@addai/node 0.30.12 → 0.30.14

package/dist/entitybox-queue-request.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runEntityboxQueueRequest = runEntityboxQueueRequest;
+const entitybox_install_1 = require("./entitybox-install");
+const entitybox_mcp_contract_1 = require("./entitybox-mcp-contract");
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const entitybox_computer_task_1 = require("./entitybox-computer-task");
+const entitybox_operation_1 = require("./entitybox-operation");
+/** Called before native host auth, cwd/project preparation or installation.
+ * No adapter means disabled, never ordinary-host fallback. An MCP scope is
+ * only a route marker: the runtime-authenticated SQL claim is authorization. */
+async function runEntityboxQueueRequest(req, io, services) {
+    const env = req.mcp_env_overrides?.['entity-desktop-mcp'];
+    if (req.entitybox_computer_request !== true && (!env || !Object.prototype.hasOwnProperty.call(env, 'ENTITYBOX_DESKTOP_SCOPE')))
+        return false;
+    let lease, owner;
+    let prepared;
+    let preparing, preparationSettled = true;
+    let completion, reason = 'failed';
+    let poll, timeout, polling, watching = true;
+    const stop = new AbortController();
+    const cancel = (why) => { if (!stop.signal.aborted) {
+        reason = why;
+        stop.abort();
+        lease?.fence();
+    } };
+    const shutdown = () => cancel('lease_lost');
+    services?.signal?.addEventListener('abort', shutdown, { once: true });
+    if (services?.signal?.aborted)
+        shutdown();
+    const token = () => { const p = io.pairing(); if (!p || p.runtimeId !== req.runtime_id)
+        throw new Error(); return p.daemonToken; };
+    const status = () => (0, entitybox_operation_1.entityboxOperation)([], 4500, () => io.rpc('runtime_get_request_status', { p_token: token(), p_request_id: req.id }));
+    const inspectStatus = async () => {
+        try {
+            const value = await status();
+            if (value === 'canceled')
+                cancel('canceled');
+            else if (!['starting', 'running'].includes(value))
+                cancel('lease_lost');
+        }
+        catch {
+            cancel('lease_lost');
+        }
+    };
+    const tick = () => { polling = inspectStatus().finally(() => { if (watching && !stop.signal.aborted)
+        poll = setTimeout(tick, 750); }); };
+    try {
+        const scope = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(JSON.parse((0, entitybox_install_1.entityboxInstallScope)(req.mcp_env_overrides ?? undefined, req.id)));
+        if (scope.runtimeId !== req.runtime_id || scope.desktopId !== req.desktop_id || req.agent !== 'claude' || req.mode !== 'print'
+            || typeof req.prompt !== 'string' || !req.prompt.trim() || req.prompt.length > 12000
+            || (req.timeout_seconds != null && (!Number.isInteger(req.timeout_seconds) || req.timeout_seconds < 0 || req.timeout_seconds > 2147483)))
+            throw new Error();
+        if (!services)
+            throw new entitybox_execution_lease_1.EntityboxExecutionError('Isolated computer execution is not configured on this runtime.');
+        await inspectStatus();
+        if (stop.signal.aborted)
+            return true;
+        if (req.timeout_seconds)
+            timeout = setTimeout(() => cancel('failed'), req.timeout_seconds * 1000);
+        tick();
+        lease = await entitybox_execution_lease_1.EntityboxExecutionLease.claim(req.id, scope, token, io.rpc);
+        if (stop.signal.aborted)
+            lease.fence();
+        lease.assertActive();
+        prepared = await (0, entitybox_operation_1.entityboxOperation)([lease.signal, stop.signal], 10000, signal => {
+            preparationSettled = false;
+            preparing = Promise.resolve().then(() => services.prepare(structuredClone(req), lease, signal))
+                .then(value => { prepared = value; return value; }).finally(() => { preparationSettled = true; });
+            return preparing;
+        });
+        lease.assertActive();
+        if (stop.signal.aborted)
+            throw new Error();
+        const task = await entitybox_computer_task_1.EntityboxComputerTask.start(lease, { ...prepared.options,
+            onTask: value => { owner = value; prepared?.onTask?.(value); },
+            onContainer: container => prepared.register(container),
+            onEvent: async (event) => {
+                if (event.type === 'turn_complete') {
+                    completion = event;
+                    return;
+                }
+                // Fresh server authority for each event; no best-effort write or
+                // raw provider/RPC diagnostic can masquerade as durable progress.
+                if (!await lease.appendEvent(event))
+                    throw new Error();
+            },
+        });
+        const result = await task.done;
+        await inspectStatus();
+        if (!stop.signal.aborted && result.code === 0 && completion?.type === 'turn_complete' && completion.stopReason === 'success')
+            reason = 'completed';
+    }
+    catch {
+        lease?.fence();
+        if (!stop.signal.aborted)
+            reason = 'failed';
+    }
+    finally {
+        services?.signal?.removeEventListener('abort', shutdown);
+        watching = false;
+        clearTimeout(poll);
+        clearTimeout(timeout);
+        await polling;
+        if (lease) {
+            // Stop discovery waits for coordinator startup, including failures.
+            // No reservation release or successful event without complete proof.
+            try {
+                // Cooperative preparation gets a bounded chance to finish aborting.
+                // An unresponsive adapter must not strand the queue worker forever,
+                // but its unknown state also must not release the SQL reservation.
+                if (preparing && !preparationSettled) {
+                    try {
+                        await (0, entitybox_operation_1.entityboxOperation)([], 1500, () => preparing);
+                    }
+                    catch { }
+                }
+                if (!preparationSettled)
+                    throw new Error();
+                await lease.acknowledgeStopped(reason, async () => {
+                    await owner?.stopAndVerify();
+                    if (prepared)
+                        await prepared.verifyAllStopped();
+                });
+                await lease.finishRequest(reason, reason === 'completed' ? completion : undefined);
+            }
+            catch {
+                lease.fence();
+                throw new entitybox_execution_lease_1.EntityboxExecutionError('Computer task cleanup or final status remains unverified.');
+            }
+        }
+        else if (!stop.signal.aborted) {
+            // Before a lease exists, retain the native failure reporting contract.
+            // Do not retry, resolve host credentials, install or start a harness.
+            const message = 'The isolated computer task could not start. Check runtime configuration and task access.';
+            await io.rpc('runtime_request_update', { p_token: token(), p_request_id: req.id, p_status: 'failed', p_error_code: 'entitybox_computer_setup_failed', p_error_message: message });
+            await io.rpc('runtime_event_emit', { p_token: token(), p_request_id: req.id, p_type: 'error', p_payload: { code: 'entitybox_computer_setup_failed', message } });
+        }
+    }
+    return true;
+}

package/dist/entitybox-recovery-host.d.ts

@@ -0,0 +1,12 @@
+import { type EntityboxRecoveryWorkerIO } from './entitybox-recovery-worker';
+/** Recovery can stay enabled after execution/provisioning are disabled. It
+ * grants no new task or computer startup authority. */
+export declare function entityboxRecoveryEnvironment(env?: NodeJS.ProcessEnv): {
+    enabled: true;
+    dockerContext: string;
+    directory: string;
+} | undefined;
+export declare function startEntityboxRecoveryHost(io: Omit<EntityboxRecoveryWorkerIO, 'report'>, env?: NodeJS.ProcessEnv): {
+    stop(): void;
+    drain(_timeout?: number): Promise<boolean>;
+};

package/dist/entitybox-recovery-host.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entityboxRecoveryEnvironment = entityboxRecoveryEnvironment;
+exports.startEntityboxRecoveryHost = startEntityboxRecoveryHost;
+const path = __importStar(require("path"));
+const paths_1 = require("./paths");
+const entitybox_recovery_worker_1 = require("./entitybox-recovery-worker");
+/** Recovery can stay enabled after execution/provisioning are disabled. It
+ * grants no new task or computer startup authority. */
+function entityboxRecoveryEnvironment(env = process.env) {
+    if (env.AINODE_ENTITYBOX_RECOVERY_ENABLED !== '1')
+        return undefined;
+    const dockerContext = env.AINODE_ENTITYBOX_DOCKER_CONTEXT ?? '';
+    const directory = env.AINODE_ENTITYBOX_RECOVERY_DIRECTORY ?? path.join(paths_1.RUNTIME_HOME, 'entitybox', 'recovery');
+    if (env.DOCKER_HOST || !/^[-a-zA-Z0-9_.]{1,80}$/.test(dockerContext) || !path.isAbsolute(directory) || directory.startsWith('\\\\'))
+        throw new Error('Invalid recovery configuration');
+    return { enabled: true, dockerContext, directory };
+}
+function startEntityboxRecoveryHost(io, env = process.env) {
+    const idle = { stop() { }, async drain(_timeout) { return true; } };
+    try {
+        const config = entityboxRecoveryEnvironment(env);
+        if (!config)
+            return idle;
+        const pairing = io.pairing();
+        if (!pairing)
+            throw new Error();
+        const reported = new Map();
+        const worker = (0, entitybox_recovery_worker_1.createEntityboxRecoveryWorker)({ ...config, runtimeId: pairing.runtimeId }, { ...io, report: (state, id) => {
+                const key = id ?? 'worker', at = Date.now(), last = reported.get(key);
+                if (last?.state === state && at - last.at < 60000)
+                    return;
+                if (reported.size > 1000)
+                    reported.clear();
+                reported.set(key, { state, at });
+                console.log('[entitybox] Computer recovery ' + state + (id ? ' (' + id + ')' : ''));
+            } });
+        if (!worker)
+            return idle;
+        worker.start();
+        return worker;
+    }
+    catch {
+        console.warn('[entitybox] Computer recovery is disabled: host configuration unavailable.');
+        return idle;
+    }
+}

package/dist/entitybox-recovery-store.d.ts

@@ -0,0 +1,33 @@
+import { type EntityboxExecutionIdentity } from './entitybox-execution-lease';
+import type { EntityboxApplicationBinding, EntityboxApplicationQuiescence } from './entitybox-application-boundary';
+import { type EntityboxHostProcess } from './entitybox-host-process';
+export declare function entityboxCanonical(value: unknown): string;
+export interface EntityboxRecoveryHost {
+    hostId: string;
+    dockerContext: string;
+    controller: EntityboxHostProcess;
+    guard: EntityboxHostProcess;
+}
+export interface EntityboxGuardEvidence {
+    version: 1;
+    host: EntityboxRecoveryHost;
+    identity: EntityboxExecutionIdentity;
+    application: EntityboxApplicationBinding;
+    proof: EntityboxApplicationQuiescence;
+}
+export declare function parseEntityboxRecoveryHost(value: unknown): Readonly<EntityboxRecoveryHost>;
+/** Private host-local evidence only. Nothing is stored in browser/profile/work
+ * volumes, and no execution/pairing/provider nonce is written here. */
+export declare class EntityboxRecoveryStore {
+    readonly directory: string;
+    readonly hostId: string;
+    constructor(directory: string);
+    private read;
+    private immutable;
+    writeProof(value: EntityboxGuardEvidence): void;
+    readProof(attemptId: string): {
+        value: EntityboxGuardEvidence;
+        sha256: string;
+    };
+    private proofFile;
+}

package/dist/entitybox-recovery-store.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityboxRecoveryStore = void 0;
+exports.entityboxCanonical = entityboxCanonical;
+exports.parseEntityboxRecoveryHost = parseEntityboxRecoveryHost;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const entitybox_host_process_1 = require("./entitybox-host-process");
+const entitybox_mcp_contract_1 = require("./entitybox-mcp-contract");
+const uuid = /^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/;
+const fail = () => new entitybox_execution_lease_1.EntityboxExecutionError('Native recovery evidence could not be verified');
+function entityboxCanonical(value) { if (Array.isArray(value))
+    return '[' + value.map(entityboxCanonical).join(',') + ']'; if (value && typeof value === 'object')
+    return '{' + Object.keys(value).sort().map(k => JSON.stringify(k) + ':' + entityboxCanonical(value[k])).join(',') + '}'; const result = JSON.stringify(value); if (result === undefined)
+    throw fail(); return result; }
+function parseEntityboxRecoveryHost(value) {
+    const h = value;
+    if (!h || Object.keys(h).sort().join(',') !== 'controller,dockerContext,guard,hostId' || !uuid.test(h.hostId) || typeof h.dockerContext !== 'string' || !/^[-a-zA-Z0-9_.]{1,80}$/.test(h.dockerContext))
+        throw fail();
+    const controller = (0, entitybox_host_process_1.parseEntityboxHostProcess)(h.controller), guard = (0, entitybox_host_process_1.parseEntityboxHostProcess)(h.guard);
+    if (controller.platform !== guard.platform || controller.domain !== guard.domain || controller.pid === guard.pid)
+        throw fail();
+    return Object.freeze({ ...h, controller, guard });
+}
+/** Private host-local evidence only. Nothing is stored in browser/profile/work
+ * volumes, and no execution/pairing/provider nonce is written here. */
+class EntityboxRecoveryStore {
+    directory;
+    hostId;
+    constructor(directory) {
+        if (!path.isAbsolute(directory) || directory.startsWith('\\\\'))
+            throw fail();
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        this.directory = fs.realpathSync(directory);
+        const file = path.join(this.directory, 'host.json');
+        this.immutable(file, entityboxCanonical({ version: 1, id: (0, crypto_1.randomUUID)() }), true);
+        const value = JSON.parse(this.read(file));
+        if (value?.version !== 1 || !uuid.test(value.id) || Object.keys(value).sort().join(',') !== 'id,version')
+            throw fail();
+        this.hostId = value.id;
+    }
+    read(file) { try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16384)
+            throw fail();
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        throw fail();
+    } }
+    immutable(file, text, existing = false) {
+        const temp = path.join(this.directory, 'pending-' + (0, crypto_1.randomUUID)() + '.json');
+        let fd, created = false;
+        try {
+            fd = fs.openSync(temp, 'wx', 0o600);
+            created = true;
+            fs.writeFileSync(fd, text);
+            fs.fsyncSync(fd);
+            fs.closeSync(fd);
+            fd = undefined;
+            try {
+                fs.linkSync(temp, file);
+            }
+            catch (e) {
+                if (e.code !== 'EEXIST' || !existing && this.read(file) !== text)
+                    throw fail();
+            }
+            if (process.platform !== 'win32') {
+                const dir = fs.openSync(this.directory, 'r');
+                try {
+                    fs.fsyncSync(dir);
+                }
+                finally {
+                    fs.closeSync(dir);
+                }
+            }
+        }
+        catch {
+            throw fail();
+        }
+        finally {
+            if (fd !== undefined)
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { }
+            if (created)
+                try {
+                    fs.unlinkSync(temp);
+                }
+                catch { }
+        }
+    }
+    writeProof(value) {
+        const h = parseEntityboxRecoveryHost(value.host), identity = value.identity, scope = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(identity?.scope), a = value.application, p = value.proof;
+        if (value.version !== 1 || h.hostId !== this.hostId || !uuid.test(identity?.requestId) || !uuid.test(identity?.attemptId) || !a || !uuid.test(a.capacityId) || a.desktopId !== scope.desktopId || a.runtimeId !== scope.runtimeId || !/^[a-f0-9]{64}$/.test(a.containerId) || !/^sha256:[a-f0-9]{64}$/.test(a.imageId) || !Number.isFinite(Date.parse(a.startedAt)) || p?.attemptId !== identity.attemptId || p.capacityId !== a.capacityId || p.containerId !== a.containerId || !['paused', 'stopped'].includes(p.state) || !Number.isFinite(Date.parse(p.observedAt)))
+            throw fail();
+        const text = entityboxCanonical({ version: 1, host: h, identity: { requestId: identity.requestId, attemptId: identity.attemptId, scope }, application: { capacityId: a.capacityId, desktopId: a.desktopId, runtimeId: a.runtimeId, containerId: a.containerId, imageId: a.imageId, startedAt: a.startedAt }, proof: { capacityId: p.capacityId, containerId: p.containerId, attemptId: p.attemptId, state: p.state, observedAt: p.observedAt } });
+        if (Buffer.byteLength(text) > 16384)
+            throw fail();
+        this.immutable(this.proofFile(identity.attemptId), text);
+    }
+    readProof(attemptId) { const text = this.read(this.proofFile(attemptId)); let value; try {
+        value = JSON.parse(text);
+        if (value?.version !== 1 || value.identity?.attemptId !== attemptId || value.host?.hostId !== this.hostId)
+            throw fail();
+        parseEntityboxRecoveryHost(value.host);
+    }
+    catch {
+        throw fail();
+    } return { value, sha256: (0, crypto_1.createHash)('sha256').update(text).digest('hex') }; }
+    proofFile(id) { if (!uuid.test(id))
+        throw fail(); return path.join(this.directory, 'guard-' + id + '.json'); }
+}
+exports.EntityboxRecoveryStore = EntityboxRecoveryStore;

package/dist/entitybox-recovery-worker.d.ts

@@ -0,0 +1,30 @@
+import { type EntityboxControllerRecoveryOptions } from './entitybox-controller-recovery';
+export interface EntityboxRecoveryWorkerConfiguration {
+    enabled?: boolean;
+    runtimeId: string;
+    dockerContext: string;
+    directory: string;
+}
+export interface EntityboxRecoveryWorkerIO {
+    rpc: EntityboxControllerRecoveryOptions['rpc'];
+    pairing: () => {
+        runtimeId: string;
+        daemonToken: string;
+    } | null;
+    activeRequests: () => readonly string[];
+    report?: (state: 'recovered' | 'waiting' | 'attention' | 'unavailable', attemptId?: string) => void;
+    /** Fixture-only factory/clock, never model or queue input. */
+    recover?: (options: EntityboxControllerRecoveryOptions) => {
+        run: () => Promise<string>;
+    };
+    clock?: () => number;
+}
+/** Discover interrupted native attempts. Inventory is a hint, never proof of
+ * process death or permission to release resources. The retained recovery
+ * driver rechecks SQL, exact guard evidence and OS process birth identities. */
+export declare function createEntityboxRecoveryWorker(config: EntityboxRecoveryWorkerConfiguration, io: EntityboxRecoveryWorkerIO): {
+    tick: () => Promise<void>;
+    start(): void;
+    stop(): void;
+    drain(timeoutMs?: number): Promise<boolean>;
+} | undefined;

package/dist/entitybox-recovery-worker.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEntityboxRecoveryWorker = createEntityboxRecoveryWorker;
+const entitybox_controller_recovery_1 = require("./entitybox-controller-recovery");
+const entitybox_recovery_store_1 = require("./entitybox-recovery-store");
+const entitybox_mcp_contract_1 = require("./entitybox-mcp-contract");
+const entitybox_operation_1 = require("./entitybox-operation");
+const uuid = /^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+/** Discover interrupted native attempts. Inventory is a hint, never proof of
+ * process death or permission to release resources. The retained recovery
+ * driver rechecks SQL, exact guard evidence and OS process birth identities. */
+function createEntityboxRecoveryWorker(config, io) {
+    if (config.enabled !== true)
+        return undefined;
+    if (!uuid.test(config.runtimeId) || !/^[-a-zA-Z0-9_.]{1,80}$/.test(config.dockerContext))
+        throw new Error('Invalid native recovery configuration');
+    const settings = Object.freeze({ ...config }), store = new entitybox_recovery_store_1.EntityboxRecoveryStore(settings.directory), now = io.clock ?? Date.now;
+    const owners = new Map();
+    let stopped = false, started = false, flight, timer;
+    const token = () => {
+        const p = io.pairing();
+        if (stopped || !p || p.runtimeId !== settings.runtimeId || !p.daemonToken)
+            throw new Error('Recovery unavailable');
+        return p.daemonToken;
+    };
+    const report = (state, id) => { try {
+        io.report?.(state, id);
+    }
+    catch { } };
+    async function inventory() {
+        const rows = [], seen = new Set();
+        let after = null;
+        for (let page = 0; page < 10; page++) {
+            const values = await (0, entitybox_operation_1.entityboxOperation)([], 4500, () => io.rpc('entitybox_native_execution_inventory', { p_token: token(), p_after: after, p_limit: 50 }));
+            token();
+            if (!Array.isArray(values) || values.length > 50)
+                throw new Error();
+            for (const value of values) {
+                if (!value || ![value.attemptId, value.requestId].every(v => typeof v === 'string' && uuid.test(v))
+                    || !['running', 'stop_requested'].includes(value.phase) || seen.has(value.attemptId)
+                    || after !== null && value.attemptId <= after)
+                    throw new Error();
+                const scope = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(value.scope);
+                if (scope.runtimeId !== settings.runtimeId || value.runId !== scope.runId)
+                    throw new Error();
+                seen.add(value.attemptId);
+                after = value.attemptId;
+                rows.push({ attemptId: value.attemptId, requestId: value.requestId, scope });
+            }
+            if (values.length < 50)
+                return rows;
+        }
+        throw new Error();
+    }
+    async function run() {
+        try {
+            const rows = await inventory();
+            const present = new Set(rows.map(r => r.attemptId));
+            // SQL no longer lists a completed attempt. Drop only local retry state;
+            // never touch its old physical bindings after replacement has begun.
+            for (const id of owners.keys())
+                if (!present.has(id))
+                    owners.delete(id);
+            for (const identity of rows) {
+                if (stopped)
+                    return;
+                const active = io.activeRequests();
+                if (!Array.isArray(active) || !active.every(id => typeof id === 'string' && uuid.test(id)))
+                    throw new Error();
+                if (active.includes(identity.requestId))
+                    continue;
+                let retained = owners.get(identity.attemptId);
+                if (retained && (0, entitybox_recovery_store_1.entityboxCanonical)(retained.identity) !== (0, entitybox_recovery_store_1.entityboxCanonical)(identity))
+                    throw new Error();
+                if (retained && now() < retained.retryAt)
+                    continue;
+                try {
+                    token();
+                    if (!retained) {
+                        // Live guards have not written a stop receipt. Reading a receipt
+                        // does not assert its owner died; the driver must still prove it.
+                        const evidence = store.readProof(identity.attemptId).value;
+                        if ((0, entitybox_recovery_store_1.entityboxCanonical)(evidence.identity) !== (0, entitybox_recovery_store_1.entityboxCanonical)(identity)
+                            || evidence.host.hostId !== store.hostId || evidence.host.dockerContext !== settings.dockerContext)
+                            throw new Error();
+                        if (owners.size >= 500)
+                            throw new Error();
+                        const options = { identity, store, dockerContext: settings.dockerContext, token, rpc: io.rpc };
+                        const owner = io.recover ? io.recover(options) : new entitybox_controller_recovery_1.EntityboxControllerRecovery(options);
+                        retained = { identity, owner, failures: 0, retryAt: 0 };
+                        owners.set(identity.attemptId, retained);
+                    }
+                    await retained.owner.run();
+                    token();
+                    owners.delete(identity.attemptId);
+                    report('recovered', identity.attemptId);
+                }
+                catch {
+                    if (retained) {
+                        retained.failures++;
+                        retained.retryAt = now() + Math.min(300000, 5000 * 2 ** Math.min(retained.failures - 1, 6));
+                    }
+                    report(retained ? 'attention' : 'waiting', identity.attemptId);
+                }
+            }
+        }
+        catch {
+            if (!stopped)
+                report('unavailable');
+        }
+    }
+    function tick() { if (stopped)
+        return Promise.resolve(); if (!flight)
+        flight = run().finally(() => { flight = undefined; }); return flight; }
+    function schedule() { if (stopped)
+        return; timer = setTimeout(() => { void tick().finally(schedule); }, 15000); timer.unref?.(); }
+    return {
+        tick,
+        start() { if (started || stopped)
+            return; started = true; void tick().finally(schedule); },
+        stop() { stopped = true; clearTimeout(timer); },
+        async drain(timeoutMs = 15000) {
+            if (!flight)
+                return true;
+            let deadline;
+            try {
+                return await Promise.race([flight.then(() => true), new Promise(resolve => { deadline = setTimeout(() => resolve(false), Math.max(0, timeoutMs)); })]);
+            }
+            finally {
+                clearTimeout(deadline);
+            }
+        },
+    };
+}

package/dist/entitybox-vault-provider.d.ts

@@ -0,0 +1,27 @@
+import { type EntityboxExecutionLease } from './entitybox-execution-lease';
+interface Configuration {
+    /** Trusted request configuration and native-resolved MCP identity only. */
+    itemId: string;
+    entityKey: string;
+    /** Isolated test transport; never supplied by a model or renderer. */
+    fetch?: typeof fetch;
+}
+export declare function entityboxAnthropicKey(values: unknown): string;
+/** Reuse the existing entity-authenticated Vault MCP get_login operation.
+ * Each lookup checks the current Vault grant; no secret cache, host login
+ * directory, environment fallback or credential file is used. */
+export declare class EntityboxVaultProvider {
+    private readonly lease;
+    private readonly config;
+    constructor(lease: EntityboxExecutionLease, config: Configuration);
+    apiKey(signal: AbortSignal): Promise<string>;
+}
+/** Construct the contained broker's API provider from server-verified native
+ * selection. The entity key comes from the read-only native desktop resolver.
+ * Every inference lookup rechecks that selection before asking Vault, so a
+ * revoked or changed binding cannot quietly switch credentials mid-task. */
+export declare function entityboxNativeProvider(lease: EntityboxExecutionLease, entityKey: string, signal: AbortSignal, transport?: typeof fetch): Promise<{
+    models: readonly string[];
+    apiKey: (signal: AbortSignal) => Promise<string>;
+}>;
+export {};