@ericsanchezok/meta-synergy 1.1.26 → 1.2.17

package/src/owner-registry.ts

@@ -0,0 +1,162 @@
+import { readFile, writeFile } from "node:fs/promises"
+import { MetaSynergyStore } from "./state/store"
+
+export interface MetaSynergyLocalOwnerRegistryState {
+  ownerIDs: string[]
+  activeOwnerID?: string
+  leaseExpiresAt?: number
+}
+
+export interface MetaSynergyOwnerRegistryState {
+  local: MetaSynergyLocalOwnerRegistryState
+}
+
+const DEFAULT_REGISTRY: MetaSynergyOwnerRegistryState = {
+  local: {
+    ownerIDs: [],
+  },
+}
+
+export namespace MetaSynergyOwnerRegistry {
+  export function hydrate(input: unknown): MetaSynergyOwnerRegistryState {
+    const parsed = isRecord(input) ? input : undefined
+    if (isLegacySynergyOwnerRecord(parsed)) {
+      const ownerID = parsed.agentId ? `synergy:${parsed.agentId}` : parsed.owner
+      return {
+        local: {
+          ownerIDs: [ownerID],
+          activeOwnerID: ownerID,
+        },
+      }
+    }
+
+    const local = isRecord(parsed?.local) ? parsed.local : undefined
+    const ownerIDs = uniqueStrings(Array.isArray(local?.ownerIDs) ? local.ownerIDs : undefined)
+    const activeOwnerID =
+      typeof local?.activeOwnerID === "string" && local.activeOwnerID.length > 0 ? local.activeOwnerID : undefined
+    const leaseExpiresAt =
+      typeof local?.leaseExpiresAt === "number" && Number.isFinite(local.leaseExpiresAt)
+        ? local.leaseExpiresAt
+        : undefined
+
+    if (activeOwnerID && !ownerIDs.includes(activeOwnerID)) {
+      ownerIDs.unshift(activeOwnerID)
+    }
+
+    return {
+      local: {
+        ownerIDs,
+        activeOwnerID,
+        leaseExpiresAt,
+      },
+    }
+  }
+
+  export function declareLocalOwner(
+    registry: MetaSynergyOwnerRegistryState,
+    ownerID: string,
+    options?: { leaseExpiresAt?: number },
+  ) {
+    const normalizedOwnerID = normalizeOwnerID(ownerID)
+    if (!registry.local.ownerIDs.includes(normalizedOwnerID)) {
+      registry.local.ownerIDs.unshift(normalizedOwnerID)
+    }
+    registry.local.activeOwnerID = normalizedOwnerID
+    registry.local.leaseExpiresAt = normalizeLeaseExpiresAt(options?.leaseExpiresAt)
+    return snapshot(registry)
+  }
+
+  export function releaseLocalOwner(registry: MetaSynergyOwnerRegistryState, ownerID?: string) {
+    const normalizedOwnerID = ownerID ? normalizeOwnerID(ownerID) : undefined
+    if (!normalizedOwnerID || registry.local.activeOwnerID === normalizedOwnerID) {
+      registry.local.activeOwnerID = undefined
+      registry.local.leaseExpiresAt = undefined
+    }
+    return snapshot(registry)
+  }
+
+  export function hasActiveLocalOwner(registry: MetaSynergyOwnerRegistryState, now = Date.now()) {
+    const hydrated = hydrate(registry)
+    if (!hydrated.local.activeOwnerID) return false
+    if (hydrated.local.leaseExpiresAt !== undefined && hydrated.local.leaseExpiresAt <= now) {
+      return false
+    }
+    return true
+  }
+
+  export function activeOwnerExpired(registry: MetaSynergyOwnerRegistryState, now = Date.now()) {
+    const hydrated = hydrate(registry)
+    return (
+      hydrated.local.activeOwnerID !== undefined &&
+      hydrated.local.leaseExpiresAt !== undefined &&
+      hydrated.local.leaseExpiresAt <= now
+    )
+  }
+
+  export function snapshot(registry: MetaSynergyOwnerRegistryState) {
+    const hydrated = hydrate(registry)
+    return {
+      local: {
+        ownerIDs: hydrated.local.ownerIDs,
+        activeOwnerID: hydrated.local.activeOwnerID ?? null,
+        leaseExpiresAt: hydrated.local.leaseExpiresAt ?? null,
+        owned: hasActiveLocalOwner(hydrated),
+      },
+    }
+  }
+
+  export function defaultRegistry() {
+    return hydrate(DEFAULT_REGISTRY)
+  }
+
+  export async function loadFile() {
+    try {
+      const parsed = JSON.parse(await readFile(MetaSynergyStore.ownerRegistryPath(), "utf8")) as unknown
+      return hydrate(parsed)
+    } catch {
+      return defaultRegistry()
+    }
+  }
+
+  export async function saveFile(registry: MetaSynergyOwnerRegistryState) {
+    await MetaSynergyStore.ensureRoot()
+    await writeFile(MetaSynergyStore.ownerRegistryPath(), JSON.stringify(snapshot(registry), null, 2) + "\n")
+  }
+}
+
+function normalizeOwnerID(ownerID: string) {
+  const normalized = ownerID.trim()
+  if (!normalized) {
+    throw new Error("Owner ID is required.")
+  }
+  return normalized
+}
+
+function normalizeLeaseExpiresAt(value: number | undefined) {
+  if (value === undefined) return undefined
+  if (!Number.isFinite(value)) {
+    throw new Error("Lease expiration must be a finite timestamp.")
+  }
+  return value
+}
+
+function uniqueStrings(values: unknown[] | undefined): string[] {
+  return [
+    ...new Set(
+      values?.filter((value): value is string => typeof value === "string" && value.length > 0) ??
+        DEFAULT_REGISTRY.local.ownerIDs,
+    ),
+  ]
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null
+}
+
+function isLegacySynergyOwnerRecord(value: Record<string, unknown> | undefined): value is {
+  owner: string
+  agentId?: string
+  version?: number
+} {
+  return typeof value?.owner === "string" && (value.version === undefined || typeof value.version === "number")
+}

package/src/runtime.ts

@@ -1,11 +1,16 @@
-import { MetaProtocolEnv } from "@ericsanchezok/meta-protocol"
 import process from "node:process"
+import { MetaSynergyControlClient } from "./control/client"
 import { MetaSynergyControlServer } from "./control/server"
+import type { MetaSynergyControlRequest } from "./control/schema"
+import { MetaSynergyDisplay } from "./display"
+import { MetaSynergyMigrationRunner } from "./migration"
 import { MetaSynergyHost } from "./host"
 import { MetaSynergyInboundHandler, type SessionOpenDecision } from "./inbound/handler"
 import { MetaSynergyHolosClient } from "./holos/client"
+import { MetaSynergyHolosAuth, type MetaSynergyHolosAuthSource } from "./holos/auth"
 import { MetaSynergyHolosLogin } from "./holos/login"
 import { MetaSynergyLog } from "./log"
+import { MetaSynergyOwnerRegistry } from "./owner-registry"
 import { RPCHandler } from "./rpc/handler"
 import { MetaSynergyLocalService } from "./service/local"
 import { SessionManager } from "./session/manager"
@@ -29,6 +34,8 @@ export class MetaSynergyRuntime {
   #reconnectAttempt = 0
   #stopping = false
   #manualReconnectInFlight = false
+  #runPromise: Promise<void> | null = null
+  #resolveRunPromise: (() => void) | null = null
 
   private constructor(
     host: MetaSynergyHost,
@@ -45,6 +52,7 @@ export class MetaSynergyRuntime {
   }
 
   static async create() {
+    await MetaSynergyMigrationRunner.run()
     const state = await MetaSynergyStore.loadState()
     const envID = state.envID ?? `env_${crypto.randomUUID()}`
     const hostSessionID = state.hostSessionID ?? crypto.randomUUID()
@@ -73,15 +81,28 @@ export class MetaSynergyRuntime {
     const inbound = new MetaSynergyInboundHandler(rpc, sessions, (input) => runtime.decideSessionOpen(input))
     const control = new MetaSynergyControlServer((request) => runtime.handleControlRequest(request))
     runtime = new MetaSynergyRuntime(host, sessions, rpc, inbound, control)
+    const ownerRegistry = await MetaSynergyOwnerRegistry.loadFile()
     runtime.state = {
       ...state,
       envID,
       hostSessionID,
+      ownerRegistry,
       currentSession: undefined,
       logs: {
         filePath: state.logs.filePath || MetaSynergyStore.logsPath(),
       },
     }
+
+    if (
+      runtime.state.runtimeMode === "managed" &&
+      !MetaSynergyOwnerRegistry.hasActiveLocalOwner(runtime.state.ownerRegistry)
+    ) {
+      runtime.state.runtimeMode = "standalone"
+      runtime.state.ownerRegistry = MetaSynergyOwnerRegistry.hydrate(runtime.state.ownerRegistry)
+      MetaSynergyOwnerRegistry.releaseLocalOwner(runtime.state.ownerRegistry)
+      runtime.state.connectionStatus = "disconnected"
+    }
+
     await MetaSynergyStore.saveState(runtime.state)
     return runtime
   }
@@ -93,6 +114,9 @@ export class MetaSynergyRuntime {
   async start(input?: { printLogs?: boolean }) {
     const state = requireState(this)
     this.#stopping = false
+    this.#runPromise = new Promise<void>((resolve) => {
+      this.#resolveRunPromise = resolve
+    })
     state.service.desiredState = "running"
     state.service.runtimeStatus = "starting"
     state.service.pid = process.pid
@@ -100,39 +124,55 @@ export class MetaSynergyRuntime {
     state.service.startedAt = state.service.startedAt ?? Date.now()
     state.service.stoppedAt = undefined
     state.logs.filePath = MetaSynergyStore.logsPath()
-    state.connectionStatus = "connecting"
+    state.ownerRegistry = MetaSynergyOwnerRegistry.hydrate(state.ownerRegistry)
+    if (state.runtimeMode === "standalone") {
+      MetaSynergyOwnerRegistry.releaseLocalOwner(state.ownerRegistry)
+      await MetaSynergyOwnerRegistry.saveFile(state.ownerRegistry)
+    }
+    state.connectionStatus = state.runtimeMode === "managed" ? "disconnected" : "connecting"
     MetaSynergyLog.configure({ printToConsole: state.service.printLogs })
     await MetaSynergyStore.saveState(state)
     await this.control.start()
 
-    const auth = await MetaSynergyStore.loadAuth()
-    if (!auth) {
-      console.log("No Holos credentials found in ~/.meta-synergy. Starting login flow.")
-      await this.login()
-    }
+    this.#startLoops()
+    if (state.runtimeMode === "standalone") {
+      const auth = await MetaSynergyHolosAuth.load()
+      if (!auth) {
+        console.log("No Holos credentials found. Starting login flow.")
+        await this.login()
+      }
 
-    const nextAuth = await MetaSynergyStore.loadAuth()
-    if (!nextAuth) {
-      throw new Error("Meta Synergy could not load credentials after login.")
-    }
+      const nextAuth = await MetaSynergyHolosAuth.load()
+      if (!nextAuth) {
+        throw new Error("Meta Synergy could not load credentials after login.")
+      }
 
-    this.#startLoops()
-    this.#ensureClient(nextAuth)
-    try {
-      await this.#connectClient()
-    } catch (error) {
-      MetaSynergyLog.error("runtime.connection.initial_connect_failed", {
-        error: error instanceof Error ? error.message : String(error),
-      })
+      this.#ensureClient(nextAuth)
+      try {
+        await this.#connectClient()
+      } catch (error) {
+        MetaSynergyLog.error("runtime.connection.initial_connect_failed", {
+          error: error instanceof Error ? error.message : String(error),
+        })
+        await this.#setConnectionStatus("disconnected")
+        this.#scheduleReconnect("initial_connect_failed")
+      }
+
+      console.log(
+        `MetaSynergy running as ${MetaSynergyDisplay.identifier(nextAuth.agentID, { hiddenReason: "policy" })}`,
+      )
+    } else {
+      this.#clearReconnectTimer()
+      this.#client = null
       await this.#setConnectionStatus("disconnected")
-      this.#scheduleReconnect("initial_connect_failed")
+      console.log("MetaSynergy running in managed mode")
     }
 
     state.service.runtimeStatus = "running"
     await MetaSynergyStore.saveState(state)
 
-    console.log(`MetaSynergy running as ${nextAuth.agentID}`)
     console.log(`envID: ${this.host.envID}`)
+    console.log(`Mode: ${state.runtimeMode}`)
     console.log(`Holos: ${this.state?.connectionStatus ?? "disconnected"}`)
     console.log(`Status: ${this.sessions.current() ? "busy" : "idle"}`)
 
@@ -143,12 +183,13 @@ export class MetaSynergyRuntime {
       void this.stopServerProcess({ exit: true })
     })
 
-    await new Promise(() => undefined)
+    await this.#runPromise
   }
 
   async stopServerProcess(input?: { exit?: boolean }) {
     this.#stopping = true
     this.#clearReconnectTimer()
+    await this.#releaseManagedOwner("service_stop")
     this.#stopLoops()
     if (this.state) {
       this.state.connectionStatus = "disconnected"
@@ -163,6 +204,9 @@ export class MetaSynergyRuntime {
     await this.#client?.disconnect().catch(() => undefined)
     this.#client = null
     await this.control.stop()
+    this.#resolveRunPromise?.()
+    this.#resolveRunPromise = null
+    this.#runPromise = null
     if (input?.exit) {
       process.exit(0)
     }
@@ -174,7 +218,9 @@ export class MetaSynergyRuntime {
 
   async logout() {
     await this.stopServerProcess()
-    await MetaSynergyStore.clearAuth()
+    if (requireState(this).runtimeMode !== "managed") {
+      await MetaSynergyHolosAuth.clear()
+    }
   }
 
   async setCollaborationEnabled(enabled: boolean) {
@@ -224,6 +270,16 @@ export class MetaSynergyRuntime {
   }
 
   async reconnect() {
+    const state = requireState(this)
+    if (state.runtimeMode === "managed") {
+      return {
+        requested: false,
+        succeeded: false,
+        reason: "Holos is disabled in managed mode",
+        service: this.getServiceSnapshot(),
+      }
+    }
+
     const succeeded = await this.#reconnectClient()
     if (!succeeded) {
       this.#scheduleReconnect("manual_reconnect_failed")
@@ -244,6 +300,88 @@ export class MetaSynergyRuntime {
     }
   }
 
+  async getMode() {
+    const state = requireState(this)
+    return {
+      mode: state.runtimeMode,
+      ownership: this.getOwnershipSnapshot(),
+      connectionStatus: state.connectionStatus,
+      service: this.getServiceSnapshot(),
+    }
+  }
+
+  async enterManagedMode(input?: { ownerID?: string; leaseExpiresAt?: number }) {
+    const state = requireState(this)
+    state.runtimeMode = "managed"
+    state.ownerRegistry = MetaSynergyOwnerRegistry.hydrate(state.ownerRegistry)
+    MetaSynergyOwnerRegistry.declareLocalOwner(
+      state.ownerRegistry,
+      input?.ownerID ?? state.envID ?? this.host.envID ?? crypto.randomUUID(),
+      { leaseExpiresAt: input?.leaseExpiresAt },
+    )
+    await MetaSynergyOwnerRegistry.saveFile(state.ownerRegistry)
+    this.#clearReconnectTimer()
+    this.#reconnectAttempt = 0
+    await this.#client?.disconnect().catch(() => undefined)
+    this.#client = null
+    await this.#setConnectionStatus("disconnected")
+    await MetaSynergyStore.saveState(state)
+    return {
+      mode: state.runtimeMode,
+      ownership: this.getOwnershipSnapshot(),
+      connectionStatus: state.connectionStatus,
+      service: this.getServiceSnapshot(),
+    }
+  }
+
+  async enterStandaloneMode(input?: { ownerID?: string; reason?: string }) {
+    const state = requireState(this)
+    const previousMode = state.runtimeMode
+    state.runtimeMode = "standalone"
+    state.ownerRegistry = MetaSynergyOwnerRegistry.hydrate(state.ownerRegistry)
+    MetaSynergyOwnerRegistry.releaseLocalOwner(state.ownerRegistry, input?.ownerID)
+    await MetaSynergyOwnerRegistry.saveFile(state.ownerRegistry)
+    this.#clearReconnectTimer()
+    this.#reconnectAttempt = 0
+    if (this.sessions.current()) {
+      this.sessions.kickCurrent(false)
+    }
+    await this.#client?.disconnect().catch(() => undefined)
+    this.#client = null
+    await this.#setConnectionStatus("disconnected")
+    await MetaSynergyStore.saveState(state)
+
+    MetaSynergyLog.info("runtime.mode.changed", {
+      from: previousMode,
+      to: state.runtimeMode,
+      reason: input?.reason,
+    })
+
+    if (state.service.runtimeStatus === "running" && !this.#stopping) {
+      void this.#resumeStandaloneConnection(input?.reason)
+    }
+
+    return {
+      mode: state.runtimeMode,
+      ownership: this.getOwnershipSnapshot(),
+      connectionStatus: state.connectionStatus,
+      service: this.getServiceSnapshot(),
+    }
+  }
+
+  async releaseManagedMode(input?: { ownerID?: string; reason?: string }) {
+    const state = requireState(this)
+    if (state.runtimeMode !== "managed") {
+      return {
+        mode: state.runtimeMode,
+        ownership: this.getOwnershipSnapshot(),
+        connectionStatus: state.connectionStatus,
+        service: this.getServiceSnapshot(),
+      }
+    }
+    return await this.enterStandaloneMode({ ownerID: input?.ownerID, reason: input?.reason ?? "release_requested" })
+  }
+
   async getApproval() {
     const state = requireState(this)
     return { mode: state.approvalMode }
@@ -355,6 +493,11 @@ export class MetaSynergyRuntime {
     }
   }
 
+  getOwnershipSnapshot() {
+    const state = requireState(this)
+    return MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry)
+  }
+
   async getStatusSnapshot() {
     const state = requireState(this)
     return {
@@ -363,6 +506,8 @@ export class MetaSynergyRuntime {
         hostSessionID: state.hostSessionID ?? this.host.hostSessionID,
         label: state.label,
       },
+      runtimeMode: state.runtimeMode,
+      ownership: this.getOwnershipSnapshot(),
       connectionStatus: state.connectionStatus,
       collaborationEnabled: state.collaborationEnabled,
       approvalMode: state.approvalMode,
@@ -375,10 +520,14 @@ export class MetaSynergyRuntime {
   }
 
   async getStatusPayload() {
-    const auth = await MetaSynergyStore.loadAuth()
     const state = requireState(this)
+    const authInfo = await MetaSynergyHolosAuth.inspect()
     return {
-      auth: sanitizeAuth(auth),
+      auth: sanitizeAuth(authInfo.auth, authInfo.source, {
+        hiddenReason: state.runtimeMode === "managed" ? "managed" : null,
+      }),
+      mode: state.runtimeMode,
+      ownership: this.getOwnershipSnapshot(),
       state: sanitizeState(state),
       session: state.currentSession ?? null,
       envID: state.envID ?? null,
@@ -392,7 +541,7 @@ export class MetaSynergyRuntime {
     }
   }
 
-  async handleControlRequest(request: { action: string; [key: string]: unknown }) {
+  async handleControlRequest(request: MetaSynergyControlRequest) {
     switch (request.action) {
       case "ping":
         return null
@@ -405,6 +554,28 @@ export class MetaSynergyRuntime {
         return null
       case "runtime.status":
         return await this.getStatusPayload()
+      case "runtime.mode":
+        return await this.getMode()
+      case "runtime.enter_managed":
+        return await this.enterManagedMode()
+      case "runtime.enter_managed_mode":
+        return await this.enterManagedMode({
+          ownerID: controlOwnerID(request),
+        })
+      case "runtime.set_mode":
+        if (request.mode === "managed") {
+          return await this.enterManagedMode({
+            ownerID: controlOwnerID(request),
+            leaseExpiresAt: controlLeaseExpiresAt(request),
+          })
+        }
+        return await this.enterStandaloneMode({ ownerID: controlOwnerID(request), reason: "control_set_mode" })
+      case "runtime.release_managed":
+        return await this.releaseManagedMode({
+          ownerID: controlOwnerID(request),
+          reason: "control_release_managed",
+        })
+
       case "runtime.reconnect":
         return await this.reconnect()
       case "collaboration.status":
@@ -423,6 +594,11 @@ export class MetaSynergyRuntime {
         return await this.getSessionStatus()
       case "session.kick":
         return await this.kickCurrentSession(Boolean(request.block))
+      case "meta.execute":
+        return await this.inbound.handle({
+          caller: request.caller,
+          body: request.body,
+        })
       case "approval.get":
         return await this.getApproval()
       case "approval.set":
@@ -443,8 +619,10 @@ export class MetaSynergyRuntime {
           since: request.since as string | undefined,
           maxBytes: request.maxBytes as number | undefined,
         })
-      default:
-        throw new Error(`Unsupported control action: ${request.action}`)
+      default: {
+        const unsupported: never = request
+        throw new Error(`Unsupported control action: ${String(unsupported)}`)
+      }
     }
   }
 
@@ -598,7 +776,13 @@ export class MetaSynergyRuntime {
       }
     }, 30_000)
     idleTimer.unref?.()
-    this.#timers = [idleTimer]
+
+    const ownershipTimer = setInterval(() => {
+      void this.#watchManagedOwnership()
+    }, 5_000)
+    ownershipTimer.unref?.()
+
+    this.#timers = [idleTimer, ownershipTimer]
   }
 
   #stopLoops() {
@@ -608,7 +792,11 @@ export class MetaSynergyRuntime {
 
   async #connectClient() {
     if (!this.state) return
-    const auth = await MetaSynergyStore.loadAuth()
+    if (this.state.runtimeMode === "managed") {
+      await this.#setConnectionStatus("disconnected")
+      throw new Error("Holos is disabled in managed mode.")
+    }
+    const auth = await MetaSynergyHolosAuth.load()
     if (!auth) {
       this.state.connectionStatus = "disconnected"
       await MetaSynergyStore.saveState(this.state)
@@ -670,7 +858,7 @@ export class MetaSynergyRuntime {
 
   async #handleClientClosed(input: { intentional: boolean }) {
     await this.#setConnectionStatus("disconnected")
-    if (input.intentional || this.#stopping || this.#manualReconnectInFlight) {
+    if (input.intentional || this.#stopping || this.#manualReconnectInFlight || this.state?.runtimeMode === "managed") {
       return
     }
     this.#scheduleReconnect("socket_closed")
@@ -678,6 +866,7 @@ export class MetaSynergyRuntime {
 
   #scheduleReconnect(reason: string) {
     if (this.#stopping || this.#manualReconnectInFlight || this.#reconnectTimer) return
+    if (!this.state || this.state.runtimeMode === "managed") return
 
     const attempt = this.#reconnectAttempt + 1
     const delayMs = Math.min(60_000, 2_000 * 2 ** (attempt - 1))
@@ -711,12 +900,49 @@ export class MetaSynergyRuntime {
     }
   }
 
+  async #resumeStandaloneConnection(reason?: string) {
+    const state = this.state
+    if (!state || state.runtimeMode !== "standalone" || this.#stopping) return
+    const auth = await MetaSynergyHolosAuth.load()
+    if (!auth) {
+      MetaSynergyLog.warn("runtime.connection.recover_skipped_missing_auth", { reason })
+      return
+    }
+    try {
+      await this.#connectClient()
+    } catch (error) {
+      MetaSynergyLog.error("runtime.connection.recover_failed", {
+        reason,
+        error: error instanceof Error ? error.message : String(error),
+      })
+      this.#scheduleReconnect(reason ?? "standalone_transition_failed")
+    }
+  }
+
   #clearReconnectTimer() {
     if (!this.#reconnectTimer) return
     clearTimeout(this.#reconnectTimer)
     this.#reconnectTimer = null
   }
 
+  async #releaseManagedOwner(reason: string) {
+    if (!this.state || this.state.runtimeMode !== "managed") return
+    this.state.ownerRegistry = MetaSynergyOwnerRegistry.hydrate(this.state.ownerRegistry)
+    MetaSynergyOwnerRegistry.releaseLocalOwner(this.state.ownerRegistry)
+    await MetaSynergyOwnerRegistry.saveFile(this.state.ownerRegistry)
+    await MetaSynergyStore.saveState(this.state)
+    MetaSynergyLog.info("runtime.managed.owner_released", { reason })
+  }
+
+  async #watchManagedOwnership() {
+    if (!this.state || this.#stopping || this.state.runtimeMode !== "managed") return
+    this.state.ownerRegistry = MetaSynergyOwnerRegistry.hydrate(this.state.ownerRegistry)
+    if (MetaSynergyOwnerRegistry.hasActiveLocalOwner(this.state.ownerRegistry)) {
+      return
+    }
+    await this.enterStandaloneMode({ reason: "managed_owner_lost" })
+  }
+
   async #setConnectionStatus(status: "disconnected" | "connecting" | "connected") {
     if (!this.state) return
     this.state.connectionStatus = status
@@ -724,20 +950,44 @@ export class MetaSynergyRuntime {
   }
 }
 
-function sanitizeAuth(auth: { agentID: string; agentSecret: string } | undefined) {
+function controlOwnerID(request: { owner?: unknown; ownerAgentId?: unknown }) {
+  if (typeof request.ownerAgentId === "string" && request.ownerAgentId.length > 0) return request.ownerAgentId
+  if (typeof request.owner === "string" && request.owner.length > 0) return request.owner
+  return undefined
+}
+
+function controlLeaseExpiresAt(request: { leaseExpiresAt?: unknown }) {
+  return typeof request.leaseExpiresAt === "number" && Number.isFinite(request.leaseExpiresAt)
+    ? request.leaseExpiresAt
+    : undefined
+}
+
+function sanitizeAuth(
+  auth: { agentID: string; agentSecret: string } | undefined,
+  source: MetaSynergyHolosAuthSource | null,
+  options?: { hiddenReason?: "managed" | "policy" | null },
+) {
   return auth
     ? {
         loggedIn: true,
-        agentID: auth.agentID,
+        agentID: MetaSynergyDisplay.identifier(auth.agentID, {
+          hiddenReason: options?.hiddenReason,
+        }),
+        source,
+        hiddenReason: options?.hiddenReason ?? null,
       }
     : {
         loggedIn: false,
         agentID: null,
+        source: null,
+        hiddenReason: null,
       }
 }
 
 function sanitizeState(state: MetaSynergyState) {
   return {
+    runtimeMode: state.runtimeMode,
+    ownerRegistry: MetaSynergyOwnerRegistry.snapshot(state.ownerRegistry),
     collaborationEnabled: state.collaborationEnabled,
     approvalMode: state.approvalMode,
     trusted: {