@fungi.computer/truffle 0.5.0 → 0.6.0

package/dist/private-local-delegation.js

@@ -1,6 +1,6 @@
 import * as Effect from "effect/Effect";
 import { AgentArchiveRefused } from "@fungi.computer/shiitake/agent-control";
-import { agentDelegationRequestKey, createFleetDelegation, delegationProvenance, delegationReplyMeta, delegationSendMeta, } from "@fungi.computer/shiitake/fleet";
+import { agentDelegationRequestKey, createFleetDelegation, delegationProvenance, delegationReplyMeta, delegationSendMeta, isOneWayAncestorNotice, } from "@fungi.computer/shiitake/fleet";
 /** How long one Local delegation grant stays valid while it is admitted. */
 const grantLifetimeMs = 60_000;
 /**
@@ -113,19 +113,22 @@ export function createPrivateLocalDelegation(input) {
             sessionId: sourceSessionId,
         });
         signal.throwIfAborted();
+        let delegation = {
+            agentId: task.agentId,
+            sessionId: task.sessionId,
+            delivery: task.delivery,
+            text: task.text,
+            requestId,
+        };
+        if (task.delivery === "followUp" && task.goal !== undefined)
+            delegation = { ...delegation, goal: task.goal };
         return fleet.start({
             agents: agents.map(({ agentId }) => agentId),
             actions: ["delegate"],
             expiresAt: Date.now() + grantLifetimeMs,
             provenance,
             meta,
-        }, {
-            agentId: task.agentId,
-            sessionId: task.sessionId,
-            delivery: task.delivery,
-            text: task.text,
-            requestId,
-        });
+        }, delegation);
     }
     /** Resolve only this sender's receipt, then let the target own the pending guard. */
     async function recall(task, sourceSessionId, signal) {
@@ -157,9 +160,8 @@ export function createPrivateLocalDelegation(input) {
         }
     }
     /**
-     * Admit one mail addressed to this Agent. New work must name its sender as
-     * its only reply destination; a reply-less mail is admitted only as an
-     * authenticated reply. Everything else is refused.
+     * Admit delegated work, one-way ancestor notices and authenticated replies.
+     * Other reply-less mail is refused.
      */
     async function receive(mail) {
         const mesh = await input.meshAdmission?.(mail.to.agentId);
@@ -187,6 +189,8 @@ export function createPrivateLocalDelegation(input) {
                 throw new Error("Local delegated work must reply to its sender");
             return input.accept(mail, mail.meta);
         }
+        if (isOneWayAncestorNotice(mail))
+            return input.accept(mail, mail.meta);
         if (mail.reply?.outcome === "accepted") {
             const receipt = fleet.recordAcceptedNotice(mail);
             if (receipt === undefined)

package/dist/private-local-exec-environment.d.ts

@@ -1,3 +1,6 @@
+import { z } from "zod";
+/** Shared admission for shell/direct run and managed start. */
+export declare const privateLocalExecEnvironmentInput: z.ZodRecord<z.ZodString, z.ZodString>;
 /**
  * The only host variables a Local exec child receives besides its selected
  * PATH and HOME. Exec runs as the host's own user, so that user's session
@@ -5,7 +8,7 @@
  * `loginctl` and other user-service tools need to find the user manager.
  * Every other host variable, credentials included, stays out.
  */
-export type PrivateLocalExecEnvironment = {
+export type PrivateLocalExecEnvironment = Record<string, string> & {
     PATH: string;
     HOME: string;
     XDG_RUNTIME_DIR?: string;
@@ -13,4 +16,4 @@ export type PrivateLocalExecEnvironment = {
 };
 export declare function privateLocalExecEnvironment(executionPath: string, host: NodeJS.ProcessEnv & {
     HOME: string;
-}): PrivateLocalExecEnvironment;
+}, extra?: Readonly<Record<string, string>>): PrivateLocalExecEnvironment;

package/dist/private-local-exec-environment.js

@@ -1,5 +1,39 @@
-export function privateLocalExecEnvironment(executionPath, host) {
+import { z } from "zod";
+// Extras reach the native sandbox launcher too; its loader controls stay owned
+// by the host rather than loading model-selected code before containment.
+const hostOwnedNames = new Set([
+    "PATH",
+    "HOME",
+    "XDG_RUNTIME_DIR",
+    "DBUS_SESSION_BUS_ADDRESS",
+    "TMPDIR",
+    "SSH_AUTH_SOCK",
+    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
+    "FUNGI_SANDBOX",
+    "FUNGI_SANDBOX_NETWORK_DISABLED",
+    "GLIBC_TUNABLES",
+    "GCONV_PATH",
+    "LOCPATH",
+]);
+const environmentName = z
+    .string()
+    .regex(/^[A-Z_][A-Z0-9_]*$/u)
+    .refine((name) => !hostOwnedNames.has(name) &&
+    !name.startsWith("LD_") &&
+    !name.startsWith("DYLD_"), "Host-owned environment variable");
+/** Shared admission for shell/direct run and managed start. */
+export const privateLocalExecEnvironmentInput = z
+    .record(environmentName, z
+    .string()
+    .max(1_024)
+    .regex(/^[^\0]*$/u, "Environment values cannot contain NUL"))
+    .refine((environment) => Object.keys(environment).length <= 64, {
+    message: "Exec env accepts at most 64 variables",
+})
+    .describe("Up to 64 extra string variables, each at most 1024 UTF-16 code units, with uppercase ASCII names (letters, digits and underscores; no leading digit). Host-owned names, including HOME, PATH, session/sandbox locators and dynamic-loader controls, are refused.");
+export function privateLocalExecEnvironment(executionPath, host, extra = {}) {
     const environment = {
+        ...extra,
         PATH: executionPath,
         HOME: host.HOME,
     };

package/dist/private-local-exec-review.js

@@ -1,5 +1,6 @@
-import { gitRuleCoverage, rulePrefix } from "./private-local-exec-rules.js";
-import { quote } from "shell-quote";
+import * as Result from "effect/Result";
+import { gitRuleCoverage, hasExtensionInstallRisk, rulePrefix, } from "./private-local-exec-rules.js";
+import { parse, quote } from "shell-quote";
 const gitHookGrantSubcommands = new Set([
     "add",
     "branch",
@@ -25,6 +26,12 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
         ? undefined
         : [request.executable, ...(request.args ?? [])];
     const command = request.command ?? quote(argv ?? []);
+    // Literal shell tokens only add the extension risk note. They never turn
+    // shell text into argv, establish command identity, or permit a saved rule.
+    // Opaque shell text keeps its existing once-only generic review.
+    const words = argv ??
+        Result.getOrElse(Result.try(() => parse(command, {})), () => []);
+    const extensionInstall = hasExtensionInstallRisk(words, argv === undefined ? "shell" : "direct");
     const prefix = argv === undefined || (argv[0] === "git" && gitGrant === undefined)
         ? undefined
         : rulePrefix(argv, gitGrant?.configuredRemotes);
@@ -33,9 +40,7 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
         cwd,
         justification: request.escape.justification,
         form: argv === undefined ? "shell" : "direct",
-        kind: argv?.[0] === "fungi" && argv[1] === "extension" && argv[2] === "add"
-            ? "extension-install"
-            : "exec",
+        kind: extensionInstall ? "extension-install" : "exec",
     };
     if (argv !== undefined)
         review.argv = argv;
@@ -44,7 +49,7 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
         review.alwaysAllowCoverage =
             prefix[0] === "git"
                 ? gitRuleCoverage(prefix[1] ?? "")
-                : `Direct argv commands beginning ${JSON.stringify(prefix)} in this project; shell commands still ask.`;
+                : `Direct argv commands beginning ${JSON.stringify(prefix)} in this project; shell commands${prefix[0] === "fungi" ? " and extension installs" : ""} still ask.`;
         if (prefix[0] === "git") {
             const hookCapable = gitHookGrantSubcommands.has(prefix[1] ?? "");
             const summary = (hookCapable
@@ -68,7 +73,9 @@ export function localExecEscapeReview(request, cwd, gitGrant) {
             review.risk = { summary, detail };
         }
         else {
-            const summary = `Every \`${prefix.join(" ")} …\` command will run outside the sandbox, as you.`;
+            const summary = prefix[0] === "fungi"
+                ? `Matching \`${prefix.join(" ")} …\` commands run outside the sandbox, as you. Extension installs still ask.`
+                : `Every \`${prefix.join(" ")} …\` command will run outside the sandbox, as you.`;
             review.risk = { summary, detail: summary };
         }
     }

package/dist/private-local-exec-rules.d.ts

@@ -1,3 +1,10 @@
+import type { ParseEntry } from "shell-quote";
+/**
+ * Conservative literal risk, not CLI parsing or executable identity. Global
+ * options can occur among positionals. Shell tokens may disclose risk, but
+ * only actual direct argv ever reaches the reusable-grant matcher.
+ */
+export declare function hasExtensionInstallRisk(words: readonly ParseEntry[], form: "direct" | "shell"): boolean;
 /** Offer only direct commands that this same matcher can authorize. */
 export declare function rulePrefix(argv: readonly string[], configuredRemotes?: ReadonlySet<string>): string[] | undefined;
 /** Text for the same Git option profile that gates matching, not a second list. */

package/dist/private-local-exec-rules.js

@@ -2,6 +2,27 @@ import { lstatSync, mkdirSync, readFileSync, renameSync, rmdirSync, writeFileSyn
 import { basename, join } from "node:path";
 import { correlationKey, defineIdFamily } from "@fungi.computer/cairn";
 import { z } from "zod";
+function fungiWord(word) {
+    const parsed = z.string().safeParse(word);
+    return parsed.success && basename(parsed.data) === "fungi";
+}
+/**
+ * Conservative literal risk, not CLI parsing or executable identity. Global
+ * options can occur among positionals. Shell tokens may disclose risk, but
+ * only actual direct argv ever reaches the reusable-grant matcher.
+ */
+export function hasExtensionInstallRisk(words, form) {
+    const executable = form === "direct"
+        ? fungiWord(words[0])
+            ? 0
+            : -1
+        : words.findIndex(fungiWord);
+    if (executable < 0)
+        return false;
+    const extension = words.findIndex((word, index) => index > executable && word === "extension");
+    return (extension >= 0 &&
+        words.some((word, index) => index > extension && word === "add"));
+}
 const prefixSchema = z.array(z.string().min(1).max(4096)).min(1).max(32);
 const projectRuleIds = defineIdFamily({
     family: "local-exec-rules",
@@ -264,9 +285,7 @@ export function rulePrefix(argv, configuredRemotes) {
             ? prefix
             : undefined;
     }
-    if (basename(argv[0] ?? "") === "fungi" &&
-        argv[1] === "extension" &&
-        argv[2] === "add")
+    if (hasExtensionInstallRisk(argv, "direct"))
         return undefined;
     const parsed = prefixSchema.safeParse(argv.slice(0, 2));
     return parsed.success && validPrefix(parsed.data) ? parsed.data : undefined;
@@ -416,9 +435,7 @@ export function localExecRules(project) {
     };
     const match = (argv, configuredRemotes) => {
         if (unsafeExecutable(argv[0] ?? "") ||
-            (basename(argv[0] ?? "") === "fungi" &&
-                argv[1] === "extension" &&
-                argv[2] === "add"))
+            hasExtensionInstallRisk(argv, "direct"))
             return undefined;
         if (argv[0] === "git" && !safeGitCommand(argv, configuredRemotes))
             return undefined;

package/dist/private-local-extension-records.d.ts

@@ -7,6 +7,7 @@ export declare const activationsSchema: z.ZodObject<{
         revision: z.ZodString;
         capabilities: z.ZodArray<z.ZodEnum<{
             state: "state";
+            prompt: "prompt";
             attention: "attention";
             settled: "settled";
             send: "send";
@@ -15,7 +16,6 @@ export declare const activationsSchema: z.ZodObject<{
             projection: "projection";
             run_tools: "run_tools";
             files: "files";
-            prompt: "prompt";
             compaction_handoff: "compaction_handoff";
         }>>;
         skills: z.ZodBoolean;

package/dist/private-local-runtime-host.js

@@ -1348,7 +1348,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                 throw new Error("Local escape approval could not be presented");
             return pending;
         };
-        const policyForSession = (sessionId) => async ({ request, cwd, mode, executionPath }) => {
+        const policyForSession = (sessionId) => async ({ request, cwd, mode, executionPath, context }) => {
             if (mode !== "workspace" || !("executable" in request))
                 return undefined;
             let configuredRemotes;
@@ -1365,7 +1365,7 @@ export async function openPrivateLocalRuntimeHost(input, suppliedModels) {
                 executable: request.executable,
                 ruleId: matched.ruleId,
             });
-            return shellOutput.parse(await dispatchApprovedLocalExec(request, cwd, executionPath, configRoot.home, localTools.processes.scope(sessionId), mode));
+            return shellOutput.parse(await dispatchApprovedLocalExec(request, cwd, executionPath, configRoot.home, localTools.processes.scope(sessionId), mode, context.output));
         };
         const localTools = await createPrivateLocalTools(selectedFolder.absolute, input.fungiMcp, subagents?.directory, (sessionId) => sessionPaths.get(sessionId), dirname(paths.databasePath), subagents, await input.configuration?.(dirname(paths.databasePath)), configRoot, sandboxOwner, () => sandboxOwner.status().mode, escapeForSession, policyForSession);
         processes = localTools.processes;

package/dist/private-local-sandbox-policy.js

@@ -90,6 +90,10 @@ osHome, platform = "linux") {
         mode,
         temporaryDirectory,
         fungiCache: protectedFungiCache,
+        // Adding PATH lookup directories would invalidate the current name-based
+        // extension-install risk classification; revisit private-local-exec-rules.ts
+        // before widening this set. Guard: ../test/private-local-containment.test.ts,
+        // "keeps every captured PATH directory outside Workspace writable roots".
         writable: mode === "workspace"
             ? [...new Set([policy.writableRoot, ...writableCaches])]
             : [],

package/dist/private-local-sandbox.d.ts

@@ -1,6 +1,6 @@
 import type { NativeSourceReader } from "./private-local-bwrap.js";
 import { z } from "zod";
-import { sandboxUnavailableReasonSchema, type SandboxUnavailableReason } from "./private-local-containment.js";
+import { establishLocalSandbox, sandboxUnavailableReasonSchema, type SandboxUnavailableReason } from "./private-local-containment.js";
 import type { LocalPermissionMode } from "./private-local-permission-mode.js";
 import type { LocalSandboxWrites } from "./private-invocation-files.js";
 import type { NativePayloadStaging } from "./private-local-native-staging.js";
@@ -48,6 +48,8 @@ export declare function createLocalSandboxControls(input: Readonly<{
     platform?: string;
     readNativePatchSource?: NativeSourceReader;
     native?: NativePayloadStaging | undefined;
+    /** Test-only hook for inspecting probe launches without native execution. */
+    runProbe?: Parameters<typeof establishLocalSandbox>[2];
 }>): LocalSandboxControls;
 /** Probe a fresh Agent before deciding its mode; never treat an unavailable backend as a sandboxed run. */
 export declare function probeLocalSandbox(project: string, folder: string, native?: NativePayloadStaging): SandboxUnavailableReason | undefined;

package/dist/private-local-sandbox.js

@@ -97,7 +97,7 @@ export function createLocalSandboxControls(input) {
                 temporaryDirectory: temporaryDirectory ??
                     agentSandboxTemporaryDirectory(temporaryOwner, input.project),
                 ...platform,
-            }, native);
+            }, native, input.runProbe);
         }
     }
     catch (cause) {
@@ -167,7 +167,7 @@ export function createLocalSandboxControls(input) {
             mode: nextMode,
             temporaryDirectory,
             ...platform,
-        }, native);
+        }, native, input.runProbe);
         if (admission.state === "ready") {
             sandbox = admission.sandbox;
             preparedMode = nextMode;

package/dist/private-local-schedule-client.d.ts

@@ -0,0 +1,12 @@
+import type { z } from "zod";
+import { type AgentScheduleRow, type AgentScheduleTarget } from "@fungi.computer/shiitake-extensions/schedules";
+import { localScheduleListInputSchema, type LocalSchedulePage } from "./private-local-schedules.js";
+import type { PrivateLocalServiceRequestOptions, PrivateLocalServiceStatus } from "./private-local-service-contract.js";
+/** A private, folder-bound owner capability; it contains no public URL or grant. */
+export type PrivateLocalScheduleCapability = Readonly<{
+    list(input?: Omit<z.input<typeof localScheduleListInputSchema>, "invocationRoot">, options?: PrivateLocalServiceRequestOptions): Promise<LocalSchedulePage>;
+    pause(target: AgentScheduleTarget, options?: PrivateLocalServiceRequestOptions): Promise<AgentScheduleRow>;
+    delete(target: AgentScheduleTarget, options?: PrivateLocalServiceRequestOptions): Promise<AgentScheduleRow>;
+}>;
+/** Only a native private service client creates this capability for its person. */
+export declare function createPrivateLocalScheduleCapability(invocationRoot: string, start: (options?: PrivateLocalServiceRequestOptions) => Promise<PrivateLocalServiceStatus>): PrivateLocalScheduleCapability;

package/dist/private-local-schedule-client.js

@@ -0,0 +1,41 @@
+import * as Schema from "effect/Schema";
+import { parseShiitakeError } from "@fungi.computer/shiitake/client";
+import { agentScheduleRowSchema, } from "@fungi.computer/shiitake-extensions/schedules";
+import { readBoundedResponse } from "./private-bounded-response.js";
+import { localScheduleControlInputSchema, localScheduleListInputSchema, localSchedulePageSchema, } from "./private-local-schedules.js";
+// A page has at most 64 prompts of 256 KiB, including JSON escaping and metadata.
+// This is a wire budget, not a limit on retained records or future occurrences.
+const maximumResponseBytes = 128 * 1024 * 1024;
+/** Only a native private service client creates this capability for its person. */
+export function createPrivateLocalScheduleCapability(invocationRoot, start) {
+    async function call(operation, input, output, options = {}) {
+        options.signal?.throwIfAborted();
+        const service = await start(options);
+        const request = {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(input),
+            redirect: "error",
+        };
+        if (options.signal !== undefined)
+            request.signal = options.signal;
+        const response = await fetch(`${service.baseUrl}/service/${service.serviceId}/schedules/${operation}`, request);
+        const body = await readBoundedResponse(response, maximumResponseBytes, `Private Local schedule ${operation}`);
+        if (!response.ok) {
+            let failure;
+            try {
+                failure = parseShiitakeError(body);
+            }
+            catch (cause) {
+                throw new Error(`Private Local schedule ${operation} failed (${String(response.status)})`, { cause });
+            }
+            throw failure;
+        }
+        return Schema.decodeUnknownSync(output, { onExcessProperty: "error" })(JSON.parse(body));
+    }
+    return {
+        list: (input = {}, options) => call("list", localScheduleListInputSchema.parse({ ...input, invocationRoot }), localSchedulePageSchema, options),
+        pause: (target, options) => call("pause", localScheduleControlInputSchema.parse({ invocationRoot, target }), agentScheduleRowSchema, options),
+        delete: (target, options) => call("delete", localScheduleControlInputSchema.parse({ invocationRoot, target }), agentScheduleRowSchema, options),
+    };
+}

package/dist/private-local-schedules.d.ts

@@ -0,0 +1,84 @@
+import * as Schema from "effect/Schema";
+import { z } from "zod";
+import type { ShiitakeAgent } from "@fungi.computer/shiitake";
+/** Private service ingress, never a Team/member or machine-link request. */
+export declare const localScheduleListInputSchema: z.ZodObject<{
+    after: z.ZodOptional<z.ZodObject<{
+        agentId: z.ZodString;
+        kind: z.ZodUnion<readonly [z.ZodLiteral<"almanac">, z.ZodLiteral<"loop">]>;
+        after: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    invocationRoot: z.ZodString;
+}, z.core.$strict>;
+/** Private person-only mutation, distinct from the finite list request. */
+export declare const localScheduleControlInputSchema: z.ZodObject<{
+    invocationRoot: z.ZodString;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"almanac">;
+        agentId: z.ZodString;
+        scheduleId: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"loop">;
+        agentId: z.ZodString;
+        sessionId: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+        loopId: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+/** Local directory pages reuse the schedule owner's decoder and retained state. */
+export declare const localSchedulePageSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+        readonly agentId: Schema.String;
+        readonly kind: Schema.Literal<"almanac">;
+        readonly schedule: Schema.Struct<{
+            readonly id: Schema.String;
+            readonly sessionId: Schema.String;
+            readonly prompt: Schema.String;
+            readonly cron: Schema.NullOr<Schema.Struct<{
+                readonly expression: Schema.String;
+                readonly timeZone: Schema.String;
+            }>>;
+            readonly nextDueAt: Schema.Int;
+            readonly state: Schema.Literals<readonly ["active", "paused", "cancelled", "finished"]>;
+            readonly lastCommandId: Schema.NullOr<Schema.String>;
+            readonly lastError: Schema.NullOr<Schema.String>;
+            readonly attempt: Schema.Int;
+        }>;
+    }>, Schema.Struct<{
+        readonly agentId: Schema.String;
+        readonly kind: Schema.Literal<"loop">;
+        readonly schedule: Schema.Struct<{
+            readonly sessionId: Schema.String;
+            readonly loopId: Schema.String;
+            readonly origin: Schema.Literals<readonly ["human", "model"]>;
+            readonly expiresAt: Schema.NullOr<Schema.Int>;
+            readonly prompt: Schema.String;
+            readonly mode: Schema.Literals<readonly ["self_paced", "fixed_interval"]>;
+            readonly cron: Schema.NullOr<Schema.Struct<{
+                readonly expression: Schema.String;
+                readonly timeZone: Schema.String;
+            }>>;
+            readonly state: Schema.Literals<readonly ["active", "paused", "finished", "failed", "cancelled"]>;
+            readonly commandId: Schema.String;
+            readonly reason: Schema.NullOr<Schema.String>;
+            readonly nextDueAt: Schema.NullOr<Schema.Int>;
+            readonly lastError: Schema.NullOr<Schema.String>;
+            readonly consecutiveFailures: Schema.Int;
+        }>;
+    }>]>>;
+    readonly unavailable: Schema.$Array<Schema.Struct<{
+        readonly agentId: Schema.String;
+        readonly reason: Schema.Literal<"owner_unavailable">;
+    }>>;
+    readonly next: Schema.NullOr<Schema.Struct<{
+        readonly agentId: Schema.String;
+        readonly kind: Schema.Literals<readonly ["almanac", "loop"]>;
+        readonly after: Schema.optionalKey<Schema.String>;
+    }>>;
+}>;
+export type LocalSchedulePage = typeof localSchedulePageSchema.Type;
+/** One bounded read, borrowing existing admitted Agent owners one at a time. */
+export declare function readLocalSchedulePage(agentIds: readonly string[], open: (agentId: string, signal: AbortSignal) => Promise<{
+    owner: Pick<ShiitakeAgent, "extensions">;
+    release: () => void;
+}>, input: z.output<typeof localScheduleListInputSchema>, signal: AbortSignal): Promise<LocalSchedulePage>;

package/dist/private-local-schedules.js

@@ -0,0 +1,65 @@
+import * as Schema from "effect/Schema";
+import { z } from "zod";
+import { agentScheduleListInputSchema, agentSchedulePageSchema, agentScheduleTargetSchema, readAgentSchedulePage, } from "@fungi.computer/shiitake-extensions/schedules";
+import { logEvent } from "./log-event.js";
+/** Private service ingress, never a Team/member or machine-link request. */
+export const localScheduleListInputSchema = z.strictObject({
+    invocationRoot: z.string().min(1),
+    ...agentScheduleListInputSchema.shape,
+});
+/** Private person-only mutation, distinct from the finite list request. */
+export const localScheduleControlInputSchema = z.strictObject({
+    invocationRoot: z.string().min(1),
+    target: agentScheduleTargetSchema,
+});
+/** Local directory pages reuse the schedule owner's decoder and retained state. */
+export const localSchedulePageSchema = Schema.Struct({
+    items: agentSchedulePageSchema.fields.items,
+    unavailable: Schema.Array(Schema.Struct({
+        agentId: Schema.String,
+        reason: Schema.Literal("owner_unavailable"),
+    })).check(Schema.isMaxLength(8)),
+    next: agentSchedulePageSchema.fields.next,
+});
+/** One bounded read, borrowing existing admitted Agent owners one at a time. */
+export async function readLocalSchedulePage(agentIds, open, input, signal) {
+    signal.throwIfAborted();
+    const candidates = agentIds
+        .filter((agentId) => input.after === undefined ? true : agentId >= input.after.agentId)
+        .sort();
+    const items = [];
+    const unavailable = [];
+    // Bound runtime fan-out even when many retained Agents have no schedules.
+    const owners = candidates.slice(0, 8);
+    for (const agentId of owners) {
+        signal.throwIfAborted();
+        try {
+            const { owner, release } = await open(agentId, signal);
+            try {
+                const limit = input.limit - items.length;
+                const pageInput = input.after?.agentId === agentId
+                    ? { limit, after: input.after }
+                    : { limit };
+                const page = await readAgentSchedulePage(agentId, owner, pageInput);
+                signal.throwIfAborted();
+                items.push(...page.items);
+                if (page.next !== null)
+                    return { items, unavailable, next: page.next };
+            }
+            finally {
+                release();
+            }
+        }
+        catch (cause) {
+            signal.throwIfAborted();
+            logEvent("schedule-directory.owner-unavailable", cause);
+            unavailable.push({ agentId, reason: "owner_unavailable" });
+        }
+    }
+    const unread = candidates.at(owners.length);
+    return {
+        items,
+        unavailable,
+        next: unread === undefined ? null : { agentId: unread, kind: "almanac" },
+    };
+}

package/dist/private-local-service-contract.d.ts

@@ -10,6 +10,7 @@ import type { ServiceDiagnosticsStatus } from "./private-local-service-log.js";
 import type { LocalSandboxStatus } from "./private-local-sandbox.js";
 import type { LocalPermissionMode } from "./private-local-permission-mode.js";
 import type { LocalUiAttachmentLifetime } from "./private-local-ui-attachment.js";
+import type { PrivateLocalScheduleCapability } from "./private-local-schedule-client.js";
 /** Live health, not the on-disk identity record or a cached connection snapshot. */
 export type PrivateLocalServiceStatus = Readonly<{
     /** The client-service wire contract this service speaks. */
@@ -140,6 +141,8 @@ export type PrivateLocalSessionDiscovery = Readonly<{
 }>;
 /** Local process management stays outside the shared Session HTTP contract. */
 export type PrivateLocalServiceManager = Readonly<{
+    /** Explicit private person-only capability; never provided by a mesh/App grant. */
+    schedules: (invocationRoot: string) => PrivateLocalScheduleCapability;
     reload: (invocationRoot: string) => Promise<string>;
     /** Throws `LocalServiceUpdated` when a live service speaks another protocol. */
     status: () => Promise<PrivateLocalServiceStatus | undefined>;

package/dist/private-local-service-discovery.d.ts

@@ -4,7 +4,7 @@ export { sandboxStatusSchema } from "./private-local-sandbox.js";
  * The client-service wire contract. Bump it with any change an older client
  * cannot read; a running client then asks its window to restart.
  */
-export declare const privateLocalServiceProtocol = 4;
+export declare const privateLocalServiceProtocol = 5;
 /** This build's identity: the packed CLI's content hash, or `source` for a source run. */
 export declare function privateLocalServiceVersion(): string;
 /**
@@ -19,7 +19,7 @@ declare const serviceLifecycleSchema: z.ZodObject<{
     startedAt: z.ZodString;
 }, z.core.$loose>;
 declare const serviceRecordSchema: z.ZodObject<{
-    protocol: z.ZodLiteral<4>;
+    protocol: z.ZodLiteral<5>;
     baseUrl: z.ZodURL;
     version: z.ZodString;
     serviceId: z.ZodString & z.ZodType<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string, z.core.$ZodTypeInternals<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string>>;
@@ -29,7 +29,7 @@ declare const serviceRecordSchema: z.ZodObject<{
 export type ServiceRecord = z.infer<typeof serviceRecordSchema>;
 /** Mandatory live diagnostics; never written into the registration pointer. */
 export declare const liveServiceStatusSchema: z.ZodObject<{
-    protocol: z.ZodLiteral<4>;
+    protocol: z.ZodLiteral<5>;
     baseUrl: z.ZodURL;
     version: z.ZodString;
     serviceId: z.ZodString & z.ZodType<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string, z.core.$ZodTypeInternals<import("@fungi.computer/cairn").CairnId<"local-service", "service", 1>, string>>;

package/dist/private-local-service-discovery.js

@@ -17,7 +17,7 @@ export { sandboxStatusSchema } from "./private-local-sandbox.js";
  * The client-service wire contract. Bump it with any change an older client
  * cannot read; a running client then asks its window to restart.
  */
-export const privateLocalServiceProtocol = 4;
+export const privateLocalServiceProtocol = 5;
 /** This build's identity: the packed CLI's content hash, or `source` for a source run. */
 export function privateLocalServiceVersion() {
     return (z

package/dist/private-local-service-listener.js

@@ -1,5 +1,8 @@
 import { localFailureMetadata, logEvent } from "./log-event.js";
 import { bodyLimit } from "hono/body-limit";
+import { ShiitakeError } from "@fungi.computer/shiitake";
+import { toShiitakeErrorWire } from "@fungi.computer/shiitake/http";
+import { localScheduleControlInputSchema, localScheduleListInputSchema, } from "./private-local-schedules.js";
 import { enrollPrivateLocalMesh, localMeshJoinSchema, } from "./private-local-mesh-enrollment.js";
 import { createLocalMachineEnrollmentAccount, registerFungiAccountOwner, signOutOwnedFungiAccount, } from "./private-fungi-account.js";
 import { createServiceLogLifecycle, } from "./private-local-service-log.js";
@@ -103,6 +106,9 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
     const app = new Hono();
     app.onError((error, context) => {
         diagnostics.failure(localFailureMetadata("service.request", error));
+        if (error instanceof ShiitakeError &&
+            context.req.path.startsWith(`${prefix}/schedules/`))
+            return context.json(toShiitakeErrorWire(error), error.cause === "conflict" ? 409 : 400);
         if (error instanceof LocalStoreSchemaError)
             return context.json({
                 code: "store_schema_incompatible",
@@ -308,6 +314,9 @@ readRecoveryManifest, root = capturePrivateLocalConfigRoot()) {
                 archived: input.archived,
             }));
         });
+        app.post(`${prefix}/schedules/list`, bodyLimit({ maxSize: 32 * 1024 }), async (context) => context.json(await owners.schedules(localScheduleListInputSchema.parse(await context.req.json()), context.req.raw.signal)));
+        app.post(`${prefix}/schedules/pause`, bodyLimit({ maxSize: 32 * 1024 }), async (context) => context.json(await owners.pauseSchedule(localScheduleControlInputSchema.parse(await context.req.json()), context.req.raw.signal)));
+        app.post(`${prefix}/schedules/delete`, bodyLimit({ maxSize: 32 * 1024 }), async (context) => context.json(await owners.deleteSchedule(localScheduleControlInputSchema.parse(await context.req.json()), context.req.raw.signal)));
         app.post(`${prefix}/reload`, async (context) => {
             try {
                 const input = z