@codexhost/cli-darwin-arm64 0.1.0-test.2 → 0.1.0

package/app/desktop-controller.mjs

@@ -48,14 +48,27 @@ async function startControllerAttachmentServer(options) {
       if (newline < 0) return;
       handled = true;
       const line = request.slice(0, newline).replace(/\r$/, "");
-      if (line !== `ATTACH ${options.nonce}`) {
-        respond(socket, "rejected");
+      if (line === `ATTACH ${options.nonce}`) {
+        void options.attach().then(
+          () => respond(socket, "ready"),
+          () => respond(socket, "failed")
+        );
         return;
       }
-      void options.attach().then(
-        () => respond(socket, "ready"),
-        () => respond(socket, "failed")
-      );
+      if (line === `COMPATIBILITY_UPDATE ${options.nonce}`) {
+        socket.setTimeout(2e4);
+        void options.compatibilityUpdate().then(
+          (outcome) => respond(socket, outcome),
+          () => respond(socket, "failed")
+        );
+        return;
+      }
+      if (line === `SHUTDOWN ${options.nonce}`) {
+        respond(socket, "ready");
+        queueMicrotask(() => void options.shutdown().catch(() => void 0));
+        return;
+      }
+      respond(socket, "rejected");
     });
   });
   await new Promise((resolve, reject) => {
@@ -321,32 +334,18 @@ var ELECTRON_MODULE_EXPRESSION = `(() => {
   return createRequire(process.execPath)('electron');
 })()`;
 var CONNECT_APP_HOST_CHANNEL = "codex_desktop:connect-app-host";
+var REVIEWED_TITLE_SERVICE_IDENTITIES = ["Dhe", "Nye", "wbe", "nxe"];
 var POLICY_STATE_SYMBOL = "codexhost.main-process-title-policy.v1";
 var SERVICE_OWNER_SYMBOL = "codexhost.main-process-title-policy.owner.v1";
 var RENDERER_READY_EXPRESSION = "(() => { Object.defineProperty(window, '__codexhostMainProcessTitlePolicyV1', { configurable: true, value: { state: 'ready' } }); return 'ready'; })()";
-var INSTALL_POLICY_FUNCTION = `async function () {
+var INSTALL_POLICY_FUNCTION = `async function (rendererWebContentsId) {
   const mainModule = process.mainModule;
   const electron = mainModule != null && typeof mainModule.require === 'function'
     ? mainModule.require('electron')
     : process.getBuiltinModule('module').createRequire(process.execPath)('electron');
-  let selected = null;
-  let largestElementCount = 0;
-  for (const contents of electron.webContents.getAllWebContents()) {
-    if (contents.isDestroyed() || contents.getType() !== 'window') continue;
-    let elementCount = 0;
-    try {
-      elementCount = await contents.executeJavaScript(
-        "document.querySelectorAll('*').length",
-        true,
-      );
-    } catch {}
-    if (Number.isInteger(elementCount) && elementCount > largestElementCount) {
-      selected = contents;
-      largestElementCount = elementCount;
-    }
-  }
-  if (selected == null || largestElementCount < 50) {
-    throw new Error('Populated Renderer unavailable for title policy');
+  const selected = electron.webContents.fromId(rendererWebContentsId);
+  if (selected == null || selected.isDestroyed() || selected.getType() !== 'window') {
+    throw new Error('Owned Renderer unavailable for title policy');
   }
 
   const context = this(selected);
@@ -364,12 +363,22 @@ var INSTALL_POLICY_FUNCTION = `async function () {
   const originalGenerateTitle = servicePrototype?.generateTitle;
   if (
     servicePrototype == null ||
-    !['Dhe', 'Nye'].includes(sampleService?.constructor?.name) ||
     typeof originalGenerateTitle !== 'function' ||
     !Function.prototype.toString.call(originalGenerateTitle).includes('Failed to generate thread title')
   ) {
     throw new Error('ThreadMetadataGenerationService signature mismatch');
   }
+  const rawServiceClass = sampleService?.constructor?.name;
+  const serviceClass = typeof rawServiceClass === 'string' && /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/.test(rawServiceClass)
+    ? rawServiceClass
+    : 'unknown';
+  const warnings = ${JSON.stringify(REVIEWED_TITLE_SERVICE_IDENTITIES)}.includes(serviceClass)
+    ? []
+    : [{
+        capability: 'title-isolation',
+        reason: 'unreviewed-title-service-identity',
+        observedIdentity: serviceClass,
+      }];
 
   const counters = {
     codexTitleCalls: 0,
@@ -443,12 +452,14 @@ var INSTALL_POLICY_FUNCTION = `async function () {
   return {
     state: 'ready',
     reason: 'ready',
-    contextClass: context.constructor.name,
-    serviceClass: sampleService.constructor.name,
     requiresRendererReload: true,
+    warnings,
   };
 }`;
-async function installMainProcessTitlePolicy(inspector) {
+async function installMainProcessTitlePolicy(inspector, rendererWebContentsId) {
+  if (!Number.isInteger(rendererWebContentsId) || rendererWebContentsId <= 0) {
+    throw new Error("Renderer webContents ID must be a positive integer");
+  }
   const listenerResponse = resultRecord(
     await inspector.command("Runtime.evaluate", {
       expression: `(${ELECTRON_MODULE_EXPRESSION}).ipcMain.listeners(${JSON.stringify(
@@ -497,7 +508,8 @@ async function installMainProcessTitlePolicy(inspector) {
   const installPromise = resultRecord(
     await inspector.command("Runtime.callFunctionOn", {
       objectId: getContextId,
-      functionDeclaration: INSTALL_POLICY_FUNCTION
+      functionDeclaration: INSTALL_POLICY_FUNCTION,
+      arguments: [{ value: rendererWebContentsId }]
     }),
     "Runtime.callFunctionOn"
   );
@@ -514,12 +526,17 @@ async function installMainProcessTitlePolicy(inspector) {
   );
   const remoteResult = installResponse.result;
   const value = isRecord2(remoteResult) ? remoteResult.value : null;
-  if (!isRecord2(value) || value.state !== "ready" || value.reason !== "ready" || typeof value.contextClass !== "string" || typeof value.serviceClass !== "string" || value.requiresRendererReload !== true) {
+  if (!isRecord2(value) || value.state !== "ready" || value.reason !== "ready" || value.requiresRendererReload !== true || !Array.isArray(value.warnings) || value.warnings.length > 1 || value.warnings.some(
+    (warning) => !isRecord2(warning) || warning.capability !== "title-isolation" || warning.reason !== "unreviewed-title-service-identity" || typeof warning.observedIdentity !== "string" || !/^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/.test(warning.observedIdentity) || Object.keys(warning).length !== 3
+  )) {
     throw new Error("Main-process title policy returned an invalid status");
   }
   return value;
 }
-async function markRendererTitlePolicyReady(inspector) {
+async function markRendererTitlePolicyReady(inspector, rendererWebContentsId) {
+  if (!Number.isInteger(rendererWebContentsId) || rendererWebContentsId <= 0) {
+    throw new Error("Renderer webContents ID must be a positive integer");
+  }
   const value = await inspector.evaluate(`(async () => {
     const state = globalThis[Symbol.for(${JSON.stringify(POLICY_STATE_SYMBOL)})];
     if (state == null) throw new Error('Main-process title policy is unavailable');
@@ -527,28 +544,9 @@ async function markRendererTitlePolicyReady(inspector) {
     const electron = mainModule != null && typeof mainModule.require === 'function'
       ? mainModule.require('electron')
       : process.getBuiltinModule('module').createRequire(process.execPath)('electron');
-    let selected = null;
-    let largestElementCount = 0;
-    for (const contents of electron.webContents.getAllWebContents()) {
-      if (contents.isDestroyed() || contents.getType() !== 'window') continue;
-      let elementCount = 0;
-      try {
-        const evaluation = contents.executeJavaScript(
-          "document.querySelectorAll('*').length",
-          true,
-        );
-        const timeout = new Promise((_, reject) => {
-          setTimeout(() => reject(new Error('Renderer readiness inspection timed out')), 2_000);
-        });
-        elementCount = await Promise.race([evaluation, timeout]);
-      } catch {}
-      if (Number.isInteger(elementCount) && elementCount > largestElementCount) {
-        selected = contents;
-        largestElementCount = elementCount;
-      }
-    }
-    if (selected == null || largestElementCount < 50) {
-      throw new Error('Populated Renderer unavailable for title policy readiness');
+    const selected = electron.webContents.fromId(${rendererWebContentsId});
+    if (selected == null || selected.isDestroyed() || selected.getType() !== 'window') {
+      throw new Error('Owned Renderer unavailable for title policy readiness');
     }
     if (!state.ownedWebContentsIds.has(selected.id)) {
       throw new Error('Renderer metadata service ownership is unavailable');
@@ -626,55 +624,78 @@ async function installDraftPrewarmPolicyInRenderer(contents, findRequestManagerE
       (property) => property.name === "candidateCount"
     )?.value?.value;
     const hostId = managerProperties.result?.find((property) => property.name === "hostId")?.value?.value;
-    const sendRequest = managerProperties.result?.find(
-      (property) => property.name === "sendRequest"
+    const manager = managerProperties.result?.find(
+      (property) => property.name === "manager"
     )?.value;
-    if (candidateCount !== 1 || hostId !== "local" || typeof sendRequest?.objectId !== "string") {
+    if (candidateCount !== 1 || hostId !== "local" || typeof manager?.objectId !== "string") {
       throw new Error("Renderer request manager is ambiguous");
     }
+    const managerFunctions = await contents.debugger.sendCommand("Runtime.getProperties", {
+      objectId: manager.objectId
+    });
+    let managerSendRequestId = managerFunctions.result?.find(
+      (property) => property.name === "sendRequest"
+    )?.value?.objectId;
+    const managerPrototypeId = managerFunctions.internalProperties?.find(
+      (property) => property.name === "[[Prototype]]"
+    )?.value?.objectId;
+    if (typeof managerSendRequestId !== "string" && typeof managerPrototypeId === "string") {
+      const prototypeFunctions = await contents.debugger.sendCommand("Runtime.getProperties", {
+        objectId: managerPrototypeId,
+        ownProperties: true
+      });
+      managerSendRequestId = prototypeFunctions.result?.find(
+        (property) => property.name === "sendRequest"
+      )?.value?.objectId;
+    }
+    if (typeof managerSendRequestId !== "string") {
+      throw new Error("Renderer request manager sendRequest is unavailable");
+    }
     const functionProperties = await contents.debugger.sendCommand("Runtime.getProperties", {
-      objectId: sendRequest.objectId
+      objectId: managerSendRequestId
     });
     const scopesId = functionProperties.internalProperties?.find(
       (property) => property.name === "[[Scopes]]"
     )?.value?.objectId;
-    if (typeof scopesId !== "string") {
-      throw new Error("Renderer request bridge scopes are unavailable");
-    }
-    const scopes = await contents.debugger.sendCommand("Runtime.getProperties", {
-      objectId: scopesId,
-      ownProperties: true
-    });
-    const bridgeCandidates = [];
-    for (const scope of scopes.result ?? []) {
-      const scopeId = scope.value?.objectId;
-      if (typeof scopeId !== "string") continue;
-      const scopeProperties = await contents.debugger.sendCommand("Runtime.getProperties", {
-        objectId: scopeId,
+    const hostBridgeCandidates = [];
+    if (typeof scopesId === "string") {
+      const scopes = await contents.debugger.sendCommand("Runtime.getProperties", {
+        objectId: scopesId,
         ownProperties: true
       });
-      const bridge2 = scopeProperties.result?.find(
-        (property) => (property.name === "Rf" || property.name === "rp") && property.value?.type === "function"
-      )?.value;
-      if (typeof bridge2?.objectId === "string") {
-        bridgeCandidates.push({ objectId: bridge2.objectId });
+      for (const scope of scopes.result ?? []) {
+        if (typeof scope.value?.objectId !== "string") continue;
+        const scopeProperties = await contents.debugger.sendCommand("Runtime.getProperties", {
+          objectId: scope.value.objectId,
+          ownProperties: true
+        });
+        for (const property of scopeProperties.result ?? []) {
+          if (property.value?.type !== "object" || typeof property.value.objectId !== "string") {
+            continue;
+          }
+          const candidateSignature = await contents.debugger.sendCommand(
+            "Runtime.callFunctionOn",
+            {
+              objectId: property.value.objectId,
+              functionDeclaration: "function(){const send=this.sendRequest;return typeof send==='function'&&Function.prototype.toString.call(send).includes('messageHandler')}",
+              returnByValue: true
+            }
+          );
+          if (candidateSignature.result?.value === true) {
+            hostBridgeCandidates.push({
+              name: String(property.name),
+              objectId: property.value.objectId
+            });
+          }
+        }
       }
     }
-    const bridge = bridgeCandidates[0];
-    if (bridgeCandidates.length !== 1 || !bridge) {
-      throw new Error("Renderer request bridge is ambiguous");
-    }
-    const signature = await contents.debugger.sendCommand("Runtime.callFunctionOn", {
-      objectId: bridge.objectId,
-      functionDeclaration: "function(){return {arity:this.length,source:Function.prototype.toString.call(this)}}",
-      returnByValue: true
-    });
-    const signatureValue = signature.result?.value;
-    if (signatureValue?.arity !== 2 || typeof signatureValue.source !== "string" || !signatureValue.source.includes(".sendRequest")) {
-      throw new Error("Renderer request bridge signature mismatch");
+    const hostBridge = hostBridgeCandidates[0];
+    if (hostBridgeCandidates.length !== 1 || !hostBridge) {
+      throw new Error("Renderer Host request bridge is ambiguous");
     }
     const installed = await contents.debugger.sendCommand("Runtime.callFunctionOn", {
-      objectId: bridge.objectId,
+      objectId: hostBridge.objectId,
       functionDeclaration: installRendererPolicyFunction,
       arguments: [{ value: hostId }],
       awaitPromise: true,
@@ -732,11 +753,13 @@ var FIND_REQUEST_MANAGER_EXPRESSION = `(() => {
   return {
     candidateCount: managers.size,
     hostId: manager?.getHostId?.() ?? null,
-    sendRequest: manager?.sendRequest ?? null,
+    manager,
   };
 })()`;
 var INSTALL_RENDERER_POLICY_FUNCTION = `function(hostId) {
-  return (${installDraftPrewarmPolicyBridge.toString()})(this, hostId, window);
+  const bridge = this;
+  const send = (method, parameters) => bridge.sendRequest(method, parameters);
+  return (${installDraftPrewarmPolicyBridge.toString()})(send, hostId, window);
 }`;
 function mainProcessInstaller(rendererWebContentsId) {
   return `async function () {
@@ -765,21 +788,30 @@ async function installRendererDraftPrewarmPolicy(inspector, rendererWebContentsI
 }
 
 // packages/desktop-control/src/renderer-control-session.ts
+var RendererCompatibilityError = class extends Error {
+  constructor(capability, reason, cause) {
+    super(`Renderer compatibility boundary unavailable: ${capability}`, { cause });
+    this.capability = capability;
+    this.reason = reason;
+    this.name = "RendererCompatibilityError";
+  }
+  capability;
+  reason;
+};
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function safeTargetUrl(value) {
-  if (typeof value !== "string" || value.length === 0) return "unknown";
-  try {
-    const url = new URL(value);
-    return url.protocol === "app:" ? `${url.protocol}//${url.host}${url.pathname}` : url.protocol;
-  } catch {
-    return "unknown";
-  }
-}
 function sleep(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
+async function requireCompatibilityBoundary(capability, reason, operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    if (error instanceof RendererCompatibilityError) throw error;
+    throw new RendererCompatibilityError(capability, reason, error);
+  }
+}
 function sameAgents(actual, expected) {
   return actual.length === expected.length && actual.every((agent, index) => agent === expected[index]);
 }
@@ -810,8 +842,7 @@ function selectRendererWebContents(contents) {
   ).toSorted(
     (left, right) => (right.runtime.elementCount ?? 0) - (left.runtime.elementCount ?? 0)
   );
-  const selected = candidates[0];
-  return selected && (selected.runtime.elementCount ?? 0) >= 50 ? selected : null;
+  return candidates.find((candidate) => (candidate.runtime.elementCount ?? 0) > 0) ?? null;
 }
 async function waitForRendererTitlePolicyReady(markReadiness, options = {}) {
   const timeoutMs = options.timeoutMs ?? 3e4;
@@ -858,17 +889,13 @@ var electronModuleExpression = `(() => {
   const { createRequire } = process.getBuiltinModule('module');
   return createRequire(process.execPath)('electron');
 })()`;
-var webContentsRuntimeExpression = `(() => ({
-  elementCount: document.querySelectorAll('*').length,
-  editorCandidates: document.querySelectorAll('textarea, [contenteditable="true"], [role="textbox"]').length,
-  sendButtonCandidates: [...document.querySelectorAll('button')].filter((button) => button.type === 'submit').length
-}))()`;
+var webContentsRuntimeExpression = "(() => ({ elementCount: document.querySelectorAll('*').length }))()";
 async function inspectElectronWebContents(inspector) {
   const value = await inspector.evaluate(`(async () => {
     const { webContents } = ${electronModuleExpression};
     const result = [];
     for (const contents of webContents.getAllWebContents()) {
-      let runtime = { available: false, elementCount: null, editorCandidates: null, sendButtonCandidates: null };
+      let runtime = { available: false, elementCount: null };
       try {
         const evaluation = contents.executeJavaScript(${JSON.stringify(webContentsRuntimeExpression)}, true);
         const timeout = new Promise((_, reject) => {
@@ -880,7 +907,6 @@ async function inspectElectronWebContents(inspector) {
         id: contents.id,
         type: contents.getType(),
         surface: contents.getURL().includes('avatar-overlay') ? 'overlay' : 'primary',
-        url: contents.getURL(),
         runtime,
       });
     }
@@ -895,12 +921,9 @@ async function inspectElectronWebContents(inspector) {
       id: item.id,
       type: item.type,
       surface: item.surface,
-      url: safeTargetUrl(item.url),
       runtime: {
         available: item.runtime.available === true,
-        elementCount: Number.isInteger(item.runtime.elementCount) ? item.runtime.elementCount : null,
-        editorCandidates: Number.isInteger(item.runtime.editorCandidates) ? item.runtime.editorCandidates : null,
-        sendButtonCandidates: Number.isInteger(item.runtime.sendButtonCandidates) ? item.runtime.sendButtonCandidates : null
+        elementCount: Number.isInteger(item.runtime.elementCount) ? item.runtime.elementCount : null
       }
     };
   });
@@ -921,6 +944,14 @@ async function activateElectronDesktop(inspector) {
   }
   return value;
 }
+async function quitElectronDesktop(inspector) {
+  const accepted = await inspector.evaluate(`(() => {
+    const { app } = ${electronModuleExpression};
+    setTimeout(() => app.quit(), 100);
+    return true;
+  })()`);
+  if (accepted !== true) throw new Error("Electron Desktop did not accept the quit request");
+}
 async function executeInWebContents(inspector, rendererWebContentsId, source) {
   return inspector.evaluate(`(async () => {
     const { webContents } = ${electronModuleExpression};
@@ -945,20 +976,20 @@ var defaultOperations = {
     rendererWebContentsId,
     "window.__codexhostRendererBindingProbeV1?.status() ?? null"
   ),
-  readTitlePolicyCounters: readMainProcessTitlePolicyCounters
+  readTitlePolicyCounters: readMainProcessTitlePolicyCounters,
+  quitDesktop: quitElectronDesktop
 };
 async function waitForRenderer(inspector, operations, timeoutMs, pollIntervalMs) {
   const deadline = Date.now() + timeoutMs;
-  let inventory = [];
+  let candidateCount = 0;
   while (Date.now() < deadline) {
-    inventory = await operations.inspect(inspector);
+    const inventory = await operations.inspect(inspector);
+    candidateCount = inventory.length;
     const renderer = selectRendererWebContents(inventory);
-    if (renderer) return { inventory, renderer };
+    if (renderer) return renderer;
     await sleep(pollIntervalMs);
   }
-  throw new Error(
-    `Inspector did not find a populated Electron Renderer (${inventory.length} seen)`
-  );
+  throw new Error(`Inspector did not find a live Electron Renderer (${candidateCount} seen)`);
 }
 async function waitForBinding(inspector, operations, rendererWebContentsId, enabledAgents, timeoutMs, pollIntervalMs) {
   const deadline = Date.now() + timeoutMs;
@@ -1007,32 +1038,45 @@ var InstalledRendererControlSession = class {
       this.timeoutMs,
       this.pollIntervalMs
     );
-    const existing = await this.operations.readBinding(this.inspector, selected.renderer.id).catch(() => null);
+    const existing = await this.operations.readBinding(this.inspector, selected.id).catch(() => null);
     if (existing !== null) {
-      const binding2 = validateBindingStatus(existing, this.enabledAgents);
-      this.#snapshot = { ...this.#snapshot, ...selected, binding: binding2 };
+      const binding2 = await requireCompatibilityBoundary(
+        "agent-routing",
+        "agent-routing-structure-unavailable",
+        () => validateBindingStatus(existing, this.enabledAgents)
+      );
+      this.#snapshot = { ...this.#snapshot, renderer: selected, binding: binding2 };
       return this.#snapshot;
     }
-    const titlePolicyReadiness = await waitForRendererTitlePolicyReady(
-      () => this.operations.markTitlePolicyReady(this.inspector),
-      { timeoutMs: this.timeoutMs, pollIntervalMs: this.pollIntervalMs }
+    const titlePolicyReadiness = await requireCompatibilityBoundary(
+      "title-isolation",
+      "title-isolation-structure-unavailable",
+      () => waitForRendererTitlePolicyReady(
+        () => this.operations.markTitlePolicyReady(this.inspector, selected.id),
+        { timeoutMs: this.timeoutMs, pollIntervalMs: this.pollIntervalMs }
+      )
     );
-    const draftPrewarmPolicy = await this.operations.installDraftPrewarmPolicy(
-      this.inspector,
-      selected.renderer.id
+    await this.operations.execute(this.inspector, selected.id, this.rendererSource);
+    const binding = await requireCompatibilityBoundary(
+      "agent-routing",
+      "agent-routing-structure-unavailable",
+      () => waitForBinding(
+        this.inspector,
+        this.operations,
+        selected.id,
+        this.enabledAgents,
+        this.timeoutMs,
+        this.pollIntervalMs
+      )
     );
-    await this.operations.execute(this.inspector, selected.renderer.id, this.rendererSource);
-    const binding = await waitForBinding(
-      this.inspector,
-      this.operations,
-      selected.renderer.id,
-      this.enabledAgents,
-      this.timeoutMs,
-      this.pollIntervalMs
+    const draftPrewarmPolicy = await requireCompatibilityBoundary(
+      "draft-routing",
+      "draft-routing-structure-unavailable",
+      () => this.operations.installDraftPrewarmPolicy(this.inspector, selected.id)
     );
     this.#snapshot = {
       ...this.#snapshot,
-      ...selected,
+      renderer: selected,
       titlePolicyReadiness,
       draftPrewarmPolicy,
       binding
@@ -1043,6 +1087,19 @@ var InstalledRendererControlSession = class {
     if (this.#closed) return Promise.reject(new Error("Renderer Control Session is closed"));
     return activateElectronDesktop(this.inspector);
   }
+  quitDesktop() {
+    if (this.#closed) return Promise.reject(new Error("Renderer Control Session is closed"));
+    return this.operations.quitDesktop(this.inspector);
+  }
+  async requestCompatibilityUpdate() {
+    const value = await this.executeRenderer(
+      "window.__codexhostRendererBindingProbeV1?.requestCompatibilityUpdate?.() ?? 'unavailable'"
+    );
+    if (value !== "update-started" && value !== "current" && value !== "unavailable") {
+      throw new Error("Renderer returned an invalid compatibility update outcome");
+    }
+    return value;
+  }
   executeRenderer(expression) {
     if (this.#closed) return Promise.reject(new Error("Renderer Control Session is closed"));
     return this.operations.execute(
@@ -1067,25 +1124,41 @@ async function createRendererControlSession(options) {
   const pollIntervalMs = options.pollIntervalMs ?? 250;
   const operations = options.operations ?? defaultOperations;
   const initial = await waitForRenderer(options.inspector, operations, timeoutMs, pollIntervalMs);
-  const titlePolicy = await operations.installTitlePolicy(options.inspector);
-  await operations.reload(options.inspector, initial.renderer.id);
+  const titlePolicy = await requireCompatibilityBoundary(
+    "title-isolation",
+    "title-isolation-structure-unavailable",
+    () => operations.installTitlePolicy(options.inspector, initial.id)
+  );
+  await operations.reload(options.inspector, initial.id);
   const selected = await waitForRenderer(options.inspector, operations, timeoutMs, pollIntervalMs);
-  const titlePolicyReadiness = await waitForRendererTitlePolicyReady(
-    () => operations.markTitlePolicyReady(options.inspector),
-    { timeoutMs, pollIntervalMs }
+  const titlePolicyReadiness = await requireCompatibilityBoundary(
+    "title-isolation",
+    "title-isolation-structure-unavailable",
+    () => waitForRendererTitlePolicyReady(
+      () => operations.markTitlePolicyReady(options.inspector, selected.id),
+      {
+        timeoutMs,
+        pollIntervalMs
+      }
+    )
   );
-  const draftPrewarmPolicy = await operations.installDraftPrewarmPolicy(
-    options.inspector,
-    selected.renderer.id
+  await operations.execute(options.inspector, selected.id, options.rendererSource);
+  const binding = await requireCompatibilityBoundary(
+    "agent-routing",
+    "agent-routing-structure-unavailable",
+    () => waitForBinding(
+      options.inspector,
+      operations,
+      selected.id,
+      enabledAgents,
+      timeoutMs,
+      pollIntervalMs
+    )
   );
-  await operations.execute(options.inspector, selected.renderer.id, options.rendererSource);
-  const binding = await waitForBinding(
-    options.inspector,
-    operations,
-    selected.renderer.id,
-    enabledAgents,
-    timeoutMs,
-    pollIntervalMs
+  const draftPrewarmPolicy = await requireCompatibilityBoundary(
+    "draft-routing",
+    "draft-routing-structure-unavailable",
+    () => operations.installDraftPrewarmPolicy(options.inspector, selected.id)
   );
   return new InstalledRendererControlSession(
     options.inspector,
@@ -1095,7 +1168,7 @@ async function createRendererControlSession(options) {
     pollIntervalMs,
     operations,
     {
-      ...selected,
+      renderer: selected,
       titlePolicy,
       titlePolicyReadiness,
       draftPrewarmPolicy,
@@ -1127,14 +1200,56 @@ async function installRendererControlSession(options) {
 
 // packages/desktop-control/src/production-controller.ts
 var PRODUCTION_INSTALL_TIMEOUT_MS = 9e4;
+var DESKTOP_CONTROLLER_READINESS_MAX_BYTES = 512;
 var TRANSIENT_INSTALL_ATTEMPTS = 3;
 var TRANSIENT_INSTALL_RETRY_MS = 250;
+function validCompatibilityIssue(state, issue) {
+  const keys = Object.keys(issue);
+  if (state === "compatible-with-warning") {
+    return issue.capability === "title-isolation" && issue.reason === "unreviewed-title-service-identity" && typeof issue.observedIdentity === "string" && /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/.test(issue.observedIdentity) && keys.length === 3;
+  }
+  if (state === "degraded") {
+    return [
+      "permission-control",
+      "sidebar-decoration",
+      "fork-control",
+      "usage-surface",
+      "settings-surface"
+    ].includes(issue.capability) && issue.reason === "capability-unavailable" && issue.observedIdentity === void 0 && keys.length === 2;
+  }
+  if (state === "incompatible") {
+    const pair = `${issue.capability}:${issue.reason}`;
+    return [
+      "title-isolation:title-isolation-structure-unavailable",
+      "draft-routing:draft-routing-structure-unavailable",
+      "agent-routing:agent-routing-structure-unavailable"
+    ].includes(pair) && issue.observedIdentity === void 0 && keys.length === 2;
+  }
+  return state === "detection-failed" && issue.capability === "compatibility-detection" && issue.reason === "inspection-failed" && issue.observedIdentity === void 0 && keys.length === 2;
+}
+function serializeDesktopControllerReadiness(readiness) {
+  if (readiness.schemaVersion !== 2 || ![
+    "compatible",
+    "compatible-with-warning",
+    "degraded",
+    "incompatible",
+    "detection-failed"
+  ].includes(readiness.state) || !Array.isArray(readiness.issues) || readiness.issues.length > 1 || readiness.state === "compatible" && readiness.issues.length !== 0 || readiness.state !== "compatible" && (readiness.issues.length !== 1 || !readiness.issues[0] || !validCompatibilityIssue(readiness.state, readiness.issues[0])) || Object.keys(readiness).length !== 3) {
+    throw new Error("Desktop Controller readiness is invalid");
+  }
+  const line = JSON.stringify(readiness);
+  if (Buffer.byteLength(line, "utf8") > DESKTOP_CONTROLLER_READINESS_MAX_BYTES) {
+    throw new Error("Desktop Controller readiness exceeds its size limit");
+  }
+  return line;
+}
 var defaultDependencies = {
   readRenderer: (filePath) => readFile(filePath, "utf8"),
   install: installRendererControlSession,
   startAttachmentServer: startControllerAttachmentServer,
-  ready: () => {
-    process.stdout.write("ready\n");
+  ready: (readiness) => {
+    process.stdout.write(`${serializeDesktopControllerReadiness(readiness)}
+`);
   },
   sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
   monitorIntervalMs: 500
@@ -1218,8 +1333,16 @@ function parseDesktopControllerArguments(arguments_) {
   };
 }
 function isTransientElectronInstallError(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  return message.includes("Uncaught (in promise)") || message.includes("Execution context was destroyed") || message.includes("Promise was collected");
+  let current = error;
+  for (let depth = 0; depth < 4; depth += 1) {
+    const message = current instanceof Error ? current.message : String(current);
+    if (message.includes("Execution context was destroyed") || message.includes("Promise was collected")) {
+      return true;
+    }
+    current = current instanceof Error ? current.cause : void 0;
+    if (current === void 0) break;
+  }
+  return false;
 }
 async function installProductionSession(options, dependencies) {
   for (let attempt = 1; attempt <= TRANSIENT_INSTALL_ATTEMPTS; attempt += 1) {
@@ -1235,19 +1358,35 @@ async function installProductionSession(options, dependencies) {
   throw new Error("Desktop Controller exhausted Renderer installation attempts");
 }
 async function runDesktopController(options, signal, dependencies = defaultDependencies) {
-  const rendererSource = await dependencies.readRenderer(options.rendererPath);
-  if (rendererSource.trim().length === 0) throw new Error("production Renderer Bundle is empty");
-  const configuration = `Object.defineProperty(window, "__codexhostProductionConfigV1", { configurable: true, value: { defaultAgent: ${JSON.stringify(options.defaultAgent)} } });`;
-  const session = await installProductionSession(
-    {
-      inspectorEndpoint: options.inspectorEndpoint,
-      rendererSource: `${configuration}
+  let session;
+  try {
+    const rendererSource = await dependencies.readRenderer(options.rendererPath);
+    if (rendererSource.trim().length === 0) throw new Error("production Renderer Bundle is empty");
+    const configuration = `Object.defineProperty(window, "__codexhostProductionConfigV1", { configurable: true, value: { defaultAgent: ${JSON.stringify(options.defaultAgent)} } });`;
+    session = await installProductionSession(
+      {
+        inspectorEndpoint: options.inspectorEndpoint,
+        rendererSource: `${configuration}
 ${rendererSource}`,
-      enabledAgents: ["codex", "pi", "claude-code"],
-      timeoutMs: PRODUCTION_INSTALL_TIMEOUT_MS
-    },
-    dependencies
-  );
+        enabledAgents: ["codex", "pi", "claude-code"],
+        timeoutMs: PRODUCTION_INSTALL_TIMEOUT_MS
+      },
+      dependencies
+    );
+  } catch (error) {
+    dependencies.ready(
+      error instanceof RendererCompatibilityError && !isTransientElectronInstallError(error) ? {
+        schemaVersion: 2,
+        state: "incompatible",
+        issues: [{ capability: error.capability, reason: error.reason }]
+      } : {
+        schemaVersion: 2,
+        state: "detection-failed",
+        issues: [{ capability: "compatibility-detection", reason: "inspection-failed" }]
+      }
+    );
+    return;
+  }
   let operation = Promise.resolve(void 0);
   const useSession = (callback) => {
     const next = operation.then(callback, callback);
@@ -1265,9 +1404,19 @@ ${rendererSource}`,
       attach: () => useSession(async () => {
         await session.ensureInstalled();
         await session.activateDesktop();
-      })
+      }),
+      compatibilityUpdate: () => useSession(async () => {
+        await session.ensureInstalled();
+        return session.requestCompatibilityUpdate();
+      }),
+      shutdown: () => useSession(() => session.quitDesktop())
+    });
+    const issues = session.snapshot.titlePolicy.warnings;
+    dependencies.ready({
+      schemaVersion: 2,
+      state: issues.length === 0 ? "compatible" : "compatible-with-warning",
+      issues
     });
-    dependencies.ready();
     while (!signal.aborted) {
       await dependencies.sleep(dependencies.monitorIntervalMs);
       if (!signal.aborted) await useSession(() => session.ensureInstalled());