@dungle-scrubs/harness-cli-normalizer 0.1.1

package/src/knowledge/claude-code.ts

@@ -0,0 +1,132 @@
+/**
+ * The claude-code descriptor: facts about the `claude` CLI as data, verified
+ * against claude 2.1.227 and the 00-chat-substrate spike evidence (A-001,
+ * A-002, A-005). No process logic lives here.
+ */
+import { deepFreeze, type HarnessDescriptor, UUID_SHAPE } from "./descriptor.js";
+import { SHARED_AUTH_MATCHERS, SHARED_LIMIT_MATCHERS } from "./matchers.js";
+
+export const claudeCode: HarnessDescriptor = deepFreeze({
+  name: "claude",
+  bin: "claude",
+  verifiedAgainst: "2.1.227",
+  versionSource: { kind: "npm", package: "@anthropic-ai/claude-code" },
+  launch: {
+    baseFlags: ["-p"],
+    subcommands: [],
+    promptStyle: "positional",
+    toolsFlag: "--allowedTools",
+    // A headless turn launches with the full stream-json output set so the
+    // runner can decode identity/limits and stream token deltas; bare -p
+    // (granularity none) is a degraded invocation this builder never emits.
+    streamFlags: ["--output-format", "stream-json", "--verbose", "--include-partial-messages"],
+    idFlag: "--session-id",
+  },
+  resume: {
+    // A-005: claude resumes are id-stable - the caller-assigned id survives
+    // every resume, so there is no rotation handling and forking is only the
+    // explicit --fork-session flag (deliberate branching, never a default).
+    style: "flag",
+    flag: "--resume",
+    aliases: ["-r"],
+    idShape: UUID_SHAPE,
+    onMissing: "error",
+    extraFlags: ["-p"],
+  },
+  sessionMode: {
+    // A-001: one process, many turns; `result` delimits turns; mid-turn sends
+    // queue. --setting-sources project isolates the child from user-level
+    // hooks (D-025). Token deltas require this exact output flag set.
+    flags: [
+      "--input-format",
+      "stream-json",
+      "--output-format",
+      "stream-json",
+      "--include-partial-messages",
+      "--verbose",
+      "--setting-sources",
+      "project",
+    ],
+    idFlag: "--session-id",
+    input: { kind: "claude-sdk-user-message" },
+  },
+  output: {
+    // --output-format/--include-partial-messages only work with --print, so
+    // -p is part of the pin, not an accident of the builders.
+    pins: [
+      {
+        flags: ["-p", "--output-format", "stream-json", "--verbose", "--include-partial-messages"],
+        granularity: "token",
+      },
+    ],
+    floor: "none",
+    flagAliases: { "--print": "-p" },
+  },
+  identity: {
+    authority: "caller-assigned",
+    announce: { match: { type: "system", subtype: "init" }, idField: "session_id" },
+  },
+  limitMatchers: [
+    // Observed phrasings from the live CLI (ported from lucid v1's limits.ts):
+    // "You've hit your session limit · resets 6:30pm"
+    [/you'?ve hit your session limit/i, "session-limit"],
+    // "You've hit your weekly limit · resets 2am (Asia/Bangkok)"
+    [/you'?ve hit your weekly limit/i, "weekly-limit"],
+    ...SHARED_LIMIT_MATCHERS,
+  ],
+  authMatchers: [
+    // A detached process cannot read Keychain creds, and misreading that as
+    // "not logged in" sends the human to redo a login that was never broken.
+    [/oauth session expired|could not be refreshed/i, "expired"],
+    [/failed to authenticate/i, "expired"],
+    [/not logged in|please run \/login/i, "not-logged-in"],
+    ...SHARED_AUTH_MATCHERS,
+  ],
+  autonomy: { flag: "--dangerously-skip-permissions" },
+  vocabulary: {
+    modelFlag: "--model",
+    models: ["claude-fable-5", "claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5-20251001"],
+    aliases: {
+      fable: "claude-fable-5",
+      opus: "claude-opus-5",
+      sonnet: "claude-sonnet-5",
+      haiku: "claude-haiku-4-5-20251001",
+    },
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    // Effort is an in-session command for claude, not a launch flag.
+    effortFlag: null,
+    extensible: false,
+  },
+  store: {
+    // Verified against the A-001 fixture's memory_paths slug and real
+    // ~/.claude/projects entries: '/', '.' -> '-'; '_' preserved.
+    template: "{home}/.claude/projects/{cwdSlug}/{sessionId}.jsonl",
+    cwdSlug: "dash-separators",
+  },
+  contextHook: {
+    // claude statusline payload: { context_window: { used_percentage } }.
+    // This arrives on the statusline channel, never on stream-json stdout -
+    // route accordingly, do not call per stdout line.
+    object: "context_window",
+    usedPctField: "used_percentage",
+  },
+  resumeLast: null,
+  provider: null,
+  stdin: "inherit",
+  // D-025: project-only setting sources is claude's discovery-isolation
+  // spelling; the child loads no user-level hooks or skills.
+  discoveryDisableFlags: ["--setting-sources", "project"],
+  presence: {
+    headlessMarkers: ["-p", "--print"],
+  },
+  capabilities: {
+    vision: true,
+    images: true,
+    streamingByMode: {
+      "headless-turn": "token",
+      "headless-session": "token",
+      interactive: "message",
+    },
+    session: true,
+  },
+});

package/src/knowledge/codex.ts

@@ -0,0 +1,106 @@
+/**
+ * The codex descriptor: facts about the `codex` CLI as data, verified
+ * against codex-cli 0.147.0 and lucid v1's registry. Descriptor groundwork
+ * only (D-003): not exercised through the chat protocol until the claude
+ * vertical slice is green.
+ */
+import { deepFreeze, type HarnessDescriptor, UUID_SHAPE } from "./descriptor.js";
+import { SHARED_AUTH_MATCHERS, SHARED_LIMIT_MATCHERS } from "./matchers.js";
+
+export const codexCli: HarnessDescriptor = deepFreeze({
+  name: "codex",
+  bin: "codex",
+  verifiedAgainst: "0.147.0",
+  versionSource: { kind: "npm", package: "@openai/codex" },
+  launch: {
+    // exec --json emits structured item events; without --json, identity
+    // discovery is blind (v1: requiredArgument "--json"). The sandbox grant
+    // is v1's proven spawn shape - codex's built-in default is read-only,
+    // under which a non-autonomy turn cannot write files.
+    // --skip-git-repo-check: codex exec refuses to run outside a trusted
+    // git dir without it (verified 0.147.0). cwd targeting is the spawner's
+    // job (spawn opts.cwd), not descriptor data.
+    baseFlags: ["exec", "--json", "--sandbox", "workspace-write", "--skip-git-repo-check"],
+    subcommands: ["exec"],
+    promptStyle: "positional",
+    toolsFlag: null,
+    streamFlags: [],
+    // Codex mints its own thread id; there is nothing to assign at launch.
+    idFlag: null,
+  },
+  resume: {
+    // `codex exec resume <id> [--json] <prompt>` - the resume word is a
+    // subcommand of exec (verified: `codex exec resume --help`).
+    style: "positional",
+    flag: "resume",
+    aliases: [],
+    idShape: UUID_SHAPE,
+    onMissing: "error",
+    // `codex exec resume` accepts --json and --skip-git-repo-check but
+    // REJECTS --sandbox (verified 0.147.0: "unexpected argument").
+    extraFlags: ["--json", "--skip-git-repo-check"],
+  },
+  sessionMode: null,
+  output: {
+    // exec --json emits item-level events (message granularity); a bare
+    // exec emits nothing structured at all.
+    pins: [{ flags: ["--json"], granularity: "message" }],
+    floor: "none",
+    flagAliases: {},
+  },
+  identity: {
+    // Codex mints its own thread id and announces it on stdout-jsonl.
+    authority: "harness-minted",
+    announce: { match: { type: "thread.started" }, idField: "thread_id" },
+  },
+  limitMatchers: [...SHARED_LIMIT_MATCHERS],
+  authMatchers: [[/run codex login/i, "not-logged-in"], ...SHARED_AUTH_MATCHERS],
+  // Accepted by codex 0.147.0 as a hidden alias (not in --help).
+  autonomy: { flag: "--yolo" },
+  vocabulary: {
+    modelFlag: "--model",
+    models: ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5"],
+    aliases: {},
+    efforts: ["minimal", "low", "medium", "high", "xhigh", "max", "ultra"],
+    // Codex constrains ladders per model generation (v1 registry).
+    effortsByModel: {
+      "gpt-5.5": ["minimal", "low", "medium", "high"],
+      "gpt-5.6-sol": ["medium", "high", "xhigh", "max", "ultra"],
+      "gpt-5.6-terra": ["medium", "high", "xhigh", "max", "ultra"],
+      "gpt-5.6-luna": ["medium", "high", "xhigh", "max", "ultra"],
+    },
+    // Reasoning effort is a config key (-c model_reasoning_effort=...), not
+    // a plain flag; argv-level insertion has no spelling to use.
+    effortFlag: null,
+    extensible: false,
+  },
+  store: {
+    // ~/.codex/sessions/YYYY/MM/DD/rollout-<stamp>-<threadId>.jsonl - the
+    // date/stamp components need a store scan, so the template names the
+    // sessions root; the execution layer resolves the rollout file.
+    template: "{home}/.codex/sessions",
+    cwdSlug: "verbatim",
+  },
+  contextHook: null,
+  // Valid only in the `exec resume` context: `codex exec resume --last`.
+  resumeLast: { flag: "--last" },
+  provider: null,
+  // codex exec appends piped stdin as a <stdin> block and can block on an
+  // open stdin - close it (verified 0.147.0: "Reading additional input
+  // from stdin...").
+  stdin: "close-required",
+  discoveryDisableFlags: [],
+  presence: {
+    headlessMarkers: ["exec"],
+  },
+  capabilities: {
+    vision: true,
+    images: true,
+    streamingByMode: {
+      "headless-turn": "message",
+      "headless-session": "none",
+      interactive: "none",
+    },
+    session: false,
+  },
+});

package/src/knowledge/descriptor.ts

@@ -0,0 +1,217 @@
+/**
+ * Descriptor types: the shape of what is KNOWN about a harness CLI, as pure
+ * data. Interpretation functions consume these; nothing here executes.
+ */
+
+export const HARNESS_NAMES = ["claude", "codex", "pi", "muse"] as const;
+export type HarnessName = (typeof HARNESS_NAMES)[number];
+
+/** Descriptors are process-wide defaults shared by reference into merged
+ * override sets - freezing makes an accidental in-place edit throw instead
+ * of corrupting every consumer. */
+/** A 36-char UUID - how every supported harness names its sessions. */
+export const UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export const deepFreeze = <T>(value: T): T => {
+  if (typeof value === "object" && value !== null) {
+    for (const inner of Object.values(value)) deepFreeze(inner);
+    Object.freeze(value);
+  }
+  return value;
+};
+
+export type StreamingGranularity = "token" | "message" | "none";
+
+export type HarnessMode = "headless-turn" | "headless-session" | "interactive";
+
+export const SESSION_INPUT_KINDS = ["claude-sdk-user-message"] as const;
+export type SessionInputKind = (typeof SESSION_INPUT_KINDS)[number];
+
+export interface SessionInputContract {
+  readonly kind: SessionInputKind;
+}
+
+/** Consumers branch on these (session-limit: wait for reset; weekly-limit:
+ * route elsewhere), so the vocabulary is closed - a descriptor cannot invent
+ * a code a consumer has no arm for. */
+export type LimitCode = "usage-limit" | "session-limit" | "weekly-limit" | "credits" | "quota";
+
+/** Auth walls are separate from usage limits because the remedy is entirely
+ * different (re-auth vs wait), and a detached process misreading one as the
+ * other sends the human to fix the wrong thing. */
+export type AuthFailureKind = "not-logged-in" | "expired" | "invalid-key";
+
+export interface HarnessDescriptor {
+  readonly name: HarnessName;
+  readonly bin: string;
+  /** The CLI version every fact in this descriptor - argv shapes, event
+   * vocabularies, capability claims, resume semantics - was verified
+   * against, as `<bin> --version` reports it. This is the anchor for the
+   * harness-update pipeline: CI compares the published/installed version to
+   * this, and a mismatch means the descriptor's facts are unverified for the
+   * new version (drift possible, or a capability the descriptor says is
+   * absent may now exist). Bump it only when the facts have been re-verified
+   * against that version (and the fixtures re-captured). */
+  readonly verifiedAgainst: string;
+  /** Where the latest published version is found, so the update pipeline can
+   * detect a new release WITHOUT installing the CLI or running inference.
+   * `npm` is a pure registry query (credential-free, CI-friendly);
+   * `installed` harnesses (muse ships a shell script, not an npm package)
+   * have no registry to poll, so the check falls back to the locally
+   * installed `<bin> --version` and is skipped where the CLI is absent. */
+  readonly versionSource:
+    | { readonly kind: "npm"; readonly package: string }
+    | { readonly kind: "installed" };
+  /** Headless one-turn launch shape. `promptStyle: "positional"` means the
+   * prompt travels as a bare argv entry (ordering constraints apply).
+   * `streamFlags` is the output flag set a headless turn launches with so
+   * its stream is parseable and token-granular where the harness supports
+   * it - the v1 stall-watchdog scar was launching bare and then waiting for
+   * deltas the invocation could not emit. */
+  readonly launch: {
+    readonly baseFlags: readonly string[];
+    /** The subcommand words among baseFlags (codex/muse `exec`), declared
+     * explicitly - resume parsing anchors on them, and deriving them by
+     * filtering non-dash tokens would silently promote flag VALUES like
+     * `workspace-write` into subcommands. */
+    readonly subcommands: readonly string[];
+    readonly promptStyle: "positional";
+    readonly toolsFlag: string | null;
+    readonly streamFlags: readonly string[];
+    /** The flag that pins a caller-assigned id at LAUNCH (spawn-time
+     * assignment; the execution layer consumes it), or null when the
+     * harness mints its own. */
+    readonly idFlag: string | null;
+  };
+  /** How a named session id is resumed. `flag` style: `<bin> <flag> <id>`;
+   * `positional` style: `<bin> resume <id>` (muse) - the resume token must
+   * sit at argv position 1. `idShape` is the shape of the harness's own ids;
+   * parseResumeCommand refuses commands where an id-shaped token appears
+   * anywhere else (the v1 first-UUID-wins scar: a UUID inside quoted prompt
+   * text was returned as the session id, and resuming it started a stranger). */
+  readonly resume: {
+    readonly style: "flag" | "positional";
+    readonly flag: string;
+    readonly aliases: readonly string[];
+    readonly idShape: RegExp;
+    /** Flags valid in the RESUME grammar - resume argv never inherits
+     * launch flags, because subcommand grammars differ (codex exec resume
+     * rejects --sandbox). */
+    readonly extraFlags: readonly string[];
+    /** A parse-only positional spelling (muse's interactive `muse resume
+     * <id>`) recognized when pasted, but never built - the builder uses
+     * `style`/`flag`. */
+    readonly positionalParseWord?: string;
+    /** What resuming a NONEXISTENT id does (verified live): "error" -
+     * claude/codex refuse an unknown session; "create" - pi/muse treat the
+     * id as create-if-missing and silently start a FRESH session under it.
+     * The protocol layer must know this: a consumer resuming a session it
+     * believes exists gets a blank session, not an error, on a "create"
+     * harness. */
+    readonly onMissing: "error" | "create";
+  };
+  /** Persistent headless session support: the exact flag set that opens one
+   * lucid-owned process serving many turns, or null when the harness has no
+   * such mode. `idFlag` pins the caller-assigned session identity. */
+  readonly sessionMode: {
+    readonly flags: readonly string[];
+    readonly idFlag: string;
+    readonly input: SessionInputContract;
+  } | null;
+  /** Streaming is a property of the INVOCATION, not the harness: each pin
+   * names the flag set that unlocks a granularity, checked in order, first
+   * fully-satisfied pin wins; an argv satisfying none gets `floor`. This
+   * carries claude (token under stream-json), codex (message under --json,
+   * none bare), and muse/pi in one shape - a single conditional tier could
+   * not. `flagAliases` maps alternate spellings onto pin members. */
+  readonly output: {
+    readonly pins: ReadonlyArray<{
+      readonly flags: readonly string[];
+      readonly granularity: StreamingGranularity;
+    }>;
+    readonly floor: StreamingGranularity;
+    readonly flagAliases: Readonly<Record<string, string>>;
+  };
+  /** Where native identity appears in the stream, and who mints it. Every
+   * key/value pair in `announce.match` must match the raw event; claude:
+   * {type: "system", subtype: "init"}, re-emitted at every turn start with
+   * the same value (A-001) - consumers dedupe via decodeIdentity. */
+  readonly identity: {
+    readonly authority: "caller-assigned" | "harness-minted";
+    /** `idField` is a dot-path (muse nests its id at `stream.id`); an empty
+     * `match` means "any record carrying the id path". */
+    readonly announce: {
+      readonly match: Readonly<Record<string, string>>;
+      readonly idField: string;
+    };
+  };
+  /** "Stopped on a limit" vs crash vs clean exit: the harness's own wall
+   * phrasings. First match wins per line. */
+  readonly limitMatchers: ReadonlyArray<readonly [RegExp, LimitCode]>;
+  /** Auth-wall phrasings, same scan discipline as limitMatchers. */
+  readonly authMatchers: ReadonlyArray<readonly [RegExp, AuthFailureKind]>;
+  /** The "run unattended without stops" flag, or null when the harness has
+   * no such mode. */
+  readonly autonomy: { readonly flag: string } | null;
+  /** The harness's own model-id spellings, alias map, and effort ladder.
+   * Curated baseline - pi's registry is runtime-extensible, so validation
+   * against this vocabulary is a default, not a final word (D-008).
+   * `effortFlag` is null where effort is not a launch-time flag (claude:
+   * effort is an in-session command, not argv). */
+  readonly vocabulary: {
+    readonly modelFlag: string;
+    readonly models: readonly string[];
+    readonly aliases: Readonly<Record<string, string>>;
+    readonly efforts: readonly string[];
+    /** Per-model effort ladders where the harness constrains them (codex:
+     * gpt-5.5 tops out at high; gpt-5.6-* starts at medium). Falls back to
+     * the harness-wide `efforts`. */
+    readonly effortsByModel?: Readonly<Record<string, readonly string[]>>;
+    readonly effortFlag: string | null;
+    /** D-008: an extensible vocabulary (pi) accepts clean unknown model
+     * selectors at argv time; capability claims for them degrade to
+     * unknown until runtime verification. */
+    readonly extensible: boolean;
+  };
+  /** Where the harness files sessions/transcripts, as a template over
+   * {home}, {cwdSlug} and {sessionId}. Slugging rule is per-harness. */
+  readonly store: {
+    readonly template: string;
+    /** claude: '/', '.' -> '-'; pi: '/' -> '-' wrapped in leading/trailing
+     * dashes, dots preserved. */
+    readonly cwdSlug: "dash-separators" | "pi-dash-wrapped" | "verbatim";
+  };
+  /** How the harness exposes context-window usage; the interpretation layer
+   * surfaces it as a `context` HarnessEvent. */
+  readonly contextHook: {
+    readonly object: string;
+    readonly usedPctField: string;
+  } | null;
+  /** Resume-most-recent support (codex --last), or null. The race it opens
+   * is owned by the corroboration ranking in interpretation. */
+  readonly resumeLast: { readonly flag: string } | null;
+  /** Provider/model-route flag where present (pi --provider). */
+  readonly provider: { readonly flag: string } | null;
+  /** Whether backgrounded headless calls must have stdin closed (pi hangs
+   * without `< /dev/null`). */
+  readonly stdin: "inherit" | "close-required";
+  /** Flags that disable instruction-file/skill/MCP auto-discovery, in the
+   * spelling the harness accepts. */
+  readonly discoveryDisableFlags: readonly string[];
+  /** Presence recognition: how an interactive process for a session id shows
+   * up in a process listing. `headlessMarkers` mark a process as headless
+   * (not interactive presence). Known blind spot, inherent to argv matching:
+   * an interactive session carrying no id in argv (`claude --continue`) is
+   * invisible here - presence corroborates, it never proves. */
+  readonly presence: {
+    readonly headlessMarkers: readonly string[];
+  };
+  /** Curated capability baseline per mode (D-008: a default, never a final
+   * word - runtime verification upgrades source/confidence at attach). */
+  readonly capabilities: {
+    readonly vision: boolean;
+    readonly images: boolean;
+    readonly streamingByMode: Readonly<Record<HarnessMode, StreamingGranularity>>;
+    readonly session: boolean;
+  };
+}

package/src/knowledge/index.ts

@@ -0,0 +1,23 @@
+/**
+ * Knowledge layer: owns harness descriptors as pure data.
+ *
+ * Each supported CLI (claude, codex, pi, muse) is described by an immutable
+ * descriptor capturing its argv shapes, identity and store locations, flag
+ * sets, and capability claims. The point of this module is to keep every fact
+ * about a harness in one declarative place as data, rather than scattered
+ * through branching logic. It is intentionally NOT responsible for
+ * interpreting descriptors or executing processes - those live in the
+ * interpretation and execution layers.
+ */
+export { claudeCode } from "./claude-code.js";
+export { codexCli } from "./codex.js";
+export * from "./descriptor.js";
+export { SHARED_AUTH_MATCHERS, SHARED_LIMIT_MATCHERS } from "./matchers.js";
+export { museCode } from "./muse.js";
+export {
+  type DescriptorSet,
+  defaultDescriptors,
+  OverrideRefusalError,
+  parseOverrides,
+} from "./overrides.js";
+export { piCli } from "./pi.js";

package/src/knowledge/matchers.ts

@@ -0,0 +1,19 @@
+/**
+ * Wall phrasings every harness shares. v1 applied every pattern to every
+ * harness deliberately - a muse turn dying on "You've hit your usage limit"
+ * or a provider 401 must classify no matter which CLI printed it. Each
+ * descriptor spreads these after its harness-specific phrasings.
+ */
+import type { AuthFailureKind, LimitCode } from "./descriptor.js";
+
+export const SHARED_LIMIT_MATCHERS: ReadonlyArray<readonly [RegExp, LimitCode]> = [
+  [/you'?ve hit your usage limit/i, "usage-limit"],
+  [/usage limit (?:reached|exceeded)/i, "usage-limit"],
+  [/purchase more credits|insufficient credits|out of credits/i, "credits"],
+  [/resource_exhausted|quota exceeded|exceeded your current quota/i, "quota"],
+];
+
+export const SHARED_AUTH_MATCHERS: ReadonlyArray<readonly [RegExp, AuthFailureKind]> = [
+  [/401 unauthorized/i, "expired"],
+  [/invalid api key/i, "invalid-key"],
+];

package/src/knowledge/muse.ts

@@ -0,0 +1,94 @@
+/**
+ * The muse descriptor: facts about the `muse` CLI as data, verified against
+ * Muse Code 0.1.0 and lucid v1's registry. Descriptor groundwork only
+ * (D-003). The v1 scars this encodes: headless re-entry is `muse exec
+ * --session-id <id>` (the positional `muse resume <id>` is the INTERACTIVE
+ * picker - recognized when pasted, never built), and `muse exec` exits 0
+ * even when the work inside failed (verification always reruns the
+ * project's own checks).
+ */
+import { deepFreeze, type HarnessDescriptor, UUID_SHAPE } from "./descriptor.js";
+import { SHARED_AUTH_MATCHERS, SHARED_LIMIT_MATCHERS } from "./matchers.js";
+
+export const museCode: HarnessDescriptor = deepFreeze({
+  name: "muse",
+  bin: "muse",
+  verifiedAgainst: "0.1.0",
+  versionSource: { kind: "installed" },
+  launch: {
+    // exec --json emits the payload_type/stream records the runner decodes
+    // (verified 0.1.0); bare exec streams human text.
+    baseFlags: ["exec", "--json"],
+    subcommands: ["exec"],
+    promptStyle: "positional",
+    toolsFlag: null,
+    streamFlags: [],
+    idFlag: "--session-id",
+  },
+  resume: {
+    // Headless re-entry: the same --session-id on exec (v1 registry). The
+    // interactive `muse resume <id>` spelling is parse-only.
+    style: "flag",
+    flag: "--session-id",
+    aliases: [],
+    idShape: UUID_SHAPE,
+    onMissing: "create",
+    // Structured output on resume too (see launch baseFlags).
+    extraFlags: ["--json"],
+    positionalParseWord: "resume",
+  },
+  sessionMode: null,
+  output: {
+    // muse exec --json emits payload.kind run_output_delta text chunks
+    // (verified 0.1.0), so this invocation is token-granular.
+    pins: [{ flags: ["--json"], granularity: "token" }],
+    floor: "none",
+    flagAliases: {},
+  },
+  identity: {
+    authority: "caller-assigned",
+    // Verified on 0.1.0 (--provider echo --json): records carry
+    // payload_type discriminators, no top-level type; the session id lives
+    // nested at stream.id - so match any record and read the path.
+    announce: { match: {}, idField: "stream.id" },
+  },
+  limitMatchers: [...SHARED_LIMIT_MATCHERS],
+  authMatchers: [...SHARED_AUTH_MATCHERS],
+  autonomy: { flag: "--yolo" },
+  vocabulary: {
+    modelFlag: "--model",
+    models: ["muse-spark-1.2-contributor", "muse-spark-1.2", "muse-spark-1.1"],
+    aliases: {},
+    efforts: ["none", "minimal", "low", "medium", "high", "xhigh", "ultra"],
+    effortFlag: "--reasoning-effort",
+    extensible: false,
+  },
+  store: {
+    // ~/.local/share/muse/sessions/YYYY/MM/DD/{id}/session.jsonl (index at
+    // session-index.db) - the template names the sessions root; the
+    // execution layer resolves the dated session file.
+    template: "{home}/.local/share/muse/sessions",
+    cwdSlug: "verbatim",
+  },
+  contextHook: null,
+  // `muse resume --last` exists (muse resume --help).
+  resumeLast: { flag: "--last" },
+  provider: null,
+  stdin: "inherit",
+  discoveryDisableFlags: [],
+  presence: {
+    headlessMarkers: ["exec"],
+  },
+  capabilities: {
+    // images: muse exec exposes --image <PATH>; kept false pending runtime
+    // verification (curated claims stay conservative).
+    vision: false,
+    images: false,
+    streamingByMode: {
+      "headless-turn": "token",
+      "headless-session": "none",
+      interactive: "none",
+    },
+    session: false,
+  },
+});