feat: ship Slice J1 — pbrain integration (skills + CLI allowlist + auto-onboard)

[joedanz]

Summary

• @mc/core/pbrain (new) ships pbrainBashAllowlist (Bash-only, pbrain * allowlist with shell-metachar denial) and runProjectOnboard (one-shot Claude SDK call bound to the pbrain project-onboard skill, bounded by maxTurns + abortSignal).
• mc project add <path> now runs the onboarder after registry.add() succeeds — --no-pbrain to skip; pbrain failures never invert add's exit code. New mc project pbrain-backfill [--slug X | --all] retroactively onboards existing projects.
• Chat lane gains pbrain access (read-only additionalDirectories: [skillsRoot], Bash(pbrain:*) allowlist via canUseTool, brainstorm prompt augmented with a "Pbrain access" section). The chat-no-project + pbrain case routes cwd to the pbrain skills tree to avoid exposing MC internals (state.db, dashboard.token) via the SDK's cwd auto-allow.
• @mc/core/config.pbrain (new) — env-driven PBRAIN_ROOT (default ~/code/pbrain), validated against <root>/skills/; discriminated union mirrors discord/memory.vec.

Why this shape

Skills + CLI over MCP. Pbrain ships a pbrain serve MCP with ~30 tools. Wiring that into chat-bridge would tax every chat turn ~2.4k tokens (80 tokens × 30 schemas) for occasional-use operations. Skills + Bash-allowlist load on demand (~500–1500 tokens per invocation) and match how pbrain itself is designed to be consumed by agents. The in-process mc-memory MCP from I1b stays for its hot-path single-tool case — the tradeoff is asymmetric for the right reasons.

CLI runs the onboarder, not the daemon. Mission Control's EventBus<ProjectEvent> already publishes project.added from registry.add() — but the bus lives in whichever process called the registry, not across the CLI/daemon boundary. So a daemon-side subscriber wouldn't fire on mc project add. The CLI runs the onboarder itself (using a hoisted shared cliAgentRunner), which keeps mc project add self-contained and works whether or not the daemon is up.

Bash allowlist via canUseTool, not allowedTools. The SDK's allowedTools: ['Bash'] would auto-allow any shell command, and disallowedTools is a name-only blocklist. canUseTool is the only surface that expresses "Bash, but only pbrain *" — and we defend against shell metacharacter injection (pbrain query x; rm -rf /) with a regex on the trimmed command. Single-user dev tool, no privilege boundary, but a clean allowlist still bounds the agent's blast radius if a prompt-injection convinces it to try shelling out.

assistant_text_delta in onboarder is gone. /simplify quality review caught that the onboarder's assistant_text_delta case was overwriting summary with the most recent partial delta, then completed.result would replace it with the full text — but if an out-of-order delta arrived after completed, it would silently overwrite the good summary. Removed the case; rely on completed.result.

composeBrainstormPrompt lives in chat-bridge, not compose.ts. /simplify flagged that having both pbrain?: PbrainEnabledConfig and a pre-composed brainstormSystemPrompt on ChatBridgeOpts made callers responsible for synchronizing two views of the same state. Moved composition inside the bridge — caller passes the base prompt + pbrain config once. Tests still pin a stub via the basePrompt override.

Test status

• 1340 / 1340 tests passing
• pnpm build, pnpm typecheck, pnpm lint, pnpm test all green locally
• /simplify ran (3 reviewers in parallel); applied 11 findings (assistant_text_delta bug fix, cwd-leak fix in chat-no-project + pbrain, OnboardProject → Pick<Project,…>, hoisted pbrainBashAllowlist to a const, dropped narrative slice/swarm comments per CONTRIBUTING, etc.)

Test plan

• pnpm test (1340/1340)
• pnpm build (all packages)
• pnpm typecheck (all packages)
• ./node_modules/.bin/biome check . (clean)
• Manual: mc project add ~/code/<some-repo> against the user's local pbrain — verify the pbrain skill kicks off, summary line prints, project still registers on pbrain failure
• Manual: mc project add --no-pbrain ~/code/<some-repo> — verify no pbrain output
• Manual: Discord chat to a routed channel — verify pbrain query "<x>" works in a chat session

Deferred / additive

• pbrain access in the task lane (J1 is chat-only; promotion via /do resumes the same SDK session, so a task already inherits chat's pbrain context).
• Pbrain MCP server opt-in (pbrain serve) — one-line addition next to the existing mc-memory MCP if a high-frequency loop ever justifies the schema cost.
• Shared "iterate agentRunner.run(), capture terminal event" helper — chat-bridge, summarize-handler, and onboarder all do roughly this. /simplify flagged it; deferring until a fourth call site appears so the abstraction has real shape.
• Reaction-emoji promotion (👍 → /do) from I1's deferred list.
• Cross-conversation /do.