@rho-workspace/rho 0.5.4 → 0.5.6

package/dist/agent-connect.d.ts

@@ -12,6 +12,14 @@ export declare const connectLimits: {
 };
 export declare function mcpName(root: string): string;
 export declare function mcpCommand(connectionFile: string): string[];
+export declare function connectionInstructions(project: {
+    id: string;
+    root: string;
+}, stateDirectory: string): {
+    request: string;
+    prompt: string;
+    command: string[];
+};
 export declare function addToAgent(agent: OutsideAgent, binary: string, root: string, name: string, command: string[], limits?: {
     timeoutMs: number;
     outputBytes: number;

package/dist/agent-connect.js

@@ -13,6 +13,21 @@ export function mcpName(root) {
 export function mcpCommand(connectionFile) {
     return [process.execPath, fileURLToPath(new URL('./cli.js', import.meta.url)), '--mcp', connectionFile];
 }
+// Paths are data in an argv array, never an interpolated shell command. Reading these
+// instructions starts nothing, grants no access and includes no credential bytes.
+export function connectionInstructions(project, stateDirectory) {
+    const command = [process.execPath, fileURLToPath(new URL('./cli.js', import.meta.url)), '--grant', path.join(stateDirectory, 'connection.json'), '--project-id', project.id];
+    const request = `Connect yourself to my existing Rho project ${JSON.stringify(path.basename(project.root))} so we can work on it together.`;
+    const prompt = [request, '',
+        `Project folder: ${JSON.stringify(project.root)}. Project ID: ${project.id}. Rho is already running on this machine.`,
+        'Configure your own client using its supported MCP setup mechanism; inspect your own help or documentation if needed. Keep unrelated configuration, models and credentials intact. Use private local configuration, scoped to this project where supported, and keep connection settings out of version-controlled files. If you cannot run a local stdio MCP server, explain that limitation.',
+        'Run this program and argument array, appending --session and a stable name identifying your own Agent (1–128 characters from A–Z, a–z, 0–9, dot, underscore, colon, @ or hyphen). Reuse that name when retrying:',
+        JSON.stringify(command),
+        'Parse the JSON reply. Register a stdio MCP server using mcp.name, mcp.command and mcp.args exactly as returned. The connection files contain credentials: do not print their contents or put them in the project. Do not start another Rho service.',
+        'Reload your MCP tools if supported, or tell me to open a new session in the project folder. Then call rho_index through your configured client tools and verify scopeHint.projectId matches the project ID above. A direct protocol probe is useful diagnostics but does not prove your client loaded its tools. Report configuration and a successful tool call separately; do not claim connected before the call succeeds. If configuration or verification fails, report the actual error and continue from the same connection.',
+    ].join('\n');
+    return { request, prompt, command };
+}
 function run(binary, args, cwd, limits) {
     return new Promise((resolve, reject) => {
         const child = spawn(binary, args, { cwd, env: process.env, stdio: ['ignore', 'pipe', 'pipe'] });

package/dist/browser-access.js

@@ -1,3 +1,4 @@
+import { extensionMethods } from './extension-contract.js';
 import * as fs from 'node:fs/promises';
 import path from 'node:path';
 import { randomBytes } from 'node:crypto';
@@ -36,7 +37,7 @@ export const browserMethods = ['protocol.describe', 'protocol.validate', 'projec
 // Only the person at this machine talks to a conversation Rho starts: it runs their own Claude
 // Code with their model credentials. Only they add Rho to their own Agent's configuration. A
 // narrower, expiring link never receives these.
-export const conversationMethods = ['session.connect', 'conversation.start', 'conversation.send', 'conversation.stop', 'conversation.decide', 'conversation.read', 'conversation.list', 'conversation.trash', 'conversation.restore', 'conversation.delete', 'conversation.permission', 'conversation.configure', 'conversation.settings.read', 'conversation.settings.update', 'conversation.settings.check', 'project.work.read', 'evidence.preview', 'evidence.export'];
+export const conversationMethods = ['agent.sessions.list', 'agent.sessions.read', 'session.instructions', 'session.connect', 'conversation.start', 'conversation.send', 'conversation.stop', 'conversation.decide', 'conversation.read', 'conversation.list', 'conversation.trash', 'conversation.restore', 'conversation.delete', 'conversation.permission', 'conversation.configure', 'conversation.settings.read', 'conversation.settings.update', 'conversation.settings.check', 'project.work.read', 'evidence.preview', 'evidence.export'];
 // The person at this machine. A tab this service served is authorized by the request itself:
 // same origin, loopback only, no link, no code and no expiry. `--pair` stays an explicit,
 // narrower grant for a shared or subfolder-scoped tab.
@@ -49,7 +50,7 @@ export const skillsMethods = ['skills.list', 'skills.read', 'skills.change', 'sk
 export function localBrowserPrincipal(root) {
     // The empty token hash can never match a request digest, so no header impersonates this
     // identity: it is chosen because the request carried no credential at all.
-    return { id: localBrowserId, kind: 'browser', tokenHash: '', projectRoot: root, methods: [...browserMethods, ...conversationMethods, ...consoleMethods, ...kernelMethods, ...skillsMethods] };
+    return { id: localBrowserId, kind: 'browser', tokenHash: '', projectRoot: root, methods: [...extensionMethods, ...browserMethods, ...conversationMethods, ...consoleMethods, ...kernelMethods, ...skillsMethods] };
 }
 export class BrowserAccess {
     state;

package/dist/capabilities.d.ts

@@ -157,7 +157,7 @@ export declare class Capabilities {
         enabled: string[];
     }, author: string): Promise<{
         version: number;
-        enabled: ("media" | "r" | "agent" | "files" | "documents" | "requirements" | "tables" | "charts" | "annotations" | "console" | "kernel" | "skills")[];
+        enabled: ("media" | "r" | "agent" | "files" | "skills" | "documents" | "requirements" | "tables" | "charts" | "annotations" | "console" | "kernel")[];
         receipt: CapabilityReceipt;
     }>;
     private pluginStatus;
@@ -192,7 +192,7 @@ export declare class Capabilities {
         }[];
         configuration: {
             version: number;
-            enabled: ("media" | "r" | "agent" | "files" | "documents" | "requirements" | "tables" | "charts" | "annotations" | "console" | "kernel" | "skills")[];
+            enabled: ("media" | "r" | "agent" | "files" | "skills" | "documents" | "requirements" | "tables" | "charts" | "annotations" | "console" | "kernel")[];
             retainedReceipts: number;
             retainedFromVersion: number;
             maxReceipts: number;

package/dist/capabilities.js

@@ -10,6 +10,11 @@ const applicationContent = [
     'Start with rho_index: select an owner or search, then rho_resolve only the operations',
     'needed now. Use rho_call with the complete contractRef. The private connection supplies',
     'the project; discovery never grants additional authority or starts a runtime.',
+    'Independent third-party plugins: extension.list shows installed packages, extension.describe',
+    'gives their digest, operations and Skill entries. Read extension.content (kind skill)',
+    'before extension.call. Keep expectedDigest and the original changeId for a native call;',
+    'extension.read observes pending or unknown outcomes without rerunning. Installation and',
+    'management belong to the local person; plugin code never expands this connection grant.',
     'Large replies carry a result reference. Use rho_read to inspect its fields and fetch',
     'only selected text ranges or array pages. Retain useful references; release finished',
     'results explicitly. Never repeat an action just to retrieve a large reply.',
@@ -30,7 +35,7 @@ const applicationContent = [
     'run or export it as files; a stopped run is not resubmitted under its own operationId.'
 ].join('\n');
 const applicationSkill = {
-    id: 'rho.workspace', version: '1.5', content: applicationContent,
+    id: 'rho.workspace', version: '1.6', content: applicationContent,
     intent: 'Work in this project through versioned operations, in a safe order.',
     requires: ['capability.list', 'observation.snapshot', 'action.submit', 'composition.apply', 'context.read'],
     example: { method: 'observation.snapshot', input: { projectId: 'the-open-project' } },

package/dist/cli.js

@@ -2,6 +2,8 @@
 import path from 'node:path';
 import { parseArgs } from 'node:util';
 import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import os from 'node:os';
 import { spawn } from 'node:child_process';
 // A widened link is optional: the fragment carries a one-time code, which no request or Referer
 // sends and which the page redeems and removes. Opening the plain url needs no code at all.
@@ -33,7 +35,9 @@ function parseAcpCommand(spec) {
         throw new Error('--acp-command is empty.');
     return { file: parts[0], args: parts.slice(1) };
 }
-const usage = `Verify a read-only evidence package:
+const usage = `Develop, install and manage independent plugins:
+  rho plugin --help
+Verify a read-only evidence package:
   rho --verify-evidence PATH
 Start Rho on ~/Rho/projects and ~/Rho/state, and say where it is and what is missing:
   rho
@@ -41,10 +45,11 @@ Start Rho:
   rho --root PROJECTS_DIRECTORY --state-dir SERVICE_STATE [--core ABSOLUTE_CORE_BINARY] [--rscript ABSOLUTE_RSCRIPT] [--python PYTHON] [--ssh SSH] [--serverctl SERVERCTL] [--claude CLAUDE_CODE_BINARY] [--codex CODEX_BINARY] [--agent-backend claude-acp|codex-acp|claude-cli|acp] [--acp-command JSON_ARGV] [--port PORT] [--limits JSON_FILE] [--plugins documents,files,...] [--example on|off] [--open]
 A narrower browser link (optional):
   rho --pair PRIVATE_CONNECTION_FILE [--root PROJECTS_RELATIVE_DIRECTORY] [--open]
-Add Rho to your own Claude Code or Codex for one project, as the project page's button does:
+Add Rho to your own Claude Code or Codex for one project:
   rho --grant PRIVATE_CONNECTION_FILE --project PROJECTS_RELATIVE_DIRECTORY --agent claude-code|codex
-Give an Agent access to one project, and the command that adds it to Claude Code:
+Give any MCP Agent access to one project and print its stdio MCP configuration:
   rho --grant PRIVATE_CONNECTION_FILE --project PROJECTS_RELATIVE_DIRECTORY [--session NAME]
+  rho --grant PRIVATE_CONNECTION_FILE --project-id EXISTING_PROJECT_ID --session NAME
 Serve that access to the Agent over MCP (stdio):
   rho --mcp AGENT_CONNECTION_FILE
 Observe an external ACP client (use this as its agent command):
@@ -58,8 +63,24 @@ narrower, expiring link for one folder.
 PRIVATE_CONNECTION_FILE is the connectionFile the running service printed; it and every
 connection file are credentials.
 `;
+// DeepSeek Harness speaks ACP through its `acp` profile (`dsh acp`). It is used only when both the
+// launcher and that profile are on this computer; nothing is started to find them.
+async function harnessAcp() {
+    const home = process.env.DSH_HOME || path.join(os.homedir(), '.dsh');
+    const profile = await fs.stat(path.join(home, 'profiles', 'acp', 'package.json')).then(s => s.isFile(), () => false);
+    if (!profile)
+        return undefined;
+    const names = process.platform === 'win32' ? ['dsh.cmd', 'dsh.exe', 'dsh'] : ['dsh'];
+    for (const dir of (process.env.PATH ?? '').split(path.delimiter).filter(Boolean))
+        for (const name of names) {
+            const file = path.join(dir, name);
+            if (await fs.access(file, fsConstants.X_OK).then(() => true, () => false))
+                return { file, args: ['acp'] };
+        }
+    return undefined;
+}
 const options = { example: { type: 'string' }, 'verify-evidence': { type: 'string' }, acp: { type: 'string' }, 'acp-agent': { type: 'string' }, root: { type: 'string' }, 'state-dir': { type: 'string' }, core: { type: 'string' }, rscript: { type: 'string' }, python: { type: 'string' }, ssh: { type: 'string' }, serverctl: { type: 'string' }, claude: { type: 'string' }, codex: { type: 'string' }, 'agent-backend': { type: 'string' }, 'acp-command': { type: 'string' }, port: { type: 'string' }, limits: { type: 'string' }, plugins: { type: 'string' }, pair: { type: 'string' }, open: { type: 'boolean' },
-    grant: { type: 'string' }, project: { type: 'string' }, session: { type: 'string' }, agent: { type: 'string' }, mcp: { type: 'string' }, help: { type: 'boolean', short: 'h' } };
+    grant: { type: 'string' }, project: { type: 'string' }, 'project-id': { type: 'string' }, session: { type: 'string' }, agent: { type: 'string' }, mcp: { type: 'string' }, help: { type: 'boolean', short: 'h' } };
 // A command that is refused says why and what to do. A service that is not running is the
 // common case for --grant and --pair; anything without a known reason keeps its stack.
 function refuse(error, url) {
@@ -72,197 +93,219 @@ function refuse(error, url) {
         throw error;
     process.exit(1);
 }
-let parsed;
-try {
-    parsed = parseArgs({ options });
-}
-catch (error) {
-    process.stderr.write((error instanceof Error ? error.message : String(error)) + '\n\n' + usage);
-    process.exit(2);
-}
-const { values } = parsed;
-if (values['verify-evidence']) {
+if (process.argv[2] === 'plugin') {
     try {
-        const { verifyEvidence } = await import('./evidence-export.js');
-        process.stdout.write(JSON.stringify(await verifyEvidence(path.resolve(values['verify-evidence']))) + '\n');
+        await (await import('./plugin-cli.js')).pluginCli(process.argv.slice(3));
     }
-    catch (e) {
-        process.stderr.write((e instanceof Error ? e.message : String(e)) + '\n');
+    catch (error) {
+        process.stderr.write((error instanceof Error ? error.message : String(error)) + '\n');
         process.exitCode = 1;
     }
-    process.exit(process.exitCode ?? 0);
-}
-if (values.help) {
-    process.stdout.write(usage);
-    process.exit(0);
 }
-// The Agent's side of a grant: its MCP server reads the connection file and speaks on stdio,
-// so nothing else may write to stdout in this mode.
-if (values.acp) {
-    if (!['claude', 'codex'].includes(values['acp-agent'] ?? '')) {
-        process.stderr.write('Select --acp-agent claude or codex.\n');
+else {
+    let parsed;
+    try {
+        parsed = parseArgs({ options });
+    }
+    catch (error) {
+        process.stderr.write((error instanceof Error ? error.message : String(error)) + '\n\n' + usage);
         process.exit(2);
     }
-    const { runExternalAcp } = await import('@rho-workspace/plugin-agent/acp-cli');
-    runExternalAcp(path.resolve(values.acp), values['acp-agent']);
-}
-else if (values.mcp) {
-    process.env.RHO_AGENT_CONNECTION = path.resolve(values.mcp);
-    await import('@rho-workspace/plugin-agent/mcp');
-}
-else {
-    // Access comes from whoever runs Rho: the operator's connection grants one project to one
-    // Agent session, and the reply says how Claude Code starts that session's MCP server.
-    if (values.grant) {
-        if (!values.project) {
-            process.stderr.write('--grant needs --project, the project folder relative to the service root.\n\n' + usage);
-            process.exit(2);
+    const { values } = parsed;
+    if (values['verify-evidence']) {
+        try {
+            const { verifyEvidence } = await import('./evidence-export.js');
+            process.stdout.write(JSON.stringify(await verifyEvidence(path.resolve(values['verify-evidence']))) + '\n');
         }
-        if (values.agent !== undefined && !['claude-code', 'codex'].includes(values.agent)) {
-            process.stderr.write('Choose --agent claude-code or codex.\n');
-            process.exit(2);
+        catch (e) {
+            process.stderr.write((e instanceof Error ? e.message : String(e)) + '\n');
+            process.exitCode = 1;
         }
-        if (values.agent !== undefined && values.session !== undefined) {
-            process.stderr.write('--agent names the session itself; leave out --session.\n');
+        process.exit(process.exitCode ?? 0);
+    }
+    if (values.help) {
+        process.stdout.write(usage);
+        process.exit(0);
+    }
+    // The Agent's side of a grant: its MCP server reads the connection file and speaks on stdio,
+    // so nothing else may write to stdout in this mode.
+    if (values.acp) {
+        if (!['claude', 'codex'].includes(values['acp-agent'] ?? '')) {
+            process.stderr.write('Select --acp-agent claude or codex.\n');
             process.exit(2);
         }
-        const { RhoClient } = await import('./client.js');
-        const client = await RhoClient.fromFile(path.resolve(values.grant)).catch(error => refuse(error));
-        try {
-            const project = await client.call('project.open', { path: values.project });
-            // The same as the project page's button: the grant that Agent keeps, then its own
-            // `mcp add`, recorded so the page shows it under that Agent.
-            if (values.agent) {
-                const connected = await client.call('session.connect', { projectId: project.id, agent: values.agent });
-                process.stdout.write(JSON.stringify({ projectId: project.id, root: project.root, agent: values.agent, methods: connected.methods, granted: connected.granted, added: connected.added }) + '\n');
+        const { runExternalAcp } = await import('@rho-workspace/plugin-agent/acp-cli');
+        runExternalAcp(path.resolve(values.acp), values['acp-agent']);
+    }
+    else if (values.mcp) {
+        process.env.RHO_AGENT_CONNECTION = path.resolve(values.mcp);
+        await import('@rho-workspace/plugin-agent/mcp');
+    }
+    else {
+        // Access comes from whoever runs Rho: the operator's connection grants one project to one
+        // Agent session, and the reply says how Claude Code starts that session's MCP server.
+        if (values.grant) {
+            if (!!values.project === !!values['project-id']) {
+                process.stderr.write('--grant needs exactly one of --project (a folder relative to the service root) or --project-id (an existing project).\n\n' + usage);
+                process.exit(2);
+            }
+            if (values.agent !== undefined && !['claude-code', 'codex'].includes(values.agent)) {
+                process.stderr.write('Choose --agent claude-code or codex.\n');
+                process.exit(2);
+            }
+            if (values.agent !== undefined && values.session !== undefined) {
+                process.stderr.write('--agent names the session itself; leave out --session.\n');
+                process.exit(2);
+            }
+            const { RhoClient } = await import('./client.js');
+            const client = await RhoClient.fromFile(path.resolve(values.grant)).catch(error => refuse(error));
+            try {
+                const project = values['project-id']
+                    ? (await client.call('project.list', {})).find(p => p.id === values['project-id'])
+                    : await client.call('project.open', { path: values.project });
+                if (!project) {
+                    process.stderr.write('Project is not registered or is outside this connection’s scope. Open the project in Rho and copy its setup prompt again.\n');
+                    process.exit(1);
+                }
+                // The same as the project page's button: the grant that Agent keeps, then its own
+                // `mcp add`, recorded so the page shows it under that Agent.
+                if (values.agent) {
+                    const connected = await client.call('session.connect', { projectId: project.id, agent: values.agent });
+                    process.stdout.write(JSON.stringify({ projectId: project.id, root: project.root, agent: values.agent, methods: connected.methods, granted: connected.granted, added: connected.added }) + '\n');
+                    process.exit(0);
+                }
+                const session = values.session ?? 'claude-code';
+                const granted = await client.call('session.grant', { projectId: project.id, externalSessionId: session });
+                const { mcpCommand, mcpName } = await import('./agent-connect.js');
+                const command = mcpCommand(granted.connectionFile), name = mcpName(project.root);
+                const quote = (value) => /^[A-Za-z0-9_./:@=-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+                process.stdout.write(JSON.stringify({ projectId: project.id, session, connectionFile: granted.connectionFile, methods: granted.methods.length,
+                    mcp: { name, command: command[0], args: command.slice(1) }, claude: ['claude', 'mcp', 'add', name, '--', ...command].map(quote).join(' ') }) + '\n');
                 process.exit(0);
             }
-            const session = values.session ?? 'claude-code';
-            const granted = await client.call('session.grant', { projectId: project.id, externalSessionId: session });
-            const { mcpCommand, mcpName } = await import('./agent-connect.js');
-            const command = mcpCommand(granted.connectionFile), name = mcpName(project.root);
-            const quote = (value) => /^[A-Za-z0-9_./:@=-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-            process.stdout.write(JSON.stringify({ projectId: project.id, session, connectionFile: granted.connectionFile, methods: granted.methods.length,
-                mcp: { name, command: command[0], args: command.slice(1) }, claude: ['claude', 'mcp', 'add', name, '--', ...command].map(quote).join(' ') }) + '\n');
-            process.exit(0);
+            catch (error) {
+                refuse(error, client.connection.url);
+            }
         }
-        catch (error) {
-            refuse(error, client.connection.url);
+        if (values.pair) {
+            const { RhoClient } = await import('./client.js');
+            const client = await RhoClient.fromFile(path.resolve(values.pair)).catch(error => refuse(error));
+            try {
+                const pairing = await client.call('session.browser.pair', values.root ? { path: values.root } : {});
+                const openUrl = link(client.connection.url, pairing.code);
+                process.stdout.write(JSON.stringify({ url: client.connection.url, openUrl, pairingCode: pairing.code, pairingExpiresAt: pairing.expiresAt }) + '\n');
+                if (values.open)
+                    openBrowser(openUrl);
+                process.exit(0);
+            }
+            catch (error) {
+                refuse(error, client.connection.url);
+            }
         }
-    }
-    if (values.pair) {
-        const { RhoClient } = await import('./client.js');
-        const client = await RhoClient.fromFile(path.resolve(values.pair)).catch(error => refuse(error));
-        try {
-            const pairing = await client.call('session.browser.pair', values.root ? { path: values.root } : {});
-            const openUrl = link(client.connection.url, pairing.code);
-            process.stdout.write(JSON.stringify({ url: client.connection.url, openUrl, pairingCode: pairing.code, pairingExpiresAt: pairing.expiresAt }) + '\n');
-            if (values.open)
-                openBrowser(openUrl);
-            process.exit(0);
+        // A person who runs `npx @rho-workspace/rho` with no arguments wants the application, not a
+        // usage page: start it on their own folders, say in plain words where it is, and open it when
+        // this is an interactive terminal. Every flagged start is unchanged, so scripts and
+        // acceptance runs keep the output they read.
+        const quickStart = !values.root && !values['state-dir'];
+        if (!quickStart && (!values.root || !values['state-dir'])) {
+            process.stderr.write(usage);
+            process.exit(2);
         }
-        catch (error) {
-            refuse(error, client.connection.url);
+        let quickRoot = '', quickState = '';
+        if (quickStart) {
+            const { homedir } = await import('node:os');
+            quickRoot = path.join(homedir(), 'Rho', 'projects');
+            quickState = path.join(homedir(), 'Rho', 'state');
+            await fs.mkdir(quickRoot, { recursive: true });
+            await fs.mkdir(quickState, { recursive: true });
         }
-    }
-    // A person who runs `npx @rho-workspace/rho` with no arguments wants the application, not a
-    // usage page: start it on their own folders, say in plain words where it is, and open it when
-    // this is an interactive terminal. Every flagged start is unchanged, so scripts and
-    // acceptance runs keep the output they read.
-    const quickStart = !values.root && !values['state-dir'];
-    if (!quickStart && (!values.root || !values['state-dir'])) {
-        process.stderr.write(usage);
-        process.exit(2);
-    }
-    let quickRoot = '', quickState = '';
-    if (quickStart) {
-        const { homedir } = await import('node:os');
-        quickRoot = path.join(homedir(), 'Rho', 'projects');
-        quickState = path.join(homedir(), 'Rho', 'state');
-        await fs.mkdir(quickRoot, { recursive: true });
-        await fs.mkdir(quickState, { recursive: true });
-    }
-    const projectsRoot = values.root ?? quickRoot, stateDirectory = values['state-dir'] ?? quickState;
-    const limits = values.limits ? JSON.parse(await fs.readFile(values.limits, 'utf8')) : {};
-    const allowed = new Set(['maxRequestBytes', 'maxEventBytes', 'eventRetention', 'maxSubscriptions', 'maxQueue', 'maxContexts', 'maxBindings', 'maxActivities', 'maxContextBytes', 'maxRetainedMetadataBytes', 'maxConcurrentActions', 'maxOperations', 'maxLogPageBytes', 'maxCodeBytes', 'maxReconciled', 'documents', 'resources', 'workspace', 'r', 'annotations', 'interactions', 'capabilityLimits', 'browser', 'nativeFolders', 'conversations', 'evidence', 'console']);
-    if (Object.keys(limits).some(k => !allowed.has(k)))
-        throw new Error('Unknown service budget in --limits file.');
-    const { RhoService } = await import('./server.js'), { runtime } = await import('./runtime.js');
-    const agentBackend = values['agent-backend'] ?? process.env.RHO_AGENT_BACKEND ?? 'claude-acp';
-    if (!['claude-acp', 'codex-acp', 'claude-cli', 'acp'].includes(agentBackend))
-        throw new Error('Choose --agent-backend claude-acp, codex-acp, claude-cli or acp.');
-    const acpCommand = agentBackend === 'acp' ? parseAcpCommand(values['acp-command'] ?? process.env.RHO_ACP_COMMAND) : undefined;
-    if (values.port !== undefined && !(/^\d+$/.test(values.port) && Number(values.port) <= 65535)) {
-        process.stderr.write('Choose --port 0 to 65535, or leave it out.\n');
-        process.exit(2);
-    }
-    // A Core that cannot be used (none for this platform, a changed digest) is read by a person.
-    const native = await runtime(values.core, values.rscript).catch(e => { process.stderr.write((e instanceof Error ? e.message : String(e)) + '\n'); process.exit(1); });
-    // A person starting Rho sees the project it ships with; a composition that starts a service
-    // for its own work says so itself and is left alone.
-    if (values.example !== undefined && !['on', 'off'].includes(values.example))
-        throw new Error('Choose --example on or off.');
-    const example = values.example !== 'off';
-    const service = await new RhoService({ example, ...limits, root: path.resolve(projectsRoot), stateDir: path.resolve(stateDirectory), ...native, agentBackend: agentBackend, acpCommand, codex: values.codex ?? process.env.RHO_CODEX ?? 'codex', claude: values.claude ?? process.env.RHO_CLAUDE ?? 'claude', python: values.python ?? process.env.RHO_PYTHON, ssh: values.ssh ?? process.env.RHO_SSH, serverctl: values.serverctl ?? process.env.RHO_SERVERCTL, port: values.port === undefined ? undefined : Number(values.port), ...(values.plugins !== undefined ? { plugins: values.plugins ? values.plugins.split(',') : [] } : {}) }).start().catch(async (error) => {
-        // Starting Rho again on a state it already runs on is the common refusal: say where it runs.
-        const held = error?.details?.stateDirectory;
-        const running = typeof held === 'string' ? await fs.readFile(path.join(held, 'connection.json'), 'utf8').then(text => String(JSON.parse(text).url), () => '') : '';
-        return refuse(running ? Object.assign(error, { message: `Rho is already running for ${held} at ${running}. Open that url, or stop that service before starting it again.` }) : error);
-    });
-    // The narrow conclusion a person needs on one line: what was selected, where state
-    // lives, and how to open it. It stays inside `ready` so a parser reading line one is
-    // unaffected. Opening this url on this machine is the access; no link is minted.
-    const rscript = values.rscript ?? process.env.RHO_RSCRIPT ?? 'Rscript';
-    process.stdout.write(JSON.stringify({ ready: {
-            url: service.url, connectionFile: path.join(service.state.directory, 'connection.json'), apiVersion: '2.0',
-            openUrl: service.url,
-            startup: {
-                projects: path.resolve(projectsRoot), state: path.resolve(stateDirectory),
-                core: service.bridge.binary, rscript: service.bridge.rscript,
-                note: 'Open this url in a browser on this machine. Execution stays off until an Agent submits a run; project.doctor answers what is missing.'
+        const projectsRoot = values.root ?? quickRoot, stateDirectory = values['state-dir'] ?? quickState;
+        const limits = values.limits ? JSON.parse(await fs.readFile(values.limits, 'utf8')) : {};
+        const allowed = new Set(['maxRequestBytes', 'maxEventBytes', 'eventRetention', 'maxSubscriptions', 'maxQueue', 'maxContexts', 'maxBindings', 'maxActivities', 'maxContextBytes', 'maxRetainedMetadataBytes', 'maxConcurrentActions', 'maxOperations', 'maxLogPageBytes', 'maxCodeBytes', 'maxReconciled', 'documents', 'resources', 'workspace', 'r', 'annotations', 'interactions', 'capabilityLimits', 'browser', 'nativeFolders', 'conversations', 'evidence', 'console']);
+        if (Object.keys(limits).some(k => !allowed.has(k)))
+            throw new Error('Unknown service budget in --limits file.');
+        const { RhoService } = await import('./server.js'), { runtime } = await import('./runtime.js');
+        const agentBackend = values['agent-backend'] ?? process.env.RHO_AGENT_BACKEND ?? 'claude-acp';
+        if (!['claude-acp', 'codex-acp', 'claude-cli', 'acp'].includes(agentBackend))
+            throw new Error('Choose --agent-backend claude-acp, codex-acp, claude-cli or acp.');
+        // An ACP command named here, or else DeepSeek Harness's own ACP profile when it is installed, so
+        // sessions started in Harness continue in Rho too. Naming one does not make it the default Agent.
+        const named = values['acp-command'] ?? process.env.RHO_ACP_COMMAND;
+        const acpCommand = agentBackend === 'acp' || named ? parseAcpCommand(named) : await harnessAcp();
+        if (values.port !== undefined && !(/^\d+$/.test(values.port) && Number(values.port) <= 65535)) {
+            process.stderr.write('Choose --port 0 to 65535, or leave it out.\n');
+            process.exit(2);
+        }
+        // A Core that cannot be used (none for this platform, a changed digest) is read by a person.
+        const native = await runtime(values.core, values.rscript).catch(e => { process.stderr.write((e instanceof Error ? e.message : String(e)) + '\n'); process.exit(1); });
+        // A person starting Rho sees the project it ships with; a composition that starts a service
+        // for its own work says so itself and is left alone.
+        if (values.example !== undefined && !['on', 'off'].includes(values.example))
+            throw new Error('Choose --example on or off.');
+        const example = values.example !== 'off';
+        const service = await new RhoService({ example, ...limits, root: path.resolve(projectsRoot), stateDir: path.resolve(stateDirectory), ...native, agentBackend: agentBackend, acpCommand, codex: values.codex ?? process.env.RHO_CODEX ?? 'codex', claude: values.claude ?? process.env.RHO_CLAUDE ?? 'claude', python: values.python ?? process.env.RHO_PYTHON, ssh: values.ssh ?? process.env.RHO_SSH, serverctl: values.serverctl ?? process.env.RHO_SERVERCTL, port: values.port === undefined ? undefined : Number(values.port), ...(values.plugins !== undefined ? { plugins: values.plugins ? values.plugins.split(',') : [] } : {}) }).start().catch(async (error) => {
+            // Starting Rho again on a state it already runs on is the common refusal: say where it runs.
+            const held = error?.details?.stateDirectory;
+            const running = typeof held === 'string' ? await fs.readFile(path.join(held, 'connection.json'), 'utf8').then(text => String(JSON.parse(text).url), () => '') : '';
+            return refuse(running ? Object.assign(error, { message: `Rho is already running for ${held} at ${running}. Open that url, or stop that service before starting it again.` }) : error);
+        });
+        // The narrow conclusion a person needs on one line: what was selected, where state
+        // lives, and how to open it. It stays inside `ready` so a parser reading line one is
+        // unaffected. Opening this url on this machine is the access; no link is minted.
+        const rscript = values.rscript ?? process.env.RHO_RSCRIPT ?? 'Rscript';
+        process.stdout.write(JSON.stringify({ ready: {
+                url: service.url, connectionFile: path.join(service.state.directory, 'connection.json'), apiVersion: '2.0',
+                openUrl: service.url,
+                startup: {
+                    projects: path.resolve(projectsRoot), state: path.resolve(stateDirectory),
+                    core: service.bridge.binary, rscript: service.bridge.rscript,
+                    note: 'Open this url in a browser on this machine. Execution stays off until an Agent submits a run; project.doctor answers what is missing.'
+                }
+            } }) + '\n');
+        // What a person needs, after the machine line: where it is, and what is missing to work in it.
+        // A missing Agent or R does not stop the workspace; it decides what the person can do next.
+        if (quickStart) {
+            const say = (text) => process.stdout.write(text + '\n');
+            say('');
+            say('Rho is running. Open this address in a browser on this machine:');
+            say('  ' + service.url);
+            say('');
+            say('Projects folder: ' + quickRoot);
+            say('Service state:   ' + quickState);
+            say('');
+            const agentCommand = await import('@rho-workspace/plugin-agent/acp-command').catch(() => null);
+            // The selection the service itself got: an explicit flag, then the environment, then the name
+            // on PATH. Reporting "installed" for a client the person pointed at a missing path is worse
+            // than saying nothing.
+            const claudePath = values.claude ?? process.env.RHO_CLAUDE, codexPath = values.codex ?? process.env.RHO_CODEX;
+            const env = { ...process.env, ...(claudePath ? { CLAUDE_CODE_EXECUTABLE: claudePath } : {}), ...(codexPath ? { CODEX_PATH: codexPath } : {}) };
+            // An ACP agent named with --acp-command is the operator's own command; it is named, not checked.
+            if (acpCommand && agentBackend === 'acp')
+                say('Agent: ' + acpCommand.file + ', named with --acp-command.');
+            else {
+                if (acpCommand)
+                    say('Also: ' + (acpCommand.args[0] === 'acp' && /dsh(\.[a-z]+)?$/i.test(acpCommand.file) ? 'DeepSeek Harness (' + acpCommand.file + ' acp)' : acpCommand.file) + ', so its sessions can continue here.');
+                const missing = agentCommand ? agentCommand.missingClient(agentBackend === 'codex-acp' ? 'codex' : 'claude', env) : null;
+                say(missing
+                    ? 'Agent: ' + missing + ' Until then folders can be opened and files read here; the Agent cannot run in them.'
+                    : 'Agent: ' + (agentBackend === 'codex-acp' ? 'Codex' : 'Claude Code') + ' is installed; a conversation can start in any project.');
             }
-        } }) + '\n');
-    // What a person needs, after the machine line: where it is, and what is missing to work in it.
-    // A missing Agent or R does not stop the workspace; it decides what the person can do next.
-    if (quickStart) {
-        const say = (text) => process.stdout.write(text + '\n');
-        say('');
-        say('Rho is running. Open this address in a browser on this machine:');
-        say('  ' + service.url);
-        say('');
-        say('Projects folder: ' + quickRoot);
-        say('Service state:   ' + quickState);
-        say('');
-        const agentCommand = await import('@rho-workspace/plugin-agent/acp-command').catch(() => null);
-        // The selection the service itself got: an explicit flag, then the environment, then the name
-        // on PATH. Reporting "installed" for a client the person pointed at a missing path is worse
-        // than saying nothing.
-        const claudePath = values.claude ?? process.env.RHO_CLAUDE, codexPath = values.codex ?? process.env.RHO_CODEX;
-        const env = { ...process.env, ...(claudePath ? { CLAUDE_CODE_EXECUTABLE: claudePath } : {}), ...(codexPath ? { CODEX_PATH: codexPath } : {}) };
-        // An ACP agent named with --acp-command is the operator's own command; it is named, not checked.
-        if (acpCommand)
-            say('Agent: ' + acpCommand.file + ', named with --acp-command.');
-        else {
-            const missing = agentCommand ? agentCommand.missingClient(agentBackend === 'codex-acp' ? 'codex' : 'claude', env) : null;
-            say(missing
-                ? 'Agent: ' + missing + ' Until then folders can be opened and files read here; the Agent cannot run in them.'
-                : 'Agent: ' + (agentBackend === 'codex-acp' ? 'Codex' : 'Claude Code') + ' is installed; a conversation can start in any project.');
+            const hasR = await fs.access(service.bridge.rscript).then(() => true, () => false);
+            say(hasR
+                ? 'R: ' + service.bridge.rscript
+                : 'R: Rscript was not found. Reading, editing and viewing work; running R needs R installed (or --rscript).');
+            say('');
+            say('Stop it with Ctrl+C. Start it again with: npx @rho-workspace/rho');
+            if (process.stdout.isTTY)
+                openBrowser(service.url);
         }
-        const hasR = await fs.access(service.bridge.rscript).then(() => true, () => false);
-        say(hasR
-            ? 'R: ' + service.bridge.rscript
-            : 'R: Rscript was not found. Reading, editing and viewing work; running R needs R installed (or --rscript).');
-        say('');
-        say('Stop it with Ctrl+C. Start it again with: npx @rho-workspace/rho');
-        if (process.stdout.isTTY)
+        if (values.open)
             openBrowser(service.url);
+        let closing = false;
+        // Windows has no SIGTERM another process can send, and a console may pass on Ctrl+C turned off;
+        // there Ctrl+Break on Rho's console (SIGBREAK) stops it in order too.
+        for (const signal of ['SIGTERM', 'SIGINT', ...(process.platform === 'win32' ? ['SIGBREAK'] : [])])
+            process.on(signal, async () => { if (closing)
+                return; closing = true; const reports = await service.close(); process.stdout.write(JSON.stringify({ shutdown: reports }) + '\n'); });
     }
-    if (values.open)
-        openBrowser(service.url);
-    let closing = false;
-    // Windows has no SIGTERM another process can send, and a console may pass on Ctrl+C turned off;
-    // there Ctrl+Break on Rho's console (SIGBREAK) stops it in order too.
-    for (const signal of ['SIGTERM', 'SIGINT', ...(process.platform === 'win32' ? ['SIGBREAK'] : [])])
-        process.on(signal, async () => { if (closing)
-            return; closing = true; const reports = await service.close(); process.stdout.write(JSON.stringify({ shutdown: reports }) + '\n'); });
 }