@openrig/cli 0.6.5 → 0.6.7

package/daemon/dist/startup.js

@@ -35,9 +35,10 @@ import { ClaudeResumeAdapter } from "./adapters/claude-resume.js";
 import { CodexResumeAdapter } from "./adapters/codex-resume.js";
 import { codexDaemonSupportProbe } from "./domain/codex-daemon-support.js";
 import { codexNetworkDefaultReader } from "./domain/codex-network-default.js";
+import { prepareCodexTeamWorkspace } from "./domain/codex-team-workspace.js";
 import { PiResumeAdapter } from "./adapters/pi-resume.js";
 import { OmpResumeAdapter } from "./adapters/omp-resume.js";
-import { OMP_PROVIDER_ENV_VARS } from "./adapters/pi-runner-protocol.js";
+import { OMP_PROVIDER_ENV_VARS, OMP_PROVIDER_EXTRA_ENV_VARS } from "./adapters/pi-runner-protocol.js";
 import { RigSpecExporter } from "./domain/rigspec-exporter.js";
 import { PodRepository } from "./domain/pod-repository.js";
 import { RigSpecPreflight } from "./domain/rigspec-preflight.js";
@@ -54,6 +55,7 @@ import { ExternalInstallPlanner } from "./domain/external-install-planner.js";
 import { ExternalInstallExecutor } from "./domain/external-install-executor.js";
 import { PackageInstallService } from "./domain/package-install-service.js";
 import { BootstrapOrchestrator } from "./domain/bootstrap-orchestrator.js";
+import { routeBundleContents } from "./domain/bundle-content-routing.js";
 import { TmuxDiscoveryScanner } from "./domain/tmux-discovery-scanner.js";
 import { SessionFingerprinter } from "./domain/session-fingerprinter.js";
 import { SessionEnricher } from "./domain/session-enricher.js";
@@ -90,6 +92,7 @@ import { ChatRepository } from "./domain/chat-repository.js";
 import { StreamStore } from "./domain/stream-store.js";
 import { SlowOpRecorder } from "./domain/slow-op-recorder.js";
 import { configureSyncSiteRecorder } from "./domain/sync-site-wrap.js";
+import { RequestPhaseObserver } from "./domain/request-phase-observer.js";
 import { QueueRepository, isBlockerLive } from "./domain/queue-repository.js";
 import { createWorkflowFrontierPredicate } from "./domain/workflow-frontier-guard.js";
 import { InboxHandler } from "./domain/inbox-handler.js";
@@ -137,7 +140,7 @@ import nodePath from "node:path";
 // status + error_message columns to workflow_specs so the scanner
 // can record diagnostic rows. SC-29 #10 declared verbatim in commit body.
 import { RigModeStore } from "./domain/rig-mode/rig-mode-store.js";
-import { OperatingPostureService } from "./domain/rig-mode/operating-posture.js";
+import { OperatingPostureService, configuredCatalogPath } from "./domain/rig-mode/operating-posture.js";
 import { MissionControlActionLog } from "./domain/mission-control/mission-control-action-log.js";
 import { MissionControlWriteContract } from "./domain/mission-control/mission-control-write-contract.js";
 import { MissionControlReadLayer } from "./domain/mission-control/mission-control-read-layer.js";
@@ -167,10 +170,12 @@ const KNOWN_PROVIDER_AUTH_ENV = new Set([
     // pi-runner's own deny-by-default allowlist then has nothing to pass
     // through). Double opt-in preserved: the operator must still name each var
     // in recovery.provider_auth_env_allowlist. OpenRouter is the founder-ruled
-    // preferred path (2026-07-06); zai/kimi-coding are the secondary natives.
+    // preferred path (2026-07-06); zai/kimi-coding are the secondary natives;
+    // minimax follows the same per-family pattern (one key var per native slug).
     "OPENROUTER_API_KEY",
     "ZAI_API_KEY",
     "KIMI_API_KEY",
+    "MINIMAX_API_KEY",
     // Issue #194: the bearer token of a Codex Amazon Bedrock provider
     // (`env_key = "AWS_BEARER_TOKEN_BEDROCK"`). Still forwarded only when the
     // operator names it in recovery.provider_auth_env_allowlist.
@@ -181,7 +186,14 @@ const KNOWN_PROVIDER_AUTH_ENV = new Set([
 // every other runtime keeps KNOWN_PROVIDER_AUTH_ENV above. Double opt-in is
 // unchanged: the operator names each var, and the runner forwards only the
 // declared provider's var.
-const OMP_PROVIDER_AUTH_ENV = Object.fromEntries(Object.values(OMP_PROVIDER_ENV_VARS).map((name) => [name, true]));
+// A provider whose key is scoped to one endpoint (a self-hosted LiteLLM proxy)
+// contributes its base-URL variable too: admitting the key alone would hand the
+// seat an unusable credential, so the pair travels together — the same pairing
+// KNOWN_PROVIDER_AUTH_ENV makes for ANTHROPIC_BASE_URL / OPENAI_BASE_URL.
+const OMP_PROVIDER_AUTH_ENV = Object.fromEntries([
+    ...Object.values(OMP_PROVIDER_ENV_VARS),
+    ...Object.values(OMP_PROVIDER_EXTRA_ENV_VARS).flat(),
+].map((name) => [name, true]));
 export function collectAllowlistedProviderAuthEnv(raw, env, runtime) {
     const admitOmp = runtime === "omp";
     const out = {};
@@ -525,14 +537,15 @@ export async function createDaemon(opts) {
     const claudeResume = new ClaudeResumeAdapter(tmuxAdapter, { claudeManagedLaunch, seatLaunchEnvironment });
     // #275: one reader for both Codex launch adapters, with the PATH, HOME and CODEX_HOME a seat session gets.
     const readCodexNetworkDefault = codexNetworkDefaultReader({ launchPath: process.env.PATH, home: daemonHome, codexHome });
-    const codexResume = new CodexResumeAdapter(tmuxAdapter, { seatLaunchEnvironment, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault });
+    const prepareTeamWorkspace = (sessionName) => prepareCodexTeamWorkspace(sessionName, new ContextPackSettingsStore().resolveConfig().workspaceRoot, process.env.OPENRIG_SHARED_DOCS_ROOT?.trim() || nodePath.join(daemonHome, ".openrig", "shared-docs"), daemonHome);
+    const codexResume = new CodexResumeAdapter(tmuxAdapter, { prepareTeamWorkspace, seatLaunchEnvironment, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault });
     // OPR.0.4.6.PI1 — the Pi seat-state root + the compiled runner entry (daemon
     // dist). Shared by the Pi runtime adapter, the resume adapter, and the
     // resume-token capture sidecar reader.
     const piStateRoot = nodePath.join(OPENRIG_HOME, "state", "pi");
     const ompStateRoot = nodePath.join(OPENRIG_HOME, "state", "omp");
     const piRunnerEntryPath = nodePath.resolve(import.meta.dirname, "./adapters/pi-runner.js");
-    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
+    const piResume = new PiResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath }, { seatLaunchEnvironment });
     const ompResume = new OmpResumeAdapter(tmuxAdapter, { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }) }, { stateRoot: ompStateRoot, runnerEntryPath: piRunnerEntryPath });
     // Services infrastructure (RigEnv) — created early so restore/bootstrap can use it
     const { ComposeServicesAdapter } = await import("./adapters/compose-services-adapter.js");
@@ -675,7 +688,7 @@ export async function createDaemon(opts) {
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
             } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs"), claudeHooksManifestPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/claude.json"), recordProjection: (targetPath, content) => projectionManifestStore.record({ targetPath, lastHash: hashContent(content), writtenAt: new Date().toISOString() }) });
-    const codexAdapter = new CodexRuntimeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const codexAdapter = new CodexRuntimeAdapter({ prepareTeamWorkspace, tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
@@ -683,12 +696,12 @@ export async function createDaemon(opts) {
             } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m), homedir: daemonHome }, codexHome: configuredCodexHome, launchPath: process.env.PATH, detectDaemonSupport: codexDaemonSupportProbe(process.env.PATH, undefined, configuredCodexHome), readNetworkDefault: readCodexNetworkDefault, activityRelayPath: nodePath.resolve(import.meta.dirname, "../assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs") });
     // OPR.0.4.6.PI1 — the RPC-first Pi adapter (runner-in-a-pane). Same fsOps
     // shape as the Codex adapter; seat isolation roots under piStateRoot.
-    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+    const piAdapter = new PiRuntimeAdapter({ tmux: tmuxAdapter, seatLaunchEnvironment, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; } }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
+            } } w(dir, ""); return r; }, statMode: (p) => fs.statSync(p).mode, chmod: (p, m) => fs.chmodSync(p, m) }, stateRoot: piStateRoot, runnerEntryPath: piRunnerEntryPath });
     const ompAdapter = new OmpRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
@@ -793,10 +806,31 @@ export async function createDaemon(opts) {
             logger: (...args) => console.log("[openrig]", ...args),
         });
         await vendorService.ensureLatest("openrig-core");
-        vendorService.ensureSkillGlobally("openrig-core", "openrig-skills", [
-            nodePath.join(os.homedir(), ".claude", "skills"),
-            nodePath.join(os.homedir(), ".agents", "skills"),
-        ]);
+        for (const skill of ["openrig-skills", "refocusing"]) {
+            try {
+                vendorService.ensureSkillGlobally("openrig-core", skill, [
+                    nodePath.join(os.homedir(), ".claude", "skills"),
+                    nodePath.join(os.homedir(), ".agents", "skills"),
+                ]);
+            }
+            catch (err) {
+                console.error(`[openrig] global ${skill} skill setup warning: ${err.message}`);
+            }
+        }
+        // `rigs` is the person-facing guide (skills/rigs, the skills.sh front door), for a session that isn't on a
+        // team yet, so it isn't a plugin skill: that would put it in every seat's loadout. Its packaged copy
+        // installs under OpenRig's own version, so each upgrade refreshes it; a copy installed another way has no
+        // OpenRig marker and is left as it is.
+        try {
+            const { getDaemonVersion } = await import("./domain/daemon-version.js");
+            vendorService.ensureSkillDirGlobally(nodePath.resolve(import.meta.dirname, "../assets/skills/rigs"), "rigs", getDaemonVersion(), [
+                nodePath.join(os.homedir(), ".claude", "skills"),
+                nodePath.join(os.homedir(), ".agents", "skills"),
+            ]);
+        }
+        catch (err) {
+            console.error(`[openrig] global rigs skill setup warning: ${err.message}`);
+        }
     }
     catch (err) {
         console.error(`[openrig] plugin vendor setup warning: ${err.message}`);
@@ -823,7 +857,9 @@ export async function createDaemon(opts) {
             const settingsStore = new ContextPackSettingsStore();
             const cfg = settingsStore.resolveConfig();
             const workspacePacksRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "context-packs");
-            if (workspacePacksRoot !== userPacksRoot && workspacePacksRoot !== systemPacksRoot && fs.existsSync(workspacePacksRoot)) {
+            // Registered even before it exists: scan() skips a missing root, so a
+            // folder created after startup is found by the next sync, not a restart.
+            if (workspacePacksRoot !== userPacksRoot && workspacePacksRoot !== systemPacksRoot) {
                 roots.push({ path: workspacePacksRoot, sourceType: "workspace" });
             }
         }
@@ -914,6 +950,11 @@ export async function createDaemon(opts) {
         packageInstallService, rigInstantiator, fsOps: resolverFsOps,
         bundleSourceResolver, podInstantiator, podBundleSourceResolver,
         serviceOrchestrator, rigRepo,
+        // A bundle's packs land in context.root before its seats launch; rescan
+        // so the live library serves them on the first turn.
+        routeBundleContents: (bundlePath) => routeBundleContents(bundlePath, {
+            onContextPacksRouted: () => contextPackLibrary.scan(),
+        }),
     });
     // V0.3.1 slice 05 kernel-rig-as-default — auto-boot the kernel rig
     // on daemon-start. Forward-fix #3 architectural: the bootstrap is
@@ -1002,7 +1043,7 @@ export async function createDaemon(opts) {
     const healthPolicy = new HealthPolicyStore(OPENRIG_HOME, () => healthSettingsStore.resolveContextPressurePolicy());
     const healthCheckpoints = new HealthCheckpointSource(OPENRIG_HOME, queueRepoInstance, healthPolicy, undefined, healthSettingsStore.resolveOne("workspace.root").value);
     const rigModeStore = new RigModeStore(db);
-    const operatingPosture = new OperatingPostureService(db, rigModeStore, () => healthSettingsStore.resolveOne("workspace.root").value);
+    const operatingPosture = new OperatingPostureService(db, rigModeStore, () => healthSettingsStore.resolveOne("workspace.root").value, configuredCatalogPath(healthSettingsStore));
     const passiveCeremony = new PassiveCeremonySource(healthSettingsStore.resolveOne("workspace.root").value, queueRepoInstance, healthPolicy, undefined, healthCheckpoints, { reader: operatingPosture, instanceId: OPENRIG_HOME });
     const healthProjection = new HealthProjectionService([contextHealthSource, healthCheckpoints, passiveCeremony], () => healthPolicy.read(), (record) => operatingPosture.forHealth(record));
     const healthDiagnosis = new HealthDiagnosisService({ queue: queueRepoInstance, projection: healthProjection, policy: healthPolicy,
@@ -1641,7 +1682,7 @@ export async function createDaemon(opts) {
     {
         const { TerminalService } = await import("./domain/terminal/terminal-service.js");
         const { HerdrAdapter } = await import("./domain/terminal/herdr-adapter.js");
-        const { createHerdrSocketRpc, createHerdrSocketTransport } = await import("./domain/terminal/herdr-transport.js");
+        const { createHerdrSocketRpc, createHerdrSocketTransport, resolveHerdrSocketPath } = await import("./domain/terminal/herdr-transport.js");
         const { CmuxProviderAdapter } = await import("./domain/terminal/cmux-provider-adapter.js");
         const { CmuxLayoutService } = await import("./domain/cmux-layout-service.js");
         const { TerminalViewsStore } = await import("./domain/terminal/terminal-views-store.js");
@@ -1657,9 +1698,11 @@ export async function createDaemon(opts) {
             rigName: e.rigName,
             logicalId: e.logicalId,
         });
+        const herdrSocketPath = resolveHerdrSocketPath();
         const herdrProvider = new HerdrAdapter({
             // FB4: herdr speaks its unix control socket (there is no `layout` CLI).
-            transportFactory: createHerdrSocketTransport(createHerdrSocketRpc()),
+            transportFactory: createHerdrSocketTransport(createHerdrSocketRpc(herdrSocketPath)),
+            launch: { socketPath: herdrSocketPath, ...(process.env["HERDR_SESSION"] ? { session: process.env["HERDR_SESSION"] } : {}) },
         });
         const cmuxProvider = new CmuxProviderAdapter({
             cmuxAdapter,
@@ -1730,6 +1773,8 @@ export async function createDaemon(opts) {
                 return r.ok ? r.host : null;
             },
             hasSession: (session) => tmuxAdapter.hasSession(session),
+            // #707: local tiles run the tmux the daemon resolves, not whatever the provider's PATH finds.
+            resolveLocalTmux: async () => (await probeRegistry.probeCli("tmux")).detectedPath,
         });
     }
     // UI Enhancement Pack v0:
@@ -2264,7 +2309,9 @@ export async function createDaemon(opts) {
     // (loop lag / last-tick age) and the expensive topology routes are timed.
     const { EventLoopMonitor } = await import("./domain/event-loop-monitor.js");
     const { RouteTimingRecorder } = await import("./domain/route-timing-recorder.js");
-    const eventLoopMonitor = new EventLoopMonitor();
+    const requestPhaseObserver = slowOpRecorder?.recordDiagnostic ? new RequestPhaseObserver(slowOpRecorder) : undefined;
+    deps.requestPhaseObserver = requestPhaseObserver;
+    const eventLoopMonitor = new EventLoopMonitor({ onTick: (at, previous) => requestPhaseObserver?.tick(at, previous) });
     const routeTimingRecorder = new RouteTimingRecorder();
     deps.eventLoopMonitor = eventLoopMonitor;
     deps.routeTimingRecorder = routeTimingRecorder;