sneakoscope 7.0.0 → 7.0.3

package/dist/core/subagents/official-subagent-config.js

@@ -10,12 +10,6 @@ export const DEFAULT_OFFICIAL_SUBAGENT_MAX_DEPTH = 1;
 export const DEFAULT_OFFICIAL_SUBAGENT_JOB_MAX_RUNTIME_SECONDS = 1200;
 export const DEFAULT_OFFICIAL_SUBAGENT_INTERRUPT_MESSAGE = true;
 export const LEGACY_SKS_MAX_THREAD_VALUES = Object.freeze([4, 5, 6]);
-/**
- * Merge the project-scoped Codex [agents] defaults without overriding explicit
- * project or inherited global values. Legacy 4/5/6 values migrate only when a
- * caller supplies concrete SKS ownership evidence (for example the generated
- * file inventory from the previous project manifest).
- */
 export function mergeOfficialSubagentConfig(text = '', opts = {}) {
     const source = String(text || '');
     if (!inspectToml(source).ok)
@@ -58,8 +52,6 @@ export async function readOfficialSubagentConfig(root, opts = {}) {
     const maxDepth = resolveLayeredValue(projectLayer.agents.max_depth, globalLayer.agents.max_depth, DEFAULT_OFFICIAL_SUBAGENT_MAX_DEPTH, positiveInteger);
     const jobMaxRuntimeSeconds = resolveLayeredValue(projectLayer.agents.job_max_runtime_seconds, globalLayer.agents.job_max_runtime_seconds, DEFAULT_OFFICIAL_SUBAGENT_JOB_MAX_RUNTIME_SECONDS, positiveInteger);
     const interruptMessage = resolveLayeredValue(projectLayer.agents.interrupt_message, globalLayer.agents.interrupt_message, DEFAULT_OFFICIAL_SUBAGENT_INTERRUPT_MESSAGE, booleanValue);
-    // Official Naruto admits only depth=1. Coerce higher values so they cannot
-    // contradict the launcher hard-enforcement or look "supported".
     const depthCoerced = maxDepth.value > 1;
     const warnings = depthCoerced
         ? [`official_subagent_max_depth_coerced_to_one:${maxDepth.value}:${maxDepth.source}`]

package/dist/core/subagents/official-subagent-preparation.js

@@ -16,6 +16,7 @@ import { SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_EVENT_LOG_FILENAME, SUBAGENT_PAREN
 import { sksPrefixedDollarCommand, unprefixedSksSkillName } from '../routes/dollar-prefix.js';
 import { withFileLock, tryWithFileLock } from '../locks/file-lock.js';
 import { updateCurrentIfMissionAndRun } from '../mission.js';
+import { HOST_CAPABILITY_HOOK_EVIDENCE_FILENAME, HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME, HOST_CAPABILITY_HOOK_PENDING_RUNTIME_FILENAME, HOST_CAPABILITY_HOOK_RUNTIME_FILENAME } from '../agent-bridge/host-capability-runtime.js';
 export const NARUTO_RESULT_SCHEMA = 'sks.naruto-subagent-workflow.v1';
 export const SUBAGENT_PLAN_FILENAME = 'subagent-plan.json';
 export const NARUTO_SUMMARY_FILENAME = 'naruto-summary.json';
@@ -128,8 +129,6 @@ async function prepareOfficialSubagentMissionLocked(input) {
         });
         return [name, {
                 ...config,
-                // Catalog TOML remains the spawn-type contract; dynamic decision records why
-                // this role maps onto the sealed four-profile matrix for this goal.
                 routed_model: decision.model,
                 routed_model_reasoning_effort: decision.model_reasoning_effort,
                 routed_model_policy: decision.model_selection_reason,
@@ -379,7 +378,11 @@ function officialSubagentPreparationTombstoneInventory(mode) {
                 'completion-proof.md',
                 'evidence-index.json',
                 'route-completion-contract.json',
-                'trust-report.json'
+                'trust-report.json',
+                HOST_CAPABILITY_HOOK_PENDING_RUNTIME_FILENAME,
+                HOST_CAPABILITY_HOOK_RUNTIME_FILENAME,
+                HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME,
+                HOST_CAPABILITY_HOOK_EVIDENCE_FILENAME
             ]
             : [])
     ];
@@ -937,8 +940,6 @@ function narutoEventRunIds(value) {
             }
         }
         catch {
-            // A torn incomplete line is not an identity claim. The admitted owner
-            // may reset it only after the live/terminal checks above pass.
         }
     }
     return uniqueStrings(values);

package/dist/core/subagents/official-subagent-prompt.js

@@ -64,6 +64,16 @@ Parent agent:
 - owns decomposition, integration, and final answer
 - do not do duplicate work already delegated
 
+Host capability policy:
+- use a host tool only when it is actually available in the project MCP inventory; do not infer availability from config text or duplicate host tool schemas
+- SQL-generation-only requests: call \`datasource_schema_context\` first, use only reported tables and columns, and may complete without \`datasource_query_readonly\`
+- actual data retrieval: call \`datasource_schema_context\`, generate one bounded parameterized SELECT/CTE, call \`datasource_query_readonly\`, and retain its receipt
+- spreadsheet create: \`spreadsheet_create\` -> \`spreadsheet_inspect\` -> optional one minimal \`spreadsheet_update\` -> \`spreadsheet_inspect\`
+- spreadsheet edit: \`spreadsheet_inspect\` -> one minimal \`spreadsheet_update\` -> \`spreadsheet_inspect\`
+- document delivery: editable source -> render -> artifact receipt
+- when a requested host capability is missing or unhealthy, return blocked proof; do not fabricate a fallback or success evidence
+- Slack delivery belongs to the ACAS runtime and is never a model tool
+
 Subagent rules:
 - use only Codex official subagent threads; do not launch shell workers, a custom scheduler, a worker pool, or model fanout
 - select the narrowest matching project custom agent by its description; the custom agent name is the spawn type
@@ -133,10 +143,29 @@ Final parent output:
   "verification": [
     { "name": "focused check", "status": "passed|not_applicable", "reason": "required when not_applicable" }
   ],
+  "artifacts": [
+    {
+      "path": "workspace-relative/verified-output.xlsx",
+      "kind": "spreadsheet",
+      "media_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+      "sha256": "sha256:<64 lowercase hex>",
+      "bytes": 1,
+      "role": "deliverable|scratch|temp|log"
+    }
+  ],
+  "capabilities_used": [
+    {
+      "id": "declared host capability id",
+      "status": "passed|failed",
+      "tool_names": ["actually called host tool"],
+      "receipt_sha256": "sha256:<64 lowercase hex>"
+    }
+  ],
   "blockers": []
 }
 - include one thread_outcomes row for every requested subagent; a SubagentStop event alone never proves success
 - if changed_files is non-empty, include at least one passed named check or a specifically justified not_applicable verification row
+- use empty artifacts/capabilities_used arrays when no host capability was used; SKS overwrites these fields with observed Codex JSONL evidence before persistence
 - keep completion summary and Honest Mode wording inside the JSON fields; do not add prose outside the object
 `.trim();
 }

package/dist/core/subagents/official-subagent-runner.js

@@ -1,10 +1,13 @@
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { runProcess } from '../fsx.js';
+import { randomId, runProcess, writeJsonAtomic } from '../fsx.js';
+import { missionDir } from '../mission.js';
 import { NARUTO_PARENT_EFFORT, NARUTO_PARENT_MODEL } from './model-policy.js';
 import { inspectCodexLbCliLaunchRecovery } from '../codex-control/codex-lb-launch-recovery.js';
 import { resolveOfficialCodexPackageRuntime } from '../codex-runtime/resolve-codex-runtime.js';
+import { withFileLock } from '../locks/file-lock.js';
+import { HOST_CAPABILITY_HOOK_PENDING_RUNTIME_FILENAME, HOST_CAPABILITY_MCP_SERVER, createHostCapabilityHookPendingRuntime, createHostCapabilityEventCollector, hostCapabilityCodexConfigArgs, inspectHostCapabilityRuntime, requestHostCapabilities } from '../agent-bridge/host-capability-runtime.js';
 export const OFFICIAL_SUBAGENT_WORKFLOW_SCHEMA = 'sks.subagent-workflow.v1';
 const OFFICIAL_SUBAGENT_CHILD_ENV_ALLOWLIST = Object.freeze([
     'HOME',
@@ -39,7 +42,14 @@ const OFFICIAL_SUBAGENT_CHILD_ENV_ALLOWLIST = Object.freeze([
     'CODEX_CI',
     'CODEX_MANAGED_BY_NPM',
     'CODEX_INTERNAL_ORIGINATOR',
-    'CODEX_SANDBOX_NETWORK_DISABLED'
+    'CODEX_SANDBOX_NETWORK_DISABLED',
+    'SKS_AGENT_MODE',
+    'ACAS_AGENT_SLUG',
+    'ACAS_AGENT_WORKSPACE',
+    'ALFREDO_AGENT_SOULS_FILE',
+    'ACAS_CHROME_PATH',
+    'ACAS_HTML_TO_PDF_ENGINE',
+    'ACAS_HTML_TO_PDF_ALLOW_CHROME_CLI_FALLBACK'
 ]);
 const SECRET_ENV_KEY_RE = /(?:api[_-]?key|token|secret|password|credential|authorization|cookie)/i;
 const SECRET_BEARING_ENV_KEYS = new Set([
@@ -66,12 +76,16 @@ export function codexAppSessionKey(env = process.env) {
 export function buildOfficialSubagentCodexArgs(input) {
     return [
         'exec',
+        '--json',
+        ...(input.workingDirectory ? ['-C', input.workingDirectory] : []),
         '-m', NARUTO_PARENT_MODEL,
         '-c', `model_reasoning_effort="${NARUTO_PARENT_EFFORT}"`,
         '-c', 'model_provider="openai"',
         '-c', 'forced_login_method="chatgpt"',
         '-c', `agents.max_threads=${Math.max(1, Math.floor(input.maxThreads))}`,
         '-c', 'agents.max_depth=1',
+        ...(input.projectConfigArgs || []),
+        ...(input.hostCapabilityConfigArgs || []),
         '--output-last-message', input.parentSummaryFile,
         input.prompt
     ];
@@ -87,8 +101,84 @@ export function buildOfficialSubagentChildEnv(input = {}) {
     childEnv.SKS_NARUTO_PARENT_LAUNCH = '1';
     if (input.missionId)
         childEnv.SKS_NARUTO_PARENT_MISSION_ID = input.missionId;
+    if (input.workflowRunId)
+        childEnv.SKS_NARUTO_PARENT_WORKFLOW_RUN_ID = input.workflowRunId;
+    if (input.hostCapabilityLaunchNonce) {
+        childEnv.SKS_NARUTO_PARENT_HOST_CAPABILITY_NONCE = input.hostCapabilityLaunchNonce;
+    }
     return childEnv;
 }
+export function hostCapabilityProjectCodexConfigArgs(input) {
+    const trustLevel = input.projectTrusted ? 'trusted' : 'untrusted';
+    return [
+        '-c', `projects={${JSON.stringify(input.canonicalRoot)}={trust_level="${trustLevel}"}}`,
+        ...(!input.projectTrusted && input.globalHostCapabilityConfigured
+            ? ['-c', `mcp_servers.${HOST_CAPABILITY_MCP_SERVER}.enabled=false`]
+            : [])
+    ];
+}
+async function inspectConfiguredGlobalHostCapabilityServer(input) {
+    const result = await runProcess(input.codexCommand, [
+        '-C', input.canonicalRoot,
+        ...hostCapabilityProjectCodexConfigArgs({
+            canonicalRoot: input.canonicalRoot,
+            projectTrusted: false
+        }),
+        'mcp', 'list', '--json'
+    ], {
+        cwd: input.canonicalRoot,
+        timeoutMs: 10_000,
+        maxOutputBytes: 1024 * 1024,
+        env: input.env,
+        envMode: 'replace'
+    }).catch(() => null);
+    if (!result || result.code !== 0 || result.timedOut || result.truncated) {
+        return { ok: false, present: false };
+    }
+    try {
+        const rows = JSON.parse(result.stdout);
+        if (!Array.isArray(rows))
+            return { ok: false, present: false };
+        return {
+            ok: true,
+            present: rows.some((row) => row && typeof row === 'object' && row.name === HOST_CAPABILITY_MCP_SERVER)
+        };
+    }
+    catch {
+        return { ok: false, present: false };
+    }
+}
+async function writeHostCapabilityPendingRuntime(input) {
+    try {
+        await withFileLock({
+            lockPath: path.join(input.dir, '.host-capability-hooks.lock'),
+            timeoutMs: 5_000,
+            staleMs: 60_000
+        }, async () => {
+            await fsp.rm(path.join(input.dir, HOST_CAPABILITY_HOOK_PENDING_RUNTIME_FILENAME), { force: true });
+            await writeJsonAtomic(path.join(input.dir, HOST_CAPABILITY_HOOK_PENDING_RUNTIME_FILENAME), createHostCapabilityHookPendingRuntime({
+                missionId: input.missionId,
+                workflowRunId: input.workflowRunId,
+                launchNonce: input.launchNonce,
+                runtime: input.runtime
+            }));
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function removeHostCapabilityPendingRuntime(dir) {
+    if (!dir)
+        return;
+    await withFileLock({
+        lockPath: path.join(dir, '.host-capability-hooks.lock'),
+        timeoutMs: 5_000,
+        staleMs: 60_000
+    }, () => fsp.rm(path.join(dir, HOST_CAPABILITY_HOOK_PENDING_RUNTIME_FILENAME), { force: true }))
+        .catch(() => undefined);
+}
 function knownInheritedSecretValues(env) {
     const source = { ...process.env, ...(env || {}) };
     return [...new Set(Object.entries(source)
@@ -102,7 +192,30 @@ function redactKnownValues(text, values) {
         redacted = redacted.split(value).join('<redacted>');
     return redacted;
 }
+function structuredValueContainsKnownValue(value, values) {
+    if (typeof value === 'string')
+        return values.some((secret) => value.includes(secret));
+    if (Array.isArray(value))
+        return value.some((item) => structuredValueContainsKnownValue(item, values));
+    if (!value || typeof value !== 'object')
+        return false;
+    return Object.values(value).some((item) => structuredValueContainsKnownValue(item, values));
+}
+function confineHostCapabilityEvidenceSecrets(evidence, secretValues) {
+    if (!structuredValueContainsKnownValue(evidence, secretValues))
+        return evidence;
+    const confined = createHostCapabilityEventCollector(evidence.runtime).finish();
+    return {
+        ...confined,
+        ok: false,
+        blockers: uniqueStrings([
+            ...confined.blockers,
+            'host_capability_evidence_secret_reflection'
+        ])
+    };
+}
 export async function runOfficialSubagentWorkflow(input) {
+    const hostCapabilityRequest = requestHostCapabilities(input.goal);
     const base = {
         schema: OFFICIAL_SUBAGENT_WORKFLOW_SCHEMA,
         workflow: 'official_codex_subagent',
@@ -111,50 +224,118 @@ export async function runOfficialSubagentWorkflow(input) {
         max_depth: 1,
         parent_model: NARUTO_PARENT_MODEL,
         parent_reasoning_effort: NARUTO_PARENT_EFFORT,
-        session_scope: input.sessionKey || null
+        session_scope: input.sessionKey || null,
+        host_capability_request: hostCapabilityRequest
     };
+    const hostCapabilityRuntime = await inspectHostCapabilityRuntime({
+        root: input.root,
+        request: hostCapabilityRequest,
+        projectTrusted: input.projectTrusted === true,
+        ...(input.hostCapabilityDependencies ? { dependencies: input.hostCapabilityDependencies } : {})
+    });
     if (input.appSession) {
+        if (hostCapabilityRequest.capability_ids.length > 0 && !input.sessionKey) {
+            return {
+                ...base,
+                ok: false,
+                status: 'host_capability_blocked',
+                prepared: false,
+                additionalContext: null,
+                host_capability_runtime: hostCapabilityRuntime,
+                blockers: ['host_capability_session_scope_missing'],
+                completion_evidence: false,
+                note: 'Requested host capabilities cannot be safely bound without the current Codex session identity.'
+            };
+        }
+        if (!hostCapabilityRuntime.ok) {
+            return {
+                ...base,
+                ok: false,
+                status: 'host_capability_blocked',
+                prepared: false,
+                additionalContext: null,
+                host_capability_runtime: hostCapabilityRuntime,
+                blockers: hostCapabilityRuntime.blockers,
+                completion_evidence: false,
+                note: 'Requested project-scoped host capabilities are missing or unhealthy. No runnable delegation context was returned.'
+            };
+        }
         return {
             ...base,
             ok: false,
             status: 'delegation_context_ready',
             prepared: true,
             additionalContext: input.prompt,
+            host_capability_runtime: hostCapabilityRuntime,
             completion_evidence: false,
             note: 'The current Codex parent must spawn and await the official subagents. Preparation is not completion evidence.'
         };
     }
-    const childEnv = buildOfficialSubagentChildEnv({
-        ...(input.env ? { env: input.env } : {}),
-        ...(input.missionId ? { missionId: input.missionId } : {})
-    });
     const inheritedSecretValues = knownInheritedSecretValues(input.env);
     const parentSummaryFile = path.join(os.tmpdir(), `sks-naruto-parent-summary-${process.pid}-${Date.now()}.txt`);
-    const args = buildOfficialSubagentCodexArgs({
-        prompt: input.prompt,
-        maxThreads: input.maxThreads,
-        parentSummaryFile
-    });
-    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
-        root: input.root,
-        env: childEnv,
-        cliArgs: args.slice(0, -1)
-    });
-    if (!toolOutputRecovery.ok) {
+    const hostCapabilityCollector = createHostCapabilityEventCollector(hostCapabilityRuntime);
+    if (!hostCapabilityRuntime.ok) {
+        const hostCapabilityEvidence = hostCapabilityCollector.finish();
         return {
             ...base,
             ok: false,
-            status: 'tool_output_recovery_blocked',
+            status: 'host_capability_blocked',
             prepared: false,
             codex_exit_code: null,
             parent_summary: null,
             parent_summary_file: null,
-            tool_output_recovery: toolOutputRecovery,
-            blockers: toolOutputRecovery.blockers,
-            operator_actions: toolOutputRecovery.operator_actions,
+            host_capability_runtime: hostCapabilityRuntime,
+            host_capability_evidence: hostCapabilityEvidence,
+            blockers: hostCapabilityEvidence.blockers,
             completion_evidence: false
         };
     }
+    const canonicalRoot = await fsp.realpath(input.root).catch(() => null);
+    if (!canonicalRoot) {
+        return {
+            ...base,
+            ok: false,
+            status: 'trusted_runtime_blocked',
+            prepared: false,
+            codex_exit_code: null,
+            parent_summary: null,
+            parent_summary_file: null,
+            host_capability_runtime: hostCapabilityRuntime,
+            host_capability_evidence: hostCapabilityCollector.finish(),
+            blockers: ['host_capability_project_root_realpath_failed'],
+            completion_evidence: false
+        };
+    }
+    let hostCapabilityLaunchNonce = null;
+    let hostCapabilityPendingDir = null;
+    if (hostCapabilityRequest.capability_ids.length > 0) {
+        if (!input.missionId || !input.workflowRunId) {
+            return {
+                ...base,
+                ok: false,
+                status: 'host_capability_blocked',
+                prepared: false,
+                codex_exit_code: null,
+                parent_summary: null,
+                parent_summary_file: null,
+                host_capability_runtime: hostCapabilityRuntime,
+                host_capability_evidence: hostCapabilityCollector.finish(),
+                blockers: ['host_capability_parent_binding_identity_missing'],
+                completion_evidence: false
+            };
+        }
+        hostCapabilityLaunchNonce = randomId(32);
+        hostCapabilityPendingDir = missionDir(canonicalRoot, input.missionId);
+    }
+    const childEnv = buildOfficialSubagentChildEnv({
+        ...(input.env ? { env: input.env } : {}),
+        ...(input.missionId ? { missionId: input.missionId } : {}),
+        ...(input.workflowRunId ? { workflowRunId: input.workflowRunId } : {}),
+        ...(hostCapabilityLaunchNonce ? { hostCapabilityLaunchNonce } : {})
+    });
+    const outputSecretValues = hostCapabilityLaunchNonce
+        ? [...inheritedSecretValues, hostCapabilityLaunchNonce]
+        : inheritedSecretValues;
     let codexCommand;
     if (input.runProcessImpl) {
         codexCommand = input.codexBin || 'codex';
@@ -169,7 +350,8 @@ export async function runOfficialSubagentWorkflow(input) {
                 codex_exit_code: null,
                 parent_summary: null,
                 parent_summary_file: null,
-                tool_output_recovery: toolOutputRecovery,
+                host_capability_runtime: hostCapabilityRuntime,
+                host_capability_evidence: hostCapabilityCollector.finish(),
                 blockers: ['codex_parent_executable_override_forbidden'],
                 completion_evidence: false
             };
@@ -184,23 +366,108 @@ export async function runOfficialSubagentWorkflow(input) {
                 codex_exit_code: null,
                 parent_summary: null,
                 parent_summary_file: null,
-                tool_output_recovery: toolOutputRecovery,
+                host_capability_runtime: hostCapabilityRuntime,
+                host_capability_evidence: hostCapabilityCollector.finish(),
                 blockers: [...runtime.blockers],
                 completion_evidence: false
             };
         }
         codexCommand = runtime.identity.realpath;
     }
+    let globalHostCapabilityConfigured = false;
+    if (input.projectTrusted !== true && !input.runProcessImpl) {
+        const configured = await inspectConfiguredGlobalHostCapabilityServer({
+            codexCommand,
+            canonicalRoot,
+            env: childEnv
+        });
+        if (!configured.ok) {
+            return {
+                ...base,
+                ok: false,
+                status: 'trusted_runtime_blocked',
+                prepared: false,
+                codex_exit_code: null,
+                parent_summary: null,
+                parent_summary_file: null,
+                host_capability_runtime: hostCapabilityRuntime,
+                host_capability_evidence: hostCapabilityCollector.finish(),
+                blockers: ['host_capability_global_config_probe_failed'],
+                completion_evidence: false
+            };
+        }
+        globalHostCapabilityConfigured = configured.present;
+    }
+    const args = buildOfficialSubagentCodexArgs({
+        prompt: input.prompt,
+        maxThreads: input.maxThreads,
+        parentSummaryFile,
+        workingDirectory: canonicalRoot,
+        projectConfigArgs: hostCapabilityProjectCodexConfigArgs({
+            canonicalRoot,
+            projectTrusted: input.projectTrusted === true,
+            globalHostCapabilityConfigured
+        }),
+        hostCapabilityConfigArgs: hostCapabilityCodexConfigArgs(hostCapabilityRuntime)
+    });
+    const toolOutputRecovery = await inspectCodexLbCliLaunchRecovery({
+        root: input.root,
+        env: childEnv,
+        cliArgs: args.slice(0, -1)
+    });
+    if (!toolOutputRecovery.ok) {
+        return {
+            ...base,
+            ok: false,
+            status: 'tool_output_recovery_blocked',
+            prepared: false,
+            codex_exit_code: null,
+            parent_summary: null,
+            parent_summary_file: null,
+            host_capability_runtime: hostCapabilityRuntime,
+            host_capability_evidence: hostCapabilityCollector.finish(),
+            tool_output_recovery: toolOutputRecovery,
+            blockers: toolOutputRecovery.blockers,
+            operator_actions: toolOutputRecovery.operator_actions,
+            completion_evidence: false
+        };
+    }
     await fsp.mkdir(path.dirname(parentSummaryFile), { recursive: true });
+    if (hostCapabilityPendingDir && hostCapabilityLaunchNonce && input.missionId && input.workflowRunId) {
+        const prepared = await writeHostCapabilityPendingRuntime({
+            dir: hostCapabilityPendingDir,
+            missionId: input.missionId,
+            workflowRunId: input.workflowRunId,
+            launchNonce: hostCapabilityLaunchNonce,
+            runtime: hostCapabilityRuntime
+        });
+        if (!prepared) {
+            return {
+                ...base,
+                ok: false,
+                status: 'host_capability_blocked',
+                prepared: false,
+                codex_exit_code: null,
+                parent_summary: null,
+                parent_summary_file: null,
+                host_capability_runtime: hostCapabilityRuntime,
+                host_capability_evidence: hostCapabilityCollector.finish(),
+                tool_output_recovery: toolOutputRecovery,
+                blockers: ['host_capability_pending_runtime_write_failed'],
+                completion_evidence: false
+            };
+        }
+    }
     const execute = input.runProcessImpl || runProcess;
     let processResult;
     try {
         processResult = await execute(codexCommand, args, {
-            cwd: input.root,
+            cwd: canonicalRoot,
             timeoutMs: input.timeoutMs || 60 * 60 * 1000,
             maxOutputBytes: 256 * 1024,
             env: childEnv,
             envMode: 'replace',
+            onStdout: hostCapabilityCollector.push,
             ...(input.onChildSpawn ? { onSpawn: input.onChildSpawn } : {})
         });
     }
@@ -215,33 +482,79 @@ export async function runOfficialSubagentWorkflow(input) {
             timedOut: false
         };
     }
-    const parentSummary = redactKnownValues(await fsp.readFile(parentSummaryFile, 'utf8').catch(() => ''), inheritedSecretValues);
+    finally {
+        await removeHostCapabilityPendingRuntime(hostCapabilityPendingDir);
+    }
+    const parentSummary = redactKnownValues(await fsp.readFile(parentSummaryFile, 'utf8').catch(() => ''), outputSecretValues);
     await fsp.rm(parentSummaryFile, { force: true }).catch(() => undefined);
-    const stdout = redactKnownValues(processResult.stdout, inheritedSecretValues);
-    const stderr = redactKnownValues(processResult.stderr, inheritedSecretValues);
-    const blockers = processResult.spawnRegistrationFailed === true
-        ? ['codex_parent_spawn_registration_failed']
-        : processResult.timedOut
-            ? ['codex_parent_timeout']
-            : processResult.code === 0
-                ? []
-                : ['codex_parent_exit:' + String(processResult.code ?? 'unknown')];
+    const hostCapabilityEvidence = confineHostCapabilityEvidenceSecrets(hostCapabilityCollector.finish(processResult.stdout), outputSecretValues);
+    const stdout = summarizeCodexJsonlOutput(processResult.stdout, outputSecretValues);
+    const stderr = redactKnownValues(processResult.stderr, outputSecretValues).slice(-12_000);
+    const blockers = uniqueStrings([
+        ...(processResult.spawnRegistrationFailed === true
+            ? ['codex_parent_spawn_registration_failed']
+            : processResult.timedOut
+                ? ['codex_parent_timeout']
+                : processResult.code === 0
+                    ? []
+                    : ['codex_parent_exit:' + String(processResult.code ?? 'unknown')]),
+        ...hostCapabilityEvidence.blockers
+    ]);
+    const ok = processResult.code === 0 && hostCapabilityEvidence.ok;
+    const status = processResult.code !== 0
+        ? 'parent_failed'
+        : hostCapabilityEvidence.ok
+            ? 'parent_completed'
+            : 'host_capability_blocked';
     return {
         ...base,
-        ok: processResult.code === 0,
-        status: processResult.code === 0 ? 'parent_completed' : 'parent_failed',
+        ok,
+        status,
         codex_exit_code: processResult.code,
         parent_summary: parentSummary.trim() || null,
         parent_summary_file: null,
         blockers,
+        host_capability_runtime: hostCapabilityRuntime,
+        host_capability_evidence: hostCapabilityEvidence,
         tool_output_recovery: toolOutputRecovery,
         process: {
             pid: processResult.pid || null,
             timed_out: processResult.timedOut,
-            stdout_tail: stdout,
+            stdout_tail: stdout.tail,
             stderr_tail: stderr,
+            jsonl_event_count: stdout.event_count,
+            jsonl_event_types: stdout.event_types,
             output_truncated: processResult.truncated
         },
         completion_evidence: false
     };
 }
+function summarizeCodexJsonlOutput(text, secretValues) {
+    const redacted = redactKnownValues(String(text || ''), secretValues);
+    const eventTypes = [];
+    let eventCount = 0;
+    for (const line of redacted.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const parsed = JSON.parse(trimmed);
+            eventCount += 1;
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                const type = String(parsed.type || '').trim();
+                if (type)
+                    eventTypes.push(type);
+            }
+            continue;
+        }
+        catch { }
+    }
+    return {
+        tail: '',
+        event_count: eventCount,
+        event_types: uniqueStrings(eventTypes)
+    };
+}
+function uniqueStrings(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))].sort();
+}