@themoltnet/agent-daemon 0.60.0 → 0.62.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { assertRuntimeAdapterSupportsProfile } from "./runtime.js";
-import { a as cryptoService, defaultPiDaemonAdapter, i as compileExecutionPlan, n as createExecutionPlanSnapshot, r as parseCredentialRequirements, t as runtimeExecutionOffer } from "./pi.js";
+import { a as enrollmentProofMessage, defaultPiDaemonAdapter, i as compileExecutionPlan, n as createExecutionPlanSnapshot, o as cryptoService, r as parseCredentialRequirements, t as runtimeExecutionOffer } from "./pi.js";
 import { createRequire } from "node:module";
 import { pino, transport } from "pino";
 import { Type } from "typebox";
@@ -8,15 +8,15 @@ import "multiformats/cid";
 import "multiformats/codecs/json";
 import "multiformats/hashes/sha2";
 import "typebox/value";
+import { execFile, spawn } from "node:child_process";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
-import { parseArgs, promisify } from "node:util";
-import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, createLocalSeedSigner, resolveAgentIdentity, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
+import { parseArgs, parseEnv, promisify } from "node:util";
+import { CredentialPersistenceError, EnrollmentRecoveryError, FILE_SECRET_PROVIDER, FileSecretProvider, ProjectConfigError, ProvisioningNotStartedError, RegisterIdentityError, WORKSPACE_STRATEGIES, boundedIdentitySignal, canonicalDirectory, connect, createNodeSecretProviderRegistry, enrollTeam, getProjectConfigPath, readProjectConfig, register, resolveProjectBinding } from "@themoltnet/sdk/node";
+import { constants, copyFileSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, hasAgentKeyConfiguration, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, selectAgentKeyReference, signBytes } from "@themoltnet/sdk";
+import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, RuntimeProfilePrerequisiteError, createLocalSeedSigner, resolveAgentIdentity, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
-import { FILE_SECRET_PROVIDER, FileSecretProvider, RegisterIdentityError, boundedIdentitySignal, connect, createNodeSecretProviderRegistry, register } from "@themoltnet/sdk/node";
-import { constants, copyFileSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, hasAgentKeyConfiguration, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, selectAgentKeyReference } from "@themoltnet/sdk";
-import { execFile, spawn } from "node:child_process";
-import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { once } from "node:events";
 import { metrics } from "@opentelemetry/api";
 import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-proto";
@@ -28,8 +28,8 @@ import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
 import { homedir, platform, tmpdir } from "node:os";
 import { PI_MODEL_MODALITIES, writePiConfig } from "@themoltnet/pi-runtime/pi-config";
+import { chmod, lstat, mkdir, open, readFile, readdir, realpath, stat, writeFile } from "node:fs/promises";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { mkdir, open, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
 import { createInterface } from "node:readline/promises";
 import { ModelRuntime, readStoredCredential } from "@earendil-works/pi-coding-agent";
@@ -38,13 +38,13 @@ import { lock, lockSync } from "proper-lockfile";
 import { isIP } from "node:net";
 import cors from "@fastify/cors";
 import helmet from "@fastify/helmet";
+import { createServer } from "node:http";
+import { createRemoteJWKSet, jwtVerify } from "jose";
 import { Transform, Writable } from "node:stream";
 import { pathToFileURL } from "node:url";
 import { StringDecoder } from "node:string_decoder";
 import rateLimit from "@fastify/rate-limit";
 import Fastify from "fastify";
-import "reflect-metadata";
-import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, IP, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, X509CertificateGenerator } from "@peculiar/x509";
 import { createGzip } from "node:zlib";
 //#region ../../libs/tasks/src/rubric.ts
 /**
@@ -857,6 +857,23 @@ Object.freeze([...[
 	"offline_access"
 ], ...MCP_CLIENT_SCOPES]);
 //#endregion
+//#region ../../libs/models/src/operator-oauth.ts
+/** Public protocol constants shared by consent, native control, and Console. */
+var OPERATOR_OAUTH = Object.freeze({
+	protocolVersion: 2,
+	provisioningScope: "moltnet:provision",
+	localControlScope: "moltnet:local-control",
+	provisioningAudience: "moltnet:provisioning",
+	localControlAudience: "moltnet:agent-server",
+	nativeClientId: "moltnet-native",
+	consoleClientId: "moltnet-console",
+	approvalTransportGraceSeconds: 30,
+	callbackPort: 17375,
+	consoleLifetimeSeconds: 900,
+	nativeLifetimeSeconds: 300,
+	serverPort: 17374
+});
+//#endregion
 //#region ../../libs/models/src/preview-sign.ts
 function schemaRef$2(schema, id) {
 	return Type.Unsafe(Type.Ref(id));
@@ -1208,7 +1225,8 @@ Type.Object({
 });
 Type.Object({
 	code: Type.String({ minLength: 1 }),
-	issueAgentKey: Type.Optional(Type.Literal(true))
+	issueAgentKey: Type.Optional(Type.Literal(true)),
+	expectedTeamId: Type.Optional(UuidSchema)
 });
 Type.Object({ role: Type.Union([
 	Type.Literal("manager"),
@@ -1449,6 +1467,7 @@ var ProblemCodeSchema = Type.Union([
 	Type.Literal("FORBIDDEN"),
 	Type.Literal("NOT_FOUND"),
 	Type.Literal("CONFLICT"),
+	Type.Literal("PROJECT_MISMATCH"),
 	Type.Literal("UNSUPPORTED_MEDIA_TYPE"),
 	Type.Literal("VALIDATION_FAILED"),
 	Type.Literal("INVALID_CHALLENGE"),
@@ -1529,6 +1548,34 @@ Type.Intersect([ConflictProblemDetailsSchema, Type.Object({ flagged: Type.Option
 	threats: Type.Array(Type.Ref("InjectionThreat"))
 }, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
 Type.Intersect([ProblemDetailsSchema, Type.Object({ errors: Type.Array(Type.Ref("ValidationError")) })], { $id: "ValidationProblemDetails" });
+Type.Object({
+	id: Type.String({ format: "uuid" }),
+	teamId: Type.String({ format: "uuid" }),
+	creatorAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	creatorHumanId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	name: Type.String(),
+	description: Type.Union([Type.String(), Type.Null()]),
+	defaultDiaryId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
+	archived: Type.Boolean(),
+	createdAt: Type.String({ format: "date-time" }),
+	updatedAt: Type.String({ format: "date-time" })
+});
+var CreateProjectSchema = Type.Object({
+	name: Type.String({
+		minLength: 1,
+		maxLength: 255,
+		pattern: "\\S"
+	}),
+	description: Type.Optional(Type.Union([Type.String({ maxLength: 1e4 }), Type.Null()])),
+	defaultDiaryId: Type.Optional(Type.Union([Type.String({ format: "uuid" }), Type.Null()]))
+}, { additionalProperties: false });
+Type.Object({
+	...Type.Partial(CreateProjectSchema).properties,
+	archived: Type.Optional(Type.Boolean())
+}, {
+	additionalProperties: false,
+	minProperties: 1
+});
 Type.Union([
 	Type.Literal("pack"),
 	Type.Literal("entry"),
@@ -1967,7 +2014,7 @@ var RuntimeProfileMaxBashTimeouts = Type.Integer({
 	minimum: 0,
 	maximum: 1e3
 });
-Type.Object({
+var RuntimeProfile = Type.Object({
 	id: Type.String({ format: "uuid" }),
 	teamId: Type.String({ format: "uuid" }),
 	name: RuntimeProfileName,
@@ -3353,6 +3400,7 @@ Type.Object({
 	title: Type.Union([Type.String(), Type.Null()]),
 	tags: Type.Array(Type.String()),
 	teamId: Uuid,
+	projectId: Type.Union([Uuid, Type.Null()]),
 	diaryId: Type.Union([Uuid, Type.Null()]),
 	outputKind: OutputKind,
 	input: Type.Record(Type.String(), Type.Unknown()),
@@ -3461,257 +3509,6 @@ Type.Object({
 	additionalProperties: false
 });
 //#endregion
-//#region src/lib/help.ts
-var COMMON_REQUIRED_FLAGS = `\
-  -a, --agent <name>          MoltNet agent identity. Agent-key auth is
-                              configless; OAuth2 reads moltnet.json.
-  --profile <uuid|name>       Remote runtime profile. Repeat for poll/drain
-                              to declare priority order. Provider, model,
-                              sandbox policy, prerequisites, and runtime
-                              execution policy come from the selected profile.`;
-var COMMON_OPTIONAL_FLAGS = `\
-  --sandbox <path>            Deprecated. Remote runtime profiles define
-                              sandbox policy.
-  --agent-root <path>         Directory that owns .moltnet/<agent>. Default:
-                              CWD, with git root fallback when available.
-  --git-author <"Name <email>">
-                              Non-secret git identity projected into the
-                              guest for host-brokered commit signing. Default:
-                              host git config. Configless agent-key runs must
-                              provide this flag or MOLTNET_GIT_AUTHOR.
-                              Env: MOLTNET_GIT_AUTHOR.
-  --heartbeat-interval-ms <n> Reporter heartbeat cadence. Default: 60000.
-  --warm-retention-sec <n>    Resumability window for runtime slots
-                              (Pi sessions + reusable worktrees) after use.
-                              Default: 1800.
-  --debug                     Verbose logging: also log successful list/claim
-                              outcomes (candidate counts, claim attempts).`;
-var REGISTERED_TASK_TYPES = Object.keys(BUILT_IN_TASK_TYPES).sort();
-function knownTaskTypesList() {
-	return REGISTERED_TASK_TYPES.join(", ");
-}
-var ROOT_USAGE = `\
-agent-daemon — long-running task worker for MoltNet.
-
-Usage: agent-daemon [--runtime <module>] <command> [...flags]
-
-Runtime:
-  --runtime <module>          Trusted local file or installed package whose
-                              default export is a DaemonRuntimeAdapter.
-                              Omit to use the built-in gondolin_pi runtime.
-
-Commands:
-  poll      Long-running worker. Polls the task queue and claims tasks
-            matching the configured filter until SIGINT/SIGTERM.
-  once      Claim and execute one specific queued task by id, then exit.
-  drain     Poll until the queue has nothing claimable, then exit.
-            Useful for batch eval runs and demos.
-  server    Loopback supervisor for console-managed runs: pairing,
-            agent/provider config store, and start/stop of poll/drain
-            child processes. Binds 127.0.0.1 only.
-  server trust
-            Install the per-user macOS local-HTTPS CA after explicit consent.
-  providers Manage configured endpoints and Pi OAuth subscriptions without
-            starting the Agent Server. See \`agent-daemon providers --help\`.
-  sync-sessions
-            Repair durable runtime-session checkpoints from local slot files.
-  update check
-            Check the stable MoltNet agent release without reading credentials.
-
-Run \`agent-daemon <command> --help\` for command-specific flags.
-
-Prerequisites:
-  - configless: MOLTNET_AGENT_KEY (or MOLTNET_AGENT_KEY_REF) and
-    MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF); no agent files
-  - config-based: ~/.config/moltnet/identities/<agent>/moltnet.json
-    carrying agent_key_refs or agent_key_ref (OAuth2 is not accepted)
-    --agent-root explicitly selects a legacy .moltnet/<agent> bundle
-
-No key yet? Mint one with the CLI (--store writes the team slot into
-moltnet.json and keeps the secret in a provider):
-
-  moltnet teams list             # find the team id
-  moltnet agents keys create --team-id <team-uuid> \\
-    --name <agent>-daemon --store
-
-  https://docs.themolt.net/operate/agent-keys#run-the-daemon-with-an-agent-key
-  - --profile — remote runtime profile supplies provider/model/sandbox
-    policy and CWD is used as the VM mountPath.
-
-Registered task types: ${knownTaskTypesList()}`;
-var POLL_HELP = `\
-agent-daemon poll — long-running task worker.
-
-Usage:
-  agent-daemon poll --team <uuid> --agent <name> --profile <uuid|name> [...]
-
-Required:
-  --team <uuid>               Team whose queue to serve. The daemon must be
-                              a member of this team (canAccessTeam permit).
-${COMMON_REQUIRED_FLAGS}
-
-Optional:
-  --task-types <csv>          Whitelist of task types to claim. Default:
-                              accept any registered type. Known types:
-                              ${knownTaskTypesList()}
-  --correlation-id <uuid>     Restrict claims to one orchestration run.
-  --diary-ids <csv>           Further client-side filter on task.diaryId.
-  --poll-interval-ms <n>      Idle backoff floor. Default: 2000.
-  --max-poll-interval-ms <n>  Idle backoff ceiling. Default: 30000.
-  --list-limit <n>            Page size per list call. Default: 10.
-${COMMON_OPTIONAL_FLAGS}
-
-Example:
-  agent-daemon poll \\
-    --team 6743b4b1-6b93-46e2-a048-19490f04f91a \\
-    --task-types curate_pack,fulfill_brief \\
-    --agent legreffier \\
-    --profile github-linear \\
-    --profile local-fallback
-
-Stops cleanly on SIGINT/SIGTERM (drains the in-flight task before exit).`;
-var ONCE_HELP = `\
-agent-daemon once — execute one specific queued task by id, then exit.
-
-Usage:
-  agent-daemon once --task-id <uuid> --agent <name> --profile <uuid|name> [...]
-
-Required:
-  -t, --task-id <uuid>        Task to claim and execute. Must already be
-                              in 'queued' status.
-${COMMON_REQUIRED_FLAGS}
-
-Optional:
-  --team <uuid>               Team scope for resolving --profile by name.
-                              Required only when --profile is a name.
-${COMMON_OPTIONAL_FLAGS}
-
-Example:
-  agent-daemon once \\
-    --task-id 26004a77-bc10-43ef-a79f-c8e62faf59b1 \\
-    --agent legreffier \\
-    --profile github-linear
-
-Exits 0 on completed, 1 on failed/cancelled/runtime-error.`;
-var DRAIN_HELP = `\
-agent-daemon drain — poll until the queue is empty, then exit.
-
-Usage:
-  agent-daemon drain --team <uuid> --agent <name> --profile <uuid|name> [...]
-
-Same flags as \`poll\`. The only behavioural difference: \`drain\` exits
-when a list call confirms no claimable tasks remain (vs \`poll\` which
-sleeps and retries forever).
-
-Required:
-  --team <uuid>               Team whose queue to drain.
-${COMMON_REQUIRED_FLAGS}
-
-Optional:
-  --task-types <csv>          Whitelist. Known types: ${knownTaskTypesList()}
-  --correlation-id <uuid>     Restrict claims to one orchestration run.
-  --wait-for-first-task-sec <n>
-                              Wait this long for an initially empty run before
-                              exiting. After the first claim, exit on empty.
-  --wait-after-task-sec <n>   Require the queue to remain empty for this long
-                              after a claim before exiting.
-  --diary-ids <csv>           Diary filter.
-  --poll-interval-ms <n>      Default: 2000.
-  --max-poll-interval-ms <n>  Default: 30000.
-  --list-limit <n>            Default: 10.
-${COMMON_OPTIONAL_FLAGS}
-
-Example:
-  agent-daemon drain \\
-    --team 6743b4b1-6b93-46e2-a048-19490f04f91a \\
-    --task-types judge_pack \\
-    --agent legreffier \\
-    --profile eval-judge`;
-var SYNC_SESSIONS_HELP = `\
-agent-daemon sync-sessions — repair durable runtime-session checkpoints.
-
-Usage:
-  agent-daemon sync-sessions --team <uuid> --agent <name> [...]
-
-Scans this daemon's team-scoped runtime slots, compares local Pi session files
-with durable runtime-session metadata, and uploads missing or stale checkpoints.
-
-Required:
-  --team <uuid>               Team whose runtime slots to inspect.
-  -a, --agent <name>          MoltNet agent identity. Reads credentials
-                              from <agent-root>/.moltnet/<name>/moltnet.json.
-
-Optional:
-  --runtime-profile-id <uuid> Limit repair to one runtime profile.
-  --state <active|idle>       Limit scanned slots by state. Default: all.
-  --limit <n>                 Max slots to scan, 1..200. Default: 100.
-  --dry-run                   Report missing/stale sessions without uploading.
-  --agent-root <path>         Directory that owns .moltnet/<agent>. Default:
-                              CWD, with git root fallback when available.
-  --debug                     Accepted for consistency; no extra output yet.
-
-Example:
-  agent-daemon sync-sessions \\
-    --team 6743b4b1-6b93-46e2-a048-19490f04f91a \\
-    --agent legreffier \\
-    --state idle`;
-function isHelpFlag(args) {
-	return args.includes("--help") || args.includes("-h");
-}
-var AGENT_SERVER_HELP = `\
-agent-daemon server — loopback supervisor for console-managed runs.
-
-Binds 127.0.0.1 only. A paired Console origin configures agents and
-providers (secret references only) and starts/stops poll/drain runs as
-child processes of this supervisor.
-
-Options:
-  --port <n>                  Loopback port. Default: 17374.
-                              Env: MOLTNET_AGENT_SERVER_PORT.
-  --allowed-origins <csv>     Exact Console origins allowed to pair.
-                              Default: https://console.themolt.net.
-                              Env: MOLTNET_AGENT_SERVER_ALLOWED_ORIGINS.
-  --root <path>               Config root. Default: ~/.config/moltnet
-                              (or MOLTNET_AGENT_SERVER_ROOT).
-  --api-url <url>             Default MoltNet API for new managed agents.
-                              Default: https://api.themolt.net.
-  --heartbeat-interval-ms <n> Child reporter heartbeat cadence. Default: 60000.
-  --warm-retention-sec <n>    Child session/workspace retention. Default: 1800.
-  --supervised                Also stop gracefully when stdin reaches EOF.
-
-On macOS, the first interactive run asks to trust a per-user local CA in the
-login keychain and serves HTTPS. Native supervisors use:
-  server trust --status --json
-  server trust --yes --json
-  server trust --remove --yes --json
-Run \`agent-daemon server trust --remove\` interactively to remove that exact
-CA. Linux continues to use the Chromium PNA HTTP path.
-`;
-var PROVIDERS_HELP = `\
-moltnet-agent providers — manage local model providers.
-
-Usage:
-  moltnet-agent providers list [--json] [--root <path>]
-  moltnet-agent providers set <id> [--base-url <url>] [--api <pi-api-kind>]
-    [--model <id> ... | --clear-models]
-    [--model-input <id>=text,image ...]
-    [--api-key-stdin | --clear-api-key] [--root <path>]
-  moltnet-agent providers discover <id> [--save] [--json] [--root <path>]
-  moltnet-agent providers remove <id> [--yes] [--root <path>]
-  moltnet-agent providers login <id> [--auth-method <method-id>]
-    [--root <path>]
-  moltnet-agent providers logout <id> [--yes] [--root <path>]
-
-The default root is ~/.config/moltnet. MOLTNET_AGENT_SERVER_ROOT remains the
-environment override. API keys are accepted only from redirected stdin; they
-are stored separately and providers.json contains only a secret reference.
-
---model declares a text-only model. --model-input declares a model together
-with the input modalities it accepts, and is what makes a vision model usable:
-a model with no declared modalities is text-only to Pi, which drops image
-content parts before the request leaves the runtime.
-`;
-//#endregion
 //#region src/lib/identity-pin.ts
 /** Compare every pinned field without choosing a caller-specific error type. */
 function assessIdentityPin(current, expected) {
@@ -3748,7 +3545,7 @@ function matchesCredentialTeam(current, credentialTeamId) {
 * `docs/.vitepress/config.ts`.
 */
 var AGENT_KEYS_DOC_URL = "https://docs.themolt.net/operate/agent-keys#run-the-daemon-with-an-agent-key";
-/** Scopes a daemon key must carry; mirrors `DAEMON_REQUIRED_SCOPES`. */
+/** Scopes a new daemon key should be minted with; mirrors `DAEMON_RECOMMENDED_SCOPES`. */
 var DAEMON_KEY_SCOPES = AGENT_CREDENTIAL_SCOPES;
 /**
 * Report where `connect()` will find the key, without ever reading the secret
@@ -3827,14 +3624,24 @@ async function validateStartupBinding(options) {
 async function resolveAgentContext(agentName, options = {}) {
 	assertIdentityAlias(agentName);
 	const { agentDir, agentRootDir } = resolveIdentityLocation(agentName, options.agentRootDir, { requireConfig: options.credentialSource !== "environment" });
-	if (options.credentialSource === "environment") return {
-		agentDir,
-		agentRootDir,
-		agent: await connect({ secretProviders: createNodeSecretProviderRegistry() }),
-		credentialSource: "environment"
-	};
+	const projectApiUrl = options.projectApiUrl;
+	if (options.credentialSource === "environment") {
+		if (projectApiUrl) assertTrustedConfigApiUrl(projectApiUrl, options.envApiUrl?.trim() || "https://api.themolt.net");
+		return {
+			agentDir,
+			agentRootDir,
+			agent: await connect({
+				...projectApiUrl ? { apiUrl: projectApiUrl } : {},
+				secretProviders: createNodeSecretProviderRegistry()
+			}),
+			credentialSource: "environment"
+		};
+	}
 	const config = await readConfig(agentDir);
 	if (!config || !hasAgentKeyConfiguration(config)) throw new Error(agentKeyRequiredMessage(agentDir, agentName));
+	const configuredApiUrl = resolveConfigApiUrl(config, options.envApiUrl);
+	if (options.envApiUrl?.trim()) requireSecureCredentialApiUrl(options.envApiUrl);
+	if (projectApiUrl) assertTrustedConfigApiUrl(projectApiUrl, options.envApiUrl?.trim() || configuredApiUrl || "https://api.themolt.net");
 	const secretProviders = createNodeSecretProviderRegistry();
 	const agentKey = await resolveAgentKey(config, secretProviders, options.teamId);
 	if (!agentKey) throw new Error(agentKeyRequiredMessage(agentDir, agentName));
@@ -3845,7 +3652,7 @@ async function resolveAgentContext(agentName, options = {}) {
 			configDir: agentDir,
 			secretProviders,
 			agentKey,
-			apiUrl: resolveConfigApiUrl(config, options.envApiUrl)
+			apiUrl: projectApiUrl ?? configuredApiUrl
 		}),
 		credentialSource: "config",
 		credentialTeamId: selectAgentKeyReference(config, options.teamId)?.teamId
@@ -3934,6 +3741,13 @@ function isTransientWhoamiError(error) {
 	const statusCode = error.statusCode;
 	return typeof statusCode === "number" && (statusCode === 408 || statusCode === 429 || statusCode >= 500);
 }
+/** Read only non-secret endpoint metadata before selecting a team credential. */
+async function resolveSelectionApiUrl(agentName, options) {
+	if (options.envApiUrl?.trim()) return options.envApiUrl.trim();
+	if (options.credentialSource === "environment") throw new Error("Set MOLTNET_API_URL for an environment-key worker");
+	const { agentDir } = resolveIdentityLocation(agentName, options.agentRootDir, { requireConfig: true });
+	return resolveConfigApiUrl(await readConfig(agentDir) ?? {}) ?? "https://api.themolt.net";
+}
 //#endregion
 //#region src/config.ts
 /**
@@ -4002,7 +3816,19 @@ function activatePiCodingAgentDir(path, env = {}) {
 	Object.assign(process.env, env);
 }
 function loadAgentServerEnvConfig() {
+	const issuer = process.env["MOLTNET_OPERATOR_OAUTH_ISSUER"];
+	const publicUrl = process.env["MOLTNET_OPERATOR_OAUTH_PUBLIC_URL"] ?? issuer;
+	const nativeClientId = process.env["MOLTNET_NATIVE_OAUTH_CLIENT_ID"];
+	const consoleClientId = process.env["MOLTNET_CONSOLE_OAUTH_CLIENT_ID"];
+	const apiUrl = process.env["MOLTNET_OPERATOR_API_URL"];
 	return {
+		operatorOAuth: {
+			...issuer ? { issuer } : {},
+			...publicUrl ? { publicUrl } : {},
+			...nativeClientId ? { nativeClientId } : {},
+			...consoleClientId ? { consoleClientId } : {},
+			...apiUrl ? { apiUrl } : {}
+		},
 		port: process.env["MOLTNET_AGENT_SERVER_PORT"] ?? "",
 		allowedOrigins: process.env["MOLTNET_AGENT_SERVER_ALLOWED_ORIGINS"] ?? "",
 		root: process.env["MOLTNET_AGENT_SERVER_ROOT"] ?? "",
@@ -4022,6 +3848,376 @@ function loadUpdateEnvConfig() {
 	};
 }
 //#endregion
+//#region src/lib/run-project-selection.ts
+var execFileAsync$1 = promisify(execFile);
+var GIT_TIMEOUT_MS = 1e4;
+var GIT_MAX_OUTPUT_BYTES = 64 * 1024;
+async function validateGitSource(source) {
+	const inherited = processEnvSnapshot();
+	try {
+		const { stdout } = await execFileAsync$1("git", [
+			"rev-parse",
+			"--show-toplevel",
+			"--verify",
+			"HEAD^{commit}"
+		], {
+			cwd: source,
+			env: {
+				PATH: inherited.PATH,
+				HOME: inherited.HOME,
+				GIT_CONFIG_NOSYSTEM: "1",
+				GIT_CONFIG_GLOBAL: "/dev/null"
+			},
+			timeout: GIT_TIMEOUT_MS,
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_MAX_OUTPUT_BYTES
+		});
+		const top = stdout.trim().split("\n")[0];
+		if (await canonicalDirectory(top) === source) return;
+	} catch (cause) {
+		throw new ProjectConfigError("selection", `git-worktree source ${source} requires a Git repository root with a committed revision: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+	}
+	throw new ProjectConfigError("selection", `git-worktree source ${source} must be the Git repository root, not a subdirectory`);
+}
+function projectRunOptionDefs() {
+	return {
+		project: { type: "string" },
+		binding: { type: "string" },
+		general: { type: "boolean" },
+		"config-file": { type: "string" },
+		"state-dir": { type: "string" },
+		source: { type: "string" },
+		"workspace-strategy": { type: "string" }
+	};
+}
+function strategy(value) {
+	if (value === void 0) return void 0;
+	if (WORKSPACE_STRATEGIES.includes(value)) return value;
+	throw new ProjectConfigError("validation", `Unknown workspace strategy ${value}; choose ${WORKSPACE_STRATEGIES.join(", ")}`);
+}
+/** Resolve once at worker startup. No credentials, remote calls, hooks or workspace creation. */
+async function resolveRunProjectSelection(args) {
+	const env = processEnvSnapshot();
+	const inherited = env.MOLTNET_ACTIVE_IDENTITY === args.agent && !args.general;
+	const bindingName = args.binding ?? (!args["config-file"] && !args.project && inherited ? env.MOLTNET_PROJECT_BINDING : void 0);
+	const projectId = args.project ?? (!args["config-file"] && !args.binding && inherited ? env.MOLTNET_PROJECT_ID : void 0);
+	const configPath = resolve(args.cwd, args["config-file"] ?? (inherited ? env.MOLTNET_PROJECT_CONFIG : void 0) ?? getProjectConfigPath());
+	if (args.general && (args.project || args.binding)) throw new ProjectConfigError("selection", "General work cannot also declare a project or binding");
+	const overrideStrategy = strategy(args["workspace-strategy"]);
+	const stateRootDir = args["state-dir"] ? resolve(args.cwd, args["state-dir"]) : void 0;
+	let binding = null;
+	if (!args.general) try {
+		binding = await resolveProjectBinding(await readProjectConfig(configPath), {
+			configPath,
+			cwd: args.cwd,
+			binding: bindingName,
+			projectId,
+			native: !bindingName && !projectId,
+			teamId: args.team,
+			apiUrl: args.apiUrl || void 0,
+			overrides: {
+				...args.source === void 0 ? {} : { source: args.source },
+				...overrideStrategy === void 0 ? {} : { strategy: overrideStrategy }
+			}
+		});
+		if (!binding && (bindingName || projectId)) throw new ProjectConfigError("selection", `No matching project binding ${bindingName ?? projectId} in ${configPath} for endpoint ${args.apiUrl ?? "(unspecified)"}; run moltnet projects setup or select --binding/--general`);
+	} catch (cause) {
+		throw new ProjectConfigError(cause instanceof ProjectConfigError ? cause.kind : "selection", `Project selection in ${configPath} (binding ${bindingName ?? projectId ?? "ancestor"}, endpoint ${args.apiUrl ?? "unspecified"}): ${cause instanceof Error ? cause.message : String(cause)}. Use moltnet projects setup to register a folder, or select --binding/--general.`, { cause });
+	}
+	const workspaceStrategy = binding?.strategy ?? overrideStrategy ?? "existing";
+	if (workspaceStrategy === "none" && args.source !== void 0) throw new ProjectConfigError("selection", "No-workspace execution cannot specify a source");
+	let source = binding?.source;
+	if (workspaceStrategy !== "none" && !source) source = await canonicalDirectory(resolve(args.cwd, args.source ?? "."));
+	if (workspaceStrategy === "isolated-directory" || binding?.hooks?.afterCreate || binding?.hooks?.beforeRun) throw new ProjectConfigError("selection", `Binding ${binding?.name ?? "(run override)"} in ${configPath}: this runtime does not support isolated-directory preparation or setup hooks; choose a supported binding`);
+	if (workspaceStrategy === "git-worktree" && source) await validateGitSource(source);
+	return {
+		configPath,
+		selectedBy: args.binding || args.project ? "explicit" : bindingName ? "activation" : binding ? "ancestor" : "general",
+		projectId: binding?.projectId ?? null,
+		teamId: binding?.teamId ?? args.team,
+		apiUrl: binding?.apiUrl ?? (args.apiUrl || void 0),
+		...binding ? { binding } : {},
+		source,
+		strategy: workspaceStrategy,
+		stateRootDir,
+		workspaceExplicit: Boolean(binding || overrideStrategy || args.source)
+	};
+}
+/** A selected location fixes this worker's strategy; saved profiles are never mutated. */
+function applyProjectWorkspacePolicy(profile, selection) {
+	if (!selection.workspaceExplicit) return profile;
+	if (selection.strategy === "isolated-directory") throw new Error("This runtime does not yet support isolated-directory preparation");
+	if (selection.binding?.hooks?.afterCreate || selection.binding?.hooks?.beforeRun) throw new Error("This runtime does not yet support project setup hooks");
+	const mode = selection.strategy === "existing" ? "shared_mount" : selection.strategy === "git-worktree" ? "dedicated_worktree" : "none";
+	if (profile.allowedWorkspaceModes.length && !profile.allowedWorkspaceModes.includes(mode)) throw new Error(`Workspace strategy ${selection.strategy} is not allowed by profile ${profile.name}`);
+	return {
+		...profile,
+		mountPath: selection.source ?? profile.mountPath,
+		defaultWorkspaceMode: mode,
+		allowedWorkspaceModes: [mode]
+	};
+}
+var PROJECT_RUN_FLAGS = `  --binding <name>            Select a saved local project location.
+  --project <uuid>            Select a project and its unambiguous binding.
+  --general                   Serve General work (projectId: null).
+  --config-file <path>        Explicit project bindings JSON.
+  --source <path>             Run-only source folder override.
+  --workspace-strategy <name> existing, git-worktree, none; isolated-directory
+                              is reserved and currently unsupported.
+  --state-dir <path>          Supervisor/session state, separate from source.
+                              Default: profile mount root (existing state retained).`;
+//#endregion
+//#region src/lib/help.ts
+var COMMON_REQUIRED_FLAGS = `\
+  -a, --agent <name>          MoltNet agent identity. Agent-key auth is
+                              configless; OAuth2 reads moltnet.json.
+  --profile <uuid|name>       Remote runtime profile. Repeat for poll/drain
+                              to declare priority order. Provider, model,
+                              sandbox policy, prerequisites, and runtime
+                              execution policy come from the selected profile.`;
+var COMMON_OPTIONAL_FLAGS = `\
+  --sandbox <path>            Deprecated. Remote runtime profiles define
+                              sandbox policy.
+  --agent-root <path>         Explicit legacy identity bundle location.
+                              Omitted: use the central identity store.
+${PROJECT_RUN_FLAGS}
+  --git-author <"Name <email>">
+                              Non-secret git identity projected into the
+                              guest for host-brokered commit signing. Default:
+                              host git config. Configless agent-key runs must
+                              provide this flag or MOLTNET_GIT_AUTHOR.
+                              Env: MOLTNET_GIT_AUTHOR.
+  --heartbeat-interval-ms <n> Reporter heartbeat cadence. Default: 60000.
+  --warm-retention-sec <n>    Resumability window for runtime slots
+                              (Pi sessions + reusable worktrees) after use.
+                              Default: 1800.
+  --debug                     Verbose logging: also log successful list/claim
+                              outcomes (candidate counts, claim attempts).`;
+var REGISTERED_TASK_TYPES = Object.keys(BUILT_IN_TASK_TYPES).sort();
+function knownTaskTypesList() {
+	return REGISTERED_TASK_TYPES.join(", ");
+}
+var ROOT_USAGE = `\
+agent-daemon — long-running task worker for MoltNet.
+
+Usage: agent-daemon [--runtime <module>] <command> [...flags]
+
+Runtime:
+  --runtime <module>          Trusted local file or installed package whose
+                              default export is a DaemonRuntimeAdapter.
+                              Omit to use the built-in gondolin_pi runtime.
+
+Commands:
+  poll      Long-running worker. Polls the task queue and claims tasks
+            matching the configured filter until SIGINT/SIGTERM.
+  once      Claim and execute one specific queued task by id, then exit.
+  drain     Poll until the queue has nothing claimable, then exit.
+            Useful for batch eval runs and demos.
+  server    Supervisor for managed runs: authorized standalone local control,
+            agent/provider config store, and start/stop of poll/drain child
+            processes. Binds 127.0.0.1 or a private native socket.
+  providers Manage configured endpoints and Pi OAuth subscriptions without
+            starting the Agent Server. See \`agent-daemon providers --help\`.
+  sync-sessions
+            Repair durable runtime-session checkpoints from local slot files.
+  update check
+            Check the stable MoltNet agent release without reading credentials.
+
+Run \`agent-daemon <command> --help\` for command-specific flags.
+
+Prerequisites:
+  - configless: MOLTNET_AGENT_KEY (or MOLTNET_AGENT_KEY_REF) and
+    MOLTNET_PRIVATE_KEY (or MOLTNET_PRIVATE_KEY_REF); no agent files
+  - config-based: ~/.config/moltnet/identities/<agent>/moltnet.json
+    carrying agent_key_refs or agent_key_ref (OAuth2 is not accepted)
+    --agent-root explicitly selects a legacy .moltnet/<agent> bundle
+
+No key yet? Mint one with the CLI (--store writes the team slot into
+moltnet.json and keeps the secret in a provider):
+
+  moltnet teams list             # find the team id
+  moltnet agents keys create --team-id <team-uuid> \\
+    --name <agent>-daemon --store
+
+  https://docs.themolt.net/operate/agent-keys#run-the-daemon-with-an-agent-key
+  - --profile — remote runtime profile supplies provider/model/sandbox
+    policy and CWD is used as the VM mountPath.
+
+Registered task types: ${knownTaskTypesList()}`;
+var POLL_HELP = `\
+agent-daemon poll — long-running task worker.
+
+Usage:
+  agent-daemon poll --team <uuid> --agent <name> --profile <uuid|name> [...]
+
+Required:
+  --team <uuid>               Team whose queue to serve. The daemon must be
+                              a member of this team (canAccessTeam permit).
+${COMMON_REQUIRED_FLAGS}
+
+Optional:
+  --task-types <csv>          Whitelist of task types to claim. Default:
+                              accept any registered type. Known types:
+                              ${knownTaskTypesList()}
+  --correlation-id <uuid>     Restrict claims to one orchestration run.
+  --diary-ids <csv>           Further client-side filter on task.diaryId.
+  --poll-interval-ms <n>      Idle backoff floor. Default: 2000.
+  --max-poll-interval-ms <n>  Idle backoff ceiling. Default: 30000.
+  --list-limit <n>            Page size per list call. Default: 10.
+${COMMON_OPTIONAL_FLAGS}
+
+Example:
+  agent-daemon poll \\
+    --team 6743b4b1-6b93-46e2-a048-19490f04f91a \\
+    --task-types curate_pack,fulfill_brief \\
+    --agent legreffier \\
+    --profile github-linear \\
+    --profile local-fallback
+
+Stops cleanly on SIGINT/SIGTERM (drains the in-flight task before exit).`;
+var ONCE_HELP = `\
+agent-daemon once — execute one specific queued task by id, then exit.
+
+Usage:
+  agent-daemon once --task-id <uuid> --agent <name> --profile <uuid|name> [...]
+
+Required:
+  -t, --task-id <uuid>        Task to claim and execute. Must already be
+                              in 'queued' status.
+${COMMON_REQUIRED_FLAGS}
+
+Optional:
+  --team <uuid>               Team scope for resolving --profile by name.
+                              Required only when --profile is a name.
+${COMMON_OPTIONAL_FLAGS}
+
+Example:
+  agent-daemon once \\
+    --task-id 26004a77-bc10-43ef-a79f-c8e62faf59b1 \\
+    --agent legreffier \\
+    --profile github-linear
+
+Exits 0 on completed, 1 on failed/cancelled/runtime-error.`;
+var DRAIN_HELP = `\
+agent-daemon drain — poll until the queue is empty, then exit.
+
+Usage:
+  agent-daemon drain --team <uuid> --agent <name> --profile <uuid|name> [...]
+
+Same flags as \`poll\`. The only behavioural difference: \`drain\` exits
+when a list call confirms no claimable tasks remain (vs \`poll\` which
+sleeps and retries forever).
+
+Required:
+  --team <uuid>               Team whose queue to drain.
+${COMMON_REQUIRED_FLAGS}
+
+Optional:
+  --task-types <csv>          Whitelist. Known types: ${knownTaskTypesList()}
+  --correlation-id <uuid>     Restrict claims to one orchestration run.
+  --wait-for-first-task-sec <n>
+                              Wait this long for an initially empty run before
+                              exiting. After the first claim, exit on empty.
+  --wait-after-task-sec <n>   Require the queue to remain empty for this long
+                              after a claim before exiting.
+  --diary-ids <csv>           Diary filter.
+  --poll-interval-ms <n>      Default: 2000.
+  --max-poll-interval-ms <n>  Default: 30000.
+  --list-limit <n>            Default: 10.
+${COMMON_OPTIONAL_FLAGS}
+
+Example:
+  agent-daemon drain \\
+    --team 6743b4b1-6b93-46e2-a048-19490f04f91a \\
+    --task-types judge_pack \\
+    --agent legreffier \\
+    --profile eval-judge`;
+var SYNC_SESSIONS_HELP = `\
+agent-daemon sync-sessions — repair durable runtime-session checkpoints.
+
+Usage:
+  agent-daemon sync-sessions --team <uuid> --agent <name> [...]
+
+Scans this daemon's team-scoped runtime slots, compares local Pi session files
+with durable runtime-session metadata, and uploads missing or stale checkpoints.
+
+Required:
+  --team <uuid>               Team whose runtime slots to inspect.
+  -a, --agent <name>          MoltNet agent identity. Reads credentials
+                              from <agent-root>/.moltnet/<name>/moltnet.json.
+
+Optional:
+  --runtime-profile-id <uuid> Limit repair to one runtime profile.
+  --state <active|idle>       Limit scanned slots by state. Default: all.
+  --limit <n>                 Max slots to scan, 1..200. Default: 100.
+  --dry-run                   Report missing/stale sessions without uploading.
+  --agent-root <path>         Explicit legacy identity bundle location.
+                              Omitted: use the central identity store.
+${PROJECT_RUN_FLAGS}
+  --debug                     Accepted for consistency; no extra output yet.
+
+Example:
+  agent-daemon sync-sessions \\
+    --team 6743b4b1-6b93-46e2-a048-19490f04f91a \\
+    --agent legreffier \\
+    --state idle`;
+function isHelpFlag(args) {
+	return args.includes("--help") || args.includes("-h");
+}
+var AGENT_SERVER_HELP = `\
+agent-daemon server — local supervisor for managed runs.
+
+Standalone mode binds 127.0.0.1 for authorized local-control clients. MoltNet
+Agent Desktop instead uses a private Unix socket with a process-scoped grant.
+Both modes configure agents and providers and start/stop child runs.
+
+Options:
+  --port <n>                  Loopback port. Default: 17374.
+                              Env: MOLTNET_AGENT_SERVER_PORT.
+  --allowed-origins <csv>     Exact browser-controller origins allowed
+                              local control.
+                              Default: https://console.themolt.net.
+                              Env: MOLTNET_AGENT_SERVER_ALLOWED_ORIGINS.
+  --root <path>               Config root. Default: ~/.config/moltnet
+                              (or MOLTNET_AGENT_SERVER_ROOT).
+  --api-url <url>             Default MoltNet API for new managed agents.
+                              Default: https://api.themolt.net.
+  --heartbeat-interval-ms <n> Child reporter heartbeat cadence. Default: 60000.
+  --warm-retention-sec <n>    Child session/workspace retention. Default: 1800.
+  --supervised                Also stop gracefully when stdin reaches EOF.
+  --native-socket <path>      Private native-only socket (requires --supervised).
+                              Absolute, at most 100 bytes, with a new socket in
+                              a caller-owned 0700 directory. TCP flags are not
+                              accepted; inherited TCP env settings are ignored.
+
+Standalone mode uses loopback HTTP on every platform. Desktop socket mode does
+not open a TCP listener.
+`;
+var PROVIDERS_HELP = `\
+moltnet-agent providers — manage local model providers.
+
+Usage:
+  moltnet-agent providers list [--json] [--root <path>]
+  moltnet-agent providers set <id> [--base-url <url>] [--api <pi-api-kind>]
+    [--model <id> ... | --clear-models]
+    [--model-input <id>=text,image ...]
+    [--api-key-stdin | --clear-api-key] [--root <path>]
+  moltnet-agent providers discover <id> [--save] [--json] [--root <path>]
+  moltnet-agent providers remove <id> [--yes] [--root <path>]
+  moltnet-agent providers login <id> [--auth-method <method-id>]
+    [--root <path>]
+  moltnet-agent providers logout <id> [--yes] [--root <path>]
+
+The default root is ~/.config/moltnet. MOLTNET_AGENT_SERVER_ROOT remains the
+environment override. API keys are accepted only from redirected stdin; they
+are stored separately and providers.json contains only a secret reference.
+
+--model declares a text-only model. --model-input declares a model together
+with the input modalities it accepts, and is what makes a vision model usable:
+a model with no declared modalities is text-only to Pi, which drops image
+content parts before the request leaves the runtime.
+`;
+//#endregion
 //#region src/lib/abort-active-attempt.ts
 /** Best-effort signal cleanup; lease expiry remains the final backstop. */
 async function abortActiveAttemptOnSignal(opts) {
@@ -4058,7 +4254,7 @@ async function resolveDaemonAgentIdentity(input) {
 }
 //#endregion
 //#region src/lib/correlation.ts
-var execFileAsync$1 = promisify(execFile);
+var execFileAsync = promisify(execFile);
 var CORRELATION_TRAILER_KEY = "Moltnet-Correlation-Id";
 var CORRELATION_MARKER_RE = /<!--\s*moltnet-correlation:\s*([\w-]+)\s*-->/i;
 new RegExp(`^${CORRELATION_TRAILER_KEY}:\\s*(\\S+)\\s*$`, "m");
@@ -4105,7 +4301,7 @@ function makePrBodyAnchorWriter(deps) {
 function createGhCliClient() {
 	return {
 		async get({ owner, repo, number }) {
-			const { stdout } = await execFileAsync$1("gh", [
+			const { stdout } = await execFileAsync("gh", [
 				"api",
 				`repos/${owner}/${repo}/pulls/${number}`,
 				"--jq",
@@ -4114,7 +4310,7 @@ function createGhCliClient() {
 			return JSON.parse(stdout);
 		},
 		async patch({ owner, repo, number }, body) {
-			await execFileAsync$1("gh", [
+			await execFileAsync("gh", [
 				"api",
 				"-X",
 				"PATCH",
@@ -4201,6 +4397,7 @@ function slugifySessionComponent(input) {
 }
 //#endregion
 //#region src/lib/task-execution-plan.ts
+var WorkspaceModeMismatchError = class extends Error {};
 function buildDaemonTaskExecutionPlan(task, stateDirs, identity, warmRetentionSec, runtimeProfileWorkspacePolicy = {}, attemptN) {
 	const descriptor = deriveTaskSessionDescriptor(task);
 	const workspaceMode = resolveTaskWorkspaceMode(task, descriptor.policy, runtimeProfileWorkspacePolicy);
@@ -4274,6 +4471,7 @@ function resolveTaskWorkspaceMode(task, policy, runtimeProfileWorkspacePolicy) {
 	const requestedWorkspace = policy.acceptsInputWorkspaceOverride && typeof task.input.execution?.workspace === "string" ? task.input.execution.workspace : null;
 	if (isRuntimeProfileWorkspaceMode(requestedWorkspace)) {
 		if (allowed.has(requestedWorkspace)) return toDaemonWorkspaceMode(requestedWorkspace);
+		if (runtimeProfileWorkspacePolicy.workspaceExplicit) throw new WorkspaceModeMismatchError(`Requested workspace mode ${requestedWorkspace} is not allowed by profile ${runtimeProfileWorkspacePolicy.profileName ?? "(selected)"}; allowed: ${[...allowed].join(", ")}`);
 	}
 	if (profileDefault && allowed.has(profileDefault)) return toDaemonWorkspaceMode(profileDefault);
 	if (allowed.has(policy.workspaceMode)) return policy.workspaceMode;
@@ -4381,8 +4579,8 @@ function assertPlanAllowedByWorkspacePolicy(plan, policy, runtimeProfileId) {
 		"dedicated_worktree"
 	]);
 	const effectiveMode = planToRuntimeProfileWorkspaceMode(plan);
-	if (plan.workspaceRevision && effectiveMode !== "dedicated_worktree") throw new Error(`Runtime profile "${runtimeProfileId}" does not allow "dedicated_worktree", required by a revision-pinned task (resolved workspace mode "${effectiveMode}")`);
-	if (!allowed.has(effectiveMode)) throw new Error(`Runtime profile forbids final workspace mode "${effectiveMode}" for this task`);
+	if (plan.workspaceRevision && effectiveMode !== "dedicated_worktree") throw new WorkspaceModeMismatchError(`Runtime profile "${runtimeProfileId}" does not allow "dedicated_worktree", required by a revision-pinned task (resolved workspace mode "${effectiveMode}")`);
+	if (!allowed.has(effectiveMode)) throw new WorkspaceModeMismatchError(`Runtime profile "${policy?.profileName ?? runtimeProfileId}" forbids final workspace mode "${effectiveMode}"; allowed: ${[...allowed].join(", ")}`);
 }
 function planToRuntimeProfileWorkspaceMode(plan) {
 	if (plan.workspaceMode === "scratch_mount") return "none";
@@ -4569,7 +4767,8 @@ function resolveProducerWorkspaceCopySource(producer, stateDirs) {
 		if (isDisposableScratchWorkspace(producer, stateDirs)) return null;
 		throw new ProducerContextResolutionError(`Producer workspace path is missing on disk: ${workspacePath}`);
 	}
-	const sharedMountRoot = dirname(dirname(stateDirs.rootDir));
+	const sharedMountRoot = stateDirs.mountPath;
+	if (!sharedMountRoot) throw new ProducerContextResolutionError("Shared producer mount root was not supplied by the runtime profile");
 	if (!existsSync(sharedMountRoot)) throw new ProducerContextResolutionError(`Shared producer mount root is missing on disk: ${sharedMountRoot}`);
 	return sharedMountRoot;
 }
@@ -5557,7 +5756,6 @@ var AgentServerStore = class {
 			activations: {}
 		};
 		if (!isRecord$1(state) || state.version !== 2) throw new AgentServerStoreError("invalid_state", `agent-server.json version ${String(isRecord$1(state) ? state.version : void 0)} is not supported; move agent-server.json aside, run \`moltnet config migrate\`, then add or attach the agents again`);
-		if ("pairedOrigins" in state) throw new AgentServerStoreError("invalid_state", "agent-server.json uses the obsolete pairing format; move agent-server.json aside and configure the agent server again");
 		if (!isRecord$1(state.pendingRegistrations) || !isRecord$1(state.activations)) throw new AgentServerStoreError("invalid_state", "agent-server.json is missing the version 2 activation map; move agent-server.json aside, run `moltnet config migrate`, then add or attach the agents again");
 		for (const [alias, activation] of Object.entries(state.activations)) validateActivation(alias, activation);
 		for (const [alias, registration] of Object.entries(state.pendingRegistrations)) {
@@ -5661,7 +5859,18 @@ var AgentServerStore = class {
 		if (activation.source === "managed") delete state.pendingRegistrations[alias];
 		this.writeAgentServerState(state);
 	}
-	listActivations() {
+	writeCredentialMetadata(alias, teamId, metadata) {
+		const activation = this.readActivation(alias);
+		if (!activation) throw new AgentServerStoreError("not_found", "Identity is not activated");
+		this.writeActivation({
+			...activation,
+			credentialHealth: {
+				...activation.credentialHealth,
+				[teamId]: metadata
+			}
+		});
+	}
+	listActivations() {
 		return Object.values(this.readAgentServerState().activations).sort((a, b) => a.alias.localeCompare(b.alias));
 	}
 	get providersPath() {
@@ -5726,6 +5935,24 @@ var AgentServerStore = class {
 	writeRun(record) {
 		writeJsonAtomic(join(this.runDir(record.id), "run.json"), record);
 	}
+	/** Status polling reads history without blocking the supervisor event loop. */
+	async listRunsAsync(limit, includeIds = []) {
+		let ids;
+		try {
+			ids = await readdir(this.runsDir);
+		} catch {
+			return [];
+		}
+		const selected = ids.filter((id) => NAME_RE.test(id)).sort().reverse().slice(0, Math.max(0, limit));
+		return (await Promise.all([...new Set([...includeIds, ...selected])].map(async (id) => {
+			try {
+				return JSON.parse(await readFile(join(this.runDir(id), "run.json"), "utf8"));
+			} catch (error) {
+				if (error.code === "ENOENT") return null;
+				throw error;
+			}
+		}))).filter((record) => record !== null).sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+	}
 	listRuns(limit = Number.POSITIVE_INFINITY) {
 		let ids;
 		try {
@@ -5956,14 +6183,32 @@ function mergePiModels(store, repo) {
 //#endregion
 //#region src/lib/state-dir.ts
 function ensureDaemonStateDirs(mountPath) {
-	const rootDir = join(mountPath, ".moltnet", "d");
+	const rootDir = canonicalStatePath(join(mountPath, ".moltnet", "d"));
 	const piSessionsDir = join(rootDir, "pi-sessions");
-	mkdirSync(piSessionsDir, { recursive: true });
+	mkdirSync(rootDir, {
+		recursive: true,
+		mode: 448
+	});
+	mkdirSync(piSessionsDir, {
+		recursive: true,
+		mode: 448
+	});
 	return {
-		rootDir,
-		piSessionsDir
+		rootDir: realpathSync(rootDir),
+		piSessionsDir: realpathSync(piSessionsDir)
 	};
 }
+function canonicalStatePath(path) {
+	let parent = resolve(path);
+	const missing = [];
+	while (!existsSync(parent)) {
+		missing.unshift(basename(parent));
+		const next = dirname(parent);
+		if (next === parent) throw new Error(`Cannot resolve daemon state root ${path}`);
+		parent = next;
+	}
+	return join(realpathSync(parent), ...missing);
+}
 //#endregion
 //#region src/lib/prepare-runtime-profile.ts
 /** Validate and prepare a profile through the shared daemon execution path. */
@@ -5985,7 +6230,8 @@ async function prepareRuntimeProfile(input) {
 		rootDir: profile.mountPath,
 		path: profile.source
 	};
-	const stateDirs = ensureDaemonStateDirs(sandbox.rootDir);
+	const stateDirs = ensureDaemonStateDirs(input.stateRootDir ?? sandbox.rootDir);
+	stateDirs.mountPath = profile.mountPath;
 	const slotIdentity = {
 		agentName: input.agentName,
 		runtimeProfileId: profile.id,
@@ -6002,6 +6248,8 @@ async function prepareRuntimeProfile(input) {
 			slotIdentity,
 			warmRetentionSec: input.warmRetentionSec,
 			workspacePolicy: {
+				workspaceExplicit: input.workspaceExplicit,
+				profileName: profile.name,
 				defaultWorkspaceMode: profile.defaultWorkspaceMode,
 				allowedWorkspaceModes: profile.allowedWorkspaceModes
 			},
@@ -6012,6 +6260,32 @@ async function prepareRuntimeProfile(input) {
 	};
 }
 //#endregion
+//#region src/lib/project-task-source.ts
+function createProjectOnceSource(selection, options) {
+	return new ApiTaskSource({
+		...options,
+		projectId: selection.projectId
+	});
+}
+function createProjectPollingSource(selection, options) {
+	return new PollingApiTaskSource({
+		...options,
+		projectId: selection.projectId,
+		isTaskEligible: (task) => {
+			if (!selection.workspaceExplicit) return true;
+			if (resolveTaskWorkspaceRevision(task.input) && selection.strategy !== "git-worktree") return false;
+			if (!getTaskExecutionPolicy(task.taskType).acceptsInputWorkspaceOverride) return true;
+			const requested = task.input?.execution?.workspace;
+			if (!requested || ![
+				"none",
+				"shared_mount",
+				"dedicated_worktree"
+			].includes(requested)) return true;
+			return requested === (selection.strategy === "existing" ? "shared_mount" : selection.strategy === "git-worktree" ? "dedicated_worktree" : "none");
+		}
+	});
+}
+//#endregion
 //#region src/lib/runtime-context.ts
 var storage = new AsyncLocalStorage();
 function runWithDaemonRuntimeContext(context, callback) {
@@ -6591,6 +6865,7 @@ async function runPolling(opts) {
 		args: opts.argv,
 		options: {
 			...runtimeCommandOptionDefs(),
+			...projectRunOptionDefs(),
 			team: { type: "string" },
 			"task-types": { type: "string" },
 			"correlation-id": { type: "string" },
@@ -6607,12 +6882,12 @@ async function runPolling(opts) {
 			}
 		}
 	});
-	if (!values.team) {
+	if (!values.team && !values.binding && !values.project && !values["config-file"]) {
 		console.error("Missing required flag: --team\n");
 		console.error(opts.helpText);
 		return 1;
 	}
-	const teamId = values.team;
+	let teamId = values.team ?? "";
 	const profileValues = parseProfileValues(values.profile);
 	if (profileValues.length === 0) {
 		console.error("Missing required flag: --profile\n");
@@ -6655,6 +6930,41 @@ async function runPolling(opts) {
 	}
 	if (taskTypes.length === 0) console.error(`[${opts.modeLabel}] --task-types is empty — daemon will accept any registered type. Pass an explicit list to limit scope (e.g. --task-types fulfill_brief).`);
 	const cfg = loadConfig();
+	let selection;
+	try {
+		const endpoint = await resolveSelectionApiUrl(identity.agent, {
+			agentRootDir: values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0,
+			credentialSource: cfg.credentialSource,
+			envApiUrl: cfg.apiUrl
+		});
+		selection = await resolveRunProjectSelection({
+			agent: identity.agent,
+			cwd: process.cwd(),
+			apiUrl: endpoint,
+			binding: values.binding,
+			project: values.project,
+			team: values.team,
+			general: values.general,
+			"config-file": values["config-file"],
+			"state-dir": values["state-dir"],
+			source: values.source,
+			"workspace-strategy": values["workspace-strategy"]
+		});
+		teamId = selection.teamId ?? "";
+		if (!teamId) throw new Error("Select --team or a binding with a team");
+	} catch (error) {
+		await logDaemonStartupFailure({
+			serviceName: "agent-daemon.selection",
+			level: cfg.logLevel || "info",
+			gate: "project_selection",
+			agent: identity.agent,
+			credentialSource: cfg.credentialSource,
+			error
+		});
+		console.error(error instanceof Error ? error.message : String(error));
+		console.error(opts.helpText);
+		return 1;
+	}
 	const credentialSources = {
 		profileRequirements: cfg.profileCredentialRequirements,
 		bindings: cfg.credentialBindings
@@ -6668,6 +6978,7 @@ async function runPolling(opts) {
 				agentRootDir: explicitAgentRootDir,
 				credentialSource: cfg.credentialSource,
 				envApiUrl: cfg.apiUrl,
+				projectApiUrl: selection.binding?.apiUrl,
 				teamId
 			});
 			gate = "authenticate_and_bind";
@@ -6722,18 +7033,25 @@ async function runPolling(opts) {
 			throw error;
 		}
 	})();
-	const daemonRootDir = explicitAgentRootDir ?? process.cwd();
-	const resolvedProfiles = await resolveRuntimeProfiles({
+	const daemonRootDir = selection.binding || values.source ? selection.source ?? process.cwd() : explicitAgentRootDir ?? process.cwd();
+	const resolvedProfiles = (await resolveRuntimeProfiles({
 		agent: ctx.agent,
 		profiles: profileValues,
 		teamId,
 		cwd: daemonRootDir
-	});
+	})).map((profile) => applyProjectWorkspacePolicy(profile, selection));
 	const { logger, shutdown: shutdownLogger } = createRootLogger({
 		name: `agent-daemon.${opts.modeLabel}`,
 		level: cfg.logLevel || (identity.debug ? "debug" : "info")
 	});
 	const rootLogger = logger.child({
+		projectId: selection.projectId,
+		binding: selection.binding?.name,
+		selectedBy: selection.selectedBy,
+		source: daemonRootDir,
+		strategy: selection.strategy,
+		stateRootDir: selection.stateRootDir ?? daemonRootDir,
+		apiUrl: selection.apiUrl,
 		mode: opts.modeLabel,
 		agent: identity.agent,
 		teamId,
@@ -6756,6 +7074,8 @@ async function runPolling(opts) {
 			agent: ctx.agent,
 			agentName: identity.agent,
 			profile,
+			stateRootDir: selection.stateRootDir,
+			workspaceExplicit: selection.workspaceExplicit,
 			prerequisiteEnv: cfg.profilePrerequisiteEnv,
 			runtimeAdapter,
 			runtimeInstanceId,
@@ -6787,6 +7107,9 @@ async function runPolling(opts) {
 		agent: ctx.agent,
 		endpoint: cfg.otelEndpoint,
 		resourceAttributes: {
+			"moltnet.project.id": selection.projectId ?? "general",
+			"moltnet.project.selection": selection.selectedBy,
+			"moltnet.workspace.strategy": selection.strategy,
 			"moltnet.team.id": teamId,
 			"moltnet.agent.name": identity.agent,
 			"moltnet.credential.source": ctx.credentialSource,
@@ -6905,7 +7228,7 @@ async function runPolling(opts) {
 	try {
 		runtime = new AgentRuntime({
 			logger: rootLogger,
-			source: new PollingApiTaskSource({
+			source: createProjectPollingSource(selection, {
 				agent: ctx.agent,
 				teamId,
 				taskTypes: taskTypes.length > 0 ? taskTypes : void 0,
@@ -7027,7 +7350,7 @@ async function runPolling(opts) {
 						error: {
 							code: err instanceof ProducerContextResolutionError ? "producer_context_missing" : "execution_plan_failed",
 							message,
-							retryable: false
+							retryable: err instanceof WorkspaceModeMismatchError
 						}
 					};
 				}
@@ -7227,6 +7550,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		args: argv,
 		options: {
 			...runtimeCommandOptionDefs(),
+			...projectRunOptionDefs(),
 			"task-id": {
 				type: "string",
 				short: "t"
@@ -7264,6 +7588,39 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		return 1;
 	}
 	const cfg = loadConfig();
+	let selection;
+	try {
+		const endpoint = await resolveSelectionApiUrl(identity.agent, {
+			agentRootDir: values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0,
+			credentialSource: cfg.credentialSource,
+			envApiUrl: cfg.apiUrl
+		});
+		selection = await resolveRunProjectSelection({
+			agent: identity.agent,
+			cwd: process.cwd(),
+			apiUrl: endpoint,
+			binding: values.binding,
+			project: values.project,
+			team: values.team,
+			general: values.general,
+			"config-file": values["config-file"],
+			"state-dir": values["state-dir"],
+			source: values.source,
+			"workspace-strategy": values["workspace-strategy"]
+		});
+	} catch (error) {
+		await logDaemonStartupFailure({
+			serviceName: "agent-daemon.selection",
+			level: cfg.logLevel || "info",
+			gate: "project_selection",
+			agent: identity.agent,
+			credentialSource: cfg.credentialSource,
+			error
+		});
+		console.error(error instanceof Error ? error.message : String(error));
+		console.error(ONCE_HELP);
+		return 1;
+	}
 	const credentialSources = {
 		profileRequirements: cfg.profileCredentialRequirements,
 		bindings: cfg.credentialBindings
@@ -7277,13 +7634,14 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 				agentRootDir: explicitAgentRootDir,
 				credentialSource: cfg.credentialSource,
 				envApiUrl: cfg.apiUrl,
-				teamId: values.team
+				projectApiUrl: selection.binding?.apiUrl,
+				teamId: selection.teamId
 			});
 			gate = "authenticate_and_bind";
 			const whoami = await validateStartupBinding({
 				agent: resolvedContext.agent,
 				credentialTeamId: resolvedContext.credentialTeamId,
-				teamId: values.team,
+				teamId: selection.teamId,
 				expectedAgent: cfg.expectedAgent
 			});
 			gate = "resolve_signing_material";
@@ -7330,18 +7688,25 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 			throw error;
 		}
 	})();
-	const daemonRootDir = explicitAgentRootDir ?? process.cwd();
-	const profile = await resolveRuntimeProfile({
+	const daemonRootDir = selection.binding || values.source ? selection.source ?? process.cwd() : explicitAgentRootDir ?? process.cwd();
+	const profile = applyProjectWorkspacePolicy(await resolveRuntimeProfile({
 		agent: ctx.agent,
 		profile: values.profile,
-		teamId: values.team,
+		teamId: selection.teamId,
 		cwd: daemonRootDir
-	});
+	}), selection);
 	const { logger, shutdown: shutdownLogger } = createRootLogger({
 		name: "agent-daemon.once",
 		level: cfg.logLevel || (identity.debug ? "debug" : "info")
 	});
 	const rootLogger = logger.child({
+		projectId: selection.projectId,
+		binding: selection.binding?.name,
+		selectedBy: selection.selectedBy,
+		source: daemonRootDir,
+		strategy: selection.strategy,
+		stateRootDir: selection.stateRootDir ?? daemonRootDir,
+		apiUrl: selection.apiUrl,
 		mode: "once",
 		agent: identity.agent,
 		provider: profile.provider,
@@ -7365,6 +7730,8 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		agent: ctx.agent,
 		agentName: identity.agent,
 		profile,
+		stateRootDir: selection.stateRootDir,
+		workspaceExplicit: selection.workspaceExplicit,
 		prerequisiteEnv: cfg.profilePrerequisiteEnv,
 		runtimeAdapter,
 		runtimeInstanceId,
@@ -7382,6 +7749,9 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		agent: ctx.agent,
 		endpoint: cfg.otelEndpoint,
 		resourceAttributes: {
+			"moltnet.project.id": selection.projectId ?? "general",
+			"moltnet.project.selection": selection.selectedBy,
+			"moltnet.workspace.strategy": selection.strategy,
 			"moltnet.task.id": taskId,
 			"moltnet.agent.name": identity.agent,
 			"moltnet.credential.source": ctx.credentialSource,
@@ -7576,7 +7946,7 @@ async function runOnce(argv, runtimeAdapter = defaultPiDaemonAdapter) {
 		});
 		runtime = new AgentRuntime({
 			logger: rootLogger,
-			source: new ApiTaskSource({
+			source: createProjectOnceSource(selection, {
 				agent: ctx.agent,
 				taskId,
 				teamId: profile.teamId,
@@ -7669,6 +8039,18 @@ function runPoll(argv, runtimeAdapter) {
 //#region src/lib/provider-lock.ts
 var DEFAULT_LOCK_TIMEOUT_MS = 3e4;
 var LOCK_WAIT_WARNING_MS = 1e3;
+/**
+* When to warn that we are waiting on another process.
+*
+* A fixed 1s threshold is silently useless to a caller whose whole budget is
+* shorter than that: the timeout wins the race and the operation fails with no
+* word of *why* it failed, which is the one thing the caller needs. So the
+* threshold scales down with the budget, and never sits so close to the
+* deadline that whether it fires depends on timer drift.
+*/
+function warningThresholdMs(timeoutMs) {
+	return Math.min(LOCK_WAIT_WARNING_MS, Math.floor(timeoutMs / 2));
+}
 var ProviderLockError = class extends Error {
 	name = "ProviderLockError";
 	constructor(code, message, options) {
@@ -7697,6 +8079,7 @@ async function withNamedProviderLock(root, name, work, options) {
 	let compromised;
 	const startedAt = Date.now();
 	const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
+	const warnAfterMs = warningThresholdMs(timeoutMs);
 	const lockfilePath = join(locksDir, `${name}.lock`);
 	let warned = false;
 	let release;
@@ -7704,7 +8087,7 @@ async function withNamedProviderLock(root, name, work, options) {
 		if (options.signal?.aborted) throw new ProviderLockError("lock_aborted", `provider lock acquisition was cancelled for "${name}"`, { cause: options.signal.reason });
 		const elapsedMs = Date.now() - startedAt;
 		if (elapsedMs >= timeoutMs) throw new ProviderLockError("lock_timeout", `timed out waiting for provider lock "${name}"`);
-		if (!warned && elapsedMs >= LOCK_WAIT_WARNING_MS) {
+		if (!warned && elapsedMs >= warnAfterMs) {
 			warned = true;
 			options.logger?.warn({
 				code: "provider_lock_contended",
@@ -8887,29 +9270,97 @@ function registerLoopbackSecurity(app, options) {
 	});
 }
 //#endregion
-//#region ../../libs/loopback-companion/src/fetch-metadata.ts
-function headerValue(headers, name) {
-	const value = headers[name];
-	return typeof value === "string" ? value : void 0;
-}
-/**
-* Require that a request is a top-level browser navigation (used by local
-* approval pages that must be opened as a document, never fetched).
-*/
-function assertNavigationRequest(headers) {
-	const site = headerValue(headers, "sec-fetch-site");
-	const mode = headerValue(headers, "sec-fetch-mode");
-	const destination = headerValue(headers, "sec-fetch-dest");
-	if (site !== "cross-site" && site !== "same-origin" && site !== "none" || mode !== "navigate" || destination !== "document") throw new LoopbackViolationError("navigation_required", "Request must be opened as a browser navigation");
+//#region src/lib/agent-server/connection-settings.ts
+var RELEASE_CONNECTION = {
+	apiUrl: "https://api.themolt.net",
+	issuer: "https://auth.themolt.net",
+	publicUrl: "https://auth.themolt.net",
+	nativeClientId: "moltnet-native",
+	consoleClientId: "moltnet-console"
+};
+var KEYS = Object.keys(RELEASE_CONNECTION);
+function validateConnectionOverrides(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Connection settings must be an object");
+	const result = {};
+	for (const [key, raw] of Object.entries(value)) {
+		if (!KEYS.includes(key) || typeof raw !== "string" || !raw.trim()) throw new Error(`Invalid connection setting: ${key}`);
+		const text = raw.trim();
+		if (key.endsWith("ClientId")) {
+			if (text.length > 255 || /\s/u.test(text)) throw new Error("Client IDs must not contain whitespace");
+		} else {
+			const url = new URL(text);
+			if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && (key === "issuer" || isLoopbackHostname(url.hostname)))) throw new Error("Connection URLs require HTTPS (HTTP is allowed only on loopback)");
+		}
+		result[key] = text;
+	}
+	return result;
 }
-/**
-* Reject an explicit cross-site Fetch-Metadata signal. Only the explicit
-* `cross-site` value is rejected: Safari may omit Fetch Metadata on
-* same-origin form submissions, so the absence of the header is not treated
-* as a violation — callers keep their one-time token as the primary control.
-*/
-function rejectExplicitCrossSite(headers) {
-	if (headerValue(headers, "sec-fetch-site") === "cross-site") throw new LoopbackViolationError("cross_site_rejected", "Request must not originate cross-site");
+/** Local administration only. Never exposed through browser authorization. */
+var ConnectionSettingsStore = class {
+	path;
+	environment;
+	constructor(root, environment = {}) {
+		this.root = root;
+		this.path = join(root, "connection-settings.json");
+		this.environment = validateConnectionOverrides(environment);
+	}
+	view() {
+		let overrides = {};
+		try {
+			overrides = validateConnectionOverrides(JSON.parse(readFileSync(this.path, "utf8")));
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		return {
+			defaults: RELEASE_CONNECTION,
+			overrides,
+			environment: this.environment,
+			effective: {
+				...RELEASE_CONNECTION,
+				...overrides,
+				...this.environment
+			}
+		};
+	}
+	stateRoot(settings = this.view().effective) {
+		if (this.environment.apiUrl && this.environment.issuer) return this.root;
+		return connectionStateRoot(this.root, settings);
+	}
+	save(value) {
+		const overrides = validateConnectionOverrides(value);
+		const current = this.view();
+		for (const key of KEYS) {
+			if (this.environment[key] !== void 0 && overrides[key] !== current.overrides[key]) throw new Error(`${key} is managed by the launch environment`);
+			if (overrides[key] === RELEASE_CONNECTION[key]) delete overrides[key];
+		}
+		mkdirSync(this.root, {
+			recursive: true,
+			mode: 448
+		});
+		const effective = {
+			...RELEASE_CONNECTION,
+			...overrides,
+			...this.environment
+		};
+		rmSync(join(this.stateRoot(effective), "operator.json"), { force: true });
+		const temporary = `${this.path}.${randomUUID()}.tmp`;
+		writeFileSync(temporary, JSON.stringify(overrides, null, 2) + "\n", {
+			mode: 384,
+			flag: "wx"
+		});
+		try {
+			renameSync(temporary, this.path);
+		} finally {
+			rmSync(temporary, { force: true });
+		}
+		return this.view();
+	}
+};
+/** A custom service gets its own identities, keys and runtime configuration. */
+function connectionStateRoot(root, settings) {
+	const identity = [settings.apiUrl.replace(/\/$/u, ""), settings.issuer.replace(/\/$/u, "")];
+	if (identity[0] === RELEASE_CONNECTION.apiUrl && identity[1] === RELEASE_CONNECTION.issuer) return root;
+	return join(root, "environments", createHash("sha256").update(JSON.stringify(identity)).digest("hex"));
 }
 //#endregion
 //#region src/lib/agent-server/lock.ts
@@ -8968,169 +9419,279 @@ async function withAgentServerLock(root, work, options) {
 	}
 }
 //#endregion
-//#region src/lib/agent-server/pairing.ts
+//#region src/lib/agent-server/native-grant.ts
 /**
-* One-click pairing ceremony for the agent server, mirroring the signer's
-* session/ceremony pattern (#2062 design):
+* Environment variable the supervising desktop app uses to hand this server
+* process its control token.
 *
-*   1. Console (allowed origin) POSTs `/v1/pairings` → pending pairing bound
-*      to that origin, with a one-time confirmation token.
-*   2. Console opens `http://127.0.0.1:<port>/pairings/<id>` in a new tab —
-*      a navigation-gated local approval page naming the origin.
-*   3. One click POSTs the confirmation form (explicit cross-site rejected;
-*      the one-time token is the primary CSRF control).
-*   4. Console claims `/v1/pairings/<id>/claim` from the same origin and
-*      receives the bearer token exactly once; only its SHA-256 remains in
-*      this supervisor process.
+* The parent generates the token, passes it here, and keeps it in native
+* memory — it is never written to disk, never printed to stdout (the desktop
+* app surfaces server output in its WebView), and never reaches the renderer.
+*/
+var NATIVE_TOKEN_ENV = "MOLTNET_AGENT_SERVER_NATIVE_TOKEN";
+/** 32 bytes of entropy, base64url-encoded, is 43 characters. */
+var MIN_TOKEN_LENGTH = 32;
+/**
+* Consume the supervisor's native token from the environment and grant it.
+*
+* Consuming matters as much as granting: spawned run children inherit this
+* process environment, so a token left in place would hand every
+* task-executing agent control of the Agent Server supervising it. The
+* variable is deleted whether or not the value turns out to be usable.
 *
-* The token exists for shared-machine cross-user protection and to bind
-* "this console session is the operator" — browser-vs-browser isolation is
-* already covered by the loopback-companion origin checks. Grants are
-* deliberately process-scoped: after the listening socket changes owners, a
-* token disclosed to an impostor on that port cannot authenticate to a later
-* supervisor process.
+* @returns whether a native grant was issued.
 */
-var PENDING_TTL_MS = 600 * 1e3;
-var AgentServerPairingError = class extends Error {
-	name = "AgentServerPairingError";
-	constructor(code, message) {
-		super(message);
-		this.code = code;
+function applyNativeClientGrant(options) {
+	const { nativeGrant, env } = options;
+	const token = env[NATIVE_TOKEN_ENV];
+	delete env[NATIVE_TOKEN_ENV];
+	if (typeof token !== "string" || token.length === 0) return false;
+	if (token.length < MIN_TOKEN_LENGTH) throw new Error(`${NATIVE_TOKEN_ENV} must be at least 32 characters of unguessable entropy`);
+	nativeGrant.grantNative(token);
+	return true;
+}
+var NativeGrantError = class extends Error {
+	code = "native_token_invalid";
+};
+var NativeGrantService = class {
+	digest;
+	grantNative(token) {
+		if (!token) throw new NativeGrantError("Native token must not be empty");
+		this.digest = createHash("sha256").update(token).digest();
+	}
+	verify(origin, token) {
+		const digest = createHash("sha256").update(token).digest();
+		if (origin !== "moltnet-agent-desktop://native" || !this.digest || !timingSafeEqual(this.digest, digest)) throw new NativeGrantError("Native token is not valid");
 	}
 };
-function sha256Hex(value) {
-	return createHash("sha256").update(value, "utf8").digest("hex");
-}
-function safeEqual(a, b) {
-	const left = Buffer.from(a, "utf8");
-	const right = Buffer.from(b, "utf8");
-	return left.length === right.length && timingSafeEqual(left, right);
-}
-var PairingService = class {
-	pending = /* @__PURE__ */ new Map();
-	paired = /* @__PURE__ */ new Map();
-	constructor(options = {}) {
-		this.options = options;
+//#endregion
+//#region src/lib/agent-server/native-socket.ts
+/** The supervisor owns the private directory; the server never removes peers. */
+async function validateNativeSocket(path) {
+	if (!isAbsolute(path) || Buffer.byteLength(path) > 100) throw new Error("Native socket must be an absolute path of at most 100 bytes");
+	const parent = dirname(path);
+	const metadata = await lstat(parent);
+	if (metadata.isSymbolicLink()) throw new Error(`Native socket parent contains a symlink: ${parent}`);
+	if (!metadata.isDirectory()) throw new Error(`Native socket parent is not a directory: ${parent}`);
+	const expectedUid = process.getuid?.();
+	if (expectedUid === void 0 || metadata.uid !== expectedUid) throw new Error(`Native socket parent has uid ${metadata.uid}; expected ${String(expectedUid)}: ${parent}`);
+	const mode = metadata.mode & 511;
+	if (mode !== 448) throw new Error(`Native socket parent has mode ${mode.toString(8)}; expected 700: ${parent}`);
+	const canonical = await realpath(parent);
+	if (canonical !== resolve(parent)) throw new Error(`Native socket parent contains a symlink: ${parent} resolves to ${canonical}`);
+	try {
+		await lstat(path);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
 	}
-	now() {
-		return this.options.now?.() ?? Date.now();
+	throw new Error("Native socket path already exists; it was left untouched");
+}
+//#endregion
+//#region src/lib/agent-server/operator-oauth.ts
+var InvalidOperatorGrantError = class extends Error {};
+var LOCAL_SCOPE = OPERATOR_OAUTH.localControlScope;
+/** Trusted native controller owns the verifier, callback and token exchange. */
+var OperatorOAuth = class {
+	instance = randomUUID();
+	keys;
+	active = false;
+	pending;
+	operator;
+	constructor(config, root, openBrowser = (url) => {
+		const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
+		return new Promise((resolve, reject) => {
+			execFile(command, [url], (error) => {
+				if (error) reject(/* @__PURE__ */ new Error("Could not open Console approval"));
+				else resolve();
+			});
+		});
+	}) {
+		this.config = config;
+		this.root = root;
+		this.openBrowser = openBrowser;
+		const endpoints = [
+			config.authorizationUrl,
+			config.tokenUrl,
+			config.jwksUrl
+		].map((value) => new URL(value));
+		if (endpoints.some((url) => url.username || url.password || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHostname(url.hostname))) || endpoints.some((url) => url.origin !== endpoints[0].origin)) throw new Error("OAuth endpoints must share a trusted secure origin");
+		this.keys = createRemoteJWKSet(new URL(config.jwksUrl));
+		try {
+			const value = JSON.parse(readFileSync(join(root, "operator.json"), "utf8"));
+			if (!value || typeof value !== "object" || !("issuer" in value) || !("subject" in value) || typeof value.issuer !== "string" || typeof value.subject !== "string") throw new Error("Invalid operator");
+			this.operator = {
+				issuer: value.issuer,
+				subject: value.subject
+			};
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+			this.operator = null;
+		}
 	}
-	token() {
-		return this.options.randomToken?.() ?? randomBytes(32).toString("base64url");
+	cancel() {
+		this.pending?.abort();
 	}
-	sweep() {
-		const now = this.now();
-		for (const [id, pairing] of this.pending) if (pairing.expiresAt <= now) this.pending.delete(id);
+	removeOperator() {
+		this.cancel();
+		rmSync(join(this.root, "operator.json"), { force: true });
+		this.operator = null;
 	}
-	start(origin) {
-		this.sweep();
-		const pairingId = randomBytes(12).toString("hex");
-		this.pending.set(pairingId, {
-			origin,
-			confirmToken: this.token(),
-			expiresAt: this.now() + PENDING_TTL_MS,
-			approved: false,
-			bearerToken: null
-		});
+	metadata() {
 		return {
-			pairingId,
-			approvalPath: `/pairings/${pairingId}`
+			protocolVersion: OPERATOR_OAUTH.protocolVersion,
+			instance: this.instance,
+			issuer: this.config.issuer,
+			authorizationUrl: this.config.authorizationUrl,
+			tokenUrl: this.config.tokenUrl,
+			clientId: this.config.consoleClientId,
+			operatorConfigured: !!this.operator
 		};
 	}
-	/** Data for the local approval page. */
-	approval(pairingId) {
-		const pairing = this.require(pairingId);
-		if (pairing.approved) throw new AgentServerPairingError("pairing_invalid", "Pairing is already approved");
+	async verify(token, scope, clientId) {
+		const { payload } = await jwtVerify(token, this.keys, {
+			algorithms: ["RS256"],
+			issuer: this.config.issuer,
+			audience: scope === LOCAL_SCOPE ? OPERATOR_OAUTH.localControlAudience : OPERATOR_OAUTH.provisioningAudience,
+			requiredClaims: [
+				"exp",
+				"iat",
+				"sub"
+			],
+			maxTokenAge: clientId === this.config.nativeClientId ? OPERATOR_OAUTH.nativeLifetimeSeconds : OPERATOR_OAUTH.consoleLifetimeSeconds
+		});
+		const claims = payload.ext;
+		const scopes = typeof payload.scope === "string" ? payload.scope.split(" ") : payload.scp;
+		if (!Array.isArray(scopes) || scopes.length !== 1 || scopes[0] !== scope || payload.client_id !== clientId || claims?.["moltnet:subject_type"] !== "human" || claims["moltnet:identity_id"] !== payload.sub || claims["moltnet:instance"] !== this.instance) throw new InvalidOperatorGrantError("Invalid operator grant");
 		return {
-			origin: pairing.origin,
-			confirmToken: pairing.confirmToken
+			issuer: payload.iss,
+			subject: payload.sub,
+			provisioning: claims["moltnet:provisioning"]
 		};
 	}
-	confirm(pairingId, confirmToken) {
-		const pairing = this.require(pairingId);
-		if (pairing.approved || !safeEqual(pairing.confirmToken, confirmToken)) throw new AgentServerPairingError("pairing_invalid", "Confirmation token is not valid");
-		pairing.approved = true;
-		pairing.bearerToken = this.token();
-		return { origin: pairing.origin };
-	}
-	claim(pairingId, origin) {
-		const pairing = this.require(pairingId);
-		if (pairing.origin !== origin) throw new AgentServerPairingError("pairing_origin_mismatch", "Pairing belongs to a different origin");
-		if (!pairing.approved || !pairing.bearerToken) throw new AgentServerPairingError("pairing_not_approved", "Pairing has not been approved yet");
-		const token = pairing.bearerToken;
-		this.pending.delete(pairingId);
-		this.paired.set(origin, sha256Hex(token));
-		return { token };
-	}
-	verify(origin, token) {
-		const tokenHash = this.paired.get(origin);
-		if (!tokenHash || !safeEqual(tokenHash, sha256Hex(token))) throw new AgentServerPairingError("pairing_token_invalid", "Pairing token is not valid for this origin");
-	}
-	require(pairingId) {
-		this.sweep();
-		const pairing = this.pending.get(pairingId);
-		if (!pairing) throw new AgentServerPairingError("pairing_not_found", "Pairing was not found or has expired");
-		return pairing;
+	async verifyBrowser(token) {
+		const operator = await this.verify(token, LOCAL_SCOPE, this.config.consoleClientId);
+		if (!this.operator || operator.issuer !== this.operator.issuer || operator.subject !== this.operator.subject) throw new InvalidOperatorGrantError("Native operator sign-in required");
+	}
+	async authorize(grant, signal) {
+		if (this.active) throw new Error("An approval is already pending");
+		this.active = true;
+		const state = randomBytes(32).toString("base64url");
+		const verifier = randomBytes(32).toString("base64url");
+		const callback = `http://127.0.0.1:${this.config.callbackPort}/oauth/callback`;
+		const scope = grant ? OPERATOR_OAUTH.provisioningScope : LOCAL_SCOPE;
+		const controller = new AbortController();
+		this.pending = controller;
+		const timeout = setTimeout(() => controller.abort(), OPERATOR_OAUTH.nativeLifetimeSeconds * 1e3);
+		const abort = () => controller.abort();
+		signal?.addEventListener("abort", abort, { once: true });
+		let server;
+		try {
+			if (signal?.aborted) throw new Error("Approval cancelled");
+			const code = await new Promise((resolve, reject) => {
+				let consumed = false;
+				server = createServer((req, res) => {
+					const url = new URL(req.url ?? "/", callback);
+					res.setHeader("Cache-Control", "no-store");
+					res.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+					if (req.method !== "GET" || req.headers.host !== `127.0.0.1:${this.config.callbackPort}` || url.pathname !== "/oauth/callback" || url.searchParams.getAll("state").length !== 1 || url.searchParams.get("state") !== state || consumed) {
+						res.writeHead(400);
+						res.end("Invalid callback");
+						return;
+					}
+					consumed = true;
+					if (url.searchParams.has("error") || url.searchParams.getAll("code").length !== 1 || !url.searchParams.get("code")) {
+						res.end("Approval cancelled. Return to Desktop.");
+						reject(/* @__PURE__ */ new Error("Approval cancelled"));
+						return;
+					}
+					res.end("Approval received. Return to Desktop.");
+					resolve(url.searchParams.get("code"));
+				});
+				server.once("error", reject);
+				controller.signal.addEventListener("abort", () => reject(/* @__PURE__ */ new Error("Approval cancelled")), { once: true });
+				server.listen(this.config.callbackPort, "127.0.0.1", () => {
+					const url = new URL(this.config.authorizationUrl);
+					for (const [key, value] of Object.entries({
+						client_id: this.config.nativeClientId,
+						response_type: "code",
+						scope,
+						audience: grant ? OPERATOR_OAUTH.provisioningAudience : OPERATOR_OAUTH.localControlAudience,
+						redirect_uri: callback,
+						state,
+						code_challenge_method: "S256",
+						code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+						prompt: "consent",
+						instance: this.instance,
+						...grant ? { provisioning: JSON.stringify(grant) } : {}
+					})) url.searchParams.set(key, value);
+					try {
+						Promise.resolve(this.openBrowser(url.href)).catch(() => reject(/* @__PURE__ */ new Error("Could not open Console approval")));
+					} catch {
+						reject(/* @__PURE__ */ new Error("Could not open Console approval"));
+					}
+				});
+			});
+			const response = await fetch(this.config.tokenUrl, {
+				method: "POST",
+				redirect: "error",
+				signal: controller.signal,
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					grant_type: "authorization_code",
+					code,
+					code_verifier: verifier,
+					client_id: this.config.nativeClientId,
+					redirect_uri: callback
+				})
+			});
+			if (!response.ok) throw new Error("Approval exchange lost; request fresh approval");
+			const tokens = await response.json();
+			if (!tokens.access_token || tokens.refresh_token) throw new Error("Invalid approval token response");
+			const operator = await this.verify(tokens.access_token, scope, this.config.nativeClientId);
+			controller.signal.throwIfAborted();
+			if (grant) {
+				const actual = operator.provisioning;
+				if (!actual || !Array.isArray(actual.scopes) || !actual.scopes.every((scope) => typeof scope === "string") || actual.agentId !== grant.agentId || actual.teamId !== grant.teamId || actual.operation !== grant.operation || actual.idempotencyKey !== grant.idempotencyKey || [...actual.scopes].sort().join(" ") !== [...grant.scopes].sort().join(" ")) throw new Error("Approval target differs from native request");
+			}
+			if (this.operator && (this.operator.issuer !== operator.issuer || this.operator.subject !== operator.subject)) throw new Error("Change the operator through native administration first");
+			if (!this.operator) {
+				try {
+					writeFileSync(join(this.root, "operator.json"), JSON.stringify({
+						issuer: operator.issuer,
+						subject: operator.subject
+					}), {
+						mode: 384,
+						flag: "wx"
+					});
+				} catch (error) {
+					if (error.code !== "EEXIST") throw error;
+					const pinned = JSON.parse(readFileSync(join(this.root, "operator.json"), "utf8"));
+					if (!pinned || typeof pinned !== "object" || !("issuer" in pinned) || !("subject" in pinned) || pinned.issuer !== operator.issuer || pinned.subject !== operator.subject) throw new Error("Change the operator through native administration first");
+				}
+				this.operator = {
+					issuer: operator.issuer,
+					subject: operator.subject
+				};
+			}
+			return tokens.access_token;
+		} finally {
+			clearTimeout(timeout);
+			signal?.removeEventListener("abort", abort);
+			server?.close();
+			server?.closeAllConnections();
+			this.active = false;
+			this.pending = void 0;
+		}
 	}
 };
-function escapeHtml(value) {
-	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
-}
-/** Minimal, dependency-free local approval page. */
-function renderPairingApprovalPage(input) {
-	return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>MoltNet Agent — approve connection</title>
-<style>
-  :root { color-scheme: light dark; }
-  body { margin: 0; font: 16px/1.5 system-ui, sans-serif; display: grid; place-items: center; min-height: 100vh; background: Canvas; color: CanvasText; }
-  main { max-width: 26rem; padding: 2rem; border: 1px solid color-mix(in srgb, CanvasText 20%, transparent); border-radius: 12px; }
-  h1 { font-size: 1.2rem; margin: 0 0 0.5rem; }
-  code { font-size: 0.95em; word-break: break-all; }
-  button { margin-top: 1.25rem; font: inherit; padding: 0.6rem 1.4rem; border-radius: 8px; border: 1px solid color-mix(in srgb, CanvasText 30%, transparent); cursor: pointer; }
-  p.small { font-size: 0.85rem; opacity: 0.75; }
-</style>
-</head>
-<body>
-<script>
-  // The Console must remain this popup's opener until it finishes navigating
-  // from about:blank. Safari rejects that cross-origin navigation otherwise.
-  // Once this trusted local approval document has loaded, it needs no opener.
-  window.opener = null;
-<\/script>
-<main>
-<h1>Allow this site to manage local MoltNet agents?</h1>
-<p><code>${escapeHtml(input.origin)}</code> asks to configure agents and start or stop local daemon runs on this machine.</p>
-<p class="small">Approve only if you opened that page yourself. This grant lasts until the local supervisor stops.</p>
-<form method="post" action="/pairings/${escapeHtml(input.pairingId)}/confirm">
-<input type="hidden" name="confirmToken" value="${escapeHtml(input.confirmToken)}" />
-<button type="submit">Approve</button>
-</form>
-</main>
-</body>
-</html>
-`;
-}
-function renderPairingResultPage(input) {
-	return `<!doctype html>
-<html lang="en">
-<head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>${escapeHtml(input.title)}</title>
-<style>:root{color-scheme:light dark}body{margin:0;font:16px/1.5 system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;background:Canvas;color:CanvasText}main{max-width:26rem;padding:2rem}</style>
-</head>
-<body><main role="status"><h1>${escapeHtml(input.title)}</h1><p>${escapeHtml(input.message)}</p><p>You can close this tab.</p></main></body>
-</html>
-`;
-}
 //#endregion
 //#region src/lib/agent-server/provider-login.ts
 /**
 * Subscription-provider OAuth brokering for Agent Server (#2061 slice 4).
 *
-* The console clicks "Connect"; agent server runs the Pi OAuth flow host-side via
-* `ModelRuntime.login()` (which owns persistence into the shared
+* An authorized controller starts the flow; Agent Server runs Pi OAuth
+* host-side via `ModelRuntime.login()` (which owns persistence into the shared
 * `pi/auth.json` and token rotation thereafter). The browser only ever sees
 * the provider's authorize URL or device code — never tokens.
 *
@@ -9669,53 +10230,6 @@ async function attachExternalAgent(store, secretProviders, input, connectAgent =
 		releaseAlias();
 	}
 }
-/** Load and authenticate the current config, then refresh its derived pin. */
-async function verifyAgentActivation(store, alias, managedSecretProviders, externalSecretProviders, connectAgent = connect, signal, teamId) {
-	const activation = requireActivation(store, alias);
-	teamId ??= activation.boundTeamId;
-	const verified = activation.source === "managed" ? await verifyManagedActivation(store, activation, managedSecretProviders, connectAgent, signal, teamId) : await verifyExternalActivation(store, activation, externalSecretProviders, connectAgent, signal, teamId);
-	assertSubjectMatches(verified.whoami, verified.config, "authenticated whoami", `agent "${activation.alias}" config`);
-	if (verified.whoami.subjectId !== activation.subjectId) throw new AgentServerIdentityError("verification_failed", `authenticated whoami subject does not match agent "${activation.alias}" pinned activation`);
-	const identity = identityFromConfig(verified.config);
-	assertIdentityMatches(verified.whoami, identity, "authenticated whoami", `agent "${activation.alias}" config`);
-	const boundTeamId = boundTeamIdFromWhoami(verified.whoami);
-	if (!selectAgentKeyReference(verified.config, teamId)?.teamId && activation.boundTeamId !== boundTeamId) throw new AgentServerIdentityError("verification_failed", `authenticated whoami team binding does not match agent "${activation.alias}" pinned activation`);
-	const refreshed = {
-		...activation,
-		...identity
-	};
-	if (activation.publicKey !== refreshed.publicKey || activation.fingerprint !== refreshed.fingerprint) {
-		store.writeActivation(refreshed);
-		process.stderr.write(`agent-server: refreshed the authenticated signing identity for ${JSON.stringify(activation.alias)}\n`);
-	}
-	return {
-		activation: refreshed,
-		config: verified.config,
-		...boundTeamId ? { boundTeamId } : {}
-	};
-}
-async function verifyManagedActivation(store, activation, secretProviders, connectAgent, signal, teamId) {
-	const configPath = store.agentPath(activation.alias);
-	const config = await readCurrentConfig(configPath);
-	assertActivatedConfig(config, activation, configPath, requireConfigApiUrl(config, configPath), activation.apiUrl);
-	return {
-		config,
-		whoami: await authenticateConfig(config, configPath, activation.apiUrl, secretProviders, connectAgent, signal, teamId)
-	};
-}
-async function verifyExternalActivation(store, activation, secretProviders, connectAgent, signal, teamId) {
-	const central = activation.configPath === store.agentPath(activation.alias);
-	if (!central) externalAgentLocation(activation.configPath);
-	assertTrustedConfigApiUrl(activation.configApiUrl);
-	const config = await readCurrentConfig(activation.configPath);
-	if (central && !hasAgentKeyConfiguration(config)) throw new AgentServerIdentityError("unsupported_credential", `central identity "${activation.alias}" needs a stored agent key before the Agent Server can run it`);
-	assertActivatedConfig(config, activation, activation.configPath, requireTrustedConfigApiUrl(config, activation.configPath), activation.configApiUrl);
-	const effectiveApiUrl = requireTrustedApiOverride(activation.apiUrl, activation.configApiUrl, activation.configPath);
-	return {
-		config,
-		whoami: await authenticateConfig(config, activation.configPath, effectiveApiUrl, secretProviders, connectAgent, signal, teamId)
-	};
-}
 /** Never let request or activation metadata redirect persisted credentials. */
 function requireTrustedApiOverride(override, configApiUrl, configPath) {
 	if (!override) return configApiUrl;
@@ -9854,6 +10368,129 @@ function requireActivation(store, alias) {
 	if (!activation) throw new AgentServerStoreError("not_found", `agent "${alias}" is not configured`);
 	return activation;
 }
+/** Enrollment may recover a central identity before its first online activation. */
+async function loadEnrollmentIdentity(store, alias) {
+	if (store.readActivation(alias)) return loadAgentActivation(store, alias);
+	const configPath = store.agentPath(alias);
+	const config = await readCurrentConfig(configPath);
+	if (!isCanonicalConfig(config)) throw new AgentServerIdentityError("verification_failed", "Enrollment requires a canonical agent identity");
+	const apiUrl = requireTrustedConfigApiUrl(config, configPath);
+	return {
+		config,
+		activation: {
+			source: "external",
+			alias,
+			configPath,
+			configApiUrl: apiUrl,
+			apiUrl,
+			subjectId: config.subject_id,
+			...identityFromConfig(config),
+			createdAt: config.registered_at
+		}
+	};
+}
+/** Resolve pinned local identity state without requiring a live API credential. */
+async function loadAgentActivation(store, alias) {
+	const activation = requireActivation(store, alias);
+	const configPath = activation.source === "managed" ? store.agentPath(alias) : activation.configPath;
+	if (activation.source === "external" && configPath !== store.agentPath(alias)) externalAgentLocation(configPath);
+	const config = await readCurrentConfig(configPath);
+	const apiUrl = activation.source === "managed" ? activation.apiUrl : activation.configApiUrl;
+	assertActivatedConfig(config, activation, configPath, requireTrustedConfigApiUrl(config, configPath), apiUrl);
+	requireTrustedApiOverride(activation.apiUrl, apiUrl, configPath);
+	return {
+		activation,
+		config
+	};
+}
+//#endregion
+//#region src/lib/agent-server/team-credentials.ts
+var AGENT_SERVER_REQUIRED_SCOPES = [
+	...DAEMON_MINIMUM_SCOPES,
+	"team:read",
+	"diary:read"
+];
+var TeamCredentialError = class extends Error {
+	constructor(blocker) {
+		super(blocker.message);
+		this.blocker = blocker;
+	}
+};
+function credentialBlocker(error) {
+	return error instanceof TeamCredentialError ? error.blocker : {
+		code: "agent_key_unavailable",
+		message: "This team credential could not be verified or read its team resources.",
+		remedy: "Check connectivity and team access, or renew this team credential."
+	};
+}
+var snapshots = /* @__PURE__ */ new WeakMap();
+/** Capture is internal to the verifier; exported for injected verifier test doubles. */
+function captureTeamCredential(agent, snapshot) {
+	snapshots.set(agent, snapshot);
+	return agent;
+}
+function requireCredentialSnapshot(agent) {
+	const snapshot = snapshots.get(agent);
+	if (!snapshot) throw new Error("A verified team credential snapshot is required");
+	return snapshot;
+}
+/** The only supervised credential path. No fallback reference or OAuth resolution. */
+async function verifyTeamActivation(store, alias, managed, external, connectImpl = connect, signal, teamId) {
+	const activated = await loadAgentActivation(store, alias);
+	const { config, activation } = activated;
+	const reference = teamId ? config.agent_key_refs?.[teamId] : void 0;
+	if (!teamId || !reference) throw new TeamCredentialError({
+		code: "agent_key_missing",
+		message: "No credential is indexed for this team.",
+		remedy: "Enroll into this team or explicitly index its existing team-bound credential."
+	});
+	let agentKey;
+	try {
+		const resolved = await resolveAgentKey({
+			...config,
+			agent_key_ref: void 0,
+			agent_key_refs: { [teamId]: reference }
+		}, activation.source === "managed" ? managed : external, teamId);
+		if (!resolved) throw new Error("Missing selected key");
+		agentKey = resolved;
+	} catch {
+		throw new TeamCredentialError({
+			code: "agent_key_unavailable",
+			message: "The selected team credential is unavailable.",
+			remedy: "Repair its secret provider or renew this team credential."
+		});
+	}
+	const client = await connectImpl({
+		agentKey,
+		apiUrl: activation.apiUrl ?? (activation.source === "external" ? activation.configApiUrl : void 0),
+		signal
+	});
+	const whoami = await client.agents.whoami({ signal });
+	if (whoami.subjectType !== "agent" || whoami.subjectId !== activation.subjectId || whoami.publicKey !== config.keys.public_key || whoami.fingerprint !== config.keys.fingerprint || whoami.publicKey !== activation.publicKey || whoami.fingerprint !== activation.fingerprint || whoami.credentialBinding?.bindingScope !== "team" || whoami.credentialBinding.boundTeamId !== teamId) throw new TeamCredentialError({
+		code: "agent_key_binding_invalid",
+		message: "The selected credential does not match this identity and team.",
+		remedy: "Renew the selected team credential."
+	});
+	const metadata = {
+		keyId: whoami.credentialBinding.keyId,
+		...Object.hasOwn(whoami.credentialBinding, "expiresAt") ? { expiresAt: whoami.credentialBinding.expiresAt } : {},
+		scopes: [...whoami.scopes ?? []],
+		verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	store.writeCredentialMetadata(alias, teamId, metadata);
+	const missing = AGENT_SERVER_REQUIRED_SCOPES.filter((scope) => !metadata.scopes.includes(scope));
+	if (missing.length) throw new TeamCredentialError({
+		code: "agent_key_scopes_insufficient",
+		message: `This credential lacks ${missing.join(", ")}.`,
+		remedy: "Renew through Console approval with the required desktop scopes."
+	});
+	activated.boundTeamId = teamId;
+	return captureTeamCredential(activated, {
+		agentKey,
+		client,
+		metadata
+	});
+}
 //#endregion
 //#region src/lib/agent-server/runs.ts
 var STOP_GRACE_MS = 1e4;
@@ -9893,6 +10530,19 @@ var INHERITED_MOLTNET_ENV_NAMES = new Set([
 	"MOLTNET_SIGNER_URL",
 	"MOLTNET_TRACE_IDLE_POLLING"
 ]);
+/** The runtime kind bundled with the agent; needs no registration. */
+var BUILT_IN_RUNTIME_KIND = "gondolin_pi";
+/** Persist only process status; worker stderr can contain provider secrets. */
+function describeFailure(code, signal) {
+	if (signal) return {
+		code: "run_signalled",
+		message: `The worker was stopped by ${signal}.`
+	};
+	return {
+		code: "run_failed",
+		message: `The worker exited with code ${code ?? "unknown"}. Open the log for detail.`
+	};
+}
 var AgentServerRunError = class extends Error {
 	name = "AgentServerRunError";
 	constructor(code, message) {
@@ -9975,23 +10625,16 @@ var RunManager = class {
 			String(runtimeSettings.warmRetentionSec),
 			...target.extraArgs
 		];
+		env["MOLTNET_AGENT_KEY"] = requireCredentialSnapshot(agent).agentKey;
+		env["MOLTNET_API_URL"] = activation.apiUrl ?? (activation.source === "external" ? activation.configApiUrl : "");
 		if (activation.source === "managed") {
-			const reference = selectAgentKeyReference(config, spec.teamId)?.reference;
-			if (!reference || !config.keys.private_key_ref) throw new AgentServerRunError("invalid_spec", `managed config for "${activation.alias}" is missing canonical secret references`);
-			env["MOLTNET_API_URL"] = activation.apiUrl;
-			env["MOLTNET_AGENT_KEY_REF"] = formatSecretReferenceString(reference);
+			if (!config.keys.private_key_ref) throw new AgentServerRunError("invalid_spec", "The managed signing key reference is missing");
 			env["MOLTNET_PRIVATE_KEY_REF"] = formatSecretReferenceString(config.keys.private_key_ref);
 			env["MOLTNET_SECRET_ROOT"] = this.store.secretsDir;
-		} else {
-			env["MOLTNET_API_URL"] = activation.apiUrl ?? activation.configApiUrl;
-			try {
-				const agentKey = await resolveAgentKey(config, this.options.externalSecretProviders, spec.teamId);
-				if (!agentKey) throw new Error("external daemon config has no agent key");
-				env["MOLTNET_AGENT_KEY"] = agentKey;
-				env["MOLTNET_PRIVATE_KEY"] = await resolveIdentitySeed(config, this.options.externalSecretProviders);
-			} catch {
-				throw new AgentServerRunError("invalid_spec", `external credentials for "${activation.alias}" could not be projected`);
-			}
+		} else try {
+			env["MOLTNET_PRIVATE_KEY"] = await resolveIdentitySeed(config, this.options.externalSecretProviders);
+		} catch {
+			throw new AgentServerRunError("invalid_spec", "The selected signing key could not be projected");
 		}
 		env["MOLTNET_EXPECTED_SUBJECT_ID"] = activation.subjectId;
 		env["MOLTNET_EXPECTED_SUBJECT_TYPE"] = "agent";
@@ -10025,9 +10668,9 @@ var RunManager = class {
 	}
 	async startReserved(spec, signal) {
 		this.assertStartOpen(signal);
-		const agent = await (this.options.verifyActivationImpl ?? verifyAgentActivation)(this.store, spec.agent, this.options.secretProviders, this.options.externalSecretProviders, void 0, signal, spec.teamId).catch((cause) => {
-			if (cause instanceof AgentServerIdentityError && cause.code === "verification_failed") throw new AgentServerIdentityError(cause.code, `Cannot start agent "${spec.agent}" for team "${spec.teamId}": credential verification failed. Check the selected team key and activation.`, { cause });
-			throw cause;
+		const agent = await (this.options.verifyActivationImpl ?? verifyTeamActivation)(this.store, spec.agent, this.options.secretProviders, this.options.externalSecretProviders, void 0, signal, spec.teamId).catch((cause) => {
+			if (cause instanceof TeamCredentialError || cause instanceof AgentServerStoreError) throw cause;
+			throw new AgentServerIdentityError("verification_failed", `Cannot start agent "${spec.agent}" for team "${spec.teamId}": credential verification failed. Check the selected team key and activation.`);
 		});
 		this.assertStartOpen(signal);
 		if (agent.boundTeamId && agent.boundTeamId !== spec.teamId) throw new AgentServerRunError("invalid_spec", `agent "${spec.agent}" has a key bound to team ${agent.boundTeamId}; start the run with that team, or create a new agent with an enrollment token from team ${spec.teamId}`);
@@ -10104,7 +10747,8 @@ var RunManager = class {
 				id,
 				status: "running",
 				pid: child.pid,
-				startedAt: (this.options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+				startedAt: (this.options.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+				credential: requireCredentialSnapshot(agent).metadata
 			};
 			child.once("exit", (code, signal) => {
 				const activeRun = this.active.get(id);
@@ -10119,7 +10763,8 @@ var RunManager = class {
 				});
 				this.persistRunCompletion(id, spec.agent, {
 					status,
-					exitCode: code
+					exitCode: code,
+					...status === "failed" ? { lastError: describeFailure(code, signal) } : {}
 				});
 			});
 			child.once("error", (error) => {
@@ -10130,7 +10775,13 @@ var RunManager = class {
 					transition: "spawn_failed",
 					...safeRunError(error)
 				});
-				this.persistRunCompletion(id, spec.agent, { status: "failed" });
+				this.persistRunCompletion(id, spec.agent, {
+					status: "failed",
+					lastError: {
+						code: "spawn_failed",
+						message: `The worker could not be started: ${error.message}`
+					}
+				});
 			});
 			this.store.writeRun(record);
 			this.log("info", "agent server run started", {
@@ -10157,7 +10808,7 @@ var RunManager = class {
 	}
 	async resolveRuntimeModule(spec, activated, cwd) {
 		const profiles = await resolveRuntimeProfiles({
-			agent: await this.connectActivatedAgent(activated, spec.teamId),
+			agent: await this.connectAgent(activated, spec.teamId),
 			profiles: spec.profiles,
 			teamId: spec.teamId,
 			cwd
@@ -10179,14 +10830,9 @@ var RunManager = class {
 		if (kind === "gondolin_pi") return void 0;
 		throw new AgentServerRunError("invalid_spec", `No local runtime is registered for profile kind "${kind}".`);
 	}
-	async connectActivatedAgent(activated, teamId) {
-		const { activation, config } = activated;
-		const agentKey = await resolveAgentKey(config, activation.source === "managed" ? this.options.secretProviders : this.options.externalSecretProviders, teamId);
-		if (!agentKey) throw new AgentServerRunError("invalid_spec", `agent "${activation.alias}" has no agent key`);
-		return connect({
-			agentKey,
-			apiUrl: activation.source === "managed" ? activation.apiUrl : activation.apiUrl ?? activation.configApiUrl
-		});
+	connectAgent(activated, teamId) {
+		if (activated.boundTeamId !== teamId) throw new AgentServerRunError("invalid_spec", "Snapshot team mismatch");
+		return Promise.resolve(requireCredentialSnapshot(activated).client);
 	}
 	stop(id) {
 		const record = this.store.readRun(id);
@@ -10211,6 +10857,22 @@ var RunManager = class {
 		if (!record) throw new AgentServerStoreError("not_found", `run "${id}" was not found`);
 		return record;
 	}
+	async listAsync(limit) {
+		const activeIds = new Set(this.active.keys());
+		const records = await this.store.listRunsAsync(limit + activeIds.size, [...activeIds]);
+		return [...records.filter((record) => activeIds.has(record.id)), ...records.filter((record) => !activeIds.has(record.id)).slice(0, limit)];
+	}
+	/** Freeze new starts only after local configuration has been persisted. */
+	prepareServerRestart(persist) {
+		if (this.closing || this.starting > 0 || this.active.size > 0) throw new AgentServerRunError("invalid_spec", "Stop running or starting work before changing connection settings");
+		this.closing = true;
+		try {
+			return persist();
+		} catch (error) {
+			this.closing = false;
+			throw error;
+		}
+	}
 	list(limit = Number.POSITIVE_INFINITY) {
 		if (!Number.isFinite(limit)) return this.store.listRuns();
 		const active = [...this.active.keys()].map((id) => this.store.readRun(id)).filter((record) => record !== null).sort((a, b) => b.startedAt.localeCompare(a.startedAt));
@@ -10467,6 +11129,21 @@ var LOCKFILE_NAMES = [
 ];
 /** Local, operator-owned allowlist for executable daemon runtime modules. */
 var RuntimeRegistry = class {
+	displayDigests = /* @__PURE__ */ new Map();
+	displayHash(path) {
+		const stat = statSync(path);
+		const key = String(path);
+		const stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+		const previous = this.displayDigests.get(key);
+		if (previous?.stamp === stamp) return previous.hash;
+		const hash = hashPath(path);
+		if (this.displayDigests.size >= 128) this.displayDigests.clear();
+		this.displayDigests.set(key, {
+			stamp,
+			hash
+		});
+		return hash;
+	}
 	constructor(root) {
 		this.root = root;
 	}
@@ -10489,7 +11166,7 @@ var RuntimeRegistry = class {
 		const adapter = await loadDaemonRuntimeAdapter(specifier, { cwd });
 		if (adapter.runtimeKind !== kind) throw new Error(`Runtime module provides "${adapter.runtimeKind}", not registered kind "${kind}".`);
 		if (!moduleUrl.startsWith("file:")) throw new Error("Runtime registration must resolve to a local file URL.");
-		const entryHash = hashFile(new URL(moduleUrl));
+		const entryHash = hashPath(new URL(moduleUrl));
 		const lockfilePath = isPackageSpecifier(specifier) ? findLockfile(cwd) : void 0;
 		if (isPackageSpecifier(specifier) && !lockfilePath) throw new Error("Package runtime registration requires a pnpm, npm, Yarn, or Bun lockfile in the current project or a parent directory.");
 		const entry = {
@@ -10515,18 +11192,16 @@ var RuntimeRegistry = class {
 		writeRegistry(this.path, next);
 		return true;
 	}
-	resolve(kind) {
+	resolve(kind, options = {}) {
 		kind = assertStoreName("runtime kind", kind);
 		const entry = this.list().find((candidate) => candidate.kind === kind);
 		if (!entry) return void 0;
-		if (hashFile(new URL(entry.moduleUrl)) !== entry.entryHash) throw new Error(`Registered runtime "${kind}" has changed; re-register it before starting a run.`);
-		if (entry.lockfilePath && (!existsSync(entry.lockfilePath) || hashPath(entry.lockfilePath) !== entry.lockfileHash)) throw new Error(`Registered runtime "${kind}" lockfile has changed; re-register it before starting a run.`);
+		const digest = (path) => options.forDisplay ? this.displayHash(path) : hashPath(path);
+		if (digest(new URL(entry.moduleUrl)) !== entry.entryHash) throw new Error(`Registered runtime "${kind}" has changed; re-register it before starting a run.`);
+		if (entry.lockfilePath && (!existsSync(entry.lockfilePath) || digest(entry.lockfilePath) !== entry.lockfileHash)) throw new Error(`Registered runtime "${kind}" lockfile has changed; re-register it before starting a run.`);
 		return entry;
 	}
 };
-function hashFile(url) {
-	return createHash("sha256").update(readFileSync(url)).digest("hex");
-}
 function hashPath(path) {
 	return createHash("sha256").update(readFileSync(path)).digest("hex");
 }
@@ -10556,6 +11231,229 @@ function writeRegistry(path, entries) {
 	renameSync(temp, path);
 }
 //#endregion
+//#region src/lib/agent-server/readiness.ts
+/**
+* Whether a runtime profile can execute on *this* machine.
+*
+* A profile is authored in Console against a team; whether it can run depends
+* on local facts only the server knows — which provider keys are configured
+* here and which runtime kinds this machine can produce.
+*
+* The prerequisite comparison itself is **not** reimplemented here. Run start
+* calls `validateRuntimeProfilePrerequisites`, and the catalogue calls the same
+* function, so the composer cannot promise a run that startup would reject for
+* a reason the two evaluated differently.
+*/
+function deriveProfileReadiness(profile, machine) {
+	const blockers = [];
+	const env = {};
+	for (const [name, configured] of machine.providerEnv) if (configured) env[name] = "configured";
+	try {
+		validateRuntimeProfilePrerequisites(profile, env, {
+			tools: machine.inventory?.tools ?? profile.requiredTools,
+			executables: machine.inventory?.executables ?? profile.requiredExecutables
+		});
+	} catch (error) {
+		if (!(error instanceof RuntimeProfilePrerequisiteError)) throw error;
+		for (const name of error.missingEnv) blockers.push({
+			code: "env_missing",
+			message: `${name} is not configured on this machine.`,
+			remedy: "Add the key under Providers, then reopen this run."
+		});
+		for (const name of error.missingTools) blockers.push({
+			code: "tool_missing",
+			message: `The runtime does not provide the tool ${name}.`,
+			remedy: `Use a profile whose runtime provides ${name}, or change the profile in Console.`
+		});
+		for (const name of error.missingExecutables) blockers.push({
+			code: "executable_missing",
+			message: `The runtime does not provide the executable ${name}.`,
+			remedy: `Use a runtime that ships ${name}, or drop the requirement in Console.`
+		});
+	}
+	if (!machine.runtimeKinds.has(profile.runtimeKind)) blockers.push({
+		code: "runtime_unregistered",
+		message: `Runtime kind ${profile.runtimeKind} is not available on this machine.`,
+		remedy: "Register the runtime under Runtimes, then reopen this run."
+	});
+	return {
+		ready: blockers.length === 0,
+		blockers
+	};
+}
+//#endregion
+//#region src/lib/agent-server/catalogue.ts
+async function buildCatalogue(options) {
+	const { agent, machine, identityDefault } = options;
+	const entries = await Promise.all(agent.teamIds.map(async (teamId) => {
+		try {
+			const result = await agent.readTeam(teamId);
+			if (result.team.id !== teamId) throw new Error("Team response mismatch");
+			const diaries = result.diaries.filter((diary) => diary.teamId === teamId).map(({ id, name }) => ({
+				id,
+				name
+			}));
+			return {
+				team: {
+					teamId,
+					teamName: result.team.name,
+					available: true,
+					blockers: [],
+					credential: result.credential,
+					diaries,
+					defaultDiaryId: resolveDefaultDiary(teamId, diaries, identityDefault)
+				},
+				profiles: result.profiles.filter((profile) => profile.teamId === teamId).map((profile) => ({
+					...profile,
+					...deriveProfileReadiness(profile, machine)
+				}))
+			};
+		} catch (error) {
+			return {
+				team: {
+					teamId,
+					teamName: teamId,
+					available: false,
+					blockers: [credentialBlocker(error)],
+					credential: agent.lastVerified(teamId),
+					diaries: [],
+					defaultDiaryId: null
+				},
+				profiles: []
+			};
+		}
+	}));
+	const teams = entries.map(({ team }) => team);
+	const available = teams.filter((team) => team.available);
+	return {
+		teams,
+		defaultTeamId: available.find((team) => team.teamId === identityDefault.teamId)?.teamId ?? available[0]?.teamId ?? null,
+		profiles: entries.flatMap((entry) => entry.profiles)
+	};
+}
+function resolveDefaultDiary(teamId, diaries, identityDefault) {
+	const bound = diaries.find((diary) => diary.id === identityDefault.diaryId);
+	if (bound && identityDefault.teamId === teamId) return bound.id;
+	return diaries.length === 1 ? diaries[0]?.id ?? null : null;
+}
+//#endregion
+//#region src/lib/agent-server/enrollment.ts
+/** Native callers receive metadata only; approval and storage stay local. */
+async function enrollIdentityTeam(options) {
+	const apiUrl = new URL(options.apiUrl);
+	if (apiUrl.username || apiUrl.password || apiUrl.hash || apiUrl.protocol !== "https:" && !(apiUrl.protocol === "http:" && isLoopbackHostname(apiUrl.hostname))) throw new Error("Provisioning requires a configured secure API endpoint");
+	const { activation, config } = await loadEnrollmentIdentity(options.store, options.alias);
+	const identityApiUrl = activation.apiUrl ?? config.endpoints?.api;
+	if (!identityApiUrl) throw new Error("The identity has no API environment configured");
+	if (new URL(identityApiUrl).href.replace(/\/$/u, "") !== apiUrl.href.replace(/\/$/u, "")) throw new Error("The identity belongs to another API environment. Select that environment in Server settings before enrollment.");
+	const registry = activation.source === "managed" ? options.managed : options.external;
+	const replacement = options.input.mode === "replace" ? { teamId: options.input.teamId } : void 0;
+	const providerName = replacement ? config.agent_key_refs?.[replacement.teamId]?.provider : activation.source === "managed" ? "file" : config.keys.private_key_ref?.provider;
+	const provider = providerName ? registry.get(providerName) : void 0;
+	if (!provider?.capabilities.write) throw new Error("Enrollment requires a writable identity secret provider");
+	const configPath = activation.source === "managed" ? options.store.agentPath(options.alias) : activation.configPath;
+	try {
+		const result = await enrollTeam({
+			idempotencyKey: options.input.idempotencyKey,
+			provisioningContext: {
+				teamId: options.input.teamId,
+				operation: replacement ? "renew" : "enroll",
+				scopes: [...AGENT_SERVER_REQUIRED_SCOPES]
+			},
+			replacement,
+			provision: async () => {
+				const grant = {
+					agentId: config.subject_id,
+					teamId: options.input.teamId,
+					operation: replacement ? "renew" : "enroll",
+					scopes: [...AGENT_SERVER_REQUIRED_SCOPES],
+					idempotencyKey: options.input.idempotencyKey
+				};
+				let token;
+				let agentProof;
+				try {
+					token = await options.oauth.authorize(grant, options.signal);
+					agentProof = replacement ? void 0 : await signBytes(Buffer.from(enrollmentProofMessage({
+						accessToken: token,
+						grant
+					})).toString("base64"), dirname(configPath), registry);
+				} catch (error) {
+					throw new ProvisioningNotStartedError(error);
+				}
+				const response = await fetch(new URL("/oauth2/provision", options.apiUrl), {
+					method: "POST",
+					redirect: "error",
+					signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4),
+					headers: {
+						authorization: `Bearer ${token}`,
+						"content-type": "application/json"
+					},
+					body: JSON.stringify(agentProof ? { agentProof } : {})
+				});
+				if (!response.ok) throw new Error("Provisioning unavailable; inspect recovery before fresh approval");
+				const agentKey = await response.json();
+				return {
+					teamId: options.input.teamId,
+					role: "member",
+					agentKey
+				};
+			},
+			configDir: dirname(configPath),
+			secretProvider: provider,
+			apiUrl: options.apiUrl
+		});
+		if (!options.store.readActivation(options.alias)) options.store.writeActivation(activation);
+		return {
+			state: "persisted",
+			teamId: result.teamId,
+			keyId: result.key.id
+		};
+	} catch (error) {
+		if (error instanceof ProvisioningNotStartedError) throw error;
+		if (error instanceof CredentialPersistenceError || error instanceof EnrollmentRecoveryError) return {
+			state: "recovery_required",
+			secretCaptured: error.secretCaptured,
+			...error.issuedKeyId ? { issuedKeyId: error.issuedKeyId } : {},
+			...error.recoveryPath ? { recoveryId: basename(error.recoveryPath) } : {},
+			message: error.secretCaptured ? "The credential was captured locally but persistence is incomplete. Recover the captured credential before retrying enrollment." : "No credential secret was captured. Approved team membership may already exist. Retained retry context identifies this issuance; inspect it before requesting fresh approval."
+		};
+		throw new Error("Team enrollment could not be completed", { cause: error });
+	}
+}
+//#endregion
+//#region src/lib/agent-server/identity-binding.ts
+/**
+* The identity-wide team/diary binding, read from `<identityDir>/env`.
+*
+* This mirrors the Go CLI's `identityDefaultBinding` (`project_selection.go`),
+* which is the fallback the CLI uses when a working directory has no
+* registered project binding.
+*
+* The desktop cannot use the CLI's *location* bindings at all — its composer
+* has no working directory to key on — but it can honour this identity-wide
+* default, so an operator sees their familiar team preselected rather than an
+* arbitrary first entry.
+*
+* Like the CLI, a half-filled pair is treated as no binding: a team without a
+* diary is ignored.
+*/
+function readIdentityDefaultBinding(identityDir) {
+	let contents;
+	try {
+		contents = readFileSync(join(identityDir, "env"), "utf8");
+	} catch {
+		return {};
+	}
+	const env = parseEnv(contents);
+	const teamId = env["MOLTNET_TEAM_ID"]?.trim();
+	const diaryId = env["MOLTNET_DIARY_ID"]?.trim();
+	if (!teamId || !diaryId) return {};
+	return {
+		teamId,
+		diaryId
+	};
+}
+//#endregion
 //#region src/lib/agent-server/protocol.ts
 var DateTime = Type.String({ format: "date-time" });
 var StringList = Type.Array(Type.String());
@@ -10601,6 +11499,63 @@ var AgentServerProviderSchema = Type.Object({
 	models: ProviderModelList,
 	hasApiKey: Type.Boolean()
 }, { $id: "AgentServerProvider" });
+var CredentialMetadataSchema = Type.Object({
+	keyId: Type.String(),
+	expiresAt: Type.Optional(Type.Union([DateTime, Type.Null()])),
+	verifiedAt: DateTime,
+	scopes: StringList
+});
+var AgentServerCatalogueTeamSchema = Type.Object({
+	teamId: Type.String(),
+	teamName: Type.String(),
+	available: Type.Boolean(),
+	credential: Type.Optional(CredentialMetadataSchema),
+	blockers: Type.Array(Type.Object({
+		code: Type.String(),
+		message: Type.String(),
+		remedy: Type.String()
+	})),
+	diaries: Type.Array(Type.Object({
+		id: Type.String(),
+		name: Type.String()
+	})),
+	defaultDiaryId: Type.Union([Type.String(), Type.Null()])
+}, { $id: "AgentServerCatalogueTeam" });
+/**
+* Composed from the canonical `RuntimeProfile` schema rather than restated, so
+* the wire contract cannot drift from the profile the API serves — and so the
+* constrained fields keep their real unions instead of degrading to `string`.
+*/
+var AgentServerCatalogueProfileSchema = Type.Intersect([Type.Pick(RuntimeProfile, [
+	"id",
+	"name",
+	"teamId",
+	"description",
+	"provider",
+	"model",
+	"runtimeKind",
+	"toolEnforcement",
+	"defaultWorkspaceMode",
+	"maxTurns",
+	"revision",
+	"definitionCid",
+	"requiredEnv",
+	"requiredTools",
+	"requiredExecutables"
+]), Type.Object({
+	ready: Type.Boolean(),
+	blockers: Type.Array(Type.Object({
+		code: Type.String(),
+		message: Type.String(),
+		remedy: Type.String()
+	}))
+})], { $id: "AgentServerCatalogueProfile" });
+var AgentServerCatalogueSchema = Type.Object({
+	teams: Type.Array(schemaRef(AgentServerCatalogueTeamSchema)),
+	defaultTeamId: Type.Union([Type.String(), Type.Null()]),
+	profiles: Type.Array(schemaRef(AgentServerCatalogueProfileSchema))
+}, { $id: "AgentServerCatalogue" });
+var CatalogueQuerySchema = Type.Object({ identity: Type.String({ minLength: 1 }) });
 var AgentServerRunRecordSchema = Type.Object({
 	id: Type.String(),
 	agent: Type.String(),
@@ -10617,6 +11572,11 @@ var AgentServerRunRecordSchema = Type.Object({
 	]),
 	pid: Type.Optional(Type.Number()),
 	exitCode: Type.Optional(Type.Union([Type.Number(), Type.Null()])),
+	credential: Type.Optional(CredentialMetadataSchema),
+	lastError: Type.Optional(Type.Object({
+		code: Type.String(),
+		message: Type.String()
+	})),
 	startedAt: DateTime,
 	endedAt: Type.Optional(DateTime)
 }, { $id: "AgentServerRunRecord" });
@@ -10653,12 +11613,6 @@ var AgentServerStatusSchema = Type.Object({
 		warmRetentionSec: Type.Integer({ minimum: 0 })
 	})
 }, { $id: "AgentServerStatus" });
-var PairingStartedSchema = Type.Object({
-	pairingId: Type.String(),
-	approvalPath: Type.String()
-}, { $id: "PairingStarted" });
-var PairingClaimedSchema = Type.Object({ token: Type.String() }, { $id: "PairingClaimed" });
-var PairingParamsSchema = Type.Object({ pairingId: Type.String() });
 var ProviderParamsSchema = Type.Object({ providerId: Type.String() });
 var AgentParamsSchema = Type.Object({ agentName: Type.String() });
 var RunParamsSchema = Type.Object({ runId: Type.String() });
@@ -10704,19 +11658,20 @@ var AGENT_SERVER_SCHEMAS = [
 	AgentServerIdentitySchema,
 	AgentServerTaskTypeSchema,
 	AgentServerProviderSchema,
+	AgentServerCatalogueTeamSchema,
+	AgentServerCatalogueProfileSchema,
+	AgentServerCatalogueSchema,
 	AgentServerRunRecordSchema,
 	AgentServerRunSchema,
 	AgentServerSubscriptionSchema,
 	AgentServerSubscriptionLoginSchema,
 	AgentServerStatusSchema,
-	PairingStartedSchema,
-	PairingClaimedSchema,
 	ReconcileAgentResultSchema,
 	DiscoverModelsSchema,
 	CancelledSubscriptionSchema,
 	LogStreamSchema
 ];
-var pairedSecurity = [{ agentServerToken: [] }];
+var localControlSecurity = [{ agentServerToken: [] }];
 var problemResponse = { default: schemaRef(AgentServerProblemSchema) };
 var AgentServerRouteSchemas = {
 	health: {
@@ -10724,27 +11679,10 @@ var AgentServerRouteSchemas = {
 		tags: ["system"],
 		response: { 200: schemaRef(AgentServerHealthSchema) }
 	},
-	startPairing: {
-		operationId: "startAgentServerPairing",
-		tags: ["pairing"],
-		response: {
-			201: schemaRef(PairingStartedSchema),
-			...problemResponse
-		}
-	},
-	claimPairing: {
-		operationId: "claimAgentServerPairing",
-		tags: ["pairing"],
-		params: PairingParamsSchema,
-		response: {
-			200: schemaRef(PairingClaimedSchema),
-			...problemResponse
-		}
-	},
 	status: {
 		operationId: "getAgentServerStatus",
 		tags: ["system"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		response: {
 			200: schemaRef(AgentServerStatusSchema),
 			...problemResponse
@@ -10753,7 +11691,7 @@ var AgentServerRouteSchemas = {
 	listAgents: {
 		operationId: "listAgentServerAgents",
 		tags: ["agents"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		response: {
 			200: Type.Array(schemaRef(AgentServerAgentSchema)),
 			...problemResponse
@@ -10762,17 +11700,44 @@ var AgentServerRouteSchemas = {
 	createAgent: {
 		operationId: "createAgentServerAgent",
 		tags: ["agents"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		body: CreateAgentSchema,
 		response: {
 			201: schemaRef(AgentServerAgentSchema),
 			...problemResponse
 		}
 	},
+	enrollTeam: {
+		operationId: "enrollAgentServerTeam",
+		tags: ["agents"],
+		security: localControlSecurity,
+		params: AgentParamsSchema,
+		body: Type.Intersect([Type.Object({
+			teamId: Type.String({ format: "uuid" }),
+			idempotencyKey: Type.String({
+				minLength: 1,
+				maxLength: 256
+			})
+		}), Type.Union([Type.Object({ mode: Type.Literal("enroll") }), Type.Object({ mode: Type.Literal("replace") })])]),
+		response: {
+			200: Type.Union([Type.Object({
+				state: Type.Literal("persisted"),
+				teamId: Type.String(),
+				keyId: Type.String()
+			}), Type.Object({
+				state: Type.Literal("recovery_required"),
+				secretCaptured: Type.Boolean(),
+				issuedKeyId: Type.Optional(Type.String()),
+				recoveryId: Type.String(),
+				message: Type.String()
+			})]),
+			...problemResponse
+		}
+	},
 	reconcileAgent: {
 		operationId: "reconcileAgentServerAgent",
 		tags: ["agents"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: AgentParamsSchema,
 		body: ReconcileAgentSchema,
 		response: {
@@ -10783,7 +11748,7 @@ var AgentServerRouteSchemas = {
 	listProviders: {
 		operationId: "listAgentServerProviders",
 		tags: ["providers"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		response: {
 			200: Type.Record(Type.String(), schemaRef(AgentServerProviderSchema)),
 			...problemResponse
@@ -10792,7 +11757,7 @@ var AgentServerRouteSchemas = {
 	discoverModels: {
 		operationId: "discoverAgentServerProviderModels",
 		tags: ["providers"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: ProviderParamsSchema,
 		response: {
 			200: schemaRef(DiscoverModelsSchema),
@@ -10802,7 +11767,7 @@ var AgentServerRouteSchemas = {
 	putProvider: {
 		operationId: "putAgentServerProvider",
 		tags: ["providers"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: ProviderParamsSchema,
 		body: PutProviderSchema,
 		response: {
@@ -10813,7 +11778,7 @@ var AgentServerRouteSchemas = {
 	deleteProvider: {
 		operationId: "deleteAgentServerProvider",
 		tags: ["providers"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: ProviderParamsSchema,
 		response: {
 			204: Type.Any(),
@@ -10823,7 +11788,7 @@ var AgentServerRouteSchemas = {
 	listSubscriptions: {
 		operationId: "listAgentServerSubscriptions",
 		tags: ["subscriptions"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		response: {
 			200: Type.Array(schemaRef(AgentServerSubscriptionSchema)),
 			...problemResponse
@@ -10832,7 +11797,7 @@ var AgentServerRouteSchemas = {
 	startSubscriptionLogin: {
 		operationId: "startAgentServerSubscriptionLogin",
 		tags: ["subscriptions"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: ProviderParamsSchema,
 		response: {
 			201: schemaRef(AgentServerSubscriptionLoginSchema),
@@ -10842,7 +11807,7 @@ var AgentServerRouteSchemas = {
 	getSubscriptionLogin: {
 		operationId: "getAgentServerSubscriptionLogin",
 		tags: ["subscriptions"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: ProviderParamsSchema,
 		response: {
 			200: schemaRef(AgentServerSubscriptionLoginSchema),
@@ -10852,17 +11817,27 @@ var AgentServerRouteSchemas = {
 	cancelSubscriptionLogin: {
 		operationId: "cancelAgentServerSubscriptionLogin",
 		tags: ["subscriptions"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: ProviderParamsSchema,
 		response: {
 			200: schemaRef(CancelledSubscriptionSchema),
 			...problemResponse
 		}
 	},
+	catalogue: {
+		operationId: "getAgentServerCatalogue",
+		tags: ["catalogue"],
+		security: localControlSecurity,
+		querystring: CatalogueQuerySchema,
+		response: {
+			200: schemaRef(AgentServerCatalogueSchema),
+			...problemResponse
+		}
+	},
 	listRuns: {
 		operationId: "listAgentServerRuns",
 		tags: ["runs"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		response: {
 			200: Type.Array(schemaRef(AgentServerRunSchema)),
 			...problemResponse
@@ -10871,7 +11846,7 @@ var AgentServerRouteSchemas = {
 	startRun: {
 		operationId: "startAgentServerRun",
 		tags: ["runs"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		body: StartRunSchema,
 		response: {
 			201: schemaRef(AgentServerRunSchema),
@@ -10881,7 +11856,7 @@ var AgentServerRouteSchemas = {
 	stopRun: {
 		operationId: "stopAgentServerRun",
 		tags: ["runs"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: RunParamsSchema,
 		response: {
 			200: schemaRef(AgentServerRunRecordSchema),
@@ -10891,7 +11866,7 @@ var AgentServerRouteSchemas = {
 	streamRunLogs: {
 		operationId: "streamAgentServerRunLogs",
 		tags: ["runs"],
-		security: pairedSecurity,
+		security: localControlSecurity,
 		params: RunParamsSchema,
 		response: {
 			200: schemaRef(LogStreamSchema),
@@ -10906,9 +11881,8 @@ var AgentServerRouteSchemas = {
 * loopback-companion security profile (#2066): loopback Host enforcement,
 * exact-origin CORS, Fetch-Metadata guards, strict JSON parsing.
 *
-* Everything under `/v1` except the pairing bootstrap requires a paired
-* origin: the `x-moltnet-agent-server-token` header must verify against the
-* origin-bound token issued by the one-click pairing ceremony.
+* Control routes require a native process grant or an OAuth token bound to
+* the native operator and this server instance. Origin checks apply to both.
 */
 var AGENT_SERVER_TOKEN_HEADER = "x-moltnet-agent-server-token";
 var BODY_LIMIT = 64 * 1024;
@@ -11024,19 +11998,19 @@ function requestOperationSignal(request, shutdownSignal) {
 	return shutdownSignal ? AbortSignal.any([disconnected.signal, shutdownSignal]) : disconnected.signal;
 }
 function buildAgentServer(options) {
-	const { pairing } = options;
-	const fastifyOptions = {
-		bodyLimit: BODY_LIMIT,
-		...options.tls ? { https: options.tls } : {}
-	};
+	const { nativeGrant } = options;
+	const oauth = options.operatorOAuth;
+	let restartRequired = false;
+	const fastifyOptions = { bodyLimit: BODY_LIMIT };
 	const app = options.logger ? Fastify({
 		...fastifyOptions,
 		loggerInstance: options.logger
 	}) : Fastify(fastifyOptions);
 	options.registerOpenApi?.(app);
 	for (const schema of AGENT_SERVER_SCHEMAS) app.addSchema(schema);
+	const browserOrigins = new OriginAllowlist(options.allowedOrigins);
 	registerLoopbackSecurity(app, {
-		allowedOrigins: options.allowedOrigins,
+		isOriginAllowed: (origin) => origin === "moltnet-agent-desktop://native" || browserOrigins.has(origin),
 		...options.selfOrigin ? { selfOrigins: [options.selfOrigin] } : {},
 		allowedHeaders: [AGENT_SERVER_TOKEN_HEADER],
 		methods: [
@@ -11047,40 +12021,213 @@ function buildAgentServer(options) {
 			"OPTIONS"
 		]
 	});
+	let verificationWindow = Date.now();
+	let verifications = 0;
+	const browserVerification = /* @__PURE__ */ new WeakMap();
+	function verifyBrowser(request, token) {
+		const previous = browserVerification.get(request);
+		if (previous) return previous;
+		if (Date.now() - verificationWindow >= RATE_LIMIT_WINDOW_MS) {
+			verificationWindow = Date.now();
+			verifications = 0;
+		}
+		if (++verifications > RATE_LIMIT_MAX) throw new AgentServerHttpError(429, "rate_limited", "Too many authorization attempts");
+		if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
+		const pending = oauth.verifyBrowser(token);
+		browserVerification.set(request, pending);
+		return pending;
+	}
+	function hasValidNativeGrant(origin, token) {
+		if (origin !== "moltnet-agent-desktop://native" || typeof token !== "string" || token.length === 0) return false;
+		try {
+			nativeGrant.verify(origin, token);
+			return true;
+		} catch (error) {
+			if (error instanceof NativeGrantError) return false;
+			throw error;
+		}
+	}
+	const nativeVerification = /* @__PURE__ */ new WeakSet();
+	function requireNativeGrant(request) {
+		if (nativeVerification.has(request)) return;
+		const origin = request.headers.origin;
+		const token = request.headers[AGENT_SERVER_TOKEN_HEADER];
+		if (hasValidNativeGrant(origin, token)) {
+			nativeVerification.add(request);
+			return;
+		}
+		request.log.warn({
+			stage: "native-control-authorization",
+			outcome: "rejected"
+		}, "Native control authorization failed");
+		throw new AgentServerHttpError(401, "native_token_invalid", "Native authorization required");
+	}
 	app.register(rateLimit, {
-		global: false,
+		global: true,
 		max: options.rateLimitMax ?? RATE_LIMIT_MAX,
 		timeWindow: RATE_LIMIT_WINDOW_MS,
 		errorResponseBuilder: () => new AgentServerHttpError(429, "rate_limited", "Too many requests"),
-		keyGenerator: (request) => {
+		keyGenerator: async (request) => {
 			const origin = request.headers.origin;
-			return isConfiguredOrigin(origin, options) ? `origin:${origin}` : `ip:${request.ip}`;
-		}
-	});
-	app.addContentTypeParser("application/x-www-form-urlencoded", { parseAs: "buffer" }, (_request, body, done) => {
-		try {
-			const form = new TextDecoder("utf-8", { fatal: true }).decode(typeof body === "string" ? Buffer.from(body) : body);
-			done(null, new URLSearchParams(form));
-		} catch {
-			done(new AgentServerHttpError(400, "invalid_body", "Form body is invalid"), void 0);
+			if (!isConfiguredOrigin(origin, options)) return `ip:${request.ip}`;
+			const presented = request.headers[AGENT_SERVER_TOKEN_HEADER];
+			let authenticated = false;
+			if (typeof presented === "string" && presented.length > 0) try {
+				if (origin === "moltnet-agent-desktop://native") authenticated = hasValidNativeGrant(origin, presented);
+				else {
+					if (!oauth) return `unauth:${origin}:${request.ip}`;
+					await verifyBrowser(request, presented);
+					authenticated = true;
+				}
+			} catch (error) {
+				if (error instanceof AgentServerHttpError && error.statusCode === 429) throw error;
+				if (origin === "moltnet-agent-desktop://native") throw error;
+			}
+			return authenticated ? `origin:${origin}` : `unauth:${origin}:${request.ip}`;
 		}
 	});
-	const requirePairedOrigin = (request) => {
+	const requireAuthorizedOrigin = async (request) => {
+		if (restartRequired) throw new AgentServerHttpError(409, "restart_required", "Restart the Agent Server to apply connection settings");
 		const origin = requireOriginHeader(request.headers);
 		const token = request.headers[AGENT_SERVER_TOKEN_HEADER];
-		if (typeof token !== "string" || token.length === 0) throw new AgentServerHttpError(401, "pairing_required", "Pairing token is required");
-		pairing.verify(origin, token);
+		if (typeof token !== "string" || token.length === 0) throw new AgentServerHttpError(401, "authorization_required", "Local control token is required");
+		if (origin === "moltnet-agent-desktop://native") requireNativeGrant(request);
+		else try {
+			if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
+			const admission = browserVerification.get(request);
+			browserVerification.delete(request);
+			await (admission ?? oauth.verifyBrowser(token));
+		} catch (error) {
+			if (error instanceof AgentServerHttpError) throw error;
+			const code = error && typeof error === "object" && "code" in error ? error.code : void 0;
+			const rejected = error instanceof InvalidOperatorGrantError || typeof code === "string" && [
+				"ERR_JWT_EXPIRED",
+				"ERR_JWT_CLAIM_VALIDATION_FAILED",
+				"ERR_JWS_SIGNATURE_VERIFICATION_FAILED",
+				"ERR_JWS_INVALID",
+				"ERR_JWT_INVALID",
+				"ERR_JOSE_ALG_NOT_ALLOWED",
+				"ERR_JWKS_NO_MATCHING_KEY"
+			].includes(code);
+			request.log.warn({
+				stage: "local-control-authorization",
+				outcome: rejected ? "rejected" : "unavailable",
+				code: typeof code === "string" ? code : void 0
+			}, "Local control authorization failed");
+			if (!rejected) throw new AgentServerHttpError(503, "authorization_unavailable", "Local authorization is unavailable. Check Server settings or retry shortly.");
+			throw new AgentServerHttpError(401, "authorization_required", "Sign in to authorize local control");
+		}
 		return origin;
 	};
 	app.after(() => {
-		app.addHook("onRequest", app.rateLimit());
+		if (options.nativeOnly) app.addHook("preParsing", async (request) => {
+			requireNativeGrant(request);
+		});
 		app.get("/health", { schema: AgentServerRouteSchemas.health }, async () => ({ status: "ok" }));
-		registerPairingRoutes(app, pairing);
-		registerStatusRoute(app, options, requirePairedOrigin);
-		registerAgentRoutes(app, options, requirePairedOrigin);
-		registerProviderRoutes(app, options, requirePairedOrigin);
-		registerSubscriptionRoutes(app, options, requirePairedOrigin);
-		registerRunRoutes(app, options, requirePairedOrigin);
+		app.get("/v1/native/connection-settings", { schema: { hide: true } }, async (request) => {
+			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !options.connectionSettings) throw new AgentServerHttpError(403, "native_required", "Native administration required");
+			return options.connectionSettings.view();
+		});
+		app.post("/v1/native/connection-settings", { schema: { hide: true } }, async (request) => {
+			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !options.connectionSettings) throw new AgentServerHttpError(403, "native_required", "Native administration required");
+			try {
+				const settings = options.runs.prepareServerRestart(() => options.connectionSettings.save(request.body));
+				oauth?.cancel();
+				restartRequired = true;
+				return settings;
+			} catch (error) {
+				throw new AgentServerHttpError(400, "invalid_connection_settings", error instanceof Error ? error.message : "Invalid connection settings");
+			}
+		});
+		app.get("/oauth/metadata", { schema: {
+			operationId: "getAgentServerOAuthMetadata",
+			tags: ["operator"],
+			response: { 200: {
+				type: "object",
+				required: [
+					"protocolVersion",
+					"instance",
+					"issuer",
+					"authorizationUrl",
+					"tokenUrl",
+					"clientId",
+					"operatorConfigured"
+				],
+				properties: {
+					protocolVersion: {
+						type: "integer",
+						const: OPERATOR_OAUTH.protocolVersion
+					},
+					instance: {
+						type: "string",
+						format: "uuid"
+					},
+					issuer: { type: "string" },
+					authorizationUrl: { type: "string" },
+					tokenUrl: { type: "string" },
+					clientId: { type: "string" },
+					operatorConfigured: { type: "boolean" }
+				}
+			} }
+		} }, async () => {
+			if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
+			return oauth.metadata();
+		});
+		app.post("/v1/operator/sign-in", { schema: {
+			operationId: "signInAgentServerOperator",
+			response: { 200: {
+				type: "object",
+				properties: { state: { type: "string" } },
+				required: ["state"]
+			} }
+		} }, async (request) => {
+			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !oauth) throw new AgentServerHttpError(403, "native_required", "Native administration required");
+			await oauth.authorize(void 0, requestOperationSignal(request, options.shutdownSignal));
+			return { state: "authorized" };
+		});
+		app.post("/v1/operator/cancel", { schema: {
+			operationId: "cancelAgentServerOperatorApproval",
+			tags: ["operator"],
+			security: [{ agentServerToken: [] }],
+			response: { 200: {
+				type: "object",
+				properties: { state: {
+					type: "string",
+					const: "cancelled"
+				} },
+				required: ["state"]
+			} }
+		} }, async (request) => {
+			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !oauth) throw new AgentServerHttpError(403, "native_required", "Native administration required");
+			oauth.cancel();
+			return { state: "cancelled" };
+		});
+		app.delete("/v1/operator", { schema: {
+			operationId: "removeAgentServerOperator",
+			tags: ["operator"],
+			security: [{ agentServerToken: [] }],
+			response: { 200: {
+				type: "object",
+				properties: { state: {
+					type: "string",
+					const: "removed"
+				} },
+				required: ["state"]
+			} }
+		} }, async (request) => {
+			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !oauth) throw new AgentServerHttpError(403, "native_required", "Native administration required");
+			oauth.removeOperator();
+			return { state: "removed" };
+		});
+		registerStatusRoute(app, options, requireAuthorizedOrigin);
+		registerAgentRoutes(app, options, requireAuthorizedOrigin);
+		registerProviderRoutes(app, options, requireAuthorizedOrigin);
+		registerSubscriptionRoutes(app, options, requireAuthorizedOrigin);
+		registerRunRoutes(app, options, requireAuthorizedOrigin);
+		registerCatalogueRoute(app, options, requireAuthorizedOrigin);
+	});
+	app.addHook("preClose", async () => {
+		options.operatorOAuth?.cancel();
 	});
 	app.addHook("onClose", () => {
 		options.subscriptions.close();
@@ -11104,41 +12251,65 @@ function buildAgentServer(options) {
 	});
 	return app;
 }
-function registerPairingRoutes(app, pairing) {
-	app.post("/v1/pairings", { schema: AgentServerRouteSchemas.startPairing }, async (request, reply) => {
-		const origin = requireOriginHeader(request.headers);
-		return reply.code(201).send(pairing.start(origin));
-	});
-	app.get("/pairings/:pairingId", { schema: { hide: true } }, async (request, reply) => {
-		assertNavigationRequest(request.headers);
-		const { pairingId } = request.params;
-		const approval = pairing.approval(pairingId);
-		return reply.type("text/html; charset=utf-8").send(renderPairingApprovalPage({
-			pairingId,
-			origin: approval.origin,
-			confirmToken: approval.confirmToken
-		}));
-	});
-	app.post("/pairings/:pairingId/confirm", { schema: { hide: true } }, async (request, reply) => {
-		rejectExplicitCrossSite(request.headers);
-		const { pairingId } = request.params;
-		if (!(request.body instanceof URLSearchParams)) throw new AgentServerHttpError(400, "invalid_body", "Confirmation form is invalid");
-		const { origin } = pairing.confirm(pairingId, request.body.get("confirmToken") ?? "");
-		return reply.type("text/html; charset=utf-8").send(renderPairingResultPage({
-			title: "Connection approved",
-			message: `${origin} can now manage local MoltNet agents on this machine.`
-		}));
-	});
-	app.post("/v1/pairings/:pairingId/claim", { schema: AgentServerRouteSchemas.claimPairing }, async (request) => {
-		const origin = requireOriginHeader(request.headers);
-		const { pairingId } = request.params;
-		return pairing.claim(pairingId, origin);
+function registerCatalogueRoute(app, options, requireAuthorizedOrigin) {
+	app.get("/v1/catalogue", {
+		schema: AgentServerRouteSchemas.catalogue,
+		attachValidation: true
+	}, async (request) => {
+		await requireAuthorizedOrigin(request);
+		const { identity } = request.query ?? {};
+		if (!identity || identity.trim().length === 0) throw new AgentServerHttpError(400, "invalid_query", "\"identity\" is required");
+		const alias = identity.trim();
+		requireActivation(options.store, alias);
+		return buildCatalogue({
+			agent: await (options.catalogueAgentFor ? options.catalogueAgentFor(alias) : defaultCatalogueAgent(options, alias)),
+			machine: machineCapabilities(options),
+			identityDefault: readIdentityDefaultBinding(options.store.identityDir(alias))
+		});
 	});
 }
-function registerStatusRoute(app, options, requirePairedOrigin) {
+/** Resolve and verify each indexed team independently with its exact key. */
+async function defaultCatalogueAgent(options, alias) {
+	const { config } = await loadAgentActivation(options.store, alias);
+	return {
+		teamIds: Object.keys(config.agent_key_refs ?? {}),
+		lastVerified: (teamId) => requireActivation(options.store, alias).credentialHealth?.[teamId],
+		readTeam: async (teamId) => {
+			const { client, metadata } = requireCredentialSnapshot(await verifyTeamActivation(options.store, alias, options.secretProviders, options.externalSecretProviders, void 0, options.shutdownSignal, teamId));
+			const [team, diaries, profiles] = await Promise.all([
+				client.teams.get(teamId),
+				client.diaries.list(),
+				client.runtimeProfiles.list({ teamId })
+			]);
+			return {
+				team,
+				diaries: diaries.items,
+				profiles: profiles.items,
+				credential: metadata
+			};
+		}
+	};
+}
+/** What this machine can execute right now: provider keys and runtime kinds. */
+function machineCapabilities(options) {
+	const providerEnv = /* @__PURE__ */ new Map();
+	for (const provider of Object.values(options.providers.list())) {
+		const configured = providerEnv.get(provider.envName) === true;
+		providerEnv.set(provider.envName, configured || provider.hasApiKey);
+	}
+	const runtimeKinds = new Set([BUILT_IN_RUNTIME_KIND]);
+	for (const entry of options.runtimeRegistry?.list() ?? []) try {
+		if (options.runtimeRegistry?.resolve(entry.kind, { forDisplay: true })) runtimeKinds.add(entry.kind);
+	} catch {}
+	return {
+		providerEnv,
+		runtimeKinds
+	};
+}
+function registerStatusRoute(app, options, requireAuthorizedOrigin) {
 	const { store, runs } = options;
 	app.get("/v1/status", { schema: AgentServerRouteSchemas.status }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const selected = selectedIdentity(store, options.activeIdentity);
 		return {
 			version: options.version,
@@ -11148,22 +12319,22 @@ function registerStatusRoute(app, options, requirePairedOrigin) {
 			identities: identityViews(store),
 			...selected ? { selectedIdentity: selected } : {},
 			providers: options.providers.list(),
-			runs: runViews(runs),
+			runs: await runViews(runs),
 			runtimeSettings: options.runtimeSettings ?? DEFAULT_LOCAL_OPERATIONAL_SETTINGS
 		};
 	});
 }
-function registerAgentRoutes(app, options, requirePairedOrigin) {
+function registerAgentRoutes(app, options, requireAuthorizedOrigin) {
 	const { store } = options;
 	app.get("/v1/agents", { schema: AgentServerRouteSchemas.listAgents }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		return store.listActivations().map((activation) => publicAgentView(store, activation));
 	});
 	app.post("/v1/agents", {
 		schema: AgentServerRouteSchemas.createAgent,
 		attachValidation: true
 	}, async (request, reply) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const body = requireBody(request);
 		const signal = requestOperationSignal(request, options.shutdownSignal);
 		const kind = requireString(body, "kind");
@@ -11189,11 +12360,26 @@ function registerAgentRoutes(app, options, requirePairedOrigin) {
 		}
 		throw new AgentServerHttpError(400, "invalid_body", "\"kind\" must be \"managed\" or \"external\"");
 	});
+	app.post("/v1/agents/:agentName/teams", { schema: AgentServerRouteSchemas.enrollTeam }, async (request) => {
+		await requireAuthorizedOrigin(request);
+		const { agentName } = request.params;
+		if (request.headers.origin !== "moltnet-agent-desktop://native" || !options.operatorOAuth || !options.operatorApiUrl) throw new AgentServerHttpError(403, "native_required", "Native OAuth enrollment required");
+		return enrollIdentityTeam({
+			oauth: options.operatorOAuth,
+			apiUrl: options.operatorApiUrl,
+			store,
+			alias: agentName,
+			managed: options.secretProviders,
+			external: options.externalSecretProviders,
+			input: request.body,
+			signal: requestOperationSignal(request, options.shutdownSignal)
+		});
+	});
 	app.post("/v1/agents/:agentName/reconcile", {
 		schema: AgentServerRouteSchemas.reconcileAgent,
 		attachValidation: true
 	}, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { agentName } = request.params;
 		const action = requireString(requireBody(request), "action");
 		if (action !== "resume" && action !== "abandon") throw new AgentServerHttpError(400, "invalid_body", "\"action\" must be \"resume\" or \"abandon\"");
@@ -11217,13 +12403,13 @@ function identityViews(store) {
 		hasAgentKey: hasAgentKeyConfiguration(store.readAgentConfig(alias) ?? {})
 	}));
 }
-function registerProviderRoutes(app, options, requirePairedOrigin) {
+function registerProviderRoutes(app, options, requireAuthorizedOrigin) {
 	app.get("/v1/providers", { schema: AgentServerRouteSchemas.listProviders }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		return options.providers.list();
 	});
 	app.post("/v1/providers/:providerId/discover-models", { schema: AgentServerRouteSchemas.discoverModels }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { providerId } = request.params;
 		return options.providers.discover(providerId, { signal: requestOperationSignal(request, options.shutdownSignal) });
 	});
@@ -11231,7 +12417,7 @@ function registerProviderRoutes(app, options, requirePairedOrigin) {
 		schema: AgentServerRouteSchemas.putProvider,
 		attachValidation: true
 	}, async (request, reply) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { providerId } = request.params;
 		const body = requireBody(request);
 		const entry = await options.providers.set(providerId, {
@@ -11247,7 +12433,7 @@ function registerProviderRoutes(app, options, requirePairedOrigin) {
 		schema: AgentServerRouteSchemas.deleteProvider,
 		attachValidation: true
 	}, async (request, reply) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { providerId } = request.params;
 		try {
 			await options.providers.remove(providerId);
@@ -11258,45 +12444,45 @@ function registerProviderRoutes(app, options, requirePairedOrigin) {
 		return reply.code(204).send(null);
 	});
 }
-function runViews(runs) {
-	return runs.list(RUN_HISTORY_LIMIT).map((record) => ({
+async function runViews(runs) {
+	return (await runs.listAsync(RUN_HISTORY_LIMIT)).map((record) => ({
 		...record,
 		active: runs.isActive(record.id)
 	}));
 }
-function registerSubscriptionRoutes(app, options, requirePairedOrigin) {
+function registerSubscriptionRoutes(app, options, requireAuthorizedOrigin) {
 	app.get("/v1/subscriptions", { schema: AgentServerRouteSchemas.listSubscriptions }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		return options.subscriptions.list();
 	});
 	app.post("/v1/subscriptions/:providerId/login", { schema: AgentServerRouteSchemas.startSubscriptionLogin }, async (request, reply) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { providerId } = request.params;
 		const login = await options.subscriptions.start(providerId);
 		return reply.code(201).send(login);
 	});
 	app.get("/v1/subscriptions/:providerId/login", { schema: AgentServerRouteSchemas.getSubscriptionLogin }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { providerId } = request.params;
 		return options.subscriptions.status(providerId);
 	});
 	app.delete("/v1/subscriptions/:providerId/login", { schema: AgentServerRouteSchemas.cancelSubscriptionLogin }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { providerId } = request.params;
 		return options.subscriptions.cancel(providerId);
 	});
 }
-function registerRunRoutes(app, options, requirePairedOrigin) {
+function registerRunRoutes(app, options, requireAuthorizedOrigin) {
 	const { runs } = options;
 	app.get("/v1/runs", { schema: AgentServerRouteSchemas.listRuns }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		return runViews(runs);
 	});
 	app.post("/v1/runs", {
 		schema: AgentServerRouteSchemas.startRun,
 		attachValidation: true
 	}, async (request, reply) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const body = requireBody(request);
 		const diaryId = optionalString(body, "diaryId");
 		const record = await runs.start({
@@ -11313,17 +12499,57 @@ function registerRunRoutes(app, options, requirePairedOrigin) {
 		});
 	});
 	app.delete("/v1/runs/:runId", { schema: AgentServerRouteSchemas.stopRun }, async (request) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { runId } = request.params;
 		return runs.stop(runId);
 	});
-	registerRunLogRoute(app, options, requirePairedOrigin);
+	registerRunLogRoute(app, options, requireAuthorizedOrigin);
 }
-function registerRunLogRoute(app, options, requirePairedOrigin) {
+function registerRunLogRoute(app, options, requireAuthorizedOrigin) {
 	const { runs, store } = options;
+	app.get("/v1/runs/:runId/logs/snapshot", { schema: {
+		operationId: "getAgentServerRunLogSnapshot",
+		tags: ["runs"],
+		security: [{ agentServerToken: [] }],
+		params: {
+			type: "object",
+			required: ["runId"],
+			properties: { runId: {
+				type: "string",
+				minLength: 1
+			} }
+		},
+		response: { 200: {
+			type: "object",
+			required: ["lines"],
+			properties: { lines: {
+				type: "array",
+				items: { type: "string" }
+			} }
+		} }
+	} }, async (request) => {
+		await requireAuthorizedOrigin(request);
+		const { runId } = request.params;
+		const record = runs.status(runId);
+		const handle = await open(store.resolveRunLogPath(record.id), constants.O_RDONLY | constants.O_NOFOLLOW);
+		try {
+			const state = {
+				offset: 0,
+				fragment: ""
+			};
+			const { lines, omitted } = await readAgentServerLogDelta(handle, state);
+			return { lines: [
+				...omitted ? ["[older log output omitted]"] : [],
+				...lines,
+				...state.fragment ? [state.fragment] : []
+			] };
+		} finally {
+			await handle.close();
+		}
+	});
 	let openStreams = 0;
 	app.get("/v1/runs/:runId/logs", { schema: AgentServerRouteSchemas.streamRunLogs }, async (request, reply) => {
-		requirePairedOrigin(request);
+		await requireAuthorizedOrigin(request);
 		const { runId } = request.params;
 		const record = runs.status(runId);
 		store.resolveRunLogPath(record.id);
@@ -11366,6 +12592,7 @@ function registerRunLogRoute(app, options, requirePairedOrigin) {
 			});
 		};
 		const push = async () => {
+			if (request.headers.origin !== "moltnet-agent-desktop://native") await requireAuthorizedOrigin(request);
 			const handle = await open(store.resolveRunLogPath(record.id), constants.O_RDONLY | constants.O_NOFOLLOW);
 			try {
 				const { lines, omitted } = await readAgentServerLogDelta(handle, readState);
@@ -11414,9 +12641,14 @@ function corsHeadersFor(request, options) {
 	return {};
 }
 function isConfiguredOrigin(origin, options) {
-	return typeof origin === "string" && (options.allowedOrigins.includes(origin) || origin === options.selfOrigin);
+	return typeof origin === "string" && (origin === "moltnet-agent-desktop://native" || options.allowedOrigins.includes(origin) || origin === options.selfOrigin);
 }
 function normalizeAgentServerError(error) {
+	if (error instanceof TeamCredentialError) return {
+		statusCode: 400,
+		code: error.blocker.code,
+		message: error.blocker.message
+	};
 	if (error instanceof AgentServerHttpError) return {
 		statusCode: error.statusCode,
 		code: error.code,
@@ -11427,8 +12659,8 @@ function normalizeAgentServerError(error) {
 		code: error.kind,
 		message: error.message
 	};
-	if (error instanceof AgentServerPairingError) return {
-		statusCode: error.code === "pairing_not_found" ? 404 : error.code === "pairing_token_invalid" || error.code === "pairing_not_approved" ? 401 : 403,
+	if (error instanceof NativeGrantError) return {
+		statusCode: 401,
 		code: error.code,
 		message: error.message
 	};
@@ -11469,185 +12701,42 @@ function normalizeAgentServerError(error) {
 	};
 }
 //#endregion
-//#region src/lib/agent-server/tls.ts
-var execFileAsync = promisify(execFile);
-var CA_COMMON_NAME = "MoltNet Local Agent CA";
-var LEAF_COMMON_NAME = "MoltNet Local Agent";
-var RENEW_BEFORE_MS = 720 * 60 * 60 * 1e3;
-function loginKeychainPath() {
-	return join(homedir(), "Library", "Keychains", "login.keychain-db");
-}
-function pemPrivateKey(key) {
-	return webcrypto.subtle.exportKey("pkcs8", key).then((der) => createPrivateKey({
-		key: Buffer.from(der),
-		format: "der",
-		type: "pkcs8"
-	}).export({
-		format: "pem",
-		type: "pkcs8"
-	}).toString());
-}
-async function importCaKeyPair(pem) {
-	const privateKey = createPrivateKey(pem);
-	const privateDer = privateKey.export({
-		format: "der",
-		type: "pkcs8"
-	});
-	const publicDer = createPublicKey(privateKey).export({
-		format: "der",
-		type: "spki"
-	});
-	const [privateCryptoKey, publicCryptoKey] = await Promise.all([webcrypto.subtle.importKey("pkcs8", privateDer, {
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, false, ["sign"]), webcrypto.subtle.importKey("spki", publicDer, {
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, false, ["verify"])]);
-	return {
-		privateKey: privateCryptoKey,
-		publicKey: publicCryptoKey
-	};
-}
-async function localTlsMaterialFromDirectory(dir) {
-	try {
-		const [key, cert, ca] = await Promise.all([
-			readFile(join(dir, "loopback-key.pem"), "utf8"),
-			readFile(join(dir, "loopback-cert.pem"), "utf8"),
-			readFile(join(dir, "local-ca.pem"), "utf8")
-		]);
-		const parsed = new X509Certificate(cert);
-		if (Date.parse(parsed.validTo) - Date.now() > RENEW_BEFORE_MS) return {
-			key,
-			cert,
-			ca,
-			fingerprint: new X509Certificate(ca).fingerprint256
-		};
-	} catch {}
-	return null;
-}
-/** Creates a per-user CA and loopback-only leaf certificate under a 0700 directory. */
-async function ensureLocalTlsMaterial(root) {
-	const dir = join(root, "tls");
-	await mkdir(dir, {
-		recursive: true,
-		mode: 448
-	});
-	const existing = await localTlsMaterialFromDirectory(dir);
-	if (existing) return existing;
-	let ca;
-	let caKeys;
-	let caKey;
-	try {
-		ca = await readFile(join(dir, "local-ca.pem"), "utf8");
-		caKeys = await importCaKeyPair(await readFile(join(dir, "local-ca-key.pem"), "utf8"));
-	} catch {
-		caKeys = await webcrypto.subtle.generateKey({
-			name: "ECDSA",
-			namedCurve: "P-256"
-		}, true, ["sign", "verify"]);
-		ca = (await X509CertificateGenerator.createSelfSigned({
-			name: `CN=${CA_COMMON_NAME}`,
-			keys: caKeys,
-			notAfter: new Date(Date.now() + 10 * 365 * 24 * 60 * 60 * 1e3),
-			extensions: [new BasicConstraintsExtension(true, void 0, true), new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true)]
-		})).toString("pem");
-		caKey = await pemPrivateKey(caKeys.privateKey);
-	}
-	const leafKeys = await webcrypto.subtle.generateKey({
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, true, ["sign", "verify"]);
-	const leafCert = await X509CertificateGenerator.create({
-		subject: `CN=${LEAF_COMMON_NAME}`,
-		issuer: `CN=${CA_COMMON_NAME}`,
-		publicKey: leafKeys.publicKey,
-		signingKey: caKeys.privateKey,
-		notAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1e3),
-		extensions: [
-			new BasicConstraintsExtension(false, void 0, true),
-			new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
-			new ExtendedKeyUsageExtension([ExtendedKeyUsage.serverAuth]),
-			new SubjectAlternativeNameExtension([{
-				type: IP,
-				value: "127.0.0.1"
-			}], true)
-		]
-	});
-	const key = await pemPrivateKey(leafKeys.privateKey);
-	const cert = leafCert.toString("pem");
-	const writes = [writeFile(join(dir, "loopback-key.pem"), key, { mode: 384 }), writeFile(join(dir, "loopback-cert.pem"), cert, { mode: 384 })];
-	if (caKey) writes.push(writeFile(join(dir, "local-ca.pem"), ca, { mode: 384 }), writeFile(join(dir, "local-ca-key.pem"), caKey, { mode: 384 }));
-	await Promise.all(writes);
-	return {
-		key,
-		cert,
-		ca,
-		fingerprint: new X509Certificate(ca).fingerprint256
-	};
-}
-async function trustLocalCa(root) {
-	const caPath = join(root, "tls", "local-ca.pem");
-	await execFileAsync("security", [
-		"add-trusted-cert",
-		"-d",
-		"-r",
-		"trustRoot",
-		"-k",
-		loginKeychainPath(),
-		caPath
-	]);
-}
-async function isLocalCaTrusted(root) {
-	const ca = await readFile(join(root, "tls", "local-ca.pem"), "utf8");
-	try {
-		const { stdout } = await execFileAsync("security", [
-			"find-certificate",
-			"-a",
-			"-p",
-			"-c",
-			CA_COMMON_NAME,
-			loginKeychainPath()
-		]);
-		return stdout.includes(ca.trim());
-	} catch {
-		return false;
-	}
-}
-async function removeLocalCa(root) {
-	await execFileAsync("security", [
-		"delete-certificate",
-		"-Z",
-		new X509Certificate(await readFile(join(root, "tls", "local-ca.pem"), "utf8")).fingerprint256.replaceAll(":", ""),
-		loginKeychainPath()
-	]);
-}
-function isMacos() {
-	return process.platform === "darwin";
-}
-//#endregion
 //#region src/cli/server.ts
 /**
 * `moltnet-agent server` — per-user loopback supervisor (#2061).
 *
-* Starts nothing on its own: it binds 127.0.0.1 and waits for a paired
-* Console origin to configure agents/providers and start/stop runs.
+* Starts nothing on its own: it binds 127.0.0.1 or a private native socket and
+* waits for an authorized controller to configure agents/providers and
+* start or stop runs.
 */
-var DEFAULT_PORT = 17374;
+var DEFAULT_PORT = OPERATOR_OAUTH.serverPort;
 var DEFAULT_ALLOWED_ORIGINS = "https://console.themolt.net";
-var DEFAULT_API_URL = "https://api.themolt.net";
 var SHUTDOWN_TIMEOUT_MS = 15e3;
+var LOCK_HELD_EXIT_CODE = 75;
+function agentServerLockExitCode(error) {
+	return error.code === "held" ? LOCK_HELD_EXIT_CODE : 1;
+}
+function validateNativeSocketOptions(options) {
+	if (!options.nativeSocket) return void 0;
+	if (!options.supervised) return "--native-socket requires --supervised";
+	if (options.port || options.allowedOrigins) return "--native-socket cannot be combined with TCP options";
+}
+function nativeSocketValidationOptions(input) {
+	return {
+		...input.nativeSocket ? { nativeSocket: input.nativeSocket } : {},
+		...input.supervised ? { supervised: true } : {},
+		...input.cliPort ? { port: input.cliPort } : {},
+		...input.cliAllowedOrigins ? { allowedOrigins: input.cliAllowedOrigins } : {}
+	};
+}
 async function runAgentServer(argv) {
 	if (isHelpFlag(argv)) {
 		console.log(AGENT_SERVER_HELP);
 		return 0;
 	}
-	const trustRequested = argv[0] === "trust";
-	const commandArgs = trustRequested ? argv.slice(1) : argv;
 	const envConfig = loadAgentServerEnvConfig();
-	if (trustRequested) return runTrustCommand(commandArgs, resolveAgentServerRoot({ root: envConfig.root }));
 	const { values } = parseArgs({
-		args: commandArgs,
+		args: argv,
 		options: {
 			port: { type: "string" },
 			"allowed-origins": { type: "string" },
@@ -11655,17 +12744,36 @@ async function runAgentServer(argv) {
 			"api-url": { type: "string" },
 			"heartbeat-interval-ms": { type: "string" },
 			"warm-retention-sec": { type: "string" },
-			supervised: { type: "boolean" }
+			supervised: { type: "boolean" },
+			"native-socket": { type: "string" }
 		}
 	});
+	const nativeSocket = values["native-socket"];
+	const nativeSocketError = validateNativeSocketOptions(nativeSocketValidationOptions({
+		...nativeSocket ? { nativeSocket } : {},
+		...values.supervised ? { supervised: true } : {},
+		...values.port ? { cliPort: values.port } : {},
+		...values["allowed-origins"] ? { cliAllowedOrigins: values["allowed-origins"] } : {},
+		...envConfig.port ? { envPort: envConfig.port } : {},
+		...envConfig.allowedOrigins ? { envAllowedOrigins: envConfig.allowedOrigins } : {}
+	}));
+	if (nativeSocketError) {
+		console.error(nativeSocketError);
+		return 1;
+	}
 	const port = Number.parseInt(values.port ?? (envConfig.port || `${DEFAULT_PORT}`), 10);
 	if (!Number.isInteger(port) || port < 1 || port > 65535) {
 		console.error(`Invalid --port: ${String(values.port)}`);
 		return 1;
 	}
 	const allowedOrigins = parseAllowedOrigins(values["allowed-origins"] ?? (envConfig.allowedOrigins || DEFAULT_ALLOWED_ORIGINS));
-	const root = values.root ?? resolveAgentServerRoot({ root: envConfig.root });
-	const defaultApiUrl = values["api-url"] ?? (envConfig.apiUrl || DEFAULT_API_URL);
+	const connectionSettings = new ConnectionSettingsStore(values.root ?? resolveAgentServerRoot({ root: envConfig.root }), {
+		...envConfig.operatorOAuth,
+		...values["api-url"] || envConfig.apiUrl ? { apiUrl: values["api-url"] || envConfig.apiUrl } : {}
+	});
+	const connection = connectionSettings.view().effective;
+	const root = connectionSettings.stateRoot(connection);
+	const defaultApiUrl = connection.apiUrl;
 	const runtimeSettings = parseLocalOperationalSettings(values);
 	const store = new AgentServerStore(root).ensure();
 	const { logger, shutdown: shutdownLogger } = createRootLogger({
@@ -11681,7 +12789,15 @@ async function runAgentServer(argv) {
 				});
 				const secretProviders = createNodeSecretProviderRegistry().register(secrets);
 				const externalSecretProviders = createNodeSecretProviderRegistry();
-				const pairing = new PairingService();
+				const nativeGrant = new NativeGrantService();
+				const nativeClient = applyNativeClientGrant({
+					nativeGrant,
+					env: processEnvSnapshot()
+				});
+				if (Boolean(values.supervised) && !nativeClient) {
+					console.error(`A supervised Agent Server requires ${NATIVE_TOKEN_ENV}. Start it from MoltNet Agent, or omit --supervised for an authorized standalone controller.`);
+					return 1;
+				}
 				const shutdownController = new AbortController();
 				const subscriptions = await ProviderLoginService.create({
 					authPath: store.piAuthJsonPath,
@@ -11693,31 +12809,42 @@ async function runAgentServer(argv) {
 					secretProviders,
 					logger
 				});
+				const runtimeRegistry = new RuntimeRegistry(store.root);
 				const runs = new RunManager({
 					store,
 					secretProviders,
 					externalSecretProviders,
 					baseEnv: processEnvSnapshot(),
 					logger,
-					runtimeRegistry: new RuntimeRegistry(store.root),
+					runtimeRegistry,
 					runtimeSettings
 				});
-				const tls = isMacos() ? await ensureTrustedLocalTls(root) : void 0;
+				if (nativeSocket) await validateNativeSocket(nativeSocket);
+				const selfOrigin = nativeSocket ? void 0 : `http://127.0.0.1:${port}`;
 				const app = buildAgentServer({
+					operatorOAuth: new OperatorOAuth({
+						issuer: connection.issuer,
+						authorizationUrl: new URL("/oauth2/auth", connection.publicUrl).href,
+						tokenUrl: new URL("/oauth2/token", connection.publicUrl).href,
+						jwksUrl: new URL("/.well-known/jwks.json", connection.publicUrl).href,
+						nativeClientId: connection.nativeClientId,
+						consoleClientId: connection.consoleClientId,
+						callbackPort: OPERATOR_OAUTH.callbackPort
+					}, root),
+					nativeOnly: Boolean(nativeSocket),
+					connectionSettings,
+					operatorApiUrl: connection.apiUrl,
 					store,
 					secrets,
 					secretProviders,
 					externalSecretProviders,
-					pairing,
+					nativeGrant,
 					runs,
 					subscriptions,
 					providers,
-					allowedOrigins,
-					selfOrigin: `${tls ? "https" : "http"}://127.0.0.1:${port}`,
-					...tls ? { tls: {
-						key: tls.key,
-						cert: tls.cert
-					} } : {},
+					runtimeRegistry,
+					allowedOrigins: nativeSocket ? [] : allowedOrigins,
+					...selfOrigin ? { selfOrigin } : {},
 					defaultApiUrl,
 					runtimeSettings,
 					...envConfig.activeIdentity ? { activeIdentity: envConfig.activeIdentity } : {},
@@ -11726,14 +12853,17 @@ async function runAgentServer(argv) {
 					shutdownSignal: shutdownController.signal
 				});
 				try {
-					const address = await app.listen({
+					const address = await app.listen(nativeSocket ? { path: nativeSocket } : {
 						host: "127.0.0.1",
 						port
 					});
+					if (nativeSocket) await chmod(nativeSocket, 384);
 					console.error(`moltnet-agent server listening on ${address}`);
 					console.error(`config root: ${root}`);
-					console.error(`allowed origins: ${allowedOrigins.join(", ")}`);
-					console.error("Pair from the Console \"Local runtime\" page; approve the one-click prompt this server opens.");
+					if (nativeSocket) console.error(`native control socket: ${nativeSocket}`);
+					else console.error(`allowed origins: ${allowedOrigins.join(", ")}`);
+					if (nativeClient) console.error("native desktop client: authorized");
+					if (!nativeSocket) console.error("Connect from an allowed local-control client after operator authorization.");
 					return await waitForAgentServerShutdown(runs, app, shutdownController, Boolean(values.supervised));
 				} catch (cause) {
 					await app.close().catch(() => void 0);
@@ -11747,7 +12877,7 @@ async function runAgentServer(argv) {
 		} catch (cause) {
 			if (cause instanceof AgentServerLockError) {
 				console.error(cause.message);
-				return 1;
+				return agentServerLockExitCode(cause);
 			}
 			throw cause;
 		}
@@ -11755,98 +12885,6 @@ async function runAgentServer(argv) {
 		await shutdownLogger();
 	}
 }
-async function runTrustCommand(argv, defaultRoot) {
-	try {
-		const { values } = parseArgs({
-			args: argv,
-			options: {
-				root: { type: "string" },
-				remove: { type: "boolean" },
-				status: { type: "boolean" },
-				yes: { type: "boolean" },
-				json: { type: "boolean" }
-			}
-		});
-		const root = values.root ?? defaultRoot;
-		const statusRequested = Boolean(values.status);
-		const removeRequested = Boolean(values.remove);
-		const yes = Boolean(values.yes);
-		const json = Boolean(values.json);
-		if (statusRequested && (removeRequested || yes)) {
-			console.error("Usage: moltnet-agent server trust --status [--json]");
-			return 1;
-		}
-		if (!isMacos()) {
-			if (json) {
-				printTrustStatus({
-					supported: false,
-					trusted: false,
-					fingerprint: null
-				});
-				return 0;
-			}
-			console.error("Local HTTPS trust setup is currently supported on macOS only.");
-			return 1;
-		}
-		const material = await ensureLocalTlsMaterial(root);
-		if (statusRequested) {
-			const trusted = await isLocalCaTrusted(root);
-			if (json) printTrustStatus({
-				supported: true,
-				trusted,
-				fingerprint: material.fingerprint
-			});
-			else console.log(trusted ? `MoltNet local CA ${material.fingerprint} is trusted.` : `MoltNet local CA ${material.fingerprint} is not trusted.`);
-			return 0;
-		}
-		if (json && !yes) {
-			console.error("Machine-readable trust changes require --yes after native app consent.");
-			return 1;
-		}
-		if (removeRequested) {
-			await removeLocalCa(root);
-			if (json) printTrustStatus({
-				supported: true,
-				trusted: false,
-				fingerprint: material.fingerprint
-			});
-			else console.log("Removed the MoltNet local CA from your login keychain.");
-			return 0;
-		}
-		if (yes) await trustLocalCa(root);
-		else await ensureTrustedLocalTls(root);
-		if (json) printTrustStatus({
-			supported: true,
-			trusted: await isLocalCaTrusted(root),
-			fingerprint: material.fingerprint
-		});
-		else console.log("MoltNet local HTTPS trust is ready for this macOS user.");
-		return 0;
-	} catch (cause) {
-		console.error(`Agent Server trust command failed: ${cause instanceof Error ? cause.message : String(cause)}`);
-		return 1;
-	}
-}
-function printTrustStatus(status) {
-	console.log(JSON.stringify(status));
-}
-async function ensureTrustedLocalTls(root) {
-	const material = await ensureLocalTlsMaterial(root);
-	if (await isLocalCaTrusted(root)) return material;
-	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Local HTTPS trust is not configured. Run `moltnet-agent server trust` from an interactive terminal.");
-	const prompt = createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const answer = await prompt.question(`Trust MoltNet's local CA (${material.fingerprint}) in this macOS login keychain? [y/N] `);
-		if (!/^y(es)?$/i.test(answer.trim())) throw new Error("Local HTTPS trust was not approved.");
-	} finally {
-		prompt.close();
-	}
-	await trustLocalCa(root);
-	return material;
-}
 function waitForAgentServerShutdown(runs, app, shutdownController, supervised) {
 	return new Promise((resolvePromise) => {
 		let shuttingDown = false;
@@ -12021,6 +13059,7 @@ async function runSyncSessions(argv) {
 		args: argv,
 		options: {
 			...identityOptionDefs(),
+			...projectRunOptionDefs(),
 			team: { type: "string" },
 			"runtime-profile-id": { type: "string" },
 			state: { type: "string" },
@@ -12028,11 +13067,6 @@ async function runSyncSessions(argv) {
 			"dry-run": { type: "boolean" }
 		}
 	});
-	if (!values.team) {
-		console.error("Missing required flag: --team\n");
-		console.error(SYNC_SESSIONS_HELP);
-		return 1;
-	}
 	let identity;
 	try {
 		identity = parseIdentityProcessOptions(values);
@@ -12049,18 +13083,38 @@ async function runSyncSessions(argv) {
 	const agentRootDir = resolve(process.cwd(), values["agent-root"] ?? process.cwd());
 	const explicitAgentRootDir = values["agent-root"] ? resolve(process.cwd(), values["agent-root"]) : void 0;
 	const cfg = loadConfig();
+	let selection;
+	try {
+		const apiUrl = await resolveSelectionApiUrl(identity.agent, {
+			agentRootDir: explicitAgentRootDir,
+			credentialSource: cfg.credentialSource,
+			envApiUrl: cfg.apiUrl
+		});
+		selection = await resolveRunProjectSelection({
+			...values,
+			agent: identity.agent,
+			cwd: process.cwd(),
+			apiUrl
+		});
+		if (!selection.teamId) throw new Error("Select --team or a binding with a team");
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : String(error));
+		console.error(SYNC_SESSIONS_HELP);
+		return 1;
+	}
 	const ctx = await resolveAgentContext(identity.agent, {
 		credentialSource: cfg.credentialSource,
 		envApiUrl: cfg.apiUrl,
-		teamId: values.team,
+		projectApiUrl: selection.binding?.apiUrl,
+		teamId: selection.teamId,
 		agentRootDir: explicitAgentRootDir
 	});
 	await validateStartupBinding({
 		agent: ctx.agent,
-		teamId: values.team,
+		teamId: selection.teamId,
 		credentialTeamId: ctx.credentialTeamId
 	});
-	const stateDirs = ensureDaemonStateDirs(agentRootDir);
+	const stateDirs = ensureDaemonStateDirs(selection.stateRootDir ?? (selection.binding || values.source ? selection.source ?? agentRootDir : agentRootDir));
 	const result = await syncRuntimeSessions({
 		runtimeSessionStore: createApiRuntimeSessionStore({ agent: ctx.agent }),
 		runtimeSlotStore: createApiRuntimeSlotStore({ agent: ctx.agent }),
@@ -12072,7 +13126,7 @@ async function runSyncSessions(argv) {
 		runtimeProfileId: values["runtime-profile-id"],
 		sessionRootDir: stateDirs.piSessionsDir,
 		state,
-		teamId: values.team
+		teamId: selection.teamId
 	});
 	console.log(JSON.stringify(result, null, 2));
 	return result.failedUpload > 0 || result.unsafeSessionPath > 0 ? 1 : 0;
@@ -12243,7 +13297,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.60.0";
+var DAEMON_VERSION = "0.62.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {