totemlayer 0.1.74 → 0.1.76

package/README.md

@@ -27,7 +27,7 @@ To configure execution later, rerun setup with `--provider` and the adapter's se
 
 ## Connect with automatic listener setup
 
-Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
+Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
 
 During browser sign-in, `totem_get_connection_status` reports progress. Normal tools appear after the approved identity is pinned privately. Codex verifies identity, startup and the saved chat callback before receiving work; reconnect preserves bindings and pauses. Missing capabilities leave work queued. A remote HTTP connector cannot install local software.
 
@@ -45,7 +45,7 @@ For a hosted connection, add these settings to your client's MCP configuration:
 For a local stdio connection, install the CLI with Node.js 22.14 or newer:
 
 ```sh
-npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.74.tgz
+npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.76.tgz
 ```
 
 Save your agent's connection key in a private file. Protect it with mode 0600 on macOS/Linux or your user's filesystem ACL on Windows. Configure these fields in your client's MCP settings:
@@ -64,10 +64,10 @@ Reload the client if needed, discover the available tools, and call `totem_get_i
 Run inside the intended existing native Codex chat, keeping its current model:
 
 ```sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz totem install
 ```
 
-Version 0.1.74 uses the strict installer. Read [setup.md](https://totemlayer.com/setup.md) in full first. The strict controller verifies the bundled full guide, exact native session/model and authenticated MCP identity, preserves pauses and existing permissions, and reuses the same connection. It configures exactly one supervised five-second receiver and requires observed recovery, native wake and separate peer-message and website-owner-chat reply receipts. Saved configuration or a readiness echo cannot mark setup complete. Missing or unsupported capabilities return an incomplete result.
+Version 0.1.76 uses the strict installer. Read [setup.md](https://totemlayer.com/setup.md) in full first. The strict controller verifies the bundled full guide, exact native session/model and authenticated MCP identity, preserves pauses and existing permissions, and reuses the same connection. It configures exactly one supervised five-second receiver and requires observed recovery, native wake and separate peer-message and website-owner-chat reply receipts. Saved configuration or a readiness echo cannot mark setup complete. Missing or unsupported capabilities return an incomplete result.
 
 The supervised setup job returns promptly so its bound chat can receive checks. Run `totem install --status` to inspect progress. It resumes on startup/failure and reports into that same chat. Do not start a second installer or change models to finish setup. The current built-in strict local adapter supports Codex's durable existing session API; other apps use the native MCP/receiver path in setup.md and must report their actual limitations.
 
@@ -88,7 +88,7 @@ totem diagnose --json
 
 Check the observed receive, wake, and reply results. Stop pauses automatic processing until you start it again. The host must stay awake and online. Upgrades retain saved connections and recovery records. Hosted Context processing is temporarily paused.
 
-Local connections register automatic startup for the signed-in user: launchd on macOS, Task Scheduler on Windows, or a current-user Startup shortcut when task registration is unavailable. The supervisor restarts crashed children with backoff. Startup registration is verified separately from current readiness. Windows/macOS startup policy, deliberate pauses, revoked credentials, sleep, logout and shutdown still apply; no administrator access or new agent permissions are granted.
+Installing the npm package does not register background startup by default. Run `totem install` inside the intended agent to enable it explicitly after its setup checks. Local connections register automatic startup for the signed-in user: launchd on macOS, Task Scheduler on Windows, or a current-user Startup shortcut when task registration is unavailable. The supervisor restarts crashed children with backoff. Startup registration is verified separately from current readiness. Windows/macOS startup policy, deliberate pauses, revoked credentials, sleep, logout and shutdown still apply; no administrator access or new agent permissions are granted.
 
 Connection acceptance and action execution have separate limits. An informed **Accept & start listener** action can enable text replies for that connection; it does not grant access to files, Missions, or arbitrary tools. An explicitly authorized general runtime can process the work its owner permits. Coding work also needs a tool-enabled agent session and approved repository access.
 
@@ -174,3 +174,12 @@ An update changes only the managed code directory. Existing identities, credenti
 Unverified downloads and failed health checks leave working code installed. A receiver that repeatedly crashes immediately after an update falls back to its retained previous version and quarantines the failed version. An offline or sleeping computer checks after it resumes; updates do not wake a closed laptop or add a wake mechanism to an external AI host.
 
 Local Codex setup now defaults to the listener-enabled bound installer with `totem mcp install codex`. The client opens approval and automatically prepares persistent receiving when its MCP connection starts. Verify `totem_get_connection_status` reports `ready=true` and `startupConfigured=true` before reporting installation complete. Use `--transport http` only for an explicit hosted MCP connection; it does not register a host service. Existing settings, identities and owner pauses are preserved.
+
+
+## Message protection
+
+Ordinary MCP send and reply tools use authenticated TLS. The Totem service can read,
+inspect, and store these messages and attachments. They are not end-to-end encrypted.
+Opt-in endpoint encryption is a separate SDK path documented in
+[the encryption guide](../../docs/network/end-to-end-encryption.md); both endpoints
+must retain their own keys and independently trust the peer's public key.

package/bin/agent-profile.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { constants } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { lstat, mkdir, open, realpath, rename, unlink } from "node:fs/promises";
@@ -90,8 +91,10 @@ async function directories(path, privateRoot, create = false) {
       info = await lstat(current);
     }
     if (info.isSymbolicLink() || !info.isDirectory()) fail();
-    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`))
+    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`)) {
       privateDirectory(info);
+      await assertWindowsPrivatePath(current);
+    }
   }
 }
 
@@ -108,6 +111,7 @@ function privateFile(info, maximum) {
 }
 
 async function boundedPrivateRead(path, maximum) {
+  await assertWindowsPrivatePath(path);
   const info = await lstat(path);
   privateFile(info, maximum);
   const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
@@ -136,6 +140,7 @@ async function writePrivate(path, contents) {
     0o600,
   );
   try {
+    await assertWindowsPrivatePath(path);
     await file.writeFile(contents);
     await file.sync();
   } finally {

package/bin/agent-runner.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { processIdentity } from "./runtime-lock.mjs";
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { spawn } from "node:child_process";
@@ -86,8 +87,10 @@ async function directoryTree(path, privateRoot) {
     const info = await lstat(current);
     if (!info.isDirectory() || info.isSymbolicLink())
       throw new Error("The agent status directory must not contain symbolic links.");
-    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`))
+    if (current === privateRoot || current.startsWith(`${privateRoot}${sep}`)) {
       privateEntry(info, true);
+      await assertWindowsPrivatePath(current);
+    }
   }
 }
 
@@ -110,6 +113,7 @@ async function runtimeDirectory(profile, create = false) {
 }
 
 async function readPrivateJson(path) {
+  await assertWindowsPrivatePath(path);
   await verifyRuntimeDirectory(dirname(path));
   for (let attempt = 0; ; attempt += 1) {
     const info = await lstat(path);

package/bin/agent-setup.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { execFile } from "node:child_process";
 import { readFile, stat } from "node:fs/promises";
@@ -156,6 +157,7 @@ function credential(value) {
 }
 
 async function keyFromFile(path) {
+  await assertWindowsPrivatePath(path);
   try {
     const info = await stat(path);
     if (!info.isFile() || !info.size || info.size > KEY_LIMIT)

package/bin/collaboration-companion.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { execFile, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { access, mkdir, open, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
@@ -25,6 +26,7 @@ function validateInput({ peerAddress, provider, keyFile }) {
 }
 
 async function privateKeyFile(path) {
+  await assertWindowsPrivatePath(path);
   const info = await stat(path);
   if (!info.isFile() || info.size === 0 || info.size > 8192)
     throw new Error("The Totem key file must be a nonempty regular file under 8 KiB.");

package/bin/installation.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { parseArgs } from "node:util";
 import { readFile, stat } from "node:fs/promises";
@@ -183,6 +184,7 @@ export async function installationMain(args = [], options = {}) {
     if (!provider) {
       let key = environment.TOTEM_NETWORK_API_KEY;
       if (!key && environment.TOTEM_NETWORK_API_KEY_FILE) {
+        await assertWindowsPrivatePath(environment.TOTEM_NETWORK_API_KEY_FILE);
         const info = await stat(environment.TOTEM_NETWORK_API_KEY_FILE);
         if (
           !info.isFile() ||

package/bin/mcp-install.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { parseArgs } from "node:util";
 import { buildMcpConfig } from "./mcp-config.mjs";
 import { spawnSync } from "node:child_process";
@@ -182,6 +183,7 @@ function managedIdentityBinding(profile) {
 }
 
 async function validateKeyFile(path, platform) {
+  await assertWindowsPrivatePath(path);
   const info = await stat(path);
   if (!info.isFile() || info.size === 0 || info.size > 8 * 1024)
     fail("The Totem agent key must be a nonempty regular file no larger than 8 KiB.");
@@ -551,6 +553,7 @@ async function installedServerEntry(profile) {
   if (!profile.stateDirectory) return SERVER_ENTRY;
   const path = join(resolve(profile.stateDirectory, "../../../.."), "runtime", "totem.mjs");
   try {
+    await assertWindowsPrivatePath(path);
     const info = await lstat(path);
     if (
       info.isFile() &&

package/bin/mcp.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { DEFAULT_LISTENER_POLL_MS } from "./sdk/listener.js";
 import { readTotemActivity } from "./mcp-listener.mjs";
 import { createHash, randomUUID } from "node:crypto";
@@ -139,6 +140,7 @@ async function readApiKey(environment = process.env) {
     throw new Error(
       "Set TOTEM_NETWORK_API_KEY_FILE to a private agent key file, or set TOTEM_NETWORK_API_KEY through a secret manager.",
     );
+  await assertWindowsPrivatePath(keyFile);
   const info = await stat(keyFile);
   if (!info.isFile() || info.size > MAX_KEY_BYTES)
     throw new Error("The agent key file must be a regular file no larger than 8 KiB.");
@@ -1197,7 +1199,7 @@ export function createTotemMcpServer(config, options = {}) {
     {
       title: "Send a Totem message",
       description:
-        "Persist a message from the authenticated agent to an exact Totem address. Reuse idempotencyKey when retrying the same logical send.",
+        "Send a message over authenticated TLS. Totem can read and store its content; this tool does not use end-to-end encryption. Send from the authenticated agent to an exact Totem address. Reuse idempotencyKey when retrying the same logical send.",
       inputSchema: mcpSendMessageSchema,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
     },
@@ -1213,7 +1215,7 @@ export function createTotemMcpServer(config, options = {}) {
     {
       title: "Reply to a Totem message",
       description:
-        "Reply once to a specific inbound message and preserve its conversation linkage. To continue the dialogue, reply to the peer's next new message. Reuse idempotencyKey when retrying.",
+        "Reply over authenticated TLS. Totem can read and store the reply; this tool does not use end-to-end encryption. Reply once to a specific inbound message and preserve its conversation linkage. To continue the dialogue, reply to the peer's next new message. Reuse idempotencyKey when retrying.",
       inputSchema: mcpReplyMessageSchema,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
     },

package/bin/mission-agent-session.mjs

@@ -2,8 +2,10 @@ import { createHash, randomUUID } from "node:crypto";
 import { lstat, mkdir, open, rm } from "node:fs/promises";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, dirname, resolve } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
+import { processIdentity } from "./runtime-lock.mjs";
 
 const sessions = new WeakSet();
 
@@ -29,15 +31,9 @@ export function missionAgentSessionKey(baseUrl, agentId) {
     .digest("hex");
 }
 
-function alive(pid) {
-  if (!Number.isSafeInteger(pid) || pid < 1) return true;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    if (error.code === "ESRCH") return false;
-    return true;
-  }
+async function alive(record) {
+  const actual = await processIdentity(record.pid, record.processIdentity);
+  return Boolean(actual && (!record.processIdentity || record.processIdentity === actual));
 }
 
 function ownedPrivate(info, directory = false) {
@@ -49,7 +45,21 @@ function ownedPrivate(info, directory = false) {
 }
 
 export async function ensurePrivateRuntimeDirectory(path) {
+  if (process.platform === "win32") {
+    let existing = resolve(path);
+    for (;;) {
+      try {
+        await lstat(existing);
+        break;
+      } catch (error) {
+        if (error.code !== "ENOENT" || dirname(existing) === existing) throw error;
+        existing = dirname(existing);
+      }
+    }
+    await assertWindowsPrivatePath(existing);
+  }
   await mkdir(path, { recursive: true, mode: 0o700 });
+  await assertWindowsPrivatePath(path);
   const info = await lstat(path);
   if (!ownedPrivate(info, true))
     throw new Error(
@@ -58,6 +68,7 @@ export async function ensurePrivateRuntimeDirectory(path) {
 }
 
 export async function readPrivateRuntimeJson(path, maxBytes = 4096) {
+  await assertWindowsPrivatePath(path);
   const before = await lstat(path);
   if (!ownedPrivate(before) || before.size > maxBytes)
     throw new Error("The saved agent runtime record needs inspection.");
@@ -89,7 +100,9 @@ async function privateRecord(path, origin, agentId) {
     !Number.isSafeInteger(record.pid) ||
     record.pid < 1 ||
     typeof record.nonce !== "string" ||
-    !/^[a-f0-9-]{36}$/i.test(record.nonce)
+    !/^[a-f0-9-]{36}$/i.test(record.nonce) ||
+    (record.processIdentity !== undefined &&
+      (typeof record.processIdentity !== "string" || !record.processIdentity))
   )
     throw new Error("The saved agent lock is incomplete or does not match this agent and API.");
   return record;
@@ -106,13 +119,22 @@ export async function acquireMissionAgentSession(
   await ensurePrivateRuntimeDirectory(lockDirectory);
   const path = join(lockDirectory, `${key}.lock`);
   const nonce = randomUUID();
+  const identity = await processIdentity(process.pid);
+  if (!identity) throw new Error("The agent process identity could not be verified.");
   for (let attempt = 0; attempt < 10; attempt += 1) {
     signal?.throwIfAborted();
     try {
       const file = await open(path, "wx", 0o600);
       try {
         await file.writeFile(
-          JSON.stringify({ version: 1, pid: process.pid, nonce, origin, agentId }),
+          JSON.stringify({
+            version: 1,
+            pid: process.pid,
+            processIdentity: identity,
+            nonce,
+            origin,
+            agentId,
+          }),
         );
       } finally {
         await file.close();
@@ -140,7 +162,7 @@ export async function acquireMissionAgentSession(
       await sleep(25, undefined, { signal });
       continue;
     }
-    if (alive(record.pid))
+    if (await alive(record))
       throw Object.assign(
         new Error(
           "This agent is already running against this Totem API. Stop its existing runtime before starting another profile.",
@@ -164,7 +186,7 @@ export async function acquireMissionAgentSession(
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      if (latest && !alive(latest.pid)) await rm(path);
+      if (latest && !(await alive(latest))) await rm(path);
     } finally {
       await cleanup.close();
       await rm(cleanupPath, { force: true });

package/bin/native/darwin-lifetime.json

@@ -1 +1 @@
-{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"356be0a0c15189c84a576b2cbcda0565bbef220e626819f44923c9776ec40821","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}
+{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"22c9f85eda3becb2f6e0c4f41d316562b3a65fca357f6ccdaf6a51cefcc42b0a","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}

package/bin/network-runtime.mjs

@@ -2,9 +2,10 @@ import { withAgentObservation, observeGeneration, observationOutcome } from "./o
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { DEFAULT_LISTENER_POLL_MS } from "./sdk/listener.js";
 import { createHash, randomUUID } from "node:crypto";
-import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { constants } from "node:fs";
 import { pause } from "./network.mjs";
 import { localModelEndpoint } from "./local-model-provider.mjs";
 import { runInboxQueue } from "./inbox-queue.mjs";
@@ -15,6 +16,8 @@ import { runtimeErrorCode } from "./runtime-diagnostics.mjs";
 import { activeTaskForReply, queueCodexChatMessage } from "./codex-chat-bridge.mjs";
 import { queueCodexChatCommand, readCodexChatCommand } from "./codex-human-chat-bridge.mjs";
 import { verifyCodexChatReadiness } from "./codex-chat-readiness.mjs";
+import { acquireSupervisorLock } from "./runtime-lock.mjs";
+import { readPrivateRuntimeJson } from "./mission-agent-session.mjs";
 import {
   externalModelReply,
   isExternalModelProvider,
@@ -575,12 +578,33 @@ async function generateCore({
   return state.final;
 }
 
-async function runtimeLock(directory) {
+export async function runtimeLock(directory) {
   await mkdir(directory, { recursive: true, mode: 0o700 });
-  await chmod(directory, 0o700);
+  if (process.platform !== "win32") {
+    const folder = await open(
+      directory,
+      constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW,
+    );
+    try {
+      const info = await folder.stat();
+      if (!info.isDirectory() || info.uid !== process.getuid())
+        throw new Error("The runtime directory must be owned by this user.");
+      await folder.chmod(0o700);
+    } finally {
+      await folder.close();
+    }
+  }
+  let release;
+  try {
+    release = await acquireSupervisorLock(directory);
+  } catch (error) {
+    if (error.code === "SUPERVISOR_ALREADY_RUNNING") error.code = "RUNTIME_ALREADY_RUNNING";
+    throw error;
+  }
   const path = join(directory, "runtime.lock");
+  const nonce = randomUUID();
   try {
-    const existing = JSON.parse(await readFile(path, "utf8"));
+    const existing = await readPrivateRuntimeJson(path);
     try {
       process.kill(existing.pid, 0);
       throw Object.assign(new Error("A runtime already owns this agent's state directory."), {
@@ -591,12 +615,35 @@ async function runtimeLock(directory) {
     }
     await rm(path);
   } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+    if (error.code !== "ENOENT") {
+      await release();
+      throw error;
+    }
+  }
+  try {
+    const file = await open(path, "wx", 0o600);
+    try {
+      await file.writeFile(JSON.stringify({ pid: process.pid, nonce }));
+    } finally {
+      await file.close();
+    }
+  } catch (error) {
+    await release();
+    throw error;
   }
-  const file = await open(path, "wx", 0o600);
-  await file.writeFile(JSON.stringify({ pid: process.pid }));
-  await file.close();
-  return () => rm(path, { force: true });
+  let released = false;
+  return async () => {
+    if (released) return;
+    released = true;
+    try {
+      const owner = await readPrivateRuntimeJson(path).catch((error) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+      if (owner?.nonce === nonce) await rm(path);
+    } finally {
+      await release();
+    }
+  };
 }
 
 export async function runRuntime(settings) {

package/bin/network.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { DEFAULT_LISTENER_POLL_MS } from "./sdk/listener.js";
 import { parseArgs, stripVTControlCharacters } from "node:util";
 import { readFile, stat } from "node:fs/promises";
@@ -210,6 +211,7 @@ export async function networkMain(args) {
       if (secret)
         throw new Error("Set only one of TOTEM_NETWORK_API_KEY and TOTEM_NETWORK_API_KEY_FILE.");
       const path = process.env.TOTEM_NETWORK_API_KEY_FILE;
+      await assertWindowsPrivatePath(path);
       const info = await stat(path);
       if (
         !info.isFile() ||

package/bin/observability.mjs

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { readPrivateRuntimeJson } from "./mission-agent-session.mjs";
+import { isCredentialField, redactCredentialText } from "./sdk/credential-redaction.js";
 
 const context = new AsyncLocalStorage();
 const capabilities = new WeakMap();
@@ -13,23 +14,7 @@ const failureCode = (error, fallback) =>
 /** Export data-plane text only. Never pass request headers or provider configuration here. */
 export function redactObservation(value, depth = 0) {
   if (depth > 8) return "[depth limit]";
-  if (typeof value === "string")
-    return value
-      .replace(
-        /\b(?:tn_(?:live|test)_[A-Za-z0-9_-]{20,}|sk-(?:ant-)?[A-Za-z0-9_-]{16,}|AKIA[A-Z0-9]{16})\b/g,
-        "[credential redacted]",
-      )
-      .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+\/-]+=*/gi, "[authorization redacted]")
-      .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[token redacted]")
-      .replace(
-        /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g,
-        "[private key redacted]",
-      )
-      .replace(
-        /((?:["']?)(?:[A-Z0-9_]*secret[A-Z0-9_]*|[A-Z0-9_]*password|api[_ -]?(?:key|token)|access[_ -]?token|AWS_SESSION_TOKEN|authorization)(?:["']?)\s*[=:]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;"'}]+)/gi,
-        "$1[redacted]",
-      )
-      .slice(0, MAX_TEXT);
+  if (typeof value === "string") return redactCredentialText(value).slice(0, MAX_TEXT);
   if (Array.isArray(value))
     return value.slice(0, 80).map((item) => redactObservation(item, depth + 1));
   if (value && typeof value === "object")
@@ -37,10 +22,9 @@ export function redactObservation(value, depth = 0) {
       Object.entries(value)
         .slice(0, 80)
         .map(([key, item]) => [
-          key,
-          /(?:authorization|password|secret|api[_-]?(?:key|token)|access[_-]?token|AWS_SESSION_TOKEN|leaseToken)/i.test(
-            key,
-          )
+          redactCredentialText(key),
+          // Session IDs on observation records are correlation metadata, never auth sessions.
+          isCredentialField(key) && !(depth === 0 && key === "sessionId")
             ? "[redacted]"
             : redactObservation(item, depth + 1),
         ]),

package/bin/runtime-installation.mjs

@@ -1,3 +1,4 @@
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { constants } from "node:fs";
@@ -15,6 +16,7 @@ export function runtimeRoot(env = process.env) {
 }
 export async function privateDirectory(path) {
   await mkdir(path, { recursive: true, mode: 0o700 });
+  await assertWindowsPrivatePath(path);
   const info = await lstat(path);
   if (
     !info.isDirectory() ||
@@ -25,6 +27,7 @@ export async function privateDirectory(path) {
     throw new Error("The runtime directory must be private and owned by this user.");
 }
 export async function privateRead(path) {
+  await assertWindowsPrivatePath(path);
   const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
   try {
     const info = await handle.stat();
@@ -50,6 +53,7 @@ export async function privateWrite(path, value) {
     0o600,
   );
   try {
+    await assertWindowsPrivatePath(temporary);
     await handle.writeFile(JSON.stringify(value));
     await handle.sync();
   } finally {
@@ -188,9 +192,11 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { spawn } from 'node:child_process';
 import { setTimeout as delay } from 'node:timers/promises';
+import { assertWindowsPrivatePath } from './windows-private-path.mjs';
 const entry = fileURLToPath(import.meta.url);
 const root = dirname(entry);
 const file = join(root, 'current.json');
+await assertWindowsPrivatePath(file);
 const info = await lstat(file);
 if (info.isSymbolicLink() || (process.getuid && info.uid !== process.getuid()) || (process.platform !== 'win32' && (info.mode & 511) !== 384)) throw Error('Unsafe runtime installation');
 const { version } = JSON.parse(await readFile(file, 'utf8'));
@@ -247,6 +253,10 @@ if (process.env.TOTEM_RUNTIME_ENV_LOADED === entry) {
 }
 `;
   for (const [path, contents] of [
+    [
+      join(runtime, "windows-private-path.mjs"),
+      await readFile(new URL("./windows-private-path.mjs", import.meta.url), "utf8"),
+    ],
     [cli, launcher("totem.mjs")],
     [supervisor, launcher("automatic-runtime.mjs")],
   ]) {
@@ -256,6 +266,7 @@ if (process.env.TOTEM_RUNTIME_ENV_LOADED === entry) {
       0o600,
     );
     try {
+      await assertWindowsPrivatePath(path);
       await handle.writeFile(contents);
     } finally {
       await handle.close();

package/bin/sdk/credential-redaction.js

@@ -0,0 +1 @@
+const CREDENTIAL_TOKEN_PATTERN=/\b(?:(?:tn|at)_(?:live|test)_[A-Za-z0-9_-]{8,}|t[acr]_[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|sk-(?:proj-|svcacct-|ant-)?[A-Za-z0-9_-]{16,}|(?:AKIA|ASIA)[A-Z0-9]{16}|[rs]k_(?:live|test)_[A-Za-z0-9]{8,}|xox[a-z][.-][A-Za-z0-9.-]{10,}|xapp-[A-Za-z0-9-]{12,})\b/g;function isCredentialField(key){const normalized=key.replace(/[^a-z0-9]/gi,"").toLowerCase();return/(?:authorization|authentication|password|passwd|secret|apikey|apitoken|accesstoken|refreshtoken|sessiontoken|sessionid|sessionkey|sessioncookie|cookie|leasetoken|privatekey)/.test(normalized)||normalized==="token"}function redactCredentialText(value){return value.replace(/(\b(?:set[-_ ]?cookie|cookie)\s*[:=]\s*)[^\r\n]*/gi,"$1[redacted]").replace(CREDENTIAL_TOKEN_PATTERN,"[credential redacted]").replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+\/-]+=*/gi,"[authorization redacted]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,"[token redacted]").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g,"[private key redacted]").replace(/(["']?(?:[A-Z0-9_]*secret[A-Z0-9_]*|[A-Z0-9_]*password|api[_ -]?(?:key|token)|(?:access|refresh|session)[_ -]?(?:token|key|id|cookie)|(?:set[_ -]?)?cookie|AWS_SESSION_TOKEN|authorization|authentication|token)["']?\s*[=:]\s*)(?:"(?:\\.|[^"\\])*(?:"|$)|'(?:\\.|[^'\\])*(?:'|$)|[^\r\n,;"'}]+)/gi,"$1[redacted]")}export{CREDENTIAL_TOKEN_PATTERN,isCredentialField,redactCredentialText};

package/bin/sdk/transport.js

@@ -1 +1 @@
-import{apiError,TotemCanceledError,TotemError,TotemNetworkError,TotemTimeoutError}from"./errors.js";function idempotencyKey(){return globalThis.crypto.randomUUID()}function sleep(ms,signal){return new Promise((resolve,reject)=>{const cancel=()=>{clearTimeout(timer);signal?.removeEventListener("abort",cancel);reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};const timer=setTimeout(()=>{signal?.removeEventListener("abort",cancel);resolve()},ms);signal?.addEventListener("abort",cancel,{once:true});if(signal?.aborted)cancel()})}class Transport{#apiKey;#baseUrl;#fetch;#timeoutMs;#maxRetries;#retryDelayMs;#responseEnvelope;constructor(options,api=void 0){if(!options.apiKey?.trim())throw new TotemError("An agent API key is required.",{code:"INVALID_CONFIG"});const url=new URL(options.baseUrl??"https://totemlayer.com");const loopback=["localhost","127.0.0.1","[::1]"].includes(url.hostname);if(url.protocol!=="https:"&&!(url.protocol==="http:"&&loopback)||url.username||url.password||url.search||url.hash||url.pathname!=="/"){throw new TotemError("baseUrl must be an HTTPS origin or a local HTTP origin.",{code:"INVALID_CONFIG"})}this.#apiKey=options.apiKey;this.#baseUrl=`${url.origin}${api?.basePath??"/api/v1/network"}`;this.#responseEnvelope=api?.responseEnvelope??"data";this.#fetch=options.fetch??globalThis.fetch.bind(globalThis);this.#timeoutMs=options.timeoutMs??15e3;this.#maxRetries=options.maxRetries??2;this.#retryDelayMs=options.retryDelayMs??250;if(!Number.isFinite(this.#timeoutMs)||this.#timeoutMs<1||!Number.isInteger(this.#maxRetries)||this.#maxRetries<0||this.#maxRetries>10||!Number.isFinite(this.#retryDelayMs)||this.#retryDelayMs<0){throw new TotemError("Invalid timeout or retry configuration.",{code:"INVALID_CONFIG"})}}async request(method,path,options={}){const url=new URL(`${this.#baseUrl}${path}`);for(const[key,value]of Object.entries(options.query??{})){if(value!==void 0&&value!==null)url.searchParams.set(key,String(value))}const retrySafe=method==="GET"||options.retrySafe===true||Boolean(options.idempotencyKey);const body=options.binaryBody??(options.body===void 0?void 0:JSON.stringify(options.body));const headers={Authorization:`Bearer ${this.#apiKey}`,Accept:"application/json",...body===void 0||options.binaryBody?{}:{"Content-Type":"application/json"},...options.idempotencyKey?{"Idempotency-Key":options.idempotencyKey}:{},...options.headers??{}};for(let attempt=0;;attempt++){if(options.signal?.aborted)throw new TotemCanceledError("Totem request canceled.",{code:"CANCELED"});const controller=new AbortController;let timer;let cancel;let retryAfter=null;try{const aborted=new Promise((_,reject)=>{cancel=()=>{controller.abort();reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};options.signal?.addEventListener("abort",cancel,{once:true});if(options.signal?.aborted)cancel();timer=setTimeout(()=>{controller.abort();reject(new TotemTimeoutError("Totem request timed out.",{code:"TIMEOUT"}))},this.#timeoutMs)});const response=(async()=>{const result=await this.#fetch(url.toString(),{method,headers,body:body instanceof Uint8Array?new Uint8Array(body):body,signal:controller.signal,redirect:"error",cache:"no-store"});retryAfter=result.headers.get("Retry-After");const requestId=result.headers.get("X-Request-Id")??void 0;let payload;try{payload=await result.json()}catch{if(!result.ok)throw apiError(result.status,void 0,requestId);throw new TotemError("Totem returned invalid JSON.",{code:"INVALID_RESPONSE",requestId})}if(!result.ok)throw apiError(result.status,payload,requestId);if(!payload||typeof payload!=="object"||Array.isArray(payload)||this.#responseEnvelope==="data"&&!("data"in payload)){throw new TotemError("Totem returned an invalid response envelope.",{code:"INVALID_RESPONSE",requestId})}return payload})();return await Promise.race([response,aborted])}catch(cause){const error=cause instanceof TotemError?cause:new TotemNetworkError("Unable to reach Totem.",{code:"NETWORK_ERROR",cause});const transient=error instanceof TotemNetworkError||error instanceof TotemTimeoutError||error.status!==void 0&&[408,429,500,502,503,504].includes(error.status);if(!retrySafe||!transient||attempt>=this.#maxRetries)throw error;clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel);const seconds=retryAfter===null?NaN:Number(retryAfter);const parsedDate=retryAfter===null?NaN:Date.parse(retryAfter);const requestedDelay=Number.isFinite(seconds)?seconds*1e3:parsedDate-Date.now();const fallback=this.#retryDelayMs*2**attempt*(.75+Math.random()*.5);await sleep(Math.min(3e4,Math.max(0,Number.isFinite(requestedDelay)?requestedDelay:fallback)),options.signal)}finally{clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel)}}}async download(path,options={}){const signal=AbortSignal.any([options.signal,AbortSignal.timeout(this.#timeoutMs)].filter(Boolean));let response;try{response=await this.#fetch(`${this.#baseUrl}${path}`,{method:"GET",headers:{Authorization:`Bearer ${this.#apiKey}`},signal,redirect:"error",cache:"no-store"})}catch(cause){throw new TotemNetworkError("Unable to download the attachment.",{code:"NETWORK_ERROR",cause})}if(!response.ok){const payload=await response.json().catch(()=>void 0);throw apiError(response.status,payload,response.headers.get("x-request-id")??void 0)}const reported=Number(response.headers.get("content-length"));if(reported>2*1024*1024)throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"});const bytes=new Uint8Array(await response.arrayBuffer());if(bytes.byteLength>2*1024*1024)throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"});const disposition=response.headers.get("content-disposition")??"";const encoded=disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];return{bytes,mediaType:response.headers.get("content-type")??"application/octet-stream",name:encoded?decodeURIComponent(encoded):"attachment",sha256:response.headers.get("x-content-sha256")}}}export{Transport,idempotencyKey,sleep};
+import{apiError,TotemCanceledError,TotemError,TotemNetworkError,TotemTimeoutError}from"./errors.js";function idempotencyKey(){return globalThis.crypto.randomUUID()}function sleep(ms,signal){return new Promise((resolve,reject)=>{const cancel=()=>{clearTimeout(timer);signal?.removeEventListener("abort",cancel);reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};const timer=setTimeout(()=>{signal?.removeEventListener("abort",cancel);resolve()},ms);signal?.addEventListener("abort",cancel,{once:true});if(signal?.aborted)cancel()})}class Transport{#apiKey;#baseUrl;#fetch;#timeoutMs;#maxRetries;#retryDelayMs;#responseEnvelope;constructor(options,api=void 0){if(!options.apiKey?.trim())throw new TotemError("An agent API key is required.",{code:"INVALID_CONFIG"});const url=new URL(options.baseUrl??"https://totemlayer.com");const loopback=["localhost","127.0.0.1","[::1]"].includes(url.hostname);if(url.protocol!=="https:"&&!(url.protocol==="http:"&&loopback)||url.username||url.password||url.search||url.hash||url.pathname!=="/"){throw new TotemError("baseUrl must be an HTTPS origin or a local HTTP origin.",{code:"INVALID_CONFIG"})}this.#apiKey=options.apiKey;this.#baseUrl=`${url.origin}${api?.basePath??"/api/v1/network"}`;this.#responseEnvelope=api?.responseEnvelope??"data";this.#fetch=options.fetch??globalThis.fetch.bind(globalThis);this.#timeoutMs=options.timeoutMs??15e3;this.#maxRetries=options.maxRetries??2;this.#retryDelayMs=options.retryDelayMs??250;if(!Number.isFinite(this.#timeoutMs)||this.#timeoutMs<1||!Number.isInteger(this.#maxRetries)||this.#maxRetries<0||this.#maxRetries>10||!Number.isFinite(this.#retryDelayMs)||this.#retryDelayMs<0){throw new TotemError("Invalid timeout or retry configuration.",{code:"INVALID_CONFIG"})}}async request(method,path,options={}){const url=new URL(`${this.#baseUrl}${path}`);for(const[key,value]of Object.entries(options.query??{})){if(value!==void 0&&value!==null)url.searchParams.set(key,String(value))}const retrySafe=method==="GET"||options.retrySafe===true||Boolean(options.idempotencyKey);const body=options.binaryBody??(options.body===void 0?void 0:JSON.stringify(options.body));const headers={Authorization:`Bearer ${this.#apiKey}`,Accept:"application/json",...body===void 0||options.binaryBody?{}:{"Content-Type":"application/json"},...options.idempotencyKey?{"Idempotency-Key":options.idempotencyKey}:{},...options.headers??{}};for(let attempt=0;;attempt++){if(options.signal?.aborted)throw new TotemCanceledError("Totem request canceled.",{code:"CANCELED"});const controller=new AbortController;let timer;let cancel;let retryAfter=null;try{const aborted=new Promise((_,reject)=>{cancel=()=>{controller.abort();reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};options.signal?.addEventListener("abort",cancel,{once:true});if(options.signal?.aborted)cancel();timer=setTimeout(()=>{controller.abort();reject(new TotemTimeoutError("Totem request timed out.",{code:"TIMEOUT"}))},this.#timeoutMs)});const response=(async()=>{const result=await this.#fetch(url.toString(),{method,headers,body:body instanceof Uint8Array?new Uint8Array(body):body,signal:controller.signal,redirect:"error",cache:"no-store"});retryAfter=result.headers.get("Retry-After");const requestId=result.headers.get("X-Request-Id")??void 0;let payload;try{payload=await result.json()}catch{if(!result.ok)throw apiError(result.status,void 0,requestId);throw new TotemError("Totem returned invalid JSON.",{code:"INVALID_RESPONSE",requestId})}if(!result.ok)throw apiError(result.status,payload,requestId);if(!payload||typeof payload!=="object"||Array.isArray(payload)||this.#responseEnvelope==="data"&&!("data"in payload)){throw new TotemError("Totem returned an invalid response envelope.",{code:"INVALID_RESPONSE",requestId})}return payload})();return await Promise.race([response,aborted])}catch(cause){const error=cause instanceof TotemError?cause:new TotemNetworkError("Unable to reach Totem.",{code:"NETWORK_ERROR",cause});const transient=error instanceof TotemNetworkError||error instanceof TotemTimeoutError||error.status!==void 0&&[408,429,500,502,503,504].includes(error.status);if(!retrySafe||!transient||attempt>=this.#maxRetries)throw error;clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel);const seconds=retryAfter===null?NaN:Number(retryAfter);const parsedDate=retryAfter===null?NaN:Date.parse(retryAfter);const requestedDelay=Number.isFinite(seconds)?seconds*1e3:parsedDate-Date.now();const fallback=this.#retryDelayMs*2**attempt*(.75+Math.random()*.5);await sleep(Math.min(3e4,Math.max(0,Number.isFinite(requestedDelay)?requestedDelay:fallback)),options.signal)}finally{clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel)}}}async download(path,options={}){const signal=AbortSignal.any([options.signal,AbortSignal.timeout(this.#timeoutMs)].filter(Boolean));let response;try{response=await this.#fetch(`${this.#baseUrl}${path}`,{method:"GET",headers:{Authorization:`Bearer ${this.#apiKey}`},signal,redirect:"error",cache:"no-store"})}catch(cause){throw new TotemNetworkError("Unable to download the attachment.",{code:"NETWORK_ERROR",cause})}if(!response.ok){const payload=await response.json().catch(()=>void 0);throw apiError(response.status,payload,response.headers.get("x-request-id")??void 0)}const reported=Number(response.headers.get("content-length"));if(reported>2*1024*1024){await response.body?.cancel().catch(()=>{});throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"})}const reader=response.body?.getReader();const chunks=[];let size=0;if(reader){try{for(;;){const{done,value}=await reader.read();if(done)break;size+=value.byteLength;if(size>2*1024*1024){await reader.cancel().catch(()=>{});throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"})}chunks.push(value)}}finally{reader.releaseLock()}}const bytes=new Uint8Array(size);let offset=0;for(const chunk of chunks){bytes.set(chunk,offset);offset+=chunk.byteLength}const disposition=response.headers.get("content-disposition")??"";const encoded=disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];return{bytes,mediaType:response.headers.get("content-type")??"application/octet-stream",name:encoded?decodeURIComponent(encoded):"attachment",sha256:response.headers.get("x-content-sha256")}}}export{Transport,idempotencyKey,sleep};

package/bin/setup-assets/api-manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.74","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}
+{"version":1,"packageVersion":"0.1.76","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}

package/bin/setup-assets/manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.74","bytes":36144,"sha256":"a5115bdc86d08737eba0510aab110dd28f583e3ec24aa84f389c9f017a7c5cae"}
+{"version":1,"packageVersion":"0.1.76","bytes":36144,"sha256":"66535754c594ad559c91b68c93348ec5579f10a0d791c462cecf98cb618ea2ae"}

package/bin/setup-assets/setup.backup.md

@@ -39,10 +39,10 @@ Use an actual native user-message tool if available and wait for delivery. Other
 Run on the actual command-capable agent host, from the intended native session:
 
 ~~~sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz totem install
 ~~~
 
-This command pins release **0.1.74**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
+This command pins release **0.1.76**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
 
 The command verifies the full bundled guide against its byte length/SHA-256 manifest, with a complete alternate copy. `totem install --read-guide` prints it without setup changes. Corrupt/incomplete required guides are a hard stop. The native adapter must verify the current model and unchanged host permissions, exact session, intended identity, transport and current credential generation. “default” or a guessed model is not evidence. There is no force-success, skip-tests, model-supplied proof or arbitrary adapter-script URL.
 

package/bin/setup-assets/setup.md

@@ -39,10 +39,10 @@ Use an actual native user-message tool if available and wait for delivery. Other
 Run on the actual command-capable agent host, from the intended native session:
 
 ~~~sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.74.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz totem install
 ~~~
 
-This command pins release **0.1.74**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
+This command pins release **0.1.76**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
 
 The command verifies the full bundled guide against its byte length/SHA-256 manifest, with a complete alternate copy. `totem install --read-guide` prints it without setup changes. Corrupt/incomplete required guides are a hard stop. The native adapter must verify the current model and unchanged host permissions, exact session, intended identity, transport and current credential generation. “default” or a guessed model is not evidence. There is no force-success, skip-tests, model-supplied proof or arbitrary adapter-script URL.
 

package/bin/strict-codex-adapter.mjs

@@ -15,6 +15,8 @@ import { runtimeRoot, privateRead, privateWrite } from "./runtime-installation.m
 import { readReleaseSetupGuide } from "./setup-guide.mjs";
 import { prepareSetupTests, readSetupTests } from "./setup-receipts.mjs";
 import { defaultCodexQueue } from "./codex-chat-bridge.mjs";
+import { installedClientInvocation, localClientEnvironment } from "./platform-client.mjs";
+import { validOrganizationId } from "./strict-setup.mjs";
 
 const execute = promisify(execFile);
 const fail = (code) => {
@@ -125,7 +127,7 @@ export function createStrictCodexAdapter(flags, options = {}) {
           own.id !== saved.agentId ||
           own.address !== saved.address ||
           own.environment !== saved.environment ||
-          !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(own.organization?.id ?? "")
+          !validOrganizationId(own.organization?.id)
         )
           fail("AGENT_IDENTITY_MISMATCH");
         const checked = await snapshot();
@@ -190,18 +192,15 @@ export function createStrictCodexAdapter(flags, options = {}) {
     readGuide: options.readGuide ?? readReleaseSetupGuide,
     async inspect(readOnly = false) {
       host = await snapshot();
-      const result = await (options.execute ?? execute)("codex", ["mcp", "list", "--json"], {
-        env: inherited,
+      const invocation = installedClientInvocation("codex", ["mcp", "list", "--json"], inherited);
+      const pending = (options.execute ?? execute)(invocation.command, invocation.args, {
+        env: localClientEnvironment(inherited),
         encoding: "utf8",
         timeout: 5000,
         maxBuffer: 65536,
-      }).catch((error) => {
-        if (
-          /no mcp server|not found|does not exist/i.test(
-            `${error.stdout ?? ""}\n${error.stderr ?? ""}`,
-          )
-        )
-          return null;
+      });
+      pending.child?.stdin?.end();
+      const result = await pending.catch(() => {
         fail("MCP_SETTINGS_UNVERIFIED");
       });
       if (result) {

package/bin/strict-setup.mjs

@@ -17,6 +17,9 @@ const token = (value) =>
   typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,319}$/.test(value);
 const uuid = (value) =>
   typeof value === "string" && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(value);
+export const validOrganizationId = (value) =>
+  uuid(value) ||
+  (typeof value === "string" && /^org_(?:[A-Za-z0-9_-]{24}|personal_[a-f0-9]{20})$/.test(value));
 const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 const stop = (code) => {
   throw Object.assign(new Error(code), { code });
@@ -26,7 +29,7 @@ export function setupBinding(identity, host, transport, connection) {
   if (
     !uuid(identity?.id) ||
     !token(identity.address) ||
-    !uuid(identity.organization?.id) ||
+    !validOrganizationId(identity.organization?.id) ||
     !["PRODUCTION", "SANDBOX"].includes(identity.environment) ||
     !token(host?.name) ||
     !token(host.model) ||
@@ -245,6 +248,7 @@ export async function runStrictSetup(adapter, options = {}) {
     if (
       expected &&
       (identity?.id !== expected.id ||
+        identity.address !== expected.address ||
         identity.environment !== expected.environment ||
         (expected.organization?.id && identity.organization?.id !== expected.organization.id))
     )

package/bin/windows-private-path.mjs

@@ -0,0 +1,89 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { join, resolve } from "node:path";
+import { lstat } from "node:fs/promises";
+
+const execute = promisify(execFile);
+export function validateWindowsPrivateAcl(snapshot) {
+  const sid = snapshot?.sid;
+  if (typeof sid !== "string" || !/^S-1-(?:\d+-){1,14}\d+$/.test(sid))
+    throw new Error("The Windows account SID could not be verified.");
+  const trusted = new Set([sid, "S-1-5-18", "S-1-5-32-544"]);
+  const trustedAncestors = new Set([
+    ...trusted,
+    "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
+  ]);
+  if (
+    snapshot.owner !== sid ||
+    snapshot.reparse ||
+    !Array.isArray(snapshot.rules) ||
+    !Array.isArray(snapshot.ancestors)
+  )
+    throw new Error("The private Windows path has an unsafe owner or reparse point.");
+  let readable = false;
+  for (const rule of snapshot.rules) {
+    if (
+      !Number.isSafeInteger(rule.rights) ||
+      rule.rights < 0 ||
+      !["Allow", "Deny"].includes(rule.type)
+    )
+      throw new Error("The Windows access rules could not be verified.");
+    if (rule.type === "Allow" && !trusted.has(rule.sid))
+      throw new Error("The private Windows path grants access to another principal.");
+    if (rule.type === "Allow" && rule.sid === sid && (rule.rights & 131073) === 131073)
+      readable = true;
+    if (rule.type === "Deny" && rule.sid === sid && rule.rights & 131073)
+      throw new Error("The private Windows path denies required owner access.");
+  }
+  if (
+    !readable ||
+    snapshot.ancestors.some(
+      (parent) =>
+        parent.reparse ||
+        !trustedAncestors.has(parent.owner) ||
+        !Array.isArray(parent.rules) ||
+        parent.rules.some(
+          (rule) =>
+            !rule.inheritOnly &&
+            rule.type === "Allow" &&
+            !trustedAncestors.has(rule.sid) &&
+            (rule.rights & (64 | 65536 | 262144 | 524288)) !== 0,
+        ),
+    )
+  )
+    throw new Error("The private Windows path or its parent can be replaced by another principal.");
+}
+
+export async function assertWindowsPrivatePath(path) {
+  if (process.platform !== "win32") return;
+  await lstat(path); // Preserve ENOENT for callers that create a new private file.
+  const encoded = Buffer.from(resolve(path), "utf8").toString("base64");
+  const script = `$ErrorActionPreference='Stop'
+$path=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}'))
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+function Rules($acl) { @($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]) | ForEach-Object { @{sid=$_.IdentityReference.Value;rights=[int64]$_.FileSystemRights;type=$_.AccessControlType.ToString();inheritOnly=[bool]($_.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly)} }) }
+$item=Get-Item -LiteralPath $path -Force
+$acl=Get-Acl -LiteralPath $path
+$parents=@(); $parent=Split-Path -LiteralPath $path
+while ($parent) {
+  $p=Get-Item -LiteralPath $parent -Force
+  $parentAcl=Get-Acl -LiteralPath $parent
+  $parents+=@{owner=$parentAcl.GetOwner([Security.Principal.SecurityIdentifier]).Value;reparse=[bool]($p.Attributes -band [IO.FileAttributes]::ReparsePoint);rules=@(Rules $parentAcl)}
+  $next=Split-Path -LiteralPath $parent
+  if ($next -eq $parent) { break }; $parent=$next
+}
+@{sid=$sid;owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;reparse=[bool]($item.Attributes -band [IO.FileAttributes]::ReparsePoint);rules=@(Rules $acl);ancestors=$parents} | ConvertTo-Json -Depth 8 -Compress`;
+  const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
+  if (!systemRoot) throw new Error("The Windows system directory could not be verified.");
+  const { stdout } = await execute(
+    join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64"),
+    ],
+    { timeout: 10000, maxBuffer: 262144, windowsHide: true },
+  );
+  validateWindowsPrivateAcl(JSON.parse(stdout.replace(/^\uFEFF/, "")));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "description": "Cross-platform CLI for TotemLayer agent identity and authorization",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "@modelcontextprotocol/client": "2.3.0",
     "@modelcontextprotocol/server": "2.3.0",
     "undici": "7.30.1",
-    "zod": "4.6.6"
+    "zod": "4.6.7"
   },
   "scripts": {
     "postinstall": "node bin/installation.mjs --postinstall",