@minionry/minion 0.7.36 → 0.7.39

package/bin/commands/minions.js

@@ -66,6 +66,25 @@ export function describeMinions(instances = loadInstances()) {
     .sort((a, b) => a.port - b.port);
 }
 
+export function pickLaunchedInstance(instances, { workingDirectory, environment, launchedAt }) {
+  return (
+    instances
+      .filter(
+        (instance) =>
+          Number.isInteger(instance?.pid) &&
+          instance.workingDirectory === workingDirectory &&
+          (instance.environment ?? 'production') === environment &&
+          typeof instance.startedAt === 'number' &&
+          instance.startedAt >= launchedAt
+      )
+      .sort((a, b) => b.startedAt - a.startedAt)[0] ?? null
+  );
+}
+
+export function findLaunchedMinion(criteria) {
+  return pickLaunchedInstance(loadInstances(), criteria);
+}
+
 function printNoMinions() {
   log('\n  No minion servers registered on this machine.\n', colors.bold);
   log('  Start one:', colors.bold);

package/bin/minion.js

@@ -336,12 +336,32 @@ function resolveStartScript() {
   return 'dev';
 }
 
-function runNpmScriptDetached(script, args = [], envOverrides = {}) {
+const REGISTER_WAIT_MS = 20000;
+const REGISTER_POLL_MS = 150;
+
+async function waitForLaunchedServerPid(child, criteria) {
+  const { findLaunchedMinion } = await import('./commands/minions.js');
+  const deadline = Date.now() + REGISTER_WAIT_MS;
+  let launchExited = false;
+  child.once('exit', () => {
+    launchExited = true;
+  });
+
+  for (;;) {
+    const instance = findLaunchedMinion(criteria);
+    if (instance) return instance.pid;
+    if (launchExited || Date.now() >= deadline) return null;
+    await new Promise((resolveTick) => setTimeout(resolveTick, REGISTER_POLL_MS));
+  }
+}
+
+async function runNpmScriptDetached(script, args = [], envOverrides = {}) {
   const logDir = machinePath('logs');
   if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
   const logPath = join(logDir, `minionry-${new Date().toISOString().replace(/[:.]/g, '-')}.log`);
   const logFd = openSync(logPath, 'a');
 
+  const launchedAt = Date.now();
   const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
   const child = spawn(npmCmd, ['run', '--silent', script, ...args], {
     cwd: CLIENT_ROOT,
@@ -353,7 +373,6 @@ function runNpmScriptDetached(script, args = [], envOverrides = {}) {
 
   child.on('error', (err) => {
     log(`Error: ${err.message}`, colors.red);
-    closeSync(logFd);
     process.exit(1);
   });
 
@@ -361,7 +380,17 @@ function runNpmScriptDetached(script, args = [], envOverrides = {}) {
   closeSync(logFd);
 
   log(`\n  ${APP_NAME} started in background`, colors.bold + colors.green);
-  log(`  Stop: kill ${child.pid}`, colors.dim);
+  const serverPid = await waitForLaunchedServerPid(child, {
+    workingDirectory: USER_CWD,
+    environment: envOverrides.MINIONRY_ENV ?? 'production',
+    launchedAt,
+  });
+  log(
+    serverPid === null
+      ? '  Stop: minion list minions, then minion shutdown <pid>'
+      : `  Stop: minion shutdown ${serverPid}`,
+    colors.dim
+  );
   log('  Status: minion status', colors.dim);
   log(`  Remote control: ${envOverrides.APP_ORIGIN || 'https://app.minionry.com'}\n`, colors.dim);
   process.exit(0);
@@ -657,7 +686,7 @@ async function startServer(envOverrides, { foreground = false } = {}) {
   if (foreground) {
     runNpmScript(script, [], envOverrides);
   } else {
-    runNpmScriptDetached(script, [], envOverrides);
+    await runNpmScriptDetached(script, [], envOverrides);
   }
 }
 

package/dist/server/cli/headless/claude-invoker-process.js

@@ -5,8 +5,10 @@ import { randomUUID } from 'node:crypto';
 import { mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { machineFile } from '../../../bin/machine-layout.js';
+import { TOOL_LESS_CLAUDE_ARGS } from '../../engines/claude/claude-command.js';
 import { resolveModelProfile } from '../../engines/credentials/model-profiles.js';
 import { ANTHROPIC_PROVIDER_ID, getApiKey, } from '../../engines/credentials/provider-credentials.js';
+import { BOUNCER_HOOK_TOOLS, BOUNCER_PERMISSION_MODE, bouncerSpawnSettings, bouncerToolName, PERMISSION_PROMPT_TOOL, } from '../../mcp/permission-channels.js';
 import { isDirectory } from '../../services/pathUtils.js';
 import { profileAllowsBrowserControl } from '../../services/sdk/run-profile.js';
 import { getMaxConcurrentSessions, getSubagentModel, getSubagentModelForce, } from '../../services/settings.js';
@@ -84,7 +86,8 @@ export function handleSpawnError(error, config, reject) {
     }
     reject(new Error(formatted));
 }
-function buildSettingsOverride(config) {
+const PERMISSION_REQUEST_HOOK_TIMEOUT_S = 31 * 60;
+function buildSettingsOverride(config, bouncerActive) {
     const override = {};
     if (config.ultracode || config.effortLevel === 'ultracode') {
         override.ultracode = true;
@@ -92,6 +95,9 @@ function buildSettingsOverride(config) {
     if (config.fastMode) {
         override.fastMode = true;
     }
+    if (bouncerActive) {
+        Object.assign(override, bouncerSpawnSettings(PERMISSION_REQUEST_HOOK_TIMEOUT_S));
+    }
     return Object.keys(override).length > 0 ? JSON.stringify(override) : null;
 }
 export function isOpusTierModel(model) {
@@ -145,7 +151,7 @@ browserMcpActive = false) {
     if (effort) {
         args.push('--effort', effort);
     }
-    const settingsOverride = config.inferenceOnly ? null : buildSettingsOverride(config);
+    const settingsOverride = config.inferenceOnly ? null : buildSettingsOverride(config, mcpConfigPath !== null);
     if (settingsOverride) {
         args.push('--settings', settingsOverride);
     }
@@ -156,7 +162,7 @@ browserMcpActive = false) {
         args.push('--input-format', 'stream-json');
     }
     if (config.inferenceOnly) {
-        args.push('--tools', '', '--strict-mcp-config');
+        args.push(...TOOL_LESS_CLAUDE_ARGS);
         return args;
     }
     if (config.claudeSessionId && config.continueSession) {
@@ -165,19 +171,27 @@ browserMcpActive = false) {
     else if (config.continueSession) {
         args.push('--continue');
     }
-    const disallowedTools = [
-        ...new Set([...(config.disallowedTools ?? []), ...(config.appRunProfile?.disallowedTools ?? [])]),
-    ];
+    const disallowedTools = resolveDisallowedTools(config, mcpConfigPath !== null);
     if (disallowedTools.length > 0) {
         args.push('--disallowedTools', disallowedTools.join(','));
     }
     pushPermissionAndPromptArgs(args, config, mcpConfigPath, browserMcpActive);
     return args;
 }
+function resolveDisallowedTools(config, bouncerActive) {
+    return [
+        ...new Set([
+            ...(config.disallowedTools ?? []),
+            ...(config.appRunProfile?.disallowedTools ?? []),
+            ...(bouncerActive ? BOUNCER_HOOK_TOOLS : []),
+        ]),
+    ];
+}
 function pushPermissionAndPromptArgs(args, config, mcpConfigPath, browserMcpActive) {
     if (mcpConfigPath) {
         args.push('--mcp-config', mcpConfigPath);
-        args.push('--permission-prompt-tool', 'mcp__minionry-bouncer__approval_prompt');
+        args.push('--permission-prompt-tool', bouncerToolName(PERMISSION_PROMPT_TOOL));
+        args.push('--permission-mode', BOUNCER_PERMISSION_MODE);
         if (browserMcpActive) {
             args.push('--strict-mcp-config');
         }
@@ -216,6 +230,8 @@ function writeImageAttachmentsToStdin(claudeProcess, prompt, config) {
 const CLAUDE_SUBPROCESS_ENV_DEFAULTS = {
     CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS: '0',
     CLAUDE_CODE_ENABLE_TODO_TOOLS: '1',
+    CLAUDE_CODE_MAX_OUTPUT_TOKENS: '64000',
+    DISABLE_NONESSENTIAL_TRAFFIC: '1',
 };
 function claudeCredentialEnv(model) {
     const resolved = resolveModelProfile(model);

package/dist/server/cli/headless/claude-invoker-stream.js

@@ -1,5 +1,6 @@
 // Copyright (c) 2025-present Minionry, Inc.
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { clampInput, clampText, DEFAULT_CHAT_TIMELINE_LIMITS } from '../../services/timeline/index.js';
 import { applyStreamEventToBackground } from './background-activity.js';
 import { engineAvailability } from './engine-availability.js';
 import { classifyEngineNotice, isSyntheticModel } from './engine-notice.js';
@@ -242,7 +243,12 @@ function handleToolResult(parsed, ctx) {
             toolEntry.duration = Date.now() - toolEntry.startTime;
         }
         if (ctx.config.toolUseCallback) {
-            ctx.config.toolUseCallback({ type: 'tool_result', toolId, result: resultStr, isError });
+            ctx.config.toolUseCallback({
+                type: 'tool_result',
+                toolId,
+                result: clampText(resultStr, DEFAULT_CHAT_TIMELINE_LIMITS.maxToolResultChars),
+                isError,
+            });
         }
     }
 }
@@ -474,7 +480,6 @@ function handleToolInputDelta(event, ctx) {
     if (toolBuffer)
         toolBuffer.inputJson += partialJson;
     ctx.lastTokenActivityTime = Date.now();
-    ctx.config.toolUseCallback?.({ type: 'tool_input_delta', partialJson, index });
 }
 function handleToolComplete(event, ctx) {
     if (event.type !== 'content_block_stop')
@@ -495,7 +500,7 @@ function handleToolComplete(event, ctx) {
     ctx.toolInputBuffers.delete(index);
     ctx.config.toolUseCallback?.({
         type: 'tool_complete', toolName: toolBuffer.name, toolId: toolBuffer.id,
-        index, completeInput
+        index, completeInput: clampInput(completeInput, DEFAULT_CHAT_TIMELINE_LIMITS.maxToolInputChars)
     });
 }
 function handleToolStreamEvents(event, ctx) {

package/dist/server/cli/headless/haiku-assessments.js

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
 import { spawn } from 'node:child_process';
 import { homedir } from 'node:os';
+import { TOOL_LESS_CLAUDE_ARGS } from '../../engines/claude/claude-command.js';
 import { isDirectory } from '../../services/pathUtils.js';
 import { loadSkillPrompt } from '../../services/plan/agent-loader.js';
 import { engineAvailability } from './engine-availability.js';
@@ -64,7 +65,7 @@ export function spawnHaikuRaw(prompt, claudeCommand, verbose, label, options = {
         };
         let proc;
         try {
-            proc = spawn(claudeCommand, ['--print', '--model', 'haiku', prompt], { stdio: ['ignore', 'pipe', 'pipe'], cwd: options.cwd ?? resolveAssessorCwd() });
+            proc = spawn(claudeCommand, ['--print', '--model', 'haiku', ...TOOL_LESS_CLAUDE_ARGS, prompt], { stdio: ['ignore', 'pipe', 'pipe'], cwd: options.cwd ?? resolveAssessorCwd() });
         }
         catch (err) {
             settled = true;

package/dist/server/cli/headless/mcp-config.js

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { ensureMachineDir } from '../../../bin/machine-layout.js';
+import { BOUNCER_MCP_SERVER_NAME } from '../../mcp/permission-channels.js';
 import { APP_TOOLS_MCP_SERVER_PATH, BROWSER_MCP_SERVER_PATH, IS_COMPILED, MCP_SERVER_PATH, MINIONRY_ROOT, QUALITY_MCP_SERVER_PATH, } from '../../utils/paths.js';
 import { herror, hlog } from './headless-logger.js';
 const APP_TOOLS_MCP_SERVER_NAME = 'minionry-app-tools';
@@ -286,7 +287,7 @@ export function generateMcpConfig(workingDir, verbose = false, options = {}) {
         const browserEntry = browserMcp ? buildBrowserMcpEntry(browserMcp) : null;
         const qualityEntry = qualityMcp ? buildQualityMcpEntry(qualityMcp) : null;
         const mcpServers = {
-            'minionry-bouncer': {
+            [BOUNCER_MCP_SERVER_NAME]: {
                 command: launcher.command,
                 args: [...launcher.argsPrefix, MCP_SERVER_PATH],
                 description: 'Minionry security bouncer for approving/denying Claude Code tool use',

package/dist/server/engines/claude/claude-command.js

@@ -21,6 +21,7 @@ function isExecutableFile(path) {
         return false;
     }
 }
+export const TOOL_LESS_CLAUDE_ARGS = ['--tools', '', '--strict-mcp-config'];
 export function resolveClaudeCommand({ env = process.env, home = homedir(), isExecutable = isExecutableFile, } = {}) {
     const override = env.CLAUDE_COMMAND?.trim();
     if (override)

package/dist/server/engines/factory.js

@@ -8,6 +8,7 @@ import { ProviderCredentialStore } from './credentials/provider-credentials.js';
 import { HermesEngine } from './hermes/HermesEngine.js';
 import { createHermesAuth } from './hermes/hermes-auth.js';
 import { planHermesAppRunGatewayHome, planHermesGatewayHome, planHermesProfileGatewayHome, provisionHermesGatewayHome, } from './hermes/hermes-gateway-home.js';
+import { hermesGatewayRegistry } from './hermes/hermes-gateway-registry.js';
 function provisionAppRunGatewayHome(model, appRun) {
     const owned = resolveModelProfile(model);
     const plan = owned?.profile.engine === 'hermes'
@@ -23,6 +24,7 @@ export function createEngine(engineId) {
             return new CodexEngine({ resolveCommand: () => resolveCodexCommand() });
         case 'hermes':
             return new HermesEngine({
+                gateways: hermesGatewayRegistry(),
                 auth: createHermesAuth(),
                 provisionGatewayHome: (model, browserMcp, appRun) => {
                     if (appRun)