@themoltnet/agent-daemon 0.54.0 → 0.55.0

package/dist/cli.js

@@ -13,8 +13,8 @@ import { parseArgs, promisify } from "node:util";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveProfileWarmSessionTtlSec, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
 import { FILE_SECRET_PROVIDER, FileSecretProvider, connect, createNodeSecretProviderRegistry } from "@themoltnet/sdk/node";
-import { constants, cpSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, agentKeyKey, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, getConfigDir, getIdentityDir, identitySeedKey, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, resolveOAuth2ClientSecret } from "@themoltnet/sdk";
+import { constants, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, agentKeyKey, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, deriveMcpUrl, formatSecretReferenceString, getConfigDir, getIdentityDir, identitySeedKey, isCanonicalConfig, parseSecretReferenceString, readConfig, register, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, resolveOAuth2ClientSecret } from "@themoltnet/sdk";
 import { execFile, spawn } from "node:child_process";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
 import { once } from "node:events";
@@ -1363,7 +1363,8 @@ Type.Object({ "x-moltnet-team-id": Type.Optional(Type.String({
 })) });
 Type.Object({
 	kind: Type.Literal("agent"),
-	identityId: UuidSchema,
+	agentId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()]),
 	fingerprint: FingerprintSchema,
 	publicKey: PublicKeySchema
 }, {
@@ -1380,7 +1381,8 @@ Type.Object({
 });
 var principalUnionVariants = [Type.Object({
 	kind: Type.Literal("agent"),
-	identityId: UuidSchema,
+	agentId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()]),
 	fingerprint: FingerprintSchema,
 	publicKey: PublicKeySchema
 }, { additionalProperties: false }), Type.Object({
@@ -3408,8 +3410,8 @@ var COMMON_OPTIONAL_FLAGS = `\
   --git-author <"Name <email>">
                               Non-secret git identity projected into the
                               guest for host-brokered commit signing. Default:
-                              host git config (OAuth2) or
-                              <identityId>+<agent>[bot]@users.noreply.github.com.
+                              host git config. Configless agent-key runs must
+                              provide this flag or MOLTNET_GIT_AUTHOR.
                               Env: MOLTNET_GIT_AUTHOR.
   --lease-ttl-sec <n>         Sliding liveness window. Silence longer than
                               this ends the attempt with lease_expired.
@@ -3626,8 +3628,17 @@ remove that exact CA. Linux continues to use the Chromium PNA HTTP path.
 //#region src/lib/identity-pin.ts
 /** Compare every pinned field without choosing a caller-specific error type. */
 function assessIdentityPin(current, expected) {
+	for (const [field, label] of [["publicKey", "public key"], ["fingerprint", "fingerprint"]]) if (!current[field] || current[field] !== expected[field]) return {
+		ok: false,
+		field,
+		label
+	};
+	return { ok: true };
+}
+function assessAgentStartupPin(current, expected) {
 	for (const [field, label] of [
-		["identityId", "identity id"],
+		["subjectId", "subject id"],
+		["subjectType", "subject type"],
 		["publicKey", "public key"],
 		["fingerprint", "fingerprint"]
 	]) if (!current[field] || current[field] !== expected[field]) return {
@@ -3712,8 +3723,8 @@ async function validateStartupBinding(options) {
 	}
 	const assessment = assessStartupBinding(whoami, options.teamId);
 	if (!assessment.ok) throw new Error(`Daemon startup validation failed: ${assessment.reason}`);
-	const expected = options.expectedIdentity;
-	if (expected && !assessIdentityPin(whoami, expected).ok) throw new Error("Daemon startup validation failed: authenticated identity does not match the Agent Server activation.");
+	const expected = options.expectedAgent;
+	if (expected && !assessAgentStartupPin(whoami, expected).ok) throw new Error("Daemon startup validation failed: authenticated agent does not match the Agent Server activation.");
 	return whoami;
 }
 /**
@@ -3843,7 +3854,7 @@ function isTransientWhoamiError(error) {
 function loadConfig() {
 	assertSingleCredentialForm("MOLTNET_AGENT_KEY", "MOLTNET_AGENT_KEY_REF");
 	assertSingleCredentialForm("MOLTNET_PRIVATE_KEY", "MOLTNET_PRIVATE_KEY_REF");
-	const expectedIdentity = readExpectedIdentity();
+	const expectedAgent = readExpectedAgent();
 	return {
 		otelEndpoint: process.env["MOLTNET_OTEL_ENDPOINT"] ?? "",
 		logLevel: process.env["LOG_LEVEL"] ?? "",
@@ -3859,22 +3870,27 @@ function loadConfig() {
 		credentialBindings: process.env["MOLTNET_CREDENTIAL_BINDINGS"] ?? "",
 		credentialEnforcement: process.env["MOLTNET_CREDENTIAL_ENFORCEMENT"] ?? "",
 		traceIdlePolling: readBoolean("MOLTNET_TRACE_IDLE_POLLING", process.env["MOLTNET_TRACE_IDLE_POLLING"]),
-		...expectedIdentity ? { expectedIdentity } : {}
+		...expectedAgent ? { expectedAgent } : {}
 	};
 }
-function readExpectedIdentity() {
-	const identityId = process.env["MOLTNET_EXPECTED_IDENTITY_ID"]?.trim() ?? "";
+function readExpectedAgent() {
+	if (process.env["MOLTNET_EXPECTED_IDENTITY_ID"]?.trim()) throw new Error("MOLTNET_EXPECTED_IDENTITY_ID is no longer supported; set the complete MOLTNET_EXPECTED_SUBJECT_ID, MOLTNET_EXPECTED_SUBJECT_TYPE=agent, MOLTNET_EXPECTED_PUBLIC_KEY, and MOLTNET_EXPECTED_FINGERPRINT pin");
+	const subjectId = process.env["MOLTNET_EXPECTED_SUBJECT_ID"]?.trim() ?? "";
+	const subjectType = process.env["MOLTNET_EXPECTED_SUBJECT_TYPE"]?.trim() ?? "";
 	const publicKey = process.env["MOLTNET_EXPECTED_PUBLIC_KEY"]?.trim() ?? "";
 	const fingerprint = process.env["MOLTNET_EXPECTED_FINGERPRINT"]?.trim() ?? "";
 	const present = [
-		identityId,
+		subjectId,
+		subjectType,
 		publicKey,
 		fingerprint
 	].filter(Boolean).length;
 	if (present === 0) return void 0;
-	if (present !== 3) throw new Error("MOLTNET_EXPECTED_IDENTITY_ID, MOLTNET_EXPECTED_PUBLIC_KEY, and MOLTNET_EXPECTED_FINGERPRINT must be set together");
+	if (present !== 4) throw new Error("MOLTNET_EXPECTED_SUBJECT_ID, MOLTNET_EXPECTED_SUBJECT_TYPE, MOLTNET_EXPECTED_PUBLIC_KEY, and MOLTNET_EXPECTED_FINGERPRINT must be set together");
+	if (subjectType !== "agent") throw new Error("MOLTNET_EXPECTED_SUBJECT_TYPE must be agent");
 	return {
-		identityId,
+		subjectId,
+		subjectType,
 		publicKey,
 		fingerprint
 	};
@@ -3896,7 +3912,6 @@ function loadAgentServerEnvConfig() {
 		port: process.env["MOLTNET_AGENT_SERVER_PORT"] ?? "",
 		allowedOrigins: process.env["MOLTNET_AGENT_SERVER_ALLOWED_ORIGINS"] ?? "",
 		root: process.env["MOLTNET_AGENT_SERVER_ROOT"] ?? "",
-		xdgConfigHome: process.env["XDG_CONFIG_HOME"] ?? "",
 		apiUrl: process.env["MOLTNET_API_URL"] ?? "",
 		logLevel: process.env["LOG_LEVEL"] ?? ""
 	};
@@ -6024,7 +6039,7 @@ async function runPolling(opts) {
 			const whoami = await validateStartupBinding({
 				agent: resolvedContext.agent,
 				teamId,
-				expectedIdentity: cfg.expectedIdentity
+				expectedAgent: cfg.expectedAgent
 			});
 			gate = "resolve_signing_material";
 			const privateKey = await resolveExecutorSigningPrivateKey({
@@ -6682,7 +6697,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			const whoami = await validateStartupBinding({
 				agent: resolvedContext.agent,
 				teamId: values.team,
-				expectedIdentity: cfg.expectedIdentity
+				expectedAgent: cfg.expectedAgent
 			});
 			gate = "resolve_signing_material";
 			const privateKey = await resolveExecutorSigningPrivateKey({
@@ -7869,39 +7884,13 @@ var AgentServerStoreError = class extends Error {
 * so honouring XDG here gave one application two config roots: on a machine
 * with the variable set, the daemon wrote identities the CLI and SDK could not
 * read. `MOLTNET_AGENT_SERVER_ROOT` remains the explicit escape hatch for a
-* genuinely custom location. The XDG parameter is gone rather than ignored: an
-* accepted-but-discarded argument reads like it still works. Callers adopting
-* state from the old root pass it to ensure() instead.
+* genuinely custom location.
 */
 function resolveAgentServerRoot(input) {
 	const override = input.root?.trim();
 	if (override) return override;
 	return getConfigDir();
 }
-/** The pre-#1834 root that honoured XDG_CONFIG_HOME, if it differs. */
-function legacyXdgAgentServerRoot(xdgConfigHome) {
-	const xdg = xdgConfigHome.trim();
-	if (!xdg) return null;
-	const legacy = join(xdg, "moltnet");
-	return legacy === resolveAgentServerRoot({}) ? null : legacy;
-}
-/** True when a root holds agent-server state worth preserving. */
-function hasAgentServerState(root) {
-	for (const child of [
-		"agent-server.json",
-		"identity-selector.json",
-		"identities",
-		"agents"
-	]) try {
-		if (readdirSync(join(root, child)).length > 0) return true;
-	} catch {
-		try {
-			readFileSync(join(root, child));
-			return true;
-		} catch {}
-	}
-	return false;
-}
 function providerEnvName(providerId) {
 	return `MOLTNET_PROVIDER_${assertProviderId(providerId).replaceAll("-", "_").toUpperCase()}_API_KEY`;
 }
@@ -7954,8 +7943,7 @@ var AgentServerStore = class {
 		return join(this.piDir, "auth.json");
 	}
 	/** Create the directory layout (0700) if missing. Idempotent. */
-	ensure(options = {}) {
-		this.adoptLegacyXdgRoot(options.legacyXdgConfigHome ?? "");
+	ensure() {
 		for (const dir of [
 			this.root,
 			this.identitiesDir,
@@ -7965,94 +7953,28 @@ var AgentServerStore = class {
 			recursive: true,
 			mode: 448
 		});
-		this.migrateLegacyAgentDocuments();
 		return this;
 	}
-	/**
-	* Adopt state left at the pre-#1834 XDG root.
-	*
-	* The daemon used to resolve `$XDG_CONFIG_HOME/moltnet` while the CLI and SDK
-	* resolved `~/.config/moltnet`. Aligning the root without this would silently
-	* orphan an existing daemon's entire state — it would come up reporting zero
-	* managed agents.
-	*/
-	adoptLegacyXdgRoot(xdgConfigHome) {
-		const legacyRoot = legacyXdgAgentServerRoot(xdgConfigHome);
-		if (!legacyRoot || legacyRoot === this.root) return;
-		if (!hasAgentServerState(legacyRoot)) return;
-		if (hasAgentServerState(this.root)) throw new AgentServerStoreError("invalid_state", `agent server state exists at both ${legacyRoot} (the pre-1834 XDG_CONFIG_HOME location) and ${this.root}. The daemon now shares ${this.root} with the CLI and SDK. Merge or remove one of them, or set MOLTNET_AGENT_SERVER_ROOT to choose explicitly.`);
-		mkdirSync(resolve(this.root, ".."), {
-			recursive: true,
-			mode: 448
-		});
-		try {
-			if (readdirSync(this.root).length === 0) rmSync(this.root, { recursive: true });
-		} catch {}
-		try {
-			renameSync(legacyRoot, this.root);
-		} catch (error) {
-			if (error.code !== "EXDEV") throw new AgentServerStoreError("io_error", `could not adopt the pre-1834 agent server state at ${legacyRoot}: ${String(error.message)}. Move it to ${this.root} manually, or set MOLTNET_AGENT_SERVER_ROOT to choose a root explicitly.`);
-			cpSync(legacyRoot, this.root, { recursive: true });
-			rmSync(legacyRoot, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-	/**
-	* Migrate managed documents from the pre-#1834 `agents/<alias>.json` layout
-	* to `identities/<alias>/moltnet.json`. Without this an upgraded daemon sees
-	* zero managed agents and reports a plain "not found".
-	*/
-	migrateLegacyAgentDocuments() {
-		const legacyDir = join(this.root, "agents");
-		let entries;
-		try {
-			entries = readdirSync(legacyDir);
-		} catch {
-			return;
-		}
-		for (const entry of entries) {
-			if (!entry.endsWith(".json")) continue;
-			const alias = entry.slice(0, -5);
-			if (!NAME_RE.test(alias)) continue;
-			const legacyPath = join(legacyDir, entry);
-			const target = this.agentPath(alias);
-			if (readJson(target)) continue;
-			const config = readJson(legacyPath);
-			if (!config) continue;
-			mkdirSync(join(this.identitiesDir, alias), {
-				recursive: true,
-				mode: 448
-			});
-			writeJsonAtomic(target, config);
-			rmSync(legacyPath, { force: true });
-		}
-		if (readdirSync(legacyDir).length === 0) rmSync(legacyDir, {
-			recursive: true,
-			force: true
-		});
-	}
 	get statePath() {
 		return join(this.root, "agent-server.json");
 	}
 	readAgentServerState() {
 		const state = readJson(this.statePath);
 		if (!state) return {
-			version: 1,
+			version: 2,
 			pendingRegistrations: {},
 			activations: {}
 		};
-		if (!isRecord$1(state) || state.version !== 1) throw new AgentServerStoreError("invalid_state", `agent-server.json version ${String(isRecord$1(state) ? state.version : void 0)} is not supported`);
-		if ("pairedOrigins" in state) throw new AgentServerStoreError("invalid_state", "agent-server.json uses the obsolete pairing format; clear the unreleased agent server store and reconfigure it");
-		if (!isRecord$1(state.pendingRegistrations) || !isRecord$1(state.activations)) throw new AgentServerStoreError("invalid_state", "agent-server.json is missing the version 1 activation map; clear the unreleased agent server store and reconfigure it");
+		if (!isRecord$1(state) || state.version !== 2) throw new AgentServerStoreError("invalid_state", `agent-server.json version ${String(isRecord$1(state) ? state.version : void 0)} is not supported; move agent-server.json aside, run \`moltnet config migrate\`, then add or attach the agents again`);
+		if ("pairedOrigins" in state) throw new AgentServerStoreError("invalid_state", "agent-server.json uses the obsolete pairing format; move agent-server.json aside and configure the agent server again");
+		if (!isRecord$1(state.pendingRegistrations) || !isRecord$1(state.activations)) throw new AgentServerStoreError("invalid_state", "agent-server.json is missing the version 2 activation map; move agent-server.json aside, run `moltnet config migrate`, then add or attach the agents again");
 		for (const [alias, activation] of Object.entries(state.activations)) validateActivation(alias, activation);
 		for (const [alias, registration] of Object.entries(state.pendingRegistrations)) {
 			assertStoreName("agent name", alias);
 			if (!isRecord$1(registration) || typeof registration.apiUrl !== "string" || registration.apiUrl.length === 0 || typeof registration.createdAt !== "string" || registration.createdAt.length === 0) throw new AgentServerStoreError("invalid_state", `pending registration "${alias}" is not valid`);
 		}
 		return {
-			version: 1,
+			version: 2,
 			pendingRegistrations: state.pendingRegistrations,
 			activations: state.activations
 		};
@@ -8281,13 +8203,13 @@ function isStrictDescendant(root, candidate) {
 }
 function validateActivation(alias, value) {
 	const invalid = () => {
-		throw new AgentServerStoreError("invalid_state", `activation "${alias}" is not a valid version 1 activation`);
+		throw new AgentServerStoreError("invalid_state", `activation "${alias}" is not a valid version 2 activation`);
 	};
 	if (!isRecord$1(value)) invalid();
 	const activation = value;
 	if (activation.alias !== alias) invalid();
 	if (![
-		"identityId",
+		"subjectId",
 		"publicKey",
 		"fingerprint",
 		"createdAt"
@@ -8332,7 +8254,7 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 	const alias = assertStoreName("agent name", input.name);
 	if (!input.enrollmentToken.trim()) throw new AgentServerIdentityError("enrollment_required", "an enrollment token from the target team is required — a self-registered agent would be stranded in its own personal team");
 	const releaseAlias = reserveAlias(store, alias);
-	let registeredIdentityId;
+	let registered = false;
 	try {
 		let apiUrl;
 		try {
@@ -8349,18 +8271,19 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 		});
 		if (result.credentials.type !== "agent_key") throw new AgentServerIdentityError("unsupported_credential", `registration returned credential type "${result.credentials.type}"; agent server manages agent-key credentials only`);
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const { identityId, fingerprint, publicKey, privateKey } = result.identity;
-		registeredIdentityId = identityId;
+		const { subjectId, fingerprint, publicKey, privateKey } = result.identity;
+		registered = true;
 		const agentKeyReference = {
 			provider: FILE_SECRET_PROVIDER,
-			key: agentKeyKey(identityId)
+			key: agentKeyKey(subjectId)
 		};
 		const seedReference = {
 			provider: FILE_SECRET_PROVIDER,
 			key: identitySeedKey(fingerprint)
 		};
 		const config = {
-			identity_id: identityId,
+			subject_id: subjectId,
+			subject_type: "agent",
 			registered_at: now,
 			agent_key_ref: agentKeyReference,
 			keys: {
@@ -8381,15 +8304,15 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 			apiUrl: result.apiUrl
 		}, store.agentPath(alias), input.signal);
 		assertIdentityMatches(whoami, {
-			identityId,
 			publicKey,
 			fingerprint
 		}, "authenticated whoami", `new managed agent "${alias}"`);
+		assertSubjectMatches(whoami, config, "authenticated whoami", `managed config ${store.agentPath(alias)}`);
 		const boundTeamId = boundTeamIdFromWhoami(whoami);
 		const activation = {
 			alias,
 			source: "managed",
-			identityId,
+			subjectId: whoami.subjectId,
 			publicKey,
 			fingerprint,
 			...boundTeamId ? { boundTeamId } : {},
@@ -8403,11 +8326,11 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 			...boundTeamId ? { boundTeamId } : {}
 		};
 	} catch (cause) {
-		if (!registeredIdentityId && cause instanceof MoltNetError && cause.statusCode !== void 0 && cause.statusCode >= 400 && cause.statusCode < 500) {
+		if (!registered && cause instanceof MoltNetError && cause.statusCode !== void 0 && cause.statusCode >= 400 && cause.statusCode < 500) {
 			store.clearPendingRegistration(alias);
 			throw new AgentServerIdentityError("registration_failed", registrationRejectionMessage(alias, cause), { cause });
 		}
-		if (store.hasPendingRegistration(alias)) throw new AgentServerIdentityError("registration_incomplete", registeredIdentityId ? `identity "${registeredIdentityId}" was registered but local activation is incomplete; reconcile or clear its pending Agent Server record before retrying` : `registration for "${alias}" may be incomplete; inspect the remote API before changing its pending Agent Server record`, { cause });
+		if (store.hasPendingRegistration(alias)) throw new AgentServerIdentityError("registration_incomplete", registered ? `the remote agent was registered but local activation is incomplete; reconcile or clear its pending Agent Server record before retrying` : `registration for "${alias}" may be incomplete; inspect the remote API before changing its pending Agent Server record`, { cause });
 		throw cause;
 	} finally {
 		releaseAlias();
@@ -8438,17 +8361,19 @@ async function reconcileManagedRegistration(store, secrets, aliasInput, action,
 	if (!config?.agent_key_ref || config.agent_key_ref.provider !== FILE_SECRET_PROVIDER || config.keys.private_key_ref?.provider !== FILE_SECRET_PROVIDER) throw new AgentServerIdentityError("registration_incomplete", `pending registration for "${alias}" does not have complete managed references`);
 	const [agentKey, privateKeyState] = await Promise.all([secrets.read(config.agent_key_ref.key), secrets.probe(config.keys.private_key_ref.key)]);
 	if (!agentKey || privateKeyState !== "present") throw new AgentServerIdentityError("registration_incomplete", `pending registration for "${alias}" is missing persisted secret material`);
-	const identity = identityFromConfig(config);
 	const apiUrl = requireConfigApiUrl(config, store.agentPath(alias));
 	const whoami = await callWhoami(connectAgent, {
 		agentKey,
 		apiUrl
 	}, store.agentPath(alias), signal);
+	assertSubjectMatches(whoami, config, "authenticated whoami", `pending registration "${alias}" config`);
+	const identity = identityFromConfig(config);
 	assertIdentityMatches(whoami, identity, "authenticated whoami", `pending registration "${alias}" config`);
 	const boundTeamId = boundTeamIdFromWhoami(whoami);
 	const recovered = {
 		alias,
 		source: "managed",
+		subjectId: whoami.subjectId,
 		...identity,
 		...boundTeamId ? { boundTeamId } : {},
 		createdAt: config.registered_at,
@@ -8474,10 +8399,12 @@ async function attachExternalAgent(store, secretProviders, input, connectAgent =
 		const whoami = await authenticateConfig(input.configDir, effectiveApiUrl, secretProviders, connectAgent, input.signal);
 		const identity = identityFromConfig(config);
 		assertIdentityMatches(identity, whoami, `external config ${configPath}`, "authenticated whoami");
+		assertSubjectMatches(whoami, config, "authenticated whoami", `external config ${configPath}`);
 		const boundTeamId = boundTeamIdFromWhoami(whoami);
 		const activation = {
 			alias,
 			source: "external",
+			subjectId: whoami.subjectId,
 			...identity,
 			...boundTeamId ? { boundTeamId } : {},
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8495,15 +8422,26 @@ async function attachExternalAgent(store, secretProviders, input, connectAgent =
 		releaseAlias();
 	}
 }
-/** Load and authenticate the current config, then compare all pinned fields. */
+/** Load and authenticate the current config, then refresh its derived pin. */
 async function verifyAgentActivation(store, alias, managedSecretProviders, externalSecretProviders, connectAgent = connect, signal) {
 	const activation = requireActivation(store, alias);
 	const verified = activation.source === "managed" ? await verifyManagedActivation(store, activation, managedSecretProviders, connectAgent, signal) : await verifyExternalActivation(activation, externalSecretProviders, connectAgent, signal);
-	assertIdentityMatches(verified.whoami, activation, "authenticated whoami", `agent "${activation.alias}" pinned activation`);
+	assertSubjectMatches(verified.whoami, verified.config, "authenticated whoami", `agent "${activation.alias}" config`);
+	if (verified.whoami.subjectId !== activation.subjectId) throw new AgentServerIdentityError("verification_failed", `authenticated whoami subject does not match agent "${activation.alias}" pinned activation`);
+	const identity = identityFromConfig(verified.config);
+	assertIdentityMatches(verified.whoami, identity, "authenticated whoami", `agent "${activation.alias}" config`);
 	const boundTeamId = boundTeamIdFromWhoami(verified.whoami);
 	if (activation.boundTeamId !== boundTeamId) throw new AgentServerIdentityError("verification_failed", `authenticated whoami team binding does not match agent "${activation.alias}" pinned activation`);
+	const refreshed = {
+		...activation,
+		...identity
+	};
+	if (activation.publicKey !== refreshed.publicKey || activation.fingerprint !== refreshed.fingerprint) {
+		store.writeActivation(refreshed);
+		process.stderr.write(`agent-server: refreshed the authenticated signing identity for ${JSON.stringify(activation.alias)}\n`);
+	}
 	return {
-		activation,
+		activation: refreshed,
 		config: verified.config,
 		...boundTeamId ? { boundTeamId } : {}
 	};
@@ -8546,7 +8484,7 @@ function requireTrustedApiOverride(override, configApiUrl, configPath) {
 }
 function assertActivatedConfig(config, activation, configPath, currentApiUrl, pinnedApiUrl) {
 	if (currentApiUrl !== pinnedApiUrl) throw new AgentServerIdentityError("verification_failed", `agent config at ${configPath} API endpoint does not match its pinned activation`);
-	assertIdentityMatches(identityFromConfig(config), activation, configPath, `agent "${activation.alias}" pinned activation`);
+	if (config.subject_id !== activation.subjectId) throw new AgentServerIdentityError("verification_failed", `agent config at ${configPath} subject does not match its pinned activation`);
 }
 function requireConfigApiUrl(config, configPath) {
 	const apiUrl = config?.endpoints?.api?.trim();
@@ -8618,16 +8556,18 @@ function boundedIdentitySignal(signal) {
 	return signal ? AbortSignal.any([signal, timeout]) : timeout;
 }
 function identityFromConfig(config) {
-	const identityId = config?.identity_id?.trim();
 	const publicKey = config?.keys?.public_key?.trim();
 	const fingerprint = config?.keys?.fingerprint?.trim();
-	if (!identityId || !publicKey || !fingerprint) throw new AgentServerIdentityError("verification_failed", "agent config is missing canonical identity_id, keys.public_key, or keys.fingerprint");
+	if (!publicKey || !fingerprint) throw new AgentServerIdentityError("verification_failed", "agent config is missing keys.public_key or keys.fingerprint");
 	return {
-		identityId,
 		publicKey,
 		fingerprint
 	};
 }
+function assertSubjectMatches(current, expected, currentLabel, expectedLabel) {
+	if (!isCanonicalConfig(expected)) throw new AgentServerIdentityError("verification_failed", `${expectedLabel} is missing canonical subject_type=agent and subject_id; run \`moltnet config migrate\` first`);
+	if (current.subjectType !== "agent" || current.subjectId !== expected.subject_id) throw new AgentServerIdentityError("verification_failed", `${currentLabel} subject does not match ${expectedLabel}`);
+}
 function assertIdentityMatches(current, expected, currentLabel, expectedLabel) {
 	const assessment = assessIdentityPin(current, expected);
 	if (!assessment.ok) throw new AgentServerIdentityError("verification_failed", `${currentLabel} ${assessment.label} does not match ${expectedLabel}`);
@@ -8642,7 +8582,7 @@ function publicAgentView(store, activation) {
 		return {
 			kind: "managed",
 			agentName: activation.alias,
-			identityId: activation.identityId,
+			subjectId: activation.subjectId,
 			fingerprint: activation.fingerprint,
 			...activation.boundTeamId ? { teamId: activation.boundTeamId } : {},
 			apiUrl: activation.apiUrl,
@@ -8656,7 +8596,7 @@ function publicAgentView(store, activation) {
 		agentName: activation.alias,
 		configDir: dirname(activation.configPath),
 		...activation.apiUrl ? { apiUrl: activation.apiUrl } : {},
-		identityId: activation.identityId,
+		subjectId: activation.subjectId,
 		fingerprint: activation.fingerprint,
 		...activation.boundTeamId ? { teamId: activation.boundTeamId } : {},
 		createdAt: activation.createdAt
@@ -8802,7 +8742,8 @@ var RunManager = class {
 				throw new AgentServerRunError("invalid_spec", `external credentials for "${activation.alias}" could not be projected`);
 			}
 		}
-		env["MOLTNET_EXPECTED_IDENTITY_ID"] = activation.identityId;
+		env["MOLTNET_EXPECTED_SUBJECT_ID"] = activation.subjectId;
+		env["MOLTNET_EXPECTED_SUBJECT_TYPE"] = "agent";
 		env["MOLTNET_EXPECTED_PUBLIC_KEY"] = activation.publicKey;
 		env["MOLTNET_EXPECTED_FINGERPRINT"] = activation.fingerprint;
 		env["MOLTNET_SUPERVISED_RUN"] = "1";
@@ -9459,7 +9400,7 @@ var AgentServerProblemSchema = Type.Object({
 var AgentServerAgentSchema = Type.Object({
 	kind: Type.Union([Type.Literal("managed"), Type.Literal("external")]),
 	agentName: Type.String(),
-	identityId: Type.Optional(Type.String()),
+	subjectId: Type.String(),
 	fingerprint: Type.Optional(Type.String()),
 	apiUrl: Type.Optional(Type.String()),
 	teamId: Type.Optional(Type.String()),
@@ -10624,7 +10565,7 @@ async function runAgentServer(argv) {
 	const allowedOrigins = parseAllowedOrigins(values["allowed-origins"] ?? (envConfig.allowedOrigins || DEFAULT_ALLOWED_ORIGINS));
 	const root = values.root ?? resolveAgentServerRoot({ root: envConfig.root });
 	const defaultApiUrl = values["api-url"] ?? (envConfig.apiUrl || DEFAULT_API_URL);
-	const store = new AgentServerStore(root).ensure({ legacyXdgConfigHome: envConfig.xdgConfigHome });
+	const store = new AgentServerStore(root).ensure();
 	if (trustRequested) return runTrustCommand(commandArgs, root);
 	const { logger, shutdown: shutdownLogger } = createRootLogger({
 		name: "agent-daemon.server",
@@ -11112,7 +11053,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.54.0";
+var DAEMON_VERSION = "0.55.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -85,10 +85,10 @@
     "proper-lockfile": "4.1.2",
     "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
-    "@themoltnet/pi-runtime": "0.14.3",
-    "@themoltnet/agent-runtime": "0.46.0",
-    "@themoltnet/sdk": "0.140.2",
-    "@themoltnet/os-keyring": "0.3.0"
+    "@themoltnet/agent-runtime": "1.0.0",
+    "@themoltnet/pi-runtime": "0.15.0",
+    "@themoltnet/os-keyring": "0.3.0",
+    "@themoltnet/sdk": "0.141.0"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -100,14 +100,14 @@
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/execution-plan": "0.1.0",
     "@moltnet/execution-integrations": "0.1.0",
-    "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/loopback-companion": "0.1.0",
     "@moltnet/agent-eval": "0.1.0",
+    "@moltnet/execution-plan": "0.1.0",
+    "@moltnet/loopback-companion": "0.1.0",
+    "@moltnet/models": "0.1.0",
+    "@moltnet/tasks": "0.1.0",
     "@moltnet/observability": "0.1.0",
-    "@moltnet/models": "0.1.0"
+    "@moltnet/runtime-profiles": "0.1.0"
   },
   "nx": {
     "projectType": "application",