catherd-cli 1.3.0 → 1.5.0

package/plugin/skills/catherd-setup/SKILL.md

@@ -7,7 +7,9 @@ description: Use when the user wants to tune catherd — which models and effort
 
 You tune the user's catherd profile in conversation. A profile says, per role, which rungs it may run on (`backend:model#effort`, in ladder order) and what it may touch (its access mode); whether routing favours cost or speed; how each backend is billed; whether Jev picks the rung; which rung stands in when a backend hits its usage limit; the run budget and timeouts; whether each vendor harness runs with the user's customizations or isolated; how many heavy commands run at once; and when to push.
 
-**You never edit a file by hand.** `profile_set` is the only writer, so this conversation, the `catherd profile` commands and the TUI cannot drift apart.
+**You never edit a file by hand.** Use `profile_set` for patches and the existing reviewed CLI reset below; both go through ProfileService, as do the `catherd profile` commands and the TUI.
+
+**Discover the host first with `status()`.** Use the host's available MCP discovery facility; names and deferred tools differ. Claude Code may use `ToolSearch`; Codex never needs invented Claude tools or native Claude agents. Pass the actual project `repo` explicitly to profile, setup and catalog calls that accept it: native Codex starts the MCP server in the installed plugin root, not the project. An unknown terminal can use `catherd init --host codex` or `--host claude-code` for setup; this does not create a conversation owner. Conflicting identity must be resolved before ownership or push.
 
 ## Rules
 
@@ -21,17 +23,19 @@ You tune the user's catherd profile in conversation. A profile says, per role, w
 Ask these, one at a time, each with its recommended answer:
 
 1. **Their order of speed, cost and quality.** Recommend cost first, the default `objective`: catherd climbs a rung when a cheap one cannot do the work, so the lanes that need speed get it anyway, and the reviewer and the verifier hold quality either way.
-2. **The subscriptions they hold:** a ChatGPT plan (Codex), a Claude plan, OpenCode Go, Zen credit or API keys. They set `billing` per key (`codex`, `claude`, `claude-code`, `opencode-go`, `opencode`, `cursor`, `grok`, `antigravity`): `chatgpt-plan`, `claude-plan`, `subscription` or `metered`. Recommend leaning on subscriptions before metered spend, and on Claude last among the workers, since it spends the same quota as this conversation.
+2. **The subscriptions they hold:** a ChatGPT plan (Codex), a Claude plan, OpenCode Go, Zen credit or API keys. They set `billing` per key (`codex`, `claude`, `claude-code`, `opencode-go`, `opencode`, `cursor`, `grok`, `antigravity`): `chatgpt-plan`, `claude-plan`, `subscription` or `metered`. Recommend leaning on subscriptions before metered spend. Explain which workers share this conversation's quota from the actual host and billing facts.
 3. **The kind of work they orchestrate:** front-end screens, back-end services, terminal and ops work, docs. Recommend from their own runs when `runs_summary` has any.
 
 ## 2. Read the facts before proposing
 
 In one message, call:
 
-- `catalog_query({ role: "<role>" })` for each role you will discuss: the models that can fill it, their scored rungs, any "treat like", each rung's cost under their billing, and whether their backend's last listing offers it (`listed: false` means their account does not);
+- `catalog_query({ repo, role: "<role>" })` for each role you will discuss: the models that can fill it, their scored rungs, any "treat like", each rung's cost under their billing, and whether their backend's last listing offers it (`listed: false` means their account does not);
 - `runs_summary({})`: how each rung has done on their own runs (runs, refusals, climbs, time) and the harness cost line, for claude-code and opencode only: Codex reports no per-request input, so it has no harness figure;
 - `profile_get({ repo })`: where they stand now, with each role's `access` and `enforcement`. Pass the user's repo: without a name, the profile tools act on the profile this repo runs on (the one bound to it, else the active one), which `here` names; `active` is the global active profile.
 
+Verify the exact omitted Codex model ID `gpt-6.1-sol` against native catalog discovery and validation. If its spelling differs, report the mismatch and resolve it explicitly with the owner; never silently normalize or substitute a model. Retain architect high and verifier low effort.
+
 ## 3. Propose one decision at a time
 
 Go through these in order, and skip any the user does not care about:
@@ -40,7 +44,7 @@ Go through these in order, and skip any the user does not care about:
 2. `billing`, from step 1;
 3. the worker's `rungs` and its `defaultRung`;
 4. the reviewer and the UI reviewer;
-5. the architect and the verifier, which spend Claude quota. A `claude:` rung runs as a native subagent in this session; a `claude-code:` rung runs headless through `dispatch`. Recommend native for these two;
+5. the architect and the verifier. Recommend omitted host defaults: on Codex, exactly `codex:gpt-6.1-sol#high` and `codex:gpt-6.1-sol#low`; on Claude Code, the existing native Claude defaults. A `claude:` rung requires a Claude Code host and its native `Agent`; `claude-code:` runs headless through `dispatch` on either host. Codex architect/verifier use process `dispatch`/`result`. Preserve explicit model IDs, efforts, ladder order and all other fields. Never silently convert `claude:` into `claude-code:`;
 6. the writer, the researcher and the artist;
 7. each role's `access` (below);
 8. `failover` (below);
@@ -48,6 +52,16 @@ Go through these in order, and skip any the user does not care about:
 10. harness isolation, per harness (below);
 11. `lock.heavy` and `notify`.
 
+Existing materialized profiles remain unchanged on read, init, upgrade or host switch. To deliberately opt into host defaults, use the existing CLI from the project directory, naming the profile returned by `profile_get`:
+
+```sh
+catherd profile reset-host-defaults <profile> --host codex --preview --json > /tmp/catherd-host-defaults-review.json
+# Read the complete diff, effective defaults, errors and warnings before saving.
+catherd profile reset-host-defaults <profile> --host codex --expect /tmp/catherd-host-defaults-review.json --json
+```
+
+Use `--host claude-code` for that host. This reviewed reset removes only architect/verifier `rungs` and `defaultRung`, preserving access, enabled state, network, budget, isolation, billing, routing and failover. The `--expect` file guards against a profile changing after review. There is no MCP reset tool. Offer the exact headless model/effort equivalent as a separate explicit choice when a native Claude rung is incompatible with Codex.
+
 Each proposal has three parts: the change, a worked example from their facts, and the tradeoff in their terms. For instance: "Luna high on build lanes: about 5 min slower than Sol medium, no Claude quota, climbs on 1 in 5 of your runs so far."
 
 - Offer only the rungs `catalog_query` lists as capable for the role, written `backend:model#effort`.
@@ -57,7 +71,9 @@ Each proposal has three parts: the change, a worked example from their facts, an
 
 **Failover.** `failover` maps a rung to its stand-in when that rung's backend hits a usage limit. A stand-in must be scored and on another quota (Go and Zen bill apart; native `claude` and `claude-code` share the Claude plan). The default profile fails a Codex rung over only to a stand-in that clears the same bars at least as well: Go's GPT-6 Luna for Luna high, and Kimi K3 (its scores borrowed from Sol medium) for Sol medium. Sol high and xhigh have none, so a limit there pauses the lane rather than dropping it a tier. Say so, and offer to change it when they have no Go subscription. `null` removes an entry.
 
-**Budget and timeouts.** `budget` (`minutes`, `tokens`, `usd`) is a soft cap: from 80 % routing starts at the cheapest rung that clears the bar, and at 100 % no new role starts. `timeouts.idleMin` (15) stops a role that has gone quiet, `timeouts.wallMin` (90) one that runs too long. `preflight.confirm: true` makes `preflight` show its commands for the user to approve first.
+**Budget and timeouts.** `budget` (`minutes`, `tokens`, `usd`) is a soft cap: from 80 % routing starts at the cheapest rung that clears the bar, and at 100 % no new role starts. `timeouts.idleMin` (15) stops a role that has gone quiet, `timeouts.wallMin` (90) one that runs too long; `roles.<role>.timeouts.idleMin` and `wallMin` override them for one role (a verifier with a long gate), and `null` removes the override. `preflight.confirm: true` makes `preflight` show its commands for the user to approve first.
+
+**Notifications and readiness.** `notify` controls milestone, finish and blocked moments through whatever notification facility the host actually exposes; Claude Code may have `PushNotification`. Do not invent a Codex tool or a scheduling promise. Completion uses Claude's peer inbox or Codex's existing native queue (`--remote unix://`); a Codex busy session receives ordered next input after its active turn, not urgent next-tool-round delivery. Queue acceptance proves neither processing nor `result` collection; unloaded/interrupted sessions may retain input. `catherd doctor --host codex` checks capability without sending; only explicit `--test-push` sends a labeled smoke input. Use the orchestration skill's `peek`/`result` recovery and current-owner, exact-event `runs retry-push` decision for ambiguity.
 
 **Harness isolation.** For each harness they use (`codex`, `claude-code`, `opencode`, `cursor`, `grok`, `antigravity`), offer `harness.<name>.isolated` with its harness line from `runs_summary` (Codex has none: it reports no per-request input, so say there is no figure for it instead of offering one) and this tradeoff: "native keeps your hooks, skills and AGENTS.md; isolated saves ~N tokens per run, but the role loses them." Recommend native. When they have no isolated runs yet, the number is the median first-turn input of their native runs: say that isolation would save some part of it, not all of it. When there are no runs at all, say there is no number yet, and recommend native until there is.
 
@@ -70,6 +86,6 @@ Each proposal has three parts: the change, a worked example from their facts, an
 
 ## 5. Say what applies when
 
-- Codex, claude-code, opencode, Cursor, grok and Antigravity changes, access and isolation included, apply at the next dispatch, even in a run already under way. Isolating Cursor needs `CURSOR_API_KEY` in the environment catherd runs in, isolating grok `XAI_API_KEY`, and isolating Antigravity `GEMINI_API_KEY`; `profile_validate` refuses each without. A read-only role (reviewer, architect, researcher) can run on Antigravity only isolated: agy has no read-only mode.
-- An agent listed in `newSessionNeededFor` applies from the next Claude Code session: Claude Code reads agent files when a session starts. Other Claude changes apply now.
-- Editing a profile that is not the active one writes its agent files but links none; they apply once it becomes active (`catherd profile use <name>`), or in a repo it is bound to (`catherd profile use <name> --repo`).
+- Codex, claude-code, opencode, Cursor, grok and Antigravity rung and ladder changes apply at the next dispatch, even in a run already under way. Access and isolation are pinned per run when it starts: a run under way keeps them (its `state.md` and `status` name the change) until its orchestrator re-pins it with `run_pin` (`catherd runs pin <run>`). Isolating Cursor needs `CURSOR_API_KEY` in the environment catherd runs in, isolating grok `XAI_API_KEY`, and isolating Antigravity `GEMINI_API_KEY`; `profile_validate` refuses each without. A read-only role (reviewer, architect, researcher) can run on Antigravity only isolated: agy has no read-only mode.
+- For native Claude roles, an agent listed in `newSessionNeededFor` applies from the next Claude Code session: Claude Code reads agent files when a session starts. Other Claude changes apply now. `record_agent_run` accounts only for native Claude Agent results on Claude Code; process records are automatic.
+- ProfileService manages Claude agent files/links only when native Claude roles are used. Codex-only setup and profile operations do not write under `~/.claude`; Claude CLI/login is needed only by an enabled selected role or reachable failover that uses it. Editing an inactive Claude-dependent profile writes its managed files but links none; they apply once active or repo-bound. Keep role-disabled, access, isolation, budget and failover choices intact.

package/src/adapters/access.ts

@@ -1,3 +1,4 @@
+import { scrubSecrets } from "../infra/env.ts";
 import { existsSync, mkdtempSync, realpathSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
@@ -53,7 +54,12 @@ export type ToolQuery = (bin: string, args: string[]) => string[];
 
 const queryTool: ToolQuery = (bin, args) => {
   try {
-    const r = Bun.spawnSync([bin, ...args], { stdout: "pipe", stderr: "ignore", timeout: 5_000 });
+    const r = Bun.spawnSync([bin, ...args], {
+      env: scrubSecrets(process.env),
+      stdout: "pipe",
+      stderr: "ignore",
+      timeout: 5_000,
+    });
     return r.exitCode === 0
       ? r.stdout
           .toString()

package/src/adapters/antigravity/index.ts

@@ -102,11 +102,20 @@ function plan(r: RunRequest): SpawnPlan {
   };
 }
 
-async function listModels(): Promise<DiscoveredModel[]> {
-  const r = await runCli("agy", ["models"], { ...agyShell, env: ENV });
+/** `agy models` under `env`: the user's HOME (its Google login) by default, an isolated one with the key. */
+async function listAs(env: Record<string, string> = {}): Promise<DiscoveredModel[]> {
+  const r = await runCli("agy", ["models"], { ...agyShell, env: { ...ENV, ...env } });
   return r?.ok ? parseAgyModels(r.out) : [];
 }
 
+const listModels = (): Promise<DiscoveredModel[]> => listAs();
+
+/**
+ * The discovery cache an isolated run is judged by: the listing under catherd's isolated HOME, where
+ * GEMINI_API_KEY signs agy in, apart from the native login's (1.3 follow-ups: the two may serve differently).
+ */
+export const ISOLATED_LISTING = "antigravity-isolated";
+
 /**
  * Spec 1.3 §6.3, §6.4, §9 Q2: read-only runs only isolated; an isolated run needs GEMINI_API_KEY and gets its
  * home and settings; a native one needs agy's own login; the rung's model and effort must be ones agy lists.
@@ -137,7 +146,13 @@ async function prepare(req: {
       { fix: LOGIN_FIX },
     );
   const { model, effort } = req.rung;
-  const models = await discovered("antigravity", listModels, { maxAgeMs: DAY_MS, need: model });
+  // an isolated run signs in with the key, so its model is checked against the key's own listing
+  const models = req.isolated
+    ? await discovered(ISOLATED_LISTING, () => listAs(agyHomeEnv(req.access, req.network !== false)), {
+        maxAgeMs: DAY_MS,
+        need: model,
+      })
+    : await discovered("antigravity", listModels, { maxAgeMs: DAY_MS, need: model });
   if (models.length === 0) return; // agy listed nothing: let the run itself say what is wrong
   const m = models.find((x) => x.id === model);
   if (!m)

package/src/adapters/backend.ts

@@ -3,6 +3,7 @@ import type { ADAPTER_IDS, Rung } from "../domain/ids.ts";
 import type { BillingMode } from "../domain/cost.ts";
 import type { Access, ExitInfo, RunStatus, Tokens } from "../domain/record.ts";
 import type { CliResult } from "./cli.ts";
+import type { RoleMcpContext } from "../domain/role-tools.ts";
 type AdapterId = (typeof ADAPTER_IDS)[number];
 
 export interface Probe {
@@ -43,6 +44,10 @@ export interface DiscoveredModel {
 export interface RunRequest {
   rung: Rung;
   access: Access;
+  /** Native catherd roles receive a dedicated, run-bound control-plane server. */
+  roleMcp?: RoleMcpContext;
+  /** spec 1.5 plan 21: the role's TMPDIR (`<run>/scratch/<name>`), a write root besides the repo */
+  scratch?: string;
   /** spec §5: a workspace-write role's network and loopback grants; false only when the profile says `network: false` */
   network?: boolean;
   thread: string | null;
@@ -82,6 +87,11 @@ export interface EventDelta {
   limit?: boolean;
   tooOld?: boolean;
   retrying?: boolean;
+  /**
+   * plan 23: a model step started (opencode's step_start). Two in a row with nothing between are a provider retry,
+   * which the supervisor never counts as progress
+   */
+  step?: boolean;
   /** the stream's terminal event: the supervisor may kill a CLI that lingers after it */
   final?: boolean;
   /** a tool call starting (`open`) or ending: while one is open the run is busy, however quiet */
@@ -147,14 +157,20 @@ export interface BackendAdapter {
   interrupt?(thread: string, cwd: string): Promise<void>;
   /** `sinceMs`: when this run started, so what an earlier run on the thread left behind does not count */
   isBusy?(thread: string, cwd: string, sinceMs?: number): Promise<boolean>;
+  /**
+   * Plan 23: the provider retry the session is waiting out, by its attempt number, when its newest message since
+   * `sinceMs` is retrying (a 503, an overloaded backend); null when it is not
+   */
+  providerRetry?(thread: string, cwd: string, sinceMs: number): Promise<number | null>;
   /** Spec §4.5: this backend's own stand-in for a rung on a usage limit, when the profile names none. */
   failoverFor?(rung: Rung, repo?: string): Rung | null;
   /**
    * Spec §5 and §12: a shell that runs a command the way this backend's workspace-write worker runs one,
    * with the grants the worker gets, for doctor's access probes; a string says why it cannot be tested here.
-   * Absent: the CLI has no way to run a shell in its sandbox without a model turn (spec 1.3 §3.4).
+   * Absent: the CLI has no way to run a shell in its sandbox without a model turn (spec 1.3 §3.4). `repos`: the
+   * repositories workers run in (doctor's own and every bound one), for a backend whose sandbox is set per repo.
    */
-  accessShell?(o: { network: boolean }): Promise<AccessShell | string>;
+  accessShell?(o: { network: boolean; repos?: string[] }): Promise<AccessShell | string>;
   /** Spec §10.3: why this backend's isolation is weak; doctor warns when a profile uses it. */
   isolationNote?: string;
   /**

package/src/adapters/claude-code/index.ts

@@ -16,6 +16,8 @@ import {
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { claudeHome } from "../../infra/paths.ts";
+import { ROLE_MCP_SERVER, roleMcpTools } from "../../domain/role-tools.ts";
+import { roleMcpConfig } from "../../infra/role-mcp.ts";
 import { dockerSocket, scratchShell, writableRoots } from "../access.ts";
 import { jsonOf, runCli } from "../cli.ts";
 import {
@@ -74,15 +76,21 @@ export const CLAUDE_ACCESS: Record<Access, string[]> = {
  * them Docker: the socket and `docker *` are network grants) and sets `allowLocalBinding: false`, so the
  * user's own `true` does not carry over (their allowedDomains and other array grants merge in and stay;
  * doctor says `network: false` is not enforced by claude-code's shell). With the user's sandbox on, `enabled: true`
- * goes in too, so a merge that replaces the whole `sandbox` object cannot turn it off.
+ * goes in too, so a merge that replaces the whole `sandbox` object cannot turn it off. A `repo` of null reads the
+ * user's settings only: a run that drops the project's settings files (`--setting-sources ""`).
  */
-export function claudeAccessArgs(access: Access, network = true, repo?: string): string[] {
+export function claudeAccessArgs(
+  access: Access,
+  network = true,
+  repo?: string | null,
+  extra: string[] = [],
+): string[] {
   const base = CLAUDE_ACCESS[access];
   if (access !== "workspace-write") return base;
   const sock = dockerSocket();
   const sandbox = {
     ...(claudeSandboxOn(repo) ? { enabled: true } : {}),
-    filesystem: { allowWrite: writableRoots() },
+    filesystem: { allowWrite: [...new Set([...writableRoots(), ...extra])] },
     ...(network
       ? {
           network: { allowLocalBinding: true, ...(sock ? { allowUnixSockets: [sock] } : {}) },
@@ -113,12 +121,14 @@ function sandboxEnabledIn(file: string): boolean | undefined {
  * Whether Claude Code's Bash sandbox is on for a worker in `repo` (`sandbox.enabled`): the most specific
  * settings file that says wins, as Claude Code layers them: the user's settings.json, then the project's
  * .claude/settings.json and .claude/settings.local.json (Claude Code has no user-level settings.local.json).
+ * A `repo` of null reads the user's settings.json only.
  */
-export function claudeSandboxOn(repo: string = process.cwd()): boolean {
+export function claudeSandboxOn(repo: string | null = process.cwd()): boolean {
   const files = [
     join(claudeHome(), "settings.json"),
-    join(repo, ".claude", "settings.json"),
-    join(repo, ".claude", "settings.local.json"),
+    ...(repo === null
+      ? []
+      : [join(repo, ".claude", "settings.json"), join(repo, ".claude", "settings.local.json")]),
   ];
   return files.map(sandboxEnabledIn).findLast((on) => on !== undefined) ?? false;
 }
@@ -128,17 +138,114 @@ export function claudeSandboxOn(repo: string = process.cwd()): boolean {
  * shell, which doctor probes as is. With it on, only a model turn runs inside it, so doctor says what to
  * check instead of spending one.
  */
-async function accessShell(): Promise<AccessShell | string> {
-  if (claudeSandboxOn())
-    return "Claude Code's own sandbox is on (sandbox.enabled): catherd passes the lock, temp, loopback and Docker grants in --settings; outbound HTTPS reaches only sandbox.network.allowedDomains, so add registry.npmjs.org and the hosts your checks need there";
+async function accessShell(o: { repos?: string[] } = {}): Promise<AccessShell | string> {
+  // the setting is per repo (its .claude/settings*.json over the user's): each repo a worker runs in counts,
+  // not only the directory doctor runs in
+  const repos = o.repos?.length ? o.repos : [process.cwd()];
+  const on = repos.filter((r) => claudeSandboxOn(r));
+  if (on.length)
+    return `Claude Code's own sandbox is on (sandbox.enabled)${o.repos?.length ? ` in ${on.join(", ")}` : ""}: catherd passes the lock, temp, loopback and Docker grants in --settings; outbound HTTPS reaches only sandbox.network.allowedDomains, so add registry.npmjs.org and the hosts your checks need there`;
   return scratchShell("an unsandboxed shell (Claude Code's sandbox is off)", []);
 }
 
+/**
+ * An isolated run without the user's customizations. --bare would also drop OAuth, so a Claude plan could not
+ * log in; --safe-mode keeps auth, but drops every --mcp-config server too (Claude Code 2.1.287: "--mcp-config:
+ * … ignored (safe mode)"). A run with the role server (spec 1.5 plan 21, #42 finding 1) gets the same isolation
+ * piece by piece instead: only the --mcp-config servers, no settings file (so no hooks, no enabled plugins), no
+ * skills, CLAUDE.md and auto-memory off through the env, and the user's auth, provider, model, deny rules and
+ * allowed domains carried into --settings (carriedUserSettings).
+ */
+/** The user settings keys --setting-sources "" would drop that a run needs: auth, provider and model. */
+const CARRIED_SETTINGS = [
+  "apiKeyHelper",
+  "env",
+  "awsAuthRefresh",
+  "awsCredentialExport",
+  "gcpAuthRefresh",
+  "model",
+] as const;
+
+/**
+ * What an isolated run with the role server keeps of the user's settings.json (plan 21 review, finding 1):
+ * --safe-mode keeps the settings files and drops only customizations, while `--setting-sources ""` drops the
+ * files, so a Bedrock, Vertex, gateway or apiKeyHelper login would fail. Carried: the auth and provider keys,
+ * `model`, `permissions.deny` and `sandbox.network`; never hooks, plugins, allow rules or the rest.
+ */
+function carriedUserSettings(): Record<string, unknown> {
+  let user: Record<string, any>;
+  try {
+    user = JSON.parse(readFileSync(join(claudeHome(), "settings.json"), "utf8"));
+  } catch {
+    return {};
+  }
+  if (!user || typeof user !== "object") return {};
+  const out: Record<string, unknown> = {};
+  for (const k of CARRIED_SETTINGS) if (user[k] !== undefined) out[k] = user[k];
+  const deny = user.permissions?.deny;
+  if (Array.isArray(deny) && deny.length) out.permissions = { deny };
+  const network = user.sandbox?.network;
+  if (network && typeof network === "object") out.sandbox = { network };
+  return out;
+}
+
+/** `--settings` with the user's carried keys merged under catherd's own: catherd's sandbox grants win. */
+function withCarriedSettings(args: string[]): string[] {
+  const carried = carriedUserSettings();
+  if (!Object.keys(carried).length) return args;
+  const at = args.indexOf("--settings");
+  const own: Record<string, any> = at >= 0 ? JSON.parse(args[at + 1] as string) : {};
+  const userNet: Record<string, unknown> = (carried.sandbox as any)?.network ?? {};
+  const ownNet: Record<string, unknown> = own.sandbox?.network ?? {};
+  const sockets = [
+    ...((userNet.allowUnixSockets as string[] | undefined) ?? []),
+    ...((ownNet.allowUnixSockets as string[] | undefined) ?? []),
+  ];
+  const sandbox =
+    carried.sandbox || own.sandbox
+      ? {
+          sandbox: {
+            ...own.sandbox,
+            network: {
+              ...userNet,
+              ...ownNet,
+              ...(sockets.length ? { allowUnixSockets: [...new Set(sockets)] } : {}),
+            },
+          },
+        }
+      : {};
+  const json = JSON.stringify({ ...carried, ...own, ...sandbox });
+  if (at < 0) return [...args, "--settings", json];
+  const out = [...args];
+  out[at + 1] = json;
+  return out;
+}
+
+function isolationArgs(r: RunRequest): string[] {
+  if (!r.roleMcp) return ["--safe-mode"];
+  return ["--strict-mcp-config", "--setting-sources", "", "--disable-slash-commands"];
+}
+
 function plan(r: RunRequest): SpawnPlan {
   if (r.thread !== null && !THREAD.test(r.thread))
     throw new CatherdError("E_ADMIT_THREAD", `"${r.thread}" is not a Claude Code session id`, {
       fix: "pass the thread from the earlier RunRecord",
     });
+  // isolated with the role server, `--setting-sources ""` drops the project's settings (its network grants too),
+  // so only the user's carried settings.json decides whether the sandbox is on (PR #46)
+  const carried = r.isolated && !!r.roleMcp;
+  const access = claudeAccessArgs(r.access, r.network, carried ? null : r.repo, r.scratch ? [r.scratch] : []);
+  const accessArgs = carried ? withCarriedSettings(access) : [...access];
+  if (r.roleMcp) {
+    const tools = roleMcpTools(r.roleMcp.role).map((tool) => `mcp__${ROLE_MCP_SERVER}__${tool}`);
+    const allowed = accessArgs.indexOf("--allowedTools");
+    if (allowed >= 0) accessArgs[allowed + 1] = [accessArgs[allowed + 1], ...tools].join(",");
+    else accessArgs.push("--allowedTools", tools.join(","));
+    accessArgs.push(
+      "--mcp-config",
+      JSON.stringify({ mcpServers: { [ROLE_MCP_SERVER]: roleMcpConfig(r.roleMcp) } }),
+    );
+  }
   return {
     cmd: "claude",
     args: [
@@ -154,11 +261,14 @@ function plan(r: RunRequest): SpawnPlan {
       ...(r.thread === null ? ["--session-id", crypto.randomUUID()] : ["--resume", r.thread]),
       "--permission-prompts",
       "none",
-      ...claudeAccessArgs(r.access, r.network, r.repo),
-      // --bare would also drop OAuth, so a Claude plan could not log in; --safe-mode keeps auth
-      ...(r.isolated ? ["--safe-mode"] : []),
+      ...accessArgs,
+      ...(r.isolated ? isolationArgs(r) : []),
     ],
-    env: {},
+    // CLAUDE.md and auto-memory off, as --safe-mode turns them off (spec 1.5 plan 21)
+    env:
+      r.isolated && r.roleMcp
+        ? { CLAUDE_CODE_DISABLE_CLAUDE_MDS: "1", CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" }
+        : {},
     cwd: r.repo,
     stdinPath: r.briefPath,
   };
@@ -232,7 +342,9 @@ function claudeActivity(e: Record<string, any>): string | undefined {
     if (typeof input.command === "string") return `$ ${input.command}`;
     if (typeof input.file_path === "string")
       return `${EDIT_TOOLS.has(c.name) ? "edit" : String(c.name)} ${input.file_path}`;
-    return String(c.name ?? "tool");
+    // another tool shows its first string argument, as opencode's activity does
+    const first = Object.values(input).find((v) => typeof v === "string");
+    return `${String(c.name ?? "tool")}${typeof first === "string" ? ` ${first}` : ""}`;
   }
   if (c?.type === "text" && typeof c.text === "string") return c.text;
   return undefined;

package/src/adapters/cli.ts

@@ -1,67 +1,4 @@
-import { scrubSecrets } from "../infra/env.ts";
-import { log } from "../infra/log.ts";
-import { killGroup } from "../infra/proc.ts";
-
-export interface CliResult {
-  ok: boolean;
-  out: string;
-  err: string;
-}
-
-/** Process groups of CLI calls still running: an exiting catherd (Ctrl-C is exit 130) kills them. */
-const live = new Set<number>();
-let hooked = false;
-function track(pid: number): void {
-  live.add(pid);
-  if (hooked) return;
-  hooked = true;
-  // a detached group gets no terminal SIGINT, and process.exit skips the timeout, so kill it on the way out
-  process.on("exit", () => {
-    for (const g of live) killGroup(g, "SIGKILL");
-  });
-}
-
-/**
- * Runs `bin <args>` without catherd's secrets and with no stdin; null when `bin` is not on PATH. A call
- * past `timeoutMs` is killed with every process it started (it runs in its own process group) and is
- * reported as failed, so neither a wedged CLI nor a child holding its pipes stalls the caller.
- */
-export async function runCli(
-  bin: string,
-  args: string[],
-  o: { timeoutMs: number; env?: Record<string, string>; cwd?: string },
-): Promise<CliResult | null> {
-  if (!Bun.which(bin, { PATH: process.env.PATH ?? "" })) return null;
-  log("debug", "spawn", { argv: [bin, ...args], env: o.env ?? {} });
-  const p = Bun.spawn([bin, ...args], {
-    cwd: o.cwd,
-    env: { ...scrubSecrets(process.env), ...o.env },
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe",
-    detached: true,
-  });
-  track(p.pid);
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const late = new Promise<null>((resolve) => {
-    timer = setTimeout(() => resolve(null), o.timeoutMs);
-  });
-  try {
-    const done = await Promise.race([
-      Promise.all([p.exited, new Response(p.stdout).text(), new Response(p.stderr).text()]),
-      late,
-    ]);
-    if (!done) {
-      killGroup(p.pid, "SIGKILL");
-      return { ok: false, out: "", err: `${bin} ${args.join(" ")} timed out after ${o.timeoutMs} ms` };
-    }
-    const [code, out, err] = done;
-    return { ok: code === 0, out, err };
-  } finally {
-    clearTimeout(timer);
-    live.delete(p.pid);
-  }
-}
+export { runCli, type CliResult } from "../infra/cli.ts";
 
 /** The JSON a CLI printed, or null for empty or unreadable output. */
 export function jsonOf(out: string | undefined): unknown {

package/src/adapters/codex/events.ts

@@ -8,6 +8,8 @@ export interface CodexFold {
   limit: boolean;
   tooOld: boolean;
   lastEvent: string | null;
+  /** plan 22: the agent message that ended each completed turn, in order */
+  finals: string[];
 }
 
 /**
@@ -43,10 +45,18 @@ export function foldCodexEvents(lines: string[]): CodexFold {
     limit: false,
     tooOld: false,
     lastEvent: null,
+    finals: [],
   };
+  let said: string | null = null;
   for (const line of lines) {
     const e = parseCodexLine(line);
     if (!e) continue;
+    if (e.type === "item.completed" && e.item?.type === "agent_message" && typeof e.item.text === "string")
+      said = e.item.text;
+    if (e.type === "turn.completed" && said !== null) {
+      f.finals.push(said);
+      said = null;
+    }
     f.lastEvent = e.item?.type ? `${e.type}/${e.item.type}` : e.type;
     const msg: string = e.message ?? e.error?.message ?? e.item?.message ?? "";
     if (CODEX_TOO_OLD.some((r) => r.test(msg))) f.tooOld = true;

package/src/adapters/codex/index.ts

@@ -1,7 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { codexRoleMcpArgs } from "../../infra/role-mcp.ts";
 import { CatherdError } from "../../domain/errors.ts";
 import type { Access, RunStatus } from "../../domain/record.ts";
+import { composeReply } from "../../domain/reply.ts";
 import {
   type AccessShell,
   type BackendAdapter,
@@ -57,9 +59,14 @@ export function userWritableRoots(): string[] {
  * The same `-c` overrides go to `codex sandbox` in doctor's probes, so doctor tests exactly what a worker gets. `-c …writable_roots=` replaces the
  * user's own roots, so theirs go in too; an isolated run ignores the user's config, so it has none.
  */
-export function codexGrants(access: Access, network = true, isolated = false): string[] {
+export function codexGrants(
+  access: Access,
+  network = true,
+  isolated = false,
+  extra: string[] = [],
+): string[] {
   if (access !== "workspace-write") return [];
-  const roots = [...new Set([...(isolated ? [] : userWritableRoots()), ...writableRoots()])];
+  const roots = [...new Set([...(isolated ? [] : userWritableRoots()), ...writableRoots(), ...extra])];
   return [
     "-c",
     `sandbox_workspace_write.network_access=${network}`,
@@ -89,7 +96,8 @@ function plan(r: RunRequest): SpawnPlan {
     "--json",
     "-o",
     r.replyPath,
-    ...codexGrants(r.access, r.network, r.isolated),
+    ...codexGrants(r.access, r.network, r.isolated, r.scratch ? [r.scratch] : []),
+    ...(r.roleMcp ? codexRoleMcpArgs(r.roleMcp) : []),
   ];
   const sandbox = SANDBOX[r.access];
   const args =
@@ -125,6 +133,7 @@ function finalize(run: FinishedRun): Outcome {
                 : "ok";
   const lastErr = run.stderr.trim().split("\n").at(-1) ?? "";
   const home = run.request.isolated ? isolatedCodexHomePath() : userCodexHome();
+  const reply = composeReply(f.finals, run.reply);
   return {
     status,
     thread: f.thread ?? run.request.thread,
@@ -138,6 +147,8 @@ function finalize(run: FinishedRun): Outcome {
             code: status,
             message: f.failure ?? (lastErr || `${stopped}, exit ${run.exit.code ?? run.exit.signal}`),
           },
+    // plan 22: -o keeps the last turn's message; a later turn never overwrites the report
+    ...(reply !== run.reply ? { reply } : {}),
   };
 }
 
@@ -243,7 +254,7 @@ function codexActivity(e: Record<string, any>): string | undefined {
     return `edit ${it.changes
       .map((c: { path?: unknown }) => c.path)
       .filter((p: unknown) => typeof p === "string")
-      .join(", ")}`;
+      .join(", ")}`.trimEnd();
   if (it.type === "agent_message" && typeof it.text === "string") return it.text;
   return undefined;
 }
@@ -263,12 +274,13 @@ export const codexAdapter: BackendAdapter = {
     // Not a todo_list: update_plan opens one that only completes with the turn, and would mute the watchdog
     const id = typeof e.item?.id === "string" && CODEX_TOOL_ITEMS.has(e.item.type) ? e.item.id : null;
     const open = e.type === "item.started" ? true : e.type === "item.completed" ? false : null;
+    const activity = codexActivity(e);
     return {
       ...(f.thread ? { thread: f.thread } : {}),
       ...(id !== null && open !== null ? { item: { id, open } } : {}),
       ...(e.type === "turn.completed" ? { tokens: f.tokens } : {}),
       lastEvent: f.lastEvent ?? undefined,
-      ...(codexActivity(e) ? { activity: codexActivity(e) } : {}),
+      ...(activity ? { activity } : {}),
       ...(f.turnFailed ? { failure: f.failure ?? "turn failed" } : {}),
       ...(f.limit ? { limit: true } : {}),
       ...(f.tooOld ? { tooOld: true } : {}),

package/src/adapters/cursor/index.ts

@@ -100,7 +100,13 @@ function plan(r: RunRequest): SpawnPlan {
 }
 
 async function listModels(): Promise<DiscoveredModel[]> {
-  const r = await runCli(cursorBin(), ["models"], { ...cursorShell, env: { NO_OPEN_BROWSER: "1" } });
+  const bin = cursorBin();
+  // an `agent` that is not Cursor's (grok's, say) is never asked for models: nothing to list, as when absent
+  if (bin === "agent") {
+    const v = await runCli(bin, ["--version"], cursorShell).catch(() => null);
+    if (!v || !CURSOR_VERSION.test(v.out)) return [];
+  }
+  const r = await runCli(bin, ["models"], { ...cursorShell, env: { NO_OPEN_BROWSER: "1" } });
   return r?.ok ? parseCursorModels(r.out) : [];
 }