@botbuddy/cli 1.63.13 → 1.63.15

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.13",
-  "source_commit": "36f37695e469a42ec5b85ae0d3db8fefa4c4d5bc",
-  "source_sha256": "ed337e0fa12ed74a93c4eeef069f30a6733a48cd6b3e2de85dc6e1e3f6b1c2c6",
+  "release_version": "1.63.15",
+  "source_commit": "420d8fb935d96c0a7afbd66e5f63fc75b0e05613",
+  "source_sha256": "73dc245585a15aabe21ee1eafb46a034045292d2ce0de76f26b20364b2c05f77",
   "target": "darwin-arm64",
-  "sha256": "bd4b5271deee0be522d4d4ff112b18a48999d7a7fbeccd1e59c001b3e54ab3cb"
+  "sha256": "698836042536d3d1f2ab96c42b7828e7ffcf17c8af01373a68f3282d631e91b2"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.13",
-  "source_commit": "36f37695e469a42ec5b85ae0d3db8fefa4c4d5bc",
-  "source_sha256": "ed337e0fa12ed74a93c4eeef069f30a6733a48cd6b3e2de85dc6e1e3f6b1c2c6",
+  "release_version": "1.63.15",
+  "source_commit": "420d8fb935d96c0a7afbd66e5f63fc75b0e05613",
+  "source_sha256": "73dc245585a15aabe21ee1eafb46a034045292d2ce0de76f26b20364b2c05f77",
   "target": "linux-x64",
-  "sha256": "83d29dc25d53a99c882f1df99f6738d175beed460b12f01fef8a8d9dca1185b2"
+  "sha256": "806fff5fe2c473729abc66b3f7281687d99161c9f2aec43d5c8b258707a40989"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.13",
-  "source_commit": "36f37695e469a42ec5b85ae0d3db8fefa4c4d5bc",
-  "source_sha256": "ed337e0fa12ed74a93c4eeef069f30a6733a48cd6b3e2de85dc6e1e3f6b1c2c6",
+  "release_version": "1.63.15",
+  "source_commit": "420d8fb935d96c0a7afbd66e5f63fc75b0e05613",
+  "source_sha256": "73dc245585a15aabe21ee1eafb46a034045292d2ce0de76f26b20364b2c05f77",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "bd4b5271deee0be522d4d4ff112b18a48999d7a7fbeccd1e59c001b3e54ab3cb",
+      "sha256": "698836042536d3d1f2ab96c42b7828e7ffcf17c8af01373a68f3282d631e91b2",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "83d29dc25d53a99c882f1df99f6738d175beed460b12f01fef8a8d9dca1185b2",
+      "sha256": "806fff5fe2c473729abc66b3f7281687d99161c9f2aec43d5c8b258707a40989",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.13",
+  "version": "1.63.15",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/daemon/callback-release.mjs

@@ -0,0 +1,50 @@
+// BOT-2775: authenticate an older installed runtime against its exact published
+// npm package. Only archive data are read; no downloaded code is executed.
+import {createHash} from 'node:crypto';
+import {execFile as execFileCallback} from 'node:child_process';
+import {promisify} from 'node:util';
+import {mkdtemp,lstat,readFile,mkdir,writeFile,rm} from 'node:fs/promises';
+import {join} from 'node:path';
+import {tmpdir} from 'node:os';
+import {validateDaemonRelease} from './release.mjs';
+const execFile=promisify(execFileCallback),MAX_ARCHIVE=128*1024*1024,MAX_BINARY=64*1024*1024;
+const fail=reason=>{throw Error('callback_release_'+reason)};
+const matches=(r,v,c,s)=>r.releaseVersion===v&&r.sourceCommit===c&&r.sha256===s;
+async function metadataJSON(response){
+ if(!response.ok||!response.body)fail('metadata');let size=0;const chunks=[];
+ for await(const chunk of response.body){size+=chunk.length;if(size>65536)fail('metadata_size');chunks.push(chunk)}
+ try{return JSON.parse(Buffer.concat(chunks).toString('utf8'))}catch{fail('metadata')}
+}
+export async function verifiedCallbackRelease({version,sourceCommit,sha256,releaseRoot,run=execFile,fetchImpl=fetch,validateRelease=validateDaemonRelease}={}){
+ if(!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)||!/^[0-9a-f]{40}$/.test(sourceCommit)||!/^[0-9a-f]{64}$/.test(sha256))fail('identity');
+ try{const current=await validateRelease({releaseRoot},{platform:'linux',arch:'x64'});if(matches(current,version,sourceCommit,sha256))return current}catch{}
+ const controller=new AbortController(),deadline=setTimeout(()=>controller.abort(),60_000);deadline.unref();
+ let root;
+ try{
+  const metadata=await metadataJSON(await fetchImpl('https://registry.npmjs.org/@botbuddy%2fcli/'+encodeURIComponent(version),{signal:controller.signal,redirect:'error'}));
+  const integrity=metadata?.dist?.integrity;
+  if(metadata?.name!=='@botbuddy/cli'||metadata.version!==version||metadata.dist?.tarball!==`https://registry.npmjs.org/@botbuddy/cli/-/cli-${version}.tgz`||typeof integrity!=='string'||!/^sha512-[A-Za-z0-9+/]{86}==$/.test(integrity))fail('metadata');
+  root=await mkdtemp(join(tmpdir(),'botbuddy-callback-release-'));
+  const packed=await run('npm',['pack','@botbuddy/cli@'+version,'--ignore-scripts','--json','--pack-destination',root,'--registry=https://registry.npmjs.org','--fetch-retries=0','--fetch-timeout=30000'],{signal:controller.signal,timeout:45_000,maxBuffer:65536,encoding:'utf8'});
+  let result;try{result=JSON.parse(packed.stdout)}catch{fail('pack')}
+  if(!Array.isArray(result)||result.length!==1||result[0].name!=='@botbuddy/cli'||result[0].version!==version||result[0].integrity!==integrity||!/^[-A-Za-z0-9.]+\.tgz$/.test(result[0].filename))fail('pack');
+  const archive=join(root,result[0].filename),stat=await lstat(archive);
+  if(!stat.isFile()||stat.isSymbolicLink()||stat.size>MAX_ARCHIVE)fail('archive');
+  if('sha512-'+createHash('sha512').update(await readFile(archive)).digest('base64')!==integrity)fail('integrity');
+  const tar=async(args,maxBuffer)=>run('tar',args,{signal:controller.signal,timeout:10_000,maxBuffer,encoding:'buffer'});
+  const names=(await tar(['-tzf',archive],4*1024*1024)).stdout.toString('utf8').trimEnd().split('\n');
+  const details=(await tar(['-tvzf',archive],8*1024*1024)).stdout.toString('utf8').trimEnd().split('\n');
+  if(names.length!==details.length||new Set(names).size!==names.length||names.some((name,i)=>!/^package\//.test(name)||/[\\\x00-\x20\x7f]/.test(name)||name.split('/').some(part=>part==='..'||part==='.')||!['-','d'].includes(details[i][0])))fail('archive_entries');
+  const entries=['package/package.json','package/daemon-release/manifest.json','package/daemon/bin/linux-x64/botbuddy-daemon'];
+  if(entries.some(name=>!names.includes(name)||details[names.indexOf(name)][0]!=='-'))fail('archive_entries');
+  const buffers=[];for(const name of entries)buffers.push((await tar(['-xOzf',archive,'--',name],name.endsWith('botbuddy-daemon')?MAX_BINARY:65536)).stdout);
+  let pkg;try{pkg=JSON.parse(buffers[0])}catch{fail('package')}
+  if(pkg.name!=='@botbuddy/cli'||pkg.version!==version)fail('package');
+  const verifiedRoot=join(root,'verified');await mkdir(join(verifiedRoot,'daemon-release'),{recursive:true,mode:0o700});await mkdir(join(verifiedRoot,'daemon/bin/linux-x64'),{recursive:true,mode:0o700});
+  await writeFile(join(verifiedRoot,'daemon-release/manifest.json'),buffers[1],{mode:0o600});await writeFile(join(verifiedRoot,'daemon/bin/linux-x64/botbuddy-daemon'),buffers[2],{mode:0o755});
+  const release=await validateDaemonRelease({releaseRoot:verifiedRoot},{platform:'linux',arch:'x64'});
+  if(!matches(release,version,sourceCommit,sha256))fail('identity');
+  // No path or payload escapes the temporary verification scope.
+  return Object.freeze({releaseVersion:release.releaseVersion,sourceCommit:release.sourceCommit,sha256:release.sha256,target:release.target});
+ }finally{clearTimeout(deadline);controller.abort();if(root)await rm(root,{recursive:true,force:true})}
+}

package/src/daemon/installer.mjs

@@ -436,3 +436,33 @@ export async function serviceStatus({ platform, host, exec = execFile } = {}) {
     throw error;
   }
 }
+
+// BOT-2775 uses the same immutable release layout, root ancestry and external
+// checksum checks as installation before invoking a producer-published mode.
+// This read-only check runs as the already-authorized SSH/service user, no sudo.
+export const remoteVerifyInstalledCallbackScript = String.raw`set -eu
+binary=$1
+digest=$2
+service_uid=$3
+test "$(uname -s)" = Linux
+test "$(id -u)" = "$service_uid"
+parent=$(dirname "$binary")
+while :; do
+  test ! -L "$parent"
+  test -d "$parent"
+  test "$(stat -c '%u' "$parent")" = 0
+  mode=$(stat -c '%a' "$parent")
+  case "$mode" in *[2367][0-7]|*[0-7][2367]) exit 82 ;; esac
+  test "$parent" != / || break
+  parent=$(dirname "$parent")
+done
+test ! -L "$binary"
+test -f "$binary"
+test -x "$binary"
+test "$(stat -c '%u' "$binary")" = 0
+mode=$(stat -c '%a' "$binary")
+case "$mode" in *[2367][0-7]|*[0-7][2367]) exit 82 ;; esac
+actual=$(sha256sum "$binary" | awk '{print $1}')
+test "$actual" = "$digest"
+printf '%s\n' '{"verified":true}'
+`;

package/src/fixtures/bot2775-callback-contract.json

@@ -0,0 +1,32 @@
+{
+  "fixture_scope": "Synthetic contract fixture only; not an actual installed producer receipt.",
+  "callback_transport": "native_origin_v1",
+  "callback_current_authorization": true,
+  "callback_context": {
+    "owner": "operator@example.test",
+    "tenant_id": "botbuddy",
+    "requester_machine_id": "30000000-0000-4000-8000-000000000001",
+    "descriptor": {
+      "protocol": 1,
+      "binary_path": "/opt/botbuddy/daemon/releases/1.99.0/linux-x64/botbuddy-daemon",
+      "artifact_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "config_path": "/home/botbuddy/.botbuddy-daemon/runtime.json",
+      "service_uid": 1001,
+      "runtime_version": "1.99.0",
+      "runtime_git_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "runtime_target": "linux-amd64",
+      "host_key": "bbh-cccccccccccccccccccccccc",
+      "machine_id": "exact-linux-machine-id-spelling",
+      "engine_id": "engine-fixture",
+      "lease_id": "10000000-0000-4000-8000-000000000001",
+      "job_id": "20000000-0000-4000-8000-000000000001",
+      "attempt": 1,
+      "tenant_id": "botbuddy",
+      "project_id": "bbbot2775fixture",
+      "callback_port": 4600,
+      "producer_pid": 4242,
+      "producer_start_ticks": "100000",
+      "producer_boot_id": "70000000-0000-4000-8000-000000000001"
+    }
+  }
+}

package/src/fixtures/bot2779-handler-status-2026-10-27.json

@@ -0,0 +1,47 @@
+{
+  "provenance": {
+    "captured_at": "2026-10-27",
+    "source": "BOT-2779 actual isolated get_stack_lease handler/SQL fixture run 1afcb247",
+    "producer_descriptor": "synthetic, not a native producer receipt",
+    "projection": "sanitized by backend test owner; only context/project metadata"
+  },
+  "response": {
+    "lease_id": "74704da2-d98a-45c2-9dcc-f3d69e901d24",
+    "state": "active",
+    "host_key": "bbh-09093a8a9efa4f45691a61e7",
+    "execution_mode": "remote",
+    "callback_port": 4600,
+    "callback_transport": "native_origin_v1",
+    "callback_current_authorization": true,
+    "callback_context": {
+      "owner": "jono@bot-buddy.ai",
+      "tenant_id": "botbuddy",
+      "requester_machine_id": "e0c36c64-5055-4456-9df8-5c1d1b60fa43",
+      "descriptor": {
+        "protocol": 1,
+        "binary_path": "/opt/botbuddy/daemon/releases/1.99.0/linux-x64/botbuddy-daemon",
+        "artifact_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "config_path": "/home/botbuddy/.botbuddy-daemon/runtime.json",
+        "service_uid": 1001,
+        "runtime_version": "1.99.0",
+        "runtime_git_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "runtime_target": "linux-amd64",
+        "host_key": "bbh-09093a8a9efa4f45691a61e7",
+        "machine_id": "57d36d8c-a574-4971-98d1-3bea0def5a6f",
+        "engine_id": "engine-fixture",
+        "lease_id": "74704da2-d98a-45c2-9dcc-f3d69e901d24",
+        "job_id": "098b322e-d162-49d9-8f5a-44d31441d88f",
+        "attempt": 1,
+        "tenant_id": "botbuddy",
+        "project_id": "bb214530925b62",
+        "callback_port": 4600,
+        "producer_pid": 4242,
+        "producer_start_ticks": "100000",
+        "producer_boot_id": "70000000-0000-4000-8000-000000000001"
+      }
+    },
+    "connection": {
+      "project_id": "bb214530925b62"
+    }
+  }
+}

package/src/stack-callback-gateway.mjs

@@ -0,0 +1,44 @@
+// BOT-2775: private requester gateway for one same-owner SSH callback generation.
+// The caller supplies only a binding from the authenticated CURRENT lease read.
+import {createServer, request} from 'node:http';
+import {createHash,createHmac, timingSafeEqual} from 'node:crypto';
+import {Transform} from 'node:stream';
+export const CALLBACK_CAP_HEADER='x-botbuddy-callback-capability';
+const digest=value=>createHash('sha256').update(value).digest();
+export const CALLBACK_MAX_STREAM_BYTES=32*1024*1024;
+const sameBinding=(a,b)=>b&&typeof b==='object'&&Object.keys(a).length===Object.keys(b).length&&Object.keys(a).every(key=>a[key]===b[key]);
+export async function openCallbackGateway({callbackPort,binding,capability,lifetimeMs=30_000,now=Date.now,activate=true,readinessNonce=null}){
+ if(!Number.isInteger(callbackPort)||callbackPort<1024||callbackPort>65535||!binding||typeof binding!=='object'||!Object.isFrozen(binding)||typeof capability!=='string'||!/^[0-9a-f]{64}$/.test(capability)||lifetimeMs<1||lifetimeMs>30_000)throw Error('callback gateway admission refused');
+ if(readinessNonce!==null&&!/^[0-9a-f]{32}$/.test(readinessNonce))throw Error('callback readiness identity refused');
+ const bootstrapDeadline=now()+30_000,readinessPath=readinessNonce?'/.botbuddy/callback-ready/'+readinessNonce:null;
+ const readinessProof=readinessNonce?createHmac('sha256',Buffer.from(capability,'hex')).update('native_origin_v1/readiness/'+readinessNonce).digest('hex'):null;
+ const expected=digest(capability),active=new Set(),closeListeners=new Set();let deadline=0,timer,closed=false;
+ const server=createServer((incoming,outgoing)=>{
+  const presented=incoming.headers[CALLBACK_CAP_HEADER];
+  const readiness=readinessPath&&incoming.method==='HEAD'&&incoming.url===readinessPath;
+  if(closed||(now()>=deadline&&!(readiness&&deadline===0&&now()<bootstrapDeadline))||typeof presented!=='string'||!/^[0-9a-f]{64}$/.test(presented)||!timingSafeEqual(digest(presented),expected)||!incoming.url?.startsWith('/')||incoming.url.startsWith('//')||incoming.method==='TRACE'||incoming.headers.upgrade){outgoing.writeHead(403);outgoing.end('CALLBACK_REFUSED');return;}
+  if(readiness){outgoing.writeHead(204,{'x-botbuddy-callback-ready':readinessNonce,'x-botbuddy-callback-proof':readinessProof});outgoing.end();return;}
+  if(Number(incoming.headers['content-length'])>CALLBACK_MAX_STREAM_BYTES){outgoing.writeHead(413,{connection:'close'});outgoing.end('CALLBACK_STREAM_LIMIT');return;}
+  const headers={...incoming.headers,host:'127.0.0.1:'+callbackPort};delete headers[CALLBACK_CAP_HEADER];delete headers['x-botbuddy-callback-ready'];delete headers['x-botbuddy-callback-proof'];delete headers['proxy-authorization'];delete headers['proxy-connection'];
+  const abort=new AbortController();active.add(abort);let limited=false;
+  const finish=()=>{active.delete(abort);abort.abort();};outgoing.once('close',finish);incoming.once('aborted',finish);
+  const limitStream=()=>{let bytes=0;return new Transform({transform(chunk,_encoding,done){bytes+=chunk.length;if(bytes>CALLBACK_MAX_STREAM_BYTES)done(Error('CALLBACK_STREAM_LIMIT'));else done(null,chunk);}});};
+  const upstream=request({host:'127.0.0.1',port:callbackPort,path:incoming.url,method:incoming.method,headers,signal:abort.signal},response=>{
+   const responseHeaders={...response.headers};delete responseHeaders[CALLBACK_CAP_HEADER];delete responseHeaders['x-botbuddy-callback-ready'];delete responseHeaders['x-botbuddy-callback-proof'];
+   if(incoming.method!=='HEAD'&&Number(response.headers['content-length'])>CALLBACK_MAX_STREAM_BYTES){limited=true;response.destroy();outgoing.writeHead(502,{connection:'close'});outgoing.end('CALLBACK_STREAM_LIMIT');return;}
+   const counter=limitStream();counter.on('error',()=>{limited=true;response.destroy();outgoing.destroy();finish();});
+   response.on('error',()=>outgoing.destroy());outgoing.writeHead(response.statusCode,responseHeaders);response.pipe(counter).pipe(outgoing);
+  });
+  upstream.on('error',()=>{if(limited)return;if(!outgoing.headersSent){outgoing.writeHead(503);outgoing.end('CALLBACK_UPSTREAM_UNAVAILABLE');}else outgoing.destroy();});
+  // Count both streaming directions without buffering. Application auth and
+  // HMAC/body bytes are preserved; a stream over32MiB is aborted.
+  const counter=limitStream();counter.on('error',()=>{limited=true;upstream.destroy();incoming.unpipe(counter);if(!outgoing.headersSent){outgoing.writeHead(413,{connection:'close'});outgoing.end('CALLBACK_STREAM_LIMIT',()=>incoming.destroy());}else outgoing.destroy();finish();});incoming.pipe(counter).pipe(upstream);
+ });
+ server.maxConnections=64;server.maxHeadersCount=100;server.headersTimeout=10_000;server.requestTimeout=0;
+ const denySocket=(_req,socket)=>socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');server.on('connect',denySocket);server.on('upgrade',denySocket);
+ let closePromise;const close=()=>{if(closePromise)return closePromise;closed=true;clearTimeout(timer);for(const controller of active)controller.abort();active.clear();server.closeAllConnections();closePromise=new Promise(resolve=>server.close(resolve));for(const listener of closeListeners)listener();return closePromise;};
+ const refresh=(current,validForMs=lifetimeMs)=>{let matches=false;try{matches=sameBinding(binding,current)}catch{}if(closed||!matches||!Number.isFinite(validForMs)||validForMs<=0||validForMs>lifetimeMs){close();throw Error('callback binding changed');}deadline=now()+validForMs;clearTimeout(timer);timer=setTimeout(close,validForMs);timer.unref();};
+ await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(0,'127.0.0.1',resolve);});
+ if(activate)refresh(binding);else{timer=setTimeout(close,30_000);timer.unref();}
+ return {port:server.address().port,refresh,close,onClose(listener){closeListeners.add(listener);if(closed)listener()},isLive:()=>!closed&&now()<deadline};
+}

package/src/stack-identified-admission.mjs

@@ -0,0 +1,17 @@
+// BOT-2780 consumer of BOT-2499's identified admission ACK (not a second allocator).
+// A durable ACK is recovery identity; pending delivery is never dispatch authority.
+const uuid = value => typeof value === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+export function identifiedAdmissionAck(value, requestId) {
+ if(value?.success!==true||!['ADMITTED','EXACT_REPLAY'].includes(value.code)||!uuid(requestId)||!uuid(value.request_id)||value.request_id.toLowerCase()!==requestId.toLowerCase()||!uuid(value.lease_id)||!['created','readopted'].includes(value.admission_kind)||!['queued','provisioning','active'].includes(value.state)||!['pending','bound','none'].includes(value.job_binding)||!(value.provision_job_id===null||uuid(value.provision_job_id))||((value.job_binding==='bound')!==uuid(value.provision_job_id))||(value.admission_kind==='created'&&value.job_binding==='none')||(value.admission_kind==='readopted'&&value.job_binding!=='none')||!['ready','pending'].includes(value.delivery_status))return null;
+ return Object.freeze(Object.fromEntries(['code','request_id','lease_id','admission_kind','state','job_binding','provision_job_id','delivery_status'].map(key=>[key,value[key]])));
+}
+export function identifiedAdmissionDelivery(value, ack) {
+ const delivery=value?.delivery;
+ if(!ack||ack.delivery_status!=='ready'||!delivery||typeof delivery!=='object'||Array.isArray(delivery)||delivery.success===false||delivery.lease_id!=null&&delivery.lease_id!==ack.lease_id||delivery.state!=null&&delivery.state!==ack.state)return null;
+ return {...delivery,success:true,lease_id:ack.lease_id,state:ack.state};
+}
+export function identifiedAdmissionRecovery(request, contextFile, ack=null) {
+ return {request_id:request.request_id,context_file:contextFile,
+  read_tool:'get_stack_lease_admission',read_args:{request_id:request.request_id},
+  ...(ack?{committed_ack:ack}:{})};
+}

package/src/stack-isolation.mjs

@@ -786,6 +786,39 @@ export function stableRunStackReusable(worktreeRoot, dirName, { read = readFileS
   return marker.idle_retained === true || marker.released === true;
 }
 
+/**
+ * BOT-2780: a beta requester-origin run never resumes a retained slot context. Its
+ * generated links name the listener of the invocation that started that stack, so
+ * refuse any unreleased marker for this slot before deriving a new bundle or ports.
+ */
+export function assertFreshRunStackAvailable(worktreeRoot, slot, { read = readFileSync, readdir = readdirSync, lstat = lstatSync } = {}) {
+  const refuse = () => {
+    const error = new Error("requester origin cannot resume a retained slot context; inspect its owning lease with `bb stack status <lease-id>` and use `bb stack done <lease-id> --reap` only after that owner finishes, then confirm reaped before a fresh run");
+    error.code = "REQUESTER_ORIGIN_RETAINED_CONTEXT";
+    throw error;
+  };
+  const stacks = join(worktreeRoot, LEASED_STACKS_DIR);
+  let entries;
+  try { entries = readdir(stacks); } catch (error) { if (error.code === "ENOENT") return; refuse(); }
+  if (entries.length > 4096) refuse();
+  for (const entry of entries) {
+    const path = join(stacks, entry, LEASED_STACK_MARKER);
+    let info;
+    try { info = lstat(path); } catch (error) { if (error.code === "ENOENT" || error.code === "ENOTDIR") continue; refuse(); }
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 65536) refuse();
+    let marker;
+    try { marker = JSON.parse(read(path, "utf8")); } catch { refuse(); }
+    if (!marker || typeof marker.slot !== "string") refuse();
+    if (marker.slot !== slot || marker.released === true) continue;
+    // An expired context whose owner is gone is what materialization GC collects anyway; the
+    // control plane still refuses a new remote lease while any lease on the slot is unreaped.
+    const ownerAlive = Number.isInteger(marker.owner_pid) && marker.owner_pid > 0 &&
+      (!marker.host || marker.host === hostname()) && pidIsAlive(marker.owner_pid);
+    const expired = marker.idle_retained !== true && Number.isFinite(marker.retain_until) && Date.now() >= marker.retain_until;
+    if (!expired || ownerAlive) refuse();
+  }
+}
+
 /** BOT-1803: record a PROVEN reap on the stack's marker, so the next run may reuse the directory. */
 export function markLeasedStackReleased(stackDir, { read = readFileSync, write = writeFileSync, rename = renameSync } = {}) {
   const marker = readStackMarker(stackDir, read);
@@ -1246,6 +1279,22 @@ export function bindLeasedStackClaim(stackDir, leaseId, { registryDir = defaultP
   });
 }
 
+/**
+ * BOT-2780: associate this invocation's claims and marker with its identified admission
+ * request BEFORE the request leaves, so a possibly committed but never acknowledged lease
+ * can later release them through matching accepted cleanup (recoverLeasedStackClaim).
+ */
+export function recordAdmissionRequest(stackDir, requestId, { registryDir = defaultPortRegistryDir() } = {}) {
+  const marker = readStackMarker(stackDir, readFileSync);
+  const token = marker?.invocation_token;
+  if (!token || typeof requestId !== "string" || !requestId) throw new Error("local port claim has no invocation identity");
+  return mutateBoundClaims(stackDir, registryDir, (claims) => {
+    if (claims.some(({ claim }) => claim.invocation_token !== token || claim.lease_id != null)) throw new Error("local port claim was replaced or already bound");
+    for (const { path, claim } of claims) atomicWrite(path, JSON.stringify({ ...claim, admission_request_id: requestId }), { write: writeFileSync, rename: renameSync });
+    atomicWrite(join(stackDir, LEASED_STACK_MARKER), JSON.stringify({ ...marker, admission_request_id: requestId }), { write: writeFileSync, rename: renameSync });
+  });
+}
+
 /** Allocation and recovery serialize the inspect/delete against replacement claims. */
 function mutateBoundClaims(stackDir, registryDir, mutate) {
   const config = readFileSync(join(stackDir, "supabase/config.toml"), "utf8");
@@ -1286,8 +1335,12 @@ export function recoverLeasedStackClaim(stackDir, leaseId, proof, { registryDir
       if (!claims.length) return { released: true, reason: "no local claim remains for this stack" };
       const token = claims[0].claim.invocation_token;
       const project = claims[0].claim.project_id;
+      // BOT-2780: an unbound claim recorded for an identified admission request is this lease's
+      // only when the caller proved (owner-scoped admission read) that request named the lease.
+      const requestBound = (entry) => entry?.lease_id == null && typeof proof.admission_request_id === "string" &&
+        proof.admission_request_id.length > 0 && entry?.admission_request_id === proof.admission_request_id;
       if (typeof token !== "string" || !token || typeof project !== "string" || !/^[A-Za-z0-9_-]+$/.test(project) || claims.some(({ claim }) =>
-        claim.lease_id !== leaseId || claim.invocation_token !== token || claim.project_id !== project || claim.host !== hostname() ||
+        (claim.lease_id !== leaseId && !requestBound(claim)) || claim.invocation_token !== token || claim.project_id !== project || claim.host !== hostname() ||
         !Number.isInteger(claim.owner_pid) || claim.owner_pid <= 0 || pidIsAlive(claim.owner_pid))) {
         return { released: false, reason: "local claim is live, replaced, or lacks this lease binding" };
       }
@@ -1302,7 +1355,7 @@ export function recoverLeasedStackClaim(stackDir, leaseId, proof, { registryDir
         if (error?.code !== "ENOENT") return { released: false, reason: "stack marker is unreadable or corrupt; local claim retained" };
         marker = null;
       }
-      if (marker && (marker.invocation_token !== token || marker.lease_id !== leaseId || marker.project_id !== project)) {
+      if (marker && (marker.invocation_token !== token || (marker.lease_id !== leaseId && !requestBound(marker)) || marker.project_id !== project)) {
         return { released: false, reason: "stack marker was replaced" };
       }
       for (const { path } of claims) rmSync(path);
@@ -1687,7 +1740,8 @@ export function materializeRunStackDir(cwd, { slot, ticket, nonce, idleTtlSecs }
   const configPath = join(sourceDir, "config.toml");
   let rootConfig;
   try {
-    rootConfig = read(configPath, "utf8");
+    // BOT-2780: a beta requester-origin run supplies the already patched private copy.
+    rootConfig = io.configText ?? read(configPath, "utf8");
   } catch (error) {
     throw new Error(
       `cannot materialize an isolated leased stack: ${configPath} is missing or unreadable (${error?.code ?? error?.message ?? error}). ` +

package/src/stack-native-callback.mjs

@@ -0,0 +1,126 @@
+// BOT-2775 same-owner, required native HTTP callback transport. No child capability.
+import {execFile as execFileCallback,spawn} from 'node:child_process';
+import {promisify} from 'node:util';
+import {randomBytes,randomUUID} from 'node:crypto';
+import {createInterface} from 'node:readline';
+import {posix} from 'node:path';
+import {isIP as netIsIP} from 'node:net';
+import {fileURLToPath} from 'node:url';
+import {validateDaemonRelease} from './daemon/release.mjs';
+import {verifiedCallbackRelease} from './daemon/callback-release.mjs';
+import {assertSshTarget,SSH_FORWARD_OPTIONS} from './stack-tunnel.mjs';
+import {installedBinaryPath,remoteVerifyInstalledCallbackScript} from './daemon/installer.mjs';
+import {openCallbackGateway} from './stack-callback-gateway.mjs';
+export const NATIVE_CALLBACK_TRANSPORT='native_origin_v1';
+const execFile=promisify(execFileCallback),uuid=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const safePath=value=>typeof value==='string'&&value.startsWith('/')&&!/[\x00-\x1f\x7f]/.test(value)&&posix.normalize(value)===value;
+const text=value=>typeof value==='string'&&value.length>0&&value.length<=512&&!/[\x00-\x20\x7f]/.test(value);
+const version=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const fields=['protocol','binary_path','artifact_sha256','config_path','service_uid','runtime_version','runtime_git_sha','runtime_target','host_key','machine_id','engine_id','lease_id','job_id','attempt','tenant_id','project_id','callback_port','producer_pid','producer_start_ticks','producer_boot_id'];
+const fail=(code,message)=>{throw Object.assign(Error(message),{code});};
+const quote=value=>"'"+String(value).replaceAll("'","'\\''")+"'";
+const canonicalMachine=value=>typeof value==='string'&&/^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.test(value)?value.replaceAll('-','').toLowerCase():null;
+
+export function validatedCallbackDescriptor(value){
+ if(!value||typeof value!=='object'||Array.isArray(value)||Object.keys(value).length!==fields.length||fields.some(field=>!(field in value)))fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','native callback descriptor missing or unknown');
+ const d=Object.fromEntries(fields.map(field=>[field,value[field]]));
+ if(d.protocol!==1||typeof d.runtime_version!=='string'||!version.test(d.runtime_version)||d.runtime_target!=='linux-amd64'||d.binary_path!==installedBinaryPath({releaseVersion:d.runtime_version,target:'linux-x64'})||!safePath(d.config_path)||!/^sha256:[0-9a-f]{64}$/.test(d.artifact_sha256)||!Number.isSafeInteger(d.service_uid)||d.service_uid<1||!Number.isSafeInteger(d.producer_pid)||d.producer_pid<=1||typeof d.producer_start_ticks!=='string'||!/^[1-9][0-9]*$/.test(d.producer_start_ticks)||!uuid.test(d.producer_boot_id)||!text(d.host_key)||!text(d.machine_id)||!text(d.engine_id)||!uuid.test(d.lease_id)||!uuid.test(d.job_id)||!Number.isSafeInteger(d.attempt)||d.attempt<1||!text(d.tenant_id)||typeof d.project_id!=='string'||!/^[a-z0-9][a-z0-9_-]{1,62}$/.test(d.project_id)||!Number.isInteger(d.callback_port)||d.callback_port<1024||d.callback_port>65535||!/^[0-9a-f]{40}$/.test(d.runtime_git_sha))fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','native callback runtime identity refused');
+ return Object.freeze(d);
+}
+
+export function currentCallbackBinding(current,{leaseId,hostKey,callbackPort,requesterMachineId,routeGeneration}){
+ if(current?.callback_transport!==NATIVE_CALLBACK_TRANSPORT)fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','backend did not acknowledge required callback transport');
+ if(current.callback_current_authorization!==true||current.state!=='active'||current.execution_mode!=='remote')fail('CALLBACK_AUTHORIZATION_LOST','current callback authorization unavailable');
+ const context=current.callback_context,d=validatedCallbackDescriptor(context?.descriptor);
+ if(current.lease_id!==leaseId||current.host_key!==hostKey||d.lease_id!==leaseId||d.host_key!==hostKey||d.callback_port!==callbackPort||current.callback_port!==callbackPort||d.project_id!==current.connection?.project_id||!context||context.tenant_id!==d.tenant_id||!text(context.owner)||!uuid.test(context.requester_machine_id)||canonicalMachine(requesterMachineId)!==canonicalMachine(context.requester_machine_id)||!uuid.test(routeGeneration))fail('CALLBACK_AUTHORIZATION_LOST','current callback context changed');
+ return Object.freeze({owner:context.owner,tenant_id:context.tenant_id,requester_machine_id:context.requester_machine_id,route_generation:routeGeneration,origin:'requester_http',descriptor:d});
+}
+
+export async function verifyInstalledCallbackRuntime({descriptor,sshTarget,sshBin='ssh',run=execFile,env=process.env,releaseRoot=fileURLToPath(new URL('../',import.meta.url)),validateRelease=validateDaemonRelease,resolveRelease=verifiedCallbackRelease}){
+ const d=validatedCallbackDescriptor(descriptor),target=assertSshTarget(sshTarget);
+ let release;try{release=await resolveRelease({version:d.runtime_version,sourceCommit:d.runtime_git_sha,sha256:d.artifact_sha256.slice(7),releaseRoot,validateRelease});}catch{fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','verified callback release unavailable');}
+ if(release.releaseVersion!==d.runtime_version||release.sourceCommit!==d.runtime_git_sha||'sha256:'+release.sha256!==d.artifact_sha256)fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','callback runtime differs from verified release');
+ const command='sh -c '+quote(remoteVerifyInstalledCallbackScript)+' sh '+[d.binary_path,d.artifact_sha256.slice(7),d.service_uid].map(quote).join(' ');
+ let result;try{result=await run(sshBin,['-T','-o','BatchMode=yes','-o','ControlMaster=no','-o','ControlPath=none','--',target,command],{env,timeout:15_000,maxBuffer:4096});}catch{fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','installed callback executable verification failed');}
+ if(result.stdout.trim()!=='{"verified":true}')fail('HOST_CALLBACK_TRANSPORT_UNSUPPORTED','installed callback executable was not verified');
+ return d;
+}
+
+const privateIPv4=value=>netIsIP(value)===4&&(value.startsWith('10.')||value.startsWith('192.168.')||/^172\.(?:1[6-9]|2[0-9]|3[01])\./.test(value));
+function callbackReadiness(value,callbackPort){
+ let url;try{url=new URL(value.callback_url)}catch{fail('CALLBACK_NOT_READY','native callback readiness refused');}
+ if(value.ready!==true||url.protocol!=='http:'||!privateIPv4(url.hostname)||Number(url.port)!==callbackPort||url.pathname!=='/'||url.search||url.hash||url.username||url.password||!privateIPv4(value.peer_ip)||!['container_id','network_id','endpoint_id'].every(key=>/^[0-9a-f]{64}$/.test(value[key]??'')))fail('CALLBACK_NOT_READY','native callback endpoint refused');
+ return url.origin;
+}
+
+// Renewal cadence and acknowledgement budgets. The first renewal also runs the relay's
+// consuming-namespace probe (validation + docker exec), so it gets the larger budget.
+const GENERATION_MS=30_000,RENEW_INTERVAL_MS=10_000,FIRST_ACK_MS=15_000,RENEW_ACK_MS=6_000,STATUS_DEADLINE_MS=5_000,TRANSIENT_RETRY_MS=1_000;
+// A transient status read is retried after TRANSIENT_RETRY_MS only while that retry (read +
+// acknowledgement) can still land inside the current 30 s generation; otherwise the route closes.
+const TRANSIENT_GRACE_MS=GENERATION_MS-TRANSIENT_RETRY_MS-STATUS_DEADLINE_MS-RENEW_ACK_MS;
+export async function openNativeCallbackTransport({current,leaseId,hostKey,callbackPort,requesterMachineId,sshTarget,readCurrent,sshBin='ssh',env=process.env,run=execFile,spawnImpl=spawn,verifyRuntime=verifyInstalledCallbackRuntime,openGateway=openCallbackGateway,renewIntervalMs=RENEW_INTERVAL_MS,firstAckMs=FIRST_ACK_MS,renewAckMs=RENEW_ACK_MS,statusDeadlineMs=STATUS_DEADLINE_MS,transientRetryMs=TRANSIENT_RETRY_MS,transientGraceMs=TRANSIENT_GRACE_MS}){
+ if(typeof readCurrent!=='function')fail('CALLBACK_AUTHORIZATION_LOST','current callback status reader required');
+ const routeGeneration=randomUUID(),options={leaseId,hostKey,callbackPort,requesterMachineId,routeGeneration};
+ const binding=currentCallbackBinding(current,options),snapshot=JSON.stringify(binding),target=assertSshTarget(sshTarget),d=binding.descriptor;
+ await verifyRuntime({descriptor:d,sshTarget:target,sshBin,env,run});
+ const capability=randomBytes(32).toString('hex'),readinessNonce=randomBytes(16).toString('hex'),directory='/tmp/bb-callback-'+randomUUID(),socket=directory+'/callback.sock';
+ const sshArgs=['-T','-o','BatchMode=yes','-o','ControlMaster=no','-o','ControlPath=none','--',target];
+ let gateway,child,terminal,refreshTimer,statusAbort,pendingReady,pendingAck,closed=false,refreshing=false,cleanupPromise,exitResult;const exits=new Set();
+ const reportExit=exit=>{exitResult=exit;for(const listener of exits)listener(exit)};
+ const remote=async command=>{try{return await run(sshBin,[...sshArgs,command],{env,timeout:15_000,maxBuffer:4096})}catch{fail('CALLBACK_REMOTE_OPERATION_FAILED','owned callback operation failed');}};
+ const retire=async()=>{
+  // Every check tolerates the relay's own EXIT trap removing the socket/directory concurrently
+  // (a SIGKILLed local ssh): absence is success, anything present must be exactly ours.
+  const command=`set -eu; directory=${quote(directory)}; socket=${quote(socket)}; gone(){ [ ! -e "$directory" ] && [ ! -L "$directory" ]; }; if gone; then exit 0; fi; test ! -L "$directory"; if ! mode=$(stat -c '%u:%a' "$directory" 2>/dev/null); then gone; exit 0; fi; if [ ! -d "$directory" ]; then gone; exit 0; fi; test "$mode" = ${quote(d.service_uid+':700')}; if [ -e "$socket" ] || [ -L "$socket" ]; then test ! -L "$socket"; if smode=$(stat -c '%u:%a' "$socket" 2>/dev/null); then if [ -e "$socket" ]; then test -S "$socket"; fi; test "$smode" = ${quote(d.service_uid+':600')}; fi; rm -f -- "$socket"; fi; rmdir -- "$directory" 2>/dev/null || gone`;
+  await remote(command);
+ };
+ const close=()=>cleanupPromise??=(async()=>{
+  closed=true;clearInterval(refreshTimer);statusAbort?.abort();pendingReady?.reject(Error('callback closed'));pendingAck?.reject(Error('callback closed'));await gateway?.close();
+  if(child){child.stdin.end();const term=setTimeout(()=>child.kill('SIGTERM'),3000);const kill=setTimeout(()=>child.kill('SIGKILL'),6000);term.unref();kill.unref();try{await terminal}finally{clearTimeout(term);clearTimeout(kill)}}
+  try{await retire()}catch{fail('CALLBACK_CLEANUP_UNCERTAIN','owned callback cleanup could not be verified');}
+ })();
+ try{
+  await remote(`set -eu; test "$(id -u)" = ${quote(d.service_uid)}; umask 077; mkdir -- ${quote(directory)}; chmod 0700 -- ${quote(directory)}`);
+  gateway=await openGateway({callbackPort,binding:Object.freeze({snapshot}),capability,activate:false,readinessNonce});
+  const command=`set -eu; relayPid=; cleanup(){ trap - EXIT HUP INT TERM; if [ -n "$relayPid" ]; then kill -TERM "$relayPid" 2>/dev/null || :; wait "$relayPid" 2>/dev/null || :; fi; rm -f -- ${quote(socket)}; rmdir -- ${quote(directory)}; }; trap cleanup EXIT HUP INT TERM; ${quote(d.binary_path)} --callback-relay --config ${quote(d.config_path)} <&0 & relayPid=$!; status=0; wait "$relayPid" || status=$?; relayPid=; exit "$status"`;
+  child=spawnImpl(sshBin,[...SSH_FORWARD_OPTIONS.filter(arg=>arg!=='-N'),'-o','StreamLocalBindMask=0177','-R',socket+':127.0.0.1:'+gateway.port,'--',target,command],{env,stdio:['pipe','pipe','pipe']});
+  child.stdin.on('error',()=>{});child.stderr.on('data',()=>{});
+  let spawnError=false;child.once('error',()=>{spawnError=true});terminal=new Promise(resolve=>child.once('close',(code,signal)=>resolve({code,signal,reason:spawnError?'callback_process_error':'callback_process_exit'})));
+  terminal.then(exit=>{if(!closed){reportExit(exit);void close().catch(()=>reportExit({code:null,reason:'callback_cleanup_uncertain'}))}});
+  const lines=createInterface({input:child.stdout});
+  lines.on('line',line=>{try{const event=JSON.parse(line);if(event.refused===true&&event.code==='CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE'&&pendingAck){const waiter=pendingAck;pendingAck=undefined;const refusal=Error('consuming namespace callback probe failed');refusal.code='CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE';waiter.reject(refusal);}else if(pendingReady){const waiter=pendingReady;pendingReady=undefined;waiter.resolve(event);}else if(pendingAck&&event.renewed===true&&event.route_generation===routeGeneration&&Number.isFinite(Date.parse(event.expires_at))){const waiter=pendingAck;pendingAck=undefined;waiter.resolve(event);}else throw Error('unexpected callback frame');}catch{reportExit({code:null,reason:'callback_protocol_error'});void close().catch(()=>{})}});
+  terminal.then(()=>{lines.close();pendingReady?.reject(Error('callback process ended'));pendingAck?.reject(Error('callback process ended'));});
+  const ready=await new Promise((resolve,reject)=>{
+   const timeout=setTimeout(()=>reject(Object.assign(Error('callback readiness deadline'),{code:'CALLBACK_NOT_READY'})),20_000);timeout.unref();
+   pendingReady={resolve:value=>{clearTimeout(timeout);resolve(value)},reject:error=>{clearTimeout(timeout);reject(error)}};
+   child.stdin.write(JSON.stringify({binding,capability,socket_path:socket,readiness_nonce:readinessNonce})+'\n');
+  });
+  const callbackUrl=callbackReadiness(ready,callbackPort);
+  gateway.onClose(()=>{if(!closed){reportExit({code:null,reason:'callback_gateway_closed'});void close().catch(()=>{})}});
+  let renewedAt=null;
+  const refresh=async(first=false)=>{
+   if(closed||refreshing)return;refreshing=true;
+   try{
+    statusAbort=new AbortController();let statusTimeout,status;
+    try{status=await new Promise((resolve,reject)=>{statusTimeout=setTimeout(()=>{statusAbort.abort();reject(Object.assign(Error('callback status deadline'),{transient:true}));},statusDeadlineMs);statusTimeout.unref();Promise.resolve().then(()=>readCurrent(statusAbort.signal)).then(resolve,reject).finally(()=>clearTimeout(statusTimeout));});}
+    catch(error){
+     // A failed status READ is not an authorization answer: keep the live generation (relay and
+     // gateway still expire it at 30 s) and retry on the next tick while inside the grace window.
+     if(!first&&error?.transient===true&&renewedAt!==null&&performance.now()-renewedAt<transientGraceMs){const retry=setTimeout(()=>{void refresh()},transientRetryMs);retry.unref();return;}
+     throw error;
+    }
+    if(closed)return;const renewed=currentCallbackBinding(status,options);if(JSON.stringify(renewed)!==snapshot)fail('CALLBACK_AUTHORIZATION_LOST','callback context changed');
+    const sentAt=performance.now();
+    await new Promise((resolve,reject)=>{const timeout=setTimeout(()=>reject(Error('callback renewal acknowledgement deadline')),first?firstAckMs:renewAckMs);timeout.unref();pendingAck={resolve:value=>{clearTimeout(timeout);resolve(value)},reject:error=>{clearTimeout(timeout);reject(error)}};child.stdin.write(JSON.stringify({binding:renewed,renew:true})+'\n');});
+    if(closed)return;renewedAt=sentAt;gateway.refresh(Object.freeze({snapshot}),30_000-(performance.now()-sentAt));
+   }
+   // The first renewal carries the consuming-namespace probe: its uncoded failure is readiness.
+   catch(error){if(!closed){reportExit({code:null,reason:'callback_authorization_lost',...(error.code?{code:error.code}:first?{code:'CALLBACK_NOT_READY'}:{})});void close().catch(()=>{});}}
+   finally{refreshing=false}
+  };
+  await refresh(true);if(closed||!gateway.isLive())fail(exitResult?.code??'CALLBACK_NOT_READY','callback route not ready after readiness');
+  refreshTimer=setInterval(refresh,renewIntervalMs);refreshTimer.unref();
+  return{callbackUrl,close,isLive:()=>!closed&&gateway.isLive(),onExit(listener){exits.add(listener);if(exitResult)listener(exitResult)}};
+ }catch(error){try{await close()}catch{fail('CALLBACK_CLEANUP_UNCERTAIN','owned callback cleanup could not be verified');}throw error;}
+}

package/src/stack-requester-origin-config.mjs

@@ -0,0 +1,21 @@
+// BOT-2780: parse and roundtrip the private derived config before bundling.
+// The vendored, hash-pinned smol-toml 1.9.1 parser (src/vendor/smol-toml) is loaded only
+// for the beta requester-origin feature; help and legacy paths never import it.
+import {isDeepStrictEqual} from 'node:util';
+const fail=(code,message)=>{const error=Error(message);error.code=code;throw error};
+let parser;
+export async function patchRequesterAuthOrigin(configText,origin){
+ let url;try{url=new URL(origin)}catch{fail('REQUESTER_ORIGIN_URL_REFUSED','requester origin refused')}
+ if(url.protocol!=='http:'||url.hostname!=='127.0.0.1'||url.username||url.password||url.pathname!=='/'||url.search||url.hash||origin!==url.origin||!Number.isInteger(Number(url.port))||Number(url.port)<1024||Number(url.port)>65535)fail('REQUESTER_ORIGIN_URL_REFUSED','requester origin must be its reserved loopback HTTP listener');
+ if(typeof configText!=='string'||Buffer.byteLength(configText)>1024*1024)fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config is unavailable or exceeds its bound');
+ try{parser??=import('./vendor/smol-toml/index.js');const {parse,stringify}=await parser;let document;try{document=parse(configText,{integersAsBigInt:true,unsafeKeyBehaviour:'throw'})}catch{fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config is not supported valid TOML')}
+  if(!Object.hasOwn(document,'auth'))Object.defineProperty(document,'auth',{value:{},writable:true,enumerable:true,configurable:true});
+  const auth=document.auth;if(!auth||typeof auth!=='object'||Array.isArray(auth))fail('REQUESTER_ORIGIN_AUTH_REFUSED','private auth configuration is ambiguous');
+  const target=origin+'/auth/v1';
+  if(Object.hasOwn(auth,'external_url')&&(typeof auth.external_url!=='string'||auth.external_url!==''&&auth.external_url!==target))fail('REQUESTER_ORIGIN_EXPLICIT_CONFLICT','explicit auth external URL conflicts with the owned requester origin');
+  Object.defineProperty(auth,'external_url',{value:target,writable:true,enumerable:true,configurable:true});
+  let text,roundtrip;try{text=stringify(document,{numbersAsFloat:true,strictTemporal:true});roundtrip=parse(text,{integersAsBigInt:true,unsafeKeyBehaviour:'throw'})}catch{fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config could not roundtrip safely')}
+  if(!isDeepStrictEqual(roundtrip,document))fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config changed during TOML roundtrip');
+  return text;
+ }catch(error){if(error.code?.startsWith('REQUESTER_ORIGIN_'))throw error;fail('REQUESTER_ORIGIN_PARSER_UNAVAILABLE','vendored requester-origin TOML parser unavailable')}
+}