@jungjaehoon/mama-os 0.10.0 → 0.10.2

package/dist/agent/agent-loop.js

@@ -45,7 +45,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgentLoop = void 0;
+exports.loadSkillContent = loadSkillContent;
 exports.loadInstalledSkills = loadInstalledSkills;
+exports.loadBackendAgentsMd = loadBackendAgentsMd;
 exports.loadComposedSystemPrompt = loadComposedSystemPrompt;
 exports.getGatewayToolsPrompt = getGatewayToolsPrompt;
 const fs_1 = require("fs");
@@ -53,7 +55,8 @@ const prompt_size_monitor_js_1 = require("./prompt-size-monitor.js");
 const codex_mcp_process_js_1 = require("./codex-mcp-process.js");
 const persistent_cli_adapter_js_1 = require("./persistent-cli-adapter.js");
 const gateway_tool_executor_js_1 = require("./gateway-tool-executor.js");
-const index_js_1 = require("../concurrency/index.js");
+const index_js_1 = require("./code-act/index.js");
+const index_js_2 = require("../concurrency/index.js");
 const session_pool_js_1 = require("./session-pool.js");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -183,16 +186,57 @@ function collectMarkdownFiles(dir, prefix = '') {
     }
     return results;
 }
+// ─── Skill On-Demand Injection ───────────────────────────────────────────────
 /**
- * Load installed & enabled skills from ~/.mama/skills/
- * Returns skill content blocks for system prompt injection.
- * Reads all .md files recursively (commands/, skills/, etc.)
+ * Parse YAML frontmatter from skill .md file
+ */
+function parseSkillFrontmatter(content) {
+    const match = content.match(/^---\n([\s\S]*?)\n---/);
+    if (!match)
+        return { name: '', description: '', keywords: [] };
+    const block = match[1];
+    const name = (block.match(/^name:\s*(.+)$/m)?.[1] ?? '').trim();
+    const description = (block.match(/^description:\s*(.+)$/m)?.[1] ?? '').trim();
+    const kwBlock = block.match(/^keywords:\n((?:[ \t]+-[ \t]*.+\n?)+)/m);
+    const keywords = kwBlock
+        ? kwBlock[1]
+            .trim()
+            .split('\n')
+            .map((l) => l.replace(/^[ \t]*-[ \t]*/, '').trim())
+            .filter((k) => k.length > 0)
+        : [];
+    return { name, description, keywords };
+}
+/**
+ * Find the main .md file for a directory skill (for frontmatter parsing)
+ */
+function findMainSkillFile(skillDir, skillName) {
+    for (const name of [`${skillName}.md`, 'skill.md', 'index.md']) {
+        const p = (0, path_1.join)(skillDir, name);
+        if ((0, fs_1.existsSync)(p))
+            return p;
+    }
+    try {
+        const entries = (0, fs_1.readdirSync)(skillDir, { withFileTypes: true });
+        for (const e of entries) {
+            if (e.isFile() && e.name.endsWith('.md') && !EXCLUDED_SKILL_FILES.has(e.name)) {
+                return (0, path_1.join)(skillDir, e.name);
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    return null;
+}
+/**
+ * Build skill catalog (one line per enabled skill) for system prompt.
+ * Format: "- [source/skillId] keywords: kw1, kw2 | description"
  */
-function loadInstalledSkills(verbose = false, options = {}) {
+function buildSkillCatalog(verbose = false) {
     const skillsBase = (0, path_1.join)((0, os_1.homedir)(), '.mama', 'skills');
     const stateFile = (0, path_1.join)(skillsBase, 'state.json');
-    const blocks = [];
-    // Load state (enabled/disabled tracking)
+    const catalog = [];
     let state = {};
     try {
         if ((0, fs_1.existsSync)(stateFile)) {
@@ -200,7 +244,7 @@ function loadInstalledSkills(verbose = false, options = {}) {
         }
     }
     catch {
-        // No state file
+        /* no state file */
     }
     const sources = ['mama', 'cowork', 'external'];
     for (const source of sources) {
@@ -213,76 +257,132 @@ function loadInstalledSkills(verbose = false, options = {}) {
                 if (!entry.isDirectory())
                     continue;
                 const stateKey = `${source}/${entry.name}`;
-                // Skip disabled skills
                 if (state[stateKey]?.enabled === false)
                     continue;
                 const skillDir = (0, path_1.join)(sourceDir, entry.name);
-                let mdFiles = collectMarkdownFiles(skillDir);
-                if (options.onlyCommands) {
-                    mdFiles = mdFiles.filter((f) => f.path.startsWith('commands/'));
-                }
-                if (mdFiles.length > 0) {
-                    const parts = mdFiles.map((f) => `## ${f.path}\n\n${f.content}`);
-                    blocks.push(`# [Skill: ${source}/${entry.name}]\n\n${parts.join('\n\n---\n\n')}`);
+                const mainFile = findMainSkillFile(skillDir, entry.name);
+                if (!mainFile)
+                    continue;
+                try {
+                    const content = (0, fs_1.readFileSync)(mainFile, 'utf-8');
+                    const fm = parseSkillFrontmatter(content);
+                    const description = fm.description || '';
+                    const keywords = fm.keywords.length > 0 ? fm.keywords.join(', ') : entry.name;
+                    catalog.push(`- [${stateKey}] keywords: ${keywords} | ${description}`);
                     if (verbose)
-                        console.log(`[AgentLoop] Loaded skill: ${source}/${entry.name} (${mdFiles.length} files)`);
+                        console.log(`[AgentLoop] Skill catalog: ${stateKey}`);
+                }
+                catch {
+                    /* skip unreadable */
                 }
             }
         }
         catch {
-            // Directory read failed
+            /* directory read failed */
         }
     }
-    // Also load flat .md skill files from ~/.mama/skills/ root
+    // Flat .md files at root
     try {
         const rootEntries = (0, fs_1.readdirSync)(skillsBase, { withFileTypes: true });
         for (const entry of rootEntries) {
-            if (!entry.isFile() || !entry.name.endsWith('.md')) {
+            if (!entry.isFile() || !entry.name.endsWith('.md'))
                 continue;
-            }
-            if (EXCLUDED_SKILL_FILES.has(entry.name)) {
+            if (EXCLUDED_SKILL_FILES.has(entry.name))
                 continue;
-            }
             const id = entry.name.replace(/\.md$/, '');
             const stateKey = `mama/${id}`;
-            // Skip disabled skills (check state like subdirectory skills)
-            if (state[stateKey]?.enabled === false) {
+            if (state[stateKey]?.enabled === false)
                 continue;
-            }
-            // Skip if already loaded from subdirectory
-            if (blocks.some((b) => b.includes(`[Skill: mama/${id}]`))) {
+            if (catalog.some((l) => l.includes(`[${stateKey}]`)))
                 continue;
+            try {
+                const content = (0, fs_1.readFileSync)((0, path_1.join)(skillsBase, entry.name), 'utf-8');
+                const fm = parseSkillFrontmatter(content);
+                const description = fm.description || '';
+                const keywords = fm.keywords.length > 0 ? fm.keywords.join(', ') : id;
+                catalog.push(`- [${stateKey}] keywords: ${keywords} | ${description}`);
+                if (verbose)
+                    console.log(`[AgentLoop] Skill catalog (flat): ${stateKey}`);
             }
-            const fullPath = (0, path_1.join)(skillsBase, entry.name);
-            let content = (0, fs_1.readFileSync)(fullPath, 'utf-8');
-            if (content.length > MAX_SKILL_FILE_CHARS) {
-                content = content.slice(0, MAX_SKILL_FILE_CHARS) + '\n\n[... truncated]';
+            catch {
+                /* skip */
             }
-            blocks.push(`# [Skill: mama/${id}]\n\n${content}`);
-            if (verbose)
-                console.log(`[AgentLoop] Loaded root skill: ${id}`);
         }
     }
     catch {
-        // Root directory read failed
+        /* root directory read failed */
     }
-    return blocks;
+    return catalog;
 }
-function loadComposedSystemPrompt(verbose = false, context) {
-    const mamaHome = (0, path_1.join)((0, os_1.homedir)(), '.mama');
-    const layers = [];
-    // Load state for conditional loading (skills + system docs)
-    const stateFile = (0, path_1.join)(mamaHome, 'skills', 'state.json');
-    let state = {};
-    try {
-        if ((0, fs_1.existsSync)(stateFile)) {
-            state = JSON.parse((0, fs_1.readFileSync)(stateFile, 'utf-8'));
+/**
+ * Load full skill content on-demand for per-message injection.
+ * @param skillId - Skill identifier like "mama/playground"
+ */
+function loadSkillContent(skillId) {
+    const skillsBase = (0, path_1.join)((0, os_1.homedir)(), '.mama', 'skills');
+    // Try directory skill first
+    const skillDir = (0, path_1.join)(skillsBase, skillId);
+    if ((0, fs_1.existsSync)(skillDir)) {
+        const mdFiles = collectMarkdownFiles(skillDir);
+        if (mdFiles.length > 0) {
+            const parts = mdFiles.map((f) => `## ${f.path}\n\n${f.content}`);
+            return `# [Skill: ${skillId}]\n\n${parts.join('\n\n---\n\n')}`;
         }
     }
-    catch (err) {
-        logger.error(`Failed to parse state file ${stateFile}:`, err);
-        throw new Error(`Failed to parse state file ${stateFile}: ${err instanceof Error ? err.message : String(err)}`);
+    // Try flat .md file: "mama/playground" → skills/playground.md
+    const idParts = skillId.split('/');
+    if (idParts.length >= 2) {
+        const flatPath = (0, path_1.join)(skillsBase, `${idParts[idParts.length - 1]}.md`);
+        if ((0, fs_1.existsSync)(flatPath)) {
+            try {
+                return (0, fs_1.readFileSync)(flatPath, 'utf-8');
+            }
+            catch {
+                /* skip */
+            }
+        }
     }
+    return null;
+}
+/**
+ * Load installed & enabled skills from ~/.mama/skills/
+ * Returns skill catalog lines for system prompt injection (on-demand mode).
+ * Full skill content is injected per-message via detectSkillMatch() in PromptEnhancer.
+ */
+function loadInstalledSkills(verbose = false, _options = {}) {
+    return buildSkillCatalog(verbose);
+}
+/**
+ * Load backend-specific AGENTS.md from ~/.mama/
+ * Maps backend to file: 'claude' → AGENTS.claude.md, 'codex-mcp' → AGENTS.codex.md
+ */
+function loadBackendAgentsMd(backend, verbose = false) {
+    if (!backend) {
+        return '';
+    }
+    const keyMap = {
+        claude: 'claude',
+        'codex-mcp': 'codex',
+    };
+    const key = keyMap[backend];
+    if (!key) {
+        return '';
+    }
+    const filePath = (0, path_1.join)((0, os_1.homedir)(), '.mama', `AGENTS.${key}.md`);
+    if ((0, fs_1.existsSync)(filePath)) {
+        if (verbose) {
+            console.log(`[AgentLoop] Loaded backend AGENTS.md: AGENTS.${key}.md`);
+        }
+        return (0, fs_1.readFileSync)(filePath, 'utf-8');
+    }
+    if (verbose) {
+        console.log(`[AgentLoop] Backend AGENTS.md not found: AGENTS.${key}.md`);
+    }
+    return '';
+}
+function loadComposedSystemPrompt(verbose = false, context) {
+    const mamaHome = (0, path_1.join)((0, os_1.homedir)(), '.mama');
+    const layers = [];
     // Load persona files: SOUL.md, IDENTITY.md, USER.md
     const personaFiles = ['SOUL.md', 'IDENTITY.md', 'USER.md'];
     for (const file of personaFiles) {
@@ -298,55 +398,54 @@ function loadComposedSystemPrompt(verbose = false, context) {
                 console.log(`[AgentLoop] Persona file not found (skipping): ${file}`);
         }
     }
-    // Load installed & enabled skills (HIGH PRIORITY — before CLAUDE.md)
-    const skillBlocks = loadInstalledSkills(verbose);
-    if (skillBlocks.length > 0) {
+    // Load skill catalog (on-demand mode — full content injected per-message by PromptEnhancer)
+    const skillCatalog = loadInstalledSkills(verbose);
+    if (skillCatalog.length > 0) {
         const skillDirective = [
-            '# Installed Skills (PRIORITY)',
+            '# Installed Skills',
             '',
-            '**IMPORTANT:** The following skills/plugins are installed by the user.',
-            'When a user request matches a skill by keywords or description, you MUST:',
-            '1. Find the matching skill section below (check "keywords" in frontmatter or skill name)',
-            '2. Follow its "지시사항" / instructions EXACTLY as written — do NOT improvise alternatives',
-            '3. Use the tools available to you (fetch, Bash, etc.) as the skill directs',
-            '4. DO NOT create separate scripts or files unless the skill explicitly instructs it',
-            '5. For [INSTALLED PLUGIN COMMAND] messages, find matching "commands/{name}.md"',
-            '6. DO NOT use the Skill tool — these are NOT system skills',
+            'To invoke a skill, include its keywords in your message.',
+            'The full skill instructions will be injected automatically when matched.',
             '',
-            skillBlocks.join('\n\n---\n\n'),
+            ...skillCatalog,
         ].join('\n');
         layers.push(skillDirective);
         if (verbose)
-            console.log(`[AgentLoop] Injected ${skillBlocks.length} installed skills`);
+            console.log(`[AgentLoop] Skill catalog: ${skillCatalog.length} skills`);
     }
-    // Add context prompt if AgentContext is provided (role awareness)
+    // Add minimal context if AgentContext is provided (role awareness)
     if (context) {
-        const contextPrompt = (0, context_prompt_builder_js_1.buildContextPrompt)(context);
-        if (verbose)
-            console.log(`[AgentLoop] Injecting context prompt for ${context.roleName}@${context.platform}`);
-        layers.push(contextPrompt);
+        layers.push((0, context_prompt_builder_js_1.buildMinimalContext)(context));
+    }
+    // Load backend-specific AGENTS.md (e.g., AGENTS.claude.md, AGENTS.codex.md)
+    const backendAgentsMd = loadBackendAgentsMd(context?.backend, verbose);
+    if (backendAgentsMd) {
+        layers.push(backendAgentsMd);
     }
     // Load CLAUDE.md (base instructions)
     const claudeMd = loadSystemPrompt(verbose);
     layers.push(claudeMd);
-    // Load ONBOARDING.md only if not disabled in state
-    // This contains config schema + bot setup guides - only needed during initial setup
-    if (state['system/onboarding']?.enabled !== false) {
+    // Load ONBOARDING.md only during initial setup (before SOUL.md is created)
+    const soulPath = (0, path_1.join)(mamaHome, 'SOUL.md');
+    if (!(0, fs_1.existsSync)(soulPath)) {
         const onboardingPath = (0, path_1.join)(mamaHome, 'ONBOARDING.md');
         if ((0, fs_1.existsSync)(onboardingPath)) {
             const onboardingContent = (0, fs_1.readFileSync)(onboardingPath, 'utf-8');
             layers.push(onboardingContent);
             if (verbose) {
-                logger.debug('Loaded ONBOARDING.md (setup reference)');
+                logger.debug('Loaded ONBOARDING.md (initial setup)');
             }
         }
     }
     else {
         if (verbose) {
-            logger.debug('Skipped ONBOARDING.md (disabled in state)');
+            logger.debug('Skipped ONBOARDING.md (SOUL.md exists, setup complete)');
         }
     }
-    return layers.join('\n\n---\n\n');
+    const result = layers.join('\n\n---\n\n');
+    // Debug: log each layer's size to find what's consuming context
+    logger.debug(`[SystemPrompt] Total: ${result.length} chars, layers: ${layers.map((l, i) => `L${i}=${l.length}`).join(', ')}`);
+    return result;
 }
 /**
  * Load Gateway Tools prompt from MD file
@@ -390,11 +489,14 @@ class AgentLoop {
     sessionPool;
     toolsConfig;
     isGatewayMode;
+    useCodeAct;
     backend;
     postToolHandler;
     stopContinuationHandler;
     preCompactHandler;
     preCompactInjected = false;
+    currentStreamCallbacks;
+    currentTier = 1;
     constructor(_oauthManager, options = {}, _clientOptions, executorOptions) {
         // Initialize tools config (hybrid Gateway/MCP routing)
         this.toolsConfig = {
@@ -414,6 +516,7 @@ class AgentLoop {
         const useGatewayMode = gatewayTools.includes('*') || gatewayTools.length > 0;
         const useMCPMode = mcpTools.includes('*') || mcpTools.length > 0;
         this.isGatewayMode = useGatewayMode;
+        this.useCodeAct = options.useCodeAct ?? false;
         if (useGatewayMode && useMCPMode) {
             logger.debug('🔀 Hybrid mode: Gateway + MCP tools enabled');
         }
@@ -423,38 +526,111 @@ class AgentLoop {
         else {
             logger.debug('⚙️ Gateway-only mode');
         }
-        // Build system prompt
-        const basePrompt = options.systemPrompt || loadComposedSystemPrompt();
-        // Only include Gateway Tools prompt if using Gateway mode
-        const gatewayToolsPrompt = useGatewayMode ? getGatewayToolsPrompt() : '';
-        let defaultSystemPrompt = gatewayToolsPrompt
-            ? `${basePrompt}\n\n---\n\n${gatewayToolsPrompt}`
-            : basePrompt;
-        // Monitor and enforce prompt size limits
+        // Build system prompt with layered truncation support
         const monitor = new prompt_size_monitor_js_1.PromptSizeMonitor();
-        const promptLayers = [
-            { name: 'base', content: basePrompt, priority: 1 },
-            ...(gatewayToolsPrompt
-                ? [{ name: 'gatewayTools', content: gatewayToolsPrompt, priority: 2 }]
-                : []),
-        ];
+        let promptLayers;
+        if (options.systemPrompt) {
+            // Custom system prompt (e.g., multi-agent): treat as a single critical layer
+            promptLayers = [{ name: 'custom', content: options.systemPrompt, priority: 1 }];
+        }
+        else {
+            // Composed prompt: build layers with individual priorities for graceful truncation
+            // Priority 1 (never cut): CLAUDE.md base instructions
+            // Priority 2 (cut if extreme): personas (SOUL, IDENTITY, USER) + gateway tools
+            // Priority 3 (cut first): context prompt + skills + onboarding
+            const mamaHome = (0, path_1.join)((0, os_1.homedir)(), '.mama');
+            const claudeMd = loadSystemPrompt();
+            const personaFiles = ['SOUL.md', 'IDENTITY.md', 'USER.md'];
+            const personaParts = [];
+            for (const file of personaFiles) {
+                const p = (0, path_1.join)(mamaHome, file);
+                if ((0, fs_1.existsSync)(p))
+                    personaParts.push((0, fs_1.readFileSync)(p, 'utf-8'));
+            }
+            const skillCatalog = loadInstalledSkills();
+            // Only load ONBOARDING.md during initial setup (before SOUL.md exists)
+            const onboardingContent = !(0, fs_1.existsSync)((0, path_1.join)(mamaHome, 'SOUL.md'))
+                ? (() => {
+                    const op = (0, path_1.join)(mamaHome, 'ONBOARDING.md');
+                    return (0, fs_1.existsSync)(op) ? (0, fs_1.readFileSync)(op, 'utf-8') : '';
+                })()
+                : '';
+            promptLayers = [
+                { name: 'claudeMd', content: claudeMd, priority: 1 },
+                ...(personaParts.length > 0
+                    ? [
+                        {
+                            name: 'personas',
+                            content: personaParts.join('\n\n---\n\n'),
+                            priority: 2,
+                        },
+                    ]
+                    : []),
+                ...(skillCatalog.length > 0
+                    ? [
+                        {
+                            name: 'skills',
+                            content: [
+                                '# Installed Skills',
+                                '',
+                                'To invoke a skill, include its keywords in your message.',
+                                '',
+                                ...skillCatalog,
+                            ].join('\n'),
+                            priority: 3,
+                        },
+                    ]
+                    : []),
+                ...(onboardingContent
+                    ? [{ name: 'onboarding', content: onboardingContent, priority: 4 }]
+                    : []),
+            ];
+        }
+        const backend = options.backend ?? 'claude';
+        // Load backend-specific AGENTS.md (e.g., AGENTS.claude.md, AGENTS.codex.md)
+        const backendAgentsMd = loadBackendAgentsMd(backend);
+        if (backendAgentsMd) {
+            promptLayers.push({ name: 'backendAgents', content: backendAgentsMd, priority: 2 });
+        }
+        if (useGatewayMode) {
+            if (this.useCodeAct) {
+                // Code-Act mode: replace verbose gateway tools markdown with compact .d.ts
+                const tierForTypeDefs = options.agentContext?.tier === 1 ||
+                    options.agentContext?.tier === 2 ||
+                    options.agentContext?.tier === 3
+                    ? options.agentContext.tier
+                    : 1;
+                const typeDefs = index_js_1.TypeDefinitionGenerator.generate(tierForTypeDefs);
+                const codeActBackend = backend === 'codex-mcp' ? 'codex-mcp' : 'claude';
+                const codeActPrompt = (0, index_js_1.getCodeActInstructions)(codeActBackend) + '\n```typescript\n' + typeDefs + '\n```';
+                promptLayers.push({ name: 'codeAct', content: codeActPrompt, priority: 2 });
+            }
+            else {
+                const gatewayToolsPrompt = getGatewayToolsPrompt();
+                if (gatewayToolsPrompt) {
+                    promptLayers.push({ name: 'gatewayTools', content: gatewayToolsPrompt, priority: 2 });
+                }
+            }
+        }
         const checkResult = monitor.check(promptLayers);
         if (checkResult.warning) {
             logger.warn(checkResult.warning);
         }
-        // Actually enforce truncation if over budget
+        // Enforce truncation if over budget (priority > 1 layers trimmed first)
         if (!checkResult.withinBudget) {
             const { layers: trimmedLayers, result: enforceResult } = monitor.enforce(promptLayers);
             if (enforceResult.truncatedLayers.length > 0) {
                 logger.warn(`Truncated layers: ${enforceResult.truncatedLayers.join(', ')}`);
             }
-            const trimmedBase = trimmedLayers.find((l) => l.name === 'base')?.content || basePrompt;
-            const trimmedTools = trimmedLayers.find((l) => l.name === 'gatewayTools')?.content || '';
-            defaultSystemPrompt = trimmedTools ? `${trimmedBase}\n\n---\n\n${trimmedTools}` : trimmedBase;
-            logger.debug(`System prompt truncated: ${checkResult.totalChars} → ${defaultSystemPrompt.length} chars`);
+            promptLayers = trimmedLayers;
+            logger.debug(`System prompt truncated: ${checkResult.totalChars} → ${enforceResult.totalChars} chars`);
         }
+        const defaultSystemPrompt = promptLayers
+            .filter((l) => l.content.length > 0)
+            .map((l) => l.content)
+            .join('\n\n---\n\n');
         // Choose backend (default: claude)
-        this.backend = options.backend ?? 'claude';
+        this.backend = backend;
         if (this.backend === 'codex-mcp') {
             // Codex MCP mode: standard MCP protocol
             const workspaceDir = (0, path_1.join)((0, os_1.homedir)(), '.mama', 'workspace');
@@ -469,23 +645,28 @@ class AgentLoop {
                 systemPrompt: defaultSystemPrompt,
                 compactPrompt: 'Summarize the conversation concisely, preserving key decisions and context.',
                 timeoutMs: options.timeoutMs,
+                codexHome: (0, path_1.join)((0, os_1.homedir)(), '.mama', '.codex'),
             });
             logger.debug('Codex MCP backend enabled');
         }
         else {
             // Claude backend: always use PersistentCLI for fast responses (~2-3s vs ~16-30s)
             this.persistentCLI = new persistent_cli_adapter_js_1.PersistentCLIAdapter({
-                model: options.model ?? 'claude-sonnet-4-20250514',
+                model: options.model,
                 sessionId,
                 systemPrompt: defaultSystemPrompt,
-                // Hybrid mode: pass MCP config even with Gateway tools enabled
+                // MCP config: only pass when MCP mode is enabled (gateway mode uses GatewayToolExecutor)
                 mcpConfigPath: useMCPMode ? mcpConfigPath : undefined,
-                // Headless daemon requires skipping permission prompts (no TTY available).
-                // Security is enforced by MAMA's RoleManager, not Claude CLI's interactive prompts.
-                // MAMA_TRUSTED_ENV must be set to enable this flag (defense in depth)
-                dangerouslySkipPermissions: process.env.MAMA_TRUSTED_ENV === 'true' && (options.dangerouslySkipPermissions ?? false),
+                // MAMA OS is a headless daemon (no TTY) — Claude CLI's interactive permission prompts
+                // cannot work. Security is enforced by MAMA's own RoleManager layer (config.yaml roles).
+                // DO NOT gate this on env vars — MAMA manages permissions via its config, not Claude CLI.
+                dangerouslySkipPermissions: options.dangerouslySkipPermissions ?? false,
                 // Gateway tools are processed by GatewayToolExecutor (hybrid with MCP)
                 useGatewayTools: useGatewayMode,
+                // Code-Act: available as optional tool alongside direct tools (no disallowedTools)
+                disallowedTools: undefined,
+                // Pass configured timeout (default in PersistentCLI: 120s — too short for complex tasks)
+                requestTimeout: options.timeoutMs,
             });
             this.agent = this.persistentCLI;
             logger.debug('🚀 Claude PersistentCLI mode enabled - faster responses');
@@ -497,12 +678,11 @@ class AgentLoop {
         this.mcpExecutor = new gateway_tool_executor_js_1.GatewayToolExecutor(executorOptions);
         this.systemPromptOverride = options.systemPrompt;
         this.maxTurns = options.maxTurns ?? DEFAULT_MAX_TURNS;
-        // Use the same default model as CLI wrappers above (L252, L264)
-        this.model = options.model ?? 'claude-sonnet-4-20250514';
+        this.model = options.model;
         this.onTurn = options.onTurn;
         this.onToolUse = options.onToolUse;
         this.onTokenUsage = options.onTokenUsage;
-        this.laneManager = (0, index_js_1.getGlobalLaneManager)();
+        this.laneManager = (0, index_js_2.getGlobalLaneManager)();
         this.useLanes = options.useLanes ?? false;
         this.sessionKey = options.sessionKey ?? 'default';
         this.sessionPool = (0, session_pool_js_1.getSessionPool)();
@@ -624,10 +804,21 @@ class AgentLoop {
      * Internal implementation of runWithContent (without lane queueing)
      */
     async runWithContentInternal(content, options) {
+        this.currentStreamCallbacks = options?.streamCallbacks;
         const history = [];
         const totalUsage = { input_tokens: 0, output_tokens: 0 };
         let turn = 0;
         let stopReason = 'end_turn';
+        // Propagate agentContext to executor for tier-aware tool permissions
+        if (options?.agentContext) {
+            this.mcpExecutor.setAgentContext?.(options.agentContext);
+            const rawTier = options.agentContext.tier ?? 1;
+            this.currentTier = (rawTier === 1 || rawTier === 2 || rawTier === 3 ? rawTier : 1);
+        }
+        else {
+            this.mcpExecutor.setAgentContext?.(null);
+            this.currentTier = 1;
+        }
         // Infinite loop prevention
         let consecutiveToolCalls = 0;
         let lastToolName = '';
@@ -640,10 +831,19 @@ class AgentLoop {
         // MessageRouter already calls getSession() and passes the result via options
         let sessionIsNew = options?.resumeSession === undefined ? true : !options.resumeSession;
         let ownedSession = false;
-        // Set session ID on the agent (works for both ClaudeCLIWrapper and PersistentCLIAdapter)
+        // Set session ID on the agent
+        // Claude PersistentCLI: process alive → CONTINUE (stdin message), process dead → NEW (spawn with --session-id)
+        // Codex: threadId alive → CONTINUE (codex-reply), threadId null → NEW (codex tool)
+        const isCodex = this.backend === 'codex-mcp';
+        const sessionLabel = (isNew) => {
+            if (isCodex) {
+                return isNew ? 'NEW thread' : 'CONTINUE thread';
+            }
+            return isNew ? 'NEW process' : 'CONTINUE session';
+        };
         if (options?.cliSessionId) {
             this.agent.setSessionId(options.cliSessionId);
-            console.log(`[AgentLoop] Using caller session: ${channelKey} → ${options.cliSessionId} (${sessionIsNew ? 'NEW' : 'RESUME'})`);
+            console.log(`[AgentLoop] [${isCodex ? 'codex' : 'claude'}] ${channelKey} (${sessionLabel(sessionIsNew)})`);
         }
         else {
             // Fallback: get session from pool (for direct AgentLoop usage)
@@ -655,13 +855,27 @@ class AgentLoop {
             sessionIsNew = isNew;
             ownedSession = true;
             this.agent.setSessionId(cliSessionId);
-            console.log(`[AgentLoop] Session pool: ${channelKey} → ${cliSessionId} (${isNew ? 'NEW' : 'RESUME'})`);
+            console.log(`[AgentLoop] [${isCodex ? 'codex' : 'claude'}] ${channelKey} (${sessionLabel(isNew)})`);
         }
         try {
             if (options?.systemPrompt) {
                 // Skip gateway tools if already embedded in systemPrompt (e.g. by MessageRouter)
-                const alreadyHasTools = options.systemPrompt.includes('# Gateway Tools');
-                const gatewayToolsPrompt = this.isGatewayMode && !alreadyHasTools ? getGatewayToolsPrompt() : '';
+                const alreadyHasTools = options.systemPrompt.includes('## Gateway Tools') ||
+                    options.systemPrompt.includes('# Code Execution') ||
+                    options.systemPrompt.includes('## Code-Act');
+                let gatewayToolsPrompt = '';
+                const isResumingSession = options?.resumeSession === true;
+                if (this.isGatewayMode && !alreadyHasTools && !isResumingSession) {
+                    if (this.useCodeAct) {
+                        const typeDefs = index_js_1.TypeDefinitionGenerator.generate(this.currentTier);
+                        const codeActBackend = this.backend === 'codex-mcp' ? 'codex-mcp' : 'claude';
+                        gatewayToolsPrompt =
+                            (0, index_js_1.getCodeActInstructions)(codeActBackend) + '\n```typescript\n' + typeDefs + '\n```';
+                    }
+                    else {
+                        gatewayToolsPrompt = getGatewayToolsPrompt();
+                    }
+                }
                 const fullPrompt = gatewayToolsPrompt
                     ? `${options.systemPrompt}\n\n---\n\n${gatewayToolsPrompt}`
                     : options.systemPrompt;
@@ -711,29 +925,32 @@ class AgentLoop {
                     throw new types_js_1.AgentError(`Emergency stop: Agent loop exceeded emergency maximum turns (${EMERGENCY_MAX_TURNS})`, 'EMERGENCY_MAX_TURNS', undefined, false);
                 }
                 let response;
+                const ext = this.currentStreamCallbacks;
                 const callbacks = {
                     onDelta: (text) => {
-                        console.log('[Streaming] Delta received:', text.length, 'chars');
+                        ext?.onDelta?.(text);
+                    },
+                    onToolUse: (name, input) => {
+                        ext?.onToolUse?.(name, input);
                     },
-                    onToolUse: (name, _input) => {
-                        console.log(`[Streaming] Tool called: ${name}`);
+                    onToolComplete: (name, toolUseId, isError) => {
+                        ext?.onToolComplete?.(name, toolUseId, isError);
                     },
-                    onFinal: (_finalResponse) => {
-                        console.log('[Streaming] Stream complete');
+                    onFinal: (finalResponse) => {
+                        ext?.onFinal?.(finalResponse);
                     },
                     onError: (error) => {
-                        console.error('[Streaming] Error:', error);
-                        // Don't throw - let the promise rejection handle it
+                        ext?.onError?.(error);
                     },
                 };
                 let piResult;
-                // Pass role-specific model and resume flag based on session state
-                // First turn of new session: --session-id (inject system prompt)
-                // Subsequent turns (tool loop) or resumed sessions: --resume (skip system prompt)
+                // Claude: First turn → --session-id (inject system prompt), subsequent → --resume
+                // Codex: resumeSession only controls threadId reset (false=new thread, true=continue)
                 const shouldResume = !sessionIsNew || turn > 1;
                 // Both Claude PersistentCLI and Codex MCP preserve context - only send new messages
                 const promptText = this.formatLastMessageOnly(history);
                 try {
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- onFinal signature differs between PersistentCLI and Codex
                     piResult = await this.agent.prompt(promptText, callbacks, {
                         model: options?.model,
                         resumeSession: shouldResume,
@@ -753,7 +970,9 @@ class AgentLoop {
                     const isSessionInUse = errorMessage.includes('is already in use');
                     const isPromptTooLong = errorMessage.includes('Prompt is too long') ||
                         errorMessage.includes('prompt is too long') ||
-                        errorMessage.includes('request_too_large');
+                        errorMessage.includes('request_too_large') ||
+                        errorMessage.includes('context window') ||
+                        errorMessage.includes('context_length_exceeded');
                     if (isSessionNotFound || isSessionInUse || isPromptTooLong) {
                         const reason = isSessionNotFound
                             ? 'not found in CLI'
@@ -762,10 +981,10 @@ class AgentLoop {
                                 : 'prompt too long (context overflow)';
                         console.log(`[AgentLoop] Session ${reason}, retrying with new session`);
                         // Reset session in pool so it creates a new one
-                        this.sessionPool.resetSession(channelKey);
-                        const newSessionId = this.sessionPool.getSessionId(channelKey);
+                        const newSessionId = this.sessionPool.resetSession(channelKey);
                         this.agent.setSessionId(newSessionId);
                         // Retry with new session (--session-id instead of --resume)
+                        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- onFinal signature differs between PersistentCLI and Codex
                         piResult = await this.agent.prompt(promptText, callbacks, {
                             model: options?.model,
                             resumeSession: false, // Force new session
@@ -784,9 +1003,16 @@ class AgentLoop {
                 // Build content blocks - include tool_use blocks if present
                 const contentBlocks = [];
                 let parsedToolCalls = [];
-                // Parse tool_call blocks from text response (Gateway Tools mode ONLY)
+                // Parse tool_call / code_act blocks from text response (Gateway Tools mode ONLY)
                 if (this.isGatewayMode) {
                     parsedToolCalls = this.parseToolCallsFromText(piResult.response || '');
+                    // Code-Act: parse ```js blocks only if enabled
+                    if (this.useCodeAct) {
+                        const codeActCalls = this.parseCodeActBlocks(piResult.response || '');
+                        if (codeActCalls.length > 0) {
+                            parsedToolCalls.push(...codeActCalls);
+                        }
+                    }
                     const textWithoutToolCalls = this.removeToolCallBlocks(piResult.response || '');
                     if (textWithoutToolCalls.trim()) {
                         contentBlocks.push({ type: 'text', text: textWithoutToolCalls });
@@ -971,6 +1197,7 @@ class AgentLoop {
             if (ownedSession) {
                 this.sessionPool.releaseSession(channelKey);
             }
+            this.currentStreamCallbacks = undefined;
         }
     }
     /**
@@ -982,27 +1209,63 @@ class AgentLoop {
         for (const toolUse of toolUseBlocks) {
             let result;
             let isError = false;
+            // Notify stream: tool execution starting
+            this.currentStreamCallbacks?.onToolUse?.(toolUse.name, toolUse.input);
             try {
-                // PreToolUse: search MAMA for contracts before Write operations
-                let contractContext = '';
-                if (toolUse.name === 'Write' && toolUse.input) {
-                    contractContext = await this.searchContractsForTool(toolUse.name, toolUse.input);
+                // Code-Act: execute JS code in sandbox
+                if (toolUse.name === index_js_1.CODE_ACT_MARKER) {
+                    const codeInput = toolUse.input;
+                    const code = typeof codeInput?.code === 'string' ? codeInput.code : '';
+                    const codeActResult = code
+                        ? await this.executeCodeAct(code, this.currentTier)
+                        : {
+                            success: false,
+                            error: {
+                                name: 'ValidationError',
+                                message: 'Missing or invalid "code" field in code_act input',
+                            },
+                            logs: [],
+                            metrics: { durationMs: 0, hostCallCount: 0, memoryUsedBytes: 0 },
+                        };
+                    result = JSON.stringify(codeActResult, null, 2);
+                    if (!codeActResult.success) {
+                        isError = true;
+                    }
+                    this.onToolUse?.(toolUse.name, toolUse.input, codeActResult);
+                    this.currentStreamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, isError);
                 }
-                const toolResult = await this.mcpExecutor.execute(toolUse.name, toolUse.input);
-                result = JSON.stringify(toolResult, null, 2);
-                if (contractContext) {
-                    result = `${contractContext}\n\n---\n\n${result}`;
+                else {
+                    // PreToolUse: search MAMA for contracts before Write operations
+                    let contractContext = '';
+                    if (toolUse.name === 'Write' && toolUse.input) {
+                        contractContext = await this.searchContractsForTool(toolUse.name, toolUse.input);
+                    }
+                    const toolResult = await this.mcpExecutor.execute(toolUse.name, toolUse.input);
+                    result = JSON.stringify(toolResult, null, 2);
+                    // Check if tool execution failed
+                    const hasSuccess = 'success' in toolResult;
+                    const toolFailed = hasSuccess && !toolResult.success;
+                    if (toolFailed) {
+                        isError = true;
+                    }
+                    if (contractContext) {
+                        result = `${contractContext}\n\n---\n\n${result}`;
+                    }
+                    // Notify tool use callback
+                    this.onToolUse?.(toolUse.name, toolUse.input, toolResult);
+                    // PostToolUse: auto-extract contracts (fire-and-forget)
+                    this.postToolHandler?.processInBackground(toolUse.name, toolUse.input, toolResult);
+                    // Notify stream: tool completed (check actual status)
+                    this.currentStreamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, isError);
                 }
-                // Notify tool use callback
-                this.onToolUse?.(toolUse.name, toolUse.input, toolResult);
-                // PostToolUse: auto-extract contracts (fire-and-forget)
-                this.postToolHandler?.processInBackground(toolUse.name, toolUse.input, toolResult);
             }
             catch (error) {
                 isError = true;
                 result = error instanceof Error ? error.message : String(error);
                 // Notify tool use callback with error
                 this.onToolUse?.(toolUse.name, toolUse.input, { error: result });
+                // Notify stream: tool completed with error
+                this.currentStreamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, true);
             }
             results.push({
                 type: 'tool_result',
@@ -1078,10 +1341,77 @@ class AgentLoop {
         return toolCalls;
     }
     /**
-     * Remove tool_call blocks from text (to avoid duplication in response)
+     * Parse ```js code blocks as code_act tool calls (Code-Act mode)
+     */
+    parseCodeActBlocks(text) {
+        const blocks = [];
+        const codeActRegex = /```(?:js|javascript)\s*\n([\s\S]*?)\n```/g;
+        let match;
+        while ((match = codeActRegex.exec(text)) !== null) {
+            const code = match[1].trim();
+            if (code) {
+                blocks.push({
+                    type: 'tool_use',
+                    id: `code_act_${(0, crypto_1.randomUUID)()}`,
+                    name: index_js_1.CODE_ACT_MARKER,
+                    input: { code },
+                });
+            }
+        }
+        return blocks;
+    }
+    /**
+     * Execute Code-Act JS code in a sandboxed QuickJS environment
+     */
+    async executeCodeAct(code, tier = 1) {
+        try {
+            const sandbox = new index_js_1.CodeActSandbox();
+            const bridge = new index_js_1.HostBridge(this.mcpExecutor);
+            bridge.onToolUse = (toolName, input, result) => {
+                if (result === undefined) {
+                    // Tool starting — surface to stream
+                    this.currentStreamCallbacks?.onToolUse?.(toolName, input);
+                }
+                if (result !== undefined) {
+                    // Tool completed — notify callback
+                    this.onToolUse?.(toolName, input, result);
+                    const isError = typeof result === 'object' &&
+                        result !== null &&
+                        'success' in result &&
+                        !result.success;
+                    this.currentStreamCallbacks?.onToolComplete?.(toolName, `code_act_sub_${Date.now()}`, isError);
+                }
+            };
+            bridge.injectInto(sandbox, tier);
+            const result = await sandbox.execute(code);
+            if (result.logs.length > 0) {
+                console.log(`[CodeAct] console output: ${result.logs.join('\n')}`);
+            }
+            return result;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`[CodeAct] Sandbox initialization failed: ${message}`);
+            return {
+                success: false,
+                error: {
+                    name: 'SandboxError',
+                    message: `Failed to initialize Code-Act sandbox: ${message}`,
+                },
+                logs: [],
+                metrics: { durationMs: 0, hostCallCount: 0, memoryUsedBytes: 0 },
+            };
+        }
+    }
+    /**
+     * Remove tool_call and code_act blocks from text (to avoid duplication in response)
      */
     removeToolCallBlocks(text) {
-        return text.replace(/```tool_call\s*\n[\s\S]*?\n```/g, '').trim();
+        let result = text.replace(/```tool_call\s*\n[\s\S]*?\n```/g, '');
+        if (this.useCodeAct) {
+            result = result.replace(/```(?:js|javascript)\s*\n[\s\S]*?\n```/g, '');
+        }
+        return result.trim();
     }
     extractTextFromContent(content) {
         return content