@staix/agent-hub 0.12.33 → 0.12.34

package/src/adapters/registry-types.ts

@@ -1,5 +1,9 @@
+import type { SettingDef } from "../hub/settings.ts";
+import type { Addon } from "../hub/tooling.ts";
+import type { RecoveryContinuityBookmark } from "../hub/recovery-continuity.ts";
+import type { RecoveryPeer } from "../cli/upgrade.ts";
 import type { Launch, StatusLineTee, FactsHook } from "../cli/launch.ts";
-import type { LaunchMetadata, TerminalBinding } from "../cli/terminal-recovery.ts";
+import type { LaunchMetadata, TerminalBinding, SessionRef } from "../cli/terminal-recovery.ts";
 import type { UsageWindow } from "../hub/budget.ts";
 import type { ContextReading } from "../hub/context-window.ts";
 import type { PeerAdapter } from "../hub/peers.ts";
@@ -11,6 +15,7 @@ import type { LocalOptions } from "./local-worker.ts";
 import type { PiOptions } from "./pi.ts";
 
 export type StartForm = "tui" | "headless";
+export type DaemonEngine = "codex-appserver" | "acp" | "owned-acp" | "pi-rpc" | "local-worker";
 
 /** Existing buildLaunch inputs plus the startup-bound instance and project identity. */
 export interface LaunchContext {
@@ -31,9 +36,16 @@ export interface LaunchContext {
   env: Readonly<Record<string, string>>;
   /** Existing validated config argv (or the existing redacted preview), never model input. */
   nativeCommand?: readonly string[];
+  /** Existing trusted Pi builder inputs; never populated from a request or model. */
+  pi?: {
+    options: Pick<PiOptions, "stateDir" | "cmd" | "mode" | "backend" | "model" | "relay" | "tools" | "preamble" | "maxSteps" | "sessionFile" | "sessionId">;
+    extension: string;
+    bridgePort: number | string;
+    bridgeToken: string;
+  };
 }
 
-export type LaunchPlan = Launch & { metadata: LaunchMetadata; mcpFile?: { path: string; entry: unknown } };
+export type LaunchPlan = Launch & { env?: NodeJS.ProcessEnv; metadata: LaunchMetadata; mcpFile?: { path: string; entry: unknown } };
 
 /** A factory receives exactly its existing transport options, with no cross-transport callback widening. */
 export type DaemonPorts =
@@ -65,6 +77,9 @@ export interface StartRequest {
 
 export interface VersionContext {
   instance: string;
+  observedVersion?: string;
+  nativeCommand?: readonly string[];
+  projectRoot?: string;
   peer?: PeerAdapter;
   env: Readonly<Record<string, string>>;
 }
@@ -78,13 +93,13 @@ export type NativeModeSpec =
 
 export interface QuotaReader {
   source: string;
-  read(peer: PeerAdapter): UsageWindow[] | undefined;
+  read(value: unknown): UsageWindow[];
   resetOnWindow?: boolean;
 }
 
 export interface ContextReader {
   source: ContextReading["source"];
-  read(peer: PeerAdapter): ContextReading | undefined;
+  read(value: unknown, sessionId: string, measuredAt: number): ContextReading;
 }
 
 export interface CapabilityManifest {
@@ -106,10 +121,21 @@ export interface NativeHooks {
   factsHook: (msg: unknown) => unknown;
   conversationRevert(turnId: string): Promise<void>;
   replaceSession(req: StartRequest): Promise<unknown>;
-  pluginInventory(env: Readonly<Record<string, string>>): string[];
+  pluginInventory(ctx: { home: string; cwd?: string; env: Readonly<Record<string, string | undefined>> }): Addon[];
+  recallSource: string;
+  recallInjected: boolean;
+  classifyTool(name: string, command?: string): "edit" | undefined;
   recallPlatform: string;
 }
 
+export type NativeConfigCheck = (value: unknown, key: string) => void;
+export interface NativeConfigValidators {
+  bool: NativeConfigCheck; text: NativeConfigCheck; strings: NativeConfigCheck; argv: NativeConfigCheck;
+  number(min?: number, max?: number, integer?: boolean): NativeConfigCheck;
+  words(values: readonly string[]): NativeConfigCheck;
+  block(fields: Record<string, NativeConfigCheck>): NativeConfigCheck;
+}
+
 /** Adapter API 1, including the merged revision-3 members frozen in issue #451. */
 export interface AdapterDefinition {
   api: 1;
@@ -120,6 +146,8 @@ export interface AdapterDefinition {
   roles: readonly string[];
   optional?: boolean;
   defaultOnRoster?: boolean;
+  /** A legacy enable switch gates new starts, not retained sockets or queues. */
+  enabledSwitchStartOnly?: boolean;
   trust: { onPrem: boolean; hubSandboxed: boolean };
   start: {
     forms: readonly StartForm[];
@@ -127,17 +155,30 @@ export interface AdapterDefinition {
     ownsTerminal(form: StartForm): boolean;
     launch(ctx: LaunchContext): LaunchPlan;
     create?(ctx: CreateContext): PeerAdapter;
+    daemonPort?: DaemonEngine;
     preflight?(ctx: StartRequest): string | undefined;
     version?(ctx: VersionContext): string | undefined;
     conductorStartable: boolean;
+    passthrough?: boolean;
     autoStart?: "pi.auto_start";
+    exclusiveStartRefusal?: string;
+    refreshTools?: boolean;
+    explicitHeadlessMode?: boolean;
+    planCommand?(form: StartForm): string;
+    acpCommand?(command: readonly string[], model?: string): string[];
+    reconfigureWhileAttached?: boolean;
     unattended?: boolean;
     hubSwitches: readonly string[];
     ownedFlags: readonly string[];
     conductorStartArgs?(args: string[]): { mode?: StartForm } | Error;
   };
   identity: { mcp: "acp-session" | "project-file" | "env" | "channel-plugin" };
-  attach?: { pullOnlyForms?: readonly StartForm[] };
+  attach?: {
+    pullOnlyForms?: readonly StartForm[];
+    recoveryLaunch?(instance: string): Record<string, unknown>;
+    pullOnlyNotice?: string;
+    admission?: { reservedRefusal: string; watchRefusal: string };
+  };
   permission: {
     modes: Partial<Record<PermissionMode, NativeModeSpec>>;
     grants?: Partial<Record<PermissionMode, string>>;
@@ -145,30 +186,76 @@ export interface AdapterDefinition {
     unmanaged?: string;
     unmanagedForms?: readonly StartForm[];
     unmanagedNote?: string;
+    unmanagedStatusNote?: string;
+    trackUnattended?: boolean;
   };
   session: {
+    nativeRevert?: boolean;
+    crashPlan?(meta: Record<string, unknown>): { resume?: Record<string, string>; how: string; fresh?: Record<string, string>; tui?: true };
+    unrecordedTerminal?: "always" | "tui";
+    continuityBookmark?(peer: RecoveryPeer, binding?: TerminalBinding): Pick<RecoveryContinuityBookmark, "pi">;
+    continuity?: { key: string; parse(value: unknown): unknown | undefined };
     idField: "sessionId" | "threadId";
     currentId(peer: PeerAdapter): string | undefined;
     configDirEnv?: "CODEX_HOME" | "CLAUDE_CONFIG_DIR";
-    resumeArgv?(binding: TerminalBinding, fresh: boolean): string[];
+    resumeArgv?(binding: SessionRef, fresh: boolean): string[];
     transcriptPath?(binding: TerminalBinding): string | undefined;
     transcriptExists?(binding: TerminalBinding): boolean | "unknown";
     zeroTurnFresh?: boolean;
+    zeroTurn?(ctx: { stateDir: string; binding: TerminalBinding; phase: "plan" | "attach" | "verify" }): boolean;
+    restoreArgs?(peer: RecoveryPeer): Record<string, string>;
+    recoveryRefusal?(peer: RecoveryPeer, phase?: "plan" | "restore"): string | undefined;
+    personFresh?: boolean;
+    missingEvidence?: "rollout" | "transcript";
+    /** Fixed source-only compatibility reads used by released recovery coordinators. */
+    legacyTargetSupport?: { file: "src/hub/peer-catalog.ts"; exportName: "OPTIONAL_PEERS"; refusal: string };
+    legacyHeadlessArgv?: { file: "src/hub/start-mode.ts"; exportName: "START_MODE_PEERS"; argv: readonly string[] };
     freshOnRestore?: boolean;
+    /** The daemon restores recorded startup options before auto-starting this kind. */
     restoreOnStart?: boolean;
+    /** Recovery passes the verified native session id to this kind's start command. */
+    resumeById?: boolean;
     launchKind?: string;
     launchRecord?: boolean;
     crashIdentity?(row: unknown): { sessionId?: string; sessionFile?: string };
   };
   turnEnd: "adapter" | "native-hook";
-  budget?: { account: string; reader?: QuotaReader; context?: ContextReader; checkpoint?: boolean };
+  reporting?: { tokensNotReported?: boolean };
+  /** Legacy native routing policy; external definitions cannot claim these host-specific policies. */
+  routing?: {
+    localAllowedRefusal?: string;
+    longContext?: "backend-limit" | "skip-owner";
+    preferredTier?: boolean;
+    handoffPriority?: number;
+    trace?: "route" | "backend";
+    backendLabel?: string;
+  };
+  budget?: { account: string; quotaExempt?: boolean; instrumented?: boolean; reader?: QuotaReader; context?: ContextReader; checkpoint?: boolean; resetSoftTokensOnResume?: boolean };
+  configuration?: {
+    schema?(ports: NativeConfigValidators): Record<string, NativeConfigCheck>;
+    routingSchema?(ports: NativeConfigValidators): Record<string, NativeConfigCheck>;
+    settings?: readonly SettingDef[];
+    restartReasons?: Readonly<Record<string, string>>;
+    validateEffective?(raw: Record<string, unknown>, fail: (key: string, reason: string) => never): void;
+  };
   capabilities?: { manifest?(peer: PeerAdapter): Promise<CapabilityManifest>; watch?: boolean };
-  init?: { templateFragment?: string; mcpFile?: string };
+  init?: {
+    templateFragment?: string;
+    mcpFile?: string;
+    /** Pure planner; the CLI host owns every write and cleanup. */
+    mcpPlan?(ctx: { projectRoot: string; stateDir: string; entrypoint: string; form: StartForm }): { file: string; tracked: boolean; changed: boolean; action: string };
+  };
   cli: {
     command: string;
+    /** Restrictions only; core identity remains authoritative. */
+    authority?: "person" | "conductor";
+    personOnlyFlags?: readonly string[];
     startWords(form: StartForm): string[];
     stopNotice?(form: StartForm, owner: PeerAdapter | undefined): string;
+    previewArgs?: readonly string[];
+    retainedTerminalNotice?(instance: string, form: StartForm | undefined, resumeCommand: string): string | undefined;
+    rosterReturnNotice?(resumeCommand: string): string;
   };
-  display: { palette: { fg: string; bg: string } };
+  display: { palette: { fg: string; bg: string; tone?: string; ansi?: string } };
   hooks?: Partial<NativeHooks>;
 }

package/src/adapters/registry.ts

@@ -1,10 +1,22 @@
-import { BUILTIN_DEFINITIONS_WITHOUT_QWEN } from "./definitions/builtin-metadata.ts";
+import { builtinCliEntries } from "./definitions/native-cli-entry.ts";
+import { builtinPreview } from "./definitions/native-cli-preview.ts";
+import { DAEMON_PORTS } from "./definitions/native-factories.ts";
+export { DAEMON_PORTS };
+import { NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN } from "./definitions/builtin-metadata.ts";
 import { QWEN_DEFINITION } from "./definitions/qwen.ts";
 import type { AdapterDefinition } from "./registry-types.ts";
 
 export type * from "./registry-types.ts";
 export const ADAPTER_API = 1;
 
+/** Ordered compatibility projections stay typed independently of definition implementation inference. */
+export const KNOWN_PEERS = ["claude", "codex", "kimi", "pi", "local"] as const;
+export const OPTIONAL_PEERS = ["qwen", "jcode"] as const;
+export const SUPPORTED_PEERS = [...KNOWN_PEERS, ...OPTIONAL_PEERS] as const;
+export const START_MODE_PEERS = ["pi", "codex", "kimi"] as const;
+export const OFFICE_PEER_ORDER: readonly string[] = KNOWN_PEERS;
+
+
 function immutable<T>(value: T, seen = new WeakSet<object>()): T {
   if (!value || typeof value !== "object" || seen.has(value)) return value;
   seen.add(value);
@@ -12,18 +24,27 @@ function immutable<T>(value: T, seen = new WeakSet<object>()): T {
   return Object.freeze(value);
 }
 
+const fixedBuiltinDefinitions = new Set<AdapterDefinition>([...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN, QWEN_DEFINITION]);
+
 /** Keep the native catalog's order, independently of the legacy default-role object order. */
 export const ADAPTERS: readonly AdapterDefinition[] = immutable([
-  ...BUILTIN_DEFINITIONS_WITHOUT_QWEN.filter(definition => definition.kind !== "jcode"),
+  ...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN.filter(definition => definition.kind !== "jcode"),
   QWEN_DEFINITION,
-  ...BUILTIN_DEFINITIONS_WITHOUT_QWEN.filter(definition => definition.kind === "jcode"),
+  ...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN.filter(definition => definition.kind === "jcode"),
 ]);
 const definitions = new Map<string, AdapterDefinition>();
 for (const definition of ADAPTERS) {
+  assertDaemonEngine(definition);
+  assertNativeCapabilityScope(definition);
   if (definition.api !== ADAPTER_API || definitions.has(definition.kind)) throw new Error("invalid builtin adapter registry");
   definitions.set(definition.kind, definition);
 }
 
+/** Native quota handoff platform names, distinct from per-delivery recall injection policy. */
+export const QUOTA_HANDOFF_PLATFORMS: Readonly<Record<string, string>> = Object.freeze(Object.fromEntries(
+  ADAPTERS.flatMap(adapter => adapter.hooks?.recallPlatform ? [[adapter.kind, adapter.hooks.recallPlatform]] : []),
+));
+
 /** A1 registers kinds only. Undeclared suffixes never acquire a native kind or admission. */
 export function kindOf(id: string): string | undefined {
   return definitions.has(id) ? id : undefined;
@@ -34,3 +55,82 @@ export function definitionOf(id: string): AdapterDefinition | undefined {
 export function familyOf(id: string): string | undefined {
   return definitionOf(id)?.family;
 }
+
+/** Compatibility projection order is observable in default role maps and planner selection. */
+const ROLE_ORDER = ["claude", "codex", "kimi", "local", "pi", "qwen", "jcode"] as const;
+export const PLANNER_PEERS = ["claude", "codex", "kimi", "qwen", "jcode"] as const;
+
+/** Callers own their role arrays, independent of immutable native policy. */
+export function defaultPeerRoles(includeOptional = false): Record<string, string[]> {
+  return Object.fromEntries(ROLE_ORDER.filter(peer => includeOptional || !definitionOf(peer)!.optional)
+    .map(peer => [peer, [...definitionOf(peer)!.roles]]));
+}
+
+/** Preserve the tool schema's legacy preferred order without spreading native names into tools. */
+const CONDUCTOR_START_PRIORITY = ["local", "kimi", "pi"] as const;
+export const CONDUCTOR_START_PEERS = [
+  ...CONDUCTOR_START_PRIORITY,
+  ...ADAPTERS.filter(adapter => !(CONDUCTOR_START_PRIORITY as readonly string[]).includes(adapter.kind)).map(adapter => adapter.kind),
+];
+
+/** A missing definition retains external-id admission; Pi's legacy enabled switch controls its default only. */
+export function defaultRosterEnabled(peer: string, piEnabled: boolean): boolean {
+  const definition = definitionOf(peer);
+  if (!definition) return true;
+  return definition.kind === "pi" ? piEnabled : definition.defaultOnRoster ?? false;
+}
+
+/** A factory must name one existing engine; metadata never creates a caller-controlled port. */
+export function assertDaemonEngine(definition: Pick<AdapterDefinition, "start">): void {
+  const engine = definition.start.daemonPort;
+  if (definition.start.create && engine === undefined || engine !== undefined && !Object.hasOwn(DAEMON_PORTS, engine)) throw new Error("invalid adapter daemon engine");
+}
+
+/** Host-global native quirks are not capabilities a config-only or external definition may opt into. */
+export function assertNativeCapabilityScope(definition: AdapterDefinition): void {
+  if (fixedBuiltinDefinitions.has(definition)) return;
+  const declared = (block: object | undefined, key: string): boolean => block !== undefined && key in block;
+  const restricted: [string, boolean][] = [
+    ["start.acpCommand", declared(definition.start, "acpCommand")],
+    ["attach.admission", declared(definition.attach, "admission")],
+    ["budget.resetSoftTokensOnResume", declared(definition.budget, "resetSoftTokensOnResume")],
+    ["session.crashIdentity", declared(definition.session, "crashIdentity")],
+    ["start.daemonPort pi-rpc", definition.start.daemonPort === "pi-rpc"],
+    ["routing", definition.routing !== undefined],
+  ];
+  const field = restricted.find(([, present]) => present)?.[0];
+  if (field) throw new Error(`${field} is restricted to fixed builtin adapter definitions`);
+}
+
+/** Ordered catalog projections consumed by generic core hosts. */
+export const STARTABLE_PEERS = SUPPORTED_PEERS;
+export type SupportedPeer = typeof SUPPORTED_PEERS[number];
+export function isSupportedPeer(peer: unknown): peer is SupportedPeer { return typeof peer === "string" && definitionOf(peer) !== undefined; }
+export function isStartablePeer(peer: unknown): peer is SupportedPeer { return typeof peer === "string" && definitionOf(peer)?.start.conductorStartable === true; }
+
+/** Body-free browser metadata, derived from the same native participation and managed-tool contracts. */
+export const ADAPTER_DISPLAY = Object.fromEntries(ADAPTERS.map(adapter => [adapter.kind, {
+  pullOnlyRead: adapter.attach?.pullOnlyForms?.includes("tui") === true,
+  terminalApproval: adapter.trust.hubSandboxed,
+}]));
+
+export { NATIVE_CONFIG_BLOCKS, nativeConfigurationDefaults, mergeNativeConfiguration, retainNativeRouting } from "./definitions/native-config-defaults.ts";
+
+/** Private fixed-builtin preview implementation; not an adapter extension or configurable callback. */
+export function builtinPreviewOf(id: string) {
+  const definition = definitionOf(id);
+  return definition ? builtinPreview(definition) : undefined;
+}
+
+/** Fixed builtin doctor metadata and pure observed-value projections; the CLI retains all probe effects. */
+export { DOCTOR_TOOL_PROBES, DOCTOR_MEMORY_CAPTURE_PEERS, DOCTOR_PLUGIN_PROBE, nativeDoctorCheck, nativeDoctorRecoveryIdentity, nativeDoctorOptionalProbes } from "./definitions/native-cli-doctor.ts";
+
+/** Internal fixed builtin CLI entries; public AdapterDefinition and NativeHooks expose no execution extension. */
+export const BUILTIN_CLI_ENTRIES = Object.freeze(builtinCliEntries.map(entry => {
+  const definition = definitionOf(entry.command);
+  if (!definition) throw new Error("builtin CLI entry has no adapter definition");
+  return Object.freeze({ ...entry, definition });
+}));
+
+/** Private fixed-builtin stream presentation; does not widen the public palette object. */
+export { nativeStreamTone } from "./definitions/native-display.ts";

package/src/cli/console-state.ts

@@ -2,7 +2,7 @@ import { consoleNeeds, characterAttentionLine, attentionCommand } from "./attent
 import { CHARACTERS, petFrame, petSize, petFooterRows, type CharacterId, type PetSize, type PetPose } from "../pet/frame.ts";
 import { PEER_PALETTE } from "../ui/peer-palette.ts";
 import { PERMISSION_MODES, permissionBoundary } from "../hub/permission-mode.ts";
-import { PLANNER_PEERS } from "../hub/peer-catalog.ts";
+import { PLANNER_PEERS, definitionOf, nativeStreamTone } from "../adapters/registry.ts";
 import { taskProgress } from "../ui/task-progress.ts";
 import type { ProgressStage } from "../ui/task-progress.ts";
 import { sanitize } from "../hub/envelope.ts";
@@ -114,7 +114,6 @@ export function paint(line: Span[], color: boolean): string {
 export function streamTokens(value: string, eventTone?: Tone, kind?: string): Span[] {
   const text = terminalText(value);
   if (kind === "command" || kind === "console") return [{ text }];
-  const peers: Readonly<Record<string, Tone>> = { claude: "peerClaude", codex: "peerCodex" };
   // Hub-written peer slots only; words such as local/pi/hub in a title do not identify a speaker.
   const peerSlots = new Set<number>();
   const leading = text.match(/^\s*(?:[.?*!]\s+)?([A-Za-z_][A-Za-z_0-9-]*)(?=:| is | asks permission:| permission )/);
@@ -143,6 +142,7 @@ export function streamTokens(value: string, eventTone?: Tone, kind?: string): Sp
     const gap = text.slice(end, start);
     if (gap) out.push({ text: gap });
     let tone: Tone | undefined;
+    const peerTone = nativeStreamTone(token);
     // ponytail: legacy notices have no typed reference ranges. Classify task/review prefixes textually;
     // assign/which #N remains an issue reference until notices carry structured reference spans.
     if (token.startsWith("#")) {
@@ -152,7 +152,7 @@ export function streamTokens(value: string, eventTone?: Tone, kind?: string): Sp
     }
     else if (start === taskKeywordAt) tone = "taskKeyword";
     else if (/^[0-9]/.test(token) && !permissionIds.has(start)) tone = "number";
-    else if (peerSlots.has(start) && Object.hasOwn(peers, token)) tone = peers[token];
+    else if (peerSlots.has(start) && peerTone) tone = peerTone;
     else if (start === markerAt || start === stateAt || (route && token === "->" && start < route[0].length)) tone = eventTone;
     out.push({ text: token, ...(tone ? { tone } : {}) });
     previousToken = token; previousStart = start; end = start + token.length;
@@ -749,7 +749,7 @@ export function cells(s: ConsoleState, row: any, selected: boolean, now: number,
       : row.paused === "manual" ? "user" : row.paused ? String(row.paused).split(":")[0] : "-";
     return [id(row.planner ? `${row.id} (planner)` : row.id, row.state === "offline" ? undefined : "info"), span(row.rostered === false ? `${row.state} off roster` : row.state, stateTone(row.state)),
       ...(showPermissionModes(s) ? [span(row.permissionMode && row.permissionMode !== "ask" ? row.permissionMode : "-", row.permissionMode === "never-ask" ? "attention" : undefined)] : []),
-      span(row.pullOnly && row.id === "kimi" ? "pull-only" : row.toolsOnly ? "tools-only" : row.attached === false ? "detached" : "attached", row.toolsOnly ? "attention" : undefined),
+      span(row.pullOnly && definitionOf(row.id)?.attach?.pullOnlyForms?.includes("tui") ? "pull-only" : row.toolsOnly ? "tools-only" : row.attached === false ? "detached" : "attached", row.toolsOnly ? "attention" : undefined),
       span(count(row.queued)), span(count(row.queuedImportant), row.queuedImportant ? "attention" : undefined),
       span(count(row.needsReview), row.needsReview ? "failure" : undefined), span(paused, paused === "-" ? undefined : "attention"),
       span(b?.windows?.length ? b.windows.map((w: any) => `${w.id} ${Math.round(w.used * 100)}%${typeof w.resetsAt === "number" ? ` ${relative(w.resetsAt, now)}` : ""}`).join(", ") : "-"),
@@ -890,7 +890,7 @@ export function renderConsoleLines(s: ConsoleState, columns: number, rows = 24,
     if (p.permissionMode && p.permissionMode !== "ask") summary.push(span(` ${p.permissionMode}`, "attention"));
     if (p.needsReview) summary.push(span(` review${p.needsReview}`, "failure"));
     if (p.paused) summary.push(span(" paused", "attention"));
-    if (p.toolsOnly) summary.push(span(id === "kimi" ? ` pull-only, read ${typeof p.lastInboxAt === "number" ? relative(p.lastInboxAt, now) : "never"}` : " tools-only: ahub claude", "attention"));
+    if (p.toolsOnly) summary.push(span(definitionOf(id)?.attach?.pullOnlyForms?.includes("tui") ? ` pull-only, read ${typeof p.lastInboxAt === "number" ? relative(p.lastInboxAt, now) : "never"}` : " tools-only: ahub claude", "attention"));
   }
   if (s.pendingRestart?.length) summary.push(span(`${summary.length ? " | " : ""}restart pending: ${s.pendingRestart.map(row => row.key).join(", ")}`, "attention"));
   const quotas = Object.entries(s.budget).map(([id, b]) => `${id}:${b.windows?.map((w: any) => `${w.id} ${Math.round(w.used * 100)}%`).join("/") ?? "?"}`).join(" ");

package/src/cli/identity.ts

@@ -1,5 +1,5 @@
 import { recoveryPresentationFlag } from "./recovery-presentation-options.ts";
-import { isSupportedPeer } from "../hub/peer-catalog.ts";
+import { definitionOf } from "../adapters/registry.ts";
 
 /** Recovery reads this declaration before delegating to another package's CLI. */
 export const LIVE_TEST_SUPPORTED = true;
@@ -52,7 +52,8 @@ export type PeerCommandAccess = "allowed" | "conductor" | "console";
 /** A closed list: unknown commands cannot acquire console authority through an agent shell. */
 export function classifyPeerCommand(command: string, args: readonly string[]): PeerCommandAccess {
   if (command === "recovery" && recoveryAction(args) === "reattach") return "console";
-  if (command === "pi" && args.includes("--replace-session")) return "console";
+  const native = definitionOf(command);
+  if (native?.cli.personOnlyFlags?.some(flag => args.includes(flag))) return "console";
   if (command === "pet" && args.includes("--window")) return "console";
   if (command === "permission" || command === "stop" || command === "watch") return "console";
   if (args.some((arg) => arg === "--as-user" || arg.startsWith("--as-user="))) return "console";
@@ -72,8 +73,8 @@ export function classifyPeerCommand(command: string, args: readonly string[]): P
   // The subcommand is the first argument that is not --json, which the command accepts anywhere.
   if (command === "bench") return args.find((arg) => arg !== "--json") === "run" ? "console" : "allowed";
   if (command === "budget") return !args.length || args.every((arg) => arg === "--json" || arg === "--full" || arg.startsWith("--color=")) ? "allowed" : "console";
-  if (command === "jcode") return "console"; // the person launcher alone writes its project MCP entry
-  if (isSupportedPeer(command) || ["pause", "resume"].includes(command)) return "conductor";
+  if (native?.cli.authority === "person") return "console";
+  if (native || ["pause", "resume"].includes(command)) return "conductor";
   if (command === "board" && args[0] === "import") return "console";
   if (["help", "version", "--version", "say", "status", "pet", "board", "report", "turns", "review", "remember", "facts", "check-path"].includes(command)) return "allowed";
   return "console";
@@ -84,7 +85,7 @@ export function cliCommandLabel(command: string, args: readonly string[]): strin
   if (command === "backlog") return ["list", "add", "pull", "pull-ready", "split", "return", "plan", "pin", "undo"].includes(args[0] ?? "") ? `backlog ${args[0]}` : "backlog";
   if (command === "board" && args[0] === "import") return "board import";
   if (command === "release") return ["new", "list", "show", "plan", "activate", "freeze", "ship", "drop"].includes(args[0] ?? "") ? `release ${args[0]}` : "release";
-  if (!["upgrade", "restart", "recovery", "recovery-run", "help", "--help", "--version", "version", "projects", "ui", "manager", "setup", "init", "daemon", "up", "console", "claude", "codex", "kimi", "qwen", "jcode", "pi", "local", "stop", "models", "say", "queue", "tail", "watch", "budget", "board", "task", "review", "remember", "ask", "route", "pause", "resume", "permit", "permission", "settings", "roster", "status", "pet", "logs", "export", "report", "research", "memory", "goal", "bench", "sdlc", "role", "facts", "check-path", "turns", "undo", "kill", "reset", "doctor"].includes(command)) return "unknown";
+  if (!definitionOf(command) && !["upgrade", "restart", "recovery", "recovery-run", "help", "--help", "--version", "version", "projects", "ui", "manager", "setup", "init", "daemon", "up", "console", "stop", "models", "say", "queue", "tail", "watch", "budget", "board", "task", "review", "remember", "ask", "route", "pause", "resume", "permit", "permission", "settings", "roster", "status", "pet", "logs", "export", "report", "research", "memory", "goal", "bench", "sdlc", "role", "facts", "check-path", "turns", "undo", "kill", "reset", "doctor"].includes(command)) return "unknown";
   if (["task", "queue", "budget", "route", "recovery", "models", "projects", "research", "memory", "goal", "bench"].includes(command)) {
     const sub = command === "bench" || command === "memory" || command === "goal" ? args.find((arg) => arg !== "--json") : args[0];
     if (sub && ["propose", "show", "assign", "unassign", "escalate", "label", "list", "resolve", "resume", "set", "execution", "explain", "status", "abort", "dispose", "reattach", "setup", "start", "stop", "remove", "export", "backfill", "addons", "run", "report", "compare", "search", "graph", "promote", "demote", "forget", "supersede", "dedupe", "decay", "rebuild", "sync", "machine", "import", "suggestions", "confirm", "reject", "new", "link", "state", "done", "take"].includes(sub)) return `${command} ${sub}`;

package/src/cli/jcode-mcp.ts

@@ -1,58 +1,2 @@
-import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { join } from "node:path";
-import { hubGitSync } from "../hub/git.ts";
-
-export const JCODE_MCP_FILE = ".jcode/mcp.json", JCODE_MCP_NAME = "agent-hub-jcode";
-type Document = Record<string, unknown>;
-const object = (value: unknown): value is Document => !!value && typeof value === "object" && !Array.isArray(value);
-
-function document(file: string): Document {
-  const stat = lstatSync(file, { throwIfNoEntry: false });
-  if (!stat) return {};
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 256 * 1024) throw new Error("Jcode MCP configuration must be a bounded regular file, not a link");
-  let value: unknown; try { value = JSON.parse(readFileSync(file, "utf8")); } catch { throw new Error("Jcode MCP configuration is invalid JSON"); }
-  if (!object(value)) throw new Error("Jcode MCP configuration must be an object");
-  if (value.servers !== undefined && value.mcpServers !== undefined) throw new Error("Jcode MCP configuration has ambiguous server maps");
-  for (const key of ["servers", "mcpServers"]) if (value[key] !== undefined && !object(value[key])) throw new Error("Jcode MCP server map must be an object");
-  return value;
-}
-const map = (doc: Document): Document => (doc.mcpServers ?? doc.servers ?? {}) as Document;
-const owned = (entry: unknown, cwd: string): entry is Document => object(entry) && object(entry.env) && entry.env.AGENTHUB_MODE === "tools" && entry.env.AGENTHUB_PEER_ID === "jcode" && entry.env.AGENTHUB_PROJECT_DIR === cwd;
-
-export function jcodeMcpEntry(cwd: string, stateDir: string, bundle: string) {
-  return { command: "bun", args: ["run", bundle], shared: false, env: { AGENTHUB_MODE: "tools", AGENTHUB_DELIVERY_ONLY: "true", AGENTHUB_PEER_ID: "jcode", AGENTHUB_STATE_DIR: stateDir, AGENTHUB_PROJECT_DIR: cwd } };
-}
-/** The native loader reads later project files last. Never shadow a foreign definition. */
-function inspect(cwd: string): Document {
-  const directory = lstatSync(join(cwd, ".jcode"), { throwIfNoEntry: false });
-  if (directory && (!directory.isDirectory() || directory.isSymbolicLink())) throw new Error(".jcode must be a project directory, not a link");
-  for (const relative of [".mcp.json", ".claude/mcp.json"]) {
-    const parent = relative.startsWith(".claude/") ? lstatSync(join(cwd, ".claude"), { throwIfNoEntry: false }) : undefined;
-    if (parent?.isSymbolicLink()) throw new Error("Jcode MCP override layer is a link; inspect it before launching");
-    if (Object.hasOwn(map(document(join(cwd, relative))), JCODE_MCP_NAME)) throw new Error("a later project MCP layer overrides agent-hub-jcode; resolve it in your editor");
-  }
-  return document(join(cwd, JCODE_MCP_FILE));
-}
-export function jcodeMcpReady(cwd: string, stateDir: string, bundle: string): boolean {
-  const entry = map(inspect(cwd))[JCODE_MCP_NAME];
-  return JSON.stringify(entry) === JSON.stringify(jcodeMcpEntry(cwd, stateDir, bundle));
-}
-/** Only the console launcher calls this; daemon starts use jcodeMcpReady read-only. */
-export function configureJcodeMcp(cwd: string, stateDir: string, bundle: string, remove = false): { changed: boolean; tracked: boolean } {
-  const current = inspect(cwd), servers = { ...map(current) }, existing = servers[JCODE_MCP_NAME];
-  if (existing !== undefined && !owned(existing, cwd)) throw new Error("agent-hub-jcode is a foreign MCP entry; it was not changed");
-  if (remove) delete servers[JCODE_MCP_NAME]; else servers[JCODE_MCP_NAME] = jcodeMcpEntry(cwd, stateDir, bundle);
-  const key = current.servers !== undefined ? "servers" : "mcpServers";
-  const next = { ...current, ...(current[key] !== undefined || !remove ? { [key]: servers } : {}) };
-  const tracked = hubGitSync(["ls-files", "--error-unmatch", "--", JCODE_MCP_FILE], { cwd, encoding: "utf8", timeout: 3000 }).status === 0;
-  if (JSON.stringify(next) === JSON.stringify(current)) return { changed: false, tracked };
-  mkdirSync(join(cwd, ".jcode"), { recursive: true });
-  const file = join(cwd, JCODE_MCP_FILE), temporary = `${file}.${randomUUID()}.tmp`;
-  try {
-    const fd = openSync(temporary, "wx", 0o600);
-    try { writeFileSync(fd, `${JSON.stringify(next, null, 2)}\n`); } finally { closeSync(fd); }
-    renameSync(temporary, file);
-  } finally { if (existsSync(temporary)) unlinkSync(temporary); }
-  return { changed: true, tracked };
-}
+/** Compatibility exports; the project MCP layer is native adapter policy. */
+export { JCODE_MCP_FILE, JCODE_MCP_NAME, jcodeMcpEntry, jcodeMcpReady, configureJcodeMcp } from "../adapters/definitions/native-cli-jcode-mcp.ts";