feat(2.6.5): W1 — the eight P0 blockers, closing with consent before a local MCP spawn (ADR-0084)

apps/cli/src/chat/agent-source.ts

@@ -30,12 +30,39 @@ export function resolveChatAgent(
   agentRef: string | undefined,
   opts: ResolveChatAgentOptions,
 ): AgentDefinition {
+  return resolveChatAgentSource(agentRef, opts).agent;
+}
+
+/** The resolved agent together with the FILE it came from — `undefined` for the built-in default. */
+export interface ResolvedChatAgent {
+  readonly agent: AgentDefinition;
+  /**
+   * The path the agent was read from, for the MCP consent prompt.
+   *
+   * Not folded into `AgentDefinition`: that shape is the parsed artifact, is persisted into a session
+   * snapshot, and is produced by the pure core parser, which has no business carrying a host path. It
+   * travels beside the agent instead —
+   * [ADR-0084](../../../../docs/decisions/0084-consent-before-a-local-mcp-spawn.md) §7 requires the prompt
+   * to name the declaring file, and `chat --agent ./downloaded.agent.yaml` is precisely the imported-artifact
+   * case the gate exists for, so "the user typed a word" is not a good enough answer there.
+   */
+  readonly artifact: string | undefined;
+}
+
+/** {@link resolveChatAgent}, plus the source path the consent prompt needs. */
+export function resolveChatAgentSource(
+  agentRef: string | undefined,
+  opts: ResolveChatAgentOptions,
+): ResolvedChatAgent {
   if (agentRef === undefined) {
-    return buildDefaultChatAgent(
-      opts.defaultModel ?? DEFAULT_CHAT_MODEL,
-      opts.reasoningEffort,
-      opts.defaultProvider,
-    );
+    return {
+      agent: buildDefaultChatAgent(
+        opts.defaultModel ?? DEFAULT_CHAT_MODEL,
+        opts.reasoningEffort,
+        opts.defaultProvider,
+      ),
+      artifact: undefined,
+    };
   }
   const source = resolveYamlSource(agentRef, {
     cwd: opts.cwd,
@@ -44,5 +71,5 @@ export function resolveChatAgent(
     projectConfigDir: opts.projectConfigDir,
     idSuffixes: ['.agent.yaml', '.relavium.yaml', '.yaml'],
   });
-  return parseAgent(source.yaml, { source: source.path });
+  return { agent: parseAgent(source.yaml, { source: source.path }), artifact: source.path };
 }

apps/cli/src/chat/persister.test.ts

@@ -1,4 +1,4 @@
-import { reconstructSessionState } from '@relavium/core';
+import { reconstructSessionState, unwrapUntrusted } from '@relavium/core';
 import type { StreamChunk } from '@relavium/llm';
 import {
   createClient,
@@ -860,10 +860,15 @@ describe('createSessionPersister', () => {
     // The full transcript is preserved (append-only — nothing deleted): 4 real rows + 1 marker.
     expect(messages).toHaveLength(5);
 
-    // Resume honors the marker: only the kept exchange survives, with the summary as the preamble.
+    // Resume honors the marker: only the kept exchange survives, and the summary comes back RE-MARKED
+    // untrusted (ADR-0081 §2) — persistence stores a raw string, and a value does not become trustworthy by
+    // having been stored, so the reconstruction boundary is where the brand is reapplied.
     const full = store.loadFull('sess-1');
     const state = reconstructSessionState(full!.session, full!.messages);
-    expect(state.contextPreamble).toBe('the summary text');
+    expect(state.compactionSummary).toBeDefined();
+    expect(state.compactionSummary && unwrapUntrusted(state.compactionSummary)).toBe(
+      'the summary text',
+    );
     expect(state.messages).toEqual([
       { role: 'user', content: [{ type: 'text', text: 'q2' }] },
       { role: 'assistant', content: [{ type: 'text', text: 'a2' }] },

apps/cli/src/chat/session-host.test.ts

@@ -40,6 +40,7 @@ import {
   toolUseTurn,
   unresolvedResolver,
 } from './test-support.js';
+import { createInMemoryEffectJournal } from '@relavium/core';
 
 /** A tool-call turn that carries JSON args (the `toolUseTurn` helper sends none) — for read_file/write_file. */
 const callWithArgs = (id: string, name: string, args: unknown): StreamChunk[] => [
@@ -101,18 +102,28 @@ function deterministicIds() {
   return { now: () => tick++, uuid: () => 'sess-test-1' };
 }
 
-function build(overrides: Partial<Parameters<typeof buildChatSession>[0]> = {}) {
+async function build(overrides: Partial<Parameters<typeof buildChatSession>[0]> = {}) {
   const { now, uuid } = deterministicIds();
-  return buildChatSession({
+  const built = await buildChatSession({
     chat: EMPTY_CHAT,
     agentRef: undefined,
     cwd: '/workspace',
     projectConfigDir: undefined,
     now,
     uuid,
     providers: scriptedResolver([textTurn('hello there')]),
+    // `connectAgentMcp` REFUSES a stdio declaration when no gate was wired (ADR-0084 §1) — the optionality
+    // that left four of the five entry points ungated. These cases are about host wiring, not consent, so the
+    // default says so explicitly; a case about the gate itself overrides it.
+    consentGate: () => Promise.resolve(new Map()),
     ...overrides,
   });
+  // In production the persister attaches this once `history.db` is open. Attaching a REAL in-memory journal
+  // here rather than leaving it unwired: MCP tools are tier 3 (ADR-0080), so the MCP tests below genuinely
+  // dispatch effects, and the unwired port correctly refuses those — which would test the refusal instead of
+  // the routing each test is about.
+  built.attachEffectJournal((correlation) => createInMemoryEffectJournal(correlation));
+  return built;
 }
 
 describe('buildChatSession', () => {
@@ -419,6 +430,34 @@ describe('buildChatSession + MCP host wiring (2.R)', () => {
     expect(closed).toBe(1);
   });
 
+  it('names the RESOLVED agent file at the consent gate (ADR-0084 §7)', async () => {
+    // The prompt's "declared in <file>" line is what turns a consent decision about an opaque program into
+    // one about an artifact the user can go read — and `chat --agent ./downloaded.agent.yaml` is exactly the
+    // imported-artifact case the gate exists for. It has now died silently TWICE, at two different layers,
+    // because every test called the gate directly and none went through the surface that computes the value.
+    const agentPath = writeMcpAgent();
+    let asked = 0;
+    let seen: string | undefined;
+    await build({
+      agentRef: agentPath,
+      consentGate: (_refs, _cwd, artifact) => {
+        asked += 1;
+        seen = artifact;
+        return Promise.resolve(new Map());
+      },
+      startMcpClient: () =>
+        Promise.resolve({
+          capability: { call: () => Promise.resolve({ content: [], isError: false }) },
+          toolDefs: [],
+          toolIdsByServer: new Map(),
+          skipped: [],
+          close: () => Promise.resolve(),
+        }),
+    });
+    expect(asked).toBe(1); // else `seen === undefined` would pass for a gate that never ran
+    expect(seen).toBe(agentPath);
+  });
+
   it('MERGE-not-replace: a session with MCP keeps the fs arm too — read_file AND an MCP tool both dispatch', async () => {
     // The keystone 2.5.A fix (ADR-0055): the inbound-MCP arm is MERGED onto the factory fs+process host, never
     // REPLACING it. Proven end-to-end: in ONE session, read_file routes via host.fs (real file) AND mcp_fs_read
@@ -585,6 +624,7 @@ describe('buildResumedChatSession (2.N)', () => {
       messages,
       now: () => Date.parse(ISO),
       providers: scriptedResolver([textTurn('continued')]),
+      consentGate: () => Promise.resolve(new Map()), // see `build` above (ADR-0084 §1)
     });
   }
 
@@ -827,7 +867,10 @@ describe('buildResumedChatSession (2.N)', () => {
         now: () => Date.parse(ISO),
         providers: scriptedResolver([toolUseTurn('c1', 'mcp_fs_read'), textTurn('done')]),
         startMcpClient: () => realStartMcpClient([{ id: 'fs', open: () => Promise.resolve(conn) }]),
+        consentGate: () => Promise.resolve(new Map()), // see `build` above (ADR-0084 §1)
       });
+      // A resumed session's MCP tools are tier 3 too (ADR-0080) — same reason as `build()` above.
+      built.attachEffectJournal((correlation) => createInMemoryEffectJournal(correlation));
 
       // The RETURNED agent is the ORIGINAL snapshot — its grant is not baked with the dynamic id, and it still
       // carries mcp_servers so a FUTURE resume re-discovers again (the persistence contract).
@@ -870,6 +913,7 @@ describe('buildResumedChatSession (2.N)', () => {
         now: () => Date.parse(ISO),
         providers: scriptedResolver([textTurn('unused')]),
         startMcpClient: () => Promise.resolve(collidingClient),
+        consentGate: () => Promise.resolve(new Map()), // see `build` above (ADR-0084 §1)
       });
       await expect(building).rejects.toThrow(/duplicate tool id/);
       expect(closed).toBe(1);