@prohost/cli 0.2.1 → 0.2.3

package/dist/agent/run.d.ts

@@ -59,6 +59,18 @@ export interface AgentRunOptions {
     maxConnections?: number;
     /** Injectable sleep so tests don't wait out the reconnect backoff. */
     sleepImpl?: (ms: number) => Promise<void>;
+    /**
+     * Injectable short-command runner, used before Codex runs to ask which MCP
+     * servers the operator's current config defines. Separate from
+     * {@link spawnImpl} because it is synchronous and captures stdout, and
+     * because a test wants to answer this question without answering the other.
+     * The second argument is the exact cwd the eventual Codex process receives;
+     * Codex discovers project-local config from it.
+     */
+    probeImpl?: (command: string, cwd?: string) => {
+        status: number | null;
+        stdout: string;
+    };
     /** Environment used to locate the run ledger (tests point this at a temp dir). */
     env?: NodeJS.ProcessEnv;
 }
@@ -81,6 +93,26 @@ export interface AgentRunMetrics {
      */
     fatal?: string;
 }
+interface PreparedMcp {
+    /** Claude Code: path of the strict generated MCP config. */
+    mcpConfigPath?: string;
+    /** Codex: entries in the single verified `mcp_servers` override. */
+    codexMcpEntries?: string[];
+    /** Credentials moved out of Codex's process argv. */
+    execEnv?: NodeJS.ProcessEnv;
+    /** ProhostAI tools are actually reachable from this invocation. */
+    mcpWired: boolean;
+    /** A fail-closed preparation error. When set, the agent is never spawned. */
+    error?: string;
+}
+/**
+ * Prepare a fresh Codex MCP override immediately before each invocation.
+ *
+ * No cache is safe here: Codex rereads its config per invocation and the
+ * extras file is the operator's live grant list. Fresh reads make both a new
+ * configured server and a revoked extra visible to the very next run.
+ */
+export declare function codexMcpEntryProvider(options: AgentRunOptions, log: (line: string) => void, workdir?: string): () => PreparedMcp;
 /**
  * Run the harness until the abort signal fires (or ``maxConnections`` is hit).
  *
@@ -88,3 +120,4 @@ export interface AgentRunMetrics {
  * is fatal, because retrying a rejected credential just hammers the server.
  */
 export declare function runAgentHarness(options: AgentRunOptions): Promise<AgentRunMetrics>;
+export {};

package/dist/agent/run.js

@@ -18,9 +18,13 @@
  *   the command a second time and post a second reply.
  */
 import os from 'node:os';
+import { spawnSync } from 'node:child_process';
 import WebSocket from 'ws';
 import { completeRun, postReply } from './api.js';
-import { MCP_SERVER_NAME, claudeCommand, isClaudeExec, looksLikeResumeFailure, parseClaudeOutput, writeMcpConfig, } from './claude.js';
+import { claudeCommand, isClaudeExec, looksLikeResumeFailure, parseClaudeOutput, writeMcpConfig, } from './claude.js';
+import { MCP_API_KEY_ENV_VAR, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, disableEntriesThatLoad, extraMcpEntries, isCodexExec, listMcpServers, mcpServersOverride, prohostMcpEntry, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
+import { EXTRA_MCP_FILENAME, loadExtraMcpServers } from './extras.js';
+import { MCP_SERVER_NAME, MCP_TOOL_PATTERN } from './mcp.js';
 import { EVENT_AGENT_RUN_REQUESTED, EVENT_MENTION_CREATED, EVENT_MESSAGE_TEAM_CHAT, eventData, parseRunRequest, } from './contract.js';
 import { ensureWorkspace, streamUrlFor, workspacePath } from './credentials.js';
 import { execAgent } from './exec.js';
@@ -114,56 +118,225 @@ function resolveWorkdir(options, log) {
     }
 }
 /**
- * Assemble the per-process runtime: workspace, session ledger, and — for Claude
- * Code only — the MCP config that gives the agent tools.
+ * Assemble the per-process runtime: workspace, session ledger, and the
+ * brain-specific MCP preparation used immediately before each run.
  *
- * Every step here is allowed to fail without stopping the harness. An agent
- * that answers from the prompt alone is the product as it shipped; refusing to
- * start because a config file couldn't be written would be a regression
- * dressed up as a safety check.
+ * Brain-specific MCP preparation happens per run. A daemon is long-lived, so
+ * an extras-file deletion or newly installed Codex server must take effect on
+ * the next invocation rather than after a restart or cache timeout.
  */
 function buildRuntime(options, log) {
     const workdir = resolveWorkdir(options, log);
     const sessions = SessionStore.load(options.env, log);
-    const claude = isClaudeExec(options.exec);
+    const brain = isClaudeExec(options.exec)
+        ? 'claude'
+        : isCodexExec(options.exec)
+            ? 'codex'
+            : 'plain';
     const skipPermissions = options.safeTools !== true;
-    if (!claude)
-        return { workdir, sessions, claude, skipPermissions };
-    let mcpConfigPath;
-    const mcpUrl = options.credentials.mcp_url;
-    if (mcpUrl) {
-        try {
-            mcpConfigPath = writeMcpConfig({
-                mcpUrl,
-                apiKey: options.credentials.api_key,
-                env: options.env,
-            });
-        }
-        catch (err) {
-            // Said out loud rather than swallowed: the visible symptom would
-            // otherwise be an agent that answers "I can't look that up", which reads
-            // like a model problem and sends someone to the wrong file.
-            log(`${timestamp()} ! could not write the MCP config ` +
-                `(${err instanceof Error ? err.message : String(err)}); the agent will run without ` +
-                'ProhostAI tools');
-        }
+    if (brain === 'plain') {
+        return { workdir, sessions, brain, skipPermissions, prepareMcp: () => ({ mcpWired: false }) };
     }
-    else {
+    const mcpUrl = options.credentials.mcp_url;
+    let announced = '';
+    const announce = (lines) => {
+        const message = lines.join('\n');
+        if (message === announced)
+            return;
+        for (const line of lines)
+            log(line);
+        announced = message;
+    };
+    if (!mcpUrl) {
         log(`${timestamp()} ! this pairing carries no MCP endpoint; the agent will run without ProhostAI tools`);
     }
-    log(`${timestamp()} ⚙ Claude Code detected — resuming a session per conversation` +
-        (mcpConfigPath ? `, ProhostAI tools wired in as ${MCP_SERVER_NAME}` : '') +
-        `${workdir ? ` (workspace: ${workdir})` : ''}`);
+    const prepareMcp = brain === 'claude'
+        ? () => {
+            const extras = loadExtraMcpServers({ env: options.env });
+            announce(extras.warnings.map((warning) => `${timestamp()} ! ${warning}`));
+            // Always pass an explicit strict config, including when it is empty.
+            // Omitting the path would make `--strict-mcp-config` ineffective and
+            // expose Claude's user/project MCP servers under skipped permissions.
+            try {
+                const mcpConfigPath = writeMcpConfig({
+                    mcpUrl,
+                    apiKey: options.credentials.api_key,
+                    extraServers: extras.servers,
+                    env: options.env,
+                });
+                return { mcpConfigPath, mcpWired: Boolean(mcpUrl) };
+            }
+            catch (err) {
+                const detail = err instanceof Error ? err.message : String(err);
+                return {
+                    mcpWired: false,
+                    error: `could not write the strict Claude MCP config (${detail})`,
+                };
+            }
+        }
+        : codexMcpEntryProvider(options, log, workdir);
+    const tools = mcpUrl ? `, ProhostAI tools prepared per run as ${MCP_SERVER_NAME}` : '';
+    const where = workdir ? ` (workspace: ${workdir})` : '';
+    log(brain === 'claude'
+        ? `${timestamp()} ⚙ Claude Code detected — resuming a session per conversation${tools}${where}`
+        : `${timestamp()} ⚙ Codex detected — resuming a thread per conversation${tools}${where}`);
     // Said out loud every start-up, not buried in --help. This is the line that
     // tells an operator their machine will run tool calls, unprompted, on text
     // written by someone else in their workspace.
+    const bypassFlag = brain === 'claude' ? '--dangerously-skip-permissions' : '--yolo';
     log(skipPermissions
         ? `${timestamp()} ⚠ tools run WITHOUT permission prompts ` +
-            '(--dangerously-skip-permissions). The agent acts as you, with your local ' +
+            `(${bypassFlag}). The agent acts as you, with your local ` +
             'access, on instructions from your workspace. Use --safe-tools to gate them.'
         : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
             'approval will not run (nobody is at a terminal to approve it).');
-    return { workdir, sessions, claude, mcpConfigPath, skipPermissions };
+    return { workdir, sessions, brain, prepareMcp, skipPermissions };
+}
+/**
+ * Prepare a fresh Codex MCP override immediately before each invocation.
+ *
+ * No cache is safe here: Codex rereads its config per invocation and the
+ * extras file is the operator's live grant list. Fresh reads make both a new
+ * configured server and a revoked extra visible to the very next run.
+ */
+export function codexMcpEntryProvider(options, log, workdir) {
+    let announced = '';
+    return () => {
+        const extras = loadExtraMcpServers({ env: options.env });
+        const lines = extras.warnings.map((warning) => `${timestamp()} ! ${warning}`);
+        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir);
+        const said = lines.join('\n');
+        if (said !== announced) {
+            for (const line of lines)
+                log(line);
+            announced = said;
+        }
+        return prepared;
+    };
+}
+/*
+ * Every `mcp_servers` entry a Codex run gets: ours, the operator's extras, and
+ * verified switches that keep the operator's own servers out. Preparation is
+ * fail-closed: an unprovable boundary never reaches an unsandboxed agent.
+ */
+function codexMcpEntries(options, extraServers, log, workdir) {
+    const fail = (detail) => {
+        log(`${timestamp()} ! ${detail}`);
+        return { mcpWired: false, error: detail };
+    };
+    const probe = options.probeImpl ?? defaultProbe;
+    if (codexShellSyntax(options.exec)) {
+        return fail('--exec uses shell quoting, expansion, glob, comment, escape, or control syntax that the Codex ' +
+            'isolation verifier cannot tokenize safely; use a plain argv-shaped Codex command');
+    }
+    const binary = codexBinary(options.exec);
+    const entries = [];
+    const execEnv = {};
+    if (options.credentials.mcp_url) {
+        entries.push(prohostMcpEntry(options.credentials.mcp_url));
+        execEnv[MCP_API_KEY_ENV_VAR] = options.credentials.api_key;
+    }
+    const profile = codexProfileName(options.exec);
+    if (profile) {
+        return fail(`--exec runs Codex under profile "${profile}", whose MCP servers cannot be enumerated; ` +
+            'remove the profile flag before running this harness');
+    }
+    const inventoryFlag = codexMcpInventoryFlag(options.exec);
+    if (inventoryFlag) {
+        return fail(`--exec includes ${inventoryFlag}, which can change Codex's MCP or plugin inventory, or its ` +
+            `working directory, outside the configuration the harness can verify; remove cwd, config, feature, ` +
+            'and --ignore-user-config flags');
+    }
+    const configured = listMcpServers(binary, probe, undefined, workdir);
+    if (configured === null) {
+        return fail('could not ask Codex which MCP servers it has configured');
+    }
+    const configuredNames = new Set(configured.map((server) => server.name));
+    if (configuredNames.has(MCP_SERVER_NAME)) {
+        return fail(`your Codex config already defines the reserved MCP server name "${MCP_SERVER_NAME}"; ` +
+            'rename or remove it so credentials cannot be merged into the paired server');
+    }
+    const collisions = Object.keys(extraServers).filter((name) => configuredNames.has(name));
+    if (collisions.length > 0) {
+        log(`${timestamp()} ! ${EXTRA_MCP_FILENAME} reuses names your Codex config already defines, ` +
+            `so those entries were ignored (Codex would merge their credentials): ${collisions.join(', ')}. Rename them to use them.`);
+    }
+    const usableExtras = Object.fromEntries(Object.entries(extraServers).filter(([name]) => !collisions.includes(name)));
+    const extra = extraMcpEntries(usableExtras);
+    if (extra.skipped.length > 0) {
+        log(`${timestamp()} ! could not pass these extra MCP servers to Codex ` +
+            `(value not expressible as a safe config override): ${extra.skipped.join(', ')}`);
+    }
+    let acceptedExtraEntries = [];
+    if (extra.entries.length > 0) {
+        if (listMcpServers(binary, probe, mcpServersOverride(extra.entries), workdir) === null) {
+            log(`${timestamp()} ! Codex rejected the server definitions in ${EXTRA_MCP_FILENAME}; ` +
+                'the run will continue without those optional extras');
+        }
+        else {
+            acceptedExtraEntries = extra.entries;
+            entries.push(...acceptedExtraEntries);
+            Object.assign(execEnv, extra.env);
+        }
+    }
+    // A configured collision was dropped above, so it is deliberately disabled.
+    const acceptedExtraNames = new Set(Object.keys(usableExtras).filter((name) => !extra.skipped.includes(name)));
+    if (acceptedExtraEntries.length === 0)
+        acceptedExtraNames.clear();
+    const targets = [...configuredNames].filter((name) => !acceptedExtraNames.has(name));
+    const { entries: disabled, failed } = disableEntriesThatLoad(binary, probe, targets, workdir);
+    if (failed.length > 0) {
+        return fail(`these Codex MCP servers could not be disabled: ${failed.join(', ')}`);
+    }
+    entries.push(...disabled);
+    if (disabled.length > 0) {
+        log(`${timestamp()} ⚙ your own Codex MCP servers are disabled for agent runs: ${targets.join(', ')}`);
+    }
+    // Verify the exact combined override, not its pieces. This catches a config
+    // merge that re-enables a server and a server installed between the initial
+    // survey and this final probe.
+    const override = mcpServersOverride(entries);
+    const finalListing = listMcpServers(binary, probe, override, workdir);
+    if (finalListing === null)
+        return fail('Codex rejected the final isolated MCP configuration');
+    const allowed = new Set([
+        ...(options.credentials.mcp_url ? [MCP_SERVER_NAME] : []),
+        ...acceptedExtraNames,
+    ]);
+    const enabled = new Set(finalListing.filter((server) => server.enabled).map((server) => server.name));
+    const missing = [...allowed].filter((name) => !enabled.has(name));
+    if (missing.length > 0) {
+        return fail(`expected MCP servers are missing or disabled after isolation: ${missing.join(', ')}`);
+    }
+    const unexpected = finalListing.filter((server) => server.enabled && !allowed.has(server.name));
+    if (unexpected.length > 0) {
+        return fail(`unexpected MCP servers remain enabled after isolation: ${unexpected.map((server) => server.name).join(', ')}`);
+    }
+    return {
+        codexMcpEntries: entries,
+        execEnv: Object.keys(execEnv).length > 0 ? execEnv : undefined,
+        mcpWired: Boolean(options.credentials.mcp_url),
+    };
+}
+/**
+ * Run one short command and capture stdout.
+ *
+ * `shell: true` for the same reason `exec.ts` uses it — the binary name comes
+ * out of the operator's own `--exec` string and may be a quoted path — and for
+ * the same reason it is safe: nothing event-derived reaches this command line.
+ * `cwd` must match the eventual run exactly, because Codex loads trusted
+ * project `.codex/config.toml` layers from there.
+ */
+function defaultProbe(command, cwd) {
+    const result = spawnSync(command, {
+        shell: true,
+        cwd,
+        encoding: 'utf8',
+        // Generous for a config read, short enough that a wedged binary delays
+        // a run rather than wedging the daemon.
+        timeout: 15_000,
+    });
+    return { status: result.status, stdout: result.stdout ?? '' };
 }
 /**
  * Run the agent command once and turn its output into a reply.
@@ -174,7 +347,7 @@ function buildRuntime(options, log) {
  * tell a failed turn from a successful one. A plain command's behaviour here is
  * byte-for-byte what it was before this function existed.
  */
-async function runTurn(run, prompt, options, runtime, log) {
+async function runTurn(run, prompt, options, runtime, mcp, log) {
     // `--timeout` is a ceiling on the run, not on each attempt: the retry below
     // must not let one run take twice what the operator allowed. Both attempts
     // share one deadline, which costs the retry nothing in practice — a rejected
@@ -187,11 +360,15 @@ async function runTurn(run, prompt, options, runtime, log) {
         prompt,
         timeoutMs: remainingMs(),
         cwd: runtime.workdir,
+        env: mcp.execEnv,
         spawnImpl: options.spawnImpl,
     });
     // Wall clock for the whole turn, retry included — what the operator waited,
     // rather than what the last attempt took.
     const elapsed = () => Date.now() - startedAt;
+    if (mcp.error) {
+        return { ok: false, reason: 'MCP isolation could not be established', detail: mcp.error, durationMs: 0 };
+    }
     const failure = (result) => ({
         ok: false,
         reason: result.error ??
@@ -199,7 +376,7 @@ async function runTurn(run, prompt, options, runtime, log) {
         detail: result.stderr.trim().slice(-500),
         durationMs: elapsed(),
     });
-    if (!runtime.claude) {
+    if (runtime.brain === 'plain') {
         const result = await exec(options.exec);
         if (!result.ok)
             return failure(result);
@@ -209,37 +386,67 @@ async function runTurn(run, prompt, options, runtime, log) {
             : { ok: false, reason: 'agent produced no output', durationMs: elapsed() };
     }
     // No session bookkeeping on a dry run. `--dry-run` promises to make no
-    // writes, and a resumed turn is a write: Claude Code records it in the
+    // writes, and a resumed turn is a write: both brains record it in their
     // transcript whether or not we post the reply, so remembering the session
     // would leave the next *real* run continuing from an answer nobody saw.
     const key = options.dryRun ? undefined : sessionKeyFor(run);
     const sessionId = runtime.sessions.get(key);
-    const shape = { mcpConfigPath: runtime.mcpConfigPath, skipPermissions: runtime.skipPermissions };
-    let result = await exec(claudeCommand(options.exec, { ...shape, sessionId }));
+    const codex = runtime.brain === 'codex';
+    // Same three questions for both brains — resume this thread, wire these
+    // tools, gate or don't — asked with each one's own flags.
+    const build = (resume) => codex
+        ? codexCommand(options.exec, {
+            sessionId: resume,
+            mcpEntries: mcp.codexMcpEntries,
+            skipPermissions: runtime.skipPermissions,
+        })
+        : claudeCommand(options.exec, {
+            sessionId: resume,
+            mcpConfigPath: mcp.mcpConfigPath,
+            skipPermissions: runtime.skipPermissions,
+        });
+    let result = await exec(build(sessionId));
     // A remembered session may simply be gone — transcripts are cleaned up and
     // the ledger can't know. One retry without it, because the alternative is a
     // surface that fails every run forever over an optimisation.
+    const resumeFailed = codex ? looksLikeCodexResumeFailure : looksLikeResumeFailure;
     if (!result.ok &&
         sessionId &&
-        looksLikeResumeFailure(`${result.stderr}\n${result.stdout}`, sessionId) &&
+        resumeFailed(`${result.stderr}\n${result.stdout}`, sessionId) &&
         // Skipped rather than squeezed into a token budget: a retry with no time
         // left would be killed on the spot and reported as a timeout, which is a
         // worse error message than the resume failure it replaced.
         remainingMs() > 0) {
         log(`    … session ${sessionId.slice(0, 12)} could not be resumed; starting a fresh one`);
         runtime.sessions.forget(key);
-        result = await exec(claudeCommand(options.exec, shape));
+        result = await exec(build());
     }
     if (!result.ok)
         return failure(result);
-    const parsed = parseClaudeOutput(result.stdout);
-    // A denied tool is not an error the agent reports — the turn succeeds and the
-    // reply just quietly lacks whatever the tool would have found. Printing it is
-    // the difference between "the agent seems dumb" and "the agent asked for
-    // WebSearch and there was nobody to approve it".
-    if (parsed.denials.length > 0) {
-        log(`    ! tools the agent asked for and was refused: ${parsed.denials.join(', ')}`);
+    // A denied tool is not an error either brain reports — the turn succeeds and
+    // the reply just quietly lacks whatever the tool would have found. Printing
+    // it is the difference between "the agent seems dumb" and "the agent asked
+    // for WebSearch and there was nobody to approve it".
+    const reportDenials = (denials) => {
+        if (denials.length > 0) {
+            log(`    ! tools the agent asked for and was refused: ${denials.join(', ')}`);
+        }
+    };
+    if (codex) {
+        const output = parseCodexOutput(result.stdout);
+        reportDenials(output.denials);
+        if (!output.ok) {
+            return {
+                ok: false,
+                reason: 'the agent did not produce a usable reply',
+                detail: output.error,
+                durationMs: elapsed(),
+            };
+        }
+        return { ok: true, reply: output.text, durationMs: elapsed(), sessionId: output.sessionId };
     }
+    const parsed = parseClaudeOutput(result.stdout);
+    reportDenials(parsed.denials);
     if (!parsed.ok) {
         return {
             ok: false,
@@ -260,15 +467,21 @@ async function handleRun(run, options, runtime, api, log, sleep) {
     const label = `run ${run.run_id.slice(0, 12)}`;
     const surface = run.conversation_id ?? run.kind ?? 'no conversation';
     log(`${timestamp()} ▶ ${label} started (${surface})`);
+    const mcp = runtime.prepareMcp();
     const prompt = buildPrompt(run, {
         agentName: options.credentials.agent?.name ?? 'your agent',
         // Named only when the tools are actually reachable from this invocation.
         // Telling an agent about an endpoint it has no client for is what produced
         // replies describing lookups that never happened.
-        mcpServerName: runtime.mcpConfigPath ? MCP_SERVER_NAME : undefined,
+        mcpServerName: mcp.mcpWired ? MCP_SERVER_NAME : undefined,
+        // Both shaped brains spell MCP tools `mcp__<server>__<tool>` — Codex's was
+        // an open question until it was measured against the binary in 0.2.3. A
+        // `plain` command is still told the server name only: we have no idea what
+        // it is. See PromptContext.mcpToolPattern.
+        mcpToolPattern: runtime.brain !== 'plain' && mcp.mcpWired ? MCP_TOOL_PATTERN : undefined,
         toolsGated: !runtime.skipPermissions,
     });
-    const result = await runTurn(run, prompt, options, runtime, log);
+    const result = await runTurn(run, prompt, options, runtime, mcp, log);
     const seconds = (result.durationMs / 1000).toFixed(1);
     if (!result.ok) {
         const { reason } = result;

package/dist/agent/shell.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Quoting for the `shell: true` command lines the brain harnesses build.
+ *
+ * Shared by `claude.ts` and `codex.ts` because both append values — a session
+ * id we stored, a path under `$PROHOST_HOME`, a TOML config override — to a
+ * string that a shell will parse.
+ */
+/**
+ * Quote a value for a `shell: true` command line on this platform.
+ *
+ * Every value that goes through here is ours or the operator's — never
+ * event-derived text. It is quoted anyway: a home directory with a space in it
+ * is ordinary, and "the inputs are trusted" is the assumption that stops being
+ * true the first time someone extends this.
+ *
+ * Windows needs its own branch. `shell: true` there runs `cmd.exe`, where a
+ * single quote is an ordinary character rather than a quoting one — POSIX
+ * quoting would hand the child a config path with literal apostrophes around
+ * it, and the tools would simply never load.
+ */
+export declare function shellQuote(value: string, platform: NodeJS.Platform): string;
+/** Pipes, lists, redirections, subshells — anything that makes "append to the end" wrong. */
+export declare const SHELL_CONTROL_OPERATORS: RegExp;

package/dist/agent/shell.js

@@ -0,0 +1,27 @@
+/**
+ * Quoting for the `shell: true` command lines the brain harnesses build.
+ *
+ * Shared by `claude.ts` and `codex.ts` because both append values — a session
+ * id we stored, a path under `$PROHOST_HOME`, a TOML config override — to a
+ * string that a shell will parse.
+ */
+/**
+ * Quote a value for a `shell: true` command line on this platform.
+ *
+ * Every value that goes through here is ours or the operator's — never
+ * event-derived text. It is quoted anyway: a home directory with a space in it
+ * is ordinary, and "the inputs are trusted" is the assumption that stops being
+ * true the first time someone extends this.
+ *
+ * Windows needs its own branch. `shell: true` there runs `cmd.exe`, where a
+ * single quote is an ordinary character rather than a quoting one — POSIX
+ * quoting would hand the child a config path with literal apostrophes around
+ * it, and the tools would simply never load.
+ */
+export function shellQuote(value, platform) {
+    if (platform === 'win32')
+        return `"${value.replace(/"/g, '""')}"`;
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** Pipes, lists, redirections, subshells — anything that makes "append to the end" wrong. */
+export const SHELL_CONTROL_OPERATORS = /[|&;<>(){}`]|\$\(/;

package/dist/index.js

@@ -57,6 +57,16 @@ function printHelp() {
         '                   act; with --safe-tools expect it to answer rather than do. Alias:',
         '                   --no-skip-permissions.',
         '',
+        'Extra MCP servers (opt-in):',
+        '  A run gets the ProhostAI MCP server and nothing else. To add more, create',
+        '  $PROHOST_HOME/extra-mcp.json yourself — the CLI never writes it — holding the same',
+        '  {"mcpServers": {...}} object Claude Code\'s --mcp-config takes. Works on Claude Code',
+        '  and Codex.',
+        '  EVERY server you add is exercisable by anyone who can trigger this agent, with',
+        '  permission prompts off and no human in the loop. Scope each one as narrowly as it',
+        '  will go. The name "prohost" is reserved; a malformed file is a warning and a run',
+        '  without extras. Which servers loaded is printed to agent.log at start-up.',
+        '',
         'agent install-daemon flags:  (macOS: launchd; Linux: prints a systemd-user unit)',
         '  --exec           The same command you would pass to `agent run` (required).',
         '  --workdir, --timeout, --machine, --url, --allow-unverified, --safe-tools — passed to `agent run`.',

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.2.1";
+export declare const CLI_VERSION = "0.2.3";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.2.1";
+export declare const USER_AGENT = "prohost-cli/0.2.3";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.2.1';
+export const CLI_VERSION = '0.2.3';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",