agent-tempo 1.2.0 → 1.4.0

package/dist/pi/zod-to-typebox.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Narrow zod → TypeBox converter (D1 / MD-B, Phase 1).
+ *
+ * agent-tempo tools declare their parameters as a `z.ZodRawShape`
+ * (`Record<string, z.ZodTypeAny>`) — the exact object handed to
+ * `McpServer.tool(...)` today (see `src/tools/helpers.ts` `defineTool`). The Pi
+ * front-end (`pi.registerTool({ parameters })`) wants a TypeBox schema instead.
+ * This module derives the TypeBox object schema from the zod shape so **zod
+ * stays the single source of truth** and the two surfaces cannot drift.
+ *
+ * DESIGN: this is deliberately NOT a general-purpose zod→TypeBox shim. It
+ * handles ONLY the feature subset the ~30 tools actually use (audited
+ * 2026-06-03) and **throws** — naming the field + feature — on anything else.
+ * Failing loud is the whole point (D1): a faithless silent conversion would
+ * ship a wrong tool schema to the model. The CI parity test (Track A / S5b)
+ * asserts the converter raised on nothing across the real tool set, so any new
+ * unaudited zod construct trips CI instead of producing a bad schema.
+ *
+ * Supported subset:
+ *   - z.string()  (+ .min/.max → minLength/maxLength, .regex → pattern)
+ *   - z.number()  (+ .int() → integer, .min/.max → minimum/maximum [inclusive])
+ *   - z.boolean()
+ *   - z.enum([...])            → Type.Union of Type.Literal (anyOf of const)
+ *   - z.array(inner)           (+ .min/.max → minItems/maxItems)
+ *   - z.object({...})          (nested; appears as an array element today)
+ *   - z.union([...])           SCALAR members only (string/number/boolean/enum/
+ *                              literal) — object/array/nested-union members throw
+ *   - .optional()              → Type.Optional (drops the field from `required`)
+ *   - .describe(s)             → TypeBox `{ description: s }` (Pi surfaces it)
+ *
+ * Everything else (.default, .nullable, .refine/.transform, .coerce, .email,
+ * .gt/.lt, z.record/any/unknown/null/date/tuple/intersection/nativeEnum, …)
+ * raises {@link UnsupportedZodFeatureError}.
+ *
+ * `.min`/`.max` are CONTEXT-SENSITIVE — the same modifier maps to
+ * minLength/maxLength (string), minimum/maximum (number), or minItems/maxItems
+ * (array) depending on the base zod type. The mapping is keyed on the base
+ * type, never on the modifier alone.
+ *
+ * TypeBox note (D12, confirmed): a TypeBox `Type.*` value IS a plain JSON-Schema
+ * object at runtime (`{ type, required, properties, … }`), so the output drops
+ * straight into Pi's `parameters` field with no further transform.
+ */
+import { z } from 'zod';
+import { type TObject } from 'typebox';
+/** Where in the schema we are, for actionable error messages. */
+interface ConvertContext {
+    /** Tool name, when the caller supplies it (richer errors). */
+    readonly tool?: string;
+    /** Dotted field path within the shape, e.g. `evaluations.status`. */
+    readonly path: string;
+}
+/**
+ * Thrown when a tool param schema uses a zod construct outside the audited
+ * subset. Carries the field path + offending feature so CI / callers can point
+ * at the exact source. A named class lets the parity test assert "raised on
+ * nothing" precisely.
+ */
+export declare class UnsupportedZodFeatureError extends Error {
+    readonly context: ConvertContext;
+    readonly feature: string;
+    constructor(context: ConvertContext, feature: string);
+}
+/**
+ * Convert a tool's zod param shape into a TypeBox object schema suitable for
+ * `pi.registerTool({ parameters })`. This is the public entry point consumed by
+ * the Pi front-end (`src/pi/render-tools.ts`).
+ *
+ * @param shape    The tool's `z.ZodRawShape` (the `paramsSchema` from `defineTool`).
+ * @param toolName Optional tool name, woven into error messages.
+ * @throws {UnsupportedZodFeatureError} on any zod construct outside the subset.
+ */
+export declare function zodShapeToTypeBox(shape: z.ZodRawShape, toolName?: string): TObject;
+export {};

package/dist/pi/zod-to-typebox.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedZodFeatureError = void 0;
+exports.zodShapeToTypeBox = zodShapeToTypeBox;
+const typebox_1 = require("typebox");
+/**
+ * Thrown when a tool param schema uses a zod construct outside the audited
+ * subset. Carries the field path + offending feature so CI / callers can point
+ * at the exact source. A named class lets the parity test assert "raised on
+ * nothing" precisely.
+ */
+class UnsupportedZodFeatureError extends Error {
+    context;
+    feature;
+    constructor(context, feature) {
+        const where = `${context.tool ? `${context.tool}.` : ''}${context.path || '<root>'}`;
+        super(`zod→TypeBox: unsupported feature "${feature}" at ${where}. ` +
+            `Extend src/pi/zod-to-typebox.ts (and a unit test) if this construct is intentional.`);
+        this.context = context;
+        this.feature = feature;
+        this.name = 'UnsupportedZodFeatureError';
+    }
+}
+exports.UnsupportedZodFeatureError = UnsupportedZodFeatureError;
+function defOf(zt) {
+    return zt._def;
+}
+const SCALAR_TYPE_NAMES = new Set([
+    'ZodString',
+    'ZodNumber',
+    'ZodBoolean',
+    'ZodEnum',
+    'ZodLiteral',
+]);
+/**
+ * Convert a tool's zod param shape into a TypeBox object schema suitable for
+ * `pi.registerTool({ parameters })`. This is the public entry point consumed by
+ * the Pi front-end (`src/pi/render-tools.ts`).
+ *
+ * @param shape    The tool's `z.ZodRawShape` (the `paramsSchema` from `defineTool`).
+ * @param toolName Optional tool name, woven into error messages.
+ * @throws {UnsupportedZodFeatureError} on any zod construct outside the subset.
+ */
+function zodShapeToTypeBox(shape, toolName) {
+    return buildObject(shape, { tool: toolName, path: '' });
+}
+function buildObject(shape, ctx, meta = {}) {
+    const props = {};
+    for (const [key, zt] of Object.entries(shape)) {
+        const fieldCtx = {
+            tool: ctx.tool,
+            path: ctx.path ? `${ctx.path}.${key}` : key,
+        };
+        const { inner, isOptional, outerDescription } = stripOptional(zt);
+        const schema = convert(inner, fieldCtx, outerDescription);
+        props[key] = isOptional ? typebox_1.Type.Optional(schema) : schema;
+    }
+    return typebox_1.Type.Object(props, meta);
+}
+/**
+ * Peel a single `.optional()` wrapper. Captures the description authored on the
+ * wrapper (e.g. `z.string().optional().describe('…')` puts it on the optional)
+ * so it survives onto the inner schema.
+ */
+function stripOptional(zt) {
+    const def = defOf(zt);
+    if (def?.typeName === 'ZodOptional') {
+        return { inner: def.innerType, isOptional: true, outerDescription: def.description };
+    }
+    return { inner: zt, isOptional: false };
+}
+/** Convert a NON-optional zod type. `descOverride` wins over the node's own description. */
+function convert(zt, ctx, descOverride) {
+    const def = defOf(zt);
+    const typeName = def?.typeName;
+    const description = descOverride ?? def?.description;
+    const meta = description !== undefined ? { description } : {};
+    switch (typeName) {
+        case 'ZodString':
+            return typebox_1.Type.String({ ...meta, ...stringConstraints(zt, ctx) });
+        case 'ZodNumber': {
+            const { isInt, opts } = numberConstraints(zt, ctx);
+            const numMeta = { ...meta, ...opts };
+            return isInt ? typebox_1.Type.Integer(numMeta) : typebox_1.Type.Number(numMeta);
+        }
+        case 'ZodBoolean':
+            return typebox_1.Type.Boolean(meta);
+        case 'ZodEnum': {
+            const values = def.values;
+            return typebox_1.Type.Union(values.map((v) => typebox_1.Type.Literal(v)), meta);
+        }
+        case 'ZodLiteral':
+            return typebox_1.Type.Literal(def.value, meta);
+        case 'ZodArray':
+            return typebox_1.Type.Array(arrayElement(def.type, ctx), {
+                ...meta,
+                ...arrayConstraints(zt, ctx),
+            });
+        case 'ZodObject':
+            return buildObject(def.shape(), ctx, meta);
+        case 'ZodUnion':
+            return convertUnion(zt, ctx, meta);
+        default:
+            throw new UnsupportedZodFeatureError(ctx, typeName ?? 'unknown (not a zod type)');
+    }
+}
+/** Array elements are converted as non-optional types; an optional element is rejected. */
+function arrayElement(el, ctx) {
+    const { inner, isOptional } = stripOptional(el);
+    if (isOptional) {
+        throw new UnsupportedZodFeatureError({ ...ctx, path: `${ctx.path}[]` }, 'optional array element');
+    }
+    return convert(inner, { ...ctx, path: `${ctx.path}[]` });
+}
+function stringConstraints(zt, ctx) {
+    const out = {};
+    for (const check of (defOf(zt).checks ?? [])) {
+        switch (check.kind) {
+            case 'min':
+                out.minLength = check.value;
+                break;
+            case 'max':
+                out.maxLength = check.value;
+                break;
+            case 'regex':
+                out.pattern = check.regex.source;
+                break;
+            default:
+                throw new UnsupportedZodFeatureError(ctx, `z.string().${String(check.kind)}()`);
+        }
+    }
+    return out;
+}
+function numberConstraints(zt, ctx) {
+    let isInt = false;
+    const opts = {};
+    for (const check of (defOf(zt).checks ?? [])) {
+        switch (check.kind) {
+            case 'int':
+                isInt = true;
+                break;
+            case 'min':
+                if (check.inclusive === false) {
+                    throw new UnsupportedZodFeatureError(ctx, 'z.number() exclusive minimum (.gt)');
+                }
+                opts.minimum = check.value;
+                break;
+            case 'max':
+                if (check.inclusive === false) {
+                    throw new UnsupportedZodFeatureError(ctx, 'z.number() exclusive maximum (.lt)');
+                }
+                opts.maximum = check.value;
+                break;
+            default:
+                throw new UnsupportedZodFeatureError(ctx, `z.number().${String(check.kind)}()`);
+        }
+    }
+    return { isInt, opts };
+}
+function arrayConstraints(zt, ctx) {
+    // NOTE: zod stores array length bounds as named `_def` FIELDS
+    // (`minLength`/`maxLength`/`exactLength`), NOT as `_def.checks[]` entries like
+    // string and number bounds. Don't "unify" this with stringConstraints /
+    // numberConstraints — they read a genuinely different zod representation.
+    const def = defOf(zt);
+    const out = {};
+    if (def.exactLength) {
+        throw new UnsupportedZodFeatureError(ctx, 'z.array().length() (exact length)');
+    }
+    if (def.minLength)
+        out.minItems = def.minLength.value;
+    if (def.maxLength)
+        out.maxItems = def.maxLength.value;
+    return out;
+}
+function convertUnion(zt, ctx, meta) {
+    const options = defOf(zt).options;
+    const members = options.map((member, i) => {
+        const memberCtx = { ...ctx, path: `${ctx.path}|${i}` };
+        const { inner, isOptional } = stripOptional(member);
+        if (isOptional) {
+            throw new UnsupportedZodFeatureError(memberCtx, 'optional union member');
+        }
+        const memberTypeName = defOf(inner)?.typeName;
+        if (memberTypeName === undefined || !SCALAR_TYPE_NAMES.has(memberTypeName)) {
+            throw new UnsupportedZodFeatureError(memberCtx, `non-scalar union member (${memberTypeName ?? 'unknown'}); only string/number/boolean/enum/literal members are supported`);
+        }
+        return convert(inner, memberCtx);
+    });
+    return typebox_1.Type.Union(members, meta);
+}

package/dist/scripts/verify-daemon-isolation-guard.js

@@ -81,30 +81,30 @@ catch (err) {
     console.error(err && err.message);
     process.exit(1);
 }
-const detector = `
-  // Step 1: load daemon-command (should leave require.cache clean of Temporal).
-  require(${JSON.stringify(DAEMON_COMMAND_DIST)});
-  // Step 2: simulate a regression — load @temporalio/client directly.
-  // This is what would happen if a future edit to daemon-command (or one of
-  // its deps) accidentally imported something Temporal-adjacent.
-  require(${JSON.stringify(temporalClientPath)});
-  // Step 3: run the same detector as test/daemon-command-isolation.test.ts.
-  const forbidden = [
-    /[\\\\/]@temporalio[\\\\/]/,
-    /[\\\\/]rxjs[\\\\/]/,
-    /[\\\\/]@grpc[\\\\/]/,
-    /[\\\\/]nice-grpc(?:-[^\\\\/]+)?[\\\\/]/,
-    /[\\\\/]long[\\\\/]umd[\\\\/]/,
-  ];
-  const hits = Object.keys(require.cache).filter((k) => forbidden.some((re) => re.test(k)));
-  if (hits.length > 0) {
-    console.log('Detector found ' + hits.length + ' forbidden module(s) in require.cache:');
-    for (const h of hits.slice(0, 3)) console.log('  ' + h);
-    if (hits.length > 3) console.log('  ... (' + (hits.length - 3) + ' more)');
-    process.exit(0);
-  }
-  console.error('BUG: detector did not flag any of the injected forbidden modules.');
-  process.exit(1);
+const detector = `
+  // Step 1: load daemon-command (should leave require.cache clean of Temporal).
+  require(${JSON.stringify(DAEMON_COMMAND_DIST)});
+  // Step 2: simulate a regression — load @temporalio/client directly.
+  // This is what would happen if a future edit to daemon-command (or one of
+  // its deps) accidentally imported something Temporal-adjacent.
+  require(${JSON.stringify(temporalClientPath)});
+  // Step 3: run the same detector as test/daemon-command-isolation.test.ts.
+  const forbidden = [
+    /[\\\\/]@temporalio[\\\\/]/,
+    /[\\\\/]rxjs[\\\\/]/,
+    /[\\\\/]@grpc[\\\\/]/,
+    /[\\\\/]nice-grpc(?:-[^\\\\/]+)?[\\\\/]/,
+    /[\\\\/]long[\\\\/]umd[\\\\/]/,
+  ];
+  const hits = Object.keys(require.cache).filter((k) => forbidden.some((re) => re.test(k)));
+  if (hits.length > 0) {
+    console.log('Detector found ' + hits.length + ' forbidden module(s) in require.cache:');
+    for (const h of hits.slice(0, 3)) console.log('  ' + h);
+    if (hits.length > 3) console.log('  ... (' + (hits.length - 3) + ' more)');
+    process.exit(0);
+  }
+  console.error('BUG: detector did not flag any of the injected forbidden modules.');
+  process.exit(1);
 `;
 const result = (0, child_process_1.spawnSync)(process.execPath, ['-e', detector], {
     stdio: ['ignore', 'inherit', 'inherit'],

package/dist/server-tools.d.ts

@@ -20,6 +20,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { Client, WorkflowHandle } from '@temporalio/client';
 import { Config } from './config';
 import { AgentType } from './types';
+import { type TempoToolDescriptor } from './tools/descriptor';
 /**
  * Identity + state context every tool registration consumes. The two
  * surfaces (stdio MCP server in `src/server.ts`, in-process MCP server in
@@ -57,6 +58,7 @@ export interface RegisterAllTempoToolsOpts {
  * `opts.isConductor` — non-conductor players don't see them on either
  * surface.
  */
+export declare function buildAllTempoTools(opts: RegisterAllTempoToolsOpts): TempoToolDescriptor[];
 export declare function registerAllTempoTools(server: McpServer, opts: RegisterAllTempoToolsOpts): void;
 /**
  * Identity + ensemble context for {@link buildServerInstructions}.

package/dist/server-tools.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAllTempoTools = buildAllTempoTools;
 exports.registerAllTempoTools = registerAllTempoTools;
 exports.buildServerInstructions = buildServerInstructions;
+const descriptor_1 = require("./tools/descriptor");
 const ensemble_1 = require("./tools/ensemble");
 const cue_1 = require("./tools/cue");
 const set_part_1 = require("./tools/set-part");
@@ -32,6 +34,7 @@ const stages_1 = require("./tools/stages");
 const cancel_stage_1 = require("./tools/cancel-stage");
 const restart_1 = require("./tools/restart");
 const destroy_1 = require("./tools/destroy");
+const reset_1 = require("./tools/reset");
 const migrate_1 = require("./tools/migrate");
 const attachment_info_1 = require("./tools/attachment-info");
 const hosts_1 = require("./tools/hosts");
@@ -55,55 +58,56 @@ const coat_check_evict_1 = require("./tools/coat-check-evict");
  * `opts.isConductor` — non-conductor players don't see them on either
  * surface.
  */
-function registerAllTempoTools(server, opts) {
+function buildAllTempoTools(opts) {
     const { client, config, getPlayerId, setPlayerId, handle, workflowId, ownAgentType, isConductor } = opts;
-    (0, ensemble_1.registerEnsembleTool)(server, client, config, getPlayerId, workflowId);
-    (0, cue_1.registerCueTool)(server, client, config, getPlayerId, handle);
-    (0, set_part_1.registerSetPartTool)(server, handle);
-    (0, set_name_1.registerSetNameTool)(server, client, config, handle, getPlayerId, setPlayerId);
-    (0, listen_1.registerListenTool)(server, handle);
-    (0, recruit_1.registerRecruitTool)(server, client, config, getPlayerId, handle, ownAgentType);
-    (0, report_1.registerReportTool)(server, handle);
-    (0, schedule_1.registerScheduleTool)(server, client, config, getPlayerId);
-    (0, unschedule_1.registerUnscheduleTool)(server, client, config);
-    (0, schedules_1.registerSchedulesTool)(server, client, config);
-    (0, save_lineup_1.registerSaveLineupTool)(server, client, config, getPlayerId, isConductor);
-    (0, load_lineup_1.registerLoadLineupTool)(server, client, config, getPlayerId, ownAgentType, handle, setPlayerId, isConductor);
-    (0, agent_types_1.registerAgentTypesTool)(server);
-    (0, who_am_i_1.registerWhoAmITool)(server, handle, getPlayerId);
-    (0, broadcast_1.registerBroadcastTool)(server, client, config, getPlayerId, handle);
-    (0, recall_1.registerRecallTool)(server, handle, getPlayerId);
-    (0, release_1.registerReleaseTool)(server, client, config, getPlayerId, handle);
-    (0, pause_1.registerPauseTool)(server, client, config, getPlayerId);
-    (0, play_1.registerPlayTool)(server, client, config, getPlayerId);
-    (0, shutdown_1.registerShutdownTool)(server, client, config, getPlayerId);
-    (0, restore_1.registerRestoreTool)(server, client, config, getPlayerId);
-    (0, restart_1.registerRestartTool)(server, client, config, getPlayerId, handle);
-    (0, destroy_1.registerDestroyTool)(server, client, config, getPlayerId, handle);
-    (0, migrate_1.registerMigrateTool)(server, client, config, getPlayerId, handle);
-    (0, attachment_info_1.registerAttachmentInfoTool)(server, client, config);
-    (0, hosts_1.registerHostsTool)(server, client, config);
-    (0, set_ensemble_description_1.registerSetEnsembleDescriptionTool)(server, client, config);
-    // #334 PR-1 — owner-write / peer-read player saveable state.
-    (0, save_state_1.registerSaveStateTool)(server, handle, getPlayerId);
-    (0, fetch_state_1.registerFetchStateTool)(server, client, config, handle, getPlayerId);
-    (0, clear_state_1.registerClearStateTool)(server, handle);
-    // #318 — ensemble-shared coat-check (put/get/list/evict). Any player can put;
-    // any player can get/list; owner-or-conductor can evict. Audit identity is
-    // set at the tool layer via getPlayerId() — no playerId arg on any schema.
-    (0, coat_check_put_1.registerCoatCheckPutTool)(server, client, config, getPlayerId);
-    (0, coat_check_get_1.registerCoatCheckGetTool)(server, client, config, getPlayerId);
-    (0, coat_check_list_1.registerCoatCheckListTool)(server, client, config);
-    (0, coat_check_evict_1.registerCoatCheckEvictTool)(server, client, config, getPlayerId);
+    const tools = [
+        (0, ensemble_1.buildEnsembleTool)(client, config, getPlayerId, workflowId),
+        (0, cue_1.buildCueTool)(client, config, getPlayerId, handle),
+        (0, set_part_1.buildSetPartTool)(handle),
+        (0, set_name_1.buildSetNameTool)(client, config, handle, getPlayerId, setPlayerId),
+        (0, listen_1.buildListenTool)(handle),
+        (0, recruit_1.buildRecruitTool)(client, config, getPlayerId, handle, ownAgentType),
+        (0, report_1.buildReportTool)(handle),
+        (0, schedule_1.buildScheduleTool)(client, config, getPlayerId),
+        (0, unschedule_1.buildUnscheduleTool)(client, config),
+        (0, schedules_1.buildSchedulesTool)(client, config),
+        (0, save_lineup_1.buildSaveLineupTool)(client, config, getPlayerId, isConductor),
+        (0, load_lineup_1.buildLoadLineupTool)(client, config, getPlayerId, ownAgentType, handle, setPlayerId, isConductor),
+        (0, agent_types_1.buildAgentTypesTool)(),
+        (0, who_am_i_1.buildWhoAmITool)(handle, getPlayerId),
+        (0, broadcast_1.buildBroadcastTool)(client, config, getPlayerId, handle),
+        (0, recall_1.buildRecallTool)(handle, getPlayerId),
+        (0, release_1.buildReleaseTool)(client, config, getPlayerId, handle),
+        (0, pause_1.buildPauseTool)(client, config, getPlayerId),
+        (0, play_1.buildPlayTool)(client, config, getPlayerId),
+        (0, shutdown_1.buildShutdownTool)(client, config, getPlayerId),
+        (0, restore_1.buildRestoreTool)(client, config, getPlayerId),
+        (0, restart_1.buildRestartTool)(client, config, getPlayerId, handle),
+        (0, destroy_1.buildDestroyTool)(client, config, getPlayerId, handle),
+        (0, reset_1.buildResetTool)(handle, getPlayerId),
+        (0, migrate_1.buildMigrateTool)(client, config, getPlayerId, handle),
+        (0, attachment_info_1.buildAttachmentInfoTool)(client, config),
+        (0, hosts_1.buildHostsTool)(client, config),
+        (0, set_ensemble_description_1.buildSetEnsembleDescriptionTool)(client, config),
+        // #334 PR-1 — owner-write / peer-read player saveable state.
+        (0, save_state_1.buildSaveStateTool)(handle, getPlayerId),
+        (0, fetch_state_1.buildFetchStateTool)(client, config, handle, getPlayerId),
+        (0, clear_state_1.buildClearStateTool)(handle),
+        // #318 — ensemble-shared coat-check (put/get/list/evict). Any player can put;
+        // any player can get/list; owner-or-conductor can evict. Audit identity is
+        // set at the tool layer via getPlayerId() — no playerId arg on any schema.
+        (0, coat_check_put_1.buildCoatCheckPutTool)(client, config, getPlayerId),
+        (0, coat_check_get_1.buildCoatCheckGetTool)(client, config, getPlayerId),
+        (0, coat_check_list_1.buildCoatCheckListTool)(client, config),
+        (0, coat_check_evict_1.buildCoatCheckEvictTool)(client, config, getPlayerId),
+    ];
     if (isConductor) {
-        (0, quality_gate_1.registerQualityGateTool)(server, handle, getPlayerId);
-        (0, evaluate_gate_1.registerEvaluateGateTool)(server, handle, getPlayerId);
-        (0, gates_1.registerGatesTool)(server, handle);
-        (0, worktree_1.registerWorktreeTool)(server, client, config, handle, getPlayerId);
-        (0, stage_1.registerStageTool)(server, handle, getPlayerId);
-        (0, stages_1.registerStagesTool)(server, handle);
-        (0, cancel_stage_1.registerCancelStageTool)(server, handle);
+        tools.push((0, quality_gate_1.buildQualityGateTool)(handle, getPlayerId), (0, evaluate_gate_1.buildEvaluateGateTool)(handle, getPlayerId), (0, gates_1.buildGatesTool)(handle), (0, worktree_1.buildWorktreeTool)(client, config, handle, getPlayerId), (0, stage_1.buildStageTool)(handle, getPlayerId), (0, stages_1.buildStagesTool)(handle), (0, cancel_stage_1.buildCancelStageTool)(handle));
     }
+    return tools;
+}
+function registerAllTempoTools(server, opts) {
+    (0, descriptor_1.renderToMcp)(server, buildAllTempoTools(opts));
 }
 /**
  * Build the `instructions` string that lands in `McpServer`'s `instructions`

package/dist/server.js

@@ -56,9 +56,13 @@ const server_tools_1 = require("./server-tools");
 const adapters_1 = require("./adapters");
 const agent_types_1 = require("./ensemble/agent-types");
 const parent_death_watchdog_1 = require("./utils/parent-death-watchdog");
+const grpc_shutdown_guard_1 = require("./utils/grpc-shutdown-guard");
 const log = (...args) => console.error('[agent-tempo]', ...args);
 async function main() {
     (0, parent_death_watchdog_1.installParentDeathWatchdog)();
+    // Neutralize the Temporal/grpc-js "Channel has been shut down" retry-after-
+    // close race. See src/utils/grpc-shutdown-guard.ts.
+    (0, grpc_shutdown_guard_1.installGrpcShutdownGuard)();
     // Only activate when explicitly opted in via AGENT_TEMPO_ENSEMBLE
     if (!process.env[config_1.ENV.ENSEMBLE]) {
         log(`${config_1.ENV.ENSEMBLE} not set — MCP server idle (no workflow started)`);

package/dist/spawn.d.ts

@@ -236,6 +236,61 @@ export interface OpenCodeAdapterResult {
  * specific provider key since the model is opaque pass-through).
  */
 export declare function spawnOpenCodeAdapter(opts: OpenCodeAdapterOpts): OpenCodeAdapterResult;
+/**
+ * Options for {@link spawnPiHeadless}. Mirrors {@link OpenCodeAdapterOpts} for
+ * identity + Temporal connection + attachment handoff; adds Pi-specific knobs:
+ * `model` (provider/model via `AGENT_TEMPO_PI_MODEL`), `continueSessionId`
+ * (restart-resume via `AGENT_TEMPO_PI_CONTINUE_SESSION` → Pi `continueSession`),
+ * and `toolAccess` (MD-C tool-class policy via `AGENT_TEMPO_TOOL_ACCESS`).
+ *
+ * Unlike the other headless adapters, the Pi entry does NOT drive a
+ * `BaseAttachment` loop — it injects the `src/pi` extension into Pi's
+ * `createAgentSession`; the module-scope extension singleton owns the lifecycle.
+ */
+export interface PiHeadlessAdapterOpts {
+    name: string;
+    ensemble: string;
+    temporalAddress: string;
+    temporalNamespace?: string;
+    temporalApiKey?: string;
+    temporalTlsCertPath?: string;
+    temporalTlsKeyPath?: string;
+    isConductor?: boolean;
+    workDir: string;
+    /** Directory for log + PID files. Defaults to `logs/` inside workDir. */
+    logDir?: string;
+    /** Pi provider/model selector (e.g. `anthropic/claude-opus-4-7`); absent → Pi default. */
+    model?: string;
+    /** Restart-resume: the Pi conversation id to continue (from `metadata.sessionId`). */
+    continueSessionId?: string;
+    /** MD-C tool-class policy: `restricted` (default) | `standard` | `full`. */
+    toolAccess?: string;
+    /**
+     * 3c Tier-2 ingest token (minted by the daemon outbox, scoped to this player's
+     * workflowId). Threaded into the subprocess env as `AGENT_TEMPO_INGEST_TOKEN`
+     * so the inner-loop publisher can authenticate `POST /inner/ingest`. NOTE:
+     * spawn.ts only THREADS the token — minting lives in the daemon-only outbox
+     * (this module runs outside the daemon and must not import the registry).
+     */
+    ingestToken?: string;
+    /** PR-D attachment-lease handoff (renew rather than fresh-claim on boot). */
+    attachmentId?: string;
+    attachmentRunId?: string;
+    adapterId?: string;
+}
+export interface PiHeadlessAdapterResult {
+    pid: number | undefined;
+    logPath: string;
+    pidPath: string;
+}
+/**
+ * Spawn the headless Pi runtime as a detached subprocess. Pattern matches
+ * {@link spawnOpenCodeAdapter} — no TTY, log + PID files, env carries identity +
+ * Temporal settings + attachment handoff + the Pi model / continue-session /
+ * tool-access knobs. The entry constructs `createAgentSession` with the `src/pi`
+ * extension injected inline; the singleton claims + heartbeats + registers tools.
+ */
+export declare function spawnPiHeadless(opts: PiHeadlessAdapterOpts): PiHeadlessAdapterResult;
 /**
  * Options for {@link spawnClaudeCodeHeadlessAdapter}. Mirrors
  * {@link ClaudeApiAdapterOpts} for identity + Temporal connection +