@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/acp/managedRuntime.js

@@ -0,0 +1,314 @@
+/** Bundled release certification is the trust root; writable receipts never authorize a runtime. */
+import { spawn } from 'node:child_process';
+import { constants } from 'node:fs';
+import { lstat, mkdtemp, open, readFile, readdir, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import semver from 'semver';
+import { inside, assertSafeAgentId, assertSafePackageName } from './builds/model.js';
+import { nodeVersionOf } from './builds/nodeGate.js';
+import { expectedPatchedFiles, patchDigest, verifyPatchedFiles } from './managedPatches.js';
+import { managedRuntimePolicies, packagePatches, patchAssetRoot, validatePackagePatch, validatePatchPath } from './patchAssets.js';
+export const REQUIRED_RUNTIME_CHECKS = ['initialize', 'ordinary-input', 'permissions', 'images-settings', 'parallel-subagents', 'background-reconnect', 'next-append', 'next-button', 'stop', 'cached-resume', 'legacy-migration', 'explicit-load', 'replay', 'install-gates', 'platform'];
+const hashPattern = /^[a-f0-9]{64}$/;
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+function requireThat(condition, message) {
+    if (!condition)
+        throw new Error(`Managed runtime release: ${message}`);
+}
+function exactVersion(value) { return typeof value === 'string' && semver.valid(value) === value && semver.prerelease(value) === null; }
+export function managedRuntimeFor(agent, policies = managedRuntimePolicies) {
+    const found = policies.filter(policy => policy.agent === agent);
+    requireThat(found.length <= 1, 'duplicate agent policy');
+    return found[0];
+}
+export function assertRuntimeRequest(policy, name, version) {
+    assertSafeAgentId(policy.agent);
+    assertSafePackageName(policy.package);
+    validatePatchPath(policy.release);
+    requireThat(exactVersion(policy.version) && policy.ignore_scripts === true, 'invalid exact version or script policy');
+    requireThat(Array.isArray(policy.required_patches) && policy.required_patches.length > 0 && policy.required_patches.every(id => typeof id === 'string' && id.length > 0) && new Set(policy.required_patches).size === policy.required_patches.length, 'invalid required patches');
+    requireThat(name === policy.package && version === policy.version, `only certified ${policy.package}@${policy.version} may be installed`);
+}
+/**
+ * Reject aliases in every component; use nonblocking nofollow opens so a FIFO cannot hang
+ * verification. Root-owned system symlinks (`/var -> /private/var` on macOS, in front of every
+ * per-user tmpdir) are crossed, not refused: a root-owned link to a root-owned, non-group-writable
+ * directory is not plantable by the running user. Every user-owned symlink is still refused.
+ */
+async function ownedFile(filename) {
+    const full = path.resolve(filename);
+    let current = path.parse(full).root;
+    const systemSymlink = async (uid) => {
+        if (uid !== 0 || process.getuid?.() === 0)
+            return false;
+        try {
+            const target = await realpath(current);
+            const stat = await lstat(target);
+            return stat.isDirectory() && stat.uid === 0 && (stat.mode & 0o022) === 0;
+        }
+        catch {
+            return false;
+        }
+    };
+    for (const part of full.slice(current.length).split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        const info = await lstat(current);
+        requireThat(!info.isSymbolicLink() || (await systemSymlink(info.uid)), 'symlink in runtime path');
+    }
+    const file = await open(full, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    if (!(await file.stat()).isFile()) {
+        await file.close();
+        throw new Error('Managed runtime requires a regular file');
+    }
+    return file;
+}
+async function readReleaseAsset(relative, assets) {
+    validatePatchPath(relative);
+    const base = assets.assetRoot ?? patchAssetRoot;
+    const handle = await ownedFile(inside(base instanceof URL ? fileURLToPath(base) : base, relative));
+    try {
+        requireThat((await handle.stat()).size <= 8 * 1024 * 1024, 'manifest too large');
+        return JSON.parse(await handle.readFile('utf8'));
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function loadRuntimeRelease(policy, assets = {}) {
+    assertRuntimeRequest(policy, policy.package, policy.version);
+    return validateRuntimeRelease(await readReleaseAsset(policy.release, assets), policy, assets);
+}
+function validateRuntimeRelease(r, policy, assets, retained = false) {
+    assertRuntimeRequest(policy, policy.package, policy.version);
+    requireThat(r?.schema === 1 && typeof r.id === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(r.id), 'invalid schema/id');
+    requireThat(r.package === policy.package && r.version === policy.version, 'policy/package/version mismatch');
+    requireThat(typeof r.integrity === 'string' && /^sha512-[A-Za-z0-9+/]{86}==$/.test(r.integrity), 'invalid archive integrity');
+    requireThat(r.bin && typeof r.bin.name === 'string' && r.bin.name.length > 0, 'invalid bin');
+    validatePatchPath(r.bin.path);
+    requireThat(r.bin.args === undefined || (Array.isArray(r.bin.args) && r.bin.args.every(arg => typeof arg === 'string' && !arg.includes('\0'))), 'invalid static argv');
+    requireThat(r.agentInfo && typeof r.agentInfo.name === 'string' && r.agentInfo.name.length > 0 && exactVersion(r.agentInfo.version), 'invalid agent identity');
+    requireThat(r.node && typeof r.node.range === 'string' && semver.validRange(r.node.range), 'invalid Node range');
+    requireThat(Array.isArray(r.historyVersions) && r.historyVersions.includes(r.version) && r.historyVersions.every(exactVersion) && new Set(r.historyVersions).size === r.historyVersions.length, 'invalid history versions');
+    requireThat(same(r.patches, policy.required_patches), 'ordered required patches mismatch');
+    requireThat(r.files && typeof r.files === 'object' && !Array.isArray(r.files) && Object.keys(r.files).length > 0, 'missing trusted files');
+    for (const [file, hash] of Object.entries(r.files)) {
+        validatePatchPath(file);
+        requireThat(typeof hash === 'string' && hashPattern.test(hash), 'invalid trusted file digest');
+    }
+    requireThat(r.files['package.json'] && r.files[r.bin.path], 'manifest and executable must be trusted files');
+    requireThat(r.capabilities?.cachedReconnect === 'resume' && same(r.capabilities.steering, ['next']) && r.capabilities.subagents === true, 'invalid capabilities');
+    const c = r.certification;
+    requireThat(c && typeof c.suite === 'string' && c.suite.length > 0 && Array.isArray(c.checks) && Array.isArray(c.platforms), 'missing certification');
+    requireThat(c.checks.length === REQUIRED_RUNTIME_CHECKS.length && new Set(c.checks.map(v => v.name)).size === c.checks.length && REQUIRED_RUNTIME_CHECKS.every(name => c.checks.some(v => v.name === name)), 'incomplete or duplicate required checks');
+    requireThat(c.checks.every(v => ['PASS', 'NOT_PASS'].includes(v.status) && hashPattern.test(v.evidenceSha256)), 'invalid certification check status');
+    requireThat(c.platforms.every(v => typeof v.platform === 'string' && typeof v.arch === 'string' && ['PASS', 'NOT_PASS'].includes(v.status) && hashPattern.test(v.evidenceSha256)) && new Set(c.platforms.map(v => `${v.platform}/${v.arch}`)).size === c.platforms.length, 'invalid platform records');
+    requireThat(c.platforms.some(v => v.platform === process.platform && v.arch === process.arch), 'platform record missing');
+    requireThat(r.runtimeTools === undefined || Array.isArray(r.runtimeTools), 'invalid runtime tools');
+    const tools = r.runtimeTools ?? [];
+    requireThat(new Set(tools.map(v => `${v.package?.name ?? r.package}/${v.platform}/${v.arch}/${v.path}`)).size === tools.length, 'duplicate runtime tools');
+    for (const tool of tools) {
+        validatePatchPath(tool.path);
+        if (tool.package !== undefined) {
+            requireThat(tool.package && typeof tool.package.name === 'string' && typeof tool.package.version === 'string' && semver.valid(tool.package.version) === tool.package.version, 'invalid exact tool package identity');
+            assertSafePackageName(tool.package.name);
+        }
+        const primary = tool.package === undefined || tool.package.name === r.package;
+        requireThat(typeof tool.platform === 'string' && typeof tool.arch === 'string' && hashPattern.test(tool.sha256) && (!primary || r.files[tool.path] === tool.sha256) && c.platforms.some(v => v.platform === tool.platform && v.arch === tool.arch), 'tool must match a trusted digest and declared platform');
+    }
+    if (retained)
+        requireThat(typeof r.patchDigest === 'string' && hashPattern.test(r.patchDigest), 'retained release requires trusted patch digest');
+    else {
+        const digest = patchDigest(runtimeRecipes(policy, r, assets.recipes));
+        requireThat(r.patchDigest === undefined || r.patchDigest === digest, 'release patch digest disagrees with bundled recipes');
+    }
+    return r;
+}
+export function runtimeRecipes(policy, release, recipes = packagePatches) {
+    const selected = recipes.filter(recipe => recipe.package === policy.package && recipe.versions?.includes(policy.version));
+    requireThat(same(selected.map(v => v.id), policy.required_patches), 'missing or unordered exact patch recipe');
+    for (const recipe of selected) {
+        validatePackagePatch(recipe);
+        requireThat(recipe.bin === undefined || recipe.bin === release.bin.name, 'patch bin disagrees with release');
+    }
+    for (const [qualified, hash] of Object.entries(expectedPatchedFiles(selected))) {
+        requireThat(release.files[qualified.slice(policy.package.length + 1)] === hash, 'patch digest disagrees with trusted release files');
+    }
+    return selected;
+}
+/** Reverse the declared edits to derive trusted pristine hashes, without trusting package metadata. */
+function pristineFiles(release, recipes) {
+    const files = { ...release.files };
+    for (const recipe of [...recipes].reverse()) {
+        for (const asset of recipe.assets ?? [])
+            delete files[asset.target];
+        for (const edit of [...recipe.edits].reverse()) {
+            requireThat(files[edit.file] === edit.after_sha256 && hashPattern.test(edit.before_sha256), 'inconsistent patch hash chain');
+            files[edit.file] = edit.before_sha256;
+        }
+    }
+    return files;
+}
+export async function verifyRuntimeTree(options) {
+    const r = await loadRuntimeRelease(options.policy, options);
+    return verifyReleaseTree(options, r);
+}
+async function verifyReleaseTree(options, r) {
+    const pkg = inside(path.join(options.treeRoot, 'node_modules'), r.package);
+    const files = options.pristine ? pristineFiles(r, runtimeRecipes(options.policy, r, options.recipes)) : r.files;
+    await verifyPatchedFiles(pkg, files);
+    // Extra executable code or links must not survive a cache adoption, even with matching package.json.
+    const actual = [];
+    const walk = async (dir, prefix = '') => {
+        for (const entry of await readdir(dir, { withFileTypes: true })) {
+            const rel = prefix + entry.name;
+            if (entry.isDirectory())
+                await walk(path.join(dir, entry.name), rel + '/');
+            else {
+                requireThat(entry.isFile(), 'non-regular runtime asset');
+                actual.push(rel);
+            }
+        }
+    };
+    await walk(pkg);
+    requireThat(same(actual.sort(), Object.keys(files).sort()), 'unexpected or missing runtime files');
+    const metadata = JSON.parse(await readFile(path.join(pkg, 'package.json'), 'utf8'));
+    requireThat(metadata.name === r.package && metadata.version === r.version && metadata.bin?.[r.bin.name] === r.bin.path, 'package identity/bin mismatch');
+    for (const tool of r.runtimeTools ?? []) {
+        if (tool.platform !== process.platform || tool.arch !== process.arch)
+            continue;
+        const toolPackage = tool.package ?? { name: r.package, version: r.version };
+        const toolDir = inside(path.join(options.treeRoot, 'node_modules'), toolPackage.name);
+        const manifest = await ownedFile(path.join(toolDir, 'package.json'));
+        try {
+            const identity = JSON.parse(await manifest.readFile('utf8'));
+            requireThat(identity.name === toolPackage.name && identity.version === toolPackage.version, 'runtime tool package identity mismatch');
+        }
+        finally {
+            await manifest.close();
+        }
+        // External tools are authenticated by this explicit record, not by a claim about their whole package.
+        await verifyPatchedFiles(toolDir, { [tool.path]: tool.sha256 });
+        const handle = await ownedFile(inside(toolDir, tool.path));
+        try {
+            if (options.prepareTools)
+                await handle.chmod(0o755);
+            requireThat(process.platform === 'win32' || ((await handle.stat()).mode & 0o111) !== 0, `runtime tool not executable: ${tool.path}`);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    return r;
+}
+export async function verifyManagedRuntime(options) {
+    const release = await loadRuntimeRelease(options.policy, options);
+    await verifyReleaseBuild(options, release, patchDigest(runtimeRecipes(options.policy, release, options.recipes)));
+}
+/** Explicit recorded bindings/rollback only. Every historical authority is bundled and listed, never a writable receipt. */
+export async function verifyRecordedManagedRuntime(options) {
+    const active = await loadRuntimeRelease(options.policy, options);
+    if (options.build.runtimeReleaseId === active.id) {
+        await verifyReleaseBuild(options, active, patchDigest(runtimeRecipes(options.policy, active, options.recipes)));
+        return;
+    }
+    const paths = options.policy.retained_releases ?? [];
+    requireThat(Array.isArray(paths) && new Set(paths).size === paths.length && !paths.includes(options.policy.release), 'duplicate or active retained release path');
+    const ids = new Set([active.id]);
+    let match;
+    for (const relative of paths) {
+        const release = await readReleaseAsset(relative, options);
+        requireThat(release?.schema === 1 && typeof release.id === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(release.id) && !ids.has(release.id), 'invalid, duplicate or active retained release identity');
+        ids.add(release.id);
+        if (release.id === options.build.runtimeReleaseId)
+            match = { release, path: relative };
+    }
+    requireThat(match, 'recorded release is not explicitly retained');
+    const policy = { agent: options.policy.agent, package: match.release.package, version: match.release.version, release: match.path, required_patches: match.release.patches, ignore_scripts: true };
+    const release = validateRuntimeRelease(match.release, policy, options, true);
+    requireThat(release.package !== options.policy.package || semver.lte(release.version, options.policy.version), 'retained release is a future version');
+    await verifyReleaseBuild({ ...options, policy }, release, release.patchDigest);
+}
+async function verifyReleaseBuild(options, release, digest) {
+    const { policy, build } = options;
+    requireThat(release.certification.checks.length === REQUIRED_RUNTIME_CHECKS.length && release.certification.checks.every(v => v.status === 'PASS'), 'release certification is NOT_PASS');
+    requireThat(release.certification.platforms.some(v => v.platform === process.platform && v.arch === process.arch && v.status === 'PASS'), 'platform is NOT_PASS');
+    assertRuntimeRequest(policy, build.package ?? '', build.version);
+    await verifyReleaseTree({ ...options, treeRoot: inside(options.storeRoot, build.dir), pristine: false }, release);
+    requireThat(build.agentId === policy.agent && build.runtimeReleaseId === release.id, 'build release identity mismatch');
+    requireThat(build.kind === 'npm-patched' && build.patchDigest === digest && same(build.patches, release.patches), 'build patch identity mismatch');
+    requireThat(build.launch.entry === `node_modules/${release.package}/${release.bin.path}` && build.launch.runtime === 'node', 'build executable/dispatcher mismatch');
+    requireThat(same(build.launch.args, release.bin.args ?? []), 'build static argv mismatch');
+    const nodeVersion = await nodeVersionOf(options.nodePath);
+    requireThat(semver.satisfies(nodeVersion, release.node.range, { includePrerelease: false }), `Node ${nodeVersion} outside ${release.node.range}`);
+    if (options.initialize)
+        await initializeProbe(build, options.storeRoot, options.nodePath, release);
+}
+/** One initialize only, no credentials or user HOME, bounded streams/time, awaited process cleanup. */
+async function initializeProbe(build, storeRoot, nodePath, release) {
+    const home = await mkdtemp(path.join(tmpdir(), 'runtime-probe-'));
+    try {
+        await new Promise((resolve, reject) => {
+            const dir = inside(storeRoot, build.dir);
+            const child = spawn(nodePath, [inside(dir, build.launch.entry), ...build.launch.args], {
+                cwd: home, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'],
+                env: { PATH: [path.dirname(nodePath), ...(build.launch.pathDirs ?? []).map(p => inside(dir, p)), process.env.PATH ?? ''].join(path.delimiter), HOME: home, USERPROFILE: home, APPDATA: home, LOCALAPPDATA: home, XDG_CONFIG_HOME: home, XDG_CACHE_HOME: home, TMPDIR: home, TEMP: home, TMP: home, ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}) },
+            });
+            let output = '';
+            let bytes = 0;
+            let stderrBytes = 0;
+            let response = false;
+            let failure;
+            const fail = (message) => { failure ??= new Error(`Managed runtime initialize: ${message}`); child.kill('SIGKILL'); };
+            const timeout = setTimeout(() => fail('timed out'), 30_000);
+            child.on('error', error => { failure ??= error; });
+            child.stdin.on('error', () => { });
+            child.stderr.on('data', (data) => { stderrBytes += data.length; if (stderrBytes > 1024 * 1024)
+                fail('stderr limit exceeded'); });
+            child.stdout.on('data', (data) => {
+                bytes += data.length;
+                if (bytes > 1024 * 1024) {
+                    fail('stdout limit exceeded');
+                    return;
+                }
+                output += data.toString('utf8');
+                let end;
+                while ((end = output.indexOf('\n')) >= 0) {
+                    const line = output.slice(0, end);
+                    output = output.slice(end + 1);
+                    try {
+                        requireThat(!response, 'extra initialize response');
+                        const msg = JSON.parse(line);
+                        const result = msg.result;
+                        requireThat(msg.jsonrpc === '2.0' && msg.id === 'axom-runtime-initialize' && !Object.hasOwn(msg, 'error') && !Object.hasOwn(msg, 'method') && result?.protocolVersion === 1, 'invalid correlated initialize result');
+                        requireThat(result.agentInfo?.name === release.agentInfo.name && result.agentInfo?.version === release.agentInfo.version, 'initialize agent identity mismatch');
+                        requireThat(result._meta?.axom?.releaseId === release.id && result._meta?.axom?.cachedReconnect === 'resume', 'initialize release/resume mismatch');
+                        requireThat(result.agentCapabilities?.loadSession === true && result.agentCapabilities?.sessionCapabilities?.resume && typeof result.agentCapabilities.sessionCapabilities.resume === 'object' && !Array.isArray(result.agentCapabilities.sessionCapabilities.resume), 'missing resume capability');
+                        requireThat(result._meta?.steering?.supported === true && same(result._meta.steering.timings, ['next']), 'missing next capability');
+                        response = true;
+                        child.stdin.end();
+                        // Await graceful EOF cleanup within the same overall deadline. Native agents may
+                        // flush telemetry before exiting; a second, shorter deadline can kill a healthy one.
+                    }
+                    catch (error) {
+                        fail(error.message);
+                    }
+                }
+            });
+            child.once('close', (code) => {
+                clearTimeout(timeout);
+                if (!failure && (!response || output.trim() || code !== 0))
+                    failure = new Error('Managed runtime initialize: incomplete response or startup failure');
+                if (failure)
+                    reject(failure);
+                else
+                    resolve();
+            });
+            child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id: 'axom-runtime-initialize', method: 'initialize', params: { protocolVersion: 1, clientInfo: { name: 'axom-runtime-check', version: '1.0.0' }, clientCapabilities: { fs: { readTextFile: true, writeTextFile: true }, terminal: true } } }) + '\n');
+        });
+    }
+    finally {
+        await rm(home, { recursive: true, force: true });
+    }
+}

package/dist/workstation/acp/outbox.js

@@ -22,7 +22,7 @@
  * ## Residual (documented, not fixed)
  *
  * While the producing window is full — a server parked on an approval with ≥ 256 root frames held, a connection that is down, an
- * applier that never acknowledges — the record loop folds nothing: a steer or config RPC waits for the processor's reply and can
+ * applier that never acknowledges — the record loop folds nothing: an already-admitted steer or config RPC waits for the processor's reply and can
  * time out on the server; an `agent_interrupt` note is folded (and the `session/cancel` written) only once the server unparks.
  */
 /** Unacknowledged events per session (spec §5.6, `W_EVT`). `ACK_EVERY_EVENTS(32) < W_EVT ≤ HOLD_OFF_CAPACITY(512)`. */
@@ -278,16 +278,22 @@ export class SessionOutbox {
     }
     /**
      * A new connection: everything recorded so far — sent on an earlier connection or produced while none was bound — is held until
-     * the server reopens the ref and says how far it got ({@link SENT_EARLIER}); what is recorded from now on is sent at once. (The
-     * journal's semantics: frames produced while unbound were replayed by the reopen, never sent on their own.)
+     * the server reopens the ref and says how far it got ({@link SENT_EARLIER}). Newly recorded frames wait behind those older
+     * entries so a higher seq cannot advance the server's watermark past retained output.
      */
     connectionChanged() {
         for (const item of this.items)
             item.sentOn = SENT_EARLIER;
     }
-    /** The first entry never sent (the sender's next candidate), in seq order. */
+    /** The first entry never sent, without overtaking an older entry held for reopen. */
     nextUnsent() {
-        return this.items.find((item) => item.sentOn === null);
+        for (const item of this.items) {
+            if (item.sentOn === SENT_EARLIER)
+                return undefined;
+            if (item.sentOn === null)
+                return item;
+        }
+        return undefined;
     }
     /** Resolves when this life's unacknowledged backlog is below the window (immediately once {@link stopWaiting} ran). */
     room() {
@@ -295,6 +301,7 @@ export class SessionOutbox {
             return undefined;
         return new Promise((resolve) => { this.roomWaiters.add(resolve); });
     }
+    /** Whether another raw record can be folded now, without registering a waiter. */
     hasRoom() {
         if (this.stopped)
             return true;

package/dist/workstation/acp/patchAssets.js

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import semver from 'semver';
+import { assertSafePackageName } from './builds/model.js';
 // Production reads only assets shipped in this CLI. The .ts path is for source-based tests.
 export const patchAssetRoot = new URL(import.meta.url.endsWith('.ts') ? '../../../../axom-patch/cli/' : '../../axom-patch/cli/', import.meta.url);
 const runtime = JSON.parse(readFileSync(new URL('runtime.json', patchAssetRoot), 'utf8'));
@@ -26,11 +27,27 @@ export function validateOverride(entry) {
         throw new Error(`Axom patch ${entry.id}: pinned ${entry.distribution.version} must not sort above ${until}`);
     }
 }
+/** Portable relative paths only: no platform-specific interpretation or normalization. */
+export function validatePatchPath(value) {
+    if (typeof value !== 'string' || !value || /[\\:\0]/.test(value) || value.split('/').some(part => !part || part === '.' || part === '..')) {
+        throw new Error('Axom patch path escapes its root or is not a portable relative path');
+    }
+}
 export function validatePackagePatch(recipe) {
     validateCondition(recipe.id, recipe.versions, recipe.until_version, 'versions', 'until_version');
     if (recipe.versions === undefined && recipe.until_version === undefined) {
         throw new Error(`Axom patch ${recipe.id}: needs versions or until_version`);
     }
+    for (const edit of recipe.edits)
+        validatePatchPath(edit.file);
+    if (recipe.assets !== undefined && !Array.isArray(recipe.assets))
+        throw new Error('Axom patch assets must be an array');
+    for (const asset of recipe.assets ?? []) {
+        validatePatchPath(asset.source);
+        validatePatchPath(asset.target);
+        if (!/^[a-f0-9]{64}$/.test(asset.sha256))
+            throw new Error('Axom patch asset sha256 must be a lowercase SHA-256 digest');
+    }
 }
 function inRange(version, when, until) {
     if (when)
@@ -78,3 +95,26 @@ export function nativeExtensionFor(agent, version) {
 export function nativeAccountLimitsVersionFor(agent, version) {
     return runtime.native_extensions?.find(entry => entry.agent === agent && entry.versions.includes(version))?.accountLimitsVersion ?? 2;
 }
+/** One entry per package; the only policy is skipping npm lifecycle scripts a package would run in the user's HOME. */
+export function validateInstallPolicies(policies) {
+    if (!Array.isArray(policies))
+        throw new Error('Axom install_policies must be an array');
+    const seen = new Set();
+    for (const policy of policies) {
+        if (typeof policy?.package !== 'string')
+            throw new Error('Axom install policy needs a package name');
+        assertSafePackageName(policy.package);
+        if (seen.has(policy.package))
+            throw new Error(`Axom install policy for ${policy.package} is duplicated`);
+        if (policy.ignore_scripts !== true)
+            throw new Error(`Axom install policy for ${policy.package} must set ignore_scripts: true`);
+        seen.add(policy.package);
+    }
+    return policies;
+}
+export const installPolicies = validateInstallPolicies(runtime.install_policies ?? []);
+export function installPolicyFor(name, policies = installPolicies) {
+    return policies.find((policy) => policy.package === name);
+}
+/** Optional strict release policies; activation is an explicit bundled manifest change. */
+export const managedRuntimePolicies = runtime.managed_runtimes ?? [];

package/dist/workstation/acp/permission.js

@@ -174,7 +174,8 @@ export function buildPermissionRequestedEvent(input) {
  * forced into a selection the user never made.
  */
 export async function handleRequestPermission(input, sink) {
-    if (input.options.length === 0) {
+    const optionIds = new Set(input.options.map((option) => option.optionId));
+    if (input.options.length === 0 || optionIds.size !== input.options.length) {
         return { outcome: 'rejected' };
     }
     if (input.signal?.aborted) {
@@ -192,7 +193,6 @@ export async function handleRequestPermission(input, sink) {
         console.error(`[acp] refusing to raise a permission card that fails validateWireEvent: ${rejection.reason}`);
         return { outcome: 'rejected' };
     }
-    const optionIds = new Set(input.options.map((option) => option.optionId));
     return new Promise((resolve) => {
         let settled = false;
         const settle = (decision) => {

package/dist/workstation/acp/processor/checkpoint.js

@@ -1,35 +1,17 @@
+/** Checkpoint schema answers whether state is readable; processorVersion identifies output semantics. Readable older processor versions remain restorable; replay differences across versions do not count as divergence. Version 9 moves adapter-specific compatibility folds out and removes retired optional state. */
+import { initialState, PROCESSOR_STATE_SCHEMA } from './state.js';
 /**
- * Processor checkpoints (spec 2026-10-11 §5.5): the state after record `offset`, as JSON.
- *
- * ## Two versions, two questions
- *
- * - `schema` answers "can this daemon **read** it?". An unknown schema throws
- *   {@link CheckpointUnreadableError}; the caller then replays from the session's start (outbox and
- *   watermark cover the frames already sent), or, if the log was truncated, marks the session
- *   degraded and switches it at the next open (§5.5.6). Readability of older schemas is a test-guarded
- *   promise: never change the meaning of an existing field without bumping `schema` and adding a
- *   reader for the old one.
- * - `processorVersion` answers "would **this** code have produced the same frames?". Bump it whenever
- *   `step` can emit different output for the same records. A readable checkpoint from another
- *   processor version is still restored — that is the whole point of cutting a head checkpoint at
- *   upgrade — but the caller must not count replay-vs-outbox differences as divergence then.
- *
- * Checkpoints are cut only on record boundaries (a synchronous `step` leaves no half-processed record)
- * and carry no secrets (`state.ts`).
+ * Output history: 2 — turns, cards, seq and semantic-only request checks;
+ * 3 — session updates, binding, config, steering and validated events;
+ * 4 — spawn-bound commands and history dropped counts; prompt closes history;
+ * 5 — callback snapshots, runtime revisions and adapter compatibility folds;
+ * 6 — child status precedes process results; ended calls release data;
+ * 7 — install outcomes become step events;
+ * 8 — loaded-session levels fold live; output gaps become steps;
+ * 9 — adapter compatibility folds moved out and retired optional state removed;
+ * 10 — ended replay scopes cannot leak late level snapshots into the live journal.
  */
-import { PROCESSOR_STATE_SCHEMA } from './state.js';
-/**
- * Bump when `step`'s output for the same records changes. 2: Task 17a (turns, cards, `seq`; prompt
- * methods refused by `rpc.request`). 3: Task 17b (`session/update` mapped, the open session bound
- * from its response, config/steer/levels; events validated before numbering). 4: commands carry
- * their `spawnId`; `processor.history_end` carries `droppedCount`; a prompt closes open history.
- * 5: Task 17c (the callback snapshot in the runtime diagnostics and its revision bumps; Qoder SDK
- * cards carry a `callbackContext`; the Qoder adapter boundaries; side-channel notes). 6: a process call's
- * result waits for its child's first status; ended/delivered calls keep no dead data.
- * 7: Task 20 — the `agent_install_outcome` note becomes a `step` event (it was an unknown note).
- * 8: Task 21 — a level update after a load's response is folded live, not as history; the `agent_output_gap` note is a `step`.
- */
-export const PROCESSOR_VERSION = 8;
+export const PROCESSOR_VERSION = 10;
 export const CHECKPOINT_SCHEMA = 1;
 export class CheckpointUnreadableError extends Error {
 }
@@ -66,22 +48,32 @@ export function decodeCheckpoint(blob) {
         throw new CheckpointUnreadableError('checkpoint has no processorVersion');
     if (typeof offset !== 'number' || !Number.isSafeInteger(offset) || offset < -1)
         throw new CheckpointUnreadableError('checkpoint offset is invalid');
-    if (!isRecord(state) || state.schema !== PROCESSOR_STATE_SCHEMA)
+    if (!isRecord(state) || (state.schema !== 4 && state.schema !== PROCESSOR_STATE_SCHEMA))
         throw new CheckpointUnreadableError('checkpoint state schema is unknown');
     if (state.offset !== offset)
         throw new CheckpointUnreadableError('checkpoint offset disagrees with its state');
     for (const key of ['process', 'initialize', 'outbound', 'inbound', 'diagnostics', 'permissions', 'elicitations',
         'permissionOrigins', 'permissionParents', 'unresolvedPermissionOrigins', 'open', 'mapperScopes', 'message', 'steers',
-        'asyncTasks', 'runtime', 'callbacks', 'boundaries']) {
+        'asyncTasks', 'runtime', 'callbacks']) {
         if (!isRecord(state[key]))
             throw new CheckpointUnreadableError(`checkpoint state has no ${key}`);
     }
     if (typeof state.seq !== 'number' || !Array.isArray(state.turns) || !Array.isArray(state.settledPermissions)) {
         throw new CheckpointUnreadableError('checkpoint state has no session layer (seq/turns)');
     }
-    if (!Array.isArray(state.steered) || !('configOptions' in state) || !('delegation' in state) || !('history' in state)
+    if (!Array.isArray(state.steered) || !('configOptions' in state) || !('history' in state)
         || !('activity' in state)) {
         throw new CheckpointUnreadableError('checkpoint state has no open-session layer (Task 17b)');
     }
-    return { schema: CHECKPOINT_SCHEMA, processorVersion, offset, state: clone(state) };
+    return { schema: CHECKPOINT_SCHEMA, processorVersion, offset, state: clone({ ...(state.schema === 4 ? upgradeStateFromSchema4(state) : state), ...(!Object.hasOwn(state, 'draftSubagents') ? { draftSubagents: { children: {}, overflow: false } } : {}), ...(!Object.hasOwn(state, 'closedReplayScopes') ? { closedReplayScopes: {} } : {}) }) };
+}
+/** Read only the current neutral keys; retired adapter state is deliberately not copied. */
+function upgradeStateFromSchema4(state) {
+    const keys = [...Object.keys(initialState()), 'closed', 'accountAuthBillingModes', 'accountLimits'];
+    const current = Object.fromEntries(keys.filter((key) => Object.hasOwn(state, key)).map((key) => [key, state[key]]));
+    const runtime = state.runtime;
+    return { ...current, schema: PROCESSOR_STATE_SCHEMA, runtime: {
+            revision: runtime.revision, available: runtime.available,
+            ...(Object.hasOwn(runtime, 'launch') ? { launch: runtime.launch } : {}),
+        } };
 }