@ljwei-stak/dsh-model-route-bot 0.66.4 → 0.67.0

package/packages/orchestration/src/remote-machines.mjs

@@ -2,6 +2,7 @@ import { randomUUID, createHash } from 'node:crypto'
 import { mkdirSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { createDesktopSessionHost } from './desktop-sessions.mjs'
+import { connectSecureTransport, normalizeSecureTransport } from '../../../modules/openmaus-protocol/transport.mjs'
 
 export const REMOTE_TOOLS = Object.freeze(['machine_ping','fs_list','fs_read','fs_write','shell_exec','container_command_v1','cli_probe_v1','cli_task_v1',
   'operation_status','operation_cancel','artifact_stat','artifact_read','worktree_create','worktree_diff','worktree_integrate',
@@ -21,16 +22,18 @@ const references = (values, allowed) => {
   if (!Array.isArray(values) || !values.length || values.length > 64 || new Set(values).size !== values.length || values.some(v => !ref(v) || allowed && !allowed.includes(v))) fail('INVALID_MACHINE_SCOPE')
   return [...values].sort()
 }
-export function normalizeMachineEndpoint(value, protectedTunnel = false) {
+export function normalizeMachineEndpoint(value, protectedTunnel = false, transport) {
   let url; try { url = new URL(value) } catch { fail('INVALID_MACHINE_ENDPOINT') }
   if (!['https:','http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/') fail('INVALID_MACHINE_ENDPOINT')
-  if (url.protocol === 'http:' && !['127.0.0.1','[::1]','localhost'].includes(url.hostname) && protectedTunnel !== true) fail('MACHINE_TLS_REQUIRED')
+  if (transport !== undefined) normalizeSecureTransport(transport)
+  if (url.protocol === 'http:' && !['127.0.0.1','[::1]','localhost'].includes(url.hostname) && protectedTunnel !== true && transport?.kind !== 'noise-v1') fail('MACHINE_TLS_REQUIRED')
   return url.origin
 }
 
 /** Host metadata only. Long-lived credentials stay in the existing DS secret UI. */
-export function openRemoteMachines({ Database, file, resolveSecret, botExists, authority, cliProfiles = [], onChanged = () => {}, now = Date.now, fetchImpl = fetch }) {
+export function openRemoteMachines({ Database, file, resolveSecret, botExists, mainBotIds = () => [], authority, desktopProxy, desktopHttp, cliProfiles = [], onChanged = () => {}, now = Date.now, fetchImpl = fetch }) {
   if (typeof Database !== 'function' || typeof resolveSecret !== 'function' || typeof botExists !== 'function') throw new TypeError('REMOTE_MACHINE_SERVICES_REQUIRED')
+  if (typeof mainBotIds !== 'function') throw new TypeError('REMOTE_MACHINE_MAIN_ROLE_REQUIRED')
   if (!Array.isArray(cliProfiles) || cliProfiles.length > 64 || new Set(cliProfiles.map(p=>`${p?.machineId}/${p?.rootId}`)).size !== cliProfiles.length
     || cliProfiles.some(p=>!p||!['machineId','rootId','profileId'].every(k=>ref(p[k]))||!Number.isSafeInteger(p.profileRevision)||p.profileRevision<1
       ||!/^[a-f0-9]{64}$/.test(p.entry?.sha256??'')||!/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(p.entry?.version??''))) throw new TypeError('REMOTE_CLI_PROFILES_INVALID')
@@ -41,6 +44,7 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
   db.exec(`CREATE TABLE IF NOT EXISTS remote_machine_component(component TEXT PRIMARY KEY,version INTEGER NOT NULL);
     CREATE TABLE IF NOT EXISTS remote_machines(id TEXT PRIMARY KEY,revision INTEGER NOT NULL,config TEXT NOT NULL,revoked INTEGER NOT NULL,health TEXT);
     CREATE TABLE IF NOT EXISTS remote_machine_bindings(machine_id TEXT NOT NULL,bot_id TEXT NOT NULL,revision INTEGER NOT NULL,scope TEXT NOT NULL,revoked INTEGER NOT NULL,PRIMARY KEY(machine_id,bot_id));
+    CREATE TABLE IF NOT EXISTS remote_machine_grant_subjects(machine_id TEXT NOT NULL,bot_id TEXT NOT NULL,PRIMARY KEY(machine_id,bot_id));
     CREATE TABLE IF NOT EXISTS remote_machine_revocations(machine_id TEXT NOT NULL,bot_id TEXT NOT NULL,status TEXT NOT NULL,at_ms INTEGER NOT NULL,request_id TEXT NOT NULL,PRIMARY KEY(machine_id,bot_id));
     CREATE TABLE IF NOT EXISTS remote_machine_events(sequence INTEGER PRIMARY KEY AUTOINCREMENT,machine_id TEXT NOT NULL,bot_id TEXT,kind TEXT NOT NULL,time INTEGER NOT NULL);`)
   const version = db.prepare('SELECT version FROM remote_machine_component WHERE component=?').get('machines')
@@ -49,9 +53,28 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
   if(!db.pragma('table_info(remote_machine_revocations)').some(column=>column.name==='request_id'))db.exec("ALTER TABLE remote_machine_revocations ADD COLUMN request_id TEXT NOT NULL DEFAULT ''")
   let closed = false
   const active = new Set()
+  const channels = new Map()
   const alive = () => { if (closed) fail('MACHINE_DIRECTORY_CLOSED') }
   const machine = id => { alive(); if (!ref(id)) fail('INVALID_MACHINE_ID'); const r = db.prepare('SELECT * FROM remote_machines WHERE id=?').get(id); if (!r || r.revoked) fail('MACHINE_NOT_PAIRED'); return { ...r, config: JSON.parse(r.config), health: r.health ? JSON.parse(r.health) : null } }
-  const binding = (machineId,botId) => { const r = db.prepare('SELECT * FROM remote_machine_bindings WHERE machine_id=? AND bot_id=?').get(machineId,botId); if (!r || r.revoked || !botExists(botId)) fail('MACHINE_BOT_DENIED'); return { ...r, scope: JSON.parse(r.scope) } }
+  const binding = (machineId,botId) => {
+    const row = db.prepare('SELECT * FROM remote_machine_bindings WHERE machine_id=? AND bot_id=?').get(machineId,botId)
+    if (!botExists(botId) || row?.revoked) fail('MACHINE_BOT_DENIED')
+    if (mainBotIds().includes(botId)) {
+      const record = machine(machineId)
+      // Main inherits only this paired client's verified ceiling. The remote
+      // authority still authenticates the client, Bot and every issued grant.
+      return { machine_id: record.id, bot_id: botId, revision: record.revision,
+        scope: { roots: [...record.config.roots], tools: [...record.config.tools], mode: 'workspace-write' } }
+    }
+    if (!row) fail('MACHINE_BOT_DENIED')
+    return { ...row, scope: JSON.parse(row.scope) }
+  }
+  const mainScopes = botId => db.prepare('SELECT * FROM remote_machines WHERE revoked=0').all().flatMap(row => {
+    if (db.prepare('SELECT revoked FROM remote_machine_bindings WHERE machine_id=? AND bot_id=?').get(row.id,botId)?.revoked) return []
+    const config=JSON.parse(row.config)
+    return [{machineId:row.id,revision:row.revision,roots:[...config.roots],tools:[...config.tools],mode:'workspace-write',inheritedMain:true}]
+  })
+  const inheritedMainScopes = botId => botExists(botId)&&mainBotIds().includes(botId) ? mainScopes(botId) : null
   const event = (id,botId,kind) => db.prepare('INSERT INTO remote_machine_events(machine_id,bot_id,kind,time) VALUES(?,?,?,?)').run(id,botId,kind,now())
   const requestRevocation = (id,botId) => {
     const key=randomUUID()
@@ -75,7 +98,9 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
   }
   const request = async (config,path,token,body,signal) => {
     try {
-      return await responseJson(await fetchImpl(`${config.endpoint}${path}`, { method: 'POST', redirect: 'error',
+      const channel = config.transport ? await secureChannel(config,signal) : null
+      const send = channel ? (url,options) => channel.fetch(path,options) : fetchImpl
+      return await responseJson(await send(`${config.endpoint}${path}`, { method: 'POST', redirect: 'error',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream', 'MCP-Protocol-Version': '2025-11-25' },
         body: JSON.stringify(body), signal: AbortSignal.any([AbortSignal.timeout(35000), ...(signal ? [signal] : [])]) }))
     } catch (error) { if (signal?.aborted) throw signal.reason; if (/^[A-Z][A-Z0-9_]{0,80}$/.test(error?.code)) throw error; fail('MACHINE_CONNECTION_FAILED') }
@@ -86,13 +111,36 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
     if (typeof secret !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(secret)) fail('MACHINE_SECRET_UNAVAILABLE')
     return secret
   }
+  const secureChannel = async (config,signal) => {
+    alive()
+    const token=await secretFor({config})
+    const key=JSON.stringify([config.endpoint,config.transport.publicKey,config.secretRef,createHash('sha256').update(token).digest('hex')])
+    let entry=channels.get(key)
+    if(!entry){
+      if(channels.size>=32)fail('MACHINE_CONNECTION_LIMIT')
+      const pending=connectSecureTransport({endpoint:config.endpoint,transport:config.transport,token,signal})
+      entry={config,pending};channels.set(key,entry)
+      void pending.then(channel=>{if(closed){channel.close();return};void channel.closed.then(()=>{if(channels.get(key)===entry)channels.delete(key)})},()=>{if(channels.get(key)===entry)channels.delete(key)})
+    }
+    const channel=await entry.pending
+    signal?.throwIfAborted();alive()
+    if(channel.state!=='open')fail('MACHINE_CONNECTION_FAILED')
+    return channel
+  }
+  const closeChannels = config => {
+    for(const [key,entry] of channels)if(!config||entry.config.secretRef===config.secretRef&&entry.config.endpoint===config.endpoint){channels.delete(key);void entry.pending.then(channel=>channel.close(),()=>{})}
+  }
   const versionUnsupported = (code,details) => { throw Object.assign(new Error(`${code}: require agentApiMajor=1 and MCP protocol 2025-11-25`), { code, details }) }
   const issue = async (record,botId,scope,identity,signal) => {
+    // Persist the identity before any network await, including pair probes and
+    // inherited Main grants that have no per-Bot binding row. Whole-machine
+    // revocation must reach every identity for which this Host requested tickets.
+    db.prepare('INSERT OR IGNORE INTO remote_machine_grant_subjects VALUES(?,?)').run(record.id,botId)
     const secret = await secretFor(record)
     signal?.throwIfAborted()
     const value = await request(record.config,'/control/v1/grants',secret,{ botId, taskId: identity.taskId, attemptId: identity.attemptId, roots: scope.roots, tools: scope.tools, ttlMs: 60000 },signal)
     if (value.agentApiMajor !== 1) versionUnsupported('MACHINE_VERSION_UNSUPPORTED', { requiredAgentApiMajor: 1, actualAgentApiMajor: value.agentApiMajor ?? null })
-    if (value.machineId !== record.id || value.botId !== botId || value.taskId !== identity.taskId || value.attemptId !== identity.attemptId || typeof value.grantToken !== 'string') fail('MACHINE_IDENTITY_MISMATCH')
+    if (value.machineId !== record.id || record.config.clientId && value.clientId !== record.config.clientId || value.botId !== botId || value.taskId !== identity.taskId || value.attemptId !== identity.attemptId || typeof value.grantToken !== 'string') fail('MACHINE_IDENTITY_MISMATCH')
     return value.grantToken
   }
   const invoke = async (record,token,name,args,operationId,signal) => {
@@ -115,24 +163,36 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
   const compare = (old, expectedRevision) => { if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0 || (old?.revision ?? 0) !== expectedRevision) fail('MACHINE_CONFIG_CONFLICT') }
   const publicMachine = row => ({ id: row.id, machineId: row.id, revision: row.revision, name: row.config.name, endpoint: row.config.endpoint,
     secretRef: row.config.secretRef, roots: row.config.roots, tools: row.config.tools, protectedTunnel: row.config.protectedTunnel,
+    ...(row.config.transport?{transport:row.config.transport}:{}),
     status: row.revoked ? 'revoked' : row.health && now()-row.health.lastSeenAt<90000 ? 'online' : 'unverified', lastSeenAt: row.health?.lastSeenAt ?? null,
     platform: row.health?.platform ?? null, version: row.health?.version ?? null, capabilities: row.health?.capabilities ?? [], desktop: row.health?.desktop ?? {status:'unverified'},
     revocations:db.prepare('SELECT bot_id,status,at_ms FROM remote_machine_revocations WHERE machine_id=?').all(row.id).map(r=>({botId:r.bot_id,status:r.status,at:r.at_ms})),
     bindings: db.prepare('SELECT bot_id,revision,scope,revoked FROM remote_machine_bindings WHERE machine_id=?').all(row.id).map(b => ({botId:b.bot_id,revision:b.revision,revoked:Boolean(b.revoked),...JSON.parse(b.scope)})) })
-  const desktopSessions = createDesktopSessionHost({ machine, binding, authority, issue, request, event, now })
+  const desktopSessions = createDesktopSessionHost({ machine, binding, authority, issue, request, event, now, desktopProxy, desktopHttp,
+    cleanupRequest:async(record,input,signal)=>request(record.config,'/control/v1/desktop/close',await secretFor(record),input,signal),
+    connectDesktop: async (record,signal,origin,options={}) => {
+      if(machine(record.id).revision!==record.revision)fail('MACHINE_GRANT_CHANGED')
+      const channel=await secureChannel(record.config,signal)
+      if(machine(record.id).revision!==record.revision)fail('MACHINE_GRANT_CHANGED')
+      return channel.openWebSocket('/desktop/v1/socket',{origin,...options})
+    },
+  })
   const store = {
     schemaVersion:1, file,
     desktopSession: (subject, input, context) => desktopSessions.open(subject, input, context),
+    routineDesktopSession: (subject,input,context) => desktopSessions.openInternal(subject,input,context),
     renewDesktopSession: (subject, input, context) => desktopSessions.renew(subject, input, context),
     closeDesktopSession: (subject, input, context) => desktopSessions.close(subject, input, context),
     closeDesktopSessions: () => desktopSessions.closeAll(),
     async pair(input,context) {
-      owner(context); alive(); keys(input,['machineId','name','endpoint','secretRef','protectedTunnel','roots','tools','probeBotId','expectedRevision'])
+      owner(context); alive(); keys(input,['machineId','clientId','name','endpoint','secretRef','protectedTunnel','transport','roots','tools','probeBotId','expectedRevision'])
       if (!ref(input.machineId) || !ref(input.probeBotId) || !botExists(input.probeBotId)) fail('INVALID_MACHINE_ID')
       if (typeof input.name !== 'string' || !input.name.trim() || input.name.length>128 || /[\x00-\x1f]/.test(input.name)) fail('INVALID_MACHINE_NAME')
       if (typeof input.secretRef !== 'string' || !/^ds-secret\/[A-Za-z][A-Za-z0-9_]{0,127}$/.test(input.secretRef)) fail('INVALID_MACHINE_SECRET_REF')
       if (input.protectedTunnel !== undefined && typeof input.protectedTunnel !== 'boolean') fail('INVALID_MACHINE_ENDPOINT')
-      const config = { name:input.name.trim(), endpoint:normalizeMachineEndpoint(input.endpoint,input.protectedTunnel), secretRef:input.secretRef, protectedTunnel:input.protectedTunnel===true, roots:references(input.roots), tools:references(input.tools,REMOTE_TOOLS) }
+      if (input.clientId !== undefined && !ref(input.clientId)) fail('INVALID_MACHINE_ID')
+      const transport = input.transport === undefined ? undefined : normalizeSecureTransport(input.transport)
+      const config = { name:input.name.trim(), endpoint:normalizeMachineEndpoint(input.endpoint,input.protectedTunnel,transport), secretRef:input.secretRef, protectedTunnel:input.protectedTunnel===true, roots:references(input.roots), tools:references(input.tools,REMOTE_TOOLS), ...(transport?{transport}:{}), ...(input.clientId?{clientId:input.clientId}:{}) }
       if (!config.tools.includes('machine_ping')) fail('MACHINE_PING_REQUIRED')
       compare(db.prepare('SELECT revision FROM remote_machines WHERE id=?').get(input.machineId),input.expectedRevision)
       const record = {id:input.machineId,config}, identity={taskId:`pair-${randomUUID()}`,attemptId:`attempt-${randomUUID()}`}
@@ -173,10 +233,15 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
       owner(context); alive(); keys(input,['machineId','botId','expectedRevision'])
       const record=machine(input.machineId), botId=input.botId??null
       if(botId!==null&&!ref(botId)) fail('INVALID_MACHINE_ID')
-      const affected=botId?[botId]:db.prepare('SELECT bot_id FROM remote_machine_bindings WHERE machine_id=? AND revoked=0').all(record.id).map(r=>r.bot_id)
+      const affected=botId?[botId]:db.prepare('SELECT bot_id FROM remote_machine_bindings WHERE machine_id=? UNION SELECT bot_id FROM remote_machine_grant_subjects WHERE machine_id=?').all(record.id,record.id).map(r=>r.bot_id)
       const requests=new Map()
       db.transaction(()=>{
-        if(botId){compare(db.prepare('SELECT revision FROM remote_machine_bindings WHERE machine_id=? AND bot_id=?').get(record.id,botId),input.expectedRevision);db.prepare('UPDATE remote_machine_bindings SET revoked=1,revision=revision+1 WHERE machine_id=? AND bot_id=?').run(record.id,botId)}
+        if(botId){
+          const previous=db.prepare('SELECT revision FROM remote_machine_bindings WHERE machine_id=? AND bot_id=?').get(record.id,botId)
+          compare(previous,input.expectedRevision)
+          if(previous)db.prepare('UPDATE remote_machine_bindings SET revoked=1,revision=revision+1 WHERE machine_id=? AND bot_id=?').run(record.id,botId)
+          else db.prepare('INSERT INTO remote_machine_bindings VALUES(?,?,1,?,1)').run(record.id,botId,JSON.stringify({roots:[],tools:[],mode:'read-only'}))
+        }
         else{compare(record,input.expectedRevision);db.prepare('UPDATE remote_machines SET revoked=1,revision=revision+1 WHERE id=?').run(record.id);db.prepare('UPDATE remote_machine_bindings SET revoked=1,revision=revision+1 WHERE machine_id=?').run(record.id)}
         event(record.id,botId,'revoked')
         for(const id of affected)requests.set(id,requestRevocation(record.id,id))
@@ -293,7 +358,7 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
         throw error
       }
     },
-    scopes(botId) { alive(); return db.prepare('SELECT machine_id,revision,scope FROM remote_machine_bindings WHERE bot_id=? AND revoked=0').all(botId).flatMap(r=>{try{machine(r.machine_id);return [{machineId:r.machine_id,revision:r.revision,...JSON.parse(r.scope)}]}catch{return []}}) },
+    scopes(botId) { alive(); return inheritedMainScopes(botId) ?? db.prepare('SELECT machine_id,revision,scope FROM remote_machine_bindings WHERE bot_id=? AND revoked=0').all(botId).flatMap(r=>{try{machine(r.machine_id);return [{machineId:r.machine_id,revision:r.revision,...JSON.parse(r.scope)}]}catch{return []}}) },
     /**
      * A Bot's grants, straight from committed state.
      *
@@ -301,16 +366,19 @@ export function openRemoteMachines({ Database, file, resolveSecret, botExists, a
      * must not depend on `scopes()` (which needs the directory alive). This reads the same rows
      * without the availability check: what was authorised stays authorised across a restart.
      */
-    bindingsFor(botId) {
+    bindingsFor(botId,{main=mainBotIds().includes(botId)}={}) {
       alive()
       if (typeof botId !== 'string' || !botId) return []
+      // Only Host grant compilation supplies this override, from the saved role
+      // being adopted. The currently committed role may still be the old one.
+      if(main)return mainScopes(botId)
       return db.prepare('SELECT machine_id, revision, scope FROM remote_machine_bindings WHERE bot_id=? AND revoked=0').all(botId).flatMap(row => {
         try { const scope = JSON.parse(row.scope); return [{ machineId: row.machine_id, revision: row.revision, roots: scope.roots ?? [], tools: scope.tools ?? [], mode: scope.mode ?? 'read-only' }] } catch { return [] }
       })
     },
 
     readModel() { alive(); return {status:'available',items:db.prepare('SELECT * FROM remote_machines ORDER BY id').all().map(row=>publicMachine({...row,config:JSON.parse(row.config),health:row.health?JSON.parse(row.health):null}))} },
-    close() { if(!closed){for(const call of active)call.controller.abort(new Error('MACHINE_DIRECTORY_CLOSED'));closed=true;db.close()} },
+    close() { if(!closed){for(const call of active)call.controller.abort(new Error('MACHINE_DIRECTORY_CLOSED'));closed=true;closeChannels();db.close()} },
   }
   return Object.freeze(store)
 }

package/packages/orchestration/src/routine-execution.mjs

@@ -8,6 +8,7 @@ const failureStatus = (failure, signal) => failure?.status === 'unknown' || fail
 /** Legacy five-action routines remain usable on the acknowledged desktop session. */
 export function routineStepInputs(step) {
   if (step.action === 'input') return [normalizeRoutineInput(step.event)]
+  if (step.action === 'release-input') return []
   if (step.action === 'wait') return []
   if (step.action === 'click') return ['down', 'up'].map(action => normalizeRoutineInput({ type: 'pointer', action, x: step.x, y: step.y, button: step.button ?? 'left' }))
   if (step.action === 'type') return [normalizeRoutineInput({ type: 'text', text: step.text })]
@@ -48,7 +49,7 @@ export function createRoutineExecutionService({ machines, store, botIdForSubject
       const completed = [], cleanup = { inputReleased: false, controlReleased: false, stopConfirmed: false }
       try {
         if (controller.signal.aborted) fail('ROUTINE_CANCELLED', { status: 'cancelled' })
-        ticket = await machines.desktopSession(subject, { machineId, rootId, mode: 'watch', fps: 5,
+        ticket = await (machines.routineDesktopSession??machines.desktopSession).call(machines,subject, { machineId, rootId, mode: 'watch', fps: 5,
           ...(routine.recording ? { displayId: routine.recording.display.displayId } : {}) }, runContext)
         store.updateRun(botId, row.runId, { sessionId: ticket.sessionId })
         session = createRoutineDesktopSession({ ticket, WebSocketImpl, signal: controller.signal, now, ackTimeoutMs, renewEveryMs,
@@ -66,10 +67,11 @@ export function createRoutineExecutionService({ machines, store, botIdForSubject
         await session.acquire()
         for (currentStep = 0; currentStep < routine.steps.length; currentStep++) {
           const step = routine.steps[currentStep]
-          await routineDelay(step.action === 'wait' ? step.ms : step.action === 'input' ? step.delayMs : 0, controller.signal)
+          await routineDelay(step.action === 'wait' ? step.ms : ['input','release-input'].includes(step.action) ? step.delayMs : 0, controller.signal)
           const currentDisplay = normalizeRoutineDisplay(session.metadata)
           if (['displayId', 'width', 'height', 'coordinateSpace'].some(field => currentDisplay[field] !== display[field])) fail('ROUTINE_DISPLAY_CHANGED')
-          for (const event of inputs[currentStep]) await session.input(event, { stepIndex: currentStep })
+          if (step.action === 'release-input') await session.releaseInput()
+          else for (const event of inputs[currentStep]) await session.input(event, { stepIndex: currentStep })
           completed.push(currentStep)
           store.updateRun(botId, row.runId, { steps: completed, stoppedAt: currentStep + 1 })
           await onStep?.(step, currentStep, { runId: row.runId, taskId: row.taskId, attemptId: row.attemptId })

package/packages/orchestration/src/routine-session.mjs

@@ -12,10 +12,9 @@ const deferred = () => {
 export function createRoutineDesktopSession({ ticket, WebSocketImpl = globalThis.WebSocket, renewTicket, closeTicket,
   signal, ackTimeoutMs = 5_000, renewEveryMs = 45_000, now = Date.now,
   onFrame, onMetadata, onState, onBeforeInput, onAcknowledgedInput, onInputFailure } = {}) {
-  if (!ticket?.sessionId || !ticket?.token || !ticket?.websocketUrl || typeof WebSocketImpl !== 'function') throw error('ROUTINE_DESKTOP_UNAVAILABLE')
+  if (!ticket?.sessionId || !ticket?.token || (typeof ticket.openWebSocket!=='function'&&(!ticket.websocketUrl||typeof WebSocketImpl!=='function'))) throw error('ROUTINE_DESKTOP_UNAVAILABLE')
   if (!Number.isSafeInteger(ackTimeoutMs) || ackTimeoutMs < 1 || ackTimeoutMs > 60_000) throw error('ROUTINE_ACK_TIMEOUT_INVALID')
-  const socket = new WebSocketImpl(ticket.websocketUrl)
-  socket.binaryType = 'arraybuffer'
+  let socket
   const ready = deferred(), pending = new Map()
   let mode = 'watch', metadata = null, nextId = 0, queue = Promise.resolve(), closed = false, fatal = null
   let renewTimer, currentTicket = ticket
@@ -31,12 +30,12 @@ export function createRoutineDesktopSession({ ticket, WebSocketImpl = globalThis
     emit({ status: 'error', mode, code })
   }
   const send = value => {
-    if (closed || socket.readyState !== 1) throw error('ROUTINE_DESKTOP_DISCONNECTED')
+    if (closed || socket?.readyState !== 1) throw error('ROUTINE_DESKTOP_DISCONNECTED')
     socket.send(JSON.stringify(value))
   }
   const request = (packet, type, id, operationSignal) => {
     if (operationSignal?.aborted) return Promise.reject(error('ROUTINE_CANCELLED', 'cancelled'))
-    if (closed || socket.readyState !== 1) return Promise.reject(error('ROUTINE_DESKTOP_DISCONNECTED'))
+    if (closed || socket?.readyState !== 1) return Promise.reject(error('ROUTINE_DESKTOP_DISCONNECTED'))
     const key = `${type}:${id ?? ''}`, result = deferred()
     const waiter = { ...result, type, id, sent: false, fail: null, finish: null }
     const clear = () => { clearTimeout(timer); operationSignal?.removeEventListener?.('abort', abort); pending.delete(key) }
@@ -58,17 +57,17 @@ export function createRoutineDesktopSession({ ticket, WebSocketImpl = globalThis
         if (closed) return
         if (!renewed || renewed.sessionId !== ticket.sessionId || !Number.isFinite(renewed.expiresAt) || renewed.expiresAt <= now()) throw error('ROUTINE_RENEW_INVALID')
         currentTicket = renewed; scheduleRenew()
-      } catch { breakConnection('ROUTINE_AUTHORIZATION_LOST'); try { socket.close() } catch {} }
+      } catch { breakConnection('ROUTINE_AUTHORIZATION_LOST'); try { socket?.close() } catch {} }
     }, Math.max(1, Math.min(renewEveryMs, untilExpiry)))
     renewTimer.unref?.()
   }
-  socket.onopen = () => {
+  const onOpen = () => {
     try { send({ type: 'auth', sessionId: ticket.sessionId, token: ticket.token }); emit({ status: 'authenticating', mode }) }
     catch (failure) { breakConnection(failure.code ?? 'ROUTINE_AUTH_FAILED') }
   }
-  const readyTimer = setTimeout(() => { breakConnection('ROUTINE_READY_TIMEOUT'); try { socket.close() } catch {} }, ackTimeoutMs)
+  const readyTimer = setTimeout(() => { breakConnection('ROUTINE_READY_TIMEOUT'); try { socket?.close() } catch {} }, ackTimeoutMs)
   ready.promise.finally(() => clearTimeout(readyTimer)).catch(() => {})
-  socket.onmessage = message => {
+  const onMessage = message => {
     if (closed) return
     if (typeof message.data !== 'string') { onFrame?.(message.data); return }
     let value
@@ -101,8 +100,15 @@ export function createRoutineDesktopSession({ ticket, WebSocketImpl = globalThis
     }
     if (value.type === 'error') breakConnection(value.code ?? 'ROUTINE_DESKTOP_ERROR')
   }
-  socket.onerror = () => breakConnection('ROUTINE_DESKTOP_DISCONNECTED')
-  socket.onclose = () => breakConnection('ROUTINE_DESKTOP_DISCONNECTED')
+  const attach = value => {
+    value.onerror=()=>breakConnection('ROUTINE_DESKTOP_DISCONNECTED')
+    if(closed||fatal){value.close();return}
+    socket=value;socket.binaryType='arraybuffer';socket.onopen=onOpen;socket.onmessage=onMessage
+    socket.onclose=()=>breakConnection('ROUTINE_DESKTOP_DISCONNECTED')
+    if(socket.readyState===1)onOpen()
+  }
+  if(typeof ticket.openWebSocket==='function')Promise.resolve().then(()=>ticket.openWebSocket()).then(attach,()=>breakConnection('ROUTINE_DESKTOP_UNAVAILABLE'))
+  else attach(new WebSocketImpl(ticket.websocketUrl))
   const serialize = (work, cleanup = false) => {
     const result = queue.then(async () => {
       if (!cleanup && fatal) throw fatal
@@ -148,9 +154,9 @@ export function createRoutineDesktopSession({ ticket, WebSocketImpl = globalThis
     async close() {
       if (closed) return { stopConfirmed: false, code: 'ROUTINE_ALREADY_CLOSED' }
       clearTimeout(renewTimer)
-      try { if (socket.readyState === 1) send({ type: 'close' }) } catch {}
+      try { if (socket?.readyState === 1) send({ type: 'close' }) } catch {}
       closed = true; mode = 'watch'; stopPending(error('ROUTINE_DESKTOP_CLOSED'))
-      try { socket.close() } catch {}
+      try { socket?.close() } catch {}
       try { return await closeTicket?.(ticket.sessionId) ?? { stopConfirmed: false } }
       catch (failure) { return { stopConfirmed: false, code: failure.code ?? 'ROUTINE_STOP_UNCONFIRMED' } }
     },

package/packages/orchestration/src/secure-pairing-host.mjs

@@ -0,0 +1,112 @@
+import { createHash } from 'node:crypto'
+import { parseSecureInvite } from './pairing-invite.mjs'
+import { connectSecureTransport, normalizeSecureTransport } from '../../../modules/openmaus-protocol/transport.mjs'
+import { REMOTE_TOOLS } from './remote-machines.mjs'
+
+const fail = code => { throw Object.assign(new Error(code), { code }) }
+const hash = value => createHash('sha256').update(value).digest('hex')
+// SHA256(token) is also the Noise credential hash. A recovery check must not
+// persist that reusable authentication material in the Host intent journal.
+const credentialDigest = token => hash(`dsh-pairing-recovery-v1\0${token}`)
+const sameScope = (a,b) => Array.isArray(a) && Array.isArray(b) && JSON.stringify([...a].sort()) === JSON.stringify([...b].sort())
+
+/** Durable intent/result only. Raw invite proofs remain in memory; device credentials go straight to Host secrets. */
+export function openSecurePairingHost({ Database, file, saveSecret, resolveSecret, machines, pair, botExists, now = Date.now }) {
+  const db = new Database(file)
+  db.pragma('busy_timeout=5000'); db.pragma('journal_mode=WAL'); db.pragma('synchronous=FULL')
+  db.exec(`CREATE TABLE IF NOT EXISTS secure_pairing_requests (
+    request_id TEXT PRIMARY KEY,intent_hash TEXT NOT NULL,machine_id TEXT NOT NULL,client_id TEXT NOT NULL,
+    config TEXT NOT NULL,status TEXT NOT NULL,result TEXT,created_at INTEGER NOT NULL
+  ); CREATE UNIQUE INDEX IF NOT EXISTS secure_pairing_intent ON secure_pairing_requests(intent_hash)`)
+  if (!db.pragma('table_info(secure_pairing_requests)').some(column=>column.name==='credential_digest')) db.exec('ALTER TABLE secure_pairing_requests ADD COLUMN credential_digest TEXT')
+  const inFlight = new Set()
+  let closed = false
+  return Object.freeze({
+    async redeem(input,context) {
+      if (context?.kind !== 'owner') fail('REMOTE_OWNER_REQUIRED')
+      if (closed) fail('PAIRING_SERVICE_CLOSED')
+      if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(key => !['invite','code','requestId','probeBotId','expectedRevision'].includes(key))
+        || typeof input.requestId !== 'string' || !/^[A-Za-z0-9_-]{16,128}$/.test(input.requestId)
+        || typeof input.code !== 'string' || !/^\d{6}$/.test(input.code) || !botExists(input.probeBotId)
+        || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0) fail('PAIRING_REQUEST_INVALID')
+      const invite = parseSecureInvite(input.invite), transport = normalizeSecureTransport(invite.transport)
+      if (invite.ceiling.tools.some(tool => !REMOTE_TOOLS.includes(tool))) fail('PAIRING_TOOLS_UNSUPPORTED')
+      if (!invite.ceiling.hostManagedBots && !invite.ceiling.botIds.includes(input.probeBotId)) fail('MACHINE_BOT_DENIED')
+      const { code: _printedCode, token, ...publicInvite } = invite
+      const intent = hash(JSON.stringify({ invite: publicInvite, token: hash(token), code: hash(input.code), probeBotId: input.probeBotId, expectedRevision: input.expectedRevision }))
+      const secretName = `REMOTE_AGENT_${hash(JSON.stringify([invite.machineId,invite.clientId])).slice(0,40).toUpperCase()}`
+      const config = { machineId: invite.machineId, clientId: invite.clientId, name: invite.name, endpoint: invite.endpoint,
+        transport, roots: invite.ceiling.roots, tools: invite.ceiling.tools, secretRef: `ds-secret/${secretName}`,
+        probeBotId: input.probeBotId, expectedRevision: input.expectedRevision }
+      let row = db.prepare('SELECT * FROM secure_pairing_requests WHERE request_id=?').get(input.requestId)
+      if (row && row.intent_hash !== intent) fail('PAIRING_REQUEST_CONFLICT')
+      if (!row) row = db.prepare('SELECT * FROM secure_pairing_requests WHERE intent_hash=?').get(intent)
+      const requestId = row?.request_id ?? input.requestId
+      if (row?.status === 'complete') {
+        const result=JSON.parse(row.result), live=machines.readModel().items.find(item=>item.id===invite.machineId)
+        if(!live||live.status==='revoked'||live.revision!==result.revision||live.transport?.publicKey!==transport.publicKey)fail('PAIRING_CONFIGURATION_CHANGED')
+        return { ...result, recovered: true }
+      }
+      if (inFlight.has(requestId)) fail('PAIRING_REQUEST_PENDING')
+      const existing = () => machines.readModel().items.find(item => item.id === invite.machineId)
+      const current = existing()
+      if (!row && (current?.revision ?? 0) !== input.expectedRevision) fail('MACHINE_CONFIG_CONFLICT')
+      if (!row) {
+        if (invite.expiresAt <= now() || invite.expiresAt > now() + 180_000) fail('PAIRING_WINDOW_CLOSED')
+        db.prepare("INSERT INTO secure_pairing_requests(request_id,intent_hash,machine_id,client_id,config,status,result,created_at) VALUES(?,?,?,?,?,'pending',NULL,?)").run(requestId,intent,invite.machineId,invite.clientId,JSON.stringify(config),now())
+        row = { status: 'pending' }
+      }
+      inFlight.add(requestId)
+      let channel
+      try {
+        // The Secret service and SQLite cannot share a transaction. Persist the
+        // verified credential digest first, then reconcile an already committed
+        // Secret after a crash without redeeming or minting another device.
+        if (row.status !== 'secret-saved' && /^[a-f0-9]{64}$/.test(row.credential_digest??'') && typeof resolveSecret==='function') {
+          const saved=await resolveSecret(config.secretRef)
+          if (saved!==null && saved!==undefined) {
+            if (typeof saved!=='string'||!/^[A-Za-z0-9_-]{43}$/.test(saved)||credentialDigest(saved)!==row.credential_digest) fail('PAIRING_CREDENTIAL_CHANGED')
+            db.prepare("UPDATE secure_pairing_requests SET status='secret-saved' WHERE request_id=?").run(requestId)
+            row.status='secret-saved'
+          }
+        }
+        if (row.status !== 'secret-saved') {
+          if (invite.expiresAt <= now()) fail('PAIRING_RESULT_UNRECOVERABLE')
+          context.signal?.throwIfAborted()
+          try { channel = await connectSecureTransport({ endpoint: invite.endpoint, transport, token, signal: context.signal }) }
+          catch { fail('PAIRING_PEER_UNVERIFIED') }
+          let response, result
+          try {
+            response = await channel.fetch('/pair/v2/redeem', { headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ requestId, code: input.code }), signal: AbortSignal.any([AbortSignal.timeout(15_000),...(context.signal?[context.signal]:[])]) })
+            result = await response.json()
+          } catch { fail('PAIRING_RESULT_UNKNOWN') }
+          if (!response.ok) {
+            if (result?.error?.code==='PAIRING_ALREADY_REDEEMED') fail('PAIRING_DEVICE_ALREADY_COMMITTED')
+            fail(/^[A-Z][A-Z0-9_]{0,80}$/.test(result?.error?.code) ? result.error.code : 'PAIRING_REDEEM_FAILED')
+          }
+          if (result.machineId !== invite.machineId || result.clientId !== invite.clientId || typeof result.token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(result.token)
+            || normalizeSecureTransport(result.transport).publicKey !== transport.publicKey || !result.ceiling
+            || !sameScope(result.ceiling.roots,invite.ceiling.roots) || !sameScope(result.ceiling.tools,invite.ceiling.tools)
+            || !sameScope(result.ceiling.botIds??[],invite.ceiling.botIds) || (result.ceiling.hostManagedBots===true)!==(invite.ceiling.hostManagedBots===true)) fail('PAIRING_IDENTITY_MISMATCH')
+          if (row.credential_digest && row.credential_digest!==credentialDigest(result.token)) fail('PAIRING_CREDENTIAL_CHANGED')
+          db.prepare("UPDATE secure_pairing_requests SET status='secret-saving',credential_digest=? WHERE request_id=?").run(credentialDigest(result.token),requestId)
+          await saveSecret(secretName,result.token)
+          db.prepare("UPDATE secure_pairing_requests SET status='secret-saved' WHERE request_id=?").run(requestId)
+        }
+        context.signal?.throwIfAborted()
+        const live = existing()
+        let result
+        if (live && live.revision === config.expectedRevision + 1 && live.secretRef === config.secretRef
+          && live.endpoint === config.endpoint && live.transport?.publicKey === config.transport.publicKey
+          && sameScope(live.roots,config.roots) && sameScope(live.tools,config.tools)) {
+          result = { ...live, mainBinding: { status: 'blocked', code: 'PAIRING_BINDING_REVIEW_REQUIRED' } }
+        } else result = await pair(config,context)
+        if (closed) fail('PAIRING_SERVICE_CLOSED')
+        db.prepare("UPDATE secure_pairing_requests SET status='complete',result=? WHERE request_id=?").run(JSON.stringify(result),requestId)
+        return result
+      } finally { channel?.close(); inFlight.delete(requestId) }
+    },
+    close() { if (!closed) { closed = true; db.close() } },
+  })
+}

package/packages/orchestration/src/task-journal.mjs

@@ -647,6 +647,35 @@ export function openTaskJournal(Database, path, {database=null,financialEpoch=nu
           updated_ms DESC,id LIMIT ?`).all(JSON.stringify(ids),limit))
       return {items,total,truncated:total>items.length}
     },
+    // A sanitized cross-task event feed for the notification center: it names the
+    // safe structured fields only (seq/task/attempt/kind/at plus a validated
+    // outcome and code). Raw event detail — run ids, reference/evidence hashes,
+    // operation ids, gates — never leaves the journal, so a person-facing
+    // notification is built from structured state instead of a leak. Keyset
+    // pagination walks the monotonic seq; `maxSeq` is the feed watermark.
+    notificationEvents(owners,kinds,{before=null,after=0,limit=64}={}) {
+      const ids=[...new Set((Array.isArray(owners)?owners:[]).map(taskRef))]
+      const wanted=[...new Set((Array.isArray(kinds)?kinds:[]).filter(kind=>typeof kind==='string'))]
+      if(!ids.length||!wanted.length||!Number.isSafeInteger(limit)||limit<1||limit>512)return {items:[],maxSeq:0}
+      const bound=value=>Number.isSafeInteger(value)&&value>=0?value:0
+      const floor=bound(after),ceil=before===null?null:bound(before)
+      const range=ceil===null?'e.seq>?':'e.seq>? AND e.seq<?',params=ceil===null?[floor]:[floor,ceil]
+      const ownerJson=JSON.stringify(ids),kindJson=JSON.stringify(wanted)
+      const items=stmt(`SELECT e.seq,e.task_id,e.attempt_id,e.kind,e.at_ms,e.detail,t.owner_bot
+        FROM task_events e JOIN tasks t ON t.id=e.task_id
+        WHERE t.owner_bot IN (SELECT value FROM json_each(?)) AND e.kind IN (SELECT value FROM json_each(?)) AND ${range}
+        ORDER BY e.seq DESC LIMIT ?`).all(ownerJson,kindJson,...params,limit).map(row=>{
+          let outcome=null,notifyCode=null
+          try{const detail=JSON.parse(row.detail)
+            outcome=['succeeded','failed','cancelled','skipped','blocked','unknown','waiting-budget','needs-reconciliation','ready','running','admitting','cancelling'].includes(detail?.outcome)?detail.outcome:null
+            notifyCode=typeof detail?.code==='string'&&/^[A-Z0-9_:-]{1,128}$/.test(detail.code)?detail.code:null
+          }catch{}
+          return {seq:row.seq,taskId:row.task_id,ownerBotId:row.owner_bot,attemptId:row.attempt_id,kind:row.kind,at:row.at_ms,outcome,code:notifyCode}
+        })
+      const maxSeq=stmt(`SELECT COALESCE(MAX(e.seq),0) AS m FROM task_events e JOIN tasks t ON t.id=e.task_id
+        WHERE t.owner_bot IN (SELECT value FROM json_each(?)) AND e.kind IN (SELECT value FROM json_each(?))`).get(ownerJson,kindJson).m
+      return {items,maxSeq}
+    },
     // One Bot's durable tasks, oldest first; the read model never invents a task.
     list(owner) {taskRef(owner);return viewsOf(stmt('SELECT * FROM tasks WHERE owner_bot=? ORDER BY created_ms,id LIMIT 128').all(owner))},
     close() {if(!closed){closed=true;if(borrowed){try{db.pragma(`busy_timeout=${priorTimeout}`)}catch{}}else db.close();onClose()}},

package/packages/orchestration/src/task-product.mjs

@@ -36,6 +36,23 @@ export function projectProductTask(task) {
   }
 }
 
+/** Bounded owner navigation data; never reads funding receipts or backend inputs. */
+export async function readProductAttention({ runtime, journal, limit = 512 }, payload = {}) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload) || Object.keys(payload).length) {
+    throw Object.assign(new Error('INVALID_ATTENTION_REQUEST'), { code: 'INVALID_ATTENTION_REQUEST' })
+  }
+  await runtime.load()
+  const loaded = journal.productList(Object.values(runtime.state?.bots ?? {}).map(bot => bot.id), { limit })
+  const items = loaded.items.map(task => {
+    const view = projectProductTask(task)
+    const remote = view.result?.remote
+    return { botId: view.botId, taskId: view.taskId, state: view.state,
+      ...(remote ? { result: { remote: { stopConfirmed: remote.stopConfirmed, possiblyApplied: remote.possiblyApplied,
+        ...(remote.notStarted === true ? { notStarted: true } : {}) } } } : {}) }
+  })
+  return { schemaVersion: 1, tasks: { status: 'available', items, total: loaded.total, truncated: loaded.truncated } }
+}
+
 /** The service checks the Bot's committed task/read grant and the task's owner first. */
 export function inspectProductTask({ service, journal, subject, taskId }) {
   const task = service.get(subject, { taskId })