@brutalsystems/muster 0.7.12 → 0.7.15

package/dist/identity-cli.js

@@ -0,0 +1,88 @@
+import { identityAuthState } from "./identity-auth.js";
+import { IdentityError, identityDirExists, identityMetaSchema, identityNameSchema, identityPath, listIdentities, readIdentity, writeIdentity, } from "./identity-store.js";
+/**
+ * The one-time login for each agent. Muster never performs it: each is an
+ * interactive OAuth flow, and a command that appeared to do it for you would be
+ * hiding a credential prompt.
+ */
+function loginCommand(agent, dir) {
+    if (agent === "claude")
+        // setup-token first, and not as an alternative: a launch runs from a COPY of
+        // this directory, and the keychain credential an interactive /login writes is
+        // keyed to THIS path, so it cannot be reached from a copy. Only a token can.
+        return `CLAUDE_CONFIG_DIR=${dir} claude setup-token    # then export the token and pass --token-env`;
+    if (agent === "codex")
+        return `CODEX_HOME=${dir} codex login`;
+    return `OPENCODE_CONFIG_DIR=${dir} opencode auth login`;
+}
+export async function setupIdentity(opts) {
+    const name = identityNameSchema.parse(opts.name);
+    // token_env is consumed ONLY by identityEnv's Claude branch, and
+    // identityAuthState ignores it for the others — while the launch path refuses
+    // when the named variable is unset. So on a codex or opencode identity it has
+    // exactly one effect: a new way to fail. Refused where the operator types it.
+    if (opts.tokenEnv && opts.agent !== "claude")
+        throw new IdentityError(name, `--token-env applies only to a claude identity; ${opts.agent} authenticates from an auth file in the template, and a token variable here would only add a way for the launch to fail`);
+    // Distinguish "no such identity" from "an identity that is there but unusable".
+    // Overwriting the second would silently repurpose a directory that still holds
+    // another agent's credential.
+    const present = await identityDirExists(opts.home, name);
+    let created = true;
+    let existing;
+    if (present) {
+        created = false;
+        existing = await readIdentity(opts.home, name); // throws if unusable
+        if (existing.agent !== opts.agent)
+            throw new IdentityError(name, `already exists for agent ${existing.agent}; refusing to repurpose it for ${opts.agent}`);
+    }
+    // An operator who passes --token-env means it to take effect, even on an
+    // identity that already has one recorded — that's the whole point of this
+    // command's remedy path (see issue #59). Omitting the flag on a re-run must
+    // leave whatever is recorded alone, which is why this only fires when a
+    // value was actually supplied and it differs from what's already there.
+    const tokenEnvChanged = opts.tokenEnv !== undefined && opts.tokenEnv !== existing?.token_env;
+    const meta = identityMetaSchema.parse({
+        agent: opts.agent,
+        // Preserve the original creation timestamp for an existing identity;
+        // only a brand-new directory gets a fresh one.
+        created: existing?.created ?? new Date().toISOString(),
+        ...(opts.tokenEnv !== undefined
+            ? { token_env: opts.tokenEnv }
+            : existing?.token_env
+                ? { token_env: existing.token_env }
+                : {}),
+    });
+    if (created || tokenEnvChanged)
+        await writeIdentity(opts.home, name, meta);
+    const current = await readIdentity(opts.home, name);
+    const dir = identityPath(opts.home, name);
+    return {
+        created,
+        path: dir,
+        login: loginCommand(current.agent, dir),
+        auth: await identityAuthState(opts.home, name, current, opts.env ?? process.env),
+    };
+}
+export async function describeIdentities(home, env, 
+/** Profile grants, so stale ones surface without a launch having to fail. */
+grants = {}) {
+    const found = await listIdentities(home);
+    const identities = [];
+    for (const { name, meta } of found)
+        identities.push({
+            name,
+            agent: meta.agent,
+            auth: await identityAuthState(home, name, meta, env),
+        });
+    // A profile granting an identity that does not exist is a misconfiguration.
+    // It is deliberately NOT checked in loadConfig: Muster reads its config for
+    // every command, so failing there would stop `list` and `stop` working and
+    // turn a stale grant into a total outage.
+    const names = new Set(found.map((i) => i.name));
+    const staleGrants = [];
+    for (const [profile, granted] of Object.entries(grants))
+        for (const identity of granted)
+            if (!names.has(identity))
+                staleGrants.push({ profile, identity });
+    return { identities, staleGrants };
+}

package/dist/identity-copy.js

@@ -0,0 +1,184 @@
+import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import TOML from "@iarna/toml";
+import { identityPath } from "./identity-store.js";
+/**
+ * What a copy must contain: enough to start authenticated, onboarded, and
+ * trusting the launch directory. Deliberately not the template's cache, plugins
+ * or history — copying only this is what keeps retained copies proportional to
+ * the transcripts written into them rather than to the template's size.
+ *
+ * OpenCode entries are settled against the installed 1.18.32 binary, not
+ * guessed (see task-4-report.md for the full evidence trail):
+ *   - CONFIG resolves as `OPENCODE_CONFIG_DIR ?? XDG_CONFIG_HOME/opencode`,
+ *     used as-is with no suffix appended. The real file the binary reads on
+ *     this machine is `opencode.jsonc` (confirmed at ~/.config/opencode —
+ *     `config.json` and `opencode.json` are also checked, in that order, but
+ *     neither exists here; `opencode.jsonc` is the one actually in use).
+ *   - DATA always resolves as `XDG_DATA_HOME/opencode` — the "opencode"
+ *     suffix is hardcoded in the binary and cannot be overridden
+ *     independently (there is no OPENCODE_DATA_DIR). Its auth file is
+ *     `<data>/auth.json`, confirmed against the string join(e.Path.data,
+ *     "auth.json") in the binary and against the real file at
+ *     ~/.local/share/opencode/auth.json on this machine.
+ * So the copy reproduces that shape under a `data/` subdirectory, and
+ * `identityEnv` points XDG_DATA_HOME at it (see below). This was NOT
+ * verified end to end against an authenticated OpenCode identity — no one
+ * has run the one-time login for one on this machine, so there is no
+ * template to copy from and launch. The config/data path resolution above is
+ * verified from the binary's own logic and the real on-disk layout; whether a
+ * copy built this way actually leaves OpenCode believing itself logged in on
+ * first launch is unverified.
+ */
+export const IDENTITY_FILES = {
+    claude: [".claude.json", "settings.json"],
+    codex: ["auth.json", "config.toml"],
+    opencode: ["opencode.jsonc", join("data", "opencode", "auth.json")],
+};
+export const identityLiveDir = (home, launchId) => join(home, "identities-live", launchId);
+export async function copyIdentity(home, name, meta, launchId) {
+    const from = identityPath(home, name);
+    const to = identityLiveDir(home, launchId);
+    await mkdir(to, { recursive: true, mode: 0o700 });
+    for (const file of IDENTITY_FILES[meta.agent]) {
+        const dest = join(to, file);
+        // A declared file may nest inside a subdirectory (opencode's data/opencode/
+        // auth.json) — the destination directory needs to exist before copyFile can
+        // write into it. Not swallowed: if the parent cannot be created, that must
+        // surface rather than leave the file silently absent from the copy.
+        await mkdir(dirname(dest), { recursive: true });
+        try {
+            await copyFile(join(from, file), dest);
+        }
+        catch (e) {
+            // A template legitimately lacks a file until the agent writes one — a new
+            // identity has no settings.json yet. Anything else is a real failure, and
+            // hiding it would launch an agent that cannot authenticate with no signal.
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+    }
+    return to;
+}
+/**
+ * The variables the AGENT receives. Muster's own subprocesses never get these:
+ * a version probe pointed at a per-launch copy answers the wrong question.
+ */
+export function identityEnv(meta, copyPath, sourceEnv) {
+    if (meta.agent === "codex")
+        return { CODEX_HOME: copyPath };
+    if (meta.agent === "opencode")
+        // OPENCODE_CONFIG_DIR replaces the config root outright, so it is set to
+        // copyPath directly. XDG_DATA_HOME is different: the binary hardcodes an
+        // "opencode" suffix onto whatever XDG_DATA_HOME is, so XDG_DATA_HOME must be
+        // set one level ABOVE where the files actually land (copyPath/data, not
+        // copyPath/data/opencode) for that suffix to land back on the copy.
+        return {
+            OPENCODE_CONFIG_DIR: copyPath,
+            XDG_DATA_HOME: join(copyPath, "data"),
+        };
+    const env = { CLAUDE_CONFIG_DIR: copyPath };
+    if (meta.token_env) {
+        const token = sourceEnv[meta.token_env];
+        // Absence is the caller's problem to report before spawning; see run.ts.
+        if (typeof token === "string" && token.length)
+            env.CLAUDE_CODE_OAUTH_TOKEN = token;
+    }
+    return env;
+}
+/**
+ * Set Claude Code's workspace-trust flag for one directory, inside a copy Muster
+ * just created. The live `~/.claude.json` is never touched — that file is written
+ * continuously by every running session, and Muster cannot coordinate with it.
+ */
+export async function setWorkspaceTrust(copyPath, cwd) {
+    const file = join(copyPath, ".claude.json");
+    let data = {};
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (e) {
+        // The same rule identity-store.ts and copyIdentity settled on: a template
+        // that has never been logged into legitimately has no .claude.json, and a
+        // file containing only `projects` is valid. Anything else — EACCES, EISDIR —
+        // is a real failure, and swallowing it here discarded every onboarding flag
+        // the template's own login produced and wrote a file that had lost them.
+        if (e.code !== "ENOENT")
+            throw e;
+    }
+    if (raw !== undefined)
+        try {
+            data = JSON.parse(raw);
+        }
+        catch (e) {
+            // A file that EXISTS and does not parse is not "no file yet". Overwriting
+            // it would silently drop the copied template's onboarding state and leave
+            // an agent that re-onboards, or does not start at all, with no signal.
+            throw new Error(`${file} exists but is not valid JSON: ${String(e)}`);
+        }
+    const projects = (data.projects ?? {});
+    const existing = (projects[cwd] ?? {});
+    projects[cwd] = { ...existing, hasTrustDialogAccepted: true };
+    data.projects = projects;
+    await writeFile(file, JSON.stringify(data), { mode: 0o600 });
+}
+/**
+ * Set Codex's directory-trust flag for one directory, inside a copy Muster just
+ * created. Codex has its own gate, unrelated to Claude's: without a
+ * `[projects."<dir>"] trust_level = "trusted"` entry in the config.toml it
+ * reads, the TUI stops on "Do you trust the contents of this directory?" before
+ * it ever opens a thread. No thread is opened, so no thread-writer lock is
+ * written, so `resolveCodex` finds nothing and the launch burns its whole
+ * deadline reporting `no descendant runtime identity found`.
+ *
+ * A fresh identity copy has no `projects` table at all, which made EVERY Codex
+ * identity launch fail exactly that way — measured, not inferred: the pane was
+ * captured mid-launch sitting on the prompt while the copy filled with Codex's
+ * own sqlite state and never grew a `thread-writer-locks/` directory.
+ *
+ * `-c projects."<dir>".trust_level="trusted"` does NOT satisfy the gate. It
+ * parses and is accepted, and the prompt still appears: the check reads
+ * persisted config, so the entry has to be in the file.
+ *
+ * The user's real `~/.codex/config.toml` is never touched, for the same reason
+ * `setWorkspaceTrust` leaves the live `~/.claude.json` alone.
+ */
+export async function setCodexWorkspaceTrust(copyPath, cwd) {
+    const file = join(copyPath, "config.toml");
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (e) {
+        // A template that has never been logged into has no config.toml; Codex
+        // runs on defaults. Anything else — EACCES, EISDIR — is a real failure,
+        // and swallowing it would hand the agent a config missing every setting
+        // the template's own login wrote.
+        if (e.code !== "ENOENT")
+            throw e;
+    }
+    let data = {};
+    if (raw !== undefined)
+        try {
+            data = TOML.parse(raw);
+        }
+        catch (e) {
+            // A file that EXISTS and does not parse is not "no file yet". Codex would
+            // refuse it too, so writing over it trades one clear failure for a silent
+            // loss of the template's settings.
+            throw new Error(`${file} exists but is not valid TOML: ${String(e)}`);
+        }
+    const projects = (data.projects ?? {});
+    const existing = (projects[cwd] ?? {});
+    if (existing.trust_level === "trusted")
+        return;
+    projects[cwd] = { ...existing, trust_level: "trusted" };
+    data.projects = projects;
+    // Re-serialised rather than appended, so an entry the template already
+    // carries with a different trust_level is corrected instead of duplicated —
+    // a duplicate table is a TOML error and Codex would refuse the whole file.
+    // Comments and key order in the copy are lost; the copy is per-launch and
+    // machine-read, and the template it came from is untouched.
+    await writeFile(file, TOML.stringify(data), { mode: 0o600 });
+}

package/dist/identity-store.js

@@ -0,0 +1,101 @@
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+/**
+ * A named, pre-authenticated template configuration for one agent.
+ *
+ * The directory is 0700 because a Codex or OpenCode template contains that
+ * account's own auth file — written there by that agent's login, not by Muster,
+ * but on disk under `~/.muster` all the same. Deleting an identity deletes a
+ * credential.
+ */
+export const identityNameSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-zA-Z0-9_-]+$/, "must be letters, digits, dash or underscore");
+export const identityMetaSchema = z
+    .object({
+    agent: z.enum(["codex", "claude", "opencode"]),
+    created: z.string().min(1),
+    /** Name of the variable holding this identity's token. Never the token. */
+    token_env: z.string().min(1).optional(),
+})
+    .strict();
+/** A local problem with an identity: unknown, malformed, or unusable. */
+export class IdentityError extends Error {
+    identity;
+    constructor(identity, message) {
+        super(`identity ${identity}: ${message}`);
+        this.identity = identity;
+        this.name = "IdentityError";
+    }
+}
+export const identitiesDir = (home) => join(home, "identities");
+export const identityPath = (home, name) => {
+    // Wrapped so every identity problem is an IdentityError, as the error model
+    // promises — a raw schema error here would escape that contract and reach a
+    // caller as an unrecognisable shape.
+    const parsed = identityNameSchema.safeParse(name);
+    if (!parsed.success)
+        throw new IdentityError(name, "name must be letters, digits, dash or underscore");
+    return join(identitiesDir(home), parsed.data);
+};
+/** Whether the directory exists, regardless of whether its metadata is usable. */
+export async function identityDirExists(home, name) {
+    const dir = identityPath(home, name); // throws IdentityError for a bad name
+    try {
+        return (await stat(dir)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export async function writeIdentity(home, name, meta) {
+    const dir = identityPath(home, name);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await writeFile(join(dir, "identity.json"), JSON.stringify(identityMetaSchema.parse(meta), null, 2) + "\n", { mode: 0o600 });
+}
+export async function readIdentity(home, name) {
+    const file = join(identityPath(home, name), "identity.json");
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ENOENT")
+            throw new IdentityError(name, "not found — create it with setup-identity");
+        throw new IdentityError(name, `metadata could not be read (${code ?? String(e)})`);
+    }
+    try {
+        return identityMetaSchema.parse(JSON.parse(raw));
+    }
+    catch (e) {
+        throw new IdentityError(name, `metadata is unusable (${String(e)})`);
+    }
+}
+export async function listIdentities(home) {
+    let names;
+    try {
+        names = (await readdir(identitiesDir(home), { withFileTypes: true }))
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return [];
+        throw e;
+    }
+    const out = [];
+    for (const name of names)
+        try {
+            out.push({ name, meta: await readIdentity(home, name) });
+        }
+        catch {
+            // A directory without usable metadata is not an identity. `identities`
+            // reports store contents, and a half-made directory is not one.
+        }
+    return out;
+}

package/dist/log.js

@@ -1,15 +1,93 @@
-import { mkdir, open } from "node:fs/promises";
+import { mkdir, open, rename, stat } from "node:fs/promises";
 import { join } from "node:path";
+/**
+ * Fields a metadata-only record must not carry: the instruction itself, any
+ * captured screen or output, and anything environment-derived. Enough remains
+ * to diagnose a failed launch without holding what was asked.
+ *
+ * `args` is deliberately NOT dropped: `runtimeArgs` admits only `--model`,
+ * `-m`, `--effort`, `--agent` and `--variant`, so argv cannot carry instruction
+ * text or a credential, and keeping it is worth more for diagnosis than the
+ * nothing it exposes.
+ */
+export const METADATA_DROP = ["prompt", "diagnostic", "output", "env"];
+/**
+ * A nested launch record — a ready session's `peer`, a started task's `run` —
+ * is REBUILT from this allowlist in metadata mode rather than filtered by a
+ * drop list.
+ *
+ * `peer.name` and `peer.canonical_id` are slugs of the runtime's own session
+ * title, which every runtime derives from the prompt, so `{"name":
+ * "secret-instruction"}` reached a log the README calls promptless. A drop
+ * list would have fixed those two and let the next field someone adds to a
+ * peer through; an allowlist admits only what is named here, which is the set
+ * the spec enumerates for a metadata record.
+ */
+export const METADATA_RECORD_KEEP = [
+    "kind",
+    "id",
+    "runtime",
+    "state",
+    "cwd",
+    "host",
+    "pid",
+    "permissions",
+    "sandbox",
+    "enforcement",
+    "mcp",
+    "mcp_warnings",
+    "plugins",
+];
+/**
+ * `requester` is the one nested object passed through whole: the spec keeps the
+ * tuple and its label, and a label is supplied by the receiver's own config,
+ * never derived from the request.
+ */
+const PASS_THROUGH = ["requester"];
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * One generation, 8 MiB. The file had no bound at all before this.
+ *
+ * Rotation is not locked. Two processes crossing the ceiling together cannot
+ * lose a line — each write opens the file fresh, and a rename only clobbers
+ * the destination — but three or more crossing at once can, because a second
+ * clobber may take out an intermediate file that has already been closed.
+ * Accepted: the registry's lock exists for launch reservations, and coupling
+ * a best-effort history to it would cost more than the history is worth. If
+ * that trade ever stops holding, this is the place it changes.
+ */
+const MAX_BYTES = 8 * 1024 * 1024;
 export class LaunchLog {
     home;
     constructor(home) {
         this.home = home;
     }
-    async write(data) {
+    /**
+     * The caller chooses the mode; this method only obeys it. The policy that a
+     * non-local requester always gets `metadata`, and that a profile may not
+     * relax it, lives with the requester policy resolution, not here.
+     */
+    async write(data, mode = "full") {
         await mkdir(this.home, { recursive: true, mode: 0o700 });
-        const file = await open(join(this.home, "launches.jsonl"), "a", 0o600);
+        const path = join(this.home, "launches.jsonl");
+        const size = await stat(path)
+            .then((s) => s.size)
+            .catch(() => 0);
+        if (size >= MAX_BYTES)
+            await rename(path, path + ".1").catch(() => undefined);
+        const body = mode === "full"
+            ? data
+            : Object.fromEntries(Object.entries(data)
+                .filter(([k]) => !METADATA_DROP.includes(k))
+                .map(([k, v]) => isRecord(v) && !PASS_THROUGH.includes(k)
+                ? [
+                    k,
+                    Object.fromEntries(Object.entries(v).filter(([field]) => METADATA_RECORD_KEEP.includes(field))),
+                ]
+                : [k, v]));
+        const file = await open(path, "a", 0o600);
         try {
-            await file.writeFile(JSON.stringify({ at: new Date().toISOString(), ...data }) + "\n");
+            await file.writeFile(JSON.stringify({ at: new Date().toISOString(), ...body }) + "\n");
             await file.sync();
         }
         finally {

package/dist/mcp-tools.js

@@ -0,0 +1,134 @@
+/**
+ * The `run`, `list`, `stop` and `output` tools exactly as the MCP server
+ * advertises them.
+ *
+ * Extracted from `src/muster.ts` so it can be ASSERTED against `runSchema`
+ * rather than kept in step by hand. One request shape had two hand-maintained
+ * descriptions and nothing checked that they agreed, and four fields drifted
+ * across two branches: `level`, then `identity`, `model` and `plugin`. Because
+ * the schema is `additionalProperties: false`, an omitted key is not merely
+ * undocumented — a conformant client is told it is INVALID.
+ * `test/mcp-run-schema.test.ts` is what ends that class.
+ */
+export const MCP_TOOLS = [
+    {
+        name: "run",
+        description: "Launch an instructed agent. Sessions return only when reachable; tasks return a non-messageable run handle.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                runtime: {
+                    type: "string",
+                    enum: ["codex", "claude", "opencode"],
+                },
+                prompt: { type: "string", minLength: 1 },
+                cwd: { type: "string" },
+                kind: {
+                    type: "string",
+                    enum: ["session", "task"],
+                    default: "session",
+                },
+                host: {
+                    type: "string",
+                    enum: ["auto", "tmux", "pty", "macos-terminal"],
+                },
+                open: {
+                    type: "boolean",
+                    description: "Open the tmux session in a terminal viewer (macOS only).",
+                },
+                terminal: {
+                    type: "string",
+                    enum: ["auto", "terminal", "iterm2", "ghostty"],
+                    description: "Viewer app; requires open. Auto uses Terminal.app.",
+                },
+                permissions: {
+                    type: "string",
+                    enum: ["auto", "deny", "bypass"],
+                    description: "Defaults to config (deny). Auto requires workspace-write; bypass requires authorized full-access.",
+                },
+                sandbox: {
+                    type: "string",
+                    enum: ["read-only", "workspace-write", "full-access"],
+                    description: "Defaults to config (read-only). Full access requires config authorization.",
+                },
+                level: {
+                    type: "string",
+                    enum: ["read", "work", "open"],
+                    description: "A spelling of a legal permissions/sandbox pair: read is deny + read-only, work is auto + workspace-write, open is bypass + full-access. Naming a level and either flag is an error.",
+                },
+                mcp: {
+                    type: "array",
+                    items: { type: "string", pattern: "^[a-zA-Z0-9_-]+$" },
+                    description: "Configured MCP server names. Omit for session defaults; [] disables all. Tasks have no defaults.",
+                },
+                project: {
+                    type: "string",
+                    pattern: "^[a-zA-Z0-9_-]+$",
+                    description: "A project named in config.toml, used instead of cwd. Naming both is an error.",
+                },
+                requestKey: {
+                    type: "string",
+                    minLength: 1,
+                    maxLength: 200,
+                    description: "Caller-owned identity for this launch. Repeating it returns the launch it already produced instead of starting another; repeating it with different parameters is refused.",
+                },
+                plugin: {
+                    type: "array",
+                    items: { type: "string", pattern: "^[a-zA-Z0-9_-]+$" },
+                    description: "Configured OpenCode plugin names. Omit for session defaults; [] disables all. OpenCode only.",
+                },
+                model: {
+                    type: "string",
+                    minLength: 1,
+                    description: "PROVIDER/MODEL, overriding the configured [opencode] model. OpenCode only.",
+                },
+                identity: {
+                    type: "string",
+                    pattern: "^[a-zA-Z0-9_-]+$",
+                    description: "A named identity created by `muster setup-identity`; the agent runs as that account instead of inheriting the ambient environment. A non-local requester is bounded by its profile's identities.",
+                },
+                args: { type: "array", items: { type: "string" } },
+            },
+            required: ["runtime", "prompt"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "list",
+        description: "List Muster-owned sessions and tasks, including host capabilities.",
+        inputSchema: {
+            type: "object",
+            properties: { kind: { type: "string", enum: ["session", "task"] } },
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "stop",
+        description: "Stop a Muster-owned run by durable id or unambiguous peer name.",
+        inputSchema: {
+            type: "object",
+            properties: { id: { type: "string", minLength: 1 } },
+            required: ["id"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "output",
+        description: "Read captured output from a task run.",
+        inputSchema: {
+            type: "object",
+            properties: { id: { type: "string", minLength: 1 } },
+            required: ["id"],
+            additionalProperties: false,
+        },
+    },
+];
+/**
+ * runSchema keys deliberately absent from the advertised `run` inputSchema.
+ *
+ * Empty today, and it stays here rather than being implicit: adding a field to
+ * runSchema without either advertising it or naming it here — with a reason —
+ * fails the drift test. That is the point. An entry is a decision that MCP
+ * callers may not set the field, not a place to park an oversight.
+ */
+export const RUN_MCP_OMITTED = [];