hilos-agent 0.11.3 → 0.11.5

package/README.md

@@ -392,12 +392,23 @@ npx hilos-agent@latest hooks print
   `hilos-agent` is running. Ambient messages, older thread history, and agent
   replies do not wake it. Current workspace roles are checked at pickup: guests,
   removed people, and unknown authors remain advisory and cannot start code.
+- Every initial mention job is also signed for its exact agent-token row and
+  answer room after final server revalidation. The daemon keeps that proof on a
+  job-local MCP client, so concurrent rooms cannot exchange project context. A
+  guest-visible room may be explicitly allowed to run code, but its task still
+  cannot pull workspace memory, Docs, Tasks, sibling conversations, or external
+  context into the answer.
 - The resumed turn receives bounded thread, room, and member context. Codex also
   gets a random loopback-only Hilos MCP URL for that turn, so it can search any
   room its linked owner can access when that owner minted the current key,
   without receiving the bearer token. Regenerate an older key from Connect to
   enable that inheritance. Admin-issued keys and other people's private rooms
-  stay outside the context.
+  stay outside the context. Hilos signs the turn's room into a short-lived
+  claim tied to that exact agent-token row; the loopback fixes the claim in an
+  upstream header that the coding child cannot replace. A missing, malformed,
+  cross-token, or conflicting room claim is refused, and a guest-visible turn
+  cannot use workspace-wide tools to pull private sibling context into its
+  answer.
 - The room's normal execution gate still applies; a chat-only guest room cannot
   resume local code.
 - Steps are coalesced into ~2s batches to keep traffic light.
@@ -490,6 +501,11 @@ Bump `version` in `package.json`, merge, wait for main CI, then tag that commit
 that exact version, a commit contained in `main`, and a successful `verify`
 check. It packs and clean-installs the artifact on Node.js 20, 22, and 24 before
 publishing, then installs the registry copy and checks its version and help.
-A manual workflow dispatch is always a dry run and cannot publish. The current
-release path needs the `NPM_TOKEN` repository secret until npm trusted
-publishing is configured (1094, 1211).
+A manual workflow dispatch is always a dry run and cannot publish. The workflow
+prefers npm trusted publishing's short-lived GitHub OIDC identity. The registry
+trust is configured for `pablostanley/hilos`, `npm-publish.yml`, no GitHub
+environment, and direct publishing. `NPM_TOKEN` remains as a fallback until one
+real tagged release proves OIDC end to end. After that proof, remove the
+workflow fallback, revoke the npm token, and delete the GitHub secret (1094,
+1211, 1228). Because the source repository is private, npm will not attach a
+public provenance attestation even when the publish itself uses OIDC.

package/bin/hilos-agent.mjs

@@ -31,6 +31,14 @@ import { runWebMcpCommand } from "../src/webmcp-bridge.mjs";
 import { detectVendor, fastChatCmd, webCapability } from "../src/progress-emitter.mjs";
 import { commandArgv } from "../src/argv.mjs";
 
+// 1251 — the plugin writes `hook --claude --personal`, so the client flags name
+// the vendor for `hook` the same way they choose a target for `hooks install`.
+const HOOK_CLIENT_VENDORS = {
+  claude: "claude_code",
+  codex: "codex",
+  cursor: "cursor",
+};
+
 function packageVersion() {
   const pkgPath = fileURLToPath(new URL("../package.json", import.meta.url));
   return JSON.parse(readFileSync(pkgPath, "utf8")).version;
@@ -121,6 +129,9 @@ function parseArgs(argv) {
     else if (a === "--cursor") flags.hookClient = "cursor";
     else if (a === "--vendor") flags.vendor = requiredOptionValue(argv, i++, a);
     else if (a === "--scope-managed") flags.scopeManaged = true;
+    // This session belongs to a person, not to an agent: it takes a seat in the
+    // room and never streams into an agent's live card.
+    else if (a === "--personal") flags.personal = true;
     // Marker embedded in self-contained hook commands. It is intentionally
     // internal: hook.mjs uses it to recognize and replace managed installs.
     else if (a === "--managed-runtime") flags.managedRuntime = true;
@@ -154,6 +165,10 @@ const HELP = `hilos-agent — your coding agent as a teammate in hilos
                                  use --codex, --claude, or --cursor to choose, and
                                  --global for every repo. HILOS_HOOKS=off pauses
                                  streaming; HILOS_REPLY_BRIDGE=off pauses pickup.
+                                 --personal takes YOUR seat in the room instead
+                                 of streaming into an agent's card; it needs
+                                 HILOS_MCP_TOKEN. The Claude Code plugin does the
+                                 same in one gesture.
   hilos-agent hooks print        preview the hook configuration without writing
 
 Options:
@@ -201,11 +216,19 @@ async function main() {
   // fast, silent, and always exit 0, so it short-circuits before any daemon
   // machinery.
   if (cmd === "hook") {
-    await hookMain({ vendor: flags.vendor || "unknown", scopeManaged: Boolean(flags.scopeManaged) });
+    await hookMain({
+      vendor: flags.vendor || HOOK_CLIENT_VENDORS[flags.hookClient] || "unknown",
+      scopeManaged: Boolean(flags.scopeManaged),
+      personal: Boolean(flags.personal),
+    });
     return;
   }
   if (cmd === "hooks") {
-    hooksMain(positional[1], { global: Boolean(flags.global), client: flags.hookClient || "all" });
+    hooksMain(positional[1], {
+      global: Boolean(flags.global),
+      client: flags.hookClient || "all",
+      personal: Boolean(flags.personal),
+    });
     return;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "description": "Run your own coding agent (Claude Code, Codex, Cursor, OpenCode, Hermes, or any command) as a teammate in a hilos room. The checkout and credentials stay local; changes go to your configured Git remote as a PR for human review, and bounded progress and reports go to hilos.",
   "type": "module",
   "bin": {
@@ -9,6 +9,7 @@
   "files": [
     "bin",
     "src",
+    "skills",
     "README.md"
   ],
   "engines": {

package/skills/hilos-handoff/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: hilos-handoff
+description: Hand work from this session to the room's agents — one ask, or a plan of rows a person approves. Use when asked to hand off, delegate, split up, or ask an agent for something.
+---
+
+# Handoff
+
+Give work to the room instead of doing all of it here. Everything below is
+posted as the person running this session; they are the author of record.
+
+1. Call `list_room_roster` for the room. Offer the agents it returns as the
+   options, with their state, so nobody hands work to an agent already busy.
+2. Say what the work is, in the person's words, and confirm the split with them
+   before calling anything.
+
+One piece of work, one agent: call `ask_agent` with the channel id, the agent
+(`agentId` or `handle`), the ask, `threadRootId` when the work belongs in the
+thread this session is bound to, and `kind` — `ask`, `review`, or `handoff`.
+
+More than one piece: call `propose_plan` with the channel id, the ask in one
+line, and up to eight rows. Give each row a `title`, a `brief` with the detail
+the specialist needs, and an `assignee` only when the room's roster makes the
+right agent obvious; leaving it off lets hilos route the row.
+
+A plan is a proposal, not a dispatch. Say so when you print the result: nothing
+runs until a person approves the rows on the plan card in hilos, and rows
+nobody approves never run at all. Print the link and stop there.

package/skills/hilos-room/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: hilos-room
+description: Show who is in the hilos room this session is attached to, and what is waiting on you. Use when asked "who is in the room", "what needs me", or "catch me up on hilos".
+---
+
+# Room
+
+Who is at the table right now, and what is waiting on the person running this
+session. Read-only: this skill never posts anything.
+
+1. Find the room. Use the channel this session has already posted into. If
+   there is none, call `list_channels` and ask which room to read.
+2. Call `list_room_roster` with that channel id.
+3. Call `list_mentions` for what is addressed to this person.
+
+Print two short blocks and nothing else.
+
+A table of the roster, one row per seat:
+
+| Who | What | State | On |
+| --- | --- | --- | --- |
+
+`What` is person, session, or agent. `State` is what the roster returned
+(working, waiting on a person, available, offline). `On` is the task title or
+branch when the roster gives one, otherwise a dash.
+
+Then `Needs you:` and one line per mention, newest first: who, the room, and
+the first few words. Write `Nothing is waiting.` when the list is empty.
+
+Keep the whole answer under twenty lines. A guest in the room means the roster
+comes back as names only; say so in one line instead of inventing detail.

package/skills/hilos-share/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: hilos-share
+description: Post a short summary, a diff, or a link from this session into the hilos thread it is bound to. Use when asked to share, post, or tell the room what happened.
+---
+
+# Share
+
+Put what just happened in front of the people in the room. The message is
+posted as the person running this session, under their name.
+
+1. Find the thread. Use the thread this session last posted into. If there is
+   none, call `list_channels`, ask which room, and post at top level there.
+2. Write the summary yourself, in the person's register: what changed, where to
+   look, what is still open. Three to six lines. A branch name, a PR link, or a
+   `git diff --stat` reads better than prose about the diff.
+3. Call `post_message` with the channel id, the body, and `parentId` when there
+   is a bound thread.
+4. Print the returned link so the person can open it.
+
+Never paste a whole diff, a transcript, a token, or the contents of `.env`. If
+the change is large, share the shape of it and the link. Ask before sharing
+anything the person has not seen in this session yet.

package/src/child-mcp.mjs

@@ -0,0 +1,316 @@
+// The agent's seat INSIDE its own run (1255).
+//
+// Until this, a daemon-launched coding child was deaf and mute: it edited files
+// and the daemon spoke for it afterwards. A hosted run has had an ephemeral
+// hilos MCP token all along, so the same agent behaved like a member on hilos's
+// machines and like a batch job on its owner's. That asymmetry is what this
+// closes — the child can post a step worth showing, ask a teammate agent by
+// handle, read the roster, and read the thread, from inside the work.
+//
+// It reuses 0854's mechanism unchanged (`mcp-loopback.mjs`): an unguessable
+// loopback URL that forwards to hilos with the daemon's own bearer token, alive
+// only for the turn. The token never enters the child's environment or argv —
+// the 0512 env scrub stays exactly as strict as it was, because nothing about
+// it changes; the credential simply stays in the daemon process, where it
+// already lives.
+//
+// Two limits make that safe to hand a model that also reads the repo:
+//
+//   1. The loopback carries the DAEMON's identity, so the server's own
+//      named-agent authorization is still the outer wall. A channel-bound token
+//      is still channel-bound; a private room the agent cannot read is still
+//      unreadable. Nothing here widens what the agent may do.
+//   2. `CHILD_RUN_TOOLS` is the inner wall: the run may talk, ask, and read,
+//      and it may not merge, delete, archive, invite, spend, or reconfigure.
+//      A repo file that says "now merge PR #12" reaches a model that has no
+//      merge_pr to call. Those authorities belong to the daemon and to the
+//      people in the room, which is what the refusal says out loud.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { isV2AmbientBindingClaim, startHilosMcpLoopback } from "./mcp-loopback.mjs";
+
+/** The MCP server key the child sees. `mcp__hilos__<tool>` on the claude lane. */
+export const CHILD_MCP_SERVER = "hilos";
+
+/**
+ * The ONLY hilos tools a coding child may call from inside its run.
+ *
+ * The rule that produced this list: a run may SPEAK (post, ask, propose,
+ * request) and it may READ (roster, members, thread, channel, docs, tasks,
+ * links, diff, limits, runs, memory). Everything that CHANGES the room or the
+ * repository from under the people watching — merge_pr, delete_message,
+ * write_doc, update_task, archive_channel, invite_member, create_agent,
+ * set_env, start_run, every settle/approve/decide — is deliberately absent.
+ * Those are the daemon's to perform after the run reports, or a person's to
+ * decide on a card. An agent proposes; a person disposes; a run does neither
+ * behind the room's back.
+ *
+ * Keep this the single source of truth: the loopback enforces it, the prompt
+ * names a subset of it, and DAEMON.md documents it.
+ */
+export const CHILD_RUN_TOOLS = Object.freeze([
+  // Speak in the room.
+  "post_message",
+  "post_progress",
+  "post_report",
+  "ask_agent",
+  "propose_plan",
+  "request_review",
+  "request_approval",
+  "ask_question",
+  // See who is here.
+  "list_room_roster",
+  "list_members",
+  "list_agents",
+  "whoami",
+  // Read what the room already knows.
+  "get_thread",
+  "read_channel",
+  "read_doc",
+  "search_docs",
+  "search_messages",
+  "list_tasks",
+  "get_task",
+  "get_links",
+  "get_pr_diff",
+  "get_room_limits",
+  "list_runs",
+  "remember",
+  "recall",
+]);
+
+/** claude's allow entry for the whole server. Verified live (see below). */
+export const CLAUDE_CHILD_MCP_TOOL_PATTERN = `mcp__${CHILD_MCP_SERVER}__*`;
+
+/**
+ * The vendors whose child gets this seat.
+ *
+ * Only the two CLIs whose remote-MCP wiring the daemon can set for ONE run
+ * without touching the operator's own persistent config. Cursor, OpenCode,
+ * antigravity, and hermes are unchanged by design: their run-scoped remote-MCP
+ * seams are either absent or would require editing a config file that outlives
+ * the turn, and a permanent change is not what a turn-scoped seat means.
+ */
+export const CHILD_MCP_VENDORS = Object.freeze(["claude_code", "codex"]);
+
+const OFF_RE = /^(0|off|false|no)$/i;
+const ON_RE = /^(1|on|true|yes)$/i;
+
+/**
+ * Is the seat switched on for this machine?
+ *
+ * Default ON. `HILOS_CHILD_MCP=off` in the environment and `childMcp: false` in
+ * `~/.hilos/agent.json` both turn it off; the environment wins either way, so
+ * an operator can disable it without editing a file and re-enable it without
+ * finding the one that said no.
+ *
+ * @param {{ childMcp?: boolean } | null} [cfg]
+ * @param {Record<string, string | undefined>} [env]
+ */
+export function childMcpEnabled(cfg, env = process.env) {
+  const raw = String(env?.HILOS_CHILD_MCP ?? "").trim();
+  if (OFF_RE.test(raw)) return false;
+  if (ON_RE.test(raw)) return true;
+  return cfg?.childMcp !== false;
+}
+
+/** @param {string} [vendor] */
+export function childMcpSupportsVendor(vendor) {
+  return CHILD_MCP_VENDORS.includes(String(vendor || ""));
+}
+
+/**
+ * Will this run get the seat?
+ *
+ * Answerable BEFORE the loopback exists, because the PROMPT is written first
+ * and it must not promise tools the child will not have (the same reason
+ * `codexRunIsGated` exists). Every input is known at that point: the switch,
+ * the vendor, the connection, and whether the server sent a v2 room claim with
+ * this job. The only thing left that can still fail is binding a loopback
+ * socket, which is why `startChildHilosMcp` returns null on that and the
+ * prompt-side over-promise is bounded to a case that does not happen in
+ * practice.
+ *
+ * @param {{ cfg?: any, vendor?: string, bindingClaim?: unknown, env?: Record<string, string | undefined> }} o
+ */
+export function childMcpPlanned({ cfg, vendor, bindingClaim, env } = {}) {
+  if (!childMcpEnabled(cfg, env ?? process.env)) return false;
+  if (!childMcpSupportsVendor(vendor)) return false;
+  if (!cfg?.url || !cfg?.token) return false;
+  // Same rule the reply bridge follows: no server-signed room proof, no bridge.
+  // A run whose ambient authority cannot be proven gets no room tools at all
+  // rather than a set of calls the server would reject one by one.
+  return isV2AmbientBindingClaim(typeof bindingClaim === "string" ? bindingClaim.trim() : "");
+}
+
+/** The `mcpServers` fragment for a claude `--mcp-config` JSON. */
+export function childMcpServers(url) {
+  return { [CHILD_MCP_SERVER]: { type: "http", url } };
+}
+
+/**
+ * Write a 0600 `--mcp-config` holding ONLY the hilos server.
+ *
+ * Used when the permission gate is off and therefore writes no config of its
+ * own. When the gate IS on, the hilos entry is merged into the gate's single
+ * config file instead — claude takes `--mcp-config` more than once, but one
+ * file the run owns end-to-end is one file to delete.
+ */
+export function writeChildMcpConfig(url, { dir = os.tmpdir() } = {}) {
+  const configPath = path.join(
+    dir,
+    `hilos-child-mcp-${process.pid}-${randomBytes(6).toString("hex")}.json`,
+  );
+  fs.writeFileSync(configPath, JSON.stringify({ mcpServers: childMcpServers(url) }), {
+    mode: 0o600,
+  });
+  return configPath;
+}
+
+/**
+ * The argv a CODEX child needs to reach the loopback, byte-identical in shape
+ * to what the reply bridge has been passing since 0854.
+ *
+ * The third entry is not decoration. Neither `codex exec` (stdin closed) nor a
+ * gated `codex mcp-server` run should route the agent's OWN room tools through
+ * an approval channel: on exec there is none, so every call comes back "user
+ * cancelled", and on mcp-server it would raise a permission card in the room
+ * for the agent asking to speak in that same room. Approval is scoped to this
+ * one random, loopback-only, turn-scoped server; hilos's own authorization and
+ * the allowlist below remain the authority.
+ *
+ * @param {string} url
+ */
+export function codexChildMcpArgs(url) {
+  if (!url) return [];
+  return [
+    "-c", `mcp_servers.${CHILD_MCP_SERVER}.url=${JSON.stringify(url)}`,
+    "-c", `mcp_servers.${CHILD_MCP_SERVER}.startup_timeout_sec=15`,
+    "-c", `mcp_servers.${CHILD_MCP_SERVER}.default_tools_approval_mode="approve"`,
+  ];
+}
+
+/**
+ * The argv a CLAUDE child needs on the ungated lane.
+ *
+ * VERIFIED LIVE against claude 2.1.261 (0521: flags are proven against the
+ * binary, never remembered):
+ *   • `-p --permission-mode acceptEdits --mcp-config <cfg>` alone answers
+ *     "Permission required to call `mcp__hilos__ping`" and never calls the
+ *     tool — an MCP server without an allow entry is inert in print mode;
+ *   • adding `--allowedTools "mcp__hilos__*"` calls it (the wildcard is
+ *     honored per server);
+ *   • repeated `--allowedTools` flags ACCUMULATE — an operator's own
+ *     `--allowedTools` in `codingCmd` still applies when ours is appended;
+ *   • with `--permission-prompt-tool` also present, the allow entry wins and
+ *     the gate is never asked, so the agent's own room tools raise no card,
+ *     while everything else still does.
+ *
+ * @param {string} configPath
+ */
+export function claudeChildMcpArgs(configPath) {
+  if (!configPath) return [];
+  return ["--mcp-config", configPath, "--allowedTools", CLAUDE_CHILD_MCP_TOOL_PATTERN];
+}
+
+/**
+ * The argv for whichever vendor this run uses, on the UNGATED lane. The gated
+ * lanes thread the same facts through their own transports instead.
+ *
+ * @param {string} vendor
+ * @param {{ url?: string, configPath?: string | null } | null} childMcp
+ */
+export function childMcpArgs(vendor, childMcp) {
+  if (!childMcp) return [];
+  if (vendor === "claude_code") return claudeChildMcpArgs(childMcp.configPath || "");
+  if (vendor === "codex") return codexChildMcpArgs(childMcp.url || "");
+  return [];
+}
+
+/**
+ * Start the turn-scoped seat, or return null when this run does not get one.
+ * The caller MUST close it in a finally: the loopback outliving the run would
+ * be a live credential proxy with nobody using it.
+ *
+ * @param {{
+ *   cfg?: any,
+ *   vendor?: string,
+ *   bindingClaim?: unknown,
+ *   standaloneConfig?: boolean,
+ *   startLoopback?: typeof startHilosMcpLoopback,
+ *   dir?: string,
+ *   log?: { error?: (message: string) => void },
+ * }} o
+ */
+export async function startChildHilosMcp({
+  cfg,
+  vendor,
+  bindingClaim,
+  standaloneConfig = false,
+  startLoopback = startHilosMcpLoopback,
+  dir = os.tmpdir(),
+  log,
+} = {}) {
+  if (!childMcpPlanned({ cfg, vendor, bindingClaim })) return null;
+  let loopback = null;
+  try {
+    loopback = await startLoopback({
+      url: cfg.url,
+      token: cfg.token,
+      bindingClaim: String(bindingClaim).trim(),
+      allowTools: CHILD_RUN_TOOLS,
+    });
+  } catch (error) {
+    log?.error?.(`hilos child MCP: ${error?.message || error}`);
+    return null;
+  }
+  if (!loopback) return null;
+  let configPath = null;
+  if (standaloneConfig) {
+    try {
+      configPath = writeChildMcpConfig(loopback.url, { dir });
+    } catch (error) {
+      // A config we cannot write means a claude child with no way to reach the
+      // seat. Tear the proxy down rather than leave one open for nobody.
+      log?.error?.(`hilos child MCP config: ${error?.message || error}`);
+      await loopback.close().catch(() => {});
+      return null;
+    }
+  }
+  return {
+    url: loopback.url,
+    configPath,
+    servers: childMcpServers(loopback.url),
+    allowedTools: CLAUDE_CHILD_MCP_TOOL_PATTERN,
+    async close() {
+      if (configPath) {
+        try {
+          fs.unlinkSync(configPath);
+        } catch {
+          /* a leftover temp config must never fail a finished run */
+        }
+      }
+      await loopback.close().catch(() => {});
+    },
+  };
+}
+
+/**
+ * The paragraph the coding prompt gains when the seat is on. Deliberately short
+ * and deliberately "sparingly": a run that narrates every file it opens is the
+ * failure mode, and the daemon still posts the report at the end either way.
+ *
+ * @param {boolean} enabled
+ */
+export function childToolsNote(enabled) {
+  if (!enabled) return "";
+  return (
+    "You have hilos tools for this room: post_progress for a step worth showing, " +
+    "ask_agent to ask a teammate agent by handle when you are blocked, " +
+    "list_room_roster to see who is here, get_thread to read the discussion. " +
+    "Use them sparingly; the daemon posts your report when you finish."
+  );
+}

package/src/claude-permissions.mjs

@@ -160,9 +160,27 @@ export function shouldGateClaudePermissions({ vendor, runtimePermissions, codeAr
   return true;
 }
 
-/** The argv the gate appends to a claude code run. */
-export function claudePermissionArgs({ configPath, toolId = CLAUDE_PERMISSION_TOOL_ID }) {
-  return ["--mcp-config", configPath, "--permission-prompt-tool", toolId];
+/**
+ * The argv the gate appends to a claude code run.
+ *
+ * `allowedTools` (1255) is the pattern for the run's OWN hilos server when it
+ * rides in this same config. Verified live on 2.1.261: an allow entry wins over
+ * `--permission-prompt-tool`, so the agent speaking in its own room raises no
+ * card, while every other tool still does; and repeated `--allowedTools` flags
+ * accumulate, so an operator's own list in `codingCmd` survives.
+ */
+export function claudePermissionArgs({
+  configPath,
+  toolId = CLAUDE_PERMISSION_TOOL_ID,
+  allowedTools = "",
+}) {
+  return [
+    "--mcp-config",
+    configPath,
+    "--permission-prompt-tool",
+    toolId,
+    ...(allowedTools ? ["--allowedTools", allowedTools] : []),
+  ];
 }
 
 /** The flags to strip when a CLI turns out not to know them (compat retry). */
@@ -186,6 +204,8 @@ export const CLAUDE_PERMISSION_FLAGS = ["--mcp-config", "--permission-prompt-too
  *   signal?: AbortSignal,
  *   log?: { error?: (message: string) => void },
  *   dir?: string,
+ *   extraServers?: Record<string, object> | null,
+ *   allowedTools?: string,
  * }} options
  * @returns {Promise<{ configPath: string, toolId: string, url: string, port: number,
  *   args: string[], setSessionId: (value: string) => void, pending: () => number,
@@ -202,6 +222,11 @@ export async function startClaudePermissionServer({
   signal,
   log,
   dir = os.tmpdir(),
+  // 1255 — the run's turn-scoped hilos server rides in this SAME file. One
+  // `--mcp-config` the run owns end to end is one file to write 0600 and one
+  // file to delete; a second config would be a second lifetime to get wrong.
+  extraServers = null,
+  allowedTools = "",
 }) {
   if (typeof requestPermission !== "function" || typeof getPermissionDecision !== "function") {
     throw new Error("claude permission server requires requestPermission and getPermissionDecision");
@@ -408,6 +433,10 @@ export async function startClaudePermissionServer({
     configPath,
     JSON.stringify({
       mcpServers: {
+        // Extras go FIRST so the gate's own entry always wins the key: a
+        // caller's server must never be able to replace the permission server
+        // this file exists to serve.
+        ...(extraServers && typeof extraServers === "object" ? extraServers : {}),
         [CLAUDE_PERMISSION_SERVER]: { type: "http", url, headers: { Authorization: `Bearer ${token}` } },
       },
     }),
@@ -419,7 +448,7 @@ export async function startClaudePermissionServer({
     toolId: CLAUDE_PERMISSION_TOOL_ID,
     url,
     port,
-    args: claudePermissionArgs({ configPath }),
+    args: claudePermissionArgs({ configPath, allowedTools }),
     /** Let the caller stamp the CLI's real session id onto later cards. */
     setSessionId(value) {
       if (typeof value === "string" && value) currentSessionId = value;

package/src/config.mjs

@@ -107,6 +107,17 @@ const DEFAULTS = {
   // HILOS_UPLOAD_TRANSCRIPTS=1 does the same from the environment (=0 forces it
   // back off). Live-reloadable, so it can be revoked without a restart.
   uploadTranscripts: false,
+  // The agent's seat inside its own run (1255): a turn-scoped hilos MCP the
+  // daemon-launched Claude Code / Codex child can call, so a run can post a
+  // step, ask a teammate agent, read the roster, and read the thread from
+  // inside the work instead of only through the daemon's report afterwards.
+  // The bearer token stays in the daemon — the child gets a random loopback URL
+  // that dies with the turn, and only the read/speak tools on the allowlist in
+  // `child-mcp.mjs`; merge, delete, and every settle stay the daemon's.
+  //
+  // ON by default. `childMcp: false` here turns it off; HILOS_CHILD_MCP=off (or
+  // =on) does the same from the environment and wins over the file.
+  childMcp: true,
   // Replies in an exact thread bound by an opted-in local-session hook resume
   // that same provider session (0847). The hook install is the consent gate;
   // this switch lets an operator pause inbound pickup without uninstalling it.
@@ -215,6 +226,14 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
         : /^(0|off|false)$/i.test(process.env.HILOS_REPLY_BRIDGE || "")
           ? false
           : undefined,
+    // Both directions, like acpTransport: a machine whose file says yes must be
+    // able to say no from the environment, and the reverse.
+    childMcp:
+      /^(1|on|true|yes)$/i.test(process.env.HILOS_CHILD_MCP || "")
+        ? true
+        : /^(0|off|false|no)$/i.test(process.env.HILOS_CHILD_MCP || "")
+          ? false
+          : undefined,
   };
   const merged = { ...DEFAULTS, ...file };
   for (const [k, v] of Object.entries(env)) if (v !== undefined && v !== "") merged[k] = v;
@@ -252,6 +271,11 @@ const LIVE_FIELDS = [
   // special-cased below, because for this field a DELETED key has to mean no.
   "uploadTranscripts",
   "replyBridge",
+  // Live-reloadable: an operator who decides a run should not speak in the room
+  // must not have to restart the daemon to stop it. Like webMcp/webSearch, a
+  // DELETED key returns to the default rather than pinning a stale opt-out, so
+  // the special case below recomputes it.
+  "childMcp",
   "codingModel",
   "chatCmd",
   "codingEnv",
@@ -328,6 +352,9 @@ export function reloadConfig(prev) {
   // returns to that default on the next poll instead of pinning a stale opt-out
   // until restart; the environment override below still wins.
   if (changed("webSearch")) next.webSearch = file.webSearch !== false;
+  // The child's seat follows the same safe-on rule: removing an edited
+  // `childMcp:false` restores the default on the next poll.
+  if (changed("childMcp")) next.childMcp = file.childMcp !== false;
   // The environment stays the operator's override on reload, in both
   // directions — a machine that opted out with =0 must not be opted back in by
   // a file edit (0792).
@@ -335,6 +362,8 @@ export function reloadConfig(prev) {
   if (process.env.HILOS_UPLOAD_TRANSCRIPTS === "0") next.uploadTranscripts = false;
   if (/^(1|on|true)$/i.test(process.env.HILOS_REPLY_BRIDGE || "")) next.replyBridge = true;
   if (/^(0|off|false)$/i.test(process.env.HILOS_REPLY_BRIDGE || "")) next.replyBridge = false;
+  if (/^(1|on|true|yes)$/i.test(process.env.HILOS_CHILD_MCP || "")) next.childMcp = true;
+  if (/^(0|off|false|no)$/i.test(process.env.HILOS_CHILD_MCP || "")) next.childMcp = false;
   if (process.env.CODING_CMD) next.codingCmd = process.env.CODING_CMD;
   if (process.env.HILOS_CODING_MODEL) next.codingModel = process.env.HILOS_CODING_MODEL;
   if (process.env.HILOS_CHAT_CMD) next.chatCmd = process.env.HILOS_CHAT_CMD;