[kortiene]

Summary

• Make scoped Code Mode fail closed on authenticated remote execution by default, with an explicit isolated-process development/test opt-out.
• Add bounded JSON transport, source/result/output/nested-call limits, runtime and memory ceilings, admission control, and atomic callback cleanup.
• Make authorization, accounting, transport, event, output, and result-limit violations terminal even when generated code catches callback errors.
• Add bounded, key-safe nested event sanitization, stable ancestry, originating-turn attribution, and fixed error redaction.
• Preserve generic compatibility defaults: the restricted-agent pool remains pickle-based, sandbox tokens remain optional outside scoped Code Mode, metrics remain 0.0.0.0:8091, and server-owned limits remain unset unless configured.

Testing

• uv run --python 3.12 pytest tests/codemode/test_model.py tests/codemode/test_protocol.py tests/harness_sdk -q (251 passed, 1 skipped)
• make lint in hyperforge
• make lint in agents/restricted
• uv run --python 3.12 pytest tests/test_sandbox.py -q in agents/restricted (16 passed)
• git diff --check

Stack

Depends on upstream foundation PR nuclia#139. This PR targets the matching foundation branch in the contributor fork so the hardening delta remains independently reviewable. Once the foundation merges, this branch can be proposed directly against upstream main.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T01:00:38.234101Z	931b413	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 931b413035

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Fall back when detailed worker errors exceed the packet cap

For a non-redacted isolated or remote request, generated code can raise an exception whose string is larger than MAX_PROTOCOL_BYTES (for example, raise RuntimeError('x' * 20_000_000)). Encoding this _error task then raises instead of notifying the controller; the finally block still sends _close, after which the worker exits nonzero and the caller receives the misleading “exceeded its memory limit or exited unexpectedly” error rather than the actual runtime failure. Send a bounded fallback error when the detailed error cannot be encoded.

Useful? React with 👍 / 👎.

[kortiene]

Superseded by upstream internal PR nuclia#140 now that foundation PR nuclia#139 has merged. The upstream branch contains only the hardening delta against current main and is tree-identical to this PR head.