tickmarkr 2.8.4 → 2.8.6

package/dist/adapters/claude-code.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, declareInputBox, MODEL_ID_RE, promptFitsArgv, shq, TokenUsageSchema } from "./types.js";
 // SPEND-01/SPEND-11: claude writes a per-session JSONL to ~/.claude/projects/<slug>/ where slug is the
@@ -188,7 +189,7 @@ export function probeClaudeAliasIdentity(cwd, alias) {
             "--strict-mcp-config",
             "--mcp-config", '{"mcpServers":{}}',
             "--output-format", "text",
-        ], { cwd, encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"] });
+        ], { cwd, encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"], env: withoutHostSession() });
         if (r.error || r.status !== 0)
             return undefined;
         const identity = (r.stdout || "").trim();
@@ -202,7 +203,7 @@ export function resolveClaudeAliasIdentity(cwd, alias, probe = probeClaudeAliasI
     return readClaudeAliasIdentity(cwd, alias) ?? probe(cwd, alias);
 }
 export function probeVersion(bin) {
-    const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 10000 });
+    const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 10000, env: withoutHostSession() });
     if (r.error || r.status !== 0)
         return { installed: false, authed: false, models: [] };
     return {

package/dist/adapters/codex-commit-check.d.ts

@@ -10,6 +10,7 @@ export interface CodexCommitProbe {
     hostileRoot: string;
     token: string;
     signal?: AbortSignal;
+    repoRoot?: string;
 }
 /** Runs the probe script inside the Codex sandbox and resolves its stdout. Injected in tests. */
 export type CodexSandbox = (probe: CodexCommitProbe) => Promise<string>;
@@ -17,10 +18,10 @@ export interface CodexCommitResult {
     status: CodexCommitStatus;
     detail: string;
 }
-/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
+/** Queue row 2 (D-2112, D-2114): the fixture uses the same literal grant as a worker. */
 export declare const codexSandboxArgs: (p: CodexCommitProbe, grant?: string) => string[];
-/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
-export declare const codexSandboxFor: (grant: string) => CodexSandbox;
+/** Queue row 2 (D-2112): tests may supply a mutant; production renders each fixture. */
+export declare const codexSandboxFor: (grant?: string) => CodexSandbox;
 export declare const codexSandbox: CodexSandbox;
 export declare function probeCodexCommit(repoRoot: string, sandbox?: CodexSandbox, signal?: AbortSignal): Promise<CodexCommitResult>;
 /** A persisted verdict outside the closed table (an older or newer doctor.json) reads unknown, never allowed. */

package/dist/adapters/codex-commit-check.js

@@ -4,18 +4,20 @@ import { existsSync, mkdtempSync, readFileSync, rmdirSync, rmSync } from "node:f
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
-import { assertGitTrust, GitTrustRefusal, protectedGitEnv } from "../run/git-trust.js";
-import { CODEX_GIT_GRANT, codex } from "./codex.js";
+import { assertGitTrust, GitTrustRefusal } from "../run/git-trust.js";
+import { shGitOk } from "../run/git.js";
+import { withoutHostSession } from "../drivers/host-env.js";
+import { renderCodexGitGrant, codex } from "./codex.js";
 import { shq } from "./types.js";
 const exec = promisify(execFile);
-const git = async (cwd, ...args) => (await exec("git", args, { cwd })).stdout.trim();
-// v2.6.7 T4: host git after the sandbox has had the fixture — validation and cleanup — runs the uncached trust
-// check and the forced child config on every call, so seat-rewritten metadata can neither run a config program
-// nor answer for the probe's commit.
-const hostGit = async (cwd, ...args) => {
-    assertGitTrust(cwd);
-    return (await exec("git", args, { cwd, env: protectedGitEnv(process.env) })).stdout.trim();
-};
+// v2.6.7 T4 → queue row 2 item b (D-2112): every fixture git — setup, validation and cleanup — is tickmarkr's own git
+// (shGitOk): the uncached trust check, the forced inert fsmonitor and hooks and, in a linked checkout, the pin, so
+// seat-rewritten metadata can neither run a config program or hook nor answer for the probe's commit. A trust refusal
+// rejects with GitTrustRefusal naming the path and is reported as an unknown verdict, never folded into another answer.
+const hostGit = async (cwd, args, own) => (await shGitOk(["git", ...args].map(shq).join(" "), cwd, own)).trim();
+/** An ordinary git failure is `fallback`; a trust refusal propagates. */
+const unlessRefused = (fallback) => (error) => { if (error instanceof GitTrustRefusal)
+    throw error; return fallback; };
 /** The fixture checkout's trust after the sandbox returned or threw: a refusal is reported with its path. */
 const fixtureRefusal = (worktree) => {
     try {
@@ -34,14 +36,14 @@ const SCRIPT = `printf %s "$2" > "$1" && echo control=ok || echo control=fail
 git add -- "$1" && git -c core.hooksPath=/dev/null -c core.logAllRefUpdates=true -c commit.gpgsign=false -c user.name=tickmarkr -c user.email=probe@tickmarkr.invalid commit -q -m "tickmarkr-probe $2" && echo commit=ok || echo commit=fail
 (set -C; printf %s "$2" > "$3") 2>/dev/null && echo hook=written || echo hook=denied
 (set -C; printf %s "$2" > "$4") 2>/dev/null && echo root=written || echo root=denied`;
-/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
-export const codexSandboxArgs = (p, grant = CODEX_GIT_GRANT) => [
+/** Queue row 2 (D-2112, D-2114): the fixture uses the same literal grant as a worker. */
+export const codexSandboxArgs = (p, grant = renderCodexGitGrant({ cwd: p.worktree, branch: p.branch, repoRoot: p.repoRoot ?? p.commonDir })) => [
     "-c",
     `codex sandbox -c 'sandbox_mode="workspace-write"' ${grant} -- sh -c ${shq(SCRIPT)} sh ${[p.control, p.token, p.hostileHook, p.hostileRoot].map(shq).join(" ")}`,
 ];
-/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
-export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal })).stdout;
-export const codexSandbox = codexSandboxFor(CODEX_GIT_GRANT);
+/** Queue row 2 (D-2112): tests may supply a mutant; production renders each fixture. */
+export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal, env: withoutHostSession() })).stdout;
+export const codexSandbox = codexSandboxFor();
 const holds = (path, token) => {
     try {
         return readFileSync(path, "utf8") === token;
@@ -66,18 +68,28 @@ const contradictory = (out) => {
     }
     return false;
 };
-const tipOf = async (repo, ref) => hostGit(repo, "rev-parse", "--verify", "--quiet", `${ref}^{commit}`).catch(() => undefined);
+const tipOf = async (repo, ref) => hostGit(repo, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).catch(unlessRefused(undefined));
 // This probe's commit and nothing else: one parent (the fixture base), its token in the subject and the control.
 const isProbeCommit = async (repo, commit, base, token) => {
     try {
-        return await hostGit(repo, "log", "-1", "--format=%P %s", commit) === `${base} tickmarkr-probe ${token}`
-            && await hostGit(repo, "cat-file", "blob", `${commit}:${CONTROL}`) === token;
+        return await hostGit(repo, ["log", "-1", "--format=%P %s", commit]) === `${base} tickmarkr-probe ${token}`
+            && await hostGit(repo, ["cat-file", "blob", `${commit}:${CONTROL}`]) === token;
     }
-    catch {
-        return false;
+    catch (e) {
+        return unlessRefused(false)(e);
     }
 };
 export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal) {
+    // queue row 2 item b: cleanup stays best effort for ordinary git failures, but a trust refusal there is never
+    // folded into the verdict already reached — it is reported as unknown naming its path (an escape still dominates)
+    let refusal;
+    const result = await probeFixture(repoRoot, sandbox, signal, (e) => { refusal ??= e; });
+    return refusal && result.status !== "escape" ? unknown(`fixture git refused (${refusal.message})`) : result;
+}
+async function probeFixture(repoRoot, sandbox, signal, refused) {
+    /** A cleanup git's ordinary failure is `fallback`; its trust refusal is reported to the caller, then `fallback`. */
+    const cleanup = (fallback) => (e) => { if (e instanceof GitTrustRefusal)
+        refused(e); return fallback; };
     const token = randomUUID();
     const parent = mkdtempSync(join(tmpdir(), "tickmarkr-codex-commit-"));
     // git names the fixture's metadata directory after the checkout's basename; a unique one makes that
@@ -90,21 +102,22 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
     let hostile = [];
     let sandboxed = false;
     try {
-        const commonDir = await git(repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
+        const commonDir = await hostGit(repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
         lock = join(commonDir, "worktrees", basename(worktree), "index.lock");
         const hostileHook = join(commonDir, "hooks", branch), hostileRoot = join(commonDir, branch);
         hostile = [hostileHook, hostileRoot];
         if (hostile.some((m) => existsSync(m)))
             return unknown("a foreign file already holds a hostile probe path");
-        base = await git(repoRoot, "rev-parse", "--verify", "HEAD^{commit}");
-        await git(repoRoot, "worktree", "add", "-b", branch, worktree, base);
-        if (join(await git(worktree, "rev-parse", "--absolute-git-dir"), "index.lock") !== lock)
+        base = await hostGit(repoRoot, ["rev-parse", "--verify", "HEAD^{commit}"]);
+        // the add declares the branch capability: a result refused after its child ran is rolled back (checkout and branch)
+        await hostGit(repoRoot, ["worktree", "add", "-b", branch, worktree, base], { createsWorktree: "branch", rollback: { dir: worktree, branch: { name: branch } } });
+        if (join(await hostGit(worktree, ["rev-parse", "--absolute-git-dir"]), "index.lock") !== lock)
             return unknown("the fixture worktree metadata is not where git was expected to put it");
         const control = join(worktree, CONTROL);
         if (existsSync(lock))
             return unknown("a foreign index.lock already holds the fixture worktree");
         sandboxed = true;
-        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal });
+        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal, repoRoot });
         // An escape on disk dominates; every other verdict needs consistent receipts AND disk — and trusted metadata.
         const escape = escaped(hostile, token);
         if (escape)
@@ -144,6 +157,8 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         const refused = sandboxed ? fixtureRefusal(worktree) : undefined;
         if (refused)
             return refused;
+        if (e instanceof GitTrustRefusal)
+            return unknown(`fixture git refused (${e.message})`);
         return unknown(signal?.aborted ? "probe cancelled" : `probe did not run (${(e instanceof Error ? e.message : String(e)).split("\n")[0]})`);
     }
     finally {
@@ -158,7 +173,7 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         // prune — that would take an earlier probe's preserved foreign lock (or anyone's prunable worktree).
         const foreign = lock !== undefined && existsSync(lock);
         if (lock && !foreign) {
-            await hostGit(repoRoot, "worktree", "remove", "--force", worktree).catch(() => undefined);
+            await hostGit(repoRoot, ["worktree", "remove", "--force", worktree]).catch(cleanup(undefined));
             // a failed `worktree add` leaves metadata git no longer removes by path: drop this probe's own directory
             rmSync(dirname(lock), { recursive: true, force: true });
             try {
@@ -169,9 +184,9 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         // The fixture branch and its reflog go only while the tip is still this probe's (the base or its own
         // commit), and update-ref's old-value check refuses if anyone moves it between this read and the delete.
         // Metadata preserved for a foreign lock keeps its branch too: that checkout's HEAD still names it.
-        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref);
-        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token))) {
-            await hostGit(repoRoot, "update-ref", "-d", ref, tip).catch(() => undefined);
+        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref).catch(cleanup(undefined));
+        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token).catch(cleanup(false)))) {
+            await hostGit(repoRoot, ["update-ref", "-d", ref, tip]).catch(cleanup(undefined));
         }
         rmSync(parent, { recursive: true, force: true });
     }

package/dist/adapters/codex.d.ts

@@ -1,11 +1,11 @@
-import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
+import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter, type WorkerLaunchContext } from "./types.js";
 export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
     hidden?: string[];
 };
-export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=${tkr_common%?/} && tkr_gitdir=${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=${tkr_head%/*};; (*) tkr_leaf=;; esac && [ \"$(printf %s \"$tkr_common$tkr_gitdir$tkr_leaf\" | LC_ALL=C tr -d '\\0-\\37\\177\"\\\\')\" = \"$tkr_common$tkr_gitdir$tkr_leaf\" ] && { [ \"$tkr_gitdir\" = \"$tkr_common\" ] || printf '\"%s\",' \"$tkr_gitdir\"; } && printf '\"%s/objects\"' \"$tkr_common\" && { [ -z \"$tkr_leaf\" ] || printf ',\"%s/%s\",\"%s/logs/%s\"' \"$tkr_common\" \"$tkr_leaf\" \"$tkr_common\" \"$tkr_leaf\"; })]\"";
+export declare function renderCodexGitGrant(ctx?: Partial<WorkerLaunchContext>): string;
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;

package/dist/adapters/codex.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { checkedAuthority } from "../run/git-trust.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, declareInputBox, MODEL_ID_RE, promptFitsArgv, shq, TokenUsageSchema } from "./types.js";
@@ -100,32 +101,37 @@ function codexRetirement(upgrade) {
     // the successor id comes from an external file and is rendered in lints — same charset gate as slugs
     return typeof u.model === "string" && MODEL_ID_RE.test(u.model) ? { retiresAt: u.retirement_at, successor: u.model } : undefined;
 }
-// tickmarkr worktrees keep their gitdir under the MAIN repo's .git/worktrees/<name> — outside the
-// workspace-write sandbox root — so git commit dies on index.lock (incident run-20260709-104447
-// P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the launching shell at the
-// worktree cwd, for Codex WORKERS only: v2.6.7 T4 (D-1046) — invoke() (the headless worker form, including
-// the interactive size fallback) and interactiveCommand carry it; headlessCommand, which judge, review,
-// consult and the model probe launch, carries no writable_roots at all (those seats never commit).
-// v2.6.6 T9 (K, D-912) → v2.8.0 T1 (rows 17/18, D-910): the grant is a LEAF of what a linked-worktree branch
-// commit writes, never the shared hooks/config (the shipped [common] and D-910's [common, gitdir] let a seat
-// write <common>/hooks and <common>/config, which unsandboxed git later runs) and never whole common/refs and
-// common/logs (which let a seat move main, any branch or tag, or the stash). The closed root table, in order:
-//   - the worktree's own gitdir, only when it differs from the common dir (an ordinary checkout gets none);
-//   - <common>/objects;
-//   - only when HEAD is a symbolic ref refs/heads/<B>: <common>/refs/heads/<D> and <common>/logs/refs/heads/<D>,
-//     <D> being <B> without its last slash-separated segment (refs/heads itself when <B> holds no slash);
-//     a detached HEAD gets no refs or reflog root.
-// A directory outside any repository, any failed git read, or any root holding a character of the closed
-// forbidden set (U+0000 to U+001F, U+007F DEL, the double quote, the backslash) yields the EMPTY array `[]`:
-// no git write root, so a commit fails closed — never a partial array, an escaped string or codex's
-// literal-string fallback. Every emitted root is therefore a TOML basic string that parses back to the exact
-// path (git's own trailing newline is stripped through a sentinel, never a path's). No common-root fallback;
-// packed-refs is not granted (packed-ref ops fail closed); stash, tags, notes and branches outside the leaf
-// are denied. Declared (queue row 151): sibling refs in the same leaf (other task branches, the run's integration
-// branch under the default prefix) stay writable; since 2.8.1 a write to the integration ref parks the merge and is
-// never published.
-// doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
-export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=\${tkr_common%?/} && tkr_gitdir=\${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=\${tkr_head%/*};; (*) tkr_leaf=;; esac && [ "$(printf %s "$tkr_common$tkr_gitdir$tkr_leaf" | LC_ALL=C tr -d '\\0-\\37\\177"\\\\')" = "$tkr_common$tkr_gitdir$tkr_leaf" ] && { [ "$tkr_gitdir" = "$tkr_common" ] || printf '"%s",' "$tkr_gitdir"; } && printf '"%s/objects"' "$tkr_common" && { [ -z "$tkr_leaf" ] || printf ',"%s/%s","%s/logs/%s"' "$tkr_common" "$tkr_leaf" "$tkr_common" "$tkr_leaf"; })]"`;
+// Queue row 2 item a (D-2112, D-2114): tickmarkr renders literal roots from the checked authority,
+// never a launch-shell git lookup. The worker's common dir must be the run repository's trusted one.
+// Closed table: gitdir only when distinct, common objects, and the assigned branch's ref/reflog leaf
+// only while its HEAD still names that branch. Ordinary checkouts omit gitdir; packed-refs stays denied.
+// Any refusal, absent context or forbidden byte yields []; permitted bytes survive TOML and shq exactly.
+// Queue row 151: sibling refs inside the assigned leaf remain writable.
+export function renderCodexGitGrant(ctx) {
+    let roots = [];
+    try {
+        if (!ctx?.cwd || !ctx.branch || !ctx.repoRoot)
+            throw new Error("missing launch context");
+        const authority = checkedAuthority(ctx.cwd);
+        const run = checkedAuthority(ctx.repoRoot);
+        if (!authority || !run || authority.common !== run.common)
+            throw new Error("foreign git authority");
+        const { gitdir, common } = authority;
+        roots = [...(gitdir === common ? [] : [gitdir]), `${common}/objects`];
+        const head = readFileSync(join(gitdir, "HEAD"), "utf8");
+        if (head === `ref: refs/heads/${ctx.branch}\n` || head === `ref: refs/heads/${ctx.branch}`) {
+            const ref = `refs/heads/${ctx.branch}`;
+            const leaf = ref.slice(0, ref.lastIndexOf("/"));
+            roots.push(`${common}/${leaf}`, `${common}/logs/${leaf}`);
+        }
+        if (roots.some(root => /[\x00-\x1f\x7f"\\]/.test(root)))
+            roots = [];
+    }
+    catch {
+        roots = [];
+    }
+    return `-c ${shq(`sandbox_workspace_write.writable_roots=[${roots.map(root => `"${root}"`).join(",")}]`)}`;
+}
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
 // from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
 // untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever
@@ -275,7 +281,7 @@ export function codexMcpSuppressionFlags(configPath) {
     }
     return flags.join(" ");
 }
-// The one headless form: `grant` is "" for every non-worker seat and ` ${CODEX_GIT_GRANT}` for the worker.
+// Queue row 2 (D-2112): non-worker seats omit the grant; workers carry the rendered argument.
 const codexExec = (promptFile, model, effort, grant) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()}${grant}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`;
 export const codex = {
     id: "codex",
@@ -286,7 +292,7 @@ export const codex = {
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // v1.65 T3: every flag the command builder below hardcodes (incl. codexMcpSuppressionFlags' -c/
-    // --disable and CODEX_GIT_GRANT's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
+    // --disable and renderCodexGitGrant's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
     hardcodedFlags: { binary: "codex", flags: ["--sandbox", "-a", "-s", "--model", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
@@ -304,11 +310,11 @@ export const codex = {
     // autonomous approval policy (exec has no approvals to configure).
     // OBS-930 (Linux): the inlined prompt is ONE argv string and Linux caps one at 131072 bytes, so a
     // prompt over promptArgvCeiling() returns null → worker-mode-fallback → the headless form (types.ts).
-    interactiveCommand: (promptFile, model, effort) => promptFitsArgv(promptFile)
-        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${CODEX_GIT_GRANT}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
+    interactiveCommand: (promptFile, model, effort, ctx) => promptFitsArgv(promptFile)
+        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${renderCodexGitGrant(ctx)}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
         : null,
-    invoke(task, _cwd, a, ctx) {
-        return { command: codexExec(ctx.promptFile, a.model, a.effort, ` ${CODEX_GIT_GRANT}`) };
+    invoke(task, cwd, a, ctx) {
+        return { command: codexExec(ctx.promptFile, a.model, a.effort, ` ${renderCodexGitGrant({ ...ctx, cwd })}`) };
     },
     parse: parseWorkerResult,
     // v1.22 T5: seed [projects."<repoRoot>"] trust_level="trusted" so fresh worktrees never stall on

package/dist/adapters/cursor-agent.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, shq } from "./types.js";
@@ -58,7 +59,7 @@ export const cursorAgent = {
     // network (1.35s wall vs 0.34s CPU, RESEARCH A1); 15s timeout + fail-open covers offline.
     // Live-verified 2026-07-10, cursor-agent 2026.07.08.
     listModels: async () => {
-        const r = spawnSync("cursor-agent", ["--list-models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("cursor-agent", ["--list-models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parseCursorModels(r.stdout || "");
     },
 };

package/dist/adapters/grok.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, shq } from "./types.js";
@@ -130,7 +131,7 @@ export const grok = {
     // Advisory/doctor-only — never in the dispatch or auth path (types.ts:56-60).
     // Live-verified 2026-07-11 format, grok 0.2.93, 40-RESEARCH F-1.
     listModels: async () => {
-        const r = spawnSync("grok", ["models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("grok", ["models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parseGrokModels(r.stdout || "");
     },
 };

package/dist/adapters/kimi.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { runInteractiveSeed } from "../run/interactive-seed.js";
@@ -191,7 +192,7 @@ const kimiTuiLaunch = (model) => {
     let neverAsk = false;
     try {
         const help = spawnSync("kimi", ["--help"], {
-            encoding: "utf8", timeout: KIMI_HELP_TIMEOUT_MS, stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf8", timeout: KIMI_HELP_TIMEOUT_MS, stdio: ["ignore", "pipe", "ignore"], env: withoutHostSession(),
         });
         neverAsk = !help.error && help.status === 0 && kimiHasNeverAskOption(help.stdout);
     }
@@ -287,8 +288,12 @@ const KIMI_SEED = {
 // cursor glyph; prose never does. Enter accepts the highlighted "Trust this folder" option, and the
 // two captures above are the reason the cursor+label pair is the fingerprint rather than either
 // prompt's heading: the same gate ships two different headings.
+// Queue row 198: kimi 2.2.0 renders that gate as one modal whose selected option is "Trust and continue"
+// (KIMI_TRUST_PANE in types.ts), so the 0.29.0 pair above no longer appears and the seat waited out its
+// readiness budget on an unanswered modal. The declaration follows the installed kimi, which updates
+// itself; a kimi older than 2.2.0 renders the 0.29.0 option, which this declaration no longer answers.
 export const KIMI_TRUST_DIALOG = {
-    fingerprint: "❯ Trust this folder",
+    fingerprint: "❯ Trust and continue",
     key: "Enter",
 };
 // v1.69 T7 / v1.71 T2: thin wrapper over the daemon's generic dispatch path for kimi-only tests.
@@ -317,13 +322,10 @@ export const kimi = {
     // v1.65 T3: every flag the command builders below hardcode (-S is resumeCommand's) — verified in
     // `kimi --help` 2026-07-22.
     hardcodedFlags: { binary: "kimi", flags: ["-p", "--model", "--output-format", "-S"] },
-    // KNOWN GAP, stated rather than implied: this declaration is consumed by the daemon's trust loop,
-    // which is entered only AFTER runInteractiveSeed returns — and that seed waits for
-    // `readinessMatch` for the whole task timeout, which is exactly the window this prompt blocks in
-    // (run …215). So on a kimi startup pane the declaration is correct and still unreached: the seed
-    // reports `readiness pattern not seen` with zero keypresses. Answering it during the readiness
-    // wait is a change to src/run/interactive-seed.ts — WHEN and HOW OFTEN a declaration is answered
-    // is T19's half of this contract, and src/run may not appear in this task's diff.
+    // The seed's readiness wait answers this declaration once per slot before the banner appears
+    // (src/run/interactive-seed.ts awaitReadiness); the daemon's post-seed trust loop is the second
+    // consumer. Queue row 198: a declaration whose fingerprint the installed kimi no longer renders is
+    // never answered, and the seat waits out its readiness budget on the modal (row 199).
     trustDialog: KIMI_TRUST_DIALOG,
     // KIMI-02 headless. -p prompt mode + explicit model, NO permission flag: kimi 0.26.0 rejects
     // -p combined with -y/--auto at argument parse time ("Cannot combine --prompt with --yolo",

package/dist/adapters/model-lints.js

@@ -1,8 +1,8 @@
-import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { DEFAULT_CONFIG, TIER_RANK } from "../config/config.js";
 import { filesGlob } from "../graph/files-glob.js";
+import { gitSync } from "../run/git.js";
 import { piModelVendor } from "./pi.js";
 import { buildTaskPrompt } from "./prompt.js";
 import { channelKey, MODEL_ID_RE } from "./types.js";
@@ -249,7 +249,8 @@ const GLOB_CHARS = /[*?{[]/;
 // and `-z` is load-bearing correctness, not economy: without it git quotes any non-ASCII path, so
 // every Arabic/UTF-8 tracked file read as absent.
 function baseTreeAtHead(dir) {
-    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: protected git; a trust refusal throws instead of reading as "no base tree"
+    const git = (...args) => gitSync(dir, args);
     const top = git("rev-parse", "--show-toplevel");
     const tree = git("ls-tree", "--full-tree", "-r", "-l", "-z", "HEAD");
     if (top.status !== 0 || tree.status !== 0 || typeof top.stdout !== "string" || typeof tree.stdout !== "string")
@@ -287,7 +288,7 @@ function measureBytes(tree, rel) {
     return covered ? total : undefined;
 }
 function absentContextReason(root, path) {
-    if (spawnSync("git", ["-C", root, "check-ignore", "-q", "--", path]).status === 0)
+    if (gitSync(root, ["check-ignore", "-q", "--", path]).status === 0)
         return "gitignored";
     return existsSync(join(root, path)) ? "untracked" : "absent";
 }

package/dist/adapters/opencode.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, OPENCODE_BUSY_FRAME_MARKERS, shq, TokenUsageSchema } from "./types.js";
@@ -52,7 +53,7 @@ export const opencode = {
     // opencode reads its own cache offline; --refresh adds an avoidable network dependency (RESEARCH
     // anti-pattern). Live-verified 2026-07-10, opencode 1.17.15.
     listModels: async () => {
-        const r = spawnSync("opencode", ["models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("opencode", ["models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parseOpencodeModels(r.stdout || "");
     },
     // SPEND-09: opencode 1.x writes per-message token deltas to SQLite opencode.db (NOT the dead 0.7.x

package/dist/adapters/pi.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
@@ -142,7 +143,7 @@ export const pi = {
         // The store is local and independently useful: preserve its advisory even when the network/auth
         // capability call below fails. A failed model listing must not erase evidence of a substitution.
         const drift = servedModelNote();
-        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         if (r.error || r.status !== 0) {
             return drift ? { ...h, note: `${h.note ? `${h.note}; ` : ""}${drift}` } : h;
         }
@@ -183,7 +184,7 @@ export const pi = {
     // v1.5 MODEL-01: fail OPEN to [] (detection is advisory — unlike gates' fail-closed posture).
     // spawnSync mirrors probeVersion; 15s timeout. Live-verified 2026-07-10, pi 0.80.3.
     listModels: async () => {
-        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parsePiModels(r.stdout || "");
     },
     collectUsage(cwd, sinceMs) {

package/dist/adapters/qwen.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, shq, } from "./types.js";
 export const QWEN_VERSION_IDENTITY = /^\d+\.\d+\.\d+/;
@@ -149,7 +150,7 @@ export function parseQwenResult(raw, nonce) {
     return { ...parseWorkerResult(decoded.assistantText, nonce), raw };
 }
 function probeQwen() {
-    const result = spawnSync("qwen", ["--version"], { encoding: "utf8", timeout: 10_000 });
+    const result = spawnSync("qwen", ["--version"], { encoding: "utf8", timeout: 10_000, env: withoutHostSession() });
     if (result.error || result.status !== 0)
         return { installed: false, authed: false, models: [] };
     const version = (result.stdout || result.stderr).trim().split("\n")[0] ?? "";

package/dist/adapters/registry.js

@@ -10,6 +10,7 @@ import { sh } from "../run/git.js";
 import { FakeAdapter } from "./fake.js";
 import { parseWorkerResult } from "./prompt.js";
 import { sealHerdrEnv } from "../drivers/subprocess.js";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { catalogEntries, isNativeCliDrive, projectCliEntries, SHIPPED_CLI_CATALOG, } from "./catalog.js";
 import { channelKey, channelsFromConfig, modelAuthed, MODEL_ID_RE, MODEL_PROBE_ERRORS, QUOTA_PHRASE_RE, shq, STATUS_LABEL, } from "./types.js";
 // Compatibility projection for callers/tests that only need shipped advisory names. The literal
@@ -180,7 +181,7 @@ export function formatCandidateCliRow({ binary, path }) {
 // so no drift verdict piles onto the existing auth report.
 export function probeHelpText(bin) {
     try {
-        const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10000 });
+        const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10000, env: withoutHostSession() });
         if (r.error || r.status !== 0)
             return undefined;
         return `${r.stdout || ""}\n${r.stderr || ""}`;

package/dist/adapters/types.d.ts

@@ -118,6 +118,7 @@ export declare const CLAUDE_TRUST_PANE: string;
 export declare const CODEX_TRUST_PANE: string;
 export declare const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
 export declare const KIMI_TRUST_PANE: string;
+export declare const KIMI_TRUST_PANE_029: string;
 export declare const KIMI_MCP_TRUST_PANE: string;
 export declare const RECORDED_TRUST_PANES: readonly string[];
 export declare const APPROVED_TRUST_FINGERPRINTS: readonly string[];
@@ -186,6 +187,12 @@ export declare class SettledTrailerTracker {
     constructor(markers: readonly BusyFrameMarker[]);
     sample(paneText: string, trailer: boolean): boolean;
 }
+/** Queue row 2 item a (D-2112, D-2114): context owned by the task dispatcher. */
+export interface WorkerLaunchContext {
+    cwd: string;
+    branch: string;
+    repoRoot: string;
+}
 export interface WorkerAdapter {
     id: string;
     vendor: string;
@@ -196,13 +203,15 @@ export interface WorkerAdapter {
     headlessCommand(promptFile: string, model: string, effort?: Effort): string;
     harnessBannerRows?: readonly string[];
     paneReviewBuffersOutput?: boolean;
-    interactiveCommand(promptFile: string, model: string, effort?: Effort): string | null;
+    interactiveCommand(promptFile: string, model: string, effort?: Effort, ctx?: WorkerLaunchContext): string | null;
     interactiveSeed?: InteractiveSeed;
     resumeCommand?(sessionId: string, promptFile: string, model: string, effort?: Effort): string;
     sessionIdFrom?(output: string): string | undefined;
     resumeUnknownContext?: boolean;
     invoke(task: Task, cwd: string, a: Assignment, ctx: {
         promptFile: string;
+        branch?: string;
+        repoRoot?: string;
     }): Invocation;
     parse(output: string, nonce: string): WorkerResult;
     listModels?(): Promise<string[]>;

package/dist/adapters/types.js

@@ -59,11 +59,25 @@ export const CODEX_TRUST_PANE = [
 ].join("\n");
 // v1.22 T5 / OBS-19, cursor-agent's per-worktree dialog.
 export const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+// Queue row 198, kimi 2.2.0's folder-trust modal on a fresh task worktree (run 1394 T3, read off the
+// Orca screen before its one Enter). The worktree path is shortened as above; every other row is as
+// rendered. 2.2.0 renamed the selected option, so the 0.29.0 fingerprint below never matched it and the
+// seat sat on this modal for 21 minutes.
+export const KIMI_TRUST_PANE = [
+    "Trust this folder?",
+    "↑↓ navigate · Enter select · Esc exit",
+    "/Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20261017-122301-…1394--T3",
+    "No project integrations or instructions to activate.",
+    "Trust is remembered for this folder, including future project config changes.",
+    "Tool approvals follow your permission settings.",
+    " ❯ Trust and continue",
+    "   Exit",
+].join("\n");
 // OBS-358, live pane wW:p2TB of run-20260805-121252 — the dialog that cost 30 minutes — quoted from
 // the record holding all five lines, .overseer/REPAIR-v186/GATE-T28-1.md (OBSERVATIONS.md abridges
 // it to the first three). "← highlighted" is the observer's annotation of the selected row, kept
-// exactly as recorded rather than tidied away.
-export const KIMI_TRUST_PANE = [
+// exactly as recorded rather than tidied away. kimi 0.29.0; superseded by the 2.2.0 capture above.
+export const KIMI_TRUST_PANE_029 = [
     "Trust this folder?",
     "  /Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20260805-121252--T29",
     "❯ Trust this folder     ← highlighted",
@@ -77,7 +91,7 @@ export const KIMI_MCP_TRUST_PANE = [
     " ❯ Trust this folder      /      Don't trust",
 ].join("\n");
 export const RECORDED_TRUST_PANES = [
-    CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_MCP_TRUST_PANE,
+    CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_TRUST_PANE_029, KIMI_MCP_TRUST_PANE,
 ];
 // v1.89 T1 / OBS-414 round 4 — EXACT, not "leading bytes of a recorded line". Round 3 accepted any
 // prefix of a captured line, and every prefix of a trust prompt is also a substring of unrelated
@@ -96,6 +110,7 @@ export const APPROVED_TRUST_FINGERPRINTS = [
     "Do you trust the contents of this directory?", // codex 0.144.6, OBS-137
     "Workspace Trust Required", // cursor-agent, OBS-19
     "❯ Trust this folder", // kimi 0.29.0, OBS-358 + OBS-406 — the cursor glyph is load-bearing
+    "❯ Trust and continue", // kimi 2.2.0, queue row 198 — the same gate with its option renamed
 ];
 const isApprovedFingerprint = (fingerprint) => APPROVED_TRUST_FINGERPRINTS.includes(fingerprint)
     && RECORDED_TRUST_PANES.some((pane) => pane.includes(fingerprint));