@mmerterden/multi-agent-pipeline 20.30.0 → 20.33.0

package/CHANGELOG.md

@@ -16,6 +16,86 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.33.0] - 2026-10-25
+
+### Added
+
+- Office: pipelines run step by step. Agents wait at the open office and walk over to take their seat in a run's room. The table sign counts phases from 1 over the run's own phases, fills the current phase as its tasks finish and names the task in progress; the run window shows each phase's checklist and a seat shows its own tasks and recent MCP calls. A finished run stays two minutes.
+- `task-mirror.sh`, a PostToolUse hook on `TaskCreate` / `TaskUpdate`: the native task list of the session driving a run lands in that run's tracker under the phase in progress, so the office and the terminal show the same list. Phase tiles are skipped, nothing is written outside a run bound to the session, and the hook never prints.
+- The analysis mode has its own phase names in `schemas/phases.json` (Intake, Evidence, Synthesis, Review, Publish, Report); `/multi-agent:test-gen` and a standalone `/multi-agent:review` register tracker runs with their own steps, on Claude Code and Copilot CLI alike.
+- Office rooms per repository are typed: Development rooms (`/multi-agent`) and Analysis rooms (`/multi-agent:analysis`), each floor keeping a free Analysis room; a run that touches more repositories opens an annex desk on theirs. Labels go through one layout pass and never overlap; a thought cloud over a working agent says what it is doing and opens its detail.
+- Office reception has two new-run desks (development and analysis) that list Jira and GitHub issues and take free text.
+- Office mail room: pull requests on every GitHub account `gh` is logged in to, each asked with its own token, and on the configured Bitbucket Server.
+- Office server room: the key cabinet (`GET /v1/credentials`, names and probe verdicts from `credential-inventory.sh`, never a value, local-only) and the system panel (`GET /v1/system`: CPU, memory, disk and the pipeline's own processes, numbers only). The library holds per-repository memory (`GET /v1/memory`: code graph age, learnings, findings and session notes, redacted). The restroom previews and prunes old run logs through `prune-logs.sh` (`POST /v1/prune-logs`, two steps, 7, 30 or 90 days, local-only).
+- Office orientation room: a trainer next to reception opens a guide built from the floor that is drawn, listing every room with the windows it opens, how both pipelines run, what is a job, a window or terminal-only, the security model and the signs. Each visit points at it in the feed; the page keeps nothing in browser storage.
+- Five read-only office jobs: doctor, route status, scan, scenario audit and analysis review (19 jobs in all). Commands that stay in the terminal say why instead of offering a copy button.
+- Office tables seat a run's whole crew from the start, one seat per role each phase uses (planner and plan critic, developer and dev critic, three reviewers, committer, reporter; an analysis run its own): whoever's phase runs works, later ones wait for their turn, finished ones stay seated.
+- The table sign names where the work came from (the Jira key, the GitHub issue as `repo#N`, both when an issue got a Jira, or free text), what a waiting run waits for (a local test, the report channels, an answer here, or a question in the terminal) and, once finished, the pull request it opened. `runs-index` carries `source`, `prNumber`, `mode`, `channels` and the local-only `channelUrls` (runs surface 1.3.0). The client contract is 1.6.0: the six new routes, and the activity and pull-request surfaces at 1.1.0. A run with no tracker still lists every phase of its mode.
+- A question a session asks in its own terminal counts as waiting for you: the table glows, the HUD counts it, the feed says so and the tab title shows the number; the drawer says to answer it in the terminal. The HUD reads agents working, runs and sessions.
+- Office settings screen in the manager's office (`GET/POST /v1/settings`, local-only, two steps, one change at a time): output language, the fable rung and model routing, each through the script its terminal command runs (`office-settings.mjs`). Route on keeps the saved strategy and scope; rules, free providers and prompt language stay in the terminal.
+- Phase 5 records each report channel's outcome in `state.channelResults`; the run window lists where the report went, with the addresses (https only) from the run record, which drops them from a redacted answer.
+- The memory shelf offers a code graph build or refresh for each repository, through the graph job.
+- Office characters come in twelve looks: six sheets and a recoloured second set, so every role at a run's table looks different. The team window shows every character with its portrait, the office staff and the agent pool apart, and the chat drawer shows the character actually at the seat.
+- README and README.tr gain an office section with screenshots; README.tr gains the hooks-per-host table README has.
+- Office rooms carry more of a real office: pictures, a clock and hanging plants on free wall, and a plant in each free corner, never behind a tall piece, under a room's sign or in anyone's way.
+- The autopilot window is one switch that says the state and flips it, the three numbers that matter, and the repository selection; stop buttons appear only while it runs, and with no repository it says how one is added.
+
+### Changed
+
+- Office roles on the floor and in the feed are translated, and phase events count from 1 like the table sign.
+- `/multi-agent:office-on` describes the panel as it is; the help catalog says the server runs until `office-off`.
+- `prune-logs.sh` spares a run that can still be resumed (an `agent-state.json` status that is not finished, abandoned or cancelled) unless `--task` names it; `--only-from=FILE` limits a prune to a confirmed list. The office prunes only the folders its preview listed, passing them through `--only-from`, and refuses with `changed` when the set moved.
+- `phase-tracker.sh task <N> <id> deleted` takes a mirrored task off the list, as a native `TaskUpdate` with status `deleted` does. A task id used again in a later phase updates that phase's task.
+- Text cut to fit a field (`transcript-index` excerpts) counts its ` ...` ending toward the limit.
+- An MCP call a turn left without a result is closed as failed, so no desk stands at the server rack forever. A task created between two phases is mirrored under the phase about to start.
+- The key cabinet shows every verdict `credential-inventory.sh --probe` gives (malformed, no credential, probe error, server error, tier ready, needs a grant) and calls one it does not know unknown instead of not checked.
+- The Bitbucket pull request list authenticates the way the credential inventory does: Basic with a stored `bitbucket_user`, else the token as a bearer. On a `gh` without `auth token --user`, the active account answers alone.
+- The system panel counts only a node, npx or npm process as the toolkit server, and on macOS reports used memory from `vm_stat` (reclaimable pages count as free).
+- A memory store line that is not a JSON object is skipped, a shelf that cannot be read is left out instead of failing the answer, and a graph dated in the future reads as zero days old.
+- The room sign names only commands that exist; an autopilot job reads `/multi-agent autopilot` as its run does. Prunes run one at a time. A language change the preferences file could not take, or whose command descriptions were not switched, is reported as failed.
+- The office translates numbered roles in the run window and chat drawer, the HUD counts sessions apart from solo jobs, the job form names the scenario audit's CSV field, and a run's head and crew stay at the table until it leaves.
+- A run that just finished keeps only the session that ran it, so a session that starts the next run within two minutes sits at the new table.
+- Office wall-station labels sit inside their room instead of above the top wall, and `smoke-office-runtime.sh` checks that no two labels overlap at any zoom step. A floor station's label sits above its tallest piece, hotbar labels fit under their icons, and room signs never cover a picture or board; the runtime smoke checks all three.
+- `schemas/phases.schema.json` allows a mode's own phase `names`.
+
+### Security
+
+- `GET /v1/system` measures with child processes off the event loop; requests that arrive while one measures share its answer, and the log folder size is reused for a minute. `GET /v1/memory` reads its stores asynchronously, parses only their last megabyte, and skips a store that is a FIFO, a symlink or anything but a regular file.
+- Turning routing on from the office names, in its confirmation, the saved free provider chain it brings back and whether that chain allows training.
+- `/multi-agent:scenario-audit` writes its verdicts in a folder of the run's own instead of a fixed name under `/tmp`.
+- The Bitbucket token is read from the credential store with a deadline and sent only over https (a loopback host excepted); redirects are not followed. A redacted pull request list carries no URL or login.
+- `resolveToken` gives the credential store a deadline. A GitHub Enterprise Server account's token reaches `gh` as `GH_ENTERPRISE_TOKEN` as well.
+- Office threat model rows T19 to T24 cover the new routes, the PR listing, the task mirror hook, the settings screen and report links.
+
+## [20.32.0] - 2026-10-25
+
+### Added
+
+- Office: a repository can be added from any window that picks one. Checkouts earlier runs worked in are suggested, a path can be typed, and a registered entry whose folder is gone can be taken off the list; each is a two-step write (`POST /v1/repos`, `DELETE /v1/repos/{id}`), and only a git checkout is accepted. `GET /v1/repos?all=1` (`launch-request.mjs repos --all`) lists the suggested and the missing entries by id, never by path to a page.
+- Office keeps itself current: the open page shows a reload banner when a newer page is installed and reloads onto it through a fresh one-time code (`GET /office/version`, `POST /office/reload`); `office-on` replaces a running server whose code changed on disk. A server that has stopped is said so on the page.
+- The office ships the toolkit version the release was checked against (`office/toolkit.json`, written by `office-build.mjs` from `docs/facts.json` and held by `--check`), so the Tools window starts an exact version with no manual step and every pipeline update moves it forward. `MA_TOOLKIT_VERSION` and `prefs.global.office.toolkitVersion` still override it. The Tools window shows the version; nothing writes the preferences file.
+- Office: hand a job to someone. Clicking a person or a station opens the jobs that role does (`schemas/office-jobs.json`: 14 jobs, each parameter typed by kind, no free text); the confirmation names the exact prompt, the repository and what the job writes outside this machine, and the second step starts `claude --bg` with the unattended profile and no shell (`GET/POST /v1/jobs`, two steps). A team job meets in its repository's room and is refused while another run is live there (`room-busy`); a solo job sits at a desk under its role. Every start is recorded under `logs/multi-agent/office/jobs/` (0600). The autopilot runner and the office start sessions through one launcher, `pipeline/lib/bg-launch.mjs`.
+- Office is a company building: a hall with the lobby, the open office and the kitchen on top, then the manager's office, library, server room, test lab, analysis room, archive, mail room and restroom, with each repository's meeting rooms below. Thirteen staff work in their rooms; the hotbar moves the camera to a room, and each room's window holds its commands (the cleanup in the restroom previews `/v1/gc` before it runs). Copy buttons are gone: the New run flow, PR review and the command cards start real jobs.
+- Office furniture drawn for this project: 16 sprites kept as pixel grids in `pipeline/office-art` and rendered into PNGs by `office-build.mjs` with a dependency-free encoder; `--check` holds the PNGs to their sources.
+- `smoke-office-ui.sh`: the signed-in panel driven by Playwright (adding a repository, the refusal of a folder that is not a checkout, command cards, the reload banner, a stopped server).
+
+### Security
+
+- The unattended profile denies reading `~/.claude/logs/multi-agent/contract-server/` (a `Read` deny, a sandbox `denyRead`, and in `MCP_TOOLKIT_INDEX_DENY` together with the office state directory), where the local server keeps its bearer token, so a session the office or the autopilot starts cannot pick it up. Every install adds the deny rules and index-deny directories a newer release ships to an existing `multi-agent-unattended.settings.json` without changing what it allows (`tightenUnattendedProfile`), so the autopilot's profile check keeps passing after an update.
+- `POST /v1/jobs` starts nothing unless agent-guard.sh is registered for every tool (`guard-missing`), re-checks at the confirmation that the repository is still allowed, and keeps claude's own error output off the page.
+
+### Changed
+
+- Office: the panel's server runs until `/multi-agent:office-off`; it no longer stops after an idle time or after 8 hours. `contract-server.mjs` takes `--idle-minutes 0` and `--max-hours 0` for that, and keeps its 15 minute and 8 hour defaults when started on its own. The open page checks in once a minute, also in a background tab, and says so when the server has stopped.
+- Office: command cards keep their button on the title row; long names are cut with the full name on hover.
+- `/multi-agent:sync` checks the office instead of copying it: the committed page matches its sources, the installed copies match the page, and the recorded toolkit version is reported (Step 3e).
+
+## [20.31.0] - 2026-10-25
+
+### Changed
+
+- Office: every run meets in its own walled room inside its repository's room. The orchestrator sits at the head of a long table with a computer, the agents face each other along it, and the table grows with the team from two to six chairs a side. Agent labels sit above the near row and below the far one; on a narrow floor the chairs are packed and labels show on hover. Free meeting rooms finish the row, a hall on the left leads in, and the floor reaches the bottom of the stage. The corridor label of a run over several repositories now sits beside the room name.
+
 ## [20.30.0] - 2026-10-25
 
 ### Added

package/README.md

@@ -353,6 +353,50 @@ Continuous mode therefore needs the `claude` binary on `PATH` everywhere. The
 queue and the repo selection live in `~/.claude/autopilot/` on every host, on
 purpose - two CLIs on one machine must read one queue, not two.
 
+## The office
+
+A local web page that shows the pipeline as a pixel office and lets you drive
+it. `/multi-agent:office-on` starts the contract server on 127.0.0.1 and opens
+the page with a one-time code; the server runs until `/multi-agent:office-off`.
+
+![The company floor: reception, orientation, the open office, kitchen, accounting and the restroom](.github/office/floor.png)
+
+- **Runs come alive.** Agents wait at their desks in the open office and walk
+  to a run's room when the run calls their role. Each repository has its own
+  floor of Development rooms (`/multi-agent`) and Analysis rooms
+  (`/multi-agent:analysis`); a run that touches more repositories opens an
+  annex desk on theirs.
+- **The native task widget, on the table.** The table sign shows the phase
+  (`Phase 3/6 Dev`), a bar that fills as that phase's tasks finish and the
+  task in progress. A PostToolUse hook copies `TaskCreate` / `TaskUpdate` into
+  the run's tracker, so the office and the terminal show the same list. A
+  thought cloud over a working agent says what it is doing.
+- **The rest of the ecosystem has a room.** Reception starts a run from a Jira
+  or GitHub issue or free text. The mail room lists pull requests on every
+  GitHub account `gh` is logged in to and on Bitbucket Server. The server room
+  holds the toolkit MCP tools, the services, the key cabinet (names and probe
+  verdicts, never a value) and the machine's CPU, memory and disk. The library
+  holds stacks, commands and what the pipeline learned per repository. The
+  restroom clears worktrees, abandoned runs and old run logs after a preview.
+  Accounting shows tokens and cost, the manager's office holds autopilot,
+  routines and the settings (output language, the fable rung, model routing),
+  and the orientation room explains the building.
+- **People take jobs.** Click one, pick a job, confirm. Writes that change the
+  machine are local-only and take two requests. Work that is interactive or
+  changes the installation stays in the terminal, and the commands window says
+  why for each command.
+
+![Repository floors with Development and Analysis rooms, a live analysis and an annex desk](.github/office/rooms.png)
+
+| Command                      | What it does                                                    |
+| ---------------------------- | --------------------------------------------------------------- |
+| `/multi-agent:office-on`     | Start or reuse the server and open the page                     |
+| `/multi-agent:office-status` | Whether it runs, its URL (never the token) and its last actions |
+| `/multi-agent:office-off`    | Stop the server; it runs until you do                           |
+
+Security model: [office threat model](pipeline/multi-agent-refs/features/office-threat-model.md).
+Phone access is not part of this installation.
+
 ## Which model answers
 
 The ladder is `fable -> opus -> sonnet -> haiku`, and a run walks it on failure.
@@ -458,6 +502,7 @@ The **secret scan** runs as a `PreToolUse` hook on Claude Code (hard-blocks a co
 | `agent-guard.sh` (attribution, force-push, skipped git hooks, argv secrets, closure confirmations, read-only repos, unattended policy) | PreToolUse `Bash`, file edits, fetch and toolkit tools | none | none |
 | `run-scope-guard.sh` (Figma phase rule, worktree boundary warning) | PreToolUse Figma tools, file edits | none: the phase records its own MCP calls | none |
 | `run-stop-guard.sh` (no silent stop mid-run) | Stop | none: halts stay the phase's own write | none |
+| `task-mirror.sh` (native task list into the run tracker, so the office shows it) | PostToolUse `TaskCreate`/`TaskUpdate` | none: the phase calls `phase-tracker.sh task` itself | none: the phase calls `phase-tracker.sh task` itself |
 | `edit-syntax-gate.sh` | PostToolUse file edits | PostToolUse `apply_patch` | none: Copilot discards postToolUse output |
 | `check-read-size.sh`, capture hooks | registered | none | none |
 

package/README.tr.md

@@ -352,6 +352,51 @@ Dolayısıyla sürekli mod her hostta `claude` binary'sinin `PATH`'te olmasını
 istiyor. Kuyruk ve repo seçimi her hostta `~/.claude/autopilot/` altında durur;
 bu bilinçli - bir makinedeki iki CLI tek kuyruk okumalı, iki değil.
 
+## Ofis
+
+Pipeline'ı piksel bir ofis olarak gösteren ve oradan yönetmeni sağlayan yerel
+bir web sayfası. `/multi-agent:office-on` sözleşme sunucusunu 127.0.0.1'de
+başlatır ve sayfayı tek kullanımlık bir kodla açar; sunucu
+`/multi-agent:office-off` ile durdurulana kadar çalışır.
+
+![Şirket katı: resepsiyon, oryantasyon, açık ofis, mutfak, muhasebe ve tuvalet](.github/office/floor-tr.png)
+
+- **Koşular canlanır.** Ajanlar açık ofiste masalarında bekler. Bir koşu
+  rollerini çağırınca koşunun odasına yürürler. Her reponun kendi katı var:
+  Geliştirme odaları (`/multi-agent`) ve Analiz odaları
+  (`/multi-agent:analysis`). Birden fazla repoya dokunan koşu, diğer repoların
+  katında şube masası açar.
+- **Terminaldeki görev listesi masada.** Masa tabelası fazı (`Faz 3/6 Dev`),
+  fazın görevleri bittikçe dolan çubuğu ve sürmekte olan görevi gösterir. Bir
+  PostToolUse hook'u `TaskCreate` / `TaskUpdate` çağrılarını koşunun
+  takipçisine yazar; ofis ile terminal aynı listeyi gösterir. Çalışan ajanın
+  üstündeki bulut ne yaptığını söyler.
+- **Ekosistemin geri kalanının da odası var.** Resepsiyon, Jira ya da GitHub
+  issue'sundan veya serbest metinden koşu başlatır. Posta odası, `gh`'nin
+  oturum açtığı tüm GitHub hesaplarındaki ve Bitbucket Server'daki PR'ları
+  listeler. Sunucu odasında toolkit MCP araçları, servisler, anahtar dolabı
+  (ad ve canlı kontrol sonucu, asla değer) ve makinenin CPU, bellek ve disk durumu
+  var. Kütüphane stack'leri, komutları ve pipeline'ın repo başına öğrendiklerini
+  tutar. Tuvalet, önizleme gösterdikten sonra worktree'leri, yarım kalan
+  koşuları ve eski koşu loglarını temizler. Muhasebe token ve maliyeti
+  gösterir. Yönetici odasında otopilot, rutinler ve ayarlar (çıktı dili,
+  Fable basamağı, model yönlendirmesi) var. Oryantasyon odası binayı anlatır.
+- **Kişiler iş alır.** Birine tıkla, iş seç, onayla. Makineyi değiştiren
+  yazmalar yalnızca yereldir ve iki istek ister. Etkileşimli ya da kurulumu
+  değiştiren işler terminalde kalır; komutlar penceresi her komut için sebebini
+  yazar.
+
+![Geliştirme ve Analiz odalarıyla repo katları, süren bir analiz ve bir şube masası](.github/office/rooms-tr.png)
+
+| Komut                        | Ne yapar                                                 |
+| ---------------------------- | -------------------------------------------------------- |
+| `/multi-agent:office-on`     | Sunucuyu başlatır ya da var olanı kullanır, sayfayı açar |
+| `/multi-agent:office-status` | Çalışıyor mu, adresi (token asla) ve son işlemleri       |
+| `/multi-agent:office-off`    | Sunucuyu durdurur; sen durdurana kadar çalışır           |
+
+Güvenlik modeli: [ofis tehdit modeli](pipeline/multi-agent-refs/features/office-threat-model.md).
+Telefondan erişim bu kurulumun parçası değil.
+
 ## Hangi model cevaplıyor
 
 Merdiven `fable -> opus -> sonnet -> haiku`; koşu başarısızlıkta merdiveni iner.
@@ -450,6 +495,20 @@ triage notu bunu belirtir.
 
 **Secret scan**, Claude Code'da bir `PreToolUse` hook'u olarak (bulgu halinde commit'i sert-engeller) ve diğer yerlerde bir pre-push kontrolü olarak çalışır.
 
+**Host başına hook'lar.** Zorlayan hook'lar Claude Code'a ait; `install` bunları kaydeder, `/multi-agent:doctor` (`hook-reachability`) ayarlarında hangisinin eksik olduğunu söyler.
+
+| Hook | Claude Code | Codex CLI | Copilot CLI |
+| --- | --- | --- | --- |
+| `pre-commit-check.sh` (secret taraması, sahipli yollar, attended build/test kanıtı, unattended defteri) | PreToolUse `Bash` | yok: pre-push kontrolü | yok: pre-push kontrolü |
+| `agent-guard.sh` (atıf, force-push, atlanan git hook'ları, argv'de secret, kapanış onayları, salt okunur repolar, unattended politikası) | PreToolUse `Bash`, dosya düzenlemeleri, fetch ve toolkit araçları | yok | yok |
+| `run-scope-guard.sh` (Figma faz kuralı, worktree sınırı uyarısı) | PreToolUse Figma araçları, dosya düzenlemeleri | yok: faz kendi MCP çağrılarını kaydeder | yok |
+| `run-stop-guard.sh` (koşu ortasında sessizce durmaz) | Stop | yok: duraklama fazın kendi yazımı olarak kalır | yok |
+| `task-mirror.sh` (terminaldeki görev listesini koşunun takipçisine yazar, ofis de onu gösterir) | PostToolUse `TaskCreate`/`TaskUpdate` | yok: faz `phase-tracker.sh task`'ı kendisi çağırır | yok: faz `phase-tracker.sh task`'ı kendisi çağırır |
+| `edit-syntax-gate.sh` | PostToolUse dosya düzenlemeleri | PostToolUse `apply_patch` | yok: Copilot postToolUse çıktısını atar |
+| `check-read-size.sh`, capture hook'ları | kayıtlı | yok | yok |
+
+Bir host'ta eşdeğer hook yoksa kural yine faz dokümanlarında durur; orada zorlama değil, bir istektir.
+
 ## Pipeline koşusu dışında
 
 Pipeline'ı kurmak yalnız onu çalıştırdığında işe yaramıyor. Sıradan bir oturum açtığında aynı üç şey elinin altında; her sohbette yüklenen `rules/outside-the-pipeline.md` bunları duyuruyor:

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-10-24",
-  "version": "20.30.0",
+  "generatedAt": "2026-10-25",
+  "version": "20.33.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -33,7 +33,7 @@
   "modes": {
     "full": [0, 1, 2, 3, 4, 5],
     "autopilot": [0, 1, 2, 3, 4, 5],
-    "analysis": [0, 1, 3, 4, 5]
+    "analysis": [0, 1, 2, 3, 4, 5]
   },
   "commandCount": 69,
   "skillCount": 165,

package/install/_unattended-profile.mjs

@@ -316,6 +316,67 @@ export function buildUnattendedProfile(current = {}, opts = {}) {
   return next;
 }
 
+/**
+ * Bring an existing profile up to the shipped deny rules without touching
+ * anything else: only permissions.deny and the sandbox's denyRead and
+ * denyWrite grow, so a release that adds a deny reaches every installed
+ * profile on the next install, and nothing it allows changes. No profile file,
+ * or one that does not parse, is left alone.
+ *
+ * @param {{home:string, dryRun?:boolean}} opts
+ * @returns {{path:string, added:string[], written:boolean}}
+ */
+export function tightenUnattendedProfile({ home, dryRun = false }) {
+  const path = unattendedSettingsPath(home);
+  if (!existsSync(path)) return { path, added: [], written: false };
+  let current;
+  try {
+    current = JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return { path, added: [], written: false };
+  }
+  if (!current || typeof current !== "object" || Array.isArray(current))
+    return { path, added: [], written: false };
+  const added = [];
+  const perms = { ...(current.permissions || {}) };
+  const deny = Array.isArray(perms.deny) ? [...perms.deny] : [];
+  for (const [rule] of PROFILE.deny) {
+    if (hasRule(deny, rule)) continue;
+    deny.push(rule);
+    added.push(`deny:${rule}`);
+  }
+  const next = { ...current, permissions: { ...perms, deny } };
+  // Directories the toolkit's index refuses: a list, so it only grows too.
+  for (const [key, value] of PROFILE.env) {
+    if (key !== "MCP_TOOLKIT_INDEX_DENY") continue;
+    const env = current.env && typeof current.env === "object" ? current.env : {};
+    const have = String(env[key] ?? "")
+      .split(",")
+      .map((x) => x.trim())
+      .filter(Boolean);
+    const missing = value.split(",").filter((x) => !have.includes(x));
+    if (!missing.length) continue;
+    next.env = { ...env, [key]: [...have, ...missing].join(",") };
+    added.push(...missing.map((x) => `env.${key}:${x}`));
+  }
+  const sb = current.sandbox;
+  if (sb && typeof sb === "object" && !Array.isArray(sb)) {
+    const fs = sb.filesystem && typeof sb.filesystem === "object" ? sb.filesystem : {};
+    const nextFs = { ...fs };
+    for (const key of ["denyRead", "denyWrite"]) {
+      const have = Array.isArray(fs[key]) ? fs[key].map(String) : [];
+      const missing = PROFILE.sandbox.filesystem[key].filter((p) => !have.includes(p));
+      if (!missing.length) continue;
+      nextFs[key] = [...have, ...missing];
+      added.push(...missing.map((p) => `sandbox.${key}:${p}`));
+    }
+    next.sandbox = { ...sb, filesystem: nextFs };
+  }
+  if (!added.length || dryRun) return { path, added, written: false };
+  writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+  return { path, added, written: true };
+}
+
 /**
  * Write the profile into its own settings file. Idempotent: running it twice
  * changes nothing the second time.