFileSync(0, 'utf8'));
+  if (mode === '--decision') process.stdout.write(JSON.stringify(routeNativePrompt(request)) + '\n');
+  else if (mode === '--ready' || mode === '--health') process.stdout.write(JSON.stringify(writeReadinessReceipt({ ...request, status: mode === '--ready' ? 'ready' : 'health' })) + '\n');
+  else if (mode === '--prepare') process.stdout.write(JSON.stringify(prepareClaudeTerminalMod(request)) + '\n');
+  else throw new Error('Expected --prepare, --decision, --ready, or --health');
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main().catch(() => {
+  process.stderr.write('claude-terminal-mod: routing or activation unavailable; no fallback\n'); process.exitCode = 1;
+});

package/scripts/model-routing-gateway.mjs

@@ -15,6 +15,21 @@ import { subscriptionEnvironment, assertSubscriptionAuth, validateDispatchDecisi
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const REFUSED = 'Current reviewed native model/effort allocation unavailable; new turn was not forwarded.';
 const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+// Native inference surfaces without qualified execution-time routing are denied.
+const UNQUALIFIED = new Set(['review/start', 'thread/queue/add', 'thread/queue/update', 'thread/queue/start',
+  'thread/realtime/start', 'thread/realtime/appendAudio', 'thread/realtime/appendSpeech', 'thread/realtime/appendText',
+  'thread/goal/set', 'thread/goal/create', 'thread/goal/resume', 'thread/compact/start', 'turn/addUserMessage', 'thread/startAeon']);
+
+function canonicalCodexConfig(config) {
+  if (!config || (config.model_provider ?? 'openai') !== 'openai') return false;
+  // Native 0.160 gives serviceTierForTurn precedence over daemon/thread Fast defaults.
+  // routeCodexTurn supplies both standard overrides; provider/auth checks remain mandatory.
+  // A provider with the built-in name can still be replaced by a custom endpoint.
+  if (config.model_providers && Object.hasOwn(config.model_providers, 'openai') && config.model_providers.openai != null) return false;
+  if (config.chatgpt_base_url != null && config.chatgpt_base_url !== 'https://chatgpt.com/backend-api/') return false;
+  // Native Config serializes openai_base_url:null when the override is unset.
+  return !Object.entries(config).some(([key, value]) => value != null && /^(model_providers\.openai|base_url|baseUrl|openai_base_url)(\.|$)/.test(key));
+}
 
 /** Fresh policy-only subprocess: prompt stays on stdin, never argv, receipts or diagnostics. */
 export function decideNativeTurn(prompt, harness, { env = process.env, spawnEngine = spawn, timeoutMs = 4000, multimodal = false } = {}) {
@@ -107,9 +122,9 @@ function unsafeSettings(value, prefix = '', routing = false) {
   if (!value || typeof value !== 'object') return false;
   return Object.entries(value).some(([key, entry]) => {
     const name = prefix ? `${prefix}.${key}` : key;
-    if (/^(model_providers|apiKeyHelper|api_key|apiKey|base_url|baseUrl|auth_token|authToken|customHeaders|env|modelSettings|alwaysThinkingEnabled|maxEffortLevel)(\.|$)/.test(name)) return true;
+    if (/^(model_providers|apiKeyHelper|api_key|apiKey|base_url|baseUrl|openai_base_url|chatgpt_base_url|auth_token|authToken|customHeaders|env|modelSettings|alwaysThinkingEnabled|maxEffortLevel)(\.|$)/.test(name)) return true;
     if (/^(model_provider|modelProvider)$/.test(name) && entry !== 'openai') return true;
-    if (/^(service_tier|serviceTier)$/.test(name) && entry != null && entry !== 'default') return true;
+    if (/^(service_tier|serviceTier|service_tier_for_turn|serviceTierForTurn)$/.test(name) && entry != null && entry !== 'default') return true;
     if (/^(features\.fast_mode|fastMode)$/.test(name) && entry !== false) return true;
     if (routing && /^(model|effort|effortLevel|reasoning_effort|collaborationMode)(\.|$)/.test(name)) return true;
     return unsafeSettings(entry, name, routing);
@@ -123,7 +138,7 @@ export function verifyNativeVision(decision, models = loadNativeCodexModels()) {
 
 /** Pure native override: preserve every context, tool, approval and collaboration instruction. */
 export function routeCodexTurn(message, decision) {
-  const params = { ...message.params, model: decision.model, effort: decision.effort, serviceTier: 'default' };
+  const params = { ...message.params, model: decision.model, effort: decision.effort, serviceTier: 'default', serviceTierForTurn: 'default' };
   if (params.collaborationMode) params.collaborationMode = { ...params.collaborationMode,
     settings: { ...params.collaborationMode.settings, model: decision.model, reasoning_effort: decision.effort } };
   return { ...message, params };
@@ -135,7 +150,7 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
   receipt = appendGatewayReceipt, timeoutMs = 5000, maxDeferredBytes = 64 * 1024 * 1024, tempRoot = os.tmpdir(), now = () => new Date().toISOString() } = {}) {
   const nonce = crypto.randomUUID();
   const pending = new Map(), initIds = new Set(), ownIds = new Set(), held = new Set();
-  const accepted = new Map(), starts = new Map(), inactiveWaiters = new Set();
+  const accepted = new Map(), starts = new Map(), inactiveWaiters = new Set(), boundedWaiters = new Set();
   let serial = Promise.resolve(), ready = harness === 'codex', active = false, closed = false, serialNumber = 0;
   let readiness = null, resolveReady;
   let queuedBytes = 0, spoolDirectory = null, spoolSequence = 0, declineUsers = false;
@@ -218,9 +233,10 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
   };
   function bounded(work) {
     return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error(REFUSED)), timeoutMs);
-      Promise.resolve(work).then((value) => { clearTimeout(timer); resolve(value); },
-        (error) => { clearTimeout(timer); reject(error); });
+      const finish = (error, value) => { clearTimeout(timer); boundedWaiters.delete(cancel); error ? reject(error) : resolve(value); };
+      const cancel = () => finish(new Error(REFUSED));
+      const timer = setTimeout(cancel, timeoutMs); boundedWaiters.add(cancel);
+      Promise.resolve(work).then((value) => finish(null, value), (error) => finish(error));
     });
   }
   const control = (request) => new Promise((resolve, reject) => {
@@ -262,7 +278,7 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
       if (harness === 'codex') {
         if (message.method !== 'turn/start') {
           const pair = accepted.get(message.params?.threadId);
-          if (!pair || pair.model !== decision.model || pair.effort !== decision.effort) {
+          if (!pair || pair.turnId !== message.params?.expectedTurnId || pair.model !== decision.model || pair.effort !== decision.effort) {
             fail(message, 'Input not submitted: requires a new turn with reviewed allocation; current work continues.'); return;
           }
           record('active-input-approved', decision, false, { evidence: 'native-turn-start.accepted-configured-pair' });
@@ -271,6 +287,14 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
         const account = await control({ method: 'account/read', params: { refreshToken: false } });
         assertLive();
         if (account?.account?.type !== 'chatgpt') throw new Error(REFUSED);
+        const thread = await control({ method: 'thread/read', params: { threadId: message.params?.threadId, includeTurns: false } });
+        assertLive();
+        if (thread?.thread?.id !== message.params?.threadId || thread.thread.modelProvider !== 'openai') throw new Error(REFUSED);
+        const cwd = message.params?.cwd ?? thread.thread.cwd;
+        if (typeof cwd !== 'string' || !path.isAbsolute(cwd)) throw new Error(REFUSED);
+        const effective = await control({ method: 'config/read', params: { includeLayers: false, cwd } });
+        assertLive();
+        if (!canonicalCodexConfig(effective?.config)) throw new Error(REFUSED);
         const allowance = await control({ method: 'account/rateLimits/read', params: { excludeResetCreditDetails: true, supportsLunaReserve: false } });
         assertLive();
         if (allowance?.ordinaryUsageAllowed !== true) throw new Error(REFUSED);
@@ -310,10 +334,14 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     stream.on('end', () => { buffer += decoder.end(); if (buffer) handler(buffer); });
   };
   listenLines(input, (line) => {
+    if (closed) return;
     let message;
     try { message = JSON.parse(line); } catch { if (!closed) writeHost(line); return; }
     if (harness === 'claude-code' && message.type === 'control_request' && message.request?.subtype === 'initialize') initIds.add(message.request_id);
-    const routable = harness === 'codex' ? ['turn/start', 'turn/steer', 'thread/queue/add'].includes(message.method) : message.type === 'user';
+    if (harness === 'codex' && UNQUALIFIED.has(message.method)) {
+      fail(message, 'Native inference method is not qualified for gateway routing; request not forwarded.'); return;
+    }
+    const routable = harness === 'codex' ? ['turn/start', 'turn/steer'].includes(message.method) : message.type === 'user';
     if (routable && harness === 'claude-code' && (declineUsers || queuedBytes + Buffer.byteLength(line) > maxDeferredBytes)) {
       declineUsers = true;
       const reason = 'Deferred input capacity (64 MiB) exceeded; new user packet not submitted; current work continues.';
@@ -334,9 +362,11 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     let unsafe = false;
     if (harness === 'codex') {
       const params = message.params || {};
-      unsafe = unsafeSettings(params.config) || unsafeSettings({ modelProvider: params.modelProvider ?? 'openai', serviceTier: params.serviceTier ?? 'default' });
+      unsafe = unsafeSettings(params.config) || unsafeSettings({ modelProvider: params.modelProvider ?? 'openai',
+        serviceTier: params.serviceTier, service_tier: params.service_tier,
+        serviceTierForTurn: params.serviceTierForTurn, service_tier_for_turn: params.service_tier_for_turn });
       if (message.method === 'account/login/start' && !['chatgpt', 'chatgptDeviceCode', 'chatgptAuthTokens'].includes(params.type)) unsafe = true;
-      if (message.method === 'thread/settings/update') unsafe ||= unsafeSettings(params, '', true);
+      if (['thread/settings/update', 'turn/settings/update'].includes(message.method)) unsafe ||= unsafeSettings(params, '', true);
       const edits = message.method === 'config/value/write' ? [params] : message.method === 'config/batchWrite' ? params.edits || [] : [];
       if (message.method === 'config/batchWrite' && params.reloadUserConfig === true) unsafe = true;
       unsafe ||= edits.some((edit) => unsafeSettings({ [edit.keyPath]: edit.value }, '', true));
@@ -366,9 +396,9 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     }
     if (starts.has(id)) {
       const pair = starts.get(id); starts.delete(id);
-      if (!message.error && message.result?.turn) accepted.set(pair.threadId, pair);
+      if (!message.error && typeof message.result?.turn?.id === 'string' && message.result.turn.id) accepted.set(pair.threadId, { ...pair, turnId: message.result.turn.id });
     }
-    if (message.method === 'turn/completed') accepted.delete(message.params?.threadId);
+    if (message.method === 'turn/completed' && accepted.get(message.params?.threadId)?.turnId === message.params?.turn?.id) accepted.delete(message.params.threadId);
     if (ownIds.has(id)) return; // late own-control replies never escape into the host client
     if (initIds.has(id) && message.response?.subtype === 'success') {
       ready = true; active = message.response.response?.session_state && message.response.response.session_state !== 'idle'; resolveReady?.();
@@ -379,7 +409,9 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
   });
   child.stderr?.on('data', (chunk) => diagnostics.write(chunk));
   const close = () => {
+    if (closed) return;
     closed = true; hostWriter.close(); inactiveWaiters.forEach((resolve) => resolve()); inactiveWaiters.clear();
+    boundedWaiters.forEach((cancel) => cancel()); boundedWaiters.clear(); accepted.clear(); starts.clear();
     for (const token of [...held]) { token.cancelled = true; retire(token); }
     if (spoolDirectory) fs.rmSync(spoolDirectory, { recursive: true, force: true });
     spoolKey.fill(0);
@@ -387,7 +419,8 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     pending.clear();
   };
   child.once('error', close); child.once('exit', close); child.stdin.on('error', close); child.stdout.on('error', close);
-  input.on('end', () => { serial.finally(async () => { await hostWriter.idle(); if (!closed) child.stdin.end(); }); });
+  const disconnect = () => { close(); if (!child.stdin.destroyed) child.stdin.end(); };
+  input.on('end', disconnect); input.on('error', disconnect); input.on('close', disconnect);
   return { idle: () => serial, close, spoolState: () => ({ directory: spoolDirectory, queuedBytes }) };
 }
 

package/scripts/model-routing-launchers.mjs

@@ -9,6 +9,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 
 const SELF = fileURLToPath(import.meta.url);
 const sha = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
@@ -90,6 +91,27 @@ export function runtimeSnapshot(sourceRoot) {
     }
   };
   for (const relative of ['scripts/model-routing-gateway.mjs', 'scripts/model-router-engine.mjs', 'scripts/metaharness-router.mjs']) visit(relative);
+  for (const relative of ['scripts/model-terminal-gateway.mjs', 'scripts/claude-terminal-mod.mjs', 'scripts/model-terminal-launchers.mjs']) {
+    if (fs.existsSync(path.join(root, relative))) visit(relative);
+  }
+  const mod = 'config/model-router/claude-terminal-mod';
+  if (fs.existsSync(path.join(root, mod))) {
+    for (const relative of ['.claude-plugin/plugin.json', 'hooks/hooks.json', 'hooks/register.js', 'hooks/routing.js', 'hooks/runtime.js']) visit(`${mod}/${relative}`);
+  }
+  // The socket adapter must resolve its transport from the same immutable closure.
+  // Optional native accelerators are deliberately excluded; ws supports pure JS.
+  if (files.has('scripts/model-terminal-gateway.mjs')) {
+    const require = createRequire(path.join(root, 'package.json'));
+    const packageRoot = path.dirname(regular(require.resolve('ws/package.json')));
+    const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json')));
+    if (packageJson.name !== 'ws') throw new Error('Unexpected WebSocket dependency identity');
+    for (const relative of ['package.json', 'LICENSE', 'index.js', 'wrapper.mjs', 'browser.js',
+      ...fs.readdirSync(path.join(packageRoot, 'lib')).filter((name) => name.endsWith('.js')).map((name) => `lib/${name}`)]) {
+      const file = regular(path.join(packageRoot, relative));
+      if (!file.startsWith(`${packageRoot}${path.sep}`)) throw new Error('WebSocket dependency escaped package root');
+      files.set(`node_modules/ws/${relative}`, fs.readFileSync(file));
+    }
+  }
   for (const name of fs.readdirSync(path.join(root, 'config/model-router'))) {
     if (/\.(?:json|mjs)$/.test(name)) visit(`config/model-router/${name}`);
   }
@@ -104,6 +126,19 @@ function stableNode() {
   return process.execPath;
 }
 
+/** Terminal routing does not require a VS Code extension installation. */
+export function installRoutingRuntime({ sourceRoot, home = os.homedir(), apply = false } = {}) {
+  const snapshot = runtimeSnapshot(sourceRoot);
+  const runtimeRoot = path.join(home, '.cache/ruvnet-brain/model-routing/versions', snapshot.digest);
+  if (apply) for (const [relative, bytes] of snapshot.files) {
+    const file = path.join(runtimeRoot, relative);
+    if (fs.existsSync(file)) {
+      if (sha(fs.readFileSync(regular(file))) !== sha(bytes)) throw new Error('Immutable runtime snapshot mismatch');
+    } else atomic(file, bytes);
+  }
+  return { apply, runtimeRoot, runtimeDigest: snapshot.digest, runtimeFiles: snapshot.identity };
+}
+
 export function installNativeLaunchers({ sourceRoot, home = os.homedir(), extensionsRoot = path.join(home, '.vscode-server/extensions'), nodeBinary = stableNode(), apply = false } = {}) {
   // VS Code spawns its executable directly. A .cmd/.sh surrogate is not a proved
   // Windows executable adapter; refuse before writing a misleading registration.
@@ -113,7 +148,7 @@ export function installNativeLaunchers({ sourceRoot, home = os.homedir(), extens
   const runtime = path.join(base, 'versions', snapshot.digest);
   const runner = path.join(base, 'model-routing-launchers.mjs');
   const configPath = path.join(base, 'launcher-config.json');
-  const config = { extensionsRoot: fs.realpathSync(extensionsRoot), nodeBinary: (regular(fs.realpathSync(nodeBinary)), nodeBinary), gatewayPath: path.join(runtime, 'scripts/model-routing-gateway.mjs'), runtimeDigest: snapshot.digest };
+  const config = { extensionsRoot: fs.realpathSync(extensionsRoot), nodeBinary: (regular(fs.realpathSync(nodeBinary)), nodeBinary), gatewayPath: path.join(runtime, 'scripts/model-routing-gateway.mjs'), terminalGatewayPath: path.join(runtime, 'scripts/model-terminal-gateway.mjs'), runtimeRoot: runtime, runtimeDigest: snapshot.digest };
   const codexBinary = discoverNativeCodex(config.extensionsRoot);
   const launchers = Object.fromEntries(Object.keys(KEYS).map((host) => [host, path.join(home, '.local/bin', `ruvnet-brain-${host === 'codex' ? 'codex' : 'claude'}-gateway`)]));
   const texts = Object.fromEntries(Object.entries(launchers).map(([host]) => [host, `#!/bin/sh\n# Managed RuvNet Brain native routing launcher\nexec ${shellQuote(config.nodeBinary)} ${shellQuote(runner)} --launch ${shellQuote(host)} --config ${shellQuote(configPath)} --launcher "$0" -- "$@"\n`]));

package/scripts/model-terminal-gateway.mjs

@@ -0,0 +1,310 @@
+#!/usr/bin/env node
+// Per-launch Unix WebSocket adapter for the native subscription TUI. No daemon lifecycle ownership.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import http from 'node:http';
+import { Duplex, PassThrough, Writable } from 'node:stream';
+import { EventEmitter } from 'node:events';
+import { StringDecoder } from 'node:string_decoder';
+import { spawn } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
+import { connectNativeGateway, decideNativeTurn, nativeGatewayLaunch } from './model-routing-gateway.mjs';
+import { subscriptionEnvironment, assertSubscriptionAuth } from './model-router-dispatch.mjs';
+
+export const MAX_TERMINAL_BYTES = 64 * 1024 * 1024;
+const REFUSED = 'Native terminal routing unavailable; request was not sent.';
+const COMMANDS = new Set(['agents', 'exec', 'e', 'review', 'login', 'logout', 'mcp', 'plugin', 'app-server',
+  'remote-control', 'app', 'completion', 'update', 'doctor', 'sandbox', 'debug', 'apply', 'a', 'resume',
+  'queue', 'archive', 'delete', 'migrate-rollouts', 'unarchive', 'fork', 'cloud', 'exec-server', 'features', 'help']);
+const ADMIN = new Set(['login', 'logout', 'mcp', 'plugin', 'completion', 'update', 'doctor', 'features', 'help']);
+const VALUES = new Set(['-c', '--config', '--enable', '--disable', '-i', '--image', '-m', '--model',
+  '-p', '--profile', '-s', '--sandbox', '-C', '--cd', '--add-dir', '-a', '--ask-for-approval']);
+
+/** Short Unix roots avoid long environment-provided temp paths; Windows has no qualified transport. */
+export function terminalTempRoot(platform = process.platform) {
+  if (!['darwin', 'linux'].includes(platform)) throw new Error('Native Unix terminal routing requires macOS or Linux');
+  return platform === 'darwin' ? '/private/tmp' : '/tmp';
+}
+
+/** Keep native arguments verbatim; only proved interactive paths may enter the routed transport. */
+export function classifyTerminalArguments(args = []) {
+  if (args.some((arg) => /^--(?:remote(?:-auth-token-env)?|no-daemon)(?:=|$)/.test(arg))) {
+    throw new Error('Explicit remote or no-daemon transport conflicts with terminal routing');
+  }
+  let first;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === '--') return 'interactive'; // Native '--' ends subcommand parsing: following words are prompts.
+    if (VALUES.has(arg)) { index++; continue; }
+    if (arg.startsWith('-')) continue;
+    first = arg; break;
+  }
+  if (ADMIN.has(first) || (!first && args.some((arg) => ['--help', '-h', '--version', '-V'].includes(arg)))) return 'admin';
+  if (COMMANDS.has(first) && !['resume', 'fork'].includes(first)) {
+    throw new Error(`Native command ${first} has no proved terminal routing transport`);
+  }
+  return 'interactive';
+}
+
+/** Reject symlinks and foreign/group-accessible endpoints, including their containing directory. */
+export function validateUpstreamSocket(socketPath, { uid = process.getuid?.() } = {}) {
+  if (!path.isAbsolute(socketPath || '') || uid == null) throw new Error('Owned absolute Unix socket required');
+  const normalized = path.normalize(socketPath);
+  let current = normalized;
+  while (true) {
+    const entry = fs.lstatSync(current);
+    if (entry.isSymbolicLink()) throw new Error('Symlink in upstream socket path refused');
+    if (current === normalized && (!entry.isSocket() || entry.uid !== uid || (entry.mode & 0o077))) {
+      throw new Error('Upstream must be an owned private Unix socket');
+    }
+    if (current === path.dirname(normalized) && (!entry.isDirectory() || entry.uid !== uid || (entry.mode & 0o077))) {
+      throw new Error('Upstream socket directory must be owned and private');
+    }
+    if (current === path.dirname(current)) break;
+    current = path.dirname(current);
+  }
+  return normalized;
+}
+
+function jsonPacket(text) {
+  const packet = JSON.parse(text);
+  if (!packet || typeof packet !== 'object' || Array.isArray(packet)
+    || !(typeof packet.method === 'string' || (Object.hasOwn(packet, 'id')
+      && (Object.hasOwn(packet, 'result') || Object.hasOwn(packet, 'error'))))) throw new Error(REFUSED);
+  if (Object.hasOwn(packet, 'id') && !(typeof packet.id === 'string' || Number.isSafeInteger(packet.id))) throw new Error(REFUSED);
+  return packet;
+}
+
+/** Official proxy is a byte tunnel: perform the daemon's /rpc WebSocket handshake over its stdio. */
+export async function connectProxyWebSocket(proxy, { startupMs = 10000, maxBytes = MAX_TERMINAL_BYTES } = {}) {
+  const { WebSocket } = await import('ws');
+  const tunnel = Duplex.from({ readable: proxy.stdout, writable: proxy.stdin });
+  // createConnection always returns the owned tunnel; even the placeholder endpoint is Unix-only.
+  const ws = new WebSocket('ws+unix:///native-proxy:/rpc', { createConnection: () => tunnel,
+    perMessageDeflate: false, maxPayload: maxBytes, handshakeTimeout: startupMs, followRedirects: false });
+  const child = new EventEmitter(); child.on('error', () => {});
+  child.stdout = new PassThrough({ highWaterMark: 65536 }); child.stderr = proxy.stderr;
+  child.exitCode = null; child.signalCode = null;
+  let closed = false, ready = false, buffer = '';
+  const decoder = new StringDecoder('utf8');
+  const fail = () => { if (!closed) { child.emit('error', new Error(REFUSED)); child.kill('SIGTERM'); } };
+  child.kill = (signal) => {
+    if (closed && signal !== 'SIGKILL') return;
+    if (!closed) { closed = true; ws.terminate(); tunnel.destroy(); }
+    const sent = proxy.kill(signal);
+    if (signal !== 'SIGKILL') {
+      const killer = setTimeout(() => { if (proxy.exitCode == null && proxy.signalCode == null) proxy.kill('SIGKILL'); }, 1000);
+      killer.unref(); proxy.once('exit', () => clearTimeout(killer));
+    } child.exitCode = proxy.exitCode; child.signalCode = proxy.signalCode;
+    return sent;
+  };
+  child.stdin = new Writable({ highWaterMark: 65536, write(chunk, _encoding, callback) {
+    try {
+      buffer += decoder.write(chunk); if (Buffer.byteLength(buffer) > maxBytes) throw new Error(REFUSED);
+      const lines = buffer.split('\n'); buffer = lines.pop(); let index = 0;
+      const send = () => {
+        if (index === lines.length) { callback(); return; }
+        const line = lines[index++]; jsonPacket(line);
+        if (closed || ws.readyState !== WebSocket.OPEN || ws.bufferedAmount + Buffer.byteLength(line) > maxBytes) throw new Error(REFUSED);
+        ws.send(line, { binary: false }, (error) => {
+          if (error) { callback(error); fail(); return; }
+          try { send(); } catch (error) { callback(error); fail(); }
+        });
+      }; send();
+    } catch (error) { callback(error); fail(); }
+  } });
+  child.stdin.on('error', fail); child.stdout.on('error', fail);
+  ws.on('message', (bytes, binary) => {
+    try {
+      if (binary || bytes.length > maxBytes || child.stdout.writableLength + bytes.length + 1 > maxBytes) throw new Error(REFUSED);
+      const line = new TextDecoder('utf-8', { fatal: true }).decode(bytes); jsonPacket(line);
+      if (!child.stdout.write(line + '\n')) ws.pause();
+    } catch { fail(); }
+  });
+  child.stdout.on('drain', () => { if (!closed) ws.resume(); });
+  proxy.once('error', (error) => child.emit('error', error));
+  proxy.once('exit', (code, signal) => {
+    child.exitCode = code; child.signalCode = signal; child.emit('exit', code, signal);
+    if (!closed) { closed = true; ws.terminate(); tunnel.destroy(); }
+  });
+  ws.on('error', () => { if (ready) fail(); });
+  ws.once('close', () => { if (ready && !closed) fail(); });
+  try {
+    await new Promise((resolve, reject) => {
+      const rejectProxy = () => reject(new Error(REFUSED));
+      proxy.once('exit', rejectProxy); proxy.once('error', rejectProxy);
+      ws.once('error', rejectProxy); ws.once('close', rejectProxy);
+      ws.once('open', () => { proxy.removeListener('exit', rejectProxy); proxy.removeListener('error', rejectProxy);
+        ws.removeListener('error', rejectProxy); ws.removeListener('close', rejectProxy); ready = true; resolve(); });
+    });
+  } catch (error) { child.kill('SIGTERM'); throw error; }
+  return child;
+}
+
+/** Real HTTP/WebSocket framing over one private Unix socket, converted to native JSONL streams. */
+export async function createTerminalTransport({ child, diagnostics = process.stderr, gatewayOptions = {},
+  tempRoot, maxBytes = MAX_TERMINAL_BYTES, startupMs = 10000, onFailure = () => {} } = {}) {
+  const defaultTempRoot = terminalTempRoot();
+  const { WebSocketServer, WebSocket } = await import('ws');
+  if (!child?.stdin || !child?.stdout) throw new Error('Native proxy child required');
+  if (!(maxBytes > 0 && maxBytes <= MAX_TERMINAL_BYTES)) throw new Error('Invalid transport byte bound');
+  const directory = fs.mkdtempSync(path.join(fs.realpathSync(tempRoot ?? defaultTempRoot), 'crt-'));
+  fs.chmodSync(directory, 0o700);
+  const socketPath = path.join(directory, 'r.sock');
+  if (Buffer.byteLength(socketPath) > 100) { fs.rmSync(directory, { recursive: true }); throw new Error('Unix socket path too long'); }
+  const server = http.createServer((_request, response) => { response.writeHead(403); response.end(); });
+  const wss = new WebSocketServer({ noServer: true, maxPayload: maxBytes, perMessageDeflate: false });
+  const input = new PassThrough({ highWaterMark: 65536 });
+  let client, claimed = false, gateway, closed = false, outputBuffer = '', failed = false;
+  const decoder = new StringDecoder('utf8'), initializations = new Set();
+  let resolveConnected, resolveReady;
+  const connected = new Promise((resolve) => { resolveConnected = resolve; });
+  const ready = new Promise((resolve) => { resolveReady = resolve; });
+  const close = () => {
+    if (closed) return;
+    closed = true; clearTimeout(timer); gateway?.close(); input.destroy(); output.destroy();
+    client?.terminate(); wss.close(); server.close();
+    // This is the only child and filesystem tree owned by this launch.
+    child.kill?.('SIGTERM');
+    const killer = setTimeout(() => { if (child.exitCode == null && child.signalCode == null) child.kill?.('SIGKILL'); }, 1000);
+    killer.unref(); child.once?.('exit', () => clearTimeout(killer));
+    fs.rmSync(directory, { recursive: true, force: true }); resolveConnected(false); resolveReady(false);
+  };
+  const fail = () => {
+    if (closed) return;
+    failed = true; diagnostics.write(`[native-terminal-routing] ${REFUSED}\n`); close(); onFailure();
+  };
+  const output = new Writable({ highWaterMark: 65536, write(chunk, _encoding, callback) {
+    try {
+      outputBuffer += decoder.write(chunk);
+      if (Buffer.byteLength(outputBuffer) > maxBytes) throw new Error(REFUSED);
+      const lines = outputBuffer.split('\n'); outputBuffer = lines.pop();
+      let index = 0;
+      const send = () => {
+        if (index >= lines.length) { callback(); return; }
+        const line = lines[index++], packet = jsonPacket(line);
+        if (initializations.has(packet.id)) {
+          if (packet.error) throw new Error(REFUSED);
+          initializations.delete(packet.id); clearTimeout(timer); resolveReady(true);
+        }
+        if (closed || client?.readyState !== WebSocket.OPEN || client.bufferedAmount + Buffer.byteLength(line) > maxBytes) throw new Error(REFUSED);
+        client.send(line, { binary: false }, (error) => {
+          if (error) { callback(error); fail(); return; }
+          try { send(); } catch (error) { callback(error); fail(); }
+        });
+      };
+      send();
+    } catch (error) { callback(error); fail(); }
+  } });
+  output.on('error', fail); input.on('error', fail);
+  const timer = setTimeout(fail, startupMs);
+  server.on('error', fail); wss.on('error', fail);
+  server.on('upgrade', (request, socket, head) => {
+    // Refuse a second client for this launch, including reconnect after disconnect.
+    if (closed || claimed || request.url !== '/rpc' || request.headers.origin) {
+      socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); return;
+    }
+    claimed = true;
+    wss.handleUpgrade(request, socket, head, (ws) => wss.emit('connection', ws));
+  });
+  wss.on('connection', (ws) => {
+    client = ws;
+    gateway = connectNativeGateway({ ...gatewayOptions, harness: 'codex', child, input, output, diagnostics });
+    ws.on('message', (bytes, binary) => {
+      try {
+        if (binary || bytes.length > maxBytes || closed) throw new Error(REFUSED);
+        const line = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        const packet = jsonPacket(line);
+        if (packet.method === 'initialize' && Object.hasOwn(packet, 'id')) initializations.add(packet.id);
+        // Shared daemon ownership never crosses this per-client boundary.
+        if (['shutdown', 'exit'].includes(packet.method)) {
+          if (Object.hasOwn(packet, 'id')) ws.send(JSON.stringify({ id: packet.id, error: { code: -32001, message: 'Shared daemon shutdown refused' } }));
+          return;
+        }
+        if (gateway.spoolState().queuedBytes + input.writableLength + Buffer.byteLength(line) + 1 > maxBytes) throw new Error(REFUSED);
+        if (!input.write(JSON.stringify(packet) + '\n')) ws.pause();
+      } catch { fail(); }
+    });
+    input.on('drain', () => { if (!closed) ws.resume(); });
+    ws.once('close', close); ws.on('error', fail); resolveConnected(true);
+  });
+  child.once('error', fail); child.once('exit', fail);
+  child.stdin.on('error', fail); child.stdout.on('error', fail);
+  try {
+    await new Promise((resolve, reject) => {
+      server.once('error', reject); server.listen(socketPath, () => { server.removeListener('error', reject); resolve(); });
+    });
+    if (closed) throw new Error(REFUSED);
+    fs.chmodSync(socketPath, 0o600);
+  } catch (error) { close(); throw error; }
+  return { socketPath, directory, remote: `unix://${socketPath}`, connected, ready, close,
+    failed: () => failed, gateway: () => gateway };
+}
+
+export function parseTerminalInvocation(argv, env = process.env) {
+  const args = [...argv]; let realBinary = env.MODEL_ROUTER_REAL_CODEX, upstreamSocket;
+  while (args.length && args[0] !== '--') {
+    const flag = args.shift();
+    if (!['--real-binary', '--upstream-socket'].includes(flag) || !args.length) throw new Error('Explicit terminal gateway options required');
+    if (flag === '--real-binary') realBinary = args.shift(); else upstreamSocket = args.shift();
+  }
+  if (args[0] === '--') args.shift();
+  return { realBinary, upstreamSocket, args, env };
+}
+
+export async function runTerminalGateway({ realBinary, upstreamSocket, args = [], env = process.env,
+  spawnNative = spawn, adaptProxy = connectProxyWebSocket, gatewayOptions = {}, startupMs = 10000, tempRoot,
+  signalSource = process, diagnostics = process.stderr } = {}) {
+  if (!path.isAbsolute(realBinary || '')) throw new Error('Explicit absolute native executable required');
+  const binary = fs.realpathSync(realBinary), clean = subscriptionEnvironment(env);
+  if (env.MODEL_ROUTER_TERMINAL_ACTIVE || env.MODEL_ROUTER_GATEWAY_ACTIVE) throw new Error('Terminal routing recursion refused');
+  const mode = classifyTerminalArguments(args);
+  if (mode === 'admin') {
+    const child = spawnNative(binary, args, { env: clean, shell: false, stdio: 'inherit' });
+    return await exitOf(child);
+  }
+  const defaultTempRoot = terminalTempRoot();
+  tempRoot ??= defaultTempRoot;
+  // Reuse the established provider/config guards; this does not spawn app-server.
+  const normalized = nativeGatewayLaunch({ harness: 'codex', realBinary: binary, args: ['app-server', ...args], env: clean });
+  // Native global options precede the original subcommand/prompt, including a literal '--'.
+  const standardOverrides = normalized.args.slice(args.length + 1);
+  const socketPath = validateUpstreamSocket(upstreamSocket || path.join(clean.CODEX_HOME || path.join(os.homedir(), '.codex'), 'app-server-control', 'app-server-control.sock'));
+  const auth = () => assertSubscriptionAuth('codex', { env: clean }); auth();
+  clean.MODEL_ROUTER_TERMINAL_ACTIVE = '1';
+  const proxy = spawnNative(binary, ['app-server', 'proxy', '--sock', socketPath], { env: clean, shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
+  let tui, transport, forcedFailure = false;
+  const handlers = new Map();
+  try {
+    const backend = await adaptProxy(proxy, { startupMs });
+    transport = await createTerminalTransport({ child: backend, diagnostics, startupMs, tempRoot,
+      onFailure: () => { forcedFailure = true; tui?.kill('SIGTERM'); },
+      gatewayOptions: { ...gatewayOptions, checkAuth: auth,
+        decide: gatewayOptions.decide || ((prompt, harness, metadata) => decideNativeTurn(prompt, harness, { env: clean, ...metadata })) } });
+    if (transport.failed()) throw new Error(REFUSED);
+    tui = spawnNative(binary, ['--remote', transport.remote, ...standardOverrides, ...args], { env: clean, shell: false, stdio: 'inherit' });
+    for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+      const handler = () => { transport.close(); tui.kill(signal); };
+      handlers.set(signal, handler); signalSource.on(signal, handler);
+    }
+    const result = await exitOf(tui);
+    return forcedFailure ? { code: 1, signal: null } : result;
+  } finally {
+    handlers.forEach((handler, signal) => signalSource.removeListener(signal, handler));
+    if (transport) transport.close(); else proxy.kill('SIGTERM');
+  }
+}
+
+function exitOf(child) {
+  return new Promise((resolve, reject) => {
+    child.once('error', reject); child.once('exit', (code, signal) => resolve({ code, signal }));
+  });
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  runTerminalGateway(parseTerminalInvocation(process.argv.slice(2))).then(({ code, signal }) => {
+    if (signal) { process.removeAllListeners(signal); process.kill(process.pid, signal); }
+    else process.exitCode = code ?? 1;
+  }).catch((error) => { process.stderr.write(`[native-terminal-routing] ${error.message}\n`); process.exitCode = 1; });
+}