Unify the input-field "audience" model (retiredField / AI SDK hidden / MCP admission) #2027

Surfaced by #2023. The concept "who may write this input field, on which surface" is now expressed three times, each a separate name-keyed mechanism:

• retiredField() — src/commands/command-input.ts: refuse with migration guidance, omit from schema.
• ALWAYS_HIDDEN_FIELDS + omitSchemaProperties/omitHidden — src/ai-sdk/index.ts: hide session/stateDir/etc. from the model-facing schema and strip from input.
• OPERATOR_INPUT_GUIDANCE/CONFIG_LOADER_GUIDANCE + the deny-by-default admission boundary — src/mcp/command-tools.ts (added in Harden the MCP surface: registry rug-pull fix, operator-only credentials/endpoints, device-shell argv gate, declared timeouts #2023): operator/credential/config keys refused, unknown keys rejected.

Root cause: the ~21 shared common fields exist only as parallel enumerations by name — commonProperties() (schema), readCommonInput() (readers), commonToClientOptions() (projection), the CommonCommandInput type, and COMMON_COMMAND_SUPPORTED_FLAG_KEYS — none carrying metadata beyond a description. So any policy about a field (retired? operator-only? model-visible?) forces a new name-keyed map elsewhere, plus a test to keep the maps in sync.

Proposal

One declarative common-field table, each row { key, schema, reader, flagKey?, audience } where audience ∈ 'model' | 'operator' | 'retired' (+ the AI-SDK-pinned extras like session/platform). Derive from it:

• the JSON schema (commonProperties),
• the readers (readCommonInput) and client projection (commonToClientOptions),
• the supported-flag list,
• the MCP admission allowlist and its guidance strings,
• the AI SDK hidden set.

Then retiredField becomes audience: 'retired', the operator refusals become audience: 'operator', and the guidance strings become mechanically derived (buildPrimaryEnvVarName already exists) instead of hand-written per key — folding in the smaller "guidance strings are hand-written but derivable" cleanup.

Payoff

The security-relevant surface becomes pure data: adding/reclassifying a field is a one-row edit that the schema, readers, projection, and both surface boundaries all honor, with no cross-map sync test. In #2023, the operator/endpoint/path removal (items 2–3) would have been ~10 row edits instead of ~250 lines across three mechanisms.

Purely internal; no wire/behavior change intended (a characterization test over listCommandTools() output + the CLI schema pins that).