totemlayer 0.1.68 → 0.1.75

package/bin/strict-setup.mjs

@@ -0,0 +1,385 @@
+import { createHash } from "node:crypto";
+
+export const SETUP_CHECKS = Object.freeze([
+  "guide",
+  "model",
+  "identity",
+  "transport",
+  "receiver",
+  "startup",
+  "recovery",
+  "nativeWake",
+  "peerReply",
+  "ownerChat",
+]);
+export const GUIDE_UNAVAILABLE = "Setup incomplete: setup.md could not be read in full.";
+const token = (value) =>
+  typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,319}$/.test(value);
+const uuid = (value) =>
+  typeof value === "string" && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(value);
+const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const stop = (code) => {
+  throw Object.assign(new Error(code), { code });
+};
+
+export function setupBinding(identity, host, transport, connection) {
+  if (
+    !uuid(identity?.id) ||
+    !token(identity.address) ||
+    !uuid(identity.organization?.id) ||
+    !["PRODUCTION", "SANDBOX"].includes(identity.environment) ||
+    !token(host?.name) ||
+    !token(host.model) ||
+    host.model === "default" ||
+    !token(host.sessionId) ||
+    !["mcp", "api"].includes(transport) ||
+    !/^[a-f0-9]{64}$/.test(connection?.fingerprint ?? "")
+  )
+    stop("SETUP_BINDING_UNVERIFIED");
+  let origin;
+  try {
+    const url = new URL(connection.origin);
+    if (
+      url.username ||
+      url.password ||
+      url.search ||
+      url.hash ||
+      url.pathname !== "/" ||
+      (url.protocol !== "https:" &&
+        !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+    )
+      stop("SETUP_BINDING_UNVERIFIED");
+    origin = url.origin;
+  } catch {
+    stop("SETUP_BINDING_UNVERIFIED");
+  }
+  return digest([
+    identity.id,
+    identity.address,
+    identity.organization.id,
+    identity.environment,
+    origin,
+    connection.fingerprint,
+    host.name,
+    host.model,
+    host.sessionId,
+    transport,
+  ]);
+}
+
+function sameHost(before, after) {
+  return (
+    after?.modelVerified === true &&
+    before.name === after.name &&
+    before.model === after.model &&
+    before.sessionId === after.sessionId &&
+    before.policyDigest === after.policyDigest
+  );
+}
+
+/** This controller accepts observations from installed adapters, never model-supplied proofs. */
+export async function runStrictSetup(adapter, options = {}) {
+  const checks = Object.fromEntries(SETUP_CHECKS.map((name) => [name, false]));
+  let identity,
+    host,
+    transport,
+    binding,
+    receiver,
+    proofs,
+    apiReason,
+    operation = "readGuide";
+  const progress = async (stage) => options.progress?.({ stage, checks: { ...checks } });
+  const report = (code) => ({
+    version: 1,
+    complete: !code && SETUP_CHECKS.every((name) => checks[name]),
+    state:
+      code === "RECEIVER_INTENTIONALLY_PAUSED"
+        ? "paused"
+        : !code && SETUP_CHECKS.every((name) => checks[name])
+          ? "complete"
+          : "incomplete",
+    ...(code ? { code } : {}),
+    message:
+      code === "GUIDE_UNAVAILABLE"
+        ? GUIDE_UNAVAILABLE
+        : !code && SETUP_CHECKS.every((name) => checks[name])
+          ? "Totem setup complete; required checks verified."
+          : checks.identity
+            ? "Connection verified; automatic receiving setup incomplete"
+            : "Setup incomplete",
+    ...(host ? { host: host.name, model: host.model, sessionId: host.sessionId } : {}),
+    ...(identity && checks.identity
+      ? {
+          agentId: identity.id,
+          address: identity.address,
+          organizationId: identity.organization.id,
+          environment: identity.environment,
+        }
+      : {}),
+    ...(transport ? { transport } : {}),
+    ...(apiReason ? { apiReason } : {}),
+    ...(receiver
+      ? {
+          intervalSeconds: receiver.intervalSeconds,
+          measuredCheckSeconds: receiver.measuredCheckSeconds,
+        }
+      : {}),
+    ...(checks.peerReply
+      ? {
+          peerVerification: {
+            messageId: proofs.peer.messageId,
+            replyId: proofs.peer.replyId,
+            receivedAt: proofs.peer.receivedAt,
+            repliedAt: proofs.peer.repliedAt,
+            exactlyOneReply: true,
+            acknowledgedAfterReply: true,
+          },
+        }
+      : {}),
+    ...(checks.ownerChat
+      ? {
+          ownerChatVerification: {
+            commandId: proofs.ownerChat.commandId,
+            chatId: proofs.ownerChat.chatId,
+            eventId: proofs.ownerChat.eventId,
+            leaseRenewed: true,
+            completedInOriginalChat: true,
+            queuedAt: proofs.ownerChat.queuedAt,
+            completedAt: proofs.ownerChat.completedAt,
+          },
+        }
+      : {}),
+    checks: { ...checks },
+    remaining: SETUP_CHECKS.filter((name) => !checks[name]),
+  });
+  try {
+    // No host inspection, approval or setup mutation is permitted before a complete guide.
+    let guide;
+    for (const reader of ["primary", "alternate"]) {
+      try {
+        const value = await adapter.readGuide(reader);
+        if (
+          value?.complete === true &&
+          value.integrityVerified === true &&
+          /^[a-f0-9]{64}$/.test(value.sha256 ?? "") &&
+          typeof value.text === "string" &&
+          value.text.startsWith("# Set up Totem") &&
+          value.text.endsWith("<!-- totem-setup:end -->\n")
+        ) {
+          guide = value;
+          break;
+        }
+      } catch {
+        /* Try the independent supported reader before stopping. */
+      }
+    }
+    if (!guide) return report("GUIDE_UNAVAILABLE");
+    checks.guide = true;
+    await progress("guide_verified");
+    operation = "inspectHost";
+    const inspected = await adapter.inspect();
+    const proposedHost = inspected.host;
+    if (
+      !token(proposedHost?.name) ||
+      !token(proposedHost.model) ||
+      proposedHost.model === "default" ||
+      /(?:tn_(?:live|test)_|Bearer|secret|token=)/i.test(proposedHost.model) ||
+      !token(proposedHost.sessionId) ||
+      !/^[a-f0-9]{64}$/.test(proposedHost.policyDigest ?? "") ||
+      proposedHost.modelVerified !== true
+    )
+      stop("CURRENT_MODEL_UNVERIFIED");
+    host = proposedHost;
+    checks.model = true;
+    if (inspected.policyDenied) stop("HOST_POLICY_DENIED");
+    if (inspected.identityConflict) stop("AGENT_IDENTITY_MISMATCH");
+    // Existing transport, identity, credential generation and intentional pauses win.
+    transport = inspected.connection?.transport;
+    if (!transport) {
+      if (inspected.ownerSelectedTransport === "api" && inspected.apiSupported === true) {
+        transport = "api";
+        apiReason = "The owner explicitly selected API for this host.";
+      } else if (inspected.customMcp === true) transport = "mcp";
+      else if (
+        inspected.customMcp === false &&
+        inspected.apiSupported === true &&
+        typeof inspected.missingMcpCapability === "string" &&
+        inspected.missingMcpCapability.trim()
+      ) {
+        transport = "api";
+        apiReason = inspected.missingMcpCapability.slice(0, 500);
+      } else stop("HOST_MCP_CAPABILITY_UNVERIFIED");
+    }
+    if (!["mcp", "api"].includes(transport)) stop("TRANSPORT_UNSUPPORTED");
+    if (transport === "api" && !inspected.connection) {
+      let apiGuide;
+      for (const reader of ["primary", "alternate"]) {
+        try {
+          const value = await adapter.readApiGuide?.(reader);
+          if (
+            value?.complete === true &&
+            value.integrityVerified === true &&
+            /^[a-f0-9]{64}$/.test(value.sha256 ?? "") &&
+            value.text?.startsWith("# Connect an agent to the Totem API") &&
+            value.text.endsWith("<!-- totem-api-setup:end -->\n")
+          ) {
+            apiGuide = value;
+            break;
+          }
+        } catch {}
+      }
+      if (!apiGuide) {
+        checks.guide = false;
+        stop("API_GUIDE_UNAVAILABLE");
+      }
+      const delivery = await adapter.explainApi(apiReason);
+      if (delivery?.ownerVisible !== true || delivery.deliveredBeforeRequest !== true)
+        stop("API_EXPLANATION_NOT_DELIVERED");
+    }
+    // A stopped connection is inspected read-only, without login, repair, recovery or tests.
+    const connection =
+      inspected.connection ?? (inspected.paused ? undefined : await adapter.connect(transport));
+    if (!connection) stop("CONNECTION_APPROVAL_REQUIRED");
+    identity = await adapter.identity(connection, transport);
+    const expected = inspected.connection?.identity ?? connection.identity;
+    if (
+      expected &&
+      (identity?.id !== expected.id ||
+        identity.environment !== expected.environment ||
+        (expected.organization?.id && identity.organization?.id !== expected.organization.id))
+    )
+      stop("AGENT_IDENTITY_MISMATCH");
+    if (options.expectedAgentId && identity?.id !== options.expectedAgentId)
+      stop("AGENT_IDENTITY_MISMATCH");
+    if (options.expectedEnvironment && identity?.environment !== options.expectedEnvironment)
+      stop("AGENT_IDENTITY_MISMATCH");
+    binding = setupBinding(identity, host, transport, connection);
+    checks.identity = true;
+    checks.transport =
+      transport === "mcp"
+        ? connection.mcpIdentityVerified === true
+        : connection.apiIdentityVerified === true &&
+          connection.inboxVerified === true &&
+          connection.installationAcknowledged === true;
+    if (!checks.transport) stop("CONNECTION_VERIFICATION_INCOMPLETE");
+    if (inspected.paused) return report("RECEIVER_INTENTIONALLY_PAUSED");
+    await progress("identity_verified");
+    const context = Object.freeze({
+      identity,
+      host,
+      transport,
+      binding,
+      connectionFingerprint: connection.fingerprint,
+      guideSha256: guide.sha256,
+    });
+    operation = "configureReceiver";
+    await adapter.configureReceiver(context);
+    receiver = await adapter.readReceiver(context);
+    if (receiver?.binding !== binding || receiver.count !== 1 || receiver.sameConnection !== true)
+      stop("EXACT_RECEIVER_UNVERIFIED");
+    if (receiver.paused) return report("RECEIVER_INTENTIONALLY_PAUSED");
+    if (!Number.isFinite(receiver.intervalSeconds) || receiver.intervalSeconds <= 0)
+      stop("RECEIVER_INTERVAL_UNVERIFIED");
+    // A preserved slower interval or documented fallback remains installed and is reported honestly.
+    const operational =
+      receiver.running === true &&
+      Number.isFinite(receiver.measuredCheckSeconds) &&
+      receiver.measuredCheckSeconds > 0 &&
+      receiver.independentOfModel === true &&
+      receiver.silentWhenIdle === true &&
+      receiver.bothQueues === true &&
+      receiver.privateState === true;
+    checks.receiver = operational && receiver.intervalSeconds === 5;
+    checks.startup =
+      receiver.startupEnabled === true &&
+      receiver.restartOnFailure === true &&
+      receiver.persistent === true;
+    if (!sameHost(host, await adapter.readHost(context))) {
+      checks.model = false;
+      stop("CURRENT_MODEL_CHANGED");
+    }
+    if (!operational || !checks.startup)
+      return {
+        ...report("RECEIVER_CAPABILITY_INCOMPLETE"),
+        intervalSeconds: receiver.intervalSeconds,
+      };
+    await progress("receiver_verified");
+    const recovery = await adapter.verifyRecovery(context);
+    checks.recovery =
+      recovery?.binding === binding &&
+      recovery.newRunVerified === true &&
+      recovery.savedStatePreserved === true &&
+      recovery.ownerPausePreserved === true &&
+      recovery.noDuplicateReceiver === true;
+    if (!checks.recovery) return report("RECOVERY_UNVERIFIED");
+    await progress("recovery_verified");
+    // This requests incoming tests from the owner. It never sends traffic to another agent.
+    await adapter.requestTests(context);
+    proofs = await adapter.readTests(context);
+    const peer = proofs?.peer,
+      chat = proofs?.ownerChat;
+    checks.nativeWake =
+      peer?.binding === binding &&
+      peer.nativeSessionId === host.sessionId &&
+      peer.newMessageTriggeredWake === true &&
+      peer.appearedInNativeChat === true;
+    checks.peerReply =
+      peer?.binding === binding &&
+      peer.nativeSessionId === host.sessionId &&
+      peer.appearedInNativeChat === true &&
+      uuid(peer.messageId) &&
+      uuid(peer.replyId) &&
+      peer.correlated === true &&
+      peer.exactlyOneReply === true &&
+      peer.acknowledgedAfterReply === true &&
+      peer.authorized === true &&
+      Number.isFinite(peer.receivedAt) &&
+      Number.isFinite(peer.repliedAt) &&
+      peer.repliedAt >= peer.receivedAt;
+    checks.ownerChat =
+      chat?.binding === binding &&
+      uuid(chat.commandId) &&
+      uuid(chat.chatId) &&
+      uuid(chat.eventId) &&
+      chat.claimed === true &&
+      chat.leaseRenewed === true &&
+      chat.completedInOriginalChat === true &&
+      chat.authorized === true &&
+      Number.isFinite(chat.queuedAt) &&
+      Number.isFinite(chat.completedAt) &&
+      chat.completedAt >= chat.queuedAt;
+    if (!sameHost(host, await adapter.readHost(context))) {
+      checks.model = false;
+      stop("CURRENT_MODEL_CHANGED");
+    }
+    await progress("tests_checked");
+    return report(
+      !checks.peerReply || !checks.ownerChat
+        ? "AUTHORIZED_TESTS_PENDING"
+        : !checks.receiver
+          ? "RECEIVER_INTERVAL_LIMITATION"
+          : !checks.nativeWake
+            ? "NATIVE_WAKE_UNVERIFIED"
+            : undefined,
+    );
+  } catch (error) {
+    // Adapter error messages may contain private host diagnostics. Export only bounded codes.
+    const code = /^[A-Z][A-Z0-9_]{0,79}$/.test(error?.code ?? "")
+      ? error.code
+      : "SETUP_ADAPTER_FAILED";
+    if (code === "HOST_POLICY_DENIED") {
+      const reason =
+        typeof error.publicReason === "string"
+          ? error.publicReason
+              .slice(0, 1000)
+              .replace(/tn_(?:live|test)_[A-Za-z0-9_-]+|Bearer\s+\S+/gi, "[redacted]")
+          : "The host did not supply a public reason.";
+      return { ...report(code), deniedOperation: operation, statedReason: reason };
+    }
+    return report(code);
+  } finally {
+    await Promise.resolve()
+      .then(() => adapter.close?.())
+      .catch(() => {});
+  }
+}

package/bin/totem.mjs

@@ -1754,6 +1754,11 @@ async function runRfq(options, baseUrl) {
 }
 
 async function main() {
+  if (process.argv[2] === "install-worker") {
+    const { strictSetupWorkerMain } = await import("./strict-setup-jobs.mjs");
+    process.exitCode = await strictSetupWorkerMain(process.argv[3]);
+    return;
+  }
   if (process.argv[2] === "update") {
     const { runtimeUpdateMain } = await import("./managed-mcp.mjs");
     await runtimeUpdateMain(process.argv.slice(3));
@@ -1769,7 +1774,12 @@ async function main() {
     process.exitCode = await executorDiagnosticMain(process.argv.slice(3));
     return;
   }
-  if (!process.argv[2] || ["login", "install"].includes(process.argv[2])) {
+  if (process.argv[2] === "install") {
+    const { strictInstallationMain } = await import("./strict-installation.mjs");
+    process.exitCode = await strictInstallationMain(process.argv.slice(3));
+    return;
+  }
+  if (!process.argv[2] || process.argv[2] === "login") {
     const { installationMain } = await import("./installation.mjs");
     process.exitCode = await installationMain(process.argv.slice(3), {});
     return;

package/bin/windows-private-path.mjs

@@ -0,0 +1,89 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { join, resolve } from "node:path";
+import { lstat } from "node:fs/promises";
+
+const execute = promisify(execFile);
+export function validateWindowsPrivateAcl(snapshot) {
+  const sid = snapshot?.sid;
+  if (typeof sid !== "string" || !/^S-1-(?:\d+-){1,14}\d+$/.test(sid))
+    throw new Error("The Windows account SID could not be verified.");
+  const trusted = new Set([sid, "S-1-5-18", "S-1-5-32-544"]);
+  const trustedAncestors = new Set([
+    ...trusted,
+    "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
+  ]);
+  if (
+    snapshot.owner !== sid ||
+    snapshot.reparse ||
+    !Array.isArray(snapshot.rules) ||
+    !Array.isArray(snapshot.ancestors)
+  )
+    throw new Error("The private Windows path has an unsafe owner or reparse point.");
+  let readable = false;
+  for (const rule of snapshot.rules) {
+    if (
+      !Number.isSafeInteger(rule.rights) ||
+      rule.rights < 0 ||
+      !["Allow", "Deny"].includes(rule.type)
+    )
+      throw new Error("The Windows access rules could not be verified.");
+    if (rule.type === "Allow" && !trusted.has(rule.sid))
+      throw new Error("The private Windows path grants access to another principal.");
+    if (rule.type === "Allow" && rule.sid === sid && (rule.rights & 131073) === 131073)
+      readable = true;
+    if (rule.type === "Deny" && rule.sid === sid && rule.rights & 131073)
+      throw new Error("The private Windows path denies required owner access.");
+  }
+  if (
+    !readable ||
+    snapshot.ancestors.some(
+      (parent) =>
+        parent.reparse ||
+        !trustedAncestors.has(parent.owner) ||
+        !Array.isArray(parent.rules) ||
+        parent.rules.some(
+          (rule) =>
+            !rule.inheritOnly &&
+            rule.type === "Allow" &&
+            !trustedAncestors.has(rule.sid) &&
+            (rule.rights & (64 | 262144 | 524288)) !== 0,
+        ),
+    )
+  )
+    throw new Error("The private Windows path or its parent can be replaced by another principal.");
+}
+
+export async function assertWindowsPrivatePath(path) {
+  if (process.platform !== "win32") return;
+  await lstat(path); // Preserve ENOENT for callers that create a new private file.
+  const encoded = Buffer.from(resolve(path), "utf8").toString("base64");
+  const script = `$ErrorActionPreference='Stop'
+$path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}'))
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+function Rules($acl) { @($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]) | ForEach-Object { @{sid=$_.IdentityReference.Value;rights=[int64]$_.FileSystemRights;type=$_.AccessControlType.ToString();inheritOnly=[bool]($_.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly)} }) }
+$item=Get-Item -LiteralPath $path -Force
+$acl=Get-Acl -LiteralPath $path
+$parents=@(); $parent=Split-Path -LiteralPath $path
+while ($parent) {
+  $p=Get-Item -LiteralPath $parent -Force
+  $parentAcl=Get-Acl -LiteralPath $parent
+  $parents+=@{owner=$parentAcl.GetOwner([Security.Principal.SecurityIdentifier]).Value;reparse=[bool]($p.Attributes -band [IO.FileAttributes]::ReparsePoint);rules=@(Rules $parentAcl)}
+  $next=Split-Path -LiteralPath $parent
+  if ($next -eq $parent) { break }; $parent=$next
+}
+@{sid=$sid;owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;reparse=[bool]($item.Attributes -band [IO.FileAttributes]::ReparsePoint);rules=@(Rules $acl);ancestors=$parents} | ConvertTo-Json -Depth 8 -Compress`;
+  const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
+  if (!systemRoot) throw new Error("The Windows system directory could not be verified.");
+  const { stdout } = await execute(
+    join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64"),
+    ],
+    { timeout: 10000, maxBuffer: 262144, windowsHide: true },
+  );
+  validateWindowsPrivateAcl(JSON.parse(stdout.replace(/^\uFEFF/, "")));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.68",
+  "version": "0.1.75",
   "description": "Cross-platform CLI for TotemLayer agent identity and authorization",
   "type": "module",
   "bin": {
@@ -33,9 +33,10 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
+    "@modelcontextprotocol/client": "2.3.0",
     "@modelcontextprotocol/server": "2.3.0",
-    "undici": "7.30.0",
-    "zod": "4.4.3"
+    "undici": "7.30.1",
+    "zod": "4.6.6"
   },
   "scripts": {
     "postinstall": "node bin/installation.mjs --postinstall",

package/scripts/prepare.mjs

@@ -2,6 +2,7 @@ import { access, readdir, readFile, writeFile } from "node:fs/promises";
 import { transform } from "esbuild";
 import "./build-native.mjs";
 import { generateNetworkContract } from "../../../scripts/generate-network-contract.mjs";
+import "../../../scripts/build-strict-installer-guide.mjs";
 await generateNetworkContract();
 // This candidate rebases coordination on the immutable published 0.1.21 bundle.
 // Its bundled SDK is the release source; do not rebuild it from an older sibling checkout.
@@ -18,6 +19,7 @@ for (const name of [
   "runtime-diagnostics.mjs",
   "codex-chat-bridge.mjs",
   "codex-human-chat-bridge.mjs",
+  "codex-mission-bridge.mjs",
   "chat-prompt-limit.mjs",
   "worker-core/adapters.mjs",
   "worker-core/errors.mjs",