@inhuman.tools/harness 0.1.0 → 0.3.0

package/dist/server/daemon/kernel/KernelDaemon.d.ts

@@ -1,4 +1,5 @@
 import { PluginProjectionRegistry, KernelPlexus, SessionPlexus, type GrantRow, type SessionRoot } from "@inhuman.tools/harness-model";
+import { type KvProposal, type PermissionMode } from "@inhuman.tools/harness-model/shared";
 import * as Y from "yjs";
 import { type DriverRegistry } from "../../../connections/index.js";
 import { BehaviorKernel } from "../../../extensions/index.js";
@@ -420,6 +421,30 @@ export declare class KernelDaemon extends RequestHost implements Disposable, Asy
         invoke: string;
         scope: "project" | "home";
         body: string;
+    }> | DaemonRpcMethod<{
+        name?: string | undefined;
+    }, {
+        ok: true;
+        email: string;
+        machineId: string;
+    } | {
+        ok: false;
+    } | {
+        [x: string]: unknown;
+        form: "ui";
+        body: string;
+        pending: string;
+    }> | DaemonRpcMethod<Record<string, never>, {
+        loggedIn: boolean;
+        machineId: string;
+        machineName: string;
+        relayUrl: string;
+        connected: boolean;
+        email?: string | undefined;
+        lastError?: string | undefined;
+    }> | DaemonRpcMethod<Record<string, never>, {
+        ok: true;
+        wasLoggedIn: boolean;
     }> | DaemonRpcMethod<{
         scope: "project" | "home";
         name: string;
@@ -457,6 +482,9 @@ export declare class KernelDaemon extends RequestHost implements Disposable, Asy
     /** Drop expired rows from the file so the permissions view stays honest. Returns how many went. */
     sweepGrants(now?: number): number;
     adjustKv(update: (bag: Record<string, string>) => Record<string, string> | void): Record<string, string>;
+    writeKvs(proposals: readonly KvProposal[]): void;
+    rememberModelChoice(connection: string, model: string): void;
+    writeDefaultPermissionMode(policy: PermissionMode): void;
     ui(body: string): Promise<{
         kind: "accept";
     } | {

package/dist/server/daemon/kernel/KernelDaemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KernelDaemon.d.ts","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/KernelDaemon.ts"],"names":[],"mappings":"AAmBA,OAAO,EAUL,wBAAwB,EACxB,YAAY,EAEZ,aAAa,EAMb,KAAK,QAAQ,EAGb,KAAK,WAAW,EAEjB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAGzB,OAAO,EAA4C,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAoB,cAAc,EAA6C,MAAM,cAAc,CAAC;AAW3G,OAAO,EAA2B,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAmB,aAAa,EAAc,KAAK,WAAW,EAAE,MAAM,OAAO,CAAC;AAkBrF,OAAO,EAAE,eAAe,EAA+B,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAMhH,OAAO,EAAsD,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGlH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAUhE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AA+BjE,qBAAa,YAAa,SAAQ,WAAY,YAAW,UAAU,EAAE,eAAe;;IAsXhF,QAAQ,CAAC,IAAI,EAAE,MAAM;IArXvB,MAAM,EAAG,YAAY,CAAC;IAgBtB,QAAQ,CAAC,OAAO,oBAA2B;IAC3C,QAAQ,CAAC,WAAW,2BAAkC;IACtD,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACnD,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,iBAcd;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAsBrB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAyTjB;gBAGS,IAAI,EAAE,MAAM,EAErB,QAAQ,GAAE,cAAsD;IA2KlE,IAAI,WAAW,gFAEd;IAqCD,mFAAmF;IACnF,IAAI,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEjC;IAED,gBAAgB,IAAI,WAAW,EAAE;IAqIjC,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,GAAG,IAAI,GAAG,UAAU;IAS3E,4GAA4G;IAC5G,gBAAgB,IAAI,QAAQ,EAAE;IAI9B,+EAA+E;IAC/E,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IASvC,iHAAiH;IACjH,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAmBpD,mGAAmG;IACnG,WAAW,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM;IAqF7C,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAO/F,EAAE,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;;cAKL,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;cAItC,OAAO,CAAC,GAAG,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;cAU7C,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIpD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI;IAYrF,+FAA+F;IAC/F,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI1C,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIxC,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,uBAAuB,IAAI,WAAW,CAAC,MAAM,CAAC;IAgB9C,4EAA4E;IAC5E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAKzD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAInC,6DAA6D;IAC7D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAI3D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,aAAa;IA6CpF;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAqB5E,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAchG;;;OAGG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA2B3E,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IA0I7C,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAMzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAW9B,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAWnE,gFAAgF;IAC1E,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IAUV,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAO9D;;;OAGG;IACG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB5C,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;CAqFzB"}
+{"version":3,"file":"KernelDaemon.d.ts","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/KernelDaemon.ts"],"names":[],"mappings":"AAoBA,OAAO,EAML,wBAAwB,EACxB,YAAY,EAGZ,aAAa,EAMb,KAAK,QAAQ,EAGb,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAW,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAMpG,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAGzB,OAAO,EAA4C,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAoB,cAAc,EAA6C,MAAM,cAAc,CAAC;AAW3G,OAAO,EAA2B,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAmB,aAAa,EAAc,KAAK,WAAW,EAAE,MAAM,OAAO,CAAC;AAsBrF,OAAO,EAAE,eAAe,EAA+B,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAIhH,OAAO,EAAsD,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGlH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAUhE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AA+BjE,qBAAa,YAAa,SAAQ,WAAY,YAAW,UAAU,EAAE,eAAe;;IA0dhF,QAAQ,CAAC,IAAI,EAAE,MAAM;IAzdvB,MAAM,EAAG,YAAY,CAAC;IAgBtB,QAAQ,CAAC,OAAO,oBAA2B;IAC3C,QAAQ,CAAC,WAAW,2BAAkC;IACtD,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACnD,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,iBAcd;IAcH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAuBrB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA+YjB;gBAGS,IAAI,EAAE,MAAM,EAErB,QAAQ,GAAE,cAAsD;IAqLlE,IAAI,WAAW,gFAEd;IAqCD,mFAAmF;IACnF,IAAI,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEjC;IAED,gBAAgB,IAAI,WAAW,EAAE;IAkJjC,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,GAAG,IAAI,GAAG,UAAU;IAS3E,4GAA4G;IAC5G,gBAAgB,IAAI,QAAQ,EAAE;IAI9B,+EAA+E;IAC/E,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IASvC,iHAAiH;IACjH,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAmBpD,mGAAmG;IACnG,WAAW,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM;IAqF7C,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAOxG,QAAQ,CAAC,SAAS,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI;IAOhD,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5D,0BAA0B,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAM/C,EAAE,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;;cAKL,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;cAItC,OAAO,CAAC,GAAG,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;cAU7C,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIpD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI;IAYrF,+FAA+F;IAC/F,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI1C,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIxC,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,uBAAuB,IAAI,WAAW,CAAC,MAAM,CAAC;IAgB9C,4EAA4E;IAC5E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAKzD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAInC,6DAA6D;IAC7D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAI3D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,aAAa;IA6CpF;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAqB5E,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAchG;;;OAGG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA2B3E,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAsI7C,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAMzC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAW9B,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAWnE,gFAAgF;IAC1E,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IAUV,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAO9D;;;OAGG;IACG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB5C,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;CAsFzB"}

package/dist/server/daemon/kernel/KernelDaemon.js

@@ -3,12 +3,16 @@ import { mkdir } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { Writable } from "node:stream";
+import { isDeepStrictEqual } from "node:util";
 import { DefaultedMap } from "@here.build/collections";
 import { asUserPrompt } from "@inhuman.tools/harness-commons";
 import { contract } from "@inhuman.tools/harness-contract";
 import { fail, step } from "@inhuman.tools/harness-diagnostics";
-import { AskAgentSpec, DEFAULT_COMPACT_STRATEGY, DEFAULT_COMPACT_TRIGGERS, DEFAULT_COMPACT_KEEP_TURNS, latestUserPrompt, outgoingAgentRelations, bindSessionProjections, PluginProjectionRegistry, KernelPlexus, ProjectPlexus, SessionPlexus, sessionIsOccupied, projectBotSpecs, fencedSubtree, grantLabel, rowKind, parseAuthorizationConfig, parseGrantRows, SessionTurn, } from "@inhuman.tools/harness-model";
+import { AskAgentSpec, DEFAULT_COMPACT_STRATEGY, DEFAULT_COMPACT_TRIGGERS, DEFAULT_COMPACT_KEEP_TURNS, bindSessionProjections, PluginProjectionRegistry, KernelPlexus, HOST_QUEUE_VERBS, ProjectPlexus, SessionPlexus, sessionIsOccupied, projectBotSpecs, fencedSubtree, grantLabel, rowKind, parseAuthorizationConfig, parseGrantRows, } from "@inhuman.tools/harness-model";
+import { applyKv } from "@inhuman.tools/harness-model/shared";
+import { daemonSocketPath } from "@inhuman.tools/harness-sdk/paths";
 import { disposeKernelConnections, dropConnection } from "@inhuman.tools/plexus-expectations/executor";
+import { sessionSummary, observeSessionSummary } from "@inhuman.tools/turn/runtime";
 import fs from "fs-extra";
 import { autorun, comparer, observable, reaction, runInAction } from "mobx";
 import * as Y from "yjs";
@@ -21,18 +25,20 @@ import { documentKey, KERNEL_DOCUMENT_KEY } from "../../../protocol/document/ind
 import { adoptMcp, logoutMcpHttp, addConnectionAlwaysAllow, addConnectionToolExclude, searchOfficialRegistry, } from "../../../providers/mcp/index.js";
 import { graphEligibleSessionIds, ProductionRuntime } from "../../../runtime/index.js";
 import { DocumentService, AwarenessRoom, attachLens } from "../../../yjs/index.js";
-import { internLookedAt, probeCompletionCatalog } from "./completion-catalog.js";
+import { internLookedAt, probeCompletionCatalog, warmCompletionCatalog } from "./completion-catalog.js";
 import { loginConnection, requireConnection, settingsBag, toListRow } from "./connection-rpc.js";
 import { healKernelDependencies, KERNEL_SEED_PACKAGES } from "./kernel-package.js";
+import { RemoteAccess, remoteLoggedIn } from "./remote-access.js";
+import { RemoteConnector } from "./remote-connector.js";
+import { WEB_STATIC_DIR_ENV } from "./remote-http.js";
 import { applyConfigSet, applyPluginSet } from "./settings-config.js";
 import { listSkillFiles, readBotAuthoring, removeBotFile, removeSkillFile, skillBody, skillsHome, writeBotFile, writeSkillFile, } from "./settings-files.js";
 import { adjustJson } from "../../adjust-json.js";
 import { bindBlobStore } from "../../blobs/store.js";
+import { PRODUCT_PROVIDERS } from "../../composition.js";
 import { DaemonRpcMethod, isAbortError, isUiCancelled, RequestHost, RpcInvalidParams } from "../../contract.js";
 import { KernelReflector } from "./fs-reflection/KernelReflector.js";
 import { reflectKernel } from "./fs-reflection/reflectKernel.js";
-import { glanceAskLine } from "./glance-ask-line.js";
-import { PRODUCT_PROVIDERS } from "../../composition.js";
 import { defaultCompactSource } from "../../defaults/index.js";
 import { parseConfigJson, parseKvBag, connectionSliceSchema } from "../../schemas/well-known.js";
 import { deleteConnectionSecrets, readConnectionSecrets, writeConnectionSecrets } from "../../secrets.js";
@@ -101,6 +107,19 @@ export class KernelDaemon extends RequestHost {
         approved: (plugin) => new Set(this.#config().plugins[plugin]?.guards),
         store: new KernelStateStore(() => this.root, (sessionId) => this.runtime.replica(sessionId)?.root),
     });
+    /** Remote-access login and tokens; durable in the kernel's `secrets.json`. */
+    #remote = new RemoteAccess({
+        credentials: {
+            read: (id) => readConnectionSecrets(this.root, id),
+            write: (id, secrets) => writeConnectionSecrets(this.root, id, { ...secrets }),
+        },
+    });
+    /**
+     * Dials the relay while logged in. The static directory is the CLI's to
+     * name (the daemon does not depend on the web app); file roots are the
+     * projects this kernel knows.
+     */
+    #connector;
     ready;
     #daemons = new Map();
     #acquiring = new Map();
@@ -123,6 +142,7 @@ export class KernelDaemon extends RequestHost {
      * otherwise `term-continue/set` on the next TUI boot waits forever.
      */
     #writeChain = Promise.resolve();
+    #loginAttempts = new Map();
     rpcMethods = [
         DaemonRpcMethod.fromContract(contract.kernel.termContinue.set, (args) => {
             this.plexus.root.termContinue[args.key] = args.sessionId;
@@ -188,6 +208,7 @@ export class KernelDaemon extends RequestHost {
             const secretBag = { ...bags.secrets, ...(secrets ?? {}) };
             if (Object.keys(secretBag).length > 0)
                 writeConnectionSecrets(this.root, id, secretBag);
+            warmCompletionCatalog(this, this, id);
             return { id };
         }),
         DaemonRpcMethod.fromContract(contract.kernel.mcpServer.adopt, async ({ name, input, settings, secrets }) => {
@@ -298,25 +319,70 @@ export class KernelDaemon extends RequestHost {
         DaemonRpcMethod.fromContract(contract.kernel.connect.login, async (args) => {
             step(`connect/login ${args.id}`);
             const signal = this.requestSignal();
+            let attempt;
             try {
+                const spec = requireConnection(this.connections, args.id, "connect/login");
+                attempt = {};
+                this.#loginAttempts.set(args.id, attempt);
+                const driver = spec.driver.name;
+                const settings = settingsBag(spec);
+                const beforeSettings = structuredClone(settings);
+                const assertCurrent = (config = this.#config()) => {
+                    if (signal.aborted)
+                        throw new DOMException("Sign-in cancelled", "AbortError");
+                    RpcInvalidParams.invariant(this.#loginAttempts.get(args.id) === attempt, "A newer sign-in attempt replaced this one. Try again.");
+                    const row = config.connections[args.id];
+                    RpcInvalidParams.invariant(row?.driver === driver &&
+                        this.connections[args.id] === spec &&
+                        isDeepStrictEqual(row.settings, beforeSettings), "Connection changed during sign-in. Try again.");
+                };
+                if (spec.driver.abilityClaim.includes("completion")) {
+                    // Re-run the driver's sign-in ceremony without allocating another connection.
+                    // Do not pass old secrets: key-based drivers must ask for a replacement too.
+                    const bags = await this.runtime.adopt(driver, this.plexus.root.drivers, { name: spec.name, settings, signal, reauthenticate: true }, (kind, body) => {
+                        RpcInvalidParams.invariant(kind === "UI", `unknown callback ${kind}`);
+                        return this.ui(body);
+                    });
+                    if (signal.aborted)
+                        return { ok: false };
+                    this.adjustConfig((config) => {
+                        assertCurrent(config);
+                        const row = config.connections[args.id];
+                        row.settings = { ...row.settings, ...bags.settings };
+                    });
+                    writeConnectionSecrets(this.root, args.id, { ...bags.secrets });
+                    await dropConnection(this.plexus.root, args.id);
+                    // The picker is still looking at the same id, so awareness does not
+                    // change. Warm the replacement handle explicitly after dropping it.
+                    await probeCompletionCatalog(this, this, args.id);
+                    return { ok: true };
+                }
                 const result = await loginConnection(args.id, this.connections, {
                     signal,
                     ui: (body) => this.ui(body),
-                    writeSecrets: (id, secrets) => writeConnectionSecrets(this.root, id, { ...secrets }),
+                    writeSecrets: (id, secrets) => {
+                        assertCurrent();
+                        writeConnectionSecrets(this.root, id, { ...secrets });
+                    },
                     readSecrets: (id) => readConnectionSecrets(this.root, id),
                 });
+                assertCurrent();
                 step(`memo-clear: connection=${args.id}`);
                 await dropConnection(this.plexus.root, args.id);
                 return result;
             }
             catch (error) {
-                if (isAbortError(error))
+                if (isUiCancelled(error) || isAbortError(error))
                     return { ok: false };
                 if (error instanceof RpcInvalidParams)
                     throw error;
                 fail("connect/login", error);
                 RpcInvalidParams.invariant(false, error instanceof Error ? error.message : "connect/login failed");
             }
+            finally {
+                if (attempt != null && this.#loginAttempts.get(args.id) === attempt)
+                    this.#loginAttempts.delete(args.id);
+            }
         }),
         DaemonRpcMethod.fromContract(contract.kernel.connect.logout, (args) => {
             step(`connect/logout ${args.id}`);
@@ -383,15 +449,21 @@ export class KernelDaemon extends RequestHost {
         }),
         DaemonRpcMethod.fromContract(contract.kernel.skill.list, (args) => {
             const project = this.#knownProject(args.project);
-            return { skills: listSkillFiles(project, skillsHome()) };
+            return { skills: listSkillFiles(project, skillsHome(), this.#reservedSkillCommands()) };
         }),
         DaemonRpcMethod.fromContract(contract.kernel.skill.write, (args) => {
             const root = args.scope === "home" ? this.#skillsHome() : this.#knownProject(args.project);
             RpcInvalidParams.invariant(root != null, "skill/write: no directory for that scope");
             const location = writeSkillFile(root, args.name, args.description, args.body);
-            const listed = listSkillFiles(args.scope === "project" ? root : null, args.scope === "home" ? root : skillsHome());
+            const listed = listSkillFiles(args.scope === "project" ? root : null, args.scope === "home" ? root : skillsHome(), this.#reservedSkillCommands());
             const row = listed.find((skill) => skill.location === location || skill.name === args.name);
-            return row ?? { name: args.name, description: args.description, location, invoke: args.name, scope: args.scope };
+            return (row ?? {
+                name: args.name,
+                description: args.description,
+                location,
+                invoke: this.#reservedSkillCommands().has(args.name) ? `skill:${args.name}` : args.name,
+                scope: args.scope,
+            });
         }),
         DaemonRpcMethod.fromContract(contract.kernel.skill.remove, (args) => {
             const root = args.scope === "home" ? this.#skillsHome() : this.#knownProject(args.project);
@@ -402,11 +474,36 @@ export class KernelDaemon extends RequestHost {
         DaemonRpcMethod.fromContract(contract.kernel.skill.read, (args) => {
             const root = args.scope === "home" ? this.#skillsHome() : this.#knownProject(args.project);
             RpcInvalidParams.invariant(root != null, "skill/read: no directory for that scope");
-            const listed = listSkillFiles(args.scope === "project" ? root : null, args.scope === "home" ? root : skillsHome());
+            const listed = listSkillFiles(args.scope === "project" ? root : null, args.scope === "home" ? root : skillsHome(), this.#reservedSkillCommands());
             const row = listed.find((skill) => skill.name === args.name && skill.scope === args.scope);
             RpcInvalidParams.invariant(row != null, `skill/read: unknown skill ${args.name}`);
             return { ...row, body: skillBody(row.location) };
         }),
+        DaemonRpcMethod.fromContract(contract.kernel.remote.login, async ({ name }) => {
+            step("remote/login");
+            const signal = this.requestSignal();
+            try {
+                const done = await this.#remote.login((body) => this.ui(body), {
+                    signal,
+                    ...(name === undefined ? {} : { name }),
+                });
+                this.#connector.start();
+                return { ok: true, ...done };
+            }
+            catch (error) {
+                if (isUiCancelled(error) || isAbortError(error))
+                    return { ok: false };
+                fail("remote/login", error);
+                RpcInvalidParams.invariant(false, error instanceof Error ? error.message : "remote/login failed");
+            }
+        }),
+        DaemonRpcMethod.fromContract(contract.kernel.remote.status, () => this.#remote.status(this.#connector.connected)),
+        DaemonRpcMethod.fromContract(contract.kernel.remote.logout, async () => {
+            step("remote/logout");
+            const done = this.#remote.logout();
+            await this.#connector.stop();
+            return { ok: true, ...done };
+        }),
         DaemonRpcMethod.fromContract(contract.kernel.bot.write, (args) => {
             const dir = this.#botDir(args.scope, args.project);
             const prior = readBotAuthoring(dir, args.name);
@@ -436,6 +533,14 @@ export class KernelDaemon extends RequestHost {
     registry = openDriverRegistry(PRODUCT_PROVIDERS)) {
         super();
         this.root = root;
+        this.#connector = new RemoteConnector({
+            access: this.#remote,
+            sockPath: daemonSocketPath(realpathOrSelf(root)),
+            http: {
+                staticDir: process.env[WEB_STATIC_DIR_ENV],
+                fileRoots: () => Object.keys(this.plexus.root.projects),
+            },
+        });
         bindVisualStore(this.root);
         bindBlobStore(this.root);
         this.runtime = new ProductionRuntime({
@@ -557,6 +662,7 @@ export class KernelDaemon extends RequestHost {
         await this.#reflector.ready;
         if (this.#closed)
             return;
+        warmCompletionCatalog(this, this);
         this.#homeWatcher = new BotsWatcher(defaultBotsHome(this.root), () => this.#syncHomeBots(true));
         this.#globalHost = new ProjectDaemon(this, this.root, true);
         await this.#globalHost.ready;
@@ -592,6 +698,8 @@ export class KernelDaemon extends RequestHost {
         }
         else {
             this.#activate();
+            if (remoteLoggedIn(this.root))
+                this.#connector.start();
         }
     }
     /** Occupancy attach starts after needed replicas are interned. */
@@ -767,6 +875,22 @@ export class KernelDaemon extends RequestHost {
         RpcInvalidParams.invariant(Object.hasOwn(this.plexus.root.projects, path), `unknown project ${path}`);
         return path;
     }
+    #reservedSkillCommands() {
+        const reserved = new Set(HOST_QUEUE_VERBS);
+        for (const [key, spec] of Object.entries(this.plexus.root.commands)) {
+            if (key !== "")
+                reserved.add(key);
+            if (spec == null)
+                continue;
+            if (spec.verb !== "")
+                reserved.add(spec.verb);
+            for (const alias of spec.aliases) {
+                if (alias !== "")
+                    reserved.add(alias);
+            }
+        }
+        return reserved;
+    }
     #skillsHome() {
         return skillsHome();
     }
@@ -907,6 +1031,20 @@ export class KernelDaemon extends RequestHost {
             return update(bag) ?? bag;
         });
     }
+    writeKvs(proposals) {
+        this.adjustKv((bag) => {
+            applyKv(bag, proposals);
+        });
+        this.plexus.root.applyKvs(proposals);
+    }
+    rememberModelChoice(connection, model) {
+        this.plexus.root.stampModelUsage(connection, model);
+    }
+    writeDefaultPermissionMode(policy) {
+        this.adjustConfig((config) => {
+            config.defaultPermissionMode = policy;
+        });
+    }
     ui(body) {
         this.#writeChain = Promise.resolve();
         return super.ui(body);
@@ -1110,10 +1248,10 @@ export class KernelDaemon extends RequestHost {
     #watchSessionGlance(sessionId, plexus) {
         if (this.#glanceWatch.has(sessionId))
             return;
-        const stopLens = reaction(() => glanceSnapOf(plexus.root), (snap) => {
+        const stopLens = observeSessionSummary(plexus, (snap) => {
             this.#upsertSessionGlance(sessionId, snap);
             this.#rememberConversationFromSnap(sessionId, snap);
-        }, { equals: comparer.structural, fireImmediately: true });
+        });
         const stopHead = reaction(() => plexus.root.head?.uuid ?? "", (uuid) => {
             if (uuid === "")
                 return;
@@ -1213,7 +1351,7 @@ export class KernelDaemon extends RequestHost {
     }
     /** Conversation catalog is empty-scope only. Stamp/re-intern retracts a named worker. */
     #rememberConversation(sessionId, plexus) {
-        this.#rememberConversationFromSnap(sessionId, glanceSnapOf(plexus.root));
+        this.#rememberConversationFromSnap(sessionId, sessionSummary(plexus.root));
     }
     #rememberConversationFromSnap(sessionId, snap) {
         if (snap.path === "")
@@ -1305,6 +1443,7 @@ export class KernelDaemon extends RequestHost {
     }
     [Symbol.dispose]() {
         this.#closed = true;
+        void this.#connector.stop();
         this.#eligibilityWatch?.();
         this.#eligibilityWatch = null;
         this.#room?.close(1001, "kernel disposed");
@@ -1398,32 +1537,6 @@ export class KernelDaemon extends RequestHost {
             throw new Error(`flushDocument: ${result.reason}`);
     }
 }
-function glanceSnapOf(root) {
-    const spec = root.agent.spec;
-    const unfinished = root.unfinished;
-    return {
-        title: root.title,
-        recipeScope: spec.recipeScope,
-        specName: spec.name,
-        resident: spec.resident,
-        keepAlive: spec.keepAlive,
-        oneShot: spec instanceof AskAgentSpec,
-        model: (root.kvs.model ?? "").trim(),
-        status: root.turnDescription,
-        midMotion: root.midMotion,
-        openTurn: root.openTurn,
-        openToolCount: root.openToolCount,
-        periodArmed: root.periodArmed,
-        openCallbackCount: root.openCallbackCount,
-        asking: root.asking,
-        unfinished,
-        lastPrompt: latestUserPrompt(root.head),
-        askLine: unfinished === "ask" ? glanceAskLine(root.head?.approvalHead ?? null) : "",
-        questionLine: unfinished === "question" && root.head instanceof SessionTurn ? root.head.questionLine : "",
-        path: root.path,
-        calls: outgoingAgentRelations(root),
-    };
-}
 function captureInstallStreams() {
     let err = "";
     const stderr = new Writable({
@@ -1462,4 +1575,12 @@ function withoutDependency(raw, npmName) {
     pkg.dependencies = dependencies;
     return pkg;
 }
+function realpathOrSelf(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
 //# sourceMappingURL=KernelDaemon.js.map