@jossuealcala/madre 0.3.1 → 0.3.3

package/public/styles.css

@@ -39,6 +39,7 @@
   --mode-1: var(--phosphor); --mode-1-ink: var(--phosphor-ink);   /* EXCHANGE · phosphor */
   --mode-2: #ffb000; --mode-2-ink: #1a1000;        /* CREATE · amber phosphor */
   --mode-3: var(--terror); --mode-3-ink: #fff3f1;  /* CONTROL · the red screen */
+  --mode-4: #8fd3ff; --mode-4-ink: #04131c;        /* AIRLOCK · the cold outside */
 }
 @media (prefers-color-scheme: light) {
   :root:not([data-theme="dark"]) {
@@ -65,6 +66,7 @@
     --mode-0: #6f786e; --mode-0-ink: #ffffff;
     --mode-2: #a06e00; --mode-2-ink: #ffffff;
     --mode-3: #d81b12; --mode-3-ink: #ffffff;
+    --mode-4: #0b6fa8; --mode-4-ink: #ffffff;
   }
 }
 :root[data-theme="light"] {
@@ -395,6 +397,7 @@ textarea::placeholder { color: var(--text-3); }
 .composer.m0 { --mode: var(--mode-0); --mode-ink: var(--mode-0-ink); }
 .composer.m2 { --mode: var(--mode-2); --mode-ink: var(--mode-2-ink); }
 .composer.m3 { --mode: var(--mode-3); --mode-ink: var(--mode-3-ink); }
+.composer.m4 { --mode: var(--mode-4); --mode-ink: var(--mode-4-ink); }
 .field button[type="submit"] { width: 34px; height: 34px; padding: 0; border: 0; border-radius: 50%; background: var(--mode, var(--phosphor)); color: var(--mode-ink, var(--phosphor-ink)); cursor: pointer; display: grid; place-items: center; box-shadow: 0 0 18px color-mix(in srgb, var(--mode, var(--phosphor)) 45%, transparent); transition: background .25s, box-shadow .25s; }
 .field button[type="submit"] svg { width: 18px; height: 18px; }
 .field button[type="submit"]:hover { filter: brightness(1.06); }
@@ -566,11 +569,15 @@ dialog.mother::backdrop { background: rgba(0, 0, 0, .82); backdrop-filter: blur(
 .stop-all.armed { opacity: 1; cursor: pointer; border-color: var(--terror); background: color-mix(in srgb, var(--terror) 12%, transparent); color: var(--terror); text-shadow: 0 0 8px color-mix(in srgb, var(--terror) 60%, transparent); animation: blink 1.4s infinite; }
 .stop-all.armed:hover { background: var(--terror); color: #fff; text-shadow: none; animation: none; }
 .stop-all-glyph { width: 8px; height: 8px; background: currentColor; }
-.update-pill { opacity: 1; cursor: pointer; border-color: var(--warn); background: color-mix(in srgb, var(--warn) 12%, transparent); color: var(--warn); text-shadow: 0 0 8px color-mix(in srgb, var(--warn) 60%, transparent); animation: update-breathe 2.8s ease-in-out infinite; }
-.update-pill:hover { background: var(--warn); color: #050605; text-shadow: none; animation: none; }
-.update-pill .update-glyph { border-radius: 50%; }
-@keyframes update-breathe { 0%, 100% { box-shadow: 0 0 0 0 color-mix(in srgb, var(--warn) 0%, transparent); } 50% { box-shadow: 0 0 14px 0 color-mix(in srgb, var(--warn) 45%, transparent); } }
-@media (prefers-reduced-motion: reduce) { .update-pill { animation: none; } }
+/* The version alert: an amber hairline, a soft fill, no glow. It should read as information, not alarm. */
+.update-pill { opacity: 1; cursor: pointer; border-color: color-mix(in srgb, var(--warn) 45%, transparent); background: color-mix(in srgb, var(--warn) 9%, transparent); color: var(--warn); text-shadow: none; transition: background-color .22s ease, border-color .22s ease, color .22s ease, transform .16s ease; }
+.update-pill:hover { background: color-mix(in srgb, var(--warn) 16%, transparent); border-color: color-mix(in srgb, var(--warn) 70%, transparent); }
+.update-pill:active { transform: scale(.98); }
+.update-pill:focus-visible { outline: 2px solid color-mix(in srgb, var(--warn) 60%, transparent); outline-offset: 2px; }
+.update-pill .update-glyph { border-radius: 50%; opacity: .9; }
+.update-restart { display: inline-flex; align-items: center; height: 30px; padding: 0 14px; margin: 4px 0 10px; border: 1px solid var(--ph); background: color-mix(in srgb, var(--ph) 12%, transparent); color: var(--ph); font: inherit; font-size: 10px; letter-spacing: .18em; cursor: pointer; transition: background-color .22s ease, color .22s ease, opacity .22s ease; }
+.update-restart:hover { background: color-mix(in srgb, var(--ph) 22%, transparent); }
+.update-restart:disabled { opacity: .55; cursor: default; }
 .system.alert { color: var(--terror); text-shadow: 0 0 10px color-mix(in srgb, var(--terror) 70%, transparent); letter-spacing: .14em; animation: terror-in 1.4s steps(3, end) 1; }
 .system.alert b { color: var(--terror); }
 .system.alert .cmd { display: inline-block; margin-left: 8px; padding: 1px 8px; border: 1px solid var(--terror); letter-spacing: .2em; }
@@ -643,6 +650,7 @@ dialog.mother::backdrop { background: rgba(0, 0, 0, .82); backdrop-filter: blur(
 .picker .mode-chip.m1 { --mode: var(--mode-1); }
 .picker .mode-chip.m2 { --mode: var(--mode-2); }
 .picker .mode-chip.m3 { --mode: var(--mode-3); }
+.picker .mode-chip.m4 { --mode: var(--mode-4); }
 .mode-menu { width: min(380px, calc(100vw - 24px)); padding: 12px; }
 .mode-menu .model-menu-title { margin: 4px 10px 10px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .mode-menu .mode-ladder { display: grid; gap: 2px; }
@@ -653,6 +661,7 @@ dialog.mother::backdrop { background: rgba(0, 0, 0, .82); backdrop-filter: blur(
 .mode-menu .mode-option.o1.current { --mode: var(--mode-1); }
 .mode-menu .mode-option.o2.current { --mode: var(--mode-2); }
 .mode-menu .mode-option.o3 { --mode: var(--mode-3); }
+.mode-menu .mode-option.o4 { --mode: var(--mode-4); }
 .mode-menu .mode-option.locked { opacity: .45; }
 .mode-menu .mode-option.locked:hover { opacity: 1; }
 .mode-menu .mode-option:disabled { opacity: .3; cursor: default; }
@@ -661,11 +670,11 @@ dialog.mother::backdrop { background: rgba(0, 0, 0, .82); backdrop-filter: blur(
 .mode-menu .mode-option .body { display: grid; gap: 3px; min-width: 0; }
 .mode-menu .mode-option .name { font-size: 11px; font-weight: 700; letter-spacing: .14em; color: var(--mode); }
 .mode-menu .mode-option.current .name, .mode-menu .mode-option:hover .name { color: var(--mode); }
-.mode-menu .mode-option:not(.current):not(.o3) .name { color: var(--text); }
+.mode-menu .mode-option:not(.current):not(.o3):not(.o4) .name { color: var(--text); }
 .mode-menu .mode-option .body { gap: 5px; }
 .mode-menu .mode-option .hint { display: block; font-size: 10.5px; line-height: 1.5; letter-spacing: 0; color: var(--text-2); text-transform: none; font-family: var(--sans, inherit); }
 .mode-menu .mode-option .tag { display: inline-flex; align-items: center; gap: 7px; font-size: 8.5px; font-weight: 700; letter-spacing: .16em; color: var(--mode); white-space: nowrap; align-self: center; margin-left: 4px; }
-.mode-menu .mode-option .tag.raise { border: 1px solid var(--mode-3); border-radius: 999px; padding: 3px 9px; }
+.mode-menu .mode-option .tag.raise { border: 1px solid var(--mode); border-radius: 999px; padding: 3px 9px; }
 .mode-menu .mode-option .tag .dot { width: 6px; height: 6px; border-radius: 50%; background: var(--mode); box-shadow: 0 0 8px var(--mode); animation: mode-dot 1.4s ease-in-out infinite; }
 @keyframes mode-dot { 0%, 100% { opacity: 1; } 50% { opacity: .15; } }
 @media (prefers-reduced-motion: reduce) { .mode-menu .mode-option .tag .dot { animation: none; } }
@@ -677,10 +686,13 @@ dialog.mother::backdrop { background: rgba(0, 0, 0, .82); backdrop-filter: blur(
 .composer.control { width: min(1180px, 100% - 40px); }
 .composer.control .field { border-color: var(--terror); box-shadow: 0 0 0 3px color-mix(in srgb, var(--terror) 18%, transparent), 0 0 30px color-mix(in srgb, var(--terror) 20%, transparent); }
 .composer.control .crew-label { color: var(--terror); text-shadow: 0 0 8px color-mix(in srgb, var(--terror) 60%, transparent); }
+/* AIRLOCK: the same width as CONTROL, a cold ring instead of the red one. */
+.composer.airlock .field { border-color: var(--mode-4); box-shadow: 0 0 0 3px color-mix(in srgb, var(--mode-4) 18%, transparent), 0 0 30px color-mix(in srgb, var(--mode-4) 16%, transparent); }
+.composer.airlock .crew-label { color: var(--mode-4); text-shadow: 0 0 8px color-mix(in srgb, var(--mode-4) 55%, transparent); }
 .composer.intruder .crew-label { color: var(--terror); text-shadow: 0 0 8px color-mix(in srgb, var(--terror) 60%, transparent); animation: blink 1.6s steps(1) infinite; }
 /* Mode badges on bubbles and plan steps */
 .who .badge.mode { font-weight: 700; letter-spacing: .1em; }
-.who .badge.mode.m0 { color: var(--mode-0); border-color: color-mix(in srgb, var(--mode-0) 50%, transparent); } .who .badge.mode.m1 { color: var(--mode-1); border-color: color-mix(in srgb, var(--mode-1) 45%, transparent); } .who .badge.mode.m2 { color: var(--mode-2); border-color: color-mix(in srgb, var(--mode-2) 50%, transparent); } .who .badge.mode.m3 { color: var(--mode-3); border-color: var(--mode-3); }
+.who .badge.mode.m0 { color: var(--mode-0); border-color: color-mix(in srgb, var(--mode-0) 50%, transparent); } .who .badge.mode.m1 { color: var(--mode-1); border-color: color-mix(in srgb, var(--mode-1) 45%, transparent); } .who .badge.mode.m2 { color: var(--mode-2); border-color: color-mix(in srgb, var(--mode-2) 50%, transparent); } .who .badge.mode.m3 { color: var(--mode-3); border-color: var(--mode-3); } .who .badge.mode.m4 { color: var(--mode-4); border-color: var(--mode-4); }
 .row.ghost .bubble { border: 1px dashed var(--line-2); background: transparent; opacity: .85; }
 .row.ghost.user .bubble { background: transparent; color: var(--text); border-color: var(--text-3); }
 .row.ghost .stamp::after { content: ' · not recorded'; color: var(--text-3); }
@@ -1040,6 +1052,7 @@ dialog.viewer::backdrop { background: rgba(0,0,0,.7); backdrop-filter: blur(4px)
 :root[data-scheme="light"] .field button[type="submit"] { box-shadow: 0 2px 8px rgba(0, 0, 0, .14); }
 :root[data-scheme="light"] .user .bubble { box-shadow: 0 3px 12px rgba(0, 0, 0, .08); }
 :root[data-scheme="light"] .composer.control .field { box-shadow: 0 0 0 2px color-mix(in srgb, var(--terror) 30%, transparent); }
+:root[data-scheme="light"] .composer.airlock .field { box-shadow: 0 0 0 2px color-mix(in srgb, var(--mode-4) 35%, transparent); }
 :root[data-scheme="light"] .composer.creating .field, :root[data-scheme="light"] .composer.creating.ordering .field { box-shadow: 0 0 0 2px color-mix(in srgb, var(--mode-2) 30%, transparent); }
 :root[data-scheme="light"] .composer.ordering .field { box-shadow: 0 0 0 2px color-mix(in srgb, var(--brew) 22%, transparent); }
 :root[data-scheme="light"] .composer.dropping .field { box-shadow: 0 0 0 2px color-mix(in srgb, var(--phosphor) 35%, transparent); }
@@ -1068,3 +1081,8 @@ dialog.viewer::backdrop { background: rgba(0,0,0,.7); backdrop-filter: blur(4px)
 .module-card .actions .toggle { display: inline-flex; align-items: center; gap: 6px; font-size: 9.5px; letter-spacing: .14em; color: var(--ph-dim); cursor: pointer; }
 .module-card .actions .toggle input { accent-color: #9bff66; }
 .mother-section.sentinel .note, .mother-section.update .note { margin: 0 0 10px; font-size: 10px; letter-spacing: .12em; line-height: 1.7; color: var(--ph-dim); }
+
+/* Motion of controls: every colour change eases over 220 ms. Nothing snaps. */
+.mother-button, .tree-button, .stop-all, .mother-close, .mother-section button, .seg-option, .mode-chip, .model-chip, .bubble-actions .act, .update-command button, .codeblock .copy { transition: background-color .22s ease, color .22s ease, border-color .22s ease, box-shadow .22s ease, opacity .22s ease, transform .16s ease; }
+.mother-button:active, .tree-button:active, .mother-close:active, .mother-section button:active, .update-command button:active { transform: scale(.98); }
+@media (prefers-reduced-motion: reduce) { .mother-button, .tree-button, .stop-all, .mother-close, .mother-section button, .seg-option, .mode-chip, .model-chip, .bubble-actions .act, .update-command button, .update-pill, .update-restart { transition: none; } }

package/public/troubleshooting.js

@@ -299,20 +299,20 @@ export const CONDITIONS = [
   {
     id: 'modes',
     severity: 'informational',
-    title: 'Permission modes: #0 GHOST · #1 EXCHANGE · #2 CREATE · #3 CONTROL',
-    match: /mode|ghost|exchange|control|override|designation|max mode|#[0-3]\b/i,
-    diagnosis: 'Every message goes out at a mode, chosen in the chip after TO @agent (or typed as #2 in the text). #0 GHOST is off the record: nothing is saved, no other agent remembers it, gone on reload, no delegation. #1 EXCHANGE is the default: read and coordinate. #2 CREATE is the creation lease: files and images inside .pulse/out/. #3 CONTROL puts one agent in command of the project itself: a git checkpoint is taken first, every change is listed afterwards, writes into .git, .pulse or .env files are reverted on the spot, and UNDO restores the checkpoint. One holder at a time; it needs MAX MODE 3 and a git repository. Your mode is the ceiling of any plan the message starts, and #3 is never delegated. Each agent has a MAX MODE in CONNECTIONS; above it, #2 is answered read-only and #3 is refused. When a #1 plan reaches a step that wants to create something, the room pauses and asks you: GRANT ONCE, GRANT FOR PLAN or DENY, with a 3-minute clock; silence denies.',
-    remedy: 'Pick the mode in the chip, or type #0..#3 in the message. Raise an agent\'s MAX MODE in ⚙ CONNECTIONS. CONTROL asks for the project designation (the folder name) in the override before arming.',
-    fixes: same(['# chip: TO @codex  #1 EXCHANGE ▾  → choose', '@codex #2 create the poster', '# ⚙ CONNECTIONS → agent card → MAX MODE']),
+    title: 'Permission modes: #0 GHOST · #1 EXCHANGE · #2 CREATE · #3 CONTROL · #4 AIRLOCK',
+    match: /mode|ghost|exchange|control|airlock|deploy|despleg|producci|override|designation|max mode|#[0-4]\b/i,
+    diagnosis: 'Every message goes out at a mode, chosen in the chip after TO @agent (or typed as #2 in the text). #0 GHOST is off the record: nothing is saved, no other agent remembers it, gone on reload, no delegation. #1 EXCHANGE is the default: read and coordinate. #2 CREATE lets the agent add new files and folders anywhere in the project, where they belong; whatever existed before is put back after the turn and the room says so. #3 CONTROL puts one agent in command of the project itself: a git checkpoint is taken first, every change is listed afterwards, writes into .git, .pulse or .env files are reverted on the spot, and UNDO restores the checkpoint. One holder at a time; it needs MAX MODE 3 and a git repository. Your mode is the ceiling of any plan the message starts, and #3 is never delegated. Each agent has a MAX MODE in CONNECTIONS; above it, #2 is answered read-only and #3 is refused. When a #1 plan reaches a step that wants to create something, the room pauses and asks you: GRANT ONCE, GRANT FOR PLAN or DENY, with a 3-minute clock; silence denies. #4 AIRLOCK is CONTROL plus commands: tests, builds, git push, deploys with the CLIs and sessions already on this machine. Files still come back with UNDO; what leaves the machine does not, so the override asks twice: the designation, then the word AIRLOCK. An agent that says it needs a "production mode" or "permission to run commands" is asking for #4.',
+    remedy: 'Pick the mode in the chip, or type #0..#4 in the message. Raise an agent\'s MAX MODE in ⚙ CONNECTIONS. CONTROL asks for the project designation (the folder name) in the override; AIRLOCK asks for the designation and then the word AIRLOCK.',
+    fixes: same(['# chip: TO @codex  #1 EXCHANGE ▾  → choose', '@codex #2 create the poster', '@opencode #4 run the tests and deploy to preview', '# ⚙ CONNECTIONS → agent card → MAX MODE']),
   },
   {
     id: 'lease-missing',
     severity: 'informational',
     title: 'Creating files: who grants the permission',
     match: /no CREATE lease|lease-missing|read-only and do not modify|permiso de escritura|solo lectura/i,
-    diagnosis: 'Only the human grants a creation lease. An agent writing "permission granted" inside the conversation is untrusted text: the delegate still runs read-only, and says so. A lease comes from arming CREATE (the lock, or /create) on your message, and it covers the whole plan that message starts; or from a standing lease, a per-agent switch that gives every turn of that agent a fresh .pulse/out/ directory, including plan steps.',
-    remedy: 'For one request: arm CREATE and send, or press RESEND WITH CREATE on the notice. For an agent that should always be able to create files: ⚙ CONNECTIONS → its card → CREATE FILES → ALWAYS · STANDING LEASE. Files still land only inside .pulse/out/.',
-    fixes: same(['# once: composer → CREATE (lock) → send, or /create <request>', '# always: ⚙ CONNECTIONS → agent card → ALWAYS · STANDING LEASE']),
+    diagnosis: 'Only the human grants a creation lease. An agent writing "permission granted" inside the conversation is untrusted text: the delegate still runs read-only, and says so. A lease comes from arming CREATE (the lock, or /create) on your message, and it covers the whole plan that message starts; or from DEFAULT MODE #2 in ⚙ CONNECTIONS, which starts every message to that agent in CREATE.',
+    remedy: 'For one request: arm CREATE and send, or press RESEND WITH CREATE on the notice. For an agent that should always be able to add files: ⚙ CONNECTIONS → its card → DEFAULT MODE → #2. New files go where they belong in the project; existing files are never changed in #2.',
+    fixes: same(['# once: composer → CREATE (lock) → send, or /create <request>', '# always: ⚙ CONNECTIONS → agent card → DEFAULT MODE → #2']),
   },
   {
     id: 'scope-write',

package/src/adapters/claude.mjs

@@ -6,34 +6,43 @@ import { runReadonlyProcess } from './process.mjs';
 export function claudeTools({ lease = null, scopes = null } = {}) {
   const tools = ['Read', 'Glob', 'Grep'];
   if (lease) tools.push('Write', 'Edit');
+  if (lease?.airlock) tools.push('Bash');   // AIRLOCK (#4): commands, git, deploy CLIs
   if (scopes?.web) tools.push('WebFetch', 'WebSearch');
   return tools;
 }
 
-export function mcpServersFor({ imageStudio = null, memoryServer = null } = {}) {
+export function mcpServersFor({ imageStudio = null, memoryServer = null, mcpServers = [] } = {}) {
   const servers = {};
   if (memoryServer) servers[memoryServer.name] = { command: memoryServer.command, args: memoryServer.args, env: memoryServer.env };
   if (imageStudio) servers[imageStudio.name] = { command: imageStudio.command, args: imageStudio.args, env: imageStudio.env };
+  for (const server of mcpServers) servers[server.name] = { command: server.command, args: server.args ?? [], env: server.env ?? {} };
   return servers;
 }
+// Claude's permission names for a module's server: each tool, or the whole server when the list is open.
+export const claudeMcpTools = (server) => (server.tools?.length ? server.tools.map((tool) => `mcp__${server.name}__${tool}`) : [`mcp__${server.name}`]);
 
-export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, lease = null, scopes = null, imageStudio = null, memoryServer = null }) {
+export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] }) {
   const tools = claudeTools({ lease, scopes });
   const mcpTools = [
     ...(memoryServer ? memoryServer.tools.map((tool) => `mcp__${memoryServer.name}__${tool}`) : []),
     ...(imageStudio ? [`mcp__${imageStudio.name}__${imageStudio.tool}`] : []),
+    ...mcpServers.flatMap(claudeMcpTools),
   ];
   const allowed = [
     'Read', 'Glob', 'Grep',
     // Claude Code reads `/path` as relative to the project and `//path` as an absolute path.
+    // Claude Code grants Write only when Edit is allowed on the same paths (verified with the real
+    // CLI: a lone Write rule is denied under dontAsk), so both come together; in CREATE the room
+    // restores existing files after the turn.
     ...(lease ? [`Write(//${lease.outDir}/**)`, `Edit(//${lease.outDir}/**)`] : []),
+    ...(lease?.airlock ? ['Bash'] : []),
     ...(scopes?.web ? ['WebFetch', 'WebSearch'] : []),
     ...mcpTools,
   ];
   // Only MADRE's own MCP servers ever reach Claude here; --strict-mcp-config
   // keeps the user's servers out of the isolated run.
-  const anyMcp = Boolean(imageStudio || memoryServer);
-  const mcpConfig = JSON.stringify({ mcpServers: mcpServersFor({ imageStudio, memoryServer }) });
+  const anyMcp = Boolean(imageStudio || memoryServer || mcpServers.length);
+  const mcpConfig = JSON.stringify({ mcpServers: mcpServersFor({ imageStudio, memoryServer, mcpServers }) });
   return [
     '-p',
     ...(model ? ['--model', model] : []),
@@ -44,7 +53,7 @@ export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, l
     '--tools', tools.join(','),
     ...(lease || scopes?.web || anyMcp ? ['--allowedTools', allowed.join(',')] : []),
     // CONTROL: the whole project is writable except MADRE's forbidden zones.
-    ...(lease?.control ? ['--disallowedTools', ['.git/**', '.pulse/**', '.env', '.env.*', '**/.env', '**/.env.*'].flatMap((glob) => [`Write(//${lease.outDir}/${glob})`, `Edit(//${lease.outDir}/${glob})`]).join(',')] : []),
+    ...(lease?.control || lease?.create ? ['--disallowedTools', ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'].flatMap((glob) => [`Write(//${lease.outDir}/${glob})`, `Edit(//${lease.outDir}/${glob})`]).join(',')] : []),
     // --safe-mode disables every MCP server, ours included. With a MADRE server
     // attached we drop it and instead load no setting sources at all: no user
     // hooks, plugins or MCP servers, only the project's CLAUDE.md and ours.
@@ -92,10 +101,10 @@ export function parseClaudeOutput(output) {
   }
 }
 
-export function invokeClaude({ executable, projectRoot, prompt, timeoutMs = 120000, signal, model = null, attachments = [], lease = null, scopes = null, imageStudio = null, memoryServer = null }) {
+export function invokeClaude({ executable, projectRoot, prompt, timeoutMs = 120000, signal, model = null, attachments = [], lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] }) {
   return runReadonlyProcess({
     executable,
-    args: buildClaudeArgs({ prompt, model, attachmentsDir: attachments[0]?.dir ?? null, lease, scopes, imageStudio, memoryServer }),
+    args: buildClaudeArgs({ prompt, model, attachmentsDir: attachments[0]?.dir ?? null, lease, scopes, imageStudio, memoryServer, mcpServers }),
     cwd: projectRoot,
     env: process.env,
     timeoutMs,

package/src/adapters/codex.mjs

@@ -12,25 +12,28 @@ export function tomlValue(value) {
 // The room's memory as an MCP server for this run only: Codex reads
 // mcp_servers.<name> from its config, and -c overrides it on the command line
 // without touching the user's config.toml.
-export function codexMcpOverrides(memoryServer) {
-  if (!memoryServer) return [];
-  const key = `mcp_servers.${memoryServer.name}`;
-  return [
-    '-c', `${key}.command=${tomlValue(memoryServer.command)}`,
-    '-c', `${key}.args=${tomlValue(memoryServer.args)}`,
-    '-c', `${key}.env=${tomlValue(memoryServer.env ?? {})}`,
-  ];
+export function codexMcpOverrides(servers) {
+  const list = (Array.isArray(servers) ? servers : [servers]).filter(Boolean);
+  return list.flatMap((server) => {
+    const key = `mcp_servers.${server.name}`;
+    return [
+      '-c', `${key}.command=${tomlValue(server.command)}`,
+      '-c', `${key}.args=${tomlValue(server.args ?? [])}`,
+      '-c', `${key}.env=${tomlValue(server.env ?? {})}`,
+    ];
+  });
 }
 
-export function buildCodexArgs({ projectRoot, prompt, model = null, attachments = [], lease = null, scopes = null, memoryServer = null }) {
+export function buildCodexArgs({ projectRoot, prompt, model = null, attachments = [], lease = null, scopes = null, memoryServer = null, mcpServers = [] }) {
   const images = attachments.filter((file) => /^image\//.test(file.contentType ?? ''));
   return [
-    '--sandbox', lease ? 'workspace-write' : 'read-only',
+    // AIRLOCK (#4): commands with network, so pushes and deploys can leave; otherwise the sandbox.
+    '--sandbox', lease?.airlock ? 'danger-full-access' : lease ? 'workspace-write' : 'read-only',
     '--ask-for-approval', 'never',
     // Live web search is a global Codex flag; the human's web scope decides.
     ...(scopes?.web ? ['--search'] : []),
     '-C', lease ? lease.outDir : projectRoot,
-    ...codexMcpOverrides(memoryServer),
+    ...codexMcpOverrides([memoryServer, ...mcpServers]),
     // Image generation is a Codex feature; the human's scope decides per turn.
     ...(lease && (scopes?.imageGen === false || lease.scopes?.imageGen === false) ? ['-c', 'features.image_generation=false'] : []),
     'exec',
@@ -70,10 +73,10 @@ export function parseCodexOutput(output) {
   return { text: text.trim(), usage };
 }
 
-export function invokeCodex({ executable, projectRoot, prompt, timeoutMs = 120000, signal, model = null, attachments = [], lease = null, scopes = null, memoryServer = null }) {
+export function invokeCodex({ executable, projectRoot, prompt, timeoutMs = 120000, signal, model = null, attachments = [], lease = null, scopes = null, memoryServer = null, mcpServers = [] }) {
   return runReadonlyProcess({
     executable,
-    args: buildCodexArgs({ projectRoot, prompt, model, attachments, lease, scopes, memoryServer }),
+    args: buildCodexArgs({ projectRoot, prompt, model, attachments, lease, scopes, memoryServer, mcpServers }),
     cwd: lease ? lease.outDir : projectRoot,
     env: process.env,
     timeoutMs,

package/src/adapters/gemini.mjs

@@ -27,19 +27,30 @@ export const geminiCredentialFiles = ['oauth_creds.json', 'google_accounts.json'
 // whose file_path argument starts with the lease directory. Plan mode would
 // block every write regardless of policy, so a lease uses approval "default":
 // headless Gemini cannot prompt, so anything the policy does not allow fails.
-export function geminiLeasePolicy(outDir, { control = false } = {}) {
+export function geminiLeasePolicy(outDir, { control = false, create = false, airlock = false } = {}) {
   const escaped = outDir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  const forbidden = control ? `
+  // The whole project is the lease in #2 and #3: MADRE's zones stay out of reach.
+  const forbidden = control || create ? `
 [[rule]]
 toolName = ["write_file", "replace", "edit", "run_shell_command"]
-argsPattern = '${escaped}/(\\.git|\\.pulse|\\.env)'
+argsPattern = '${escaped}/(\\.git|\\.pulse|\\.madre|\\.env|\\.claude/settings\\.local\\.json)'
 decision = "deny"
 priority = 1100
 interactive = false
 ` : '';
-  return `${geminiReadonlyPolicy}
+  // CREATE (#2) adds files: write_file only; CONTROL (#3) also replaces and edits.
+  const tools = create ? '["write_file"]' : '["write_file", "replace", "edit"]';
+  // AIRLOCK (#4): commands too; the forbidden-zone rule above still outranks this one.
+  const commands = airlock ? `
 [[rule]]
-toolName = ["write_file", "replace", "edit"]
+toolName = "run_shell_command"
+decision = "allow"
+priority = 1000
+interactive = false
+` : '';
+  return `${geminiReadonlyPolicy}${commands}
+[[rule]]
+toolName = ${tools}
 argsPattern = '"file_path"\\s*:\\s*"${escaped}/'
 decision = "allow"
 priority = 1000
@@ -55,12 +66,13 @@ priority = 999
 interactive = false
 `;
 
-export function geminiPolicy({ lease = null, scopes = null, imageStudio = null, memoryServer = null } = {}) {
-  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control) }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}`;
+export function geminiPolicy({ lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] } = {}) {
+  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create), airlock: Boolean(lease.airlock) }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}${mcpServers.map(geminiMemoryPolicy).join('')}`;
 }
 
+// Allow rules for a server's tools, by bare name and by server-prefixed name; an open tool list allows the server's prefix.
 export function geminiMemoryPolicy(memoryServer) {
-  const names = memoryServer.tools.flatMap((tool) => [tool, `${memoryServer.name}__${tool}`]);
+  const names = memoryServer.tools?.length ? memoryServer.tools.flatMap((tool) => [tool, `${memoryServer.name}__${tool}`]) : [`${memoryServer.name}__*`];
   return `
 [[rule]]
 toolName = [${names.map((name) => `"${name}"`).join(', ')}]
@@ -109,10 +121,10 @@ export function buildGeminiEnvironment({ runtimeRoot, environment = process.env
   };
 }
 
-export function isolateGeminiSettings(settings, { imageStudio = null, memoryServer = null } = {}) {
+export function isolateGeminiSettings(settings, { imageStudio = null, memoryServer = null, mcpServers = [] } = {}) {
   const auth = settings?.security?.auth;
   const isolated = auth ? { security: { auth } } : {};
-  for (const server of [memoryServer, imageStudio]) {
+  for (const server of [memoryServer, imageStudio, ...mcpServers]) {
     if (!server) continue;
     isolated.mcpServers ??= {};
     isolated.mcpServers[server.name] = { command: server.command, args: server.args, env: server.env, trust: true };
@@ -130,7 +142,7 @@ interactive = false
 `;
 }
 
-export async function prepareGeminiHome({ runtimeRoot, sourceHome = join(homedir(), '.gemini'), imageStudio = null, memoryServer = null }) {
+export async function prepareGeminiHome({ runtimeRoot, sourceHome = join(homedir(), '.gemini'), imageStudio = null, memoryServer = null, mcpServers = [] }) {
   const geminiDir = join(runtimeRoot, '.gemini');
   await mkdir(geminiDir, { recursive: true, mode: 0o700 });
   for (const name of geminiCredentialFiles) {
@@ -144,7 +156,7 @@ export async function prepareGeminiHome({ runtimeRoot, sourceHome = join(homedir
   } catch (error) {
     if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) throw error;
   }
-  await writeFile(join(geminiDir, 'settings.json'), JSON.stringify(isolateGeminiSettings(settings, { imageStudio, memoryServer })), { mode: 0o600 });
+  await writeFile(join(geminiDir, 'settings.json'), JSON.stringify(isolateGeminiSettings(settings, { imageStudio, memoryServer, mcpServers })), { mode: 0o600 });
   return geminiDir;
 }
 
@@ -256,6 +268,7 @@ export async function invokeGemini({
   scopes = null,
   imageStudio = null,
   memoryServer = null,
+  mcpServers = [],
   idleTimeoutMs = Number(process.env.PULSE_GEMINI_IDLE_MS ?? 90000),
   retries = Number(process.env.PULSE_GEMINI_RETRIES ?? 1),
   fallbackModel = process.env.PULSE_GEMINI_FALLBACK_MODEL ?? 'gemini-2.5-flash',
@@ -265,8 +278,8 @@ export async function invokeGemini({
   const runtimeRoot = await mkdtemp(join(tmpdir(), 'pulse-gemini-'));
   const policyPath = join(runtimeRoot, 'readonly.toml');
   try {
-    await writeFile(policyPath, geminiPolicy({ lease, scopes, imageStudio: lease ? imageStudio : null, memoryServer }), { mode: 0o600 });
-    await prepareGeminiHome({ runtimeRoot, imageStudio: lease ? imageStudio : null, memoryServer });
+    await writeFile(policyPath, geminiPolicy({ lease, scopes, imageStudio: lease ? imageStudio : null, memoryServer, mcpServers }), { mode: 0o600 });
+    await prepareGeminiHome({ runtimeRoot, imageStudio: lease ? imageStudio : null, memoryServer, mcpServers });
     let attempt = 0;
     let currentModel = model;
     let switched = false;

package/src/adapters/opencode.mjs

@@ -34,27 +34,47 @@ export function buildOpenCodeArgs({ projectRoot, prompt, model = process.env.PUL
   ];
 }
 
-export function leaseConfig(outDir, { control = false } = {}) {
-  const forbidden = control ? Object.fromEntries(['.git/**', '.pulse/**', '.env', '.env.*', '**/.env', '**/.env.*'].map((glob) => [`${outDir}/${glob}`, 'deny'])) : {};
+// OpenCode matches permission patterns against paths relative to `--dir`, last matching rule
+// wins, and creating a file is the `write` tool while changing one is `edit`: both need a rule.
+// Verified against opencode 1.18.4: absolute patterns never match, so the lease is named by
+// its directory relative to the project.
+export const FORBIDDEN_GLOBS = ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'];
+export function writeRules(relativeDir, { control = false, create = false } = {}) {
+  if (control || create) return { '*': 'allow', ...Object.fromEntries(FORBIDDEN_GLOBS.map((glob) => [glob, 'deny'])) };
+  const dir = String(relativeDir ?? '.').replace(/^\.\/+/, '').replace(/\/+$/, '');
+  return { '*': 'deny', [dir && dir !== '.' ? `${dir}/**` : '**']: 'allow' };
+}
+
+export function leaseConfig(outDir, { control = false, create = false, airlock = false, relativeDir = null } = {}) {
+  const rules = writeRules(relativeDir ?? outDir, { control, create });
+  // OpenCode gates its `write` tool behind the `edit` permission as well (denying edit leaves "no
+  // file-writing tool"), so CREATE allows both and the room restores existing files afterwards.
+  const editRules = rules;
   return {
     ...readonlyConfig,
     agent: {
       'pulse-readonly': {
         ...readonlyConfig.agent['pulse-readonly'],
-        prompt: control
-          ? 'Answer the user directly. You are in CONTROL of this project: create and edit files anywhere inside it except .git, .pulse and .env files. Do not run commands, browse the web, or launch subagents.'
-          : 'Answer the user directly. Inspect project files when necessary. You may create or edit files only inside the creation lease directory named in the request; never elsewhere. Do not run commands, browse the web, or launch subagents.',
+        prompt: airlock
+          ? 'Answer the user directly. AIRLOCK: you are in command of this project and may run commands in it, including git and deploy CLIs with the sessions already on this machine. Say what will leave the machine before it does. Never print secrets. Do not launch subagents.'
+          : control
+          ? 'Answer the user directly. You are in CONTROL of this project: create and edit files anywhere inside it except .git, .pulse, .madre and .env files. Do not run commands, browse the web, or launch subagents.'
+          : create
+            ? 'Answer the user directly. You may create new files and folders anywhere in this project where they belong; do not modify or delete existing files. Do not run commands, browse the web, or launch subagents.'
+            : 'Answer the user directly. Inspect project files when necessary. You may create or edit files only inside the creation lease directory named in the request; never elsewhere. Do not run commands, browse the web, or launch subagents.',
         permission: {
           ...readonlyConfig.agent['pulse-readonly'].permission,
-          edit: { '*': 'deny', [`${outDir}/**`]: 'allow', ...forbidden },
+          edit: editRules,
+          write: rules,
+          ...(airlock ? { bash: 'allow' } : {}),   // AIRLOCK (#4): commands, git, deploy CLIs
         },
       },
     },
   };
 }
 
-export function openCodeConfig({ lease = null, scopes = null, imageStudio = null, memoryServer = null } = {}) {
-  let config = lease ? leaseConfig(lease.outDir, { control: Boolean(lease.control) }) : readonlyConfig;
+export function openCodeConfig({ lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] } = {}) {
+  let config = lease ? leaseConfig(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create), airlock: Boolean(lease.airlock), relativeDir: lease.relativeDir ?? null }) : readonlyConfig;
   if (scopes?.web) {
     config = {
       ...config,
@@ -73,17 +93,17 @@ export function openCodeConfig({ lease = null, scopes = null, imageStudio = null
       mcp: { ...(config.mcp ?? {}), [imageStudio.name]: { type: 'local', command: [imageStudio.command, ...imageStudio.args], environment: imageStudio.env, enabled: true } },
     };
   }
-  if (memoryServer) {
+  for (const server of [memoryServer, ...mcpServers].filter(Boolean)) {
     config = {
       ...config,
-      mcp: { ...(config.mcp ?? {}), [memoryServer.name]: { type: 'local', command: [memoryServer.command, ...memoryServer.args], environment: memoryServer.env, enabled: true } },
+      mcp: { ...(config.mcp ?? {}), [server.name]: { type: 'local', command: [server.command, ...(server.args ?? [])], environment: server.env ?? {}, enabled: true } },
       agent: {
         'pulse-readonly': {
           ...config.agent['pulse-readonly'],
           permission: {
             ...config.agent['pulse-readonly'].permission,
-            [`${memoryServer.name}*`]: 'allow',
-            ...Object.fromEntries(memoryServer.tools.map((tool) => [`${memoryServer.name}_${tool}`, 'allow'])),
+            [`${server.name}*`]: 'allow',
+            ...Object.fromEntries((server.tools ?? []).map((tool) => [`${server.name}_${tool}`, 'allow'])),
           },
         },
       },
@@ -92,11 +112,11 @@ export function openCodeConfig({ lease = null, scopes = null, imageStudio = null
   return config;
 }
 
-export function openCodeEnvironment(environment = process.env, { lease = null, scopes = null, imageStudio = null, memoryServer = null } = {}) {
+export function openCodeEnvironment(environment = process.env, { lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] } = {}) {
   return {
     ...environment,
     OPENCODE_AUTO_SHARE: 'false',
-    OPENCODE_CONFIG_CONTENT: JSON.stringify(openCodeConfig({ lease, scopes, imageStudio, memoryServer })),
+    OPENCODE_CONFIG_CONTENT: JSON.stringify(openCodeConfig({ lease, scopes, imageStudio, memoryServer, mcpServers })),
     OPENCODE_DISABLE_AUTOUPDATE: 'true',
   };
 }
@@ -134,12 +154,12 @@ export function parseOpenCodeOutput(output) {
   return { text: text.join('').trim(), usage, ...(error ? { error } : {}) };
 }
 
-export function invokeOpenCode({ executable, projectRoot, prompt, timeoutMs = 120000, signal, model = null, attachments = [], lease = null, scopes = null, imageStudio = null, memoryServer = null }) {
+export function invokeOpenCode({ executable, projectRoot, prompt, timeoutMs = 120000, signal, model = null, attachments = [], lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] }) {
   return runReadonlyProcess({
     executable,
     args: buildOpenCodeArgs({ projectRoot, prompt, attachments, ...(model ? { model } : {}) }),
     cwd: projectRoot,
-    env: openCodeEnvironment(process.env, { lease, scopes, imageStudio, memoryServer }),
+    env: openCodeEnvironment(process.env, { lease, scopes, imageStudio, memoryServer, mcpServers }),
     timeoutMs,
     signal,
     label: 'OpenCode',

package/src/capabilities.mjs

@@ -87,8 +87,9 @@ export const MODES = {
   1: { key: 'exchange', label: 'EXCHANGE', hint: 'read the project and coordinate · default' },
   2: { key: 'create', label: 'CREATE', hint: 'create files and images inside .pulse/out/' },
   3: { key: 'control', label: 'CONTROL', hint: 'modify the project itself · only this agent · needs the override' },
+  4: { key: 'airlock', label: 'AIRLOCK', hint: 'run commands, push, deploy · what leaves the ship does not come back · override, twice' },
 };
-export const MODE_MAX = 3;
+export const MODE_MAX = 4;
 export const normalizeMode = (value, fallback = 1) => {
   const mode = Number(value);
   return Number.isInteger(mode) && mode >= 0 && mode <= MODE_MAX ? mode : fallback;
@@ -108,14 +109,16 @@ export function resolveScopes(agentId, configured = {}) {
     const wanted = configured[scope] ?? (scope !== 'web');
     scopes[scope] = { capable, enabled: capable && wanted, wired: true };
   }
-  // A standing lease: every turn of this agent may create files inside
-  // .pulse/out/ without the human arming CREATE each time. Opt-in per agent.
-  scopes.write.always = Boolean(configured.alwaysCreate) && scopes.write.enabled;
-  // The ceiling: how far the composer may take this agent. Writing needs the
-  // CLI to be able to write; CONTROL is capped at 2 until phase C wires it.
-  const wanted = normalizeMode(configured.maxMode, scopes.write.enabled ? 2 : 1);
-  scopes.maxMode = Math.min(wanted, scopes.write.capable ? 3 : 1);
-  scopes.defaultMode = scopes.write.always && scopes.maxMode >= 2 ? 2 : 1;
+  // One ceiling per agent: MAX MODE. Writing follows from it: an agent capped at #1 never
+  // writes, one allowed to #2 or #3 does. A `write: false` from an older config reads as #1.
+  const capableMax = scopes.write.capable ? 4 : 1;
+  const legacyCap = configured.write === false ? 1 : 4;
+  scopes.maxMode = Math.min(normalizeMode(configured.maxMode, scopes.write.capable ? 2 : 1), legacyCap, capableMax);
+  scopes.write.enabled = scopes.write.capable && scopes.maxMode >= 2;
+  // One start per agent: DEFAULT MODE, #1 or #2, never above the ceiling. An older
+  // `alwaysCreate` reads as #2. `write.always` keeps its name for the room's code.
+  scopes.defaultMode = Math.min(normalizeMode(configured.defaultMode, configured.alwaysCreate ? 2 : 1), 2, Math.max(1, scopes.maxMode));
+  scopes.write.always = scopes.defaultMode >= 2 && scopes.write.enabled;
   return scopes;
 }