@fungi.computer/truffle 0.2.1 → 0.3.0

package/dist/private-local-service-listener.js

@@ -6,6 +6,10 @@ import { createServiceLogLifecycle, } from "./private-local-service-log.js";
 import { stopAllRequestSchema } from "./private-local-stop-all.js";
 import { FungiMcpSelectionConflict } from "./private-fungi-mcp-selection.js";
 import { LocalSandboxUnavailable } from "./private-local-containment.js";
+import { createNativePayloadStaging, } from "./private-local-native-staging.js";
+import { nativePackageStartupError } from "./private-local-native-install-error.js";
+import { LocalBwrapUnavailable } from "./private-local-bwrap.js";
+import { writeFileSync } from "node:fs";
 import { PrivateLocalAuthTarget } from "./private-local-auth-rpc.js";
 import { runLocalAuthCli } from "./auth-cli.js";
 import { capturePrivateLocalConfigRoot, } from "./private-local-config-root.js";
@@ -88,7 +92,12 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
             heap: jsc.heapStats(),
         }),
     });
-    const owners = createLocalServiceOwners(openRuntime, directory, undefined, idleSweepMs, readRecoveryManifest, diagnostics.recoveryDisabled, root);
+    let native;
+    const owners = createLocalServiceOwners(openRuntime, directory, undefined, idleSweepMs, readRecoveryManifest, diagnostics.recoveryDisabled, root, undefined, diagnostics.ruleMatch, () => {
+        if (native === undefined)
+            throw new Error("Local service native staging is not ready");
+        return native;
+    });
     const prefix = `/service/${serviceId}`;
     const releaseAccountOwner = registerFungiAccountOwner(root.credentialPath, () => owners.refreshMesh());
     const app = new Hono();
@@ -182,7 +191,11 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
         };
     };
     const shutdown = createPrivateLocalServiceShutdown({
-        closeOwners: owners.close,
+        closeOwners: async () => {
+            await owners.close();
+            // No Agent, including one reopened during recovery, still uses the copy.
+            native?.close();
+        },
         closeServer: async () => {
             await server?.close();
         },
@@ -233,6 +246,31 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
     const isLocalRequest = (request) => !request.headers.has("origin") &&
         new URL(request.url).hostname === "127.0.0.1";
     try {
+        // Verify and stage before publishing discovery, even without a selected Agent.
+        try {
+            native = createNativePayloadStaging(directory);
+        }
+        catch (cause) {
+            if (cause instanceof LocalBwrapUnavailable) {
+                // A detached child has no stderr. Only this classified startup refusal
+                // crosses to the starting client; never export arbitrary exception text.
+                const marker = process.env.FUNGI_NATIVE_STARTUP_REFUSAL;
+                if (marker !== undefined) {
+                    try {
+                        writeFileSync(marker, "native-package", {
+                            flag: "wx",
+                            mode: 0o600,
+                        });
+                    }
+                    catch (reportFailure) {
+                        // A broken report channel cannot replace the native refusal.
+                        logEvent("service-listener.native-refusal-report", reportFailure);
+                    }
+                }
+                throw nativePackageStartupError(cause);
+            }
+            throw cause;
+        }
         app.use("*", async (context, next) => {
             const request = context.req.raw;
             // Local client only: no browser-origin admission or DNS rebinding authority.

package/dist/private-local-service-log.d.ts

@@ -50,6 +50,11 @@ export type ServiceLogEvent = Readonly<{
 }> | Readonly<{
     event: "recovery-persistence-disabled";
     code: RecoveryPersistenceFailureCode;
+}> | Readonly<{
+    event: "exec-rule-match";
+    agentId: string;
+    executable: string;
+    ruleId: string;
 }> | Readonly<{
     event: "memory";
     rss: number;
@@ -80,6 +85,9 @@ export type ServiceLogLifecycle = Readonly<{
     ready: (serviceId: string) => void;
     stopping: (reason: ServiceLogShutdownReason) => void;
     failure: (failure: FailureMetadata) => void;
+    ruleMatch: (match: Omit<Extract<ServiceLogEvent, {
+        event: "exec-rule-match";
+    }>, "event">) => void;
     recoveryDisabled: (code: RecoveryPersistenceFailureCode) => void;
     /** Synchronous, so it lands before the bounded drain exits the process. */
     drainTimeout: (drain: Readonly<{

package/dist/private-local-service-log.js

@@ -287,6 +287,9 @@ export function createServiceLogLifecycle(input) {
         failure(failure) {
             emit({ event: "failure", failure });
         },
+        ruleMatch(match) {
+            emit({ event: "exec-rule-match", ...match });
+        },
         recoveryDisabled(code) {
             if (closed || recovery !== undefined)
                 return;

package/dist/private-local-service-owner.d.ts

@@ -6,7 +6,8 @@ import { type LocalExtensions } from "./local-extensions.js";
 import type { PrivateLocalServiceSelection, PrivateLocalSessionCreation } from "./private-local-service-contract.js";
 import { openPrivateLocalRuntimeHost, type PrivateLocalRuntimeHost } from "./private-local-runtime-host.js";
 import type { LocalUiAttachment } from "./private-local-ui-attachment.js";
-export type LocalServiceRuntime = Pick<PrivateLocalRuntimeHost, "databasePath" | "agentId" | "name" | "getSession" | "effectiveModel" | "setModel" | "setArchived" | "setRequireSandbox" | "sandboxStatus" | "pendingDelegation" | "assertModelReady" | "listSessions" | "createSession" | "deleteSession" | "extensions" | "prepareReload" | "bindSessionPath" | "acceptMail" | "readSettlement" | "idle" | "close">;
+import { createLocalMeshLinks } from "./private-local-mesh-links.js";
+export type LocalServiceRuntime = Pick<PrivateLocalRuntimeHost, "databasePath" | "agentId" | "name" | "getSession" | "effectiveModel" | "setModel" | "setArchived" | "setMode" | "sandboxStatus" | "pendingDelegation" | "assertModelReady" | "listSessions" | "createSession" | "deleteSession" | "extensions" | "prepareReload" | "bindSessionPath" | "acceptMail" | "readSettlement" | "idle" | "close">;
 export declare class LocalSessionPathConflict extends Error {
     readonly name = "LocalSessionPathConflict";
     constructor();
@@ -35,7 +36,9 @@ idleSweepMs?: number,
 /** Read the recovery manifest; tests can hold this I/O independently of opens. */
 readRecoveryManifest?: (path: string) => Promise<string>, 
 /** Report only the classification, never the manifest or exception text. */
-onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: PrivateLocalConfigRoot): {
+onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: PrivateLocalConfigRoot, meshLinksFactory?: typeof createLocalMeshLinks, onExecRuleMatch?: NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["onExecRuleMatch"]>, 
+/** Supplied by the listener after startup; individual Agents never close it. */
+serviceNative?: () => NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["native"]>): {
     refreshMesh: () => Promise<void>;
     createSession: (creation: PrivateLocalSessionCreation) => Promise<{
         agentId: string;
@@ -59,6 +62,10 @@ onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: Priva
                 set: (preference: import("@fungi.computer/shiitake").ModelPreference | null) => Promise<void>;
             }>;
             read: (input?: import("@fungi.computer/shiitake").ReadOptions) => Promise<import("@fungi.computer/shiitake").SessionSnapshot>;
+            readSettlement: (commandId: string, options?: Readonly<{
+                timeoutMs?: number;
+                signal?: AbortSignal;
+            }>) => Promise<import("@fungi.computer/shiitake").CommandSettlement | undefined>;
             subscribe: (input: import("@fungi.computer/shiitake").SubscribeOptions) => AsyncIterable<import("@fungi.computer/shiitake").SessionFrame>;
             watch: (input?: import("@fungi.computer/shiitake").WatchOptions) => Promise<import("@fungi.computer/shiitake").SessionWatch>;
         }>;
@@ -87,6 +94,10 @@ onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: Priva
                 set: (preference: import("@fungi.computer/shiitake").ModelPreference | null) => Promise<void>;
             }>;
             read: (input?: import("@fungi.computer/shiitake").ReadOptions) => Promise<import("@fungi.computer/shiitake").SessionSnapshot>;
+            readSettlement: (commandId: string, options?: Readonly<{
+                timeoutMs?: number;
+                signal?: AbortSignal;
+            }>) => Promise<import("@fungi.computer/shiitake").CommandSettlement | undefined>;
             subscribe: (input: import("@fungi.computer/shiitake").SubscribeOptions) => AsyncIterable<import("@fungi.computer/shiitake").SessionFrame>;
             watch: (input?: import("@fungi.computer/shiitake").WatchOptions) => Promise<import("@fungi.computer/shiitake").SessionWatch>;
         }>;
@@ -108,15 +119,12 @@ onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: Priva
         reasoning?: "minimal" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
     }>;
     sandboxStatus: (selection: Pick<PrivateLocalServiceSelection, "invocationRoot" | "databasePath" | "fungiMcp">, signal: AbortSignal) => Promise<{
-        state: "available";
-        requireSandbox: boolean;
-    } | {
-        state: "unavailable";
-        requireSandbox: boolean;
-        reason: {
-            kind: "missing" | "invalid-digest" | "digest-mismatch" | "not-executable" | "unsupported-platform" | "invalid-folder" | "backend-refused";
+        mode: "read-only" | "workspace" | "full-access";
+        available: boolean;
+        reason?: {
+            kind: "install" | "unsupported" | "folder" | "startup-refused";
             message: string;
-        };
+        } | undefined;
     }>;
     sweepIdle: () => Promise<void>;
     archive: (request: Readonly<{

package/dist/private-local-service-owner.js

@@ -1,5 +1,7 @@
 import * as Effect from "effect/Effect";
+import { parseDelegationReceipt } from "@fungi.computer/shiitake/client";
 import { logEvent } from "./log-event.js";
+import { modeWithinCeiling } from "./private-local-permission-mode.js";
 import { createPrivateModels } from "./local-models.js";
 import { capturePrivateLocalConfigRoot, } from "./private-local-config-root.js";
 import { AdmissionGate } from "./private-local-admission-gate.js";
@@ -19,7 +21,6 @@ import { createPrivateLocalSessionRequestId, openPrivateLocalRuntimeHost, resolv
 import { parsePrivateLocalExecPath } from "./private-local-exec-path.js";
 import { createLocalMeshLinks, localMeshLinkKey, } from "./private-local-mesh-links.js";
 import { agentMailAddressSchema, machineAgentRequestSchema, machineDirectorySchema, } from "@fungi.computer/seam/machine-link-protocol";
-import { parseAccepted } from "@fungi.computer/shiitake/client";
 import { commandSettlementSchema } from "@fungi.computer/shiitake/fleet";
 import { BirdDogMailSchema } from "@fungi.computer/bird-dog/effect";
 export class LocalSessionPathConflict extends Error {
@@ -44,7 +45,10 @@ export class LocalAgentSelectionAmbiguous extends Error {
 // Reopen inputs only. Credentials remain with Local's account custodian.
 const recoveryOwnerSchema = selectionSchema
     .omit({ clientPath: true, sessionId: true, uiAttachmentLifetime: true })
-    .extend({ databasePath: z.string().min(1) });
+    .extend({
+    databasePath: z.string().min(1),
+    wakeAt: z.number().optional(),
+});
 const decodeRecoveryFile = Schema.decodeUnknownResult(Schema.fromJsonString(Schema.Array(Schema.Unknown)));
 class LocalRecoveryPersistenceDisabled extends Error {
     reason;
@@ -65,12 +69,40 @@ idleSweepMs = 60_000,
 /** Read the recovery manifest; tests can hold this I/O independently of opens. */
 readRecoveryManifest = (path) => readFile(path, "utf8"), 
 /** Report only the classification, never the manifest or exception text. */
-onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot()) {
+onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot(), meshLinksFactory = createLocalMeshLinks, onExecRuleMatch = () => undefined, 
+/** Supplied by the listener after startup; individual Agents never close it. */
+serviceNative) {
     const extensions = suppliedExtensions ?? localExtensions({ home: configRoot.home });
     const recoveryPath = recoveryDirectory === undefined
         ? undefined
         : resolve(recoveryDirectory, "owners.json");
     const recovery = new Map();
+    const wakes = new Map();
+    let wakeTimer;
+    function scheduleWakes() {
+        if (wakeTimer !== undefined)
+            clearTimeout(wakeTimer);
+        wakeTimer = undefined;
+        if (stopping || wakes.size === 0)
+            return;
+        let earliest = Infinity;
+        for (const entry of wakes.values())
+            earliest = Math.min(earliest, entry.wakeAt ?? Infinity);
+        wakeTimer = setTimeout(() => {
+            wakeTimer = undefined;
+            if (stopping)
+                return;
+            const due = [...wakes.values()].filter((entry) => entry.wakeAt !== undefined && entry.wakeAt <= Date.now());
+            for (const entry of due) {
+                wakes.delete(entry.databasePath);
+                void ownerFor(entry).catch((cause) => {
+                    logEvent("service-owner.wake", cause);
+                });
+            }
+            scheduleWakes();
+        }, Math.min(2_147_483_647, Math.max(0, earliest - Date.now())));
+        wakeTimer.unref();
+    }
     let loadingRecovery;
     let saving = Promise.resolve();
     const emptySessions = new Map();
@@ -87,7 +119,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         }
         return undefined;
     }
-    const mesh = createLocalMeshLinks({
+    const mesh = meshLinksFactory({
         credentialPath: configRoot.credentialPath,
         receive: async (record, envelope) => {
             if (envelope.kind === "machineDirectory") {
@@ -142,13 +174,18 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 })(envelope.event);
                 if (envelope.kind !== "agentMail" ||
                     envelope.key !== mail.key ||
-                    mail.to.agentId !== address.agentId ||
-                    new TextEncoder().encode(JSON.stringify(mail)).byteLength > 256 * 1024)
+                    mail.to.agentId !== address.agentId)
                     return "refused";
-                // Only select the physical store here. Never rewrite frozen addresses
-                // or bypass that runtime's own recipient/sender admission.
-                const receipt = await admitted(owner, () => owner.acceptMail(mail));
-                return { status: "accepted", receipt };
+                if (mail.from.sessionId === undefined &&
+                    !(mail.replyTo.length === 0 && mail.reply?.outcome === "undeliverable"))
+                    return "refused";
+                const sessionlessAcceptance = mail.to.sessionId === undefined;
+                // Only select the physical store here. Never bypass that runtime's
+                // recipient/sender admission; request keys make acceptance replay-safe.
+                const command = await admitted(owner, () => owner.acceptMail(mail));
+                if (sessionlessAcceptance && command.sessionId === undefined)
+                    throw new Error("Sessionless mail acceptance returned no Session");
+                return { status: "accepted", receipt: command };
             }
             finally {
                 release();
@@ -295,6 +332,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         });
         pending = pending.then(async (owner) => {
             roots.set(owner.runtime.databasePath, invocationRoot);
+            if (wakes.delete(owner.runtime.databasePath))
+                scheduleWakes();
             if (recoveryPath !== undefined) {
                 const reference = {
                     invocationRoot,
@@ -523,9 +562,12 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 }
                 let runtime;
                 let idle;
+                let wakeAt;
                 try {
                     ({ runtime } = await pending);
-                    idle = await runtime.idle();
+                    const state = await runtime.idle();
+                    idle = state.idle;
+                    wakeAt = state.wakeAt;
                 }
                 catch (cause) {
                     // One unreadable Agent stays open; the sweep still checks the rest.
@@ -542,7 +584,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                     idleCandidates.add(databasePath);
                     continue;
                 }
-                closed.push(releaseStore(databasePath, pending, runtime));
+                closed.push(releaseStore(databasePath, pending, runtime, wakeAt));
             }
             await Promise.all(closed);
         })().finally(() => {
@@ -550,7 +592,18 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         });
         return sweeping;
     }
-    function releaseStore(databasePath, pending, runtime) {
+    /** Forget empty Agents; retain a future wake for the next service owner. */
+    function rememberIdleWake(databasePath, wakeAt) {
+        const reference = recovery.get(databasePath);
+        if (wakeAt === null || reference === undefined) {
+            recovery.delete(databasePath);
+            return undefined;
+        }
+        const scheduled = { ...reference, wakeAt };
+        recovery.set(databasePath, scheduled);
+        return scheduled;
+    }
+    function releaseStore(databasePath, pending, runtime, wakeAt) {
         idleCandidates.delete(databasePath);
         released.add(runtime);
         for (const [key, value] of owners)
@@ -558,7 +611,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 owners.delete(key);
         emptySessions.delete(databasePath);
         roots.delete(databasePath);
-        recovery.delete(databasePath);
+        const scheduled = rememberIdleWake(databasePath, wakeAt);
         const opened = openedByStore.get(databasePath);
         openedByStore.delete(databasePath);
         if (opened !== undefined)
@@ -570,6 +623,10 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
             catch (cause) {
                 logEvent("service-owner.release-runtime", cause);
             }
+            if (scheduled !== undefined && !stopping) {
+                wakes.set(databasePath, scheduled);
+                scheduleWakes();
+            }
             await saveRecovery();
         })();
         releasing.set(databasePath, closed);
@@ -627,6 +684,16 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         const invocationRoot = await realpath(selection.invocationRoot);
         const databasePath = await selectedDatabasePath(invocationRoot, selection.databasePath);
         ensureRunning();
+        if (selection.mode !== undefined && databasePath !== undefined) {
+            const child = readPrivateLocalAgentProfile(databasePath);
+            if (child.createdBy !== null) {
+                const stores = await listPrivateLocalAgentStores(invocationRoot);
+                const creatorPath = stores.find((path) => basename(dirname(path)) === child.createdBy);
+                if (creatorPath === undefined ||
+                    !modeWithinCeiling(selection.mode, readPrivateLocalAgentProfile(creatorPath).mode))
+                    throw new AgentCreateRefused("exceeds_creator", "a created Agent cannot exceed its creator's permission mode");
+            }
+        }
         const fungiMcp = selection.fungiMcp === undefined
             ? undefined
             : readFungiMcpSelection(selection.fungiMcp, {
@@ -662,11 +729,14 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 invocationRoot,
                 databasePath,
                 // The host must persist/admit this BEFORE Shiitake can recover work.
-                requireSandbox: selection.requireSandbox,
+                mode: selection.mode,
                 agentControl: projectControl ? directory(invocationRoot) : undefined,
                 mail: projectControl ? mailRouting(invocationRoot) : undefined,
                 meshAdmission,
+                onExecRuleMatch,
             };
+            if (serviceNative !== undefined)
+                options = { ...options, native: serviceNative() };
             if (fungiMcp !== undefined)
                 options = { ...options, fungiMcp };
             const captured = configuration;
@@ -683,8 +753,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
             fungiMcp !== undefined &&
             !sameFungiMcpConnection(owner.fungiMcp, fungiMcp))
             throw new FungiMcpSelectionConflict();
-        if (!openingHere && selection.requireSandbox !== undefined)
-            owner.runtime.setRequireSandbox(selection.requireSandbox);
+        if (!openingHere && selection.mode !== undefined)
+            owner.runtime.setMode(selection.mode);
         return owner.runtime;
     }
     async function select(selection, createRequestId) {
@@ -750,11 +820,15 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                         !("receipt" in result) ||
                         result.status === "refused")
                         throw new Error("Mesh recipient did not return command acceptance");
-                    return parseAccepted(JSON.stringify(result.receipt));
+                    return parseDelegationReceipt(JSON.stringify(result.receipt));
                 }
                 const { owner, release } = await control.owner(mail.to.agentId, new AbortController().signal);
                 try {
-                    return await admitted(owner, () => owner.acceptMail(mail));
+                    const receipt = await admitted(owner, () => owner.acceptMail(mail));
+                    if (mail.to.sessionId === undefined &&
+                        receipt.sessionId === undefined)
+                        throw new Error("Sessionless mail acceptance returned no Session");
+                    return receipt;
                 }
                 finally {
                     release();
@@ -935,7 +1009,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 if (creatorDatabase === undefined)
                     throw new AgentCreateRefused("no_creator", "the creating Agent is not in this Local project");
                 const creatorStore = dirname(creatorDatabase);
-                const sandbox = readPrivateLocalAgentProfile(creatorDatabase);
+                const creatorProfile = readPrivateLocalAgentProfile(creatorDatabase);
                 try {
                     await extensions.assertHeldByAgent(creatorStore, requested);
                 }
@@ -970,11 +1044,14 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                             createRequestId: requestId,
                             name,
                             createdBy,
-                            requireSandbox: sandbox.requireSandbox,
-                            folder: sandbox.folder,
+                            mode: creatorProfile.mode,
+                            folder: creatorProfile.folder,
                             agentControl: directory(invocationRoot),
                             mail: mailRouting(invocationRoot),
+                            onExecRuleMatch,
                         };
+                        if (serviceNative !== undefined)
+                            options = { ...options, native: serviceNative() };
                         if (model !== undefined)
                             options = {
                                 ...options,
@@ -1028,7 +1105,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
             checkModel: async ({ agentId, sessionId }, signal) => {
                 const { owner, release } = await admittedOwner(agentId, signal);
                 try {
-                    await owner.assertModelReady(sessionId, signal);
+                    if (sessionId !== undefined)
+                        await owner.assertModelReady(sessionId, signal);
                 }
                 finally {
                     release();
@@ -1060,6 +1138,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
     function close() {
         stopping = true;
         clearInterval(sweepTimer);
+        if (wakeTimer !== undefined)
+            clearTimeout(wakeTimer);
         closing ??= (async () => {
             const meshResults = await Promise.allSettled([mesh.close()]);
             // End our observers before deciding which Agents have work to resume.
@@ -1098,8 +1178,11 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 const databasePath = owner.runtime.databasePath;
                 const unused = () => !uses.has(databasePath) && !gates.has(databasePath);
                 try {
-                    if (unused() && (await owner.runtime.idle()) && unused())
-                        recovery.delete(databasePath);
+                    if (unused()) {
+                        const state = await owner.runtime.idle();
+                        if (state.idle && unused())
+                            rememberIdleWake(databasePath, state.wakeAt);
+                    }
                 }
                 catch (cause) {
                     logEvent("service-owner.read-idle", cause);
@@ -1184,6 +1267,14 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         for (const selection of loaded.references) {
             if (stopping)
                 break;
+            if (selection.wakeAt !== undefined && selection.wakeAt > Date.now()) {
+                // A client may already have opened this store while the manifest was
+                // loading. Its runtime now owns the wake; do not arm a second one.
+                await Promise.allSettled(pendingOpenings);
+                if (!owners.has(`store:${selection.databasePath}`))
+                    wakes.set(selection.databasePath, selection);
+                continue;
+            }
             try {
                 await ownerFor(selection);
             }
@@ -1199,6 +1290,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                     recovery.delete(selection.databasePath);
             }
         }
+        scheduleWakes();
         await saveRecovery();
     }
     /** A person archives or restores any Agent of one project folder. */

package/dist/private-local-service.js

@@ -13,9 +13,12 @@ export { AgentArchiveRefused } from "@fungi.computer/shiitake/agent-control";
 import { newWebSocketRpcSession } from "@fungi.computer/capnweb";
 import { runPrivateLocalAuthRemote, } from "./private-local-auth-rpc.js";
 import { spawn } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { setTimeout as delay } from "node:timers/promises";
 import { readInstalledLocalClientBuildId } from "./private-local-client-version.js";
+import { nativePackageStartupError } from "./private-local-native-install-error.js";
 export { readInstalledLocalClientBuildId } from "./private-local-client-version.js";
 export { privateLocalServiceVersion } from "./private-local-service-discovery.js";
 import { createShiitakeClient, parseSessionSnapshot, } from "@fungi.computer/shiitake/client";
@@ -220,6 +223,7 @@ export function createPrivateLocalServiceManager(options = {}) {
         request.signal?.throwIfAborted();
         const directory = await serviceDirectory(selectedDirectory);
         const release = await acquireServiceLock(directory, "startup");
+        let nativeRefusalDirectory;
         try {
             const registration = await readServiceRegistration(directory);
             const existing = registration === undefined
@@ -232,17 +236,30 @@ export function createPrivateLocalServiceManager(options = {}) {
             if (await serviceOwnerIsLive(directory))
                 return "busy";
             const bundledCli = process.env.FUNGI_BUNDLED_CLI;
-            const child = spawn(options.executable ?? process.execPath, bundledCli === undefined
-                ? [
-                    fileURLToPath(new URL("./private-local-service-process.js", import.meta.url)),
-                    directory,
-                ]
-                : [bundledCli, "--internal-service", directory], {
+            // A detached Bun service also starts in the invoking project's cwd.
+            // Keep the host process from importing Agent-authored bunfig or .env.
+            const bunFlags = options.executable === undefined && "bun" in process.versions
+                ? ["--config=/dev/null", "--no-env-file"]
+                : [];
+            const serviceEntry = bundledCli ??
+                fileURLToPath(new URL("./private-local-service-process.js", import.meta.url));
+            nativeRefusalDirectory = await mkdtemp(join(directory, ".native-startup-refusal-"));
+            const nativeRefusal = join(nativeRefusalDirectory, "native-package");
+            const child = spawn(options.executable ?? process.execPath, [
+                ...bunFlags,
+                serviceEntry,
+                ...(bundledCli === undefined ? [] : ["--internal-service"]),
+                directory,
+            ], {
                 detached: true,
                 stdio: "ignore",
                 // Service startup retains its existing inherited inputs. This is
                 // not a Computer exec child: only its selected host HOME is pinned.
-                env: { ...process.env, HOME: root.home },
+                env: {
+                    ...process.env,
+                    HOME: root.home,
+                    FUNGI_NATIVE_STARTUP_REFUSAL: nativeRefusal,
+                },
             });
             let failure;
             let exited = false;
@@ -265,8 +282,18 @@ export function createPrivateLocalServiceManager(options = {}) {
                         throw new Error(`The started Local service reports version ${ready.version}, not this client's ${expectedVersion}`);
                     return accept(ready);
                 }
-                if (hasExited())
+                if (hasExited()) {
+                    const refusal = await readFile(nativeRefusal, "utf8").catch((cause) => {
+                        if (cause instanceof Error &&
+                            "code" in cause &&
+                            cause.code === "ENOENT")
+                            return undefined;
+                        throw cause;
+                    });
+                    if (refusal === "native-package")
+                        throw nativePackageStartupError();
                     throw new Error("Local service exited before its handshake");
+                }
                 await delay(100, undefined, { signal: request.signal });
             }
             child.kill("SIGTERM");
@@ -277,7 +304,14 @@ export function createPrivateLocalServiceManager(options = {}) {
                 : `Local service did not become ready; child ${String(child.pid)} is still running`);
         }
         finally {
-            await release();
+            // The token is per spawn and cannot survive a failed or successful start.
+            try {
+                if (nativeRefusalDirectory !== undefined)
+                    await rm(nativeRefusalDirectory, { recursive: true, force: true });
+            }
+            finally {
+                await release();
+            }
         }
     }
     /** POST one selection to `service`; every refusal is a typed failure. */

package/dist/private-local-session-discovery.d.ts

@@ -32,12 +32,13 @@ export declare function readPrivateLocalAgentProfile(path: string): {
     name: string | undefined;
     createdBy: string | null;
     archived: boolean;
-    requireSandbox: boolean;
+    mode: "read-only" | "workspace" | "full-access";
+    writableFolders: string[];
     folder: string;
     model: {
         readonly providerId: string;
         readonly modelId: string;
-        readonly reasoning?: "minimal" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
+        readonly reasoning?: "high" | "low" | "max" | "medium" | "minimal" | "xhigh" | undefined;
     } | null;
 };
 export declare function readPrivateLocalSessionSummaries(path: string): Promise<readonly LocalSummary[]>;