@plurnk/plurnk 0.74.0 → 0.76.0

package/dist/dispatcher.js

@@ -3,19 +3,20 @@
 // §2 (CLI mode) and §3 (TUI mode).
 import { parseArgs } from "node:util";
 import { readFile } from "node:fs/promises";
-import { isAbsolute, join, resolve } from "node:path";
-import { homedir } from "node:os";
+import { isAbsolute, resolve } from "node:path";
 import { createRequire } from "node:module";
-import { parseAliasesFromEnv } from "@plurnk/plurnk-aliases";
 import { buildJsonError } from "./cli.js";
 import { loadFloor } from "./envdefaults.js";
 import { runCliViaBridge, runScriptViaBridge } from "./agui_cli.js";
 import { BridgeTransport } from "./transport.js";
 import { actionViaBridge, resolveWorld } from "./agui.js";
 import { runTui } from "./tui.js";
+import { handleMcp } from "./mcp.js";
+import { formatWorkerReasoning, readWorkerReasoning, setWorkerReasoning, } from "./reasoning.js";
 import { runModels, runWorkspaceList, runWorkspaceWorkers, runWorkspaceRename, runLogRead, runRead } from "./subcommands.js";
 import { ProblemError, report, clientConnectionRefused, isUnreachable, clientProblem, clientFlagInvalid, clientFlagMissingDependency, clientRuntimeError, clientSubcommandMissingArgument, clientSubcommandUnknownVerb, clientWorkerNotFound, } from "./diagnostics.js";
 import { formatBuildInfo, getBuildInfo } from "./build-info.js";
+import { userConfigFile } from "./paths.js";
 // Read all of stdin to EOF. Called when stdin is piped (not a TTY) — never
 // blocks an interactive workspace because we gate on isTTY upstream.
 const readStdin = async () => {
@@ -43,19 +44,6 @@ export const resolveLoopFlags = (rawJson, auto = false) => {
     }
     return { ...parsed, ...(auto ? { auto: true } : {}) };
 };
-// #90 — resolve a model alias to a concrete "<provider>/<model>" from the CLIENT's
-// (always-fresh) env, so a long-lived daemon launched before the user set
-// PLURNK_MODEL_<alias> doesn't reject loop.run with "unknown alias" (the daemon's
-// launch env is frozen; ours isn't). First-slash split is lossless — provider is
-// before the first "/", the model id is the rest (may itself contain "/"). baseUrl
-// stays daemon-side. null → send bare {alias} and let the daemon resolve or fail.
-// parseAliasesFromEnv is fail-hard on a duplicate/dangling env config — let it throw.
-export const resolveModelSpec = (alias, env = process.env) => {
-    if (alias === undefined)
-        return undefined;
-    const match = parseAliasesFromEnv(env).find((a) => a.alias === alias.toLowerCase());
-    return match !== undefined ? `${match.provider}/${match.model}` : undefined;
-};
 // #132 — the client's per-workspace exec-policy layer: forward the closed
 // enable/disable grammar (PLURNK_EXECS_ONLY, PLURNK_EXECS_<TAG>=0|false) so the
 // daemon intersects it with its own ceiling (service ∧ client — subtractive,
@@ -77,6 +65,23 @@ export const collectExecsPolicy = (env = process.env) => {
     }
     return out;
 };
+const MCP_CONFIGURATION_PREFIX = "PLURNK_MCP_";
+const MCP_SERVICE_CONTROLS = new Set([
+    "PLURNK_MCP_CONNECT_TIMEOUT",
+    "PLURNK_MCP_REQUEST_TIMEOUT",
+    "PLURNK_MCP_ENABLED",
+]);
+export const collectMcpConfiguration = (env = process.env) => {
+    const configuration = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value === undefined || !key.startsWith(MCP_CONFIGURATION_PREFIX))
+            continue;
+        if (MCP_SERVICE_CONTROLS.has(key.toUpperCase()))
+            continue;
+        configuration[key] = value;
+    }
+    return configuration;
+};
 // projectRoot resolution: empty string = explicit headless (null on wire);
 // otherwise must be an absolute path. Caller passes cwd as default.
 export const resolveProjectRoot = (raw) => {
@@ -88,15 +93,18 @@ export const resolveProjectRoot = (raw) => {
         throw new ProblemError(clientFlagInvalid("--project-root", raw, "must be an absolute path"));
     return raw;
 };
-const USAGE = `usage: plurnk [--json] [--workspace <name>] [--worker <name>] [--model <alias>] [prompt...]
+export const USAGE = `usage: plurnk [--json] [--workspace <name>] [--worker <name>] [--model <selector>] [--reasoning <policy>] [prompt...]
        <piped stdin> | plurnk [options] [prompt...]
-       plurnk models [--json]
+       plurnk models [search...] [--provider <name>] [--all] [--offset <n>] [--limit <n>] [--json]
        plurnk workspace list [--json]
        plurnk workspace workers <name> [--json]
        plurnk workspace rename <name> <newname> [--json]
        plurnk log read --workspace <name> [--worker <name>]
                        [--loop <id>] [--turn <id>] [--since <id>] [--limit <n>] [--json]
        plurnk read <loop>/<turn>/<seq> --workspace <name> [--worker <name>] [--json]
+       plurnk reasoning [policy] --workspace <name> [--worker <name>] [--json]
+       plurnk mcp [add <alias> <target> [options.json] | enable <alias> [options.json]
+                   | disable|remove <alias> | oauth <alias> <callback-url>]
 
 Connects to the plurnk-service daemon. Run a single prompt one-shot
 (positional args, piped stdin, or both — positionals come first, stdin
@@ -104,17 +112,12 @@ is appended after a blank line). With no positionals and a TTY stdin,
 enters the interactive REPL. Read-only subcommands (models / workspace list /
 log read / read <coord>) inspect daemon state without running a loop.
 
-env (cascade, highest first: shell < --env-file < ./.env < ~/.plurnk/.env
-     < ~/.plurnk/.env.defaults < the client's packaged .env.defaults floor):
+env (cascade, low → high: packaged .env.defaults < $XDG_CONFIG_HOME/plurnk/.env
+     < ./.env < repeated --env-file flags (last wins) < shell):
                         Works with no config at all.
   PLURNK_CLIENT_WORKSPACE        resume/create a workspace by name. UNSET = the daemon
                         mints a fresh, uniquely-named workspace per invocation.
   PLURNK_CLIENT_WORKER            resume (or create) a named worker within that workspace
-  PLURNK_MODEL          model alias to use for every loop.run on this invocation.
-                        Shared with the daemon (user-level preference). --model
-                        overrides for this invocation only.
-  PLURNK_MODEL_CHILD    optional WORK/FORK/BARE provider alias. Unset = inherit the
-                        spawning loop's provider; interactive /child overrides.
   PLURNK_CLIENT_PROJECT_ROOT   absolute path passed to workspace.create as the workspace's
                         project_root (workspace for file ops). Default: cwd.
                         Empty string = headless (no project_root, file ops 400).
@@ -122,9 +125,9 @@ env (cascade, highest first: shell < --env-file < ./.env < ~/.plurnk/.env
   PLURNK_AUTO                  when truthy, keep proposal authority inside the loop.
                         Client-side only — proposals still go through the wire.
   PLURNK_CLIENT_JSON           when truthy, same as --json for one-shot runs.
-  PLURNK_QUESTIONS      when truthy, let the model ask you via a SEND carrying
-                        signal 300 (shared intent — the daemon reads it too).
-                        --questions overrides.
+  PLURNK_REQUEST_USER_INPUT  when truthy, the conversation worker may ask you
+                        through the question tool. TUI/nvim default on; the
+                        one-shot CLI defaults off. --request_user_input overrides.
   PLURNK_AGUI_URL       plurnk-agui bridge URL (e.g. http://127.0.0.1:8787). When
                         set, a one-shot (text AND --json) runs THROUGH the bridge
                         instead of raw daemon WS (the exclusive-portal path).
@@ -136,7 +139,10 @@ env (cascade, highest first: shell < --env-file < ./.env < ~/.plurnk/.env
                         never forwarded. Subtractive only — the
                         daemon intersects with its ceiling; the client can narrow,
                         never re-enable. Shares the daemon's grammar; a workspace's
-                        .env carries its own. (MCP server configs are NOT sent.)
+                        .env carries its own.
+  PLURNK_MCP_*          raw server declarations accompany MCP list and enable.
+                        Service controls do not. The daemon owns parsing,
+                        activation, persistence, and credential expansion.
 
 options:
   -h, --help              print this message and exit
@@ -151,10 +157,14 @@ options:
                           auto-named workspace is created. Overrides PLURNK_CLIENT_WORKSPACE.
       --worker <name>        resume (or create) the named worker within the workspace.
                           Requires --workspace. Overrides PLURNK_CLIENT_WORKER.
-      --model <alias>     model alias to pass on every loop.run. Resolved
-                          server-side against PLURNK_MODEL_<alias>. Without
-                          this (and PLURNK_MODEL unset), the daemon uses its
-                          own boot-time PLURNK_MODEL.
+      --model <selector>  persistently select the conversation worker's model
+                          before the first loop (worker.model.set). A selector is
+                          a declared alias or exact provider/model route. Without
+                          this, the worker's durable model or the daemon's
+                          boot-time default runs.
+      --reasoning <policy> persistently select the conversation worker's reasoning
+                          policy before the first loop. The daemon validates the
+                          policy against the selected parent and child models.
       --project-root <p>  absolute path. Sent on workspace.create only; ignored
                           on --workspace attach (daemon preserves stored value).
                           Default: cwd. Empty string = headless. Overrides
@@ -166,10 +176,11 @@ options:
       --flags <json>      raw LoopFlags JSON passthrough on every loop.run
                           (e.g. '{"auto":true}' for unattended
                           benchmark/automation runs).
-      --questions         let the model ask you with SEND signal 300 when it needs a
-                          decision — multiple choice with a free-response escape,
-                          or an open question. Off by default. Overrides
-                          PLURNK_QUESTIONS. (Requires a daemon that emits that signal.)
+      --request_user_input  let the model ask you through the question tool when it
+                          needs a decision (multiple choice with a free-response
+                          escape, or an open question). Off by default for the
+                          one-shot CLI; on by default for the TUI. Overrides
+                          PLURNK_REQUEST_USER_INPUT.
       --env-file <p>      load env from <p> (errors if missing). Repeatable.
       --env-file-if-exists <p>  same, but silently skip a missing file. Repeatable.
       --max-turns <n>     per-loop turn cap (daemon default PLURNK_MAX_TURNS).
@@ -192,14 +203,19 @@ options:
       --turn <id>         (log read) filter to a single turn id
       --since <id>        (log read) return entries with id > <id>
       --limit <n>         (log read) max entries to return (default 100)
+      --provider <name>   (models) restrict the catalog to one provider
+      --all               (models) include unconfigured models with readiness causes
+      --offset <n>        (models) catalog page offset (default 0)
 
 subcommands:
-  models                  list configured model aliases (providers.list)
+  models [search...]      list the bounded daemon model catalog (models.list)
   workspace list            list workspaces on the daemon (workspace.list)
   workspace workers <name>  list workers in the named workspace (workspace.workers)
   workspace rename <a> <b>  rename workspace <a> to <b> (workspace.rename — a workspace's
                           name is a mutable handle; workers are immutable)
   log read --workspace ...  read log entries from the named workspace's worker
+  reasoning [policy]      inspect or set a worker's durable reasoning policy
+  mcp ...                 list and manage MCP servers for --workspace
   script <file.plk>       run a .plk file: feed its DSL to op.parse, render the
                           trace, exit by worst op status. Honors --workspace/--yolo
                           /--project-root + membership flags. The daemon owns the
@@ -215,32 +231,45 @@ const dieJson = (code, problem) => {
     process.stdout.write(`${JSON.stringify(buildJsonError(problem))}\n`);
     process.exit(code);
 };
-// Env cascade, aligned with plurnk-service's ~/.plurnk layering so the two share
-// one config home. process.loadEnvFile only fills UNSET vars, so loading
-// highest-precedence-first yields:
-//   shell > --env-file > --env-file-if-exists > ./.env > ~/.plurnk/.env
-//   > ~/.plurnk/.env.defaults (the daemon family's rendered catalog)
-//   > the client's OWN packaged .env.defaults (#141 — the self-serve floor:
-//     the client is the one member the daemon cannot assemble).
-const loadEnvCascade = (envFiles, envFilesIfExists) => {
+export const orderedEnvFiles = (args) => {
+    const files = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--")
+            break;
+        for (const [flag, required] of [["--env-file", true], ["--env-file-if-exists", false]]) {
+            if (arg === flag) {
+                const path = args[index + 1];
+                if (path !== undefined)
+                    files.push({ path, required });
+                index += 1;
+                break;
+            }
+            if (arg.startsWith(`${flag}=`))
+                files.push({ path: arg.slice(flag.length + 1), required });
+        }
+    }
+    return files;
+};
+export const loadEnvCascade = (explicitFiles, userConfig = userConfigFile()) => {
     const ifExists = (p) => { try {
         process.loadEnvFile(p);
     }
     catch { /* optional layer */ } };
-    for (const f of envFiles) {
+    for (const { path, required } of explicitFiles.toReversed()) {
+        if (!required) {
+            ifExists(path);
+            continue;
+        }
         try {
-            process.loadEnvFile(f);
+            process.loadEnvFile(path);
         }
         catch {
-            dieWith(64, clientFlagInvalid("--env-file", f, "file not found"));
+            dieWith(64, clientFlagInvalid("--env-file", path, "file not found"));
         }
     }
-    for (const f of envFilesIfExists)
-        ifExists(f);
     ifExists(".env");
-    const home = join(homedir(), ".plurnk");
-    ifExists(join(home, ".env"));
-    ifExists(join(home, ".env.defaults"));
+    ifExists(userConfig);
     loadFloor();
 };
 // Map repeatable membership flags to workspace constraints.
@@ -254,11 +283,6 @@ export const buildSettings = async (values, cwd, env = process.env) => {
     const execs = collectExecsPolicy(env);
     if (Object.keys(execs).length > 0)
         settings.execs = execs;
-    // svc#346 — enable model→user SEND signal 300 questions (per-workspace; the daemon
-    // injects questions.md teaching + intersects its PLURNK_QUESTIONS ceiling).
-    // Flag or bare env (shared user intent). The daemon owns refusal when off.
-    if (values.questions === true || ["1", "true", "yes", "on"].includes((env.PLURNK_QUESTIONS ?? "").toLowerCase()))
-        settings.questions = true;
     const mc = values["max-commands"];
     if (mc !== undefined) {
         const n = Number(mc);
@@ -277,25 +301,6 @@ export const buildSettings = async (values, cwd, env = process.env) => {
         }
         settings.filesItems = n;
     }
-    const mdSpecs = values.md ?? [];
-    if (mdSpecs.length > 0) {
-        const mdDocs = [];
-        for (const spec of mdSpecs) {
-            const eq = spec.indexOf("=");
-            if (eq <= 0)
-                throw new ProblemError(clientFlagInvalid("--md", spec, "must be NAME=path"));
-            const alias = spec.slice(0, eq);
-            const raw = spec.slice(eq + 1);
-            const abs = isAbsolute(raw) ? raw : resolve(cwd, raw);
-            try {
-                mdDocs.push({ alias, content: await readFile(abs, "utf8") });
-            }
-            catch (cause) {
-                throw new ProblemError(clientFlagInvalid("--md", spec, `file not readable: ${cause instanceof Error ? cause.message : String(cause)}`));
-            }
-        }
-        settings.mdDocs = mdDocs;
-    }
     return settings;
 };
 // svc#235: discover.versions { service:{installed, latest?}, client:{latest?} }.
@@ -359,10 +364,22 @@ const runSubcommand = async (rpc, positionals, opts) => {
     const verb = positionals[0];
     const sub = positionals[1];
     if (verb === "models") {
-        if (positionals.length > 1) {
-            throw new ProblemError(clientSubcommandUnknownVerb(`models ${positionals.slice(1).join(" ")}`));
+        const offset = parseIntFlag(opts.values.offset, "--offset");
+        const limit = parseIntFlag(opts.values.limit, "--limit");
+        if (limit !== undefined && (limit < 1 || limit > 100)) {
+            throw new ProblemError(clientFlagInvalid("--limit", String(limit), "must be between 1 and 100 for models"));
         }
-        return await runModels(rpc, { json: opts.json });
+        const search = positionals.slice(1).join(" ").trim();
+        return await runModels(rpc, {
+            json: opts.json,
+            query: {
+                ...(typeof opts.values.provider === "string" ? { provider: opts.values.provider } : {}),
+                ...(search.length > 0 ? { search } : {}),
+                ...(opts.values.all === true ? { availability: "all" } : {}),
+                ...(offset !== undefined ? { offset } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+            },
+        });
     }
     if (verb === "workspace") {
         if (sub === "list") {
@@ -394,6 +411,32 @@ const runSubcommand = async (rpc, positionals, opts) => {
         }
         throw new ProblemError(clientSubcommandUnknownVerb(`workspace ${sub ?? "(missing)"}`, ["list", "workers", "rename"]));
     }
+    if (verb === "mcp") {
+        if (opts.workspaceName === undefined) {
+            throw new ProblemError(clientFlagMissingDependency("plurnk mcp", "--workspace (or PLURNK_CLIENT_WORKSPACE)"));
+        }
+        const result = await handleMcp(positionals.slice(1), rpc, opts.json ? () => undefined : (text) => process.stdout.write(text), { overlay: opts.mcpConfiguration });
+        if (result === null)
+            return 64;
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify(result)}\n`);
+        return 0;
+    }
+    if (verb === "reasoning") {
+        if (opts.workspaceName === undefined) {
+            throw new ProblemError(clientFlagMissingDependency("plurnk reasoning", "--workspace (or PLURNK_CLIENT_WORKSPACE)"));
+        }
+        if (positionals.length > 2) {
+            throw new ProblemError(clientSubcommandUnknownVerb(`reasoning ${positionals.slice(1).join(" ")}`));
+        }
+        const reasoning = sub === undefined
+            ? await readWorkerReasoning(rpc)
+            : await setWorkerReasoning(rpc, sub);
+        process.stdout.write(opts.json
+            ? `${JSON.stringify(reasoning)}\n`
+            : formatWorkerReasoning(reasoning));
+        return 0;
+    }
     if (verb === "log") {
         if (sub !== "read") {
             throw new ProblemError(clientSubcommandUnknownVerb(`log ${sub ?? "(missing)"}`, ["read"]));
@@ -403,7 +446,8 @@ const runSubcommand = async (rpc, positionals, opts) => {
         }
         // The caller's threadId (--workspace) scopes the action to that workspace; the
         // module defaults reads to the conversation (model worker); --worker pins by name.
-        const filters = { ...(await resolveWorkerId(rpc, opts.workerName) !== undefined ? { workerId: await resolveWorkerId(rpc, opts.workerName) } : {}) };
+        const workerId = await resolveWorkerId(rpc, opts.workerName);
+        const filters = { ...(workerId === undefined ? {} : { workerId }) };
         const loopId = parseIntFlag(opts.values.loop, "--loop");
         const turnId = parseIntFlag(opts.values.turn, "--turn");
         const sinceId = parseIntFlag(opts.values.since, "--since");
@@ -450,11 +494,12 @@ export const main = async (argv) => {
             workspace: { type: "string" },
             worker: { type: "string" },
             model: { type: "string" },
+            reasoning: { type: "string" },
             "project-root": { type: "string" },
             yolo: { type: "boolean" },
             auto: { type: "boolean" },
             flags: { type: "string" },
-            questions: { type: "boolean" }, // --questions: allow the model to ask via SEND signal 300
+            "request-user-input": { type: "boolean" }, // --request_user_input: the worker may ask through the question tool
             "max-turns": { type: "string" },
             timeout: { type: "string" },
             // membership overlay — repeatable globs; service vocabulary
@@ -463,7 +508,6 @@ export const main = async (argv) => {
             view: { type: "string", multiple: true },
             // workspace-open settings (svc#231) + tighten-only ceilings (svc#232)
             "files-items": { type: "string" },
-            md: { type: "string", multiple: true },
             "max-commands": { type: "string" },
             "no-git": { type: "boolean" },
             // log read filters
@@ -471,6 +515,9 @@ export const main = async (argv) => {
             turn: { type: "string" },
             since: { type: "string" },
             limit: { type: "string" },
+            provider: { type: "string" },
+            all: { type: "boolean" },
+            offset: { type: "string" },
         },
     });
     if (values.help) {
@@ -482,17 +529,17 @@ export const main = async (argv) => {
         process.stdout.write(`${formatBuildInfo(buildInfo)}\n`);
         process.exit(0);
     }
-    // Shared ~/.plurnk env cascade (after parse so --env-file flags participate).
-    loadEnvCascade(values["env-file"] ?? [], values["env-file-if-exists"] ?? []);
+    // Shared XDG user env cascade (after parse so --env-file flags participate).
+    loadEnvCascade(orderedEnvFiles(argv.slice(2)));
+    const mcpConfiguration = collectMcpConfiguration(process.env);
     // json OUTPUT MODE — flag or env (user-level, same name client+daemon would
     // read). One complete document on stdout, stderr silent, structured errors.
     const json = values.json === true || ["1", "true", "yes", "on"].includes((process.env.PLURNK_CLIENT_JSON ?? "").toLowerCase());
     if (!json)
         process.stderr.write(`plurnk: ${formatBuildInfo(buildInfo)}\n`);
-    // Subcommand routing happens BEFORE prompt assembly: if positionals[0] is
-    // a known read-only subcommand (models / workspace / log), we skip stdin
-    // reading and prompt construction entirely.
-    const SUBCOMMANDS = ["models", "workspace", "log", "read", "script"];
+    // State-command routing happens BEFORE prompt assembly, so inspection and
+    // deliberate configuration never consume stdin or become model prompts.
+    const SUBCOMMANDS = ["models", "workspace", "log", "read", "script", "mcp", "reasoning"];
     const subcommand = positionals[0];
     const isSubcommand = subcommand !== undefined && SUBCOMMANDS.includes(subcommand);
     // Assemble the prompt only if we're NOT running a subcommand.
@@ -510,11 +557,16 @@ export const main = async (argv) => {
             // PLURNK_CLIENT_JSON with no prompt is the interactive TUI — env shouldn't force CLI mode.
         }
     }
-    // CLI flag overrides env; env overrides nothing.
+    // Client flags select client behavior. Provider defaults remain daemon-owned.
     const workspaceName = values.workspace ?? process.env.PLURNK_CLIENT_WORKSPACE;
     const workerName = values.worker ?? process.env.PLURNK_CLIENT_WORKER;
-    const modelAlias = values.model ?? process.env.PLURNK_MODEL;
-    const childAlias = process.env.PLURNK_MODEL_CHILD;
+    const modelSelector = values.model;
+    const reasoningPolicy = values.reasoning;
+    // {§worker-settings} — the worker's request-user-input rule: TUI/nvim default on,
+    // the one-shot CLI defaults off; the explicit flag always wins, then the env.
+    const requestUserInputEnv = ["1", "true", "yes", "on"].includes((process.env.PLURNK_REQUEST_USER_INPUT ?? "").toLowerCase());
+    const requestUserInputCli = values["request-user-input"] === true || (values["request-user-input"] === undefined && requestUserInputEnv);
+    const requestUserInputTui = values["request-user-input"] ?? (requestUserInputEnv || true);
     const yolo = values.yolo === true || ["1", "true", "yes", "on"].includes((process.env.PLURNK_CLIENT_YOLO ?? "").toLowerCase());
     if (workerName !== undefined && workspaceName === undefined) {
         dieWith(64, clientFlagMissingDependency("--worker (or PLURNK_CLIENT_WORKER)", "--workspace (or PLURNK_CLIENT_WORKSPACE)"));
@@ -535,9 +587,10 @@ export const main = async (argv) => {
             dieWith(cause.exitCode, cause.problem);
         dieWith(64, clientRuntimeError(cause));
     }
-    // --questions / PLURNK_QUESTIONS is a SESSION setting (settings.questions in
-    // buildSettings), NOT a loop flag — svc#346 ruled it workspace-scoped (it also
-    // gates the questions.md teaching, so capability + teaching arrive together).
+    // --request_user_input / PLURNK_REQUEST_USER_INPUT is the worker's own
+    // behavioral rule ({§worker-settings}): it rides the run's forwardedProps, the
+    // AG-UI thread binding persists it on the conversation worker, and it stays
+    // flippable between loops via worker.settings.set.
     const projectRootRaw = values["project-root"] ?? process.env.PLURNK_CLIENT_PROJECT_ROOT;
     const projectRoot = (() => {
         try {
@@ -592,7 +645,16 @@ export const main = async (argv) => {
             // thread == world (the model worker).
             const w = await world();
             const { constraints, settings } = await workspaceOptions();
-            const code = await runCliViaBridge({ bridgeUrl, token: process.env.PLURNK_AGUI_TOKEN }, prompt, { threadId: workerName ?? w, workspace: w, ...(modelAlias !== undefined ? { alias: modelAlias } : {}), ...(resolveModelSpec(modelAlias) !== undefined ? { model: resolveModelSpec(modelAlias) } : {}), ...(childAlias !== undefined ? { childAlias } : {}), ...(resolveModelSpec(childAlias) !== undefined ? { childModel: resolveModelSpec(childAlias) } : {}), ...(loopFlags !== undefined ? { flags: loopFlags } : {}), ...(maxTurns !== undefined ? { maxTurns } : {}), ...(timeoutSec !== undefined ? { timeoutSec } : {}), yolo, json, projectRoot, constraints, settings });
+            // {§worker-model-selection} — an explicit --model is a durable selection:
+            // persist it onto the conversation worker before the run, then run WITHOUT
+            // a per-loop model selector (the worker owns the model).
+            if (values.model !== undefined && modelSelector !== undefined) {
+                await actionViaBridge({ bridgeUrl, token: process.env.PLURNK_AGUI_TOKEN }, { threadId: workerName ?? w, workspace: w, kind: "worker.model.set", params: { selector: modelSelector } });
+            }
+            if (reasoningPolicy !== undefined) {
+                await actionViaBridge({ bridgeUrl, token: process.env.PLURNK_AGUI_TOKEN }, { threadId: workerName ?? w, workspace: w, kind: "worker.reasoning.set", params: { policy: reasoningPolicy } });
+            }
+            const code = await runCliViaBridge({ bridgeUrl, token: process.env.PLURNK_AGUI_TOKEN }, prompt, { threadId: workerName ?? w, workspace: w, requestUserInput: requestUserInputCli, ...(loopFlags !== undefined ? { flags: loopFlags } : {}), ...(maxTurns !== undefined ? { maxTurns } : {}), ...(timeoutSec !== undefined ? { timeoutSec } : {}), yolo, json, projectRoot, constraints, settings });
             // Let Node drain stdout before termination. A forced exit truncated large
             // --json records mid-string when notices made the pipe exceed its buffer.
             process.exitCode = code;
@@ -624,7 +686,7 @@ export const main = async (argv) => {
     // TUI through the bridge (no prompt): skip the WS connect + workspace.create — a
     // pure-bridge client has no direct daemon WS. The bridge owns the workspace; we
     // pass a threadId-named stub (the daemon workspace id is bridge-created). projectRoot
-    // rides forwardedProps; PLURNK_AGUI_QUESTIONS gates questions bridge-side.
+    // rides forwardedProps.
     // (Per-workspace constraints/settings over the bridge are a follow-up.)
     if (bridgeUrl !== undefined && bridgeUrl.length > 0 && !isSubcommand && subcommand !== "script" && prompt.length === 0) {
         const w = await world();
@@ -641,15 +703,45 @@ export const main = async (argv) => {
             constraints,
             settings,
         });
-        await runTui(transport, { id: 0, name: w }, { modelAlias, model: resolveModelSpec(modelAlias), childAlias, childModel: resolveModelSpec(childAlias), resolveModel: (a) => resolveModelSpec(a), yolo, loopFlags, maxTurns, projectRoot, workerName, client: CLIENT_ID_TUI });
-        process.exitCode = 0;
-        return;
+        try {
+            await runTui(transport, { id: 0, name: w }, {
+                modelSelector,
+                modelExplicit: values.model !== undefined,
+                reasoningPolicy,
+                reasoningExplicit: reasoningPolicy !== undefined,
+                requestUserInput: requestUserInputTui,
+                yolo,
+                loopFlags,
+                maxTurns,
+                projectRoot,
+                workerName,
+                client: CLIENT_ID_TUI,
+                mcpConfiguration,
+            });
+            process.exitCode = 0;
+            return;
+        }
+        catch (cause) {
+            transport.shutdown();
+            if (cause instanceof ProblemError)
+                dieWith(cause.exitCode, cause.problem);
+            if (isUnreachable(cause))
+                dieWith(1, clientConnectionRefused(bridgeUrl, cause));
+            dieWith(1, clientRuntimeError(cause));
+        }
     }
     // AG-UI+ is the ONLY wire (the WS transport is deleted). Subcommands + script
     // speak the action surface through a structural Caller.
     const target = { bridgeUrl, token: process.env.PLURNK_AGUI_TOKEN };
-    const callerThread = workspaceName ?? "cli";
-    const caller = { call: (method, params) => actionViaBridge(target, { threadId: callerThread, kind: method, params }) };
+    const callerThread = workerName ?? workspaceName ?? "cli";
+    const caller = {
+        call: (method, params) => actionViaBridge(target, {
+            threadId: callerThread,
+            ...(workspaceName !== undefined ? { workspace: workspaceName } : {}),
+            kind: method,
+            params,
+        }),
+    };
     try {
         // `plurnk script foo.plk` — feed a .plk file to op.parse over the action
         // surface. The client never parses the file; the module owns the grammar.
@@ -668,7 +760,7 @@ export const main = async (argv) => {
         }
         if (isSubcommand) {
             const exitCode = await runSubcommand(caller, positionals, {
-                json, workspaceName, workerName, projectRoot, values,
+                json, workspaceName, workerName, projectRoot, values, mcpConfiguration,
             });
             process.exitCode = exitCode;
             return;