@sjawhar/pi-legion 8.15.0 → 8.16.1

package/dist/legion.js

@@ -13,10 +13,11 @@ var __export = (target, all) => {
       set: __exportSetter.bind(all, name)
     });
 };
+var __require = import.meta.require;
 
 // extensions/legion.ts
 import { randomUUID } from "crypto";
-import path4 from "path";
+import path5 from "path";
 
 // ../envoy-client/src/dispatch-config.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -13559,6 +13560,9 @@ config(en_default());
 function messageFor(error48) {
   return error48 instanceof Error ? error48.message : String(error48);
 }
+function hasErrnoCode(error48, code) {
+  return error48 instanceof Error && "code" in error48 && error48.code === code;
+}
 
 // ../envoy-client/src/secret-file.ts
 import { readFileSync } from "fs";
@@ -15219,6 +15223,385 @@ function subagentSessionCheck() {
 // extensions/legion.ts
 import { logger as logger3 } from "@oh-my-pi/pi-utils";
 
+// src/capability-report.ts
+import { readdir, stat } from "fs/promises";
+import path3 from "path";
+var CAPABILITY_CHECK_TIMEOUT_MS = 8000;
+var CAPABILITY_REPORT_TIMEOUT_MS = 1e4;
+var WEB_SEARCH_PROBE_QUERY = "jujutsu version control";
+var ENVOY_TOOL_NAMES = [
+  "envoy_subscribe",
+  "envoy_unsubscribe",
+  "envoy_list",
+  "envoy_inbox",
+  "envoy_send",
+  "envoy_publish",
+  "envoy_role_set",
+  "envoy_role_get",
+  "envoy_whoami",
+  "envoy_sessions"
+];
+var LIVE_CAPABILITIES = [
+  "subagents",
+  "web-search",
+  "mcp",
+  "repository-extensions",
+  "dispatch-envoy-tools",
+  "github"
+];
+var DEFAULT_BUDGETS = {
+  checkMs: CAPABILITY_CHECK_TIMEOUT_MS,
+  reportMs: CAPABILITY_REPORT_TIMEOUT_MS
+};
+var ok = (detail) => ({ ok: true, detail });
+var failed = (detail) => ({ ok: false, detail });
+function firstLine(text) {
+  return text.trim().split(`
+`, 1)[0] ?? "";
+}
+function commandFailure(result) {
+  return firstLine(result.stderr) || `exit code ${result.code ?? "none"}`;
+}
+function whichOnPath(name) {
+  return Bun.which(name, { PATH: process.env.PATH ?? "" }) ?? name;
+}
+var checkSubagents = async (host2, input) => {
+  if (!input.agentsExposed)
+    return failed("pi.agents is not exposed");
+  if (!input.activeTools.includes("task"))
+    return failed("task is not a registered tool");
+  const [discovered, disabled] = await Promise.all([
+    host2.discoverAgents(input.cwd),
+    host2.disabledAgents()
+  ]);
+  const names = new Set(discovered.agents.map((agent) => agent.name));
+  const missing = input.promptAgents.filter((agent) => !names.has(agent));
+  const off = input.promptAgents.filter((agent) => disabled.includes(agent));
+  const problems = [];
+  if (missing.length > 0) {
+    problems.push(`agents the prompts dispatch that the task tool does not resolve: ${missing.join(", ")}`);
+  }
+  if (off.length > 0)
+    problems.push(`disabled by task.disabledAgents: ${off.join(", ")}`);
+  if (problems.length > 0)
+    return failed(problems.join("; "));
+  return ok(`task resolves ${names.size} agents, every one the prompts dispatch`);
+};
+var checkWebSearch = async (host2, input, signal) => {
+  if (!input.activeTools.includes("web_search")) {
+    return failed("web_search is not a registered tool");
+  }
+  const started = Date.now();
+  const result = await host2.runSearchQuery({ query: WEB_SEARCH_PROBE_QUERY, limit: 1 }, { sessionId: input.sessionId, signal });
+  const elapsed = Date.now() - started;
+  const details = result.details ?? {};
+  if (details.error !== undefined && details.error !== null) {
+    return failed(`web_search failed: ${String(details.error)}`);
+  }
+  const provider = details.response?.provider ?? details.provider;
+  if (provider === undefined || provider === null || provider === "none") {
+    return failed("web_search failed: no provider answered");
+  }
+  const text = result.content?.[0]?.text ?? "";
+  if (text.startsWith("Error"))
+    return failed(`web_search failed: ${firstLine(text)}`);
+  return ok(`web_search registered; provider ${String(provider)} answered in ${elapsed} ms`);
+};
+function mcpErrorFor(errors3, name) {
+  for (const entry of errors3) {
+    if (typeof entry !== "object" || entry === null) {
+      if (!String(entry).includes(name))
+        continue;
+      return String(entry);
+    }
+    const record2 = entry;
+    const names = [record2.server, record2.name, record2.path];
+    if (!names.some((value) => value === name || value === `mcp:${name}`))
+      continue;
+    const message = record2.error ?? record2.message;
+    return message === undefined ? String(entry) : String(message);
+  }
+  return;
+}
+var checkMCP = async (host2, input, signal) => {
+  const { configs, sources } = await host2.loadMCPConfigs(input.cwd);
+  const configured = Object.keys(configs);
+  if (configured.length === 0)
+    return ok("no MCP server configured");
+  const { manager, errors: errors3 } = await host2.discoverMCPServers(input.cwd);
+  let torn;
+  const tearDown = () => {
+    torn ??= manager.disconnectAll().catch(() => {
+      return;
+    });
+    return torn;
+  };
+  signal.addEventListener("abort", tearDown, { once: true });
+  if (signal.aborted)
+    tearDown();
+  try {
+    await manager.waitForPendingConnections();
+    const connected = [];
+    const unconnected = [];
+    for (const name of configured) {
+      const status = manager.getConnectionStatus(name);
+      if (status === "connected") {
+        const source = sources[name]?.path;
+        connected.push(source === undefined ? name : `${name} (${path3.relative(input.cwd, source)})`);
+      } else {
+        unconnected.push(`${name} (${mcpErrorFor(errors3, name) ?? `status ${status}`})`);
+      }
+    }
+    if (unconnected.length === 0)
+      return ok(`connected: ${connected.join(", ")}`);
+    const suffix = connected.length === 0 ? "" : `; connected: ${connected.join(", ")}`;
+    return failed(`not connected: ${unconnected.join(", ")}${suffix}`);
+  } finally {
+    signal.removeEventListener("abort", tearDown);
+    await tearDown();
+  }
+};
+var EXTENSION_MODULE = /\.(?:ts|js|mjs|cjs)$/;
+var EXTENSION_INDEXES = ["index.ts", "index.js", "index.mjs", "index.cjs"];
+var SKILL_DIRECTORIES = [path3.join(".omp", "skills"), path3.join(".claude", "skills")];
+async function namesIn(directory) {
+  try {
+    return await readdir(directory);
+  } catch (error48) {
+    if (hasErrnoCode(error48, "ENOENT") || hasErrnoCode(error48, "ENOTDIR"))
+      return [];
+    throw error48;
+  }
+}
+async function kindOf(file2) {
+  try {
+    const stats = await stat(file2);
+    return stats.isFile() ? "file" : stats.isDirectory() ? "directory" : undefined;
+  } catch (error48) {
+    if (hasErrnoCode(error48, "ENOENT") || hasErrnoCode(error48, "ENOTDIR"))
+      return;
+    throw error48;
+  }
+}
+async function repositoryEntries(cwd) {
+  const entries = [];
+  const extensions = path3.join(cwd, ".omp", "extensions");
+  for (const name of await namesIn(extensions)) {
+    const candidate = path3.join(extensions, name);
+    const kind = await kindOf(candidate);
+    if (kind === "file" && EXTENSION_MODULE.test(name)) {
+      entries.push({ path: candidate, directory: false });
+    } else if (kind === "directory") {
+      const indexes = await Promise.all(EXTENSION_INDEXES.map((index) => kindOf(path3.join(candidate, index))));
+      if (indexes.includes("file"))
+        entries.push({ path: candidate, directory: true });
+    }
+  }
+  for (const skills of SKILL_DIRECTORIES) {
+    for (const name of await namesIn(path3.join(cwd, skills))) {
+      const skill = path3.join(cwd, skills, name, "SKILL.md");
+      if (await kindOf(skill) === "file")
+        entries.push({ path: skill, directory: false });
+    }
+  }
+  return entries;
+}
+var checkRepositoryExtensions = async (host2, input) => {
+  const entries = await repositoryEntries(input.cwd);
+  if (entries.length === 0) {
+    return ok("the repository carries no .omp/extensions, .omp/skills or .claude/skills");
+  }
+  const [extensionPaths, loaded] = await Promise.all([
+    host2.discoverExtensionPaths(input.cwd),
+    host2.loadSkills(input.cwd)
+  ]);
+  const discovered = new Set([...extensionPaths, ...loaded.skills.map((skill) => skill.filePath)].map((file2) => path3.resolve(file2)));
+  const isDiscovered = (entry) => {
+    const resolved = path3.resolve(entry.path);
+    if (discovered.has(resolved))
+      return true;
+    if (!entry.directory)
+      return false;
+    const prefix = resolved + path3.sep;
+    return [...discovered].some((file2) => file2.startsWith(prefix));
+  };
+  const relative = (selected) => selected.map((entry) => path3.relative(input.cwd, entry.path)).sort().join(", ");
+  const found = [];
+  const lost = [];
+  for (const entry of entries)
+    (isDiscovered(entry) ? found : lost).push(entry);
+  if (lost.length === 0)
+    return ok(`discovered: ${relative(found)}`);
+  const suffix = found.length === 0 ? "" : `; discovered: ${relative(found)}`;
+  return failed(`not discovered: ${relative(lost)}${suffix}`);
+};
+var checkDispatchEnvoyTools = async (host2, input, signal) => {
+  const missing = ENVOY_TOOL_NAMES.filter((tool) => !input.activeTools.includes(tool));
+  if (missing.length > 0)
+    return failed(`Envoy tools missing: ${missing.join(", ")}`);
+  const result = await host2.run("dispatch", ["read", "--issue", input.issue], {
+    cwd: input.cwd,
+    signal
+  });
+  if (result.code !== 0)
+    return failed(`dispatch read failed: ${commandFailure(result)}`);
+  return ok(`ten Envoy tools registered; dispatch read ${input.issue} answered from ${whichOnPath("dispatch")}`);
+};
+var checkGitHub = async (host2, input, signal) => {
+  const result = await host2.run("gh", ["api", "graphql", "-f", "query={viewer{login}}", "--jq", ".data.viewer.login"], { cwd: input.cwd, signal });
+  if (result.code !== 0)
+    return failed(`gh viewer login failed: ${commandFailure(result)}`);
+  return ok(`gh viewer login: ${result.stdout.trim()}`);
+};
+var CHECKS = {
+  subagents: checkSubagents,
+  "web-search": checkWebSearch,
+  mcp: checkMCP,
+  "repository-extensions": checkRepositoryExtensions,
+  "dispatch-envoy-tools": checkDispatchEnvoyTools,
+  github: checkGitHub
+};
+var MAX_DETAIL_BYTES = 1024;
+var HELD = "\uFFFF";
+function isSpace(code) {
+  return code >= 9 && code <= 13 || code === 32 || code === 133 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288;
+}
+function truncateUtf8(text, max) {
+  let bytes = 0;
+  let end = 0;
+  for (const char of text) {
+    const code = char.codePointAt(0) ?? 0;
+    bytes += code < 128 ? 1 : code < 2048 ? 2 : code < 65536 ? 3 : 4;
+    if (bytes > max)
+      break;
+    end += char.length;
+  }
+  return text.slice(0, end);
+}
+var CREDENTIAL_RULES = [
+  [/(?<![a-z0-9+.-])([0-9+.-]*[a-z][a-z0-9+.-]*:\/\/)[^ /?#]+@/gi, "$1***@"],
+  [
+    /([?&](?:token|key|secret|password|access_token|refresh_token|id_token|api_key|apikey|client_secret|sig|x-amz-security-token|x-amz-signature)=)[^ &#"'<>]+/gi,
+    "$1***"
+  ],
+  [
+    /(authorization["']?[ \uffff]*[:=][ \uffff]*)(?:(["'])((?:bearer|basic|token|digest)[ \uffff]+)?[^"']+|(\[?)((?:bearer|basic|token|digest)[ \uffff]+)?[^)\]}>]+)/gi,
+    "$1$2$3$4$5***"
+  ],
+  [/(x-api-key["']?[ \uffff]*[:=][ \uffff]*["']?)[A-Za-z0-9._~+/=*\uffff-]+/gi, "$1***"],
+  [/\b(bearer[ \uffff]+)[A-Za-z0-9._~+/=*\uffff-]+/gi, "$1***"],
+  [/\b(gh[pousr]_|github_pat_)[A-Za-z0-9._\uffff-]{20,}/g, "$1***"],
+  [
+    /(?<![A-Za-z0-9_\uffff-])eyJ[A-Za-z0-9_\uffff-]{8,}\.[A-Za-z0-9_\uffff-]{8,}\.[A-Za-z0-9_\uffff-]*/g,
+    "***"
+  ],
+  [/\b(sk-|dsp_)[A-Za-z0-9_\uffff-]{20,}/g, "$1***"],
+  [/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, "$1***"]
+];
+function cleanDetail(text) {
+  let marked = "";
+  for (const char of text) {
+    const code = char.codePointAt(0) ?? 0;
+    const control = code < 32 || code >= 127 && code < 160;
+    marked += isSpace(code) ? " " : control ? HELD : char;
+  }
+  const redacted = CREDENTIAL_RULES.reduce((line2, [pattern, replacement]) => line2.replace(pattern, replacement), marked);
+  const line = redacted.replaceAll(HELD, " ").split(" ").filter((field) => field !== "").join(" ");
+  return truncateUtf8(line, MAX_DETAIL_BYTES);
+}
+function budgetLabel(ms) {
+  return ms % 1000 === 0 ? `${ms / 1000} s` : `${ms} ms`;
+}
+async function withinBudget(work, ms, onDeadline) {
+  const deadline = Promise.withResolvers();
+  const timer = setTimeout(() => deadline.resolve(onDeadline()), ms);
+  try {
+    return await Promise.race([work, deadline.promise]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function measureCapabilities(host2, input, budgets = DEFAULT_BUDGETS) {
+  const started = Date.now();
+  const measuredAt = new Date(started).toISOString();
+  const outcomes = new Map;
+  const controllers = [];
+  const checks3 = LIVE_CAPABILITIES.map(async (name) => {
+    const controller = new AbortController;
+    controllers.push(controller);
+    const outcome = await withinBudget(CHECKS[name](host2, input, controller.signal).catch((error48) => failed(firstLine(messageFor(error48)))), budgets.checkMs, () => {
+      controller.abort();
+      return failed(`did not finish within ${budgetLabel(budgets.checkMs)}`);
+    });
+    outcomes.set(name, outcome);
+  });
+  await withinBudget(Promise.all(checks3).then(() => {
+    return;
+  }), budgets.reportMs, () => {
+    return;
+  });
+  for (const controller of controllers)
+    controller.abort();
+  const rows = LIVE_CAPABILITIES.map((name) => {
+    const { ok: ok2, detail } = outcomes.get(name) ?? failed(`did not finish within ${budgetLabel(budgets.reportMs)}`);
+    return { name, ok: ok2, detail: cleanDetail(detail) };
+  });
+  return { measuredAt, elapsedMs: Date.now() - started, rows };
+}
+async function runCommand(command, args, options) {
+  const child = Bun.spawn([command, ...args], {
+    cwd: options.cwd,
+    env: process.env,
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    signal: options.signal
+  });
+  const [stdout, stderr] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { code: child.exitCode, stdout, stderr };
+}
+function ompCapabilityHost() {
+  const hostSettings = async () => (await import("@oh-my-pi/pi-coding-agent/config/settings")).settings;
+  return {
+    discoverAgents: async (cwd) => (await import("@oh-my-pi/pi-coding-agent")).discoverAgents(cwd),
+    disabledAgents: async () => {
+      const [{ cfgTaskDisabledAgents }, settings] = await Promise.all([
+        import("@oh-my-pi/pi-coding-agent/task/settings"),
+        hostSettings()
+      ]);
+      return cfgTaskDisabledAgents.get(settings);
+    },
+    runSearchQuery: async (args, options) => (await import("@oh-my-pi/pi-coding-agent")).runSearchQuery(args, options),
+    loadMCPConfigs: async (cwd) => (await import("@oh-my-pi/pi-coding-agent/mcp/config")).loadAllMCPConfigs(cwd),
+    discoverMCPServers: async (cwd) => (await import("@oh-my-pi/pi-coding-agent")).discoverMCPServers(cwd),
+    discoverExtensionPaths: async (cwd) => {
+      const [{ discoverExtensionPaths }, { cfgDisabledExtensions }, settings] = await Promise.all([
+        import("@oh-my-pi/pi-coding-agent/extensibility/extensions/loader"),
+        import("@oh-my-pi/pi-coding-agent/extensibility/settings"),
+        hostSettings()
+      ]);
+      return discoverExtensionPaths([], cwd, cfgDisabledExtensions.get(settings));
+    },
+    loadSkills: async (cwd) => {
+      const [{ loadSkills }, { cfgDisabledExtensions, cfgSkills }, settings] = await Promise.all([
+        import("@oh-my-pi/pi-coding-agent"),
+        import("@oh-my-pi/pi-coding-agent/extensibility/settings"),
+        hostSettings()
+      ]);
+      return loadSkills({
+        ...cfgSkills.get(settings),
+        cwd,
+        disabledExtensions: cfgDisabledExtensions.get(settings)
+      });
+    },
+    run: runCommand
+  };
+}
+
 // ../pi-shared/src/role-claim-bridge.ts
 function legionRoleClaimBridge() {
   return envoyPluginInterface().roleClaim;
@@ -15244,7 +15627,7 @@ function onEnvoyRoleRegained(listener) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion",
-  version: "8.15.0",
+  version: "8.16.1",
   license: "Apache-2.0",
   type: "module",
   omp: {
@@ -15256,7 +15639,7 @@ var package_default = {
     ]
   },
   legion: {
-    daemonApiVersion: 20
+    daemonApiVersion: 21
   },
   repository: {
     type: "git",
@@ -15394,10 +15777,17 @@ var legionLocator = exports_external.discriminatedUnion("runtime", [
     })
   })
 ]);
+var legionCapabilityReportView = exports_external.strictObject({
+  measuredAt: timestamp,
+  incarnation: exports_external.string(),
+  ok: exports_external.array(nonEmptyString),
+  open: exports_external.array(exports_external.strictObject({ name: nonEmptyString, detail: nonEmptyString }))
+});
 var legionClaimView = exports_external.strictObject({
   session: exports_external.string(),
   state: exports_external.enum(LEGION_CLAIM_STATES),
-  locator: legionLocator.optional()
+  locator: legionLocator.optional(),
+  capabilities: legionCapabilityReportView.optional()
 });
 var legionPhaseView = exports_external.strictObject({
   claim: legionClaimView,
@@ -15465,7 +15855,7 @@ var legionAgentSecretsLoginView = exports_external.strictObject({
 });
 var legionCapabilityState = exports_external.strictObject({
   name: nonEmptyString,
-  status: exports_external.enum(["present", "installed", "unchecked", "live", "withheld", "decided", "open"]),
+  status: exports_external.enum(["present", "installed", "unchecked", "withheld", "decided", "open"]),
   detail: nonEmptyString,
   decision: nonEmptyString.optional(),
   configLine: nonEmptyString.optional()
@@ -15485,7 +15875,20 @@ var LegionRegisterResponse = exports_external.strictObject({
   issue: nonEmptyString,
   role: exports_external.enum(LEGION_ROLES),
   generation: exports_external.number().int().positive(),
-  secret: nonEmptyString
+  secret: nonEmptyString,
+  promptAgents: exports_external.array(nonEmptyString)
+});
+var LegionCapabilityReport = exports_external.strictObject({
+  measuredAt: timestamp,
+  elapsedMs: exports_external.number().int().nonnegative(),
+  rows: exports_external.array(exports_external.strictObject({ name: nonEmptyString, ok: exports_external.boolean(), detail: exports_external.string() }))
+});
+var LegionReadyRequest = exports_external.strictObject({
+  claimToken: nonEmptyString,
+  sessionId: nonEmptyString,
+  secret: nonEmptyString,
+  generation: exports_external.number().int().positive(),
+  capabilities: LegionCapabilityReport.optional()
 });
 var LegionControllerRegisterResponse = exports_external.strictObject({
   claimToken: nonEmptyString,
@@ -15618,10 +16021,10 @@ class LegionDaemonApiError extends Error {
   status;
   code;
   detail;
-  constructor(method, path3, status, code, detail) {
-    super(`${method} ${path3} failed with ${status}${code === undefined ? "" : ` ${code}`}: ${detail}`);
+  constructor(method, path4, status, code, detail) {
+    super(`${method} ${path4} failed with ${status}${code === undefined ? "" : ` ${code}`}: ${detail}`);
     this.method = method;
-    this.path = path3;
+    this.path = path4;
     this.status = status;
     this.code = code;
     this.detail = detail;
@@ -15633,10 +16036,10 @@ class LegionDaemonContractError extends Error {
   method;
   path;
   status;
-  constructor(method, path3, status, problem) {
-    super(`${method} ${path3} answered ${status} with a body the daemon API contract does not describe: ${problem}`);
+  constructor(method, path4, status, problem) {
+    super(`${method} ${path4} answered ${status} with a body the daemon API contract does not describe: ${problem}`);
     this.method = method;
-    this.path = path3;
+    this.path = path4;
     this.status = status;
     this.name = "LegionDaemonContractError";
   }
@@ -15657,8 +16060,8 @@ function parseStrictly(schema, body) {
 }
 function createLegionDaemonClient(baseUrl, fetchFn = fetch) {
   const endpoint = baseUrl.replace(/\/+$/, "");
-  const call = async (method, path3, body) => {
-    const response = await fetchFn(`${endpoint}${path3}`, body === undefined ? undefined : {
+  const call = async (method, path4, body) => {
+    const response = await fetchFn(`${endpoint}${path4}`, body === undefined ? undefined : {
       method,
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body)
@@ -15669,23 +16072,23 @@ function createLegionDaemonClient(baseUrl, fetchFn = fetch) {
     const refusal = parseStrictly(LegionErrorResponse, text);
     if ("value" in refusal) {
       const code = "code" in refusal.value && typeof refusal.value.code === "string" ? refusal.value.code : undefined;
-      throw new LegionDaemonApiError(method, path3, response.status, code, refusal.value.error);
+      throw new LegionDaemonApiError(method, path4, response.status, code, refusal.value.error);
     }
-    throw new LegionDaemonApiError(method, path3, response.status, undefined, `${JSON.stringify(text)} is not the daemon's refusal shape (${refusal.problem})`);
+    throw new LegionDaemonApiError(method, path4, response.status, undefined, `${JSON.stringify(text)} is not the daemon's refusal shape (${refusal.problem})`);
   };
-  const read = async (method, path3, schema, body) => {
-    const { status, text } = await call(method, path3, body);
+  const read = async (method, path4, schema, body) => {
+    const { status, text } = await call(method, path4, body);
     const parsed = parseStrictly(schema, text);
     if ("problem" in parsed) {
-      throw new LegionDaemonContractError(method, path3, status, parsed.problem);
+      throw new LegionDaemonContractError(method, path4, status, parsed.problem);
     }
     return parsed.value;
   };
-  const post = (path3, request, response, body) => read("POST", path3, response, request.parse(body));
-  const acknowledge = async (path3, body) => {
-    const { status, text } = await call("POST", path3, body);
+  const post = (path4, request, response, body) => read("POST", path4, response, request.parse(body));
+  const acknowledge = async (path4, body) => {
+    const { status, text } = await call("POST", path4, body);
     if (status !== 204 || text !== "") {
-      throw new LegionDaemonContractError("POST", path3, status, "the route answers 204 with no body");
+      throw new LegionDaemonContractError("POST", path4, status, "the route answers 204 with no body");
     }
   };
   return {
@@ -15712,16 +16115,16 @@ function createLegionDaemonClient(baseUrl, fetchFn = fetch) {
 // src/jj-attribution.ts
 import { execFile as execFile2 } from "child_process";
 import { mkdir, rename, writeFile } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 import { promisify as promisify2 } from "util";
 var UUID = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}";
 var TOP_LEVEL_TRANSCRIPT = new RegExp(`^\\d{4}-\\d{2}-\\d{2}T[\\d-]+Z_(${UUID})\\.jsonl$`);
 var ATTRIBUTION_OVERLAY = /^omp-attribution-.*\.toml$/;
 function sessionIdFromTranscript(sessionFile) {
-  return TOP_LEVEL_TRANSCRIPT.exec(path3.basename(sessionFile))?.[1];
+  return TOP_LEVEL_TRANSCRIPT.exec(path4.basename(sessionFile))?.[1];
 }
 function withoutOverlays(chain) {
-  return chain.split(":").filter((entry) => entry && !ATTRIBUTION_OVERLAY.test(path3.basename(entry))).join(":");
+  return chain.split(":").filter((entry) => entry && !ATTRIBUTION_OVERLAY.test(path4.basename(entry))).join(":");
 }
 async function userConfigChain() {
   try {
@@ -15737,7 +16140,7 @@ async function exportJjSessionAttribution(sessionFile, stateDir, env = process.e
   const id = sessionIdFromTranscript(sessionFile);
   if (!id)
     return;
-  const overlay = path3.join(stateDir, `omp-attribution-${id}.toml`);
+  const overlay = path4.join(stateDir, `omp-attribution-${id}.toml`);
   if (env.JJ_CONFIG?.split(":").includes(overlay))
     return;
   const base = (env.JJ_CONFIG ? withoutOverlays(env.JJ_CONFIG) : "") || await resolveBase();
@@ -15808,12 +16211,10 @@ function createClaimSession(deps) {
       agentId,
       pluginContract: package_default.legion.daemonApiVersion
     }).catch((error48) => exitOnRegistrationRefusal(error48, deps.exitProcess));
-    const ready = {
-      claimToken: claim.claimToken,
-      sessionId: sessionID,
-      secret: claim.secret,
-      generation: claim.generation
-    };
+    const measuring = Promise.resolve().then(() => deps.measureCapabilities(context, { issue: claim.issue, promptAgents: claim.promptAgents })).catch((error48) => {
+      console.error(`[legion] capability measurement failed; ready carries no report: ${messageFor(error48)}`);
+      return;
+    });
     try {
       const stateDir = requiredEnvironment(process.env, "LEGION_STATE_DIR");
       await exportJjSessionAttribution(sessionFile, stateDir);
@@ -15825,6 +16226,14 @@ function createClaimSession(deps) {
         secret: claim.secret
       };
       await claimEnvoyRole(sessionID, claim.claimToken, context);
+      const capabilities = await measuring;
+      const ready = {
+        claimToken: claim.claimToken,
+        sessionId: sessionID,
+        secret: claim.secret,
+        generation: claim.generation,
+        ...capabilities === undefined ? {} : { capabilities }
+      };
       await callReadyWithRetry("claims/ready", () => daemon.ready(ready));
       onEnvoyRoleRegained(async (role, reason) => {
         if (role !== claim.claimToken)
@@ -16406,13 +16815,17 @@ var exitProcess = (code) => process.exit(code);
 function setLegionBootstrapExitForTests(hook) {
   exitProcess = hook;
 }
+var capabilityHost = ompCapabilityHost;
+function setLegionCapabilityHostForTests(host2) {
+  capabilityHost = host2;
+}
 async function persistedTranscript(context) {
   await context.sessionManager.ensureOnDisk();
   const sessionFile = context.sessionManager.getSessionFile();
   if (!sessionFile?.endsWith(".jsonl")) {
     throw new Error("Legion session must have a persisted transcript");
   }
-  const agentId = path4.basename(sessionFile, ".jsonl");
+  const agentId = path5.basename(sessionFile, ".jsonl");
   if (!agentId)
     throw new Error("Legion session transcript has no agent id");
   return { sessionFile, agentId };
@@ -16462,6 +16875,14 @@ function legionExtension(pi) {
   const claimSession = createClaimSession({
     daemon: roleDaemon,
     persistedTranscript,
+    measureCapabilities: (context, input) => measureCapabilities(capabilityHost(), {
+      cwd: context.cwd,
+      sessionId: context.sessionManager.getSessionId(),
+      issue: input.issue,
+      promptAgents: input.promptAgents,
+      activeTools: pi.getActiveTools(),
+      agentsExposed: pi.agents !== undefined
+    }),
     exitProcess: (code) => exitProcess(code)
   });
   const controllerSession = createControllerSession({
@@ -16620,6 +17041,7 @@ function legionExtension(pi) {
   });
 }
 export {
+  setLegionCapabilityHostForTests,
   setLegionBootstrapExitForTests,
   legionExtension as default
 };

package/dist/skills/legion-controller/SKILL.md

@@ -193,12 +193,17 @@ unsent:
   `controller_wake_interval_seconds` (an hour by default), whatever the slots. An earlier walk
   that found nothing, a day with no event, and [a tree waiting on a root
   claim](#trees-waiting-on-a-root-claim-go-daemon) all get a turn from it. Its payload's
-  `openCapabilities`, when present, names the deployment capabilities (the secrets broker, model
-  fallback, every role's CPU and memory limits) the deployment's own configuration leaves open with
-  no decision recorded. `read_state` lists every row under `capabilities`, each open one
-  with its `detail` and the `configLine` to write into `legion.yaml`
-  (`capabilities.decided.<name>: "<reason>"`); name them in the day's report. A gap is the
-  operator's to close or to decide, never yours, and it never stops the walk.
+  `openCapabilities`, when present, names the open capability rows: the deployment capabilities
+  (the secrets broker, model fallback, every role's CPU and memory limits) the deployment's own
+  configuration leaves open with no decision recorded, and the live capabilities (`subagents`,
+  `web-search`, `mcp`, `repository-extensions`, `dispatch-envoy-tools`, `github`) a running
+  session's own check at its start failed. `read_state` lists every row under `capabilities`, each
+  open one with its `detail`: on a deployment row, with the `configLine` to write into
+  `legion.yaml` (`capabilities.decided.<name>: "<reason>"`); on a live row, naming each failing
+  session (its pod or pane, its role, its issue) and the fact its check found, with no
+  `configLine`, since nothing in `legion.yaml` decides a live row. Name them in the day's report.
+  A gap is the operator's to close or to decide — a live one the operator's or the issue's
+  architect's to fix in the session's environment — never yours, and it never stops the walk.
 
 **Scope first.** The scope the deployment instructions state decides which issues are candidates
 at all, before anything below. When they say you hand Legion no issue yourself, or that Legion
@@ -350,9 +355,12 @@ every pull request by its URL.
   when it made one: what it took, and how many candidates each row of the table skipped, so a
   reader can see why a free slot stays empty.
 - **Open capabilities.** Each row of `capabilities` in `read_state` whose `status` is
-  `open` (the `tick` payload's `openCapabilities`): its name, its `detail`, and its `configLine`,
-  the `legion.yaml` line that records a decision. The operator closes or decides it; you only
-  report it, and a report with none says nothing of them.
+  `open` (the `tick` payload's `openCapabilities`): its name, its `detail`, and, on a deployment
+  row, its `configLine`, the `legion.yaml` line that records a decision. A live row a running
+  session failed has no `configLine`: its `detail` names the session (pod or pane), the role, the
+  issue and the fact, and nothing in `legion.yaml` decides it. The operator closes or decides a
+  deployment row, and the operator or the issue's architect fixes a live row's session
+  environment; you only report either, and a report with none says nothing of them.
 
 A day with nothing finished says so in one sentence. When the lists do not fit, keep the counts
 and the highest-priority issues.
@@ -394,7 +402,7 @@ priority first, then board rank ([Keeping the slots full](#keeping-the-slots-ful
 | New issue created in the Dispatch project, status `triage`: `triage on <KEY>` (payload `{kind: "triage"}`) on the controller topic, for an unrecorded root carrying the `legion` label only ("Issues handed to Legion" above); the start procedure above catches one sent while no controller ran | issue key + triage context (incl. pre-existing children) | Triage: `set_status` to `todo` to admit, or to `backlog`/`icebox` to park |
 | `slot-free on <KEY>` from the Go daemon (payload `{kind: "slot-free"}`) | the root whose slot the daemon released with no waiting root to take it | Verify a free slot in `read_state`, then fill it ([Keeping the slots full](#keeping-the-slots-full-go-daemon)) |
 | `todo on <KEY>` from the Go daemon (payload `{kind: "todo"}`) | an issue not handed to Legion that changed while in `todo` and a slot stood free, sent half a minute later | Verify a free slot, then walk the whole `todo` list ([Keeping the slots full](#keeping-the-slots-full-go-daemon)) |
-| `tick on <PROJECT>` from the Go daemon (payload `{kind: "tick", openCapabilities?: [<name>, …]}`) | the project key; the daemon's periodic wake, whatever the slots; `openCapabilities` names the deployment capabilities with no decision, each with its detail and `capabilities.decided.<name>` line under `capabilities` in `read_state` | Recheck the trees waiting on a claim, then walk if a slot is free — a gap never stops the walk; post the day's report if this is the day's first turn, naming each open capability in it (the operator closes or decides it) |
+| `tick on <PROJECT>` from the Go daemon (payload `{kind: "tick", openCapabilities?: [<name>, …]}`) | the project key; the daemon's periodic wake, whatever the slots; `openCapabilities` names the deployment capabilities with no decision, each with its detail and `capabilities.decided.<name>` line under `capabilities` in `read_state`, and the live capabilities a running session's check failed, each with the detail naming the session (pod or pane), role, issue and fact, and no `configLine` | Recheck the trees waiting on a claim, then walk if a slot is free — a gap never stops the walk; post the day's report if this is the day's first turn, naming each open capability in it (the operator closes or decides a deployment row; the operator or the issue's architect fixes a live row's session; you take no other action) |
 | Architect escalation (controller-actionable only: re-file a child as a root issue, capacity, cross-tree conflicts) | request + context | Judge and act; the owning architect writes an issue-design decision as a decision block and opens `dispatch ask` only for a human to-do |
 | Mention | Slack/GitHub PR @mention text | Answer, or route to the owning issue's architect role |
 | `held on <KEY>` from the Go daemon (payload `{kind: "held", phase, role?, reason?}`) | the held issue, the phase it left, and the role whose claim failed, or `reason: "escalated"` | Verify the hold in `read_state` (the issue's phase is `held`). Without `reason`, a phase worker's launches or prompts ran out and the tree's architect decides retry or escalate: no action. With `reason: "escalated"` (on the record, `issues.<KEY>.holdReason` is `escalated`), the architect sent it to you: handle it as an architect escalation below. Parking the tree is `set_status` of the root to `backlog`; setting the root back to `todo` later re-admits it as a new generation, which starts again from its architect |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion",
-  "version": "8.15.0",
+  "version": "8.16.1",
   "license": "Apache-2.0",
   "type": "module",
   "omp": {
@@ -12,7 +12,7 @@
     ]
   },
   "legion": {
-    "daemonApiVersion": 20
+    "daemonApiVersion": 21
   },
   "repository": {
     "type": "git",