[spalen0]

What changes

• Make LLM_CLI_PROVIDERS=none the default. Operators explicitly choose codex, claude, or an ordered list such as codex,claude; only listed CLIs are tried before the API provider.
• Run both CLIs as text-only summarizers. The explainer already supplies decoded calls, verified source, on-chain state, simulation and protocol adapter context, so the agent needs no tools.
  • Codex: replace --yolo with --sandbox read-only, --ignore-user-config, --ignore-rules, disabled shell/browser/apps/plugins/hooks/multi-agent/image features, and web_search="disabled". No MCP servers load.
  • Claude: replace --dangerously-skip-permissions with --permission-mode dontAsk, --tools "" and --strict-mcp-config with no MCP config, so no built-in tools and no MCP servers.
• Give the CLI subprocess only process basics and its own authentication variables. RPC, Etherscan, Telegram, Tenderly and application LLM API credentials stay out of the child environment.
• Audit Codex JSONL and Claude stream JSON after each run. Any tool event disables that provider for the process and falls through to the next one. Claude's internal StructuredOutput event (schema calls only) and Codex todo_list plan items are not tool use. Non-JSON warning lines are skipped; output without events fails only that call.
• Error messages for a non-zero exit quote stderr only, never the event stream.
• Pass cli_auth_credentials_store="auto" to Codex: --ignore-user-config also drops that setting, and the file-only default misses a login kept in the OS keyring (401).
• Docs, .env.example and the systemd unit state the new none default.

If a summary turns out to need more chain data, add the read to the explainer's context gathering rather than giving the agent a tool.

Dependency audit

The certifi fix for PYSEC-2026-4320 (pin certifi==2026.10.19, certifi-only exclude-newer-package override, no audit ignore) is split out to #432 so main goes green first. This branch carries identical pyproject.toml, uv.lock and CI files, so merging main after #432 is conflict-free and leaves only the CLI changes in this diff.

Validation

• uv run pytest -q tests/test_llm_cli.py: 40 passed (tool audit, environment allowlist, stderr-only errors, warning-line tolerance, fallback and factory wiring).
• Ruff lint/format and ty pass.
• Live local runs of both CLIs through the providers: asked to run pwd, each answered NO_TOOLS; schema-constrained output works on both.

Rollout

Keep LLM_CLI_PROVIDERS=none in production until this version is deployed. Enable one CLI explicitly for a trial, check the AI summary using <model> logs, then choose the order.

Both CLIs still run as the monitoring service's Unix user, and the restrictions are CLI flags; event auditing detects unexpected tool calls after the fact and cannot undo one.

🤖 Generated with Claude Code