hilos-agent 0.11.13 → 0.11.14

package/src/handler.mjs

@@ -1,3 +1,4 @@
+import { runCodingTransport, codingChildEnv, codingChildWebEnv, codexRunIsGated } from "./coding-transport.mjs";
 import { githubArtifactPatch } from "./github-artifacts.mjs";
 import { AGENT_CODE_RESULT_RULE, AGENT_REPLY_STYLE_RULE, agentResultText } from "./agent-result.mjs";
 // The handler the published `hilos-agent` package ships and runs. Bias-to-PR by
@@ -28,16 +29,7 @@ import {
   detectPrContinuation,
   selfDrivenShipPlan,
 } from "./daemon.mjs";
-import {
-  runCli,
-  buildHeartbeat,
-  ackText,
-  oneLine,
-  fmtElapsed,
-  minimalEnv,
-  scrubHilosEnv,
-  envForCwd,
-} from "./cli.mjs";
+import { runCli, buildHeartbeat, ackText, oneLine, fmtElapsed, envForCwd } from "./cli.mjs";
 import { commandArgv } from "./argv.mjs";
 import { makeStreamParser, createUsageFold } from "./agent-events.mjs";
 import {
@@ -47,21 +39,7 @@ import {
   MAX_DIRECTION_TURNS,
   readPendingInputs,
 } from "./run-inputs.mjs";
-import {
-  detectVendor,
-  chatWebArgs,
-  codeStreamArgs,
-  codeWebArgs,
-  codeDirArgs,
-  codeImageArgs,
-  codeProjectKey,
-  imagesNeedReading,
-  attachTarget,
-  createProgressEmitter,
-  fastChatCmd,
-  nativeWebPrompt,
-  webToolEnv,
-} from "./progress-emitter.mjs";
+import { detectVendor, chatWebArgs, codeStreamArgs, codeWebArgs, codeDirArgs, codeImageArgs, codeProjectKey, imagesNeedReading, createProgressEmitter, fastChatCmd, nativeWebPrompt } from "./progress-emitter.mjs";
 import { createTranscriptTap } from "./transcript.mjs";
 import { createLocalHarnessEmitter } from "./local-harness-transport.mjs";
 import { releaseDaemonIterateClaim } from "./iterate-claim-recovery.mjs";
@@ -86,25 +64,11 @@ import { buildMemoryBlock } from "./memory.mjs";
 import { deployFolder, resolveDeployTarget } from "./deploy.mjs";
 import { runOpenCodeHttpSession } from "./opencode-session.mjs";
 import { runAcpSession } from "./acp-session.mjs";
-import {
-  shouldGateClaudePermissions,
-  startClaudePermissionServer,
-} from "./claude-permissions.mjs";
-import {
-  codexMcpTransportUnavailable,
-  codexSandboxFromArgs,
-  runCodexMcpSession,
-  shouldGateCodexPermissions,
-} from "./codex-mcp-session.mjs";
-import {
-  childMcpArgs,
-  childMcpPlanned,
-  childToolsNote,
-  codexChildMcpArgs,
-  startChildHilosMcp,
-} from "./child-mcp.mjs";
+import { startClaudePermissionServer } from "./claude-permissions.mjs";
+import { runCodexMcpSession } from "./codex-mcp-session.mjs";
+import { childMcpPlanned, childToolsNote, startChildHilosMcp } from "./child-mcp.mjs";
 import { createUngatedRunNotice } from "./permission-gate.mjs";
-import { repoEditAllowance } from "./permission-gate.mjs";
+
 import { webMcpAgentPrompt } from "./webmcp-bridge.mjs";
 import { truncate } from "./util.mjs";
 import {
@@ -117,28 +81,6 @@ import {
   validConflictRecovery,
 } from "./conflicts.mjs";
 
-/**
- * The environment for a coding/chat CLI run. runCli always strips HILOS_* on top
- * of whatever this returns; here we additionally honor `codingEnv: "minimal"`
- * (strict isolation — only what the tool needs to reach its own model provider).
- * Returns undefined for the default "inherit" mode so runCli falls back to the
- * scrubbed process.env.
- */
-function codingChildEnv(cfg) {
-  return cfg?.codingEnv === "minimal"
-    ? minimalEnv(process.env, cfg.codingEnvAllow)
-    : undefined;
-}
-
-/** Add only the selected CLI's public-web enablement to its already-isolated
- * child environment. Today this changes OpenCode only; keeping it shared makes
- * argv, ACP, HTTP, gated, and conversational runs follow one contract. */
-function codingChildWebEnv(cfg, vendor) {
-  return webToolEnv(vendor, codingChildEnv(cfg), {
-    enabled: cfg?.webSearch !== false,
-  });
-}
-
 /**
  * The fast chat command for this config: an explicit chatCmd wins, else the
  * coding vendor's verified non-interactive print mode (fastChatCmd), else the
@@ -165,7 +107,6 @@ const reviewRounds = new Map();
 // (binary, tier) for the process; a failed lookup emits [] and retries later.
 const modelArgsFor = createModelArgsResolver({ run: (opts) => runCli(opts) });
 
-
 // Sentinel the router model emits (only when a thread already owns a run) to
 // classify a follow-up: change | new-scope | ambiguous. Parsed out of the router
 // output and stripped from the coding brief.
@@ -359,81 +300,6 @@ function defaultDeps() {
   };
 }
 
-/**
- * Bind one OpenCode HTTP session to hilos's vendor-neutral permission tools.
- * Both repo and direct-folder runs use this exact callback contract so neither
- * path can accidentally become the ungated exception.
- */
-function openCodePermissionCallbacks({
-  tool,
-  channelId,
-  threadRoot,
-  runId = null,
-  provider = "opencode",
-  // 0866 — when the server's get_permission_decision supports a long-poll
-  // hold, each read blocks up to this many ms and answers the moment a human
-  // decides, instead of the gate discovering the decision on its next 1s poll.
-  // 0 (older servers) keeps the plain immediate read.
-  decisionWaitMs = 0,
-  // 1256 — the checkout this run edits; an edit under it is allowed on the
-  // daemon without a card (the pull request is the gate). Empty means "no
-  // local allowance": every ask still reaches the room.
-  repoRoot = "",
-  gateRepoEdits = false,
-}) {
-  return {
-    localAllow: (request) => repoEditAllowance(request, { repoRoot, gateRepoEdits }),
-    requestPermission: async (request) => {
-      const detail =
-        request.metadata && typeof request.metadata === "object"
-          ? request.metadata
-          : {};
-      const title = [
-        detail.title,
-        detail.description,
-        detail.command,
-        request.resources?.[0],
-      ].find((value) => typeof value === "string" && value.trim());
-      return tool("request_permission", {
-        channelId,
-        threadRootId: threadRoot,
-        ...(runId ? { runId } : {}),
-        provider,
-        vendorSessionId: request.sessionId,
-        vendorRequestId: request.vendorRequestId,
-        action: request.action,
-        title: title || `${request.action} permission`,
-        resources: request.resources,
-        suggestedSave: request.suggestedSave,
-        metadata: detail,
-        ...(request.source ? { source: request.source } : {}),
-      });
-    },
-    getPermissionDecision: async (handle, { request, failClosed = false }) => {
-      const requestId =
-        handle &&
-        typeof handle === "object" &&
-        typeof handle.requestId === "string"
-          ? handle.requestId
-          : null;
-      if (!requestId) {
-        throw new Error(
-          "hilos returned a pending permission without a request id",
-        );
-      }
-      return tool("get_permission_decision", {
-        requestId,
-        provider,
-        vendorSessionId: request.sessionId,
-        vendorRequestId: request.vendorRequestId,
-        ...(failClosed ? { failClosed: true } : {}),
-        // Never on a failClosed settlement — that call exists to act NOW.
-        ...(decisionWaitMs > 0 && !failClosed ? { waitMs: decisionWaitMs } : {}),
-      });
-    },
-  };
-}
-
 /**
  * The post_progress sender both run lanes use, with the 0782 stop check folded
  * into the beat they already send.
@@ -591,256 +457,6 @@ export function createStopPoller({
   return { stop, tick };
 }
 
-/** The local HTTP bridge can own only a local OpenCode server. An explicit
- * `--attach` remains on OpenCode's CLI responder, which rejects unanswered asks
- * fail closed; taking over a remote server requires a separate authenticated
- * transport contract. Shared by repo and direct-folder runs. */
-export function shouldUseRuntimePermissionBridge({
-  vendor,
-  runtimePermissions,
-  codeArgs,
-  codingCmd,
-}) {
-  return (
-    vendor === "opencode" &&
-    runtimePermissions === true &&
-    !codeArgs.includes("--auto") &&
-    attachTarget(codingCmd) === null
-  );
-}
-
-/** ACP transport (0759; slice 1 opencode, slice 2 cursor). Only runs the
- * workspace already gates with runtime permissions qualify, and only when the
- * vendor's own auto-allow escape hatches are absent — over ACP, hilos must be
- * the one answering asks, so a run configured to never ask has nothing to gate
- * here.
- *
- * 0778 removed two limits that were never about correctness. `acpTransport`
- * now defaults ON (config.mjs) for the vendors whose adapter is proven, and a
- * RESUMED run no longer disqualifies: both live vendors advertise ACP's
- * `loadSession` capability, so acp-session.mjs resumes the session and keeps
- * raising cards. Setting `acpTransport: false` still opts a workspace out. */
-export function shouldUseAcpTransport({
-  vendor,
-  acpTransport,
-  runtimePermissions,
-  codeArgs,
-  codingCmd,
-}) {
-  if (acpTransport !== true) return false;
-  if (runtimePermissions !== true) return false;
-  if (vendor === "opencode") {
-    return shouldUseRuntimePermissionBridge({
-      vendor,
-      runtimePermissions,
-      codeArgs,
-      codingCmd,
-    });
-  }
-  if (vendor === "cursor") {
-    // -f/--force is cursor's "allow everything" switch — the exact analog of
-    // opencode's --auto.
-    return !codeArgs.includes("-f") && !codeArgs.includes("--force");
-  }
-  return false;
-}
-
-/**
- * The env a gated claude run gets (0777).
- *
- * A permission card can legitimately wait on a person for minutes — a 150s wait
- * was verified live — so the CLI's own MCP tool timeout must not cut the ask
- * short before hilos's run deadline does. Everything else about the env is
- * unchanged (runCli still strips HILOS_* itself).
- */
-function claudeGateEnv(cfg) {
-  const base = codingChildEnv(cfg) || process.env;
-  const budget = Math.max(60_000, Number(cfg?.runTimeoutMs) || 0) + 60_000;
-  return { ...base, MCP_TOOL_TIMEOUT: String(budget) };
-}
-
-/**
- * Run claude_code through its permission-prompt seam (0777).
- *
- * Deliberately NOT a new transport: the ordinary argv run is untouched — same
- * runCli, same resume args, same streaming — and the gate is two extra flags
- * plus a loopback MCP server that lives exactly as long as the run. The prompt
- * stays the final argument.
- */
-async function runClaudeGatedCli({
-  deps,
-  cfg,
-  onGateDropped,
-  cmd,
-  codeArgs,
-  prompt,
-  cwd,
-  signal,
-  onData,
-  permissionCallbacks,
-  sessionId = "",
-  resolveSessionId,
-  beforeSpawn,
-  childMcp = null,
-  log = console,
-}) {
-  const server = await deps.startClaudePermissionServer({
-    ...permissionCallbacks,
-    // 1255 — one config file for the run: the gate's permission server and the
-    // run's own hilos seat, plus the allow entry that keeps the agent's room
-    // tools off the permission card.
-    ...(childMcp ? { extraServers: childMcp.servers, allowedTools: childMcp.allowedTools } : {}),
-    sessionId,
-    // A FRESH run has no session id to hand over: claude reveals its own in the
-    // init frame of its stream, which the progress emitter is already folding.
-    // Pulling from that snapshot means an ask carries the CLI's real session id
-    // without a second parser — and hilos rejects an empty one outright.
-    resolveSessionId,
-    timeoutMs: cfg.runTimeoutMs,
-    signal,
-    log,
-  });
-  try {
-    return await deps.runCli({
-      cmd,
-      args: [...codeArgs, ...server.args, prompt],
-      cwd,
-      timeoutMs: cfg.runTimeoutMs,
-      label: "coding",
-      signal,
-      env: claudeGateEnv(cfg),
-      onData,
-      beforeSpawn,
-      // 0785 — a CLI that rejects the gate flags is retried without them. This
-      // fires BEFORE that ungated retry is spawned, so the room hears about the
-      // downgrade first rather than after the fact.
-      onPermissionGateDropped: onGateDropped,
-    });
-  } finally {
-    try {
-      await server.close();
-    } catch {
-      /* tearing the gate down must never fail a finished run */
-    }
-  }
-}
-
-/**
- * Will this codex run take the gated transport (0785)?
- *
- * Answerable before the run's argv exists, because the only input that can
- * change the answer is the operator's OWN command — every flag the daemon
- * appends later (model, dir, image, resume, stream) is ours and none of them is
- * the bypass tier. Which matters because the PROMPT is written before the
- * transport is chosen, and what the prompt may claim about images depends on it.
- */
-function codexRunIsGated(cfg, caps) {
-  return shouldGateCodexPermissions({
-    vendor: detectVendor(cfg?.codingCmd),
-    runtimePermissions: caps?.runtimePermissions,
-    codeArgs: commandArgv(String(cfg?.codingCmd || "")).slice(1),
-  });
-}
-
-/**
- * Run codex through its gated transport, with an honest fallback (0785).
- *
- * A granted workspace ALWAYS gets `codex mcp-server` — that is what the grant
- * means, and it is the only codex transport that can ask (`codex exec` has no
- * approval channel at any flag combination, see codex-mcp-session.mjs). The one
- * thing the grant can't conjure is the subcommand itself: a codex old enough
- * not to have it never answers the MCP handshake, and before this the run just
- * failed. Now it degrades to the plain exec argv — the ungated run every codex
- * did before 0777, never worse.
- *
- * Two rules make that degrade safe. It happens ONLY on positive evidence that
- * the subcommand is absent (codexMcpTransportUnavailable — every other
- * pre-handshake failure is returned as the failed run it is, because a wrongly
- * failed run is recoverable and a wrongly ungated one is not). And the room is
- * told BEFORE the ungated child is spawned, so the warning arrives while the
- * run can still be stopped.
- *
- * The exec argv is the run's real one (model, images, resume, stream flags),
- * so the fallback is the same run the ungated lane would have made.
- */
-async function runCodexGatedSession({
-  deps,
-  cfg,
-  onGateDropped,
-  cmd,
-  codeArgs,
-  prompt,
-  cwd,
-  model,
-  resumeThreadId = null,
-  signal,
-  onData,
-  onEvent,
-  beforeSpawn,
-  permissionCallbacks,
-  childMcp = null,
-}) {
-  // 1255 — `codex mcp-server` takes the same global `-c` overrides `codex exec`
-  // does (verified on codex-cli 0.153.4: `codex mcp-server --help` lists
-  // `-c, --config <key=value>`), so the seat reaches both codex transports
-  // through one argv fragment.
-  const childMcpConfig = childMcp ? codexChildMcpArgs(childMcp.url) : [];
-  if (typeof beforeSpawn === "function" && (await beforeSpawn()) === false) {
-    return {
-      status: null,
-      stdout: "",
-      stderr: "",
-      aborted: true,
-      authorityLost: true,
-      error: new Error("execution authority lost before spawn"),
-    };
-  }
-  const run = await deps.runCodexMcpSession({
-    cmd,
-    ...(childMcpConfig.length ? { serverArgs: ["mcp-server", ...childMcpConfig] } : {}),
-    cwd,
-    prompt,
-    sandbox: codexSandboxFromArgs(codeArgs),
-    // 0785 — the resolved tier (0783) or a hand-pinned id. The gated transport
-    // took the account default before this, so a preset was silently ignored
-    // exactly where the operator was most likely to have set one.
-    model: model || null,
-    webSearch: cfg.webSearch !== false,
-    resumeThreadId,
-    timeoutMs: cfg.runTimeoutMs,
-    signal,
-    env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
-    onData,
-    onEvent,
-    beforeSpawn,
-    ...permissionCallbacks,
-  });
-  if (!codexMcpTransportUnavailable(run)) return run;
-  console.log(
-    "  code → this codex has no `mcp-server`; running WITHOUT the hilos permission gate",
-  );
-  // Warn FIRST — before a single ungated command can run.
-  if (typeof onGateDropped === "function") {
-    try {
-      await onGateDropped();
-    } catch {
-      /* telling the room must never break the run */
-    }
-  }
-  const fallback = await deps.runCli({
-    cmd,
-    args: [...codeArgs, ...childMcpConfig, prompt],
-    cwd,
-    timeoutMs: cfg.runTimeoutMs,
-    label: "coding",
-    signal,
-    env: codingChildEnv(cfg),
-    onData,
-    beforeSpawn,
-  });
-  return { ...fallback, permissionGateDropped: true };
-}
-
 async function awaitDecision({ tool, reportMessageId, cfg, deps, signal }) {
   if (!reportMessageId) return { kind: "timeout" };
   const deadline = deps.now() + cfg.decisionTimeoutMs;
@@ -1740,9 +1356,9 @@ function askedYouTo(message) {
  * The server delivers it as a `kind: "answer"` mention row carrying
  * `askMessageId` — a reply in the thread where this agent asked. Without a lead
  * line the run reads it as a fresh instruction from a stranger; with one it
- * reads as the reply it has been waiting for. Defensive by construction: an
- * older server sends no `kind` at all, this returns "", and the prompt is
- * exactly what it was.
+ * reads as the reply it has been waiting for. Only answer delivery gets this
+ * lead line; every other mention kind leaves the prompt unchanged. Missing
+ * author names likewise produce no lead line.
  * @param {{ kind?: string, author?: string } | null} [message]
  */
 export function answeredYou(message) {
@@ -1976,11 +1592,11 @@ export async function proposePlanAck({
 
 /**
  * React to the wake's message instead of replying (0860). Best-effort and
- * capability-gated: on an older server (no add_reaction) or any failure the
- * agent simply stays quiet, which is what the model chose anyway.
+ * injectable for tests. A write failure leaves the agent quiet, which is
+ * what the model chose anyway.
  */
-async function reactQuietly({ tool, caps, message, emoji }) {
-  if (!emoji || !caps?.react || !message?.id) return;
+async function reactQuietly({ tool, testCapabilities, message, emoji }) {
+  if (!emoji || !testCapabilities?.react || !message?.id) return;
   await tool("add_reaction", { messageId: message.id, emoji }).catch(() => {});
 }
 
@@ -1996,7 +1612,7 @@ async function respondConversationally({
   workspaceMemory,
   signal,
   context,
-  caps = {},
+  testCapabilities = {},
   runCliFn = runCli,
   pathExistsFn = existsSync,
 }) {
@@ -2004,8 +1620,8 @@ async function respondConversationally({
   const { transcript } = context || (await fetchContext({ channelId, tool, parentId }));
   // 1249 — the room can ask agents to answer in a thread instead of in the
   // room. The server owns the setting and marks the mention; the daemon only
-  // has to post under the message it names. An older server sends neither
-  // field, so this stays exactly `parentId` and nothing changes. The context
+  // has to post under the message it names. Other mentions retain their
+  // existing parent, including a top-level reply with no parent. The context
   // above still reads the CHANNEL tail: the ask happened in the room, and the
   // thread we are about to open has nothing in it yet.
   const replyParentId =
@@ -2074,7 +1690,7 @@ async function respondConversationally({
   let beatBusy = false;
   const beatMs = Math.min(cfg.chatTimeoutMs || 90000, 30000);
   const beat =
-    caps.editMessage && beatMs > 0
+    testCapabilities.editMessage && beatMs > 0
       ? setInterval(async () => {
           if (beatStopped || beatBusy || thinkingId) return;
           beatBusy = true;
@@ -2131,7 +1747,7 @@ async function respondConversationally({
       if (thinkingId) {
         await deliver(quiet.emoji || "👍");
       } else {
-        await reactQuietly({ tool, caps, message, emoji: quiet.emoji });
+        await reactQuietly({ tool, testCapabilities, message, emoji: quiet.emoji });
       }
       return;
     }
@@ -2582,7 +2198,7 @@ async function handleFolderDeploy({
  * live), request-changes = re-run in place (bounded), reject = revert the run's
  * own changes (git repos only).
  */
-async function handleFolderTask({ message, channelId, tool, caps, cfg, deps, signal, parentId, folderPath, brief, workspaceMemory, context, onStopRequested }) {
+async function handleFolderTask({ message, channelId, tool, testCapabilities, cfg, deps, signal, parentId, folderPath, brief, workspaceMemory, context, onStopRequested }) {
   const git = deps.git;
   // 0779 — screenshots the poll loop already pulled to a temp dir at pickup.
   // The prompt names them; the argv carries them for a vendor that takes one.
@@ -2591,7 +2207,7 @@ async function handleFolderTask({ message, channelId, tool, caps, cfg, deps, sig
     ? {
         images: localImages,
         imagesReadable: imagesNeedReading(detectVendor(cfg.codingCmd), {
-          gated: codexRunIsGated(cfg, caps),
+          gated: codexRunIsGated(cfg, testCapabilities),
         }),
       }
     : {};
@@ -2693,7 +2309,7 @@ async function handleFolderTask({ message, channelId, tool, caps, cfg, deps, sig
   const runFolderCli = async (promptText) => {
     const parts = commandArgv(cfg.codingCmd);
     const vendor = detectVendor(cfg.codingCmd);
-    const streamOn = Boolean(caps.postProgress);
+    const streamOn = Boolean(testCapabilities.postProgress);
     const streamArgs = streamOn ? codeStreamArgs(vendor) : [];
     let emitter = null;
     // Every dispatched progress write, so the settle can wait them out (0289).
@@ -2746,7 +2362,7 @@ async function handleFolderTask({ message, channelId, tool, caps, cfg, deps, sig
           intervalMs: cfg.stopPollMs || STOP_POLL_MS,
         });
       }
-    } else if (caps.editMessage && cfg.heartbeatMs > 0) {
+    } else if (testCapabilities.editMessage && cfg.heartbeatMs > 0) {
       const start = deps.now();
       let stopped = false;
       let busy = false;
@@ -2775,7 +2391,6 @@ async function handleFolderTask({ message, channelId, tool, caps, cfg, deps, sig
     }
     let run;
     // 1255 — the run's own hilos seat, closed in the same finally as the run.
-    let childMcp = null;
     // Model preset (0504): same run-time resolution as the repo path.
     const modelArgs = await modelArgsFor(cfg, vendor);
     // 0787: the id we actually handed the CLI, kept for the usage receipt when
@@ -2834,195 +2449,51 @@ async function handleFolderTask({ message, channelId, tool, caps, cfg, deps, sig
         /* accounting must never break the run */
       }
     };
-    try {
-      const useAcpTransport = shouldUseAcpTransport({
-        vendor,
-        acpTransport: cfg.acpTransport,
-        runtimePermissions: caps.runtimePermissions,
-        codeArgs,
-        codingCmd: cfg.codingCmd,
-      });
-      const useRuntimePermissionBridge =
-        !useAcpTransport &&
-        shouldUseRuntimePermissionBridge({
-          vendor,
-          runtimePermissions: caps.runtimePermissions,
-          codeArgs,
-          codingCmd: cfg.codingCmd,
-        });
-      // 0777: the two vendors that had no gate at all. Neither is an ACP
-      // adapter — each CLI turned out to have its own native seam (see the
-      // module headers), so both compose with everything already here.
-      const gateCodexPermissions =
-        !useAcpTransport &&
-        !useRuntimePermissionBridge &&
-        shouldGateCodexPermissions({
-          vendor,
-          runtimePermissions: caps.runtimePermissions,
-          codeArgs,
-        });
-      const gateClaudePermissions =
-        !useAcpTransport &&
-        !useRuntimePermissionBridge &&
-        !gateCodexPermissions &&
-        shouldGateClaudePermissions({
-          vendor,
-          runtimePermissions: caps.runtimePermissions,
-          codeArgs,
-        });
-      // 1255 — the agent's seat inside its own run. Turn-scoped: it opens here
-      // and closes in the same finally the run does, so no loopback outlives
-      // the work it was opened for. Claude and codex only; every other vendor
-      // takes the identical argv it took before.
-      childMcp = await deps.startChildHilosMcp({
-        cfg,
-        vendor,
-        bindingClaim: message?.bindingClaim,
-        // The gate writes the one config when it is on; otherwise this writes it.
-        standaloneConfig: vendor === "claude_code" && !gateClaudePermissions,
-      });
-      if (useAcpTransport) {
-        run = await deps.runAcpSession({
-          cmd: parts[0],
-          vendor,
-          cwd: folderPath,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          timeoutMs: cfg.runTimeoutMs,
-          signal,
-          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
-          onData: handleCliData,
-          onEvent: handleCliEvent,
-          ...openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-            provider: vendor,
-          }),
-        });
-      } else if (useRuntimePermissionBridge) {
-        run = await deps.runOpenCodeHttpSession({
-          cmd: parts[0],
-          args: codeArgs,
-          cwd: folderPath,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          timeoutMs: cfg.runTimeoutMs,
-          signal,
-          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
-          onData: handleCliData,
-          ...openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-          }),
-        });
-      } else if (gateCodexPermissions) {
-        run = await runCodexGatedSession({
-          deps,
-          cfg,
-          onGateDropped: () => noticeUngatedRun(parts[0]),
-          cmd: parts[0],
-          codeArgs,
-          cwd: folderPath,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          model: resolvedModelId,
-          signal,
-          onData: handleCliData,
-          onEvent: handleCliEvent,
-          childMcp,
-          permissionCallbacks: openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-            provider: vendor,
-            repoRoot: folderPath,
-            gateRepoEdits: cfg.gateRepoEdits === true,
-          }),
-        });
-      } else if (gateClaudePermissions) {
-        run = await runClaudeGatedCli({
-          deps,
-          cfg,
-          onGateDropped: () => noticeUngatedRun(parts[0]),
-          cmd: parts[0],
-          codeArgs,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          cwd: folderPath,
-          signal,
-          onData: handleCliData,
-          resolveSessionId: () => emitter?.snapshot()?.sessionId ?? null,
-          childMcp,
-          permissionCallbacks: openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-            provider: vendor,
-            repoRoot: folderPath,
-            gateRepoEdits: cfg.gateRepoEdits === true,
-          }),
-        });
-      } else {
-        run = await deps.runCli({
-          cmd: parts[0],
-          args: [
-            ...codeArgs,
-            ...childMcpArgs(vendor, childMcp),
-            agentPreamble(workspaceMemory, cfg) + promptText,
-          ],
-          cwd: folderPath,
-          timeoutMs: cfg.runTimeoutMs,
-          label: "coding",
-          signal,
-          env: codingChildWebEnv(cfg, vendor),
-          onData: handleCliData,
-        });
-      }
-      // 0785 backstop. The notice normally goes out from `onGateDropped`,
-      // BEFORE the ungated child is spawned — the room has to be warned while
-      // the run can still be stopped, not told afterwards what it already did.
-      // This catches a degrade that reached us without firing that hook; the
-      // latch makes it a no-op in the ordinary case.
-      if (run?.permissionGateDropped) await noticeUngatedRun(parts[0]);
-    } finally {
-      // 1255 — the seat dies with the turn. A loopback that outlived its run
-      // would be an open credential proxy nobody is using.
-      try {
-        await childMcp?.close();
-      } catch {
-        /* tearing the seat down must never fail a finished run */
-      }
-      childMcp = null;
-      stopHeartbeat();
-      stopPoller?.stop();
-      if (emitter) {
-        const errored = Boolean(run && (run.aborted || run.error || run.status !== 0));
-        // Remembered for the accounting-only settlement (0787): an exit with no
-        // report re-sends this same terminal state, so the card is never
-        // repainted into something it wasn't.
-        lastTerminalState = errored ? "error" : "done";
-        let reason = "";
-        if (errored && run && !run.aborted) {
-          const stderrTail = oneLine((run.stderr || "").trim().split("\n").slice(-3).join(" "), 200);
-          if (run.error?.code === "ENOENT") reason = `Couldn't start ${parts[0]} — is it installed and on PATH?`;
-          else if (run.error?.message) reason = run.error.message;
-          else if (run.status != null) reason = `The CLI exited ${run.status}`;
-          if (stderrTail) reason = reason ? `${reason}: ${stderrTail}` : stderrTail;
-        }
-        try {
-          emitter.done(errored ? "error" : "done", reason);
-        } catch {
-          /* ignore */
-        }
-        try {
-          await drainProgress();
-        } catch {
-          /* a drain failure must never break the run */
+    run = await runCodingTransport({
+      deps, cfg, cmd: parts[0], vendor, codeArgs, cwd: folderPath,
+      prompt: agentPreamble(workspaceMemory, cfg) + promptText,
+      model: resolvedModelId,
+      runtimePermissions: testCapabilities.runtimePermissions,
+      permissionCallbacks: { tool, channelId, threadRoot, decisionWaitMs: testCapabilities.decisionWaitMs },
+      childMcp: ({ standaloneConfig }) => deps.startChildHilosMcp({
+        cfg, vendor, bindingClaim: message?.bindingClaim, standaloneConfig,
+      }),
+      onData: handleCliData,
+      onEvent: handleCliEvent,
+      signal,
+      onGateDropped: () => noticeUngatedRun(parts[0]),
+      resolveSessionId: () => emitter?.snapshot()?.sessionId ?? null,
+      onSettle: async (settledRun) => {
+        run = settledRun;
+        stopHeartbeat();
+        stopPoller?.stop();
+        if (emitter) {
+          const errored = Boolean(run && (run.aborted || run.error || run.status !== 0));
+          // Remembered for the accounting-only settlement (0787): an exit with no
+          // report re-sends this same terminal state, so the card is never
+          // repainted into something it wasn't.
+          lastTerminalState = errored ? "error" : "done";
+          let reason = "";
+          if (errored && run && !run.aborted) {
+            const stderrTail = oneLine((run.stderr || "").trim().split("\n").slice(-3).join(" "), 200);
+            if (run.error?.code === "ENOENT") reason = `Couldn't start ${parts[0]} — is it installed and on PATH?`;
+            else if (run.error?.message) reason = run.error.message;
+            else if (run.status != null) reason = `The CLI exited ${run.status}`;
+            if (stderrTail) reason = reason ? `${reason}: ${stderrTail}` : stderrTail;
+          }
+          try {
+            emitter.done(errored ? "error" : "done", reason);
+          } catch {
+            /* ignore */
+          }
+          try {
+            await drainProgress();
+          } catch {
+            /* a drain failure must never break the run */
+          }
         }
-      }
-    }
+      },
+    });
     if (resultParser) {
       try {
         foldResultEvents(resultParser.flush());
@@ -3253,7 +2724,9 @@ async function handleFolderTask({ message, channelId, tool, caps, cfg, deps, sig
 
 /** Handle one task. cfg/deps injectable for tests. `opts.signal` (AbortSignal)
  *  cancels an in-flight run — the queue fires it when a human says "stop". */
-export async function handleTask({ message, channelId, tool, me, caps = {}, iterateClaimRecoveryStore = null }, cfg, depsOverride, opts = {}) {
+// 1290: run() supplies the current hilos.sh contract. testCapabilities is the
+// missing-tool fixture seam for direct handler tests, not server negotiation.
+export async function handleTask({ message, channelId, tool, me, testCapabilities = {}, canRecall = true, iterateClaimRecoveryStore = null }, cfg, depsOverride, opts = {}) {
   if (message.dispatch?.briefMarkdown) {
     message = { ...message, body: `${message.body}\n\n${message.dispatch.briefMarkdown}` };
   }
@@ -3311,9 +2784,8 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
 
   // REVIEW EXECUTION (0288): a review-request routes to the read-only reviewer
   // BEFORE the chat/code flow — it reads the PR's diff and posts an advisory review
-  // that @-tags the author. Gated on caps.review (post_review + get_pr_diff on this
-  // server); without it (older deploy) this is skipped and behavior is unchanged.
-  if (caps.review && isReviewRequest(message)) {
+  // that @-tags the author. Missing-tool fixtures can disable this branch.
+  if (testCapabilities.review && isReviewRequest(message)) {
     return await reviewTask({ message, channelId, tool, me, cfg, workspaceMemory, context, signal });
   }
 
@@ -3323,7 +2795,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   // agent sees — then fall through to the normal follow-up machinery, which (0281)
   // checks out the thread's PR branch and pushes onto the SAME human-gated PR. Best-
   // effort; a failure just leaves the summary line to drive the iterate.
-  if (caps.review && message?.kind === "review") {
+  if (testCapabilities.review && message?.kind === "review") {
     const target =
       message?.reviewOf && (message.reviewOf.prUrl || message.reviewOf.messageId)
         ? message.reviewOf
@@ -3354,7 +2826,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
       mode,
       // A manager-routed dispatch is a brief to implement, not an instruction to
       // land something — its body is assembled text, never a person's sentence.
-      canRelay: Boolean(caps.prActions) && !message.dispatch && !forcedConflictRecovery,
+      canRelay: Boolean(testCapabilities.prActions) && !message.dispatch && !forcedConflictRecovery,
     });
     if (relay.relay) {
       const verb = relay.action;
@@ -3443,7 +2915,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
         routed = { code: false, reply: null };
       } else if (mode === "ship") {
         routed = { code: true, task: message.body };
-      } else if (caps.agentIntent) {
+      } else if (testCapabilities.agentIntent) {
         const classifierDeployTarget = deps.resolveDeployTarget({
           cfg,
           channelId,
@@ -3516,7 +2988,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
         return { status: "chat" };
       }
       if (routed.noReply) {
-        await reactQuietly({ tool, caps, message, emoji: routed.emoji });
+        await reactQuietly({ tool, testCapabilities, message, emoji: routed.emoji });
         return { status: "quiet" };
       }
       if (routed.code) {
@@ -3524,7 +2996,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
           message,
           channelId,
           tool,
-          caps,
+          testCapabilities,
           cfg,
           deps,
           signal,
@@ -3550,7 +3022,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
       workspaceMemory,
       signal,
       context,
-      caps,
+      testCapabilities,
       runCliFn: deps.runCli,
       pathExistsFn: deps.pathExists,
     });
@@ -3575,7 +3047,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
       workspaceMemory,
       signal,
       context,
-      caps,
+      testCapabilities,
       runCliFn: deps.runCli,
       pathExistsFn: deps.pathExists,
     });
@@ -3585,10 +3057,10 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   // Same-PR follow-up (0281): if this mention is a reply in a thread that already
   // owns a run (branch + PR), we may continue THAT run instead of forking a
   // duplicate. Look it up by the thread root — the parentId the reply carried.
-  // Best-effort + gated on the server supporting the runs entity (caps.runs); any
+  // Best-effort + injectable for tests (testCapabilities.runs); any
   // failure falls back to a fresh run (mode 'new'), never breaking the task.
   let activeRun = null;
-  if (caps.runs && parentId) {
+  if (testCapabilities.runs && parentId) {
     const r = await tool("get_active_run", { channelId, threadRootId: parentId }).catch(() => null);
     if (r && r.found) activeRun = r;
   }
@@ -3635,7 +3107,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   }
   if (!routed.code) {
     if (routed.noReply) {
-      await reactQuietly({ tool, caps, message, emoji: routed.emoji });
+      await reactQuietly({ tool, testCapabilities, message, emoji: routed.emoji });
       return { status: "quiet" };
     }
     await respondConversationally({
@@ -3649,7 +3121,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
       workspaceMemory,
       signal,
       context,
-      caps,
+      testCapabilities,
       runCliFn: deps.runCli,
       pathExistsFn: deps.pathExists,
     });
@@ -3919,8 +3391,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   }
 
   // Instant acknowledgement: post a template in <1s so the channel shows life
-  // before any model call. If the server supports edit_message and a fast chatCmd
-  // is set, a bounded plan-ack edits in a sentence of specifics ("I'll do X…").
+  // before any model call. If a fast chatCmd is set, a bounded plan-ack edits in a sentence of specifics ("I'll do X…").
   // Best-effort — a slow or failed ack just leaves the template, never blocks.
   //
   // INSPECTABLE ACK (0281): when we're continuing or forking off an existing run,
@@ -3962,8 +3433,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   //   redirect → supersede the old run (so a future follow-up no longer points at
   //              it), then record a FRESH run for the new, separate PR.
   //   new      → record a fresh run, exactly as before.
-  // Best-effort throughout — a bookkeeping failure (or an older server without the
-  // runs tools) must NEVER break the run, so it proceeds without a runId.
+  // A bookkeeping failure must never break the run, so it proceeds without a runId.
   let runId = message.dispatch?.runId ?? (effectiveMode === "iterate" ? activeRun?.runId ?? null : null);
   // Immutable generation for every report attempt in this daemon turn. A reused
   // run claims the next value atomically below; fresh and dispatch-adopted rows
@@ -3975,11 +3445,11 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
       : 0;
   let iterateClaimId = null;
   let iterateAuthorityLost = false;
-  if (message.dispatch?.runId && caps.runs) {
+  if (message.dispatch?.runId && testCapabilities.runs) {
     // Adopt the dispatch's canonical run. If the server already SETTLED it (the
     // reaper/outbox closed a dispatch we were slow to pick up), leave it alone
     // and skip the coding run — resurrecting it would ship work no one is
-    // waiting on. Any OTHER failure (network, an older server without the guard)
+    // waiting on. Any OTHER failure (network or the guard)
     // keeps today's best-effort behavior: proceed with the run.
     try {
       const adopted = await tool("update_run", { runId: message.dispatch.runId, status: "running" });
@@ -4002,7 +3472,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
       };
     }
   }
-  if (caps.runs && effectiveMode === "iterate" && runId && !message.dispatch?.runId) {
+  if (testCapabilities.runs && effectiveMode === "iterate" && runId && !message.dispatch?.runId) {
     try {
       const claimed = await claimDaemonIterate({
         tool,
@@ -4029,7 +3499,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
       return { status: "iterate-claim-lost", runId };
     }
   }
-  if (caps.runs && threadRoot && effectiveMode !== "iterate" && !message.dispatch?.runId) {
+  if (testCapabilities.runs && threadRoot && effectiveMode !== "iterate" && !message.dispatch?.runId) {
     try {
       if (effectiveMode === "redirect" && activeRun?.runId) {
         await tool("update_run", { runId: activeRun.runId, status: "superseded" }).catch(() => {});
@@ -4055,7 +3525,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
         // `pendingInputs` off its heartbeat and runs one more CLI turn with
         // them after the coding turn. Declared only when the server can take
         // the receipt, so the room never offers a composer nothing will read.
-        ...(caps.runInputs ? { inputTransport: "next_turn" } : {}),
+        ...(testCapabilities.runInputs ? { inputTransport: "next_turn" } : {}),
       });
       runId = r?.runId ?? null;
       if (Number.isSafeInteger(r?.iterateTurn)) iterateTurn = Number(r.iterateTurn);
@@ -4067,7 +3537,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   // the server knows (start_run answered) and only when it can take the
   // receipt; otherwise there is no door and nothing is ever listed.
   const directions =
-    caps.runInputs && runId
+    testCapabilities.runInputs && runId
       ? createDirectionInbox({ tool, runId, log: (line) => console.log(line) })
       : null;
   // All subprocesses launched after an Iterate claim — including the fast plan
@@ -4086,7 +3556,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
     return ownsClaim && !signal?.aborted;
   };
   const settleConflictFailure = async (reason) => {
-    if (!activeConflictMerge || !runId || !caps.runs) return;
+    if (!activeConflictMerge || !runId || !testCapabilities.runs) return;
     await tool("update_run", {
       runId,
       status: effectiveMode === "iterate" ? "awaiting_review" : "failed",
@@ -4097,7 +3567,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   // an LLM plan) so a human can correct the routing before code lands.
   if (
     ackId &&
-    caps.editMessage &&
+    testCapabilities.editMessage &&
     chatCmdFor(cfg) &&
     !continuingPrUrl &&
     !anchorNote &&
@@ -4121,11 +3591,9 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   // then EDIT it on later beats — alive without thread spam. Needs edit_message;
   // without it we skip rather than post a fresh message every beat. lastLine
   // carries the CLI's latest output into the beat.
-  // Live progress (0274): when the server supports post_progress, the code run
-  // STREAMS a coalesced "what I'm doing right now" card onto one thread status
-  // message (via the 0272 stream parser) instead of the 3-min edit heartbeat. On
-  // older servers (no post_progress) we fall back to the exact legacy behavior.
-  const streamOn = Boolean(caps.postProgress);
+  // Live progress (0274) coalesces activity onto one thread status message
+  // through the 0272 parser. Tests can inject the heartbeat-only fixture.
+  const streamOn = Boolean(testCapabilities.postProgress);
   const vendor = detectVendor(cfg.codingCmd);
   // 1255 — same pre-run answer as the folder lane, for the same reason.
   const hilosTools = childMcpPlanned({
@@ -4141,14 +3609,14 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   // revision rounds all land in one transcript — the run is the unit, not the
   // spawn.
   const transcriptTap =
-    cfg.uploadTranscripts && caps.uploadTranscript && runId ? createTranscriptTap() : null;
+    cfg.uploadTranscripts && testCapabilities.uploadTranscript && runId ? createTranscriptTap() : null;
   // 0779 — screenshots the poll loop pulled to a temp dir at pickup. The prompt
   // names them; the argv carries them for a vendor with a verified image flag.
   const localImages = Array.isArray(message?.images) ? message.images : [];
   const codeImagePromptArgs = localImages.length
     ? {
         images: localImages,
-        imagesReadable: imagesNeedReading(vendor, { gated: codexRunIsGated(cfg, caps) }),
+        imagesReadable: imagesNeedReading(vendor, { gated: codexRunIsGated(cfg, testCapabilities) }),
       }
     : {};
   // 0785 — one line per run, whichever CLI turns out to be ungateable.
@@ -4206,7 +3674,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
     }
   }
 
-  const heartbeatOn = Boolean(caps.editMessage) && cfg.heartbeatMs > 0 && !streamOn;
+  const heartbeatOn = Boolean(testCapabilities.editMessage) && cfg.heartbeatMs > 0 && !streamOn;
   let lastLine = "";
   let progressId = null; // the thread progress/status reply, once one has posted
   const startHeartbeat = () => {
@@ -4282,7 +3750,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
   // sit there claiming the agent is alive. No-op when no beat ever fired (short
   // run) or without edit_message. Best-effort.
   const finalizeProgress = async (text) => {
-    if (progressId && caps.editMessage) {
+    if (progressId && testCapabilities.editMessage) {
       await tool("edit_message", { messageId: progressId, body: text }).catch(() => {});
     }
   };
@@ -4437,7 +3905,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
     // automatic but deliberately best-effort: it is bounded, secret-redacted
     // again on the server, and can never interrupt the coding process.
     const harnessEmitter =
-      caps.hepEvents &&
+      testCapabilities.hepEvents &&
       runId &&
       me?.agentId &&
       ["claude_code", "codex", "cursor", "opencode"].includes(vendor)
@@ -4497,255 +3965,89 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
     };
     let run;
     // 1255 — the run's own hilos seat, closed in the same finally as the run.
-    let childMcp = null;
-    try {
-      // OpenCode's own non-interactive CLI auto-rejects every permission ask
-      // unless --auto is present. For the gated tiers, bypass that responder
-      // and own the authenticated HTTP session + SSE stream directly so hilos
-      // is the sole authority answering the paused tool call (0593).
-      const useAcpTransport = shouldUseAcpTransport({
-        vendor,
-        acpTransport: cfg.acpTransport,
-        runtimePermissions: caps.runtimePermissions,
-        codeArgs,
-        codingCmd: cfg.codingCmd,
-      });
-      const useRuntimePermissionBridge =
-        !useAcpTransport &&
-        shouldUseRuntimePermissionBridge({
-          vendor,
-          runtimePermissions: caps.runtimePermissions,
-          codeArgs,
-          codingCmd: cfg.codingCmd,
-        });
-      // 0777, and the reason it composes with resume (0778): claude keeps its
-      // ordinary argv run (resumeArgs included), and codex's gated transport
-      // has its OWN resume — `codex-reply {threadId}` — so a gated iterate
-      // continues the same thread instead of trading continuity for a gate.
-      const gateCodexPermissions =
-        !useAcpTransport &&
-        !useRuntimePermissionBridge &&
-        shouldGateCodexPermissions({
-          vendor,
-          runtimePermissions: caps.runtimePermissions,
-          codeArgs,
-        });
-      const gateClaudePermissions =
-        !useAcpTransport &&
-        !useRuntimePermissionBridge &&
-        !gateCodexPermissions &&
-        shouldGateClaudePermissions({
-          vendor,
-          runtimePermissions: caps.runtimePermissions,
-          codeArgs,
-        });
-      // 1255 — the agent's seat inside its own run, on the same two vendors and
-      // with the same turn-scoped lifetime as the folder lane. Every other
-      // vendor's argv is byte-identical to what it was.
-      childMcp = await deps.startChildHilosMcp({
-        cfg,
-        vendor,
-        bindingClaim: message?.bindingClaim,
-        standaloneConfig: vendor === "claude_code" && !gateClaudePermissions,
-      });
-      if (useAcpTransport) {
-        run = await deps.runAcpSession({
-          cmd: parts[0],
-          vendor,
-          cwd: repoPath,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          // 0778: approvals AND continuity. `resume:false` (the never-worse
-          // retry) drops it exactly like buildResumeArgs does.
-          resumeSessionId: resume ? resumeSessionId : null,
-          timeoutMs: cfg.runTimeoutMs,
-          signal,
-          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
-          onData: handleCliData,
-          onEvent: handleCliEvent,
-          beforeSpawn: beforeCodingSpawn,
-          ...openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-            runId,
-            provider: vendor,
-          }),
-        });
-      } else if (useRuntimePermissionBridge) {
-        run = await deps.runOpenCodeHttpSession({
-          cmd: parts[0],
-          args: codeArgs,
-          cwd: repoPath,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          timeoutMs: cfg.runTimeoutMs,
-          signal,
-          // A model running inside the server must never inherit the daemon's
-          // hilos bearer token. The bridge's random loopback password is added
-          // after this scrub and dies with the process group.
-          env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
-          onData: handleCliData,
-          beforeSpawn: beforeCodingSpawn,
-          ...openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-            runId,
-          }),
-        });
-      } else if (gateCodexPermissions) {
-        run = await runCodexGatedSession({
-          deps,
-          cfg,
-          onGateDropped: () => noticeUngatedRun(parts[0]),
-          cmd: parts[0],
-          codeArgs,
-          cwd: repoPath,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          model: resolvedModelId,
-          // Codex's own resume over this transport. `resume:false` (the
-          // never-worse retry) drops it exactly like buildResumeArgs does.
-          resumeThreadId: resume ? resumeSessionId : null,
-          signal,
-          onData: handleCliData,
-          onEvent: handleCliEvent,
-          beforeSpawn: beforeCodingSpawn,
-          childMcp,
-          permissionCallbacks: openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-            runId,
-            provider: vendor,
-            repoRoot: repoPath,
-            gateRepoEdits: cfg.gateRepoEdits === true,
-          }),
-        });
-      } else if (gateClaudePermissions) {
-        run = await runClaudeGatedCli({
-          deps,
-          cfg,
-          onGateDropped: () => noticeUngatedRun(parts[0]),
-          cmd: parts[0],
-          // codeArgs already carries this run's resume flags, so a gated
-          // iterate resumes AND raises cards — the two never traded off.
-          codeArgs,
-          prompt: agentPreamble(workspaceMemory, cfg) + promptText,
-          cwd: repoPath,
-          signal,
-          onData: handleCliData,
-          beforeSpawn: beforeCodingSpawn,
-          sessionId: resume ? resumeSessionId ?? "" : "",
-          resolveSessionId: () => emitter?.snapshot()?.sessionId ?? null,
-          childMcp,
-          permissionCallbacks: openCodePermissionCallbacks({
-            tool,
-            channelId,
-            threadRoot,
-            decisionWaitMs: caps.decisionWaitMs,
-            runId,
-            provider: vendor,
-            repoRoot: repoPath,
-            gateRepoEdits: cfg.gateRepoEdits === true,
-          }),
-        });
-      } else {
-        // deps.runCli, not the bare import: `defaultDeps` wraps the very same
-        // function, so production is byte-identical, but the ungated repo run
-        // was the ONE coding path that escaped the injectable runner — which is
-        // why nothing above the unit tests could ever drive it (0787).
-        run = await deps.runCli({
-          cmd: parts[0],
-          args: [
-            ...codeArgs,
-            ...childMcpArgs(vendor, childMcp),
-            agentPreamble(workspaceMemory, cfg) + promptText,
-          ],
-          cwd: repoPath,
-          timeoutMs: cfg.runTimeoutMs,
-          label: "coding",
-          signal,
-          env: codingChildWebEnv(cfg, vendor),
-          onData: handleCliData,
-          beforeSpawn: beforeCodingSpawn,
-        });
-      }
-      // 0785 — the gate was expected here and the CLI couldn't hold it. Say so
-      // in the room, once per run, rather than only in the daemon's console.
-      if (run?.permissionGateDropped) await noticeUngatedRun(parts[0]);
-    } finally {
-      // 1255 — the seat dies with the turn (see the folder lane).
-      try {
-        await childMcp?.close();
-      } catch {
-        /* tearing the seat down must never fail a finished run */
-      }
-      childMcp = null;
-      stopHeartbeat();
-      stopPoller?.stop();
-      if (run?.sessionId) runSessionId = run.sessionId;
-      try {
-        await harnessEmitter?.drain();
-      } catch {
-        /* runtime exhaust must never break the run */
-      }
-      if (emitter) {
-        // Terminal state: flip the status card off "working" (state 'done'/'error')
-        // so it stops claiming the agent is alive. For a run that produced work,
-        // the gate:false path then SETTLES the report onto this same card in place
-        // (0289) — the card cross-fades run → report; for no-changes/failed/gate
-        // outcomes this terminal 'done'/'error' is the card's final state.
-        const errored = Boolean(run && (run.aborted || run.error || run.status !== 0));
-        // Remembered so an exit with no report re-sends this same state (0787)
-        // rather than repainting the card into something it wasn't.
-        lastTerminalState = errored ? "error" : "done";
-        // On error, carry an honest reason onto the card (0294) — the same signal
-        // the chat note uses: spawn error message, else exit status, plus a short
-        // stderr tail. Sanitized again server-side; an old server just drops it.
-        let reason = "";
-        if (errored && run && !run.aborted) {
-          const stderrTail = oneLine((run.stderr || "").trim().split("\n").slice(-3).join(" "), 200);
-          if (run.error?.code === "ENOENT") {
-            reason = `Couldn't start ${parts[0]} — is it installed and on PATH?`;
-          } else if (run.error?.message) {
-            reason = run.error.message;
-          } else if (run.status != null) {
-            reason = `The CLI exited ${run.status}`;
-          }
-          if (stderrTail) reason = reason ? `${reason}: ${stderrTail}` : stderrTail;
-        }
-        try {
-          emitter.done(errored ? "error" : "done", reason);
-        } catch {
-          /* ignore */
-        }
-        // Wait for every progress write (including the terminal one above) to land
-        // BEFORE runAndStage returns, so nothing is in flight when the caller
-        // settles the report onto this card — no lost-update clobber (0289).
-        try {
-          await drainProgress();
-        } catch {
-          /* a drain failure must never break the run */
-        }
+    run = await runCodingTransport({
+      deps, cfg, cmd: parts[0], vendor, codeArgs, cwd: repoPath,
+      prompt: agentPreamble(workspaceMemory, cfg) + promptText,
+      model: resolvedModelId,
+      runtimePermissions: testCapabilities.runtimePermissions,
+      permissionCallbacks: { tool, channelId, threadRoot, decisionWaitMs: testCapabilities.decisionWaitMs },
+      childMcp: ({ standaloneConfig }) => deps.startChildHilosMcp({
+        cfg, vendor, bindingClaim: message?.bindingClaim, standaloneConfig,
+      }),
+      onData: handleCliData,
+      onEvent: handleCliEvent,
+      signal,
+      onGateDropped: () => noticeUngatedRun(parts[0]),
+      resolveSessionId: () => emitter?.snapshot()?.sessionId ?? null,
+      beforeSpawn: beforeCodingSpawn,
+      resume: { sessionId: resume ? resumeSessionId : null },
+      runId,
+      onSettle: async (settledRun) => {
+        run = settledRun;
+        stopHeartbeat();
+        stopPoller?.stop();
+        if (run?.sessionId) runSessionId = run.sessionId;
         try {
-          const snap = emitter.snapshot();
-          if (snap && snap.sessionId) runSessionId = snap.sessionId;
+          await harnessEmitter?.drain();
         } catch {
-          /* ignore */
+          /* runtime exhaust must never break the run */
         }
-        // 0787 — read the run's cost AFTER done() (the terminal usage frame
-        // usually arrives in the parser flush). Folded, not sent yet: the
-        // report call is what carries it home.
-        try {
-          const spend = emitter.usage?.();
-          if (spend) runUsage.push({ t: "usage", ...spend });
-        } catch {
-          /* accounting must never break the run */
+        if (emitter) {
+          // Terminal state: flip the status card off "working" (state 'done'/'error')
+          // so it stops claiming the agent is alive. For a run that produced work,
+          // the gate:false path then SETTLES the report onto this same card in place
+          // (0289) — the card cross-fades run → report; for no-changes/failed/gate
+          // outcomes this terminal 'done'/'error' is the card's final state.
+          const errored = Boolean(run && (run.aborted || run.error || run.status !== 0));
+          // Remembered so an exit with no report re-sends this same state (0787)
+          // rather than repainting the card into something it wasn't.
+          lastTerminalState = errored ? "error" : "done";
+          // On error, carry an honest reason onto the card (0294) — the same signal
+          // the chat note uses: spawn error message, else exit status, plus a short
+          // stderr tail. Sanitized again server-side.
+          let reason = "";
+          if (errored && run && !run.aborted) {
+            const stderrTail = oneLine((run.stderr || "").trim().split("\n").slice(-3).join(" "), 200);
+            if (run.error?.code === "ENOENT") {
+              reason = `Couldn't start ${parts[0]} — is it installed and on PATH?`;
+            } else if (run.error?.message) {
+              reason = run.error.message;
+            } else if (run.status != null) {
+              reason = `The CLI exited ${run.status}`;
+            }
+            if (stderrTail) reason = reason ? `${reason}: ${stderrTail}` : stderrTail;
+          }
+          try {
+            emitter.done(errored ? "error" : "done", reason);
+          } catch {
+            /* ignore */
+          }
+          // Wait for every progress write (including the terminal one above) to land
+          // BEFORE runAndStage returns, so nothing is in flight when the caller
+          // settles the report onto this card — no lost-update clobber (0289).
+          try {
+            await drainProgress();
+          } catch {
+            /* a drain failure must never break the run */
+          }
+          try {
+            const snap = emitter.snapshot();
+            if (snap && snap.sessionId) runSessionId = snap.sessionId;
+          } catch {
+            /* ignore */
+          }
+          // 0787 — read the run's cost AFTER done() (the terminal usage frame
+          // usually arrives in the parser flush). Folded, not sent yet: the
+          // report call is what carries it home.
+          try {
+            const spend = emitter.usage?.();
+            if (spend) runUsage.push({ t: "usage", ...spend });
+          } catch {
+            /* accounting must never break the run */
+          }
         }
-      }
-    }
+      },
+    });
     if (!resultText && emitter) {
       try {
         resultText = emitter.snapshot()?.lastLine || "";
@@ -4988,7 +4290,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
     await updateChannelMarker(compactRunMarker("cancelled", branch));
     // 1270 — a process interruption has no server-side Stop action to settle
     // the row. Iterate claims keep their fenced recovery path in run().
-    if (runId && caps.runs && !iterateClaimId) {
+    if (runId && testCapabilities.runs && !iterateClaimId) {
       await tool("update_run", { runId, status: "failed", reason: "daemon-stopped" }).catch(() => {});
     }
     // Every repo-lane cancel funnels through here, so one settle covers them
@@ -5023,12 +4325,11 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
 
   // Team memory recall (0297): best-effort fetch accumulated learnings for this
   // channel before the coding run so the coding agent has the team's conventions
-  // and gotchas from the start. Capability-gated: older servers without the
-  // `recall` tool degrade silently (caps.recall=false → skip, no change in
-  // behavior). A recall failure — network hiccup, server error — NEVER fails the
-  // task; it is caught and the run proceeds without the block.
+  // and gotchas from the start. Channel-bound tokens cannot read workspace
+  // memory (0513); tests can also omit recall. A failed read leaves the task
+  // running without the memory block.
   let teamMemoryBlock = "";
-  if (caps.recall) {
+  if (canRecall && testCapabilities.recall) {
     try {
       // Pass the task's channelId so the server scopes recall to this project AND
       // can apply the guest gate (0298): the daemon's token is long-lived with no
@@ -5275,7 +4576,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
     if (directions) await directions.close();
     // A terminal progress card is presentation; it does not settle this row.
     // Keep an existing PR at its review gate when feedback produces no diff.
-    if (runId && caps.runs && !iterateClaimId) {
+    if (runId && testCapabilities.runs && !iterateClaimId) {
       await tool("update_run", {
         runId,
         status: continuingPrUrl ? "awaiting_review" : staged.failed ? "failed" : "succeeded",
@@ -5299,7 +4600,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {}, iter
     // settle the report onto it in place instead of posting a separate report
     // message. Only the DEFAULT gate:false report settles in place; gate:true's
     // proposal → decision → report lifecycle stays on separate messages (a
-    // separate ticket). No status card (older server / status post failed) →
+    // separate ticket). No status card (status post failed or missing-tool fixture) →
     // settleId is null and applyDecision posts a fresh final report instead.
     const settleId = streamOn && progressId ? progressId : null;
     // 1182 — the inbox closes BEFORE the report: the report ends the pass on