moshcode 0.32.0 → 0.33.0

package/src/cli-schema.mjs

@@ -20,6 +20,7 @@
  */
 export const COMMAND_GROUPS = [
   { key: "engines", title: "engines" },
+  { key: "runtime", title: "runtime" },
   { key: "tools", title: "tools" },
   { key: "extend", title: "extend" },
   { key: "script", title: "script" },
@@ -53,9 +54,92 @@ export const CORE_CLI_COMMANDS = [
     name: "start",
     group: "engines",
     description: "launch an engine with its native defaults",
-    synopsis: [["moshcode start <engine> [args…]", "no bypass flags, no agent view"]],
-    examples: [["moshcode start opencode", ""]],
-    seeAlso: ["agents", "engines"],
+    synopsis: [
+      ["moshcode start <engine> [args…]", "no bypass flags, no agent view"],
+      ["moshcode start <engine> --detach", "run it in the herd and keep your prompt"],
+    ],
+    flags: [
+      ["--detach, -d", "start in the herd instead of taking this terminal", ""],
+      ["--name <slug>", "name the herd session (implies --detach)", "<engine>-<dir>"],
+    ],
+    examples: [
+      ["moshcode start opencode", ""],
+      ["moshcode start claude --name api-refactor", "runs in the background; moshcode ps to see it"],
+    ],
+    seeAlso: ["agents", "engines", "herd", "ps"],
+  },
+  {
+    name: "herd",
+    group: "runtime",
+    description: "run agent sessions that outlive this terminal",
+    synopsis: [
+      ["moshcode herd", "the roster — same as moshcode ps"],
+      ["moshcode herd <verb> [args…]", "drive one session"],
+    ],
+    verbs: "HERD_VERBS",
+    flags: [["--json", "machine-readable, on every verb", ""]],
+    examples: [
+      ["moshcode herd start claude --name api", "start one and get your prompt back"],
+      ["moshcode herd prompt api \"run the tests\" --wait", "hand it work and block until it lands"],
+      ["moshcode herd read api --lines 40", "read its screen without attaching"],
+    ],
+    seeAlso: ["ps", "attach", "wait", "restore", "start"],
+    note: "sessions live in a tmux server moshcode owns, or under script(1) when there is no tmux. with neither, launches stay in the foreground and say so.",
+  },
+  {
+    name: "ps",
+    group: "runtime",
+    description: "list herd sessions and what each one is doing",
+    synopsis: [["moshcode ps [--json]", "name, engine, state, cwd, age"]],
+    flags: [["--json", "machine-readable", ""]],
+    examples: [["moshcode ps", "which agent is blocked?"]],
+    seeAlso: ["herd", "attach", "wait"],
+    note: "state is idle, working, blocked, done or unknown — unknown is a safe answer, not a failure.",
+  },
+  {
+    name: "attach",
+    group: "runtime",
+    description: "attach this terminal to a herd session",
+    synopsis: [["moshcode attach <name>", "detach again with Ctrl-b d (or Ctrl-] without tmux)"]],
+    examples: [["moshcode attach api", ""]],
+    seeAlso: ["ps", "herd", "kill"],
+    note: "detaching leaves the session running. ending it is `moshcode kill`.",
+  },
+  {
+    name: "kill",
+    group: "runtime",
+    description: "end a herd session",
+    synopsis: [["moshcode kill <name…> | --all", ""]],
+    flags: [["--all", "end every session in the herd", ""]],
+    examples: [["moshcode kill api", ""]],
+    seeAlso: ["ps", "herd", "attach"],
+  },
+  {
+    name: "wait",
+    group: "runtime",
+    description: "block until a session is blocked, done, or idle",
+    synopsis: [["moshcode wait <name> [--state blocked,done] [--timeout 30m]", ""]],
+    flags: [
+      ["--state <list>", "states to wait for, comma-separated", "blocked,done"],
+      ["--timeout <dur>", "give up after this long (30s, 10m, 2h)", "30m"],
+      ["--json", "machine-readable", ""],
+    ],
+    examples: [["moshcode wait api --state blocked --timeout 1h", "exit 0 matched · 2 timed out · 3 gone"]],
+    seeAlso: ["herd", "ps"],
+    note: "exit codes are the point: 0 matched, 2 timed out, 3 no such session.",
+  },
+  {
+    name: "restore",
+    group: "runtime",
+    description: "rebuild the herd's sessions after a reboot",
+    synopsis: [["moshcode restore [--resume] [--dry-run]", ""]],
+    flags: [
+      ["--resume", "ask each engine to reopen its own last conversation", ""],
+      ["--dry-run", "say what would come back, change nothing", ""],
+    ],
+    examples: [["moshcode restore --dry-run", ""]],
+    seeAlso: ["herd", "ps"],
+    note: "this brings back the shape — sessions, directories, engines. the processes are new; work that was in flight is not still running.",
   },
   {
     name: "install",
@@ -197,6 +281,7 @@ export const CORE_CLI_COMMANDS = [
       ["--port <n>", "port for the bridge", "5354"],
       ["--registry <url>", "registry to resolve against", "https://pit.moshcode.sh"],
       ["--no-trust", "with enable: route names but skip the local CA", ""],
+      ["--no-proxy", "with enable: answer origins rather than the local proxy", ""],
     ],
     examples: [
       ["sudo moshcode dns enable", "route Moshpit endings here"],
@@ -620,7 +705,70 @@ export const PLUGIN_VERBS = [
 ];
 
 /** Sub-verb tables, by the name a command's `verbs` field refers to. */
+export const HERD_VERBS = [
+  { name: "ps", description: "the roster: every session and its state",
+    synopsis: [["moshcode herd ps [--json]", ""]],
+    flags: [["--json", "machine-readable", ""]] },
+  { name: "status", description: "what the herd is running on, and how many sessions",
+    synopsis: [["moshcode herd status [--json]", ""]],
+    flags: [["--json", "machine-readable", ""]] },
+  { name: "start", description: "start a session and hand the prompt back",
+    synopsis: [["moshcode herd start <engine> [--name <slug>] [--agent] [args…]", ""]],
+    flags: [
+      ["--name <slug>", "session name", "<engine>-<dir>"],
+      ["--cwd <dir>", "where to run it", "this directory"],
+      ["--agent", "autonomous mode — bypasses the engine's approvals", ""],
+      ["--json", "machine-readable", ""],
+    ] },
+  { name: "attach", description: "put this terminal inside a session",
+    synopsis: [["moshcode herd attach <name>", ""]] },
+  { name: "kill", description: "end a session",
+    synopsis: [["moshcode herd kill <name…> | --all", ""]],
+    flags: [["--all", "every session", ""]] },
+  { name: "prune", description: "forget sessions the runtime no longer has",
+    synopsis: [["moshcode herd prune", "never ends anything that is running"]] },
+  { name: "read", description: "read a session's screen without attaching",
+    synopsis: [["moshcode herd read <name> [--lines N]", ""]],
+    flags: [["--lines <n>", "how much of the screen", "60"], ["--json", "machine-readable", ""]] },
+  { name: "prompt", description: "type a prompt into a session",
+    synopsis: [['moshcode herd prompt <name> "<text>" [--wait]', ""]],
+    flags: [
+      ["--wait", "block until the session stops working", ""],
+      ["--timeout <dur>", "give up waiting after this long", "30m"],
+      ["--json", "machine-readable", ""],
+    ] },
+  { name: "send-keys", description: "send raw keys (Enter, Escape, C-c, literal text)",
+    synopsis: [["moshcode herd send-keys <name> <keys…>", ""]] },
+  { name: "wait", description: "block until a session reaches a state",
+    synopsis: [["moshcode herd wait <name> [--state blocked,done]", ""]],
+    flags: [
+      ["--state <list>", "states to wait for", "blocked,done"],
+      ["--timeout <dur>", "give up after this long", "30m"],
+      ["--json", "machine-readable", ""],
+    ] },
+  { name: "restore", description: "rebuild remembered sessions after a reboot",
+    synopsis: [["moshcode herd restore [--resume] [--dry-run]", ""]],
+    flags: [["--resume", "reopen each engine's last conversation", ""], ["--dry-run", "change nothing", ""]] },
+  { name: "report", description: "record an authoritative state (for engine hooks)",
+    synopsis: [["moshcode herd report <name> <state> [--ttl 15m]", ""]],
+    flags: [["--ttl <dur>", "how long the report stays authoritative", "15m"]] },
+  { name: "notify", description: "page the operator when a session blocks",
+    synopsis: [["moshcode herd notify <on|off|status> [--state blocked,done] [--ask]", ""]],
+    flags: [
+      ["--state <list>", "which transitions are worth a notification", "blocked"],
+      ["--ask", "wait for a reply and type it into the session", ""],
+      ["--no-ask", "notify only; never wait for a reply", ""],
+    ] },
+  { name: "watch", description: "deliver those notifications (run it inside the herd)",
+    synopsis: [["moshcode herd watch [--interval 5s]", ""]],
+    flags: [["--interval <dur>", "how often to look", "5s"], ["--force", "watch even with notifications off", ""]] },
+  { name: "stop", description: "stop the whole runtime and everything in it",
+    synopsis: [["moshcode herd stop --yes", ""]],
+    flags: [["--yes, -y", "required when sessions are running", ""]] },
+];
+
 export const VERB_TABLES = {
+  HERD_VERBS,
   MCP_VERBS,
   SKILL_VERBS,
   UPGRADE_TARGETS,
@@ -651,6 +799,18 @@ export const PIT_COMMANDS = [
     description: "list engines, or launch one autonomously" },
   { name: "start", args: "<engine> [args…]", cli: "start",
     description: "raw launch; inject no engine arguments" },
+  { name: "herd", args: "[verb] [args…]", cli: "herd",
+    description: "sessions that keep running when you leave" },
+  { name: "ps", cli: "ps",
+    description: "what the herd is running, and which one wants you" },
+  { name: "attach", args: "<name>", cli: "attach",
+    description: "step into a herd session (detach leaves it running)" },
+  { name: "kill", args: "<name…>", cli: "kill",
+    description: "end a herd session" },
+  { name: "wait", args: "<name> [--state …]", cli: "wait",
+    description: "block until a session is blocked or done" },
+  { name: "restore", args: "[--resume]", cli: "restore",
+    description: "rebuild the herd's sessions after a reboot" },
   { name: "tools", args: "[name] [args…]", cli: "tools",
     description: "list workflow tools, or run one" },
   { name: "trade", args: "<verb> [args…]", cli: "trade",

package/src/commands.mjs

@@ -18,6 +18,8 @@ import { spawn, spawnSync } from "node:child_process";
 import { createRegistry } from "./registry.mjs";
 import { cliVerb, aiVerb } from "./cli.mjs";
 import { ingestApproval, pollApproval } from "./notify.mjs";
+import { capture, killSession, sendPrompt } from "./herd.mjs";
+import { herdStart, roster, waitFor } from "./herd-cli.mjs";
 
 // The moshcoding pit-anthem playlist. mosh() blasts this URL and, on a desktop
 // with a GUI, tries to open it in the default browser.
@@ -221,6 +223,103 @@ const COMMANDS = [
     },
   },
 
+  // The herd (PRD 0009 R12). These are local rather than cliVerbs on purpose:
+  // a cliVerb returns { ok, code }, and the whole reason a script wants the
+  // herd is to fan work out and then read what came back. `herdRead()` has to
+  // hand back a string and `herdList()` an array, which shelling out cannot do.
+  //
+  //   const a = herdStart("claude", { name: "api" });
+  //   const b = herdStart("codex",  { name: "web" });
+  //   herdPrompt("api", "port the auth routes");
+  //   herdPrompt("web", "port the dashboard");
+  //   await herdWait("api"); await herdWait("web");   // both, in parallel
+  //   say(herdRead("api", { lines: 20 }));
+  {
+    name: "herdStart",
+    summary: "start an agent session that outlives this script",
+    usage: 'herdStart(engine, { name, cwd, agent })',
+    detail: "returns { ok, name }; the session keeps running after the script ends",
+    run(ctx, engine, opts = {}) {
+      if (!engine) throw new Error("moshscript: herdStart(engine) requires an engine name");
+      const argv = [String(engine), "--json"];
+      if (opts.name) argv.push("--name", String(opts.name));
+      if (opts.cwd) argv.push("--cwd", String(opts.cwd));
+      if (opts.agent) argv.push("--agent");
+      if (ctx.dryRun) {
+        ctx.out(`  🐑 herdStart(${engine}) → would run: moshcode herd start ${argv.join(" ")}`);
+        return { ok: true, name: opts.name || String(engine), dryRun: true };
+      }
+      let captured = "";
+      const code = herdStart(argv, { write: (s) => { captured += `${s}\n`; } });
+      if (code !== 0) { ctx.out(`  ✗ herdStart(${engine}) → ${captured.trim()}`); return { ok: false, name: null }; }
+      const name = JSON.parse(captured).name;
+      ctx.out(`  🐑 herdStart(${engine}) → ${name}`);
+      return { ok: true, name };
+    },
+  },
+  {
+    name: "herdPrompt",
+    summary: "type a prompt into a herd session",
+    usage: "herdPrompt(name, text)",
+    detail: "returns { ok }; does not wait — use herdWait() to join",
+    run(ctx, name, ...words) {
+      const text = words.join(" ");
+      if (!name || !text) throw new Error("moshscript: herdPrompt(name, text) requires both");
+      if (ctx.dryRun) { ctx.out(`  💬 herdPrompt(${name}) → would send: ${text}`); return { ok: true, dryRun: true }; }
+      ctx.out(`  💬 herdPrompt(${name}) → ${text.slice(0, 60)}${text.length > 60 ? "…" : ""}`);
+      const sent = sendPrompt(String(name), text);
+      return { ok: Boolean(sent.ok) };
+    },
+  },
+  {
+    name: "herdWait",
+    summary: "BLOCK until a herd session is blocked, done, or idle",
+    usage: "herdWait(name, { states, timeout })",
+    detail: "returns the state it reached. needs await",
+    async run(ctx, name, opts = {}) {
+      if (!name) throw new Error("moshscript: herdWait(name) requires a session name");
+      const states = opts.states || ["blocked", "done", "idle"];
+      if (ctx.dryRun) { ctx.out(`  ⏳ herdWait(${name}) → would wait for ${states.join("/")}`); return "idle"; }
+      ctx.out(`  ⏳ herdWait(${name}) → waiting for ${states.join("/")}…`);
+      const result = await waitFor(String(name), states, opts.timeout ? { timeoutMs: Number(opts.timeout) } : {});
+      ctx.out(`     ${result.outcome === "matched" ? "✅" : "⌛"} ${name} is ${result.state}`);
+      return result.state;
+    },
+  },
+  {
+    name: "herdRead",
+    summary: "read a herd session's screen as a string",
+    usage: "herdRead(name, { lines })",
+    detail: "returns the last `lines` rows of its screen (default 60)",
+    run(ctx, name, opts = {}) {
+      if (!name) throw new Error("moshscript: herdRead(name) requires a session name");
+      if (ctx.dryRun) { ctx.out(`  📖 herdRead(${name}) → would read its screen`); return ""; }
+      return capture(String(name), { lines: Number(opts.lines) || 60 });
+    },
+  },
+  {
+    name: "herdList",
+    summary: "every herd session and its state",
+    usage: "herdList()",
+    detail: "returns [{ name, engine, state, cwd, alive }, …]",
+    run(ctx) {
+      if (ctx.dryRun) { ctx.out("  🐑 herdList() → would list the herd"); return []; }
+      return roster().map(({ name, engine, state, cwd, alive }) => ({ name, engine, state, cwd, alive }));
+    },
+  },
+  {
+    name: "herdKill",
+    summary: "end a herd session",
+    usage: "herdKill(name)",
+    detail: "returns { ok }",
+    run(ctx, name) {
+      if (!name) throw new Error("moshscript: herdKill(name) requires a session name");
+      if (ctx.dryRun) { ctx.out(`  ⏹ herdKill(${name}) → would end it`); return { ok: true, dryRun: true }; }
+      ctx.out(`  ⏹ herdKill(${name})`);
+      return { ok: Boolean(killSession(String(name)).ok) };
+    },
+  },
+
   // CLI verbs — each is `moshcode <name> ...args`. This is the whole point:
   // scripting the CLI. Add a capability by adding a line here.
   //
@@ -231,6 +330,8 @@ const COMMANDS = [
   // shortcut: ai() runs an engine headlessly and RETURNS its output (see PRD R17)
   aiVerb,
   cliVerb("agents", "launch an autonomous agent session (moshcode agents <engine>)"),
+  cliVerb("herd", "drive the herd (moshcode herd <verb>) — see herdStart/herdWait for values"),
+  cliVerb("ps", "print the herd roster"),
   cliVerb("start", "raw-launch an engine (moshcode start <engine>)"),
   cliVerb("install", "install an engine or workflow tool"),
   cliVerb("upgrade", "upgrade moshcode, engines, and tools"),

package/src/dns-system.mjs

@@ -373,13 +373,17 @@ export async function daemonStatus(path = pidfilePath()) {
  * not survive a reboot. `moshcode dns status` says so plainly rather than
  * letting someone discover it when their names stop resolving.
  */
-export async function startDaemon({ port, registryBase, path = pidfilePath(), entry }) {
+export async function startDaemon({ port, registryBase, path = pidfilePath(), entry, proxy = null }) {
   const existing = await daemonStatus(path);
   if (existing.running) return { started: false, pid: existing.pid, alreadyRunning: true };
 
   await mkdir(dirname(path), { recursive: true });
   const args = [entry, "dns", "start", "--port", String(port)];
   if (registryBase) args.push("--registry", registryBase);
+  // Passed at spawn time because it is what the resolver answers with, not
+  // something it can be told later — there is no channel to a detached daemon
+  // short of restarting it, which is why `enable` decides this before starting.
+  if (proxy) args.push("--proxy", proxy);
 
   const child = spawn(process.execPath, args, { detached: true, stdio: "ignore" });
   child.unref();

package/src/dns.mjs

@@ -695,6 +695,111 @@ export function proxyReachable(address, port = 443, { connect = null, timeoutMs
   });
 }
 
+/** The root moshpit-proxy signs with. Its leaves are how the proxy is recognised. */
+export const PROXY_ROOT_CN = "Moshpit Local CA";
+
+/**
+ * Is the thing on that address *our proxy*, or merely something on port 443?
+ *
+ * `proxyReachable` answers the second question, and on one common class of
+ * machine the two answers differ in the worst possible way. An origin runs
+ * nginx on `0.0.0.0:443`, which covers loopback — so a bare connect succeeds,
+ * proxy mode is turned on, and every live Moshpit name on the machine is
+ * pointed at a web server that knows nothing about them. That is not a
+ * certificate problem, it is every name on the machine serving the wrong site
+ * at once, and the connect probe cannot see it coming.
+ *
+ * So this asks the question that actually distinguishes them: complete a TLS
+ * handshake and look at who issued the certificate. The proxy mints a leaf per
+ * name from the root it generated on this machine, so the issuer is that root.
+ * Anything else — nginx with the origin's own self-signed certificate, some
+ * unrelated service — is issued by something else and is refused.
+ *
+ * `rejectUnauthorized` is off deliberately, and it is not a hole: nothing is
+ * sent, the peer certificate is read rather than trusted, and the only thing
+ * accepted from it is the issuer name. Verifying properly would require the
+ * root to already be installed, which is a step that has not happened yet at
+ * the point this runs.
+ */
+export async function proxyServes(address, name, {
+  port = PROXY_PORT,
+  timeoutMs = 2500,
+  tlsConnect = null,
+} = {}) {
+  const connectImpl = tlsConnect || (await import("node:tls")).connect;
+  return new Promise((resolve) => {
+    let socket;
+    const done = (result) => {
+      try { socket?.destroy(); } catch { /* already gone */ }
+      resolve(result);
+    };
+    try {
+      socket = connectImpl({
+        host: address,
+        port,
+        servername: name,
+        rejectUnauthorized: false,
+        // The proxy forces http/1.1; offering nothing keeps this a pure
+        // handshake rather than a protocol negotiation that could be declined.
+        ALPNProtocols: ["http/1.1"],
+      });
+      // Not unref'd, for the reason proxyReachable spells out: this timer is the
+      // only guarantee the promise settles.
+      const timer = setTimeout(() => done({ ok: false, why: "timed out" }), timeoutMs);
+      socket.once("secureConnect", () => {
+        clearTimeout(timer);
+        const cert = socket.getPeerCertificate?.() || {};
+        const issuer = cert.issuer?.CN || "";
+        if (issuer === PROXY_ROOT_CN) return done({ ok: true, issuer });
+        done({
+          ok: false,
+          issuer,
+          // Named as what it means rather than what was seen: "issuer is
+          // chovy.hacker" is a fact, "something else owns 443" is the reason
+          // proxy mode must stay off.
+          why: issuer
+            ? `something other than the proxy owns ${address}:${port} — it served a certificate issued by ${JSON.stringify(issuer)}`
+            : `something other than the proxy owns ${address}:${port}`,
+        });
+      });
+      socket.once("error", (err) => {
+        clearTimeout(timer);
+        done({ ok: false, why: err?.code || err?.message || "connection failed" });
+      });
+    } catch (err) {
+      resolve({ ok: false, why: err?.message || "connection failed" });
+    }
+  });
+}
+
+/**
+ * Which loopback addresses have the proxy behind them, if any.
+ *
+ * Both families are asked because answering one of them wrongly is an outage:
+ * a v6-only answer for a v4-only listener is a refused connection that reads as
+ * the site being down. `addressAnswer` handles the asymmetry; this just reports
+ * what is actually there.
+ */
+export async function findLocalProxy(name, { candidates = ["127.0.0.1", "::1"], ...options } = {}) {
+  const reachable = [];
+  let why = null;
+  for (const address of candidates) {
+    const result = await proxyServes(address, name, options);
+    if (result.ok) reachable.push(address);
+    // Keep the most informative refusal: "something else owns 443" is worth
+    // saying out loud, where "ECONNREFUSED" just means no proxy is installed.
+    else if (result.issuer && !why) why = result.why;
+  }
+  return {
+    found: reachable.length > 0,
+    why,
+    address: {
+      v4: reachable.find((a) => isIP(a) === 4) || null,
+      v6: reachable.find((a) => isIP(a) === 6) || null,
+    },
+  };
+}
+
 export async function addressAnswer(name, options = {}) {
   const { parkingAddress, wantsV6 = false, proxyAddress = null } = options;
   const plan = (kind, extra) => ({ exists: true, kind, records: [], address: null, cname: null, ...extra });
@@ -2088,6 +2193,10 @@ const USAGE = `moshcode dns — resolve Moshpit names on this machine
   --no-trust   with enable: route names but skip the local CA. They will
                resolve and then fail TLS, which is the state this flag exists
                to leave you in deliberately.
+  --no-proxy   with enable: answer each name's origin rather than the local
+               pinned-TLS proxy. Only the proxy can hand a stock client a
+               certificate it will accept, so this is the other half of the
+               same deliberate breakage.
 
 The registry speaks HTTP, not DNS, so nothing outside a browser can reach a
 Moshpit name until this bridge is running and your resolver points at it.
@@ -2123,6 +2232,7 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     bridgeStatus = daemonStatus,
     startBridge = startDaemon,
     proxyReachableImpl = proxyReachable,
+    findLocalProxyImpl = findLocalProxy,
     autoTrustImpl = createAutoTrust,
     stopBridge = stopDaemon,
     dropins = readDropins,
@@ -2723,9 +2833,65 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     // serve is silently shadowed by the bridge it said would not be started.
     // Honoring the note is the whole of the fix.
     const reusing = cleared.holder && cleared.holderForwards ? cleared.holder : null;
+
+    // Proxy mode, decided here because the bridge cannot be told later: what a
+    // resolver answers with is fixed when it starts.
+    //
+    // This is the step that was missing, and its absence is why the whole
+    // feature read as broken. Everything else was built — the proxy verifies
+    // origins against registry pins and re-signs with a root `dns enable`
+    // installs, and `addressAnswer` knows how to point names at it — but
+    // nothing ever turned it on, so names resolved straight to their origin and
+    // a stock client got a certificate no CA had signed. Trust was installed
+    // for a proxy that was never on the path.
+    //
+    // Refusing is the safe direction and the default: with proxy mode on and
+    // nothing behind it, every Moshpit name on the machine resolves and then
+    // refuses the connection.
+    let proxyAddress = null;
+    if (reusing) {
+      // A bridge this run did not start keeps whatever mode it was started
+      // with: `startDaemon` decides "already running" from our pidfile, and
+      // there is no channel to a detached daemon to change its mind. So the
+      // probe is skipped rather than run and then discarded — announcing a
+      // proxy and retracting it two lines later is worse than not looking.
+      out("  --   the bridge already running was not started by this run, so it keeps its own");
+      out("       mode — to pick up proxy mode: moshcode dns disable && moshcode dns enable");
+    } else if (!rest.includes("--no-proxy")) {
+      const probeName = moshpitProbe || "";
+      if (!probeName) {
+        out("  --   proxy mode not checked — no Moshpit name to probe with");
+      } else {
+        const local = await findLocalProxyImpl(probeName);
+        if (local.found) {
+          proxyAddress = local.address;
+          const at = [local.address.v4, local.address.v6].filter(Boolean).join(", ");
+          out(`  ok   pinned-TLS proxy on ${at}:${PROXY_PORT} — every live name will answer there`);
+        } else if (local.why) {
+          // The origin case, and the one worth naming precisely. A machine that
+          // serves Moshpit names has nginx on 443, so the proxy cannot be on the
+          // path here and pointing names at loopback would hand all of them to
+          // a web server that has never heard of them.
+          out(`  --   ${local.why}`);
+          out("       proxy mode stays off — names will answer their origin.");
+        } else {
+          out("  --   no pinned-TLS proxy on this machine — names will answer their origin");
+          out("       a stock client cannot verify those: https://github.com/profullstack/moshpit-proxy");
+        }
+      }
+    }
+
     const started = reusing
       ? { started: false, pid: reusing.pid, alreadyRunning: true, reused: true }
-      : await startBridge({ port: wanted, registryBase, entry: cliEntry() });
+      : await startBridge({
+        port: wanted,
+        registryBase,
+        entry: cliEntry(),
+        // v4 by preference: `dns start --proxy` takes one address and probes
+        // both families itself, so handing it the v4 loopback lets it find ::1
+        // too rather than pinning the answer to one family.
+        proxy: proxyAddress ? (proxyAddress.v4 || proxyAddress.v6) : null,
+      });
     out(started.reused
       ? `  ok   using the bridge already on ${DEFAULT_HOST}:${wanted} (pid ${reusing.pid || "?"}) — not starting a second one`
       : started.alreadyRunning

package/src/engines.mjs

@@ -10,6 +10,19 @@
 // `agentArgs` — an autonomous session with native approvals
 // bypassed/auto-approved. Do not use a machine-readable, one-shot list command
 // as an agents view: `/agents` promises to hand the terminal to a live session.
+//
+// `state` (optional) is how the herd reads this engine's screen when it has no
+// authoritative hook to go on (PRD 0009 R7). It lives here, next to the install
+// spec, so a new engine ships its detection rules with itself rather than in a
+// table somewhere else that nobody remembers to update. Shared patterns — bare
+// y/n prompts, "esc to interrupt" — are in src/herd-state.mjs and do not need
+// repeating; only put a pattern here when it is this engine's own wording.
+// Every pattern is matched against the bottom of the screen with ANSI stripped.
+//
+// `resume` (optional) is the argv that reopens this engine's last conversation,
+// used by `moshcode restore --resume` after a reboot. Omit it rather than guess:
+// a session that starts fresh is a small disappointment, and one that starts
+// with a flag the engine does not have is a crash.
 import { spawn } from "node:child_process";
 import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
@@ -24,6 +37,10 @@ export const ENGINES = {
     agentArgs: ["--auto"],
     install: { cmd: "bash", args: ["-c", "curl -fsSL https://opencode.ai/install | bash"] },
     upgrade: { cmd: "opencode", args: ["upgrade"] },
+    resume: ["--continue"],
+    state: {
+      blocked: [/\bpermission (?:request|required)\b/i, /\ballow this (?:command|tool)\b/i],
+    },
     // The installer appends this directory to a shell profile. The moshcode
     // process that ran it cannot see that PATH change, so search it directly.
     binDirs: [path.join(homedir(), ".opencode", "bin")],
@@ -35,6 +52,11 @@ export const ENGINES = {
     agentArgs: ["--auto"],
     install: { cmd: "sh", args: ["-c", "curl -fsSL https://getprivacycode.com/install | sh"] },
     binDirs: [path.join(homedir(), ".privacycode", "bin")],
+    // Same lineage, so the same screen wording and the same resume flag.
+    resume: ["--continue"],
+    state: {
+      blocked: [/\bpermission (?:request|required)\b/i, /\ballow this (?:command|tool)\b/i],
+    },
     // Deliberately no native updater. `privacycode upgrade` is opencode's, and
     // it works out how to update itself by recognising where it was installed —
     // it knows opencode's own locations, not this fork's ~/.privacycode/bin. It
@@ -59,18 +81,37 @@ export const ENGINES = {
       "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN",
       "CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_SESSION_ID", "CLAUDE_CODE_CHILD_SESSION",
     ],
+    resume: ["--continue"],
+    state: {
+      // The permission dialog's own heading, and the selector on its first
+      // option — the generic numbered-menu pattern would catch the second only
+      // if the cursor happened to be resting there.
+      blocked: [/\bdo you want to (?:proceed|make this edit|create)\b/i, /^\s*❯\s*1\.\s*yes/im],
+      // Claude Code parks "? for shortcuts" under the composer when it is
+      // waiting on you and nothing else, which is as close to an explicit
+      // "idle" as it publishes.
+      idle: [/\?\s+for shortcuts/i],
+    },
   },
   codex: {
     desc: "Codex — OpenAI's coding CLI",
     bin: "codex",
     agentArgs: ["--dangerously-bypass-approvals-and-sandbox"],
     install: { cmd: "npm", args: ["install", "-g", "@openai/codex"] },
+    resume: ["resume", "--last"],
+    state: {
+      blocked: [/\ballow (?:this )?command\b/i, /\bapprove this (?:command|edit|change)\b/i],
+      working: [/\besc to interrupt\b/i, /^\s*working\b/im],
+    },
   },
   gemini: {
     desc: "Gemini CLI — Google's agentic CLI",
     bin: "gemini",
     agentArgs: ["--approval-mode=yolo"],
     install: { cmd: "npm", args: ["install", "-g", "@google/gemini-cli"] },
+    state: {
+      blocked: [/\bapply this change\?/i, /\ballow execution\b/i],
+    },
   },
   kimi: {
     desc: "Kimi Code — Moonshot AI's agentic CLI",
@@ -131,6 +172,11 @@ export const ENGINES = {
     agentArgs: ["--yes-always"],
     install: { cmd: "bash", args: ["-c", "curl -LsSf https://aider.chat/install.sh | sh"] },
     upgrade: { cmd: "aider", args: ["--upgrade"] },
+    state: {
+      // aider asks in prose and answers in (Y)es/(N)o, which the shared y/n
+      // pattern misses because of the parentheses around the letters.
+      blocked: [/\((?:Y\)es|N\)o)/, /\badd .* to the chat\?/i],
+    },
   },
 };