model-orchestrator 1.0.6 → 1.0.8

package/AGENTS.md

@@ -25,14 +25,19 @@ When using the Claude Code plugin, follow [plugin/README.md](plugin/README.md).
 
 ## Change this repository
 
-- **Read first:** `CONTRIBUTING.md`, `src/README.md` and `docs/security-review-history.md`.
+- **Read first:** `CONTRIBUTING.md`, `src/README.md`, `SECURITY.md` (security scope) and `docs/security-review-history.md`.
 - **Catalog:** when adding an AI or companion, edit `src/catalog.js`; keep templates free of logic.
 - **Templates:** when changing installed instructions, edit `templates/`. Use public terms: task brief, context file, acceptance checks, definition of done and result.
-- **Generated files:** run `npm run gen:catalog` after catalog changes and `npm run gen:plugin` after plugin-template changes. `test/plugin.test.js` checks the committed bundle.
+- **Generated files:** run `npm run gen:catalog` after catalog changes and `npm run gen:plugin` after plugin-template changes. `plugin/` is generated from `templates/`; only `plugin/README.md` and `plugin/hooks/hooks.json` are hand-owned. `test/plugin.test.js` fails on drift. Before a release, `claude plugin validate --strict plugin` must pass.
 - **Plugin safety:** hooks may only read and emit context. No network, file writes, subprocesses or credential access.
-- **Installer safety:** writes remain inside `--dir` and `--project`; preserve user edits according to manifest hashes and explicit flags. Run no third-party installer.
-- **Runner safety:** preserve exit codes and the log schema. Before changing an output judge, add a failing case in `test/judges.test.js`.
+- **Installer safety:** `bin/cli.js` writes only inside `--dir` and `--project`, refuses home-level agent configuration and runs no third-party installer or vendor script.
+- **Installer ownership:** existing documents stay unless `--force` replaces them or `--update-docs` verifies their recorded hash. Machine-owned configuration refreshes, unchanged managed runtime files upgrade, and `--upgrade-runtime` explicitly replaces runtime files. Project activation merges supported entries with backups. Preserve these rules; `test/install.test.js` and `test/cli.test.js` check them.
+- **Runner safety:** preserve exit codes and the log schema. `bin/cli-run.mjs` exits non-zero when a lane produced nothing. Every judge has a red case in `test/judges.test.js`; add one before changing a judge.
+- **Systemd:** when touching `templates/advanced/vm/jobs/`, run `test/systemd/run-on-ubuntu.sh` by hand on a Linux host with systemd to check `TimeoutStartSec` and `KillMode`. This check sits outside `npm test`; follow `test/systemd/README.md`.
+- **Fixtures:** `test/fixtures/` is real vendor output. When a vendor upgrade changes a shape, capture again at the new version and update `manifest.json` and the README compatibility table together.
 - **Secrets:** use environment-variable names only. Never add a credential value to code, examples or tests.
 - **Proof:** measure through `proof/scripts/`, store results in `proof/results.json` and regenerate the proof page. An expired entry warns and is re-measured; it never blocks tests or releases.
-- **Verify:** run `npm test` and report tests, pass, fail, skipped and exit code. The suite prints current counts. Use `npm pack --dry-run` to inspect publication contents.
+- **Verify:** before proposing a change, run `npm test` and report tests, pass, fail, skipped and exit code. The suite prints current counts. Use `npm pack --dry-run` to inspect publication contents.
 - **Style:** use short condition-to-action instructions and no em dashes. `test/prose.test.js` checks public vocabulary and examples.
+
+Each rule is the fix for a failure that reached an audit or CI. `CHANGELOG.md` names the issue behind each.

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project are documented here. The format follows [Kee
 
 ## [Unreleased]
 
+## [1.0.8] - 2026-09-30
+
+### Changed
+
+- AGENTS.md is the single source of agent instructions. CLAUDE.md imports it so Claude Code loads the same rules as every other agent.
+- Merge the contributor rules that had diverged between AGENTS.md and CLAUDE.md.
+- The feature request form asks for an observable success check.
+
+## [1.0.7] - 2026-09-30
+
+### Fixed
+
+- Prefer an already-connected Claude worker MCP service in host routing, with the native CLI retained as a standalone fallback. Route suggestions and generated instructions describe the session, result, permission and environment boundaries; no MCP installation or automatic transport retry is added.
+- Enable the native `claude` CLI worker with print-mode JSON completion checks, existing permission rules, model and effort overrides, failure classification and shared timeout/cancellation handling. Codex-primary stacks can assign independent review to Claude Code; Claude-primary stacks retain Codex review. Generated lanes use executable names while manifest AI identities retain installer IDs. Claude fixtures record native success and authentication failures.
+- Keep supported lanes usable when an edited or unverifiable older runner is kept during an upgrade. Withhold unsupported lanes and their defaults from `lanes.json`, and report how to enable them with `--upgrade-runtime`.
+- Classify Claude's expired OAuth session and `Failed to authenticate` errors as auth (exit 14).
+- Match Claude HTTP codes only in API status fields or `API Error:` prefixes, so a 400 error mentioning 429 tokens stays rejected (exit 16).
+
+### Changed
+
+- Check and pin the Claude lane at 2.1.285, and replace its hand-written success fixture with a captured restricted live success at that version.
+
 ## [1.0.6] - 2026-09-29
 
 ### Added
@@ -16,6 +38,10 @@ All notable changes to this project are documented here. The format follows [Kee
 - A hermes model/provider mismatch (an upstream "model is not supported" or `model_not_found`, for example `grok-4.6` sent to `openai-codex`) is now class `rejected`, exit 16, with a problem line naming the mismatch and a fix pointing at `hermes model`. It was reported as a vague nonzero exit.
 - A pinned hermes route (`--model` or `--effort`, by flag or `lanes.json` default) no longer fails every run. cli-run placed those flags between `-z` and the prompt, and `-z` takes the prompt as its value, so Hermes refused the arguments ("argument -z/--oneshot: expected one argument"). Route flags now come before `-z`, and a Hermes argument error is reported as such rather than as a toolsets error.
 
+### Changed
+
+- The product website generates public Markdown mirrors, llms discovery files and agent navigation guidance from its existing documentation allowlist on each Git build.
+
 ## [1.0.5] - 2026-09-28
 
 ### Changed
@@ -569,7 +595,10 @@ First release.
 - Tests: a case per fix, judges proven to go red, mutation checks; `npm test` prints the current count.
 - Adversarial audit: two Codex rounds plus a two-engine review (Codex, Antigravity); findings and fixes in `docs/audit-brief.md`. After the review: subagents go to the project root (`--project`), snippet paths computed from `--dir`, lane sections rendered from the selection, a primary agent required, level 3 asks for API keys separately from CLIs, images and CLI installs pinned, an activation summary at the end of every install.
 
-[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.5...HEAD
+[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.8...HEAD
+[1.0.8]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.7...v1.0.8
+[1.0.7]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.6...v1.0.7
+[1.0.6]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.5...v1.0.6
 [1.0.5]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.4...v1.0.5
 [1.0.4]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.2...v1.0.3

package/README.md

@@ -175,6 +175,8 @@ It helps an agent match a task to a model, effort level and toolset. Run `npx mo
 
 Run `npx model-orchestrator --yes --level 2 --ais claude-code,codex --primary claude-code --project . --dir ./ai-orchestrator`, then follow the activation summary. Claude Code can dispatch scoped work through `aunx cli-run codex --brief TASK_BRIEF.md` and use a different model family for review.
 
+For Codex as the main agent, set `--primary codex`. Independent review goes to Claude Code through a connected Claude worker MCP service when the host has one, or through `aunx cli-run claude --brief TASK_BRIEF.md`. The `claude` lane runs in `dontAsk` mode, so calls needing approval are denied; `--audit` stays Codex-only.
+
 ### How do I reduce Claude Code token usage?
 
 Install routing rules with `npx model-orchestrator`, so your agent has guidance for sending routine work to cheaper models and keeping reads scoped. Use `aunx route-metrics --summary` to measure where your work goes; savings depend on your tasks and model choices.
@@ -233,7 +235,7 @@ The lane wiring and the output judges were written against these versions, which
 
 | Lane | Vendor | Version this release was built against | Where that number is proved |
 |---|---|---|---|
-| `claude` | Anthropic | 2.1.226 | the npm pin the installer writes, `@anthropic-ai/claude-code@2.1.226` |
+| `claude` | Anthropic | 2.1.285 | `test/fixtures/claude-2.1.285-success.json`, a recorded run |
 | `codex` | OpenAI | 0.153.4 | `test/fixtures/codex-0.153.4.jsonl`, a recorded run |
 | `agy` | Google | 1.1.27 | `test/fixtures/agy-1.1.27.jsonl`, a recorded run |
 | `grok` | xAI | 1.0.5 | `test/fixtures/grok-1.0.5.json`, a recorded run |
@@ -241,12 +243,14 @@ The lane wiring and the output judges were written against these versions, which
 | `qwen` | Alibaba | 0.22.3 | `test/fixtures/qwen-0.22.3-nokey.json`, a recorded run |
 | `ollama` | Ollama | 0.34.4 | the pinned image the level 3 box runs, `ollama/ollama:0.34.4` |
 
-Generated from `src/catalog.js` by `npm run gen:catalog`; `npm test` fails if this table and the catalog disagree. Fixtures were captured 2026-09-06.
+Generated from `src/catalog.js` by `npm run gen:catalog`; `npm test` fails if this table and the catalog disagree. Original vendor fixtures were captured 2026-09-06; [fixture provenance](test/fixtures/README.md) records later captures and remaining gaps.
 
 <!-- vendor-table:end -->
 
 For npm-installed lanes, `builtAgainst` in the catalog supplies both the compatibility table and the install pin. Newer vendor versions may work or may change a flag the generated wiring uses. When a lane starts failing after a vendor upgrade, compare against this table first.
 
+The `claude` lane is checked against recorded Claude Code 2.1.285 runs: a restricted success, a sign-in failure and an expired-session failure.
+
 **The live canary runs on your machine, with your credentials.** That is what `aunx cli-run --doctor --run` (direct form: `node bin/cli-run.mjs --doctor --run`) is: it sends every enabled lane one tiny prompt through your own sign-ins and reports `canary ok` or `canary FAILED rc=` per lane. Choose this optional live check after setup or a vendor upgrade when you want to verify actual responses.
 
 CI runs the full suite against stub lanes on Ubuntu, macOS and Windows, Node 18/20/22, plus a packaged install into a clean consumer. Run the live check locally to verify your own sign-ins, quota and vendor versions.
@@ -267,6 +271,7 @@ Run `npm test` with your change. Keep templates free of logic and credential val
 ## Credits
 
 - [@shawnwows](https://x.com/shawnwows) reviewed the router and made the case for separating role, complexity and stakes instead of compressing them into one scale, for recording the model and effort a lane was actually asked for, and for verifying findings before they trigger repairs. All three shipped in 0.1.14.
+- [@shawnbissell](https://github.com/shawnbissell) added the native Claude Code worker lane (print-mode JSON judge, failure classes, dontAsk permissions) and the connected-MCP preference for Claude workers.
 
 ## License
 

package/bin/cli-run.mjs

@@ -15,6 +15,7 @@
 // NATIVE terminal event and refuses to call an empty run a success.
 //
 //   grok    --output-format json        -> stopReason == "end_turn" and text non-empty
+//   claude  -p --output-format json     -> result subtype success, is_error false, result non-empty
 //   codex   exec --json --color never -o F -> terminal {"type":"turn.completed"} and F non-empty
 //   agy     --output-format stream-json -> terminal {"event":"result"} status SUCCESS, response non-empty
 //   hermes  -z                          -> its exit code is already honest (0 ok / 1 none / 2 bad args)
@@ -59,10 +60,8 @@
 // silently stops being the route that runs. --model / --effort pin it per call,
 // `defaults` in lanes.json pins it per lane, and every run logs the value that
 // was REQUESTED plus where the request came from (flag, lanes.json, or nothing
-// at all). It does not log an "actual". One lane of five (grok) does report a
-// model id in its own output; the other four report none, and a field present
-// for one lane, and absent for four, is worse than no field. It would also be a
-// provider-supplied string, which this log deliberately never holds.
+// at all). It does not log an "actual": model reporting varies by CLI and is
+// provider-supplied text, which this log deliberately never holds.
 
 import { spawn, spawnSync } from 'node:child_process';
 import { StringDecoder } from 'node:string_decoder';
@@ -72,7 +71,7 @@ import { join, dirname, delimiter, resolve, relative, isAbsolute, sep } from 'no
 import { tmpdir, homedir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-export const LANES = ['grok', 'codex', 'agy', 'hermes', 'qwen'];
+export const LANES = ['grok', 'codex', 'agy', 'hermes', 'qwen', 'claude'];
 export const OK = 0, NO_DELIVERABLE = 10, NO_OUTPUT = 11, TIMEOUT = 12, UNAVAILABLE = 13, USAGE = 2;
 export const AUTH = 14, QUOTA = 15, REJECTED = 16, REFUSED = 17, CUT_SHORT = 18;
 
@@ -161,6 +160,31 @@ function lastJsonLine(out, needle, want) {
 const fail = (reason, detail) => ({ text: null, reason, detail });
 const pass = (text, detail) => ({ text, reason: 'ok', detail });
 
+// Print-mode JSON is one result object, not the stream-json event sequence.
+// Source: https://code.claude.com/docs/en/headless and /en/agent-sdk/agent-loop.
+function claudeResultObject(out) {
+  try {
+    const o = JSON.parse(out);
+    return isObj(o) && o.type === 'result' ? o : null;
+  } catch { return null; }
+}
+
+export function judgeClaude(rc, out) {
+  let o;
+  try { o = JSON.parse(out); } catch { return fail('not_json', 'stdout was not JSON'); }
+  if (!isObj(o) || o.type !== 'result') return fail('not_result', 'JSON was not a result object');
+  if (o.subtype !== 'success') return fail('bad_subtype', 'result did not report successful completion');
+  if (o.is_error !== false) return fail('is_error', 'result did not report is_error=false');
+  if (o.errors !== undefined) {
+    if (!Array.isArray(o.errors) || !o.errors.every(e => typeof e === 'string')) return fail('error_message_not_string', 'errors was not an array of strings');
+    if (o.errors.length) return fail('is_error', 'result carried execution errors');
+  }
+  if (o.stop_reason != null && !['end_turn', 'stop_sequence', 'refusal'].includes(o.stop_reason)) return fail('bad_stop_reason', 'result stopped before completing a response');
+  if (typeof o.result !== 'string') return fail('result_not_string', 'result was not a string');
+  const text = o.result.trim();
+  return text ? pass(text, 'subtype=success, is_error=false') : fail('empty_result', 'success but empty result');
+}
+
 export function judgeGrok(rc, out) {
   let o;
   try {
@@ -256,6 +280,7 @@ export function judgeQwen(rc, out) {
 // CLI's own --help, not remembered. A lane with `effort: null` has no reasoning
 // flag at all; asking for one there is a usage error, never a silent drop.
 //   grok    -m MODEL   --reasoning-effort EFFORT
+//   claude  --model M  --effort EFFORT
 //   codex   -m MODEL   -c model_reasoning_effort="EFFORT"   (a TOML override, hence the quotes)
 //   agy     --model M  --effort EFFORT                      (low|medium|high)
 //   hermes  -m MODEL   --reasoning LEVEL   --provider ID    (none|minimal|...)
@@ -265,6 +290,7 @@ export function judgeQwen(rc, out) {
 // (grok-4.6 on openai-codex). `hermes -z --provider` without a model exits 2,
 // so cli-run refuses that pairing before the lane starts.
 export const LANE_FLAGS = {
+  claude: { model: (v) => ['--model', v], effort: (v) => ['--effort', v], provider: null },
   grok: { model: (v) => ['-m', v], effort: (v) => ['--reasoning-effort', v], provider: null },
   codex: { model: (v) => ['-m', v], effort: (v) => ['-c', `model_reasoning_effort="${v}"`], provider: null },
   agy: { model: (v) => ['--model', v], effort: (v) => ['--effort', v], provider: null },
@@ -275,6 +301,7 @@ export const LANE_FLAGS = {
 // Auto is deliberately a small, static ladder. It is not a vendor capability
 // probe and it never chooses the top of a vendor's effort range.
 export const AUTO_EFFORT = {
+  claude: { small: 'medium', large: 'high' },
   codex: { small: 'medium', large: 'high' },
   grok: { small: 'medium', large: 'high' },
   agy: { small: 'medium', large: 'high' },
@@ -381,6 +408,11 @@ export function buildArgv(lane, binary, prompt, opts, tmp) {
   const timeout = opts.timeout;
   const route = routeFlags(lane, opts);
   switch (lane) {
+    case 'claude':
+      // dontAsk denies calls needing approval and retains configured allow/deny
+      // rules. It grants no new permissions and is not a filesystem sandbox.
+      // -- ends option parsing so even a brief starting with a dash is data.
+      return { argv: [binary, '-p', '--output-format', 'json', '--permission-mode', 'dontAsk', ...route, '--', prompt] };
     case 'grok':
       return { argv: [binary, '--output-format', 'json', ...route, '-p', prompt] };
     case 'codex': {
@@ -410,6 +442,8 @@ export function buildArgv(lane, binary, prompt, opts, tmp) {
 
 export function judge(lane, rc, out, err, outFile) {
   switch (lane) {
+    case 'claude':
+      return judgeClaude(rc, out);
     case 'grok':
       return judgeGrok(rc, out);
     case 'codex':
@@ -581,7 +615,19 @@ export function qwenErrorText(out) {
   return parts.join('\n');
 }
 
+// Only native failure fields are authoritative. A successful model answer
+// mentioning login, quota or permissions must never become an error signal.
+export function claudeErrorText(out) {
+  const o = claudeResultObject(out);
+  if (!o) return '';
+  const parts = Array.isArray(o.errors) ? o.errors.filter(e => typeof e === 'string') : [];
+  if (o.is_error === true && typeof o.result === 'string') parts.push(o.result);
+  if (Number.isInteger(o.api_error_status)) parts.push(`api_error_status=${o.api_error_status}`);
+  return parts.join('\n');
+}
+
 function authoritativeBlob(lane, out, err, detail, rc) {
+  if (lane === 'claude') return `${claudeErrorText(out)}\n${err || ''}`;
   if (lane === 'codex') return `${codexErrorEventsText(out)}\n${err || ''}`;
   if (lane === 'agy') return `${agyResultFieldsText(out)}\n${err || ''}`;
   if (lane === 'hermes') return rc !== 0 ? `${err || ''}\n${hermesMismatchLine(out, { vendorShape: true }) || ''}` : '';
@@ -591,6 +637,7 @@ function authoritativeBlob(lane, out, err, detail, rc) {
 
 export function sigAuth(lane, blob) {
   const b = blob.toLowerCase();
+  if (lane === 'claude') return /authentication_error|permission_error|invalid api key|not logged in|please run \/login|failed to authenticate|oauth (?:token|session).*expired|api_error_status=(?:401|403)|api error: (?:401|403)\b/.test(b);
   if (lane === 'qwen') return b.includes('missing api key');
   if (lane === 'agy') return b.includes('you are not logged into antigravity') || b.includes('not authenticated');
   return false; // codex, grok, hermes: no documented native auth signal
@@ -598,6 +645,7 @@ export function sigAuth(lane, blob) {
 
 export function sigQuota(lane, blob) {
   const b = blob.toLowerCase();
+  if (lane === 'claude') return /rate_limit_error|rate limit|insufficient credits|credit balance|you['’]ve hit your limit|api_error_status=429|api error: 429\b/.test(b);
   if (lane === 'qwen') return b.includes('[api error: 402') || b.includes('requires more credits') || blob.includes(' 429') || b.includes('rate limit');
   if (lane === 'codex') return blob.includes('usage_limit_exceeded') || b.includes("you've hit your usage limit");
   if (lane === 'hermes') return hermesQuotaText(b);
@@ -606,6 +654,7 @@ export function sigQuota(lane, blob) {
 
 export function sigRejected(lane, blob) {
   const b = blob.toLowerCase();
+  if (lane === 'claude') return /invalid_request_error|unknown option|invalid (?:model|effort)|api_error_status=400|api error: 400\b/.test(b);
   if (lane === 'qwen') return b.includes('[api error: 400') || b.includes('no endpoints found') || b.includes('failed to parse grammar');
   if (lane === 'codex') return blob.includes('invalid_request_error');
   if (lane === 'hermes') return hermesArgError(b) || b.includes('toolset') || hermesMismatchLine(blob) !== null;
@@ -615,6 +664,7 @@ export function sigRejected(lane, blob) {
 // Which judge reasons mean the lane never reached a trustworthy finish, as
 // opposed to finishing cleanly with nothing in it (class empty).
 const CUT_SHORT_REASONS = {
+  claude: new Set(['not_json', 'not_result', 'bad_subtype', 'is_error', 'bad_stop_reason', 'result_not_string', 'error_message_not_string']),
   grok: new Set(['not_json', 'bad_stop_reason']),
   codex: new Set(['no_terminal_event']),
   agy: new Set(['no_terminal_event', 'bad_last_event']),
@@ -740,6 +790,10 @@ export function refusedGrok(out, { root = process.env.CLI_RUN_GROK_SESSIONS_ROOT
 
 export function countRefused(lane, out, err, opts) {
   try {
+    if (lane === 'claude') {
+      const pd = claudeResultObject(out)?.permission_denials;
+      return Array.isArray(pd) ? pd.length : null;
+    }
     if (lane === 'qwen') return refusedQwen(out);
     if (lane === 'agy') return refusedAgy(out);
     if (lane === 'codex') return refusedCodex(out, err);
@@ -1211,7 +1265,8 @@ export async function doctor(run, { here = dirname(fileURLToPath(import.meta.url
   const { enabled, defaults } = cfg;
   let bad = 0;
   if (!compact) console.log(`doctor: ${enabled.length} enabled lane(s): ${enabled.join(', ') || 'none'}`);
-  if (!compact && primary && !enabled.includes(primary)) console.log(`  note: ${primary} is the main agent and is not an executable lane`);
+  const primaryLane = primary === 'claude-code' ? 'claude' : primary;
+  if (!compact && primary && !enabled.includes(primaryLane)) console.log(`  note: ${primary} is the main agent and is not an executable lane`);
   if (!enabled.length) {
     if (compact) {
       console.log('doctor: no executable lanes enabled.');
@@ -1445,6 +1500,7 @@ export async function main(argv) {
     if (!opts.quiet) {
       console.error(`cli-run[${lane}] ${verdict} rc=${code} class=${cls} refused=${refused === null ? 'null' : refused} ${r.seconds.toFixed(1)}s raw=${r.outBytes || 0}B route=${routeNote} :: ${redact(detail)}`);
       let authoritative = null;
+      if (lane === 'claude' && ['auth', 'quota', 'rejected'].includes(cls)) authoritative = stderrHead(claudeErrorText(out) || err);
       if (lane === 'codex' && (cls === 'quota' || cls === 'rejected')) authoritative = codexPrimaryError(out);
       const pf = problemAndFix(lane, cls, { out, err, detail, refused, authoritative });
       if (pf.problem) console.error('cli-run problem: ' + redact(pf.problem).slice(0, 600));

package/bin/cli.js

@@ -498,6 +498,7 @@ async function main() {
         for (const path of preview.written) console.log('  would write ' + path);
         for (const path of [...preview.skipped, ...preview.conflicts, ...preview.unverifiable, ...preview.docsConflict, ...preview.docsUnverifiable]) console.log('  would keep ' + path);
         for (const path of preview.backups) console.log('  would back up ' + path);
+        if (preview.lanesWithheld.length) console.log(`  lanes withheld: ${preview.lanesWithheld.join(', ')} (the kept bin/cli-run.mjs predates them; re-run with --upgrade-runtime to enable)`);
       }
       console.log('\n--dry: nothing written.');
       rl && rl.close();
@@ -548,9 +549,9 @@ async function main() {
         .concat(JSON.stringify(prev.roles || {}) !== JSON.stringify(plannedManifest.roles || {}) ? ['roles'] : [])
     : [];
 
-  let written, skipped, upgraded, conflicts, unverifiable, docsUpdated, docsConflict, docsUnverifiable, docsRenamed;
+  let written, skipped, upgraded, conflicts, unverifiable, lanesWithheld, docsUpdated, docsConflict, docsUnverifiable, docsRenamed;
   try {
-    ({ written, skipped, upgraded, conflicts, unverifiable, docsUpdated, docsConflict, docsUnverifiable, docsRenamed } = writeFiles(files, { dir, project, force: flag('force'), upgradeRuntime: flag('upgrade-runtime'), updateDocs: flag('update-docs'), prevManifest: prev, backupExisting: applySnippets, onBackup: (path) => console.log('  backup ' + path) }));
+    ({ written, skipped, upgraded, conflicts, unverifiable, lanesWithheld, docsUpdated, docsConflict, docsUnverifiable, docsRenamed } = writeFiles(files, { dir, project, force: flag('force'), upgradeRuntime: flag('upgrade-runtime'), updateDocs: flag('update-docs'), prevManifest: prev, backupExisting: applySnippets, onBackup: (path) => console.log('  backup ' + path) }));
   } catch (e) {
     if (e && e.code === 'PREFLIGHT') bad(e.message);
     throw e;
@@ -564,10 +565,11 @@ async function main() {
     if (prev) {
       if (changed.length) {
         console.log(`  selection changed: ${changed.join(', ')}`);
-        console.log(`  applied: ${ownedWritten.join(', ') || 'nothing'} (machine-owned files are always rewritten, so the new lanes are live)`);
+        console.log(`  applied: ${ownedWritten.join(', ') || 'nothing'} (machine-owned files are always rewritten)`);
         if (changed.includes('roles')) console.log('  the role assignment changed; MANIFEST.json and aunx route are current. Any kept documents may still carry the previous assignment.');
       } else console.log('  selection identical.');
     }
+    if (lanesWithheld.length) console.log(`  lanes withheld: ${lanesWithheld.join(', ')} (the kept bin/cli-run.mjs predates them; re-run with --upgrade-runtime to enable)`);
     if (upgraded.length) console.log(`  runtime upgraded: ${upgraded.join(', ')} ${flag('upgrade-runtime') ? '(--upgrade-runtime: replaced whether or not you had edited them)' : '(each installed copy matched the hash of a previous run, so nobody had edited it)'}`);
     if (conflicts.length) {
       console.log(`  runtime CONFLICT, kept: ${conflicts.join(', ')}`);

package/docs/catalog.md

@@ -16,14 +16,15 @@ Generated from `src/catalog.js`. Do not hand-edit; `npm run gen:catalog` rewrite
 
 - **Kind:** agent-cli · **Billing:** subscription · **Level:** 1+
 - **What it is:** Anthropic's terminal coding agent; its subagents load the project rules file
-- **Install:** `npm install -g @anthropic-ai/claude-code@2.1.226`
+- **Install:** `npm install -g @anthropic-ai/claude-code@2.1.285`
 - **Sign in:** run `claude` once and sign in with your Anthropic account
 - **Reads rules from:** `CLAUDE.md` · subagents in `.claude/agents/`
+- **cli-run lane:** yes
 - **Plans:**
   - Claude Pro (base headroom, checked 2026-09-12; tier models: unverified): https://claude.com/pricing
   - Claude Max 5x (high headroom, checked 2026-09-12; tier models: unverified): https://claude.com/pricing
   - Claude Max 20x (max headroom, checked 2026-09-12; tier models: unverified): https://claude.com/pricing
-- **Built against:** 2.1.226 (the same number the npm pin uses)
+- **Built against:** 2.1.285 (the same number the npm pin uses)
 
 **Capability facts.** An unverified value needs a current capability check before use. Role assignments come from the selected stack, using these facts.
 
@@ -34,7 +35,7 @@ Generated from `src/catalog.js`. Do not hand-edit; `npm run gen:catalog` rewrite
 | `billing` | subscription |
 | `pricing` | unverified |
 | `headless` | yes |
-| `cliRun` | no |
+| `cliRun` | yes |
 | `writesFiles` | yes |
 | `readOnlyMode` | no |
 | `liveWeb` | yes |

package/docs/security-review-history.md

@@ -6,6 +6,8 @@ This page summarizes completed reviews recorded in the [changelog](../CHANGELOG.
 
 | Release | Review recorded | What the review found | What changed and where it is checked |
 |---|---|---|---|
+| 1.0.7 | Review of external PR 48 (native Claude Code lane) by a second model family, then one audit of the fix diff | An upgrade that kept an edited older runner could disable every lane; an expired Claude sign-in read as cut short; a bare HTTP number in an error could pick the wrong class | Kept runners withhold lanes they do not list; expired-session and status-anchored Claude signals; captured 2.1.285 fixtures; `test/install.test.js`, `test/classify.test.js`, `test/cli.test.js` |
+| 1.0.6 | Pre-release review of the hermes provider route by a second model family, one round | Hermes stdout could print raw terminal control characters in a failure line; agent prose on stdout and an unrelated quota word could be misclassified; one provider test could not fail; route flags placed after `-z` broke every pinned hermes run | Control characters stripped, stdout matched only in the vendor's error shape, the mismatch checked before quota, route flags moved before `-z`; `test/classify.test.js`, `test/judges.test.js`, `test/cli.test.js` |
 | 1.0.2 | Independent review of 1.0.1 by a second model family, then an audit of its fix | A detached check descendant outlived the timeout while the notes said descendants stop; a symlinked-manifest refusal named no file or fix; refusal paths could carry terminal escapes; a directory got symlink advice | The protocol states the process-group limit; refusals name the path, escape control characters and give advice by file type; `test/security-messages.test.js` |
 | 1.0.1 | Codex Security scan and regression-backed remediation | A metrics summary executed project code; manifest reads and check descendants needed bounds; weekly jobs inherited gateway credentials | Packaged metrics dispatch, bounded file readers, check process-tree cleanup, stdin-only gateway probe and separate audit environment; `test/security-cli.test.js`, `test/security-vm.test.js`, `test/security-pins.test.js` |
 | 0.1.0 | Initial review and follow-up round, with a second model-family review | Paths could escape the write roots, partial writes could remain, malformed arguments could proceed, and empty results could appear successful | Containment preflight, exclusive writes with rollback, strict flag parsing and vendor-specific result checks; `test/install.test.js`, `test/cli.test.js`, `test/judges.test.js` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "model-orchestrator",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Model router for AI coding agents: installs routing rules, 8 subagents, hooks and a CLI runner so your AI picks model and effort per task and saves tokens",
   "type": "module",
   "bin": {

package/proof/README.md

@@ -2,14 +2,14 @@
 
 Generated from [results.json](results.json). Each figure has a method, sample size, measurement date and expiry. Run the scripts on your own machine to compare.
 
-Environment: Node v22.22.3, darwin arm64. Timing varies with startup caches and other work on the machine. Synthetic cases show what those fixtures exercise.
+Environment: Node v22.23.2, linux x64. Timing varies with startup caches and other work on the machine. Synthetic cases show what those fixtures exercise.
 
 | Measurement | Result | Sample size | Measured | Expires | Reproduce |
 |---|---|---|---|---|---|
-| Dry install wall time | 42.22 ms median | 7 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/install-time.js) |
-| Lane runner overhead | 63.74 ms median difference | 7 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/runner-overhead.js) |
-| Empty results flagged | 10 fixtures rejected | 10 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/missing-results.js) |
-| Acceptance failures blocked | 4 fixtures rejected | 4 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/check-gate.js) |
+| Dry install wall time | 61.59 ms median | 7 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/install-time.js) |
+| Lane runner overhead | 60.27 ms median difference | 7 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/runner-overhead.js) |
+| Empty results flagged | 10 fixtures rejected | 10 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/missing-results.js) |
+| Acceptance failures blocked | 4 fixtures rejected | 4 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/check-gate.js) |
 
 ## Run the proof scripts
 
@@ -40,7 +40,7 @@ The [recording script](scripts/record-gate.js) captures real command output into
 
 Spawn a fresh Node installer process per sample; level 2, Claude Code + Codex, no companions, --dry. Includes Node startup and planning; writes no install files. Isolated home and PATH, no real vendors.
 
-Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/install-time.js](../proof/scripts/install-time.js).
 
@@ -48,7 +48,7 @@ Source: [proof/scripts/install-time.js](../proof/scripts/install-time.js).
 
 Paired fresh processes: direct Node stub versus cli-run hermes with the same stub. Alternates pair order. Includes wrapper startup, validation and local log writes; excludes vendor/network/model time.
 
-Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/runner-overhead.js](../proof/scripts/runner-overhead.js).
 
@@ -56,7 +56,7 @@ Source: [proof/scripts/runner-overhead.js](../proof/scripts/runner-overhead.js).
 
 Run cli-run against an exit-0 stub for every supported lane, once with empty stdout and once with an empty native final result. Count exit 10/11 only. A successful Hermes response is the positive control. Synthetic fixtures measure these shapes only.
 
-Kind: reproducible local measurement. Sample size: 10. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 10. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/missing-results.js](../proof/scripts/missing-results.js).
 
@@ -64,7 +64,7 @@ Source: [proof/scripts/missing-results.js](../proof/scripts/missing-results.js).
 
 Run aunx checks run against nonzero, manual, missing-program and timeout fixtures. Each must exit 1; a passing command must exit 0. This is a local command gate, activated by the user in their release sequence.
 
-Kind: reproducible local measurement. Sample size: 4. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 4. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/check-gate.js](../proof/scripts/check-gate.js).
 

package/proof/results.json

@@ -1,78 +1,78 @@
 {
   "schemaVersion": 1,
   "environment": {
-    "node": "v22.22.3",
-    "platform": "darwin",
-    "arch": "arm64"
+    "node": "v22.23.2",
+    "platform": "linux",
+    "arch": "x64"
   },
   "entries": [
     {
       "id": "install-dry-ms",
       "label": "Dry install wall time",
       "kind": "reproducible",
-      "value": 42.220875,
+      "value": 61.594306,
       "unit": "ms median",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Spawn a fresh Node installer process per sample; level 2, Claude Code + Codex, no companions, --dry. Includes Node startup and planning; writes no install files. Isolated home and PATH, no real vendors.",
       "sampleSize": 7,
       "script": "proof/scripts/install-time.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "samples": [
-        51.577042,
-        48.655542,
-        46.568834,
-        42.220875,
-        41.573667,
-        39.881333,
-        40.983417
+        72.998866,
+        61.594306,
+        63.307248,
+        60.59507,
+        61.218156,
+        66.993599,
+        61.070192
       ]
     },
     {
       "id": "runner-overhead-ms",
       "label": "Lane runner overhead",
       "kind": "reproducible",
-      "value": 63.742250999999996,
+      "value": 60.27329300000001,
       "unit": "ms median difference",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Paired fresh processes: direct Node stub versus cli-run hermes with the same stub. Alternates pair order. Includes wrapper startup, validation and local log writes; excludes vendor/network/model time.",
       "sampleSize": 7,
       "script": "proof/scripts/runner-overhead.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "pairs": [
         {
-          "directMs": 26.925375,
-          "wrappedMs": 409.562,
-          "overheadMs": 382.63662500000004
+          "directMs": 27.602021,
+          "wrappedMs": 89.562129,
+          "overheadMs": 61.960108
         },
         {
-          "directMs": 28.554875,
-          "wrappedMs": 95.06725,
-          "overheadMs": 66.512375
+          "directMs": 26.453384,
+          "wrappedMs": 85.145791,
+          "overheadMs": 58.692407
         },
         {
-          "directMs": 28.981666,
-          "wrappedMs": 94.610209,
-          "overheadMs": 65.628543
+          "directMs": 26.104555,
+          "wrappedMs": 91.019659,
+          "overheadMs": 64.915104
         },
         {
-          "directMs": 26.295583,
-          "wrappedMs": 86.161958,
-          "overheadMs": 59.866375
+          "directMs": 24.351936,
+          "wrappedMs": 84.625229,
+          "overheadMs": 60.27329300000001
         },
         {
-          "directMs": 28.71575,
-          "wrappedMs": 82.585583,
-          "overheadMs": 53.869833
+          "directMs": 27.307321,
+          "wrappedMs": 86.025276,
+          "overheadMs": 58.717955
         },
         {
-          "directMs": 26.668791,
-          "wrappedMs": 90.411042,
-          "overheadMs": 63.742250999999996
+          "directMs": 26.203506,
+          "wrappedMs": 84.365333,
+          "overheadMs": 58.161827
         },
         {
-          "directMs": 34.081333,
-          "wrappedMs": 82.568041,
-          "overheadMs": 48.48670799999999
+          "directMs": 26.328261,
+          "wrappedMs": 86.629325,
+          "overheadMs": 60.301064
         }
       ]
     },
@@ -82,11 +82,11 @@
       "kind": "reproducible",
       "value": 10,
       "unit": "fixtures rejected",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Run cli-run against an exit-0 stub for every supported lane, once with empty stdout and once with an empty native final result. Count exit 10/11 only. A successful Hermes response is the positive control. Synthetic fixtures measure these shapes only.",
       "sampleSize": 10,
       "script": "proof/scripts/missing-results.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "outcomes": [
         {
           "lane": "grok",
@@ -146,11 +146,11 @@
       "kind": "reproducible",
       "value": 4,
       "unit": "fixtures rejected",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Run aunx checks run against nonzero, manual, missing-program and timeout fixtures. Each must exit 1; a passing command must exit 0. This is a local command gate, activated by the user in their release sequence.",
       "sampleSize": 4,
       "script": "proof/scripts/check-gate.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "outcomes": [
         {
           "fixture": "nonzero",

package/src/aunx.js

@@ -205,6 +205,9 @@ function stackSuggestion(assignment) {
   if (assignment.command) via = '`' + clean(assignment.command.startsWith('cli-run ') ? `aunx ${assignment.command}` : assignment.command) + '`';
   else if (assignment.agent) via = '`' + clean(assignment.agent) + '` on your main agent';
   else via = { 'main-agent': 'your main agent', local: 'your local runtime', manual: 'manual handoff', subagent: 'a subagent', 'cli-run': 'cli-run' }[assignment.via];
+  if (assignment.ai === 'claude-code' && assignment.via === 'cli-run' && assignment.command === 'cli-run claude' && assignment.preferredTransport === 'mcp') {
+    via = `connected Claude worker MCP when available; fallback ${via}`;
+  }
   return `Your stack: ${name}, via ${via || 'your selected tool'}${reason ? ` (${clean(reason)})` : ''}.`;
 }
 

package/src/catalog.js

@@ -71,7 +71,7 @@ export const AIS = [
       billing: 'subscription',
       pricing: null, // UNVERIFIED: check your provider's current rate.
       headless: true,
-      cliRun: false,
+      cliRun: true,
       writesFiles: true,
       readOnlyMode: false,
       liveWeb: true, // Source: templates/agents/claude-code/live-researcher.md grants WebSearch and WebFetch.
@@ -93,8 +93,8 @@ export const AIS = [
     bin: 'claude',
     summary: 'Anthropic\'s terminal coding agent; its subagents load the project rules file',
     minLevel: 1,
-    install: { npm: '@anthropic-ai/claude-code', url: 'https://code.claude.com/docs/en/setup', pin: '2.1.226' },
-    builtAgainst: '2.1.226',
+    install: { npm: '@anthropic-ai/claude-code', url: 'https://code.claude.com/docs/en/setup', pin: '2.1.285' },
+    builtAgainst: '2.1.285',
     auth: 'run `claude` once and sign in with your Anthropic account',
     // Positive-only (Q1): an author-machine probe of a working, authenticated
     // session (2026-09-27) still returned {"loggedIn":false} with exit 1, so a

package/src/install.js

@@ -70,7 +70,7 @@ export function lanesTable(selected, plans = {}, primary = inferPrimary(selected
     a.facts.billing,
     summaryWithEvidence(a),
     Object.entries(roles).filter(([, role]) => role.ai === a.id).map(([id]) => id).join(', ') || 'none',
-    a.facts.cliRun ? '`cli-run ' + a.id + '`' : a.bin ? '`' + a.bin + '`' : 'the app',
+    a.facts.cliRun ? '`cli-run ' + a.bin + '`' : a.bin ? '`' + a.bin + '`' : 'the app',
     plans[a.id] ? `${plans[a.id].name} (${plans[a.id].headroom} headroom)` : 'not stated'
   ]);
   return table(rows, ['AI', 'Lane', 'What it is', 'Assigned roles', 'Call it with', 'Plan']);
@@ -180,7 +180,7 @@ export function dirProblems(dir) {
 export function auditLane(selected, primary = selected[0]) {
   const { roles } = assignRoles({ selected, primary });
   const id = roles.review.ai ?? roles.bulk.ai ?? null;
-  return selected.some(a => a.id === id && a.facts.cliRun) ? id : null;
+  return selected.find(a => a.id === id && a.facts.cliRun)?.bin || null;
 }
 
 function stackContext(selected, primary, detected = new Set()) {
@@ -558,7 +558,7 @@ function vars(opts) {
   const assignment = assignRoles({ selected, primary, detected: opts.detected, plans });
   const stack = stackContext(selected, primary, opts.detected);
   const enabled = selected.filter(a => a.facts.cliRun);
-  const exampleLane = enabled[0]?.id || '<lane>';
+  const exampleLane = enabled[0]?.bin || '<lane>';
   const exampleDefaults = { model: '<model-id>', ...(LANE_FLAGS[exampleLane]?.effort ? { effort: 'high' } : {}) };
   const auditExample = enabled.find(a => a.facts.readOnlyMode);
   const fallbackNote = 'When no separate lane qualifies, your main agent carries the job at its stated tier. Independent review and local-only work require an eligible lane.';
@@ -634,8 +634,8 @@ function vars(opts) {
     EXAMPLE_LANE: exampleLane,
     EXAMPLE_EFFORT_FLAGS: LANE_FLAGS[exampleLane]?.effort ? ' --effort high' : '',
     EXAMPLE_AUDIT_LANE: auditExample?.id || '',
-    EXAMPLE_AUDIT_BLOCK: auditExample ? `When reviewing with an available read-only mode, select its audit shape:\n\n\x60\x60\x60bash\naunx cli-run ${auditExample.id} --audit --brief REVIEW.md\nnode bin/cli-run.mjs ${auditExample.id} --audit --brief REVIEW.md\n\x60\x60\x60` : 'When reviewing, verify the chosen lane permissions and request review-only work.',
-    EXAMPLE_LANES_JSON: JSON.stringify({ enabled: enabled.map(a => a.id), defaults: { [exampleLane]: exampleDefaults } }, null, 2),
+    EXAMPLE_AUDIT_BLOCK: auditExample ? `When reviewing with an available read-only mode, select its audit shape:\n\n\x60\x60\x60bash\naunx cli-run ${auditExample.bin} --audit --brief REVIEW.md\nnode bin/cli-run.mjs ${auditExample.bin} --audit --brief REVIEW.md\n\x60\x60\x60` : 'When reviewing, verify the chosen lane permissions and request review-only work.',
+    EXAMPLE_LANES_JSON: JSON.stringify({ enabled: enabled.map(a => a.bin), defaults: { [exampleLane]: exampleDefaults } }, null, 2),
     // Renders only when Qwen is actually selected: the sentence names a flag
     // that is a usage error on every other lane (C1).
     QWEN_SAFE_MODE_NOTE: selected.some(a => a.id === 'qwen') ? "When Qwen's safe mode is required, pass `--safe-mode` to that lane. " : '',
@@ -686,8 +686,8 @@ function vars(opts) {
     AUDIT_LANE: lane || 'none',
     // Enforced boundary per lane: codex has a read-only sandbox flag; the others
     // run with whatever their own config allows, and the script says so.
-    AUDIT_LANE_FLAGS: selected.find(a => a.id === lane)?.facts.readOnlyMode ? '--audit' : '',
-    AUDIT_LANE_BOUNDARY_NOTE: selected.find(a => a.id === lane)?.facts.readOnlyMode
+    AUDIT_LANE_FLAGS: selected.find(a => a.bin === lane)?.facts.readOnlyMode ? '--audit' : '',
+    AUDIT_LANE_BOUNDARY_NOTE: selected.find(a => a.bin === lane)?.facts.readOnlyMode
       ? `${lane} --audit, a read-only filesystem sandbox; commands and network follow the ${lane} config`
       : lane
         ? `${lane} offers no sandbox flag cli-run can pass, so the denied-actions list is instruction-level only and enforcement is whatever ${lane}'s own permission config allows`
@@ -714,7 +714,10 @@ function vars(opts) {
     LANES_TABLE: lanesTable(selected, plans, primary),
     PLAN_GUIDANCE: planGuidance(selected, plans),
     INSTALL_TABLE: installTable(selected),
-    CLI_RUN_LANES: selected.filter((a) => a.facts.cliRun).map((a) => a.id).join(', ') || 'none selected',
+    CLI_RUN_LANES: selected.filter((a) => a.facts.cliRun).map((a) => a.bin).join(', ') || 'none selected',
+    CLAUDE_WORKER_TRANSPORT: Object.values(assignment.roles).some(role => role.ai === 'claude-code' && role.via === 'cli-run')
+      ? '- When assigning a Claude Code worker, prefer a connected Claude worker MCP service exposed in the host tool catalog. Call its tools directly from the host, follow its session and permission workflow, and preserve the task scope. See `CLI-RUN.md` for dispatch and fallback boundaries.\n'
+      : '',
     GATEWAY_MODELS: gatewayModels(selected, apis),
     ENV_NAMES: envNames(selected, apis).map((n) => '- `' + n + '`').join('\n'),
     ENV_EXPORTS: envNames(selected, apis).map((n) => n + '=').join('\n'),
@@ -820,10 +823,10 @@ export function planFiles(opts) {
       join('bin', 'lanes.json'),
       JSON.stringify(
         {
-          enabled: selected.filter((a) => a.facts.cliRun).map((a) => a.id),
-          defaults: Object.fromEntries((opts.effortAuto || []).map((lane) => [lane, { effort: 'auto' }])),
+          enabled: selected.filter((a) => a.facts.cliRun).map((a) => a.bin),
+          defaults: Object.fromEntries((opts.effortAuto || []).map((id) => [selected.find(a => a.id === id)?.bin || id, { effort: 'auto' }])),
           note: 'Lanes cli-run may call. Edit to enable or disable a lane. A lane not listed here exits 13 (unavailable).',
-          defaultsNote: 'Pin what a lane runs with, so the route in your docs is the route that runs: "defaults": {"' + (selected.find(a => a.facts.cliRun)?.id || '<lane>') + '": ' + JSON.stringify({ model: '<model-id>', ...(LANE_FLAGS[selected.find(a => a.facts.cliRun)?.id]?.effort ? { effort: 'high' } : {}) }) + '}. Left empty, a lane inherits its own config file, which cli-run cannot see and does not guess. `--model` and `--effort` override this per call, and `--doctor` prints what each lane is pinned to. Every enabled lane takes a model; the runner reports which lanes support an effort flag. Hermes also takes "provider" beside "model", so the model goes to a provider that serves it.'
+          defaultsNote: 'Pin what a lane runs with, so the route in your docs is the route that runs: "defaults": {"' + (selected.find(a => a.facts.cliRun)?.bin || '<lane>') + '": ' + JSON.stringify({ model: '<model-id>', ...(LANE_FLAGS[selected.find(a => a.facts.cliRun)?.bin]?.effort ? { effort: 'high' } : {}) }) + '}. Left empty, a lane inherits its own config file, which cli-run cannot see and does not guess. `--model` and `--effort` override this per call, and `--doctor` prints what each lane is pinned to. Every enabled lane takes a model; the runner reports which lanes support an effort flag. Hermes also takes "provider" beside "model", so the model goes to a provider that serves it.'
         },
         null,
         2
@@ -1117,6 +1120,8 @@ export function writeFiles(files, opts) {
   const upgraded = [];      // runtime files replaced because the installed copy was an untouched generated one
   const conflicts = [];     // runtime files kept because the installed copy differs from what we generated
   const unverifiable = [];  // runtime files kept because there is no manifest to compare against
+  const lanesWithheld = []; // selected lanes the kept runner does not support
+  let lanesHash;
   const docsUpdated = [];   // --update-docs: documents regenerated because the installed copy was an untouched generated one
   const docsConflict = [];  // --update-docs: documents kept because you edited them
   const docsUnverifiable = []; // --update-docs: documents kept because there is no manifest to compare against
@@ -1206,6 +1211,24 @@ export function writeFiles(files, opts) {
           }
         }
         let content = f.content;
+        if (k === 'dir' && key === 'bin/lanes.json' && keptKeys.has('bin/cli-run.mjs')) {
+          // planFiles puts the runner first, so its keep decision is known here.
+          let supported;
+          try {
+            const match = readFileSync(join(root, 'bin', 'cli-run.mjs'), 'utf8').match(/^\s*export const LANES = \[([\s\S]*?)\];/m);
+            if (match && /^\s*(?:(?:'[^'\\]*'|"[^"\\]*")\s*(?:,\s*(?:'[^'\\]*'|"[^"\\]*")\s*)*,?\s*)?$/.test(match[1])) {
+              supported = [...match[1].matchAll(/'([^'\\]*)'|"([^"\\]*)"/g)].map(m => m[1] ?? m[2]);
+            }
+          } catch { /* unknown runner contents are not evidence of unsupported lanes */ }
+          if (supported) {
+            const lanes = JSON.parse(content);
+            lanesWithheld.push(...new Set([...lanes.enabled, ...Object.keys(lanes.defaults || {})].filter(lane => !supported.includes(lane))));
+            lanes.enabled = lanes.enabled.filter(lane => supported.includes(lane));
+            if (lanes.defaults) lanes.defaults = Object.fromEntries(Object.entries(lanes.defaults).filter(([lane]) => supported.includes(lane)));
+            content = JSON.stringify(lanes, null, 2) + '\n';
+            lanesHash = sha256(content);
+          }
+        }
         if (f.rel === 'MANIFEST.json') {
           if (hasLegacy) {
             const previousHash = prevHashes?.[LEGACY_BRIEF];
@@ -1239,6 +1262,7 @@ export function writeFiles(files, opts) {
           // formerly selected files, so uninstall still checks their original
           // installed hashes. New defaults do not erase a previous selection.
           m.files = { ...prevHashes, ...m.files };
+          if (lanesHash) m.files['bin/lanes.json'] = lanesHash;
           if (Object.keys(activation).length) m.activation = activation;
           for (const removed of removedKeys) delete m.files[removed];
           for (const kk of Object.keys(m.files || {})) {
@@ -1304,7 +1328,7 @@ export function writeFiles(files, opts) {
     }
     throw e;
   }
-  return { written, skipped, upgraded, conflicts, unverifiable, docsUpdated, docsConflict, docsUnverifiable, docsRenamed, backups };
+  return { written, skipped, upgraded, conflicts, unverifiable, lanesWithheld, docsUpdated, docsConflict, docsUnverifiable, docsRenamed, backups };
 }
 
 export function resolveSelection(ids) {

package/src/postinstall.js

@@ -50,7 +50,7 @@ export async function installHealthCheck({ level, selected, primary, dir }) {
   // runner in the target directory. Only its data configuration is read.
   const rc = await doctor(false, {
     here: join(dir, 'bin'), primary: primary?.id, compact: true,
-    ...(level < 2 ? { config: { enabled: selected.filter(ai => ai.facts.cliRun).map(ai => ai.id), defaults: {} } } : {})
+    ...(level < 2 ? { config: { enabled: selected.filter(ai => ai.facts.cliRun).map(ai => ai.bin), defaults: {} } } : {})
   });
   if (rc && rc !== 10 && rc !== 13) console.log(`  doctor could not read the installed lane configuration (exit ${rc}).`);
   return rc;

package/src/roles.js

@@ -136,7 +136,10 @@ export function roleRoute(roleId, assignment, { selected = [], primary = null, a
   if (role.ai === null) {
     out.reason = role.why;
   } else if (role.via === 'cli-run' && ai?.facts.cliRun === true) {
-    out.command = `cli-run ${ai.id}${['review', 'verify'].includes(roleId) && ai.facts.readOnlyMode === true ? ' --audit' : ''}`;
+    out.command = `cli-run ${ai.bin}${['review', 'verify'].includes(roleId) && ai.facts.readOnlyMode === true ? ' --audit' : ''}`;
+    // The host knows its connected tools. The standalone CLI command remains
+    // usable without an MCP installation; it cannot call host-owned tools.
+    if (ai.id === 'claude-code') out.preferredTransport = 'mcp';
   } else if (role.ai === primary?.id && primary.facts.agentDefinitions && agents[roleId]) {
     out.agent = agents[roleId];
   }
@@ -151,6 +154,7 @@ export function roleHow(role, { selected = [], primary = null } = {}) {
   if (role.ai === null) return role.reason?.startsWith('Nothing in your stack') ? 'keep it off every lane here' : 'fresh-context self-check on your main agent';
   const ai = selected.find((item) => item.id === role.ai);
   const tier = `${role.tier} tier`;
+  if (role.preferredTransport === 'mcp') return `connected Claude worker MCP when available; fallback \`aunx ${role.command}\`, ${tier}`;
   if (role.command) return `\`aunx ${role.command}\`, ${tier}`;
   if (role.via === 'local') return `${ai?.bin ? `\`${ai.bin}\`` : 'local runtime'} on your machine, ${tier}`;
   if (ai?.facts.kind === 'chat') return `paste the work into your ${role.ai === primary?.id ? 'main agent' : 'chat app'}, ${tier}`;

package/templates/advanced/vm/ENVIRONMENT.md

@@ -18,7 +18,7 @@ The audit script builds an explicit allowed environment with shell builtins befo
 
 The allowed runtime names are `HOME`, `PATH`, `USER`, `LOGNAME`, `SHELL`; `LANG`, `LANGUAGE`, `TZ`; `LC_ALL`, `LC_CTYPE`, `LC_COLLATE`, `LC_MESSAGES`, `LC_MONETARY`, `LC_NUMERIC`, `LC_TIME`, `LC_ADDRESS`, `LC_IDENTIFICATION`, `LC_MEASUREMENT`, `LC_NAME`, `LC_PAPER`, `LC_TELEPHONE`; `TMPDIR`, `TMP`, `TEMP`; `XDG_CONFIG_HOME`, `XDG_DATA_HOME`, `XDG_STATE_HOME`, `XDG_CACHE_HOME`, `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS`; and the Windows shell runtime names `SystemRoot`, `SYSTEMROOT`, `WINDIR`. User-service access and stored sign-ins use those same locations.
 
-Only the selected report worker additionally receives its location override: `CODEX_HOME` for `codex`, `HERMES_HOME` for `hermes`. These names are removed from collection/version probes. `agy`, `grok` and `qwen` use stored sign-ins in the common user/configuration locations, with no additional exported authentication name. Configure the selected vendor's sign-in in the systemd user's account, such as `hermes auth add <provider>` for Hermes. API-only setups that depend on exported provider keys need vendor-supported stored authentication before this job can run. Claude Code is not a cli-run worker in this catalog, so its session-token export is removed as well.
+Only the selected report worker additionally receives its location override: `CODEX_HOME` for `codex`, `HERMES_HOME` for `hermes`. These names are removed from collection/version probes. `claude`, `agy`, `grok` and `qwen` must use stored sign-ins in the common user/configuration locations, with no additional exported authentication name. Configure the selected vendor's sign-in in the systemd user's account, such as `hermes auth add <provider>` for Hermes. Setups that depend on exported provider keys or session tokens need vendor-supported stored authentication before this job can run. `CLAUDE_CODE_OAUTH_TOKEN` remains excluded by the same boundary as other token variables.
 
 `PROBE_SECS` and `RUNNER_SECS` remain shell-only deadline overrides. Set documented runtime and location overrides in the service's `Environment=` settings or audit-only environment file. The key and any selected worker settings stay out of command arguments and logs. There is no arbitrary variable pass-through option.
 

package/templates/advanced/vm/jobs/README.md

@@ -34,7 +34,7 @@ Sign the selected vendor CLI in under the same user before enabling the timer. B
 | User service and keyring session | `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS` |
 | Windows shell runtime compatibility | `SystemRoot`, `SYSTEMROOT`, `WINDIR` |
 
-The report worker additionally receives `CODEX_HOME` when the selected worker is `codex`, or `HERMES_HOME` when it is `hermes`, if that name was set. These location overrides are absent from collection and version probes. The `agy`, `grok` and `qwen` workers use their stored sign-ins under the common user/configuration directories. No token or provider-key variable is allowed for any current worker; `CLAUDE_CODE_OAUTH_TOKEN` is also removed because Claude Code is not a supported cli-run worker in this catalog. Configure authentication with the selected vendor's sign-in flow, such as `codex login`, `grok login`, `hermes auth add <provider>`, `agy`, or Qwen's `/auth`.
+The report worker additionally receives `CODEX_HOME` when the selected worker is `codex`, or `HERMES_HOME` when it is `hermes`, if that name was set. These location overrides are absent from collection and version probes. The `claude`, `agy`, `grok` and `qwen` workers must use stored sign-ins under the common user/configuration directories. No token or provider-key variable is allowed for any current worker, including `CLAUDE_CODE_OAUTH_TOKEN`. Configure authentication with the selected vendor's sign-in flow, such as `claude`, `codex login`, `grok login`, `hermes auth add <provider>`, `agy`, or Qwen's `/auth`.
 
 `GATEWAY_MASTER_KEY` stays in a private shell variable until the stdin probe finishes and is then removed. `PROBE_SECS` and `RUNNER_SECS` override the shell's deadlines without becoming child exports. Configure the allowed names and worker location overrides through the service's `Environment=` settings or its audit-only environment file. Keep that file limited to the gateway key and the documented runtime/location settings; keep provider credentials in the gateway launch environment. The script provides no arbitrary extra-variable override.
 

package/templates/intermediate/CLI-RUN.md

@@ -6,6 +6,14 @@ Enabled lanes (edit `bin/lanes.json`): {{CLI_RUN_LANES}}.
 
 ## Call a lane with a task brief
 
+- When Claude Code is assigned and a Claude worker MCP service is connected, prefer it. Inspect its schema and instructions, then call its tools from the host. Runner subprocesses cannot access the host's connected tools. The manifest's `preferredTransport: "mcp"` records the preference and `command` gives the CLI fallback; `aunx route` reports it without discovering or invoking servers.
+- When starting an MCP session, send the scoped brief and project directory, keep the session ID and cursor, and poll as the service directs until the final result. Verify acceptance checks, handle errors and cancel on the task deadline or user cancellation. A start response or idle session alone is not proof of success.
+- For either transport, preserve the caller's permissions and project scope. Do not auto-approve tools, broaden paths, add credentials or change authentication. Answer permission requests within existing authorization and deny requests outside it; keep review requests review-only. Check the MCP server's environment against the task's access limits, even when it differs from the command sandbox.
+- When selecting MCP options, leave the model unset unless the task or lane defaults select it; translate effort and other defaults only when the service supports them.
+- When a compatible service is absent, use the native CLI in an authorized environment with its existing sign-in. After either transport fails, report the cause before switching; do not retry automatically through the other transport. Use CLI doctor for CLI presence and optional canaries only; check MCP availability and authentication through the host.
+
+Anthropic's built-in [`claude mcp serve`](https://code.claude.com/docs/en/mcp#use-claude-code-as-an-mcp-server) exposes tools; it does not by itself establish a Claude agent-review service.
+
 ```bash
 aunx cli-run {{EXAMPLE_LANE}} --brief TASK_BRIEF.md --timeout 900
 node bin/cli-run.mjs {{EXAMPLE_LANE}} --brief TASK_BRIEF.md --timeout 900
@@ -56,6 +64,7 @@ The runner supports these lanes whether or not you selected them.
 
 | Lane | Invocation built | Accepted response |
 |---|---|---|
+| claude | `-p --output-format json --permission-mode dontAsk` | result object, `subtype == "success"`, `is_error == false`, non-empty `result`, no execution errors or truncated stop reason |
 | grok | `--output-format json -p` | `stopReason == "end_turn"` and non-empty `text` |
 | codex | `exec --json --color never --skip-git-repo-check -o FILE` | terminal `turn.completed` event and non-empty output file |
 | agy | `--print-timeout Nm --output-format stream-json -p` | terminal `result` event, `status == "SUCCESS"`, non-empty `response` |
@@ -64,6 +73,10 @@ The runner supports these lanes whether or not you selected them.
 
 When Qwen's error telemetry is absent, the runner refuses the response. These checks distinguish response structure from successful task execution.
 
+Select Claude Code with installer ID `claude-code`; use `aunx cli-run claude` for its executable fallback. The native adapter needs the Claude CLI and its existing authentication, independently of optional MCP companions. It uses [Anthropic's print-mode JSON result](https://code.claude.com/docs/en/headless) and [result completion states](https://code.claude.com/docs/en/agent-sdk/agent-loop).
+
+Claude runs with [the `dontAsk` permission mode](https://code.claude.com/docs/en/permissions): calls needing approval are denied, while existing allow rules and actions needing no approval still apply. The runner grants no additional tools or permissions. This is not a read-only filesystem sandbox; `--audit` remains Codex-only. Claude's `permission_denials` counts blocked tools; a non-empty completed answer with denials is accepted with a warning, while no answer with denials exits 17. Authentication or account-access errors exit 14. Error subtypes, malformed JSON and truncated responses exit 18 unless a more specific native error identifies the cause.
+
 ## Respond to the exit class
 
 | Code | Class | Action |
@@ -99,6 +112,7 @@ The runner supports these lanes whether or not you selected them.
 
 | Lane | Model flag | Effort flag | Provider flag |
 |---|---|---|---|
+| claude | `--model` | `--effort` | Unsupported |
 | grok | `-m` | `--reasoning-effort` | Unsupported |
 | codex | `-m` | `-c model_reasoning_effort="LEVEL"` | Unsupported |
 | agy | `--model` | `--effort` | Unsupported |
@@ -111,7 +125,7 @@ When using `--effort auto`, treat its medium/high selection as a bounded heurist
 
 ## Preserve permissions and secrets
 
-The runner never adds permission flags. Keep each vendor's permissions in its own configuration and route work within the task's granted scope. A denied write becomes a handoff to an authorized writer.
+The runner grants no additional permissions. Claude uses `dontAsk` to deny calls needing approval; Codex `--audit` requests a read-only filesystem sandbox. Keep each vendor's permissions in its own configuration and route work within the task's granted scope. A denied write becomes a handoff to an authorized writer.
 
 Prompts travel in argv, which other processes may inspect. Never put secrets in a prompt. For large task inputs, give the worker a brief with authorized source paths instead of exceeding the operating system's argument-size limit.
 

package/templates/intermediate/ROUTING.md

@@ -58,6 +58,7 @@ When work runs in the background, check liveness and output growth every five mi
 
 ## Tools and fallbacks
 
+{{CLAUDE_WORKER_TRANSPORT}}
 - When reporting consequential arithmetic or code equivalence, use a computing tool (`protocols/numbers-and-logic.md`). codecalc: {{CODECALC_STATUS}}. When absent, use the local runtime, test suite or spreadsheet.{{METERED_CITATION_NOTE}}
 - When writing durable records, search first, update the index and keep one writer (`protocols/memory-and-record.md`). obsidian-tc: {{OBSIDIAN_TC_STATUS}}. When absent, use project files, search and version control.
 - When using a changing library or API, read current documentation and verify behavior (`protocols/docs-then-prove.md`). Context7: {{CONTEXT7_STATUS}}. When absent, read official docs or installed source; use the local runtime when codecalc is absent.