@tangle-network/cli-agent-registry 0.14.0 → 0.15.0

package/README.md

@@ -23,6 +23,36 @@ overrides unless `env` is also supplied. Returned contents are sensitive raw fil
 not proof of a valid OAuth subscription. Callers own consent and native login
 validation before enrollment. This filesystem reader does not read macOS Keychain.
 
+## Native HOME layouts (0.15)
+
+`CliDirLayout.configAllow` accepts strings or `{ path, kind: "symlink" }` rules.
+Consumers must narrow an entry before calling string methods and apply its kind
+constraint. The maintained Orchestrator classifier does both; arbitrary external
+string-only consumers require migration. `mergeCliDirLayout` keeps its four keys,
+key order and fresh default-plus-addition arrays.
+
+Codex's known cache and plugin trees and coordination files are preserved as
+auxiliary source bytes. Only its four generated arg0 symlink aliases are named
+configuration; regular files at those names and unknown siblings remain held.
+Credential exclusions, native-store identity and conservation still apply.
+
+## Host registry export
+
+`host-contracts.json` is the generated data-only projection of the canonical
+`harness-contracts/` session stores, store environment, CLI versions and model
+environment names. Non-JavaScript Git consumers can pin this committed file by
+commit and hash. Build emits its byte-identical package copy in `dist`; the public
+`/host-contracts.json` export resolves there, and prepack rejects drift in either copy.
+The real CLI/Python
+boundary check is `node tests/host-contracts.integration.mjs`.
+
+The `/host-contracts` entry also exports `HOST_CONTRACTS`. Host-only `cursor-cli`
+and the Cursor CLI declaration describes its native on-disk stores; it does not
+register sandbox backends, change Cursor SDK's unsupported status, or establish
+sandbox recovery conformance. Per-store `env` selects its base-directory override;
+`xdg` supplies a lower-priority XDG base. `session.storeEnv` declares each override's
+default home-relative base; append the remaining suffix of `store.root`.
+
 ## Identity, availability and implementation
 
 Interface describes recognized identities, including historical ones. This

package/dist/{backend-types-CREj4iOY.mjs → backend-types-CNo_Zj_K.mjs}

@@ -1,15 +1,6 @@
 import { z } from "zod";
 //#region ../runtime-contracts/dist/backend-types.js
-/**
-* This distribution's backend vocabulary, declared positively. The shared
-* Interface vocabulary also contains historical and differently hosted harnesses;
-* knowing one upstream must not require installing it here or make this module
-* throw at import time. Keep old wire identities readable when retiring execution.
-*
-* Gemini is not a direct Sandbox backend; it is available only through a backing
-* transport. Adding it upstream never implicitly makes it dispatchable here.
-* The spec/adapter composition must still prove every backend it actually enables.
-*/
+/** This distribution's backend vocabulary. Gemini is only a backing transport, not a direct backend. */
 const BACKEND_TYPE = {
 	OPENCODE: "opencode",
 	CLAUDE_CODE: "claude-code",
@@ -20,11 +11,11 @@ const BACKEND_TYPE = {
 	PI: "pi",
 	PRIME: "prime",
 	HERMES: "hermes",
-	FORGE: "forge",
 	OPENCLAW: "openclaw",
 	NANOCLAW: "nanoclaw",
 	ACP: "acp",
 	CURSOR: "cursor",
+	GROK: "grok",
 	CLI_BASE: "cli-base"
 };
 /** Stable declaration order; registry tests check the shipped spec composition. */
@@ -42,4 +33,4 @@ function parseBackendType(value) {
 //#endregion
 export { parseBackendType as a, isBackendType as i, BACKEND_TYPE as n, backendTypeSchema as r, ALL_BACKEND_TYPES as t };
 
-//# sourceMappingURL=backend-types-CREj4iOY.mjs.map
+//# sourceMappingURL=backend-types-CNo_Zj_K.mjs.map

package/dist/{backend-types-CJH-wHS3.d.mts → backend-types-DRmLR1e0.d.mts}

@@ -1,16 +1,7 @@
 import { z } from "zod";
 
 //#region ../runtime-contracts/dist/backend-types.d.ts
-/**
- * This distribution's backend vocabulary, declared positively. The shared
- * Interface vocabulary also contains historical and differently hosted harnesses;
- * knowing one upstream must not require installing it here or make this module
- * throw at import time. Keep old wire identities readable when retiring execution.
- *
- * Gemini is not a direct Sandbox backend; it is available only through a backing
- * transport. Adding it upstream never implicitly makes it dispatchable here.
- * The spec/adapter composition must still prove every backend it actually enables.
- */
+/** This distribution's backend vocabulary. Gemini is only a backing transport, not a direct backend. */
 declare const BACKEND_TYPE: {
   readonly OPENCODE: "opencode";
   readonly CLAUDE_CODE: "claude-code";
@@ -21,11 +12,11 @@ declare const BACKEND_TYPE: {
   readonly PI: "pi";
   readonly PRIME: "prime";
   readonly HERMES: "hermes";
-  readonly FORGE: "forge";
   readonly OPENCLAW: "openclaw";
   readonly NANOCLAW: "nanoclaw";
   readonly ACP: "acp";
   readonly CURSOR: "cursor";
+  readonly GROK: "grok";
   readonly CLI_BASE: "cli-base";
 };
 /** Derived from the local declaration, not the complement of the upstream enum. */
@@ -44,8 +35,8 @@ declare const backendTypeSchema: z.ZodEnum<{
   openclaw: "openclaw";
   amp: "amp";
   "factory-droids": "factory-droids";
-  forge: "forge";
   cursor: "cursor";
+  grok: "grok";
   acp: "acp";
   "cli-base": "cli-base";
 }>;
@@ -53,4 +44,4 @@ declare function isBackendType(value: string): value is BackendType;
 declare function parseBackendType(value: string): BackendType;
 //#endregion
 export { isBackendType as a, backendTypeSchema as i, BACKEND_TYPE as n, parseBackendType as o, BackendType as r, ALL_BACKEND_TYPES as t };
-//# sourceMappingURL=backend-types-CJH-wHS3.d.mts.map
+//# sourceMappingURL=backend-types-DRmLR1e0.d.mts.map

package/dist/backend-types.d.mts

@@ -1,2 +1,2 @@
-import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-CJH-wHS3.mjs";
+import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-DRmLR1e0.mjs";
 export { ALL_BACKEND_TYPES, BACKEND_TYPE, BackendType, backendTypeSchema, isBackendType, parseBackendType };

package/dist/backend-types.mjs

@@ -1,2 +1,2 @@
-import { a as parseBackendType, i as isBackendType, n as BACKEND_TYPE, r as backendTypeSchema, t as ALL_BACKEND_TYPES } from "./backend-types-CREj4iOY.mjs";
+import { a as parseBackendType, i as isBackendType, n as BACKEND_TYPE, r as backendTypeSchema, t as ALL_BACKEND_TYPES } from "./backend-types-CNo_Zj_K.mjs";
 export { ALL_BACKEND_TYPES, BACKEND_TYPE, backendTypeSchema, isBackendType, parseBackendType };

package/dist/cli-auth-bundle-C6DtK7GX.mjs

@@ -0,0 +1,95 @@
+import { l as getSpec } from "./specs-BBF55TnM.mjs";
+import "@tangle-network/agent-interface";
+import { z } from "zod";
+//#region ../runtime-contracts/dist/public-profile-request.js
+const cliAuthReferenceSchema = z.strictObject({
+	account: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9@._+-]{0,127}$/),
+	secretEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}$/),
+	format: z.enum([
+		"token",
+		"bundle",
+		"files"
+	])
+});
+//#endregion
+//#region src/cli-auth-bundle.ts
+const DEFAULT_MODE = 384;
+const AUTH_BUNDLE_PATHS = Object.freeze({
+	codex: ".codex/auth.json",
+	"claude-code": ".claude/.credentials.json"
+});
+/** Convert a native credential JSON bundle without reading host credentials. */
+function materializeCliAuthBundle(backendType, rawBundle) {
+	if (backendType !== "codex" && backendType !== "claude-code") throw new Error("CLI auth bundle is not supported for the selected backend");
+	if (typeof rawBundle !== "string") throw new Error("CLI auth bundle must be a JSON object");
+	let value;
+	try {
+		value = JSON.parse(rawBundle);
+	} catch {
+		throw new Error("CLI auth bundle must be a JSON object");
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("CLI auth bundle must be a JSON object");
+	return [{
+		path: AUTH_BUNDLE_PATHS[backendType],
+		content: rawBundle,
+		mode: DEFAULT_MODE
+	}];
+}
+const CLI_AUTH_REFERENCE_ENV_VAR = "AGENT_INTERNAL_CLI_AUTH_REF";
+const cliAuthFilesSchema = z.array(z.object({
+	path: z.string().min(1).max(4096).refine((value) => !value.startsWith("/") && !/^[A-Za-z]:/.test(value) && !/[\\\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..")),
+	content: z.string().max(1024 * 1024),
+	mode: z.number().int().min(0).max(448).refine((mode) => (mode & 63) === 0).optional()
+}).strict()).min(1).max(128);
+function assertCliAuthReferenceSupported(backendType, model) {
+	if (model.cliAuth === void 0) return void 0;
+	const parsedReference = cliAuthReferenceSchema.safeParse(model.cliAuth);
+	if (!parsedReference.success) throw new Error("Invalid native authentication reference");
+	const reference = parsedReference.data;
+	if (model.authMode === "api-key" || model.apiKey !== void 0 || model.apiKeyEnv !== void 0 || model.baseUrl !== void 0 || model.authFiles !== void 0) throw new Error("cliAuth cannot be combined with API credentials, baseUrl, or inline authFiles");
+	const spec = getSpec(backendType);
+	if (!spec?.hasCliAuth) throw new Error(`Native CLI authentication is unsupported by ${backendType}`);
+	if (reference.format === "token" && !spec.envVars.oauthToken) throw new Error(`Native subscription tokens are unsupported by ${backendType}`);
+	if (reference.format === "bundle" && backendType !== "codex" && backendType !== "claude-code") throw new Error(`Native credential bundles are unsupported by ${backendType}`);
+	return reference;
+}
+/** Resolve only the selected injected secret, without copying it into a public config. */
+function resolveCliAuthReference(backendType, model, environment) {
+	const reference = assertCliAuthReferenceSupported(backendType, model);
+	if (!reference) return void 0;
+	const value = environment[reference.secretEnv];
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`Missing native credential environment variable: ${reference.secretEnv}`);
+	if (reference.format === "token") {
+		const tokenEnv = getSpec(backendType)?.envVars.oauthToken;
+		if (!tokenEnv) throw new Error(`Native subscription tokens are unsupported by ${backendType}`);
+		if (/\s/.test(value) || value.startsWith("{") || value.startsWith("[")) throw new Error("Native token authentication requires a raw token, not a credential wrapper");
+		return {
+			reference,
+			authFiles: [],
+			tokenEnvironment: { [tokenEnv]: value }
+		};
+	}
+	if (reference.format === "bundle") return {
+		reference,
+		authFiles: materializeCliAuthBundle(backendType, value),
+		tokenEnvironment: {}
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		throw new Error("Native authFiles secret must contain a JSON array of auth files");
+	}
+	const files = cliAuthFilesSchema.safeParse(parsed);
+	if (!files.success) throw new Error("Native authFiles secret must contain a JSON array of auth files");
+	if (backendType === "codex" && (files.data.length !== 1 || files.data[0]?.path !== AUTH_BUNDLE_PATHS.codex || files.data[0]?.content.trim().length === 0)) throw new Error("Codex native auth files require only .codex/auth.json");
+	return {
+		reference,
+		authFiles: files.data,
+		tokenEnvironment: {}
+	};
+}
+//#endregion
+export { materializeCliAuthBundle as a, cliAuthFilesSchema as i, CLI_AUTH_REFERENCE_ENV_VAR as n, resolveCliAuthReference as o, assertCliAuthReferenceSupported as r, cliAuthReferenceSchema as s, AUTH_BUNDLE_PATHS as t };
+
+//# sourceMappingURL=cli-auth-bundle-C6DtK7GX.mjs.map

package/dist/cli-auth-bundle-CwAaH0Ap.d.mts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+
+//#region ../runtime-contracts/dist/public-profile-request.d.ts
+declare const cliAuthReferenceSchema: z.ZodObject<{
+  account: z.ZodString;
+  secretEnv: z.ZodString;
+  format: z.ZodEnum<{
+    files: "files";
+    token: "token";
+    bundle: "bundle";
+  }>;
+}, z.core.$strict>;
+/** A supplied account binding label, not a verified native account principal. */
+type CliAuthReference = z.infer<typeof cliAuthReferenceSchema>;
+//#endregion
+//#region src/cli-auth-bundle.d.ts
+type LocalCliAuthFile = {
+  path: string;
+  content: string;
+  mode?: number;
+};
+declare const AUTH_BUNDLE_PATHS: Readonly<{
+  readonly codex: ".codex/auth.json";
+  readonly "claude-code": ".claude/.credentials.json";
+}>;
+/** Convert a native credential JSON bundle without reading host credentials. */
+declare function materializeCliAuthBundle(backendType: string, rawBundle: string): LocalCliAuthFile[];
+declare const CLI_AUTH_REFERENCE_ENV_VAR = "AGENT_INTERNAL_CLI_AUTH_REF";
+type CliAuthMaterial = {
+  reference: CliAuthReference;
+  authFiles: LocalCliAuthFile[];
+  tokenEnvironment: Record<string, string>;
+};
+declare const cliAuthFilesSchema: z.ZodArray<z.ZodObject<{
+  path: z.ZodString;
+  content: z.ZodString;
+  mode: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>>;
+declare function assertCliAuthReferenceSupported(backendType: string, model: {
+  cliAuth?: CliAuthReference;
+  authMode?: string;
+  apiKey?: string;
+  apiKeyEnv?: string;
+  baseUrl?: string;
+  authFiles?: LocalCliAuthFile[];
+}): CliAuthReference | undefined;
+/** Resolve only the selected injected secret, without copying it into a public config. */
+declare function resolveCliAuthReference(backendType: string, model: Parameters<typeof assertCliAuthReferenceSupported>[1], environment: Readonly<Record<string, string | undefined>>): CliAuthMaterial | undefined;
+//#endregion
+export { assertCliAuthReferenceSupported as a, resolveCliAuthReference as c, LocalCliAuthFile as i, CliAuthReference as l, CLI_AUTH_REFERENCE_ENV_VAR as n, cliAuthFilesSchema as o, CliAuthMaterial as r, materializeCliAuthBundle as s, AUTH_BUNDLE_PATHS as t, cliAuthReferenceSchema as u };
+//# sourceMappingURL=cli-auth-bundle-CwAaH0Ap.d.mts.map

package/dist/cli-auth-bundle.d.mts

@@ -1,49 +1,2 @@
-import { z } from "zod";
-
-//#region src/cli-auth-bundle.d.ts
-type LocalCliAuthFile = {
-  path: string;
-  content: string;
-  mode?: number;
-};
-declare const AUTH_BUNDLE_PATHS: Readonly<{
-  readonly codex: ".codex/auth.json";
-  readonly "claude-code": ".claude/.credentials.json";
-}>;
-/** Convert a native credential JSON bundle without reading host credentials. */
-declare function materializeCliAuthBundle(backendType: string, rawBundle: string): LocalCliAuthFile[];
-declare const CLI_AUTH_REFERENCE_ENV_VAR = "AGENT_INTERNAL_CLI_AUTH_REF";
-declare const cliAuthReferenceSchema: z.ZodObject<{
-  account: z.ZodString;
-  secretEnv: z.ZodString;
-  format: z.ZodEnum<{
-    token: "token";
-    bundle: "bundle";
-    files: "files";
-  }>;
-}, z.core.$strict>;
-/** A supplied account binding label, not a verified native account principal. */
-type CliAuthReference = z.infer<typeof cliAuthReferenceSchema>;
-type CliAuthMaterial = {
-  reference: CliAuthReference;
-  authFiles: LocalCliAuthFile[];
-  tokenEnvironment: Record<string, string>;
-};
-declare const cliAuthFilesSchema: z.ZodArray<z.ZodObject<{
-  path: z.ZodString;
-  content: z.ZodString;
-  mode: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>>;
-declare function assertCliAuthReferenceSupported(backendType: string, model: {
-  cliAuth?: CliAuthReference;
-  authMode?: string;
-  apiKey?: string;
-  apiKeyEnv?: string;
-  baseUrl?: string;
-  authFiles?: LocalCliAuthFile[];
-}): CliAuthReference | undefined;
-/** Resolve only the selected injected secret, without copying it into a public config. */
-declare function resolveCliAuthReference(backendType: string, model: Parameters<typeof assertCliAuthReferenceSupported>[1], environment: Readonly<Record<string, string | undefined>>): CliAuthMaterial | undefined;
-//#endregion
-export { AUTH_BUNDLE_PATHS, CLI_AUTH_REFERENCE_ENV_VAR, CliAuthMaterial, CliAuthReference, LocalCliAuthFile, assertCliAuthReferenceSupported, cliAuthFilesSchema, cliAuthReferenceSchema, materializeCliAuthBundle, resolveCliAuthReference };
-//# sourceMappingURL=cli-auth-bundle.d.mts.map
+import { a as assertCliAuthReferenceSupported, c as resolveCliAuthReference, i as LocalCliAuthFile, l as CliAuthReference, n as CLI_AUTH_REFERENCE_ENV_VAR, o as cliAuthFilesSchema, r as CliAuthMaterial, s as materializeCliAuthBundle, t as AUTH_BUNDLE_PATHS, u as cliAuthReferenceSchema } from "./cli-auth-bundle-CwAaH0Ap.mjs";
+export { AUTH_BUNDLE_PATHS, CLI_AUTH_REFERENCE_ENV_VAR, CliAuthMaterial, CliAuthReference, LocalCliAuthFile, assertCliAuthReferenceSupported, cliAuthFilesSchema, cliAuthReferenceSchema, materializeCliAuthBundle, resolveCliAuthReference };

package/dist/cli-auth-bundle.mjs

@@ -1,92 +1,2 @@
-import { l as getSpec } from "./specs-Bbiay_8K.mjs";
-import { z } from "zod";
-//#region src/cli-auth-bundle.ts
-const DEFAULT_MODE = 384;
-const AUTH_BUNDLE_PATHS = Object.freeze({
-	codex: ".codex/auth.json",
-	"claude-code": ".claude/.credentials.json"
-});
-/** Convert a native credential JSON bundle without reading host credentials. */
-function materializeCliAuthBundle(backendType, rawBundle) {
-	if (backendType !== "codex" && backendType !== "claude-code") throw new Error("CLI auth bundle is not supported for the selected backend");
-	if (typeof rawBundle !== "string") throw new Error("CLI auth bundle must be a JSON object");
-	let value;
-	try {
-		value = JSON.parse(rawBundle);
-	} catch {
-		throw new Error("CLI auth bundle must be a JSON object");
-	}
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("CLI auth bundle must be a JSON object");
-	return [{
-		path: AUTH_BUNDLE_PATHS[backendType],
-		content: rawBundle,
-		mode: DEFAULT_MODE
-	}];
-}
-const CLI_AUTH_REFERENCE_ENV_VAR = "AGENT_INTERNAL_CLI_AUTH_REF";
-const cliAuthReferenceSchema = z.object({
-	account: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9@._+-]{0,127}$/),
-	secretEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}$/),
-	format: z.enum([
-		"token",
-		"bundle",
-		"files"
-	])
-}).strict();
-const cliAuthFilesSchema = z.array(z.object({
-	path: z.string().min(1).max(4096).refine((value) => !value.startsWith("/") && !/^[A-Za-z]:/.test(value) && !/[\\\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..")),
-	content: z.string().max(1024 * 1024),
-	mode: z.number().int().min(0).max(448).refine((mode) => (mode & 63) === 0).optional()
-}).strict()).min(1).max(128);
-function assertCliAuthReferenceSupported(backendType, model) {
-	if (model.cliAuth === void 0) return void 0;
-	const parsedReference = cliAuthReferenceSchema.safeParse(model.cliAuth);
-	if (!parsedReference.success) throw new Error("Invalid native authentication reference");
-	const reference = parsedReference.data;
-	if (model.authMode === "api-key" || model.apiKey !== void 0 || model.apiKeyEnv !== void 0 || model.baseUrl !== void 0 || model.authFiles !== void 0) throw new Error("cliAuth cannot be combined with API credentials, baseUrl, or inline authFiles");
-	const spec = getSpec(backendType);
-	if (!spec?.hasCliAuth) throw new Error(`Native CLI authentication is unsupported by ${backendType}`);
-	if (reference.format === "token" && !spec.envVars.oauthToken) throw new Error(`Native subscription tokens are unsupported by ${backendType}`);
-	if (reference.format === "bundle" && backendType !== "codex" && backendType !== "claude-code") throw new Error(`Native credential bundles are unsupported by ${backendType}`);
-	return reference;
-}
-/** Resolve only the selected injected secret, without copying it into a public config. */
-function resolveCliAuthReference(backendType, model, environment) {
-	const reference = assertCliAuthReferenceSupported(backendType, model);
-	if (!reference) return void 0;
-	const value = environment[reference.secretEnv];
-	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`Missing native credential environment variable: ${reference.secretEnv}`);
-	if (reference.format === "token") {
-		const tokenEnv = getSpec(backendType)?.envVars.oauthToken;
-		if (!tokenEnv) throw new Error(`Native subscription tokens are unsupported by ${backendType}`);
-		if (/\s/.test(value) || value.startsWith("{") || value.startsWith("[")) throw new Error("Native token authentication requires a raw token, not a credential wrapper");
-		return {
-			reference,
-			authFiles: [],
-			tokenEnvironment: { [tokenEnv]: value }
-		};
-	}
-	if (reference.format === "bundle") return {
-		reference,
-		authFiles: materializeCliAuthBundle(backendType, value),
-		tokenEnvironment: {}
-	};
-	let parsed;
-	try {
-		parsed = JSON.parse(value);
-	} catch {
-		throw new Error("Native authFiles secret must contain a JSON array of auth files");
-	}
-	const files = cliAuthFilesSchema.safeParse(parsed);
-	if (!files.success) throw new Error("Native authFiles secret must contain a JSON array of auth files");
-	if (backendType === "codex" && (files.data.length !== 1 || files.data[0]?.path !== AUTH_BUNDLE_PATHS.codex || files.data[0]?.content.trim().length === 0)) throw new Error("Codex native auth files require only .codex/auth.json");
-	return {
-		reference,
-		authFiles: files.data,
-		tokenEnvironment: {}
-	};
-}
-//#endregion
+import { a as materializeCliAuthBundle, i as cliAuthFilesSchema, n as CLI_AUTH_REFERENCE_ENV_VAR, o as resolveCliAuthReference, r as assertCliAuthReferenceSupported, s as cliAuthReferenceSchema, t as AUTH_BUNDLE_PATHS } from "./cli-auth-bundle-C6DtK7GX.mjs";
 export { AUTH_BUNDLE_PATHS, CLI_AUTH_REFERENCE_ENV_VAR, assertCliAuthReferenceSupported, cliAuthFilesSchema, cliAuthReferenceSchema, materializeCliAuthBundle, resolveCliAuthReference };
-
-//# sourceMappingURL=cli-auth-bundle.mjs.map

package/dist/cli-auth-placeholder.d.mts

@@ -1,4 +1,4 @@
-import { CliAuthMaterial, CliAuthReference } from "./cli-auth-bundle.mjs";
+import { l as CliAuthReference, r as CliAuthMaterial } from "./cli-auth-bundle-CwAaH0Ap.mjs";
 import { z } from "zod";
 
 //#region src/cli-auth-placeholder.d.ts

package/dist/cli-auth-placeholder.mjs

@@ -1,5 +1,5 @@
-import { AUTH_BUNDLE_PATHS, assertCliAuthReferenceSupported, resolveCliAuthReference } from "./cli-auth-bundle.mjs";
-import { i as baseProxyToken, r as declaredSecretSlotTokens } from "./harness-DIdVNSwl.mjs";
+import { o as resolveCliAuthReference, r as assertCliAuthReferenceSupported, t as AUTH_BUNDLE_PATHS } from "./cli-auth-bundle-C6DtK7GX.mjs";
+import { i as baseProxyToken, r as declaredSecretSlotTokens } from "./harness-D1fTxnDD.mjs";
 import { z } from "zod";
 //#region src/cli-auth-placeholder.ts
 const identity = z.string().regex(/^[A-Za-z0-9_-]{1,256}$/);

package/dist/cli-backend-auth-env.mjs

@@ -1,6 +1,6 @@
-import { l as getSpec } from "./specs-Bbiay_8K.mjs";
-import { CLI_AUTH_REFERENCE_ENV_VAR, cliAuthFilesSchema, cliAuthReferenceSchema, resolveCliAuthReference } from "./cli-auth-bundle.mjs";
-import { n as isSafeEnvVarName, t as isForbiddenEnvVarName } from "./harness-DIdVNSwl.mjs";
+import { l as getSpec } from "./specs-BBF55TnM.mjs";
+import { i as cliAuthFilesSchema, n as CLI_AUTH_REFERENCE_ENV_VAR, o as resolveCliAuthReference, s as cliAuthReferenceSchema } from "./cli-auth-bundle-C6DtK7GX.mjs";
+import { n as isSafeEnvVarName, t as isForbiddenEnvVarName } from "./harness-D1fTxnDD.mjs";
 //#region src/cli-backend-auth-env.ts
 /** The narrow credential leg shared by the host and sidecar rebind boundary. */
 function assertCliBackendAuthEnv(backendType, authEnv) {

package/dist/default-backend.d.mts

@@ -1,4 +1,4 @@
-import { r as BackendType } from "./backend-types-CJH-wHS3.mjs";
+import { r as BackendType } from "./backend-types-DRmLR1e0.mjs";
 //#region src/default-backend.d.ts
 /**
  * Platform-wide default agent backend, read from `DEFAULT_AGENT_BACKEND`.

package/dist/default-backend.mjs

@@ -1,5 +1,5 @@
-import { i as isBackendType, t as ALL_BACKEND_TYPES } from "./backend-types-CREj4iOY.mjs";
-import "./specs-Bbiay_8K.mjs";
+import { i as isBackendType, t as ALL_BACKEND_TYPES } from "./backend-types-CNo_Zj_K.mjs";
+import "./specs-BBF55TnM.mjs";
 //#region src/default-backend.ts
 /**
 * Platform-wide default agent backend, read from `DEFAULT_AGENT_BACKEND`.

package/dist/{harness-DIdVNSwl.mjs → harness-D1fTxnDD.mjs}

@@ -1,22 +1,10 @@
-import { o as HARNESS_WARM_TRANSPORT_ENV } from "./native-session-contracts-DWFzgoye.mjs";
-import "./backend-types-CREj4iOY.mjs";
+import { n as HARNESS_WARM_TRANSPORT_ENV } from "./harness-contracts-BZoECCMc.mjs";
+import { ProxySecretBindingSchema, ProxySecretGrantSchema, ProxySecretReceiptSchema, ProxySecretUpdateControlsSchema, ProxySecretsSchema, isProxySecretScopeAttenuation, ownPropertyRecordSchema, proxySecretPresentationsEqual } from "@tangle-network/agent-interface";
 import { z } from "zod";
-/**
-* Strip the per-sandbox salt, returning the shared base token. The reverse
-* lookup (token -> secret env var name) keys on the base, so a salted token must
-* be reduced here before lookup. An unsalted token (no separator) is returned
-* as-is.
-*/
 function baseProxyToken(token) {
 	const i = token.indexOf(".");
 	return i === -1 ? token : token.slice(0, i);
 }
-/**
-* The dummy model credential the egress proxy swaps for each env var a box
-* may carry. A box holds only these, salted per sandbox; the real keys stay
-* with the egress proxy. Host-side proxy configuration adds the non-model
-* tokens.
-*/
 const MODEL_PROXY_TOKENS = {
 	OPENCODE_MODEL_API_KEY: "proxy-model-token",
 	OPENAI_API_KEY: "proxy-openai-token",
@@ -33,15 +21,14 @@ new Set([
 	"GITHUB_TOKEN",
 	"GH_TOKEN"
 ]);
-/**
-* Fixed proxy slot names. The egress layer keys every secret it holds by an
-* env-var-shaped name, and its persistence and recovery paths list those
-* names; a declaration takes the slot at its index, so a sandbox with
-* declarations needs no name the layer has not already listed.
-*/
+/** Proxy-private slot names shared by legacy and canonical bindings. */
 function declaredSecretSlotEnvVar(index) {
 	return `TANGLE_DECLARED_SLOT_${index}`;
 }
+/** True for a slot name, which exists at the proxy and never in a box env. */
+function isDeclaredSecretSlotEnvVar(name) {
+	return /^TANGLE_DECLARED_SLOT_\d+$/.test(name);
+}
 /** The base placeholder for the slot at `index`; the box holds it salted. */
 function declaredSecretBaseToken(index) {
 	return `proxy-declared-${index}-token`;
@@ -53,6 +40,44 @@ function declaredSecretSlotTokens() {
 	return slots;
 }
 //#endregion
+//#region ../runtime-contracts/dist/proxy-secret-materialization.js
+const syntheticHeader = {
+	alg: "HS256",
+	typ: "JWT"
+};
+const encode = (value) => btoa(value instanceof Uint8Array ? String.fromCharCode(...value) : JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+function placeholderPrefix(slot, format, expiresAt) {
+	return format === "jwt" ? `${encode(syntheticHeader)}.${encode({
+		sub: "sandbox-placeholder",
+		aud: "proxy-secret-placeholder",
+		exp: Math.floor(Date.parse(expiresAt) / 1e3)
+	})}.` : `proxy-declared-${slot.slice(21)}-token-`;
+}
+function isSyntheticPlaceholder(material) {
+	const prefix = placeholderPrefix(material.slot, material.grant.placeholderFormat, material.issuerExpiresAt);
+	return material.placeholder.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/.test(material.placeholder.slice(prefix.length));
+}
+z.array(z.strictObject({
+	binding: ProxySecretBindingSchema,
+	grant: ProxySecretGrantSchema,
+	placeholder: z.string().min(1),
+	slot: z.string().refine(isDeclaredSecretSlotEnvVar),
+	issuerExpiresAt: z.iso.datetime(),
+	native: z.unknown().optional()
+})).superRefine((materials, ctx) => {
+	const bindings = ProxySecretsSchema.safeParse(materials.map((m) => m.binding));
+	const unique = (values) => new Set(values).size === values.length;
+	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
+		code: "custom",
+		message: "Invalid proxy secret materialization"
+	});
+});
+ProxySecretUpdateControlsSchema.extend({
+	resolvedSecrets: ownPropertyRecordSchema(z.string().min(1), { maxEntries: Number.MAX_SAFE_INTEGER }).default({}),
+	proxySecretGrants: ProxySecretReceiptSchema.options[0].shape.bindings,
+	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration.unwrap()
+}).strict().refine((body) => new Set(body.proxySecretGrants.map((b) => b.envName)).size === body.proxySecretGrants.length);
+//#endregion
 //#region ../runtime-contracts/dist/runtime-environment.js
 const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function isSafeEnvVarName(name) {
@@ -60,6 +85,23 @@ function isSafeEnvVarName(name) {
 	if (name.length === 0 || name.length > 256) return false;
 	return SAFE_ENV_VAR_NAME_RE.test(name);
 }
+/** Client proxy URLs first, then bypass names. */
+const EGRESS_PROXY_ENV_NAMES = [
+	"HTTPS_PROXY",
+	"https_proxy",
+	"HTTP_PROXY",
+	"http_proxy",
+	"NO_PROXY",
+	"no_proxy"
+];
+const CA_TRUST_ENV_NAMES = [
+	"NODE_EXTRA_CA_CERTS",
+	"SSL_CERT_FILE",
+	"CURL_CA_BUNDLE",
+	"GIT_SSL_CAINFO",
+	"NIX_SSL_CERT_FILE"
+];
+[...EGRESS_PROXY_ENV_NAMES, ...CA_TRUST_ENV_NAMES];
 const FORBIDDEN_ENV_VAR_NAMES = new Set([
 	"LD_PRELOAD",
 	"LD_LIBRARY_PATH",
@@ -133,20 +175,10 @@ function isForbiddenEnvVarName(name) {
 	return false;
 }
 /**
-* Env record schema that enforces POSIX env-var name shape (via
-* {@link isSafeEnvVarName}) on every key. Suitable for env that flows
-* into a container the caller owns (user code), where names like
-* `PATH`, `NODE_OPTIONS`, `LD_PRELOAD`, or `HTTPS_PROXY` are legitimate
-* because the user controls the resulting process environment.
-*
-* Callers that merge env into the runtime's OWN process.env (sidecar
-* `/config/env`, orchestrator `/sidecars/start`, project provisioning)
-* MUST additionally reject the process-control blocklist via
-* {@link isForbiddenEnvVarName} — see
-* `apps/orchestrator/src/routes/sidecars.ts` and
-* `apps/sidecar/src/routes/agents-config.ts` for the canonical shape.
+* POSIX names for caller-owned container env. Runtime process.env merges must additionally enforce
+* isForbiddenEnvVarName, including project provisioning and Sidecar config.
 */
-const safeEnvRecordSchema = z.record(z.string(), z.string()).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
+const safeEnvRecordSchema = ownPropertyRecordSchema(z.string(), { maxEntries: Number.MAX_SAFE_INTEGER }).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
 /** Names only: the caller must keep a separate source and pass values to resume({ env }). */
 const sandboxEnvRecoverySchema = z.object({ callerResupplies: z.array(z.string().max(256).refine(isSafeEnvVarName, { message: "invalid env var name" })).max(128).refine((keys) => new Set(keys).size === keys.length, { message: "callerResupplies must contain unique keys" }) }).strict();
 z.object({
@@ -164,4 +196,4 @@ safeEnvRecordSchema.refine((value) => Object.keys(value).every((key) => !isForbi
 //#endregion
 export { baseProxyToken as i, isSafeEnvVarName as n, declaredSecretSlotTokens as r, isForbiddenEnvVarName as t };
 
-//# sourceMappingURL=harness-DIdVNSwl.mjs.map
+//# sourceMappingURL=harness-D1fTxnDD.mjs.map