aiterm-mcp 0.18.0 → 0.18.2

package/README.ja.md

@@ -24,7 +24,7 @@
 
 12 ツール: 6 つの **PTY ツール**（`pty_open` / `pty_send` / `pty_read` / `pty_key` / `pty_close` / `pty_list`）で 1 本の永続端末を開き・操作し・読む。加えて 4 つの **エージェント起動ツール**（`claude_agent` / `codex_agent` / `grok_agent` / `composer_agent`）が別のコーディングエージェントの TUI を新しい端末の中に起動し、`claude_turn`がdurable caller向けの構造化issue／recoveryを、`diagnostics`が安全なfactory readinessを返す。バックエンドは **tmux** なので、MCP サーバや AI クライアントが再起動してもセッションは生き残る。
 
-**v0.18.0 を 2026-07-18 に公開。** 実運用障害の還流による agent dispatch の hardening:
+**v0.18.1 を 2026-07-18 に公開**（0.18.0＋stale案内文言の修理1件）。実運用障害の還流による agent dispatch の hardening:
 全 dispatch／launch receipt に **submit 座礁観測** `submit_residue` を追加
 （送信 prompt が vendor TUI の composer に未 submit のまま残存していないかを有界に観測して報告する。
 陽性証拠のみ・auto-retry なし）。agent への prompt paste は tmux **bracketed paste**（pane ごとの

package/README.md

@@ -24,7 +24,8 @@
 
 Twelve tools: six **PTY tools** — `pty_open` / `pty_send` / `pty_read` / `pty_key` / `pty_close` / `pty_list` — to open, drive, and read one persistent terminal, four **agent launchers** — `claude_agent` / `codex_agent` / `grok_agent` / `composer_agent` — that each start another coding agent's TUI inside a fresh one, `claude_turn` for durable structured issue/recovery, and `diagnostics` for safe factory readiness. The backend is **tmux**, so sessions survive even if the MCP server or the AI client restarts.
 
-**v0.18.0 was published on 2026-07-18.** Field-failure hardening for agent
+**v0.18.1 was published on 2026-07-18** (v0.18.0 plus one stale-guidance
+message fix). Field-failure hardening for agent
 dispatch: every dispatch/launch receipt now carries a **submit-strand
 observation** `submit_residue` (a bounded screen poll that reports when the
 sent prompt is still sitting unsubmitted in the vendor TUI's composer —
@@ -96,6 +97,8 @@ One call per model, so the tool name itself tells you which model you get:
 
 The vendor CLI must be installed and authenticated (`claude` for `claude_agent`; `codex` for `codex_agent`; `grok` for both Grok tools). aiterm resolves the binary via `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN`, then `~/.local/bin/claude` / `~/.local/bin/codex` / `~/.grok/bin/grok`, then `PATH`. Prerequisites are checked **before** a session exists: empty `model` values and unsupported effort values are rejected up front; a missing CLI binary or a nonexistent `cwd` fails for all four. A rejected launch leaves **zero leftover session** behind. Claude and Codex launchers forward `model` and `reasoning_effort` through their vendor CLI's public flags; Grok/Composer reject `reasoning_effort` because it is headless-only. Pass an absolute path for `cwd` — `~` is not expanded. Durable callers can make a promptless Claude launch exactly replayable by passing an explicit `session_name` and a `launch_operation_id` formatted as `sha256:<64 lowercase hex>`. Repeating the identical launch returns the same structured session receipt without starting the CLI twice; a different correlation ID or launch argument for that session fails explicitly. Claude uses launch-local managed settings containing only aiterm's Stop hook: normal user/project/local hooks are not inherited, the hook event contains no answer body, and the bounded owner-only result is returned by `pty_read({ agent_transcript:true })` without reading Claude's private transcript. A late result remains recoverable from the same session without re-sending the prompt. Non-interrupt keys are rejected on the managed Claude route; use dispatch, `pty_key("C-c")`, and `pty_close` (`force:true` on `pty_send` is the manual-intervention escape). For unconstrained manual key-by-key driving, open a plain `pty_open` session and start the vendor CLI yourself. Codex uses a managed `CODEX_HOME`; Grok/Composer isolate their managed homes and pass validated OAuth state through `GROK_AUTH_PATH`. Before the first unbound dispatch, aiterm waits for the vendor TUI's input prompt and fails before sending if it is not ready. Managed completion requires POSIX filesystem semantics (Linux, WSL2, macOS).
 
+The managed Codex home links authentication, privately snapshots `config.toml` and `agents/*.toml` custom-role definitions, and keeps sessions/caches isolated. A symlinked role definition is resolved into a regular-file snapshot rather than shared with the source home.
+
 There is no hidden protocol between agents: a launched Claude, Codex, Grok, or Composer is another user-visible persistent terminal session. The MCP client drives that TUI with ordinary PTY operations, and a human can attach to watch or take over.
 
 ## Demo

package/dist/core.js

@@ -1505,6 +1505,40 @@ function managedCodexConfigSummary(configPath, hookTrustBypass) {
         bits.push("hook trust bypass 有効");
     return `managed config: ${bits.join(" / ")}`;
 }
+// Custom agent definitions are configuration, not mutable Codex state. Copy only direct
+// agents/*.toml entries into the per-launch home so role discovery matches the source home while
+// sessions/cache remain isolated. Source symlinks are resolved and their contents are snapshotted;
+// the managed home never points back to the source definition.
+function snapshotCodexAgentDefinitions(srcHome, managedHome) {
+    const srcDir = path.join(srcHome, "agents");
+    let srcDirSt;
+    try {
+        srcDirSt = fs.statSync(srcDir);
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return;
+        throw e;
+    }
+    if (!srcDirSt.isDirectory()) {
+        throw new AitermError(`Codex agents が directory ではありません: ${srcDir}`, 2);
+    }
+    const names = fs.readdirSync(srcDir).filter((name) => name.endsWith(".toml")).sort();
+    if (!names.length)
+        return;
+    const dstDir = path.join(managedHome, "agents");
+    fs.mkdirSync(dstDir, { mode: 0o700 });
+    fs.chmodSync(dstDir, 0o700);
+    for (const name of names) {
+        const src = path.join(srcDir, name);
+        const resolved = fs.realpathSync(src);
+        const st = fs.statSync(resolved);
+        if (!st.isFile()) {
+            throw new AitermError(`Codex agent definition が通常ファイルではありません: ${src}`, 2);
+        }
+        writeText0600(path.join(dstDir, name), fs.readFileSync(resolved, "utf8"));
+    }
+}
 function createManagedCodexHome(name, launchId, overrides = {}) {
     const srcHome = realCodexHome();
     let srcSt;
@@ -1549,6 +1583,7 @@ function createManagedCodexHome(name, launchId, overrides = {}) {
         fs.writeFileSync(configDst, configOut, { mode: 0o600 });
         fs.chmodSync(configDst, 0o600);
     }
+    snapshotCodexAgentDefinitions(srcHome, managedHome);
     const hookScript = codexHookScriptPath();
     if (!fs.existsSync(hookScript)) {
         throw new AitermError(`Codex Stop hook wrapper が見つかりません。npm run build を実行してください: ${hookScript}`, 2);
@@ -2108,7 +2143,7 @@ function loadAgentMetadata(name) {
         .readdirSync(dir)
         .filter((f) => f.startsWith(`${name}.`) && f.endsWith(".agent.json"));
     if (files.length === 0) {
-        throw new AitermError(`session '${name}' は agent_done 管理セッションではありません。codex_agent(agent_done:true) で起動してください。`, 2);
+        throw new AitermError(`session '${name}' は agent_done 管理セッションではありません。claude_agent／codex_agent 等の launcher で起動してください（launcher は常に managed）。`, 2);
     }
     if (files.length !== 1) {
         throw new AitermError(`session '${name}' の agent metadata が複数あります。閉じて起動し直してください。`, 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.18.0",
+  "version": "0.18.2",
   "mcpName": "io.github.kitepon-rgb/aiterm-mcp",
   "description": "AI-driven persistent terminal as a local stdio MCP server (tmux-backed). Holds one local PTY; SSH and containers are just commands you send into it. Also launches interactive Claude/Codex/Grok/Composer agent TUIs in a persistent terminal. Token-reducing reads.",
   "keywords": [