@commonlyai/cli 0.1.166 → 0.1.169

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.166",
+  "version": "0.1.169",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -1,3 +1,6 @@
+import { createOwnKeyResolver, createMachineReportClient } from '../lib/own-key-launch.js';
+import { WALKED_HARNESSES } from '../lib/runtime-inventory.js';
+import { createRuntimeReporter } from '../lib/runtime-observation.js';
 /**
  * commonly agent <subcommand>
  *
@@ -1262,8 +1265,12 @@ export const performRun = ({
   sleepImpl = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); }),
   // The agent to @mention when the model provider refuses a request's content
   // (lib/content-refusal.js). Null: the refusal notice names no one.
+  reportRuntime = false,
+  resolveOwnProviderKey = null,
+  runtimeReportClient = null,
   refusalHandoff = null,
 }) => {
+  reportRuntime = reportRuntime && WALKED_HARNESSES.includes(adapter?.name);
   if (environment?.provider !== undefined && !adapter?.supportsProvider) {
     throw new Error('environment.provider requires a provider-capable adapter');
   }
@@ -1271,6 +1278,11 @@ export const performRun = ({
   const effectiveTurnTimeoutMs = Number.isFinite(requestedTurnTimeout) && requestedTurnTimeout > 0
     ? Math.min(requestedTurnTimeout, 2_147_483_647) : 15 * 60 * 1000;
   const client = createClient({ instance: instanceUrl, token });
+  const runtimeReporter = createRuntimeReporter({
+    client: runtimeReportClient || { post: async () => {} },
+    harness: adapter.name, detect: () => adapter.detect(),
+  });
+  const runtimeConnected = reportRuntime ? runtimeReporter.connect() : Promise.resolve();
   const missingModelNotices = new Set();
   const handoffAgent = sanitizeHandoffAgent(refusalHandoff);
   if (refusalHandoff && !handoffAgent) {
@@ -1321,12 +1333,18 @@ export const performRun = ({
   // the adapter spawns with, and the stored record keeps its broker, so the
   // daemon stays the layer that judges a host it knows. Applied once for the
   // run rather than per turn: `agent run` reads its record once at boot.
-  const seatEnvironment = withholdGrantBroker(environment, adapter?.name, {
+  const requestedSeatEnvironment = withholdGrantBroker(environment, adapter?.name, {
     instanceUrl,
     onRefuse: (refusal, names) => log(
       `${refusal.code} (${refusal.reason}) — withholding ${names.join(', ')}: ${refusal.detail}`,
     ),
   });
+  // Without native effort inventory a machine runner cannot promise that a
+  // stored effort is supported. Preserve the record and use harness default.
+  // Standalone CLI behavior remains under the operator's control.
+  const runtimeInventoryPromise = reportRuntime ? Promise.resolve(adapter.inventory?.()).then((value) => value || { models: null, efforts: [] })
+    .catch(() => ({ models: null, efforts: [] })) : Promise.resolve(null);
+  let seatEnvironment = requestedSeatEnvironment;
   // OpenCode retains tool-call IDs in its resumed history. A Gemini proxy
   // marks those IDs with signature references, so changing providers must
   // start a fresh session before another upstream can receive them.
@@ -1384,6 +1402,10 @@ export const performRun = ({
   const batchLimit = Math.min(50, Math.max(1, Number(inboxBatchLimit) || 10));
 
   const processEvent = async (event) => {
+    const inventory = await runtimeInventoryPromise;
+    if (reportRuntime && requestedSeatEnvironment && !inventory?.efforts.includes(requestedSeatEnvironment.effort)) {
+      seatEnvironment = { ...requestedSeatEnvironment, effort: undefined };
+    }
     const eventPodId = event.podId || podId;
     const prompt = extractPrompt(event);
     if (!prompt || !eventPodId) {
@@ -1785,6 +1807,7 @@ export const performRun = ({
       ? { mounted: serverSkills.mounted, conflicted: serverSkills.conflicted, ...(skillReadUnavailable ? { status: 'unavailable' } : {}) }
       : null;
     let spawnCompleted = false;
+    let observedSpawn = false;
     let commitAttribution = null;
     try {
       // The local CLI is a wrapper for a Commonly seat, so its Git commits
@@ -1802,7 +1825,24 @@ export const performRun = ({
           effort: seatEnvironment?.effort,
         });
       }
+      await runtimeConnected;
+      let providerKey;
+      if (reportRuntime && resolveOwnProviderKey) {
+        try {
+          providerKey = await resolveOwnProviderKey({ opened, harness: adapter.name,
+            provider: seatEnvironment?.provider });
+        } catch (error) {
+          if (!error.ownKeySpawnRefused) throw error;
+          return { outcome: 'no_action', refused: { reason: 'delivery-refused' },
+            reason: 'own-key-requires-scoped-spawn' };
+        }
+      }
       result = await adapter.spawn(frameDecisionForkRule(promptForSpawn), {
+        onSpawn: reportRuntime ? (controls) => {
+          observedSpawn = true;
+          return runtimeReporter.spawn(controls);
+        } : undefined,
+        providerKey,
         timeoutMs: effectiveTurnTimeoutMs,
         sessionId,
         cwd: agentCwd,
@@ -1831,6 +1871,7 @@ export const performRun = ({
       spawnCompleted = true;
     } finally {
       try {
+        if (reportRuntime) await runtimeReporter.settled(observedSpawn ? spawnCompleted ? 'completed' : 'failed' : null);
         commitAttribution?.cleanup();
       } finally {
         if (spawnCompleted && skillMount) {
@@ -1994,15 +2035,32 @@ export const performRun = ({
     } else {
       // ADR-018 length gate: the tone contract is enforced here, where the
       // wrapper is the one posting. Split, attach — never truncate.
-      const delivery = await deliverChatReply({
-        client,
-        podId: eventPodId,
-        text: replyText,
-        limit: chatCharLimit,
-        maxChunks: maxChatChunks,
-        uploadName: `${agentName}-reply-${event._id}.md`,
-        log: (line) => log(`[${event.type}] ${line}`),
-      });
+      let delivery;
+      try {
+        delivery = await deliverChatReply({
+          client,
+          podId: eventPodId,
+          text: replyText,
+          limit: chatCharLimit,
+          maxChunks: maxChatChunks,
+          uploadName: `${agentName}-reply-${event._id}.md`,
+          log: (line) => log(`[${event.type}] ${line}`),
+        });
+      } catch (deliveryError) {
+        // TASK-535: every rung threw, so the reply reached nobody. The throw
+        // still leaves the events unacked for redelivery (unchanged), but the
+        // retry report is about the BATCH; this line is about the reply, and
+        // it names where it was going so a lost summary is never silent.
+        const eventCount = Array.isArray(event.payload?.batchEventIds)
+          ? event.payload.batchEventIds.length
+          : 1;
+        log(
+          `[${event.type}] ERROR reply NOT delivered to pod ${eventPodId} — `
+          + `${Buffer.byteLength(replyText)} bytes lost, ${eventCount} event${eventCount === 1 ? '' : 's'} `
+          + `left unacked for retry: ${deliveryError.message}`,
+        );
+        throw deliveryError;
+      }
       if (delivery.skipped) {
         // The server answered 200 and created nothing: a duplicate inside its
         // dedupe window, a silent body, a heartbeat it keeps. Nothing reached
@@ -3537,6 +3595,11 @@ Docs:
         // TASK-102 part B: the operator's TTL ask, if any. Unset means the
         // server's published default, which is the only lifetime we can justify
         // without an operator saying otherwise.
+        runtimeReportClient: createMachineReportClient({ instanceUrl: record.instanceUrl,
+          machineId: record.machineId, agentName: record.agentName, instanceId: record.instanceId }),
+        resolveOwnProviderKey: createOwnKeyResolver({ instanceUrl: record.instanceUrl,
+          machineId: record.machineId, agentName: record.agentName, instanceId: record.instanceId }),
+        reportRuntime: Boolean(record.machineId || process.env.COMMONLY_MANAGED_RUNNER === '1'),
         spawnCredentialTtlSeconds: resolveSpawnTtlSeconds(process.env),
         refusalHandoff: opts.refusalHandoff || null,
         log: (line) => console.log(`${stamp()} [${name}] ${line}`),

package/src/commands/daemon.js

@@ -1,3 +1,4 @@
+import { collectRuntimeInventory } from '../lib/runtime-inventory.js';
 /**
  * commonly daemon <subcommand>
  *
@@ -474,6 +475,8 @@ Examples:
           // exit parks it on macOS; systemd honors 77 directly.
           process.exitCode = saved || process.platform !== 'darwin' ? 77 : 0;
         };
+        let cachedInventory;
+        let inventoryCheckedAt = 0;
         supervisor = createDaemonSupervisor({
           record,
           client,
@@ -488,10 +491,18 @@ Examples:
             chmodSync(seatLog, 0o600);
             return spawn(process.execPath, [process.argv[1], 'agent', 'run', agentName], {
               stdio: ['ignore', out, out],
+              env: { ...process.env, COMMONLY_MANAGED_RUNNER: '1' },
             });
           },
           loadToken: loadAgentToken,
           saveToken: saveAgentToken,
+          runtimeInventory: async () => {
+            if (!cachedInventory || Date.now() - inventoryCheckedAt > 300_000) {
+              cachedInventory = await collectRuntimeInventory(getAdapter);
+              inventoryCheckedAt = Date.now();
+            }
+            return cachedInventory;
+          },
           resolveAdapter: (runtime) => resolveAdapterForRuntime(runtime),
           log: stampLog,
           persistState: (seats) => saveDaemonState({

package/src/lib/adapters/claude.js

@@ -1,3 +1,5 @@
+import { claudeRuntimeInventory } from '../native-runtime-inventory.js';
+import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
 /**
  * claude adapter — wraps the local `claude` CLI as a Commonly agent.
  *
@@ -289,12 +291,13 @@ const publicSkillPromptArgs = async (skillSources) => {
   return { args: text ? ['--append-system-prompt', text] : [], included };
 };
 
-const runClaude = ({ cmd, args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn }) => new Promise((resolve, reject) => {
+const runClaude = ({ cmd, args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn, onSpawn, controls = {} }) => new Promise((resolve, reject) => {
   const proc = spawnImpl(cmd, args, {
     cwd,
     env,
     stdio: ['ignore', 'pipe', 'pipe'],
   });
+  observeSpawn(proc, onSpawn, controls);
   let stdout = '';
   let stderr = '';
   let timedOut = false;
@@ -736,11 +739,13 @@ export default {
   // hosted variant.
   runtimeType: 'claude-code',
 
+  inventory: () => claudeRuntimeInventory({ env: withClaudePath(process.env) }),
+
   async detect() {
     try {
       const claudeEnv = withClaudePath(process.env);
       const res = spawnSync('claude', ['--version'], {
-        encoding: 'utf8',
+        encoding: 'utf8', timeout: 5000,
         env: claudeEnv,
       });
       if (res.error || res.status !== 0) return null;
@@ -900,7 +905,7 @@ export default {
         // and its provider key is not an env var here, so the seat credential is
         // the value a tail can echo back.
         credentials: spawnCredentials(spawnCtx),
-        spawnImpl: ctx._spawnImpl, // test seam only — do not use in production
+        spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(modelArgs, { modelFlag: '--model', effortFlag: '--effort' }), // test seam only — do not use in production
       });
       // TASK-440: the context this turn left, read from the transcript the
       // child wrote under its own env (an isolated HOME for public seats).
@@ -951,7 +956,7 @@ export default {
           env: retry.env,
           timeoutMs: ctx.timeoutMs || DEFAULT_TIMEOUT_MS,
           credentials: spawnCredentials(retryCtx),
-          spawnImpl: ctx._spawnImpl,
+          spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(modelArgs, { modelFlag: '--model', effortFlag: '--effort' }),
         });
         const contextTokens = claudeContextTokens({
           cwd: ctx.cwd, sessionId: freshId,

package/src/lib/adapters/codex.js

@@ -1,3 +1,5 @@
+import { codexRuntimeInventory } from '../native-runtime-inventory.js';
+import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
 /**
  * codex adapter — wraps the local `codex` CLI as a Commonly agent.
  *
@@ -570,7 +572,7 @@ const CODEX_PROVIDER_KEY_ENVS = [
   'CODEX_API_KEY',
 ];
 
-const runCodex = ({ args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn }) => new Promise((resolve, reject) => {  // stdio: ['ignore', 'pipe', 'pipe'] — without this, child_process.spawn
+const runCodex = ({ args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn, onSpawn, controls = {} }) => new Promise((resolve, reject) => {  // stdio: ['ignore', 'pipe', 'pipe'] — without this, child_process.spawn
   // defaults stdin to a fresh pipe. Codex 0.125.0's `exec` then blocks on
   // `Reading additional input from stdin...` because it sees an open pipe
   // and waits for input that never arrives. Interactive runs are fine because
@@ -578,6 +580,7 @@ const runCodex = ({ args, cwd, env, timeoutMs, credentials = [], spawnImpl = chi
   // `'ignore'` gives codex /dev/null → immediate EOF → it falls back to the
   // argv prompt as intended. Surfaced live during ADR-005 Phase 2 smoke.
   const proc = spawnImpl('codex', args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+  observeSpawn(proc, onSpawn, controls);
   let stderr = '';
   let timedOut = false;
   const events = makeEventParser();
@@ -625,9 +628,11 @@ export default {
   // `runtimeType` and differ only on `host`.
   runtimeType: 'codex',
 
+  inventory: codexRuntimeInventory,
+
   async detect() {
     try {
-      const res = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+      const res = spawnSync('codex', ['--version'], { encoding: 'utf8', timeout: 5000 });
       if (res.error || res.status !== 0) return null;
       // `codex --version` prints e.g. "codex-cli 0.125.0" — last token is
       // the version. Defensive against future format tweaks: if no
@@ -734,7 +739,7 @@ export default {
         // already removed the token from the child copy, and after that there is
         // nothing left to compare a tail against.
         credentials: spawnCredentials(ctx, CODEX_PROVIDER_KEY_ENVS),
-        spawnImpl: ctx._spawnImpl, // test seam only — do not use in production
+        spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(args.slice(args.indexOf('exec') + (args[args.indexOf('exec') + 1] === 'resume' ? 3 : 1), -1), { modelFlag: '--model', valueFlags: ['-c', '-o', '--permission-profile'], codex: true }), // test seam only — do not use in production
       });
 
       let text = '';

package/src/lib/adapters/dsh.js

@@ -1,3 +1,4 @@
+import { observeSpawn } from '../runtime-observation.js';
 /** DeepSeek Harness 0.2.1-rc.2, private seats only. Configuration is per spawn. */
 import { requireSeatModel } from './seat-model.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
@@ -167,8 +168,9 @@ const parseEvent = (line, state) => {
   }
 };
 
-export const runDsh = ({ binary, args, cwd, env, timeoutMs, credentials, spawnImpl = childSpawn }) => new Promise((resolve, reject) => {
+export const runDsh = ({ binary, args, cwd, env, timeoutMs, credentials, spawnImpl = childSpawn, onSpawn, controls = {} }) => new Promise((resolve, reject) => {
   const proc = spawnImpl(binary, args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+  observeSpawn(proc, onSpawn, controls);
   const state = { sessionId: null, final: null, error: null, buffer: '' };
   let stderr = '';
   let timedOut = false;
@@ -277,11 +279,14 @@ export default {
       const mcp = resolveCommonlyMcp(ctx.environment?.mcp, {
         credentialFile: credential.path, instanceUrl: ctx.instanceUrl,
       });
-      const patch = JSON.stringify(buildPatch({
+      const patchData = buildPatch({
         proxyBaseURL: proxy.baseURL, model: seatModel,
         cwd: ctx.cwd, mcp, effort: ctx.environment.effort,
         deepseekOfficial: new URL(ctx.environment.provider.baseURL).hostname === 'api.deepseek.com',
-      }), null, 2);
+      });
+      const patch = JSON.stringify(patchData, null, 2);
+      const passedProvider = patchData.find((entry) => entry.id === 'llm-pi-ai').config.providers.commonly;
+      const passedModel = patchData.find((entry) => entry.id === 'agent-default-model').config.model;
       assertPatchHasNoCredentials(patch, [ctx.runtimeToken, bearer]);
       const patchPath = join(tempDir, 'seat.patch.yml');
       await writeFile(patchPath, `${patch}\n`, { mode: 0o600 });
@@ -296,7 +301,7 @@ export default {
         ? Math.min(requested, MAX_TIMEOUT_MS) : MAX_TIMEOUT_MS;
       return await runDsh({
         binary, args, cwd: ctx.cwd, env, timeoutMs,
-        credentials: [...spawnCredentials(ctx, []), bearer], spawnImpl: ctx._spawnImpl,
+        credentials: [...spawnCredentials(ctx, []), bearer], spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: { model: passedModel || null, effort: passedProvider.reasoning || null },
       });
     } finally {
       try { await proxy?.close(); } catch { /* best effort */ }

package/src/lib/adapters/hermes.js

@@ -1,3 +1,4 @@
+import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
 /** Hermes 0.22.2 local CLI wrapper. Hermes owns provider I/O; this file only spawns it. */
 import { requireSeatModel, seatModelRequired } from './seat-model.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
@@ -49,10 +50,11 @@ export const readHermesJsonl = (line, state) => {
   }
 };
 
-const runHermes = ({ args, prompt, cwd, env, timeoutMs, spawnImpl, credentials }) => new Promise((resolve, reject) => {
+const runHermes = ({ args, prompt, cwd, env, timeoutMs, spawnImpl, credentials, onSpawn, controls = {} }) => new Promise((resolve, reject) => {
   const child = (spawnImpl || childSpawn)('hermes', args, {
     cwd, env, stdio: ['pipe', 'pipe', 'pipe'],
   });
+  observeSpawn(child, onSpawn, controls);
   const state = { started: false, result: null };
   const decoder = new StringDecoder('utf8');
   let buffer = '';
@@ -190,7 +192,7 @@ export default {
       ? Math.min(requestedTimeout, DEFAULT_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
     return runHermes({
       args, prompt: fullPrompt, cwd: ctx.cwd, env, timeoutMs,
-      spawnImpl: ctx._spawnImpl,
+      spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(args, { modelFlag: '--model', valueFlags: ['--query-file', '--format', '--provider', '--source', '--resume'] }),
       credentials: spawnCredentials(ctx, ['OPENROUTER_API_KEY']),
     });
   },

package/src/lib/adapters/opencode.js

@@ -1,3 +1,4 @@
+import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
 /**
  * OpenCode adapter — wraps `opencode run --format json` as a Commonly seat.
  *
@@ -393,7 +394,7 @@ const publicToolFailedError = ({ tool, error }) => {
   return failure;
 };
 
-const runOpenCode = ({ cmd, args, cwd, env, timeoutMs, credentials, spawnImpl = childSpawn }) => new Promise((resolve, reject) => {
+const runOpenCode = ({ cmd, args, cwd, env, timeoutMs, credentials, spawnImpl = childSpawn, onSpawn, controls = {} }) => new Promise((resolve, reject) => {
   let proc;
   try {
     proc = spawnImpl(cmd, args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
@@ -401,6 +402,7 @@ const runOpenCode = ({ cmd, args, cwd, env, timeoutMs, credentials, spawnImpl =
     reject(err);
     return;
   }
+  observeSpawn(proc, onSpawn, controls);
   let stderr = '';
   let timedOut = false;
   let killTimer = null;
@@ -634,7 +636,7 @@ export default {
 
   async detect() {
     try {
-      const res = spawnSync('opencode', ['--version'], { encoding: 'utf8' });
+      const res = spawnSync('opencode', ['--version'], { encoding: 'utf8', timeout: VERSION_CHECK_TIMEOUT_MS });
       if (res.error || res.status !== 0) return null;
       const stdout = (res.stdout || '').trim();
       const version = parseOpenCodeVersion(stdout) || stdout || 'unknown';
@@ -666,7 +668,10 @@ export default {
     if (isPublic && !provider) {
       throw new Error('public OpenCode seats require environment.provider; the implicit public tier and operator auth.json are unsupported for public trust');
     }
-    const providerKeyFile = await validateProviderEnvironment(ctx.environment, ctx.cwd);
+    if (ctx.providerKey && (!isPublic || !['workspace', 'read-only', 'bwrap'].includes(sandboxMode))) {
+      throw new Error('Own provider keys require a confined OpenCode runtime');
+    }
+    const providerKeyFile = ctx.providerKey ? null : await validateProviderEnvironment(ctx.environment, ctx.cwd);
 
     const sourceEnv = ctx.env || process.env;
     const childSourceEnv = Object.fromEntries(Object.entries(sourceEnv)
@@ -739,7 +744,7 @@ export default {
         // the bearer only prevents unrelated local processes from using it.
         providerProxy = await startProviderProxy({
           provider,
-          keyFile: providerKeyFile,
+          keyFile: providerKeyFile, keyMaterial: ctx.providerKey,
           tokenFile: join(tempDir, 'provider-proxy-token'),
           ...(sandboxMode === 'bwrap' ? {
             socketPath: join(tempDir, 'provider-proxy.sock'),
@@ -868,7 +873,7 @@ export default {
         });
         [cmd, ...spawnArgs] = wrapped;
       }
-      const credentials = spawnCredentials(ctx, sourceAuthEnvNames(sourceEnv));
+      const credentials = [...spawnCredentials(ctx, sourceAuthEnvNames(sourceEnv)), ctx.providerKey].filter(Boolean);
       const result = await runOpenCode({
         cmd,
         args: spawnArgs,
@@ -876,7 +881,7 @@ export default {
         env: childEnv,
         timeoutMs: ctx.timeoutMs || DEFAULT_TIMEOUT_MS,
         credentials,
-        spawnImpl: ctx._spawnImpl,
+        spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(args.slice(0, -1), { modelFlag: '-m', effortFlag: '--variant', valueFlags: ['-s', '--dir', '--title', '--format'] }),
       });
       if (isPublic) {
         const failure = publicToolFailure(result.toolErrors, ctx.environment?.mcp);

package/src/lib/daemon-supervisor.js

@@ -64,6 +64,7 @@ export const createDaemonSupervisor = ({
   spawnChild, // (agentName) => child emitting 'exit'; must expose .kill()
   loadToken, // (agentName) => token record | null
   saveToken, // (agentName, record) => void
+  runtimeInventory = async () => undefined,
   resolveAdapter, // async (runtime) => adapter name for THIS machine
   persistState = () => {}, // (agentStates) => void; must not persist secrets
   log = () => {},
@@ -343,6 +344,7 @@ export const createDaemonSupervisor = ({
         const workspacePath = workspacePathFor(nextEnvironment);
         const nextRecord = {
           ...existing,
+          machineId: record.machineId,
           ...(adapterChanged ? { adapter: nextAdapter } : {}),
           environment: nextEnvironment,
           ...(workspacePath ? { workspacePath } : {}),
@@ -445,6 +447,7 @@ export const createDaemonSupervisor = ({
       instanceId: row.instanceId,
       runtimeToken: minted.token,
       instanceUrl: record.instanceUrl,
+      machineId: record.machineId,
       podId: row.podIds?.[0] || null,
       adapter,
       ...(recordEnvironment ? { environment: recordEnvironment } : {}),
@@ -552,7 +555,7 @@ export const createDaemonSupervisor = ({
   const heartbeat = async () => {
     if (stopped || now() < reconnectAfter) return;
     try {
-      await client.post(`/api/machines/${record.machineDbId}/heartbeat`, { agents: agentStates() });
+      await client.post(`/api/machines/${record.machineDbId}/heartbeat`, { agents: agentStates(), runtimeInventory: await runtimeInventory() });
       connectionRestored();
     } catch (error) {
       connectionFailure(error, 'heartbeat failed');

package/src/lib/enforcement.js

@@ -18,6 +18,8 @@
  * stands the agent down, and both are logged with the reason.
  */
 
+import { isUnseenMessagesHold } from './pod-catch-up.js';
+
 // Event types whose payload.messageId identifies a claimable trigger message.
 // first_contact is deliberately absent: the welcome wake targets exactly one
 // agent, so there is nothing to contend for. Heartbeats have no message at
@@ -673,7 +675,49 @@ export const deliverChatReply = async ({
   // request, but no message was created. Keep that distinction at the client
   // boundary so every delivery mode shares it rather than treating a resolved
   // promise as proof of a post.
-  const postMessage = (body) => client.post(messagesPath, body);
+  //
+  // TASK-535 — the send-time freshness hold. The backend answers 409
+  // `unseen_messages` when other members posted after this seat's last
+  // recorded tail read. A turn that ran ~43 minutes (rhea, 2026-10-25 10:01Z)
+  // hit it on the thread headline, the attach card and the split fallback in
+  // turn, so the reply was lost and its 10 events re-ran. A retry without an
+  // override cannot succeed — every rung posts to the same guarded route.
+  //
+  // CTO ruling: on the FIRST hold of a delivery, re-read the pod tail once,
+  // then post with `continueAnyway: true`, and keep the override for every
+  // later post in THIS delivery (remaining chunks, later rungs). The re-read
+  // is GET /messages at the route's 50-row cap with no `before`/`threadRootId`
+  // — the read that records a seen cursor (AgentSendFreshness.recordRead). It
+  // advances the cursor only when the page holds EVERY message since the last
+  // recorded read. The wrapper's own post-turn snapshot is that same read at
+  // limit 10, which is why a 12-message gap stayed unseen. So a re-read alone
+  // passes a normal post only while the gap is ≤ 50 and nothing lands between
+  // read and post; the override is what delivers, and the read records what
+  // the wrapper saw, exactly as its snapshots already do. One re-read and one
+  // override per delivery; a post that still fails throws to the next rung as
+  // before. Nothing here loops.
+  let freshnessOverride = false;
+  const postMessage = async (body) => {
+    if (freshnessOverride) return client.post(messagesPath, { ...body, continueAnyway: true });
+    try {
+      return await client.post(messagesPath, body);
+    } catch (error) {
+      if (!isUnseenMessagesHold(error)) throw error;
+      freshnessOverride = true;
+      const unseen = error.body?.unseenCount;
+      log(
+        `reply held: ${Number.isFinite(unseen) ? unseen : 'some'} unseen message(s) in pod ${podId} `
+        + 'arrived during the turn — re-reading the pod once, then posting with continueAnyway (TASK-535)',
+      );
+      try {
+        await client.get(messagesPath, { limit: 50 });
+      } catch (readError) {
+        // The re-read is bookkeeping, not permission: the override delivers.
+        log(`pod re-read before the continueAnyway post failed (${readError.message}) — posting anyway`);
+      }
+      return client.post(messagesPath, { ...body, continueAnyway: true });
+    }
+  };
   const refused = (response, messages, attemptedMessages) => ({
     mode: 'refused',
     messages,

package/src/lib/native-runtime-inventory.js

@@ -0,0 +1,33 @@
+import { spawnSync } from 'node:child_process';
+import { readFile, stat } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+export const claudeEffortsFromHelp = (help) => {
+  const section = String(help).match(/--effort\s+<[^>]+>([\s\S]*?)(?=\n\s+--|$)/)?.[1];
+  const declared = section?.match(/\((low(?:\s*,\s*(?:medium|high|xhigh|max))*)\)/)?.[1];
+  return declared ? declared.split(',').map((level) => level.trim()) : [];
+};
+export const codexModelsFromCache = (cache) => {
+  const models = Array.isArray(cache?.models) ? cache.models.filter((row) => typeof row.slug === 'string'
+    && row.slug.length > 0 && row.slug.length <= 256 && row.visibility !== 'hidden') : [];
+  const levels = models.map((row) => (Array.isArray(row.supported_reasoning_levels)
+    ? row.supported_reasoning_levels.flatMap((level) => typeof level.effort === 'string' ? [level.effort] : []) : []));
+  return { models: models.length ? models.map((row) => row.slug) : null,
+    // Only levels supported by every advertised model are offered globally.
+    efforts: levels.length ? levels[0].filter((level) => levels.every((list) => list.includes(level))) : [] };
+};
+export const claudeRuntimeInventory = async ({ spawnSyncImpl = spawnSync, env = process.env } = {}) => {
+  const result = spawnSyncImpl('claude', ['--help'], {
+    encoding: 'utf8', timeout: 5000, maxBuffer: 128 * 1024, cwd: tmpdir(), env,
+  });
+  return { models: null, efforts: result.status === 0 ? claudeEffortsFromHelp(result.stdout) : [] };
+};
+export const codexRuntimeInventory = async ({ readFileImpl = readFile, statImpl = stat, env = process.env } = {}) => {
+  // Native cache only: no command that could execute workspace extensions.
+  const path = join(env.CODEX_HOME || join(homedir(), '.codex'), 'models_cache.json');
+  try {
+    if ((await statImpl(path)).size > 2 * 1024 * 1024) return { models: null, efforts: [] };
+    return codexModelsFromCache(JSON.parse(await readFileImpl(path, 'utf8')));
+  } catch { return { models: null, efforts: [] }; }
+};

package/src/lib/own-key-launch.js

@@ -0,0 +1,42 @@
+import { loadDaemonRecord } from './daemon-store.js';
+import { createClient } from './api.js';
+
+// The daemon bearer stays in this parent closure. Seat tokens can be inherited
+// by model children during mint fallback, so they never authorize key reads.
+export const createOwnKeyResolver = ({ instanceUrl, machineId, agentName, instanceId = 'default',
+  loadRecord = loadDaemonRecord, clientFactory = createClient }) => async ({ opened, harness, provider }) => {
+  if (harness !== 'opencode' || !provider) return undefined;
+  const record = loadRecord();
+  if (!record || (machineId && record.machineId !== machineId)
+    || new URL(record.instanceUrl).href !== new URL(instanceUrl).href) {
+    throw new Error('Own provider key requires this machine’s registered daemon');
+  }
+  let launch;
+  try {
+    launch = await clientFactory({ instance: instanceUrl, token: record.daemonToken })
+      .post('/api/agents/runtime/provider-key/launch', { agentName, instanceId, harness,
+        providerId: provider.id, baseURL: provider.baseURL, metadataOnly: opened?.source !== 'spawn' });
+  } catch (error) {
+    if ([404, 405].includes(error.status)) return undefined;
+    throw new Error('Own provider key could not be resolved; retry after checking Settings');
+  }
+  if (!launch?.set) return undefined;
+  if (opened?.source !== 'spawn') {
+    const error = new Error('Own provider key requires a scoped spawn credential; turn was not started');
+    error.ownKeySpawnRefused = true;
+    throw error;
+  }
+  return launch.key;
+};
+
+// Parent-only receipt client. Failure to load machine authority disables
+// diagnostics; it must never fall back to a seat bearer.
+export const createMachineReportClient = ({ instanceUrl, machineId, agentName, instanceId = 'default' }) => {
+  try {
+    const record = loadDaemonRecord();
+    if (!record || (machineId && machineId !== record.machineId)
+      || new URL(record.instanceUrl).href !== new URL(instanceUrl).href) return null;
+    const client = createClient({ instance: instanceUrl, token: record.daemonToken });
+    return { post: (path, body) => client.post(path, { ...body, agentName, instanceId }) };
+  } catch { return null; }
+};

package/src/lib/pod-catch-up.js

@@ -1,3 +1,13 @@
+/**
+ * The backend's send-time freshness hold (agentSendFreshness.unseenMessages):
+ * HTTP 409 with `code: 'unseen_messages'`, surfaced by api.js as
+ * `error.status` + `error.body`. Shared by the turn-start probe below and the
+ * end-of-turn delivery in enforcement.js, so both read the hold the same way.
+ */
+export const isUnseenMessagesHold = (error) => (
+  error?.status === 409 && error?.body?.code === 'unseen_messages'
+);
+
 /** Explicit turn-start recovery for history that cannot fit in a tail read. */
 export const catchUpBeforeTurn = async (client, podId) => {
   const base = `/api/agents/runtime/pods/${encodeURIComponent(podId)}`;
@@ -9,13 +19,19 @@ export const catchUpBeforeTurn = async (client, podId) => {
     // Unknown freshness preserves existing turn behavior; the send-time auth
     // and freshness checks still decide whether output may be posted.
     if (error?.status !== 409) return '';
-    if (error?.body?.code !== 'unseen_messages') throw error;
+    if (!isUnseenMessagesHold(error)) throw error;
     unseenCount = error.body.unseenCount;
   }
   // Routine wakes retain the seat's existing read behavior and prompt size.
   if (!(unseenCount > 50)) return '';
-  // Never retry an already generated reply with continueAnyway. A catch-up
-  // supplies fresh conversation context BEFORE the model gets a turn.
+  // Before the turn, the answer to a hold is context, not an override: a
+  // catch-up supplies fresh conversation BEFORE the model gets a turn, so
+  // nothing here sends with continueAnyway. The one place an already
+  // generated reply IS retried with continueAnyway is end-of-turn delivery
+  // (deliverChatReply, TASK-535): a turn long enough for the pod to move on
+  // otherwise lost its whole reply to this same hold and left its events to
+  // re-run. That is a CTO ruling scoped to delivery; it does not license
+  // continueAnyway anywhere a fresh read can still reach the model.
   let body;
   try {
     body = await client.post(`${base}/catch-up`, { confirmSkipHistory: true });

package/src/lib/provider-proxy.js

@@ -1,3 +1,4 @@
+import { Transform } from 'node:stream';
 /** The per-spawn loopback proxy shared by OpenAI-compatible CLI adapters. */
 import { randomBytes, timingSafeEqual } from 'crypto';
 import { constants as fsConstants, realpathSync } from 'fs';
@@ -6,6 +7,30 @@ import { request as httpsRequest } from 'https';
 import { chmod, lstat, open, unlink, writeFile } from 'fs/promises';
 import { isAbsolute, relative, sep } from 'path';
 
+// Providers sometimes echo request headers in an error response. Redact the
+// material across arbitrary stream chunk boundaries before any model sees it.
+export const redactProviderMaterial = (material) => {
+  const secret = Buffer.from(material);
+  let pending = Buffer.alloc(0);
+  return new Transform({
+    transform(chunk, _encoding, done) {
+      pending = Buffer.concat([pending, Buffer.from(chunk)]);
+      while (pending.length >= secret.length) {
+        const index = pending.indexOf(secret);
+        if (index >= 0) {
+          this.push(pending.subarray(0, index)); this.push('[redacted]');
+          pending = pending.subarray(index + secret.length);
+        } else {
+          const count = pending.length - secret.length + 1;
+          this.push(pending.subarray(0, count)); pending = pending.subarray(count);
+        }
+      }
+      done();
+    },
+    flush(done) { this.push(pending); pending = Buffer.alloc(0); done(); },
+  });
+};
+
 const isPathWithin = (parent, candidate) => {
   const fromParent = relative(parent, candidate);
   return fromParent === '' || (fromParent !== '..'
@@ -68,7 +93,7 @@ const readProviderKey = async (keyFile, adapterLabel) => {
 };
 
 export const startProviderProxy = async ({
-  provider, keyFile, tokenFile, socketPath, isolatedPort, adapterLabel = 'OpenCode',
+  provider, keyFile, keyMaterial, tokenFile, socketPath, isolatedPort, adapterLabel = 'OpenCode',
 }) => {
   const upstream = new URL(provider.baseURL);
   if (socketPath && (!isAbsolute(socketPath)
@@ -80,7 +105,8 @@ export const startProviderProxy = async ({
     throw new Error(`${adapterLabel} provider.baseURL must be an http(s) URL without embedded credentials or query data`);
   }
   const basePath = upstream.pathname.replace(/\/+$/, '') || '/';
-  const upstreamKey = await readProviderKey(keyFile, adapterLabel);
+  const upstreamKey = keyMaterial === undefined ? await readProviderKey(keyFile, adapterLabel) : keyMaterial;
+  if (typeof upstreamKey !== 'string' || !upstreamKey || /[\r\n]/.test(upstreamKey)) throw new Error('Invalid provider key');
   const proxyToken = randomBytes(32).toString('base64url');
   await writeFile(tokenFile, proxyToken, { encoding: 'utf8', mode: 0o600 });
   await chmod(tokenFile, 0o600);
@@ -176,6 +202,7 @@ export const startProviderProxy = async ({
       ].includes(name.toLowerCase())));
     headers.authorization = `Bearer ${upstreamKey}`;
     headers.host = target.host;
+    headers['accept-encoding'] = 'identity';
     const request = (target.protocol === 'https:' ? httpsRequest : httpRequest)({
       protocol: target.protocol,
       hostname: target.hostname,
@@ -189,13 +216,21 @@ export const startProviderProxy = async ({
         outgoing.writeHead(502).end('Provider redirects are not supported');
         return;
       }
+      if (response.headers['content-encoding'] && response.headers['content-encoding'] !== 'identity') {
+        response.resume(); outgoing.writeHead(502).end('Compressed provider responses are not supported'); return;
+      }
       const responseHeaders = Object.fromEntries(Object.entries(response.headers)
         .filter(([name]) => ![
           'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
           'te', 'trailer', 'transfer-encoding', 'upgrade',
         ].includes(name.toLowerCase())));
+      delete responseHeaders['content-length'];
+      for (const [name, value] of Object.entries(responseHeaders)) {
+        if (typeof value === 'string') responseHeaders[name] = value.split(upstreamKey).join('[redacted]');
+        else if (Array.isArray(value)) responseHeaders[name] = value.map((entry) => entry.split(upstreamKey).join('[redacted]'));
+      }
       outgoing.writeHead(response.statusCode || 502, responseHeaders);
-      response.pipe(outgoing);
+      response.pipe(redactProviderMaterial(upstreamKey)).pipe(outgoing);
     });
     request.on('error', () => {
       if (!outgoing.headersSent) outgoing.writeHead(502);

package/src/lib/runtime-inventory.js

@@ -0,0 +1,12 @@
+// Probe only the walked adapter's version command. Never enumerate workspace
+// extensions to discover models: a model picker must not execute project code.
+export const WALKED_HARNESSES = ['claude', 'codex', 'opencode', 'hermes', 'dsh'];
+export const collectRuntimeInventory = async (getAdapter, capabilities) => Promise.all(WALKED_HARNESSES.map(async (harness) => {
+  const adapter = getAdapter(harness);
+  let detected = null;
+  try { detected = await adapter?.detect(); } catch { /* unavailable */ }
+  let choices = { models: null, efforts: [] };
+  if (detected) { try { choices = (await (capabilities ? capabilities(harness) : adapter?.inventory?.())) || choices; } catch { /* unavailable */ } }
+  return { harness, installed: Boolean(detected), version: detected?.version || null,
+    models: choices.models, efforts: choices.efforts };
+}));

package/src/lib/runtime-observation.js

@@ -0,0 +1,51 @@
+// Read only adapter-owned control arguments. Callers exclude prompt/stdin and
+// provide every value-taking option, so a flag-shaped model/session value is
+// never reinterpreted as a second option. Raw arguments never leave the runner.
+export const controlsFromArguments = (args, { modelFlag, effortFlag, valueFlags = [], codex = false }) => {
+  const controls = { model: null, effort: null };
+  const flags = new Set([modelFlag, effortFlag, ...valueFlags].filter(Boolean));
+  for (let index = 0; index < args.length; index += 1) {
+    const flag = args[index];
+    if (!flags.has(flag)) continue;
+    const value = args[++index];
+    if (flag === modelFlag) controls.model = value || null;
+    if (flag === effortFlag) controls.effort = value || null;
+    if (codex && flag === '-c' && value?.startsWith('model_reasoning_effort=')) {
+      try { controls.effort = JSON.parse(value.slice('model_reasoning_effort='.length)); } catch { /* unknown encoding */ }
+    }
+  }
+  return controls;
+};
+
+// Called at the child's successful OS spawn event, not when a requested
+// configuration is saved or when a turn is merely queued. Never send argv.
+export const observeSpawn = (child, onSpawn, controls) => {
+  if (typeof onSpawn !== 'function') return;
+  child.once('spawn', () => {
+    try { onSpawn({ model: controls.model || null, effort: controls.effort || null, at: new Date().toISOString() }); } catch { /* diagnostic only */ }
+  });
+};
+
+export const createRuntimeReporter = ({ client, harness, detect }) => {
+  let queue = Promise.resolve();
+  const send = (body) => {
+    // Serialize so a fast process cannot have its settled report overtake its
+    // spawn report. Old backends and diagnostic outages don't stop a turn.
+    queue = queue.then(() => client.post('/api/agents/runtime/observation', body)).catch(() => {});
+    return queue;
+  };
+  return {
+    async connect() {
+      return send({ event: 'connected' });
+    },
+    spawn: ({ model, effort, at }) => {
+      const receipt = { event: 'spawn', harness, version: null, model, effort, ...(at ? { at } : {}) };
+      queue = queue.then(async () => {
+        try { receipt.version = (await detect())?.version || null; } catch { /* unavailable */ }
+        await client.post('/api/agents/runtime/observation', receipt);
+      }).catch(() => {});
+      return queue;
+    },
+    settled: (outcome = null) => send({ event: 'settled', ...(outcome ? { outcome } : {}) }),
+  };
+};