@themoltnet/agent-daemon 0.61.0 → 0.62.0

package/README.md

@@ -15,17 +15,18 @@ from [themolt.net/download](https://themolt.net/download). Opening the app:
 
 1. installs or updates the publisher-verified Agent CLI bundle under
    `~/.local/share/moltnet/agent`;
-2. asks before adding the per-user local HTTPS CA to the login Keychain;
-3. starts a foreground, supervised Agent Server; and
-4. opens Console for OAuth PKCE approval and runtime management.
+2. starts a foreground, supervised Agent Server over a private native socket;
+   and
+3. opens the browser only when OAuth approval is required.
 
 Closing the status window hides it. **Quit and Stop Server** stops the owned
-server process before the app exits. After the server restarts, reconnect Console through OAuth PKCE. The local
-operator, identities, and provider configuration persist.
+server process before the app exits. Desktop re-establishes its private native
+control channel after a server restart. The local operator, identities, and
+provider configuration persist.
 
 Agent CLI updates and desktop-app updates use independent signed channels and
 always require consent. Removing the Agent CLI bundle preserves
-`~/.config/moltnet`. Removing the local CA is a separate opt-in action.
+`~/.config/moltnet`.
 
 ### Agent CLI
 
@@ -123,8 +124,8 @@ For config-based runs, the agent's `moltnet.json` lives in the central store
 (`~/.config/moltnet/identities/<agent>/`) or, for an external config, next to
 its gitconfig in `.moltnet/<agent>/`. Three paths create it:
 
-- The Console's Local Runtime page creates a managed agent through the Agent
-  Server: keypair and agent key generated on this machine, stored under the
+- MoltNet Agent creates a managed agent through the Agent Server: keypair and
+  agent key generated on this machine, stored under the
   store's `secrets/` directory, no CLI involved.
 - [`moltnet register`](../../docs/start/install-and-initialize.md#register-an-agent)
   creates an OAuth2 identity from the CLI; add a stored agent key with
@@ -209,7 +210,7 @@ carries them -- read access to the agent's teams and their diaries, and
 enrollment into a team. Startup does not check for them: a key without them
 claims and runs work, and the daemon reports which are absent.
 
-The Console selects the full set by default. Knowledge-enabled workers must add
+Desktop selects the full set by default. Knowledge-enabled workers must add
 `diary:write`, `pack:read`, and `pack:write` when the key is issued.
 
 `crypto:sign` is in the minimum because host-capability signing runs on the

package/dist/cli.js

@@ -16,7 +16,7 @@ import { constants, copyFileSync, createReadStream, createWriteStream, existsSyn
 import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, hasAgentKeyConfiguration, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, selectAgentKeyReference, signBytes } from "@themoltnet/sdk";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, RuntimeProfilePrerequisiteError, createLocalSeedSigner, resolveAgentIdentity, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
-import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { once } from "node:events";
 import { metrics } from "@opentelemetry/api";
 import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-proto";
@@ -28,7 +28,7 @@ import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
 import { homedir, platform, tmpdir } from "node:os";
 import { PI_MODEL_MODALITIES, writePiConfig } from "@themoltnet/pi-runtime/pi-config";
-import { mkdir, open, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, open, readFile, readdir, realpath, stat, writeFile } from "node:fs/promises";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { pipeline } from "node:stream/promises";
 import { createInterface } from "node:readline/promises";
@@ -45,8 +45,6 @@ import { pathToFileURL } from "node:url";
 import { StringDecoder } from "node:string_decoder";
 import rateLimit from "@fastify/rate-limit";
 import Fastify from "fastify";
-import "reflect-metadata";
-import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, IP, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, X509CertificateGenerator } from "@peculiar/x509";
 import { createGzip } from "node:zlib";
 //#region ../../libs/tasks/src/rubric.ts
 /**
@@ -3851,13 +3849,13 @@ function loadUpdateEnvConfig() {
 }
 //#endregion
 //#region src/lib/run-project-selection.ts
-var execFileAsync$2 = promisify(execFile);
+var execFileAsync$1 = promisify(execFile);
 var GIT_TIMEOUT_MS = 1e4;
 var GIT_MAX_OUTPUT_BYTES = 64 * 1024;
 async function validateGitSource(source) {
 	const inherited = processEnvSnapshot();
 	try {
-		const { stdout } = await execFileAsync$2("git", [
+		const { stdout } = await execFileAsync$1("git", [
 			"rev-parse",
 			"--show-toplevel",
 			"--verify",
@@ -4015,11 +4013,9 @@ Commands:
   once      Claim and execute one specific queued task by id, then exit.
   drain     Poll until the queue has nothing claimable, then exit.
             Useful for batch eval runs and demos.
-  server    Loopback supervisor for console-managed runs: OAuth local control,
-            agent/provider config store, and start/stop of poll/drain
-            child processes. Binds 127.0.0.1 only.
-  server trust
-            Install the per-user macOS local-HTTPS CA after explicit consent.
+  server    Supervisor for managed runs: authorized standalone local control,
+            agent/provider config store, and start/stop of poll/drain child
+            processes. Binds 127.0.0.1 or a private native socket.
   providers Manage configured endpoints and Pi OAuth subscriptions without
             starting the Agent Server. See \`agent-daemon providers --help\`.
   sync-sessions
@@ -4169,16 +4165,17 @@ function isHelpFlag(args) {
 	return args.includes("--help") || args.includes("-h");
 }
 var AGENT_SERVER_HELP = `\
-agent-daemon server — loopback supervisor for console-managed runs.
+agent-daemon server — local supervisor for managed runs.
 
-Binds 127.0.0.1 only. An authorized Console origin configures agents and
-providers (secret references only) and starts/stops poll/drain runs as
-child processes of this supervisor.
+Standalone mode binds 127.0.0.1 for authorized local-control clients. MoltNet
+Agent Desktop instead uses a private Unix socket with a process-scoped grant.
+Both modes configure agents and providers and start/stop child runs.
 
 Options:
   --port <n>                  Loopback port. Default: 17374.
                               Env: MOLTNET_AGENT_SERVER_PORT.
-  --allowed-origins <csv>     Exact Console origins allowed local control.
+  --allowed-origins <csv>     Exact browser-controller origins allowed
+                              local control.
                               Default: https://console.themolt.net.
                               Env: MOLTNET_AGENT_SERVER_ALLOWED_ORIGINS.
   --root <path>               Config root. Default: ~/.config/moltnet
@@ -4188,14 +4185,13 @@ Options:
   --heartbeat-interval-ms <n> Child reporter heartbeat cadence. Default: 60000.
   --warm-retention-sec <n>    Child session/workspace retention. Default: 1800.
   --supervised                Also stop gracefully when stdin reaches EOF.
+  --native-socket <path>      Private native-only socket (requires --supervised).
+                              Absolute, at most 100 bytes, with a new socket in
+                              a caller-owned 0700 directory. TCP flags are not
+                              accepted; inherited TCP env settings are ignored.
 
-On macOS, the first interactive run asks to trust a per-user local CA in the
-login keychain and serves HTTPS. Native supervisors use:
-  server trust --status --json
-  server trust --yes --json
-  server trust --remove --yes --json
-Run \`agent-daemon server trust --remove\` interactively to remove that exact
-CA. Linux continues to use the Chromium PNA HTTP path.
+Standalone mode uses loopback HTTP on every platform. Desktop socket mode does
+not open a TCP listener.
 `;
 var PROVIDERS_HELP = `\
 moltnet-agent providers — manage local model providers.
@@ -4258,7 +4254,7 @@ async function resolveDaemonAgentIdentity(input) {
 }
 //#endregion
 //#region src/lib/correlation.ts
-var execFileAsync$1 = promisify(execFile);
+var execFileAsync = promisify(execFile);
 var CORRELATION_TRAILER_KEY = "Moltnet-Correlation-Id";
 var CORRELATION_MARKER_RE = /<!--\s*moltnet-correlation:\s*([\w-]+)\s*-->/i;
 new RegExp(`^${CORRELATION_TRAILER_KEY}:\\s*(\\S+)\\s*$`, "m");
@@ -4305,7 +4301,7 @@ function makePrBodyAnchorWriter(deps) {
 function createGhCliClient() {
 	return {
 		async get({ owner, repo, number }) {
-			const { stdout } = await execFileAsync$1("gh", [
+			const { stdout } = await execFileAsync("gh", [
 				"api",
 				`repos/${owner}/${repo}/pulls/${number}`,
 				"--jq",
@@ -4314,7 +4310,7 @@ function createGhCliClient() {
 			return JSON.parse(stdout);
 		},
 		async patch({ owner, repo, number }, body) {
-			await execFileAsync$1("gh", [
+			await execFileAsync("gh", [
 				"api",
 				"-X",
 				"PATCH",
@@ -9469,6 +9465,29 @@ var NativeGrantService = class {
 	}
 };
 //#endregion
+//#region src/lib/agent-server/native-socket.ts
+/** The supervisor owns the private directory; the server never removes peers. */
+async function validateNativeSocket(path) {
+	if (!isAbsolute(path) || Buffer.byteLength(path) > 100) throw new Error("Native socket must be an absolute path of at most 100 bytes");
+	const parent = dirname(path);
+	const metadata = await lstat(parent);
+	if (metadata.isSymbolicLink()) throw new Error(`Native socket parent contains a symlink: ${parent}`);
+	if (!metadata.isDirectory()) throw new Error(`Native socket parent is not a directory: ${parent}`);
+	const expectedUid = process.getuid?.();
+	if (expectedUid === void 0 || metadata.uid !== expectedUid) throw new Error(`Native socket parent has uid ${metadata.uid}; expected ${String(expectedUid)}: ${parent}`);
+	const mode = metadata.mode & 511;
+	if (mode !== 448) throw new Error(`Native socket parent has mode ${mode.toString(8)}; expected 700: ${parent}`);
+	const canonical = await realpath(parent);
+	if (canonical !== resolve(parent)) throw new Error(`Native socket parent contains a symlink: ${parent} resolves to ${canonical}`);
+	try {
+		await lstat(path);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	throw new Error("Native socket path already exists; it was left untouched");
+}
+//#endregion
 //#region src/lib/agent-server/operator-oauth.ts
 var InvalidOperatorGrantError = class extends Error {};
 var LOCAL_SCOPE = OPERATOR_OAUTH.localControlScope;
@@ -9671,8 +9690,8 @@ var OperatorOAuth = class {
 /**
 * Subscription-provider OAuth brokering for Agent Server (#2061 slice 4).
 *
-* The console clicks "Connect"; agent server runs the Pi OAuth flow host-side via
-* `ModelRuntime.login()` (which owns persistence into the shared
+* An authorized controller starts the flow; Agent Server runs Pi OAuth
+* host-side via `ModelRuntime.login()` (which owns persistence into the shared
 * `pi/auth.json` and token rotation thereafter). The browser only ever sees
 * the provider's authorize URL or device code — never tokens.
 *
@@ -11406,17 +11425,17 @@ async function enrollIdentityTeam(options) {
 /**
 * The identity-wide team/diary binding, read from `<identityDir>/env`.
 *
-* This mirrors the Go CLI's `identityDefaultBinding` (`context_store.go:219`),
+* This mirrors the Go CLI's `identityDefaultBinding` (`project_selection.go`),
 * which is the fallback the CLI uses when a working directory has no
-* location-keyed binding in `contexts.json`.
+* registered project binding.
 *
 * The desktop cannot use the CLI's *location* bindings at all — its composer
 * has no working directory to key on — but it can honour this identity-wide
-* default, so an operator who ran `moltnet context set` sees their familiar
-* team preselected rather than an arbitrary first entry.
+* default, so an operator sees their familiar team preselected rather than an
+* arbitrary first entry.
 *
 * Like the CLI, a half-filled pair is treated as no binding: a team without a
-* diary is exactly the state `validateContextBinding` rejects.
+* diary is ignored.
 */
 function readIdentityDefaultBinding(identityDir) {
 	let contents;
@@ -11982,10 +12001,7 @@ function buildAgentServer(options) {
 	const { nativeGrant } = options;
 	const oauth = options.operatorOAuth;
 	let restartRequired = false;
-	const fastifyOptions = {
-		bodyLimit: BODY_LIMIT,
-		...options.tls ? { https: options.tls } : {}
-	};
+	const fastifyOptions = { bodyLimit: BODY_LIMIT };
 	const app = options.logger ? Fastify({
 		...fastifyOptions,
 		loggerInstance: options.logger
@@ -12021,6 +12037,31 @@ function buildAgentServer(options) {
 		browserVerification.set(request, pending);
 		return pending;
 	}
+	function hasValidNativeGrant(origin, token) {
+		if (origin !== "moltnet-agent-desktop://native" || typeof token !== "string" || token.length === 0) return false;
+		try {
+			nativeGrant.verify(origin, token);
+			return true;
+		} catch (error) {
+			if (error instanceof NativeGrantError) return false;
+			throw error;
+		}
+	}
+	const nativeVerification = /* @__PURE__ */ new WeakSet();
+	function requireNativeGrant(request) {
+		if (nativeVerification.has(request)) return;
+		const origin = request.headers.origin;
+		const token = request.headers[AGENT_SERVER_TOKEN_HEADER];
+		if (hasValidNativeGrant(origin, token)) {
+			nativeVerification.add(request);
+			return;
+		}
+		request.log.warn({
+			stage: "native-control-authorization",
+			outcome: "rejected"
+		}, "Native control authorization failed");
+		throw new AgentServerHttpError(401, "native_token_invalid", "Native authorization required");
+	}
 	app.register(rateLimit, {
 		global: true,
 		max: options.rateLimitMax ?? RATE_LIMIT_MAX,
@@ -12032,15 +12073,15 @@ function buildAgentServer(options) {
 			const presented = request.headers[AGENT_SERVER_TOKEN_HEADER];
 			let authenticated = false;
 			if (typeof presented === "string" && presented.length > 0) try {
-				if (origin === "moltnet-agent-desktop://native") nativeGrant.verify(origin, presented);
+				if (origin === "moltnet-agent-desktop://native") authenticated = hasValidNativeGrant(origin, presented);
 				else {
 					if (!oauth) return `unauth:${origin}:${request.ip}`;
 					await verifyBrowser(request, presented);
+					authenticated = true;
 				}
-				authenticated = true;
 			} catch (error) {
 				if (error instanceof AgentServerHttpError && error.statusCode === 429) throw error;
-				if (origin === "moltnet-agent-desktop://native" && !(error instanceof NativeGrantError)) throw error;
+				if (origin === "moltnet-agent-desktop://native") throw error;
 			}
 			return authenticated ? `origin:${origin}` : `unauth:${origin}:${request.ip}`;
 		}
@@ -12050,7 +12091,7 @@ function buildAgentServer(options) {
 		const origin = requireOriginHeader(request.headers);
 		const token = request.headers[AGENT_SERVER_TOKEN_HEADER];
 		if (typeof token !== "string" || token.length === 0) throw new AgentServerHttpError(401, "authorization_required", "Local control token is required");
-		if (origin === "moltnet-agent-desktop://native") nativeGrant.verify(origin, token);
+		if (origin === "moltnet-agent-desktop://native") requireNativeGrant(request);
 		else try {
 			if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
 			const admission = browserVerification.get(request);
@@ -12079,6 +12120,9 @@ function buildAgentServer(options) {
 		return origin;
 	};
 	app.after(() => {
+		if (options.nativeOnly) app.addHook("preParsing", async (request) => {
+			requireNativeGrant(request);
+		});
 		app.get("/health", { schema: AgentServerRouteSchemas.health }, async () => ({ status: "ok" }));
 		app.get("/v1/native/connection-settings", { schema: { hide: true } }, async (request) => {
 			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !options.connectionSettings) throw new AgentServerHttpError(403, "native_required", "Native administration required");
@@ -12657,196 +12701,42 @@ function normalizeAgentServerError(error) {
 	};
 }
 //#endregion
-//#region src/lib/agent-server/tls.ts
-var execFileAsync = promisify(execFile);
-var CA_COMMON_NAME = "MoltNet Local Agent CA";
-var LEAF_COMMON_NAME = "MoltNet Local Agent";
-var RENEW_BEFORE_MS = 720 * 60 * 60 * 1e3;
-function loginKeychainPath() {
-	return join(homedir(), "Library", "Keychains", "login.keychain-db");
-}
-function pemPrivateKey(key) {
-	return webcrypto.subtle.exportKey("pkcs8", key).then((der) => createPrivateKey({
-		key: Buffer.from(der),
-		format: "der",
-		type: "pkcs8"
-	}).export({
-		format: "pem",
-		type: "pkcs8"
-	}).toString());
-}
-async function localTlsMaterialFromDirectory(dir) {
-	try {
-		const [key, cert, ca] = await Promise.all([
-			readFile(join(dir, "loopback-key.pem"), "utf8"),
-			readFile(join(dir, "loopback-cert.pem"), "utf8"),
-			readFile(join(dir, "local-ca.pem"), "utf8")
-		]);
-		const parsed = new X509Certificate(cert);
-		const authority = new X509Certificate(ca);
-		if (Date.parse(parsed.validTo) - Date.now() > RENEW_BEFORE_MS && Date.parse(authority.validTo) - Date.now() > RENEW_BEFORE_MS && authority.keyUsage?.includes("1.3.6.1.5.5.7.3.1") && parsed.checkIP("127.0.0.1") === "127.0.0.1" && parsed.verify(authority.publicKey) && parsed.publicKey.equals(createPublicKey(key))) return {
-			key,
-			cert,
-			ca,
-			fingerprint: new X509Certificate(ca).fingerprint256
-		};
-	} catch {}
-	return null;
-}
-/** Read-only inspection for native status polling. */
-async function inspectLocalTlsMaterial(root) {
-	if (await hasStoredSigningKey(join(root, "tls"))) return null;
-	return localTlsMaterialFromDirectory(join(root, "tls"));
-}
-async function hasStoredSigningKey(dir) {
-	return stat(join(dir, "local-ca-key.pem")).then(() => true, (error) => {
-		if (error.code === "ENOENT") return false;
-		throw error;
-	});
-}
-/** Creates a per-user CA and loopback-only leaf certificate under a 0700 directory. */
-async function ensureLocalTlsMaterial(root) {
-	const dir = join(root, "tls");
-	await mkdir(dir, {
-		recursive: true,
-		mode: 448
-	});
-	const previousSigningKey = join(dir, "local-ca-key.pem");
-	const hasPreviousSigningKey = await hasStoredSigningKey(dir);
-	const existing = await localTlsMaterialFromDirectory(dir);
-	if (existing && !hasPreviousSigningKey) return existing;
-	if (isMacos() && await isLocalCaTrusted(root)) await removeLocalCa(root);
-	const caKeys = await webcrypto.subtle.generateKey({
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, false, ["sign", "verify"]);
-	const ca = (await X509CertificateGenerator.createSelfSigned({
-		name: `CN=${CA_COMMON_NAME}`,
-		keys: caKeys,
-		notAfter: new Date(Date.now() + 366 * 24 * 60 * 60 * 1e3),
-		extensions: [
-			new BasicConstraintsExtension(true, 0, true),
-			new KeyUsagesExtension(KeyUsageFlags.keyCertSign, true),
-			new ExtendedKeyUsageExtension([ExtendedKeyUsage.serverAuth], true)
-		]
-	})).toString("pem");
-	const leafKeys = await webcrypto.subtle.generateKey({
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, true, ["sign", "verify"]);
-	const leafCert = await X509CertificateGenerator.create({
-		subject: `CN=${LEAF_COMMON_NAME}`,
-		issuer: `CN=${CA_COMMON_NAME}`,
-		publicKey: leafKeys.publicKey,
-		signingKey: caKeys.privateKey,
-		notAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1e3),
-		extensions: [
-			new BasicConstraintsExtension(false, void 0, true),
-			new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
-			new ExtendedKeyUsageExtension([ExtendedKeyUsage.serverAuth]),
-			new SubjectAlternativeNameExtension([{
-				type: IP,
-				value: "127.0.0.1"
-			}], true)
-		]
-	});
-	const key = await pemPrivateKey(leafKeys.privateKey);
-	const cert = leafCert.toString("pem");
-	const writes = [writeFile(join(dir, "loopback-key.pem"), key, { mode: 384 }), writeFile(join(dir, "loopback-cert.pem"), cert, { mode: 384 })];
-	writes.push(writeFile(join(dir, "local-ca.pem"), ca, { mode: 384 }));
-	await Promise.all(writes);
-	await rm(previousSigningKey, { force: true });
-	return {
-		key,
-		cert,
-		ca,
-		fingerprint: new X509Certificate(ca).fingerprint256
-	};
-}
-async function trustLocalCa(root) {
-	const caPath = join(root, "tls", "local-ca.pem");
-	await execFileAsync("/usr/bin/security", [
-		"add-trusted-cert",
-		"-r",
-		"trustRoot",
-		"-p",
-		"ssl",
-		"-s",
-		"127.0.0.1",
-		"-k",
-		loginKeychainPath(),
-		caPath
-	]);
-}
-async function isLocalCaTrusted(root) {
-	try {
-		const ca = await readFile(join(root, "tls", "local-ca.pem"), "utf8");
-		const { stdout } = await execFileAsync("/usr/bin/security", [
-			"find-certificate",
-			"-a",
-			"-p",
-			"-c",
-			CA_COMMON_NAME,
-			loginKeychainPath()
-		]);
-		return stdout.includes(ca.trim());
-	} catch (error) {
-		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
-		const stderr = error && typeof error === "object" && "stderr" in error ? error.stderr : void 0;
-		if (typeof stderr === "string" && stderr.trim() === "security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.") return false;
-		throw error;
-	}
-}
-async function removeLocalCa(root) {
-	const fingerprint = new X509Certificate(await readFile(join(root, "tls", "local-ca.pem"), "utf8")).fingerprint256.replaceAll(":", "");
-	const caPath = join(root, "tls", "local-ca.pem");
-	await removeTrustSettings([
-		"remove-trusted-cert",
-		"-d",
-		caPath
-	]);
-	await removeTrustSettings(["remove-trusted-cert", caPath]);
-	await execFileAsync("/usr/bin/security", [
-		"delete-certificate",
-		"-Z",
-		fingerprint,
-		loginKeychainPath()
-	]);
-}
-function isMacos() {
-	return process.platform === "darwin";
-}
-async function removeTrustSettings(args) {
-	try {
-		await execFileAsync("/usr/bin/security", args, { env: { LC_ALL: "C" } });
-	} catch (error) {
-		const stderr = error && typeof error === "object" && "stderr" in error ? error.stderr : void 0;
-		if (typeof stderr === "string" && ["SecTrustSettingsRemoveTrustSettings: No Trust Settings were found.", "SecTrustSettingsRemoveTrustSettings: The specified item could not be found in the keychain."].includes(stderr.trim())) return;
-		throw error;
-	}
-}
-//#endregion
 //#region src/cli/server.ts
 /**
 * `moltnet-agent server` — per-user loopback supervisor (#2061).
 *
-* Starts nothing on its own: it binds 127.0.0.1 and waits for an authorized
-* Console origin to configure agents/providers and start/stop runs.
+* Starts nothing on its own: it binds 127.0.0.1 or a private native socket and
+* waits for an authorized controller to configure agents/providers and
+* start or stop runs.
 */
 var DEFAULT_PORT = OPERATOR_OAUTH.serverPort;
 var DEFAULT_ALLOWED_ORIGINS = "https://console.themolt.net";
 var SHUTDOWN_TIMEOUT_MS = 15e3;
+var LOCK_HELD_EXIT_CODE = 75;
+function agentServerLockExitCode(error) {
+	return error.code === "held" ? LOCK_HELD_EXIT_CODE : 1;
+}
+function validateNativeSocketOptions(options) {
+	if (!options.nativeSocket) return void 0;
+	if (!options.supervised) return "--native-socket requires --supervised";
+	if (options.port || options.allowedOrigins) return "--native-socket cannot be combined with TCP options";
+}
+function nativeSocketValidationOptions(input) {
+	return {
+		...input.nativeSocket ? { nativeSocket: input.nativeSocket } : {},
+		...input.supervised ? { supervised: true } : {},
+		...input.cliPort ? { port: input.cliPort } : {},
+		...input.cliAllowedOrigins ? { allowedOrigins: input.cliAllowedOrigins } : {}
+	};
+}
 async function runAgentServer(argv) {
 	if (isHelpFlag(argv)) {
 		console.log(AGENT_SERVER_HELP);
 		return 0;
 	}
-	const trustRequested = argv[0] === "trust";
-	const commandArgs = trustRequested ? argv.slice(1) : argv;
 	const envConfig = loadAgentServerEnvConfig();
-	if (trustRequested) return runTrustCommand(commandArgs, resolveAgentServerRoot({ root: envConfig.root }));
 	const { values } = parseArgs({
-		args: commandArgs,
+		args: argv,
 		options: {
 			port: { type: "string" },
 			"allowed-origins": { type: "string" },
@@ -12854,17 +12744,30 @@ async function runAgentServer(argv) {
 			"api-url": { type: "string" },
 			"heartbeat-interval-ms": { type: "string" },
 			"warm-retention-sec": { type: "string" },
-			supervised: { type: "boolean" }
+			supervised: { type: "boolean" },
+			"native-socket": { type: "string" }
 		}
 	});
+	const nativeSocket = values["native-socket"];
+	const nativeSocketError = validateNativeSocketOptions(nativeSocketValidationOptions({
+		...nativeSocket ? { nativeSocket } : {},
+		...values.supervised ? { supervised: true } : {},
+		...values.port ? { cliPort: values.port } : {},
+		...values["allowed-origins"] ? { cliAllowedOrigins: values["allowed-origins"] } : {},
+		...envConfig.port ? { envPort: envConfig.port } : {},
+		...envConfig.allowedOrigins ? { envAllowedOrigins: envConfig.allowedOrigins } : {}
+	}));
+	if (nativeSocketError) {
+		console.error(nativeSocketError);
+		return 1;
+	}
 	const port = Number.parseInt(values.port ?? (envConfig.port || `${DEFAULT_PORT}`), 10);
 	if (!Number.isInteger(port) || port < 1 || port > 65535) {
 		console.error(`Invalid --port: ${String(values.port)}`);
 		return 1;
 	}
 	const allowedOrigins = parseAllowedOrigins(values["allowed-origins"] ?? (envConfig.allowedOrigins || DEFAULT_ALLOWED_ORIGINS));
-	const settingsRoot = values.root ?? resolveAgentServerRoot({ root: envConfig.root });
-	const connectionSettings = new ConnectionSettingsStore(settingsRoot, {
+	const connectionSettings = new ConnectionSettingsStore(values.root ?? resolveAgentServerRoot({ root: envConfig.root }), {
 		...envConfig.operatorOAuth,
 		...values["api-url"] || envConfig.apiUrl ? { apiUrl: values["api-url"] || envConfig.apiUrl } : {}
 	});
@@ -12892,7 +12795,7 @@ async function runAgentServer(argv) {
 					env: processEnvSnapshot()
 				});
 				if (Boolean(values.supervised) && !nativeClient) {
-					console.error(`A supervised Agent Server requires ${NATIVE_TOKEN_ENV}. Start it from MoltNet Agent, or omit --supervised to run it to reconnect Console to an operator already established by Desktop.`);
+					console.error(`A supervised Agent Server requires ${NATIVE_TOKEN_ENV}. Start it from MoltNet Agent, or omit --supervised for an authorized standalone controller.`);
 					return 1;
 				}
 				const shutdownController = new AbortController();
@@ -12916,8 +12819,8 @@ async function runAgentServer(argv) {
 					runtimeRegistry,
 					runtimeSettings
 				});
-				const tls = isMacos() ? await ensureTrustedLocalTls(settingsRoot) : void 0;
-				const selfOrigin = `${tls ? "https" : "http"}://127.0.0.1:${port}`;
+				if (nativeSocket) await validateNativeSocket(nativeSocket);
+				const selfOrigin = nativeSocket ? void 0 : `http://127.0.0.1:${port}`;
 				const app = buildAgentServer({
 					operatorOAuth: new OperatorOAuth({
 						issuer: connection.issuer,
@@ -12928,6 +12831,7 @@ async function runAgentServer(argv) {
 						consoleClientId: connection.consoleClientId,
 						callbackPort: OPERATOR_OAUTH.callbackPort
 					}, root),
+					nativeOnly: Boolean(nativeSocket),
 					connectionSettings,
 					operatorApiUrl: connection.apiUrl,
 					store,
@@ -12939,12 +12843,8 @@ async function runAgentServer(argv) {
 					subscriptions,
 					providers,
 					runtimeRegistry,
-					allowedOrigins,
-					selfOrigin,
-					...tls ? { tls: {
-						key: tls.key,
-						cert: tls.cert
-					} } : {},
+					allowedOrigins: nativeSocket ? [] : allowedOrigins,
+					...selfOrigin ? { selfOrigin } : {},
 					defaultApiUrl,
 					runtimeSettings,
 					...envConfig.activeIdentity ? { activeIdentity: envConfig.activeIdentity } : {},
@@ -12953,15 +12853,17 @@ async function runAgentServer(argv) {
 					shutdownSignal: shutdownController.signal
 				});
 				try {
-					const address = await app.listen({
+					const address = await app.listen(nativeSocket ? { path: nativeSocket } : {
 						host: "127.0.0.1",
 						port
 					});
+					if (nativeSocket) await chmod(nativeSocket, 384);
 					console.error(`moltnet-agent server listening on ${address}`);
 					console.error(`config root: ${root}`);
-					console.error(`allowed origins: ${allowedOrigins.join(", ")}`);
+					if (nativeSocket) console.error(`native control socket: ${nativeSocket}`);
+					else console.error(`allowed origins: ${allowedOrigins.join(", ")}`);
 					if (nativeClient) console.error("native desktop client: authorized");
-					console.error("Sign in through Desktop, then connect from the Console \"Local runtime\" page.");
+					if (!nativeSocket) console.error("Connect from an allowed local-control client after operator authorization.");
 					return await waitForAgentServerShutdown(runs, app, shutdownController, Boolean(values.supervised));
 				} catch (cause) {
 					await app.close().catch(() => void 0);
@@ -12975,7 +12877,7 @@ async function runAgentServer(argv) {
 		} catch (cause) {
 			if (cause instanceof AgentServerLockError) {
 				console.error(cause.message);
-				return 1;
+				return agentServerLockExitCode(cause);
 			}
 			throw cause;
 		}
@@ -12983,99 +12885,6 @@ async function runAgentServer(argv) {
 		await shutdownLogger();
 	}
 }
-async function runTrustCommand(argv, defaultRoot) {
-	try {
-		const { values } = parseArgs({
-			args: argv,
-			options: {
-				root: { type: "string" },
-				remove: { type: "boolean" },
-				status: { type: "boolean" },
-				yes: { type: "boolean" },
-				json: { type: "boolean" }
-			}
-		});
-		const root = values.root ?? defaultRoot;
-		const statusRequested = Boolean(values.status);
-		const removeRequested = Boolean(values.remove);
-		const yes = Boolean(values.yes);
-		const json = Boolean(values.json);
-		if (statusRequested && (removeRequested || yes)) {
-			console.error("Usage: moltnet-agent server trust --status [--json]");
-			return 1;
-		}
-		if (!isMacos()) {
-			if (json) {
-				printTrustStatus({
-					supported: false,
-					trusted: false,
-					fingerprint: null
-				});
-				return 0;
-			}
-			console.error("Local HTTPS trust setup is currently supported on macOS only.");
-			return 1;
-		}
-		if (statusRequested) {
-			const material = await inspectLocalTlsMaterial(root);
-			const trusted = material !== null && await isLocalCaTrusted(root);
-			if (json) printTrustStatus({
-				supported: true,
-				trusted,
-				fingerprint: material?.fingerprint ?? null
-			});
-			else console.log(trusted ? `MoltNet local CA ${material?.fingerprint ?? "(not prepared)"} is trusted.` : `MoltNet local CA ${material?.fingerprint ?? "(not prepared)"} is not trusted.`);
-			return 0;
-		}
-		if (json && !yes) {
-			console.error("Machine-readable trust changes require --yes after native app consent.");
-			return 1;
-		}
-		if (removeRequested) {
-			await removeLocalCa(root);
-			if (json) printTrustStatus({
-				supported: true,
-				trusted: false,
-				fingerprint: null
-			});
-			else console.log("Removed the MoltNet local CA from your login keychain.");
-			return 0;
-		}
-		const material = await ensureLocalTlsMaterial(root);
-		if (yes) await trustLocalCa(root);
-		else await ensureTrustedLocalTls(root);
-		if (json) printTrustStatus({
-			supported: true,
-			trusted: await isLocalCaTrusted(root),
-			fingerprint: material.fingerprint
-		});
-		else console.log("MoltNet local HTTPS trust is ready for this macOS user.");
-		return 0;
-	} catch (cause) {
-		console.error(`Agent Server trust command failed: ${cause instanceof Error ? cause.message : String(cause)}`);
-		return 1;
-	}
-}
-function printTrustStatus(status) {
-	console.log(JSON.stringify(status));
-}
-async function ensureTrustedLocalTls(root) {
-	const material = await ensureLocalTlsMaterial(root);
-	if (await isLocalCaTrusted(root)) return material;
-	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Local HTTPS trust is not configured. Run `moltnet-agent server trust` from an interactive terminal.");
-	const prompt = createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const answer = await prompt.question(`Trust MoltNet's local CA (${material.fingerprint}) in this macOS login keychain? [y/N] `);
-		if (!/^y(es)?$/i.test(answer.trim())) throw new Error("Local HTTPS trust was not approved.");
-	} finally {
-		prompt.close();
-	}
-	await trustLocalCa(root);
-	return material;
-}
 function waitForAgentServerShutdown(runs, app, shutdownController, supervised) {
 	return new Promise((resolvePromise) => {
 		let shuttingDown = false;
@@ -13488,7 +13297,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.61.0";
+var DAEMON_VERSION = "0.62.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.61.0",
+  "version": "0.62.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -75,7 +75,6 @@
     "@opentelemetry/sdk-trace-base": "^2.5.1",
     "@opentelemetry/sdk-trace-node": "^2.5.1",
     "@opentelemetry/semantic-conventions": "^1.39.0",
-    "@peculiar/x509": "^2.0.0",
     "fastify": "^5.8.5",
     "fastify-plugin": "^5.1.0",
     "jose": "^6.1.3",
@@ -84,11 +83,10 @@
     "pino-opentelemetry-transport": "^3.0.0",
     "pino-pretty": "^13.1.3",
     "proper-lockfile": "4.1.2",
-    "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
     "@themoltnet/agent-runtime": "1.2.0",
-    "@themoltnet/os-keyring": "0.3.0",
     "@themoltnet/pi-runtime": "0.18.2",
+    "@themoltnet/os-keyring": "0.3.0",
     "@themoltnet/sdk": "0.144.0"
   },
   "devDependencies": {
@@ -99,15 +97,15 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/agent-eval": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/api-client": "0.1.0",
+    "@moltnet/agent-eval": "0.1.0",
     "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/execution-integrations": "0.1.0",
-    "@moltnet/execution-plan": "0.1.0",
-    "@moltnet/loopback-companion": "0.1.0",
     "@moltnet/models": "0.1.0",
     "@moltnet/observability": "0.1.0",
+    "@moltnet/loopback-companion": "0.1.0",
+    "@moltnet/execution-plan": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
     "@moltnet/tasks": "0.1.0"
   },