@xrkseek/harness 0.3.11 → 0.4.0-rc.2

package/node_modules/@xrkseek/server-host/dist/index.js

@@ -1,18 +1,25 @@
 import { createLocalAttachmentStore, resolveLocalAttachmentsRoot } from "@xrkseek/attachment-local";
-import { createMemorySessionStore, createPersistentSessionStore, createSessionDrainHub, newSession, } from "@xrkseek/core-session";
+import { createMemorySessionStore, createPersistentSessionStore, createSessionDrainHub, newSession, SessionsDirInUseError, } from "@xrkseek/core-session";
 import { createProviderRegistry } from "@xrkseek/llm-registry";
-import { createPolicyEngineFromFile } from "@xrkseek/policy";
+import { loadPolicyRulesetFile } from "@xrkseek/policy";
 import { hostSettingsPath, defaultSpillDir, resolveXrkHome } from "@xrkseek/server-config";
 import { installOutboundHttpProxy } from "./http-proxy.js";
-import { applyXrkProductBootPolicy, chainPublicHandlers, ensureDshCompatHostPlugin, createHostPluginsPublicHandler, createHttpServer, createXrkPluginPublicHandler, createSidebarPublicHandler, prewarmDshCompatAdapters, shutdownDshCompatServices, applyHostPackageByName, stopHostPackageFiber, listHostAppliedPackages, invokeDshCompatRpc, attachDshCompatUpgrades, DSH_SETTINGS_NAMESPACES, DSH_SETTINGS_DEFAULTS, runPluginMutate, ensureXrkPlatformClientBootEntries, injectBootIntoHtml, injectMobileAccessShellIntoHtml, loadBootManifestFromWebDist, mergeWebBootManifests, resolveWebBootManifest, createXrkWalletPort, createMobileAccessGateChecker, createMobileAccessGateHandler, } from "@xrkseek/server-http";
-import { attachFaceUpgrades, bindSubagentTools, createFaceRuntime, effectiveHostApiKey, isLoopbackAddress, publishRemoteEvent, createSessionRoutingLlm, liveRouteAllowsImageInput, resolveSessionCwd, canonicalAgentPresetId, resolveAgentPresetProfile, tryHandleFaceHttp, isPluginSoftDisabledAt, readDisabledPluginIdsAt, readManagedPackageIndexAt, reconcileManagedProcessPlugins, } from "@xrkseek/server-face";
-import { createPluginLoader, wireCompositionChannels, wireCompositionLlm, collectChannelPluginRegistrations, } from "@xrkseek/server-loader";
+import { watchPolicyFile } from "./policy-file-watch.js";
+import { applyXrkProductBootPolicy, chainPublicHandlers, ensureDshCompatHostPlugin, createLiveHostPluginsPublicHandler, createHttpServer, createXrkPluginPublicHandler, createSidebarPublicHandler, prewarmDshCompatAdapters, shutdownDshCompatServices, applyHostPackageByName, stopHostPackageFiber, listHostAppliedPackages, invokeDshCompatRpc, attachDshCompatUpgrades, DSH_SETTINGS_NAMESPACES, DSH_SETTINGS_DEFAULTS, runPluginMutate, ensureXrkPlatformClientBootEntries, injectBootIntoHtml, injectMobileAccessShellIntoHtml, loadBootManifestFromWebDist, mergeWebBootManifests, resolveWebBootManifest, createXrkWalletPort, createMobileAccessGateChecker, createMobileAccessGateHandler, loadSidebarPrefs, } from "@xrkseek/server-http";
+import { attachFaceUpgrades, bindSubagentTools, createFaceRuntime, effectiveHostApiKey, isLoopbackAddress, publishRemoteEvent, createSessionRoutingLlm, liveRouteAllowsImageInput, resolveSessionCwd, canonicalAgentPresetId, resolveAgentPresetProfile, DEFAULT_MAX_DEPTH, DEFAULT_MAX_ACTIVE_CHILDREN, tryHandleFaceHttp, isPluginSoftDisabledAt, readDisabledPluginIdsAt, readManagedPackageIndexAt, reconcileManagedProcessPlugins, } from "@xrkseek/server-face";
+import { createPluginLoader, composeHostPolicyEngine, wireCompositionChannels, wireCompositionLlm, collectChannelPluginRegistrations, } from "@xrkseek/server-loader";
 import { existsSync } from "node:fs";
 import { access } from "node:fs/promises";
 import path from "node:path";
 import { createHostAgentCache } from "./agent-cache.js";
+import { createHostCron } from "@xrkseek/server-cron";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { wireDrainStatus, publishDrainIdle } from "./drain-status.js";
 import { attachSidebarPtyUpgrades } from "./sidebar-pty.js";
+import { AgentOpenRegistry } from "./sidebar-agent-opens.js";
+import { AgentPtyRegistry } from "./sidebar-agent-pty.js";
+import { createSshDirectoryBackend } from "./ssh-directory-backend.js";
+import { bindSidebarAgentTools } from "./sidebar-agent-tools.js";
 import { createUsageStatsBridgeFromFace } from "./usage-stats-bridge.js";
 import { createCostMeterUsageBridge } from "./cost-meter-bridge.js";
 import { createHarnessConnectorBridgeFromFace } from "./harness-connector-bridge.js";
@@ -20,13 +27,17 @@ import { createAutoReviewBridgeFromHost } from "./auto-review-bridge.js";
 import { createWalletFaceBridgeFromFace } from "./wallet-bridge.js";
 import { createSidebarFaceBridgeFromFace } from "./sidebar-face-bridge.js";
 import { mcpDraftsToSpecs, parseMcpServersEnv, readMcpAllowFromHostSettings, readMcpServersFromHostSettings, reconcileMcpToolPlugins, } from "./mcp-wire.js";
+import { createMcpDeferredDispose } from "./mcp-deferred-dispose.js";
 import { createStandingToolRegistry } from "./standing-tools.js";
 import { createDefaultPtyAccess } from "@xrkseek/exec-pty";
 import { createLocalShell } from "@xrkseek/exec-shell";
 import { createLocalSubprocess } from "@xrkseek/exec-subprocess";
+import { createSshExecutionWorld, resolveSshConfigFromEnv, } from "@xrkseek/exec-ssh";
+/** True while an unattended cron agent turn is running — skip cron tools to avoid recursion. */
+const cronAgentDepth = new AsyncLocalStorage();
 export { createHostAgentCache, HOST_PLUGINS_KEY } from "./agent-cache.js";
 export { createStandingToolRegistry } from "./standing-tools.js";
-export { loadMcpToolPlugins, mcpDraftsToSpecs, mcpFingerprint, parseMcpServersEnv, readMcpAllowFromHostSettings, readMcpServersFromHostSettings, reconcileMcpToolPlugins, } from "./mcp-wire.js";
+export { loadMcpToolPlugins, mcpDraftsToSpecs, mcpFingerprint, parseMcpServersEnv, readMcpAllowFromHostSettings, readMcpServersFromHostSettings, reconcileMcpToolPlugins, resetLastGoodHostMcpWireCaches, } from "./mcp-wire.js";
 function logMcpReconcile(log, label, result) {
     if (!log)
         return;
@@ -94,9 +105,19 @@ export function createHostManager() {
             }
             const id = `host_${++seq}`;
             const sessionsDir = config.runtime.sessionsDir?.trim();
-            const store = sessionsDir
-                ? createPersistentSessionStore(sessionsDir)
-                : createMemorySessionStore();
+            let store;
+            try {
+                store = sessionsDir
+                    ? createPersistentSessionStore(sessionsDir)
+                    : createMemorySessionStore();
+            }
+            catch (err) {
+                if (err instanceof SessionsDirInUseError) {
+                    log?.error(err.message);
+                    throw err;
+                }
+                throw err;
+            }
             const loader = createPluginLoader();
             const registry = createProviderRegistry();
             // Face / mutate / soft-disable always share this absolute path. Config may
@@ -110,13 +131,45 @@ export function createHostManager() {
             let loadedPluginIds = [];
             if (managedPluginsRootReady()) {
                 // Single path with Settings soft-disable: discover+load enabled,
-                // skip soft-disabled (never mcp:*).
-                loadedPluginIds = [
-                    ...(await reconcileManagedProcessPlugins(loader, resolvedPluginsDir)),
-                ];
+                // skip soft-disabled (never mcp:*). Optional load failures warn;
+                // required failures throw (abort spawn).
+                const bootPlugins = await reconcileManagedProcessPlugins(loader, resolvedPluginsDir);
+                loadedPluginIds = [...bootPlugins.ids];
+                for (const failure of bootPlugins.failures) {
+                    log?.warn(`plugin load failed (${failure.id}): ${failure.message}`);
+                }
             }
-            const policy = config.runtime.policyFile
-                ? await createPolicyEngineFromFile(config.runtime.policyFile)
+            // File rules first, then kind:policy plugins. Delegate so a later
+            // plugin refresh / policy-file watch rebuilds without swapping captures.
+            let filePolicy = config.runtime.policyFile
+                ? await loadPolicyRulesetFile(config.runtime.policyFile)
+                : undefined;
+            let policyEngine = composeHostPolicyEngine({
+                ...(filePolicy !== undefined ? { file: filePolicy } : {}),
+                plugins: loader.list(),
+            });
+            const policy = {
+                evaluate: (subject) => policyEngine.evaluate(subject),
+            };
+            const rebuildPolicyEngine = () => {
+                policyEngine = composeHostPolicyEngine({
+                    ...(filePolicy !== undefined ? { file: filePolicy } : {}),
+                    plugins: loader.list(),
+                });
+            };
+            const policyFileWatch = config.runtime.policyFile
+                ? watchPolicyFile({
+                    filePath: config.runtime.policyFile,
+                    onReload: (next) => {
+                        filePolicy = next;
+                        rebuildPolicyEngine();
+                        log?.info(`policy reloaded (${config.runtime.policyFile})`);
+                    },
+                    onError: (err) => {
+                        const msg = err instanceof Error ? err.message : String(err);
+                        log?.warn(`policy reload skipped: ${msg}`);
+                    },
+                })
                 : undefined;
             const hostPublic = {
                 host: config.runtime.host,
@@ -143,6 +196,18 @@ export function createHostManager() {
             const pendingAgentInvalidate = new Set();
             const drainActiveBox = {
                 isActive: () => false,
+                activeIds: () => [],
+            };
+            /** Soft-detach MCP while drains hold mid-turn tool handles. */
+            const mcpDeferred = createMcpDeferredDispose({
+                detach: (id) => loader.detach(id),
+                unregister: (id) => loader.unregister(id),
+                isBusy: () => drainActiveBox.activeIds().length > 0 ||
+                    pendingAgentInvalidate.size > 0,
+            });
+            const mcpUnregister = async (pluginId) => {
+                await mcpDeferred.remove(pluginId);
+                loadedPluginIds = loadedPluginIds.filter((x) => x !== pluginId);
             };
             /** Mutable Face inventory — Host splices after MCP reconcile / health. */
             const facePlugins = [];
@@ -150,6 +215,7 @@ export function createHostManager() {
                 facePlugins.splice(0, facePlugins.length, ...loader.list());
                 wireCompositionLlm(registry, { plugins: loader.list() });
                 wireCompositionChannels({ plugins: loader.list() });
+                rebuildPolicyEngine();
                 hostPublic.processChannels = collectChannelPluginRegistrations(loader.list()).map((row) => ({
                     pluginId: row.pluginId,
                     channelId: row.channelId,
@@ -189,12 +255,11 @@ export function createHostManager() {
                             loadedPluginIds = [...loadedPluginIds, plugin.id];
                         }
                     },
-                    unregister: async (pluginId) => {
-                        await loader.unregister(pluginId);
-                        loadedPluginIds = loadedPluginIds.filter((x) => x !== pluginId);
-                    },
-                    ...(policy ? { policy } : {}),
+                    unregister: mcpUnregister,
+                    retained: () => mcpDeferred.retained(),
+                    policy,
                     allowConnect: mcpAllowConnect,
+                    workspaceRoot: config.runtime.workspaceRoot,
                     imageAdmission: mcpImageAdmission,
                     ...mcpHooks,
                 });
@@ -204,7 +269,8 @@ export function createHostManager() {
             const agentCache = createHostAgentCache(loader.list(), { hostId: id });
             // MCP remount / settings_mutate runs inside an active drain. Aborting that
             // agent mid-tool yields "Error: tool call aborted". Skip active sessions
-            // and invalidate them after the turn settles.
+            // and invalidate them after the turn settles. Soft-detach (not dispose)
+            // MCP clients until those drains go idle — see mcpDeferred.
             invalidateAgents = async () => {
                 await agentCache.invalidateAll({
                     skip: (sessionId) => {
@@ -214,16 +280,42 @@ export function createHostManager() {
                         return true;
                     },
                 });
+                await mcpDeferred.flush();
             };
             let mcpSyncTail = Promise.resolve();
             const lastDrainResult = new Map();
-            const sharedPty = config.runtime.preset === "harness" || config.runtime.preset === "server"
+            // Local Host + remote cwd: swap fs/shell (Hermes/DSH provider pattern).
+            let sshWorld;
+            /** Local Host cwd before SSH workspace swap (browse/settings anchor). */
+            let localHostRoot;
+            try {
+                const sshConfig = resolveSshConfigFromEnv(process.env);
+                if (sshConfig) {
+                    localHostRoot = config.runtime.workspaceRoot;
+                    sshWorld = createSshExecutionWorld({ config: sshConfig });
+                    // Tool coordinates are the remote workspace; Face session cwd follows.
+                    config.runtime.workspaceRoot =
+                        sshWorld.workspaceRoot;
+                }
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                throw new Error(`SSH remote workspace: ${message}`, { cause: err });
+            }
+            const sharedPty = !sshWorld &&
+                (config.runtime.preset === "harness" ||
+                    config.runtime.preset === "server")
                 ? createDefaultPtyAccess({
                     workspaceRoot: config.runtime.workspaceRoot,
                 })
                 : undefined;
             const sharedShell = config.runtime.preset === "harness" || config.runtime.preset === "server"
-                ? createLocalShell({ subprocess: createLocalSubprocess() })
+                ? createLocalShell({
+                    subprocess: sshWorld
+                        ? sshWorld.subprocess
+                        : createLocalSubprocess(),
+                    defaultCwd: config.runtime.workspaceRoot,
+                })
                 : undefined;
             const ensureSession = (sid) => newSession(store, sid).id;
             const faceBox = {};
@@ -235,6 +327,10 @@ export function createHostManager() {
             const lineage = {
                 parentOf: () => undefined,
             };
+            // Sidebar agent-opens / agent-terminals — Host registries (not plugin host.mjs).
+            const agentOpenRegistry = new AgentOpenRegistry();
+            const agentPtyRegistry = new AgentPtyRegistry();
+            const cronBox = {};
             const resolveAgent = async (sessionId) => {
                 // Cache composition binding only — never treat AgentHandle as transcript source (ADR-0003).
                 const parentSessionId = lineage.parentOf(sessionId);
@@ -251,6 +347,7 @@ export function createHostManager() {
                         ...(wsRow?.title ? { workspaceDisplayTitle: wsRow.title } : {}),
                         plugins: loader.list(),
                         attachments,
+                        // Spill subtree + attachments only — never resolveXrkHome().
                         hostReadableRoots: [
                             attachmentsRoot,
                             defaultSpillDir(),
@@ -270,6 +367,16 @@ export function createHostManager() {
                         resolveFilePath: (ref) => attachments.fileHostPath?.(ref),
                         ...(sharedPty ? { ptyService: sharedPty.service } : {}),
                         ...(sharedShell ? { shellJobs: sharedShell } : {}),
+                        ...(cronBox.scheduler && !cronAgentDepth.getStore()
+                            ? { cronScheduler: cronBox.scheduler }
+                            : {}),
+                        ...(sshWorld
+                            ? {
+                                fs: sshWorld.fs,
+                                remoteExecution: true,
+                                codeRuntime: sshWorld.codeRuntime,
+                            }
+                            : {}),
                         ...(llmResolverBox.resolve
                             ? { resolveLlm: llmResolverBox.resolve }
                             : {}),
@@ -313,17 +420,51 @@ export function createHostManager() {
                     if (agent.tools && faceBox.runtime) {
                         const profile = resolveAgentPresetProfile(agentPreset ?? config.runtime.preset, config.runtime.preset);
                         if (profile.subagents.mode === "on") {
+                            const faceDepth = pluginSettings.maxSubagentDepth ?? DEFAULT_MAX_DEPTH;
+                            const faceActive = pluginSettings.maxActiveSubagents ??
+                                DEFAULT_MAX_ACTIVE_CHILDREN;
+                            const presetDepth = profile.subagents.maxDepth;
+                            const presetActive = profile.subagents.maxActiveChildren;
+                            const maxDepth = presetDepth !== undefined
+                                ? Math.min(faceDepth, presetDepth)
+                                : faceDepth;
+                            const maxActiveChildren = presetActive !== undefined
+                                ? Math.min(faceActive, presetActive)
+                                : faceActive;
                             bindSubagentTools(agent.tools, {
                                 runtime: faceBox.runtime,
                                 parentSessionId: sessionId,
-                                ...(profile.subagents.maxDepth !== undefined
-                                    ? { maxDepth: profile.subagents.maxDepth }
-                                    : {}),
-                                ...(profile.subagents.maxActiveChildren !== undefined
-                                    ? {
-                                        maxActiveChildren: profile.subagents.maxActiveChildren,
-                                    }
-                                    : {}),
+                                maxDepth,
+                                maxActiveChildren,
+                            });
+                        }
+                        const prefs = loadSidebarPrefs(resolveXrkHome()).value;
+                        if (prefs.agentOpenTools === true ||
+                            prefs.agentTerminalTools === true) {
+                            bindSidebarAgentTools(agent.tools, {
+                                sessionId,
+                                agentOpens: agentOpenRegistry,
+                                agentPty: agentPtyRegistry,
+                                resolveCwd: (sid) => resolveSessionCwd(faceBox.runtime, sid) ??
+                                    faceBox.runtime.workspaceRoot,
+                                readPrefs: () => loadSidebarPrefs(resolveXrkHome()).value,
+                                readShellOverrides: () => {
+                                    const p = loadSidebarPrefs(resolveXrkHome()).value;
+                                    const shell = typeof p.terminalShell === "string" &&
+                                        p.terminalShell.trim()
+                                        ? p.terminalShell.trim()
+                                        : undefined;
+                                    const shellArgsRaw = typeof p.terminalShellArgs === "string"
+                                        ? p.terminalShellArgs.trim()
+                                        : "";
+                                    const shellArgs = shellArgsRaw.length > 0
+                                        ? shellArgsRaw.split(/\s+/).filter(Boolean)
+                                        : undefined;
+                                    return {
+                                        ...(shell ? { shell } : {}),
+                                        ...(shellArgs ? { shellArgs } : {}),
+                                    };
+                                },
                             });
                         }
                     }
@@ -354,7 +495,10 @@ export function createHostManager() {
                             }
                             if (!running && pendingAgentInvalidate.has(sid)) {
                                 pendingAgentInvalidate.delete(sid);
-                                void agentCache.invalidate(sid);
+                                void agentCache.invalidate(sid).then(() => mcpDeferred.flush());
+                            }
+                            else if (!running) {
+                                void mcpDeferred.flush();
                             }
                             hostStatusBox.publish?.(sid, running);
                         });
@@ -365,6 +509,41 @@ export function createHostManager() {
                 hostStatusBox.publish?.(sessionId, running);
             }, lastDrainResult);
             drainActiveBox.isActive = (sessionId) => drain.isActive(sessionId);
+            drainActiveBox.activeIds = () => hub.activeIds();
+            cronBox.scheduler = createHostCron({
+                productHome: resolveXrkHome(),
+                workspaceRoot: config.runtime.workspaceRoot,
+                runAgent: async (job, signal) => {
+                    const run = job.run;
+                    if (run.kind !== "agent") {
+                        return {
+                            ok: false,
+                            output: "",
+                            error: "not an agent job",
+                        };
+                    }
+                    return cronAgentDepth.run(true, async () => {
+                        const session = store.create();
+                        const agent = await resolveAgent(session.id);
+                        const result = await agent.continueTurn({
+                            text: `[cron ${job.id}${job.name ? ` ${job.name}` : ""}]\n${run.prompt}`,
+                            ...(signal ? { signal } : {}),
+                        });
+                        return {
+                            ok: true,
+                            output: result.text,
+                            sessionId: session.id,
+                        };
+                    });
+                },
+                onError: (err) => {
+                    log?.warn(`cron: ${err instanceof Error ? err.message : String(err)}`);
+                },
+            });
+            cronBox.scheduler?.start();
+            if (cronBox.scheduler) {
+                log?.info("cron ticker started (~/.xrk/cron/jobs.json)");
+            }
             const webOverlay = await resolveWebPluginOverlay(resolvedPluginsDir);
             const overlayBoot = webOverlay
                 ? loadBootManifestFromWebDist(webOverlay)
@@ -381,6 +560,30 @@ export function createHostManager() {
                     entries: overlayBoot.entries.filter((e) => !isPluginSoftDisabledAt(e.id, disabledIds, packageIndex)),
                 };
             const boot = applyXrkProductBootPolicy(ensureXrkPlatformClientBootEntries(mergeWebBootManifests(resolveWebBootManifest(config.runtime.webDist), filteredOverlay), config.runtime.webDist));
+            // Mutable like facePlugins: soft-disable / remove rewrite boot.json, so
+            // inventory must re-read overlay or removed clients stay as active ghosts.
+            const faceWebPlugins = [];
+            const refreshFaceWebPlugins = async () => {
+                if (!config.runtime.webDist) {
+                    faceWebPlugins.splice(0, faceWebPlugins.length);
+                    return;
+                }
+                const overlayRoot = await resolveWebPluginOverlay(resolvedPluginsDir);
+                const nextOverlay = overlayRoot
+                    ? loadBootManifestFromWebDist(overlayRoot)
+                    : undefined;
+                const disabled = readDisabledPluginIdsAt(resolvedPluginsDir);
+                const index = readManagedPackageIndexAt(resolvedPluginsDir);
+                const filtered = nextOverlay === undefined || disabled.size === 0
+                    ? nextOverlay
+                    : {
+                        rev: nextOverlay.rev,
+                        entries: nextOverlay.entries.filter((e) => !isPluginSoftDisabledAt(e.id, disabled, index)),
+                    };
+                const nextBoot = applyXrkProductBootPolicy(ensureXrkPlatformClientBootEntries(mergeWebBootManifests(resolveWebBootManifest(config.runtime.webDist), filtered), config.runtime.webDist));
+                faceWebPlugins.splice(0, faceWebPlugins.length, ...nextBoot.entries.map((e) => ({ id: e.id })));
+            };
+            faceWebPlugins.push(...boot.entries.map((e) => ({ id: e.id })));
             const hostWireRef = {};
             const syncCordisHostApplied = () => {
                 hostPublic.cordisHostApplied = listHostAppliedPackages().map((row) => row.packageName);
@@ -393,6 +596,13 @@ export function createHostManager() {
                 store,
                 resolveAgent,
                 workspaceRoot: config.runtime.workspaceRoot,
+                ...(sshWorld
+                    ? {
+                        remoteExecution: true,
+                        ...(localHostRoot !== undefined ? { localHostRoot } : {}),
+                        directoryBackend: createSshDirectoryBackend(sshWorld),
+                    }
+                    : {}),
                 // Face settings / credentials / workspaces.json / host-settings → harness home.
                 productDir: resolveXrkHome(),
                 tools: createStandingToolRegistry({
@@ -439,10 +649,13 @@ export function createHostManager() {
                 syncManagedProcessPlugins: async () => {
                     if (!managedPluginsRootReady())
                         return;
-                    loadedPluginIds = [
-                        ...(await reconcileManagedProcessPlugins(loader, resolvedPluginsDir)),
-                    ];
+                    const synced = await reconcileManagedProcessPlugins(loader, resolvedPluginsDir);
+                    loadedPluginIds = [...synced.ids];
+                    for (const failure of synced.failures) {
+                        log?.warn(`plugin load failed (${failure.id}): ${failure.message}`);
+                    }
                     refreshFacePlugins();
+                    await refreshFaceWebPlugins();
                     await invalidateAgents();
                 },
                 ...(mcpFileSourced
@@ -459,12 +672,11 @@ export function createHostManager() {
                                             loadedPluginIds = [...loadedPluginIds, plugin.id];
                                         }
                                     },
-                                    unregister: async (pluginId) => {
-                                        await loader.unregister(pluginId);
-                                        loadedPluginIds = loadedPluginIds.filter((x) => x !== pluginId);
-                                    },
-                                    ...(policy ? { policy } : {}),
+                                    unregister: mcpUnregister,
+                                    retained: () => mcpDeferred.retained(),
+                                    policy,
                                     allowConnect: mcpAllowConnect,
+                                    workspaceRoot: config.runtime.workspaceRoot,
                                     imageAdmission: mcpImageAdmission,
                                     ...mcpHooks,
                                 });
@@ -483,7 +695,7 @@ export function createHostManager() {
                     }
                     : {}),
                 ...(config.runtime.webDist
-                    ? { webPlugins: boot.entries.map((e) => ({ id: e.id })) }
+                    ? { webPlugins: faceWebPlugins }
                     : {}),
                 hostPublic,
                 cordisHostBridge: {
@@ -514,14 +726,17 @@ export function createHostManager() {
                     },
                 },
                 bootstrapApiKey: config.credentials.apiKey,
-                ...(policy ? { policy } : {}),
+                policy,
                 ...(config.runtime.policyFile
                     ? { settingsDocumentPath: path.resolve(config.runtime.policyFile) }
                     : {}),
                 invalidateAgent: (sessionId) => agentCache.invalidate(sessionId),
                 ...createAutoReviewBridgeFromHost(resolveXrkHome()),
                 ...(sharedPty
-                    ? { hasPtyActivity: () => sharedPty.service.hasActivity() }
+                    ? {
+                        // Agent terminal_* registry only — never sidebar user PTYs.
+                        hasPtyActivity: () => sharedPty.service.hasActivity(),
+                    }
                     : {}),
                 drain: {
                     wake: (sessionId) => drain.wake(sessionId),
@@ -544,6 +759,38 @@ export function createHostManager() {
             faceBox.approvals = faceRuntime.approvals;
             faceBox.questions = faceRuntime.questions;
             faceBox.runtime = faceRuntime;
+            // Face hydrate may migrate legacy settings.yaml mcp → host-settings after
+            // boot reconcile already ran with []. Remount once when file-sourced.
+            if (mcpFileSourced && mcpSpecs.length === 0) {
+                const mcpUser = faceRuntime.settingsNamespaces.ensure("mcp").user;
+                const drafts = Array.isArray(mcpUser.servers)
+                    ? mcpUser.servers
+                    : [];
+                const desired = mcpDraftsToSpecs(drafts);
+                if (desired.length > 0) {
+                    mcpAllowConnect = resolveMcpAllowConnect(config, mcpUser.allowConnect === true);
+                    const migrated = await reconcileMcpToolPlugins({
+                        desired,
+                        list: () => loader.list(),
+                        register: (plugin) => {
+                            loader.register(plugin);
+                            if (!loadedPluginIds.includes(plugin.id)) {
+                                loadedPluginIds = [...loadedPluginIds, plugin.id];
+                            }
+                        },
+                        unregister: mcpUnregister,
+                        retained: () => mcpDeferred.retained(),
+                        policy,
+                        allowConnect: mcpAllowConnect,
+                        workspaceRoot: config.runtime.workspaceRoot,
+                        imageAdmission: mcpImageAdmission,
+                        ...mcpHooks,
+                    });
+                    logMcpReconcile(log, "yaml-migrate", migrated);
+                    refreshFacePlugins();
+                    await invalidateAgents();
+                }
+            }
             sessionCwdBox.get = (sessionId) => resolveSessionCwd(faceRuntime, sessionId);
             sessionPresetBox.get = (sessionId) => faceRuntime.sessionAgentPresets.get(sessionId);
             hostStatusBox.publish = (sessionId, running) => {
@@ -608,6 +855,16 @@ export function createHostManager() {
                     loop.toolResultMaxInlineBytes >= 0
                     ? Math.floor(loop.toolResultMaxInlineBytes)
                     : undefined;
+                const maxSubagentDepth = typeof loop.maxSubagentDepth === "number" &&
+                    Number.isFinite(loop.maxSubagentDepth) &&
+                    loop.maxSubagentDepth >= 1
+                    ? Math.min(3, Math.floor(loop.maxSubagentDepth))
+                    : undefined;
+                const maxActiveSubagents = typeof loop.maxActiveSubagents === "number" &&
+                    Number.isFinite(loop.maxActiveSubagents) &&
+                    loop.maxActiveSubagents >= 1
+                    ? Math.min(16, Math.floor(loop.maxActiveSubagents))
+                    : undefined;
                 const timeoutMs = typeof bash.timeoutMs === "number" &&
                     Number.isFinite(bash.timeoutMs) &&
                     bash.timeoutMs > 0
@@ -674,6 +931,8 @@ export function createHostManager() {
                     ...(toolResultMaxInlineBytes !== undefined
                         ? { toolResultMaxInlineBytes }
                         : {}),
+                    ...(maxSubagentDepth !== undefined ? { maxSubagentDepth } : {}),
+                    ...(maxActiveSubagents !== undefined ? { maxActiveSubagents } : {}),
                     bashLimits: {
                         ...(timeoutMs !== undefined ? { timeoutMs } : {}),
                         maxOutputBytes,
@@ -757,6 +1016,16 @@ export function createHostManager() {
                     ...(sharedShell ? { shell: sharedShell } : {}),
                 }),
                 harnessConnector: createHarnessConnectorBridgeFromFace(faceRuntime),
+                policy,
+                resolvePolicyAsk: async (args) => {
+                    if (!args.sessionId)
+                        return undefined;
+                    return faceRuntime.approvals.requestHostGate(args.sessionId, {
+                        kind: args.subject.kind,
+                        reason: args.reason,
+                        summary: JSON.stringify(args.subject),
+                    });
+                },
             };
             hostWireRef.ctx = hostWireCtx;
             await prewarmDshCompatAdapters(hostWireCtx);
@@ -777,10 +1046,15 @@ export function createHostManager() {
                     resolveSessionCwd: (sessionId) => resolveSessionCwd(faceRuntime, sessionId),
                     sidebarFace: hostWireCtx.sidebarFace,
                     pluginsDir: resolvedPluginsDir,
+                    agentRegistries: {
+                        closeAgentPty: (uuid) => agentPtyRegistry.close(uuid),
+                    },
+                    policy,
+                    resolvePolicyAsk: hostWireCtx.resolvePolicyAsk,
                 }), createXrkPluginPublicHandler({
                     pluginsDir: resolvedPluginsDir,
                     xrkHome: resolveXrkHome(),
-                }), createHostPluginsPublicHandler(loader.list(), hostWireCtx)),
+                }), createLiveHostPluginsPublicHandler(() => loader.list(), hostWireCtx)),
                 ...(log
                     ? {
                         onAccess: (info) => {
@@ -809,13 +1083,21 @@ export function createHostManager() {
                     const dshUpgrades = attachDshCompatUpgrades(server, {
                         checkAuth: faceCheckAuth,
                     });
-                    const sidebarPty = attachSidebarPtyUpgrades(server, {
-                        defaultCwd: faceRuntime.workspaceRoot,
-                        checkAuth: faceCheckAuth,
-                    });
+                    // Sidebar interactive PTY is Host-local node-pty — not SSH. Skip when
+                    // remote so defaultCwd is never a remote POSIX path on the Host disk.
+                    const sidebarPty = sshWorld
+                        ? { close() { } }
+                        : attachSidebarPtyUpgrades(server, {
+                            defaultCwd: faceRuntime.workspaceRoot,
+                            checkAuth: faceCheckAuth,
+                            agentPty: agentPtyRegistry,
+                            agentOpens: agentOpenRegistry,
+                        });
                     return {
                         close() {
                             sidebarPty.close();
+                            agentPtyRegistry.disposeAll();
+                            agentOpenRegistry.dispose();
                             dshUpgrades.close();
                             face.close();
                             shutdownDshCompatServices();
@@ -864,6 +1146,8 @@ export function createHostManager() {
                         return stopPromise;
                     status = "stopped";
                     stopPromise = (async () => {
+                        cronBox.scheduler?.stop();
+                        policyFileWatch?.dispose();
                         await http.close();
                         await agentCache.dispose();
                         if (sharedShell) {
@@ -874,6 +1158,14 @@ export function createHostManager() {
                                 // Host stop must continue even if jobs teardown partially fails.
                             }
                         }
+                        if (sshWorld) {
+                            try {
+                                sshWorld.dispose();
+                            }
+                            catch {
+                                // Host stop must continue even if SSH ControlMaster exit fails.
+                            }
+                        }
                         if (sharedPty) {
                             try {
                                 await sharedPty.service.dispose();