@phuetz/code-buddy 1.6.1 → 2.1.0

package/dist/server/index.js

@@ -1,3 +1,4 @@
+import { createA2AJsonRpcRoutes } from './routes/a2a-jsonrpc.js';
 /**
  * API Server
  *
@@ -16,6 +17,7 @@ import cors from 'cors';
 import { createServer } from 'http';
 import { createServer as createHttpsServer, Server as HttpsServer } from 'https';
 import { resolveServerTlsOptions } from './tls-config.js';
+import { createDeviceAuthRoutes } from './routes/device-auth.js';
 const _require = createRequire(import.meta.url);
 let SERVER_VERSION = '0.0.0';
 try {
@@ -24,11 +26,14 @@ try {
 catch {
     /* ignore */
 }
-import { isOriginAllowed, isLoopbackHost, DEFAULT_LOCALHOST_ORIGINS } from './origin-check.js';
-import { createAuthMiddleware, requireScope, createRateLimitMiddleware, createLoggingMiddleware, createSecurityHeadersMiddleware, requestIdMiddleware, errorHandler, notFoundHandler, } from './middleware/index.js';
-import { chatRoutes, toolsRoutes, sessionsRoutes, memoryRoutes, healthRoutes, metricsRoutes, createWorkflowApiRouter, createA2AProtocolRoutes, createACPRoutes, createK8sHealthAliases, createDashboardRouter, createCloudTaskRoutes, createWebhookRoutes, mobileRoutes, } from './routes/index.js';
-import { setupWebSocket, closeAllConnections, getConnectionStats } from './websocket/index.js';
+import { isOriginAllowed, DEFAULT_LOCALHOST_ORIGINS } from './origin-check.js';
+import { diagnoseServerExposure } from './exposure-diagnostic.js';
+import { createAuthMiddleware, requireLocalAnonymousAccess, requireScope, createRateLimitMiddleware, createLoggingMiddleware, createSecurityHeadersMiddleware, requestIdMiddleware, errorHandler, notFoundHandler, } from './middleware/index.js';
+import { chatRoutes, toolsRoutes, sessionsRoutes, memoryRoutes, lessonsRoutes, healthRoutes, metricsRoutes, createWorkflowApiRouter, createA2AProtocolRoutes, createACPRoutes, createK8sHealthAliases, createCanvasRouter, createDashboardRouter, createCloudTaskRoutes, createWebhookRoutes, createCognitionRoutes, mobileRoutes, mobilePwaRouter, isMobilePwaEnabled, runsRoutes, } from './routes/index.js';
+import { setupWebSocket, closeAllConnections, getConnectionStats, wireCognitionBridge, } from './websocket/index.js';
 import { setupDesktopWebSocket, closeDesktopWebSocket } from './websocket/desktop-handler.js';
+import { getPeerMethodHandler } from './websocket/peer-rpc.js';
+import { fleetHttpDescribeEnvelope } from '../fleet/fleet-http-surface.js';
 import { startFleetHeartbeat, stopFleetHeartbeat } from '../fleet/heartbeat-broadcaster.js';
 import { startAutonomousTick, stopAutonomousTick } from '../fleet/autonomous-tick-broadcaster.js';
 import { startApiHeartbeatMonitor, stopApiHeartbeatMonitor } from './heartbeat-monitor.js';
@@ -36,12 +41,17 @@ import { wireCompactionBridge, unwireCompactionBridge } from '../fleet/compactio
 import { wirePeerChatBridge, unwirePeerChatBridge } from '../fleet/peer-chat-bridge.js';
 import { wirePeerSessionBridge, unwirePeerSessionBridge } from '../fleet/peer-session-bridge.js';
 import { wirePeerToolBridge, unwirePeerToolBridge } from '../fleet/peer-tool-bridge.js';
+import { wirePeerCkgBridge, unwirePeerCkgBridge } from '../fleet/peer-ckg-bridge.js';
+import { wirePeerMissionExchangeBridge, unwirePeerMissionExchangeBridge, } from '../fleet/peer-mission-exchange-bridge.js';
+import { unwireMobileConfirmationBridge } from './websocket/confirmation-bridge.js';
 import { logger } from '../utils/logger.js';
 import { initMetrics } from '../metrics/index.js';
 import { CSRFProtection } from '../security/csrf-protection.js';
 import { initializeDatabase } from '../database/database-manager.js';
 import { SERVER_CONFIG, TIMEOUT_CONFIG, LIMIT_CONFIG } from '../config/constants.js';
 import { listServerModels } from './agent-adapter.js';
+import { CognitiveHub, createInternalCognitivePrincipal, } from '../cognition/cognitive-hub.js';
+import { InProcessCognitivePort, } from '../cognition/cognitive-port.js';
 // Lazy import to avoid circular dependency: channels/index.ts re-exports
 // TelegramChannel/DiscordChannel which import BaseChannel from channels/index.ts
 // before it's fully initialized.
@@ -130,10 +140,11 @@ function wantsStatusReport(query) {
 /**
  * Create and configure the Express application
  */
-function createApp(config) {
+function createApp(config, cognitiveHub) {
     const app = express();
     // Trust proxy (for rate limiting behind reverse proxy)
     app.set('trust proxy', 1);
+    app.set('authEnabled', config.authEnabled);
     // Request ID middleware
     app.use(requestIdMiddleware);
     // Security headers middleware (CSP, X-Frame-Options, HSTS, etc.)
@@ -167,6 +178,10 @@ function createApp(config) {
             ],
         }));
     }
+    // Separate opt-in peer bearer auth, bounded parser and rate limit; existing REST/JWT routes unchanged.
+    if (process.env.CODEBUDDY_A2A_PEERS) {
+        app.use(createA2AJsonRpcRoutes({ publicUrl: process.env.CODEBUDDY_A2A_PUBLIC_URL ?? `http://127.0.0.1:${config.port}/a2a/v1` }));
+    }
     // Body parsing
     app.use(express.json({ limit: config.maxRequestSize }));
     app.use(express.urlencoded({ extended: true, limit: config.maxRequestSize }));
@@ -184,10 +199,57 @@ function createApp(config) {
     app.use('/metrics', metricsRoutes);
     // Mobile remote-supervision routes (custom pairing-token auth)
     app.use('/api/mobile', mobileRoutes);
+    // PWA shell (HTML/CSS/JS/manifest/SW) is public; /api and /ws still require JWT.
+    // Opt-in: without CODEBUDDY_MOBILE_PWA=true the route is absent (404).
+    if (isMobilePwaEnabled()) {
+        app.use('/__codebuddy__/mobile', mobilePwaRouter);
+    }
+    else {
+        app.use('/__codebuddy__/mobile', (_req, res) => {
+            res.status(404).end();
+        });
+    }
+    // Android pairs with a local code and proves key possession before JWT auth.
+    app.use('/api/auth/device', createDeviceAuthRoutes(config.jwtSecret));
     // Authentication (applied after public health/metrics/mobile endpoints)
     app.use(createAuthMiddleware(config));
     // A2A routes (auth-based, exempt from CSRF) — must be mounted BEFORE CSRF middleware
     app.use('/api/a2a', createA2AProtocolRoutes());
+    // In --no-auth mode, only the deliberately constrained A2A surface remains
+    // network-reachable. All general agent/session/tool/workflow routes below are
+    // direct-loopback only; otherwise remote chat could invoke tools indirectly.
+    app.use(requireLocalAnonymousAccess);
+    // Read-only Fleet diagnostics for the CLI. These HTTP wrappers expose the
+    // same server state and peer description as the Gateway WebSocket methods.
+    app.get('/api/fleet/status', (_req, res) => {
+        res.json({
+            status: 'ok',
+            connections: getConnectionStats(),
+        });
+    });
+    app.get('/api/fleet/describe', async (_req, res) => {
+        const describe = getPeerMethodHandler('peer.describe');
+        if (!describe) {
+            res.status(503).json({ error: 'Fleet peer description is unavailable' });
+            return;
+        }
+        try {
+            const description = await describe({}, {
+                connectionId: 'http-fleet-cli',
+                scopes: ['peer:invoke'],
+                traceId: `http-fleet-${Date.now().toString(36)}`,
+                depth: 0,
+            });
+            res.json(fleetHttpDescribeEnvelope(description && typeof description === 'object'
+                ? description
+                : { description }));
+        }
+        catch (error) {
+            res.status(503).json({
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    });
     // CSRF protection for state-changing endpoints (POST/PUT/DELETE)
     // Applied AFTER A2A routes so they are never touched by CSRF middleware
     if (config.authEnabled && process.env.CSRF_PROTECTION !== 'false') {
@@ -208,10 +270,13 @@ function createApp(config) {
     app.use('/api/tools', toolsRoutes);
     app.use('/api/sessions', sessionsRoutes);
     app.use('/api/memory', memoryRoutes);
+    app.use('/api/lessons', lessonsRoutes);
+    app.use('/api/cognition', createCognitionRoutes(cognitiveHub));
     app.use('/api/workflows', createWorkflowApiRouter());
     app.use('/api/acp', createACPRoutes());
     app.use('/api/cloud/tasks', createCloudTaskRoutes());
     app.use('/api/webhooks', createWebhookRoutes());
+    app.use('/api', runsRoutes);
     // OpenAI-compatible alias
     app.use('/v1/chat', chatRoutes);
     app.get('/v1/models', requireScope('chat'), (_req, res) => {
@@ -232,7 +297,7 @@ function createApp(config) {
         }
     });
     // Peer route resolution endpoint (for testing/debugging)
-    app.post('/api/routing/resolve', async (req, res) => {
+    app.post('/api/routing/resolve', requireScope('admin'), async (req, res) => {
         const message = req.body.message;
         const accountId = req.body.accountId;
         if (!message) {
@@ -297,12 +362,12 @@ function createApp(config) {
             res.json({ jobs: [], stats: {} });
         }
     });
-    app.post('/api/cron/jobs/:id/trigger', async (req, res) => {
+    app.post('/api/cron/jobs/:id/trigger', requireScope('admin'), async (req, res) => {
         try {
             const { getCronScheduler } = await import('../scheduler/cron-scheduler.js');
             const scheduler = getCronScheduler();
             await scheduler.loadFromDisk();
-            const run = await scheduler.runJobNow(req.params.id);
+            const run = await scheduler.runJobNow(String(req.params.id || ''));
             if (run) {
                 res.json({ success: true, run });
             }
@@ -325,7 +390,7 @@ function createApp(config) {
             res.json({});
         }
     });
-    app.post('/api/notifications/preferences', async (req, res) => {
+    app.post('/api/notifications/preferences', requireScope('admin'), async (req, res) => {
         try {
             if (!req.body || typeof req.body !== 'object') {
                 res.status(400).json({ error: 'Request body must be a JSON object' });
@@ -351,7 +416,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/webhooks', async (req, res) => {
+    app.post('/api/webhooks', requireScope('admin'), async (req, res) => {
         try {
             const { name, agentMessage, secret } = req.body;
             if (!name || typeof name !== 'string' || !agentMessage || typeof agentMessage !== 'string') {
@@ -371,11 +436,11 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.delete('/api/webhooks/:id', async (req, res) => {
+    app.delete('/api/webhooks/:id', requireScope('admin'), async (req, res) => {
         try {
             const { WebhookManager } = await import('../webhooks/webhook-manager.js');
             const mgr = new WebhookManager();
-            if (mgr.remove(req.params.id)) {
+            if (mgr.remove(String(req.params.id || ''))) {
                 res.json({ success: true });
             }
             else {
@@ -386,12 +451,12 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/webhooks/:id/trigger', async (req, res) => {
+    app.post('/api/webhooks/:id/trigger', requireScope('admin'), async (req, res) => {
         try {
             const { WebhookManager } = await import('../webhooks/webhook-manager.js');
             const mgr = new WebhookManager();
             const signature = req.headers['x-webhook-signature'];
-            const result = mgr.processPayload(req.params.id, req.body, signature);
+            const result = mgr.processPayload(String(req.params.id || ''), req.body, signature);
             if ('error' in result) {
                 const status = result.error === 'Webhook not found' ? 404 : 400;
                 res.status(status).json(result);
@@ -446,7 +511,7 @@ function createApp(config) {
             res.json({ running: false, enabled: false, totalTicks: 0 });
         }
     });
-    app.post('/api/heartbeat/start', async (_req, res) => {
+    app.post('/api/heartbeat/start', requireScope('admin'), async (_req, res) => {
         try {
             const { getHeartbeatEngine } = await import('../daemon/heartbeat.js');
             const engine = getHeartbeatEngine();
@@ -457,7 +522,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/heartbeat/stop', async (_req, res) => {
+    app.post('/api/heartbeat/stop', requireScope('admin'), async (_req, res) => {
         try {
             const { getHeartbeatEngine } = await import('../daemon/heartbeat.js');
             const engine = getHeartbeatEngine();
@@ -468,7 +533,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/heartbeat/tick', async (_req, res) => {
+    app.post('/api/heartbeat/tick', requireScope('admin'), async (_req, res) => {
         try {
             const { getHeartbeatEngine } = await import('../daemon/heartbeat.js');
             const engine = getHeartbeatEngine();
@@ -504,7 +569,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/hub/install', async (req, res) => {
+    app.post('/api/hub/install', requireScope('admin'), async (req, res) => {
         try {
             const { name, version } = req.body;
             if (!name || typeof name !== 'string') {
@@ -524,11 +589,11 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.delete('/api/hub/:name', async (req, res) => {
+    app.delete('/api/hub/:name', requireScope('admin'), async (req, res) => {
         try {
             const { getSkillsHub } = await import('../skills/hub.js');
             const hub = getSkillsHub();
-            const removed = await hub.uninstall(req.params.name);
+            const removed = await hub.uninstall(String(req.params.name || ''));
             if (removed) {
                 res.json({ success: true });
             }
@@ -563,7 +628,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.put('/api/identity/:name', async (req, res) => {
+    app.put('/api/identity/:name', requireScope('admin'), async (req, res) => {
         try {
             const { content } = req.body;
             if (!content || typeof content !== 'string') {
@@ -577,7 +642,7 @@ function createApp(config) {
             const { getIdentityManager } = await import('../identity/identity-manager.js');
             const mgr = getIdentityManager();
             await mgr.load(process.cwd());
-            await mgr.set(req.params.name, content);
+            await mgr.set(String(req.params.name || ''), content);
             res.json({ success: true });
         }
         catch (error) {
@@ -605,7 +670,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/groups/block', async (req, res) => {
+    app.post('/api/groups/block', requireScope('admin'), async (req, res) => {
         try {
             const { userId } = req.body;
             if (!userId || typeof userId !== 'string') {
@@ -621,11 +686,11 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.delete('/api/groups/block/:userId', async (req, res) => {
+    app.delete('/api/groups/block/:userId', requireScope('admin'), async (req, res) => {
         try {
             const { getGroupSecurity } = await import('../channels/group-security.js');
             const mgr = getGroupSecurity();
-            if (mgr.removeFromBlocklist(req.params.userId)) {
+            if (mgr.removeFromBlocklist(String(req.params.userId || ''))) {
                 res.json({ success: true });
             }
             else {
@@ -647,7 +712,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/auth-profiles', async (req, res) => {
+    app.post('/api/auth-profiles', requireScope('admin'), async (req, res) => {
         try {
             const profile = req.body;
             if (!profile || typeof profile !== 'object') {
@@ -676,11 +741,11 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.delete('/api/auth-profiles/:id', async (req, res) => {
+    app.delete('/api/auth-profiles/:id', requireScope('admin'), async (req, res) => {
         try {
             const { getAuthProfileManager } = await import('../auth/profile-manager.js');
             const mgr = getAuthProfileManager();
-            if (mgr.removeProfile(req.params.id)) {
+            if (mgr.removeProfile(String(req.params.id || ''))) {
                 res.json({ success: true });
             }
             else {
@@ -691,7 +756,7 @@ function createApp(config) {
             res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
         }
     });
-    app.post('/api/auth-profiles/reset', async (_req, res) => {
+    app.post('/api/auth-profiles/reset', requireScope('admin'), async (_req, res) => {
         try {
             const { resetAuthProfileManager, getAuthProfileManager } = await import('../auth/profile-manager.js');
             resetAuthProfileManager();
@@ -750,16 +815,113 @@ function createApp(config) {
                     get: { summary: 'Historical metrics data', tags: ['Metrics'] },
                 },
                 '/api/chat': {
-                    post: { summary: 'Send chat message', tags: ['Chat'] },
+                    post: {
+                        summary: 'Send chat message',
+                        tags: ['Chat'],
+                        requestBody: {
+                            required: true,
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        required: ['messages'],
+                                        properties: {
+                                            messages: { type: 'array', items: { type: 'object' } },
+                                            sessionId: {
+                                                type: 'string',
+                                                maxLength: 512,
+                                                description: 'Logical conversation shared by REST chat and tool calls.',
+                                            },
+                                            stream: { type: 'boolean' },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
                 },
                 '/api/chat/completions': {
-                    post: { summary: 'OpenAI-compatible chat completions', tags: ['Chat'] },
+                    post: {
+                        summary: 'OpenAI-compatible chat completions',
+                        tags: ['Chat'],
+                        requestBody: {
+                            required: true,
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        required: ['messages'],
+                                        properties: {
+                                            messages: { type: 'array', items: { type: 'object' } },
+                                            session_id: {
+                                                type: 'string',
+                                                maxLength: 512,
+                                                description: 'OpenAI-style logical conversation identifier.',
+                                            },
+                                            sessionId: {
+                                                type: 'string',
+                                                maxLength: 512,
+                                                description: 'Code Buddy alias for session_id.',
+                                            },
+                                            stream: { type: 'boolean' },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
                 },
                 '/api/tools': {
                     get: { summary: 'List available tools', tags: ['Tools'] },
                 },
                 '/api/tools/{name}/execute': {
-                    post: { summary: 'Execute a tool', tags: ['Tools'] },
+                    post: {
+                        summary: 'Execute a tool',
+                        tags: ['Tools'],
+                        requestBody: {
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        properties: {
+                                            parameters: { type: 'object' },
+                                            confirmed: { type: 'boolean' },
+                                            sessionId: {
+                                                type: 'string',
+                                                maxLength: 512,
+                                                description: 'Logical conversation shared with REST chat.',
+                                            },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                },
+                '/api/tools/batch': {
+                    post: {
+                        summary: 'Execute a sequence of tools in one logical conversation',
+                        tags: ['Tools'],
+                        requestBody: {
+                            required: true,
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        required: ['tools'],
+                                        properties: {
+                                            tools: { type: 'array', maxItems: 10, items: { type: 'object' } },
+                                            sessionId: {
+                                                type: 'string',
+                                                maxLength: 512,
+                                                description: 'Logical conversation shared with REST chat.',
+                                            },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
                 },
                 '/api/sessions': {
                     get: { summary: 'List sessions', tags: ['Sessions'] },
@@ -836,6 +998,8 @@ function createApp(config) {
             },
         });
     });
+    // Canvas / A2UI (documented at /__codebuddy__/canvas/:id and /__codebuddy__/a2ui/)
+    app.use('/__codebuddy__', createCanvasRouter());
     // Dashboard SPA
     app.use('/__codebuddy__/dashboard', createDashboardRouter());
     // 404 handler
@@ -886,7 +1050,9 @@ export async function startServer(userConfig = {}) {
     catch {
         /* prometheus exporter optional */
     }
-    const app = createApp(config);
+    const cognitiveHub = new CognitiveHub();
+    const cognitionPort = new InProcessCognitivePort(cognitiveHub, createInternalCognitivePrincipal('embedded-cowork'));
+    const app = createApp(config, cognitiveHub);
     // Optional TLS: serve the API (including /api/mobile) over HTTPS when
     // CODEBUDDY_HTTPS / CODEBUDDY_MOBILE_TLS is set so the mobile-supervision
     // endpoint can be exposed off-device securely. Default (no env) is plain HTTP,
@@ -898,6 +1064,8 @@ export async function startServer(userConfig = {}) {
     const server = tlsOptions
         ? createHttpsServer(tlsOptions, app)
         : createServer(app);
+    server._cognitiveHub = cognitiveHub;
+    server._cognitionPort = cognitionPort;
     const startChannelBridge = async (baseUrl) => {
         try {
             const { getChannelManager } = await import('../channels/index.js');
@@ -947,7 +1115,11 @@ export async function startServer(userConfig = {}) {
     // Setup WebSocket if enabled
     if (config.websocketEnabled) {
         await setupWebSocket(server, config);
+        const unwireCognition = wireCognitionBridge(cognitiveHub);
+        server._unwireCognition =
+            unwireCognition;
         logger.info('WebSocket server enabled at /ws');
+        logger.info('Cognitive bus enabled at /ws (bounded, scoped, resumable)');
         // Dedicated desktop (Cowork) endpoint for the conversational core only
         // (chat / sessions / live stream events). Speaks the Cowork ClientEvent
         // /ServerEvent protocol, auth at handshake (JWT), origin-hardened. Mounted
@@ -981,6 +1153,11 @@ export async function startServer(userConfig = {}) {
         // needed: the bridge wraps standalone executors and runs gates
         // (allowlist + fleetSafe + workspace root) per invocation.
         wirePeerToolBridge();
+        // CB2 INNOV-4 — pull-only CKG federation. The method remains registered
+        // when disabled so callers receive CKG_SYNC_NOT_ENABLED; its handler gates
+        // before touching the ledger.
+        wirePeerCkgBridge();
+        wirePeerMissionExchangeBridge();
         // Phase (d).16a — auto-detect the peer.chat client from env
         // (priority order: ollama > grok > anthropic > gemini > openai).
         // When no key is detected, peer.chat still wires but answers
@@ -988,16 +1165,16 @@ export async function startServer(userConfig = {}) {
         // so remote Claudes know what they're talking to.
         (async () => {
             try {
-                const { createPeerChatClientFromEnv } = await import('../fleet/peer-chat-client-factory.js');
+                const { createPeerChatClientFromEnv, createPeerChatClientForProvider } = await import('../fleet/peer-chat-client-factory.js');
                 const factory = createPeerChatClientFromEnv();
                 if (factory) {
-                    wirePeerChatBridge(() => factory.client, factory.info);
-                    await wirePeerSessionBridge(() => factory.client);
+                    wirePeerChatBridge(() => factory.client, factory.info, (provider, model) => createPeerChatClientForProvider(provider, model));
+                    await wirePeerSessionBridge(() => factory.client, factory.info, (provider, model) => createPeerChatClientForProvider(provider, model));
                     logger.info(`[fleet] peer.chat wired: ${factory.info.provider} (${factory.info.model}${factory.info.isLocal ? ', local' : ''})`);
                 }
                 else {
-                    wirePeerChatBridge(() => null);
-                    await wirePeerSessionBridge(() => null);
+                    wirePeerChatBridge(() => null, null, (provider, model) => createPeerChatClientForProvider(provider, model));
+                    await wirePeerSessionBridge(() => null, null, (provider, model) => createPeerChatClientForProvider(provider, model));
                     logger.info('[fleet] peer.chat wired without provider — set GOOGLE_API_KEY / GROK_API_KEY / ... or OLLAMA_HOST to activate');
                 }
             }
@@ -1022,21 +1199,70 @@ export async function startServer(userConfig = {}) {
             logger.info(`Metrics Dashboard: ${baseUrl}/api/metrics/dashboard`);
             logger.info(`Docs: ${baseUrl}/api/docs`);
             logger.info(`WebSocket: ${config.websocketEnabled ? 'Enabled (/ws)' : 'Disabled'}`);
+            // Fleet rooms (opt-in): persistent signed messages between members. Wired
+            // after listen so auth audiences use the port actually bound.
+            if (config.websocketEnabled && process.env.CODEBUDDY_FLEET_ROOMS === 'true') {
+                try {
+                    const address = server.address();
+                    const port = address && typeof address === 'object' ? address.port : config.port;
+                    const { startFleetRooms } = await import('../fleet/rooms/room-server.js');
+                    server._fleetRooms =
+                        startFleetRooms({ port });
+                }
+                catch (error) {
+                    logger.warn('[fleet-rooms] not enabled', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
             // Sensory nervous-system bridge (opt-in): ingress for the Rust buddy-sense
             // daemon → internal event bus → reactions. Loopback-only.
             if (process.env.CODEBUDDY_SENSORY === 'true' && !sensoryWired) {
                 sensoryWired = true; // wire once per process (a 2nd start would double listeners + re-bind the port)
                 try {
                     const { startSensoryBridge } = await import('../sensory/sensory-bridge.js');
-                    const { wireSensoryReactions } = await import('../sensory/reactions.js');
+                    const { shouldWireSpeechReaction, wireSensoryReactions } = await import('../sensory/reactions.js');
                     const { getHeartbeatScheduler } = await import('../sensory/heartbeat-scheduler.js');
                     const sensoryBridgeHandle = startSensoryBridge();
+                    sensoryTeardown.push(() => sensoryBridgeHandle.close());
+                    await sensoryBridgeHandle.ready;
                     const unwireReactions = wireSensoryReactions();
-                    sensoryTeardown.push(() => sensoryBridgeHandle.close(), unwireReactions);
-                    // Vision reaction (opt-in) — vision/motion → camera_analyze (local gemma).
+                    const { wireSensoryWorkspace } = await import('../cognition/sensory-workspace.js');
+                    const embodiedCognition = wireSensoryWorkspace({
+                        workspace: cognitiveHub.workspace,
+                        mesh: cognitiveHub.mesh,
+                    });
+                    const { CognitiveContextProjector } = await import('../cognition/context-renderer.js');
+                    const cognitiveContextProjector = new CognitiveContextProjector(embodiedCognition.workspace);
+                    sensoryTeardown.push(unwireReactions, () => embodiedCognition.close());
+                    logger.info('Embodied cognition: Enabled in shadow mode (bounded workspace + parallel specialist mailboxes)');
+                    if (config.websocketEnabled && process.env.CODEBUDDY_AVATAR_BRIDGE !== 'false') {
+                        const [{ wireAvatarGatewayBridge }, { broadcast }] = await Promise.all([
+                            import('../avatar/avatar-gateway-bridge.js'),
+                            import('./websocket/handler.js'),
+                        ]);
+                        const unsubscribeAvatar = wireAvatarGatewayBridge(broadcast);
+                        sensoryTeardown.push(unsubscribeAvatar);
+                        logger.info('Avatar performance bridge: Enabled (Gateway avatar:event, scope avatar:read)');
+                    }
+                    // Vision reaction (opt-in) — vision/motion → bounded local VLM description.
                     // Requires a shared token: a frame can trigger the webcam, so refuse to
                     // wire it on an unauthenticated bridge.
                     const sensoryToken = process.env.CODEBUDDY_SENSORY_TOKEN;
+                    // One shared response decider for the whole sensory session: the vision
+                    // arrival greeting opens the engagement window (markEngaged) that the
+                    // speech reaction's gate reads, so a greeted visitor's natural reply is
+                    // treated as addressed — no wake-word needed. Without this shared wiring
+                    // the greeting played but never opened a conversation.
+                    const { createResponseDecider, resolveSensoryResponsePolicy } = await import('../sensory/respond-decider.js');
+                    const responsePolicy = resolveSensoryResponsePolicy();
+                    for (const warning of responsePolicy.warnings) {
+                        logger.warn(`[respond-policy] ${warning}`);
+                    }
+                    const responseDecider = createResponseDecider({ chimeIn: responsePolicy.chimeIn });
+                    const { setVoiceResponseDecider } = await import('../sensory/voice-loop.js');
+                    setVoiceResponseDecider(responseDecider);
+                    sensoryTeardown.push(() => setVoiceResponseDecider(undefined));
                     {
                         const { shouldWireVisionReaction, wireVisionReaction } = await import('../sensory/vision-reaction.js');
                         if (shouldWireVisionReaction({ camera: process.env.CODEBUDDY_SENSORY_CAMERA, token: sensoryToken })) {
@@ -1046,6 +1272,23 @@ export async function startServer(userConfig = {}) {
                         else if (process.env.CODEBUDDY_SENSORY_CAMERA === 'true') {
                             logger.warn('Sensory vision reaction NOT enabled: set CODEBUDDY_SENSORY_TOKEN to allow camera triggering.');
                         }
+                        // Semantic vision events (person_entered/lost, drowsy) from the vision sidecar.
+                        if (shouldWireVisionReaction({ camera: process.env.CODEBUDDY_SENSORY_CAMERA, token: sensoryToken })) {
+                            const { wireSemanticVisionReaction } = await import('../sensory/semantic-vision-reaction.js');
+                            sensoryTeardown.push(wireSemanticVisionReaction({ onEngage: () => responseDecider.markEngaged('arrival') }));
+                            logger.info('Sensory semantic-vision reaction: Enabled (person/drowsy → alert + greet→engage)');
+                        }
+                        // Event→action rules engine (a camera event triggers code) — opt-in + token-gated,
+                        // since rules can run shell. Safety lives in sensory-action-executor (env-only context,
+                        // destructive-block). Off unless CODEBUDDY_SENSORY_RULES=true AND a token is set.
+                        if (process.env.CODEBUDDY_SENSORY_RULES === 'true' && sensoryToken) {
+                            const { wireSensoryRules } = await import('../sensory/sensory-rules-engine.js');
+                            sensoryTeardown.push(wireSensoryRules());
+                            logger.info('Sensory rules engine: Enabled (event → shell/webhook/alert/agent)');
+                        }
+                        else if (process.env.CODEBUDDY_SENSORY_RULES === 'true') {
+                            logger.warn('Sensory rules NOT enabled: set CODEBUDDY_SENSORY_TOKEN (rules can run shell).');
+                        }
                     }
                     // Screen reaction (opt-in) — also token-gated (an injected analyzer could capture the desktop).
                     if (process.env.CODEBUDDY_SENSORY_SCREEN === 'true') {
@@ -1058,11 +1301,373 @@ export async function startServer(userConfig = {}) {
                             logger.warn('Sensory screen reaction NOT enabled: set CODEBUDDY_SENSORY_TOKEN.');
                         }
                     }
+                    // Perceptive pair (opt-in) — existing screen text/keyframes → one
+                    // conductor-arbitrated local voice suggestion. No capture, agent turn,
+                    // edit or remote notification is performed.
+                    if (process.env.CODEBUDDY_SENSORY_ERRORWATCH === 'true') {
+                        const { wireErrorWatchReaction } = await import('../sensory/error-watch-reaction.js');
+                        sensoryTeardown.push(wireErrorWatchReaction());
+                        logger.info('Sensory error watch: Enabled (screen error → local voice suggestion)');
+                    }
                     // Speech reaction (opt-in) — speech_end → STT → 'hearing' percept (+ onHeard hook).
-                    if (process.env.CODEBUDDY_SENSORY_SPEECH === 'true') {
+                    // With CODEBUDDY_SENSORY_SPEAK=true the loop closes: STT → think (local $0) → speak (Piper).
+                    if (shouldWireSpeechReaction({
+                        speech: process.env.CODEBUDDY_SENSORY_SPEECH,
+                        token: sensoryToken,
+                    })) {
                         const { wireSpeechReaction } = await import('../sensory/speech-reaction.js');
-                        sensoryTeardown.push(wireSpeechReaction());
-                        logger.info('Sensory speech reaction: Enabled (speech_end → STT → percept)');
+                        if (process.env.CODEBUDDY_SENSORY_SPEAK === 'true') {
+                            const { makeVoiceReply, playCachedConversationCue, describeVoiceReadiness, prewarmVoiceModel, prewarmVoiceRuntime, resolveVoiceModel, } = await import('../sensory/voice-loop.js');
+                            const readiness = describeVoiceReadiness();
+                            // Fail LOUD: a wired-but-silent robot looks broken. Name what to set.
+                            for (const w of readiness.warnings)
+                                logger.warn(`[voice] ${w}`);
+                            const { registerDefaultVoiceSpecialists, isLoopbackCognitiveRoute } = await import('../cognition/voice-specialists.js');
+                            void resolveVoiceModel('Bonjour Lisa', {
+                                forceFastLane: true,
+                            })
+                                .then((specialistRoute) => {
+                                const registration = registerDefaultVoiceSpecialists(embodiedCognition.mesh, specialistRoute, {
+                                    enabled: process.env.CODEBUDDY_COGNITIVE_SPECIALISTS !== 'false',
+                                    maxActivationsPerHour: Number(process.env.CODEBUDDY_COGNITIVE_SPECIALIST_MAX_PER_HOUR ?? 30),
+                                });
+                                logger.info(`[cognition] voice specialists ${registration.enabled ? 'enabled' : 'disabled'} ` +
+                                    `reason=${registration.reason} models=${specialistRoute.model} ` +
+                                    `ids=${registration.specialistIds.join(',') || 'none'}`);
+                            })
+                                .catch((error) => {
+                                logger.warn(`[cognition] voice specialists unavailable: ${error instanceof Error ? error.message : String(error)}`);
+                            });
+                            const acquireCognitiveContext = (route, heard) => {
+                                const privacyClearance = route.baseURL && isLoopbackCognitiveRoute(route.baseURL)
+                                    ? 'local-only'
+                                    : 'cloud-ok';
+                                const lease = cognitiveContextProjector.begin({
+                                    consumerId: 'voice:resident',
+                                    privacyClearance,
+                                    query: heard,
+                                    maxItems: 4,
+                                    maxChars: 1_200,
+                                });
+                                return lease.leaseId ? lease : null;
+                            };
+                            // Pay the real cold costs (route probe, Ollama model load, common Piper clips)
+                            // before somebody speaks. All work is background and never delays server readiness.
+                            const prewarmFactLane = async () => {
+                                const factModel = process.env.CODEBUDDY_SENSORY_SPEAK_FACT_MODEL?.trim();
+                                if (!factModel)
+                                    return;
+                                const route = await resolveVoiceModel('Pourquoi le ciel est-il bleu ?');
+                                const result = await prewarmVoiceModel({ route });
+                                logger.info(`[voice] factual model warm: model=${result.model} ` +
+                                    `${result.warmed ? `${result.durationMs}ms` : result.reason || 'skipped'}`);
+                            };
+                            void prewarmVoiceRuntime()
+                                .then(async (result) => {
+                                logger.info(`[voice] runtime warm: model=${result.route.model} ` +
+                                    `route=${result.routeMs}ms ollama=${result.model.warmed ? `${result.model.durationMs}ms` : result.model.reason || 'skipped'} ` +
+                                    `tts=${result.tts.cached}/${result.tts.attempted} (${result.tts.durationMs}ms)`);
+                                await prewarmFactLane();
+                            })
+                                .catch((err) => {
+                                logger.warn(`[voice] runtime prewarm failed: ${err instanceof Error ? err.message : String(err)}`);
+                            });
+                            const refreshValue = Number(process.env.CODEBUDDY_VOICE_MODEL_REFRESH_MS);
+                            const modelRefreshMs = Number.isFinite(refreshValue) && refreshValue >= 0 ? refreshValue : 15 * 60_000;
+                            if (process.env.CODEBUDDY_VOICE_MODEL_PREWARM !== 'false' &&
+                                modelRefreshMs > 0) {
+                                const keepWarmTimer = setInterval(() => {
+                                    void prewarmVoiceModel()
+                                        .then(() => prewarmFactLane())
+                                        .catch(() => undefined);
+                                }, modelRefreshMs);
+                                keepWarmTimer.unref();
+                                sensoryTeardown.push(() => clearInterval(keepWarmTimer));
+                            }
+                            // Build the richer relationship graph before the first user turn. The cache remains
+                            // latency-bounded if startup warming has not completed when somebody speaks.
+                            if (process.env.CODEBUDDY_COMPANION_RELATIONAL === 'true') {
+                                void import('../companion/relational-context.js')
+                                    .then((m) => m.prewarmVoiceRelationalContext())
+                                    .catch(() => undefined);
+                            }
+                            // ACT (opt-in): a spoken command drives a REAL agent turn (can edit/run) under a
+                            // permission posture. Default off → today's chatty companion reply.
+                            // Both paths use the hybrid for conversational MEMORY + persona warmth + phatic
+                            // short-circuit. With ACT on, a real question/command escalates to a GROUNDED agent
+                            // turn (reads/searches under the posture). With ACT off, ordinary dialogue stays on
+                            // the fast warm lane while Lisa can still inspect herself in read-only plan mode.
+                            const { makeHybridReply, classifyLisaIntrospection } = await import('../sensory/hybrid-reply.js');
+                            const { getCrossChannelConversationBridge } = await import('../conversation/cross-channel-bridge.js');
+                            const { createCanonicalVoiceReplySpeaker, speakCanonicalVoiceInitiative, } = await import('../conversation/voice-continuity.js');
+                            const conversationBridge = getCrossChannelConversationBridge();
+                            // Resolve activity on every turn. The voice process may start
+                            // before Telegram/Cowork publishes the rendezvous event.
+                            const sharedHistory = () => conversationBridge.isActive() ? conversationBridge.history() : [];
+                            let replyFn;
+                            if (readiness.act) {
+                                // Grounded turn can take a few seconds → speak a short ack first so a real
+                                // question isn't met with silence. Optional repo cwd so it grounds on real files.
+                                const { sayNow } = await import('../sensory/voice-loop.js');
+                                const speakCwd = process.env.CODEBUDDY_SENSORY_SPEAK_CWD;
+                                replyFn = makeHybridReply({
+                                    permissionMode: readiness.permissionMode || 'default',
+                                    ...(speakCwd ? { cwd: speakCwd } : {}),
+                                    sharedHistory,
+                                    acquireCognitiveContext,
+                                    ack: async (_transcript, opts) => {
+                                        await sayNow("D'accord, je regarde ça.", {
+                                            signal: opts?.signal,
+                                            phoneDelivery: 'never',
+                                        });
+                                    },
+                                });
+                            }
+                            else {
+                                const { sayNow } = await import('../sensory/voice-loop.js');
+                                const speakCwd = process.env.CODEBUDDY_SENSORY_SPEAK_CWD;
+                                replyFn = makeHybridReply({
+                                    permissionMode: 'plan',
+                                    ...(speakCwd ? { cwd: speakCwd } : {}),
+                                    classify: (heard) => classifyLisaIntrospection(heard) !== null,
+                                    sharedHistory,
+                                    acquireCognitiveContext,
+                                    ack: async (_transcript, opts) => {
+                                        await sayNow("D'accord, je regarde ça.", {
+                                            signal: opts?.signal,
+                                            phoneDelivery: 'never',
+                                        });
+                                    },
+                                });
+                            }
+                            let latestVoiceTiming;
+                            const reply = makeVoiceReply({
+                                replyFn,
+                                onConversationTurn: async (turn) => {
+                                    await conversationBridge.recordVoiceTurn(turn);
+                                },
+                                onCorrelatedConversationTurn: (turn) => {
+                                    if (turn.role === 'assistant') {
+                                        embodiedCognition.mesh.publish({
+                                            kind: 'result',
+                                            producerId: 'voice:dialogue',
+                                            correlationId: turn.turnId ?? `voice-assistant:${Date.now()}`,
+                                            salience: 0.8,
+                                            confidence: 1,
+                                            privacy: 'local-only',
+                                            provenance: { source: 'voice-loop' },
+                                            ttlMs: 5 * 60_000,
+                                            payload: { role: turn.role, content: turn.content, surface: 'voice' },
+                                        });
+                                    }
+                                },
+                                onTiming: (timing) => {
+                                    latestVoiceTiming = timing;
+                                },
+                            });
+                            // Human-like response policy: contextual/addressed always install the shared
+                            // decider. Only contextual permits the optional high-bar chime-in judge; addressed
+                            // keeps deterministic address/greeting/continuity only. `always` is the explicit
+                            // unfiltered push-to-talk/test escape hatch resolved and warned at startup above.
+                            // Reminder voice-ack: a spoken "c'est fait" marks a PENDING reminder done. It binds
+                            // only to a reminder fired in its window (safety: never from ambient speech / the
+                            // chime-in LLM), bypasses the silence gate, reads the bind back, and short-circuits
+                            // the normal reply so the robot doesn't both confirm AND chat.
+                            // `reply` is a VoiceReplyHandler (callable + `.interrupt()`); the wrappers below
+                            // replace it with plain handlers, so type onHeard by the call contract they share.
+                            let onHeard = reply;
+                            let reminderShortcut;
+                            let maisonShortcut;
+                            if (process.env.CODEBUDDY_REMINDERS === 'true') {
+                                const rem = await import('../companion/reminders.js');
+                                const { sayNow } = await import('../sensory/voice-loop.js');
+                                // A reminder voice-ack OR a voice-creation both bypass the silence gate and
+                                // short-circuit the normal reply (the robot confirms instead of chatting).
+                                reminderShortcut = (t) => rem.matchAck(t, Date.now()) !== null ||
+                                    rem.isSnoozeCommand(t, Date.now()) ||
+                                    rem.isUndoCommand(t, Date.now()) ||
+                                    rem.isReminderVoiceCommand(t) ||
+                                    rem.parseVoiceReminder(t) !== null;
+                                onHeard = async (t, context) => {
+                                    const sayCanonical = createCanonicalVoiceReplySpeaker(t, (content) => sayNow(content, { phoneDelivery: 'never' }), conversationBridge);
+                                    // Spoken undo FIRST: a bare "annule" right after a creation reverts it (the
+                                    // confirm-and-await flow, ambient-style — the confirmation read the cadence
+                                    // back, the correction stays natural speech). Window-bounded, so it never
+                                    // hijacks an "annule" said minutes later in conversation.
+                                    const undone = rem.undoPending(t, Date.now());
+                                    if (undone) {
+                                        await rem.removeReminder(undone.id);
+                                        await sayCanonical(`OK, j'annule le rappel : ${undone.label}.`);
+                                        return;
+                                    }
+                                    // Snooze a pending reminder ("dans 10 minutes" / "plus tard") before anything else.
+                                    const snoozed = await rem.snoozePending(t, Date.now());
+                                    if (snoozed) {
+                                        const mins = Math.max(1, Math.round(snoozed.delayMs / 60_000));
+                                        await sayCanonical(`D'accord, je te le rappelle dans ${mins} minute${mins > 1 ? 's' : ''}.`);
+                                        return;
+                                    }
+                                    const id = rem.matchAck(t, Date.now());
+                                    if (id) {
+                                        const done = await rem.markDone(id, 'voice');
+                                        if (done)
+                                            await sayCanonical(rem.reminderReadback(done.label));
+                                        return;
+                                    }
+                                    // Manage reminders by voice (list / remove / disable) BEFORE create, so
+                                    // "supprime le rappel du train" isn't misread as a new reminder.
+                                    if (await rem.handleReminderVoiceCommand(t, { speak: sayCanonical }))
+                                        return;
+                                    const created = rem.parseVoiceReminder(t);
+                                    if (created) {
+                                        try {
+                                            const r = await rem.addReminder(created);
+                                            // Arm the spoken undo: a bare "annule" within the window reverts THIS creation.
+                                            rem.noteCreatedForUndo(r, Date.now());
+                                            // Read back the CADENCE ("demain" / "tous les jours") so a mis-captured
+                                            // recurrence is audible on the spot (the train-bug class of confusion).
+                                            await sayCanonical(`C'est noté : ${r.label}, ${rem.reminderCadencePhrase(r)} à ${r.time}.`);
+                                        }
+                                        catch (err) {
+                                            logger.warn(`[reminders] voice create failed: ${err instanceof Error ? err.message : String(err)}`);
+                                        }
+                                        return;
+                                    }
+                                    await reply(t, context);
+                                };
+                            }
+                            // Maison shortcuts are deterministic and local: quiet/focus/guest/cooking modes and
+                            // named cooking timers do not wait for an LLM. Explicit wording only, so ordinary
+                            // conversation still falls through to the normal hybrid reply.
+                            {
+                                const maison = await import('../companion/maison-voice-actions.js');
+                                const { sayNow } = await import('../sensory/voice-loop.js');
+                                maisonShortcut = maison.isMaisonVoiceCommand;
+                                const inner = onHeard;
+                                onHeard = async (t, context) => {
+                                    const sayCanonical = createCanonicalVoiceReplySpeaker(t, (content) => sayNow(content, { phoneDelivery: 'never' }), conversationBridge);
+                                    if (await maison.handleMaisonVoiceCommand(t, { speak: sayCanonical }))
+                                        return;
+                                    await inner(t, context);
+                                };
+                            }
+                            // Event follow-ups (opt-in): when Patrice mentions a dated future event IN a real
+                            // conversation with Lisa, capture it and confirm aloud so a mis-hear is corrected on
+                            // the spot; the presence loop later asks how it went. Capture runs AFTER the reply and
+                            // fire-and-forget so it never adds reply latency, and is skipped for reminder commands
+                            // (those are handled above and would otherwise double as a "future event").
+                            if (process.env.CODEBUDDY_COMPANION_EVENT_FOLLOWUPS === 'true') {
+                                const ef = await import('../companion/event-followups.js');
+                                const { sayNow } = await import('../sensory/voice-loop.js');
+                                const extractor = ef.makeLLMEventExtractor();
+                                const inner = onHeard;
+                                onHeard = async (t, context) => {
+                                    // Start prospective extraction on its own cognitive lane while
+                                    // the canonical response is generated and spoken. The result
+                                    // may propose a later initiative, but never owns this turn's mouth.
+                                    const capturePromise = reminderShortcut?.(t) || maisonShortcut?.(t)
+                                        ? null
+                                        : ef.captureEventFollowUp(t, Date.now(), { extractor })
+                                            .then((captured) => ({ captured, error: undefined }))
+                                            .catch((error) => ({ captured: null, error }));
+                                    await inner(t, context);
+                                    if (!capturePromise)
+                                        return;
+                                    void capturePromise
+                                        .then(async ({ captured, error }) => {
+                                        if (error) {
+                                            logger.warn(`[event-followup] capture failed: ${error instanceof Error ? error.message : String(error)}`);
+                                            return;
+                                        }
+                                        if (captured) {
+                                            const confirmation = ef.confirmationLine(captured, Date.now());
+                                            await speakCanonicalVoiceInitiative(confirmation, (content) => sayNow(content, { phoneDelivery: 'never' }), conversationBridge);
+                                            logger.info(`[event-followup] captured "${captured.event}" → due ${new Date(captured.dueAt).toISOString()}`);
+                                        }
+                                    });
+                                };
+                                logger.info('Event follow-ups: Enabled (CODEBUDDY_COMPANION_EVENT_FOLLOWUPS) — capture dated events from conversation, ask how they went');
+                            }
+                            const wireOpts = {
+                                onHeard,
+                                onRecognizedTurn: ({ turnId, text }) => {
+                                    embodiedCognition.mesh.publish({
+                                        kind: 'utterance',
+                                        producerId: 'voice:hearing',
+                                        correlationId: turnId,
+                                        salience: 0.9,
+                                        confidence: 0.9,
+                                        privacy: 'local-only',
+                                        provenance: { source: 'recognized-voice-turn' },
+                                        ttlMs: 5 * 60_000,
+                                        payload: { role: 'user', content: text, surface: 'voice' },
+                                    });
+                                },
+                                // The Rust VAD publishes this before endpointing/STT. Prepare
+                                // the grounded standby during the user's own speaking time;
+                                // the transcript gate below remains the only authority to talk.
+                                onSpeechStart: () => replyFn.prewarm(),
+                                // One local offline partial may retarget the prepared model and
+                                // MCP set. It is never published, remembered, or treated as a
+                                // committed request; only transcript_final can enter cognition.
+                                onSpeechPartial: ({ text }) => replyFn.prewarm(text),
+                                onBargeInStart: (_payload, interruptedTurnId) => {
+                                    reply.interrupt(interruptedTurnId);
+                                    if (interruptedTurnId) {
+                                        embodiedCognition.mesh.cancelCorrelation(interruptedTurnId);
+                                    }
+                                },
+                                onBargeIn: (_text, interruptedTurnId) => {
+                                    reply.interrupt(interruptedTurnId);
+                                    if (interruptedTurnId) {
+                                        embodiedCognition.mesh.cancelCorrelation(interruptedTurnId);
+                                    }
+                                },
+                                getResponseTiming: () => {
+                                    const timing = latestVoiceTiming;
+                                    latestVoiceTiming = undefined;
+                                    return timing;
+                                },
+                                getAttentionSnapshot: () => responseDecider.snapshot(),
+                                isAddressed: (text) => responseDecider.isAddressed(text),
+                            };
+                            if (process.env.CODEBUDDY_SENSORY_BACKCHANNEL === 'true'
+                                || process.env.CODEBUDDY_SENSORY_REPAIR === 'true') {
+                                wireOpts.onConversationCue = playCachedConversationCue;
+                            }
+                            if (responsePolicy.gateEnabled) {
+                                // Reuse the session decider shared with the vision greeting above, so a
+                                // person-arrival greeting's open engagement window carries into this gate.
+                                wireOpts.shouldRespond = (t) => reminderShortcut?.(t) || maisonShortcut?.(t)
+                                    ? Promise.resolve({
+                                        respond: true,
+                                        reason: reminderShortcut?.(t) ? 'reminder' : 'maison',
+                                    })
+                                    : responseDecider.decide(t);
+                            }
+                            sensoryTeardown.push(wireSpeechReaction(wireOpts));
+                            sensoryTeardown.push(() => replyFn.dispose());
+                            sensoryTeardown.push(() => conversationBridge.flush());
+                            const gateLabel = responsePolicy.policy === 'always'
+                                ? 'always-respond[unfiltered:test-or-push-to-talk-only]'
+                                : responsePolicy.policy === 'contextual'
+                                    ? responsePolicy.chimeIn
+                                        ? 'gate[contextual+chime-in]'
+                                        : 'gate[contextual]'
+                                    : 'gate[addressed:no-chime-in]';
+                            logger.info(`Sensory speech reaction: Enabled (speech_end → STT → ${gateLabel} → ${readiness.act ? `agent[${readiness.permissionMode}]` : `think[${readiness.model}]+introspection[plan]`} → speak` +
+                                `${readiness.speakReady ? `[${readiness.voice}]` : ' — SILENT until CODEBUDDY_TTS_VOICE is set'})`);
+                            if (conversationBridge.isActive() && conversationBridge.config.target) {
+                                logger.info(`Conversation bridge: voice ↔ ${conversationBridge.config.target.channel} (configured target, thread ${conversationBridge.config.conversationId})`);
+                            }
+                        }
+                        else {
+                            sensoryTeardown.push(wireSpeechReaction());
+                            logger.info('Sensory speech reaction: Enabled (speech_end → STT → percept)');
+                        }
+                    }
+                    else if (process.env.CODEBUDDY_SENSORY_SPEECH === 'true') {
+                        logger.warn('Sensory speech reaction NOT enabled: set CODEBUDDY_SENSORY_TOKEN (speech can trigger an agent turn).');
                     }
                     // Privacy: camera/screen descriptions land in percepts.jsonl — warn if not encrypted at rest.
                     if ((process.env.CODEBUDDY_SENSORY_CAMERA === 'true' || process.env.CODEBUDDY_SENSORY_SCREEN === 'true') &&
@@ -1078,6 +1683,25 @@ export async function startServer(userConfig = {}) {
                         everyBeats,
                         handler: (ctx) => logger.info(`[heartbeat] pacemaker tick — beat ${ctx.beat} (load ${ctx.load1 ?? '?'})`),
                     });
+                    const configuredCognitionEvery = Number(process.env.CODEBUDDY_COGNITION_METRICS_EVERY ?? 30);
+                    const cognitionEvery = Number.isFinite(configuredCognitionEvery)
+                        ? Math.max(10, Math.floor(configuredCognitionEvery))
+                        : 30;
+                    heart.register({
+                        name: 'cognitive-observability',
+                        everyBeats: cognitionEvery,
+                        handler: () => {
+                            const workspaceMetrics = embodiedCognition.workspace.metrics();
+                            const specialistMetrics = embodiedCognition.mesh.metrics();
+                            const queued = specialistMetrics.reduce((sum, metric) => sum + metric.queued, 0);
+                            const active = specialistMetrics.reduce((sum, metric) => sum + metric.active, 0);
+                            const dropped = specialistMetrics.reduce((sum, metric) => sum + metric.dropped, 0);
+                            const privacyRejected = specialistMetrics.reduce((sum, metric) => sum + metric.privacyRejected, 0);
+                            logger.info(`[cognition] workspace=${workspaceMetrics.size} world=${embodiedCognition.snapshotWorld().length} ` +
+                                `queued=${queued} active=${active} dropped=${dropped} ` +
+                                `privacyRejected=${privacyRejected}`);
+                        },
+                    });
                     // Dreaming — consolidate short-term sensory memory every N beats.
                     const dreamEvery = Math.max(1, Number(process.env.CODEBUDDY_DREAM_EVERY ?? 30));
                     heart.register({
@@ -1088,16 +1712,275 @@ export async function startServer(userConfig = {}) {
                             await runDreamingPass();
                         },
                     });
+                    // System vitals (opt-in) — turn the EXISTING system monitors into heartbeat-paced
+                    // percepts on the bus (resource_threshold / disk_low / fleet_saturated / process_runaway),
+                    // so declarative rules replace busy-loop monitoring. The scheduler's inFlight lock means
+                    // one sample per beat, never a loop. Default OFF => byte-identical behavior.
+                    if (process.env.CODEBUDDY_SYSTEM_VITALS === 'true') {
+                        const vitalsEvery = Math.max(1, Number(process.env.CODEBUDDY_SYSTEM_VITALS_EVERY ?? 30));
+                        heart.register({
+                            name: 'system-vitals',
+                            everyBeats: vitalsEvery,
+                            handler: async () => {
+                                const { runSystemVitalsPass } = await import('../sensory/system-vitals-emitter.js');
+                                await runSystemVitalsPass();
+                            },
+                        });
+                        sensoryTeardown.push(() => heart.unregister('system-vitals'));
+                        logger.info(`System vitals: Enabled (CODEBUDDY_SYSTEM_VITALS) - heartbeat-paced resource percepts every ${vitalsEvery} beats`);
+                    }
+                    // Lisa selfie cache refill (opt-in) — one image per beat when ComfyUI is
+                    // reachable and load is low. Default OFF ⇒ byte-identical. Tests inject a
+                    // fake generator; this path never busy-loops if the generator is down.
+                    if (process.env.CODEBUDDY_LISA_SELFIE_REFILL === 'true') {
+                        const refillEvery = Math.max(1, Number(process.env.CODEBUDDY_LISA_SELFIE_REFILL_EVERY ?? 40));
+                        heart.register({
+                            name: 'lisa-selfie-refill',
+                            everyBeats: refillEvery,
+                            handler: async (ctx) => {
+                                const { runLisaSelfieRefillPass } = await import('../companion/lisa-selfie-refill.js');
+                                await runLisaSelfieRefillPass({
+                                    ...(typeof ctx.load1 === 'number' ? { load1: () => ctx.load1 } : {}),
+                                });
+                            },
+                        });
+                        sensoryTeardown.push(() => heart.unregister('lisa-selfie-refill'));
+                        logger.info(`Lisa selfie refill: Enabled (CODEBUDDY_LISA_SELFIE_REFILL) - at most one image every ${refillEvery} beats`);
+                    }
+                    // Schedule ticks (opt-in) — emit a `time/tick` percept each pass so rules can fire at a
+                    // time of day (match.kind:'tick' + between/filters on hhmm) with no busy loop. The
+                    // heartbeat is the clock. Default OFF => byte-identical behavior.
+                    if (process.env.CODEBUDDY_SCHEDULE_TICKS === 'true') {
+                        const ticksEvery = Math.max(1, Number(process.env.CODEBUDDY_SCHEDULE_TICKS_EVERY ?? 20));
+                        heart.register({
+                            name: 'schedule-ticks',
+                            everyBeats: ticksEvery,
+                            handler: async () => {
+                                const { runSchedulePass } = await import('../sensory/schedule-emitter.js');
+                                runSchedulePass();
+                            },
+                        });
+                        sensoryTeardown.push(() => heart.unregister('schedule-ticks'));
+                        logger.info(`Schedule ticks: Enabled (CODEBUDDY_SCHEDULE_TICKS) - time/tick percept every ${ticksEvery} beats`);
+                    }
+                    // Domain-event bridge (opt-in) — re-emit the agent's internal domain events
+                    // (fleet:activity, agent:loop_detected, cost:*, context:pre_compact) as sensory
+                    // percepts, so ONE rule grammar covers physical perception AND inner life. Anti-loop:
+                    // it never subscribes to sensory:perception. Default OFF => byte-identical behavior.
+                    if (process.env.CODEBUDDY_DOMAIN_EVENTS === 'true') {
+                        const { wireDomainEventBridge } = await import('../sensory/domain-event-bridge.js');
+                        sensoryTeardown.push(wireDomainEventBridge());
+                        logger.info('Domain-event bridge: Enabled (CODEBUDDY_DOMAIN_EVENTS) - domain events -> sensory:perception');
+                    }
+                    // Episodic journal (opt-in) — consolidate the heard DIALOGUE into "what we talked about"
+                    // so the arrival opener / follow-ups can reference it. Distinct from dreaming (sensor stats).
+                    if (process.env.CODEBUDDY_EPISODE_JOURNAL === 'true') {
+                        const episodeEvery = Math.max(1, Number(process.env.CODEBUDDY_EPISODE_EVERY ?? 40));
+                        heart.register({
+                            name: 'episodic-journal',
+                            everyBeats: episodeEvery,
+                            handler: async () => {
+                                const { runEpisodeConsolidation } = await import('../sensory/episodic-journal.js');
+                                const { getCrossChannelConversationBridge } = await import('../conversation/cross-channel-bridge.js');
+                                await runEpisodeConsolidation({
+                                    readConversation: async (limit) => getCrossChannelConversationBridge().history(limit),
+                                });
+                            },
+                        });
+                        logger.info(`Episodic journal: Enabled (CODEBUDDY_EPISODE_JOURNAL) — dialogue consolidation every ${episodeEvery} beats`);
+                    }
+                    // Inner life (opt-in) — every N beats Lisa "spends a moment" (a digital-authentic vignette
+                    // + her own small mood drift), surfaced via relational memory so a reply can reference what
+                    // she did while he was away. Gives her an interior without ever claiming a human life.
+                    if (process.env.CODEBUDDY_COMPANION_INNER_LIFE === 'true') {
+                        const innerLifeEvery = Math.max(1, Number(process.env.CODEBUDDY_INNER_LIFE_EVERY ?? 50));
+                        heart.register({
+                            name: 'inner-life',
+                            everyBeats: innerLifeEvery,
+                            handler: async () => {
+                                const { runInnerLifeTick } = await import('../companion/inner-life.js');
+                                await runInnerLifeTick();
+                                // A fresh vignette/mood should be visible to the next spoken turn.
+                                try {
+                                    const { invalidateVoiceRelationalContext } = await import('../companion/relational-context.js');
+                                    invalidateVoiceRelationalContext();
+                                }
+                                catch {
+                                    /* best-effort refresh */
+                                }
+                            },
+                        });
+                        logger.info(`Inner life: Enabled (CODEBUDDY_COMPANION_INNER_LIFE) — a moment to herself every ${innerLifeEvery} beats`);
+                    }
+                    // Voice-assistant improvement loop (opt-in, MySoulmate-inspired) — reflect on recent
+                    // dialogue and adapt over time: learned reply-guidance + bounded trait drift (behavioral
+                    // mode; never auto-accepts personal facts — those stay pending for `buddy assistant improve --apply`).
+                    if (process.env.CODEBUDDY_VOICE_IMPROVE === 'true') {
+                        const improveEvery = Math.max(1, Number(process.env.CODEBUDDY_VOICE_IMPROVE_EVERY ?? 60));
+                        heart.register({
+                            name: 'voice-improvement',
+                            everyBeats: improveEvery,
+                            handler: async () => {
+                                const { runVoiceImprovementCycle } = await import('../companion/voice-improvement-loop.js');
+                                await runVoiceImprovementCycle({ mode: 'behavioral' });
+                            },
+                        });
+                        logger.info(`Voice improvement loop: Enabled (CODEBUDDY_VOICE_IMPROVE) — reflect + adapt every ${improveEvery} beats (behavioral; facts stay pending)`);
+                    }
+                    // Deterministic conversation-quality loop — evaluates complete user/Lisa exchanges,
+                    // stores aggregate metrics only, and applies a reversible guidance line only after the
+                    // same weakness recurs. This has no model/API cost and is enabled by default.
+                    if (process.env.CODEBUDDY_CONVERSATION_EVAL !== 'false') {
+                        const configuredEvery = Number(process.env.CODEBUDDY_CONVERSATION_EVAL_EVERY ?? 30);
+                        const evaluationEvery = Number.isFinite(configuredEvery)
+                            ? Math.max(5, Math.floor(configuredEvery))
+                            : 30;
+                        const configuredStreak = Number(process.env.CODEBUDDY_CONVERSATION_EVAL_MIN_STREAK ?? 2);
+                        const minIssueStreak = Number.isFinite(configuredStreak)
+                            ? Math.max(2, Math.min(5, Math.floor(configuredStreak)))
+                            : 2;
+                        const configuredCooldown = Number(process.env.CODEBUDDY_CONVERSATION_EVAL_COOLDOWN_MS ?? 6 * 60 * 60_000);
+                        const guidanceCooldownMs = Number.isFinite(configuredCooldown)
+                            ? Math.max(60_000, configuredCooldown)
+                            : 6 * 60 * 60_000;
+                        heart.register({
+                            name: 'conversation-quality',
+                            everyBeats: evaluationEvery,
+                            handler: async () => {
+                                const { runConversationImprovementCycle } = await import('../companion/conversation-improvement-loop.js');
+                                await runConversationImprovementCycle({
+                                    mode: 'behavioral',
+                                    minIssueStreak,
+                                    guidanceCooldownMs,
+                                });
+                            },
+                        });
+                        logger.info(`Conversation quality: Enabled — aggregate evaluation every ${evaluationEvery} beats (adapt after ${minIssueStreak} recurring cycle(s))`);
+                    }
+                    // Fresh-context warmer — structured evidence, not canned LLM prose. It runs on wall
+                    // clock time so a changing sensory heartbeat cannot make news unexpectedly stale.
+                    if (process.env.CODEBUDDY_PREFETCH !== 'false') {
+                        const configuredInterval = Number(process.env.CODEBUDDY_PREFETCH_INTERVAL_MS ?? 15 * 60_000);
+                        const prefetchIntervalMs = Number.isFinite(configuredInterval)
+                            ? Math.max(60_000, configuredInterval)
+                            : 15 * 60_000;
+                        const runPrefetch = async () => {
+                            const { runPrefetchCycle } = await import('../companion/prefetch-engine.js');
+                            await runPrefetchCycle();
+                        };
+                        void runPrefetch(); // warm the cache immediately, don't wait for the first beat
+                        const prefetchTimer = setInterval(() => void runPrefetch(), prefetchIntervalMs);
+                        prefetchTimer.unref();
+                        sensoryTeardown.push(() => clearInterval(prefetchTimer));
+                        logger.info(`Fresh context: Enabled — structured refresh every ${Math.round(prefetchIntervalMs / 60_000)} minute(s)`);
+                    }
+                    // Jokes top-up (opt-in) — generate a few fresh jokes in the background so Lisa's humour
+                    // stays varied. The curated list already works instantly WITHOUT this.
+                    if (process.env.CODEBUDDY_JOKES_TOPUP === 'true') {
+                        const jokesEvery = Math.max(1, Number(process.env.CODEBUDDY_JOKES_TOPUP_EVERY ?? 200));
+                        heart.register({
+                            name: 'jokes-topup',
+                            everyBeats: jokesEvery,
+                            handler: async () => {
+                                const { refreshJokePool } = await import('../companion/jokes.js');
+                                await refreshJokePool();
+                            },
+                        });
+                        logger.info(`Jokes top-up: Enabled (CODEBUDDY_JOKES_TOPUP) — fresh jokes every ${jokesEvery} beats`);
+                    }
                     heart.start();
                     sensoryTeardown.push(() => heart.stop());
+                    // TS pacemaker (opt-in) — emits the same vital/heartbeat percept when
+                    // buddy-sense is absent. Auto-disables on a real beat; re-arms after
+                    // silence. Default OFF => no timer, byte-identical.
+                    if (process.env.CODEBUDDY_HEARTBEAT_FALLBACK === 'true') {
+                        const { startHeartbeatFallback } = await import('../sensory/heartbeat-fallback.js');
+                        const fallback = startHeartbeatFallback();
+                        sensoryTeardown.push(() => fallback.stop());
+                        logger.info('Heartbeat fallback: Enabled (CODEBUDDY_HEARTBEAT_FALLBACK) - TS pacemaker until buddy-sense beats');
+                    }
+                    {
+                        const { wireSensoryStatusSnapshot } = await import('../sensory/sensory-status.js');
+                        sensoryTeardown.push(wireSensoryStatusSnapshot({
+                            treatments: heart.list().map((t) => ({ name: t.name, everyBeats: t.everyBeats })),
+                        }));
+                    }
                     logger.info(`Sensory bridge: Enabled (buddy-sense → event bus; heartbeat treatments every ${everyBeats} beats)`);
                 }
                 catch (err) {
                     logger.warn(`Sensory bridge failed to start: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
+            // Persistent named cooking timers are user-requested alerts, not
+            // spontaneous companion speech. They reuse this server lifecycle and are
+            // enabled by default; set CODEBUDDY_COOKING_TIMERS=false to disable.
+            if (process.env.CODEBUDDY_COOKING_TIMERS !== 'false') {
+                try {
+                    const { wireCookingTimerRunner } = await import('../companion/cooking-timer-runner.js');
+                    sensoryTeardown.push(wireCookingTimerRunner());
+                    logger.info('Cooking timers: Enabled — persistent named alerts, explicit acknowledgement');
+                }
+                catch (err) {
+                    logger.warn(`Cooking timers failed to start: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            // Reminders (opt-in, independent of the sensory daemon so Telegram delivery works without a
+            // mic/camera): a tick loop announces due reminders (voice + Telegram) and escalates a missed
+            // dose to Telegram. Voice acknowledgement ("c'est fait") is wired in the speech block above.
+            if (process.env.CODEBUDDY_REMINDERS === 'true') {
+                try {
+                    const { wireReminderRunner } = await import('../companion/reminder-runner.js');
+                    sensoryTeardown.push(wireReminderRunner());
+                    logger.info('Reminders: Enabled (CODEBUDDY_REMINDERS) — due reminders announced (voice + Telegram); no-ack → re-nag then Telegram');
+                }
+                catch (err) {
+                    logger.warn(`Reminders failed to start: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            // Companion presence (opt-in): the conductor that occasionally says one small warm thing when
+            // the moment warrants (check-in / debrief / encouragement / break) and is otherwise silent.
+            // Hard-gated (quiet hours, presence-aware, hourly cap) — see presence-loop.ts.
+            if (process.env.CODEBUDDY_COMPANION_PRESENCE === 'true') {
+                try {
+                    const { wirePresenceLoop } = await import('../companion/presence-loop.js');
+                    sensoryTeardown.push(wirePresenceLoop());
+                    logger.info('Companion presence: Enabled (CODEBUDDY_COMPANION_PRESENCE) — gentle proactive presence, default-silent');
+                }
+                catch (err) {
+                    logger.warn(`Companion presence failed to start: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            // Companion proactive (opt-in): Lisa reaches out FIRST — morning/evening, after an absence, on
+            // a tenure milestone or a due follow-up — INDEPENDENT of the camera (Telegram voice note when
+            // away, spoken when present). Priority-scored, single winner, 12h cooldown. See proactive-engine.ts.
+            if (process.env.CODEBUDDY_COMPANION_PROACTIVE === 'true') {
+                try {
+                    const { wireProactiveLoop } = await import('../companion/proactive-engine.js');
+                    sensoryTeardown.push(wireProactiveLoop());
+                    logger.info('Companion proactive: Enabled (CODEBUDDY_COMPANION_PROACTIVE) — reaches out first, camera-independent (spoken/Telegram)');
+                }
+                catch (err) {
+                    logger.warn(`Companion proactive failed to start: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            // Companion idle (opt-in): when ALONE, it does useful safe work ($0, read-only/reversible) and
+            // leaves reviewable artifacts in the idle log — never acts on your repos/prod. See idle-loop.ts.
+            if (process.env.CODEBUDDY_COMPANION_IDLE === 'true') {
+                try {
+                    const { wireIdleLoop } = await import('../companion/idle-loop.js');
+                    sensoryTeardown.push(wireIdleLoop());
+                    logger.info('Companion idle: Enabled (CODEBUDDY_COMPANION_IDLE) — alone-only useful work, $0, artifacts only');
+                }
+                catch (err) {
+                    logger.warn(`Companion idle failed to start: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
             logger.info(`Auth: ${config.authEnabled ? 'Enabled' : 'Disabled'}`);
-            if (!isLoopbackHost(config.host)) {
+            const exposure = diagnoseServerExposure(config);
+            if (exposure.unsafe) {
+                logger.warn(exposure.message);
+            }
+            else if (exposure.networkExposed) {
                 logger.warn(`Server is bound to ${config.host} (non-loopback) and is reachable from the network. ` +
                     `Auth is ${config.authEnabled ? 'ENABLED' : 'DISABLED'}; CORS origins: ${[config.corsOrigins ?? []].flat().join(', ') || '(none)'}. ` +
                     `Bind to localhost with HOST=127.0.0.1 if remote access is not intended.`);
@@ -1141,7 +2024,7 @@ export async function startServer(userConfig = {}) {
             catch {
                 logger.info('Peer Routing: not initialized');
             }
-            resolve({ app, server, config });
+            resolve({ app, server, config, cognitionPort });
         });
         server.on('error', reject);
     });
@@ -1161,6 +2044,11 @@ export async function stopServer(server) {
         }
     }
     sensoryWired = false;
+    const cognitiveHub = server._cognitiveHub;
+    const cognitionPort = server
+        ._cognitionPort;
+    cognitionPort?.close();
+    cognitiveHub?.close();
     return new Promise((resolve, reject) => {
         // Phase (d).9 — cancel the heartbeat timer so it doesn't keep
         // emitting against a half-shut server. Idempotent.
@@ -1177,6 +2065,13 @@ export async function stopServer(server) {
         unwirePeerSessionBridge();
         // Phase (d).23 — un-register peer.tool.invoke + .stream.
         unwirePeerToolBridge();
+        unwirePeerCkgBridge();
+        unwirePeerMissionExchangeBridge();
+        unwireMobileConfirmationBridge();
+        const unwireCognition = server
+            ._unwireCognition;
+        unwireCognition?.();
+        server._fleetRooms?.stop();
         // Detach the channel-A2A bridge handler + shut down the
         // ChannelManager so polling loops (Telegram, Discord, ...) stop.
         const bridgeStop = server