witnora 0.20.15 → 0.20.17

package/dist/credentials.js

@@ -23,8 +23,9 @@ export async function saveConnection(name, input, options = {}) {
     return path;
 }
 export async function loadConnection(name, options = {}) {
+    const explicitConfigHome = options.configHome ?? process.env.WITNORA_CONFIG_HOME ?? process.env.AGENTCERT_CONFIG_HOME;
     const file = await readCredentialFile(credentialsPath(options))
-        ?? (options.configHome ? undefined : await readCredentialFile(legacyCredentialsPath()));
+        ?? (explicitConfigHome !== undefined ? undefined : await readCredentialFile(legacyCredentialsPath()));
     if (!file)
         return undefined;
     const connectionName = name ? validateConnectionName(name) : file.defaultConnection;
@@ -90,7 +91,8 @@ function validateConnection(input) {
         throw new Error("Witnora project ID is required.");
     if (!apiKey.startsWith("ac_live_"))
         throw new Error("Witnora API key must start with ac_live_.");
-    return { server: normalizeServer(input.server), projectId, apiKey };
+    const approvedSetupPlanId = input.approvedSetupPlanId?.trim();
+    return { server: normalizeServer(input.server), projectId, apiKey, ...(approvedSetupPlanId ? { approvedSetupPlanId } : {}) };
 }
 function normalizeServer(value) {
     let url;

package/dist/device-authorization.js

@@ -25,6 +25,7 @@ export async function authorizeProjectConnection(options) {
         server,
         projectId: token.projectId,
         apiKey: token.apiKey,
+        approvedSetupPlanId: token.approvedSetupPlanId,
     }, { configHome: options.configHome });
     return { ...token, server, credentialsPath };
 }

package/dist/onboard.js

@@ -48,18 +48,22 @@ export async function runOnboard(options) {
         configHome: options.configHome,
     });
     if (reusableConnection)
-        output("Reusing the previously approved project-scoped setup connection; no new browser approval is required.\n");
+        output("Reusing this Agent's previously approved setup connection; verifying its exact Setup Plan.\n");
     const credentialsPath = token.credentialsPath;
     await verifyControlPlaneConnection({ baseUrl: server, projectId: token.projectId, apiKey: token.apiKey, fetch: requestFetch });
-    const planSnapshot = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/setup-plans`, {
+    const planQuery = token.approvedSetupPlanId ? `?setupPlanId=${encodeURIComponent(token.approvedSetupPlanId)}` : "";
+    const planSnapshot = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/setup-plans${planQuery}`, {
         method: "GET", headers: { authorization: `Bearer ${token.apiKey}` },
     });
     const setupPlan = planSnapshot.plan;
-    if (!setupPlan || !setupPlan.authorizedOperations.some((item) => item.kind === "authorize_install")) {
+    if (!setupPlan || (token.approvedSetupPlanId && setupPlan.id !== token.approvedSetupPlanId) || !setupPlan.authorizedOperations.some((item) => item.kind === "authorize_install")) {
         throw new Error("Confirm the Setup Plan and authorize installation in the Witnora Workspace before running onboard.");
     }
+    const attemptId = `install-${Date.now()}-${randomSuffix()}`;
+    // Resume an authorized failed install before requesting fresh Runtime authority.
+    await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     let localRuntime = await discoverRuntimeReferences({
-        repository: repositoryPath, configHome: options.configHome, projectId: token.projectId, server, env: options.env ?? process.env,
+        repository: repositoryPath, configHome: options.configHome, projectId: token.projectId, setupPlanId: setupPlan.id, server, env: options.env ?? process.env,
     });
     let runtimeLimitation = localRuntime.limitation;
     let runtimeBootstrapRequired = !localRuntime.references;
@@ -96,7 +100,6 @@ export async function runOnboard(options) {
             runtimeLimitation = `Hosted Runtime bootstrap did not complete: ${detail.slice(0, 500)} The existing Gateway was preserved and setup remains RECORDED_ONLY.`;
         }
     }
-    const attemptId = `install-${Date.now()}-${randomSuffix()}`;
     const generatedFiles = [];
     const gatewayLifecycle = options.gatewayLifecycle ?? {
         start: startManagedCustomerGateway,
@@ -145,7 +148,6 @@ export async function runOnboard(options) {
         }
         throw lastError;
     };
-    await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
         const selfTestDir = join(repositoryPath, ".witnora", "onboarding", "self-test", attemptId);
@@ -203,9 +205,13 @@ export async function runOnboard(options) {
             generatedFiles.push(...gateway.generatedFiles);
         }
         else {
-            const binding = await inspectGatewayBinding(gatewayState.directory, token.projectId, server);
-            if (binding.matches) {
-                await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey }, { configHome: options.configHome });
+            const binding = await inspectGatewayBinding(gatewayState.directory, token.projectId, server, setupPlan.id);
+            if (binding.projectId === token.projectId && binding.server === server) {
+                const planRepairRequired = !binding.matches && Boolean(binding.runtimeSetupPlanId);
+                if (planRepairRequired && !localRuntime.references) {
+                    throw new RuntimeSetupNotReadyError(`The existing Gateway belongs to a different Setup Plan and could not be restored. ${runtimeLimitation ?? "Runtime references are unavailable."} Run onboard again to retry; the existing Gateway is preserved.`);
+                }
+                await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey, approvedSetupPlanId: setupPlan.id }, { configHome: options.configHome });
                 if (localRuntime.references) {
                     try {
                         runtimeUpgrade = await prepareRuntime(() => upgradeCustomerGatewayRuntime({ repository: repositoryPath, authorization: token, runtimeReferences: localRuntime.references, agentIdentity, configHome: options.configHome, fetch: requestFetch }));
@@ -222,6 +228,8 @@ export async function runOnboard(options) {
                     catch (error) {
                         if (!(error instanceof RuntimeSetupNotReadyError))
                             throw error;
+                        if (planRepairRequired)
+                            throw error;
                         runtimeLimitation = `Local sandbox Runtime references were found but did not establish readiness: ${error.message}`;
                         output(`\nExisting customer-owned Gateway remains RECORDED_ONLY because its Runtime references did not pass readiness checks: ${error.message}\n`);
                     }
@@ -597,7 +605,7 @@ function configuredGatewayPorts(environment) {
     const port = Number(value);
     return Number.isInteger(port) && port > 0 && port <= 65_535 ? new Set([port]) : new Set();
 }
-async function inspectGatewayBinding(directory, projectId, server) {
+async function inspectGatewayBinding(directory, projectId, server, setupPlanId) {
     let value;
     try {
         value = JSON.parse(await readFile(join(directory, "gateway.json"), "utf8"));
@@ -611,10 +619,12 @@ async function inspectGatewayBinding(directory, projectId, server) {
     const collectorId = typeof value.collectorId === "string" ? value.collectorId.trim() : "";
     const host = typeof value.host === "string" && value.host.trim() ? value.host.trim() : "127.0.0.1";
     const port = Number(value.port);
+    const worker = value.runtimeWorker;
+    const runtimeSetupPlanId = typeof worker?.runtimeSetupPlanId === "string" ? worker.runtimeSetupPlanId : undefined;
     if (!existingProjectId || !existingServer || !connectionName || !collectorId || !Number.isInteger(port) || port < 1 || port > 65_535) {
         throw new Error("Existing Gateway configuration is missing a valid project, server, connection, collector, host, or port. Preserve it and repair the setup in Advanced mode.");
     }
-    return { matches: existingProjectId === projectId && existingServer === server, projectId: existingProjectId, server: existingServer, connectionName, collectorId, host, port };
+    return { matches: existingProjectId === projectId && existingServer === server && runtimeSetupPlanId === setupPlanId, runtimeSetupPlanId, projectId: existingProjectId, server: existingServer, connectionName, collectorId, host, port };
 }
 async function assertGatewayStopped(requestFetch, host, port, oldCollectorId, oldProjectId, newProjectId) {
     try {

package/dist/runtime-bootstrap.js

@@ -3,7 +3,7 @@ import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises"
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { credentialsPath } from "./credentials.js";
-import { saveRuntimeReferenceManifest } from "./runtime-sandbox-kit.js";
+import { runtimeReferenceManifestPath, saveRuntimeReferenceManifest } from "./runtime-sandbox-kit.js";
 const SCHEMA_VERSION = "witnora.runtime_bootstrap.v0.1";
 const ENVELOPE_ALGORITHM = "X25519-HKDF-SHA256-A256GCM";
 const PROBE_SCOPES = ["outcomes:verify"];
@@ -85,6 +85,7 @@ export async function bootstrapLocalRuntime(input) {
         await acknowledge(requestFetch, endpoint, input.apiKey, issued.bootstrapId, issued.envelope.digestSha256);
     const manifestPath = join(dirname(credentialsPath({ configHome: input.configHome })), "runtime-references.json");
     await saveRuntimeReferenceManifest(manifestPath, input.projectId, server, references);
+    await saveRuntimeReferenceManifest(runtimeReferenceManifestPath({ ...input, server, setupPlanId: input.planId }), input.projectId, server, references);
     await rm(attemptPath, { force: true });
     return { references, bootstrapId: issued.bootstrapId };
 }

package/dist/runtime-sandbox-kit.js

@@ -16,15 +16,26 @@ export async function discoverRuntimeReferences(input) {
         runtimeKeyId: input.env.WITNORA_RUNTIME_KEY_ID?.trim(),
         runtimeSigningKeyHandle: input.env.WITNORA_RUNTIME_SIGNING_KEY_HANDLE?.trim(),
     };
-    const manifestPath = join(dirname(credentialsPath({ configHome: input.configHome })), "runtime-references.json");
-    const manifest = await optionalJson(manifestPath);
+    const manifestPath = runtimeReferenceManifestPath(input);
+    const legacyManifestPath = join(dirname(credentialsPath({ configHome: input.configHome })), "runtime-references.json");
+    const gateway = input.setupPlanId ? await optionalJson(join(input.repository, ".witnora", "gateway", "gateway.json")) : undefined;
+    const worker = object(gateway?.runtimeWorker);
+    const gatewayReferences = gateway?.projectId === input.projectId && gateway.server === input.server && worker.runtimeSetupPlanId === input.setupPlanId
+        ? completeReferences({ ...worker, setupPlanId: worker.runtimeSetupPlanId, bootstrapId: worker.runtimeBootstrapId,
+            adapterDigestSha256: worker.adapterModuleSha256, probeDigestSha256: worker.probeModuleSha256, fixtureContractDigestSha256: worker.fixtureContractSha256 })
+        : undefined;
+    const manifest = await optionalJson(manifestPath) ?? (gatewayReferences
+        ? { schemaVersion: "witnora.runtime_references.v0.1", projectId: input.projectId, server: input.server, references: gatewayReferences }
+        : await optionalJson(legacyManifestPath));
     const manifestReferences = manifest?.schemaVersion === "witnora.runtime_references.v0.1" && manifest.projectId === input.projectId && manifest.server === input.server
         ? completeReferences(manifest.references)
         : undefined;
+    const matchingReferences = !input.setupPlanId || !manifestReferences?.probeApiKeyId || manifestReferences.setupPlanId === input.setupPlanId
+        ? manifestReferences : undefined;
     const environmentOverrides = Object.fromEntries(Object.entries(entries).filter(([, value]) => value));
-    const configuredReferences = completeReferences({ ...manifestReferences, ...environmentOverrides });
+    const configuredReferences = completeReferences({ ...matchingReferences, ...environmentOverrides });
     if (configuredReferences) {
-        if (Object.keys(environmentOverrides).length > 0)
+        if (input.setupPlanId || Object.keys(environmentOverrides).length > 0)
             await saveRuntimeReferenceManifest(manifestPath, input.projectId, input.server, configuredReferences);
         return { references: configuredReferences, manifestPath };
     }
@@ -48,6 +59,13 @@ export async function discoverRuntimeReferences(input) {
             ? `Local sandbox Runtime references are incomplete (${present.join(", ")} present). Existing Gateway setup remains RECORDED_ONLY.`
             : "No existing private Witnora Runtime reference manifest was found. Gateway setup remains RECORDED_ONLY until Hosted bootstrap can issue one-time Runtime references." };
 }
+export function runtimeReferenceManifestPath(input) {
+    const root = dirname(credentialsPath({ configHome: input.configHome }));
+    if (!input.setupPlanId)
+        return join(root, "runtime-references.json");
+    const bindingId = createHash("sha256").update(JSON.stringify([normalizeServer(input.server), input.projectId, input.setupPlanId])).digest("hex");
+    return join(root, "runtime-bootstrap", bindingId, "runtime-references.json");
+}
 function completeReferences(value) {
     const mandateId = text(value.mandateId);
     const runtimeIdentityId = text(value.runtimeIdentityId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.20.15",
+  "version": "0.20.17",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",