@animalabs/connectome-host 0.7.4 → 0.8.1

package/src/index.ts

@@ -10,7 +10,7 @@
  *   bun src/index.ts --headless --exit-when-idle   # One-shot: exit when agents go idle after first inference
  *
  * Environment variables:
- *   ANTHROPIC_API_KEY   - Required
+ *   ANTHROPIC_API_KEY   - Required (not needed for recipe provider "mock")
  *   MODEL               - Override model (default: from recipe or claude-opus-4-6)
  *   DATA_DIR            - Data directory for sessions (default: ./data)
  */
@@ -19,18 +19,21 @@ import {
   AnthropicXmlFormatter,
   BedrockAdapter,
   Membrane,
+  MockAdapter,
   NativeFormatter,
   OpenAIResponsesAPIAdapter,
   OpenAIResponsesFormatter,
+  OpenAICompatibleAdapter,
   OpenRouterAdapter,
 } from '@animalabs/membrane';
 import { LoggingAnthropicAdapter } from './logging-adapter.js';
 import { LoggingProviderAdapter } from './logging-provider-wrapper.js';
+import { gateTelemetryHeaders, stampedTrigger, type TurnTrigger } from './gate-telemetry.js';
 import { LoggingBedrockAdapter } from './logging-bedrock-adapter.js';
 import { CodexSubscriptionAdapter } from './codex-subscription-adapter.js';
 import { CallLedger } from './call-ledger.js';
 import { SettingsModule } from './modules/settings-module.js';
-import { AgentFramework, WorkspaceModule, resolveTimeZone, type Module, type MountConfig } from '@animalabs/agent-framework';
+import { AgentFramework, WorkspaceModule, resolveTimeZone, type Module } from '@animalabs/agent-framework';
 import { resolve, join, basename } from 'node:path';
 import { appendFile, mkdir, stat, rename } from 'node:fs/promises';
 import { readFileSync, existsSync } from 'node:fs';
@@ -38,7 +41,6 @@ import { SubagentModule } from './modules/subagent-module.js';
 import { LessonsModule } from './modules/lessons-module.js';
 import { RetrievalModule } from './modules/retrieval-module.js';
 import { buildRetrievalModuleConfig } from './retrieval-config.js';
-import type { RecipeWorkspaceMount } from './recipe.js';
 import { TuiModule } from './modules/tui-module.js';
 import { TimeModule } from './modules/time-module.js';
 import { FleetModule, type FleetModuleConfig } from './modules/fleet-module.js';
@@ -50,14 +52,15 @@ import { ObserversModule } from './modules/observers-module.js';
 import { IdentityModule } from './modules/identity-module.js';
 import { McplAdminModule } from './modules/mcpl-admin-module.js';
 import { TtsRelayModule } from './modules/tts-relay-module.js';
-import { loadMcplServers, applyAgentOverlay, DEFAULT_CONFIG_PATH, DEFAULT_AGENT_OVERLAY_PATH } from './mcpl-config.js';
+import { InstructionsModule } from './modules/instructions-module.js';
+import { loadMcplServers, applyAgentOverlay, composeMcplChildEnv, DEFAULT_CONFIG_PATH, DEFAULT_AGENT_OVERLAY_PATH } from './mcpl-config.js';
 import { SessionManager } from './session-manager.js';
 import { resolveAgentName } from './agent-name.js';
 import { generateSessionName } from './synesthete.js';
 import {
   type Recipe,
   DEFAULT_RECIPE,
-  loadRecipe,
+  loadRecipeDetailed,
   saveRecipe,
   loadSavedRecipe,
   clearSavedRecipe,
@@ -65,7 +68,9 @@ import {
 } from './recipe.js';
 import { createBranchState, resetBranchState, handleExport, type BranchState } from './commands.js';
 import { buildFrameworkAgentConfig, membraneCachingOverride } from './framework-agent-config.js';
-import { buildFrameworkStrategy } from './framework-strategy.js';
+import { buildFrameworkStrategy, buildConversationsConfig } from './framework-strategy.js';
+import { buildWorkspaceMounts } from './workspace-mounts.js';
+import { logKeepaliveEvent } from './cache-keepalive-log.js';
 import { loadExtensions } from './extensions.js';
 
 export type { AppContext };
@@ -80,6 +85,10 @@ const config = {
   authToken: process.env.ANTHROPIC_AUTH_TOKEN,
   openaiApiKey: process.env.OPENAI_API_KEY,
   openrouterApiKey: process.env.OPENROUTER_API_KEY,
+  // Deliberately NO fallback to OPENAI_API_KEY: agent.baseUrl is
+  // recipe-controlled, so a fallback would silently send a real OpenAI
+  // credential as a Bearer token to whatever endpoint a recipe names.
+  openaiCompatibleApiKey: process.env.OPENAI_COMPATIBLE_API_KEY,
   codexBinary: process.env.CODEX_BINARY,
   model: process.env.MODEL,
   dataDir: process.env.DATA_DIR || './data',
@@ -128,8 +137,10 @@ async function resolveRecipe(): Promise<Recipe> {
 
   if (source) {
     try {
-      const recipe = await loadRecipe(source);
-      saveRecipe(config.dataDir, recipe);
+      // Save the unresolved (pre-substitution) form: $DATA_DIR is typically
+      // host-mounted and backed up, so resolved secrets must never land there.
+      const { recipe, persistable } = await loadRecipeDetailed(source);
+      saveRecipe(config.dataDir, persistable);
       console.log(`Loaded recipe: ${recipe.name}${recipe.description ? ` — ${recipe.description}` : ''}`);
       return recipe;
     } catch (err) {
@@ -138,11 +149,21 @@ async function resolveRecipe(): Promise<Recipe> {
     }
   }
 
-  // Try saved recipe
-  const saved = loadSavedRecipe(config.dataDir);
-  if (saved) {
-    console.log(`Resuming recipe: ${saved.name}`);
-    return saved;
+  // Try saved recipe. Re-resolves ${VAR} references against the CURRENT
+  // environment, so a missing secret fails loudly here rather than starting
+  // a misconfigured agent on the default recipe.
+  try {
+    const saved = await loadSavedRecipe(config.dataDir);
+    if (saved) {
+      console.log(`Resuming recipe: ${saved.name}`);
+      return saved;
+    }
+  } catch (err) {
+    console.error(
+      `Failed to resume saved recipe from ${config.dataDir}:`,
+      err instanceof Error ? err.message : err,
+    );
+    process.exit(1);
   }
 
   return DEFAULT_RECIPE;
@@ -260,48 +281,30 @@ async function createFramework(
   // Note: workspace: false disables ALL filesystem access (both read and write).
   // Previously LocalFilesModule was always-on; this is an intentional change —
   // recipes that need read-only access should keep workspace enabled (the default).
+  // Mount construction lives in workspace-mounts.ts so recipe validation
+  // reasons over the SAME mount flags the runtime builds (see that file's
+  // header for why).
   let workspaceModule: WorkspaceModule | null = null;
-  if (modules.workspace !== false) {
-    let mounts: MountConfig[];
-    if (typeof modules.workspace === 'object' && modules.workspace.mounts) {
-      // Only pass fields the recipe explicitly provides; let WorkspaceModule default the rest.
-      // We override watch to 'never' since FKM doesn't need chokidar filesystem watchers.
-      mounts = modules.workspace.mounts.map((m: RecipeWorkspaceMount) => {
-        const mount: MountConfig = {
-          name: m.name,
-          path: resolve(m.path),
-          mode: m.mode ?? 'read-write',
-          watch: m.watch ?? 'never', // FKM: no chokidar watchers by default
-        };
-        if (m.ignore) mount.ignore = m.ignore;
-        if (m.wakeOnChange !== undefined) mount.wakeOnChange = m.wakeOnChange;
-        if (m.autoMaterialize !== undefined) mount.autoMaterialize = m.autoMaterialize;
-        return mount;
-      });
-    } else {
-      // Default: read-only input mount + read-write products mount
-      mounts = [
-        { name: 'input', path: resolve('./input'), mode: 'read-only', watch: 'never' },
-        { name: 'products', path: resolve('./output'), mode: 'read-write', watch: 'never' },
-      ];
-    }
-
-    // Config mount: version-controls gate.json (and future config files) via Chronicle.
-    // Opt-in via recipe: workspace.configMount = true
-    const wantConfigMount = typeof modules.workspace === 'object' && modules.workspace.configMount;
-    if (wantConfigMount) {
-      mounts.push({
-        name: '_config',
-        path: resolve(join(storePath, 'config')),
-        mode: 'read-write',
-        watch: 'always',
-      });
-    }
-
-    workspaceModule = new WorkspaceModule({ mounts });
+  const workspaceMounts = buildWorkspaceMounts(modules.workspace, storePath);
+  if (workspaceMounts) {
+    workspaceModule = new WorkspaceModule({ mounts: workspaceMounts });
     moduleInstances.push(workspaceModule);
   }
 
+  // Shared operating instructions — opt-in per recipe. Injects a living
+  // instructions document (read through a workspace mount) into EVERY
+  // agent's context on every turn — resident and ephemeral subagents alike —
+  // via gatherContext. Requires the workspace module; validateRecipe rejects
+  // the instructions+`workspace: false` pairing, so workspaceModule is
+  // non-null here (the guard keeps the module fail-open regardless).
+  if (modules.instructions) {
+    const instructionsConfig =
+      typeof modules.instructions === 'object' ? modules.instructions : {};
+    const instructionsModule = new InstructionsModule(instructionsConfig);
+    if (workspaceModule) instructionsModule.setWorkspace(workspaceModule);
+    moduleInstances.push(instructionsModule);
+  }
+
   // Activity (typing indicators) — opt-in per recipe
   let activityModule: ActivityModule | null = null;
   if (modules.activity !== undefined && modules.activity !== false) {
@@ -461,9 +464,11 @@ async function createFramework(
   const finalServers = applyAgentOverlay(allServers, DEFAULT_AGENT_OVERLAY_PATH).map((server) => {
     const withEnv: { id: string; command?: string; url?: string; [k: string]: unknown } = {
       ...server,
-      // Stdio MCPL children inherit a single agent-facing wall clock. Protocol
-      // timestamps remain UTC; only their rendered text uses this setting.
-      env: { ...(server.env ?? {}), AGENT_TIMEZONE: timeZone },
+      // Stdio MCPL children inherit a single agent-facing wall clock plus the
+      // framework's refusal-annotation suppression baseline (operator env
+      // supersedes the baseline; see composeMcplChildEnv). Protocol
+      // timestamps remain UTC; only their rendered text uses AGENT_TIMEZONE.
+      env: composeMcplChildEnv(server.env as Record<string, string> | undefined, timeZone),
     };
     // `access` is a declarative name (recipe/file/overlay); the credential
     // provider it implies is attached HERE, at load time — fresh credential
@@ -489,6 +494,10 @@ async function createFramework(
   const strategy = buildFrameworkStrategy(recipe, model, timeZone, extensionRegistry);
   const agentConfig = buildFrameworkAgentConfig(recipe, agentName, model, strategy);
 
+  // Per-channel conversation routing: the recipe agent becomes the trunk
+  // template; forks get a fresh instance of the same recipe strategy.
+  const conversations = buildConversationsConfig(recipe, agentName, model, timeZone, extensionRegistry);
+
   // -- Create framework --
   const framework = await AgentFramework.create({
     storePath,
@@ -500,6 +509,10 @@ agents: [agentConfig],
     timeZone,
     // Client-side programmatic tool calling (code_execution) — recipe opt-in.
     ...(recipe.codeExecution ? { codeExecution: recipe.codeExecution } : {}),
+    ...(conversations ? { conversations } : {}),
+    // Tune-out's subconscious resident (agent-framework#77) — recipe opt-in,
+    // passed through verbatim; the framework owns the defaults.
+    ...(recipe.subconscious ? { subconscious: recipe.subconscious } : {}),
   });
 
   // Wire post-creation hooks
@@ -872,6 +885,16 @@ async function main() {
         fastMode: recipe.agent.codex?.fastMode ?? false,
       })
     : undefined;
+  // Generic OpenAI-compatible chat-completions endpoint (Ollama, vLLM, Together,
+  // Groq, NanoGPT, ...). The recipe carries the endpoint (agent.baseUrl,
+  // validated at load); the key is optional because local servers have none.
+  const openaiCompatibleAdapter = provider === 'openai-compatible'
+    ? new OpenAICompatibleAdapter({
+        baseURL: recipe.agent.baseUrl!,
+        apiKey: config.openaiCompatibleApiKey || undefined,
+        providerName: 'openai-compatible',
+      })
+    : undefined;
   const openrouterAdapter = provider === 'openrouter'
     ? new OpenRouterAdapter({
         apiKey: config.openrouterApiKey!,
@@ -890,9 +913,98 @@ async function main() {
   // live probe 2026-07-31. Still no CallLedger — it's
   // anthropic-transport-only for now; cache metrics are visible in
   // llm-calls.jsonl via the logging wrapper.
+  // BEDROCK_BASE_URL routes bedrock-runtime calls through an inference
+  // gateway (gate.animalabs.ai/bedrock/<credSet>) — mirrors the
+  // ANTHROPIC_BASE_URL hook below. The gate reads the agent token from the
+  // SigV4 Credential (AWS_ACCESS_KEY_ID slot), discards the client
+  // signature, and re-signs with real AWS creds held on the gate box.
   const bedrockAdapter = provider === 'bedrock'
-    ? new LoggingBedrockAdapter({}, llmLogPath)
+    ? new LoggingBedrockAdapter(
+        { baseURL: process.env.BEDROCK_BASE_URL || undefined },
+        llmLogPath,
+      )
+    : undefined;
+  // Mock: membrane's canned/echo adapter — the full host loop with zero
+  // provider spend and no credentials (none of the key checks above are
+  // gated on it). Echo is the default because it's the informative shape
+  // for interactive smoke runs; recipe agent.mock.echoMode=false switches
+  // to defaultResponse for deterministic scripted output. It rides the
+  // generic logging decorator so even mock calls leave llm-calls.jsonl
+  // receipts — the observability path is part of what a mock run exercises.
+  const mockAdapter = provider === 'mock'
+    ? new MockAdapter({
+        echoMode: recipe.agent.mock?.echoMode ?? true,
+        ...(recipe.agent.mock?.defaultResponse !== undefined
+          ? { defaultResponse: recipe.agent.mock.defaultResponse }
+          : {}),
+      })
     : undefined;
+  // -- x-gate-debt-chunks stamp (membrane dynamicHeaders, antra-tess/membrane#65)
+  // The gate records compression-debt per ledger row; debt only changes at
+  // calls, so the per-call series is its full-resolution history ("spoke ->
+  // chunk appeared -> chewed" vs "solver repacked -> queue spiked"). The value
+  // is the SAME reduction /healthz reports (cm getCompressionDebt). Late-bound
+  // through appRef because the framework outlives adapter construction and is
+  // replaced on session switch. Whenever it is unreadable — no framework yet,
+  // multi-agent process (whose debt would we even claim?), no strategy — the
+  // header is simply not sent: an unstamped call is honest, a guessed one lies.
+  let appRefForDebt: AppContext | null = null;
+  // The resident whose turn/debt we stamp. TODO(agent-framework ≥0.14): use a
+  // public getPrimaryAgentName() accessor instead of the private field read.
+  const primaryAgent = (): { name: string; agent: unknown } | null => {
+    const fw = appRefForDebt?.framework;
+    const agents = fw?.getAllAgents() ?? [];
+    const name = (fw as unknown as { primaryAgentName?: string } | undefined)?.primaryAgentName
+      ?? (agents.length === 1 ? agents[0]!.name : undefined);
+    if (!name) return null;
+    const agent = agents.find((a) => a.name === name);
+    return agent ? { name, agent } : null;
+  };
+  const pendingDebtChunks = (): number | null => {
+    try {
+      const p = primaryAgent();
+      if (!p) return null;
+      const strategy = (p.agent as unknown as {
+        getContextManager?: () => { getStrategy?: () => { getCompressionDebt?: () => unknown } };
+      }).getContextManager?.()?.getStrategy?.();
+      const d = strategy?.getCompressionDebt?.() as { pendingChunks?: unknown } | undefined;
+      const n = d?.pendingChunks;
+      return typeof n === 'number' && Number.isFinite(n) && n >= 0 ? Math.round(n) : null;
+    } catch {
+      return null;
+    }
+  };
+
+  // Why the turn in progress fired (heartbeat / a channel message by whom /
+  // operator), read from the framework's active-turn trigger. Same guards as
+  // the debt getter: no framework or several agents
+  // -> null -> the origin trio is simply not sent.
+  const activeTurnTrigger = (): TurnTrigger | null => {
+    try {
+      const fw = appRefForDebt?.framework;
+      if (!fw) return null;
+      const agents = fw.getAllAgents();
+      // ONE adapter serves every agent in this process, so this hook cannot
+      // tell whose request it is decorating: stamp the primary's trigger only
+      // while no other agent (subconscious, fork, ephemeral) has a turn in
+      // flight — see stampedTrigger().
+      const t = stampedTrigger({
+        agents: agents.map((a) => a.name),
+        primary: primaryAgent()?.name,
+        triggerOf: (name) => {
+          const r = fw.getActiveTurnTrigger(name) as
+            (ReturnType<typeof fw.getActiveTurnTrigger> & { wakeChannelId?: string }) | undefined;
+          return r ? { reason: r.reason, source: r.source, channelId: r.channelId, wakeChannelId: r.wakeChannelId, counterparty: r.counterparty } : null;
+        },
+      });
+      return t;
+    } catch {
+      return null;
+    }
+  };
+
+  const gateTelemetryDynamicHeaders = gateTelemetryHeaders(process.env, pendingDebtChunks, activeTurnTrigger);
+
   const adapter = provider === 'openai-responses'
     ? new LoggingProviderAdapter(
         new OpenAIResponsesAPIAdapter({
@@ -907,7 +1019,9 @@ async function main() {
     // `openrouterAdapter` instances stay un-wrapped for auth commands and
     // dispose() — only the membrane sees the wrapper.
     : bedrockAdapter
+      ?? (mockAdapter ? new LoggingProviderAdapter(mockAdapter, llmLogPath) : undefined)
       ?? (openrouterAdapter ? new LoggingProviderAdapter(openrouterAdapter, llmLogPath) : undefined)
+      ?? (openaiCompatibleAdapter ? new LoggingProviderAdapter(openaiCompatibleAdapter, llmLogPath) : undefined)
       ?? (codexAdapter ? new LoggingProviderAdapter(codexAdapter, llmLogPath) : undefined)
       ?? new LoggingAnthropicAdapter(
         {
@@ -929,6 +1043,29 @@ async function main() {
                   : {}),
               }),
           baseURL: process.env.ANTHROPIC_BASE_URL || undefined,
+          // Double-gated (see src/gate-telemetry.ts): GATE_TELEMETRY=1 AND a
+          // configured base URL, so the stamp can only ever go to a
+          // gateway the operator has declared — never to the vendor's
+          // default endpoint (review finding on the first wiring).
+          ...(gateTelemetryDynamicHeaders ? { dynamicHeaders: gateTelemetryDynamicHeaders } : {}),
+          // Hold this agent's cached prefix warm across idle gaps. Only fires
+          // when the entry is actually near expiry, so a busy agent costs
+          // nothing; only the 1h-TTL primary lane is eligible (the module
+          // skips anything else). Off with cacheKeepalive.enabled: false.
+          cacheKeepalive: {
+            enabled: recipe.agent.cacheKeepalive?.enabled !== false,
+            ...(recipe.agent.cacheKeepalive?.maxIdleHours !== undefined
+              ? { maxIdleMs: recipe.agent.cacheKeepalive.maxIdleHours * 60 * 60_000 }
+              : {}),
+            ...(recipe.agent.cacheKeepalive?.refreshAfterMinutes !== undefined
+              ? { refreshAfterMs: recipe.agent.cacheKeepalive.refreshAfterMinutes * 60_000 }
+              : {}),
+            // Every event — routine refreshes included — goes to stderr, so
+            // all of them land in service-stderr.log next to
+            // [inference-refusal]. See cache-keepalive-log.ts for why this is
+            // not severity-routed.
+            onEvent: logKeepaliveEvent,
+          },
         },
         llmLogPath,
         () => settingsModule.getReasoning(),
@@ -1019,6 +1156,8 @@ async function main() {
     },
   };
 
+  appRefForDebt = app;
+
   // Off-path refusal dragnet → ops alerts (observability M3): refusals on
   // non-streamed calls (compression/summarizer drains, maintenance) never
   // reach the framework's own noteRefusal — the 2026-07-15 mythos cascade

package/src/mcpl-config.ts

@@ -6,6 +6,7 @@
 
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
+import { REFUSAL_REACTION_BASELINE } from '@animalabs/agent-framework';
 
 /** Default config file path, resolved from cwd. */
 export const DEFAULT_CONFIG_PATH = resolve(process.cwd(), 'mcpl-servers.json');
@@ -134,10 +135,57 @@ export function saveAgentOverlay(
   writeFileSync(overlayPath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
 }
 
+/**
+ * Capabilities an agent-deployed server is never granted by default: the
+ * consequential surfaces — context hooks (observation of and injection into
+ * the agent's own inference), server-initiated inference, and inference
+ * lifecycle. Bare parents on purpose: the config mask's subtree matching
+ * denies everything beneath them, present and future (afterInference, undo,
+ * state land under these the day the vocabulary grows them). A world/chat
+ * server needs none of this — channels + tools is the whole job. An operator
+ * who wants a self-deployed server to hold one of these moves the server
+ * into the recipe, where `enabledCapabilities` is theirs to write.
+ */
+export const AGENT_DEPLOY_DENIED_CAPABILITIES: readonly string[] = [
+  'contextHooks',
+  'inferenceRequest',
+  'inferenceLifecycle',
+];
+
+/** The allow/deny list fields where an EMPTY array carries no intent (see
+ *  resolveOverlayEntry — OpenAI strict function calling forces every schema
+ *  property, so agent tool calls arrive with `[]` meaning "unspecified"). */
+const OVERLAY_LIST_FIELDS = [
+  'enabledFeatureSets',
+  'disabledFeatureSets',
+  'enabledTools',
+  'disabledTools',
+] as const;
+
 /**
  * Resolve an overlay entry into a server config object (id + fields, relative
  * `./`/`../` args resolved against the overlay file's directory). Returns
  * null for tombstones and entries with neither command nor url.
+ *
+ * The overlay is the AGENT's file, so resolution is also where host policy
+ * for self-deployed servers lives (applied at boot AND at deploy — existing
+ * files heal without a re-deploy):
+ *
+ *  - Empty allow/deny lists are treated as absent. OpenAI-style strict
+ *    function calling forces every schema property, so GPT-family residents
+ *    calling mcpl_deploy emit `[]` where they meant "unspecified" — and for
+ *    the allowlists PRESENT-empty is deny-all under the §5.3 pin (Mica's
+ *    silently eventless eidoverse, 2026-08-04). An agent that truly wants
+ *    deny-all says `disabledTools: ["*"]` / `disabledFeatureSets: ["*"]`.
+ *
+ *  - `enabledCapabilities` is dropped: the agent's file can narrow, never
+ *    widen — a hand-written entry here could re-grant §13.4 deny-by-default
+ *    paths.
+ *
+ *  - `disabledCapabilities` always carries at least
+ *    AGENT_DEPLOY_DENIED_CAPABILITIES (unioned with anything the entry
+ *    already denies): self-deployed servers get channels + tools and
+ *    nothing consequential by default.
  */
 export function resolveOverlayEntry(
   id: string,
@@ -148,9 +196,29 @@ export function resolveOverlayEntry(
   if (!entry.command && !entry.url) return null;
   const overlayDir = dirname(resolve(overlayPath));
   const { disabled: _d, ...fields } = entry;
+  const rec = fields as Record<string, unknown>;
+  for (const k of OVERLAY_LIST_FIELDS) {
+    if (Array.isArray(rec[k]) && (rec[k] as unknown[]).length === 0) delete rec[k];
+  }
+  delete rec.enabledCapabilities;
+  // A network server the agent deployed should come back when it bounces.
+  // reconnect defaulted to false, so an entry that never said `reconnect:
+  // true` was severed PERMANENTLY by any server restart — with no signal to
+  // anyone — until the agent's own next restart, which for a long-lived
+  // resident is days away (Mythos, eventless in eidoverse after the
+  // 2026-08-04 door deploy). Websocket entries now default to reconnect
+  // unless the entry explicitly says false. Stdio entries keep the old
+  // default: reconnect does not respawn a dead child anyway (mcpl_restart
+  // is that path), so `true` there would promise something it can't do.
+  if (entry.url && rec.reconnect === undefined) rec.reconnect = true;
+  const denied = new Set<string>([
+    ...AGENT_DEPLOY_DENIED_CAPABILITIES,
+    ...(Array.isArray(rec.disabledCapabilities) ? (rec.disabledCapabilities as unknown[]).map(String) : []),
+  ]);
   return {
     id,
-    ...fields,
+    ...rec,
+    disabledCapabilities: [...denied].sort(),
     ...(entry.args
       ? {
           args: entry.args.map(arg =>
@@ -206,3 +274,33 @@ export function saveMcplServers(configPath: string, servers: Record<string, Serv
   const data: McplServersFile = { mcplServers: servers };
   writeFileSync(configPath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
 }
+
+/**
+ * Compose the environment for a stdio MCPL child.
+ *
+ * Two host-owned values ride along with whatever the server entry declares:
+ *
+ * - `DISCORD_SUPPRESSED_REACTIONS_BASELINE` — the framework's exported
+ *   refusal-annotation set (REFUSAL_REACTION_BASELINE, comma-joined), so a
+ *   never-configured Discord adapter defaults to suppressing exactly the
+ *   markers this host's framework stamps. Placed BEFORE the spread: an
+ *   operator who sets the var on the server entry supersedes the house
+ *   baseline — the host injects a default, never overrides a decision. The
+ *   adapter's own precedence (file key incl. [] → legacy operator env →
+ *   baseline) then decides what is actually enforced; house markers are
+ *   Host semantics, and a standalone adapter without this composition stays
+ *   honestly unprotected.
+ * - `AGENT_TIMEZONE` — after the spread, deliberately: the agent-facing
+ *   wall clock is resolved per-recipe by the host and is not a per-server
+ *   operator knob.
+ */
+export function composeMcplChildEnv(
+  serverEnv: Record<string, string> | undefined,
+  timeZone: string,
+): Record<string, string> {
+  return {
+    DISCORD_SUPPRESSED_REACTIONS_BASELINE: REFUSAL_REACTION_BASELINE.join(','),
+    ...(serverEnv ?? {}),
+    AGENT_TIMEZONE: timeZone,
+  };
+}