agent-temporary 0.7.0

package/README.md

@@ -0,0 +1,74 @@
+# agent-temporary
+
+agent-temporary 0.7.0 — small utility for explicitly bounded temporary root access on Linux or macOS.
+
+## Contract
+
+```text
+sudo agent-temporary install --user zero
+sudo agent-temporary on
+sudo agent-temporary on --ttl 30m
+sudo agent-temporary on --ttl 2h --persist-reboot
+sudo agent-temporary off
+agent-temporary status
+agent-temporary version
+sudo ./uninstall.sh
+```
+
+The npm distribution installs only an unprivileged setup command:
+
+```sh
+npm install -g agent-temporary
+agent-temporary-setup install
+agent-temporary status
+agent-temporary-setup update
+npm uninstall -g agent-temporary
+agent-temporary-setup uninstall-system
+```
+
+`npm install` and `npm uninstall` affect only the npm package. The explicit setup
+commands invoke the existing system installer or uninstaller and request administrator
+privileges; they do not activate temporary access. To update the setup package, use
+`npm install -g agent-temporary@latest` and then run `agent-temporary-setup update`.
+
+Activation defaults to a 5-minute TTL. The allowed range is 5 minutes through 8 hours;
+accepted forms are integer minutes or hours such as `30m`, `1h`, and `4h`.
+
+On macOS, `--persist-reboot` explicitly preserves the same grant across reboot
+until its original expiry. On Linux, the existing behavior remains unchanged.
+Without persistence, boot revocation removes
+temporary privilege.
+
+While active, the configured user has unrestricted `NOPASSWD: ALL` sudo access.
+The privilege is bounded by a local expiry supervisor and is revoked on boot.
+It does not use SSH keys or `authorized_keys`, and does not require Netbot or a
+remote controller to revoke access.
+
+`status` reports state from local state/rule inspection and an exact harmless
+`sudo -n /usr/bin/true` execution probe; sudo policy listing alone is not treated
+as effective authority. `status --json` is accepted for machine-readable integration
+(the key/value fields remain stable). State is stored root-owned under
+`/var/lib/agent-temporary/`.
+
+## Platform
+
+Supported: Linux with an active systemd or OpenRC runtime and sudo/visudo, or
+macOS with launchd and sudo/visudo. OpenRC is detected through its native runtime
+state and service tools, including their standard `/sbin` locations.
+
+Unsupported: Linux with another/unknown init system and unsupported platforms;
+they fail closed and are not given a synthetic systemd setup.
+
+## Release
+
+Build a release artifact with:
+
+```sh
+./release.sh
+```
+
+The resulting directory contains the executable, systemd/OpenRC/launchd service definitions, `VERSION`,
+`SHA256SUMS`, and a deterministic `install.sh`. It also creates
+`dist/agent-temporary-X.Y.Z.zip` and its SHA-256 sidecar. The archive contains no Git metadata,
+runtime state, logs, or private material; after extraction, run
+`sudo ./install.sh --user zero` and the extracted source directory may be removed.

package/bin/agent-temporary-setup.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const cp = require('child_process');
+
+const packageRoot = path.resolve(__dirname, '..');
+const pkg = require(path.join(packageRoot, 'package.json'));
+const payload = path.join(packageRoot, 'payload');
+const manifestPath = path.join(packageRoot, 'manifest.json');
+
+function fail(message) {
+  process.stderr.write(`agent-temporary-setup: ${message}\n`);
+  process.exitCode = 1;
+}
+
+function usage() {
+  process.stdout.write('Usage:\n' +
+    '  agent-temporary-setup install\n' +
+    '  agent-temporary-setup update\n' +
+    '  agent-temporary-setup status\n' +
+    '  agent-temporary-setup uninstall-system\n');
+}
+
+function versionParts(value) {
+  const match = /^([0-9]+)\.([0-9]+)\.([0-9]+)$/.exec(value || '');
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function compareVersions(left, right) {
+  const a = versionParts(left);
+  const b = versionParts(right);
+  if (!a || !b) return null;
+  for (let i = 0; i < 3; i += 1) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function verifyPayload() {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  } catch (error) {
+    throw new Error(`cannot read payload manifest: ${error.message}`);
+  }
+  if (manifest.version !== pkg.version || manifest.payload_version !== pkg.version) {
+    throw new Error('package version and embedded payload version do not match');
+  }
+  const version = fs.readFileSync(path.join(payload, 'VERSION'), 'utf8').trim();
+  if (version !== pkg.version) throw new Error('embedded VERSION does not match package version');
+  const checksumFile = path.join(packageRoot, manifest.payload_checksums || 'payload/SHA256SUMS');
+  const lines = fs.readFileSync(checksumFile, 'utf8').trim().split(/\n/).filter(Boolean);
+  if (!lines.length) throw new Error('embedded payload checksums are empty');
+  for (const line of lines) {
+    const match = /^([0-9a-f]{64})\s+(.+)$/.exec(line);
+    if (!match) throw new Error(`malformed payload checksum line: ${line}`);
+    const relative = match[2];
+    const resolved = path.resolve(payload, relative);
+    if (resolved !== payload && !resolved.startsWith(`${payload}${path.sep}`)) {
+      throw new Error(`payload checksum escapes payload: ${relative}`);
+    }
+    const actual = crypto.createHash('sha256').update(fs.readFileSync(resolved)).digest('hex');
+    if (actual !== match[1]) throw new Error(`payload integrity check failed: ${relative}`);
+  }
+  for (const required of ['install.sh', 'uninstall.sh', 'agent-temporary', 'VERSION']) {
+    if (!fs.existsSync(path.join(payload, required))) throw new Error(`payload is missing ${required}`);
+  }
+}
+
+function installedSystem() {
+  const result = cp.spawnSync('agent-temporary', ['version'], { encoding: 'utf8' });
+  if (result.error || result.status !== 0) return { present: false, version: null };
+  const output = `${result.stdout || ''}${result.stderr || ''}`;
+  const match = /agent-temporary\s+([^\s]+)/.exec(output);
+  return { present: true, version: match ? match[1] : null };
+}
+
+function runSudo(args) {
+  return cp.spawnSync('sudo', args, { stdio: 'inherit' });
+}
+
+function verifyInactive() {
+  const result = cp.spawnSync('sudo', ['agent-temporary', 'status'], { encoding: 'utf8' });
+  if (result.error || result.status !== 0) throw new Error('could not verify final system status');
+  const output = `${result.stdout || ''}${result.stderr || ''}`;
+  process.stdout.write(output);
+  if (!/^state=inactive$/m.test(output) || !/^effective_authority=false$/m.test(output)) {
+    throw new Error('system installation is not inactive after setup');
+  }
+}
+
+function doStatus() {
+  const system = installedSystem();
+  process.stdout.write(`npm/package version=${pkg.version}\n`);
+  process.stdout.write(`embedded payload version=${pkg.version}\n`);
+  process.stdout.write(`system components=${system.present ? 'present' : 'absent/unknown'}\n`);
+  process.stdout.write(`installed system version=${system.version || 'unknown'}\n`);
+  if (!system.present) process.stdout.write('update available=no (system installation not detected)\n');
+  else {
+    const comparison = compareVersions(system.version, pkg.version);
+    if (comparison === null) process.stdout.write('update available=unknown\n');
+    else if (comparison < 0) process.stdout.write('update available=yes\n');
+    else process.stdout.write('update available=no\n');
+  }
+}
+
+function installOrUpdate(command) {
+  verifyPayload();
+  const system = installedSystem();
+  const comparison = system.version ? compareVersions(system.version, pkg.version) : null;
+  if (system.present && comparison === null) throw new Error('installed system version is unknown; refusing ambiguous installation');
+  if (comparison > 0) throw new Error(`installed system version ${system.version} is newer than package version ${pkg.version}; downgrade is not supported`);
+  if (command === 'update' && !system.present) throw new Error('no installed system detected; use install');
+  if (comparison === 0) {
+    process.stdout.write(`agent-temporary ${pkg.version} is already current; no system changes made.\n`);
+    return;
+  }
+  process.stdout.write(`Installing agent-temporary ${pkg.version} system components.\nAdministrator privileges are required.\n`);
+  const result = runSudo(['sh', path.join(payload, 'install.sh')]);
+  if (result.error || result.status !== 0) throw new Error('system installer failed');
+  const installed = installedSystem();
+  if (!installed.present || installed.version !== pkg.version) throw new Error('installed system version verification failed');
+  verifyInactive();
+  process.stdout.write(`agent-temporary ${pkg.version} system installation is present and inactive.\n`);
+}
+
+function uninstallSystem() {
+  verifyPayload();
+  process.stdout.write('Removing agent-temporary system components. Administrator privileges are required.\n');
+  const result = runSudo(['sh', path.join(payload, 'uninstall.sh')]);
+  if (result.error || result.status !== 0) throw new Error('system uninstaller failed');
+  const system = installedSystem();
+  if (system.present) throw new Error('system command remains after uninstall');
+  process.stdout.write('agent-temporary system installation removed.\n');
+}
+
+function main() {
+  const command = process.argv[2];
+  if (!command) return usage();
+  if (command === '--help' || command === '-h') return usage();
+  if (command === '--version') return process.stdout.write(`agent-temporary-setup ${pkg.version}\n`);
+  if (!['status', 'install', 'update', 'uninstall-system'].includes(command)) {
+    usage();
+    process.exitCode = 2;
+    return;
+  }
+  try {
+    if (command === 'status') doStatus();
+    else if (command === 'uninstall-system') uninstallSystem();
+    else installOrUpdate(command);
+  } catch (error) {
+    fail(error.message);
+  }
+}
+
+main();

package/bin/postinstall.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+'use strict';
+
+const pkg = require('../package.json');
+process.stdout.write(`agent-temporary ${pkg.version} installed.\n\n` +
+  'System components are not installed automatically.\n' +
+  'To finish setup:\n' +
+  '  agent-temporary-setup install\n\n' +
+  'This step will request administrator privileges.\n');

package/manifest.json

@@ -0,0 +1,5 @@
+{
+  "version": "0.7.0",
+  "payload_version": "0.7.0",
+  "payload_checksums": "payload/SHA256SUMS"
+}

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "agent-temporary",
+  "version": "0.7.0",
+  "description": "Unprivileged setup layer for the agent-temporary system release",
+  "bin": {
+    "agent-temporary-setup": "bin/agent-temporary-setup.js"
+  },
+  "files": [
+    "bin",
+    "payload",
+    "manifest.json",
+    "README.md"
+  ],
+  "scripts": {
+    "postinstall": "node bin/postinstall.js"
+  },
+  "license": "MIT"
+}

package/payload/SHA256SUMS

@@ -0,0 +1,13 @@
+a41b716bf984f50311a67f6841b624741f534d80bfb7ca9d7e68e2b68a192882  agent-temporary
+661adb81432a930663d85f3f7a36bff5a6bdc82534012688b3ff34502d792612  agent-temporary-expire.service
+c14e46956698ac589515971fa71171034f94ee0276c97645c363b0729c1d2870  agent-temporary-expire.timer
+425bc4e3601631c6cf612140905a5e8f1167320278c870cb5d4b6723eadda5e6  agent-temporary-boot.service
+fc2cab450fa5743ba05b46ab8a5aca8d8e418ba39517be52848630a05dda9eb0  agent-temporary-boot.openrc
+15369ed62ff24f98c19d3d331f32b12f1d0712b5e3cbac9c2cddb5ad22c2e00a  agent-temporary-expire.openrc
+d26cd02487363aaa2f633f6c83bd61206fed2297004023b0c3e143c20633f416  macos/agent-temporary-macos
+1dff1a00db27128e2c618877fd2c76986bc27240c1b5b075a9daa3b8b9d58fce  macos/agent-temporary-reaper
+0cf3a987694cc296331cbbeee0ef3af77dd1e21f1136f5438b5a621b6fe75ce5  macos/com.agent-temporary.expire.plist
+e963a4d32c7b47eb68db3e286ca53675b59ddd22370ad330334115e32a877363  macos/com.agent-temporary.boot.plist
+967d9afb101346667166f2e76e81910bc190488d7d41d50ca0072e9d92f00e32  VERSION
+2ee46662f8db2fb0d6536b91cef0aad4239255d91f9485de7b34111125a8ccd7  install.sh
+a52fb0bd6dd7c24069096706c075b35fc511468912970bb6eaadb2bcdc83a32d  uninstall.sh

package/payload/VERSION

@@ -0,0 +1 @@
+0.7.0

package/payload/agent-temporary

@@ -0,0 +1,327 @@
+#!/bin/sh
+set -eu
+
+VERSION=0.7.0
+DEFAULT_TTL=5m
+PREFIX=${PREFIX:-/usr/local/bin}
+TARGET=${TARGET:-$PREFIX/agent-temporary}
+RULE=${AGENT_TEMPORARY_RULE:-/etc/sudoers.d/90-temporary-agent}
+CONFIG=${AGENT_TEMPORARY_CONFIG:-/etc/agent-temporary.conf}
+STATE_DIR=${AGENT_TEMPORARY_STATE_DIR:-/var/lib/agent-temporary}
+STATE=${AGENT_TEMPORARY_STATE:-$STATE_DIR/state}
+SYSTEMD_DIR=${AGENT_TEMPORARY_SYSTEMD_DIR:-/etc/systemd/system}
+SYSTEMCTL=${SYSTEMCTL:-systemctl}
+OPENRC_DIR=${AGENT_TEMPORARY_OPENRC_DIR:-/etc/init.d}
+RCSERVICE=${RCSERVICE:-}
+RCUPDATE=${RCUPDATE:-}
+OPENRC_PIDFILE=${AGENT_TEMPORARY_OPENRC_PIDFILE:-/run/agent-temporary-expire.pid}
+VISUDO=${VISUDO:-visudo}
+SUDOERS=${AGENT_TEMPORARY_SUDOERS:-/etc/sudoers}
+EXPIRY_TIMER=agent-temporary-expire.timer
+SOURCE_DIR=${AGENT_TEMPORARY_RELEASE_DIR:-.}
+UNAME=${UNAME:-uname}
+
+OS=$($UNAME -s 2>/dev/null || true)
+
+usage() { echo "Usage: sudo $0 {install --user USER|on --ttl DURATION|off|status [--json]|version}" >&2; exit 2; }
+need_root() { [ "$(id -u)" -eq 0 ] || { echo "Run as root: sudo $0 $*" >&2; exit 1; }; }
+die() { echo "agent-temporary: $*" >&2; exit 1; }
+version() { echo "agent-temporary $VERSION"; }
+
+load_user() {
+    [ -r "$CONFIG" ] || die "not installed: $CONFIG is missing"
+    . "$CONFIG"
+    [ -n "${AGENT_USER:-}" ] || die "invalid config: AGENT_USER is missing"
+    id "$AGENT_USER" >/dev/null 2>&1 || die "unknown configured user: $AGENT_USER"
+}
+
+validate_platform() {
+    [ "$OS" = Linux ] || die "Linux systemd or OpenRC is required"
+    command -v "$VISUDO" >/dev/null 2>&1 || die "visudo is required"
+    if command -v "$SYSTEMCTL" >/dev/null 2>&1 && { [ -d /run/systemd/system ] || "$SYSTEMCTL" show-environment >/dev/null 2>&1; }; then
+        INIT_SYSTEM=systemd
+    else
+        [ -n "$RCSERVICE" ] || for candidate in /sbin/rc-service /usr/sbin/rc-service; do [ -x "$candidate" ] && { RCSERVICE=$candidate; break; }; done
+        [ -n "$RCUPDATE" ] || for candidate in /sbin/rc-update /usr/sbin/rc-update; do [ -x "$candidate" ] && { RCUPDATE=$candidate; break; }; done
+        [ -x "${RCSERVICE:-/nonexistent}" ] && [ -x "${RCUPDATE:-/nonexistent}" ] || die "Linux systemd or OpenRC is required"
+        [ -e /run/openrc/softlevel ] || die "OpenRC is not active"
+        INIT_SYSTEM=openrc
+    fi
+}
+
+service_unit() { [ "$1" = agent-temporary-expire ] && [ "$INIT_SYSTEM" = systemd ] && echo agent-temporary-expire.timer || echo "$1"; }
+service_start() { validate_platform; unit=$(service_unit "$1"); if [ "$INIT_SYSTEM" = openrc ]; then "$RCSERVICE" "$unit" start; else "$SYSTEMCTL" start "$unit"; fi; }
+service_stop() { validate_platform; unit=$(service_unit "$1"); if [ "$INIT_SYSTEM" = openrc ]; then "$RCSERVICE" "$unit" stop >/dev/null 2>&1 || true; else "$SYSTEMCTL" stop "$unit" >/dev/null 2>&1 || true; fi; }
+service_active() { validate_platform; unit=$(service_unit "$1"); if [ "$INIT_SYSTEM" = openrc ]; then "$RCSERVICE" "$unit" status >/dev/null 2>&1; else "$SYSTEMCTL" is-active --quiet "$unit"; fi; }
+
+parse_ttl() {
+    ttl=$1
+    case "$ttl" in
+        [0-9]*m) number=${ttl%m}; seconds=$((number * 60)) ;;
+        [0-9]*h) number=${ttl%h}; seconds=$((number * 3600)) ;;
+        *) die "TTL must be an integer number of minutes or hours (30m or 1h)" ;;
+    esac
+    case "$number" in ''|*[!0-9]*) die "malformed TTL: $ttl" ;; esac
+    [ "$seconds" -ge 300 ] || die "TTL minimum is 5m"
+    [ "$seconds" -le 28800 ] || die "TTL maximum is 8h"
+    echo "$seconds"
+}
+
+validate_sudoers() { "$VISUDO" -cf "$SUDOERS" >/dev/null; }
+
+effective_unrestricted() {
+    # sudo -l describes policy, not effective execution.  Probe the exact
+    # noninteractive mechanism with a harmless command as the configured
+    # user.  This also catches Defaults/authenticate and group-rule ordering
+    # differences across sudo implementations.
+    "$VISUDO" -cf "$SUDOERS" >/dev/null 2>&1 || return 1
+    true_command=
+    for candidate in /usr/bin/true /bin/true; do
+        if [ -x "$candidate" ]; then true_command=$candidate; break; fi
+    done
+    [ -n "$true_command" ] || return 1
+    if [ "$(id -u)" -eq 0 ]; then
+        su -s /bin/sh "$1" -c "sudo -n $true_command" >/dev/null 2>&1
+    elif [ "$(id -un)" = "$1" ]; then
+        sudo -n "$true_command" >/dev/null 2>&1
+    else
+        return 1
+    fi
+}
+
+write_rule() {
+    tmp=$(mktemp "${RULE}.XXXXXX")
+    trap 'rm -f "$tmp"' EXIT HUP INT TERM
+    # Group rules (notably Alpine's wheel rule) can match after the user
+    # specification and restore password authentication.  The scoped
+    # Defaults entry makes the temporary NOPASSWD contract effective for the
+    # configured user while this file exists; it disappears on off/expiry.
+    printf 'Defaults:%s !authenticate\n%s ALL=(ALL) NOPASSWD: ALL\n' "$AGENT_USER" "$AGENT_USER" > "$tmp"
+    chmod 440 "$tmp"; chown root:"$(id -gn root)" "$tmp"
+    "$VISUDO" -cf "$tmp" >/dev/null
+    mv -f "$tmp" "$RULE"
+    trap - EXIT HUP INT TERM
+}
+
+write_state() {
+    activated_epoch=$1; expires_epoch=$2; ttl=$3; persist_reboot=$4
+    tmp=$(mktemp "${STATE}.XXXXXX")
+    trap 'rm -f "$tmp"' EXIT HUP INT TERM
+    {
+        printf 'version=%s\n' "$VERSION"
+        printf 'user=%s\n' "$AGENT_USER"
+        printf 'activated_at_epoch=%s\n' "$activated_epoch"
+        printf 'expires_at_epoch=%s\n' "$expires_epoch"
+        printf 'ttl=%s\n' "$ttl"
+        printf 'persist_reboot=%s\n' "$persist_reboot"
+    } > "$tmp"
+    chmod 600 "$tmp"; chown root:"$(id -gn root)" "$tmp"; mv -f "$tmp" "$STATE"
+    trap - EXIT HUP INT TERM
+}
+
+state_value() { sed -n "s/^$1=//p" "$STATE" | head -n 1; }
+
+install_units() {
+    if [ "${INIT_SYSTEM:-}" = openrc ]; then
+        install -d -m 755 "$OPENRC_DIR"
+        install -o root -g "$(id -gn root)" -m 755 "$SOURCE_DIR/agent-temporary-boot.openrc" "$OPENRC_DIR/agent-temporary-boot"
+        install -o root -g "$(id -gn root)" -m 755 "$SOURCE_DIR/agent-temporary-expire.openrc" "$OPENRC_DIR/agent-temporary-expire"
+        "$RCUPDATE" add agent-temporary-boot default >/dev/null 2>&1 || true
+        "$RCUPDATE" add agent-temporary-expire default >/dev/null 2>&1 || true
+        return
+    fi
+    install -d -m 755 "$SYSTEMD_DIR"
+    install -o root -g "$(id -gn root)" -m 644 "$SOURCE_DIR/agent-temporary-expire.service" "$SYSTEMD_DIR/agent-temporary-expire.service"
+    install -o root -g "$(id -gn root)" -m 644 "$SOURCE_DIR/agent-temporary-expire.timer" "$SYSTEMD_DIR/agent-temporary-expire.timer"
+    install -o root -g "$(id -gn root)" -m 644 "$SOURCE_DIR/agent-temporary-boot.service" "$SYSTEMD_DIR/agent-temporary-boot.service"
+    "$SYSTEMCTL" daemon-reload
+    "$SYSTEMCTL" enable agent-temporary-boot.service >/dev/null
+    "$SYSTEMCTL" enable agent-temporary-expire.timer >/dev/null
+}
+
+do_install() {
+    need_root install; validate_platform
+    target_user=${INSTALL_USER:-${AGENT_USER:-${SUDO_USER:-}}}
+    [ -n "$target_user" ] || die "set AGENT_USER or run through sudo from the target user"
+    id "$target_user" >/dev/null 2>&1 || die "unknown user: $target_user"
+    install -d -m 755 "$PREFIX"; install -d -m 700 "$STATE_DIR"; install -d -m 700 "$STATE_DIR/backups"
+    stamp=$(date +%Y%m%d-%H%M%S); backup="$STATE_DIR/backups/$stamp"; install -d -m 700 "$backup"
+    for file in "$RULE" "$TARGET" "$CONFIG"; do [ -e "$file" ] && cp -p "$file" "$backup/$(basename "$file")" || true; done
+    rm -f "$RULE" "$STATE"
+    install -o root -g "$(id -gn root)" -m 755 "$0" "$TARGET"
+    tmp=$(mktemp "${CONFIG}.XXXXXX"); trap 'rm -f "$tmp"' EXIT HUP INT TERM
+    printf 'AGENT_USER=%s\n' "$target_user" > "$tmp"
+    chmod 600 "$tmp"; chown root:"$(id -gn root)" "$tmp"; mv -f "$tmp" "$CONFIG"
+    trap - EXIT HUP INT TERM
+    install_units
+    service_stop agent-temporary-expire
+    validate_sudoers
+    echo "Installed $TARGET version $VERSION for user $target_user; temporary access is inactive."
+}
+
+macos_plist_lint() {
+    command -v plutil >/dev/null 2>&1 || die "plutil is required on macOS"
+    plutil -lint "$1" >/dev/null || die "invalid launchd plist: $1"
+}
+
+macos_install_file() {
+    src=$1 dest=$2 mode=$3
+    [ -f "$src" ] || die "release file is missing: $src"
+    install -o root -g wheel -m "$mode" "$src" "$dest" || die "cannot install $dest"
+}
+
+do_install_macos() {
+    need_root install
+    command -v visudo >/dev/null 2>&1 || die "visudo is required"
+    [ ! -e /etc/sudoers.d/90-temporary-agent ] || die "legacy sudoers fragment exists; remove it before installation"
+    target_user=${INSTALL_USER:-${SUDO_USER:-}}
+    [ -n "$target_user" ] || die "set --user USER or run through sudo from the target user"
+    id "$target_user" >/dev/null 2>&1 || die "unknown user: $target_user"
+    macos_backend=$SOURCE_DIR/macos/agent-temporary-macos
+    macos_reaper=$SOURCE_DIR/macos/agent-temporary-reaper
+    macos_expire=$SOURCE_DIR/macos/com.agent-temporary.expire.plist
+    macos_boot=$SOURCE_DIR/macos/com.agent-temporary.boot.plist
+    for plist in "$macos_expire" "$macos_boot"; do macos_plist_lint "$plist"; done
+    sh -n "$macos_backend" "$macos_reaper"
+    if [ -e /etc/sudoers.d/90-agent-temporary ] || [ -e /var/db/agent-temporary/state ]; then
+        [ -x /usr/local/libexec/agent-temporary-macos ] || die "managed macOS authority exists but its backend is missing"
+        /usr/local/libexec/agent-temporary-macos off || die "cannot revoke existing macOS authority"
+    fi
+    "$VISUDO" -cf "$SUDOERS" >/dev/null || die "sudoers validation failed before installation"
+    install -d -o root -g wheel -m 755 /usr/local/bin /usr/local/libexec
+    install -d -o root -g wheel -m 700 /var/db/agent-temporary
+    macos_install_file "$macos_backend" /usr/local/libexec/agent-temporary-macos 755
+    macos_install_file "$macos_reaper" /usr/local/libexec/agent-temporary-reaper 755
+    macos_install_file "$macos_expire" /Library/LaunchDaemons/com.agent-temporary.expire.plist 644
+    macos_install_file "$macos_boot" /Library/LaunchDaemons/com.agent-temporary.boot.plist 644
+    tmp=$(mktemp /etc/agent-temporary.conf.XXXXXX)
+    printf 'CONFIG_USER=%s\n' "$target_user" > "$tmp"
+    chmod 600 "$tmp"; chown root:wheel "$tmp"; mv -f "$tmp" /etc/agent-temporary.conf
+    macos_install_file "$SOURCE_DIR/agent-temporary" "$TARGET" 755
+    launchctl bootout system/com.agent-temporary.expire >/dev/null 2>&1 || true
+    launchctl bootout system/com.agent-temporary.boot >/dev/null 2>&1 || true
+    launchctl bootstrap system /Library/LaunchDaemons/com.agent-temporary.expire.plist || die "cannot bootstrap expiry launchd job"
+    launchctl bootstrap system /Library/LaunchDaemons/com.agent-temporary.boot.plist || die "cannot bootstrap boot launchd job"
+    launchctl print system/com.agent-temporary.expire >/dev/null 2>&1 || die "expiry launchd job is not loaded"
+    launchctl print system/com.agent-temporary.boot >/dev/null 2>&1 || die "boot launchd job is not loaded"
+    "$VISUDO" -cf "$SUDOERS" >/dev/null || die "sudoers validation failed after installation"
+    echo "Installed $TARGET version $VERSION for user $target_user; temporary access is inactive."
+}
+
+do_on() {
+    need_root on
+    ttl_text=; persist_reboot=no
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            --ttl) [ "$#" -ge 2 ] || die "--ttl requires a duration"; [ -z "$ttl_text" ] || die "--ttl supplied more than once"; ttl_text=$2; shift 2 ;;
+            --persist-reboot) [ "$persist_reboot" = no ] || die "--persist-reboot supplied more than once"; persist_reboot=yes; shift ;;
+            *) die "unknown on option: $1" ;;
+        esac
+    done
+    [ "$persist_reboot" = no ] || [ -n "$ttl_text" ] || die "--persist-reboot requires explicit --ttl DURATION"
+    [ -n "$ttl_text" ] || ttl_text=$DEFAULT_TTL
+    ttl_seconds=$(parse_ttl "$ttl_text"); validate_platform; load_user
+    if [ -f "$STATE" ]; then
+        expires=$(state_value expires_at_epoch); now=$(date +%s)
+        if [ -n "$expires" ] && [ "$now" -lt "$expires" ] && effective_unrestricted "$AGENT_USER"; then
+            echo "already active; expires_at_epoch=$expires; no changes made."; exit 0
+        fi
+        if [ -n "$expires" ] && [ "$now" -ge "$expires" ] && [ ! -e "$RULE" ]; then
+            rm -f "$STATE"
+        else
+            die "already active or inconsistent: run status/off"
+        fi
+    fi
+    now=$(date +%s); expires=$((now + ttl_seconds)); write_rule; write_state "$now" "$expires" "$ttl_text" "$persist_reboot"
+    if ! service_start agent-temporary-expire >/dev/null 2>&1; then rm -f "$RULE" "$STATE"; die "could not arm local expiry timer; privilege was revoked"; fi
+    validate_sudoers; echo "Temporary agent sudo access enabled for $AGENT_USER until epoch $expires."
+}
+
+do_off() {
+    need_root off; load_user; rm -f "$RULE" "$STATE"
+    service_stop agent-temporary-expire
+    validate_sudoers
+    if effective_unrestricted "$AGENT_USER"; then die "effective temporary privilege remains after revoke"; fi
+    echo "Temporary agent sudo access disabled."
+}
+
+do_expire() {
+    need_root internal; [ -f "$STATE" ] || exit 0; expires=$(state_value expires_at_epoch)
+    case "$expires" in ''|*[!0-9]*) rm -f "$RULE" "$STATE"; exit 0 ;; esac
+    [ "$(date +%s)" -ge "$expires" ] || exit 0; rm -f "$RULE"; validate_sudoers
+}
+
+do_expire_loop() {
+    need_root internal
+    while [ -f "$STATE" ]; do
+        expires=$(state_value expires_at_epoch); now=$(date +%s)
+        case "$expires" in ''|*[!0-9]*) rm -f "$RULE" "$STATE"; validate_sudoers; exit 0 ;; esac
+        if [ "$now" -ge "$expires" ]; then rm -f "$RULE"; validate_sudoers; exit 0; fi
+        sleep 1
+    done
+}
+
+do_boot_revoke() {
+    need_root internal
+    if [ ! -f "$STATE" ]; then rm -f "$RULE"; validate_sudoers; exit 0; fi
+    load_user; expires=$(state_value expires_at_epoch); now=$(date +%s); persist=$(state_value persist_reboot)
+    case "$expires" in ''|*[!0-9]*) rm -f "$RULE" "$STATE"; validate_sudoers; exit 0 ;; esac
+    if [ "$now" -ge "$expires" ]; then rm -f "$RULE" "$STATE"; service_stop agent-temporary-expire; validate_sudoers; exit 0; fi
+    if [ "$persist" != yes ]; then rm -f "$RULE" "$STATE"; service_stop agent-temporary-expire; validate_sudoers; exit 0; fi
+    if ! effective_unrestricted "$AGENT_USER"; then write_rule; fi
+    service_start agent-temporary-expire >/dev/null
+    validate_sudoers
+}
+
+do_status() {
+    if [ "$(id -u)" -ne 0 ] && { [ ! -r "$STATE" ] || [ ! -r "$RULE" ]; }; then
+        echo "status=inspection-requires-privilege"; echo "detail=root privileges are required to inspect effective temporary sudo state"; exit 0
+    fi
+    if [ ! -r "$CONFIG" ]; then echo "status=inspection-requires-privilege"; exit 0; fi
+    . "$CONFIG"; AGENT_USER=${AGENT_USER:-unknown}; rule_present=no; [ -e "$RULE" ] && rule_present=yes; state_present=no; [ -e "$STATE" ] && state_present=yes
+    if [ "$rule_present" = no ] && [ "$state_present" = no ]; then echo "state=inactive"; echo "effective_authority=false"; echo "user=$AGENT_USER"; echo "persist_reboot=no"; echo "version=$VERSION"; exit 0; fi
+    if [ "$rule_present" = yes ] && [ "$state_present" = no ]; then echo "state=inconsistent"; echo "effective_authority=unknown"; echo "status=broken/inconsistent"; echo "detail=effective rule without state"; exit 0; fi
+    if [ "$rule_present" = no ] && [ "$state_present" = yes ]; then
+        expires=$(state_value expires_at_epoch); now=$(date +%s)
+        if [ -n "$expires" ] && [ "$now" -ge "$expires" ]; then echo "state=expired"; echo "effective_authority=false"; else echo "state=inconsistent"; echo "effective_authority=false"; echo "status=broken/inconsistent"; echo "detail=state without effective rule"; fi
+        exit 0
+    fi
+    expires=$(state_value expires_at_epoch); now=$(date +%s)
+    if [ -z "$expires" ]; then echo "state=inconsistent"; echo "effective_authority=unknown"; echo "status=broken/inconsistent"; echo "detail=missing expiry"; exit 0; fi
+    if [ "$now" -ge "$expires" ]; then
+        if effective_unrestricted "$AGENT_USER"; then echo "state=inconsistent"; echo "effective_authority=true"; echo "status=security-error"; echo "detail=expiry passed but privilege remains";
+        else echo "state=expired"; echo "effective_authority=false"; fi
+        exit 0
+    fi
+    if ! effective_unrestricted "$AGENT_USER"; then echo "state=inconsistent"; echo "effective_authority=false"; echo "status=broken/inconsistent"; echo "detail=exact sudo execution is not effective"; exit 0; fi
+    if ! service_active agent-temporary-expire; then echo "state=inconsistent"; echo "effective_authority=true"; echo "status=security-error"; echo "detail=expiry timer is not active"; exit 0; fi
+    persist=$(state_value persist_reboot); [ "$persist" = yes ] || persist=no
+    remaining=$((expires - now)); echo "state=active"; echo "effective_authority=true"; echo "user=$AGENT_USER"; echo "version=$(state_value version)"; echo "activated_at_epoch=$(state_value activated_at_epoch)"; echo "expires_at_epoch=$expires"; echo "remaining_seconds=$remaining"; echo "ttl=$(state_value ttl)"; echo "persist_reboot=$persist"; echo "scope=unrestricted-root"; echo "authentication=NOPASSWD"
+}
+
+if [ "$OS" = Darwin ]; then
+    case "${1:-status}" in
+        install) shift; INSTALL_USER=; [ "${1:-}" = --user ] && { [ "$#" -eq 2 ] || usage; INSTALL_USER=$2; }; do_install_macos ;;
+        version) [ "$#" -eq 1 ] || usage; echo "agent-temporary $VERSION" ;;
+        --validate-ttl) [ "$#" -eq 2 ] || usage; parse_ttl "$2" >/dev/null; echo valid ;;
+        *) exec /usr/local/libexec/agent-temporary-macos "$@" ;;
+    esac
+    exit 0
+fi
+
+case "${1:-status}" in
+    on) shift; do_on "$@" ;; off) do_off ;; status)
+        shift; STATUS_JSON=no
+        if [ "$#" -eq 1 ] && [ "$1" = --json ]; then STATUS_JSON=yes
+        elif [ "$#" -ne 0 ]; then usage
+        fi
+        if [ "$STATUS_JSON" = yes ]; then
+            do_status | awk -F= 'BEGIN { printf "{"; first=1 }
+                { key=$1; value=substr($0, index($0,"=")+1); gsub(/\\/,"\\\\",value); gsub(/"/,"\\\"",value); if (!first) printf ","; printf "\"%s\":\"%s\"",key,value; first=0 }
+                END { print "}" }'
+        else do_status
+        fi ;;
+    version) version ;;
+    --validate-ttl) [ "$#" -eq 2 ] || usage; parse_ttl "$2" >/dev/null; echo valid ;;
+    --internal-expire) do_expire ;; --internal-expire-loop) do_expire_loop ;; --internal-boot-revoke) do_boot_revoke ;; *) usage ;;
+esac

package/payload/agent-temporary-boot.openrc

@@ -0,0 +1,10 @@
+#!/sbin/openrc-run
+
+name="agent-temporary-boot"
+command="/usr/local/bin/agent-temporary"
+command_args="--internal-boot-revoke"
+
+depend() {
+    need localmount
+    after bootmisc
+}

package/payload/agent-temporary-boot.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Revoke agent-temporary privilege after boot
+After=local-fs.target
+Before=sshd.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/agent-temporary --internal-boot-revoke
+
+[Install]
+WantedBy=multi-user.target

package/payload/agent-temporary-expire.openrc

@@ -0,0 +1,15 @@
+#!/sbin/openrc-run
+
+name="agent-temporary-expire"
+command="/usr/local/bin/agent-temporary"
+command_args="--internal-expire-loop"
+command_background=true
+supervisor="supervise-daemon"
+respawn_delay=30
+respawn_max=5
+respawn_period=600
+
+depend() {
+    need localmount
+    after bootmisc
+}

package/payload/agent-temporary-expire.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Expire agent-temporary privilege when its local TTL ends
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/agent-temporary --internal-expire

package/payload/agent-temporary-expire.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Local expiry check for agent-temporary privilege
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=1min
+AccuracySec=1s
+Unit=agent-temporary-expire.service
+
+[Install]
+WantedBy=timers.target

package/payload/install.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+base=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec env AGENT_TEMPORARY_RELEASE_DIR="$base" sh "$base/agent-temporary" install "$@"

package/payload/macos/agent-temporary-macos

@@ -0,0 +1,292 @@
+#!/bin/sh
+
+VERSION=0.7.0
+RULE=${AGENT_TEMPORARY_RULE:-/etc/sudoers.d/90-agent-temporary}
+STATE_DIR=${AGENT_TEMPORARY_STATE_DIR:-/var/db/agent-temporary}
+STATE=${AGENT_TEMPORARY_STATE:-$STATE_DIR/state}
+LOCK=${AGENT_TEMPORARY_LOCK:-$STATE_DIR/.lock}
+SUDOERS=${AGENT_TEMPORARY_SUDOERS:-/etc/sudoers}
+CONFIG=${AGENT_TEMPORARY_CONFIG:-/etc/agent-temporary.conf}
+EXPIRY_LABEL=com.agent-temporary.expire
+
+ID=${ID:-/usr/bin/id}
+DATE=${DATE:-/bin/date}
+SYSCTL=${SYSCTL:-/usr/sbin/sysctl}
+MKTEMP=${MKTEMP:-/usr/bin/mktemp}
+MV=${MV:-/bin/mv}
+RM=${RM:-/bin/rm}
+MKDIR=${MKDIR:-/bin/mkdir}
+RMDIR=${RMDIR:-/bin/rmdir}
+CHMOD=${CHMOD:-/bin/chmod}
+CHOWN=${CHOWN:-/usr/sbin/chown}
+VISUDO=${VISUDO:-/usr/sbin/visudo}
+LAUNCHCTL=${LAUNCHCTL:-/bin/launchctl}
+PROBE=${PROBE:-}
+SUDO=${SUDO:-/usr/bin/sudo}
+SU=${SU:-/usr/bin/su}
+TRUE=${TRUE:-/usr/bin/true}
+KICK_ATTEMPTS=${KICK_ATTEMPTS:-100}
+KICK_SLEEP=${KICK_SLEEP:-0.1}
+REAPER_LOCK_ATTEMPTS=${REAPER_LOCK_ATTEMPTS:-100}
+REAPER_LOCK_SLEEP=${REAPER_LOCK_SLEEP:-0.1}
+
+die() { echo "agent-temporary: $*" >&2; exit 1; }
+usage() { echo "usage: agent-temporary-macos on [--ttl MINUTESm|HOURSh] [--persist-reboot] | off | status | --reaper | --boot-revoke" >&2; exit 2; }
+
+require_root() { [ "$($ID -u 2>/dev/null)" = 0 ] || die "root is required"; }
+
+load_user() {
+    TARGET_USER=${AGENT_TEMPORARY_USER:-}
+    if [ -r "$CONFIG" ]; then
+        CONFIG_USER=
+        . "$CONFIG"
+        [ -n "$CONFIG_USER" ] && TARGET_USER=$CONFIG_USER
+    fi
+    [ -n "$TARGET_USER" ] || die "configured target user is required"
+    "$ID" "$TARGET_USER" >/dev/null 2>&1 || die "unknown target user: $TARGET_USER"
+}
+
+now() { "$DATE" +%s; }
+boot_identity() {
+    raw=$("$SYSCTL" -n kern.boottime 2>/dev/null) || return 1
+    sec=$(printf '%s\n' "$raw" | sed -n 's/.*{[[:space:]]*sec[[:space:]]*=[[:space:]]*\([0-9][0-9]*\).*/\1/p' | sed -n '1p')
+    usec=$(printf '%s\n' "$raw" | sed -n 's/.*,[[:space:]]*usec[[:space:]]*=[[:space:]]*\([0-9][0-9]*\).*/\1/p' | sed -n '1p')
+    digits "$sec" && digits "$usec" || return 1
+    printf '%s:%s\n' "$sec" "$usec"
+}
+state_value() { [ -f "$STATE" ] || return 1; sed -n "s/^$1=//p" "$STATE" | sed -n '1p'; }
+digits() { case $1 in ''|*[!0-9]*) return 1;; *) return 0;; esac; }
+
+parse_ttl() {
+    ttl=$1
+    case "$ttl" in
+        [0-9]*m) number=${ttl%m}; unit=m;;
+        [0-9]*h) number=${ttl%h}; unit=h;;
+        *) die "TTL must be a positive integer number of minutes or hours";;
+    esac
+    digits "$number" || die "malformed TTL: $ttl"
+    while [ "${number#0}" != "$number" ]; do number=${number#0}; done
+    [ -n "$number" ] || die "TTL must be greater than zero"
+    case "$unit" in
+        m) [ "$number" -le 480 ] || die "TTL maximum is 8h"; seconds=$((number * 60));;
+        h) [ "$number" -le 8 ] || die "TTL maximum is 8h"; seconds=$((number * 3600));;
+    esac
+    [ "$seconds" -ge 300 ] || die "TTL minimum is 5m"
+    echo "$seconds"
+}
+
+valid_state() {
+    [ -f "$STATE" ] || return 1
+    awk -F= '
+        BEGIN { ok=1; count=0 }
+        NF != 2 { ok=0; next }
+        $1 !~ /^(phase|user|issued_at|expires_at|boot_identity|persist_reboot)$/ { ok=0 }
+        { seen[$1]++; if (seen[$1] > 1) ok=0 }
+        { count++ }
+        END {
+            if (count != 6) ok=0
+            if (!seen["phase"] || !seen["user"] || !seen["issued_at"] || !seen["expires_at"] || !seen["boot_identity"] || !seen["persist_reboot"]) ok=0
+            exit(ok ? 0 : 1)
+        }
+    ' "$STATE" 2>/dev/null || return 1
+    phase=$(state_value phase) || return 1
+    user=$(state_value user) || return 1
+    issued=$(state_value issued_at) || return 1
+    expires=$(state_value expires_at) || return 1
+    boot=$(state_value boot_identity) || return 1
+    persist=$(state_value persist_reboot) || return 1
+    [ "$phase" = active ] || [ "$phase" = prepared ] || return 1
+    [ -n "$user" ] && digits "$issued" && digits "$expires" && [ "$issued" -le "$expires" ] && [ -n "$boot" ] && { [ "$persist" = yes ] || [ "$persist" = no ]; }
+}
+
+secure_state_dir() {
+    "$MKDIR" -p "$STATE_DIR" 2>/dev/null || die "cannot create state directory"
+    "$CHMOD" 700 "$STATE_DIR" 2>/dev/null || die "cannot secure state directory"
+    "$CHOWN" root:wheel "$STATE_DIR" 2>/dev/null || die "cannot secure state ownership"
+}
+acquire_lock() {
+    secure_state_dir
+    "$MKDIR" "$LOCK" 2>/dev/null || die "transaction already in progress"
+    "$CHMOD" 700 "$LOCK" 2>/dev/null || die "cannot secure transaction lock"
+    "$CHOWN" root:wheel "$LOCK" 2>/dev/null || die "cannot secure transaction lock ownership"
+    trap release_lock EXIT INT TERM
+}
+acquire_lock_wait() {
+    secure_state_dir
+    attempts=0
+    while ! "$MKDIR" "$LOCK" 2>/dev/null; do
+        [ "$attempts" -lt "$REAPER_LOCK_ATTEMPTS" ] || die "reaper transaction lock wait expired"
+        attempts=$((attempts + 1)); sleep "$REAPER_LOCK_SLEEP"
+    done
+    "$CHMOD" 700 "$LOCK" 2>/dev/null || die "cannot secure transaction lock"
+    "$CHOWN" root:wheel "$LOCK" 2>/dev/null || die "cannot secure transaction lock ownership"
+    trap release_lock EXIT INT TERM
+}
+release_lock() { "$RMDIR" "$LOCK" 2>/dev/null || true; trap - EXIT INT TERM; }
+remove_rule() { [ -e "$RULE" ] && "$RM" -f "$RULE"; }
+clear_state() { [ -e "$STATE" ] && "$RM" -f "$STATE"; }
+validate_full() { "$VISUDO" -cf "$SUDOERS" >/dev/null 2>&1; }
+
+exact_probe() {
+    if [ -n "$PROBE" ]; then "$PROBE" "$1"; else "$SU" "$1" -c "$SUDO -k; $SUDO -n $TRUE"; fi
+}
+
+daemon_running() {
+    "$LAUNCHCTL" print "system/$EXPIRY_LABEL" 2>/dev/null | grep -q 'state = running'
+}
+
+kick_reaper() {
+    "$LAUNCHCTL" print "system/$EXPIRY_LABEL" >/dev/null 2>&1 || return 1
+    "$LAUNCHCTL" kickstart -p "system/$EXPIRY_LABEL" >/dev/null 2>&1 || return 1
+    i=0
+    while [ "$i" -lt "$KICK_ATTEMPTS" ]; do
+        daemon_running && return 0
+        i=$((i + 1)); sleep "$KICK_SLEEP"
+    done
+    return 1
+}
+
+write_state() {
+    phase=$1 user=$2 issued=$3 expires=$4 boot=$5 persist=$6
+    tmp=$($MKTEMP "$STATE.XXXXXX") || return 1
+    if ! { printf 'phase=%s\n' "$phase"; printf 'user=%s\n' "$user"; printf 'issued_at=%s\n' "$issued"; printf 'expires_at=%s\n' "$expires"; printf 'boot_identity=%s\n' "$boot"; printf 'persist_reboot=%s\n' "$persist"; } >"$tmp"; then
+        "$RM" -f "$tmp"; return 1
+    fi
+    "$CHMOD" 600 "$tmp" 2>/dev/null || { "$RM" -f "$tmp"; return 1; }
+    "$CHOWN" root:wheel "$tmp" 2>/dev/null || { "$RM" -f "$tmp"; return 1; }
+    "$MV" "$tmp" "$STATE" 2>/dev/null || { "$RM" -f "$tmp"; return 1; }
+}
+
+write_candidate() {
+    user=$1
+    tmp=$($MKTEMP "$RULE.XXXXXX") || return 1
+    if ! { printf 'Defaults:%s !authenticate\n' "$user"; printf '%s ALL=(ALL) NOPASSWD: ALL\n' "$user"; } >"$tmp"; then
+        "$RM" -f "$tmp"; return 1
+    fi
+    "$CHMOD" 440 "$tmp" 2>/dev/null || { "$RM" -f "$tmp"; return 1; }
+    "$CHOWN" root:wheel "$tmp" 2>/dev/null || { "$RM" -f "$tmp"; return 1; }
+    "$VISUDO" -cf "$tmp" >/dev/null 2>&1 || { "$RM" -f "$tmp"; return 1; }
+    CANDIDATE=$tmp
+}
+
+rollback() {
+    [ -n "${CANDIDATE:-}" ] && "$RM" -f "$CANDIDATE" 2>/dev/null || true
+    remove_rule; clear_state; validate_full || true
+}
+
+revoke_locked() {
+    user=${1:-}; validation_failed=0
+    remove_rule
+    validate_full || validation_failed=1
+    clear_state
+    if [ -n "$user" ] && exact_probe "$user" >/dev/null 2>&1; then probe_failed=1; else probe_failed=0; fi
+    [ "$validation_failed" = 0 ] && [ "$probe_failed" = 0 ]
+}
+
+classify_before_on() {
+    if [ -e "$RULE" ] && ! valid_state; then revoke_locked "${TARGET_USER:-}" || true; return 0; fi
+    if [ -f "$STATE" ] && [ ! -e "$RULE" ]; then clear_state; return 0; fi
+    if valid_state; then
+        phase=$(state_value phase); expires=$(state_value expires_at); existing_persist=$(state_value persist_reboot)
+        if [ "$phase" != active ] || [ "$expires" -le "$(now)" ]; then
+            revoke_locked "$(state_value user)" || true
+        elif [ -e "$RULE" ]; then
+            if exact_probe "$(state_value user)" >/dev/null 2>&1 && daemon_running; then
+                [ "$existing_persist" = "$REQUESTED_PERSIST" ] || die "already active; run off before changing persistence"
+                echo "already active; expires_at=$expires; no changes made."; exit 0
+            fi
+            revoke_locked "$(state_value user)" || true
+        fi
+    fi
+}
+
+on_cmd() {
+    require_root; load_user; ttl=300; REQUESTED_PERSIST=no
+    while [ "$#" -gt 0 ]; do
+        case $1 in
+            --ttl) [ "$#" -ge 2 ] || usage; ttl=$(parse_ttl "$2") || exit 1; shift 2;;
+            --persist-reboot) [ "$REQUESTED_PERSIST" = no ] || usage; REQUESTED_PERSIST=yes; shift;;
+            *) usage;;
+        esac
+    done
+    acquire_lock; classify_before_on
+    started=$(now); expires=$((started + ttl)); boot=$(boot_identity) || { release_lock; die "cannot determine boot identity"; }
+    write_candidate "$TARGET_USER" || { rollback; release_lock; die "cannot prepare sudoers candidate"; }
+    write_state prepared "$TARGET_USER" "$started" "$expires" "$boot" "$REQUESTED_PERSIST" || { rollback; release_lock; die "cannot write prepared state"; }
+    "$MV" "$CANDIDATE" "$RULE" 2>/dev/null || { rollback; release_lock; die "cannot install sudoers fragment"; }
+    CANDIDATE=
+    validate_full || { rollback; release_lock; die "complete sudoers validation failed"; }
+    exact_probe "$TARGET_USER" >/dev/null 2>&1 || { rollback; release_lock; die "exact authority probe failed"; }
+    write_state active "$TARGET_USER" "$started" "$expires" "$boot" "$REQUESTED_PERSIST" || { rollback; release_lock; die "cannot commit active state"; }
+    kick_reaper || { rollback; release_lock; die "expiry launchd job is not ready"; }
+    echo "Temporary agent access enabled for $TARGET_USER until epoch $expires."
+}
+
+status_cmd() {
+    if [ "$($ID -u 2>/dev/null)" -ne 0 ]; then
+        if [ ! -e "$RULE" ] && [ ! -e "$STATE" ]; then
+            echo 'state=inactive'; echo 'effective_authority=false'; echo "version=$VERSION"; return 0
+        fi
+        echo 'status=inspection-requires-privilege'
+        echo 'detail=root privileges are required to inspect effective temporary sudo state'
+        return 0
+    fi
+    acquire_lock
+    if [ ! -e "$RULE" ] && [ ! -e "$STATE" ]; then echo 'state=inactive'; echo 'effective_authority=false'; echo "version=$VERSION"; return 0; fi
+    if ! valid_state; then remove_rule; clear_state; validate_full || true; echo 'state=inconsistent'; echo 'detail=orphan-or-invalid-authority'; echo 'effective_authority=false'; echo "version=$VERSION"; return 0; fi
+    user=$(state_value user); expires=$(state_value expires_at)
+    if [ ! -e "$RULE" ]; then clear_state; echo 'state=inconsistent'; echo 'detail=state-without-authority'; echo 'effective_authority=false'; echo "version=$VERSION"; return 0; fi
+    if [ "$expires" -le "$(now)" ]; then revoke_locked "$user" || true; echo 'state=expired'; echo 'effective_authority=false'; echo "expires_at=$expires"; echo "version=$VERSION"; return 0; fi
+    if ! daemon_running; then revoke_locked "$user" || true; echo 'state=inconsistent'; echo 'detail=reaper-unavailable'; echo 'effective_authority=false'; echo "version=$VERSION"; return 0; fi
+    if ! exact_probe "$user" >/dev/null 2>&1; then revoke_locked "$user" || true; echo 'state=inconsistent'; echo 'detail=effective-authority-failed'; echo 'effective_authority=false'; echo "version=$VERSION"; return 0; fi
+    echo 'state=active'; echo 'effective_authority=true'; echo "user=$user"; echo "issued_at=$(state_value issued_at)"; echo "expires_at=$expires"; echo "remaining_seconds=$((expires - $(now)))"; echo "persist_reboot=$(state_value persist_reboot)"; echo "version=$VERSION"
+}
+
+off_cmd() {
+    require_root; user=${AGENT_TEMPORARY_USER:-}; [ -f "$STATE" ] && user=$(state_value user 2>/dev/null || printf '%s' "$user"); acquire_lock_wait
+    revoke_locked "$user" || { release_lock; die "revocation validation or exact probe failed"; }
+    echo 'Temporary agent access disabled.'
+}
+
+reaper_cmd() {
+    require_root; acquire_lock_wait
+    if ! valid_state || [ ! -e "$RULE" ]; then revoke_locked "$(state_value user 2>/dev/null || true)" || true; release_lock; exit 0; fi
+    user=$(state_value user); expires=$(state_value expires_at); boot=$(state_value boot_identity); current_boot=$(boot_identity)
+    if [ "$expires" -le "$(now)" ] || [ "$boot" != "$current_boot" ]; then revoke_locked "$user" || true; release_lock; exit 0; fi
+    release_lock
+    while :; do
+        [ -f "$STATE" ] && [ -e "$RULE" ] || exit 0
+        [ "$(now)" -ge "$expires" ] && { acquire_lock; revoke_locked "$user" || true; release_lock; exit 0; }
+        sleep 1
+    done
+}
+
+boot_reconcile_cmd() {
+    require_root; acquire_lock
+    if [ ! -f "$STATE" ]; then remove_rule; validate_full || true; return 0; fi
+    if ! valid_state; then revoke_locked "$(state_value user 2>/dev/null || true)" || true; return 1; fi
+    phase=$(state_value phase); user=$(state_value user); issued=$(state_value issued_at); expires=$(state_value expires_at); persist=$(state_value persist_reboot); current_boot=$(boot_identity)
+    if [ "$phase" != active ] || [ "$persist" != yes ] || [ "$expires" -le "$(now)" ] || [ "$(now)" -lt "$issued" ]; then
+        revoke_locked "$user" || true; return 0
+    fi
+    if [ -z "$current_boot" ]; then revoke_locked "$user" || true; return 1; fi
+    CANDIDATE=
+    write_candidate "$user" || { rollback; return 1; }
+    "$MV" "$CANDIDATE" "$RULE" 2>/dev/null || { rollback; return 1; }
+    CANDIDATE=
+    validate_full || { rollback; return 1; }
+    exact_probe "$user" >/dev/null 2>&1 || { rollback; return 1; }
+    write_state active "$user" "$issued" "$expires" "$current_boot" yes || { rollback; return 1; }
+    kick_reaper || { rollback; return 1; }
+    return 0
+}
+
+case ${1:-} in
+    on) shift; on_cmd "$@";;
+    off) shift; [ "$#" -eq 0 ] || usage; off_cmd;;
+    status) shift; [ "$#" -eq 0 ] || usage; status_cmd;;
+    --reaper) [ "$#" -eq 1 ] || usage; reaper_cmd;;
+    --boot-revoke) [ "$#" -eq 1 ] || usage; boot_reconcile_cmd;;
+    version|--version) [ "$#" -eq 1 ] || usage; echo "agent-temporary $VERSION";;
+    *) usage;;
+esac

package/payload/macos/agent-temporary-reaper

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /usr/local/libexec/agent-temporary-macos --reaper

package/payload/macos/com.agent-temporary.boot.plist

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.agent-temporary.boot</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/local/libexec/agent-temporary-macos</string>
+        <string>--boot-revoke</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <dict>
+        <key>SuccessfulExit</key>
+        <false/>
+    </dict>
+    <key>ThrottleInterval</key>
+    <integer>60</integer>
+</dict>
+</plist>

package/payload/macos/com.agent-temporary.expire.plist

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.agent-temporary.expire</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/usr/local/libexec/agent-temporary-reaper</string>
+        <string>--reaper</string>
+    </array>
+    <key>ThrottleInterval</key>
+    <integer>60</integer>
+</dict>
+</plist>

package/payload/uninstall.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+set -eu
+
+PREFIX=${PREFIX:-/usr/local/bin}
+TARGET=${TARGET:-$PREFIX/agent-temporary}
+UNAME=${UNAME:-uname}
+OS=$($UNAME -s 2>/dev/null || true)
+if [ "$OS" = Darwin ]; then
+    RULE=${AGENT_TEMPORARY_RULE:-/etc/sudoers.d/90-agent-temporary}
+    LEGACY_RULE=${AGENT_TEMPORARY_LEGACY_RULE:-/etc/sudoers.d/90-temporary-agent}
+    STATE_DIR=${AGENT_TEMPORARY_STATE_DIR:-/var/db/agent-temporary}
+    [ "$(id -u)" -eq 0 ] || { echo "Run as root: sudo $0" >&2; exit 1; }
+    [ ! -e "$LEGACY_RULE" ] || { echo "Security error: legacy sudoers authority fragment exists at $LEGACY_RULE; inspect and intentionally clean it up before uninstall" >&2; exit 1; }
+    [ -x /usr/local/libexec/agent-temporary-macos ] || { [ ! -e "$RULE" ] || { echo "macOS backend is missing; refusing unsafe uninstall" >&2; exit 1; }; }
+    if [ -e "$RULE" ] || [ -e "$STATE_DIR/state" ]; then
+        /usr/local/libexec/agent-temporary-macos off || { echo "Could not revoke managed macOS authority" >&2; exit 1; }
+    fi
+    /usr/sbin/visudo -cf /etc/sudoers >/dev/null || { echo "sudoers validation failed after revoke" >&2; exit 1; }
+    /bin/launchctl bootout system/com.agent-temporary.expire >/dev/null 2>&1 || true
+    /bin/launchctl bootout system/com.agent-temporary.boot >/dev/null 2>&1 || true
+    rm -f /Library/LaunchDaemons/com.agent-temporary.expire.plist /Library/LaunchDaemons/com.agent-temporary.boot.plist /usr/local/libexec/agent-temporary-macos /usr/local/libexec/agent-temporary-reaper "$TARGET" /etc/agent-temporary.conf
+    rm -rf "$STATE_DIR"
+    /usr/sbin/visudo -cf /etc/sudoers >/dev/null || { echo "sudoers validation failed after uninstall" >&2; exit 1; }
+    echo "Removed macOS agent-temporary runtime, privilege rule, launchd jobs, and state."
+    exit 0
+fi
+RULE=${AGENT_TEMPORARY_RULE:-/etc/sudoers.d/90-temporary-agent}
+CONFIG=${AGENT_TEMPORARY_CONFIG:-/etc/agent-temporary.conf}
+STATE_DIR=${AGENT_TEMPORARY_STATE_DIR:-/var/lib/agent-temporary}
+SYSTEMD_DIR=${AGENT_TEMPORARY_SYSTEMD_DIR:-/etc/systemd/system}
+OPENRC_DIR=${AGENT_TEMPORARY_OPENRC_DIR:-/etc/init.d}
+SYSTEMCTL=${SYSTEMCTL:-systemctl}
+RCSERVICE=${RCSERVICE:-/sbin/rc-service}
+RCUPDATE=${RCUPDATE:-/sbin/rc-update}
+
+[ "$(id -u)" -eq 0 ] || { echo "Run as root: sudo $0" >&2; exit 1; }
+rm -f "$RULE"
+if command -v "$SYSTEMCTL" >/dev/null 2>&1 && { [ -d /run/systemd/system ] || "$SYSTEMCTL" show-environment >/dev/null 2>&1; }; then
+    "$SYSTEMCTL" disable --now agent-temporary-expire.timer >/dev/null 2>&1 || true
+    rm -f "$SYSTEMD_DIR/agent-temporary-expire.service" "$SYSTEMD_DIR/agent-temporary-expire.timer" "$SYSTEMD_DIR/agent-temporary-boot.service"
+    "$SYSTEMCTL" daemon-reload >/dev/null 2>&1 || true
+elif [ -x "$RCSERVICE" ]; then
+    "$RCSERVICE" agent-temporary-expire stop >/dev/null 2>&1 || true
+    "$RCUPDATE" del agent-temporary-boot default >/dev/null 2>&1 || true
+    "$RCUPDATE" del agent-temporary-expire default >/dev/null 2>&1 || true
+    "$RCSERVICE" agent-temporary-boot stop >/dev/null 2>&1 || true
+    rm -f "$OPENRC_DIR/agent-temporary-boot" "$OPENRC_DIR/agent-temporary-expire"
+fi
+rm -f "$CONFIG" "$TARGET"
+rm -rf "$STATE_DIR"
+if command -v visudo >/dev/null 2>&1; then visudo -cf /etc/sudoers >/dev/null; fi
+echo "Removed agent-temporary runtime, privilege rule, service integration, and state."