@fungi.computer/truffle 0.3.1 → 0.4.0

package/dist/private-local-service-owner.js

@@ -10,6 +10,7 @@ import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { AgentCreateRefused, AgentArchiveRefused, } from "@fungi.computer/shiitake/agent-control";
 import { localExtensions, LocalExtensionError, } from "./local-extensions.js";
+import { deferExtensionArchiveNotices } from "./private-local-extension-archive-notice.js";
 import { readFile, realpath } from "node:fs/promises";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
@@ -72,7 +73,11 @@ readRecoveryManifest = (path) => readFile(path, "utf8"),
 onRecoveryDisabled = () => undefined, configRoot = capturePrivateLocalConfigRoot(), meshLinksFactory = createLocalMeshLinks, onExecRuleMatch = () => undefined, 
 /** Supplied by the listener after startup; individual Agents never close it. */
 serviceNative, onExecApprovalDecision = () => undefined) {
-    const extensions = suppliedExtensions ?? localExtensions({ home: configRoot.home });
+    deferExtensionArchiveNotices(configRoot.home);
+    const extensions = suppliedExtensions ??
+        localExtensions({
+            home: configRoot.home,
+        });
     const recoveryPath = recoveryDirectory === undefined
         ? undefined
         : resolve(recoveryDirectory, "owners.json");
@@ -176,8 +181,9 @@ serviceNative, onExecApprovalDecision = () => undefined) {
                     envelope.key !== mail.key ||
                     mail.to.agentId !== address.agentId)
                     return "refused";
-                if (mail.from.sessionId === undefined &&
-                    !(mail.replyTo.length === 0 && mail.reply?.outcome === "undeliverable"))
+                if (mail.from.kind === "system" &&
+                    !(mail.reply?.outcome === "undeliverable" &&
+                        mail.reply.reason === "recipient_offline"))
                     return "refused";
                 const sessionlessAcceptance = mail.to.sessionId === undefined;
                 // Only select the physical store here. Never bypass that runtime's
@@ -229,7 +235,9 @@ serviceNative, onExecApprovalDecision = () => undefined) {
             for (const project of projects)
                 selections.set(project, await readProjectFungiMcpSelection(project));
             const candidate = {
-                load: await localExtensions({ home: configRoot.home }).captureAgent(),
+                load: await localExtensions({
+                    home: configRoot.home,
+                }).captureAgent(),
                 mcp: selections,
                 clientPath: path,
             };
@@ -801,8 +809,9 @@ serviceNative, onExecApprovalDecision = () => undefined) {
         const control = directory(invocationRoot);
         return {
             deliver: async (mail) => {
+                const senderAgentId = mail.from.kind === "agent" ? mail.from.agentId : undefined;
                 const remote = [...meshDirectories.values()].find(({ record }) => record.invocationRoot === invocationRoot &&
-                    record.bindings.some((binding) => binding.agentId === mail.from.agentId));
+                    record.bindings.some((binding) => binding.agentId === senderAgentId));
                 if (remote !== undefined) {
                     if (!remote.agents.some((agent) => agent.agentId === mail.to.agentId))
                         throw new Error("Mesh mail recipient is outside this Team");
@@ -1001,9 +1010,10 @@ serviceNative, onExecApprovalDecision = () => undefined) {
                     return model === null ? agent : { ...agent, model };
                 });
             },
-            create: async ({ requestId, name, model, extensions: requested = [], createdBy }, signal) => {
+            create: async ({ requestId, name, model, extensions: requested = [], createdBy, createdBySessionId, }, signal) => {
                 ensureRunning();
                 signal.throwIfAborted();
+                z.string().min(1).max(256).parse(createdBySessionId);
                 // An Agent creating an Agent cannot give it more than it holds. Refuse
                 // before anything exists; never trim the request.
                 const creatorDatabase = (await targets(signal)).get(createdBy);
@@ -1021,7 +1031,8 @@ serviceNative, onExecApprovalDecision = () => undefined) {
                     throw error;
                 }
                 const key = `create:${JSON.stringify([invocationRoot, requestId])}`;
-                const createStore = await resolvePrivateLocalCreateStore(invocationRoot, requestId);
+                const creator = { agentId: createdBy, sessionId: createdBySessionId };
+                const createStore = await resolvePrivateLocalCreateStore(invocationRoot, requestId, creator);
                 signal.throwIfAborted();
                 ensureRunning();
                 const databasePath = createStore.databasePath;
@@ -1045,6 +1056,7 @@ serviceNative, onExecApprovalDecision = () => undefined) {
                             createRequestId: requestId,
                             name,
                             createdBy,
+                            createdBySessionId,
                             mode: creatorProfile.mode,
                             folder: creatorProfile.folder,
                             agentControl: directory(invocationRoot),

package/dist/private-local-service-termination.js

@@ -1,5 +1,5 @@
 import { setTimeout as delay } from "node:timers/promises";
-import { readProcessStart } from "./private-local-process-identity.js";
+import { identifyLocalServiceProcess } from "./private-local-process-identity.js";
 import { readServiceLeaseOwner, } from "./private-local-service-lease.js";
 /** How long a SIGTERM'd service may drain its owners before it is killed. */
 const terminationGraceMs = 5_000;
@@ -8,11 +8,11 @@ const terminationPollMs = 50;
  * Whether `service` is still the process running under its PID. A PID whose
  * start differs is refused. A separate read and signal still has a race window.
  */
-async function isServiceProcess(service) {
-    const current = await readProcessStart(service.pid);
-    if (current.kind === "unverifiable")
-        throw new Error(`Fungi cannot verify the service process ${String(service.pid)} with sub-second precision on ${process.platform}, so it refuses to signal it. Close that service manually, then reopen Fungi.`);
-    return current.kind === "running" && current.start === service.startedAt;
+async function isServiceProcess(directory, service) {
+    const current = await identifyLocalServiceProcess({ ...service, directory });
+    if (current.kind === "other" && process.platform !== "linux")
+        throw new Error(`Cannot safely stop Fungi service pid ${String(service.pid)} in ${directory}: its command line does not identify this service. No process was signalled.`);
+    return current.kind === "ours";
 }
 /** Signal `pid`; false when it has already exited. */
 function signalService(pid, signal) {
@@ -33,12 +33,13 @@ async function signalIfStillRunning(directory, service, signal) {
     const owner = await readServiceLeaseOwner(directory);
     if (owner?.pid !== service.pid || owner.startedAt !== service.startedAt)
         return false;
-    return (await isServiceProcess(owner)) && signalService(owner.pid, signal);
+    return ((await isServiceProcess(directory, owner)) &&
+        signalService(owner.pid, signal));
 }
-async function exitedWithin(service, ms) {
+async function exitedWithin(directory, service, ms) {
     const deadline = Date.now() + ms;
     for (;;) {
-        if (!(await isServiceProcess(service)))
+        if (!(await isServiceProcess(directory, service)))
             return true;
         if (Date.now() >= deadline)
             return false;
@@ -57,11 +58,11 @@ export async function terminatePrivateLocalService(directory, service) {
         throw new Error("The Fungi service runs inside this process; stop it from within instead of with fungi stop.");
     if (!(await signalIfStillRunning(directory, service, "SIGTERM")))
         return "stopped";
-    if (await exitedWithin(service, terminationGraceMs))
+    if (await exitedWithin(directory, service, terminationGraceMs))
         return "stopped";
     if (!(await signalIfStillRunning(directory, service, "SIGKILL")))
         return "stopped";
-    if (await exitedWithin(service, terminationGraceMs))
+    if (await exitedWithin(directory, service, terminationGraceMs))
         return "killed";
     throw new Error(`Local service process ${String(service.pid)} is still running after SIGKILL`);
 }

package/dist/private-local-service.js

@@ -4,6 +4,7 @@ import { readBoundedResponse } from "./private-bounded-response.js";
 import { LocalSandboxUnavailable, sandboxUnavailableReasonSchema, } from "./private-local-containment.js";
 export { LocalSandboxUnavailable } from "./private-local-containment.js";
 import { capturePrivateLocalConfigRoot } from "./private-local-config-root.js";
+import { takePendingExtensionArchiveNotices } from "./private-local-extension-archive-notice.js";
 import { stopAllResultSchema } from "./private-local-stop-all.js";
 import { LocalAgentSelectionAmbiguous, LocalSessionPathConflict, } from "./private-local-service-owner.js";
 export { LocalAgentSelectionAmbiguous, LocalSessionPathConflict, } from "./private-local-service-owner.js";
@@ -111,6 +112,16 @@ export function createPrivateLocalServiceManager(options = {}) {
         ? capturePrivateLocalExecPath(process.env.PATH ?? "/usr/bin:/bin", process.cwd())
         : parsePrivateLocalExecPath(options.executionPath);
     const expectedVersion = privateLocalServiceVersion();
+    async function reportPendingExtensionArchiveNotices() {
+        try {
+            const notices = await takePendingExtensionArchiveNotices(root.home);
+            for (const notice of notices)
+                process.stderr.write(`${notice}\n`);
+        }
+        catch (cause) {
+            logEvent("extension.archive-notice", cause);
+        }
+    }
     /**
      * Set once this client has reached a service. Only a starting client
      * replaces a service speaking another protocol. Same-protocol build changes
@@ -344,6 +355,7 @@ export function createPrivateLocalServiceManager(options = {}) {
         request.signal?.throwIfAborted();
         const service = await start(request);
         const selected = await postSelection(endpoint, input, service, request.signal);
+        await reportPendingExtensionArchiveNotices();
         const firstBase = routeBase(service, selected);
         /**
          * Where this connection's client currently talks. A restarted service

package/dist/private-local-session-discovery.d.ts

@@ -17,6 +17,12 @@ export declare function unreadableStoreReason(agentId: string): string;
  */
 export declare function isArchivedStore(path: string): boolean;
 export declare function listPrivateLocalAgentStores(root: string, visibility?: LocalStoreVisibility): Promise<readonly string[]>;
+/** Entry-preserving survey: a symlink is archived as a link, not its target. */
+export declare function probePrivateLocalAgentStoreEntries(home: string, maximum?: number): Promise<readonly Readonly<{
+    agentId: string;
+    entry: string;
+    databasePath: string;
+}>[]>;
 /** A Local or Woodstock store outside the current schema; Local never migrates it. */
 export declare class LocalStoreSchemaError extends Error {
     readonly databasePath: string;

package/dist/private-local-session-discovery.js

@@ -102,6 +102,37 @@ export async function listPrivateLocalAgentStores(root, visibility = "active") {
     }
     return [...paths];
 }
+/** Entry-preserving survey: a symlink is archived as a link, not its target. */
+export async function probePrivateLocalAgentStoreEntries(home, maximum = 512) {
+    const directory = join(home, ".fungi", "agents");
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch (cause) {
+        if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+            return [];
+        throw cause;
+    }
+    const stores = entries.filter((entry) => entry.isDirectory() || entry.isSymbolicLink());
+    if (stores.length > maximum)
+        throw new Error(`Fungi cannot survey ${String(stores.length)} Agent stores (maximum ${String(maximum)})`);
+    const candidates = [];
+    for (const store of stores) {
+        const entry = join(directory, store.name);
+        const databasePath = join(entry, "agent.sqlite");
+        try {
+            if ((await stat(databasePath)).isFile())
+                candidates.push({ agentId: store.name, entry, databasePath });
+        }
+        catch (cause) {
+            if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+                continue;
+            throw cause;
+        }
+    }
+    return candidates;
+}
 const storedProfileSchema = z.strictObject({
     name: z.string().nullable(),
     createdBy: z.string().nullable(),

package/dist/private-mcp-form-contract.d.ts

@@ -51,6 +51,7 @@ declare const answerResult: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"policy">;
             }>]>>;
             readonly reason: Schema.NullOr<Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>>;
+            readonly denialNote: Schema.optionalKey<Schema.String>;
             readonly requestedAt: Schema.Int;
             readonly expiresAt: Schema.Int;
             readonly updatedAt: Schema.Int;
@@ -62,6 +63,7 @@ declare const answerResult: Schema.Union<readonly [Schema.Struct<{
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"refused">;
     readonly reason: Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>;
+    readonly denialNote: Schema.optionalKey<Schema.String>;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"submitted">;
 }>, Schema.Struct<{
@@ -79,6 +81,7 @@ export declare const mcpFormApprovalContract: {
                 readonly id: Schema.String;
                 readonly decision: Schema.Literals<readonly ["approve", "deny", "always-allow"]>;
                 readonly expectedRevision: Schema.Int;
+                readonly denialNote: Schema.optionalKey<Schema.String>;
             }>;
             output: Schema.Union<readonly [Schema.Struct<{
                 readonly kind: Schema.Literal<"answered">;
@@ -115,6 +118,7 @@ export declare const mcpFormApprovalContract: {
                             readonly kind: Schema.Literal<"policy">;
                         }>]>>;
                         readonly reason: Schema.NullOr<Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>>;
+                        readonly denialNote: Schema.optionalKey<Schema.String>;
                         readonly requestedAt: Schema.Int;
                         readonly expiresAt: Schema.Int;
                         readonly updatedAt: Schema.Int;
@@ -126,6 +130,7 @@ export declare const mcpFormApprovalContract: {
             }>, Schema.Struct<{
                 readonly kind: Schema.Literal<"refused">;
                 readonly reason: Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>;
+                readonly denialNote: Schema.optionalKey<Schema.String>;
             }>, Schema.Struct<{
                 readonly kind: Schema.Literal<"submitted">;
             }>, Schema.Struct<{
@@ -171,6 +176,7 @@ export declare const mcpFormApprovalContract: {
                             readonly kind: Schema.Literal<"policy">;
                         }>]>>;
                         readonly reason: Schema.NullOr<Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>>;
+                        readonly denialNote: Schema.optionalKey<Schema.String>;
                         readonly requestedAt: Schema.Int;
                         readonly expiresAt: Schema.Int;
                         readonly updatedAt: Schema.Int;
@@ -183,10 +189,17 @@ export declare const mcpFormApprovalContract: {
                     readonly command: Schema.String;
                     readonly cwd: Schema.String;
                     readonly justification: Schema.String;
+                    readonly form: Schema.Literals<readonly ["direct", "shell"]>;
+                    readonly kind: Schema.Literals<readonly ["exec", "extension-install"]>;
+                    readonly argv: Schema.optionalKey<Schema.$Array<Schema.String>>;
                     readonly prefix: Schema.optionalKey<Schema.$Array<Schema.String>>;
                     readonly warning: Schema.optionalKey<Schema.String>;
                     readonly alwaysAllowCoverage: Schema.optionalKey<Schema.String>;
                     readonly alwaysAllowUnavailableReason: Schema.optionalKey<Schema.String>;
+                    readonly risk: Schema.optionalKey<Schema.Struct<{
+                        readonly summary: Schema.String;
+                        readonly detail: Schema.String;
+                    }>>;
                 }>>;
             }>>;
         }>;

package/dist/private-mcp-form-contract.js

@@ -1,6 +1,6 @@
 import { ExtensionId, } from "@fungi.computer/shiitake/extensions";
 import * as Schema from "effect/Schema";
-import { ApprovalAnswerInputSchema, ApprovalRefusalSchema, ApprovalViewSchema, } from "@fungi.computer/approvals";
+import { ApprovalAnswerInputSchema, ApprovalDenialNoteSchema, ApprovalRefusalSchema, ApprovalViewSchema, } from "@fungi.computer/approvals";
 /** The actual MCP form, not a ledger record or an authorization decision. */
 export const McpFormApprovalRequestSchema = Schema.Struct({
     message: Schema.String,
@@ -36,10 +36,14 @@ const McpFormPendingSchema = Schema.Struct({
         command: Schema.String,
         cwd: Schema.String,
         justification: Schema.String,
+        form: Schema.Literals(["direct", "shell"]),
+        kind: Schema.Literals(["exec", "extension-install"]),
+        argv: Schema.optionalKey(Schema.Array(Schema.String)),
         prefix: Schema.optionalKey(Schema.Array(Schema.String)),
         warning: Schema.optionalKey(Schema.String),
         alwaysAllowCoverage: Schema.optionalKey(Schema.String),
         alwaysAllowUnavailableReason: Schema.optionalKey(Schema.String),
+        risk: Schema.optionalKey(Schema.Struct({ summary: Schema.String, detail: Schema.String })),
     })),
 });
 /** The existing Session extension slot carries only display-safe form data. */
@@ -52,6 +56,7 @@ export const mcpFormApprovalContract = {
                 id: Schema.String,
                 decision: Schema.Literals(["approve", "deny", "always-allow"]),
                 expectedRevision: ApprovalAnswerInputSchema.fields.expectedRevision,
+                denialNote: Schema.optionalKey(ApprovalDenialNoteSchema),
             }),
             output: answerResult,
         },

package/dist/private-mcp-form-session.d.ts

@@ -5,10 +5,17 @@ export type LocalApprovalReview = {
     command: string;
     cwd: string;
     justification: string;
+    form: "direct" | "shell";
+    kind: "exec" | "extension-install";
+    argv?: string[];
     prefix?: readonly string[];
     warning?: string;
     alwaysAllowCoverage?: string;
     alwaysAllowUnavailableReason?: string;
+    risk?: {
+        summary: string;
+        detail: string;
+    };
 };
 type Pending = {
     sessionId: string;
@@ -27,6 +34,7 @@ export declare function createMcpFormSession(): {
                 readonly id: import("effect/Schema").String;
                 readonly decision: import("effect/Schema").Literals<readonly ["approve", "deny", "always-allow"]>;
                 readonly expectedRevision: import("effect/Schema").Int;
+                readonly denialNote: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             }>;
             output: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
                 readonly kind: import("effect/Schema").Literal<"answered">;
@@ -63,6 +71,7 @@ export declare function createMcpFormSession(): {
                             readonly kind: import("effect/Schema").Literal<"policy">;
                         }>]>>;
                         readonly reason: import("effect/Schema").NullOr<import("effect/Schema").Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>>;
+                        readonly denialNote: import("effect/Schema").optionalKey<import("effect/Schema").String>;
                         readonly requestedAt: import("effect/Schema").Int;
                         readonly expiresAt: import("effect/Schema").Int;
                         readonly updatedAt: import("effect/Schema").Int;
@@ -74,6 +83,7 @@ export declare function createMcpFormSession(): {
             }>, import("effect/Schema").Struct<{
                 readonly kind: import("effect/Schema").Literal<"refused">;
                 readonly reason: import("effect/Schema").Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>;
+                readonly denialNote: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             }>, import("effect/Schema").Struct<{
                 readonly kind: import("effect/Schema").Literal<"submitted">;
             }>, import("effect/Schema").Struct<{
@@ -115,6 +125,7 @@ export declare function createMcpFormSession(): {
                     readonly expiresAt: number;
                     readonly updatedAt: number;
                     readonly revision: number;
+                    readonly denialNote?: string;
                     readonly evidence?: readonly {
                         readonly kind: "artifact";
                         readonly ref: string;
@@ -126,13 +137,20 @@ export declare function createMcpFormSession(): {
                 readonly canSetAutoApprove: boolean;
             };
             readonly review?: {
+                readonly kind: "exec" | "extension-install";
+                readonly form: "direct" | "shell";
                 readonly command: string;
                 readonly cwd: string;
                 readonly justification: string;
+                readonly argv?: readonly string[];
                 readonly prefix?: readonly string[];
                 readonly warning?: string;
                 readonly alwaysAllowCoverage?: string;
                 readonly alwaysAllowUnavailableReason?: string;
+                readonly risk?: {
+                    readonly summary: string;
+                    readonly detail: string;
+                };
             };
         }[];
     }, {
@@ -169,6 +187,7 @@ export declare function createMcpFormSession(): {
                     readonly expiresAt: number;
                     readonly updatedAt: number;
                     readonly revision: number;
+                    readonly denialNote?: string;
                     readonly evidence?: readonly {
                         readonly kind: "artifact";
                         readonly ref: string;
@@ -180,13 +199,20 @@ export declare function createMcpFormSession(): {
                 readonly canSetAutoApprove: boolean;
             };
             readonly review?: {
+                readonly kind: "exec" | "extension-install";
+                readonly form: "direct" | "shell";
                 readonly command: string;
                 readonly cwd: string;
                 readonly justification: string;
+                readonly argv?: readonly string[];
                 readonly prefix?: readonly string[];
                 readonly warning?: string;
                 readonly alwaysAllowCoverage?: string;
                 readonly alwaysAllowUnavailableReason?: string;
+                readonly risk?: {
+                    readonly summary: string;
+                    readonly detail: string;
+                };
             };
         }[];
     }>;

package/dist/private-mcp-form-session.js

@@ -49,15 +49,18 @@ export function createMcpFormSession() {
                             if (input.decision === "always-allow" &&
                                 entry.alwaysAllow === undefined)
                                 return { kind: "refused", reason: "not-pending" };
+                            if (input.denialNote !== undefined && input.decision !== "deny")
+                                return { kind: "refused", reason: "not-pending" };
                             if (input.decision === "always-allow")
                                 entry.alwaysAllow?.("prefix");
-                            const result = await entry.approvals.answer({
+                            const answer = {
                                 recordId: entry.approval.record.recordId,
-                                decision: input.decision === "always-allow"
-                                    ? "approve"
-                                    : input.decision,
+                                decision: input.decision === "deny" ? "deny" : "approve",
                                 expectedRevision: input.expectedRevision,
-                            });
+                            };
+                            const result = await entry.approvals.answer(input.denialNote === undefined
+                                ? answer
+                                : { ...answer, denialNote: input.denialNote });
                             return result;
                         }
                         finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/truffle",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "private": false,
   "description": "Truffle: Fungi's local Agent runtime, bundled into the fungi command",
   "type": "module",
@@ -50,6 +50,10 @@
       "types": "./dist/local-extensions.d.ts",
       "import": "./dist/local-extensions.js"
     },
+    "./upgrade": {
+      "types": "./dist/local-upgrade.d.ts",
+      "import": "./dist/local-upgrade.js"
+    },
     "./rules": {
       "types": "./dist/private-local-exec-rules.d.ts",
       "import": "./dist/private-local-exec-rules.js"
@@ -65,26 +69,26 @@
     "@cf-wasm/photon": "0.4.0",
     "@earendil-works/pi-ai": "1.3.0",
     "@effect/platform-node": "4.0.2",
-    "@fungi.computer/agar": "0.3.1",
-    "@fungi.computer/approvals": "0.1.0",
-    "@fungi.computer/bird-dog": "0.2.0",
+    "@fungi.computer/agar": "0.4.0",
+    "@fungi.computer/approvals": "0.2.0",
+    "@fungi.computer/bird-dog": "0.2.1",
     "@fungi.computer/cairn": "0.1.0",
     "@fungi.computer/capnweb": "0.12.0",
     "@fungi.computer/carrier": "0.2.0",
     "@fungi.computer/cordyceps": "0.4.0",
     "@fungi.computer/gills": "0.2.0",
-    "@fungi.computer/graft": "0.1.2",
-    "@fungi.computer/knapsack": "0.3.0",
+    "@fungi.computer/graft": "0.1.3",
+    "@fungi.computer/knapsack": "0.3.1",
     "@fungi.computer/lantern": "0.3.0",
     "@fungi.computer/mycelium": "0.2.2",
-    "@fungi.computer/nacre": "0.0.2",
+    "@fungi.computer/nacre": "0.0.3",
     "@fungi.computer/seam": "0.2.0",
-    "@fungi.computer/shiitake": "0.4.0",
-    "@fungi.computer/shiitake-extensions": "0.2.0",
-    "@fungi.computer/veil": "0.2.0",
+    "@fungi.computer/shiitake": "0.5.0",
+    "@fungi.computer/shiitake-extensions": "0.3.0",
+    "@fungi.computer/veil": "0.2.1",
     "@fungi.computer/watchdog": "0.1.0",
-    "@fungi.computer/whistle": "0.1.0",
-    "@fungi.computer/zookeeper": "0.0.3",
+    "@fungi.computer/whistle": "0.2.0",
+    "@fungi.computer/zookeeper": "0.0.4",
     "@jellybrick/dbus-next": "0.11.4",
     "@modelcontextprotocol/client": "2.0.0",
     "@napi-rs/keyring": "2.1.2",
@@ -97,6 +101,8 @@
     "miniflare": "5.20260828.0-alpha",
     "proper-lockfile": "4.1.2",
     "re2js": "1.3.3",
+    "semver": "7.8.5",
+    "shell-quote": "1.10.0",
     "write-file-atomic": "8.0.0",
     "yaml": "2.9.0",
     "zod": "4.4.3"
@@ -107,6 +113,7 @@
     "@modelcontextprotocol/server": "2.0.0",
     "@types/node": "24.13.3",
     "@types/proper-lockfile": "4.1.4",
+    "@types/semver": "7.8.0",
     "@types/write-file-atomic": "4.0.3",
     "bun": "1.4.2",
     "bun-types": "1.4.1",
@@ -154,7 +161,7 @@
     "test:node": "../../node_modules/.bin/vitest run",
     "test:bun": "pnpm run test:mesh-link && pnpm run test:bun:batch && bun test ./test/private-workerd-deadline.bun.test.ts",
     "test:mesh-link": "bun test ./test/private-local-mesh-links.bun.test.ts",
-    "test:bun:batch": "bun test ./test/private-sqlite-approval-driver.bun.test.ts ./test/mcp-form-service.bun.test.ts ./test/private-local-service-discovery.bun.test.ts ./test/private-local-service-listener.bun.test.ts ./test/private-local-service-manager.bun.test.ts ./test/private-local-service-rebind.bun.test.ts ./test/private-local-service-stop.bun.test.ts ./test/private-local-service-ensure.bun.test.ts ./test/private-local-service-identity.bun.test.ts ./test/private-local-service-kill-resume.bun.test.ts ./test/private-local-service-idle-owners.bun.test.ts ./test/private-local-service-idle-delegation.bun.test.ts ./test/private-local-mail-retry.bun.test.ts ./test/private-local-service-log-native.bun.test.ts ./test/private-local-service-log.bun.test.ts ./test/private-local-sqlite-lifetime.bun.test.ts ./test/private-sqlite-driver.bun.test.ts ./test/private-local-reload.bun.test.ts ./test/private-local-auth-rpc.bun.test.ts ./test/private-workerd-forage.bun.test.ts ./test/local-extensions.bun.test.ts ./test/local-zookeeper-slot.bun.test.ts ./test/local-extension-skills.bun.test.ts ./test/private-local-sandbox-service.bun.test.ts ./test/private-local-native-service.bun.test.ts",
+    "test:bun:batch": "bun test ./test/private-sqlite-approval-driver.bun.test.ts ./test/mcp-form-service.bun.test.ts ./test/private-local-service-discovery.bun.test.ts ./test/private-local-service-listener.bun.test.ts ./test/private-local-service-manager.bun.test.ts ./test/private-local-service-rebind.bun.test.ts ./test/private-local-service-stop.bun.test.ts ./test/private-local-service-ensure.bun.test.ts ./test/private-local-service-identity.bun.test.ts ./test/private-local-service-kill-resume.bun.test.ts ./test/private-local-service-idle-owners.bun.test.ts ./test/private-local-service-idle-delegation.bun.test.ts ./test/private-local-mail-retry.bun.test.ts ./test/private-local-service-log-native.bun.test.ts ./test/private-local-service-log.bun.test.ts ./test/private-local-sqlite-lifetime.bun.test.ts ./test/private-sqlite-driver.bun.test.ts ./test/private-local-reload.bun.test.ts ./test/private-local-auth-rpc.bun.test.ts ./test/private-workerd-forage.bun.test.ts ./test/local-extensions.bun.test.ts ./test/local-extension-archive.bun.test.ts ./test/local-zookeeper-slot.bun.test.ts ./test/local-extension-skills.bun.test.ts ./test/private-local-sandbox-service.bun.test.ts ./test/private-local-native-service.bun.test.ts",
     "build:native": "fungi-apply-patch-build --out native/bin && node scripts/build-bwrap.mjs --out native/bin && node scripts/generate-native-digests.mjs",
     "test:patch": "node --test --test-timeout=30000 test/apply-patch.native.mjs",
     "test:sandbox:linux": "node --import tsx test/fixtures/local-sandbox-proof.mts",