fuli-context 0.7.6 → 0.7.8

package/src/employees/package-registry.js

@@ -0,0 +1,107 @@
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { EmployeeError, parseEmployeeManifest } from './manifest.js';
+
+const builtinRoot = fileURLToPath(new URL('./catalog/', import.meta.url));
+
+export function createEmployeePackageRegistry({ packageDirectory, dataDirectory, catalogDirectory = builtinRoot }) {
+  const runtimes = new Map();
+  let closed = false;
+
+  function catalog() {
+    const entries = new Map();
+    for (const file of readdirSync(catalogDirectory).filter((name) => name.endsWith('.json'))) {
+      const manifest = readManifest(join(catalogDirectory, file));
+      entries.set(manifest.id, { manifest, root: null, runtimeStatus: manifest.runtime ? 'install_required' : 'not_required' });
+    }
+    if (packageDirectory && existsSync(packageDirectory)) {
+      for (const name of readdirSync(packageDirectory)) {
+        if (!/^[a-z][a-z0-9-]{0,63}$/.test(name)) continue;
+        const root = join(packageDirectory, name);
+        try {
+          if (!statSync(root).isDirectory()) continue;
+          confinedPath(packageDirectory, name);
+          const manifest = readManifest(confinedPath(root, 'employee.json'));
+          if (manifest.id !== name) continue;
+          if (manifest.runtime) {
+            confinedPath(root, manifest.runtime.entry);
+            confinedPath(root, `${manifest.runtime.webRoot}/index.html`);
+          }
+          entries.set(name, { manifest, root, runtimeStatus: manifest.runtime ? 'ready' : 'not_required' });
+        } catch {
+          const previous = entries.get(name);
+          if (previous) entries.set(name, { ...previous, runtimeStatus: 'unavailable' });
+        }
+      }
+    }
+    return [...entries.values()];
+  }
+
+  function get(id) {
+    const entry = catalog().find(({ manifest }) => manifest.id === id);
+    if (!entry) throw new EmployeeError('Employee template not found', 404, 'template_not_found');
+    return entry;
+  }
+
+  async function runtime(id) {
+    if (closed) throw new EmployeeError('Employee runtime is closed', 503, 'runtime_closed');
+    const entry = get(id);
+    if (entry.runtimeStatus !== 'ready' || !entry.manifest.runtime) {
+      throw new EmployeeError('Employee workbench package is not installed or unavailable', 503, 'runtime_unavailable');
+    }
+    if (!runtimes.has(id)) {
+      const loading = (async () => {
+        const module = await import(pathToFileURL(confinedPath(entry.root, entry.manifest.runtime.entry)).href);
+        if (typeof module.createEmployeeRuntime !== 'function') throw new TypeError('Invalid employee runtime export');
+        const instance = await module.createEmployeeRuntime({
+          dataDirectory: resolve(dataDirectory, id),
+          packageDirectory: entry.root,
+          manifest: entry.manifest
+        });
+        if (!instance || !['handleHttp', 'callTool', 'describeTools', 'close'].every(
+          (name) => typeof instance[name] === 'function'
+        )) {
+          instance?.close?.();
+          throw new TypeError('Employee runtime does not implement API version 1');
+        }
+        if (closed) { await instance.close(); throw new Error('Employee runtime is closed'); }
+        return instance;
+      })().catch(() => {
+        runtimes.delete(id);
+        throw new EmployeeError('Employee runtime could not be loaded', 503, 'runtime_unavailable');
+      });
+      runtimes.set(id, loading);
+    }
+    return runtimes.get(id);
+  }
+
+  return {
+    catalog, get, runtime,
+    async close() {
+      closed = true;
+      await Promise.allSettled([...runtimes.values()].map(async (entry) => (await entry).close()));
+      runtimes.clear();
+    }
+  };
+}
+
+export function confinedPath(root, file) {
+  const resolvedRoot = realpathSync(root);
+  const resolvedFile = realpathSync(resolve(root, file));
+  const local = relative(resolvedRoot, resolvedFile);
+  if (local === '..' || local.startsWith(`..${sep}`) || isAbsolute(local)) {
+    throw new TypeError('Employee package path escapes its installation');
+  }
+  return resolvedFile;
+}
+
+function readManifest(file) {
+  if (statSync(file).size > 32_768) throw new TypeError('Employee manifest is too large');
+  return parseEmployeeManifest(JSON.parse(readFileSync(file, 'utf8')));
+}
+
+export function employeeDirectories(runtimeConfigPath) {
+  const root = join(dirname(runtimeConfigPath), 'employees');
+  return { packageDirectory: join(root, 'packages'), dataDirectory: join(root, 'data') };
+}

package/src/employees/project-selection.js

@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { EmployeeError } from './manifest.js';
+
+const projectId = z.string().min(1).max(256);
+const selectionSchema = z.object({
+  personalProjectId: projectId.optional(),
+  personalProjectIds: z.array(projectId).max(500).optional(),
+  replaceAssignments: z.boolean().optional(),
+  expectedAssignmentsVersion: z.string().min(1).max(128).optional(),
+  reactivate: z.boolean().optional(),
+  management: z.unknown().optional(),
+});
+
+export function parseEmployeeProjectSelection(input) {
+  const parsed = selectionSchema.safeParse(input);
+  if (!parsed.success) throw new TypeError('Invalid employee project selection');
+  const value = parsed.data;
+  if ((value.personalProjectId && value.personalProjectIds !== undefined) ||
+    (value.management !== undefined && (value.personalProjectId || value.personalProjectIds !== undefined)) ||
+    (value.replaceAssignments && ((!value.personalProjectIds && value.management === undefined) || !value.expectedAssignmentsVersion)) ||
+    (!value.replaceAssignments && value.expectedAssignmentsVersion !== undefined)) {
+    throw new TypeError('Replacing employee projects requires an explicit project list and its last-read version');
+  }
+  return {
+    projectIds: [...new Set(value.personalProjectIds ?? (value.personalProjectId ? [value.personalProjectId] : []))],
+    replace: value.replaceAssignments === true,
+    expectedVersion: value.expectedAssignmentsVersion,
+  };
+}
+
+export function activeEmployeeAssignments(agent) {
+  return (agent?.assignments ?? []).filter(({ status }) => status === 'active');
+}
+
+export function employeeAssignmentsVersion(agent, policy = null) {
+  const records = activeEmployeeAssignments(agent)
+    .map(({ personalProjectId, assignmentId, revision }) => [personalProjectId, assignmentId, revision ?? 0])
+    .sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+  return createHash('sha256').update(JSON.stringify(policy ? [records, policy] : records)).digest('hex');
+}
+
+export async function resolveEmployeeProjectSelection(app, spaceId, selection) {
+  const projects = await app.listPersonalProjects({ personalSpaceId: spaceId });
+  const availableIds = new Set(projects.filter((entry) => entry.profile?.lifecycle !== 'archived').map((entry) => entry.project_id));
+  if (selection.projectIds.some((id) => !availableIds.has(id))) {
+    throw new EmployeeError('Project is unavailable; reload and select active FULI projects', 404, 'project_not_found');
+  }
+  return availableIds;
+}

package/src/employees/recruitment.js

@@ -0,0 +1,199 @@
+import { createHash } from 'node:crypto';
+import { EmployeeError, employeeAgentId, employeeCapability } from './manifest.js';
+import {
+  activeEmployeeAssignments, employeeAssignmentsVersion,
+  parseEmployeeProjectSelection, resolveEmployeeProjectSelection,
+} from './project-selection.js';
+import { managementFor, managementWithoutRevision, parseEmployeeManagement, policyAllowsProject } from './management-policy.js';
+
+export function createEmployeeRecruitment({ app, registry, managementStore }) {
+  const locks = new Map();
+  const spaceId = app.config.personal.spaceId;
+
+  function assertSpace(input) {
+    if (input.personalSpaceId && input.personalSpaceId !== spaceId) {
+      throw new EmployeeError('Employee belongs to another personal space', 403, 'space_mismatch');
+    }
+  }
+
+  async function project(input, required = false) {
+    assertSpace(input);
+    const id = input.personalProjectId;
+    if (!id && !required) return null;
+    if (!id) throw new EmployeeError('Select a project before opening the workbench', 400, 'project_required');
+    const projects = await app.listPersonalProjects({ personalSpaceId: spaceId });
+    const match = projects.find((entry) => entry.project_id === id);
+    if (!match || match.profile?.lifecycle === 'archived') {
+      throw new EmployeeError('Project is unavailable; create or select an active FULI project', 404, 'project_not_found');
+    }
+    return { id: match.project_id, name: match.profile.name, description: match.profile.purpose ?? '' };
+  }
+
+  async function list(input = {}) {
+    assertSpace(input);
+    const [agents, projects] = await Promise.all([
+      app.listProjectAgents({ personalSpaceId: spaceId }),
+      app.listPersonalProjects({ personalSpaceId: spaceId }),
+    ]);
+    return { templates: registry.catalog().map(({ manifest, runtimeStatus }) => {
+      const agent = agents.find(({ agentId }) => agentId === employeeAgentId(manifest.id));
+      const owned = agent?.profile.capabilities.includes(employeeCapability(manifest.id));
+      const stored = managementStore.read(spaceId, manifest.id);
+      const management = managementFor(manifest, owned ? agent : null, stored);
+      const managedProjects = owned && agent.profile.status === 'active' ? projects
+        .filter(entry => entry.profile?.lifecycle !== 'archived' && policyAllowsProject(management, entry.project_id)
+          && (management.mode === 'all' || activeEmployeeAssignments(agent).some(a => a.personalProjectId === entry.project_id)))
+        .map(entry => ({ id: entry.project_id, name: entry.profile.name })) : [];
+      return {
+        ...manifest,
+        runtime: manifest.runtime ? { apiVersion: manifest.runtime.apiVersion } : null,
+        runtimeStatus,
+        agentId: owned ? agent.agentId : null,
+        agentStatus: owned ? agent.profile.status : null,
+        assignmentsVersion: employeeAssignmentsVersion(owned ? agent : null, stored),
+        management, managedProjects,
+        assignmentCount: owned ? activeEmployeeAssignments(agent).length : 0,
+        assignments: owned ? activeEmployeeAssignments(agent) : [],
+        identityConflict: Boolean(agent && !owned)
+      };
+    }) };
+  }
+
+  async function recruit(input) {
+    assertSpace(input);
+    const { manifest } = registry.get(input.templateId);
+    const selection = parseEmployeeProjectSelection(input);
+    const agentId = employeeAgentId(manifest.id);
+    const key = `${spaceId}:${agentId}`;
+    const previous = locks.get(key) ?? Promise.resolve();
+    const operation = previous.catch(() => {}).then(async () => {
+      // Validate the entire snapshot before creating an identity or changing any assignment.
+      const availableIds = await resolveEmployeeProjectSelection(app, spaceId, selection);
+      const agents = await app.listProjectAgents({ personalSpaceId: spaceId });
+      let agent = agents.find((entry) => entry.agentId === agentId);
+      let changed = false;
+      if (agent && !agent.profile.capabilities.includes(employeeCapability(manifest.id))) {
+        throw new EmployeeError('This Agent identifier is already in use; the existing Agent was not modified', 409, 'identity_conflict');
+      }
+      if (agent && agent.profile.status !== 'active' && input.reactivate !== true) {
+        throw new EmployeeError('Confirm reactivation of this employee first', 409, 'reactivation_required');
+      }
+      const active = activeEmployeeAssignments(agent);
+      const stored = managementStore.read(spaceId, manifest.id);
+      const currentPolicy = managementFor(manifest, agent, stored);
+      let desiredPolicy = managementWithoutRevision(currentPolicy);
+      if (input.management !== undefined) {
+        desiredPolicy = parseEmployeeManagement(input.management);
+        if (agent && !selection.replace) throw new TypeError('Updating employee management requires replaceAssignments and its last-read version');
+        const existingProjects = new Set((await app.listPersonalProjects({ personalSpaceId: spaceId })).map(p => p.project_id));
+        if (desiredPolicy.projectIds.some(id => !availableIds.has(id)) || desiredPolicy.excludedProjectIds.some(id => !existingProjects.has(id) && !currentPolicy.excludedProjectIds.includes(id))) {
+          throw new EmployeeError('Project is unavailable; reload the management policy', 404, 'project_not_found');
+        }
+      } else if (input.personalProjectIds !== undefined || input.personalProjectId) {
+        if (currentPolicy.mode === 'all' && agent && !selection.replace) {
+          if (selection.projectIds.some(id => !policyAllowsProject(currentPolicy, id))) {
+            throw new EmployeeError('This project is excluded; update the management policy explicitly', 403, 'project_excluded');
+          }
+        } else {
+          desiredPolicy = { ...desiredPolicy, mode: 'selected', excludedProjectIds: [],
+            projectIds: [...new Set(selection.replace ? selection.projectIds : [...active.map(a => a.personalProjectId), ...selection.projectIds])].sort() };
+        }
+      }
+      const requestedIds = new Set([...availableIds].filter(id => policyAllowsProject(desiredPolicy, id)));
+      const additions = [...requestedIds].filter((id) => !active.some((entry) => entry.personalProjectId === id));
+      // Archived project history stays intact; this control only manages currently available projects.
+      const removals = selection.replace ? active.filter((entry) => availableIds.has(entry.personalProjectId) && !requestedIds.has(entry.personalProjectId)) : [];
+      const policyChanged = JSON.stringify(desiredPolicy) !== JSON.stringify(managementWithoutRevision(currentPolicy));
+      if (selection.replace && (additions.length || removals.length || policyChanged) &&
+        selection.expectedVersion !== employeeAssignmentsVersion(agent, stored)) {
+        throw new EmployeeError('Project assignments changed; reload the selection before saving', 409, 'assignment_scope_conflict');
+      }
+      if (!agent || agent.profile.status !== 'active') {
+        const profile = agent ? { ...agent.profile, status: 'active' } : {
+          name: manifest.name,
+          occupationEmoji: manifest.occupationEmoji,
+          responsibility: `${manifest.role}：${manifest.description}`,
+          agentType: 'durable', status: 'active',
+          capabilities: [...manifest.capabilities, employeeCapability(manifest.id)],
+          workKinds: manifest.workKinds,
+          initialPreferences: manifest.initialPreferences,
+          defaultModelStrategy: { mode: 'adaptive' },
+          executorPolicy: { mode: 'flexible' }
+        };
+        agent = await app.upsertProjectAgent({ personalSpaceId: spaceId, agentId, profile });
+        changed = true;
+      }
+      const endedAssignments = [];
+      try {
+        // Persist the authorization boundary first. Provider writes may fail,
+        // but a newly excluded project must immediately stop reaching the PM.
+        if (policyChanged || !stored) {
+          managementStore.write(spaceId, manifest.id, desiredPolicy, stored?.revision ?? 0);
+          changed = true;
+        }
+        // Revoke first: an interrupted batch must never grant new access before removing exclusions.
+        for (const assignment of removals) {
+          endedAssignments.push(await app.endProjectAgentAssignment({
+            personalSpaceId: spaceId, personalProjectId: assignment.personalProjectId,
+            assignmentId: assignment.assignmentId, expectedRevision: assignment.revision ?? 0,
+            reason: `Update employee ${manifest.id} project selection`,
+          }));
+          changed = true;
+        }
+        for (const personalProjectId of additions) {
+          const history = (agent.assignments ?? []).filter((entry) => entry.personalProjectId === personalProjectId);
+          const generation = history.map((entry) => `${entry.assignmentId}:${entry.revision ?? 0}`).sort();
+          const key = createHash('sha256').update(JSON.stringify([manifest.id, personalProjectId, generation])).digest('hex');
+          await app.createProjectAgentAssignment({
+            personalSpaceId: spaceId, personalProjectId, agentId,
+            idempotencyKey: `employee-assignment:${key}`,
+            responsibility: agent.profile.responsibility,
+            workKinds: agent.profile.workKinds ?? manifest.workKinds,
+            capabilities: agent.profile.capabilities,
+            reason: `Recruit employee template ${manifest.id}@${manifest.version}`,
+          });
+          changed = true;
+        }
+      } catch (error) {
+        if (error instanceof EmployeeError && error.code === 'assignment_scope_conflict') throw error;
+        // Provider assignment writes are individually durable, not a cross-project transaction.
+        throw new EmployeeError('Project selection could not be fully saved; reload actual assignments before retrying', 502, 'assignment_update_incomplete');
+      }
+      agent = (await app.listProjectAgents({ personalSpaceId: spaceId })).find((entry) => entry.agentId === agentId);
+      const assignments = activeEmployeeAssignments(agent);
+      const assignment = selection.projectIds.length === 1
+        ? assignments.find((entry) => entry.personalProjectId === selection.projectIds[0]) ?? null : null;
+      return {
+        templateId: manifest.id, management: managementFor(manifest, agent, managementStore.read(spaceId, manifest.id)),
+        assignmentsVersion: employeeAssignmentsVersion(agent, managementStore.read(spaceId, manifest.id)),
+        assignmentCount: assignments.length, endedAssignmentCount: endedAssignments.length, idempotent: !changed,
+        assignments: structuredClone(assignments), endedAssignments: structuredClone(endedAssignments),
+        assignment: structuredClone(assignment), agent,
+      };
+    });
+    locks.set(key, operation);
+    try { return await operation; }
+    finally { if (locks.get(key) === operation) locks.delete(key); }
+  }
+
+  async function authorize(input) {
+    const selectedProject = await project(input, true);
+    const { manifest } = registry.get(input.templateId);
+    // All-project policy also covers projects without a materialized assignment.
+    const agents = await app.listProjectAgents({ personalSpaceId: spaceId });
+    const agent = agents.find((entry) => entry.agentId === employeeAgentId(manifest.id));
+    const management = managementFor(manifest, agent, managementStore.read(spaceId, manifest.id));
+    if (input.sourceApplication && Array.isArray(agent?.profile.allowedClients) && !agent.profile.allowedClients.includes(input.sourceApplication)) {
+      throw new EmployeeError('This employee is not enabled for the current Agent client', 403, 'assignment_required');
+    }
+    if (!agent || agent.profile.status !== 'active' ||
+      !agent.profile.capabilities.includes(employeeCapability(manifest.id)) ||
+      !policyAllowsProject(management, selectedProject.id) ||
+      (management.mode !== 'all' && !(agent.assignments ?? []).some((entry) => entry.personalProjectId === selectedProject.id && entry.status === 'active'))) {
+      throw new EmployeeError('Recruit this employee into the selected project first', 403, 'assignment_required');
+    }
+    return { personalSpaceId: spaceId, project: selectedProject, agentId: agent.agentId, management };
+  }
+
+  return { list, recruit, authorize };
+}

package/src/employees/service.js

@@ -0,0 +1,83 @@
+import { EmployeeError } from './manifest.js';
+import { createEmployeePackageRegistry, employeeDirectories } from './package-registry.js';
+import { createEmployeeRecruitment } from './recruitment.js';
+import { join } from 'node:path';
+import { EmployeeManagementStore } from './management-policy.js';
+import { employeeTaskEntry } from './task-entry.js';
+
+export function createEmployeeService({ app, runtimeConfigPath, registry: configuredRegistry, managementStore: configuredManagementStore }) {
+  const registry = configuredRegistry ?? createEmployeePackageRegistry(employeeDirectories(runtimeConfigPath));
+  const managementStore = configuredManagementStore ?? new EmployeeManagementStore(runtimeConfigPath
+    ? join(employeeDirectories(runtimeConfigPath).dataDirectory, 'management.sqlite') : ':memory:');
+  const recruitment = createEmployeeRecruitment({ app, registry, managementStore });
+
+  async function resolveInput(input) {
+    if (!input.projectPath) return input;
+    const resolution = await app.listCurrentProjectAgents({ projectPath: input.projectPath });
+    if (!resolution.personal_project_id) {
+      throw new EmployeeError('Register or select this exact FULI project first', 400, 'project_unresolved');
+    }
+    if (input.personalProjectId && input.personalProjectId !== resolution.personal_project_id) {
+      throw new EmployeeError('Project path and project identifier do not match', 403, 'project_mismatch');
+    }
+    return { ...input, personalProjectId: resolution.personal_project_id };
+  }
+
+  async function workspace(input) {
+    const resolved = await resolveInput(input);
+    const context = await recruitment.authorize(resolved);
+    const { manifest, runtimeStatus } = registry.get(resolved.templateId);
+    const basePath = `/employee-workspaces/${encodeURIComponent(manifest.id)}/${encodeURIComponent(context.project.id)}/`;
+    return {
+      ...context, templateId: manifest.id, name: manifest.name, role: manifest.role,
+      runtimeStatus, basePath,
+      workbenchUrl: basePath,
+      agentCardUrl: `${basePath}.well-known/agent-card.json`
+    };
+  }
+
+  async function describeTools(input) {
+    const context = await workspace(input);
+    const runtime = await registry.runtime(context.templateId);
+    return { ...context, tools: await runtime.describeTools() };
+  }
+
+  async function callTool(input) {
+    const context = await workspace(input);
+    const runtime = await registry.runtime(context.templateId);
+    const tools = await runtime.describeTools();
+    const tool = tools.find((entry) => entry.name === input.tool);
+    const { manifest } = registry.get(context.templateId);
+    if (!tool || !manifest.permissions.includes(tool.permission)) {
+      throw new EmployeeError('Employee tool is not available or permitted', 403, 'tool_not_permitted');
+    }
+    const session = input.sourceSessionId ? {
+      sourceApplication: input.sourceApplication ?? 'other', id: input.sourceSessionId,
+      verified: input.sourceSessionVerified === true,
+    } : null;
+    try { return await runtime.callTool(input.tool, input.arguments ?? {}, { ...context, session }); }
+    catch (error) {
+      if (Number.isInteger(error?.status) && error.status >= 400 && error.status < 500) {
+        throw new EmployeeError(error.message, error.status, error.code ?? 'tool_error');
+      }
+      throw error;
+    }
+  }
+
+  return {
+    list: recruitment.list,
+    recruit: async (input) => recruitment.recruit(await resolveInput(input)),
+    workspace, describeTools, callTool,
+    authorize: recruitment.authorize,
+    taskEntry: (input) => employeeTaskEntry({ registry, recruitment, workspace }, input)
+      .catch(() => ({ status: 'unavailable', managers: [], worker_started: false })),
+    async handleHttp(request, response, input) {
+      const context = await workspace(input);
+      const runtime = await registry.runtime(context.templateId);
+      await runtime.handleHttp(request, response, {
+        ...context, origin: input.origin, relativePath: input.relativePath
+      });
+    },
+    async close() { try { await registry.close(); } finally { managementStore.close(); } }
+  };
+}

package/src/employees/task-entry.js

@@ -0,0 +1,39 @@
+// Management is a task-entry capability, not a replacement for the specialist
+// role/executor chosen by FULI. Never persist the user's prompt or start a model.
+export async function employeeTaskEntry({ registry, recruitment, workspace }, input) {
+  if (!input.personalProjectId) return { status: 'project_unresolved', managers: [], worker_started: false };
+  const managers = [];
+  let unavailable = false;
+  for (const { manifest, runtimeStatus } of registry.catalog()) {
+    if (!manifest.taskEntry) continue;
+    try {
+      const context = await recruitment.authorize({ templateId: manifest.id, personalProjectId: input.personalProjectId, sourceApplication: input.sourceApplication });
+      if (runtimeStatus !== 'ready') { unavailable = true; continue; }
+      const resolved = await workspace({ templateId: manifest.id, personalProjectId: input.personalProjectId, sourceApplication: input.sourceApplication });
+      const runtime = await registry.runtime(manifest.id);
+      const definition = (await runtime.describeTools()).find(tool => tool.name === manifest.taskEntry.boardTool);
+      if (!definition || definition.permission !== 'board.read' || !manifest.permissions.includes('board.read')) {
+        unavailable = true; continue;
+      }
+      const board = await runtime.callTool(manifest.taskEntry.boardTool, { limit: 8 }, resolved);
+      managers.push({
+        template_id: manifest.id, agent_id: context.agentId, name: manifest.name,
+        personal_project_id: context.project.id, scope_mode: context.management.mode,
+        title_mode: context.management.titleMode, title_style: context.management.titleStyle,
+        board: { version: board.version, total: board.total, truncated: board.truncated,
+          items: (board.items ?? []).slice(0, 8).map(item => ({
+            id: item.id, title: item.title, status: item.status, priority: item.priority,
+            workType: item.workType, updatedAt: item.updatedAt,
+          })) },
+        session: { sourceApplication: input.sourceApplication ?? 'other', sessionId: input.sourceSessionId ?? input.sessionId ?? null },
+        tools: { discover: 'list_employee_tools', call: 'call_employee_tool',
+          read_board: manifest.taskEntry.boardTool, prepare_title: manifest.taskEntry.titleTool ?? null },
+        guidance: 'Route actionable work in this project through this manager: match existing board items, or create a concise task for new work. Keep conversation-only questions out of the backlog. Update linked items as evidence arrives; Agent completion goes to review, never human-confirmed done. Before creating or editing, discover the installed tool schemas and preserve versions/idempotency. If title_mode is auto or suggest, prepare a title from only this session’s linked work item IDs. Auto applies only when the current host exposes a native session rename capability and the exact target session is known: execute the returned action in that host, then report its actual result. Never edit client databases or transcripts, invent an execution receipt, rename another session, or override a locked/manual title. Do not start an additional model solely for this entry.'
+      });
+    } catch (error) {
+      // Excluded/unassigned/inactive projects never reach the plugin runtime.
+      if (!['assignment_required', 'project_not_found'].includes(error?.code)) unavailable = true;
+    }
+  }
+  return { status: unavailable ? 'degraded' : managers.length ? 'ready' : 'not_managed', managers, worker_started: false };
+}