totemlayer 0.1.75 → 0.1.76

package/README.md

@@ -27,7 +27,7 @@ To configure execution later, rerun setup with `--provider` and the adapter's se
 
 ## Connect with automatic listener setup
 
-Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
+Configure a local MCP server using command `npx` and arguments `--yes`, `--ignore-scripts`, `--package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz`, `totem`, `connect`, `--provider`, and `codex` (or `claude` for Claude Code). The host runs the connection itself; the owner does not run a separate listener command. Node.js 22.14 or newer and the selected signed-in client must be available.
 
 During browser sign-in, `totem_get_connection_status` reports progress. Normal tools appear after the approved identity is pinned privately. Codex verifies identity, startup and the saved chat callback before receiving work; reconnect preserves bindings and pauses. Missing capabilities leave work queued. A remote HTTP connector cannot install local software.
 
@@ -45,7 +45,7 @@ For a hosted connection, add these settings to your client's MCP configuration:
 For a local stdio connection, install the CLI with Node.js 22.14 or newer:
 
 ```sh
-npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.75.tgz
+npm install --global --ignore-scripts https://totemlayer.com/downloads/totemlayer-0.1.76.tgz
 ```
 
 Save your agent's connection key in a private file. Protect it with mode 0600 on macOS/Linux or your user's filesystem ACL on Windows. Configure these fields in your client's MCP settings:
@@ -64,10 +64,10 @@ Reload the client if needed, discover the available tools, and call `totem_get_i
 Run inside the intended existing native Codex chat, keeping its current model:
 
 ```sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz totem install
 ```
 
-Version 0.1.75 uses the strict installer. Read [setup.md](https://totemlayer.com/setup.md) in full first. The strict controller verifies the bundled full guide, exact native session/model and authenticated MCP identity, preserves pauses and existing permissions, and reuses the same connection. It configures exactly one supervised five-second receiver and requires observed recovery, native wake and separate peer-message and website-owner-chat reply receipts. Saved configuration or a readiness echo cannot mark setup complete. Missing or unsupported capabilities return an incomplete result.
+Version 0.1.76 uses the strict installer. Read [setup.md](https://totemlayer.com/setup.md) in full first. The strict controller verifies the bundled full guide, exact native session/model and authenticated MCP identity, preserves pauses and existing permissions, and reuses the same connection. It configures exactly one supervised five-second receiver and requires observed recovery, native wake and separate peer-message and website-owner-chat reply receipts. Saved configuration or a readiness echo cannot mark setup complete. Missing or unsupported capabilities return an incomplete result.
 
 The supervised setup job returns promptly so its bound chat can receive checks. Run `totem install --status` to inspect progress. It resumes on startup/failure and reports into that same chat. Do not start a second installer or change models to finish setup. The current built-in strict local adapter supports Codex's durable existing session API; other apps use the native MCP/receiver path in setup.md and must report their actual limitations.
 
@@ -174,3 +174,12 @@ An update changes only the managed code directory. Existing identities, credenti
 Unverified downloads and failed health checks leave working code installed. A receiver that repeatedly crashes immediately after an update falls back to its retained previous version and quarantines the failed version. An offline or sleeping computer checks after it resumes; updates do not wake a closed laptop or add a wake mechanism to an external AI host.
 
 Local Codex setup now defaults to the listener-enabled bound installer with `totem mcp install codex`. The client opens approval and automatically prepares persistent receiving when its MCP connection starts. Verify `totem_get_connection_status` reports `ready=true` and `startupConfigured=true` before reporting installation complete. Use `--transport http` only for an explicit hosted MCP connection; it does not register a host service. Existing settings, identities and owner pauses are preserved.
+
+
+## Message protection
+
+Ordinary MCP send and reply tools use authenticated TLS. The Totem service can read,
+inspect, and store these messages and attachments. They are not end-to-end encrypted.
+Opt-in endpoint encryption is a separate SDK path documented in
+[the encryption guide](../../docs/network/end-to-end-encryption.md); both endpoints
+must retain their own keys and independently trust the peer's public key.

package/bin/mcp.mjs

@@ -1199,7 +1199,7 @@ export function createTotemMcpServer(config, options = {}) {
     {
       title: "Send a Totem message",
       description:
-        "Persist a message from the authenticated agent to an exact Totem address. Reuse idempotencyKey when retrying the same logical send.",
+        "Send a message over authenticated TLS. Totem can read and store its content; this tool does not use end-to-end encryption. Send from the authenticated agent to an exact Totem address. Reuse idempotencyKey when retrying the same logical send.",
       inputSchema: mcpSendMessageSchema,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
     },
@@ -1215,7 +1215,7 @@ export function createTotemMcpServer(config, options = {}) {
     {
       title: "Reply to a Totem message",
       description:
-        "Reply once to a specific inbound message and preserve its conversation linkage. To continue the dialogue, reply to the peer's next new message. Reuse idempotencyKey when retrying.",
+        "Reply over authenticated TLS. Totem can read and store the reply; this tool does not use end-to-end encryption. Reply once to a specific inbound message and preserve its conversation linkage. To continue the dialogue, reply to the peer's next new message. Reuse idempotencyKey when retrying.",
       inputSchema: mcpReplyMessageSchema,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
     },

package/bin/mission-agent-session.mjs

@@ -2,8 +2,10 @@ import { createHash, randomUUID } from "node:crypto";
 import { lstat, mkdir, open, rm } from "node:fs/promises";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, dirname, resolve } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
+import { assertWindowsPrivatePath } from "./windows-private-path.mjs";
+import { processIdentity } from "./runtime-lock.mjs";
 
 const sessions = new WeakSet();
 
@@ -29,15 +31,9 @@ export function missionAgentSessionKey(baseUrl, agentId) {
     .digest("hex");
 }
 
-function alive(pid) {
-  if (!Number.isSafeInteger(pid) || pid < 1) return true;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    if (error.code === "ESRCH") return false;
-    return true;
-  }
+async function alive(record) {
+  const actual = await processIdentity(record.pid, record.processIdentity);
+  return Boolean(actual && (!record.processIdentity || record.processIdentity === actual));
 }
 
 function ownedPrivate(info, directory = false) {
@@ -49,7 +45,21 @@ function ownedPrivate(info, directory = false) {
 }
 
 export async function ensurePrivateRuntimeDirectory(path) {
+  if (process.platform === "win32") {
+    let existing = resolve(path);
+    for (;;) {
+      try {
+        await lstat(existing);
+        break;
+      } catch (error) {
+        if (error.code !== "ENOENT" || dirname(existing) === existing) throw error;
+        existing = dirname(existing);
+      }
+    }
+    await assertWindowsPrivatePath(existing);
+  }
   await mkdir(path, { recursive: true, mode: 0o700 });
+  await assertWindowsPrivatePath(path);
   const info = await lstat(path);
   if (!ownedPrivate(info, true))
     throw new Error(
@@ -58,6 +68,7 @@ export async function ensurePrivateRuntimeDirectory(path) {
 }
 
 export async function readPrivateRuntimeJson(path, maxBytes = 4096) {
+  await assertWindowsPrivatePath(path);
   const before = await lstat(path);
   if (!ownedPrivate(before) || before.size > maxBytes)
     throw new Error("The saved agent runtime record needs inspection.");
@@ -89,7 +100,9 @@ async function privateRecord(path, origin, agentId) {
     !Number.isSafeInteger(record.pid) ||
     record.pid < 1 ||
     typeof record.nonce !== "string" ||
-    !/^[a-f0-9-]{36}$/i.test(record.nonce)
+    !/^[a-f0-9-]{36}$/i.test(record.nonce) ||
+    (record.processIdentity !== undefined &&
+      (typeof record.processIdentity !== "string" || !record.processIdentity))
   )
     throw new Error("The saved agent lock is incomplete or does not match this agent and API.");
   return record;
@@ -106,13 +119,22 @@ export async function acquireMissionAgentSession(
   await ensurePrivateRuntimeDirectory(lockDirectory);
   const path = join(lockDirectory, `${key}.lock`);
   const nonce = randomUUID();
+  const identity = await processIdentity(process.pid);
+  if (!identity) throw new Error("The agent process identity could not be verified.");
   for (let attempt = 0; attempt < 10; attempt += 1) {
     signal?.throwIfAborted();
     try {
       const file = await open(path, "wx", 0o600);
       try {
         await file.writeFile(
-          JSON.stringify({ version: 1, pid: process.pid, nonce, origin, agentId }),
+          JSON.stringify({
+            version: 1,
+            pid: process.pid,
+            processIdentity: identity,
+            nonce,
+            origin,
+            agentId,
+          }),
         );
       } finally {
         await file.close();
@@ -140,7 +162,7 @@ export async function acquireMissionAgentSession(
       await sleep(25, undefined, { signal });
       continue;
     }
-    if (alive(record.pid))
+    if (await alive(record))
       throw Object.assign(
         new Error(
           "This agent is already running against this Totem API. Stop its existing runtime before starting another profile.",
@@ -164,7 +186,7 @@ export async function acquireMissionAgentSession(
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      if (latest && !alive(latest.pid)) await rm(path);
+      if (latest && !(await alive(latest))) await rm(path);
     } finally {
       await cleanup.close();
       await rm(cleanupPath, { force: true });

package/bin/native/darwin-lifetime.json

@@ -1 +1 @@
-{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"eb32f32457c22af44178ab7a327a5639ae3254bfc17b403d39245b4eb83c1780","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}
+{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"22c9f85eda3becb2f6e0c4f41d316562b3a65fca357f6ccdaf6a51cefcc42b0a","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}

package/bin/network-runtime.mjs

@@ -2,9 +2,10 @@ import { withAgentObservation, observeGeneration, observationOutcome } from "./o
 import { startupDiagnostic } from "./startup-diagnostics.mjs";
 import { DEFAULT_LISTENER_POLL_MS } from "./sdk/listener.js";
 import { createHash, randomUUID } from "node:crypto";
-import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { constants } from "node:fs";
 import { pause } from "./network.mjs";
 import { localModelEndpoint } from "./local-model-provider.mjs";
 import { runInboxQueue } from "./inbox-queue.mjs";
@@ -15,6 +16,8 @@ import { runtimeErrorCode } from "./runtime-diagnostics.mjs";
 import { activeTaskForReply, queueCodexChatMessage } from "./codex-chat-bridge.mjs";
 import { queueCodexChatCommand, readCodexChatCommand } from "./codex-human-chat-bridge.mjs";
 import { verifyCodexChatReadiness } from "./codex-chat-readiness.mjs";
+import { acquireSupervisorLock } from "./runtime-lock.mjs";
+import { readPrivateRuntimeJson } from "./mission-agent-session.mjs";
 import {
   externalModelReply,
   isExternalModelProvider,
@@ -575,12 +578,33 @@ async function generateCore({
   return state.final;
 }
 
-async function runtimeLock(directory) {
+export async function runtimeLock(directory) {
   await mkdir(directory, { recursive: true, mode: 0o700 });
-  await chmod(directory, 0o700);
+  if (process.platform !== "win32") {
+    const folder = await open(
+      directory,
+      constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW,
+    );
+    try {
+      const info = await folder.stat();
+      if (!info.isDirectory() || info.uid !== process.getuid())
+        throw new Error("The runtime directory must be owned by this user.");
+      await folder.chmod(0o700);
+    } finally {
+      await folder.close();
+    }
+  }
+  let release;
+  try {
+    release = await acquireSupervisorLock(directory);
+  } catch (error) {
+    if (error.code === "SUPERVISOR_ALREADY_RUNNING") error.code = "RUNTIME_ALREADY_RUNNING";
+    throw error;
+  }
   const path = join(directory, "runtime.lock");
+  const nonce = randomUUID();
   try {
-    const existing = JSON.parse(await readFile(path, "utf8"));
+    const existing = await readPrivateRuntimeJson(path);
     try {
       process.kill(existing.pid, 0);
       throw Object.assign(new Error("A runtime already owns this agent's state directory."), {
@@ -591,12 +615,35 @@ async function runtimeLock(directory) {
     }
     await rm(path);
   } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+    if (error.code !== "ENOENT") {
+      await release();
+      throw error;
+    }
+  }
+  try {
+    const file = await open(path, "wx", 0o600);
+    try {
+      await file.writeFile(JSON.stringify({ pid: process.pid, nonce }));
+    } finally {
+      await file.close();
+    }
+  } catch (error) {
+    await release();
+    throw error;
   }
-  const file = await open(path, "wx", 0o600);
-  await file.writeFile(JSON.stringify({ pid: process.pid }));
-  await file.close();
-  return () => rm(path, { force: true });
+  let released = false;
+  return async () => {
+    if (released) return;
+    released = true;
+    try {
+      const owner = await readPrivateRuntimeJson(path).catch((error) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+      if (owner?.nonce === nonce) await rm(path);
+    } finally {
+      await release();
+    }
+  };
 }
 
 export async function runRuntime(settings) {

package/bin/observability.mjs

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { readPrivateRuntimeJson } from "./mission-agent-session.mjs";
+import { isCredentialField, redactCredentialText } from "./sdk/credential-redaction.js";
 
 const context = new AsyncLocalStorage();
 const capabilities = new WeakMap();
@@ -13,23 +14,7 @@ const failureCode = (error, fallback) =>
 /** Export data-plane text only. Never pass request headers or provider configuration here. */
 export function redactObservation(value, depth = 0) {
   if (depth > 8) return "[depth limit]";
-  if (typeof value === "string")
-    return value
-      .replace(
-        /\b(?:tn_(?:live|test)_[A-Za-z0-9_-]{20,}|sk-(?:ant-)?[A-Za-z0-9_-]{16,}|AKIA[A-Z0-9]{16})\b/g,
-        "[credential redacted]",
-      )
-      .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+\/-]+=*/gi, "[authorization redacted]")
-      .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[token redacted]")
-      .replace(
-        /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g,
-        "[private key redacted]",
-      )
-      .replace(
-        /((?:["']?)(?:[A-Z0-9_]*secret[A-Z0-9_]*|[A-Z0-9_]*password|api[_ -]?(?:key|token)|access[_ -]?token|AWS_SESSION_TOKEN|authorization)(?:["']?)\s*[=:]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;"'}]+)/gi,
-        "$1[redacted]",
-      )
-      .slice(0, MAX_TEXT);
+  if (typeof value === "string") return redactCredentialText(value).slice(0, MAX_TEXT);
   if (Array.isArray(value))
     return value.slice(0, 80).map((item) => redactObservation(item, depth + 1));
   if (value && typeof value === "object")
@@ -37,10 +22,9 @@ export function redactObservation(value, depth = 0) {
       Object.entries(value)
         .slice(0, 80)
         .map(([key, item]) => [
-          key,
-          /(?:authorization|password|secret|api[_-]?(?:key|token)|access[_-]?token|AWS_SESSION_TOKEN|leaseToken)/i.test(
-            key,
-          )
+          redactCredentialText(key),
+          // Session IDs on observation records are correlation metadata, never auth sessions.
+          isCredentialField(key) && !(depth === 0 && key === "sessionId")
             ? "[redacted]"
             : redactObservation(item, depth + 1),
         ]),

package/bin/sdk/credential-redaction.js

@@ -0,0 +1 @@
+const CREDENTIAL_TOKEN_PATTERN=/\b(?:(?:tn|at)_(?:live|test)_[A-Za-z0-9_-]{8,}|t[acr]_[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|sk-(?:proj-|svcacct-|ant-)?[A-Za-z0-9_-]{16,}|(?:AKIA|ASIA)[A-Z0-9]{16}|[rs]k_(?:live|test)_[A-Za-z0-9]{8,}|xox[a-z][.-][A-Za-z0-9.-]{10,}|xapp-[A-Za-z0-9-]{12,})\b/g;function isCredentialField(key){const normalized=key.replace(/[^a-z0-9]/gi,"").toLowerCase();return/(?:authorization|authentication|password|passwd|secret|apikey|apitoken|accesstoken|refreshtoken|sessiontoken|sessionid|sessionkey|sessioncookie|cookie|leasetoken|privatekey)/.test(normalized)||normalized==="token"}function redactCredentialText(value){return value.replace(/(\b(?:set[-_ ]?cookie|cookie)\s*[:=]\s*)[^\r\n]*/gi,"$1[redacted]").replace(CREDENTIAL_TOKEN_PATTERN,"[credential redacted]").replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+\/-]+=*/gi,"[authorization redacted]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,"[token redacted]").replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g,"[private key redacted]").replace(/(["']?(?:[A-Z0-9_]*secret[A-Z0-9_]*|[A-Z0-9_]*password|api[_ -]?(?:key|token)|(?:access|refresh|session)[_ -]?(?:token|key|id|cookie)|(?:set[_ -]?)?cookie|AWS_SESSION_TOKEN|authorization|authentication|token)["']?\s*[=:]\s*)(?:"(?:\\.|[^"\\])*(?:"|$)|'(?:\\.|[^'\\])*(?:'|$)|[^\r\n,;"'}]+)/gi,"$1[redacted]")}export{CREDENTIAL_TOKEN_PATTERN,isCredentialField,redactCredentialText};

package/bin/sdk/transport.js

@@ -1 +1 @@
-import{apiError,TotemCanceledError,TotemError,TotemNetworkError,TotemTimeoutError}from"./errors.js";function idempotencyKey(){return globalThis.crypto.randomUUID()}function sleep(ms,signal){return new Promise((resolve,reject)=>{const cancel=()=>{clearTimeout(timer);signal?.removeEventListener("abort",cancel);reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};const timer=setTimeout(()=>{signal?.removeEventListener("abort",cancel);resolve()},ms);signal?.addEventListener("abort",cancel,{once:true});if(signal?.aborted)cancel()})}class Transport{#apiKey;#baseUrl;#fetch;#timeoutMs;#maxRetries;#retryDelayMs;#responseEnvelope;constructor(options,api=void 0){if(!options.apiKey?.trim())throw new TotemError("An agent API key is required.",{code:"INVALID_CONFIG"});const url=new URL(options.baseUrl??"https://totemlayer.com");const loopback=["localhost","127.0.0.1","[::1]"].includes(url.hostname);if(url.protocol!=="https:"&&!(url.protocol==="http:"&&loopback)||url.username||url.password||url.search||url.hash||url.pathname!=="/"){throw new TotemError("baseUrl must be an HTTPS origin or a local HTTP origin.",{code:"INVALID_CONFIG"})}this.#apiKey=options.apiKey;this.#baseUrl=`${url.origin}${api?.basePath??"/api/v1/network"}`;this.#responseEnvelope=api?.responseEnvelope??"data";this.#fetch=options.fetch??globalThis.fetch.bind(globalThis);this.#timeoutMs=options.timeoutMs??15e3;this.#maxRetries=options.maxRetries??2;this.#retryDelayMs=options.retryDelayMs??250;if(!Number.isFinite(this.#timeoutMs)||this.#timeoutMs<1||!Number.isInteger(this.#maxRetries)||this.#maxRetries<0||this.#maxRetries>10||!Number.isFinite(this.#retryDelayMs)||this.#retryDelayMs<0){throw new TotemError("Invalid timeout or retry configuration.",{code:"INVALID_CONFIG"})}}async request(method,path,options={}){const url=new URL(`${this.#baseUrl}${path}`);for(const[key,value]of Object.entries(options.query??{})){if(value!==void 0&&value!==null)url.searchParams.set(key,String(value))}const retrySafe=method==="GET"||options.retrySafe===true||Boolean(options.idempotencyKey);const body=options.binaryBody??(options.body===void 0?void 0:JSON.stringify(options.body));const headers={Authorization:`Bearer ${this.#apiKey}`,Accept:"application/json",...body===void 0||options.binaryBody?{}:{"Content-Type":"application/json"},...options.idempotencyKey?{"Idempotency-Key":options.idempotencyKey}:{},...options.headers??{}};for(let attempt=0;;attempt++){if(options.signal?.aborted)throw new TotemCanceledError("Totem request canceled.",{code:"CANCELED"});const controller=new AbortController;let timer;let cancel;let retryAfter=null;try{const aborted=new Promise((_,reject)=>{cancel=()=>{controller.abort();reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};options.signal?.addEventListener("abort",cancel,{once:true});if(options.signal?.aborted)cancel();timer=setTimeout(()=>{controller.abort();reject(new TotemTimeoutError("Totem request timed out.",{code:"TIMEOUT"}))},this.#timeoutMs)});const response=(async()=>{const result=await this.#fetch(url.toString(),{method,headers,body:body instanceof Uint8Array?new Uint8Array(body):body,signal:controller.signal,redirect:"error",cache:"no-store"});retryAfter=result.headers.get("Retry-After");const requestId=result.headers.get("X-Request-Id")??void 0;let payload;try{payload=await result.json()}catch{if(!result.ok)throw apiError(result.status,void 0,requestId);throw new TotemError("Totem returned invalid JSON.",{code:"INVALID_RESPONSE",requestId})}if(!result.ok)throw apiError(result.status,payload,requestId);if(!payload||typeof payload!=="object"||Array.isArray(payload)||this.#responseEnvelope==="data"&&!("data"in payload)){throw new TotemError("Totem returned an invalid response envelope.",{code:"INVALID_RESPONSE",requestId})}return payload})();return await Promise.race([response,aborted])}catch(cause){const error=cause instanceof TotemError?cause:new TotemNetworkError("Unable to reach Totem.",{code:"NETWORK_ERROR",cause});const transient=error instanceof TotemNetworkError||error instanceof TotemTimeoutError||error.status!==void 0&&[408,429,500,502,503,504].includes(error.status);if(!retrySafe||!transient||attempt>=this.#maxRetries)throw error;clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel);const seconds=retryAfter===null?NaN:Number(retryAfter);const parsedDate=retryAfter===null?NaN:Date.parse(retryAfter);const requestedDelay=Number.isFinite(seconds)?seconds*1e3:parsedDate-Date.now();const fallback=this.#retryDelayMs*2**attempt*(.75+Math.random()*.5);await sleep(Math.min(3e4,Math.max(0,Number.isFinite(requestedDelay)?requestedDelay:fallback)),options.signal)}finally{clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel)}}}async download(path,options={}){const signal=AbortSignal.any([options.signal,AbortSignal.timeout(this.#timeoutMs)].filter(Boolean));let response;try{response=await this.#fetch(`${this.#baseUrl}${path}`,{method:"GET",headers:{Authorization:`Bearer ${this.#apiKey}`},signal,redirect:"error",cache:"no-store"})}catch(cause){throw new TotemNetworkError("Unable to download the attachment.",{code:"NETWORK_ERROR",cause})}if(!response.ok){const payload=await response.json().catch(()=>void 0);throw apiError(response.status,payload,response.headers.get("x-request-id")??void 0)}const reported=Number(response.headers.get("content-length"));if(reported>2*1024*1024)throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"});const bytes=new Uint8Array(await response.arrayBuffer());if(bytes.byteLength>2*1024*1024)throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"});const disposition=response.headers.get("content-disposition")??"";const encoded=disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];return{bytes,mediaType:response.headers.get("content-type")??"application/octet-stream",name:encoded?decodeURIComponent(encoded):"attachment",sha256:response.headers.get("x-content-sha256")}}}export{Transport,idempotencyKey,sleep};
+import{apiError,TotemCanceledError,TotemError,TotemNetworkError,TotemTimeoutError}from"./errors.js";function idempotencyKey(){return globalThis.crypto.randomUUID()}function sleep(ms,signal){return new Promise((resolve,reject)=>{const cancel=()=>{clearTimeout(timer);signal?.removeEventListener("abort",cancel);reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};const timer=setTimeout(()=>{signal?.removeEventListener("abort",cancel);resolve()},ms);signal?.addEventListener("abort",cancel,{once:true});if(signal?.aborted)cancel()})}class Transport{#apiKey;#baseUrl;#fetch;#timeoutMs;#maxRetries;#retryDelayMs;#responseEnvelope;constructor(options,api=void 0){if(!options.apiKey?.trim())throw new TotemError("An agent API key is required.",{code:"INVALID_CONFIG"});const url=new URL(options.baseUrl??"https://totemlayer.com");const loopback=["localhost","127.0.0.1","[::1]"].includes(url.hostname);if(url.protocol!=="https:"&&!(url.protocol==="http:"&&loopback)||url.username||url.password||url.search||url.hash||url.pathname!=="/"){throw new TotemError("baseUrl must be an HTTPS origin or a local HTTP origin.",{code:"INVALID_CONFIG"})}this.#apiKey=options.apiKey;this.#baseUrl=`${url.origin}${api?.basePath??"/api/v1/network"}`;this.#responseEnvelope=api?.responseEnvelope??"data";this.#fetch=options.fetch??globalThis.fetch.bind(globalThis);this.#timeoutMs=options.timeoutMs??15e3;this.#maxRetries=options.maxRetries??2;this.#retryDelayMs=options.retryDelayMs??250;if(!Number.isFinite(this.#timeoutMs)||this.#timeoutMs<1||!Number.isInteger(this.#maxRetries)||this.#maxRetries<0||this.#maxRetries>10||!Number.isFinite(this.#retryDelayMs)||this.#retryDelayMs<0){throw new TotemError("Invalid timeout or retry configuration.",{code:"INVALID_CONFIG"})}}async request(method,path,options={}){const url=new URL(`${this.#baseUrl}${path}`);for(const[key,value]of Object.entries(options.query??{})){if(value!==void 0&&value!==null)url.searchParams.set(key,String(value))}const retrySafe=method==="GET"||options.retrySafe===true||Boolean(options.idempotencyKey);const body=options.binaryBody??(options.body===void 0?void 0:JSON.stringify(options.body));const headers={Authorization:`Bearer ${this.#apiKey}`,Accept:"application/json",...body===void 0||options.binaryBody?{}:{"Content-Type":"application/json"},...options.idempotencyKey?{"Idempotency-Key":options.idempotencyKey}:{},...options.headers??{}};for(let attempt=0;;attempt++){if(options.signal?.aborted)throw new TotemCanceledError("Totem request canceled.",{code:"CANCELED"});const controller=new AbortController;let timer;let cancel;let retryAfter=null;try{const aborted=new Promise((_,reject)=>{cancel=()=>{controller.abort();reject(new TotemCanceledError("Totem request canceled.",{code:"CANCELED"}))};options.signal?.addEventListener("abort",cancel,{once:true});if(options.signal?.aborted)cancel();timer=setTimeout(()=>{controller.abort();reject(new TotemTimeoutError("Totem request timed out.",{code:"TIMEOUT"}))},this.#timeoutMs)});const response=(async()=>{const result=await this.#fetch(url.toString(),{method,headers,body:body instanceof Uint8Array?new Uint8Array(body):body,signal:controller.signal,redirect:"error",cache:"no-store"});retryAfter=result.headers.get("Retry-After");const requestId=result.headers.get("X-Request-Id")??void 0;let payload;try{payload=await result.json()}catch{if(!result.ok)throw apiError(result.status,void 0,requestId);throw new TotemError("Totem returned invalid JSON.",{code:"INVALID_RESPONSE",requestId})}if(!result.ok)throw apiError(result.status,payload,requestId);if(!payload||typeof payload!=="object"||Array.isArray(payload)||this.#responseEnvelope==="data"&&!("data"in payload)){throw new TotemError("Totem returned an invalid response envelope.",{code:"INVALID_RESPONSE",requestId})}return payload})();return await Promise.race([response,aborted])}catch(cause){const error=cause instanceof TotemError?cause:new TotemNetworkError("Unable to reach Totem.",{code:"NETWORK_ERROR",cause});const transient=error instanceof TotemNetworkError||error instanceof TotemTimeoutError||error.status!==void 0&&[408,429,500,502,503,504].includes(error.status);if(!retrySafe||!transient||attempt>=this.#maxRetries)throw error;clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel);const seconds=retryAfter===null?NaN:Number(retryAfter);const parsedDate=retryAfter===null?NaN:Date.parse(retryAfter);const requestedDelay=Number.isFinite(seconds)?seconds*1e3:parsedDate-Date.now();const fallback=this.#retryDelayMs*2**attempt*(.75+Math.random()*.5);await sleep(Math.min(3e4,Math.max(0,Number.isFinite(requestedDelay)?requestedDelay:fallback)),options.signal)}finally{clearTimeout(timer);if(cancel)options.signal?.removeEventListener("abort",cancel)}}}async download(path,options={}){const signal=AbortSignal.any([options.signal,AbortSignal.timeout(this.#timeoutMs)].filter(Boolean));let response;try{response=await this.#fetch(`${this.#baseUrl}${path}`,{method:"GET",headers:{Authorization:`Bearer ${this.#apiKey}`},signal,redirect:"error",cache:"no-store"})}catch(cause){throw new TotemNetworkError("Unable to download the attachment.",{code:"NETWORK_ERROR",cause})}if(!response.ok){const payload=await response.json().catch(()=>void 0);throw apiError(response.status,payload,response.headers.get("x-request-id")??void 0)}const reported=Number(response.headers.get("content-length"));if(reported>2*1024*1024){await response.body?.cancel().catch(()=>{});throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"})}const reader=response.body?.getReader();const chunks=[];let size=0;if(reader){try{for(;;){const{done,value}=await reader.read();if(done)break;size+=value.byteLength;if(size>2*1024*1024){await reader.cancel().catch(()=>{});throw new TotemError("The attachment exceeds the 2 MiB limit.",{code:"ATTACHMENT_TOO_LARGE"})}chunks.push(value)}}finally{reader.releaseLock()}}const bytes=new Uint8Array(size);let offset=0;for(const chunk of chunks){bytes.set(chunk,offset);offset+=chunk.byteLength}const disposition=response.headers.get("content-disposition")??"";const encoded=disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];return{bytes,mediaType:response.headers.get("content-type")??"application/octet-stream",name:encoded?decodeURIComponent(encoded):"attachment",sha256:response.headers.get("x-content-sha256")}}}export{Transport,idempotencyKey,sleep};

package/bin/setup-assets/api-manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.75","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}
+{"version":1,"packageVersion":"0.1.76","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}

package/bin/setup-assets/manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.75","bytes":36144,"sha256":"b9e6518f5e1d15b83e013469753220a26ab61fb9a4bc45db74cc007ea2178279"}
+{"version":1,"packageVersion":"0.1.76","bytes":36144,"sha256":"66535754c594ad559c91b68c93348ec5579f10a0d791c462cecf98cb618ea2ae"}

package/bin/setup-assets/setup.backup.md

@@ -39,10 +39,10 @@ Use an actual native user-message tool if available and wait for delivery. Other
 Run on the actual command-capable agent host, from the intended native session:
 
 ~~~sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz totem install
 ~~~
 
-This command pins release **0.1.75**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
+This command pins release **0.1.76**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
 
 The command verifies the full bundled guide against its byte length/SHA-256 manifest, with a complete alternate copy. `totem install --read-guide` prints it without setup changes. Corrupt/incomplete required guides are a hard stop. The native adapter must verify the current model and unchanged host permissions, exact session, intended identity, transport and current credential generation. “default” or a guessed model is not evidence. There is no force-success, skip-tests, model-supplied proof or arbitrary adapter-script URL.
 

package/bin/setup-assets/setup.md

@@ -39,10 +39,10 @@ Use an actual native user-message tool if available and wait for delivery. Other
 Run on the actual command-capable agent host, from the intended native session:
 
 ~~~sh
-npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.75.tgz totem install
+npx --yes --ignore-scripts --package=https://totemlayer.com/downloads/totemlayer-0.1.76.tgz totem install
 ~~~
 
-This command pins release **0.1.75**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
+This command pins release **0.1.76**. Verify the published package and full guide before making setup changes. Node.js 22.14 or newer is required for this package. Pin the tested release. `--ignore-scripts` prevents package lifecycle setup before the strict controller. Installing the package alone grants no connection or background authority.
 
 The command verifies the full bundled guide against its byte length/SHA-256 manifest, with a complete alternate copy. `totem install --read-guide` prints it without setup changes. Corrupt/incomplete required guides are a hard stop. The native adapter must verify the current model and unchanged host permissions, exact session, intended identity, transport and current credential generation. “default” or a guessed model is not evidence. There is no force-success, skip-tests, model-supplied proof or arbitrary adapter-script URL.
 

package/bin/strict-codex-adapter.mjs

@@ -16,6 +16,7 @@ import { readReleaseSetupGuide } from "./setup-guide.mjs";
 import { prepareSetupTests, readSetupTests } from "./setup-receipts.mjs";
 import { defaultCodexQueue } from "./codex-chat-bridge.mjs";
 import { installedClientInvocation, localClientEnvironment } from "./platform-client.mjs";
+import { validOrganizationId } from "./strict-setup.mjs";
 
 const execute = promisify(execFile);
 const fail = (code) => {
@@ -126,7 +127,7 @@ export function createStrictCodexAdapter(flags, options = {}) {
           own.id !== saved.agentId ||
           own.address !== saved.address ||
           own.environment !== saved.environment ||
-          !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(own.organization?.id ?? "")
+          !validOrganizationId(own.organization?.id)
         )
           fail("AGENT_IDENTITY_MISMATCH");
         const checked = await snapshot();

package/bin/strict-setup.mjs

@@ -17,6 +17,9 @@ const token = (value) =>
   typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,319}$/.test(value);
 const uuid = (value) =>
   typeof value === "string" && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(value);
+export const validOrganizationId = (value) =>
+  uuid(value) ||
+  (typeof value === "string" && /^org_(?:[A-Za-z0-9_-]{24}|personal_[a-f0-9]{20})$/.test(value));
 const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 const stop = (code) => {
   throw Object.assign(new Error(code), { code });
@@ -26,7 +29,7 @@ export function setupBinding(identity, host, transport, connection) {
   if (
     !uuid(identity?.id) ||
     !token(identity.address) ||
-    !uuid(identity.organization?.id) ||
+    !validOrganizationId(identity.organization?.id) ||
     !["PRODUCTION", "SANDBOX"].includes(identity.environment) ||
     !token(host?.name) ||
     !token(host.model) ||
@@ -245,6 +248,7 @@ export async function runStrictSetup(adapter, options = {}) {
     if (
       expected &&
       (identity?.id !== expected.id ||
+        identity.address !== expected.address ||
         identity.environment !== expected.environment ||
         (expected.organization?.id && identity.organization?.id !== expected.organization.id))
     )

package/bin/windows-private-path.mjs

@@ -47,7 +47,7 @@ export function validateWindowsPrivateAcl(snapshot) {
             !rule.inheritOnly &&
             rule.type === "Allow" &&
             !trustedAncestors.has(rule.sid) &&
-            (rule.rights & (64 | 262144 | 524288)) !== 0,
+            (rule.rights & (64 | 65536 | 262144 | 524288)) !== 0,
         ),
     )
   )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.75",
+  "version": "0.1.76",
   "description": "Cross-platform CLI for TotemLayer agent identity and authorization",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "@modelcontextprotocol/client": "2.3.0",
     "@modelcontextprotocol/server": "2.3.0",
     "undici": "7.30.1",
-    "zod": "4.6.6"
+    "zod": "4.6.7"
   },
   "scripts": {
     "postinstall": "node bin/installation.mjs --postinstall",