@dharma-ai-labs/agent-fabric 0.2.108 → 0.2.110

package/README.md

@@ -31,6 +31,47 @@ is sent. An acknowledged message proves delivery, not that the recipient agent
 used or correctly applied the answer. The Demo peer transport is separate from
 the signed package, knowledge, Atlas, and autonomous-update readiness gates.
 
+## Signing Upgrade Proof Preparation
+
+For a reviewed Demo signing-consumer upgrade, an operator supplies the bounded
+`dharma.signing-upgrade-context/v1` review JSON for the exact organization and
+repository. It identifies the candidate, predecessor, installed preload hash,
+unchanged original-client inventory, current and requested consumer versions,
+and a proof expiry no more than 15 minutes away. This file is a review request,
+not authorization. Never put a grant, credential or private key in it.
+
+```bash
+dharma demo signing-client-proof --organization-id <org> --repository-id <repo> --normalized-repository <normalized-remote> --review-context <review.json>
+dharma demo signing-client-proof --organization-id <org> --repository-id <repo> --normalized-repository <normalized-remote> --review-context <review.json> --submit
+dharma demo signing-owner-proof --organization-id <org> --repository-id <repo> --normalized-repository <normalized-remote> --review-context <review.json>
+```
+
+`--submit` records only an original enrolled client's signing-upgrade proof. It
+uses the existing device key and still-valid protected preload, verifies the
+exact server receipt, and preserves the same pending proof for a grant-free
+retry after a lost response. Run the same command with the same review context
+to resume; do not delete the pending proof or change trust files. A recorded
+proof is not activation. Owner proofs still require explicit ordinary-session
+browser review; `signing-owner-proof --submit` is rejected. Expired trust requires
+browser-authorized re-enrollment, not a locally extended anchor.
+
+Both commands verify the current Git remote, use the existing enrolled device
+and protected, still-valid preload, and read versions from the actual installed
+CLI/contracts packages. `--dry-run` verifies the repository scope and reports
+only a plan; it does not attest installed trust or issue a signature.
+
+Without `--submit`, the JSON result has `stage: "proof_prepared"` and
+`submitted: false`. It contains
+the device signature and source hash, not enrollment credentials. Preparing an
+owner proof does not prove owner authority or approve rotation: the current
+owner must separately review and confirm it in the ordinary browser session.
+The server must independently check current access, preload and inventory for
+every submitted source and final registration. Only client `--submit` sends the
+proof. Neither command rotates or activates keys, extends trust, replaces an original client, alters
+financial records, or bypass browser approval. Missing OS credentials or a
+missing protected signing anchor fail without recreating them. Expired trust requires supported
+browser-authorized re-enrollment, never editing local trust files.
+
 ## Autonomous organization setup
 
 Requires Node.js 22.20.0 through 24.x.

package/dist/codexBoundSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codexBoundSession.d.ts","sourceRoot":"","sources":["../src/codexBoundSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACxH,OAAO,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AACzG,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,2EAA2E,CAAC;AAC5I,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6EAA6E,CAAC;AAEvH,UAAU,sBAAsB;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,4BAA4B,CAAC;IAEvC,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,QAAQ,EAAE,uBAAuB,CAAC;IAClC,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,sBAAsB;;;yBAkC1C;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;GA0BnF;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,sBAAsB,GAAG;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;;;;;;;GAmBA"}
+{"version":3,"file":"codexBoundSession.d.ts","sourceRoot":"","sources":["../src/codexBoundSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACxH,OAAO,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AACzG,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,2EAA2E,CAAC;AAC5I,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6EAA6E,CAAC;AAEvH,UAAU,sBAAsB;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,4BAA4B,CAAC;IAEvC,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,QAAQ,EAAE,uBAAuB,CAAC;IAClC,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,sBAAsB;;;yBAmC1C;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;GA0BnF;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,sBAAsB,GAAG;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;;;;;;;GAmBA"}

package/dist/codexBoundSession.js

@@ -5,6 +5,8 @@ export async function openCodexBoundSession(input) {
     if (!binding || binding.provider !== 'codex' || binding.owner !== 'dharma_bridge') {
         throw new Error('codex_session_binding_unavailable');
     }
+    if (process.platform !== 'linux')
+        throw new Error('codex_session_sandbox_unqualified');
     const codexBinding = { ...binding, threadId: binding.sessionId };
     const lease = input.vault.tryAcquireProviderSessionLease(input.bindingId, input.identity);
     if (!lease)

package/dist/codexBoundSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"codexBoundSession.js","sourceRoot":"","sources":["../src/codexBoundSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAgC,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAAE,sBAAsB,EAA2B,MAAM,2EAA2E,CAAC;AAa5I,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAA6B;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC;IACxB,IAAI,SAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;IAAC,CAAC;IAChD,OAAO,KAAK,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAE1C,KAAK,UAAU,KAAK;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,MAAM;YAAE,OAAO;QACnB,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,2EAA2E;YAC3E,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YACxB,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC;YAAC,MAAM,QAAQ,CAAC;QAAC,CAAC;gBACf,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;QAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACpF,KAAK,CAAC,WAAW,CAAC,OAA8D;YAC9E,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACrD,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,EAC/E,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;oBAC1C,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACrE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC/C,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACrD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4EAA4E;gBAC5E,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,CAAC,kCAAkC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvE,IAAI,CAAC;wBAAC,MAAM,KAAK,EAAE,CAAC;oBAAC,CAAC;oBACtB,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;YAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,gCAAgC,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,EAC7E,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,kEAAkE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"codexBoundSession.js","sourceRoot":"","sources":["../src/codexBoundSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAgC,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAAE,sBAAsB,EAA2B,MAAM,2EAA2E,CAAC;AAa5I,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAA6B;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC;IACxB,IAAI,SAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;IAAC,CAAC;IAChD,OAAO,KAAK,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAE1C,KAAK,UAAU,KAAK;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,MAAM;YAAE,OAAO;QACnB,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,2EAA2E;YAC3E,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YACxB,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC;YAAC,MAAM,QAAQ,CAAC;QAAC,CAAC;gBACf,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;QAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACpF,KAAK,CAAC,WAAW,CAAC,OAA8D;YAC9E,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACrD,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,EAC/E,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;oBAC1C,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACrE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC/C,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACrD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4EAA4E;gBAC5E,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,CAAC,kCAAkC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvE,IAAI,CAAC;wBAAC,MAAM,KAAK,EAAE,CAAC;oBAAC,CAAC;oBACtB,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;YAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,gCAAgC,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,EAC7E,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,kEAAkE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}