@alan-ai-hq/agent-manager 0.1.88 → 0.1.89

package/dist/index.cjs

@@ -15180,7 +15180,7 @@ function resolveCommand(args, env) {
 
 // src/daemon.ts
 var import_node_crypto19 = require("crypto");
-var import_node_os12 = require("os");
+var import_node_os13 = require("os");
 
 // src/sleep-inhibitor.ts
 var import_node_child_process2 = require("child_process");
@@ -15447,7 +15447,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.88";
+var AGENT_VERSION = "0.1.89";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -19549,9 +19549,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value2) {
   return value2.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url3, hostname4) {
-  hostname4.lastIndex = 0;
-  return hostname4.test(url3.hostname);
+function urlHostnameOk(url3, hostname5) {
+  hostname5.lastIndex = 0;
+  return hostname5.test(url3.hostname);
 }
 function urlProtocolOk(url3, protocol4) {
   protocol4.lastIndex = 0;
@@ -50894,7 +50894,7 @@ function scheduleRuntimeModelScan(getBaseMetadata, options) {
 var import_node_crypto18 = require("crypto");
 var import_node_fs22 = require("fs");
 var import_node_http = __toESM(require("http"), 1);
-var import_node_os11 = require("os");
+var import_node_os12 = require("os");
 var import_node_path24 = require("path");
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
@@ -51480,8 +51480,8 @@ var Transport = class extends Emitter {
     return schema + "://" + this._hostname() + this._port() + this.opts.path + this._query(query);
   }
   _hostname() {
-    const hostname4 = this.opts.hostname;
-    return hostname4.indexOf(":") === -1 ? hostname4 : "[" + hostname4 + "]";
+    const hostname5 = this.opts.hostname;
+    return hostname5.indexOf(":") === -1 ? hostname5 : "[" + hostname5 + "]";
   }
   _port() {
     if (this.opts.port && (this.opts.secure && Number(this.opts.port) !== 443 || !this.opts.secure && Number(this.opts.port) !== 80)) {
@@ -70429,8 +70429,8 @@ function applyPostAuth(clientId, clientSecret, params) {
 function applyPublicAuth(clientId, params) {
   params.set("client_id", clientId);
 }
-function isLoopbackHost(hostname4) {
-  return hostname4 === "localhost" || hostname4 === "127.0.0.1" || hostname4 === "[::1]" || hostname4 === "::1";
+function isLoopbackHost(hostname5) {
+  return hostname5 === "localhost" || hostname5 === "127.0.0.1" || hostname5 === "[::1]" || hostname5 === "::1";
 }
 function assertSecureTokenEndpoint(tokenEndpoint) {
   const url3 = new URL(String(tokenEndpoint));
@@ -75335,7 +75335,8 @@ function createLocalDaemonHttpHandler(deps) {
       queueFullShutdown,
       wsUrl,
       inspectLocalSkill,
-      readLocalSkillFile
+      readLocalSkillFile,
+      adoptRuntimeSetupGrant
     } = deps;
     const localApiPort = getLocalApiPort2();
     const heartbeatSeq = getHeartbeatSeq();
@@ -75393,6 +75394,15 @@ function createLocalDaemonHttpHandler(deps) {
       res.writeHead(401, { "content-type": "application/json" }).end(JSON.stringify({ error: "Unauthorized" }));
       return;
     }
+    if (req.method === "POST" && req.url === "/credentials/setup") {
+      void readJsonRequest(req).then((value2) => parseRuntimeSetupGrantInput(value2)).then(adoptRuntimeSetupGrant).then((result) => {
+        res.writeHead(200, { "cache-control": "no-store", "content-type": "application/json" }).end(JSON.stringify(result));
+      }).catch((error61) => {
+        pushLog(`runtime-credential-setup-failed ${error61.message}`);
+        res.writeHead(409, { "cache-control": "no-store", "content-type": "application/json" }).end(JSON.stringify({ error: error61.message }));
+      });
+      return;
+    }
     if (req.method === "GET" && req.url?.startsWith("/skills/preview/file?")) {
       const url3 = new URL(req.url, "http://127.0.0.1");
       const input2 = localSkillRequestInput(url3, true);
@@ -75574,6 +75584,31 @@ function createLocalDaemonHttpHandler(deps) {
     res.writeHead(404, { "content-type": "application/json" }).end(JSON.stringify({ error: "Not found" }));
   };
 }
+async function readJsonRequest(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 16384) throw new Error("credential setup request is too large");
+    chunks.push(buffer);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new Error("credential setup request must be valid JSON");
+  }
+}
+function parseRuntimeSetupGrantInput(value2) {
+  if (!value2 || typeof value2 !== "object") {
+    throw new Error("credential setup request must be an object");
+  }
+  const input2 = value2;
+  if (typeof input2.apiUrl !== "string" || typeof input2.wsUrl !== "string" || input2.endpointProfile !== "production" && input2.endpointProfile !== "local" && input2.endpointProfile !== "staging" && input2.endpointProfile !== "custom" || typeof input2.setupToken !== "string" || input2.setupToken.length === 0 || typeof input2.displayName !== "string" || input2.displayName.length === 0 || typeof input2.installationId !== "string" || input2.installationId.length === 0 || input2.teamId !== void 0 && typeof input2.teamId !== "string") {
+    throw new Error("credential setup request is incomplete");
+  }
+  return input2;
+}
 function localSkillRequestInput(url3, requirePath) {
   const localKey = url3.searchParams.get("localKey") ?? "";
   const expectedContentHash = url3.searchParams.get("expectedContentHash") ?? "";
@@ -76463,6 +76498,123 @@ var RuntimeRunJournal = class {
   }
 };
 
+// src/runtime-registration.ts
+var import_node_os11 = require("os");
+var RuntimeSetupGrantExpiredError = class extends Error {
+  constructor() {
+    super("Runtime setup grant expired");
+    this.name = "RuntimeSetupGrantExpiredError";
+  }
+};
+async function createRuntimeSetupGrant(input2) {
+  const response = await fetch(`${input2.apiUrl}/public/runtimes/setup-tokens`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${input2.accessToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      scope: input2.scope,
+      ...input2.scope === "team" ? { teamId: input2.teamId } : {},
+      ttlMinutes: 5
+    }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  const body = await response.json();
+  if (!response.ok || typeof body.setupToken !== "string") {
+    const detail = typeof body.error === "string" ? `: ${body.error}` : "";
+    throw new Error(`runtime setup grant creation failed with HTTP ${response.status}${detail}`);
+  }
+  return body.setupToken;
+}
+async function exchangeRuntimeSetupGrant(input2) {
+  const registrationAttemptId = getOrCreateSetupAttemptId(input2.setupToken);
+  const registrationInit = {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      ...input2.teamId ? { teamId: input2.teamId } : {},
+      setupToken: input2.setupToken,
+      registrationAttemptId,
+      displayName: input2.displayName,
+      hostname: (0, import_node_os11.hostname)(),
+      runtimeKind: "machine",
+      managementKind: "user_managed",
+      hostKind: "daemon",
+      lifecycle: "durable",
+      capabilities: discoverCapabilities(),
+      metadata: {
+        ...await collectRuntimeMetadataWithProviderLimits(),
+        installationId: input2.installationId
+      }
+    })
+  };
+  let response;
+  let transportError;
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    try {
+      response = await fetch(
+        `${input2.apiUrl}/public/runtimes/register-with-setup-token`,
+        registrationInit
+      );
+      transportError = void 0;
+    } catch (error61) {
+      transportError = error61;
+    }
+    const retriable = response && (response.status === 408 || response.status === 429 || response.status >= 500);
+    if (response && (!retriable || response.ok) || attempt === 3) break;
+    await new Promise((resolve15) => setTimeout(resolve15, attempt * 100));
+  }
+  if (!response) {
+    const detail = transportError instanceof Error ? transportError.message : String(transportError);
+    throw new Error(`runtime registration failed: unable to reach Alan (${detail})`);
+  }
+  if (!response.ok) {
+    const responseBody = await response.text();
+    let errorCode2;
+    try {
+      const parsed = JSON.parse(responseBody);
+      if (typeof parsed.error === "string") errorCode2 = parsed.error;
+    } catch {
+    }
+    if (response.status === 401 && errorCode2 === "setup_token_expired") {
+      clearPendingSetupIntent();
+      throw new RuntimeSetupGrantExpiredError();
+    }
+    throw new Error(`runtime registration failed: ${response.status} ${responseBody}`);
+  }
+  const body = await response.json();
+  if (typeof body.runtime?.id !== "string" || typeof body.runtime.credentialGeneration !== "number" || typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_") || typeof body.runtimeRenewalToken !== "string" || !body.runtimeRenewalToken.startsWith("alan_runtime_renew_")) {
+    throw new Error("runtime registration returned an invalid credential bundle");
+  }
+  return {
+    runtimeId: body.runtime.id,
+    displayName: typeof body.runtime.displayName === "string" ? body.runtime.displayName : input2.displayName,
+    credentialGeneration: body.runtime.credentialGeneration,
+    runtimeToken: body.runtimeToken,
+    runtimeRenewalToken: body.runtimeRenewalToken
+  };
+}
+async function handoffRuntimeSetupGrant(input2) {
+  const response = await fetch(`http://127.0.0.1:${input2.port}/credentials/setup`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${input2.localApiToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(input2.setup),
+    signal: AbortSignal.timeout(input2.timeoutMs ?? 2e4)
+  });
+  const body = await response.json();
+  if (!response.ok) {
+    throw new Error(body.error ?? `daemon credential setup failed with HTTP ${response.status}`);
+  }
+  if (typeof body.runtimeId !== "string" || typeof body.credentialGeneration !== "number") {
+    throw new Error("daemon credential setup returned an invalid activation receipt");
+  }
+  return { runtimeId: body.runtimeId, credentialGeneration: body.credentialGeneration };
+}
+
 // src/skills/local-skill-source.ts
 var import_node_buffer2 = require("buffer");
 var import_node_crypto14 = require("crypto");
@@ -78923,7 +79075,7 @@ async function startDaemon(args) {
     getRuntimeToken: () => runtimeToken
   });
   const runtimeSkillManager = await RuntimeSkillManager.open({
-    homeDirectory: (0, import_node_os11.homedir)(),
+    homeDirectory: (0, import_node_os12.homedir)(),
     endpointProfile,
     profileStorageIdentity: configPath,
     controlClient: skillControl
@@ -78931,7 +79083,7 @@ async function startDaemon(args) {
   const runtimeSkillCoordinator = new RuntimeSkillCoordinator(
     runtimeSkillManager,
     skillControl,
-    (input2) => resolveSkillScanInput((0, import_node_os11.homedir)(), input2)
+    (input2) => resolveSkillScanInput((0, import_node_os12.homedir)(), input2)
   );
   const runSkillSync = async (reason) => {
     const operation = reason === "startup" ? runtimeSkillCoordinator.runStartup() : reason === "interval" ? runtimeSkillCoordinator.runIncremental() : reason === "refresh" ? runtimeSkillCoordinator.runAudit() : runtimeSkillCoordinator.run();
@@ -79250,27 +79402,7 @@ async function startDaemon(args) {
   const renewRuntimeLease = () => {
     if (runtimeRenewalInFlight) return runtimeRenewalInFlight;
     const attempt = (async () => {
-      const adoptRewrittenCredentials = () => {
-        const current2 = readConfig();
-        if (current2.runtimeId !== runtimeId) return false;
-        const nextToken = current2.runtimeToken;
-        const nextRenewal = current2.runtimeRenewalToken;
-        if (typeof nextToken !== "string" || !nextToken.startsWith("alan_runtime_") || typeof nextRenewal !== "string" || !nextRenewal.startsWith("alan_runtime_renew_")) {
-          return false;
-        }
-        if (nextToken === runtimeToken && nextRenewal === runtimeRenewalToken) {
-          return false;
-        }
-        runtimeToken = nextToken;
-        runtimeRenewalToken = nextRenewal;
-        socket.auth = { token: nextToken };
-        clearConnectErrors();
-        pushLog("runtime-credentials-reloaded-from-config");
-        socket.connect();
-        return true;
-      };
       if (!stored.apiUrl || !runtimeRenewalToken) {
-        if (adoptRewrittenCredentials()) return true;
         return false;
       }
       let response = null;
@@ -79302,9 +79434,6 @@ async function startDaemon(args) {
         return false;
       }
       if (!response.ok) {
-        if (response.status === 401 && adoptRewrittenCredentials()) {
-          return true;
-        }
         const code = response.status === 401 ? "runtime_renewal_rejected" : response.status === 403 ? "runtime_disabled" : response.status === 410 ? "runtime_deleted" : response.status >= 500 ? "backend_unreachable" : "runtime_renewal_failed";
         rememberConnectErrorCode(code);
         lastConnectError = `Runtime renewal failed: ${response.status} ${await response.text()}`;
@@ -79320,7 +79449,6 @@ async function startDaemon(args) {
       }
       const current = readConfig();
       if (current.runtimeId !== runtimeId || current.runtimeRenewalToken !== runtimeRenewalToken) {
-        if (adoptRewrittenCredentials()) return true;
         rememberConnectErrorCode("runtime_renewal_superseded");
         lastConnectError = "Runtime credentials changed while renewal was in progress";
         pushLog("runtime-renewal-superseded");
@@ -79348,6 +79476,64 @@ async function startDaemon(args) {
     });
     return attempt;
   };
+  let runtimeSetupInFlight = null;
+  const adoptRuntimeSetupGrant = (input2) => {
+    if (runtimeSetupInFlight) return runtimeSetupInFlight;
+    const attempt = (async () => {
+      const current = readConfig();
+      if (current.runtimeId !== runtimeId || current.installationId !== installationId || input2.installationId !== installationId) {
+        throw new Error("credential setup does not belong to this daemon installation");
+      }
+      if (input2.apiUrl !== stored.apiUrl || input2.wsUrl !== wsUrl) {
+        throw new Error("credential setup cannot change a running daemon's endpoints");
+      }
+      const bundle = await exchangeRuntimeSetupGrant(input2);
+      if (bundle.runtimeId !== runtimeId) {
+        throw new Error("credential setup resolved to a different runtime");
+      }
+      writeConfig({
+        ...current,
+        runtimeToken: bundle.runtimeToken,
+        runtimeRenewalToken: bundle.runtimeRenewalToken,
+        displayName: bundle.displayName
+      });
+      clearPendingSetupIntent();
+      runtimeToken = bundle.runtimeToken;
+      runtimeRenewalToken = bundle.runtimeRenewalToken;
+      socket.auth = { token: bundle.runtimeToken };
+      clearConnectErrors();
+      const ready = new Promise((resolveReady, rejectReady) => {
+        const timeout = setTimeout(() => {
+          socket.off("runtime.ready", onReady);
+          rejectReady(
+            new Error("backend did not acknowledge the replacement credential generation")
+          );
+        }, 15e3);
+        const onReady = (payload) => {
+          if (payload?.credentialGeneration !== bundle.credentialGeneration) return;
+          clearTimeout(timeout);
+          socket.off("runtime.ready", onReady);
+          resolveReady();
+        };
+        socket.on("runtime.ready", onReady);
+      });
+      pushLog(`runtime-credential-setup-redial generation=${bundle.credentialGeneration}`);
+      if (socket.connected) socket.disconnect();
+      socket.connect();
+      await ready;
+      pushLog(`runtime-credential-setup-ready generation=${bundle.credentialGeneration}`);
+      return {
+        runtimeId: bundle.runtimeId,
+        credentialGeneration: bundle.credentialGeneration
+      };
+    })();
+    runtimeSetupInFlight = attempt;
+    void attempt.finally(() => {
+      if (runtimeSetupInFlight === attempt) runtimeSetupInFlight = null;
+    }).catch(() => {
+    });
+    return attempt;
+  };
   const relocationInFlight = /* @__PURE__ */ new Set();
   const persistWorkspaceRelocations = () => {
     const current = readConfig();
@@ -79773,7 +79959,8 @@ async function startDaemon(args) {
       queueFullShutdown: () => queueFullShutdown(),
       wsUrl,
       inspectLocalSkill: (input2) => runtimeSkillManager.inspectLocalPackage(input2),
-      readLocalSkillFile: (input2) => runtimeSkillManager.readLocalPackageFile(input2)
+      readLocalSkillFile: (input2) => runtimeSkillManager.readLocalPackageFile(input2),
+      adoptRuntimeSetupGrant
     })
   );
   const occupiedProbe = await probeLocalDaemonEndpoint(localApiPort, localApiToken);
@@ -79967,7 +80154,7 @@ async function setupDaemon(args) {
   const teamId = argValue(args, "--team") ?? process.env.ALAN_TEAM_ID;
   const setupToken = argValue(args, "--setup-token") ?? process.env.ALAN_RUNTIME_SETUP_TOKEN;
   const token = argValue(args, "--token") ?? process.env.ALAN_SETUP_TOKEN;
-  const displayName = argValue(args, "--name") ?? (0, import_node_os12.hostname)();
+  const displayName = argValue(args, "--name") ?? (0, import_node_os13.hostname)();
   const scope = argValue(args, "--scope") ?? process.env.ALAN_RUNTIME_SCOPE ?? (setupToken ? "team" : "user");
   const installationId = argValue(args, "--installation-id") ?? previousConfig.installationId ?? (0, import_node_crypto19.randomUUID)();
   if (scope !== "team" && scope !== "user") {
@@ -79978,69 +80165,65 @@ async function setupDaemon(args) {
       "setup requires --setup-token <token> or --token <Alan access token>.\nFor normal setup, copy the setup token from Alan and run: alan-agent setup --setup-token <token>\nFor browser authorization, run: alan-agent login"
     );
   }
-  const registrationAttemptId = setupToken ? getOrCreateSetupAttemptId(setupToken) : (0, import_node_crypto19.randomUUID)();
-  const registrationUrl = `${apiUrl}/public/runtimes${setupToken ? "/register-with-setup-token" : ""}`;
-  const registrationInit = {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      ...setupToken ? {} : { authorization: `Bearer ${token}` }
-    },
-    body: JSON.stringify({
-      ...teamId ? { teamId } : {},
-      ...setupToken ? { setupToken, registrationAttemptId } : {},
-      displayName,
-      hostname: (0, import_node_os12.hostname)(),
-      runtimeKind: "machine",
-      managementKind: "user_managed",
-      hostKind: "daemon",
-      lifecycle: "durable",
-      capabilities: discoverCapabilities(),
-      metadata: {
-        ...await collectRuntimeMetadataWithProviderLimits(),
-        installationId
-      }
-    })
+  const registrationGrant = setupToken ?? await createRuntimeSetupGrant({
+    apiUrl,
+    accessToken: token,
+    scope,
+    teamId
+  });
+  const setup = {
+    apiUrl,
+    wsUrl,
+    endpointProfile,
+    setupToken: registrationGrant,
+    teamId,
+    displayName,
+    installationId
   };
-  let response;
-  let transportError;
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
-    try {
-      response = await fetch(registrationUrl, registrationInit);
-      transportError = void 0;
-    } catch (error61) {
-      transportError = error61;
+  let liveConfig = previousConfig;
+  const localApiPort = getLocalApiPort(args, liveConfig);
+  let live = liveConfig.localApiToken ? await probeLocalDaemon(localApiPort, liveConfig.localApiToken) : null;
+  if (!live && liveConfig.localServiceId && liveConfig.localServiceSecret) {
+    live = await adoptConfiguredLocalDaemon(args);
+    liveConfig = readConfigForRegistration();
+  }
+  if (live) {
+    if (!liveConfig.localApiToken) {
+      throw new Error("running daemon could not be authenticated for credential setup");
     }
-    const retriableStatus = response && (response.status === 408 || response.status === 429 || response.status >= 500);
-    if (response && (!retriableStatus || response.ok) || attempt === 3) break;
-    await new Promise((resolve15) => setTimeout(resolve15, attempt * 100));
+    const body2 = await handoffRuntimeSetupGrant({
+      port: localApiPort,
+      localApiToken: liveConfig.localApiToken,
+      setup
+    });
+    console.info("[alan-agent] Runtime credentials adopted by running daemon", {
+      runtimeId: body2.runtimeId,
+      credentialGeneration: body2.credentialGeneration,
+      configPath: getConfigPath()
+    });
+    return;
   }
-  if (!response) {
-    const detail = transportError instanceof Error ? transportError.message : String(transportError);
-    throw new Error(`runtime registration failed: unable to reach Alan (${detail})`);
+  if (readLocalDaemonOwnerLease(getConfigPath())) {
+    throw new Error(
+      "the daemon still owns this runtime configuration, but its authenticated local API is unreachable; recover or stop the daemon before running setup again"
+    );
   }
-  if (!response.ok) {
-    const responseBody = await response.text();
-    let errorCode2;
-    try {
-      const parsed = JSON.parse(responseBody);
-      if (typeof parsed.error === "string") errorCode2 = parsed.error;
-    } catch {
-    }
-    if (setupToken && response.status === 401 && errorCode2 === "setup_token_expired") {
-      clearPendingSetupIntent();
+  let body;
+  try {
+    body = await exchangeRuntimeSetupGrant(setup);
+  } catch (error61) {
+    if (setupToken && error61 instanceof RuntimeSetupGrantExpiredError) {
       console.info("[alan-agent] Setup link expired; continuing with browser authorization");
       await loginWithDeviceCode(args);
       return;
     }
-    throw new Error(`runtime registration failed: ${response.status} ${responseBody}`);
+    throw error61;
   }
-  const body = await response.json();
   writeConfig({
     apiUrl,
     wsUrl,
     endpointProfile,
-    runtimeId: body.runtime.id,
+    runtimeId: body.runtimeId,
     runtimeToken: body.runtimeToken,
     runtimeRenewalToken: body.runtimeRenewalToken,
     localApiPort: getLocalApiPort(args, {}),
@@ -80049,12 +80232,12 @@ async function setupDaemon(args) {
     localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
     eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto19.randomBytes)(32).toString("base64url"),
     daemonEpoch: previousConfig.daemonEpoch,
-    displayName: body.runtime.displayName ?? displayName,
+    displayName: body.displayName,
     installationId
   });
-  if (setupToken) clearPendingSetupIntent();
+  clearPendingSetupIntent();
   console.info("[alan-agent] Runtime registered", {
-    runtimeId: body.runtime.id,
+    runtimeId: body.runtimeId,
     configPath: getConfigPath()
   });
 }
@@ -80074,7 +80257,7 @@ async function loginWithDeviceCode(args) {
     }
     const previousConfig = readConfigForRegistration();
     const { apiUrl, wsUrl, endpointProfile } = resolveEndpoints(args);
-    const displayName = argValue(args, "--name") ?? (0, import_node_os12.hostname)();
+    const displayName = argValue(args, "--name") ?? (0, import_node_os13.hostname)();
     const maxPolls = Number.parseInt(argValue(args, "--max-polls") ?? "300", 10);
     const resumed = readPendingDeviceAuthorization(apiUrl);
     const installationId = resumed?.installationId ?? previousConfig.installationId ?? (0, import_node_crypto19.randomUUID)();
@@ -80086,7 +80269,7 @@ async function loginWithDeviceCode(args) {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           displayName,
-          hostname: (0, import_node_os12.hostname)(),
+          hostname: (0, import_node_os13.hostname)(),
           capabilities: discoverCapabilities(),
           metadata: {
             ...await collectRuntimeMetadataWithProviderLimits(),
@@ -80516,7 +80699,7 @@ async function printDoctor(args = []) {
 // src/mcp-config-adapters.ts
 var import_node_crypto20 = require("crypto");
 var import_node_fs23 = require("fs");
-var import_node_os13 = require("os");
+var import_node_os14 = require("os");
 var import_node_path25 = require("path");
 var log = {
   info: (...args) => console.info("[mcp-config-adapters]", ...args),
@@ -80526,7 +80709,7 @@ var log = {
 };
 var homeDirectoryOverride;
 function homeDirectory() {
-  return homeDirectoryOverride ?? (0, import_node_os13.homedir)();
+  return homeDirectoryOverride ?? (0, import_node_os14.homedir)();
 }
 var MalformedToolConfigError = class extends Error {
 };
@@ -81271,7 +81454,7 @@ var McpSyncService = class {
 
 // src/native-hook-config.ts
 var import_node_fs24 = require("fs");
-var import_node_os14 = require("os");
+var import_node_os15 = require("os");
 var import_node_path26 = require("path");
 var ALAN_HOOK_MARKER = "# alan-native-session-hook";
 var ALAN_KIMI_HOOKS_START = "# alan-native-session-hooks:start";
@@ -81365,7 +81548,7 @@ function nativeHookCommand(input2) {
   if (environment.length === 0) {
     return { type: "command", command: input2.nodeExecutable, args, timeout: 5 };
   }
-  if ((input2.platform ?? (0, import_node_os14.platform)()) === "win32") {
+  if ((input2.platform ?? (0, import_node_os15.platform)()) === "win32") {
     const environmentPrefix2 = environment.map(([key, value2]) => `$env:${key}=${powershellQuote(value2)}`).join("; ");
     const command2 = [input2.nodeExecutable, ...args].map(powershellQuote).join(" ");
     return {
@@ -81410,11 +81593,11 @@ function resolveRuntime(input2 = {}) {
   }
   return {
     configPath,
-    homeDir: input2.homeDir ?? (0, import_node_os14.homedir)(),
+    homeDir: input2.homeDir ?? (0, import_node_os15.homedir)(),
     nodeExecutable: input2.nodeExecutable ?? process.execPath,
     cliEntry,
     environment: input2.environment,
-    platform: input2.platform ?? (0, import_node_os14.platform)()
+    platform: input2.platform ?? (0, import_node_os15.platform)()
   };
 }
 function readSettings(path2, providerLabel) {
@@ -81505,7 +81688,7 @@ function reconcileClaudeNativeHooks(input2 = {}) {
     })
   });
 }
-function removeClaudeNativeHooks(homeDir = (0, import_node_os14.homedir)()) {
+function removeClaudeNativeHooks(homeDir = (0, import_node_os15.homedir)()) {
   return removeNestedCommandHooks((0, import_node_path26.join)(homeDir, ".claude", "settings.json"), "Claude");
 }
 function reconcileCodexNativeHooks(input2 = {}) {
@@ -81522,7 +81705,7 @@ function reconcileCodexNativeHooks(input2 = {}) {
     })
   });
 }
-function removeCodexNativeHooks(homeDir = (0, import_node_os14.homedir)()) {
+function removeCodexNativeHooks(homeDir = (0, import_node_os15.homedir)()) {
   return removeNestedCommandHooks((0, import_node_path26.join)(homeDir, ".codex", "hooks.json"), "Codex");
 }
 function reconcileCopilotNativeHooks(input2 = {}) {
@@ -81546,7 +81729,7 @@ function reconcileCopilotNativeHooks(input2 = {}) {
   );
   return writeSettings(path2, { version: 1, hooks });
 }
-function removeCopilotNativeHooks(homeDir = (0, import_node_os14.homedir)()) {
+function removeCopilotNativeHooks(homeDir = (0, import_node_os15.homedir)()) {
   const path2 = (0, import_node_path26.join)(homeDir, ".copilot", "hooks", "alan-native-session.json");
   if (!(0, import_node_fs24.existsSync)(path2)) return false;
   if (!(0, import_node_fs24.readFileSync)(path2, "utf8").includes(ALAN_HOOK_MARKER)) return false;
@@ -81571,7 +81754,7 @@ function reconcileCursorNativeHooks(input2 = {}) {
   }
   return writeSettings(path2, { ...settings, version: settings.version ?? 1, hooks });
 }
-function removeCursorNativeHooks(homeDir = (0, import_node_os14.homedir)()) {
+function removeCursorNativeHooks(homeDir = (0, import_node_os15.homedir)()) {
   const path2 = (0, import_node_path26.join)(homeDir, ".cursor", "hooks.json");
   if (!(0, import_node_fs24.existsSync)(path2)) return false;
   const settings = readSettings(path2, "Cursor");
@@ -81609,7 +81792,7 @@ function reconcileKimiNativeHooks(input2 = {}) {
 `;
   return writeTextFile(path2, content);
 }
-function removeKimiNativeHooks(homeDir = (0, import_node_os14.homedir)()) {
+function removeKimiNativeHooks(homeDir = (0, import_node_os15.homedir)()) {
   const path2 = (0, import_node_path26.join)(homeDir, ".kimi-code", "config.toml");
   if (!(0, import_node_fs24.existsSync)(path2)) return false;
   const current = (0, import_node_fs24.readFileSync)(path2, "utf8");
@@ -81635,7 +81818,7 @@ function reconcileGrokNativeHooks(input2 = {}) {
     })
   });
 }
-function removeGrokNativeHooks(homeDir = (0, import_node_os14.homedir)()) {
+function removeGrokNativeHooks(homeDir = (0, import_node_os15.homedir)()) {
   const path2 = (0, import_node_path26.join)(homeDir, ".grok", "hooks", "alan-native-session.json");
   if (!(0, import_node_fs24.existsSync)(path2)) return false;
   if (!(0, import_node_fs24.readFileSync)(path2, "utf8").includes(ALAN_HOOK_MARKER)) return false;
@@ -81739,7 +81922,7 @@ function reconcileOpencodeNativePlugin(input2 = {}) {
   (0, import_node_fs24.renameSync)(temporary, path2);
   return true;
 }
-function removeOpencodeNativePlugin(homeDir = (0, import_node_os14.homedir)()) {
+function removeOpencodeNativePlugin(homeDir = (0, import_node_os15.homedir)()) {
   const path2 = (0, import_node_path26.join)(homeDir, ".config", "opencode", "plugins", "alan-native-session.js");
   if (!(0, import_node_fs24.existsSync)(path2)) return false;
   if (!(0, import_node_fs24.readFileSync)(path2, "utf8").includes(ALAN_OPENCODE_PLUGIN_MARKER)) return false;
@@ -81754,7 +81937,7 @@ function configFileContainsMarker(path2, marker) {
     return false;
   }
 }
-function inspectNativeHooksConfigured(providerKind, homeDir = (0, import_node_os14.homedir)(), expectedConfigPath) {
+function inspectNativeHooksConfigured(providerKind, homeDir = (0, import_node_os15.homedir)(), expectedConfigPath) {
   const matchesActiveProfile = (path2, marker) => {
     if (!configFileContainsMarker(path2, marker)) return false;
     if (!expectedConfigPath) return true;
@@ -94335,7 +94518,7 @@ async function runMcpStdioProxy(env = process.env, local = new StdioServerTransp
 // src/native-hook-command.ts
 var import_node_crypto21 = require("crypto");
 var import_node_fs26 = require("fs");
-var import_node_os15 = require("os");
+var import_node_os16 = require("os");
 var import_node_path28 = require("path");
 
 // src/native-project-config.ts
@@ -94615,7 +94798,7 @@ function resolveCodexSessionIdFromTranscriptPath(transcriptPath) {
   );
   return match?.[1];
 }
-function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.KIMI_CODE_HOME?.trim() || (0, import_node_path28.join)((0, import_node_os15.homedir)(), ".kimi-code")) {
+function resolveKimiTranscriptPath(externalSessionId, kimiHomeDir = process.env.KIMI_CODE_HOME?.trim() || (0, import_node_path28.join)((0, import_node_os16.homedir)(), ".kimi-code")) {
   if ((0, import_node_path28.basename)(externalSessionId) !== externalSessionId) return void 0;
   const sessionsDir = (0, import_node_path28.join)(kimiHomeDir, "sessions");
   if (!(0, import_node_fs26.existsSync)(sessionsDir)) return void 0;
@@ -94840,7 +95023,7 @@ function collectNativeIntegrationStatus(args = []) {
   const config2 = readConfig();
   const configPath = getConfigPath();
   const env = getDaemonCliEnvironment();
-  const homeDir = (0, import_node_os15.homedir)();
+  const homeDir = (0, import_node_os16.homedir)();
   return NATIVE_SESSION_PROVIDER_CAPABILITIES.map((capability) => ({
     provider: capability.providerKind,
     command: capability.command,
@@ -94869,7 +95052,7 @@ function decodeResumeFallbackContext(encoded) {
 }
 
 // src/sandbox.ts
-var import_node_os16 = require("os");
+var import_node_os17 = require("os");
 
 // src/execution-activity-tracker.ts
 var ExecutionActivityTracker = class {
@@ -95484,10 +95667,6 @@ var agentProbeAckSchema = external_exports.object({
 // src/sandbox-outbox.ts
 var import_node_crypto23 = require("crypto");
 var import_node_fs27 = require("fs");
-var SANDBOX_EVENT_OUTBOX_ENV = "ALAN_EVENT_OUTBOX_ENABLED";
-function isSandboxEventOutboxEnabled(env = process.env) {
-  return env[SANDBOX_EVENT_OUTBOX_ENV] === "true";
-}
 function deriveSandboxOutboxKey(sessionToken) {
   if (!sessionToken) {
     throw new Error("sandbox event outbox requires ALAN_SESSION_TOKEN for key derivation");
@@ -95507,6 +95686,7 @@ function createSandboxEventOutbox(input2) {
       `sandbox_outbox_spool_reset ${error61 instanceof Error ? error61.message : String(error61)}`
     );
     (0, import_node_fs27.rmSync)(path2, { force: true });
+    (0, import_node_fs27.rmSync)(eventJournalDir(path2), { recursive: true, force: true });
     return new EncryptedEventOutbox(path2, key, input2.pushLog, input2.options);
   }
 }
@@ -95526,7 +95706,12 @@ var SandboxOutboxSocket = class {
       seq = this.seqCounter;
       this.seqByEventId.set(payload.eventId, seq);
     }
-    const wirePayload = { ...payload.event, eventId: payload.eventId, seq };
+    const wirePayload = {
+      ...payload.event,
+      eventId: payload.eventId,
+      seq,
+      deliveryRunId: payload.runId
+    };
     this.socket.emit("agent_event", wirePayload, (result) => {
       if (result?.ok) this.seqByEventId.delete(payload.eventId);
       acknowledge({ ok: Boolean(result?.ok), retryable: result?.retryable });
@@ -95540,54 +95725,38 @@ var SandboxEventDispatcher = class {
   currentRunId;
   constructor(input2) {
     this.conversationId = input2.conversationId;
-    if (!input2.enabled) return;
-    try {
-      this.outbox = createSandboxEventOutbox({
-        conversationId: input2.conversationId,
-        sessionToken: input2.sessionToken,
-        pushLog: input2.pushLog,
-        options: input2.options,
-        spoolPath: input2.spoolPath
-      });
-      this.outboxSocket = new SandboxOutboxSocket(input2.socket);
-    } catch (error61) {
-      input2.onInitError?.(error61);
-      this.outbox = void 0;
-      this.outboxSocket = void 0;
-    }
-  }
-  /** True when events are being durably queued rather than fired-and-forgotten. */
-  get active() {
-    return this.outbox !== void 0 && this.outboxSocket !== void 0;
+    this.outbox = createSandboxEventOutbox({
+      conversationId: input2.conversationId,
+      sessionToken: input2.sessionToken,
+      pushLog: input2.pushLog,
+      options: input2.options,
+      spoolPath: input2.spoolPath
+    });
+    this.outboxSocket = new SandboxOutboxSocket(input2.socket);
   }
   /** Set the run id used for fair replay and per-run heartbeat pruning. */
   setRunId(runId) {
     this.currentRunId = runId;
   }
   /**
-   * Durably deliver one event (enqueue-before-send, remove-on-ack). When the
-   * outbox is inactive, defers to `fireAndForget` so behaviour is unchanged.
+   * Durably deliver one event (enqueue-before-send, remove-on-ack).
    */
-  emit(event, fireAndForget) {
-    if (!this.outbox || !this.outboxSocket) {
-      fireAndForget(event);
-      return;
-    }
+  emit(event) {
     if (isBackgroundHeartbeat(event) && !this.outboxSocket.connected) return;
     this.outbox.enqueue(this.conversationId, this.currentRunId ?? this.conversationId, event);
     this.outbox.flush(this.outboxSocket);
   }
   /** Replay un-acked events in order — called on (re)connect before new events. */
   flush() {
-    if (this.outbox && this.outboxSocket) this.outbox.flush(this.outboxSocket);
+    this.outbox.flush(this.outboxSocket);
   }
   /** Reset in-flight state on disconnect so the next flush replays from the head. */
   disconnect() {
-    this.outbox?.disconnect();
+    this.outbox.disconnect();
   }
   /** Diagnostics: number of events still awaiting a server ack. */
   pendingCount() {
-    return this.outbox?.pendingCount() ?? 0;
+    return this.outbox.pendingCount();
   }
 };
 
@@ -95631,20 +95800,13 @@ var WSClient = class {
       upgrade: false,
       extraHeaders: { "ngrok-skip-browser-warning": "1" }
     });
-    const outboxEnabled = isSandboxEventOutboxEnabled();
     this.eventDispatcher = new SandboxEventDispatcher({
       conversationId: sessionId,
       sessionToken: token,
-      enabled: outboxEnabled,
       socket: this.socket,
-      pushLog: (message) => this.lifecycle?.info("sandbox_agent_event_outbox", { detail: message }),
-      onInitError: (error61) => this.lifecycle?.warn("sandbox_agent_event_outbox_init_failed", {
-        error: error61 instanceof Error ? error61 : new Error(String(error61))
-      })
+      pushLog: (message) => this.lifecycle?.info("sandbox_agent_event_outbox", { detail: message })
     });
-    if (this.eventDispatcher.active) {
-      this.lifecycle?.info("sandbox_agent_event_outbox_enabled", { conversationId: sessionId });
-    }
+    this.lifecycle?.info("sandbox_agent_event_outbox_enabled", { conversationId: sessionId });
     this.setupListeners(callbacks);
   }
   socket;
@@ -95659,11 +95821,7 @@ var WSClient = class {
   intentionalClose = false;
   agentVersion;
   getRunState;
-  /**
-   * Durable at-least-once delivery for stream events. Active only when
-   * `ALAN_EVENT_OUTBOX_ENABLED === "true"`; otherwise events are fired-and-
-   * forgotten exactly as before (see {@link SandboxEventDispatcher}).
-   */
+  /** Durable at-least-once delivery for stream events (see {@link SandboxEventDispatcher}). */
   eventDispatcher;
   /**
    * Bounded record of `messageId`s whose handoff to `onUserMessage` already
@@ -95686,8 +95844,7 @@ var WSClient = class {
   }
   /**
    * Record the run id for events emitted from here on, so the durable outbox can
-   * bucket per-run caps and terminal-event condensation correctly. No-op when the
-   * outbox is disabled.
+   * bucket per-run caps and terminal-event condensation correctly.
    */
   setCurrentRunId(runId) {
     this.eventDispatcher.setRunId(runId);
@@ -95728,9 +95885,7 @@ var WSClient = class {
     }
   }
   emitEvent(event) {
-    this.eventDispatcher.emit(event, (payload) => {
-      this.socket.emit("agent_event", payload);
-    });
+    this.eventDispatcher.emit(event);
   }
   waitForConnection(timeoutMs = 15e3) {
     return new Promise((resolve15, reject) => {
@@ -96172,7 +96327,7 @@ async function runSandbox(config2) {
   }
   const presenter = new WebPresenter(wsClient, config2.sessionId, config2.projectPath);
   presenter.setSuppressSessionLifecycle(true);
-  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os16.homedir)() });
+  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os17.homedir)() });
   let lastProviderSessionId = config2.providerSessionId;
   let resumeFallbackContext = config2.resumeFallbackContext;
   let activeBackendKind = config2.backendKind || "claude_cli";
@@ -96472,7 +96627,7 @@ async function runSandbox(config2) {
 // src/service-manager.ts
 var import_node_child_process9 = require("child_process");
 var import_node_fs28 = require("fs");
-var import_node_os17 = require("os");
+var import_node_os18 = require("os");
 var import_node_path29 = require("path");
 var SERVICE_LABEL = "ai.tryalan.agent";
 var SYSTEMD_UNIT = "alan-agent.service";
@@ -96789,7 +96944,7 @@ WantedBy=default.target
   };
 }
 function resolveCurrentPlatform() {
-  const currentPlatform = (0, import_node_os17.platform)();
+  const currentPlatform = (0, import_node_os18.platform)();
   if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
     throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
   }
@@ -96802,7 +96957,7 @@ function currentServicePlan(args, runtime) {
   if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
   return buildDaemonServicePlan({
     platform: currentPlatform,
-    homeDir: (0, import_node_os17.homedir)(),
+    homeDir: (0, import_node_os18.homedir)(),
     nodeExecutable: runtime?.executable ?? process.execPath,
     cliEntry: (0, import_node_path29.resolve)(cliEntry),
     profile,
@@ -96883,7 +97038,7 @@ function shouldStartOnInstall(hostState) {
 function resolveUsername(options) {
   if (options?.username) return options.username;
   try {
-    return (0, import_node_os17.userInfo)().username;
+    return (0, import_node_os18.userInfo)().username;
   } catch {
     return process.env.USER || process.env.USERNAME || "unknown";
   }
@@ -96921,7 +97076,7 @@ function createHostContext(options = {}) {
   const removeManifest = options.removeManifest ?? ((path2) => (0, import_node_fs28.rmSync)(path2, { force: true }));
   const ensureLogDir = options.ensureLogDir ?? (() => {
     if (plan.platform === "darwin") {
-      (0, import_node_fs28.mkdirSync)((0, import_node_path29.join)((0, import_node_os17.homedir)(), ".alan", "agent", "logs"), { recursive: true, mode: 448 });
+      (0, import_node_fs28.mkdirSync)((0, import_node_path29.join)((0, import_node_os18.homedir)(), ".alan", "agent", "logs"), { recursive: true, mode: 448 });
     }
   });
   return {
@@ -97037,11 +97192,11 @@ ${result.output}
 
 // src/skills/skill-cli.ts
 var import_promises6 = require("fs/promises");
-var import_node_os18 = require("os");
+var import_node_os19 = require("os");
 var import_node_path30 = require("path");
 async function runSkillsCommand(args) {
   const [subcommand, ...options] = args;
-  const homeDirectory2 = option(options, "--home") ?? (0, import_node_os18.homedir)();
+  const homeDirectory2 = option(options, "--home") ?? (0, import_node_os19.homedir)();
   const manager = await RuntimeSkillManager.open({ homeDirectory: homeDirectory2 });
   if (subcommand === "scan") {
     const inputPath = option(options, "--input");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alan-ai-hq/agent-manager",
-  "version": "0.1.88",
+  "version": "0.1.89",
   "type": "module",
   "description": "Alan agent runtime — cloud sandbox and local daemon (alan-agent CLI)",
   "bin": {
@@ -40,7 +40,6 @@
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "type-check": "tsc --noEmit",
-    "publish:npm": "node ../../scripts/publish-agent-manager.mjs",
-    "publish:npm:legacy": "node ../../scripts/publish-agent-manager.mjs --legacy-only"
+    "publish:npm": "node ../../scripts/publish-agent-manager.mjs"
   }
 }