@chorus-aidlc/chorus 0.14.4 → 0.14.5

package/.next/standalone/public/kiro-plugin/.kiro/skills/chorus-develop/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Development workflow — claim tasks, report work, manage se
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/kiro-plugin/.kiro/skills/chorus-idea/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Idea workflow — claim ideas, run elaboration rounds, and p
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/kiro-plugin/.kiro/skills/chorus-openspec-aware/SKILL.md

@@ -4,7 +4,7 @@ description: Opt-in OpenSpec-mode authoring for Chorus PM workflows in Kiro CLI.
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/kiro-plugin/.kiro/skills/chorus-proposal/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Proposal workflow — create proposals with document and tas
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/kiro-plugin/.kiro/skills/chorus-quick-dev/SKILL.md

@@ -4,7 +4,7 @@ description: Quick Task workflow — skip Idea→Proposal, create tasks directly
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/kiro-plugin/.kiro/skills/chorus-review/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Review workflow — approve/reject proposals, verify tasks,
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/kiro-plugin/.kiro/skills/chorus-yolo/SKILL.md

@@ -4,7 +4,7 @@ description: Full-auto AI-DLC pipeline — from prompt to done. Automates the en
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/kiro-plugin/bin/chorus-api.sh

@@ -240,7 +240,7 @@ cmd_mcp_tool() {
     # Step 1: Initialize MCP session
     local init_payload
     init_payload=$(cat <<JSONEOF
-{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"chorus-hook","version":"0.14.3"}}}
+{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"chorus-hook","version":"0.14.5"}}}
 JSONEOF
 )
 

package/.next/standalone/public/skill/brainstorm-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Optional divergent-then-convergent dialogue for fuzzy ideas. Invoke
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus AI Agent collaboration platform — overview, common tools,
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/code-reviewer-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Read-only adversarial Chorus code-review gateway — independently
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/develop-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Development workflow — claim tasks, report work, self-chec
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/idea-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Idea workflow — claim ideas, run elaboration rounds, and p
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chorus-skill",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "Chorus AI Agent collaboration platform skill. Supports PM, Developer, and Admin roles via MCP tools for the Idea-Proposal-Task workflow.",
   "author": "chorus",
   "license": "AGPL-3.0",

package/.next/standalone/public/skill/proposal-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Proposal workflow — create proposals with document and tas
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/proposal-reviewer-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Read-only adversarial Chorus proposal reviewer — audits PRD/task
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/quick-dev-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Quick Task workflow — skip Idea→Proposal, create tasks directly
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/review-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Review workflow — approve/reject proposals, verify tasks,
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/task-reviewer-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Read-only adversarial Chorus task reviewer — independently verifi
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/skill/yolo-chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Full-auto AI-DLC pipeline — drive a single prompt from Idea throu
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.14.3"
+  version: "0.14.5"
   category: project-management
   mcp_server: chorus
 ---

package/cli/claude-spawner.mjs

@@ -241,6 +241,8 @@ export function parseNdjsonChunk(buffer, chunk, onObject, onWarn = () => {}) {
  * @property {(o: object) => { stdin: any, stdout: any, stderr: any, on: Function, kill?: Function }} [spawnImpl]
  * @property {{info(m:string):void,warn(m:string):void,error(m:string):void}} [logger]
  * @property {PermissionMode} [permissionMode]  How much the woken Claude may do (default "chorus").
+ * @property {{ url: string, apiKey: string }} [creds] Daemon credentials exported
+ *   to the child for plugin hooks and shell-based Chorus tooling.
  * @property {NodeJS.Platform} [platform]  Injectable for tests; gates `detached` (POSIX-only).
  */
 
@@ -255,6 +257,7 @@ export class ClaudeSpawner {
     this.spawnImpl = opts.spawnImpl ?? spawn;
     this.logger = opts.logger ?? NOOP_LOGGER;
     this.permissionMode = opts.permissionMode ?? "chorus";
+    this.creds = opts.creds ?? null;
     // POSIX spawns `detached: true` (process-group leader) so the interrupt path
     // can group-kill the tree; Windows does not. Injectable so a POSIX test host
     // can exercise the Windows branch and vice versa.
@@ -318,6 +321,11 @@ export class ClaudeSpawner {
     // stream and observe the exit. On Windows `detached` is NOT used: taskkill /T
     // walks the tree by pid, and detached there only spawns a new console window.
     const detached = (this.platform ?? process.platform) !== "win32";
+    const childEnv = { ...process.env, CHORUS_DAEMON_HEADLESS: "1" };
+    if (this.creds) {
+      if (this.creds.url) childEnv.CHORUS_URL = this.creds.url;
+      if (this.creds.apiKey) childEnv.CHORUS_API_KEY = this.creds.apiKey;
+    }
 
     return new Promise((resolve) => {
       let child;
@@ -325,14 +333,9 @@ export class ClaudeSpawner {
         child = this.spawnImpl(command, argv, {
           cwd: cwd ?? process.cwd(),
           stdio: ["pipe", "pipe", "pipe"],
-          // Mark the child as a headless daemon-woken session (add-daemon-headless-
-          // interaction-guard). Merged OVER the inherited env so PATH, the Bedrock /
-          // credential vars, CLAUDE_CONFIG_DIR, etc. all survive — only this one var is
-          // added. It is a machine-checkable signal (the wake prompt also states it in
-          // text); this change only LAYS IT DOWN — no code here reads it back. Set
-          // unconditionally: the spawner only ever runs headless daemon wakes, so both
-          // "chorus" and "yolo" permission modes get it.
-          env: { ...process.env, CHORUS_DAEMON_HEADLESS: "1" },
+          // Preserve the inherited runtime environment while giving hooks and
+          // shell-based Chorus tooling the daemon's authoritative connection pair.
+          env: childEnv,
           // No shell:true — command is either the real executable or cmd.exe
           // with the script as an argv element. Avoids shell word-splitting /
           // injection; .cmd is handled explicitly via cmd.exe above.

package/cli/codex-spawner.mjs

@@ -13,17 +13,18 @@
 //     it and persist anchor→thread_id (codex-session-map.mjs) so a later wake can
 //     `resume <thread_id>`. (serde: ThreadEvent tag="type", rename="thread.started";
 //     ThreadStartedEvent.thread_id: String — codex-rs/exec/src/exec_events.rs.)
-//   • No `--mcp-config`: MCP comes from the user's ~/.codex/config.toml; the daemon
-//     key reaches it via the configured bearer_token_env_var (default
-//     CHORUS_API_KEY) exported into the child ENV — never argv.
+//   • No `--mcp-config`: MCP comes from the user's ~/.codex/config.toml. The daemon
+//     exports its resolved URL for SessionStart hooks and its key for the configured
+//     bearer_token_env_var (default CHORUS_API_KEY) — never argv.
 //   • Permission is a SANDBOX mode, not a tool allowlist.
 //
 // Reuses claude-spawner's platform-neutral helpers: parseNdjsonChunk (NDJSON
 // stream parse) and the PATH-walk shape of resolveClaudePath.
 
 import { spawn } from "node:child_process";
-import { statSync } from "node:fs";
-import { win32 as pathWin32, posix as pathPosix } from "node:path";
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, win32 as pathWin32, posix as pathPosix } from "node:path";
 import { parseNdjsonChunk } from "./claude-spawner.mjs";
 import { getThreadId as defaultGetThreadId, setThreadId as defaultSetThreadId } from "./codex-session-map.mjs";
 import {
@@ -34,6 +35,25 @@ import {
 
 const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
 
+/**
+ * Check whether the user's Codex config declares the Chorus MCP server.
+ * This is diagnostic only: a missing or unreadable config must never block a wake.
+ * @param {{ env?: NodeJS.ProcessEnv, readFile?: typeof readFileSync, home?: string }} [deps]
+ * @returns {boolean}
+ */
+export function hasChorusMcpServer(deps = {}) {
+  const env = deps.env ?? process.env;
+  const readFile = deps.readFile ?? readFileSync;
+  const home = deps.home ?? homedir();
+  const configPath = join(env.CODEX_HOME || join(home, ".codex"), "config.toml");
+  try {
+    const config = readFile(configPath, "utf8");
+    return /^\s*\[mcp_servers\.chorus\]\s*(?:#.*)?$/m.test(config);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * @typedef {Object} Spawner
  * @property {(params: {
@@ -165,13 +185,14 @@ export function resolveSpawnCommand(codexPath, args, platform = process.platform
  * @property {(o: object) => any} [spawnImpl]   Injectable spawn (tests).
  * @property {{info(m:string):void,warn(m:string):void,error(m:string):void}} [logger]
  * @property {"chorus"|"yolo"} [permissionMode]  Maps to a Codex sandbox posture.
- * @property {{ url: string, apiKey: string }} [creds]  Daemon creds — apiKey is exported
- *   into the child env under the user config's bearer_token_env_var (default CHORUS_API_KEY).
+ * @property {{ url: string, apiKey: string }} [creds] Daemon creds exported into
+ *   the child env for SessionStart hooks and the user-configured MCP bearer token.
  * @property {NodeJS.Platform} [platform]  Injectable for tests; gates POSIX `detached`.
  * @property {(anchor: string) => string|null} [getThreadIdFn]  Injectable session-map read.
  * @property {(anchor: string, threadId: string) => void} [setThreadIdFn]  Injectable session-map write.
  * @property {(anchor: string, threadId: string) => object|null} [getUsageSnapshotFn]
  * @property {(anchor: string, threadId: string, usage: object) => void} [setUsageSnapshotFn]
+ * @property {() => boolean} [hasChorusMcpServerFn] Injectable config probe.
  */
 
 export class CodexSpawner {
@@ -189,6 +210,8 @@ export class CodexSpawner {
     this.getUsageSnapshotFn = opts.getUsageSnapshotFn ?? defaultGetUsageSnapshot;
     this.setUsageSnapshotFn = opts.setUsageSnapshotFn ?? defaultSetUsageSnapshot;
     this.resolveCodexPathFn = opts.resolveCodexPathFn ?? resolveCodexPath;
+    this.hasChorusMcpServerFn = opts.hasChorusMcpServerFn ?? hasChorusMcpServer;
+    this.mcpConfigChecked = false;
   }
 
   /**
@@ -225,6 +248,15 @@ export class CodexSpawner {
       return { sessionId: anchor, exitCode: null, isNew };
     }
 
+    if (!this.mcpConfigChecked) {
+      this.mcpConfigChecked = true;
+      if (!this.hasChorusMcpServerFn()) {
+        this.logger.warn(
+          "[Chorus] Codex config has no [mcp_servers.chorus] entry; wake will continue without Chorus MCP tools",
+        );
+      }
+    }
+
     const args = buildCodexArgs({ isNew, threadId: knownThreadId, permissionMode: this.permissionMode });
     const { command, argv } = resolveSpawnCommand(codexPath, args, this.platform);
 
@@ -233,11 +265,14 @@ export class CodexSpawner {
     // stays piped — prompt over stdin + NDJSON stdout parse are unaffected.
     const detached = this.platform !== "win32";
 
-    // Daemon key via ENV under the var the user's [mcp_servers.chorus] references
-    // (bearer_token_env_var, default CHORUS_API_KEY) — NEVER argv. Merged over the
-    // inherited env so PATH / model auth (Bedrock profile) / CODEX_HOME survive.
+    // Export the daemon's resolved connection pair for both Codex MCP auth and
+    // SessionStart hooks. Explicitly overwrite inherited values so the hook and
+    // daemon cannot disagree about which Chorus instance this wake belongs to.
     const childEnv = { ...process.env, CHORUS_DAEMON_HEADLESS: "1" };
-    if (this.creds && this.creds.apiKey) childEnv.CHORUS_API_KEY = this.creds.apiKey;
+    if (this.creds) {
+      if (this.creds.url) childEnv.CHORUS_URL = this.creds.url;
+      if (this.creds.apiKey) childEnv.CHORUS_API_KEY = this.creds.apiKey;
+    }
 
     return new Promise((resolve) => {
       let child;

package/cli/kiro-spawner.mjs

@@ -209,8 +209,8 @@ export function pickNewSessionId(before, after) {
  * @property {(o: object) => any} [spawnImpl]   Injectable spawn (tests).
  * @property {{info(m:string):void,warn(m:string):void,error(m:string):void}} [logger]
  * @property {"chorus"|"yolo"} [permissionMode]  Maps to a Kiro tool-trust posture.
- * @property {{ url: string, apiKey: string }} [creds]  Daemon creds — apiKey is exported
- *   into the child env as CHORUS_API_KEY (the var the plugin's .kiro/settings/mcp.json references).
+ * @property {{ url: string, apiKey: string }} [creds] Daemon credentials exported
+ *   into the child env for plugin hooks, shell tooling, and MCP authentication.
  * @property {NodeJS.Platform} [platform]  Injectable for tests; gates POSIX `detached`.
  * @property {(anchor: string) => string|null} [getSessionIdFn]  Injectable session-map read.
  * @property {(anchor: string, id: string) => void} [setSessionIdFn]  Injectable session-map write.
@@ -274,11 +274,13 @@ export class KiroSpawner {
     // stays piped — prompt over stdin + stdout capture are unaffected.
     const detached = this.platform !== "win32";
 
-    // Daemon key via ENV as CHORUS_API_KEY — the var the plugin's
-    // [mcpServers.chorus] header references (${env:CHORUS_API_KEY}). NEVER argv.
-    // Merged over the inherited env so PATH / model auth / KIRO_* survive.
+    // Export the daemon's authoritative connection pair. CHORUS_API_KEY is also
+    // referenced by the plugin's MCP config; neither value is placed in argv.
     const childEnv = { ...process.env, CHORUS_DAEMON_HEADLESS: "1" };
-    if (this.creds && this.creds.apiKey) childEnv.CHORUS_API_KEY = this.creds.apiKey;
+    if (this.creds) {
+      if (this.creds.url) childEnv.CHORUS_URL = this.creds.url;
+      if (this.creds.apiKey) childEnv.CHORUS_API_KEY = this.creds.apiKey;
+    }
 
     // Snapshot the session store BEFORE the run so we can identify the sessionId
     // this run creates (Kiro has no id-bearing stream event). On resume we already

package/cli/spawner-select.mjs

@@ -25,12 +25,7 @@ export function selectSpawner(agentType, opts = {}) {
     return new CodexSpawner({ logger, permissionMode, creds });
   }
   if (agentType === "kiro") {
-    // Kiro follows the Codex model — MCP from the user's plugin config, daemon key
-    // via env — so it takes the same { logger, permissionMode, creds } shape.
     return new KiroSpawner({ logger, permissionMode, creds });
   }
-  // Default / "claude-code": construction byte-identical to the prior daemon
-  // (ClaudeSpawner takes only { logger, permissionMode } — creds are not used by
-  // the Claude backend, which gets its key via the --mcp-config file).
-  return new ClaudeSpawner({ logger, permissionMode });
+  return new ClaudeSpawner({ logger, permissionMode, creds });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chorus-aidlc/chorus",
-  "version": "0.14.4",
+  "version": "0.14.5",
   "description": "The Agent Harness for AI-Human Collaboration — session lifecycle, task state, sub-agent orchestration, observability, and failure recovery",
   "homepage": "https://github.com/Chorus-AIDLC/Chorus",
   "repository": {