agent-tempo 1.7.0 → 2.0.0-beta.1

package/dist/http/auth.d.ts

@@ -50,44 +50,26 @@ export declare function extractBearerToken(authHeader: string | undefined): stri
  * reading "constant-time" doesn't assume length is also blinded.
  */
 export declare function tokensMatch(received: string, expected: string): boolean;
-/**
- * @deprecated 3e — superseded by {@link loadRbacTokens} (read + admin split).
- * Kept only until every caller migrates; do NOT add new callers. Resolves the
- * legacy single `httpToken` (env-less) for back-compat shims.
- */
-export declare function loadOrGenerateHttpToken(opts: {
-    bearerRequired: boolean;
-    load?: () => PersistedConfig;
-    save?: (cfg: PersistedConfig) => void;
-}): string | null;
 /** Resolved RBAC tokens for the daemon HTTP surface (3e). */
 export interface RbacTokens {
     /** T1 read token (env > config.json > auto-gen), or `null` when none + not required. */
     readToken: string | null;
     /** T1+T2+T3 admin token — ENV-VAR-ONLY, or `null` when unset (→ 503 on T≥2). */
     adminToken: string | null;
-    /**
-     * True when a LEGACY `httpToken` (no `readToken`) was adopted as the read token.
-     * The daemon emits a one-time startup warning so the operator sets an admin token.
-     */
-    legacyMigrated: boolean;
 }
 /** Admin token — ENV-VAR-ONLY (never config.json/disk, never auto-generated). */
 export declare function loadAdminToken(env?: NodeJS.ProcessEnv): string | null;
 /**
  * Read token (T1). Priority: env `AGENT_TEMPO_HTTP_READ_TOKEN` > config.json
- * `readToken` > LEGACY config.json `httpToken` (adopted → `legacy:true`) >
- * auto-generate when bearer mode is required (persisted as `readToken`).
+ * `readToken` > auto-generate when bearer mode is required (persisted as
+ * `readToken`).
  */
 export declare function loadReadToken(opts: {
     bearerRequired: boolean;
     env?: NodeJS.ProcessEnv;
     load?: () => PersistedConfig;
     save?: (cfg: PersistedConfig) => void;
-}): {
-    token: string | null;
-    legacy: boolean;
-};
+}): string | null;
 /** Load both RBAC tokens. The daemon calls this once at startup. */
 export declare function loadRbacTokens(opts: {
     bearerRequired: boolean;

package/dist/http/auth.js

@@ -38,7 +38,6 @@ exports.originHost = originHost;
 exports.bearerRequired = bearerRequired;
 exports.extractBearerToken = extractBearerToken;
 exports.tokensMatch = tokensMatch;
-exports.loadOrGenerateHttpToken = loadOrGenerateHttpToken;
 exports.loadAdminToken = loadAdminToken;
 exports.loadReadToken = loadReadToken;
 exports.loadRbacTokens = loadRbacTokens;
@@ -63,9 +62,10 @@ exports.requireTier = requireTier;
  * by reverse proxies, supervisord, and the TUI bootstrap state machine.
  *
  * **Token storage** (§3.1) — `~/.agent-tempo/config.json` field
- * `httpToken`. Auto-generated on first daemon boot when bearer mode is
+ * `readToken` (T1). Auto-generated on first daemon boot when bearer mode is
  * required and no token is set: `crypto.randomBytes(32).toString('base64url')`,
  * 0600 on POSIX. Rotation = delete the field; next daemon boot regenerates.
+ * The admin token (T2/T3) is env-var-only (`AGENT_TEMPO_HTTP_ADMIN_TOKEN`).
  */
 const crypto = __importStar(require("crypto"));
 const config_1 = require("../config");
@@ -156,24 +156,6 @@ function tokensMatch(received, expected) {
     const b = Buffer.from(expected, 'utf8');
     return crypto.timingSafeEqual(a, b);
 }
-/**
- * @deprecated 3e — superseded by {@link loadRbacTokens} (read + admin split).
- * Kept only until every caller migrates; do NOT add new callers. Resolves the
- * legacy single `httpToken` (env-less) for back-compat shims.
- */
-function loadOrGenerateHttpToken(opts) {
-    const load = opts.load ?? config_1.loadConfigFile;
-    const save = opts.save ?? config_1.saveConfigFile;
-    const cfg = load();
-    if (cfg.httpToken && typeof cfg.httpToken === 'string' && cfg.httpToken.length > 0) {
-        return cfg.httpToken;
-    }
-    if (!opts.bearerRequired)
-        return null;
-    const token = crypto.randomBytes(32).toString('base64url');
-    save({ ...cfg, httpToken: token });
-    return token;
-}
 /** Admin token — ENV-VAR-ONLY (never config.json/disk, never auto-generated). */
 function loadAdminToken(env = process.env) {
     const t = env[config_1.ENV.HTTP_ADMIN_TOKEN];
@@ -181,8 +163,8 @@ function loadAdminToken(env = process.env) {
 }
 /**
  * Read token (T1). Priority: env `AGENT_TEMPO_HTTP_READ_TOKEN` > config.json
- * `readToken` > LEGACY config.json `httpToken` (adopted → `legacy:true`) >
- * auto-generate when bearer mode is required (persisted as `readToken`).
+ * `readToken` > auto-generate when bearer mode is required (persisted as
+ * `readToken`).
  */
 function loadReadToken(opts) {
     const env = opts.env ?? process.env;
@@ -190,24 +172,21 @@ function loadReadToken(opts) {
     const save = opts.save ?? config_1.saveConfigFile;
     const envTok = env[config_1.ENV.HTTP_READ_TOKEN];
     if (envTok && envTok.length > 0)
-        return { token: envTok, legacy: false };
+        return envTok;
     const cfg = load();
     if (cfg.readToken && cfg.readToken.length > 0)
-        return { token: cfg.readToken, legacy: false };
-    // LEGACY: a pre-3e single `httpToken` becomes the READ token (T1) — NOT admin.
-    if (cfg.httpToken && cfg.httpToken.length > 0)
-        return { token: cfg.httpToken, legacy: true };
+        return cfg.readToken;
     if (!opts.bearerRequired)
-        return { token: null, legacy: false };
+        return null;
     const token = crypto.randomBytes(32).toString('base64url');
     save({ ...cfg, readToken: token });
-    return { token, legacy: false };
+    return token;
 }
 /** Load both RBAC tokens. The daemon calls this once at startup. */
 function loadRbacTokens(opts) {
-    const { token: readToken, legacy } = loadReadToken(opts);
+    const readToken = loadReadToken(opts);
     const adminToken = loadAdminToken(opts.env);
-    return { readToken, adminToken, legacyMigrated: legacy };
+    return { readToken, adminToken };
 }
 /**
  * Granted tier for a presented bearer, given the RBAC tokens (timing-safe).

package/dist/http/event-types.d.ts

@@ -242,10 +242,11 @@ export type EventIdToken = string;
  *   - `'stale'` — matches a host with `freshness === 'stale'`
  *   - `'missing'` — `preferredHost` is null OR no matching host record
  *
- * `migrateCommand` is the TUI slash-command the operator pastes into their
- * own session on the migrate target. `--yes-steal=` (NOT
- * `--confirm-steal-from-host`) is the actual flag accepted by
- * `src/tui/commands.ts:handleMigrate`. When `preferredHost` is null the
+ * `migrateCommand` is the `/migrate` slash-command the operator pastes into
+ * their own session on the migrate target (the command-center board; the Ink
+ * TUI that originally handled it was removed in #789). `--yes-steal=` (NOT
+ * `--confirm-steal-from-host`) is the actual flag the `/migrate` handler
+ * accepts. When `preferredHost` is null the
  * command targets the local host and includes the steal guard pre-filled
  * with the last-known host (or a literal `'(unknown)'` when even that is
  * missing — the operator must edit it before submit).

package/dist/http/orphans.d.ts

@@ -30,9 +30,9 @@ import type { TempoClient } from '../client/interface';
 import type { HostInfo } from '../types';
 import type { OrphanCandidate } from '../reconcile/orphans';
 /**
- * Render the TUI `/migrate` slash command the operator pastes into their
- * own session to recover an orphan. Wording mirrors
- * `src/tui/commands.ts:handleMigrate` exactly:
+ * Render the `/migrate` slash command the operator pastes into their own
+ * session to recover an orphan (the command-center board; the Ink TUI that
+ * originally handled it was removed in #789). Wording:
  *   - positional `<playerId> <host>`
  *   - flag form `--yes-steal=<currentHost>` (NOT `--confirm-steal-from-host`)
  *

package/dist/http/orphans.js

@@ -6,9 +6,9 @@ exports.buildOrphansResponse = buildOrphansResponse;
 exports.handleOrphans = handleOrphans;
 const responses_1 = require("./responses");
 /**
- * Render the TUI `/migrate` slash command the operator pastes into their
- * own session to recover an orphan. Wording mirrors
- * `src/tui/commands.ts:handleMigrate` exactly:
+ * Render the `/migrate` slash command the operator pastes into their own
+ * session to recover an orphan (the command-center board; the Ink TUI that
+ * originally handled it was removed in #789). Wording:
  *   - positional `<playerId> <host>`
  *   - flag form `--yes-steal=<currentHost>` (NOT `--confirm-steal-from-host`)
  *

package/dist/http/server.d.ts

@@ -61,11 +61,6 @@ export interface HttpServerOptions {
      * don't fight production daemons running on the same machine.
      */
     portFilePath?: string;
-    /**
-     * @deprecated 3e — back-compat alias for {@link readToken}. A single injected
-     * bearer is treated as the READ token (T1). Prefer `readToken`/`adminToken`.
-     */
-    httpToken?: string;
     /** 3e — inject the read-tier (T1) token directly (tests). Overrides config/env. */
     readToken?: string;
     /** 3e — inject the admin (T1+T2+T3) token directly (tests). Overrides env. */

package/dist/http/server.js

@@ -103,42 +103,22 @@ async function startHttpServer(opts) {
     // generation now so the daemon doesn't crash mid-request when the first
     // bearer-required call shows up.
     const bindIsLoopback = (0, auth_1.isLoopbackBindAddr)(bindAddr);
-    // 3e RBAC token resolution. Back-compat: a single `httpToken` option (or a
-    // legacy config.json `httpToken`) is adopted as the READ token (T1); the ADMIN
-    // token is env-var-only. Explicit `readToken`/`adminToken` options override
-    // (used by tests). loopback bind ⇒ no bearer required ⇒ tokens may be null.
-    let readToken;
-    let legacyMigrated = false;
-    if (opts.readToken !== undefined) {
-        readToken = opts.readToken;
-    }
-    else if (opts.httpToken !== undefined) {
-        // Back-compat: a single injected bearer is treated as the READ token (T1).
-        readToken = opts.httpToken;
-    }
-    else {
-        const loaded = (0, auth_1.loadReadToken)({ bearerRequired: !bindIsLoopback });
-        readToken = loaded.token;
-        legacyMigrated = loaded.legacy;
-    }
+    // 3e RBAC token resolution. The READ token (T1) comes from the explicit
+    // `readToken` option (tests) or env/config/auto-gen; the ADMIN token is
+    // env-var-only. loopback bind ⇒ no bearer required ⇒ tokens may be null.
+    const readToken = opts.readToken !== undefined
+        ? opts.readToken
+        : (0, auth_1.loadReadToken)({ bearerRequired: !bindIsLoopback });
     const adminToken = opts.adminToken ?? (0, auth_1.loadAdminToken)();
     if (!bindIsLoopback && !readToken) {
         throw new Error('Bearer token required for non-loopback bind but none configured. ' +
             'Set AGENT_TEMPO_HTTP_READ_TOKEN (or readToken in ~/.agent-tempo/config.json), ' +
             'or unset AGENT_TEMPO_HTTP_BIND.');
     }
-    // 3e MD-E — one-time startup warnings (non-blocking).
+    // 3e MD-E — one-time startup warning (non-blocking).
     //
-    // (1) Legacy migration: a pre-3e single `httpToken` was adopted as the READ
-    //     token (T1) and no admin token is configured, so writes / inner-tail
-    //     (all Tier ≥ 2) will 503 until an admin token is set.
-    if (legacyMigrated && adminToken === null) {
-        log('NOTICE: adopted legacy config.json `httpToken` as the read-tier token. ' +
-            'Writes and the inner-tail are admin-only and will return ' +
-            '503 until you set AGENT_TEMPO_HTTP_ADMIN_TOKEN (env-var only).');
-    }
-    // (2) Plaintext-bearer exposure: binding to a non-loopback address serves the
-    //     bearer token over cleartext HTTP. Suppressible, never blocking.
+    // Plaintext-bearer exposure: binding to a non-loopback address serves the
+    // bearer token over cleartext HTTP. Suppressible, never blocking.
     if (!bindIsLoopback && process.env[config_1.ENV.TLS_ACKNOWLEDGED] !== '1') {
         log(`WARNING: binding to non-loopback ${bindAddr} serves the bearer token over ` +
             'plaintext HTTP. Terminate TLS at a reverse proxy, or tunnel via SSH/Tailscale. ' +
@@ -433,6 +413,37 @@ async function handle(req, res, ctx) {
         }
         return (0, coat_check_1.handleCoatCheckGet)(res, ctx.client, ensemble, ticket);
     }
+    // #742 — per-player attachment-info read (`/attachment-info` board command).
+    // 2-segment GET; MUST be matched BEFORE the generic writeMatch below, which
+    // would otherwise 404 `attachment-info` as an unknown write action. The
+    // player is a `?playerId=` query param (the path stays ensemble-scoped).
+    const attachmentInfoMatch = pathname.match(/^\/v1\/ensembles\/([^/]+)\/attachment-info$/);
+    if (attachmentInfoMatch) {
+        const ensemble = decodeURIComponent(attachmentInfoMatch[1]);
+        if (!gateTier(1))
+            return; // L3 — read (Tier 1).
+        if (method !== 'GET') {
+            return (0, responses_1.errorResponse)(res, 405, { error: 'method-not-allowed' }, { Allow: 'GET, OPTIONS' });
+        }
+        const playerId = url.searchParams.get('playerId');
+        if (!playerId)
+            return (0, responses_1.errorResponse)(res, 400, { error: 'missing-field', field: 'playerId' });
+        return handleAttachmentInfo(res, ctx, ensemble, playerId);
+    }
+    // #742 — active-schedule listing (`/schedule list` board command). 2-segment
+    // GET; same ordering rationale as attachment-info (precede writeMatch). The
+    // schedule WRITE path is the `unschedule` write action below + the MCP
+    // `schedule` tool for create (no thin-shim create method on the client).
+    const schedulesMatch = pathname.match(/^\/v1\/ensembles\/([^/]+)\/schedules$/);
+    if (schedulesMatch) {
+        const ensemble = decodeURIComponent(schedulesMatch[1]);
+        if (!gateTier(1))
+            return; // L3 — read (Tier 1).
+        if (method !== 'GET') {
+            return (0, responses_1.errorResponse)(res, 405, { error: 'method-not-allowed' }, { Allow: 'GET, OPTIONS' });
+        }
+        return handleSchedules(res, ctx, ensemble);
+    }
     // Write surface (PR-7a of #340) — POST `/v1/ensembles/:ensemble/<action>`
     // Match BEFORE the GET-only method gate; everything else (POST to a
     // read endpoint, GET to a write endpoint) flows into the 405 fallback
@@ -718,6 +729,35 @@ async function handleHosts(res, ctx) {
     const hosts = await ctx.client.listHosts();
     (0, responses_1.jsonResponse)(res, 200, hosts);
 }
+/**
+ * #742 — a player's V2 attachment-lifecycle snapshot. Thin shim over
+ * `client.attachmentInfo`; the command-center `/attachment-info` board command
+ * renders the payload via the shared `formatAttachmentInfoForDisplay`. A 404 is
+ * surfaced when the player's session can't be resolved (it throws "No session
+ * found …", mirroring the recall not-found contract).
+ */
+async function handleAttachmentInfo(res, ctx, ensemble, playerId) {
+    try {
+        const info = await ctx.client.attachmentInfo(ensemble, playerId);
+        (0, responses_1.jsonResponse)(res, 200, info);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (/no session found|not found/i.test(message)) {
+            return (0, responses_1.errorResponse)(res, 404, { error: 'session-not-found', ensemble, playerId, detail: message });
+        }
+        throw err;
+    }
+}
+/**
+ * #742 — active-schedule listing. Thin shim over `client.getSchedules` (which
+ * already degrades to `[]` when no scheduler is running). The command-center
+ * `/schedule [list]` board command renders the entries.
+ */
+async function handleSchedules(res, ctx, ensemble) {
+    const schedules = await ctx.client.getSchedules(ensemble);
+    (0, responses_1.jsonResponse)(res, 200, schedules);
+}
 /**
  * #753 — daemon-process per-source Temporal action counters. Pure in-memory
  * read (zero Temporal calls); adapter and Pi processes self-report via their

package/dist/http/writes.d.ts

@@ -42,7 +42,7 @@ export { WRITE_BODY_MAX };
  *   mutations. Bodies are uniform `{ playerId, reason? }` (plus per-action
  *   extras); the ensemble lives in the URL.
  */
-export declare const WRITE_ACTIONS: readonly ["cue", "pause", "play", "release", "recruit", "restart", "reset", "destroy", "detach", "recall", "shutdown"];
+export declare const WRITE_ACTIONS: readonly ["cue", "pause", "play", "release", "recruit", "restart", "reset", "destroy", "detach", "recall", "unschedule", "shutdown"];
 export type WriteAction = (typeof WRITE_ACTIONS)[number];
 /** Type guard — narrows an arbitrary string to a known `WriteAction`. */
 export declare function isWriteAction(s: string): s is WriteAction;

package/dist/http/writes.js

@@ -31,6 +31,7 @@ exports.WRITE_ACTIONS = [
     'destroy',
     'detach',
     'recall',
+    'unschedule',
     'shutdown',
 ];
 /** Type guard — narrows an arbitrary string to a known `WriteAction`. */
@@ -69,6 +70,7 @@ async function handleWriteRoute(req, res, client, ensemble, action) {
             case 'destroy': return await handleDestroy(res, client, ensemble, body);
             case 'detach': return await handleDetach(res, client, ensemble, body);
             case 'recall': return await handleRecall(res, client, ensemble, body);
+            case 'unschedule': return await handleUnschedule(res, client, ensemble, body);
             case 'shutdown': return await handleShutdown(res, client, ensemble, body);
         }
     }
@@ -242,12 +244,33 @@ async function handleRecall(res, client, ensemble, body) {
     // The dashboard's `RecallResult` consumer expects a count, not the raw
     // arrays — projecting `received` + `sent` lengths here keeps the wire
     // payload tight and avoids leaking inbox + sent-history shape into the
-    // browser-side type. Callers wanting the full timeline use the MCP
-    // `recall` tool / TempoClient method directly.
+    // browser-side type. Callers wanting the full timeline pass `{ full: true }`
+    // (the command-center `/recall` board command, #742) or use the MCP `recall`
+    // tool / TempoClient method directly.
     const result = await client.recall(ensemble, playerId);
+    if (body.full === true) {
+        // Full timeline — the operator board feeds this through the shared
+        // `buildTimeline`/`formatRecall` helpers, same as the MCP tool. Kept behind
+        // an opt-in flag so the count-only default stays the dashboard's shape.
+        return (0, responses_1.jsonResponse)(res, 200, { ok: true, ensemble, playerId, received: result.received, sent: result.sent });
+    }
     const messages = result.received.length + result.sent.length;
     (0, responses_1.jsonResponse)(res, 200, { ok: true, ensemble, playerId, messages });
 }
+/**
+ * Cancel a named schedule (#742 — the command-center `/unschedule` &
+ * `/schedule delete`). Thin shim over `client.cancelSchedule`. Body is
+ * `{ name }` (the schedule key), distinct from the per-player `{ playerId }`
+ * shape — schedules are ensemble-scoped, keyed by name. 200 (the cancel IS
+ * the operation, not a queued effect).
+ */
+async function handleUnschedule(res, client, ensemble, body) {
+    const name = (0, body_1.stringField)(body, 'name');
+    if (!name)
+        return (0, responses_1.errorResponse)(res, 400, { error: 'missing-field', field: 'name' });
+    await client.cancelSchedule(ensemble, name);
+    (0, responses_1.jsonResponse)(res, 200, { ok: true, ensemble, name });
+}
 /**
  * Ensemble teardown (#700 P1) — the HTTP verb the command-center `/ensemble-down`
  * needs (the CLI `down` + the `shutdown` MCP tool cover this, but neither was

package/dist/palette/index.d.ts

@@ -1,14 +1,13 @@
 /**
  * Pure palette-input classification + filtering helpers.
  *
- * Shared between the TUI (`src/tui/commands.ts`) and the dashboard
- * (`dashboard/src/components/chat/`) so the two surfaces' chat-input
- * autocomplete machinery stays in lockstep — same prefix detection,
- * same filtering semantics, same quote-aware tokenizer.
+ * Used by the dashboard (`dashboard/src/components/chat/`) chat-input
+ * autocomplete machinery — prefix detection, filtering semantics, and the
+ * quote-aware tokenizer.
  *
- * Extracted from `src/tui/commands.ts` in #471/#472 (dashboard chat-input
- * TUI parity bundle). The TUI re-exports every symbol from here so existing
- * callers see no behaviour change. The dashboard imports directly from
+ * Originally extracted from the former `src/tui/commands.ts` in #471/#472
+ * (dashboard ↔ TUI parity bundle); the Ink TUI was deleted in #789, so the
+ * dashboard is now the sole consumer. The dashboard imports directly from
  * `agent-tempo/palette` (Vite alias `agent-tempo` → `../src`).
  *
  * **No imports allowed.** Keep this module dependency-free so it

package/dist/palette/index.js

@@ -2,14 +2,13 @@
 /**
  * Pure palette-input classification + filtering helpers.
  *
- * Shared between the TUI (`src/tui/commands.ts`) and the dashboard
- * (`dashboard/src/components/chat/`) so the two surfaces' chat-input
- * autocomplete machinery stays in lockstep — same prefix detection,
- * same filtering semantics, same quote-aware tokenizer.
+ * Used by the dashboard (`dashboard/src/components/chat/`) chat-input
+ * autocomplete machinery — prefix detection, filtering semantics, and the
+ * quote-aware tokenizer.
  *
- * Extracted from `src/tui/commands.ts` in #471/#472 (dashboard chat-input
- * TUI parity bundle). The TUI re-exports every symbol from here so existing
- * callers see no behaviour change. The dashboard imports directly from
+ * Originally extracted from the former `src/tui/commands.ts` in #471/#472
+ * (dashboard ↔ TUI parity bundle); the Ink TUI was deleted in #789, so the
+ * dashboard is now the sole consumer. The dashboard imports directly from
  * `agent-tempo/palette` (Vite alias `agent-tempo` → `../src`).
  *
  * **No imports allowed.** Keep this module dependency-free so it

package/dist/pi/mission-control/actions.d.ts

@@ -1,4 +1,4 @@
-import type { AnswerEntry } from '../../types';
+import type { AnswerEntry, HostInfo, AttachmentInfo, ScheduleEntry, Message, SentMessage } from '../../types';
 import type { EnsembleSummary } from '../../client/interface';
 /** Env var holding the daemon admin (T3) token (writes + inner tail). */
 export declare const ADMIN_TOKEN_ENV = "AGENT_TEMPO_HTTP_ADMIN_TOKEN";
@@ -104,9 +104,75 @@ export declare class MissionControlActions {
         ok: false;
         error: string;
     }>;
+    /**
+     * List connected hosts (`GET /v1/hosts`, Tier-1 read) — the cluster host
+     * registry + freshness + capability profile, the same payload the dashboard
+     * `/hosts` view and the CLI `agent-tempo hosts` consume. NOT ensemble-scoped
+     * (the host registry is cluster-global), so it ignores the bound ensemble.
+     */
+    listHosts(): Promise<{
+        ok: true;
+        hosts: HostInfo[];
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /**
+     * A player's V2 attachment-lifecycle snapshot (`GET /v1/ensembles/:e/attachment-info`,
+     * Tier-1 read). Thin shim over `client.attachmentInfo` — the same payload the
+     * MCP `attachment_info` tool and CLI `attachment-info` render via the shared
+     * `formatAttachmentInfoForDisplay`. The player is a `?playerId=` query param.
+     */
+    attachmentInfo(playerId: string): Promise<{
+        ok: true;
+        info: AttachmentInfo;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /**
+     * A player's full message timeline (received + sent). Hits the existing
+     * `POST /v1/ensembles/:e/recall` route with `{ full: true }` so the daemon
+     * returns the raw `{ received, sent }` arrays (the default count-only shape
+     * stays for the dashboard). Thin shim over `client.recall`; the caller feeds
+     * the result through the shared `buildTimeline`/`formatRecall` helpers. POST
+     * (not GET) because recall groups with the per-player action surface (T2).
+     */
+    recall(playerId: string): Promise<{
+        ok: true;
+        received: Message[];
+        sent: SentMessage[];
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /**
+     * Active schedules for the bound ensemble (`GET /v1/ensembles/:e/schedules`,
+     * Tier-1 read). Thin shim over `client.getSchedules` — the same `ScheduleEntry[]`
+     * the MCP `schedules` tool and CLI render. Empty when no scheduler is running.
+     */
+    listSchedules(): Promise<{
+        ok: true;
+        schedules: ScheduleEntry[];
+    } | {
+        ok: false;
+        error: string;
+    }>;
     cue(to: string, message: string): Promise<ActionResult>;
     pause(): Promise<ActionResult>;
     play(release?: boolean): Promise<ActionResult>;
+    /**
+     * Free HELD players via the dedicated `POST /v1/ensembles/:e/release` route
+     * (#742 gap 8 — `/go`). Optional `playerId` releases ONE held player; omitted
+     * releases all held in the ensemble. Distinct from `play(release:true)`, which
+     * ALSO clears the PAUSE axis — `/go` frees holds without touching pause.
+     */
+    release(playerId?: string): Promise<ActionResult>;
+    /**
+     * Cancel a named schedule (`POST /v1/ensembles/:e/unschedule`, #742 gap —
+     * `/unschedule` & `/schedule delete`). Thin shim over `client.cancelSchedule`.
+     */
+    unschedule(name: string): Promise<ActionResult>;
     restart(playerId: string, reason?: string): Promise<ActionResult>;
     destroy(playerId: string, reason?: string): Promise<ActionResult>;
     reset(playerId: string, reason?: string): Promise<ActionResult>;

package/dist/pi/mission-control/actions.js

@@ -211,6 +211,51 @@ class MissionControlActions {
         const res = await this.getJson('/v1/ensembles');
         return res.ok ? { ok: true, ensembles: res.data } : res;
     }
+    // ── Read surface: hosts (#742 gap 5) ──
+    /**
+     * List connected hosts (`GET /v1/hosts`, Tier-1 read) — the cluster host
+     * registry + freshness + capability profile, the same payload the dashboard
+     * `/hosts` view and the CLI `agent-tempo hosts` consume. NOT ensemble-scoped
+     * (the host registry is cluster-global), so it ignores the bound ensemble.
+     */
+    async listHosts() {
+        const res = await this.getJson('/v1/hosts');
+        return res.ok ? { ok: true, hosts: res.data } : res;
+    }
+    // ── Read surface: attachment-info (#742 gap — /attachment-info) ──
+    /**
+     * A player's V2 attachment-lifecycle snapshot (`GET /v1/ensembles/:e/attachment-info`,
+     * Tier-1 read). Thin shim over `client.attachmentInfo` — the same payload the
+     * MCP `attachment_info` tool and CLI `attachment-info` render via the shared
+     * `formatAttachmentInfoForDisplay`. The player is a `?playerId=` query param.
+     */
+    async attachmentInfo(playerId) {
+        const res = await this.getJson(`/v1/ensembles/${this.ens()}/attachment-info?playerId=${encodeURIComponent(playerId)}`);
+        return res.ok ? { ok: true, info: res.data } : res;
+    }
+    // ── Read surface: recall (#742 gap — /recall) ──
+    /**
+     * A player's full message timeline (received + sent). Hits the existing
+     * `POST /v1/ensembles/:e/recall` route with `{ full: true }` so the daemon
+     * returns the raw `{ received, sent }` arrays (the default count-only shape
+     * stays for the dashboard). Thin shim over `client.recall`; the caller feeds
+     * the result through the shared `buildTimeline`/`formatRecall` helpers. POST
+     * (not GET) because recall groups with the per-player action surface (T2).
+     */
+    async recall(playerId) {
+        const res = await this.postJson(`/v1/ensembles/${this.ens()}/recall`, { playerId, full: true });
+        return res.ok ? { ok: true, received: res.data.received, sent: res.data.sent } : res;
+    }
+    // ── Read surface: schedules (#742 gap — /schedule list) ──
+    /**
+     * Active schedules for the bound ensemble (`GET /v1/ensembles/:e/schedules`,
+     * Tier-1 read). Thin shim over `client.getSchedules` — the same `ScheduleEntry[]`
+     * the MCP `schedules` tool and CLI render. Empty when no scheduler is running.
+     */
+    async listSchedules() {
+        const res = await this.getJson(`/v1/ensembles/${this.ens()}/schedules`);
+        return res.ok ? { ok: true, schedules: res.data } : res;
+    }
     // ── Ensemble write surface (T2) ──
     cue(to, message) {
         // #822 — parse the deliverability hint so the board warns on a detached/gone
@@ -223,6 +268,22 @@ class MissionControlActions {
     play(release) {
         return this.post(`/v1/ensembles/${this.ens()}/play`, release ? { release } : {});
     }
+    /**
+     * Free HELD players via the dedicated `POST /v1/ensembles/:e/release` route
+     * (#742 gap 8 — `/go`). Optional `playerId` releases ONE held player; omitted
+     * releases all held in the ensemble. Distinct from `play(release:true)`, which
+     * ALSO clears the PAUSE axis — `/go` frees holds without touching pause.
+     */
+    release(playerId) {
+        return this.post(`/v1/ensembles/${this.ens()}/release`, playerId ? { playerId } : {});
+    }
+    /**
+     * Cancel a named schedule (`POST /v1/ensembles/:e/unschedule`, #742 gap —
+     * `/unschedule` & `/schedule delete`). Thin shim over `client.cancelSchedule`.
+     */
+    unschedule(name) {
+        return this.post(`/v1/ensembles/${this.ens()}/unschedule`, { name });
+    }
     restart(playerId, reason) {
         return this.post(`/v1/ensembles/${this.ens()}/restart`, { playerId, ...(reason ? { reason } : {}) });
     }