@monster-orange/den 0.4.3 → 0.4.5

package/src/shared/web-owner.ts

@@ -0,0 +1,91 @@
+/**
+ * SEC-2a: the owner's GitHub identity. `<state dir>/web-owner.json`, mode
+ * 0600: `{ v: 1, owner: "github:<numeric id>", login, linkedAt }`. The id
+ * is what sign-in compares; the login is for display only (a login can be
+ * renamed, the id can't). No token is ever stored: the device flow's token
+ * is dropped right after `GET /user`.
+ *
+ * Written by `<cli> web owner link` and Settings › Access; removed by
+ * `web owner unlink`. Re-read whenever it changes on disk.
+ */
+import { randomBytes } from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import { getStateDir } from "./paths.js";
+
+export const WEB_OWNER_FILE = "web-owner.json";
+
+export interface WebOwner {
+  /** `github:<numeric id>`. */
+  owner: `github:${number}`;
+  /** The GitHub login at link time, for display. */
+  login: string;
+  /** ISO time it was linked. */
+  linkedAt: string;
+}
+
+export function webOwnerPath(stateDir: string = getStateDir()): string {
+  return path.join(stateDir, WEB_OWNER_FILE);
+}
+
+const LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+
+/** The linked owner, or null (none, or a file that isn't one). */
+export function readWebOwner(
+  stateDir: string = getStateDir(),
+): WebOwner | null {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(fs.readFileSync(webOwnerPath(stateDir), "utf-8"));
+  } catch {
+    return null;
+  }
+  const o = raw as Partial<WebOwner> | null;
+  if (
+    !o ||
+    typeof o.owner !== "string" ||
+    !/^github:[1-9][0-9]{0,15}$/.test(o.owner) ||
+    typeof o.login !== "string" ||
+    !LOGIN.test(o.login)
+  )
+    return null;
+  return {
+    owner: o.owner,
+    login: o.login,
+    linkedAt: typeof o.linkedAt === "string" ? o.linkedAt : "",
+  };
+}
+
+/** Link `id` (`login` for display) as the owner: atomic, 0600. */
+export function writeWebOwner(
+  identity: { id: number; login: string },
+  stateDir: string = getStateDir(),
+  now: Date = new Date(),
+): WebOwner {
+  if (!Number.isSafeInteger(identity.id) || identity.id <= 0)
+    throw new Error("a GitHub account id is a positive integer");
+  if (!LOGIN.test(identity.login))
+    throw new Error("that is not a GitHub login");
+  const rec: WebOwner = {
+    owner: `github:${identity.id}`,
+    login: identity.login,
+    linkedAt: now.toISOString(),
+  };
+  fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+  const file = webOwnerPath(stateDir);
+  const tmp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify({ v: 1, ...rec })}\n`, {
+    mode: 0o600,
+  });
+  fs.renameSync(tmp, file);
+  return rec;
+}
+
+/** Unlink the owner; the one it was, or null when none was linked. */
+export function clearWebOwner(
+  stateDir: string = getStateDir(),
+): WebOwner | null {
+  const was = readWebOwner(stateDir);
+  fs.rmSync(webOwnerPath(stateDir), { force: true });
+  return was;
+}

package/src/shared/web-session.ts

@@ -21,6 +21,7 @@ import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 import * as fs from "fs";
 import * as path from "path";
 import * as yaml from "yaml";
+import { parseMachineName } from "./cli-command.js";
 import { getStateDir } from "./paths.js";
 
 export const LOGIN_CODE_TTL_MS = 60_000;
@@ -98,6 +99,14 @@ export function checkLoginCode(
   return { ok: true, nonce: m[2], expiresAt };
 }
 
+/** A login code's nonce, from its shape alone (unverified), or null. */
+export function loginCodeNonce(code: string): string | null {
+  const m = /^v1\.([A-Za-z0-9_-]{22})\.[0-9a-z]{1,11}\.[A-Za-z0-9_-]{43}$/.exec(
+    code,
+  );
+  return m ? m[1] : null;
+}
+
 /**
  * Where a sign-in may send the browser: a same-origin relative path, else
  * `/`. `//evil`, `/\evil`, `http://evil`, a control character or a path back
@@ -167,8 +176,30 @@ export interface WebAuthConfig {
    * never the distribution's), and warned about at start.
    */
   plainHttpInDistribution?: string;
+  /**
+   * `web.github_client_id` (SEC-2a): the GitHub App whose device flow signs
+   * the owner in. user.yml over the distribution config; unset: the MO Den
+   * app's (github-app.ts).
+   */
+  githubClientId?: string;
+  /**
+   * `web.edge_unattested` (SEC-2a, user.yml only): what an edge request
+   * whose client Den can't place gets. `signin` (the default): it signs in;
+   * `local`: it is treated as this machine (0.4.4's allow).
+   */
+  edgeUnattested: EdgeUnattested;
+  /** The distribution config's file when it sets `web.edge_unattested`: ignored there. */
+  edgeUnattestedInDistribution?: string;
+  /**
+   * `web.machine_name` (SEC-2a, user.yml only): the name the signed-out
+   * page gives this machine ("runs on <name>"). Unset: the short hostname.
+   */
+  machineName?: string;
 }
 
+/** `web.edge_unattested`'s values. */
+export type EdgeUnattested = "local" | "signin";
+
 function readYaml(file: string): Record<string, unknown> {
   try {
     const v = yaml.parse(fs.readFileSync(file, "utf-8")) as unknown;
@@ -210,6 +241,12 @@ export function ignoredConfigWarning(cfg: WebAuthConfig): string | null {
       `${cfg.ignored.join(", ")}: ignored. A browser session never expires; ` +
         "it ends at sign-out or `web logout`. Remove the key to silence this.",
     );
+  if (cfg.edgeUnattestedInDistribution)
+    lines.push(
+      `web.edge_unattested (${cfg.edgeUnattestedInDistribution}): ignored. ` +
+        "It is a choice for one machine, read only from config/local/user.yml; " +
+        "move it there on the machine that needs it, and remove it here.",
+    );
   if (cfg.plainHttpInDistribution)
     lines.push(
       `web.allow_plain_http_remote (${cfg.plainHttpInDistribution}): ignored. ` +
@@ -241,15 +278,47 @@ export function readWebAuthConfig(
     throw new Error(
       `web.allow_plain_http_remote must be true or false, got ${JSON.stringify(plain)}`,
     );
+  const unattested = user.edge_unattested;
+  if (
+    unattested !== undefined &&
+    unattested !== "local" &&
+    unattested !== "signin"
+  )
+    throw new Error(
+      `web.edge_unattested must be local or signin, got ${JSON.stringify(unattested)}`,
+    );
+  const clientId =
+    clientIdOf(user, "config/local/user.yml") ?? clientIdOf(team, configFile);
+  const machineName = parseMachineName(user.machine_name);
   return {
+    ...(machineName ? { machineName } : {}),
     allowPlainHttpRemote: plain === true,
     ignored,
+    edgeUnattested: unattested ?? "signin",
+    ...(clientId !== undefined ? { githubClientId: clientId } : {}),
     ...(team.allow_plain_http_remote !== undefined
       ? { plainHttpInDistribution: configFile }
       : {}),
+    ...(team.edge_unattested !== undefined
+      ? { edgeUnattestedInDistribution: configFile }
+      : {}),
   };
 }
 
+/** `web.github_client_id` in one file: a GitHub App client id, or unset. */
+function clientIdOf(
+  w: Record<string, unknown>,
+  file: string,
+): string | undefined {
+  const v = w.github_client_id;
+  if (v === undefined || v === null) return undefined;
+  if (typeof v !== "string" || !/^[A-Za-z0-9._-]{0,64}$/.test(v.trim()))
+    throw new Error(
+      `web.github_client_id (${file}) must be a GitHub App client id (letters, digits, dots, dashes), got ${JSON.stringify(v)}`,
+    );
+  return v.trim();
+}
+
 // ── The session store ──────────────────────────────────────────────────────
 
 export interface SessionRecord {
@@ -260,6 +329,14 @@ export interface SessionRecord {
   csrf: string;
   /** The Host it was issued on. */
   host: string;
+  /** SEC-2a: how it signed in: a GitHub sign-in, or a one-time link (pairing). Unset: a link (before 0.4.5). */
+  via?: "github" | "link" | "code";
+  /** SEC-2a: the client's address when Den could attest it. */
+  client?: string;
+  /** SEC-2a: a GitHub sign-in's login (the chip's "@login"). */
+  login?: string;
+  /** SEC-2a: not yet greeted ("This device is signed in…", once). */
+  welcome?: true;
 }
 
 interface StoreFile {
@@ -384,7 +461,13 @@ export class WebSessionStore {
   }
 
   /** A new session: its id (the cookie's value) and record. */
-  create(meta: { userAgent?: string; host?: string }): {
+  create(meta: {
+    userAgent?: string;
+    host?: string;
+    via?: "github" | "link" | "code";
+    client?: string;
+    login?: string;
+  }): {
     id: string;
     session: SessionView;
   } {
@@ -400,6 +483,10 @@ export class WebSessionStore {
       host: String(meta.host ?? "")
         .toLowerCase()
         .slice(0, 255),
+      ...(meta.via ? { via: meta.via } : {}),
+      ...(meta.client ? { client: String(meta.client).slice(0, 64) } : {}),
+      ...(meta.login ? { login: String(meta.login).slice(0, 64) } : {}),
+      welcome: true,
     };
     const data = structuredClone(this.load());
     this.prune(data, now);
@@ -438,6 +525,19 @@ export class WebSessionStore {
     }
   }
 
+  /**
+   * Whether this session is yet to be greeted, once: true the first time
+   * after its sign-in, and never again (the flag is cleared).
+   */
+  takeWelcome(key: string): boolean {
+    const data = this.load();
+    if (!data.sessions[key]?.welcome) return false;
+    const next = structuredClone(data);
+    delete next.sessions[key].welcome;
+    this.trySave(next);
+    return true;
+  }
+
   /** Every session, newest first. */
   list(): SessionView[] {
     return Object.entries(this.load().sessions)
@@ -489,3 +589,37 @@ export class WebSessionStore {
 export function sessionIdPrefix(key: string): string {
   return key.slice(0, 8);
 }
+
+/**
+ * A linked device's name from its User-Agent (SEC-2a: "Chrome on macOS"),
+ * or "Unknown browser".
+ */
+export function deviceName(userAgent: string | undefined): string {
+  const ua = String(userAgent ?? "");
+  const browser = /Edg\//.test(ua)
+    ? "Edge"
+    : /Firefox\//.test(ua)
+      ? "Firefox"
+      : /(Chrome|CriOS)\//.test(ua)
+        ? "Chrome"
+        : /Safari\//.test(ua)
+          ? "Safari"
+          : /curl\//.test(ua)
+            ? "curl"
+            : null;
+  const os = /iPhone|iPad|iPod/.test(ua)
+    ? "iOS"
+    : /Android/.test(ua)
+      ? "Android"
+      : /Mac OS X|Macintosh/.test(ua)
+        ? "macOS"
+        : /Windows/.test(ua)
+          ? "Windows"
+          : /CrOS/.test(ua)
+            ? "ChromeOS"
+            : /Linux/.test(ua)
+              ? "Linux"
+              : null;
+  if (browser && os) return `${browser} on ${os}`;
+  return browser ?? (os ? `A browser on ${os}` : "Unknown browser");
+}

package/src/ui/cli/agent-ops.ts

@@ -42,10 +42,22 @@ import * as path from "path";
 import {
   AGENTS_RESERVED_KEYS,
   configuredRuntimeBin,
+  configuredRuntimeCatalog,
   readAgentsConfig,
+  setUserRuntimeBin,
   userConfigPath,
   type ResolvedAgentsConfig,
 } from "../../shared/den-config.js";
+import {
+  setWorkspaceRuntimeBin,
+  workspaceBinKey,
+  workspaceRuntimeBin,
+} from "../../shared/environment-manager/workspaces.js";
+import {
+  BUILTIN_CATALOG,
+  type CatalogEntry,
+} from "../../shared/agents/catalog.js";
+import { checkRuntimeBin } from "../../shared/agents/catalog-runtime.js";
 import { cliEntrypoint } from "../../shared/engine.js";
 import { getDistRoot } from "../../shared/paths.js";
 import { envKey } from "../../shared/product.js";
@@ -70,6 +82,7 @@ import {
   getRuntime,
   LaunchError,
   runtimeIds,
+  syncConfiguredRuntimes,
   type AgentMcp,
   type LaunchInput,
   type Runtime,
@@ -77,7 +90,10 @@ import {
 import type { RuntimeDetect } from "../../shared/agents/runtime.js";
 import {
   binSettingKey,
+  ensureInteractivePath,
+  interactivePathAsked,
   runtimeVersion,
+  type BinSetting,
   type BinSource,
 } from "../../shared/agents/runtime-search.js";
 import { WORKSPACE_NAME_RE } from "../../shared/agent-actor.js";
@@ -116,6 +132,20 @@ export interface AgentsDeps extends SessionsDeps {
   exitWatchMs?: number;
   /** `agents.runtimes.<id>.bin` (default: user.yml's; undefined: unset). */
   runtimeBin?: (id: string) => unknown;
+  /**
+   * Workspace `ws`'s `agents.runtimes.<id>.bin` (default: workspaces.yml's;
+   * undefined: unset). It wins over runtimeBin (AG-0.5).
+   */
+  workspaceRuntimeBin?: (ws: string, id: string) => unknown;
+  /** user.yml's runtime catalog entries, checked (default: user.yml's). */
+  userCatalog?: (taken: readonly string[]) => CatalogEntry[];
+  /** Save a checked path (null clears it): global or the workspace's. */
+  saveRuntimeBin?: (
+    scope: "global" | "workspace",
+    ws: string | undefined,
+    id: string,
+    bin: string | null,
+  ) => void;
   /** The user.yml a person edits to set it (default: config/local/user.yml). */
   userConfigFile?: () => string;
 }
@@ -127,6 +157,9 @@ export interface AgentsResolved extends Resolved {
   mcpServer: () => { command: string[] | string; env: Record<string, string> };
   exitWatchMs: number;
   runtimeBin: (id: string) => unknown;
+  workspaceRuntimeBin: (ws: string, id: string) => unknown;
+  userCatalog: (taken: readonly string[]) => CatalogEntry[];
+  saveRuntimeBin: NonNullable<AgentsDeps["saveRuntimeBin"]>;
   userConfigFile: () => string;
 }
 
@@ -217,6 +250,15 @@ export function resolveAgentsDeps(d: AgentsDeps): AgentsResolved {
     mcpServer: d.mcpServer ?? (() => defaultMcpServer(base.cli)),
     exitWatchMs: d.exitWatchMs ?? EXIT_WATCH_MS,
     runtimeBin: d.runtimeBin ?? ((id) => configuredRuntimeBin(id)),
+    workspaceRuntimeBin:
+      d.workspaceRuntimeBin ?? ((ws, id) => workspaceRuntimeBin(ws, id)),
+    userCatalog: d.userCatalog ?? ((taken) => configuredRuntimeCatalog(taken)),
+    saveRuntimeBin:
+      d.saveRuntimeBin ??
+      ((scope, ws, id, bin) =>
+        scope === "workspace" && ws
+          ? setWorkspaceRuntimeBin(ws, id, bin)
+          : setUserRuntimeBin(id, bin)),
     userConfigFile: d.userConfigFile ?? userConfigPath,
   };
 }
@@ -415,44 +457,137 @@ export interface RuntimeChoice {
   id: string;
   /** Its name for people ("Claude Code"). */
   label?: string;
+  /** Who makes it ("Anthropic"): a catalog runtime (AG-0.5). */
+  vendor?: string;
+  /**
+   * false: it runs as its own CLI, without Den's tools yet ("Den tools:
+   * coming"). Absent for a runtime that isn't from the catalog.
+   */
+  denTools?: boolean;
   available: boolean;
   /** Why it is unavailable. */
   why?: string;
   version?: string;
   /** The CLI it runs (AG-0.2). */
   path?: string;
-  /** Where that path came from: setting, login-shell, well-known or PATH. */
+  /**
+   * Where that path came from: workspace (its workspaces.yml entry),
+   * setting (user.yml), login-shell, PATH, well-known, interactive-shell.
+   */
   source?: BinSource;
   /** The directories searched, in order (a runtime with a CLI to find). */
   searched?: string[];
   /** The user.yml key that sets its path (a runtime with a CLI to find). */
   setting?: string;
+  /** The workspace's key for it, when listed for a workspace. */
+  workspaceSetting?: string;
   /** It declares resume. */
   resume: boolean;
   default: boolean;
 }
 
 /**
- * Whether runtime `rt` can run here (AG-0.1): its setting
- * (`agents.runtimes.<id>.bin`, from d.runtimeBin), else the search. Runs
- * nothing.
+ * The path set for runtime `id` (AG-0.5): the workspace's (when `ws` is
+ * given and it sets one), else user.yml's; null when neither does.
+ */
+export function runtimeSetting(
+  d: AgentsResolved,
+  id: string,
+  ws?: string,
+): BinSetting | null {
+  if (ws) {
+    const v = d.workspaceRuntimeBin(ws, id);
+    if (v !== undefined && v !== null)
+      return { value: v, source: "workspace", key: workspaceBinKey(ws, id) };
+  }
+  const g = d.runtimeBin(id);
+  return g === undefined || g === null ? null : { value: g, source: "setting" };
+}
+
+/**
+ * Whether runtime `rt` can run here (AG-0.1, AG-0.5): a path set for the
+ * workspace, else user.yml's (`agents.runtimes.<id>.bin`), else the
+ * search. Runs nothing.
+ */
+export function detectRuntime(
+  d: AgentsResolved,
+  rt: Runtime,
+  ws?: string,
+): RuntimeDetect {
+  return rt.detect(d.env, { bin: runtimeSetting(d, rt.id, ws) });
+}
+
+/**
+ * The catalog entries the distribution and user.yml add, registered as
+ * runtimes (AG-0.5). A malformed entry is a refusal naming its key.
+ */
+export function syncCatalog(d: AgentsResolved): void {
+  const cfg = agentsConfig(d);
+  let extra: CatalogEntry[];
+  try {
+    extra = [
+      ...cfg.runtimeCatalog,
+      ...d.userCatalog([
+        ...BUILTIN_CATALOG.map((e) => e.id),
+        ...cfg.runtimeCatalog.map((e) => e.id),
+      ]),
+    ];
+  } catch (e) {
+    throw refused((e as Error).message, [], 422);
+  }
+  syncConfiguredRuntimes(extra);
+}
+
+/**
+ * When a catalog runtime is still missing (nothing set, not found on the
+ * login PATH, PATH or its install directories), ask the interactive shell
+ * for its PATH: once per process, then kept (AG-0.5).
+ */
+async function fallbackSearch(
+  d: AgentsResolved,
+  rts: Runtime[],
+  ws?: string,
+): Promise<void> {
+  if (interactivePathAsked()) return;
+  const missing = rts.some(
+    (rt) =>
+      rt.catalog &&
+      !runtimeSetting(d, rt.id, ws) &&
+      !detectRuntime(d, rt, ws).available,
+  );
+  if (missing) await ensureInteractivePath({ env: d.env });
+}
+
+/**
+ * The catalog's installed runtimes first, then the ones not found, then
+ * the rest (generic: no CLI of its own to find).
  */
-export function detectRuntime(d: AgentsResolved, rt: Runtime): RuntimeDetect {
-  return rt.detect(d.env, { bin: d.runtimeBin(rt.id) ?? null });
+function rank(r: RuntimeChoice): number {
+  if (r.denTools === undefined) return 2;
+  return r.available ? 0 : 1;
 }
 
 /**
- * Every registered runtime, and whether it can run here, with the path it
- * runs and its version: its version command (`claude --version`), run once
- * under a timeout and kept, else what its install says.
+ * Every registered runtime, and whether it can run here (for an agent of
+ * `ws`, when given: its workspace's path wins), with the path it runs and
+ * its version: its version command (`claude --version`), run once under a
+ * timeout and kept, else what its install says. Installed ones first.
  */
 export async function listRuntimes(
   d: AgentsResolved,
+  ws?: string,
 ): Promise<RuntimeChoice[]> {
-  return Promise.all(
-    runtimeIds().map(async (id) => {
+  syncCatalog(d);
+  const ids = runtimeIds();
+  await fallbackSearch(
+    d,
+    ids.map((id) => getRuntime(id)!),
+    ws,
+  );
+  const rows = await Promise.all(
+    ids.map(async (id) => {
       const rt = getRuntime(id)!;
-      const det = detectRuntime(d, rt);
+      const det = detectRuntime(d, rt, ws);
       const asked =
         det.available && det.path && rt.find?.versionArgs
           ? await runtimeVersion(det.path, rt.find.versionArgs, d.env)
@@ -461,24 +596,72 @@ export async function listRuntimes(
       return {
         id,
         ...(rt.label ? { label: rt.label } : {}),
+        ...(rt.vendor ? { vendor: rt.vendor } : {}),
+        ...(rt.catalog ? { denTools: rt.denTools === true } : {}),
         available: det.available,
         ...(det.available ? {} : { why: det.why ?? "unavailable" }),
         ...(version ? { version } : {}),
         ...(det.path ? { path: det.path } : {}),
         ...(det.source ? { source: det.source } : {}),
         ...(rt.find
-          ? { searched: det.searched ?? [], setting: binSettingKey(id) }
+          ? {
+              searched: det.searched ?? [],
+              setting: binSettingKey(id),
+              ...(ws ? { workspaceSetting: workspaceBinKey(ws, id) } : {}),
+            }
           : {}),
         resume: Boolean(rt.resume),
         default: id === DEFAULT_RUNTIME_ID,
       };
     }),
   );
+  return rows
+    .map((r, i) => ({ r, i }))
+    .sort((a, b) => rank(a.r) - rank(b.r) || a.i - b.i)
+    .map((x) => x.r);
+}
+
+/**
+ * Set (or, with null, clear) runtime `id`'s path, global or for workspace
+ * `ws` (AG-0.5): its version command runs first, and a path that isn't
+ * that runtime is refused. Returns its row as listed after.
+ */
+export async function setRuntimePath(
+  d: AgentsResolved,
+  req: {
+    id: string;
+    scope: "global" | "workspace";
+    workspace?: string;
+    bin: string | null;
+  },
+): Promise<RuntimeChoice> {
+  syncCatalog(d);
+  const rt = runtimeFor(req.id);
+  if (!rt.catalog)
+    throw usage(`${req.id} has no CLI to find: its path can't be set`);
+  let ws: string | undefined;
+  if (req.scope === "workspace") {
+    ws = checkWorkspaceName("runtime path", req.workspace);
+    if (!d.workspaceExists(ws))
+      throw usage(`workspace "${ws}" does not exist`, 404);
+  }
+  if (req.bin !== null) {
+    const c = await checkRuntimeBin(rt.catalog, req.bin, d.env);
+    if (!c.ok) throw refused(c.why, [], 422);
+    d.saveRuntimeBin(req.scope, ws, rt.id, c.path);
+  } else d.saveRuntimeBin(req.scope, ws, rt.id, null);
+  const rows = await listRuntimes(d, ws);
+  return rows.find((r) => r.id === rt.id)!;
 }
 
 /** Refused unless `rt` can run here; its detect result when it can. */
-function availableOrRefuse(d: AgentsResolved, rt: Runtime): RuntimeDetect {
-  const det = detectRuntime(d, rt);
+async function availableOrRefuse(
+  d: AgentsResolved,
+  rt: Runtime,
+  ws?: string,
+): Promise<RuntimeDetect> {
+  await fallbackSearch(d, [rt], ws);
+  const det = detectRuntime(d, rt, ws);
   if (!det.available)
     throw refused(
       `${rt.id} is unavailable: ${det.why ?? "unknown"}`,
@@ -538,9 +721,15 @@ interface Launch {
   binDir?: string;
 }
 
-/** A configured CLI's directory, for its session's PATH (its own tools). */
+/**
+ * A CLI's directory when the session's PATH wouldn't have it (a path set
+ * for it, or found by the interactive shell), for its own tools.
+ */
 function binDirOf(det: RuntimeDetect): { binDir?: string } {
-  return det.source === "setting" && det.path
+  return (det.source === "setting" ||
+    det.source === "workspace" ||
+    det.source === "interactive-shell") &&
+    det.path
     ? { binDir: path.dirname(det.path) }
     : {};
 }
@@ -766,8 +955,9 @@ export async function startAgent(
     );
   const id = req.id ?? defaultId(d.stateDir(), persona.id, ws);
   checkId(where, id);
+  syncCatalog(d);
   const rt = runtimeFor(req.runtime ?? persona.runtime ?? DEFAULT_RUNTIME_ID);
-  const det = availableOrRefuse(d, rt);
+  const det = await availableOrRefuse(d, rt, ws);
   const model = req.model ?? persona.model;
 
   const prev = readRecord(d.stateDir(), id);
@@ -871,6 +1061,7 @@ export async function resumeAgent(
   ws?: string,
 ): Promise<Resumed> {
   const rec = agentRecord(d, id, ws);
+  syncCatalog(d);
   const rt = runtimeFor(rec.runtime);
   if (!rt.resume)
     throw refused(`runtime ${rt.id} does not declare resume`, [
@@ -880,7 +1071,7 @@ export async function resumeAgent(
   const persona = personas(d, cfg).get(rec.persona);
   if (!persona)
     throw refused(`agent ${rec.id}'s persona "${rec.persona}" is gone`);
-  const det = availableOrRefuse(d, rt);
+  const det = await availableOrRefuse(d, rt, rec.workspace);
   ptyOrRefuse(d);
   return withClient(d, async (c) => {
     const old = sessionOf(await c.list(), rec);