@tryinget/pi-agent-registry 0.3.1 → 0.3.2

package/src/visible-launch-bootstrap.ts

@@ -0,0 +1,100 @@
+// summary: resolve only approved explicit entrypoints from installed local package manifests, never caller paths.
+import { readFile, realpath, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { sha256Hex } from "./dispatch-receipt.ts";
+
+export interface TrustedVisibleLaunchBootstrap {
+  extensions: string[];
+  bindings: { package: string; entry: string; manifestSha256: string; entrySha256: string }[];
+  /** Re-observe package manifests and entry bytes at the admission/observation boundaries. */
+  verify(): Promise<boolean>;
+}
+export type TrustedVisibleLaunchBootstrapResolver = (
+  model: string,
+) => Promise<TrustedVisibleLaunchBootstrap | undefined>;
+
+// Provider-extension aliases are deliberately NOT inferred. An owner-approved provider bootstrap
+// must extend this policy, not inherit ambient extensions or accept PI_SUBAGENT_EXTENSIONS paths.
+// Installed Pi 0.84.4 natively supplies zai/glm-5.3; no ambient provider extension is needed.
+// Operator models.json/auth remain configured inputs, not a whole-runtime integrity claim.
+const BUILTIN_PROVIDERS = new Set(["anthropic", "openai", "openai-codex", "google", "zai"]);
+const APPROVED = [
+  ["@tryinget/pi-peer-messaging", "extensions/intercom.ts"],
+  ["@tryinget/pi-little-helpers", "extensions/session-presence.ts"],
+] as const;
+
+export const resolveTrustedVisibleLaunchBootstrap: TrustedVisibleLaunchBootstrapResolver = async (
+  model,
+) => {
+  if (!BUILTIN_PROVIDERS.has(model.split("/")[0]) || !model.includes("/")) return undefined;
+  const configured = process.env.PI_CODING_AGENT_DIR;
+  const agentDir = configured
+    ? resolve(configured === "~" ? homedir() : configured)
+    : join(homedir(), ".pi", "agent");
+  try {
+    const settings = JSON.parse(await readFile(join(agentDir, "settings.json"), "utf8"));
+    if (!Array.isArray(settings.packages)) return undefined;
+    const bindings: TrustedVisibleLaunchBootstrap["bindings"] = [];
+    const captured: { path: string; sha256: string }[] = [];
+    for (const [name, entry] of APPROVED) {
+      const matches: { root: string; manifest: Buffer }[] = [];
+      for (const installed of settings.packages) {
+        const source = typeof installed === "string" ? installed : installed?.source;
+        if (
+          typeof source !== "string" ||
+          !(isAbsolute(source) || /^\.\.?\//u.test(source) || source.startsWith("~/"))
+        )
+          continue;
+        const root = await realpath(
+          source.startsWith("~/") ? join(homedir(), source.slice(2)) : resolve(agentDir, source),
+        ).catch(() => undefined);
+        if (!root) continue;
+        const manifest = await readFile(join(root, "package.json")).catch(() => undefined);
+        if (!manifest) continue;
+        const parsed = JSON.parse(manifest.toString("utf8"));
+        if (parsed.name !== name) continue;
+        if (
+          !Array.isArray(parsed.pi?.extensions) ||
+          !parsed.pi.extensions.some((p: unknown) => p === entry || p === `./${entry}`)
+        )
+          return undefined;
+        // Complex/glob settings filters have no approval proof in this slice.
+        if (
+          typeof installed === "object" &&
+          (installed.autoload === false || installed.extensions !== undefined)
+        )
+          return undefined;
+        matches.push({ root, manifest });
+      }
+      if (matches.length !== 1) return undefined;
+      const { root, manifest } = matches[0];
+      const path = await realpath(join(root, entry));
+      if (relative(root, path).startsWith("..") || !(await stat(path)).isFile()) return undefined;
+      const entrySha256 = sha256Hex(await readFile(path));
+      const manifestSha256 = sha256Hex(manifest);
+      bindings.push({ package: name, entry: path, manifestSha256, entrySha256 });
+      captured.push(
+        { path: join(root, "package.json"), sha256: manifestSha256 },
+        { path, sha256: entrySha256 },
+      );
+    }
+    return {
+      extensions: bindings.map((b) => b.entry),
+      bindings,
+      async verify() {
+        try {
+          return (
+            await Promise.all(
+              captured.map(async (file) => sha256Hex(await readFile(file.path)) === file.sha256),
+            )
+          ).every(Boolean);
+        } catch {
+          return false;
+        }
+      },
+    };
+  } catch {
+    return undefined;
+  }
+};

package/src/visible-launch-compose.ts

@@ -0,0 +1,273 @@
+// ---
+// summary: pure Fleet Phase-3 composition: standing-agent child argv, boot prompt with ACK protocol, and title.
+// read_when:
+//   - changing how a visible standing agent is composed from its manifest, or the ACK/boot prompt literals.
+// ---
+
+import { createHash, randomUUID } from "node:crypto";
+import type { AgentManifest } from "./manifest.ts";
+import type { ResolvedAgentLaunch } from "./registry.ts";
+import {
+  READ_ONLY_VISIBLE_LAUNCH_TOOLS,
+  VISIBLE_LAUNCH_ACK_TOOL,
+  VISIBLE_LAUNCH_SYSTEM_PROMPT_ARGV_LIMIT,
+  type VisibleLaunchReportBack,
+} from "./visible-launch-contract.ts";
+
+const EXACT_SESSION_ID_PATTERN =
+  /^session-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+
+const AMBIGUOUS_PARENT_PEER_TARGETS = new Set([
+  "active",
+  "controller",
+  "current",
+  "here",
+  "me",
+  "parent",
+  "self",
+  "this",
+]);
+
+export type ParentTargetCheck =
+  | { ok: true; target: string }
+  | { ok: false; reason: "missing" | "ambiguous" | "not_exact_session_id"; target?: string };
+
+/** Exact controller session id required for intercom report-back (peer-messaging target contract). */
+export function checkParentPeerTarget(value: string | undefined): ParentTargetCheck {
+  const target = value?.trim();
+  if (!target) return { ok: false, reason: "missing" };
+  if (AMBIGUOUS_PARENT_PEER_TARGETS.has(target.toLowerCase())) {
+    return { ok: false, reason: "ambiguous", target };
+  }
+  if (!EXACT_SESSION_ID_PATTERN.test(target)) {
+    return { ok: false, reason: "not_exact_session_id", target };
+  }
+  return { ok: true, target };
+}
+
+export function createStandingAgentRunId(): string {
+  return `standingagent-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+}
+
+/** Standing-agent tab/window title base. */
+export function standingAgentTitle(manifest: AgentManifest): string {
+  const label = manifest.display_name ?? manifest.name;
+  return `Standing: ${label} (${manifest.name})`;
+}
+
+/** Boot/report-back instructions mirroring the peer PEER_ACK/PEER_FINAL protocol literals. */
+export function standingAgentBootInstructions({
+  reportBack,
+  parentPeerTarget,
+  runId,
+  agentName,
+}: {
+  reportBack: VisibleLaunchReportBack;
+  parentPeerTarget?: string;
+  runId: string;
+  agentName: string;
+}): string {
+  if (reportBack !== "intercom") {
+    return `No intercom boot ACK is required because reportBack is ${reportBack}. Leave your status visible in this standing-agent session.`;
+  }
+  const target = parentPeerTarget?.trim();
+  if (!target) {
+    return "Intercom boot ACK requires an exact parentPeerTarget; this launch should not have reached the child without one.";
+  }
+  return [
+    "Before reading task context, inspecting files, or doing any other work, send the ACK below.",
+    "Only allowed pre-ACK tool: `intercom`.",
+    `Literal ACK call: \`intercom({ action: "send", to: "${target}", message: "PEER_ACK peer_run_id=${runId}: standing agent ${agentName} started" })\``,
+    "If the ACK send fails or intercom is unavailable, visibly report `ACK_FAILED` in this session and stop; do not continue work silently.",
+    "After ACK succeeds, follow the standing brief below. Send exactly one `PEER_FINAL` as your closing report when this exact bounded read-only objective ends; after `PEER_FINAL`, stop. Do not accept follow-on work under this launch admission.",
+  ].join("\n");
+}
+
+function standingAgentReportBackInstructions({
+  reportBack,
+  parentPeerTarget,
+  runId,
+}: {
+  reportBack: VisibleLaunchReportBack;
+  parentPeerTarget?: string;
+  runId: string;
+}): string {
+  if (reportBack === "intercom") {
+    const target = parentPeerTarget?.trim();
+    return [
+      "Use intercom for report-back if the tool is available.",
+      `Report to the exact parent target: ${target}`,
+      `Peer run id: ${runId}`,
+      "",
+      "## Intercom Message Budget",
+      `1. \`PEER_ACK peer_run_id=${runId}: ...\` — send once as your first action, identifying yourself as the standing agent.`,
+      `2. \`PEER_FINAL peer_run_id=${runId}: ...\` — send once as your closing report for an assigned objective or retirement.`,
+      `Use the literal target in tool calls, for example: \`intercom({ action: "send", to: "${target}", message: "PEER_FINAL peer_run_id=${runId}: ..." })\`.`,
+      "Intercom is communication only; it is not durable evidence or completion authority.",
+    ].join("\n");
+  }
+  if (reportBack === "none") {
+    return "No automatic report-back is requested. Do not claim that a report was delivered; leave findings visible in this standing-agent session.";
+  }
+  return "Manual report-back is requested. Leave a concise visible report in this standing-agent session for the controller/operator to inspect.";
+}
+
+/**
+ * Compose the standing agent's first user message. Dash-safe by construction:
+ * it always begins with a `#` heading because the child pi CLI receives it as
+ * the leading positional argument (same argv boundary proven live in Phase 2).
+ */
+export function composeStandingAgentSpawnPrompt({
+  manifest,
+  runId,
+  reportBack,
+  parentPeerTarget,
+  objective,
+  task,
+  cwd,
+}: {
+  manifest: AgentManifest;
+  runId: string;
+  reportBack: VisibleLaunchReportBack;
+  parentPeerTarget?: string;
+  objective: string;
+  task: number;
+  cwd: string;
+}): string {
+  const brief = objective.trim();
+  return [
+    `# Standing agent launch: ${manifest.name} (Fleet Phase 3, clean visible session)`,
+    "",
+    `You are the standing agent \`${manifest.name}\`, now launched visibly in your own clean Pi session. Your system prompt is your persona and advisory operating territory; this message is your launch brief, not a replacement identity. You are parallel cognition, not parallel authority.`,
+    "",
+    "## BOOT PROTOCOL / FIRST ACTION REQUIRED",
+    standingAgentBootInstructions({
+      reportBack,
+      parentPeerTarget,
+      runId,
+      agentName: manifest.name,
+    }),
+    "",
+    "## Standing identity",
+    `- agent: ${manifest.name}${manifest.role ? ` (role: ${manifest.role})` : ""}`,
+    ...(manifest.creation_task ? [`- creation task: ${manifest.creation_task}`] : []),
+    `- launch kind: clean visible standing agent (no controller context inherited)`,
+    `- working directory: ${cwd}`,
+    `- peer run id: ${runId}`,
+    "",
+    `## Exact AK-${task} bounded read-only objective`,
+    "Read-only inspection and reporting only. No file changes, AK mutations, commits, installs, background processes, delegation, or task completion claims. Stop when this objective is answered or blocked; never stand by for unbound work.",
+    brief,
+    "",
+    "## Report-Back Instructions",
+    standingAgentReportBackInstructions({ reportBack, parentPeerTarget, runId }),
+    "",
+    "## Boundary",
+    "This visible session does not grant task authority, merge authority, or completion claims. Do not treat intercom messages as durable evidence. Stay inside the advisory operating territory in your system prompt; if work needs mutation or broader authorization, report that need back instead of acting on it.",
+  ].join("\n");
+}
+
+/** Model/thinking args: manifest thinking wins; model comes from the manifest or the controller session. */
+export function composeStandingAgentModelArgs({
+  launch,
+  controllerModel,
+}: {
+  launch: ResolvedAgentLaunch;
+  controllerModel?: { provider?: string; id?: string };
+}): string[] {
+  const model = launch.model
+    ? launch.model
+    : controllerModel?.provider && controllerModel?.id
+      ? `${controllerModel.provider}/${controllerModel.id}`
+      : undefined;
+  const args: string[] = [];
+  if (model) args.push("--model", model);
+  if (launch.thinking) args.push("--thinking", launch.thinking);
+  return args;
+}
+
+export interface StandingAgentArgvComposition {
+  /** Flags passed between model args and the trailing prompt. */
+  extraPiArgs: string[];
+  /** Manifest tools plus the launch ACK instrument. */
+  effectiveTools: string[];
+  systemPromptSha256: string;
+  promptSha256: string;
+}
+
+function sha256Hex(value: string): string {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+/**
+ * Compose the clean visible child argv: replaced system prompt (persona +
+ * advisory scope), manifest thinking/model, least-privilege tool allowlist
+ * plus the ACK instrument, materialized skill dirs, and the trailing boot
+ * prompt. The system prompt is passed as the `--system-prompt` argv value and
+ * fails closed near the Linux per-argument byte bound.
+ */
+export function composeStandingAgentArgv({
+  launch,
+  prompt,
+  trustedExtensions,
+}: {
+  launch: ResolvedAgentLaunch;
+  prompt: string;
+  trustedExtensions: readonly string[];
+}): StandingAgentArgvComposition {
+  const declaredTools = launch.tools
+    .split(",")
+    .map((tool) => tool.trim())
+    .filter(Boolean);
+  const effectiveTools = [...declaredTools, VISIBLE_LAUNCH_ACK_TOOL];
+  const extraPiArgs: string[] = [
+    "--offline",
+    "--no-extensions",
+    "--no-skills",
+    "--no-prompt-templates",
+    "--system-prompt",
+    launch.systemPrompt,
+    "--tools",
+    effectiveTools.join(","),
+  ];
+  for (const extension of trustedExtensions) extraPiArgs.push("--extension", extension);
+  for (const skillDir of launch.skillDirs) {
+    extraPiArgs.push("--skill", skillDir);
+  }
+  return {
+    extraPiArgs,
+    effectiveTools,
+    systemPromptSha256: sha256Hex(launch.systemPrompt),
+    promptSha256: sha256Hex(prompt),
+  };
+}
+
+/** Size gate for the composed system prompt as one argv value. */
+export function systemPromptWithinArgvBound(systemPrompt: string): boolean {
+  // A small margin below MAX_ARG_STRLEN for NUL-termination accounting.
+  return (
+    !systemPrompt.includes("\0") &&
+    Buffer.from(systemPrompt, "utf8").toString("utf8") === systemPrompt &&
+    Buffer.byteLength(systemPrompt, "utf8") < VISIBLE_LAUNCH_SYSTEM_PROMPT_ARGV_LIMIT - 1
+  );
+}
+
+/** Shape-only argv projection for receipts: flag names with values redacted to digests/counts. */
+export function redactArgvForReceipt(extraPiArgs: string[]): string[] {
+  const projection: string[] = [];
+  for (let index = 0; index < extraPiArgs.length; index += 1) {
+    const flag = extraPiArgs[index];
+    projection.push(flag);
+    if (!["--offline", "--no-extensions", "--no-skills", "--no-prompt-templates"].includes(flag))
+      index += 1;
+  }
+  return projection;
+}
+
+/** Declared-tool gate helper shared by the pipeline and tests. */
+export function manifestToolsAreLaunchEligible(manifest: AgentManifest): boolean {
+  return (
+    manifest.tools.length > 0 &&
+    manifest.tools.every((tool) => READ_ONLY_VISIBLE_LAUNCH_TOOLS.includes(tool))
+  );
+}

package/src/visible-launch-contract.ts

@@ -0,0 +1,165 @@
+// ---
+// summary: Fleet Phase-3 clean visible standing-agent launch contract constants and types.
+// read_when:
+//   - changing the standing_agent_spawn Phase-3 gates, ACK instrument policy, or receipt/evidence semantics.
+// ---
+
+import type { AkAuthorizationFailureCode } from "./dispatch-authorization.ts";
+import type { AgentRegistry } from "./registry.ts";
+import type { TrustedVisibleLaunchBootstrapResolver } from "./visible-launch-bootstrap.ts";
+import type {
+  VisibleLaunchReceipt,
+  writeImmutableVisibleLaunchReceipt,
+} from "./visible-launch-receipt.ts";
+
+/**
+ * Fleet Phase 3 adds exactly one bounded surface: launching one registered
+ * standing agent as a CLEAN VISIBLE Pi TUI session in a Ghostty tab/window,
+ * composed from the fleet manifest, ACKing the controller through intercom,
+ * and recorded as one write-once launch receipt. It is an operator-surface
+ * capability, not ASC execution and not task authority: dispatch_agent keeps
+ * owning exact-task read-only dispatch, and AK keeps owning task/evidence
+ * truth. The launch does not authenticate the caller as any AK claimant.
+ */
+export const VISIBLE_LAUNCH_PHASE = "fleet_phase_3" as const;
+
+export const VISIBLE_LAUNCH_RECEIPT_SCHEMA = "pi-agent-registry.visible-launch-receipt/1" as const;
+
+export const VISIBLE_LAUNCH_EVIDENCE_CHECK_TYPE = "standing-agent-visible-launch" as const;
+
+/**
+ * Declared-tool gate for a visible standing-agent launch. Mirrors Phase-2
+ * read-only posture: `bash` is admitted only as the fleet's established
+ * read-only exploration instrument; a visible standing agent with mutation
+ * tools is a later fleet phase, not this contract.
+ */
+export const READ_ONLY_VISIBLE_LAUNCH_TOOLS: readonly string[] = ["read", "bash"];
+
+/**
+ * Report-back instrument added by the launch envelope. It is not part of the
+ * agent's declared manifest toolset (which stays the agent's own authority
+ * surface); the receipt records declared and effective tools separately so
+ * the ACK instrument never silently widens agent authority.
+ */
+export const VISIBLE_LAUNCH_ACK_TOOL = "intercom" as const;
+
+/**
+ * Provenance marker exported into every visibly launched standing-agent
+ * child. `standing_agent_spawn` refuses to run inside a session that already
+ * carries it, keeping visible standing-agent launches one level deep.
+ */
+export const VISIBLE_LAUNCH_CHILD_PROVENANCE_ENV =
+  "PI_PROVENANCE_STANDING_AGENT_VISIBLE_LAUNCH" as const;
+
+/**
+ * Linux MAX_ARG_STRLEN (32 pages) bounds one argv entry; a composed system
+ * prompt at or above this bound cannot be passed as `--system-prompt` argv
+ * and fails closed instead of silently truncating the agent persona.
+ */
+export const VISIBLE_LAUNCH_SYSTEM_PROMPT_ARGV_LIMIT = 131_072;
+
+export type VisibleLaunchReportBack = "intercom" | "manual" | "none";
+
+export type VisibleLaunchFailureReason =
+  | AkAuthorizationFailureCode
+  | "parent_repo_unobservable"
+  | "bootstrap_unavailable"
+  | "manifest_extensions_unapproved"
+  | "launch_already_reserved"
+  | "reservation_failed"
+  | "cancelled"
+  | "invalid_argv"
+  | "invalid_request"
+  | "invalid_parent_peer_target"
+  | "recursive_launch"
+  | "visible_transport_unavailable"
+  | "unknown_agent"
+  | "agent_not_read_only"
+  | "agent_repo_dirty"
+  | "agent_repo_drift"
+  | "agent_resolution_failed"
+  | "system_prompt_too_large"
+  | "launch_failed"
+  | "launch_indeterminate"
+  | "receipt_write_failed";
+
+export interface StandingAgentSpawnRequest {
+  /** Registered standing-agent name (agent.json `name`). */
+  agent: string;
+  /** Exact claimed AK task in the origin repository. */
+  task: number;
+  /** Nonblank bounded read-only objective; never a standby session. */
+  objective: string;
+  /** Report-back mode; intercom (default) requires an exact parent session id. */
+  reportBack?: VisibleLaunchReportBack;
+  /** Exact controller session id receiving PEER_ACK/PEER_FINAL. */
+  parentPeerTarget?: string;
+  /** Working directory for the child (default: the origin repository). */
+  cwd?: string;
+}
+
+/** Structural shape of the little-helpers visible transport seam. */
+export interface VisibleLaunchTransport {
+  launchPiQuestSession: (request: {
+    pi: unknown;
+    ctx: { model?: unknown; cwd?: string };
+    options?: Record<string, unknown>;
+    defaultPiBin: string;
+    prompt: string;
+    titlePrompt: string;
+    cwd: string;
+    titlePrefix?: string;
+    modelArgs?: string[];
+    extraPiArgs?: string[];
+    childProvenanceEnv?: Record<string, string>;
+    signal?: AbortSignal;
+  }) => Promise<{
+    ok: boolean;
+    effectDisposition: string;
+    launchMode: string;
+    sessionMode: string;
+    cwd: string;
+    titleBase: string;
+    promptSummary: string;
+    launchNote?: string;
+    failure?: string;
+  }>;
+}
+
+export interface StandingAgentSpawnDeps {
+  registry: AgentRegistry;
+  pi: unknown;
+  /** Test-only transport substitution; null forces unavailable. Never a tool parameter. */
+  transport?: VisibleLaunchTransport | null;
+  receiptsDir?: string;
+  akBinary?: string;
+  /** Trusted runtime dependency, not caller-supplied extension paths. */
+  resolveTrustedBootstrap?: TrustedVisibleLaunchBootstrapResolver;
+  /** Test seam for publication failures after transport admission. */
+  writeReceipt?: typeof writeImmutableVisibleLaunchReceipt;
+}
+export interface VisibleLaunchCtx {
+  cwd: string;
+  model?: { provider?: string; id?: string };
+}
+export interface StandingAgentSpawnSuccess {
+  ok: true;
+  phase: typeof VISIBLE_LAUNCH_PHASE;
+  admission: "transport_admitted";
+  receipt: VisibleLaunchReceipt;
+  receiptPath: string;
+  runId: string;
+  launchMode: string;
+}
+export interface StandingAgentSpawnFailure {
+  ok: false;
+  phase: typeof VISIBLE_LAUNCH_PHASE;
+  reason: VisibleLaunchFailureReason;
+  message: string;
+  effectDisposition: "confirmed_no_effects" | "settled" | "effect_indeterminate";
+  spawnAttempted: boolean;
+  runId?: string;
+  receipt?: VisibleLaunchReceipt;
+  receiptPath?: string;
+}
+export type StandingAgentSpawnOutcome = StandingAgentSpawnSuccess | StandingAgentSpawnFailure;

package/src/visible-launch-inputs.ts

@@ -0,0 +1,57 @@
+// summary: compare cached, freshly parsed, committed and worktree persona inputs without altering Phase 2.
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { canonicalJsonString } from "./dispatch-receipt.ts";
+import { knownEcProfiles } from "./ec-profiles.ts";
+import type { FleetGitSnapshot } from "./fleet-git-snapshot.ts";
+import {
+  type AgentManifest,
+  loadAgentManifest,
+  readAgentSystemPrompt,
+  validateAgentManifest,
+} from "./manifest.ts";
+import { type AgentRegistry, type ResolvedAgentLaunch, renderScopeSection } from "./registry.ts";
+
+export async function verifyVisibleLaunchInputs(
+  manifest: AgentManifest,
+  registry: AgentRegistry,
+  snapshot: FleetGitSnapshot,
+  launch?: ResolvedAgentLaunch,
+): Promise<boolean> {
+  try {
+    const committed = await snapshot.readFile("agent.json", 64 * 1024);
+    const persona = await snapshot.readFile(manifest.system_prompt_file, 512 * 1024);
+    if (!committed || !persona) return false;
+    const options = { ecProfiles: knownEcProfiles(registry.ec) };
+    const parsed = validateAgentManifest(
+      JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(committed.bytes)),
+      snapshot.root,
+      join(snapshot.root, "agent.json"),
+      options,
+    );
+    const fresh = await loadAgentManifest(snapshot.root, options);
+    const normalized = canonicalJsonString(parsed);
+    if (
+      normalized !== canonicalJsonString(manifest) ||
+      normalized !== canonicalJsonString(fresh) ||
+      normalized !== canonicalJsonString(registry.get(manifest.name))
+    )
+      return false;
+    if (!(await readFile(parsed.manifestPath)).equals(committed.bytes)) return false;
+    const prompt = await readAgentSystemPrompt(parsed);
+    if (!Buffer.from(prompt, "utf8").equals(persona.bytes)) return false;
+    const scope = renderScopeSection(parsed);
+    const composed = scope ? `${prompt.replace(/\s+$/u, "")}\n\n---\n\n${scope}` : prompt;
+    return (
+      !launch ||
+      (launch.systemPrompt === composed &&
+        launch.name === parsed.name &&
+        launch.tools === parsed.tools.join(",") &&
+        launch.model === parsed.defaults.model &&
+        launch.thinking === parsed.defaults.thinking &&
+        launch.extensions.length === 0)
+    );
+  } catch {
+    return false;
+  }
+}