@dharma-ai-labs/agent-fabric 0.2.110 → 0.2.112

package/dist/index.js

@@ -41,13 +41,18 @@ import { demoRepositoryPackage } from './demoPackage.js';
 import { demoDeviceAndPackageStatus } from './demoStatus.js';
 import { prepareDemoSigningUpgradeProof, readDemoSigningUpgradeContext } from './demoSigningUpgradeProof.js';
 import { submitDemoSigningUpgradeProof } from './demoSigningUpgradeSubmission.js';
+import { createDemoDeviceTransport } from './demoDeviceTransport.js';
 import { runDemoWatch } from './demoWatch.js';
 import { runDemoSupervisor } from './demoSupervisor.js';
 import { demoWatchRegistrationKey, listDemoWatchRegistrations } from './demoWatchRegistry.js';
 import { createDemoWatchHealthRecorder } from './demoWatchHealth.js';
 import { demoWatchStatus, disableDemoWatch, enableDemoWatch, inspectDemoWatchSupervisor } from './demoWatchControl.js';
+import { namedSessionPaths, namedSessionRequest, readNamedSession, saveNamedSession, runNamedSessionService } from './namedSessionService.js';
+import { openCodexAppServerTransport } from '@dharma-ai-labs/agent-fabric-provider-adapters/experimental/codex-transport';
+import { createNamedSessionTrust, isNamedSessionOwnerReceipt, renewNamedSessionLifetime } from './namedSessionTrust.js';
+import { startNamedCodexThread } from './namedCodexThread.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.110';
+const VERSION = '0.2.112';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -1606,14 +1611,15 @@ async function supervisedDemoCycle(registration, signal) {
     const nativeDirectory = registration.provider === 'codex' ? resolve(workspace, '.agents', 'skills')
         : registration.provider === 'claude' ? resolve(workspace, '.claude', 'skills')
             : nativeSkillDirectory(registration.provider);
-    return withDemoDeviceLock(scope, () => {
+    return withDemoDeviceLock(scope, async () => {
         signal.throwIfAborted();
-        return demoRepositoryPackage({ scope, workspace, provider: registration.provider,
-            nativeSkillDirectory: nativeDirectory }, { fetcher: (url, options) => {
+        const deps = await createDemoDeviceTransport(scope, { fetcher: (url, options) => {
                 signal.throwIfAborted();
                 return fetch(url, { ...options,
                     signal: options?.signal ? AbortSignal.any([options.signal, signal]) : signal });
             } });
+        return demoRepositoryPackage({ scope, workspace, provider: registration.provider,
+            nativeSkillDirectory: nativeDirectory }, deps);
     });
 }
 async function relaySupervise(flags) {
@@ -1665,7 +1671,9 @@ async function relaySupervise(flags) {
             }),
         }) : Promise.resolve({ restarts: 0 });
         services.push(standard);
-        const [demoResult, standardResult] = await Promise.all([demo, standard]);
+        const sessions = policyPath ? superviseNamedSessions(controller.signal) : Promise.resolve();
+        services.push(sessions);
+        const [demoResult, standardResult] = await Promise.all([demo, standard, sessions]);
         return { ok: true, stopped: true, ...standardResult, demo: demoResult };
     }
     finally {
@@ -1681,6 +1689,42 @@ async function relaySupervise(flags) {
         await releaseLease();
     }
 }
+async function superviseNamedSessions(signal) {
+    if (process.platform !== 'linux')
+        return;
+    while (!signal.aborted) {
+        const root = resolve(dharmaHome(), 'sessions');
+        const entries = await readdir(root, { withFileTypes: true }).catch(error => {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        });
+        for (const entry of entries.slice(0, 50)) {
+            if (signal.aborted)
+                break;
+            if (!entry.isDirectory() || !/^[a-z][a-z0-9-]{0,47}$/.test(entry.name))
+                continue;
+            try {
+                const registration = await readNamedSession(dharmaHome(), entry.name);
+                if (!registration?.enabled)
+                    continue;
+                await namedSessionCommand('start', new Map([
+                    ['name', registration.name], ['workspace-id', registration.identity.workspaceId], ['apply', true],
+                ]));
+            }
+            catch {
+                process.stderr.write(`${JSON.stringify({ event: 'named_session_reconnect_pending', name: entry.name })}\n`);
+            }
+        }
+        await new Promise(resolveWait => {
+            const finish = () => { clearTimeout(timer); signal.removeEventListener('abort', finish); resolveWait(); };
+            const timer = setTimeout(finish, 10_000);
+            signal.addEventListener('abort', finish, { once: true });
+            if (signal.aborted)
+                finish();
+        });
+    }
+}
 async function relayStop() {
     const home = dharmaHome();
     const supervisor = await relaySupervisorProcessState(home);
@@ -2033,12 +2077,22 @@ async function bootstrap(flags) {
         usage,
     });
     const operatingContract = await loadAgentFabricOnboardingContract();
+    const namedSession = provider === 'codex' && process.platform === 'linux' && sharedRepositoryReady
+        ? await withOnboardingStage('named_session', String(onboarded.workspaceId), `dharma bootstrap --resume --complete --portal-url ${hqUrl} --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`, () => namedSessionCommand('start', new Map([
+            ['name', String(flags.get('session-name') || `codex-${String(onboarded.workspaceId).slice(0, 8)}`)],
+            ['workspace-id', String(onboarded.workspaceId)], ['apply', true],
+            ...(typeof flags.get('session-budget-cents') === 'string'
+                ? [['session-budget-cents', String(flags.get('session-budget-cents'))]] : []),
+        ])))
+        : null;
     const repositoryReceipt = onboarded;
+    const namedSessionReady = provider !== 'codex' || process.platform !== 'linux'
+        || Boolean(namedSession?.ok === true && ['running', 'executing'].includes(String(namedSession.state)));
     const firstLearning = repositoryReceipt.firstLearningEvidence;
     const role = repositoryReceipt.repositoryRole;
     return {
-        ok: repositoryReadiness?.outcome !== 'blocked',
-        stage: sharedRepositoryReady ? 'complete'
+        ok: repositoryReadiness?.outcome !== 'blocked' && namedSessionReady,
+        stage: sharedRepositoryReady ? namedSessionReady ? 'complete' : 'named_session_pending'
             : repositoryReadiness?.outcome === 'blocked' ? 'shared_repository_blocked' : 'shared_repository_pending',
         localStage: 'complete',
         sharedRepositoryReady,
@@ -2063,6 +2117,7 @@ async function bootstrap(flags) {
         },
         relayProbe: relay.probe,
         relay,
+        namedSession,
         repositoryReadiness,
         organizationApi,
         operatingContract: {
@@ -2077,6 +2132,8 @@ async function bootstrap(flags) {
                 ? Number(firstLearning.discovered || 0) > 0 ? 'synchronized' : 'no_eligible_history'
                 : String(firstLearning?.state || 'pending'),
             synchronization: relay.state === 'running' ? 'running' : 'pending',
+            namedSession: namedSession && namedSessionReady ? 'ready'
+                : provider === 'codex' && process.platform === 'linux' ? 'pending' : 'not_supported',
         },
     };
 }
@@ -3159,6 +3216,17 @@ async function repositoryRoleCommand(action, flags) {
     if (!item)
         throw new Error('Repository role workspace is not registered locally.');
     const scope = repositoryRoleScope(item), transport = await client();
+    if (['ask', 'reply'].includes(action) && flags.has('session-name')) {
+        const name = required(flags, 'session-name');
+        const registered = await readNamedSession(dharmaHome(), name);
+        if (!registered || registered.identity.workspaceId !== workspaceId)
+            throw new Error('named_session_scope_mismatch');
+        return namedSessionRequest(dharmaHome(), name, action === 'ask' ? {
+            action: 'ask', targetBindingId: required(flags, 'target-session-binding-id'),
+            taskId: required(flags, 'task-id'), category: required(flags, 'category'), question: required(flags, 'question'),
+        } : { action: 'read', questionId: required(flags, 'question-id'),
+            taskId: required(flags, 'task-id'), targetBindingId: required(flags, 'target-session-binding-id') });
+    }
     if (action === 'register') {
         const categories = required(flags, 'question-categories').split(',').map(value => value.trim()).filter(Boolean);
         return registerRepositoryRoleMetadata(transport, scope, { expectedRevision: Number(flags.get('expected-revision') || 0),
@@ -3175,6 +3243,201 @@ async function repositoryRoleCommand(action, flags) {
             targetEndpointId: typeof flags.get('target-endpoint-id') === 'string' ? String(flags.get('target-endpoint-id')) : undefined });
     return readRepositoryRoleReply({ transport, scope, questionId: required(flags, 'question-id') });
 }
+async function namedSessionCommand(action, flags) {
+    const name = String(flags.get('name') || 'codex');
+    const paths = namedSessionPaths(dharmaHome(), name);
+    if (process.platform !== 'linux')
+        throw new Error('codex_session_sandbox_unqualified');
+    const workspaceId = required(flags, 'workspace-id');
+    const item = (await registry()).find(row => row.workspaceId === workspaceId);
+    const config = await readDeviceConfig();
+    if (!item || !config || item.organizationId !== config.organizationId)
+        throw new Error('named_session_scope_mismatch');
+    const scope = repositoryRoleScope(item);
+    const existing = await readNamedSession(dharmaHome(), name);
+    if (existing && (existing.identity.workspaceId !== item.workspaceId
+        || existing.identity.organizationId !== config.organizationId || existing.identity.deviceId !== config.deviceId
+        || existing.identity.endpointId !== scope.endpointId || existing.identity.repositoryBindingId !== scope.repositoryBindingId)) {
+        throw new Error('named_session_scope_mismatch');
+    }
+    if (action === 'status') {
+        try {
+            return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+        }
+        catch {
+            return { ok: true, name, state: 'stopped', registered: Boolean(existing), enabled: existing?.enabled ?? false,
+                bindingId: existing?.bindingId ?? null };
+        }
+    }
+    if (action === 'work')
+        return namedSessionRequest(dharmaHome(), name, { action: 'work',
+            workId: String(flags.get('work-id') || randomUUID()), prompt: required(flags, 'prompt') });
+    if (action === 'stop') {
+        if (!flags.has('apply'))
+            return { ok: true, planned: true, name, action: 'stop' };
+        if (existing)
+            await saveNamedSession(dharmaHome(), { ...existing, enabled: false });
+        try {
+            return await namedSessionRequest(dharmaHome(), name, { action: 'stop' });
+        }
+        catch {
+            return { ok: true, name, state: 'stopped', enabled: false };
+        }
+    }
+    if (!['start', 'serve'].includes(action))
+        throw new Error('named_session_action_invalid');
+    if (!flags.has('apply'))
+        return { ok: true, planned: true, name, workspaceId,
+            provider: 'codex', localWork: 'workspace_write', peerQuestions: 'read_only', network: 'deny' };
+    if (!await repositorySharedReady(item))
+        throw new Error('named_session_repository_package_pending');
+    if (action === 'start') {
+        if (existing && !existing.enabled)
+            await saveNamedSession(dharmaHome(), { ...existing, enabled: true });
+        try {
+            return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+        }
+        catch { /* Start an owned worker below. */ }
+        const args = [fileURLToPath(import.meta.url), 'sessions', 'serve', '--name', name,
+            '--workspace-id', workspaceId, '--apply'];
+        for (const key of ['session-budget-cents', 'turn-budget-cents']) {
+            if (flags.has(key))
+                args.push(`--${key}`, required(flags, key));
+        }
+        const child = spawn(process.execPath, args, { cwd: item.path, detached: true, stdio: 'ignore', env: process.env });
+        child.on('error', () => { });
+        child.unref();
+        for (let attempt = 0; attempt < 80; attempt++) {
+            await new Promise(resolveWait => setTimeout(resolveWait, 250));
+            try {
+                return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+            }
+            catch { /* Await service initialization. */ }
+        }
+        throw new Error('named_session_startup_failed');
+    }
+    await mkdir(paths.root, { recursive: true, mode: 0o700 });
+    const releaseLock = await acquirePidLock(resolve(paths.root, 'service.lock'), 250, 'named_session_already_running');
+    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
+    const vault = await LocalVault.open({ root: resolve(dharmaHome(), 'vault'), masterKey: await loadOrCreateVaultMasterKey() });
+    const controller = new AbortController(), stop = () => controller.abort();
+    process.once('SIGTERM', stop);
+    process.once('SIGINT', stop);
+    let transport;
+    try {
+        const fabric = await AgentFabricClient.open({ configPath: configPath(), statePath: resolve(paths.root, 'protocol-state.json') });
+        if (fabric.config.organizationId !== config.organizationId || fabric.config.deviceId !== config.deviceId
+            || fabric.config.publicKeyEd25519 !== config.publicKeyEd25519)
+            throw new Error('named_session_trust_scope_mismatch');
+        const trust = createNamedSessionTrust({ configPath: configPath(), identity: fabric.config });
+        await trust.refresh();
+        await fabric.openSession(VERSION);
+        const policyPath = resolve(item.path, '.dharma', 'approved-policy.json');
+        const policy = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+        const writeRoots = policy.tasks.writePaths.filter(path => /^[a-zA-Z0-9_-]+\/\*\*$/.test(path))
+            .map(path => path.slice(0, -3));
+        if (!writeRoots.length)
+            throw new Error('named_session_workspace_write_not_authorized');
+        const workRoots = ['"."="read"', ...writeRoots.map(root => `${JSON.stringify(root)}="write"`)].join(',');
+        transport = await openCodexAppServerTransport({ command: 'codex', cwd: item.path,
+            environment: providerProcessEnvironment(process.env), experimentalApi: true,
+            argv: ['-c', 'default_permissions="dharma_bridge"',
+                '-c', 'permissions.dharma_bridge.filesystem={":minimal"="read",":workspace_roots"={"."="read"}}',
+                '-c', 'permissions.dharma_bridge.network={enabled=false}',
+                '-c', `permissions.dharma_work.filesystem={":minimal"="read",":workspace_roots"={${workRoots}}}`,
+                '-c', 'permissions.dharma_work.network={enabled=false}', 'app-server'] });
+        const account = await transport.request('account/read', { refreshToken: false });
+        if (!account.account)
+            throw new Error('named_session_provider_authentication_required');
+        let registration = existing;
+        if (!registration) {
+            const maximumCostCents = boundedInteger(flags.get('session-budget-cents'), 1000, 1, 10000, '--session-budget-cents');
+            const maximumTurnCostCents = boundedInteger(flags.get('turn-budget-cents'), 25, 1, maximumCostCents, '--turn-budget-cents');
+            const threadId = await startNamedCodexThread(transport, item.path, name);
+            const bindingId = randomUUID();
+            const response = await fabric.signedPost('/agent-fabric/provider-sessions', {
+                schema: 'dharma.provider-session-registration/v1', action: 'attach', provider: 'codex', mode: 'bridge_owned',
+                workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                bindingId, expectedRevision: 0, leaseSeconds: 60,
+            });
+            const remote = response.registration;
+            if (response.ok !== true || response.organizationId !== config.organizationId || !remote
+                || remote.bindingId !== bindingId || remote.workspaceId !== workspaceId || remote.endpointId !== scope.endpointId
+                || remote.repositoryBindingId !== scope.repositoryBindingId || remote.deviceId !== config.deviceId
+                || !UUID_PATTERN.test(String(remote.membershipId)) || remote.provider !== 'codex'
+                || remote.mode !== 'bridge_owned' || remote.state !== 'attached' || remote.revision !== 1) {
+                throw new Error('named_session_registration_invalid');
+            }
+            const identity = { organizationId: config.organizationId, repositoryBindingId: scope.repositoryBindingId,
+                workspaceId, endpointId: scope.endpointId, membershipId: String(remote.membershipId), deviceId: config.deviceId,
+                provider: 'codex' };
+            vault.saveProviderSessionBinding({ schema: 'dharma.local-provider-session-binding/v1', ...identity,
+                bindingId, owner: 'dharma_bridge', sessionId: threadId, workspaceRoot: item.path,
+                createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
+                maximumProviderCostCents: maximumTurnCostCents });
+            registration = { schema: 'dharma.named-session/v1', name, bindingId, identity,
+                maximumCostCents, maximumTurnCostCents, enabled: true };
+            await saveNamedSession(dharmaHome(), registration);
+        }
+        const authorizeLifetime = async () => {
+            const current = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+            if (!writeRoots.every(root => current.tasks.writePaths.includes(`${root}/**`)))
+                return false;
+            const response = await fabric.signedPost('/agent-fabric/provider-sessions', {
+                schema: 'dharma.provider-session-registration/v1', action: 'inspect', provider: 'codex', mode: 'bridge_owned',
+                workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                bindingId: registration.bindingId, expectedRevision: 0, leaseSeconds: 60,
+            });
+            return isNamedSessionOwnerReceipt(response, registration.bindingId, registration.identity);
+        };
+        const refreshLifetime = () => renewNamedSessionLifetime({ vault, bindingId: registration.bindingId,
+            identity: registration.identity, trust, authorize: authorizeLifetime });
+        await refreshLifetime();
+        const channelTransport = { async signedPost(route, body) {
+                await trust.refresh();
+                const response = await fabric.signedPost(route, body);
+                await trust.refresh();
+                return response;
+            } };
+        // The durable reservation already suppresses duplicate provider execution.
+        const consumed = new Set();
+        return await runNamedSessionService({ home: dharmaHome(), registration, vault, signal: controller.signal,
+            localWriteRoots: writeRoots,
+            withActivationBoundary: operation => withWorkspaceSkillActivationLock(workspaceId, 'codex', async () => {
+                await refreshLifetime();
+                const skill = await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace: item.path });
+                if (!skill.ready || !await repositorySharedReady(item))
+                    throw new Error('named_session_repository_package_pending');
+                return operation();
+            }),
+            authorizeLocalWork: async () => {
+                const current = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+                return writeRoots.every(root => current.tasks.writePaths.includes(`${root}/**`));
+            },
+            openTransport: async () => transport, channelTransport,
+            verifier: { resolvePublicKey: trust.resolvePublicKey, consume: async (id) => { if (consumed.has(id))
+                    return false; consumed.add(id); return true; } },
+            authorizeContent: async (content) => {
+                const current = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+                return current.evidence.automaticDisclosure?.mode === 'customer_authorized_content'
+                    && !containsDisallowedLocalPath(content)
+                    && canonicalize(redactValue(content, { classes: new Set(), redactedValues: 0,
+                        excludedPaths: 0, inputBytes: 0, outputBytes: 0 })) === canonicalize(content);
+            } });
+    }
+    finally {
+        try {
+            if (transport)
+                await transport.close();
+        }
+        finally {
+            vault.close();
+            await releaseLock();
+            process.removeListener('SIGTERM', stop);
+            process.removeListener('SIGINT', stop);
+        }
+    }
+}
 async function workspaceSync(flags, positional) {
     const workspaceId = positional[0] || required(flags, 'workspace-id');
     const policyRevision = required(flags, 'policy-revision');
@@ -5899,7 +6162,7 @@ export async function run(argv) {
         return { version: VERSION };
     if (command === 'demo' && ['connect', 'status', 'role', 'peers', 'ask', 'reply', 'inbox', 'ack', 'resume',
         'package', 'package-status', 'watch', 'watch-enable', 'watch-status', 'watch-disable',
-        'signing-client-proof', 'signing-owner-proof']
+        'signing-client-proof', 'signing-owner-proof', 'transport-connect']
         .includes(String(subcommand))) {
         const hqUrl = normalizeHqUrl(portalUrl(flags));
         const organizationId = required(flags, 'organization-id');
@@ -5921,11 +6184,23 @@ export async function run(argv) {
         if (watchControl && await realpath(root) !== workspace) {
             throw new Error('Demo watch setup must select the exact Git repository root.');
         }
+        let transportOrigin = null;
+        if (subcommand === 'transport-connect') {
+            transportOrigin = required(flags, 'transport-origin');
+            try {
+                const target = new URL(transportOrigin);
+                if (transportOrigin.length > 2048 || target.protocol !== 'https:' || target.origin !== transportOrigin || transportOrigin === hqUrl)
+                    throw new Error();
+            }
+            catch {
+                throw new Error('Demo transport recovery target_invalid. Use the exact reviewed HTTPS origin.');
+            }
+        }
         if (flags.has('dry-run'))
-            return { ok: true, stage: signingProof ? 'demo_signing_proof_plan'
+            return { ok: true, stage: transportOrigin ? 'demo_transport_plan' : signingProof ? 'demo_signing_proof_plan'
                     : watchControl ? 'demo_watch_plan' : 'demo_device_plan',
                 organizationId, repositoryId, normalizedRepository, workspaceVerified: true,
-                repositoryPackageState: 'not_connected' };
+                repositoryPackageState: 'not_connected', ...(transportOrigin ? { transportOrigin } : {}) };
         const grant = subcommand === 'connect' ? required(flags, 'grant') : null;
         const scope = {
             hqUrl, organizationId, repositoryId, normalizedRepository,
@@ -5934,7 +6209,7 @@ export async function run(argv) {
         if (signingProof) {
             const context = await readDemoSigningUpgradeContext(resolve(required(flags, 'review-context')));
             if (flags.has('submit'))
-                return withDemoDeviceLock(scope, () => submitDemoSigningUpgradeProof(scope, context));
+                return withDemoDeviceLock(scope, async () => submitDemoSigningUpgradeProof(scope, context, await createDemoDeviceTransport(scope)));
             return withDemoDeviceLock(scope, () => prepareDemoSigningUpgradeProof(scope, context, subcommand === 'signing-owner-proof' ? 'owner' : 'client'));
         }
         if (watchControl) {
@@ -5949,7 +6224,9 @@ export async function run(argv) {
                 hqUrl, organizationId, repositoryId, normalizedRepository, provider, workspace };
             const input = { home: dharmaHome(), registration, version: VERSION };
             const deps = {
-                verify: async () => { await withDemoDeviceLock(scope, () => verifyDemoDevice(scope)); },
+                verify: async () => {
+                    await withDemoDeviceLock(scope, async () => verifyDemoDevice(scope, await createDemoDeviceTransport(scope)));
+                },
                 exclusive: operation => withRelayStartupMutation(operation),
                 prepareStartup: async () => {
                     const launcher = await installStableRepositoryLauncher(workspace);
@@ -5977,9 +6254,9 @@ export async function run(argv) {
             const demoNativeSkillDirectory = provider === 'codex' ? resolve(workspace, '.agents', 'skills')
                 : provider === 'claude' ? resolve(workspace, '.claude', 'skills')
                     : nativeSkillDirectory(provider);
-            const cycle = () => withDemoDeviceLock(scope, () => demoRepositoryPackage({ scope, workspace,
+            const cycle = () => withDemoDeviceLock(scope, async () => demoRepositoryPackage({ scope, workspace,
                 statusOnly: subcommand === 'package-status', provider,
-                nativeSkillDirectory: demoNativeSkillDirectory }));
+                nativeSkillDirectory: demoNativeSkillDirectory }, await createDemoDeviceTransport(scope)));
             if (subcommand !== 'watch')
                 return cycle();
             const rawInterval = flags.get('interval-ms');
@@ -6002,8 +6279,6 @@ export async function run(argv) {
             }
         }
         return withDemoDeviceLock(scope, async () => {
-            if (subcommand === 'status')
-                return demoDeviceAndPackageStatus(scope, workspace);
             if (subcommand === 'connect') {
                 const connected = await connectDemoDevice({
                     ...scope, grant: grant,
@@ -6017,6 +6292,11 @@ export async function run(argv) {
                 const { configPath: _configPath, ...receipt } = connected;
                 return receipt;
             }
+            const deps = await createDemoDeviceTransport(scope);
+            if (transportOrigin)
+                return deps.connectTransport(transportOrigin);
+            if (subcommand === 'status')
+                return demoDeviceAndPackageStatus(scope, workspace, deps);
             let action = null;
             if (subcommand === 'role') {
                 const categories = repeated.get('category') || [];
@@ -6040,11 +6320,13 @@ export async function run(argv) {
                 action = { kind: 'inbox' };
             if (subcommand === 'ack')
                 action = { kind: 'ack', messageId: required(flags, 'message-id') };
-            return performDemoPeerAction(scope, action);
+            return performDemoPeerAction(scope, action, deps);
         });
     }
     if (command === 'bootstrap')
         return bootstrap(flags);
+    if (command === 'sessions')
+        return namedSessionCommand(String(subcommand), flags);
     if (command === 'onboard')
         return onboard(flags);
     if (command === 'login')