talon-agent 5.0.0 → 5.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -99,7 +99,7 @@
     "build:fusefs": "node native/talon-fusefs/build.mjs"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.197",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.277",
     "@anthropic-ai/sdk": "^0.104.1",
     "@brave/brave-search-mcp-server": "^2.0.75",
     "@clack/prompts": "^1.2.0",

package/src/app.ts

@@ -7,7 +7,7 @@
  */
 
 import { getFrontends } from "./core/config/index.js";
-import { startUploadCleanup, stopUploadCleanup } from "./util/workspace.js";
+import { startUploadCleanup, stopUploadCleanup } from "./core/vfs/workspace.js";
 import { flushDatabase } from "./storage/db.js";
 import { getActiveCount, stopAllTurns } from "./core/engine/dispatcher.js";
 import {
@@ -28,9 +28,9 @@ import {
 import { shutdownTriggers } from "./core/background/triggers/index.js";
 import { pruneSettledTriggers } from "./storage/triggers.js";
 import { startWatchdog, stopWatchdog } from "./util/watchdog.js";
-import { spawnSuccessor } from "./util/respawn.js";
+import { spawnSuccessor } from "./core/daemon/respawn.js";
 import { log, logError, logWarn } from "./util/log.js";
-import { bootPhase, bootReport } from "./util/boot-timer.js";
+import { bootPhase, bootReport } from "./core/daemon/boot-timer.js";
 import {
   getVfs,
   mountNamespaceFs,

package/src/backend/claude-sdk/factory.ts

@@ -24,23 +24,12 @@ import {
   type ToolRuntime,
   type UsageTelemetry,
 } from "../../core/agent-runtime/capabilities.js";
-import { getPlanUsage } from "./plan-usage.js";
 
 import {
-  initAgent as initClaudeAgent,
   updateSystemPrompt as claudeUpdateSystemPrompt,
-  warmSession as claudeWarmSession,
-  getActiveQuery,
-  buildMcpServers,
-  buildPluginMcpServers,
-  runOneShotAgent as claudeRunOneShotAgent,
   evictOrphanSubprocesses as claudeEvictOrphanSubprocesses,
 } from "./index.js";
-import {
-  runChatTurn as claudeRunChatTurn,
-  interruptChatTurn as claudeInterruptChatTurn,
-} from "./handler.js";
-import { waitForMcpServersReady } from "./mcp-ready.js";
+import { createInProcessAgentHost } from "./host/in-process.js";
 
 import * as modelProvider from "./model-provider.js";
 import { claudeDoctorChecks } from "./doctor.js";
@@ -54,16 +43,25 @@ const claudeSdkFactory: BackendFactory = {
   doctor: (config, isActive) => claudeDoctorChecks(config, isActive),
 
   async init(config, ctx) {
-    await initClaudeAgent(config, ctx.getBridgePort);
+    // Everything SDK-side goes through the agent-host seam
+    // (docs/agent-host-sidecar.md). Phase 1 binds the in-process client,
+    // which calls the same functions this factory used to call inline;
+    // Phase 2 swaps in a process-backed client behind the same interface.
+    const host = createInProcessAgentHost(config, ctx.getBridgePort);
+    await host.hello();
     log("bot", "Backend: Claude SDK (@anthropic-ai/claude-agent-sdk)");
 
     const chat: ChatBackend = {
-      runChatTurn: (params) => claudeRunChatTurn(params),
-      interruptChatTurn: (chatId) => claudeInterruptChatTurn(chatId),
+      runChatTurn: (params) => host.runTurn(params),
+      interruptChatTurn: (chatId) => host.interrupt(chatId),
     };
 
     const background: BackgroundRunner = {
-      runOneShotAgent: (p) => claudeRunOneShotAgent(p),
+      runOneShotAgent: (p) => host.runOneShot(p),
+      // Not a protocol-table row yet: subprocess eviction reaches into
+      // the SDK's own children, so it belongs to the host — but the
+      // design's message table has no request for it. Tracked as an open
+      // question against Phase 2; bound directly until it gains one.
       evictOrphanSubprocesses: (label) => claudeEvictOrphanSubprocesses(label),
     };
 
@@ -81,7 +79,10 @@ const claudeSdkFactory: BackendFactory = {
       getProviderModels: (p, pg, ps) =>
         modelProvider.getProviderModels(p, pg, ps),
       formatModelError: (q, r) => modelProvider.formatModelError(q, r),
-      listModels: (f) => modelProvider.listModels(f),
+      // The one catalog member that asks the host: `list_models` is the
+      // protocol's model row. The seven above are daemon-side formatting
+      // over `core/models/catalog.ts`, which `hello` populates.
+      listModels: (f) => host.listModels(f),
     };
 
     // Claude SDK's per-turn subprocess model has no shared session
@@ -89,32 +90,11 @@ const claudeSdkFactory: BackendFactory = {
     // dispatcher's `/reset` clears Talon's stored session id via
     // `storage/sessions.ts:resetSession` regardless.
     const sessions: SessionBackend = {
-      warmSession: (chatId) => claudeWarmSession(chatId),
+      warmSession: (chatId) => host.warmSession(chatId),
     };
 
     const tools: ToolRuntime = {
-      refreshTools: async (chatId) => {
-        const qi = getActiveQuery(chatId);
-        if (!qi) return null;
-        // Two-phase teardown: remove all MCP servers first so each
-        // subprocess receives an OS-agnostic shutdown via stdio, then
-        // install the fresh set.
-        await qi.setMcpServers({});
-        const freshServers = {
-          ...buildMcpServers(chatId),
-          ...buildPluginMcpServers(chatId),
-        };
-        const result = await qi.setMcpServers(freshServers);
-        // setMcpServers resolves on REGISTER, not CONNECT — MCP startup is
-        // non-blocking. A stdio server that dials a slow remote (e.g. the
-        // playwright plugin connecting to the Camoufox websocket) is still
-        // 'pending' at this point and its tools are absent from the live
-        // registry, so the turn would proceed with mcp__playwright-tools__*
-        // stuck "connecting" until the next refresh. Wait (bounded) for the
-        // newly-added servers to finish connecting before returning.
-        await waitForMcpServersReady(qi, result.added);
-        return result;
-      },
+      refreshTools: (chatId) => host.refreshTools(chatId),
     };
 
     const control: SystemControl = {
@@ -124,7 +104,7 @@ const claudeSdkFactory: BackendFactory = {
     // No per-session snapshot to offer (each turn is a fresh subprocess),
     // but the subscription's rate-limit windows are readable.
     const usage: UsageTelemetry = {
-      getPlanUsage: () => getPlanUsage(),
+      getPlanUsage: () => host.planUsage(),
     };
 
     const backend = composeBackend({

package/src/backend/claude-sdk/handler.ts

@@ -156,23 +156,48 @@ function createPostResultWatchdog(
 }
 
 // ── Active query store ──────────────────────────────────────────────────────
-// Holds the Query reference for each in-flight chat so gateway actions
-// (e.g. reload_plugins) can call control methods like setMcpServers().
+// Holds the in-flight turn for each chat so gateway actions (e.g.
+// reload_plugins) can call control methods like setMcpServers(), and so a
+// user-driven stop can mark the very turn it interrupts.
 
-const activeQueries = new Map<string, Query>();
+type ActiveTurn = {
+  qi: Query;
+  /**
+   * Set by `interruptChatTurn` the moment a stop is requested. The turn's
+   * close-out reads it to tell a deliberate stop from a fault: whatever
+   * the SDK does after an interrupt is the stop.
+   *
+   * Since SDK 0.3.x that is emphatically not a clean `result`. The CLI
+   * emits an `is_error` result whose `errors[]` holds only an
+   * `[ede_diagnostic] …` line, `Query.readMessages` keeps it as
+   * `lastErrorResultText`, and when the underlying stream then errors the
+   * SDK replaces the error with `Error("Claude Code returned an error
+   * result: " + lastErrorResultText)`. Unmarked, that reads as a genuine
+   * SDK failure: an ERROR log per /stop, failed-turn accounting, and a
+   * fallback-model retry of the turn the user just stopped.
+   */
+  interrupted: boolean;
+};
+
+const activeQueries = new Map<string, ActiveTurn>();
 
 /**
  * Best-effort graceful interrupt of a chat's in-flight turn. Uses the SDK's
- * native `Query.interrupt()`, which stops the agent loop and closes the stream
- * with a `result` (subtype `interrupt`) — so the turn ends as a normal
- * completion (turn_end + usage), NOT an error, and never trips the
- * model-fallback retry path. No-op (returns false) when no turn is running.
+ * native `Query.interrupt()`, which stops the agent loop — so the turn ends
+ * as a normal completion (turn_end + usage), NOT an error, and never trips
+ * the model-fallback retry path.
+ *
+ * The turn is marked BEFORE the native interrupt is fired, exactly as the
+ * shared `runtime/turn/turn-interrupt.ts` marks `state.turnTerminated`
+ * first: the mark, not the SDK's own close-out shape, is what makes the
+ * contract above true. No-op (returns false) when no turn is running.
  */
 export async function interruptChatTurn(chatId: string): Promise<boolean> {
-  const qi = activeQueries.get(chatId);
-  if (!qi) return false;
+  const active = activeQueries.get(chatId);
+  if (!active) return false;
+  active.interrupted = true;
   try {
-    await qi.interrupt();
+    await active.qi.interrupt();
     log("agent", `[${chatId}] turn interrupted by user`);
     incrementCounter("sdk.turn_interrupted");
     return true;
@@ -187,7 +212,7 @@ export async function interruptChatTurn(chatId: string): Promise<boolean> {
 
 /** Get the active Query for a chat, if one is in flight. */
 export function getActiveQuery(chatId: string): Query | undefined {
-  return activeQueries.get(chatId);
+  return activeQueries.get(chatId)?.qi;
 }
 
 // ── Internal state passed across recursive retry calls ──────────────────────
@@ -428,12 +453,6 @@ function accountFailedClaudeTurn(
   model: string,
   durationMs: number,
 ): void {
-  const sawResultUsage =
-    state.sdkInputTokens +
-      state.sdkOutputTokens +
-      state.sdkCacheRead +
-      state.sdkCacheWrite >
-    0;
   accountFailedTurn({
     backend: "claude",
     chatId,
@@ -441,7 +460,7 @@ function accountFailedClaudeTurn(
     durationMs,
     model,
     apiCalls: state.numApiCalls || live.calls,
-    usage: sawResultUsage
+    usage: sawResultUsage(state)
       ? turnUsageSnapshot(state)
       : {
           inputTokens: live.input,
@@ -452,6 +471,37 @@ function accountFailedClaudeTurn(
   });
 }
 
+/** Whether the turn's `result` message reported any tokens at all. */
+function sawResultUsage(state: StreamState): boolean {
+  return (
+    state.sdkInputTokens +
+      state.sdkOutputTokens +
+      state.sdkCacheRead +
+      state.sdkCacheWrite >
+    0
+  );
+}
+
+/**
+ * Close out a turn the user stopped. An interrupt is a completion, so it
+ * accounts like one (`accountTurn`, not `accountFailedTurn` — nothing
+ * failed) — but the `result` message may never have landed, leaving
+ * `state.sdk*` at zero while the per-API-call accumulator holds what the
+ * turn really burned. Fold the accumulator in so a stop doesn't lose the
+ * tokens, and mark the turn terminated so the flow-violation re-prompt
+ * can't resurrect what the user just stopped (the same guarantee
+ * `runtime/turn/turn-interrupt.ts` gives the callback backends).
+ */
+function closeInterruptedTurn(state: StreamState, live: LiveUsage): void {
+  state.turnTerminated = true;
+  if (sawResultUsage(state)) return;
+  state.sdkInputTokens = live.input;
+  state.sdkOutputTokens = live.output;
+  state.sdkCacheRead = live.cacheRead;
+  state.sdkCacheWrite = live.cacheWrite;
+  if (!state.numApiCalls) state.numApiCalls = live.calls;
+}
+
 /**
  * The aggregate `cache=NN%` can't distinguish a turn that reused the
  * previous turn's prefix from one that re-wrote it — see
@@ -488,6 +538,105 @@ function reportCacheVerdict(
   noteLookbackRisk(chatId, state.toolCalls);
 }
 
+// ── Stream phase ────────────────────────────────────────────────────────────
+
+/** What the stream phase left for the rest of the turn to do. */
+type StreamOutcome =
+  /** Run the normal post-stream phases (this includes every user stop). */
+  | { kind: "ok" }
+  /** A retry already ran to completion and yielded its own events. */
+  | { kind: "retried" }
+  /** Terminal failure — account for it and yield this `error` event. */
+  | { kind: "failed"; event: AgentEvent };
+
+/**
+ * Drive the SDK stream to exhaustion and decide what its ending means.
+ * Owns the error recovery (retry decision, model fallback) and the
+ * user-interrupt contract; releases the watchdog timer and the
+ * `activeQueries` entry on every exit.
+ */
+async function* runTurnStream(inputs: {
+  chatId: string;
+  params: ChatRunParams;
+  internal: InternalState;
+  active: ActiveTurn;
+  state: StreamState;
+  live: LiveUsage;
+  watchdog: PostResultWatchdog;
+  /** Model the turn is accounted against. */
+  activeModel: string;
+  /** Model string the SDK attributes the result message's usage to. */
+  sdkModel: string;
+}): AsyncGenerator<AgentEvent, StreamOutcome, void> {
+  const { chatId, active, state, live, watchdog } = inputs;
+  try {
+    yield* consumeSdkStream({
+      chatId,
+      qi: active.qi,
+      state,
+      live,
+      watchdog,
+      model: inputs.sdkModel,
+      pendingTools: new Map(),
+    });
+    // The SDK doesn't throw on API errors — it converts them into a
+    // synthetic assistant message and finishes the turn with an error-
+    // flagged result (usage limits, 429s, auth failures all land here).
+    // Rethrow so this turn takes the SAME path as a thrown SDK error
+    // instead of tripping the flow-violation re-prompt loop against an
+    // already-exhausted limit.
+    //
+    // …unless the user stopped this turn: an interrupted turn's result is
+    // flagged `is_error` with nothing but an `[ede_diagnostic]` line
+    // behind it, which `readResultError` then renders as bare trailing
+    // text or "Claude SDK turn failed (<subtype>)". That is the stop, not
+    // a failure — the turn closes as a completion.
+    if (state.resultErrorText && !active.interrupted) {
+      throw new Error(state.resultErrorText);
+    }
+  } catch (err) {
+    if (active.interrupted) {
+      // Same deal one layer down: after an interrupt the SDK re-labels the
+      // stream error with that error-result text. Quiet by design — no
+      // `logError`, no retry decision (which would classify the ede text,
+      // bump `errors.*`, and could fall back to another model for a turn
+      // the user just stopped), no `error` event. The shutdown drain takes
+      // this same path: its abort interrupts through here too.
+      log(
+        "agent",
+        `[${chatId}] turn ended by user interrupt: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+      incrementCounter("sdk.interrupt_closed_stream");
+    } else if (!watchdog.forceClosed) {
+      const { retried, classified } = yield* applyRetryDecisionStream({
+        err,
+        chatId,
+        activeModel: inputs.activeModel,
+        retried: inputs.internal.errorRetried ?? false,
+        buildRetryStream: retryStreamBuilder(inputs.params, inputs.internal),
+        // No backendLabel — historical claude-sdk log shape was un-prefixed.
+      });
+      if (retried) return { kind: "retried" };
+      logError("agent", `[${chatId}] SDK error: ${classified.message}`);
+      // Returning (rather than yielding) here defers the `error` event
+      // until after `finally` releases the watchdog timer and the
+      // activeQueries entry.
+      return {
+        kind: "failed",
+        event: { type: "error", error: classifiedToAgentError(classified) },
+      };
+    }
+  } finally {
+    watchdog.clear();
+    if (activeQueries.get(chatId) === active) {
+      activeQueries.delete(chatId);
+    }
+  }
+  return { kind: "ok" };
+}
+
 // ── Main chat-turn generator ────────────────────────────────────────────────
 
 /**
@@ -498,7 +647,11 @@ function reportCacheVerdict(
  * recurse via `yield*` and produce the retry's event stream
  * transparently). On flow violation: `yield* runChatTurn(retry
  * params)` — the recursive call owns its `incrementTurns`, the
- * caller deliberately doesn't increment.
+ * caller deliberately doesn't increment. On a user interrupt
+ * (`interruptChatTurn`, which also backs the shutdown drain): the turn
+ * closes as a completion carrying the partial text and the real usage —
+ * never an `error` event, never a retry, whatever shape the SDK chose to
+ * end the stream in.
  */
 export async function* runChatTurn(
   params: ChatRunParams,
@@ -552,7 +705,8 @@ export async function* runChatTurn(
   yield { type: "run_started" };
 
   const qi = query({ prompt, options });
-  activeQueries.set(chatId, qi);
+  const active: ActiveTurn = { qi, interrupted: false };
+  activeQueries.set(chatId, active);
 
   // Cold-start delivery-tool race: on the FIRST turn of a freshly-opened
   // chat the hub's `${frontend}-tools` binding can still be `pending` when
@@ -567,59 +721,27 @@ export async function* runChatTurn(
   const live = createLiveUsage();
   const watchdog = createPostResultWatchdog(chatId, abortController, qi);
 
-  let propagateError: AgentEvent | null = null;
-  try {
-    yield* consumeSdkStream({
-      chatId,
-      qi,
-      state,
-      live,
-      watchdog,
-      model: options.model ?? activeModel,
-      pendingTools: new Map(),
-    });
-    // The SDK doesn't throw on API errors — it converts them into a
-    // synthetic assistant message and finishes the turn with an error-
-    // flagged result (usage limits, 429s, auth failures all land here).
-    // Rethrow so this turn takes the SAME path as a thrown SDK error
-    // instead of tripping the flow-violation re-prompt loop against an
-    // already-exhausted limit.
-    if (state.resultErrorText) {
-      throw new Error(state.resultErrorText);
-    }
-  } catch (err) {
-    if (!watchdog.forceClosed) {
-      const { retried, classified } = yield* applyRetryDecisionStream({
-        err,
-        chatId,
-        activeModel,
-        retried: _internal.errorRetried ?? false,
-        buildRetryStream: retryStreamBuilder(params, _internal),
-        // No backendLabel — historical claude-sdk log shape was un-prefixed.
-      });
-      // The recursive stream already yielded its own usage + completed.
-      if (retried) return;
-      logError("agent", `[${chatId}] SDK error: ${classified.message}`);
-      // Defer the yield until after `finally` releases the watchdog timer
-      // and the activeQueries entry.
-      propagateError = {
-        type: "error",
-        error: classifiedToAgentError(classified),
-      };
-    }
-  } finally {
-    watchdog.clear();
-    if (activeQueries.get(chatId) === qi) {
-      activeQueries.delete(chatId);
-    }
-  }
-
-  if (propagateError) {
+  const outcome = yield* runTurnStream({
+    chatId,
+    params,
+    internal: _internal,
+    active,
+    state,
+    live,
+    watchdog,
+    activeModel,
+    sdkModel: options.model ?? activeModel,
+  });
+  // The recursive retry stream already yielded its own usage + completed.
+  if (outcome.kind === "retried") return;
+  if (outcome.kind === "failed") {
     accountFailedClaudeTurn(chatId, state, live, activeModel, Date.now() - t0);
-    yield propagateError;
+    yield outcome.event;
     return;
   }
 
+  if (active.interrupted) closeInterruptedTurn(state, live);
+
   const durationMs = Date.now() - t0;
   accountTurn({
     chatId,

package/src/backend/claude-sdk/host/in-process.ts

@@ -0,0 +1,147 @@
+/**
+ * The in-process agent host — `AgentHostClient` implemented as direct
+ * calls into `backend/claude-sdk/`.
+ *
+ * `docs/agent-host-sidecar.md` Phase 1. This is the implementation that
+ * keeps today's behaviour exactly: every method is a call-through to the
+ * function the claude-sdk `BackendFactory` used to call itself. There is
+ * no process, no framing and no logic of its own — the only code that
+ * moved here is `refreshTools`' two-phase MCP teardown, which had to,
+ * because it drives a `Query` handle and handles do not cross a process
+ * boundary.
+ *
+ * Phase 2 adds a sibling that speaks the same interface over a child
+ * process's stdio. Nothing above this file changes when it does.
+ */
+
+import type {
+  AgentHostClient,
+  HostReadyInfo,
+  HostSessionInfo,
+  HostToolRefresh,
+} from "../../../core/agent-runtime/agent-host.js";
+import { AGENT_HOST_PROTOCOL_VERSION } from "../../../core/agent-runtime/agent-host.js";
+import type { TalonConfig } from "../../../core/config/index.js";
+import { getSession } from "../../../storage/sessions.js";
+import { talonVersion } from "../../../util/version.js";
+
+import {
+  initAgent as claudeInitAgent,
+  warmSession as claudeWarmSession,
+  getActiveQuery,
+  buildMcpServers,
+  buildPluginMcpServers,
+  runOneShotAgent as claudeRunOneShotAgent,
+} from "../index.js";
+import {
+  runChatTurn as claudeRunChatTurn,
+  interruptChatTurn as claudeInterruptChatTurn,
+} from "../handler.js";
+import { waitForMcpServersReady } from "../mcp-ready.js";
+import { listModels as claudeListModels } from "../model-provider.js";
+import { getPlanUsage } from "../plan-usage.js";
+
+/**
+ * Install an MCP server set on the chat's live query. `null` when the
+ * chat has no query in flight — the same "nothing to refresh" answer
+ * `ToolRuntime.refreshTools` has always given.
+ */
+async function setMcpServers(
+  chatId: string,
+  servers: Record<string, unknown>,
+): Promise<HostToolRefresh | null> {
+  const qi = getActiveQuery(chatId);
+  if (!qi) return null;
+  return qi.setMcpServers(servers as Parameters<typeof qi.setMcpServers>[0]);
+}
+
+/**
+ * Re-derive the chat's MCP config from the live plugin registry. Body
+ * lifted verbatim from the claude-sdk factory's `tools.refreshTools`,
+ * comments included — the ordering is load-bearing.
+ */
+async function refreshTools(chatId: string): Promise<HostToolRefresh | null> {
+  const qi = getActiveQuery(chatId);
+  if (!qi) return null;
+  // Two-phase teardown: remove all MCP servers first so each
+  // subprocess receives an OS-agnostic shutdown via stdio, then
+  // install the fresh set.
+  await qi.setMcpServers({});
+  const freshServers = {
+    ...buildMcpServers(chatId),
+    ...buildPluginMcpServers(chatId),
+  };
+  const result = await qi.setMcpServers(freshServers);
+  // setMcpServers resolves on REGISTER, not CONNECT — MCP startup is
+  // non-blocking. A stdio server that dials a slow remote (e.g. the
+  // playwright plugin connecting to the Camoufox websocket) is still
+  // 'pending' at this point and its tools are absent from the live
+  // registry, so the turn would proceed with mcp__playwright-tools__*
+  // stuck "connecting" until the next refresh. Wait (bounded) for the
+  // newly-added servers to finish connecting before returning.
+  await waitForMcpServersReady(qi, result.added);
+  return result;
+}
+
+/**
+ * The context figures `warm_session` populates, read back out of the
+ * daemon's session store. In-process the host and the store share a
+ * process, so this is a lookup; in Phase 2 it is the reply that carries
+ * those numbers home.
+ */
+async function sessionInfo(chatId: string): Promise<HostSessionInfo> {
+  const session = getSession(chatId);
+  return {
+    chatId,
+    sessionId: session.sessionId,
+    turns: session.turns,
+    contextTokens: session.usage.contextTokens,
+    contextWindow: session.usage.contextWindow,
+  };
+}
+
+/**
+ * The Claude SDK backend keeps no conversation memory of its own — each
+ * turn is a fresh subprocess — so the only per-chat state the host holds
+ * is the in-flight query handle. Dropping it is interrupting it.
+ *
+ * Not bound into the `Backend` object: claude-sdk has no `resetChat`
+ * slot today and Phase 1 does not add one. `/reset` still clears the
+ * stored session id through `storage/sessions.ts`, as it always has.
+ */
+async function resetSession(chatId: string): Promise<boolean> {
+  return claudeInterruptChatTurn(chatId);
+}
+
+/**
+ * Build the in-process host. `config` and `getBridgePort` are held only
+ * for `hello()`, which performs the same `initAgent(config,
+ * getBridgePort)` the factory used to call inline.
+ */
+export function createInProcessAgentHost(
+  config: TalonConfig,
+  getBridgePort?: () => number,
+): AgentHostClient {
+  return {
+    async hello(): Promise<HostReadyInfo> {
+      await claudeInitAgent(config, getBridgePort);
+      // `sdk` is omitted: in-process there is no separately-pinned SDK
+      // build to name — the daemon's own lockfile is the answer, and
+      // Phase 4 gives the host a `package.json` of its own to report.
+      return { protocol: AGENT_HOST_PROTOCOL_VERSION, host: talonVersion() };
+    },
+    runTurn: (params) => claudeRunChatTurn(params),
+    interrupt: (chatId) => claudeInterruptChatTurn(chatId),
+    runOneShot: (params) => claudeRunOneShotAgent(params),
+    warmSession: (chatId) => claudeWarmSession(chatId),
+    setMcpServers,
+    refreshTools,
+    listModels: (filter) => claudeListModels(filter),
+    planUsage: () => getPlanUsage(),
+    sessionInfo,
+    resetSession,
+    // Nothing to drain while the host is this process: the daemon's own
+    // shutdown path already aborts in-flight turns.
+    shutdown: async () => undefined,
+  };
+}