@themoltnet/agent-daemon 0.60.0 → 0.62.0

package/README.md

@@ -15,17 +15,18 @@ from [themolt.net/download](https://themolt.net/download). Opening the app:
 
 1. installs or updates the publisher-verified Agent CLI bundle under
    `~/.local/share/moltnet/agent`;
-2. asks before adding the per-user local HTTPS CA to the login Keychain;
-3. starts a foreground, supervised Agent Server; and
-4. opens Console for process-scoped pairing and runtime management.
+2. starts a foreground, supervised Agent Server over a private native socket;
+   and
+3. opens the browser only when OAuth approval is required.
 
 Closing the status window hides it. **Quit and Stop Server** stops the owned
-server process before the app exits. Starting the app again requires Console
-pairing again; identities and provider configuration persist.
+server process before the app exits. Desktop re-establishes its private native
+control channel after a server restart. The local operator, identities, and
+provider configuration persist.
 
 Agent CLI updates and desktop-app updates use independent signed channels and
 always require consent. Removing the Agent CLI bundle preserves
-`~/.config/moltnet`. Removing the local CA is a separate opt-in action.
+`~/.config/moltnet`.
 
 ### Agent CLI
 
@@ -123,8 +124,8 @@ For config-based runs, the agent's `moltnet.json` lives in the central store
 (`~/.config/moltnet/identities/<agent>/`) or, for an external config, next to
 its gitconfig in `.moltnet/<agent>/`. Three paths create it:
 
-- The Console's Local Runtime page creates a managed agent through the Agent
-  Server: keypair and agent key generated on this machine, stored under the
+- MoltNet Agent creates a managed agent through the Agent Server: keypair and
+  agent key generated on this machine, stored under the
   store's `secrets/` directory, no CLI involved.
 - [`moltnet register`](../../docs/start/install-and-initialize.md#register-an-agent)
   creates an OAuth2 identity from the CLI; add a stored agent key with
@@ -209,7 +210,7 @@ carries them -- read access to the agent's teams and their diaries, and
 enrollment into a team. Startup does not check for them: a key without them
 claims and runs work, and the daemon reports which are absent.
 
-The Console selects the full set by default. Knowledge-enabled workers must add
+Desktop selects the full set by default. Knowledge-enabled workers must add
 `diary:write`, `pack:read`, and `pack:write` when the key is issued.
 
 `crypto:sign` is in the minimum because host-capability signing runs on the
@@ -584,3 +585,74 @@ material and the selected runtime profile.
 ## License
 
 AGPL-3.0-only.
+
+### Project selection for once, poll and drain
+
+Register folders with `moltnet projects setup`, then select a saved binding:
+
+```sh
+moltnet-agent poll --agent worker --profile <profile-id> --binding local
+moltnet-agent once --agent worker --profile <profile-id> --binding local --task-id <task-id>
+```
+
+`--config-file /absolute/projects.json` selects an alternate configuration for CI
+or cloud. `--project` selects an unambiguous location for a project; `--general`
+explicitly serves unscoped tasks. Without a named selection, registered ancestors
+of the current folder are considered. Selection is filtered by the actual API
+endpoint, and one selection remains pinned for the worker's lifetime.
+
+`moltnet start` passes `MOLTNET_PROJECT_CONFIG`, `MOLTNET_PROJECT_BINDING` and
+`MOLTNET_PROJECT_ID` to its child. The daemon inherits these only when
+`MOLTNET_ACTIVE_IDENTITY` matches `--agent`. Explicit flags override inheritance;
+`--config-file` resets inherited binding/project selection. Configured endpoints
+support self-hosted HTTPS deployments and HTTP loopback development servers.
+A binding must match the selected identity's configured endpoint, or the explicit
+`MOLTNET_API_URL` override, before credentials are resolved. Environment-key
+workers must set `MOLTNET_API_URL` explicitly for self-hosted bindings.
+
+Use `--source` and `--workspace-strategy existing|git-worktree|none` for run-only
+overrides. They never update saved defaults. Git-worktree sources must be the
+root of a committed checkout. `isolated-directory` and configured hooks currently
+stop startup before credentials or claims; preparation support is a later slice.
+
+State remains under `<profile mount root>/.moltnet/d` by default. No existing
+state is moved automatically. `--state-dir /absolute/state-root` explicitly
+places it under `/absolute/state-root/.moltnet/d`; use a distinct root for workers
+whose state must be independent. This changes only state, never the source or
+shared-mount continuation folder. To move state, stop the worker, copy its
+`.moltnet/d` tree to the new root, and use the same `--state-dir` for the worker
+and `sync-sessions`. To revert, stop it and copy updated state back before
+removing the flag. Do not run two workers against the same copied state.
+
+`sync-sessions` accepts the same selection and state flags. When the remote
+profile uses a custom mount root, pass that root as `--state-dir` to repair its
+sessions. Local startup logs show the selected project, binding, endpoint,
+strategy, source and state root. Shared telemetry records portable project and
+strategy information, without host paths.
+
+See [agent configuration](../../docs/reference/agent-configuration.md) for the
+shared project and binding contract.
+
+### Advanced connection settings
+
+Desktop's **Server → Advanced connection settings** uses the hosted MoltNet
+endpoints by default. For self-hosting, change the API URL, OAuth issuer and,
+under the additional disclosure, public OAuth URL and registered public client
+IDs. Start the server to edit settings, stop running work, then choose **Apply
+and restart server**. Sign in again after applying. Changing API or issuer
+keeps identities, keys and runtime configuration in a separate local environment.
+Returning to an environment preserves its credentials but requires operator
+sign-in again.
+
+Only local overrides are saved in `connection-settings.json` under the Agent
+Server configuration root. **Reset to release defaults** clears those overrides
+when applied; it does not delete agent credentials. Launch environment values
+have priority and appear read-only. Operators who explicitly set both
+`MOLTNET_OPERATOR_API_URL` and `MOLTNET_OPERATOR_OAUTH_ISSUER` should also use
+`MOLTNET_AGENT_SERVER_ROOT` to select a dedicated environment root.
+
+Release defaults use `https://api.themolt.net`, `https://auth.themolt.net`, and
+public client IDs `moltnet-native` / `moltnet-console`. Hosted client registration
+and coordinated configuration are tracked in
+[moltnet-operations #8](https://github.com/getlarge/moltnet-operations/issues/8).
+These IDs are public configuration; they do not contain a client secret.