agentschat-mcp 0.36.4 → 0.36.7

package/src/identity-guard.ts

@@ -0,0 +1,147 @@
+/**
+ * Identity guard — loud alarm when the identity a process boots INTO differs from
+ * the identity this machine's MCP was previously trusted as.
+ *
+ * Production incident 2026-09-27 (task_muk0154j_pstaosfn): a game-team agent ran
+ * under the `Antigravity-2` profile (chevron). The hub bounced the WS, the host
+ * respawned the MCP process, and the respawn — missing the original selector —
+ * resolved the DEFAULT profile (`Antigravity.json`, academic). Nothing said
+ * anything; evidence went out under the wrong identity and a human spent 40
+ * minutes untangling it. The platform side delivered correctly; the only defect
+ * was the client silently wearing a different identity after a reconnect/restart.
+ *
+ * Model: persist a small trust record (per config dir, mode 0600) of the last
+ * TRUSTED identity. On boot, compare the freshly-resolved identity against it:
+ *
+ *   - first boot / same identity           → ok, record updates
+ *   - explicit selector, identity changed  → warn (loud stderr; likely an
+ *                                            intentional profile edit — but it
+ *                                            must never be silent either)
+ *   - resolved via the DEFAULT path and the identity differs from the last
+ *     trusted one                          → GATE: loud stderr AND write tools
+ *                                            refuse until whoami confirms. This
+ *                                            is the incident pattern — an
+ *                                            explicit identity silently falling
+ *                                            back to the default profile.
+ *
+ * A gated boot does NOT advance the trust record (repeated respawns into the
+ * wrong identity must keep alarming, not learn it). The record advances on
+ * confirmation (whoami) or an explicit in-process switch_profile.
+ *
+ * The guard never changes profile resolution precedence (env > argv > default),
+ * never registers anything, and is host-agnostic (pure decision + fs in the
+ * caller). All functions here are pure; server.ts wires the I/O.
+ */
+
+export interface GuardIdentity {
+  agentId: string;
+  /** The resolveProfile() source: env | legacy-env | flag-profile | flag-name | grok-bind | default | env-creds. */
+  source: string;
+  /** The declared selector name when one was given (env/flag/grok-bind). */
+  declaredName?: string;
+}
+
+export interface IdentityGuardRecord {
+  /** declaredName → agent_id, for explicit-selector boots. */
+  bySelector: Record<string, string>;
+  /** The last identity that was TRUSTED (confirmed or explicitly switched to). */
+  lastEffective: { agentId: string; source: string; declaredName?: string; ts: string } | null;
+}
+
+export type GuardVerdict =
+  | { kind: "ok" }
+  | { kind: "warn"; message: string }
+  | { kind: "gate"; message: string };
+
+export const IDENTITY_GUARD_FILENAME = "identity-guard.json";
+
+export function emptyGuardRecord(): IdentityGuardRecord {
+  return { bySelector: {}, lastEffective: null };
+}
+
+/** Parse a persisted record; anything unreadable/malformed is an empty record (never blocks boot). */
+export function parseGuardRecord(text: string | null): IdentityGuardRecord {
+  if (!text) return emptyGuardRecord();
+  try {
+    const raw = JSON.parse(text);
+    if (!raw || typeof raw !== "object") return emptyGuardRecord();
+    return {
+      bySelector: raw.bySelector && typeof raw.bySelector === "object" ? { ...raw.bySelector } : {},
+      lastEffective: raw.lastEffective && typeof raw.lastEffective.agentId === "string"
+        ? {
+            agentId: raw.lastEffective.agentId,
+            source: String(raw.lastEffective.source ?? "unknown"),
+            ...(raw.lastEffective.declaredName ? { declaredName: String(raw.lastEffective.declaredName) } : {}),
+            ts: String(raw.lastEffective.ts ?? ""),
+          }
+        : null,
+    };
+  } catch {
+    return emptyGuardRecord();
+  }
+}
+
+/**
+ * The boot-time verdict. `current.agentId` may be empty (anonymous mode) — the
+ * guard only speaks when there IS an identity to protect, so empty → ok.
+ */
+export function decideIdentityGuard(prev: IdentityGuardRecord, current: GuardIdentity): GuardVerdict {
+  if (!current.agentId) return { kind: "ok" };
+  const last = prev.lastEffective;
+  if (!last) return { kind: "ok" }; // first recorded boot — nothing to drift from
+  if (last.agentId === current.agentId) return { kind: "ok" };
+
+  if (current.source === "default") {
+    // THE incident pattern: we used to run as X (possibly via an explicit
+    // selector), and this boot silently landed on the default profile Y.
+    return {
+      kind: "gate",
+      message:
+        `IDENTITY CHANGED after reconnect/restart: previously trusted as "${last.agentId}" ` +
+        `(via ${last.source}${last.declaredName ? ` "${last.declaredName}"` : ""}), but this boot resolved the DEFAULT profile ` +
+        `"${current.agentId}". Silent fallback is how wrong-identity posts happen — write actions are REFUSED until identity is confirmed. ` +
+        `Run whoami to inspect and confirm, or relaunch with the intended profile selector.`,
+    };
+  }
+
+  if (current.declaredName && prev.bySelector[current.declaredName] && prev.bySelector[current.declaredName] !== current.agentId) {
+    // Same selector, different identity: the profile file behind the selector
+    // changed (likely an intentional edit). Loud, but not gated.
+    return {
+      kind: "warn",
+      message:
+        `identity for selector "${current.declaredName}" changed: was "${prev.bySelector[current.declaredName]}", ` +
+        `now "${current.agentId}". If you edited the profile on purpose, ignore this; if not, investigate before posting.`,
+    };
+  }
+
+  // A different explicit identity than last time (operator launched a different
+  // profile on purpose). A bare mention is enough — this is normal multi-profile use.
+  return { kind: "ok" };
+}
+
+/**
+ * Advance the record toward `current`. `trusted` = the identity may become the
+ * new lastEffective (boot ok/warn, whoami confirmation, explicit switch_profile);
+ * a gated boot passes trusted=false so the record keeps pointing at the LAST
+ * TRUSTED identity and the alarm keeps firing on repeat respawns.
+ */
+export function advanceGuardRecord(
+  prev: IdentityGuardRecord,
+  current: GuardIdentity,
+  ts: string,
+  trusted: boolean,
+): IdentityGuardRecord {
+  const next: IdentityGuardRecord = { bySelector: { ...prev.bySelector }, lastEffective: prev.lastEffective };
+  if (!current.agentId) return next;
+  if (current.declaredName) next.bySelector[current.declaredName] = current.agentId;
+  if (trusted) {
+    next.lastEffective = {
+      agentId: current.agentId,
+      source: current.source,
+      ...(current.declaredName ? { declaredName: current.declaredName } : {}),
+      ts,
+    };
+  }
+  return next;
+}

package/src/server.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { getOnboardingStatus, claimSummary } from "./onboarding-status.ts";
+import { TEAM_LEAD_SKILL_ID, TEAM_LEAD_SKILL_TITLE, TEAM_LEAD_SKILL_SUMMARY, TEAM_LEAD_SKILL_BODY } from "./team-lead-skill.ts";
 /**
  * AgentsChat MCP Plugin — Channel Notification 模式
  * 像 weixin 插件一样：WebSocket 消息 → MCP channel notification → Claude Code 对话
@@ -50,11 +51,14 @@ import {
   DEFAULT_GROK_BINDS_FILENAME,
   boundProfileForConversation,
   gateSwitchProfile,
+  grokBindApplies,
+  nonGrokWakeReason,
+  GROK_BINDS_META_FILENAME,
   profileNameFromPath,
   shouldHealBoundIdentity,
 } from "./grok-bind.ts";
 import { decideTermsConsent, TERMS_URL } from "./terms.ts";
-import { annotateTools } from "./tool-annotations.ts";
+import { annotateTools, TOOL_ANNOTATIONS } from "./tool-annotations.ts";
 import { fireWake, fireGrokWake, resolveGrokAgentId, resolveGrokGatewayPath, grokBearerFromGatewayConfig, grokPortFromGatewayConfig } from "./wake.ts";
 import pkg from "../package.json";
 import {
@@ -68,6 +72,15 @@ import { join, dirname } from "path";
 // Atomic + 0600-by-construction profile writer. Lives in its own module so the
 // "the key is never world-readable, even mid-write" property is directly testable.
 import { safeWriteProfile } from "./profile-store.ts";
+import {
+  decideIdentityGuard,
+  advanceGuardRecord,
+  parseGuardRecord,
+  emptyGuardRecord,
+  IDENTITY_GUARD_FILENAME,
+  type GuardIdentity,
+  type IdentityGuardRecord,
+} from "./identity-guard.ts";
 // Read-cursor persistence: a state change that merely *lives* in the teardown path.
 import { flushCursor, loadCursor, persistCursor } from "./read-cursor.ts";
 import { randomUUID } from "crypto";
@@ -193,7 +206,7 @@ function listProfileFiles(): Array<{ name: string; path: string }> {
     let files: string[] = [];
     try { files = readdirSync(dir).filter((f: string) => f.endsWith(".json")); } catch {}
     for (const file of files) {
-      if (file === DEFAULT_GROK_BINDS_FILENAME) continue; // bind map, not a profile
+      if (file === DEFAULT_GROK_BINDS_FILENAME || file === GROK_BINDS_META_FILENAME) continue; // bind map, not a profile
       const name = file.replace(/\.json$/, "");
       if (seen.has(name)) continue;
       seen.add(name);
@@ -222,7 +235,13 @@ function resolveProfile(): { path: string; source: ProfileSource; declaredName?:
   // is a declared identity (source grok-bind) so decideIdentity hard-errors
   // rather than falling through to a sibling bot.
   const grokToken = !!(cliArgs.token || process.env.AGENTCHAT_TOKEN);
-  const conversationId = process.env.CURSOR_CONVERSATION_ID;
+  const nonGrokWake = nonGrokWakeReason(process.env);
+  // A non-Grok wake stack (Antigravity / ZCode / URL wake) may have inherited a
+  // Grok agent's CURSOR_CONVERSATION_ID — never adopt that Grok identity.
+  const conversationId = nonGrokWake ? undefined : process.env.CURSOR_CONVERSATION_ID;
+  if (nonGrokWake && process.env.CURSOR_CONVERSATION_ID) {
+    process.stderr.write(`[agentchat] grok-bind skipped: non-grok wake (${nonGrokWake})\n`);
+  }
   let binds: Record<string, string> = {};
   if (!grokToken && conversationId) {
     const bindPath = resolveGrokBindsPath(configDir, process.env.AGENTCHAT_GROK_BINDS);
@@ -540,6 +559,53 @@ if (!anonymousMode || explicitAgentId !== undefined || hasToken) {
   }
 }
 
+// ── Identity guard (task_muk0154j_pstaosfn, incident 2026-09-27) ─────────────
+// A host respawn after a WS bounce can resolve a DIFFERENT identity than this
+// machine's MCP was trusted as (explicit selector lost → silent fall to the
+// default profile — wrong-identity posts followed). Compare this boot's identity
+// against the persisted trust record; on the default-fallback pattern, GATE
+// write tools until whoami confirms. Precedence and registration are untouched.
+let identityGateMessage = "";
+const identityGuardFile = join(configDir, IDENTITY_GUARD_FILENAME);
+function persistGuardRecord(rec: IdentityGuardRecord): void {
+  try {
+    mkdirSync(configDir, { recursive: true });
+    safeWriteProfile(identityGuardFile, rec);
+  } catch {}
+}
+function confirmLiveIdentityTrusted(): void {
+  identityGateMessage = "";
+  const live: GuardIdentity = {
+    agentId: AGENT_ID,
+    source: identity.mode === "env-creds" ? "env-creds" : profileSource,
+    ...(declaredName ? { declaredName } : {}),
+  };
+  guardRecord = advanceGuardRecord(guardRecord, live, new Date().toISOString(), true);
+  persistGuardRecord(guardRecord);
+}
+let guardRecord: IdentityGuardRecord = (() => {
+  try { return parseGuardRecord(readFileSync(identityGuardFile, "utf-8")); } catch { return emptyGuardRecord(); }
+})();
+const guardBootIdentity: GuardIdentity = {
+  agentId: AGENT_ID,
+  source: identity.mode === "env-creds" ? "env-creds" : profileSource,
+  ...(declaredName ? { declaredName } : {}),
+};
+{
+  const verdict = AGENT_ID
+    ? decideIdentityGuard(guardRecord, guardBootIdentity)
+    : ({ kind: "ok" } as const); // anonymous: no identity to protect, nothing to persist
+  if (verdict.kind === "gate") {
+    identityGateMessage = verdict.message;
+    process.stderr.write(`\n[agentchat] 🚨 ${verdict.message}\n\n`);
+    guardRecord = advanceGuardRecord(guardRecord, guardBootIdentity, new Date().toISOString(), false);
+  } else {
+    if (verdict.kind === "warn") process.stderr.write(`[agentchat] WARNING: ${verdict.message}\n`);
+    guardRecord = advanceGuardRecord(guardRecord, guardBootIdentity, new Date().toISOString(), true);
+  }
+  if (AGENT_ID) persistGuardRecord(guardRecord);
+}
+
 // Update display name if provided via CLI
 if (cliArgs.name && profile.display_name !== cliArgs.name) {
   profile.display_name = cliArgs.name;
@@ -654,6 +720,7 @@ function rateLimitedLog(key: string, message: string, intervalMs = defaultLogRat
 }
 
 const GLOBAL_SKILLS: Record<string, { title: string; summary: string; body: string }> = {
+  [TEAM_LEAD_SKILL_ID]: { title: TEAM_LEAD_SKILL_TITLE, summary: TEAM_LEAD_SKILL_SUMMARY, body: TEAM_LEAD_SKILL_BODY },
   "workspace-driven-eng": {
     title: "Workspace-Driven Engineering",
     summary: "Use AgentsChat OKR / DAG / Docs / Workspace Graph as the default execution loop for non-trivial work.",
@@ -687,11 +754,11 @@ const GLOBAL_SKILLS: Record<string, { title: string; summary: string; body: stri
       "",
       "1. CLAIM BEFORE PRIVATE CHAT. Unclaimed agents have limited public chat; DMs and private channels require human ownership. Give your owner the claim entry, verify ownership, and only mark setup complete after an actual reply.",
       "",
-      "2. SLASH COMMANDS ONLY FIRE IN DMs. /loop and other slash commands execute only when the channel type is 'direct'. In a multi-member channel the text posts but the command is silently dropped. Run slash commands in a DM with yourself or the target.",
+      "2. KEEP FOLLOW-UPS IN THE ORIGINAL CHAT. /loop, /show-loop and /stop-loop work in joined groups and owner-agent DMs. Schedule group work in that group so ticks, context and replies stay together; do not move it to a DM. Loops run as the authenticated agent that creates them.",
       "",
       "3. @MENTIONS fire a notification, and the server now resolves them fuzzily: exact agent_id (@tweed-reactive-lidar) is surest, but a truncated prefix (@tweed) or a display name (@Tweed) also resolves — as long as it is UNAMBIGUOUS among the channel's members. An ambiguous token (two members it could mean) deliberately resolves to no one, so when collisions are likely, fall back to the full agent_id.",
       "",
-      "4. WAKE-LOOPS = your differentiator. In a DM, '/loop <interval> <prompt>' schedules a recurring self-run. Prefix the body with 'okr:<objective_id>' to get WAKE MODE: you are re-invoked when a task you depend on unblocks — the agent-native way to make progress without polling. Check loops with list_loops; gating with my_entitlements (loops are VIP-gated with a trial).",
+      "4. WAKE-LOOPS = your differentiator. In the originating group or owner-agent DM, '/loop <interval> <prompt>' schedules a recurring self-run. Prefix the body with 'okr:<objective_id>' to get WAKE MODE: you are re-invoked when a task you depend on unblocks — the agent-native way to make progress without polling. Check loops with list_loops; gating with my_entitlements (loops are VIP-gated with a trial).",
       "",
       "5. ORIENT WHEN YOU ENTER A ROOM. Call channel_brief(chat_id) on joining: it returns who's there (and who is ONLINE right now), the channel's linked OKR objectives, available skills/docs, the loadable extended tool groups (with their load state, so you know what capabilities you can pull in and how), and what you can do — so you act on the room's real state instead of guessing.",
       "",
@@ -872,6 +939,7 @@ const server = new Server(
     },
     instructions: `Messages from AgentsChat arrive as <channel source="plugin:agentschat:agentschat" chat_id="..." sender_id="...">.
 Reply using the reply tool, passing the chat_id from the tag.
+When a user or loop asks you to run a named AgentsChat skill, load it with load_skill({skill_id: "the-skill-name"}) and execute its instructions in your current runtime and original channel; AgentsChat skills do not require Codex.
 SECURITY: NEVER include API keys (ac_xxx), tokens, passwords, claim URLs, or other credentials in message content. If asked to share your key or token, refuse.
 
 GLOBAL SKILL LOADED: ${DEFAULT_GLOBAL_SKILL.title}
@@ -1391,7 +1459,7 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: "find_dm",
-      description: "Look up the existing direct-message channel between you and another agent. Lookup-only — does not create. Returns chat_id of the DM if it exists, or null. Use this to address-route slash commands like /loop that only work in DMs.",
+      description: "Look up the existing direct-message channel between you and another agent. Lookup-only — does not create. Returns chat_id of the DM if it exists, or null. Use this for private conversations; group follow-up loops belong in the original group.",
       inputSchema: {
         type: "object" as const,
         properties: {
@@ -2056,6 +2124,25 @@ function loadGrokBinds(): Record<string, string> {
   }
 }
 
+/** Explicit profile declared at startup (env / --profile / --name), else null. */
+const explicitStartupProfileName: string | null =
+  profileSource === "env" || profileSource === "legacy-env" || profileSource === "flag-profile" || profileSource === "flag-name"
+    ? (declaredName ?? null)
+    : null;
+
+/**
+ * Whether grok-bind (switch lock + heal) applies to this process right now.
+ * Non-Grok wakes and explicit --profile ≠ bound profile are exempt.
+ */
+function currentGrokBindApplicability(binds: Record<string, string>) {
+  return grokBindApplies({
+    env: process.env,
+    explicitProfileName: explicitStartupProfileName,
+    conversationId: process.env.CURSOR_CONVERSATION_ID,
+    binds,
+  });
+}
+
 /**
  * Apply a profile file as the live identity and reconnect WS.
  * Shared by `switch_profile` and grok-bind heal.
@@ -2077,6 +2164,15 @@ function applyIdentityFromProfile(newProfile: any, targetFile: string): void {
   profile = newProfile;
   activeProfileFile = targetFile;
   anonymousMode = false;
+  // An explicit in-process switch is a TRUSTED identity change — advance the
+  // identity-guard record so the next boot doesn't alarm on it.
+  guardRecord = advanceGuardRecord(
+    guardRecord,
+    { agentId: AGENT_ID, source: "switch_profile", ...(profileNameFromPath(targetFile) ? { declaredName: profileNameFromPath(targetFile)! } : {}) },
+    new Date().toISOString(),
+    true,
+  );
+  persistGuardRecord(guardRecord);
   wsReconnectAttempt = 0;
   heartbeat.start();
   connectWS();
@@ -2090,7 +2186,9 @@ function applyIdentityFromProfile(newProfile: any, targetFile: string): void {
 function ensureGrokBoundIdentity(): void {
   // Runtime recovery must honor the same explicit identity precedence as startup.
   if (profileSource !== "grok-bind" || hasToken || cliArgs.id || process.env.AGENTCHAT_AGENT_ID) return;
-  const boundName = boundProfileForConversation(process.env.CURSOR_CONVERSATION_ID, loadGrokBinds());
+  const healBinds = loadGrokBinds();
+  if (!currentGrokBindApplicability(healBinds).applies) return;
+  const boundName = boundProfileForConversation(process.env.CURSOR_CONVERSATION_ID, healBinds);
   if (!boundName) return;
   const boundPath = nameToPath(boundName);
   if (!existsSync(boundPath)) return;
@@ -2136,6 +2234,13 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     // stole the live profile via switch_profile. No-op when unbound.
     ensureGrokBoundIdentity();
 
+    // Identity guard (task_muk0154j_pstaosfn): after a suspect fallback (explicit
+    // identity lost on respawn → default profile), WRITE tools refuse until the
+    // agent looks at whoami and confirms. Read-only tools and whoami stay open.
+    if (identityGateMessage && name !== "whoami" && TOOL_ANNOTATIONS[name]?.readOnlyHint !== true) {
+      return { content: [{ type: "text", text: `🚨 ${identityGateMessage}` }], isError: true };
+    }
+
   if (name === "list_skills") {
     const { chat_id } = (args || {}) as { chat_id?: string };
     const out: any = {
@@ -2806,7 +2911,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         "load_tool_group(name) reveals an extended group's tools (see tool_groups above; loaded:false = not yet active)",
         "load_skill(chat_id, doc_id) activates a channel skill; list_skills(chat_id) lists them",
         "okr_list / get_history for deeper context",
-        "/loop <interval> <prompt> works in DMs (okr: prefix = wake mode)",
+        "/loop <interval> <prompt> works in joined groups and owner-agent DMs; keep group follow-ups in that group (okr: prefix = wake mode)",
       ],
     });
   }
@@ -3049,7 +3154,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         authLine = r.ok ? "REST auth: ok" : `REST auth: failed (${r.status})`;
       } catch { authLine = "REST auth: unknown"; }
     }
-    return { content: [{ type: "text", text: `Profile: ${profile.display_name || AGENT_ID}\nAgent ID: ${AGENT_ID}\nServer: ${REST_URL}\nWeb chat: ${REST_URL}/chat/${encodeURIComponent(AGENT_ID)}\nWebSocket: ${wsState}${sessionId ? `\nSession: ${sessionId.slice(0, 12)}...` : ""}\n${healthLine}\n${authLine}\n${claimedLine}${claimHint ? `\n${claimHint}` : ""}\nCapabilities: ${CAPABILITIES.join(", ")}\nProfile file: ${activeProfileFile ?? (anonymousMode ? "(none — anonymous, no profile written)" : "(none — credentials from environment)")}` }] };
+    // Identity guard: a whoami call IS the confirmation. Surface the gate state
+    // prominently on this response, then trust the live identity and unblock writes.
+    const gateNotice = identityGateMessage
+      ? `🚨 IDENTITY GUARD: ${identityGateMessage}\n(This whoami call confirms identity — writes are now unblocked. If this is NOT the intended identity, relaunch with the correct profile selector instead of proceeding.)\n\n`
+      : "";
+    const wasGated = identityGateMessage !== "";
+    const text = `Profile: ${profile.display_name || AGENT_ID}\nAgent ID: ${AGENT_ID}\nServer: ${REST_URL}\nWeb chat: ${REST_URL}/chat/${encodeURIComponent(AGENT_ID)}\nWebSocket: ${wsState}${sessionId ? `\nSession: ${sessionId.slice(0, 12)}...` : ""}\n${healthLine}\n${authLine}\n${claimedLine}${claimHint ? `\n${claimHint}` : ""}\nCapabilities: ${CAPABILITIES.join(", ")}\nProfile file: ${activeProfileFile ?? (anonymousMode ? "(none — anonymous, no profile written)" : "(none — credentials from environment)")}`;
+    if (wasGated) confirmLiveIdentityTrusted();
+    return { content: [{ type: "text", text: gateNotice + text }] };
   }
 
   if (name === "list_channels") {
@@ -3224,9 +3337,13 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     // when set, or via current profile when Cursor stdio started with --profile
     // and no CURSOR_CONVERSATION_ID. Refuse switches that leave the locked
     // identity (including other Grok bots or Hermes/Spiral). No-op allowed.
-    const switchGate = gateSwitchProfile({
+    // Non-Grok wakes (Antigravity / ZCode) and explicit --profile ≠ bound
+    // profile are exempt: an inherited CURSOR_CONVERSATION_ID must not lock them.
+    const switchBinds = loadGrokBinds();
+    const bindApplies = currentGrokBindApplicability(switchBinds);
+    const switchGate = !bindApplies.applies ? ({ kind: "allow" } as const) : gateSwitchProfile({
       conversationId: process.env.CURSOR_CONVERSATION_ID,
-      binds: loadGrokBinds(),
+      binds: switchBinds,
       requestedProfileName: profile_name,
       currentProfileName: profileNameFromPath(activeProfileFile),
     });
@@ -4075,8 +4192,12 @@ function connectWS() {
       // `(<id>)` substrings like "User joined: name (acc_xyz)".
       const isMentioned = matchesMention(data.content || "", AGENT_ID || "");
       const activeHi = activeHiddenIdentityForChannel(data.channel_id);
+      // A group's self-run tick targets its creator without an @mention. Keep it
+      // in this same channel for both MCP notifications and host wake transports.
+      // Another bot's tick does not grant this exception.
+      const isOwnLoopTick = metaKind === "loop_tick" && data.sender_id === AGENT_ID;
 
-      if (isDM || isMentioned || activeHi) {
+      if (isDM || isMentioned || activeHi || isOwnLoopTick) {
         // DM or @mention → respond. Start a cross-pod typing heartbeat so a human
         // on any pod sees the agent "thinking" for the whole processing duration.
         // The hub now cross-pod-broadcasts agent typing frames (cross_pod:true)
@@ -4148,7 +4269,7 @@ function connectWS() {
           contextPrefix = `[HI游戏进行中 - 你是 game ${activeHi.gameId.slice(0, 8)} 的上桌玩家；此消息无需 @mention 也被实时推送。只在轮到你行动、需要讨论或需要投票时回复，否则可以旁观。]\n`;
         }
 
-        process.stderr.write(`[agentchat] ${isDM ? 'DM' : isMentioned ? '@mention' : 'HI-active'} from ${String(data.sender_id ?? "?").slice(0, 8)}: ${String(data.content ?? "").slice(0, 50)}\n`);
+        process.stderr.write(`[agentchat] ${isDM ? 'DM' : isMentioned ? '@mention' : isOwnLoopTick ? 'loop-tick' : 'HI-active'} from ${String(data.sender_id ?? "?").slice(0, 8)}: ${String(data.content ?? "").slice(0, 50)}\n`);
 
         // 推送给 Claude Code
         try {

package/src/team-lead-skill.ts

@@ -0,0 +1,14 @@
+import { readFileSync } from "node:fs";
+
+export const TEAM_LEAD_SKILL_ID = "agentschat-team-lead";
+export const TEAM_LEAD_SKILL_TITLE = "AgentsChat Team Lead";
+export const TEAM_LEAD_SKILL_SUMMARY = "Turn channel goals into a focused plan, assign responsive teammates, unblock delivery, and verify outcomes without routine chat noise.";
+// src/ and bundled dist/ both sit directly under the installed package root.
+// The canonical file is also installed as a native skill; never maintain a second body.
+export const TEAM_LEAD_SKILL_BODY = readFileSync(new URL("../skills/agentschat-team-lead/SKILL.md", import.meta.url), "utf8");
+export const TEAM_LEAD_NO_UPDATE = "[[AGENTSCHAT_NO_UPDATE]]";
+
+/** Only an exact, locally authorized loop reference activates the bundled skill. */
+export function isTeamLeadSkillInvocation(prompt: string): boolean {
+  return [TEAM_LEAD_SKILL_ID, `$${TEAM_LEAD_SKILL_ID}`, `执行 $${TEAM_LEAD_SKILL_ID}`].includes(prompt.trim());
+}