@orkastery/cli 0.5.3 → 0.6.0

package/assets/skills-en/reviewers/security-auditor/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: security-auditor
+description: "Security auditor for CHECK: goes through security-checklist.md on the diff, the branch history and the thread artifacts, with the hard condition of zero blockers. Never prints the secret it finds."
+bucket: reviewers
+roteia: "ork verify <thread> | references/security-checklist.md"
+license: MIT
+---
+
+# Security Auditor
+
+## What this skill is
+
+A thin router that applies [security-checklist.md](../../../references/security-checklist.md) to the
+thread's scope. The pass condition is hard: **zero security blockers, in any conduction
+mode, including `#Auto`.**
+
+## How to route
+
+```bash
+git diff <base>...HEAD               # a arvore de trabalho
+git log -p <base>..HEAD              # o historico atras da branch
+ork phase list <thread>              # policies e gates ja registrados
+ork doctor                           # provider e ambiente da maquina
+```
+
+## Scope and conduct
+
+1. **The scope is declared before the findings:** which directories, which history range,
+   which artifacts. An audit without a declared scope does not count as evidence.
+2. **Test fixtures and example configs are in scope.** A credential in a test is a leaked
+   credential, made worse by the fact that nobody looks there; `SEC 1` includes `.env`, fixtures and examples.
+3. **History is in scope.** A secret committed and then deleted is still leaked; the audit
+   reads the range, not only the tree.
+4. **The report does not print credentials.** The finding names the pattern, the file and the line, in redacted
+   form. **A leak report that prints the secret is a second leak.**
+5. **Absence is asserted as a result**, with what was examined: "nothing found" without a scope is
+   different from "audited and clean", and the difference is written down.
+
+## With `verify.security_scan` declared
+
+Without `verify.security_scan`, this skill does what it always did: the whole checklist by reading, and the manual pass remains valid. With the key declared, the scan report (`.orkastery/security-scan/<sha>/report.json`, in the main tree) is the evidence for `SEC 1`, `SEC 2` and `SEC 10`, and the triage below applies.
+
+1. **Declare the scan scope:** `base`, `head`, the stacks and each tool with its state (`ran`, `failed` or `unavailable`) and the `reason`.
+2. **A tool `unavailable` or `failed` never counts as clean.** Declare it as such; its `SEC` items fall back to manual reading, marked as such. The manual pass is only valid with the scan declared `unavailable`.
+3. **Triage: one verdict per `new` finding of the loop** (`loop`), none without a verdict:
+   - **real:** type B correction, with the rule, `arquivo:linha`, the real output **redacted (never the secret value; only the rule, `arquivo:linha` and `fingerprint`)**, the `SEC n` and the reach (`reachable` from govulncheck); the way back is the `security-remediation` skill;
+   - **false positive:** type A correction, `acrescentar <fingerprint> ao .ork-security/dismissals.json, motivo <m>`, plus `ork decisao registrar`;
+   - **inconclusive:** no correction; the short question goes into the report, the verdict is not PASSOU and the finding stays open until the owner answers through `ork gate request` (the path is in the `check-quality` skill).
+4. **The verdict reaches GO-FIX as a CHECK claim, one per finding.** `ork fix open` derives the GO-FIX spec only from `ork verify`, and verify re-runs the claims: each failed claim becomes a correction carrying its text.
+   - real: `ork claims add <thread> <arquivo> --fase CHECK --claim "<veredito>" --verificar "<comando de verify.security_scan>"`; the command fails on HEAD and the correction is born type B (`claims.failed`). The claim fails and passes with the whole scan, not with this finding (the `fingerprint` stays in the text), costs one extra HEAD scan per claim at every verify and goes into the `.ork-ci` bundle with the other claims;
+   - false positive: `ork claims add <thread> .ork-security/dismissals.json --fase CHECK --claim "<veredito>"`, without `--verificar`; the claim with no command is born type A (`claims.unverifiable`). A claim the core reads as negative fails with no command and becomes type B without warning: `ehAlegacaoNegativa` in `core/src/claims.ts` looks, without accents and even inside words, for `nenhum`, `nenhuma`, `nunca`, `sempre`, `zero`, `todos`, `todas`, `nao ha`, `nao existe`, `nao resta`, `sem nenhum`, `100%`, `totalmente`, `completamente` (`metodos` contains `todos`). Check the `ork claims add` output: the false positive only holds with the `negativa` line at `nao` and the `estado` line at `nao-verificavel` (pt-BR output; in the `en` locale, the `negative` line at `no` and the `state` line at `unverifiable`); otherwise, `ork claims retirar <thread> <claim> --motivo "<motivo>"` and register it again with neutral wording;
+   - the `<veredito>` carries the finding id, the tool, the rule, `arquivo:linha`, the `fingerprint`, the type and the correction, and for a false positive the reason and the `eventId` of `ork decisao registrar`;
+   - the owner's answer to an inconclusive finding becomes a claim the same way, registered by whoever conducts or by a new CHECK, before `ork fix open`.
+5. **The auditor does not edit:** neither code nor `.ork-security/dismissals.json`. It returns the verdict, and whoever writes the fix is GO.
+6. **Secret material never goes to the session output.** With a `new` Gitleaks finding, the finding's line and the content of the commit that brought it do not go to the output through any tool: Read, `sed`, `head`, `grep -n`, editor, `git log -p`, `git show`, `cat`, diff. The output goes to the transcript and to the provider, and it is a second leak. **A `secret` finding gets no context reading at all:** not the line, not its neighbours, not the file, because a multi-line secret (a PEM key) gets past any single-line mask. Its verdict uses only the report's `rule`, `arquivo:linha` and `fingerprint`, and comparing the value with another is done by hash (`sha256sum`), printing neither. Context without the finding's line (`awk -v n=<linha> 'NR>=n-5 && NR<=n+5 && NR!=n' <arquivo>`) applies only to the other categories (`sast`, `dependency`, `iac`, `workflow`).
+7. `existing` and `dismissed` go in the report as declared debt, never as a new blocker.
+
+## What the core checks for you
+
+The `segredo_em_prompt` policy runs at the `phase.dispatch` gate **before the prompt is written to
+disk**: a rejected prompt never comes to exist as a file. The `provider` policy blocks dispatch
+through a paid provider under `subscription-only`, and `push_direto_na_base` blocks a delivery without a thread
+branch. All three reject in any mode.
+
+## Racionalizacoes comuns (Common rationalizations)
+
+| Excuse | Reality |
+|---|---|
+| "The key is only in the test fixture" | Fixtures are in the scope of `SEC 1`. A credential in a test is a leaked credential, made worse by the fact that nobody looks there. |
+| "I deleted the commit that had the token" | Deleting from the tree does not delete from history. A blocker until the credential is rotated and the rotation verified, not promised. |
+| "I will paste the snippet in the report so the team can see it" | A leak report that prints the secret is a second leak. Name the pattern and the line, redacted. |
+| "This blocker is theoretical, nobody would exploit it" | Zero blockers is a hard condition, not negotiable by a probability estimated by eye. |
+| "The thread is `#Auto`, the audit can be lighter" | The mode loosens the pause, never the verification. The list is the same; what changes is who waits for the verdict. |
+| "Since I found it, I will fix it right here" | The auditor does not edit. An auditor who fixes ends up auditing its own work; the verdict goes to GO and the fix comes back through CHECK. |
+
+## Bandeiras vermelhas (Red flags)
+
+- A security report with no scope and no history range.
+- A real secret pasted into the report or the ledger.
+- A finding without the `SEC n` it violates.
+- "Nothing found" without saying what was examined.
+- A new dependency without justification in the PLAN.
+- A Gitleaks secret value pasted in the correction, the verdict or the ledger.
+- A `new` loop finding without a verdict, or a `failed` tool counted as clean.
+- The line or commit of a `new` Gitleaks finding in the session output, through any tool (Read, `sed`, `grep -n`, `git log -p`, `git show`, `cat`, diff).
+- File context read for a `secret` finding, even without the finding's line.
+- A verdict on a `new` scan finding only in the report, without the CHECK claim that carries it to `ork fix open`.
+
+## Verification before leaving the audit
+
+Scope declared, tree and history scanned, thread artifacts read, each finding with a category
+and `SEC n`, no credential printed, and zero blockers for the PASSOU (passed) verdict. See `SEC 15` to
+`SEC 17` and `DoD 9`.

package/assets/skills-en/reviewers/test-engineer/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: test-engineer
+description: "Test reviewer for CHECK: applies testing-patterns.md to the thread's suite, confirms that the green suite was earned and not loosened, and reports coverage with a declared source."
+bucket: reviewers
+roteia: "ork verify <thread> | ork verify <thread> --baseline | references/testing-patterns.md"
+license: MIT
+---
+
+# Test Engineer
+
+## What this skill is
+
+A thin router that applies [testing-patterns.md](../../../references/testing-patterns.md) to the
+thread's suite. It does not write the missing test: it shows which one is missing and why, and that becomes a
+GO task. **A green suite must be earned, not declared.**
+
+## How to route
+
+```bash
+ork verify <thread> --baseline     # gravada ANTES do GO
+ork verify <thread>                # reexecucao no HEAD real, comparada com a baseline
+git diff <base>...HEAD -- '*test*' # o que aconteceu com os testes no caminho
+```
+
+## Scope and conduct
+
+1. **Compare against the baseline.** Without a baseline, a failure cannot tell a regression from
+   pre-existing debt, and the report turns into an argument about blame.
+2. **Look for the loosening**, not only the red: a removed test, a test marked to skip,
+   an assertion swapped for the value the code produces today. **Adjusting the expected to the observed is the
+   most common way to turn a defect into a contract.**
+3. **Require the test that reproduces the defect** in every fix request, and require that it failed
+   before the fix.
+4. **Report numbers with their source:** `runtime_reported`, `estimated` or `unavailable`. A gap is
+   published as a gap, never as zero.
+
+## What the core checks for you
+
+`ork verify` re-runs the manifest commands and the claims on the real HEAD and stamps the commit.
+A command that passed in the baseline and fails now comes out as `verify.regression`; what already failed comes out
+as declared debt, with the command name.
+
+## Racionalizacoes comuns (Common rationalizations)
+
+| Excuse | Reality |
+|---|---|
+| "That test was flaky, I marked it to skip" | Skipping a test is a recorded scope change. Without a record, it is the defect slipping out the back door. |
+| "I adjusted the assertion to the right value" | Right according to whom? If the expected value changed, the reason is in the PLAN. Adjusting the expected to the observed turns a defect into a contract. |
+| "The bug is obvious, the reproduction test is redundant" | A fix whose defect was never reproduced does not prove it fixed anything. |
+| "Coverage is at about 80 percent" | A number without a source does not go in. Without a tool, coverage comes out `unavailable`, with the reason. |
+| "The happy path alone is enough, the rest is unlikely" | A suite that only exercises success measures optimism. The failure path is where the user meets the product. |
+| "I ran it locally and it passed" | A reported pass is not a pass. What counts is the real output of the re-run on HEAD. |
+
+## Bandeiras vermelhas (Red flags)
+
+- A test removed in the same commit as the fix.
+- A new `skip` without a record.
+- An assertion changed without a written reason.
+- Coverage reported as a round number with no tool on the machine.
+- No baseline recorded before GO.
+
+## Verification before leaving the review
+
+Baseline in place, suite re-run on the real HEAD, test diff read in search of loosening,
+a reproduction test present in the fixes, and every number with a declared source. See `TEST 1` to
+`TEST 12` and `DoD 7`.

package/assets/skills-en/reviewers/web-performance-auditor/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: web-performance-auditor
+description: "Performance auditor for CHECK: a conditional audit that runs when the target has a latency-sensitive surface and, when it does not, is waived by a written contract. Does not assert performance without measurement."
+bucket: reviewers
+roteia: "references/performance-checklist.md | ork verify <thread>"
+license: MIT
+---
+
+# Web Performance Auditor
+
+## What this skill is
+
+A thin router that applies
+[performance-checklist.md](../../../references/performance-checklist.md) to the thread's target. It is
+**conditional and never absent**: when the target has no latency-sensitive surface, the section
+exists and contains the written waiver, with the reason.
+
+## How to route
+
+```bash
+ork verify <thread>            # a suite, e o tempo real que ela leva
+git diff <base>...HEAD         # os lacos e o I/O que o diff introduziu
+```
+
+## Scope and conduct
+
+1. **Decide and record applicability.** A written waiver is a result; a missing audit with no
+   line at all is a gap.
+2. **Measure before asserting.** Every performance statement carries a number, a unit and how the number
+   was obtained. **"It got faster" without a measurement is opinion, and opinion does not pass a gate.**
+3. **Compare on the same machine and under the same conditions**, with enough repetition to separate signal from
+   noise. A single run becomes `estimated`, never `runtime_reported`.
+4. **Measure the user's path**, not the convenient microbenchmark.
+5. **Declare the source of every number**, and what was not measured comes out `unavailable` with the reason, never
+   as zero.
+
+## What the core checks for you
+
+The same discipline as the `ork` token gate, which would rather say "not measurable" than invent a
+window occupancy: `runtime_reported`, `estimated`, `informada`, `unavailable`. The source is part
+of the data, not decoration on the report.
+
+## Racionalizacoes comuns (Common rationalizations)
+
+| Excuse | Reality |
+|---|---|
+| "It got visibly faster" | Without a number, a unit and a method, it is opinion. Opinion does not pass a performance gate. |
+| "I measured on my machine, it came out better than on CI" | Comparing different machines compares machines, not code. Same hardware, same conditions, or no comparison. |
+| "I ran it once and could already see it" | One run becomes `estimated`. Without repetition there is no way to separate gain from noise. |
+| "There is no web interface, so I skip the section" | The section always exists. With no sensitive surface, it contains the waiver and the reason. |
+| "I put zero where I could not measure" | Zero is a data point, and a false one. What was not measured comes out `unavailable` with the reason. |
+
+## Bandeiras vermelhas (Red flags)
+
+- A CHECK report with no performance section, not even with the waiver.
+- A gain asserted with no number and no method.
+- A number without a declared source.
+- A comparison across different machines or conditions presented as before and after.
+
+## Verification before leaving the audit
+
+Applicability decided and written down, measurements with method and repetition when there is something to measure, the user's
+path covered, and every number with its source. See `PERF 1` to `PERF 10` and `DoD 9`.

package/dist/adapters/claude-bg.js

@@ -42,11 +42,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JANELA_CURTA_MAX_MS = exports.NOME_ADAPTER = void 0;
+exports.DAEMON_DO_CLAUDE = exports.PRAZO_DO_DAEMON_MS = exports.JANELA_CURTA_MAX_MS = exports.MOD_DA_ENTREGA = exports.MOD_DOS_TETOS = exports.MINIMO_DA_API_DE_MODS = exports.NOME_ADAPTER = void 0;
 exports.ambienteDoPerfil = ambienteDoPerfil;
 exports.semContextoDeDespacho = semContextoDeDespacho;
 exports.disponivel = disponivel;
 exports.versao = versao;
+exports.modsParaOClaude = modsParaOClaude;
+exports.agentTeamsDoDespacho = agentTeamsDoDespacho;
+exports.entradaDoDespacho = entradaDoDespacho;
 exports.montarComando = montarComando;
 exports.extrairSessionId = extrairSessionId;
 exports.listarSessoes = listarSessoes;
@@ -57,6 +60,7 @@ exports.despachar = despachar;
 exports.parseRateLimit = parseRateLimit;
 exports.naturezaDoLimite = naturezaDoLimite;
 exports.parseFalhaDeConta = parseFalhaDeConta;
+exports.cotaExpostaDoAuth = cotaExpostaDoAuth;
 exports.conferirAuth = conferirAuth;
 exports.comandoAttach = comandoAttach;
 exports.limparAnsi = limparAnsi;
@@ -66,6 +70,9 @@ exports.parar = parar;
 exports.pararAchada = pararAchada;
 exports.acharSessaoNasContas = acharSessaoNasContas;
 exports.ocupacaoDeContexto = ocupacaoDeContexto;
+exports.lerStatusDoDaemon = lerStatusDoDaemon;
+exports.sondarDaemon = sondarDaemon;
+exports.derrubarDaemon = derrubarDaemon;
 const horario_1 = require("../horario");
 const util_1 = require("../util");
 const runtime_ambiente_1 = require("../runtime-ambiente");
@@ -73,6 +80,7 @@ const path = __importStar(require("node:path"));
 const runtime_context_1 = require("../runtime-context");
 const runtime_profiles_1 = require("../runtime-profiles");
 const mcp_grafo_1 = require("../mcp-grafo");
+const locale_1 = require("../locale");
 function exec(cmd, args, cwd, timeoutMs, ambiente = (0, runtime_ambiente_1.ambienteDeAssinatura)()) {
     return (0, util_1.exec)(cmd, args, cwd, timeoutMs, ambiente);
 }
@@ -138,6 +146,78 @@ function versao() {
 }
 /** Ferramentas de arquivo negadas no PLAN: o plano sai pelo núcleo, não pelo disco. */
 const ESCRITA_DE_ARQUIVO = ['Edit', 'Write', 'NotebookEdit'];
+/** O contexto do despacho conferido para o host Claude Code (D4 do RM-037: o host errado recusa antes de tudo). */
+function validarDoClaude(contexto, cwd) {
+    if (contexto.host !== 'claude-code')
+        throw Error('runtime.context.invalid: host Claude esperado');
+    return (0, runtime_context_1.validarContextoRuntime)(contexto, cwd);
+}
+/** RM-059 (T0.7, D2): a API de mods saiu no Claude Code 2.1.287; nenhum mod vai a um `claude` mais velho. */
+exports.MINIMO_DA_API_DE_MODS = '2.1.287';
+/** `2.1.296 (Claude Code)` vira `[2, 1, 296]`; texto sem versao vira `null`. */
+function versaoNumerica(texto) {
+    const m = /(\d+)\.(\d+)\.(\d+)/.exec(texto ?? '');
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function atende(versao, minimo) {
+    const i = versao.findIndex((parte, j) => parte !== minimo[j]);
+    return i < 0 || versao[i] > minimo[i];
+}
+/**
+ * RM-059 (T0.7, D2): os mods de fase que este `claude` carrega. O mod que pede versao mais nova fica de
+ * fora e o despacho segue, porque o nucleo nao depende de mod; versao ilegivel nao leva mod nenhum. Mod
+ * cuja dependencia ficou de fora (por versao, ou por ser so de papel `dono`) tambem fica: sem ela, ele
+ * carregaria pela metade na sessao de fase.
+ */
+function modsParaOClaude(mods, versao) {
+    const atual = versaoNumerica(versao);
+    if (!atual)
+        return [];
+    const piso = versaoNumerica(exports.MINIMO_DA_API_DE_MODS);
+    let vao = mods.filter((m) => atende(atual, piso) && atende(atual, versaoNumerica(m.claudeCodeMinimo) ?? piso));
+    for (;;) {
+        const nomes = new Set(vao.map((m) => m.nome));
+        const sobram = vao.filter((m) => m.dependencias.every((d) => nomes.has(d)));
+        if (sobram.length === vao.length)
+            return vao;
+        vao = sobram;
+    }
+}
+/** RM-059 (T10.4): o mod que aplica os tetos de agent teams dentro da sessao de fase. */
+exports.MOD_DOS_TETOS = 'ork-portao';
+/**
+ * RM-059 (T10.4, D11 da thread ork-rm059portao): o que o despacho acrescenta ao `--settings` para agent teams no
+ * piloto, e so quando o contexto validado trouxe os tetos (manifesto ligado, GO no bloco) e o Portao de Tarefas esta
+ * entre os mods que vao de fato a sessao: sem ele, ninguem aplicaria os tetos. A sessao de fundo nao tem `tmux`, entao
+ * os teammates rodam no mesmo processo (`teammateMode` `in-process`).
+ */
+function agentTeamsDoDespacho(tetos, mods) {
+    if (!tetos || !mods.some((m) => m.nome === exports.MOD_DOS_TETOS))
+        return null;
+    return {
+        env: {
+            CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: '1',
+            ORK_AGENT_TEAMS_TEAMMATES: String(tetos.teammates),
+            ORK_AGENT_TEAMS_CUSTO_USD: String(tetos.custo_usd),
+        },
+        teammateMode: 'in-process',
+    };
+}
+/** RM-059 (fatia F9): o mod que confere, na sessao de fase, a resposta do dono que chega de outra sessao. */
+exports.MOD_DA_ENTREGA = 'ork-mensageiro';
+/**
+ * RM-059 (T9.4, D14 da thread ork-rm059mensag): o que o despacho acrescenta ao `--settings` para a sessao de fase
+ * receber a resposta do dono pelo Mensageiro de Sessoes. `crossSessionInbound: accept` entrega a mensagem de outra
+ * sessao do mesmo usuario sem a paridade de modo, que numa sessao sem pessoa vence o prazo e descarta; por isso so
+ * vai com o Mensageiro entre os mods que vao de fato a sessao (sem ele, ninguem confere o que chega) e so na sessao
+ * despachada (`ORK_DISPATCH_ID` no env do despacho). Sem um dos dois, o `--settings` sai como antes.
+ */
+function entradaDoDespacho(mods, env) {
+    if (!mods.some((m) => m.nome === exports.MOD_DA_ENTREGA))
+        return null;
+    const despacho = env?.[runtime_ambiente_1.ENV_IDENTIDADE_DE_DESPACHO];
+    return typeof despacho === 'string' && despacho.trim() !== '' ? { crossSessionInbound: 'accept' } : null;
+}
 /** Monta a linha de comando exata do despacho (usada tambem pelo `--dry-run`). */
 function montarComando(pedido) {
     const args = ['--bg', pedido.prompt, '--name', pedido.nome];
@@ -153,13 +233,19 @@ function montarComando(pedido) {
     // O `claude --bg` entrega a sessao a um processo reserva do daemon da conta, e o daemon guarda o
     // ambiente de quem o iniciou: pelo ambiente, a sessao nascia com a identidade de outro despacho.
     // Medido em 28/09/2026 (2.1.284): o `env` de `--settings` chega ao Bash da sessao e vence o herdado.
-    const doDespacho = pedido.ambienteExtra ?? {};
-    if (Object.keys(doDespacho).length)
-        args.push('--settings', JSON.stringify({ env: doDespacho }));
-    if (pedido.contextoRuntime) {
-        if (pedido.contextoRuntime.host !== 'claude-code')
-            throw Error('runtime.context.invalid: host Claude esperado');
-        const contexto = (0, runtime_context_1.validarContextoRuntime)(pedido.contextoRuntime, pedido.cwd);
+    const contexto = pedido.contextoRuntime ? validarDoClaude(pedido.contextoRuntime, pedido.cwd) : null;
+    // RM-059 (T0.7): cada mod de fase conferido entra com o proprio --plugin-dir, depois do plugin do Orkastery.
+    const mods = !contexto || contexto.modsDeFase.length === 0 ? []
+        : modsParaOClaude(contexto.modsDeFase, pedido.versaoClaude !== undefined ? pedido.versaoClaude : versao());
+    // RM-059 (T10.4): agent teams so no piloto, com os tetos no env e o Portao na sessao; sem eles, o --settings de antes.
+    const teams = agentTeamsDoDespacho(contexto?.agentTeams, mods);
+    // RM-059 (T9.4): a resposta do dono pelo Mensageiro so na sessao despachada e com ele na sessao.
+    const entrada = entradaDoDespacho(mods, pedido.ambienteExtra);
+    const doDespacho = { ...(pedido.ambienteExtra ?? {}), ...(teams ? teams.env : {}) };
+    if (Object.keys(doDespacho).length) {
+        args.push('--settings', JSON.stringify({ env: doDespacho, ...(teams ? { teammateMode: teams.teammateMode } : {}), ...(entrada ?? {}) }));
+    }
+    if (contexto) {
         const consultas = [...CONSULTAS_MCP, ...(contexto.grafoMcp ? consultasDoGrafoMcp() : [])];
         // Somente o servidor gerado: nao mesclar MCP de outros escopos nesta sessao filha.
         const permissoes = contexto.permissoesFilho === 'worktree'
@@ -169,7 +255,7 @@ function montarComando(pedido) {
         const allow = plano ? [...consultas, 'mcp__orkastery__ork_artifact_write', 'mcp__orkastery__ork_decision_record']
             : permissoes?.allow ?? consultas;
         const deny = [...(plano ? ESCRITA_DE_ARQUIVO : []), ...(permissoes?.deny ?? [])];
-        args.push('--plugin-dir', contexto.instalacao, '--strict-mcp-config', '--mcp-config', JSON.stringify({ mcpServers: { orkastery: contexto.servidor } }), '--allowedTools', allow.join(','));
+        args.push('--plugin-dir', contexto.instalacao, ...mods.flatMap((m) => ['--plugin-dir', m.dir]), '--strict-mcp-config', '--mcp-config', JSON.stringify({ mcpServers: { orkastery: contexto.servidor } }), '--allowedTools', allow.join(','));
         if (deny.length)
             args.push('--disallowedTools', deny.join(','));
     }
@@ -203,15 +289,15 @@ function listarSessoes(cwd, todas = false, ambiente = (0, runtime_ambiente_1.amb
  * falha aqui (o observador e o pulse não concluem nada dele); só o inventário o trata como fonte
  * ausente, com a correção.
  */
-function consultarSessoes(cwd, todas = false, ambiente = (0, runtime_ambiente_1.ambienteDeAssinatura)()) {
+function consultarSessoes(cwd, todas = false, ambiente = (0, runtime_ambiente_1.ambienteDeAssinatura)(), prazoMs = 60000) {
     const args = ['agents', '--json'];
     if (todas)
         args.push('--all');
-    const r = exec('claude', args, undefined, 60000, ambiente);
+    const r = exec('claude', args, undefined, prazoMs, ambiente);
     if (r.error === 'ENOENT')
-        return { ok: false, ausente: true, sessoes: [], detalhe: 'binário `claude` fora do PATH' };
+        return { ok: false, ausente: true, sessoes: [], detalhe: (0, locale_1.textoDoCatalogo)((m) => m.pulse.claudeForaDoPath) };
     if (!r.ok)
-        return { ok: false, sessoes: [], detalhe: `claude agents falhou (código ${r.code})` };
+        return { ok: false, sessoes: [], detalhe: (0, locale_1.textoDoCatalogo)((m) => m.pulse.claudeAgentsFalhou(r.code)) };
     let dados;
     try {
         const bruto = JSON.parse(r.stdout);
@@ -601,6 +687,7 @@ exports.JANELA_CURTA_MAX_MS = 15 * 60 * 1000;
 const FRASES_DE_ESGOTAMENTO = [
     /\busage_limit_exceeded\b/i,
     /\busage_limit_reached\b/i,
+    /seu limite de uso foi atingido/i,
     /\bout of credits\b/i,
     /\binsufficient_quota\b/i,
     /exceeded your current quota/i,
@@ -684,6 +771,37 @@ function parseFalhaDeConta(saida, agoraMs = Date.now()) {
     const ampla = FRASES_AMPLAS_DE_AUTH.find((r) => r.test(texto));
     return ampla ? { motivo: 'runtime.auth-missing', resetEm: null, fonte: 'sem-horario', trecho: trechoDa(texto, ampla) } : null;
 }
+const objeto = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const numeroFinito = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : null;
+/** Formatos estruturados aceitos quando `auth status --json` traz uso; chaves alheias não viram medida. */
+function cotaExpostaDoAuth(dados) {
+    if (!objeto(dados))
+        return null;
+    const candidato = ['quota', 'usage', 'rateLimit'].map((k) => dados[k]).find(objeto);
+    if (!candidato)
+        return null;
+    let limite = numeroFinito(candidato.limit ?? candidato.total ?? candidato.max);
+    let usada = numeroFinito(candidato.used ?? candidato.consumed ?? candidato.current);
+    const restanteInformada = numeroFinito(candidato.remaining);
+    const percentual = numeroFinito(candidato.percentUsed ?? candidato.utilization);
+    let emPercentual = false;
+    if (limite === null && percentual !== null && percentual <= 100) {
+        limite = 100;
+        usada = percentual;
+        emPercentual = true;
+    }
+    if (limite !== null && usada === null && restanteInformada !== null)
+        usada = Math.max(0, limite - restanteInformada);
+    if (limite === null || usada === null || limite <= 0 || usada > limite)
+        return null;
+    const unidadeBruta = candidato.unit ?? candidato.unidade;
+    // O nome da unidade que o runtime não informa é texto de quem lê: sai do catálogo, não daqui.
+    const informada = typeof unidadeBruta === 'string' ? unidadeBruta.replace(/[^a-zA-Z0-9%._-]/g, '').slice(0, 24) : '';
+    const unidade = informada || (emPercentual ? '%' : null);
+    const resetBruto = candidato.resetsAt ?? candidato.resetAt ?? candidato.resetEm;
+    const resetEm = typeof resetBruto === 'string' && Number.isFinite(Date.parse(resetBruto)) ? resetBruto : null;
+    return { usada, limite, restante: Math.max(0, limite - usada), unidade, resetEm, fonte: 'runtime' };
+}
 /** Campo textual do `auth status`, sem controle e curto, para o detalhe legivel. */
 const campoDeAuth = (v) => typeof v === 'string' ? v.replace(/[^a-zA-Z0-9_.-]/g, '').slice(0, 32) : '';
 /**
@@ -695,11 +813,12 @@ const campoDeAuth = (v) => typeof v === 'string' ? v.replace(/[^a-zA-Z0-9_.-]/g,
  */
 function conferirAuth(perfil) {
     let ambiente;
+    // RM-061 (F3b, GO-FIX 1): o erro do catalogo fica registrado, e a impressao o remonta.
     try {
         ambiente = ambienteDoPerfil(perfil);
     }
     catch (e) {
-        return { ok: false, detalhe: e.message };
+        return { ok: false, detalhe: (0, locale_1.textoDoErro)(e) };
     }
     const r = exec('claude', ['auth', 'status', '--json'], undefined, 30000, ambiente);
     // A14: sem codigo de saida (timeout, sinal ou binario ausente) ou sem JSON, a conferencia e inconclusiva.
@@ -724,7 +843,8 @@ function conferirAuth(perfil) {
             ...(provedor && provedor !== 'firstParty' ? [`apiProvider ${provedor}`] : [])];
         return { ok: false, pago: true, detalhe: `claude auth status: provider pago (${partes.join(', ')}); so a assinatura claude.ai despacha` };
     }
-    return { ok: true, detalhe: `claude auth status: loggedIn (${metodo})` };
+    const cota = cotaExpostaDoAuth(dados);
+    return { ok: true, detalhe: `claude auth status: loggedIn (${metodo})`, ...(cota ? { cota } : {}) };
 }
 /**
  * Comando de anexar a sessao (precisa de TTY, entao o CLI imprime em vez de executar). RM-037
@@ -882,3 +1002,61 @@ function ocupacaoDeContexto(chave) {
     void chave;
     return null;
 }
+/** O `status` e o `stop` do daemon nao esperam um daemon travado por minutos. */
+exports.PRAZO_DO_DAEMON_MS = 20_000;
+const linhaCurta = (texto) => texto.replace(/\p{Cc}/gu, ' ').replace(/\s+/g, ' ').trim().slice(0, 160);
+/**
+ * A saida do `claude daemon status` (medida em 12/10/2026 na 2.1.296): `pid:` com o daemon de pe ou `not running`,
+ * e a linha `control.sock: reachable` ou `control.sock: unreachable (...)`. O daemon de pe com o socket que nao
+ * responde e o travado do incidente; sem daemon, o `claude --bg` sobe um sob demanda. Saida fora dessa forma e
+ * `nao-lido`: sem prova, nada e derrubado.
+ */
+function lerStatusDoDaemon(saida, codigo) {
+    const texto = String(saida ?? '').replace(/\r/g, '');
+    const sock = /^\s*control\.sock:\s*(.+)$/m.exec(texto)?.[1]?.trim() ?? '';
+    const dePe = /^\s*pid:\s*\d+/m.test(texto);
+    const parado = /^\s*not running\b/im.test(texto);
+    const detalhe = sock ? linhaCurta(`control.sock: ${sock}`) : linhaCurta(texto.split('\n').find((l) => l.trim()) ?? '');
+    if (codigo !== 0 || !sock || dePe === parado) {
+        return { estado: 'nao-lido', detalhe: `claude daemon status sem a forma conhecida (codigo ${codigo ?? '?'})${detalhe ? `: ${detalhe}` : ''}` };
+    }
+    if (/^reachable\b/i.test(sock))
+        return dePe ? { estado: 'responde', detalhe } : { estado: 'nao-lido', detalhe };
+    if (/^unreachable\b/i.test(sock))
+        return { estado: dePe ? 'nao-responde' : 'parado', detalhe };
+    return { estado: 'nao-lido', detalhe };
+}
+/** `claude daemon status` com o ambiente do perfil do despacho: a conta certa, o daemon certo. */
+function sondarDaemon(perfil) {
+    let ambiente;
+    try {
+        ambiente = ambienteDoPerfil(perfil);
+    }
+    catch (e) {
+        return { estado: 'nao-lido', detalhe: linhaCurta(e.message) };
+    }
+    const r = exec('claude', ['daemon', 'status'], undefined, exports.PRAZO_DO_DAEMON_MS, ambiente);
+    if (r.error === 'ENOENT')
+        return { estado: 'nao-lido', detalhe: 'binario `claude` nao encontrado no PATH' };
+    if (r.error || r.signal)
+        return { estado: 'nao-lido', detalhe: `claude daemon status nao terminou em ${exports.PRAZO_DO_DAEMON_MS / 1000} s` };
+    return lerStatusDoDaemon(`${r.stdout}\n${r.stderr}`, r.code);
+}
+/**
+ * `claude daemon stop --any --keep-workers`: derruba o supervisor transitorio da conta (o que o `claude --bg` subiu
+ * sob demanda) e deixa as sessoes destacadas rodando. O proximo `claude --bg` sobe outro.
+ */
+function derrubarDaemon(perfil) {
+    let ambiente;
+    try {
+        ambiente = ambienteDoPerfil(perfil);
+    }
+    catch (e) {
+        return { ok: false, detalhe: linhaCurta(e.message) };
+    }
+    const r = exec('claude', ['daemon', 'stop', '--any', '--keep-workers'], undefined, exports.PRAZO_DO_DAEMON_MS, ambiente);
+    const primeira = linhaCurta(`${r.stdout}\n${r.stderr}`.split('\n').find((l) => l.trim()) ?? '');
+    return { ok: r.ok, detalhe: r.ok ? primeira || 'daemon parado' : `saiu ${r.error ?? r.code}${primeira ? `: ${primeira}` : ''}` };
+}
+/** O daemon do claude-bg que a escada usa quando ninguem injeta outro. */
+exports.DAEMON_DO_CLAUDE = { sondar: sondarDaemon, derrubar: derrubarDaemon };

package/dist/adapters/codex-controller-worker.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.interromperTurnoAtivo = interromperTurnoAtivo;
 /** Dono exclusivo do stdin app-server. IPC local autenticado pelo uid/diretório 0700. */
 const fs = __importStar(require("node:fs"));
 const net = __importStar(require("node:net"));
@@ -42,6 +43,16 @@ const node_crypto_1 = require("node:crypto");
 const codex_question_1 = require("./codex-question");
 const runtime_context_1 = require("../runtime-context");
 const codex_controller_1 = require("./codex-controller");
+/** RM-064: interrupção nativa testável sem descobrir PID, sessão ou turno fora do controller vinculado. */
+async function interromperTurnoAtivo(state, sessao, perguntaAtiva, enviar, esperar) {
+    const bloqueioDivergente = state.estado === 'blocked' && (!perguntaAtiva || sessao.bloqueio !== state.bloqueio);
+    if (!['working', 'blocked'].includes(state.estado) || sessao.estado !== state.estado || !state.turno ||
+        sessao.sessionId !== state.sessionId || sessao.instancia !== state.instancia || sessao.cwd !== state.cwd ||
+        bloqueioDivergente)
+        throw new Error('runtime.unavailable: sessão não está ativa nesta instância');
+    await enviar('turn/interrupt', { threadId: state.sessionId, turnId: state.turno });
+    await esperar(() => state.estado === 'stopped');
+}
 function gravar(nome, valor) {
     const tmp = `${nome}.${(0, node_crypto_1.randomUUID)()}.tmp`;
     fs.writeFileSync(tmp, JSON.stringify(valor), { flag: 'wx', mode: 0o600 });
@@ -246,11 +257,7 @@ async function servidor() {
                 }
                 else if (r.operacao === 'parar') {
                     const s = r.dados;
-                    if (!pergunta || state.estado !== 'blocked' || s.sessionId !== state.sessionId || s.instancia !== state.instancia ||
-                        s.cwd !== state.cwd || s.bloqueio !== state.bloqueio)
-                        throw new Error('runtime.unavailable: sessão não está bloqueada nesta instância');
-                    await rpc('turn/interrupt', { threadId: state.sessionId, turnId: state.turno });
-                    await aguardar(() => state.estado === 'stopped');
+                    await interromperTurnoAtivo(state, s, !!pergunta, rpc, aguardar);
                     resultado = true;
                 }
                 else

package/dist/adapters/codex-events.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ParserCodex = exports.LIMITE_LINHA_CODEX = void 0;
+exports.ParserCodex = exports.LIMITE_RESPOSTA_CODEX = exports.LIMITE_LINHA_CODEX = void 0;
 exports.falhaDeContaDoErroCodex = falhaDeContaDoErroCodex;
 exports.classificarMensagem = classificarMensagem;
 /** D4/D5: stream e rollout são observações de turno, nunca aprovação de CHECK. */
@@ -84,6 +84,15 @@ function tokens(v, fonte, escopo) {
         output: Number(output), total: Number(total), unidade: 'tokens', escopo, fonte };
 }
 exports.LIMITE_LINHA_CODEX = 1024 * 1024;
+exports.LIMITE_RESPOSTA_CODEX = 256 * 1024;
+function limitarResposta(texto) {
+    if (typeof texto !== 'string' || !texto.trim())
+        return null;
+    const bruto = Buffer.from(texto, 'utf8');
+    if (bruto.byteLength <= exports.LIMITE_RESPOSTA_CODEX)
+        return texto;
+    return bruto.subarray(0, exports.LIMITE_RESPOSTA_CODEX).toString('utf8').replace(/\uFFFD$/, '');
+}
 class ParserCodex {
     pendente = Buffer.alloc(0);
     descartando = false;
@@ -154,6 +163,7 @@ class ParserCodex {
             this.estado.turnId = daFonte ?? `stream-${this.estado.turnos}`;
             this.estado.turnIdOrigem = daFonte === null ? 'gerado' : 'explicito';
             this.estado.mensagem = null;
+            this.estado.mensagemTexto = null;
             this.estado.tokens = indisponivel();
             this.eventosValidos++;
             return null;
@@ -177,6 +187,7 @@ class ParserCodex {
             p.type === 'agent_message' ? p.message : undefined);
         if (mensagem !== undefined) {
             this.estado.mensagem = classificarMensagem(mensagem);
+            this.estado.mensagemTexto = limitarResposta(mensagem);
             this.eventosValidos++;
             return null;
         }
@@ -189,8 +200,8 @@ class ParserCodex {
         const falhou = p.type === 'turn.failed' || p.type === 'task_failed' || comErro;
         const conta = comErro ? falhaDeContaDoErroCodex(p.error, agoraMs) : null;
         const explicito = motivo(p.motivo ?? p.reason);
-        const mensagemFinal = typeof p.last_agent_message === 'string' && p.last_agent_message.trim()
-            ? classificarMensagem(p.last_agent_message) : this.estado.mensagem ?? sucesso();
+        const textoFinal = limitarResposta(p.last_agent_message) ?? this.estado.mensagemTexto ?? null;
+        const mensagemFinal = textoFinal !== null ? classificarMensagem(textoFinal) : this.estado.mensagem ?? sucesso();
         const classificacao = this.estado.invalido ? falha()
             : conta ? { classificacao: 'gate_blocked', motivo: conta.motivo } : explicito ??
                 (mensagemFinal.classificacao !== 'fase_concluida' ? mensagemFinal : falhou ? falha() : sucesso());
@@ -201,7 +212,8 @@ class ParserCodex {
             numeroTurno: this.estado.turnos, timestampFonte: e.timestamp ? 'evento' : 'observacao',
             fonte: e.type === 'event_msg' ? `rollout.${p.type}` : `stream.${p.type}`,
             tokens: structuredClone(this.estado.tokens),
-            duracaoMs: Number.isFinite(p.duration_ms) && p.duration_ms >= 0 ? p.duration_ms : null };
+            duracaoMs: Number.isFinite(p.duration_ms) && p.duration_ms >= 0 ? p.duration_ms : null,
+            ...(textoFinal !== null ? { respostaFinal: textoFinal } : {}) };
     }
 }
 exports.ParserCodex = ParserCodex;