@catheadowl/ukp 0.2.5 → 0.3.0

package/src/capabilities/tls-identity.ts

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { hostname, networkInterfaces } from "node:os";
 import { X509Certificate, createHash } from "node:crypto";
@@ -124,8 +124,13 @@ export interface SelfSignedIdentity {
 }
 
 /** Idempotent self-signed identity for `ukp serve --tls`: persisted under
- * `<serviceFolder>/.ukp/tls/` (machine-local, gitignored — the instance-uid
- * posture). openssl signs it because node:crypto cannot issue X.509; the
+ * the machine home the caller resolves (`~/.ukp/tls/<endpoint-name>/` in
+ * endpoint mode, `~/.ukp/tls/` flat in door mode — the registry's
+ * directory, machine-scoped by adjudication 2026-11-01, inbox
+ * service-dir-layering item 2; the pre-2026-11-01 home was
+ * `<serviceFolder>/.ukp/tls/`, relocated by migrateLegacyServiceTlsDir).
+ * openssl signs
+ * it because node:crypto cannot issue X.509; the
  * identity is the keypair, so losing the key loses the identity (clients
  * re-register). `extraSanEntries` (the `--tls-san` flag, already normalized
  * `IP:x`/`DNS:y`) merges into the SAN coverage; when a persisted certificate
@@ -227,3 +232,50 @@ function runOpenssl(args: readonly string[], outputs: readonly string[]): void {
     );
   }
 }
+
+/** One-time relocation of a Service folder's TLS identity into its machine
+ * home (adjudication 2026-11-01, inbox service-dir-layering item 2): the
+ * identity is machine-scoped material — its SAN coverage names THIS host's
+ * interfaces — so the keypair moves from the pre-2026-11-01
+ * `<serviceFolder>/.ukp/tls/` to the caller-resolved machine home,
+ * untouched (the SPKI pin every client holds survives; nothing re-signs —
+ * INV-04 renewal semantics by construction). The caller swaps the retired
+ * `/tls/` ignore rule in the same gesture.
+ *
+ * `occupied`: the machine home already holds a complete identity while the
+ * legacy dir also exists (a folder copied between machines rather than
+ * cloned through git). The stale duplicate stays put — silently deleting
+ * key material is not this step's call, and the legacy ignore rule keeps
+ * guarding it. */
+export function migrateLegacyServiceTlsDir(
+  serviceFolder: string,
+  identityDir: string,
+): "moved" | "absent" | "occupied" {
+  const legacyDir = join(serviceFolder, ".ukp", "tls");
+  if (!existsSync(legacyDir)) return "absent";
+  if (existsSync(join(identityDir, "cert.pem")) && existsSync(join(identityDir, "key.pem"))) {
+    return "occupied";
+  }
+  mkdirSync(identityDir, { recursive: true, mode: 0o700 });
+  for (const name of ["cert.pem", "key.pem"] as const) {
+    const source = join(legacyDir, name);
+    if (existsSync(source)) moveFileStrict(source, join(identityDir, name));
+  }
+  // With the material out, the whole legacy dir goes: anything left behind
+  // (.lock residue from a crashed serve) is transient state, not identity.
+  rmSync(legacyDir, { recursive: true, force: true });
+  return "moved";
+}
+
+/** rename with a cross-device fallback (a service folder and the user home
+ * can live on different drives); the key keeps its 0600 either way. */
+function moveFileStrict(source: string, target: string): void {
+  try {
+    renameSync(source, target);
+  } catch (error) {
+    if (!(error instanceof Error) || (error as NodeJS.ErrnoException).code !== "EXDEV") throw error;
+    copyFileSync(source, target);
+    chmodSync(target, 0o600);
+    unlinkSync(source);
+  }
+}

package/src/cli.ts

@@ -13,6 +13,7 @@ import { executeReadCommand, READ_SPEC } from "./commands/read.ts";
 import { executeRgCommand, RG_SPEC } from "./commands/rg.ts";
 import { executeGuideCommand, GUIDE_SPEC, GUIDE_TOPICS } from "./commands/guide.ts";
 import { executeInitCommand, INIT_SPEC } from "./commands/init.ts";
+import { executeSessionCommand } from "./commands/session.ts";
 import { executeInspectCommand, INSPECT_SPEC } from "./commands/inspect.ts";
 import { executeListCommand, executeRegisterCommand, executeUnregisterCommand, LIST_SPEC, REGISTER_SPEC, UNREGISTER_SPEC } from "./commands/inventory.ts";
 import { executeNavCommand, NAV_SPEC } from "./commands/nav.ts";
@@ -20,6 +21,7 @@ import { executeProposeCommand, PROPOSE_SPEC } from "./commands/propose.ts";
 import { executeUpdateCommand, UPDATE_SPEC } from "./commands/update.ts";
 import { executeServeCommand, SERVE_SPEC } from "./commands/serve.ts";
 import { executeSearchCommand, SEARCH_SPEC } from "./commands/search.ts";
+import { executeUseCommand, USE_SPEC } from "./commands/use.ts";
 
 export { renderSearchHelp } from "./commands/search.ts";
 export { renderDiagnoseHelp } from "./commands/diagnose.ts";
@@ -54,6 +56,7 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   register: REGISTER_SPEC.summary,
   unregister: UNREGISTER_SPEC.summary,
   list: LIST_SPEC.summary,
+  use: USE_SPEC.summary,
   nav: NAV_SPEC.summary,
   propose: PROPOSE_SPEC.summary,
   search: SEARCH_SPEC.summary,
@@ -66,7 +69,10 @@ export const COMMANDS = Object.entries(COMMAND_DESCRIPTIONS).map(
 
 // Help-display groups (ADR 0022): purpose-noun headings over a flat verb
 // surface. Every command must appear in exactly one group; a guard test
-// locks group membership against COMMANDS.
+// locks group membership against COMMANDS. `session` is deliberately
+// outside the advertised surface (owner ruling 2026-11-03, extending the
+// 2026-10-31 contract-face exit): dispatch stays live, the skill face
+// documents it — hidden but functional, the clig.dev shape.
 export const COMMAND_GROUPS = [
   {
     heading: "Endpoint commands",
@@ -74,7 +80,7 @@ export const COMMAND_GROUPS = [
   },
   {
     heading: "Registry commands",
-    commands: ["init", "register", "unregister", "list"],
+    commands: ["init", "register", "unregister", "list", "use"],
   },
   {
     heading: "Operations commands",
@@ -92,9 +98,16 @@ export interface CliContext {
   resolveProvider?: ProviderResolver;
   qmdCommand?: readonly string[];
   rgCommand?: readonly string[];
+  /** Overrides the amux binary behind `ukp session` (wrapper mechanism,
+   * rg.ts rgCommand precedent). */
+  amuxCommand?: readonly string[];
   artifactRoot?: string;
   artifactRunId?: string;
   now?: Date;
+  /** Overrides the door system snapshot behind `diagnose --door` for tests. */
+  doorProbe?: () => import("./capabilities/door-health.ts").DoorSystemSnapshot;
+  /** Overrides door-file reads behind `diagnose --door` for tests. */
+  readTextFile?: (path: string) => string;
 }
 
 interface CliCommandResult {
@@ -196,7 +209,9 @@ export function renderHelp(): string {
       ),
       "",
     ]),
-    "Endpoint names for --endpoint come from 'ukp list'.",
+    "Endpoint names for --endpoint come from 'ukp list -g' (every registered endpoint); plain 'ukp list' shows the workspace scope.",
+    "",
+    "ukp:// references (ukp://<endpoint>/<path>) address registered endpoints, not web pages; open one with 'ukp read <uri>'.",
     "",
     "A Service's declared capabilities are backed by a provider (QMD, an external tool, backs search and update today); rg and nav work on endpoint files directly, no provider needed.",
     "",
@@ -222,51 +237,6 @@ function writeCommandResult(
   return result.exitCode;
 }
 
-/** Channel philosophy for `ukp list` (ukp_list W2): stdout is the data
- * channel — byte contract, one row per line, the terminal wraps what it
- * must; stderr to an INTERACTIVE terminal is the human channel — progress
- * frames already live there, and the footnote lines (degradation warnings,
- * drift notes) may exceed any terminal width (pins are ~44 chars, urls
- * longer), so the terminal would otherwise break them mid-word or
- * mid-hash. This wraps them at word boundaries (over-long tokens
- * hard-split at the width) — only when the emitter knows the width;
- * piped/CI stderr keeps raw single lines, the machine-parseable form. */
-export function wrapLinesForTerminal(text: string, columns: number): string {
-  if (!Number.isSafeInteger(columns) || columns < 8) return text;
-  const wrapped: string[] = [];
-  for (const line of text.split("\n")) {
-    if (line.length <= columns) {
-      wrapped.push(line);
-      continue;
-    }
-    let current = "";
-    for (const token of line.split(" ")) {
-      // A token longer than the width hard-splits at the width (paths and
-      // SPKI pins have no spaces to break on); the remainder re-enters the
-      // same greedy fill so following words still pack.
-      const pieces: string[] = [];
-      let rest = token;
-      while (rest.length > columns) {
-        pieces.push(rest.slice(0, columns));
-        rest = rest.slice(columns);
-      }
-      pieces.push(rest);
-      for (const piece of pieces) {
-        if (current.length === 0) {
-          current = piece;
-        } else if (current.length + 1 + piece.length <= columns) {
-          current += ` ${piece}`;
-        } else {
-          wrapped.push(current);
-          current = piece;
-        }
-      }
-    }
-    wrapped.push(current);
-  }
-  return wrapped.join("\n");
-}
-
 function executeVersionCommand(args: readonly string[]): CliCommandResult {
   if (args.length === 0) {
     return { exitCode: 0, stdout: renderVersion(), stderr: "" };
@@ -353,6 +323,8 @@ export function runCli(
       currentDirectory,
       registryPath,
       resolveProvider: context.resolveProvider,
+      doorProbe: context.doorProbe,
+      readTextFile: context.readTextFile,
     }), stdout, stderr);
   }
 
@@ -364,6 +336,13 @@ export function runCli(
     }), stdout, stderr);
   }
 
+  if (command === "session") {
+    return writeCommandResultMaybeAsync(executeSessionCommand(args.slice(1), {
+      registryPath,
+      amuxCommand: context.amuxCommand,
+    }), stdout, stderr);
+  }
+
   if (command === "guide") {
     return writeCommandResult(executeGuideCommand(args.slice(1)), stdout, stderr);
   }
@@ -413,22 +392,21 @@ export function runCli(
     }), stdout, stderr);
   }
 
+  if (command === "use") {
+    return writeCommandResult(executeUseCommand(args.slice(1), {
+      currentDirectory,
+      registryPath,
+    }), stdout, stderr);
+  }
+
   if (command === "list") {
     // Streaming delivery (ukp_list W2 / ADR 0026 rule 3): line-by-line
     // through the same stdout writer every other print uses (console.log
     // per line ≡ the single print's trailing-newline form, so piped bytes
     // match the returned-text contract); progress frames only on an
-    // interactive stderr, so piped runs stay progress-silent. The stderr
-    // footnotes wrap at the terminal width there too — piped stderr keeps
-    // the raw single lines (wrapLinesForTerminal's contract).
-    const stderrColumns = process.stderr.columns ?? process.stdout.columns;
-    const interactivelyWrap = (result: CliCommandResult): CliCommandResult =>
-      process.stderr.isTTY === true && typeof stderrColumns === "number" && result.stderr.length > 0
-        ? { ...result, stderr: wrapLinesForTerminal(result.stderr, stderrColumns) }
-        : result;
-    // Conditionality preserved (the W2 sync seam): an all-local listing
-    // stays a synchronous value wrapped synchronously; only the remote
-    // branch's promise goes through .then.
+    // interactive stderr, so piped runs stay progress-silent. stderr
+    // footnotes stay raw single lines in every mode — wrapping is the
+    // terminal's business (channel philosophy, docs/spec list-command).
     const result = executeListCommand(args.slice(1), {
       currentDirectory,
       registryPath,
@@ -437,11 +415,7 @@ export function runCli(
         : {}),
       emitStdout: (line: string) => stdout(line),
     });
-    return writeCommandResultMaybeAsync(
-      result instanceof Promise ? result.then(interactivelyWrap) : interactivelyWrap(result),
-      stdout,
-      stderr,
-    );
+    return writeCommandResultMaybeAsync(result, stdout, stderr);
   }
 
   if (command === "nav") {

package/src/commands/diagnose.ts

@@ -8,6 +8,15 @@ import { HelpRequestError, isHelpRequest } from "./flags.ts";
 import { defaultQmdCommand } from "../capabilities/qmd.ts";
 import { resolveProposeFolder } from "../capabilities/propose.ts";
 import { rgExecutableAvailable } from "../capabilities/rg.ts";
+import {
+  defaultDoorSystemProbe,
+  defaultReadDoorFile,
+  evaluateDoorSnapshot,
+  renderDoorHealthReport,
+  type DoorSystemProbe,
+  type DoorSystemSnapshot,
+} from "../capabilities/door-health.ts";
+import { homedir } from "node:os";
 
 export interface ProviderCheck {
   supported: boolean;
@@ -31,6 +40,15 @@ export interface DiagnoseCommandContext {
   currentDirectory: string;
   registryPath: string;
   resolveProvider?: ProviderResolver;
+  /** Overrides the PowerShell door snapshot for tests (--door mode). */
+  doorProbe?: DoorSystemProbe;
+  /** Overrides file reads of the operator-authored door files for tests. */
+  readTextFile?: (path: string) => string;
+  /** Overrides the %USERPROFILE% expansion root for tests (--door mode). */
+  homeDir?: string;
+  /** Overrides the door-mode platform admission for tests (--door mode);
+   * process.platform in production. */
+  platform?: string;
 }
 
 export interface DiagnoseCommandResult {
@@ -52,8 +70,11 @@ export const DIAGNOSE_SPEC: UkpCommandSpec = {
   name: "diagnose",
   summary: "check a Service or endpoints for wiring problems (manifest, provider setup)",
   group: "operations",
-  description: "Validate a Service folder or selected registered Service endpoints.",
-  usage: "[--endpoint <name> ... | -g]",
+  description: "Validate a Service folder or selected registered Service endpoints, or this host's resident doors (--door).",
+  usage: "[--door] [--endpoint <name> ... | -g]",
+  options: [
+    { flags: "--door", help: "check this host's resident doors (Windows scheduled tasks running the print-task hidden launcher): task state, process tree, port holder, door.log tail - read-only" },
+  ],
   scope: {
     endpointHelp: "validate one registered endpoint; repeat to validate multiple endpoints",
     globalHelp: "validate every endpoint in the Host Registry; takes no value",
@@ -65,6 +86,16 @@ export const DIAGNOSE_SPEC: UkpCommandSpec = {
     "  Service (Manifest and provider wiring). -g validates every registered",
     "  endpoint; -g cannot be combined with --endpoint.",
     "",
+    "Doors:",
+    "  --door skips Service validation and checks this host's resident doors",
+    "  (Windows): every scheduled task running the print-task hidden launcher",
+    "  is reported with its task state, the wscript->cmd->bun process tree,",
+    "  its port (and who holds it), and the door.log tail. Read-only -",
+    "  repairs live in 'ukp serve --print-task' section 5 and the deployment",
+    "  handbook. A door that is down is a finding (exit 1); a host with no",
+    "  doors is healthy. Not combinable with --endpoint or -g; on Linux the",
+    "  door is a systemd socket-activation unit (see the handbook).",
+    "",
   ].join("\n"),
 };
 
@@ -208,18 +239,55 @@ export function renderDependencyRegistryWarnings(
 }
 
 function parseDiagnoseArgs(args: readonly string[]): {
+  door: boolean;
   explicitEndpoints?: string[];
   global: boolean;
   warnings: string[];
 } {
   const parsed = parseKitArgs(DIAGNOSE_SPEC, args);
   return {
+    door: (parsed.options as { door?: boolean }).door === true,
     explicitEndpoints: parsed.scope.explicitEndpoints,
     global: parsed.scope.global,
     warnings: parsed.scope.warnings,
   };
 }
 
+/** Door-mode platform admission (mirrors printTaskPreflightError: pure,
+ * `process.platform` in production). Linux doors are systemd units with
+ * their own check surface; running the Windows probe there is meaningless. */
+export function doorModePlatformError(platform: string): string | undefined {
+  if (platform !== "win32") {
+    return "--door is Windows-only; on Linux the door is a systemd socket-activation unit - check it with systemctl --user status ukp-door.socket (the deployment handbook carries the recipes)";
+  }
+  return undefined;
+}
+
+function executeDoorDiagnose(context: DiagnoseCommandContext): DiagnoseCommandResult {
+  const probe = context.doorProbe ?? defaultDoorSystemProbe;
+  const readTextFile = context.readTextFile ?? defaultReadDoorFile;
+  let snapshot: DoorSystemSnapshot;
+  try {
+    snapshot = probe();
+  } catch (error) {
+    return {
+      exitCode: 1,
+      stdout: "",
+      stderr: `ukp diagnose: door snapshot failed: ${error instanceof Error ? error.message : String(error)}\n`,
+    };
+  }
+  const doors = evaluateDoorSnapshot(snapshot, {
+    homeDir: context.homeDir ?? homedir(),
+    readTextFile,
+  });
+  const unhealthy = doors.some((door) => door.status !== "ok");
+  return {
+    exitCode: unhealthy ? 1 : 0,
+    stdout: renderDoorHealthReport(doors),
+    stderr: "",
+  };
+}
+
 function diagnoseBinding(
   binding: RegistryBinding,
   resolveProvider: ProviderResolver | undefined,
@@ -254,6 +322,16 @@ export function executeDiagnoseCommand(
 
   try {
     const parsed = parseDiagnoseArgs(args);
+    if (parsed.door) {
+      if (parsed.explicitEndpoints !== undefined || parsed.global) {
+        throw new KitUsageError("--door checks this host's resident doors and cannot be combined with --endpoint or -g");
+      }
+      const gate = doorModePlatformError(context.platform ?? process.platform);
+      if (gate !== undefined) {
+        throw new Error(gate);
+      }
+      return executeDoorDiagnose(context);
+    }
     if (!parsed.explicitEndpoints && !parsed.global) {
       try {
         const report = diagnoseService(context.currentDirectory, context.resolveProvider);

package/src/commands/guide-content/client.txt

@@ -4,16 +4,24 @@ Goal: use registered Services from a workspace by default, without naming an end
 
 Model:
 - Client path is separate from the provider path: it uses Services; it does not declare one.
-- A folder may hold both roles at once (dual-role): a Service folder may also carry its own .ukp/client.toml to set its default scope. Each file is read independently.
+- A folder may hold both roles at once (dual-role): a Service folder may also carry its own .ukp/client.toml to set its default scope. Each file is read independently; 'ukp use' never touches the Service face.
 - A workspace .ukp/client.toml default_endpoints list selects which registered endpoints you mean when no selector is given.
 - UKP walks up from the current directory to find the nearest .ukp/client.toml.
 - Client Config stores endpoint names only; bindings live in the Host Registry.
 - Explicit --endpoint <name> or -g overrides the client defaults. With no Client Config, most commands fall back to every registered endpoint.
 - ukp update is stricter: it does not fall back to the Registry. It uses your Client Config defaults, or requires --endpoint <name> / -g.
-- ukp register does not edit .ukp/client.toml.
-
-1. Create a workspace Client Config
-   .ukp/client.toml at the workspace root:
+- ukp register does not edit .ukp/client.toml; 'ukp use' is the one-step writer.
+
+1. Set the workspace defaults (one step)
+   ukp use endpoint-a endpoint-b
+   Writes .ukp/client.toml (default_endpoints = the names you gave, explicit
+   replace, idempotent) and makes it version-visible in the same step:
+   .ukp/.gitignore ignores machine-local state only (the instance
+   identity), so client.toml and service.toml can be committed. Existing
+   repos carrying the retired '*' template are migrated off it (a local
+   'ukp register' does the same on the service side); operator-owned
+   ignore files are left untouched.
+   Manual form: .ukp/client.toml with
    default_endpoints = ["endpoint-a", "endpoint-b"]
    Each name must match a registered endpoint; run 'ukp list' to see what is registered.
 
@@ -41,8 +49,13 @@ Model:
 
 Remember:
 - Client path consumes Services; provider path (ukp guide service) creates them.
-- Client Config lists names, not paths or provider details.
+- Client Config lists names, not paths or provider details; 'ukp use' is the one-step writer (register still does not edit it).
 - Explicit selectors always beat Client Config defaults.
 - Register does not edit Client Config, and Client Config does not register endpoints.
+- Declarations (client.toml, service.toml) are committable by design; only
+  machine-local state (.ukp/instance-uid) stays ignored - the serve TLS
+  identity lives beside the host registry (~/.ukp/tls/), never in the
+  folder. Commit the config so a fresh clone restores the workspace scope
+  once endpoints are registered.
 - Search run artifacts live outside your folders: %LOCALAPPDATA%\ukp\artifacts
   on Windows, ~/.cache/ukp/artifacts (or $XDG_CACHE_HOME) elsewhere.

package/src/commands/guide-content/remote.txt

@@ -5,7 +5,7 @@ Goal: expose registered Services from one machine and consume them from another
 Current model:
 - The ssh:// path needs nothing running on the host: each invocation wakes a loopback door over the SSH connection (it serves the host Registry fresh and self-reaps when idle). Host prerequisites: the host is ssh reachable and has ukp installed the usual way (npm i -g or bun add -g - the wake finds the standard locations).
 - The https path (LAN, public IP, or behind a reverse proxy) uses a resident door: run ukp serve under your process manager. Arbitrary consumers have no SSH credentials, so the listener itself is the trust boundary (TLS + bearer token).
-- Prefer host door mode: run ukp serve without --endpoint to expose every local endpoint behind one port.
+- Prefer host door mode when the whole Registry is safe to declare: run ukp serve without --endpoint to expose every local endpoint behind one port. A Registry that mixes in endpoints you do not want to expose uses --select instead: ukp serve --select a,b,c keeps one port and one door for exactly the named endpoints - everything unselected is not served, routed, or declared (probing its name behaves exactly like probing one that never existed). Reserve per-endpoint --endpoint <name> doors for exposing a single endpoint to different consumers.
 - The door reads the host Registry fresh on each request, so newly registered local endpoints appear without restarting the door.
 - Declared endpoint names come from the host Service Manifest or discovery document; your registry binds each one under a local handle - the declared name by default, or --name <handle> when that name is already taken (two hosts both declaring 'notes' become your 'notes' and 'ali-notes'). --endpoint during register stays an expected-name assertion on the declared name.
 
@@ -41,6 +41,27 @@ LAN HTTPS path:
    ukp read --endpoint <name> notes/x.md
    ukp rg "keyword" --endpoint <name>
 
+Scoped keys for a second machine or an agent (instead of sharing the env token):
+1. On the host, issue a labeled key (run WITHOUT UKP_SERVE_TOKEN set - while the
+   env token is set it takes precedence and the key file is not consulted)
+   ukp serve token add liku "notes:ro,cad:rw"    # prints the raw key ONCE
+   The key lands in ~/.ukp/tokens (0600, hash-only); scopes are name:ro|rw,
+   comma-separated (full power is the explicit '*:rw'); several keys may share
+   a label for zero-downtime rotation.
+
+2. Serve the door with no env token (the file arms the gate; it is re-read on
+   every request)
+   ukp serve --host 0.0.0.0 --tls
+
+3. On the consuming machine, register with the raw key as the token
+   ukp register --url https://<ip>:8570 --token <raw-key>
+   A scoped key only sees its own endpoints: out-of-scope names answer exactly
+   like nonexistent ones; a read-only scope has no propose route.
+
+4. Revoke on the host (effective on the next request - no restart)
+   ukp serve token list
+   ukp serve token revoke liku
+
 Single endpoint mode:
 Use this when you deliberately want to expose only one endpoint instead of the whole host Registry.
    UKP_SERVE_TOKEN=<token> ukp serve --endpoint <name> --host 0.0.0.0 --tls

package/src/commands/guide-content/rg.txt

@@ -27,8 +27,8 @@ Model:
 
 4. Visibility (every rg mode)
    Hidden files (dot-prefixed, including the .ukp/ wiring) are skipped by
-   default. Add -- --hidden after '--' to include them; -uu also lifts
-   .gitignore rules. 'ukp read' can address hidden files directly either way.
+   default. Add -- --hidden after '--' to include them; --no-ignore also
+   lifts .gitignore rules. 'ukp read' can address hidden files directly either way.
 
 Remember:
 - Exact flags and the passthrough allowlist live in 'ukp rg --help'.