@dharma-ai-labs/agent-fabric 0.2.197 → 0.2.199

package/dist/index.js

@@ -104,7 +104,7 @@ import { assertCodexSetupExecutionLease } from './codexSetupAdmission.js';
 import { parseLocalCodexSetupReadiness } from '@dharma-ai-labs/agent-fabric-local-vault/setup-readiness';
 import { writeBootstrapHostJson, writeBootstrapHostText } from './bootstrapHostFiles.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.197';
+const VERSION = '0.2.199';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -1491,6 +1491,20 @@ export async function preflightBootstrapWorkspaceIdentity(workspace, explicitKey
     const remote = await gitValue(workspace, ['config', '--get', 'remote.origin.url']);
     return sourceRepositoryFingerprint(remote, explicitKey);
 }
+// Requalification is itself the scope fence. Calling gitValue here would
+// re-enter that fence before dispatching either read-only metadata command.
+async function readBootstrapSourceIdentityForRequalification(workspace, signal) {
+    const options = { timeout: 10_000, maxBuffer: 65_536, windowsHide: true, signal,
+        env: providerProcessEnvironment(process.env) };
+    signal.throwIfAborted();
+    const root = await execFileAsync('git', ['-C', workspace, 'rev-parse', '--show-toplevel'], options);
+    signal.throwIfAborted();
+    if (!root.stdout.trim())
+        throw new Error('Bootstrap workspace must be a Git repository.');
+    const remote = await execFileAsync('git', ['-C', workspace, 'config', '--get', 'remote.origin.url'], options);
+    signal.throwIfAborted();
+    return sourceRepositoryFingerprint(remote.stdout.trim() || null);
+}
 export function responseTextFromEvent(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return null;
@@ -2069,8 +2083,10 @@ async function startRelayDaemon(policyPath) {
     const supervisorState = await relaySupervisorProcessState();
     if (supervisorState === 'unknown')
         throw new Error('Relay supervisor process state is unknown.');
-    if (supervisorState === 'stopped') {
-        const startupBackend = (await relayAutostartStatus({ home: dharmaHome() })).backend;
+    const startup = await step(() => relayAutostartStatus({ home: dharmaHome() }));
+    const hostPending = startup.restartCoverage === 'wsl-host-logon' && startup.hostLifecycle !== 'running';
+    if (supervisorState === 'stopped' || hostPending) {
+        const startupBackend = startup.backend;
         // A setup turn cannot own a supervisor intended to outlive that turn.
         if (hostScope || startupBackend === 'container-entrypoint' || startupBackend === 'systemd-user') {
             await step(() => startRelayAutostart({ home: dharmaHome() }));
@@ -2701,7 +2717,8 @@ async function observeCodexBootstrapRuntime(prepared, vault, firstLearning, inte
         || resolve(startup.workspace) !== startup.workspace
         || startup.policy !== resolve(startup.workspace, '.dharma', 'approved-policy.json')
         || startup.launcher !== resolve(startup.workspace, '.dharma', 'bin', 'dharma')
-        || startup.backend === 'container-entrypoint' && startupState.lifecycle !== 'running') {
+        || startup.backend === 'container-entrypoint' && startupState.lifecycle !== 'running'
+        || startupState.restartCoverage === 'wsl-host-logon' && startupState.hostLifecycle !== 'running') {
         throw new Error('setup_runtime_startup_unconfirmed');
     }
     // A standard relay can retain another repository as its same-device anchor.
@@ -3163,7 +3180,8 @@ async function codexPortalSetup(flags) {
                 && (info.mode & (privateMode ? 0o077 : 0o022)) === 0 && await realpath(path) === path;
         };
         const current = async () => {
-            if (controller.signal.aborted || Date.now() >= Date.parse(prepared.intent.expiresAt)
+            const qualificationSignal = currentBootstrapHostScope()?.signal ?? controller.signal;
+            if (qualificationSignal.aborted || Date.now() >= Date.parse(prepared.intent.expiresAt)
                 || process.getuid?.() !== uid || process.cwd() !== currentDirectory
                 || process.env.DHARMA_HOME !== environment.home || process.env.CODEX_HOME !== environment.provider)
                 return false;
@@ -3172,7 +3190,7 @@ async function codexPortalSetup(flags) {
                 return now.isFile() && !now.isSymbolicLink() && now.dev === runtime.dev && now.ino === runtime.ino
                     && now.size === runtime.size && now.mtimeNs === runtime.mtimeNs && now.ctimeNs === runtime.ctimeNs
                     && await privateDirectory(home, true) && await privateDirectory(providerHome, false)
-                    && (await preflightBootstrapWorkspaceIdentity(workspace)).fingerprint === prepared.intent.repositoryFingerprint;
+                    && (await readBootstrapSourceIdentityForRequalification(workspace, qualificationSignal)).fingerprint === prepared.intent.repositoryFingerprint;
             }
             catch {
                 return false;
@@ -3433,7 +3451,8 @@ async function bootstrap(flags, hostScope) {
             const code = error instanceof Error && error.message.startsWith('autostart_conflict:')
                 ? 'autostart_conflict' : error instanceof Error && error.message.startsWith('relay_runtime_upgrade_required:')
                 ? 'relay_runtime_upgrade_required' : error instanceof Error && error.message.startsWith('relay_workspace_conflict:')
-                ? 'relay_workspace_conflict' : 'startup_preflight_unavailable';
+                ? 'relay_workspace_conflict' : error instanceof Error && error.message === 'wsl_host_startup_unavailable'
+                ? 'wsl_host_startup_unavailable' : 'startup_preflight_unavailable';
             return { ok: false, stage: 'startup_preflight', code, grantRedeemed: false, enrollmentChanged: false,
                 message: code === 'relay_runtime_upgrade_required'
                     ? 'Upgrade the existing enrolled startup runtime through the supported same-device update flow before retrying; setup has not redeemed authority or changed enrollment.'
@@ -3441,7 +3460,9 @@ async function bootstrap(flags, hostScope) {
                         ? 'This Linux user already has a startup entry owned by another installation. Use the existing enrolled installation or an eligible clean client; setup has not redeemed authority or changed enrollment.'
                         : code === 'relay_workspace_conflict'
                             ? 'The existing startup anchor does not match this device and its approved repository policy. Recover that enrolled repository through the supported same-device flow before retrying; setup has not redeemed authority or changed enrollment.'
-                            : 'Startup ownership could not be verified. Resolve the supported startup prerequisite before retrying; setup has not redeemed authority or changed enrollment.' };
+                            : code === 'wsl_host_startup_unavailable'
+                                ? 'The WSL host startup owner could not be verified. Restore the supported user-logon host binding before retrying; setup has not redeemed authority or changed enrollment.'
+                                : 'Startup ownership could not be verified. Resolve the supported startup prerequisite before retrying; setup has not redeemed authority or changed enrollment.' };
         }
     }
     if (grantMode === 'prompt')
@@ -3744,11 +3765,12 @@ async function bootstrap(flags, hostScope) {
     const role = repositoryReceipt.repositoryRole;
     const roleReady = Boolean(role);
     const relayReady = relay.state === 'running';
-    const observedAutostart = autostart.backend === 'container-entrypoint'
+    const observedAutostart = autostart.backend === 'container-entrypoint' || autostart.restartCoverage === 'wsl-host-logon'
         ? await step(() => relayAutostartStatus({ home: dharmaHome() })) : autostart;
     const startupReady = !['win32', 'linux', 'darwin'].includes(process.platform)
         || observedAutostart.state === 'enabled'
-            && (observedAutostart.backend !== 'container-entrypoint' || observedAutostart.lifecycle === 'running');
+            && (observedAutostart.backend !== 'container-entrypoint' || observedAutostart.lifecycle === 'running')
+            && (observedAutostart.restartCoverage !== 'wsl-host-logon' || observedAutostart.hostLifecycle === 'running');
     const complete = sharedRepositoryReady && namedSessionReady && firstLearningReady
         && roleReady && relayReady && startupReady;
     return {