@hraness/ghostget 0.17.6 → 0.18.2

package/src/plugins/whatsapp-linked-device/vendor/README.md

@@ -0,0 +1,39 @@
+# Reviewed WhatsApp automation transport
+
+This patch applies to `openclaw/wacli` commit
+`a020de724180d31eccfa5241d45443402d62fb06` (v0.15.0). It is opt-in through
+`sync --ghostget-private-transport`. Ordinary wacli commands retain their
+existing behavior. Ghostget does not admit stock auto-retrying sends for its
+automation contract.
+
+The private socket carries fixed-schema JSON, bound to an exact account,
+connection generation, direct recipient JID, and durable request ID. A claimed
+request is never sent again; only an exact prior accepted receipt is returned.
+Connection loss or an unfinished claim remains indeterminate. Acceptance means
+the provider acknowledged the operation, not that the recipient received it.
+
+Private sends make one joined application-level attempt and omit recipient
+alias rewriting and URL previews. Text, document attachments, WebP stickers,
+reactions and polls use existing pinned wacli operations. The upstream protocol
+library may retransmit protocol frames with its own message ID. No account,
+pairing, private-message or live-send qualification is implied by offline tests.
+
+The private runtime installs SQLite triggers that journal message insert,
+update and delete projections in the same transaction. A persistent generation
+and monotonic sequence support resumption; retention is 10,000 events and
+expired or changed anchors require a new baseline. Historical backfill keeps
+its original timestamp. Consumers must apply their freshness policy before
+replying. A single writer connection uses `synchronous=FULL`.
+
+Build with Go 1.25.12, the unchanged committed module graph, a macOS arm64
+toolchain, and the exact commands in `provenance.json`. The native binary is
+bundled as compressed pinned bytes inside Ghostget's existing package archive.
+Owner setup installs it with the exact-hash installer; it is not an additional
+canonical package release asset. The supervised socket lives in its owned
+private cleanup directory so long managed account paths remain usable.
+
+Tests in the patch exercise a real private Unix socket using a synthetic
+runtime, joined cancellation, one-attempt failure, exact replay, identity and
+target mismatch, transactional events, cursor expiration and bounded retention.
+Both complete upstream suites (plain and `sqlite_fts5`) and `go vet ./...`
+passed. Two builds with identical flags produced identical bytes.

package/src/plugins/whatsapp-linked-device/vendor/provenance.json

@@ -0,0 +1,45 @@
+{
+  "schemaVersion": 1,
+  "upstream": {
+    "repository": "https://github.com/openclaw/wacli",
+    "version": "0.15.0",
+    "baseCommit": "a020de724180d31eccfa5241d45443402d62fb06"
+  },
+  "reviewedPatchStack": {
+    "tipCommit": "16cf7557a1683eb18e7a6e1c1fde8ca9f05e0850",
+    "patches": [{
+      "file": "0001-ghostget-private-messaging.patch",
+      "sha256": "44235d0fcd070d895fbe2fa3fa4406b34b8f7c808216fd22a2417c4fc86f3255",
+      "purpose": "Bounded owner-only IPC, durable one-attempt request claims, exact direct JIDs, joined cancellation and atomic bounded message-change events."
+    }]
+  },
+  "artifact": {
+    "platform": "darwin",
+    "arch": "arm64",
+    "version": "0.15.0+ghostget-private.1",
+    "executableSha256": "9b77ffb810d028fde725ca02b1451f1725b5ff5312a46a54468a9a38533d4cea",
+    "executableBytes": 21963810,
+    "compression": "gzip",
+    "compressedSha256": "1c1650d6c79b74db7f8f335b4746398c802031260a90468312dcaac0374a5166",
+    "compressedBytes": 7682949,
+    "build": {
+      "go": "go1.25.12 darwin/arm64",
+      "goArchiveSha256": "fa2c88bbcf64bd3b2aef355f026cfec6d3a4a01c132f999c8f8c964eb767164f",
+      "clang": "Apple clang version 21.0.0 (clang-2100.1.1.101)",
+      "macosSdk": "26.5",
+      "moduleGraphChanged": false,
+      "command": ["go", "build", "-trimpath", "-buildvcs=false", "-tags", "sqlite_fts5", "-ldflags", "-s -w -buildid= -X main.version=0.15.0+ghostget-private.1", "-o", "wacli-private", "./cmd/wacli"],
+      "secondIdenticalBuildVerified": true
+    }
+  },
+  "validation": {
+    "goTestAll": "passed",
+    "goTestAllSqliteFts5": "passed",
+    "goVetAll": "passed",
+    "privateSocketUsesSyntheticRuntime": true,
+    "realAccountRead": false,
+    "pairingPerformed": false,
+    "liveSendPerformed": false,
+    "deliveryQualified": false
+  }
+}

package/src/provider-http.ts

@@ -76,7 +76,7 @@ function canonicalTokenPath(path: string): string {
   return current;
 }
 
-function readPrivateTokenFile(path: string): string {
+function readPrivateTokenFile(path: string, expectedContent?: string): string {
   if (!isAbsolute(path)) throw new Error("OAuth token file path must be absolute");
   const canonical = canonicalTokenPath(path);
   const descriptor = openSync(
@@ -112,6 +112,11 @@ function readPrivateTokenFile(path: string): string {
       || before.ctimeNs !== after.ctimeNs
       || before.mode !== after.mode
     ) throw new Error("OAuth token file changed while it was read");
+    // Bind write readback before decoding, including byte-order marks and
+    // formatting. Never derive cleanup authority from different stored bytes.
+    if (expectedContent !== undefined && !buffer.equals(Buffer.from(expectedContent, "utf8"))) {
+      throw new Error("OAuth credential file does not match its intended content");
+    }
     return new TextDecoder("utf-8", { fatal: true }).decode(buffer);
   } finally {
     closeSync(descriptor);
@@ -190,11 +195,14 @@ function parseGoogleInstalledAppRefresh(value: unknown): GoogleInstalledAppRefre
 }
 
 /** Load and strictly bind a private token document without enforcing freshness. */
-export function loadOAuthCredential(auth: OAuthTokenAuth): LoadedOAuthCredential {
+export function loadOAuthCredential(
+  auth: OAuthTokenAuth,
+  options: Readonly<{ expectedContent?: string }> = {},
+): LoadedOAuthCredential {
   let content: string;
   let parsed: unknown;
   try {
-    content = readPrivateTokenFile(auth.path);
+    content = readPrivateTokenFile(auth.path, options.expectedContent);
     parsed = JSON.parse(content) as unknown;
   } catch (error) {
     throw new Error(`could not load private ${auth.provider} OAuth token document`, { cause: error });

package/src/provider-plugin-contract-identity.ts

@@ -303,8 +303,9 @@ const identities = Object.freeze({
   "linkedin-web": {
     schemaVersion: 1,
     pluginVersion: "1.6.0",
-    implementationSha256: "11b52ca3dd9cbafe4829eed9f27d59bdc1c312db943ea29b93cbab6417ac7025",
+    implementationSha256: "95000a4d81f2fdbd222fa793b229704ba77ab9a23d02b26db5fa561bd5d6e491",
     legacyCurrentReadImplementationSha256: [
+      "11b52ca3dd9cbafe4829eed9f27d59bdc1c312db943ea29b93cbab6417ac7025",
       "e4614ab9c7733d7526b8157410e462f1bb48fdaa1c2319a6a4179c18b9e6839d",
       "97194dc5a8ec3afc4f4a20152efe51dbdc2fa8a8dde0cd9484b54718c4767f45",
       "64621493e09949fcb9973270140fec1d7398374cf48d3ef150a0c24b882fdeb8",
@@ -316,7 +317,6 @@ const identities = Object.freeze({
       "dbda2aee2075a0a3726241fd24932113ae6c2d139ae1f7036ea827a335f7344c",
       "9acb34f9ef5f59dd46b249766af236a3876a4975e0797e330f2975b3fd4ed643",
       "951102310bd87f93ce0863c1a444371d62f412934cc805f82c9981f82edfe50e",
-      "4fd6c293984be688a9273acb09bccea64a75134daca745b322fa8d33dfe9f97c",
     ],
     legacyReadImplementationSha256: {
       test: "00a99426ec31182f8d37d5cceb819947a09e630b468bb6e3ed8827f5b0fa4628",

package/src/provider-plugin-import-analysis.ts

@@ -0,0 +1,52 @@
+import { createHash } from "node:crypto";
+
+type LiteralModuleImport = {
+  readonly kind: string;
+  readonly path: string;
+};
+
+const scanners = Object.freeze({
+  js: new Bun.Transpiler({ loader: "js" }),
+  ts: new Bun.Transpiler({ loader: "ts" }),
+});
+const MAX_MEMO_ENTRIES = 2_048;
+const MAX_MEMO_TEXT_BYTES = 4 * 1024 * 1024;
+const importsMemo = new Map<string, {
+  readonly imports: readonly LiteralModuleImport[];
+  readonly textBytes: number;
+}>();
+let memoTextBytes = 0;
+
+/**
+ * Pure syntax only: callers still read current bytes, enforce their bounds,
+ * resolve every edge from its current importer, and revalidate the filesystem.
+ * Keep only immutable scanner output; never retain source text or an AST.
+ */
+export function scanProviderPluginValueImports(
+  source: string,
+  loader: "js" | "ts",
+): readonly LiteralModuleImport[] {
+  const key = `${loader}\0${createHash("sha256").update(source).digest("hex")}`;
+  const cached = importsMemo.get(key);
+  if (cached !== undefined) return cached.imports;
+  const imports = Object.freeze(scanners[loader].scanImports(source).map(
+    ({ kind, path }) => Object.freeze({ kind, path }),
+  ));
+  const textBytes = key.length + imports.reduce(
+    (total, entry) => total + Buffer.byteLength(entry.kind) + Buffer.byteLength(entry.path),
+    0,
+  );
+  // Count entries as well as returned text so empty modules stay bounded too.
+  // Oversized foreign input is still rejected by the caller's own import bound.
+  if (imports.length > 4_096 || textBytes > MAX_MEMO_TEXT_BYTES) return imports;
+  while (importsMemo.size >= MAX_MEMO_ENTRIES
+    || memoTextBytes + textBytes > MAX_MEMO_TEXT_BYTES) {
+    const oldest = importsMemo.entries().next().value;
+    if (oldest === undefined) break;
+    importsMemo.delete(oldest[0]);
+    memoTextBytes -= oldest[1].textBytes;
+  }
+  importsMemo.set(key, { imports, textBytes });
+  memoTextBytes += textBytes;
+  return imports;
+}

package/src/provider-plugin-module-analysis.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { extname } from "node:path";
 import ts from "typescript";
 
@@ -8,6 +9,12 @@ const opaqueModuleLoaderNames = new Set([
   "getBuiltinModule",
 ]);
 
+// Only a boolean is retained, keyed by the freshly supplied source and every
+// parser input. Filename is included because the source-local binding proof
+// creates a TypeScript program. No AST, path resolution, or authority is cached.
+const nonLiteralLoadMemo = new Map<string, boolean>();
+const MAX_NON_LITERAL_LOAD_MEMO_ENTRIES = 4_096;
+
 function hasOneLiteralModuleArgument(node: ts.CallExpression): boolean {
   const [argument] = node.arguments;
   return node.arguments.length === 1
@@ -244,12 +251,20 @@ function localEvalCallbackProof(sourceFile: ts.SourceFile): (node: ts.Node) => b
  * rather than attempting to sandbox deliberately obfuscated JavaScript.
  */
 export function hasNonLiteralModuleLoad(source: string, path: string): boolean {
+  const scriptKind = providerPluginScriptKind(path);
+  const key = createHash("sha256")
+    .update(JSON.stringify([path, scriptKind]))
+    .update("\0")
+    .update(source)
+    .digest("hex");
+  const cached = nonLiteralLoadMemo.get(key);
+  if (cached !== undefined) return cached;
   const sourceFile = ts.createSourceFile(
     path,
     source,
     ts.ScriptTarget.ESNext,
     false,
-    providerPluginScriptKind(path),
+    scriptKind,
   );
   let callbackProof: ((node: ts.Node) => boolean) | undefined;
   const isLocalCallback = (node: ts.Node): boolean => {
@@ -332,5 +347,10 @@ export function hasNonLiteralModuleLoad(source: string, path: string): boolean {
     node.forEachChild((child) => visit(child, node));
   };
   visit(sourceFile);
+  if (nonLiteralLoadMemo.size >= MAX_NON_LITERAL_LOAD_MEMO_ENTRIES) {
+    const oldest = nonLiteralLoadMemo.keys().next().value;
+    if (oldest !== undefined) nonLiteralLoadMemo.delete(oldest);
+  }
+  nonLiteralLoadMemo.set(key, found);
   return found;
 }

package/src/provider-plugin-registry.ts

@@ -24,6 +24,7 @@ import {
   sep,
 } from "node:path";
 import ts from "typescript";
+import { scanProviderPluginValueImports } from "./provider-plugin-import-analysis";
 import {
   hasNonLiteralModuleLoad,
   providerPluginScriptKind,
@@ -540,10 +541,6 @@ function readDependencySourceFromDisk(path: string): Buffer {
   );
 }
 
-const providerPluginImportScanners = Object.freeze({
-  js: new Bun.Transpiler({ loader: "js" }),
-  ts: new Bun.Transpiler({ loader: "ts" }),
-});
 const providerPluginModuleExtensions = new Set([
   ".cjs",
   ".cts",
@@ -698,11 +695,10 @@ function valueImports(source: string, path: string): readonly {
       `provider plugin implementation module ${path} uses configuration-dependent JSX or TSX; publish deterministic JavaScript or TypeScript instead`,
     );
   }
-  const scanner =
+  const loader =
     extension === ".ts" || extension === ".mts" || extension === ".cts"
-      ? providerPluginImportScanners.ts
-      : providerPluginImportScanners.js;
-  return scanner.scanImports(moduleSource);
+      ? "ts" : "js";
+  return scanProviderPluginValueImports(moduleSource, loader);
 }
 
 

package/src/provider-plugin.ts

@@ -25,6 +25,7 @@ import {
   sep,
 } from "node:path";
 import { fileURLToPath } from "node:url";
+import { scanProviderPluginValueImports } from "./provider-plugin-import-analysis";
 
 import type { GhostgetAuth } from "./auth";
 import type { MessageLikeMeSourceConversationCoordinateBindingV1 } from "./message-like-me-agentic-messaging";
@@ -1339,10 +1340,6 @@ const MAX_PROVIDER_PLUGIN_EVALUATION_PACKAGE_DEPTH = 32;
 const MAX_PROVIDER_PLUGIN_EVALUATION_PACKAGE_PATH_BYTES = 1_024;
 const MAX_PROVIDER_PLUGIN_EVALUATION_PACKAGE_BYTES = 128 * 1024 * 1024;
 const MAX_PROVIDER_PLUGIN_EVALUATION_PACKAGE_CACHE_ENTRIES = 256;
-const providerPluginEvaluationImportScanners = Object.freeze({
-  js: new Bun.Transpiler({ loader: "js" }),
-  ts: new Bun.Transpiler({ loader: "ts" }),
-});
 const providerPluginEvaluationModuleExtensions = new Set([
   ".cjs",
   ".cts",
@@ -2194,11 +2191,10 @@ function providerPluginEvaluationValueImports(
       `provider plugin evaluation module ${path} must be valid UTF-8`,
     );
   }
-  const scanner =
+  const loader =
     extension === ".ts" || extension === ".mts" || extension === ".cts"
-      ? providerPluginEvaluationImportScanners.ts
-      : providerPluginEvaluationImportScanners.js;
-  const imports = Object.freeze([...scanner.scanImports(source)]);
+      ? "ts" : "js";
+  const imports = scanProviderPluginValueImports(source, loader);
   if (imports.length > MAX_PROVIDER_PLUGIN_EVALUATION_IMPORTS_PER_MODULE) {
     throw new Error(
       `provider plugin evaluation module ${path} has too many static imports`,
@@ -3489,6 +3485,20 @@ export function bindProviderPluginRuntimeLoadIdentity(
   );
 }
 
+/** Trusted extensions share the binding's complete source snapshot. They cannot
+ * load an independent provider runtime without the registry's pre/post checks. */
+export async function loadProviderPluginExtensionRuntime<T>(
+  loadRuntime: () => Promise<unknown>, loader: () => Promise<T>,
+): Promise<T> {
+  const identity = providerPluginRuntimeLoadIdentities.get(loadRuntime);
+  if (identity === undefined) throw new Error("Provider extension has no registered implementation identity");
+  providerPluginStartedRuntimeLoaders.add(loadRuntime);
+  await identity.verify("before");
+  const runtime = await loader();
+  await identity.verify("after");
+  return runtime;
+}
+
 export function lazyProviderApiRuntime(
   loader: () => Promise<ProviderApiPluginRuntimeV1>,
 ): ProviderApiPluginRuntimeHooksV1 {

package/src/providers/imessage-automation.ts

@@ -0,0 +1,250 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { join } from "node:path";
+import type { GhostgetAuth } from "../auth";
+import { canonicalJson } from "../canonical-json";
+import type { LocalCliExecutionOptions } from "../local-cli-execution";
+import { OperationDeadline } from "../operation-deadline";
+import type { AutomationAction, AutomationConversation, AutomationCoordinate, AutomationIdentity, AutomationMessage, AutomationProviderStatus, AutomationProviderSendResult, MessagingAutomationProvider } from "../messaging-automation-types";
+import { AUTOMATION_ACTION_KINDS, automationArray, automationDigest, automationInteger, automationRecord, automationText, parseAutomationAction, parseAutomationCoordinate, parseAutomationIdentity } from "../messaging-automation-validation";
+import { IMSG_NO_FETCH_RICH_CARDS_AVAILABLE, type ImsgChatCoordinate, type ImsgRpcRequest } from "./imessage-direct";
+import { imsgAutomationProjection as project, withImsgAutomationRuntime, type ImsgChatProjection, type ImsgDirectRuntimeDependencies } from "./imessage-direct-runtime";
+
+export type ImsgAutomationOperation = "inspect" | "conversations" | "resolve" | "history" | "events" | AutomationAction["kind"];
+/** The Ghostget host supplies existing permission admission, auth lifetime and
+ * exact plugin closure. A contact grant only narrows this authority. */
+export type ImsgAutomationAdmission = Readonly<{ auth: GhostgetAuth; accountIdentity: string; implementationIdentity: string }>;
+export type ImsgAutomationOptions = Readonly<{
+  authorize(operation: ImsgAutomationOperation, signal?: AbortSignal): Promise<ImsgAutomationAdmission>;
+  execution: Pick<LocalCliExecutionOptions, "registerCleanupBarrier" | "environment">;
+  resolveAsset(assetId: string, signal?: AbortSignal): Promise<Readonly<{ bytes: Uint8Array; sha256: string }>>;
+  dependencies?: ImsgDirectRuntimeDependencies;
+}>;
+type Session = Parameters<Parameters<typeof withImsgAutomationRuntime>[2]>[0];
+const sha = (value: unknown): string => createHash("sha256").update(canonicalJson(value)).digest("hex");
+function request(method: string, params: Readonly<Record<string, unknown>> = {}, id = "operation"): ImsgRpcRequest { return { jsonrpc: "2.0", id, method, params }; }
+function coordinate(value: unknown): Extract<AutomationCoordinate, { provider: "imessage" }> {
+  const result = parseAutomationCoordinate(value);
+  if (result.provider !== "imessage") throw new Error("iMessage cannot operate another messaging network");
+  return result;
+}
+function target(value: AutomationCoordinate): ImsgChatCoordinate {
+  const item = coordinate(value); return { chatGuid: item.chatGuid, service: "iMessage", observedChatRowId: item.observedChatRowId };
+}
+function conversation(chat: ImsgChatProjection): AutomationConversation {
+  return { coordinate: coordinate({ provider: "imessage", chatGuid: chat.guid, service: "iMessage", observedChatRowId: chat.id }), title: chat.title, kind: chat.kind, participants: chat.participants };
+}
+async function exactConversation(session: Session, value: AutomationCoordinate): Promise<AutomationConversation> {
+  const selected = target(value);
+  const output = await session.run([request("chats.get", { chat_id: selected.observedChatRowId })]);
+  return conversation(project.exactChat(output.get("operation"), selected));
+}
+function methods(session: Session): ReadonlySet<string> {
+  const status = session.status as Record<string, unknown>; // already parsed by the pinned runtime
+  return new Set(automationArray(status.methods, 256).map(value => automationText(value, 128)));
+}
+function providerStatus(session: Session, identity: AutomationIdentity): AutomationProviderStatus {
+  const available = methods(session);
+  const rpc: Partial<Record<AutomationAction["kind"], string>> = { text: "send", attachment: "send", reaction: "tapback", sticker: "send.sticker", link: "send.rich", poll: "poll.send" };
+  const actions = Object.fromEntries(AUTOMATION_ACTION_KINDS.map(kind => {
+    if (kind === "link" && !IMSG_NO_FETCH_RICH_CARDS_AVAILABLE) return [kind, { available: false, reason: "The installed iMessage artifact predates no-fetch rich cards. The replacement native build has not been admitted." }];
+    const method = rpc[kind]; const ready = method !== undefined && available.has(method);
+    return [kind, { available: ready, reason: ready ? null : !method ? "The pinned iMessage helper has no reviewed operation for this action." : method === "send" ? "The native iMessage send operation is unavailable. Check Messages permissions in Ghostget." : `The private Messages bridge does not currently advertise ${method}. Its injection design requires owner-configured system support, including disabled SIP. Ghostget installation never changes SIP.` }];
+  })) as AutomationProviderStatus["actions"];
+  return { identity, connected: true, events: { available: available.has("messages.after"), reason: available.has("messages.after") ? null : "The pinned database cursor operation is unavailable." }, actions };
+}
+function message(value: unknown, selected: AutomationCoordinate): AutomationMessage {
+  const projected = project.parseMessage(value, "automation message", target(selected));
+  const raw = value as Record<string, unknown>;
+  if (raw.is_reaction !== undefined && typeof raw.is_reaction !== "boolean") throw new Error("Invalid reaction marker");
+  const related = raw.is_reaction === true ? automationText(raw.reacted_to_guid, 256) : projected.replyToGuid;
+  if (Buffer.byteLength(projected.text) > 65_536) throw new Error("Automation message exceeds its text bound");
+  return { id: automationText(projected.guid, 256), coordinate: selected, direction: projected.isFromMe ? "outgoing" : "incoming", occurredAt: projected.createdAt, text: projected.text, kind: raw.is_reaction === true ? "reaction" : "message", relatedMessageId: related, attachments: [] };
+}
+async function historyMessages(session: Session, selected: AutomationCoordinate, limit: number): Promise<readonly AutomationMessage[]> {
+  await exactConversation(session, selected);
+  const response = await session.run([request("messages.history", { chat_id: target(selected).observedChatRowId, limit, attachments: false })]);
+  const row = automationRecord(response.get("operation"), ["messages"]);
+  const messages = automationArray(row.messages, limit).map(raw => message(raw, selected));
+  if (new Set(messages.map(item => item.id)).size !== messages.length) throw new Error("Repeated message identity");
+  return messages;
+}
+type Cursor = { version: 1; identity: string; coordinates: string; rows: number[]; anchors: ({ row: number; id: string } | null)[] };
+function cursor(value: string | null, identity: AutomationIdentity, coordinates: readonly AutomationCoordinate[]): Cursor {
+  if (value === null) return { version: 1, identity: sha(identity), coordinates: sha(coordinates), rows: coordinates.map(() => 0), anchors: coordinates.map(() => null) };
+  automationText(value, 16_384);
+  const decoded = Buffer.from(value, "base64url");
+  if (decoded.toString("base64url") !== value) throw new Error("Noncanonical iMessage cursor");
+  const parsed = automationRecord(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decoded)), ["version", "identity", "coordinates", "rows", "anchors"]);
+  if (parsed.version !== 1 || parsed.identity !== sha(identity) || parsed.coordinates !== sha(coordinates)) throw new Error("iMessage cursor generation or scope changed");
+  const rows = automationArray(parsed.rows, 50).map(value => automationInteger(value, 0, Number.MAX_SAFE_INTEGER));
+  if (rows.length !== coordinates.length) throw new Error("iMessage cursor scope changed");
+  const anchors = automationArray(parsed.anchors, 50).map((value, index) => {
+    if (value === null) return null;
+    const anchor = automationRecord(value, ["row", "id"]);
+    return { row: automationInteger(anchor.row, 1, rows[index] ?? 0), id: automationText(anchor.id, 256) };
+  });
+  if (anchors.length !== rows.length) throw new Error("iMessage cursor anchor scope changed");
+  return { version: 1, identity: parsed.identity as string, coordinates: parsed.coordinates as string, rows, anchors };
+}
+
+/** Concrete pinned imsg implementation. It never starts the private Messages
+ * bridge, changes OS permissions, or falls back to SMS or another transport. */
+export function createImsgAutomationProvider(options: ImsgAutomationOptions): MessagingAutomationProvider {
+  let closed = false; let inFlight: Promise<unknown> | undefined;
+  async function run<T>(operation: ImsgAutomationOperation, signal: AbortSignal | undefined, work: (session: Session, identity: AutomationIdentity, reauthorize: () => Promise<void>) => Promise<T>): Promise<T> {
+    if (closed || inFlight) throw new Error("iMessage provider is closed or busy");
+    const pending = (async () => {
+      signal?.throwIfAborted();
+      const admission = await options.authorize(operation, signal);
+      if (admission.auth.kind !== "linked-device-store" || admission.auth.provider !== "imessage") throw new Error("iMessage account required");
+      const deadline = new OperationDeadline(30_000, signal ? { signal } : {});
+      try {
+        return await withImsgAutomationRuntime(admission.auth, { ...options.execution, operationDeadline: deadline, ...(options.dependencies ? { dependencies: options.dependencies } : {}) }, async session => {
+          const identity = parseAutomationIdentity({ provider: "imessage", authId: admission.auth.id, accountIdentity: admission.accountIdentity, accountSubject: session.subject, implementationIdentity: admission.implementationIdentity, sourceGeneration: session.sourceGeneration });
+          const reauthorize = async () => { signal?.throwIfAborted(); const after = await options.authorize(operation, signal); if (sha(after) !== sha(admission)) throw new Error("iMessage account or permission changed during the operation"); };
+          const result = await work(session, identity, reauthorize);
+          await reauthorize();
+          return result;
+        });
+      } finally { deadline.dispose(); }
+    })();
+    inFlight = pending;
+    try { return await pending; } finally { if (inFlight === pending) inFlight = undefined; }
+  }
+  return {
+    provider: "imessage",
+    inspect(signal) { return run("inspect", signal, async (session, identity) => providerStatus(session, identity)); },
+    conversations(input, signal) {
+      const limit = automationInteger(input.limit, 1, 200);
+      return run("conversations", signal, async (session, identity) => {
+        const result = await session.run([request("chats.list", { limit })]);
+        return { identity, conversations: project.parseChats(result.get("operation")).map(conversation), complete: false };
+      });
+    },
+    resolve(value, signal) { const selected = coordinate(value); return run("resolve", signal, async (session, identity) => ({ identity, conversation: await exactConversation(session, selected) })); },
+    history(input, signal) {
+      const selected = coordinate(input.coordinate), limit = automationInteger(input.limit, 1, 200);
+      return run("history", signal, async (session, identity) => {
+        await exactConversation(session, selected);
+        const response = await session.run([request("messages.history", { chat_id: selected.observedChatRowId, limit, attachments: false })]);
+        const raw = automationArray(automationRecord(response.get("operation"), ["messages"]).messages, limit);
+        const messages = raw.map(value => message(value, selected));
+        if (new Set(messages.map(item => item.id)).size !== messages.length) throw new Error("Repeated history identity");
+        const next = cursor(null, identity, [selected]);
+        for (const [index, value] of raw.entries()) {
+          const row = automationInteger((value as Record<string, unknown>).id, 1, Number.MAX_SAFE_INTEGER);
+          if (row > next.rows[0]!) { next.rows[0] = row; next.anchors[0] = { row, id: messages[index]!.id }; }
+        }
+        // Start after the newest verified history row, then silently drain any
+        // remaining rows to establish the initial live boundary.
+        return { identity, messages, nextCursor: Buffer.from(canonicalJson(next)).toString("base64url"), caughtUp: false, gap: false };
+      });
+    },
+    events(input, signal) {
+      const coordinates = automationArray(input.coordinates, 50).map(coordinate).sort((a, b) => canonicalJson(a).localeCompare(canonicalJson(b)));
+      if (coordinates.length === 0 || new Set(coordinates.map(sha)).size !== coordinates.length) throw new Error("Distinct iMessage event scopes required");
+      const limit = automationInteger(input.limit, 1, 500);
+      return run("events", signal, async (session, identity) => {
+        if (!methods(session).has("messages.after")) throw new Error("Database event cursor is unavailable");
+        const next = cursor(input.cursor, identity, coordinates);
+        const messages: AutomationMessage[] = []; let caughtUp = true;
+        for (const [index, selected] of coordinates.entries()) {
+          if (messages.length === limit) { caughtUp = false; break; }
+          await exactConversation(session, selected);
+          const anchor = next.anchors[index];
+          if (anchor) {
+            const proof = await session.run([request("messages.after", { chat_id: selected.observedChatRowId, since_rowid: anchor.row - 1, limit: 1, attachments: false, convert_attachments: false, include_reactions: true })]);
+            const proofPage = automationRecord(proof.get("operation"), ["messages", "next_rowid", "has_more"]);
+            const first = automationArray(proofPage.messages, 1)[0];
+            if (!first || (first as Record<string, unknown>).id !== anchor.row || message(first, selected).id !== anchor.id) throw new Error("iMessage cursor anchor changed; re-enrollment is required");
+          }
+          const remaining = limit - messages.length;
+          const result = await session.run([request("messages.after", { chat_id: selected.observedChatRowId, since_rowid: next.rows[index], limit: remaining, attachments: false, convert_attachments: false, include_reactions: true })]);
+          const page = automationRecord(result.get("operation"), ["messages", "next_rowid", "has_more"]);
+          const nextRow = automationInteger(page.next_rowid, next.rows[index]!, Number.MAX_SAFE_INTEGER);
+          if (typeof page.has_more !== "boolean" || page.has_more && nextRow === next.rows[index]) throw new Error("Nonprogressing iMessage cursor");
+          const rawMessages = automationArray(page.messages, remaining);
+          let previous = next.rows[index]!;
+          for (const raw of rawMessages) {
+            const parsed = message(raw, selected);
+            const rowId = automationInteger((raw as Record<string, unknown>).id, previous + 1, nextRow);
+            previous = rowId; messages.push(parsed); next.anchors[index] = { row: rowId, id: parsed.id };
+          }
+          next.rows[index] = nextRow;
+          if (page.has_more) caughtUp = false;
+        }
+        if (new Set(messages.map(item => item.id)).size !== messages.length) throw new Error("Repeated event identity");
+        return { identity, messages, nextCursor: Buffer.from(canonicalJson(next)).toString("base64url"), caughtUp, gap: false };
+      });
+    },
+    async send(input, signal): Promise<AutomationProviderSendResult> {
+      const selected = coordinate(input.coordinate), action = parseAutomationAction(input.action), expected = parseAutomationIdentity(input.identity);
+      let dispatched = false;
+      try {
+        return await run(action.kind, signal, async (session, identity, reauthorize) => {
+          if (sha(identity) !== sha(expected)) throw new Error("iMessage account or source changed before dispatch");
+          const live = await exactConversation(session, selected);
+          if (live.kind !== "single" || live.participants.length !== 1) throw new Error("Only direct participant-bound automation is supported");
+          if (!providerStatus(session, identity).actions[action.kind].available) throw new Error("Requested action is unavailable");
+          let method: string; const params: Record<string, unknown> = { chat_guid: selected.chatGuid };
+          if (action.kind === "text") { method = "send"; Object.assign(params, { text: action.text, service: "imessage", transport: "applescript", allow_sms_fallback: false }); }
+          else if (action.kind === "link") { method = "send.rich"; params.url = action.url; params.fetch_metadata = false; }
+          else if (action.kind === "poll") { if (action.maximumSelections !== null) throw new Error("Native iMessage polls use provider selection behavior"); method = "poll.send"; Object.assign(params, { question: action.question, options: action.options, suppress_comment: true }); }
+          else if (action.kind === "reaction" || action.kind === "sticker" || action.kind === "attachment") {
+            if ((action.kind === "reaction" || action.kind === "sticker") && action.messageId !== null) {
+              const current = await historyMessages(session, selected, 200);
+              if (!current.some(message => message.id === action.messageId && message.kind === "message")) throw new Error("Reaction or sticker target must belong to current conversation history");
+            }
+            if (action.kind === "reaction") {
+              if (!["❤️", "👍", "👎", "😂", "‼️", "❓"].includes(action.emoji)) throw new Error("This iMessage contract admits the six standard reactions");
+              method = "tapback"; Object.assign(params, { message_guid: action.messageId, emoji: action.emoji, remove: action.remove });
+            } else {
+              const asset = await options.resolveAsset(action.assetId, signal);
+              const maximum = action.kind === "sticker" ? 500 * 1024 : 16 * 1024 * 1024;
+              if (!(asset.bytes instanceof Uint8Array) || asset.bytes.byteLength < 1 || asset.bytes.byteLength > maximum) throw new Error("Attachment byte admission failed");
+              const bytes = Buffer.from(asset.bytes);
+              if (createHash("sha256").update(bytes).digest("hex") !== automationDigest(asset.sha256)) throw new Error("Attachment byte admission failed");
+              const path = join(session.operationRoot, action.kind === "attachment" ? action.name : "sticker");
+              const file = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+              try { await file.writeFile(bytes); await file.sync(); } finally { await file.close(); }
+              params.file = path;
+              if (action.kind === "sticker") { method = "send.sticker"; if (action.messageId !== null) params.attach_to = action.messageId; }
+              else { method = "send"; Object.assign(params, { service: "imessage", transport: "applescript", allow_sms_fallback: false }); }
+            }
+          } else throw new Error("No reviewed iMessage implementation exists for this experience");
+          signal?.throwIfAborted();
+          const response = await session.run([request(method, params)], async () => {
+            await reauthorize();
+            if (sha(await exactConversation(session, selected)) !== sha(live)) throw new Error("iMessage participants changed before dispatch");
+            await reauthorize();
+            dispatched = true;
+          });
+          const raw = response.get("operation");
+          if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Invalid iMessage acceptance");
+          const result = raw as Record<string, unknown>;
+          if (action.kind === "text" || action.kind === "attachment") {
+            const accepted = project.parseSendAccepted(result, target(selected));
+            return { state: "accepted", messageId: automationText(accepted.messageGuid, 256), providerReceiptId: null, delivery: "unknown" };
+          }
+          const allowed = action.kind === "reaction" ? ["ok", "reaction"] : action.kind === "poll" ? ["ok", "event", "guid", "message_id", "poll"] : action.kind === "link" ? ["ok", "id", "guid", "message_id", "messageGuid", "chat_guid", "chatGuid", "queued", "service", "richLinkImageUsed"] : ["ok", "transfer_guid"];
+          if (result.ok !== true || Object.keys(result).some(key => !allowed.includes(key)) || result.chat_guid !== undefined && result.chat_guid !== selected.chatGuid || result.transport !== undefined && result.transport !== "applescript") throw new Error("iMessage acceptance changed");
+          const ids = [result.guid, result.message_id, result.messageGuid].filter(value => value !== undefined).map(value => automationText(value, 256));
+          const messageId = ids[0] ?? null;
+          if (ids.some(value => value !== messageId)) throw new Error("Ambiguous iMessage result identity");
+          if (result.chatGuid !== undefined && result.chatGuid !== selected.chatGuid || result.queued !== undefined && typeof result.queued !== "boolean") throw new Error("iMessage rich-link receipt changed");
+          if (action.kind === "link" && (result.service !== undefined && result.service !== "iMessage" || result.richLinkImageUsed !== undefined && result.richLinkImageUsed !== false)) throw new Error("iMessage rich-link transport or metadata mode changed");
+          if (result.id !== undefined) automationInteger(result.id, 1, Number.MAX_SAFE_INTEGER);
+          if (action.kind === "link" && messageId === null) throw new Error("Rich-link acceptance has no reconciled message identity");
+          const providerReceiptId = result.transfer_guid === undefined ? null : automationText(result.transfer_guid, 256);
+          if (action.kind === "reaction") { automationRecord(result, ["ok", "reaction"]); automationInteger(result.reaction, action.remove ? 3000 : 2000, action.remove ? 3005 : 2005); }
+          if (action.kind === "sticker") { automationRecord(result, ["ok", "transfer_guid"]); if (providerReceiptId === null) throw new Error("Sticker transfer receipt is missing"); }
+          if (action.kind === "poll" && (result.event !== "imessage.poll.created" || messageId === null)) throw new Error("Poll creation receipt is missing");
+          return { state: "accepted", messageId, providerReceiptId, delivery: "unknown" };
+        });
+      } catch { return { state: dispatched ? "indeterminate" : "not-started", reason: dispatched ? "iMessage dispatch or process cleanup could not be reconciled. Do not retry." : "iMessage admission failed before any send." }; }
+    },
+    async close() { closed = true; await inFlight; },
+  };
+}

package/src/providers/imessage-direct-install.ts

@@ -9,6 +9,7 @@ import {
   unlink,
 } from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
+import { ensureImsgNativeResources, verifyImsgNativeResources } from "./messaging-native-install";
 
 import {
   ensurePrivateStateDirectory,
@@ -136,6 +137,11 @@ export async function resolvePinnedImsgBinary(
       `reviewed imsg transport ${IMSG_REVIEWED_VERSION} is unavailable or failed integrity verification`,
     );
   }
+  try {
+    await verifyImsgNativeResources(join(ghostgetStateHome(environment), "tools", "imsg", IMSG_REVIEWED_VERSION));
+  } catch {
+    throw installFailure("reviewed imsg resources are unavailable or failed integrity verification");
+  }
   return resolved;
 }
 
@@ -274,6 +280,7 @@ export async function installReviewedImsgBinary(
   try {
     ensurePrivateStateDirectory(installDirectory, environment);
     await validateInstallDirectory(installDirectory);
+    await ensureImsgNativeResources(installDirectory, environment);
   } catch (error) {
     if (error instanceof ImsgInstallFailure) throw error;
     throw installFailure("imsg install state directory is unavailable or unsafe");