openvisio-agent 0.18.6 → 0.18.8

package/README.md

@@ -50,7 +50,7 @@ npx -y openvisio-agent@latest connect --backend https://api.your-org.example/dev
 - `--ws <wss-url>` — the org's API-Gateway WebSocket base (the same value the frontend uses as `NEXT_PUBLIC_BACKEND_WS_URL`).
 - `--mcp-url <url>` — registers the `openvisio-team` MCP (authed with the agent header pair) so the agent has tools to **act** on the events.
 
-Then `watch --name ada` auto-detects the backend agent and runs a WebSocket loop instead of polling: it connects with `?api_key=&identifier=`, keeps the connection warm with keepalives, reconnects with backoff, and pokes **one** Claude cycle per `task:assigned` / `agent:mention` (a burst of mentions coalesces into a single follow-up). Needs **Node ≥ 21** for the built-in WebSocket (Node 20: run with `--experimental-websocket`).
+Then `watch --name ada` auto-detects the backend agent and runs a WebSocket loop instead of polling: it connects with `?api_key=&identifier=`, keeps the connection warm with keepalives, reconnects with backoff, and queues each accepted assignment or mention independently. A work cycle can contain many assistant, tool, and message actions; emitting a progress message does not end it. Needs **Node ≥ 21** for the built-in WebSocket (Node 20: run with `--experimental-websocket`).
 
 ### `watch --name <agent>`
 
@@ -62,7 +62,7 @@ The backend MCP may be stateful or stateless. A successful initialize response w
 
 Codex BYO agents follow the repository's normative runtime specification in `docs/CODEX_BYO_AGENT_SPEC.md`: one WebSocket identity, independent Sol reply/work lanes, authoritative `get_ticket` verification for assignments, REST-backed in-app activity, persistent replay suppression, and runtime evidence gates before completion. Maintainers must run `npm run certify` before publishing.
 
-An `agent:mention` event only wakes the watcher; it does not grant ownership of the conversation. The actual source message is checked before any model starts. Messages redirected to another agent and unaddressed agent chatter stay silent, while a direct stand-down cancels queued/running work for that thread. Accepted coding work uses the activity indicator instead of a generic pickup message, then returns one verified result or concrete blocker in the source thread.
+An `agent:mention` event only wakes the watcher; it does not grant ownership of the conversation. The actual source message is checked before any model starts. Messages redirected to another agent and unaddressed agent chatter stay silent, while a direct stand-down cancels queued/running work for that thread. Accepted coding work uses the activity indicator instead of a generic pickup message. Claude and OpenCode may add one concrete progress update after work begins, but must continue and post a distinct verified result or blocker afterward; Codex keeps cancellation-safe delivery watcher-owned and renders the verified final answer once.
 
 Ticket references follow the board UI: BYO agents use the project-scoped slug, such as `OVS-57`, in messages, comments, PR descriptions, blockers, and results. Numeric `project_id` and `ticket_id` values remain internal MCP arguments and are never used as human-facing ticket names. If an older backend omits the slug, the agent uses the ticket title rather than inventing one.
 
@@ -75,9 +75,9 @@ openvisio-agent watch --name ada --workdir ~/repo  # allow REAL work on a git br
 openvisio-agent stop --name ada                  # stop service + every ada watcher
 ```
 
-With `--workdir`, the agent gets file + shell tools scoped to the workspace and works on an `agent/*` branch. For a codebase linked to OpenVisio, Codex first uses the authenticated MCP branch, commit, and pull-request tools. That creates the PR through the existing integration and avoids a local `git push`.
+The work lane uses the configured workspace and an `agent/*` branch. It reuses local clones and is instructed to preserve dirty/staged work, create unique branches, use separate worktrees for shared checkouts, and stage only task-owned changes. The independent reply lane receives a chat charter and no coding workspace. Codex publishes local branches through the constrained helper, then opens a PR with `gh pr create`; linked-codebase MCP operations are a fallback when the repository cannot be obtained locally.
 
-When those linked-codebase tools are unavailable, a pull request still requires exporting the local branch to the private Git remote. The constrained fallback uses an explicit, one-time authorization per repository:
+Publishing a local branch uses an explicit, one-time authorization per repository:
 
 ```bash
 cd /path/to/private-repo
@@ -86,6 +86,10 @@ openvisio-agent authorize-pr-push
 
 That command installs a narrow Codex rule for `openvisio-agent push-pr-branch` and records the repository's exact root and `origin`. The helper accepts no arguments and can only push `HEAD` to the same `agent/*` branch on that authorized origin. It disables repository hooks and rejects main/master, other branch namespaces, changed remotes, force pushes, local/file remotes, and credential-bearing URLs. Revoke it from the repository with `openvisio-agent revoke-pr-push`.
 
+Assignments use independent FIFO entries with stable-key duplicate suppression. Backlog recovery uses the same ticket verification path as WebSocket events, and each queued ticket is checked again before a model starts. MCP calls have a 20-second deadline including response bodies; tool discovery is cached and paginated. Activity requests are limited to one in flight per channel. Cancellation waits for process closure, with POSIX process-group termination for tool children. Credentials, replay state, and memory use atomic file replacement.
+
+See `docs/BYO_SYSTEM_AUDIT.md` in the repository for the audit results and remaining live-validation limits. Local certification does not certify a deployed agent's behavior.
+
 `--install` sets up a background service (launchd on macOS, systemd `--user` on Linux) that runs `watch` and restarts on login. Logs go to `~/.openvisio/<agent>.log` (macOS) or `journalctl --user -u openvisio-<agent>` (Linux).
 
 Do not chase auto-changing watcher PIDs. `openvisio-agent stop --name <agent>` unloads the named background service first, stops every remaining watcher for that exact agent, and clears its stale lock. Running `watch --install` also performs this cleanup before replacing the service.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openvisio-agent",
-  "version": "0.18.6",
+  "version": "0.18.8",
   "description": "Connect Claude Code, Codex, or OpenCode to an OpenVisio team — MCP tools + optional autonomy — in one command.",
   "type": "module",
   "bin": {

package/scripts/certify.mjs

@@ -28,6 +28,7 @@ const opencodeConfig = readFileSync(join(root, 'src', 'opencode-config.mjs'), 'u
 const prPush = readFileSync(join(root, 'src', 'pr-push.mjs'), 'utf8')
 const cli = readFileSync(join(root, 'bin', 'cli.mjs'), 'utf8')
 const websocket = readFileSync(join(root, 'src', 'ws.mjs'), 'utf8')
+const cycleQueue = readFileSync(join(root, 'src', 'cycle-queue.mjs'), 'utf8')
 const activityHook = readFileSync(join(repo, 'frontend', 'hooks', 'useAgentActivity.ts'), 'utf8')
 const taskHook = readFileSync(join(repo, 'frontend', 'hooks', 'useBackendTasks.ts'), 'utf8')
 const liveTasks = readFileSync(join(repo, 'frontend', 'lib', 'collab', 'liveTasks.ts'), 'utf8')
@@ -47,7 +48,7 @@ const assertions = [
   ['completion requires review/done state and PR evidence', watcher.includes('buildTaskCompletionReport') && watcher.includes('completion report deferred')],
   ['completion delivery survives reconnect and deduplicates', watcher.includes('pendingCompletionReports: [...pendingCompletionReports]') && watcher.includes('reportedCompletions: [...reportedCompletions]') && watcher.includes('reportedCompletions.has(report.key)')],
   ['optional ticket comments cannot block verified completion', watcher.includes("callOptionalMcpTool('comment_ticket', { project_id: projectId, ticket_id: ticketId, text: report.content })") && watcher.includes('comment_ticket is not exposed; completing ticket') && watcher.includes('reportedTaskComments: [...reportedTaskComments]') && watcher.includes('reportedTaskComments.has(report.key)')],
-  ['ticket comments cannot masquerade as channel completion', watcher.includes('didChannelMessage') && watcher.includes("mcpCalls.includes('post_message')")],
+  ['ticket comments cannot masquerade as channel completion', events.includes("didChannelMessage: completed && mcpTool === 'post_message'") && watcher.includes('result.didChannelMessage')],
   ['single-watcher acquisition is atomic and fails closed', watcher.includes("openSync(lockPath, 'wx')") && watcher.includes('Could not acquire the single-watcher lock')],
   ['websocket and activity mention delivery share a replay guard', watcher.includes('markMentionHandled(activityMessage, activityChannelId)') && watcher.includes('markMentionHandled(msg, cid)') && watcher.includes('recentMentionSignatures')],
   ['reconciled mentions reuse the guarded websocket delivery path', watcher.includes("onEvent('agent:mention'") && watcher.includes('_mentionAlreadyMarked: true')],
@@ -60,7 +61,10 @@ const assertions = [
   ['rendered backend replies are checked before every guarded thread post', watcher.includes("callMcpTool('list_message_thread'") && watcher.includes('renderedAgentMessages(live') && watcher.includes('same-content-rendered')],
   ['Codex cannot race the watcher with post_message', watcher.includes("disabledMcpTools: ['post_message']") && watcher.includes('disabled_tools = [')],
   ['reply delivery keys survive reconnects', watcher.includes('deliveredReplies: [...deliveredReplies]') && watcher.includes('deliveredReplies.has(deliveryKey)')],
-  ['guarded replies stay independent while a lane is busy', watcher.includes('lane.deferred.push') && watcher.includes('lane.deferred.shift()')],
+  ['tickets and guarded replies use the behavior-tested serial queue', watcher.includes('createCycleQueue({') && watcher.includes('queues[laneName].enqueue') && cycleQueue.includes('const pending = new Map()')],
+  ['queued assignments are checked again before model execution', watcher.includes('queued ticket no longer actionable; skipped before model start')],
+  ['reply runner has no coding workspace or coding charter', watcher.includes("workdir: '', systemPrompt: CHAT_CHARTER") && opencodeConfig.includes("'*': 'deny'")],
+  ['MCP requests have a deadline including response bodies', mcpHttp.includes('controller.abort()') && mcpHttp.includes('const body = await res.text()')],
   ['BYO memory uses real ticket and thread identities', watcher.includes('createByoMemoryGraph') && watcher.includes('memory.context(memoryRefs)') && memory.includes('sameRef(r.projectId, refs.projectId)') && memory.includes('sameRef(r.threadId, refs.threadId)')],
   ['two internal lanes exist', watcher.includes('work: createCycleRunner') && watcher.includes('reply: createCycleRunner')],
   ['work and reply activity targets are isolated', watcher.includes("laneStatusTargets = { work: new Set(), reply: new Set() }") && watcher.includes("emitLaneStatus('work', 'typing')") && watcher.includes("emitLaneStatus('reply', 'typing')")],
@@ -87,7 +91,9 @@ const assertions = [
   ['OpenCode identities use isolated configs outside the code workspace', watcher.includes('opencodeRuntimeLayout({ cfgKey, workdir })') && watcher.includes("'--dir', workspace") && watcher.includes('OPENCODE_CONFIG: opencodeConfigPath') && watcher.includes('OPENCODE_CONFIG_CONTENT: JSON.stringify(opencodeConfig)')],
   ['OpenCode backend prompts forbid relay and resource-discovery tools', watcher.includes('BACKEND MCP RULE') && watcher.includes('get_marching_orders, poll_inbox, get_resource, list_mcp_resources, list_mcp_resource_templates')],
   ['OpenCode tool failures retain sanitized diagnostics', events.includes('toolError: toolError.replace') && watcher.includes("opencode tool '") && watcher.includes("split(redactKey).join('[redacted]')")],
-  ['OpenCode acknowledgements cannot satisfy coding completion', watcher.includes("agent === 'codex' || agent === 'opencode'") && watcher.includes('releaseTaskForRetry(activeTaskRef, prompt)')],
+  ['all runtime acknowledgements cannot satisfy coding completion', watcher.includes('missingRuntimeWorkEvidence(result') && watcher.includes('claudeEventEvidence(o, turnToolUses)') && watcher.includes('releaseTaskForRetry(activeTaskRef, prompt)')],
+  ['Codex prose cannot masquerade as repository evidence', watcher.includes('codexEventEvidence(event)') && events.includes("item.type === 'agent_message'") && events.includes("event.type === 'item.completed'")],
+  ['coding recovery retains source context and requires a final result', watcher.includes('ORIGINAL REQUEST AND ROUTING CONTEXT') && events.includes('resultMessageRequired && !result?.didResultMessage') && events.includes("outputText: second?.outputText || first?.outputText || ''")],
   ['backend MCP accepts stateless initialize responses', mcpHttp.includes("mode = () => !initialized ? 'uninitialized' : sessionId ? 'stateful' : 'stateless'") && !watcher.includes('MCP initialize returned no session id')],
   ['MCP initialize is shared across concurrent startup probes', mcpHttp.includes('if (initializePromise) return initializePromise')],
   ['stateless tool errors do not cause initialize loops', mcpHttp.includes('if (hadSession && !retried')],
@@ -104,10 +110,10 @@ const assertions = [
   ['private PR pushes use an explicit constrained helper', cli.includes("cmd === 'authorize-pr-push'") && cli.includes("cmd === 'push-pr-branch'") && prPush.includes("'push', '-u', 'origin', destination")],
   ['PR push helper rejects protected/alternate/force targets by construction', prPush.includes("/^agent\\/") && prPush.includes('entry?.root === root && entry?.remote === remote') && prPush.includes('accepts no force, remote, or ref args')],
   ['Codex recognizes helper authorization as a blocker', events.includes('OPENVISIO_PR_PUSH_AUTH_REQUIRED') && watcher.includes("block?.kind === 'pr-push-authorization-required'")],
-  ['policy blocker is surfaced to the user', watcher.includes('reportPolicyBlock(prompt, activeTaskRef, result.policyBlock)') && watcher.includes("Action required: I'm blocked")],
-  ['blocker routing carries explicit task identity', watcher.includes('taskRefs: []') && watcher.includes('activeTaskRef') && watcher.includes('taskRef: activeTaskRef')],
+  ['policy blocker is surfaced to the user', watcher.includes('reportPolicyBlock(prompt, activeTaskRef, result.policyBlock, delivery)') && watcher.includes("Action required: I'm blocked")],
+  ['blocker routing carries explicit task identity', watcher.includes('const activeTaskRef = taskRef') && watcher.includes('taskRef: activeTaskRef')],
   ['all runtime blockers have a delivery path', watcher.includes('publishBlocker') && watcher.includes('WORK_CYCLE_BLOCKED') && watcher.includes('COORDINATION_CYCLE_BLOCKED')],
-  ['ticket blocker cannot self-authorize', watcher.includes("ticketNotice = `I'm paused") && watcher.includes('publishBlocker({ prompt, taskRef, notice, ticketNotice, pause: true })')],
+  ['ticket blocker cannot self-authorize', watcher.includes("ticketNotice = `I'm paused") && watcher.includes('publishBlocker({ prompt, taskRef, delivery, notice, ticketNotice, pause: true })') && !watcher.includes('test(approvalText)')],
   ['agent messages use first-person voice', watcher.includes('FIRST-PERSON VOICE') && watcher.includes("I'm blocked") && !watcher.includes('Alex is blocked') && !watcher.includes('Alex is paused')],
   ['normative certification gates are documented', spec.includes('## Mandatory certification gates')],
 ]

package/src/cycle-queue.mjs

@@ -0,0 +1,44 @@
+// One immutable source per cycle. A Map provides FIFO ordering and constant-time
+// replay checks without merging ticket identities or starving older assignments.
+export function createCycleQueue({ run, onError = () => {} }) {
+  const pending = new Map()
+  let active = null
+  let sequence = 0
+
+  const pump = async () => {
+    if (active || !pending.size) return
+    const [key, entry] = pending.entries().next().value
+    pending.delete(key)
+    active = { key, ...entry }
+    try { entry.resolve(await run(entry.item)) }
+    catch (error) {
+      try { onError(error, entry.item) } catch { /* logging cannot strand the queue */ }
+      entry.resolve({ status: 'failed' })
+    } finally {
+      active = null
+      void pump()
+    }
+  }
+
+  return {
+    enqueue(item, key = `cycle:${++sequence}`) {
+      if (active?.key === key) return active.promise
+      if (pending.has(key)) return pending.get(key).promise
+      let resolve
+      const promise = new Promise((done) => { resolve = done })
+      pending.set(key, { item, promise, resolve })
+      void pump()
+      return promise
+    },
+    cancel(predicate, cancelActive = () => {}) {
+      for (const [key, entry] of pending) {
+        if (!predicate(entry.item)) continue
+        pending.delete(key)
+        entry.resolve({ status: 'canceled' })
+      }
+      if (active && predicate(active.item)) cancelActive(active.item)
+    },
+    has(key) { return active?.key === key || pending.has(key) },
+    get size() { return pending.size + (active ? 1 : 0) },
+  }
+}

package/src/events.mjs

@@ -56,7 +56,21 @@ export function taskIsAwaitingReview(task, reviewTypeIds = new Set()) {
   return /\b(?:review|test|testing|qa|quality\s+assurance|verification|approval)\b/i.test(state)
 }
 
-export function buildTaskCompletionReport(task, { projectId, fallbackText = '' } = {}) {
+function personDisplayName(person) {
+  if (!person || typeof person !== 'object') return ''
+  return (`${person.first_name || person.firstName || ''} ${person.last_name || person.lastName || ''}`.trim() || person.name || '').trim()
+}
+
+/** The human responsible for a BYO agent is the person who added it, not the
+ * creator of whichever ticket it happens to complete. Backend deployments have
+ * exposed that relationship under both association and transport-style names. */
+export function agentAddedByName(agent) {
+  if (!agent || typeof agent !== 'object') return ''
+  const addedBy = agent.agentCreator || agent.agent_creator || agent.createdByUser || agent.created_by_user || agent.owner || agent.user
+  return personDisplayName(addedBy)
+}
+
+export function buildTaskCompletionReport(task, { projectId, fallbackText = '', recipientName = '' } = {}) {
   if (!task || typeof task !== 'object' || task.id == null) return null
   if (!taskIsCompleted(task) && !taskIsAwaitingReview(task)) return null
 
@@ -64,8 +78,7 @@ export function buildTaskCompletionReport(task, { projectId, fallbackText = '' }
   const prUrl = /https:\/\/github\.com\/[^\s)\]}>]+\/pull\/\d+/i.exec(evidence)?.[0]?.replace(/[.,;:]+$/, '') || ''
   if (!prUrl) return null
 
-  const creator = task.creator || task.created_by_user || task.createdByUser || {}
-  const requester = (`${creator.first_name || creator.firstName || ''} ${creator.last_name || creator.lastName || ''}`.trim() || creator.name || '').trim()
+  const requester = String(recipientName || '').trim()
   const title = String(task.title || 'Untitled task').replace(/\s+/g, ' ').trim().slice(0, 180)
   const status = String(task.type?.name || task.task_type?.name || task.status || task.state || 'review').replace(/\s+/g, ' ').trim()
   const verification = /\bVerification:\s*([^\n]{1,180})/i.exec(evidence)?.[1]?.replace(/\s+/g, ' ').trim().replace(/[.]+$/, '') || ''
@@ -100,7 +113,7 @@ export function opencodeEventEvidence(event) {
   const state = part.state && typeof part.state === 'object' ? part.state : {}
   const status = String(state.status ?? part.status ?? '').toLowerCase()
   const failed = /error|failed|denied|rejected/.test(status) || state.error != null || part.error != null
-  const completed = !failed && (!status || /completed|success|succeeded|ok/.test(status))
+  const completed = !failed && /^(?:completed|success|succeeded|ok)$/.test(status)
   const rawToolError = state.error ?? part.error
   const toolError = rawToolError == null ? '' : (typeof rawToolError === 'string' ? rawToolError : JSON.stringify(rawToolError))
   const input = state.input && typeof state.input === 'object' ? state.input : (part.input && typeof part.input === 'object' ? part.input : {})
@@ -124,13 +137,141 @@ export function opencodeEventEvidence(event) {
     ...(failed && toolError ? { toolError: toolError.replace(/\s+/g, ' ').slice(0, 500) } : {}),
     didCode: completed && (mutationTool || bashTool || codebaseMutation),
     didRepoMutation: completed && (mutationTool || codebaseMutation || (bashTool && commandMutation)),
-    didMcpTaskRead: completed && /^(?:get_ticket|list_tasks|list_task_types)$/.test(mcpTool),
+    didMcpTaskRead: completed && /^(?:get_ticket|list_tasks)$/.test(mcpTool),
     didMcpTaskUpdate: completed && mcpTool === 'update_ticket',
     didMessage: completed && /^(?:post_message|comment_ticket)$/.test(mcpTool),
     didChannelMessage: completed && mcpTool === 'post_message',
   }
 }
 
+// Codex emits started/completed JSONL records for the same item. Trust only a
+// completed, non-failed record for mutation and MCP evidence. In particular,
+// words such as "apply_patch" inside an agent_message are just prose.
+export function codexEventEvidence(event) {
+  if (!event || typeof event !== 'object') return {}
+  const item = event.item ?? event
+  if (!item || typeof item !== 'object') return {}
+  if (item.type === 'agent_message') return { outputText: typeof item.text === 'string' ? item.text : '' }
+
+  const status = String(item.status ?? '').toLowerCase()
+  const completed = event.type === 'item.completed' || /^(?:completed|success|succeeded|ok)$/.test(status)
+  const failed = event.type === 'item.failed' || /(?:fail|error|denied|rejected)/.test(status) || item.error != null || item.result?.isError === true || (item.exit_code != null && Number(item.exit_code) !== 0)
+  const itemType = String(item.type ?? '')
+  if (/^(?:command_execution|file_change|apply_patch|shell_command|exec_command)$/.test(itemType)) {
+    const command = String(item.command ?? item.input?.command ?? item.input?.cmd ?? '')
+    return {
+      failed,
+      completed: completed && !failed,
+      didCode: completed && !failed,
+      didRepoMutation: completed && !failed && (/^(?:file_change|apply_patch)$/.test(itemType) || /\b(?:git\s+(?:commit|push)|gh\s+pr\s+create|openvisio-agent\s+push-pr-branch)\b/i.test(command)),
+    }
+  }
+  if (itemType !== 'mcp_tool_call') return {}
+
+  const rawTool = String(item.tool ?? item.name ?? item.method ?? 'unknown')
+  const prefixed = /^(?:mcp__)?openvisio(?:-team|_team)(?:__|[_.:/-])(.+)$/i.exec(rawTool)
+  const mcpTool = String(prefixed?.[1] ?? rawTool).replace(/[-.]/g, '_')
+  const succeeded = completed && !failed
+  return {
+    mcpTool,
+    failed,
+    completed: succeeded,
+    didCode: succeeded && /^(?:create_codebase_branch|create_codebase_commit|write_codebase_file|create_pull_request)$/.test(mcpTool),
+    didRepoMutation: succeeded && /^(?:create_codebase_branch|create_codebase_commit|write_codebase_file|create_pull_request)$/.test(mcpTool),
+    didMcpTaskRead: succeeded && /^(?:get_ticket|list_tasks)$/.test(mcpTool),
+    didMcpTaskUpdate: succeeded && mcpTool === 'update_ticket',
+    didMessage: succeeded && /^(?:post_message|comment_ticket)$/.test(mcpTool),
+    didChannelMessage: succeeded && mcpTool === 'post_message',
+  }
+}
+
+// Claude's stream-json protocol separates tool_use blocks from their later
+// tool_result blocks. Keep the pending uses supplied by the caller and reduce
+// only completed results to work evidence; announcing a tool call is not proof
+// that the action succeeded.
+export function claudeEventEvidence(event, pendingToolUses = new Map()) {
+  if (!event || typeof event !== 'object') return {}
+  const content = Array.isArray(event.message?.content) ? event.message.content : []
+  const output = []
+  const toolCalls = []
+  const toolResults = []
+
+  if (event.type === 'assistant') {
+    for (const block of content) {
+      if (block?.type === 'text' && typeof block.text === 'string' && block.text.trim()) output.push(block.text.trim())
+      if (block?.type !== 'tool_use' || !block.name) continue
+      const id = String(block.id ?? block.tool_use_id ?? '')
+      const use = { name: String(block.name), input: block.input && typeof block.input === 'object' ? block.input : {} }
+      if (id) pendingToolUses.set(id, use)
+      toolCalls.push(use.name)
+    }
+  }
+
+  if (event.type === 'user') {
+    for (const block of content) {
+      if (block?.type !== 'tool_result') continue
+      const id = String(block.tool_use_id ?? block.id ?? '')
+      const use = id ? pendingToolUses.get(id) : null
+      if (!use) continue
+      pendingToolUses.delete(id)
+      const failed = block.is_error === true
+      toolResults.push(opencodeEventEvidence({
+        type: 'tool_use',
+        part: {
+          type: 'tool',
+          tool: use.name,
+          state: {
+            status: failed ? 'error' : 'completed',
+            input: use.input,
+            ...(failed ? { error: block.content ?? 'Claude tool call failed' } : {}),
+          },
+        },
+      }))
+    }
+  }
+
+  return {
+    ...(output.length ? { outputText: output.join(' ') } : {}),
+    ...(toolCalls.length ? { toolCalls } : {}),
+    ...(toolResults.length ? { toolResults } : {}),
+  }
+}
+
+export function missingRuntimeWorkEvidence(result, { ticketCycle = false, resultMessageRequired = false } = {}) {
+  const missing = [
+    ticketCycle && !result?.didMcpTaskRead && 'read the ticket through get_ticket/list_tasks',
+    !result?.didRepoMutation && 'perform and verify the repository change',
+    ticketCycle && !result?.didMcpTaskUpdate && 'update the ticket through update_ticket',
+    resultMessageRequired && !result?.didResultMessage && 'post a final result after the repository work',
+  ].filter(Boolean)
+  if (result?.mcpErrors?.length) missing.push('resolve failed MCP calls: ' + result.mcpErrors.join(', '))
+  return missing
+}
+
+export function combineRuntimeWorkEvidence(first, second) {
+  return {
+    ...second,
+    didCode: !!first?.didCode || !!second?.didCode,
+    didRepoMutation: !!first?.didRepoMutation || !!second?.didRepoMutation,
+    didMessage: !!first?.didMessage || !!second?.didMessage,
+    didChannelMessage: !!first?.didChannelMessage || !!second?.didChannelMessage,
+    // A message in a continuation comes after repository work completed in the
+    // first turn, even when that continuation itself performs no new mutation.
+    didResultMessage: !!first?.didResultMessage || !!second?.didResultMessage || (!!first?.didRepoMutation && !!second?.didChannelMessage),
+    didMcpTaskRead: !!first?.didMcpTaskRead || !!second?.didMcpTaskRead,
+    didMcpTaskUpdate: !!first?.didMcpTaskUpdate || !!second?.didMcpTaskUpdate,
+    mcpCalls: [...new Set([...(first?.mcpCalls || []), ...(second?.mcpCalls || [])])],
+    // An unrelated successful turn cannot erase a failed action. Clear only
+    // tools actually retried successfully in the continuation.
+    mcpErrors: [...new Set([
+      ...(first?.mcpErrors || []).filter((name) => !(second?.mcpCalls || []).includes(name)),
+      ...(second?.mcpErrors || []),
+    ])],
+    // Never deliver a stale promise together with a later verified result.
+    outputText: second?.outputText || first?.outputText || '',
+  }
+}
+
 export function agentStateRequest(backend, channelId, state, apiKey, identifier) {
   if (!['thinking', 'working', 'typing'].includes(state)) throw new Error('invalid agent state')
   const id = Number(channelId)

package/src/lib.mjs

@@ -3,8 +3,9 @@
 
 import { spawnSync } from 'node:child_process'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { mkdirSync, writeFileSync, readFileSync, chmodSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { mkdirSync, writeFileSync, readFileSync, chmodSync, renameSync, unlinkSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
 
 export const OV_DIR = join(homedir(), '.openvisio')
 // The agent's default code WORKSPACE — a single dedicated root that holds the org's
@@ -92,9 +93,17 @@ export function ensureCodex() {
 }
 
 export function writeJson(path, obj, secret = false) {
-  mkdirSync(OV_DIR, { recursive: true })
-  writeFileSync(path, JSON.stringify(obj, null, 2))
-  if (secret) chmodSafe(path, 0o600)
+  const contents = JSON.stringify(obj, null, 2)
+  mkdirSync(dirname(path), { recursive: true })
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`
+  try {
+    // Create private files privately, then replace atomically. A crash during a
+    // write must not truncate credentials or forget delivered-message guards.
+    writeFileSync(temporary, contents, { flag: 'wx', mode: secret ? 0o600 : 0o644 })
+    renameSync(temporary, path)
+  } finally {
+    try { unlinkSync(temporary) } catch (error) { if (error.code !== 'ENOENT') throw error }
+  }
 }
 
 export function readConfig(slug) {

package/src/mcp-http.mjs

@@ -9,7 +9,8 @@ const parsePayload = async (res) => {
 // Mcp-Session-Id) and stateless servers (no session header). The backend agent
 // MCP is deployed in both forms, so absence of a session id is a transport mode,
 // not an initialization failure.
-export function createMcpHttpClient({ url, apiKey, identifier, clientVersion, fetchImpl = fetch, log = () => {} }) {
+export function createMcpHttpClient({ url, apiKey, identifier, clientVersion, fetchImpl = fetch, log = () => {}, requestTimeoutMs = 20_000 }) {
+  if (!Number.isFinite(requestTimeoutMs) || requestTimeoutMs <= 0) throw new Error('invalid MCP request timeout')
   let initialized = false
   let sessionId = ''
   let rpcId = 0
@@ -17,17 +18,36 @@ export function createMcpHttpClient({ url, apiKey, identifier, clientVersion, fe
   let toolsPromise = null
   let toolsCache = null
 
-  const post = (message, withSession = true) => fetchImpl(url, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      accept: 'application/json, text/event-stream',
-      'x-agent-api-key': apiKey,
-      'x-agent-identifier': identifier,
-      ...(withSession && sessionId ? { 'mcp-session-id': sessionId } : {}),
-    },
-    body: JSON.stringify(message),
-  })
+  const post = async (message, withSession = true) => {
+    const controller = new AbortController()
+    let timer
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(new Error(`MCP ${message.method} timed out after ${requestTimeoutMs}ms`))
+        controller.abort()
+      }, requestTimeoutMs)
+    })
+    try {
+      // The deadline covers response bodies too: headers alone do not prove a
+      // streaming MCP request finished. Never retry an ambiguous mutation here.
+      return await Promise.race([timeout, (async () => {
+        const res = await fetchImpl(url, {
+          method: 'POST',
+          signal: controller.signal,
+          headers: {
+            'content-type': 'application/json',
+            accept: 'application/json, text/event-stream',
+            'x-agent-api-key': apiKey,
+            'x-agent-identifier': identifier,
+            ...(withSession && sessionId ? { 'mcp-session-id': sessionId } : {}),
+          },
+          body: JSON.stringify(message),
+        })
+        const body = await res.text()
+        return { ok: res.ok, status: res.status, headers: res.headers, text: async () => body }
+      })()])
+    } finally { clearTimeout(timer) }
+  }
 
   const reset = () => { initialized = false; sessionId = ''; toolsCache = null }
 
@@ -56,6 +76,7 @@ export function createMcpHttpClient({ url, apiKey, identifier, clientVersion, fe
 
   const callTool = async (name, args = {}, retried = false) => {
     await initialize()
+    const requestSession = sessionId
     const hadSession = !!sessionId
     const res = await post({
       jsonrpc: '2.0',
@@ -67,7 +88,7 @@ export function createMcpHttpClient({ url, apiKey, identifier, clientVersion, fe
       // Only a stateful transport can have an expired session. A stateless 4xx
       // belongs to the tool request itself and must not trigger an initialize loop.
       if (hadSession && !retried && [400, 404, 409, 410].includes(res.status)) {
-        reset()
+        if (sessionId === requestSession) reset()
         return callTool(name, args, true)
       }
       throw new Error(`MCP ${name} HTTP ${res.status}`)
@@ -82,13 +103,14 @@ export function createMcpHttpClient({ url, apiKey, identifier, clientVersion, fe
     return result
   }
 
-  const requestTools = async (retried = false) => {
+  const requestTools = async (retried = false, cursor, collected = [], cursors = new Set()) => {
     await initialize()
+    const requestSession = sessionId
     const hadSession = !!sessionId
-    const res = await post({ jsonrpc: '2.0', id: ++rpcId, method: 'tools/list', params: {} })
+    const res = await post({ jsonrpc: '2.0', id: ++rpcId, method: 'tools/list', params: cursor ? { cursor } : {} })
     if (!res.ok) {
       if (hadSession && !retried && [400, 404, 409, 410].includes(res.status)) {
-        reset()
+        if (sessionId === requestSession) reset()
         return requestTools(true)
       }
       throw new Error(`MCP tools/list HTTP ${res.status}`)
@@ -97,8 +119,15 @@ export function createMcpHttpClient({ url, apiKey, identifier, clientVersion, fe
     if (payload.error) throw new Error(`MCP tools/list: ${payload.error.message || 'protocol error'}`)
     const tools = payload.result?.tools ?? payload.tools
     if (!Array.isArray(tools)) throw new Error('MCP tools/list returned no tool array')
-    toolsCache = tools
-    return tools
+    const combined = [...collected, ...tools]
+    const nextCursor = payload.result?.nextCursor ?? payload.nextCursor
+    if (nextCursor) {
+      if (cursors.has(nextCursor) || cursors.size >= 99) throw new Error('MCP tools/list pagination did not terminate')
+      cursors.add(nextCursor)
+      return requestTools(retried, nextCursor, combined, cursors)
+    }
+    toolsCache = [...new Map(combined.map((tool) => [tool.name, tool])).values()]
+    return toolsCache
   }
 
   // Capability discovery is shared and cached. BYO runtimes use it before

package/src/memory.mjs

@@ -1,5 +1,5 @@
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { dirname } from 'node:path'
+import { readFileSync } from 'node:fs'
+import { writeJson } from './lib.mjs'
 
 const clean = (value, max = 320) => String(value || '').replace(/\s+/g, ' ').trim().slice(0, max)
 const sameRef = (a, b) => a != null && b != null && String(a) === String(b)
@@ -16,8 +16,7 @@ export function createByoMemoryGraph({ path, maxNodes = 1000, now = () => Date.n
 
   const persist = () => {
     try {
-      mkdirSync(dirname(path), { recursive: true })
-      writeFileSync(path, JSON.stringify({ version: 1, nodes: [...nodes.values()], edges: [...edges.values()] }, null, 2) + '\n', { mode: 0o600 })
+      writeJson(path, { version: 1, nodes: [...nodes.values()], edges: [...edges.values()] }, true)
     } catch { /* memory is best-effort; live backend checks remain authoritative */ }
   }
   const trim = () => {

package/src/opencode-config.mjs

@@ -11,19 +11,27 @@ export function opencodeRuntimeLayout({ cfgKey, workdir, baseDir = OV_DIR }) {
   }
 }
 
-export function buildOpencodeConfig({ mcpUrl, mcpHeaders }) {
-  if (!mcpUrl) return null
+export function buildOpencodeConfig({ mcpUrl, mcpHeaders, canCode = true }) {
+  if (!mcpUrl && canCode) return null
+  const replyPermissions = { '*': 'deny', 'openvisio-team_*': 'allow' }
   return {
     $schema: 'https://opencode.ai/config.json',
+    ...(!canCode ? {
+      permission: replyPermissions,
+      // Agent-level rules take precedence over global permissions. Select this
+      // private primary agent for reply runs, including stale project configs.
+      default_agent: 'openvisio-reply',
+      agent: { 'openvisio-reply': { mode: 'primary', permission: replyPermissions } },
+    } : {}),
     mcp: {
-      'openvisio-team': {
+      ...(mcpUrl ? { 'openvisio-team': {
         type: 'remote',
         url: mcpUrl,
         enabled: true,
         oauth: false,
         timeout: 15_000,
         ...(mcpHeaders && Object.keys(mcpHeaders).length ? { headers: mcpHeaders } : {}),
-      },
+      } } : {}),
     },
   }
 }

package/src/process-lifecycle.mjs

@@ -0,0 +1,28 @@
+// Model CLIs spawn shell/tool children. A lane remains occupied until its child
+// closes; POSIX process groups let cancellation reach those descendants too.
+export const modelProcessOptions = { detached: process.platform !== 'win32' }
+
+export function stopModelProcess(child, { graceMs = 1000 } = {}) {
+  if (!child?.pid || child.exitCode != null || child.signalCode != null) return Promise.resolve()
+  return new Promise((resolve) => {
+    let timer
+    const signal = (name) => {
+      if (process.platform !== 'win32') {
+        try { process.kill(-child.pid, name); return } catch { /* exited or not a process group leader */ }
+      }
+      try { child.kill(name) } catch { /* already gone */ }
+    }
+    const closed = () => {
+      clearTimeout(timer)
+      child.removeListener('close', closed)
+      // A tool may have detached its stdio while retaining the process group.
+      if (process.platform !== 'win32') {
+        try { process.kill(-child.pid, 'SIGKILL') } catch { /* no descendants remain */ }
+      }
+      resolve()
+    }
+    child.once('close', closed)
+    timer = setTimeout(() => signal('SIGKILL'), graceMs)
+    signal('SIGTERM')
+  })
+}