Deferred fork follow-ups: security re-implements, xterm v6, read-path rearchitecture

[polymath-orchestrator]

Higher-effort items from the upstream triage (ao-ops/docs/UPSTREAM-CHERRY-PICK-TRIAGE.md), deferred from the Tier-1/Tier-2 folding (#1) because they need real implementation work, not a clean cherry-pick.

Security (Go-only upstream → re-implement in TS)

• feat(review): enforce reviewer read-only via tool allowlist AgentWrapper/agent-orchestrator#2194 / enhancement(review): enforce reviewer read-only via a tool allowlist instead of bypassPermissions + prompt AgentWrapper/agent-orchestrator#2175 — reviewer agent runs with bypassPermissions; read-only is prompt-only. Re-implement scoped AllowedTools/DisallowedTools through the claude-code plugin + reviewer path in core. Highest-value security item for an autonomous orchestrator.
• [codex] isolate worker MCP config AgentWrapper/agent-orchestrator#2232 / Let workers use a different MCP server set than the orchestrator AgentWrapper/agent-orchestrator#2195 — worker sessions inherit the global/orchestrator MCP server set (ambient creds). Add role-scoped MCP config (inherit/none/custom), workers default empty.

Dependency upgrade (test carefully)

• fix(web): upgrade xterm.js to v6 for DEC 2026 synchronized output support AgentWrapper/agent-orchestrator#1198 / fix(web): upgrade xterm.js to v6 to fix garbled terminal rendering AgentWrapper/agent-orchestrator#1273 — xterm.js v6 (fixes garbled/flickering terminal during streaming; DEC-2026 sync output). Dep bump → validate terminal rendering before/after.

Read-path rearchitecture (the 'platform-down' root cause; upstream's wholesale fix never merged)

• bug(core,web): dashboard read path makes per-session gh calls — gh is the dominant 20-40s bottleneck (benchmarked), not tmux/ps; #1858 is scoped to the wrong probes AgentWrapper/agent-orchestrator#1885 dashboard read path makes per-session gh calls (20-40s bottleneck)
• bug(web): session-detail page connection-pool starvation — RSC sidebar prefetches + sync probes + first-failure-fatal cascade produces "Failed to load session" AgentWrapper/agent-orchestrator#1855 session-detail connection-pool starvation
• bug(core,web): dashboard request paths run expensive agent enrichment for terminated/runtime-lost sessions AgentWrapper/agent-orchestrator#1991 expensive enrichment for terminated/runtime-lost sessions
• Next.js dev server OOM crash — JavaScript heap out of memory (~4GB) on ao start AgentWrapper/agent-orchestrator#1935 Next.js dev server OOM on ao start

Pre-existing test gap noticed during folding

• integration-tests readLastJsonlEntry returns a recognized message type fails on hosts with current Claude JSONL — the recognized-message-type set is stale. Low-pri, env-dependent.

🤖 Generated with Claude Code

[polymath-orchestrator]

All items complete:

• feat(review): enforce reviewer read-only via tool allowlist AgentWrapper/agent-orchestrator#2194 reviewer read-only allowlist → b44f2d3 (defense-in-depth; our reviewer was already Codex-sandboxed)
• [codex] isolate worker MCP config AgentWrapper/agent-orchestrator#2232 worker MCP isolation → f39e0a7 (real ambient-MCP leak fixed: role-scoped, workers default none)
• fix(web): upgrade xterm.js to v6 for DEC 2026 synchronized output support AgentWrapper/agent-orchestrator#1198 xterm v6 → already present in the fork (@xterm/xterm 6.1.0-beta.256)
• read-path bug(core,web): dashboard read path makes per-session gh calls — gh is the dominant 20-40s bottleneck (benchmarked), not tmux/ps; #1858 is scoped to the wrong probes AgentWrapper/agent-orchestrator#1885/bug(web): session-detail page connection-pool starvation — RSC sidebar prefetches + sync probes + first-failure-fatal cascade produces "Failed to load session" AgentWrapper/agent-orchestrator#1855/bug(core,web): dashboard request paths run expensive agent enrichment for terminated/runtime-lost sessions AgentWrapper/agent-orchestrator#1991/Next.js dev server OOM crash — JavaScript heap out of memory (~4GB) on ao start AgentWrapper/agent-orchestrator#1935 → 4 phases (d197f43, f8ddaeb, ca2ac7c, 869181d), live + verified
• readLastJsonlEntry test gap → f344159 (bridge-session)

Nothing deferred remains. Closing.