@openrig/cli 0.6.4 → 0.6.6

package/daemon/dist/startup.js

@@ -15,7 +15,7 @@ import { migrate } from "./db/migrate.js";
 import { ALL_MIGRATIONS } from "./db/all-migrations.js";
 import { RigRepository } from "./domain/rig-repository.js";
 import { SessionRegistry } from "./domain/session-registry.js";
-import { isHumanSeatSessionRef, parseSessionName } from "./domain/session-name.js";
+import { deriveCanonicalSessionName, isHumanSeatSessionRef, parseSessionName } from "./domain/session-name.js";
 import { resolveExternal } from "./domain/gateway/external-admission.js";
 import { loadHumanRegistry } from "./domain/gateway/human-registry.js";
 import { EventBus } from "./domain/event-bus.js";
@@ -24,6 +24,7 @@ import { TmuxOptionDefaultsApplier } from "./domain/tmux-option-defaults.js";
 import { TmuxAdapter } from "./adapters/tmux.js";
 import { CmuxAdapter } from "./adapters/cmux.js";
 import { execArgvCommand, execCommand } from "./adapters/tmux-exec.js";
+import { execPreflightCommand } from "./adapters/preflight-exec.js";
 import { createCmuxCliTransport } from "./adapters/cmux-transport.js";
 import { SnapshotRepository } from "./domain/snapshot-repository.js";
 import { CheckpointStore } from "./domain/checkpoint-store.js";
@@ -33,7 +34,11 @@ import { ClaudeManagedLaunch } from "./domain/claude-managed-launch.js";
 import { ClaudeResumeAdapter } from "./adapters/claude-resume.js";
 import { CodexResumeAdapter } from "./adapters/codex-resume.js";
 import { codexDaemonSupportProbe } from "./domain/codex-daemon-support.js";
+import { codexNetworkDefaultReader } from "./domain/codex-network-default.js";
+import { prepareCodexTeamWorkspace } from "./domain/codex-team-workspace.js";
 import { PiResumeAdapter } from "./adapters/pi-resume.js";
+import { OmpResumeAdapter } from "./adapters/omp-resume.js";
+import { OMP_PROVIDER_ENV_VARS, OMP_PROVIDER_EXTRA_ENV_VARS } from "./adapters/pi-runner-protocol.js";
 import { RigSpecExporter } from "./domain/rigspec-exporter.js";
 import { PodRepository } from "./domain/pod-repository.js";
 import { RigSpecPreflight } from "./domain/rigspec-preflight.js";
@@ -50,6 +55,7 @@ import { ExternalInstallPlanner } from "./domain/external-install-planner.js";
 import { ExternalInstallExecutor } from "./domain/external-install-executor.js";
 import { PackageInstallService } from "./domain/package-install-service.js";
 import { BootstrapOrchestrator } from "./domain/bootstrap-orchestrator.js";
+import { routeBundleContents } from "./domain/bundle-content-routing.js";
 import { TmuxDiscoveryScanner } from "./domain/tmux-discovery-scanner.js";
 import { SessionFingerprinter } from "./domain/session-fingerprinter.js";
 import { SessionEnricher } from "./domain/session-enricher.js";
@@ -74,6 +80,7 @@ import { setSelfHostId, setSelfHostIdSource } from "./domain/hosts/fanout-contra
 import { UpCommandRouter } from "./domain/up-command-router.js";
 import { RigTeardownOrchestrator } from "./domain/rig-teardown.js";
 import { ResumeMetadataRefresher } from "./domain/resume-metadata-refresher.js";
+import { observeClaudePaneStartedAt } from "./domain/native-process-lineage.js";
 import { TranscriptStore } from "./domain/transcript-store.js";
 import { resumeRunningTranscriptCaptures } from "./domain/transcript-capture.js";
 import { SessionTransport } from "./domain/session-transport.js";
@@ -85,6 +92,7 @@ import { ChatRepository } from "./domain/chat-repository.js";
 import { StreamStore } from "./domain/stream-store.js";
 import { SlowOpRecorder } from "./domain/slow-op-recorder.js";
 import { configureSyncSiteRecorder } from "./domain/sync-site-wrap.js";
+import { RequestPhaseObserver } from "./domain/request-phase-observer.js";
 import { QueueRepository, isBlockerLive } from "./domain/queue-repository.js";
 import { createWorkflowFrontierPredicate } from "./domain/workflow-frontier-guard.js";
 import { InboxHandler } from "./domain/inbox-handler.js";
@@ -132,7 +140,7 @@ import nodePath from "node:path";
 // status + error_message columns to workflow_specs so the scanner
 // can record diagnostic rows. SC-29 #10 declared verbatim in commit body.
 import { RigModeStore } from "./domain/rig-mode/rig-mode-store.js";
-import { OperatingPostureService } from "./domain/rig-mode/operating-posture.js";
+import { OperatingPostureService, configuredCatalogPath } from "./domain/rig-mode/operating-posture.js";
 import { MissionControlActionLog } from "./domain/mission-control/mission-control-action-log.js";
 import { MissionControlWriteContract } from "./domain/mission-control/mission-control-write-contract.js";
 import { MissionControlReadLayer } from "./domain/mission-control/mission-control-read-layer.js";
@@ -171,7 +179,21 @@ const KNOWN_PROVIDER_AUTH_ENV = new Set([
     // operator names it in recovery.provider_auth_env_allowlist.
     "AWS_BEARER_TOKEN_BEDROCK",
 ]);
-export function collectAllowlistedProviderAuthEnv(raw, env) {
+// OMP seat providers, derived from the runner's OMP map so a key the runner
+// can pass is always admissible. Admitted only into OMP seats' launch env;
+// every other runtime keeps KNOWN_PROVIDER_AUTH_ENV above. Double opt-in is
+// unchanged: the operator names each var, and the runner forwards only the
+// declared provider's var.
+// A provider whose key is scoped to one endpoint (a self-hosted LiteLLM proxy)
+// contributes its base-URL variable too: admitting the key alone would hand the
+// seat an unusable credential, so the pair travels together — the same pairing
+// KNOWN_PROVIDER_AUTH_ENV makes for ANTHROPIC_BASE_URL / OPENAI_BASE_URL.
+const OMP_PROVIDER_AUTH_ENV = Object.fromEntries([
+    ...Object.values(OMP_PROVIDER_ENV_VARS),
+    ...Object.values(OMP_PROVIDER_EXTRA_ENV_VARS).flat(),
+].map((name) => [name, true]));
+export function collectAllowlistedProviderAuthEnv(raw, env, runtime) {
+    const admitOmp = runtime === "omp";
     const out = {};
     for (const item of (raw ?? "").split(",")) {
         const name = item.trim();
@@ -179,7 +201,7 @@ export function collectAllowlistedProviderAuthEnv(raw, env) {
             continue;
         if (!/^[A-Z_][A-Z0-9_]*$/.test(name))
             continue;
-        if (!KNOWN_PROVIDER_AUTH_ENV.has(name))
+        if (!KNOWN_PROVIDER_AUTH_ENV.has(name) && !(admitOmp && Object.hasOwn(OMP_PROVIDER_AUTH_ENV, name)))
             continue;
         const value = env[name];
         if (typeof value === "string" && value.length > 0) {
@@ -190,11 +212,13 @@ export function collectAllowlistedProviderAuthEnv(raw, env) {
 }
 export async function createDaemon(opts) {
     const daemonHome = os.homedir();
-    const configuredCodexHome = process.env.CODEX_HOME;
+    const configuredCodexHome = process.env.CODEX_HOME || undefined;
     if (configuredCodexHome && !nodePath.isAbsolute(configuredCodexHome)) {
         throw new Error(`CODEX_HOME must be an absolute path for managed seats: ${configuredCodexHome}`);
     }
     const codexHome = configuredCodexHome || nodePath.join(daemonHome, ".codex");
+    // Only the explicit selection overrides a pane rc or the legacy PID-home
+    // reader. The resolved default remains the writer/network-reader/session root.
     const dbPath = opts?.dbPath ?? ":memory:";
     const db = createDb(dbPath);
     migrate(db, ALL_MIGRATIONS);
@@ -258,8 +282,8 @@ export async function createDaemon(opts) {
         console.error("[slow-operation] setDegradedHandler registration failed", error);
     }
     // PL-004 Phase A revision (R1): topology-backed validateRig.
-    // Reject `<member>@<unknown-rig>` shapes by checking the rig portion
-    // against the rig registry. Bare ids without `@` are also rejected
+    // Reject `<member>@<unknown-rig>` shapes against the rig registry.
+    // Bare ids without `@` are also rejected
     // (no canonical rig binding).
     // OPR.0.4.6.MH1 FR-8: this gate is the ARCHETYPE consumer of the shared
     // parse contract — human-seat classification BEFORE parse, then the
@@ -284,12 +308,58 @@ export async function createDaemon(opts) {
             return false;
         return rigRepo.findRigsByName(parsed.rig).length > 0;
     };
+    // Seat absence in positively known local topology is advice, never admission
+    // authority. Keep every typed destination intact, including adopted aliases.
+    const topologyDestinationAdvisory = (sessionRef) => {
+        const parsed = parseSessionName(sessionRef);
+        if (isHumanSeatSessionRef(sessionRef) || parsed.kind !== "canonical")
+            return null;
+        const rigs = rigRepo.findUnarchivedRigsByName(parsed.rig);
+        if (rigs.length === 0)
+            return null;
+        // Membership needs only registered names and logical seat coordinates,
+        // not the full ps projection (snapshots, activity and lifecycle history).
+        for (const rig of rigs) {
+            if (db.prepare(`SELECT 1 FROM sessions s JOIN nodes n ON n.id = s.node_id
+        WHERE n.rig_id = ? AND s.session_name = ? LIMIT 1`).get(rig.id, sessionRef))
+                return null;
+            if (db.prepare(`SELECT 1 FROM nodes WHERE rig_id = ? AND
+        CASE WHEN instr(logical_id, '.') = 0 THEN logical_id
+          WHEN instr(logical_id, '.') > 1 AND instr(logical_id, '.') < length(logical_id)
+          THEN substr(logical_id, 1, instr(logical_id, '.') - 1) || '-' || substr(logical_id, instr(logical_id, '.') + 1)
+        END = ? LIMIT 1`).get(rig.id, parsed.member))
+                return null;
+        }
+        const names = rigs.flatMap((rig) => db.prepare(`SELECT n.logical_id, s.session_name
+      FROM nodes n LEFT JOIN sessions s ON s.id =
+        (SELECT id FROM sessions WHERE node_id = n.id ORDER BY id DESC LIMIT 1)
+      WHERE n.rig_id = ?`).all(rig.id));
+        const canonicalName = (logicalId) => {
+            const dot = logicalId.indexOf(".");
+            if (dot < 0)
+                return `${logicalId}@${parsed.rig}`;
+            return dot > 0 && dot < logicalId.length - 1
+                ? deriveCanonicalSessionName(logicalId.slice(0, dot), logicalId.slice(dot + 1), parsed.rig) : null;
+        };
+        const availableDestinations = [...new Set(names.flatMap((entry) => [
+                entry.session_name, canonicalName(entry.logical_id),
+            ]).filter((destination) => !!destination && parseSessionName(destination).kind === "canonical"))].sort();
+        return {
+            code: "unmatched_destination_seat",
+            destinationSession: sessionRef,
+            availableDestinations,
+            message: `Suspected seat typo: '${sessionRef}' matches no session address of locally known rig '${parsed.rig}'. `
+                + `Available destinations: ${availableDestinations.join(", ") || "(none)"}. `
+                + "The row keeps the exact destination as typed; this warning does not guarantee pickup or delivery.",
+        };
+    };
     // PL-004 Phase A — shared coordination services. Constructed early so
     // both the queueRepo dep slot and inboxHandler can share one instance.
     // Transport is wired after SessionTransport instantiation below via
     // attachTransport().
     const queueRepoInstance = new QueueRepository(db, eventBus, {
         validateRig: topologyValidateRig,
+        destinationAdvisory: topologyDestinationAdvisory,
         // OPR.0.4.6.WF3 FR-6 — the frontier close-path guard's predicate,
         // INJECTED here (arch layering pin: the queue never imports the
         // workflow domain; startup wires them — the validateRig precedent).
@@ -396,6 +466,11 @@ export async function createDaemon(opts) {
     writeActivityEndpointFile(OPENRIG_HOME, { baseUrl: resolvedActivityHookUrl, token: resolvedActivityHookToken });
     const startupSettings = new ContextPackSettingsStore().resolveConfig();
     const providerAuthEnv = collectAllowlistedProviderAuthEnv(startupSettings.recoveryProviderAuthEnvAllowlistRaw, process.env);
+    // OMP's extra provider keys reach OMP seats only (fresh launch and handover
+    // successors); every other runtime's seat env is unchanged.
+    const runtimeSessionEnv = {
+        omp: collectAllowlistedProviderAuthEnv(startupSettings.recoveryProviderAuthEnvAllowlistRaw, process.env, "omp"),
+    };
     const transcriptStore = new TranscriptStore({
         enabled: transcriptsEnabled,
         transcriptsRoot: transcriptsPath,
@@ -413,6 +488,8 @@ export async function createDaemon(opts) {
         OPENRIG_ACTIVITY_HOOK_TOKEN: resolvedActivityHookToken,
         ...providerAuthEnv,
         HOME: daemonHome,
+        USER: process.env.USER,
+        LOGNAME: process.env.LOGNAME,
         CODEX_HOME: codexHome,
     };
     // OPR.0.4.6.02 S1 — ONE shared tmux option-defaults applier, injected into
@@ -436,6 +513,8 @@ export async function createDaemon(opts) {
             }
         },
     });
+    const { SeatLaunchEnvironment } = await import("./domain/seat-launch-environment.js");
+    const seatLaunchEnvironment = new SeatLaunchEnvironment(tmuxAdapter, launchSessionEnv, process.cwd(), undefined, configuredCodexHome);
     const nodeLauncher = new NodeLauncher({
         db,
         rigRepo,
@@ -444,6 +523,7 @@ export async function createDaemon(opts) {
         tmuxAdapter,
         transcriptStore,
         sessionEnv: launchSessionEnv,
+        runtimeSessionEnv,
         tmuxOptionDefaults,
     });
     const snapshotRepo = new SnapshotRepository(db);
@@ -452,14 +532,19 @@ export async function createDaemon(opts) {
     const claudeManagedLaunch = new ClaudeManagedLaunch(db, { ...launchSessionEnv, CLAUDE_CONFIG_DIR: process.env.CLAUDE_CONFIG_DIR }, {
         OPENRIG_CLAUDE_DISABLE_ALTERNATE_SCREEN: process.env.OPENRIG_CLAUDE_DISABLE_ALTERNATE_SCREEN,
     });
-    const claudeResume = new ClaudeResumeAdapter(tmuxAdapter, { claudeManagedLaunch });
-    const codexResume = new CodexResumeAdapter(tmuxAdapter, { launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH) });
+    const claudeResume = new ClaudeResumeAdapter(tmuxAdapter, { claudeManagedLaunch, seatLaunchEnvironment });
+    // #275: one reader for both Codex launch adapters, with the PATH, HOME and CODEX_HOME a seat session gets.
+    const readCodexNetworkDefault = codexNetworkDefaultReader({ launchPath: process.env.PATH, home: daemonHome, codexHome });
+    const prepareTeamWorkspace = (sessionName) => prepareCodexTeamWorkspace(sessionName, new ContextPackSettingsStore().resolveConfig().workspaceRoot, process.env.OPENRIG_SHARED_DOCS_ROOT?.trim() || nodePath.join(daemonHome, ".openrig", "shared-docs"), daemonHome);
+    const codexResume = new CodexResumeAdapter(tmuxAdapter, { prepareTeamWorkspace, seatLaunchEnvironment, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault });
     // OPR.0.4.6.PI1 — the Pi seat-state root + the compiled runner entry (daemon
     // dist). Shared by the Pi runtime adapter, the resume adapter, and the
     // resume-token capture sidecar reader.
     const piStateRoot = nodePath.join(OPENRIG_HOME, "state", "pi");
+    const ompStateRoot = nodePath.join(OPENRIG_HOME, "state", "omp");
     const piRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/pi-runner.js");
-    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
+    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath }, { seatLaunchEnvironment });
+    const ompResume = new OmpResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: ompStateRoot, runnerEntryPath: piRunnerEntryPath });
     // Services infrastructure (RigEnv) — created early so restore/bootstrap can use it
     const { ComposeServicesAdapter } = await import("./adapters/compose-services-adapter.js");
     const { ServiceOrchestrator } = await import("./domain/service-orchestrator.js");
@@ -467,7 +552,7 @@ export async function createDaemon(opts) {
     const serviceOrchestrator = new ServiceOrchestrator({ rigRepo, composeAdapter });
     const restoreOrchestrator = new RestoreOrchestrator({
         db, rigRepo, sessionRegistry, eventBus, snapshotRepo, snapshotCapture,
-        checkpointStore, nodeLauncher, tmuxAdapter, claudeResume, codexResume, piResume,
+        checkpointStore, nodeLauncher, tmuxAdapter, claudeResume, codexResume, piResume, ompResume,
         transcriptStore, serviceOrchestrator,
     });
     // Connect to cmux at startup — degrades gracefully if absent
@@ -524,7 +609,7 @@ export async function createDaemon(opts) {
     const podRepo = new PodRepository(db);
     const rigSpecExporter = new RigSpecExporter({ rigRepo, sessionRegistry, podRepo });
     const rigSpecPreflight = new RigSpecPreflight({
-        rigRepo, tmuxAdapter, exec: opts?.tmuxExec ?? execCommand, cmuxExec: opts?.cmuxExec ?? execCommand,
+        rigRepo, tmuxAdapter, exec: opts?.tmuxExec ?? execPreflightCommand, cmuxExec: opts?.cmuxExec ?? execCommand,
     });
     const rigInstantiator = new RigInstantiator({
         db, rigRepo, sessionRegistry, eventBus, nodeLauncher, preflight: rigSpecPreflight, tmuxAdapter,
@@ -592,28 +677,35 @@ export async function createDaemon(opts) {
     }
     const { CodexRuntimeAdapter } = await import("./adapters/codex-runtime-adapter.js");
     const { PiRuntimeAdapter } = await import("./adapters/pi-runtime-adapter.js");
+    const { OmpRuntimeAdapter } = await import("./adapters/omp-runtime-adapter.js");
     const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
     const runtimeSettings = new ContextPackSettingsStore().resolveConfig();
-    const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, claudeManagedLaunch, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: (src, dest) => fs.copyFileSync(src, dest), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, claudeManagedLaunch, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: (src, dest) => fs.copyFileSync(src, dest), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
             } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json"), recordProjection: (targetPath, content) => projectionManifestStore.record({ targetPath, lastHash: hashContent(content), writtenAt: new Date().toISOString() }) });
-    const codexAdapter = new CodexRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const codexAdapter = new CodexRuntimeAdapter({ prepareTeamWorkspace, tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH), activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
     // OPR.0.4.6.PI1 — the RPC-first Pi adapter (runner-in-a-pane). Same fsOps
     // shape as the Codex adapter; seat isolation roots under piStateRoot.
-    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                if (e.isDirectory())
+                    w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
+                else
+                    r.push(pre ? nodePath.join(pre, e.name) : e.name);
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m) }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
+    const ompAdapter = new OmpRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; } }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
+            } } w(dir, ""); return r; } }, stateRoot: ompStateRoot, runnerEntryPath: piRunnerEntryPath });
     // OPR.0.5.1.1 — the stub runtime adapter (Pi-shaped node-script runner in a pane).
     // Same fsOps shape as Pi; the compiled runner entry lives in the daemon dist.
     const { StubRuntimeAdapter } = await import("./adapters/stub-runtime-adapter.js");
@@ -742,7 +834,9 @@ export async function createDaemon(opts) {
             const settingsStore = new ContextPackSettingsStore();
             const cfg = settingsStore.resolveConfig();
             const workspacePacksRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "context-packs");
-            if (workspacePacksRoot !== userPacksRoot && workspacePacksRoot !== systemPacksRoot && fs.existsSync(workspacePacksRoot)) {
+            // Registered even before it exists: scan() skips a missing root, so a
+            // folder created after startup is found by the next sync, not a restart.
+            if (workspacePacksRoot !== userPacksRoot && workspacePacksRoot !== systemPacksRoot) {
                 roots.push({ path: workspacePacksRoot, sourceType: "workspace" });
             }
         }
@@ -804,11 +898,11 @@ export async function createDaemon(opts) {
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
         fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
-        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         tmuxAdapter,
         agentImageLibrary,
         continuityPolicyMaterializer,
-        exec,
+        exec: opts?.tmuxExec ?? execPreflightCommand,
         // OPR.0.5.3.6 — shipped topology chain-file defaults install under the
         // typed topology.root at materialization (copy-if-absent).
         topologyRootResolver: () => String(new ContextPackSettingsStore().resolveOne("topology.root").value),
@@ -833,6 +927,11 @@ export async function createDaemon(opts) {
         packageInstallService, rigInstantiator, fsOps: resolverFsOps,
         bundleSourceResolver, podInstantiator, podBundleSourceResolver,
         serviceOrchestrator, rigRepo,
+        // A bundle's packs land in context.root before its seats launch; rescan
+        // so the live library serves them on the first turn.
+        routeBundleContents: (bundlePath) => routeBundleContents(bundlePath, {
+            onContextPacksRouted: () => contextPackLibrary.scan(),
+        }),
     });
     // V0.3.1 slice 05 kernel-rig-as-default — auto-boot the kernel rig
     // on daemon-start. Forward-fix #3 architectural: the bootstrap is
@@ -904,6 +1003,7 @@ export async function createDaemon(opts) {
     const { ContextUsageStore } = await import("./domain/context-usage-store.js");
     const contextUsageStore = new ContextUsageStore(db, {
         stateDir: OPENRIG_HOME,
+        codexHome: configuredCodexHome,
         // GHOST-STAGE (c-id): reject context readings from before the live occupant booted (prior
         // generation) so a frozen pre-handover sample can't drive the threshold. null = UNKNOWN (inert).
         resolveOccupantBootAt: (nodeId) => sessionRegistry.currentOccupantTenure(nodeId)?.bootAt ?? null,
@@ -920,25 +1020,30 @@ export async function createDaemon(opts) {
     const healthPolicy = new HealthPolicyStore(OPENRIG_HOME, () => healthSettingsStore.resolveContextPressurePolicy());
     const healthCheckpoints = new HealthCheckpointSource(OPENRIG_HOME, queueRepoInstance, healthPolicy, undefined, healthSettingsStore.resolveOne("workspace.root").value);
     const rigModeStore = new RigModeStore(db);
-    const operatingPosture = new OperatingPostureService(db, rigModeStore, () => healthSettingsStore.resolveOne("workspace.root").value);
+    const operatingPosture = new OperatingPostureService(db, rigModeStore, () => healthSettingsStore.resolveOne("workspace.root").value, configuredCatalogPath(healthSettingsStore));
     const passiveCeremony = new PassiveCeremonySource(healthSettingsStore.resolveOne("workspace.root").value, queueRepoInstance, healthPolicy, undefined, healthCheckpoints, { reader: operatingPosture, instanceId: OPENRIG_HOME });
-    const healthProjection = new HealthProjectionService({ read: () => [...contextHealthSource.read(), ...healthCheckpoints.read(), ...passiveCeremony.read()] }, () => healthPolicy.read(), (record) => operatingPosture.forHealth(record));
+    const healthProjection = new HealthProjectionService([contextHealthSource, healthCheckpoints, passiveCeremony], () => healthPolicy.read(), (record) => operatingPosture.forHealth(record));
     const healthDiagnosis = new HealthDiagnosisService({ queue: queueRepoInstance, projection: healthProjection, policy: healthPolicy,
         authority: (record) => healthAuthority(healthSettingsStore.resolveOne("workspace.root").value, healthCheckpoints, record),
         resolveEvidence: (path, finding) => readHealthArtifact(finding.operatingPosture?.context?.paths?.project ?? healthSettingsStore.resolveOne("workspace.root").value, path),
         humanReadiness: (address) => healthHumanReadiness(OPENRIG_HOME, address, deps.gatewaySubsystem?.status().state === "active"), });
     // OPR.0.4.3.20 FR-4 — inject contextUsageStore so refresh() can null-fill a
     // Claude token from the sidecar during periodic/manual snapshot refresh.
-    const resumeMetadataRefresher = new ResumeMetadataRefresher({ sessionRegistry, tmuxAdapter, contextUsageStore });
+    // #421 — the pane's current Claude process start time; a sidecar sampled earlier is not this
+    // process's, so capture and null-fill skip it.
+    const claudeProcessStartedAt = (sessionName) => observeClaudePaneStartedAt({ target: sessionName, tmux: tmuxAdapter });
+    const resumeMetadataRefresher = new ResumeMetadataRefresher({ sessionRegistry, tmuxAdapter, contextUsageStore, claudeProcessStartedAt, codexHome: configuredCodexHome });
     const claimService = new ClaimService({
         db, rigRepo, sessionRegistry, discoveryRepo, eventBus, tmuxAdapter, transcriptStore,
         claudeContextProvisioner: claudeAdapter,
         // OPR.0.4.3.20 FR-3 — adoption-boundary resume-token capture deps
         // (Claude sidecar reader + Codex thread-id capturer, both reuse).
         contextUsageStore,
+        claudeProcessStartedAt,
         resumeTokenCapturer: resumeMetadataRefresher,
         // OPR.0.4.6.PI1 FR-6 — pi-runner sidecar reader (the adapter exposes it).
         piRunnerStateStore: piAdapter,
+        ompRunnerStateStore: ompAdapter,
     });
     const selfAttachService = new SelfAttachService({
         db, rigRepo, podRepo, sessionRegistry, eventBus, tmuxAdapter, transcriptStore,
@@ -983,6 +1088,9 @@ export async function createDaemon(opts) {
             return transport.capture(session, opts);
         },
     });
+    // Capture compatibility before the spec-library initializer creates the primary directory.
+    const userSpecLibraryRoot = getDefaultOpenRigPath("specs");
+    const compatibleSpecLibraryRoot = getCompatibleOpenRigPath("specs");
     const deps = {
         rigRepo,
         sessionRegistry,
@@ -994,6 +1102,7 @@ export async function createDaemon(opts) {
         tmuxAdapter,
         tmuxOptionDefaults,
         sessionEnv: launchSessionEnv,
+        runtimeSessionEnv,
         cmuxAdapter,
         snapshotCapture,
         snapshotRepo,
@@ -1046,7 +1155,7 @@ export async function createDaemon(opts) {
         }),
         podInstantiator,
         podBundleSourceResolver,
-        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
+        runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "omp": ompAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         transcriptStore,
         sessionTransport: (() => {
             const t = new SessionTransport({
@@ -1153,8 +1262,8 @@ export async function createDaemon(opts) {
         kernelBootTracker,
         specReviewService,
         specLibraryService: (() => {
-            const userSpecsRoot = getDefaultOpenRigPath("specs");
-            const legacySpecsRoot = getCompatibleOpenRigPath("specs");
+            const userSpecsRoot = userSpecLibraryRoot;
+            const legacySpecsRoot = compatibleSpecLibraryRoot;
             try {
                 fs.mkdirSync(userSpecsRoot, { recursive: true });
             }
@@ -1175,26 +1284,22 @@ export async function createDaemon(opts) {
             lib.scan();
             return lib;
         })(),
-        // Phase 3a slice 3.3 — plugin discovery service.
-        // SC-29 EXCEPTION #8 verbatim: see packages/daemon/src/routes/plugins.ts
-        // header. Filesystem-scan over 3 source roots + agent.yaml-parse for
-        // used-by reverse query. No SQL; no mutation. Spec library directory
-        // for used-by uses the same default user spec root as SpecLibraryService
-        // above; one root at v0 (multi-root expansion deferred to a later slice
-        // when spec library hooks its full root list through to discovery).
+        // Plugin reverse usage must cover the same built-in, user, and legacy roots as the spec library.
         // bug-fix slice plugin-discovery-respects-openrig-home: route the
         // openrigPluginsDir through the OPENRIG_HOME-aware resolver so
         // discovery + vendor (which already uses the helper at line 428)
         // resolve to the same root. Operator-level test isolation + the
         // slice 22 populated-VM-env story both depend on this symmetry.
-        // claudeCacheDir / codexCacheDir remain homedir-anchored because
-        // those cache locations belong to the runtime tools, not to the
-        // OpenRig state root.
+        // Provider caches belong to their selected provider homes, not OPENRIG_HOME.
         pluginDiscoveryService: new PluginDiscoveryService({
             openrigPluginsDir: getDefaultOpenRigPath("plugins"),
             claudeCacheDir: nodePath.join(os.homedir(), ".claude", "plugins", "cache"),
-            codexCacheDir: nodePath.join(os.homedir(), ".codex", "plugins", "cache"),
-            specLibraryDir: getDefaultOpenRigPath("specs"),
+            codexCacheDir: nodePath.join(codexHome, "plugins", "cache"),
+            specLibraryDir: userSpecLibraryRoot,
+            additionalSpecLibraryDirs: [
+                nodePath.resolve(import.meta.dirname, "../specs"),
+                compatibleSpecLibraryRoot,
+            ],
         }),
         // Slice 28 Checkpoint C-3 — skillLibraryDiscoveryService is constructed
         // AFTER filesAllowlist resolution below (deps.skillLibraryDiscoveryService
@@ -1367,14 +1472,8 @@ export async function createDaemon(opts) {
             db,
             eventBus,
             rigRepo,
-            // R1 fix per guard PL-005 Phase A review: wire the production
-            // capability probe so /api/mission-control/cli-capabilities
-            // honestly reports drift when MISSION_CONTROL_DESIRED_FIELDS
-            // are missing from the local CLI's allow-list. Without this
-            // probe injection, the production path defaulted to a no-op
-            // that always reported staleCliCount=0 even when the audit-
-            // row-5 case (recoveryGuidance not in CLI allow-list) was
-            // present.
+            // This projection observes the daemon registry and queue, not a CLI.
+            // Leave CLI version/capabilities unknown until actually observed.
             probeRig: makeLocalCliCapabilityProbe(),
         });
         // V0.3.1 slice 05 kernel-rig-as-default — cascade the resolved
@@ -1433,15 +1532,20 @@ export async function createDaemon(opts) {
             else {
                 throw new Error(`OPENRIG_NOTIFICATIONS_MECHANISM='${mechanism}' is not recognized; supported: ntfy | webhook | none`);
             }
-            const dispatcher = new MissionControlNotificationDispatcher({
-                db,
-                eventBus,
-                adapter,
-                includeVerbCompletion,
-                missionControlBaseUrl,
-            });
-            dispatcher.start();
-            deps.missionControlNotificationDispatcher = dispatcher;
+            if (adapter.disabled) {
+                // Target URL failed validation; warning was logged and daemon starts with notifications disabled.
+            }
+            else {
+                const dispatcher = new MissionControlNotificationDispatcher({
+                    db,
+                    eventBus,
+                    adapter,
+                    includeVerbCompletion,
+                    missionControlBaseUrl,
+                });
+                dispatcher.start();
+                deps.missionControlNotificationDispatcher = dispatcher;
+            }
         }
     }
     // Slice Story View v0 — slice indexer + per-tab projector.
@@ -1644,6 +1748,8 @@ export async function createDaemon(opts) {
                 return r.ok ? r.host : null;
             },
             hasSession: (session) => tmuxAdapter.hasSession(session),
+            // #707: local tiles run the tmux the daemon resolves, not whatever the provider's PATH finds.
+            resolveLocalTmux: async () => (await probeRegistry.probeCli("tmux")).detectedPath,
         });
     }
     // UI Enhancement Pack v0:
@@ -1957,7 +2063,7 @@ export async function createDaemon(opts) {
             const { ProcessCensus } = await import("./domain/process-census.js");
             const { CodexThreadIdResolver } = await import("./domain/codex-thread-id.js");
             const divergenceCensus = new ProcessCensus();
-            const codexThreadIdResolver = new CodexThreadIdResolver({ defaultHome: nodeOs.homedir() });
+            const codexThreadIdResolver = new CodexThreadIdResolver({ defaultHome: nodeOs.homedir(), codexHome: configuredCodexHome });
             const currentGenDeps = {
                 getPanePid: async (sessionTarget) => tmuxAdapter.getPanePid ? tmuxAdapter.getPanePid(sessionTarget) : null,
                 listProcesses: () => divergenceCensus.list(),
@@ -2140,6 +2246,7 @@ export async function createDaemon(opts) {
         "claude-code": claudeAdapter,
         codex: codexAdapter,
         pi: piAdapter,
+        omp: ompAdapter,
     }, usageSamplesStore, () => providerWindowSamplesFromSignals(collectClaudeSignalsFromProviderUsageDirectory(providerUsageDirectory(OPENRIG_HOME), undefined, legacyProviderUsageDirectory(OPENRIG_HOME))));
     deps.contextMonitor = contextMonitor;
     // OPR.0.4.3.14 — expose the SAME enforcer instance to routes for the manual
@@ -2177,7 +2284,9 @@ export async function createDaemon(opts) {
     // (loop lag / last-tick age) and the expensive topology routes are timed.
     const { EventLoopMonitor } = await import("./domain/event-loop-monitor.js");
     const { RouteTimingRecorder } = await import("./domain/route-timing-recorder.js");
-    const eventLoopMonitor = new EventLoopMonitor();
+    const requestPhaseObserver = slowOpRecorder?.recordDiagnostic ? new RequestPhaseObserver(slowOpRecorder) : undefined;
+    deps.requestPhaseObserver = requestPhaseObserver;
+    const eventLoopMonitor = new EventLoopMonitor({ onTick: (at, previous) => requestPhaseObserver?.tick(at, previous) });
     const routeTimingRecorder = new RouteTimingRecorder();
     deps.eventLoopMonitor = eventLoopMonitor;
     deps.routeTimingRecorder = routeTimingRecorder;