paseo-room 0.11.0 → 0.13.0

package/README.md

@@ -311,6 +311,7 @@ still required where Paseo launch state outranks the agent's own configuration:
 | `disableAgentView: true` + `CLAUDE_CODE_DISABLE_AGENT_VIEW=1` | Claude | Disables Claude's separate background-agent control plane across settings scopes and at launch. |
 | `disableWorkflows: true` + `CLAUDE_CODE_DISABLE_WORKFLOWS=1` | Claude | Disables dynamic workflows through every entry point, beyond denying the `Workflow` tool. |
 | `crossSessionInbound: "refuse"` | Claude | Prevents another Claude session from injecting a turn into a room seat. |
+| `disableClaudeAiConnectors: true` + `ENABLE_CLAUDEAI_MCP_SERVERS=0` | Claude | Keeps the signed-in account's claude.ai connectors (Canva, Claude Docs, …) out of every seat. They bypass the room's MCP check and reach Peer, and one that needs authorising makes each seat ask you to connect it. Your own Claude Code sessions keep them. |
 | strict argv + `PI_MCP_CONFIG_MODE=exclusive` + additive runtime capsule | Pi | Disables extension discovery and project trust, and restricts adapter config to the role-home `mcp.json`; forbids a second agent control plane without claiming sandboxing. |
 | `paseoTools: {enabled}` | all | Room tools for Supervisor and Lead, never for Peer. |
 
@@ -353,10 +354,11 @@ list is written to both provider `disallowedTools` and every role's `settings.js
 `permissions.deny`. The role file is minimal, deterministic room policy: it does not copy operator
 env, hooks, permissions, or auth helpers. The room does not write `permissions.defaultMode`:
 Paseo passes the profile's mode as a command-line session setting, which outranks that file. The two
-Claude disable environment keys are likewise pinned in both the provider and generated
-`settings.json`, because Claude applies settings-file environment values after launch values.
-The generated top-level `disableAgentView` and `disableWorkflows` settings are also forced to
-`true`; their restrictive value cannot be weakened by another ordinary settings scope.
+Claude disable environment keys, `ENABLE_CLAUDEAI_MCP_SERVERS=0` among them, are likewise pinned in
+both the provider and generated `settings.json`, because Claude applies settings-file environment
+values after launch values. The generated top-level `disableAgentView`, `disableWorkflows` and
+`disableClaudeAiConnectors` settings are also forced to `true`; their restrictive value cannot be
+weakened by another ordinary settings scope.
 
 No default model is pinned. The profile schema supports `model`, but leaving it absent lets
 each provider use its current default and avoids silently choosing a cost/capability tier for
@@ -656,6 +658,10 @@ npx paseo-room verify
     daemon restart, so Claude compacts at that share instead of near the end of a 1M window. An open
     session keeps what it opened with. Codex and Pi seats show their context and keep their own
     compaction.
+  - A mark applies to a seat only where it comes to at least 150k tokens on its window: at 30%, a
+    Lead on a 1M model is reported at 300k, but one on a 272k Codex or Pi model, or a 200k Claude
+    model, is not reported and keeps its agent's own compaction. The hints show what each mark comes
+    to per window.
 - **A runtime-dispatched Peer** is titled `<Disposition> · <outcome gist> · <assignment id>` (for
   example `Reviewer · Review the Docker Compose dev env… · asg_…`), and the runtime's notices to Lead
   name the assignment the same way. It gets exactly two tools, `ask` and `handoff`, for its own
@@ -715,12 +721,19 @@ learn only when you ask it to check.
     incident on one beginning `INCIDENT:`. The first wakes the Supervisor and the second pages it,
     even for a turn it prompted, once per line, and the letter quotes those lines rather than the
     message's end.
+  - A Lead turn that read the Supervisor's `message_lead` answers it. The answer goes to the
+    Supervisor as soon as it is idle, with up to 1,500 characters of the Lead's message, even with
+    letters off, and no later turn replaces it.
+  - A Lead turn that began with the runtime's notices and left a Peer working is progress. It goes
+    with the Supervisor's next letter and never wakes it alone; once the loop leaves nothing
+    running, its next turn is news again.
   - Letters are held until the Supervisor is idle, batched into digests, and limited to a few wakes
-    an hour. They are never sent while the Supervisor holds a permission, because a send would
-    deny it.
-  - Each item has an id for `attention_feedback`, and a letter's own id rates every item in it. A
-    letter is evidence, not an instruction: the Supervisor contract has it ask or nudge the Lead, or
-    relay a question to you, and never direct a Peer.
+    an hour; a `NEEDS-HUMAN` line and an answer are never held back by that limit. Letters are never
+    sent while the Supervisor holds a permission or a question to you, because a send would deny it.
+  - Each item has an id for `attention_feedback`, and a letter's own id rates every item in it. The
+    Supervisor rates only noise; an item it leaves unrated counts as useful. A letter is evidence,
+    not an instruction: the Supervisor contract has it ask or nudge the Lead, or relay a question to
+    you, and never direct a Peer.
 - **Starting seats.** From the **Room** view, **New Supervisor** opens one in an existing directory
   outside every repository. **Add repository** checks a repository, opens its Lead under the
   Supervisor you pick, and sends a fixed kickoff with your first directive verbatim; it also offers
@@ -749,10 +762,10 @@ learn only when you ask it to check.
     Lead is not running, when Paseo would take none.
   - **The Supervisor may do the same**, but only for a Lead of its own project that is past its
     rotation mark, through the runtime's `lead_replace_*` tools. The runtime refuses a Lead below
-    the mark and applies the same quiet-point checks. The Supervisor reviews the handoff against the
-    repository, confirms it, and tells you which Lead now owns the project. The panel shows a
-    replacement the Supervisor started, and you may cancel it until it completes. Any other reason to
-    replace a Lead stays yours.
+    the mark, or on a window where the mark does not apply, and applies the same quiet-point
+    checks. The Supervisor reviews the handoff against the repository, confirms it, and tells you
+    which Lead now owns the project. The panel shows a replacement the Supervisor started, and you
+    may cancel it until it completes. Any other reason to replace a Lead stays yours.
 - **Settings › Room attention.** Here you turn letters on or off, see what reached Supervisors in
   the last 24 hours (letters by level, incidents, Lead turns by what was decided, and the ratings you
   or a Supervisor gave), change when a Supervisor is told and how often, and configure the optional

package/dist/index.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "paseo-room",
-      version: "0.11.0",
+      version: "0.13.0",
       description: "One CLI that configures Codex, Claude Code, and Pi role homes in $HOME and registers them with your local Paseo daemon.",
       keywords: [
         "paseo",
@@ -1186,7 +1186,7 @@ function renderRoleSettings(role, secureStorageDir) {
   const settings = {
     // Claude applies settings.env after the launch environment, so repeat provider closures here.
     env: {
-      ...CONTROL_PLANE_ENV,
+      ...LAUNCH_ENV,
       PASEO_ROOM_ROLE: role,
       ...secureStorageDir === void 0 ? {} : { [SECURE_STORAGE_ENV]: secureStorageDir }
     },
@@ -1195,6 +1195,7 @@ function renderRoleSettings(role, secureStorageDir) {
     // These restrictive settings cannot be weakened by another settings scope.
     disableAgentView: true,
     disableWorkflows: true,
+    disableClaudeAiConnectors: true,
     crossSessionInbound: "refuse"
   };
   return JSON.stringify(settings, null, 2) + "\n";
@@ -1252,7 +1253,7 @@ function mcpDriftCheck(role, home, path, divergence) {
     `If this role should have the same servers, add them with: CLAUDE_CONFIG_DIR=${home} claude mcp add ... \u2014 or delete ${path} and run setup --apply to reseed it from your current Claude state, which discards that role's other runtime state.`
   );
 }
-var SHARED, EXECUTABLE, RUNTIME_SKILLS, MCP_KEY, AUTH_ENV, CONTROL_PLANE_ENV, DISALLOWED_TOOLS, SECURE_STORAGE_ENV, SEEDED_KEYS, claudeAgent;
+var SHARED, EXECUTABLE, RUNTIME_SKILLS, MCP_KEY, AUTH_ENV, CONTROL_PLANE_ENV, CONNECTOR_ENV, LAUNCH_ENV, DISALLOWED_TOOLS, SECURE_STORAGE_ENV, SEEDED_KEYS, claudeAgent;
 var init_claude = __esm({
   "src/agents/claude.ts"() {
     "use strict";
@@ -1290,6 +1291,8 @@ var init_claude = __esm({
       CLAUDE_CODE_DISABLE_AGENT_VIEW: "1",
       CLAUDE_CODE_DISABLE_WORKFLOWS: "1"
     };
+    CONNECTOR_ENV = { ENABLE_CLAUDEAI_MCP_SERVERS: "0" };
+    LAUNCH_ENV = { ...CONTROL_PLANE_ENV, ...CONNECTOR_ENV };
     DISALLOWED_TOOLS = [
       "Task",
       "Agent",
@@ -1312,8 +1315,9 @@ var init_claude = __esm({
       id: "claude",
       label: "Claude Code",
       homeEnv: "CLAUDE_CONFIG_DIR",
-      // Agent View and dynamic workflows have entry points beyond model tool calls.
-      providerEnv: CONTROL_PLANE_ENV,
+      // Agent View and dynamic workflows have entry points beyond model tool calls, and claude.ai
+      // connectors arrive with the account rather than from any declaration the room inspects.
+      providerEnv: LAUNCH_ENV,
       defaultModeId: "bypassPermissions",
       // Keep the legacy Task name and block current native orchestration,
       // shared task/cron coordination, and cross-session paths. Paseo alone owns