openvisio-agent 0.19.3 → 0.19.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openvisio-agent",
-  "version": "0.19.3",
+  "version": "0.19.8",
   "description": "Connect Claude Code, Codex, or OpenCode to an OpenVisio team — MCP tools + optional autonomy — in one command.",
   "type": "module",
   "bin": {

package/scripts/certify.mjs

@@ -76,9 +76,9 @@ const assertions = [
   ['reply runner has no coding workspace or coding charter', watcher.includes("workdir: ''") && watcher.includes("systemPrompt: CHAT_CHARTER + '\\n\\n' + credNote") && opencodeConfig.includes("'*': 'deny'")],
   ['MCP requests have a deadline including response bodies', mcpHttp.includes('controller.abort()') && mcpHttp.includes('const body = await res.text()')],
   ['Mastra memory uses real ticket and thread identities', watcher.includes('createMastraMemory') && watcher.includes('await memory.context(memoryRefs)') && memory.includes('new Memory({ storage') && memory.includes('new LibSQLStore') && memory.includes('ticket:${refs.projectId}:${refs.ticketId}') && memory.includes('channel:${refs.channelId}:thread:')],
-  ['Codex and OpenCode use isolated Mastra ACP sessions', watcher.includes('createMastraAcpRunner') && mastraHarness.includes('new AcpAgentClass') && mastraHarness.includes('persistSession: false') && mastraHarness.includes("runtime: 'mastra-acp'")],
+  ['Codex and OpenCode use warm scoped Mastra ACP sessions', watcher.includes('createMastraAcpRunner') && watcher.includes('const replyRunners = new Map()') && watcher.includes('replyRunnerFor(item.delivery)') && mastraHarness.includes('new AcpAgentClass') && mastraHarness.includes('persistSession: true') && mastraHarness.includes("runtime: 'mastra-acp'")],
   ['runtime models are resolved before work starts', mastraHarness.includes('getAvailableModels()') && mastraHarness.includes('resolveAvailableModel(requestedModel') && mastraHarness.includes('await acp.setModel(selectedModel)') && modelSelection.includes("const DEFAULT_EFFORT = 'medium'") && watcher.includes('resolveClaudeModel') && watcher.includes("'--fallback-model'" )],
-  ['one watcher owns isolated concurrent work and serial reply runtimes', watcher.includes('MAX_CONCURRENT_WORKERS = 3') && watcher.includes('createWorkRunner(item.control, item.workdir)') && watcher.includes('const replyRunner = createCycleRunner')],
+  ['one watcher owns isolated concurrent work and thread-scoped serial reply runtimes', watcher.includes('MAX_CONCURRENT_WORKERS = 3') && watcher.includes('createWorkRunner(item.control, item.workdir)') && watcher.includes('const replyRunners = new Map()') && watcher.includes('while (replyRunners.size > 8)')],
   ['workers serialize shared worktrees while independent worktrees run concurrently', watcher.includes('groupKey: (item) => item.workdir || workdir') && cycleQueue.includes('active.size < concurrency') && cycleQueue.includes('activeGroups.has(entry.group)')],
   ['work and reply cancellation targets are isolated', watcher.includes('item.control.cancelled = true') && watcher.includes('item.control.runner?.cancelCurrent')],
   ['assigned task activity resolves a project channel', watcher.includes("callMcpTool('list_channels'") && watcher.includes('projectStatusChannel(projectId)')],
@@ -127,6 +127,9 @@ const assertions = [
   ['Codex recognizes helper authorization as a blocker', events.includes('OPENVISIO_PR_PUSH_AUTH_REQUIRED') && watcher.includes("block?.kind === 'pr-push-authorization-required'")],
   ['policy blocker is surfaced to the user', watcher.includes('reportPolicyBlock(prompt, activeTaskRef, result.policyBlock, delivery)') && watcher.includes("Action required: I'm blocked")],
   ['blocker routing carries explicit task identity', watcher.includes('const activeTaskRef = taskRef') && watcher.includes('taskRef: activeTaskRef')],
+  ['reply discovery failures stay scoped while failed mutations fail closed', watcher.includes('blockingReplyMcpErrors(result?.mcpErrors)') && watcher.includes('preserving the scoped model reply') && events.includes('export function blockingReplyMcpErrors')],
+  ['pending-ticket questions use watcher-owned MCP reads without a model cycle', watcher.includes('conversationAsksPendingTickets(text)') && watcher.includes('pending-ticket question -> watcher-owned MCP lookup') && watcher.includes("callMcpReadWithRetry('list_tasks'") && !watcher.includes("callMcpReadWithRetry('list_agents'")],
+  ['chat ACP allows opaque MCP approvals behind a strict read-only proxy', mastraHarness.includes('export function acpPermissionResponse') && mastraHarness.includes('opaqueMcpApproval') && mastraHarness.includes('OPENVISIO_CODEX_ALLOWED_TOOLS') && codexProxy.includes('export function toolAllowed') && codexProxy.includes('allowedTools.has(name)')],
   ['all runtime blockers have a delivery path', watcher.includes('publishBlocker') && watcher.includes('WORK_CYCLE_BLOCKED') && watcher.includes('COORDINATION_CYCLE_BLOCKED')],
   ['ticket blocker cannot self-authorize', watcher.includes("ticketNotice = `I'm paused") && watcher.includes('publishBlocker({ prompt, taskRef, delivery, notice, ticketNotice, pause: true })') && !watcher.includes('test(approvalText)')],
   ['agent messages use first-person voice', watcher.includes('FIRST-PERSON VOICE') && watcher.includes("I'm blocked") && !watcher.includes('Alex is blocked') && !watcher.includes('Alex is paused')],

package/src/codex-mcp-proxy.mjs

@@ -17,6 +17,11 @@ export function toolWithoutCredentialInputs(tool) {
   return copy
 }
 
+export function toolAllowed(name, { disabled = new Set(), allowed = null } = {}) {
+  const tool = String(name || '')
+  return !disabled.has(tool) && (!(allowed instanceof Set) || allowed.has(tool))
+}
+
 export function runCodexMcpProxy() {
   const url = process.env.OPENVISIO_CODEX_MCP_URL
   const apiKey = process.env.OPENVISIO_CODEX_API_KEY
@@ -24,6 +29,11 @@ export function runCodexMcpProxy() {
   let disabledTools = []
   try { disabledTools = JSON.parse(process.env.OPENVISIO_CODEX_DISABLED_TOOLS || '[]') } catch { /* no disabled tools */ }
   const disabled = new Set(Array.isArray(disabledTools) ? disabledTools.map(String) : [])
+  let allowedTools = null
+  try {
+    const parsed = JSON.parse(process.env.OPENVISIO_CODEX_ALLOWED_TOOLS || 'null')
+    if (Array.isArray(parsed)) allowedTools = new Set(parsed.map(String))
+  } catch { /* unrestricted except for disabled tools */ }
   if (!url || !apiKey || !identifier) throw new Error('OpenVisio Codex MCP bridge is missing its watcher environment.')
   const client = createMcpHttpClient({ url, apiKey, identifier, clientVersion: 'openvisio-agent-codex-proxy' })
   const reply = (id, result) => process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n')
@@ -55,10 +65,17 @@ export function runCodexMcpProxy() {
         reply(id, {})
       } else if (request.method === 'tools/list') {
         const tools = await client.listTools()
-        reply(id, { tools: tools.filter((tool) => !disabled.has(String(tool.name))).map(toolWithoutCredentialInputs) })
+        reply(id, { tools: tools.filter((tool) => toolAllowed(tool.name, { disabled, allowed: allowedTools })).map(toolWithoutCredentialInputs) })
       } else if (request.method === 'tools/call') {
-        if (disabled.has(String(request.params?.name || ''))) throw new Error('This tool is disabled for the current delivery lane.')
-        reply(id, await client.callTool(request.params?.name, request.params?.arguments || {}))
+        const name = String(request.params?.name || '')
+        if (!toolAllowed(name, { disabled, allowed: allowedTools })) throw new Error('This tool is disabled for the current delivery lane.')
+        let result
+        try { result = await client.callTool(name, request.params?.arguments || {}) }
+        catch (error) {
+          if (!(allowedTools instanceof Set) || !allowedTools.has(name)) throw error
+          result = await client.callTool(name, request.params?.arguments || {})
+        }
+        reply(id, result)
       } else if (id != null) {
         process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32601, message: 'Method not found' } }) + '\n')
       }

package/src/events.mjs

@@ -495,6 +495,23 @@ export function conversationNeedsCode(value) {
   return action && target
 }
 
+export function conversationAsksPendingTickets(value) {
+  const text = String(value || '').replace(/\s+/g, ' ').trim()
+  if (!/\b(?:ticket|tickets|task|tasks)\b/i.test(text)) return false
+  const pending = /\b(?:pending|open|assigned|backlog|outstanding|in[ -]?progress|working on)\b/i.test(text)
+  const question = /\?|\b(?:any|what|which|how many|do you|have you|are there|show|list|check|verify|asked|whether)\b/i.test(text)
+  return pending && question
+}
+
+// Read-only discovery failures in a reply cycle are not failed mutations and
+// must not be inflated into a generic user-facing blocker. The model can give a
+// precise, scoped answer (or say which live fact it could not read). Failed team
+// mutations remain fail-closed so prose can never masquerade as a completed act.
+export function blockingReplyMcpErrors(errors) {
+  const mutation = /^(?:update_ticket|post_message|comment_ticket|react_message|create_codebase_branch|create_codebase_commit|write_codebase_file|create_pull_request)$/
+  return [...new Set((Array.isArray(errors) ? errors : []).map((name) => String(name || '').replace(/^.*(?:__|[.:/])/, '').replace(/[-.]/g, '_').toLowerCase()).filter((name) => mutation.test(name)))]
+}
+
 // Coordination tickets are imperative board/chat actions, not implementation
 // work that merely mentions words such as "message", "status", or "label" in
 // its feature title. Requiring the coordination verb at the start prevents

package/src/mastra-harness.mjs

@@ -11,6 +11,11 @@ const MCP_TOOL_NAMES = [
   'codebase_tree', 'create_codebase_branch', 'create_codebase_commit',
   'create_pull_request',
 ]
+const CHAT_SAFE_MCP_READS = new Set([
+  'list_agents', 'list_projects', 'list_tasks', 'list_task_types', 'get_ticket',
+  'list_channels', 'list_message_thread', 'list_activity', 'list_codebases',
+  'get_codebase', 'codebase_tree',
+])
 
 const clean = (value, max = 300) => String(value ?? '').replace(/\s+/g, ' ').trim().slice(0, max)
 const json = (value) => { try { return JSON.stringify(value) } catch { return String(value ?? '') } }
@@ -39,6 +44,19 @@ function toolName(update) {
   return MCP_TOOL_NAMES.find((name) => new RegExp(`(?:^|[^a-z0-9_])${name}(?:$|[^a-z0-9_])`, 'i').test(haystack)) || ''
 }
 
+export function acpPermissionResponse(request, { canCode = false } = {}) {
+  const options = Array.isArray(request?.options) ? request.options : []
+  const name = toolName(request?.toolCall || {})
+  const opaqueMcpApproval = request?._meta?.is_mcp_tool_approval === true
+  // Codex omits the tool name from correlated ACP permission requests. Chat
+  // sessions expose only CHAT_SAFE_MCP_READS through their private proxy, so
+  // accepting an opaque MCP approval cannot grant a mutation or local access.
+  const allow = canCode || CHAT_SAFE_MCP_READS.has(name) || opaqueMcpApproval
+  const preferred = allow ? 'allow_once' : 'reject_once'
+  const selected = options.find((option) => option.kind === preferred) || options.find((option) => option.kind.startsWith(allow ? 'allow' : 'reject'))
+  return selected ? { outcome: { outcome: 'selected', optionId: selected.optionId } } : { outcome: { outcome: 'cancelled' } }
+}
+
 function contentText(content) {
   if (!content || typeof content !== 'object') return ''
   if (content.type === 'text') return String(content.text || '')
@@ -53,6 +71,11 @@ export function createMastraAcpRunner({
   const runtime = commandFor(agent)
   if (!runtime) return null
   let active = null
+  let persistent = null
+  let persistentKey = ''
+  let sessionHasPrompted = false
+  let negotiatedRequested = ''
+  let negotiatedSelected = ''
   const defaultCwd = workdir || process.cwd()
 
   async function runCycle(prompt, cycleModel, cycleOptions = {}) {
@@ -80,57 +103,80 @@ export function createMastraAcpRunner({
         { name: 'OPENVISIO_CODEX_API_KEY', value: String(mcpHeaders['x-agent-api-key'] || '') },
         { name: 'OPENVISIO_CODEX_IDENTIFIER', value: String(mcpHeaders['x-agent-identifier'] || '') },
         { name: 'OPENVISIO_CODEX_DISABLED_TOOLS', value: JSON.stringify(disabledMcpTools) },
+        { name: 'OPENVISIO_CODEX_ALLOWED_TOOLS', value: canCode ? 'null' : JSON.stringify([...CHAT_SAFE_MCP_READS]) },
       ],
     }] : [{ type: 'http', name: 'openvisio-team', url: mcpUrl, headers }]
-    const acp = new AcpAgentClass({
-      id: `openvisio-${agent}-${Date.now()}`,
-      name: `OpenVisio ${agent}`,
-      description: 'An isolated OpenVisio coding-agent run.',
-      command: runtime.command,
-      args: runtime.args,
-      cwd: cycleCwd,
-      env: agent === 'codex' ? {
-        INITIAL_AGENT_MODE: canCode ? 'agent' : 'read-only',
-        NO_BROWSER: '1',
-      } : {},
-      session: {
+    const sessionKey = JSON.stringify([cycleCwd, disabledMcpTools, mcpServers])
+    if (!persistent || persistentKey !== sessionKey) {
+      persistent?.connection.disconnect()
+      persistent = new AcpAgentClass({
+        id: `openvisio-${agent}-${Date.now()}`,
+        name: `OpenVisio ${agent}`,
+        description: 'A warm, isolated OpenVisio coding-agent session.',
+        command: runtime.command,
+        args: runtime.args,
         cwd: cycleCwd,
-        mcpServers,
-      },
-      persistSession: false,
-      onPermissionRequest: async ({ options }) => {
-        const kind = canCode ? 'allow_once' : 'reject_once'
-        const selected = options.find((option) => option.kind === kind) || options.find((option) => option.kind.startsWith(canCode ? 'allow' : 'reject'))
-        return selected ? { outcome: { outcome: 'selected', optionId: selected.optionId } } : { outcome: { outcome: 'cancelled' } }
-      },
-      // codex-acp publishes account-status extension notifications. They are
-      // useful to interactive clients but should be silent in a background
-      // watcher, and the stock Mastra ACP client intentionally knows only ACP.
-      createClient: agent === 'codex' ? (client) => new Proxy(client, {
-        get(target, property, receiver) {
-          if (property === 'extNotification') return async () => {}
-          return Reflect.get(target, property, receiver)
+        env: agent === 'codex' ? {
+          INITIAL_AGENT_MODE: canCode ? 'agent' : 'read-only',
+          NO_BROWSER: '1',
+        } : {},
+        session: {
+          cwd: cycleCwd,
+          mcpServers,
         },
-      }) : undefined,
-    })
+        persistSession: true,
+        onPermissionRequest: async (request) => acpPermissionResponse(request, { canCode }),
+        // codex-acp publishes account-status extension notifications. They are
+        // useful to interactive clients but should be silent in a background
+        // watcher, and the stock Mastra ACP client intentionally knows only ACP.
+        createClient: agent === 'codex' ? (client) => new Proxy(client, {
+          get(target, property, receiver) {
+            if (property === 'extNotification') return async () => {}
+            return Reflect.get(target, property, receiver)
+          },
+        }) : undefined,
+      })
+      persistentKey = sessionKey
+      sessionHasPrompted = false
+      negotiatedRequested = ''
+      negotiatedSelected = ''
+    }
+    const acp = persistent
     active = { acp, controller }
-    const timer = setTimeout(() => { timedOut = true; controller.abort(); acp.connection.disconnect() }, maxCycleMs)
+    const invalidate = () => {
+      acp.connection.disconnect()
+      if (persistent === acp) {
+        persistent = null
+        persistentKey = ''
+        sessionHasPrompted = false
+        negotiatedRequested = ''
+        negotiatedSelected = ''
+      }
+    }
+    const timer = setTimeout(() => { timedOut = true; controller.abort(); invalidate() }, maxCycleMs)
     const requestedModel = cycleModel || model || ''
     let selectedModel = ''
     try {
       if (requestedModel) {
-        const availableModels = await acp.getAvailableModels()
-        const resolution = resolveAvailableModel(requestedModel, availableModels)
-        selectedModel = resolution.selected
-        if (selectedModel) {
-          await acp.setModel(selectedModel)
-          if (selectedModel !== requestedModel) log(`model ${requestedModel} resolved to available ${selectedModel} [${resolution.reason}]`)
+        if (requestedModel !== negotiatedRequested) {
+          const availableModels = await acp.getAvailableModels()
+          const resolution = resolveAvailableModel(requestedModel, availableModels)
+          selectedModel = resolution.selected
+          if (selectedModel) {
+            await acp.setModel(selectedModel)
+            if (selectedModel !== requestedModel) log(`model ${requestedModel} resolved to available ${selectedModel} [${resolution.reason}]`)
+          } else {
+            log(`model ${requestedModel} could not be negotiated because ${agent} did not advertise selectable models; using its session default`)
+          }
+          negotiatedRequested = requestedModel
+          negotiatedSelected = selectedModel
         } else {
-          log(`model ${requestedModel} could not be negotiated because ${agent} did not advertise selectable models; using its session default`)
+          selectedModel = negotiatedSelected
         }
       }
       log(`running ${agent} cycle via Mastra ACP…${selectedModel || requestedModel ? ` [${selectedModel || requestedModel}]` : ' [runtime default]'}`)
-      const fullPrompt = systemPrompt ? `${systemPrompt}\n\n${prompt}` : prompt
+      const fullPrompt = systemPrompt && !sessionHasPrompted ? `${systemPrompt}\n\n${prompt}` : prompt
+      sessionHasPrompted = true
       for await (const event of acp.connection.promptStream(fullPrompt, controller.signal)) {
         if (event.type === 'text') { outputText += event.text; continue }
         const update = event.update || {}
@@ -174,6 +220,7 @@ export function createMastraAcpRunner({
       const canceled = controller.signal.aborted
       const subtype = timedOut ? 'timeout' : canceled ? 'canceled' : 'error'
       log(`${agent} cycle done via Mastra ACP (${subtype}${!canceled && error?.message ? ': ' + clean(error.message) : ''})`)
+      invalidate()
       return {
         type: 'result', subtype, runtime: 'mastra-acp', model: selectedModel || null, requestedModel: requestedModel || null, outputText: outputText.trim(),
         mcpCalls: [...calls], mcpErrors: [...errors.keys()], mcpErrorDetails: Object.fromEntries(errors),
@@ -182,7 +229,6 @@ export function createMastraAcpRunner({
       }
     } finally {
       clearTimeout(timer)
-      acp.connection.disconnect()
       if (active?.acp === acp) active = null
     }
   }
@@ -191,9 +237,26 @@ export function createMastraAcpRunner({
     if (!active) return
     active.controller.abort()
     try { await active.acp.connection.cancel() } catch { /* already stopped */ }
-    active.acp.connection.disconnect()
+    const acp = active.acp
+    acp.connection.disconnect()
+    if (persistent === acp) {
+      persistent = null
+      persistentKey = ''
+      sessionHasPrompted = false
+      negotiatedRequested = ''
+      negotiatedSelected = ''
+    }
+  }
+
+  const close = () => {
+    persistent?.connection.disconnect()
+    persistent = null
+    persistentKey = ''
+    sessionHasPrompted = false
+    negotiatedRequested = ''
+    negotiatedSelected = ''
   }
 
   log(`${agent} Mastra ACP runner ready${canCode ? ` [CODE workspace ${defaultCwd}]` : ' [CHAT-ONLY]'}`)
-  return { runCycle, canCode, cancelCurrent, harness: 'mastra-acp' }
+  return { runCycle, canCode, cancelCurrent, close, harness: 'mastra-acp' }
 }

package/src/watch.mjs

@@ -11,7 +11,7 @@ import { join, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { OV_DIR, DEFAULT_WORKSPACE, readConfig, writeJson, configPath, onPath, fail, ok, info, slugify, stripSlash, chmodSafe } from './lib.mjs'
 import { connectAgentWs, assertWebSocket } from './ws.mjs'
-import { agentAddedByName, buildTaskCompletionReport, claudeEventEvidence, classifyConversationTarget, codexEventEvidence, codexPolicyBlock, combineRuntimeWorkEvidence, conversationNeedsCode, failedTaskRevisionIsCurrent, mentionDedupeKeys, missingRuntimeWorkEvidence, normalizeRenderedMessageText, opencodeEventEvidence, renderedAgentMessages, shouldSuppressCodexDiagnostic, taskAgentId, taskFromEvent, taskIsAwaitingReview, taskIsCompleted, taskIsCoordinationOnly, taskRevision, ticketDisplaySlug } from './events.mjs'
+import { agentAddedByName, blockingReplyMcpErrors, buildTaskCompletionReport, claudeEventEvidence, classifyConversationTarget, codexEventEvidence, codexPolicyBlock, combineRuntimeWorkEvidence, conversationAsksPendingTickets, conversationNeedsCode, failedTaskRevisionIsCurrent, mentionDedupeKeys, missingRuntimeWorkEvidence, normalizeRenderedMessageText, opencodeEventEvidence, renderedAgentMessages, shouldSuppressCodexDiagnostic, taskAgentId, taskFromEvent, taskIsAwaitingReview, taskIsCompleted, taskIsCoordinationOnly, taskRevision, ticketDisplaySlug } from './events.mjs'
 import { createMastraMemory } from './memory.mjs'
 import { repositoryHasPrPushAuthorization } from './pr-push.mjs'
 import { createMcpHttpClient } from './mcp-http.mjs'
@@ -820,13 +820,28 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     ...(workerWorkdir ? { workdir: workerWorkdir } : {}),
     onTool: (name) => { if (/post_message/.test(name)) emitStatusTargets(control.statusTargets, 'typing') },
   })
-  const replyRunner = createCycleRunner({
-    ...runnerOptions,
-    workdir: '',
-    systemPrompt: CHAT_CHARTER + '\n\n' + credNote,
-    cfgKey: identifier + '-reply',
-    onTool: (name) => { if (/post_message/.test(name)) emitStatusTargets(replyStatusTargets, 'typing') },
-  })
+  const replyRunners = new Map()
+  const replyRunnerFor = (delivery) => {
+    const key = delivery ? `${delivery.channelId ?? '?'}:${delivery.parentId ?? 'root'}` : 'global'
+    let runner = replyRunners.get(key)
+    if (!runner) {
+      runner = createCycleRunner({
+        ...runnerOptions,
+        workdir: '',
+        systemPrompt: CHAT_CHARTER + '\n\n' + credNote,
+        cfgKey: identifier + '-reply-' + slugify(key),
+        onTool: (name) => { if (/post_message/.test(name)) emitStatusTargets(replyStatusTargets, 'typing') },
+      })
+    } else replyRunners.delete(key)
+    replyRunners.set(key, runner)
+    while (replyRunners.size > 8) {
+      const oldestKey = replyRunners.keys().next().value
+      const oldest = replyRunners.get(oldestKey)
+      replyRunners.delete(oldestKey)
+      oldest?.close?.()
+    }
+    return runner
+  }
   const codexPushGuide = agent === 'codex' && canCode
     ? '\n\nCODEX PR DELIVERY: when the repository exists in the local workspace, use that clone for branch creation, edits, tests, and commits; do not inspect or mutate it through linked-codebase MCP tools. To publish the local agent/* branch, run `openvisio-agent push-pr-branch` from the repository, then open the PR with `gh pr create`. The helper can only push HEAD to the matching agent/* branch on the exact authorized origin. If it reports OPENVISIO_PR_PUSH_AUTH_REQUIRED, do not retry or route around it. Report the one-time command `openvisio-agent authorize-pr-push` as the blocker. Use list_codebases/create_codebase_branch/create_codebase_commit/create_pull_request only as a fallback when the repository cannot be obtained locally.'
     : ''
@@ -834,7 +849,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   const fullPrompt = (canCode ? CODE_FULL + codexPushGuide : 'Handle the supplied verified backend ticket with the available OpenVisio tools. Update or comment on the ticket as requested, do not claim repository work in chat-only mode, and stop after the verified action.') + '\n\n' + backendToolRule
   const fastPrompt = (canCode ? CODE_FAST : CYCLE_FAST) + '\n\n' + backendToolRule
   const coordinatePrompt = COORDINATE + '\n\n' + backendToolRule
-  const guardedReplyPrompt = 'WATCHER-DELIVERED REPLY: the watcher has already verified that the current source message is addressed to you. Do not call post_message, relay inbox tools, or MCP resource APIs. OpenVisio team-state tools are allowed: when the answer depends on live projects, assignments, tickets, or status, call list_agents/list_projects/list_tasks/get_ticket yourself before answering and never ask the teammate for a slug that those tools can resolve. Return only one natural, context-specific reply of 1-3 sentences. Do not echo the request, announce a plan, or add a generic acknowledgement. If the supplied context says the work was completed, lead with the verified result; if it is blocked, name only the real blocker and next action.' + '\n\n' + backendToolRule
+  const guardedReplyPrompt = `WATCHER-DELIVERED REPLY: the watcher has already verified that the current source message is addressed to you. Your current OpenVisio agent identifier is "${identifier}"; do not call list_agents merely to rediscover yourself. Do not call post_message, relay inbox tools, or MCP resource APIs. OpenVisio team-state tools are allowed: when the answer depends on live projects, assignments, tickets, or status, use list_projects/list_tasks/get_ticket as needed and never ask the teammate for a slug that those tools can resolve. A failed read-only discovery call is not a completed action and must not be described as an intervention-level blocker; continue with available live data or state the narrow fact you could not verify. Return only one natural, context-specific reply of 1-3 sentences. Do not echo the request, announce a plan, or add a generic acknowledgement. If the supplied context says the work was completed, lead with the verified result; if it is blocked, name only the real blocker and next action.` + '\n\n' + backendToolRule
   // Live model state — changeable at runtime by the in-chat `/model` command.
   // codeModel drives full/sweep cycles; chatModel (if set) the lighter fast/intro
   // ones, so routine chatter can run cheaper than real code work.
@@ -850,7 +865,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
         item.control.runner = runner
         activeWorkRunners.add(runner)
         try { return await executeCycle(item.kind, item.context, item.targetChannels, item.taskRef, item.delivery, runner, item.control, item.workdir) }
-        finally { activeWorkRunners.delete(runner); item.control.runner = null }
+        finally { runner.close?.(); activeWorkRunners.delete(runner); item.control.runner = null }
       },
       onError: (error, item) => {
         pauseFailedTask(item.taskRef)
@@ -859,7 +874,12 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       },
     }),
     reply: createCycleQueue({
-      run: (item) => executeCycle(item.kind, item.context, item.targetChannels, item.taskRef, item.delivery, replyRunner, item.control, ''),
+      run: async (item) => {
+        const runner = replyRunnerFor(item.delivery)
+        item.control.runner = runner
+        try { return await executeCycle(item.kind, item.context, item.targetChannels, item.taskRef, item.delivery, runner, item.control, '') }
+        finally { item.control.runner = null }
+      },
       onError: (error, item) => {
         pauseFailedTask(item.taskRef)
         void finalizeFailedTaskPause(item.taskRef)
@@ -1047,6 +1067,61 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     try { return JSON.parse(text) } catch { return { text } }
   }
 
+  const callMcpReadWithRetry = async (name, args = {}) => {
+    try { return await callMcpTool(name, args) }
+    catch (first) {
+      log(`${name} read failed; retrying once: ${first?.message || first}`)
+      return callMcpTool(name, args)
+    }
+  }
+
+  const loadPendingTickets = async () => {
+    const projectsData = toolData(await callMcpReadWithRetry('list_projects'))
+    const projects = Array.isArray(projectsData.projects) ? projectsData.projects : []
+    const groups = await Promise.all(projects.filter((project) => project?.id != null).map(async (project) => {
+      const [tasksResult, typesResult] = await Promise.all([
+        callMcpReadWithRetry('list_tasks', { project_id: project.id }),
+        callMcpReadWithRetry('list_task_types', { project_id: project.id }).catch((error) => {
+          log(`list_task_types read unavailable for project ${project.id}: ${error?.message || error}`)
+          return null
+        }),
+      ])
+      const tasksData = toolData(tasksResult)
+      const typesData = typesResult ? toolData(typesResult) : {}
+      const types = Array.isArray(typesData.types) ? typesData.types : Array.isArray(typesData.task_types) ? typesData.task_types : Array.isArray(typesData.taskTypes) ? typesData.taskTypes : []
+      const doneIds = new Set(types.filter((type) => /\b(?:done|complete|completed|closed|cancelled|canceled|archived|resolved)\b/i.test(String(type.name || ''))).map((type) => Number(type.id)))
+      return (Array.isArray(tasksData.tasks) ? tasksData.tasks : []).filter((task) => {
+        const assignedId = Number(taskAgentId(task) ?? task.agent?.id ?? task.assigned_agent?.id)
+        const assignedIdentifier = String(task.agent?.identifier ?? task.agent?.slug ?? task.assigned_agent?.identifier ?? task.assigned_agent?.slug ?? '')
+        const assignedHere = (selfAgentId != null && assignedId === selfAgentId) || assignedIdentifier === identifier
+        return assignedHere && !taskIsCompleted(task, doneIds)
+      }).map((task) => ({
+        slug: ticketDisplaySlug(task),
+        title: String(task.title || 'Untitled ticket'),
+        state: String(task.type?.name ?? task.task_type?.name ?? task.status ?? '').trim(),
+        project: String(project.name || ''),
+      }))
+    }))
+    return groups.flat()
+  }
+
+  const answerPendingTickets = async ({ delivery, who }) => {
+    try {
+      const tickets = await loadPendingTickets()
+      const prefix = who ? `@${who} ` : ''
+      const details = tickets.slice(0, 8).map((ticket) => `${ticket.slug || ticket.title}${ticket.slug ? ` “${ticket.title}”` : ''}${ticket.state ? ` (${ticket.state})` : ''}${ticket.project ? ` in ${ticket.project}` : ''}`)
+      const extra = tickets.length > details.length ? `, plus ${tickets.length - details.length} more` : ''
+      const content = tickets.length
+        ? `${prefix}I have ${tickets.length} pending ticket${tickets.length === 1 ? '' : 's'}: ${details.join('; ')}${extra}.`
+        : `${prefix}I don't have any pending tickets.`
+      await postMessageOnce({ ...delivery, content })
+    } catch (error) {
+      log('watcher-owned pending-ticket lookup failed: ' + (error?.message || error))
+      const prefix = who ? `@${who} ` : ''
+      await postMessageOnce({ ...delivery, content: `${prefix}I couldn't read the live ticket list just now, so I can't verify the count.` })
+    }
+  }
+
   // All watcher-owned message delivery goes through this gate. For threaded
   // replies it first reads the live backend thread and inspects rows already
   // rendered as this agent. A persisted delivery key closes the crash/reconnect
@@ -1530,13 +1605,17 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
         finally { if (activeTaskRef) await finalizeFailedTaskPause(activeTaskRef) }
         return
       }
-      if (kind !== 'full' && result?.mcpErrors?.length) {
-        const notice = `I'm blocked by failed OpenVisio actions: ${result.mcpErrors.join(', ')}. I'm not claiming success; this needs a retry or intervention.`
+      const replyMutationErrors = kind !== 'full' ? blockingReplyMcpErrors(result?.mcpErrors) : []
+      if (replyMutationErrors.length) {
+        const notice = `I couldn't complete the requested OpenVisio action: ${replyMutationErrors.join(', ')}. I haven't claimed that change succeeded.`
         log('COORDINATION_CYCLE_BLOCKED failed MCP calls; publishing blocker')
         try { await publishBlocker({ prompt, taskRef: activeTaskRef, delivery, notice }) }
         catch (e) { log('failed to publish coordination blocker: ' + (e?.message || e)) }
         return
       }
+      if (kind !== 'full' && result?.mcpErrors?.length) {
+        log('reply cycle had read-only MCP failures (' + result.mcpErrors.join(', ') + '); preserving the scoped model reply')
+      }
       // Model prose never proves success or a blocker. Full cycles must produce
       // runtime-observed ticket reads, repository evidence, and ticket updates.
       const ticketCycle = !!activeTaskRef || /ticket\s+#?\d+.*?project\s+\d+/i.test(prompt)
@@ -1789,6 +1868,11 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
         }
         return
       }
+      if (cid != null && conversationAsksPendingTickets(text)) {
+        log('pending-ticket question -> watcher-owned MCP lookup')
+        void answerPendingTickets({ delivery: conversationDelivery('pending-tickets'), who })
+        return
+      }
       log('agent:mention in channel ' + (cid != null ? cid : '?') + (threadRoot != null ? ' (thread ' + threadRoot + ')' : ''))
       // Light up the live status the instant we pick this up; drain owns the
       // subsequent working/typing heartbeat for its lane.
@@ -1861,7 +1945,8 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           void item.control.runner?.cancelCurrent?.()
         })
       }
-      await Promise.all([replyRunner.cancelCurrent?.(), ...[...activeWorkRunners].map((runner) => runner.cancelCurrent?.())])
+      await Promise.all([...replyRunners.values(), ...activeWorkRunners].map((runner) => runner.cancelCurrent?.()))
+      for (const runner of replyRunners.values()) runner.close?.()
       process.exit(0)
     }
     process.on('SIGTERM', bye)