cawdev-cli 0.9.0 → 1.0.0-beta

package/runner/runner.mjs

@@ -15,7 +15,7 @@ import { spawn } from 'node:child_process';
 import {
   access, copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile,
 } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 
 import { join, resolve } from 'node:path';
 import { describeTurn, totalsOf } from '../lib/usage.mjs';
@@ -27,7 +27,9 @@ import { codeMapOf } from '../lib/code-map.mjs';
 import { usageLimitOf } from '../lib/usage-limit.mjs';
 import { TranscriptBatch } from '../lib/transcript-batch.mjs';
 import { parseUsage } from '../lib/usage-report.mjs';
-import { qualified, writeRunPlugin } from '../lib/run-plugin.mjs';
+import {
+  ANTIGRAVITY_EXPERTS_PLUGIN, qualified, writeAntigravityExpertsPlugin, writeRunPlugin,
+} from '../lib/run-plugin.mjs';
 import { AI_CONFIG, harnessPrompt, readRepoConfig } from '../lib/harness-prompt.mjs';
 import { loadToken, storedUrls } from './token-store.mjs';
 import {
@@ -35,6 +37,7 @@ import {
 } from '../lib/stage-tools.mjs';
 import { capabilityIn, describeCall } from '../lib/tool-line.mjs';
 import { findSecret } from '../lib/secrets.mjs';
+import { cliVersion, isBelow } from '../lib/version.mjs';
 
 // --- configuration -----------------------------------------------------------
 
@@ -72,7 +75,7 @@ const DEFAULTS = {
    * cure. A default that is simply the thing this daemon exists to run costs
    * nothing and cannot be missing.
    */
-  agentCommand: 'claude',
+  agentCommands: ['claude'],
   /**
    * Verified against Claude Code 2.1.247.
    *
@@ -337,15 +340,22 @@ const DEFAULTS = {
   usageSeconds: 600,
 };
 
-async function readConfig() {
+/** The `--config` path this process was started with, or the default. */
+function configPathFromArgv() {
   const index = process.argv.indexOf('--config');
-  const path = index === -1 ? 'runner.config.json' : process.argv[index + 1];
+  return index === -1 ? 'runner.config.json' : process.argv[index + 1];
+}
+
+async function readConfig() {
+  const path = configPathFromArgv();
 
   let file = {};
+  let fromFile = false;
   try {
     file = JSON.parse(await readFile(path, 'utf8'));
+    fromFile = true;
   } catch (failure) {
-    if (index !== -1) {
+    if (process.argv.includes('--config')) {
       throw new Error(`Could not read ${path}: ${failure.message}`);
     }
     // No config file is fine when everything comes from the environment.
@@ -369,7 +379,7 @@ async function readConfig() {
      */
     token: process.env.CAWDEV_TOKEN ?? file.token ?? (await loadToken(url)),
     name: process.env.CAWDEV_RUNNER_NAME ?? file.name ?? DEFAULTS.name,
-    agentCommand: process.env.CAWDEV_AGENT_COMMAND ?? file.agentCommand ?? DEFAULTS.agentCommand,
+    agentCommands: file.agentCommands ?? (file.agentCommand ? [file.agentCommand] : null) ?? (process.env.CAWDEV_AGENT_COMMAND ? process.env.CAWDEV_AGENT_COMMAND.split(',').map(s => s.trim()) : null) ?? DEFAULTS.agentCommands,
     // Which projects this runner serves, and where their working copies are.
     projects: normaliseProjects(file.projects ?? {}),
     /**
@@ -391,6 +401,14 @@ async function readConfig() {
     idleSeconds: file.idleSeconds ?? DEFAULTS.idleSeconds,
     usageSeconds: file.usageSeconds ?? DEFAULTS.usageSeconds,
     sessionExitSeconds: file.sessionExitSeconds ?? DEFAULTS.sessionExitSeconds,
+    /**
+     * The FILE this daemon booted from, absolute, or null when everything
+     * came from the environment — R288. Published on the control socket so
+     * the attached terminal's `c` key edits the config this process is
+     * actually running on and not one it guessed at. Absolute because the
+     * daemon's cwd is not the terminal's: `cawdev` starts it detached.
+     */
+    configPath: fromFile ? resolve(path) : null,
   };
 
   if (!config.token) {
@@ -783,50 +801,59 @@ async function readUsage(config) {
   if (!config.usageSeconds || !config.runnerId) {
     return;
   }
-  const said = await new Promise((resolve) => {
-    let out = '';
-    const child = spawn(config.agentCommand, ['-p', '/usage', '--output-format', 'text'], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    // Bounded, because this runs on a timer for the life of the daemon: a CLI
-    // that hangs here must not accumulate a process per tick.
-    const giveUp = setTimeout(() => {
-      try {
-        child.kill('SIGTERM');
-      } catch { /* already gone */ }
-      resolve('');
-    }, 60_000);
-    giveUp.unref?.();
-    child.stdout.on('data', (chunk) => (out += chunk));
-    child.stderr.on('data', (chunk) => (out += chunk));
-    child.on('error', () => {
-      clearTimeout(giveUp);
-      resolve('');
-    });
-    child.on('close', () => {
-      clearTimeout(giveUp);
-      resolve(out);
+  
+  const allWindows = [];
+  
+  for (const agentCommand of config.agentCommands) {
+    const said = await new Promise((resolve) => {
+      let out = '';
+      const child = spawn(agentCommand, ['-p', '/usage', '--output-format', 'text'], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+      // Bounded, because this runs on a timer for the life of the daemon: a CLI
+      // that hangs here must not accumulate a process per tick.
+      const giveUp = setTimeout(() => {
+        try {
+          child.kill('SIGTERM');
+        } catch { /* already gone */ }
+        resolve('');
+      }, 60_000);
+      giveUp.unref?.();
+      child.stdout.on('data', (chunk) => (out += chunk));
+      child.stderr.on('data', (chunk) => (out += chunk));
+      child.on('error', () => {
+        clearTimeout(giveUp);
+        resolve('');
+      });
+      child.on('close', () => {
+        clearTimeout(giveUp);
+        resolve(out);
+      });
     });
-  });
 
-  const windows = parseUsage(said);
-  if (!windows.length) {
+    const windows = parseUsage(said);
+    for (const each of windows) {
+      allWindows.push({
+        provider: agentCommand.endsWith('agy') ? 'agy' : 'claude',
+        window: each.kind,
+        model: each.model,
+        percentUsed: each.percent,
+        // The counts stay null. The CLI gives a percentage and no totals, and
+        // inventing `used: 25, limit: 100` would put units on a page that the
+        // provider never stated — R20's rule, one level down.
+        used: null,
+        limit: null,
+        resetsAt: each.resetsAt ? each.resetsAt.toISOString() : null,
+      });
+    }
+  }
+
+  if (!allWindows.length) {
     return;
   }
   await api(config, `/api/runners/${config.runnerId}/limits`, {
     method: 'POST',
-    body: windows.map((each) => ({
-      provider: 'claude',
-      window: each.kind,
-      model: each.model,
-      percentUsed: each.percent,
-      // The counts stay null. The CLI gives a percentage and no totals, and
-      // inventing `used: 25, limit: 100` would put units on a page that the
-      // provider never stated — R20's rule, one level down.
-      used: null,
-      limit: null,
-      resetsAt: each.resetsAt ? each.resetsAt.toISOString() : null,
-    })),
+    body: allWindows,
   }).catch((failure) => log(`  could not report usage: ${failure.message}`));
 }
 
@@ -5888,6 +5915,40 @@ async function spawnAgent(config, run, runToken, cwd, baseCommit, workspace, res
   // narrowed by what the laptop already allows, and this is the laptop being
   // told — by its own operator, through a page it opted in to — to allow more.
   const granted = await machineRules(config);
+
+  // R147. Which of the run's experts THIS process may reach — moved ahead of
+  // the agy branch below (R279) so BOTH spawn paths narrow the same way: a
+  // read-only stage is handed only the experts that can change nothing.
+  // `readOnlyExpert` judges by the frontmatter the plugin is written from, so
+  // the plugin loaded, the delegation tool allowed, and the list the session
+  // is told about all agree. Everything else, and every process with no
+  // lifecycle, gets them all.
+  const readOnlyStage = Boolean(stage) && ['PLAN', 'VERIFY', 'MEMORY'].includes(stage.stage);
+  const stageExperts = readOnlyStage ? expertAgents.filter(readOnlyExpert) : expertAgents;
+  // R161. From `stageExperts` and NEVER from `expertAgents` — see the note
+  // above; an expert a read-only stage cannot reach must not be required here.
+  const cannotDelegate = readOnlyStage && expertAgents.length && !stageExperts.length
+    ? [`The ${stage.stage} stage holds nothing that can change anything, and none of this `
+      + "project's experts is read-only, so none can be reached from it. They are reached "
+      + 'from IMPLEMENT and TEST.']
+    : undefined;
+
+  // Which CLI answers this run — R276's follow-on made real. A staged run
+  // carries the resolved choice on its stage (`stage.agent`, from
+  // `WorkflowService.forRun`); anything else carries it on the run itself
+  // now (`run.agent`, from `RunService.agentFor`) — both fall back to Claude
+  // Code, exactly as every run did before either existed. Antigravity's
+  // shape differs enough (no --mcp-config, no --allowedTools, no --resume —
+  // checked against the real CLI by hand) that it is not this function's
+  // Claude-specific machinery with a different binary name; it is
+  // `spawnAntigravity`, entirely.
+  if ((stage?.agent ?? run.agent) === 'agy') {
+    const agyCmd = config.agentCommands.find((each) => each.endsWith('agy')) ?? 'agy';
+    return spawnAntigravity(config, run, runToken, cwd, baseCommit, resume, projectServers,
+      skills, stageExperts, cannotDelegate, instincts, briefing, plan, lifecycle, stage, carried,
+      agyCmd, granted);
+  }
+
   const ceiling = [
     ...(config.grantable ?? []),
     ...(config.projects[run.projectSlug]?.grantable ?? []),
@@ -5992,13 +6053,8 @@ async function spawnAgent(config, run, runToken, cwd, baseCommit, workspace, res
   };
   await writeFile(mcpConfigPath, JSON.stringify({ mcpServers }, null, 2));
 
-  // R147. Which of the run's experts THIS process may reach. A read-only stage
-  // is handed only the experts that can change nothing — `readOnlyExpert`
-  // judges by the frontmatter the plugin below is written from — so the plugin
-  // it loads, the `Agent` it is allowed and the list it is told about all
-  // agree. Everything else, and every process with no lifecycle, gets them all.
-  const readOnlyStage = Boolean(stage) && ['PLAN', 'VERIFY', 'MEMORY'].includes(stage.stage);
-  const stageExperts = readOnlyStage ? expertAgents.filter(readOnlyExpert) : expertAgents;
+  // R147/R279. `readOnlyStage` and `stageExperts` are computed once, ahead of
+  // the agy branch above, so both spawn paths narrow the same way.
 
   // R161. What this project said had to be used, by the name a transcript line
   // carries.
@@ -6151,11 +6207,7 @@ async function spawnAgent(config, run, runToken, cwd, baseCommit, workspace, res
       description: each.description ?? each.name ?? each.key,
       required: each.mode === 'REQUIRED',
     })),
-    cannotDelegate: readOnlyStage && expertAgents.length && !stageExperts.length
-      ? [`The ${stage.stage} stage holds nothing that can change anything, and none of this `
-        + "project's experts is read-only, so none can be reached from it. They are reached "
-        + 'from IMPLEMENT and TEST.']
-      : undefined,
+    cannotDelegate,
     // R124. Null on everything but an implementation phase whose card has been
     // planned, which the PLATFORM decides — the runner does not work out which
     // runs deserve a plan, it carries the one it was handed.
@@ -6196,6 +6248,14 @@ async function spawnAgent(config, run, runToken, cwd, baseCommit, workspace, res
           writesItsOwnCard: writesItsOwnCard(run) })]
     : null;
 
+  // Reaching here at all means Claude Code answers this run — the branch at
+  // the top of this function sent Antigravity to spawnAntigravity instead.
+  // Matched against what this machine actually lists (`config.agentCommands`)
+  // by the same suffix rule `readUsage` uses the other way around, so a
+  // machine whose list is agy-first still gets Claude Code's own command.
+  const agentCmd = config.agentCommands.find((each) => !each.endsWith('agy'))
+    ?? config.agentCommands[0] ?? 'claude';
+
   const args = [
     '--mcp-config',
     mcpConfigPath,
@@ -6210,10 +6270,10 @@ async function spawnAgent(config, run, runToken, cwd, baseCommit, workspace, res
           skills)]
       : argsForProfile(agentArgs, run.profile, run, expertAgents, skills))),
   ];
-  log(`  spawning: ${config.agentCommand} ${args.join(' ')} (prompt on stdin)`);
+  log(`  spawning: ${agentCmd} ${args.join(' ')} (prompt on stdin)`);
 
   return new Promise((resolvePromise) => {
-    const child = spawn(config.agentCommand, args, {
+    const child = spawn(agentCmd, args, {
       cwd,
       // Its own process group, so cancelling can take down the whole tree
       // rather than leaving orphaned children behind.
@@ -6751,6 +6811,556 @@ async function spawnAgent(config, run, runToken, cwd, baseCommit, workspace, res
   });
 }
 
+// --- Antigravity ('agy') ------------------------------------------------------
+
+// Serializes agy's global registry mutations — MCP servers AND, since R279,
+// installed plugins. Claude Code's --mcp-config and --plugin-dir are each a
+// file or directory this daemon writes and hands to one process; agy has no
+// per-invocation equivalent for either, only two machine-wide registries
+// (`agy mcp add/remove` and `agy plugin install/uninstall`, both under
+// ~/.gemini) shared by every agy call on this machine. Both are
+// re-registered before each spawn — the MCP token is fresh per run, and a
+// different project may have turned different experts on — and ONE lock
+// serializes both, because they are the same kind of hazard: two concurrent
+// agy spawns racing on the same machine-wide state, v1's answer to a problem
+// Claude Code's own design does not have.
+let agyRegistryLock = Promise.resolve();
+function withAgyRegistryLock(work) {
+  const next = agyRegistryLock.then(work, work);
+  agyRegistryLock = next.then(() => {}, () => {});
+  return next;
+}
+
+/** One `agy` subcommand, run to completion. Not a session — just its exit and output. */
+function runAgyCli(agyCmd, args) {
+  return new Promise((resolve) => {
+    let out = '';
+    const child = spawn(agyCmd, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    child.stdout.on('data', (chunk) => (out += chunk));
+    child.stderr.on('data', (chunk) => (out += chunk));
+    child.on('error', () => resolve({ code: -1, out }));
+    child.on('close', (code) => resolve({ code, out }));
+  });
+}
+
+/**
+ * What Antigravity currently has registered, read rather than asked for:
+ * `agy mcp list` has no machine-readable form, and the registry is one
+ * small JSON file at a fixed, undocumented path. Read-only, and tolerant of
+ * that path changing under a future CLI version — an empty list here costs
+ * a stale entry left behind, never a wrong removal.
+ */
+async function currentAntigravityMcpNames() {
+  try {
+    const raw = await readFile(join(homedir(), '.gemini', 'config', 'mcp_config.json'), 'utf8');
+    return Object.keys(JSON.parse(raw)?.mcpServers ?? {});
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Registers cawdev's own MCP server, this checkout's own (its `.mcp.json`),
+ * and R76's registry entries this run was handed — R278, the same three
+ * Claude Code's `--mcp-config` carries. R105's skills are NOT here: those
+ * are not servers, see `inlinedSkillsFor`. Experts are NOT here either, but
+ * for the opposite reason R278 first claimed — that card said agy "has
+ * nothing shaped like `--plugin-dir`, only its own, unrelated subagent
+ * system", and that was wrong, unverified when it was written. Checked by
+ * hand for R279: `agy plugin install <directory>` reads the very same
+ * `agents/*.md` shape, and `invoke_subagent` really does reach one — see
+ * `registerAntigravityExperts`, which does for experts what this does for
+ * servers, under the same lock.
+ *
+ * Every name but `cawdev` itself is prefixed `cawdev-server-` — on two
+ * sides of the same reason: this must never touch an MCP server Dali
+ * registered with agy himself for something unrelated, and a stale entry
+ * an EARLIER run left behind (a different project, a different registry)
+ * has to be findable by that same prefix so it can be removed before the
+ * new set goes in. Confirmed by hand that this is safe to do at all: a
+ * registered server inherits the daemon's own environment (`PATH`, `HOME`,
+ * ...) same as any spawned child, so `--env` only has to carry what a
+ * server adds on top of that — not `...process.env` the way the
+ * file-based `--mcp-config` write does.
+ */
+function registerAntigravityMcp(agyCmd, {
+  url, token, projectSlug, cwd, serverPath, repoServers, attachedServers,
+}) {
+  return withAgyRegistryLock(async () => {
+    const wanted = new Map();
+    wanted.set('cawdev', {
+      command: process.execPath,
+      args: [serverPath],
+      env: {
+        CAWDEV_URL: url, CAWDEV_TOKEN: token, CAWDEV_PROJECT: projectSlug, CAWDEV_WORKSPACE: cwd,
+      },
+    });
+    // This checkout's own `.mcp.json`.
+    for (const [name, def] of Object.entries(repoServers ?? {})) {
+      wanted.set(`cawdev-server-${name}`, {
+        command: def.command, args: def.args ?? [], env: def.env ?? {},
+      });
+    }
+    // R76's registry, via `resolveSkills` — `skill` here is what that
+    // function calls its own parameter, from a rename that came after it
+    // was written; the shape is `RunMcpServerView`, a server, not a SKILL.md.
+    for (const { skill, local } of attachedServers ?? []) {
+      wanted.set(`cawdev-server-${skill.key}`, {
+        command: skill.command, args: skill.args, env: local.env ?? {},
+      });
+    }
+
+    const stale = (await currentAntigravityMcpNames()).filter((name) => (
+      name === 'cawdev' || name.startsWith('cawdev-server-')
+    ) && !wanted.has(name));
+    for (const name of stale) {
+      await runAgyCli(agyCmd, ['mcp', 'remove', name]);
+    }
+
+    let ok = true;
+    for (const [name, def] of wanted) {
+      // Removed first — agy mcp add UPDATES an existing name in place, but
+      // a run's token changes every time and "updates" is exactly the kind
+      // of word worth not trusting without having watched it happen.
+      await runAgyCli(agyCmd, ['mcp', 'remove', name]);
+      // Flags before <name> or agy silently absorbs them into the spawned
+      // command's own argv instead of its env — confirmed by hand: the same
+      // --env flags placed after the name landed in mcp_config.json's
+      // `args`, never in an `env` object. `agy mcp add --help`'s own note
+      // ("Flags must come before <name>") says this; it just doesn't reject
+      // the wrong order, it mis-files it.
+      const envArgs = Object.entries(def.env).flatMap(([key, value]) => ['--env', `${key}=${value}`]);
+      const added = await runAgyCli(agyCmd,
+        ['mcp', 'add', ...envArgs, name, def.command, ...def.args]);
+      if (added.code !== 0) {
+        ok = false;
+      }
+    }
+    return ok;
+  });
+}
+
+/**
+ * What Antigravity currently has installed, read the same way
+ * `currentAntigravityMcpNames` reads its registrations: `agy plugin list`
+ * has no machine-readable form either, and `import_manifest.json` is the
+ * file it renders from (confirmed by hand: installing and listing a probe
+ * plugin round-tripped through exactly this file). Tolerant of the same
+ * failure for the same reason — an empty list here costs a stale plugin
+ * left behind, never a wrong uninstall.
+ */
+async function currentAntigravityPluginNames() {
+  try {
+    const raw = await readFile(join(homedir(), '.gemini', 'config', 'import_manifest.json'), 'utf8');
+    const imports = JSON.parse(raw)?.imports;
+    return Array.isArray(imports) ? imports.map((each) => each.name).filter(Boolean) : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Installs this run's experts as an Antigravity plugin — R279, doing for
+ * `agents/*.md` what `registerAntigravityMcp` does for servers, and under
+ * the SAME lock: `agy plugin install` is machine-wide state exactly like
+ * `agy mcp add` is, one project's experts at a time on this machine.
+ *
+ * <p>Always removes whatever `ANTIGRAVITY_EXPERTS_PLUGIN` currently holds
+ * first — never trusting `agy plugin install` to update a name in place,
+ * the same caution `registerAntigravityMcp` already takes with `agy mcp
+ * add`, unverified here and not worth finding out the hard way — then
+ * installs fresh only when this run was handed experts at all. Takes
+ * `stageExperts`, never raw `expertAgents`: R147's read-only-stage
+ * narrowing has to hold for Antigravity exactly as it does for Claude Code,
+ * and the caller is where that narrowing already happened.
+ *
+ * <p>Failing to install is NOT failed the way a failed MCP registration is
+ * — an expert is optional delegation, not plumbing a report/ask_user call
+ * depends on, so the caller logs it and carries on without one rather than
+ * failing the run.
+ */
+function registerAntigravityExperts(agyCmd, { expertAgents }) {
+  return withAgyRegistryLock(async () => {
+    const stale = (await currentAntigravityPluginNames())
+      .filter((name) => name === ANTIGRAVITY_EXPERTS_PLUGIN);
+    for (const name of stale) {
+      await runAgyCli(agyCmd, ['plugin', 'uninstall', name]);
+    }
+    if (!expertAgents.length) {
+      return true;
+    }
+    const pluginDir = await mkdtemp(join(tmpdir(), 'cawdev-agy-experts-'));
+    try {
+      const root = await writeAntigravityExpertsPlugin(pluginDir, expertAgents);
+      const installed = await runAgyCli(agyCmd, ['plugin', 'install', root]);
+      return installed.code === 0;
+    } finally {
+      await rm(pluginDir, { recursive: true, force: true });
+    }
+  });
+}
+
+/**
+ * The prompt's half of R279 — telling the session which experts it has and
+ * how to reach one, the way `harnessPrompt`'s own experts section does for
+ * Claude Code. NOT folded into `harnessPrompt` itself: that function's
+ * wording ("delegate with the `Agent` tool, `subagent_type` exactly as
+ * written") names a Claude Code tool, and agy's is `invoke_subagent` — the
+ * same split `inlinedSkillsFor` already makes for skills, for the same
+ * reason.
+ *
+ * <p>`experts` here must already be `stageExperts` — narrowed for a
+ * read-only stage — and, when nothing was installed for this run
+ * (`registerAntigravityExperts` failed, or there was nothing to install),
+ * an empty list: advertising an expert the plugin step could not actually
+ * install would tell the session it can reach something it cannot.
+ */
+function expertsBlockFor(experts, cannotDelegate) {
+  const list = Array.isArray(experts) ? experts : [];
+  if (!list.length) {
+    return cannotDelegate?.length ? `\n\n## Experts\n\n${cannotDelegate.join(' ')}` : '';
+  }
+  const must = list.filter((each) => each.mode === 'REQUIRED');
+  const may = list.filter((each) => each.mode !== 'REQUIRED');
+  const entry = (each) => `- **${each.key}** — ${each.description ?? each.name ?? each.key}`;
+  const section = (heading, rows) => rows.length
+    ? `## ${heading}\n\n${rows.map(entry).join('\n')}`
+    : '';
+  return '\n\n' + [
+    section('Experts you MUST use — delegate with `invoke_subagent`, naming it exactly as '
+      + 'written below, before this stage is finished', must),
+    section("Experts — delegate with `invoke_subagent` whenever one's description fits the "
+      + 'step you are on', may),
+  ].filter(Boolean).join('\n\n');
+}
+
+/**
+ * R105's skills, whole, for a CLI with no `Skill` tool to fetch one lazily.
+ *
+ * <p>Claude Code sees a name and a description in its harness prompt and
+ * loads the `body` — the actual SKILL.md instructions — only if the model
+ * invokes it, through a plugin directory this agent has no equivalent way
+ * to be handed. There is nothing to invoke here, so the body is INLINED
+ * up front instead: every skill this run was handed, whether or not the
+ * model ends up needing it. Larger prompt, no lazy loading — the honest
+ * trade for a CLI with no mechanism to defer it.
+ */
+function inlinedSkillsFor(skills) {
+  const list = Array.isArray(skills) ? skills : [];
+  if (!list.length) {
+    return '';
+  }
+  const must = list.filter((each) => each.mode === 'REQUIRED');
+  const may = list.filter((each) => each.mode !== 'REQUIRED');
+  const entry = (each) => `### ${each.name ?? each.key}\n\n${each.description ?? ''}\n\n${each.body ?? ''}`
+    .trim();
+  const section = (heading, rows) => rows.length
+    ? `## ${heading}\n\n${rows.map(entry).join('\n\n')}`
+    : '';
+  return '\n\n' + [
+    section('Skills you MUST use — this project requires each of these; use one before this '
+      + 'stage is finished', must),
+    section('Skills — use one when its description fits the work', may),
+  ].filter(Boolean).join('\n\n');
+}
+
+/**
+ * Antigravity's shape — one-shot per turn, not a long-lived process.
+ *
+ * Checked against the real CLI by hand rather than guessed at: no
+ * `--mcp-config` (`flags provided but not defined`), no `--allowedTools` (no
+ * per-tool allow-list exists at all), no `--resume <id>` (`--conversation
+ * <id>` instead). `--mode plan` denies MCP tool calls outright — including
+ * calls to cawdev's own `report`/`ask_user` — so even a read-only run needs
+ * `--dangerously-skip-permissions` just to talk to the platform. There is no
+ * narrower option on this CLI today.
+ *
+ * So: this refuses to run at all unless the machine has granted "everything"
+ * — R126, the same switch Claude Code's `bypassPermissions` already stands
+ * behind — and every call that does run gets `--dangerously-skip-permissions`
+ * unconditionally, coding or not. No per-project tool-rule narrowing, and no
+ * live mid-run prompting (R22's "keep stdin open" assumes a process that
+ * stays up between turns; agy's `-p` exits after one). A STAGE is already
+ * one process per R112, so stages fit this shape without changing it — a
+ * follow-up typed into a RUNNING session does not reach it yet, and that gap
+ * is not silently papered over: `sendPrompt` still only writes to a live
+ * child's stdin, which this never opens.
+ *
+ * R278: this checkout's own MCP servers and R76's registry ARE reached now,
+ * the way `registerAntigravityMcp` describes, and R105's skills are
+ * inlined whole (`inlinedSkillsFor`) rather than reached at all — there is
+ * nothing on this CLI shaped like Claude Code's `Skill` tool to fetch one
+ * lazily.
+ *
+ * R279: expert agents ARE reached too, now — R278's claim that agy "has
+ * nothing shaped like `--plugin-dir`" was wrong, and unverified when it was
+ * written. `agy plugin install <directory>` reads the same `agents/*.md`
+ * shape Claude Code's plugin does; `registerAntigravityExperts` installs
+ * this run's `stageExperts` under it, and `invoke_subagent` is the real
+ * tool a session delegates through — confirmed end-to-end by hand, a probe
+ * agent installed, invoked by name, and its answer returned correctly.
+ */
+async function spawnAntigravity(config, run, runToken, cwd, baseCommit, resume, projectServers,
+    skills, stageExperts, cannotDelegate, instincts, briefing, plan, lifecycle, stage, carried,
+    agyCmd, granted) {
+  if (!granted.everything) {
+    const summary = 'This machine has not allowed everything, and Antigravity has no narrower '
+      + 'permission mode — no per-tool allow-list exists on it, and even reading needs it. Turn '
+      + 'on "allow everything" for this machine, or use Claude Code for this run.';
+    log(`  refusing to spawn Antigravity: ${summary}`);
+    await finish(config, run, 'FAILED', summary);
+    return stage ? { code: -1, signal: null, text: summary, turnEnded: false } : undefined;
+  }
+
+  // Created here rather than down with the spawn — the notes below (what
+  // attached, what a project asked for that this machine refused, what an
+  // index build said) belong on the run the moment they are known, same as
+  // Claude Code's path: a person watching should not have to wait for the
+  // one-shot call to finish before finding out something never loaded.
+  const transcript = new Transcript(config, run);
+
+  // Two DIFFERENT things cawdev calls capabilities, reached two different
+  // ways even for Claude Code — R278 gives Antigravity both, each the way
+  // its own shape allows:
+  //
+  // `projectServers` (R76's registry, `claimed.mcpServers` — the parameter
+  // is misleadingly named after an old rename, not this checkout's own
+  // `.mcp.json`) and `repoServers` (that actual file, read fresh) are both
+  // real MCP SERVERS — a command line cawdev already knows how to run.
+  // `resolveSkills` (despite its name — R76 called these "skills" before
+  // R105 split the word) turns the registry half into the same shape.
+  // Both go through `registerAntigravityMcp`, the same way cawdev's own
+  // server does.
+  //
+  // `skills` (R105, `claimed.skills`) is NOT a server at all — it is a
+  // SKILL.md's `body`, markdown Claude Code loads lazily through its own
+  // `Skill` tool when the model invokes it by name, bundled into a plugin
+  // directory this agent has no equivalent way to be handed
+  // (`--plugin-dir`, same gap experts have). There is nothing to invoke
+  // here to fetch it later, so it is not offered as something reachable —
+  // it is INLINED below, in full, up front.
+  const serverPath = config.mcpServerPath ?? new URL('../mcp/server.mjs', import.meta.url).pathname;
+  const repoServers = await projectMcpServers(cwd);
+  const { attached: attachedServers, notes: serverNotes } =
+    await resolveSkills(config, run, cwd, baseCommit, projectServers);
+  if (attachedServers.length) {
+    log(`  loading ${attachedServers.length} MCP server(s)`);
+  }
+  for (const line of serverNotes) {
+    log(`  ${line}`);
+    transcript.push({ kind: 'SYSTEM', body: line });
+  }
+  const registered = await registerAntigravityMcp(agyCmd, {
+    url: config.url, token: runToken, projectSlug: run.projectSlug, cwd, serverPath,
+    repoServers, attachedServers,
+  });
+  if (!registered) {
+    const summary = 'Could not register this session\'s MCP servers with Antigravity (`agy mcp '
+      + 'add` failed) — without cawdev\'s own this session cannot report, ask a question, or '
+      + 'read the roadmap.';
+    log(`  ${summary}`);
+    await finish(config, run, 'FAILED', summary);
+    return stage ? { code: -1, signal: null, text: summary, turnEnded: false } : undefined;
+  }
+
+  // R279. Unlike the MCP registration above, a failed expert install does
+  // NOT fail the run — an expert is optional delegation, not the plumbing a
+  // report/ask_user call depends on. `usableExperts` drops to empty so the
+  // prompt below never advertises an expert that was not actually
+  // installed; `stageExperts` itself already carries R147's read-only-stage
+  // narrowing from the caller.
+  if (stageExperts.length) {
+    log(`  loading ${stageExperts.length} expert(s)`);
+  }
+  const expertsRegistered = await registerAntigravityExperts(agyCmd, { expertAgents: stageExperts });
+  if (!expertsRegistered && stageExperts.length) {
+    const note = 'Could not install this project\'s experts into Antigravity (`agy plugin '
+      + 'install` failed) — continuing without delegation.';
+    log(`  ${note}`);
+    transcript.push({ kind: 'SYSTEM', body: note });
+  }
+  const usableExperts = expertsRegistered ? stageExperts : [];
+
+  // Same assembly as Claude Code's — promptFor, harnessPrompt, stagePrompt
+  // are all agent-agnostic. Both experts and skills are kept OUT of
+  // harnessPrompt's own `experts`/`skills` params and handled entirely
+  // below instead — its wording ("the `Agent` tool", "the `Skill` tool")
+  // names tools this CLI does not have. `expertsBlockFor` and
+  // `inlinedSkillsFor` are agy's own wording for the same two ideas.
+  const harness = harnessPrompt({
+    instincts, briefing, experts: [], skills: [], plan, lifecycle,
+    repoConfig: await readRepoConfig(cwd),
+  });
+  const skillsBlock = inlinedSkillsFor(skills);
+  const expertsBlock = expertsBlockFor(usableExperts, cannotDelegate);
+  const resuming = Boolean(resume?.agentSessionId);
+  const promptText = resuming
+    ? resume.prompt
+    : (promptFor(run) + harness + skillsBlock + expertsBlock
+      + (stage ? stagePrompt(stage, carried) : ''));
+
+  const args = ['-p', promptText, '--output-format', 'stream-json', '--dangerously-skip-permissions'];
+  if (run.model) {
+    args.push('--model', run.model);
+  }
+  if (resuming) {
+    args.push('--conversation', resume.agentSessionId);
+  }
+
+  log(`  spawning: ${agyCmd} -p <prompt omitted, ${promptText.length} chars> --output-format `
+    + `stream-json --dangerously-skip-permissions${resuming ? ` --conversation ${resume.agentSessionId}` : ''}`);
+
+  // The same live view Claude Code gets — none of this existed before, and a
+  // run that writes nothing here is a run the console and the CLI's attach
+  // both draw as a black box until the one-shot call finally returns.
+  // Confirmed by hand against the real CLI: `--output-format stream-json`
+  // gives `init` (once, carries the conversation id), `step_update` (an
+  // `agent_response` step's `text_delta` is an INCREMENTAL chunk to append,
+  // not the text so far; a `tool` step is ACTIVE with the call and DONE with
+  // `tool_info.output`), and one final `result` — the same shape
+  // `--output-format json` returns whole, just arriving a piece at a time.
+
+  return new Promise((resolvePromise) => {
+    let result = null;
+    let err = '';
+    let buffer = '';
+    const child = spawn(agyCmd, args, {
+      cwd,
+      // Its own process group — see the same choice on the Claude Code path.
+      detached: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    child.cawdevProjectSlug = run.projectSlug;
+    // The existing cancellation sweep (`reapCancelled`) reads this map by
+    // run id and SIGTERMs whatever is in it — true for any child, so a
+    // cancelled Antigravity run stops exactly the way a cancelled Claude
+    // Code one does, with no code of its own.
+    running.set(run.id, child);
+
+    // stream-json arrives in chunks that split mid-line, same as Claude
+    // Code's — buffer until a full line rather than assuming one chunk is
+    // one event.
+    child.stdout.on('data', (chunk) => {
+      buffer += chunk;
+      let newline;
+      while ((newline = buffer.indexOf('\n')) !== -1) {
+        const line = buffer.slice(0, newline);
+        buffer = buffer.slice(newline + 1);
+        if (!line.trim()) continue;
+        let event;
+        try {
+          event = JSON.parse(line);
+        } catch {
+          // A stray non-protocol line on stdout — shown rather than dropped,
+          // the same call `linesOf` makes for Claude Code's unparseable ones.
+          transcript.push({ kind: 'SYSTEM', body: line.slice(0, 4000) });
+          continue;
+        }
+        if (event.event === 'init') {
+          if (event.conversation_id) {
+            reportSessionId(config, run, event.conversation_id);
+          }
+          transcript.push({
+            kind: 'SYSTEM',
+            body: `session ${short(event.conversation_id)} started`
+              + (run.model ? ` on ${run.model}` : ''),
+          });
+        } else if (event.event === 'step_update') {
+          const step = event.step_update ?? {};
+          if (step.step_type === 'agent_response' && step.text_delta) {
+            transcript.push({ kind: 'ASSISTANT', body: step.text_delta });
+          } else if (step.step_type === 'tool' && step.state === 'ACTIVE') {
+            transcript.push({
+              kind: 'TOOL',
+              body: `${step.tool_name}(${JSON.stringify(step.tool_info?.parameters ?? {})})`,
+            });
+          } else if (step.step_type === 'tool' && step.state === 'DONE') {
+            transcript.push({
+              kind: 'TOOL_RESULT',
+              body: String(step.tool_info?.output ?? '(no output)').slice(0, 4000),
+            });
+          } else if (step.step_type === 'subagent' && step.state === 'ACTIVE') {
+            // R279. Delegation is its OWN step_type, `subagent` — confirmed
+            // by hand it is not `tool`, which is why this needed its own
+            // branch rather than falling into the one above by accident.
+            // No `tool_info` here, only `subagent_info.subagents[]`; the
+            // sub-conversation's own transcript is a local file this
+            // process never reads, so the parent's own narration (an
+            // ordinary `agent_response`) is what carries the answer back to
+            // this transcript, same as it already did in the run that
+            // proved this end to end.
+            const who = (step.subagent_info?.subagents ?? [])
+              .map((each) => each.type_name).filter(Boolean).join(', ') || 'a subagent';
+            const prompt = step.subagent_info?.subagents?.[0]?.initial_prompt ?? '';
+            transcript.push({ kind: 'TOOL', body: `invoke_subagent(${who}): ${prompt}` });
+          } else if (step.step_type === 'subagent' && step.state === 'DONE') {
+            const who = (step.subagent_info?.subagents ?? [])
+              .map((each) => each.type_name).filter(Boolean).join(', ') || 'a subagent';
+            transcript.push({ kind: 'TOOL_RESULT', body: `${who} finished` });
+          }
+          // user_input steps carry no text of their own — the prompt is
+          // already shown as "What it was asked", from run.openingPrompt.
+        } else if (event.event === 'result') {
+          result = event.result;
+          if (result?.usage) {
+            reportUsage(config, run, {
+              tokensIn: Number(result.usage.input_tokens) || 0,
+              tokensOut: Number(result.usage.output_tokens) || 0,
+            });
+          }
+        }
+      }
+    });
+    child.stderr.on('data', (chunk) => {
+      const text = String(chunk).trim();
+      if (text) {
+        log(`  agent stderr: ${text.slice(0, 400)}`);
+      }
+      err += chunk;
+    });
+
+    child.on('error', async (failure) => {
+      running.delete(run.id);
+      const summary = `Could not spawn Antigravity: ${failure.message}`;
+      await transcript.flush();
+      await finish(config, run, 'FAILED', summary);
+      resolvePromise(
+        stage ? { code: -1, signal: null, text: summary, turnEnded: false } : undefined);
+    });
+
+    child.on('close', async (code) => {
+      running.delete(run.id);
+      await transcript.flush();
+      const text = result?.response
+        || (result?.denied_actions?.length
+          ? `Antigravity denied an action it needed and stopped: `
+            + result.denied_actions.map((each) => each.display_name ?? each.action).join(', ')
+          : null)
+        || err.trim() || 'Antigravity produced no output.';
+      // Whether the CLI ever gave back a parseable turn — this agent has no
+      // separate "the turn ended" signal the way Claude Code's stream does;
+      // getting the `result` event at all IS the turn ending, one way or
+      // the other.
+      const turnEnded = Boolean(result);
+
+      // The agent normally ends the run itself with report(done|blocked),
+      // through the same cawdev MCP server Claude Code calls — this only
+      // catches a call that produced nothing report could act on.
+      const current = await api(config, `/api/projects/${run.projectSlug}/runs/${run.id}`)
+        .catch(() => null);
+      if (current?.live && !stage) {
+        await finish(config, run, code === 0 && result?.status === 'SUCCESS' ? 'FINISHED' : 'FAILED',
+          text);
+      }
+      // R112: not between stages — see the same line on the Claude Code path.
+      if (!stage) {
+        await settleActions(config, run, cwd);
+      }
+      resolvePromise(stage ? { code, signal: null, text, turnEnded } : undefined);
+    });
+  });
+}
+
 /**
  * Tells the platform what the CLI calls this session — R69.
  *
@@ -6853,7 +7463,7 @@ function capabilities(config) {
     // can read this can say which side refused without waiting for a run to
     // say it in a transcript.
     skills: config.skills ?? [],
-    agent: config.agentCommand,
+    agents: config.agentCommands,
     // R260. This daemon knows a claim can carry `baseBranch` — a sprint's
     // branch to cut from, open the pull request against and merge into. It
     // is the WHOLE of how the platform tells an old daemon from a new one:
@@ -6878,56 +7488,59 @@ function capabilities(config) {
  * message from a CLI it does not own is worse than one that says so and runs.
  */
 async function probePermissionPrompt(config) {
-  const said = await new Promise((done) => {
-    let text = '';
-    let child;
-    try {
-      child = spawn(config.agentCommand, ['-p', '--permission-prompt-tool', 'mcp__cawdev__approve'], {
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-    } catch (failure) {
-      return done(`could not be run: ${failure.message}`);
-    }
-    const give_up = setTimeout(() => {
+  let allGood = true;
+  for (const agentCommand of config.agentCommands) {
+    const said = await new Promise((done) => {
+      let text = '';
+      let child;
       try {
-        child.kill('SIGKILL');
-      } catch {
-        // Already gone.
+        child = spawn(agentCommand, ['-p', '--permission-prompt-tool', 'mcp__cawdev__approve'], {
+          stdio: ['pipe', 'pipe', 'pipe'],
+        });
+      } catch (failure) {
+        return done(`could not be run: ${failure.message}`);
       }
-      done(text);
-    }, 10_000);
-    give_up.unref?.();
-
-    child.stdout.on('data', (chunk) => (text += chunk));
-    child.stderr.on('data', (chunk) => (text += chunk));
-    child.on('error', (failure) => {
-      clearTimeout(give_up);
-      done(`could not be run: ${failure.message}`);
-    });
-    // `close`, not `exit`: this reads the CLI's own help to decide whether a
-    // flag exists, and a truncated read would answer "no" for a flag that is
-    // there. See git() above.
-    child.on('close', () => {
-      clearTimeout(give_up);
-      done(text);
+      const give_up = setTimeout(() => {
+        try {
+          child.kill('SIGKILL');
+        } catch {
+          // Already gone.
+        }
+        done(text);
+      }, 10_000);
+      give_up.unref?.();
+
+      child.stdout.on('data', (chunk) => (text += chunk));
+      child.stderr.on('data', (chunk) => (text += chunk));
+      child.on('error', (failure) => {
+        clearTimeout(give_up);
+        done(`could not be run: ${failure.message}`);
+      });
+      // `close`, not `exit`: this reads the CLI's own help to decide whether a
+      // flag exists, and a truncated read would answer "no" for a flag that is
+      // there. See git() above.
+      child.on('close', () => {
+        clearTimeout(give_up);
+        done(text);
+      });
+      // Nothing to say: the missing prompt is what we want it to complain about.
+      child.stdin.end();
     });
-    // Nothing to say: the missing prompt is what we want it to complain about.
-    child.stdin.end();
-  });
 
-  if (/unknown option.*permission-prompt-tool/i.test(said)) {
-    log(
-      `WARNING: ${config.agentCommand} does not accept --permission-prompt-tool. Sessions that ` +
-        `need a command nobody allowed in advance will be denied outright rather than asking ` +
-        `you. See R51 and tools/runner/README.md.`,
-    );
-    return false;
-  }
-  if (said.startsWith('could not be run:')) {
-    log(`WARNING: ${config.agentCommand} ${said}`);
-    return false;
+    if (/unknown option.*permission-prompt-tool/i.test(said)) {
+      log(
+        `WARNING: ${agentCommand} does not accept --permission-prompt-tool. Sessions that ` +
+          `need a command nobody allowed in advance will be denied outright rather than asking ` +
+          `you. See R51 and tools/runner/README.md.`,
+      );
+      allGood = false;
+    }
+    if (said.startsWith('could not be run:')) {
+      log(`WARNING: ${agentCommand} ${said}`);
+      allGood = false;
+    }
   }
-  return true;
+  return allGood;
 }
 
 async function main() {
@@ -6936,6 +7549,31 @@ async function main() {
   quiet = attaching;
 
   const config = await readConfig();
+  const myVersion = await cliVersion();
+
+  // R283. Checked before registering — a daemon too old to be safe should not
+  // get as far as claiming a run. `/api/health` is unauthenticated, so this
+  // works with the very token `readConfig` just resolved, before it has been
+  // proven good for anything else. Anything BUT "the platform said refuse"
+  // fails open: a health check that cannot be reached is not evidence the
+  // version is wrong, and refusing to boot over a network hiccup would be R2's
+  // failure mode pointed at the wrong target.
+  try {
+    const health = await api(config, '/api/health');
+    if (isBelow(myVersion, health?.minimumCliVersion)) {
+      throw new Error(
+        `This CLI is ${myVersion}; ${config.url} requires at least `
+          + `${health.minimumCliVersion}. Update it (npm i -g ./tools from an `
+          + 'updated checkout, or however this machine installs cawdev) and run '
+          + 'cawdev again.',
+      );
+    }
+  } catch (failure) {
+    if (failure.message.startsWith('This CLI is')) {
+      throw failure;
+    }
+    log(`could not check the minimum CLI version (${failure.message}); continuing`);
+  }
 
   const runner = await api(config, '/api/runners', {
     method: 'POST',
@@ -6948,6 +7586,8 @@ async function main() {
       // would not be a ceiling.
       acceptsConsoleRules: config.acceptsRulesFromConsole === true,
       grantable: JSON.stringify(declaredCeiling(config)),
+      // R283. Own version, on every registration and heartbeat — see cliVersion below.
+      cliVersion: myVersion,
     },
   });
   config.runnerId = runner.id;
@@ -6960,7 +7600,7 @@ async function main() {
   // Skipped when attaching, where the UI takes the screen a moment later and
   // a banner would only flash.
   if (!quiet) {
-    console.log(bannerLines(config, ink).join('\n'));
+    console.log(bannerLines(config, ink, myVersion).join('\n'));
   }
 
   log(`registered as "${runner.name}" (${runner.id})`);
@@ -6990,36 +7630,90 @@ async function main() {
   // than buried under a session that then fails for a reason it explains.
   await probePermissionPrompt(config);
 
+  // What this daemon SAYS it is, on every hello — R52's socket, R288's rule
+  // that it describes the current state. One object, sent as-is by
+  // `serveControl` and mutated by the SIGHUP handler below, so a terminal that
+  // attaches after a toggle reads what is true now.
+  const advertised = {
+    id: config.runnerId,
+    name: config.name,
+    url: config.url,
+    // R126. Whether this machine takes rules from the console — so the
+    // terminal only offers `M` when pressing it would do something. A key
+    // that takes an answer the platform then refuses reads as cawdev being
+    // broken, which is R58's rule about `a` applied to this one.
+    acceptsConsoleRules: config.acceptsRulesFromConsole === true,
+    projects: Object.keys(config.projects),
+    // How many checkouts each has — R62. The per-project half of R47's
+    // gate, which the bar shows as `cawdev 1/2`. Added rather than
+    // replacing `projects`: an older attach ignores it and still works,
+    // and a newer one against an older daemon simply shows a count with
+    // nothing to compare it against.
+    workspaces: Object.fromEntries(
+      Object.entries(config.projects).map(([slug, p]) => [slug, p.workspaces.length]),
+    ),
+    // R288: which agents this machine spawns, and the file it booted from,
+    // so the attached terminal's config screen can show the state of each
+    // toggle and write to the right file. `configPath` is null for a daemon
+    // run from the environment alone, and the screen says so rather than
+    // inventing a file.
+    agents: [...config.agentCommands],
+    configPath: config.configPath,
+    // R81. `cawdev` starts a daemon for you when it finds none, and
+    // quitting the UI leaves it running — it is driving sessions. A
+    // background process you did not know you started is the cost of that
+    // choice, so the goodbye has to name it precisely enough to stop, and
+    // this is the only place the number is known.
+    pid: process.pid,
+  };
+
+  // R283. `cawdev config agent enable/disable` and `cawdev config rules
+  // on/off` write the file and, if a daemon is running on it, send this — NOT
+  // a control-socket command. `control.mjs` is deliberately read-only ("no
+  // command can" change anything, so a person acting through it never gets
+  // more than their own HTTPS session already grants); SIGHUP is a unix
+  // convention for "re-read your config", asked of a process this operator
+  // already owns, so it does not open that door. Only the settings that are
+  // genuinely safe to hot-swap: `agentCommands`, `grantable` and
+  // `acceptsRulesFromConsole` are read fresh from `config` on every use
+  // (spawn, or the next heartbeat), never captured once at boot — so mutating
+  // them here is enough, with no further plumbing.
+  process.on('SIGHUP', async () => {
+    const path = configPathFromArgv();
+    try {
+      const file = JSON.parse(await readFile(path, 'utf8'));
+      const before = {
+        acceptsRulesFromConsole: config.acceptsRulesFromConsole,
+        grantable: config.grantable,
+        agentCommands: config.agentCommands,
+      };
+      config.acceptsRulesFromConsole =
+        file.acceptsRulesFromConsole ?? DEFAULTS.acceptsRulesFromConsole;
+      config.grantable = file.grantable ?? DEFAULTS.grantable;
+      config.agentCommands = file.agentCommands
+        ?? (file.agentCommand ? [file.agentCommand] : null)
+        ?? DEFAULTS.agentCommands;
+      // R288: the hello describes the current state, not the booted one — an
+      // attach opened after a toggle would otherwise offer to turn on what is
+      // already on. The same object `serveControl` sends, mutated in place.
+      advertised.acceptsConsoleRules = config.acceptsRulesFromConsole === true;
+      advertised.agents = [...config.agentCommands];
+      const changed = Object.keys(before)
+        .filter((key) => JSON.stringify(before[key]) !== JSON.stringify(config[key]));
+      log(changed.length
+        ? `re-read ${path} on SIGHUP — changed: ${changed.join(', ')}`
+        : `re-read ${path} on SIGHUP — nothing changed`);
+    } catch (failure) {
+      log(`SIGHUP re-read of ${path} failed: ${failure.message}`);
+    }
+  });
+
   // R52. Nothing here is load-bearing for running an agent, so a daemon that
   // cannot open a socket says so and carries on: trading the ability to run
   // work for the ability to watch it would be the wrong way round.
   try {
     control = await serveControl({
-      runner: {
-        id: config.runnerId,
-        name: config.name,
-        url: config.url,
-        // R126. Whether this machine takes rules from the console — so the
-        // terminal only offers `M` when pressing it would do something. A key
-        // that takes an answer the platform then refuses reads as cawdev being
-        // broken, which is R58's rule about `a` applied to this one.
-        acceptsConsoleRules: config.acceptsRulesFromConsole === true,
-        projects: Object.keys(config.projects),
-        // How many checkouts each has — R62. The per-project half of R47's
-        // gate, which the bar shows as `cawdev 1/2`. Added rather than
-        // replacing `projects`: an older attach ignores it and still works,
-        // and a newer one against an older daemon simply shows a count with
-        // nothing to compare it against.
-        workspaces: Object.fromEntries(
-          Object.entries(config.projects).map(([slug, p]) => [slug, p.workspaces.length]),
-        ),
-        // R81. `cawdev` starts a daemon for you when it finds none, and
-        // quitting the UI leaves it running — it is driving sessions. A
-        // background process you did not know you started is the cost of that
-        // choice, so the goodbye has to name it precisely enough to stop, and
-        // this is the only place the number is known.
-        pid: process.pid,
-      },
+      runner: advertised,
       snapshot: snapshotRuns,
     });
     log(`watchable at ${control.path} — attach with: node runner.mjs attach`);
@@ -7099,6 +7793,10 @@ async function main() {
         // without anybody having to revoke anything.
         acceptsConsoleRules: config.acceptsRulesFromConsole === true,
         grantable: JSON.stringify(declaredCeiling(config)),
+        // R283. Sent on every beat, not only at registration, for
+        // `acceptsConsoleRules`' own reason: a daemon reconfigured or
+        // reinstalled reports what is true NOW.
+        cliVersion: myVersion,
       },
     }).then((me) => {
       // R73/R80. The heartbeat's answer is what the platform decided about