@themoltnet/agent-daemon 0.52.0 → 0.54.0

package/README.md

@@ -81,31 +81,50 @@ All config flows from environment variables. The daemon reads them in
 
 ### MoltNet identity
 
-| Var                   | Required                              | Purpose                                                                    |
-| --------------------- | ------------------------------------- | -------------------------------------------------------------------------- |
-| `GIT_CONFIG_GLOBAL`   | OAuth2/local                          | Optional git identity path; not needed for configless agent-key startup.   |
-| `MOLTNET_AGENT_NAME`  | yes                                   | Agent name (matches `.moltnet/<name>/`).                                   |
-| `MOLTNET_API_URL`     | agent-key only                        | Explicit API endpoint; key mode never reads it from `moltnet.json`.        |
-| `MOLTNET_AGENT_KEY`   | no                                    | Team- or identity-scoped agent key. Set to authenticate instead of OAuth2. |
-| `MOLTNET_PRIVATE_KEY` | agent-key `once`, `poll`, and `drain` | Base64 Ed25519 seed used by daemon-owned executor attestation.             |
-
-For OAuth2/local mode, the agent's `moltnet.json` and gitconfig live next to
+| Var                   | Required                           | Purpose                                                                   |
+| --------------------- | ---------------------------------- | ------------------------------------------------------------------------- |
+| `GIT_CONFIG_GLOBAL`   | config-based                       | Optional git identity path; not needed for configless startup.            |
+| `MOLTNET_AGENT_NAME`  | yes                                | Agent name (matches `.moltnet/<name>/`).                                  |
+| `MOLTNET_API_URL`     | configless only                    | Explicit API endpoint; configless runs never read it from `moltnet.json`. |
+| `MOLTNET_AGENT_KEY`   | no                                 | Team- or identity-scoped agent key. Overrides `moltnet.json`.             |
+| `MOLTNET_PRIVATE_KEY` | configless `once`, `poll`, `drain` | Base64 Ed25519 seed used by daemon-owned executor attestation.            |
+
+For config-based runs, the agent's `moltnet.json` and gitconfig live next to
 each other in `.moltnet/<agent>/`. Provision them once via
 [`moltnet agents init`](../../docs/start/install-and-initialize.md#initialize-an-autonomous-agent).
 
-**Auth mode.** When `MOLTNET_AGENT_KEY` is set the daemon authenticates with
-that key as an opaque bearer token (no OAuth2 exchange); otherwise it uses the
-OAuth2 client-credentials from `moltnet.json`. The key is read from the
-environment only — never store it in `moltnet.json`. The daemon reconciles a
-team-bound key against `--team` at startup; an identity-scoped key may select
-any team where the agent is authorized. It fails fast if the key is rejected,
-is not an agent, or a team binding mismatches. See
+**The daemon runs on an agent key only.** OAuth2 client_credentials is not
+accepted: it hands the daemon the full 17-scope agent grant against a six-scope
+need, and a Hydra token cannot be a Talos derivation parent. A `moltnet.json`
+without `agent_key_ref` is refused at startup with the command that fixes it.
+
+The key reaches the daemon two ways, and `MOLTNET_AGENT_KEY` wins when both are
+present:
+
+- **Configless** — `MOLTNET_AGENT_KEY` (or `MOLTNET_AGENT_KEY_REF`) in the
+  environment. No agent files are read at all.
+- **From `moltnet.json`** — an `agent_key_ref` pointing at a secret provider,
+  which is what `moltnet agents keys create --store` writes. The plaintext
+  secret never lands in the file.
+
+Mint or rotate the key with the CLI, which is separate operator tooling and
+keeps using OAuth2 for its own authentication:
+
+```bash
+moltnet agents keys create --agent-id <uuid> --team-id <uuid> \
+  --name <agent>-daemon --store
+moltnet agents keys rotate <key-id> --team-id <uuid> --store
+```
+
+The daemon reconciles a team-bound key against `--team` at startup; an
+identity-scoped key may select any team where the agent is authorized. It fails
+fast if the key is rejected, is not an agent, or a team binding mismatches. See
 [Run the daemon with an agent key](../../docs/operate/agent-keys.md#run-the-daemon-with-an-agent-key).
 
-Daemon authentication and the guest boundary are two separate concerns. How the
-daemon authenticates (an agent key, or OAuth2 resolved from
-`.moltnet/<agent>/moltnet.json` through the host secret provider) decides how the
-host-side SDK `Agent` is built. The guest boundary is fixed: **the guest never
+Daemon authentication and the guest boundary are two separate concerns. Where
+the agent key comes from (the environment, or an `agent_key_ref` in
+`.moltnet/<agent>/moltnet.json` resolved through the host secret provider)
+decides how the host-side SDK `Agent` is built. The guest boundary is fixed: **the guest never
 receives MoltNet credential material.** No `.moltnet` file, gitconfig, SSH
 signing key, GitHub App PEM, or MoltNet environment credential is injected into
 Gondolin, and mounted `.moltnet` paths are hidden. Structured MoltNet tools
@@ -135,14 +154,22 @@ of `MOLTNET_PRIVATE_KEY`.
 An agent key used by the daemon needs this least-privilege scope set:
 
 ```text
-agent:profile runtime:read task:read task:claim task:execute
+agent:profile crypto:sign runtime:read task:read task:claim task:execute
 ```
 
-The Console selects these five scopes by default. Knowledge-enabled workers
-must add `diary:read`, `diary:write`, `pack:read`, and `pack:write` when the key
-is issued. Runtime policy can narrow key authority but cannot add missing
-scopes, and existing keys are never widened automatically; issue a replacement
-credential when broader authority is required.
+The Console selects these scopes by default. Knowledge-enabled workers must add
+`diary:read`, `diary:write`, `pack:read`, and `pack:write` when the key is
+issued.
+
+`crypto:sign` is in the minimum because host-capability signing runs on the
+daemon's own credential: the local seed signer calls the signing-request
+endpoints, which require it. Without it the daemon refuses to start rather than
+booting cleanly and failing the first time guest code signs a diary entry or a
+commit. Keys issued with the older five-scope set must be reissued.
+
+Runtime policy can narrow key authority but cannot add missing scopes, and
+existing keys are never widened automatically; issue a replacement credential
+when broader authority is required.
 
 ### Pi provider auth
 

package/dist/cli.js

@@ -13,9 +13,9 @@ import { parseArgs, promisify } from "node:util";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
 import { FILE_SECRET_PROVIDER, FileSecretProvider, connect, createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
-import { execFile, execFileSync, spawn } from "node:child_process";
-import { constants, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { AuthenticationError, MoltNetError, agentKeyKey, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, identitySeedKey, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, resolveOAuth2ClientSecret } from "@themoltnet/sdk";
+import { constants, cpSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, agentKeyKey, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, getConfigDir, getIdentityDir, identitySeedKey, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, resolveOAuth2ClientSecret } from "@themoltnet/sdk";
+import { execFile, spawn } from "node:child_process";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
 import { once } from "node:events";
 import { metrics } from "@opentelemetry/api";
@@ -36,13 +36,13 @@ import { lock, lockSync } from "proper-lockfile";
 import { ModelRuntime, readStoredCredential } from "@earendil-works/pi-coding-agent";
 import { Transform, Writable } from "node:stream";
 import { writePiConfig } from "@themoltnet/pi-runtime/pi-config";
-import { homedir, platform } from "node:os";
 import { pathToFileURL } from "node:url";
 import { StringDecoder } from "node:string_decoder";
 import rateLimit from "@fastify/rate-limit";
 import Fastify from "fastify";
 import { isIP } from "node:net";
 import "reflect-metadata";
+import { homedir, platform } from "node:os";
 import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, IP, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, X509CertificateGenerator } from "@peculiar/x509";
 import { createGzip } from "node:zlib";
 //#region ../../libs/tasks/src/rubric.ts
@@ -779,16 +779,30 @@ var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
 /**
 * Minimum grant for the agent daemon. Task credentials attenuate this further
 * to `task:execute` alone.
+*
+* `crypto:sign` is part of the minimum because host-capability signing runs on
+* the daemon's own credential: the local seed signer calls the signing-request
+* endpoints, which require it. A grant without it produces a daemon that boots
+* cleanly and then fails the first time guest code signs a diary entry or a
+* commit.
 */
 var AGENT_CREDENTIAL_SCOPES = [
 	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
 	CREDENTIAL_SCOPES.RuntimeRead,
 	CREDENTIAL_SCOPES.TaskRead,
 	CREDENTIAL_SCOPES.TaskClaim,
 	CREDENTIAL_SCOPES.TaskExecute
 ];
 Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
-[
+/**
+* REST capabilities exercised by the current MCP tool surface.
+*
+* Intentionally excludes connector invocation, key management, runtime
+* management/read, and task claiming because MCP exposes none of those
+* operations.
+*/
+var MCP_CLIENT_SCOPES = [
 	CREDENTIAL_SCOPES.AgentProfile,
 	CREDENTIAL_SCOPES.CryptoSign,
 	CREDENTIAL_SCOPES.DiaryManage,
@@ -802,7 +816,13 @@ Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPE
 	CREDENTIAL_SCOPES.TaskRead,
 	CREDENTIAL_SCOPES.TeamManage,
 	CREDENTIAL_SCOPES.TeamRead
-].filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+];
+MCP_CLIENT_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+Object.freeze([...[
+	"openid",
+	"offline",
+	"offline_access"
+], ...MCP_CLIENT_SCOPES]);
 //#endregion
 //#region ../../libs/models/src/preview-sign.ts
 function schemaRef$2(schema, id) {
@@ -3444,9 +3464,19 @@ Commands:
 Run \`agent-daemon <command> --help\` for command-specific flags.
 
 Prerequisites:
-  - agent-key mode: MOLTNET_AGENT_KEY (or MOLTNET_AGENT_KEY_REF) and
+  - configless: MOLTNET_AGENT_KEY (or MOLTNET_AGENT_KEY_REF) and
     MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF); no agent files
-  - OAuth2 and sync-sessions: <agent-root>/.moltnet/<agent>/moltnet.json
+  - config-based and sync-sessions: <agent-root>/.moltnet/<agent>/moltnet.json
+    carrying agent_key_ref (OAuth2 client credentials are not accepted)
+
+No key yet? Mint one with the CLI (--store writes agent_key_ref into
+moltnet.json and keeps the secret in a provider):
+
+  moltnet teams list             # find the team id
+  moltnet agents keys create --team-id <team-uuid> \\
+    --name <agent>-daemon --store
+
+  https://docs.themolt.net/operate/agent-keys#run-the-daemon-with-an-agent-key
   - --profile — remote runtime profile supplies provider/model/sandbox
     policy and CWD is used as the VM mountPath.
 
@@ -3610,18 +3640,30 @@ function assessIdentityPin(current, expected) {
 //#endregion
 //#region src/lib/agent-context.ts
 /**
-* Report which auth mode `connect()` will use, without ever reading the secret
-* value into anything logged. Agent-key mode is selected when
-* `MOLTNET_AGENT_KEY` or `MOLTNET_AGENT_KEY_REF` holds a non-blank value —
-* mirroring the SDK precedence
-* where an environment key opts into key mode ahead of the config-file OAuth2
-* credentials. The daemon never passes explicit in-code credentials to
-* `connect()`, so this env-only check matches what `connect()` actually does.
+* Where an operator goes after the daemon refuses to start. The published site
+* rather than a GitHub blob: it renders, and it tracks the deployed docs
+* instead of whatever `main` happens to say. Sidebar entry lives in
+* `docs/.vitepress/config.ts`.
+*/
+var AGENT_KEYS_DOC_URL = "https://docs.themolt.net/operate/agent-keys#run-the-daemon-with-an-agent-key";
+/** Scopes a daemon key must carry; mirrors `DAEMON_REQUIRED_SCOPES`. */
+var DAEMON_KEY_SCOPES = AGENT_CREDENTIAL_SCOPES;
+/**
+* Report where `connect()` will find the key, without ever reading the secret
+* value into anything logged. A non-blank `MOLTNET_AGENT_KEY` or
+* `MOLTNET_AGENT_KEY_REF` means configless; otherwise the key comes from
+* `moltnet.json`. This mirrors the SDK precedence, where an environment key
+* wins over the config file.
+*
+* It reports the *source*, not what `connect()` would pick on its own: the
+* config path resolves the key and passes it explicitly, because ambient
+* resolution ranks environment OAuth2 credentials above a configured
+* `agent_key_ref` (see `resolveAgentContext`).
 *
 * Pure: `env` is passed in (the config module owns the `process.env` read).
 */
-function detectAuthMode(env) {
-	return env.MOLTNET_AGENT_KEY?.trim() || env.MOLTNET_AGENT_KEY_REF?.trim() ? "agent-key" : "oauth2";
+function detectCredentialSource(env) {
+	return env.MOLTNET_AGENT_KEY?.trim() || env.MOLTNET_AGENT_KEY_REF?.trim() ? "environment" : "config";
 }
 /**
 * Pure check: may the identity described by `whoami` operate the daemon as
@@ -3677,40 +3719,111 @@ async function validateStartupBinding(options) {
 /**
 * Resolve the agent's MoltNet credentials directory and connect via SDK.
 *
-* Looks under an explicit agent root first, then falls back to the git root
-* when available. Fails fast if the dir is missing — credentials are required,
-* the daemon never falls back to unauthenticated calls.
+* The daemon selects the same central identity directory as the CLI. It never
+* inspects a repository, Git state, or legacy agent bundle for credentials.
 */
 async function resolveAgentContext(agentName, options = {}) {
-	if (!/^[a-zA-Z0-9_-]+$/.test(agentName)) throw new Error(`Invalid agent name "${agentName}": must match /^[a-zA-Z0-9_-]+$/`);
-	const roots = resolveCredentialRoots(options.agentRootDir);
-	if (options.authMode === "agent-key") {
-		const rootDir = roots[0] ?? process.cwd();
-		return {
-			agentDir: join(rootDir, ".moltnet", agentName),
-			agentRootDir: rootDir,
-			agent: await connect({ secretProviders: createNodeSecretProviderRegistry() }),
-			credentialSource: "environment",
-			authMechanism: "agent-key"
-		};
-	}
-	const located = locateAgentConfig(roots, agentName);
-	if (located) {
-		const agent = await connect({
-			configDir: located.agentDir,
-			secretProviders: createNodeSecretProviderRegistry()
-		});
-		const config = await readConfig(located.agentDir);
-		return {
-			agentDir: located.agentDir,
-			agentRootDir: located.rootDir,
-			agent,
-			credentialSource: "config",
-			authMechanism: config?.agent_key_ref ? "agent-key" : "oauth2"
+	assertIdentityAlias(agentName);
+	const { agentDir, agentRootDir } = resolveIdentityLocation(agentName, options.agentRootDir, { requireConfig: options.credentialSource !== "environment" });
+	if (options.credentialSource === "environment") return {
+		agentDir,
+		agentRootDir,
+		agent: await connect({ secretProviders: createNodeSecretProviderRegistry() }),
+		credentialSource: "environment"
+	};
+	const config = await readConfig(agentDir);
+	if (!config?.agent_key_ref) throw new Error(agentKeyRequiredMessage(agentDir, agentName));
+	const secretProviders = createNodeSecretProviderRegistry();
+	const agentKey = await resolveAgentKey(config, secretProviders);
+	if (!agentKey) throw new Error(agentKeyRequiredMessage(agentDir, agentName));
+	return {
+		agentDir,
+		agentRootDir,
+		agent: await connect({
+			configDir: agentDir,
+			secretProviders,
+			agentKey,
+			apiUrl: resolveConfigApiUrl(config, options.envApiUrl)
+		}),
+		credentialSource: "config"
+	};
+}
+/**
+* The daemon runs on an agent key only. A `moltnet.json` carrying OAuth2
+* client credentials but no `agent_key_ref` is the pre-#2160 shape, and
+* `connect()` would happily authenticate it — so this has to be refused here
+* rather than left to surface as an over-scoped token later.
+*/
+function agentKeyRequiredMessage(agentDir, agentName) {
+	return [
+		`${join(agentDir, "moltnet.json")} has no "agent_key_ref". The daemon`,
+		`requires a team-bound agent key; OAuth2 client_credentials is no longer`,
+		`accepted.`,
+		``,
+		`Mint one (--agent-id defaults to the agent you authenticate as):`,
+		``,
+		`  moltnet teams list             # find the team id`,
+		`  moltnet agents keys create \\`,
+		`    --team-id <team-uuid> \\`,
+		`    --name ${agentName}-daemon \\`,
+		`    --scopes ${DAEMON_KEY_SCOPES.join(",")} \\`,
+		`    --store`,
+		``,
+		`--store writes "agent_key_ref" into moltnet.json and keeps the secret in`,
+		`a provider, so the key itself never lands in the file. Omit --scopes to`,
+		`get the same daemon minimum by default.`,
+		``,
+		`To run configless instead, set MOLTNET_AGENT_KEY (or`,
+		`MOLTNET_AGENT_KEY_REF) and skip the config entirely.`,
+		``,
+		`Full guide: ${AGENT_KEYS_DOC_URL}`
+	].join("\n");
+}
+/**
+* The central identity directory, unless an explicit `--agent-root` names a
+* legacy bundle that actually exists.
+*
+* The flag is documented as "Directory that owns .moltnet/<agent>" and is still
+* accepted by `once`, `poll` and `sync-sessions`. Ignoring it silently sent
+* every caller that passes one — sandboxed runs, the e2e harness — to a
+* central store they never populated, and failed with a bare "No credentials
+* found".
+*/
+/**
+* `agentDir` is where credentials live; `agentRootDir` is the directory that
+* OWNS it and is mounted into the sandbox. They differ for a legacy bundle
+* (`<root>/.moltnet/<agent>` inside `<root>`) and coincide for a central
+* identity, which owns nothing above itself. Collapsing them mounted the
+* credentials directory itself into the guest.
+*/
+function resolveIdentityLocation(agentName, explicitRootDir, { requireConfig }) {
+	const root = explicitRootDir?.trim();
+	if (root) {
+		const bundle = join(root, ".moltnet", agentName);
+		if (!requireConfig || existsSync(join(bundle, "moltnet.json"))) return {
+			agentDir: bundle,
+			agentRootDir: root
 		};
 	}
-	const tried = roots.map((root) => join(root, ".moltnet", agentName));
-	throw new Error(`Missing credentials for ${agentName}. Checked ${tried.join(", ")}. Run the agent onboarding flow first.`);
+	const central = getIdentityDir(agentName);
+	return {
+		agentDir: central,
+		agentRootDir: central
+	};
+}
+/**
+* Pick the API URL for an explicitly-keyed connect, preserving the checks
+* ambient config resolution would have applied. An explicit `apiUrl` skips
+* ambient's own normalisation, so a URL taken from `moltnet.json` still has to
+* clear the config-trust and transport checks before it is used.
+*/
+function resolveConfigApiUrl(config, envApiUrl) {
+	if (envApiUrl?.trim()) return void 0;
+	const fromConfig = config.endpoints?.api?.trim();
+	if (!fromConfig) return void 0;
+	assertTrustedConfigApiUrl(fromConfig);
+	requireSecureCredentialApiUrl(fromConfig);
+	return fromConfig;
 }
 function isTransientWhoamiError(error) {
 	if (error instanceof TypeError) return true;
@@ -3718,26 +3831,6 @@ function isTransientWhoamiError(error) {
 	const statusCode = error.statusCode;
 	return typeof statusCode === "number" && (statusCode === 408 || statusCode === 429 || statusCode >= 500);
 }
-function locateAgentConfig(roots, agentName) {
-	for (const rootDir of roots) {
-		const agentDir = join(rootDir, ".moltnet", agentName);
-		if (existsSync(join(agentDir, "moltnet.json"))) return {
-			rootDir,
-			agentDir
-		};
-	}
-}
-function resolveCredentialRoots(agentRootDir) {
-	const roots = agentRootDir ? [agentRootDir] : [];
-	try {
-		const gitRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-			encoding: "utf8",
-			stdio: "pipe"
-		}).trim();
-		if (!roots.includes(gitRoot)) roots.push(gitRoot);
-	} catch {}
-	return roots;
-}
 //#endregion
 //#region src/config.ts
 /**
@@ -3757,7 +3850,8 @@ function loadConfig() {
 		profilePrerequisiteEnv: process.env,
 		profilePrerequisitePath: process.env.PATH ?? "",
 		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? "",
-		authMode: detectAuthMode(process.env),
+		credentialSource: detectCredentialSource(process.env),
+		apiUrl: process.env["MOLTNET_API_URL"] ?? "",
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
 		signingPrivateKeyRef: process.env["MOLTNET_PRIVATE_KEY_REF"] ?? "",
 		gitAuthor: process.env["MOLTNET_GIT_AUTHOR"] ?? "",
@@ -3832,13 +3926,13 @@ async function abortActiveAttemptOnSignal(opts) {
 //#region src/lib/agent-identity.ts
 /**
 * Build the non-secret identity projected into guests. Host git config is a
-* non-secret input and is consulted only on OAuth2 hosts, which already read
-* that configuration for the signing seed; configless agent-key hosts never
-* touch a config directory.
+* non-secret input and is consulted only on config-based hosts, which already
+* read that configuration for the signing seed; configless hosts never touch a
+* config directory.
 */
 async function resolveDaemonAgentIdentity(input) {
 	let hostGit;
-	if (input.gitAuthor === void 0 && input.authMode === "oauth2") {
+	if (input.gitAuthor === void 0 && input.credentialSource === "config") {
 		const config = await readConfig(input.agentDir);
 		hostGit = config?.git ? {
 			name: config.git.name,
@@ -4383,26 +4477,26 @@ function recoverScratchWorkspacePath(producer, stateDirs) {
 //#region src/lib/executor-attestation.ts
 var DAEMON_REQUIRED_SCOPES = AGENT_CREDENTIAL_SCOPES;
 async function resolveExecutorSigningPrivateKey(input) {
-	if (input.authMode === "agent-key") {
+	if (input.credentialSource === "environment") {
 		const privateKey = input.configuredPrivateKey.trim();
 		if (privateKey) return privateKey;
 		const reference = input.configuredPrivateKeyRef?.trim();
-		if (!reference) throw new Error("Agent-key daemon startup requires MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF) containing the base64-encoded Ed25519 private key seed.");
+		if (!reference) throw new Error("Configless daemon startup requires MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF) containing the base64-encoded Ed25519 private key seed.");
 		let resolved;
 		try {
 			resolved = await resolveEnvSecretReference(reference, createNodeSecretProviderRegistry());
 		} catch (cause) {
-			throw new Error(`Agent-key daemon startup could not resolve MOLTNET_PRIVATE_KEY_REF: ${cause.message}`, { cause });
+			throw new Error(`Configless daemon startup could not resolve MOLTNET_PRIVATE_KEY_REF: ${cause.message}`, { cause });
 		}
 		if (Buffer.from(resolved, "base64").length !== 32) throw new Error("MOLTNET_PRIVATE_KEY_REF must resolve to a base64-encoded 32-byte Ed25519 seed.");
 		return resolved;
 	}
 	const config = await readConfig(input.agentDir);
-	if (!config) throw new Error(`OAuth2 daemon startup requires ${input.agentDir}/moltnet.json.`);
+	if (!config) throw new Error(`Config-based daemon startup requires ${input.agentDir}/moltnet.json.`);
 	try {
 		return await resolveIdentitySeed(config, createNodeSecretProviderRegistry());
 	} catch (cause) {
-		throw new Error(`OAuth2 daemon startup could not resolve the signing seed from ${input.agentDir}/moltnet.json (keys.private_key or keys.private_key_ref): ${cause.message}`, { cause });
+		throw new Error(`Config-based daemon startup could not resolve the signing seed from ${input.agentDir}/moltnet.json (keys.private_key or keys.private_key_ref): ${cause.message}`, { cause });
 	}
 }
 function validateDaemonScopes(whoami) {
@@ -5098,7 +5192,7 @@ async function logDaemonStartupFailure(input) {
 		event: "agent-daemon.startup_failed",
 		gate: input.gate,
 		agent: input.agent,
-		authMode: input.authMode
+		credentialSource: input.credentialSource
 	}, "Agent daemon startup validation failed");
 	await shutdown();
 }
@@ -5917,13 +6011,14 @@ async function runPolling(opts) {
 		bindings: cfg.credentialBindings
 	};
 	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
-	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
+	const explicitAgentRootDir = values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0;
 	const { ctx, signingPrivateKey, startupWhoami, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
 		try {
 			const resolvedContext = await resolveAgentContext(baseCommon.agent, {
-				agentRootDir,
-				authMode: cfg.authMode
+				agentRootDir: explicitAgentRootDir,
+				credentialSource: cfg.credentialSource,
+				envApiUrl: cfg.apiUrl
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -5933,7 +6028,7 @@ async function runPolling(opts) {
 			});
 			gate = "resolve_signing_material";
 			const privateKey = await resolveExecutorSigningPrivateKey({
-				authMode: cfg.authMode,
+				credentialSource: cfg.credentialSource,
 				agentDir: resolvedContext.agentDir,
 				configuredPrivateKey: cfg.signingPrivateKey,
 				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
@@ -5949,7 +6044,7 @@ async function runPolling(opts) {
 			const agentIdentity = await resolveDaemonAgentIdentity({
 				agentName: baseCommon.agent,
 				whoami,
-				authMode: cfg.authMode,
+				credentialSource: cfg.credentialSource,
 				agentDir: resolvedContext.agentDir,
 				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
 			});
@@ -5970,7 +6065,7 @@ async function runPolling(opts) {
 				level: cfg.logLevel || (baseCommon.debug ? "debug" : "info"),
 				gate,
 				agent: baseCommon.agent,
-				authMode: cfg.authMode,
+				credentialSource: cfg.credentialSource,
 				error
 			});
 			throw error;
@@ -6074,7 +6169,7 @@ async function runPolling(opts) {
 		resourceAttributes: {
 			"moltnet.team.id": teamId,
 			"moltnet.agent.name": baseCommon.agent,
-			"moltnet.auth.mode": ctx.authMechanism,
+			"moltnet.credential.source": ctx.credentialSource,
 			"moltnet.runtime_profile.count": String(profiles.length),
 			"moltnet.runtime_profile.ids": profiles.map((p) => p.id).join(",")
 		}
@@ -6122,7 +6217,7 @@ async function runPolling(opts) {
 		}
 	});
 	rootLogger.info({
-		authMode: cfg.authMode,
+		credentialSource: cfg.credentialSource,
 		subjectType: startupWhoami.subjectType,
 		bindingScope: startupWhoami.credentialBinding?.bindingScope ?? null,
 		credentialKeyId: startupWhoami.credentialBinding?.keyId ?? null,
@@ -6574,13 +6669,14 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 	};
 	const runtimeCredentialConfig = resolveCredentialEnforcement(cfg.credentialEnforcement, credentialSources) === "off" ? null : loadRuntimeCredentialConfig(credentialSources);
 	const initialOpts = opts;
-	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
+	const explicitAgentRootDir = values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0;
 	const { ctx, signingPrivateKey, agentIdentity, hostCapabilitySigner } = await (async () => {
 		let gate = "resolve_agent_context";
 		try {
 			const resolvedContext = await resolveAgentContext(initialOpts.agent, {
-				agentRootDir,
-				authMode: cfg.authMode
+				agentRootDir: explicitAgentRootDir,
+				credentialSource: cfg.credentialSource,
+				envApiUrl: cfg.apiUrl
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
@@ -6590,7 +6686,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			});
 			gate = "resolve_signing_material";
 			const privateKey = await resolveExecutorSigningPrivateKey({
-				authMode: cfg.authMode,
+				credentialSource: cfg.credentialSource,
 				agentDir: resolvedContext.agentDir,
 				configuredPrivateKey: cfg.signingPrivateKey,
 				configuredPrivateKeyRef: cfg.signingPrivateKeyRef
@@ -6606,7 +6702,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			const agentIdentity = await resolveDaemonAgentIdentity({
 				agentName: initialOpts.agent,
 				whoami,
-				authMode: cfg.authMode,
+				credentialSource: cfg.credentialSource,
 				agentDir: resolvedContext.agentDir,
 				gitAuthor: values["git-author"] ?? (cfg.gitAuthor || void 0)
 			});
@@ -6626,7 +6722,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 				level: cfg.logLevel || (initialOpts.debug ? "debug" : "info"),
 				gate,
 				agent: initialOpts.agent,
-				authMode: cfg.authMode,
+				credentialSource: cfg.credentialSource,
 				error
 			});
 			throw error;
@@ -6696,7 +6792,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		resourceAttributes: {
 			"moltnet.task.id": taskId,
 			"moltnet.agent.name": opts.agent,
-			"moltnet.auth.mode": ctx.authMechanism,
+			"moltnet.credential.source": ctx.credentialSource,
 			"moltnet.llm.provider": profile.provider,
 			"moltnet.llm.model": profile.model,
 			...profile.thinkingLevel ? { "moltnet.llm.thinking_level": profile.thinkingLevel } : {},
@@ -7745,11 +7841,14 @@ function snapshot(login) {
 		...waitingForAuthorization ? { waitingForAuthorization } : {}
 	};
 }
-var NAME_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+var NAME_RE = IDENTITY_ALIAS_PATTERN;
 var PROVIDER_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function assertStoreName(kind, value) {
-	if (!NAME_RE.test(value)) throw new AgentServerStoreError("invalid_name", `${kind} must match ${NAME_RE.source}`);
-	return value;
+	try {
+		return assertIdentityAlias(value);
+	} catch {
+		throw new AgentServerStoreError("invalid_name", `${kind} must match ${NAME_RE.source}`);
+	}
 }
 function assertProviderId(value) {
 	if (!PROVIDER_ID_RE.test(value)) throw new AgentServerStoreError("invalid_name", `provider id must match ${PROVIDER_ID_RE.source}`);
@@ -7762,12 +7861,46 @@ var AgentServerStoreError = class extends Error {
 		this.code = code;
 	}
 };
-/** `MOLTNET_AGENT_SERVER_ROOT` override, else `$XDG_CONFIG_HOME/moltnet`, else `~/.config/moltnet`. */
+/**
+* `MOLTNET_AGENT_SERVER_ROOT` override, else `~/.config/moltnet`.
+*
+* Deliberately does NOT consult `XDG_CONFIG_HOME`. The Go CLI's GetConfigDir
+* and @moltnet/agent-config's getConfigDir both resolve `~/.config/moltnet`,
+* so honouring XDG here gave one application two config roots: on a machine
+* with the variable set, the daemon wrote identities the CLI and SDK could not
+* read. `MOLTNET_AGENT_SERVER_ROOT` remains the explicit escape hatch for a
+* genuinely custom location. The XDG parameter is gone rather than ignored: an
+* accepted-but-discarded argument reads like it still works. Callers adopting
+* state from the old root pass it to ensure() instead.
+*/
 function resolveAgentServerRoot(input) {
 	const override = input.root?.trim();
 	if (override) return override;
-	const xdg = input.xdgConfigHome?.trim();
-	return join(xdg || join(homedir(), ".config"), "moltnet");
+	return getConfigDir();
+}
+/** The pre-#1834 root that honoured XDG_CONFIG_HOME, if it differs. */
+function legacyXdgAgentServerRoot(xdgConfigHome) {
+	const xdg = xdgConfigHome.trim();
+	if (!xdg) return null;
+	const legacy = join(xdg, "moltnet");
+	return legacy === resolveAgentServerRoot({}) ? null : legacy;
+}
+/** True when a root holds agent-server state worth preserving. */
+function hasAgentServerState(root) {
+	for (const child of [
+		"agent-server.json",
+		"identity-selector.json",
+		"identities",
+		"agents"
+	]) try {
+		if (readdirSync(join(root, child)).length > 0) return true;
+	} catch {
+		try {
+			readFileSync(join(root, child));
+			return true;
+		} catch {}
+	}
+	return false;
 }
 function providerEnvName(providerId) {
 	return `MOLTNET_PROVIDER_${assertProviderId(providerId).replaceAll("-", "_").toUpperCase()}_API_KEY`;
@@ -7805,14 +7938,14 @@ function writeJsonAtomic(path, value) {
 }
 var AgentServerStore = class {
 	root;
-	agentsDir;
+	identitiesDir;
 	runsDir;
 	secretsDir;
 	/** Shared Pi credential dir; `auth.json` inside is pi-managed (lockfiled). */
 	piDir;
 	constructor(root) {
 		this.root = root;
-		this.agentsDir = join(root, "agents");
+		this.identitiesDir = join(root, "identities");
 		this.runsDir = join(root, "runs");
 		this.secretsDir = join(root, "secrets");
 		this.piDir = join(root, "pi");
@@ -7821,18 +7954,85 @@ var AgentServerStore = class {
 		return join(this.piDir, "auth.json");
 	}
 	/** Create the directory layout (0700) if missing. Idempotent. */
-	ensure() {
+	ensure(options = {}) {
+		this.adoptLegacyXdgRoot(options.legacyXdgConfigHome ?? "");
 		for (const dir of [
 			this.root,
-			this.agentsDir,
+			this.identitiesDir,
 			this.runsDir,
 			this.secretsDir
 		]) mkdirSync(dir, {
 			recursive: true,
 			mode: 448
 		});
+		this.migrateLegacyAgentDocuments();
 		return this;
 	}
+	/**
+	* Adopt state left at the pre-#1834 XDG root.
+	*
+	* The daemon used to resolve `$XDG_CONFIG_HOME/moltnet` while the CLI and SDK
+	* resolved `~/.config/moltnet`. Aligning the root without this would silently
+	* orphan an existing daemon's entire state — it would come up reporting zero
+	* managed agents.
+	*/
+	adoptLegacyXdgRoot(xdgConfigHome) {
+		const legacyRoot = legacyXdgAgentServerRoot(xdgConfigHome);
+		if (!legacyRoot || legacyRoot === this.root) return;
+		if (!hasAgentServerState(legacyRoot)) return;
+		if (hasAgentServerState(this.root)) throw new AgentServerStoreError("invalid_state", `agent server state exists at both ${legacyRoot} (the pre-1834 XDG_CONFIG_HOME location) and ${this.root}. The daemon now shares ${this.root} with the CLI and SDK. Merge or remove one of them, or set MOLTNET_AGENT_SERVER_ROOT to choose explicitly.`);
+		mkdirSync(resolve(this.root, ".."), {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			if (readdirSync(this.root).length === 0) rmSync(this.root, { recursive: true });
+		} catch {}
+		try {
+			renameSync(legacyRoot, this.root);
+		} catch (error) {
+			if (error.code !== "EXDEV") throw new AgentServerStoreError("io_error", `could not adopt the pre-1834 agent server state at ${legacyRoot}: ${String(error.message)}. Move it to ${this.root} manually, or set MOLTNET_AGENT_SERVER_ROOT to choose a root explicitly.`);
+			cpSync(legacyRoot, this.root, { recursive: true });
+			rmSync(legacyRoot, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	/**
+	* Migrate managed documents from the pre-#1834 `agents/<alias>.json` layout
+	* to `identities/<alias>/moltnet.json`. Without this an upgraded daemon sees
+	* zero managed agents and reports a plain "not found".
+	*/
+	migrateLegacyAgentDocuments() {
+		const legacyDir = join(this.root, "agents");
+		let entries;
+		try {
+			entries = readdirSync(legacyDir);
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (!entry.endsWith(".json")) continue;
+			const alias = entry.slice(0, -5);
+			if (!NAME_RE.test(alias)) continue;
+			const legacyPath = join(legacyDir, entry);
+			const target = this.agentPath(alias);
+			if (readJson(target)) continue;
+			const config = readJson(legacyPath);
+			if (!config) continue;
+			mkdirSync(join(this.identitiesDir, alias), {
+				recursive: true,
+				mode: 448
+			});
+			writeJsonAtomic(target, config);
+			rmSync(legacyPath, { force: true });
+		}
+		if (readdirSync(legacyDir).length === 0) rmSync(legacyDir, {
+			recursive: true,
+			force: true
+		});
+	}
 	get statePath() {
 		return join(this.root, "agent-server.json");
 	}
@@ -7861,16 +8061,58 @@ var AgentServerStore = class {
 		writeJsonAtomic(this.statePath, state);
 	}
 	agentPath(name) {
-		return storeChildPath(this.agentsDir, "agent name", name, ".json");
+		return join(storeChildPath(this.identitiesDir, "identity alias", name), "moltnet.json");
+	}
+	/** Central identity directory, shared with the Go CLI layout. */
+	identityDir(name) {
+		return storeChildPath(this.identitiesDir, "identity alias", name);
+	}
+	get identitySelectorPath() {
+		return join(this.root, "identity-selector.json");
+	}
+	readIdentitySelector() {
+		const selector = readJson(this.identitySelectorPath);
+		if (!selector) return null;
+		if (!isRecord$1(selector) || selector.version !== 1 || selector.default_identity !== void 0 && typeof selector.default_identity !== "string") throw new AgentServerStoreError("invalid_state", "identity-selector.json is not a supported selector document");
+		if (selector.default_identity) assertStoreName("identity alias", selector.default_identity);
+		return selector;
+	}
+	writeIdentitySelector(alias) {
+		writeJsonAtomic(this.identitySelectorPath, {
+			version: 1,
+			default_identity: assertStoreName("identity alias", alias)
+		});
+	}
+	resolveIdentityAlias(explicit, active) {
+		const alias = explicit?.trim() || active?.trim() || this.readIdentitySelector()?.default_identity;
+		if (!alias) throw new AgentServerStoreError("not_found", "no active identity selected");
+		return assertStoreName("identity alias", alias);
 	}
 	readAgentConfig(alias) {
 		return readJson(this.agentPath(alias));
 	}
 	writeAgentConfig(alias, config) {
+		mkdirSync(this.identityDir(alias), {
+			recursive: true,
+			mode: 448
+		});
 		writeJsonAtomic(this.agentPath(alias), config);
+		if (!this.readIdentitySelector()?.default_identity) this.writeIdentitySelector(alias);
 	}
 	removeAgentConfig(alias) {
 		rmSync(this.agentPath(alias), { force: true });
+		this.clearIdentitySelectorIfDefault(alias);
+	}
+	/** Clears the persisted default when it names `alias`. */
+	clearIdentitySelectorIfDefault(alias) {
+		let selector = null;
+		try {
+			selector = this.readIdentitySelector();
+		} catch {
+			return;
+		}
+		if (!selector || selector.default_identity !== alias) return;
+		writeJsonAtomic(this.identitySelectorPath, { version: 1 });
 	}
 	readActivation(alias) {
 		return this.readAgentServerState().activations[assertStoreName("agent name", alias)] ?? null;
@@ -10380,12 +10622,9 @@ async function runAgentServer(argv) {
 		return 1;
 	}
 	const allowedOrigins = parseAllowedOrigins(values["allowed-origins"] ?? (envConfig.allowedOrigins || DEFAULT_ALLOWED_ORIGINS));
-	const root = values.root ?? resolveAgentServerRoot({
-		root: envConfig.root,
-		xdgConfigHome: envConfig.xdgConfigHome
-	});
+	const root = values.root ?? resolveAgentServerRoot({ root: envConfig.root });
 	const defaultApiUrl = values["api-url"] ?? (envConfig.apiUrl || DEFAULT_API_URL);
-	const store = new AgentServerStore(root).ensure();
+	const store = new AgentServerStore(root).ensure({ legacyXdgConfigHome: envConfig.xdgConfigHome });
 	if (trustRequested) return runTrustCommand(commandArgs, root);
 	const { logger, shutdown: shutdownLogger } = createRootLogger({
 		name: "agent-daemon.server",
@@ -10679,7 +10918,13 @@ async function runSyncSessions(argv) {
 	const state = parseState(values.state);
 	const limit = parseLimit(values.limit);
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
-	const ctx = await resolveAgentContext(opts.agent, { agentRootDir });
+	const explicitAgentRootDir = values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0;
+	const cfg = loadConfig();
+	const ctx = await resolveAgentContext(opts.agent, {
+		credentialSource: cfg.credentialSource,
+		envApiUrl: cfg.apiUrl,
+		agentRootDir: explicitAgentRootDir
+	});
 	await validateStartupBinding({
 		agent: ctx.agent,
 		teamId: values.team
@@ -10714,18 +10959,51 @@ function parseLimit(raw) {
 }
 //#endregion
 //#region src/lib/update.ts
-var UPDATE_MANIFEST_URL = "https://themolt.net/download/manifest.json";
+/**
+* `npm install -g @themoltnet/agent-daemon@latest` resolves the registry's own
+* dist-tag, so for an npm install the registry is the precise answer — the
+* manifest serves the themolt.net pin, which gates the bundle installer's
+* default and says nothing about what npm already has. It is also the origin an
+* npm install already talks to, so this adds no new dependency in CI, where the
+* daemon runs as `npx @themoltnet/agent-daemon` and would otherwise reach for
+* api.github.com from shared runner IPs.
+*
+* Bundle and direct installs ask the release listing, and their upgrade command
+* passes `MOLTNET_AGENT_VERSION=latest` so the installer resolves the same thing
+* rather than falling back to its own pinned default. Reporting the pin here
+* would hide releases that are already downloadable; reporting the release
+* without the sentinel would advertise a version the command could not deliver.
+* The pin still governs a fresh `curl .../install/agent | sh`.
+*/
+var UPDATE_RELEASES_URL = "https://api.github.com/repos/getlarge/themoltnet/releases?per_page=100";
+var RELEASE_TAG_PREFIX = "agent-daemon-v";
+var UPDATE_NPM_REGISTRY_URL = "https://registry.npmjs.org/@themoltnet/agent-daemon/latest";
 var UPDATE_CACHE_TTL_MS = 1440 * 60 * 1e3;
 var UPDATE_ERROR_CACHE_TTL_MS = 300 * 1e3;
+/**
+* Node does not resolve `process.argv[1]`: invoked through npm's bin shim it
+* reports `/usr/local/bin/moltnet-agent`, not the `node_modules` path this
+* matches on. Every global npm install therefore looked like `direct` and was
+* offered the bundle installer, which would drop a bundle on top of an npm
+* install. Resolve first; a missing path falls back to the input.
+*/
+function resolveDaemonExecutable(executable) {
+	if (!executable) return executable;
+	try {
+		return realpathSync(executable);
+	} catch {
+		return executable;
+	}
+}
 function detectDaemonInstallMethod(executable = process.argv[1] ?? "") {
-	const path = executable.replaceAll("\\", "/");
+	const path = resolveDaemonExecutable(executable).replaceAll("\\", "/");
 	if (path.includes("/node_modules/@themoltnet/agent-daemon/")) return "npm";
 	if (path.includes("/.local/share/moltnet/") || path.includes("/opt/moltnet/")) return "bundle";
 	return "direct";
 }
 function daemonUpdateCommand(method) {
 	if (method === "npm") return "npm install -g @themoltnet/agent-daemon@latest";
-	return "curl -fsSL https://themolt.net/install/agent | sh";
+	return "curl -fsSL https://themolt.net/install/agent | MOLTNET_AGENT_VERSION=latest sh";
 }
 async function checkDaemonUpdate(input) {
 	const installMethod = detectDaemonInstallMethod(input.executable ?? process.argv[1] ?? "moltnet-agent");
@@ -10746,11 +11024,15 @@ async function checkDaemonUpdate(input) {
 			return result;
 		}
 	}
+	const viaNpm = installMethod === "npm";
+	const source = viaNpm ? UPDATE_NPM_REGISTRY_URL : UPDATE_RELEASES_URL;
+	const label = viaNpm ? "npm registry" : "release listing";
 	try {
-		const response = await (input.fetchFn ?? fetch)(UPDATE_MANIFEST_URL, { signal: AbortSignal.timeout(5e3) });
-		if (!response.ok) throw new Error(`manifest returned HTTP ${response.status}`);
-		const latest = manifestVersion(await response.json());
-		if (!latest) throw new Error("manifest has no valid agent version");
+		const response = await (input.fetchFn ?? fetch)(source, { signal: AbortSignal.timeout(5e3) });
+		if (!response.ok) throw new Error(`${label} returned HTTP ${response.status}`);
+		const body = await response.json();
+		const latest = viaNpm ? distTagVersion(body) : newestReleaseVersion(body);
+		if (!latest) throw new Error(`${label} has no valid agent version`);
 		await writeCache({
 			checkedAt: now.toISOString(),
 			latest
@@ -10766,13 +11048,31 @@ async function checkDaemonUpdate(input) {
 		throw new Error(`could not check for MoltNet agent updates: ${error instanceof Error ? error.message : String(error)}`);
 	}
 }
-function manifestVersion(value) {
+function distTagVersion(value) {
 	if (!value || typeof value !== "object") return void 0;
-	const agent = value.agent;
-	if (!agent || typeof agent !== "object") return void 0;
-	const version = agent.version;
+	const version = value.version;
 	return typeof version === "string" && validVersion(version) ? normalizeVersion(version) : void 0;
 }
+/**
+* The listing is ordered by creation date, not version, so compare every
+* candidate rather than trusting position. Drafts are filtered explicitly:
+* unauthenticated callers never see them, but a token would, and this
+* repository carries stuck drafts that would otherwise look newest.
+*/
+function newestReleaseVersion(value) {
+	if (!Array.isArray(value)) return void 0;
+	let newest;
+	for (const entry of value) {
+		if (!entry || typeof entry !== "object") continue;
+		const { tag_name: tag, draft, prerelease } = entry;
+		if (draft === true || prerelease === true) continue;
+		if (typeof tag !== "string" || !tag.startsWith(RELEASE_TAG_PREFIX)) continue;
+		const candidate = tag.slice(14);
+		if (!validVersion(candidate)) continue;
+		if (!newest || compareVersions(candidate, newest) > 0) newest = normalizeVersion(candidate);
+	}
+	return newest;
+}
 function normalizeVersion(value) {
 	return value.trim().replace(/^v/, "");
 }
@@ -10812,7 +11112,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.52.0";
+var DAEMON_VERSION = "0.54.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {
@@ -10870,11 +11170,7 @@ async function runUpdate(argv) {
 	}
 }
 async function runRuntime(argv) {
-	const config = loadAgentServerEnvConfig();
-	const registry = new RuntimeRegistry(resolveAgentServerRoot({
-		root: config.root,
-		xdgConfigHome: config.xdgConfigHome
-	}));
+	const registry = new RuntimeRegistry(resolveAgentServerRoot({ root: loadAgentServerEnvConfig().root }));
 	const [command, ...rest] = argv;
 	if (command === "list") {
 		console.log(JSON.stringify(registry.list(), null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -85,10 +85,10 @@
     "proper-lockfile": "4.1.2",
     "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
-    "@themoltnet/pi-runtime": "0.14.1",
-    "@themoltnet/agent-runtime": "0.45.2",
-    "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/sdk": "0.140.0"
+    "@themoltnet/pi-runtime": "0.14.3",
+    "@themoltnet/agent-runtime": "0.46.0",
+    "@themoltnet/sdk": "0.140.2",
+    "@themoltnet/os-keyring": "0.3.0"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -99,15 +99,15 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/agent-eval": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/execution-integrations": "0.1.0",
     "@moltnet/execution-plan": "0.1.0",
+    "@moltnet/execution-integrations": "0.1.0",
+    "@moltnet/runtime-profiles": "0.1.0",
+    "@moltnet/tasks": "0.1.0",
     "@moltnet/loopback-companion": "0.1.0",
+    "@moltnet/agent-eval": "0.1.0",
     "@moltnet/observability": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/models": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/models": "0.1.0"
   },
   "nx": {
     "projectType": "application",
@@ -132,6 +132,14 @@
           "cwd": "{workspaceRoot}",
           "command": "node tools/release/agent-bundle/build.mjs --skip-daemon-build --out dist/agent-bundle"
         }
+      },
+      "test": {
+        "inputs": [
+          "default",
+          "^production",
+          "{workspaceRoot}/docs/operate/*.md",
+          "{workspaceRoot}/docs/.vitepress/config.ts"
+        ]
       }
     }
   },