@themoltnet/agent-daemon 0.63.1 → 0.64.0

package/dist/cli.js

@@ -9,9 +9,9 @@ import "multiformats/codecs/json";
 import "multiformats/hashes/sha2";
 import "typebox/value";
 import { execFile, spawn } from "node:child_process";
-import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { parseArgs, parseEnv, promisify } from "node:util";
-import { CredentialPersistenceError, EnrollmentRecoveryError, FILE_SECRET_PROVIDER, FileSecretProvider, ProjectConfigError, ProvisioningNotStartedError, RegisterIdentityError, WORKSPACE_STRATEGIES, boundedIdentitySignal, canonicalDirectory, canonicalStoreRoot, connect, createNodeSecretProviderRegistry, defaultStoreRoot, enrollTeam, getProjectConfigPath, isDefaultStore, readProjectConfig, register, resolveProjectBinding, resolveStoreRoot, resolveStoreSelection } from "@themoltnet/sdk/node";
+import { CredentialPersistenceError, EnrollmentRecoveryError, FILE_SECRET_PROVIDER, FileSecretProvider, ProjectConfigError, ProvisioningNotStartedError, RegisterIdentityError, WORKSPACE_STRATEGIES, boundedIdentitySignal, canonicalDirectory, canonicalStoreRoot, connect, createNodeSecretProviderRegistry, defaultStoreRoot, enrollTeam, getProjectConfigPath, isDefaultStore, normalizeProjectEndpoint, readProjectConfig, register, resolveProjectBinding, resolveStoreRoot, resolveStoreSelection, updateProjectConfig, validateProjectConfig } from "@themoltnet/sdk/node";
 import { constants, copyFileSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { AuthenticationError, IDENTITY_ALIAS_PATTERN, MoltNetError, assertIdentityAlias, assertTrustedConfigApiUrl, createExecutorAttestor, formatSecretReferenceString, getConfigDir, getIdentityDir, hasAgentKeyConfiguration, isCanonicalConfig, parseSecretReferenceString, readConfig, requireSecureCredentialApiUrl, resolveAgentKey, resolveEnvSecretReference, resolveIdentitySeed, selectAgentKeyReference, signBytes } from "@themoltnet/sdk";
 import { AgentRuntime, ApiTaskReporter, ApiTaskSource, PollingApiTaskSource, RuntimeProfilePrerequisiteError, createLocalSeedSigner, resolveAgentIdentity, resolveRuntimeProfile, resolveRuntimeProfiles, validateRuntimeProfilePrerequisites } from "@themoltnet/agent-runtime";
@@ -866,10 +866,8 @@ var OPERATOR_OAUTH = Object.freeze({
 	provisioningAudience: "moltnet:provisioning",
 	localControlAudience: "moltnet:agent-server",
 	nativeClientId: "moltnet-native",
-	consoleClientId: "moltnet-console",
 	approvalTransportGraceSeconds: 30,
 	callbackPort: 17375,
-	consoleLifetimeSeconds: 900,
 	nativeLifetimeSeconds: 300,
 	serverPort: 17374
 });
@@ -1548,7 +1546,9 @@ Type.Intersect([ConflictProblemDetailsSchema, Type.Object({ flagged: Type.Option
 	threats: Type.Array(Type.Ref("InjectionThreat"))
 }, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
 Type.Intersect([ProblemDetailsSchema, Type.Object({ errors: Type.Array(Type.Ref("ValidationError")) })], { $id: "ValidationProblemDetails" });
-Type.Object({
+//#endregion
+//#region ../../libs/models/src/projects.ts
+var ProjectResponseSchema = Type.Object({
 	id: Type.String({ format: "uuid" }),
 	teamId: Type.String({ format: "uuid" }),
 	creatorAgentId: Type.Union([Type.String({ format: "uuid" }), Type.Null()]),
@@ -3827,14 +3827,12 @@ function loadAgentServerEnvConfig(root) {
 	const issuer = process.env["MOLTNET_OPERATOR_OAUTH_ISSUER"];
 	const publicUrl = process.env["MOLTNET_OPERATOR_OAUTH_PUBLIC_URL"] ?? issuer;
 	const nativeClientId = process.env["MOLTNET_NATIVE_OAUTH_CLIENT_ID"];
-	const consoleClientId = process.env["MOLTNET_CONSOLE_OAUTH_CLIENT_ID"];
 	const apiUrl = process.env["MOLTNET_OPERATOR_API_URL"];
 	return {
 		operatorOAuth: {
 			...issuer ? { issuer } : {},
 			...publicUrl ? { publicUrl } : {},
 			...nativeClientId ? { nativeClientId } : {},
-			...consoleClientId ? { consoleClientId } : {},
 			...apiUrl ? { apiUrl } : {}
 		},
 		port: process.env["MOLTNET_AGENT_SERVER_PORT"] ?? "",
@@ -3862,7 +3860,8 @@ function loadUpdateEnvConfig(root) {
 var execFileAsync$1 = promisify(execFile);
 var GIT_TIMEOUT_MS = 1e4;
 var GIT_MAX_OUTPUT_BYTES = 64 * 1024;
-async function validateGitSource(source) {
+/** `signal` stops the `git` process; an abort is reported as an abort. */
+async function validateGitSource(source, signal) {
 	const inherited = processEnvSnapshot();
 	try {
 		const { stdout } = await execFileAsync$1("git", [
@@ -3880,15 +3879,37 @@ async function validateGitSource(source) {
 			},
 			timeout: GIT_TIMEOUT_MS,
 			killSignal: "SIGKILL",
-			maxBuffer: GIT_MAX_OUTPUT_BYTES
+			maxBuffer: GIT_MAX_OUTPUT_BYTES,
+			...signal ? { signal } : {}
 		});
 		const top = stdout.trim().split("\n")[0];
 		if (await canonicalDirectory(top) === source) return;
 	} catch (cause) {
+		if (signal?.aborted) throw cause;
 		throw new ProjectConfigError("selection", `git-worktree source ${source} requires a Git repository root with a committed revision: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
 	}
 	throw new ProjectConfigError("selection", `git-worktree source ${source} must be the Git repository root, not a subdirectory`);
 }
+/** Hooks that would run commands; an empty `hooks: {}` prepares nothing. */
+function hasPreparationHooks(hooks) {
+	return Boolean(hooks?.afterCreate || hooks?.beforeRun);
+}
+/**
+* The one rule for whether this runtime can prepare a location. Worker
+* selection, workspace policy and Desktop readiness all call it, so a location
+* Desktop shows as ready is one a worker can start.
+*/
+function preparationBlocker(strategy, hooks) {
+	if (strategy === "isolated-directory") return {
+		code: "unsupported_strategy",
+		message: "this runtime does not support isolated-directory preparation"
+	};
+	if (hasPreparationHooks(hooks)) return {
+		code: "hooks_unavailable",
+		message: "this runtime does not support project setup hooks"
+	};
+	return null;
+}
 function projectRunOptionDefs() {
 	return {
 		project: { type: "string" },
@@ -3900,13 +3921,16 @@ function projectRunOptionDefs() {
 		"workspace-strategy": { type: "string" }
 	};
 }
+/** Serialize for a worker; the inverse of parsing with `projectRunOptionDefs`. */
+function projectRunArgs(flags) {
+	return Object.entries(flags).flatMap(([name, value]) => value === void 0 || value === false ? [] : value === true ? [`--${name}`] : [`--${name}`, value]);
+}
 function strategy(value) {
 	if (value === void 0) return void 0;
 	if (WORKSPACE_STRATEGIES.includes(value)) return value;
 	throw new ProjectConfigError("validation", `Unknown workspace strategy ${value}; choose ${WORKSPACE_STRATEGIES.join(", ")}`);
 }
-/** Resolve once at worker startup. No credentials, remote calls, hooks or workspace creation. */
-async function resolveRunProjectSelection(args) {
+async function resolveRunProjectSelection(args, options = {}) {
 	const env = processEnvSnapshot();
 	const inherited = env.MOLTNET_ACTIVE_IDENTITY === args.agent && !args.general;
 	const bindingName = args.binding ?? (!args["config-file"] && !args.project && inherited ? env.MOLTNET_PROJECT_BINDING : void 0);
@@ -3938,8 +3962,10 @@ async function resolveRunProjectSelection(args) {
 	if (workspaceStrategy === "none" && args.source !== void 0) throw new ProjectConfigError("selection", "No-workspace execution cannot specify a source");
 	let source = binding?.source;
 	if (workspaceStrategy !== "none" && !source) source = await canonicalDirectory(resolve(args.cwd, args.source ?? "."));
-	if (workspaceStrategy === "isolated-directory" || binding?.hooks?.afterCreate || binding?.hooks?.beforeRun) throw new ProjectConfigError("selection", `Binding ${binding?.name ?? "(run override)"} in ${configPath}: this runtime does not support isolated-directory preparation or setup hooks; choose a supported binding`);
-	if (workspaceStrategy === "git-worktree" && source) await validateGitSource(source);
+	const blocker = preparationBlocker(workspaceStrategy, binding?.hooks);
+	if (blocker) throw new ProjectConfigError("selection", `Binding ${binding?.name ?? "(run override)"} in ${configPath}: ${blocker.message}; choose a supported binding`);
+	if (source && (binding || args.source !== void 0)) options.guardSource?.(source);
+	if (workspaceStrategy === "git-worktree" && source) await validateGitSource(source, options.signal);
 	return {
 		configPath,
 		selectedBy: args.binding || args.project ? "explicit" : bindingName ? "activation" : binding ? "ancestor" : "general",
@@ -3956,8 +3982,8 @@ async function resolveRunProjectSelection(args) {
 /** A selected location fixes this worker's strategy; saved profiles are never mutated. */
 function applyProjectWorkspacePolicy(profile, selection) {
 	if (!selection.workspaceExplicit) return profile;
-	if (selection.strategy === "isolated-directory") throw new Error("This runtime does not yet support isolated-directory preparation");
-	if (selection.binding?.hooks?.afterCreate || selection.binding?.hooks?.beforeRun) throw new Error("This runtime does not yet support project setup hooks");
+	const blocker = preparationBlocker(selection.strategy, selection.binding?.hooks);
+	if (blocker) throw new Error(`Workspace preparation: ${blocker.message}`);
 	const mode = selection.strategy === "existing" ? "shared_mount" : selection.strategy === "git-worktree" ? "dedicated_worktree" : "none";
 	if (profile.allowedWorkspaceModes.length && !profile.allowedWorkspaceModes.includes(mode)) throw new Error(`Workspace strategy ${selection.strategy} is not allowed by profile ${profile.name}`);
 	return {
@@ -5690,6 +5716,8 @@ function assertProviderEnvName(providerId, value) {
 	if (value !== expected) throw new AgentServerStoreError("invalid_state", `provider envName must be ${expected}`);
 	return value;
 }
+/** The run follows its runtime profile's own workspace mode. */
+var PROFILE_DEFAULT_STRATEGY = "profile-default";
 function readJson(path) {
 	let raw;
 	try {
@@ -9266,8 +9294,7 @@ var RELEASE_CONNECTION = {
 	apiUrl: "https://api.themolt.net",
 	issuer: "https://auth.themolt.net",
 	publicUrl: "https://auth.themolt.net",
-	nativeClientId: "moltnet-native",
-	consoleClientId: "moltnet-console"
+	nativeClientId: "moltnet-native"
 };
 var KEYS = Object.keys(RELEASE_CONNECTION);
 function validateConnectionOverrides(value) {
@@ -9564,7 +9591,7 @@ var OperatorOAuth = class {
 		const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
 		return new Promise((resolve, reject) => {
 			execFile(command, [url], (error) => {
-				if (error) reject(/* @__PURE__ */ new Error("Could not open Console approval"));
+				if (error) reject(/* @__PURE__ */ new Error("Could not open browser approval"));
 				else resolve();
 			});
 		});
@@ -9594,22 +9621,14 @@ var OperatorOAuth = class {
 	cancel() {
 		this.pending?.abort();
 	}
+	operatorConfigured() {
+		return this.operator !== null;
+	}
 	removeOperator() {
 		this.cancel();
 		rmSync(join(this.root, "operator.json"), { force: true });
 		this.operator = null;
 	}
-	metadata() {
-		return {
-			protocolVersion: OPERATOR_OAUTH.protocolVersion,
-			instance: this.instance,
-			issuer: this.config.issuer,
-			authorizationUrl: this.config.authorizationUrl,
-			tokenUrl: this.config.tokenUrl,
-			clientId: this.config.consoleClientId,
-			operatorConfigured: !!this.operator
-		};
-	}
 	async verify(token, scope, clientId) {
 		const { payload } = await jwtVerify(token, this.keys, {
 			algorithms: ["RS256"],
@@ -9620,7 +9639,7 @@ var OperatorOAuth = class {
 				"iat",
 				"sub"
 			],
-			maxTokenAge: clientId === this.config.nativeClientId ? OPERATOR_OAUTH.nativeLifetimeSeconds : OPERATOR_OAUTH.consoleLifetimeSeconds
+			maxTokenAge: OPERATOR_OAUTH.nativeLifetimeSeconds
 		});
 		const claims = payload.ext;
 		const scopes = typeof payload.scope === "string" ? payload.scope.split(" ") : payload.scp;
@@ -9631,10 +9650,6 @@ var OperatorOAuth = class {
 			provisioning: claims["moltnet:provisioning"]
 		};
 	}
-	async verifyBrowser(token) {
-		const operator = await this.verify(token, LOCAL_SCOPE, this.config.consoleClientId);
-		if (!this.operator || operator.issuer !== this.operator.issuer || operator.subject !== this.operator.subject) throw new InvalidOperatorGrantError("Native operator sign-in required");
-	}
 	async authorize(grant, signal) {
 		if (this.active) throw new Error("An approval is already pending");
 		this.active = true;
@@ -9688,9 +9703,9 @@ var OperatorOAuth = class {
 						...grant ? { provisioning: JSON.stringify(grant) } : {}
 					})) url.searchParams.set(key, value);
 					try {
-						Promise.resolve(this.openBrowser(url.href)).catch(() => reject(/* @__PURE__ */ new Error("Could not open Console approval")));
+						Promise.resolve(this.openBrowser(url.href)).catch(() => reject(/* @__PURE__ */ new Error("Could not open browser approval")));
 					} catch {
-						reject(/* @__PURE__ */ new Error("Could not open Console approval"));
+						reject(/* @__PURE__ */ new Error("Could not open browser approval"));
 					}
 				});
 			});
@@ -10101,6 +10116,94 @@ function snapshot(login) {
 	};
 }
 //#endregion
+//#region src/lib/agent-server/catalogue-project-reader.ts
+var PAGE_SIZE = 100;
+var ProjectPaginationError = class extends Error {
+	name = "ProjectPaginationError";
+};
+async function readCatalogueProjects(projects, teamId) {
+	const items = [];
+	let offset = 0;
+	for (let page = 0; page < 10; page++) {
+		const result = await projects.list({
+			includeArchived: false,
+			limit: PAGE_SIZE,
+			offset
+		}, { teamId });
+		items.push(...result.items);
+		if (result.nextOffset === null) return {
+			items,
+			truncated: false
+		};
+		if (!Number.isSafeInteger(result.nextOffset) || result.nextOffset <= offset) throw new ProjectPaginationError("Invalid project pagination offset");
+		offset = result.nextOffset;
+	}
+	return {
+		items,
+		truncated: true
+	};
+}
+/** One project by id; null when the credential cannot see it. */
+async function readCatalogueProject(projects, teamId, projectId) {
+	try {
+		return await projects.get(projectId, { teamId });
+	} catch (error) {
+		if (error instanceof MoltNetError && (error.statusCode === 403 || error.statusCode === 404)) return null;
+		throw error;
+	}
+}
+//#endregion
+//#region src/lib/agent-server/readiness.ts
+/**
+* Whether a runtime profile can execute on *this* machine.
+*
+* A profile is authored in Console against a team; whether it can run depends
+* on local facts only the server knows — which provider keys are configured
+* here and which runtime kinds this machine can produce.
+*
+* The prerequisite comparison itself is **not** reimplemented here. Run start
+* calls `validateRuntimeProfilePrerequisites`, and the catalogue calls the same
+* function, so the composer cannot promise a run that startup would reject for
+* a reason the two evaluated differently.
+*/
+function deriveProfileReadiness(profile, machine) {
+	const blockers = [];
+	const env = {};
+	for (const [name, configured] of machine.providerEnv) if (configured) env[name] = "configured";
+	try {
+		validateRuntimeProfilePrerequisites(profile, env, {
+			tools: machine.inventory?.tools ?? profile.requiredTools,
+			executables: machine.inventory?.executables ?? profile.requiredExecutables
+		});
+	} catch (error) {
+		if (!(error instanceof RuntimeProfilePrerequisiteError)) throw error;
+		for (const name of error.missingEnv) blockers.push({
+			code: "env_missing",
+			message: `${name} is not configured on this machine.`,
+			remedy: "Add the key under Providers, then reopen this run."
+		});
+		for (const name of error.missingTools) blockers.push({
+			code: "tool_missing",
+			message: `The runtime does not provide the tool ${name}.`,
+			remedy: `Use a profile whose runtime provides ${name}, or change the profile in Console.`
+		});
+		for (const name of error.missingExecutables) blockers.push({
+			code: "executable_missing",
+			message: `The runtime does not provide the executable ${name}.`,
+			remedy: `Use a runtime that ships ${name}, or drop the requirement in Console.`
+		});
+	}
+	if (!machine.runtimeKinds.has(profile.runtimeKind)) blockers.push({
+		code: "runtime_unregistered",
+		message: `Runtime kind ${profile.runtimeKind} is not available on this machine.`,
+		remedy: "Register the runtime under Runtimes, then reopen this run."
+	});
+	return {
+		ready: blockers.length === 0,
+		blockers
+	};
+}
+//#endregion
 //#region src/lib/agent-server/identity.ts
 /**
 * AgentServer identity activation (#2061/#1834 boundary).
@@ -10544,7 +10647,7 @@ async function verifyTeamActivation(store, alias, managed, external, connectImpl
 	if (missing.length) throw new TeamCredentialError({
 		code: "agent_key_scopes_insufficient",
 		message: `This credential lacks ${missing.join(", ")}.`,
-		remedy: "Renew through Console approval with the required desktop scopes."
+		remedy: "Renew through browser approval with the required desktop scopes."
 	});
 	activated.boundTeamId = teamId;
 	return captureTeamCredential(activated, {
@@ -10554,6 +10657,367 @@ async function verifyTeamActivation(store, alias, managed, external, connectImpl
 	});
 }
 //#endregion
+//#region src/lib/agent-server/catalogue.ts
+/**
+* The team/profile catalogue the desktop Run Center composes runs from.
+*
+* Scoped to the *selected agent identity*, never a human session: the daemon
+* already reads runtime profiles with agent credentials on every run, so this
+* reads the same data with the same authority, earlier. An agent-scoped list is
+* also authoritative about what can actually run, which a human-scoped list is
+* not — Console needs a "this agent cannot poll that team" error precisely
+* because it offers teams the agent cannot serve.
+*
+* Team and diary travel together here for the same reason `RunSpec` pairs
+* them: the CLI's context store refuses one without the other, and a diary
+* that drifts from its team means entries land in the wrong place.
+*/
+async function buildCatalogue(options) {
+	const { agent, machine, identityDefault, logger } = options;
+	const entries = await Promise.all(agent.teamIds.map(async (teamId) => {
+		try {
+			const result = await agent.readTeam(teamId);
+			if (result.team.id !== teamId) throw new Error("Team response mismatch");
+			const diaries = result.diaries.filter((diary) => diary.teamId === teamId).map(({ id, name }) => ({
+				id,
+				name
+			}));
+			const team = {
+				teamId,
+				teamName: result.team.name,
+				available: true,
+				blockers: [],
+				credential: result.credential,
+				diaries,
+				defaultDiaryId: resolveDefaultDiary(teamId, diaries, identityDefault)
+			};
+			const profiles = result.profiles.filter((profile) => profile.teamId === teamId).map((profile) => ({
+				...profile,
+				...deriveProfileReadiness(profile, machine)
+			}));
+			try {
+				const page = await agent.readProjects(teamId);
+				return {
+					team,
+					profiles,
+					projects: page.items.filter((project) => project.teamId === teamId && !project.archived),
+					projectErrors: page.truncated ? [{
+						teamId,
+						code: "truncated",
+						message: "Only the first projects are listed. Archive unused projects to see the rest."
+					}] : []
+				};
+			} catch (error) {
+				logger?.warn({
+					...safeErrorContext(error),
+					teamId,
+					code: "agent_server_project_discovery_failed"
+				}, "AgentServer project discovery failed");
+				return {
+					team,
+					profiles,
+					projects: [],
+					projectErrors: [projectError(teamId, error)]
+				};
+			}
+		} catch (error) {
+			const blocker = credentialBlocker(error);
+			logger?.warn({
+				...safeErrorContext(error),
+				teamId,
+				blocker: blocker.code,
+				code: "agent_server_team_unavailable"
+			}, "AgentServer team credential unavailable");
+			return {
+				team: {
+					teamId,
+					teamName: teamId,
+					available: false,
+					blockers: [blocker],
+					credential: agent.lastVerified(teamId),
+					diaries: [],
+					defaultDiaryId: null
+				},
+				profiles: [],
+				projects: [],
+				projectErrors: []
+			};
+		}
+	}));
+	const teams = entries.map(({ team }) => team);
+	const available = teams.filter((team) => team.available);
+	return {
+		teams,
+		defaultTeamId: available.find((team) => team.teamId === identityDefault.teamId)?.teamId ?? available[0]?.teamId ?? null,
+		profiles: entries.flatMap((entry) => entry.profiles),
+		projects: entries.flatMap((entry) => entry.projects),
+		projectErrors: entries.flatMap((entry) => entry.projectErrors)
+	};
+}
+function projectError(teamId, error) {
+	if (error instanceof MoltNetError && (error.statusCode === 401 || error.statusCode === 403)) return {
+		teamId,
+		code: "forbidden",
+		message: "This team credential cannot list projects. Renew it with project access."
+	};
+	if (error instanceof ProjectPaginationError) return {
+		teamId,
+		code: "invalid_response",
+		message: "The server returned an unreadable project list."
+	};
+	return {
+		teamId,
+		code: "unreachable",
+		message: "Projects could not be loaded. Retry project discovery."
+	};
+}
+/** The one default-diary rule, shared with General run start. */
+function resolveDefaultDiary(teamId, diaries, identityDefault) {
+	const bound = diaries.find((diary) => diary.id === identityDefault.diaryId);
+	if (bound && identityDefault.teamId === teamId) return bound.id;
+	return diaries.length === 1 ? diaries[0]?.id ?? null : null;
+}
+//#endregion
+//#region src/lib/agent-server/http-error.ts
+/** A route failure with a stable wire code; the server error handler maps it verbatim. */
+var AgentServerHttpError = class extends Error {
+	name = "AgentServerHttpError";
+	constructor(statusCode, code, message, options) {
+		super(message, options);
+		this.statusCode = statusCode;
+		this.code = code;
+	}
+};
+//#endregion
+//#region src/lib/agent-server/identity-binding.ts
+/**
+* The identity-wide team/diary binding, read from `<identityDir>/env`.
+*
+* This mirrors the Go CLI's `identityDefaultBinding` (`project_selection.go`),
+* which is the fallback the CLI uses when a working directory has no
+* registered project binding.
+*
+* The desktop cannot use the CLI's *location* bindings at all — its composer
+* has no working directory to key on — but it can honour this identity-wide
+* default, so an operator sees their familiar team preselected rather than an
+* arbitrary first entry.
+*
+* Like the CLI, a half-filled pair is treated as no binding: a team without a
+* diary is ignored.
+*/
+function readIdentityDefaultBinding(identityDir) {
+	let contents;
+	try {
+		contents = readFileSync(join(identityDir, "env"), "utf8");
+	} catch {
+		return {};
+	}
+	const env = parseEnv(contents);
+	const teamId = env["MOLTNET_TEAM_ID"]?.trim();
+	const diaryId = env["MOLTNET_DIARY_ID"]?.trim();
+	if (!teamId || !diaryId) return {};
+	return {
+		teamId,
+		diaryId
+	};
+}
+async function verifyProjectTarget(reader, target, options) {
+	const { signal, logger } = options;
+	let project = null;
+	let diary = null;
+	try {
+		await untilAborted(signal, async () => {
+			if (target.projectId) project = await reader.readProject(target.teamId, target.projectId, signal);
+			if (target.diaryId) diary = await reader.readDiary(target.teamId, target.diaryId, signal);
+		});
+	} catch (error) {
+		if (!signal.aborted) {
+			if (error instanceof TeamCredentialError) throw error;
+			if (notVisible(error)) throw projectUnavailable();
+		}
+		logger?.warn({
+			...safeErrorContext(error),
+			teamId: target.teamId,
+			...target.projectId ? { projectId: target.projectId } : {},
+			...target.diaryId ? { diaryId: target.diaryId } : {},
+			code: signal.aborted ? "agent_server_project_check_aborted" : "agent_server_project_check_failed"
+		}, "AgentServer project check failed");
+		throw checkUnavailable(error, signal.aborted);
+	}
+	const found = project;
+	if (target.projectId && (!found || found.id !== target.projectId || found.teamId !== target.teamId || found.archived)) throw projectUnavailable();
+	const foundDiary = diary;
+	if (target.diaryId && (!foundDiary || foundDiary.id !== target.diaryId || foundDiary.teamId !== target.teamId)) throw new AgentServerHttpError(400, "diary_unavailable", "Choose a diary belonging to this team");
+	return { project: found };
+}
+/** Null when the credential cannot see the resource; other failures propagate. */
+async function visibleOrNull(read) {
+	try {
+		return await read();
+	} catch (error) {
+		if (notVisible(error)) return null;
+		throw error;
+	}
+}
+/**
+* Settles when `work` does or `signal` aborts. The SDK's team, project and
+* diary reads take no signal, so an in-flight GET may finish in the background;
+* readers check the signal between steps so nothing further starts.
+*/
+async function untilAborted(signal, work) {
+	signal.throwIfAborted();
+	const aborted = new Promise((_, reject) => {
+		signal.addEventListener("abort", () => {
+			const reason = signal.reason;
+			reject(reason instanceof Error ? reason : new Error(String(reason)));
+		}, { once: true });
+	});
+	return Promise.race([work(), aborted]);
+}
+/** True only when `cause` is the abort itself, not a failure seen after it fired. */
+function causedByAbort(cause, signal) {
+	if (!signal.aborted) return false;
+	if (cause === signal.reason) return true;
+	const error = cause;
+	return error?.cause === signal.reason || error?.name === "AbortError" || error?.name === "TimeoutError";
+}
+function checkUnavailable(cause, timedOut) {
+	return new AgentServerHttpError(503, "project_check_unavailable", timedOut ? "The request could not be completed in time, so nothing was changed. Retry in a moment." : "The server could not confirm this project. Retry in a moment.", { cause });
+}
+function projectUnavailable() {
+	return new AgentServerHttpError(400, "project_unavailable", "Verify team access and choose an available project");
+}
+function notVisible(error) {
+	return error instanceof MoltNetError && [
+		401,
+		403,
+		404
+	].includes(error.statusCode ?? 0);
+}
+//#endregion
+//#region src/lib/agent-server/protected-roots.ts
+/**
+* A worker holds agent and provider keys, so neither a run nor a saved
+* location may use a folder inside, or containing, the MoltNet store or its
+* secrets. Both sides are compared canonically.
+*/
+function isProtectedFolder(source, roots) {
+	const folder = canonicalOrSelf(source);
+	return roots.some((root) => {
+		const protectedRoot = canonicalOrSelf(root);
+		return within(folder, protectedRoot) || within(protectedRoot, folder);
+	});
+}
+var PROTECTED_FOLDER_MESSAGE = "Choose a folder outside the MoltNet configuration store";
+function canonicalOrSelf(path) {
+	try {
+		return realpathSync.native(path);
+	} catch {
+		return path;
+	}
+}
+function within(child, parent) {
+	const suffix = relative(parent, child);
+	return suffix === "" || !isAbsolute(suffix) && suffix !== ".." && !suffix.startsWith(`..${sep}`);
+}
+//#endregion
+//#region src/lib/agent-server/managed-project-selection.ts
+/** True when the start request names any project selection field. */
+function requestsProjectSelection(spec) {
+	return spec.projectId !== void 0 || spec.location !== void 0 || spec.source !== void 0 || spec.strategy !== void 0;
+}
+/**
+* Resolve against the base store once; the worker receives only this captured
+* config. The request in `spec` is never modified: resolved values are
+* returned in `workspace` and `effective`, so a run can be replayed from what
+* the caller asked for.
+*/
+async function resolveManagedProjectSelection(options) {
+	const { spec, root, cwd, apiUrl, client, signal } = options;
+	if (spec.source !== void 0) {
+		if (!isAbsolute(spec.source)) throw new ProjectConfigError("selection", "Select an absolute source folder");
+		let canonical;
+		try {
+			canonical = await canonicalDirectory(spec.source);
+		} catch (cause) {
+			throw new ProjectConfigError("selection", "The selected folder is unavailable. Choose an existing folder.", { cause });
+		}
+		assertOutsideProtected(canonical, options.protectedRoots);
+	}
+	if (spec.projectId === null && spec.location) throw new ProjectConfigError("selection", "General work cannot also name a location");
+	const selection = await resolveRunProjectSelection({
+		agent: spec.agent,
+		cwd,
+		team: spec.teamId,
+		apiUrl,
+		"config-file": getProjectConfigPath({ root }),
+		general: !spec.projectId && !spec.location,
+		project: spec.projectId ?? void 0,
+		binding: spec.location,
+		source: spec.source,
+		"workspace-strategy": spec.strategy
+	}, {
+		signal,
+		guardSource: (source) => assertOutsideProtected(source, options.protectedRoots)
+	});
+	const chosenSource = selection.workspaceExplicit ? selection.source : void 0;
+	const reader = {
+		readProject: (teamId, projectId, readSignal) => {
+			readSignal.throwIfAborted();
+			return visibleOrNull(() => client.projects.get(projectId, { teamId }));
+		},
+		readDiary: (teamId, diaryId, readSignal) => {
+			readSignal.throwIfAborted();
+			return visibleOrNull(() => client.diaries.get(diaryId, { teamId }));
+		}
+	};
+	const check = {
+		signal,
+		...options.logger ? { logger: options.logger } : {}
+	};
+	const { project } = await verifyProjectTarget(reader, {
+		teamId: spec.teamId,
+		projectId: selection.projectId
+	}, check);
+	const diaryId = spec.diaryId ?? selection.binding?.diaryId ?? project?.defaultDiaryId ?? (selection.projectId === null ? await options.generalDefaultDiary?.() : void 0) ?? void 0;
+	if (diaryId) await verifyProjectTarget(reader, {
+		teamId: spec.teamId,
+		projectId: null,
+		diaryId
+	}, check);
+	const resolvedBinding = selection.binding ? {
+		...selection.binding,
+		...diaryId ? { diaryId } : {}
+	} : void 0;
+	const config = {
+		version: 1,
+		bindings: resolvedBinding ? [resolvedBinding] : []
+	};
+	const workspace = {
+		projectId: selection.projectId,
+		...resolvedBinding ? { location: resolvedBinding.name } : {},
+		...diaryId ? { diaryId } : {},
+		...chosenSource ? { source: chosenSource } : {},
+		strategy: selection.workspaceExplicit ? selection.strategy : PROFILE_DEFAULT_STRATEGY
+	};
+	return {
+		selection: {
+			...selection,
+			binding: resolvedBinding
+		},
+		workspace,
+		config,
+		effective: {
+			...spec,
+			projectId: selection.projectId,
+			...diaryId ? { diaryId } : {}
+		}
+	};
+}
+function assertOutsideProtected(source, roots) {
+	if (isProtectedFolder(source, roots)) throw new ProjectConfigError("selection", PROTECTED_FOLDER_MESSAGE);
+}
+//#endregion
 //#region src/lib/agent-server/runs.ts
 var STOP_GRACE_MS = 1e4;
 var STOP_FORCE_MS = 2e3;
@@ -10642,7 +11106,7 @@ var RunManager = class {
 		};
 	}
 	/** Assemble child env + args for a run. Exposed for tests. */
-	async prepare(spec, agent, piDir, providers = this.store.readProviders(), runtimeModule) {
+	async prepare(spec, agent, piDir, providers = this.store.readProviders(), runtimeModule, workspace) {
 		const { activation, config } = agent;
 		const homeDir = join(dirname(piDir), "home");
 		const env = {
@@ -10687,7 +11151,16 @@ var RunManager = class {
 			String(runtimeSettings.heartbeatIntervalMs),
 			"--warm-retention-sec",
 			String(runtimeSettings.warmRetentionSec),
-			...target.extraArgs
+			...target.extraArgs,
+			...workspace ? projectRunArgs({
+				"config-file": workspace.configPath,
+				...workspace.location ? { binding: workspace.location } : { general: true },
+				...workspace.strategy === "profile-default" ? {} : {
+					source: workspace.source,
+					"workspace-strategy": workspace.strategy
+				},
+				"state-dir": this.runStateDir(spec, workspace)
+			}) : []
 		];
 		env["MOLTNET_AGENT_KEY"] = requireCredentialSnapshot(agent).agentKey;
 		env["MOLTNET_API_URL"] = activation.apiUrl ?? (activation.source === "external" ? activation.configApiUrl : "");
@@ -10718,10 +11191,11 @@ var RunManager = class {
 		return {
 			args,
 			env,
-			cwd: target.cwd
+			cwd: workspace?.source ?? (workspace ? join(dirname(piDir), "workspace") : target.cwd)
 		};
 	}
 	async start(spec, signal) {
+		spec = structuredClone(spec);
 		validateRunSpec(spec);
 		const releaseStart = this.reserveStart(spec.agent);
 		try {
@@ -10732,24 +11206,65 @@ var RunManager = class {
 	}
 	async startReserved(spec, signal) {
 		this.assertStartOpen(signal);
-		const agent = await (this.options.verifyActivationImpl ?? verifyTeamActivation)(this.store, spec.agent, this.options.secretProviders, this.options.externalSecretProviders, void 0, signal, spec.teamId).catch((cause) => {
+		const deadline = AbortSignal.any([...signal ? [signal] : [], AbortSignal.timeout(this.options.startTimeoutMs ?? 1e4)]);
+		const verify = this.options.verifyActivationImpl ?? verifyTeamActivation;
+		const agent = await untilAborted(deadline, () => verify(this.store, spec.agent, this.options.secretProviders, this.options.externalSecretProviders, void 0, deadline, spec.teamId)).catch((cause) => {
+			this.assertStartOpen(signal, deadline, cause);
 			if (cause instanceof TeamCredentialError || cause instanceof AgentServerStoreError) throw cause;
 			throw new AgentServerIdentityError("verification_failed", `Cannot start agent "${spec.agent}" for team "${spec.teamId}": credential verification failed. Check the selected team key and activation.`);
 		});
-		this.assertStartOpen(signal);
+		this.assertStartOpen(signal, deadline);
 		if (agent.boundTeamId && agent.boundTeamId !== spec.teamId) throw new AgentServerRunError("invalid_spec", `agent "${spec.agent}" has a key bound to team ${agent.boundTeamId}; start the run with that team, or create a new agent with an enrollment token from team ${spec.teamId}`);
 		const id = `${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
-		const runDir = this.store.runDir(id);
+		const runDir = resolve(this.store.runDir(id));
 		const piDir = join(runDir, "pi");
-		const providers = this.store.readProviders();
-		const runtimeModule = this.options.resolveRuntimeModule ? await this.options.resolveRuntimeModule(spec, agent, dirname(piDir)) : this.options.runtimeRegistry ? await this.resolveRuntimeModule(spec, agent, dirname(piDir)) : void 0;
-		const { args, env, cwd } = await this.prepare(spec, agent, piDir, providers, runtimeModule);
-		this.assertStartOpen(signal);
 		let child;
 		let logStream;
 		let logLimiter;
+		let workspace;
+		let effective = spec;
+		let selection;
 		try {
 			const { logPath } = this.store.createRunDir(id);
+			const executionDir = join(runDir, "workspace");
+			if (requestsProjectSelection(spec)) {
+				mkdirSync(executionDir, {
+					recursive: true,
+					mode: 448
+				});
+				const projectRoot = this.options.projectRoot ?? this.store.root;
+				const resolved = await resolveManagedProjectSelection({
+					spec,
+					root: projectRoot,
+					cwd: executionDir,
+					apiUrl: agent.activation.apiUrl ?? agent.config.endpoints.api,
+					client: requireCredentialSnapshot(agent).client,
+					protectedRoots: [
+						projectRoot,
+						this.store.root,
+						this.store.secretsDir
+					],
+					signal: deadline,
+					logger: { warn: (context, message) => this.log("warn", message, context) },
+					generalDefaultDiary: () => this.generalDefaultDiary(spec, agent, deadline)
+				});
+				workspace = {
+					...resolved.workspace,
+					configPath: join(runDir, "projects.json")
+				};
+				effective = resolved.effective;
+				selection = resolved.selection;
+				writeRunSnapshot(workspace.configPath, resolved.config);
+				mkdirSync(this.runStateDir(spec, workspace), {
+					recursive: true,
+					mode: 448
+				});
+			}
+			const providers = this.store.readProviders();
+			const executionCwd = workspace ? workspace.source ?? executionDir : dirname(piDir);
+			const runtimeModule = await untilAborted(deadline, async () => this.options.resolveRuntimeModule ? this.options.resolveRuntimeModule(effective, agent, executionCwd) : this.options.runtimeRegistry ? this.resolveRuntimeModule(effective, agent, executionCwd, selection) : void 0);
+			const { args, env, cwd } = await this.prepare(effective, agent, piDir, providers, runtimeModule, workspace);
+			this.assertStartOpen(signal, deadline);
 			for (const dir of [
 				env.HOME,
 				env.XDG_CACHE_HOME,
@@ -10780,7 +11295,7 @@ var RunManager = class {
 				child?.kill("SIGKILL");
 			});
 			const spawnImpl = this.options.spawnImpl ?? spawn;
-			this.assertStartOpen(signal);
+			this.assertStartOpen(signal, deadline);
 			child = spawnImpl(entry.execPath, [
 				...entry.execArgv,
 				entry.scriptPath,
@@ -10808,6 +11323,7 @@ var RunManager = class {
 			child.stderr?.pipe(logLimiter, { end: false });
 			const record = {
 				...spec,
+				...workspace ? { workspace } : {},
 				id,
 				status: "running",
 				pid: child.pid,
@@ -10850,6 +11366,7 @@ var RunManager = class {
 			this.store.writeRun(record);
 			this.log("info", "agent server run started", {
 				...runContext(id, spec.agent, child),
+				...selectionContext(spec, workspace),
 				transition: "running"
 			});
 			return record;
@@ -10864,20 +11381,29 @@ var RunManager = class {
 			});
 			this.log("error", "agent server run failed to start", {
 				...runContext(id, spec.agent, child),
+				...selectionContext(spec, workspace),
 				transition: "start_failed",
 				...safeRunError(cause)
 			});
+			if (!signal?.aborted && !this.closing && !(cause instanceof AgentServerHttpError) && causedByAbort(cause, deadline)) throw startTimedOut(cause);
 			throw cause;
 		}
 	}
-	async resolveRuntimeModule(spec, activated, cwd) {
-		const profiles = await resolveRuntimeProfiles({
+	async resolveRuntimeModule(spec, activated, cwd, selection) {
+		const effectiveProfiles = (await resolveRuntimeProfiles({
 			agent: await this.connectAgent(activated, spec.teamId),
 			profiles: spec.profiles,
 			teamId: spec.teamId,
 			cwd
+		})).map((profile) => {
+			if (!selection) return profile;
+			try {
+				return applyProjectWorkspacePolicy(profile, selection);
+			} catch (error) {
+				throw new AgentServerRunError("invalid_spec", error instanceof Error ? error.message : "This profile does not support the selected workspace strategy");
+			}
 		});
-		const kinds = [...new Set(profiles.map((profile) => profile.runtimeKind))];
+		const kinds = [...new Set(effectiveProfiles.map((profile) => profile.runtimeKind))];
 		if (kinds.length !== 1) throw new AgentServerRunError("invalid_spec", "All profiles in a server-managed run must use the same runtime kind.");
 		const kind = kinds[0];
 		let registration;
@@ -11022,8 +11548,10 @@ var RunManager = class {
 			else this.startingByAgent.delete(agent);
 		};
 	}
-	assertStartOpen(signal) {
+	/** Shutdown or disconnect wins; otherwise an expired budget is a retryable 503. */
+	assertStartOpen(signal, deadline, cause) {
 		if (this.closing || signal?.aborted) throw new AgentServerRunError("invalid_spec", "agent server is shutting down");
+		if (deadline?.aborted && (cause === void 0 || causedByAbort(cause, deadline))) throw startTimedOut(cause);
 	}
 	pruneCompletedRuns() {
 		const removed = this.store.pruneCompletedRuns({
@@ -11055,11 +11583,41 @@ var RunManager = class {
 			});
 		}
 	}
-	log(level, message, context) {
-		this.options.logger?.[level](context, message);
-	}
-};
-function createByteLimitTransform(limit, onTruncated) {
+	/**
+	* Same rule as the catalogue. Best effort: without it the worker resolves its
+	* own diary, as it did before project selection existed.
+	*/
+	async generalDefaultDiary(spec, agent, deadline) {
+		try {
+			const { items } = await untilAborted(deadline, () => requireCredentialSnapshot(agent).client.diaries.list());
+			return resolveDefaultDiary(spec.teamId, items.filter((diary) => diary.teamId === spec.teamId), readIdentityDefaultBinding(this.store.identityDir(spec.agent))) ?? void 0;
+		} catch (error) {
+			this.log("warn", "agent server default diary lookup failed", {
+				...safeRunError(error),
+				agent: spec.agent,
+				teamId: spec.teamId
+			});
+			return;
+		}
+	}
+	/**
+	* Stable across runs, so retries and continuations find their execution-plan
+	* cache and task workspaces. Keyed by agent and location, under the store,
+	* never inside the user's folder.
+	*/
+	runStateDir(spec, workspace) {
+		const scope = createHash("sha256").update(JSON.stringify([
+			spec.teamId,
+			workspace.projectId,
+			workspace.source ?? null
+		])).digest("hex").slice(0, 12);
+		return join(this.store.root, "run-state", spec.agent, `${workspace.location ? locationSegment(workspace.location) : "general"}-${scope}`);
+	}
+	log(level, message, context) {
+		this.options.logger?.[level](context, message);
+	}
+};
+function createByteLimitTransform(limit, onTruncated) {
 	const byteLimit = Math.max(0, Math.floor(limit));
 	const contentLimit = Math.max(0, byteLimit - LOG_TRUNCATION_MARKER.length);
 	let emitted = 0;
@@ -11082,6 +11640,33 @@ function createByteLimitTransform(limit, onTruncated) {
 		callback();
 	} });
 }
+/** Non-secret ids that tie a run's logs to its project selection. */
+function selectionContext(spec, workspace) {
+	return {
+		...spec.projectId !== void 0 ? { requestedProjectId: spec.projectId } : {},
+		...spec.location ? { requestedLocation: spec.location } : {},
+		...workspace ? {
+			projectId: workspace.projectId,
+			...workspace.location ? { location: workspace.location } : {},
+			...workspace.diaryId ? { diaryId: workspace.diaryId } : {},
+			strategy: workspace.strategy
+		} : {}
+	};
+}
+/** Readable when it is a safe path segment; hashed otherwise. */
+function locationSegment(name) {
+	return /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(name) ? `location-${name}` : `location-${createHash("sha256").update(name).digest("hex").slice(0, 16)}`;
+}
+function startTimedOut(cause) {
+	return new AgentServerHttpError(503, "start_timeout", "The run could not be prepared in time, so it was not started. Retry in a moment.", { cause });
+}
+/** Created exclusively and owner-only: a run never reuses or widens a snapshot. */
+function writeRunSnapshot(path, config) {
+	writeFileSync(path, JSON.stringify(config), {
+		mode: 384,
+		flag: "wx"
+	});
+}
 function runContext(runId, agent, child) {
 	return {
 		runId,
@@ -11309,112 +11894,6 @@ function createAgentServerSecretProviders(settings, store) {
 	};
 }
 //#endregion
-//#region src/lib/agent-server/readiness.ts
-/**
-* Whether a runtime profile can execute on *this* machine.
-*
-* A profile is authored in Console against a team; whether it can run depends
-* on local facts only the server knows — which provider keys are configured
-* here and which runtime kinds this machine can produce.
-*
-* The prerequisite comparison itself is **not** reimplemented here. Run start
-* calls `validateRuntimeProfilePrerequisites`, and the catalogue calls the same
-* function, so the composer cannot promise a run that startup would reject for
-* a reason the two evaluated differently.
-*/
-function deriveProfileReadiness(profile, machine) {
-	const blockers = [];
-	const env = {};
-	for (const [name, configured] of machine.providerEnv) if (configured) env[name] = "configured";
-	try {
-		validateRuntimeProfilePrerequisites(profile, env, {
-			tools: machine.inventory?.tools ?? profile.requiredTools,
-			executables: machine.inventory?.executables ?? profile.requiredExecutables
-		});
-	} catch (error) {
-		if (!(error instanceof RuntimeProfilePrerequisiteError)) throw error;
-		for (const name of error.missingEnv) blockers.push({
-			code: "env_missing",
-			message: `${name} is not configured on this machine.`,
-			remedy: "Add the key under Providers, then reopen this run."
-		});
-		for (const name of error.missingTools) blockers.push({
-			code: "tool_missing",
-			message: `The runtime does not provide the tool ${name}.`,
-			remedy: `Use a profile whose runtime provides ${name}, or change the profile in Console.`
-		});
-		for (const name of error.missingExecutables) blockers.push({
-			code: "executable_missing",
-			message: `The runtime does not provide the executable ${name}.`,
-			remedy: `Use a runtime that ships ${name}, or drop the requirement in Console.`
-		});
-	}
-	if (!machine.runtimeKinds.has(profile.runtimeKind)) blockers.push({
-		code: "runtime_unregistered",
-		message: `Runtime kind ${profile.runtimeKind} is not available on this machine.`,
-		remedy: "Register the runtime under Runtimes, then reopen this run."
-	});
-	return {
-		ready: blockers.length === 0,
-		blockers
-	};
-}
-//#endregion
-//#region src/lib/agent-server/catalogue.ts
-async function buildCatalogue(options) {
-	const { agent, machine, identityDefault } = options;
-	const entries = await Promise.all(agent.teamIds.map(async (teamId) => {
-		try {
-			const result = await agent.readTeam(teamId);
-			if (result.team.id !== teamId) throw new Error("Team response mismatch");
-			const diaries = result.diaries.filter((diary) => diary.teamId === teamId).map(({ id, name }) => ({
-				id,
-				name
-			}));
-			return {
-				team: {
-					teamId,
-					teamName: result.team.name,
-					available: true,
-					blockers: [],
-					credential: result.credential,
-					diaries,
-					defaultDiaryId: resolveDefaultDiary(teamId, diaries, identityDefault)
-				},
-				profiles: result.profiles.filter((profile) => profile.teamId === teamId).map((profile) => ({
-					...profile,
-					...deriveProfileReadiness(profile, machine)
-				}))
-			};
-		} catch (error) {
-			return {
-				team: {
-					teamId,
-					teamName: teamId,
-					available: false,
-					blockers: [credentialBlocker(error)],
-					credential: agent.lastVerified(teamId),
-					diaries: [],
-					defaultDiaryId: null
-				},
-				profiles: []
-			};
-		}
-	}));
-	const teams = entries.map(({ team }) => team);
-	const available = teams.filter((team) => team.available);
-	return {
-		teams,
-		defaultTeamId: available.find((team) => team.teamId === identityDefault.teamId)?.teamId ?? available[0]?.teamId ?? null,
-		profiles: entries.flatMap((entry) => entry.profiles)
-	};
-}
-function resolveDefaultDiary(teamId, diaries, identityDefault) {
-	const bound = diaries.find((diary) => diary.id === identityDefault.diaryId);
-	if (bound && identityDefault.teamId === teamId) return bound.id;
-	return diaries.length === 1 ? diaries[0]?.id ?? null : null;
-}
-//#endregion
 //#region src/lib/agent-server/enrollment.ts
 /** Native callers receive metadata only; approval and storage stay local. */
 async function enrollIdentityTeam(options) {
@@ -11499,37 +11978,139 @@ async function enrollIdentityTeam(options) {
 	}
 }
 //#endregion
-//#region src/lib/agent-server/identity-binding.ts
+//#region src/lib/agent-server/project-bindings.ts
+/** Each check may spawn `git`; bound how many run at once. */
+var READINESS_CONCURRENCY = 4;
+var PREPARATION_COPY = {
+	unsupported_strategy: "Isolated directory preparation is unavailable. Choose Work here or a Git worktree.",
+	hooks_unavailable: "Preparation hooks are unavailable. Remove the hooks or choose another location."
+};
+/** Normalize with the Go-compatible grammar, reporting a rejection as a coded error. */
+function locationEndpoint(value) {
+	try {
+		return normalizeProjectEndpoint(value);
+	} catch {
+		throw new AgentServerHttpError(400, "endpoint_unsupported", "Local project locations need an HTTPS server endpoint; HTTP is allowed only on loopback");
+	}
+}
+/** Machine registrations live at the base store, outside connection directories. */
+var LocalProjectBindings = class {
+	root;
+	path;
+	apiUrl;
+	/** `protectedRoots`: store and secrets directories no location may use. */
+	constructor(root, apiUrl, protectedRoots = []) {
+		this.protectedRoots = protectedRoots;
+		this.root = resolveStoreRoot({ root });
+		this.path = getProjectConfigPath({ root: this.root });
+		this.apiUrl = locationEndpoint(apiUrl);
+	}
+	async list() {
+		const bindings = (await stored(() => readProjectConfig(this.path))).bindings.filter((binding) => normalizeProjectEndpoint(binding.apiUrl) === this.apiUrl);
+		const locations = [];
+		for (let i = 0; i < bindings.length; i += READINESS_CONCURRENCY) locations.push(...await Promise.all(bindings.slice(i, i + READINESS_CONCURRENCY).map((binding) => this.describe(binding))));
+		return locations;
+	}
+	/** Once `signal` aborts, nothing is written, not even after the lock is taken. */
+	async save(value, options = {}) {
+		const input = structuredClone(value);
+		validateProjectConfig({
+			version: 1,
+			bindings: [input]
+		});
+		if (locationEndpoint(input.apiUrl) !== this.apiUrl) throw new AgentServerHttpError(400, "endpoint_mismatch", "Location belongs to another endpoint");
+		if (input.source && !isAbsolute(input.source)) throw new ProjectConfigError("validation", "Select an absolute source folder");
+		const location = await this.describe(input, options.signal);
+		if (!location.readiness.ready) throw new AgentServerHttpError(400, location.readiness.code ?? "location_unavailable", location.readiness.message ?? "Location is unavailable");
+		const binding = {
+			...input,
+			apiUrl: this.apiUrl,
+			...location.effectiveSource ? { source: location.effectiveSource } : {}
+		};
+		options.signal?.throwIfAborted();
+		await this.update((config) => {
+			options.signal?.throwIfAborted();
+			const index = config.bindings.findIndex((entry) => entry.name === binding.name);
+			const previous = config.bindings[index];
+			if (previous && normalizeProjectEndpoint(previous.apiUrl) !== this.apiUrl) throw conflict("This name belongs to another endpoint");
+			if (previous && hasPreparationHooks(previous.hooks)) throw conflict("Remove preparation hooks from the configuration before editing this location");
+			if (previous && (previous.teamId !== binding.teamId || previous.projectId !== binding.projectId)) throw conflict("This name belongs to another project");
+			if (binding.default) {
+				for (const entry of config.bindings) if (normalizeProjectEndpoint(entry.apiUrl) === this.apiUrl && entry.teamId === binding.teamId && entry.projectId === binding.projectId) entry.default = false;
+			}
+			if (index < 0) config.bindings.push(binding);
+			else config.bindings[index] = binding;
+		});
+		return this.describe(binding);
+	}
+	async remove(name) {
+		await this.update((config) => {
+			const index = config.bindings.findIndex((entry) => entry.name === name && normalizeProjectEndpoint(entry.apiUrl) === this.apiUrl);
+			if (index < 0) throw new AgentServerHttpError(404, "location_not_found", "Location not found");
+			config.bindings.splice(index, 1);
+		});
+	}
+	update(mutate) {
+		return stored(() => updateProjectConfig(this.path, mutate));
+	}
+	async describe(binding, signal) {
+		const { effectiveSource, readiness } = await this.readiness(binding, signal);
+		return {
+			...binding,
+			effectiveSource,
+			readiness
+		};
+	}
+	async readiness(binding, signal) {
+		const declared = binding.source ? resolve(this.root, binding.source) : null;
+		const unavailable = (code, message, effectiveSource = declared) => ({
+			effectiveSource,
+			readiness: {
+				ready: false,
+				code,
+				message
+			}
+		});
+		const blocker = preparationBlocker(binding.strategy, binding.hooks);
+		if (blocker) return unavailable(blocker.code, PREPARATION_COPY[blocker.code]);
+		if (binding.strategy === "none") return {
+			effectiveSource: declared,
+			readiness: { ready: true }
+		};
+		if (!declared) return unavailable("folder_missing", "Choose an existing source folder.");
+		let source;
+		try {
+			source = await canonicalDirectory(declared);
+		} catch {
+			return unavailable("folder_missing", "The source folder is unavailable. Choose an existing folder.");
+		}
+		if (isProtectedFolder(source, this.protectedRoots)) return unavailable("folder_protected", `${PROTECTED_FOLDER_MESSAGE}.`, source);
+		if (binding.strategy === "git-worktree") try {
+			await validateGitSource(source, signal);
+		} catch (cause) {
+			if (signal?.aborted) throw cause;
+			return unavailable("git_unavailable", "Choose a Git repository root with a committed revision, or choose Work here.", source);
+		}
+		return {
+			effectiveSource: source,
+			readiness: { ready: true }
+		};
+	}
+};
 /**
-* The identity-wide team/diary binding, read from `<identityDir>/env`.
-*
-* This mirrors the Go CLI's `identityDefaultBinding` (`project_selection.go`),
-* which is the fallback the CLI uses when a working directory has no
-* registered project binding.
-*
-* The desktop cannot use the CLI's *location* bindings at all — its composer
-* has no working directory to key on — but it can honour this identity-wide
-* default, so an operator sees their familiar team preselected rather than an
-* arbitrary first entry.
-*
-* Like the CLI, a half-filled pair is treated as no binding: a team without a
-* diary is ignored.
+* A stored file that fails validation is server-side state, not a bad request.
+* The detail names a local path, so it goes to the logs via `cause`.
 */
-function readIdentityDefaultBinding(identityDir) {
-	let contents;
+async function stored(work) {
 	try {
-		contents = readFileSync(join(identityDir, "env"), "utf8");
-	} catch {
-		return {};
+		return await work();
+	} catch (error) {
+		if (error instanceof ProjectConfigError && error.kind === "validation") throw new AgentServerHttpError(500, "config_invalid", "The project locations file is invalid. Repair or remove it, then retry.", { cause: error });
+		throw error;
 	}
-	const env = parseEnv(contents);
-	const teamId = env["MOLTNET_TEAM_ID"]?.trim();
-	const diaryId = env["MOLTNET_DIARY_ID"]?.trim();
-	if (!teamId || !diaryId) return {};
-	return {
-		teamId,
-		diaryId
-	};
+}
+function conflict(message) {
+	return new AgentServerHttpError(409, "location_conflict", message);
 }
 //#endregion
 //#region src/lib/agent-server/protocol.ts
@@ -11631,10 +12212,83 @@ var AgentServerCatalogueProfileSchema = Type.Intersect([Type.Pick(RuntimeProfile
 var AgentServerCatalogueSchema = Type.Object({
 	teams: Type.Array(schemaRef(AgentServerCatalogueTeamSchema)),
 	defaultTeamId: Type.Union([Type.String(), Type.Null()]),
-	profiles: Type.Array(schemaRef(AgentServerCatalogueProfileSchema))
+	profiles: Type.Array(schemaRef(AgentServerCatalogueProfileSchema)),
+	projects: Type.Array(Type.Pick(ProjectResponseSchema, [
+		"id",
+		"teamId",
+		"name",
+		"description",
+		"defaultDiaryId",
+		"archived"
+	])),
+	projectErrors: Type.Array(Type.Object({
+		teamId: Type.String(),
+		code: Type.Union([
+			"forbidden",
+			"unreachable",
+			"invalid_response",
+			"truncated"
+		].map((value) => Type.Literal(value))),
+		message: Type.String()
+	}))
 }, { $id: "AgentServerCatalogue" });
 var CatalogueQuerySchema = Type.Object({ identity: Type.String({ minLength: 1 }) });
+var AgentServerProjectLocationSchema = Type.Object({
+	name: Type.String({ minLength: 1 }),
+	apiUrl: Type.String(),
+	teamId: Type.String({ minLength: 1 }),
+	projectId: Type.String({ minLength: 1 }),
+	diaryId: Type.Optional(Type.String({ minLength: 1 })),
+	source: Type.Optional(Type.String({ minLength: 1 })),
+	strategy: Type.Union([
+		"none",
+		"existing",
+		"git-worktree",
+		"isolated-directory"
+	].map((value) => Type.Literal(value))),
+	default: Type.Optional(Type.Boolean()),
+	effectiveSource: Type.Union([Type.String(), Type.Null()]),
+	readiness: Type.Object({
+		ready: Type.Boolean(),
+		code: Type.Optional(Type.String()),
+		message: Type.Optional(Type.String())
+	})
+}, { $id: "AgentServerProjectLocation" });
+/** Closed: hooks and other stored fields are never writable over this route. */
+var SaveProjectLocationSchema = Type.Object({
+	identity: Type.String({ minLength: 1 }),
+	teamId: Type.String({ minLength: 1 }),
+	projectId: Type.String({ minLength: 1 }),
+	diaryId: Type.Optional(Type.String({ minLength: 1 })),
+	source: Type.Optional(Type.String({ minLength: 1 })),
+	strategy: Type.Union([
+		"none",
+		"existing",
+		"git-worktree"
+	].map((value) => Type.Literal(value))),
+	default: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+var ProjectLocationParamsSchema = Type.Object({ name: Type.String({ minLength: 1 }) });
+/** Local project selection on a run request; only the native client may set these. */
+var RunProjectFields = {
+	projectId: Type.Optional(Type.Union([Type.String({ minLength: 1 }), Type.Null()])),
+	location: Type.Optional(Type.String({ minLength: 1 })),
+	source: Type.Optional(Type.String({ minLength: 1 })),
+	strategy: Type.Optional(AgentServerProjectLocationSchema.properties.strategy)
+};
+/** Names gated to the native client; derived so a new field is gated automatically. */
+var NATIVE_RUN_FIELDS = Object.keys(RunProjectFields);
+/** What a run resolved to; the record's top-level fields stay as requested. */
+var RunWorkspaceSchema = Type.Object({
+	projectId: Type.Union([Type.String(), Type.Null()]),
+	location: Type.Optional(Type.String()),
+	diaryId: Type.Optional(Type.String()),
+	source: Type.Optional(Type.String()),
+	strategy: Type.Union([AgentServerProjectLocationSchema.properties.strategy, Type.Literal(PROFILE_DEFAULT_STRATEGY)])
+});
 var AgentServerRunRecordSchema = Type.Object({
+	...RunProjectFields,
+	workspace: Type.Optional(RunWorkspaceSchema),
 	id: Type.String(),
 	agent: Type.String(),
 	teamId: Type.String(),
@@ -11714,6 +12368,7 @@ var PutProviderSchema = Type.Object({
 });
 var DiscoverModelsSchema = Type.Object({ models: ProviderModelList }, { $id: "DiscoveredModels" });
 var StartRunSchema = Type.Object({
+	...RunProjectFields,
 	agent: Type.String(),
 	teamId: Type.String(),
 	diaryId: Type.Optional(Type.String()),
@@ -11730,6 +12385,7 @@ var LogStreamSchema = Type.String({
 	contentMediaType: "text/event-stream"
 });
 var AGENT_SERVER_SCHEMAS = [
+	AgentServerProjectLocationSchema,
 	AgentServerHealthSchema,
 	AgentServerProblemSchema,
 	AgentServerAgentSchema,
@@ -11752,6 +12408,39 @@ var AGENT_SERVER_SCHEMAS = [
 var localControlSecurity = [{ agentServerToken: [] }];
 var problemResponse = { default: schemaRef(AgentServerProblemSchema) };
 var AgentServerRouteSchemas = {
+	listProjectLocations: {
+		operationId: "listNativeProjectLocations",
+		tags: ["native-projects"],
+		security: localControlSecurity,
+		description: "Requires the Desktop native grant; browser authorization is insufficient.",
+		response: {
+			200: Type.Object({ locations: Type.Array(schemaRef(AgentServerProjectLocationSchema)) }),
+			...problemResponse
+		}
+	},
+	saveProjectLocation: {
+		operationId: "saveNativeProjectLocation",
+		tags: ["native-projects"],
+		security: localControlSecurity,
+		description: "Creates or replaces the named location. Requires the Desktop native grant.",
+		params: ProjectLocationParamsSchema,
+		body: SaveProjectLocationSchema,
+		response: {
+			200: schemaRef(AgentServerProjectLocationSchema),
+			...problemResponse
+		}
+	},
+	removeProjectLocation: {
+		operationId: "removeNativeProjectLocation",
+		tags: ["native-projects"],
+		security: localControlSecurity,
+		description: "Removes the registration only; the folder is left untouched. Requires the Desktop native grant.",
+		params: ProjectLocationParamsSchema,
+		response: {
+			200: Type.Object({ removed: Type.Boolean() }),
+			...problemResponse
+		}
+	},
 	health: {
 		operationId: "getAgentServerHealth",
 		tags: ["system"],
@@ -11925,6 +12614,7 @@ var AgentServerRouteSchemas = {
 		operationId: "startAgentServerRun",
 		tags: ["runs"],
 		security: localControlSecurity,
+		description: "projectId (other than null), location, source and strategy are native-only: other origins receive 403 native_required. A request naming none of them runs without project workspace wiring. The record keeps these fields as requested; resolved values are in `workspace`.",
 		body: StartRunSchema,
 		response: {
 			201: schemaRef(AgentServerRunSchema),
@@ -11959,8 +12649,8 @@ var AgentServerRouteSchemas = {
 * loopback-companion security profile (#2066): loopback Host enforcement,
 * exact-origin CORS, Fetch-Metadata guards, strict JSON parsing.
 *
-* Control routes require a native process grant or an OAuth token bound to
-* the native operator and this server instance. Origin checks apply to both.
+* Control routes require the process-scoped native Desktop grant. OAuth is
+* used only for native operator sign-in and credential provisioning.
 */
 var AGENT_SERVER_TOKEN_HEADER = "x-moltnet-agent-server-token";
 var BODY_LIMIT = 64 * 1024;
@@ -12019,14 +12709,6 @@ async function readAgentServerLogDelta(handle, state, limit = LOG_READ_LIMIT_BYT
 		omitted
 	};
 }
-var AgentServerHttpError = class extends Error {
-	name = "AgentServerHttpError";
-	constructor(statusCode, code, message) {
-		super(message);
-		this.statusCode = statusCode;
-		this.code = code;
-	}
-};
 function requireBody(request) {
 	const body = request.body;
 	if (typeof body !== "object" || body === null || Array.isArray(body)) throw new AgentServerHttpError(400, "invalid_body", "JSON object body required");
@@ -12112,22 +12794,6 @@ function buildAgentServer(input) {
 			isOriginAllowed: (origin) => origin === "moltnet-agent-desktop://native" || origin === options.selfOrigin || browserOrigins.has(origin)
 		});
 	}
-	let verificationWindow = Date.now();
-	let verifications = 0;
-	const browserVerification = /* @__PURE__ */ new WeakMap();
-	function verifyBrowser(request, token) {
-		const previous = browserVerification.get(request);
-		if (previous) return previous;
-		if (Date.now() - verificationWindow >= RATE_LIMIT_WINDOW_MS) {
-			verificationWindow = Date.now();
-			verifications = 0;
-		}
-		if (++verifications > RATE_LIMIT_MAX) throw new AgentServerHttpError(429, "rate_limited", "Too many authorization attempts");
-		if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
-		const pending = oauth.verifyBrowser(token);
-		browserVerification.set(request, pending);
-		return pending;
-	}
 	function hasValidNativeGrant(origin, token) {
 		if (origin !== "moltnet-agent-desktop://native" || typeof token !== "string" || token.length === 0) return false;
 		try {
@@ -12158,56 +12824,20 @@ function buildAgentServer(input) {
 		max: options.rateLimitMax ?? RATE_LIMIT_MAX,
 		timeWindow: RATE_LIMIT_WINDOW_MS,
 		errorResponseBuilder: () => new AgentServerHttpError(429, "rate_limited", "Too many requests"),
-		keyGenerator: async (request) => {
+		keyGenerator: (request) => {
 			const origin = request.headers.origin;
 			if (!isConfiguredOrigin(origin, options)) return `ip:${request.ip}`;
 			const presented = request.headers[AGENT_SERVER_TOKEN_HEADER];
-			let authenticated = false;
-			if (typeof presented === "string" && presented.length > 0) try {
-				if (origin === "moltnet-agent-desktop://native") authenticated = hasValidNativeGrant(origin, presented);
-				else {
-					if (!oauth) return `unauth:${origin}:${request.ip}`;
-					await verifyBrowser(request, presented);
-					authenticated = true;
-				}
-			} catch (error) {
-				if (error instanceof AgentServerHttpError && error.statusCode === 429) throw error;
-				if (origin === "moltnet-agent-desktop://native") throw error;
-			}
-			return authenticated ? `origin:${origin}` : `unauth:${origin}:${request.ip}`;
+			return typeof presented === "string" && presented.length > 0 && hasValidNativeGrant(origin, presented) ? `origin:${origin}` : `unauth:${origin}:${request.ip}`;
 		}
 	});
 	const requireAuthorizedOrigin = async (request) => {
 		if (restartRequired) throw new AgentServerHttpError(409, "restart_required", "Restart the Agent Server to apply connection settings");
 		const origin = requireOriginHeader(request.headers);
 		const token = request.headers[AGENT_SERVER_TOKEN_HEADER];
-		if (typeof token !== "string" || token.length === 0) throw new AgentServerHttpError(401, "authorization_required", "Local control token is required");
-		if (origin === "moltnet-agent-desktop://native") requireNativeGrant(request);
-		else try {
-			if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
-			const admission = browserVerification.get(request);
-			browserVerification.delete(request);
-			await (admission ?? oauth.verifyBrowser(token));
-		} catch (error) {
-			if (error instanceof AgentServerHttpError) throw error;
-			const code = error && typeof error === "object" && "code" in error ? error.code : void 0;
-			const rejected = error instanceof InvalidOperatorGrantError || typeof code === "string" && [
-				"ERR_JWT_EXPIRED",
-				"ERR_JWT_CLAIM_VALIDATION_FAILED",
-				"ERR_JWS_SIGNATURE_VERIFICATION_FAILED",
-				"ERR_JWS_INVALID",
-				"ERR_JWT_INVALID",
-				"ERR_JOSE_ALG_NOT_ALLOWED",
-				"ERR_JWKS_NO_MATCHING_KEY"
-			].includes(code);
-			request.log.warn({
-				stage: "local-control-authorization",
-				outcome: rejected ? "rejected" : "unavailable",
-				code: typeof code === "string" ? code : void 0
-			}, "Local control authorization failed");
-			if (!rejected) throw new AgentServerHttpError(503, "authorization_unavailable", "Local authorization is unavailable. Check Server settings or retry shortly.");
-			throw new AgentServerHttpError(401, "authorization_required", "Sign in to authorize local control");
-		}
+		if (typeof token !== "string" || token.length === 0) throw new AgentServerHttpError(401, "authorization_required", "Native authorization is required");
+		if (origin !== "moltnet-agent-desktop://native") throw new AgentServerHttpError(403, "native_required", "Native Desktop authorization required");
+		requireNativeGrant(request);
 		return origin;
 	};
 	app.after(() => {
@@ -12216,13 +12846,12 @@ function buildAgentServer(input) {
 		});
 		app.get("/health", { schema: AgentServerRouteSchemas.health }, async () => ({ status: "ok" }));
 		app.get("/v1/native/connection-settings", { schema: { hide: true } }, async (request) => {
-			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !options.connectionSettings) throw new AgentServerHttpError(403, "native_required", "Native administration required");
-			return options.connectionSettings.view();
+			return (await requireNativeOrigin(requireAuthorizedOrigin, request, options.connectionSettings)).view();
 		});
 		app.post("/v1/native/connection-settings", { schema: { hide: true } }, async (request) => {
-			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !options.connectionSettings) throw new AgentServerHttpError(403, "native_required", "Native administration required");
+			const store = await requireNativeOrigin(requireAuthorizedOrigin, request, options.connectionSettings);
 			try {
-				const settings = options.runs.prepareServerRestart(() => options.connectionSettings.save(request.body));
+				const settings = options.runs.prepareServerRestart(() => store.save(request.body));
 				oauth?.cancel();
 				restartRequired = true;
 				return settings;
@@ -12230,40 +12859,6 @@ function buildAgentServer(input) {
 				throw new AgentServerHttpError(400, "invalid_connection_settings", error instanceof Error ? error.message : "Invalid connection settings");
 			}
 		});
-		app.get("/oauth/metadata", { schema: {
-			operationId: "getAgentServerOAuthMetadata",
-			tags: ["operator"],
-			response: { 200: {
-				type: "object",
-				required: [
-					"protocolVersion",
-					"instance",
-					"issuer",
-					"authorizationUrl",
-					"tokenUrl",
-					"clientId",
-					"operatorConfigured"
-				],
-				properties: {
-					protocolVersion: {
-						type: "integer",
-						const: OPERATOR_OAUTH.protocolVersion
-					},
-					instance: {
-						type: "string",
-						format: "uuid"
-					},
-					issuer: { type: "string" },
-					authorizationUrl: { type: "string" },
-					tokenUrl: { type: "string" },
-					clientId: { type: "string" },
-					operatorConfigured: { type: "boolean" }
-				}
-			} }
-		} }, async () => {
-			if (!oauth) throw new AgentServerHttpError(503, "oauth_unavailable", "Local OAuth is not configured");
-			return oauth.metadata();
-		});
 		app.post("/v1/operator/sign-in", { schema: {
 			operationId: "signInAgentServerOperator",
 			response: { 200: {
@@ -12272,10 +12867,12 @@ function buildAgentServer(input) {
 				required: ["state"]
 			} }
 		} }, async (request) => {
-			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !oauth) throw new AgentServerHttpError(403, "native_required", "Native administration required");
-			await oauth.authorize(void 0, requestOperationSignal(request, options.shutdownSignal));
+			await (await requireNativeOrigin(requireAuthorizedOrigin, request, oauth)).authorize(void 0, requestOperationSignal(request, options.shutdownSignal));
 			return { state: "authorized" };
 		});
+		app.get("/v1/native/operator", { schema: { hide: true } }, async (request) => {
+			return { operatorConfigured: (await requireNativeOrigin(requireAuthorizedOrigin, request, oauth)).operatorConfigured() };
+		});
 		app.post("/v1/operator/cancel", { schema: {
 			operationId: "cancelAgentServerOperatorApproval",
 			tags: ["operator"],
@@ -12289,8 +12886,7 @@ function buildAgentServer(input) {
 				required: ["state"]
 			} }
 		} }, async (request) => {
-			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !oauth) throw new AgentServerHttpError(403, "native_required", "Native administration required");
-			oauth.cancel();
+			(await requireNativeOrigin(requireAuthorizedOrigin, request, oauth)).cancel();
 			return { state: "cancelled" };
 		});
 		app.delete("/v1/operator", { schema: {
@@ -12306,8 +12902,7 @@ function buildAgentServer(input) {
 				required: ["state"]
 			} }
 		} }, async (request) => {
-			if (await requireAuthorizedOrigin(request) !== "moltnet-agent-desktop://native" || !oauth) throw new AgentServerHttpError(403, "native_required", "Native administration required");
-			oauth.removeOperator();
+			(await requireNativeOrigin(requireAuthorizedOrigin, request, oauth)).removeOperator();
 			return { state: "removed" };
 		});
 		registerStatusRoute(app, options, requireAuthorizedOrigin);
@@ -12316,6 +12911,7 @@ function buildAgentServer(input) {
 		registerSubscriptionRoutes(app, options, requireAuthorizedOrigin);
 		registerRunRoutes(app, options, requireAuthorizedOrigin);
 		registerCatalogueRoute(app, options, requireAuthorizedOrigin);
+		registerProjectLocationRoutes(app, options, requireAuthorizedOrigin);
 	});
 	app.addHook("preClose", async () => {
 		options.operatorOAuth?.cancel();
@@ -12342,6 +12938,103 @@ function buildAgentServer(input) {
 	});
 	return app;
 }
+async function requireNativeOrigin(authorize, request, ...resource) {
+	if (await authorize(request) !== "moltnet-agent-desktop://native" || resource.length > 0 && resource[0] === void 0) throw new AgentServerHttpError(403, "native_required", "Native administration required");
+	return resource[0];
+}
+function registerProjectLocationRoutes(app, options, authorize) {
+	let locations;
+	const getLocations = () => {
+		const root = options.connectionSettings?.root;
+		if (!root) throw new AgentServerHttpError(503, "locations_unavailable", "Project locations need the Desktop connection store");
+		locations ??= new LocalProjectBindings(root, options.defaultApiUrl, [
+			root,
+			options.store.root,
+			options.store.secretsDir
+		]);
+		return locations;
+	};
+	const requireNativeRequest = async (request) => {
+		await requireNativeOrigin(authorize, request);
+		if (request.validationError) throw new AgentServerHttpError(400, "invalid_location", "Check the project location fields");
+	};
+	app.get("/v1/native/project-locations", { schema: AgentServerRouteSchemas.listProjectLocations }, async (request) => {
+		await requireNativeRequest(request);
+		return { locations: await getLocations().list() };
+	});
+	const saveFields = new Set(Object.keys(AgentServerRouteSchemas.saveProjectLocation.body.properties));
+	app.put("/v1/native/project-locations/:name", {
+		schema: AgentServerRouteSchemas.saveProjectLocation,
+		attachValidation: true,
+		preValidation: async (request) => {
+			await requireNativeOrigin(authorize, request);
+			const body = request.body;
+			if (body && typeof body === "object" && Object.keys(body).some((key) => !saveFields.has(key))) throw new AgentServerHttpError(400, "invalid_location", "Check the project location fields");
+		}
+	}, async (request) => {
+		await requireNativeRequest(request);
+		const bindings = getLocations();
+		const { name } = request.params;
+		const { identity, ...location } = requireBody(request);
+		const alias = identity.trim();
+		requireActivation(options.store, alias);
+		const { config } = await loadAgentActivation(options.store, alias);
+		if (locationEndpoint(config.endpoints.api) !== bindings.apiUrl) throw new AgentServerHttpError(400, "endpoint_mismatch", "Choose an identity for the current server endpoint");
+		const signal = AbortSignal.any([requestOperationSignal(request, options.shutdownSignal), AbortSignal.timeout(options.projectSaveTimeoutMs ?? 1e4)]);
+		await verifyLocationTarget(options, alias, location, request.log, signal);
+		try {
+			return await bindings.save({
+				...location,
+				name,
+				apiUrl: bindings.apiUrl
+			}, { signal });
+		} catch (error) {
+			if (signal.aborted) throw checkUnavailable(error, true);
+			throw error;
+		}
+	});
+	app.delete("/v1/native/project-locations/:name", {
+		schema: AgentServerRouteSchemas.removeProjectLocation,
+		attachValidation: true
+	}, async (request) => {
+		await requireNativeRequest(request);
+		await getLocations().remove(request.params.name);
+		return { removed: true };
+	});
+}
+/**
+* A location save checks only its target team: `readTeam` verifies the team
+* credential and returns its diaries, then the shared check reads the project.
+*/
+async function verifyLocationTarget(options, alias, target, logger, signal) {
+	const agent = await catalogueAgent(options, alias);
+	if (!agent.teamIds.includes(target.teamId)) throw projectUnavailable();
+	let diaries = [];
+	await verifyProjectTarget({
+		readProject: async (teamId, projectId, readSignal) => {
+			const team = await agent.readTeam(teamId, readSignal);
+			if (team.team.id !== teamId) throw new Error("Team response mismatch");
+			diaries = team.diaries;
+			return agent.readProject(teamId, projectId, readSignal);
+		},
+		readDiary: async (teamId, diaryId) => diaries.find((diary) => diary.id === diaryId && diary.teamId === teamId) ?? null
+	}, target, {
+		signal,
+		logger
+	});
+}
+async function catalogueAgent(options, alias) {
+	return options.catalogueAgentFor ? options.catalogueAgentFor(alias) : defaultCatalogueAgent(options, alias);
+}
+async function readIdentityCatalogue(options, alias, logger) {
+	requireActivation(options.store, alias);
+	return buildCatalogue({
+		agent: await catalogueAgent(options, alias),
+		machine: machineCapabilities(options),
+		identityDefault: readIdentityDefaultBinding(options.store.identityDir(alias)),
+		logger
+	});
+}
 function registerCatalogueRoute(app, options, requireAuthorizedOrigin) {
 	app.get("/v1/catalogue", {
 		schema: AgentServerRouteSchemas.catalogue,
@@ -12350,34 +13043,42 @@ function registerCatalogueRoute(app, options, requireAuthorizedOrigin) {
 		await requireAuthorizedOrigin(request);
 		const { identity } = request.query ?? {};
 		if (!identity || identity.trim().length === 0) throw new AgentServerHttpError(400, "invalid_query", "\"identity\" is required");
-		const alias = identity.trim();
-		requireActivation(options.store, alias);
-		return buildCatalogue({
-			agent: await (options.catalogueAgentFor ? options.catalogueAgentFor(alias) : defaultCatalogueAgent(options, alias)),
-			machine: machineCapabilities(options),
-			identityDefault: readIdentityDefaultBinding(options.store.identityDir(alias))
-		});
+		return readIdentityCatalogue(options, identity.trim(), request.log);
 	});
 }
 /** Resolve and verify each indexed team independently with its exact key. */
 async function defaultCatalogueAgent(options, alias) {
 	const { config } = await loadAgentActivation(options.store, alias);
+	const clients = /* @__PURE__ */ new Map();
+	const verifiedClient = (teamId) => {
+		const client = clients.get(teamId);
+		if (!client) throw new Error("Team must be verified before project discovery");
+		return client;
+	};
 	return {
 		teamIds: Object.keys(config.agent_key_refs ?? {}),
 		lastVerified: (teamId) => requireActivation(options.store, alias).credentialHealth?.[teamId],
-		readTeam: async (teamId) => {
-			const { client, metadata } = requireCredentialSnapshot(await verifyTeamActivation(options.store, alias, options.secretProviders, options.externalSecretProviders, void 0, options.shutdownSignal, teamId));
+		readTeam: async (teamId, signal) => {
+			const activated = await verifyTeamActivation(options.store, alias, options.secretProviders, options.externalSecretProviders, void 0, signal && options.shutdownSignal ? AbortSignal.any([signal, options.shutdownSignal]) : signal ?? options.shutdownSignal, teamId);
+			signal?.throwIfAborted();
+			const { client, metadata } = requireCredentialSnapshot(activated);
 			const [team, diaries, profiles] = await Promise.all([
 				client.teams.get(teamId),
 				client.diaries.list(),
 				client.runtimeProfiles.list({ teamId })
 			]);
+			clients.set(teamId, client);
 			return {
 				team,
 				diaries: diaries.items,
 				profiles: profiles.items,
 				credential: metadata
 			};
+		},
+		readProjects: async (teamId) => readCatalogueProjects(verifiedClient(teamId).projects, teamId),
+		readProject: async (teamId, projectId, signal) => {
+			signal?.throwIfAborted();
+			return readCatalogueProject(verifiedClient(teamId).projects, teamId, projectId);
 		}
 	};
 }
@@ -12400,7 +13101,7 @@ function machineCapabilities(options) {
 function registerStatusRoute(app, options, requireAuthorizedOrigin) {
 	const { store, runs } = options;
 	app.get("/v1/status", { schema: AgentServerRouteSchemas.status }, async (request) => {
-		await requireAuthorizedOrigin(request);
+		const origin = await requireAuthorizedOrigin(request);
 		const selected = selectedIdentity(store, options.activeIdentity);
 		return {
 			version: options.version,
@@ -12410,7 +13111,7 @@ function registerStatusRoute(app, options, requireAuthorizedOrigin) {
 			identities: identityViews(store),
 			...selected ? { selectedIdentity: selected } : {},
 			providers: options.providers.list(),
-			runs: await runViews(runs),
+			runs: await runViews(runs, origin),
 			runtimeSettings: options.runtimeSettings ?? DEFAULT_LOCAL_OPERATIONAL_SETTINGS
 		};
 	});
@@ -12535,11 +13236,30 @@ function registerProviderRoutes(app, options, requireAuthorizedOrigin) {
 		return reply.code(204).send(null);
 	});
 }
-async function runViews(runs) {
-	return (await runs.listAsync(RUN_HISTORY_LIMIT)).map((record) => ({
-		...record,
-		active: runs.isActive(record.id)
-	}));
+async function runViews(runs, origin) {
+	return (await runs.listAsync(RUN_HISTORY_LIMIT)).map((record) => runView(record, runs.isActive(record.id), origin));
+}
+/**
+* Local folders are native-only, as project locations are: other origins see
+* the location name and project, never the path. The snapshot path is
+* daemon-internal for every origin.
+*/
+function runView(record, active, origin) {
+	const native = origin === NATIVE_CLIENT_ORIGIN;
+	const { source, workspace, ...rest } = record;
+	const view = {
+		...rest,
+		...native && source !== void 0 ? { source } : {},
+		active
+	};
+	if (workspace) {
+		const { configPath: _configPath, source: resolvedSource, ...shared } = workspace;
+		view.workspace = {
+			...shared,
+			...native && resolvedSource !== void 0 ? { source: resolvedSource } : {}
+		};
+	}
+	return view;
 }
 function registerSubscriptionRoutes(app, options, requireAuthorizedOrigin) {
 	app.get("/v1/subscriptions", { schema: AgentServerRouteSchemas.listSubscriptions }, async (request) => {
@@ -12566,17 +13286,22 @@ function registerSubscriptionRoutes(app, options, requireAuthorizedOrigin) {
 function registerRunRoutes(app, options, requireAuthorizedOrigin) {
 	const { runs } = options;
 	app.get("/v1/runs", { schema: AgentServerRouteSchemas.listRuns }, async (request) => {
-		await requireAuthorizedOrigin(request);
-		return runViews(runs);
+		return runViews(runs, await requireAuthorizedOrigin(request));
 	});
 	app.post("/v1/runs", {
 		schema: AgentServerRouteSchemas.startRun,
 		attachValidation: true
 	}, async (request, reply) => {
-		await requireAuthorizedOrigin(request);
+		const origin = await requireAuthorizedOrigin(request);
 		const body = requireBody(request);
+		if (NATIVE_RUN_FIELDS.some((key) => body[key] !== void 0 && body[key] !== null)) await requireNativeOrigin(async () => origin, request);
+		if (request.validationError) throw new AgentServerHttpError(400, "invalid_spec", `Check the run fields: ${request.validationError.message}`);
 		const diaryId = optionalString(body, "diaryId");
 		const record = await runs.start({
+			...body.projectId === null ? { projectId: null } : body.projectId !== void 0 ? { projectId: requireString(body, "projectId") } : {},
+			...body.location !== void 0 ? { location: requireString(body, "location") } : {},
+			...body.source !== void 0 ? { source: requireString(body, "source") } : {},
+			...body.strategy !== void 0 ? { strategy: requireString(body, "strategy") } : {},
 			agent: requireString(body, "agent"),
 			teamId: requireString(body, "teamId"),
 			...diaryId ? { diaryId } : {},
@@ -12584,15 +13309,13 @@ function registerRunRoutes(app, options, requireAuthorizedOrigin) {
 			taskTypes: stringArray(body, "taskTypes"),
 			mode: requireString(body, "mode")
 		}, requestOperationSignal(request, options.shutdownSignal));
-		return reply.code(201).send({
-			...record,
-			active: runs.isActive(record.id)
-		});
+		return reply.code(201).send(runView(record, runs.isActive(record.id), origin));
 	});
 	app.delete("/v1/runs/:runId", { schema: AgentServerRouteSchemas.stopRun }, async (request) => {
-		await requireAuthorizedOrigin(request);
+		const origin = await requireAuthorizedOrigin(request);
 		const { runId } = request.params;
-		return runs.stop(runId);
+		const record = runs.stop(runId);
+		return runView(record, runs.isActive(record.id), origin);
 	});
 	registerRunLogRoute(app, options, requireAuthorizedOrigin);
 }
@@ -12619,9 +13342,10 @@ function registerRunLogRoute(app, options, requireAuthorizedOrigin) {
 			} }
 		} }
 	} }, async (request) => {
-		await requireAuthorizedOrigin(request);
+		const origin = await requireAuthorizedOrigin(request);
 		const { runId } = request.params;
 		const record = runs.status(runId);
+		const redact = localPathRedactor(record, origin, options);
 		const handle = await open(store.resolveRunLogPath(record.id), constants.O_RDONLY | constants.O_NOFOLLOW);
 		try {
 			const state = {
@@ -12629,20 +13353,22 @@ function registerRunLogRoute(app, options, requireAuthorizedOrigin) {
 				fragment: ""
 			};
 			const { lines, omitted } = await readAgentServerLogDelta(handle, state);
+			const native = origin === NATIVE_CLIENT_ORIGIN;
 			return { lines: [
 				...omitted ? ["[older log output omitted]"] : [],
-				...lines,
-				...state.fragment ? [state.fragment] : []
-			] };
+				...omitted && !native ? lines.slice(1) : lines,
+				...state.fragment && (native || !runs.isActive(record.id)) ? [state.fragment] : []
+			].map(redact) };
 		} finally {
 			await handle.close();
 		}
 	});
 	let openStreams = 0;
 	app.get("/v1/runs/:runId/logs", { schema: AgentServerRouteSchemas.streamRunLogs }, async (request, reply) => {
-		await requireAuthorizedOrigin(request);
+		const origin = await requireAuthorizedOrigin(request);
 		const { runId } = request.params;
 		const record = runs.status(runId);
+		const redact = localPathRedactor(record, origin, options);
 		store.resolveRunLogPath(record.id);
 		if (openStreams >= MAX_LOG_STREAMS) throw new AgentServerHttpError(429, "rate_limited", "Too many concurrent log streams");
 		openStreams += 1;
@@ -12683,12 +13409,12 @@ function registerRunLogRoute(app, options, requireAuthorizedOrigin) {
 			});
 		};
 		const push = async () => {
-			if (request.headers.origin !== "moltnet-agent-desktop://native") await requireAuthorizedOrigin(request);
 			const handle = await open(store.resolveRunLogPath(record.id), constants.O_RDONLY | constants.O_NOFOLLOW);
 			try {
 				const { lines, omitted } = await readAgentServerLogDelta(handle, readState);
 				if (omitted) await writeData("[older log output omitted]");
-				for (const line of lines) await writeData(line);
+				const complete = omitted && origin !== "moltnet-agent-desktop://native" ? lines.slice(1) : lines;
+				for (const line of complete) await writeData(redact(line));
 			} finally {
 				await handle.close();
 			}
@@ -12723,6 +13449,43 @@ function registerRunLogRoute(app, options, requireAuthorizedOrigin) {
 		return reply;
 	});
 }
+/**
+* Worker logs name local folders (the chosen source, state and HOME under the
+* store). Non-native origins get them replaced, as `runView` does for records.
+* The user's home directory is included so any other path under it cannot
+* reveal the OS account name.
+*/
+/**
+* A service account's home can be `/` or `/root`; replacing it would rewrite
+* every slash in the log, so only a home with two or more segments counts.
+*/
+function redactableHome() {
+	const home = homedir();
+	return home.split(/[\\/]/u).filter(Boolean).length >= 2 ? home : void 0;
+}
+function localPathRedactor(record, origin, options) {
+	if (origin === "moltnet-agent-desktop://native") return (line) => line;
+	const paths = /* @__PURE__ */ new Set();
+	for (const path of [
+		record.source,
+		record.workspace?.source,
+		options.store.root,
+		options.connectionSettings?.root,
+		redactableHome()
+	]) {
+		if (!path) continue;
+		const forms = [path];
+		try {
+			forms.push(realpathSync.native(path));
+		} catch {}
+		for (const form of forms) {
+			paths.add(form);
+			paths.add(JSON.stringify(form).slice(1, -1));
+		}
+	}
+	const ordered = [...paths].sort((a, b) => b.length - a.length);
+	return (line) => ordered.reduce((text, path) => text.split(path).join("<local path>"), line);
+}
 function corsHeadersFor(request, options) {
 	const origin = request.headers.origin;
 	if (isConfiguredOrigin(origin, options)) return {
@@ -12735,6 +13498,23 @@ function isConfiguredOrigin(origin, options) {
 	return typeof origin === "string" && (origin === "moltnet-agent-desktop://native" || !options.nativeOnly && (options.allowedOrigins.includes(origin) || origin === options.selfOrigin));
 }
 function normalizeAgentServerError(error) {
+	if (error instanceof ProjectConfigError) {
+		if (error.kind === "version") return {
+			statusCode: 409,
+			code: "config_version",
+			message: "The project locations file was written by a newer MoltNet. Update this app."
+		};
+		if (error.kind === "io") return {
+			statusCode: 500,
+			code: "config_unavailable",
+			message: "The project locations file could not be read or written. Check its ownership and permissions."
+		};
+		return {
+			statusCode: 400,
+			code: "invalid_location",
+			message: error.message
+		};
+	}
 	if (error instanceof TeamCredentialError) return {
 		statusCode: 400,
 		code: error.blocker.code,
@@ -12819,7 +13599,7 @@ function nativeSocketValidationOptions(input) {
 		...input.cliAllowedOrigins ? { allowedOrigins: input.cliAllowedOrigins } : {}
 	};
 }
-async function runAgentServer(argv) {
+async function runAgentServer(argv, ports = {}) {
 	if (isHelpFlag(argv)) {
 		console.log(AGENT_SERVER_HELP);
 		return 0;
@@ -12897,9 +13677,12 @@ async function runAgentServer(argv) {
 					logger
 				});
 				const runtimeRegistry = new RuntimeRegistry(store.root);
+				const supplied = ports.configure?.(store);
 				const runs = new RunManager({
+					...supplied?.runOptions,
 					store,
 					storeRoot: settingsRoot,
+					projectRoot: settingsRoot,
 					secretProviders,
 					externalSecretProviders,
 					baseEnv: processEnvSnapshot(),
@@ -12909,16 +13692,17 @@ async function runAgentServer(argv) {
 				});
 				if (nativeSocket) await validateNativeSocket(nativeSocket);
 				const selfOrigin = nativeSocket ? void 0 : `http://127.0.0.1:${port}`;
+				const operatorOAuth = new OperatorOAuth({
+					issuer: connection.issuer,
+					authorizationUrl: new URL("/oauth2/auth", connection.publicUrl).href,
+					tokenUrl: new URL("/oauth2/token", connection.publicUrl).href,
+					jwksUrl: new URL("/.well-known/jwks.json", connection.publicUrl).href,
+					nativeClientId: connection.nativeClientId,
+					callbackPort: OPERATOR_OAUTH.callbackPort
+				}, root);
 				const app = buildAgentServer({
-					operatorOAuth: new OperatorOAuth({
-						issuer: connection.issuer,
-						authorizationUrl: new URL("/oauth2/auth", connection.publicUrl).href,
-						tokenUrl: new URL("/oauth2/token", connection.publicUrl).href,
-						jwksUrl: new URL("/.well-known/jwks.json", connection.publicUrl).href,
-						nativeClientId: connection.nativeClientId,
-						consoleClientId: connection.consoleClientId,
-						callbackPort: OPERATOR_OAUTH.callbackPort
-					}, root),
+					...supplied?.catalogueAgentFor ? { catalogueAgentFor: supplied.catalogueAgentFor } : {},
+					operatorOAuth,
 					nativeOnly: Boolean(nativeSocket),
 					connectionSettings,
 					operatorApiUrl: connection.apiUrl,
@@ -13403,7 +14187,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.63.1";
+var DAEMON_VERSION = "0.64.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {