cookbook-bridge 0.1.3 → 0.1.6

package/bridge.mjs

@@ -36,8 +36,8 @@ import { spawn } from "node:child_process";
 // repair itself — the update path depends ONLY on update.mjs (node built-ins only).
 // The e2e that forced this: a stale install missing volunteer.mjs couldn't even reach
 // the updater when these were static imports.
-let listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings;
-let agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION;
+let listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, agentsQuery;
+let agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand;
 let extractUsage, displayText;
 let volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities;
 let buildPrompt, buildThreadFollowUpPrompt;
@@ -46,15 +46,17 @@ let hasCodexThread, reapCodexServer, killCodexServer;
 let checkForUpdate, applyUpdate;
 let createLocalServer, toolsForMode, modeForTools, vendorOf;
 let connectAgentsProgrammatic, detectClis;
-let serveCalls, describeCall;
+let serveCalls, describeCall, hostingMode;
 let fetchHands, claimHandsCall, reportHandsResult;
+let callsFromStreamLine, foldCallEvent, wireCalls;
 
 async function loadRuntime() {
   ({ createLocalServer, toolsForMode, modeForTools, vendorOf } = await import("./local.mjs"));
   ({ connectAgentsProgrammatic, detectClis } = await import("./device.mjs"));
-  ({ listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, fetchHands, claimHandsCall, reportHandsResult } = await import("./cookbook.mjs"));
-  ({ serveCalls, describeCall } = await import("./hands.mjs"));
-  ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION } = await import("./harden.mjs"));
+  ({ listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, fetchHands, claimHandsCall, reportHandsResult, agentsQuery } = await import("./cookbook.mjs"));
+  ({ serveCalls, describeCall, hostingMode } = await import("./hands.mjs"));
+  ({ callsFromStreamLine, foldCallEvent, wireCalls } = await import("./live.mjs"));
+  ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand } = await import("./harden.mjs"));
   ({ extractUsage, displayText } = await import("./usage.mjs"));
   ({ volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities } = await import("./volunteer.mjs"));
   ({ buildPrompt, buildThreadFollowUpPrompt } = await import("./prompt.mjs"));
@@ -164,7 +166,7 @@ function loadConfig() {
   // browser, run granted verbs on this machine? Off unless explicitly enabled —
   // `cookbook-bridge host` sets it. A Bridge that never hosts never even asks the
   // server for calls, so this costs nothing when unused.
-  cfg.hosting = cfg.hosting ?? { enabled: false };
+  cfg.hosting = cfg.hosting ?? {}; // enabled: true=always, false=off, absent=grants you approved (hands.mjs hostingMode)
   cfg.maxAttempts = cfg.maxAttempts ?? 2;
   // Phase 1 semantics: taskTimeoutSeconds is the ABSOLUTE CEILING (cost backstop),
   // livenessTimeoutSeconds is the stall detector (no output for this long = dead).
@@ -176,6 +178,7 @@ function loadConfig() {
   // execution let one long run block every workspace's queue).
   cfg.maxConcurrentRuns = Math.max(1, cfg.maxConcurrentRuns ?? 2);
   cfg.agents = (cfg.agents ?? []).filter((a) => a.enabled !== false);
+  for (const a of cfg.agents) a.cookbookUrl = cfg.cookbookUrl; // for per-run MCP pinning (spawnAgent)
   ensureAgentPath(); // so bare `claude`/`gemini` commands resolve under the app's minimal PATH
   loadRunState(); // restore attempts/given-up so a restart can't grant doomed tasks fresh attempts
   return cfg;
@@ -228,6 +231,19 @@ export function allowedByPolicy(cfg, agent, task) {
 }
 
 
+/**
+ * IDENTITY PINNING for the persistent runner. spawnAgent rewrites a claude command
+ * with --strict-mcp-config + the agent's own Cookbook token; the thread runner
+ * builds its argv from agent.command directly, so without this an agent with its
+ * own token (Chef) ran as whoever the machine's Claude was logged in as — seen
+ * 2026-08-28: Chef saw diego's workspaces and "No such grant". Same rewrite, once.
+ */
+function pinnedAgent(cfg, agent) {
+  if (!agent || !agent.token || !Array.isArray(agent.command)) return agent;
+  const { command } = withCookbookMcp(agent.command, { token: agent.token, cookbookUrl: agent.cookbookUrl ?? cfg.cookbookUrl });
+  return command === agent.command ? agent : { ...agent, command };
+}
+
 /** Spawn the agent's headless CLI with the prompt substituted into its argv.
  *  `env` (from agentEnv) strips vendor API-billing keys unless the user opted in —
  *  a task must never silently bill an API account instead of the owner's subscription. */
@@ -340,7 +356,13 @@ export function resumeCommand(command, sessionId) {
 
 function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
   return new Promise((resolve, reject) => {
-    const baseCommand = opts.command ?? agent.command;
+    // IDENTITY: a claude run with a per-agent token carries its OWN Cookbook
+    // connection (--strict-mcp-config), so it acts as this Bridge's member under the
+    // agent's name — never as whatever the CLI is logged in as, and blind to stale
+    // claude.ai connectors that poison headless runs (2026-08-25).
+    const baseCommand = withCookbookMcp
+      ? withCookbookMcp(opts.command ?? agent.command, { token: agent.token, cookbookUrl: agent.cookbookUrl }).command
+      : (opts.command ?? agent.command);
     const { command, streaming } = onProgress ? streamingCommand(baseCommand) : { command: baseCommand, streaming: false };
     const [cmd, ...rawArgs] = command;
     const args = rawArgs.map((a) => a.replaceAll("{prompt}", prompt));
@@ -363,6 +385,8 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
     // deltas. A completed turn REPLACES its partials (same text arrives both ways).
     let turnsText = "";
     let partialText = "";
+    // Live CALLS (show the work): tool_use/tool_result folded into a capped list.
+    let calls = [];
     const liveText = () => {
       const full = partialText ? `${turnsText}${turnsText ? "\n\n" : ""}${partialText}` : turnsText;
       return full.length > LIVE_TEXT_CAP ? "…" + full.slice(-LIVE_TEXT_CAP) : full;
@@ -376,7 +400,7 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
       // Bridge restarts (local retryCtx state is trimmed; the task row isn't).
       // Progress needs a token field to pass the server's substance check, so a
       // text-only tick sends output_tokens as-is (0 is fine once input>0 arrives).
-      try { onProgress({ ...acc, runner: agent.name, ...(text ? { live_text: text } : {}), ...(sessionId ? { session_ref: sessionId } : {}) }); } catch { /* progress is best-effort */ }
+      try { onProgress({ ...acc, runner: agent.name, ...(text ? { live_text: text } : {}), ...(calls.length ? { live_calls: wireCalls(calls) } : {}), ...(sessionId ? { session_ref: sessionId } : {}) }); } catch { /* progress is best-effort */ }
     };
 
     let sessionId = null;
@@ -400,10 +424,14 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
             partialText = "";
           }
         }
+        // A tool call is a discrete event people are watching for — it jumps the
+        // text throttle (still ≥300ms apart so a burst of reads is one tick).
+        let touched = false;
+        for (const ev of callsFromStreamLine(line)) { calls = foldCallEvent(calls, ev); touched = true; }
         const r = foldStreamLine(line, acc);
         acc = r.acc;
         if (r.resultLine) resultLine = r.resultLine;
-        else if (Date.now() - lastEmit > (agent.progressThrottleMs ?? 1200)) emit();
+        else if (Date.now() - lastEmit > (touched ? 300 : (agent.progressThrottleMs ?? 1200))) emit();
       }
     });
     child.stderr.on("data", (d) => { lastActivityAt = Date.now(); err += d; });
@@ -628,8 +656,9 @@ function applyConfigFromDisk(cfg) {
   if (raw.cookbookUrl) cfg.cookbookUrl = String(raw.cookbookUrl).replace(/\/$/, "");
   cfg.default = raw.default;
   cfg.localWorkspaces = raw.localWorkspaces ?? {};
-  cfg.hosting = raw.hosting ?? { enabled: false };
+  cfg.hosting = raw.hosting ?? {};
   const agents = (raw.agents ?? []).filter((a) => a.enabled !== false);
+  for (const a of agents) a.cookbookUrl = cfg.cookbookUrl;
   cfg.agents.splice(0, cfg.agents.length, ...agents);
   // A reload usually follows connect-agents fixing the token — let the next poll
   // re-verify from scratch instead of staying stuck in the rejected state.
@@ -972,7 +1001,7 @@ async function processTask(cfg, ws, task, agent) {
         const live = cfg.liveTokens !== false && agent.liveTokens !== false;
         const r = warmRunner ?? runnerFor({
           threadId: threadKey,
-          agent,
+          agent: pinnedAgent(cfg, agent),
           env: agentEnv(cfg).env,
           resumeSessionId: canResumeThread ? threadSession : null,
           helpers: { fold: foldStreamLine, textFrom: textFromStreamLine, sessionFrom: sessionIdFrom },
@@ -1203,7 +1232,7 @@ function noteAwaiting(awaiting) {
 }
 
 async function serveHands(cfg, calls) {
-  if (!cfg.hosting?.enabled || handsBusy || !calls || calls.length === 0) return;
+  if (hostingMode(cfg) === "off" || handsBusy || !calls || calls.length === 0) return;
   handsBusy = true;
   try {
     await serveCalls(calls, {
@@ -1236,7 +1265,7 @@ async function serveHands(cfg, calls) {
 /** Poll for granted calls (the net under the push channel, and the whole story on a
  *  server or network without SSE). No-ops entirely when not hosting. */
 async function pollHands(cfg) {
-  if (!cfg.hosting?.enabled || !hands.supported || handsBusy) return;
+  if (hostingMode(cfg) === "off" || !hands.supported || handsBusy) return;
   try {
     const r = await fetchHands(cfg);
     if (!r.supported) {
@@ -1274,7 +1303,7 @@ async function socketLoop(cfg) {
   let announced = false;
   while (!sseStopped && sse.supported) {
     try {
-      const res = await fetch(`${cfg.cookbookUrl}/api/bridge/stream`, {
+      const res = await fetch(`${cfg.cookbookUrl}/api/bridge/stream${agentsQuery(cfg)}`, {
         headers: { Authorization: `Bearer ${cfg.token}` },
       });
       if (res.status === 404 || res.status === 405) {
@@ -1351,7 +1380,7 @@ async function dispatchWorkInner(cfg, work, warmHints) {
       if (!agent || agent.runner === "app-server" || agent.runner === "robot") continue;
       warmUp({
         poolKey: `warm::${h.workspace_id}::${agent.name}`,
-        agent,
+        agent: pinnedAgent(cfg, agent),
         env: agentEnv(cfg).env,
         helpers: { fold: foldStreamLine, textFrom: textFromStreamLine, sessionFrom: sessionIdFrom },
         log,
@@ -1721,9 +1750,12 @@ async function main() {
     tokenOk = true;
     lastContactAt = Date.now();
     log(`Connected — watching ${ws.length} workspace(s).`);
-    if (cfg.hosting?.enabled) {
-      log("⌂ Hosting is ON — an agent you invite can run granted checks on this machine. You'll see every step; `cookbook-bridge host --off` closes the door.");
-      await pollHands(cfg);
+    {
+      const mode = hostingMode(cfg);
+      if (mode === "always") log("⌂ Hosting is ON — an agent you invite can run granted checks on this machine. You'll see every step; `cookbook-bridge host --off` closes the door.");
+      else if (mode === "grants") log("⌂ Hosting: grants you approve in Cookbook run here (every change still waits for your click). `cookbook-bridge host --off` refuses all.");
+      else log("⌂ Hosting is OFF — no visiting agent can act on this machine. `cookbook-bridge host` opens it.");
+      if (mode !== "off") await pollHands(cfg);
     }
     if (cfg.persistentThreads) {
       for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => { killAllRunners(); killCodexServer(); process.exit(0); });
@@ -1773,7 +1805,7 @@ async function main() {
       }
       // HOSTING: granted calls ride the same cadence as work. When the push channel
       // is healthy it has already delivered them; this is the net.
-      if (cfg.hosting?.enabled && !pushHealthy) await pollHands(cfg);
+      if (hostingMode(cfg) !== "off" && !pushHealthy) await pollHands(cfg);
       // A clean poll means the token is good — clear any prior rejection so the app's
       // /status flips back to connected once the user fixes it.
       lastContactAt = Date.now();
@@ -1899,6 +1931,7 @@ async function doctorReport(args) {
       cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
       cfg.cookbookUrl = (cfg.cookbookUrl || "").replace(/\/$/, "");
       cfg.agents = (cfg.agents ?? []).filter((a) => a.enabled !== false);
+  for (const a of cfg.agents) a.cookbookUrl = cfg.cookbookUrl; // for per-run MCP pinning (spawnAgent)
       if (!cfg.cookbookUrl || !cfg.token || String(cfg.token).startsWith("PASTE")) {
         bad("Config is missing cookbookUrl or a real token", "set both in config.json (token from your Cookbook → Tokens page)");
         cfg = null;
@@ -1998,6 +2031,11 @@ async function doctorReport(args) {
         }
       }
 
+      if (isClaudeCommand && isClaudeCommand(agent.command)) {
+        if (agent.token) ok(`${agent.name}: runs carry their own Cookbook connection (per-agent token) — identity is this Bridge's member`);
+        else warn(`${agent.name}: no per-agent token — runs use the claude CLI's OWN Cookbook login, which may be a different account and inherits stale claude.ai connectors`,
+          "run `cookbook-bridge connect` (mints a token for this agent) or add \"token\" to this agent in config.json");
+      }
       if ((agent.command || []).join(" ").includes("mcp__claude_ai_Cookbook__")) {
         warn(`${agent.name}: allowedTools uses mcp__claude_ai_Cookbook__* — a CLI-added server is usually mcp__cookbook__*`,
           "if tasks 'run but never complete', switch allowedTools to mcp__cookbook__*");

package/codex-runner.mjs

@@ -23,6 +23,7 @@ import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
 import { spawn } from "node:child_process";
+import { codexCallEvent, foldCallEvent, wireCalls } from "./live.mjs";
 
 const IDLE_MS = 15 * 60_000;
 const LIVE_TEXT_CAP = 1800;
@@ -150,6 +151,8 @@ class CodexServer {
         t.text += m.params.delta;
         t.emit();
       }
+      const callEv = codexCallEvent(meth, m.params);
+      if (callEv) { t.calls = foldCallEvent(t.calls, callEv); t.emit(true); }
       if (m.params) {
         const u = m.params.usage ?? m.params.tokenUsage ?? m.params.token_usage ?? (m.params.turn && m.params.turn.usage);
         if (u && typeof u === "object") t.usage = u;
@@ -189,13 +192,14 @@ class CodexServer {
         const startedAt = Date.now();
         const t = {
           resolve, reject,
-          text: "", usage: null,
+          text: "", usage: null, calls: [],
           lastEmit: 0, lastActivityAt: startedAt,
-          emit: () => {
-            if (!onProgress || Date.now() - t.lastEmit < 1200) return;
+          // `event` = a tool call started/finished: jumps the text throttle (≥300ms).
+          emit: (event = false) => {
+            if (!onProgress || Date.now() - t.lastEmit < (event ? 300 : 1200)) return;
             t.lastEmit = Date.now();
             const tail = t.text.length > LIVE_TEXT_CAP ? "…" + t.text.slice(-LIVE_TEXT_CAP) : t.text;
-            try { onProgress({ input_tokens: 0, output_tokens: 0, runner: this.agent.name, ...(tail ? { live_text: tail } : {}) }); } catch { /* best-effort */ }
+            try { onProgress({ input_tokens: 0, output_tokens: 0, runner: this.agent.name, ...(tail ? { live_text: tail } : {}), ...(t.calls.length ? { live_calls: wireCalls(t.calls) } : {}) }); } catch { /* best-effort */ }
           },
           watchdog: setInterval(() => {
             if (Date.now() - startedAt < timeoutSeconds * 1000) return;

package/cookbook.mjs

@@ -239,8 +239,15 @@ export async function recallAcrossWorkspaces(cfg, query, excludeWorkspaceId, lim
 // server that predates grants 404s, which every caller treats as "not hosting".
 
 /** Pending calls (and the live grants they belong to) for THIS Bridge's token. */
+/** `?agents=Claude,Gemini,Chef` — what this Bridge manages, so the server can say
+ *  "your Bridge is running but doesn't run X" instead of "start a Bridge". */
+export function agentsQuery(cfg) {
+  const names = (cfg?.agents ?? []).filter((a) => a && a.enabled !== false && a.name).map((a) => String(a.name));
+  return names.length ? `?agents=${encodeURIComponent(names.join(","))}` : "";
+}
+
 export async function fetchHands(cfg) {
-  const res = await fetch(`${cfg.cookbookUrl}/api/bridge/hands`, {
+  const res = await fetch(`${cfg.cookbookUrl}/api/bridge/hands${agentsQuery(cfg)}`, {
     headers: { Authorization: `Bearer ${cfg.token}` },
   });
   if (res.status === 404) return { supported: false, calls: [], grants: [] };

package/device.mjs

@@ -291,6 +291,9 @@ export function configureClis(found, { baseUrl, agentTokens, cfgPath }) {
         const add = spawnSync(cli.path, ["mcp", "add", "--scope", "user", "--transport", "http", "cookbook", mcpUrl, "--header", `Authorization: Bearer ${token}`], { encoding: "utf8", timeout: 30_000 });
         if (add.status === 0) results.push({ agent: cli.agent, ok: true, detail: "connected (server 'cookbook', user scope)" });
         else results.push({ agent: cli.agent, ok: false, detail: String(add.stderr || add.stdout || "add failed").trim().slice(0, 200) });
+        // The Bridge's OWN runs must not depend on the CLI's global server: store the
+        // token on the agent so spawnAgent pins each run to it (--strict-mcp-config).
+        if (/claude/i.test(cli.agent)) setAgentToken(cfgPath, /claude/i, token);
       } else if (cli.kind === "file") {
         const wrote = agyConfigure(mcpUrl, token);
         results.push({ agent: cli.agent, ok: true, detail: `connected (${wrote})` });
@@ -314,6 +317,16 @@ export function configureClis(found, { baseUrl, agentTokens, cfgPath }) {
   return results;
 }
 
+/** Bridge config: give the agent whose command matches `re` its attributed token. */
+function setAgentToken(cfgPath, re, token) {
+  const raw = readConfig(cfgPath);
+  if (!raw || !Array.isArray(raw.agents)) return;
+  const agent = raw.agents.find((a) => a && re.test(String(a.command?.[0] ?? a.name ?? "")));
+  if (!agent) return;
+  agent.token = token;
+  fs.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", { mode: 0o600 });
+}
+
 /** Bridge config: make sure a Codex agent exists, is enabled, and carries its pieces. */
 function enableCodexAgent(cfgPath, { binary, codexHome, token }) {
   const raw = readConfig(cfgPath);

package/hands.mjs

@@ -568,14 +568,26 @@ export const RUN_TEMPLATES = Object.freeze({
 
   tail_log: (params, ctx) => {
     const n = Math.min(Math.max(parseInt(params?.lines ?? 120, 10) || 120, 10), 400);
-    const logPath = path.join(path.dirname(ctx.cfgPath || ""), "bridge.log");
+    // Where this Bridge's log actually is: `bridge.log` beside the config (terminal),
+    // the newest `*.log` beside it (a LaunchAgent), or the newest in `logs/` (the
+    // desktop app). Chef's first look at a desktop-app machine got "no bridge.log
+    // yet" for a Bridge that was logging fine (2026-08-25).
+    const dir = path.dirname(ctx.cfgPath || "");
+    const newest = (d) => {
+      try {
+        return fs.readdirSync(d).filter((f) => f.endsWith(".log")).map((f) => path.join(d, f))
+          .sort((a, b) => fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs)[0] ?? null;
+      } catch { return null; }
+    };
+    const logPath = [path.join(dir, "bridge.log"), newest(path.join(dir, "logs")), newest(dir)]
+      .find((p) => p && fs.existsSync(p)) ?? path.join(dir, "bridge.log");
     return { local: () => {
       let text = "";
       try {
         const buf = fs.readFileSync(logPath, "utf8");
         text = buf.split("\n").slice(-n).join("\n");
       } catch (e) {
-        return { error: `no bridge.log yet (${e.code || e.message})` };
+        return { error: `no Bridge log yet (${e.code || e.message})` };
       }
       return { path: logPath, lines: n, text };
     } };
@@ -922,3 +934,24 @@ export function tomlLooksValid(text) {
   }
   return !multi && depth === 0;
 }
+
+/**
+ * HOSTING MODE — may this Bridge serve a visiting agent's calls?
+ *
+ *   "always" — `hosting.enabled: true`  (`cookbook-bridge host`): serve any grant.
+ *   "off"    — `hosting.enabled: false` (`cookbook-bridge host --off`): refuse all.
+ *   "grants" — nothing configured: serve the grants this member approved themselves.
+ *
+ * The third is the default ON PURPOSE (2026-08-25). A grant only exists because the
+ * host clicked Allow, in their own account, and it binds to this Bridge's own
+ * credential — that click IS the consent. Making it also require a separate "hosting"
+ * switch produced the failure Diego hit: Allow in a browser, a Bridge with the switch
+ * off, and every call sat queued until the grant expired. The Bridge's LOCAL_CEILING
+ * still holds every write at "ask", whatever the mode.
+ */
+export function hostingMode(cfg) {
+  const v = cfg?.hosting?.enabled;
+  if (v === true) return "always";
+  if (v === false) return "off";
+  return "grants";
+}

package/harden.mjs

@@ -115,3 +115,42 @@ export async function checkAgyVersion(argv, timeoutMs = 10_000) {
   const version = await probeVersion(argv, timeoutMs);
   return { version, tooOld: version ? versionLt(version, AGY_MIN_VERSION) : false };
 }
+
+// ── identity: a run acts as the Bridge's member, not as whoever the CLI is ──────
+//
+// Verified failure (2026-08-25): a Bridge-run `claude -p` refused every Cookbook
+// tool because a stale claude.ai-synced connector poisoned the headless session,
+// and when tools did work they acted as the CLI's own login — a different account
+// that couldn't see the workspace, so complete_task returned "Not found". Both are
+// the same mistake: letting the run inherit the CLI's global MCP state.
+//
+// `--strict-mcp-config --mcp-config <json>` makes the run see ONLY Cookbook, as the
+// member whose token this is, attributed under that token's name.
+
+/** True when this command runs the claude CLI (any path, any wrapper flags). */
+export function isClaudeCommand(command) {
+  const base = String(command?.[0] ?? "").split(/[\\/]/).pop().toLowerCase();
+  return base === "claude";
+}
+
+/**
+ * Rewrite a claude command so the run carries its own Cookbook connection.
+ * Pure. No-op (and says so) when it isn't claude, has no token, or the command
+ * already pins an MCP config by hand.
+ */
+export function withCookbookMcp(command, { token, cookbookUrl } = {}) {
+  if (!Array.isArray(command) || !isClaudeCommand(command)) return { command, injected: false, reason: "not claude" };
+  if (!token) return { command, injected: false, reason: "no token" };
+  if (!cookbookUrl) return { command, injected: false, reason: "no cookbookUrl" };
+  if (command.includes("--mcp-config") || command.includes("--strict-mcp-config")) return { command, injected: false, reason: "already pinned" };
+  const cfg = JSON.stringify({
+    mcpServers: {
+      cookbook: {
+        type: "http",
+        url: `${String(cookbookUrl).replace(/\/$/, "")}/api/mcp`,
+        headers: { Authorization: `Bearer ${token}` },
+      },
+    },
+  });
+  return { command: [command[0], "--strict-mcp-config", "--mcp-config", cfg, ...command.slice(1)], injected: true, reason: null };
+}

package/live.mjs

@@ -0,0 +1,173 @@
+/**
+ * LIVE CALLS — "show the work, not just the words" (Diego, 2026-08-26).
+ *
+ * The Bridge already streams what an agent is SAYING (live_text). This streams what
+ * it is DOING: every tool call, as a short human line — `read_file notes/plan.md`,
+ * `bash npm test`, `search "canvas ics feed"` — with a running/ok/err state. The
+ * thread shows it as a work log, the stage shows the current line, the chat
+ * sidebar shows it under the conversation. Same progress tick, one more field.
+ *
+ * Pure parsers over the vendors' own streams (no network, no fs) so they're
+ * testable: claude stream-json (`tool_use` / `tool_result` blocks), gemini
+ * stream-json (`tool_use` / `tool_result` events), codex app-server item
+ * notifications (`item/started` / `item/completed`).
+ *
+ * Shape on the wire (progress.live_calls, ≤ LIVE_CALLS_CAP entries, oldest first):
+ *   { n: "read_file", a: "notes/plan.md", s: "run" | "ok" | "err", at: <epoch ms> }
+ * The server re-validates every field (src/lib/workspaces/live-calls.ts).
+ */
+
+export const LIVE_CALLS_CAP = 12;
+const NAME_CAP = 60;
+const ARG_CAP = 120;
+
+/** Claude Code's built-in tools → the verb a teammate would say. MCP tools keep their
+ *  own name (`read_file`); other servers' tools are prefixed (`github:create_issue`). */
+const BUILTIN = {
+  read: "read", edit: "edit", multiedit: "edit", write: "write", notebookedit: "edit",
+  bash: "bash", grep: "grep", glob: "glob", ls: "ls",
+  webfetch: "fetch", websearch: "search", task: "agent", todowrite: "todo",
+  // gemini-cli built-ins
+  read_file: "read", write_file: "write", replace: "edit", run_shell_command: "bash",
+  list_directory: "ls", search_file_content: "grep", glob_files: "glob", web_fetch: "fetch", google_web_search: "search",
+};
+
+/** Harness plumbing nobody wants in a work log (Claude Code loads deferred tool
+ *  schemas through ToolSearch before the real call). */
+const SKIP = new Set(["toolsearch"]);
+
+export function shortTool(name) {
+  const raw = String(name ?? "").trim();
+  if (!raw) return "tool";
+  const m = /^mcp__([^_]+(?:_[^_]+)*)__(.+)$/.exec(raw);
+  if (m) {
+    const server = m[1].toLowerCase();
+    const tool = m[2];
+    return (server === "cookbook" ? tool : `${server}:${tool}`).slice(0, NAME_CAP);
+  }
+  const key = raw.toLowerCase();
+  if (BUILTIN[key]) return BUILTIN[key];
+  return raw.slice(0, NAME_CAP);
+}
+
+const ARG_KEYS = [
+  "path", "file_path", "filePath", "notebook_path", "absolute_path", "dir_path", "directory",
+  "command", "cmd", "query", "pattern", "url", "title", "verb", "name", "folder", "from", "to", "src", "dest",
+  "description", "prompt",
+];
+
+/** One short, safe argument for the line. Paths and commands are what people want to
+ *  see; ids and prose are last resort. Whitespace collapsed, capped. */
+export function argFor(input) {
+  if (input == null) return "";
+  if (typeof input === "string") return clip(input);
+  if (typeof input !== "object") return clip(String(input));
+  for (const k of ARG_KEYS) {
+    const v = input[k];
+    if (typeof v === "string" && v.trim()) return clip(v);
+    if (Array.isArray(v) && v.length && typeof v[0] === "string") return clip(v.slice(0, 3).join(", "));
+  }
+  return "";
+}
+
+function clip(s) {
+  const one = String(s).replace(/\s+/g, " ").trim();
+  return one.length > ARG_CAP ? one.slice(0, ARG_CAP - 1) + "…" : one;
+}
+
+/**
+ * Pull tool events out of one stream-json line. Returns an array (a claude turn can
+ * carry several tool_use blocks; a user line several tool_results), empty when the
+ * line is prose/usage/init. Event: {kind:'call', id, name, arg} | {kind:'result', id, err}.
+ */
+export function callsFromStreamLine(line) {
+  let j;
+  try { j = JSON.parse(line); } catch { return []; }
+  if (!j || typeof j !== "object") return [];
+  const out = [];
+  // claude stream-json: assistant turn with tool_use blocks / user turn with tool_result blocks
+  if ((j.type === "assistant" || j.type === "user") && Array.isArray(j.message?.content)) {
+    for (const b of j.message.content) {
+      if (!b || typeof b !== "object") continue;
+      if (b.type === "tool_use") {
+        if (SKIP.has(String(b.name ?? "").toLowerCase())) continue;
+        out.push({ kind: "call", id: String(b.id ?? ""), name: shortTool(b.name), arg: argFor(b.input) });
+      } else if (b.type === "tool_result") out.push({ kind: "result", id: String(b.tool_use_id ?? ""), err: b.is_error === true });
+    }
+    return out;
+  }
+  // gemini stream-json: flat tool_use / tool_result events
+  if (j.type === "tool_use" && (j.tool_name || j.name)) {
+    out.push({ kind: "call", id: String(j.tool_id ?? j.id ?? ""), name: shortTool(j.tool_name ?? j.name), arg: argFor(j.parameters ?? j.input) });
+  } else if (j.type === "tool_result") {
+    const st = String(j.status ?? "").toLowerCase();
+    out.push({ kind: "result", id: String(j.tool_id ?? j.tool_use_id ?? ""), err: st === "error" || st === "failed" || j.is_error === true });
+  }
+  return out;
+}
+
+/**
+ * Codex app-server: `item/started` + `item/completed` notifications carry a typed
+ * item. Defensive about naming (camel/snake, slash/dot) — the protocol is young.
+ * Returns one event or null.
+ */
+export function codexCallEvent(method, params) {
+  const meth = String(method ?? "");
+  const started = /item[/.]started$/.test(meth);
+  const completed = /item[/.]completed$/.test(meth);
+  if (!started && !completed) return null;
+  const item = params?.item;
+  if (!item || typeof item !== "object") return null;
+  const type = String(item.type ?? item.item_type ?? "").replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+  const id = String(item.id ?? "");
+  let name = null;
+  let arg = "";
+  if (type === "commandExecution") { name = "bash"; arg = argFor(item.command ?? item.cmd); }
+  else if (type === "fileChange") {
+    name = "edit";
+    const ch = Array.isArray(item.changes) ? item.changes : [];
+    arg = clip(ch.map((c) => c?.path).filter(Boolean).slice(0, 3).join(", "));
+  }
+  else if (type === "mcpToolCall") {
+    const server = String(item.server ?? "").toLowerCase();
+    const tool = String(item.tool ?? item.name ?? "tool");
+    name = server && server !== "cookbook" ? `${server}:${tool}`.slice(0, NAME_CAP) : tool.slice(0, NAME_CAP);
+    arg = argFor(item.arguments ?? item.input ?? item.params);
+  }
+  else if (type === "webSearch") { name = "search"; arg = argFor(item.query ?? item); }
+  else return null; // agentMessage, reasoning, etc. are not calls
+  if (started) return { kind: "call", id, name, arg };
+  const st = String(item.status ?? "").toLowerCase();
+  const err = st === "failed" || st === "error" || st === "declined" || (typeof item.exit_code === "number" && item.exit_code !== 0) || (typeof item.exitCode === "number" && item.exitCode !== 0);
+  return { kind: "result", id, err };
+}
+
+/**
+ * Fold one event into the running list (pure; returns a new array). A result closes
+ * the matching call by id — or, when the vendor gave no id, the oldest still-running
+ * one. Capped to the newest LIVE_CALLS_CAP so the tick stays small.
+ */
+export function foldCallEvent(list, ev, now = Date.now()) {
+  const cur = Array.isArray(list) ? list : [];
+  if (!ev) return cur;
+  if (ev.kind === "call") {
+    const next = [...cur, { id: ev.id || "", n: ev.name, a: ev.arg || "", s: "run", at: now }];
+    return next.length > LIVE_CALLS_CAP ? next.slice(next.length - LIVE_CALLS_CAP) : next;
+  }
+  if (ev.kind === "result") {
+    // Close by id; fall back to the oldest running call ONLY for id-less vendors.
+    // A known-but-unmatched id (e.g. a skipped ToolSearch) must not close a peer.
+    let i = ev.id ? cur.findIndex((c) => c.id === ev.id && c.s === "run") : -1;
+    if (i < 0 && !ev.id) i = cur.findIndex((c) => c.s === "run");
+    if (i < 0) return cur;
+    const next = cur.slice();
+    next[i] = { ...next[i], s: ev.err ? "err" : "ok" };
+    return next;
+  }
+  return cur;
+}
+
+/** Wire shape: drop the vendor id, keep what the UI renders. */
+export function wireCalls(list) {
+  return (Array.isArray(list) ? list : []).map((c) => ({ n: c.n, ...(c.a ? { a: c.a } : {}), s: c.s, at: c.at }));
+}

package/local.mjs

@@ -238,7 +238,7 @@ export function createLocalServer(deps) {
     localWorkspaces: localWorkspacesView(),
     // HARDWARE GRANTS (0069): is this machine currently willing to host a visiting
     // agent, and what is live right now? The desktop app renders this as the door.
-    hosting: { enabled: !!cfg.hosting?.enabled, activeGrants: deps.activeGrants ? deps.activeGrants() : [] },
+    hosting: { enabled: !!cfg.hosting?.enabled, mode: cfg.hosting?.enabled === true ? "always" : cfg.hosting?.enabled === false ? "off" : "grants", activeGrants: deps.activeGrants ? deps.activeGrants() : [] },
     hotWorkspaceIds: deps.hotWorkspaceIds ? [...deps.hotWorkspaceIds()] : [],
     lastError: deps.lastError ? deps.lastError() : null,
     connect: { state: connect.state },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookbook-bridge",
-  "version": "0.1.3",
+  "version": "0.1.6",
   "description": "Run your own Claude, Codex and Gemini subscriptions against your Cookbook workspaces. One approval connects every agent CLI on your machine, with a receipt for every run.",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "device.mjs",
     "hands.mjs",
     "harden.mjs",
+    "live.mjs",
     "local.mjs",
     "openclaw-runner.mjs",
     "prompt.mjs",

package/thread-runner.mjs

@@ -18,6 +18,7 @@
  *    module must not import it back).
  */
 import { spawn } from "node:child_process";
+import { callsFromStreamLine, foldCallEvent, wireCalls } from "./live.mjs";
 
 const IDLE_MS = 10 * 60_000;
 const runners = new Map(); // threadRootId -> Runner
@@ -91,6 +92,8 @@ class Runner {
         if (spoke.kind === "delta") t.partialText += spoke.text;
         else { t.turnsText += (t.turnsText && spoke.text ? "\n\n" : "") + spoke.text; t.partialText = ""; }
       }
+      let touched = false;
+      for (const ev of callsFromStreamLine(line)) { t.calls = foldCallEvent(t.calls, ev); touched = true; }
       const r = this.helpers.fold(line, t.acc);
       t.acc = r.acc;
       if (r.resultLine) {
@@ -100,7 +103,7 @@ class Runner {
         this.lastUsedAt = Date.now();
         t.resolve({ code: 0, out: r.resultLine, err: "", sessionId: this.sessionId });
       } else {
-        t.emit();
+        t.emit(touched);
       }
     }
   }
@@ -118,15 +121,17 @@ class Runner {
         resolve, reject,
         acc: { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, num_turns: 0 },
         turnsText: "", partialText: "",
+        calls: [], // live CALLS (bridge/live.mjs): the work log
         lastEmit: 0, lastActivityAt: startedAt,
-        emit: () => {
-          if (!onProgress || Date.now() - t.lastEmit < 1200) return;
+        // `event` = a tool call started/finished: jumps the text throttle (≥300ms).
+        emit: (event = false) => {
+          if (!onProgress || Date.now() - t.lastEmit < (event ? 300 : 1200)) return;
           t.lastEmit = Date.now();
           const full = t.partialText ? `${t.turnsText}${t.turnsText ? "\n\n" : ""}${t.partialText}` : t.turnsText;
           const live_text = full.length > 1800 ? "…" + full.slice(-1800) : full;
-          if (t.acc.input_tokens === 0 && t.acc.output_tokens === 0 && !live_text) return;
+          if (t.acc.input_tokens === 0 && t.acc.output_tokens === 0 && !live_text && !t.calls.length) return;
           try {
-            onProgress({ ...t.acc, runner: this.agent.name, ...(live_text ? { live_text } : {}), ...(this.sessionId ? { session_ref: this.sessionId } : {}) });
+            onProgress({ ...t.acc, runner: this.agent.name, ...(live_text ? { live_text } : {}), ...(t.calls.length ? { live_calls: wireCalls(t.calls) } : {}), ...(this.sessionId ? { session_ref: this.sessionId } : {}) });
           } catch { /* best-effort */ }
         },
         watchdog: setInterval(() => {