claude-code: refuse registering what a session runs, so no agent can plant it in the operator's sessions

The tool runner is not told who called, so a hook, a managed setting, a
permission rule or a tool server registered through these tools could come
from an agent confined on another node and run as the operator there
(hq issue 340). They are set at the controller's terminal now; a skill,
subagent or command that runs something by itself is refused too, kept
hooks and settings are never rendered, and claude_code_registrations
lists what is registered and by which node.

modules/claude-code/README.md

@@ -22,9 +22,9 @@ whenever the node's tool runtime collects the module's tools:
 | file | holds |
 |---|---|
 | `managed-mcp.json` | the tool servers every session loads: the mesh's console as `mesh`, and the servers set in this module's `mcp_servers` setting. **Exclusive**: a server not listed here does not load — not one added with `claude mcp add`, not a project's `.mcp.json`, not a plugin's |
-| `managed-settings.json` | the keys set in this module's `managed_settings` setting, then the settings registered through this module (the mesh's, then this node's), under the mesh's own keys: the repositories' attribution convention, the claude.ai connectors kept beside the managed servers, the key-helper while the node holds an API-key licence, and the two that name the `nox-mesh` marketplace and enable its plugin |
+| `managed-settings.json` | the keys set in this module's `managed_settings` setting — at the controller's terminal alone (hq issue 340) — under the mesh's own keys: the repositories' attribution convention, the claude.ai connectors kept beside the managed servers, the key-helper while the node holds an API-key licence, and the two that name the `nox-mesh` marketplace and enable its plugin |
 | `CLAUDE.md` | how a session on this mesh works, this node's name and role, the conventions, the **"instead of" table** — then the instruction sections registered for every node and for this one |
-| `marketplace/` | the `nox-mesh` plugin (hq ADR 0216): the skills, subagents, commands, hooks and output styles registered for every node and for this one, offered in a session as `nox-mesh:<name>` — and the **guard on the agent's shell** (`guard/`), the mesh's own hook, first. Replaced whole, staged beside and swapped in |
+| `marketplace/` | the `nox-mesh` plugin (hq ADR 0216): the skills, subagents, commands and output styles registered for every node and for this one, offered in a session as `nox-mesh:<name>` — and the **guard on the agent's shell** (`guard/`), the mesh's own hook and the plugin's only one (hq issue 340). Replaced whole, staged beside and swapped in |
 
 Under the operator's home: `~/.claude/.credentials.json`, only when the licence manager hands this node a
 subscription token; and what is registered at the **home** scope for this node — a skill, subagent,
@@ -46,8 +46,8 @@ must see, a node that joins later included — kept, so it carries no secret eit
 | what this node holds | the module's `holdings` state, one key for this node — the account, the kind, fingerprints and expiries, never a token — written at start and whenever the credentials file changes (hq ADR 0206) |
 | a person ran `/login` here | the credentials file gains a refresh token this module never writes; its next report shows it, and the licence manager asks `claude_code_grant` for it, giving its key — the one time a refresh token leaves the node, for the manager to adopt by refreshing it |
 | what this node should hold | the licence manager's `bindings` state, this node's key; on a newer generation this module asks `anthropic-licence-manager.current` for its token, sealed to the key it sends, and writes it access-token-only — so the agent here never refreshes. A node that was off reads its key when it is back |
-| an MCP server registered through this module | a key in the module's `servers` state — `all.<server>` for every node, `<node>.<server>` for one; every node watches it and renders what applies to it, a node's own entry over the one for every node. A node that joins later, or was off, reads the whole current set at start; unregistering is a delete. An entry with a secret in its `env` or `headers` is refused by the runtime |
-| the agent's configuration (hq ADR 0216) | a key in the module's `config` state per registration — `mesh.<kind>.<name>` for every node, `node.<node>.<kind>.<name>` for one, `home.<node>.<kind>.<name>` for one account's own directory — the item and its files in one value, at most 256 KiB. Every node watches it and renders what applies to it, a node item over a mesh item of the same kind and name |
+| an MCP server registered through this module before registering was refused (hq issue 340) | a key in the module's `servers` state — `all.<server>` for every node, `<node>.<server>` for one; every node watches it and renders what applies to it, a node's own entry over the one for every node. A node that joins later, or was off, reads the whole current set at start; unregistering is a delete. Nothing adds a key any more: a new tool server is the operator's, in the `mcp_servers` setting at the controller's terminal |
+| the agent's configuration (hq ADR 0216) | a key in the module's `config` state per registration — `mesh.<kind>.<name>` for every node, `node.<node>.<kind>.<name>` for one, `home.<node>.<kind>.<name>` for one account's own directory — the item and its files in one value, at most 256 KiB. Every node watches it and renders what applies to it, a node item over a mesh item of the same kind and name. A hook, settings, or an item that would run something by itself is never taken, whenever it was put there (hq issue 340) |
 
 ## The mesh's tools first (hq ADR 0245)
 
@@ -83,21 +83,40 @@ record is how a habit that found a way round is seen.
 ## Tools
 
 `claude_code_status`, `claude_code_render`, `claude_code_guard`, `claude_code_pull`, `claude_code_grant` (for the licence
-manager), `claude_code_mcp_list`,
-`claude_code_mcp_register` (this node by default; `nodes: "all"` or a list for more — called for this
-node alone, its answer names the other nodes running claude-code), `claude_code_mcp_unregister`.
+manager), `claude_code_mcp_list`, `claude_code_mcp_unregister` (this node by default; `nodes: "all"` or a list for
+more).
 
-The agent's configuration (hq ADR 0216), each registered at a **scope** — `mesh` (the default), `node`
-(`nodes`: a list, or `"all"` for every node running claude-code; absent is this node) or `home` (the
+**What a session runs or obeys is the operator's, at the controller's terminal** (hq issue 340). A hook, a
+permission rule, any other managed setting, and a tool server run in, or decide what runs in, every session on the
+nodes they reach, as whoever starts it — the operator, whose account holds root. The tool runner acts for any caller of
+the mesh MCP server and is not told who called, so this module cannot tell the operator from an agent confined on
+another node. So these tools refuse, and say why and how it is done instead:
+
+- `claude_code_hook_register`, `claude_code_settings_set`, `claude_code_permission_add`, `claude_code_permission_remove`:
+  the operator sets hooks, permission rules and every other managed setting in this module's `managed_settings`
+  setting, `mesh-controller settings set claude-code '{"managed_settings": {…}}' [--node <node>]`, typed at the
+  controller's terminal. The controller refuses `managed_settings`, `mcp_servers` and `role` through any verb: a
+  mergeable file asks for every key its own content names;
+- `claude_code_mcp_register`: the operator sets tool servers in the `mcp_servers` setting the same way;
+- a skill, subagent or command that would run something by itself: a shell line the agent runs when it loads one
+  (`` !`…` ``, or a block opened with ```` ```! ````), or `hooks`, `mcpServers`, `permissionMode` or `allowed-tools`
+  in its front matter. A script beside a skill is taken: it runs only when the agent runs it, through the
+  session's own rules.
+
+What was registered before stays: a tool server is still rendered, and may be unregistered; a hook or settings the
+state still holds are never rendered, and `claude_code_hook_unregister` and `claude_code_settings_clear` remove
+them. `claude_code_registrations` lists everything registered, with who registered it, when, and whether it is
+rendered, beside what the operator set for this node at the terminal. Its `by` is the node whose tool runner served
+the call, never the caller, whom the runner is not told.
+
+The agent's configuration that is text a session reads (hq ADR 0216), each registered at a **scope** — `mesh` (the
+default), `node` (`nodes`: a list, or `"all"` for every node running claude-code; absent is this node) or `home` (the
 operator account's own `~/.claude` on those nodes):
 
-- for each kind — `skill`, `agent`, `command`, `hook`, `output_style`, `instructions` —
-  `claude_code_<kind>_list`, `_register`, `_unregister`. A skill is its files (`files`, or `content` for a
-  lone SKILL.md); a hook is an `event`, a `matcher`, a `command` and its scripts as `files`, with
-  `${HOOK_DIR}` in the command naming their directory. Hooks and settings take no home scope;
-- `claude_code_settings_get`, `_set` (merged into the scope, or `replace`), `_clear`;
-  `claude_code_permission_add` and `_remove` for one allow, ask or deny rule. The agent refuses to loosen
-  its own settings: these are the operator's to call;
+- for each kind — `skill`, `agent`, `command`, `output_style`, `instructions` — `claude_code_<kind>_list`,
+  `_register`, `_unregister`. A skill is its files (`files`, or `content` for a lone SKILL.md);
+- `claude_code_hook_list` and `_unregister`, `claude_code_settings_get` (the managed settings as written, the
+  operator's setting, and what was registered before and is not rendered) and `_clear`;
 - `claude_code_config_list`, `_show` (one registration in full), `_status` (what applies here, the plugin
   as written, and the home's own items — which the mesh placed, which share a name with a mesh item, which
   call a tool server not loaded here) and `_import` (an item of this node's home, registered at a scope;
@@ -119,11 +138,14 @@ A new session takes a change; a running one at `/reload-plugins`.
 
 ## Settings
 
-Per node or for the whole mesh, through `mesh-controller.settings module=claude-code`:
+Per node or for the whole mesh, at the controller's terminal alone: `mesh-controller settings set claude-code '<json>'
+[--node <node>]`. The controller refuses all three keys through any verb, `mesh-controller.settings` included, because
+each reaches every session on the node and a verb's caller may be an agent (hq issue 340). Reading them through the
+verb still answers.
 
 - `role` — what this node is, in a few words; shown to every session.
-- `mcp_servers` — extra tool servers, set by the operator for the mesh or a node, beside the ones
-  registered through the tools; keyed by name, in the vendor's `.mcp.json` entry shape
+- `mcp_servers` — the tool servers, set by the operator for the mesh or a node, beside the ones
+  registered through the tools before that was refused; keyed by name, in the vendor's `.mcp.json` entry shape
   (`{"type":"http","url":…}` or `{"type":"stdio","command":…,"args":[…]}`). The name `mesh` is the
   module's own and cannot be set. Put a person's own servers here, or they stop loading.
 - `managed_settings` — keys of the agent's managed settings, in the vendor's `settings.json` shape: