@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/desktopControl/transport.js

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import { DesktopProtocolError, parseDesktopJson } from './protocol.js';
+const sessionId = z.string().regex(/^[0-9a-f]{32}$/);
+const generation = z.number().int().min(1).max(Number.MAX_SAFE_INTEGER);
+const secret = z.string().regex(/^[A-Za-z0-9_-]{43}$/).refine(s => Buffer.from(s, 'base64url').toString('base64url') === s);
+const role = z.enum(['viewer_control', 'viewer_media', 'device_control', 'device_media']);
+const quic = z.strictObject({ port: z.number().int().min(1).max(65535), certificate: z.string().min(64).max(2048).refine(s => Buffer.from(s, 'base64').toString('base64') === s) });
+const schema = z.discriminatedUnion('type', [
+    z.strictObject({ type: z.literal('device_attach'), sessionId, grant: secret }),
+    z.strictObject({ type: z.literal('viewer_attach'), sessionId, nonce: secret }),
+    z.strictObject({ type: z.literal('attached'), sessionId, role, controlGeneration: generation, overviewToken: secret.optional(), audioToken: secret.optional() }),
+    z.strictObject({ type: z.literal('media_grant'), sessionId, controlGeneration: generation, grant: secret, quic: quic.optional() }),
+    z.strictObject({ type: z.literal('media_nonce'), sessionId, controlGeneration: generation, nonce: secret, quic: quic.optional() }),
+]);
+export function decodeDesktopTransport(source) {
+    try {
+        return schema.parse(parseDesktopJson(source, 4096));
+    }
+    catch {
+        throw new DesktopProtocolError('Invalid desktop transport exchange');
+    }
+}
+export function encodeDesktopTransport(message) {
+    const text = JSON.stringify(message);
+    decodeDesktopTransport(text);
+    return text;
+}

package/dist/workstation/desktopControl/wallpaper.js

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+import { wallpaperAssetSchema } from './lobby.js';
+export const WALLPAPER_MAX_BYTES = 2 * 1024 * 1024;
+export const WALLPAPER_MAX_JSON = 3 * 1024 * 1024;
+export function decodeWallpaper(text) {
+    if (Buffer.byteLength(text) > WALLPAPER_MAX_JSON)
+        throw new Error('wallpaper_unavailable');
+    const result = JSON.parse(text);
+    const asset = wallpaperAssetSchema.parse(result.asset);
+    if (typeof result.image !== 'string' || result.image.length > Math.ceil(WALLPAPER_MAX_BYTES / 3) * 4)
+        throw new Error('wallpaper_unavailable');
+    const bytes = Buffer.from(result.image, 'base64');
+    if (bytes.length < 20 || bytes.length > WALLPAPER_MAX_BYTES || bytes.toString('base64') !== result.image ||
+        bytes.toString('ascii', 0, 4) !== 'RIFF' || bytes.toString('ascii', 8, 12) !== 'WEBP' || bytes.readUInt32LE(4) + 8 !== bytes.length || asset.mimeType !== 'image/webp')
+        throw new Error('wallpaper_unavailable');
+    let dimensions;
+    for (let offset = 12; offset + 8 <= bytes.length;) {
+        const kind = bytes.toString('ascii', offset, offset + 4), size = bytes.readUInt32LE(offset + 4), data = offset + 8;
+        if (size > bytes.length - data || kind === 'ANIM' || kind === 'ANMF')
+            throw new Error('wallpaper_unavailable');
+        if (kind === 'VP8X' && (size !== 10 || (bytes[data] & 2)))
+            throw new Error('wallpaper_unavailable');
+        if (kind === 'VP8 ' && size >= 10 && !(bytes[data] & 1) && bytes[data + 3] === 0x9d && bytes[data + 4] === 1 && bytes[data + 5] === 0x2a)
+            dimensions = [bytes.readUInt16LE(data + 6) & 0x3fff, bytes.readUInt16LE(data + 8) & 0x3fff];
+        if (kind === 'VP8L' && size >= 5 && bytes[data] === 0x2f) {
+            const bits = bytes.readUInt32LE(data + 1);
+            dimensions = [(bits & 0x3fff) + 1, ((bits >>> 14) & 0x3fff) + 1];
+        }
+        offset = data + size + (size & 1);
+    }
+    if (!dimensions || dimensions[0] !== asset.width || dimensions[1] !== asset.height)
+        throw new Error('wallpaper_unavailable');
+    const version = createHash('sha256').update(JSON.stringify(asset)).update(bytes).digest('hex');
+    return { asset: { ...asset, version }, bytes };
+}
+export class XfceWallpaperReader {
+    execute;
+    constructor(execute) {
+        this.execute = execute;
+    }
+    async discover() {
+        const workspaceValue = await this.execute('xprop', ['-root', '_NET_CURRENT_DESKTOP']);
+        let workspace = /_NET_CURRENT_DESKTOP\(CARDINAL\)\s*=\s*(\d+)/.exec(workspaceValue)?.[1];
+        if (workspace == null || Number(workspace) > 1024)
+            throw new Error('wallpaper_unavailable');
+        const listed = await this.execute('xfconf-query', ['-c', 'xfce4-desktop', '-l']);
+        const read = (property) => this.execute('xfconf-query', ['-c', 'xfce4-desktop', '-p', property]);
+        if (listed.split(/\r?\n/).some(line => line.trim() === '/backdrop/single-workspace-mode') &&
+            (await read('/backdrop/single-workspace-mode')).trim() === 'true') {
+            workspace = (await read('/backdrop/single-workspace-number')).trim();
+            if (!/^\d{1,4}$/.test(workspace) || Number(workspace) > 1024)
+                throw new Error('wallpaper_unavailable');
+        }
+        const available = listed.split(/\r?\n/).map(line => line.trim());
+        const properties = available
+            .filter(line => new RegExp(`^/backdrop/screen0/monitor[^/]+/workspace${workspace}/last-image$`).test(line));
+        let selected = properties[0];
+        let defaultImage = false;
+        if (properties.length === 0) {
+            const version = await this.execute('xfdesktop', ['--version']);
+            const monitors = await this.execute('xrandr', ['--listactivemonitors']);
+            if (!/xfdesktop version 4\.20(?:\.\d+)?\b/.test(version) || !/^Monitors:\s*1\s*$/m.test(monitors))
+                throw new Error('wallpaper_unavailable');
+            const output = /^\s*0:\s+\S+\s+\S+\s+(\S+)\s*$/m.exec(monitors)?.[1];
+            if (!output || !/^[A-Za-z0-9_.:-]+$/.test(output))
+                throw new Error('wallpaper_unavailable');
+            selected = `/backdrop/screen0/monitor${output}/workspace${workspace}/last-image`;
+            defaultImage = true;
+        }
+        if (properties.length > 1)
+            throw new Error('wallpaper_unavailable');
+        const file = defaultImage ? '/usr/share/backgrounds/xfce/xfce-x.svg' : (await read(selected)).trim();
+        if (!file.startsWith('/') || file.length > 4096 || /[\r\n\0]/.test(file))
+            throw new Error('wallpaper_unavailable');
+        const prefix = selected.slice(0, -'last-image'.length);
+        const style = available.includes(`${prefix}image-style`) ? (await read(`${prefix}image-style`)).trim() : '5';
+        const placement = { '1': 'center', '2': 'tile', '3': 'stretch', '4': 'fit', '5': 'cover' }[style];
+        if (!placement)
+            throw new Error('wallpaper_unavailable');
+        let background = '#000000';
+        let fidelity = 'exact';
+        if (placement !== 'cover' && placement !== 'stretch') {
+            try {
+                if ((await read(`${prefix}color-style`)).trim() !== '0')
+                    throw new Error('unsupported_gradient');
+                const values = (await read(`${prefix}rgba1`)).split(/\r?\n/).map(line => line.trim())
+                    .filter(line => /^\d+(?:\.\d+)?$/.test(line)).map(Number);
+                if (values.length !== 4 || values.some(value => value < 0 || value > 1) || values[3] !== 1)
+                    throw new Error('unknown_fill');
+                background = '#' + values.slice(0, 3).map(value => Math.round(value * 255).toString(16).padStart(2, '0')).join('');
+            }
+            catch {
+                fidelity = 'approximate';
+            }
+        }
+        return { file, placement, background, fidelity };
+    }
+}

package/dist/workstation/exec/policy.js

@@ -12,6 +12,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { KeeperFrameTooLargeError, KeeperNotConnectedError, KeeperReplacementRequiredError, KeeperRequestError } from '../keepers/kit/client.js';
 import { KeeperLaunchError } from '../keepers/terminal/client.js';
+import { RegistrationOwnershipError } from '../runtime/ownership.js';
 import { EXEC_CAPABILITY, EXEC_SIGNALS, EXEC_TERMINAL_TTL_MS, ExecErrorCode } from '../keepers/terminal/protocol.js';
 import { execArgv, execCwd, execDeadline, execEnvironment } from './command.js';
 import { DurableExec, EXEC_KILL_GRACE_MS } from './durable.js';
@@ -289,6 +290,8 @@ export class ExecPolicy {
             hello = (await keeper.ensure()).hello;
         }
         catch (error) {
+            if (error instanceof RegistrationOwnershipError)
+                throw error;
             // A repeat may be running in a keeper-terminal this daemon cannot reach right now: running it here too could run it twice.
             if (how.repeat) {
                 this.log(`exec ${req.id}: repeated request while keeper-terminal is unreachable: ${messageOf(error)}`);
@@ -323,6 +326,8 @@ export class ExecPolicy {
             return { kind: 'durable', exec: DurableExec.follow(keeper, descriptor, { outlivesChannel, ...(wire ? { wire } : {}) }, this.durableOptions()) };
         }
         catch (error) {
+            if (error instanceof RegistrationOwnershipError)
+                throw error;
             // Another keeper-terminal generation owns an exec of this id (spec §3.1: two generations may coexist): it exists, so it is
             // never started again here and never run in this process.
             if (errorCode(error) === ExecErrorCode.foreign) {

package/dist/workstation/files/client.js

@@ -78,6 +78,14 @@ export class FilesHostClient {
             return 0;
         return this.lastStatus.uploads + this.lastStatus.encodes;
     }
+    /** Removal must distinguish an idle host from one that has not supplied a current activity sample. */
+    activitySnapshot() {
+        return {
+            known: this.stopped ? !this.child && !this.spawning : !!this.child && this.hostUp && !this.retiring
+                && !!this.lastStatus && Date.now() - this.lastStatusAt <= this.timings.hungPinMs,
+            transfers: this.activity() + this.sent.size + this.waiting,
+        };
+    }
     /** Process id of the current host (diagnostics and tests). */
     get pid() { return this.child?.pid; }
     get isReady() { return this.ready; }
@@ -392,7 +400,8 @@ export class FilesHostClient {
         // Past the grace, stop feeding it: new requests wait for the restarted host while the ones in flight finish.
         if (overdue)
             this.ready = false;
-        if (this.sent.size === 0 && (overdue || (this.lastStatus?.uploads ?? 0) === 0)) {
+        if (this.sent.size === 0 && (overdue || !!this.lastStatus
+            && this.lastStatus.uploads === 0 && this.lastStatus.encodes === 0 && this.lastStatus.inFlight === 0)) {
             this.restartRequestedAt = null;
             this.log('[files-host] workspaces changed; restarting');
             void this.shutdownChild(true);

package/dist/workstation/files/credentials.js

@@ -0,0 +1,142 @@
+import { realpathSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { FileError } from './errors.js';
+/*
+ * Credential storage the platform agent file tools (`file_*_request`, the request-root scope) never read, list or
+ * change. This is a security boundary, not a policy an approval can lift: an agent that lacks a capability must not go
+ * looking for another client's identity, a token or a key to work around it.
+ *
+ * The check runs on canonical paths (the request root after realpath, components below it already refused when they
+ * are links), and again inside the `pinned()` section on what the kernel resolves: the pinned directory's realpath and
+ * each existing leaf's realpath, which return the names stored on disk. A relative path, a symlinked root, a directory
+ * swapped for a link after validation, or a leaf spelled so that a case-insensitive file system resolves it to a store
+ * (`.git-credentialſ`, `.ßh`) cannot bypass it. Names are compared folded: NFC, then full case folding (`ſ`→`s`,
+ * `ß`→`ss`, `K`→`k`), so a missing leaf created under such a spelling is refused too.
+ *
+ * The stores are named below the process's home, below any other home-like directory (`/Users/<name>`, `/home/<name>`,
+ * `/root`, `/var/root`: a daemon whose HOME is not the workspace owner's), and below the configured client
+ * directories. The lists equal `contracts/credential-stores/credential-stores.json` (a test checks it), which the
+ * server's early refusal (axom-core `ProtectedCredentialPaths`) matches too.
+ *
+ * Only the user-facing Files surfaces (configured roots, read-only previews, the owner's file manager) are not fenced
+ * here: they act for the user at the keyboard, not for an agent.
+ */
+export const PROTECTED_CREDENTIAL_MESSAGE = 'This path is protected credential storage. Agents may not read, list or change it by any means. Tell the user what is needed instead of looking for another way.';
+/** Below a home directory; each entry covers itself and everything below it; a trailing `*` matches a name prefix. */
+export const HOME_ENTRIES = [
+    // Axomwork's own identities: the desktop/app clients, the CLI's auth stores and config.
+    '.axom/clients', '.axom/auth', '.axom/config.json', '.axom/device-id',
+    // SSH, GPG, password managers and desktop keyrings.
+    '.ssh', '.gnupg', '.password-store', '.local/share/keyrings', '.config/op',
+    // Agent CLIs' credentials and session data (their instructions and settings stay readable).
+    '.claude.json', '.claude/.credentials.json', '.claude/projects', '.claude/sessions', '.claude/shell-snapshots',
+    '.claude/history.jsonl', '.claude/backups', '.claude/session-env', '.claude/file-history', '.claude/ide',
+    '.codex/auth.json', '.codex/sessions', '.codex/history.jsonl',
+    '.acpx',
+    '.gemini/oauth_creds.json', '.gemini/jetski-standalone-oauth-token', '.gemini/antigravity*',
+    '.commandcode/auth.json', '.commandcode/projects', '.commandcode/history.jsonl', '.commandcode/file-history',
+    '.qoder/.auth', '.kimi', '.zcode',
+    // Developer, database and cloud credentials.
+    '.config/gh/hosts.yml', '.git-credentials', '.netrc', '.npmrc', '.pypirc', '.docker/config.json',
+    '.pgpass', '.my.cnf', '.vault-token', '.cargo/credentials', '.cargo/credentials.toml', '.gem/credentials',
+    '.m2/settings-security.xml', '.terraform.d/credentials.tfrc.json', '.gradle/gradle.properties',
+    '.aws', '.azure', '.kube', '.config/gcloud',
+    // macOS keychains and the Axomwork credential broker's state.
+    'Library/Keychains', 'Library/Caches/com.platless.axom-credentials',
+];
+/**
+ * The workstation client directory holds the binding to the server (keys, identity, provider tokens, keeper sockets,
+ * the agent browser's profiles). Its logs, caches and update state are operational and stay readable.
+ */
+export const WORKSTATION_ENTRIES = [
+    'client.key', 'server.pub', 'config.yml', 'binding-history.json', 'operation.json', 'desktop-provider.json',
+    'desktop-preferences.json', 'control', 'keepers', 'agents', 'files-host', 'browser-profiles',
+];
+export const ABSOLUTE_ENTRIES = ['/Library/Keychains'];
+/** Home-like directories besides the process's own; `*` is one path component. */
+export const HOME_ROOTS = ['/Users/*', '/home/*', '/root', '/var/root', '/private/var/root'];
+/** `/tmp/com.platless.axom-credentials.<uid>.sock` (credentialBroker.ts) and anything else the broker names so. */
+export const BROKER_SOCKET_PREFIX = 'com.platless.axom-credentials.';
+export const TEMP_DIRECTORIES = ['/tmp', '/private/tmp'];
+/** NFC, then full case folding the way a case-insensitive file system compares (`ſ`→`s`, `ß`→`ss`, `K`→`k`). */
+export function foldName(value) { return value.normalize('NFC').toUpperCase().toLowerCase(); }
+function segments(absolute) { return foldName(path.resolve(absolute)).split(path.sep).filter(Boolean); }
+function canonical(target) {
+    try {
+        return realpathSync(target);
+    }
+    catch {
+        return path.resolve(target);
+    }
+}
+const patterns = (entries) => entries.map(entry => foldName(entry).split('/').filter(Boolean));
+const HOME_PATTERNS = patterns(HOME_ENTRIES);
+const WORKSTATION_PATTERNS = patterns(WORKSTATION_ENTRIES);
+const ABSOLUTE_PATTERNS = patterns(ABSOLUTE_ENTRIES);
+const HOME_ROOT_PATTERNS = patterns(HOME_ROOTS);
+const WORKSTATION_BELOW_HOME = ['.axom', 'workstation'];
+/** [target] starts with [pattern]; `*` alone is any one component, a trailing `*` a name prefix. */
+function startsWith(target, pattern) {
+    if (target.length < pattern.length)
+        return false;
+    return pattern.every((part, index) => part === '*' || (part.endsWith('*') ? target[index].startsWith(part.slice(0, -1)) : target[index] === part));
+}
+function coveredBelow(target, base, entries) {
+    if (!startsWith(target, base))
+        return false;
+    const rest = target.slice(base.length);
+    return entries.some(entry => startsWith(rest, entry));
+}
+let cached;
+/** Both spellings of [value]: as given (a relative one resolved as the client resolves it) and canonical. */
+function spellings(value) {
+    if (!value)
+        return [];
+    const unique = new Map();
+    for (const spelling of [path.resolve(value), canonical(value)])
+        unique.set(spelling, segments(spelling));
+    return [...unique.values()];
+}
+function bases(home) {
+    const key = JSON.stringify([home, process.env.AXOM_WORKSTATION_CONFIG_DIR ?? null, process.env.AXOM_CONFIG_DIR ?? null]);
+    if (cached?.key !== key) {
+        cached = {
+            key,
+            bases: {
+                homes: spellings(home),
+                workstations: spellings(process.env.AXOM_WORKSTATION_CONFIG_DIR),
+                // AXOM_CONFIG_DIR stands in for `~/.axom`: its config.json and device-id are the CLI's.
+                cliConfigs: spellings(process.env.AXOM_CONFIG_DIR),
+            },
+        };
+    }
+    return cached.bases;
+}
+const CLI_CONFIG_PATTERNS = patterns(['config.json', 'device-id']);
+const TEMP_PATTERNS = patterns(TEMP_DIRECTORIES);
+const BROKER_PREFIX = foldName(BROKER_SOCKET_PREFIX);
+/** True when [target] (absolute) is, or lies below, protected credential storage. */
+export function isCredentialPath(target, home = os.homedir()) {
+    const folded = segments(target);
+    if (ABSOLUTE_PATTERNS.some(entry => startsWith(folded, entry)))
+        return true;
+    if (TEMP_PATTERNS.some(dir => folded.length > dir.length && startsWith(folded, dir) && folded[dir.length].startsWith(BROKER_PREFIX)))
+        return true;
+    const { homes, workstations, cliConfigs } = bases(home);
+    // Any home-like directory the target is below, besides the process's own (a daemon running as another user).
+    const homeLike = HOME_ROOT_PATTERNS.filter(root => startsWith(folded, root)).map(root => folded.slice(0, root.length));
+    for (const base of [...homes, ...homeLike]) {
+        if (coveredBelow(folded, base, HOME_PATTERNS))
+            return true;
+        if (coveredBelow(folded, [...base, ...WORKSTATION_BELOW_HOME], WORKSTATION_PATTERNS))
+            return true;
+    }
+    if (workstations.some(base => coveredBelow(folded, base, WORKSTATION_PATTERNS)))
+        return true;
+    return cliConfigs.some(base => coveredBelow(folded, base, CLI_CONFIG_PATTERNS));
+}
+export function assertNotCredentialPath(target) {
+    if (isCredentialPath(target))
+        throw new FileError('permission_denied', PROTECTED_CREDENTIAL_MESSAGE);
+}

package/dist/workstation/files/host.js

@@ -19,6 +19,7 @@ let tools;
 let initializing = false;
 let closing;
 const inFlight = new Map();
+const operations = new Set();
 function send(message) {
     if (!process.connected)
         return;
@@ -64,7 +65,7 @@ function run(request) {
     inFlight.set(request.id, controller);
     const deadline = request.deadlineAt === null ? undefined : setTimeout(() => controller.abort(), Math.max(0, request.deadlineAt - Date.now()));
     const current = tools;
-    void (async () => {
+    const operation = (async () => {
         let reply;
         try {
             // runFileFrame never throws: errors (and cancellation) come back as the result frame's `error`.
@@ -89,6 +90,8 @@ function run(request) {
         status();
         send(reply);
     })();
+    operations.add(operation);
+    void operation.finally(() => operations.delete(operation));
 }
 /** Refuses new work, lets running calls finish within a budget (a hung IO cannot hold the exit forever), then exits. */
 function shutdown(code) {
@@ -96,7 +99,11 @@ function shutdown(code) {
         for (const controller of inFlight.values())
             controller.abort();
         const budget = new Promise(resolve => { setTimeout(resolve, DISPOSE_BUDGET_MS).unref(); });
-        await Promise.race([tools?.dispose().catch(() => { }), budget]);
+        const dispose = async () => {
+            await Promise.allSettled([...operations]);
+            await tools?.dispose();
+        };
+        await Promise.race([dispose().catch(() => { }), budget]);
         process.exit(code);
     })();
     return closing;

package/dist/workstation/files/text.js

@@ -1,8 +1,9 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { link, lstat, mkdir, open, readdir, rename, stat, unlink } from 'node:fs/promises';
+import { link, lstat, mkdir, open, readdir, realpath, rename, stat, unlink } from 'node:fs/promises';
 import { basename, dirname, join } from 'node:path';
 import { canonicalRoot, FileError, pinned, resolvePinnedDir, resolvePinnedDirCreate, resolvePinnedLeaf, resolveRelativeDir, resolveRelativeDirCreate, resolveRelativeFile, throwIfAborted, toFileError, withinRoot, } from './fence.js';
+import { assertNotCredentialPath } from './credentials.js';
 import { assertScopeAllows } from './scope.js';
 /** Text file semantics of the platform agent tools (`file_*_request`): request-root scope only. */
 export const MAX_READ_BYTES = 8 * 1024 * 1024;
@@ -306,14 +307,37 @@ function requireRequestRoot(scope, operation) {
  * keeps the file worker's contract: a request cancelled once it is under way reports `outcome_unknown` for mutations
  * and `workstation_offline` for reads.
  */
-async function anchored(operation, root, anchor, signal, hooks, run) {
+async function anchored(operation, root, anchor, leaves, signal, hooks, run) {
+    const insideRoot = withinRoot(root);
     try {
         await hooks?.afterValidation?.();
         return await pinned(anchor, async () => {
             await hooks?.afterPinned?.();
             throwIfAborted(signal);
+            // What each existing leaf resolves to, by the name stored on disk: a spelling a case-insensitive file system
+            // maps onto a store (`.git-credentialſ`) is judged by the store it opens, not by how it was written.
+            for (const leaf of leaves) {
+                let stored;
+                try {
+                    stored = await realpath(leaf);
+                }
+                catch {
+                    continue;
+                }
+                assertNotCredentialPath(stored);
+            }
             return run();
-        }, { verify: withinRoot(root), signal });
+        }, {
+            // The directory the kernel now holds, and what the operation touches below it, are checked again: a directory
+            // swapped for a link after validation must not reach credential storage (credentials.ts).
+            verify: (pinnedReal, parent) => {
+                insideRoot(pinnedReal, parent);
+                assertNotCredentialPath(pinnedReal);
+                for (const leaf of leaves)
+                    assertNotCredentialPath(join(pinnedReal, leaf));
+            },
+            signal,
+        });
     }
     catch (error) {
         if (signal?.aborted)
@@ -325,32 +349,42 @@ export async function readText(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'read');
     const root = await canonicalRoot(scope.root);
     const target = await resolveRelativeFile(root, request.path, false);
+    assertNotCredentialPath(target);
     throwIfAborted(signal);
-    // As the file worker did, the result names the leaf it read.
-    return anchored('read', root, dirname(target), signal, hooks, () => readTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf));
+    // The pinned read sees only the leaf; the result names the workspace-relative path it was asked for.
+    const data = await anchored('read', root, dirname(target), [basename(target)], signal, hooks, () => readTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf));
+    return { ...data, path: request.path };
 }
 export async function writeText(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'write');
     const root = await canonicalRoot(scope.root);
     const target = await resolveRelativeFile(root, request.path, request.mode === 'create');
-    return serialTarget(target, () => throwIfAbortedThen(signal, () => anchored('write', root, dirname(target), signal, hooks, () => writeTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf))));
+    assertNotCredentialPath(target);
+    const data = await serialTarget(target, () => throwIfAbortedThen(signal, () => anchored('write', root, dirname(target), [basename(target)], signal, hooks, () => writeTextFile({ ...request, root: '.', path: basename(target) }, signal, resolvePinnedLeaf))));
+    return { ...data, path: request.path };
 }
 export async function listDir(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'list');
     const root = await canonicalRoot(scope.root);
     const target = await resolveRelativeDir(root, request.path);
+    assertNotCredentialPath(target);
     throwIfAborted(signal);
     // Listing the root pins the root itself; '' is the zero-component leaf.
     const anchor = target === root ? root : dirname(target);
     const leaf = target === root ? '' : basename(target);
-    const data = await anchored('list', root, anchor, signal, hooks, () => listTextDir({ ...request, root: '.', path: leaf }, signal, resolvePinnedDir));
+    const data = await anchored('list', root, anchor, leaf === '' ? [] : [leaf], signal, hooks, () => listTextDir({ ...request, root: '.', path: leaf }, signal, resolvePinnedDir));
     return { ...data, path: request.path };
 }
 export async function makeDir(scope, request, signal, hooks) {
     requireRequestRoot(scope, 'mkdir');
     const root = await canonicalRoot(scope.root);
     const plan = await resolveRelativeDirCreate(root, request.path, request.parents);
+    // Every directory this would create, not only the last one.
+    const created = plan.missing.map((_, index) => plan.missing.slice(0, index + 1).join('/'));
+    assertNotCredentialPath(plan.anchor);
+    for (const leaf of created)
+        assertNotCredentialPath(join(plan.anchor, leaf));
     throwIfAborted(signal);
-    const data = await anchored('mkdir', root, plan.anchor, signal, hooks, () => createTextDir({ ...request, root: '.', path: plan.missing.join('/') }, signal, resolvePinnedDirCreate));
+    const data = await anchored('mkdir', root, plan.anchor, created, signal, hooks, () => createTextDir({ ...request, root: '.', path: plan.missing.join('/') }, signal, resolvePinnedDirCreate));
     return { ...data, path: request.path };
 }

package/dist/workstation/journal.js

@@ -15,6 +15,7 @@
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { assertRegistrationOwner } from './runtime/ownership.js';
 const SUFFIX = '.jsonl';
 function parseEntry(line) {
     try {
@@ -58,7 +59,7 @@ export async function listLegacyJournalRefs(dir) {
     return refs.sort();
 }
 /** Every readable entry of `sessionRef`'s journal, in file order (unreadable lines skipped). A missing file is empty. */
-export async function readLegacyJournal(dir, sessionRef) {
+export async function readLegacyJournal(dir, sessionRef, ownership) {
     let text;
     try {
         text = await fs.readFile(fileOf(dir, sessionRef), 'utf8');
@@ -73,8 +74,10 @@ export async function readLegacyJournal(dir, sessionRef) {
         if (line.length === 0)
             continue;
         const entry = parseEntry(line);
-        if (entry)
+        if (entry) {
+            assertRegistrationOwner(JSON.parse(line), ownership, { directory: dir, kind: 'journal' });
             entries.push(entry);
+        }
     }
     return entries;
 }

package/dist/workstation/keepers/acp/client.js

@@ -1,6 +1,7 @@
 // Daemon-side: a typed `acp.*` client for keeper-acp (launch through KeeperLauncher, one long-lived KeeperClient per generation).
 // Exempt from the keeper-side import guard (it runs in the daemon), though it imports nothing but the kit and this keeper's protocol.
 import { KeeperClient } from '../kit/client.js';
+import { assertRegistrationOwner, RegistrationOwnershipError } from '../../runtime/ownership.js';
 import { protocolWindow } from '../kit/protocol.js';
 import { ACP_PROTOCOL_VERSION, acpStream, } from './protocol.js';
 /** keeper-acp could not be reached (launch, connect or hello failed): the request was never sent. */
@@ -23,7 +24,7 @@ export class AcpKeeperClient {
     }
     get daemonProtocol() { return this.options.daemonProtocol ?? protocolWindow(ACP_PROTOCOL_VERSION); }
     clientFor(paths) {
-        if (this.client && this.clientGen === paths.gen)
+        if (this.client && this.client.state !== 'closed' && this.clientGen === paths.gen)
             return this.client;
         this.client?.close();
         this.client = new KeeperClient({
@@ -48,6 +49,7 @@ export class AcpKeeperClient {
     get gen() { return this.options.gen; }
     /** The connected client of the current build, launching keeper-acp only when needed (a `gen`-bound client only connects). */
     async ensure() {
+        this.options.launcher.assertOwnership?.('acp', this.clientGen ?? this.options.gen);
         const current = this.client;
         if (current && current.state === 'ready')
             return current;
@@ -64,14 +66,43 @@ export class AcpKeeperClient {
         return client;
     }
     async call(method, params, options = {}) {
+        this.options.launcher.assertOwnership?.('acp', this.clientGen ?? this.options.gen);
         let client;
         try {
             client = await this.ensure();
         }
         catch (error) {
+            if (error instanceof RegistrationOwnershipError)
+                throw error;
             throw new AcpKeeperUnavailableError(error);
         }
-        return client.request(method, params, options);
+        const ownership = this.options.launcher.ownership;
+        const input = params;
+        if (ownership && typeof input.sessionKey === 'string') {
+            const listed = await client.request('acp.list', {});
+            const existing = listed.sessions.find(session => session.sessionKey === input.sessionKey);
+            if (existing) {
+                if (this.options.launcher.assertSessionOwnership)
+                    this.options.launcher.assertSessionOwnership(existing.label, this.clientGen);
+                else
+                    assertRegistrationOwner(existing.label, ownership);
+            }
+            else if (method !== 'acp.spawn')
+                throw new RegistrationOwnershipError('Registration session owner is unknown');
+        }
+        if (ownership && method === 'acp.spawn')
+            params = { ...input, label: { ...input.label, registrationId: ownership.registrationId } };
+        const result = await client.request(method, params, options);
+        if (ownership && method === 'acp.list') {
+            const listed = result;
+            for (const session of listed.sessions) {
+                if (this.options.launcher.assertSessionOwnership)
+                    this.options.launcher.assertSessionOwnership(session.label, this.clientGen);
+                else
+                    assertRegistrationOwner(session.label, ownership);
+            }
+        }
+        return result;
     }
     spawn(params, options = {}) { return this.call('acp.spawn', params, options); }
     list() { return this.call('acp.list', {}); }
@@ -87,13 +118,18 @@ export class AcpKeeperClient {
     release(sessionKey) { return this.call('acp.release', { sessionKey }); }
     activity() { return this.call('keeper.activity', {}); }
     async subscribe(sessionKey, stream, handler, options) {
+        this.options.launcher.assertOwnership?.('acp', this.clientGen ?? this.options.gen);
         let client;
         try {
             client = await this.ensure();
         }
         catch (error) {
+            if (error instanceof RegistrationOwnershipError)
+                throw error;
             throw new AcpKeeperUnavailableError(error);
         }
+        if (this.options.launcher.ownership)
+            await this.attach(sessionKey);
         return client.subscribe(acpStream(stream, sessionKey), handler, options);
     }
     /** Drops the connection (keeper-acp and its adapters keep running). */

package/dist/workstation/keepers/kit/buildVersion.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { opendirSync, readFileSync, lstatSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 /**
  * The keeper buildVersion: sha256 over the bundle bytes plus the sorted list of
@@ -14,22 +14,46 @@ import { join, relative, sep } from 'node:path';
  * unchanged keeper code does not change it.
  */
 const sha256 = (data) => createHash('sha256').update(data).digest('hex');
-function walkFiles(dir) {
+function walkFiles(dir, limits) {
     const out = [];
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-        const full = join(dir, entry.name);
-        if (entry.isDirectory())
-            out.push(...walkFiles(full));
-        else
-            out.push(full);
-    }
+    let entries = 0;
+    let bytes = 0;
+    const walk = (directory, depth) => {
+        if (limits && depth > limits.maxDepth)
+            throw Error('Native bundle depth limit');
+        const handle = opendirSync(directory, { bufferSize: 32 });
+        try {
+            for (;;) {
+                const entry = handle.readSync();
+                if (!entry)
+                    break;
+                if (limits && ++entries > limits.maxEntries)
+                    throw Error('Native bundle entry limit');
+                const full = join(directory, entry.name);
+                if (entry.isDirectory())
+                    walk(full, depth + 1);
+                else {
+                    if (limits?.maxBytes !== undefined) {
+                        bytes += lstatSync(full).size;
+                        if (bytes > limits.maxBytes)
+                            throw Error('Native bundle byte limit');
+                    }
+                    out.push(full);
+                }
+            }
+        }
+        finally {
+            handle.closeSync();
+        }
+    };
+    walk(dir, 0);
     return out;
 }
 /** Relative (posix) paths of the native files carried next to a bundle, sorted. */
-export function nativeFilesOf(kindDir) {
+export function nativeFilesOf(kindDir, limits) {
     let files;
     try {
-        files = walkFiles(join(kindDir, 'node_modules'));
+        files = walkFiles(join(kindDir, 'node_modules'), limits);
     }
     catch (error) {
         if (error.code === 'ENOENT')