@noopolis/daimon 0.1.2 → 0.2.1

package/dist/runtime/engineDispatcher.js

@@ -0,0 +1,228 @@
+import { brokerProcessClock } from "./grokBrokerTaskClock.js";
+import { reportEngineTaskClockGap } from "../pi/engineTaskClock.js";
+import { attentionTools } from "./attention.js";
+import { readTaskClock } from "./taskClock.js";
+import { memoryClockOptions } from "../pi/memoryClock.js";
+import { grokDaimonToolName, grokMountedToolNamingRule } from "../contracts/grokWorkerContract.js";
+import path from "node:path";
+import { AGY_MAX_TOOL_TURNS, createCliSessionFactory, resolveCodexWakeTimeoutMs, resolveCodexWakeTokenCeiling, resolveEngineWakeLimitOverrides } from "../pi/cliSession.js";
+import { GROK_DAIMON_SANDBOX_PROFILE, prepareAndVerifyGrokSandbox } from "../pi/grokSandbox.js";
+import { PiHarnessAdapter } from "../pi/piHarness.js";
+import { engineAuthFile, engineHomeName, prepareEngineExecutable, prepareEngineReadiness, readPortableEngineCredentialSecrets } from "./engineReadiness.js";
+import { createProductionAgentTools } from "./productionAgentTools.js";
+import { AGY_SUBSCRIPTION_REALM, GROK_SUBSCRIPTION_REALM } from "./contractManifest.js";
+import { recordTurnUsage, resolveTurnUsageLedgerPath } from "./turnUsageLedger.js";
+import { recordCodexTurnRequests } from "./turnRequestLedger.js";
+/**
+ * The production-only bridge from a closed runtime engine intent to Daimon's
+ * existing one-agent harness. Configuration never carries a command or env.
+ */
+export async function startOrganizationRuntimeEngine(agent, controlTokenEnv, paths, agyBusAddress, grokBroker, organizationAgents, sharedProtectedPaths = [], attention) {
+    const clock = readTaskClock();
+    reportEngineTaskClockGap(agent.engine.kind);
+    if (agent.memory !== undefined)
+        memoryClockOptions(clock);
+    // A declared Grok model is enforced by the broker proxy and worker config;
+    // the direct path has neither, so it refuses rather than silently ignoring it.
+    if (agent.engine.kind === "grok" && agent.engine.model !== undefined && grokBroker === undefined)
+        throw new Error(`Agent ${agent.id} declares a Grok model, which requires the engine broker`);
+    await paths?.verify();
+    const canonicalAgent = paths === undefined ? agent : { ...agent, workspacePath: paths.workspacePath, runtimeHomePath: paths.runtimeHomePath };
+    const readiness = canonicalAgent.engine.kind === "grok" && grokBroker !== undefined
+        ? { ...(await prepareEngineExecutable(canonicalAgent.id, "grok")), engineHomePath: path.join(canonicalAgent.runtimeHomePath, engineHomeName("grok")) }
+        : await prepareEngineReadiness(canonicalAgent, canonicalAgent.runtimeHomePath, agyBusAddress);
+    const wakeContext = {};
+    const grokSandbox = canonicalAgent.engine.kind === "grok" && paths !== undefined && organizationAgents !== undefined
+        ? () => prepareAndVerifyGrokSandbox({
+            command: readiness.executablePath,
+            cwd: canonicalAgent.workspacePath,
+            engineHomePath: readiness.engineHomePath,
+            protectedPaths: grokSandboxProtectedPaths(canonicalAgent.id, organizationAgents, sharedProtectedPaths),
+            runtimeHomePath: canonicalAgent.runtimeHomePath
+        })
+        : undefined;
+    const codexSandboxPaths = canonicalAgent.engine.kind === "codex" && canonicalAgent.engine.codexSandbox !== undefined
+        ? {
+            protectedPaths: codexSandboxProtectedPaths(canonicalAgent.id, canonicalAgent, readiness.engineHomePath, organizationAgents ?? [canonicalAgent], sharedProtectedPaths),
+            readablePaths: codexSandboxReadablePaths(canonicalAgent)
+        }
+        : undefined;
+    const mountedTools = [...await createProductionAgentTools(canonicalAgent, wakeContext), ...(agent.attention !== undefined && attention !== undefined ? attentionTools(agent.id, attention) : [])];
+    const adapter = adapterFor(canonicalAgent, controlTokenEnv, readiness.verify, readiness.executablePath, readiness.engineHomePath, paths?.verify, agyBusAddress, mountedTools, wakeContext, grokSandbox, grokBroker, codexSandboxPaths, mountedTools.map((tool) => tool.name));
+    const handle = await adapter.startAgent({
+        id: canonicalAgent.id,
+        name: canonicalAgent.name,
+        instructions: canonicalAgent.instructions,
+        runtimeHomePath: canonicalAgent.runtimeHomePath,
+        workspacePath: canonicalAgent.workspacePath
+    });
+    await paths?.verify();
+    const result = {
+        ...handle,
+        async wake(event) {
+            await paths?.verify();
+            await readiness.verify();
+            try {
+                return await handle.wake(event);
+            }
+            finally {
+                await paths?.verify();
+                await readiness.verify();
+            }
+        },
+        async stop() { await handle.stop(); },
+        status: () => handle.status()
+    };
+    return result;
+}
+export function grokSandboxProtectedPaths(currentAgentId, organizationAgents, sharedProtectedPaths = []) {
+    return [
+        GROK_SUBSCRIPTION_REALM.bootstrapMountPath,
+        GROK_SUBSCRIPTION_REALM.durableMountPath,
+        ...(organizationAgents.some((peer) => peer.engine.kind === "agy") ? [
+            AGY_SUBSCRIPTION_REALM.unlockMountPath,
+            AGY_SUBSCRIPTION_REALM.durableMountPath
+        ] : []),
+        ...sharedProtectedPaths,
+        ...organizationAgents.filter((peer) => peer.id !== currentAgentId)
+            .flatMap((peer) => [peer.runtimeHomePath, peer.workspacePath])
+    ];
+}
+export function codexSandboxProtectedPaths(currentAgentId, currentAgent, currentEngineHomePath, organizationAgents, sharedProtectedPaths = []) {
+    return [...new Set([
+            engineAuthFile("codex", currentEngineHomePath),
+            path.join(currentAgent.runtimeHomePath, ".daimon-inbound"),
+            "/proc",
+            "/run",
+            ...grokSandboxProtectedPaths(currentAgentId, organizationAgents, sharedProtectedPaths)
+        ])];
+}
+export function codexSandboxReadablePaths(currentAgent) {
+    return [path.join(currentAgent.runtimeHomePath, "tool-output")];
+}
+function adapterFor(agent, controlTokenEnv, verifyExecutable, executablePath, engineHomePath, verifyRuntimePaths, agyBusAddress, productionTools = [], wakeEnvironmentContext = {}, verifyGrokSandbox, grokBroker, codexSandboxPaths, mountedToolNames = []) {
+    const engine = agent.engine.kind;
+    const sessionFactory = createCliSessionFactory(engine === "agy"
+        ? { engine, maxToolTurns: AGY_MAX_TOOL_TURNS, timeoutMs: 180_000, dbusSessionBusAddress: agyBusAddress, redactedEnvironmentNames: [controlTokenEnv], identityPrompt: identityEnvelope(agent, mountedToolNames), command: executablePath, engineHomePath, verifyExecutable, verifyRuntimePaths,
+            // AGY has no broker to meter it, so the session hands its decoded
+            // terminal-frame usage straight to the same ledger the Grok broker
+            // appends to. `recordTurnUsage` is advisory and never rejects.
+            onTurnUsage: (usage, outcome) => recordTurnUsage(resolveTurnUsageLedgerPath(), { agent: agent.id, wake: wakeEnvironmentContext.current ?? "wake", engine: "agy", usage, outcome }) }
+        : { engine, redactedEnvironmentNames: [controlTokenEnv], identityPrompt: identityEnvelope(agent, mountedToolNames), command: executablePath, engineHomePath, verifyExecutable, verifyRuntimePaths,
+            ...(engine === "codex" ? {
+                // Codex has no broker to meter it, so publish terminal-frame usage
+                // to the shared advisory ledger — on the wake that published and on
+                // the wake that failed after Codex had already reported its spend.
+                onTurnUsage: (usage, outcome) => recordTurnUsage(resolveTurnUsageLedgerPath(), { agent: agent.id, wake: wakeEnvironmentContext.current ?? "wake", engine: "codex", usage, outcome }),
+                // Per-model-request accounting, written to its own stream beside the
+                // ledger. `engineHomePath` is the agent's `CODEX_HOME`
+                // (`../pi/cliEnvironment.ts`), so the rollout Codex just wrote for
+                // this thread is under it. Advisory throughout: it never fails a wake.
+                onCodexTurnRequests: (threadId) => recordCodexTurnRequests({ agent: agent.id, wake: wakeEnvironmentContext.current ?? "wake", codexHome: engineHomePath, threadId }).then(() => undefined),
+                // `maxToolTurns` mediates only daimon-MCP tool calls; Codex's own
+                // shell is never routed through it, so it gets its own wall-clock
+                // and per-wake token bounds instead (`cliSession.ts`).
+                timeoutMs: resolveCodexWakeTimeoutMs(),
+                codexTokenCeiling: resolveCodexWakeTokenCeiling(),
+                // Present only when the parsed config declared them; absent keeps
+                // today's unpinned Codex CLI default and today's exact argv.
+                ...(agent.engine.model === undefined ? {} : { model: agent.engine.model }),
+                ...(agent.engine.reasoningEffort === undefined ? {} : { reasoningEffort: agent.engine.reasoningEffort }),
+                ...(agent.engine.codexSandbox === undefined ? {} : { codexSandbox: agent.engine.codexSandbox }),
+                ...(codexSandboxPaths === undefined ? {} : {
+                    codexSandboxProtectedPaths: codexSandboxPaths.protectedPaths,
+                    codexSandboxReadablePaths: codexSandboxPaths.readablePaths
+                })
+            } : {}),
+            ...(engine === "grok" && grokBroker !== undefined ? {} : { credentialSecretValues: () => readPortableEngineCredentialSecrets(agent.id, engine, engineHomePath) }),
+            // The broker seals usage and enforces its registration's limits; the
+            // wake may only lower them (DAIMON_ENGINE_WAKE_*), and a declared model
+            // must be the one the broker reports it ran.
+            ...(engine === "grok" && grokBroker !== undefined ? { grokBrokerTurn: grokBrokerTurnFor(agent, grokBroker, wakeEnvironmentContext) } : {}),
+            ...(engine === "grok" && verifyGrokSandbox ? {
+                grokSandboxProfile: GROK_DAIMON_SANDBOX_PROFILE,
+                verifyGrokSandbox
+            } : {}) });
+    return cliHarness(agent, sessionFactory, [controlTokenEnv], productionTools, wakeEnvironmentContext);
+}
+/** @internal The same callback used by the production session; no native process clock enters the engine environment. */
+export function grokBrokerTurnFor(agent, grokBroker, wakeEnvironmentContext) {
+    const limits = resolveEngineWakeLimitOverrides();
+    const options = { ...(limits === undefined ? {} : { limits }), ...(agent.engine.model === undefined ? {} : { model: agent.engine.model }) };
+    return (prompt, endpoint, signal) => {
+        const processClock = brokerProcessClock();
+        return grokBroker.turn(agent.id, wakeEnvironmentContext.current ?? "wake", prompt, endpoint, signal, { ...options, ...(processClock === undefined ? {} : { processClock }) });
+    };
+}
+/**
+ * CLI engines do not consume Pi's resource loader. Frame the same immutable
+ * identity in JSON so arbitrary names/instructions cannot change its shape.
+ */
+/**
+ * The caller-owned prompt preamble.
+ *
+ * It names the mounted tools explicitly, because a CLI engine reaches Daimon's
+ * tools over MCP and an agent whose instructions name another engine's tool
+ * spelling can finish a turn having called nothing. The declared names are the
+ * caller's own configuration, not engine-supplied text.
+ *
+ * On Grok the bare names are not the callable ones: every Daimon tool is a
+ * deferred MCP tool of server `daimon`, and Grok 1.0.34 refuses an unqualified
+ * name before any HTTP ("Tool names must be qualified as `server__tool`"). This
+ * envelope used to instruct exactly that refused form. The correct rule is not
+ * restated here — it is rendered by `grokMountedToolNamingRule` in the same
+ * contract module that renders the worker's pinned system prompt, so the two
+ * texts cannot contradict each other again. Every other engine's sentence is
+ * unchanged, byte for byte.
+ */
+export function identityEnvelope(agent, mountedToolNames = []) {
+    return [
+        "<daimon-agent-identity>",
+        JSON.stringify({ id: agent.id, name: agent.name, instructions: agent.instructions }),
+        "</daimon-agent-identity>",
+        ...(mountedToolNames.length === 0 ? [] : [
+            (agent.engine.kind === "grok"
+                ? grokMountedToolNamingRule(mountedToolNames)
+                : `Your mounted tools are exactly: ${mountedToolNames.join(", ")}. Call them by these names; `
+                    + "your instructions may spell them differently.")
+                + " No other tool reaches the newsroom."
+        ]),
+        // The one tool that reaches colleagues is named the way this engine can
+        // call it. Meaning and prohibition are unchanged; only the spelling is.
+        `Colleagues only hear you when you call ${engineToolName(agent, "moltnet_send")}; your terminal response is a private note to the runtime, not a message to anyone — keep it to one line or leave it empty. `
+            + "Do not seek transport credentials or invoke a transport CLI unless the caller explicitly mounted an authenticated transport tool.",
+        "The following is the current wake event."
+    ].join("\n") + "\n";
+}
+/**
+ * One Daimon tool name, spelled the way this agent's engine accepts it.
+ *
+ * On Grok the bare form is refused as an invalid MCP tool name, so any
+ * engine-facing sentence that *names* a tool renders it through the contract's
+ * `grokDaimonToolName`; every other engine keeps the bare name byte for byte.
+ * Grok's own native tools (`read_file`, `search_tool`, `use_tool`) are not
+ * Daimon tools and never take the prefix.
+ */
+const engineToolName = (agent, tool) => agent.engine.kind === "grok" ? grokDaimonToolName(tool) : tool;
+function cliHarness(agent, sessionFactory, protectedEnvironmentNames, productionTools, wakeEnvironmentContext) {
+    return new PiHarnessAdapter({
+        authPath: path.join(agent.runtimeHomePath, "auth.json"),
+        // Pi owns the harness envelope while the session factory owns this CLI.
+        model: {
+            auth: { method: "none" },
+            endpoint: { baseUrl: "http://127.0.0.1/daimon-cli", compatibility: "openai" },
+            name: "daimon-cli",
+            provider: "daimon-cli"
+        },
+        sessionFactory,
+        protectedEnvironmentNames,
+        productionTools,
+        ...(agent.engine.kind === "codex" && agent.engine.codexSandbox !== undefined ? { toolNames: [] } : {}),
+        wakeEnvironmentContext,
+        ...(agent.memory === undefined ? {} : { memory: {
+                runtimeHomePath: agent.memory.runtimeHomePath,
+                ...(agent.memory.source === undefined ? {} : { source: agent.memory.source }),
+                ...(agent.memory.tokenBudget === undefined ? {} : { tokenBudget: agent.memory.tokenBudget })
+            } })
+    });
+}

package/dist/runtime/engineReadiness.d.ts

@@ -0,0 +1,23 @@
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+export type EngineReadiness = Readonly<{
+    executablePath: string;
+    engineHomePath: string;
+    verify(): Promise<void>;
+}>;
+export type EngineExecutableReadiness = Readonly<{
+    executablePath: string;
+    verify(): Promise<void>;
+}>;
+/**
+ * Resolves and pins the small, local authority needed by one CLI engine. This
+ * deliberately does not start an agent, contact a provider, or read a secret
+ * beyond the bounded structural authentication check.
+ */
+export declare function prepareEngineReadiness(agent: OrganizationRuntimeAgentConfig, runtimeHomePath: string, agyBusAddress?: string): Promise<EngineReadiness>;
+export declare function prepareEngineExecutable(agentId: string, engine: "codex" | "grok" | "agy"): Promise<EngineExecutableReadiness>;
+export declare function engineHomeName(engine: "codex" | "grok"): string;
+export declare function engineAuthFile(_engine: "codex" | "grok", engineHomePath: string): string;
+/** Securely rereads the currently staged provider credential for exact output redaction. */
+export declare function readPortableEngineCredentialSecrets(agentId: string, engine: "codex" | "grok", engineHomePath: string): Promise<readonly string[]>;
+export declare function verifyAgySubscriptionEnrollment(agentId: string, executablePath: string, runtimeHomePath: string, busAddress: string | undefined): Promise<void>;
+//# sourceMappingURL=engineReadiness.d.ts.map

package/dist/runtime/engineReadiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineReadiness.d.ts","sourceRoot":"","sources":["../../src/runtime/engineReadiness.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAM/E,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC,CAAC;AAIH;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,8BAA8B,EACrC,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAC/B,OAAO,CAAC,yBAAyB,CAAC,CAqBpC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAExF;AAqFD,4FAA4F;AAC5F,wBAAsB,mCAAmC,CACvD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GAAG,MAAM,EACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAqB5B;AAUD,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/runtime/engineReadiness.js

@@ -0,0 +1,222 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { spawnRealTime as spawn } from "./taskClockProcess.js";
+import { createHash } from "node:crypto";
+import { cliChildEnvironment } from "../pi/cliEnvironment.js";
+import { hasRefreshablePortableCredential, portableCredentialSecretValues } from "./portableCredentialAuth.js";
+const MAX_AUTH_BYTES = 64 * 1024;
+const MAX_PROBE_BYTES = 8 * 1024;
+/**
+ * Resolves and pins the small, local authority needed by one CLI engine. This
+ * deliberately does not start an agent, contact a provider, or read a secret
+ * beyond the bounded structural authentication check.
+ */
+export async function prepareEngineReadiness(agent, runtimeHomePath, agyBusAddress) {
+    const executable = await prepareEngineExecutable(agent.id, agent.engine.kind);
+    const executablePath = executable.executablePath;
+    const engineHomePath = agent.engine.kind === "agy" ? runtimeHomePath : path.join(runtimeHomePath, engineHomeName(agent.engine.kind));
+    await verifyEngineAuth(agent.id, agent.engine.kind, engineHomePath, executablePath, runtimeHomePath, agyBusAddress);
+    return {
+        executablePath,
+        engineHomePath,
+        async verify() {
+            await executable.verify();
+            await verifyEngineAuth(agent.id, agent.engine.kind, engineHomePath, executablePath, runtimeHomePath, agyBusAddress);
+        }
+    };
+}
+export async function prepareEngineExecutable(agentId, engine) {
+    const executablePath = await resolveExecutable(agentId, engine);
+    const executableIdentity = identity(await stat(executablePath));
+    const capability = await probeExecutable(agentId, executablePath, engine);
+    return {
+        executablePath,
+        async verify() {
+            let current;
+            try {
+                const entry = await lstat(executablePath);
+                if (entry.isSymbolicLink())
+                    throw new Error("link");
+                current = await stat(executablePath);
+            }
+            catch {
+                throw unavailable(agentId, engine, "engine executable changed");
+            }
+            if (!sameIdentity(executableIdentity, identity(current)) || !current.isFile()) {
+                throw unavailable(agentId, engine, "engine executable changed");
+            }
+            if (await probeExecutable(agentId, executablePath, engine) !== capability) {
+                throw unavailable(agentId, engine, "engine capability changed");
+            }
+        }
+    };
+}
+export function engineHomeName(engine) {
+    return engine === "codex" ? ".codex" : ".grok";
+}
+export function engineAuthFile(_engine, engineHomePath) {
+    return path.join(engineHomePath, "auth.json");
+}
+async function resolveExecutable(agentId, engine) {
+    const sourcePath = process.env.PATH ?? "";
+    for (const directory of sourcePath.split(path.delimiter)) {
+        if (!directory || !path.isAbsolute(directory))
+            continue;
+        try {
+            const canonicalDirectory = await realpath(directory);
+            const directoryEntry = await lstat(canonicalDirectory);
+            if (!directoryEntry.isDirectory() || directoryEntry.isSymbolicLink() || (directoryEntry.mode & 0o022) !== 0)
+                continue;
+            const candidate = path.join(canonicalDirectory, engine);
+            const entry = await lstat(candidate);
+            if (!entry.isFile() && !entry.isSymbolicLink())
+                continue;
+            const canonical = await realpath(candidate);
+            const resolved = await lstat(canonical);
+            if (!resolved.isFile() || resolved.isSymbolicLink() || (resolved.mode & 0o111) === 0)
+                continue;
+            return canonical;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw unavailable(agentId, engine, "engine executable cannot be inspected");
+        }
+    }
+    throw unavailable(agentId, engine, "engine executable is unavailable");
+}
+async function probeExecutable(agentId, executablePath, engine) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(executablePath, ["--version"], { cwd: path.dirname(executablePath), env: { PATH: process.env.PATH ?? path.dirname(executablePath), LANG: "C", LC_ALL: "C" }, stdio: ["ignore", "pipe", "pipe"] });
+        let bytes = 0;
+        const output = [];
+        // Only stdout fingerprints the capability. stderr carries environment-dependent
+        // diagnostics -- allocator warnings under emulation, for one -- which are not a
+        // capability change but would otherwise invalidate the engine mid-run.
+        const consume = (chunk, capture) => { bytes += chunk.length; if (bytes > MAX_PROBE_BYTES)
+            child.kill("SIGKILL");
+        else if (capture)
+            output.push(chunk); };
+        child.stdout?.on("data", (chunk) => consume(chunk, true));
+        child.stderr?.on("data", (chunk) => consume(chunk, false));
+        const timer = setTimeout(() => child.kill("SIGKILL"), 3_000);
+        child.once("error", () => { clearTimeout(timer); reject(unavailable(agentId, engine, "engine capability probe failed")); });
+        child.once("close", (code) => {
+            clearTimeout(timer);
+            if (code === 0 && bytes <= MAX_PROBE_BYTES)
+                resolve(createHash("sha256").update(Buffer.concat(output)).digest("hex"));
+            else
+                reject(unavailable(agentId, engine, "engine capability probe failed"));
+        });
+    });
+}
+async function verifyEngineAuth(agentId, engine, engineHomePath, executablePath, runtimeHomePath, agyBusAddress) {
+    if (engine === "agy") {
+        await verifyAgySubscriptionEnrollment(agentId, executablePath, runtimeHomePath, agyBusAddress);
+        return;
+    }
+    await verifyPortableEngineAuth(agentId, engine, engineHomePath);
+}
+async function verifyPortableEngineAuth(agentId, engine, engineHomePath) {
+    const authPath = engineAuthFile(engine, engineHomePath);
+    let handle;
+    let buffer;
+    try {
+        const home = await lstat(engineHomePath);
+        if (!home.isDirectory() || home.isSymbolicLink() || home.uid !== process.getuid?.() || (home.mode & 0o777) !== 0o700) {
+            throw new Error("unsafe engine home");
+        }
+        const entry = await lstat(authPath);
+        assertPrivateAuthEntry(entry);
+        handle = await open(authPath, constants.O_RDONLY | noFollow());
+        const opened = await handle.stat();
+        assertPrivateAuthEntry(opened);
+        if (!sameIdentity(identity(entry), identity(opened)))
+            throw new Error("auth artifact changed");
+        buffer = await handle.readFile();
+        const after = await handle.stat();
+        assertPrivateAuthEntry(after);
+        if (!sameIdentity(identity(opened), identity(after)))
+            throw new Error("auth artifact changed");
+        if (!hasRefreshablePortableCredential(engine, buffer))
+            throw new Error("unsupported auth artifact");
+    }
+    catch {
+        throw unavailable(agentId, engine, "subscription authentication is not ready; provision the supported local credential and retry");
+    }
+    finally {
+        buffer?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+}
+/** Securely rereads the currently staged provider credential for exact output redaction. */
+export async function readPortableEngineCredentialSecrets(agentId, engine, engineHomePath) {
+    const authPath = engineAuthFile(engine, engineHomePath);
+    let handle;
+    let buffer;
+    try {
+        const home = await lstat(engineHomePath);
+        if (!home.isDirectory() || home.isSymbolicLink() || home.uid !== process.getuid?.() || (home.mode & 0o777) !== 0o700)
+            throw new Error("unsafe");
+        const before = await lstat(authPath);
+        assertPrivateAuthEntry(before);
+        handle = await open(authPath, constants.O_RDONLY | noFollow());
+        const opened = await handle.stat();
+        assertPrivateAuthEntry(opened);
+        if (!sameIdentity(identity(before), identity(opened)))
+            throw new Error("changed");
+        buffer = await handle.readFile();
+        const after = await handle.stat();
+        assertPrivateAuthEntry(after);
+        if (!sameIdentity(identity(opened), identity(after)) || !hasRefreshablePortableCredential(engine, buffer))
+            throw new Error("changed");
+        return portableCredentialSecretValues(engine, buffer);
+    }
+    catch {
+        throw unavailable(agentId, engine, "subscription authentication is not ready");
+    }
+    finally {
+        buffer?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+}
+function assertPrivateAuthEntry(entry) {
+    if (!entry.isFile() || entry.isSymbolicLink() || Number(entry.uid) !== process.getuid?.()
+        || Number(entry.nlink) !== 1 || (Number(entry.mode) & 0o777) !== 0o600
+        || Number(entry.size) < 1 || Number(entry.size) > MAX_AUTH_BYTES) {
+        throw new Error("unsafe auth artifact");
+    }
+}
+export async function verifyAgySubscriptionEnrollment(agentId, executablePath, runtimeHomePath, busAddress) {
+    if (busAddress === undefined)
+        throw unavailable(agentId, "agy", "Daimon subscription realm is unavailable");
+    await new Promise((resolve, reject) => {
+        const child = spawn(executablePath, ["models"], {
+            cwd: runtimeHomePath,
+            env: cliChildEnvironment([], runtimeHomePath, {
+                dbusSessionBusAddress: busAddress,
+                engine: "agy",
+                executablePath,
+                engineHomePath: runtimeHomePath
+            }),
+            stdio: ["ignore", "ignore", "ignore"]
+        });
+        const timer = setTimeout(() => child.kill("SIGKILL"), 10_000);
+        child.once("error", () => { clearTimeout(timer); reject(unavailable(agentId, "agy", "native secure-storage authentication probe failed")); });
+        child.once("close", (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                reject(unavailable(agentId, "agy", "subscription enrollment is required; run the Daimon AGY bootstrap command"));
+        });
+    });
+}
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }
+function identity(value) {
+    const numeric = value;
+    return { dev: numeric.dev, ino: numeric.ino, size: numeric.size, mtimeMs: numeric.mtimeMs, mode: numeric.mode & 0o7777 };
+}
+function sameIdentity(left, right) { return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.mode === right.mode; }
+function unavailable(agentId, engine, detail) { return new Error(`agent ${agentId} ${engine} is unavailable: ${detail}`); }

package/dist/runtime/grokAuthenticationError.d.ts

@@ -0,0 +1,8 @@
+/** Classifies a bounded streaming diagnostic without retaining provider output. */
+export declare function classifyGrokAuthenticationDiagnostic(diagnostic: string): GrokSubscriptionAuthenticationRejectedError | undefined;
+/** Fixed-message marker used to stale-fence a rotating Grok credential realm. */
+export declare class GrokSubscriptionAuthenticationRejectedError extends Error {
+    constructor(cleanupFailure?: Error);
+}
+export declare function asGrokAuthenticationRejected(error: unknown): GrokSubscriptionAuthenticationRejectedError | undefined;
+//# sourceMappingURL=grokAuthenticationError.d.ts.map

package/dist/runtime/grokAuthenticationError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokAuthenticationError.d.ts","sourceRoot":"","sources":["../../src/runtime/grokAuthenticationError.ts"],"names":[],"mappings":"AAEA,mFAAmF;AACnF,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,MAAM,GACjB,2CAA2C,GAAG,SAAS,CAIzD;AAED,iFAAiF;AACjF,qBAAa,2CAA4C,SAAQ,KAAK;gBACjD,cAAc,CAAC,EAAE,KAAK;CAO1C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,2CAA2C,GAAG,SAAS,CAIpH"}

package/dist/runtime/grokAuthenticationError.js

@@ -0,0 +1,20 @@
+const AUTH_REJECTION = /(?:Authentication rejected by server|Auth recovery exhausted|RefreshTokenRejected|Not signed in|Not logged in|NoRefresh|NoRecovery|PinnedTeamMismatch|ServerRejected)/iu;
+/** Classifies a bounded streaming diagnostic without retaining provider output. */
+export function classifyGrokAuthenticationDiagnostic(diagnostic) {
+    return AUTH_REJECTION.test(diagnostic)
+        ? new GrokSubscriptionAuthenticationRejectedError()
+        : undefined;
+}
+/** Fixed-message marker used to stale-fence a rotating Grok credential realm. */
+export class GrokSubscriptionAuthenticationRejectedError extends Error {
+    constructor(cleanupFailure) {
+        super("Grok subscription authentication was rejected; operator re-enrollment is required", cleanupFailure === undefined ? undefined : { cause: cleanupFailure });
+        this.name = "GrokSubscriptionAuthenticationRejectedError";
+    }
+}
+export function asGrokAuthenticationRejected(error) {
+    if (error instanceof GrokSubscriptionAuthenticationRejectedError)
+        return error;
+    const message = error instanceof Error ? error.message : String(error);
+    return classifyGrokAuthenticationDiagnostic(message);
+}

package/dist/runtime/grokBrokerCredentialAuthority.d.ts

@@ -0,0 +1,23 @@
+export declare class DurableGrokBrokerCredentialAuthority {
+    private readonly command;
+    private readonly home;
+    private readonly authFile;
+    private readonly flight;
+    private readonly fence;
+    private stale;
+    private initialized;
+    private staleWrite;
+    private lastDigest;
+    private generation;
+    private ancestorDigests;
+    constructor(command: string, home: string, authFile?: string);
+    initialize(): Promise<void>;
+    accessToken(forceRefresh: boolean): Promise<string>;
+    refreshAfterRejection(rejectedTokenDigest: string): Promise<string>;
+    private refresh;
+    markRejected(rejectedTokenDigest?: string): Promise<void>;
+    isStale(): boolean;
+    private markStale;
+    private write;
+}
+//# sourceMappingURL=grokBrokerCredentialAuthority.d.ts.map

package/dist/runtime/grokBrokerCredentialAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerCredentialAuthority.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerCredentialAuthority.ts"],"names":[],"mappings":"AAUA,qBAAa,oCAAoC;IAGnC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAFtG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAAC,OAAO,CAAC,KAAK,CAAS;IAAA,OAAO,CAAC,WAAW,CAAO;IAAA,OAAO,CAAC,UAAU,CAAyB;IAAA,OAAO,CAAC,UAAU,CAAkB;IAAA,OAAO,CAAC,UAAU,CAAG;IAClR,OAAO,CAAC,eAAe,CAAyB;gBACnB,OAAO,EAAE,MAAM,EAAmB,IAAI,EAAE,MAAM,EAAmB,QAAQ,SAA+B;IAC/H,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC3B,WAAW,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,qBAAqB,CAAC,mBAAmB,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC;IACvE,OAAO,CAAC,OAAO;IAYT,YAAY,CAAC,mBAAmB,CAAC,EAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,OAAO,IAAG,OAAO;IACjB,OAAO,CAAC,SAAS;YACH,KAAK;CAKpB"}