@sigrun/sigrun 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-29
+
+### Added
+- Parked-task visibility and recovery: pi-durable reports now reach logs,
+  metrics, alerts, and job status, and administrators can list and retry
+  parked tasks through the admin API.
+- Proxy identity links with case-insensitive matching, plus typed-username
+  normalization for `user add --proxy`, `link`, and `unlink`.
+- An optional chart `networkPolicy`, `OnboardingState.proxyIdentity.subject`,
+  the ProxyUnidentified screen, and the shared `./usernames` export.
+
+### Changed
+- Upgraded the Earendil runtime to pi-durable 1.4.0 (with chord and pi-ai
+  1.4.0), including durable schedule sleeps, retry backoffs that survive
+  restarts, and the crash-loop parked-task guard.
+- Extension shutdown now runs in parallel within a fixed budget, with the
+  chart's termination grace period matched to that budget.
+- The loader quarantines extensions whose declared Earendil peer range
+  excludes the host version instead of allowing an incompatible extension
+  to fail later at runtime.
+- `settings.compaction.modelOverrides` supports per-model compaction
+  settings while preserving environment-over-file precedence.
+- Proxy-only non-loopback boots refuse unvouched account creation, including
+  login and code paths, and mint no setup code there. Login derives from the
+  full email; boot sweeps orphaned proxy links, gates own-host peers, and
+  throttles proxy diagnostics.
+
+### Fixed
+- CLI empty-string identity values now mean "unset".
+
+### Breaking
+- When `SIGRUN_API_TOKEN` is set, `SIGRUN_API_TOKEN_USER` must be a valid
+  username key (the validation error includes a derivation suggestion). The
+  user value is validated only when the token is set.
+
+### Upgrade notes
+- **One-way storage migration:** the first 0.3.0 boot migrates the SQLite
+  durable schema to pi-durable 1.4.0's format. Before opening storage, boot
+  writes a crash-consistent snapshot beside the database named
+  `<storagePath>.pre-durable-schema-v<CURRENT>-<UTC stamp>.bak`. Snapshots
+  are never deleted automatically. If a needed snapshot cannot be written,
+  boot stops before migration. `SIGRUN_SKIP_MIGRATION_SNAPSHOT=1` is the
+  emergency opt-out for an operator with an independent backup.
+- **Rollback to 0.2.x (SQLite):** stop sigrun, restore the `.bak` over the
+  database file, remove the database's `-wal` and `-shm` sidecars, then
+  deploy 0.2.x. Anything committed after the upgrade is lost.
+- **JSONL storage:** there is no snapshot because its schema does not
+  change. A 0.2.x process nevertheless never resumes a task left `sleeping`
+  by 0.3.0, so rollback can strand that task.
+
 ## [0.2.1] - 2026-10-28
 
 ### Added

package/README.md

@@ -175,6 +175,7 @@ still override it per field.
 | `SIGRUN_PORT` | positive int | `3000` | `server.port` | HTTP listen port. |
 | `SIGRUN_LISTEN_HOST` | host | `::` | — | HTTP listen host — the environment equivalent of the programmatic `serve({host})` option (the option wins when both are set). One resolved value drives the bind AND the auth defaults: a loopback bind derives the no-auth workstation posture, any other bind derives `token` auth. `GET /v1/meta` reports the effective listener (`listener.host`/`port`/`families`). |
 | `SIGRUN_STORAGE_PATH` | path | `<dataDir>/sigrun.db` | `server.storagePath` | SQLite database location. Relative values resolve against the data root (absolute values verbatim; the cwd-relative `data/sigrun.db` default is retired). |
+| `SIGRUN_SKIP_MIGRATION_SNAPSHOT` | `1` | *(unset)* | — | Skip the automatic pre-migration SQLite snapshot when set to `1`. Emergency escape hatch for an operator who already has an independent backup; without it, a needed snapshot failure stops boot before the one-way durable schema migration. |
 | `SIGRUN_WORKSPACE_PATH` | path | `<dataDir>/workspace` | `server.workspacePath` | Root of the static local workspace every conversation's tools run against. The default rides the data root (chart/compose deploys set the path explicitly); it is never persisted on first boot. |
 | `SIGRUN_DATA_DIR` | path | `$XDG_DATA_HOME/sigrun` or `~/.local/share/sigrun` | `server.dataDir` | Data root (the DB default and extension data dirs). Env/file values win verbatim. |
 | `SIGRUN_CACHE_DIR` | path | `$XDG_CACHE_HOME/sigrun` or `~/.cache/sigrun` | `server.cacheDir` | Cache root (regenerable; never ensured at boot). Env/file values win verbatim. |
@@ -183,6 +184,7 @@ still override it per field.
 | — | — | *(none)* | `gitDir` is always `<configDir>/git` | Git extension checkouts clone here (pi layout). Not env-configurable. |
 | `SIGRUN_WEBUI_BUNDLE` | path | `webui/dist` | `server.webuiBundle` | Web UI bundle directory; explicit-but-missing = boot error, default-missing = API-only. |
 | `SIGRUN_CONFIG_DIR` | path | `~/.config/sigrun` | *env-only* | The settings file's own directory. |
+| `SIGRUN_API_TOKEN_USER` | username key | `sigrun` | *env-only* | User for `SIGRUN_API_TOKEN`. Must already be a valid username key (`^[a-z0-9][a-z0-9._-]*$`, at most 128 characters); invalid values fail boot with a derivation suggestion. Validated only when `SIGRUN_API_TOKEN` is non-empty. |
 | `SIGRUN_COMPACTION_ENABLED` | `true`/`false` | `true` | `server.compaction.enabled` | Context compaction on/off. |
 | `SIGRUN_COMPACTION_RESERVE_TOKENS` | positive int | `16384` | `server.compaction.reserveTokens` | Headroom reserved for the model's reply. |
 | `SIGRUN_COMPACTION_KEEP_RECENT_TOKENS` | positive int | `20000` | `server.compaction.keepRecentTokens` | Recent context retained verbatim through a compaction. |
@@ -192,6 +194,32 @@ still override it per field.
 | `SIGRUN_BACKUP_S3_PREFIX` | string | *(unset)* | `server.backup.s3.prefix` | Key prefix within the bucket. |
 | `SIGRUN_BACKUP_S3_ENDPOINT` | URL | AWS default | `server.backup.s3.endpoint` | Custom S3 endpoint (S3-compatible stores). |
 
+Per-model overrides: `server.compaction.modelOverrides` is a map keyed by
+the exact `provider/modelId` string pi-durable composes — note that a
+chain-shaped model id doubles the prefix. Use it when a small-window model
+must sit alongside the large-window default policy (lower
+`reserveTokens`/`keepRecentTokens`/`backgroundTokens`, or `enabled: false`
+for a model that must never compact):
+
+```jsonc
+"server": {
+  "compaction": {
+    "reserveTokens": 16384,
+    "modelOverrides": {
+      // Synthetic example: provider "bifrost", model id "bifrost/small-chat".
+      "bifrost/bifrost/small-chat": { "reserveTokens": 4096, "keepRecentTokens": 6000 }
+    }
+  }
+}
+```
+
+Each entry is a partial policy (the same fields and minimums as the parent
+block); unset fields inherit the global policy. Boot-time lifetime like the
+rest of compaction, and there is no env spelling. After the boot catalog
+refresh an override key that matches no known model logs one warning
+(`compaction override "<key>" matches no known model`) — never an error,
+since catalogs move.
+
 ### settings.json schema
 
 ```jsonc
@@ -218,7 +246,10 @@ still override it per field.
       "enabled": true,
       "reserveTokens": 16384,        // positive integer
       "keepRecentTokens": 20000,     // positive integer
-      "backgroundTokens": 32768      // non-negative integer (0 = off)
+      "backgroundTokens": 32768,     // non-negative integer (0 = off)
+      "modelOverrides": {            // per-model partial policies, keyed by exact provider/modelId
+        "bifrost/bifrost/small-chat": { "reserveTokens": 4096 }
+      }
     },
     "backup": { // target: { "path": "/backups" } XOR { "s3": { "bucket": "...", "prefix": "...", "endpoint": "..." } }
       "staleAfterHours": 36            // positive number: health.backup degrades past this marker age
@@ -307,6 +338,64 @@ configurable) when the request comes from a peer inside
 proxy and nothing else: every peer in `trustedProxies` can forge any
 identity, including an admin.
 
+**Which address to list.** `trustedProxies` must list the address the
+proxy **connects from**, as the pod sees it — not the proxy's own
+Service or DNS name. The same list also gates trust in
+`X-Forwarded-Host` (the Origin check) and `X-Forwarded-Proto` (the
+Secure-cookie decision): a peer outside the list cannot steer either.
+On a dual-stack cluster the Service may be reached over either family
+(the Service can be IPv6-first while the proxy still connects over
+IPv4), so list every address the proxy actually sources from.
+
+**Cilium Gateway API / Ingress.** The connect-from address is the
+per-node **Cilium ingress IP**, allocated from that node's pod CIDR —
+enumerate them with:
+
+```sh
+kubectl get ciliumnodes -o jsonpath='{..spec.ingress}'
+```
+
+Listing those addresses exactly is the tightest posture. Trusting the
+whole pod CIDR (e.g. `10.42.0.0/16`, `fd00:42::/64`) is acceptable
+**only together with a policy admitting the `ingress` entity** — the
+chart's `networkPolicy.enabled` option installs that
+CiliumNetworkPolicy, whose default also admits `host` for kubelet
+probes. Without it, any pod in the CIDR can forge
+identity headers directly to the Service. Note that the `ingress`
+entity covers **every Cilium gateway in the cluster**, so every route
+to sigrun must pass through forward auth; a gateway route that skips
+it is an open impersonation path.
+
+**Forward-auth header hygiene.** Forward auth must return **every
+identity header sigrun reads** on every authenticated response, and
+its upstream-header mode must **override, not append** — Envoy's
+`allowed_upstream_headers`, not `allowed_upstream_headers_to_append`.
+With append semantics a client can supply the headers forward auth
+omits and sigrun will read the client's copies.
+
+**Own-host peers (C5).** A trusted **range** never vouches for
+sigrun's own addresses — loopback or any local interface address —
+without the shared secret, because every local process shares those
+source addresses. An **exactly listed** local address (a bare address,
+or a `/32` / `/128` entry) does vouch, as an explicit operator
+decision, and boot logs a warning for each such entry when no shared
+secret is configured.
+
+**Rejection diagnostics.** Each rejection logs one sanitized line
+(subject to the throttle below) naming the socket peer, the method, a
+short reason, and the route, when known — never tokens, cookies, or
+identity-header values. The throttle emits one line per reason per 60 s,
+with `(N suppressed)` on the next line for that reason. The reasons:
+
+| Reason | Meaning |
+|---|---|
+| `untrusted proxy` | The socket peer is outside `trustedProxies`. |
+| `own-host peer without shared secret` | The peer is a local address trusted only through a range, and no shared secret is configured — see C5 above. |
+| `missing or wrong shared secret (<header> header)` | The named secret header was absent or did not match `SIGRUN_PROXY_SECRET`. |
+| `missing identity header (<header>)` | The proxy vouched but sent no user header — forward auth is not returning every identity header. |
+| `unusable identity claim` | The vouched username cannot be a directory user (403 `invalid_username`). |
+| `untrusted identity source` | The user does not exist and `autoProvision` is off (403 `user_not_provisioned`). |
+
 **Stored groups and group-derived admin.** `server.auth.adminGroups`
 lists groups (Authelia's `Remote-Groups`, for example) whose members act as
 admins. Core stores groups per authenticating source: `proxy` for validated
@@ -329,6 +418,106 @@ until then. Token and session requests only read the stored record; they
 never accept groups from the request. People-scoped conversation shares may
 also name groups, matched against the same stored groups.
 
+### Usernames
+
+Every external identity — proxy header, OIDC subject, invite claim,
+CLI argument — resolves to one **directory user key**. The key is the
+stable identifier: it names the user's storage directory
+(`<dataDir>/users/<user>`), their config directories, their per-user
+extension stores, and it appears in tool registrations as
+`<slug>@<user>`, split at the **first `@`**. The key pattern is
+therefore a safety rule, not a style choice:
+
+- lowercase letters, digits, `.`, `_`, `-` only, and no `/` against
+  traversal (case-insensitive filesystems would otherwise let `Alice`
+  and `alice` collide on one directory);
+- must start with a letter or digit (no leading `.` against hidden
+  paths or `..` keys);
+- no `@` — it is the tool-registration delimiter;
+- at most 128 characters, bounding key length for storage and tool
+  names.
+
+`deriveUsername(input)` maps any input onto that pattern: Unicode NFKD
+and strip combining marks, lowercase, `@` → `_`, every other disallowed
+character → `-` (no collapsing), strip leading non-alphanumerics,
+truncate to 128. Empty result → no usable key: proxy authentication
+refuses with 403 `invalid_username`, typed forms with 400, and login
+derivation falls back to the literal key `user`. The normative vectors:
+
+| Input | Key |
+|---|---|
+| `mikemacleod` | `mikemacleod` |
+| `Mike` | `mike` |
+| `mike@example.ca` | `mike_example.ca` |
+| `mike@example.com` | `mike_example.com` |
+| `Mike.Smith@Example.COM` | `mike.smith_example.com` |
+| `mike+test@example.com` | `mike-test_example.com` |
+| `José García` | `jose-garcia` |
+| `DOMAIN\mike` | `domain-mike` |
+| `Alice Smith` | `alice-smith` |
+| `.hidden` | `hidden` |
+| `mike.` | `mike.` (valid key, unchanged) |
+| `` (empty) | `undefined` (login: `user`) |
+| `@@@` | `undefined` (login: `user`) |
+
+Derivation is idempotent and every valid key is a fixed point. On the
+proxy path, a folded subject that is itself a valid key adopts the
+existing user with that key; a derived-key collision under login
+auto-provisioning takes the next free suffix instead.
+
+**Proxy uniqueness assumption (deployment requirement).** Proxy
+identity matching is case-insensitive: the proxy's usernames are
+assumed unique case-insensitively, so `Alice` and `alice` are the same
+person. Authelia/LDAP satisfy this. On a proxy where they are distinct
+accounts, `Alice` would resolve to `alice`'s account — including admin
+rights. Verify your identity source satisfies this before enabling the
+proxy method.
+
+**Derived vs typed collisions.** When a derived key is already taken
+(proxy auto-provisioning, login auto-provisioning), the next free
+suffix is chosen automatically: `alice`, then `alice-2`, `alice-3`,
+…. Typed names — `sigrun user add`, the invite claim form, the
+onboarding claim form — **refuse** with `username_taken` instead: an
+admin choosing a name never gets silently suffixed.
+
+**Login rule.** A new login user with no username claim derives from
+the **full email** (`mike@example.com` → `mike_example.com`), never
+just the local part. Existing linked users are unchanged — links are
+matched by exact subject, not by re-deriving the key.
+
+**Recipes.** Pre-provision a proxy user (and optionally grant admin):
+
+```sh
+sigrun user add alice --proxy Alice --admin
+```
+
+Link an additional proxy identity to an existing user:
+
+```sh
+sigrun user link alice --proxy alice.smith
+```
+
+**Crash-orphan repair.** If the process crashed between writing the
+user row and writing the proxy link, the user exists but cannot
+resolve. The boot sweep logs one line per orphan:
+
+```
+identity: proxy user "alice-2" has no proxy link; repair with: sigrun user link alice-2 --proxy <username>
+```
+
+Choose the repair that matches the intended owner:
+
+- If the orphaned `-2` user should own the identity, run the printed
+  `sigrun user link <key> --proxy <username>` command.
+- If the correct account already exists, delete the duplicate as an
+  admin with `DELETE /v1/users/alice-2?transferTo=alice`, where
+  `transferTo` names that existing account and receives its transferable
+  resources.
+
+These are alternatives, not a sequence: deleting a user also removes
+its links, so linking and then deleting the same `-2` user would undo
+the repair.
+
 ### External sign-in (OIDC and OAuth 2)
 
 The web sign-in screen lists configured external providers above the token
@@ -480,6 +669,20 @@ admin) or by trusted-proxy auto-provision; admins can transfer or remove
 users (`PATCH`/`DELETE /v1/users/{user}` — deletion transfers their
 conversations).
 
+**Proxy-only onboarding.** On a proxy-only server bound beyond
+loopback, onboarding happens entirely **through the proxy**: the first
+claim and every later sign-in arrive as trusted proxy identities, no
+setup or invite codes apply (no setup code is minted, and an invite
+code cannot be redeemed without a vouch), and an unvouched
+account-creating request is refused with 403
+`proxy_identity_required`. A browser reaching sigrun without a trusted
+proxy identity sees a ProxyUnidentified screen instead of a token or
+setup-code form. As a deliberate, bounded exception,
+`/v1/auth/callback/:provider` still lets a login provider with
+`policy.autoProvision` create its own non-admin account on a proxy-only
+server, although the resulting session cannot authenticate because the
+token method is off.
+
 **Sharing.** Conversations are private to their owner by default. The
 owner can share one — household-wide or with named users and groups,
 `read` or `write` — through the web UI's ⋯ menu; `write`
@@ -1075,6 +1278,34 @@ launcher) is not supervised either; there the callout says "Restart
 sigrun to apply" with no button. `GET /v1/meta` reports the posture
 (`supervised`).
 
+## Parked tasks
+
+A task cut off repeatedly without progress (a crash loop) is parked by
+pi-durable's restart limit: it shows `blocked` with reason
+`restart_limit` and does not run again until an administrator retries
+it. The `SigrunTaskParked` alert fires on this. Two admin-only
+endpoints inspect and recover parked tasks:
+
+- `GET /v1/admin/tasks?state=blocked` — lists blocked tasks with
+  `{id, kind, reason, conversationId, owner?, extension?}` per row
+  (owner is the conversation's session owner when it has one; extension
+  is the registered task definition's owner when known).
+- `POST /v1/admin/tasks/:id/retry` — re-runs a restart-parked task:
+  204 on success, 404 `unknown_task` for an unknown id, 409
+  `not_parked` for a task that isn't parked (including one blocked for
+  another reason, such as `missing_task`). A retried schedule job's
+  status returns to `waiting` as the task runs again.
+
+```sh
+# List blocked tasks (admin token).
+curl -H "Authorization: Bearer $TOKEN" \
+  "http://localhost:3000/v1/admin/tasks?state=blocked"
+
+# Retry a parked task.
+curl -X POST -H "Authorization: Bearer $TOKEN" \
+  http://localhost:3000/v1/admin/tasks/7/retry
+```
+
 ## API sketch
 
 - `GET /v1/meta` — version, extensions, health, auth posture
@@ -1084,6 +1315,8 @@ sigrun to apply" with no button. `GET /v1/meta` reports the posture
   differs from boot) and PATCH reports `{applied, pending}`.
 - `POST /v1/admin/restart` — graceful restart (admin, supervised
   deploys only; see Restarting).
+- `GET /v1/admin/tasks?state=blocked`, `POST /v1/admin/tasks/{id}/retry`
+  — parked-task inspection and recovery (admin; see Parked tasks).
 - `GET /v1/jobs`, `POST /v1/jobs`, `PATCH`/`DELETE /v1/jobs/{id}` —
   the jobs surface (see [Jobs](#jobs)); `POST /v1/jobs/{id}/run` fires
   now; `GET /v1/jobs/{id}/runs` and `GET /v1/jobs/{id}/revisions` are

package/dist/cli.js

@@ -47,7 +47,9 @@ import { dirname, join } from "node:path";
 import * as readline from "node:readline/promises";
 import { Writable } from "node:stream";
 import { resolveStoreRoots, writeFileAtomic } from "./harness/stores.js";
-import { openIdentityStores } from "./harness/identity/index.js";
+import { openIdentityStores, AccountLinkConflictError } from "./harness/identity/index.js";
+import { normalizeTypedUsername } from "./harness/identity/typed-username.js";
+import { deriveUsername, foldSubject } from "@sigrun/shared/usernames";
 import { pathToFileURL } from "node:url";
 import { effectiveMethods, loadConfig } from "./config.js";
 import { probeIsolation, runHelperProbe, selfTestHelper } from "./sandbox/availability.js";
@@ -63,7 +65,9 @@ export const USAGE_TEXT = `usage: sigrun [--user <name>]
        sigrun token create <name> --user <user>
        sigrun token list
        sigrun token revoke <id>
-       sigrun user add <user> [--admin] [--name <n>] [--email <e>]
+       sigrun user add [<user>] [--proxy <username>] [--admin] [--name <n>] [--email <e>]
+       sigrun user link <user> --proxy <username>
+       sigrun user unlink --proxy <username>
        sigrun user list
        sigrun provider list [--url <base>] [--token <token>]
        sigrun provider key <id> [--url <base>] [--token <token>]
@@ -134,8 +138,9 @@ function parseTokenArgs(argv) {
     throw usageError(`unknown token subcommand ${JSON.stringify(sub ?? "")} (create, list, revoke)`);
 }
 /**
- * Parse `user <sub> …` (Task 7): `add <user> [--admin] [--name <n>]
- * [--email <e>]`, `list`. One positional (the username), flags anywhere.
+ * Parse `user <sub> …`: `add [<user>] [--proxy <username>]`, explicit
+ * `link`/`unlink`, and `list`. A proxy add may omit the directory key,
+ * deriving it from the external username; ordinary add still requires it.
  */
 function parseUserArgs(argv) {
     const sub = argv[0];
@@ -145,51 +150,61 @@ function parseUserArgs(argv) {
         }
         return { command: "user", sub: "list" };
     }
-    if (sub === "add") {
+    if (sub === "add" || sub === "link" || sub === "unlink") {
         let user;
+        let proxy;
         let admin = false;
         let name;
         let email;
         let index = 1;
         while (index < argv.length) {
             const arg = argv[index];
-            if (arg === "--admin") {
+            if (sub === "add" && arg === "--admin") {
                 admin = true;
                 index += 1;
                 continue;
             }
-            if (arg === "--name" || arg === "--email") {
+            if (arg === "--proxy" || (sub === "add" && (arg === "--name" || arg === "--email"))) {
                 const value = argv[index + 1];
                 if (value === undefined || value.startsWith("--")) {
                     throw usageError(`${arg} requires a value`);
                 }
-                if (arg === "--name")
+                if (arg === "--proxy")
+                    proxy = value;
+                else if (arg === "--name")
                     name = value;
                 else
                     email = value;
                 index += 2;
                 continue;
             }
-            if (user === undefined && !arg.startsWith("--")) {
+            if (sub !== "unlink" && user === undefined && !arg.startsWith("--")) {
                 user = arg;
                 index += 1;
                 continue;
             }
             throw usageError(`unexpected argument ${JSON.stringify(arg)}`);
         }
-        if (user === undefined) {
-            throw usageError("user add requires a <user>");
+        if (proxy === undefined) {
+            if (sub !== "add")
+                throw usageError(`user ${sub} requires --proxy <username>`);
+            if (user === undefined)
+                throw usageError("user add requires a <user>");
+        }
+        if (sub === "link" && user === undefined) {
+            throw usageError("user link requires a <user>");
         }
         return {
             command: "user",
-            sub: "add",
-            user,
+            sub,
+            ...(user === undefined ? {} : { user }),
+            ...(proxy === undefined ? {} : { proxy }),
             ...(admin ? { admin } : {}),
             ...(name === undefined ? {} : { name }),
             ...(email === undefined ? {} : { email }),
         };
     }
-    throw usageError(`unknown user subcommand ${JSON.stringify(sub ?? "")} (add, list)`);
+    throw usageError(`unknown user subcommand ${JSON.stringify(sub ?? "")} (add, link, unlink, list)`);
 }
 /**
  * Parse `provider <sub> …` (release 0.1 Task 2b): `list`, `key <id>`,
@@ -506,9 +521,21 @@ export async function ttyPrompt(question, opts) {
         rl.close();
     }
 }
-/** Resolve the attach/run user: `--user` > `SIGRUN_USER` > tui.json. */
+/**
+ * Resolve the attach/run user: `--user` > `SIGRUN_USER` > tui.json. The
+ * source is operator-typed (unchecked): derive the canonical key before
+ * it reaches the wire (the server derives on receipt too). Unusable
+ * input fails loud, never a silent empty identity.
+ */
 function resolveUser(parsed, env, file) {
-    return parsed.user ?? env.SIGRUN_USER ?? file.user;
+    const raw = parsed.user ?? env.SIGRUN_USER ?? file.user;
+    if (raw === undefined || raw.trim() === "")
+        return undefined;
+    const derived = deriveUsername(raw);
+    if (derived === undefined) {
+        throw new Error(`invalid_username: "${raw}" derives no usable username`);
+    }
+    return derived;
 }
 /**
  * The tui.json UI refresh fields (C1) as a spreadable launch fragment —
@@ -654,7 +681,14 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
     if (parsed.command === "token") {
         switch (parsed.sub) {
             case "create": {
-                const user = parsed.user;
+                // A typed source, same rule as `user add`: the resulting key
+                // is what the token (and its printed secret) belongs to.
+                const raw = parsed.user;
+                const derived = deriveUsername(raw);
+                if (derived === undefined) {
+                    throw new Error(`invalid_username: "${raw}" derives no usable username`);
+                }
+                const user = derived;
                 if (stores.users.get(user) === undefined) {
                     throw new Error(`unknown user "${user}" — add it first: sigrun user add ${user}`);
                 }
@@ -685,6 +719,13 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
     }
     switch (parsed.sub) {
         case "add": {
+            const input = parsed.user ?? parsed.proxy;
+            const typed = normalizeTypedUsername(input, (key) => stores.users.get(key) !== undefined);
+            if (!typed.ok) {
+                throw new Error(typed.error === "invalid_username"
+                    ? `invalid_username: "${input}" derives no usable username`
+                    : `username_taken: user "${parsed.user === undefined ? input : deriveUsername(input) ?? input}" already exists`);
+            }
             const config = loadConfig(env, new SettingsStore({ dir: defaultConfigDir(env) }).read());
             const coreRoot = selfPackageRoot();
             const isolation = await isolationProbe({
@@ -703,13 +744,53 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
                     proxySecretHeader: config.auth.proxy.secretHeader,
                 }),
             });
-            await stores.users.add({
-                user: parsed.user,
+            const record = await stores.users.add({
+                user: typed.key,
                 admin: parsed.admin ?? false,
                 ...(parsed.name === undefined ? {} : { name: parsed.name }),
                 ...(parsed.email === undefined ? {} : { email: parsed.email }),
                 source: "cli",
             });
+            if (parsed.proxy !== undefined) {
+                const subject = foldSubject(parsed.proxy);
+                try {
+                    await stores.accounts.link({
+                        provider: "proxy",
+                        subject,
+                        user: record.user,
+                        via: "admin",
+                    });
+                }
+                catch (error) {
+                    if (!(error instanceof AccountLinkConflictError))
+                        throw error;
+                    await stores.users.remove(record.user);
+                    const holder = stores.accounts.lookup("proxy", subject)?.user;
+                    throw new Error(`account_link_conflict: proxy identity is linked to ${holder ?? "another user"}; removed user "${record.user}"`);
+                }
+            }
+            io.out?.(record.user);
+            return 0;
+        }
+        case "link": {
+            const user = deriveUsername(parsed.user);
+            if (user === undefined || stores.users.get(user) === undefined) {
+                throw new Error(`unknown user "${parsed.user}"`);
+            }
+            const link = await stores.accounts.link({
+                provider: "proxy",
+                subject: foldSubject(parsed.proxy),
+                user,
+                via: "admin",
+            });
+            io.out?.(`${link.provider}:${link.subject}\t${link.user}`);
+            return 0;
+        }
+        case "unlink": {
+            const subject = foldSubject(parsed.proxy);
+            if (!(await stores.accounts.unlink("proxy", subject))) {
+                throw new Error(`no proxy link for "${subject}"`);
+            }
             return 0;
         }
         case "list": {
@@ -719,6 +800,8 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
                     record.user,
                     ...(record.name === undefined ? [] : [record.name]),
                     ...(record.email === undefined ? [] : [record.email]),
+                    ...stores.accounts.listForUser(record.user)
+                        .map((link) => `${link.provider}:${link.subject}`),
                 ].join("\t"));
             }
             return 0;
@@ -727,6 +810,15 @@ async function runIdentityCommand(parsed, env, io, isolationProbe) {
     // parseArgs guarantees one of the cases above.
     throw new Error(`unhandled ${parsed.command} subcommand`);
 }
+/**
+ * The CLI-local mirror of the server's proxy-only rule (proxy-trust
+ * Task 6): no token callers exist, so a setup-code prompt can never
+ * be redeemed. Kept here rather than imported from src/server — the
+ * CLI does not import server auth modules.
+ */
+function isProxyOnly(methods) {
+    return methods.includes("proxy") && !methods.includes("token");
+}
 /**
  * The pre-launch onboarding flow (Task 7, spec §5.8): `attach`/`run`
  * ask the server its state; an UNCLAIMED server gets the interactive
@@ -766,6 +858,12 @@ async function onboardIfUnclaimed(server, prompt, fetchImpl) {
     }
     if (state.state !== "unclaimed")
         return undefined;
+    // Proxy-trust Task 6: a proxy-only server without a vouched identity
+    // refuses the claim (403 proxy_identity_required) and never mints a
+    // setup code — prompt for one and the operator can only lose.
+    if (isProxyOnly(state.methods) && state.codeRequired && state.proxyIdentity === undefined) {
+        throw new Error("sigrun: this sigrun onboards through its sign-in proxy; open it in a browser");
+    }
     let code;
     if (state.codeRequired) {
         code = (await prompt("setup code: ")).trim();

package/dist/config.js

@@ -2,6 +2,7 @@ import { isIanaTimeZone } from "./jobs/spec.js";
 import { isAbsolute, join } from "node:path";
 import { resolveStoreRoots } from "./harness/stores.js";
 import { isLoopbackHost } from "./server/auth/loopback.js";
+import { deriveUsername, isUsernameKey } from "@sigrun/shared/usernames";
 /**
  * Sigrun configuration.
  *
@@ -432,6 +433,15 @@ function parseAuth(env, server) {
     }
     const token = env.SIGRUN_API_TOKEN?.trim() || undefined;
     const secret = env.SIGRUN_PROXY_SECRET?.trim() || undefined;
+    // The service-token user is an operator-typed identity that no request
+    // ever re-derives: it must ALREADY be a canonical username key at load
+    // time (unlike the header/CLI sources, which derive). Anything else is
+    // a config error naming the derived suggestion.
+    const serviceTokenUser = env.SIGRUN_API_TOKEN_USER?.trim() || "sigrun";
+    if (token !== undefined && !isUsernameKey(serviceTokenUser)) {
+        throw new Error(`SIGRUN_API_TOKEN_USER must already be a username key, got "${serviceTokenUser}" — ` +
+            `did you mean "${deriveUsername(serviceTokenUser) ?? "sigrun"}"?`);
+    }
     return {
         sessionDays: server?.sessionDays ?? DEFAULT_AUTH.sessionDays,
         methods,
@@ -459,7 +469,7 @@ function parseAuth(env, server) {
             : {
                 serviceToken: {
                     token,
-                    user: env.SIGRUN_API_TOKEN_USER?.trim() || "sigrun",
+                    user: serviceTokenUser,
                 },
             }),
     };
@@ -556,8 +566,13 @@ export function parseBackupSections(raw) {
 function parseCompaction(env, server) {
     // Env parse first (a bad env value fails loud even when the file's
     // value is valid); a file field applies only where its env var is
-    // absent; code defaults last.
+    // absent; code defaults last. `modelOverrides` is file-only (a map
+    // has no env spelling), passed through verbatim — pi-durable's
+    // `compactionPolicy` applies it per model at compaction time.
     return {
+        ...(server?.modelOverrides === undefined
+            ? {}
+            : { modelOverrides: server.modelOverrides }),
         enabled: parseCompactionEnabled(env) ??
             server?.enabled ??
             DEFAULT_COMPACTION.enabled,
@@ -831,6 +846,7 @@ export function resolvedServerSection(config) {
  * | `SIGRUN_PORT` | `port` |
  * | `SIGRUN_WORKSPACE_PATH` | `workspacePath` |
  * | `SIGRUN_STORAGE_PATH` | `storagePath` |
+ * | `SIGRUN_SKIP_MIGRATION_SNAPSHOT` | — (boot escape hatch; never persisted) |
  * | `SIGRUN_DATA_DIR` | `dataDir` |
  * | `SIGRUN_CACHE_DIR` | `cacheDir` |
  * | `SIGRUN_STATE_DIR` | `stateDir` |
@@ -994,6 +1010,9 @@ export function effectiveServerSection(env, fileServer, config) {
     emit("compaction.reserveTokens", config.compaction.reserveTokens, ["compaction", "reserveTokens"]);
     emit("compaction.keepRecentTokens", config.compaction.keepRecentTokens, ["compaction", "keepRecentTokens"]);
     emit("compaction.backgroundTokens", config.compaction.backgroundTokens, ["compaction", "backgroundTokens"]);
+    if (config.compaction.modelOverrides !== undefined) {
+        emit("compaction.modelOverrides", config.compaction.modelOverrides, ["compaction", "modelOverrides"]);
+    }
     emit("memorySeam.hookDeadlineMs", config.memorySeam.hookDeadlineMs, ["memorySeam", "hookDeadlineMs"]);
     emit("memorySeam.idleThresholdMs", config.memorySeam.idleThresholdMs, ["memorySeam", "idleThresholdMs"]);
     emit("memorySeam.workerDeadlineMs", config.memorySeam.workerDeadlineMs, ["memorySeam", "workerDeadlineMs"]);