@animalabs/connectome-host 0.7.3 → 0.8.0

package/src/index.ts

@@ -10,7 +10,7 @@
  *   bun src/index.ts --headless --exit-when-idle   # One-shot: exit when agents go idle after first inference
  *
  * Environment variables:
- *   ANTHROPIC_API_KEY   - Required
+ *   ANTHROPIC_API_KEY   - Required (not needed for recipe provider "mock")
  *   MODEL               - Override model (default: from recipe or claude-opus-4-6)
  *   DATA_DIR            - Data directory for sessions (default: ./data)
  */
@@ -19,25 +19,28 @@ import {
   AnthropicXmlFormatter,
   BedrockAdapter,
   Membrane,
+  MockAdapter,
   NativeFormatter,
   OpenAIResponsesAPIAdapter,
   OpenAIResponsesFormatter,
+  OpenAICompatibleAdapter,
   OpenRouterAdapter,
 } from '@animalabs/membrane';
 import { LoggingAnthropicAdapter } from './logging-adapter.js';
 import { LoggingProviderAdapter } from './logging-provider-wrapper.js';
+import { gateTelemetryHeaders, type TurnTrigger } from './gate-telemetry.js';
 import { LoggingBedrockAdapter } from './logging-bedrock-adapter.js';
 import { CodexSubscriptionAdapter } from './codex-subscription-adapter.js';
 import { CallLedger } from './call-ledger.js';
 import { SettingsModule } from './modules/settings-module.js';
-import { AgentFramework, WorkspaceModule, resolveTimeZone, type Module, type MountConfig } from '@animalabs/agent-framework';
+import { AgentFramework, WorkspaceModule, resolveTimeZone, type Module } from '@animalabs/agent-framework';
 import { resolve, join, basename } from 'node:path';
 import { appendFile, mkdir, stat, rename } from 'node:fs/promises';
 import { readFileSync, existsSync } from 'node:fs';
 import { SubagentModule } from './modules/subagent-module.js';
 import { LessonsModule } from './modules/lessons-module.js';
 import { RetrievalModule } from './modules/retrieval-module.js';
-import type { RecipeWorkspaceMount } from './recipe.js';
+import { buildRetrievalModuleConfig } from './retrieval-config.js';
 import { TuiModule } from './modules/tui-module.js';
 import { TimeModule } from './modules/time-module.js';
 import { FleetModule, type FleetModuleConfig } from './modules/fleet-module.js';
@@ -49,14 +52,15 @@ import { ObserversModule } from './modules/observers-module.js';
 import { IdentityModule } from './modules/identity-module.js';
 import { McplAdminModule } from './modules/mcpl-admin-module.js';
 import { TtsRelayModule } from './modules/tts-relay-module.js';
-import { loadMcplServers, applyAgentOverlay, DEFAULT_CONFIG_PATH, DEFAULT_AGENT_OVERLAY_PATH } from './mcpl-config.js';
+import { InstructionsModule } from './modules/instructions-module.js';
+import { loadMcplServers, applyAgentOverlay, composeMcplChildEnv, DEFAULT_CONFIG_PATH, DEFAULT_AGENT_OVERLAY_PATH } from './mcpl-config.js';
 import { SessionManager } from './session-manager.js';
 import { resolveAgentName } from './agent-name.js';
 import { generateSessionName } from './synesthete.js';
 import {
   type Recipe,
   DEFAULT_RECIPE,
-  loadRecipe,
+  loadRecipeDetailed,
   saveRecipe,
   loadSavedRecipe,
   clearSavedRecipe,
@@ -64,7 +68,9 @@ import {
 } from './recipe.js';
 import { createBranchState, resetBranchState, handleExport, type BranchState } from './commands.js';
 import { buildFrameworkAgentConfig, membraneCachingOverride } from './framework-agent-config.js';
-import { buildFrameworkStrategy } from './framework-strategy.js';
+import { buildFrameworkStrategy, buildConversationsConfig } from './framework-strategy.js';
+import { buildWorkspaceMounts } from './workspace-mounts.js';
+import { logKeepaliveEvent } from './cache-keepalive-log.js';
 import { loadExtensions } from './extensions.js';
 
 export type { AppContext };
@@ -79,6 +85,10 @@ const config = {
   authToken: process.env.ANTHROPIC_AUTH_TOKEN,
   openaiApiKey: process.env.OPENAI_API_KEY,
   openrouterApiKey: process.env.OPENROUTER_API_KEY,
+  // Deliberately NO fallback to OPENAI_API_KEY: agent.baseUrl is
+  // recipe-controlled, so a fallback would silently send a real OpenAI
+  // credential as a Bearer token to whatever endpoint a recipe names.
+  openaiCompatibleApiKey: process.env.OPENAI_COMPATIBLE_API_KEY,
   codexBinary: process.env.CODEX_BINARY,
   model: process.env.MODEL,
   dataDir: process.env.DATA_DIR || './data',
@@ -103,6 +113,10 @@ interface AppContext {
   branchState: BranchState;
   userMessageCount: number;
   codexAdapter?: CodexSubscriptionAdapter;
+  /** Content-free recent provider-call ledger. Consumed by the panel-data
+   *  layer (health snapshots) in BOTH runtimes — WebUI host and headless
+   *  fleet child. Null when the provider adapter exposes no ledger. */
+  callLedger: CallLedger | null;
 
   /** Stop current framework, switch to a different session, start new framework. */
   switchSession(id: string): Promise<void>;
@@ -123,8 +137,10 @@ async function resolveRecipe(): Promise<Recipe> {
 
   if (source) {
     try {
-      const recipe = await loadRecipe(source);
-      saveRecipe(config.dataDir, recipe);
+      // Save the unresolved (pre-substitution) form: $DATA_DIR is typically
+      // host-mounted and backed up, so resolved secrets must never land there.
+      const { recipe, persistable } = await loadRecipeDetailed(source);
+      saveRecipe(config.dataDir, persistable);
       console.log(`Loaded recipe: ${recipe.name}${recipe.description ? ` — ${recipe.description}` : ''}`);
       return recipe;
     } catch (err) {
@@ -133,11 +149,21 @@ async function resolveRecipe(): Promise<Recipe> {
     }
   }
 
-  // Try saved recipe
-  const saved = loadSavedRecipe(config.dataDir);
-  if (saved) {
-    console.log(`Resuming recipe: ${saved.name}`);
-    return saved;
+  // Try saved recipe. Re-resolves ${VAR} references against the CURRENT
+  // environment, so a missing secret fails loudly here rather than starting
+  // a misconfigured agent on the default recipe.
+  try {
+    const saved = await loadSavedRecipe(config.dataDir);
+    if (saved) {
+      console.log(`Resuming recipe: ${saved.name}`);
+      return saved;
+    }
+  } catch (err) {
+    console.error(
+      `Failed to resume saved recipe from ${config.dataDir}:`,
+      err instanceof Error ? err.message : err,
+    );
+    process.exit(1);
   }
 
   return DEFAULT_RECIPE;
@@ -227,16 +253,13 @@ async function createFramework(
   }
 
   // Retrieval (requires lessons). OPT-IN — not part of the standard recipe:
-  // it injects context-dependent content into every compile (plus two Haiku
-  // calls per turn), which adds per-turn context churn. Enable explicitly via
-  // modules.retrieval only when an agent actually curates a lesson library.
+  // it injects context-dependent content into every compile (plus up to two
+  // configured retrieval-model calls), which adds per-turn context churn.
+  // Enable explicitly only when an agent actually curates a lesson library.
   if (modules.retrieval && lessonsModule) {
-    const retrievalConfig = typeof modules.retrieval === 'object' ? modules.retrieval : {};
-    moduleInstances.push(new RetrievalModule({
-      membrane,
-      retrievalModel: retrievalConfig.model,
-      maxInjectedLessons: retrievalConfig.maxInjected,
-    }));
+    moduleInstances.push(new RetrievalModule(
+      buildRetrievalModuleConfig(membrane, modules.retrieval, recipe.agent.provider),
+    ));
   }
 
   // Gate config — core AF EventGate feature.
@@ -258,48 +281,30 @@ async function createFramework(
   // Note: workspace: false disables ALL filesystem access (both read and write).
   // Previously LocalFilesModule was always-on; this is an intentional change —
   // recipes that need read-only access should keep workspace enabled (the default).
+  // Mount construction lives in workspace-mounts.ts so recipe validation
+  // reasons over the SAME mount flags the runtime builds (see that file's
+  // header for why).
   let workspaceModule: WorkspaceModule | null = null;
-  if (modules.workspace !== false) {
-    let mounts: MountConfig[];
-    if (typeof modules.workspace === 'object' && modules.workspace.mounts) {
-      // Only pass fields the recipe explicitly provides; let WorkspaceModule default the rest.
-      // We override watch to 'never' since FKM doesn't need chokidar filesystem watchers.
-      mounts = modules.workspace.mounts.map((m: RecipeWorkspaceMount) => {
-        const mount: MountConfig = {
-          name: m.name,
-          path: resolve(m.path),
-          mode: m.mode ?? 'read-write',
-          watch: m.watch ?? 'never', // FKM: no chokidar watchers by default
-        };
-        if (m.ignore) mount.ignore = m.ignore;
-        if (m.wakeOnChange !== undefined) mount.wakeOnChange = m.wakeOnChange;
-        if (m.autoMaterialize !== undefined) mount.autoMaterialize = m.autoMaterialize;
-        return mount;
-      });
-    } else {
-      // Default: read-only input mount + read-write products mount
-      mounts = [
-        { name: 'input', path: resolve('./input'), mode: 'read-only', watch: 'never' },
-        { name: 'products', path: resolve('./output'), mode: 'read-write', watch: 'never' },
-      ];
-    }
-
-    // Config mount: version-controls gate.json (and future config files) via Chronicle.
-    // Opt-in via recipe: workspace.configMount = true
-    const wantConfigMount = typeof modules.workspace === 'object' && modules.workspace.configMount;
-    if (wantConfigMount) {
-      mounts.push({
-        name: '_config',
-        path: resolve(join(storePath, 'config')),
-        mode: 'read-write',
-        watch: 'always',
-      });
-    }
-
-    workspaceModule = new WorkspaceModule({ mounts });
+  const workspaceMounts = buildWorkspaceMounts(modules.workspace, storePath);
+  if (workspaceMounts) {
+    workspaceModule = new WorkspaceModule({ mounts: workspaceMounts });
     moduleInstances.push(workspaceModule);
   }
 
+  // Shared operating instructions — opt-in per recipe. Injects a living
+  // instructions document (read through a workspace mount) into EVERY
+  // agent's context on every turn — resident and ephemeral subagents alike —
+  // via gatherContext. Requires the workspace module; validateRecipe rejects
+  // the instructions+`workspace: false` pairing, so workspaceModule is
+  // non-null here (the guard keeps the module fail-open regardless).
+  if (modules.instructions) {
+    const instructionsConfig =
+      typeof modules.instructions === 'object' ? modules.instructions : {};
+    const instructionsModule = new InstructionsModule(instructionsConfig);
+    if (workspaceModule) instructionsModule.setWorkspace(workspaceModule);
+    moduleInstances.push(instructionsModule);
+  }
+
   // Activity (typing indicators) — opt-in per recipe
   let activityModule: ActivityModule | null = null;
   if (modules.activity !== undefined && modules.activity !== false) {
@@ -459,9 +464,11 @@ async function createFramework(
   const finalServers = applyAgentOverlay(allServers, DEFAULT_AGENT_OVERLAY_PATH).map((server) => {
     const withEnv: { id: string; command?: string; url?: string; [k: string]: unknown } = {
       ...server,
-      // Stdio MCPL children inherit a single agent-facing wall clock. Protocol
-      // timestamps remain UTC; only their rendered text uses this setting.
-      env: { ...(server.env ?? {}), AGENT_TIMEZONE: timeZone },
+      // Stdio MCPL children inherit a single agent-facing wall clock plus the
+      // framework's refusal-annotation suppression baseline (operator env
+      // supersedes the baseline; see composeMcplChildEnv). Protocol
+      // timestamps remain UTC; only their rendered text uses AGENT_TIMEZONE.
+      env: composeMcplChildEnv(server.env as Record<string, string> | undefined, timeZone),
     };
     // `access` is a declarative name (recipe/file/overlay); the credential
     // provider it implies is attached HERE, at load time — fresh credential
@@ -487,6 +494,10 @@ async function createFramework(
   const strategy = buildFrameworkStrategy(recipe, model, timeZone, extensionRegistry);
   const agentConfig = buildFrameworkAgentConfig(recipe, agentName, model, strategy);
 
+  // Per-channel conversation routing: the recipe agent becomes the trunk
+  // template; forks get a fresh instance of the same recipe strategy.
+  const conversations = buildConversationsConfig(recipe, agentName, model, timeZone, extensionRegistry);
+
   // -- Create framework --
   const framework = await AgentFramework.create({
     storePath,
@@ -498,6 +509,7 @@ agents: [agentConfig],
     timeZone,
     // Client-side programmatic tool calling (code_execution) — recipe opt-in.
     ...(recipe.codeExecution ? { codeExecution: recipe.codeExecution } : {}),
+    ...(conversations ? { conversations } : {}),
   });
 
   // Wire post-creation hooks
@@ -870,6 +882,16 @@ async function main() {
         fastMode: recipe.agent.codex?.fastMode ?? false,
       })
     : undefined;
+  // Generic OpenAI-compatible chat-completions endpoint (Ollama, vLLM, Together,
+  // Groq, NanoGPT, ...). The recipe carries the endpoint (agent.baseUrl,
+  // validated at load); the key is optional because local servers have none.
+  const openaiCompatibleAdapter = provider === 'openai-compatible'
+    ? new OpenAICompatibleAdapter({
+        baseURL: recipe.agent.baseUrl!,
+        apiKey: config.openaiCompatibleApiKey || undefined,
+        providerName: 'openai-compatible',
+      })
+    : undefined;
   const openrouterAdapter = provider === 'openrouter'
     ? new OpenRouterAdapter({
         apiKey: config.openrouterApiKey!,
@@ -888,9 +910,74 @@ async function main() {
   // live probe 2026-07-31. Still no CallLedger — it's
   // anthropic-transport-only for now; cache metrics are visible in
   // llm-calls.jsonl via the logging wrapper.
+  // BEDROCK_BASE_URL routes bedrock-runtime calls through an inference
+  // gateway (gate.animalabs.ai/bedrock/<credSet>) — mirrors the
+  // ANTHROPIC_BASE_URL hook below. The gate reads the agent token from the
+  // SigV4 Credential (AWS_ACCESS_KEY_ID slot), discards the client
+  // signature, and re-signs with real AWS creds held on the gate box.
   const bedrockAdapter = provider === 'bedrock'
-    ? new LoggingBedrockAdapter({}, llmLogPath)
+    ? new LoggingBedrockAdapter(
+        { baseURL: process.env.BEDROCK_BASE_URL || undefined },
+        llmLogPath,
+      )
+    : undefined;
+  // Mock: membrane's canned/echo adapter — the full host loop with zero
+  // provider spend and no credentials (none of the key checks above are
+  // gated on it). Echo is the default because it's the informative shape
+  // for interactive smoke runs; recipe agent.mock.echoMode=false switches
+  // to defaultResponse for deterministic scripted output. It rides the
+  // generic logging decorator so even mock calls leave llm-calls.jsonl
+  // receipts — the observability path is part of what a mock run exercises.
+  const mockAdapter = provider === 'mock'
+    ? new MockAdapter({
+        echoMode: recipe.agent.mock?.echoMode ?? true,
+        ...(recipe.agent.mock?.defaultResponse !== undefined
+          ? { defaultResponse: recipe.agent.mock.defaultResponse }
+          : {}),
+      })
     : undefined;
+  // -- x-gate-debt-chunks stamp (membrane dynamicHeaders, antra-tess/membrane#65)
+  // The gate records compression-debt per ledger row; debt only changes at
+  // calls, so the per-call series is its full-resolution history ("spoke ->
+  // chunk appeared -> chewed" vs "solver repacked -> queue spiked"). The value
+  // is the SAME reduction /healthz reports (cm getCompressionDebt). Late-bound
+  // through appRef because the framework outlives adapter construction and is
+  // replaced on session switch. Whenever it is unreadable — no framework yet,
+  // multi-agent process (whose debt would we even claim?), no strategy — the
+  // header is simply not sent: an unstamped call is honest, a guessed one lies.
+  let appRefForDebt: AppContext | null = null;
+  const pendingDebtChunks = (): number | null => {
+    try {
+      const agents = appRefForDebt?.framework.getAllAgents() ?? [];
+      if (agents.length !== 1) return null;
+      const strategy = (agents[0] as unknown as {
+        getContextManager?: () => { getStrategy?: () => { getCompressionDebt?: () => unknown } };
+      }).getContextManager?.()?.getStrategy?.();
+      const d = strategy?.getCompressionDebt?.() as { pendingChunks?: unknown } | undefined;
+      const n = d?.pendingChunks;
+      return typeof n === 'number' && Number.isFinite(n) && n >= 0 ? Math.round(n) : null;
+    } catch {
+      return null;
+    }
+  };
+
+  // Why the turn in progress fired (heartbeat / a channel message by whom /
+  // operator), read from the framework's active-turn trigger. Same guards as
+  // the debt getter: no framework or several agents
+  // -> null -> the origin trio is simply not sent.
+  const activeTurnTrigger = (): TurnTrigger | null => {
+    try {
+      const agents = appRefForDebt?.framework.getAllAgents() ?? [];
+      if (agents.length !== 1) return null;
+      const t = appRefForDebt?.framework.getActiveTurnTrigger(agents[0]!.name);
+      return t ? { reason: t.reason, source: t.source, channelId: t.channelId, counterparty: t.counterparty } : null;
+    } catch {
+      return null;
+    }
+  };
+
+  const gateTelemetryDynamicHeaders = gateTelemetryHeaders(process.env, pendingDebtChunks, activeTurnTrigger);
+
   const adapter = provider === 'openai-responses'
     ? new LoggingProviderAdapter(
         new OpenAIResponsesAPIAdapter({
@@ -905,7 +992,9 @@ async function main() {
     // `openrouterAdapter` instances stay un-wrapped for auth commands and
     // dispose() — only the membrane sees the wrapper.
     : bedrockAdapter
+      ?? (mockAdapter ? new LoggingProviderAdapter(mockAdapter, llmLogPath) : undefined)
       ?? (openrouterAdapter ? new LoggingProviderAdapter(openrouterAdapter, llmLogPath) : undefined)
+      ?? (openaiCompatibleAdapter ? new LoggingProviderAdapter(openaiCompatibleAdapter, llmLogPath) : undefined)
       ?? (codexAdapter ? new LoggingProviderAdapter(codexAdapter, llmLogPath) : undefined)
       ?? new LoggingAnthropicAdapter(
         {
@@ -927,6 +1016,29 @@ async function main() {
                   : {}),
               }),
           baseURL: process.env.ANTHROPIC_BASE_URL || undefined,
+          // Double-gated (see src/gate-telemetry.ts): GATE_TELEMETRY=1 AND a
+          // configured base URL, so the stamp can only ever go to a
+          // gateway the operator has declared — never to the vendor's
+          // default endpoint (review finding on the first wiring).
+          ...(gateTelemetryDynamicHeaders ? { dynamicHeaders: gateTelemetryDynamicHeaders } : {}),
+          // Hold this agent's cached prefix warm across idle gaps. Only fires
+          // when the entry is actually near expiry, so a busy agent costs
+          // nothing; only the 1h-TTL primary lane is eligible (the module
+          // skips anything else). Off with cacheKeepalive.enabled: false.
+          cacheKeepalive: {
+            enabled: recipe.agent.cacheKeepalive?.enabled !== false,
+            ...(recipe.agent.cacheKeepalive?.maxIdleHours !== undefined
+              ? { maxIdleMs: recipe.agent.cacheKeepalive.maxIdleHours * 60 * 60_000 }
+              : {}),
+            ...(recipe.agent.cacheKeepalive?.refreshAfterMinutes !== undefined
+              ? { refreshAfterMs: recipe.agent.cacheKeepalive.refreshAfterMinutes * 60_000 }
+              : {}),
+            // Every event — routine refreshes included — goes to stderr, so
+            // all of them land in service-stderr.log next to
+            // [inference-refusal]. See cache-keepalive-log.ts for why this is
+            // not severity-routed.
+            onEvent: logKeepaliveEvent,
+          },
         },
         llmLogPath,
         () => settingsModule.getReasoning(),
@@ -996,6 +1108,7 @@ async function main() {
     branchState: createBranchState(),
     userMessageCount: 0,
     codexAdapter,
+    callLedger,
 
     async switchSession(id: string) {
       handleExport(this);
@@ -1016,6 +1129,8 @@ async function main() {
     },
   };
 
+  appRefForDebt = app;
+
   // Off-path refusal dragnet → ops alerts (observability M3): refusals on
   // non-streamed calls (compression/summarizer drains, maintenance) never
   // reach the framework's own noteRefusal — the 2026-07-15 mythos cascade

package/src/mcpl-config.ts

@@ -6,6 +6,7 @@
 
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
+import { REFUSAL_REACTION_BASELINE } from '@animalabs/agent-framework';
 
 /** Default config file path, resolved from cwd. */
 export const DEFAULT_CONFIG_PATH = resolve(process.cwd(), 'mcpl-servers.json');
@@ -134,10 +135,57 @@ export function saveAgentOverlay(
   writeFileSync(overlayPath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
 }
 
+/**
+ * Capabilities an agent-deployed server is never granted by default: the
+ * consequential surfaces — context hooks (observation of and injection into
+ * the agent's own inference), server-initiated inference, and inference
+ * lifecycle. Bare parents on purpose: the config mask's subtree matching
+ * denies everything beneath them, present and future (afterInference, undo,
+ * state land under these the day the vocabulary grows them). A world/chat
+ * server needs none of this — channels + tools is the whole job. An operator
+ * who wants a self-deployed server to hold one of these moves the server
+ * into the recipe, where `enabledCapabilities` is theirs to write.
+ */
+export const AGENT_DEPLOY_DENIED_CAPABILITIES: readonly string[] = [
+  'contextHooks',
+  'inferenceRequest',
+  'inferenceLifecycle',
+];
+
+/** The allow/deny list fields where an EMPTY array carries no intent (see
+ *  resolveOverlayEntry — OpenAI strict function calling forces every schema
+ *  property, so agent tool calls arrive with `[]` meaning "unspecified"). */
+const OVERLAY_LIST_FIELDS = [
+  'enabledFeatureSets',
+  'disabledFeatureSets',
+  'enabledTools',
+  'disabledTools',
+] as const;
+
 /**
  * Resolve an overlay entry into a server config object (id + fields, relative
  * `./`/`../` args resolved against the overlay file's directory). Returns
  * null for tombstones and entries with neither command nor url.
+ *
+ * The overlay is the AGENT's file, so resolution is also where host policy
+ * for self-deployed servers lives (applied at boot AND at deploy — existing
+ * files heal without a re-deploy):
+ *
+ *  - Empty allow/deny lists are treated as absent. OpenAI-style strict
+ *    function calling forces every schema property, so GPT-family residents
+ *    calling mcpl_deploy emit `[]` where they meant "unspecified" — and for
+ *    the allowlists PRESENT-empty is deny-all under the §5.3 pin (Mica's
+ *    silently eventless eidoverse, 2026-08-04). An agent that truly wants
+ *    deny-all says `disabledTools: ["*"]` / `disabledFeatureSets: ["*"]`.
+ *
+ *  - `enabledCapabilities` is dropped: the agent's file can narrow, never
+ *    widen — a hand-written entry here could re-grant §13.4 deny-by-default
+ *    paths.
+ *
+ *  - `disabledCapabilities` always carries at least
+ *    AGENT_DEPLOY_DENIED_CAPABILITIES (unioned with anything the entry
+ *    already denies): self-deployed servers get channels + tools and
+ *    nothing consequential by default.
  */
 export function resolveOverlayEntry(
   id: string,
@@ -148,9 +196,29 @@ export function resolveOverlayEntry(
   if (!entry.command && !entry.url) return null;
   const overlayDir = dirname(resolve(overlayPath));
   const { disabled: _d, ...fields } = entry;
+  const rec = fields as Record<string, unknown>;
+  for (const k of OVERLAY_LIST_FIELDS) {
+    if (Array.isArray(rec[k]) && (rec[k] as unknown[]).length === 0) delete rec[k];
+  }
+  delete rec.enabledCapabilities;
+  // A network server the agent deployed should come back when it bounces.
+  // reconnect defaulted to false, so an entry that never said `reconnect:
+  // true` was severed PERMANENTLY by any server restart — with no signal to
+  // anyone — until the agent's own next restart, which for a long-lived
+  // resident is days away (Mythos, eventless in eidoverse after the
+  // 2026-08-04 door deploy). Websocket entries now default to reconnect
+  // unless the entry explicitly says false. Stdio entries keep the old
+  // default: reconnect does not respawn a dead child anyway (mcpl_restart
+  // is that path), so `true` there would promise something it can't do.
+  if (entry.url && rec.reconnect === undefined) rec.reconnect = true;
+  const denied = new Set<string>([
+    ...AGENT_DEPLOY_DENIED_CAPABILITIES,
+    ...(Array.isArray(rec.disabledCapabilities) ? (rec.disabledCapabilities as unknown[]).map(String) : []),
+  ]);
   return {
     id,
-    ...fields,
+    ...rec,
+    disabledCapabilities: [...denied].sort(),
     ...(entry.args
       ? {
           args: entry.args.map(arg =>
@@ -206,3 +274,33 @@ export function saveMcplServers(configPath: string, servers: Record<string, Serv
   const data: McplServersFile = { mcplServers: servers };
   writeFileSync(configPath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
 }
+
+/**
+ * Compose the environment for a stdio MCPL child.
+ *
+ * Two host-owned values ride along with whatever the server entry declares:
+ *
+ * - `DISCORD_SUPPRESSED_REACTIONS_BASELINE` — the framework's exported
+ *   refusal-annotation set (REFUSAL_REACTION_BASELINE, comma-joined), so a
+ *   never-configured Discord adapter defaults to suppressing exactly the
+ *   markers this host's framework stamps. Placed BEFORE the spread: an
+ *   operator who sets the var on the server entry supersedes the house
+ *   baseline — the host injects a default, never overrides a decision. The
+ *   adapter's own precedence (file key incl. [] → legacy operator env →
+ *   baseline) then decides what is actually enforced; house markers are
+ *   Host semantics, and a standalone adapter without this composition stays
+ *   honestly unprotected.
+ * - `AGENT_TIMEZONE` — after the spread, deliberately: the agent-facing
+ *   wall clock is resolved per-recipe by the host and is not a per-server
+ *   operator knob.
+ */
+export function composeMcplChildEnv(
+  serverEnv: Record<string, string> | undefined,
+  timeZone: string,
+): Record<string, string> {
+  return {
+    DISCORD_SUPPRESSED_REACTIONS_BASELINE: REFUSAL_REACTION_BASELINE.join(','),
+    ...(serverEnv ?? {}),
+    AGENT_TIMEZONE: timeZone,
+  };
+}

package/src/modules/fleet-module.ts

@@ -34,7 +34,7 @@ import { spawn as spawnProcess, type ChildProcess } from 'node:child_process';
 import { connect as netConnect, type Socket } from 'node:net';
 import { existsSync, mkdirSync, unlinkSync, openSync, closeSync, appendFileSync, realpathSync } from 'node:fs';
 import { join, resolve, isAbsolute } from 'node:path';
-import { type IncomingCommand, type WireEvent, matchesSubscription } from './fleet-types.js';
+import { type IncomingCommand, type WireEvent, type PanelResponseEvent, matchesSubscription } from './fleet-types.js';
 import { loadRecipe } from '../recipe.js';
 import { REDUCER_REQUIRED_EVENTS } from '../state/agent-tree-reducer.js';
 
@@ -1621,6 +1621,65 @@ export class FleetModule implements Module {
     catch { return false; }
   }
 
+  /** Monotonic corrId source for requestPanel. */
+  private panelSeq = 0;
+
+  /**
+   * Run one operator-panel op (see src/web/panel-data.ts) in a fleet child
+   * and await its `panel-response`. Promise-based counterpart to the
+   * fire-and-forget request* verbs above: HTTP proxy routes need to await a
+   * body, and the WS handlers are simpler for it too.
+   *
+   * Never rejects — a dead child, send failure, or timeout resolves as
+   * `{ok:false, error, status}` (502 unreachable, 504 timeout), so callers
+   * translate straight into a response without try/catch.
+   */
+  requestPanel(
+    childName: string,
+    op: string,
+    params?: Record<string, unknown>,
+    timeoutMs = 30_000,
+  ): Promise<{ ok: boolean; data?: unknown; error?: string; status?: number }> {
+    const child = this.children.get(childName);
+    if (!child || !child.socket) {
+      return Promise.resolve({
+        ok: false,
+        error: child ? `child '${childName}' is ${child.status}, not running` : `unknown child: ${childName}`,
+        status: child ? 502 : 404,
+      });
+    }
+    const corrId = `panel-${op}-${++this.panelSeq}-${Date.now().toString(36)}`;
+    return new Promise((resolvePanel) => {
+      let settled = false;
+      const finish = (result: { ok: boolean; data?: unknown; error?: string; status?: number }): void => {
+        if (settled) return;
+        settled = true;
+        unsub();
+        clearTimeout(timer);
+        resolvePanel(result);
+      };
+      const unsub = this.onChildEvent(childName, (_name, evt) => {
+        if (evt.type !== 'panel-response') return;
+        const e = evt as unknown as PanelResponseEvent;
+        if (e.corrId !== corrId) return;
+        finish({
+          ok: e.ok === true,
+          ...(e.data !== undefined ? { data: e.data } : {}),
+          ...(typeof e.error === 'string' ? { error: e.error } : {}),
+          ...(typeof e.status === 'number' ? { status: e.status } : {}),
+        });
+      });
+      const timer = setTimeout(() => {
+        finish({ ok: false, error: `panel op '${op}' timed out after ${timeoutMs}ms (child '${childName}' unresponsive)`, status: 504 });
+      }, timeoutMs);
+      try {
+        this.sendToChild(child, { type: 'panel-request', op, ...(params ? { params } : {}), corrId });
+      } catch (err) {
+        finish({ ok: false, error: `send to child failed: ${err instanceof Error ? err.message : String(err)}`, status: 502 });
+      }
+    });
+  }
+
   private async killChild(child: FleetChild): Promise<void> {
     if (child.status === 'exited' || child.status === 'crashed') return;
     const proc = child.process;

package/src/modules/fleet-types.ts

@@ -38,7 +38,18 @@ export type IncomingCommand =
    *  `cancel-subagent-result`. The child looks the agent up in its own
    *  SubagentModule, so this is the only way to stop a subagent that lives
    *  in a fleet child rather than the conductor. */
-  | { type: 'cancel-subagent'; name: string; corrId?: string };
+  | { type: 'cancel-subagent'; name: string; corrId?: string }
+  /**
+   * Run one operator-panel operation in the child (see PANEL_OPS in
+   * src/web/panel-data.ts: mcpl / settings(-update|-reset|-cancel-transition)
+   * / pins / pin-add / pin-remove / health / context-makeup /
+   * context-coverage / context-curve / context-preview / debug-context).
+   * Response is a single `panel-response` with the same corrId. One generic
+   * verb rather than a verb per panel: both ends dispatch through the SAME
+   * shared handler (`runPanelOp`), so a new panel surface needs no protocol
+   * change to work across the fleet.
+   */
+  | { type: 'panel-request'; op: string; params?: Record<string, unknown>; corrId?: string };
 
 // ---------------------------------------------------------------------------
 // Child → Parent: events
@@ -134,6 +145,23 @@ export interface CancelSubagentResultEvent {
   ts?: number;
 }
 
+/** Response to a {type:'panel-request'} request. `data` is the same
+ *  wire-shaped JSON the WebUI host serves locally for the given op;
+ *  `ok:false` carries the error plus an HTTP-ish `status` so the parent's
+ *  proxy routes can answer faithfully (404 unknown agent, 429 preview
+ *  cooldown, 501 unsupported build). */
+export interface PanelResponseEvent {
+  type: 'panel-response';
+  corrId?: string;
+  /** Echo of the requested op. */
+  op: string;
+  ok: boolean;
+  data?: unknown;
+  error?: string;
+  status?: number;
+  ts?: number;
+}
+
 /** Response to a {type:'request-workspace-file'} request. */
 export interface WorkspaceFileSnapshotEvent {
   type: 'workspace-file-snapshot';
@@ -163,6 +191,7 @@ export type WireEvent =
   | WorkspaceTreeSnapshotEvent
   | WorkspaceFileSnapshotEvent
   | CancelSubagentResultEvent
+  | PanelResponseEvent
   // Arbitrary framework TraceEvent passthrough. The child stamps every emitted
   // event with `ts: Date.now()` in `emit()` (see headless.ts), so ts is always
   // present on the wire even when the underlying TraceEvent doesn't declare it.