@fungi.computer/truffle 0.2.2 → 0.3.1

package/dist/private-local-service-discovery.d.ts

@@ -4,7 +4,7 @@ export { sandboxStatusSchema } from "./private-local-sandbox.js";
  * The client-service wire contract. Bump it with any change an older client
  * cannot read; a running client then asks its window to restart.
  */
-export declare const privateLocalServiceProtocol = 3;
+export declare const privateLocalServiceProtocol = 4;
 /** This build's identity: the packed CLI's content hash, or `source` for a source run. */
 export declare function privateLocalServiceVersion(): string;
 /**
@@ -19,7 +19,7 @@ declare const serviceLifecycleSchema: z.ZodObject<{
     startedAt: z.ZodString;
 }, z.core.$loose>;
 declare const serviceRecordSchema: z.ZodObject<{
-    protocol: z.ZodLiteral<3>;
+    protocol: z.ZodLiteral<4>;
     baseUrl: z.ZodURL;
     version: z.ZodString;
     serviceId: z.ZodString & z.ZodType<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string, z.core.$ZodTypeInternals<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string>>;
@@ -29,7 +29,7 @@ declare const serviceRecordSchema: z.ZodObject<{
 export type ServiceRecord = z.infer<typeof serviceRecordSchema>;
 /** Mandatory live diagnostics; never written into the registration pointer. */
 export declare const liveServiceStatusSchema: z.ZodObject<{
-    protocol: z.ZodLiteral<3>;
+    protocol: z.ZodLiteral<4>;
     baseUrl: z.ZodURL;
     version: z.ZodString;
     serviceId: z.ZodString & z.ZodType<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string, z.core.$ZodTypeInternals<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string>>;
@@ -76,7 +76,11 @@ export declare const selectionSchema: z.ZodObject<{
     }>>;
     invocationRoot: z.ZodString;
     clientPath: z.ZodString;
-    requireSandbox: z.ZodOptional<z.ZodBoolean>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        "read-only": "read-only";
+        workspace: "workspace";
+        "full-access": "full-access";
+    }>>;
     databasePath: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     fungiMcp: z.ZodOptional<z.ZodObject<{
@@ -91,7 +95,11 @@ export declare const sessionCreationSchema: z.ZodObject<{
     }>>;
     invocationRoot: z.ZodString;
     clientPath: z.ZodString;
-    requireSandbox: z.ZodOptional<z.ZodBoolean>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        "read-only": "read-only";
+        workspace: "workspace";
+        "full-access": "full-access";
+    }>>;
     databasePath: z.ZodString;
     requestId: z.ZodString;
     fungiMcp: z.ZodOptional<z.ZodObject<{
@@ -100,13 +108,17 @@ export declare const sessionCreationSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const sessionInspectionSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+        "read-only": "read-only";
+        workspace: "workspace";
+        "full-access": "full-access";
+    }>>;
     databasePath: z.ZodOptional<z.ZodString>;
     invocationRoot: z.ZodString;
     fungiMcp: z.ZodOptional<z.ZodObject<{
         endpoint: z.ZodPipe<z.ZodURL, z.ZodString>;
         authentication: z.ZodOptional<z.ZodLiteral<"oyster-key">>;
     }, z.core.$strict>>;
-    requireSandbox: z.ZodOptional<z.ZodBoolean>;
     sessionId: z.ZodString;
     limit: z.ZodNumber;
 }, z.core.$strict>;
@@ -131,10 +143,10 @@ export declare const archiveRefusalSchema: z.ZodObject<{
     reason: z.ZodEnum<{
         pending: "pending";
         running: "running";
-        unreadable: "unreadable";
         archived: "archived";
         not_creator: "not_creator";
         self: "self";
+        unreadable: "unreadable";
     }>;
     error: z.ZodString;
 }, z.core.$strict>;

package/dist/private-local-service-discovery.js

@@ -6,6 +6,7 @@ import { join, resolve } from "node:path";
 import { homedir } from "node:os";
 import lockfile from "proper-lockfile";
 import { z } from "zod";
+import { localPermissionModeSchema } from "./private-local-permission-mode.js";
 import { localServiceIds } from "./private-local-service-ids.js";
 import { acquireServiceOwnerLease, readServiceLeaseOwner, } from "./private-local-service-lease.js";
 import { modelReasoningLevels } from "@fungi.computer/shiitake/model-preference";
@@ -16,7 +17,7 @@ export { sandboxStatusSchema } from "./private-local-sandbox.js";
  * The client-service wire contract. Bump it with any change an older client
  * cannot read; a running client then asks its window to restart.
  */
-export const privateLocalServiceProtocol = 3;
+export const privateLocalServiceProtocol = 4;
 /** This build's identity: the packed CLI's content hash, or `source` for a source run. */
 export function privateLocalServiceVersion() {
     return (z
@@ -64,7 +65,7 @@ export const selectionSchema = z.strictObject({
     uiAttachmentLifetime: localUiAttachmentLifetimeSchema.optional(),
     invocationRoot: z.string().min(1),
     clientPath: privateLocalExecPathSchema,
-    requireSandbox: z.boolean().optional(),
+    mode: localPermissionModeSchema.optional(),
     databasePath: z.string().min(1).optional(),
     sessionId: z.string().min(1).optional(),
     fungiMcp: fungiMcpSelectionSchema.optional(),
@@ -73,7 +74,7 @@ export const sessionCreationSchema = z.strictObject({
     uiAttachmentLifetime: localUiAttachmentLifetimeSchema.optional(),
     invocationRoot: z.string().min(1),
     clientPath: privateLocalExecPathSchema,
-    requireSandbox: z.boolean().optional(),
+    mode: localPermissionModeSchema.optional(),
     databasePath: z.string().min(1),
     requestId: z.string().min(1),
     fungiMcp: fungiMcpSelectionSchema.optional(),

package/dist/private-local-service-listener.js

@@ -6,6 +6,10 @@ import { createServiceLogLifecycle, } from "./private-local-service-log.js";
 import { stopAllRequestSchema } from "./private-local-stop-all.js";
 import { FungiMcpSelectionConflict } from "./private-fungi-mcp-selection.js";
 import { LocalSandboxUnavailable } from "./private-local-containment.js";
+import { createNativePayloadStaging, } from "./private-local-native-staging.js";
+import { nativePackageStartupError } from "./private-local-native-install-error.js";
+import { LocalBwrapUnavailable } from "./private-local-bwrap.js";
+import { writeFileSync } from "node:fs";
 import { PrivateLocalAuthTarget } from "./private-local-auth-rpc.js";
 import { runLocalAuthCli } from "./auth-cli.js";
 import { capturePrivateLocalConfigRoot, } from "./private-local-config-root.js";
@@ -88,7 +92,12 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
             heap: jsc.heapStats(),
         }),
     });
-    const owners = createLocalServiceOwners(openRuntime, directory, undefined, idleSweepMs, readRecoveryManifest, diagnostics.recoveryDisabled, root);
+    let native;
+    const owners = createLocalServiceOwners(openRuntime, directory, undefined, idleSweepMs, readRecoveryManifest, diagnostics.recoveryDisabled, root, undefined, diagnostics.ruleMatch, () => {
+        if (native === undefined)
+            throw new Error("Local service native staging is not ready");
+        return native;
+    }, diagnostics.approvalDecision);
     const prefix = `/service/${serviceId}`;
     const releaseAccountOwner = registerFungiAccountOwner(root.credentialPath, () => owners.refreshMesh());
     const app = new Hono();
@@ -182,7 +191,11 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
         };
     };
     const shutdown = createPrivateLocalServiceShutdown({
-        closeOwners: owners.close,
+        closeOwners: async () => {
+            await owners.close();
+            // No Agent, including one reopened during recovery, still uses the copy.
+            native?.close();
+        },
         closeServer: async () => {
             await server?.close();
         },
@@ -233,6 +246,31 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
     const isLocalRequest = (request) => !request.headers.has("origin") &&
         new URL(request.url).hostname === "127.0.0.1";
     try {
+        // Verify and stage before publishing discovery, even without a selected Agent.
+        try {
+            native = createNativePayloadStaging(directory);
+        }
+        catch (cause) {
+            if (cause instanceof LocalBwrapUnavailable) {
+                // A detached child has no stderr. Only this classified startup refusal
+                // crosses to the starting client; never export arbitrary exception text.
+                const marker = process.env.FUNGI_NATIVE_STARTUP_REFUSAL;
+                if (marker !== undefined) {
+                    try {
+                        writeFileSync(marker, "native-package", {
+                            flag: "wx",
+                            mode: 0o600,
+                        });
+                    }
+                    catch (reportFailure) {
+                        // A broken report channel cannot replace the native refusal.
+                        logEvent("service-listener.native-refusal-report", reportFailure);
+                    }
+                }
+                throw nativePackageStartupError(cause);
+            }
+            throw cause;
+        }
         app.use("*", async (context, next) => {
             const request = context.req.raw;
             // Local client only: no browser-origin admission or DNS rebinding authority.

package/dist/private-local-service-log.d.ts

@@ -50,6 +50,18 @@ export type ServiceLogEvent = Readonly<{
 }> | Readonly<{
     event: "recovery-persistence-disabled";
     code: RecoveryPersistenceFailureCode;
+}> | Readonly<{
+    event: "exec-rule-match";
+    agentId: string;
+    executable: string;
+    ruleId: string;
+}> | Readonly<{
+    event: "exec-approval-decision";
+    agentId: string;
+    recordId: string;
+    decision: "approve" | "deny";
+    scope?: "once" | "always";
+    ruleId?: string;
 }> | Readonly<{
     event: "memory";
     rss: number;
@@ -80,6 +92,12 @@ export type ServiceLogLifecycle = Readonly<{
     ready: (serviceId: string) => void;
     stopping: (reason: ServiceLogShutdownReason) => void;
     failure: (failure: FailureMetadata) => void;
+    ruleMatch: (match: Omit<Extract<ServiceLogEvent, {
+        event: "exec-rule-match";
+    }>, "event">) => void;
+    approvalDecision: (decision: Omit<Extract<ServiceLogEvent, {
+        event: "exec-approval-decision";
+    }>, "event">) => void;
     recoveryDisabled: (code: RecoveryPersistenceFailureCode) => void;
     /** Synchronous, so it lands before the bounded drain exits the process. */
     drainTimeout: (drain: Readonly<{

package/dist/private-local-service-log.js

@@ -287,6 +287,12 @@ export function createServiceLogLifecycle(input) {
         failure(failure) {
             emit({ event: "failure", failure });
         },
+        ruleMatch(match) {
+            emit({ event: "exec-rule-match", ...match });
+        },
+        approvalDecision(decision) {
+            emit({ event: "exec-approval-decision", ...decision });
+        },
         recoveryDisabled(code) {
             if (closed || recovery !== undefined)
                 return;

package/dist/private-local-service-owner.d.ts

@@ -6,7 +6,8 @@ import { type LocalExtensions } from "./local-extensions.js";
 import type { PrivateLocalServiceSelection, PrivateLocalSessionCreation } from "./private-local-service-contract.js";
 import { openPrivateLocalRuntimeHost, type PrivateLocalRuntimeHost } from "./private-local-runtime-host.js";
 import type { LocalUiAttachment } from "./private-local-ui-attachment.js";
-export type LocalServiceRuntime = Pick<PrivateLocalRuntimeHost, "databasePath" | "agentId" | "name" | "getSession" | "effectiveModel" | "setModel" | "setArchived" | "setRequireSandbox" | "sandboxStatus" | "pendingDelegation" | "assertModelReady" | "listSessions" | "createSession" | "deleteSession" | "extensions" | "prepareReload" | "bindSessionPath" | "acceptMail" | "readSettlement" | "idle" | "close">;
+import { createLocalMeshLinks } from "./private-local-mesh-links.js";
+export type LocalServiceRuntime = Pick<PrivateLocalRuntimeHost, "databasePath" | "agentId" | "name" | "getSession" | "effectiveModel" | "setModel" | "setArchived" | "setMode" | "sandboxStatus" | "pendingDelegation" | "assertModelReady" | "listSessions" | "createSession" | "deleteSession" | "extensions" | "prepareReload" | "bindSessionPath" | "acceptMail" | "readSettlement" | "idle" | "close">;
 export declare class LocalSessionPathConflict extends Error {
     readonly name = "LocalSessionPathConflict";
     constructor();
@@ -35,7 +36,9 @@ idleSweepMs?: number,
 /** Read the recovery manifest; tests can hold this I/O independently of opens. */
 readRecoveryManifest?: (path: string) => Promise<string>, 
 /** Report only the classification, never the manifest or exception text. */
-onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: PrivateLocalConfigRoot): {
+onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: PrivateLocalConfigRoot, meshLinksFactory?: typeof createLocalMeshLinks, onExecRuleMatch?: NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["onExecRuleMatch"]>, 
+/** Supplied by the listener after startup; individual Agents never close it. */
+serviceNative?: () => NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["native"]>, onExecApprovalDecision?: NonNullable<Parameters<typeof openPrivateLocalRuntimeHost>[0]["onExecApprovalDecision"]>): {
     refreshMesh: () => Promise<void>;
     createSession: (creation: PrivateLocalSessionCreation) => Promise<{
         agentId: string;
@@ -59,6 +62,10 @@ onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: Priva
                 set: (preference: import("@fungi.computer/shiitake").ModelPreference | null) => Promise<void>;
             }>;
             read: (input?: import("@fungi.computer/shiitake").ReadOptions) => Promise<import("@fungi.computer/shiitake").SessionSnapshot>;
+            readSettlement: (commandId: string, options?: Readonly<{
+                timeoutMs?: number;
+                signal?: AbortSignal;
+            }>) => Promise<import("@fungi.computer/shiitake").CommandSettlement | undefined>;
             subscribe: (input: import("@fungi.computer/shiitake").SubscribeOptions) => AsyncIterable<import("@fungi.computer/shiitake").SessionFrame>;
             watch: (input?: import("@fungi.computer/shiitake").WatchOptions) => Promise<import("@fungi.computer/shiitake").SessionWatch>;
         }>;
@@ -87,6 +94,10 @@ onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: Priva
                 set: (preference: import("@fungi.computer/shiitake").ModelPreference | null) => Promise<void>;
             }>;
             read: (input?: import("@fungi.computer/shiitake").ReadOptions) => Promise<import("@fungi.computer/shiitake").SessionSnapshot>;
+            readSettlement: (commandId: string, options?: Readonly<{
+                timeoutMs?: number;
+                signal?: AbortSignal;
+            }>) => Promise<import("@fungi.computer/shiitake").CommandSettlement | undefined>;
             subscribe: (input: import("@fungi.computer/shiitake").SubscribeOptions) => AsyncIterable<import("@fungi.computer/shiitake").SessionFrame>;
             watch: (input?: import("@fungi.computer/shiitake").WatchOptions) => Promise<import("@fungi.computer/shiitake").SessionWatch>;
         }>;
@@ -108,15 +119,12 @@ onRecoveryDisabled?: ServiceLogLifecycle["recoveryDisabled"], configRoot?: Priva
         reasoning?: "minimal" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
     }>;
     sandboxStatus: (selection: Pick<PrivateLocalServiceSelection, "invocationRoot" | "databasePath" | "fungiMcp">, signal: AbortSignal) => Promise<{
-        state: "available";
-        requireSandbox: boolean;
-    } | {
-        state: "unavailable";
-        requireSandbox: boolean;
-        reason: {
-            kind: "missing" | "missing-artifact" | "invalid-digest" | "digest-mismatch" | "unreadable" | "not-executable" | "staging-failed" | "unsupported-platform" | "invalid-folder" | "unsafe-native-payload" | "unsafe-host-code" | "startup-refused" | "backend-refused";
+        mode: "read-only" | "workspace" | "full-access";
+        available: boolean;
+        reason?: {
+            kind: "install" | "unsupported" | "folder" | "startup-refused";
             message: string;
-        };
+        } | undefined;
     }>;
     sweepIdle: () => Promise<void>;
     archive: (request: Readonly<{

package/dist/private-local-service-owner.js

@@ -1,5 +1,7 @@
 import * as Effect from "effect/Effect";
+import { parseDelegationReceipt } from "@fungi.computer/shiitake/client";
 import { logEvent } from "./log-event.js";
+import { modeWithinCeiling } from "./private-local-permission-mode.js";
 import { createPrivateModels } from "./local-models.js";
 import { capturePrivateLocalConfigRoot, } from "./private-local-config-root.js";
 import { AdmissionGate } from "./private-local-admission-gate.js";
@@ -19,7 +21,6 @@ import { createPrivateLocalSessionRequestId, openPrivateLocalRuntimeHost, resolv
 import { parsePrivateLocalExecPath } from "./private-local-exec-path.js";
 import { createLocalMeshLinks, localMeshLinkKey, } from "./private-local-mesh-links.js";
 import { agentMailAddressSchema, machineAgentRequestSchema, machineDirectorySchema, } from "@fungi.computer/seam/machine-link-protocol";
-import { parseAccepted } from "@fungi.computer/shiitake/client";
 import { commandSettlementSchema } from "@fungi.computer/shiitake/fleet";
 import { BirdDogMailSchema } from "@fungi.computer/bird-dog/effect";
 export class LocalSessionPathConflict extends Error {
@@ -44,7 +45,10 @@ export class LocalAgentSelectionAmbiguous extends Error {
 // Reopen inputs only. Credentials remain with Local's account custodian.
 const recoveryOwnerSchema = selectionSchema
     .omit({ clientPath: true, sessionId: true, uiAttachmentLifetime: true })
-    .extend({ databasePath: z.string().min(1) });
+    .extend({
+    databasePath: z.string().min(1),
+    wakeAt: z.number().optional(),
+});
 const decodeRecoveryFile = Schema.decodeUnknownResult(Schema.fromJsonString(Schema.Array(Schema.Unknown)));
 class LocalRecoveryPersistenceDisabled extends Error {
     reason;
@@ -65,12 +69,40 @@ idleSweepMs = 60_000,
 /** Read the recovery manifest; tests can hold this I/O independently of opens. */
 readRecoveryManifest = (path) => readFile(path, "utf8"), 
 /** Report only the classification, never the manifest or exception text. */
-onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot()) {
+onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot(), meshLinksFactory = createLocalMeshLinks, onExecRuleMatch = () => undefined, 
+/** Supplied by the listener after startup; individual Agents never close it. */
+serviceNative, onExecApprovalDecision = () => undefined) {
     const extensions = suppliedExtensions ?? localExtensions({ home: configRoot.home });
     const recoveryPath = recoveryDirectory === undefined
         ? undefined
         : resolve(recoveryDirectory, "owners.json");
     const recovery = new Map();
+    const wakes = new Map();
+    let wakeTimer;
+    function scheduleWakes() {
+        if (wakeTimer !== undefined)
+            clearTimeout(wakeTimer);
+        wakeTimer = undefined;
+        if (stopping || wakes.size === 0)
+            return;
+        let earliest = Infinity;
+        for (const entry of wakes.values())
+            earliest = Math.min(earliest, entry.wakeAt ?? Infinity);
+        wakeTimer = setTimeout(() => {
+            wakeTimer = undefined;
+            if (stopping)
+                return;
+            const due = [...wakes.values()].filter((entry) => entry.wakeAt !== undefined && entry.wakeAt <= Date.now());
+            for (const entry of due) {
+                wakes.delete(entry.databasePath);
+                void ownerFor(entry).catch((cause) => {
+                    logEvent("service-owner.wake", cause);
+                });
+            }
+            scheduleWakes();
+        }, Math.min(2_147_483_647, Math.max(0, earliest - Date.now())));
+        wakeTimer.unref();
+    }
     let loadingRecovery;
     let saving = Promise.resolve();
     const emptySessions = new Map();
@@ -87,7 +119,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         }
         return undefined;
     }
-    const mesh = createLocalMeshLinks({
+    const mesh = meshLinksFactory({
         credentialPath: configRoot.credentialPath,
         receive: async (record, envelope) => {
             if (envelope.kind === "machineDirectory") {
@@ -142,13 +174,18 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 })(envelope.event);
                 if (envelope.kind !== "agentMail" ||
                     envelope.key !== mail.key ||
-                    mail.to.agentId !== address.agentId ||
-                    new TextEncoder().encode(JSON.stringify(mail)).byteLength > 256 * 1024)
+                    mail.to.agentId !== address.agentId)
                     return "refused";
-                // Only select the physical store here. Never rewrite frozen addresses
-                // or bypass that runtime's own recipient/sender admission.
-                const receipt = await admitted(owner, () => owner.acceptMail(mail));
-                return { status: "accepted", receipt };
+                if (mail.from.sessionId === undefined &&
+                    !(mail.replyTo.length === 0 && mail.reply?.outcome === "undeliverable"))
+                    return "refused";
+                const sessionlessAcceptance = mail.to.sessionId === undefined;
+                // Only select the physical store here. Never bypass that runtime's
+                // recipient/sender admission; request keys make acceptance replay-safe.
+                const command = await admitted(owner, () => owner.acceptMail(mail));
+                if (sessionlessAcceptance && command.sessionId === undefined)
+                    throw new Error("Sessionless mail acceptance returned no Session");
+                return { status: "accepted", receipt: command };
             }
             finally {
                 release();
@@ -295,6 +332,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         });
         pending = pending.then(async (owner) => {
             roots.set(owner.runtime.databasePath, invocationRoot);
+            if (wakes.delete(owner.runtime.databasePath))
+                scheduleWakes();
             if (recoveryPath !== undefined) {
                 const reference = {
                     invocationRoot,
@@ -523,9 +562,12 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 }
                 let runtime;
                 let idle;
+                let wakeAt;
                 try {
                     ({ runtime } = await pending);
-                    idle = await runtime.idle();
+                    const state = await runtime.idle();
+                    idle = state.idle;
+                    wakeAt = state.wakeAt;
                 }
                 catch (cause) {
                     // One unreadable Agent stays open; the sweep still checks the rest.
@@ -542,7 +584,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                     idleCandidates.add(databasePath);
                     continue;
                 }
-                closed.push(releaseStore(databasePath, pending, runtime));
+                closed.push(releaseStore(databasePath, pending, runtime, wakeAt));
             }
             await Promise.all(closed);
         })().finally(() => {
@@ -550,7 +592,18 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         });
         return sweeping;
     }
-    function releaseStore(databasePath, pending, runtime) {
+    /** Forget empty Agents; retain a future wake for the next service owner. */
+    function rememberIdleWake(databasePath, wakeAt) {
+        const reference = recovery.get(databasePath);
+        if (wakeAt === null || reference === undefined) {
+            recovery.delete(databasePath);
+            return undefined;
+        }
+        const scheduled = { ...reference, wakeAt };
+        recovery.set(databasePath, scheduled);
+        return scheduled;
+    }
+    function releaseStore(databasePath, pending, runtime, wakeAt) {
         idleCandidates.delete(databasePath);
         released.add(runtime);
         for (const [key, value] of owners)
@@ -558,7 +611,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 owners.delete(key);
         emptySessions.delete(databasePath);
         roots.delete(databasePath);
-        recovery.delete(databasePath);
+        const scheduled = rememberIdleWake(databasePath, wakeAt);
         const opened = openedByStore.get(databasePath);
         openedByStore.delete(databasePath);
         if (opened !== undefined)
@@ -570,6 +623,10 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
             catch (cause) {
                 logEvent("service-owner.release-runtime", cause);
             }
+            if (scheduled !== undefined && !stopping) {
+                wakes.set(databasePath, scheduled);
+                scheduleWakes();
+            }
             await saveRecovery();
         })();
         releasing.set(databasePath, closed);
@@ -627,6 +684,16 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         const invocationRoot = await realpath(selection.invocationRoot);
         const databasePath = await selectedDatabasePath(invocationRoot, selection.databasePath);
         ensureRunning();
+        if (selection.mode !== undefined && databasePath !== undefined) {
+            const child = readPrivateLocalAgentProfile(databasePath);
+            if (child.createdBy !== null) {
+                const stores = await listPrivateLocalAgentStores(invocationRoot);
+                const creatorPath = stores.find((path) => basename(dirname(path)) === child.createdBy);
+                if (creatorPath === undefined ||
+                    !modeWithinCeiling(selection.mode, readPrivateLocalAgentProfile(creatorPath).mode))
+                    throw new AgentCreateRefused("exceeds_creator", "a created Agent cannot exceed its creator's permission mode");
+            }
+        }
         const fungiMcp = selection.fungiMcp === undefined
             ? undefined
             : readFungiMcpSelection(selection.fungiMcp, {
@@ -662,11 +729,15 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 invocationRoot,
                 databasePath,
                 // The host must persist/admit this BEFORE Shiitake can recover work.
-                requireSandbox: selection.requireSandbox,
+                mode: selection.mode,
                 agentControl: projectControl ? directory(invocationRoot) : undefined,
                 mail: projectControl ? mailRouting(invocationRoot) : undefined,
                 meshAdmission,
+                onExecRuleMatch,
+                onExecApprovalDecision,
             };
+            if (serviceNative !== undefined)
+                options = { ...options, native: serviceNative() };
             if (fungiMcp !== undefined)
                 options = { ...options, fungiMcp };
             const captured = configuration;
@@ -683,8 +754,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
             fungiMcp !== undefined &&
             !sameFungiMcpConnection(owner.fungiMcp, fungiMcp))
             throw new FungiMcpSelectionConflict();
-        if (!openingHere && selection.requireSandbox !== undefined)
-            owner.runtime.setRequireSandbox(selection.requireSandbox);
+        if (!openingHere && selection.mode !== undefined)
+            owner.runtime.setMode(selection.mode);
         return owner.runtime;
     }
     async function select(selection, createRequestId) {
@@ -750,11 +821,15 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                         !("receipt" in result) ||
                         result.status === "refused")
                         throw new Error("Mesh recipient did not return command acceptance");
-                    return parseAccepted(JSON.stringify(result.receipt));
+                    return parseDelegationReceipt(JSON.stringify(result.receipt));
                 }
                 const { owner, release } = await control.owner(mail.to.agentId, new AbortController().signal);
                 try {
-                    return await admitted(owner, () => owner.acceptMail(mail));
+                    const receipt = await admitted(owner, () => owner.acceptMail(mail));
+                    if (mail.to.sessionId === undefined &&
+                        receipt.sessionId === undefined)
+                        throw new Error("Sessionless mail acceptance returned no Session");
+                    return receipt;
                 }
                 finally {
                     release();
@@ -935,7 +1010,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 if (creatorDatabase === undefined)
                     throw new AgentCreateRefused("no_creator", "the creating Agent is not in this Local project");
                 const creatorStore = dirname(creatorDatabase);
-                const sandbox = readPrivateLocalAgentProfile(creatorDatabase);
+                const creatorProfile = readPrivateLocalAgentProfile(creatorDatabase);
                 try {
                     await extensions.assertHeldByAgent(creatorStore, requested);
                 }
@@ -970,11 +1045,15 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                             createRequestId: requestId,
                             name,
                             createdBy,
-                            requireSandbox: sandbox.requireSandbox,
-                            folder: sandbox.folder,
+                            mode: creatorProfile.mode,
+                            folder: creatorProfile.folder,
                             agentControl: directory(invocationRoot),
                             mail: mailRouting(invocationRoot),
+                            onExecRuleMatch,
+                            onExecApprovalDecision,
                         };
+                        if (serviceNative !== undefined)
+                            options = { ...options, native: serviceNative() };
                         if (model !== undefined)
                             options = {
                                 ...options,
@@ -1028,7 +1107,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
             checkModel: async ({ agentId, sessionId }, signal) => {
                 const { owner, release } = await admittedOwner(agentId, signal);
                 try {
-                    await owner.assertModelReady(sessionId, signal);
+                    if (sessionId !== undefined)
+                        await owner.assertModelReady(sessionId, signal);
                 }
                 finally {
                     release();
@@ -1060,6 +1140,8 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
     function close() {
         stopping = true;
         clearInterval(sweepTimer);
+        if (wakeTimer !== undefined)
+            clearTimeout(wakeTimer);
         closing ??= (async () => {
             const meshResults = await Promise.allSettled([mesh.close()]);
             // End our observers before deciding which Agents have work to resume.
@@ -1098,8 +1180,11 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                 const databasePath = owner.runtime.databasePath;
                 const unused = () => !uses.has(databasePath) && !gates.has(databasePath);
                 try {
-                    if (unused() && (await owner.runtime.idle()) && unused())
-                        recovery.delete(databasePath);
+                    if (unused()) {
+                        const state = await owner.runtime.idle();
+                        if (state.idle && unused())
+                            rememberIdleWake(databasePath, state.wakeAt);
+                    }
                 }
                 catch (cause) {
                     logEvent("service-owner.read-idle", cause);
@@ -1184,6 +1269,14 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
         for (const selection of loaded.references) {
             if (stopping)
                 break;
+            if (selection.wakeAt !== undefined && selection.wakeAt > Date.now()) {
+                // A client may already have opened this store while the manifest was
+                // loading. Its runtime now owns the wake; do not arm a second one.
+                await Promise.allSettled(pendingOpenings);
+                if (!owners.has(`store:${selection.databasePath}`))
+                    wakes.set(selection.databasePath, selection);
+                continue;
+            }
             try {
                 await ownerFor(selection);
             }
@@ -1199,6 +1292,7 @@ onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot
                     recovery.delete(selection.databasePath);
             }
         }
+        scheduleWakes();
         await saveRecovery();
     }
     /** A person archives or restores any Agent of one project folder. */