agent-relay-runner 0.88.3 → 0.89.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-runner",
-  "version": "0.88.3",
+  "version": "0.89.1",
   "description": "Unified provider lifecycle runner for Agent Relay",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "directory": "runner"
   },
   "dependencies": {
-    "agent-relay-sdk": "0.2.67"
+    "agent-relay-sdk": "0.2.68"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-relay-runner",
   "description": "Thin Agent Relay runner bridge for Claude Code",
-  "version": "0.88.3",
+  "version": "0.89.1",
   "agentRelayContracts": {
     "providerPluginProtocol": 1
   }

package/src/adapters/codex.ts

@@ -1287,7 +1287,10 @@ function codexRelayContextEnabled(process: ManagedProcess): boolean {
   return config ? profileAllowsRelayFeature(config, "context") : true;
 }
 
-function codexLaunchContext(process: ManagedProcess): string | undefined {
+// Exported for integration coverage (#462): Codex has no `--append-system-prompt`
+// flag — the composed systemPromptAppend rides in as the launch-context message
+// prepended to the first turn. This is the Codex twin of Claude's append arg.
+export function codexLaunchContext(process: ManagedProcess): string | undefined {
   const config = process.meta?.config as RunnerSpawnConfig | undefined;
   const text = config?.systemPromptAppend?.trim();
   if (!text || process.meta?.systemPromptAppendSent) return undefined;

package/src/launch-assembly.ts

@@ -7,7 +7,7 @@ import {
   type ProviderConfig,
   type RunnerSpawnConfig,
 } from "./adapter";
-import { profileUsesHostProviderGlobals, providerHomePathFor } from "./profile-home";
+import { hostUserScopeMcpServers, profileUsesHostProviderGlobals, providerHomePathFor } from "./profile-home";
 import {
   materializeResolvedAssets,
   resolveClaudeProvisionedPlugins,
@@ -66,10 +66,18 @@ export interface AssembledInstructions {
 export interface AssembledMcp {
   /** The identity-bearing relay HTTP MCP endpoint is injected. */
   relayEndpoint: boolean;
-  /** Only the assembled servers may load (Claude --strict-mcp-config) — the vanilla floor. */
+  /** Only the assembled servers may load (Claude --strict-mcp-config). #662: true for ALL
+   *  managed Claude launches so the project `.mcp.json` enable-modal can't wedge a headless
+   *  agent; relay's endpoint + provisioned servers (via --mcp-config) are preserved. Always
+   *  false for Codex (no equivalent discovery modal). */
   strict: boolean;
   /** Relay-provisioned server names (excludes the relay endpoint itself). */
   servers: string[];
+  /** #662 — host USER-scope MCP server names (`~/.claude.json` `mcpServers`) re-injected
+   *  into `--mcp-config` for an `mcp.mode:"host"` profile, so `--strict-mcp-config` keeps
+   *  the ambient host MCP (callmux/qmd/gh) instead of dropping it. Empty for non-host mcp
+   *  modes, isolated bases (own config home, never had host MCP), and Codex. */
+  hostServers: string[];
 }
 
 export interface AssembledLaunch {
@@ -194,6 +202,31 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
   const mcpServers = Object.keys(provisionedMcp).filter((name) => name !== RELAY_MCP_SERVER_NAME);
   const relayEndpoint = profileAllowsRelayFeature(config, "mcp");
 
+  // #662 — EVERY managed Claude launch is --strict-mcp-config, not just vanilla. A managed
+  // agent runs headless (no human at the keyboard), so Claude's blocking "N new MCP servers
+  // found in this project — select to enable" modal (raised on UNDECIDED cwd `.mcp.json`
+  // servers) wedges the session forever, burning quota. Relay owns MCP: everything relay
+  // decides should load is injected via --mcp-config, which strict PRESERVES; strict only
+  // blocks what relay DIDN'T inject — above all the cwd project `.mcp.json` (the modal's
+  // source), which stays excluded. The relay plugin (monitor + turn hooks) loads via
+  // --plugin-dir and ships no MCP server, so it is untouched. Was `vanilla`-only, which left
+  // host/minimal/isolated bases exposed to the modal wedge.
+  const strictMcp = true;
+
+  // #662 follow-up — strict drops ALL on-disk config, including the host user-scope
+  // `~/.claude.json` MCP that a host-base agent loaded ambiently before strict. That
+  // over-reached: it stopped honoring `mcp.mode:"host"`, so default-relay workers/reviewers
+  // lost callmux/qmd/gh. Re-inject the host USER-scope servers (NOT the project `.mcp.json`,
+  // still excluded) when the launch both uses the host config home AND its mcp mode is host.
+  // An isolated/minimal base has its own config home and never had the real host's user MCP,
+  // so it stays relay+provisioned only even if a profile sets mode:"host".
+  const usesHostMcp = profileUsesHostProviderGlobals(config)
+    && (!config.agentProfile || config.agentProfile.mcp.mode === "host");
+  const hostMcp = usesHostMcp ? hostUserScopeMcpServers() : {};
+  const hostMcpServers = Object.keys(hostMcp).filter(
+    (name) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
+  );
+
   const instructions = assembleInstructions(config);
 
   // Launch order matches the historical claude buildSpawnArgs block exactly so existing
@@ -206,7 +239,8 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
       ...(config.relayMcpEndpoint ? { endpoint: config.relayMcpEndpoint } : {}),
       includeRelay: relayEndpoint,
       servers: provisionedMcp,
-      strict: vanilla,
+      hostServers: hostMcp,
+      strict: strictMcp,
     }),
     ...(statusLine ? sessionStatusLineSettingsArgs(hostDefaultArgs, config.providerArgs) : []),
     ...(config.systemPromptAppend ? ["--append-system-prompt", config.systemPromptAppend] : []),
@@ -224,7 +258,7 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
     statusLine,
     skills: skills.map((s) => ({ name: s.name, dir: s.dir })),
     plugins: provisionedPlugins.map((p) => ({ name: p.name, dir: p.dir })),
-    mcp: { relayEndpoint, strict: vanilla, servers: mcpServers },
+    mcp: { relayEndpoint, strict: strictMcp, servers: mcpServers, hostServers: hostMcpServers },
     instructions,
     args,
     env: configHome ? { CLAUDE_CONFIG_DIR: configHome } : {},
@@ -267,7 +301,7 @@ function assembleCodex(config: RunnerSpawnConfig, _providerConfig: ProviderConfi
     statusLine: false,
     skills: provisionedSkills.map((s) => ({ name: s.name, dir: s.dir })),
     plugins: [],
-    mcp: { relayEndpoint, strict: false, servers: mcpServers },
+    mcp: { relayEndpoint, strict: false, servers: mcpServers, hostServers: [] },
     instructions,
     args,
     env: configHome ? { CODEX_HOME: configHome } : {},

package/src/profile-home.ts

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { sanitizeFsName } from "agent-relay-sdk/fs-name";
+import type { ProvisioningMcpServer } from "agent-relay-sdk";
 import { profileAllowsRelayFeature, type RunnerSpawnConfig } from "./adapter";
 import { CLAUDE_RELAY_MANUAL } from "./relay-instructions";
 import { providerHomeRootFromEnv } from "./config";
@@ -117,6 +118,20 @@ function readHostClaudeConfig(): Record<string, unknown> | undefined {
   }
 }
 
+// #662 — the host USER-scope MCP servers: the top-level `mcpServers` of `~/.claude.json`.
+// These are the ambient host MCP a host-base Claude auto-loads on EVERY launch when NOT
+// strict (user scope is global across all projects — callmux/qmd/gh on this host). Since
+// the #662 wedge fix makes every managed launch `--strict-mcp-config` (so Claude ignores
+// all on-disk config and never renders the project-`.mcp.json` enable modal), an
+// `mcp.mode:"host"` profile must re-inject these explicitly into `--mcp-config` to keep
+// honoring host mode. Deliberately NOT the project-cwd `.mcp.json` (project scope — the
+// modal's source, which must stay excluded) nor `projects[cwd].mcpServers` (local scope).
+export function hostUserScopeMcpServers(): Record<string, ProvisioningMcpServer> {
+  const servers = readHostClaudeConfig()?.mcpServers;
+  if (!servers || typeof servers !== "object") return {};
+  return servers as Record<string, ProvisioningMcpServer>;
+}
+
 function providerHomePath(provider: "claude" | "codex", config: RunnerSpawnConfig): string {
   const root = providerHomeRootFromEnv();
   const profileName = sanitizePathPart(config.agentProfile?.name || config.profile || "profile");

package/src/relay-mcp.ts

@@ -43,10 +43,12 @@ export function tomlString(value: string): string {
 }
 
 // #555 — compose the launch MCP set from (the relay endpoint, if relay.mcp) PLUS the
-// profile's relay-provisioned servers. One `--mcp-config` JSON carries them all.
-// `strict` (vanilla) adds `--strict-mcp-config` so ONLY these load — host `.mcp.json`
-// / `~/.claude.json` are ignored even if a stray config exists (belt-and-suspenders
-// on top of the `--setting-sources "user"` scope that already excludes repo MCP).
+// profile's relay-provisioned servers, PLUS (#662) the host USER-scope servers for an
+// `mcp.mode:"host"` profile. One `--mcp-config` JSON carries them all. `strict` adds
+// `--strict-mcp-config` so ONLY these load — Claude reads no on-disk config, so the
+// project-cwd `.mcp.json` is never discovered (its enable modal can't wedge a headless
+// agent). Whatever the assembler decides host mode should keep is injected here explicitly;
+// strict then preserves exactly that set and nothing else.
 import type { ProvisioningMcpServer } from "agent-relay-sdk";
 
 function claudeMcpServerEntry(server: ProvisioningMcpServer): Record<string, unknown> {
@@ -65,9 +67,21 @@ export function claudeMcpLaunchArgs(opts: {
   endpoint?: string;
   includeRelay: boolean;
   servers?: Record<string, ProvisioningMcpServer>;
+  /** #662 — host USER-scope MCP servers (`~/.claude.json` `mcpServers`), re-injected for
+   *  `mcp.mode:"host"` so `--strict-mcp-config` PRESERVES them instead of dropping the
+   *  ambient host MCP a host-base agent loaded before strict. Lowest precedence: the relay
+   *  endpoint and relay-provisioned servers win on a name collision (relay decides). */
+  hostServers?: Record<string, ProvisioningMcpServer>;
   strict?: boolean;
 }): string[] {
   const mcpServers: Record<string, unknown> = {};
+  // Host user-scope servers go in first so relay endpoint + provisioned servers below can
+  // override them by name (relay-owned config is authoritative over ambient host MCP).
+  for (const [name, server] of Object.entries(opts.hostServers ?? {})) {
+    if (name === RELAY_MCP_SERVER_NAME) continue;
+    const entry = claudeMcpServerEntry(server);
+    if (Object.keys(entry).length) mcpServers[name] = entry;
+  }
   if (opts.includeRelay) {
     mcpServers[RELAY_MCP_SERVER_NAME] = {
       type: "http",