pairai 0.2.5 → 0.3.0

package/lib.ts

@@ -2,29 +2,131 @@
  * Pure/testable functions extracted from pairai CLI.
  * Imported by both pairai.ts and unit tests.
  */
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, statSync, openSync, writeSync, closeSync, unlinkSync, mkdirSync, constants as fsConstants } from "node:fs";
 import { join } from "node:path";
+import { homedir } from "node:os";
+
+export type Provider = "claude" | "gemini" | "cursor" | "copilot" | "windsurf" | "codex" | "amazonq";
+
+const VALID_PROVIDERS: Provider[] = ["claude", "gemini", "cursor", "copilot", "windsurf", "codex", "amazonq"];
 
 /**
  * Validate the --provider flag value.
  * Returns the validated provider or throws with a message.
  */
-export function validateProvider(value: string): "claude" | "gemini" {
-  if (value !== "claude" && value !== "gemini") {
-    throw new Error(`Unknown provider "${value}". Must be "claude" or "gemini".`);
+export function validateProvider(value: string): Provider {
+  if (!VALID_PROVIDERS.includes(value as Provider)) {
+    throw new Error(`Unknown provider "${value}". Must be one of: ${VALID_PROVIDERS.join(", ")}.`);
   }
-  return value;
+  return value as Provider;
 }
 
 /**
  * Auto-detect provider based on environment and filesystem.
  */
-export function detectProvider(): "claude" | "gemini" {
+export function detectProvider(): Provider {
   if (process.env.GEMINI_CLI) return "gemini";
+  try { if (statSync(".cursor").isDirectory()) return "cursor"; } catch {}
+  try { if (statSync(".windsurf").isDirectory()) return "windsurf"; } catch {}
+  try { if (statSync(".vscode").isDirectory()) return "copilot"; } catch {}
+  try { if (statSync(".codex").isDirectory()) return "codex"; } catch {}
+  try { if (statSync(".amazonq").isDirectory()) return "amazonq"; } catch {}
   try { if (statSync(".gemini").isDirectory()) return "gemini"; } catch {}
   return "claude";
 }
 
+export interface ProviderConfig {
+  /** Config file path (project-level or global) */
+  configPath: string;
+  /** MCP server key name in the config */
+  mcpKey: string;
+  /** Format: "json" or "toml" */
+  format: "json" | "toml";
+  /** Whether this provider only supports global config */
+  globalOnly: boolean;
+  /** Post-setup instruction */
+  instruction: string;
+}
+
+/**
+ * Get the config file path, format, and setup instructions for a provider.
+ */
+export function getProviderConfig(
+  provider: Provider,
+  cwd: string,
+  homeDir: string,
+  useGlobal: boolean,
+): ProviderConfig {
+  switch (provider) {
+    case "claude":
+      return {
+        configPath: join(cwd, ".mcp.json"),
+        mcpKey: "pairai-channel",
+        format: "json",
+        globalOnly: false,
+        instruction: "Start Claude Code in this directory",
+      };
+    case "gemini": {
+      const dir = useGlobal ? join(homeDir, ".gemini") : join(cwd, ".gemini");
+      return {
+        configPath: join(dir, "settings.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Restart Gemini CLI to activate the pairai MCP server",
+      };
+    }
+    case "cursor": {
+      const dir = useGlobal ? join(homeDir, ".cursor") : join(cwd, ".cursor");
+      return {
+        configPath: join(dir, "mcp.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Restart Cursor to activate the pairai MCP server",
+      };
+    }
+    case "copilot":
+      return {
+        configPath: join(cwd, ".vscode", "mcp.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Reload VS Code window (Ctrl+Shift+P → Developer: Reload Window)",
+      };
+    case "windsurf":
+      return {
+        configPath: join(homeDir, ".codeium", "windsurf", "mcp_config.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: true,
+        instruction: "Restart Windsurf to activate the pairai MCP server",
+      };
+    case "codex": {
+      const dir = useGlobal ? join(homeDir, ".codex") : join(cwd, ".codex");
+      return {
+        configPath: join(dir, "config.toml"),
+        mcpKey: "pairai",
+        format: "toml",
+        globalOnly: false,
+        instruction: "Restart Codex CLI to activate the pairai MCP server",
+      };
+    }
+    case "amazonq": {
+      const path = useGlobal
+        ? join(homeDir, ".aws", "amazonq", "default.json")
+        : join(cwd, ".amazonq", "default.json");
+      return {
+        configPath: path,
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Restart Amazon Q to activate the pairai MCP server",
+      };
+    }
+  }
+}
+
 /**
  * Replace any `pairai@x.y.z` version pin in a config string with a new version.
  */
@@ -37,21 +139,26 @@ export function updateVersionInConfig(content: string, latest: string): string {
  * Returns the path if config exists with a pairai entry, null otherwise.
  */
 export function checkExistingConfig(
-  provider: "claude" | "gemini",
+  provider: Provider,
   cwd: string,
   homeDir: string,
   useGlobal: boolean,
 ): string | null {
-  const configPath = provider === "gemini"
-    ? join(useGlobal ? join(homeDir, ".gemini") : join(cwd, ".gemini"), "settings.json")
-    : join(cwd, ".mcp.json");
-  const mcpKey = provider === "gemini" ? "pairai" : "pairai-channel";
+  const cfg = getProviderConfig(provider, cwd, homeDir, useGlobal);
+  if (!existsSync(cfg.configPath)) return null;
+
+  if (cfg.format === "toml") {
+    try {
+      const content = readFileSync(cfg.configPath, "utf-8");
+      if (content.includes(`[mcp_servers.${cfg.mcpKey}]`)) return cfg.configPath;
+    } catch {}
+    return null;
+  }
 
-  if (!existsSync(configPath)) return null;
   try {
-    const existing = JSON.parse(readFileSync(configPath, "utf-8"));
+    const existing = JSON.parse(readFileSync(cfg.configPath, "utf-8"));
     const servers = existing.mcpServers ?? {};
-    if (servers[mcpKey]) return configPath;
+    if (servers[cfg.mcpKey]) return cfg.configPath;
   } catch {}
   return null;
 }
@@ -78,3 +185,65 @@ export function formatKeyBackupBox(keyPath: string): string[] {
   out.push(`  \u2514${"\u2500".repeat(w + 2)}\u2518`);
   return out;
 }
+
+// ── Polling lock ─────────────────────────────────────────────────────────────
+
+const STALE_THRESHOLD_MS = 60_000; // 60 seconds
+
+function lockPath(agentId: string, lockDir?: string): string {
+  const dir = lockDir ?? join(homedir(), ".pairai", "locks");
+  mkdirSync(dir, { recursive: true });
+  return join(dir, `${agentId}.lock`);
+}
+
+/**
+ * Try to acquire an exclusive lock for this agent.
+ * Uses atomic O_CREAT|O_EXCL file creation + stale lock detection.
+ * Returns true if lock acquired, false if another live process holds it.
+ */
+export function acquireLock(agentId: string, lockDir?: string): boolean {
+  const path = lockPath(agentId, lockDir);
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync(path, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY);
+      writeSync(fd, String(process.pid));
+      closeSync(fd);
+      return true;
+    } catch (err: any) {
+      if (err.code !== "EEXIST") throw err;
+
+      // Lock file exists — check if holder is alive and not stale
+      try {
+        const pid = parseInt(readFileSync(path, "utf-8").trim(), 10);
+        const stat = statSync(path);
+        const age = Date.now() - stat.mtimeMs;
+
+        // If PID is alive and lock is fresh, we can't acquire
+        if (!isNaN(pid) && age < STALE_THRESHOLD_MS) {
+          try {
+            process.kill(pid, 0); // signal 0 = check if alive
+            return false; // process is alive, lock is valid
+          } catch {
+            // process is dead — reclaim
+          }
+        }
+
+        // Stale or dead process — remove and retry
+        unlinkSync(path);
+      } catch {
+        // Can't read/stat lock file — try to remove and retry
+        try { unlinkSync(path); } catch {}
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Release the lock for this agent. Safe to call multiple times.
+ */
+export function releaseLock(agentId: string, lockDir?: string): void {
+  const path = lockPath(agentId, lockDir);
+  try { unlinkSync(path); } catch {}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairai",
-  "version": "0.2.5",
+  "version": "0.3.0",
   "description": "pairai CLI — connect AI agents to collaborate via the pairai hub",
   "type": "module",
   "license": "MIT",

package/pairai.ts

@@ -3,8 +3,8 @@
  * pairai CLI — connect AI agents via the pairai hub
  *
  * Commands:
- *   npx pairai setup "Agent Name" [--hub URL] [--provider claude|gemini] [--global] [--force]
- *   npx pairai serve [--provider claude|gemini]
+ *   npx pairai setup "Agent Name" [--hub URL] [--provider claude|gemini|cursor|copilot|windsurf|codex|amazonq] [--global] [--force]
+ *   npx pairai serve [--provider claude|gemini|cursor|copilot|windsurf|codex|amazonq]
  *   npx pairai upgrade     — update to latest version (preserves keys and config)
  *   npx pairai version     — show current version
  *
@@ -17,11 +17,12 @@ import {
   publicEncrypt, privateDecrypt, sign, verify,
   randomBytes, createCipheriv, createDecipheriv, constants,
 } from "node:crypto";
-import { writeFileSync, mkdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { validateProvider, detectProvider, updateVersionInConfig, checkExistingConfig, formatKeyBackupBox } from "./lib.js";
+import { validateProvider, detectProvider, checkExistingConfig, formatKeyBackupBox, acquireLock, releaseLock, getProviderConfig } from "./lib.js";
+import type { Provider } from "./lib.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf-8"));
@@ -49,27 +50,11 @@ if (command === "upgrade") {
     } else {
       console.log(`  New version available: v${latest}`);
       console.log(`  Upgrading...\n`);
+      // Clear npx cache so next `npx pairai serve` picks up the new version
+      try { execSync("npx clear-npx-cache 2>/dev/null || rm -rf " + join(homedir(), ".npm/_npx"), { stdio: "pipe" }); } catch {}
       execSync("npm install -g pairai@latest", { stdio: "inherit" });
       console.log(`\n  Upgraded to v${latest}.`);
       console.log(`  Keys and config are unchanged.\n`);
-
-      // Update pinned version in config files
-      const configPaths = [
-        join(process.cwd(), ".mcp.json"),
-        join(process.cwd(), ".gemini", "settings.json"),
-        join(homedir(), ".gemini", "settings.json"),
-      ];
-      for (const p of configPaths) {
-        try {
-          if (!existsSync(p)) continue;
-          const content = readFileSync(p, "utf-8");
-          const updated = updateVersionInConfig(content, latest);
-          if (updated !== content) {
-            writeFileSync(p, updated);
-            console.log(`  Updated version in ${p}`);
-          }
-        } catch {}
-      }
     }
   } catch (err) {
     console.error(`  Upgrade failed: ${(err as Error).message}`);
@@ -78,7 +63,7 @@ if (command === "upgrade") {
   process.exit(0);
 }
 
-// detectProvider, validateProvider, updateVersionInConfig, checkExistingConfig,
+// detectProvider, validateProvider, checkExistingConfig,
 // formatKeyBackupBox are imported from ./lib.js
 
 // ── Setup: register + configure ──────────────────────────────────────────────
@@ -95,7 +80,7 @@ if (command === "setup") {
       process.exit(1);
     }
   }
-  const provider = (providerArg as "claude" | "gemini") ?? detectProvider();
+  const provider = (providerArg as Provider) ?? detectProvider();
   const globalIdx = rest.indexOf("--global");
   const useGlobal = globalIdx !== -1 ? (rest.splice(globalIdx, 1), true) : false;
   const agentName = rest.find((a) => !a.startsWith("--"));
@@ -103,7 +88,7 @@ if (command === "setup") {
   const forceIdx = rest.indexOf("--force");
   const useForce = forceIdx !== -1 ? (rest.splice(forceIdx, 1), true) : false;
   if (!agentName) {
-    console.error('Usage: npx pairai setup "Agent Name" [--hub URL] [--provider claude|gemini] [--global] [--force]');
+    console.error('Usage: npx pairai setup "Agent Name" [--hub URL] [--provider claude|gemini|cursor|copilot|windsurf|codex|amazonq] [--global] [--force]');
     process.exit(1);
   }
 
@@ -152,61 +137,54 @@ if (command === "setup") {
   for (const line of formatKeyBackupBox(keyPath)) console.log(line);
   console.log();
 
-  if (provider === "gemini") {
-    // Write .gemini/settings.json (project or global)
-    const geminiDir = useGlobal
-      ? join(homedir(), ".gemini")
-      : join(process.cwd(), ".gemini");
-    mkdirSync(geminiDir, { recursive: true });
-    const settingsPath = join(geminiDir, "settings.json");
-
-    // Merge with existing settings
+  const cfg = getProviderConfig(provider, process.cwd(), homedir(), useGlobal);
+  const serverEntry = {
+    command: "npx",
+    args: ["pairai", "serve"],
+    env: {
+      PAIRAI_HUB_URL: hubUrl,
+      PAIRAI_AGENT_CRED: apiKey,
+      PAIRAI_KEY_FILE: keyPath,
+    },
+  };
+
+  // Ensure config directory exists
+  mkdirSync(dirname(cfg.configPath), { recursive: true });
+
+  if (cfg.format === "toml") {
+    // Codex CLI uses TOML
+    let existing = "";
+    try { if (existsSync(cfg.configPath)) existing = readFileSync(cfg.configPath, "utf-8"); } catch {}
+    const tomlBlock = [
+      `\n[mcp_servers.${cfg.mcpKey}]`,
+      `command = "npx"`,
+      `args = ["pairai", "serve"]`,
+      ``,
+      `[mcp_servers.${cfg.mcpKey}.env]`,
+      `PAIRAI_HUB_URL = "${hubUrl}"`,
+      `PAIRAI_AGENT_CRED = "${apiKey}"`,
+      `PAIRAI_KEY_FILE = "${keyPath}"`,
+    ].join("\n");
+    writeFileSync(cfg.configPath, existing + tomlBlock + "\n");
+  } else {
+    // JSON — merge with existing config
     let existing: any = {};
-    try {
-      if (existsSync(settingsPath)) {
-        existing = JSON.parse(readFileSync(settingsPath, "utf-8"));
-      }
-    } catch {}
-
+    try { if (existsSync(cfg.configPath)) existing = JSON.parse(readFileSync(cfg.configPath, "utf-8")); } catch {}
     if (!existing.mcpServers) existing.mcpServers = {};
-    existing.mcpServers.pairai = {
-      command: "npx",
-      args: [`pairai@${VERSION}`, "serve"],
-      env: {
-        PAIRAI_HUB_URL: hubUrl,
-        PAIRAI_AGENT_CRED: apiKey,
-        PAIRAI_KEY_FILE: keyPath,
-      },
-    };
-
-    writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
-    console.log(`  Config: ${settingsPath}`);
-    console.log();
-    console.log(`  Next steps:`);
-    console.log(`    1. Restart Gemini CLI to activate the pairai MCP server`);
-    console.log(`    2. Ask Gemini: "Generate a pairing code"`);
-    console.log(`    3. Share the code with another agent to connect`);
-  } else {
-    // Write .mcp.json for Claude Code
-    const mcpConfig = {
-      mcpServers: {
-        "pairai-channel": {
-          command: "npx",
-          args: [`pairai@${VERSION}`, "serve"],
-          env: { PAIRAI_AGENT_CRED: apiKey, PAIRAI_HUB_URL: hubUrl, PAIRAI_KEY_FILE: keyPath },
-        },
-      },
-    };
+    existing.mcpServers[cfg.mcpKey] = serverEntry;
+    writeFileSync(cfg.configPath, JSON.stringify(existing, null, 2) + "\n");
+  }
 
-    const cwd = process.cwd();
-    const mcpJsonPath = join(cwd, ".mcp.json");
-    writeFileSync(mcpJsonPath, JSON.stringify(mcpConfig, null, 2) + "\n");
-    console.log(`  Config: ${mcpJsonPath}`);
+  console.log(`  Config: ${cfg.configPath}`);
+  console.log();
+  console.log(`  Next steps:`);
+  console.log(`    1. ${cfg.instruction}`);
+  console.log(`    2. Ask your AI: "Generate a pairing code"`);
+  console.log(`    3. Share the code with another agent to connect`);
+  if (provider === "claude") {
     console.log();
-    console.log(`  Next steps:`);
-    console.log(`    1. Start Claude Code in this directory`);
-    console.log(`    2. Ask Claude: "Generate a pairing code"`);
-    console.log(`    3. Share the code with another agent to connect`);
+    console.log(`  Optional: Enable real-time notifications (research preview):`);
+    console.log(`    claude --dangerously-load-development-channels`);
   }
 
   console.log();
@@ -218,8 +196,8 @@ if (command === "setup") {
 if (command !== "serve") {
   console.error(`pairai v${VERSION}\n`);
   console.error("Usage:");
-  console.error('  npx pairai setup "Agent Name" [--hub URL] [--provider claude|gemini] [--global] [--force]');
-  console.error("  npx pairai serve [--provider claude|gemini]");
+  console.error('  npx pairai setup "Agent Name" [--hub URL] [--provider claude|gemini|cursor|copilot|windsurf|codex|amazonq] [--global] [--force]');
+  console.error("  npx pairai serve [--provider claude|gemini|cursor|copilot|windsurf|codex|amazonq]");
   console.error("  npx pairai upgrade        — update to latest version");
   console.error("  npx pairai version        — show current version");
   process.exit(1);
@@ -238,7 +216,7 @@ if (serveProviderArg) {
     process.exit(1);
   }
 }
-const serveProvider = (serveProviderArg as "claude" | "gemini") ?? "claude";
+const serveProvider = (serveProviderArg as Provider) ?? "claude";
 
 const HUB_URL = process.env.PAIRAI_HUB_URL ?? process.env.PAIRAI_URL ?? "https://pairai.pro";
 const API_KEY = process.env.PAIRAI_AGENT_CRED ?? process.env.PAIRAI_API_KEY;
@@ -381,7 +359,7 @@ const capabilities = serveProvider === "claude"
   : { tools: {} };
 
 const mcp = new Server(
-  { name: "pairai", version: "1.0.0" },
+  { name: "pairai", version: VERSION },
   { capabilities, instructions }
 );
 
@@ -389,6 +367,16 @@ const mcp = new Server(
 
 mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
   tools: [
+    {
+      name: "pairai_check_updates",
+      description: "Check for new tasks or unread messages. Call this at the start of every conversation and periodically during active collaborations.",
+      inputSchema: {
+        type: "object" as const,
+        properties: {
+          acknowledge: { type: "boolean", description: "If true, marks all current updates as seen after returning them" },
+        },
+      },
+    },
     {
       name: "pairai_reply",
       description: "Send a message to the other agent in a task.",
@@ -463,6 +451,8 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
           description: { type: "string", description: "What this agent does (max 500 chars)" },
           capabilities: { type: "array", items: { type: "string" }, description: "List of capabilities, e.g. ['scheduling', 'code-review']" },
           metadata: { type: "object", description: "Arbitrary JSON metadata (max 4KB)" },
+          discoverable: { type: "boolean", description: "Whether to appear in the public agent directory" },
+          defaultApprovalRule: { type: "string", enum: ["auto", "require"], description: "Default approval rule for new connections" },
         },
       },
     },
@@ -478,6 +468,70 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
         required: ["connection_id"],
       },
     },
+    {
+      name: "pairai_update_webhook",
+      description: "Configure a webhook URL to receive events. Set url to null to disable.",
+      inputSchema: {
+        type: "object" as const,
+        properties: {
+          url: { type: ["string", "null"], description: "HTTPS webhook endpoint, or null to disable" },
+          secret: { type: "string", description: "Shared secret for HMAC-SHA256 signature (min 16 chars)" },
+          events: { type: "array", items: { type: "string" }, description: "Event types to receive (empty = all)" },
+        },
+      },
+    },
+    {
+      name: "pairai_discover_agents",
+      description: "Search the public directory of discoverable agents by capability or name.",
+      inputSchema: {
+        type: "object" as const,
+        properties: {
+          capability: { type: "string", description: "Filter by capability tag" },
+          query: { type: "string", description: "Search name and description" },
+          limit: { type: "number", description: "Max results (default 20)" },
+        },
+      },
+    },
+    {
+      name: "pairai_set_approval_rule",
+      description: "Set whether incoming tasks from a connection require human approval. 'auto' accepts automatically, 'require' holds tasks pending.",
+      inputSchema: {
+        type: "object" as const,
+        properties: {
+          connection_id: { type: "string", description: "Connection ID" },
+          rule: { type: "string", enum: ["auto", "require"], description: "Approval rule" },
+        },
+        required: ["connection_id", "rule"],
+      },
+    },
+    {
+      name: "pairai_list_pending_approvals",
+      description: "List tasks waiting for your approval.",
+      inputSchema: { type: "object" as const, properties: {} },
+    },
+    {
+      name: "pairai_approve_task",
+      description: "Approve a task that is pending your approval.",
+      inputSchema: {
+        type: "object" as const,
+        properties: {
+          task_id: { type: "string", description: "Task ID" },
+        },
+        required: ["task_id"],
+      },
+    },
+    {
+      name: "pairai_reject_task",
+      description: "Reject a task pending your approval. Optionally provide a reason.",
+      inputSchema: {
+        type: "object" as const,
+        properties: {
+          task_id: { type: "string", description: "Task ID" },
+          reason: { type: "string", description: "Reason for rejection" },
+        },
+        required: ["task_id"],
+      },
+    },
     {
       name: "pairai_list_tasks",
       description: "List all tasks you are involved in (as initiator or target).",
@@ -531,7 +585,55 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
 
 mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
   const { name, arguments: a } = req.params;
-  const args = a as Record<string, string>;
+  const args = a as Record<string, unknown>;
+
+  if (name === "pairai_check_updates") {
+    await loadPublicKeys();
+    const updates = (await hubGet("/updates")) as {
+      hasUpdates: boolean;
+      pendingTasks: Array<{ id: string; title: string; fromAgent: string }>;
+      unreadMessages: Array<{ taskId: string; taskTitle: string; count: number }>;
+    };
+
+    if (!updates.hasUpdates) {
+      return { content: [{ type: "text" as const, text: "No updates. You're all caught up." }] };
+    }
+
+    const parts: string[] = [];
+
+    if (updates.pendingTasks.length > 0) {
+      const enriched: string[] = [];
+      for (const task of updates.pendingTasks) {
+        const full = (await hubGet(`/tasks/${task.id}`)) as any;
+        const desc = full.encrypted ? decryptTaskDescription(full, task.id) : (full.description ?? "");
+        const title = desc.split("\n")[0] || task.title;
+        enriched.push(`- "${title}" from ${task.fromAgent} (task ID: ${task.id})`);
+      }
+      parts.push(`**${updates.pendingTasks.length} pending task(s):**\n${enriched.join("\n")}`);
+    }
+
+    if (updates.unreadMessages.length > 0) {
+      const enriched: string[] = [];
+      for (const unread of updates.unreadMessages) {
+        const full = (await hubGet(`/tasks/${unread.taskId}`)) as any;
+        const msgs = (full.messages ?? []) as Array<any>;
+        const recent = msgs.slice(-unread.count);
+        const previews: string[] = [];
+        for (const m of recent) {
+          const d = full.encrypted ? decryptMessage(m, unread.taskId) : { content: m.content, contentType: m.contentType };
+          previews.push(d.content.slice(0, 100));
+        }
+        enriched.push(`- ${unread.count} new in "${unread.taskTitle}" (task ID: ${unread.taskId})\n  Preview: ${previews.join(" | ")}`);
+      }
+      parts.push(`**Unread messages:**\n${enriched.join("\n")}`);
+    }
+
+    if ((args as any).acknowledge) {
+      await hubPost("/updates/ack");
+    }
+
+    return { content: [{ type: "text" as const, text: parts.join("\n\n") }] };
+  }
 
   if (name === "pairai_reply") {
     const { task_id, text, content_type } = args as { task_id: string; text: string; content_type?: string };
@@ -638,6 +740,8 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     if (args.description !== undefined) body.description = args.description;
     if (args.capabilities !== undefined) body.capabilities = args.capabilities;
     if (args.metadata !== undefined) body.metadata = args.metadata;
+    if (args.discoverable !== undefined) body.discoverable = args.discoverable === "true" || args.discoverable === true;
+    if (args.defaultApprovalRule !== undefined) body.defaultApprovalRule = args.defaultApprovalRule;
     const data = await hubPatch("/agents/me", body);
     return { content: [{ type: "text" as const, text: "Profile updated.\n" + JSON.stringify(data, null, 2) }] };
   }
@@ -648,6 +752,47 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
   }
 
+  if (name === "pairai_update_webhook") {
+    const body: Record<string, unknown> = {};
+    if (args.url !== undefined) body.webhookUrl = args.url;
+    if (args.secret !== undefined) body.webhookSecret = args.secret;
+    if (args.events !== undefined) body.webhookEvents = args.events;
+    const data = await hubPatch("/agents/me", body);
+    return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
+  }
+
+  if (name === "pairai_discover_agents") {
+    const params = new URLSearchParams();
+    if (args.capability) params.set("capability", args.capability);
+    if (args.query) params.set("q", args.query);
+    if (args.limit) params.set("limit", args.limit);
+    const qs = params.toString();
+    const data = await hubGet(`/agents/discover${qs ? `?${qs}` : ""}`);
+    return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
+  }
+
+  if (name === "pairai_set_approval_rule") {
+    const { connection_id, rule } = args as { connection_id: string; rule: string };
+    const data = await hubPatch(`/connections/${connection_id}`, { approval: rule });
+    return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
+  }
+
+  if (name === "pairai_list_pending_approvals") {
+    const data = await hubGet("/approvals");
+    return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
+  }
+
+  if (name === "pairai_approve_task") {
+    const data = await hubPost(`/approvals/${args.task_id}/approve`);
+    return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
+  }
+
+  if (name === "pairai_reject_task") {
+    const { task_id, reason } = args as { task_id: string; reason?: string };
+    const data = await hubPost(`/approvals/${task_id}/reject`, reason ? { reason } : undefined);
+    return { content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }] };
+  }
+
   if (name === "pairai_list_tasks") {
     await loadPublicKeys();
     const data = (await hubGet("/tasks")) as Array<{
@@ -813,6 +958,7 @@ async function poll() {
         descriptionKeys?: any;
         senderSignature?: string;
         initiatorAgentId?: string;
+        approvalStatus?: string | null;
         messages: Array<{
           content: string;
           contentType: string;
@@ -828,15 +974,26 @@ async function poll() {
         return d.content;
       });
 
-      const body = [desc || task.title, ...decryptedMessages.map((c) => `> ${c}`)].join("\n\n");
+      const isPendingApproval = full.approvalStatus === "pending";
+      const approvalPrefix = isPendingApproval ? "[APPROVAL REQUIRED] " : "";
+      const approvalSuffix = isPendingApproval
+        ? `\n\nThis task requires your approval before the agent will act on it.\nUse pairai_approve_task or pairai_reject_task with task ID: ${task.id}`
+        : "";
 
-      await mcp.notification({
-        method: "notifications/claude/channel",
-        params: {
-          content: body,
-          meta: { task_id: task.id, task_title: task.title, from_agent: task.fromAgent, event_type: "new_task" },
-        },
-      });
+      const body = approvalPrefix + [desc || task.title, ...decryptedMessages.map((c) => `> ${c}`)].join("\n\n") + approvalSuffix;
+
+      try {
+        await mcp.notification({
+          method: "notifications/claude/channel",
+          params: {
+            content: body,
+            meta: { task_id: task.id, task_title: task.title, from_agent: task.fromAgent, event_type: "new_task" },
+          },
+        });
+        console.error(`[pairai] channel notification sent: new_task ${task.id} from ${task.fromAgent}${isPendingApproval ? " [APPROVAL REQUIRED]" : ""}`);
+      } catch (err) {
+        console.error(`[pairai] channel notification FAILED: ${(err as Error).message}`);
+      }
     }
 
     for (const unread of updates.unreadMessages) {
@@ -859,19 +1016,24 @@ async function poll() {
 
         const decrypted = decryptMessage(msg, unread.taskId);
 
-        await mcp.notification({
-          method: "notifications/claude/channel",
-          params: {
-            content: decrypted.content,
-            meta: {
-              task_id: unread.taskId,
-              task_title: unread.taskTitle,
-              from_agent: msg.senderAgentId,
-              event_type: "new_message",
-              content_type: decrypted.contentType,
+        try {
+          await mcp.notification({
+            method: "notifications/claude/channel",
+            params: {
+              content: decrypted.content,
+              meta: {
+                task_id: unread.taskId,
+                task_title: unread.taskTitle,
+                from_agent: msg.senderAgentId,
+                event_type: "new_message",
+                content_type: decrypted.contentType,
+              },
             },
-          },
-        });
+          });
+          console.error(`[pairai] channel notification sent: new_message in ${unread.taskId}`);
+        } catch (err) {
+          console.error(`[pairai] channel notification FAILED: ${(err as Error).message}`);
+        }
       }
     }
 
@@ -884,7 +1046,26 @@ async function poll() {
 // ── Start ────────────────────────────────────────────────────────────────────
 
 await mcp.connect(new StdioServerTransport());
+console.error(`[pairai] connected. provider=${serveProvider} channel=${!!capabilities.experimental?.["claude/channel"]} agent=${myAgentId || "(loading)"}`);
 await loadAgentInfo();
+if (!myAgentId) {
+  console.error("[pairai] failed to load agent info from hub. Cannot start polling.");
+  process.exit(1);
+}
 await loadPublicKeys();
+
+// Acquire polling lock — only one channel process per agent
+const lockDir = process.env.PAIRAI_LOCK_DIR || undefined;
+if (!acquireLock(myAgentId, lockDir)) {
+  console.error(`[pairai] another instance is already polling for agent ${myAgentId}. Exiting.`);
+  process.exit(0);
+}
+const cleanupLock = () => { try { releaseLock(myAgentId, lockDir); } catch {} };
+process.on("SIGTERM", cleanupLock);
+process.on("SIGINT", cleanupLock);
+process.on("beforeExit", cleanupLock);
+process.on("exit", cleanupLock);
+
+console.error(`[pairai] agent=${myAgentId} keys=${pubKeyCache.size} polling every ${POLL_MS}ms`);
 setInterval(poll, POLL_MS);
 poll();