agent-tempo 1.6.2 → 1.7.0-beta.1

package/dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-tempo-dashboard",
   "private": true,
-  "version": "1.6.2",
+  "version": "1.7.0-beta.1",
   "type": "module",
   "description": "Web dashboard for agent-tempo. Bundled into the npm package; served by the daemon at /dashboard/*.",
   "scripts": {

package/dist/cli/commands.js

@@ -80,6 +80,8 @@ const agent_types_1 = require("../ensemble/agent-types");
 const validation_1 = require("../utils/validation");
 const search_attributes_1 = require("../utils/search-attributes");
 const daemon_1 = require("./daemon");
+// #700 P1 — infra bootstrap moved to a shared helper (CLI `up` + `/ensemble-up`).
+const ensure_infra_1 = require("./ensure-infra");
 const client_2 = require("../client");
 const constants_1 = require("../constants");
 const recall_format_1 = require("../utils/recall-format");
@@ -902,30 +904,9 @@ function initProject(dir) {
     out.log(`  2. Start conductor: ${out.dim('agent-tempo conduct')}`);
 }
 // --- Temporal server management ---
-const DEFAULT_DB_PATH = (0, path_1.join)(config_1.AGENT_TEMPO_HOME, 'temporal-data.db');
-// Source of truth lives in `sa-preflight.ts` (REQUIRED_SEARCH_ATTRIBUTES) —
-// avoid drifting a second copy here.
-const sa_preflight_1 = require("./sa-preflight");
-async function isTemporalReachable(config) {
-    try {
-        const conn = await (0, connection_1.createTemporalConnection)(config);
-        try {
-            // Verify namespace is ready — a gRPC connection alone doesn't guarantee the server can serve requests
-            const client = new client_1.Client({ connection: conn, namespace: config.temporalNamespace || 'default' });
-            // eslint-disable-next-line @typescript-eslint/no-unused-vars
-            for await (const _ of client.workflow.list({ query: 'WorkflowId = "__readiness_probe__"' })) {
-                break;
-            }
-        }
-        finally {
-            await conn.close();
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
+// #700 P1 — DEFAULT_DB_PATH, isTemporalReachable, and registerSearchAttributes
+// MOVED to ./ensure-infra (the shared infra home; imported back below) so the CLI
+// `up` path and the mission-control `/ensemble-up` extension call ONE bootstrap.
 function temporalCliExists() {
     const cmd = process.platform === 'win32' ? 'where' : 'which';
     try {
@@ -936,52 +917,6 @@ function temporalCliExists() {
         return false;
     }
 }
-function registerSearchAttributes(temporalAddress, namespace = 'default') {
-    let failed = 0;
-    let permissionBlocked = 0;
-    for (const attr of sa_preflight_1.REQUIRED_SEARCH_ATTRIBUTES) {
-        const r = (0, sa_preflight_1.registerSearchAttribute)(attr, temporalAddress, namespace);
-        switch (r.status) {
-            case 'created':
-                out.success(`Registered search attribute: ${attr.name}`);
-                break;
-            case 'already-exists':
-                out.dim(`  ${attr.name} (already registered)`);
-                break;
-            case 'failed':
-                // A PERMISSION error (Temporal Cloud namespace API keys can't reach the
-                // operator service) means we can't tell whether the SA exists — NOT that
-                // it's missing. Don't print a scary per-attr "Failed to register" or count
-                // it as a failure; collapse to ONE soft line below and PROCEED. Reserve
-                // the per-attr warning + hard "will fail" conclusion for DEFINITIVE
-                // failures (e.g. the SQLite dev server's 10-Keyword-per-namespace cap).
-                if ((0, sa_preflight_1.isPermissionError)(r.detail)) {
-                    permissionBlocked++;
-                }
-                else {
-                    failed++;
-                    out.warn(`Failed to register ${attr.name}: ${r.detail}`);
-                }
-                break;
-        }
-    }
-    // Permission-blocked (normal on Temporal Cloud): one accurate, non-alarming
-    // line — we couldn't manage the SAs, but that doesn't mean they're missing.
-    if (permissionBlocked > 0) {
-        const saList = sa_preflight_1.REQUIRED_SEARCH_ATTRIBUTES.map((a) => `${a.name}:${a.type}`).join(', ');
-        out.warn(`Couldn't verify search attributes — this credential lacks permission to manage them ` +
-            `(normal on Temporal Cloud, where search attributes are managed via the Cloud UI or tcld). ` +
-            `If workflow starts fail with "search attribute ... is not defined", create these ` +
-            `${sa_preflight_1.REQUIRED_SEARCH_ATTRIBUTES.length} via the Cloud UI / tcld: ${saList}. ` +
-            `Otherwise this is safe to ignore.`);
-    }
-    // DEFINITIVE failures genuinely block — keep the hard, actionable conclusion.
-    if (failed > 0) {
-        out.warn(`${failed} search attribute${failed === 1 ? '' : 's'} not registered — ` +
-            `workflow starts will fail. Resolve the errors above before continuing.`);
-    }
-    return { failed };
-}
 async function server(opts) {
     const config = (0, config_1.getConfig)(opts);
     if (!temporalCliExists()) {
@@ -990,11 +925,11 @@ async function server(opts) {
         process.exit(1);
     }
     // Check if already running
-    const alreadyRunning = await isTemporalReachable(config);
+    const alreadyRunning = await (0, ensure_infra_1.isTemporalReachable)(config);
     if (alreadyRunning) {
         out.success(`Temporal already running at ${config.temporalAddress}`);
         out.log('  Registering search attributes...');
-        registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+        (0, ensure_infra_1.registerSearchAttributes)(config.temporalAddress, config.temporalNamespace);
         return;
     }
     // Ensure data directory exists
@@ -1003,10 +938,10 @@ async function server(opts) {
     const args = [
         'server', 'start-dev',
         '--port', port,
-        '--db-filename', DEFAULT_DB_PATH,
+        '--db-filename', ensure_infra_1.DEFAULT_DB_PATH,
     ];
     out.log(`Starting Temporal dev server on port ${port}...`);
-    out.log(`  Data: ${out.dim(DEFAULT_DB_PATH)}`);
+    out.log(`  Data: ${out.dim(ensure_infra_1.DEFAULT_DB_PATH)}`);
     if (opts.background) {
         const child = (0, child_process_1.spawn)('temporal', args, {
             detached: true,
@@ -1017,7 +952,7 @@ async function server(opts) {
         // Wait for it to be ready
         for (let i = 0; i < 20; i++) {
             await new Promise(r => setTimeout(r, 500));
-            if (await isTemporalReachable(config))
+            if (await (0, ensure_infra_1.isTemporalReachable)(config))
                 break;
         }
     }
@@ -1030,10 +965,10 @@ async function server(opts) {
         const waitForReady = async () => {
             for (let i = 0; i < 20; i++) {
                 await new Promise(r => setTimeout(r, 500));
-                if (await isTemporalReachable(config)) {
+                if (await (0, ensure_infra_1.isTemporalReachable)(config)) {
                     out.success(`Temporal running at ${config.temporalAddress}`);
                     out.log('  Registering search attributes...');
-                    registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+                    (0, ensure_infra_1.registerSearchAttributes)(config.temporalAddress, config.temporalNamespace);
                     out.log(`\n  ${out.dim('Press Ctrl+C to stop')}\n`);
                     return;
                 }
@@ -1059,7 +994,7 @@ async function server(opts) {
     // Register search attributes (for background mode — foreground does it inline)
     if (opts.background) {
         out.log('  Registering search attributes...');
-        registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+        (0, ensure_infra_1.registerSearchAttributes)(config.temporalAddress, config.temporalNamespace);
         out.success('Temporal ready');
     }
 }
@@ -1077,75 +1012,35 @@ async function up(opts) {
         process.exit(1);
     }
     out.check('temporal CLI installed', true);
-    // Step 2: Start Temporal if needed
-    const temporalUp = await isTemporalReachable(config);
-    if (temporalUp) {
-        out.check('Temporal running', true, config.temporalAddress);
-    }
-    else {
-        out.log(`  ${out.dim('...')} Starting Temporal dev server...`);
-        (0, fs_1.mkdirSync)(config_1.AGENT_TEMPO_HOME, { recursive: true });
-        const port = config.temporalAddress.split(':')[1] || '7233';
-        const child = (0, child_process_1.spawn)('temporal', [
-            'server', 'start-dev',
-            '--port', port,
-            '--db-filename', DEFAULT_DB_PATH,
-        ], { detached: true, stdio: 'ignore' });
-        child.unref();
-        // Wait for ready
-        let ready = false;
-        for (let i = 0; i < 20; i++) {
-            await new Promise(r => setTimeout(r, 500));
-            if (await isTemporalReachable(config)) {
-                ready = true;
-                break;
-            }
-        }
-        if (!ready) {
-            out.error('Temporal did not start within 10 seconds');
-            process.exit(1);
-        }
-        out.check('Temporal started', true, `pid ${child.pid}, data in ~/.agent-tempo/`);
-    }
-    // Step 3: Register search attributes
-    registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
-    // Step 3.5: Install shipped agent types to ~/.claude/agents/ (if not already there)
-    const userAgentsDir = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'agents');
-    const shippedAgentsPath = (0, path_1.join)(PACKAGE_ROOT, 'examples', 'agents');
-    if ((0, fs_1.existsSync)(shippedAgentsPath)) {
-        (0, fs_1.mkdirSync)(userAgentsDir, { recursive: true });
-        const shipped = (0, fs_1.readdirSync)(shippedAgentsPath).filter(f => f.endsWith('.md'));
-        let installed = 0;
-        for (const file of shipped) {
-            const dest = (0, path_1.join)(userAgentsDir, file);
-            if (!(0, fs_1.existsSync)(dest)) {
-                (0, fs_1.copyFileSync)((0, path_1.join)(shippedAgentsPath, file), dest);
-                installed++;
-            }
-        }
-        if (installed > 0) {
-            out.success(`Installed ${installed} agent type${installed !== 1 ? 's' : ''} to ~/.claude/agents/`);
-        }
-        else {
-            out.dim(`  Agent types already installed (${shipped.length} in ~/.claude/agents/)`);
-        }
-    }
-    // Step 3.7: Start worker daemon if not already running
-    if ((0, daemon_1.isDaemonRunning)()) {
-        const daemonStatus = (0, daemon_1.getDaemonStatus)();
-        out.check('Worker daemon running', true, `pid ${daemonStatus.pid}`);
+    // Steps 2–3.7: bring infra up via the SHARED ensureInfra — the same path
+    // `/ensemble-up` uses, so CLI + extension can't drift (#700 P1). Order:
+    // Temporal → search attributes → agent types → daemon (SA BEFORE daemon — the
+    // daemon refuses to boot without them). `onStep` renders the same out.check
+    // sequence `up()` showed before the extraction.
+    try {
+        await (0, ensure_infra_1.ensureInfra)({
+            config,
+            onStep: (p) => {
+                if (p.step === 'temporal') {
+                    out.check(p.status === 'ok' ? 'Temporal running' : 'Temporal started', true, p.detail);
+                }
+                else if (p.step === 'agent-types') {
+                    if (p.detail?.startsWith('installed'))
+                        out.success(`Agent types: ${p.detail} → ~/.claude/agents/`);
+                    else if (p.detail)
+                        out.dim(`  Agent types already installed (${p.detail})`);
+                }
+                else if (p.step === 'daemon') {
+                    out.check(p.status === 'ok' ? 'Worker daemon running' : 'Worker daemon started', true, p.detail);
+                }
+                // 'search-attributes' logs per-attribute internally via registerSearchAttributes.
+            },
+        });
     }
-    else {
-        out.log(`  ${out.dim('...')} Starting worker daemon...`);
-        try {
-            const daemonPid = await (0, daemon_1.startDaemon)(config);
-            out.check('Worker daemon started', true, `pid ${daemonPid}`);
-        }
-        catch (err) {
-            out.error(`Failed to start worker daemon: ${err.message || err}`);
-            out.log(`  ${out.dim('You can start it manually: agent-tempo daemon start')}`);
-            process.exit(1);
-        }
+    catch (err) {
+        out.error(`Infra startup failed: ${err?.message || err}`);
+        out.log(`  ${out.dim('You can start it manually: agent-tempo daemon start')}`);
+        process.exit(1);
     }
     // Step 4: Register MCP server if needed
     if ((0, mcp_1.isMcpConfigured)(process.cwd())) {
@@ -1628,14 +1523,14 @@ function stopTemporalServer(opts) {
 async function startTemporalForDestroy(config, deps = {}) {
     const attempts = deps.attempts ?? 20;
     const pollDelayMs = deps.pollDelayMs ?? 500;
-    const isReachable = deps.isReachable ?? (() => isTemporalReachable(config));
+    const isReachable = deps.isReachable ?? (() => (0, ensure_infra_1.isTemporalReachable)(config));
     const spawn = deps.spawn ?? (() => {
         (0, fs_1.mkdirSync)(config_1.AGENT_TEMPO_HOME, { recursive: true });
         const port = config.temporalAddress.split(':')[1] || '7233';
         return (0, child_process_1.spawn)('temporal', [
             'server', 'start-dev',
             '--port', port,
-            '--db-filename', DEFAULT_DB_PATH,
+            '--db-filename', ensure_infra_1.DEFAULT_DB_PATH,
         ], { detached: true, stdio: 'ignore' });
     });
     const child = spawn();
@@ -1662,7 +1557,7 @@ async function down(opts) {
         : `  Stopping daemon + Temporal. Workflows stay parked for the next ${out.dim('agent-tempo up')}.`);
     // Step 1 (destroy mode only): enumerate + terminate workflows across every
     // ensemble, after a typed confirmation showing the user what's at stake.
-    let temporalUp = await isTemporalReachable(config);
+    let temporalUp = await (0, ensure_infra_1.isTemporalReachable)(config);
     // `--destroy` can only terminate workflows while Temporal is reachable.
     // Workflow state lives durably on disk in ~/.agent-tempo/, so if Temporal
     // happens to be down when the user runs `down --destroy`, skipping the

package/dist/cli/ensure-infra.d.ts

@@ -0,0 +1,80 @@
+import { Config } from '../config';
+/** SQLite db file for the bundled Temporal dev server (same path `up()` uses). */
+export declare const DEFAULT_DB_PATH: string;
+/**
+ * Probe whether Temporal is reachable AND its namespace can serve requests (a
+ * gRPC connect alone doesn't prove readiness — issue a cheap visibility query).
+ * MOVED from commands.ts; the CLI's other temporal-start sites import it back.
+ */
+export declare function isTemporalReachable(config: {
+    temporalAddress: string;
+    temporalNamespace?: string;
+    temporalApiKey?: string;
+    temporalTlsCertPath?: string;
+    temporalTlsKeyPath?: string;
+}): Promise<boolean>;
+/**
+ * Register all {@link REQUIRED_SEARCH_ATTRIBUTES}. Permission errors (Temporal
+ * Cloud namespace keys can't reach the operator service) are NOT counted as
+ * failures — collapsed to one soft line (#686). Definitive failures (e.g. the
+ * SQLite 10-Keyword cap) keep the hard "will fail" conclusion. MOVED from
+ * commands.ts; re-imported there.
+ */
+export declare function registerSearchAttributes(temporalAddress: string, namespace?: string): {
+    failed: number;
+};
+/**
+ * Copy the shipped agent-type definitions into `~/.claude/agents/` if absent, so
+ * recruiting TYPED lineup players resolves. Idempotent (skips existing). MOVED
+ * from `up()` step 3.5 — folded into ensureInfra so `/ensemble-up` gets it too.
+ */
+export declare function installAgentTypes(): {
+    installed: number;
+    total: number;
+};
+/** A bootstrap-progress event, surfaced to the caller's UI (out.check / ctx.ui). */
+export interface InfraProgress {
+    step: 'temporal' | 'search-attributes' | 'agent-types' | 'daemon';
+    status: 'ok' | 'started' | 'done';
+    detail?: string;
+}
+export interface EnsureInfraResult {
+    config: Config;
+    temporal: 'up' | 'started';
+    daemon: 'up' | 'started';
+}
+/**
+ * Injectable seam (tests only). Defaults to the real functions; a test overrides
+ * to assert ordering (SA-before-daemon), connect-only, and explicit-config
+ * propagation without spawning anything.
+ */
+export interface EnsureInfraDeps {
+    isTemporalReachable: (config: Config) => Promise<boolean>;
+    startTemporalDevServer: (config: Config) => Promise<{
+        pid?: number;
+    }>;
+    registerSearchAttributes: (addr: string, ns: string) => {
+        failed: number;
+    };
+    installAgentTypes: () => {
+        installed: number;
+        total: number;
+    };
+    isDaemonRunning: () => boolean;
+    startDaemon: (config: Config) => Promise<number>;
+    getDaemonStatus: () => {
+        pid?: number;
+    };
+}
+/**
+ * Bring local infra up (CONNECT-ONLY — never registers MCP). Order: Temporal →
+ * search attributes → agent types → daemon (SA MUST precede the daemon, which
+ * refuses to boot without them). `onStep` lets the caller render progress
+ * (`up()` → out.check; the Pi extension → ctx.ui.notify). Throws if Temporal
+ * can't be reached/started; the caller decides how to surface that.
+ */
+export declare function ensureInfra(opts?: {
+    config?: Config;
+    onStep?: (p: InfraProgress) => void;
+    deps?: Partial<EnsureInfraDeps>;
+}): Promise<EnsureInfraResult>;

package/dist/cli/ensure-infra.js

@@ -0,0 +1,234 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DB_PATH = void 0;
+exports.isTemporalReachable = isTemporalReachable;
+exports.registerSearchAttributes = registerSearchAttributes;
+exports.installAgentTypes = installAgentTypes;
+exports.ensureInfra = ensureInfra;
+/**
+ * Shared infrastructure bootstrap (#700 P1 / command-center).
+ *
+ * `ensureInfra()` is the ONE path that brings the local agent-tempo infra up —
+ * Temporal dev server, the AgentTempo* search attributes, the shipped agent
+ * types, and the worker daemon — so BOTH the CLI (`agent-tempo up`) and the
+ * mission-control Pi extension (`/ensemble-up`) call identical logic and can't
+ * drift. Extracted from `up()` (the Temporal-start + SA + agent-types + daemon
+ * steps) per the command-center design §2/§7A.
+ *
+ * CONNECT-ONLY: this never registers the MCP server (`init()`) — that's a
+ * CLI-only step and is explicitly cut from the bootstrap path (the Pi extension
+ * registers tools natively, no MCP).
+ *
+ * ORDERING IS LOAD-BEARING: search attributes MUST be registered BEFORE the
+ * daemon starts — the daemon refuses to boot (process.exit) if the SAs are
+ * missing (see `sa-preflight` + `daemon.ts` boot gate). `up()` did SA at step 3,
+ * daemon at step 3.7; ensureInfra preserves that order.
+ *
+ * `isTemporalReachable` + `registerSearchAttributes` MOVED here from
+ * `commands.ts` (their natural infra home); `commands.ts` re-imports them. This
+ * keeps ensure-infra a LEAF (imports only connection / sa-preflight / daemon /
+ * config / output) — no `commands.ts ↔ ensure-infra` cycle.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
+const client_1 = require("@temporalio/client");
+const config_1 = require("../config");
+const connection_1 = require("../connection");
+const sa_preflight_1 = require("./sa-preflight");
+const daemon_1 = require("./daemon");
+const out = __importStar(require("./output"));
+/** SQLite db file for the bundled Temporal dev server (same path `up()` uses). */
+exports.DEFAULT_DB_PATH = (0, path_1.join)(config_1.AGENT_TEMPO_HOME, 'temporal-data.db');
+/** Package root (dist/cli/ensure-infra.js → dist → pkgRoot) — holds examples/agents. */
+const PACKAGE_ROOT = (0, path_1.resolve)(__dirname, '..', '..');
+/**
+ * Probe whether Temporal is reachable AND its namespace can serve requests (a
+ * gRPC connect alone doesn't prove readiness — issue a cheap visibility query).
+ * MOVED from commands.ts; the CLI's other temporal-start sites import it back.
+ */
+async function isTemporalReachable(config) {
+    try {
+        const conn = await (0, connection_1.createTemporalConnection)(config);
+        try {
+            const client = new client_1.Client({ connection: conn, namespace: config.temporalNamespace || 'default' });
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            for await (const _ of client.workflow.list({ query: 'WorkflowId = "__readiness_probe__"' })) {
+                break;
+            }
+        }
+        finally {
+            await conn.close();
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Register all {@link REQUIRED_SEARCH_ATTRIBUTES}. Permission errors (Temporal
+ * Cloud namespace keys can't reach the operator service) are NOT counted as
+ * failures — collapsed to one soft line (#686). Definitive failures (e.g. the
+ * SQLite 10-Keyword cap) keep the hard "will fail" conclusion. MOVED from
+ * commands.ts; re-imported there.
+ */
+function registerSearchAttributes(temporalAddress, namespace = 'default') {
+    let failed = 0;
+    let permissionBlocked = 0;
+    for (const attr of sa_preflight_1.REQUIRED_SEARCH_ATTRIBUTES) {
+        const r = (0, sa_preflight_1.registerSearchAttribute)(attr, temporalAddress, namespace);
+        switch (r.status) {
+            case 'created':
+                out.success(`Registered search attribute: ${attr.name}`);
+                break;
+            case 'already-exists':
+                out.dim(`  ${attr.name} (already registered)`);
+                break;
+            case 'failed':
+                if ((0, sa_preflight_1.isPermissionError)(r.detail)) {
+                    permissionBlocked++;
+                }
+                else {
+                    failed++;
+                    out.warn(`Failed to register ${attr.name}: ${r.detail}`);
+                }
+                break;
+        }
+    }
+    if (permissionBlocked > 0) {
+        const saList = sa_preflight_1.REQUIRED_SEARCH_ATTRIBUTES.map((a) => `${a.name}:${a.type}`).join(', ');
+        out.warn(`Couldn't verify search attributes — this credential lacks permission to manage them ` +
+            `(normal on Temporal Cloud, where search attributes are managed via the Cloud UI or tcld). ` +
+            `If workflow starts fail with "search attribute ... is not defined", create these ` +
+            `${sa_preflight_1.REQUIRED_SEARCH_ATTRIBUTES.length} via the Cloud UI / tcld: ${saList}. ` +
+            `Otherwise this is safe to ignore.`);
+    }
+    if (failed > 0) {
+        out.warn(`${failed} search attribute${failed === 1 ? '' : 's'} not registered — ` +
+            `workflow starts will fail. Resolve the errors above before continuing.`);
+    }
+    return { failed };
+}
+/**
+ * Copy the shipped agent-type definitions into `~/.claude/agents/` if absent, so
+ * recruiting TYPED lineup players resolves. Idempotent (skips existing). MOVED
+ * from `up()` step 3.5 — folded into ensureInfra so `/ensemble-up` gets it too.
+ */
+function installAgentTypes() {
+    const userAgentsDir = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'agents');
+    const shippedAgentsPath = (0, path_1.join)(PACKAGE_ROOT, 'examples', 'agents');
+    if (!(0, fs_1.existsSync)(shippedAgentsPath))
+        return { installed: 0, total: 0 };
+    (0, fs_1.mkdirSync)(userAgentsDir, { recursive: true });
+    const shipped = (0, fs_1.readdirSync)(shippedAgentsPath).filter((f) => f.endsWith('.md'));
+    let installed = 0;
+    for (const file of shipped) {
+        const dest = (0, path_1.join)(userAgentsDir, file);
+        if (!(0, fs_1.existsSync)(dest)) {
+            (0, fs_1.copyFileSync)((0, path_1.join)(shippedAgentsPath, file), dest);
+            installed++;
+        }
+    }
+    return { installed, total: shipped.length };
+}
+/** Default Temporal dev-server start (detached spawn + readiness poll). Throws on timeout. */
+async function startTemporalDevServer(config) {
+    (0, fs_1.mkdirSync)(config_1.AGENT_TEMPO_HOME, { recursive: true });
+    const port = config.temporalAddress.split(':')[1] || '7233';
+    const child = (0, child_process_1.spawn)('temporal', ['server', 'start-dev', '--port', port, '--db-filename', exports.DEFAULT_DB_PATH], {
+        detached: true,
+        stdio: 'ignore',
+    });
+    child.unref();
+    for (let i = 0; i < 20; i++) {
+        await new Promise((r) => setTimeout(r, 500));
+        if (await isTemporalReachable(config))
+            return { pid: child.pid };
+    }
+    throw new Error('Temporal did not start within 10 seconds');
+}
+const defaultDeps = {
+    isTemporalReachable,
+    startTemporalDevServer,
+    registerSearchAttributes,
+    installAgentTypes,
+    isDaemonRunning: daemon_1.isDaemonRunning,
+    startDaemon: daemon_1.startDaemon,
+    getDaemonStatus: daemon_1.getDaemonStatus,
+};
+/**
+ * Bring local infra up (CONNECT-ONLY — never registers MCP). Order: Temporal →
+ * search attributes → agent types → daemon (SA MUST precede the daemon, which
+ * refuses to boot without them). `onStep` lets the caller render progress
+ * (`up()` → out.check; the Pi extension → ctx.ui.notify). Throws if Temporal
+ * can't be reached/started; the caller decides how to surface that.
+ */
+async function ensureInfra(opts = {}) {
+    const config = opts.config ?? (0, config_1.getConfig)();
+    const onStep = opts.onStep ?? (() => { });
+    const d = { ...defaultDeps, ...opts.deps };
+    // 1. Temporal — reachable, or auto-start the dev server.
+    let temporal;
+    if (await d.isTemporalReachable(config)) {
+        temporal = 'up';
+        onStep({ step: 'temporal', status: 'ok', detail: config.temporalAddress });
+    }
+    else {
+        const { pid } = await d.startTemporalDevServer(config);
+        temporal = 'started';
+        onStep({ step: 'temporal', status: 'started', detail: pid != null ? `pid ${pid}` : undefined });
+    }
+    // 2. Search attributes — BEFORE the daemon (it refuses to boot without them).
+    const sa = d.registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+    onStep({ step: 'search-attributes', status: 'done', detail: sa.failed > 0 ? `${sa.failed} failed` : undefined });
+    // 3. Agent types — so recruiting typed lineup players resolves.
+    const at = d.installAgentTypes();
+    onStep({ step: 'agent-types', status: 'done', detail: at.installed > 0 ? `installed ${at.installed}` : `${at.total} present` });
+    // 4. Worker daemon (detached; reused verbatim from the CLI path).
+    let daemon;
+    if (d.isDaemonRunning()) {
+        daemon = 'up';
+        onStep({ step: 'daemon', status: 'ok', detail: d.getDaemonStatus().pid != null ? `pid ${d.getDaemonStatus().pid}` : undefined });
+    }
+    else {
+        const pid = await d.startDaemon(config);
+        daemon = 'started';
+        onStep({ step: 'daemon', status: 'started', detail: `pid ${pid}` });
+    }
+    return { config, temporal, daemon };
+}

package/dist/cli/help-text.js

@@ -89,6 +89,7 @@ ${out.bold('Commands:')}
   ${out.cyan('upgrade')}  [version]       Upgrade agent-tempo to latest (or specific version)
   ${out.cyan('config')}                   Configure Temporal connection settings
   ${out.cyan('init')}                     Register MCP server globally (or --project for .mcp.json)
+  ${out.cyan('install-pi')}               Install the Pi extensions into Pi settings (or --project for .pi/settings.json)
   ${out.cyan('preflight')}                Run preflight checks only
   ${out.cyan('help')}                     Show this help message
 

package/dist/cli.js

@@ -616,6 +616,24 @@ async function main() {
         case 'init':
             await init({ dir: args.dir, project: args.project });
             break;
+        case 'install-pi': {
+            // #700 P1 — install agent-tempo's two Pi extensions (player +
+            // command-center) the normal `.pi` way: an idempotent, install-by-reference
+            // merge of their absolute dist paths into Pi's settings.json. Pure fs
+            // (no Temporal) — dynamic-imported so it doesn't bloat the crash-proof
+            // top-level module graph. `--project` writes `.pi/settings.json` instead
+            // of the global `~/.pi/agent/settings.json`.
+            const { installPiExtensions } = await Promise.resolve().then(() => __importStar(require('./pi/install')));
+            const result = installPiExtensions({ project: args.project });
+            out.success(`Pi extensions installed → ${result.settingsPath}`);
+            for (const p of result.added)
+                out.log(`  ${out.green('+')} ${p}`);
+            for (const p of result.alreadyPresent)
+                out.log(out.dim(`  · ${p} (already installed)`));
+            out.log('');
+            out.log('  Restart `pi` to load the agent-tempo extensions.');
+            break;
+        }
         case 'migrate-from-claude-tempo': {
             // PR-2 of the v1.0 rebrand — one-shot copy of `~/.agent-tempo/` →
             // `~/.agent-tempo/`. Crash-proof (no Temporal deps). The `--dev`

package/dist/http/catalog.js

@@ -77,7 +77,7 @@ async function handleCreateEnsemble(req, res, client) {
     const parsed = parseBody(body);
     if ('error' in parsed)
         return (0, responses_1.errorResponse)(res, 400, parsed.error);
-    const { name, lineup, host, startMode, conductorInstructions } = parsed.body;
+    const { name, lineup, host, startMode, conductorInstructions, conductorAgent: conductorAgentOverride } = parsed.body;
     // 409 — ensemble already exists. `listEnsembles()` returns live
     // ensembles by Temporal workflow; matches what the dashboard's
     // `/v1/ensembles` GET sees. Note: TOCTOU between this read and the
@@ -127,7 +127,11 @@ async function handleCreateEnsemble(req, res, client) {
     // spawn target either way.
     const conductorBlock = resolved?.conductor;
     const conductorName = conductorBlock?.name ?? 'conductor';
-    const conductorAgent = pickAgent(conductorBlock?.agent, allowed);
+    // #700 P1: a body-supplied `conductorAgent` wins; fall back to the lineup's
+    // conductor agent. Each candidate is run through `pickAgent` (allowed-only),
+    // so an invalid override is dropped and we still fall back to the lineup —
+    // and OMITTING `conductorAgent` reproduces today's behavior exactly.
+    const conductorAgent = pickAgent(conductorAgentOverride, allowed) ?? pickAgent(conductorBlock?.agent, allowed);
     try {
         await client.recruit(name, {
             name: conductorName,
@@ -198,6 +202,9 @@ function parseBody(body) {
         return { error: { error: 'invalid-start-mode', allowed: ALLOWED_START_MODES } };
     }
     const conductorInstructions = (0, body_1.stringField)(body, 'conductorInstructions', { requireNonEmpty: true });
+    // #700 P1 — additive optional override (validated against allowed agents at
+    // recruit time via pickAgent, like the lineup's conductor agent).
+    const conductorAgent = (0, body_1.stringField)(body, 'conductorAgent', { requireNonEmpty: true });
     // Lightweight host-name shape check (matches the daemon's existing
     // hostname rules used by recruit). Skips when omitted.
     if (host !== undefined && (0, validation_1.validatePlayerName)(host) !== null) {
@@ -210,6 +217,7 @@ function parseBody(body) {
             ...(host !== undefined && { host }),
             ...(startMode !== undefined && { startMode: startMode }),
             ...(conductorInstructions !== undefined && { conductorInstructions }),
+            ...(conductorAgent !== undefined && { conductorAgent }),
         },
     };
 }

package/dist/http/writes.d.ts

@@ -42,7 +42,7 @@ export { WRITE_BODY_MAX };
  *   mutations. Bodies are uniform `{ playerId, reason? }` (plus per-action
  *   extras); the ensemble lives in the URL.
  */
-export declare const WRITE_ACTIONS: readonly ["cue", "pause", "play", "release", "recruit", "restart", "reset", "destroy", "detach", "recall"];
+export declare const WRITE_ACTIONS: readonly ["cue", "pause", "play", "release", "recruit", "restart", "reset", "destroy", "detach", "recall", "shutdown"];
 export type WriteAction = (typeof WRITE_ACTIONS)[number];
 /** Type guard — narrows an arbitrary string to a known `WriteAction`. */
 export declare function isWriteAction(s: string): s is WriteAction;

package/dist/http/writes.js

@@ -30,6 +30,7 @@ exports.WRITE_ACTIONS = [
     'destroy',
     'detach',
     'recall',
+    'shutdown',
 ];
 /** Type guard — narrows an arbitrary string to a known `WriteAction`. */
 function isWriteAction(s) {
@@ -67,6 +68,7 @@ async function handleWriteRoute(req, res, client, ensemble, action) {
             case 'destroy': return await handleDestroy(res, client, ensemble, body);
             case 'detach': return await handleDetach(res, client, ensemble, body);
             case 'recall': return await handleRecall(res, client, ensemble, body);
+            case 'shutdown': return await handleShutdown(res, client, ensemble, body);
         }
     }
     catch (err) {
@@ -235,6 +237,22 @@ async function handleRecall(res, client, ensemble, body) {
     const messages = result.received.length + result.sent.length;
     (0, responses_1.jsonResponse)(res, 200, { ok: true, ensemble, playerId, messages });
 }
+/**
+ * Ensemble teardown (#700 P1) — the HTTP verb the command-center `/ensemble-down`
+ * needs (the CLI `down` + the `shutdown` MCP tool cover this, but neither was
+ * HTTP). Graceful by default: `client.shutdown(ensemble)` fans out detach + pauses
+ * the scheduler + maestro; workflows survive in `detached` (pair with `restore`).
+ * `{ destroy: true }` (`/ensemble-down --destroy`) escalates to the ensemble-scope
+ * `client.destroy(ensemble)` (no `playerId`) — terminate, not graceful.
+ */
+async function handleShutdown(res, client, ensemble, body) {
+    if (body.destroy === true) {
+        const summary = await client.destroy(ensemble);
+        return (0, responses_1.jsonResponse)(res, 202, { ok: true, ensemble, mode: 'destroy', summary: summary ?? null });
+    }
+    const summary = await client.shutdown(ensemble);
+    (0, responses_1.jsonResponse)(res, 202, { ok: true, ensemble, mode: 'shutdown', summary });
+}
 // ── Helpers ──────────────────────────────────────────────────────────────
 /**
  * Map a thrown error from a TempoClient call to an HTTP response.

package/dist/pi/extension.js

@@ -188,6 +188,34 @@ function createPiExtension(options = {}) {
         };
         (0, render_tools_1.renderToPi)(pi, (0, server_tools_1.buildAllTempoTools)(toolOpts));
         log(`registered tools (player=${currentPlayerId}, conductor=${isConductor}, mode=${mode})`);
+        // ── #698 — FULL server-instruction preamble into the Pi system prompt ──
+        // The Pi equivalent of MCP players' `buildServerInstructions` (#695 S2 seeded
+        // this hook with just the 4 yield-norms; #698 widens it to the WHOLE preamble —
+        // identity, cue/report/recruit guidance, Communication-discipline, and the
+        // conductor/player operational rules). SINGLE-SOURCED off `buildServerInstructions`
+        // so MCP + Pi guidance can't drift; the yield-norms now arrive FOLDED IN (they
+        // live inside that builder since #695 S1), so there is no separate const.
+        // `before_agent_start` exposes the fully-assembled systemPrompt and accepts a
+        // replacement (chained across extensions), so we APPEND — injected into the
+        // model's system prompt every turn, invisibly (NOT a sendMessage, which would
+        // spam the transcript). Applies to ALL Pi players (interactive + headless).
+        //
+        // Opts are built PER FIRE (before_agent_start fires every turn): playerId and
+        // hasRequestedName must reflect CURRENT state, so a `set_name`-renamed player
+        // gets the right identity rather than the boot-time one.
+        const piInstructionOpts = () => ({
+            ensemble: config.ensemble,
+            playerId: toolOpts.getPlayerId(),
+            isConductor,
+            playerType: process.env[config_1.ENV.PLAYER_TYPE] || undefined,
+            // playerTypeDescription omitted (MVP — not threaded into the Pi runtime).
+            hasRequestedName: Boolean(process.env[config_1.ENV.PLAYER_NAME]),
+        });
+        // Cast mirrors the tool_call returning-handler pattern (the shim's `on` is
+        // void-typed; the real ExtensionAPI before_agent_start handler returns a result).
+        pi.on('before_agent_start', (ev) => ({
+            systemPrompt: `${ev.systemPrompt ?? ''}\n\n${(0, server_tools_1.buildServerInstructions)(piInstructionOpts())}`,
+        }));
         // ── #677 PART B — interactive-only `/tempo-reset` command ──
         // Pi's `newSession` (clean-wipe) is ExtensionCommandContext-ONLY (not on the
         // SDK session), so an interactive Pi conductor can ONLY be reset by the operator

package/dist/pi/install.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Absolute paths to the two shipped Pi extension entry points.
+ *
+ * `__dirname` is `<pkg>/dist/pi` (this module compiles to `dist/pi/install.js`),
+ * so both entry points are resolved relative to it directly (MUST-FIX 1).
+ */
+export declare function piExtensionPaths(): {
+    player: string;
+    missionControl: string;
+};
+export interface InstallPiOptions {
+    /**
+     * Install into the per-project `.pi/settings.json` (under `cwd`) instead of
+     * the global `~/.pi/agent/settings.json`.
+     */
+    project?: boolean;
+    /** Base dir for project-scope install. Defaults to `process.cwd()`. */
+    cwd?: string;
+    /** Override the home dir (tests). Defaults to `os.homedir()`. */
+    home?: string;
+}
+export interface InstallPiResult {
+    /** The settings.json file that was read/written. */
+    settingsPath: string;
+    /** Extension paths added by THIS run (empty on a repeat run — idempotent). */
+    added: string[];
+    /** Extension paths already present before this run. */
+    alreadyPresent: string[];
+    /** The final `extensions` array written to settings.json. */
+    extensions: string[];
+}
+/** Resolve the Pi settings.json path for the chosen scope. */
+export declare function piSettingsPath(opts?: InstallPiOptions): string;
+/**
+ * Idempotently merge the two agent-tempo Pi extension absolute paths into Pi's
+ * `settings.json` `"extensions"` array. Re-running is a no-op (no duplicates, no
+ * write when nothing changed). Never copies any extension file — install by
+ * reference only (see file header).
+ *
+ * Tolerates a missing / empty / corrupt settings file: a missing file is
+ * created; an unparseable one is replaced with a fresh object carrying just the
+ * extensions (we can only safely merge a valid object). Other recognised keys in
+ * a valid settings object are preserved.
+ */
+export declare function installPiExtensions(opts?: InstallPiOptions): InstallPiResult;

package/dist/pi/install.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.piExtensionPaths = piExtensionPaths;
+exports.piSettingsPath = piSettingsPath;
+exports.installPiExtensions = installPiExtensions;
+/**
+ * Install the agent-tempo Pi extensions the normal `.pi` way (#700 P1, design §8).
+ *
+ * One agent-tempo install ships TWO Pi extension entry points — the player
+ * extension (`dist/pi/extension.js`, claims attachment / registers as a player)
+ * and the command-center extension (`dist/pi/mission-control/extension.js`,
+ * observer-only board + operator controller). `installPiExtensions()`
+ * idempotently merges their ABSOLUTE dist paths into Pi's `settings.json`
+ * `"extensions"` array.
+ *
+ * ── INSTALL-BY-REFERENCE, never a loose copy (design §8, load-bearing) ──
+ * We point Pi's settings at the extension files *where they already live inside
+ * the installed agent-tempo package* — we never copy a loose `.js` into
+ * `~/.pi/agent/extensions/`. The reason is dependency resolution: our extension
+ * imports `@temporalio/*`, `croner`, etc., which resolve via Node's upward
+ * `node_modules` walk. That walk only finds our deps when the extension file
+ * sits inside the agent-tempo package tree. A loose copy has no `node_modules`
+ * beside it, so those bare imports would fail. Reference-install keeps Node's
+ * resolution intact with zero copying.
+ *
+ * ── MUST-FIX 1: resolve the two paths DIRECTLY from `__dirname` ──
+ * This file compiles to `<pkg>/dist/pi/install.js`, co-located with
+ * `dist/pi/extension.js` and `dist/pi/mission-control/extension.js`. So the
+ * paths are `join(__dirname, 'extension.js')` and
+ * `join(__dirname, 'mission-control', 'extension.js')` — NOT
+ * `resolve(__dirname, '..', …)` (that would yield `dist/dist/…`, the bug).
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
+/**
+ * Absolute paths to the two shipped Pi extension entry points.
+ *
+ * `__dirname` is `<pkg>/dist/pi` (this module compiles to `dist/pi/install.js`),
+ * so both entry points are resolved relative to it directly (MUST-FIX 1).
+ */
+function piExtensionPaths() {
+    return {
+        player: (0, path_1.resolve)(__dirname, 'extension.js'),
+        missionControl: (0, path_1.resolve)(__dirname, 'mission-control', 'extension.js'),
+    };
+}
+/** Resolve the Pi settings.json path for the chosen scope. */
+function piSettingsPath(opts = {}) {
+    if (opts.project)
+        return (0, path_1.join)(opts.cwd ?? process.cwd(), '.pi', 'settings.json');
+    return (0, path_1.join)(opts.home ?? (0, os_1.homedir)(), '.pi', 'agent', 'settings.json');
+}
+/**
+ * Idempotently merge the two agent-tempo Pi extension absolute paths into Pi's
+ * `settings.json` `"extensions"` array. Re-running is a no-op (no duplicates, no
+ * write when nothing changed). Never copies any extension file — install by
+ * reference only (see file header).
+ *
+ * Tolerates a missing / empty / corrupt settings file: a missing file is
+ * created; an unparseable one is replaced with a fresh object carrying just the
+ * extensions (we can only safely merge a valid object). Other recognised keys in
+ * a valid settings object are preserved.
+ */
+function installPiExtensions(opts = {}) {
+    const settingsPath = piSettingsPath(opts);
+    const { player, missionControl } = piExtensionPaths();
+    const want = [player, missionControl];
+    let settings = {};
+    const fileExists = (0, fs_1.existsSync)(settingsPath);
+    if (fileExists) {
+        try {
+            const parsed = JSON.parse((0, fs_1.readFileSync)(settingsPath, 'utf8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                settings = parsed;
+            }
+        }
+        catch {
+            // Corrupt JSON — fall back to a clean object (can't safely merge into
+            // something we can't parse). Other keys are unrecoverable in that case.
+            settings = {};
+        }
+    }
+    const current = Array.isArray(settings.extensions)
+        ? settings.extensions.filter((x) => typeof x === 'string')
+        : [];
+    const added = [];
+    const alreadyPresent = [];
+    const merged = [...current];
+    for (const p of want) {
+        if (merged.includes(p)) {
+            alreadyPresent.push(p);
+        }
+        else {
+            merged.push(p);
+            added.push(p);
+        }
+    }
+    settings.extensions = merged;
+    // Idempotent: only write when something actually changed (or the file is
+    // absent and must be created). A clean repeat run touches nothing.
+    if (added.length > 0 || !fileExists) {
+        (0, fs_1.mkdirSync)((0, path_1.dirname)(settingsPath), { recursive: true });
+        (0, fs_1.writeFileSync)(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, 'utf8');
+    }
+    return { settingsPath, added, alreadyPresent, extensions: merged };
+}

package/dist/pi/mission-control/actions.d.ts

@@ -43,6 +43,34 @@ export declare class MissionControlActions {
     restart(playerId: string, reason?: string): Promise<ActionResult>;
     destroy(playerId: string, reason?: string): Promise<ActionResult>;
     reset(playerId: string, reason?: string): Promise<ActionResult>;
+    /**
+     * Create a fresh ensemble via `POST /v1/ensembles` (the catalog route, NOT
+     * ensemble-scoped). Defaults `name` to this client's bound ensemble — the one
+     * the command-center board observes. `conductorAgent` lets `/ensemble-up`
+     * default the conductor to a headless Pi (design §3).
+     */
+    createEnsemble(opts?: {
+        name?: string;
+        lineup?: string;
+        host?: string;
+        startMode?: 'hold' | 'release';
+        conductorInstructions?: string;
+        conductorAgent?: string;
+    }): Promise<ActionResult>;
+    /** Recruit a player into the bound ensemble (`POST /v1/ensembles/:e/recruit`). */
+    recruit(opts: {
+        name: string;
+        workDir: string;
+        playerType?: string;
+        host?: string;
+        agent?: string;
+    }): Promise<ActionResult>;
+    /**
+     * Tear down the bound ensemble (`POST /v1/ensembles/:e/shutdown`). Graceful by
+     * default (detach + pause, survives in `detached`); `destroy: true` escalates
+     * to ensemble-scope destroy (terminate).
+     */
+    shutdownEnsemble(destroy?: boolean): Promise<ActionResult>;
     gateArm(playerId: string): Promise<ActionResult>;
     gateDisarm(playerId: string): Promise<ActionResult>;
     gateDecide(playerId: string, requestId: string, decision: 'allow' | 'deny'): Promise<ActionResult>;

package/dist/pi/mission-control/actions.js

@@ -87,6 +87,29 @@ class MissionControlActions {
     reset(playerId, reason) {
         return this.post(`/v1/ensembles/${this.ens()}/reset`, { playerId, ...(reason ? { reason } : {}) });
     }
+    // ── Bootstrap surface (#700 P1) ──
+    /**
+     * Create a fresh ensemble via `POST /v1/ensembles` (the catalog route, NOT
+     * ensemble-scoped). Defaults `name` to this client's bound ensemble — the one
+     * the command-center board observes. `conductorAgent` lets `/ensemble-up`
+     * default the conductor to a headless Pi (design §3).
+     */
+    createEnsemble(opts = {}) {
+        const { name, ...rest } = opts;
+        return this.post('/v1/ensembles', { name: name ?? this.ensemble, ...rest });
+    }
+    /** Recruit a player into the bound ensemble (`POST /v1/ensembles/:e/recruit`). */
+    recruit(opts) {
+        return this.post(`/v1/ensembles/${this.ens()}/recruit`, opts);
+    }
+    /**
+     * Tear down the bound ensemble (`POST /v1/ensembles/:e/shutdown`). Graceful by
+     * default (detach + pause, survives in `detached`); `destroy: true` escalates
+     * to ensemble-scope destroy (terminate).
+     */
+    shutdownEnsemble(destroy) {
+        return this.post(`/v1/ensembles/${this.ens()}/shutdown`, destroy ? { destroy: true } : {});
+    }
     // ── Operator gate plane (T3) ──
     gateArm(playerId) {
         return this.post(`/v1/players/${this.player(playerId)}/gate-arm`, {});

package/dist/pi/mission-control/extension.d.ts

@@ -1,5 +1,6 @@
 import { type BoardModel } from './board';
 import { MissionControlActions } from './actions';
+import { type InfraProgress } from '../../cli/ensure-infra';
 import type { McExtensionAPI, McExtensionContext } from './pi-ui';
 /** Injectable seams (production defaults; tests override). */
 export interface MissionControlDeps {
@@ -10,6 +11,27 @@ export interface MissionControlDeps {
     /** Local daemon host for tailability (test override; defaults to `os.hostname()`). */
     localHost?: string;
 }
+/**
+ * Infra-bootstrap seam (#700 P1). Defaults to the real {@link ensureInfra}; the
+ * extension command tests inject a fake so `/ensemble-up` etc. don't spawn
+ * Temporal / the daemon. Accepts only the `onStep` opt the controller passes.
+ */
+export type EnsureInfraFn = (opts?: {
+    onStep?: (p: InfraProgress) => void;
+}) => Promise<unknown>;
+/** Parsed `/ensemble-up [name] [--lineup X] [--hold]` args. */
+export declare function parseEnsembleUpArgs(args: string): {
+    name?: string;
+    lineup?: string;
+    hold: boolean;
+};
+/** Parsed `/recruit <name> [--type T] [--host H] [--agent A]` args. */
+export declare function parseRecruitArgs(args: string): {
+    name?: string;
+    type?: string;
+    host?: string;
+    agent?: string;
+};
 /**
  * The operator-command + board controller. Holds the model + the action client;
  * command methods are independently unit-testable with a fake actions + ctx.
@@ -25,7 +47,9 @@ export declare class Controller {
     readonly localHost: string;
     /** Set by the extension so /tail can (re)open the fine SSE; null in unit tests. */
     onTailRequest: ((playerId: string | null) => void) | null;
-    constructor(ensemble: string, actions: MissionControlActions, localHost?: string);
+    /** Infra bootstrap fn (#700 P1); injectable for tests. */
+    private readonly ensureInfraFn;
+    constructor(ensemble: string, actions: MissionControlActions, localHost?: string, ensureInfraFn?: EnsureInfraFn);
     private notify;
     private report;
     /** First whitespace-delimited token + the remainder. */
@@ -40,6 +64,16 @@ export declare class Controller {
     cmdReset(args: string, ctx: McExtensionContext): Promise<void>;
     cmdArm(args: string, ctx: McExtensionContext): Promise<void>;
     cmdGate(args: string, ctx: McExtensionContext): Promise<void>;
+    /**
+     * Ensure local infra is up (Temporal + SAs + agent types + daemon), streaming
+     * each step to the UI. Returns false (and notifies) if bootstrap fails, so the
+     * caller can bail before the HTTP action. Idempotent — a no-op when infra is
+     * already live.
+     */
+    private ensureInfraReady;
+    cmdEnsembleUp(args: string, ctx: McExtensionContext): Promise<void>;
+    cmdRecruit(args: string, ctx: McExtensionContext): Promise<void>;
+    cmdEnsembleDown(args: string, ctx: McExtensionContext): Promise<void>;
 }
 /**
  * Build the mission-control extension (default-export shape). The operator's Pi

package/dist/pi/mission-control/extension.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Controller = void 0;
+exports.parseEnsembleUpArgs = parseEnsembleUpArgs;
+exports.parseRecruitArgs = parseRecruitArgs;
 exports.createMissionControlExtension = createMissionControlExtension;
 /**
  * Mission-control Pi extension (3f) — turns ONE interactive Pi TUI into an
@@ -58,9 +60,52 @@ const board_1 = require("./board");
 const render_1 = require("./render");
 const actions_1 = require("./actions");
 const inner_tail_1 = require("./inner-tail");
+const ensure_infra_1 = require("../../cli/ensure-infra");
 const WIDGET_KEY = 'mission-control';
 const DEFAULT_RENDER_THROTTLE_MS = 200;
 const DEFAULT_PORT = 8473;
+/** Parsed `/ensemble-up [name] [--lineup X] [--hold]` args. */
+function parseEnsembleUpArgs(args) {
+    const tokens = args.trim().split(/\s+/).filter(Boolean);
+    let name;
+    let lineup;
+    let hold = false;
+    for (let i = 0; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === '--hold')
+            hold = true;
+        else if (t === '--lineup')
+            lineup = tokens[++i];
+        else if (t.startsWith('--lineup='))
+            lineup = t.slice('--lineup='.length);
+        else if (!t.startsWith('--') && name === undefined)
+            name = t;
+    }
+    return { ...(name !== undefined ? { name } : {}), ...(lineup !== undefined ? { lineup } : {}), hold };
+}
+/** Parsed `/recruit <name> [--type T] [--host H] [--agent A]` args. */
+function parseRecruitArgs(args) {
+    const tokens = args.trim().split(/\s+/).filter(Boolean);
+    const out = {};
+    for (let i = 0; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === '--type')
+            out.type = tokens[++i];
+        else if (t.startsWith('--type='))
+            out.type = t.slice('--type='.length);
+        else if (t === '--host')
+            out.host = tokens[++i];
+        else if (t.startsWith('--host='))
+            out.host = t.slice('--host='.length);
+        else if (t === '--agent')
+            out.agent = tokens[++i];
+        else if (t.startsWith('--agent='))
+            out.agent = t.slice('--agent='.length);
+        else if (!t.startsWith('--') && out.name === undefined)
+            out.name = t;
+    }
+    return out;
+}
 /**
  * The operator-command + board controller. Holds the model + the action client;
  * command methods are independently unit-testable with a fake actions + ctx.
@@ -76,10 +121,13 @@ class Controller {
     localHost;
     /** Set by the extension so /tail can (re)open the fine SSE; null in unit tests. */
     onTailRequest = null;
-    constructor(ensemble, actions, localHost = os.hostname()) {
+    /** Infra bootstrap fn (#700 P1); injectable for tests. */
+    ensureInfraFn;
+    constructor(ensemble, actions, localHost = os.hostname(), ensureInfraFn = ensure_infra_1.ensureInfra) {
         this.model = (0, board_1.initBoard)(ensemble);
         this.actions = actions;
         this.localHost = localHost;
+        this.ensureInfraFn = ensureInfraFn;
     }
     notify(ctx, msg) {
         if (ctx.hasUI)
@@ -191,6 +239,65 @@ class Controller {
         }
         this.report(ctx, `gate ${reqId} ${decision}`, await this.actions.gateDecide(this.model.selected, reqId, decision));
     }
+    // ── Bootstrap commands (#700 P1) ──
+    /**
+     * Ensure local infra is up (Temporal + SAs + agent types + daemon), streaming
+     * each step to the UI. Returns false (and notifies) if bootstrap fails, so the
+     * caller can bail before the HTTP action. Idempotent — a no-op when infra is
+     * already live.
+     */
+    async ensureInfraReady(ctx) {
+        try {
+            await this.ensureInfraFn({
+                onStep: (p) => this.notify(ctx, `infra: ${p.step} ${p.status}${p.detail ? ` (${p.detail})` : ''}`),
+            });
+            return true;
+        }
+        catch (err) {
+            this.notify(ctx, `infra failed: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
+    async cmdEnsembleUp(args, ctx) {
+        const { name, lineup, hold } = parseEnsembleUpArgs(args);
+        if (!(await this.ensureInfraReady(ctx)))
+            return;
+        // Conductor defaults to a HEADLESS Pi (design §3) — the human's seat is this
+        // command-center planner, so a second interactive conductor window is
+        // redundant. `conductorAgent: 'pi'` overrides any lineup conductor agent.
+        const r = await this.actions.createEnsemble({
+            ...(name !== undefined ? { name } : {}),
+            ...(lineup !== undefined ? { lineup } : {}),
+            startMode: hold ? 'hold' : 'release',
+            conductorAgent: 'pi',
+        });
+        this.report(ctx, `ensemble-up${name ? ` ${name}` : ''}`, r);
+    }
+    async cmdRecruit(args, ctx) {
+        const { name, type, host, agent } = parseRecruitArgs(args);
+        if (!name) {
+            this.notify(ctx, 'Usage: /recruit <name> [--type T] [--host H] [--agent A]');
+            return;
+        }
+        if (!(await this.ensureInfraReady(ctx)))
+            return;
+        const r = await this.actions.recruit({
+            name,
+            // The extension runs in the Pi process; its cwd is the project dir.
+            workDir: process.cwd(),
+            ...(type !== undefined ? { playerType: type } : {}),
+            ...(host !== undefined ? { host } : {}),
+            ...(agent !== undefined ? { agent } : {}),
+        });
+        this.report(ctx, `recruit ${name}`, r);
+    }
+    async cmdEnsembleDown(args, ctx) {
+        const destroy = args.trim().split(/\s+/).includes('--destroy');
+        if (!(await this.ensureInfraReady(ctx)))
+            return;
+        const r = await this.actions.shutdownEnsemble(destroy);
+        this.report(ctx, `ensemble-down${destroy ? ' --destroy' : ''}`, r);
+    }
 }
 exports.Controller = Controller;
 function resolveBaseUrl(override) {
@@ -321,6 +428,10 @@ function createMissionControlExtension(deps = {}) {
         pi.registerCommand('reset', { description: 'Clean-wipe a player (/reset <player> [reason])', handler: (a, ctx) => ctrl.cmdReset(a, ctx) });
         pi.registerCommand('arm', { description: 'Arm/disarm the operator gate for a player (/arm <player> [off])', handler: (a, ctx) => ctrl.cmdArm(a, ctx) });
         pi.registerCommand('gate', { description: 'Decide a gate request for the tailed player (/gate <reqId> allow|deny)', handler: (a, ctx) => ctrl.cmdGate(a, ctx) });
+        // #700 P1 — bootstrap commands (ensureInfra → daemon HTTP action).
+        pi.registerCommand('ensemble-up', { description: 'Bootstrap the ensemble (/ensemble-up [name] [--lineup X] [--hold])', handler: (a, ctx) => ctrl.cmdEnsembleUp(a, ctx) });
+        pi.registerCommand('recruit', { description: 'Recruit a player (/recruit <name> [--type T] [--host H] [--agent A])', handler: (a, ctx) => ctrl.cmdRecruit(a, ctx) });
+        pi.registerCommand('ensemble-down', { description: 'Tear down the ensemble (/ensemble-down [--destroy])', handler: (a, ctx) => ctrl.cmdEnsembleDown(a, ctx) });
     };
 }
 /** Default export — the loadable Pi extension. */

package/dist/pi/pi-types.d.ts

@@ -191,6 +191,24 @@ export interface PiToolCallResult {
     block?: boolean;
     reason?: string;
 }
+/**
+ * `before_agent_start` payload (#695). Pi fires this after the user prompt is
+ * assembled but before the agent loop; it carries the fully-built `systemPrompt`.
+ * A handler returns {@link PiBeforeAgentStartResult} to replace it. We read only
+ * `systemPrompt` (to append the yield norms); kept open for forward-compat.
+ */
+export interface PiBeforeAgentStartEvent {
+    /** The fully-assembled system prompt string for this turn. */
+    systemPrompt?: string;
+}
+/**
+ * Result of a `before_agent_start` handler (#695). Returning `systemPrompt`
+ * REPLACES the system prompt for the turn ("If multiple extensions return this,
+ * they are chained" — Pi 0.78). We append the yield norms and return it.
+ */
+export interface PiBeforeAgentStartResult {
+    systemPrompt?: string;
+}
 /**
  * Pi tool result — a Pi-free structural mirror of the real `AgentToolResult`
  * (#653, 1.4.2). The Phase-0 `{ output, isError }` guess was WRONG: Pi's real

package/dist/server-tools.js

@@ -138,6 +138,11 @@ function buildServerInstructions(opts) {
         `Use \`report\` to notify the conductor of task completion, blockers, or questions — always report when you finish a recruited task.` +
         `\n\nCommunication discipline:\n` +
         `- Drafting a response in your turn is not the same as sending one. The conductor and other players cannot read your reasoning — only your \`cue\` and \`report\` tool calls cross the channel boundary. If you reach a decision, ruling, or status update, fire the appropriate tool before moving on. If you find yourself thinking "I already answered that," verify the tool was actually invoked.` +
+        // #695 — yield-don't-poll norms (apply to all MCP players).
+        `\n- Yield after dispatch — after cueing a player and expecting a reply, end your turn. Inbound cues wake you automatically at the next turn boundary; there is nothing to poll.` +
+        `\n- \`listen\` is a one-shot inbox drain, not a wait primitive — it reads whatever is already queued at call time. A \`sleep\`+\`listen\` loop does not work as a wait and is an anti-pattern that burns tokens across the ensemble. If you're waiting for a reply, end your turn.` +
+        `\n- Don't reply to ack/FYI cues — if a player sends a status update or acknowledgment without asking a question or requesting action, do not respond. Responding starts a ping-pong that wastes turns on both sides.` +
+        `\n- Cues queue, they don't interrupt — a cue sent to you while you're processing arrives at your next turn boundary, not mid-turn. A burst from multiple players arrives together; process the batch in one turn.` +
         (isConductor
             ? `\n\nOperational rules:\n` +
                 `- Before assigning parallel work on different branches, provision git worktrees via the \`worktree\` tool so each player has an isolated checkout.\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-tempo",
-  "version": "1.6.2",
+  "version": "1.7.0-beta.1",
   "description": "Many agents, one tempo. Durable coordination for multi-agent work via Temporal.",
   "keywords": [
     "mcp",
@@ -54,6 +54,12 @@
     "agent-tempo": "dist/cli.js",
     "agent-tempo-server": "dist/server.js"
   },
+  "pi": {
+    "extensions": [
+      "./dist/pi/extension.js",
+      "./dist/pi/mission-control/extension.js"
+    ]
+  },
   "scripts": {
     "build": "tsc && npm run build:scripts && npm run build:dashboard && node -e \"const{bundleWorkflowCode}=require('@temporalio/worker');const path=require('path');const fs=require('fs');bundleWorkflowCode({workflowsPath:path.resolve('dist/workflows/index.js')}).then(b=>{fs.writeFileSync('workflow-bundle.js',b.code);console.log('Workflow bundle created')})\"",
     "build:scripts": "tsc -p scripts/tsconfig.json",