@prohost/cli 0.14.0 → 0.16.0

package/dist/agent/prompt.js

@@ -175,6 +175,11 @@ export function buildPrompt(run, context) {
                         : `You have been given work on a ${run.reply_surface}. There is nowhere to post a reply.`,
         '',
     ];
+    if (context.resumeNote)
+        lines.push(context.resumeNote, '');
+    if (context.askConfidence) {
+        lines.push('End your reply with one last line, exactly: [[confidence=<0 to 1> reply_class=<class>]] — how sure you are', 'the reply is right and safe to send as is, and its class: general, pricing_action, billing_action,', 'legal_contractual or bug_in_our_code. That line is removed before sending; below the bar, or for a class', 'that needs approval, your reply is saved as a draft for the team instead of sent.', '');
+    }
     // The operator's own configuration comes first, above everything the server
     // generated. It is who this agent *is* — persona, house rules, escalation
     // policy — and an agent that meets its standing instructions only after four

package/dist/agent/run.d.ts

@@ -30,9 +30,12 @@ import type { spawn } from 'node:child_process';
 import WebSocket from 'ws';
 import { HarnessAccount } from './account_runtime.js';
 import type { CommandRunner } from './accounts.js';
+import type { ApiOptions, ApiResult } from './api.js';
+import type { AgentRunRequest } from './contract.js';
 import type { AgentCredentials } from './credentials.js';
 import type { RunCapabilities } from './capabilities.js';
 import type { QuotaProvider } from './runtime_status.js';
+import { SessionStore } from './sessionstore.js';
 import type { CodeHostLike } from '../codehost/host.js';
 import type { AccountEnvResult, CodeAgent } from '../codehost/terminals.js';
 /**
@@ -196,6 +199,39 @@ export interface AgentRunOptions {
      * `null` never hosts. Tests inject a fake.
      */
     codeHost?: CodeHostLike | null;
+    /**
+     * `prohost host` only. Where this run's strict Claude MCP config is written,
+     * instead of `$PROHOST_HOME/mcp.json`: the key in it is the run's own token.
+     */
+    mcpConfigFile?: string;
+    /** `prohost host` only: said near the top of the prompt (see `PromptContext.resumeNote`). */
+    resumeNote?: string;
+    /**
+     * `prohost host` only: a turn stopped by the login's usage limit is handed
+     * back to the caller (`usage_limited`) instead of being completed, so the
+     * run can resume on another login of the same kind.
+     */
+    deferUsageLimit?: boolean;
+    /**
+     * `prohost host` only: variables for this run's command alone (a dedicated
+     * install's Claude token), read at each run so a rotation applies. A Claude
+     * Code harness also gives them to its sign-in and usage probes.
+     */
+    extraEnv?: NodeJS.ProcessEnv | (() => NodeJS.ProcessEnv);
+    /** `prohost host` only: skip the per-harness start-up lines (the host says them once). */
+    quietStartup?: boolean;
+    /**
+     * `prohost host` only: the server's send rule applies to this run's replies.
+     * The agent is asked to end a reply with {@link confidenceTrailer}; it is
+     * stripped, and `confidence` / `reply_class` go with the send.
+     */
+    replyConfidence?: boolean;
+    /**
+     * `prohost host` only: the employee's one session ledger, shared by its
+     * runs. Each run loading its own would let two overlapping conversations
+     * overwrite each other's entry when they persist.
+     */
+    sessions?: SessionStore;
 }
 export interface AgentRunMetrics {
     connections: number;
@@ -218,6 +254,53 @@ export interface AgentRunMetrics {
      */
     fatal?: string;
 }
+/**
+ * What one run amounted to.
+ *
+ * * ``succeeded`` / ``failed`` — the server accepted a terminal state. Settled.
+ * * ``cancelled`` — somebody pressed stop; the run was reported ``failed`` with
+ *   the marker error the server words as a cancellation. Settled.
+ * * ``resolved`` — the server had already closed the run out (it was reaped, or
+ *   finished elsewhere). Nothing was posted and nothing was reported, because
+ *   there is no longer anything to report to. Settled all the same.
+ * * ``unreported`` — the work is done but the completion never landed. The run
+ *   stays open in the ledger so a redelivery can report it without re-running
+ *   the agent.
+ * * ``skipped`` — a dry run. No writes were made, so it is neither a success
+ *   nor a failure and must not be counted as either.
+ */
+type RunOutcome = 'succeeded' | 'failed' | 'cancelled' | 'resolved' | 'unreported' | 'skipped';
+/**
+ * A send the server answered without sending, deliberately: `held_as_suggestion`
+ * (saved as a draft for the team — the send rule) or `ai_muted` (the thread is
+ * muted; nothing saved, nothing to retry). Either way the run is done.
+ */
+export declare function isHeldAsSuggestion(result: ApiResult): boolean;
+/**
+ * A reply without its confidence trailer (`[[confidence=0.9 reply_class=general]]`,
+ * see `replyConfidence`), and what the last one said. Every trailer is removed,
+ * wherever the model put it and however it dressed it, even one that can't be
+ * read: none may reach a guest. A line left with nothing else on it goes too.
+ */
+export declare function splitConfidence(reply: string): {
+    text: string;
+    confidence?: number;
+    replyClass?: string;
+};
+/**
+ * Why a run stopped early, when it stopped because something outside said so —
+ * or, for `expired`, because a venue run's grant is about to end.
+ */
+type Disposition = 'cancelled' | 'resolved' | 'expired';
+/** What a run in flight can see, and say, about being stopped. */
+interface RunControl {
+    /** Fires when the run must stop — cancelled, or closed server-side. */
+    signal: AbortSignal;
+    /** Why it was stopped, once it was. */
+    disposition(): Disposition | undefined;
+    /** Publish what the agent is doing, for the next heartbeat to carry. */
+    report(activity: string): void;
+}
 interface PreparedMcp {
     /** Claude Code: path of the strict generated MCP config. */
     mcpConfigPath?: string;
@@ -258,4 +341,30 @@ export declare function codexMcpEntryProvider(options: AgentRunOptions, log: (li
  */
 export declare function codeThreadAccountEnv(account: HarnessAccount | undefined, agent: CodeAgent): AccountEnvResult;
 export declare function runAgentHarness(options: AgentRunOptions): Promise<AgentRunMetrics>;
-export {};
+/** What one run executed for `prohost host` came to. */
+export interface HostedRunResult {
+    /**
+     * As `agent run` settles a run, plus `usage_limited`: the login's usage limit
+     * stopped the turn and nothing was reported (see `deferUsageLimit`).
+     */
+    outcome: RunOutcome | 'usage_limited';
+    /** When the limit lifts (ISO), for a `usage_limited` turn whose brain said. */
+    retryAfter?: string;
+    /** The model the run used, as far as the harness learnt. */
+    model?: string;
+}
+/**
+ * Execute one run that `prohost host` has already claimed, the way
+ * `agent run` executes one it accepted: the same prompt, Claude Code / Codex
+ * shaping, session continuity, tool events, reply and completion.
+ *
+ * `options.credentials.api_key` is the run's own token, and `options.env`
+ * points `PROHOST_HOME` at the employee's home (its sessions and workspace).
+ * Heartbeats, cancellation and the queue belong to the caller, which hands
+ * the outcome of each to `control`.
+ */
+export declare function executeHostedRun(run: AgentRunRequest, options: AgentRunOptions, control: RunControl, isolation: {
+    lane: string;
+    parallel: boolean;
+}, api: ApiOptions): Promise<HostedRunResult>;
+export type { RunControl as HostedRunControl, RunOutcome as HostedRunOutcome };

package/dist/agent/run.js

@@ -33,6 +33,7 @@ import { spawnSync } from 'node:child_process';
 import WebSocket from 'ws';
 import { HarnessAccount } from './account_runtime.js';
 import { EVENT_AGENT_CONFIG_UPDATED, accountEnv, machineId } from './accounts.js';
+import { defaultCommandRunner } from './accounts.js';
 import { completeRun, describeFailure, isIdempotencyInFlight, postReply } from './api.js';
 import { MAX_SALVAGE_CHARS, claudeCommand, isClaudeExec, looksLikeResumeFailure, readClaudeStream, writeMcpConfig, } from './claude.js';
 import { APPS_FEATURE, MCP_API_KEY_ENV_VAR, PLUGINS_DISABLED_OVERRIDE, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, extraMcpEntries, isCodexExec, isolateConfiguredServers, listMcpServers, mcpServersOverride, prohostMcpEntry, codexFailureMessage, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
@@ -52,7 +53,7 @@ import { SessionStore, sessionKeyFor } from './sessionstore.js';
 import { verifySignature } from './signature.js';
 import { VENUE_RUN_TOKEN_CAPABILITY, apiForRun, claudeSupportsVenueSessions, claudeVenueCommand, VENUE_PROGRESS, VENUE_SESSION_FEATURE, VENUE_SESSION_FRAME, VENUE_SESSION_OPEN_FRAME, VENUE_GRANT_CHECK_MS, VENUE_EXPIRY_MARGIN_MS, VENUE_GRANT_ENDED_ERROR, VENUE_GRANT_EXPIRED_ERROR, isVenueRun, venueEnv, venueGrantLive, venueGrantRemainingMs, venueRunFromSession, venueWorkdir, } from './venue.js';
 import { RUN_REPOS_ENV_VAR, WorktreeManager } from './worktrees.js';
-import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, RefusedDeliveryError, REMOTE_TERMINAL_CAPABILITY, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, } from '../codehost/host.js';
+import { CODE_THREAD_FOLDERS_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY, CODE_THREADS_CAPABILITY, CodeHost, RefusedDeliveryError, REMOTE_TERMINAL_CAPABILITY, EVENT_CODE_THREAD_APPROVAL_DECIDED, EVENT_CODE_THREAD_INPUT_REQUESTED, EVENT_CODE_THREAD_START_REQUESTED, } from '../codehost/host.js';
 import { loadSettings as loadCodeHostSettings } from '../codehost/settings.js';
 import { isWebhookEvent } from '../forward.js';
 import { DEFAULT_WS_URL } from '../listen.js';
@@ -208,6 +209,17 @@ const REPLAY_IN_FLIGHT_DELAY_MS = 5_000;
  *   answer, and the run is reported failed exactly once.
  */
 async function postReplyWithReplay(api, send, label, log, sleep) {
+    const result = await postReplyOnce(api, send, label, log, sleep);
+    // The send rule kept it as a suggestion for the team: handled, not failed.
+    if (isHeldAsSuggestion(result)) {
+        log(/ai_muted/.test(result.error ?? '')
+            ? `${timestamp()} ◦ ${label} reply was not sent: the thread is muted for AI`
+            : `${timestamp()} ◦ ${label} reply was held as a suggestion for the team (the employee's send rule)`);
+        return { ...result, ok: true };
+    }
+    return result;
+}
+async function postReplyOnce(api, send, label, log, sleep) {
     let posted = await send();
     // A real answer — success or a decision — is final. Only "no answer at all"
     // earns a replay.
@@ -258,6 +270,77 @@ function resolveWorkdir(options, log) {
         return undefined;
     }
 }
+/**
+ * A send the server answered without sending, deliberately: `held_as_suggestion`
+ * (saved as a draft for the team — the send rule) or `ai_muted` (the thread is
+ * muted; nothing saved, nothing to retry). Either way the run is done.
+ */
+export function isHeldAsSuggestion(result) {
+    return result.status === 409 && /held_as_suggestion|ai_muted/.test(result.error ?? '');
+}
+/** The run's extra variables, resolved now. */
+function extraEnvOf(options) {
+    return typeof options.extraEnv === 'function' ? options.extraEnv() : (options.extraEnv ?? {});
+}
+/** A line that is the confidence trailer, however the model dressed it (backticks, bold, commas, quotes). */
+/** A trailer token anywhere, with any decoration hugging it. */
+const TRAILER_TOKEN = /[`*_]*\[\[\s*confidence\b[^\]]*\]\][`*_]*\.?/gi;
+/** The confidence a trailer states: a plain decimal from 0 to 1, read whole — anything else is no confidence. */
+function trailerConfidence(token) {
+    const raw = /confidence\s*[=:]\s*["']?([^\s,"'\]]+)/i.exec(token)?.[1];
+    if (!raw || !/^(?:0|1|0?\.\d+|1\.0+|0\.\d+)$/.test(raw))
+        return undefined;
+    const value = Number(raw);
+    return value >= 0 && value <= 1 ? value : undefined;
+}
+/**
+ * A reply without its confidence trailer (`[[confidence=0.9 reply_class=general]]`,
+ * see `replyConfidence`), and what the last one said. Every trailer is removed,
+ * wherever the model put it and however it dressed it, even one that can't be
+ * read: none may reach a guest. A line left with nothing else on it goes too.
+ */
+export function splitConfidence(reply) {
+    const tokens = [...reply.matchAll(TRAILER_TOKEN)];
+    if (tokens.length === 0)
+        return { text: reply };
+    const last = tokens[tokens.length - 1][0];
+    // Whole tokens first (one may wrap onto the next line), marked; then a line
+    // left with nothing but a mark and decoration goes.
+    const MARK = '\u0000';
+    const text = reply
+        .replace(TRAILER_TOKEN, MARK)
+        .split('\n')
+        .flatMap((line) => {
+        if (!line.includes(MARK))
+            return [line];
+        const cleaned = line.split(MARK).join('').replace(/[ \t]+$/, '');
+        return /^[\s`*_>.]*$/.test(cleaned) ? [] : [cleaned];
+    })
+        .join('\n')
+        .replace(/\s+$/, '');
+    const confidence = trailerConfidence(last);
+    const replyClass = /reply_class\s*[=:]\s*["']?([A-Za-z_]{1,40})/i.exec(last)?.[1]?.toLowerCase();
+    if (confidence === undefined)
+        return { text };
+    return { text, confidence, ...(replyClass ? { replyClass } : {}) };
+}
+/** The send extras for one answer: the run's own, plus what its trailer said. */
+function shapeAnswer(answer, extra, on) {
+    if (!on)
+        return { text: answer, extra };
+    const shaped = splitConfidence(answer);
+    return {
+        text: shaped.text,
+        extra: shaped.confidence !== undefined
+            ? { ...extra, confidence: shaped.confidence, ...(shaped.replyClass ? { reply_class: shaped.replyClass } : {}) }
+            : extra,
+    };
+}
+/**
+ * A Codex turn its usage limit stopped. Codex says so in its own words on a
+ * failed turn; only `prohost host` acts on it (`deferUsageLimit`).
+ */
+const CODEX_USAGE_LIMIT = /usage limit|usage_limit_reached|hit your limit/i;
 /**
  * The lane a run waits on: runs sharing one never overlap.
  *
@@ -278,7 +361,7 @@ function laneFor(run) {
  */
 function buildRuntime(options, log) {
     const workdir = resolveWorkdir(options, log);
-    const sessions = SessionStore.load(options.env, log);
+    const sessions = options.sessions ?? SessionStore.load(options.env, log);
     const brain = isClaudeExec(options.exec)
         ? 'claude'
         : isCodexExec(options.exec)
@@ -307,11 +390,15 @@ function buildRuntime(options, log) {
         env: options.env,
         initialLabel: options.credentials.account,
         binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
-        run: options.accountCommandRunner,
+        // A Claude harness's sign-in check sees the run's extra variables too (the Claude token).
+        run: brain === 'claude' && options.extraEnv
+            ? (command, args, env) => (options.accountCommandRunner ?? defaultCommandRunner)(command, args, { ...env, ...extraEnvOf(options) })
+            : options.accountCommandRunner,
         warn: (message) => log(`${timestamp()} ! ${message}`),
     });
     const mcpUrl = options.credentials.mcp_url;
     let announced = '';
+    const quiet = options.quietStartup === true;
     const announce = (lines) => {
         const message = lines.join('\n');
         if (message === announced)
@@ -320,7 +407,7 @@ function buildRuntime(options, log) {
             log(line);
         announced = message;
     };
-    if (!mcpUrl) {
+    if (!mcpUrl && !quiet) {
         log(`${timestamp()} ! this pairing carries no MCP endpoint; the agent will run without ProhostAI tools`);
     }
     const prepareMcp = brain === 'claude'
@@ -336,6 +423,7 @@ function buildRuntime(options, log) {
                     apiKey: options.credentials.api_key,
                     extraServers: extras.servers,
                     env: options.env,
+                    ...(options.mcpConfigFile ? { file: options.mcpConfigFile } : {}),
                 });
                 return { mcpConfigPath, mcpWired: Boolean(mcpUrl) };
             }
@@ -350,19 +438,21 @@ function buildRuntime(options, log) {
         : codexMcpEntryProvider(options, log, workdir, () => account.spawnEnv());
     const tools = mcpUrl ? `, ProhostAI tools prepared per run as ${MCP_SERVER_NAME}` : '';
     const where = workdir ? ` (workspace: ${workdir})` : '';
-    log(brain === 'claude'
-        ? `${timestamp()} ⚙ Claude Code detected — resuming a session per conversation${tools}${where}`
-        : `${timestamp()} ⚙ Codex detected — resuming a thread per conversation${tools}${where}`);
+    if (!quiet)
+        log(brain === 'claude'
+            ? `${timestamp()} ⚙ Claude Code detected — resuming a session per conversation${tools}${where}`
+            : `${timestamp()} ⚙ Codex detected — resuming a thread per conversation${tools}${where}`);
     // Said out loud every start-up, not buried in --help. This is the line that
     // tells an operator their machine will run tool calls, unprompted, on text
     // written by someone else in their workspace.
     const bypassFlag = brain === 'claude' ? '--dangerously-skip-permissions' : '--yolo';
-    log(skipPermissions
-        ? `${timestamp()} ⚠ tools run WITHOUT permission prompts ` +
-            `(${bypassFlag}). The agent acts as you, with your local ` +
-            'access, on instructions from your workspace. Use --safe-tools to gate them.'
-        : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
-            'approval will not run (nobody is at a terminal to approve it).');
+    if (!quiet)
+        log(skipPermissions
+            ? `${timestamp()} ⚠ tools run WITHOUT permission prompts ` +
+                `(${bypassFlag}). The agent acts as you, with your local ` +
+                'access, on instructions from your workspace. Use --safe-tools to gate them.'
+            : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
+                'approval will not run (nobody is at a terminal to approve it).');
     // The account is resolved before anything is prepared or spawned, and its
     // environment rides every spawn of this run. A missing account fails the
     // run closed, the same way an unprovable MCP boundary does.
@@ -377,7 +467,8 @@ function buildRuntime(options, log) {
             accountLabel: resolved.record.label,
         };
     };
-    log(`${timestamp()} ⚙ account: ${account.label()}`);
+    if (!quiet)
+        log(`${timestamp()} ⚙ account: ${account.label()}`);
     return {
         workdir,
         sessions,
@@ -884,6 +975,16 @@ onEarlyAnswer) {
     // the ledger can't know. One retry without it, because the alternative is a
     // surface that fails every run forever over an optimisation.
     const resumeFailed = codex ? looksLikeCodexResumeFailure : looksLikeResumeFailure;
+    /**
+     * A Codex turn its usage limit stopped may already have acted. For
+     * `prohost host` (which moves the thread to another login) its thread is
+     * remembered, so the next login continues it rather than starting over.
+     */
+    const keepCodexThreadOnLimit = (threadId, said) => {
+        if (!options.deferUsageLimit || !sessionKey || !threadId || !CODEX_USAGE_LIMIT.test(said))
+            return;
+        runtime.sessions.remember(sessionKey, threadId);
+    };
     if (!result.ok &&
         sessionId &&
         // A usage limit fails a fresh session exactly as it failed this one, and
@@ -911,6 +1012,8 @@ onEarlyAnswer) {
         if (!result.timedOut && !result.idleTimedOut && !result.cancelled && !stream?.usageLimit()) {
             forgetRecordedSession();
         }
+        if (codex)
+            keepCodexThreadOnLimit(parseCodexOutput(result.stdout).sessionId, `${codexFailureMessage(result.stdout) ?? ''}\n${result.stderr}`);
         return failure(result);
     }
     // A denied tool is not an error either brain reports — the turn succeeds and
@@ -929,6 +1032,7 @@ onEarlyAnswer) {
         runtime.observe(readCodexObservation(output.sessionId, { ...process.env, ...options.env, ...runtime.account?.spawnEnv() }));
         reportDenials(output.denials);
         if (!output.ok) {
+            keepCodexThreadOnLimit(output.sessionId, output.error ?? '');
             return {
                 ok: false,
                 reason: 'the agent did not produce a usable reply',
@@ -977,7 +1081,9 @@ onEarlyAnswer) {
  */
 async function handleRun(run, options, runtime, api, log, sleep, control, isolation, 
 /** Prepared by the caller, which also hands the run's account back. */
-mcp) {
+mcp, 
+/** Filled for a turn handed back as `usage_limited` (see `deferUsageLimit`). */
+limited) {
     const label = `run ${run.run_id.slice(0, 12)}`;
     const surface = run.conversation_id ?? run.kind ?? 'no conversation';
     // Answered with the run's own token, by a session with no tools and none of
@@ -1020,6 +1126,8 @@ mcp) {
         parallel: isolation.parallel,
         checkouts: checkouts?.checkouts,
         checkoutFailures: checkouts?.failures,
+        ...(options.resumeNote ? { resumeNote: options.resumeNote } : {}),
+        ...(options.replyConfidence && run.reply_surface === 'conversation' ? { askConfidence: true } : {}),
     });
     // Tool-call narration for the thread. A dry run makes no writes, so it gets
     // no path and every event is dropped; so does a server that advertised none.
@@ -1029,7 +1137,7 @@ mcp) {
         log,
         label,
     });
-    const runEnv = { [PAIRED_RUN_ENV_VAR]: '1' };
+    const runEnv = { ...extraEnvOf(options), [PAIRED_RUN_ENV_VAR]: '1' };
     if (checkouts && checkouts.checkouts.length > 0)
         runEnv[RUN_REPOS_ENV_VAR] = checkouts.dir;
     // The last moment before the agent starts: a venue run that waited in the
@@ -1081,7 +1189,10 @@ mcp) {
             const { answer, key } = early[0];
             const posted = await postReplyWithReplay(api, () => stoppedNow()
                 ? Promise.resolve({ ok: false, status: -1, error: 'the run was stopped' })
-                : postReply(api, earlyPath, earlyBodyKey, answer, key, run.reply_body_extra), label, log, sleep);
+                : (() => {
+                    const shaped = shapeAnswer(answer, run.reply_body_extra, options.replyConfidence);
+                    return postReply(api, earlyPath, earlyBodyKey, shaped.text, key, shaped.extra);
+                })(), label, log, sleep);
             if (!posted.ok) {
                 if (!stoppedNow())
                     log(`${timestamp()} ! ${label} could not post an answer yet (${describeFailure(posted)})`);
@@ -1159,6 +1270,18 @@ mcp) {
         }
         return 'cancelled';
     }
+    if (!result.ok && options.deferUsageLimit && !options.dryRun && !venue) {
+        const usageLimit = result.usageLimit ??
+            (runtime.brain === 'codex' && CODEX_USAGE_LIMIT.test(`${result.reason}\n${result.detail ?? ''}`) ? {} : undefined);
+        if (usageLimit) {
+            // Not completed: the caller moves the conversation to another login of
+            // the same kind, or completes it with this limit itself.
+            log(`${timestamp()} ⏸ ${label} hit this login's usage limit after ${seconds}s`);
+            if (limited && usageLimit.retryAfter)
+                limited.retryAfter = usageLimit.retryAfter;
+            return 'usage_limited';
+        }
+    }
     if (!result.ok) {
         const { reason } = result;
         // A venue run's detail is stderr and the agent's unfinished answer — the
@@ -1183,7 +1306,9 @@ mcp) {
         }
         return 'failed';
     }
-    const { reply } = result;
+    const shaped = shapeAnswer(result.reply, run.reply_body_extra, options.replyConfidence);
+    const reply = shaped.text;
+    const sendExtra = shaped.extra;
     if (options.dryRun) {
         const destination = run.reply_surface === 'none' ? '(no reply surface)' : `${run.reply_surface} ${run.reply_path}`;
         log(`${timestamp()} ◦ ${label} dry-run — would post to ${destination}:`);
@@ -1249,7 +1374,7 @@ mcp) {
     }
     const replyPath = run.reply_path;
     const replyBodyKey = run.reply_body_key;
-    const posted = await postReplyWithReplay(api, () => postReply(api, replyPath, replyBodyKey, reply, run.run_id, run.reply_body_extra), label, log, sleep);
+    const posted = await postReplyWithReplay(api, () => postReply(api, replyPath, replyBodyKey, reply, run.run_id, sendExtra), label, log, sleep);
     if (!posted.ok) {
         const failure = describeFailure(posted);
         // The server's reason can quote the thread (a reply-race refusal previews
@@ -1400,7 +1525,10 @@ export async function runAgentHarness(options) {
     const status = new RuntimeStatusReporter({
         runtime: runtime.runtimeName,
         provider: options.quotaProvider === undefined
-            ? defaultQuotaProvider(runtime.brain, options.exec, () => runtime.account?.spawnEnv() ?? {})
+            ? defaultQuotaProvider(runtime.brain, options.exec, () => ({
+                ...runtime.account?.spawnEnv(),
+                ...(runtime.brain === 'claude' ? extraEnvOf(options) : {}),
+            }))
             : (options.quotaProvider ?? undefined),
         accounts: runtime.account
             ? (known) => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing), known)
@@ -1418,10 +1546,19 @@ export async function runAgentHarness(options) {
             // With folder starts (`folder` / `separateCopy`): the server sends one only to a socket saying so.
             // With the agents whose binaries resolve here, re-checked per frame: the server offers only those.
             ...(codeHost?.authorized()
-                ? [CODE_THREADS_CAPABILITY, CODE_THREAD_FOLDERS_CAPABILITY, codeHost.instanceCapability(), ...(codeHost.agentCapabilities?.() ?? [])]
+                ? [
+                    CODE_THREADS_CAPABILITY,
+                    CODE_THREAD_FOLDERS_CAPABILITY,
+                    codeHost.instanceCapability(),
+                    ...(codeHost.agentCapabilities?.() ?? []),
+                ]
                 : []),
             // Read on every frame, so `remote off` stops being declared at the next one.
-            ...(codeHost?.authorized() && codeHost.remoteTerminalAllowed() ? [REMOTE_TERMINAL_CAPABILITY] : []),
+            // With it, skipping permission prompts (`skipPermissions` on a start): only while remote control
+            // is on, as the host applies it only then; the server records a thread as skipping only so.
+            ...(codeHost?.authorized() && codeHost.remoteTerminalAllowed()
+                ? [REMOTE_TERMINAL_CAPABILITY, CODE_THREAD_SKIP_PERMISSIONS_CAPABILITY]
+                : []),
         ],
         // `--machine` names this machine everywhere, exactly as given: whoever set it never sends the
         // real hostname. Only the real hostname is cut to its short form.
@@ -2170,3 +2307,42 @@ export async function runAgentHarness(options) {
         });
     }
 }
+/**
+ * Execute one run that `prohost host` has already claimed, the way
+ * `agent run` executes one it accepted: the same prompt, Claude Code / Codex
+ * shaping, session continuity, tool events, reply and completion.
+ *
+ * `options.credentials.api_key` is the run's own token, and `options.env`
+ * points `PROHOST_HOME` at the employee's home (its sessions and workspace).
+ * Heartbeats, cancellation and the queue belong to the caller, which hands
+ * the outcome of each to `control`.
+ */
+export async function executeHostedRun(run, options, control, isolation, api) {
+    const log = options.onLine ?? ((line) => process.stdout.write(`${line}\n`));
+    const sleep = options.sleepImpl ?? defaultSleep;
+    const runtime = buildRuntime(options, log);
+    const worktrees = new WorktreeManager({ repos: options.repos ?? [], env: options.env, log });
+    let mcp;
+    try {
+        mcp = runtime.prepareMcp();
+    }
+    catch (err) {
+        mcp = { mcpWired: false, error: `could not prepare the run (${String(err)})` };
+    }
+    const limited = {};
+    try {
+        const outcome = await handleRun(run, options, runtime, api, log, sleep, control, { lane: isolation.lane, parallel: isolation.parallel, worktrees }, mcp, limited).catch((err) => {
+            log(`${timestamp()} ✗ run ${run.run_id} crashed the run handler: ${String(err)}`);
+            return 'failed';
+        });
+        return {
+            outcome,
+            ...(outcome === 'usage_limited' && limited.retryAfter ? { retryAfter: limited.retryAfter } : {}),
+            model: runtime.model(),
+        };
+    }
+    finally {
+        if (mcp.accountLabel !== undefined)
+            runtime.account?.finishSpawn(mcp.accountLabel);
+    }
+}

package/dist/codehost/history.d.ts

@@ -0,0 +1,80 @@
+/**
+ * A viewer's local scroll-back (CONTRACTS-R2 R1): the pane's history as text, so the viewer
+ * scrolls it on its own screen instead of driving tmux copy mode over the network (one wheel
+ * step per round trip, and copy mode is the PANE's: one viewer's scroll froze everyone's view).
+ *
+ * - client → server: `{"type":"history","id":<string>,"lines":<int, capped 10000>}`;
+ * - server → that client only: `{"type":"history","id","text","cols","rows"}`, the history and
+ *   visible screen as `tmux capture-pane -p -e -J -S -<lines>` prints them (SGR colours kept,
+ *   wrapped lines joined), or `{"type":"history","id","error":"<code>"}`.
+ *
+ * Answered only to a viewer that said `hello` (an older page never sees one), and bounded: a
+ * frame never exceeds {@link HISTORY_MAX_FRAME_BYTES}; the oldest lines go first.
+ */
+/** Most lines a viewer may ask for. */
+export declare const HISTORY_MAX_LINES = 10000;
+/** Lines asked for when a request names none (or an unusable number). */
+export declare const HISTORY_DEFAULT_LINES = 2000;
+/**
+ * Largest answer, as sent (JSON): the relay carries it over Redis and the cloud pipe's upstream
+ * socket takes at most 1 MiB, so this stays well under both.
+ */
+export declare const HISTORY_MAX_FRAME_BYTES: number;
+/** A request id: what the viewer matches its answer by. */
+export declare const HISTORY_ID_PATTERN: RegExp;
+export type HistoryError = 'alternate_screen' | 'capture_failed' | 'unavailable';
+export interface HistoryRequest {
+    type: 'history';
+    id: string;
+    lines: number;
+}
+export type HistoryFrame = {
+    type: 'history';
+    id: string;
+    text: string;
+    cols: number;
+    rows: number;
+} | {
+    type: 'history';
+    id: string;
+    error: HistoryError;
+};
+export type HistoryResult = {
+    ok: true;
+    text: string;
+    cols: number;
+    rows: number;
+} | {
+    ok: false;
+    error: HistoryError;
+};
+/** `lines` as asked, within 1..{@link HISTORY_MAX_LINES}. */
+export declare function clampHistoryLines(raw: unknown): number;
+/** A `history` request frame's fields, or `null` when it can't be answered (no usable id). */
+export declare function parseHistoryRequest(frame: Record<string, unknown>): HistoryRequest | null;
+/**
+ * `-p` print, `-e` keep the SGR escapes (colours, bold), `-J` join wrapped lines (the viewer
+ * wraps them at its own width), `-S -<lines>` from that far back in the history to the screen's end.
+ */
+export declare function captureHistoryArgs(name: string, lines: number): string[];
+/** The pane's size, and whether a program (vim, less) holds its alternate screen: `<cols> <rows> <0|1>`. */
+export declare function paneGeometryArgs(name: string): string[];
+export declare function parsePaneGeometry(stdout: string): {
+    cols: number;
+    rows: number;
+    alternate: boolean;
+} | null;
+/**
+ * The answer to request `id`, at most `maxBytes` as JSON: whole lines are dropped from the top
+ * (the oldest) until it fits. tmux ends its capture with a newline, which is not a line.
+ */
+export declare function historyFrame(id: string, result: HistoryResult, maxBytes?: number): HistoryFrame;
+export type HistoryTmux = (args: string[]) => Promise<{
+    ok: boolean;
+    stdout?: string;
+}>;
+/**
+ * Read `lines` of window `name`'s history. A pane in the alternate screen (a full-screen program)
+ * has no scroll-back to show: the viewer falls back to sending it the wheel.
+ */
+export declare function readHistory(tmux: HistoryTmux, name: string, lines: number): Promise<HistoryResult>;