feat(mcp-proxy): surface role presets in diagnostics

Add a concise human-only role presets hint to init and doctor output so users can discover static role guidance without adding runtime role demos.

Implemented with assistance from Codex.

Author: oleg-bk

packages/agentveil-mcp-proxy/agentveil_mcp_proxy/cli.py

@@ -1394,6 +1394,7 @@ def doctor_proxy(
                 )
             for warning in warnings:
                 print(f"WARN: {warning}", file=out)
+            _print_role_presets_discoverability_hint(out)
         return 0
     except ProxyCliError as exc:
         if output_json:
@@ -2798,6 +2799,16 @@ def _with_path_args(parts: list[str]) -> str:
     return doctor_cmd, client_cmd
 
 
+_ROLE_PRESETS_DISCOVERABILITY_HINT = (
+    "Role presets: available. Inspect with "
+    "`agentveil-mcp-proxy role doctor --preset reviewer`."
+)
+
+
+def _print_role_presets_discoverability_hint(out: TextIO) -> None:
+    print(_ROLE_PRESETS_DISCOVERABILITY_HINT, file=out)
+
+
 def _add_passphrase_args(parser: argparse.ArgumentParser) -> None:
     parser.add_argument("--passphrase", default=None, help="MCP proxy identity passphrase")
     parser.add_argument("--passphrase-file", type=Path, default=None, help="Read passphrase from file")
@@ -6508,6 +6519,7 @@ def main(argv: list[str] | None = None) -> int:
                 )
                 print(f"Next: {doctor_cmd}")
                 print(f"      {client_cmd}")
+                _print_role_presets_discoverability_hint(sys.stdout)
             return 0
         if args.command == "doctor":
             return doctor_proxy(

packages/agentveil-mcp-proxy/tests/test_mcp_proxy_cli.py

@@ -3165,3 +3165,50 @@ def test_root_help_lists_role_doctor(capsys):
     text = capsys.readouterr().out
     advanced = text.split("Advanced:", 1)[1].split("Typical first-run path:", 1)[0]
     assert "role" in advanced
+
+
+def test_doctor_human_output_includes_role_presets_hint(tmp_path):
+    home = tmp_path / "avp-home"
+    init_proxy(home=home, agent_name="proxy", passphrase=TEST_PASSPHRASE)
+    out = io.StringIO()
+    assert doctor_proxy(home=home, passphrase=TEST_PASSPHRASE, out=out) == 0
+    text = out.getvalue()
+    assert proxy_cli._ROLE_PRESETS_DISCOVERABILITY_HINT in text
+    assert "inferred" not in text.lower()
+    assert "adaptive" not in text.lower()
+
+
+def test_doctor_json_output_omits_role_presets_hint(tmp_path):
+    home = tmp_path / "avp-home"
+    init_proxy(home=home, agent_name="proxy", passphrase=TEST_PASSPHRASE)
+    out = io.StringIO()
+    assert doctor_proxy(
+        home=home,
+        passphrase=TEST_PASSPHRASE,
+        output_json=True,
+        out=out,
+    ) == 0
+    payload = json.loads(out.getvalue())
+    serialized = json.dumps(payload)
+    assert proxy_cli._ROLE_PRESETS_DISCOVERABILITY_HINT not in serialized
+    assert "role doctor" not in serialized
+
+
+def test_init_human_output_includes_role_presets_hint(tmp_path, capsys):
+    home = tmp_path / "avp-home"
+    assert main(["init", "--home", str(home), "--plaintext", "--force"]) == 0
+    text = capsys.readouterr().out
+    assert proxy_cli._ROLE_PRESETS_DISCOVERABILITY_HINT in text
+    assert "Next:" in text
+
+
+def test_demo_human_output_omits_role_presets_hint(tmp_path, capsys):
+    work_dir = tmp_path / "demo-no-role-hint"
+    assert main([
+        "demo",
+        "--work-dir",
+        str(work_dir),
+        "--demo-auto-approve",
+    ]) == 0
+    text = capsys.readouterr().out
+    assert proxy_cli._ROLE_PRESETS_DISCOVERABILITY_HINT not in text