@fungi.computer/truffle 0.4.0 → 0.6.0

package/dist/private-local-delegation.js

@@ -1,5 +1,6 @@
+import * as Effect from "effect/Effect";
 import { AgentArchiveRefused } from "@fungi.computer/shiitake/agent-control";
-import { agentDelegationRequestKey, createFleetDelegation, delegationProvenance, delegationReplyMeta, delegationSendMeta, } from "@fungi.computer/shiitake/fleet";
+import { agentDelegationRequestKey, createFleetDelegation, delegationProvenance, delegationReplyMeta, delegationSendMeta, isOneWayAncestorNotice, } from "@fungi.computer/shiitake/fleet";
 /** How long one Local delegation grant stays valid while it is admitted. */
 const grantLifetimeMs = 60_000;
 /**
@@ -31,7 +32,67 @@ export function createPrivateLocalDelegation(input) {
         }
         return agents;
     }
-    /** Send with one caller-owned identity; follow-up replies return here. */
+    /**
+     * Items a child left waiting on this Agent, by the reply command that told
+     * it. When the work that carried the reply ends, whatever the Agent neither
+     * answered nor escalated goes to a person, so no waiting item is silent.
+     */
+    const unattended = new Map();
+    let poll;
+    /** Escalate the items of every reply whose carrying work has settled. */
+    async function settleUnattended() {
+        const handling = input.unattended;
+        if (handling === undefined)
+            return;
+        for (const [commandId, entry] of unattended) {
+            const settlement = await handling
+                .readSettlement(entry.sessionId, commandId)
+                .catch((cause) => {
+                // Not settled as far as anyone can tell; try again on the next poll.
+                Effect.runFork(Effect.logWarning("delegation.settlement", cause));
+                return undefined;
+            });
+            if (settlement === undefined)
+                continue;
+            unattended.delete(commandId);
+            for (const itemId of entry.items)
+                await handling
+                    .escalate({ ...entry.child, itemId }, entry.sessionId)
+                    .catch((cause) => {
+                    Effect.runFork(Effect.logWarning("delegation.escalate", cause));
+                });
+        }
+        if (unattended.size === 0 && poll !== undefined) {
+            clearInterval(poll);
+            poll = undefined;
+        }
+    }
+    function watchUnattended(accepted, receiverSessionId, reply) {
+        if (input.unattended === undefined ||
+            reply.outcome === "undeliverable" ||
+            reply.waitingOnYou === undefined)
+            return;
+        if (receiverSessionId === undefined)
+            return;
+        unattended.set(accepted.commandId, {
+            sessionId: receiverSessionId,
+            child: { agentId: reply.agentId, sessionId: reply.sessionId },
+            items: reply.waitingOnYou.map(({ itemId }) => itemId),
+        });
+        poll ??= setInterval(() => {
+            void settleUnattended();
+        }, 1_000);
+        poll.unref();
+    }
+    /** Escalate what is owed now and stop watching; the Agent is closing. */
+    async function close() {
+        await settleUnattended();
+        unattended.clear();
+        if (poll !== undefined)
+            clearInterval(poll);
+        poll = undefined;
+    }
+    /** Send with one caller-owned identity; follow-up and steer replies return here. */
     async function send(task, sourceSessionId, signal, invocation) {
         if (invocation === undefined)
             throw new Error("Delegation requires a tool invocation");
@@ -43,37 +104,31 @@ export function createPrivateLocalDelegation(input) {
             requestId: task.requestId,
         });
         signal.throwIfAborted();
-        if (task.delivery === "steer") {
-            const opened = await input.directory.open(task.agentId, signal);
-            try {
-                return await opened.agent.session(task.sessionId).send(task.text, {
-                    requestId,
-                    delivery: "steer",
-                });
-            }
-            finally {
-                await opened.release();
-            }
-        }
-        const meta = delegationSendMeta({ id: input.agentId, name: input.agentId }, invocation.meta);
+        // A person reads this name where work waits on its sender.
+        const sender = agents.find(({ agentId }) => agentId === input.agentId);
+        const meta = delegationSendMeta({ id: input.agentId, name: sender?.name ?? input.agentId }, invocation.meta);
         // The caller's request key owns replay, not the current model program's bytes.
         const provenance = await delegationProvenance({
             agentId: input.agentId,
             sessionId: sourceSessionId,
         });
         signal.throwIfAborted();
+        let delegation = {
+            agentId: task.agentId,
+            sessionId: task.sessionId,
+            delivery: task.delivery,
+            text: task.text,
+            requestId,
+        };
+        if (task.delivery === "followUp" && task.goal !== undefined)
+            delegation = { ...delegation, goal: task.goal };
         return fleet.start({
             agents: agents.map(({ agentId }) => agentId),
             actions: ["delegate"],
             expiresAt: Date.now() + grantLifetimeMs,
             provenance,
             meta,
-        }, {
-            agentId: task.agentId,
-            sessionId: task.sessionId,
-            text: task.text,
-            requestId,
-        });
+        }, delegation);
     }
     /** Resolve only this sender's receipt, then let the target own the pending guard. */
     async function recall(task, sourceSessionId, signal) {
@@ -105,9 +160,8 @@ export function createPrivateLocalDelegation(input) {
         }
     }
     /**
-     * Admit one mail addressed to this Agent. New work must name its sender as
-     * its only reply destination; a reply-less mail is admitted only as an
-     * authenticated reply. Everything else is refused.
+     * Admit delegated work, one-way ancestor notices and authenticated replies.
+     * Other reply-less mail is refused.
      */
     async function receive(mail) {
         const mesh = await input.meshAdmission?.(mail.to.agentId);
@@ -135,6 +189,8 @@ export function createPrivateLocalDelegation(input) {
                 throw new Error("Local delegated work must reply to its sender");
             return input.accept(mail, mail.meta);
         }
+        if (isOneWayAncestorNotice(mail))
+            return input.accept(mail, mail.meta);
         if (mail.reply?.outcome === "accepted") {
             const receipt = fleet.recordAcceptedNotice(mail);
             if (receipt === undefined)
@@ -147,7 +203,9 @@ export function createPrivateLocalDelegation(input) {
         if (replier === undefined && !authenticatedUndeliverable)
             throw new Error("Local reply sender is outside this project");
         const meta = delegationReplyMeta(delegation, replier?.name ?? delegation.reply.agentId);
-        return input.accept({ ...mail, meta }, meta, delegation.reply);
+        const accepted = await input.accept({ ...mail, meta }, meta, delegation.reply);
+        watchUnattended(accepted, mail.to.sessionId, delegation.reply);
+        return accepted;
     }
-    return { send, recall, receive, outstanding: fleet.outstanding };
+    return { send, recall, receive, close, outstanding: fleet.outstanding };
 }

package/dist/private-local-exec-environment.d.ts

@@ -1,3 +1,6 @@
+import { z } from "zod";
+/** Shared admission for shell/direct run and managed start. */
+export declare const privateLocalExecEnvironmentInput: z.ZodRecord<z.ZodString, z.ZodString>;
 /**
  * The only host variables a Local exec child receives besides its selected
  * PATH and HOME. Exec runs as the host's own user, so that user's session
@@ -5,7 +8,7 @@
  * `loginctl` and other user-service tools need to find the user manager.
  * Every other host variable, credentials included, stays out.
  */
-export type PrivateLocalExecEnvironment = {
+export type PrivateLocalExecEnvironment = Record<string, string> & {
     PATH: string;
     HOME: string;
     XDG_RUNTIME_DIR?: string;
@@ -13,4 +16,4 @@ export type PrivateLocalExecEnvironment = {
 };
 export declare function privateLocalExecEnvironment(executionPath: string, host: NodeJS.ProcessEnv & {
     HOME: string;
-}): PrivateLocalExecEnvironment;
+}, extra?: Readonly<Record<string, string>>): PrivateLocalExecEnvironment;

package/dist/private-local-exec-environment.js

@@ -1,5 +1,39 @@
-export function privateLocalExecEnvironment(executionPath, host) {
+import { z } from "zod";
+// Extras reach the native sandbox launcher too; its loader controls stay owned
+// by the host rather than loading model-selected code before containment.
+const hostOwnedNames = new Set([
+    "PATH",
+    "HOME",
+    "XDG_RUNTIME_DIR",
+    "DBUS_SESSION_BUS_ADDRESS",
+    "TMPDIR",
+    "SSH_AUTH_SOCK",
+    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
+    "FUNGI_SANDBOX",
+    "FUNGI_SANDBOX_NETWORK_DISABLED",
+    "GLIBC_TUNABLES",
+    "GCONV_PATH",
+    "LOCPATH",
+]);
+const environmentName = z
+    .string()
+    .regex(/^[A-Z_][A-Z0-9_]*$/u)
+    .refine((name) => !hostOwnedNames.has(name) &&
+    !name.startsWith("LD_") &&
+    !name.startsWith("DYLD_"), "Host-owned environment variable");
+/** Shared admission for shell/direct run and managed start. */
+export const privateLocalExecEnvironmentInput = z
+    .record(environmentName, z
+    .string()
+    .max(1_024)
+    .regex(/^[^\0]*$/u, "Environment values cannot contain NUL"))
+    .refine((environment) => Object.keys(environment).length <= 64, {
+    message: "Exec env accepts at most 64 variables",
+})
+    .describe("Up to 64 extra string variables, each at most 1024 UTF-16 code units, with uppercase ASCII names (letters, digits and underscores; no leading digit). Host-owned names, including HOME, PATH, session/sandbox locators and dynamic-loader controls, are refused.");
+export function privateLocalExecEnvironment(executionPath, host, extra = {}) {
     const environment = {
+        ...extra,
         PATH: executionPath,
         HOME: host.HOME,
     };

package/dist/private-local-exec-review.js

@@ -1,5 +1,6 @@
-import { gitRuleCoverage, rulePrefix } from "./private-local-exec-rules.js";
-import { quote } from "shell-quote";
+import * as Result from "effect/Result";
+import { gitRuleCoverage, hasExtensionInstallRisk, rulePrefix, } from "./private-local-exec-rules.js";
+import { parse, quote } from "shell-quote";
 const gitHookGrantSubcommands = new Set([
     "add",
     "branch",
@@ -25,6 +26,12 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
         ? undefined
         : [request.executable, ...(request.args ?? [])];
     const command = request.command ?? quote(argv ?? []);
+    // Literal shell tokens only add the extension risk note. They never turn
+    // shell text into argv, establish command identity, or permit a saved rule.
+    // Opaque shell text keeps its existing once-only generic review.
+    const words = argv ??
+        Result.getOrElse(Result.try(() => parse(command, {})), () => []);
+    const extensionInstall = hasExtensionInstallRisk(words, argv === undefined ? "shell" : "direct");
     const prefix = argv === undefined || (argv[0] === "git" && gitGrant === undefined)
         ? undefined
         : rulePrefix(argv, gitGrant?.configuredRemotes);
@@ -33,9 +40,7 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
         cwd,
         justification: request.escape.justification,
         form: argv === undefined ? "shell" : "direct",
-        kind: argv?.[0] === "fungi" && argv[1] === "extension" && argv[2] === "add"
-            ? "extension-install"
-            : "exec",
+        kind: extensionInstall ? "extension-install" : "exec",
     };
     if (argv !== undefined)
         review.argv = argv;
@@ -44,7 +49,7 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
         review.alwaysAllowCoverage =
             prefix[0] === "git"
                 ? gitRuleCoverage(prefix[1] ?? "")
-                : `Direct argv commands beginning ${JSON.stringify(prefix)} in this project; shell commands still ask.`;
+                : `Direct argv commands beginning ${JSON.stringify(prefix)} in this project; shell commands${prefix[0] === "fungi" ? " and extension installs" : ""} still ask.`;
         if (prefix[0] === "git") {
             const hookCapable = gitHookGrantSubcommands.has(prefix[1] ?? "");
             const summary = (hookCapable
@@ -68,7 +73,9 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
             review.risk = { summary, detail };
         }
         else {
-            const summary = `Every \`${prefix.join(" ")} …\` command will run outside the sandbox, as you.`;
+            const summary = prefix[0] === "fungi"
+                ? `Matching \`${prefix.join(" ")} …\` commands run outside the sandbox, as you. Extension installs still ask.`
+                : `Every \`${prefix.join(" ")} …\` command will run outside the sandbox, as you.`;
             review.risk = { summary, detail: summary };
         }
     }

package/dist/private-local-exec-rules.d.ts

@@ -1,3 +1,10 @@
+import type { ParseEntry } from "shell-quote";
+/**
+ * Conservative literal risk, not CLI parsing or executable identity. Global
+ * options can occur among positionals. Shell tokens may disclose risk, but
+ * only actual direct argv ever reaches the reusable-grant matcher.
+ */
+export declare function hasExtensionInstallRisk(words: readonly ParseEntry[], form: "direct" | "shell"): boolean;
 /** Offer only direct commands that this same matcher can authorize. */
 export declare function rulePrefix(argv: readonly string[], configuredRemotes?: ReadonlySet<string>): string[] | undefined;
 /** Text for the same Git option profile that gates matching, not a second list. */

package/dist/private-local-exec-rules.js

@@ -2,6 +2,27 @@ import { lstatSync, mkdirSync, readFileSync, renameSync, rmdirSync, writeFileSyn
 import { basename, join } from "node:path";
 import { correlationKey, defineIdFamily } from "@fungi.computer/cairn";
 import { z } from "zod";
+function fungiWord(word) {
+    const parsed = z.string().safeParse(word);
+    return parsed.success && basename(parsed.data) === "fungi";
+}
+/**
+ * Conservative literal risk, not CLI parsing or executable identity. Global
+ * options can occur among positionals. Shell tokens may disclose risk, but
+ * only actual direct argv ever reaches the reusable-grant matcher.
+ */
+export function hasExtensionInstallRisk(words, form) {
+    const executable = form === "direct"
+        ? fungiWord(words[0])
+            ? 0
+            : -1
+        : words.findIndex(fungiWord);
+    if (executable < 0)
+        return false;
+    const extension = words.findIndex((word, index) => index > executable && word === "extension");
+    return (extension >= 0 &&
+        words.some((word, index) => index > extension && word === "add"));
+}
 const prefixSchema = z.array(z.string().min(1).max(4096)).min(1).max(32);
 const projectRuleIds = defineIdFamily({
     family: "local-exec-rules",
@@ -264,9 +285,7 @@ export function rulePrefix(argv, configuredRemotes) {
             ? prefix
             : undefined;
     }
-    if (basename(argv[0] ?? "") === "fungi" &&
-        argv[1] === "extension" &&
-        argv[2] === "add")
+    if (hasExtensionInstallRisk(argv, "direct"))
         return undefined;
     const parsed = prefixSchema.safeParse(argv.slice(0, 2));
     return parsed.success && validPrefix(parsed.data) ? parsed.data : undefined;
@@ -416,9 +435,7 @@ export function localExecRules(project) {
     };
     const match = (argv, configuredRemotes) => {
         if (unsafeExecutable(argv[0] ?? "") ||
-            (basename(argv[0] ?? "") === "fungi" &&
-                argv[1] === "extension" &&
-                argv[2] === "add"))
+            hasExtensionInstallRisk(argv, "direct"))
             return undefined;
         if (argv[0] === "git" && !safeGitCommand(argv, configuredRemotes))
             return undefined;

package/dist/private-local-extension-records.d.ts

@@ -7,6 +7,7 @@ export declare const activationsSchema: z.ZodObject<{
         revision: z.ZodString;
         capabilities: z.ZodArray<z.ZodEnum<{
             state: "state";
+            prompt: "prompt";
             attention: "attention";
             settled: "settled";
             send: "send";
@@ -15,7 +16,6 @@ export declare const activationsSchema: z.ZodObject<{
             projection: "projection";
             run_tools: "run_tools";
             files: "files";
-            prompt: "prompt";
             compaction_handoff: "compaction_handoff";
         }>>;
         skills: z.ZodBoolean;

package/dist/private-local-runtime-host.js

@@ -46,7 +46,7 @@ import { createPrivateInvocationFilesPort, } from "./private-invocation-files.js
 import { createLocalSkillSource } from "./local-skill-source.js";
 import { createPrivateWorkerdSandbox } from "./private-workerd-sandbox.js";
 import { createPrivateFungiMcpConnection, } from "./private-fungi-mcp-connection.js";
-import { createPrivateSqliteOwner, openPrivateWritableSqliteDatabase, } from "./private-sqlite-owner.js";
+import { createPrivateSqliteOwner, openPrivateWritableSqliteDatabase, storeWriteBusyTimeoutMs, } from "./private-sqlite-owner.js";
 import { createPrivateLocalMailRoom, hasPrivateLocalPendingMail, } from "./private-local-mail.js";
 import { createPrivateLocalDelegation, } from "./private-local-delegation.js";
 import { createPrivateLocalAgentControl, } from "./private-local-agent-control.js";
@@ -207,6 +207,30 @@ async function assertPrivateLocalReceiptFile(path, kind) {
         throw cause;
     }
 }
+function ensureReceiptTable(database) {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS ${localCreateReceiptTable} (
+      request_id TEXT PRIMARY KEY NOT NULL,
+      agent_id TEXT NOT NULL UNIQUE,
+      name TEXT,
+      created_by_agent_id TEXT,
+      created_by_session_id TEXT
+    ) WITHOUT ROWID
+  `);
+    const receiptColumns = database
+        .prepare(`PRAGMA table_info(${localCreateReceiptTable})`)
+        .all()
+        .map((column) => column.name);
+    if (!receiptColumns.includes("created_by_agent_id"))
+        database.exec(`ALTER TABLE ${localCreateReceiptTable} ADD COLUMN created_by_agent_id TEXT`);
+    if (!receiptColumns.includes("created_by_session_id"))
+        database.exec(`ALTER TABLE ${localCreateReceiptTable} ADD COLUMN created_by_session_id TEXT`);
+}
+function readReceiptRow(database, requestId) {
+    return database
+        .prepare(`SELECT agent_id, created_by_agent_id, created_by_session_id FROM ${localCreateReceiptTable} WHERE request_id = ?`)
+        .get(requestId);
+}
 /** Resolve an Agent create request through its durable Local receipt. */
 export async function resolvePrivateLocalCreateStore(root, requestId, creator) {
     if (requestId.length === 0 || requestId.length > 256)
@@ -229,27 +253,13 @@ export async function resolvePrivateLocalCreateStore(root, requestId, creator) {
     try {
         database.exec(`PRAGMA busy_timeout = ${String(receiptBusyTimeoutMs)}`);
         database.exec("BEGIN IMMEDIATE");
-        database.exec(`
-      CREATE TABLE IF NOT EXISTS ${localCreateReceiptTable} (
-        request_id TEXT PRIMARY KEY NOT NULL,
-        agent_id TEXT NOT NULL UNIQUE,
-        name TEXT,
-        created_by_agent_id TEXT,
-        created_by_session_id TEXT
-      ) WITHOUT ROWID
-    `);
-        const receiptColumns = database
-            .prepare(`PRAGMA table_info(${localCreateReceiptTable})`)
-            .all()
-            .map((column) => column.name);
-        if (!receiptColumns.includes("created_by_agent_id"))
-            database.exec(`ALTER TABLE ${localCreateReceiptTable} ADD COLUMN created_by_agent_id TEXT`);
-        if (!receiptColumns.includes("created_by_session_id"))
-            database.exec(`ALTER TABLE ${localCreateReceiptTable} ADD COLUMN created_by_session_id TEXT`);
-        const existing = database
-            .prepare(`SELECT agent_id, created_by_agent_id, created_by_session_id FROM ${localCreateReceiptTable} WHERE request_id = ?`)
-            .get(requestId);
+        ensureReceiptTable(database);
+        const existing = readReceiptRow(database, requestId);
         if (existing !== undefined) {
+            if (creatorAgentId !== undefined &&
+                (existing.created_by_agent_id === null ||
+                    existing.created_by_agent_id === undefined))
+                throw new AgentCreateRefused("request_conflict", "the Local Agent create receipt is unbound; use a fresh requestId");
             if (creatorAgentId !== undefined &&
                 (existing.created_by_agent_id !== creatorAgentId ||
                     existing.created_by_session_id !== creatorSessionId))
@@ -616,6 +626,13 @@ export function createPrivateLocalModelSource(models, providerId, modelId, provi
                     message.stopReason === "error" &&
                     modelFailure?.message === message &&
                     modelFailure.retryable,
+                retryAfterMs: (message) => modelFailure?.message === message &&
+                    modelFailure.rejection?.code === "rate-limit"
+                    ? modelFailure.rejection.retryAfterMs
+                    : undefined,
+                rejection: (message) => modelFailure?.message === message
+                    ? modelFailure.rejection
+                    : undefined,
                 failureReason: (message) => modelFailure?.message === message ? modelFailure.reason : undefined,
                 providerError: (message) => modelFailure?.message === message
                     ? modelFailure.providerError
@@ -637,7 +654,7 @@ export function createPrivateLocalModelSource(models, providerId, modelId, provi
                         const evidence = {
                             refusal: turn.refusal(),
                             upstream: upstream ?? partial,
-                            rejection: provider.rejection(),
+                            rejection: provider.rejection(upstream),
                         };
                         const message = cause === undefined
                             ? modelFailureMessage(selected.provider, evidence)
@@ -674,6 +691,8 @@ export function createPrivateLocalModelSource(models, providerId, modelId, provi
                                 reason: message,
                                 retryable: modelFailureRetryable(evidence),
                             };
+                            if (evidence.rejection !== undefined)
+                                modelFailure.rejection = evidence.rejection;
                             if (upstream?.errorMessage !== undefined)
                                 modelFailure.providerError = upstream.errorMessage;
                         }
@@ -1044,7 +1063,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
         providerCacheKey = createHash("sha256")
             .update(JSON.stringify(["fungi-local", paths.databasePath, initialSessionId]))
             .digest("hex");
-        database = openPrivateWritableSqliteDatabase(paths.databasePath, 0);
+        database = openPrivateWritableSqliteDatabase(paths.databasePath, storeWriteBusyTimeoutMs);
         database.exec("PRAGMA foreign_keys = ON");
         const agentId = ensureLocalAgentId({
             database,
@@ -1119,6 +1138,14 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                         return Promise.reject(new Error("Local mail ingress is unavailable"));
                     return acceptMail(mail, meta, reply);
                 },
+                unattended: {
+                    readSettlement: (sessionId, commandId) => readSettlement === undefined
+                        ? Promise.reject(new Error("Local settlement reads are unavailable"))
+                        : readSettlement(sessionId, commandId),
+                    escalate: async (item, receiverSessionId) => {
+                        await input.agentControl?.escalate(item, agentId, receiverSessionId, new AbortController().signal);
+                    },
+                },
             });
         let projectDirectory;
         if (input.agentControl !== undefined) {
@@ -1321,7 +1348,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                 throw new Error("Local escape approval could not be presented");
             return pending;
         };
-        const policyForSession = (sessionId) => async ({ request, cwd, mode, executionPath }) => {
+        const policyForSession = (sessionId) => async ({ request, cwd, mode, executionPath, context }) => {
             if (mode !== "workspace" || !("executable" in request))
                 return undefined;
             let configuredRemotes;
@@ -1338,7 +1365,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                 executable: request.executable,
                 ruleId: matched.ruleId,
             });
-            return shellOutput.parse(await dispatchApprovedLocalExec(request, cwd, executionPath, configRoot.home, localTools.processes.scope(sessionId), mode));
+            return shellOutput.parse(await dispatchApprovedLocalExec(request, cwd, executionPath, configRoot.home, localTools.processes.scope(sessionId), mode, context.output));
         };
         const localTools = await createPrivateLocalTools(selectedFolder.absolute, input.fungiMcp, subagents?.directory, (sessionId) => sessionPaths.get(sessionId), dirname(paths.databasePath), subagents, await input.configuration?.(dirname(paths.databasePath)), configRoot, sandboxOwner, () => sandboxOwner.status().mode, escapeForSession, policyForSession);
         processes = localTools.processes;
@@ -1531,7 +1558,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                 };
             },
             close: () => {
-                closing ??= closePrivateLocalResources({
+                closing ??= (delegation?.close() ?? Promise.resolve()).then(() => closePrivateLocalResources({
                     agent,
                     processes,
                     sandbox,
@@ -1539,7 +1566,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                     database,
                     lease,
                     providerCacheKey,
-                });
+                }));
                 return closing;
             },
         });

package/dist/private-local-sandbox-policy.js

@@ -90,6 +90,10 @@ osHome, platform = "linux") {
         mode,
         temporaryDirectory,
         fungiCache: protectedFungiCache,
+        // Adding PATH lookup directories would invalidate the current name-based
+        // extension-install risk classification; revisit private-local-exec-rules.ts
+        // before widening this set. Guard: ../test/private-local-containment.test.ts,
+        // "keeps every captured PATH directory outside Workspace writable roots".
         writable: mode === "workspace"
             ? [...new Set([policy.writableRoot, ...writableCaches])]
             : [],

package/dist/private-local-sandbox.d.ts

@@ -1,6 +1,6 @@
 import type { NativeSourceReader } from "./private-local-bwrap.js";
 import { z } from "zod";
-import { sandboxUnavailableReasonSchema, type SandboxUnavailableReason } from "./private-local-containment.js";
+import { establishLocalSandbox, sandboxUnavailableReasonSchema, type SandboxUnavailableReason } from "./private-local-containment.js";
 import type { LocalPermissionMode } from "./private-local-permission-mode.js";
 import type { LocalSandboxWrites } from "./private-invocation-files.js";
 import type { NativePayloadStaging } from "./private-local-native-staging.js";
@@ -48,6 +48,8 @@ export declare function createLocalSandboxControls(input: Readonly<{
     platform?: string;
     readNativePatchSource?: NativeSourceReader;
     native?: NativePayloadStaging | undefined;
+    /** Test-only hook for inspecting probe launches without native execution. */
+    runProbe?: Parameters<typeof establishLocalSandbox>[2];
 }>): LocalSandboxControls;
 /** Probe a fresh Agent before deciding its mode; never treat an unavailable backend as a sandboxed run. */
 export declare function probeLocalSandbox(project: string, folder: string, native?: NativePayloadStaging): SandboxUnavailableReason | undefined;

package/dist/private-local-sandbox.js

@@ -97,7 +97,7 @@ export function createLocalSandboxControls(input) {
                 temporaryDirectory: temporaryDirectory ??
                     agentSandboxTemporaryDirectory(temporaryOwner, input.project),
                 ...platform,
-            }, native);
+            }, native, input.runProbe);
         }
     }
     catch (cause) {
@@ -167,7 +167,7 @@ export function createLocalSandboxControls(input) {
             mode: nextMode,
             temporaryDirectory,
             ...platform,
-        }, native);
+        }, native, input.runProbe);
         if (admission.state === "ready") {
             sandbox = admission.sandbox;
             preparedMode = nextMode;

package/dist/private-local-schedule-client.d.ts

@@ -0,0 +1,12 @@
+import type { z } from "zod";
+import { type AgentScheduleRow, type AgentScheduleTarget } from "@fungi.computer/shiitake-extensions/schedules";
+import { localScheduleListInputSchema, type LocalSchedulePage } from "./private-local-schedules.js";
+import type { PrivateLocalServiceRequestOptions, PrivateLocalServiceStatus } from "./private-local-service-contract.js";
+/** A private, folder-bound owner capability; it contains no public URL or grant. */
+export type PrivateLocalScheduleCapability = Readonly<{
+    list(input?: Omit<z.input<typeof localScheduleListInputSchema>, "invocationRoot">, options?: PrivateLocalServiceRequestOptions): Promise<LocalSchedulePage>;
+    pause(target: AgentScheduleTarget, options?: PrivateLocalServiceRequestOptions): Promise<AgentScheduleRow>;
+    delete(target: AgentScheduleTarget, options?: PrivateLocalServiceRequestOptions): Promise<AgentScheduleRow>;
+}>;
+/** Only a native private service client creates this capability for its person. */
+export declare function createPrivateLocalScheduleCapability(invocationRoot: string, start: (options?: PrivateLocalServiceRequestOptions) => Promise<PrivateLocalServiceStatus>): PrivateLocalScheduleCapability;

package/dist/private-local-schedule-client.js

@@ -0,0 +1,41 @@
+import * as Schema from "effect/Schema";
+import { parseShiitakeError } from "@fungi.computer/shiitake/client";
+import { agentScheduleRowSchema, } from "@fungi.computer/shiitake-extensions/schedules";
+import { readBoundedResponse } from "./private-bounded-response.js";
+import { localScheduleControlInputSchema, localScheduleListInputSchema, localSchedulePageSchema, } from "./private-local-schedules.js";
+// A page has at most 64 prompts of 256 KiB, including JSON escaping and metadata.
+// This is a wire budget, not a limit on retained records or future occurrences.
+const maximumResponseBytes = 128 * 1024 * 1024;
+/** Only a native private service client creates this capability for its person. */
+export function createPrivateLocalScheduleCapability(invocationRoot, start) {
+    async function call(operation, input, output, options = {}) {
+        options.signal?.throwIfAborted();
+        const service = await start(options);
+        const request = {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(input),
+            redirect: "error",
+        };
+        if (options.signal !== undefined)
+            request.signal = options.signal;
+        const response = await fetch(`${service.baseUrl}/service/${service.serviceId}/schedules/${operation}`, request);
+        const body = await readBoundedResponse(response, maximumResponseBytes, `Private Local schedule ${operation}`);
+        if (!response.ok) {
+            let failure;
+            try {
+                failure = parseShiitakeError(body);
+            }
+            catch (cause) {
+                throw new Error(`Private Local schedule ${operation} failed (${String(response.status)})`, { cause });
+            }
+            throw failure;
+        }
+        return Schema.decodeUnknownSync(output, { onExcessProperty: "error" })(JSON.parse(body));
+    }
+    return {
+        list: (input = {}, options) => call("list", localScheduleListInputSchema.parse({ ...input, invocationRoot }), localSchedulePageSchema, options),
+        pause: (target, options) => call("pause", localScheduleControlInputSchema.parse({ invocationRoot, target }), agentScheduleRowSchema, options),
+        delete: (target, options) => call("delete", localScheduleControlInputSchema.parse({ invocationRoot, target }), agentScheduleRowSchema, options),
+    };
+}