car-runtime 0.57.4 → 0.58.0

package/README.md

@@ -138,13 +138,19 @@ main({
 
 `runAgent(config, goal)` is also exported for embedding and tests. Pass one
 long-lived runtime as `config.runtime` to reuse its daemon connection across
-runs; otherwise the loop creates and closes a runtime for each call. `serveChat`
+runs; otherwise the loop creates and closes a runtime for each call. The loop
+registers its tools and policies once per daemon session: when that runtime is
+closed and reused, or reconnects after a daemon restart (`connectionEpoch()`
+changes), the next run or `serveChat` chat turn registers them again on the
+new session. `serveChat`
 uses the same option and returns the runtime it is serving on. Its
 `AgentOutcome.run_id` is the durable key accepted by `runsGetTrace`; it is
 `null` when an older daemon has no `runs.*` surface or did not acknowledge the
 start. `runChatTurn` keeps returning bare text by default; pass
 `{ includeRunId: true }` as its final options argument to receive
-`{ text, run_id }`. `main(config)` provides `--task`, `--json`, and `--serve`.
+`{ text, run_id }`. It registers its tool schemas and `config.policies` on the
+runtime itself, so tool-using turns need no earlier `serveChat` call.
+`main(config)` provides `--task`, `--json`, and `--serve`.
 The loop adds `finish`, statically verifies every proposal before execution,
 preserves tool-call/result IDs, honors per-schema `timeoutMs`, traces task and
 chat runs, and uses request-shaped inference with prompt-cache breakpoints.

package/agent-loop.d.ts

@@ -15,6 +15,7 @@ export function runAgent(
   options?: AgentLoopOptions,
 ): Promise<AgentOutcome>;
 
+/** Registers the config's tools and policies on `runtime` before every turn whose `connectionEpoch()` is new. */
 export function runChatTurn(
   runtime: CarRuntime,
   config: AgentLoopConfig,
@@ -27,6 +28,7 @@ export function runChatTurn(
   options: AgentChatTurnOptions & { includeRunId: true },
 ): Promise<AgentChatTurnResult>;
 
+/** Registers the config's tools and policies on `runtime` before every turn whose `connectionEpoch()` is new. */
 export function runChatTurn(
   runtime: CarRuntime,
   config: AgentLoopConfig,

package/agent-loop.js

@@ -121,10 +121,13 @@ function makeToolCallback(tools, toolTimeouts = {}, onFinish = null) {
 //      for the entire run;
 //   2. the LAST tool definition — so identity + every tool schema forms ONE
 //      cached prefix, the largest genuinely stable block this loop has;
-//   3. the LAST message — the moving breakpoint. Anthropic serves the longest
-//      cached prefix it can find, so each turn writes only its own delta and
-//      READS everything the previous turn wrote. That is what turns quadratic
-//      re-billing into one write plus N cheap reads.
+//   3. the SECOND-TO-LAST message — the moving breakpoint. Anthropic serves
+//      the longest cached prefix it can find, so each turn writes only its own
+//      delta and READS everything the previous turn wrote. That is what turns
+//      quadratic re-billing into one write plus N cheap reads. Not the last
+//      message, because CAR's own assistant loop appends per-turn state to the
+//      newest message that the next request re-sends without it; the newest
+//      message is billed once at the input rate before it joins the prefix.
 // The 4th breakpoint is deliberately left unused. It would buy a
 // `context_stable_prefix` split of the system prompt, which helps only when the
 // system prompt has a volatile tail; ours has none, so splitting it would
@@ -142,29 +145,48 @@ function makeToolCallback(tools, toolTimeouts = {}, onFinish = null) {
 // Remember what this package installed so a caller-owned runtime can serve
 // hundreds of sequential runs without appending the same policy hundreds of
 // times. Weak keys ensure this bookkeeping never keeps a runtime/socket alive.
+//
+// The bookkeeping is keyed to the connection epoch, not just the object: after
+// `close()`, or a daemon restart the client silently reconnects through, the
+// same runtime talks to a blank daemon session, and remembering the old one's
+// registrations would leave the new session without its tools and policies.
 const RUNTIME_REGISTRATION = new WeakMap();
+const MAX_SETUP_ATTEMPTS = 3;
+
+// A runtime without `connectionEpoch` (a hand-built runtime-shaped object)
+// reports one epoch forever, which is the object-scoped behavior.
+async function connectionEpoch(rt) {
+  return typeof rt.connectionEpoch === 'function' ? rt.connectionEpoch() : 0;
+}
 
 async function prepareRuntime(rt, toolSchemas, policies) {
-  let state = RUNTIME_REGISTRATION.get(rt);
-  if (!state) {
-    state = { basicsAttempted: false, tools: new Set(), policies: new Set() };
-    RUNTIME_REGISTRATION.set(rt, state);
-  }
-  if (!state.basicsAttempted) {
-    state.basicsAttempted = true;
-    try { await rt.registerAgentBasics(); } catch { /* unsupported on this daemon — fine */ }
-  }
-  for (const schema of toolSchemas) {
-    if (state.tools.has(schema.name)) continue;
-    await rt.registerTool(schema.name);
-    state.tools.add(schema.name);
-  }
-  for (const policy of policies || []) {
-    const fingerprint = JSON.stringify(policy);
-    if (state.policies.has(fingerprint)) continue;
-    await rt.registerPolicy(...policy);
-    state.policies.add(fingerprint);
+  for (let attempt = 0; attempt < MAX_SETUP_ATTEMPTS; attempt++) {
+    const epoch = await connectionEpoch(rt);
+    let state = RUNTIME_REGISTRATION.get(rt);
+    if (!state || state.epoch !== epoch) {
+      state = { epoch, basicsAttempted: false, tools: new Set(), policies: new Set() };
+      RUNTIME_REGISTRATION.set(rt, state);
+    }
+    if (!state.basicsAttempted) {
+      state.basicsAttempted = true;
+      try { await rt.registerAgentBasics(); } catch { /* unsupported on this daemon — fine */ }
+    }
+    for (const schema of toolSchemas) {
+      if (state.tools.has(schema.name)) continue;
+      await rt.registerTool(schema.name);
+      state.tools.add(schema.name);
+    }
+    for (const policy of policies || []) {
+      const fingerprint = JSON.stringify(policy);
+      if (state.policies.has(fingerprint)) continue;
+      await rt.registerPolicy(...policy);
+      state.policies.add(fingerprint);
+    }
+    // A reconnect partway through setup put the later registrations on a new
+    // session and the earlier ones on a dead one; start that session over.
+    if (await connectionEpoch(rt) === epoch) return;
   }
+  throw new Error(`daemon connection reset during agent setup ${MAX_SETUP_ATTEMPTS} times in a row`);
 }
 
 async function closeRuntime(rt) {
@@ -449,6 +471,10 @@ async function runChatTurn(
   options = {},
 ) {
   const { executeProposal } = runtimeApi();
+  // A --serve agent outlives daemon restarts and the reconnects they cause, so
+  // each turn makes sure the session it lands on has the tools and policies.
+  // One epoch read when nothing changed.
+  await prepareRuntime(rt, toolSchemas, config.policies);
   const turnsCap = config.maxTurns ?? 8;
   const selectedModel = typeof requestedModel === 'string' && requestedModel.trim()
     ? requestedModel

package/daemon-wrappers.js

@@ -2587,7 +2587,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": false,
       "name": "fleet_worker_set"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -2626,7 +2626,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "goal_clear"
     },
-    "role": "operator"
+    "role": "agent"
   },
   {
     "javascript": {
@@ -2639,7 +2639,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "goal_set"
     },
-    "role": "operator"
+    "role": "agent"
   },
   {
     "javascript": {
@@ -2652,7 +2652,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "goal_status"
     },
-    "role": "operator"
+    "role": "agent"
   },
   {
     "javascript": {
@@ -2665,7 +2665,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "goal_suggest"
     },
-    "role": "operator"
+    "role": "agent"
   },
   {
     "javascript": {
@@ -3055,7 +3055,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_claim"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -3068,7 +3068,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_claims"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -3198,7 +3198,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_find"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -3211,7 +3211,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_join"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -3315,7 +3315,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_leave"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -3328,7 +3328,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_nodes"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -3445,7 +3445,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_release"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -3484,7 +3484,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "lattice_wait"
     },
-    "role": "operator"
+    "role": "owner"
   },
   {
     "javascript": {
@@ -4576,7 +4576,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "multiplayer_abandon"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -4589,7 +4589,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "multiplayer_get"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -4602,7 +4602,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "multiplayer_list"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -4615,7 +4615,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "multiplayer_merge_check"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -4628,7 +4628,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "multiplayer_publish"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -4641,7 +4641,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "multiplayer_start_stage"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -4654,7 +4654,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "multiplayer_submit_stage"
     },
-    "role": "operator"
+    "role": "operator_only"
   },
   {
     "javascript": {
@@ -4734,6 +4734,58 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
     },
     "role": "operator"
   },
+  {
+    "javascript": {
+      "generated": true,
+      "name": "openaiCodexAuthCancel"
+    },
+    "method": "openai_codex.auth_cancel",
+    "owner": "HostClient",
+    "python": {
+      "generated": true,
+      "name": "openai_codex_auth_cancel"
+    },
+    "role": "host"
+  },
+  {
+    "javascript": {
+      "generated": true,
+      "name": "openaiCodexAuthStart"
+    },
+    "method": "openai_codex.auth_start",
+    "owner": "HostClient",
+    "python": {
+      "generated": true,
+      "name": "openai_codex_auth_start"
+    },
+    "role": "host"
+  },
+  {
+    "javascript": {
+      "generated": true,
+      "name": "openaiCodexSignOut"
+    },
+    "method": "openai_codex.sign_out",
+    "owner": "HostClient",
+    "python": {
+      "generated": true,
+      "name": "openai_codex_sign_out"
+    },
+    "role": "host"
+  },
+  {
+    "javascript": {
+      "generated": true,
+      "name": "openaiCodexStatus"
+    },
+    "method": "openai_codex.status",
+    "owner": "HostClient",
+    "python": {
+      "generated": true,
+      "name": "openai_codex_status"
+    },
+    "role": "host"
+  },
   {
     "javascript": {
       "generated": true,
@@ -5642,7 +5694,7 @@ const DAEMON_WRAPPER_ROWS = Object.freeze([
       "generated": true,
       "name": "session_bind_sandbox"
     },
-    "role": "agent"
+    "role": "operator_only"
   },
   {
     "javascript": {

package/docs/ASSISTANT.md

@@ -102,7 +102,7 @@ than no tool.
 |---|---|
 | `http_request` | `url`, `method?`, `headers?`, `body?`, `timeout_secs?` (default 30, max 120) |
 | `web_search` | `query`, `max_results?` |
-| `m365_task` | `task`, `conversation_id?` — delegates to the user's Microsoft 365 Parslee AI Employee (email, calendar, contacts, HubSpot CRM, meetings) over one chat call. Mutating actions (send mail, create an event) come back **drafted for approval**, never executed silently. Advertised only with a Parslee session (`car auth login`) |
+| `m365_task` | `task`, `conversation_id?` — delegates to the user's Microsoft 365 Parslee AI Employee (email, calendar, contacts, HubSpot CRM, meetings) over one chat call. Mutating actions (send mail, create an event) come back **drafted for approval**, never executed silently. When the M365 service itself fails the task, the result has `ok: false`, an `error`, and the code to quote to support in `support_code`. Advertised only with a Parslee session (`car auth login`) |
 
 These self-declare `"tier": "full_access"`, so — unlike file/shell — they need
 approval even *inside* the sandbox unless the session was started with
@@ -125,8 +125,10 @@ The capability a text-only coding agent structurally does not have. Two tiers:
 local models (fast, always-available-if-installed) and Parslee Studio
 (slower, needs `car auth login`, materially higher quality on some axes).
 
-**Local (`sandbox_edit` tier — no approval needed once the run has edit
-permission), advertised only when the matching local model is installed:**
+**Local (`full_access` tier — approval is required unless the run uses
+`--full-access`), advertised only when the matching local model is installed.**
+These generators run through the host process even during a sandboxed session,
+so their artifact writes cross the sandbox boundary:
 
 | Tool | Parameters |
 |---|---|
@@ -179,7 +181,7 @@ nothing for it.
 | `browse_wait` | `condition` (`"page_loaded"` or `"url_changed"`), `timeout_ms?` (default 5000) |
 | `browse_observe` | `include_screenshot?`, `ocr?` — screenshot + accessibility tree + a fused `ui_map`; OCR recovers labels a polished SPA's accessibility tree misses |
 | `browser_await_answer` | `timeout_seconds?` (default 45) — blocks until a page stops changing after you submit something, so you don't screenshot mid-load |
-| `browser_await_signin` | `url?`, `success_url_contains?`, `timeout_seconds?` (default 300, max 1800) — asks the human to complete a sign-in the agent can't (SSO, MFA); the session persists afterward |
+| `browser_await_signin` | `url?`, `success_url_contains?`, `timeout_seconds?` (default 300, max 1800) — asks the human to complete a sign-in the agent can't (SSO, MFA); the session persists afterward. `success_url_contains` is matched against the URL without its query string; omitted, the wait ends when the URL leaves a login/SSO page. A start page that already passes the test (the needle matches it, or with no needle it does not look like a login page) is refused, since it cannot tell signed in from not |
 | `browser_record_start` | `quality?` (JPEG 1–100, default 80) |
 | `browser_record_stop` | `output_path?` — writes an MP4 (requires ffmpeg), captures only frames where the page actually changed |
 
@@ -237,17 +239,20 @@ a human:
 tool is routed to approval whenever its declared tier **exceeds** the run's
 standing tier. This is why `web_search`, the browser tools, `run_applescript`
 / `run_powershell`, `m365_task`, the Studio media tools, `remember`, and
-`notify_linked_device` all stop for approval inside the *default sandboxed
-run* — they declare `full_access`, and the sandbox's standing tier is only
-`SandboxEdit`. The local generators (`generate_image`, `generate_speech`)
-declare `sandbox_edit`, so they run without asking inside the sandbox but are
-gated on an unelevated local run.
+`notify_linked_device`, and the local generators (`generate_image`,
+`generate_speech`) all stop for approval inside the *default sandboxed run* —
+they declare `full_access`, and the sandbox's standing tier is only
+`SandboxEdit`. The generators write artifacts through the host process rather
+than inside the container, so their writes cross the sandbox boundary.
 
 **How the human is asked** depends on the surface:
 
 - One-shot / REPL (`car do "<goal>"` or `car do`): a terminal prompt —
   `⚠  Approve <tool>(<brief>)? [y/N]` — reading a single line from stdin.
   Anything but `y` is a denial with reason `"declined by user"`.
+  A run whose needed action was declined, or could not be approved because
+  nobody could be asked, ends as not done and exits 1, even when the final
+  answer explains it.
 - `car do --serve` / `agents.chat`: routed through the chat surface's
   `approval_pending` → park → resolve flow. A connected host can present that
   same pending approval as a reviewable control rather than a plain
@@ -272,9 +277,11 @@ supervises, not just one `car do` invocation. The three presets are the only
 accepted values; anything else is rejected before it reaches the daemon.
 
 A per-agent posture cannot widen the environment that was actually bound.
-**Approve for me** auto-allows `sandbox_edit` actions only when a sandbox exists.
-If Docker is unavailable and CAR falls back to the local host (or the run uses
-`--local`), shell commands and file edits still ask before they touch the Mac.
+**Approve for me** auto-allows `sandbox_edit` actions only when a sandbox exists
+or the user explicitly starts the run with `--full-access`. If Docker is
+unavailable and CAR falls back to the local host (or the run uses `--local`),
+shell commands and file edits still ask before they touch the Mac unless that
+explicit full-access flag was supplied.
 
 ## Memory: what actually persists
 
@@ -471,7 +478,12 @@ of `summary`, which a failed run does not carry:
 }
 ```
 
-- `status` is `"success"` or `"error"`. Branch on it.
+- `status` is one of `"success"`, `"success_substituted"`, `"max_turns"`,
+  `"stalled"`, `"error"` or `"auth_required"`. Branch on it, and match the set
+  exhaustively rather than assuming it is closed. `"success_substituted"` is an
+  answer from a model other than the one the run named, with `substituted_from`
+  and `substitution_reason` naming the model it replaced and why; it exits 0
+  like `"success"`.
 - `error` is a stable machine-readable kind (e.g. `AssistantLoopFailed`);
   `message` is the human-readable detail and is NOT stable enough to match on.
 - `receipts` is always present, including on failure, and is how you see what

package/docs/CLI.md

@@ -2,22 +2,27 @@
 
 > **Generated file — do not hand-edit below the task map.** Produced by
 > `scripts/gen-cli-docs.sh` from `car --help` / `car help <command>` on car
-> 0.57.0-nightly.20261009 (2026-10-09). Every subcommand the installed binary reports is
+> 0.58.0 (2026-10-16). Every subcommand the installed binary reports is
 > below; a new subcommand cannot ship without appearing here the next time
 > this script runs. To regenerate: `bash scripts/gen-cli-docs.sh`.
 >
-> 79 top-level commands, 158 nested subcommands
+> 80 top-level commands, 159 nested subcommands
 > (one level deep) — counted from the live binary at generation time, not
 > typed by hand.
 
 ## Finding your way around
 
-`car` is one binary with 79 subcommands spanning several different jobs:
+`car` is one binary with 80 subcommands spanning several different jobs:
 running the built-in agent, coding, local model management, OS integrations,
 and installing other people's agents on your machine. This map groups the
 commands people actually reach for; the full alphabetical reference with every
 flag follows below.
 
+A release-lab build appends its compile-time identity to version output, for
+example `car 0.57.0 (build 20261008-7fdc72e)`. The `car-server`,
+`car-host`, and `car-mcp` binaries report the same ID. Ordinary builds
+without `CAR_BUILD_ID` keep the shorter `name version` form.
+
 ### Run an agent
 
 - [`car do`](#car-do) — the general-purpose CAR Assistant. No goal opens an
@@ -205,10 +210,10 @@ commands on a cadence via launchd / cron / schtasks).
 | [`car init`](#car-init) | Initialize a .car/ project directory for team-shared configuration |
 | [`car doctor`](#car-doctor) | Diagnose (and optionally repair) a CAR install: corrupt model weights, unparseable `~/.car` state files, version skew, and leftover files from a previous install. Runs entirely against the local filesystem — no daemon required, so it works even when `car-server` won't start |
 | [`car feedback`](#car-feedback) | Report a problem to Parslee. Captures a redacted diagnostic bundle (your description, the `car doctor` report, bounded log tails, and a version stamp) into the local outbox at `~/.car/feedback-outbox` — nothing is uploaded by this command; queued reports send when CAR can reach Parslee. Works with the daemon down, like `car doctor`. macOS and Windows; Linux needs its own leak-path audit first |
-| [`car update`](#car-update) | Update the locally-installed `car` CLI and its sibling `car-server` daemon to the latest release (or `--version <X.Y.Z>`), in place — regardless of how they were installed. Reconciles the drift that otherwise builds up when one channel updates and another doesn't (e.g. CarHost.app auto-updates its bundled daemon via Sparkle but leaves the `/usr/local/bin/car` CLI behind). The npm/PyPI `car-runtime` client packages are separate — this command never touches them; `car doctor` reports which of your agents have drifted, and prints the exact command per environment. Both remedies pin: `npm install car-runtime@<version>` (`npm update` CANNOT cross a 0.x minor — npm reads `^0.41.0` as `>=0.41.0 <0.42.0`, so it is a no-op) and `<venv>/bin/python -m pip install -U car-runtime==<version>` (a bare `-U` can be silently defeated by the consumer's own pin, and the wrong interpreter installs into an environment that does not hold the stale wheel) |
+| [`car update`](#car-update) | Update the locally-installed `car` CLI and its sibling `car-server` daemon to the latest release (or `--version <X.Y.Z>`), in place — regardless of how they were installed. Reconciles the drift that otherwise builds up when one channel updates and another doesn't (e.g. CarHost.app auto-updates its bundled daemon via Sparkle but leaves the `/usr/local/bin/car` CLI behind). The npm/PyPI `car-runtime` client packages are separate — this command never touches them; `car doctor` reports which of your agents have drifted, and prints the exact command per environment. Both remedies pin: `npm install car-runtime@<version>` (`npm update` CANNOT cross a 0.x minor — npm reads `^0.41.0` as `>=0.41.0 <0.42.0`, so it is a no-op) and `<venv>/bin/python -m pip install -U car-runtime==<version>` (a bare `-U` can be silently defeated by the consumer's own pin, and the wrong interpreter installs into an environment that does not hold the stale wheel). On macOS it also creates the `car-mcp` link beside a `car` that links into CarHost.app (or replaces a dangling / wrong-bundle one): Sparkle never re-runs the package postinstall, so an install that predates `car-mcp` lacks it |
 | [`car purge`](#car-purge) | Remove this CAR install's own state under `~/.car` (config, logs, managed models, binaries) and reap any OS-level schedules CAR installed — for a clean slate before a reinstall. On macOS this also clears CarHost.app's user-level state and resets its privacy (TCC) permissions, so a reinstall really does re-run permission onboarding. NEVER touches the shared HuggingFace model cache (other tools use it); managed models are symlinks into it, so only the links are removed, not the multi-GB blobs. (To uninstall a single contributed agent instead, use `car uninstall <id>`.) |
 | [`car code`](#car-code) | Open a coding conversation in your repository. Ask questions, plan a change, or describe work to implement; review the checks and edits, then keep iterating in the same conversation |
-| [`car board`](#car-board) | Fullscreen supervision board for coder sessions — one screen for every run on this host, whoever started it (`car code`, CarHost, milo, another board). Attach to a run's full history, confirm its outcome contract, answer its questions, approve its diff, or scope work in a repo-grounded discussion first. Closing the board never stops a run |
+| [`car board`](#car-board) | Fullscreen supervision board for coder sessions — one screen for every run on this host, whoever started it (`car code`, CarHost, milo, another board). Attach to a run's full history, confirm its outcome contract, answer its questions, approve its diff, or scope work in a repo-grounded discussion first. It shows and acts on every run, authenticating with CAR's local host key; a board launched by an agent cannot. Closing the board never stops a run |
 | [`car do`](#car-do) | CAR Assistant: a general-purpose agent that works out of the box |
 | [`car policy-check-hook`](#car-policy-check-hook) | Evaluate a host's proposed tool call against `.car/policies/` and answer on stdout with that host's hook decision envelope |
 | [`car project`](#car-project) | Manage CAR-managed projects (a named, git-backed workspace CAR creates for you — no repo to pick) |
@@ -248,6 +253,7 @@ commands on a cadence via launchd / cron / schtasks).
 | [`car registry`](#car-registry) | Registry tooling for the contributed-agents registry (Parslee-ai/car#182 phase 5): `digest` a manifest, or `validate` a registry directory (the CI gate run by Parslee-ai/car-agent-registry) |
 | [`car fleet`](#car-fleet) | What every CAR instance you can reach can do — agents, capabilities and models across the fleet — and whether this machine takes coding subtasks farmed out by peers (`car fleet enroll`). Needs a running daemon |
 | [`car mp`](#car-mp) | Multiplayer development: a work item moves Build → Improve → Polish through different developers before it merges, each stage a coder session on its owner's machine with the engine they choose. Needs a running daemon and a shared git remote |
+| [`car claude`](#car-claude) | Start Claude Code as a CAR-supervised collaboration session. Enrolls a per-session agent bound to the work context `car auth resolve` names for this directory, hands its identity to the CAR plugin's collaboration tools, runs `claude` in this terminal, and removes the agent when it exits. Arguments after `--` go to `claude`. Needs a running daemon |
 | [`car publish`](#car-publish) | Publish a contributed agent to the registry (Parslee-ai/car#182 phase 5). Reads a local agent's `manifest.toml`, signs it for `--audience public` (ed25519 key at `$CAR_PUBLISH_KEY_PATH`), stages it at the versioned `agents/<namespace>/<name>/<version>/` path, updates `index.json` + the README catalog, re-runs the EXACT `car registry validate` CI gate locally, and opens a PR against the registry repo. Aborts (no PR) on a missing signing key or a validation failure |
 | [`car help`](#car-help) | Print this message or the help of the given subcommand(s) |
 
@@ -280,7 +286,7 @@ Options:
       --json         Emit machine-readable JSON
       --md           Emit generated Markdown (the default)
       --role <ROLE>  Print exactly the daemon method names assigned to this caller role [possible
-      values: agent, owner, operator, host]
+      values: agent, owner, operator, operator_only, host]
   -h, --help         Print help
 ```
 
@@ -664,7 +670,8 @@ Re-score one delivered attempt without starting a coding session
 Usage: car coder-ab rescore [OPTIONS] --attempt <ATTEMPT> --corpus <CORPUS>
 
 Options:
-      --attempt <ATTEMPT>  Existing `<ledger-dir>/artifacts/<task-id>/<attempt>` directory
+      --attempt <ATTEMPT>  Existing `<ledger-dir>/artifacts/ledgers/<ledger
+      stem>/<task-id>/<attempt>` (or legacy `<ledger-dir>/artifacts/<task-id>/<attempt>`) directory
       --corpus <CORPUS>    Corpus manifest containing the task named by the source ledger row
       --ledger <LEDGER>    Owning ledger. Omit to discover it from the attempt artifact layout
   -h, --help               Print help
@@ -1186,9 +1193,11 @@ Commands:
   both the `everyday` and `local_focused` policies — the same rule `models.list_unified` reports,
   without a machine of each size. Reads a row or an array of rows (as `car models add --dry-run
   --json` prints) from FILE, or stdin. Prints JSON. The verdict is the recommendation estimate
-  `models.list_unified` shows, which sizes the KV cache from the parameter count; load-time
-  admission uses an installed checkpoint's own KV geometry and the machine's live state, so it can
-  differ
+  `models.list_unified` shows, which sizes the KV cache from an installed checkpoint's own KV
+  geometry, as load-time admission does, and from the parameter count for a row not installed;
+  admission also uses the machine's live state, so it can differ. `platform_compatible` is false for
+  a row CAR does not run on Apple Silicon at any size (a GGUF/Candle row, say), and its
+  `smallest_mac_gb` is then null whatever the memory verdict
   register         Register a custom model from a JSON schema file
   unregister       Unregister a model by ID
   stats            Show performance stats for models based on observed outcomes
@@ -1430,8 +1439,11 @@ CAR's memory-fit verdict for catalog rows on stated Apple Silicon machines, unde
 `everyday` and `local_focused` policies — the same rule `models.list_unified` reports, without a
 machine of each size. Reads a row or an array of rows (as `car models add --dry-run --json` prints)
 from FILE, or stdin. Prints JSON. The verdict is the recommendation estimate `models.list_unified`
-shows, which sizes the KV cache from the parameter count; load-time admission uses an installed
-checkpoint's own KV geometry and the machine's live state, so it can differ
+shows, which sizes the KV cache from an installed checkpoint's own KV geometry, as load-time
+admission does, and from the parameter count for a row not installed; admission also uses the
+machine's live state, so it can differ. `platform_compatible` is false for a row CAR does not run on
+Apple Silicon at any size (a GGUF/Candle row, say), and its `smallest_mac_gb` is then null whatever
+the memory verdict
 
 Usage: car models fit [OPTIONS] [FILE]
 
@@ -1898,8 +1910,9 @@ Usage: car doctor [OPTIONS]
 
 Options:
       --repair  Apply safe repairs: purge corrupt cache files (re-pull afterward), back up
-      unparseable state files, refresh the version stamp. Never deletes unrecognized entries or
-      anything not provably corrupt
+      unparseable state files, refresh the version stamp, and (on macOS) link a missing, dangling,
+      or wrong-bundle `car-mcp` beside a bundle-linked `car`. Never deletes unrecognized entries or
+      anything not provably corrupt, and never overwrites a regular file
       --deep    Deep-verify model weights (recompute sha256 vs the HuggingFace etag) instead of the
       cheap presence/non-empty check. Slower but catches truncated-but-non-empty corruption
   -h, --help    Print help
@@ -1937,7 +1950,10 @@ which of your agents have drifted, and prints the exact command per environment.
 `npm install car-runtime@<version>` (`npm update` CANNOT cross a 0.x minor — npm reads `^0.41.0` as
 `>=0.41.0 <0.42.0`, so it is a no-op) and `<venv>/bin/python -m pip install -U
 car-runtime==<version>` (a bare `-U` can be silently defeated by the consumer's own pin, and the
-wrong interpreter installs into an environment that does not hold the stale wheel)
+wrong interpreter installs into an environment that does not hold the stale wheel). On macOS it also
+creates the `car-mcp` link beside a `car` that links into CarHost.app (or replaces a dangling /
+wrong-bundle one): Sparkle never re-runs the package postinstall, so an install that predates
+`car-mcp` lacks it
 
 Usage: car update [OPTIONS]
 
@@ -2081,7 +2097,8 @@ opens saved conversations. The exit summary prints the resume command.
 Fullscreen supervision board for coder sessions — one screen for every run on this host, whoever
 started it (`car code`, CarHost, milo, another board). Attach to a run's full history, confirm its
 outcome contract, answer its questions, approve its diff, or scope work in a repo-grounded
-discussion first. Closing the board never stops a run
+discussion first. It shows and acts on every run, authenticating with CAR's local host key; a board
+launched by an agent cannot. Closing the board never stops a run
 
 Usage: car board [OPTIONS]
 
@@ -2215,6 +2232,18 @@ Options:
 
           [default: 20]
 
+      --org <ORG>
+          Work in this organization (one a signed-in login holds). Omitted, the run binds the
+          repository's declared org, else your default org (`car auth default-org`), else runs as
+          personal work. Its memory, learned repairs, trajectories and receipts stay in that org's
+          private store, and your own-account tools (Mail, Calendar, M365, Studio, automation,
+          iMessage) are left out. Needs the daemon. Not with --serve: a served agent's organization
+          is fixed when it is registered with the daemon
+
+      --personal
+          Run as personal work even where a default org applies. Refused in a repository that
+          declares an org. Not with --serve
+
   -h, --help
           Print help (see a summary with '-h')
 ```
@@ -3093,9 +3122,11 @@ Commands:
   without it the notice is printed and nothing is sent
   connect         Connect with another owner's CAR for a shared project: invite, inspect, accept,
   confirm. Both owners consent before anything is shared
-  knock           Ask a CAR discovered on your network to connect — no invite code. Its owner sees
-  your purpose, project and key fingerprint, and accepts or declines. Its identity is unverified:
-  compare fingerprints with its owner if it matters who they are
+  knock           Ask a CAR to connect — no invite code. Either a CAR discovered on your network
+  (`<machine>`; its identity is unverified, so compare fingerprints with its owner if it matters who
+  they are), or, with `--member <account> --org <org>`, a colleague in a Parslee org through the
+  Parslee relay, which works when neither CAR can reach the other (identity `cert:<org>:<account>`,
+  from their device certificate)
   knocks          CARs discovered on your network, and knocks waiting in both directions
   knock-accept    Accept a knock, choosing your label for that CAR and what you share
   knock-decline   Decline a knock. That CAR may not knock again for a day, or ever with `--block`
@@ -3105,8 +3136,12 @@ Commands:
   knock-block     Block a key from knocking, quiet it (knocks recorded, no prompt), or allow it
   again
   connections     Your Lattice connections with other owners' CARs
-  directory       Colleagues in your org whose CARs an org admin attested — the people `car lattice
-  connect offer` can reach without a fingerprint exchange
+  directory       Colleagues in your orgs: those whose CARs an org admin attested (for `car lattice
+  connect offer`), and those whose devices Parslee certifies, reachable through the Parslee relay
+  (for `car lattice knock --member`)
+  relay-probe     Developer check of the Parslee relay: send a sealed probe to a colleague's device,
+  or pull and verify probes sent to this one. Uses this CAR's device certificate for the org; reads
+  no credential
   org             Org-attested connections: status, admin attestation and policy, and your standing
   auto-accept rules
   disconnect      End a connection now. The other CAR is told; what it already received cannot be
@@ -3231,7 +3266,8 @@ Usage: car lattice connect <COMMAND>
 
 Commands:
   invite        Create an invite: purpose, project, a name for the other CAR, and which of your
-  nodes it may see and address (repeat --share)
+  nodes it may see and address (repeat --share; a node address, or `agents:<project>` for every
+  agent joined in that project)
   inspect       Show what an invite asks for — its purpose and project — before accepting it. The
   inviter's fingerprint is not shown: ask them for it
   accept        Accept an invite with your own share list. Active once the inviter confirms your
@@ -3244,6 +3280,8 @@ Commands:
   Only then is the connection active
   share         Replace which of your nodes an active connection may see and message (repeat
   --share; none shares nothing). Takes effect here at once; the other CAR is told
+  rename        Rename your name for the other CAR (its nodes are `<node>@<name>`). Only yours: the
+  other owner's name for your CAR does not change
   help          Print this message or the help of the given subcommand(s)
 
 Options:
@@ -3253,19 +3291,30 @@ Options:
 #### car lattice knock
 
 ```text
-Ask a CAR discovered on your network to connect — no invite code. Its owner sees your purpose,
-project and key fingerprint, and accepts or declines. Its identity is unverified: compare
-fingerprints with its owner if it matters who they are
+Ask a CAR to connect — no invite code. Either a CAR discovered on your network (`<machine>`; its
+identity is unverified, so compare fingerprints with its owner if it matters who they are), or, with
+`--member <account> --org <org>`, a colleague in a Parslee org through the Parslee relay, which
+works when neither CAR can reach the other (identity `cert:<org>:<account>`, from their device
+certificate)
 
-Usage: car lattice knock --purpose <PURPOSE> --project <PROJECT> --label <LABEL> <MACHINE>
+Usage: car lattice knock [OPTIONS] --purpose <PURPOSE> --project <PROJECT> [MACHINE]
 
 Arguments:
-  <MACHINE>  The discovered CAR: its advertised name (see `car lattice knocks`) or its URL
+  [MACHINE]  The discovered CAR: its advertised name (see `car lattice knocks`) or its URL
 
 Options:
+      --member <MEMBER>    A colleague's account, as `car lattice directory` lists it: knock through
+      the Parslee relay of `--org`
+      --org <ORG>          With `--member`, the org whose Parslee relay carries the offer. Without
+      it, the org whose device certificate this knock presents
+      --device <DEVICE>    With `--member`, which of their devices (default: the one with the newest
+      certificate)
       --purpose <PURPOSE>
       --project <PROJECT>
-      --label <LABEL>      Your name for that CAR once connected (`<node>@<label>`)
+      --label <LABEL>      Your name for that CAR once connected (`<node>@<label>`). Never sent to
+      it. Required for a network knock
+      --share <SHARE>      With `--member`, a node of yours the colleague may see and address once
+      they accept (repeat)
   -h, --help               Print help
 ```
 
@@ -3367,16 +3416,37 @@ Options:
 #### car lattice directory
 
 ```text
-Colleagues in your org whose CARs an org admin attested — the people `car lattice connect offer` can
-reach without a fingerprint exchange
+Colleagues in your orgs: those whose CARs an org admin attested (for `car lattice connect offer`),
+and those whose devices Parslee certifies, reachable through the Parslee relay (for `car lattice
+knock --member`)
 
 Usage: car lattice directory [OPTIONS]
 
 Options:
       --org <ORG>  Which org, when this CAR serves several (default: all of them)
+      --refresh    Read the org's Parslee relay directory again instead of the cache
   -h, --help       Print help
 ```
 
+#### car lattice relay-probe
+
+```text
+Developer check of the Parslee relay: send a sealed probe to a colleague's device, or pull and
+verify probes sent to this one. Uses this CAR's device certificate for the org; reads no credential
+
+Usage: car lattice relay-probe <COMMAND>
+
+Commands:
+  send  Seal `text` to the device with this Ed25519 key (from the org's relay directory) and deposit
+  it with the relay
+  pull  Pull this device's relay inbox for the org, verify each probe, print them, and acknowledge
+  them. Other relay mail stays queued
+  help  Print this message or the help of the given subcommand(s)
+
+Options:
+  -h, --help  Print help
+```
+
 #### car lattice org
 
 ```text
@@ -4449,8 +4519,10 @@ Commands:
   board`
   publish  Publish a finished coder session as a stage: an approved diff, or an accepted no-change
   finding. Without --item this publishes a Build and creates the work item
-  submit   Submit a stage you did outside CAR (for example in Claude Code or Codex). CAR runs the
-  item's contract on the commit itself, without credentials, before recording it
+  submit   Submit work you did outside CAR (for example in Claude Code or Codex). CAR runs the
+  contract on the commit itself, without credentials, before recording it. With an item this is that
+  item's next stage; without one it is a Build that creates the item from --intent and
+  --contract-file
   check    Re-verify an item end to end and, if it holds, create `car/mp/<id>-final` for a pull
   request. Runs the item's contract here
   abandon  Retire a work item (e.g. its locked contract was wrong). Nothing is deleted: the record
@@ -4534,19 +4606,27 @@ Options:
 #### car mp submit
 
 ```text
-Submit a stage you did outside CAR (for example in Claude Code or Codex). CAR runs the item's
-contract on the commit itself, without credentials, before recording it
+Submit work you did outside CAR (for example in Claude Code or Codex). CAR runs the contract on the
+commit itself, without credentials, before recording it. With an item this is that item's next
+stage; without one it is a Build that creates the item from --intent and --contract-file
 
-Usage: car mp submit [OPTIONS] <ITEM>
+Usage: car mp submit [OPTIONS] [ITEM]
 
 Arguments:
-  <ITEM>
-
-Options:
-      --commit <COMMIT>  The stage's work: a commit descending from the item's tip [default: HEAD]
-      --repo <REPO>      [default: .]
-      --remote <REMOTE>  [default: origin]
-  -h, --help             Print help
+  [ITEM]
+
+Options:
+      --commit <COMMIT>                The work: a commit descending from the item's tip, or for a
+      Build from --base [default: HEAD]
+      --intent <INTENT>                Build only: what the item is for. Fixed here; the only text
+      that travels to the later stages
+      --contract-file <CONTRACT_FILE>  Build only: the outcome contract (JSON, as
+      `coder.confirm_contract` takes it) that becomes the item's locked contract
+      --base <BASE>                    Build only: the commit the Build starts from, which must be
+      on the remote. Defaults to the remote's default branch
+      --repo <REPO>                    [default: .]
+      --remote <REMOTE>                [default: origin]
+  -h, --help                           Print help
 ```
 
 #### car mp check
@@ -4585,6 +4665,23 @@ Options:
   -h, --help             Print help
 ```
 
+### car claude
+
+```text
+Start Claude Code as a CAR-supervised collaboration session. Enrolls a per-session agent bound to
+the work context `car auth resolve` names for this directory, hands its identity to the CAR plugin's
+collaboration tools, runs `claude` in this terminal, and removes the agent when it exits. Arguments
+after `--` go to `claude`. Needs a running daemon
+
+Usage: car claude [ARGS]...
+
+Arguments:
+  [ARGS]...
+
+Options:
+  -h, --help  Print help
+```
+
 ### car publish
 
 ```text

package/index.d.ts

@@ -232,6 +232,14 @@ export class CarRuntime {
   /** Transport-named alias for `close()`. */
   disconnect(): Promise<void>;
 
+  /**
+   * Identify the daemon session this runtime's calls land on, connecting first
+   * if needed. Registered tools, policies and state belong to that session, so
+   * a different value than last time (after `close()`, or a daemon restart the
+   * client reconnected through) means they must be registered again.
+   */
+  connectionEpoch(): Promise<number>;
+
   /**
    * Invoke any daemon JSON-RPC method with a JSON-encoded params value.
    * `daemonCall` is the call-by-name escape hatch; use the typed wrappers as the primary API.
@@ -240,7 +248,7 @@ export class CarRuntime {
    */
   daemonCall(method: string, paramsJson: string): Promise<string>;
 
-  /** Host-management-token twin of `daemonCall`; the method allowlist remains enforced. */
+  /** Host-management-token twin of `daemonCall`; the method allowlist remains enforced. It admits the owner-gated Coder methods (`coder.respond`, `coder.revise_contract`, `coder.confirm_contract`, `coder.refresh_review`, `coder.approve_merge`, `coder.cancel`), but refuses `coder.confirm_contract` and `coder.approve_merge` on an agent build: building an agent needs the CAR app or `car agent new` in your terminal. */
   daemonCallHostManagement(method: string, paramsJson: string): Promise<string>;
 
   /** List durable permission grants using host-management authority. */
@@ -625,16 +633,16 @@ export class CarRuntime {
   /** Generated daemon wrapper for `feedback.submit` (operator). */
   feedbackSubmit(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `goal.clear` (operator). */
+  /** Generated daemon wrapper for `goal.clear` (agent). */
   goalClear(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `goal.set` (operator). */
+  /** Generated daemon wrapper for `goal.set` (agent). */
   goalSet(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `goal.status` (operator). */
+  /** Generated daemon wrapper for `goal.status` (agent). */
   goalStatus(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `goal.suggest` (operator). */
+  /** Generated daemon wrapper for `goal.suggest` (agent). */
   goalSuggest(paramsJson: string): Promise<string>;
 
   /** Generated daemon wrapper for `host.subscribe` (operator). */
@@ -664,28 +672,28 @@ export class CarRuntime {
   /** Generated daemon wrapper for `inference.runner.fail` (operator). */
   inferenceRunnerFail(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.claim` (operator). */
+  /** Generated daemon wrapper for `lattice.claim` (owner). */
   latticeClaim(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.claims` (operator). */
+  /** Generated daemon wrapper for `lattice.claims` (owner). */
   latticeClaims(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.find` (operator). */
+  /** Generated daemon wrapper for `lattice.find` (owner). */
   latticeFind(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.join` (operator). */
+  /** Generated daemon wrapper for `lattice.join` (owner). */
   latticeJoin(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.leave` (operator). */
+  /** Generated daemon wrapper for `lattice.leave` (owner). */
   latticeLeave(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.nodes` (operator). */
+  /** Generated daemon wrapper for `lattice.nodes` (owner). */
   latticeNodes(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.release` (operator). */
+  /** Generated daemon wrapper for `lattice.release` (owner). */
   latticeRelease(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `lattice.wait` (operator). */
+  /** Generated daemon wrapper for `lattice.wait` (owner). */
   latticeWait(paramsJson: string): Promise<string>;
 
   /** Generated daemon wrapper for `meeting.get` (operator). */
@@ -823,25 +831,25 @@ export class CarRuntime {
   /** Generated daemon wrapper for `multi.vote` (operator). */
   multiVote(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `multiplayer.abandon` (operator). */
+  /** Generated daemon wrapper for `multiplayer.abandon` (operator_only). */
   multiplayerAbandon(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `multiplayer.get` (operator). */
+  /** Generated daemon wrapper for `multiplayer.get` (operator_only). */
   multiplayerGet(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `multiplayer.list` (operator). */
+  /** Generated daemon wrapper for `multiplayer.list` (operator_only). */
   multiplayerList(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `multiplayer.merge_check` (operator). */
+  /** Generated daemon wrapper for `multiplayer.merge_check` (operator_only). */
   multiplayerMergeCheck(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `multiplayer.publish` (operator). */
+  /** Generated daemon wrapper for `multiplayer.publish` (operator_only). */
   multiplayerPublish(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `multiplayer.start_stage` (operator). */
+  /** Generated daemon wrapper for `multiplayer.start_stage` (operator_only). */
   multiplayerStartStage(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `multiplayer.submit_stage` (operator). */
+  /** Generated daemon wrapper for `multiplayer.submit_stage` (operator_only). */
   multiplayerSubmitStage(paramsJson: string): Promise<string>;
 
   /** Generated daemon wrapper for `nlp.extract_entities` (operator). */
@@ -967,7 +975,7 @@ export class CarRuntime {
   /** Generated daemon wrapper for `session.auth` (agent). */
   sessionAuth(paramsJson: string): Promise<string>;
 
-  /** Generated daemon wrapper for `session.bindSandbox` (agent). */
+  /** Generated daemon wrapper for `session.bindSandbox` (operator_only). */
   sessionBindSandbox(paramsJson: string): Promise<string>;
 
   /** Generated daemon wrapper for `session.bindSubstrate` (operator). */
@@ -1666,7 +1674,9 @@ export class CarRuntime {
   /**
    * `agents.peers` — visible peers as JSON. Each row distinguishes the
    * kind-level `can_receive` capability from the current `reachable` delivery
-   * preflight; the send remains authoritative.
+   * preflight; the send remains authoritative. `{"organization_directory": true}`
+   * adds the colleague directory of the organization this connection is bound
+   * to, from what the CAR already holds.
    */
   agentsPeers(requestJson: string): Promise<string>;
   /** `agents.message` — send text to one peer: `{ to, body, summary? }`. The sender is derived server-side. */
@@ -1769,7 +1779,11 @@ export class CarRuntime {
    * `approved_no_patch` | `rejected_by_gate` | `measurement_failed` |
    * `config_moved_during_measurement` (a graded promotion whose measured base
    * was moved by something else while the replays ran — nothing applied, both
-   * values reported, no backoff). When `context_measure` was requested the
+   * values reported, no backoff) | `config_moved_since_diagnosis` (a
+   * human-approved patch whose `conversation_keep_recent` moved after
+   * diagnosis — nothing applied, `diagnosed_under_conversation_keep_recent` and
+   * `current_conversation_keep_recent` reported, no backoff). When
+   * `context_measure` was requested the
    * summary also carries `context_measured: { status: "measured" |
    * "skipped_dry_run", grade_attempts, model, split, split_seed }`.
    *
@@ -2002,9 +2016,11 @@ export class CarRuntime {
    * with reasoning suppressed to produce a direct answer, or
    * `"thinking_truncated"` when even that retry was empty (car-releases#60).
    *
-   * `local_last_resort` is present and true ONLY when CAR appended an
-   * installed on-device model behind a remote-only chain and that model
-   * actually served the turn. An explicitly selected local model is not marked.
+   * `local_last_resort` is present and true ONLY when CAR appended a
+   * model installed through CAR (under CAR's models dir or with an install
+   * receipt; a model only in the shared Hugging Face cache is skipped and
+   * named with `car models adopt`) behind a remote-only chain and that
+   * model actually served the turn. An explicitly selected local model is not marked.
    *
    * `auth_fallback_from` is present ONLY when a candidate earlier in the
    * fallback chain was skipped because its credential was **rejected**
@@ -2164,7 +2180,9 @@ export class CarRuntime {
 
   /**
    * Fetch a URL and extract readable text (keyless; companion to `search`).
-   * Returns JSON `{ url, status, content_type, title?, text }`.
+   * Returns JSON `{ url, status, content_type, title?, text }`. Only the
+   * first 8 MiB of the body are read; a longer page's `text` ends in
+   * `…[truncated]…`.
    */
   webFetch(url: string): Promise<string>;
 
@@ -2238,7 +2256,10 @@ export class CarRuntime {
    *   weights_ready, downloads_weights,
    *   max_output_tokens, public_benchmarks, cost, car_enabled, can_remove,
    *   in_use, management_evidence, fit, estimated_peak_mb,
-   *   platform_compatible, deprecated, family, version }`. `available` means CAR
+   *   platform_compatible, deprecated, credential_required,
+   *   unavailable_reason, family, version, source_kind }`. `source_kind` is the
+   * row's source `type` tag (`codex_cli`, `remote_api`, `proprietary`, ...),
+   * which keeps two routes to one model apart. `available` means CAR
    * can use the model
    * here — for a local MLX entry with a declared `hf_repo` it is `true`
    * before a byte is fetched, because it lazy-downloads on first use —
@@ -2498,7 +2519,7 @@ export class CarRuntime {
    * JSON may carry `network_approved: true` and
    * `approved_credentials: string[]`. Credential approval is limited to names
    * declared by that exact check; changing its name, command, or declarations
-   * drops carried approval.
+   * drops carried approval. Only the agent that started the run or the CAR app may call this; a run a person started also accepts any connection not bound to an agent, and an agent's run also accepts unbound connections when the daemon has no host token. To act on an agent's run with host authority, send the method through the host-management call.
    */
   coderConfirmContract(
     sessionId: string,
@@ -2556,6 +2577,7 @@ export class CarRuntime {
 
   /**
    * Answer a `user_input_requested` event, or queue native steering with steer=true.
+   * Only the agent that started the run or the CAR app may call this; a run a person started also accepts any connection not bound to an agent, and an agent's run also accepts unbound connections when the daemon has no host token. To act on an agent's run with host authority, send the method through the host-management call.
    */
   coderRespond(sessionId: string, text: string): Promise<string>;
   coderRespond(sessionId: string, text: string, steer: boolean | null): Promise<string>;
@@ -2570,7 +2592,7 @@ export class CarRuntime {
    * reply is `{state: "reported", branch: null}`. A plain `approve: true` on
    * a finding, or `acceptFinding` on a diff, is refused. Successful delivery
    * replies include `excluded_artifacts` with the exact records used by the
-   * committed staging pass.
+   * committed staging pass. Only the agent that started the run or the CAR app may call this; a run a person started also accepts any connection not bound to an agent, and an agent's run also accepts unbound connections when the daemon has no host token. To act on an agent's run with host authority, send the method through the host-management call.
    */
   coderApproveMerge(
     sessionId: string,
@@ -2596,6 +2618,7 @@ export class CarRuntime {
    * `message` names what already happened. Callers that cancel unconditionally
    * on shutdown depend on that — rejecting would turn a quiet exit into a
    * protocol error whenever the session raced to terminal first.
+   * Only the agent that started the run or the CAR app may call this; a run a person started also accepts any connection not bound to an agent, and an agent's run also accepts unbound connections when the daemon has no host token. To act on an agent's run with host authority, send the method through the host-management call.
    */
   /** `reason` names a non-operator cause and is recorded as `cancelled: <reason>`; omit it only when a person cancelled. */
   coderCancel(sessionId: string, reason?: string | undefined | null): Promise<string>;
@@ -2642,7 +2665,7 @@ export class CarRuntime {
    * Returns `{state: "running", review_refresh: true}`; the outcome arrives on
    * the event stream. Passing checks return the session to `needs_approval`
    * with a new diff; failing checks fail it and keep the worktree. Delivery
-   * still needs a separate `coderApproveMerge`.
+   * still needs a separate `coderApproveMerge`. Only the agent that started the run or the CAR app may call this; a run a person started also accepts any connection not bound to an agent, and an agent's run also accepts unbound connections when the daemon has no host token. To act on an agent's run with host authority, send the method through the host-management call.
    */
   coderRefreshReview(sessionId: string): Promise<string>;
 
@@ -2656,7 +2679,7 @@ export class CarRuntime {
    * message}`. **Check `revised` before trusting `contract`**: on a redraft
    * that does not validate, the previous contract comes back byte-identical
    * with `revised: false` and a `message` explaining why, and the daemon emits
-   * a `contract_revision_rejected` event.
+   * a `contract_revision_rejected` event. Only the agent that started the run or the CAR app may call this; a run a person started also accepts any connection not bound to an agent, and an agent's run also accepts unbound connections when the daemon has no host token. To act on an agent's run with host authority, send the method through the host-management call.
    */
   coderReviseContract(sessionId: string, request: string): Promise<string>;
 
@@ -2734,6 +2757,10 @@ export class CarRuntime {
   /**
    * Discover what the signed-in Parslee account can do — identity, m365
    * product entitlements, and Studio reachability. Read-only. Returns JSON.
+   * Resolves `{authenticated: false, hint, error?}` when signed out; rejects
+   * with the underlying failure when Parslee could not answer the session
+   * check (a rate limit, an outage, or no session answer) or denied this
+   * signed-in account access (HTTP 403).
    */
   parsleeCapabilities(): Promise<string>;
   /**
@@ -3557,6 +3584,18 @@ export class HostClient {
   /** Generated host wrapper for `models.storage_roots`. */
   modelsStorageRoots(paramsJson: string): Promise<string>;
 
+  /** Generated host wrapper for `openai_codex.auth_cancel`. */
+  openaiCodexAuthCancel(paramsJson: string): Promise<string>;
+
+  /** Generated host wrapper for `openai_codex.auth_start`. */
+  openaiCodexAuthStart(paramsJson: string): Promise<string>;
+
+  /** Generated host wrapper for `openai_codex.sign_out`. */
+  openaiCodexSignOut(paramsJson: string): Promise<string>;
+
+  /** Generated host wrapper for `openai_codex.status`. */
+  openaiCodexStatus(paramsJson: string): Promise<string>;
+
   /** Generated host wrapper for `openrouter.auth_cancel`. */
   openrouterAuthCancel(paramsJson: string): Promise<string>;
 
@@ -4005,7 +4044,22 @@ export interface DispatchVoiceTurnResponse {
 
 export type VoiceTurnEvent =
   | { type: 'voice.turn.fast_delta'; turn_id: number; text: string }
-  | { type: 'voice.turn.fast_done'; turn_id: number }
+  | {
+      type: 'voice.turn.fast_done';
+      turn_id: number;
+      /** Present (true) only when the on-device last resort answered the fast track. */
+      local_last_resort?: true;
+      /** The model the request was routed to, when the last resort stood in for it. */
+      substituted_from?: string;
+      /** Why `substituted_from` did not serve. */
+      substitution_reason?:
+        | 'credential_rejected'
+        | 'credential_absent'
+        | 'rate_limited'
+        | 'quota_exhausted'
+        | 'timed_out'
+        | 'failed';
+    }
   | {
       type: 'voice.turn.bridge';
       turn_id: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "car-runtime",
-  "version": "0.57.4",
+  "version": "0.58.0",
   "carProtocolVersion": 3,
   "description": "Common Agent Runtime — a deterministic execution layer for AI agents",
   "main": "index.js",