letagents 0.12.10 → 0.12.12

package/README.md

@@ -143,6 +143,8 @@ The API runs at `http://localhost:3001`. Point `LETAGENTS_API_URL` at your serve
 
 Optional — **long room long-polls** (multi-hour `wait_for_messages` / `GET …/messages/poll`): set the **same** `LETAGENTS_POLL_MAX_MS` on **both** the API process and any MCP client you run from source (milliseconds; default `180000`).
 
+Optional — **visible worker-channel warning grace**: set `LETAGENTS_LIVENESS_NOTICE_AFTER_MS` on the API process (milliseconds; default `300000`, or 5 minutes). Internal transport staleness remains 2 minutes for routing and diagnostics; this setting controls only when the room sees the softer “message channel unreachable” notice.
+
 The API now uses PostgreSQL with Drizzle ORM. `DB_URL` must be set before starting the server or running migrations.
 
 Useful database commands:

package/dist/api/board-intent-payloads.js

@@ -0,0 +1,25 @@
+export function boardIntentPayloadForTaskCreate(input) {
+    return {
+        title: input.title.trim(),
+        description: input.description?.trim() || null,
+        source_message_id: input.sourceMessageId?.trim() || null,
+    };
+}
+export function boardIntentPayloadForTaskMutation(input) {
+    return {
+        task_id: input.taskId,
+        status: input.status ?? null,
+        assignee: input.assignee ?? null,
+        assignee_agent_key: input.assigneeAgentKey ?? null,
+        pr_url: input.prUrl ?? null,
+    };
+}
+export function boardIntentPayloadForLeaseAction(input) {
+    return {
+        task_id: input.taskId,
+        action: input.action,
+        lease_id: input.leaseId ?? null,
+        target_actor_key: input.targetActorKey ?? null,
+        target_agent_session_id: input.targetAgentSessionId ?? null,
+    };
+}

package/dist/mcp/codex-session/runtime-bridge.js

@@ -1,5 +1,7 @@
-import { getCurrentCodexLiveSession, getStoredAuth, getStoredCodexLiveSession, readLocalState, updateCodexLiveSession, } from "../local-state.js";
+import { getCurrentCodexLiveSession, getStoredCodexLiveSession, readLocalState, updateCodexLiveSession, } from "../local-state.js";
 import { encodeRoomIdPath } from "../room-id.js";
+import { apiCall } from "../server/runtime/api.js";
+import { agentSessionCredentials } from "../server/runtime/agent-sessions.js";
 import { RpcClient } from "./rpc-client.js";
 import { isCodexAgentSessionMarker, summarizeCodexRuntimeNotificationForTest, } from "./runtime-summary.js";
 const CODEX_RUNTIME_STREAM_THROTTLE_MS = 750;
@@ -7,35 +9,16 @@ const CODEX_RUNTIME_STREAM_REPEAT_MS = 30_000;
 const CODEX_RUNTIME_STREAM_SNAPSHOT_INTERVAL_MS = 2_000;
 const CODEX_RUNTIME_STREAM_BIND_RETRY_MS = 1_000;
 const CODEX_RUNTIME_STREAM_BIND_RETRY_ATTEMPTS = 30;
+const CODEX_NATIVE_HEARTBEAT_INTERVAL_MS = 15_000;
 export function createCodexRuntimeBridgeController(input) {
     const clients = new Map();
     const snapshotTimers = new Map();
     const bindTimers = new Map();
     const lastPost = new Map();
-    function apiUrl() {
-        return (process.env.LETAGENTS_API_URL || "http://localhost:3001").replace(/\/+$/, "");
-    }
-    function authorizationHeader() {
-        const token = process.env.LETAGENTS_TOKEN || getStoredAuth()?.token || "";
-        return token ? `Bearer ${token}` : null;
-    }
+    const nativeSequence = new Map();
+    const nativeLastPostAt = new Map();
     async function codexBridgeApiCall(path, options) {
-        const headers = {
-            "Content-Type": "application/json",
-            ...options?.headers,
-        };
-        const authorization = authorizationHeader();
-        if (authorization && !headers.Authorization) {
-            headers.Authorization = authorization;
-        }
-        const response = await fetch(`${apiUrl()}${path}`, {
-            ...options,
-            headers,
-        });
-        if (!response.ok) {
-            throw new Error(`LetAgents API ${response.status}: ${await response.text()}`);
-        }
-        return (await response.json());
+        return apiCall(path, options);
     }
     function codexWorkerSessionsForRoom(roomId) {
         const state = readLocalState();
@@ -129,7 +112,32 @@ export function createCodexRuntimeBridgeController(input) {
         }
     }
     async function postReasoningUpdate(session, notification) {
-        await postReasoningSummary(session, summarizeCodexRuntimeNotificationForTest(notification));
+        const summary = summarizeCodexRuntimeNotificationForTest(notification);
+        await Promise.all([
+            postReasoningSummary(session, summary),
+            postNativeActivity(session, notification.method, summary.status),
+        ]);
+    }
+    async function postNativeActivity(session, method, status, force = false) {
+        const workerSession = codexWorkerSessionForLiveSession(session);
+        if (!workerSession)
+            return;
+        const now = Date.now();
+        if (!force && now - (nativeLastPostAt.get(session.session_id) ?? 0) < CODEX_RUNTIME_STREAM_THROTTLE_MS)
+            return;
+        nativeLastPostAt.set(session.session_id, now);
+        const sequence = (nativeSequence.get(session.session_id) ?? 0) + 1;
+        nativeSequence.set(session.session_id, sequence);
+        await codexBridgeApiCall(`/rooms/${encodeRoomIdPath(session.room_id)}/agent-sessions/${encodeURIComponent(workerSession.session_id)}/native-activity`, {
+            method: "POST",
+            body: JSON.stringify({
+                ...agentSessionCredentials(workerSession),
+                observed_at: new Date(now).toISOString(),
+                sequence,
+                method,
+                status,
+            }),
+        });
     }
     function start(session, client) {
         stop(session.session_id);
@@ -143,6 +151,11 @@ export function createCodexRuntimeBridgeController(input) {
                     !status.server_reachable ||
                     input.isTerminalStatus(status.session.status)) {
                     stop(session.session_id);
+                    return;
+                }
+                const now = Date.now();
+                if (now - (nativeLastPostAt.get(session.session_id) ?? 0) >= CODEX_NATIVE_HEARTBEAT_INTERVAL_MS) {
+                    void postNativeActivity(status.session, "native_harness.heartbeat", status.session.status === "completed" ? "idle" : "working", true).catch(() => undefined);
                 }
             }).catch(() => {
                 stop(session.session_id);
@@ -226,6 +239,8 @@ export function createCodexRuntimeBridgeController(input) {
             snapshotTimers.delete(sessionId);
         }
         lastPost.delete(sessionId);
+        nativeSequence.delete(sessionId);
+        nativeLastPostAt.delete(sessionId);
     }
     function cleanup() {
         for (const client of clients.values()) {
@@ -241,6 +256,8 @@ export function createCodexRuntimeBridgeController(input) {
         }
         bindTimers.clear();
         lastPost.clear();
+        nativeSequence.clear();
+        nativeLastPostAt.clear();
     }
     return {
         maybeStart,

package/dist/mcp/local-state/agent-sessions.js

@@ -26,6 +26,21 @@ export function getCurrentAgentSession(roomId) {
     }
     return best;
 }
+/**
+ * Every stored session (active or ended) this identity had in the room,
+ * most recently updated first. Re-registration consults the FULL lineage so a
+ * replayed prior label reuses the base recorded when that exact label was
+ * allocated — a latest-only lookup would lose an older concurrent sibling's
+ * base and misread its restart as a deliberate rename.
+ */
+export function getStoredAgentSessionsForRoomIdentity(roomId, agentKey) {
+    if (!roomId || !agentKey)
+        return [];
+    const state = readLocalState();
+    return Object.values(state.agent_sessions ?? {})
+        .filter((session) => session.room_id === roomId && session.agent_key === agentKey)
+        .sort((left, right) => right.updated_at.localeCompare(left.updated_at));
+}
 export function saveAgentSession(session, makeCurrent = true) {
     updateLocalState((state) => {
         state.agent_sessions = state.agent_sessions ?? {};

package/dist/mcp/local-state/local-chat.js

@@ -78,7 +78,7 @@ function mapAttachmentRow(row) {
 function visibleMessageClause(includePromptOnly) {
     return includePromptOnly
         ? "1 = 1"
-        : "NOT (agent_prompt_kind = 'auto' AND TRIM(text) = '')";
+        : "(agent_prompt_kind IS NULL OR agent_prompt_kind <> 'auto' OR TRIM(text) <> '')";
 }
 function toMessage(row, replyTo, attachments = []) {
     return {

package/dist/mcp/rental-tools/context.js

@@ -28,6 +28,36 @@ export async function rentalReadFile(deps, input) {
         };
     }
 }
+/**
+ * File a context access request for a path outside the approved scope.
+ * The renter reviews it; once approved the file becomes readable via
+ * rental_read_file.
+ */
+export async function rentalRequestContext(deps, input) {
+    const sessionIdError = validateSessionId(input);
+    if (sessionIdError)
+        return { success: false, error: sessionIdError };
+    if (typeof input.path !== "string" || !input.path.trim()) {
+        return { success: false, error: "path is required" };
+    }
+    const body = { path: input.path.trim() };
+    if (typeof input.reason === "string" && input.reason.trim()) {
+        body.reason = input.reason.trim();
+    }
+    try {
+        return await deps.apiCall(`/api/rental/sessions/${encodeSessionId(input.session_id)}/context-requests`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        return {
+            success: false,
+            error: errorMessage(err),
+        };
+    }
+}
 export async function rentalSearch(deps, input) {
     const sessionIdError = validateSessionId(input);
     if (sessionIdError)

package/dist/mcp/server/register-tools.js

@@ -4,16 +4,27 @@ import { registerOnboardingTools } from "./tools/onboarding.js";
 import { registerRentalTools } from "./tools/rental.js";
 import { registerRepoInitializationTool, registerRepoVisibilityTool, registerRoomInspectionTools, registerRoomJoinTools, registerRoomResumeTool, } from "./tools/rooms.js";
 import { registerTaskTools } from "./tools/tasks.js";
-export function registerTools(server) {
-    registerRoomJoinTools(server);
-    registerAgentSessionTools(server);
-    registerRoomInspectionTools(server);
-    registerStatusTools(server);
-    registerTaskTools(server);
-    registerRepoInitializationTool(server);
-    registerMessageTools(server);
-    registerOnboardingTools(server);
-    registerRoomResumeTool(server);
-    registerRentalTools(server);
-    registerRepoVisibilityTool(server);
+import { registerSupervisedRoomTurnTools } from "./tools/supervised-room-turn.js";
+import { toolSurfaceForExecutionProfile } from "./runtime/tool-surface-policy.js";
+import { profileAwareToolServer } from "./supervised-tool-facade.js";
+export function registerTools(server, profile = "autonomous_mcp_worker", supervisedProvider = process.env.LETAGENTS_SUPERVISOR_PROVIDER?.trim() || null) {
+    const tools = profileAwareToolServer(server, profile, undefined, supervisedProvider);
+    const surface = toolSurfaceForExecutionProfile(profile);
+    registerRoomJoinTools(tools);
+    if (surface.agentSessionLifecycle)
+        registerAgentSessionTools(tools);
+    registerRoomInspectionTools(tools);
+    registerStatusTools(tools);
+    registerTaskTools(tools);
+    registerRepoInitializationTool(tools);
+    registerMessageTools(tools, { includeDeliveryLoop: surface.deliveryLoop });
+    if (profile === "supervised_room_turn" && supervisedProvider === "cursor")
+        registerSupervisedRoomTurnTools(tools);
+    if (surface.onboarding)
+        registerOnboardingTools(tools);
+    if (surface.roomResume)
+        registerRoomResumeTool(tools);
+    if (surface.rental)
+        registerRentalTools(tools);
+    registerRepoVisibilityTool(tools);
 }

package/dist/mcp/server/runtime/agent-sessions.js

@@ -5,8 +5,15 @@ import { normalizeAgentBaseName } from "../../../shared/codenames.js";
 import { formatOwnerAttribution } from "../../../shared/agent-identity.js";
 import { LETAGENTS_AGENT_SESSION_ID_HEADER, LETAGENTS_AGENT_SESSION_TOKEN_HEADER, } from "../../../shared/request-headers.js";
 import { AGENT_INSTANCE_UUID, detectAgentIdeLabel, detectAgentRuntimeLabel, ensureAgentIdentity, } from "./identity.js";
+import { isSupervisedBoundedTurn, requireValidWorkerBearerRuntime } from "./worker-bearer.js";
+import { resolveCurrentSupervisedWorkerSession } from "./supervisor-bridge.js";
+// A worker bearer already represents a server-side worker session. This local
+// marker lets the MCP tool contract stay session-shaped without persisting or
+// transmitting a second set of credentials.
+export const WORKER_BEARER_AGENT_SESSION_ID = "worker_bearer";
 export function buildAgentDeliveryHeaders(agentSession) {
-    if (!agentSession) {
+    const runtime = requireValidWorkerBearerRuntime();
+    if (!agentSession || runtime.mode === "worker" || runtime.mode === "supervised") {
         return {};
     }
     return {
@@ -57,6 +64,33 @@ export function resolveAgentSession(roomId, sessionId) {
     }
     return session;
 }
+/**
+ * The stable base this client declares as `requested_base_display_name` when
+ * registering. Rules (task_66):
+ * - An explicit display_name that replays the EXACT label of any prior stored
+ *   session for this room+identity is a resume, not a rename: reuse the base
+ *   recorded when THAT label was allocated, so a server-decorated label
+ *   converges. The whole lineage is consulted (most recent first) because a
+ *   latest-only lookup would lose an older concurrent sibling's base and
+ *   misread its restart as a deliberate rename.
+ * - Any other explicit display_name is deliberate intent and IS the base —
+ *   a numeric-ending custom name ("Agent 47") is therefore never demoted.
+ * - With no explicit name, fall back to the most recent recorded base in the
+ *   lineage, then to the durable identity's display name.
+ */
+export function resolveClientRequestedBase(input) {
+    const explicit = input.explicitDisplayName?.trim() || "";
+    const lineage = input.priorSessions ?? [];
+    if (explicit) {
+        const replayed = lineage.find((session) => session.display_name?.trim() === explicit);
+        const replayedBase = replayed?.requested_base_display_name?.trim() || "";
+        return replayedBase || explicit;
+    }
+    const latestBase = lineage
+        .map((session) => session.requested_base_display_name?.trim() || "")
+        .find((base) => base.length > 0);
+    return latestBase || input.identityDisplayName.trim();
+}
 export function identityFromAgentSession(session) {
     return {
         name: normalizeAgentBaseName(session.display_name),
@@ -83,9 +117,50 @@ export function requireWorkerAgentSession(roomId, sessionId) {
     return session;
 }
 export async function resolveWorkerToolIdentity(input) {
+    const runtimeMode = requireValidWorkerBearerRuntime().mode;
+    if (runtimeMode === "supervised") {
+        const agentSession = await resolveCurrentSupervisedWorkerSession(input.roomId);
+        if (input.agentSessionId
+            && input.agentSessionId !== WORKER_BEARER_AGENT_SESSION_ID
+            && input.agentSessionId !== agentSession.session_id) {
+            throw new Error(`Daemon-supervised worker session is ${agentSession.session_id}, not ${input.agentSessionId}.`);
+        }
+        return { identity: identityFromAgentSession(agentSession), agentSession };
+    }
+    if (runtimeMode === "worker" &&
+        (!input.agentSessionId || input.agentSessionId === WORKER_BEARER_AGENT_SESSION_ID)) {
+        const identity = await ensureAgentIdentity();
+        const now = new Date().toISOString();
+        return {
+            identity,
+            agentSession: {
+                session_id: WORKER_BEARER_AGENT_SESSION_ID,
+                session_token: "",
+                room_id: input.roomId ?? "worker_bearer_room",
+                session_kind: "worker",
+                runtime: detectAgentRuntimeLabel(),
+                host_id: null,
+                host_kind: null,
+                host_label: null,
+                liveness_capability: null,
+                tool_bridge_id: null,
+                actor_label: identity.actor_label,
+                agent_key: identity.canonical_key ?? identity.runtime_key ?? identity.actor_label,
+                agent_instance_id: AGENT_INSTANCE_UUID,
+                display_name: identity.display_name,
+                owner_label: identity.owner_label,
+                ide_label: identity.ide_label ?? detectAgentIdeLabel(),
+                repo_branch: null,
+                created_at: now,
+                updated_at: now,
+                last_seen_at: now,
+                ended_at: null,
+            },
+        };
+    }
     const agentSession = input.agentSessionId
         ? requireWorkerAgentSession(input.roomId, input.agentSessionId)
-        : input.roomId && await isLocalRoomStorageEnabled(input.roomId)
+        : input.roomId && !isSupervisedBoundedTurn() && await isLocalRoomStorageEnabled(input.roomId)
             ? await ensureLocalWorkerAgentSession(input.roomId)
             : requireWorkerAgentSession(input.roomId, input.agentSessionId);
     return {
@@ -127,6 +202,10 @@ export function getAgentSessionRepoBranch(cwd) {
     return getGitCurrentBranch(workingDir);
 }
 export function agentSessionCredentials(agentSession) {
+    const runtime = requireValidWorkerBearerRuntime();
+    if (runtime.mode === "worker" || runtime.mode === "supervised") {
+        return {};
+    }
     return {
         agent_session_id: agentSession.session_id,
         agent_session_token: agentSession.session_token,

package/dist/mcp/server/runtime/api.js

@@ -1,5 +1,30 @@
-import { clearStoredAuth, getStoredAuth, } from "../../local-state.js";
 import { clearAuthenticatedAccountCache } from "./auth-cache.js";
+import { requireValidWorkerBearerRuntime } from "./worker-bearer.js";
+import { borrowCurrentSupervisedWorkerCredential, } from "./supervisor-bridge.js";
+let ownerAuthStoreLoader = () => import("../../local-state.js");
+let supervisedCredentialBorrower = () => borrowCurrentSupervisedWorkerCredential();
+export function setOwnerAuthStoreLoaderForTest(loader) {
+    ownerAuthStoreLoader = loader ?? (() => import("../../local-state.js"));
+}
+export function setSupervisedCredentialBorrowerForTest(borrower) {
+    supervisedCredentialBorrower = borrower ?? (() => borrowCurrentSupervisedWorkerCredential());
+}
+export class SupervisedWorkerCredentialError extends Error {
+    code;
+    constructor(code) {
+        super(code === "SUPERVISED_CREDENTIAL_UNAVAILABLE"
+            ? "The daemon-supervised worker credential is not available yet."
+            : "The daemon-supervised worker credential is stale or missing its exact context.");
+        this.code = code;
+        this.name = "SupervisedWorkerCredentialError";
+    }
+}
+async function getSupervisedCredential() {
+    const result = await supervisedCredentialBorrower();
+    if (result.state === "available")
+        return result.credential;
+    throw new SupervisedWorkerCredentialError(result.state === "deferred" ? "SUPERVISED_CREDENTIAL_UNAVAILABLE" : "SUPERVISED_CREDENTIAL_STALE");
+}
 export const API_URL = (process.env.LETAGENTS_API_URL || "http://localhost:3001").replace(/\/+$/, "");
 export class ApiError extends Error {
     status;
@@ -11,11 +36,22 @@ export class ApiError extends Error {
         this.body = body;
     }
 }
-export function getLetagentsToken() {
-    return process.env.LETAGENTS_TOKEN || getStoredAuth()?.token || "";
+export async function getLetagentsToken() {
+    const runtime = requireValidWorkerBearerRuntime();
+    if (runtime.mode === "worker") {
+        return runtime.bearer;
+    }
+    if (runtime.mode === "supervised")
+        return getSupervisedCredential();
+    const envToken = process.env.LETAGENTS_TOKEN?.trim();
+    if (envToken) {
+        return envToken;
+    }
+    const { getStoredAuth } = await ownerAuthStoreLoader();
+    return getStoredAuth()?.token || "";
 }
-export function getAuthorizationHeader() {
-    const letagentsToken = getLetagentsToken();
+export async function getAuthorizationHeader() {
+    const letagentsToken = await getLetagentsToken();
     return letagentsToken ? `Bearer ${letagentsToken}` : null;
 }
 export function isMissingRouteError(error) {
@@ -52,13 +88,26 @@ export function resolveApiPath(urlOrPath) {
     }
 }
 export async function apiCall(path, options) {
-    const headers = {
-        "Content-Type": "application/json",
-        ...options?.headers,
-    };
-    const authorizationHeader = getAuthorizationHeader();
-    if (authorizationHeader && !headers.Authorization) {
-        headers.Authorization = authorizationHeader;
+    const headers = new Headers(options?.headers);
+    if (!headers.has("Content-Type")) {
+        headers.set("Content-Type", "application/json");
+    }
+    const runtime = requireValidWorkerBearerRuntime();
+    if (runtime.mode === "worker") {
+        // The bearer is the complete worker credential. Normalize headers first so
+        // every caller spelling of Authorization is overwritten.
+        headers.set("Authorization", `Bearer ${runtime.bearer}`);
+    }
+    else if (runtime.mode === "supervised") {
+        // Resolve on every API request: the daemon may rotate the in-memory
+        // credential while Codex remains running.
+        headers.set("Authorization", `Bearer ${await getSupervisedCredential()}`);
+    }
+    else {
+        const authorizationHeader = await getAuthorizationHeader();
+        if (authorizationHeader && !headers.has("Authorization")) {
+            headers.set("Authorization", authorizationHeader);
+        }
     }
     const res = await fetch(`${API_URL}${path}`, {
         ...options,
@@ -66,9 +115,10 @@ export async function apiCall(path, options) {
     });
     if (!res.ok) {
         const body = await res.text();
-        if (res.status === 401) {
+        if (res.status === 401 && requireValidWorkerBearerRuntime().mode === "owner") {
             // Only clear on 401 (invalid/expired credential), NOT on 403
             // (valid credential but insufficient permissions, e.g., private repo access)
+            const { clearStoredAuth } = await ownerAuthStoreLoader();
             clearStoredAuth();
             clearAuthenticatedAccountCache();
         }

package/dist/mcp/server/runtime/execution-profile.js

@@ -0,0 +1,19 @@
+export const EXECUTION_PROFILES = [
+    "supervised_room_turn",
+    "autonomous_mcp_worker",
+    "interactive_desktop",
+];
+export const LETAGENTS_EXECUTION_PROFILE_ENV = "LETAGENTS_EXECUTION_PROFILE";
+export const LETAGENTS_SUPERVISED_BOUNDED_TURNS_ENV = "LETAGENTS_SUPERVISED_BOUNDED_TURNS";
+export function executionProfile(env = process.env) {
+    const configured = env[LETAGENTS_EXECUTION_PROFILE_ENV]?.trim();
+    const bounded = env[LETAGENTS_SUPERVISED_BOUNDED_TURNS_ENV]?.trim() === "1";
+    if (configured && !EXECUTION_PROFILES.includes(configured)) {
+        throw new Error(`Invalid ${LETAGENTS_EXECUTION_PROFILE_ENV}: ${configured}`);
+    }
+    const profile = (configured || "autonomous_mcp_worker");
+    if (bounded !== (profile === "supervised_room_turn")) {
+        throw new Error(`${LETAGENTS_EXECUTION_PROFILE_ENV}=supervised_room_turn and ${LETAGENTS_SUPERVISED_BOUNDED_TURNS_ENV}=1 must be configured together.`);
+    }
+    return profile;
+}

package/dist/mcp/server/runtime/identity/directory.js

@@ -1,10 +1,13 @@
 import { userInfo } from "os";
-import { getStoredAuth, } from "../../../local-state.js";
 import { normalizeSlugSegment } from "../../../../shared/codenames.js";
 import { apiCall, getLetagentsToken, } from "../api.js";
+import { requireValidWorkerBearerRuntime } from "../worker-bearer.js";
 import { getAuthenticatedAccountCache, setAuthenticatedAccountCache, } from "../auth-cache.js";
 import { AGENT_OWNER_LABEL, readCommandOutput, } from "./config.js";
 export async function getAuthenticatedAgentDirectory() {
+    if (requireValidWorkerBearerRuntime().mode !== "owner") {
+        return null;
+    }
     try {
         const result = await apiCall("/agents/me");
         const account = result?.account;
@@ -22,6 +25,9 @@ export async function getAuthenticatedAgentDirectory() {
     }
 }
 async function getAuthenticatedAccountProfile() {
+    if (requireValidWorkerBearerRuntime().mode !== "owner") {
+        return null;
+    }
     const envToken = (process.env.LETAGENTS_TOKEN || "").trim();
     const cache = getAuthenticatedAccountCache();
     if (envToken) {
@@ -33,12 +39,13 @@ async function getAuthenticatedAccountProfile() {
         const directory = await getAuthenticatedAgentDirectory();
         return directory?.account?.login?.trim() ? directory.account : null;
     }
+    const { getStoredAuth } = await import("../../../local-state.js");
     const storedAccount = getStoredAuth()?.account;
     if (storedAccount?.login?.trim()) {
         setAuthenticatedAccountCache(storedAccount, "stored", null);
         return storedAccount;
     }
-    if (!getLetagentsToken()) {
+    if (!await getLetagentsToken()) {
         setAuthenticatedAccountCache(undefined, null, null);
         return null;
     }

package/dist/mcp/server/runtime/identity.js

@@ -1,5 +1,6 @@
 import { buildAgentActorLabel, formatOwnerAttribution, } from "../../../shared/agent-identity.js";
 import { apiCall, getLetagentsToken, } from "./api.js";
+import { requireValidWorkerBearerRuntime } from "./worker-bearer.js";
 import { detectAgentIdeLabel, detectAgentRuntimeLabel, } from "./identity/config.js";
 import { resolveOwnerContext } from "./identity/directory.js";
 import { getSessionLivenessRegistration } from "./identity/liveness.js";
@@ -9,7 +10,7 @@ import { currentAgentIdentity, currentAgentIdentityKey, ensureAgentIdentityKey,
 export { AGENT_INSTANCE_UUID, currentAgentIdentity, currentAgentIdentityKey, detectAgentIdeLabel, detectAgentRuntimeLabel, getConversationIdentity, getSessionLivenessRegistration, resolveOwnerContext, setConversationIdentity, storeCurrentAgentIdentity, toPublicAgentIdentity, };
 export async function ensureAgentIdentity() {
     const owner = await resolveOwnerContext();
-    const authAvailable = Boolean(getLetagentsToken());
+    const authAvailable = requireValidWorkerBearerRuntime().mode === "owner" && Boolean(await getLetagentsToken());
     const ideLabel = detectAgentIdeLabel();
     const identityKey = ensureAgentIdentityKey();
     const ownerAttribution = formatOwnerAttribution(owner.label);

package/dist/mcp/server/runtime/presence.js

@@ -4,6 +4,7 @@ import { isLocalRoomStorageEnabled, resolveLocalRoomStorageIdentifiers, touchRoo
 import { apiCall, isMissingRouteError } from "./api.js";
 import { agentSessionCredentials, identityFromAgentSession } from "./agent-sessions.js";
 import { getSessionLivenessRegistration } from "./identity.js";
+import { isSupervisedBoundedTurn } from "./worker-bearer.js";
 const roomPresenceByIdentity = new Map();
 export function getRememberedRoomPresence(roomId, identity) {
     if (!roomId || !identity) {
@@ -18,7 +19,7 @@ export async function syncRoomPresence(roomId, identity, presence, agentSession)
     }
     roomPresenceByIdentity.set(getRoomIdentityPresenceCacheKey(roomId, resolvedIdentity.actor_label), presence);
     const { localRoomId, cloudRoomId } = await resolveLocalRoomStorageIdentifiers(roomId);
-    if (await isLocalRoomStorageEnabled(roomId)) {
+    if (!isSupervisedBoundedTurn() && await isLocalRoomStorageEnabled(roomId)) {
         touchRoomSession(localRoomId || roomId);
         return;
     }
@@ -38,7 +39,8 @@ export async function syncRoomPresence(roomId, identity, presence, agentSession)
                 ...agentSessionCredentials(agentSession),
             }),
         });
-        touchRoomSession(apiRoomId);
+        if (!isSupervisedBoundedTurn())
+            touchRoomSession(apiRoomId);
     }
     catch (error) {
         if (isMissingRouteError(error)) {

package/dist/mcp/server/runtime/room-api.js

@@ -3,13 +3,24 @@ import { LETAGENTS_ORIGIN_ROOM_ID_HEADER } from "../../../shared/request-headers
 import { apiCall, isMissingRouteError, } from "./api.js";
 import { maybeHandleRepoRoomAuthRequired } from "./device-auth.js";
 import { getLastMessageId } from "./messages.js";
-import { currentRoom } from "./room-state.js";
+import { currentRoom, getCurrentSupervisedRoomAuthority } from "./room-state.js";
+import { isSupervisedBoundedTurn } from "./worker-bearer.js";
 export async function roomScopedApiCall(input) {
+    const supervised = isSupervisedBoundedTurn();
+    const exactRoomAuthority = supervised ? getCurrentSupervisedRoomAuthority() : null;
+    if (supervised && (!exactRoomAuthority || input.room_id !== exactRoomAuthority)) {
+        throw new Error("The daemon-supervised API request is missing its exact per-call room authority.");
+    }
     const headers = {
         ...input.options?.headers,
     };
-    if (currentRoom?.room_id &&
-        !Object.keys(headers).some((key) => key.toLowerCase() === LETAGENTS_ORIGIN_ROOM_ID_HEADER.toLowerCase())) {
+    const originHeaderKey = Object.keys(headers).find((key) => key.toLowerCase() === LETAGENTS_ORIGIN_ROOM_ID_HEADER.toLowerCase());
+    if (exactRoomAuthority) {
+        if (originHeaderKey)
+            delete headers[originHeaderKey];
+        headers[LETAGENTS_ORIGIN_ROOM_ID_HEADER] = exactRoomAuthority;
+    }
+    else if (currentRoom?.room_id && !originHeaderKey) {
         headers[LETAGENTS_ORIGIN_ROOM_ID_HEADER] = currentRoom.room_id;
     }
     const options = {
@@ -17,16 +28,20 @@ export async function roomScopedApiCall(input) {
         headers,
     };
     if (input.room_id) {
-        const { cloudRoomId } = await resolveLocalRoomStorageIdentifiers(input.room_id);
+        const cloudRoomId = supervised
+            ? null
+            : (await resolveLocalRoomStorageIdentifiers(input.room_id)).cloudRoomId;
         const apiRoomId = cloudRoomId || input.room_id;
         try {
             const result = await apiCall(input.room_path(apiRoomId), options);
-            touchRoomSession(input.room_id, input.preserve_session_cursor ? undefined : getLastMessageId(result));
+            if (!supervised) {
+                touchRoomSession(input.room_id, input.preserve_session_cursor ? undefined : getLastMessageId(result));
+            }
             return result;
         }
         catch (error) {
             await maybeHandleRepoRoomAuthRequired(error, apiRoomId);
-            if (!input.project_id || !isMissingRouteError(error)) {
+            if (supervised || !input.project_id || !isMissingRouteError(error)) {
                 throw error;
             }
         }
@@ -36,7 +51,9 @@ export async function roomScopedApiCall(input) {
     }
     const result = await apiCall(input.project_path(input.project_id), options);
     if (input.room_id) {
-        touchRoomSession(input.room_id, input.preserve_session_cursor ? undefined : getLastMessageId(result));
+        if (!supervised) {
+            touchRoomSession(input.room_id, input.preserve_session_cursor ? undefined : getLastMessageId(result));
+        }
     }
     return result;
 }