openvisio-agent 0.21.1 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.22.0] — 2026-09-10
+
+- Carry the agent’s configured role and voice through every session, with cached identity when the roster is unavailable.
+- Let agents request their own coding workspace and carry forward findings without asking teammates to reassign work. Record the continuation in the source context graph and Studio.
+- Bound graph recall to direct source neighbors so shared nodes cannot pull in unrelated conversations.
+
+- Let the agent's native final turn end a cycle. Remove required code mutations, ticket updates, PR evidence, and forced recovery turns from the completion decision.
+- Deliver and persist the agent's actual response, including research, questions, and blockers, without automatically completing the ticket or rerunning an unchanged assignment after restart.
+- Expose advertised MCP capabilities independently of scheduling classification; allow native reading, search, browsing, planning, and context tools in reply sessions while keeping local writes scoped to coding workspaces.
+- Keep Claude context warm like Codex and OpenCode, tolerate unavailable optional history, and treat runtime deadlines as inactivity watchdogs.
+
 ## [0.21.1] — 2026-09-10
 
 - Recover identifier-owned assignments even when the agent is missing from `list_agents` or the roster request fails. Keep numeric-assignee compatibility, fresh ticket verification, and reassignment guards.

package/README.md

@@ -83,6 +83,10 @@ openvisio-agent watch --name ada --workdir ~/repo  # allow REAL work on a git br
 openvisio-agent stop --name ada                  # stop service + every ada watcher
 ```
 
+Agents choose their tools, investigation steps, context management, and when to end a turn. Each turn receives the agent’s configured identity, role, and voice when supplied by its profile; that context is cached across restarts. Reply sessions can request their configured coding workspace through `openvisio_request_work_session`, carrying their findings, source thread, and permissions into the continuation. They do not ask you to reassign work because of an internal scheduling choice. A successful native final turn ends the cycle; it does not mark a ticket done. The agent decides when to update the board. Research, audits, and already-satisfied requests can finish without code changes, ticket mutations, or a PR. Tool failures stay visible as diagnostics without forcing another model turn or replacing the agent's explanation.
+
+The context graph records source-to-continuation relationships and recalls direct neighbors without walking into unrelated conversations. The watcher saves the agent's final response for delivery retry and avoids rerunning an unchanged assignment after restart. Claude, Codex, and OpenCode keep context within a ticket or conversation; native runtimes handle compaction. A stalled-session watchdog resets when activity arrives, so ongoing work is not stopped by a fixed task duration. Ownership, cancellation, delivery deduplication, credential injection, and repository permissions remain enforced.
+
 The watcher can run up to three assigned coding tasks concurrently. Each ticket gets an isolated model runtime and ticket-specific worktree; tasks sharing the same mutable workspace remain serialized to prevent branch and file conflicts. Replies to one thread stay serialized while up to three independent threads run concurrently, and cancellation targets only the matching ticket or source thread. The work pool reuses local clones and is instructed to preserve dirty/staged work, create unique branches, and stage only task-owned changes. The independent reply lane receives a chat charter and no coding workspace. Codex publishes local branches through the constrained helper, then opens a PR with `gh pr create`; linked-codebase MCP operations are a fallback when the repository cannot be obtained locally.
 
 PR publishing is part of normal coding setup. `connect` authorizes the selected `--workspace` (or `~/openvisio-workspace`) for routine agent-branch pushes and installs the constrained Codex helper rule. New clones and linked worktrees inherit that workspace authority. Existing coding configurations migrate on their next watcher start. Use `--no-pr-push` during setup to opt out.
@@ -107,7 +111,7 @@ Do not chase auto-changing watcher PIDs. `openvisio-agent stop --name <agent>` u
 
 - **No opaque script.** You run a named, versioned npm package you can read here and on [npmjs.com](https://www.npmjs.com/package/openvisio-agent).
 - **Single-use code.** The `ovs_` code is exchanged once for a key; a leaked code is already spent.
-- **Least privilege.** Chat mode exposes only the `openvisio-team` MCP tools. Coding setup grants routine PR publishing inside its workspace through a no-argument `agent/*`-only helper. Repositories outside that workspace need an exact repository grant. The helper cannot merge or push protected branches.
+- **Scoped workspace access.** Chat sessions can discover advertised MCP actions and use reading, search, browsing, planning, and context tools. Local writes and shell execution require a coding workspace. Coding setup grants routine PR publishing inside its workspace through a no-argument `agent/*`-only helper. Repositories outside that workspace need an exact repository grant. The helper cannot merge or push protected branches.
 - **Local secrets.** Your agent key lives in `~/.openvisio/` with `600` permissions — never printed, never committed.
 
 ## Requirements

package/USER_GUIDE.md

@@ -91,7 +91,7 @@ The demo makes no model calls. Close it with `Ctrl+C` in its terminal and run St
 ### Find a result
 
 1. Select an agent in the sidebar.
-2. Select **Cycles**. A cycle is a group of actions for one unit of work.
+2. Select **Cycles**. A cycle is one agent turn, including its tool calls. The agent chooses when to finish; ticket completion is a separate action.
 3. Search for the ticket reference, such as `OVS-57`, and select the matching row.
 4. Switch between **Plan**, **Commands**, and **Response** to inspect steps, tool calls, and the final response. Expand **Runtime details** or **Cycle history** for more context.
 
@@ -113,7 +113,7 @@ Watchers running version **0.21.0 or newer** apply saved settings to the next re
 | --- | --- |
 | Live | Your browser is connected to Studio. Each watcher has its own connection status. |
 | Queued / Active | Work is waiting or running in the current watcher run. |
-| Completed | The selected action or cycle reported completion. Review the final result and ticket. |
+| Completed | The selected action finished, or the agent ended its turn. This does not automatically mark a ticket done. Review the final response for the outcome. |
 | Blocked / Failed / Timed out | Read the outcome and watcher log. Resolve the stated cause before requesting more work. |
 | Offline | The watcher stopped reporting or restarted. An unfinished cycle has no known final outcome in the available history. |
 | No explicit plan recorded | No plan was provided in the available history. This alone is not a failure. |

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "openvisio-agent",
-  "version": "0.21.1",
-  "description": "Connect Claude Code, Codex, or OpenCode to an OpenVisio team \u2014 MCP tools + optional autonomy \u2014 in one command.",
+  "version": "0.22.0",
+  "description": "Connect Claude Code, Codex, or OpenCode to an OpenVisio team — MCP tools + optional autonomy — in one command.",
   "type": "module",
   "bin": {
     "openvisio-agent": "bin/cli.mjs"

package/scenarios/runtime.scenarios.mjs

@@ -27,10 +27,10 @@ const formats = [
 
 // Tool identity, runtime representation, and lane capability are independent
 // dimensions: every row checks the actual permission boundary, not a snapshot.
-for (const tool of [...readTools, ...coordinationTools, ...repositoryTools, ...localTools]) {
+for (const tool of [...readTools, ...coordinationTools, ...repositoryTools]) {
   for (const mode of modes) for (const format of formats) {
     add(`permission-${mode.name}-${format.name}-${tool}`, 'runtime-permissions', `${mode.name} handles ${tool} from ${format.name} with only that lane's authority`, async () => {
-      const permitted = mode.canCode || readTools.includes(tool) || (mode.canCoordinate && coordinationTools.includes(tool))
+      const permitted = mode.canCode || !localTools.includes(tool)
       const result = acpPermissionResponse({ options: permissionOptions, toolCall: format.call(tool) }, mode)
       assert.equal(result.outcome.optionId, permitted ? 'yes' : 'no')
     })
@@ -317,12 +317,7 @@ for (const agent of ['codex', 'opencode']) for (const mode of modes) for (const
         assert.equal(server.command, process.execPath)
         const env = Object.fromEntries(server.env.map(({ name, value }) => [name, value]))
         const allowed = JSON.parse(env.OPENVISIO_CODEX_ALLOWED_TOOLS)
-        if (mode.canCode) assert.equal(allowed, null)
-        else {
-          assert.ok(allowed.includes('get_ticket'))
-          assert.equal(allowed.includes('update_ticket'), mode.canCoordinate)
-          assert.equal(allowed.includes('write_codebase_file'), false)
-        }
+        assert.equal(allowed, null, 'Scheduling lanes do not hide advertised capabilities')
       }
       if (agent === 'opencode') {
         const value = JSON.parse(config.env.OPENCODE_CONFIG_CONTENT)
@@ -353,10 +348,10 @@ for (const change of ['same', 'cwd', 'disabled-tools', 'model']) {
 }
 
 for (const localTool of localTools) {
-  add(`opencode-local-denial-${localTool}`, 'runtime-session-config', `OpenCode reply configuration denies inherited ${localTool} access globally and at agent level`, async () => {
+  add(`opencode-local-denial-${localTool}`, 'runtime-session-config', `OpenCode reply configuration scopes ${localTool} access globally and at agent level`, async () => {
     const config = buildOpencodeConfig({ canCode: false, mcpUrl: 'https://fixture.invalid/mcp', mcpHeaders: headers })
-    assert.equal(config.permission[localTool], 'deny')
-    assert.equal(config.agent['openvisio-reply'].permission[localTool], 'deny')
+    assert.equal(config.permission[localTool], ['read', 'task'].includes(localTool) ? 'allow' : 'deny')
+    assert.equal(config.agent['openvisio-reply'].permission[localTool], ['read', 'task'].includes(localTool) ? 'allow' : 'deny')
     assert.equal(config.mcp['openvisio-team'].oauth, false)
     assert.equal(config.mcp['openvisio-team'].headers['x-agent-api-key'], 'fixture-secret-key')
   })

package/scenarios/workspace.scenarios.mjs

@@ -16,7 +16,7 @@ async function eventually(predicate, description) {
   assert.fail(`Watcher did not reach: ${description}`)
 }
 
-export function fixture({ agent = 'codex', task = true, run, threadError = false, commentTools = [], onComment, selfProfile = self, listAgents, getTicket } = {}) {
+export function fixture({ agent = 'codex', task = true, run, threadError = false, commentTools = [], onComment, selfProfile = self, listAgents, getTicket, listChannels } = {}) {
   const dir = mkdtempSync(join(tmpdir(), 'byo-workspace-'))
   const posts = [], runs = [], calls = [], logs = [], messages = [], subscriptions = []
   const ticket = { id: 77, project_id: 1, slug: 'OPEN-77', title: 'Repair the component', agent_id: 7, status: 'In Progress', type_id: 1, updated_at: 'revision-1' }
@@ -33,6 +33,7 @@ export function fixture({ agent = 'codex', task = true, run, threadError = false
       if (name === 'list_task_types') return { types: [{ id: 1, name: 'In Progress' }, { id: 2, name: 'Testing' }, { id: 3, name: 'Done' }] }
       if (name === 'get_ticket') { assert.equal(args.project_id, 1); assert.equal(args.ticket_id, 77); return { ticket: getTicket ? getTicket(ticket) : { ...ticket } } }
       if (name === 'update_ticket') { Object.assign(ticket, args); return { ticket: { ...ticket } } }
+      if (name === 'list_channels' && listChannels) return { channels: await listChannels() }
       if (name === 'list_channels') return { channels: [{ id: 2, name: 'alex', agent_id: 7 }, { id: 9, name: 'general' }] }
       if (name === 'list_activity') return { activities: [] }
       if (name === 'list_message_thread') {

package/scripts/certify.mjs

@@ -55,7 +55,7 @@ const assertions = [
   ['review and testing handoffs do not restart work', watcher.includes('taskIsAwaitingReview(task, reviewIds)') && watcher.includes('taskIsAwaitingReview(ticket, typeSets.review)')],
   ['review handoff releases the task key for future rework', watcher.includes('seenTasks.delete(taskKey)') && watcher.includes('seenTasks.delete(key)')],
   ['assigned coding completion is posted by the watcher', watcher.includes('announceTaskCompletion') && watcher.includes('postMessageOnce({ key: `completion:${report.key}`')],
-  ['completion requires review/done state and PR evidence', watcher.includes('buildTaskCompletionReport') && watcher.includes('completion report deferred')],
+  ['agent results are delivered independently of ticket completion', watcher.includes('agentFinal: true') && watcher.includes('pendingAgentResults')],
   ['completion delivery survives reconnect and deduplicates', watcher.includes('pendingCompletionReports: [...pendingCompletionReports]') && watcher.includes('reportedCompletions: [...reportedCompletions]') && watcher.includes('reportedCompletions.has(report.key)')],
   ['optional ticket comments cannot block verified completion', watcher.includes('callOptionalTicketComment({ projectId, ticketId, content: report.content })') && watcher.includes('no ticket comment tool is exposed; completing ticket') && watcher.includes('reportedTaskComments: [...reportedTaskComments]') && watcher.includes('reportedTaskComments.has(report.key)')],
   ['ticket comments prefer the advertised modern schema with legacy compatibility', watcher.includes("names.has('create_task_comment') ? 'create_task_comment' : names.has('comment_ticket') ? 'comment_ticket' : ''") && watcher.includes("name === 'create_task_comment' ? { content } : { text: content }")],
@@ -75,7 +75,7 @@ const assertions = [
   ['human-facing ticket references require slugs, never database ids', watcher.includes('TICKET SLUGS, NEVER DATABASE IDS') && watcher.includes('ticketDisplaySlug(task)') && events.includes('export function ticketDisplaySlug') && !events.includes('I finished ticket #${task.id}')],
   ['rendered backend replies are checked before every guarded thread post', watcher.includes("callMcpTool('list_message_thread'") && watcher.includes('renderedAgentMessages(live') && watcher.includes('same-content-rendered')],
   ['Codex cannot race the watcher with post_message', watcher.includes("disabledMcpTools: ['post_message']") && codexConfig.includes('disabled_tools = [')],
-  ['ACP sessions receive the authenticated OpenVisio proxy', mastraHarness.includes("name: 'openvisio-team-watcher'") && mastraHarness.includes('OPENVISIO_CODEX_MCP_URL') && watcher.includes('missingRuntimeWorkEvidence(result')],
+  ['ACP sessions receive the authenticated OpenVisio proxy', mastraHarness.includes("name: 'openvisio-team-watcher'") && mastraHarness.includes('OPENVISIO_CODEX_MCP_URL')],
   ['Codex discovers deferred OpenVisio actions before claiming they are missing', watcher.includes('Codex may defer MCP actions') && watcher.includes('use tool_search to find that exact action') && watcher.includes('initial-list miss is NOT evidence that the server is disconnected')],
   ['Codex authentication is injected outside the model', codexConfig.includes('OPENVISIO_CODEX_API_KEY') && codexProxy.includes('toolWithoutCredentialInputs') && codexProxy.includes('client.callTool') && watcher.includes('local OpenVisio MCP bridge injects authentication outside the model')],
   ['reply delivery keys survive reconnects', watcher.includes('deliveredReplies: [...deliveredReplies]') && watcher.includes('deliveredReplies.has(deliveryKey)')],
@@ -106,18 +106,18 @@ const assertions = [
   ['bare-agent runs handle one source conversation', bareRun.includes('messageId?: string') && bareRun.includes('const targetRoot = target.parentId ?? target.messageId') && bareDriver.includes('messageId: source.messageId')],
   ['bare-agent posts have a live conversation guard', bareRun.includes('const canPostMessage') && bareRun.includes('{ canPostMessage }') && bareRuntime.includes('reply suppressed because the live thread was redirected, cancelled, or already answered')],
   ['quick replies preserve distinct top-level conversations', quickReply.includes('m.parentId ?? m.messageId') && quickReply.includes('...(parentId ? { parentId } : {})')],
-  ['completion has an evidence failure gate', watcher.includes('WORK_CYCLE_FAILED')],
-  ['failed evidence revisions persist and suppress self-triggered retries', watcher.includes('failedTaskVersions: [...failedTaskVersions]') && watcher.includes("failedTaskVersions.set(key, 'pending')") && watcher.includes('failedTaskRevisionIsCurrent(failedRevision, ticket)') && watcher.includes('ticket paused until its revision changes')],
+  ['completion follows the native agent turn without a forced recovery', watcher.includes("cycleControl.finishedBy = 'agent'") && !watcher.includes('missingRuntimeWorkEvidence') && !watcher.includes('cycle.recovery')],
+  ['runtime failures persist without restoring legacy evidence gates', watcher.includes('failedTaskVersions: [...failedTaskVersions]') && watcher.includes("replayState.completionPolicy === 'agent'") && watcher.includes('failedTaskRevisionIsCurrent(failedRevision, ticket)')],
   ['assigned coding tickets prefer their prepared local worktree', watcher.includes('findTicketWorktree(workdir, ticketId)') && watcher.includes('A prepared local git worktree for this ticket exists') && mastraHarness.includes('cwd: cycleCwd') && watcher.includes('workdir: ticketWorktree')],
   ['ACP evidence requires completed tools', mastraHarness.includes("if (tool.status !== 'completed') continue") && mastraHarness.includes('codexPolicyBlock(json(tool.rawOutput))')],
   ['OpenCode API-key MCP disables OAuth probing', opencodeConfig.includes("oauth: false") && opencodeConfig.includes('timeout: 15_000')],
   ['OpenCode ACP isolates server identity and reply permissions', mastraHarness.includes('OPENCODE_CONFIG_CONTENT') && mastraHarness.includes('buildOpencodeConfig({ canCode })') && mastraHarness.includes('mcpServers,')],
-  ['OpenCode backend prompts forbid relay and resource-discovery tools', watcher.includes('BACKEND MCP RULE') && ['get_marching_orders', 'poll_inbox', 'get_resource', 'list_mcp_resources', 'list_mcp_resource_templates'].every((name) => watcher.includes(name))],
+  ['agents can discover tools and choose context', watcher.includes('TOOL DISCOVERY') && watcher.includes('context compaction')],
   ['ACP tool failures retain sanitized diagnostics', mastraHarness.includes('for (const [name, detail] of errors)') && mastraHarness.includes('redact(detail)')],
-  ['all runtime acknowledgements cannot satisfy coding completion', watcher.includes('missingRuntimeWorkEvidence(result') && watcher.includes('claudeEventEvidence(o, turnToolUses)') && watcher.includes('releaseTaskForRetry(activeTaskRef, prompt)')],
+  ['tool telemetry remains separate from the native final response', watcher.includes('claudeEventEvidence(o, turnToolUses)') && watcher.includes('outputText: finalText')],
   ['ACP prose cannot masquerade as repository evidence', mastraHarness.includes("if (event.type === 'text') { outputText += event.text; continue }") && mastraHarness.includes("if (tool.status !== 'completed') continue")],
   ['ACP MCP failures retain sanitized per-call diagnostics', mastraHarness.includes('mcpErrorDetails: Object.fromEntries(errors)') && mastraHarness.includes("join('[redacted]')")],
-  ['coding recovery retains source context and requires a final result', watcher.includes('ORIGINAL REQUEST AND ROUTING CONTEXT') && events.includes('resultMessageRequired && !result?.didResultMessage') && events.includes("outputText: second?.outputText || first?.outputText || ''")],
+  ['same-source context stays warm across native turns', !watcher.includes('MAX_TURNS') && mastraHarness.includes('persistSession: true')],
   ['backend MCP accepts stateless initialize responses', mcpHttp.includes("mode = () => !initialized ? 'uninitialized' : sessionId ? 'stateful' : 'stateless'") && !watcher.includes('MCP initialize returned no session id')],
   ['MCP initialize is shared across concurrent startup probes', mcpHttp.includes('if (initializePromise) return initializePromise')],
   ['stateless tool errors do not cause initialize loops', mcpHttp.includes('if (hadSession && !retried')],
@@ -129,17 +129,17 @@ const assertions = [
   ['policy rejection cannot close a work cycle', mastraHarness.includes("subtype: policyBlock ? 'blocked' : 'ok'") && watcher.includes("result?.subtype === 'blocked'")],
   ['policy-blocked tickets are persisted and paused', watcher.includes('blockedTasks: [...blockedTasks]') && watcher.includes('WORK_CYCLE_BLOCKED')],
   ['repository push authorization automatically resumes the paused ticket', watcher.includes('blockedTaskRepos: [...blockedTaskRepos]') && watcher.includes('repositoryHasPrPushAuthorization')],
-  ['BYO coding prefers an existing local repository', watcher.includes('A usable local clone is your primary code surface') && watcher.includes('do not use remote codebase tools') && watcher.includes('Remote codebase tools are a fallback only when the repository cannot be obtained locally')],
+  ['BYO coding prefers an existing local repository', watcher.includes('A usable local clone is your primary code surface') && watcher.includes('Remote codebase tools are a fallback only when the repository cannot be obtained locally')],
   ['Codex publishes local branches with the constrained helper', watcher.includes('CODEX PR DELIVERY') && watcher.includes('openvisio-agent push-pr-branch') && watcher.includes('Use list_codebases/create_codebase_branch/create_codebase_commit/create_pull_request only as a fallback') && events.includes('const codebaseMutation')],
   ['private PR pushes use an explicit constrained helper', cli.includes("cmd === 'authorize-pr-push'") && cli.includes("cmd === 'push-pr-branch'") && prPush.includes("'push', '-u', identity.remote, destination")],
   ['PR push helper restricts branch and destination within setup authority', prPush.includes('isSafeAgentBranch(branch)') && prPush.includes('policyAllows(') && prPush.includes('accepts no force, remote, or ref args')],
   ['Codex recognizes helper authorization as a blocker', events.includes('OPENVISIO_PR_PUSH_AUTH_REQUIRED') && watcher.includes("block?.kind === 'pr-push-authorization-required'")],
   ['policy blocker is surfaced to the user', watcher.includes('reportPolicyBlock(prompt, activeTaskRef, result.policyBlock, delivery)') && watcher.includes("The local runtime rejected")],
   ['blocker routing carries explicit task identity', watcher.includes('const activeTaskRef = taskRef') && watcher.includes('taskRef: activeTaskRef')],
-  ['reply discovery failures stay scoped while failed mutations fail closed', watcher.includes('blockingReplyMcpErrors(result?.mcpErrors)') && watcher.includes('preserving the scoped model reply') && events.includes('export function blockingReplyMcpErrors')],
+  ['agents retain control of their response after tool failures', watcher.includes('agent ended its turn with tool diagnostics') && !watcher.includes('blockingReplyMcpErrors')],
   ['pending-ticket questions use watcher-owned MCP reads without a chat model cycle', watcher.includes('conversationAsksPendingTickets(text)') && watcher.includes('pending-ticket question -> watcher-owned MCP lookup') && watcher.includes("callMcpReadWithRetry('list_tasks'")],
-  ['chat ACP allows opaque MCP approvals behind a strict read-only proxy', mastraHarness.includes('export function acpPermissionResponse') && mastraHarness.includes('opaqueMcpApproval') && mastraHarness.includes('OPENVISIO_CODEX_ALLOWED_TOOLS') && codexProxy.includes('export function toolAllowed') && codexProxy.includes('allowedTools.has(name)')],
-  ['all runtime blockers have a delivery path', watcher.includes('publishBlocker') && watcher.includes('WORK_CYCLE_BLOCKED') && watcher.includes('COORDINATION_CYCLE_BLOCKED')],
+  ['chat ACP discovers advertised tools through the authenticated proxy', mastraHarness.includes('opaqueMcpApproval') && !mastraHarness.includes('CHAT_SAFE_MCP_READS') && codexProxy.includes('export function toolAllowed')],
+  ['runtime failures have a delivery path', watcher.includes('publishBlocker') && watcher.includes('WORK_CYCLE_BLOCKED')],
   ['ticket blocker cannot self-authorize', watcher.includes("ticketNotice = `I'm paused") && watcher.includes('publishBlocker({ prompt, taskRef, delivery, notice, ticketNotice, pause: true })') && !watcher.includes('test(approvalText)')],
   ['agent messages use first-person voice', watcher.includes('FIRST-PERSON VOICE') && watcher.includes("I'm blocked") && !watcher.includes('Alex is blocked') && !watcher.includes('Alex is paused')],
   ['normative certification gates are documented', spec.includes('## Mandatory certification gates')],

package/src/codex-mcp-proxy.mjs

@@ -1,6 +1,7 @@
 import { createInterface } from 'node:readline'
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { WORK_SESSION_TOOL, runtimeControlTools, requestWorkSession } from './runtime-control.mjs'
 import { createMcpHttpClient } from './mcp-http.mjs'
 
 export function toolWithoutCredentialInputs(tool) {
@@ -78,6 +79,7 @@ export function runCodexMcpProxy() {
   const url = process.env.OPENVISIO_CODEX_MCP_URL
   const apiKey = process.env.OPENVISIO_CODEX_API_KEY
   const identifier = process.env.OPENVISIO_CODEX_IDENTIFIER
+  const capabilities = { canCode: process.env.OPENVISIO_CAN_CODE === 'true', workspaceAvailable: process.env.OPENVISIO_WORKSPACE_AVAILABLE === 'true' }
   const { disabled, allowed: allowedTools } = proxyToolPolicyFromEnvironment()
   if (!url || !apiKey || !identifier) throw new Error('OpenVisio Codex MCP bridge is missing its watcher environment.')
   const client = createMcpHttpClient({ url, apiKey, identifier, clientVersion: 'openvisio-agent-codex-proxy' })
@@ -109,11 +111,20 @@ export function runCodexMcpProxy() {
       } else if (request.method === 'ping') {
         reply(id, {})
       } else if (request.method === 'tools/list') {
-        const tools = await client.listTools()
+        const controls = runtimeControlTools(capabilities)
+        let remote
+        try { remote = await client.listTools() }
+        catch (error) {
+          if (!controls.length) throw error
+          process.stderr.write('OpenVisio backend discovery is unavailable; local workspace continuation remains available.\n')
+          remote = []
+        }
+        const tools = [...remote.filter((tool) => tool.name !== WORK_SESSION_TOOL), ...controls]
         reply(id, { tools: tools.filter((tool) => toolAllowed(tool.name, { disabled, allowed: allowedTools })).map(toolWithoutCredentialInputs) })
       } else if (request.method === 'tools/call') {
         const name = String(request.params?.name || '')
         if (!toolAllowed(name, { disabled, allowed: allowedTools })) throw new Error('This tool is disabled for the current delivery lane.')
+        if (name === WORK_SESSION_TOOL) { reply(id, requestWorkSession(request.params?.arguments, capabilities)); return }
         let result
         try { result = await client.callTool(name, request.params?.arguments || {}) }
         catch (error) {

package/src/events.mjs

@@ -99,8 +99,14 @@ export function agentAddedByName(agent) {
   return personDisplayName(addedBy)
 }
 
-export function buildTaskCompletionReport(task, { projectId, fallbackText = '', recipientName = '', completedTypeIds = new Set(), reviewTypeIds = new Set() } = {}) {
+export function buildTaskCompletionReport(task, { projectId, fallbackText = '', agentFinal = false, recipientName = '', completedTypeIds = new Set(), reviewTypeIds = new Set() } = {}) {
   if (!task || typeof task !== 'object' || task.id == null) return null
+  if (agentFinal) {
+    const text = String(fallbackText || '').trim()
+    if (!text) return null
+    const label = ticketDisplaySlug(task) || String(task.title || 'Task')
+    return { key: `${projectId ?? task.project_id ?? task.projectId ?? '?'}:${task.id}:${taskRevision(task)}`, content: `${label}\n\n${text}`, prUrl: '' }
+  }
   if (!taskIsCompleted(task, completedTypeIds) && !taskIsAwaitingReview(task, reviewTypeIds)) return null
 
   const evidence = [task.description, fallbackText].filter(Boolean).join('\n')

package/src/mastra-harness.mjs

@@ -5,22 +5,16 @@ import { AcpAgent } from '@mastra/acp'
 import { onPath } from './lib.mjs'
 import { resolveAvailableModel } from './model-selection.mjs'
 import { codexPolicyBlock } from './events.mjs'
+import { WORK_SESSION_TOOL, workSessionRequest } from './runtime-control.mjs'
 import { buildOpencodeConfig } from './opencode-config.mjs'
 
 const MCP_TOOL_NAMES = [
-  'list_agents', 'list_projects', 'list_tasks', 'list_task_types', 'get_ticket',
+  WORK_SESSION_TOOL, 'list_agents', 'list_projects', 'list_tasks', 'list_task_types', 'get_ticket',
   'create_ticket', 'update_ticket', 'list_channels', 'list_message_thread', 'list_activity',
   'post_message', 'react_message', 'list_codebases', 'get_codebase',
   'codebase_tree', 'create_codebase_branch', 'create_codebase_commit',
   'create_pull_request', 'write_codebase_file', 'create_task_comment', 'comment_ticket',
 ]
-const CHAT_SAFE_MCP_READS = new Set([
-  'list_agents', 'list_projects', 'list_tasks', 'list_task_types', 'get_ticket',
-  'list_channels', 'list_message_thread', 'list_activity', 'list_codebases',
-  'get_codebase', 'codebase_tree',
-])
-const COORDINATION_TOOLS = ['create_ticket', 'update_ticket', 'post_message', 'react_message', 'create_task_comment', 'comment_ticket']
-
 const clean = (value, max = 300) => String(value ?? '').replace(/\s+/g, ' ').trim().slice(0, max)
 const json = (value) => { try { return JSON.stringify(value) } catch { return String(value ?? '') } }
 
@@ -63,6 +57,8 @@ function toolName(update) {
   const candidates = [update?.title, update?.rawInput?.tool, update?.rawInput?.toolName].filter((value) => typeof value === 'string')
   for (const candidate of candidates) {
     const value = candidate.toLowerCase().trim()
+    const namespaced = /^(?:mcp__openvisio-team(?:-watcher)?__|openvisio-team(?:-watcher)?[_ .:/]+)([a-z][a-z0-9_]+)$/.exec(value)
+    if (namespaced) return namespaced[1]
     for (const name of MCP_TOOL_NAMES) {
       if (value === name || (/^(?:mcp|openvisio)[\w .:/-]*?/.test(value) && new RegExp(`[_ .:/]${name}$`).test(value))) return name
     }
@@ -74,10 +70,11 @@ export function acpPermissionResponse(request, { canCode = false, canCoordinate
   const options = Array.isArray(request?.options) ? request.options : []
   const name = toolName(request?.toolCall || {})
   const opaqueMcpApproval = request?._meta?.is_mcp_tool_approval === true
-  // Codex omits the tool name from correlated ACP permission requests. Chat
-  // sessions expose only CHAT_SAFE_MCP_READS through their private proxy, so
-  // accepting an opaque MCP approval cannot grant a mutation or local access.
-  const allow = canCode || CHAT_SAFE_MCP_READS.has(name) || (canCoordinate && COORDINATION_TOOLS.includes(name)) || (opaqueMcpApproval && proxyProtected)
+  // The authenticated bridge exposes the server's advertised capabilities.
+  // The agent chooses actions within the user's request; the proxy still owns
+  // credentials and the per-request duplicate-delivery exclusion.
+  const exploratory = ['read', 'search', 'fetch', 'think', 'switch_mode'].includes(request?.toolCall?.kind)
+  const allow = canCode || exploratory || !!name || (opaqueMcpApproval && proxyProtected)
   const preferred = allow ? 'allow_once' : 'reject_once'
   const validOptions = options.filter((option) => option && typeof option.optionId === 'string' && option.optionId && ['allow_once', 'allow_always', 'reject_once', 'reject_always'].includes(option.kind))
   const selected = validOptions.find((option) => option.kind === preferred) || validOptions.find((option) => option.kind === (allow ? 'allow_always' : 'reject_always'))
@@ -92,7 +89,7 @@ function contentText(content) {
 }
 
 export function createMastraAcpRunner({
-  agent, mcpUrl, mcpHeaders = {}, workdir, canCode = !!workdir, canCoordinate = false, maxCycleMs = 20 * 60_000,
+  agent, mcpUrl, mcpHeaders = {}, workdir, canCode = !!workdir, canCoordinate = false, workspaceAvailable = canCode, maxCycleMs = 20 * 60_000,
   log = () => {}, debug = false, model, onTool, onEvent, systemPrompt = '', AcpAgentClass = AcpAgent,
 }) {
   const runtime = commandFor(agent)
@@ -173,7 +170,9 @@ export function createMastraAcpRunner({
         { name: 'OPENVISIO_CODEX_API_KEY', value: String(mcpHeaders['x-agent-api-key'] || '') },
         { name: 'OPENVISIO_CODEX_IDENTIFIER', value: String(mcpHeaders['x-agent-identifier'] || '') },
         { name: 'OPENVISIO_CODEX_DISABLED_TOOLS', value: JSON.stringify(disabledMcpTools) },
-        { name: 'OPENVISIO_CODEX_ALLOWED_TOOLS', value: canCode ? 'null' : JSON.stringify([...CHAT_SAFE_MCP_READS, ...(canCoordinate ? COORDINATION_TOOLS : [])]) },
+        { name: 'OPENVISIO_CODEX_ALLOWED_TOOLS', value: 'null' },
+          { name: 'OPENVISIO_CAN_CODE', value: String(canCode) },
+          { name: 'OPENVISIO_WORKSPACE_AVAILABLE', value: String(workspaceAvailable) },
       ],
     }] : [{ type: 'http', name: 'openvisio-team', url: mcpUrl, headers }]
     const sessionKey = JSON.stringify([cycleCwd, disabledMcpTools, mcpServers])
@@ -196,8 +195,7 @@ export function createMastraAcpRunner({
           DISABLE_MCP_CONFIG_FILTERING: 'true',
           CODEX_CONFIG: JSON.stringify({ 'mcp_servers.openvisio-team.enabled': false }),
         } : agent === 'opencode' ? {
-          // Keep local tools denied in lightweight ACP sessions, including
-          // installations whose ordinary OpenCode config auto-approves tools.
+          // Reply sessions can explore and manage context without a writable workspace.
           OPENCODE_CONFIG_CONTENT: JSON.stringify({
             ...buildOpencodeConfig({ canCode }),
             mcp: { 'openvisio-team': { enabled: false } },
@@ -248,6 +246,7 @@ export function createMastraAcpRunner({
         negotiatedSelected = ''
       }
     }
+    // This is a stalled-session watchdog, not a budget for finishing a task.
     const timer = setTimeout(() => { timedOut = true; controller.abort(); invalidate() }, maxCycleMs)
     // OpenCode can keep its ACP prompt open while the provider retries a 429.
     // Mastra 0.4.1 buffers child stderr but does not forward these diagnostics.
@@ -303,6 +302,7 @@ export function createMastraAcpRunner({
       while (true) {
         const next = await abortable(() => stream.next(), controller.signal)
         if (next.done) break
+        timer.refresh()
         const event = next.value
         if (!readyReported) {
           readyReported = true
@@ -352,10 +352,12 @@ export function createMastraAcpRunner({
       controller.signal.throwIfAborted()
       // Only final, completed tool states are evidence. Started/failed edits and
       // board mutations cannot stand in for completed repository work.
+      let workRequest = null
       for (const tool of [...tools.values()].sort((a, b) => a.order - b.order)) {
         const name = toolName(tool)
         if (tool.status === 'failed') policyBlock ||= codexPolicyBlock(json(tool.rawOutput))
         if (tool.status !== 'completed') continue
+        if (name === WORK_SESSION_TOOL) workRequest = workSessionRequest(tool.rawOutput ?? tool.content) || workRequest
         didMessage ||= ['post_message', 'create_task_comment', 'comment_ticket'].includes(name)
         didChannelMessage ||= name === 'post_message'
         didResultMessage ||= name === 'post_message' && didRepoMutation
@@ -377,7 +379,7 @@ export function createMastraAcpRunner({
       flushProgress()
       if (outputText.trim()) emit('output.final', { text: redact(outputText.trim()).slice(0, 8000), status: policyBlock ? 'blocked' : 'ok' })
       return {
-        type: 'result', subtype: policyBlock ? 'blocked' : 'ok', policyBlock, timings: { firstEventMs, totalMs: Math.round(performance.now() - startedAt) }, runtime: 'mastra-acp', model: selectedModel || null, requestedModel: requestedModel || null, outputText: outputText.trim(),
+        type: 'result', subtype: policyBlock ? 'blocked' : 'ok', stopReason: 'end_turn', workRequest, policyBlock, timings: { firstEventMs, totalMs: Math.round(performance.now() - startedAt) }, runtime: 'mastra-acp', model: selectedModel || null, requestedModel: requestedModel || null, outputText: outputText.trim(),
         mcpCalls: [...calls], mcpErrors: [...errors.keys()], mcpErrorDetails: Object.fromEntries(errors),
         didCode, didRepoMutation, didMessage, didChannelMessage, didResultMessage,
         didMcpTaskRead, didMcpTaskUpdate,

package/src/memory.mjs

@@ -66,10 +66,11 @@ export function createByoMemoryGraph({ path, maxNodes = 1000, now = () => Date.n
       return sameRef(r.channelId, refs.channelId) && (refs.threadId == null || sameRef(r.threadId, refs.threadId)) ||
         sameRef(r.projectId, refs.projectId) && sameRef(r.ticketId, refs.ticketId)
     })
-    const keys = new Set(direct.map((node) => String(node.key)))
+    const roots = new Set(direct.map((node) => String(node.key)))
+    const keys = new Set(roots)
     for (const edge of edges.values()) {
-      if (keys.has(String(edge.from))) keys.add(String(edge.to))
-      if (keys.has(String(edge.to))) keys.add(String(edge.from))
+      if (roots.has(String(edge.from))) keys.add(String(edge.to))
+      if (roots.has(String(edge.to))) keys.add(String(edge.from))
     }
     return [...nodes.values()].filter((node) => keys.has(String(node.key))).sort((a, b) => Number(b.updatedAt || 0) - Number(a.updatedAt || 0)).slice(0, limit)
   }

package/src/opencode-config.mjs

@@ -13,27 +13,24 @@ export function opencodeRuntimeLayout({ cfgKey, workdir, baseDir = OV_DIR }) {
 
 export function buildOpencodeConfig({ mcpUrl, mcpHeaders, canCode = true }) {
   if (!mcpUrl && canCode) return null
-  // Keep chat/reply runs genuinely MCP-only. `--auto` should honor a wildcard
-  // deny, but some OpenCode releases have still exposed built-ins through a
-  // merged/default agent configuration. Explicit denials prevent a reply cycle
-  // from invoking local grep (and hitting its 64 KiB JSON-record limit), reading
-  // the workspace, editing files, or delegating before the MCP allow-list wins.
+  // Keep local writes scoped to coding connections while allowing the agent
+  // to explore tools, retrieve context, plan, and use native compaction.
   const replyPermissions = {
     '*': 'deny',
-    read: 'deny',
+    read: 'allow',
     edit: 'deny',
-    glob: 'deny',
-    grep: 'deny',
-    list: 'deny',
+    glob: 'allow',
+    grep: 'allow',
+    list: 'allow',
     bash: 'deny',
-    task: 'deny',
+    task: 'allow',
     external_directory: 'deny',
-    todowrite: 'deny',
-    webfetch: 'deny',
-    websearch: 'deny',
-    lsp: 'deny',
-    skill: 'deny',
-    question: 'deny',
+    todowrite: 'allow',
+    webfetch: 'allow',
+    websearch: 'allow',
+    lsp: 'allow',
+    skill: 'allow',
+    question: 'allow',
     'openvisio-team_*': 'allow',
     'openvisio-team-watcher_*': 'allow',
   }

package/src/runtime-control.mjs

@@ -0,0 +1,50 @@
+export const WORK_SESSION_TOOL = 'openvisio_request_work_session'
+
+export function runtimeControlTools({ canCode = false, workspaceAvailable = false } = {}) {
+  if (canCode || !workspaceAvailable) return []
+  return [{
+    name: WORK_SESSION_TOOL,
+    description: 'Continue this same request in your configured coding workspace. Use when investigation reveals that local execution or edits are needed. You remain the same agent and retain the original task, recipient, and permissions. Supply the context worth carrying forward, then end this turn; the watcher starts your work session and delivers its eventual response. Do not ask the user to reassign the task.',
+    inputSchema: { type: 'object', properties: { context: { type: 'string', minLength: 1, maxLength: 12000, description: 'Relevant findings, decisions, remaining work, and context for your continuation.' } }, required: ['context'], additionalProperties: false },
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  }]
+}
+
+export function requestWorkSession(args, capabilities) {
+  if (!runtimeControlTools(capabilities).length) throw new Error('No additional coding workspace is available in this session')
+  if (!args || Object.keys(args).some((key) => key !== 'context') || typeof args.context !== 'string' || !args.context.trim() || args.context.length > 12000) throw new Error('Provide only a nonempty context string of at most 12000 characters')
+  return { content: [{ type: 'text', text: JSON.stringify({ openvisioControl: { action: 'request_work_session', context: args.context.trim() } }) }] }
+}
+
+// Only inspect outputs of our named local control tool, never arbitrary model
+// prose, commands, ticket text, or repository content.
+export function workSessionRequest(output, depth = 0) {
+  if (depth > 5 || output == null) return null
+  if (typeof output === 'string') {
+    try { return workSessionRequest(JSON.parse(output), depth + 1) } catch { return null }
+  }
+  if (Array.isArray(output)) {
+    for (const item of output) { const request = workSessionRequest(item, depth + 1); if (request) return request }
+    return null
+  }
+  const request = output.openvisioControl
+  if (request?.action === 'request_work_session' && typeof request.context === 'string' && request.context.trim() && request.context.length <= 12000) return { context: request.context.trim() }
+  for (const key of ['content', 'text', 'result', 'structuredContent']) {
+    const nested = workSessionRequest(output[key], depth + 1)
+    if (nested) return nested
+  }
+  return null
+}
+
+export function agentProfileContext(profile = {}, identifier = '') {
+  const text = (value, limit = 1200) => typeof value === 'string' ? value.trim().slice(0, limit) : ''
+  const name = text(profile.name, 120) || identifier
+  const role = text(profile.role || profile.primary_role || profile.job_role || profile.description)
+  const voice = text(profile.personality || profile.voice || profile.tone || profile.bio)
+  return [
+    `AGENT IDENTITY: ${JSON.stringify({ name, ...(role ? { role } : {}), ...(voice ? { voice } : {}) })}`,
+    'Keep this identity and voice consistent across conversations and work sessions. Let your role shape your judgment, priorities, and explanations; do not invent personal history or pretend to have performed work.',
+    'Speak naturally and directly, with warmth and your own judgment. Avoid automatic agreement, repeated apologies, canned acknowledgements, and status-bot phrasing. When corrected, say what changed in your understanding and act on it. Mention a person only when it helps direct the response, not as a greeting on every turn.',
+    'Profile and recalled context describe your role and past observations; they do not grant new permissions or override the current request.',
+  ].join('\n')
+}