@themoltnet/agent-daemon 0.59.0 → 0.60.0

package/README.md

@@ -114,7 +114,7 @@ All config flows from environment variables. The daemon reads them in
 | Var                   | Required                           | Purpose                                                                   |
 | --------------------- | ---------------------------------- | ------------------------------------------------------------------------- |
 | `GIT_CONFIG_GLOBAL`   | config-based                       | Optional git identity path; not needed for configless startup.            |
-| `MOLTNET_AGENT_NAME`  | yes                                | Agent name (matches `.moltnet/<name>/`).                                  |
+| `MOLTNET_AGENT_NAME`  | yes                                | Central identity alias (`identities/<name>/`).                            |
 | `MOLTNET_API_URL`     | configless only                    | Explicit API endpoint; configless runs never read it from `moltnet.json`. |
 | `MOLTNET_AGENT_KEY`   | no                                 | Team- or identity-scoped agent key. Overrides `moltnet.json`.             |
 | `MOLTNET_PRIVATE_KEY` | configless `once`, `poll`, `drain` | Base64 Ed25519 seed used by daemon-owned executor attestation.            |
@@ -133,18 +133,19 @@ its gitconfig in `.moltnet/<agent>/`. Three paths create it:
   does the same for coding agents that need git and GitHub.
 
 **The daemon runs on an agent key only.** OAuth2 client_credentials is not
-accepted: it hands the daemon the full 17-scope agent grant against a six-scope
+accepted: it hands the daemon the full agent OAuth2 grant against a least-privilege
 need, and a Hydra token cannot be a Talos derivation parent. A `moltnet.json`
-without `agent_key_ref` is refused at startup with the command that fixes it.
+without `agent_key_ref` or `agent_key_refs` is refused at startup with the command that fixes it.
 
 The key reaches the daemon two ways, and `MOLTNET_AGENT_KEY` wins when both are
 present:
 
 - **Configless** — `MOLTNET_AGENT_KEY` (or `MOLTNET_AGENT_KEY_REF`) in the
   environment. No agent files are read at all.
-- **From `moltnet.json`** — an `agent_key_ref` pointing at a secret provider,
-  which is what `moltnet agents keys create --store` writes. The plaintext
-  secret never lands in the file.
+- **From `moltnet.json`** — `agent_key_refs[teamId]` selects the run team's
+  provider reference. `agent_key_ref` is used only if that team has no entry.
+  A configured entry that fails never falls back. The plaintext secret never
+  lands in the file.
 
 Mint or rotate the key with the CLI, which is separate operator tooling and
 keeps using OAuth2 for its own authentication:
@@ -155,14 +156,21 @@ moltnet agents keys create --agent-id <uuid> --team-id <uuid> \
 moltnet agents keys rotate <key-id> --team-id <uuid> --store
 ```
 
+To enroll the same identity into another team, use
+`moltnet teams join --code <code> --issue-agent-key --store --idempotency-key <uuid>`.
+Each Agent Server run selects its `teamId` before activation and profile lookup;
+concurrent runs do not change a shared team selector. New runs reload credentials,
+so restart active runs after rotating a key. See the
+[enrollment and recovery guide](../../docs/operate/agent-keys.md#enroll-an-existing-agent-into-another-team).
+
 The daemon reconciles a team-bound key against `--team` at startup; an
 identity-scoped key may select any team where the agent is authorized. It fails
 fast if the key is rejected, is not an agent, or a team binding mismatches. See
 [Run the daemon with an agent key](../../docs/operate/agent-keys.md#run-the-daemon-with-an-agent-key).
 
 Daemon authentication and the guest boundary are two separate concerns. Where
-the agent key comes from (the environment, or an `agent_key_ref` in
-`.moltnet/<agent>/moltnet.json` resolved through the host secret provider)
+the agent key comes from (the environment, or a selected key reference in the
+central identity's `moltnet.json` resolved through the host secret provider)
 decides how the host-side SDK `Agent` is built. The guest boundary is fixed: **the guest never
 receives MoltNet credential material.** No `.moltnet` file, gitconfig, SSH
 signing key, GitHub App PEM, or MoltNet environment credential is injected into
@@ -196,9 +204,13 @@ An agent key used by the daemon needs this least-privilege scope set:
 agent:profile crypto:sign runtime:read task:read task:claim task:execute
 ```
 
-The Console selects these scopes by default. Knowledge-enabled workers must add
-`diary:read`, `diary:write`, `pack:read`, and `pack:write` when the key is
-issued.
+The daemon also uses `diary:read`, `team:read` and `team:join` when the key
+carries them -- read access to the agent's teams and their diaries, and
+enrollment into a team. Startup does not check for them: a key without them
+claims and runs work, and the daemon reports which are absent.
+
+The Console selects the full set by default. Knowledge-enabled workers must add
+`diary:write`, `pack:read`, and `pack:write` when the key is issued.
 
 `crypto:sign` is in the minimum because host-capability signing runs on the
 daemon's own credential: the local seed signer calls the signing-request

package/dist/cli.js

@@ -14,7 +14,7 @@ import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, cre
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
 import { FILE_SECRET_PROVIDER, FileSecretProvider, RegisterIdentityError, boundedIdentitySignal, connect, createNodeSecretProviderRegistry, register } from "@themoltnet/sdk/node";
 import { constants, copyFileSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed } from "@themoltnet/sdk";
+import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, hasAgentKeyConfiguration, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, selectAgentKeyReference } from "@themoltnet/sdk";
 import { execFile, spawn } from "node:child_process";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
 import { once } from "node:events";
@@ -774,13 +774,24 @@ var CREDENTIAL_SCOPES = {
 	TaskManage: "task:manage",
 	TaskRead: "task:read",
 	TaskWrite: "task:write",
+	TeamJoin: "team:join",
 	TeamManage: "team:manage",
 	TeamRead: "team:read"
 };
 var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
 /**
-* Minimum grant for the agent daemon. Task credentials attenuate this further
-* to `task:execute` alone.
+* What the agent daemon cannot run without, checked against
+* `GET /agents/whoami` at startup. Task credentials attenuate it further to
+* `task:execute` alone.
+*
+* This is the **boot floor**, and deliberately not the same list as
+* `AGENT_CREDENTIAL_SCOPES`. A credential's scopes are fixed when it is minted
+* and `POST /agent-keys` caps a new key at the scopes of the credential
+* requesting it, so no key can ever widen itself. A scope added here therefore
+* stops every daemon already in the field, and only a human with a Console
+* session can mint the replacement. Add one only when the daemon genuinely
+* cannot work without it; anything a caller merely benefits from belongs in
+* `DAEMON_OPTIONAL_SCOPES`, where absence costs a capability instead.
 *
 * `crypto:sign` is part of the minimum because host-capability signing runs on
 * the daemon's own credential: the local seed signer calls the signing-request
@@ -788,7 +799,7 @@ var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
 * cleanly and then fails the first time guest code signs a diary entry or a
 * commit.
 */
-var AGENT_CREDENTIAL_SCOPES = [
+var DAEMON_MINIMUM_SCOPES = [
 	CREDENTIAL_SCOPES.AgentProfile,
 	CREDENTIAL_SCOPES.CryptoSign,
 	CREDENTIAL_SCOPES.RuntimeRead,
@@ -796,6 +807,22 @@ var AGENT_CREDENTIAL_SCOPES = [
 	CREDENTIAL_SCOPES.TaskClaim,
 	CREDENTIAL_SCOPES.TaskExecute
 ];
+/**
+* Read and enrollment authority a daemon uses when it has it, and runs without
+* when it does not: reading the teams it belongs to and their diaries, and
+* joining a team it is not yet a member of.
+*
+* Which product surface each one enables is deliberately not recorded here.
+* That mapping belongs to whatever consumes the scope and changes with it,
+* while the scope names are the contract and do not.
+*/
+var DAEMON_OPTIONAL_SCOPES = [
+	CREDENTIAL_SCOPES.DiaryRead,
+	CREDENTIAL_SCOPES.TeamRead,
+	CREDENTIAL_SCOPES.TeamJoin
+];
+/** What a newly issued agent key should carry: the floor plus the rest. */
+var AGENT_CREDENTIAL_SCOPES = [...DAEMON_MINIMUM_SCOPES, ...DAEMON_OPTIONAL_SCOPES];
 CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskWrite;
 CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.DiaryRead, CREDENTIAL_SCOPES.PackRead, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TeamRead;
 Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
@@ -819,6 +846,7 @@ var MCP_CLIENT_SCOPES = [
 	CREDENTIAL_SCOPES.TaskManage,
 	CREDENTIAL_SCOPES.TaskRead,
 	CREDENTIAL_SCOPES.TaskWrite,
+	CREDENTIAL_SCOPES.TeamJoin,
 	CREDENTIAL_SCOPES.TeamManage,
 	CREDENTIAL_SCOPES.TeamRead
 ];
@@ -1172,17 +1200,16 @@ Type.Object({
 		Type.Literal("executor"),
 		Type.Literal("member")
 	])),
-	maxUses: Type.Optional(Type.Integer({
-		minimum: 1,
-		default: 1
-	})),
 	expiresInHours: Type.Optional(Type.Integer({
 		minimum: 1,
 		maximum: 720,
 		default: 168
 	}))
 });
-Type.Object({ code: Type.String({ minLength: 1 }) });
+Type.Object({
+	code: Type.String({ minLength: 1 }),
+	issueAgentKey: Type.Optional(Type.Literal(true))
+});
 Type.Object({ role: Type.Union([
 	Type.Literal("manager"),
 	Type.Literal("executor"),
@@ -1207,8 +1234,7 @@ Type.Object({
 		Type.Literal("executor"),
 		Type.Literal("member")
 	]),
-	maxUses: Type.Integer(),
-	useCount: Type.Integer(),
+	usedAt: Type.Union([Type.String({ format: "date-time" }), Type.Null()]),
 	expiresAt: DateTimeUnsafe,
 	createdAt: DateTimeUnsafe
 });
@@ -1239,11 +1265,7 @@ Type.Object({
 });
 Type.Object({
 	teamId: UuidSchema,
-	role: Type.Union([
-		Type.Literal("manager"),
-		Type.Literal("executor"),
-		Type.Literal("member")
-	])
+	role: TeamRoleSchema
 });
 Type.Object({
 	updated: Type.Boolean(),
@@ -3501,10 +3523,11 @@ Run \`agent-daemon <command> --help\` for command-specific flags.
 Prerequisites:
   - configless: MOLTNET_AGENT_KEY (or MOLTNET_AGENT_KEY_REF) and
     MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF); no agent files
-  - config-based and sync-sessions: <agent-root>/.moltnet/<agent>/moltnet.json
-    carrying agent_key_ref (OAuth2 client credentials are not accepted)
+  - config-based: ~/.config/moltnet/identities/<agent>/moltnet.json
+    carrying agent_key_refs or agent_key_ref (OAuth2 is not accepted)
+    --agent-root explicitly selects a legacy .moltnet/<agent> bundle
 
-No key yet? Mint one with the CLI (--store writes agent_key_ref into
+No key yet? Mint one with the CLI (--store writes the team slot into
 moltnet.json and keeps the secret in a provider):
 
   moltnet teams list             # find the team id
@@ -3712,6 +3735,10 @@ function assessAgentStartupPin(current, expected) {
 	};
 	return { ok: true };
 }
+/** A configured team slot must authenticate with that exact team ceiling. */
+function matchesCredentialTeam(current, credentialTeamId) {
+	return !credentialTeamId || current.credentialBinding?.bindingScope === "team" && current.credentialBinding.boundTeamId === credentialTeamId;
+}
 //#endregion
 //#region src/lib/agent-context.ts
 /**
@@ -3755,7 +3782,7 @@ function detectCredentialSource(env) {
 function assessStartupBinding(whoami, teamId) {
 	if (whoami.subjectType !== "agent") return {
 		ok: false,
-		reason: `the daemon must authenticate as an agent, but whoami reported subjectType "${whoami.subjectType}". Provide agent credentials (an agent key or the agent's client id/secret).`
+		reason: `the daemon must authenticate as an agent, but whoami reported subjectType "${whoami.subjectType}". Provide agent credentials (an agent key).`
 	};
 	const boundTeamId = whoami.credentialBinding?.bindingScope === "team" ? whoami.credentialBinding.boundTeamId : void 0;
 	if (teamId && boundTeamId && boundTeamId !== teamId) return {
@@ -3768,8 +3795,7 @@ function assessStartupBinding(whoami, teamId) {
 * Validate at startup — after `connect()`, before polling — that the connected
 * credential can operate as `teamId`, failing fast with an actionable message
 * instead of letting an obscure 401/403 surface mid-poll. Runs in both auth
-* modes; in OAuth2 mode it also doubles as an API-reachability and
-* subject-type check. Returns the `whoami` so the caller can log the resolved
+* credential sources and also checks API reachability and subject type. Returns the `whoami` so the caller can log the resolved
 * identity (never the secret).
 */
 async function validateStartupBinding(options) {
@@ -3785,6 +3811,7 @@ async function validateStartupBinding(options) {
 			setTimeout(resolve, 100 * attempt);
 		});
 	}
+	if (!matchesCredentialTeam(whoami, options.credentialTeamId)) throw new Error("Daemon startup validation failed: selected team credential has a different binding.");
 	const assessment = assessStartupBinding(whoami, options.teamId);
 	if (!assessment.ok) throw new Error(`Daemon startup validation failed: ${assessment.reason}`);
 	const expected = options.expectedAgent;
@@ -3807,9 +3834,9 @@ async function resolveAgentContext(agentName, options = {}) {
 		credentialSource: "environment"
 	};
 	const config = await readConfig(agentDir);
-	if (!config?.agent_key_ref) throw new Error(agentKeyRequiredMessage(agentDir, agentName));
+	if (!config || !hasAgentKeyConfiguration(config)) throw new Error(agentKeyRequiredMessage(agentDir, agentName));
 	const secretProviders = createNodeSecretProviderRegistry();
-	const agentKey = await resolveAgentKey(config, secretProviders);
+	const agentKey = await resolveAgentKey(config, secretProviders, options.teamId);
 	if (!agentKey) throw new Error(agentKeyRequiredMessage(agentDir, agentName));
 	return {
 		agentDir,
@@ -3820,7 +3847,8 @@ async function resolveAgentContext(agentName, options = {}) {
 			agentKey,
 			apiUrl: resolveConfigApiUrl(config, options.envApiUrl)
 		}),
-		credentialSource: "config"
+		credentialSource: "config",
+		credentialTeamId: selectAgentKeyReference(config, options.teamId)?.teamId
 	};
 }
 /**
@@ -3831,7 +3859,7 @@ async function resolveAgentContext(agentName, options = {}) {
 */
 function agentKeyRequiredMessage(agentDir, agentName) {
 	return [
-		`${join(agentDir, "moltnet.json")} has no "agent_key_ref". The daemon`,
+		`${join(agentDir, "moltnet.json")} has no "agent_key_ref" or "agent_key_refs". The daemon`,
 		`requires a team-bound agent key; OAuth2 client_credentials is no longer`,
 		`accepted.`,
 		``,
@@ -3844,7 +3872,7 @@ function agentKeyRequiredMessage(agentDir, agentName) {
 		`    --scopes ${DAEMON_KEY_SCOPES.join(",")} \\`,
 		`    --store`,
 		``,
-		`--store writes "agent_key_ref" into moltnet.json and keeps the secret in`,
+		`--store writes the team slot in "agent_key_refs" and keeps the secret in`,
 		`a provider, so the key itself never lands in the file. Omit --scopes to`,
 		`get the same daemon minimum by default.`,
 		``,
@@ -4558,7 +4586,14 @@ function recoverScratchWorkspacePath(producer, stateDirs) {
 }
 //#endregion
 //#region src/lib/executor-attestation.ts
-var DAEMON_REQUIRED_SCOPES = AGENT_CREDENTIAL_SCOPES;
+/**
+* The startup gate, which is the boot floor rather than the issuance default.
+* Gating on the wider `AGENT_CREDENTIAL_SCOPES` would refuse every key minted
+* before a scope was added to it, and a key cannot widen itself.
+*/
+var DAEMON_REQUIRED_SCOPES = DAEMON_MINIMUM_SCOPES;
+/** What `moltnet agents keys create` should mint for a new daemon. */
+var DAEMON_RECOMMENDED_SCOPES = AGENT_CREDENTIAL_SCOPES;
 async function resolveExecutorSigningPrivateKey(input) {
 	if (input.credentialSource === "environment") {
 		const privateKey = input.configuredPrivateKey.trim();
@@ -4585,7 +4620,7 @@ async function resolveExecutorSigningPrivateKey(input) {
 function validateDaemonScopes(whoami) {
 	const available = new Set(whoami.scopes ?? []);
 	const missing = DAEMON_REQUIRED_SCOPES.filter((scope) => !available.has(scope));
-	if (missing.length > 0) throw new Error(`Daemon startup credential is missing required scopes: ${missing.join(" ")}. Issue a replacement credential with ${DAEMON_REQUIRED_SCOPES.join(" ")}.`);
+	if (missing.length > 0) throw new Error(`Daemon startup credential is missing required scopes: ${missing.join(" ")}. Issue a replacement credential with ${DAEMON_RECOMMENDED_SCOPES.join(" ")}.`);
 }
 async function validateExecutorSigningIdentity(input) {
 	let publicKey;
@@ -6632,11 +6667,13 @@ async function runPolling(opts) {
 			const resolvedContext = await resolveAgentContext(identity.agent, {
 				agentRootDir: explicitAgentRootDir,
 				credentialSource: cfg.credentialSource,
-				envApiUrl: cfg.apiUrl
+				envApiUrl: cfg.apiUrl,
+				teamId
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
 				agent: resolvedContext.agent,
+				credentialTeamId: resolvedContext.credentialTeamId,
 				teamId,
 				expectedAgent: cfg.expectedAgent
 			});
@@ -7239,11 +7276,13 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			const resolvedContext = await resolveAgentContext(identity.agent, {
 				agentRootDir: explicitAgentRootDir,
 				credentialSource: cfg.credentialSource,
-				envApiUrl: cfg.apiUrl
+				envApiUrl: cfg.apiUrl,
+				teamId: values.team
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
 				agent: resolvedContext.agent,
+				credentialTeamId: resolvedContext.credentialTeamId,
 				teamId: values.team,
 				expectedAgent: cfg.expectedAgent
 			});
@@ -9540,9 +9579,10 @@ async function createManagedAgent(store, secrets, input, connectAgent = connect)
 */
 function incompleteRegistrationMessage(alias, known) {
 	const endpoint = `POST /v1/agents/${alias}/reconcile`;
+	const recovery = known.recoveryPath ? ` Inspect the protected recovery file at ${known.recoveryPath}; it may be incomplete.` : "";
 	const reconcile = known.configPath ? `Finish it with ${endpoint} and {"action":"resume"}, or discard the local record with {"action":"abandon"}.` : `No local config was written, so it cannot be resumed; discard the local record with ${endpoint} and {"action":"abandon"}.`;
-	if (known.subjectId) return `the remote agent ${known.subjectId} was registered but local activation is incomplete. ${reconcile}`;
-	return `registration for "${alias}" may have completed on the server${known.fingerprint ? ` (fingerprint ${known.fingerprint})` : ""}; look the agent up first. ${reconcile}`;
+	if (known.subjectId) return `the remote agent ${known.subjectId} was registered but local activation is incomplete. ${reconcile}${recovery}`;
+	return `registration for "${alias}" may have completed on the server${known.fingerprint ? ` (fingerprint ${known.fingerprint})` : ""}; look the agent up first. ${reconcile}${recovery}`;
 }
 /** Resume a fully persisted registration or explicitly abandon local recovery. */
 async function reconcileManagedRegistration(store, secrets, aliasInput, action, connectAgent = connect, signal) {
@@ -9563,8 +9603,9 @@ async function reconcileManagedRegistration(store, secrets, aliasInput, action,
 		store.clearPendingRegistration(alias);
 		return null;
 	}
-	if (!config?.agent_key_ref || config.agent_key_ref.provider !== FILE_SECRET_PROVIDER || config.keys.private_key_ref?.provider !== FILE_SECRET_PROVIDER) throw new AgentServerIdentityError("registration_incomplete", `pending registration for "${alias}" does not have complete managed references`);
-	const [agentKey, privateKeyState] = await Promise.all([secrets.read(config.agent_key_ref.key), secrets.probe(config.keys.private_key_ref.key)]);
+	const reference = config ? selectAgentKeyReference(config)?.reference : void 0;
+	if (!config || !reference || reference.provider !== FILE_SECRET_PROVIDER || config.keys.private_key_ref?.provider !== FILE_SECRET_PROVIDER) throw new AgentServerIdentityError("registration_incomplete", `pending registration for "${alias}" does not have complete managed references`);
+	const [agentKey, privateKeyState] = await Promise.all([secrets.read(reference.key), secrets.probe(config.keys.private_key_ref.key)]);
 	if (!agentKey || privateKeyState !== "present") throw new AgentServerIdentityError("registration_incomplete", `pending registration for "${alias}" is missing persisted secret material`);
 	const apiUrl = requireConfigApiUrl(config, store.agentPath(alias));
 	const whoami = await callWhoami(connectAgent, {
@@ -9600,9 +9641,9 @@ async function attachExternalAgent(store, secretProviders, input, connectAgent =
 	try {
 		if (!central) externalAgentLocation(configPath);
 		const config = await readCurrentConfig(configPath);
-		if (central && !config.agent_key_ref) throw new AgentServerIdentityError("unsupported_credential", `central identity "${alias}" needs a stored agent key before the Agent Server can run it`);
+		if (central && !hasAgentKeyConfiguration(config)) throw new AgentServerIdentityError("unsupported_credential", `central identity "${alias}" needs a stored agent key before the Agent Server can run it`);
 		const configApiUrl = requireTrustedConfigApiUrl(config, configPath);
-		const whoami = await authenticateConfig(config, configPath, requireTrustedApiOverride(input.apiUrl, configApiUrl, configPath), secretProviders, connectAgent, input.signal);
+		const whoami = await authenticateConfig(config, configPath, requireTrustedApiOverride(input.apiUrl, configApiUrl, configPath), secretProviders, connectAgent, input.signal, input.teamId);
 		const identity = identityFromConfig(config);
 		assertIdentityMatches(identity, whoami, `external config ${configPath}`, "authenticated whoami");
 		assertSubjectMatches(whoami, config, "authenticated whoami", `external config ${configPath}`);
@@ -9629,15 +9670,16 @@ async function attachExternalAgent(store, secretProviders, input, connectAgent =
 	}
 }
 /** Load and authenticate the current config, then refresh its derived pin. */
-async function verifyAgentActivation(store, alias, managedSecretProviders, externalSecretProviders, connectAgent = connect, signal) {
+async function verifyAgentActivation(store, alias, managedSecretProviders, externalSecretProviders, connectAgent = connect, signal, teamId) {
 	const activation = requireActivation(store, alias);
-	const verified = activation.source === "managed" ? await verifyManagedActivation(store, activation, managedSecretProviders, connectAgent, signal) : await verifyExternalActivation(store, activation, externalSecretProviders, connectAgent, signal);
+	teamId ??= activation.boundTeamId;
+	const verified = activation.source === "managed" ? await verifyManagedActivation(store, activation, managedSecretProviders, connectAgent, signal, teamId) : await verifyExternalActivation(store, activation, externalSecretProviders, connectAgent, signal, teamId);
 	assertSubjectMatches(verified.whoami, verified.config, "authenticated whoami", `agent "${activation.alias}" config`);
 	if (verified.whoami.subjectId !== activation.subjectId) throw new AgentServerIdentityError("verification_failed", `authenticated whoami subject does not match agent "${activation.alias}" pinned activation`);
 	const identity = identityFromConfig(verified.config);
 	assertIdentityMatches(verified.whoami, identity, "authenticated whoami", `agent "${activation.alias}" config`);
 	const boundTeamId = boundTeamIdFromWhoami(verified.whoami);
-	if (activation.boundTeamId !== boundTeamId) throw new AgentServerIdentityError("verification_failed", `authenticated whoami team binding does not match agent "${activation.alias}" pinned activation`);
+	if (!selectAgentKeyReference(verified.config, teamId)?.teamId && activation.boundTeamId !== boundTeamId) throw new AgentServerIdentityError("verification_failed", `authenticated whoami team binding does not match agent "${activation.alias}" pinned activation`);
 	const refreshed = {
 		...activation,
 		...identity
@@ -9652,36 +9694,26 @@ async function verifyAgentActivation(store, alias, managedSecretProviders, exter
 		...boundTeamId ? { boundTeamId } : {}
 	};
 }
-async function verifyManagedActivation(store, activation, secretProviders, connectAgent, signal) {
+async function verifyManagedActivation(store, activation, secretProviders, connectAgent, signal, teamId) {
 	const configPath = store.agentPath(activation.alias);
 	const config = await readCurrentConfig(configPath);
 	assertActivatedConfig(config, activation, configPath, requireConfigApiUrl(config, configPath), activation.apiUrl);
-	let agentKey;
-	try {
-		agentKey = await resolveAgentKey(config, secretProviders);
-	} catch (cause) {
-		throw verificationError(`could not resolve the managed agent key for "${activation.alias}"`, cause);
-	}
-	if (!agentKey) throw new AgentServerIdentityError("verification_failed", `managed config for "${activation.alias}" has no agent_key_ref`);
 	return {
 		config,
-		whoami: await callWhoami(connectAgent, {
-			agentKey,
-			apiUrl: activation.apiUrl
-		}, configPath, signal)
+		whoami: await authenticateConfig(config, configPath, activation.apiUrl, secretProviders, connectAgent, signal, teamId)
 	};
 }
-async function verifyExternalActivation(store, activation, secretProviders, connectAgent, signal) {
+async function verifyExternalActivation(store, activation, secretProviders, connectAgent, signal, teamId) {
 	const central = activation.configPath === store.agentPath(activation.alias);
 	if (!central) externalAgentLocation(activation.configPath);
 	assertTrustedConfigApiUrl(activation.configApiUrl);
 	const config = await readCurrentConfig(activation.configPath);
-	if (central && !config.agent_key_ref) throw new AgentServerIdentityError("unsupported_credential", `central identity "${activation.alias}" needs a stored agent key before the Agent Server can run it`);
+	if (central && !hasAgentKeyConfiguration(config)) throw new AgentServerIdentityError("unsupported_credential", `central identity "${activation.alias}" needs a stored agent key before the Agent Server can run it`);
 	assertActivatedConfig(config, activation, activation.configPath, requireTrustedConfigApiUrl(config, activation.configPath), activation.configApiUrl);
 	const effectiveApiUrl = requireTrustedApiOverride(activation.apiUrl, activation.configApiUrl, activation.configPath);
 	return {
 		config,
-		whoami: await authenticateConfig(config, activation.configPath, effectiveApiUrl, secretProviders, connectAgent, signal)
+		whoami: await authenticateConfig(config, activation.configPath, effectiveApiUrl, secretProviders, connectAgent, signal, teamId)
 	};
 }
 /** Never let request or activation metadata redirect persisted credentials. */
@@ -9741,18 +9773,20 @@ function externalAgentLocation(configPath) {
 		agentRoot: dirname(moltnetDir)
 	};
 }
-async function authenticateConfig(config, configPath, apiUrl, secretProviders, connectAgent, signal) {
+async function authenticateConfig(config, configPath, apiUrl, secretProviders, connectAgent, signal, teamId) {
 	let agentKey;
 	try {
-		agentKey = await resolveAgentKey(config, secretProviders);
+		agentKey = await resolveAgentKey(config, secretProviders, teamId);
 	} catch (cause) {
-		throw verificationError(`could not resolve the daemon agent key from ${configPath}`, cause);
+		throw verificationError(`could not resolve the daemon agent key from ${configPath}; select a team and enroll or repair its stored key`, cause);
 	}
 	if (!agentKey) throw new AgentServerIdentityError("unsupported_credential", `external daemon config at ${configPath} must contain an agent_key_ref`);
-	return callWhoami(connectAgent, {
+	const whoami = await callWhoami(connectAgent, {
 		agentKey,
 		...apiUrl ? { apiUrl } : {}
 	}, configPath, signal);
+	if (!matchesCredentialTeam(whoami, selectAgentKeyReference(config, teamId)?.teamId)) throw new AgentServerIdentityError("verification_failed", "authenticated credential team binding does not match the selected team");
+	return whoami;
 }
 async function callWhoami(connectAgent, options, source, signal) {
 	try {
@@ -9797,7 +9831,7 @@ function publicAgentView(store, activation) {
 			...activation.boundTeamId ? { teamId: activation.boundTeamId } : {},
 			apiUrl: activation.apiUrl,
 			createdAt: activation.createdAt,
-			hasAgentKey: Boolean(config?.agent_key_ref),
+			hasAgentKey: Boolean(config && hasAgentKeyConfiguration(config)),
 			hasPrivateKey: Boolean(config?.keys.private_key_ref)
 		};
 	}
@@ -9942,15 +9976,16 @@ var RunManager = class {
 			...target.extraArgs
 		];
 		if (activation.source === "managed") {
-			if (!config.agent_key_ref || !config.keys.private_key_ref) throw new AgentServerRunError("invalid_spec", `managed config for "${activation.alias}" is missing canonical secret references`);
+			const reference = selectAgentKeyReference(config, spec.teamId)?.reference;
+			if (!reference || !config.keys.private_key_ref) throw new AgentServerRunError("invalid_spec", `managed config for "${activation.alias}" is missing canonical secret references`);
 			env["MOLTNET_API_URL"] = activation.apiUrl;
-			env["MOLTNET_AGENT_KEY_REF"] = formatSecretReferenceString(config.agent_key_ref);
+			env["MOLTNET_AGENT_KEY_REF"] = formatSecretReferenceString(reference);
 			env["MOLTNET_PRIVATE_KEY_REF"] = formatSecretReferenceString(config.keys.private_key_ref);
 			env["MOLTNET_SECRET_ROOT"] = this.store.secretsDir;
 		} else {
 			env["MOLTNET_API_URL"] = activation.apiUrl ?? activation.configApiUrl;
 			try {
-				const agentKey = await resolveAgentKey(config, this.options.externalSecretProviders);
+				const agentKey = await resolveAgentKey(config, this.options.externalSecretProviders, spec.teamId);
 				if (!agentKey) throw new Error("external daemon config has no agent key");
 				env["MOLTNET_AGENT_KEY"] = agentKey;
 				env["MOLTNET_PRIVATE_KEY"] = await resolveIdentitySeed(config, this.options.externalSecretProviders);
@@ -9990,7 +10025,10 @@ var RunManager = class {
 	}
 	async startReserved(spec, signal) {
 		this.assertStartOpen(signal);
-		const agent = await (this.options.verifyActivationImpl ?? verifyAgentActivation)(this.store, spec.agent, this.options.secretProviders, this.options.externalSecretProviders, void 0, signal);
+		const agent = await (this.options.verifyActivationImpl ?? verifyAgentActivation)(this.store, spec.agent, this.options.secretProviders, this.options.externalSecretProviders, void 0, signal, spec.teamId).catch((cause) => {
+			if (cause instanceof AgentServerIdentityError && cause.code === "verification_failed") throw new AgentServerIdentityError(cause.code, `Cannot start agent "${spec.agent}" for team "${spec.teamId}": credential verification failed. Check the selected team key and activation.`, { cause });
+			throw cause;
+		});
 		this.assertStartOpen(signal);
 		if (agent.boundTeamId && agent.boundTeamId !== spec.teamId) throw new AgentServerRunError("invalid_spec", `agent "${spec.agent}" has a key bound to team ${agent.boundTeamId}; start the run with that team, or create a new agent with an enrollment token from team ${spec.teamId}`);
 		const id = `${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
@@ -10119,7 +10157,7 @@ var RunManager = class {
 	}
 	async resolveRuntimeModule(spec, activated, cwd) {
 		const profiles = await resolveRuntimeProfiles({
-			agent: await this.connectActivatedAgent(activated),
+			agent: await this.connectActivatedAgent(activated, spec.teamId),
 			profiles: spec.profiles,
 			teamId: spec.teamId,
 			cwd
@@ -10141,21 +10179,13 @@ var RunManager = class {
 		if (kind === "gondolin_pi") return void 0;
 		throw new AgentServerRunError("invalid_spec", `No local runtime is registered for profile kind "${kind}".`);
 	}
-	async connectActivatedAgent(activated) {
+	async connectActivatedAgent(activated, teamId) {
 		const { activation, config } = activated;
-		if (activation.source === "managed") {
-			const agentKey = await resolveAgentKey(config, this.options.secretProviders);
-			if (!agentKey) throw new AgentServerRunError("invalid_spec", `managed agent "${activation.alias}" has no agent key`);
-			return connect({
-				agentKey,
-				apiUrl: activation.apiUrl
-			});
-		}
-		const agentKey = await resolveAgentKey(config, this.options.externalSecretProviders);
-		if (!agentKey) throw new AgentServerRunError("invalid_spec", `external agent "${activation.alias}" has no agent key`);
+		const agentKey = await resolveAgentKey(config, activation.source === "managed" ? this.options.secretProviders : this.options.externalSecretProviders, teamId);
+		if (!agentKey) throw new AgentServerRunError("invalid_spec", `agent "${activation.alias}" has no agent key`);
 		return connect({
 			agentKey,
-			apiUrl: activation.apiUrl ?? activation.configApiUrl
+			apiUrl: activation.source === "managed" ? activation.apiUrl : activation.apiUrl ?? activation.configApiUrl
 		});
 	}
 	stop(id) {
@@ -10638,7 +10668,8 @@ var CreateAgentSchema = Type.Union([Type.Object({
 	enrollmentToken: Type.String()
 }), Type.Object({
 	kind: Type.Literal("external"),
-	identityAlias: Type.String()
+	identityAlias: Type.String(),
+	teamId: Type.Optional(Type.String({ format: "uuid" }))
 })]);
 var ReconcileAgentSchema = Type.Object({ action: Type.Union([Type.Literal("resume"), Type.Literal("abandon")]) });
 var ReconcileAgentResultSchema = Type.Union([schemaRef(AgentServerAgentSchema), Type.Object({ abandoned: Type.Literal(true) })], { $id: "ReconcileAgentResult" });
@@ -11151,6 +11182,7 @@ function registerAgentRoutes(app, options, requirePairedOrigin) {
 			const entry = await attachExternalAgent(store, options.externalSecretProviders, {
 				name: identityAlias,
 				configDir: store.identityDir(identityAlias),
+				...typeof body["teamId"] === "string" ? { teamId: body["teamId"] } : {},
 				signal
 			});
 			return reply.code(201).send(publicAgentView(store, entry.activation));
@@ -11182,7 +11214,7 @@ function identityViews(store) {
 	return store.listIdentityAliases().map((alias) => ({
 		alias,
 		activated: activated.has(alias),
-		hasAgentKey: Boolean(store.readAgentConfig(alias)?.agent_key_ref)
+		hasAgentKey: hasAgentKeyConfiguration(store.readAgentConfig(alias) ?? {})
 	}));
 }
 function registerProviderRoutes(app, options, requirePairedOrigin) {
@@ -12020,11 +12052,13 @@ async function runSyncSessions(argv) {
 	const ctx = await resolveAgentContext(identity.agent, {
 		credentialSource: cfg.credentialSource,
 		envApiUrl: cfg.apiUrl,
+		teamId: values.team,
 		agentRootDir: explicitAgentRootDir
 	});
 	await validateStartupBinding({
 		agent: ctx.agent,
-		teamId: values.team
+		teamId: values.team,
+		credentialTeamId: ctx.credentialTeamId
 	});
 	const stateDirs = ensureDaemonStateDirs(agentRootDir);
 	const result = await syncRuntimeSessions({
@@ -12209,7 +12243,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.59.0";
+var DAEMON_VERSION = "0.60.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.59.0",
+  "version": "0.60.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -85,10 +85,10 @@
     "proper-lockfile": "4.1.2",
     "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "1.0.3",
-    "@themoltnet/pi-runtime": "0.18.0",
+    "@themoltnet/agent-runtime": "1.1.0",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/sdk": "0.142.0"
+    "@themoltnet/sdk": "0.143.0",
+    "@themoltnet/pi-runtime": "0.18.1"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -98,17 +98,17 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
+    "@moltnet/api-client": "0.1.0",
     "@moltnet/agent-eval": "0.1.0",
     "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/api-client": "0.1.0",
     "@moltnet/execution-integrations": "0.1.0",
     "@moltnet/execution-plan": "0.1.0",
     "@moltnet/loopback-companion": "0.1.0",
-    "@moltnet/observability": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/models": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/observability": "0.1.0",
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/models": "0.1.0"
   },
   "nx": {
     "projectType": "application",