letagents 0.12.10 → 0.12.11

package/README.md

@@ -143,6 +143,8 @@ The API runs at `http://localhost:3001`. Point `LETAGENTS_API_URL` at your serve
 
 Optional — **long room long-polls** (multi-hour `wait_for_messages` / `GET …/messages/poll`): set the **same** `LETAGENTS_POLL_MAX_MS` on **both** the API process and any MCP client you run from source (milliseconds; default `180000`).
 
+Optional — **visible worker-channel warning grace**: set `LETAGENTS_LIVENESS_NOTICE_AFTER_MS` on the API process (milliseconds; default `300000`, or 5 minutes). Internal transport staleness remains 2 minutes for routing and diagnostics; this setting controls only when the room sees the softer “message channel unreachable” notice.
+
 The API now uses PostgreSQL with Drizzle ORM. `DB_URL` must be set before starting the server or running migrations.
 
 Useful database commands:

package/dist/api/board-intent-payloads.js

@@ -0,0 +1,25 @@
+export function boardIntentPayloadForTaskCreate(input) {
+    return {
+        title: input.title.trim(),
+        description: input.description?.trim() || null,
+        source_message_id: input.sourceMessageId?.trim() || null,
+    };
+}
+export function boardIntentPayloadForTaskMutation(input) {
+    return {
+        task_id: input.taskId,
+        status: input.status ?? null,
+        assignee: input.assignee ?? null,
+        assignee_agent_key: input.assigneeAgentKey ?? null,
+        pr_url: input.prUrl ?? null,
+    };
+}
+export function boardIntentPayloadForLeaseAction(input) {
+    return {
+        task_id: input.taskId,
+        action: input.action,
+        lease_id: input.leaseId ?? null,
+        target_actor_key: input.targetActorKey ?? null,
+        target_agent_session_id: input.targetAgentSessionId ?? null,
+    };
+}

package/dist/mcp/codex-session/runtime-bridge.js

@@ -1,5 +1,7 @@
-import { getCurrentCodexLiveSession, getStoredAuth, getStoredCodexLiveSession, readLocalState, updateCodexLiveSession, } from "../local-state.js";
+import { getCurrentCodexLiveSession, getStoredCodexLiveSession, readLocalState, updateCodexLiveSession, } from "../local-state.js";
 import { encodeRoomIdPath } from "../room-id.js";
+import { apiCall } from "../server/runtime/api.js";
+import { agentSessionCredentials } from "../server/runtime/agent-sessions.js";
 import { RpcClient } from "./rpc-client.js";
 import { isCodexAgentSessionMarker, summarizeCodexRuntimeNotificationForTest, } from "./runtime-summary.js";
 const CODEX_RUNTIME_STREAM_THROTTLE_MS = 750;
@@ -7,35 +9,16 @@ const CODEX_RUNTIME_STREAM_REPEAT_MS = 30_000;
 const CODEX_RUNTIME_STREAM_SNAPSHOT_INTERVAL_MS = 2_000;
 const CODEX_RUNTIME_STREAM_BIND_RETRY_MS = 1_000;
 const CODEX_RUNTIME_STREAM_BIND_RETRY_ATTEMPTS = 30;
+const CODEX_NATIVE_HEARTBEAT_INTERVAL_MS = 15_000;
 export function createCodexRuntimeBridgeController(input) {
     const clients = new Map();
     const snapshotTimers = new Map();
     const bindTimers = new Map();
     const lastPost = new Map();
-    function apiUrl() {
-        return (process.env.LETAGENTS_API_URL || "http://localhost:3001").replace(/\/+$/, "");
-    }
-    function authorizationHeader() {
-        const token = process.env.LETAGENTS_TOKEN || getStoredAuth()?.token || "";
-        return token ? `Bearer ${token}` : null;
-    }
+    const nativeSequence = new Map();
+    const nativeLastPostAt = new Map();
     async function codexBridgeApiCall(path, options) {
-        const headers = {
-            "Content-Type": "application/json",
-            ...options?.headers,
-        };
-        const authorization = authorizationHeader();
-        if (authorization && !headers.Authorization) {
-            headers.Authorization = authorization;
-        }
-        const response = await fetch(`${apiUrl()}${path}`, {
-            ...options,
-            headers,
-        });
-        if (!response.ok) {
-            throw new Error(`LetAgents API ${response.status}: ${await response.text()}`);
-        }
-        return (await response.json());
+        return apiCall(path, options);
     }
     function codexWorkerSessionsForRoom(roomId) {
         const state = readLocalState();
@@ -129,7 +112,32 @@ export function createCodexRuntimeBridgeController(input) {
         }
     }
     async function postReasoningUpdate(session, notification) {
-        await postReasoningSummary(session, summarizeCodexRuntimeNotificationForTest(notification));
+        const summary = summarizeCodexRuntimeNotificationForTest(notification);
+        await Promise.all([
+            postReasoningSummary(session, summary),
+            postNativeActivity(session, notification.method, summary.status),
+        ]);
+    }
+    async function postNativeActivity(session, method, status, force = false) {
+        const workerSession = codexWorkerSessionForLiveSession(session);
+        if (!workerSession)
+            return;
+        const now = Date.now();
+        if (!force && now - (nativeLastPostAt.get(session.session_id) ?? 0) < CODEX_RUNTIME_STREAM_THROTTLE_MS)
+            return;
+        nativeLastPostAt.set(session.session_id, now);
+        const sequence = (nativeSequence.get(session.session_id) ?? 0) + 1;
+        nativeSequence.set(session.session_id, sequence);
+        await codexBridgeApiCall(`/rooms/${encodeRoomIdPath(session.room_id)}/agent-sessions/${encodeURIComponent(workerSession.session_id)}/native-activity`, {
+            method: "POST",
+            body: JSON.stringify({
+                ...agentSessionCredentials(workerSession),
+                observed_at: new Date(now).toISOString(),
+                sequence,
+                method,
+                status,
+            }),
+        });
     }
     function start(session, client) {
         stop(session.session_id);
@@ -143,6 +151,11 @@ export function createCodexRuntimeBridgeController(input) {
                     !status.server_reachable ||
                     input.isTerminalStatus(status.session.status)) {
                     stop(session.session_id);
+                    return;
+                }
+                const now = Date.now();
+                if (now - (nativeLastPostAt.get(session.session_id) ?? 0) >= CODEX_NATIVE_HEARTBEAT_INTERVAL_MS) {
+                    void postNativeActivity(status.session, "native_harness.heartbeat", status.session.status === "completed" ? "idle" : "working", true).catch(() => undefined);
                 }
             }).catch(() => {
                 stop(session.session_id);
@@ -226,6 +239,8 @@ export function createCodexRuntimeBridgeController(input) {
             snapshotTimers.delete(sessionId);
         }
         lastPost.delete(sessionId);
+        nativeSequence.delete(sessionId);
+        nativeLastPostAt.delete(sessionId);
     }
     function cleanup() {
         for (const client of clients.values()) {
@@ -241,6 +256,8 @@ export function createCodexRuntimeBridgeController(input) {
         }
         bindTimers.clear();
         lastPost.clear();
+        nativeSequence.clear();
+        nativeLastPostAt.clear();
     }
     return {
         maybeStart,

package/dist/mcp/local-state/local-chat.js

@@ -78,7 +78,7 @@ function mapAttachmentRow(row) {
 function visibleMessageClause(includePromptOnly) {
     return includePromptOnly
         ? "1 = 1"
-        : "NOT (agent_prompt_kind = 'auto' AND TRIM(text) = '')";
+        : "(agent_prompt_kind IS NULL OR agent_prompt_kind <> 'auto' OR TRIM(text) <> '')";
 }
 function toMessage(row, replyTo, attachments = []) {
     return {

package/dist/mcp/rental-tools/context.js

@@ -28,6 +28,36 @@ export async function rentalReadFile(deps, input) {
         };
     }
 }
+/**
+ * File a context access request for a path outside the approved scope.
+ * The renter reviews it; once approved the file becomes readable via
+ * rental_read_file.
+ */
+export async function rentalRequestContext(deps, input) {
+    const sessionIdError = validateSessionId(input);
+    if (sessionIdError)
+        return { success: false, error: sessionIdError };
+    if (typeof input.path !== "string" || !input.path.trim()) {
+        return { success: false, error: "path is required" };
+    }
+    const body = { path: input.path.trim() };
+    if (typeof input.reason === "string" && input.reason.trim()) {
+        body.reason = input.reason.trim();
+    }
+    try {
+        return await deps.apiCall(`/api/rental/sessions/${encodeSessionId(input.session_id)}/context-requests`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        return {
+            success: false,
+            error: errorMessage(err),
+        };
+    }
+}
 export async function rentalSearch(deps, input) {
     const sessionIdError = validateSessionId(input);
     if (sessionIdError)

package/dist/mcp/server/runtime/agent-sessions.js

@@ -5,8 +5,13 @@ import { normalizeAgentBaseName } from "../../../shared/codenames.js";
 import { formatOwnerAttribution } from "../../../shared/agent-identity.js";
 import { LETAGENTS_AGENT_SESSION_ID_HEADER, LETAGENTS_AGENT_SESSION_TOKEN_HEADER, } from "../../../shared/request-headers.js";
 import { AGENT_INSTANCE_UUID, detectAgentIdeLabel, detectAgentRuntimeLabel, ensureAgentIdentity, } from "./identity.js";
+import { requireValidWorkerBearerRuntime } from "./worker-bearer.js";
+// A worker bearer already represents a server-side worker session. This local
+// marker lets the MCP tool contract stay session-shaped without persisting or
+// transmitting a second set of credentials.
+export const WORKER_BEARER_AGENT_SESSION_ID = "worker_bearer";
 export function buildAgentDeliveryHeaders(agentSession) {
-    if (!agentSession) {
+    if (!agentSession || requireValidWorkerBearerRuntime().mode === "worker") {
         return {};
     }
     return {
@@ -83,6 +88,37 @@ export function requireWorkerAgentSession(roomId, sessionId) {
     return session;
 }
 export async function resolveWorkerToolIdentity(input) {
+    if (requireValidWorkerBearerRuntime().mode === "worker" &&
+        (!input.agentSessionId || input.agentSessionId === WORKER_BEARER_AGENT_SESSION_ID)) {
+        const identity = await ensureAgentIdentity();
+        const now = new Date().toISOString();
+        return {
+            identity,
+            agentSession: {
+                session_id: WORKER_BEARER_AGENT_SESSION_ID,
+                session_token: "",
+                room_id: input.roomId ?? "worker_bearer_room",
+                session_kind: "worker",
+                runtime: detectAgentRuntimeLabel(),
+                host_id: null,
+                host_kind: null,
+                host_label: null,
+                liveness_capability: null,
+                tool_bridge_id: null,
+                actor_label: identity.actor_label,
+                agent_key: identity.canonical_key ?? identity.runtime_key ?? identity.actor_label,
+                agent_instance_id: AGENT_INSTANCE_UUID,
+                display_name: identity.display_name,
+                owner_label: identity.owner_label,
+                ide_label: identity.ide_label ?? detectAgentIdeLabel(),
+                repo_branch: null,
+                created_at: now,
+                updated_at: now,
+                last_seen_at: now,
+                ended_at: null,
+            },
+        };
+    }
     const agentSession = input.agentSessionId
         ? requireWorkerAgentSession(input.roomId, input.agentSessionId)
         : input.roomId && await isLocalRoomStorageEnabled(input.roomId)
@@ -127,6 +163,9 @@ export function getAgentSessionRepoBranch(cwd) {
     return getGitCurrentBranch(workingDir);
 }
 export function agentSessionCredentials(agentSession) {
+    if (requireValidWorkerBearerRuntime().mode === "worker") {
+        return {};
+    }
     return {
         agent_session_id: agentSession.session_id,
         agent_session_token: agentSession.session_token,

package/dist/mcp/server/runtime/api.js

@@ -1,5 +1,9 @@
-import { clearStoredAuth, getStoredAuth, } from "../../local-state.js";
 import { clearAuthenticatedAccountCache } from "./auth-cache.js";
+import { requireValidWorkerBearerRuntime } from "./worker-bearer.js";
+let ownerAuthStoreLoader = () => import("../../local-state.js");
+export function setOwnerAuthStoreLoaderForTest(loader) {
+    ownerAuthStoreLoader = loader ?? (() => import("../../local-state.js"));
+}
 export const API_URL = (process.env.LETAGENTS_API_URL || "http://localhost:3001").replace(/\/+$/, "");
 export class ApiError extends Error {
     status;
@@ -11,11 +15,20 @@ export class ApiError extends Error {
         this.body = body;
     }
 }
-export function getLetagentsToken() {
-    return process.env.LETAGENTS_TOKEN || getStoredAuth()?.token || "";
+export async function getLetagentsToken() {
+    const runtime = requireValidWorkerBearerRuntime();
+    if (runtime.mode === "worker") {
+        return runtime.bearer;
+    }
+    const envToken = process.env.LETAGENTS_TOKEN?.trim();
+    if (envToken) {
+        return envToken;
+    }
+    const { getStoredAuth } = await ownerAuthStoreLoader();
+    return getStoredAuth()?.token || "";
 }
-export function getAuthorizationHeader() {
-    const letagentsToken = getLetagentsToken();
+export async function getAuthorizationHeader() {
+    const letagentsToken = await getLetagentsToken();
     return letagentsToken ? `Bearer ${letagentsToken}` : null;
 }
 export function isMissingRouteError(error) {
@@ -52,13 +65,21 @@ export function resolveApiPath(urlOrPath) {
     }
 }
 export async function apiCall(path, options) {
-    const headers = {
-        "Content-Type": "application/json",
-        ...options?.headers,
-    };
-    const authorizationHeader = getAuthorizationHeader();
-    if (authorizationHeader && !headers.Authorization) {
-        headers.Authorization = authorizationHeader;
+    const headers = new Headers(options?.headers);
+    if (!headers.has("Content-Type")) {
+        headers.set("Content-Type", "application/json");
+    }
+    const runtime = requireValidWorkerBearerRuntime();
+    if (runtime.mode === "worker") {
+        // The bearer is the complete worker credential. Normalize headers first so
+        // every caller spelling of Authorization is overwritten.
+        headers.set("Authorization", `Bearer ${runtime.bearer}`);
+    }
+    else {
+        const authorizationHeader = await getAuthorizationHeader();
+        if (authorizationHeader && !headers.has("Authorization")) {
+            headers.set("Authorization", authorizationHeader);
+        }
     }
     const res = await fetch(`${API_URL}${path}`, {
         ...options,
@@ -66,9 +87,10 @@ export async function apiCall(path, options) {
     });
     if (!res.ok) {
         const body = await res.text();
-        if (res.status === 401) {
+        if (res.status === 401 && requireValidWorkerBearerRuntime().mode !== "worker") {
             // Only clear on 401 (invalid/expired credential), NOT on 403
             // (valid credential but insufficient permissions, e.g., private repo access)
+            const { clearStoredAuth } = await ownerAuthStoreLoader();
             clearStoredAuth();
             clearAuthenticatedAccountCache();
         }

package/dist/mcp/server/runtime/identity/directory.js

@@ -1,10 +1,13 @@
 import { userInfo } from "os";
-import { getStoredAuth, } from "../../../local-state.js";
 import { normalizeSlugSegment } from "../../../../shared/codenames.js";
 import { apiCall, getLetagentsToken, } from "../api.js";
+import { requireValidWorkerBearerRuntime } from "../worker-bearer.js";
 import { getAuthenticatedAccountCache, setAuthenticatedAccountCache, } from "../auth-cache.js";
 import { AGENT_OWNER_LABEL, readCommandOutput, } from "./config.js";
 export async function getAuthenticatedAgentDirectory() {
+    if (requireValidWorkerBearerRuntime().mode === "worker") {
+        return null;
+    }
     try {
         const result = await apiCall("/agents/me");
         const account = result?.account;
@@ -22,6 +25,9 @@ export async function getAuthenticatedAgentDirectory() {
     }
 }
 async function getAuthenticatedAccountProfile() {
+    if (requireValidWorkerBearerRuntime().mode === "worker") {
+        return null;
+    }
     const envToken = (process.env.LETAGENTS_TOKEN || "").trim();
     const cache = getAuthenticatedAccountCache();
     if (envToken) {
@@ -33,12 +39,13 @@ async function getAuthenticatedAccountProfile() {
         const directory = await getAuthenticatedAgentDirectory();
         return directory?.account?.login?.trim() ? directory.account : null;
     }
+    const { getStoredAuth } = await import("../../../local-state.js");
     const storedAccount = getStoredAuth()?.account;
     if (storedAccount?.login?.trim()) {
         setAuthenticatedAccountCache(storedAccount, "stored", null);
         return storedAccount;
     }
-    if (!getLetagentsToken()) {
+    if (!await getLetagentsToken()) {
         setAuthenticatedAccountCache(undefined, null, null);
         return null;
     }

package/dist/mcp/server/runtime/identity.js

@@ -1,5 +1,6 @@
 import { buildAgentActorLabel, formatOwnerAttribution, } from "../../../shared/agent-identity.js";
 import { apiCall, getLetagentsToken, } from "./api.js";
+import { requireValidWorkerBearerRuntime } from "./worker-bearer.js";
 import { detectAgentIdeLabel, detectAgentRuntimeLabel, } from "./identity/config.js";
 import { resolveOwnerContext } from "./identity/directory.js";
 import { getSessionLivenessRegistration } from "./identity/liveness.js";
@@ -9,7 +10,7 @@ import { currentAgentIdentity, currentAgentIdentityKey, ensureAgentIdentityKey,
 export { AGENT_INSTANCE_UUID, currentAgentIdentity, currentAgentIdentityKey, detectAgentIdeLabel, detectAgentRuntimeLabel, getConversationIdentity, getSessionLivenessRegistration, resolveOwnerContext, setConversationIdentity, storeCurrentAgentIdentity, toPublicAgentIdentity, };
 export async function ensureAgentIdentity() {
     const owner = await resolveOwnerContext();
-    const authAvailable = Boolean(getLetagentsToken());
+    const authAvailable = requireValidWorkerBearerRuntime().mode === "owner" && Boolean(await getLetagentsToken());
     const ideLabel = detectAgentIdeLabel();
     const identityKey = ensureAgentIdentityKey();
     const ownerAttribution = formatOwnerAttribution(owner.label);

package/dist/mcp/server/runtime/rooms.js

@@ -9,6 +9,7 @@ import { ensureAgentIdentity, toPublicAgentIdentity, withAgentIdentity, } from "
 import { withJoinRoomAgentPrompt } from "./messages.js";
 import { syncRoomPresence } from "./presence.js";
 import { rememberRoom, toPublicRoomResponse, toRoomState, } from "./room-state.js";
+import { requireValidWorkerBearerRuntime } from "./worker-bearer.js";
 export function normalizeJoinSessionMode(value) {
     return String(value || "").trim().toLowerCase() === "live" ? "live" : "current";
 }
@@ -253,8 +254,63 @@ export async function joinNamedRoom(name, sessionMode) {
         session_mode: sessionMode,
     });
 }
+function bindWorkerRoomFromContext() {
+    const configRoom = getRoomFromConfig();
+    if (configRoom) {
+        const gitContext = buildActiveGitRoomContext({
+            repoRoom: configRoom,
+            currentBranch: getGitCurrentBranch(),
+            defaultBranch: getGitDefaultBranch(),
+        });
+        const roomId = gitContext.activeRoom ?? configRoom;
+        return {
+            room: rememberRoom(toRoomState({
+                room_id: roomId,
+                display_name: roomId,
+                joined_via: "config",
+            })),
+            source: ".letagents.json",
+        };
+    }
+    const gitContext = getGitRoomContext();
+    if (gitContext.activeRoom) {
+        return {
+            room: rememberRoom(toRoomState({
+                room_id: gitContext.activeRoom,
+                display_name: gitContext.activeRoom,
+                joined_via: "git-remote",
+            })),
+            source: "git remote",
+        };
+    }
+    const savedCurrentRoom = getStoredCurrentRoom();
+    if (!savedCurrentRoom) {
+        return null;
+    }
+    return {
+        room: rememberRoom(toRoomState({
+            room_id: savedCurrentRoom.room_id,
+            project_id: savedCurrentRoom.project_id,
+            code: savedCurrentRoom.code,
+            display_name: savedCurrentRoom.display_name,
+            git_room: savedCurrentRoom.git_room,
+            joined_via: savedCurrentRoom.joined_via,
+        })),
+        source: "saved local room state",
+    };
+}
 export async function autoJoinFromContext() {
     try {
+        if (requireValidWorkerBearerRuntime().mode === "worker") {
+            const bound = bindWorkerRoomFromContext();
+            if (bound) {
+                console.error(`🏠 Bound worker bearer to room '${bound.room.room_id}' (from ${bound.source}; no join/create request).`);
+            }
+            else {
+                console.error("ℹ️ Worker bearer has no .letagents.json, git remote, or saved room to bind locally.");
+            }
+            return;
+        }
         const configRoom = getRoomFromConfig();
         if (configRoom) {
             const gitContext = buildActiveGitRoomContext({

package/dist/mcp/server/runtime/supervisor-bridge.js

@@ -0,0 +1,94 @@
+import { randomUUID } from "node:crypto";
+import { createConnection } from "node:net";
+const NEGOTIATION_PROTOCOL_VERSION = 1;
+const SUPPORTED_SUPERVISOR_PROTOCOL_VERSIONS = new Set([1, 2]);
+const DEFAULT_REQUEST_TIMEOUT_MS = 5_000;
+/** Bind the exact worker credential minted by registration to its daemon lane. */
+export async function bindSupervisedWorkerSession(session, env = process.env, options = {}) {
+    const entryId = env.LETAGENTS_SUPERVISOR_ENTRY_ID?.trim();
+    const socketPath = env.LETAGENTS_SUPERVISOR_DAEMON_SOCKET?.trim();
+    const workAttemptId = env.LETAGENTS_SUPERVISOR_WORK_ATTEMPT_ID?.trim();
+    const executionGenerationId = env.LETAGENTS_SUPERVISOR_EXECUTION_GENERATION_ID?.trim();
+    if (!entryId && !socketPath && !workAttemptId && !executionGenerationId)
+        return false;
+    if (!entryId || !socketPath || !workAttemptId || !executionGenerationId)
+        throw new Error("Supervised worker bridge environment is incomplete.");
+    if (session.session_kind !== "worker")
+        throw new Error("A supervised provider must register a worker session.");
+    const timeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1)
+        throw new Error("Supervisor bridge timeout must be a positive integer.");
+    const negotiation = await supervisorRequest(socketPath, {
+        version: NEGOTIATION_PROTOCOL_VERSION,
+        id: randomUUID(),
+        method: "daemon.negotiate",
+    }, timeoutMs);
+    if (!negotiation.ok)
+        throw new Error(negotiation.error || "Supervisor protocol negotiation failed.");
+    const protocolVersion = negotiationProtocolVersion(negotiation.result);
+    if (negotiation.version !== protocolVersion)
+        throw new Error("Supervisor negotiation response version does not match its negotiated protocol.");
+    const response = await supervisorRequest(socketPath, {
+        version: protocolVersion,
+        id: randomUUID(),
+        method: "supervisor.bind_worker_session",
+        params: {
+            entry_id: entryId,
+            room_id: session.room_id,
+            work_attempt_id: workAttemptId,
+            execution_generation_id: executionGenerationId,
+            agent_session_id: session.session_id,
+            agent_session_token: session.session_token,
+            api_url: env.LETAGENTS_API_URL?.trim() || "https://letagents.chat",
+        },
+    }, timeoutMs);
+    if (!response.ok)
+        throw new Error(response.error || "Supervisor rejected the worker session binding.");
+    if (response.version !== protocolVersion)
+        throw new Error("Supervisor binding response used an unexpected protocol version.");
+    return true;
+}
+function negotiationProtocolVersion(result) {
+    if (!result || typeof result !== "object")
+        throw new Error("Supervisor protocol negotiation returned a malformed result.");
+    const protocolVersion = result.protocol_version;
+    if (typeof protocolVersion !== "number" || !Number.isSafeInteger(protocolVersion)
+        || !SUPPORTED_SUPERVISOR_PROTOCOL_VERSIONS.has(protocolVersion)) {
+        throw new Error(`Supervisor protocol negotiation returned unsupported version ${String(protocolVersion)}.`);
+    }
+    return protocolVersion;
+}
+function supervisorRequest(socketPath, request, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const socket = createConnection(socketPath);
+        let buffer = "";
+        const timer = setTimeout(() => {
+            socket.destroy();
+            reject(new Error("Timed out communicating with the supervisor daemon."));
+        }, timeoutMs);
+        timer.unref();
+        const finish = (operation) => {
+            clearTimeout(timer);
+            operation();
+        };
+        socket.setEncoding("utf8");
+        socket.once("error", (error) => finish(() => reject(error)));
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            const newline = buffer.indexOf("\n");
+            if (newline < 0)
+                return;
+            socket.end();
+            try {
+                const response = JSON.parse(buffer.slice(0, newline));
+                finish(() => response.id === request.id
+                    ? resolve(response)
+                    : reject(new Error("Supervisor response id does not match its request.")));
+            }
+            catch (error) {
+                finish(() => reject(error));
+            }
+        });
+        socket.once("connect", () => socket.write(`${JSON.stringify(request)}\n`));
+    });
+}

package/dist/mcp/server/runtime/worker-bearer.js

@@ -0,0 +1,67 @@
+export const LETAGENTS_AGENT_SESSION_BEARER_ENV = "LETAGENTS_AGENT_SESSION_BEARER";
+export class WorkerBearerRuntimeConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WorkerBearerRuntimeConfigurationError";
+    }
+}
+export function getWorkerBearerRuntime() {
+    const bearer = process.env.LETAGENTS_AGENT_SESSION_BEARER?.trim();
+    if (!bearer) {
+        return { mode: "owner" };
+    }
+    const apiUrl = process.env.LETAGENTS_API_URL?.trim();
+    if (!apiUrl) {
+        return {
+            mode: "invalid",
+            error: "Worker bearer mode requires an explicit LETAGENTS_API_URL.",
+        };
+    }
+    try {
+        const parsed = new URL(apiUrl);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("unsupported protocol");
+        }
+        const loopbackHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+        if (parsed.protocol === "http:" && !loopbackHosts.has(parsed.hostname.toLowerCase())) {
+            return {
+                mode: "invalid",
+                error: "Worker bearer mode requires HTTPS unless LETAGENTS_API_URL uses an exact loopback host.",
+            };
+        }
+    }
+    catch {
+        return {
+            mode: "invalid",
+            error: "Worker bearer mode requires LETAGENTS_API_URL to be a valid HTTP(S) URL.",
+        };
+    }
+    if (process.env.LETAGENTS_TOKEN?.trim()) {
+        return {
+            mode: "invalid",
+            error: "Worker bearer mode refuses LETAGENTS_TOKEN. Remove the owner token from this process before starting the worker.",
+        };
+    }
+    return { mode: "worker", bearer };
+}
+export function requireValidWorkerBearerRuntime() {
+    const runtime = getWorkerBearerRuntime();
+    if (runtime.mode === "invalid") {
+        throw new WorkerBearerRuntimeConfigurationError(runtime.error);
+    }
+    return runtime;
+}
+export function workerModeDisabledToolResult(toolDescription = "This owner-auth onboarding tool") {
+    const runtime = getWorkerBearerRuntime();
+    if (runtime.mode === "invalid") {
+        return { success: false, error: "worker_bearer_configuration_invalid", message: runtime.error };
+    }
+    if (runtime.mode === "worker") {
+        return {
+            success: false,
+            error: "worker_bearer_mode",
+            message: `${toolDescription} is disabled while LETAGENTS_AGENT_SESSION_BEARER is configured.`,
+        };
+    }
+    return null;
+}

package/dist/mcp/server/runtime.js

@@ -5,7 +5,7 @@ export { API_URL, ApiError, apiCall, getAuthorizationHeader, getLetagentsToken,
 export { clearAuthenticatedAccountCache, getAuthenticatedAccountCache, setAuthenticatedAccountCache, } from "./runtime/auth-cache.js";
 export { RepoRoomAuthRequiredError, maybeHandleRepoRoomAuthRequired, startPendingDeviceAuth, toRepoRoomAuthRequiredResult, } from "./runtime/device-auth.js";
 export { AGENT_INSTANCE_UUID, currentAgentIdentity, currentAgentIdentityKey, detectAgentIdeLabel, detectAgentRuntimeLabel, ensureAgentIdentity, getConversationIdentity, getSessionLivenessRegistration, resolveOwnerContext, setConversationIdentity, storeCurrentAgentIdentity, toPublicAgentIdentity, withAgentIdentity, } from "./runtime/identity.js";
-export { agentSessionCredentials, buildAgentDeliveryHeaders, ensureLocalWorkerAgentSession, getAgentSessionRepoBranch, identityFromAgentSession, requireWorkerAgentSession, resolveAgentSession, resolveWorkerToolIdentity, toPublicAgentSession, } from "./runtime/agent-sessions.js";
+export { agentSessionCredentials, buildAgentDeliveryHeaders, ensureLocalWorkerAgentSession, getAgentSessionRepoBranch, identityFromAgentSession, requireWorkerAgentSession, resolveAgentSession, resolveWorkerToolIdentity, toPublicAgentSession, WORKER_BEARER_AGENT_SESSION_ID, } from "./runtime/agent-sessions.js";
 export { appendIncludePromptOnly, getLastMessageId, normalizeOptionalToolString, toAgentReadableMessages, withJoinRoomAgentPrompt, } from "./runtime/messages.js";
 export { currentRoom, attachMcpServer, getFallbackProjectId, getTargetRoomId, rememberRoom, shutdownRuntime, toPublicRoomResponse, toPublicRoomState, toPublicStoredRoomSession, toRoomState, touchCurrentRoom, withCanonicalRoomLink, } from "./runtime/room-state.js";
 export { getRememberedRoomPresence, heartbeatRoomPresence, syncRoomPresence, } from "./runtime/presence.js";