create-walle 0.10.2 → 0.10.3

package/template/wall-e/llm/worker-mcp-routing.js

@@ -9,13 +9,13 @@ function _inputError(error, detail) {
 function normalizeWorkerExecutionOptions(args = {}) {
   const suppliedAgent = args.agent !== undefined && args.agent !== null;
   const suppliedHarness = args.harness !== undefined && args.harness !== null;
-  const harnessAgent = args.harness === 'claude-code' ? 'claude' : args.harness === 'codex-cli' ? 'codex' : null;
-  if (suppliedHarness && !harnessAgent) throw _inputError('harness_invalid', 'harness must be claude-code or codex-cli');
-  if (suppliedAgent && !['claude', 'codex'].includes(args.agent)) throw _inputError('agent_invalid', 'agent must be claude or codex');
+  const harnessAgent = args.harness === 'claude-code' ? 'claude' : args.harness === 'codex-cli' ? 'codex' : args.harness === 'dsh-acp' ? 'dsh' : null;
+  if (suppliedHarness && !harnessAgent) throw _inputError('harness_invalid', 'harness must be claude-code, codex-cli or dsh-acp');
+  if (suppliedAgent && !['claude', 'codex', 'dsh'].includes(args.agent)) throw _inputError('agent_invalid', 'agent must be claude, codex or dsh');
   if (suppliedAgent && harnessAgent && args.agent !== harnessAgent) throw _inputError('harness_conflict', 'agent and harness select different worker CLIs');
 
   const agent = harnessAgent || (suppliedAgent ? args.agent : 'claude');
-  const harness = suppliedHarness ? args.harness : agent === 'codex' ? 'codex-cli' : 'claude-code';
+  const harness = suppliedHarness ? args.harness : agent === 'codex' ? 'codex-cli' : agent === 'dsh' ? 'dsh-acp' : 'claude-code';
   const suppliedProfile = args.worker_profile ?? args.workerProfile;
   const workerProfile = suppliedProfile === undefined ? 'implementation' : suppliedProfile;
   if (!['legacy', 'implementation', 'review'].includes(workerProfile)) {
@@ -49,6 +49,31 @@ function resolveDelegateParentAgentSessionId(explicitValue, isExplicit = false)
 // downstream with caller_unresolved).
 const CALLER_CONTEXT_TOOLS = new Set(['walle_delegate_implementation', 'walle_worker_wait', 'walle_resume_worker', 'walle_stop_worker']);
 
+// WP-4 (local-landing-queue-multi-session-integration-2026-10-26.html §6.3, §6.4): the four landing
+// tools take the SAME caller identity the delegate tools do (the stdio proxy's env-resolved
+// CODEX_THREAD_ID || CTM_SESSION_ID, injected as `parent_agent_session_id`), so `session` can
+// default to the caller's CTM session id. They are deliberately NOT in CALLER_CONTEXT_TOOLS: that
+// set is the bearer-gated HTTP door (D-11), and these are read-mostly surface every harness must
+// reach -- landing status/conflicts/wait are read-only, and land submit is already loopback-gated by
+// CTM's own auth rules. `walle_context_hint` rides here too: the D-10 line is appended for the
+// caller's session, so the hint needs the caller identity.
+const LANDING_CALLER_TOOLS = new Set([
+  'walle_landing_status', 'walle_landing_submit', 'walle_landing_wait', 'walle_landing_conflicts',
+  'walle_context_hint',
+]);
+
+// docs/remote-session-hub-bridge-2026-10-30.html §5 R-2, §6.4: the hub-bridge tools ask the hub
+// that drives THIS session to act, and the hub binds every request to the caller's own session
+// (caller_session_not_on_machine otherwise), so they need the same injected caller identity. Not in
+// CALLER_CONTEXT_TOOLS: the box CTM route they reach is loopback-gated, not bearer-gated (D-11).
+const HUB_BRIDGE_CALLER_TOOLS = new Set([
+  'hub_session_read', 'hub_read_file', 'hub_list', 'hub_exec', 'hub_mcp_list_tools', 'hub_mcp_call',
+]);
+
+// The one gate the identity injection consults: the bearer-gated caller-context tools plus the
+// landing and hub-bridge surfaces above.
+const CALLER_IDENTITY_TOOLS = new Set([...CALLER_CONTEXT_TOOLS, ...LANDING_CALLER_TOOLS, ...HUB_BRIDGE_CALLER_TOOLS]);
+
 // WP-2 (usage-attribution-followups R-3/R-4, §6.3): the two LAUNCH tools -- the ones that
 // start a worker as a side effect. They differ from the other caller-context tools twice:
 // their proxy deadline must outlast the daemon's own CTM fetch deadline
@@ -94,7 +119,7 @@ function attachDelegateCallerContext(message, callerParentId) {
     return changed ? items : message;
   }
   if (!message || message.method !== 'tools/call'
-      || !CALLER_CONTEXT_TOOLS.has(message.params?.name)
+      || !CALLER_IDENTITY_TOOLS.has(message.params?.name)
       || typeof callerParentId !== 'string' || !callerParentId.trim()) return message;
   const args = message.params.arguments;
   if (args !== undefined && (!args || typeof args !== 'object' || Array.isArray(args))) return message;
@@ -180,8 +205,8 @@ function callerBearerHeader(hostname) {
 // stays one branch); only data.cause and data.next_step differ. Frozen: the
 // skill templates and delegate-skill-templates.test.js pin these verbatim.
 const PROXY_NEXT_STEPS = Object.freeze({
-  proxy_token_missing: 'The Wall-E MCP server for this session was started without WALL_E_API_TOKEN, so it cannot present the CTM runtime bearer. Wall-E rewrites the managed Codex [mcp_servers."wall-e"] block (env_vars) at boot and before each CTM Codex launch; restart this session so Codex respawns the MCP server with the token. Do not edit config.toml by hand.',
-  non_loopback_daemon: 'The Wall-E daemon for this session is not on loopback, and the runtime bearer is only sent to a loopback daemon (F1b-1). Routed delegation needs a local Wall-E; use the native lane or a CTM-launched session on this host.',
+  proxy_token_missing: 'The Wall-E MCP server for this session was started without WALL_E_API_TOKEN, so it cannot present the CTM runtime bearer. Wall-E rewrites the managed Codex [mcp_servers."wall-e"] block (env_vars) when Wall-E starts; restart this session so Codex respawns the MCP server with the token. Do not edit config.toml by hand.',
+  non_loopback_daemon: 'The Wall-E daemon for this session is not on loopback, so routed delegation is unavailable from here. Tell the user and wait for their word; do not substitute a native helper.',
 });
 
 // D-3 (S-8): the stdio proxy refuses a caller-context call it cannot
@@ -268,12 +293,15 @@ function callerDoorBearerOk(req) {
   return require('../http/auth').requireBearer(req, strFlag('WALL_E_API_TOKEN', ''));
 }
 
-// WP-5b (lead-cost routing §6.2/§6.7): the rule cell decides whether a wait parks the watcher.
-// 'off' is a user veto (D-18: final, and silent ticks cannot move it), 'silent' is an off cell
-// still collecting 1-in-10 ticks (D-16), and CTM's default 'on' is returned as null so an
-// unchanged request keeps its exact shape (`watch=` is omitted entirely). A route wait starts
-// no watcher (WP-1), and a wait whose worker has no recorded route has no cell to read.
-const WATCH_ORDER = Object.freeze({ off: 0, silent: 1, on: 2 });
+// WP-5b (lead-cost routing §6.2/§6.7), WP-2: the rule cell decides whether a wait parks the
+// watcher. `off` is a user veto (D-18: final) or the evaluator's demotion — a watcher that has
+// proved useless is parked outright. Silent mode is RETIRED in Wall-E (it collected 1-in-10 ticks
+// inside a watcher that never lived long enough to produce a row), so the only modes are `off` and
+// `on`; a cell in `probe` collects through CTM's own default. CTM still accepts `watch=silent`
+// for mixed-version safety, but Wall-E never sends it. `on` is CTM's default and is returned as
+// null so an unchanged request keeps its exact shape (`watch=` is omitted entirely). A route wait
+// starts no watcher (WP-1), and a wait whose worker has no recorded route has no cell to read.
+const WATCH_ORDER = Object.freeze({ off: 0, on: 1 });
 const WATCH_OFF_CELL = 'off';
 
 function _helperRulesDb() {
@@ -291,7 +319,20 @@ function _watchModeOfRoute(route, db) {
   const cellKey = `wait-watch|default|${route}`;
   const row = readCell(db, cellKey);
   if (row && Number(row.user_veto) === 1) return 'off';
-  return readCellState(db, cellKey) === WATCH_OFF_CELL ? 'silent' : 'on';
+  return readCellState(db, cellKey) === WATCH_OFF_CELL ? 'off' : 'on';
+}
+
+// D-8 (round 3): a null below is CTM's default `on` -- a full-rate watcher for a worker whose cell
+// may be off. The reason is counted (and named once) so the dominant fail-open cause can be read
+// off the panel instead of guessed. Counting is advisory: it may never fail a lead's wait.
+function _noteWatchFallback(hook, reason, workerId) {
+  if (!hook || typeof hook.noteWatchFallback !== 'function') return;
+  try {
+    hook.noteWatchFallback(reason, workerId || null);
+  } catch {
+    // expected: a stub hook that throws on the counter -- the count is lost, the wait is not
+    return;
+  }
 }
 
 /**
@@ -301,20 +342,27 @@ function _watchModeOfRoute(route, db) {
  */
 function watchModeFor(args = {}, hook = require('../lib/helper-rules/lead-call-hook'), db = _helperRulesDb()) {
   const routes = new Set();
-  if (args.route) return null; // a route wait starts no watcher (WP-1)
+  if (args.route) return null; // a route wait starts no watcher, and is not a fallback (WP-1)
   try {
     if (args.ctm_session_id) {
       const entry = hook.workerRouteOf(args.ctm_session_id);
-      if (!entry || !entry.route) return null; // unknown -> 'on'
+      if (!entry || !entry.route) {
+        _noteWatchFallback(hook, 'unknown_worker', args.ctm_session_id);
+        return null; // unknown -> 'on'
+      }
       routes.add(entry.route);
     } else {
       for (const worker of hook.leadWorkersOf(args.parent_agent_session_id) || []) {
         if (worker && worker.route) routes.add(worker.route);
       }
-      if (!routes.size) return null; // nothing recorded -> 'on'
+      if (!routes.size) {
+        _noteWatchFallback(hook, 'no_lead_workers', args.parent_agent_session_id);
+        return null; // nothing recorded -> 'on'
+      }
     }
   } catch {
     // expected: the hook cannot answer -- 'on' is the fail-open default, never a failed wait
+    _noteWatchFallback(hook, 'hook_error', args.ctm_session_id || args.parent_agent_session_id);
     return null;
   }
   let mode = 'on';
@@ -403,5 +451,6 @@ module.exports = {
   resolveCallerParentAgentSessionId, callerBearerHeader, callerDoorBearerOk,
   isLoopbackHost, PROXY_NEXT_STEPS, proxyCallerDoorResponse, callerBearerStatus, withCallerBearerStatus,
   CALLER_CONTEXT_TOOLS, applyAdmissionHealth, normalizeWorkerExecutionOptions, resolveWorkerWaitResult, resolveWorkerStopResult,
+  LANDING_CALLER_TOOLS, CALLER_IDENTITY_TOOLS,
   LAUNCH_TOOLS, LAUNCH_TOOL_PROXY_TIMEOUT_MS, callerToolUseIdFromMeta, admittedToolTimeoutMs,
 };

package/template/wall-e/loops/brain-custom-writes.js

@@ -632,6 +632,23 @@ function helperRulesSetGrade(id, gradeJson) {
   return require('../lib/helper-rules/store').setGrade(brain.getDb(), id, gradeJson);
 }
 
+// WP-0 (§6.3): the v2 clock seed walk. One bounded page per call, on the OWNER's connection —
+// the walk writes brain_row_clock / brain_local_seq / brain_vv, and its caller (the scheduler
+// job, which runs in a worker holding a read-only handle) must not write them itself. Same
+// CUSTOM_BRAIN_CALLS seam as the v1 backfill batches above; the walk's own kv cursor makes it
+// resumable, and clock writes fire no capture trigger, so it enqueues no outbox row.
+function brainSyncClockSeed(options = {}) {
+  return require('../brain/brain-sync-store').seedClockPage(brain.getDb(), options);
+}
+
+// WP-4 (§6.7): the join import's ONE bounded page per call. Like the clock seed above, the caller
+// is a scheduler job; the page writes the four replicated tables with the connection-scoped
+// sentinel on (inside brain/brain-join.js), so it must run on the owner's write connection, not
+// the job's read-only handle. The kv cursor makes it resumable after a crash.
+function brainSyncV2JoinStep(options = {}) {
+  return require('../brain/brain-join').joinImportStep(brain.getDb(), options);
+}
+
 module.exports = {
   failConversationExtraction,
   markMemoriesExtractionSkipped,
@@ -665,4 +682,6 @@ module.exports = {
   helperRulesSetGrade,
   helperRulesCloseOutcomeByWorker,
   helperRulesRelabel,
+  brainSyncClockSeed,
+  brainSyncV2JoinStep,
 };

package/template/wall-e/loops/ingest.js

@@ -4,6 +4,8 @@ const eventBus = require('../events/event-bus');
 const parentBrainOwner = require('../lib/parent-brain-owner-client');
 const { brainWrite } = require('./brain-write');
 const memoryFileKnowledge = require('../adapters/memory-file-knowledge');
+const { resolvePlacement } = require('../lib/derivation-home');
+const { imessageIngestEnabled } = require('../adapters/imessage');
 
 const OWNER_WRITE_TIMEOUT_MS = 90 * 1000;
 // One commit per 200 rows: bounds the cross-process write-lock hold while still
@@ -129,6 +131,17 @@ function _adapterName(adapter) {
   return adapter.name || adapter.constructor?.name || 'unknown';
 }
 
+// D-5/S-21 (shared-memory WP-2): one placement probe per ingest tick decides whether the
+// iMessage adapter is active (the predicate lives with the adapter — adapters/imessage.js
+// `imessageIngestEnabled`). Every other adapter is host-local and runs everywhere.
+async function _activeAdapters(adapters, opts) {
+  const placement = opts.placement || await resolvePlacement();
+  const list = Array.isArray(adapters) ? adapters : [];
+  return list.filter((adapter) => (
+    _adapterName(adapter) !== 'imessage' || imessageIngestEnabled(placement)
+  ));
+}
+
 // One adapter's tick: poll, insert, exchange pairs, reconcile, checkpoint.
 // `guard` throws once runOnce has abandoned this adapter for the tick. It runs immediately before every
 // commit point, so a poll that finally resolves after the abandonment writes no memory chunk, no exchange
@@ -300,8 +313,11 @@ async function runOnce(adapters, opts = {}) {
   let latestTimestamp = legacyCheckpoint?.last_memory_at || null;
   const adapterResults = {};
   const capMs = Number(opts.adapterCapMs) > 0 ? Number(opts.adapterCapMs) : ADAPTER_TICK_CAP_MS;
+  // WP-2 (D-5/S-21): one placement probe per ingest tick decides the iMessage adapter's
+  // activity; every other adapter is unaffected (host-local ingest runs everywhere).
+  const activeAdapters = await _activeAdapters(adapters, opts);
 
-  for (const adapter of adapters) {
+  for (const adapter of activeAdapters) {
     const name = _adapterName(adapter);
     const inFlightKey = checkpointName(adapter);
     if (_abandonedBodies.has(inFlightKey)) {

package/template/wall-e/loops/think.js

@@ -10,6 +10,7 @@ const errorSink = require('../lib/error-sink');
 const { brainWrite } = require('./brain-write');
 const { listUnextractedProjection } = require('../memory/conversation-projection-v2');
 const { readSubscriberState } = require('../memory/conversation-subscriber');
+const { resolvePlacement } = require('../lib/derivation-home');
 let embeddings;
 try { embeddings = require('../embeddings'); } catch { embeddings = null; }
 
@@ -138,6 +139,16 @@ async function runOnce(opts = {}) {
   const extractFn = opts.extractFn || extractKnowledge;
   const ownerName = brain.getOwnerName();
 
+  // D-5/S-18/S-20 (WP-2): the derivation home is the only node that runs the two steps whose
+  // INPUT is replicated rows — the conversation-projection top-up and rule-based entity
+  // learning over every memory's content. Extraction of THIS node's locally ingested pending
+  // memories (below) is host-local and stays on every node. `opts.placement` is the test seam;
+  // production resolves it from CTM (cached 60 s).
+  const placement = opts.placement || await resolvePlacement(opts);
+  const derivationHome = placement.home === true;
+  const learnEntitiesFn = opts.learnEntitiesFromText || learnEntitiesFromText;
+  const listUnextractedProjectionFn = opts.listUnextractedProjection || listUnextractedProjection;
+
   // Knowledge graph WP-2: memories outside the extraction allowlist
   // are marked skipped before the batch is selected, so they never count as backlog.
   const skipIds = brain.listMemoriesToSkipExtraction({ limit: SKIP_MARK_LIMIT });
@@ -147,10 +158,12 @@ async function runOnce(opts = {}) {
   const pending = brain.listMemories({ extractionRetryable: true, limit: batchSize });
   // D-10: top the batch up with un-extracted conversation projection rows created at or after
   // the subscriber's first bootstrap. extract_from_ms 0 = never bootstrapped: select none.
-  if (pending.length < batchSize) {
+  // D-5 (WP-2): projection rows are replicated, so after WP-5 only the derivation home may
+  // extract them — a non-home node would re-extract the same transcript N times.
+  if (derivationHome && pending.length < batchSize) {
     const sinceMs = readSubscriberState(brain).extract_from_ms;
     if (sinceMs > 0) {
-      pending.push(...listUnextractedProjection(brain.getDb(), { sinceMs, limit: batchSize - pending.length }));
+      pending.push(...listUnextractedProjectionFn(brain.getDb(), { sinceMs, limit: batchSize - pending.length }));
     }
   }
   if (pending.length === 0) {
@@ -274,10 +287,12 @@ async function runOnce(opts = {}) {
   }
 
   // Step 4a: Learn entities from memory content (rule-based, no API cost)
-  await _measurePhase('entity_learning', { pending: pending.length }, () => {
+  // D-5/S-18 (WP-2): this scans ALL pending content, replicated rows included — the home only.
+  await _measurePhase('entity_learning', { pending: pending.length, derivation_home: derivationHome }, () => {
+    if (!derivationHome) return;
     for (const mem of pending) {
       if (mem.content && mem.content.length > 50) {
-        learnEntitiesFromText(mem.content, ownerName);
+        learnEntitiesFn(mem.content, ownerName);
       }
     }
   }).catch(() => {});

package/template/wall-e/mcp-contract.js

@@ -218,6 +218,20 @@ const TOOL_OUTPUT_SCHEMAS = {
   walle_worker_wait: WORKER_WAIT_OUTPUT_SCHEMA,
   walle_resume_worker: RESUME_WORKER_OUTPUT_SCHEMA,
   walle_stop_worker: WORKER_STOP_OUTPUT_SCHEMA,
+  // WP-4 (§6.3/§6.4): the landing-queue tools. The status/conflicts bodies are CTM's own read
+  // model, so they stay open objects rather than a second, drifting copy of that shape.
+  walle_landing_status: ANY_OBJECT_SCHEMA,
+  walle_landing_submit: ANY_OBJECT_SCHEMA,
+  walle_landing_conflicts: ANY_OBJECT_SCHEMA,
+  walle_landing_wait: {
+    type: 'object',
+    properties: {
+      job: { anyOf: [ANY_OBJECT_SCHEMA, { type: 'null' }] },
+      woke_on: { type: 'string', enum: ['terminal', 'timeout'] },
+    },
+    required: ['job', 'woke_on'],
+    additionalProperties: true,
+  },
 };
 
 const READ_ONLY_TOOL_ANNOTATION = Object.freeze({
@@ -250,6 +264,17 @@ const IDEMPOTENT_WRITE_TOOL_ANNOTATION = Object.freeze({
   openWorldHint: false,
 });
 
+// WP-2 (docs/remote-session-hub-bridge-2026-10-30.html §5 R-4/R-8, §6.4): `hub_exec` runs an
+// arbitrary command on the hub Mac as the hub user, so nothing but the user's own grant bounds its
+// effect. Destructive and non-idempotent; closed-world (the command runs on a machine in this pool,
+// not against an open third-party service).
+const DESTRUCTIVE_TOOL_ANNOTATION = Object.freeze({
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: false,
+});
+
 // WP-11 (D-22, gate 7.5): every tool in MCP_TOOLS has an explicit entry here. There is
 // no read-only fallback — a tool with no entry throws at module load
 // (`mcp_tool_missing_annotation:<name>`), so a new tool cannot silently inherit a hint.
@@ -296,6 +321,13 @@ const TOOL_ANNOTATIONS = {
   walle_worker_wait: READ_ONLY_TOOL_ANNOTATION,
   walle_resume_worker: ADDITIVE_WRITE_TOOL_ANNOTATION,
   walle_stop_worker: IDEMPOTENT_WRITE_TOOL_ANNOTATION,
+  // WP-4 (local-landing-queue-multi-session-integration-2026-10-26.html §6.4): the landing tools.
+  // status/conflicts/wait only read CTM's queue; submit is a write that is idempotent -- a second
+  // submit of the same tip returns the existing job (CTM/CLI own that).
+  walle_landing_status: READ_ONLY_TOOL_ANNOTATION,
+  walle_landing_submit: IDEMPOTENT_WRITE_TOOL_ANNOTATION,
+  walle_landing_wait: READ_ONLY_TOOL_ANNOTATION,
+  walle_landing_conflicts: READ_ONLY_TOOL_ANNOTATION,
   // Slack + iMessage read tools (defined in mcp-tool-registry.js; their hints come from
   // this one table, resolved through buildMcpToolRegistry). The three Slack readers call
   // a live remote Slack API -> open world. The three iMessage readers read only the local
@@ -307,6 +339,20 @@ const TOOL_ANNOTATIONS = {
   walle_imessage_search: READ_ONLY_TOOL_ANNOTATION,
   walle_imessage_read_chat: READ_ONLY_TOOL_ANNOTATION,
   walle_imessage_list_chats: READ_ONLY_TOOL_ANNOTATION,
+  // WP-1 (remote-session-hub-bridge-2026-10-30.html §5 R-10, §6.4): reading a session that lives
+  // on ANOTHER machine in this pool is a closed-world read of the local hub-bridge lane.
+  hub_session_read: READ_ONLY_TOOL_ANNOTATION,
+  // WP-2 (remote-session-hub-bridge-2026-10-30.html §5 R-4/R-8/R-11, §6.4): the hub's own file
+  // system. Two readers are closed-world reads of a machine in this pool; `hub_exec` is the one
+  // destructive tool in the family — a command can write, and only the user's grant bounds it.
+  hub_read_file: READ_ONLY_TOOL_ANNOTATION,
+  hub_list: READ_ONLY_TOOL_ANNOTATION,
+  hub_exec: DESTRUCTIVE_TOOL_ANNOTATION,
+  // WP-3 (remote-session-hub-bridge-2026-10-30.html §3 P-2, §5 R-4, §6.4, §8 WP-3): listing a hub
+  // MCP server's tools is a closed-world read of a machine in this pool; calling one is DESTRUCTIVE
+  // — a browser tool can navigate, click and type in a real browser.
+  hub_mcp_list_tools: READ_ONLY_TOOL_ANNOTATION,
+  hub_mcp_call: DESTRUCTIVE_TOOL_ANNOTATION,
 };
 
 // Gate 7.5: the only way a tool gets hints. Throws (naming the tool) rather than
@@ -595,13 +641,14 @@ const BASE_MCP_TOOLS = [
   },
   {
     name: 'walle_get_session',
-    description: 'Retrieve one bounded compact-envelope page of CTM session context by session/source id, or parse a bounded JSONL range when adapter_id and uri are provided. Continue with next_cursor; heavyweight provider payloads are never returned from CTM storage.',
+    description: 'Retrieve one bounded compact-envelope page of CTM session context by session/source id, by a session link or id from any machine in your pool (hub or box, via the `ref` arg), or parse a bounded JSONL range when adapter_id and uri are provided. Continue with next_cursor; heavyweight provider payloads are never returned from CTM storage.',
     inputSchema: {
       type: 'object',
       properties: {
         session_id: { type: 'string', description: 'CTM session id or agent session id to retrieve from cached DB tables' },
         session_ids: { type: 'array', items: { type: 'string' }, description: 'Several CTM/agent session ids to retrieve together' },
         source_id: { type: 'string', description: 'Stable source/session id to retrieve from memory' },
+        ref: { type: 'string', description: 'A session link (…#session=<id>), review=<id>, or id — the session can be on any machine in your pool' },
         adapter_id: { type: 'string', description: 'Optional adapter id for direct JSONL parse' },
         uri: { type: 'string', description: 'Optional JSONL path for direct parse' },
         limit: {
@@ -695,8 +742,8 @@ const BASE_MCP_TOOLS = [
       properties: {
         timeout_ms: { type: 'number', description: 'Timeout for each underlying CTM API call (default 5000)' },
         query: { type: 'string', description: 'Optional spoken model or route phrase (e.g. "glm 5.2"); when present the result adds `resolution` -- the same fail-closed resolution walle_delegate_implementation would apply.' },
-        agent: { type: 'string', enum: ['claude', 'codex'], description: 'Worker CLI the resolution must be servable for (default claude)' },
-        harness: { type: 'string', enum: ['claude-code', 'codex-cli'], description: 'Optional CLI harness; selects the effective worker agent for route servability' },
+        agent: { type: 'string', enum: ['claude', 'codex', 'dsh'], description: 'Worker CLI the resolution must be servable for (default claude)' },
+        harness: { type: 'string', enum: ['claude-code', 'codex-cli', 'dsh-acp'], description: 'Optional CLI harness; selects the effective worker agent for route servability' },
       },
     },
   },
@@ -711,8 +758,8 @@ const BASE_MCP_TOOLS = [
         timeout_ms: { type: 'number', description: 'Timeout for the CTM worker-start request (default 30000)' },
         route: { type: 'string', description: 'Provider row id, or the built-in anthropic-oauth. Omit (with `model` too) to use the lead\'s effective delegate pick -- Wall-E fills in both route and model before calling CTM, or answers lane "native" with no launch.' },
         model: { type: 'string', description: 'Model id, OR a spoken phrase such as "glm 5.2". Append " on <word>" to pin where it runs: an exact route id ("glm 5.3 on portkey-int-example-modal"), a class ("on portkey" = any Portkey-served route, "on direct" = a vendor-direct route), a connector type ("on modal", "on bedrock", "on vertex"), or tenant words ("on team-test"). The phrase is resolved against the registry for this agent: no match -> model_unknown; several models -> model_ambiguous with candidates; an identity whose every in-scope route is unhealthy -> route_unavailable with excluded[] reasons and offers[] you may name explicitly; an unknown word after "on" -> route_unavailable with reason route_not_found, tried[] and offers[] naming the routes that exist. chosen.reason starts with "pinned" when the qualifier was honoured -- never guessed. Omit both model and route to get the lead\'s effective delegate pick (result `source` is explicit when this field or route is given).' },
-        agent: { type: 'string', enum: ['claude', 'codex'], description: 'Worker CLI agent (default claude)' },
-        harness: { type: 'string', enum: ['claude-code', 'codex-cli'], description: 'Optional CLI harness alias; must agree with agent when both are supplied' },
+        agent: { type: 'string', enum: ['claude', 'codex', 'dsh'], description: 'Worker CLI agent (default claude)' },
+        harness: { type: 'string', enum: ['claude-code', 'codex-cli', 'dsh-acp'], description: 'Optional CLI harness alias; must agree with agent when both are supplied' },
         worker_profile: { type: 'string', enum: ['legacy', 'implementation', 'review'], description: 'Worker role profile (default implementation, bounded baseline; review = read-only census/research/review, report only, no workspace writes; legacy remains available for compatibility)' },
         allowed_tools: { type: 'array', items: { type: 'string' }, description: 'Optional explicit allow-list; default is .ctm.json worker.allowedTools, else a conservative built-in list' },
         max_turns: { type: 'number', description: 'Optional base step budget in provider requests (normally omit: CTM resolves the per-model base and renews the lease while the worker progresses)' },
@@ -777,6 +824,165 @@ const BASE_MCP_TOOLS = [
       },
     },
   },
+  // WP-4 (local-landing-queue-multi-session-integration-2026-10-26.html §6.3, §6.4, D-10): the
+  // landing-queue tools. CTM owns the queue (lib/api/landing.js); these read it and submit a
+  // branch to it -- an agent never merges or fast-forwards the target itself. `session` defaults to
+  // the caller's CTM session id when the stdio proxy supplies one (D-13); like the delegate tools
+  // it is not a documented public argument -- the proxy injects it, the server accepts it.
+  {
+    name: 'walle_landing_status',
+    description: 'Read the landing (merge) queue CTM manages for a repo: queue depth and order, per-job state/ETA, the conflict radar summary, and this session\'s own position. Read-only.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        repo: { type: 'string', description: 'Repository path (common dir or a worktree path); defaults to the caller session\'s repo' },
+        session: { type: 'string', description: 'CTM session id whose per-session view to include (defaults to the caller\'s session)' },
+        timeout_ms: { type: 'number', description: 'CTM call timeout (default 30000)' },
+      },
+    },
+  },
+  {
+    name: 'walle_landing_submit',
+    description: 'Submit the caller session\'s committed branch tip to CTM\'s landing queue and return its job (jobId, position, runner, eta_s) or the queue\'s typed refusal. Use this to integrate finished work; never merge or fast-forward the target branch yourself. Idempotent: a second submit of the same tip returns the existing job. Pass priority (with a reason) to move the job ahead.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        session: { type: 'string', description: 'CTM session id whose worktree to submit (defaults to the caller\'s session)' },
+        priority: {
+          type: 'string',
+          enum: ['normal', 'high', 'urgent'],
+          description: 'Queue priority. high = run next after the current gate; urgent = also stop a running lower-priority gate (only for a fix the target branch needs to go green). Re-submitting the same tip with a priority re-prioritizes the existing job.',
+        },
+        reason: {
+          type: 'string',
+          description: 'Required for high and urgent; shown in land status and recorded in the job audit trail.',
+        },
+        timeout_ms: { type: 'number', description: 'CTM call timeout (default 30000)' },
+      },
+    },
+  },
+  {
+    name: 'walle_landing_wait',
+    description: 'Wait for one landing job to reach a terminal state (landed, failed, blocked, canceled) by polling CTM\'s status route every 5 s (first poll immediate). Returns { job, woke_on: "terminal"|"timeout" }. Read-only; never a tight loop.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        jobId: { type: 'string', description: 'The landing job id returned by walle_landing_submit' },
+        session: { type: 'string', description: 'CTM session id (defaults to the caller\'s session)' },
+        repo: { type: 'string', description: 'Repository path to poll (defaults to the caller session\'s repo)' },
+        timeout_ms: { type: 'number', maximum: 540000, description: 'Maximum wait in milliseconds (default and maximum 540000)' },
+      },
+      required: ['jobId'],
+    },
+  },
+  {
+    name: 'walle_landing_conflicts',
+    description: 'Report the conflict radar for a repo: pairwise overlap between live branches (pairs), plus this session\'s own overlapping sessions. Derived from one landing-status call. Read-only.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        repo: { type: 'string', description: 'Repository path (common dir or a worktree path); defaults to the caller session\'s repo' },
+        session: { type: 'string', description: 'CTM session id whose overlaps to include (defaults to the caller\'s session)' },
+        timeout_ms: { type: 'number', description: 'CTM call timeout (default 30000)' },
+      },
+    },
+  },
+  {
+    // WP-1 (docs/remote-session-hub-bridge-2026-10-30.html §6.4, §8 WP-1): the one tool whose
+    // subject lives on ANOTHER machine. Every hub_* tool is HIDDEN from tools/list only for a session
+    // that is provably not a box session (hub-bridge-box-session-awareness-2026-10-31.html R-1/R-2 —
+    // see memory/hub-bridge-client.js isBoxSession and mcp-contract.js's `hideTools` option).
+    name: 'hub_session_read',
+    description: 'Read a CTM session that lives on another machine in your pool, normally the hub Mac driving this session. Use it for http://localhost:3456/...#session=<id> links, which point at the hub, not at this machine.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ref: { type: 'string', description: 'The session to read: a hub URL containing #session=<id>, a review=<id> reference, or a bare session id' },
+        query: { type: 'string', description: 'Optional case-insensitive substring filter over the message text' },
+        max_messages: { type: 'number', description: 'Maximum messages to return, newest last (default 40, hard max 200)' },
+        machine: { type: 'string', description: 'Target machine (instance id or name). Default: the hub that created this session; pass it to choose another connected machine.' },
+      },
+      required: ['ref'],
+    },
+  },
+  {
+    // WP-2 (docs/remote-session-hub-bridge-2026-10-30.html §5 R-4/R-8, §6.4, §8 WP-2): read ONE
+    // file on the hub Mac — the machine driving this session — as the hub user. Hidden with the
+    // other hub_* tools when this machine shares a pool with nobody (R-10).
+    name: 'hub_read_file',
+    description: 'Read a file on the hub Mac (the machine driving this session), as the hub user. The first use may need the user to approve \'read\' for this session in the CTM session toolbar, then retry once.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the file to read (required)' },
+        offset: { type: 'number', description: 'First line to return, 0-based (default 0)' },
+        limit: { type: 'number', description: 'Maximum lines to return (default 2000, hard max 2000)' },
+        machine: { type: 'string', description: 'Target machine (instance id or name). Default: the hub that created this session; pass it to choose another connected machine.' },
+      },
+      required: ['path'],
+    },
+  },
+  {
+    // WP-2 (§6.4): one directory listing on the hub Mac. Same tier and same R-10 hiding as the read.
+    name: 'hub_list',
+    description: 'List a directory on the hub Mac (the machine driving this session), as the hub user. The first use may need the user to approve \'read\' for this session in the CTM session toolbar, then retry once.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', description: 'Absolute path of the directory to list (required)' },
+        glob: { type: 'string', description: 'Optional simple name filter: * and ? only, matched against the entry name' },
+        machine: { type: 'string', description: 'Target machine (instance id or name). Default: the hub that created this session; pass it to choose another connected machine.' },
+      },
+      required: ['path'],
+    },
+  },
+  {
+    // WP-2 (§6.4): run a command on the hub Mac as the hub user. Annotations are DESTRUCTIVE — a
+    // command can write — and CTM gates it behind the user's own `exec` grant (R-4).
+    name: 'hub_exec',
+    description: 'Run a shell command on the hub Mac (the machine driving this session), as the hub user. DESTRUCTIVE: it can modify that machine. The first use needs the user to approve \'exec\' for this session in the CTM session toolbar, then retry once.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        command: { type: 'string', description: 'The command line to run (required; executed by the hub\'s login shell)' },
+        cwd: { type: 'string', description: 'Absolute working directory on the hub Mac (default: the hub user\'s home)' },
+        timeout_ms: { type: 'number', description: 'Kill the command after this many milliseconds (default 30000, hard max 120000)' },
+        machine: { type: 'string', description: 'Target machine (instance id or name). Default: the hub that created this session; pass it to choose another connected machine.' },
+      },
+      required: ['command'],
+    },
+  },
+  {
+    // WP-3 (docs/remote-session-hub-bridge-2026-10-30.html §3 P-2, D-4, §5 R-4, §6.4, §8 WP-3):
+    // list the tools of one HUB-side browser MCP server (tier `browser`). Hidden with the other
+    // hub_* tools when this machine shares a pool with nobody (R-10).
+    name: 'hub_mcp_list_tools',
+    description: 'List the tools of a browser MCP server running on the hub Mac (the machine driving this session). Use the hub Mac\'s browser. Server \'playwright\' is a separate automation browser (good for localhost pages). Server \'chrome-devtools\' attaches to the user\'s real Chrome, and Chrome asks the user to allow it the first time. Claude leads signed in with claude.ai may prefer native Claude in Chrome if it lists the hub browser. The first use needs the user to approve \'browser\' for this session in the CTM session toolbar, then retry once.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        server: { type: 'string', description: 'Which hub MCP server: \'playwright\' (automation browser) or \'chrome-devtools\' (the user\'s real Chrome)' },
+        machine: { type: 'string', description: 'Target machine (instance id or name). Default: the hub that created this session; pass it to choose another connected machine.' },
+      },
+      required: ['server'],
+    },
+  },
+  {
+    // WP-3 (§6.4): call one tool on one HUB-side browser MCP server. DESTRUCTIVE — a tool call can
+    // drive and modify a real browser — and CTM gates it behind the user's own `browser` grant (R-4).
+    name: 'hub_mcp_call',
+    description: 'Call a tool on a browser MCP server running on the hub Mac (the machine driving this session). DESTRUCTIVE: it can drive and modify a real browser. Use the hub Mac\'s browser. Server \'playwright\' is a separate automation browser (good for localhost pages). Server \'chrome-devtools\' attaches to the user\'s real Chrome, and Chrome asks the user to allow it the first time. Claude leads signed in with claude.ai may prefer native Claude in Chrome if it lists the hub browser. The first use needs the user to approve \'browser\' for this session in the CTM session toolbar, then retry once.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        server: { type: 'string', description: 'Which hub MCP server: \'playwright\' (automation browser) or \'chrome-devtools\' (the user\'s real Chrome)' },
+        tool: { type: 'string', description: 'The tool name to call on that server (see hub_mcp_list_tools)' },
+        arguments: { type: 'object', description: 'Arguments object for the tool, as its inputSchema describes' },
+        machine: { type: 'string', description: 'Target machine (instance id or name). Default: the hub that created this session; pass it to choose another connected machine.' },
+      },
+      required: ['server', 'tool'],
+    },
+  },
 ];
 
 function toolTitle(name) {
@@ -830,6 +1036,16 @@ const CONTROL_METHODS = Object.freeze([
 ]);
 const CONTROL_METHOD_SET = new Set(CONTROL_METHODS);
 
+/**
+ * R-1/R-2: `tools/list` is filtered through `options.hideTools` (a Set of names). A session that is
+ * provably not a box session hides every `hub_*` tool — the caller (memory/hub-bridge-client.js via
+ * bin/walle-mcp-stdio.js / mcp-server.js) owns that decision; this only refuses to advertise a name it was told to hide.
+ */
+function _visibleTools(hideTools) {
+  if (!hideTools || typeof hideTools.has !== 'function' || hideTools.size === 0) return MCP_TOOLS;
+  return MCP_TOOLS.filter((tool) => !hideTools.has(tool.name));
+}
+
 function handleControlMessage(message, options = {}) {
   const protocol = handleProtocolMessage(message, options);
   if (protocol.handled) return protocol;
@@ -837,7 +1053,7 @@ function handleControlMessage(message, options = {}) {
 
   const protocolVersion = selectProtocolVersion(message.params?.protocolVersion);
   const values = {
-    'tools/list': { tools: MCP_TOOLS },
+    'tools/list': { tools: _visibleTools(options.hideTools) },
     'resources/list': { resources: MCP_RESOURCES },
     'resources/templates/list': { resourceTemplates: MCP_RESOURCE_TEMPLATES },
     'prompts/list': { prompts: MCP_PROMPTS },