cordisx 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/src/cli/run-command.js

@@ -1,15 +1,14 @@
-import path from 'node:path';
+import { loadManagedSourceTrustNow } from '../launcher/managed-source-trust.js';
+import { createNativeSubmissionComposition, } from '../launcher/native-submission-composition.js';
 import { pathToFileURL } from 'node:url';
 import { randomBytes } from 'node:crypto';
-import { resolveHostAdapter } from '../adapters/registry.js';
-import { ensureHomeConfig, loadHomeConfig, resolveHomeConfigPath, } from '../config/home-config.js';
+import { loadHomeConfig, } from '../config/home-config.js';
 import { CdpPluginLifecycleRuntime } from '../launcher/cdp.js';
+import { findPackageRoot } from '../launcher/development.js';
 import { DirectPublisherGrantAuthority, DirectPublisherGrantStore, MacOSMachineIdentityProvider, StaticPublisherKeyRegistry, } from '../launcher/publisher-grants.js';
 import { createPublisherGrantBridgeHandler } from '../launcher/publisher-grant-rpc.js';
 import { loadConfig, } from '../launcher/config.js';
-import { assertLoopbackPortAvailable, findFreeLoopbackPort, } from '../launcher/process.js';
-import { parseCordisXCli } from './parse.js';
-import { resolveProfileSelection } from './profiles.js';
+import { acquireCodexProfileLaunchLease, assertLoopbackPortAvailable, findFreeLoopbackPort, } from '../launcher/process.js';
 import { ProviderFleet } from '../providers/fleet.js';
 import { createConfigBridgeHandler } from '../launcher/config-rpc.js';
 import { HostServiceConfigNarrowApi } from '../launcher/service-config.js';
@@ -17,99 +16,96 @@ import { createServiceConfigBridgeHandler } from '../launcher/service-config-rpc
 import { createChannelCredentialBridgeHandler, } from '../launcher/channel-credential-rpc.js';
 import { createChannelActionsBridgeHandler } from '../launcher/channel-actions-rpc.js';
 import { LauncherSecretStore } from '../launcher/secret-store.js';
-import { readServiceConfigState } from '../config/service-config.js';
-import { CHANNEL_SERVICE_CONFIG_INITIAL, createChannelHostServiceConfigContract, createLocalChannelService, projectLocalChannelManager, } from '../launcher/channel-service.js';
+import { markServiceConfigAppRestartApplied, readServiceConfigState } from '../config/service-config.js';
+import { CLI_PROXY_PROVIDER_STARTUP_CONFIG_INITIAL, CLI_PROXY_PROVIDER_STARTUP_SERVICE_ID, } from '../providers/cli-proxy-service-config.js';
+import { createChannelHostServiceConfigContract } from '../launcher/channel-service.js';
 import { PluginPermissionIdentityRegistry } from '../launcher/permission-rpc.js';
 import { LauncherMarketplaceCertifiedAuthority } from '../launcher/marketplace-certified-authority.js';
 import { PluginActivationStore } from '../launcher/plugin-activation.js';
 import { loadActivatedPluginComposition, loadPluginComposition } from '../launcher/plugin-composition.js';
 import { PluginLifecycleCoordinator } from '../launcher/plugin-lifecycle.js';
-import { PluginBundleCoordinator } from '../launcher/plugin-bundle.js';
+import { openPluginManagementService } from '../management/service.js';
+import { startPluginManagementRpcServer, } from '../launcher/management-rpc.js';
+import { bundledPluginEntry } from '../launcher/bundled-plugin.js';
 import { OwnerDocumentStore } from '../launcher/owner-document-store.js';
 import { EntityDirectoryAuthority } from '../launcher/entity-directory.js';
 import { createEntityBridgeHandler } from '../launcher/entity-rpc.js';
-import { loadStagedPluginPackage, stagedPluginBrowserArtifactDirectory } from '../launcher/plugin-package.js';
+import { loadStagedPluginPackage } from '../launcher/plugin-package.js';
 import { startPluginGenerationArtifactServer, } from '../launcher/plugin-generation-loader.js';
 import { AgentLoopAuthority } from '../launcher/agent-loop-authority.js';
-import { deployBundledCordisXSkill, } from '../launcher/builtin-skill.js';
+import { createCliProxyPlatformProviderBatch } from '../launcher/cli-proxy-platform-provider-batch.js';
+import { PackagePluginServiceConfigStore } from '../launcher/package-plugin-service-config.js';
+import { PlatformProviderPluginLifecycleRuntime } from '../launcher/platform-provider-plugin-lifecycle.js';
+import { stagePluginPackageSourceV1 } from '../launcher/packages/index.js';
+import { CORDISX_PLUGIN_MANIFEST_SCHEMA_V13, normalizePluginManifestV13 } from '../runtime-exact-request-permissions.js';
+import { CORDISX_PLUGIN_MANIFEST_SCHEMA_V14, normalizePluginManifestV14 } from '../launcher/latest-runtime-manifest.js';
+import { deployBundledCordisXSkill, deployBundledCordisXSkills } from '../launcher/builtin-skill.js';
 import { createOwnerDocumentBridgeHandler, entityInstallationId, OwnerDocumentLeaseRegistry, } from '../launcher/owner-document-rpc.js';
-import { agentHistoryHost, assertProductionGraphLaunchOwnership, buildRendererComposition, cliProxyServiceConfigApis, configuredPluginTopology, deployBuiltinSkillWithoutOverwritingUserChanges, HELP, ownValue, pluginIdentities, printPlan, providerConfigs, recoveredActivation, rootFromConfigPath, runDevelopment, runInjectedHost, usesIsolatedPackageWorker, } from './run-support.js';
-export async function runCordisXCli(argv, runtime = {}) {
-    const invocation = parseCordisXCli(argv);
-    const stdout = runtime.stdout ?? console.log;
-    const cwd = runtime.cwd ?? process.cwd();
-    const environment = runtime.env ?? process.env;
-    const homeConfigOptions = {
-        env: environment,
-        ...(runtime.homedir === undefined ? {} : { homedir: runtime.homedir }),
-    };
-    const configPath = resolveHomeConfigPath(homeConfigOptions);
-    if (invocation.action === 'help') {
-        stdout(HELP);
-        return;
-    }
-    if (invocation.action === 'setup') {
-        const config = await ensureHomeConfig(homeConfigOptions);
-        stdout(`[cordisx] configuration ready: ${configPath}`);
-        stdout(JSON.stringify(config, null, 2));
-        return;
-    }
-    if (invocation.action === 'config') {
-        const config = await ensureHomeConfig(homeConfigOptions);
-        stdout(`[cordisx] configuration: ${configPath}`);
-        stdout(JSON.stringify(config, null, 2));
-        return;
-    }
-    if (invocation.action === 'dev') {
-        await runDevelopment(invocation, cwd, stdout, environment, configPath, homeConfigOptions, runtime);
-        return;
-    }
-    const config = await ensureHomeConfig(homeConfigOptions);
-    const appId = invocation.action === 'launch' ? invocation.app ?? config.defaultApp : config.defaultApp;
-    const adapter = resolveHostAdapter(appId);
-    if (invocation.action === 'launch' && invocation.options.attach && (invocation.profile !== undefined || invocation.dataMode !== undefined)) {
-        throw new Error('--attach cannot select or override a named profile');
+import { managedBackendRuntimeServiceAccess } from '../launcher/packages/managed-backend-service-access.js';
+import { ManagedServiceRuntime } from '../launcher/managed-service-runtime.js';
+import { ManagedServiceNodeHost } from '../launcher/managed-service-node-host.js';
+import { ManagedServicePluginLifecycleRuntime } from '../launcher/managed-service-plugin-lifecycle.js';
+import { agentHistoryHost, assertProductionGraphLaunchOwnership, cliProxyServiceConfigApis, codexHome, deployBuiltinSkillsWithoutOverwritingUserChanges, deployBuiltinSkillWithoutOverwritingUserChanges, pluginIdentities, printPlan, providerConfigs, recoveredActivation, rootFromConfigPath, runInjectedHost, } from './run-support.js';
+import { attachActiveBrowserGraphs, buildRendererComposition, createProductionGraphBootstrap, createRendererLifecycleProjection, } from './renderer-composition.js';
+import { prepareCliCommand } from './run-command-dispatch.js';
+import { shouldEnableNativeSubmission } from './native-submission-launch-policy.js';
+import { createRendererChannelComposition } from './renderer-channel-composition.js';
+import { createSupervisorRuntime } from './supervisor-runtime.js';
+import { processStartIdentity } from './supervisor-state.js';
+export async function openProductionPluginManagementComposition(input) {
+    const service = await openPluginManagementService({
+        configPath: input.configPath,
+        homeDir: input.homeDir,
+        appId: input.appId,
+        profileId: input.profileId,
+        lifecycle: { coordinator: input.coordinator, runtimeGeneration: input.runtimeGeneration },
+    });
+    let server;
+    try {
+        const processStartedAt = input.processStartedAt ?? await processStartIdentity(process.pid);
+        if (processStartedAt === undefined)
+            throw new Error('cannot identify the CordisX management owner process');
+        server = await startPluginManagementRpcServer({
+            homeDir: input.homeDir,
+            appId: input.appId,
+            profileId: input.profileId,
+            configPath: input.configPath,
+            generation: input.runtimeGeneration,
+            processStartedAt,
+            service,
+        });
     }
-    if (invocation.action === 'launch' && invocation.options.system) {
-        const app = ownValue(config.apps, appId);
-        if (app === undefined)
-            throw new Error(`host app is not configured: ${appId}`);
-        const profileId = invocation.profile ?? app.defaultProfile;
-        const mode = invocation.dataMode ?? ownValue(app.profiles, profileId)?.dataMode ?? 'shared';
-        if (mode === 'host-isolated')
-            throw new Error('--system cannot enforce a host-isolated profile');
+    catch (error) {
+        service.close();
+        throw error;
     }
-    const selection = await resolveProfileSelection({
-        config,
-        configPath,
-        appId,
-        ...(invocation.action === 'launch' && invocation.profile !== undefined
-            ? { profileId: invocation.profile }
-            : {}),
-        ...(invocation.action === 'launch' && invocation.dataMode !== undefined
-            ? { dataMode: invocation.dataMode }
-            : {}),
-    });
-    if (invocation.action === 'doctor') {
-        try {
-            const plan = await adapter.resolveLaunchPlan({
-                cordisxHomeDir: rootFromConfigPath(configPath),
-                profileId: selection.profileId,
-                dataMode: selection.dataMode,
-            });
-            printPlan(plan, stdout);
-        }
-        catch (error) {
-            stdout(JSON.stringify({
-                status: 'unavailable',
-                appId,
-                profileId: selection.profileId,
-                dataMode: selection.dataMode,
-                diagnostic: error instanceof Error ? error.message : String(error),
-            }, null, 2));
-        }
+    let closed = false;
+    return {
+        handler: {
+            token: input.token,
+            profileId: input.profileId,
+            generation: input.runtimeGeneration,
+            service,
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            try {
+                await server.close();
+            }
+            finally {
+                service.close();
+            }
+        },
+    };
+}
+export async function runCordisXCli(argv, runtime = {}) {
+    const prepared = await prepareCliCommand(argv, runtime);
+    if (prepared === undefined)
         return;
-    }
+    const { invocation, stdout, environment, configPath, selection, adapter, appId } = prepared;
+    const supervisorRuntime = await createSupervisorRuntime(environment);
     const certifiedPermissionAuthority = await LauncherMarketplaceCertifiedAuthority.open({
         homeDir: rootFromConfigPath(configPath),
         configPath,
@@ -122,6 +118,10 @@ export async function runCordisXCli(argv, runtime = {}) {
         ? undefined
         : randomBytes(32).toString('hex');
     let pluginGenerationArtifactServer;
+    let managedServiceLifecycleRuntime;
+    let nativeSubmission;
+    let rendererComposition;
+    let productionPluginManagement;
     try {
         pluginGenerationArtifactServer = await startPluginGenerationArtifactServer();
         const activePluginGenerationArtifactServer = pluginGenerationArtifactServer;
@@ -135,6 +135,43 @@ export async function runCordisXCli(argv, runtime = {}) {
         const lifecycleGeneration = randomBytes(16).toString('hex');
         const lifecycleStore = new PluginActivationStore(rootFromConfigPath(configPath), selection.profileId, lifecycleGeneration);
         const lifecycleRuntime = new CdpPluginLifecycleRuntime();
+        const platformProviderLifecycleRuntime = new PlatformProviderPluginLifecycleRuntime(lifecycleRuntime);
+        managedServiceLifecycleRuntime = new ManagedServicePluginLifecycleRuntime({
+            runtime: platformProviderLifecycleRuntime,
+            profileId: selection.profileId,
+            runtimeGeneration: lifecycleGeneration,
+            activate: async (activation) => {
+                if (invocation.options.dryRun)
+                    return undefined;
+                const plugins = await loadPluginComposition(lifecycleStore, activation);
+                const accesses = await Promise.all(plugins.flatMap(plugin => {
+                    if (!plugin.enabled || plugin.package === undefined || plugin.manifest?.schemaVersion !== 14)
+                        return [];
+                    return plugin.manifest.services.flatMap(service => service.kind === 'managed-backend'
+                        ? [managedBackendRuntimeServiceAccess(rootFromConfigPath(configPath), {
+                                id: plugin.id,
+                                version: plugin.package.version,
+                                digest: plugin.package.digest,
+                                moduleGeneration: plugin.package.moduleGeneration,
+                            }, service.id, lifecycleGeneration)]
+                        : []);
+                }));
+                if (accesses.length === 0)
+                    return undefined;
+                const host = new ManagedServiceNodeHost(new ManagedServiceRuntime({
+                    homeDir: rootFromConfigPath(configPath),
+                    environment: runtime.env ?? process.env,
+                }), selection.profileId, lifecycleGeneration);
+                try {
+                    return await host.replace(accesses);
+                }
+                catch (error) {
+                    await host.dispose().catch(() => undefined);
+                    throw error;
+                }
+            },
+        });
+        const lifecycleTransactionRuntime = managedServiceLifecycleRuntime;
         const configuredIds = new Set(configuredComposition.plugins.map(plugin => plugin.id));
         const pluginLifecycleCoordinator = new PluginLifecycleCoordinator({
             homeDir: rootFromConfigPath(configPath),
@@ -143,7 +180,7 @@ export async function runCordisXCli(argv, runtime = {}) {
             permissionPolicies,
             loadPermissionPolicies: async () => (await loadHomeConfig(configPath)).permissions
                 .filter(policy => policy.key.profileId === selection.profileId),
-            runtime: lifecycleRuntime,
+            runtime: lifecycleTransactionRuntime,
             pluginGenerationArtifactServer: activePluginGenerationArtifactServer,
             reservedPluginIds: [...configuredIds],
             ...(certifiedPermissionAuthority === undefined ? {} : {
@@ -160,6 +197,7 @@ export async function runCordisXCli(argv, runtime = {}) {
                 },
             }),
         });
+        const pluginManagementToken = randomBytes(32).toString('hex');
         const recoveryPlans = await pluginLifecycleCoordinator.prepareRecovery();
         if (recoveryPlans.length > 1) {
             throw new Error('multiple shared registry rollback recoveries require separate launcher runs');
@@ -171,36 +209,14 @@ export async function runCordisXCli(argv, runtime = {}) {
         const activatedPackagePlugins = initialActivation === undefined
             ? await loadActivatedPluginComposition(lifecycleStore)
             : await loadPluginComposition(lifecycleStore, initialActivation);
-        const activatedPlugins = await Promise.all(activatedPackagePlugins.map(async (plugin) => {
-            const manifest = plugin.manifest;
-            const isolatedWorker = manifest?.schemaVersion === 7
-                || ((manifest?.schemaVersion === 5 || manifest?.schemaVersion === 6)
-                    && manifest.capabilities.some(capability => (capability.name === 'ui.host-dom.read' || capability.name === 'ui.host-dom.modify')));
-            if (!plugin.enabled || plugin.package === undefined || isolatedWorker)
-                return plugin;
-            const staged = await loadStagedPluginPackage(rootFromConfigPath(configPath), plugin.package.digest);
-            if (staged.browserArtifact === undefined)
-                return plugin;
-            const lease = await activePluginGenerationArtifactServer.lease({
-                packageIdentity: {
-                    pluginId: plugin.id,
-                    version: plugin.package.version,
-                    integrity: plugin.package.digest,
-                },
-                artifactDirectory: stagedPluginBrowserArtifactDirectory(rootFromConfigPath(configPath), plugin.package.digest),
-                runtimeEntry: staged.browserArtifact.manifest.entry,
-            }, plugin.package.moduleGeneration, staged.browserArtifact.manifest);
-            lifecycleRuntime.registerActivePluginGenerationLease(lease);
-            return {
-                ...plugin,
-                runtimeGraph: {
-                    moduleGeneration: lease.moduleGeneration,
-                    loadSource: lease.importSource,
-                    publishSource: lease.publishSource,
-                    retireSource: lease.retireSource,
-                },
-            };
-        }));
+        const activatedPlugins = await attachActiveBrowserGraphs({
+            plugins: activatedPackagePlugins,
+            homeDir: rootFromConfigPath(configPath),
+            artifactServer: activePluginGenerationArtifactServer,
+            lifecycleRuntime,
+        });
+        const activeLifecycleActivation = initialActivation ?? await lifecycleStore.loadActive();
+        await managedServiceLifecycleRuntime.initialize(activeLifecycleActivation);
         const permissionIdentities = new PluginPermissionIdentityRegistry([
             ...pluginIdentities(configuredComposition),
             ...pluginIdentities({ ...configuredComposition, plugins: activatedPlugins }),
@@ -213,64 +229,28 @@ export async function runCordisXCli(argv, runtime = {}) {
             ...configuredComposition,
             plugins: [...configuredComposition.plugins, ...activatedPlugins],
         };
-        const channelPlugin = composition.plugins.find(plugin => plugin.enabled && plugin.id === 'channel');
-        const channelCredentialBridgeToken = channelPlugin === undefined ? undefined : randomBytes(32).toString('hex');
-        const channelActionsBridgeToken = channelPlugin === undefined ? undefined : randomBytes(32).toString('hex');
-        let channelService;
-        let channelManager;
-        const loadChannelManagerProjection = async () => {
-            if (channelPlugin === undefined || channelService === undefined)
-                return undefined;
-            const state = await readServiceConfigState({
-                profileId: selection.profileId,
-                pluginId: 'channel',
-                serviceId: 'runtime',
-                initialConfig: CHANNEL_SERVICE_CONFIG_INITIAL,
-            }, configPath);
-            return projectLocalChannelManager({
-                configuration: state.config,
-                revision: state.revision,
-                lastGoodRevision: state.lastGoodRevision,
-                writable: true,
-                ...(channelService.snapshot() === undefined ? {} : { runtime: channelService.snapshot() }),
-                audit: channelService.auditSnapshot(),
-            });
-        };
-        if (channelPlugin !== undefined) {
-            const state = await readServiceConfigState({
-                profileId: selection.profileId,
-                pluginId: 'channel',
-                serviceId: 'runtime',
-                initialConfig: CHANNEL_SERVICE_CONFIG_INITIAL,
-            }, configPath);
-            channelService = createLocalChannelService({
-                artifactDirectory: path.dirname(channelPlugin.entry),
-                dataDir: path.join(rootFromConfigPath(configPath), 'cache', 'channel-runtime'),
-                source: channelPlugin.source ?? pathToFileURL(channelPlugin.entry).href,
-                environment: runtime.env ?? process.env,
-            });
-            await channelService.start(state.config);
-            channelManager = await loadChannelManagerProjection();
-        }
-        const pluginLifecycleBridgeToken = randomBytes(32).toString('hex');
-        const pluginBundleCoordinator = new PluginBundleCoordinator({
+        const channel = await createRendererChannelComposition({
+            composition,
+            profileId: selection.profileId,
+            configPath,
+            homeDir: rootFromConfigPath(configPath),
+            environment: runtime.env ?? process.env,
+        });
+        const channelPlugin = channel.plugin;
+        const channelService = channel.service;
+        const channelManager = channel.manager;
+        const channelCredentialBridgeToken = channel.credentialBridgeToken;
+        const channelActionsBridgeToken = channel.actionsBridgeToken;
+        const rendererLifecycle = createRendererLifecycleProjection({
             homeDir: rootFromConfigPath(configPath),
             profileId: selection.profileId,
-            runtimeGeneration: lifecycleGeneration,
-            pluginLifecycle: pluginLifecycleCoordinator,
+            generation: lifecycleGeneration,
+            pluginLifecycleCoordinator,
+            lifecycleRuntime,
+            managedServiceLifecycleRuntime,
         });
-        pluginLifecycleCoordinator.setBundleClaimGuard(async (pluginId) => await pluginBundleCoordinator.bundleClaims(pluginId));
-        const pluginLifecycle = {
-            handler: {
-                token: pluginLifecycleBridgeToken,
-                profileId: selection.profileId,
-                generation: lifecycleGeneration,
-                coordinator: pluginLifecycleCoordinator,
-                bundleCoordinator: pluginBundleCoordinator,
-            },
-            runtime: lifecycleRuntime,
-        };
-        const rendererComposition = await buildRendererComposition(composition, stdout, {
+        const { token: pluginLifecycleBridgeToken, pluginBundleCoordinator, pluginLifecycle, managedServiceActivation, managedServiceUICapabilities, managedServiceUI, } = rendererLifecycle;
+        rendererComposition = await buildRendererComposition(composition, stdout, {
             appId,
             profileId: selection.profileId,
             ...(selection.profile.iconTheme === undefined ? {} : { iconThemePreference: selection.profile.iconTheme }),
@@ -283,88 +263,32 @@ export async function runCordisXCli(argv, runtime = {}) {
             generation: lifecycleGeneration,
             pluginLifecycle: {
                 token: pluginLifecycleBridgeToken,
-                activation: initialActivation ?? await lifecycleStore.loadActive(),
+                activation: activeLifecycleActivation,
                 ...(recoveryPlan === undefined ? {} : { registryEpoch: recoveryPlan.rollbackRegistryEpoch }),
             },
+            pluginManagement: { token: pluginManagementToken, profileId: selection.profileId },
             pluginBundles: await pluginBundleCoordinator.snapshot(),
             ...(certifiedPermissionChannelToken === undefined ? {} : { certifiedPermissionChannelToken }),
             ...(channelManager === undefined ? {} : { channelManager }),
             ...(channelCredentialBridgeToken === undefined ? {} : { channelCredentialBridgeToken }),
             ...(channelActionsBridgeToken === undefined ? {} : { channelActionsBridgeToken }),
+            managedServiceUICapabilities,
+            productionGraph: !invocation.options.attach,
             ...(runtime.internalBuildRendererBundle === undefined
                 ? {}
                 : { internalBuildRendererBundle: runtime.internalBuildRendererBundle }),
         });
-        const initialConfiguredTopology = configuredPluginTopology(configuredComposition);
-        const loadCurrentProductionProjection = async () => {
-            const active = await lifecycleStore.loadActive();
-            const registryEpoch = lifecycleRuntime.currentRegistryEpoch();
-            const [freshConfigured, packagePlugins, freshHomeConfig, pluginBundles, freshChannelManager] = await Promise.all([
-                loadConfig(configPath, {
-                    profileId: selection.profileId,
-                    projectRoot: rootFromConfigPath(configPath),
-                }),
-                loadPluginComposition(lifecycleStore, active),
-                loadHomeConfig(configPath),
-                pluginBundleCoordinator.snapshot(),
-                loadChannelManagerProjection(),
-            ]);
-            if (configuredPluginTopology(freshConfigured) !== initialConfiguredTopology) {
-                throw new Error('launcher-configured plugin topology changed during browser graph admission');
-            }
-            if (pluginBundles.pluginRevision !== active.revision) {
-                throw new Error('plugin bundle projection does not match the active plugin revision');
-            }
-            const currentPackagePlugins = await Promise.all(packagePlugins.map(async (plugin) => {
-                if (!plugin.enabled || plugin.package === undefined || usesIsolatedPackageWorker(plugin))
-                    return plugin;
-                const staged = await loadStagedPluginPackage(rootFromConfigPath(configPath), plugin.package.digest);
-                if (staged.browserArtifact === undefined)
-                    return plugin;
-                const runtimeGraph = lifecycleRuntime.activeBrowserGraph(plugin.id, plugin.package.moduleGeneration);
-                if (runtimeGraph === undefined) {
-                    throw new Error(`active browser graph lease is unavailable for plugin ${plugin.id}`);
-                }
-                return { ...plugin, runtimeGraph };
-            }));
-            const permissionPolicies = freshHomeConfig.permissions.filter(policy => policy.key.profileId === selection.profileId);
-            const currentComposition = {
-                ...freshConfigured,
-                plugins: [...freshConfigured.plugins, ...currentPackagePlugins],
-            };
-            return {
-                active,
-                registryEpoch,
-                currentComposition,
-                permissionPolicies,
-                pluginBundles,
-                freshChannelManager,
-                fingerprint: JSON.stringify({
-                    active,
-                    registryEpoch,
-                    currentComposition,
-                    permissionPolicies,
-                    pluginBundles,
-                    freshChannelManager,
-                }),
-            };
-        };
-        const productionGraphBootstrap = async (expectedActive, expectedRegistryEpoch) => {
-            const before = await loadCurrentProductionProjection();
-            if (JSON.stringify(before.active) !== JSON.stringify(expectedActive)
-                || before.registryEpoch !== expectedRegistryEpoch)
-                throw new Error('browser graph admission activation snapshot is stale');
-            const rebuilt = await rendererComposition.rebuild(before.currentComposition, before.active, expectedRegistryEpoch, {
-                permissionPolicies: before.permissionPolicies,
-                pluginBundles: before.pluginBundles,
-                ...(before.freshChannelManager === undefined ? {} : { channelManager: before.freshChannelManager }),
-            });
-            const after = await loadCurrentProductionProjection();
-            if (after.fingerprint !== before.fingerprint) {
-                throw new Error('browser graph admission projection changed during source rebuild');
-            }
-            return rebuilt;
-        };
+        const productionGraphBootstrap = createProductionGraphBootstrap({
+            rendererComposition,
+            configuredComposition,
+            configPath,
+            profileId: selection.profileId,
+            lifecycleStore,
+            lifecycleRuntime,
+            pluginBundleCoordinator,
+            managedServiceLifecycleRuntime,
+            loadChannelManagerProjection: channel.loadManagerProjection,
+        });
         const documentLeases = new OwnerDocumentLeaseRegistry({
             stable: pluginIdentities(configuredComposition).map(identity => ({
                 source: identity.source,
@@ -392,6 +316,10 @@ export async function runCordisXCli(argv, runtime = {}) {
                 },
             });
         const ownerDocumentHandler = createOwnerDocumentBridgeHandler({
+            onDiagnostic: event => stdout(`[cordisx] HTTP transport ${JSON.stringify(event)}`),
+            localWalletHomeDir: rootFromConfigPath(configPath),
+            managedSourcesNow: () => loadManagedSourceTrustNow(rootFromConfigPath(configPath), selection.profileId),
+            managedSources: async () => (await import('../launcher/managed-source-trust.js')).loadManagedSourceTrust(rootFromConfigPath(configPath), selection.profileId),
             plugins: composition.plugins,
             secret: rendererComposition.ownerDocumentSecret,
             profileId: selection.profileId,
@@ -425,7 +353,11 @@ export async function runCordisXCli(argv, runtime = {}) {
         const ownerDocuments = Object.assign(ownerDocumentHandler, { entities: entityBridge });
         lifecycleRuntime.setOwnerDocumentAuthority({ leases: documentLeases, issue: ownerDocuments.issue });
         lifecycleRuntime.setEntityAuthority(selection.profileId, entityAuthority);
-        await runtime.internalObserveOwnerDocuments?.({ source: rendererComposition.source, handler: ownerDocuments });
+        await runtime.internalObserveOwnerDocuments?.({
+            bootstrapSource: rendererComposition.source,
+            source: rendererComposition.authoritySource(),
+            handler: ownerDocuments,
+        });
         const permissionPersistence = rendererComposition.permissionBridgeToken === undefined ? undefined : {
             configPath,
             profileId: selection.profileId,
@@ -442,12 +374,106 @@ export async function runCordisXCli(argv, runtime = {}) {
                 hostGeneration: rendererComposition.generation,
                 token: rendererComposition.iconThemePreferenceBridgeToken,
             };
+        const fleetConfigs = providerConfigs(composition, runtime.env ?? process.env)
+            .filter(provider => provider.kind === 'local-codex');
+        const cliProxyConfigured = composition.plugins.some(plugin => plugin.id === 'cli-proxy-api' && plugin.enabled);
+        const cliProxyPackageOwned = activatedPlugins.some(plugin => plugin.id === 'cli-proxy-api' && plugin.enabled);
+        const cliProxyPackageServiceConfig = cliProxyPackageOwned
+            ? new PackagePluginServiceConfigStore(rootFromConfigPath(configPath), selection.profileId, lifecycleGeneration)
+            : undefined;
+        const markCliProxyStartupConfigApplied = async () => {
+            if (!cliProxyConfigured)
+                return;
+            try {
+                const read = cliProxyPackageServiceConfig?.persistence.read ?? readServiceConfigState;
+                const state = await read({
+                    profileId: selection.profileId,
+                    pluginId: 'cli-proxy-api',
+                    serviceId: CLI_PROXY_PROVIDER_STARTUP_SERVICE_ID,
+                    initialConfig: CLI_PROXY_PROVIDER_STARTUP_CONFIG_INITIAL,
+                }, configPath);
+                if (state.restartRequired !== true)
+                    return;
+                const markApplied = cliProxyPackageServiceConfig?.persistence.markAppRestartApplied
+                    ?? markServiceConfigAppRestartApplied;
+                await markApplied({
+                    profileId: selection.profileId,
+                    pluginId: 'cli-proxy-api',
+                    serviceId: CLI_PROXY_PROVIDER_STARTUP_SERVICE_ID,
+                    expectedRevision: state.revision,
+                    initialConfig: CLI_PROXY_PROVIDER_STARTUP_CONFIG_INITIAL,
+                }, configPath);
+            }
+            catch (error) {
+                stdout(`[cordisx] failed to mark CLIProxy startup configuration applied: ${String(error)}`);
+            }
+        };
+        const runHost = runtime.internalRunInjectedHost ?? runInjectedHost;
+        const launcherCliProxy = cliProxyConfigured
+            ? await (async () => {
+                const entry = bundledPluginEntry('plugin-cli-proxy-api');
+                const staged = await stagePluginPackageSourceV1({
+                    kind: 'local-directory',
+                    location: pathToFileURL(await findPackageRoot(entry)).href,
+                }, {
+                    homeDir: rootFromConfigPath(configPath),
+                    runtimeValidators: {
+                        [CORDISX_PLUGIN_MANIFEST_SCHEMA_V13]: value => normalizePluginManifestV13(value, 'cli-proxy-api'),
+                        [CORDISX_PLUGIN_MANIFEST_SCHEMA_V14]: value => normalizePluginManifestV14(value, 'cli-proxy-api'),
+                    },
+                });
+                return {
+                    id: staged.manifest.id,
+                    version: staged.manifest.version,
+                    digest: staged.digest,
+                    moduleGeneration: `launcher-cli-proxy:${lifecycleGeneration}`,
+                    enabled: true,
+                    dependencies: staged.manifest.dependencies,
+                    ...(staged.manifest.canonicalSource === undefined
+                        ? {}
+                        : { canonicalSource: staged.manifest.canonicalSource }),
+                };
+            })()
+            : undefined;
         const providerFleet = rendererComposition.providerBridgeToken === undefined
             ? undefined
-            : await ProviderFleet.create(providerConfigs(composition, runtime.env ?? process.env), {
+            : await ProviderFleet.create(fleetConfigs, {
                 appServer: { environment: runtime.env ?? process.env },
                 agentLoopAuthority: await AgentLoopAuthority.open(rootFromConfigPath(configPath), selection.profileId),
             });
+        const platformProviderServices = providerFleet === undefined
+            ? undefined
+            : createCliProxyPlatformProviderBatch({
+                homeDir: rootFromConfigPath(configPath),
+                profileId: selection.profileId,
+                hostGeneration: lifecycleGeneration,
+                configPath,
+                rootDir: rootFromConfigPath(configPath),
+                environment: runtime.env ?? process.env,
+                activation: async () => await lifecycleStore.bindRuntimeGeneration(),
+                ...(launcherCliProxy === undefined ? {} : { launcherCandidates: [launcherCliProxy] }),
+                ...(cliProxyPackageServiceConfig === undefined
+                    ? {}
+                    : { serviceConfigPersistence: cliProxyPackageServiceConfig.persistence }),
+            });
+        if (providerFleet !== undefined && platformProviderServices !== undefined) {
+            platformProviderLifecycleRuntime.connect(async (activation) => await platformProviderServices.reconfigure(providerFleet, fleetConfigs, undefined, activation));
+            try {
+                if (await platformProviderServices.hasCandidates()) {
+                    const initialProviders = await platformProviderServices.reconfigure(providerFleet, fleetConfigs);
+                    await initialProviders.finalize();
+                }
+            }
+            catch (error) {
+                await platformProviderServices.close();
+                await providerFleet.close();
+                throw error;
+            }
+        }
+        const closeProviderFleet = async () => {
+            await platformProviderServices?.close();
+            await providerFleet?.close();
+        };
         const serviceConfigToken = rendererComposition.serviceConfigBridgeToken;
         const services = [];
         let channelConfigApi;
@@ -460,6 +486,10 @@ export async function runCordisXCli(argv, runtime = {}) {
                 rootDir: rootFromConfigPath(configPath),
                 environment: runtime.env ?? process.env,
                 fleet: providerFleet,
+                ...(platformProviderServices === undefined ? {} : { platformProviderServices }),
+                ...(cliProxyPackageServiceConfig === undefined
+                    ? {}
+                    : { persistence: cliProxyPackageServiceConfig.persistence }),
             }));
         }
         if (serviceConfigToken !== undefined && channelPlugin !== undefined && channelService !== undefined) {
@@ -508,22 +538,35 @@ export async function runCordisXCli(argv, runtime = {}) {
                 assertProductionGraphLaunchOwnership(true, rendererComposition.hasLoopbackGraph);
             }
             catch (error) {
+                ownerDocuments.walletSpend?.dispose();
+                await ownerDocuments.http.dispose();
                 await ownerDocuments.agentTools?.close();
                 await channelService?.dispose();
-                await providerFleet?.close();
+                await closeProviderFleet();
                 throw error;
             }
             const debugPort = invocation.options.debugPort ?? composition.codex.debugPort;
             if (invocation.options.dryRun) {
                 stdout(JSON.stringify({ status: 'ready', mode: 'attach', appId, debugPort }, null, 2));
+                ownerDocuments.walletSpend?.dispose();
+                await ownerDocuments.http.dispose();
                 await ownerDocuments.agentTools?.close();
                 await channelService?.dispose();
-                await providerFleet?.close();
+                await closeProviderFleet();
                 return;
             }
+            productionPluginManagement = await openProductionPluginManagementComposition({
+                configPath,
+                homeDir: rootFromConfigPath(configPath),
+                appId,
+                profileId: selection.profileId,
+                runtimeGeneration: lifecycleGeneration,
+                token: pluginManagementToken,
+                coordinator: pluginLifecycleCoordinator,
+            });
             stdout('[cordisx] built-in Skill deployment skipped for --attach because the Host HOME is unknown');
             try {
-                await runInjectedHost({
+                await runHost({
                     source: rendererComposition.source,
                     hasLoopbackGraph: rendererComposition.hasLoopbackGraph,
                     pluginArtifactOrigin: activePluginGenerationArtifactServer.origin,
@@ -542,9 +585,11 @@ export async function runCordisXCli(argv, runtime = {}) {
                     ...(serviceConfigBridge === undefined ? {} : { serviceConfigBridge }),
                     ...(channelCredentialBridge === undefined ? {} : { channelCredentialBridge }),
                     ...(channelActionsBridge === undefined ? {} : { channelActionsBridge }),
+                    managedServiceUI,
                     ...(permissionPersistence === undefined ? {} : { permissionPersistence }),
                     ...(iconThemePreferencePersistence === undefined ? {} : { iconThemePreferencePersistence }),
                     pluginLifecycle,
+                    pluginManagement: productionPluginManagement.handler,
                     ...(certifiedPermissionAuthority === undefined || certifiedPermissionChannelToken === undefined ? {} : {
                         certifiedPermission: {
                             authority: certifiedPermissionAuthority,
@@ -556,13 +601,21 @@ export async function runCordisXCli(argv, runtime = {}) {
                     debugPort,
                     hostArgs: invocation.hostArgs,
                     launcher: invocation.options,
+                    onReady: async () => {
+                        await markCliProxyStartupConfigApplied();
+                        await supervisorRuntime.markReady(debugPort);
+                    },
+                    onHostLaunched: async (pid, inspectorUrl) => await supervisorRuntime.markHostLaunched(pid, inspectorUrl),
+                    dockInspector: supervisorRuntime.dockInspector,
                     stdout,
                 });
             }
             finally {
+                ownerDocuments.walletSpend?.dispose();
+                await ownerDocuments.http.dispose();
                 await ownerDocuments.agentTools?.close();
                 await channelService?.dispose();
-                await providerFleet?.close();
+                await closeProviderFleet();
             }
             return;
         }
@@ -585,24 +638,16 @@ export async function runCordisXCli(argv, runtime = {}) {
         printPlan(plan, stdout, invocation.options.dryRun ? 'ready' : 'launching');
         if (invocation.options.dryRun) {
             stdout(`[cordisx] loopback CDP port: ${invocation.options.debugPort ?? 'automatic'}`);
+            ownerDocuments.walletSpend?.dispose();
+            await ownerDocuments.http.dispose();
             await ownerDocuments.agentTools?.close();
             await channelService?.dispose();
-            await providerFleet?.close();
+            await closeProviderFleet();
             return;
         }
         const debugPort = invocation.options.debugPort ?? await findFreeLoopbackPort();
         if (invocation.options.debugPort !== undefined)
             await assertLoopbackPortAvailable(debugPort);
-        await adapter.prepareLaunch(plan);
-        await deployBuiltinSkillWithoutOverwritingUserChanges(deployBundledCordisXSkill(plan, {
-            ...(runtime.internalBuiltinSkillSourceDir === undefined
-                ? {}
-                : { sourceDir: runtime.internalBuiltinSkillSourceDir }),
-            ...(runtime.internalSharedHomeDir === undefined
-                ? {}
-                : { sharedHomeOverride: runtime.internalSharedHomeDir }),
-        }), stdout);
-        stdout(`[cordisx] loopback CDP port: ${debugPort}`);
         const chromiumProfile = plan.chromiumProfile;
         const profile = chromiumProfile.mode === 'independent'
             ? {
@@ -611,8 +656,59 @@ export async function runCordisXCli(argv, runtime = {}) {
                     && root.path === chromiumProfile.path && root.managed),
             }
             : undefined;
+        const profileLease = profile === undefined || runHost !== runInjectedHost
+            ? undefined
+            : await acquireCodexProfileLaunchLease(profile.userDataDir);
+        let profileLeaseHandedOff = false;
         try {
-            await runInjectedHost({
+            await adapter.prepareLaunch(plan);
+            if (shouldEnableNativeSubmission({
+                platform: runtime.internalNativeSubmissionPlatform ?? process.platform,
+                adapterId: adapter.id,
+                preference: (runtime.env ?? process.env).CORDISX_EXPERIMENTAL_NATIVE_SUBMISSION,
+            })) {
+                try {
+                    nativeSubmission =
+                        await (runtime.internalCreateNativeSubmissionComposition ?? createNativeSubmissionComposition)(managedServiceActivation, plan.executable, codexHome({ ...environment, ...plan.environment }), selection.profile.defaultModelProvider === undefined
+                            ? {}
+                            : { defaultProviderId: selection.profile.defaultModelProvider });
+                }
+                catch (error) {
+                    stdout(`[cordisx] native Desktop model providers unavailable: ${String(error)}`);
+                }
+            }
+            if (runtime.internalBuiltinSkillSourceDir !== undefined
+                && runtime.internalBuiltinSkillsSourceRootDir === undefined) {
+                await deployBuiltinSkillWithoutOverwritingUserChanges(deployBundledCordisXSkill(plan, {
+                    sourceDir: runtime.internalBuiltinSkillSourceDir,
+                    ...(runtime.internalSharedHomeDir === undefined
+                        ? {}
+                        : { sharedHomeOverride: runtime.internalSharedHomeDir }),
+                }), stdout);
+            }
+            else {
+                await deployBuiltinSkillsWithoutOverwritingUserChanges(deployBundledCordisXSkills(plan, {
+                    ...(runtime.internalBuiltinSkillsSourceRootDir === undefined
+                        ? {}
+                        : { sourceRootDir: runtime.internalBuiltinSkillsSourceRootDir }),
+                    ...(runtime.internalSharedHomeDir === undefined
+                        ? {}
+                        : { sharedHomeOverride: runtime.internalSharedHomeDir }),
+                }), stdout);
+            }
+            productionPluginManagement = await openProductionPluginManagementComposition({
+                configPath,
+                homeDir: rootFromConfigPath(configPath),
+                appId,
+                profileId: selection.profileId,
+                runtimeGeneration: lifecycleGeneration,
+                token: pluginManagementToken,
+                coordinator: pluginLifecycleCoordinator,
+            });
+            stdout(`[cordisx] loopback CDP port: ${debugPort}`);
+            const createAgentHistoryHost = runtime.internalAgentHistoryHost ?? agentHistoryHost;
+            const runHostInput = {
+                ...(nativeSubmission === undefined ? {} : { nativeSubmission: nativeSubmission.installation }),
                 source: rendererComposition.source,
                 hasLoopbackGraph: rendererComposition.hasLoopbackGraph,
                 pluginArtifactOrigin: activePluginGenerationArtifactServer.origin,
@@ -620,7 +716,7 @@ export async function runCordisXCli(argv, runtime = {}) {
                 ...(rendererComposition.newDocumentSource === undefined ? {} : {
                     newDocumentSource: rendererComposition.newDocumentSource,
                 }),
-                agentHistoryHost: agentHistoryHost({ ...(runtime.env ?? process.env), ...plan.environment }, configPath, `${appId}:${selection.profileId}:${selection.dataMode}`),
+                agentHistoryHost: createAgentHistoryHost({ ...(runtime.env ?? process.env), ...plan.environment }, configPath, `${appId}:${selection.profileId}:${selection.dataMode}`),
                 agentHistoryBridgeToken: rendererComposition.agentHistoryBridgeToken,
                 ...(rendererComposition.providerBridgeToken === undefined ? {} : {
                     providerFleet: providerFleet,
@@ -631,9 +727,11 @@ export async function runCordisXCli(argv, runtime = {}) {
                 ...(serviceConfigBridge === undefined ? {} : { serviceConfigBridge }),
                 ...(channelCredentialBridge === undefined ? {} : { channelCredentialBridge }),
                 ...(channelActionsBridge === undefined ? {} : { channelActionsBridge }),
+                managedServiceUI,
                 ...(permissionPersistence === undefined ? {} : { permissionPersistence }),
                 ...(iconThemePreferencePersistence === undefined ? {} : { iconThemePreferencePersistence }),
                 pluginLifecycle,
+                pluginManagement: productionPluginManagement.handler,
                 ...(certifiedPermissionAuthority === undefined || certifiedPermissionChannelToken === undefined ? {} : {
                     certifiedPermission: {
                         authority: certifiedPermissionAuthority,
@@ -647,18 +745,38 @@ export async function runCordisXCli(argv, runtime = {}) {
                 debugPort,
                 hostArgs: invocation.hostArgs,
                 launcher: invocation.options,
+                onReady: async () => {
+                    await markCliProxyStartupConfigApplied();
+                    await supervisorRuntime.markReady(debugPort);
+                },
+                onHostLaunched: async (pid, inspectorUrl) => await supervisorRuntime.markHostLaunched(pid, inspectorUrl),
+                dockInspector: supervisorRuntime.dockInspector,
                 ...(profile === undefined ? {} : { profile }),
-                ...(Object.keys(plan.environment).length === 0 ? {} : { environment: plan.environment }),
+                ...(profileLease === undefined ? {} : { profileLease }),
+                ...((Object.keys(plan.environment).length === 0 && nativeSubmission === undefined)
+                    ? {}
+                    : { environment: { ...plan.environment, ...nativeSubmission?.environment } }),
                 stdout,
-            });
+            };
+            profileLeaseHandedOff = profileLease !== undefined;
+            await runHost(runHostInput);
         }
         finally {
+            ownerDocuments.walletSpend?.dispose();
+            await ownerDocuments.http.dispose();
+            if (profileLease !== undefined && !profileLeaseHandedOff)
+                await profileLease.release();
             await ownerDocuments.agentTools?.close();
             await channelService?.dispose();
-            await providerFleet?.close();
+            await closeProviderFleet();
         }
     }
     finally {
+        await productionPluginManagement?.close().catch(() => undefined);
+        await rendererComposition?.close().catch(() => undefined);
+        await supervisorRuntime.close();
+        await nativeSubmission?.close().catch(() => undefined);
+        await managedServiceLifecycleRuntime?.dispose().catch(() => undefined);
         await pluginGenerationArtifactServer?.close();
         await certifiedPermissionAuthority?.dispose();
     }