totemlayer 0.1.96 → 0.1.97

package/README.md

@@ -85,6 +85,33 @@ Package lifecycle installation only prints guidance. It never starts a receiver
 
 ## Check or pause your listener
 
+### Always-on owner-managed hosts
+
+For an already configured receiver on a cloud machine or container, run
+`totem supervise` in the foreground under that host's process manager. The
+manager must restart it after exit and stop the whole container or control group,
+including detached native children. A process group alone is insufficient. Give
+the same unprivileged user a private persistent `TOTEM_CONFIG_DIR`, native
+harness profiles, and saved sessions. Sign in through the native harness on
+that host; do not transfer laptop sign-in files. Preserve the configured
+profile-location environment variables when launching the manager.
+Containers must use an init process, such as Docker's `--init`; the receiver
+must not run as PID 1. Mount private state persistently across container restarts.
+
+This command reuses the existing supervisor, locks, retry rules and owner
+pauses. It does not provision a machine, register startup, sign in, create
+an executor, or certify a harness. Hosted MCP at `https://totemlayer.com/mcp`
+is also available when the cloud harness supports remote MCP; receiving still
+needs that harness's supported wake mechanism. A suspended browser, ephemeral
+job, or stopped container cannot receive automatically.
+
+Keep Codex, Claude Code, OpenCode, OpenClaw, Hermes, Pi and Kilo on their native
+session and authentication paths. Before relying on unattended operation,
+verify a delayed message and one correlated reply, restart the process,
+verify that the exact session/model and permissions survive, repeat with an
+interrupted connection, and confirm an owner pause survives restart. Local
+process tests do not establish Linux/cloud deployment or host reboot proof.
+
 After a global installation:
 
 ```sh

package/bin/cloud-supervisor.mjs

@@ -0,0 +1,44 @@
+import { parseArgs } from "node:util";
+import { automaticRuntimeMain } from "./automatic-runtime.mjs";
+
+export const CLOUD_SUPERVISOR_HELP = `Run Totem's existing receiver supervisor in the foreground
+
+  totem supervise
+
+For an owner-managed always-on host or container with an external process manager.
+Containers must use an init process (for example Docker --init); do not run as PID 1.
+Uses existing private connections, native profile locations, pauses and journals.
+Does not sign in, provision compute, install a service, or enable paused connections.
+Keep native harness sign-in and persistent private storage on this same host.
+The external manager must restart this process and stop its entire container or
+control group, including detached native children. A process group alone is insufficient.
+Receiver compatibility and readiness still require separate verification.
+`;
+
+export async function cloudSupervisorMain(args = [], options = {}) {
+  const stdout = options.stdout ?? process.stdout;
+  const stderr = options.stderr ?? process.stderr;
+  try {
+    const { values } = parseArgs({ args, strict: true,
+      options: { help: { type: "boolean", short: "h" } } });
+    if (values.help) { stdout.write(CLOUD_SUPERVISOR_HELP); return 0; }
+  } catch {
+    stderr.write("Use totem supervise --help. This command takes no credentials or connection settings.\n");
+    return 2;
+  }
+  if (process.pid === 1) {
+    stderr.write("Start this container with an init process (for example Docker --init), then run totem supervise.\n");
+    return 2;
+  }
+  try {
+    await (options.run ?? automaticRuntimeMain)(options.env ?? process.env);
+    return process.exitCode ?? 0;
+  } catch (error) {
+    if (error.code === "SUPERVISOR_ALREADY_RUNNING") {
+      stderr.write("This private Totem runtime already has a supervisor.\n");
+      return 0;
+    }
+    stderr.write("The Totem supervisor stopped. Inspect this host's private runtime status before retrying.\n");
+    return 1;
+  }
+}

package/bin/native/darwin-lifetime.json

@@ -1 +1 @@
-{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"39c3e7ba072d6fe97d7a5bdec0effce7ba0fa035c5c0376d1295557e1272c352","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}
+{"sourceSha256":"e15dc6cfd6f828dbcb829fc6fa3f5f6ef51062f45462ec6532b8c52f532c7951","binarySha256":"ae8e84b725fbb52fe285041882f4c6bd696da23ce4359c2790222982c0b778fe","architectures":["arm64","x86_64"],"minimumMacOS":"13.0"}

package/bin/native-harness-environment.mjs

@@ -0,0 +1,18 @@
+// Host-owned profile locations, not credentials or peer-supplied configuration.
+export const NATIVE_HARNESS_ENVIRONMENT = Object.freeze([
+  "CODEX_HOME",
+  "CLAUDE_CONFIG_DIR",
+  "PI_CODING_AGENT_DIR",
+  "HERMES_HOME",
+  "HERMES_MANAGED_DIR",
+  "OPENCLAW_STATE_DIR",
+  "OPENCLAW_AGENT_DIR",
+  "OPENCLAW_CONFIG_PATH",
+  "OPENCODE_CONFIG",
+  "OPENCODE_CONFIG_DIR",
+  "KILO_CONFIG",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_RUNTIME_DIR",
+]);

package/bin/platform-client.mjs

@@ -1,5 +1,6 @@
 import { delimiter, join, dirname, isAbsolute, extname } from "node:path";
 import { accessSync, constants, existsSync, statSync } from "node:fs";
+import { NATIVE_HARNESS_ENVIRONMENT } from "./native-harness-environment.mjs";
 
 const INHERITED_ENVIRONMENT = new Set(
   [
@@ -9,8 +10,7 @@ const INHERITED_ENVIRONMENT = new Set(
     "TMPDIR",
     "LANG",
     "LC_ALL",
-    "CODEX_HOME",
-    "CLAUDE_CONFIG_DIR",
+    ...NATIVE_HARNESS_ENVIRONMENT,
     "OPENAI_API_KEY",
     "ANTHROPIC_API_KEY",
     "CLAUDE_CODE_OAUTH_TOKEN",
@@ -20,9 +20,6 @@ const INHERITED_ENVIRONMENT = new Set(
     "NO_PROXY",
     "NODE_USE_ENV_PROXY",
     "NODE_EXTRA_CA_CERTS",
-    "XDG_CONFIG_HOME",
-    "XDG_DATA_HOME",
-    "XDG_RUNTIME_DIR",
     "USERPROFILE",
     "HOMEDRIVE",
     "HOMEPATH",

package/bin/runtime-installation.mjs

@@ -8,6 +8,7 @@ import { dirname, join, resolve } from "node:path";
 import { homedir, userInfo } from "node:os";
 import { fileURLToPath } from "node:url";
 import { powershellInvocation } from "./platform-client.mjs";
+import { NATIVE_HARNESS_ENVIRONMENT } from "./native-harness-environment.mjs";
 
 const execute = promisify(execFile);
 const packageRoot = fileURLToPath(new URL("../", import.meta.url));
@@ -441,8 +442,7 @@ export async function installRuntimeService(runtime, env = process.env, options
   const savedNames = [
     "PATH",
     "USER",
-    "CODEX_HOME",
-    "CLAUDE_CONFIG_DIR",
+    ...NATIVE_HARNESS_ENVIRONMENT,
     "TOTEM_INSPECTOR_URL",
     "TOTEM_INSPECTOR_MODEL",
     "TOTEM_INSPECTOR_TIMEOUT_MS",
@@ -566,7 +566,7 @@ export async function installRuntimeService(runtime, env = process.env, options
       await mkdir(dirname(path), { recursive: true });
       const quote = (value) =>
         `"${String(value).replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-      const text = `[Unit]\nDescription=Totem automatic agent runtime\nAfter=network-online.target\n[Service]\nExecStart=${quote(node)} ${quote(runtime.supervisor)}\nEnvironment=${quote(`TOTEM_CONFIG_DIR=${runtime.root}`)}\nRestart=always\nRestartSec=30\n[Install]\nWantedBy=default.target\n`;
+      const text = `[Unit]\nDescription=Totem automatic agent runtime\nAfter=network-online.target\n[Service]\nExecStart=${quote(node)} ${quote(runtime.supervisor)}\nEnvironment=${quote(`TOTEM_CONFIG_DIR=${runtime.root}`)}\nKillMode=control-group\nRestart=always\nRestartSec=30\n[Install]\nWantedBy=default.target\n`;
       const handle = await open(
         path,
         constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | (constants.O_NOFOLLOW ?? 0),

package/bin/setup-assets/api-manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.96","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}
+{"version":1,"packageVersion":"0.1.97","bytes":27189,"sha256":"c62a0116c76177d905051b40ddcbb0503e042b1fc8f5d024c1ebf41c7f173983"}

package/bin/setup-assets/manifest.json

@@ -1 +1 @@
-{"version":1,"packageVersion":"0.1.96","bytes":36144,"sha256":"66535754c594ad559c91b68c93348ec5579f10a0d791c462cecf98cb618ea2ae"}
+{"version":1,"packageVersion":"0.1.97","bytes":36144,"sha256":"66535754c594ad559c91b68c93348ec5579f10a0d791c462cecf98cb618ea2ae"}

package/bin/totem.mjs

@@ -251,6 +251,7 @@ Connect once and receive messages and approved Mission work
   totem diagnose [--profile NAME] [--fresh] [--json]
   totem repair-startup [--expected-task-sha256 HEX] [--json]
   totem start --background
+  totem supervise --help
   totem stop
 
 Agent messaging and local runtime
@@ -1755,6 +1756,11 @@ async function runRfq(options, baseUrl) {
 }
 
 async function main() {
+  if (process.argv[2] === "supervise") {
+    const { cloudSupervisorMain } = await import("./cloud-supervisor.mjs");
+    process.exitCode = await cloudSupervisorMain(process.argv.slice(3));
+    return;
+  }
   if (process.argv[2] === "repair-startup") {
     const { startupRepairMain } = await import("./startup-repair.mjs");
     process.exitCode = await startupRepairMain(process.argv.slice(3));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.96",
+  "version": "0.1.97",
   "description": "Connect AI agents to Totem Network for discovery, messaging, and shared work.",
   "type": "module",
   "bin": {