@openrig/cli 0.4.3 → 0.4.6

package/daemon/dist/domain/hosts/fanout-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fanout-contract.js","sourceRoot":"","sources":["../../../src/domain/hosts/fanout-contract.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,4EAA4E;AAC5E,uEAAuE;AACvE,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AAEvE;;kCAEkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AA6BrC;;iDAEiD;AACjD,MAAM,UAAU,YAAY,CAAC,OAAmC,EAAE,eAAyB;IACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,CAAC;AAC9G,CAAC"}

package/daemon/dist/domain/hosts/hosts-registry-reader.d.ts

@@ -0,0 +1,50 @@
+export interface SshHostEntry {
+    id: string;
+    transport: "ssh";
+    target: string;
+    user?: string;
+    notes?: string;
+}
+export interface HttpHostEntry {
+    id: string;
+    transport: "http";
+    url: string;
+    bearer_env?: string;
+    bearer_file?: string;
+    notes?: string;
+}
+export type HostEntry = SshHostEntry | HttpHostEntry;
+export interface HostRegistry {
+    hosts: HostEntry[];
+}
+export type HostRegistryLoadResult = {
+    ok: true;
+    registry: HostRegistry;
+} | {
+    ok: false;
+    error: string;
+};
+export type HostResolution = {
+    ok: true;
+    host: HostEntry;
+} | {
+    ok: false;
+    error: string;
+};
+export declare const RESERVED_HOST_IDS: Set<string>;
+export declare function defaultHostRegistryPath(): string;
+/** Load + validate the operator's hosts registry (read-only). Mirrors the CLI
+ *  loader's error surfaces so operators see one vocabulary everywhere. */
+export declare function loadHostRegistry(path?: string): HostRegistryLoadResult;
+export declare function validateHostRegistry(parsed: unknown, sourcePath: string): HostRegistryLoadResult;
+/** Resolve a host id for placement. Unknown id names the requested id and
+ *  lists up to 10 known ids — the FR-4 per-entry validation message rides
+ *  this (what/why/fix, before any launch attempt). */
+export declare function resolveHost(registry: HostRegistry, id: string): HostResolution;
+/** FR-4: placement requires a transport that can carry remote-up. v0 that is
+ *  the http transport (the shipped remote single-rig leaf is POST /api/up
+ *  over runRemoteHttpOp); ssh-transport hosts are reachable for send/capture
+ *  but cannot carry remote-up — a structured per-entry error, not a launch
+ *  attempt. */
+export declare function resolvePlacementHost(registry: HostRegistry, id: string): HostResolution;
+//# sourceMappingURL=hosts-registry-reader.d.ts.map

package/daemon/dist/domain/hosts/hosts-registry-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts-registry-reader.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/hosts-registry-reader.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAKjC,eAAO,MAAM,iBAAiB,aAAuC,CAAC;AAItE,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkC,GAAG,sBAAsB,CAoBjG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,sBAAsB,CAsGhG;AAED;;sDAEsD;AACtD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,CAW9E;AAED;;;;eAIe;AACf,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,CAUvF"}

package/daemon/dist/domain/hosts/hosts-registry-reader.js

@@ -0,0 +1,184 @@
+// OPR.0.4.4.11 — the SHARED daemon-side hosts-registry read module (the P3/P4
+// interface cell, pm-lead ruling c): P3 uses it for topology placement
+// resolution + validation messages; P4's fan-out aggregation consumes the
+// SAME module. Land once, here; P4 must not re-implement it.
+//
+// READ-ONLY FOREVER (arch ruling 3): the registry is operator-managed YAML at
+// ~/.openrig/hosts.yaml; nothing in the daemon ever writes it. This module
+// MIRRORS the CLI's packages/cli/src/host-registry.ts schema + validation
+// (incl. the exactly-one-bearer rule) — the CLI copy is deliberately
+// untouched this slice (no-unification boundary); the twin is held in sync by
+// packages/daemon/test/hosts-registry-parity.test.ts, the same discipline as
+// the scope-audit CLI/daemon twins.
+import { existsSync, readFileSync } from "node:fs";
+import { parse as parseYaml } from "yaml";
+import { getDefaultOpenRigPath } from "../../openrig-compat.js";
+// OPR.0.4.6.MH1 FR-7 — reserved host ids, MIRRORED verbatim from the
+// CLI twin (packages/cli/src/host-registry.ts RESERVED_HOST_IDS; the
+// parity test pins both). See the CLI twin for the collision rationale.
+export const RESERVED_HOST_IDS = new Set(["kernel", "host", "local"]);
+const KNOWN_TRANSPORTS = new Set(["ssh", "http"]);
+export function defaultHostRegistryPath() {
+    return getDefaultOpenRigPath("hosts.yaml");
+}
+/** Load + validate the operator's hosts registry (read-only). Mirrors the CLI
+ *  loader's error surfaces so operators see one vocabulary everywhere. */
+export function loadHostRegistry(path = defaultHostRegistryPath()) {
+    if (!existsSync(path)) {
+        return {
+            ok: false,
+            error: `host registry not found at ${path}. Create it with a 'hosts:' array; transport: ssh (target + user) or http (url + bearer_env/bearer_file).`,
+        };
+    }
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch (err) {
+        return { ok: false, error: `failed to read host registry at ${path}: ${err.message}` };
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        return { ok: false, error: `failed to parse host registry YAML at ${path}: ${err.message}` };
+    }
+    return validateHostRegistry(parsed, path);
+}
+export function validateHostRegistry(parsed, sourcePath) {
+    if (parsed === null || typeof parsed !== "object") {
+        return { ok: false, error: `host registry at ${sourcePath} must be a YAML object with a 'hosts' array` };
+    }
+    const obj = parsed;
+    const hosts = obj["hosts"];
+    if (!Array.isArray(hosts)) {
+        return { ok: false, error: `host registry at ${sourcePath}: 'hosts' must be an array` };
+    }
+    const seenIds = new Set();
+    const validated = [];
+    for (let i = 0; i < hosts.length; i++) {
+        const raw = hosts[i];
+        const prefix = `host registry at ${sourcePath}: hosts[${i}]`;
+        if (raw === null || typeof raw !== "object") {
+            return { ok: false, error: `${prefix}: must be an object with id/transport/target` };
+        }
+        const entry = raw;
+        const id = entry["id"];
+        if (typeof id !== "string" || id.trim() === "") {
+            return { ok: false, error: `${prefix}.id: required non-empty string` };
+        }
+        if (seenIds.has(id)) {
+            return { ok: false, error: `${prefix}.id: duplicate host id '${id}' (each host id must be unique within the registry)` };
+        }
+        if (RESERVED_HOST_IDS.has(id)) {
+            return {
+                ok: false,
+                error: `${prefix}.id: '${id}' is a reserved host id (reserved set: ${[...RESERVED_HOST_IDS].sort().join(", ")}). 'kernel' and 'host' collide with human-seat session classification (@kernel/@host), and 'local' is the local host itself — pick a different id.`,
+            };
+        }
+        // OPR.0.4.6.MH1 rev1-r2 B1 — host ids name FILES (the pair verb's
+        // bearer_file path embeds the id) and render in tables: path-bearing
+        // ids are rejected at the registry door, same home as reserved ids.
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(id)) {
+            return {
+                ok: false,
+                error: `${prefix}.id: '${id}' is not a valid host id — allowed: letters, digits, dot, underscore, dash (starting with a letter or digit). Host ids name credential files; path characters are not allowed.`,
+            };
+        }
+        seenIds.add(id);
+        const transport = entry["transport"];
+        if (typeof transport !== "string" || !KNOWN_TRANSPORTS.has(transport)) {
+            return {
+                ok: false,
+                error: `${prefix}.transport: must be one of ${[...KNOWN_TRANSPORTS].sort().join(", ")} (got ${JSON.stringify(transport)})`,
+            };
+        }
+        const notes = entry["notes"];
+        if (notes !== undefined && typeof notes !== "string") {
+            return { ok: false, error: `${prefix}.notes: optional, but if present must be a string` };
+        }
+        if (transport === "ssh") {
+            const target = entry["target"];
+            if (typeof target !== "string" || target.trim() === "") {
+                return { ok: false, error: `${prefix}.target: required non-empty string (an ssh target)` };
+            }
+            const user = entry["user"];
+            if (user !== undefined && (typeof user !== "string" || user.trim() === "")) {
+                return { ok: false, error: `${prefix}.user: optional, but if present must be a non-empty string` };
+            }
+            validated.push({
+                id,
+                transport: "ssh",
+                target,
+                ...(user !== undefined ? { user: user } : {}),
+                ...(notes !== undefined ? { notes: notes } : {}),
+            });
+        }
+        else if (transport === "http") {
+            const url = entry["url"];
+            if (typeof url !== "string" || url.trim() === "") {
+                return { ok: false, error: `${prefix}.url: required non-empty string (the remote daemon's base URL)` };
+            }
+            const bearerEnv = entry["bearer_env"];
+            const bearerFile = entry["bearer_file"];
+            const hasEnv = bearerEnv !== undefined;
+            const hasFile = bearerFile !== undefined;
+            if (!hasEnv && !hasFile) {
+                return { ok: false, error: `${prefix}: http transport requires exactly one of bearer_env or bearer_file` };
+            }
+            if (hasEnv && hasFile) {
+                return { ok: false, error: `${prefix}: specify exactly one of bearer_env or bearer_file, not both` };
+            }
+            if (hasEnv && (typeof bearerEnv !== "string" || bearerEnv.trim() === "")) {
+                return { ok: false, error: `${prefix}.bearer_env: must be a non-empty env var name` };
+            }
+            if (hasFile && (typeof bearerFile !== "string" || bearerFile.trim() === "")) {
+                return { ok: false, error: `${prefix}.bearer_file: must be a non-empty file path` };
+            }
+            validated.push({
+                id,
+                transport: "http",
+                url: url,
+                ...(hasEnv ? { bearer_env: bearerEnv } : {}),
+                ...(hasFile ? { bearer_file: bearerFile } : {}),
+                ...(notes !== undefined ? { notes: notes } : {}),
+            });
+        }
+    }
+    return { ok: true, registry: { hosts: validated } };
+}
+/** Resolve a host id for placement. Unknown id names the requested id and
+ *  lists up to 10 known ids — the FR-4 per-entry validation message rides
+ *  this (what/why/fix, before any launch attempt). */
+export function resolveHost(registry, id) {
+    const match = registry.hosts.find((h) => h.id === id);
+    if (match)
+        return { ok: true, host: match };
+    const knownIds = registry.hosts.map((h) => h.id).slice(0, 10);
+    const idsHint = knownIds.length > 0
+        ? ` Known host ids: ${knownIds.join(", ")}${registry.hosts.length > knownIds.length ? ` (+${registry.hosts.length - knownIds.length} more)` : ""}.`
+        : " (registry is empty)";
+    return {
+        ok: false,
+        error: `unknown host id '${id}'.${idsHint}`,
+    };
+}
+/** FR-4: placement requires a transport that can carry remote-up. v0 that is
+ *  the http transport (the shipped remote single-rig leaf is POST /api/up
+ *  over runRemoteHttpOp); ssh-transport hosts are reachable for send/capture
+ *  but cannot carry remote-up — a structured per-entry error, not a launch
+ *  attempt. */
+export function resolvePlacementHost(registry, id) {
+    const res = resolveHost(registry, id);
+    if (!res.ok)
+        return res;
+    if (res.host.transport !== "http") {
+        return {
+            ok: false,
+            error: `host '${id}' uses transport '${res.host.transport}', which cannot carry remote rig-up. Placement requires an http-transport host (url + bearer_env/bearer_file) — update the registry entry or launch that rig locally.`,
+        };
+    }
+    return res;
+}
+//# sourceMappingURL=hosts-registry-reader.js.map

package/daemon/dist/domain/hosts/hosts-registry-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts-registry-reader.js","sourceRoot":"","sources":["../../../src/domain/hosts/hosts-registry-reader.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,uEAAuE;AACvE,0EAA0E;AAC1E,6DAA6D;AAC7D,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,qEAAqE;AACrE,8EAA8E;AAC9E,6EAA6E;AAC7E,oCAAoC;AAEpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAiChE,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAElD,MAAM,UAAU,uBAAuB;IACrC,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,OAAe,uBAAuB,EAAE;IACvE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,8BAA8B,IAAI,2GAA2G;SACrJ,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAe,EAAE,UAAkB;IACtE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,UAAU,6CAA6C,EAAE,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,UAAU,4BAA4B,EAAE,CAAC;IAC1F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,oBAAoB,UAAU,WAAW,CAAC,GAAG,CAAC;QAC7D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,gCAAgC,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,EAAE,qDAAqD,EAAE,CAAC;QAC3H,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,MAAM,SAAS,EAAE,0CAA0C,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oJAAoJ;aAClQ,CAAC;QACJ,CAAC;QACD,kEAAkE;QAClE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,MAAM,SAAS,EAAE,gLAAgL;aAC5M,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,MAAM,8BAA8B,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;aAC3H,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,mDAAmD,EAAE,CAAC;QAC5F,CAAC;QAED,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,oDAAoD,EAAE,CAAC;YAC7F,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,4DAA4D,EAAE,CAAC;YACrG,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE;gBACF,SAAS,EAAE,KAAK;gBAChB,MAAM;gBACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,gEAAgE,EAAE,CAAC;YACzG,CAAC;YACD,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC;YACvC,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,oEAAoE,EAAE,CAAC;YAC7G,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,8DAA8D,EAAE,CAAC;YACvG,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,+CAA+C,EAAE,CAAC;YACxF,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,6CAA6C,EAAE,CAAC;YACtF,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE;gBACF,SAAS,EAAE,MAAM;gBACjB,GAAG,EAAE,GAAa;gBAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;AACtD,CAAC;AAED;;sDAEsD;AACtD,MAAM,UAAU,WAAW,CAAC,QAAsB,EAAE,EAAU;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG;QACnJ,CAAC,CAAC,sBAAsB,CAAC;IAC3B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,oBAAoB,EAAE,KAAK,OAAO,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED;;;;eAIe;AACf,MAAM,UAAU,oBAAoB,CAAC,QAAsB,EAAE,EAAU;IACrE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,SAAS,EAAE,qBAAqB,GAAG,CAAC,IAAI,CAAC,SAAS,uKAAuK;SACjO,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/daemon/dist/domain/hosts/hosts-registry-writer.d.ts

@@ -0,0 +1,11 @@
+import { type HostEntry } from "./hosts-registry-reader.js";
+export type AddHostResult = {
+    ok: true;
+    path: string;
+    entry: HostEntry;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function addHostEntry(rawEntry: Record<string, unknown>, path?: string): AddHostResult;
+//# sourceMappingURL=hosts-registry-writer.d.ts.map

package/daemon/dist/domain/hosts/hosts-registry-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts-registry-writer.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/hosts-registry-writer.ts"],"names":[],"mappings":"AAwBA,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,GAAE,MAAkC,GAAG,aAAa,CA6BvH"}

package/daemon/dist/domain/hosts/hosts-registry-writer.js

@@ -0,0 +1,54 @@
+// OPR.0.4.6.MH1 FR-5/FR-6 — the daemon-side hosts-registry WRITE twin
+// (arch B1 ruling, pins P1–P4).
+//
+// The browser surface cannot reach the CLI's fs code, so the dashboard
+// add/pair path writes through THIS module — a deliberate VERBATIM MIRROR
+// of packages/cli/src/host-registry.ts addHostEntry, byte-parity-pinned
+// by packages/daemon/test/hosts-add-pair-routes.test.ts (same entries in
+// → identical yaml bytes out; P3) and sharing the reader twin's
+// validateHostRegistry (identical validation: exactly-one-bearer,
+// reserved ids, duplicate ids — P3). The reader module stays READ-ONLY
+// FOREVER; writes flow ONLY through the single parity-pinned write
+// contract (CLI addHostEntry + this twin), reachable daemon-side solely
+// via the narrow named add/pair routes (P1 — no generic registry-write
+// route exists).
+//
+// Concurrency (P4): atomic tmp+rename, whole-file LAST-WRITE-WINS on a
+// concurrent add — the ceiling is one operator-scale registry file; NO
+// locking machinery by design. Two simultaneous adds may drop one entry;
+// re-running the add re-converges (add-time validation = load-time
+// validation, verbatim).
+import { existsSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { stringify as stringifyYaml } from "yaml";
+import { defaultHostRegistryPath, loadHostRegistry, validateHostRegistry, } from "./hosts-registry-reader.js";
+export function addHostEntry(rawEntry, path = defaultHostRegistryPath()) {
+    // Load what exists; a MISSING file is a valid starting point for `add`
+    // (the verb exists so operators never hand-create the YAML), but a present-
+    // but-invalid file is a loud error — never silently clobber operator state.
+    let existing = [];
+    if (existsSync(path)) {
+        const loaded = loadHostRegistry(path);
+        if (!loaded.ok) {
+            return { ok: false, error: `refusing to modify an invalid registry: ${loaded.error}` };
+        }
+        existing = loaded.registry.hosts;
+    }
+    const candidate = { hosts: [...existing, rawEntry] };
+    const validated = validateHostRegistry(candidate, path);
+    if (!validated.ok) {
+        return { ok: false, error: validated.error };
+    }
+    const entry = validated.registry.hosts[validated.registry.hosts.length - 1];
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        const tmp = join(dirname(path), `.hosts.yaml.tmp-${process.pid}`);
+        writeFileSync(tmp, stringifyYaml({ hosts: validated.registry.hosts }), { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        return { ok: false, error: `failed to write host registry at ${path}: ${err.message}` };
+    }
+    return { ok: true, path, entry };
+}
+//# sourceMappingURL=hosts-registry-writer.js.map

package/daemon/dist/domain/hosts/hosts-registry-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts-registry-writer.js","sourceRoot":"","sources":["../../../src/domain/hosts/hosts-registry-writer.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,gEAAgE;AAChE,kEAAkE;AAClE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,uEAAuE;AACvE,iBAAiB;AACjB,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,mEAAmE;AACnE,yBAAyB;AAEzB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,4BAA4B,CAAC;AAMpC,MAAM,UAAU,YAAY,CAAC,QAAiC,EAAE,OAAe,uBAAuB,EAAE;IACtG,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,QAAQ,GAAgB,EAAE,CAAC;IAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACzF,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;IACnC,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAE7E,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAClE,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC"}

package/daemon/dist/domain/hosts/read-through.d.ts

@@ -0,0 +1,28 @@
+import type { Context, Next } from "hono";
+export declare const READ_THROUGH_TIMEOUT_MS = 5000;
+export declare const READ_THROUGH_ALLOWLIST: readonly ["/api/rigs/summary", "/api/rigs/:rigId/graph", "/api/rigs/:rigId/nodes", "/api/rigs/:rigId/nodes/:logicalId", "/api/ps", "/api/slices", "/api/slices/:name", "/api/slices/:name/doc/*", "/api/missions/:missionId", "/api/specs/library", "/api/specs/library/:id/review"];
+export declare function isReadThroughPath(path: string): boolean;
+/** The param-intercept middleware (arch E2 ruling). Mounted on /api/* ahead
+ *  of the route table; consumes the `?host=` envelope for remote reads and
+ *  passes everything else through untouched. */
+export declare function hostReadThrough(): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
+    error: string;
+    boundary: string;
+    hostId: string;
+    method: string;
+    path: string;
+    message: string;
+}, 405, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+    boundary: string;
+    hostId: string;
+    path: string;
+    message: string;
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
+    detail: string;
+    remoteStatus?: number | undefined;
+    error: string;
+    hostId: string;
+    failureClass: string;
+}, 502, "json">) | (Response & import("hono").TypedResponse<string, never, "body">)>;
+//# sourceMappingURL=read-through.d.ts.map

package/daemon/dist/domain/hosts/read-through.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-through.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/read-through.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ1C,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAmB7C,eAAO,MAAM,sBAAsB,sRAiBzB,CAAC;AAEX,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASvD;AAKD;;gDAEgD;AAChD,wBAAgB,eAAe,KACf,GAAG,OAAO,EAAE,MAAM,IAAI;;;;;;;;;;;;;;;;;;;qFAyErC"}

package/daemon/dist/domain/hosts/read-through.js

@@ -0,0 +1,139 @@
+// OPR.0.4.6.MH2 FR-2 + FR-7 — the general single-host READ-THROUGH.
+//
+// The read twin of the shipped forward-then-strip write pattern
+// (routes/mission-control.ts remote-forward leg): the browser stays
+// same-origin against the LOCAL daemon; a `?host=<id>` query param is the
+// out-of-band host envelope (MH-1 BR-1 rail — host never rides in a path or
+// session identity). The daemon edge consumes the envelope: resolve the
+// registry, forward the SAME path (envelope stripped) to the origin daemon
+// over the shared bearer transport, and return the origin's response
+// VERBATIM — status + content-type + body untouched (arch P3). Origin
+// shapes stay the law: no AggregatedPayload wrapping on single-host reads.
+//
+// READ-ONLY IS ENFORCED HERE, AT THE EDGE (FR-7, arch R2): a non-GET
+// request carrying a remote host envelope, or a GET outside the named
+// allowlist below, is REFUSED with a structured error naming the MH-3
+// boundary and is NEVER forwarded. The UI hiding mutation affordances is
+// necessary but not the enforcement.
+//
+// local / absent host param short-circuits to the existing handler before
+// any of this logic runs — the local path is unchanged by construction
+// (FR-2 zero-regression negative).
+import { LOCAL_HOST_ID } from "./fanout-contract.js";
+import { loadHostRegistry, resolveHost } from "./hosts-registry-reader.js";
+import { remoteRawRequest } from "./remote-daemon-http.js";
+// The 5s single-host READ deadline class (matches the shipped aggregate
+// read class in attention-aggregator.ts; deadline is a REQUIRED arg on the
+// transport by arch ruling — named here, passed explicitly at the call).
+export const READ_THROUGH_TIMEOUT_MS = 5_000;
+// THE NAMED CLOSED ALLOWLIST (arch P1). One exported constant; additions
+// are deliberate cross-review extensions, never drive-by edits — flag arch.
+// Grammar: `:seg` matches exactly one non-empty path segment; a trailing
+// `/*` matches one-or-more tail segments. v1 = the MVP read screens
+// (topology / project / library / dashboard-ps) exactly.
+//
+// DELIBERATE EXCLUSIONS (recorded, not oversights): /api/queue/* (queue is
+// the MH-3 lane — MH-1's queue-negative boundary, read included for now);
+// /api/files/* (local FS discovery; the twin derives remote missions from
+// the host-keyed slice list instead); /api/slices/:name/proof-asset/*
+// (binary — the raw transport is text-only by design);
+// /api/specs/library/active-lens (a local operator preference with write
+// verbs — its literal segment cannot match `:id/review`'s shape).
+// NUANCE (pinned by test): the slices REFRESH write is excluded by the
+// METHOD tooth, not by path shape — `:name` matches the literal "refresh",
+// so a GET there forwards and the origin resolves it as a slice named
+// "refresh" (its own 404, verbatim); the POST can never cross the edge.
+export const READ_THROUGH_ALLOWLIST = [
+    "/api/rigs/summary",
+    "/api/rigs/:rigId/graph",
+    "/api/rigs/:rigId/nodes",
+    // OPR.0.4.6.MH2 rev1-r2 B2 + arch ruling (qitem-…c5402960): seat detail
+    // is the LEAF of the FR-2 hierarchy — same read class as its /nodes
+    // sibling. STRICT SEGMENT-SHAPE match only (the arch tooth): the deeper
+    // ACTION routes under this prefix (…/:logicalId/focus, …/open-cmux)
+    // must stay REFUSED — pinned by named negatives.
+    "/api/rigs/:rigId/nodes/:logicalId",
+    "/api/ps",
+    "/api/slices",
+    "/api/slices/:name",
+    "/api/slices/:name/doc/*",
+    "/api/missions/:missionId",
+    "/api/specs/library",
+    "/api/specs/library/:id/review",
+];
+export function isReadThroughPath(path) {
+    const parts = path.split("/").filter((s) => s !== "");
+    return READ_THROUGH_ALLOWLIST.some((pattern) => {
+        const pat = pattern.split("/").filter((s) => s !== "");
+        const tailWild = pat[pat.length - 1] === "*";
+        const fixed = tailWild ? pat.slice(0, -1) : pat;
+        if (tailWild ? parts.length <= fixed.length : parts.length !== fixed.length)
+            return false;
+        return fixed.every((seg, i) => (seg.startsWith(":") ? parts[i] !== "" : seg === parts[i]));
+    });
+}
+const MH3_BOUNDARY_MESSAGE = "acting on a remote host is the MH-3 routing lane; the MH-2 read-through forwards allowlisted GET reads only";
+/** The param-intercept middleware (arch E2 ruling). Mounted on /api/* ahead
+ *  of the route table; consumes the `?host=` envelope for remote reads and
+ *  passes everything else through untouched. */
+export function hostReadThrough() {
+    return async (c, next) => {
+        const hostParam = c.req.query("host");
+        if (hostParam === undefined || hostParam === "" || hostParam === LOCAL_HOST_ID) {
+            return next();
+        }
+        const hostId = hostParam;
+        const path = c.req.path;
+        if (c.req.method !== "GET") {
+            // FR-7 tooth 1: a mutating request never crosses the edge.
+            return c.json({ error: "cross_host_write_refused", boundary: "MH-3", hostId, method: c.req.method, path, message: MH3_BOUNDARY_MESSAGE }, 405);
+        }
+        if (!isReadThroughPath(path)) {
+            // FR-7 tooth 2: reads outside the named closed set never cross either.
+            return c.json({ error: "read_through_path_not_allowed", boundary: "MH-3", hostId, path, message: MH3_BOUNDARY_MESSAGE }, 403);
+        }
+        // Arch P2 leg 1: registry-validated BEFORE any dial — an unknown id is a
+        // structured error, never a blind network attempt. Same injected-loader
+        // seam as the write twin (tests swap it; production reads the registry).
+        const registryLoader = c.get("hostRegistryLoader") ?? loadHostRegistry;
+        const fetchImpl = c.get("remoteFetchImpl");
+        const fail = (detail, failureClass, remoteStatus) => c.json({ error: "remote_read_failed", hostId, failureClass, ...(remoteStatus !== undefined ? { remoteStatus } : {}), detail }, 502);
+        const reg = registryLoader();
+        if (!reg.ok)
+            return fail(reg.error, "registry");
+        const resolved = resolveHost(reg.registry, hostId);
+        if (!resolved.ok)
+            return fail(resolved.error, "unknown-host");
+        if (resolved.host.transport !== "http") {
+            return fail(`host '${hostId}' is SSH-declared; the read-through requires an http-transport registry entry (url + bearer)`, "unsupported-transport");
+        }
+        // Arch P2 leg 2: STRIP IS TOTAL — the forwarded request carries no host
+        // param in any form, so the origin never sees the envelope and a
+        // forwarded request structurally cannot re-forward. Every OTHER query
+        // param rides through untouched (e.g. the slices filter).
+        const url = new URL(c.req.url);
+        url.searchParams.delete("host");
+        const forwardPath = `${path}${url.searchParams.size > 0 ? `?${url.searchParams.toString()}` : ""}`;
+        const res = await remoteRawRequest(resolved.host, forwardPath, {
+            timeoutMs: READ_THROUGH_TIMEOUT_MS,
+            fetchImpl,
+        });
+        if (res.ok) {
+            // Arch P3: the origin ANSWERED — its status/content-type/body ARE the
+            // answer, passed through untouched (its own 404/500 included). Edge
+            // taxonomy errors below are only for the forward itself failing.
+            return c.body(res.bodyText, res.status, { "Content-Type": res.contentType });
+        }
+        switch (res.kind) {
+            case "bearer":
+                return fail(res.detail, "auth-failed");
+            case "timeout":
+                return fail(res.phase === "body"
+                    ? `remote read timed out: response headers arrived (HTTP ${res.status}) but the body never completed`
+                    : `remote read timed out after ${READ_THROUGH_TIMEOUT_MS}ms`, "unreachable", res.status);
+            case "network":
+                return fail(res.detail, "unreachable");
+        }
+    };
+}
+//# sourceMappingURL=read-through.js.map

package/daemon/dist/domain/hosts/read-through.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-through.js","sourceRoot":"","sources":["../../../src/domain/hosts/read-through.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,gEAAgE;AAChE,oEAAoE;AACpE,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,qEAAqE;AACrE,sEAAsE;AACtE,2EAA2E;AAC3E,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,qCAAqC;AACrC,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,mCAAmC;AAGnC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,yEAAyE;AACzE,4EAA4E;AAC5E,yEAAyE;AACzE,oEAAoE;AACpE,yDAAyD;AACzD,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,uDAAuD;AACvD,yEAAyE;AACzE,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,wBAAwB;IACxB,wBAAwB;IACxB,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,iDAAiD;IACjD,mCAAmC;IACnC,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,yBAAyB;IACzB,0BAA0B;IAC1B,oBAAoB;IACpB,+BAA+B;CACvB,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1F,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,oBAAoB,GACxB,6GAA6G,CAAC;AAEhH;;gDAEgD;AAChD,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAC/E,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAC1H,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,uEAAuE;YACvE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,+BAA+B,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,EACzG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,cAAc,GACjB,CAAC,CAAC,GAAG,CAAC,oBAA6B,CAA6D,IAAI,gBAAgB,CAAC;QACxH,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,iBAA0B,CAA6B,CAAC;QAChF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,YAAoB,EAAE,YAAqB,EAAE,EAAE,CAC3E,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAEtI,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,SAAS,MAAM,8FAA8F,EAAE,uBAAuB,CAAC,CAAC;QACtJ,CAAC;QAED,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,0DAA0D;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAEnG,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;YAC7D,SAAS,EAAE,uBAAuB;YAClC,SAAS;SACV,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAe,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACzC,KAAK,SAAS;gBACZ,OAAO,IAAI,CACT,GAAG,CAAC,KAAK,KAAK,MAAM;oBAClB,CAAC,CAAC,yDAAyD,GAAG,CAAC,MAAM,gCAAgC;oBACrG,CAAC,CAAC,+BAA+B,uBAAuB,IAAI,EAC9D,aAAa,EACb,GAAG,CAAC,MAAM,CACX,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/daemon/dist/domain/hosts/remote-daemon-http.d.ts

@@ -0,0 +1,56 @@
+import type { HttpHostEntry } from "./hosts-registry-reader.js";
+export interface RemoteJsonDeps {
+    /** Injected for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    env?: Record<string, string | undefined>;
+    readFile?: (path: string) => string;
+}
+export interface RemoteJsonOptions extends RemoteJsonDeps {
+    method: "GET" | "POST";
+    body?: unknown;
+    /** REQUIRED — the caller names its deadline class explicitly. */
+    timeoutMs: number;
+}
+export type RemoteJsonFailureKind = "bearer" | "timeout" | "network" | "http";
+export interface RemoteJsonFailure {
+    ok: false;
+    kind: RemoteJsonFailureKind;
+    /** For kind=timeout: whether the deadline fired before headers
+     *  ("request") or while reading the body ("body"). */
+    phase?: "request" | "body";
+    /** HTTP status when headers arrived (kind=http, or kind=timeout/phase=body). */
+    status?: number;
+    /** Bearer message / network error message / remote error text (may be ""). */
+    detail: string;
+}
+export type RemoteJsonResult = {
+    ok: true;
+    status: number;
+    payload: unknown;
+} | RemoteJsonFailure;
+export interface RemoteRawOptions extends RemoteJsonDeps {
+    /** REQUIRED — the caller names its deadline class explicitly. */
+    timeoutMs: number;
+}
+export type RemoteRawResult = {
+    ok: true;
+    status: number;
+    contentType: string;
+    bodyText: string;
+} | {
+    ok: false;
+    kind: Exclude<RemoteJsonFailureKind, "http">;
+    phase?: "request" | "body";
+    status?: number;
+    detail: string;
+};
+/** One bounded daemon→daemon JSON exchange. The single deadline covers
+ *  request + body; every outcome is structured — this function never hangs
+ *  and never throws. */
+export declare function remoteJsonRequest(host: HttpHostEntry, path: string, opts: RemoteJsonOptions): Promise<RemoteJsonResult>;
+/** One bounded daemon→daemon GET, body passed through as text for ANY origin
+ *  status (arch P3 verbatim rule). Same bearer resolution + single-deadline +
+ *  explicit body race discipline as remoteJsonRequest; never hangs, never
+ *  throws. */
+export declare function remoteRawRequest(host: HttpHostEntry, path: string, opts: RemoteRawOptions): Promise<RemoteRawResult>;
+//# sourceMappingURL=remote-daemon-http.d.ts.map

package/daemon/dist/domain/hosts/remote-daemon-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-daemon-http.d.ts","sourceRoot":"","sources":["../../../src/domain/hosts/remote-daemon-http.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE9E,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B;0DACsD;IACtD,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,iBAAiB,CAAC;AAElG,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB;AAUD,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwB7H;;wBAEwB;AACxB,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmD7H;AAED;;;cAGc;AACd,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwC1H"}