impel-cli 0.20.41 → 0.20.43

package/src/agents.js

@@ -21,7 +21,10 @@ import {
   IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV,
   IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
   IMPEL_NATIVE_AGENT_MCP_TARGET,
+  IMPEL_NATIVE_BENCHMARK_ENV,
+  impelCliInvocation,
   impelNativeAgentMcpInvocation,
+  nativeBenchmarkHeaderValue,
 } from "./selfInvocation.js";
 import {
   adapterAnswerFaithfulCompletionGuidance,
@@ -31,6 +34,11 @@ import {
   usesDirectAnswer,
 } from "./directAnswer.js";
 import { normalizeTenantId } from "./tenants.js";
+import {
+  ensureClaudeNativeInterceptHook,
+  nativeInterceptEnabled,
+  nativeInterceptTimeoutMs,
+} from "./nativeInterception.js";
 import {
   adapterCallerSpawnGuidance,
   adapterFaithfulCompletionGuidance,
@@ -56,7 +64,9 @@ export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
 export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 22;
+export const MANAGED_AGENT_MANIFEST_VERSION = 23;
+export const IMPEL_NATIVE_PARENT_DIRECT_ENV = "IMPEL_NATIVE_PARENT_DIRECT";
+export const IMPEL_NATIVE_SLASH_COMMANDS_ENV = "IMPEL_NATIVE_SLASH_COMMANDS";
 
 // The host model only selects the fixed MCP tool and faithfully returns its
 // result. Spark minimizes those transport-only turns while the selected Eve
@@ -77,6 +87,18 @@ function nativeAgentToolNames(agent) {
 function eagerNativeAgentTransportEnabled() {
   return process.env.IMPEL_NATIVE_EAGER_TRANSPORT !== "0";
 }
+
+function enabledProfileFlag(environment, name) {
+  return ["1", "true"].includes(String(environment?.[name] || "").toLowerCase());
+}
+
+export function nativeParentDirectEnabled(environment = process.env) {
+  return enabledProfileFlag(environment, IMPEL_NATIVE_PARENT_DIRECT_ENV);
+}
+
+export function nativeSlashCommandsEnabled(environment = process.env) {
+  return enabledProfileFlag(environment, IMPEL_NATIVE_SLASH_COMMANDS_ENV);
+}
 const MAX_RETIRED_AGENT_BINDINGS = 50;
 const MAX_NATIVE_AGENT_STATE_BYTES = 512 * 1024;
 const TERMINAL_NATIVE_AGENT_STATUSES = new Set(["succeeded", "failed", "cancelled", "canceled"]);
@@ -650,6 +672,116 @@ function nativeToolName(toolName) {
   return `${nativeToolNamespace()}__${toolName}`;
 }
 
+const CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS = Object.freeze([
+  NATIVE_AGENT_ANSWER_TOOL,
+  NATIVE_AGENT_RESUME_TOOL,
+].map((tool) => nativeToolName(tool)));
+
+function parentDirectPermissionTools(renderedAgents) {
+  const trusted = new Set(CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS);
+  const tools = [...new Set(renderedAgents.flatMap((agent) =>
+    agent.parentLaunchDefinition?.tools || []
+  ))];
+  if (!tools.every((tool) => trusted.has(tool))) {
+    throw new Error("the managed Claude parent-direct permission grant is invalid");
+  }
+  return tools;
+}
+
+function priorParentDirectPermissionGrants(prior, ownsManagedProfile) {
+  const grants = ownsManagedProfile ? prior?.nativeParentDirectPermissionGrants : null;
+  const trusted = new Set(CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS);
+  if (!Array.isArray(grants)
+    || new Set(grants).size !== grants.length
+    || !grants.every((tool) => trusted.has(tool))) return [];
+  return [...grants];
+}
+
+function readClaudeSettingsForPermissions(settingsPath) {
+  let raw;
+  try {
+    const stat = fs.lstatSync(settingsPath);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new Error(`refusing to update unsafe Claude settings path ${settingsPath}`);
+    }
+    raw = fs.readFileSync(settingsPath, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return { settings: {} };
+    throw error;
+  }
+  try {
+    const settings = raw.trim() ? JSON.parse(raw) : {};
+    if (!settings || typeof settings !== "object" || Array.isArray(settings)) throw new Error();
+    return { settings };
+  } catch {
+    throw new Error(`${settingsPath} exists but isn't a valid JSON object. Fix or remove it, then re-run.`);
+  }
+}
+
+function syncClaudeParentDirectPermissions(root, desiredTools, priorGrants) {
+  if (desiredTools.length === 0 && priorGrants.length === 0) return [];
+
+  const settingsPath = path.join(root, "settings.json");
+  const { settings } = readClaudeSettingsForPermissions(settingsPath);
+  const permissionsExisted = Object.hasOwn(settings, "permissions");
+  if (permissionsExisted && (
+    !settings.permissions
+    || typeof settings.permissions !== "object"
+    || Array.isArray(settings.permissions)
+  )) {
+    throw new Error(`${settingsPath} has an invalid permissions value. Fix or remove it, then re-run.`);
+  }
+  const permissions = permissionsExisted ? { ...settings.permissions } : {};
+  if (Object.hasOwn(permissions, "allow") && (
+    !Array.isArray(permissions.allow)
+    || !permissions.allow.every((rule) => typeof rule === "string")
+  )) {
+    throw new Error(`${settingsPath} has an invalid permissions.allow value. Fix or remove it, then re-run.`);
+  }
+
+  const desired = new Set(desiredTools);
+  const previouslyManaged = new Set(priorGrants);
+  const allow = Array.isArray(permissions.allow) ? [...permissions.allow] : [];
+  const nextAllow = allow.filter((rule) => !previouslyManaged.has(rule) || desired.has(rule));
+  const managedGrants = [];
+  for (const tool of desiredTools) {
+    if (previouslyManaged.has(tool)) {
+      managedGrants.push(tool);
+      if (!nextAllow.includes(tool)) nextAllow.push(tool);
+    } else if (!nextAllow.includes(tool)) {
+      managedGrants.push(tool);
+      nextAllow.push(tool);
+    }
+  }
+
+  // permissions.allow is Claude's ordinary pre-approval surface. Record only
+  // entries this sync actually adds, so turning the experiment back off can
+  // remove them without claiming any operator-authored permission rule.
+  if (JSON.stringify(allow) !== JSON.stringify(nextAllow)) {
+    settings.permissions = { ...permissions, allow: nextAllow };
+    atomicPrivateWrite(settingsPath, `${JSON.stringify(settings, null, 2)}\n`);
+  }
+  return managedGrants;
+}
+
+function claudeParentDirectPermissionsCurrent(root, manifest) {
+  try {
+    const desiredTools = parentDirectPermissionTools(
+      Array.isArray(manifest.agents) ? manifest.agents.map((record) => ({
+        parentLaunchDefinition: record?.launchMode === "parent-direct"
+          ? record.parentLaunchDefinition
+          : null,
+      })) : [],
+    );
+    if (desiredTools.length === 0) return true;
+    const { settings } = readClaudeSettingsForPermissions(path.join(root, "settings.json"));
+    const allow = settings.permissions?.allow;
+    return Array.isArray(allow) && desiredTools.every((tool) => allow.includes(tool));
+  } catch {
+    return false;
+  }
+}
+
 function codexAdapterInstructions(tenantId, agent) {
   const contextRequirement = agent.requiredContext.length
     ? ` Required context keys are ${JSON.stringify(agent.requiredContext)}; if any are absent, ask for them before starting the run.`
@@ -780,11 +912,61 @@ function renderClaudeAgent({ tenantId, agent, name, invocation, recoveryOnly = f
   };
 }
 
+function claudeParentDirectInstructions(tenantId, agent) {
+  const attribution = `Response from managed agent ${JSON.stringify(agent.title)} (${agent.agentId}):`;
+  return [
+    `The user explicitly selected the managed agent ${JSON.stringify(agent.title)} (${agent.agentId}) for tenant ${JSON.stringify(tenantId)}.`,
+    `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the user's complete request. Do not spawn a relay subagent and do not perform the request yourself.`,
+    `If the answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal; after a continuation exists, never call the answer tool again.`,
+    `On success, present the attribution line ${JSON.stringify(attribution)}, followed by the returned finalText verbatim with no rewriting, Markdown changes, or independent synthesis. On failure, attribute the failure to the same named managed agent and do not invent a replacement answer.`,
+  ].join(" ");
+}
+
+function claudeParentDirectDefinition({ tenantId, agent, invocation }) {
+  return {
+    prompt: claudeParentDirectInstructions(tenantId, agent),
+    permissionMode: "bypassPermissions",
+    tools: [...CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS],
+    mcpServers: [{
+      [MANAGED_AGENT_MCP_SERVER]: {
+        type: "stdio",
+        command: invocation.command,
+        args: [...invocation.args],
+        env: { ...(invocation.env || {}) },
+      },
+    }],
+  };
+}
+
+function nativeAgentTelemetryEnvironment(environment = process.env) {
+  return Object.fromEntries(IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES.flatMap((name) => {
+    const value = environment?.[name];
+    return typeof value === "string" && value.length > 0 ? [[name, value]] : [];
+  }));
+}
+
+function telemetryEnvironmentMatches(recorded, expected) {
+  const normalizedRecorded = recorded === undefined ? {} : recorded;
+  return normalizedRecorded
+    && typeof normalizedRecorded === "object"
+    && !Array.isArray(normalizedRecorded)
+    && JSON.stringify(normalizedRecorded) === JSON.stringify(expected);
+}
+
 function codexInvocationEnvironment(invocation, { durableProfile = false } = {}) {
   const entries = Object.entries(invocation.env || {});
   const transient = new Set(IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES);
+  // Ordinary durable profiles must never retain a one-off telemetry path.
+  // The native Codex profiler is different: it generates a throwaway profile
+  // for the whole benchmark cohort and needs Codex's explicit MCP environment
+  // map to carry that cohort path into the server process. The isolated root is
+  // removed after the cohort, so benchmark-tagged telemetry cannot linger in
+  // an operator's managed profile.
+  const isolatedBenchmark = nativeBenchmarkHeaderValue(invocation.env || {}) !== null;
   return [
-    ...(durableProfile ? entries.filter(([key]) => !transient.has(key)) : entries),
+    ...(durableProfile && !isolatedBenchmark
+      ? entries.filter(([key]) => !transient.has(key))
+      : entries),
     [IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV, String(CODEX_NATIVE_AGENT_ATTACHMENT_WINDOW_MS)],
   ];
 }
@@ -867,34 +1049,44 @@ function renderCodexProfile(options) {
 function boundNativeAgentInvocation(tenantId, agent, invocation, {
   policyFingerprint = nativeAgentPolicyFingerprint(agent),
   mode = usesDirectAnswer(agent) ? "answer" : "durable",
+  answerToolAttribution = false,
+  environment = process.env,
 } = {}) {
-  if (!invocation) {
-    return impelNativeAgentMcpInvocation({
+  const bound = !invocation
+    ? impelNativeAgentMcpInvocation({
       tenantId,
       agentId: agent.agentId,
       scopeParam: agent.scopeParam,
       policyFingerprint,
       mode,
-    });
-  }
-  const mcpIndex = invocation.args?.lastIndexOf("mcp") ?? -1;
-  if (mcpIndex < 0) throw new Error("native-agent MCP invocation has no mcp command");
-  return {
-    ...invocation,
-    args: [
-      ...invocation.args.slice(0, mcpIndex + 1),
-      "--target", IMPEL_NATIVE_AGENT_MCP_TARGET,
-      "--tenant", tenantId,
-      "--agent-id", agent.agentId,
-      "--scope-param", agent.scopeParam,
-      "--policy-fingerprint", policyFingerprint,
-      ...(mode === "recovery" ? ["--recovery-only"] : []),
-      ...(mode === "answer" ? ["--answer-only"] : []),
-    ],
-  };
+    }, { environment })
+    : (() => {
+      const mcpIndex = invocation.args?.lastIndexOf("mcp") ?? -1;
+      if (mcpIndex < 0) throw new Error("native-agent MCP invocation has no mcp command");
+      return {
+        ...invocation,
+        args: [
+          ...invocation.args.slice(0, mcpIndex + 1),
+          "--target", IMPEL_NATIVE_AGENT_MCP_TARGET,
+          "--tenant", tenantId,
+          "--agent-id", agent.agentId,
+          "--scope-param", agent.scopeParam,
+          "--policy-fingerprint", policyFingerprint,
+          ...(mode === "recovery" ? ["--recovery-only"] : []),
+          ...(mode === "answer" ? ["--answer-only"] : []),
+        ],
+      };
+    })();
+  return answerToolAttribution
+    ? { ...bound, args: [...bound.args, "--agent-title", agent.title] }
+    : bound;
 }
 
-export function renderManagedAgents(client, tenantId, agents, invocation = null, { directCodeMode = true } = {}) {
+export function renderManagedAgents(client, tenantId, agents, invocation = null, {
+  directCodeMode = true,
+  nativeParentDirect = false,
+  environment = process.env,
+} = {}) {
   if (client !== "claude" && client !== "codex") throw new Error(`unknown agent client ${client}`);
   const normalizedTenant = normalizeTenantId(tenantId);
   const fileStems = generatedAgentFileStems(normalizedTenant, agents);
@@ -908,12 +1100,21 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
     // builtin and remove it from the @ mention picker. Claude names are already
     // collision-safe, filesystem-safe identifiers, so use them as filenames.
     const fileStem = client === "claude" ? name : fileStems[index];
-    const boundInvocation = boundNativeAgentInvocation(normalizedTenant, agent, invocation);
-    const claudeRendered = client === "claude"
+    const parentDirect = client === "claude" && nativeParentDirect && usesDirectAnswer(agent);
+    const boundInvocation = boundNativeAgentInvocation(normalizedTenant, agent, invocation, {
+      answerToolAttribution: parentDirect,
+      environment,
+    });
+    const claudeRendered = client === "claude" && !parentDirect
       ? renderClaudeAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation })
       : null;
+    const parentLaunchDefinition = parentDirect
+      ? claudeParentDirectDefinition({ tenantId: normalizedTenant, agent, invocation: boundInvocation })
+      : null;
     const contents = claudeRendered?.contents
-      ?? renderCodexAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation, directCodeMode });
+      ?? (client === "codex"
+        ? renderCodexAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation, directCodeMode })
+        : null);
     const profileName = client === "codex" ? fileStem : null;
     return {
       agentId: agent.agentId,
@@ -923,9 +1124,10 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
       policyFingerprint: nativeAgentPolicyFingerprint(agent),
       retired: false,
       name,
-      fileName: `${fileStem}${extension}`,
+      fileName: parentDirect ? null : `${fileStem}${extension}`,
       contents,
       ...(claudeRendered ? { launchDefinition: claudeRendered.launchDefinition } : {}),
+      ...(parentLaunchDefinition ? { parentLaunchDefinition } : {}),
       ...(profileName ? {
         profileName,
         profileFileName: `${profileName}.config.toml`,
@@ -941,7 +1143,65 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
   });
 }
 
-function renderRetiredManagedAgents(client, tenantId, bindings, active, invocation = null, { directCodeMode = true } = {}) {
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function claudeSlashCommandName(agent, generatedAgentName) {
+  const base = `ask-${generatedAgentName}`;
+  if (base.length <= 63) return base;
+  const prefix = generatedAgentName.slice(0, 50).replace(/-+$/u, "") || "agent";
+  return `ask-${prefix}-${agentBindingHash(agent)}`;
+}
+
+function renderClaudeSlashCommand(tenantId, agent, commandName, invocation) {
+  const tokens = [invocation.command, ...invocation.args].map(shellQuote).join(" ");
+  const bashCommand = `${tokens} --prompt "$ARGUMENTS" --json`;
+  const attribution = `Response from managed agent ${JSON.stringify(agent.title)} (${agent.agentId}):`;
+  return [
+    "---",
+    `description: ${JSON.stringify(`Ask managed agent ${agent.title} (${agent.agentId}) in Impel tenant ${tenantId}; its rendered answer is explicitly attributed.`)}`,
+    `argument-hint: ${JSON.stringify("<task>")}`,
+    `allowed-tools: ${JSON.stringify(`Bash(${tokens}:*)`)}`,
+    "---",
+    "",
+    `The JSON below came from managed agent ${JSON.stringify(agent.title)} (${agent.agentId}), not from the host model.`,
+    `Run the fixed command exactly once. If ok is true, output the attribution line ${JSON.stringify(attribution)} followed by finalText verbatim. If ok is false, attribute the reported error to the same managed agent. Do not perform, rewrite, or independently answer the task.`,
+    "",
+    `!\`${bashCommand}\``,
+    "",
+  ].join("\n");
+}
+
+export function renderManagedClaudeSlashCommands(tenantId, agents, invocation = null) {
+  const normalizedTenant = normalizeTenantId(tenantId);
+  const names = generatedClientAgentNames("claude", agents);
+  return agents.flatMap((agent, index) => {
+    if (!usesDirectAnswer(agent)) return [];
+    const commandName = claudeSlashCommandName(agent, names[index]);
+    const commandInvocation = invocation || impelCliInvocation([
+      "native", "answer",
+      "--tenant", normalizedTenant,
+      "--agent", agent.agentId,
+    ]);
+    return [{
+      agentId: agent.agentId,
+      name: commandName,
+      fileName: `${commandName}.md`,
+      contents: renderClaudeSlashCommand(
+        normalizedTenant,
+        agent,
+        commandName,
+        commandInvocation,
+      ),
+    }];
+  });
+}
+
+function renderRetiredManagedAgents(client, tenantId, bindings, active, invocation = null, {
+  directCodeMode = true,
+  environment = process.env,
+} = {}) {
   const usedNames = new Set(active.map(({ name }) => name));
   const usedFiles = new Set(active.map(({ fileName }) => fileName));
   return bindings.map((binding) => {
@@ -979,6 +1239,7 @@ function renderRetiredManagedAgents(client, tenantId, bindings, active, invocati
     const boundInvocation = boundNativeAgentInvocation(tenantId, agent, invocation, {
       policyFingerprint: binding.policyFingerprint,
       mode: "recovery",
+      environment,
     });
     const claudeRendered = client === "claude"
       ? renderClaudeAgent({ tenantId, agent, name, invocation: boundInvocation, recoveryOnly: true })
@@ -1115,7 +1376,11 @@ function validateClaudeLaunchDefinition(record, tenantId) {
     throw new Error("the managed Claude launch definition is invalid; run `impel agents sync claude`");
   }
   const server = definition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
-  const allowedEnvironment = new Set([IMPEL_MANAGED_MCP_ENV, ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES]);
+  const allowedEnvironment = new Set([
+    IMPEL_MANAGED_MCP_ENV,
+    ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
+    IMPEL_NATIVE_BENCHMARK_ENV,
+  ]);
   if (!exactObjectKeys(server, ["type", "command", "args", "env"])
     || server.type !== "stdio"
     || typeof server.command !== "string"
@@ -1154,6 +1419,57 @@ function validateClaudeLaunchDefinition(record, tenantId) {
   return definition;
 }
 
+function validateClaudeParentLaunchDefinition(record, tenantId) {
+  const definition = record.parentLaunchDefinition;
+  const expectedTools = CLAUDE_PARENT_DIRECT_TOOL_PERMISSIONS;
+  if (!exactObjectKeys(definition, ["prompt", "permissionMode", "tools", "mcpServers"])
+    || definition.prompt !== claudeParentDirectInstructions(tenantId, record)
+    || definition.permissionMode !== "bypassPermissions"
+    || JSON.stringify(definition.tools) !== JSON.stringify(expectedTools)
+    || !Array.isArray(definition.mcpServers)
+    || definition.mcpServers.length !== 1
+    || !exactObjectKeys(definition.mcpServers[0], [MANAGED_AGENT_MCP_SERVER])) {
+    throw new Error("the managed Claude parent-direct definition is invalid; run `impel agents sync claude`");
+  }
+  const server = definition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
+  const allowedEnvironment = new Set([
+    IMPEL_MANAGED_MCP_ENV,
+    ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
+    IMPEL_NATIVE_BENCHMARK_ENV,
+  ]);
+  if (!exactObjectKeys(server, ["type", "command", "args", "env"])
+    || server.type !== "stdio"
+    || typeof server.command !== "string"
+    || !server.command
+    || !Array.isArray(server.args)
+    || !server.args.every((argument) => typeof argument === "string")
+    || !server.env
+    || typeof server.env !== "object"
+    || Array.isArray(server.env)
+    || server.env[IMPEL_MANAGED_MCP_ENV] !== "1"
+    || !Object.entries(server.env).every(([key, value]) =>
+      allowedEnvironment.has(key)
+      && typeof value === "string"
+      && value.length <= 4096
+      && redactCredentialText(value) === value
+    )) {
+    throw new Error("the managed Claude parent-direct MCP definition is invalid; run `impel agents sync claude`");
+  }
+  const trustedInvocation = impelNativeAgentMcpInvocation({
+    tenantId,
+    agentId: record.agentId,
+    scopeParam: record.scopeParam,
+    policyFingerprint: record.policyFingerprint,
+    mode: "answer",
+  });
+  const trustedArgs = [...trustedInvocation.args, "--agent-title", record.title];
+  if (server.command !== trustedInvocation.command
+    || JSON.stringify(server.args) !== JSON.stringify(trustedArgs)) {
+    throw new Error("the managed Claude parent-direct binding is invalid; run `impel agents sync claude`");
+  }
+  return definition;
+}
+
 // A selector absent from the Impel manifest remains Claude-native. A matching
 // record is integrity checked, then re-declared under a random per-launch name
 // through Claude's higher-priority --agents source. This prevents project,
@@ -1192,11 +1508,34 @@ export function resolveManagedClaudeAgent(root, tenantId, selector) {
   const [record] = matches;
   if (typeof record.agentId !== "string"
     || !SAFE_AGENT_ID_RE.test(record.agentId)
+    || typeof record.title !== "string"
+    || !record.title.trim()
+    || record.title.length > 160
     || typeof record.scopeParam !== "string"
     || !SAFE_SCOPE_PARAM_RE.test(record.scopeParam)
     || !/^[a-f0-9]{64}$/u.test(record.policyFingerprint || "")) {
     throw new Error("the managed Claude binding metadata is invalid; run `impel agents sync claude`");
   }
+  if (record.launchMode === "parent-direct") {
+    if (!manifest.nativeParentDirect) {
+      throw new Error("the managed Claude parent-direct binding is stale; run `impel agents sync claude`");
+    }
+    const parentLaunchDefinition = validateClaudeParentLaunchDefinition(record, normalizedTenant);
+    const server = parentLaunchDefinition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
+    return {
+      ...record,
+      fileName: null,
+      path: null,
+      parentDirect: true,
+      parentLaunchDefinition,
+      parentMcpConfigJson: JSON.stringify({
+        mcpServers: { [MANAGED_AGENT_MCP_SERVER]: server },
+      }),
+    };
+  }
+  if (record.launchMode !== undefined) {
+    throw new Error("the managed Claude launch mode is invalid; run `impel agents sync claude`");
+  }
   const fileName = `${record.name}.md`;
   if (path.basename(fileName) !== fileName || !manifest.files.includes(fileName)) {
     throw new Error("the managed Claude agent mapping is invalid; run `impel agents sync claude`");
@@ -1229,6 +1568,59 @@ export function resolveManagedClaudeAgent(root, tenantId, selector) {
   };
 }
 
+/**
+ * Resolve a synchronized, read-only Claude binding that is allowed to use the
+ * bounded direct-answer transport. The public `impel native answer` command
+ * deliberately trusts the integrity-tracked profile rather than accepting
+ * model- or user-supplied scope/fingerprint routing arguments.
+ */
+export function resolveManagedClaudeAnswerBinding(root, tenantId, selector) {
+  const resolved = resolveManagedClaudeAgent(root, tenantId, selector);
+  if (!resolved) {
+    throw new Error(
+      `managed Claude agent ${JSON.stringify(selector)} was not found for tenant ${JSON.stringify(normalizeTenantId(tenantId))}`,
+    );
+  }
+  const definition = resolved.parentDirect
+    ? resolved.parentLaunchDefinition
+    : resolved.launchDefinition;
+  const server = definition?.mcpServers?.[0]?.[MANAGED_AGENT_MCP_SERVER];
+  if (!Array.isArray(server?.args) || !server.args.includes("--answer-only")) {
+    throw new Error(
+      `managed Claude agent ${JSON.stringify(selector)} is not configured for direct answers`,
+    );
+  }
+  return {
+    tenantId: normalizeTenantId(tenantId),
+    agentId: resolved.agentId,
+    title: resolved.title,
+    name: resolved.name,
+    scopeParam: resolved.scopeParam,
+    policyFingerprint: resolved.policyFingerprint,
+  };
+}
+
+export function managedClaudeAnswerBindings(root, tenantId) {
+  const normalizedTenant = normalizeTenantId(tenantId);
+  const manifest = readManagedAgentManifest(root);
+  if (!manifest
+    || manifest.version !== MANAGED_AGENT_MANIFEST_VERSION
+    || manifest.client !== "claude"
+    || manifest.tenantId !== normalizedTenant
+    || !Array.isArray(manifest.agents)) {
+    return [];
+  }
+  return manifest.agents.flatMap((record) => {
+    if (!record || record.retired || typeof record.agentId !== "string") return [];
+    const definition = record.launchMode === "parent-direct"
+      ? record.parentLaunchDefinition
+      : record.launchDefinition;
+    const args = definition?.mcpServers?.[0]?.[MANAGED_AGENT_MCP_SERVER]?.args;
+    if (!Array.isArray(args) || !args.includes("--answer-only")) return [];
+    return [resolveManagedClaudeAnswerBinding(root, normalizedTenant, record.agentId)];
+  });
+}
+
 export function resolveManagedCodexAgentProfile(root, tenantId, selector) {
   const normalizedTenant = normalizeTenantId(tenantId);
   const normalizedSelector = boundedString(selector, "agent selector", { max: 512 });
@@ -1279,12 +1671,43 @@ function profileIsFresh(profile, tenantId, now, ttlMs) {
     || Array.isArray(manifest.contentDigests)) return false;
   const expectedDirectProfiles = profile.client === "codex" && profile.directProfiles !== false;
   const expectedDirectCodeMode = profile.client === "codex" && profile.directCodeMode !== false;
+  const expectedNativeParentDirect = profile.client === "claude"
+    && (profile.nativeParentDirect ?? nativeParentDirectEnabled());
+  const expectedNativeSlashCommands = profile.client === "claude"
+    && (profile.nativeSlashCommands ?? nativeSlashCommandsEnabled());
+  const expectedNativeIntercept = profile.client === "claude"
+    && (profile.nativeIntercept ?? nativeInterceptEnabled());
+  const expectedNativeInterceptTimeoutMs = expectedNativeIntercept
+    ? (profile.nativeInterceptTimeoutMs ?? nativeInterceptTimeoutMs())
+    : null;
+  const expectedTelemetryEnvironment = nativeAgentTelemetryEnvironment(
+    profile.environment ?? process.env,
+  );
+  const expectedBenchmark = nativeBenchmarkHeaderValue(
+    profile.environment ?? process.env,
+  ) !== null;
   if (manifest.directProfiles !== expectedDirectProfiles
-    || manifest.directCodeMode !== expectedDirectCodeMode) return false;
+    || manifest.directCodeMode !== expectedDirectCodeMode
+    || Boolean(manifest.nativeParentDirect) !== expectedNativeParentDirect
+    || Boolean(manifest.nativeSlashCommands) !== expectedNativeSlashCommands
+    || Boolean(manifest.nativeIntercept) !== expectedNativeIntercept
+    || !telemetryEnvironmentMatches(
+      manifest.nativeAgentTelemetryEnvironment,
+      expectedTelemetryEnvironment,
+    )
+    || Boolean(manifest.nativeBenchmark) !== expectedBenchmark
+    || (expectedNativeIntercept
+      && manifest.nativeInterceptTimeoutMs !== expectedNativeInterceptTimeoutMs)) return false;
+  if (expectedNativeParentDirect && !claudeParentDirectPermissionsCurrent(profile.root, manifest)) {
+    return false;
+  }
   const syncedAt = Date.parse(manifest.syncedAt || "");
   if (!Number.isFinite(syncedAt) || now - syncedAt >= ttlMs) return false;
   const artifacts = [
     ...manifest.files.map((fileName) => `agents/${fileName}`),
+    ...(Array.isArray(manifest.commands)
+      ? manifest.commands.map((fileName) => `commands/${fileName}`)
+      : []),
     ...(Array.isArray(manifest.profiles) ? manifest.profiles : []),
   ];
   // Renderer changes are invalidated by the manifest version/capability fields
@@ -1306,10 +1729,17 @@ export function syncAgentProfile({
   agents,
   directProfiles = client === "codex",
   directCodeMode = client === "codex",
+  nativeParentDirect = client === "claude" && nativeParentDirectEnabled(),
+  nativeSlashCommands = client === "claude" && nativeSlashCommandsEnabled(),
+  nativeIntercept = client === "claude" && nativeInterceptEnabled(),
+  nativeInterceptTimeoutMs: interceptTimeoutMs = nativeIntercept ? nativeInterceptTimeoutMs() : null,
+  environment = process.env,
+  invocation = null,
   now = Date.now(),
   nativeAgentRunsRoot = path.join(CONFIG_DIR, "native-agent-runs"),
 }) {
   const agentsDir = path.join(root, "agents");
+  const commandsDir = path.join(root, "commands");
   for (const candidate of [root, agentsDir]) {
     if (fs.existsSync(candidate) && fs.lstatSync(candidate).isSymbolicLink()) {
       throw new Error(`refusing to use symlinked native-agent path ${candidate}`);
@@ -1319,7 +1749,16 @@ export function syncAgentProfile({
   privateDirectory(managedDir);
   const manifestPath = path.join(managedDir, MANAGED_AGENT_MANIFEST);
   const prior = readManifest(manifestPath);
-  const active = renderManagedAgents(client, tenantId, agents, null, { directCodeMode });
+  if ((nativeSlashCommands || prior?.commands?.length > 0)
+    && fs.existsSync(commandsDir)
+    && fs.lstatSync(commandsDir).isSymbolicLink()) {
+    throw new Error(`refusing to use symlinked native-agent path ${commandsDir}`);
+  }
+  const active = renderManagedAgents(client, tenantId, agents, invocation, {
+    directCodeMode,
+    nativeParentDirect,
+    environment,
+  });
   const activeBindings = new Set(active.map((agent) =>
     `${agent.agentId}\0${agent.scopeParam}\0${agent.policyFingerprint}`
   ));
@@ -1327,16 +1766,27 @@ export function syncAgentProfile({
     .filter((binding) => !activeBindings.has(
       `${binding.agentId}\0${binding.scopeParam}\0${binding.policyFingerprint}`,
     ));
-  const retired = renderRetiredManagedAgents(client, tenantId, retiredBindings, active, null, { directCodeMode });
+  const retired = renderRetiredManagedAgents(client, tenantId, retiredBindings, active, invocation, {
+    directCodeMode,
+    environment,
+  });
   const rendered = [...active, ...retired];
+  const commands = client === "claude" && nativeSlashCommands
+    ? renderManagedClaudeSlashCommands(tenantId, agents)
+    : [];
+  const renderedFiles = rendered.filter(({ fileName }) => typeof fileName === "string");
   if (new Set(rendered.map(({ name }) => name)).size !== rendered.length
-    || new Set(rendered.map(({ fileName }) => fileName)).size !== rendered.length
+    || new Set(renderedFiles.map(({ fileName }) => fileName)).size !== renderedFiles.length
     || (client === "codex" && directProfiles
       && new Set(rendered.map(({ profileFileName }) => profileFileName)).size !== rendered.length)) {
     throw new Error("generated native-agent destinations are not unique");
   }
+  if (new Set(commands.map(({ fileName }) => fileName)).size !== commands.length) {
+    throw new Error("generated native-agent slash command destinations are not unique");
+  }
   const priorFiles = new Set(prior?.files || []);
   const priorProfiles = new Set(prior?.profiles || []);
+  const priorCommands = new Set(prior?.commands || []);
   const priorUsesDiscoveryRoot = Number.isInteger(prior?.version)
     && prior.version >= 2
     && prior.version <= MANAGED_AGENT_MANIFEST_VERSION;
@@ -1362,14 +1812,16 @@ export function syncAgentProfile({
   // Preflight every destination before writing so an unmanaged file with the
   // same generated name is never overwritten.
   for (const agent of rendered) {
-    const destination = path.join(agentsDir, agent.fileName);
-    if (fs.existsSync(destination)) {
-      if (fs.lstatSync(destination).isSymbolicLink()) {
-        throw new Error(`refusing to overwrite symlinked native-agent file ${destination}`);
-      }
-      if ((!priorOwnsManagedFiles || !priorFiles.has(agent.fileName))
-        && !reclaimable(`agents/${agent.fileName}`, destination)) {
-        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
+    if (agent.fileName) {
+      const destination = path.join(agentsDir, agent.fileName);
+      if (fs.existsSync(destination)) {
+        if (fs.lstatSync(destination).isSymbolicLink()) {
+          throw new Error(`refusing to overwrite symlinked native-agent file ${destination}`);
+        }
+        if ((!priorOwnsManagedFiles || !priorFiles.has(agent.fileName))
+          && !reclaimable(`agents/${agent.fileName}`, destination)) {
+          throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
+        }
       }
     }
     if (client === "codex" && directProfiles) {
@@ -1385,11 +1837,34 @@ export function syncAgentProfile({
       }
     }
   }
+  for (const command of commands) {
+    const destination = path.join(commandsDir, command.fileName);
+    if (fs.existsSync(destination)) {
+      if (fs.lstatSync(destination).isSymbolicLink()) {
+        throw new Error(`refusing to overwrite symlinked native-agent slash command ${destination}`);
+      }
+      if ((!priorOwnsManagedFiles || !priorCommands.has(command.fileName))
+        && !reclaimable(`commands/${command.fileName}`, destination)) {
+        throw new Error(`refusing to overwrite unmanaged native-agent slash command ${destination}`);
+      }
+    }
+  }
+  const parentDirectPermissions = client === "claude"
+    ? syncClaudeParentDirectPermissions(
+      root,
+      parentDirectPermissionTools(rendered),
+      priorParentDirectPermissionGrants(prior, priorOwnsManagedFiles),
+    )
+    : null;
   for (const agent of rendered) {
-    atomicPrivateWrite(path.join(agentsDir, agent.fileName), agent.contents);
+    if (agent.fileName) atomicPrivateWrite(path.join(agentsDir, agent.fileName), agent.contents);
     if (client === "codex" && directProfiles) atomicPrivateWrite(path.join(root, agent.profileFileName), agent.profileContents);
   }
-  const currentFiles = new Set(rendered.map((agent) => agent.fileName));
+  for (const command of commands) {
+    atomicPrivateWrite(path.join(commandsDir, command.fileName), command.contents);
+  }
+  const currentFiles = new Set(renderedFiles.map((agent) => agent.fileName));
+  const currentCommands = new Set(commands.map((command) => command.fileName));
   const currentProfiles = new Set(client === "codex" && directProfiles
     ? rendered.map((agent) => agent.profileFileName)
     : []);
@@ -1422,6 +1897,15 @@ export function syncAgentProfile({
       fs.rmSync(path.join(root, stale), { force: true });
     }
   }
+  for (const stale of client === "claude" ? prior?.commands || [] : []) {
+    if (
+      staleRemovable(stale, `commands/${stale}`, path.join(commandsDir, stale))
+      && stale.endsWith(".md")
+      && !currentCommands.has(stale)
+    ) {
+      fs.rmSync(path.join(commandsDir, stale), { force: true });
+    }
+  }
   if (!priorUsesDiscoveryRoot) {
     for (const legacy of prior?.files || []) {
       if (
@@ -1433,20 +1917,45 @@ export function syncAgentProfile({
       }
     }
   }
+  if (client === "claude") {
+    ensureClaudeNativeInterceptHook(root, tenantId, {
+      enabled: nativeIntercept,
+      ...(nativeIntercept ? { timeoutMs: interceptTimeoutMs } : {}),
+    });
+  }
   const contentDigests = Object.fromEntries(rendered.flatMap((agent) => [
-    [`agents/${agent.fileName}`, contentDigest(agent.contents)],
+    ...(agent.fileName ? [[`agents/${agent.fileName}`, contentDigest(agent.contents)]] : []),
     ...(client === "codex" && directProfiles
       ? [[agent.profileFileName, contentDigest(agent.profileContents)]]
       : []),
-  ]).sort(([left], [right]) => left.localeCompare(right)));
+  ]).concat(commands.map((command) => [
+    `commands/${command.fileName}`,
+    contentDigest(command.contents),
+  ])).sort(([left], [right]) => left.localeCompare(right)));
+  const telemetryEnvironment = nativeAgentTelemetryEnvironment(environment);
+  const benchmark = nativeBenchmarkHeaderValue(environment);
   atomicPrivateWrite(manifestPath, `${JSON.stringify({
     version: MANAGED_AGENT_MANIFEST_VERSION,
     tenantId,
     client,
     directProfiles: client === "codex" && directProfiles,
     directCodeMode: client === "codex" && directCodeMode,
+    ...(client === "claude" && nativeParentDirect ? { nativeParentDirect: true } : {}),
+    ...(client === "claude" && parentDirectPermissions.length > 0 ? {
+      nativeParentDirectPermissionGrants: parentDirectPermissions,
+    } : {}),
+    ...(client === "claude" && nativeSlashCommands ? { nativeSlashCommands: true } : {}),
+    ...(client === "claude" && nativeIntercept ? {
+      nativeIntercept: true,
+      nativeInterceptTimeoutMs: interceptTimeoutMs,
+    } : {}),
+    ...(Object.keys(telemetryEnvironment).length > 0 ? {
+      nativeAgentTelemetryEnvironment: telemetryEnvironment,
+    } : {}),
+    ...(benchmark ? { nativeBenchmark: true } : {}),
     syncedAt: new Date(now).toISOString(),
     files: [...currentFiles].sort(),
+    ...(client === "claude" && nativeSlashCommands ? { commands: [...currentCommands].sort() } : {}),
     profiles: [...currentProfiles].sort(),
     contentDigests,
     agents: rendered.map((agent) => ({
@@ -1458,7 +1967,9 @@ export function syncAgentProfile({
       retired: agent.retired,
       name: agent.name,
       ...(client === "claude" ? {
-        launchDefinition: agent.launchDefinition,
+        ...(agent.parentLaunchDefinition
+          ? { launchMode: "parent-direct", parentLaunchDefinition: agent.parentLaunchDefinition }
+          : { launchDefinition: agent.launchDefinition }),
       } : {}),
       ...(client === "codex" && directProfiles ? {
         profileName: agent.profileName,
@@ -1474,6 +1985,7 @@ export function syncAgentProfile({
     count: active.length,
     recoveryCount: retired.length,
     files: [...currentFiles],
+    ...(client === "claude" && nativeSlashCommands ? { commands: [...currentCommands] } : {}),
     profiles: [...currentProfiles],
   };
 }