@themoltnet/agent-daemon 0.61.0 → 0.63.0

package/README.md

@@ -15,17 +15,18 @@ from [themolt.net/download](https://themolt.net/download). Opening the app:
 
 1. installs or updates the publisher-verified Agent CLI bundle under
    `~/.local/share/moltnet/agent`;
-2. asks before adding the per-user local HTTPS CA to the login Keychain;
-3. starts a foreground, supervised Agent Server; and
-4. opens Console for OAuth PKCE approval and runtime management.
+2. starts a foreground, supervised Agent Server over a private native socket;
+   and
+3. opens the browser only when OAuth approval is required.
 
 Closing the status window hides it. **Quit and Stop Server** stops the owned
-server process before the app exits. After the server restarts, reconnect Console through OAuth PKCE. The local
-operator, identities, and provider configuration persist.
+server process before the app exits. Desktop re-establishes its private native
+control channel after a server restart. The local operator, identities, and
+provider configuration persist.
 
 Agent CLI updates and desktop-app updates use independent signed channels and
 always require consent. Removing the Agent CLI bundle preserves
-`~/.config/moltnet`. Removing the local CA is a separate opt-in action.
+`~/.config/moltnet`.
 
 ### Agent CLI
 
@@ -123,8 +124,8 @@ For config-based runs, the agent's `moltnet.json` lives in the central store
 (`~/.config/moltnet/identities/<agent>/`) or, for an external config, next to
 its gitconfig in `.moltnet/<agent>/`. Three paths create it:
 
-- The Console's Local Runtime page creates a managed agent through the Agent
-  Server: keypair and agent key generated on this machine, stored under the
+- MoltNet Agent creates a managed agent through the Agent Server: keypair and
+  agent key generated on this machine, stored under the
   store's `secrets/` directory, no CLI involved.
 - [`moltnet register`](../../docs/start/install-and-initialize.md#register-an-agent)
   creates an OAuth2 identity from the CLI; add a stored agent key with
@@ -209,7 +210,7 @@ carries them -- read access to the agent's teams and their diaries, and
 enrollment into a team. Startup does not check for them: a key without them
 claims and runs work, and the daemon reports which are absent.
 
-The Console selects the full set by default. Knowledge-enabled workers must add
+Desktop selects the full set by default. Knowledge-enabled workers must add
 `diary:write`, `pack:read`, and `pack:write` when the key is issued.
 
 `crypto:sign` is in the minimum because host-capability signing runs on the
@@ -648,10 +649,36 @@ Server configuration root. **Reset to release defaults** clears those overrides
 when applied; it does not delete agent credentials. Launch environment values
 have priority and appear read-only. Operators who explicitly set both
 `MOLTNET_OPERATOR_API_URL` and `MOLTNET_OPERATOR_OAUTH_ISSUER` should also use
-`MOLTNET_AGENT_SERVER_ROOT` to select a dedicated environment root.
+`MOLTNET_HOME` to select a dedicated environment root.
 
 Release defaults use `https://api.themolt.net`, `https://auth.themolt.net`, and
 public client IDs `moltnet-native` / `moltnet-console`. Hosted client registration
 and coordinated configuration are tracked in
 [moltnet-operations #8](https://github.com/getlarge/moltnet-operations/issues/8).
 These IDs are public configuration; they do not contain a client secret.
+
+### Isolated local development
+
+Use the development targets to keep development state and installations in
+separate directories:
+
+```bash
+pnpm exec nx run @moltnet/agent-desktop:tauri:dev
+pnpm exec nx run @themoltnet/agent-daemon:dev -- server
+```
+
+The launchers choose `~/.local/share/moltnet/development/<worktree-id>/store`
+and the sibling `agent` installation directory. The worktree ID is a stable
+hash of the canonical checkout path. Repeated launches reuse that environment;
+another worktree gets its own environment. Use `MOLTNET_DEV_HOME` and `MOLTNET_DEV_AGENT_HOME` to override these development
+locations. Use absolute overrides: relative paths start at the Nx target’s
+working directory (`apps/agent-daemon` for daemon `dev`, the repository root
+for Desktop `tauri:dev`). All daemon `dev` commands, including `poll`, use
+this isolated store.
+The launchers ignore inherited production store and installation selectors.
+The renderer-only Desktop `dev` target starts Vite without a native server.
+
+For direct CLI or SDK development commands, set `MOLTNET_HOME` explicitly. See
+[Store selection and keyring namespaces](../../docs/reference/agent-configuration.md#store-selection-and-keyring-namespaces)
+for precedence, secret namespaces and daemon discovery. Automated tests use fresh
+temporary roots.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ClB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+ClB"}

package/dist/cli.js

@@ -11,12 +11,12 @@ import "typebox/value";
 import { execFile, spawn } from "node:child_process";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { parseArgs, parseEnv, promisify } from "node:util";
-import { CredentialPersistenceError, EnrollmentRecoveryError, FILE_SECRET_PROVIDER, FileSecretProvider, ProjectConfigError, ProvisioningNotStartedError, RegisterIdentityError, WORKSPACE_STRATEGIES, boundedIdentitySignal, canonicalDirectory, connect, createNodeSecretProviderRegistry, enrollTeam, getProjectConfigPath, readProjectConfig, register, resolveProjectBinding } from "@themoltnet/sdk/node";
+import { CredentialPersistenceError, EnrollmentRecoveryError, FILE_SECRET_PROVIDER, FileSecretProvider, ProjectConfigError, ProvisioningNotStartedError, RegisterIdentityError, WORKSPACE_STRATEGIES, boundedIdentitySignal, canonicalDirectory, canonicalStoreRoot, connect, createNodeSecretProviderRegistry, defaultStoreRoot, enrollTeam, getProjectConfigPath, isDefaultStore, readProjectConfig, register, resolveProjectBinding, resolveStoreRoot, resolveStoreSelection } from "@themoltnet/sdk/node";
 import { constants, copyFileSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, hasAgentKeyConfiguration, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, selectAgentKeyReference, signBytes } from "@themoltnet/sdk";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, RuntimeProfilePrerequisiteError, createLocalSeedSigner, resolveAgentIdentity, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
 import { GuestEnvironmentBoundaryError, assertGuestEnvironmentBoundary, createPiRetryTriage, findMainWorktree, isResolvedPathInsideRoot, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveRuntimeProfileModel } from "@themoltnet/pi-runtime";
-import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual, webcrypto } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { once } from "node:events";
 import { metrics } from "@opentelemetry/api";
 import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-proto";
@@ -28,7 +28,7 @@ import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
 import { homedir, platform, tmpdir } from "node:os";
 import { PI_MODEL_MODALITIES, writePiConfig } from "@themoltnet/pi-runtime/pi-config";
-import { mkdir, open, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, open, readFile, readdir, realpath, stat, writeFile } from "node:fs/promises";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { pipeline } from "node:stream/promises";
 import { createInterface } from "node:readline/promises";
@@ -45,8 +45,6 @@ import { pathToFileURL } from "node:url";
 import { StringDecoder } from "node:string_decoder";
 import rateLimit from "@fastify/rate-limit";
 import Fastify from "fastify";
-import "reflect-metadata";
-import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, IP, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, X509CertificateGenerator } from "@peculiar/x509";
 import { createGzip } from "node:zlib";
 //#region ../../libs/tasks/src/rubric.ts
 /**
@@ -3759,6 +3757,10 @@ async function resolveSelectionApiUrl(agentName, options) {
 * here, so the rest of the daemon imports typed values rather than
 * sprinkling string lookups across the codebase.
 */
+/** All daemon commands announce the same legacy alias policy as Go and Desktop. */
+function legacyStoreNotice() {
+	return process.env["MOLTNET_AGENT_SERVER_ROOT"] !== void 0 ? "MOLTNET_AGENT_SERVER_ROOT is deprecated; use MOLTNET_HOME. Both select the entire store; no data is migrated." : void 0;
+}
 function loadConfig() {
 	assertSingleCredentialForm("MOLTNET_AGENT_KEY", "MOLTNET_AGENT_KEY_REF");
 	assertSingleCredentialForm("MOLTNET_PRIVATE_KEY", "MOLTNET_PRIVATE_KEY_REF");
@@ -3769,7 +3771,7 @@ function loadConfig() {
 		profilePrerequisiteEnv: process.env,
 		profilePrerequisitePath: process.env.PATH ?? "",
 		piCodingAgentDir: process.env["PI_CODING_AGENT_DIR"] ?? "",
-		agentServerRoot: process.env["MOLTNET_AGENT_SERVER_ROOT"] ?? "",
+		agentServerRoot: resolveStoreRoot(),
 		credentialSource: detectCredentialSource(process.env),
 		apiUrl: process.env["MOLTNET_API_URL"] ?? "",
 		signingPrivateKey: process.env["MOLTNET_PRIVATE_KEY"] ?? "",
@@ -3817,7 +3819,8 @@ function activatePiCodingAgentDir(path, env = {}) {
 	process.env["PI_CODING_AGENT_DIR"] = path;
 	Object.assign(process.env, env);
 }
-function loadAgentServerEnvConfig() {
+function loadAgentServerEnvConfig(root) {
+	const selection = resolveStoreSelection({ root });
 	const issuer = process.env["MOLTNET_OPERATOR_OAUTH_ISSUER"];
 	const publicUrl = process.env["MOLTNET_OPERATOR_OAUTH_PUBLIC_URL"] ?? issuer;
 	const nativeClientId = process.env["MOLTNET_NATIVE_OAUTH_CLIENT_ID"];
@@ -3833,7 +3836,8 @@ function loadAgentServerEnvConfig() {
 		},
 		port: process.env["MOLTNET_AGENT_SERVER_PORT"] ?? "",
 		allowedOrigins: process.env["MOLTNET_AGENT_SERVER_ALLOWED_ORIGINS"] ?? "",
-		root: process.env["MOLTNET_AGENT_SERVER_ROOT"] ?? "",
+		root: selection.root,
+		rootSource: selection.source,
 		apiUrl: process.env["MOLTNET_API_URL"] ?? "",
 		logLevel: process.env["LOG_LEVEL"] ?? "",
 		activeIdentity: process.env["MOLTNET_ACTIVE_IDENTITY"] ?? ""
@@ -3843,21 +3847,22 @@ function loadAgentServerEnvConfig() {
 function processEnvSnapshot() {
 	return process.env;
 }
-function loadUpdateEnvConfig() {
+function loadUpdateEnvConfig(root) {
 	return {
+		...!isDefaultStore({ root }) ? { storeRoot: resolveStoreRoot({ root }) } : {},
 		xdgCacheHome: process.env["XDG_CACHE_HOME"] ?? "",
 		localAppData: process.env["LOCALAPPDATA"] ?? ""
 	};
 }
 //#endregion
 //#region src/lib/run-project-selection.ts
-var execFileAsync$2 = promisify(execFile);
+var execFileAsync$1 = promisify(execFile);
 var GIT_TIMEOUT_MS = 1e4;
 var GIT_MAX_OUTPUT_BYTES = 64 * 1024;
 async function validateGitSource(source) {
 	const inherited = processEnvSnapshot();
 	try {
-		const { stdout } = await execFileAsync$2("git", [
+		const { stdout } = await execFileAsync$1("git", [
 			"rev-parse",
 			"--show-toplevel",
 			"--verify",
@@ -4015,11 +4020,9 @@ Commands:
   once      Claim and execute one specific queued task by id, then exit.
   drain     Poll until the queue has nothing claimable, then exit.
             Useful for batch eval runs and demos.
-  server    Loopback supervisor for console-managed runs: OAuth local control,
-            agent/provider config store, and start/stop of poll/drain
-            child processes. Binds 127.0.0.1 only.
-  server trust
-            Install the per-user macOS local-HTTPS CA after explicit consent.
+  server    Supervisor for managed runs: authorized standalone local control,
+            agent/provider config store, and start/stop of poll/drain child
+            processes. Binds 127.0.0.1 or a private native socket.
   providers Manage configured endpoints and Pi OAuth subscriptions without
             starting the Agent Server. See \`agent-daemon providers --help\`.
   sync-sessions
@@ -4169,33 +4172,33 @@ function isHelpFlag(args) {
 	return args.includes("--help") || args.includes("-h");
 }
 var AGENT_SERVER_HELP = `\
-agent-daemon server — loopback supervisor for console-managed runs.
+agent-daemon server — local supervisor for managed runs.
 
-Binds 127.0.0.1 only. An authorized Console origin configures agents and
-providers (secret references only) and starts/stops poll/drain runs as
-child processes of this supervisor.
+Standalone mode binds 127.0.0.1 for authorized local-control clients. MoltNet
+Agent Desktop instead uses a private Unix socket with a process-scoped grant.
+Both modes configure agents and providers and start/stop child runs.
 
 Options:
-  --port <n>                  Loopback port. Default: 17374.
+  --port <n>                  Loopback port. Default store: 17374; isolated stores: an available port.
                               Env: MOLTNET_AGENT_SERVER_PORT.
-  --allowed-origins <csv>     Exact Console origins allowed local control.
+  --allowed-origins <csv>     Exact browser-controller origins allowed
+                              local control.
                               Default: https://console.themolt.net.
                               Env: MOLTNET_AGENT_SERVER_ALLOWED_ORIGINS.
   --root <path>               Config root. Default: ~/.config/moltnet
-                              (or MOLTNET_AGENT_SERVER_ROOT).
+                              (or MOLTNET_HOME; legacy MOLTNET_AGENT_SERVER_ROOT).
   --api-url <url>             Default MoltNet API for new managed agents.
                               Default: https://api.themolt.net.
   --heartbeat-interval-ms <n> Child reporter heartbeat cadence. Default: 60000.
   --warm-retention-sec <n>    Child session/workspace retention. Default: 1800.
   --supervised                Also stop gracefully when stdin reaches EOF.
+  --native-socket <path>      Private native-only socket (requires --supervised).
+                              Absolute, at most 100 bytes, with a new socket in
+                              a caller-owned 0700 directory. TCP flags are not
+                              accepted; inherited TCP env settings are ignored.
 
-On macOS, the first interactive run asks to trust a per-user local CA in the
-login keychain and serves HTTPS. Native supervisors use:
-  server trust --status --json
-  server trust --yes --json
-  server trust --remove --yes --json
-Run \`agent-daemon server trust --remove\` interactively to remove that exact
-CA. Linux continues to use the Chromium PNA HTTP path.
+Standalone mode uses loopback HTTP on every platform. Desktop socket mode does
+not open a TCP listener.
 `;
 var PROVIDERS_HELP = `\
 moltnet-agent providers — manage local model providers.
@@ -4212,8 +4215,8 @@ Usage:
     [--root <path>]
   moltnet-agent providers logout <id> [--yes] [--root <path>]
 
-The default root is ~/.config/moltnet. MOLTNET_AGENT_SERVER_ROOT remains the
-environment override. API keys are accepted only from redirected stdin; they
+The default root is ~/.config/moltnet. MOLTNET_HOME selects another store.
+MOLTNET_AGENT_SERVER_ROOT is a legacy alias; conflicting values fail. API keys are accepted only from redirected stdin; they
 are stored separately and providers.json contains only a secret reference.
 
 --model declares a text-only model. --model-input declares a model together
@@ -4258,7 +4261,7 @@ async function resolveDaemonAgentIdentity(input) {
 }
 //#endregion
 //#region src/lib/correlation.ts
-var execFileAsync$1 = promisify(execFile);
+var execFileAsync = promisify(execFile);
 var CORRELATION_TRAILER_KEY = "Moltnet-Correlation-Id";
 var CORRELATION_MARKER_RE = /<!--\s*moltnet-correlation:\s*([\w-]+)\s*-->/i;
 new RegExp(`^${CORRELATION_TRAILER_KEY}:\\s*(\\S+)\\s*$`, "m");
@@ -4305,7 +4308,7 @@ function makePrBodyAnchorWriter(deps) {
 function createGhCliClient() {
 	return {
 		async get({ owner, repo, number }) {
-			const { stdout } = await execFileAsync$1("gh", [
+			const { stdout } = await execFileAsync("gh", [
 				"api",
 				`repos/${owner}/${repo}/pulls/${number}`,
 				"--jq",
@@ -4314,7 +4317,7 @@ function createGhCliClient() {
 			return JSON.parse(stdout);
 		},
 		async patch({ owner, repo, number }, body) {
-			await execFileAsync$1("gh", [
+			await execFileAsync("gh", [
 				"api",
 				"-X",
 				"PATCH",
@@ -5659,20 +5662,9 @@ var AgentServerStoreError = class extends Error {
 		this.code = code;
 	}
 };
-/**
-* `MOLTNET_AGENT_SERVER_ROOT` override, else `~/.config/moltnet`.
-*
-* Deliberately does NOT consult `XDG_CONFIG_HOME`. The Go CLI's GetConfigDir
-* and @moltnet/agent-config's getConfigDir both resolve `~/.config/moltnet`,
-* so honouring XDG here gave one application two config roots: on a machine
-* with the variable set, the daemon wrote identities the CLI and SDK could not
-* read. `MOLTNET_AGENT_SERVER_ROOT` remains the explicit escape hatch for a
-* genuinely custom location.
-*/
+/** Explicit root, MOLTNET_HOME, legacy alias, then the unchanged default store. */
 function resolveAgentServerRoot(input) {
-	const override = input.root?.trim();
-	if (override) return override;
-	return getConfigDir();
+	return getConfigDir(input);
 }
 /**
 * Copy a model entry, dropping an empty `input` so it never reaches the wire.
@@ -6106,7 +6098,7 @@ async function resolvePiAgentDir(cfg, agentRoot, profiles, options = {}) {
 		};
 	}
 	const repoPiDir = join(agentRoot, ".pi");
-	const store = new AgentServerStore(resolveAgentServerRoot({ root: cfg.agentServerRoot }));
+	const store = new AgentServerStore(resolveAgentServerRoot({ root: cfg.agentServerRoot || void 0 }));
 	const providers = store.readProviders();
 	const storeHasAuth = existsSync(store.piAuthJsonPath);
 	if (Object.keys(providers).length === 0 && !storeHasAuth) {
@@ -6187,7 +6179,7 @@ function mergePiModels(store, repo) {
 //#endregion
 //#region src/lib/state-dir.ts
 function ensureDaemonStateDirs(mountPath) {
-	const rootDir = canonicalStatePath(join(mountPath, ".moltnet", "d"));
+	const rootDir = canonicalStoreRoot(join(mountPath, ".moltnet", "d"));
 	const piSessionsDir = join(rootDir, "pi-sessions");
 	mkdirSync(rootDir, {
 		recursive: true,
@@ -6202,17 +6194,6 @@ function ensureDaemonStateDirs(mountPath) {
 		piSessionsDir: realpathSync(piSessionsDir)
 	};
 }
-function canonicalStatePath(path) {
-	let parent = resolve(path);
-	const missing = [];
-	while (!existsSync(parent)) {
-		missing.unshift(basename(parent));
-		const next = dirname(parent);
-		if (next === parent) throw new Error(`Cannot resolve daemon state root ${path}`);
-		parent = next;
-	}
-	return join(realpathSync(parent), ...missing);
-}
 //#endregion
 //#region src/lib/prepare-runtime-profile.ts
 /** Validate and prepare a profile through the shared daemon execution path. */
@@ -8869,12 +8850,13 @@ function parseProviderArgs(command, args) {
 	}
 }
 async function createContext(rootFlag, dependencies, installInterruptHandler) {
-	const store = new AgentServerStore(resolveAgentServerRoot({ root: rootFlag ?? dependencies.envRoot ?? loadAgentServerEnvConfig().root })).ensure();
+	const root = resolveAgentServerRoot({ root: rootFlag ?? dependencies.envRoot ?? loadAgentServerEnvConfig().root });
+	const store = new AgentServerStore(root).ensure();
 	const secrets = new FileSecretProvider({
 		root: store.secretsDir,
 		writable: true
 	});
-	const secretProviders = createNodeSecretProviderRegistry().register(secrets);
+	const secretProviders = createNodeSecretProviderRegistry({ store: { root } }).register(secrets);
 	const stderr = dependencies.stderr ?? console.error;
 	const logger = createCliLogger(stderr);
 	const configuration = dependencies.configuration ?? new ProviderConfigurationService({
@@ -9362,11 +9344,67 @@ var ConnectionSettingsStore = class {
 };
 /** A custom service gets its own identities, keys and runtime configuration. */
 function connectionStateRoot(root, settings) {
-	const identity = [settings.apiUrl.replace(/\/$/u, ""), settings.issuer.replace(/\/$/u, "")];
+	const identity = [settings.apiUrl.replace(/\/+$/u, ""), settings.issuer.replace(/\/+$/u, "")];
 	if (identity[0] === RELEASE_CONNECTION.apiUrl && identity[1] === RELEASE_CONNECTION.issuer) return root;
 	return join(root, "environments", createHash("sha256").update(JSON.stringify(identity)).digest("hex"));
 }
 //#endregion
+//#region src/lib/agent-server/endpoint.ts
+function defaultAgentServerPort(root) {
+	return isDefaultStore({ root }) ? OPERATOR_OAUTH.serverPort : 0;
+}
+function endpointPath(root) {
+	return join(root, "agent-server-endpoint.json");
+}
+function validateUrl(value) {
+	const url = new URL(value);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.port === "0" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || !/^http:\/\/127\.0\.0\.1(?::[1-9]\d{0,4})?$/.test(value)) throw new Error("Agent Server discovery requires a loopback HTTP origin");
+}
+function readAgentServerEndpoint(root) {
+	let raw;
+	try {
+		raw = readFileSync(endpointPath(root), "utf8");
+	} catch (cause) {
+		if (cause.code === "ENOENT") return null;
+		throw cause;
+	}
+	try {
+		const value = JSON.parse(raw);
+		if (value.version !== 1 || typeof value.instanceId !== "string" || value.instanceId.length !== 36 || !/^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/iu.test(value.instanceId) || typeof value.url !== "string") throw new Error("Invalid Agent Server discovery metadata");
+		validateUrl(value.url);
+		if (value.pid !== void 0) {
+			if (!Number.isSafeInteger(value.pid) || value.pid <= 0 || value.pid > 2147483647) throw new Error("Invalid process ID");
+			try {
+				process.kill(value.pid, 0);
+			} catch (cause) {
+				if (cause.code === "ESRCH") return null;
+			}
+		}
+		return value;
+	} catch (cause) {
+		throw new Error(`Invalid Agent Server discovery at ${endpointPath(root)}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+	}
+}
+/** Publish and release only while holding the selected store's singleton lock. */
+function publishAgentServerEndpoint(root, url) {
+	validateUrl(url);
+	const endpoint = {
+		version: 1,
+		instanceId: randomUUID(),
+		pid: process.pid,
+		url
+	};
+	writeJsonAtomic(endpointPath(root), endpoint);
+	return {
+		record: endpoint,
+		release() {
+			try {
+				if (readAgentServerEndpoint(root)?.instanceId === endpoint.instanceId) rmSync(endpointPath(root), { force: true });
+			} catch {}
+		}
+	};
+}
+//#endregion
 //#region src/lib/agent-server/lock.ts
 var AgentServerLockError = class extends Error {
 	name = "AgentServerLockError";
@@ -9400,7 +9438,14 @@ async function acquireAgentServerLock(root, options = {}) {
 			}
 		});
 	} catch (cause) {
-		if (cause.code === "ELOCKED") throw new AgentServerLockError("held", `another moltnet-agent server process already owns ${path}`, { cause });
+		if (cause.code === "ELOCKED") {
+			let holder = "";
+			try {
+				const endpoint = readAgentServerEndpoint(root);
+				if (endpoint?.pid) holder = ` (PID ${endpoint.pid}, instance ${endpoint.instanceId})`;
+			} catch {}
+			throw new AgentServerLockError("held", `another moltnet-agent server process already owns ${path}${holder}; stop that process before retrying`, { cause });
+		}
 		throw new AgentServerLockError("failed", `could not acquire Agent Server lock ${path}: ${cause.message}`, { cause });
 	}
 	let released = false;
@@ -9415,11 +9460,15 @@ async function acquireAgentServerLock(root, options = {}) {
 }
 /** Always release after normal completion or startup/runtime failure. */
 async function withAgentServerLock(root, work, options) {
-	const held = await acquireAgentServerLock(root, options);
+	const held = [];
 	try {
+		held.push(await acquireAgentServerLock(root, options));
+		if (options?.stateRoot && options.stateRoot !== root) held.push(await acquireAgentServerLock(options.stateRoot, options));
 		return await work();
 	} finally {
-		await held.release();
+		for (const entry of held.reverse()) await entry.release().catch((error) => {
+			console.error(`Could not release Agent Server lock ${entry.path}: ${String(error)}`);
+		});
 	}
 }
 //#endregion
@@ -9454,6 +9503,10 @@ function applyNativeClientGrant(options) {
 	nativeGrant.grantNative(token);
 	return true;
 }
+//#endregion
+//#region src/lib/agent-server/native-grant-service.ts
+/** Process-only native grant. Browser authorization belongs to OperatorOAuth. */
+var NATIVE_CLIENT_ORIGIN = "moltnet-agent-desktop://native";
 var NativeGrantError = class extends Error {
 	code = "native_token_invalid";
 };
@@ -9469,6 +9522,29 @@ var NativeGrantService = class {
 	}
 };
 //#endregion
+//#region src/lib/agent-server/native-socket.ts
+/** The supervisor owns the private directory; the server never removes peers. */
+async function validateNativeSocket(path) {
+	if (!isAbsolute(path) || Buffer.byteLength(path) > 100) throw new Error("Native socket must be an absolute path of at most 100 bytes");
+	const parent = dirname(path);
+	const metadata = await lstat(parent);
+	if (metadata.isSymbolicLink()) throw new Error(`Native socket parent contains a symlink: ${parent}`);
+	if (!metadata.isDirectory()) throw new Error(`Native socket parent is not a directory: ${parent}`);
+	const expectedUid = process.getuid?.();
+	if (expectedUid === void 0 || metadata.uid !== expectedUid) throw new Error(`Native socket parent has uid ${metadata.uid}; expected ${String(expectedUid)}: ${parent}`);
+	const mode = metadata.mode & 511;
+	if (mode !== 448) throw new Error(`Native socket parent has mode ${mode.toString(8)}; expected 700: ${parent}`);
+	const canonical = await realpath(parent);
+	if (canonical !== resolve(parent)) throw new Error(`Native socket parent contains a symlink: ${parent} resolves to ${canonical}`);
+	try {
+		await lstat(path);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	throw new Error("Native socket path already exists; it was left untouched");
+}
+//#endregion
 //#region src/lib/agent-server/operator-oauth.ts
 var InvalidOperatorGrantError = class extends Error {};
 var LOCAL_SCOPE = OPERATOR_OAUTH.localControlScope;
@@ -9671,8 +9747,8 @@ var OperatorOAuth = class {
 /**
 * Subscription-provider OAuth brokering for Agent Server (#2061 slice 4).
 *
-* The console clicks "Connect"; agent server runs the Pi OAuth flow host-side via
-* `ModelRuntime.login()` (which owns persistence into the shared
+* An authorized controller starts the flow; Agent Server runs Pi OAuth
+* host-side via `ModelRuntime.login()` (which owns persistence into the shared
 * `pi/auth.json` and token rotation thereafter). The browser only ever sees
 * the provider's authorize URL or device code — never tokens.
 *
@@ -10566,6 +10642,8 @@ var RunManager = class {
 		const homeDir = join(dirname(piDir), "home");
 		const env = {
 			HOME: homeDir,
+			MOLTNET_DEFAULT_STORE_ROOT: defaultStoreRoot({ env: this.options.baseEnv }),
+			MOLTNET_HOME: getConfigDir({ root: this.options.storeRoot ?? this.store.root }),
 			PI_CODING_AGENT_DIR: piDir,
 			XDG_CACHE_HOME: join(homeDir, ".cache"),
 			XDG_CONFIG_HOME: join(homeDir, ".config"),
@@ -10609,7 +10687,7 @@ var RunManager = class {
 		env["MOLTNET_AGENT_KEY"] = requireCredentialSnapshot(agent).agentKey;
 		env["MOLTNET_API_URL"] = activation.apiUrl ?? (activation.source === "external" ? activation.configApiUrl : "");
 		if (activation.source === "managed") {
-			if (!config.keys.private_key_ref) throw new AgentServerRunError("invalid_spec", "The managed signing key reference is missing");
+			if (config.keys.private_key_ref?.provider !== "file") throw new AgentServerRunError("invalid_store", "The managed identity store is inconsistent: its signing key must be file-backed. Restore the identity store or use credential recovery.");
 			env["MOLTNET_PRIVATE_KEY_REF"] = formatSecretReferenceString(config.keys.private_key_ref);
 			env["MOLTNET_SECRET_ROOT"] = this.store.secretsDir;
 		} else try {
@@ -11212,6 +11290,20 @@ function writeRegistry(path, entries) {
 	renameSync(temp, path);
 }
 //#endregion
+//#region src/lib/agent-server/secret-providers.ts
+function createAgentServerSecretProviders(settings, store) {
+	const secrets = new FileSecretProvider({
+		root: store.secretsDir,
+		writable: true
+	});
+	const registry = () => createNodeSecretProviderRegistry({ store: { root: settings.root } });
+	return {
+		secrets,
+		secretProviders: registry().register(secrets),
+		externalSecretProviders: registry()
+	};
+}
+//#endregion
 //#region src/lib/agent-server/readiness.ts
 /**
 * Whether a runtime profile can execute on *this* machine.
@@ -11406,17 +11498,17 @@ async function enrollIdentityTeam(options) {
 /**
 * The identity-wide team/diary binding, read from `<identityDir>/env`.
 *
-* This mirrors the Go CLI's `identityDefaultBinding` (`context_store.go:219`),
+* This mirrors the Go CLI's `identityDefaultBinding` (`project_selection.go`),
 * which is the fallback the CLI uses when a working directory has no
-* location-keyed binding in `contexts.json`.
+* registered project binding.
 *
 * The desktop cannot use the CLI's *location* bindings at all — its composer
 * has no working directory to key on — but it can honour this identity-wide
-* default, so an operator who ran `moltnet context set` sees their familiar
-* team preselected rather than an arbitrary first entry.
+* default, so an operator sees their familiar team preselected rather than an
+* arbitrary first entry.
 *
 * Like the CLI, a half-filled pair is treated as no binding: a team without a
-* diary is exactly the state `validateContextBinding` rejects.
+* diary is ignored.
 */
 function readIdentityDefaultBinding(identityDir) {
 	let contents;
@@ -11978,24 +12070,23 @@ function requestOperationSignal(request, shutdownSignal) {
 	else request.raw.once("aborted", () => disconnected.abort({ source: "request" }));
 	return shutdownSignal ? AbortSignal.any([disconnected.signal, shutdownSignal]) : disconnected.signal;
 }
-function buildAgentServer(options) {
+function buildAgentServer(input) {
+	const options = { ...input };
 	const { nativeGrant } = options;
 	const oauth = options.operatorOAuth;
 	let restartRequired = false;
-	const fastifyOptions = {
-		bodyLimit: BODY_LIMIT,
-		...options.tls ? { https: options.tls } : {}
-	};
+	const fastifyOptions = { bodyLimit: BODY_LIMIT };
 	const app = options.logger ? Fastify({
 		...fastifyOptions,
 		loggerInstance: options.logger
 	}) : Fastify(fastifyOptions);
+	app.addHook("onListen", async () => {
+		const address = app.server.address();
+		if (address && typeof address !== "string") options.selfOrigin = `http://127.0.0.1:${address.port}`;
+	});
 	options.registerOpenApi?.(app);
 	for (const schema of AGENT_SERVER_SCHEMAS) app.addSchema(schema);
-	const browserOrigins = new OriginAllowlist(options.allowedOrigins);
-	registerLoopbackSecurity(app, {
-		isOriginAllowed: (origin) => origin === "moltnet-agent-desktop://native" || browserOrigins.has(origin),
-		...options.selfOrigin ? { selfOrigins: [options.selfOrigin] } : {},
+	const securityOptions = {
 		allowedHeaders: [AGENT_SERVER_TOKEN_HEADER],
 		methods: [
 			"GET",
@@ -12004,7 +12095,18 @@ function buildAgentServer(options) {
 			"DELETE",
 			"OPTIONS"
 		]
+	};
+	if (options.nativeOnly) registerLoopbackSecurity(app, {
+		...securityOptions,
+		isOriginAllowed: (origin) => origin === NATIVE_CLIENT_ORIGIN
 	});
+	else {
+		const browserOrigins = new OriginAllowlist(options.allowedOrigins);
+		registerLoopbackSecurity(app, {
+			...securityOptions,
+			isOriginAllowed: (origin) => origin === "moltnet-agent-desktop://native" || origin === options.selfOrigin || browserOrigins.has(origin)
+		});
+	}
 	let verificationWindow = Date.now();
 	let verifications = 0;
 	const browserVerification = /* @__PURE__ */ new WeakMap();
@@ -12021,6 +12123,31 @@ function buildAgentServer(options) {
 		browserVerification.set(request, pending);
 		return pending;
 	}
+	function hasValidNativeGrant(origin, token) {
+		if (origin !== "moltnet-agent-desktop://native" || typeof token !== "string" || token.length === 0) return false;
+		try {
+			nativeGrant.verify(origin, token);
+			return true;
+		} catch (error) {
+			if (error instanceof NativeGrantError) return false;
+			throw error;
+		}
+	}
+	const nativeVerification = /* @__PURE__ */ new WeakSet();
+	function requireNativeGrant(request) {
+		if (nativeVerification.has(request)) return;
+		const origin = request.headers.origin;
+		const token = request.headers[AGENT_SERVER_TOKEN_HEADER];
+		if (hasValidNativeGrant(origin, token)) {
+			nativeVerification.add(request);
+			return;
+		}
+		request.log.warn({
+			stage: "native-control-authorization",
+			outcome: "rejected"
+		}, "Native control authorization failed");
+		throw new AgentServerHttpError(401, "native_token_invalid", "Native authorization required");
+	}
 	app.register(rateLimit, {
 		global: true,
 		max: options.rateLimitMax ?? RATE_LIMIT_MAX,
@@ -12032,15 +12159,15 @@ function buildAgentServer(options) {
 			const presented = request.headers[AGENT_SERVER_TOKEN_HEADER];
 			let authenticated = false;
 			if (typeof presented === "string" && presented.length > 0) try {
-				if (origin === "moltnet-agent-desktop://native") nativeGrant.verify(origin, presented);
+				if (origin === "moltnet-agent-desktop://native") authenticated = hasValidNativeGrant(origin, presented);
 				else {
 					if (!oauth) return `unauth:${origin}:${request.ip}`;
 					await verifyBrowser(request, presented);
+					authenticated = true;
 				}
-				authenticated = true;
 			} catch (error) {
 				if (error instanceof AgentServerHttpError && error.statusCode === 429) throw error;
-				if (origin === "moltnet-agent-desktop://native" && !(error instanceof NativeGrantError)) throw error;
+				if (origin === "moltnet-agent-desktop://native") throw error;
 			}
 			return authenticated ? `origin:${origin}` : `unauth:${origin}:${request.ip}`;
 		}
@@ -12050,7 +12177,7 @@ function buildAgentServer(options) {
 		const origin = requireOriginHeader(request.headers);
 		const token = request.headers[AGENT_SERVER_TOKEN_HEADER];
 		if (typeof token !== "string" || token.length === 0) throw new AgentServerHttpError(401, "authorization_required", "Local control token is required");
-		if (origin === "moltnet-agent-desktop://native") nativeGrant.verify(origin, token);
+		if (origin === "moltnet-agent-desktop://native") requireNativeGrant(request);
 		else try {
 			if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
 			const admission = browserVerification.get(request);
@@ -12079,6 +12206,9 @@ function buildAgentServer(options) {
 		return origin;
 	};
 	app.after(() => {
+		if (options.nativeOnly) app.addHook("preParsing", async (request) => {
+			requireNativeGrant(request);
+		});
 		app.get("/health", { schema: AgentServerRouteSchemas.health }, async () => ({ status: "ok" }));
 		app.get("/v1/native/connection-settings", { schema: { hide: true } }, async (request) => {
 			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !options.connectionSettings) throw new AgentServerHttpError(403, "native_required", "Native administration required");
@@ -12626,7 +12756,7 @@ function normalizeAgentServerError(error) {
 		message: error.message
 	};
 	if (error instanceof AgentServerRunError) return {
-		statusCode: error.code === "run_not_found" ? 404 : 400,
+		statusCode: error.code === "run_not_found" ? 404 : error.code === "invalid_store" ? 409 : 400,
 		code: error.code,
 		message: error.message
 	};
@@ -12657,196 +12787,40 @@ function normalizeAgentServerError(error) {
 	};
 }
 //#endregion
-//#region src/lib/agent-server/tls.ts
-var execFileAsync = promisify(execFile);
-var CA_COMMON_NAME = "MoltNet Local Agent CA";
-var LEAF_COMMON_NAME = "MoltNet Local Agent";
-var RENEW_BEFORE_MS = 720 * 60 * 60 * 1e3;
-function loginKeychainPath() {
-	return join(homedir(), "Library", "Keychains", "login.keychain-db");
-}
-function pemPrivateKey(key) {
-	return webcrypto.subtle.exportKey("pkcs8", key).then((der) => createPrivateKey({
-		key: Buffer.from(der),
-		format: "der",
-		type: "pkcs8"
-	}).export({
-		format: "pem",
-		type: "pkcs8"
-	}).toString());
-}
-async function localTlsMaterialFromDirectory(dir) {
-	try {
-		const [key, cert, ca] = await Promise.all([
-			readFile(join(dir, "loopback-key.pem"), "utf8"),
-			readFile(join(dir, "loopback-cert.pem"), "utf8"),
-			readFile(join(dir, "local-ca.pem"), "utf8")
-		]);
-		const parsed = new X509Certificate(cert);
-		const authority = new X509Certificate(ca);
-		if (Date.parse(parsed.validTo) - Date.now() > RENEW_BEFORE_MS && Date.parse(authority.validTo) - Date.now() > RENEW_BEFORE_MS && authority.keyUsage?.includes("1.3.6.1.5.5.7.3.1") && parsed.checkIP("127.0.0.1") === "127.0.0.1" && parsed.verify(authority.publicKey) && parsed.publicKey.equals(createPublicKey(key))) return {
-			key,
-			cert,
-			ca,
-			fingerprint: new X509Certificate(ca).fingerprint256
-		};
-	} catch {}
-	return null;
-}
-/** Read-only inspection for native status polling. */
-async function inspectLocalTlsMaterial(root) {
-	if (await hasStoredSigningKey(join(root, "tls"))) return null;
-	return localTlsMaterialFromDirectory(join(root, "tls"));
-}
-async function hasStoredSigningKey(dir) {
-	return stat(join(dir, "local-ca-key.pem")).then(() => true, (error) => {
-		if (error.code === "ENOENT") return false;
-		throw error;
-	});
-}
-/** Creates a per-user CA and loopback-only leaf certificate under a 0700 directory. */
-async function ensureLocalTlsMaterial(root) {
-	const dir = join(root, "tls");
-	await mkdir(dir, {
-		recursive: true,
-		mode: 448
-	});
-	const previousSigningKey = join(dir, "local-ca-key.pem");
-	const hasPreviousSigningKey = await hasStoredSigningKey(dir);
-	const existing = await localTlsMaterialFromDirectory(dir);
-	if (existing && !hasPreviousSigningKey) return existing;
-	if (isMacos() && await isLocalCaTrusted(root)) await removeLocalCa(root);
-	const caKeys = await webcrypto.subtle.generateKey({
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, false, ["sign", "verify"]);
-	const ca = (await X509CertificateGenerator.createSelfSigned({
-		name: `CN=${CA_COMMON_NAME}`,
-		keys: caKeys,
-		notAfter: new Date(Date.now() + 366 * 24 * 60 * 60 * 1e3),
-		extensions: [
-			new BasicConstraintsExtension(true, 0, true),
-			new KeyUsagesExtension(KeyUsageFlags.keyCertSign, true),
-			new ExtendedKeyUsageExtension([ExtendedKeyUsage.serverAuth], true)
-		]
-	})).toString("pem");
-	const leafKeys = await webcrypto.subtle.generateKey({
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, true, ["sign", "verify"]);
-	const leafCert = await X509CertificateGenerator.create({
-		subject: `CN=${LEAF_COMMON_NAME}`,
-		issuer: `CN=${CA_COMMON_NAME}`,
-		publicKey: leafKeys.publicKey,
-		signingKey: caKeys.privateKey,
-		notAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1e3),
-		extensions: [
-			new BasicConstraintsExtension(false, void 0, true),
-			new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
-			new ExtendedKeyUsageExtension([ExtendedKeyUsage.serverAuth]),
-			new SubjectAlternativeNameExtension([{
-				type: IP,
-				value: "127.0.0.1"
-			}], true)
-		]
-	});
-	const key = await pemPrivateKey(leafKeys.privateKey);
-	const cert = leafCert.toString("pem");
-	const writes = [writeFile(join(dir, "loopback-key.pem"), key, { mode: 384 }), writeFile(join(dir, "loopback-cert.pem"), cert, { mode: 384 })];
-	writes.push(writeFile(join(dir, "local-ca.pem"), ca, { mode: 384 }));
-	await Promise.all(writes);
-	await rm(previousSigningKey, { force: true });
-	return {
-		key,
-		cert,
-		ca,
-		fingerprint: new X509Certificate(ca).fingerprint256
-	};
-}
-async function trustLocalCa(root) {
-	const caPath = join(root, "tls", "local-ca.pem");
-	await execFileAsync("/usr/bin/security", [
-		"add-trusted-cert",
-		"-r",
-		"trustRoot",
-		"-p",
-		"ssl",
-		"-s",
-		"127.0.0.1",
-		"-k",
-		loginKeychainPath(),
-		caPath
-	]);
-}
-async function isLocalCaTrusted(root) {
-	try {
-		const ca = await readFile(join(root, "tls", "local-ca.pem"), "utf8");
-		const { stdout } = await execFileAsync("/usr/bin/security", [
-			"find-certificate",
-			"-a",
-			"-p",
-			"-c",
-			CA_COMMON_NAME,
-			loginKeychainPath()
-		]);
-		return stdout.includes(ca.trim());
-	} catch (error) {
-		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
-		const stderr = error && typeof error === "object" && "stderr" in error ? error.stderr : void 0;
-		if (typeof stderr === "string" && stderr.trim() === "security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.") return false;
-		throw error;
-	}
-}
-async function removeLocalCa(root) {
-	const fingerprint = new X509Certificate(await readFile(join(root, "tls", "local-ca.pem"), "utf8")).fingerprint256.replaceAll(":", "");
-	const caPath = join(root, "tls", "local-ca.pem");
-	await removeTrustSettings([
-		"remove-trusted-cert",
-		"-d",
-		caPath
-	]);
-	await removeTrustSettings(["remove-trusted-cert", caPath]);
-	await execFileAsync("/usr/bin/security", [
-		"delete-certificate",
-		"-Z",
-		fingerprint,
-		loginKeychainPath()
-	]);
-}
-function isMacos() {
-	return process.platform === "darwin";
-}
-async function removeTrustSettings(args) {
-	try {
-		await execFileAsync("/usr/bin/security", args, { env: { LC_ALL: "C" } });
-	} catch (error) {
-		const stderr = error && typeof error === "object" && "stderr" in error ? error.stderr : void 0;
-		if (typeof stderr === "string" && ["SecTrustSettingsRemoveTrustSettings: No Trust Settings were found.", "SecTrustSettingsRemoveTrustSettings: The specified item could not be found in the keychain."].includes(stderr.trim())) return;
-		throw error;
-	}
-}
-//#endregion
 //#region src/cli/server.ts
 /**
 * `moltnet-agent server` — per-user loopback supervisor (#2061).
 *
-* Starts nothing on its own: it binds 127.0.0.1 and waits for an authorized
-* Console origin to configure agents/providers and start/stop runs.
+* Starts nothing on its own: it binds 127.0.0.1 or a private native socket and
+* waits for an authorized controller to configure agents/providers and
+* start or stop runs.
 */
-var DEFAULT_PORT = OPERATOR_OAUTH.serverPort;
 var DEFAULT_ALLOWED_ORIGINS = "https://console.themolt.net";
 var SHUTDOWN_TIMEOUT_MS = 15e3;
+var LOCK_HELD_EXIT_CODE = 75;
+function agentServerLockExitCode(error) {
+	return error.code === "held" ? LOCK_HELD_EXIT_CODE : 1;
+}
+function validateNativeSocketOptions(options) {
+	if (!options.nativeSocket) return void 0;
+	if (!options.supervised) return "--native-socket requires --supervised";
+	if (options.port || options.allowedOrigins) return "--native-socket cannot be combined with TCP options";
+}
+function nativeSocketValidationOptions(input) {
+	return {
+		...input.nativeSocket ? { nativeSocket: input.nativeSocket } : {},
+		...input.supervised ? { supervised: true } : {},
+		...input.cliPort ? { port: input.cliPort } : {},
+		...input.cliAllowedOrigins ? { allowedOrigins: input.cliAllowedOrigins } : {}
+	};
+}
 async function runAgentServer(argv) {
 	if (isHelpFlag(argv)) {
 		console.log(AGENT_SERVER_HELP);
 		return 0;
 	}
-	const trustRequested = argv[0] === "trust";
-	const commandArgs = trustRequested ? argv.slice(1) : argv;
-	const envConfig = loadAgentServerEnvConfig();
-	if (trustRequested) return runTrustCommand(commandArgs, resolveAgentServerRoot({ root: envConfig.root }));
 	const { values } = parseArgs({
-		args: commandArgs,
+		args: argv,
 		options: {
 			port: { type: "string" },
 			"allowed-origins": { type: "string" },
@@ -12854,16 +12828,31 @@ async function runAgentServer(argv) {
 			"api-url": { type: "string" },
 			"heartbeat-interval-ms": { type: "string" },
 			"warm-retention-sec": { type: "string" },
-			supervised: { type: "boolean" }
+			supervised: { type: "boolean" },
+			"native-socket": { type: "string" }
 		}
 	});
-	const port = Number.parseInt(values.port ?? (envConfig.port || `${DEFAULT_PORT}`), 10);
-	if (!Number.isInteger(port) || port < 1 || port > 65535) {
+	const envConfig = loadAgentServerEnvConfig(values.root);
+	const nativeSocket = values["native-socket"];
+	const nativeSocketError = validateNativeSocketOptions(nativeSocketValidationOptions({
+		...nativeSocket ? { nativeSocket } : {},
+		...values.supervised ? { supervised: true } : {},
+		...values.port ? { cliPort: values.port } : {},
+		...values["allowed-origins"] ? { cliAllowedOrigins: values["allowed-origins"] } : {},
+		...envConfig.port ? { envPort: envConfig.port } : {},
+		...envConfig.allowedOrigins ? { envAllowedOrigins: envConfig.allowedOrigins } : {}
+	}));
+	if (nativeSocketError) {
+		console.error(nativeSocketError);
+		return 1;
+	}
+	const port = Number.parseInt(values.port ?? (envConfig.port || `${defaultAgentServerPort(envConfig.root)}`), 10);
+	if (!Number.isInteger(port) || port < 0 || port > 65535) {
 		console.error(`Invalid --port: ${String(values.port)}`);
 		return 1;
 	}
 	const allowedOrigins = parseAllowedOrigins(values["allowed-origins"] ?? (envConfig.allowedOrigins || DEFAULT_ALLOWED_ORIGINS));
-	const settingsRoot = values.root ?? resolveAgentServerRoot({ root: envConfig.root });
+	const settingsRoot = envConfig.root;
 	const connectionSettings = new ConnectionSettingsStore(settingsRoot, {
 		...envConfig.operatorOAuth,
 		...values["api-url"] || envConfig.apiUrl ? { apiUrl: values["api-url"] || envConfig.apiUrl } : {}
@@ -12879,20 +12868,15 @@ async function runAgentServer(argv) {
 	});
 	try {
 		try {
-			return await withAgentServerLock(root, async () => {
-				const secrets = new FileSecretProvider({
-					root: store.secretsDir,
-					writable: true
-				});
-				const secretProviders = createNodeSecretProviderRegistry().register(secrets);
-				const externalSecretProviders = createNodeSecretProviderRegistry();
+			return await withAgentServerLock(settingsRoot, async () => {
+				const { secrets, secretProviders, externalSecretProviders } = createAgentServerSecretProviders(connectionSettings, store);
 				const nativeGrant = new NativeGrantService();
 				const nativeClient = applyNativeClientGrant({
 					nativeGrant,
 					env: processEnvSnapshot()
 				});
 				if (Boolean(values.supervised) && !nativeClient) {
-					console.error(`A supervised Agent Server requires ${NATIVE_TOKEN_ENV}. Start it from MoltNet Agent, or omit --supervised to run it to reconnect Console to an operator already established by Desktop.`);
+					console.error(`A supervised Agent Server requires ${NATIVE_TOKEN_ENV}. Start it from MoltNet Agent, or omit --supervised for an authorized standalone controller.`);
 					return 1;
 				}
 				const shutdownController = new AbortController();
@@ -12909,6 +12893,7 @@ async function runAgentServer(argv) {
 				const runtimeRegistry = new RuntimeRegistry(store.root);
 				const runs = new RunManager({
 					store,
+					storeRoot: settingsRoot,
 					secretProviders,
 					externalSecretProviders,
 					baseEnv: processEnvSnapshot(),
@@ -12916,8 +12901,8 @@ async function runAgentServer(argv) {
 					runtimeRegistry,
 					runtimeSettings
 				});
-				const tls = isMacos() ? await ensureTrustedLocalTls(settingsRoot) : void 0;
-				const selfOrigin = `${tls ? "https" : "http"}://127.0.0.1:${port}`;
+				if (nativeSocket) await validateNativeSocket(nativeSocket);
+				const selfOrigin = nativeSocket ? void 0 : `http://127.0.0.1:${port}`;
 				const app = buildAgentServer({
 					operatorOAuth: new OperatorOAuth({
 						issuer: connection.issuer,
@@ -12928,6 +12913,7 @@ async function runAgentServer(argv) {
 						consoleClientId: connection.consoleClientId,
 						callbackPort: OPERATOR_OAUTH.callbackPort
 					}, root),
+					nativeOnly: Boolean(nativeSocket),
 					connectionSettings,
 					operatorApiUrl: connection.apiUrl,
 					store,
@@ -12939,12 +12925,8 @@ async function runAgentServer(argv) {
 					subscriptions,
 					providers,
 					runtimeRegistry,
-					allowedOrigins,
-					selfOrigin,
-					...tls ? { tls: {
-						key: tls.key,
-						cert: tls.cert
-					} } : {},
+					allowedOrigins: nativeSocket ? [] : allowedOrigins,
+					...selfOrigin ? { selfOrigin } : {},
 					defaultApiUrl,
 					runtimeSettings,
 					...envConfig.activeIdentity ? { activeIdentity: envConfig.activeIdentity } : {},
@@ -12952,30 +12934,43 @@ async function runAgentServer(argv) {
 					logger,
 					shutdownSignal: shutdownController.signal
 				});
+				let endpoint;
 				try {
-					const address = await app.listen({
+					const address = await app.listen(nativeSocket ? { path: nativeSocket } : {
 						host: "127.0.0.1",
 						port
 					});
+					if (nativeSocket) await chmod(nativeSocket, 384);
+					if (!nativeSocket) {
+						endpoint = publishAgentServerEndpoint(settingsRoot, address);
+						console.error(`discovery: ${join(settingsRoot, "agent-server-endpoint.json")}`);
+					}
 					console.error(`moltnet-agent server listening on ${address}`);
-					console.error(`config root: ${root}`);
-					console.error(`allowed origins: ${allowedOrigins.join(", ")}`);
+					console.error(`store root: ${settingsRoot} (${envConfig.rootSource})`);
+					console.error(`connection state: ${root}`);
+					if (nativeSocket) console.error(`native control socket: ${nativeSocket}`);
+					else console.error(`allowed origins: ${allowedOrigins.join(", ")}`);
 					if (nativeClient) console.error("native desktop client: authorized");
-					console.error("Sign in through Desktop, then connect from the Console \"Local runtime\" page.");
+					if (!nativeSocket) console.error("Connect from an allowed local-control client after operator authorization.");
 					return await waitForAgentServerShutdown(runs, app, shutdownController, Boolean(values.supervised));
 				} catch (cause) {
 					await app.close().catch(() => void 0);
 					throw cause;
+				} finally {
+					endpoint?.release();
+				}
+			}, {
+				stateRoot: root,
+				onCompromised: (error) => {
+					console.error(error.message);
+					process.exitCode = 1;
+					process.kill(process.pid, "SIGTERM");
 				}
-			}, { onCompromised: (error) => {
-				console.error(error.message);
-				process.exitCode = 1;
-				process.kill(process.pid, "SIGTERM");
-			} });
+			});
 		} catch (cause) {
 			if (cause instanceof AgentServerLockError) {
 				console.error(cause.message);
-				return 1;
+				return agentServerLockExitCode(cause);
 			}
 			throw cause;
 		}
@@ -12983,99 +12978,6 @@ async function runAgentServer(argv) {
 		await shutdownLogger();
 	}
 }
-async function runTrustCommand(argv, defaultRoot) {
-	try {
-		const { values } = parseArgs({
-			args: argv,
-			options: {
-				root: { type: "string" },
-				remove: { type: "boolean" },
-				status: { type: "boolean" },
-				yes: { type: "boolean" },
-				json: { type: "boolean" }
-			}
-		});
-		const root = values.root ?? defaultRoot;
-		const statusRequested = Boolean(values.status);
-		const removeRequested = Boolean(values.remove);
-		const yes = Boolean(values.yes);
-		const json = Boolean(values.json);
-		if (statusRequested && (removeRequested || yes)) {
-			console.error("Usage: moltnet-agent server trust --status [--json]");
-			return 1;
-		}
-		if (!isMacos()) {
-			if (json) {
-				printTrustStatus({
-					supported: false,
-					trusted: false,
-					fingerprint: null
-				});
-				return 0;
-			}
-			console.error("Local HTTPS trust setup is currently supported on macOS only.");
-			return 1;
-		}
-		if (statusRequested) {
-			const material = await inspectLocalTlsMaterial(root);
-			const trusted = material !== null && await isLocalCaTrusted(root);
-			if (json) printTrustStatus({
-				supported: true,
-				trusted,
-				fingerprint: material?.fingerprint ?? null
-			});
-			else console.log(trusted ? `MoltNet local CA ${material?.fingerprint ?? "(not prepared)"} is trusted.` : `MoltNet local CA ${material?.fingerprint ?? "(not prepared)"} is not trusted.`);
-			return 0;
-		}
-		if (json && !yes) {
-			console.error("Machine-readable trust changes require --yes after native app consent.");
-			return 1;
-		}
-		if (removeRequested) {
-			await removeLocalCa(root);
-			if (json) printTrustStatus({
-				supported: true,
-				trusted: false,
-				fingerprint: null
-			});
-			else console.log("Removed the MoltNet local CA from your login keychain.");
-			return 0;
-		}
-		const material = await ensureLocalTlsMaterial(root);
-		if (yes) await trustLocalCa(root);
-		else await ensureTrustedLocalTls(root);
-		if (json) printTrustStatus({
-			supported: true,
-			trusted: await isLocalCaTrusted(root),
-			fingerprint: material.fingerprint
-		});
-		else console.log("MoltNet local HTTPS trust is ready for this macOS user.");
-		return 0;
-	} catch (cause) {
-		console.error(`Agent Server trust command failed: ${cause instanceof Error ? cause.message : String(cause)}`);
-		return 1;
-	}
-}
-function printTrustStatus(status) {
-	console.log(JSON.stringify(status));
-}
-async function ensureTrustedLocalTls(root) {
-	const material = await ensureLocalTlsMaterial(root);
-	if (await isLocalCaTrusted(root)) return material;
-	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Local HTTPS trust is not configured. Run `moltnet-agent server trust` from an interactive terminal.");
-	const prompt = createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const answer = await prompt.question(`Trust MoltNet's local CA (${material.fingerprint}) in this macOS login keychain? [y/N] `);
-		if (!/^y(es)?$/i.test(answer.trim())) throw new Error("Local HTTPS trust was not approved.");
-	} finally {
-		prompt.close();
-	}
-	await trustLocalCa(root);
-	return material;
-}
 function waitForAgentServerShutdown(runs, app, shutdownController, supervised) {
 	return new Promise((resolvePromise) => {
 		let shuttingDown = false;
@@ -13469,6 +13371,7 @@ function compareVersions(a, b) {
 }
 function cachePath() {
 	const env = loadUpdateEnvConfig();
+	if (env.storeRoot) return join(env.storeRoot, "cache", "updates", "agent.json");
 	return join(env.xdgCacheHome || (platform() === "win32" ? env.localAppData || join(homedir(), "AppData", "Local") : join(homedir(), ".cache")), "moltnet", "updates", "agent.json");
 }
 async function readCache() {
@@ -13488,16 +13391,14 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.61.0";
+var DAEMON_VERSION = "0.63.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {
+	const notice = legacyStoreNotice();
+	if (notice) console.error(notice);
 	const [subcommand, ...rest] = options.argv ?? process.argv.slice(2);
-	if ([
-		"poll",
-		"drain",
-		"serve"
-	].includes(subcommand ?? "") && !isWorkspaceInvocation()) checkDaemonUpdate({ currentVersion: DAEMON_VERSION }).then((update) => {
+	if (["poll", "drain"].includes(subcommand ?? "") && !isWorkspaceInvocation()) checkDaemonUpdate({ currentVersion: DAEMON_VERSION }).then((update) => {
 		if (update.updateAvailable) pino({ name: "moltnet.agent-daemon" }).info({
 			event: "agent-daemon.update_available",
 			update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -75,7 +75,6 @@
     "@opentelemetry/sdk-trace-base": "^2.5.1",
     "@opentelemetry/sdk-trace-node": "^2.5.1",
     "@opentelemetry/semantic-conventions": "^1.39.0",
-    "@peculiar/x509": "^2.0.0",
     "fastify": "^5.8.5",
     "fastify-plugin": "^5.1.0",
     "jose": "^6.1.3",
@@ -84,12 +83,11 @@
     "pino-opentelemetry-transport": "^3.0.0",
     "pino-pretty": "^13.1.3",
     "proper-lockfile": "4.1.2",
-    "reflect-metadata": "^0.2.2",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "1.2.0",
-    "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/pi-runtime": "0.18.2",
-    "@themoltnet/sdk": "0.144.0"
+    "@themoltnet/agent-runtime": "1.3.0",
+    "@themoltnet/pi-runtime": "0.18.3",
+    "@themoltnet/sdk": "0.145.0",
+    "@themoltnet/os-keyring": "0.4.0"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -100,12 +98,12 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/agent-eval": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/api-client": "0.1.0",
-    "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/execution-integrations": "0.1.0",
     "@moltnet/execution-plan": "0.1.0",
     "@moltnet/loopback-companion": "0.1.0",
+    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/models": "0.1.0",
     "@moltnet/observability": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
@@ -139,6 +137,8 @@
         "inputs": [
           "default",
           "^production",
+          "{workspaceRoot}/test-fixtures/agent-server-endpoint.json",
+          "{workspaceRoot}/test-fixtures/connection-state-root.json",
           "{workspaceRoot}/docs/operate/*.md",
           "{workspaceRoot}/docs/.vitepress/config.ts"
         ]
@@ -147,7 +147,7 @@
   },
   "scripts": {
     "cli": "tsx src/main.ts",
-    "dev": "tsx watch src/main.ts",
+    "dev": "tsx ../../tools/src/desktop-development.ts tsx watch src/main.ts",
     "start": "node dist/main.js",
     "build": "vite build",
     "generate:openapi": "tsx scripts/generate-openapi.ts",