cookbook-bridge 0.1.2 → 0.1.4

package/bridge.mjs

@@ -36,8 +36,8 @@ import { spawn } from "node:child_process";
 // repair itself — the update path depends ONLY on update.mjs (node built-ins only).
 // The e2e that forced this: a stale install missing volunteer.mjs couldn't even reach
 // the updater when these were static imports.
-let listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings;
-let agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION;
+let listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, agentsQuery;
+let agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand;
 let extractUsage, displayText;
 let volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities;
 let buildPrompt, buildThreadFollowUpPrompt;
@@ -46,15 +46,15 @@ let hasCodexThread, reapCodexServer, killCodexServer;
 let checkForUpdate, applyUpdate;
 let createLocalServer, toolsForMode, modeForTools, vendorOf;
 let connectAgentsProgrammatic, detectClis;
-let serveCalls, describeCall;
+let serveCalls, describeCall, hostingMode;
 let fetchHands, claimHandsCall, reportHandsResult;
 
 async function loadRuntime() {
   ({ createLocalServer, toolsForMode, modeForTools, vendorOf } = await import("./local.mjs"));
   ({ connectAgentsProgrammatic, detectClis } = await import("./device.mjs"));
-  ({ listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, fetchHands, claimHandsCall, reportHandsResult } = await import("./cookbook.mjs"));
-  ({ serveCalls, describeCall } = await import("./hands.mjs"));
-  ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION } = await import("./harden.mjs"));
+  ({ listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, fetchHands, claimHandsCall, reportHandsResult, agentsQuery } = await import("./cookbook.mjs"));
+  ({ serveCalls, describeCall, hostingMode } = await import("./hands.mjs"));
+  ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand } = await import("./harden.mjs"));
   ({ extractUsage, displayText } = await import("./usage.mjs"));
   ({ volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities } = await import("./volunteer.mjs"));
   ({ buildPrompt, buildThreadFollowUpPrompt } = await import("./prompt.mjs"));
@@ -164,7 +164,7 @@ function loadConfig() {
   // browser, run granted verbs on this machine? Off unless explicitly enabled —
   // `cookbook-bridge host` sets it. A Bridge that never hosts never even asks the
   // server for calls, so this costs nothing when unused.
-  cfg.hosting = cfg.hosting ?? { enabled: false };
+  cfg.hosting = cfg.hosting ?? {}; // enabled: true=always, false=off, absent=grants you approved (hands.mjs hostingMode)
   cfg.maxAttempts = cfg.maxAttempts ?? 2;
   // Phase 1 semantics: taskTimeoutSeconds is the ABSOLUTE CEILING (cost backstop),
   // livenessTimeoutSeconds is the stall detector (no output for this long = dead).
@@ -176,6 +176,7 @@ function loadConfig() {
   // execution let one long run block every workspace's queue).
   cfg.maxConcurrentRuns = Math.max(1, cfg.maxConcurrentRuns ?? 2);
   cfg.agents = (cfg.agents ?? []).filter((a) => a.enabled !== false);
+  for (const a of cfg.agents) a.cookbookUrl = cfg.cookbookUrl; // for per-run MCP pinning (spawnAgent)
   ensureAgentPath(); // so bare `claude`/`gemini` commands resolve under the app's minimal PATH
   loadRunState(); // restore attempts/given-up so a restart can't grant doomed tasks fresh attempts
   return cfg;
@@ -340,7 +341,13 @@ export function resumeCommand(command, sessionId) {
 
 function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
   return new Promise((resolve, reject) => {
-    const baseCommand = opts.command ?? agent.command;
+    // IDENTITY: a claude run with a per-agent token carries its OWN Cookbook
+    // connection (--strict-mcp-config), so it acts as this Bridge's member under the
+    // agent's name — never as whatever the CLI is logged in as, and blind to stale
+    // claude.ai connectors that poison headless runs (2026-08-25).
+    const baseCommand = withCookbookMcp
+      ? withCookbookMcp(opts.command ?? agent.command, { token: agent.token, cookbookUrl: agent.cookbookUrl }).command
+      : (opts.command ?? agent.command);
     const { command, streaming } = onProgress ? streamingCommand(baseCommand) : { command: baseCommand, streaming: false };
     const [cmd, ...rawArgs] = command;
     const args = rawArgs.map((a) => a.replaceAll("{prompt}", prompt));
@@ -628,8 +635,9 @@ function applyConfigFromDisk(cfg) {
   if (raw.cookbookUrl) cfg.cookbookUrl = String(raw.cookbookUrl).replace(/\/$/, "");
   cfg.default = raw.default;
   cfg.localWorkspaces = raw.localWorkspaces ?? {};
-  cfg.hosting = raw.hosting ?? { enabled: false };
+  cfg.hosting = raw.hosting ?? {};
   const agents = (raw.agents ?? []).filter((a) => a.enabled !== false);
+  for (const a of agents) a.cookbookUrl = cfg.cookbookUrl;
   cfg.agents.splice(0, cfg.agents.length, ...agents);
   // A reload usually follows connect-agents fixing the token — let the next poll
   // re-verify from scratch instead of staying stuck in the rejected state.
@@ -1203,7 +1211,7 @@ function noteAwaiting(awaiting) {
 }
 
 async function serveHands(cfg, calls) {
-  if (!cfg.hosting?.enabled || handsBusy || !calls || calls.length === 0) return;
+  if (hostingMode(cfg) === "off" || handsBusy || !calls || calls.length === 0) return;
   handsBusy = true;
   try {
     await serveCalls(calls, {
@@ -1236,7 +1244,7 @@ async function serveHands(cfg, calls) {
 /** Poll for granted calls (the net under the push channel, and the whole story on a
  *  server or network without SSE). No-ops entirely when not hosting. */
 async function pollHands(cfg) {
-  if (!cfg.hosting?.enabled || !hands.supported || handsBusy) return;
+  if (hostingMode(cfg) === "off" || !hands.supported || handsBusy) return;
   try {
     const r = await fetchHands(cfg);
     if (!r.supported) {
@@ -1274,7 +1282,7 @@ async function socketLoop(cfg) {
   let announced = false;
   while (!sseStopped && sse.supported) {
     try {
-      const res = await fetch(`${cfg.cookbookUrl}/api/bridge/stream`, {
+      const res = await fetch(`${cfg.cookbookUrl}/api/bridge/stream${agentsQuery(cfg)}`, {
         headers: { Authorization: `Bearer ${cfg.token}` },
       });
       if (res.status === 404 || res.status === 405) {
@@ -1721,9 +1729,12 @@ async function main() {
     tokenOk = true;
     lastContactAt = Date.now();
     log(`Connected — watching ${ws.length} workspace(s).`);
-    if (cfg.hosting?.enabled) {
-      log("⌂ Hosting is ON — an agent you invite can run granted checks on this machine. You'll see every step; `cookbook-bridge host --off` closes the door.");
-      await pollHands(cfg);
+    {
+      const mode = hostingMode(cfg);
+      if (mode === "always") log("⌂ Hosting is ON — an agent you invite can run granted checks on this machine. You'll see every step; `cookbook-bridge host --off` closes the door.");
+      else if (mode === "grants") log("⌂ Hosting: grants you approve in Cookbook run here (every change still waits for your click). `cookbook-bridge host --off` refuses all.");
+      else log("⌂ Hosting is OFF — no visiting agent can act on this machine. `cookbook-bridge host` opens it.");
+      if (mode !== "off") await pollHands(cfg);
     }
     if (cfg.persistentThreads) {
       for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => { killAllRunners(); killCodexServer(); process.exit(0); });
@@ -1773,7 +1784,7 @@ async function main() {
       }
       // HOSTING: granted calls ride the same cadence as work. When the push channel
       // is healthy it has already delivered them; this is the net.
-      if (cfg.hosting?.enabled && !pushHealthy) await pollHands(cfg);
+      if (hostingMode(cfg) !== "off" && !pushHealthy) await pollHands(cfg);
       // A clean poll means the token is good — clear any prior rejection so the app's
       // /status flips back to connected once the user fixes it.
       lastContactAt = Date.now();
@@ -1899,6 +1910,7 @@ async function doctorReport(args) {
       cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
       cfg.cookbookUrl = (cfg.cookbookUrl || "").replace(/\/$/, "");
       cfg.agents = (cfg.agents ?? []).filter((a) => a.enabled !== false);
+  for (const a of cfg.agents) a.cookbookUrl = cfg.cookbookUrl; // for per-run MCP pinning (spawnAgent)
       if (!cfg.cookbookUrl || !cfg.token || String(cfg.token).startsWith("PASTE")) {
         bad("Config is missing cookbookUrl or a real token", "set both in config.json (token from your Cookbook → Tokens page)");
         cfg = null;
@@ -1998,6 +2010,11 @@ async function doctorReport(args) {
         }
       }
 
+      if (isClaudeCommand && isClaudeCommand(agent.command)) {
+        if (agent.token) ok(`${agent.name}: runs carry their own Cookbook connection (per-agent token) — identity is this Bridge's member`);
+        else warn(`${agent.name}: no per-agent token — runs use the claude CLI's OWN Cookbook login, which may be a different account and inherits stale claude.ai connectors`,
+          "run `cookbook-bridge connect` (mints a token for this agent) or add \"token\" to this agent in config.json");
+      }
       if ((agent.command || []).join(" ").includes("mcp__claude_ai_Cookbook__")) {
         warn(`${agent.name}: allowedTools uses mcp__claude_ai_Cookbook__* — a CLI-added server is usually mcp__cookbook__*`,
           "if tasks 'run but never complete', switch allowedTools to mcp__cookbook__*");

package/cookbook.mjs

@@ -239,14 +239,21 @@ export async function recallAcrossWorkspaces(cfg, query, excludeWorkspaceId, lim
 // server that predates grants 404s, which every caller treats as "not hosting".
 
 /** Pending calls (and the live grants they belong to) for THIS Bridge's token. */
+/** `?agents=Claude,Gemini,Chef` — what this Bridge manages, so the server can say
+ *  "your Bridge is running but doesn't run X" instead of "start a Bridge". */
+export function agentsQuery(cfg) {
+  const names = (cfg?.agents ?? []).filter((a) => a && a.enabled !== false && a.name).map((a) => String(a.name));
+  return names.length ? `?agents=${encodeURIComponent(names.join(","))}` : "";
+}
+
 export async function fetchHands(cfg) {
-  const res = await fetch(`${cfg.cookbookUrl}/api/bridge/hands`, {
+  const res = await fetch(`${cfg.cookbookUrl}/api/bridge/hands${agentsQuery(cfg)}`, {
     headers: { Authorization: `Bearer ${cfg.token}` },
   });
   if (res.status === 404) return { supported: false, calls: [], grants: [] };
   if (!res.ok) throw new Error(`hands ${res.status}`);
   const j = await res.json().catch(() => ({}));
-  return { supported: true, calls: j.calls ?? [], grants: j.grants ?? [] };
+  return { supported: true, calls: j.calls ?? [], grants: j.grants ?? [], awaiting: j.awaiting ?? [] };
 }
 
 /** Claim one call before running it. The server CASes on status, so two Bridges on

package/device.mjs

@@ -291,6 +291,9 @@ export function configureClis(found, { baseUrl, agentTokens, cfgPath }) {
         const add = spawnSync(cli.path, ["mcp", "add", "--scope", "user", "--transport", "http", "cookbook", mcpUrl, "--header", `Authorization: Bearer ${token}`], { encoding: "utf8", timeout: 30_000 });
         if (add.status === 0) results.push({ agent: cli.agent, ok: true, detail: "connected (server 'cookbook', user scope)" });
         else results.push({ agent: cli.agent, ok: false, detail: String(add.stderr || add.stdout || "add failed").trim().slice(0, 200) });
+        // The Bridge's OWN runs must not depend on the CLI's global server: store the
+        // token on the agent so spawnAgent pins each run to it (--strict-mcp-config).
+        if (/claude/i.test(cli.agent)) setAgentToken(cfgPath, /claude/i, token);
       } else if (cli.kind === "file") {
         const wrote = agyConfigure(mcpUrl, token);
         results.push({ agent: cli.agent, ok: true, detail: `connected (${wrote})` });
@@ -314,6 +317,16 @@ export function configureClis(found, { baseUrl, agentTokens, cfgPath }) {
   return results;
 }
 
+/** Bridge config: give the agent whose command matches `re` its attributed token. */
+function setAgentToken(cfgPath, re, token) {
+  const raw = readConfig(cfgPath);
+  if (!raw || !Array.isArray(raw.agents)) return;
+  const agent = raw.agents.find((a) => a && re.test(String(a.command?.[0] ?? a.name ?? "")));
+  if (!agent) return;
+  agent.token = token;
+  fs.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", { mode: 0o600 });
+}
+
 /** Bridge config: make sure a Codex agent exists, is enabled, and carries its pieces. */
 function enableCodexAgent(cfgPath, { binary, codexHome, token }) {
   const raw = readConfig(cfgPath);

package/hands.mjs

@@ -97,7 +97,7 @@ function collapseHome(text, home) {
   const h = String(home ?? "").replace(/\/+$/, "");
   if (!h || h.length < 4) return text;
   const esc = h.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return text.replace(new RegExp(esc, "g"), "~");
+  return text.replace(new RegExp(esc + "(?=/|$)", "g"), "~");
 }
 
 /** Redact secrets out of anything this machine produced. Pure. */
@@ -181,7 +181,10 @@ const NEVER_READ = Object.freeze([
   /(^|\/)id_(rsa|ed25519|ecdsa|dsa)(\.pub)?$/i,
   /(^|\/)local\.json$/i,        // the Bridge Local loopback token
   /(^|\/)\.git\/config$/i,      // can carry credentials in a remote URL
-  /(^|\/)credentials?(\.[A-Za-z0-9]+)?$/i,
+  // `credentials.json` AND its dotfile spelling `.credentials.json` — the anchor
+  // used to accept only `/` before the word, so a dotfile in a granted project
+  // folder walked through the wall (ultrareview #123, bug_003).
+  /(^|[/.])credentials?(\.[A-Za-z0-9]+)?$/i,
 ]);
 
 /** Every spelling of a path this filesystem might consider the same file. */
@@ -565,14 +568,26 @@ export const RUN_TEMPLATES = Object.freeze({
 
   tail_log: (params, ctx) => {
     const n = Math.min(Math.max(parseInt(params?.lines ?? 120, 10) || 120, 10), 400);
-    const logPath = path.join(path.dirname(ctx.cfgPath || ""), "bridge.log");
+    // Where this Bridge's log actually is: `bridge.log` beside the config (terminal),
+    // the newest `*.log` beside it (a LaunchAgent), or the newest in `logs/` (the
+    // desktop app). Chef's first look at a desktop-app machine got "no bridge.log
+    // yet" for a Bridge that was logging fine (2026-08-25).
+    const dir = path.dirname(ctx.cfgPath || "");
+    const newest = (d) => {
+      try {
+        return fs.readdirSync(d).filter((f) => f.endsWith(".log")).map((f) => path.join(d, f))
+          .sort((a, b) => fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs)[0] ?? null;
+      } catch { return null; }
+    };
+    const logPath = [path.join(dir, "bridge.log"), newest(path.join(dir, "logs")), newest(dir)]
+      .find((p) => p && fs.existsSync(p)) ?? path.join(dir, "bridge.log");
     return { local: () => {
       let text = "";
       try {
         const buf = fs.readFileSync(logPath, "utf8");
         text = buf.split("\n").slice(-n).join("\n");
       } catch (e) {
-        return { error: `no bridge.log yet (${e.code || e.message})` };
+        return { error: `no Bridge log yet (${e.code || e.message})` };
       }
       return { path: logPath, lines: n, text };
     } };
@@ -691,6 +706,13 @@ const VERBS = {
     if (ext === ".json") {
       try { JSON.parse(content); } catch (e) { return { error: `That isn't valid JSON, so it wasn't written: ${e.message.slice(0, 120)}` }; }
     }
+    // The setup allowlist carries two TOML files (Codex). The "won't parse ⇒ not
+    // written" promise covered only JSON until ultrareview #123 (bug_008) — this is
+    // a structural check, not a full parser: unbalanced quotes/brackets, lines that
+    // are neither a table header nor `key = value`, unterminated multi-line strings.
+    if (ext === ".toml" && !tomlLooksValid(content)) {
+      return { error: "That doesn't look like valid TOML (unbalanced quotes/brackets or a malformed line), so it wasn't written." };
+    }
     if (content.includes("\0")) return { error: "Content contains a null byte." };
 
     let backup = null;
@@ -713,9 +735,15 @@ const VERBS = {
     if (!r.ok) return { error: r.error };
     const name = String(args.backup ?? "");
     if (!BACKUP_RE.test(name)) return { error: "Pass the backup filename this session created (…​.bak-chef-<timestamp>)." };
-    const backupPath = path.join(path.dirname(r.path), name);
-    if (path.basename(backupPath) !== name) return { error: "Invalid backup name." };
-    if (!fs.existsSync(backupPath)) return { error: "That backup isn't there any more." };
+    // write_file placed the backup next to the RESOLVED file (r.real), so a
+    // symlinked setup file — dotfile managers do this constantly — keeps its backup
+    // in the target directory. Look there first, then beside the symlink itself
+    // (ultrareview #123, bug_009: restore used to look only beside the symlink and
+    // report "isn't there any more" about a backup that existed).
+    const candidates = [path.join(path.dirname(r.real), name), path.join(path.dirname(r.path), name)];
+    if (candidates.some((c) => path.basename(c) !== name)) return { error: "Invalid backup name." };
+    const backupPath = candidates.find((c) => fs.existsSync(c));
+    if (!backupPath) return { error: "That backup isn't there any more." };
     try { fs.copyFileSync(backupPath, r.path); } catch (e) { return { error: `restore failed: ${e.code || e.message}` }; }
     return { path: args.path, restored_from: name };
   },
@@ -863,6 +891,67 @@ export function describeCall(call) {
     case "run": return `run ${a.template}`;
     case "doctor": return "run the setup doctor";
     case "env": return "look at what's installed";
+    // The three verbs a host must approve are the three that used to render as a
+    // bare verb name (ultrareview #123, bug_007). Say WHAT, not just which.
+    case "write_file": return `write ${a.path}${typeof a.content === "string" ? ` (${a.content.length} chars)` : ""}`;
+    case "restore_backup": return `restore ${a.path} from ${a.backup ?? "its backup"}`;
+    case "open_url": {
+      try { const u = new URL(String(a.url ?? "")); return `open ${u.host}${u.pathname === "/" ? "" : u.pathname} in your browser`; }
+      catch { return `open ${a.url ?? "a page"} in your browser`; }
+    }
     default: return String(call?.verb ?? "?");
   }
 }
+
+/**
+ * Structural TOML sanity check for write_file. Deliberately NOT a parser: it
+ * rejects the ways a distracted agent breaks a config (unbalanced quotes or
+ * brackets, an unterminated multi-line string, a line that is neither a table
+ * header nor `key = value`) and accepts anything that has that shape.
+ */
+export function tomlLooksValid(text) {
+  let multi = null; // the open multi-line string delimiter, if any
+  let depth = 0;    // open [ / { across lines (multi-line arrays and inline tables)
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.trim();
+    if (multi) { if (line.includes(multi)) multi = null; continue; }
+    if (!line || line.startsWith("#")) continue;
+    if (depth > 0) {
+      for (const ch of line) { if (ch === "[" || ch === "{") depth++; else if (ch === "]" || ch === "}") depth--; if (depth < 0) return false; }
+      continue;
+    }
+    if (/^\[\[?[^\]]+\]\]?\s*(#.*)?$/.test(line)) continue;
+    const m = /^[A-Za-z0-9_\-."']+\s*=\s*(.+)$/.exec(line);
+    if (!m) return false;
+    const v = m[1].trim();
+    if (v.startsWith('"""') || v.startsWith("'''")) {
+      const q = v.slice(0, 3);
+      if (!(v.length > 3 && v.endsWith(q))) multi = q;
+      continue;
+    }
+    if (((v.match(/(?<!\\)"/g) || []).length) % 2 !== 0) return false;
+    for (const ch of v) { if (ch === "[" || ch === "{") depth++; else if (ch === "]" || ch === "}") depth--; if (depth < 0) return false; }
+  }
+  return !multi && depth === 0;
+}
+
+/**
+ * HOSTING MODE — may this Bridge serve a visiting agent's calls?
+ *
+ *   "always" — `hosting.enabled: true`  (`cookbook-bridge host`): serve any grant.
+ *   "off"    — `hosting.enabled: false` (`cookbook-bridge host --off`): refuse all.
+ *   "grants" — nothing configured: serve the grants this member approved themselves.
+ *
+ * The third is the default ON PURPOSE (2026-08-25). A grant only exists because the
+ * host clicked Allow, in their own account, and it binds to this Bridge's own
+ * credential — that click IS the consent. Making it also require a separate "hosting"
+ * switch produced the failure Diego hit: Allow in a browser, a Bridge with the switch
+ * off, and every call sat queued until the grant expired. The Bridge's LOCAL_CEILING
+ * still holds every write at "ask", whatever the mode.
+ */
+export function hostingMode(cfg) {
+  const v = cfg?.hosting?.enabled;
+  if (v === true) return "always";
+  if (v === false) return "off";
+  return "grants";
+}

package/harden.mjs

@@ -115,3 +115,42 @@ export async function checkAgyVersion(argv, timeoutMs = 10_000) {
   const version = await probeVersion(argv, timeoutMs);
   return { version, tooOld: version ? versionLt(version, AGY_MIN_VERSION) : false };
 }
+
+// ── identity: a run acts as the Bridge's member, not as whoever the CLI is ──────
+//
+// Verified failure (2026-08-25): a Bridge-run `claude -p` refused every Cookbook
+// tool because a stale claude.ai-synced connector poisoned the headless session,
+// and when tools did work they acted as the CLI's own login — a different account
+// that couldn't see the workspace, so complete_task returned "Not found". Both are
+// the same mistake: letting the run inherit the CLI's global MCP state.
+//
+// `--strict-mcp-config --mcp-config <json>` makes the run see ONLY Cookbook, as the
+// member whose token this is, attributed under that token's name.
+
+/** True when this command runs the claude CLI (any path, any wrapper flags). */
+export function isClaudeCommand(command) {
+  const base = String(command?.[0] ?? "").split(/[\\/]/).pop().toLowerCase();
+  return base === "claude";
+}
+
+/**
+ * Rewrite a claude command so the run carries its own Cookbook connection.
+ * Pure. No-op (and says so) when it isn't claude, has no token, or the command
+ * already pins an MCP config by hand.
+ */
+export function withCookbookMcp(command, { token, cookbookUrl } = {}) {
+  if (!Array.isArray(command) || !isClaudeCommand(command)) return { command, injected: false, reason: "not claude" };
+  if (!token) return { command, injected: false, reason: "no token" };
+  if (!cookbookUrl) return { command, injected: false, reason: "no cookbookUrl" };
+  if (command.includes("--mcp-config") || command.includes("--strict-mcp-config")) return { command, injected: false, reason: "already pinned" };
+  const cfg = JSON.stringify({
+    mcpServers: {
+      cookbook: {
+        type: "http",
+        url: `${String(cookbookUrl).replace(/\/$/, "")}/api/mcp`,
+        headers: { Authorization: `Bearer ${token}` },
+      },
+    },
+  });
+  return { command: [command[0], "--strict-mcp-config", "--mcp-config", cfg, ...command.slice(1)], injected: true, reason: null };
+}

package/local.mjs

@@ -238,7 +238,7 @@ export function createLocalServer(deps) {
     localWorkspaces: localWorkspacesView(),
     // HARDWARE GRANTS (0069): is this machine currently willing to host a visiting
     // agent, and what is live right now? The desktop app renders this as the door.
-    hosting: { enabled: !!cfg.hosting?.enabled, activeGrants: deps.activeGrants ? deps.activeGrants() : [] },
+    hosting: { enabled: !!cfg.hosting?.enabled, mode: cfg.hosting?.enabled === true ? "always" : cfg.hosting?.enabled === false ? "off" : "grants", activeGrants: deps.activeGrants ? deps.activeGrants() : [] },
     hotWorkspaceIds: deps.hotWorkspaceIds ? [...deps.hotWorkspaceIds()] : [],
     lastError: deps.lastError ? deps.lastError() : null,
     connect: { state: connect.state },
@@ -352,7 +352,10 @@ export function createLocalServer(deps) {
     // picks it up immediately (no restart, so a host can close the door NOW).
     if (route === "POST /hosting") {
       const body = (await readBody(req)) ?? {};
-      const enabled = body.enabled !== false;
+      // A security toggle whose default is OFF must not fail open: an empty or
+      // malformed body used to mean "turn it on" (ultrareview #123, bug_011).
+      if (typeof body.enabled !== "boolean") return json(res, 400, { ok: false, error: "`enabled` must be true or false" });
+      const enabled = body.enabled;
       cfg.hosting = { ...(cfg.hosting ?? {}), enabled };
       try {
         saveConfigPatch((raw) => { raw.hosting = { ...(raw.hosting ?? {}), enabled }; });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookbook-bridge",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Run your own Claude, Codex and Gemini subscriptions against your Cookbook workspaces. One approval connects every agent CLI on your machine, with a receipt for every run.",
   "type": "module",
   "bin": {