@platless/axom-cli 0.5.9 → 0.6.36

package/dist/workstation/desktopControl/transport.js

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import { DesktopProtocolError, parseDesktopJson } from './protocol.js';
+const sessionId = z.string().regex(/^[0-9a-f]{32}$/);
+const generation = z.number().int().min(1).max(Number.MAX_SAFE_INTEGER);
+const secret = z.string().regex(/^[A-Za-z0-9_-]{43}$/).refine(s => Buffer.from(s, 'base64url').toString('base64url') === s);
+const role = z.enum(['viewer_control', 'viewer_media', 'device_control', 'device_media']);
+const quic = z.strictObject({ port: z.number().int().min(1).max(65535), certificate: z.string().min(64).max(2048).refine(s => Buffer.from(s, 'base64').toString('base64') === s) });
+const schema = z.discriminatedUnion('type', [
+    z.strictObject({ type: z.literal('device_attach'), sessionId, grant: secret }),
+    z.strictObject({ type: z.literal('viewer_attach'), sessionId, nonce: secret }),
+    z.strictObject({ type: z.literal('attached'), sessionId, role, controlGeneration: generation, overviewToken: secret.optional(), audioToken: secret.optional() }),
+    z.strictObject({ type: z.literal('media_grant'), sessionId, controlGeneration: generation, grant: secret, quic: quic.optional() }),
+    z.strictObject({ type: z.literal('media_nonce'), sessionId, controlGeneration: generation, nonce: secret, quic: quic.optional() }),
+]);
+export function decodeDesktopTransport(source) {
+    try {
+        return schema.parse(parseDesktopJson(source, 4096));
+    }
+    catch {
+        throw new DesktopProtocolError('Invalid desktop transport exchange');
+    }
+}
+export function encodeDesktopTransport(message) {
+    const text = JSON.stringify(message);
+    decodeDesktopTransport(text);
+    return text;
+}

package/dist/workstation/desktopControl/wallpaper.js

@@ -0,0 +1,78 @@
+import { createHash } from 'node:crypto';
+import { wallpaperAssetSchema } from './lobby.js';
+export function decodeWallpaper(text) {
+    if (Buffer.byteLength(text) > 100_000)
+        throw new Error('wallpaper_unavailable');
+    const result = JSON.parse(text);
+    const asset = wallpaperAssetSchema.parse(result.asset);
+    if (typeof result.jpeg !== 'string' || result.jpeg.length > 87384)
+        throw new Error('wallpaper_unavailable');
+    const jpeg = Buffer.from(result.jpeg, 'base64');
+    if (jpeg.length < 4 || jpeg.length > 65536 || jpeg.toString('base64') !== result.jpeg || jpeg[0] !== 255 || jpeg[1] !== 216)
+        throw new Error('wallpaper_unavailable');
+    const version = createHash('sha256').update(JSON.stringify(asset)).update(jpeg).digest('hex');
+    return { asset: { ...asset, version }, jpeg };
+}
+export class XfceWallpaperReader {
+    execute;
+    constructor(execute) {
+        this.execute = execute;
+    }
+    async discover() {
+        const workspaceValue = await this.execute('xprop', ['-root', '_NET_CURRENT_DESKTOP']);
+        let workspace = /_NET_CURRENT_DESKTOP\(CARDINAL\)\s*=\s*(\d+)/.exec(workspaceValue)?.[1];
+        if (workspace == null || Number(workspace) > 1024)
+            throw new Error('wallpaper_unavailable');
+        const listed = await this.execute('xfconf-query', ['-c', 'xfce4-desktop', '-l']);
+        const read = (property) => this.execute('xfconf-query', ['-c', 'xfce4-desktop', '-p', property]);
+        if (listed.split(/\r?\n/).some(line => line.trim() === '/backdrop/single-workspace-mode') &&
+            (await read('/backdrop/single-workspace-mode')).trim() === 'true') {
+            workspace = (await read('/backdrop/single-workspace-number')).trim();
+            if (!/^\d{1,4}$/.test(workspace) || Number(workspace) > 1024)
+                throw new Error('wallpaper_unavailable');
+        }
+        const available = listed.split(/\r?\n/).map(line => line.trim());
+        const properties = available
+            .filter(line => new RegExp(`^/backdrop/screen0/monitor[^/]+/workspace${workspace}/last-image$`).test(line));
+        let selected = properties[0];
+        let defaultImage = false;
+        if (properties.length === 0) {
+            const version = await this.execute('xfdesktop', ['--version']);
+            const monitors = await this.execute('xrandr', ['--listactivemonitors']);
+            if (!/xfdesktop version 4\.20(?:\.\d+)?\b/.test(version) || !/^Monitors:\s*1\s*$/m.test(monitors))
+                throw new Error('wallpaper_unavailable');
+            const output = /^\s*0:\s+\S+\s+\S+\s+(\S+)\s*$/m.exec(monitors)?.[1];
+            if (!output || !/^[A-Za-z0-9_.:-]+$/.test(output))
+                throw new Error('wallpaper_unavailable');
+            selected = `/backdrop/screen0/monitor${output}/workspace${workspace}/last-image`;
+            defaultImage = true;
+        }
+        if (properties.length > 1)
+            throw new Error('wallpaper_unavailable');
+        const file = defaultImage ? '/usr/share/backgrounds/xfce/xfce-x.svg' : (await read(selected)).trim();
+        if (!file.startsWith('/') || file.length > 4096 || /[\r\n\0]/.test(file))
+            throw new Error('wallpaper_unavailable');
+        const prefix = selected.slice(0, -'last-image'.length);
+        const style = available.includes(`${prefix}image-style`) ? (await read(`${prefix}image-style`)).trim() : '5';
+        const placement = { '1': 'center', '2': 'tile', '3': 'stretch', '4': 'fit', '5': 'cover' }[style];
+        if (!placement)
+            throw new Error('wallpaper_unavailable');
+        let background = '#000000';
+        let fidelity = 'exact';
+        if (placement !== 'cover' && placement !== 'stretch') {
+            try {
+                if ((await read(`${prefix}color-style`)).trim() !== '0')
+                    throw new Error('unsupported_gradient');
+                const values = (await read(`${prefix}rgba1`)).split(/\r?\n/).map(line => line.trim())
+                    .filter(line => /^\d+(?:\.\d+)?$/.test(line)).map(Number);
+                if (values.length !== 4 || values.some(value => value < 0 || value > 1) || values[3] !== 1)
+                    throw new Error('unknown_fill');
+                background = '#' + values.slice(0, 3).map(value => Math.round(value * 255).toString(16).padStart(2, '0')).join('');
+            }
+            catch {
+                fidelity = 'approximate';
+            }
+        }
+        return { file, placement, background, fidelity };
+    }
+}

package/dist/workstation/files/credentials.js

@@ -0,0 +1,142 @@
+import { realpathSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { FileError } from './errors.js';
+/*
+ * Credential storage the platform agent file tools (`file_*_request`, the request-root scope) never read, list or
+ * change. This is a security boundary, not a policy an approval can lift: an agent that lacks a capability must not go
+ * looking for another client's identity, a token or a key to work around it.
+ *
+ * The check runs on canonical paths (the request root after realpath, components below it already refused when they
+ * are links), and again inside the `pinned()` section on what the kernel resolves: the pinned directory's realpath and
+ * each existing leaf's realpath, which return the names stored on disk. A relative path, a symlinked root, a directory
+ * swapped for a link after validation, or a leaf spelled so that a case-insensitive file system resolves it to a store
+ * (`.git-credentialſ`, `.ßh`) cannot bypass it. Names are compared folded: NFC, then full case folding (`ſ`→`s`,
+ * `ß`→`ss`, `K`→`k`), so a missing leaf created under such a spelling is refused too.
+ *
+ * The stores are named below the process's home, below any other home-like directory (`/Users/<name>`, `/home/<name>`,
+ * `/root`, `/var/root`: a daemon whose HOME is not the workspace owner's), and below the configured client
+ * directories. The lists equal `contracts/credential-stores/credential-stores.json` (a test checks it), which the
+ * server's early refusal (axom-core `ProtectedCredentialPaths`) matches too.
+ *
+ * Only the user-facing Files surfaces (configured roots, read-only previews, the owner's file manager) are not fenced
+ * here: they act for the user at the keyboard, not for an agent.
+ */
+export const PROTECTED_CREDENTIAL_MESSAGE = 'This path is protected credential storage. Agents may not read, list or change it by any means. Tell the user what is needed instead of looking for another way.';
+/** Below a home directory; each entry covers itself and everything below it; a trailing `*` matches a name prefix. */
+export const HOME_ENTRIES = [
+    // Axomwork's own identities: the desktop/app clients, the CLI's auth stores and config.
+    '.axom/clients', '.axom/auth', '.axom/config.json', '.axom/device-id',
+    // SSH, GPG, password managers and desktop keyrings.
+    '.ssh', '.gnupg', '.password-store', '.local/share/keyrings', '.config/op',
+    // Agent CLIs' credentials and session data (their instructions and settings stay readable).
+    '.claude.json', '.claude/.credentials.json', '.claude/projects', '.claude/sessions', '.claude/shell-snapshots',
+    '.claude/history.jsonl', '.claude/backups', '.claude/session-env', '.claude/file-history', '.claude/ide',
+    '.codex/auth.json', '.codex/sessions', '.codex/history.jsonl',
+    '.acpx',
+    '.gemini/oauth_creds.json', '.gemini/jetski-standalone-oauth-token', '.gemini/antigravity*',
+    '.commandcode/auth.json', '.commandcode/projects', '.commandcode/history.jsonl', '.commandcode/file-history',
+    '.qoder/.auth', '.kimi', '.zcode',
+    // Developer, database and cloud credentials.
+    '.config/gh/hosts.yml', '.git-credentials', '.netrc', '.npmrc', '.pypirc', '.docker/config.json',
+    '.pgpass', '.my.cnf', '.vault-token', '.cargo/credentials', '.cargo/credentials.toml', '.gem/credentials',
+    '.m2/settings-security.xml', '.terraform.d/credentials.tfrc.json', '.gradle/gradle.properties',
+    '.aws', '.azure', '.kube', '.config/gcloud',
+    // macOS keychains and the Axomwork credential broker's state.
+    'Library/Keychains', 'Library/Caches/com.platless.axom-credentials',
+];
+/**
+ * The workstation client directory holds the binding to the server (keys, identity, provider tokens, keeper sockets,
+ * the agent browser's profiles). Its logs, caches and update state are operational and stay readable.
+ */
+export const WORKSTATION_ENTRIES = [
+    'client.key', 'server.pub', 'config.yml', 'binding-history.json', 'operation.json', 'desktop-provider.json',
+    'desktop-preferences.json', 'control', 'keepers', 'agents', 'files-host', 'browser-profiles',
+];
+export const ABSOLUTE_ENTRIES = ['/Library/Keychains'];
+/** Home-like directories besides the process's own; `*` is one path component. */
+export const HOME_ROOTS = ['/Users/*', '/home/*', '/root', '/var/root', '/private/var/root'];
+/** `/tmp/com.platless.axom-credentials.<uid>.sock` (credentialBroker.ts) and anything else the broker names so. */
+export const BROKER_SOCKET_PREFIX = 'com.platless.axom-credentials.';
+export const TEMP_DIRECTORIES = ['/tmp', '/private/tmp'];
+/** NFC, then full case folding the way a case-insensitive file system compares (`ſ`→`s`, `ß`→`ss`, `K`→`k`). */
+export function foldName(value) { return value.normalize('NFC').toUpperCase().toLowerCase(); }
+function segments(absolute) { return foldName(path.resolve(absolute)).split(path.sep).filter(Boolean); }
+function canonical(target) {
+    try {
+        return realpathSync(target);
+    }
+    catch {
+        return path.resolve(target);
+    }
+}
+const patterns = (entries) => entries.map(entry => foldName(entry).split('/').filter(Boolean));
+const HOME_PATTERNS = patterns(HOME_ENTRIES);
+const WORKSTATION_PATTERNS = patterns(WORKSTATION_ENTRIES);
+const ABSOLUTE_PATTERNS = patterns(ABSOLUTE_ENTRIES);
+const HOME_ROOT_PATTERNS = patterns(HOME_ROOTS);
+const WORKSTATION_BELOW_HOME = ['.axom', 'workstation'];
+/** [target] starts with [pattern]; `*` alone is any one component, a trailing `*` a name prefix. */
+function startsWith(target, pattern) {
+    if (target.length < pattern.length)
+        return false;
+    return pattern.every((part, index) => part === '*' || (part.endsWith('*') ? target[index].startsWith(part.slice(0, -1)) : target[index] === part));
+}
+function coveredBelow(target, base, entries) {
+    if (!startsWith(target, base))
+        return false;
+    const rest = target.slice(base.length);
+    return entries.some(entry => startsWith(rest, entry));
+}
+let cached;
+/** Both spellings of [value]: as given (a relative one resolved as the client resolves it) and canonical. */
+function spellings(value) {
+    if (!value)
+        return [];
+    const unique = new Map();
+    for (const spelling of [path.resolve(value), canonical(value)])
+        unique.set(spelling, segments(spelling));
+    return [...unique.values()];
+}
+function bases(home) {
+    const key = JSON.stringify([home, process.env.AXOM_WORKSTATION_CONFIG_DIR ?? null, process.env.AXOM_CONFIG_DIR ?? null]);
+    if (cached?.key !== key) {
+        cached = {
+            key,
+            bases: {
+                homes: spellings(home),
+                workstations: spellings(process.env.AXOM_WORKSTATION_CONFIG_DIR),
+                // AXOM_CONFIG_DIR stands in for `~/.axom`: its config.json and device-id are the CLI's.
+                cliConfigs: spellings(process.env.AXOM_CONFIG_DIR),
+            },
+        };
+    }
+    return cached.bases;
+}
+const CLI_CONFIG_PATTERNS = patterns(['config.json', 'device-id']);
+const TEMP_PATTERNS = patterns(TEMP_DIRECTORIES);
+const BROKER_PREFIX = foldName(BROKER_SOCKET_PREFIX);
+/** True when [target] (absolute) is, or lies below, protected credential storage. */
+export function isCredentialPath(target, home = os.homedir()) {
+    const folded = segments(target);
+    if (ABSOLUTE_PATTERNS.some(entry => startsWith(folded, entry)))
+        return true;
+    if (TEMP_PATTERNS.some(dir => folded.length > dir.length && startsWith(folded, dir) && folded[dir.length].startsWith(BROKER_PREFIX)))
+        return true;
+    const { homes, workstations, cliConfigs } = bases(home);
+    // Any home-like directory the target is below, besides the process's own (a daemon running as another user).
+    const homeLike = HOME_ROOT_PATTERNS.filter(root => startsWith(folded, root)).map(root => folded.slice(0, root.length));
+    for (const base of [...homes, ...homeLike]) {
+        if (coveredBelow(folded, base, HOME_PATTERNS))
+            return true;
+        if (coveredBelow(folded, [...base, ...WORKSTATION_BELOW_HOME], WORKSTATION_PATTERNS))
+            return true;
+    }
+    if (workstations.some(base => coveredBelow(folded, base, WORKSTATION_PATTERNS)))
+        return true;
+    return cliConfigs.some(base => coveredBelow(folded, base, CLI_CONFIG_PATTERNS));
+}
+export function assertNotCredentialPath(target) {
+    if (isCredentialPath(target))
+        throw new FileError('permission_denied', PROTECTED_CREDENTIAL_MESSAGE);
+}

package/dist/workstation/files/text.js

@@ -1,8 +1,9 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { link, lstat, mkdir, open, readdir, rename, stat, unlink } from 'node:fs/promises';
+import { link, lstat, mkdir, open, readdir, realpath, rename, stat, unlink } from 'node:fs/promises';
 import { basename, dirname, join } from 'node:path';
 import { canonicalRoot, FileError, pinned, resolvePinnedDir, resolvePinnedDirCreate, resolvePinnedLeaf, resolveRelativeDir, resolveRelativeDirCreate, resolveRelativeFile, throwIfAborted, toFileError, withinRoot, } from './fence.js';
+import { assertNotCredentialPath } from './credentials.js';
 import { assertScopeAllows } from './scope.js';
 /** Text file semantics of the platform agent tools (`file_*_request`): request-root scope only. */
 export const MAX_READ_BYTES = 8 * 1024 * 1024;
@@ -306,14 +307,37 @@ function requireRequestRoot(scope, operation) {
  * keeps the file worker's contract: a request cancelled once it is under way reports `outcome_unknown` for mutations
  * and `workstation_offline` for reads.
  */
-async function anchored(operation, root, anchor, signal, hooks, run) {
+async function anchored(operation, root, anchor, leaves, signal, hooks, run) {
+    const insideRoot = withinRoot(root);
     try {
         await hooks?.afterValidation?.();
         return await pinned(anchor, async () => {
             await hooks?.afterPinned?.();
             throwIfAborted(signal);
+            // What each existing leaf resolves to, by the name stored on disk: a spelling a case-insensitive file system
+            // maps onto a store (`.git-credentialſ`) is judged by the store it opens, not by how it was written.
+            for (const leaf of leaves) {
+                let stored;
+                try {
+                    stored = await realpath(leaf);
+                }
+                catch {
+                    continue;
+                }
+                assertNotCredentialPath(stored);
+            }
             return run();
-        }, { verify: withinRoot(root), signal });
+        }, {
+            // The directory the kernel now holds, and what the operation touches below it, are checked again: a directory
+            // swapped for a link after validation must not reach credential storage (credentials.ts).
+            verify: (pinnedReal, parent) => {
+                insideRoot(pinnedReal, parent);
+                assertNotCredentialPath(pinnedReal);
+                for (const leaf of leaves)
+                    assertNotCredentialPath(join(pinnedReal, leaf));
+            },
+            signal,
+        });
     }
     catch (error) {
         if (signal?.aborted)
@@ -325,32 +349,42 @@ export async function readText(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'read');
     const root = await canonicalRoot(scope.root);
     const target = await resolveRelativeFile(root, request.path, false);
+    assertNotCredentialPath(target);
     throwIfAborted(signal);
-    // As the file worker did, the result names the leaf it read.
-    return anchored('read', root, dirname(target), signal, hooks, () => readTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf));
+    // The pinned read sees only the leaf; the result names the workspace-relative path it was asked for.
+    const data = await anchored('read', root, dirname(target), [basename(target)], signal, hooks, () => readTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf));
+    return { ...data, path: request.path };
 }
 export async function writeText(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'write');
     const root = await canonicalRoot(scope.root);
     const target = await resolveRelativeFile(root, request.path, request.mode === 'create');
-    return serialTarget(target, () => throwIfAbortedThen(signal, () => anchored('write', root, dirname(target), signal, hooks, () => writeTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf))));
+    assertNotCredentialPath(target);
+    const data = await serialTarget(target, () => throwIfAbortedThen(signal, () => anchored('write', root, dirname(target), [basename(target)], signal, hooks, () => writeTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf))));
+    return { ...data, path: request.path };
 }
 export async function listDir(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'list');
     const root = await canonicalRoot(scope.root);
     const target = await resolveRelativeDir(root, request.path);
+    assertNotCredentialPath(target);
     throwIfAborted(signal);
     // Listing the root pins the root itself; '' is the zero-component leaf.
     const anchor = target === root ? root : dirname(target);
     const leaf = target === root ? '' : basename(target);
-    const data = await anchored('list', root, anchor, signal, hooks, () => listTextDir({ ...request, root: '.', path: leaf }, signal, resolvePinnedDir));
+    const data = await anchored('list', root, anchor, leaf === '' ? [] : [leaf], signal, hooks, () => listTextDir({ ...request, root: '.', path: leaf }, signal, resolvePinnedDir));
     return { ...data, path: request.path };
 }
 export async function makeDir(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'mkdir');
     const root = await canonicalRoot(scope.root);
     const plan = await resolveRelativeDirCreate(root, request.path, request.parents);
+    // Every directory this would create, not only the last one.
+    const created = plan.missing.map((_, index) => plan.missing.slice(0, index + 1).join('/'));
+    assertNotCredentialPath(plan.anchor);
+    for (const leaf of created)
+        assertNotCredentialPath(join(plan.anchor, leaf));
     throwIfAborted(signal);
-    const data = await anchored('mkdir', root, plan.anchor, signal, hooks, () => createTextDir({ ...request, root: '.', path: plan.missing.join('/') }, signal, resolvePinnedDirCreate));
+    const data = await anchored('mkdir', root, plan.anchor, created, signal, hooks, () => createTextDir({ ...request, root: '.', path: plan.missing.join('/') }, signal, resolvePinnedDirCreate));
     return { ...data, path: request.path };
 }

package/dist/workstation/keepers/kit/bundle.js

@@ -97,23 +97,27 @@ export async function gcBundles(options) {
     const keep = new Set(options.keep ?? []);
     const removed = [];
     for (const kind of KEEPER_KINDS) {
-        const root = path.join(path.resolve(options.configDir), 'keepers', kind);
-        const referenced = new Set(keep);
-        for (const gen of await fs.readdir(path.join(root, 'run')).catch(() => [])) {
-            const manifest = await readPidManifest(path.join(root, 'run', gen, 'keeper.pid.json')).catch(() => null);
-            if (manifest && await manifestProcessLive(manifest))
-                referenced.add(manifest.buildVersion);
-        }
-        const bundles = path.join(root, 'bundles');
-        for (const name of await fs.readdir(bundles).catch(() => [])) {
-            if (referenced.has(name))
-                continue;
-            const dir = path.join(bundles, name);
-            const stat = await fs.lstat(dir).catch(() => null);
-            if (!stat || (minAge > 0 && now - Math.max(stat.mtimeMs, stat.ctimeMs) < minAge))
-                continue;
-            await fs.rm(dir, { recursive: true, force: true });
-            removed.push(dir);
+        const kindRoot = path.join(path.resolve(options.configDir), 'keepers', kind);
+        const entries = await fs.readdir(kindRoot, { withFileTypes: true }).catch(() => []);
+        const roots = [kindRoot, ...entries.filter(entry => entry.isDirectory() && /^[0-9a-f]{32}$/.test(entry.name)).map(entry => path.join(kindRoot, entry.name))];
+        for (const root of roots) {
+            const referenced = new Set(keep);
+            for (const gen of await fs.readdir(path.join(root, 'run')).catch(() => [])) {
+                const manifest = await readPidManifest(path.join(root, 'run', gen, 'keeper.pid.json')).catch(() => null);
+                if (manifest && await manifestProcessLive(manifest))
+                    referenced.add(manifest.buildVersion);
+            }
+            const bundles = path.join(root, 'bundles');
+            for (const name of await fs.readdir(bundles).catch(() => [])) {
+                if (referenced.has(name))
+                    continue;
+                const dir = path.join(bundles, name);
+                const stat = await fs.lstat(dir).catch(() => null);
+                if (!stat || (minAge > 0 && now - Math.max(stat.mtimeMs, stat.ctimeMs) < minAge))
+                    continue;
+                await fs.rm(dir, { recursive: true, force: true });
+                removed.push(dir);
+            }
         }
     }
     return removed;

package/dist/workstation/keepers/kit/launcher.js

@@ -1,6 +1,7 @@
 // Daemon-side: starts, probes and stops keepers. Exempt from the keeper-side import guard.
 import { spawn } from 'node:child_process';
 import { promises as fs } from 'node:fs';
+import { constants, openSync, fstatSync, readFileSync, closeSync, lstatSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { keeperOneShot, readKeeperToken } from './client.js';
@@ -49,17 +50,55 @@ export class KeeperLauncher {
     get distDir() { return this.options.distDir ?? defaultDistDir(); }
     probe(paths, timeoutMs) { return this.options.probe ? this.options.probe(paths) : pingKeeper(paths, timeoutMs); }
     /** Paths of generation `gen` of `kind` (no build needed). */
-    pathsFor(kind, gen) { return keeperPaths(this.options, kind, gen); }
+    pathsFor(kind, gen) {
+        const scoped = keeperPaths(this.options, kind, gen);
+        try {
+            lstatSync(scoped.pidFile);
+            return scoped;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const legacy = keeperPaths(this.options, kind, gen, { legacyLayout: true });
+        let descriptor;
+        try {
+            descriptor = openSync(legacy.pidFile, constants.O_RDONLY | constants.O_NOFOLLOW);
+            const stat = fstatSync(descriptor);
+            if (!stat.isFile() || stat.size > 4096 || process.getuid && stat.uid !== process.getuid())
+                throw new Error('Unsafe keeper PID manifest');
+            const manifest = JSON.parse(readFileSync(descriptor, 'utf8'));
+            if (manifest.identity === scoped.identity && manifest.kind === kind && manifest.gen === gen)
+                return legacy;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        finally {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+        }
+        return scoped;
+    }
     /** The generation the current build of `kind` runs as (`dist/keepers/<kind>/manifest.json`); starts nothing. */
     async currentGen(kind) {
         return keeperGen((await readKeeperManifest(path.join(this.distDir, kind))).buildVersion);
     }
     /** Generations of `kind` whose pid manifest names a live keeper of that generation (`<root>/run/<gen>`); starts nothing. */
     async liveGenerations(kind) {
-        const runRoot = path.join(this.pathsFor(kind, 'probe').root, 'run');
-        const gens = await fs.readdir(runRoot).catch(() => []);
+        const scoped = keeperPaths(this.options, kind, 'probe');
+        const legacy = keeperPaths(this.options, kind, 'probe', { legacyLayout: true });
+        const roots = [scoped.root, legacy.root];
+        const gens = new Set();
+        for (const root of roots)
+            for (const gen of await fs.readdir(path.join(root, 'run')).catch(() => [])) {
+                const manifest = await readPidManifest(path.join(root, 'run', gen, 'keeper.pid.json')).catch(() => null);
+                if (manifest?.identity === scoped.identity && manifest.kind === kind && manifest.gen === gen)
+                    gens.add(gen);
+            }
         const live = [];
-        for (const gen of gens.sort())
+        for (const gen of [...gens].sort())
             if (await liveManifest(this.pathsFor(kind, gen)).catch(() => false))
                 live.push(gen);
         return live;
@@ -76,7 +115,7 @@ export class KeeperLauncher {
     async start(kind) {
         const deadline = Date.now() + (this.options.startTimeoutMs ?? 7500);
         const manifest = await readKeeperManifest(path.join(this.distDir, kind));
-        const paths = keeperPaths(this.options, kind, keeperGen(manifest.buildVersion));
+        const paths = this.pathsFor(kind, keeperGen(manifest.buildVersion));
         await ensureKeeperDirectories(paths);
         // A keeper that already answers needs no snapshot check: it runs from the snapshot it was started with.
         const alive = await this.probe(paths);
@@ -165,9 +204,10 @@ export class KeeperLauncher {
      * socket. Sockets under configDir are left alone. Returns how many were touched; never throws.
      */
     async touchSockets(kind) {
-        const runRoot = path.join(this.pathsFor(kind, 'probe').root, 'run');
+        const root = keeperPaths(this.options, kind, 'probe').root;
+        const gens = new Set([...await fs.readdir(path.join(root, 'run')).catch(() => []), ...await this.liveGenerations(kind)]);
         let touched = 0;
-        for (const gen of await fs.readdir(runRoot).catch(() => [])) {
+        for (const gen of gens) {
             const paths = this.pathsFor(kind, gen);
             if (paths.socketFallback && await touchSocket(paths).catch(() => false))
                 touched += 1;

package/dist/workstation/keepers/kit/paths.js

@@ -16,7 +16,8 @@ export function keeperLockPort(identity, gen) {
 }
 export function keeperPaths(input, kind, gen, options = {}) {
     const identity = keeperIdentity(input, kind);
-    const root = path.join(path.resolve(input.configDir), 'keepers', kind);
+    const kindRoot = path.join(path.resolve(input.configDir), 'keepers', kind);
+    const root = options.legacyLayout ? kindRoot : path.join(kindRoot, identity);
     const runDir = path.join(root, 'run', gen);
     let socket = path.join(runDir, 'keeper.sock');
     let socketDir = runDir;

package/dist/workstation/managedInstall.js

@@ -0,0 +1,57 @@
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { LocalControlError } from './control/protocol.js';
+const schema = z.object({ schemaVersion: z.literal(1), source: z.literal('managed'), prefix: z.string(), nodePath: z.string(), npmPath: z.string(), cliPath: z.string(), entryPath: z.string(), runtimeVersion: z.string().regex(/^24\.\d+\.\d+$/), architecture: z.enum(['arm64', 'x64']) }).strict();
+function plannedRealPath(value) {
+    try {
+        return realpathSync(value);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT' || path.dirname(value) === value)
+            throw error;
+        return path.join(plannedRealPath(path.dirname(value)), path.basename(value));
+    }
+}
+/** This synchronous variant is shared by the existing synchronous service-context constructors. */
+export function loadManagedCliInstallSync(packageRoot) {
+    let root;
+    try {
+        root = realpathSync(packageRoot);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    const prefix = path.resolve(root, '../../../..');
+    if (root !== path.join(prefix, 'lib/node_modules/@platless/axom-cli'))
+        return null;
+    const file = path.join(prefix, 'install.json');
+    let found = false;
+    try {
+        const stat = lstatSync(file);
+        found = true;
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16384 || (process.getuid && stat.uid !== process.getuid()) || (stat.mode & 0o077))
+            throw Error('Unsafe metadata');
+        const value = schema.parse(JSON.parse(readFileSync(file, 'utf8')));
+        const home = path.resolve(prefix, '../..');
+        const runtime = path.join(home, '.axom/runtime/node', `${value.runtimeVersion}-darwin-${value.architecture}`);
+        if (prefix !== path.join(home, '.axom/cli') || realpathSync(value.prefix) !== prefix || realpathSync(value.cliPath) !== path.join(root, 'dist/cli.js') || realpathSync(value.nodePath) !== path.join(runtime, 'bin/node') || realpathSync(value.npmPath) !== path.join(runtime, 'bin/npm') || plannedRealPath(value.entryPath) !== path.join(home, '.local/bin/axom'))
+            throw Error('Metadata does not describe this installation');
+        return value;
+    }
+    catch (error) {
+        if (!found && error.code === 'ENOENT')
+            return null;
+        throw new LocalControlError('UNSUPPORTED_INSTALLATION', 'The managed CLI installation needs repair');
+    }
+}
+export async function loadManagedCliInstall(packageRoot) { return loadManagedCliInstallSync(packageRoot); }
+export function npmExecutionContext(install, inherited) {
+    if (!install)
+        return { ...inherited };
+    const result = { ...inherited, NPM_CONFIG_PREFIX: install.prefix, PATH: `${path.dirname(install.nodePath)}:${inherited.PATH ?? '/usr/bin:/bin'}` };
+    delete result.npm_config_prefix;
+    return result;
+}

package/dist/workstation/protocol/agent.js

@@ -1,5 +1,5 @@
 import { accountLimitsSchema } from './accountLimits.js';
-import { isRuntimeDiagnostics } from '../qoderAdapter/profile.js';
+import { isRuntimeDiagnostics } from './runtimeDiagnostics.js';
 import { decodeChannelFrame, hasOptional, hasRequired, isBoolean, isBridgeInfoArray, isNullableAuthMethodInfoArray, isNullableString, isNumber, isObject, isString, isStringArray, isStringRecord, } from './common.js';
 /** Current version and feature floors for the independently negotiated agent protocol. */
 export const AGENT_WIRE_VERSION = 27;
@@ -14,9 +14,7 @@ export const AGENT_WIRE_SWITCH_IDLE_VERSION = 26;
 export const AGENT_WIRE_NATIVE_DELETE_VERSION = 24;
 export const AGENT_WIRE_PROVIDER_TASK_VERSION = 23;
 export const AGENT_WIRE_RUNTIME_PROFILE_VERSION = 22;
-export const AGENT_WIRE_DELEGATION_RENEW_VERSION = 21;
 export const AGENT_WIRE_TURN_IDENTITY_VERSION = 20;
-export const AGENT_WIRE_DELEGATION_MCP_VERSION = 19;
 /** Scoped replay/history is enabled only when both peers preserve native origin. */
 export const AGENT_WIRE_SCOPED_ORIGIN_VERSION = 18;
 /** agent_open.requireSessionLoad: reject unsupported/failed load without session/new fallback. */
@@ -246,9 +244,6 @@ export const AGENT_FRAME_SHAPES = {
             env: isStringRecord, pathPrepend: isStringArray, agentEnv: isStringRecord, command: isNullableString,
             args: isStringArray, nativeSessionId: isNullableString,
             resumeFromSeq: isNumber, backfill: isBoolean, requireSessionLoad: isBoolean,
-            delegationMcp: (value) => isObject(value) &&
-                isString(value.url) && isStringRecord(value.headers) && isNumber(value.expiresAtEpochMs) &&
-                (value.bindingId === undefined || isString(value.bindingId)),
         },
     },
     agent_opened: {
@@ -265,9 +260,6 @@ export const AGENT_FRAME_SHAPES = {
             // `reloaded` is `true`-or-absent for the same reason as `supportsSteering`: a `false` would
             // be a second spelling of what its absence already says.
             reloaded: isVerifiedTrue,
-            delegationExpiresAtEpochMs: isNumber,
-            delegationRefreshPending: isVerifiedTrue,
-            delegationInstanceId: isString, delegationBindingId: isString, delegationRenewalRevision: isNumber,
             agentInfo: isAgentInfo, supportsImageInput: isVerifiedTrue, configOptions: isNullableSessionConfigOptionArray,
             // Same guard as `agent_verified.authMethods`, and the same absent-vs-`[]` reading: a
             // half-decoded method table is worse than none, because the reader would offer a login the
@@ -286,10 +278,6 @@ export const AGENT_FRAME_SHAPES = {
         },
     },
     agent_prompt: { required: { sessionRef: isString, text: isString }, optional: { images: isImageBlockArray, platformTurnId: isString } },
-    agent_delegation_renew: { required: { id: isString, sessionRef: isString, nativeSessionId: isString,
-            instanceId: isString, bindingId: isString, renewalRevision: isNumber, expiresAtEpochMs: isNumber } },
-    agent_delegation_renewed: { required: { id: isString, ok: isBoolean }, optional: { error: isString,
-            nativeSessionId: isString, instanceId: isString, bindingId: isString, renewalRevision: isNumber, expiresAtEpochMs: isNumber } },
     agent_answer: { required: { sessionRef: isString, requestId: isString, outcome: isString } },
     // `content`'s interior is never validated here -- it is ACP's free-form elicitation payload, and
     // this table is transport, not translator. `isRecord` only rejects a non-object.
@@ -773,7 +761,6 @@ export function outboundFailureReply(frame, reason) {
         case 'agent_steered': return { t: 'agent_steered', id, ok: false, error };
         case 'agent_account_read_result': return { t: 'agent_account_read_result', id, ok: false, error };
         case 'agent_config_option_set': return { t: 'agent_config_option_set', id, ok: false, error };
-        case 'agent_delegation_renewed': return { t: 'agent_delegation_renewed', id, ok: false, error };
         case 'agent_switch_idle_result': return { t: 'agent_switch_idle_result', id, ok: false, error };
         case 'agent_provider_task_stopped': return { t: 'agent_provider_task_stopped', id, state: 'unknown', error };
         case 'agent_backfill_done':
@@ -790,7 +777,7 @@ export function decodeAgentFrame(text) {
         if ((frame.state === 'completed' || frame.state === 'failed' || frame.state === 'stopped') && frame.live)
             throw new TypeError('Invalid provider task terminal live state');
         if (frame.status !== undefined &&
-            (frame.status !== frame.state || !['completed', 'failed', 'stopped'].includes(frame.status)))
+            (frame.status !== frame.state || !['completed', 'failed', 'stopped'].some(status => status === frame.status)))
             throw new TypeError('Invalid provider task terminal status');
         if (frame.summary !== undefined && frame.status === undefined)
             throw new TypeError('Provider task summary requires terminal status');