@fungi.computer/truffle 0.1.1 → 0.2.0

package/dist/private-local-acp-stdio.js

@@ -86,12 +86,14 @@ function localDirectory(manager, databasePath, invocationRoot) {
             const selected = await manager.connect({
                 invocationRoot: input.cwd,
                 databasePath,
+                uiAttachmentLifetime: "connection",
             }, { signal: input.signal });
             try {
                 const created = await manager.createSession({
                     invocationRoot: input.cwd,
                     databasePath: selected.databasePath,
                     requestId: createPrivateLocalSessionRequestId(),
+                    uiAttachmentLifetime: "connection",
                 }, { signal: input.signal });
                 return binding(created);
             }
@@ -105,6 +107,7 @@ function localDirectory(manager, databasePath, invocationRoot) {
                 invocationRoot: input.cwd,
                 databasePath,
                 sessionId: input.sessionId,
+                uiAttachmentLifetime: "connection",
             }, { signal: input.signal });
             return binding(connected);
         },

package/dist/private-local-admission-gate.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Admissions of work to one Agent share it as short leases; an archive takes the
+ * Agent exclusively. So an archive sees every command admitted before it, and
+ * work offered after it finds the Agent archived: nothing runs in between.
+ */
+export declare class AdmissionGate {
+    #private;
+    /** Nothing holds or waits for this gate, so it can be forgotten. */
+    get idle(): boolean;
+    /** Hold a shared lease; the returned release may be called more than once. */
+    lease(): Promise<() => void>;
+    /** Run alone: after every held lease is released and before any new one. */
+    exclusive<Value>(run: () => Promise<Value>): Promise<Value>;
+}

package/dist/private-local-admission-gate.js

@@ -0,0 +1,52 @@
+/**
+ * Admissions of work to one Agent share it as short leases; an archive takes the
+ * Agent exclusively. So an archive sees every command admitted before it, and
+ * work offered after it finds the Agent archived: nothing runs in between.
+ */
+export class AdmissionGate {
+    #leases = 0;
+    #exclusive = false;
+    #waiters = [];
+    #changed() {
+        for (const wake of this.#waiters.splice(0))
+            wake();
+    }
+    #change() {
+        return new Promise((resolve) => {
+            this.#waiters.push(resolve);
+        });
+    }
+    /** Nothing holds or waits for this gate, so it can be forgotten. */
+    get idle() {
+        return this.#leases === 0 && !this.#exclusive && this.#waiters.length === 0;
+    }
+    /** Hold a shared lease; the returned release may be called more than once. */
+    async lease() {
+        while (this.#exclusive)
+            await this.#change();
+        this.#leases += 1;
+        let held = true;
+        return () => {
+            if (!held)
+                return;
+            held = false;
+            this.#leases -= 1;
+            this.#changed();
+        };
+    }
+    /** Run alone: after every held lease is released and before any new one. */
+    async exclusive(run) {
+        while (this.#exclusive)
+            await this.#change();
+        this.#exclusive = true;
+        try {
+            while (this.#leases > 0)
+                await this.#change();
+            return await run();
+        }
+        finally {
+            this.#exclusive = false;
+            this.#changed();
+        }
+    }
+}

package/dist/private-local-agent-control.d.ts

@@ -0,0 +1,101 @@
+import { type AgentControlAgent, type AgentControlDirectory } from "@fungi.computer/shiitake/agent-control";
+import { createConversationAgents } from "@fungi.computer/shiitake-extensions/roster/conversation-agents";
+/** One Agent creating an Agent, as the project's Agent directory receives it. */
+export type LocalCreateRequest = Parameters<NonNullable<AgentControlDirectory["create"]>>[0] & Readonly<{
+    /** The Agent creating, resolved by the creator's own host, never by the caller. */
+    createdBy: string;
+}>;
+/**
+ * One ordinary Agent as the project's directory lists it. `unreadable` is
+ * set when this Agent's own store cannot be read (for
+ * example one written before the current schema); only that row is affected.
+ */
+export type LocalAgentControlAgent = AgentControlAgent & Readonly<{
+    unreadable?: string;
+}>;
+/**
+ * Who archives or restores an Agent: an Agent, named by its own host and never
+ * by the caller, or a person at the CLI or TUI. A person may archive any
+ * Agent; an Agent only one it created.
+ */
+export type LocalArchiver = Readonly<{
+    kind: "agent";
+    agentId: string;
+}> | Readonly<{
+    kind: "human";
+}>;
+/** One archive or restore request, as the project's Agent directory receives it. */
+export type LocalArchiveRequest = Readonly<{
+    agentId: string;
+    by: LocalArchiver;
+}>;
+/**
+ * The project's Agent directory a Local host receives. Its create names the
+ * creating Agent, so the directory owner can hold the created Agent to what
+ * the creator holds; its archive names who archives.
+ */
+export type LocalAgentControlDirectory = Omit<AgentControlDirectory, "create" | "list" | "archive" | "unarchive"> & Readonly<{
+    list: (signal: AbortSignal, options?: Readonly<{
+        archived?: boolean;
+    }>) => Promise<readonly LocalAgentControlAgent[]>;
+    create: (input: LocalCreateRequest, signal: AbortSignal) => Promise<AgentControlAgent>;
+    archive: (input: LocalArchiveRequest, signal: AbortSignal) => Promise<void>;
+    unarchive: (input: LocalArchiveRequest, signal: AbortSignal) => Promise<void>;
+}>;
+/**
+ * Ordinary Agent controls bound to this authenticated creating Agent; each
+ * conversation's accepted creates and sends are recorded in this Agent's own
+ * store for its footer.
+ */
+export declare function createPrivateLocalAgentControl(input: Readonly<{
+    agentId: string;
+    directory: LocalAgentControlDirectory;
+    storage: Parameters<typeof createConversationAgents>[0];
+}>): {
+    control: Readonly<{
+        id: string;
+        acquire: (context: import("@fungi.computer/mycelium").CapabilitySourceContext) => Promise<import("@fungi.computer/mycelium").CapabilitySourceAcquisition>;
+    }>;
+    source: Readonly<{
+        read: (sessionId: string, limit: number) => Promise<Readonly<{
+            agents: readonly import("@fungi.computer/shiitake-extensions/subagents/host").SubagentRecord[];
+            more: number;
+        }>>;
+        open: (agentId: string, signal: AbortSignal) => Promise<Readonly<{
+            agent: import("@fungi.computer/shiitake-extensions/subagents/host").SubagentAgent;
+            release: () => Promise<void>;
+        }>>;
+    }>;
+    directory: Readonly<{
+        list: (signal: AbortSignal, options?: Readonly<{
+            archived?: boolean;
+        }>) => Promise<readonly AgentControlAgent[]>;
+        send?: (input: import("@fungi.computer/shiitake/agent-control").AgentDelegationInput, sourceSessionId: string, signal: AbortSignal, invocation?: import("@fungi.computer/shiitake/agent-control").AgentDelegationInvocation) => Promise<import("@fungi.computer/shiitake").Accepted>;
+        recall?: (input: import("@fungi.computer/shiitake/agent-control").AgentRecallInput, sourceSessionId: string, signal: AbortSignal) => Promise<import("@fungi.computer/shiitake").CancelResult>;
+        create?: (input: Readonly<{
+            requestId: string;
+            name?: string;
+            model?: import("@fungi.computer/shiitake").ModelPreference;
+            extensions?: readonly string[];
+        }>, signal: AbortSignal) => Promise<AgentControlAgent>;
+        setModel?: (input: Readonly<{
+            agentId: string;
+            model: import("@fungi.computer/shiitake").ModelPreference;
+        }>, signal: AbortSignal) => Promise<void>;
+        archive?: (input: Readonly<{
+            agentId: string;
+        }>, signal: AbortSignal) => Promise<void>;
+        unarchive?: (input: Readonly<{
+            agentId: string;
+        }>, signal: AbortSignal) => Promise<void>;
+        models?: (signal: AbortSignal) => Promise<readonly import("@fungi.computer/shiitake/agent-control").AgentControlModel[]>;
+        checkModel?: (input: Readonly<{
+            agentId: string;
+            sessionId: string;
+        }>, signal: AbortSignal) => Promise<void>;
+        open: (agentId: string, signal: AbortSignal) => Promise<Readonly<{
+            agent: import("@fungi.computer/shiitake").ShiitakeAgent;
+            release: () => Promise<void>;
+        }>>;
+    }>;
+};

package/dist/private-local-agent-control.js

@@ -0,0 +1,30 @@
+import { AgentCreateRefused, } from "@fungi.computer/shiitake/agent-control";
+import { createConversationAgents } from "@fungi.computer/shiitake-extensions/roster/conversation-agents";
+/**
+ * Ordinary Agent controls bound to this authenticated creating Agent; each
+ * conversation's accepted creates and sends are recorded in this Agent's own
+ * store for its footer.
+ */
+export function createPrivateLocalAgentControl(input) {
+    const conversations = createConversationAgents(input.storage);
+    function bound(parentSessionId) {
+        const { create, archive, unarchive } = input.directory;
+        const by = { kind: "agent", agentId: input.agentId };
+        return {
+            ...input.directory,
+            archive: ({ agentId }, signal) => archive({ agentId, by }, signal),
+            unarchive: ({ agentId }, signal) => unarchive({ agentId, by }, signal),
+            create: async (request, signal) => {
+                if (parentSessionId === undefined)
+                    throw new AgentCreateRefused("no_creator", "creation requires an invoking Session");
+                return create({ ...request, createdBy: input.agentId }, signal);
+            },
+        };
+    }
+    const control = conversations.control(bound);
+    return {
+        control,
+        source: conversations.source(input.directory),
+        directory: conversations.recording(undefined, bound(undefined)),
+    };
+}

package/dist/private-local-agent-default-model.d.ts

@@ -0,0 +1,12 @@
+import type { PrivateSqliteDatabase } from "./private-sqlite-owner.js";
+import { type ModelPreference } from "@fungi.computer/shiitake/model-preference";
+/** Create the Agent default's table in a store this host owns. */
+export declare function ensureAgentDefaultModelTable(database: PrivateSqliteDatabase): void;
+/** Keep an Agent's first default; later changes go through the writer. */
+export declare function seedAgentDefaultModel(database: PrivateSqliteDatabase, model: ModelPreference | null): void;
+/** The stored default as written (JSON text); undefined when the row is missing. */
+export declare function readAgentDefaultModelJson(database: PrivateSqliteDatabase): string | undefined;
+/** Read the Agent default a store holds; null when none is set. */
+export declare function readAgentDefaultModel(database: PrivateSqliteDatabase): ModelPreference | null;
+/** Replace the Agent default, thinking level included. */
+export declare function writeAgentDefaultModel(database: PrivateSqliteDatabase, model: ModelPreference): void;

package/dist/private-local-agent-default-model.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+import { parseModelPreferenceJson, } from "@fungi.computer/shiitake/model-preference";
+/** The one module that owns the Agent default's table SQL. */
+const settingsTable = "private_local_model_settings";
+const storedModelSchema = z.string().optional();
+/** Create the Agent default's table in a store this host owns. */
+export function ensureAgentDefaultModelTable(database) {
+    database.exec(`CREATE TABLE IF NOT EXISTS ${settingsTable} (singleton INTEGER PRIMARY KEY CHECK(singleton = 1), model TEXT NOT NULL) STRICT`);
+}
+/** Keep an Agent's first default; later changes go through the writer. */
+export function seedAgentDefaultModel(database, model) {
+    database
+        .prepare(`INSERT OR IGNORE INTO ${settingsTable} VALUES (1, ?)`)
+        .run(JSON.stringify(model));
+}
+/** The stored default as written (JSON text); undefined when the row is missing. */
+export function readAgentDefaultModelJson(database) {
+    return storedModelSchema.parse(database
+        .prepare(`SELECT model FROM ${settingsTable} WHERE singleton = 1`)
+        .get()?.model);
+}
+/** Read the Agent default a store holds; null when none is set. */
+export function readAgentDefaultModel(database) {
+    return parseModelPreferenceJson(readAgentDefaultModelJson(database));
+}
+/** Replace the Agent default, thinking level included. */
+export function writeAgentDefaultModel(database, model) {
+    database
+        .prepare(`UPDATE ${settingsTable} SET model = ? WHERE singleton = 1`)
+        .run(JSON.stringify(model));
+}

package/dist/private-local-auth-rpc.d.ts

@@ -1,6 +1,7 @@
 import type { AuthInteraction, AuthEvent } from "@earendil-works/pi-ai";
 import { RpcTarget, type RpcStub } from "@fungi.computer/capnweb";
 import { z } from "zod";
+import { type FungiAccountLogoutRequest, type FungiAccountLogoutResult } from "./private-fungi-service-logout.js";
 import { runLocalAuthCli, type LocalAuthResult } from "./auth-cli.js";
 declare const requestSchema: z.ZodObject<{
     command: z.ZodEnum<{
@@ -10,8 +11,8 @@ declare const requestSchema: z.ZodObject<{
     }>;
     provider: z.ZodOptional<z.ZodString>;
     authType: z.ZodOptional<z.ZodEnum<{
-        api_key: "api_key";
         oauth: "oauth";
+        api_key: "api_key";
     }>>;
     method: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -38,6 +39,58 @@ declare const promptSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>], "type">;
 export type AuthPromptRequest = z.infer<typeof promptSchema>;
+/** What one auth RPC operation returns: a result or a typed failure. */
+export type LocalAuthWireResult = z.output<typeof wireResultSchema>;
+declare const wireResultSchema: z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"completed">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"status">;
+    providers: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        providerId: z.ZodString;
+        providerName: z.ZodString;
+        state: z.ZodLiteral<"unconfigured">;
+    }, z.core.$strip>, z.ZodObject<{
+        providerId: z.ZodString;
+        providerName: z.ZodString;
+        state: z.ZodLiteral<"configured">;
+        type: z.ZodEnum<{
+            oauth: "oauth";
+            api_key: "api_key";
+        }>;
+    }, z.core.$strip>], "state">>;
+}, z.core.$strip>], "kind">, z.ZodObject<{
+    kind: z.ZodLiteral<"failed">;
+    failure: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        category: z.ZodLiteral<"identity-unavailable">;
+        detail: z.ZodOptional<z.ZodObject<{
+            claim: z.ZodEnum<{
+                access_token: "access_token";
+                "access_token.iss": "access_token.iss";
+                "access_token.sub": "access_token.sub";
+            }>;
+            problem: z.ZodEnum<{
+                absent: "absent";
+                malformed: "malformed";
+                invalid: "invalid";
+            }>;
+            claimNames: z.ZodArray<z.ZodString>;
+            authClaimNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"callback-port-in-use">;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"oauth-state-mismatch">;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"token-exchange-rejected">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"cancelled">;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"no-key-entered">;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"unknown">;
+    }, z.core.$strict>], "category">;
+}, z.core.$strict>]>;
 declare class AuthPromptTarget extends RpcTarget {
     #private;
     constructor(prompt: AuthPromptRequest, interaction: AuthInteraction);
@@ -54,16 +107,23 @@ declare class AuthPresenterTarget extends RpcTarget {
 /** The auth-only RPC door shared by its producer and remote client. */
 export type PrivateLocalAuthEndpoint = RpcTarget & {
     cancel(): void;
-    run(input: PrivateLocalAuthRequest, presenter: RpcStub<AuthPresenterTarget>): Promise<LocalAuthResult>;
+    signOutFungi(input: FungiAccountLogoutRequest): Promise<FungiAccountLogoutResult>;
+    run(input: PrivateLocalAuthRequest, presenter: RpcStub<AuthPresenterTarget>): Promise<LocalAuthWireResult>;
 };
-/** One transient connection runs one operation through the existing Pi owner. */
+/** One transient connection runs one provider or Fungi-account operation. */
 export declare class PrivateLocalAuthTarget extends RpcTarget implements PrivateLocalAuthEndpoint {
     #private;
-    constructor(run?: typeof runLocalAuthCli);
+    constructor(run: typeof runLocalAuthCli, signOutAccount: (input: FungiAccountLogoutRequest) => Promise<FungiAccountLogoutResult>);
+    signOutFungi(input: FungiAccountLogoutRequest): Promise<FungiAccountLogoutResult>;
     cancel(): void;
     [Symbol.dispose](): void;
-    run(input: PrivateLocalAuthRequest, presenter: RpcStub<AuthPresenterTarget>): Promise<LocalAuthResult>;
+    run(input: PrivateLocalAuthRequest, presenter: RpcStub<AuthPresenterTarget>): Promise<LocalAuthWireResult>;
 }
-/** Takes ownership of a dedicated auth RPC connection, never the Session client. */
-export declare function runPrivateLocalAuthRemote(remote: RpcStub<PrivateLocalAuthEndpoint>, request: PrivateLocalAuthRequest, interaction: AuthInteraction): Promise<LocalAuthResult>;
+/**
+ * Takes ownership of a dedicated auth RPC connection, never the Session client.
+ * A cancel the caller asked for is awaited before the connection is released,
+ * so an ordinary cancel is never cut off by its own teardown; a cancel that
+ * genuinely fails is handed to `reportCleanupFailure` with its cause.
+ */
+export declare function runPrivateLocalAuthRemote(remote: RpcStub<PrivateLocalAuthEndpoint>, request: PrivateLocalAuthRequest, interaction: AuthInteraction, reportCleanupFailure: (cause: unknown) => void): Promise<LocalAuthResult>;
 export type { AuthPresenterTarget, AuthPromptTarget };

package/dist/private-local-auth-rpc.js

@@ -1,6 +1,10 @@
 import { RpcTarget } from "@fungi.computer/capnweb";
 import { z } from "zod";
-import { localAuthInputLimit, runLocalAuthCli, } from "./auth-cli.js";
+import { fungiAccountLogoutRequestSchema, fungiAccountLogoutResultSchema, } from "./private-fungi-service-logout.js";
+import { LocalAuthRefusal, localAuthInputLimit, runLocalAuthCli, } from "./auth-cli.js";
+import { openAIIdentityDetailSchema } from "./private-openai-claims.js";
+import { CredentialActivationError } from "./subscription-activation.js";
+import { OpenAIIdentityUnavailable } from "./subscription-identity.js";
 const requestSchema = z.object({
     command: z.enum(["login", "logout", "status"]),
     provider: z.string().optional(),
@@ -76,6 +80,103 @@ const eventSchema = z.discriminatedUnion("type", [
     }),
 ]);
 const answerSchema = z.string().max(localAuthInputLimit);
+/**
+ * The closed set of failures that cross the service. Provider errors can
+ * contain credential material, so no free text, cause or provider message
+ * crosses: only a fixed category, HTTP status, or missing-person claim NAMES.
+ */
+const localAuthFailureSchema = z.discriminatedUnion("category", [
+    z.strictObject({
+        category: z.literal("identity-unavailable"),
+        detail: openAIIdentityDetailSchema.optional(),
+    }),
+    z.strictObject({ category: z.literal("callback-port-in-use") }),
+    z.strictObject({ category: z.literal("oauth-state-mismatch") }),
+    z.strictObject({
+        category: z.literal("token-exchange-rejected"),
+        status: z.number().int().min(100).max(599),
+    }),
+    z.strictObject({ category: z.literal("cancelled") }),
+    z.strictObject({ category: z.literal("no-key-entered") }),
+    z.strictObject({ category: z.literal("unknown") }),
+]);
+const wireResultSchema = z.union([
+    authResultSchema,
+    z.strictObject({
+        kind: z.literal("failed"),
+        failure: localAuthFailureSchema,
+    }),
+]);
+/** Pi 1.3.0's fixed error prefixes; never retain a provider body suffix. */
+const callbackPortInUse = /^Port \d+ is in use\b/u;
+const oauthStateMismatch = "OAuth state mismatch";
+const openAITokenRequestFailed = /^OpenAI OAuth token request failed \(([1-5]\d{2})\)/u;
+function classifyFailure(cause, aborted) {
+    if (aborted)
+        return { category: "cancelled" };
+    if (cause instanceof LocalAuthRefusal)
+        return { category: "no-key-entered" };
+    if (cause instanceof OpenAIIdentityUnavailable)
+        return { category: "identity-unavailable", detail: cause.detail };
+    if (cause instanceof CredentialActivationError &&
+        cause.category === "identity-unavailable")
+        return { category: "identity-unavailable" };
+    if (cause instanceof Error) {
+        const tokenRequest = openAITokenRequestFailed.exec(cause.message);
+        if (tokenRequest !== null)
+            return {
+                category: "token-exchange-rejected",
+                status: Number(tokenRequest[1]),
+            };
+    }
+    if (cause instanceof Error && callbackPortInUse.test(cause.message))
+        return { category: "callback-port-in-use" };
+    if (cause instanceof Error && cause.message === oauthStateMismatch)
+        return { category: "oauth-state-mismatch" };
+    return { category: "unknown" };
+}
+/** Fixed wording per category; the dialog shows exactly this. */
+function failureText(failure) {
+    switch (failure.category) {
+        case "identity-unavailable": {
+            const detail = failure.detail;
+            if (detail === undefined)
+                return "Sign-in could not establish the account identity (identity-unavailable). Nothing was saved.";
+            const auth = detail.authClaimNames === undefined
+                ? ""
+                : "; auth claims: " + (detail.authClaimNames.join(", ") || "none");
+            return ("OpenAI sign-in did not identify the person (identity-unavailable: " +
+                detail.claim +
+                " " +
+                detail.problem +
+                "; claims: " +
+                (detail.claimNames.join(", ") || "none") +
+                auth +
+                "). Nothing was saved.");
+        }
+        case "callback-port-in-use":
+            return "The sign-in callback port is in use, probably by another sign-in or the Codex CLI. Close it and try again.";
+        case "oauth-state-mismatch":
+            return "The sign-in redirect did not belong to this attempt. Start the sign-in again.";
+        case "token-exchange-rejected":
+            return `OpenAI refused the sign-in token exchange (HTTP ${String(failure.status)}).`;
+        case "cancelled":
+            return "Authentication cancelled";
+        case "no-key-entered":
+            return new LocalAuthRefusal().message;
+        case "unknown":
+            return "Local authentication failed";
+    }
+}
+/** The client-side error for one typed failure; its message is fixed text. */
+class LocalAuthFailure extends Error {
+    failure;
+    constructor(failure) {
+        super(failureText(failure));
+        this.failure = failure;
+        this.name = "LocalAuthFailure";
+    }
+}
 class AuthPromptTarget extends RpcTarget {
     #controller = new AbortController();
     #result;
@@ -167,14 +268,22 @@ class AuthPresenterTarget extends RpcTarget {
         this.#interaction.notify(decoded);
     }
 }
-/** One transient connection runs one operation through the existing Pi owner. */
+/** One transient connection runs one provider or Fungi-account operation. */
 export class PrivateLocalAuthTarget extends RpcTarget {
     #controller = new AbortController();
     #used = false;
     #run;
-    constructor(run = runLocalAuthCli) {
+    #signOutAccount;
+    constructor(run, signOutAccount) {
         super();
         this.#run = run;
+        this.#signOutAccount = signOutAccount;
+    }
+    async signOutFungi(input) {
+        if (this.#used)
+            throw new Error("Authentication connection already used");
+        this.#used = true;
+        return fungiAccountLogoutResultSchema.parse(await this.#signOutAccount(fungiAccountLogoutRequestSchema.parse(input)));
     }
     cancel() {
         this.#controller.abort();
@@ -235,39 +344,53 @@ export class PrivateLocalAuthTarget extends RpcTarget {
             });
             return authResultSchema.parse(result);
         }
-        catch {
-            // Provider errors can contain credential material; do not serialize them.
-            throw new Error(signal.aborted
-                ? "Authentication cancelled"
-                : "Local authentication failed");
+        catch (cause) {
+            return {
+                kind: "failed",
+                failure: classifyFailure(cause, signal.aborted),
+            };
         }
         finally {
             this.cancel();
         }
     }
 }
-/** Takes ownership of a dedicated auth RPC connection, never the Session client. */
-export async function runPrivateLocalAuthRemote(remote, request, interaction) {
+/**
+ * Takes ownership of a dedicated auth RPC connection, never the Session client.
+ * A cancel the caller asked for is awaited before the connection is released,
+ * so an ordinary cancel is never cut off by its own teardown; a cancel that
+ * genuinely fails is handed to `reportCleanupFailure` with its cause.
+ */
+export async function runPrivateLocalAuthRemote(remote, request, interaction, reportCleanupFailure) {
     const controller = new AbortController();
     const signal = interaction.signal === undefined
         ? controller.signal
         : AbortSignal.any([controller.signal, interaction.signal]);
     const presenter = new AuthPresenterTarget({ ...interaction, signal });
+    let cancellation;
     const cancel = () => {
-        void remote.cancel().catch((cause) => {
-            console.warn("Local authentication cancellation failed", cause instanceof Error ? cause.name : "NonError");
-            remote[Symbol.dispose]();
-        });
+        cancellation = (async () => {
+            await remote.cancel();
+        })();
     };
     signal.addEventListener("abort", cancel, { once: true });
     try {
         signal.throwIfAborted();
-        const result = await remote.run(request, presenter);
-        return authResultSchema.parse(result);
+        const result = wireResultSchema.parse(await remote.run(request, presenter));
+        if (result.kind === "failed")
+            throw new LocalAuthFailure(result.failure);
+        return result;
     }
     finally {
         signal.removeEventListener("abort", cancel);
         controller.abort();
-        remote[Symbol.dispose]();
+        try {
+            const [cancelled] = await Promise.allSettled([cancellation]);
+            if (cancelled.status === "rejected")
+                reportCleanupFailure(cancelled.reason);
+        }
+        finally {
+            remote[Symbol.dispose]();
+        }
     }
 }

package/dist/private-local-bwrap.d.ts

@@ -0,0 +1,13 @@
+export declare class LocalBwrapUnavailable extends Error {
+    readonly reason: "missing" | "invalid-digest" | "digest-mismatch" | "not-executable";
+    readonly name = "LocalBwrapUnavailable";
+    constructor(reason: "missing" | "invalid-digest" | "digest-mismatch" | "not-executable", message: string, options?: ErrorOptions);
+}
+export type LinuxSandboxPayload = {
+    readonly executable: string;
+    readonly seccompFilter: Uint8Array;
+};
+/** Check both packaged artifacts on every use; never cache verification. */
+export declare function verifyLocalLinuxSandboxPayload(executable: string): LinuxSandboxPayload;
+/** Same optional native-package lookup as apply_patch, with no PATH fallback. */
+export declare function localLinuxSandboxPayload(): LinuxSandboxPayload;