@dharma-ai-labs/agent-fabric 0.2.198 → 0.2.200

package/dist/index.js

@@ -54,7 +54,7 @@ import { registerRepositoryRoleMetadata, discoverRepositoryRoleMetadata } from '
 import { askRepositoryRoleQuestion, readRepositoryRoleReply } from './repositoryRoleQuestion.js';
 import { deriveRepositoryRole } from './repositoryRoleDerivation.js';
 import { withOnboardingStage } from './onboardingStage.js';
-import { reportCodexSetupFailure } from './codexSetupDiagnostic.js';
+import { classifyCodexSetupFailure, reportCodexSetupFailure } from './codexSetupDiagnostic.js';
 import { waitForRepositoryReadiness } from './repositoryReadinessWait.js';
 import { connectDemoDevice, verifyDemoDevice } from './demoEnrollment.js';
 import { performDemoPeerAction, withDemoDeviceLock } from './demoPeer.js';
@@ -104,7 +104,7 @@ import { assertCodexSetupExecutionLease } from './codexSetupAdmission.js';
 import { parseLocalCodexSetupReadiness } from '@dharma-ai-labs/agent-fabric-local-vault/setup-readiness';
 import { writeBootstrapHostJson, writeBootstrapHostText } from './bootstrapHostFiles.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.198';
+const VERSION = '0.2.200';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -2083,8 +2083,10 @@ async function startRelayDaemon(policyPath) {
     const supervisorState = await relaySupervisorProcessState();
     if (supervisorState === 'unknown')
         throw new Error('Relay supervisor process state is unknown.');
-    if (supervisorState === 'stopped') {
-        const startupBackend = (await relayAutostartStatus({ home: dharmaHome() })).backend;
+    const startup = await step(() => relayAutostartStatus({ home: dharmaHome() }));
+    const hostPending = startup.restartCoverage === 'wsl-host-logon' && startup.hostLifecycle !== 'running';
+    if (supervisorState === 'stopped' || hostPending) {
+        const startupBackend = startup.backend;
         // A setup turn cannot own a supervisor intended to outlive that turn.
         if (hostScope || startupBackend === 'container-entrypoint' || startupBackend === 'systemd-user') {
             await step(() => startRelayAutostart({ home: dharmaHome() }));
@@ -2715,7 +2717,8 @@ async function observeCodexBootstrapRuntime(prepared, vault, firstLearning, inte
         || resolve(startup.workspace) !== startup.workspace
         || startup.policy !== resolve(startup.workspace, '.dharma', 'approved-policy.json')
         || startup.launcher !== resolve(startup.workspace, '.dharma', 'bin', 'dharma')
-        || startup.backend === 'container-entrypoint' && startupState.lifecycle !== 'running') {
+        || startup.backend === 'container-entrypoint' && startupState.lifecycle !== 'running'
+        || startupState.restartCoverage === 'wsl-host-logon' && startupState.hostLifecycle !== 'running') {
         throw new Error('setup_runtime_startup_unconfirmed');
     }
     // A standard relay can retain another repository as its same-device anchor.
@@ -3237,7 +3240,7 @@ async function codexPortalSetup(flags) {
         if (!completed || completed.operationId !== prepared.intent.operationId
             || completed.setupReference !== setupReference || !UUID_PATTERN.test(completed.readinessReceiptId)) {
             return { ok: false, stage: 'setup_host_unconfirmed', code: 'codex_setup_ingress_readiness_unconfirmed',
-                nativeThreadId: host.threadId, nativeTurnId: host.turnId };
+                nativeThreadId: host.threadId, nativeTurnId: host.turnId, diagnostics: host.diagnostics };
         }
         const config = await readDeviceConfig();
         if (!config || config.organizationId !== organizationId || normalizeHqUrl(config.hqUrl) !== origin
@@ -3245,7 +3248,7 @@ async function codexPortalSetup(flags) {
             || config.setupClaimRepositoryFingerprint !== prepared.intent.repositoryFingerprint) {
             return { ok: false, stage: 'setup_host_unconfirmed', effects: 'unconfirmed',
                 code: 'codex_setup_ingress_readiness_unconfirmed', setupReference,
-                nativeThreadId: host.threadId, nativeTurnId: host.turnId };
+                nativeThreadId: host.threadId, nativeTurnId: host.turnId, diagnostics: host.diagnostics };
         }
         // One supported grant-free reconciliation, only for this consumed reference.
         // No replacement identity, grant replay or automatic provider-turn retry.
@@ -3282,7 +3285,8 @@ async function codexPortalSetup(flags) {
             'codex_setup_owned_close_unconfirmed', 'codex_setup_owned_completion_unconfirmed']);
         return { ok: false, stage: 'setup_host_unconfirmed',
             code: error instanceof Error && known.has(error.message) ? error.message : 'codex_setup_ingress_unconfirmed',
-            requiresSupportedRecovery: true };
+            requiresSupportedRecovery: true,
+            diagnostics: [...(host?.diagnostics ?? []).slice(0, 15), classifyCodexSetupFailure(error, 'bootstrap')] };
     }
     finally {
         controller.abort();
@@ -3291,8 +3295,9 @@ async function codexPortalSetup(flags) {
         try {
             await host?.close();
         }
-        catch {
-            return { ok: false, stage: 'setup_host_unconfirmed', code: 'codex_setup_owned_close_unconfirmed' };
+        catch (error) {
+            return { ok: false, stage: 'setup_host_unconfirmed', code: 'codex_setup_owned_close_unconfirmed',
+                diagnostics: [...(host?.diagnostics ?? []).slice(0, 15), classifyCodexSetupFailure(error, 'completion')] };
         }
     }
 }
@@ -3363,6 +3368,15 @@ async function bootstrap(flags, hostScope) {
     }
     if (!joinedBindingId && joinedFingerprint)
         throw new Error('repository_join_selection_invalid');
+    // Qualify the original host/plan above before reading enrollment metadata.
+    // Refuse foreign context before checkout creation or private authority input.
+    const targetConfig = await step(() => readDeviceConfig());
+    if (targetConfig && !flags.has('replace-existing-enrollment')
+        && (targetConfig.organizationId !== organizationId || normalizeHqUrl(targetConfig.hqUrl) !== hqUrl)) {
+        return { ok: false, stage: 'connection_context', code: 'connection_context_mismatch',
+            effects: false, grantRedeemed: false, enrollmentChanged: false,
+            message: 'The existing local connection does not match the requested organization and portal. Select the intended installation; no repository selection or setup authority was used.' };
+    }
     let repositorySelection;
     try {
         if (flags.has('repository-url-base64url') && typeof selectedRemote !== 'string') {
@@ -3448,7 +3462,8 @@ async function bootstrap(flags, hostScope) {
             const code = error instanceof Error && error.message.startsWith('autostart_conflict:')
                 ? 'autostart_conflict' : error instanceof Error && error.message.startsWith('relay_runtime_upgrade_required:')
                 ? 'relay_runtime_upgrade_required' : error instanceof Error && error.message.startsWith('relay_workspace_conflict:')
-                ? 'relay_workspace_conflict' : 'startup_preflight_unavailable';
+                ? 'relay_workspace_conflict' : error instanceof Error && error.message === 'wsl_host_startup_unavailable'
+                ? 'wsl_host_startup_unavailable' : 'startup_preflight_unavailable';
             return { ok: false, stage: 'startup_preflight', code, grantRedeemed: false, enrollmentChanged: false,
                 message: code === 'relay_runtime_upgrade_required'
                     ? 'Upgrade the existing enrolled startup runtime through the supported same-device update flow before retrying; setup has not redeemed authority or changed enrollment.'
@@ -3456,7 +3471,9 @@ async function bootstrap(flags, hostScope) {
                         ? 'This Linux user already has a startup entry owned by another installation. Use the existing enrolled installation or an eligible clean client; setup has not redeemed authority or changed enrollment.'
                         : code === 'relay_workspace_conflict'
                             ? 'The existing startup anchor does not match this device and its approved repository policy. Recover that enrolled repository through the supported same-device flow before retrying; setup has not redeemed authority or changed enrollment.'
-                            : 'Startup ownership could not be verified. Resolve the supported startup prerequisite before retrying; setup has not redeemed authority or changed enrollment.' };
+                            : code === 'wsl_host_startup_unavailable'
+                                ? 'The WSL host startup owner could not be verified. Restore the supported user-logon host binding before retrying; setup has not redeemed authority or changed enrollment.'
+                                : 'Startup ownership could not be verified. Resolve the supported startup prerequisite before retrying; setup has not redeemed authority or changed enrollment.' };
         }
     }
     if (grantMode === 'prompt')
@@ -3759,11 +3776,12 @@ async function bootstrap(flags, hostScope) {
     const role = repositoryReceipt.repositoryRole;
     const roleReady = Boolean(role);
     const relayReady = relay.state === 'running';
-    const observedAutostart = autostart.backend === 'container-entrypoint'
+    const observedAutostart = autostart.backend === 'container-entrypoint' || autostart.restartCoverage === 'wsl-host-logon'
         ? await step(() => relayAutostartStatus({ home: dharmaHome() })) : autostart;
     const startupReady = !['win32', 'linux', 'darwin'].includes(process.platform)
         || observedAutostart.state === 'enabled'
-            && (observedAutostart.backend !== 'container-entrypoint' || observedAutostart.lifecycle === 'running');
+            && (observedAutostart.backend !== 'container-entrypoint' || observedAutostart.lifecycle === 'running')
+            && (observedAutostart.restartCoverage !== 'wsl-host-logon' || observedAutostart.hostLifecycle === 'running');
     const complete = sharedRepositoryReady && namedSessionReady && firstLearningReady
         && roleReady && relayReady && startupReady;
     return {