brainclaw 1.7.5 → 1.9.0

package/dist/core/agent-integrations.js

@@ -51,18 +51,15 @@ const DEFAULT_SURFACES = {
     ],
     'windsurf': [
         { kind: 'instructions', location: 'workspace', path: '.windsurfrules' },
-        { kind: 'hook', location: 'workspace', path: '.windsurfrules' },
         { kind: 'mcp', location: 'machine', path: '.codeium/windsurf/mcp_config.json' },
         { kind: 'rule', location: 'workspace', path: '.windsurf/rules/brainclaw.md' },
     ],
     'cline': [
         { kind: 'instructions', location: 'workspace', path: '.clinerules/brainclaw.md' },
-        { kind: 'hook', location: 'workspace', path: '.clinerules/brainclaw.md' },
         { kind: 'mcp', location: 'workspace', path: '.vscode/cline_mcp_settings.json' },
     ],
     'codex': [
         { kind: 'instructions', location: 'workspace', path: 'AGENTS.md' },
-        { kind: 'hook', location: 'workspace', path: 'AGENTS.md' },
         { kind: 'mcp', location: 'machine', path: '.codex/config.toml' },
         { kind: 'skill', location: 'workspace', path: '.agents/skills/brainclaw/SKILL.md' },
     ],

package/dist/core/agent-inventory.js

@@ -336,6 +336,51 @@ const AGENT_DEFINITIONS = [
         hooks_support: false,
         instruction_file: '.continue/rules/',
     },
+    {
+        name: 'openclaw',
+        detect: (home, env) => {
+            if (env.OPENCLAW_SESSION_ID || env.OPENCLAW_AGENT) {
+                return { installed: true, method: 'OPENCLAW_* env' };
+            }
+            if (fs.existsSync(path.join(home, '.openclaw'))) {
+                return { installed: true, method: '~/.openclaw directory' };
+            }
+            return { installed: false, method: '' };
+        },
+        models: [
+            { name: 'model-agnostic' },
+        ],
+        native_tools: ['shell', 'file_read', 'file_write', 'file_edit'],
+        mcp_support: true,
+        mcp_config_format: '~/.openclaw/mcp.json',
+        skills_support: false,
+        rules_support: false,
+        hooks_support: false,
+        instruction_file: 'AGENTS.md',
+    },
+    {
+        name: 'mistral-vibe',
+        detect: (home, env) => {
+            if (env.VIBE_HOME?.trim()) {
+                return { installed: true, method: 'VIBE_HOME env' };
+            }
+            if (fs.existsSync(path.join(home, '.vibe'))) {
+                return { installed: true, method: '~/.vibe directory' };
+            }
+            return { installed: false, method: '' };
+        },
+        models: [
+            { name: 'devstral', context_window: 256000 },
+            { name: 'mistral-large', context_window: 128000 },
+        ],
+        native_tools: ['shell', 'file_read', 'file_write', 'file_edit'],
+        mcp_support: true,
+        mcp_config_format: '~/.vibe/mcp.json',
+        skills_support: false,
+        rules_support: false,
+        hooks_support: false,
+        instruction_file: 'AGENTS.md',
+    },
     {
         name: 'hermes',
         detect: (home, env) => {
@@ -437,6 +482,28 @@ export function loadAgentInventory() {
         return undefined;
     }
 }
+/**
+ * Whether an agent is installed on this machine according to the saved
+ * inventory (the single source of truth for "installed" since the
+ * detection/inventory split — pln#562 step 1).
+ *
+ * Returns:
+ *  - true / false when the inventory tracks the agent
+ *  - undefined when no inventory exists yet or the agent is not tracked
+ *    (callers must NOT treat undefined as "not installed")
+ *
+ * The inventory never mints identity — this is a consultation helper for
+ * warning paths only.
+ */
+export function isAgentInstalledPerInventory(agentName, inventory = loadAgentInventory()) {
+    if (!inventory)
+        return undefined;
+    const normalized = agentName.trim().toLowerCase();
+    const entry = inventory.agents.find((a) => a.name === normalized);
+    if (!entry)
+        return undefined;
+    return entry.installed;
+}
 /**
  * Render a human-readable summary of the agent inventory.
  */

package/dist/core/agent-registry.js

@@ -2,7 +2,8 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { isKnownAgent, getCapabilityProfile } from './agent-capability.js';
+import { isKnownAgent, getCapabilityProfile, resolveAgentAlias } from './agent-capability.js';
+import { isAgentInstalledPerInventory } from './agent-inventory.js';
 import { detectAiAgent } from './ai-agent-detection.js';
 import { loadConfig, saveConfig } from './config.js';
 import { nowISO } from './ids.js';
@@ -10,6 +11,7 @@ import { MEMORY_DIR, memoryExists, resolveEntityDir } from './io.js';
 import { JsonStore } from './json-store.js';
 import { AgentIdentityDocumentSchema, } from './schema.js';
 import { logger } from './logger.js';
+import { isObserverMode } from './observer-mode.js';
 // agents/ stays at top level in entity model (already entity-aligned)
 const TRUST_ORDER = ['observer', 'contributor', 'trusted', 'curator'];
 export class AgentIdentityResolutionError extends Error {
@@ -55,8 +57,13 @@ function agentStore(cwd, preferredDirName) {
         sort: (a, b) => a.created_at.localeCompare(b.created_at) || a.agent_name.localeCompare(b.agent_name),
     });
 }
+/**
+ * Canonical agent name: lowercased, trimmed, and alias-resolved at the
+ * registry level (pln#562 step 2) — 'copilot' and 'github-copilot' are ONE
+ * identity, not two. All registry lookups and writes go through this.
+ */
 export function normalizeAgentName(agentName) {
-    return agentName.trim().toLowerCase();
+    return resolveAgentAlias(agentName.trim().toLowerCase());
 }
 function normalizeCapability(capability) {
     const normalized = capability.trim().toLowerCase();
@@ -86,9 +93,47 @@ function codexHome(env = process.env) {
     const explicit = env.CODEX_HOME?.trim();
     return explicit && explicit.length > 0 ? explicit : path.join(os.homedir(), '.codex');
 }
-function agentKeyPath(agentId, env = process.env) {
+/**
+ * ed25519 identity keys (pln#562 step 5).
+ *
+ * RESERVED for the federated identity model — these keys are not consumed by
+ * any verification path today; the identity proposal (origin signing)
+ * activates them. Do NOT delete them as debris.
+ *
+ * Private keys live under the NEUTRAL brainclaw home (~/.brainclaw/keys/),
+ * not under ~/.codex/: agent identity belongs to brainclaw, and parking
+ * private key material inside another vendor's config directory both
+ * misattributes it and exposes it to that vendor's tooling/sync.
+ */
+function agentKeyPath(agentId) {
+    return path.join(os.homedir(), MEMORY_DIR, 'keys', `${agentId}.ed25519.pem`);
+}
+/** Pre-step-5 location (inside CODEX_HOME) — read for one-time migration. */
+function legacyAgentKeyPath(agentId, env = process.env) {
     return path.join(codexHome(env), 'brainclaw', 'keys', `${agentId}.ed25519.pem`);
 }
+/**
+ * Move a key file from the legacy ~/.codex location to the neutral path.
+ * Best-effort: a failed unlink leaves a duplicate, never a missing key.
+ */
+function migrateLegacyAgentKey(agentId, env = process.env) {
+    const legacy = legacyAgentKeyPath(agentId, env);
+    const target = agentKeyPath(agentId);
+    if (fs.existsSync(target) || !fs.existsSync(legacy))
+        return;
+    try {
+        ensureParentDir(target);
+        fs.copyFileSync(legacy, target);
+        try {
+            fs.unlinkSync(legacy);
+        }
+        catch { /* duplicate is safe */ }
+        logger.debug(`Migrated agent identity key ${agentId} from ${legacy} to ${target}`);
+    }
+    catch (err) {
+        logger.debug('Failed to migrate legacy agent key:', err);
+    }
+}
 function ensureParentDir(filepath) {
     const dir = path.dirname(filepath);
     if (!fs.existsSync(dir)) {
@@ -99,7 +144,8 @@ function fingerprintPublicKey(publicKey) {
     return crypto.createHash('sha256').update(publicKey).digest('hex');
 }
 function buildIdentityKey(agentId, env = process.env, forceRegenerate = false) {
-    const filepath = agentKeyPath(agentId, env);
+    migrateLegacyAgentKey(agentId, env);
+    const filepath = agentKeyPath(agentId);
     const createdAt = nowISO();
     let publicKeyPem;
     if (!forceRegenerate && fs.existsSync(filepath)) {
@@ -152,6 +198,27 @@ export function findAgentIdentityById(agentId, cwd, preferredDirName) {
 export function registerAgentIdentity(input) {
     const normalizedCapabilities = normalizeCapabilities(input.capabilities);
     const existing = findAgentIdentityByName(input.agentName, input.cwd, input.preferredDirName);
+    // Observer mode (BRAINCLAW_OBSERVER=1) refuses to mint or mutate identity
+    // on the disk. A dashboard is not an agent — it must never auto-register
+    // (the 2026-06-10 leak where the VS Code extension impersonated whichever
+    // shell-parent agent VS Code was launched from). Return existing read-only,
+    // or a transient synthetic identity that callers can use without persisting.
+    if (isObserverMode()) {
+        if (existing)
+            return existing;
+        const normalizedNewName = normalizeAgentName(input.agentName);
+        return {
+            schema_version: 2,
+            version: 1,
+            agent_id: generateAgentId(),
+            agent_name: normalizedNewName,
+            created_at: nowISO(),
+            kind: input.kind ?? 'unknown',
+            trust_level: input.trustLevel ?? 'observer',
+            capabilities: normalizedCapabilities,
+            ...(input.contextProfile ? { context_profile: input.contextProfile } : {}),
+        };
+    }
     if (existing) {
         let updated = existing;
         if (input.kind && existing.kind !== input.kind) {
@@ -180,11 +247,22 @@ export function registerAgentIdentity(input) {
         }
         return updated;
     }
+    // Identity hardening (pln#562 step 1): a NEW identity claiming the name of
+    // an agent the inventory knows is NOT installed on this machine is suspect.
+    // Warn (the inventory is consultative) — it never blocks or mints identity.
+    const normalizedNewName = normalizeAgentName(input.agentName);
+    try {
+        if (isAgentInstalledPerInventory(normalizedNewName) === false) {
+            logger.warn(`Registering identity '${normalizedNewName}' but the agent inventory reports it is not installed on this machine. `
+                + 'Verify the claimed identity or refresh the inventory.');
+        }
+    }
+    catch { /* inventory consultation is best-effort */ }
     let created = {
         schema_version: 2,
         version: 1,
         agent_id: generateAgentId(),
-        agent_name: normalizeAgentName(input.agentName),
+        agent_name: normalizedNewName,
         created_at: nowISO(),
         kind: input.kind ?? 'unknown',
         trust_level: input.trustLevel ?? 'contributor',
@@ -212,34 +290,24 @@ export function resolveCurrentAgentIdentity(cwd, preferredDirName, homeDir) {
             return byEnvName;
     }
     // Auto-detect from native agent env vars (e.g. CLAUDECODE, CURSOR_TRACE_ID, CODEX_THREAD_ID).
-    // If detected agent is not registered, auto-register it as trusted agent.
     // This is the primary identification path for MCP servers and CLI hooks.
-    const detected = detectAiAgent(process.env, homeDir);
+    //
+    // pln#562 step 2 — registration is an EXPLICIT act (setup selection, session
+    // start, dispatcher spawn). Resolution is a read path and must never mint an
+    // identity as a side effect; a detected-but-unregistered agent resolves to
+    // undefined and the caller decides whether to register explicitly.
+    const detected = detectAiAgent(process.env);
     if (detected) {
         // If the detected name matches an explicit env var that was already tried
-        // and not found, don't auto-register — the caller expects a "not registered" error.
+        // and not found, the caller expects a "not registered" error.
         if (normalizeAgentName(detected.name) === normalizeAgentName(envAgentName)) {
             return undefined;
         }
         const byDetected = findAgentIdentityByName(detected.name, cwd, preferredDirName);
         if (byDetected)
             return byDetected;
-        // Auto-register detected agent so it's immediately usable.
-        // This avoids the "not registered" error for agents detected for the first time.
-        try {
-            const autoRegistered = registerAgentIdentity({
-                agentName: normalizeAgentName(detected.name),
-                kind: detected.kind,
-                trustLevel: detected.trust_level,
-                cwd,
-                preferredDirName,
-            });
-            logger.debug(`Auto-registered detected agent: ${detected.name} (${autoRegistered.agent_id})`);
-            return autoRegistered;
-        }
-        catch {
-            // Non-fatal: registration may fail if store is read-only
-        }
+        logger.debug(`Detected agent '${detected.name}' is not registered; read-path resolution does not auto-register `
+            + '(register via setup, session start, or dispatch).');
     }
     // config.current_agent is NOT used for identity resolution — it's a singleton global
     // that gets overwritten by whichever agent last ran register-agent --set-current.
@@ -370,10 +438,12 @@ export function resolveOrAutoRegisterAgentIdentity(options = {}) {
     catch (err) {
         if (!(err instanceof AgentIdentityResolutionError))
             throw err;
-        // Last-resort: derive a name from explicit arg or env and auto-register.
-        // This allows session_start to succeed even for agents not yet registered.
+        // Last-resort: derive a name from explicit arg, env, or runtime detection
+        // and auto-register. Session start is an EXPLICIT act (pln#562 step 2), so
+        // it is allowed to register — unlike read-path resolution, which is not.
         const candidateName = options.agentName?.trim()
-            || (options.allowEnv !== false ? resolveEnvAgentName(options.env ?? process.env) : undefined);
+            || (options.allowEnv !== false ? resolveEnvAgentName(options.env ?? process.env) : undefined)
+            || detectAiAgent(options.env ?? process.env)?.name;
         if (!candidateName)
             throw err;
         const normalizedName = normalizeAgentName(candidateName);
@@ -467,11 +537,11 @@ export function resolveCurrentModel(cwd) {
  * Note: config.current_agent is intentionally NOT used here — it's a singleton
  * global that causes cross-agent confusion in multi-agent setups.
  */
-export function resolveCurrentAgentName(cwd, homeDir) {
+export function resolveCurrentAgentName(cwd, _homeDir) {
     const fromEnv = (process.env.BRAINCLAW_AGENT_NAME ?? process.env.BRAINCLAW_AGENT)?.trim();
     if (fromEnv)
         return fromEnv;
-    const detected = detectAiAgent(process.env, homeDir);
+    const detected = detectAiAgent(process.env);
     if (detected)
         return detected.name;
     return process.env.USER ?? process.env.USERNAME ?? 'unknown';
@@ -559,4 +629,68 @@ export function agentCanCurate(agentNameOrId, cwd) {
     const level = getAgentTrustLevel(agentNameOrId, cwd);
     return level === 'curator';
 }
+// ── Debris identity cleanup (pln#562 step 2) ────────────────────────────────
+/**
+ * Identity names known to be registration debris: test fixtures and
+ * model-as-identity artifacts that leaked into real stores through the old
+ * permissive auto-registration paths.
+ */
+export const DEBRIS_AGENT_NAMES = ['testuser', 'contributor-bot', 'claude-sonnet'];
+/**
+ * List identities that look like registration debris:
+ *  - names on the known-debris list (test fixtures, model-as-identity)
+ *  - identities stored under an alias of a canonical agent name (e.g. a
+ *    'copilot' document now shadowed by the registry-level alias merge)
+ *
+ * Read-only — cleanup is a separate, guarded act (removeAgentIdentity).
+ */
+export function listDebrisAgentIdentities(cwd, preferredDirName) {
+    const debris = [];
+    for (const identity of listAgentIdentities(cwd, preferredDirName)) {
+        const stored = identity.agent_name.trim().toLowerCase();
+        if (DEBRIS_AGENT_NAMES.includes(stored)) {
+            debris.push({ identity, reason: `'${stored}' is a known debris identity name` });
+            continue;
+        }
+        const canonical = resolveAgentAlias(stored);
+        if (canonical !== stored) {
+            debris.push({
+                identity,
+                reason: `'${stored}' is an alias of '${canonical}' — superseded by the registry-level alias merge`,
+            });
+        }
+    }
+    return debris;
+}
+/**
+ * Remove a registered agent identity — guarded, never silent.
+ *
+ * Refuses unless the identity is flagged as debris (listDebrisAgentIdentities)
+ * or the caller passes force:true. Curator identities are never removed
+ * without force. Returns the removed document so callers can report exactly
+ * what was deleted.
+ */
+export function removeAgentIdentity(agentNameOrId, options = {}) {
+    const { cwd, preferredDirName, force } = options;
+    const identity = findAgentIdentityById(agentNameOrId, cwd, preferredDirName)
+        ?? findAgentIdentityByName(agentNameOrId, cwd, preferredDirName)
+        // Alias-debris docs are unreachable via normalized name lookup — match the raw stored name.
+        ?? listAgentIdentities(cwd, preferredDirName).find((a) => a.agent_name.trim().toLowerCase() === agentNameOrId.trim().toLowerCase());
+    if (!identity) {
+        throw new AgentIdentityResolutionError(`Agent '${agentNameOrId}' not found.`, { agent_name: agentNameOrId });
+    }
+    if (!force) {
+        if (identity.trust_level === 'curator') {
+            throw new AgentTrustError(`Refusing to remove curator identity '${identity.agent_name}' without force.`, { agent_id: identity.agent_id, agent_name: identity.agent_name });
+        }
+        const isDebris = listDebrisAgentIdentities(cwd, preferredDirName)
+            .some((d) => d.identity.agent_id === identity.agent_id);
+        if (!isDebris) {
+            throw new AgentIdentityResolutionError(`Refusing to remove '${identity.agent_name}': not a known debris identity. Pass force to override.`, { agent_id: identity.agent_id, agent_name: identity.agent_name });
+        }
+    }
+    agentStore(cwd, preferredDirName).delete(identity.agent_id);
+    logger.debug(`Removed agent identity ${identity.agent_name} (${identity.agent_id})`);
+    return identity;
+}
 //# sourceMappingURL=agent-registry.js.map

package/dist/core/agentrun-reconciler.js

@@ -169,7 +169,10 @@ export function collectEvidence(run, cwd, options) {
     try {
         completed_signal = signalExists(signalRoot, run.assignment_id, 'completed');
         failed_signal = signalExists(signalRoot, run.assignment_id, 'failed');
-        const hb = readHeartbeat(signalRoot, run.assignment_id);
+        // sprint 1.5: also read the worktree-local heartbeat — the only location a
+        // sandboxed worker can write (the project-root signal dir is outside its
+        // writable roots).
+        const hb = readHeartbeat(signalRoot, run.assignment_id, run.worktree_path);
         heartbeat_exists = hb.exists;
         if (hb.exists && hb.mtimeMs !== undefined)
             heartbeat_age_ms = now - hb.mtimeMs;
@@ -268,7 +271,28 @@ function describeEvidence(evidence) {
     return reasons.join(' + ');
 }
 // ── Synthetic event for unverified spawns ──────────────────────────────────
+/**
+ * Per-run throttle for "delivered_but_unverified" events (pln#558 step 5).
+ *
+ * Before this throttle every reconciliation pass during the health-check
+ * window produced a fresh runtime_event file. With the VS Code extension
+ * polling kind='board' every 30s, both reconciliation passes firing per
+ * poll, and several non-terminal runs in flight, the store accumulated
+ * ~120 of these files per hour per run — all writing under the mutation
+ * lock, none ever surfaced to the UI.
+ *
+ * Surfacing the uncertainty once per window is enough; the event content
+ * is monotonic (age increases) so re-emitting adds no information.
+ */
+const UNVERIFIED_EVENT_THROTTLE_MS = 5 * 60_000;
+const lastUnverifiedEmitAt = new Map();
 function emitUnverifiedEvent(run, evidence, actor, cwd) {
+    const now = Date.now();
+    const last = lastUnverifiedEmitAt.get(run.id);
+    if (last !== undefined && now - last < UNVERIFIED_EVENT_THROTTLE_MS) {
+        return;
+    }
+    lastUnverifiedEmitAt.set(run.id, now);
     try {
         createRuntimeEvent({
             agent: actor,
@@ -551,6 +575,13 @@ export function reconcileDeadPidRunningAgentRunAtRead(runId, cwd, options = {})
     // window (trp#292 — must converge HERE since the read path never routes
     // through reconcileAgentRun), giving an untrusted-pid worker ample time.
     if (evidence.age_ms >= stale) {
+        if (fsActiveWithin(evidence, heartbeatStale)) {
+            return {
+                run_id: run.id, action: 'no_op',
+                reason: `no heartbeat but fs active ${Math.round((evidence.fs_activity_age_ms ?? 0) / 1000)}s ago - working, not silent`,
+                evidence, previous_status: run.status, current_status: run.status,
+            };
+        }
         return failRun('silent_termination_no_evidence');
     }
     emitUnverifiedEvent(run, evidence, actor, cwd);
@@ -562,7 +593,7 @@ export function reconcileDeadPidRunningAgentRunAtRead(runId, cwd, options = {})
 }
 export function sweepDeadPidRunningAgentRunsAtRead(cwd, options = {}) {
     const now = options.nowMs ?? Date.now();
-    const minAgeMs = options.staleAfterMs ?? DEFAULT_DEAD_PID_READ_SWEEP_AGE_MS;
+    const minAgeMs = options.deadPidSweepCandidateAgeMs ?? DEFAULT_DEAD_PID_READ_SWEEP_AGE_MS;
     const cutoff = now - minAgeMs;
     const limit = options.limit ?? DEFAULT_DEAD_PID_READ_SWEEP_LIMIT;
     const candidates = listAgentRuns(cwd, { status: 'running' })

package/dist/core/agentruns.js

@@ -15,6 +15,7 @@ import { JsonStore } from './json-store.js';
 import { appendAuditEntry } from './audit.js';
 import { appendEvent } from './event-log.js';
 import { createRuntimeEvent } from './events.js';
+import { emitRegistryPostImage, registryFaultPoint } from './events/registry-post-image.js';
 function agentRunsDir(cwd, mode = 'read') {
     return resolveEntityDir('runs', cwd, mode);
 }
@@ -46,7 +47,12 @@ export function saveAgentRun(run, cwd) {
             getId: (item) => item.id,
             sort: (a, b) => a.created_at.localeCompare(b.created_at),
         });
-        store.save(AgentRunSchema.parse(run));
+        const parsed = AgentRunSchema.parse(run);
+        // pln#568 (I2): journal the post-image BEFORE the projection write.
+        const created = !store.exists(parsed.id);
+        emitRegistryPostImage('agent_run', parsed, { created, agent: parsed.agent, agent_id: parsed.agent_id, session_id: parsed.session_id, cwd });
+        registryFaultPoint('after_registry_journal');
+        store.save(parsed);
     });
 }
 export function loadAgentRun(id, cwd) {

package/dist/core/ai-agent-detection.js

@@ -1,11 +1,15 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
 /**
  * Detects the AI coding agent running in the current environment by inspecting
- * environment variables and well-known config paths. Returns the first confident
+ * PROCESS-SCOPED environment variables ONLY. Returns the first confident
  * match, or undefined if no agent is detected.
  *
+ * Identity hardening (pln#562 step 1): directory-presence fallbacks
+ * (~/.config/opencode, ~/.gemini/antigravity, ~/.openclaw, ~/.vibe, ~/.hermes)
+ * were removed — a config directory proves an agent is INSTALLED on the
+ * machine, not that it is the agent driving THIS process. Installed-ness is
+ * now answered exclusively by agent-inventory (buildAgentInventory). The
+ * inventory never mints identity; this function never consults the disk.
+ *
  * Detection order (highest confidence first — agents with dedicated env vars
  * are tested before agents detected via passive/ambient env vars):
  * 1. BRAINCLAW_AGENT env var (explicit override)
@@ -14,21 +18,21 @@ import os from 'node:os';
  * 4. Windsurf (WINDSURF_SESSION_ID — set by Windsurf itself)
  * 5. Cline (CLINE_AGENT — set by Cline itself)
  * 6. GitHub Copilot (GITHUB_COPILOT_PRODUCT — passive VS Code env, tested after active agents)
- * 7. Codex CLI (~/.codex/ directory exists)
- * 8. OpenCode (OPENCODE_* env or ~/.config/opencode/)
- * 9. Antigravity / Gemini CLI (ANTIGRAVITY_* env or ~/.gemini/antigravity/)
+ * 7. Codex CLI (CODEX_THREAD_ID / CODEX_CI / …)
+ * 8. OpenCode (OPENCODE_*)
+ * 9. Antigravity / Gemini CLI (ANTIGRAVITY_*)
  * 10. Continue (CONTINUE_*)
  * 11. Roo Code (ROO_*)
- * 12. Hermes (HERMES_* or ~/.hermes/)
- * 13. OpenClaw (~/.openclaw/ or OPENCLAW_*)
+ * 12. OpenClaw (OPENCLAW_*)
+ * 13. Mistral Vibe (VIBE_HOME)
+ * 14. Hermes (HERMES_*)
  */
-export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
+export function detectAiAgent(env = process.env) {
     // Explicit override
     if (env.BRAINCLAW_AGENT?.trim()) {
         return {
             name: env.BRAINCLAW_AGENT.trim(),
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: 'BRAINCLAW_AGENT env var',
         };
     }
@@ -44,7 +48,6 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'claude-code',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: source,
         };
     }
@@ -53,7 +56,6 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'cursor',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: 'CURSOR_* env var',
         };
     }
@@ -62,7 +64,6 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'windsurf',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: 'WINDSURF_* env var',
         };
     }
@@ -71,7 +72,6 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'cline',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: 'CLINE_* env var',
         };
     }
@@ -85,7 +85,6 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'github-copilot',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: env.GITHUB_COPILOT_PRODUCT ? 'GITHUB_COPILOT_PRODUCT env var' : 'GITHUB_COPILOT_TOKEN env var',
         };
     }
@@ -101,26 +100,23 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'codex',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: source,
         };
     }
     // OpenCode
-    if (env.OPENCODE_SESSION_ID || env.OPENCODE_AGENT || fs.existsSync(path.join(homeDir, '.config', 'opencode'))) {
+    if (env.OPENCODE_SESSION_ID || env.OPENCODE_AGENT) {
         return {
             name: 'opencode',
             kind: 'agent',
-            trust_level: 'trusted',
-            detection_source: env.OPENCODE_SESSION_ID || env.OPENCODE_AGENT ? 'OPENCODE_* env var' : '~/.config/opencode directory',
+            detection_source: 'OPENCODE_* env var',
         };
     }
     // Antigravity (Google Gemini CLI)
-    if (env.ANTIGRAVITY_SESSION_ID || env.ANTIGRAVITY_AGENT || fs.existsSync(path.join(homeDir, '.gemini', 'antigravity'))) {
+    if (env.ANTIGRAVITY_SESSION_ID || env.ANTIGRAVITY_AGENT) {
         return {
             name: 'antigravity',
             kind: 'agent',
-            trust_level: 'trusted',
-            detection_source: env.ANTIGRAVITY_SESSION_ID || env.ANTIGRAVITY_AGENT ? 'ANTIGRAVITY_* env var' : '~/.gemini/antigravity directory',
+            detection_source: 'ANTIGRAVITY_* env var',
         };
     }
     // Continue.dev
@@ -128,7 +124,6 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'continue',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: 'CONTINUE_* env var',
         };
     }
@@ -137,44 +132,36 @@ export function detectAiAgent(env = process.env, homeDir = os.homedir()) {
         return {
             name: 'roo',
             kind: 'agent',
-            trust_level: 'trusted',
             detection_source: 'ROO_* env var',
         };
     }
-    // OpenClaw (~/.openclaw/ presence or OPENCLAW_* env)
-    if (env.OPENCLAW_SESSION_ID || env.OPENCLAW_AGENT || fs.existsSync(path.join(homeDir, '.openclaw'))) {
+    // OpenClaw
+    if (env.OPENCLAW_SESSION_ID || env.OPENCLAW_AGENT) {
         return {
             name: 'openclaw',
             kind: 'agent',
-            trust_level: 'trusted',
-            detection_source: env.OPENCLAW_SESSION_ID || env.OPENCLAW_AGENT ? 'OPENCLAW_* env var' : '~/.openclaw directory',
+            detection_source: 'OPENCLAW_* env var',
         };
     }
-    // Mistral Vibe — no dedicated session env var documented (per pln#489 research).
-    // Detect via the user-level config dir (~/.vibe/) which Mistral creates on first
-    // run, or via VIBE_HOME override. Tested last so other agents with dedicated
-    // session env vars take precedence.
-    if (env.VIBE_HOME || fs.existsSync(path.join(homeDir, '.vibe'))) {
+    // Mistral Vibe — no dedicated session env var documented (per pln#489
+    // research). VIBE_HOME is the only process-scoped marker; the ~/.vibe
+    // directory check moved to agent-inventory.
+    if (env.VIBE_HOME) {
         return {
             name: 'mistral-vibe',
             kind: 'agent',
-            trust_level: 'trusted',
-            detection_source: env.VIBE_HOME ? 'VIBE_HOME env var' : '~/.vibe directory',
+            detection_source: 'VIBE_HOME env var',
         };
     }
-    // Hermes Agent — supports MCP and skills from ~/.hermes/. Detect after
-    // editor/CLI agents with stronger session env vars to avoid stealing mixed
-    // shells where Hermes is merely installed.
-    if (env.HERMES_SESSION_ID || env.HERMES_AGENT || env.HERMES_HOME || fs.existsSync(path.join(homeDir, '.hermes'))) {
+    // Hermes Agent — detect after editor/CLI agents with stronger session env
+    // vars to avoid stealing mixed shells where Hermes is merely installed.
+    if (env.HERMES_SESSION_ID || env.HERMES_AGENT || env.HERMES_HOME) {
         return {
             name: 'hermes',
             kind: 'autonomous',
-            trust_level: 'trusted',
             detection_source: env.HERMES_SESSION_ID || env.HERMES_AGENT
                 ? 'HERMES_* env var'
-                : env.HERMES_HOME
-                    ? 'HERMES_HOME env var'
-                    : '~/.hermes directory',
+                : 'HERMES_HOME env var',
         };
     }
     return undefined;