@saadnvd1/agent-os 0.3.662 → 0.3.671

package/lib/orchestrator/write-guard.ts

@@ -1,5 +1,7 @@
 /**
- * Where an orchestrator may write. Anywhere on the machine except the
+ * Where an orchestrator may write (unless its workspace has Orchestrator full
+ * access on, the default: orchestratorToolRefusal then checks nothing but
+ * warns about stopping AgentOS; full-access.ts). Anywhere on the machine except the
  * workspace's project repositories and their task worktrees (code changes go
  * through tasks, so the merge gates keep meaning something), AgentOS's own
  * install and state (all of ~/.agent-os but its own folder), secret files,
@@ -12,18 +14,21 @@
  * `..` resolved the way the system will resolve it.
  */
 
+import { agentosHome } from "../agentos-home";
 import { execFile } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
 import { db, type Session } from "../db";
+import type { ToolGuardResult } from "../chat/driver";
 import { git, GitError } from "../git-exec";
 import { isOrchestratorSecretPath as isSecretPath } from "../secret-paths";
 import { WORKTREES_DIR } from "../worktrees";
 import { orchestratorDir } from "./home";
 import { LIMITS_FILE } from "./usage";
 import { quickWorktrees } from "./quick-store";
-import { shellRefusal } from "./shell-guard";
+import { shellRefusal, shellWarning, type ShellContext } from "./shell-guard";
+import { orchestratorFullAccess } from "./full-access";
 import { liveCheckout } from "../dev-instance/liveServer";
 
 // The tools that write a file, and the argument naming it.
@@ -296,9 +301,9 @@ export async function orchestratorWriteBounds(
     memory: [...new Set([cwd, await physicalPath(cwd)])].map((c) =>
       path.join(os.homedir(), ".claude", "projects", mangleCwd(c), "memory")
     ),
-    audits: path.join(os.homedir(), ".agent-os", "audits"),
+    audits: agentosHome("audits"),
     quick: quickWorktrees(session.id),
-    state: path.join(os.homedir(), ".agent-os"),
+    state: agentosHome(),
     repos: [...repos, WORKTREES_DIR, process.cwd(), path.dirname(dbPath)],
   };
 }
@@ -365,24 +370,47 @@ export async function orchestratorToolRefusal(
   session: Session,
   tool: string,
   input: Record<string, unknown>
-): Promise<string | null> {
-  if (tool === "Bash") return commandRefusal(session, input.command);
+): Promise<ToolGuardResult> {
+  const full = orchestratorFullAccess(session);
+  if (tool === "Bash")
+    return full
+      ? commandWarning(session, input.command)
+      : commandRefusal(session, input.command);
   const arg = WRITE_TOOLS[tool];
   if (!arg) return null;
   const filePath = input[arg];
+  if (full) return null;
   if (typeof filePath !== "string") return "No file path to check.";
   return writeRefusal(filePath, await orchestratorWriteBounds(session));
 }
 
+// With full access: only a warning for stopping AgentOS or its tmux.
+async function commandWarning(
+  session: Session,
+  command: unknown
+): Promise<ToolGuardResult> {
+  const warning = await shellWarning(
+    command,
+    shellContext(session, await orchestratorWriteBounds(session))
+  );
+  return warning ? { warning } : null;
+}
+
 // A shell command, against the deny list (shell-guard.ts), its writes held
 // to the shell's share of the write bounds.
 async function commandRefusal(
   session: Session,
   command: unknown
 ): Promise<string | null> {
-  const bounds = await orchestratorWriteBounds(session);
+  return shellRefusal(
+    command,
+    shellContext(session, await orchestratorWriteBounds(session))
+  );
+}
+
+function shellContext(session: Session, bounds: WriteBounds): ShellContext {
   const dbFile = agentOsDbPath();
-  return shellRefusal(command, {
+  return {
     cwd: bounds.cwd,
     writeRefusal: (p) => writeRefusal(p, bounds, { shell: true }),
     isAgentOsState: async (p) => {
@@ -401,7 +429,7 @@ async function commandRefusal(
     },
     checkoutKind: (dir) => checkoutKind(session, dir),
     protectedPids,
-  });
+  };
 }
 
 // Whether a folder is a project checkout of the session's own workspace

package/lib/plans/features.ts

@@ -1,6 +1,7 @@
 // A plan that split into pieces: the feature, its pieces, and the one-time
 // checks that turn a plan file into rows. A one-piece plan makes none.
 
+import { agentosHome } from "../agentos-home";
 import fs from "fs";
 import os from "os";
 import path from "path";
@@ -61,8 +62,7 @@ export interface FeaturePiece {
 const expandHome = (p: string) => p.replace(/^~/, os.homedir());
 
 export const plansDir = () =>
-  process.env.AGENTOS_PLANS_DIR ||
-  path.join(os.homedir(), ".agent-os", "plans");
+  process.env.AGENTOS_PLANS_DIR || agentosHome("plans");
 export const planPathOf = (featureId: string) =>
   path.join(plansDir(), `${featureId}.md`);
 

package/lib/program-status/claude-hooks.ts

@@ -1,9 +1,9 @@
+import { agentosHome } from "../agentos-home";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { NO_ATTRIBUTION } from "../agents/attribution";
 
-const DIR = path.join(os.homedir(), ".agent-os");
+const DIR = agentosHome();
 const HOOK = path.join(DIR, "bin", "agentos-status");
 const SETTINGS = path.join(DIR, "claude-status-hooks.json");
 const SUBAGENT_HOOK = path.join(DIR, "bin", "agentos-subagent-model.mjs");

package/lib/program-status/tap.ts

@@ -9,9 +9,9 @@
  * Remote-host sessions are not tapped: their output never passes through
  * this machine except while attached. They keep reading the screen.
  */
+import { agentosHome } from "../agentos-home";
 import fs from "fs";
 import net from "net";
-import os from "os";
 import path from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -50,7 +50,7 @@ const replied = new Map<string, number>();
 
 // In a directory only this user can enter: only they can write reports.
 export function tapSocketPath(port: number): string {
-  return path.join(os.homedir(), ".agent-os", "run", `osc-${port}.sock`);
+  return agentosHome("run", `osc-${port}.sock`);
 }
 
 async function foreground(name: string): Promise<string | undefined> {

package/lib/project-config/brief.ts

@@ -18,9 +18,11 @@ import { simulatorBrief } from "../simulator/brief";
 export function runningBrief(
   config: ProjectConfig,
   ports: Record<string, number>,
-  database: SessionDatabase | null = null
+  database: SessionDatabase | null = null,
+  warning: string | null = null
 ): string {
   const lines: string[] = [];
+  if (warning) lines.push(`- ${warning}`);
   const names = Object.entries(ports);
   if (names.length)
     lines.push(

package/lib/project-config/database.ts

@@ -41,8 +41,14 @@ export type PgRun = (
   env: NodeJS.ProcessEnv
 ) => Promise<{ code: number; out: string }>;
 
-const pgRun: PgRun = (cmd, args, env) =>
+export const pgRun: PgRun = (cmd, args, env) =>
   new Promise((resolve) => {
+    // A test that reached the real server could list or drop the owner's
+    // databases: every test injects its own run.
+    if (process.env.VITEST)
+      throw new Error(
+        "Refusing to run the real Postgres tools under the test runner"
+      );
     execFile(
       cmd,
       args,
@@ -66,10 +72,10 @@ const pgRun: PgRun = (cmd, args, env) =>
 // A plain database name: never a connection string (`host=…`,
 // `postgres://…`) or an option, which pg_dump would take as one.
 const DB_NAME = /^[A-Za-z0-9_][A-Za-z0-9_$.-]{0,62}$/;
-const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
+export const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
 // One socket folder: libpq reads a comma as a list of hosts to try in turn,
 // so `/nope,db.example.com` would reach the second.
-const SOCKET_DIR = /^\/[^,=\s'"\\]*$/;
+export const SOCKET_DIR = /^\/[^,=\s'"\\]*$/;
 
 // Why `declared` can't be used, or null. A socket folder is local too.
 export function refusal(declared: DatabaseDecl): string | null {
@@ -86,13 +92,22 @@ export function refusal(declared: DatabaseDecl): string | null {
   return null;
 }
 
-const MARK = (sessionId: string) => `agentos session ${sessionId}`;
+export const MARK = (sessionId: string) => `agentos session ${sessionId}`;
 const PENDING = (sessionId: string) => `${MARK(sessionId)} (copying)`;
 
+export const sessionHash = (sessionId: string) =>
+  createHash("sha256").update(sessionId).digest("hex").slice(0, 12);
+
+// The token a session's copy carries, and so does anything a project derives
+// from it (`<copy>_test`, `<from>_test_aos_<hash>`): the one convention that
+// says AgentOS's session made a database.
+const TASK_DB = /_aos_([0-9a-f]{12})(?:_[A-Za-z0-9]+)*$/;
+export const taskHashOf = (name: string): string | null =>
+  TASK_DB.exec(name)?.[1] ?? null;
+
 // `<from>_aos_<12 hex of the session id>`, within Postgres's 63 bytes.
 export function databaseName(from: string, sessionId: string): string {
-  const hash = createHash("sha256").update(sessionId).digest("hex");
-  const suffix = `_aos_${hash.slice(0, 12)}`;
+  const suffix = `_aos_${sessionHash(sessionId)}`;
   return `${from.slice(0, 63 - suffix.length)}${suffix}`;
 }
 
@@ -122,7 +137,7 @@ const oneLine = (s: string, n = 200) => {
 };
 
 // Every database on the server with its comment, or why there's no answer.
-async function listDatabases(
+export async function listDatabases(
   run: PgRun,
   env: NodeJS.ProcessEnv
 ): Promise<Map<string, string> | string> {
@@ -165,7 +180,7 @@ async function copy(
   // recognised and remade rather than left or reused half-filled.
   const created = await run(
     "createdb",
-    ["-T", "template0", target, PENDING(sessionId)],
+    ["-T", "template0", "--", target, PENDING(sessionId)],
     env
   );
   if (created.code !== 0)
@@ -175,7 +190,7 @@ async function copy(
   try {
     let step = await run(
       "pg_dump",
-      ["--no-owner", "--no-privileges", "-f", dump, from],
+      ["--no-owner", "--no-privileges", "-f", dump, "--", from],
       env
     );
     if (step.code === 0) {
@@ -191,7 +206,7 @@ async function copy(
       );
     }
     if (step.code !== 0) {
-      await run("dropdb", ["--if-exists", target], env);
+      await run("dropdb", ["--if-exists", "--", target], env);
       return `could not copy ${from} into ${target} (${oneLine(step.out, 300)}); ${target} was dropped again`;
     }
     return null;
@@ -243,7 +258,7 @@ async function makeDatabase(
     // An interrupted copy of ours: made again from the start.
     if (!record({ ...state, name: target, pending: true }))
       return { ...state, error: ENDED };
-    const dropped = await run("dropdb", ["--if-exists", target], env);
+    const dropped = await run("dropdb", ["--if-exists", "--", target], env);
     if (dropped.code !== 0)
       return {
         ...state,
@@ -399,7 +414,10 @@ async function dropDatabase(
     console.warn(`[database] ${name} left: ${listed}`);
     return;
   }
-  if (!listed.has(name)) return void forget();
+  if (!listed.has(name)) {
+    await dropDerived(sessionId, state, listed, run, env);
+    return void forget();
+  }
   const comment = listed.get(name);
   if (comment !== MARK(sessionId) && comment !== PENDING(sessionId)) {
     console.warn(`[database] ${name} left: AgentOS didn't make it`);
@@ -408,9 +426,52 @@ async function dropDatabase(
   // The session is over: a dev server left running in its worktree and
   // still connected is a straggler, ended by --force (Postgres 13+; a plain
   // drop for an older server).
-  let dropped = await run("dropdb", ["--if-exists", "--force", name], env);
+  let dropped = await run(
+    "dropdb",
+    ["--if-exists", "--force", "--", name],
+    env
+  );
   if (dropped.code !== 0)
-    dropped = await run("dropdb", ["--if-exists", name], env);
-  if (dropped.code === 0) forget();
-  else console.warn(`[database] ${name} left: ${oneLine(dropped.out)}`);
+    dropped = await run("dropdb", ["--if-exists", "--", name], env);
+  if (dropped.code === 0) {
+    await dropDerived(sessionId, state, listed, run, env);
+    forget();
+  } else console.warn(`[database] ${name} left: ${oneLine(dropped.out)}`);
+}
+
+// What the project's own tooling made from the copy (a Rails `_test`
+// database): same session token, never the declared source.
+async function dropDerived(
+  sessionId: string,
+  state: SessionDatabase,
+  listed: Map<string, string>,
+  run: PgRun,
+  env: NodeJS.ProcessEnv
+): Promise<void> {
+  const hash = sessionHash(sessionId);
+  for (const other of listed.keys()) {
+    if (other === state.from || other === state.name) continue;
+    if (taskHashOf(other) !== hash) continue;
+    // A plain drop, and not while anyone is connected: it is another
+    // task's or a person's session if the token matches by accident.
+    const busy = await run(
+      "psql",
+      [
+        "-X",
+        "-d",
+        "postgres",
+        "-tAq",
+        "-c",
+        `select count(*) from pg_stat_activity where datname = ${quoteLiteral(other)}`,
+      ],
+      env
+    );
+    if (busy.code !== 0 || Number(busy.out.trim()) > 0) {
+      console.warn(`[database] ${other} left: connected or unreadable`);
+      continue;
+    }
+    const done = await run("dropdb", ["--if-exists", "--", other], env);
+    if (done.code !== 0)
+      console.warn(`[database] ${other} left: ${oneLine(done.out)}`);
+  }
 }

package/lib/project-config/index.ts

@@ -1,17 +1,28 @@
 /**
- * The one reader of a project's config: `agentos.json`, else `.dispatch.json`,
- * else the legacy `.agent-os/worktrees.json` / `.agent-os.json`. The first
- * file that exists is the config; a broken one is an error, never a reason
- * to read the next. Design: docs/decisions/2026-10-10-agentos-json.md.
+ * The one reader of a project's config: `agentos.json` and `.dispatch.json`
+ * together, else the legacy `.agent-os/worktrees.json` / `.agent-os.json`
+ * (the first of those that exists). A broken file is an error, never a
+ * reason to read the next or to ignore it.
+ *
+ * When both agentos.json and .dispatch.json exist they merge by top-level
+ * key: agentos.json wins any key it sets, and its value replaces
+ * .dispatch.json's whole (no deep merge, so a partial `browse` never mixes
+ * with the old one); keys only .dispatch.json has still apply, after its
+ * normalization (`workspace` becomes `cards.workspace`, dispatch-only keys
+ * are dropped). `inherited` names those keys and `warning` says to move them.
+ * Design: docs/decisions/2026-10-10-agentos-json.md.
  */
 
 import * as fs from "fs";
 import * as path from "path";
 import type { z } from "zod";
 import {
+  agentosFields,
   agentosJson,
+  dispatchFields,
   dispatchJson,
   legacyJson,
+  mergedJson,
   RESERVED_ENV,
   type ProjectConfig,
 } from "./schema";
@@ -34,9 +45,20 @@ export interface LoadedConfig {
   source: string | null;
   // Why the file was refused, naming it and every bad field.
   error: string | null;
+  // Top-level keys that came from .dispatch.json because agentos.json lacks
+  // them; empty unless both files exist.
+  inherited: string[];
+  // One line for the brief when both files exist; null otherwise.
+  warning: string | null;
 }
 
-const NONE: LoadedConfig = { config: {}, source: null, error: null };
+export const NONE: LoadedConfig = Object.freeze({
+  config: {},
+  source: null,
+  error: null,
+  inherited: Object.freeze([]) as unknown as string[],
+  warning: null,
+});
 
 function describe(file: string, error: z.ZodError): string {
   const fields = error.issues.map((i) => {
@@ -61,7 +83,9 @@ function fromLegacy(raw: z.infer<typeof legacyJson>): ProjectConfig {
   return config;
 }
 
-function parse(file: string, text: string): LoadedConfig {
+// `checked: false` leaves the port-name check to the merge, which can see
+// the ports the other file declares.
+function parse(file: string, text: string, checked = true): LoadedConfig {
   let raw: unknown;
   try {
     raw = JSON.parse(text);
@@ -73,31 +97,102 @@ function parse(file: string, text: string): LoadedConfig {
     };
   }
   if (file === "agentos.json") {
-    const got = agentosJson.safeParse(raw);
+    const got = (checked ? agentosJson : agentosFields).safeParse(raw);
     return got.success
-      ? { config: got.data, source: file, error: null }
+      ? { ...NONE, config: got.data, source: file }
       : { ...NONE, source: file, error: describe(file, got.error) };
   }
   if (file === ".dispatch.json") {
-    const got = dispatchJson.safeParse(raw);
+    const got = (checked ? dispatchJson : dispatchFields).safeParse(raw);
     if (!got.success)
       return { ...NONE, source: file, error: describe(file, got.error) };
     const { workspace, ...config } = got.data;
     if (workspace && !config.cards?.workspace)
       config.cards = { ...config.cards, workspace };
-    return { config, source: file, error: null };
+    return { ...NONE, config, source: file };
   }
   const got = legacyJson.safeParse(raw);
   return got.success
-    ? { config: fromLegacy(got.data), source: file, error: null }
+    ? { ...NONE, config: fromLegacy(got.data), source: file }
     : { ...NONE, source: file, error: describe(file, got.error) };
 }
 
+export const bothFilesWarning = (inherited: string[]): string =>
+  `This repo has both agentos.json and .dispatch.json; keys ${inherited.join(", ")} come from .dispatch.json. Move them into agentos.json and delete .dispatch.json.`;
+
+function merge(agentos: ProjectConfig, dispatch: ProjectConfig): LoadedConfig {
+  const inherited = Object.keys(dispatch).filter((k) => !(k in agentos));
+  const config = {
+    ...Object.fromEntries(
+      inherited.map((k) => [k, dispatch[k as keyof ProjectConfig]])
+    ),
+    ...agentos,
+  } as ProjectConfig;
+  const got = mergedJson.safeParse(config);
+  if (!got.success)
+    return {
+      ...NONE,
+      source: "agentos.json",
+      error: describe("agentos.json with .dispatch.json", got.error),
+    };
+  return {
+    ...NONE,
+    config,
+    source: "agentos.json",
+    inherited,
+    warning: inherited.length ? bothFilesWarning(inherited) : null,
+  };
+}
+
+function statOf(projectPath: string, file: string): fs.Stats | null {
+  try {
+    const stat = fs.statSync(path.join(projectPath, file));
+    return stat.isFile() ? stat : null;
+  } catch {
+    return null;
+  }
+}
+
+function readFile(projectPath: string, file: string): string | LoadedConfig {
+  try {
+    return fs.readFileSync(path.join(projectPath, file), "utf-8");
+  } catch (e) {
+    return {
+      ...NONE,
+      source: file,
+      error: `${file} could not be read: ${(e as Error).message}`,
+    };
+  }
+}
+
+// Both files, merged. A broken one is the error, whichever it is.
+function loadBoth(projectPath: string): LoadedConfig {
+  const parsed: LoadedConfig[] = [];
+  for (const file of ["agentos.json", ".dispatch.json"]) {
+    const text = readFile(projectPath, file);
+    if (typeof text !== "string") return text;
+    const got = parse(file, text, false);
+    if (got.error) return got;
+    parsed.push(got);
+  }
+  return merge(parsed[0].config, parsed[1].config);
+}
+
 // Keyed on the project; reused while the file's mtime and size hold, since
 // agentEnv reads it for every terminal and chat start.
 const cache = new Map<string, { stamp: string; loaded: LoadedConfig }>();
 
 export function loadProjectConfig(projectPath: string): LoadedConfig {
+  const a = statOf(projectPath, "agentos.json");
+  const d = statOf(projectPath, ".dispatch.json");
+  if (a && d) {
+    const stamp = `both:${a.mtimeMs}:${a.size}:${d.mtimeMs}:${d.size}`;
+    const hit = cache.get(projectPath);
+    if (hit?.stamp === stamp) return hit.loaded;
+    const loaded = loadBoth(projectPath);
+    cache.set(projectPath, { stamp, loaded });
+    return loaded;
+  }
   for (const file of CONFIG_FILES) {
     const full = path.join(projectPath, file);
     let stat: fs.Stats;
@@ -110,16 +205,8 @@ export function loadProjectConfig(projectPath: string): LoadedConfig {
     const stamp = `${file}:${stat.mtimeMs}:${stat.size}`;
     const hit = cache.get(projectPath);
     if (hit?.stamp === stamp) return hit.loaded;
-    let text: string;
-    try {
-      text = fs.readFileSync(full, "utf-8");
-    } catch (e) {
-      return {
-        ...NONE,
-        source: file,
-        error: `${file} could not be read: ${(e as Error).message}`,
-      };
-    }
+    const text = readFile(projectPath, file);
+    if (typeof text !== "string") return text;
     const loaded = parse(file, text);
     cache.set(projectPath, { stamp, loaded });
     return loaded;

package/lib/project-config/schema.ts

@@ -228,13 +228,19 @@ function portRefs(
 
 // agentos.json: an unknown key is an error, because it is nearly always a
 // typo that would otherwise be silently ignored.
-export const agentosJson = z.strictObject(shape).superRefine(portRefs);
+export const agentosFields = z.strictObject(shape);
+export const agentosJson = agentosFields.superRefine(portRefs);
 
 // .dispatch.json: the same fields, but dispatch has keys of its own. Its
 // top-level `workspace` is `cards.workspace` here.
-export const dispatchJson = z
-  .object({ ...shape, workspace: z.string().optional() })
-  .superRefine(portRefs);
+export const dispatchFields = z.object({
+  ...shape,
+  workspace: z.string().optional(),
+});
+export const dispatchJson = dispatchFields.superRefine(portRefs);
+
+// The cross-key port check on its own, for a config merged from two files.
+export const mergedJson = z.looseObject(shape).superRefine(portRefs);
 
 export const legacyJson = z.object({
   setup: z.array(z.string()).optional(),

package/lib/project-config/session.ts

@@ -4,11 +4,18 @@
  * an agent editing agentos.json on its branch can't change its own launch.
  */
 
+import fs from "fs";
 import os from "os";
+import { sessionTmpDir } from "../sessions/leftovers";
 import { db } from "../db";
 import { getProject } from "../projects";
 import { sessionPorts } from "../ports";
-import { loadProjectConfig, projectEnv, type LoadedConfig } from "./index";
+import {
+  loadProjectConfig,
+  NONE,
+  projectEnv,
+  type LoadedConfig,
+} from "./index";
 import { runningBrief } from "./brief";
 import { databaseEnv, sessionDatabase } from "./database";
 
@@ -29,12 +36,25 @@ export function sessionConfig(
   sessionId: string
 ): LoadedConfig & { ports: Record<string, number> | null } {
   const projectPath = projectPathOf(sessionId);
-  const loaded = projectPath
-    ? loadProjectConfig(projectPath)
-    : { config: {}, source: null, error: null };
+  const loaded = projectPath ? loadProjectConfig(projectPath) : NONE;
   return { ...loaded, ports: sessionPorts(sessionId) };
 }
 
+// A task's own temp folder, so what it leaves there is removed with it.
+// Only a session in a worktree: an orchestrator or a terminal in a checkout
+// is long-lived and keeps the system's.
+function taskTmpEnv(sessionId: string): Record<string, string> {
+  const row = db
+    .prepare(`SELECT worktree_path FROM sessions WHERE id = ?`)
+    .get(sessionId) as { worktree_path: string | null } | undefined;
+  if (!row?.worktree_path) return {};
+  const dir = sessionTmpDir(sessionId);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  // A folder left by an earlier run keeps its old mode otherwise.
+  fs.chmodSync(dir, 0o700);
+  return { TMPDIR: dir };
+}
+
 // The project's env and the session's ports. Never throws: a terminal or a
 // chat must still open when the config can't be read.
 export function sessionProjectEnv(sessionId: string): Record<string, string> {
@@ -43,6 +63,7 @@ export function sessionProjectEnv(sessionId: string): Record<string, string> {
     return {
       ...projectEnv(config, ports),
       ...(config.database ? databaseEnv(sessionDatabase(sessionId)) : {}),
+      ...taskTmpEnv(sessionId),
     };
   } catch (error) {
     console.error(`[project-config] env for ${sessionId}:`, error);
@@ -52,9 +73,9 @@ export function sessionProjectEnv(sessionId: string): Record<string, string> {
 
 export function sessionRunningBrief(sessionId: string): string {
   try {
-    const { config, source, ports } = sessionConfig(sessionId);
+    const { config, source, warning, ports } = sessionConfig(sessionId);
     return source
-      ? runningBrief(config, ports ?? {}, sessionDatabase(sessionId))
+      ? runningBrief(config, ports ?? {}, sessionDatabase(sessionId), warning)
       : "";
   } catch (error) {
     console.error(`[project-config] brief for ${sessionId}:`, error);

package/lib/security/net.ts

@@ -146,10 +146,13 @@ export function originAllowed(
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 
-// LumifyHub's approve page sends the browser back here, so this one URL is
-// reached by a cross-site top-level navigation. It acts only on a `state`
-// this instance issued, which a foreign page can't know.
-const CROSS_SITE_NAVIGATIONS = ["/api/lumifyhub/callback"];
+// LumifyHub's approve page and an MCP server's sign-in send the browser back
+// here, so these URLs are reached by a cross-site top-level navigation. Each
+// acts only on a `state` this instance issued, which a foreign page can't know.
+const CROSS_SITE_NAVIGATIONS = [
+  "/api/lumifyhub/callback",
+  "/api/mcp-auth/callback",
+];
 
 function crossSiteNavigationAllowed(req: {
   method?: string;

package/lib/security/tailnet-https.ts

@@ -10,10 +10,10 @@
  * address. AgentOS never runs `tailscale serve` or funnel.
  */
 
+import { agentosHome } from "../agentos-home";
 import { execFile } from "child_process";
 import fs from "fs";
 import https from "https";
-import os from "os";
 import path from "path";
 import type { IncomingMessage, ServerResponse } from "http";
 import type { Socket } from "net";
@@ -76,7 +76,7 @@ function runCert(
 /** Gets (or refreshes) the certificate; null when the tailnet can't issue one. */
 export async function tailnetCert(
   log: (line: string) => void = console.log,
-  dir = path.join(os.homedir(), ".agent-os", "tls")
+  dir = agentosHome("tls")
 ) {
   const ts = await tailscaleStatus();
   const bin = tailscaleBinary();