witnora 0.20.2 → 0.20.4

package/dist/cli.js

@@ -41,7 +41,7 @@ import { inspectRepository } from "./onboard.js";
 import { renderReleaseEvaluation, runReleaseEvaluation } from "./release-evaluation.js";
 import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
 import { configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, superviseManagedCustomerGateway, } from "./gateway.js";
-import { installCurrentGatewayService, restartCurrentGatewayService, uninstallCurrentGatewayService } from "./gateway-service.js";
+import { installCurrentGatewayService, uninstallCurrentGatewayService } from "./gateway-service.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
@@ -238,7 +238,6 @@ else if (command === "gateway") {
         const repository = readFlag("--repo") ?? process.cwd();
         const dir = readFlag("--dir");
         const service = await installCurrentGatewayService({ repository, gatewayDirectory: dir, cliEntry: fileURLToPath(import.meta.url) });
-        await restartCurrentGatewayService({ repository, gatewayDirectory: dir, cliEntry: fileURLToPath(import.meta.url) });
         const result = await startManagedCustomerGateway({ repository, dir });
         const doctor = await doctorCustomerGateway({ repository, dir });
         if (!isGatewayDoctorReady(doctor))
@@ -263,7 +262,7 @@ else if (command === "gateway") {
             throw new Error("Use witnora gateway service install|uninstall.");
     }
     else if (action === "supervise") {
-        await superviseManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir"), configHome: readFlag("--config-home"), output: (message) => process.stdout.write(message) });
+        await superviseManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir"), configHome: readFlag("--config-home"), serviceLeasePath: readFlag("--service-lease"), serviceGeneration: readFlag("--service-generation"), output: (message) => process.stdout.write(message) });
     }
     else if (action === "stop") {
         const result = await stopManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });

package/dist/gateway-service.js

@@ -1,17 +1,22 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { homedir, userInfo } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+const WINDOWS_PARENT_EXIT_GRACE_MS = 500;
 export async function installGatewayService(input) {
     const plan = createGatewayServicePlan(input);
     // A prior task can still be supervising an older generated Gateway. End it
     // before replacing the definition so onboarding never leaves two owners
     // racing for the same localhost port.
-    if (plan.kind === "WINDOWS_TASK")
+    if (plan.kind === "WINDOWS_TASK") {
         await input.run(plan.stop.command, plan.stop.args).catch(() => undefined);
+        await (input.removeFile ?? removeFile)(plan.serviceLease.path);
+        await (input.sleep ?? wait)(WINDOWS_PARENT_EXIT_GRACE_MS);
+        await input.writeDefinition(plan.serviceLease.path, `${plan.serviceLease.generation}\n`);
+    }
     if (plan.launcher)
         await input.writeDefinition(plan.launcher.path, plan.launcher.definition);
     await input.writeDefinition(plan.definitionPath, plan.definition);
@@ -23,31 +28,42 @@ export async function installGatewayService(input) {
     return { installed: true, plan };
 }
 export async function installCurrentGatewayService(options) {
-    const planInput = currentPlanInput(options);
+    const planInput = currentPlanInput(options, randomUUID());
     return installGatewayService({ ...planInput,
         writeDefinition: async (path, value) => {
             await mkdir(dirname(path), { recursive: true });
-            const contents = planInput.platform === "win32"
+            const contents = planInput.platform === "win32" && !path.endsWith(".lease")
                 ? Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(value, "utf16le")])
                 : Buffer.from(value, "utf8");
             await writeFile(path, contents, { mode: 0o600 });
         },
         run: options.run ?? runCommand,
+        sleep: options.sleep,
+        removeFile: options.removeFile,
     });
 }
 export async function uninstallCurrentGatewayService(options) {
     const plan = createGatewayServicePlan(currentPlanInput(options));
     const run = options.run ?? runCommand;
+    if (plan.kind === "WINDOWS_TASK") {
+        await run(plan.stop.command, plan.stop.args).catch(() => undefined);
+        await (options.removeFile ?? removeFile)(plan.serviceLease.path);
+        await (options.sleep ?? wait)(WINDOWS_PARENT_EXIT_GRACE_MS);
+    }
     await run(plan.uninstall.command, plan.uninstall.args);
     if (plan.kind === "SYSTEMD_USER")
         await run("systemctl", ["--user", "daemon-reload"]);
     await rm(plan.definitionPath, { force: true });
     if (plan.launcher)
         await rm(plan.launcher.path, { force: true });
+    if (plan.serviceLease)
+        await rm(plan.serviceLease.path, { force: true });
     return { uninstalled: true, plan };
 }
 export async function restartCurrentGatewayService(options) {
     const plan = createGatewayServicePlan(currentPlanInput(options));
+    if (plan.kind === "WINDOWS_TASK")
+        return (await installCurrentGatewayService(options)).plan;
     const run = options.run ?? runCommand;
     await run(plan.stop.command, plan.stop.args).catch(() => undefined);
     await run(plan.start.command, plan.start.args);
@@ -56,6 +72,10 @@ export async function restartCurrentGatewayService(options) {
 export async function stopCurrentGatewayService(options) {
     const plan = createGatewayServicePlan(currentPlanInput(options));
     await (options.run ?? runCommand)(plan.stop.command, plan.stop.args).catch(() => undefined);
+    if (plan.kind === "WINDOWS_TASK") {
+        await (options.removeFile ?? removeFile)(plan.serviceLease.path);
+        await (options.sleep ?? wait)(WINDOWS_PARENT_EXIT_GRACE_MS);
+    }
     return plan;
 }
 export function createGatewayServicePlan(input) {
@@ -64,8 +84,12 @@ export function createGatewayServicePlan(input) {
     const superviseArgs = [input.cliEntry, "gateway", "supervise", "--repo", input.repository, "--dir", input.gatewayDirectory];
     if (input.configHome)
         superviseArgs.push("--config-home", input.configHome);
-    if (input.platform === "win32")
-        return windowsPlan(input, id, superviseArgs);
+    if (input.platform === "win32") {
+        const leasePath = `${input.serviceHome}\\${id}.lease`;
+        const generation = input.serviceGeneration ?? "manual-service-generation";
+        superviseArgs.push("--service-lease", leasePath, "--service-generation", generation);
+        return { ...windowsPlan(input, id, superviseArgs), serviceLease: { path: leasePath, generation } };
+    }
     if (input.platform === "darwin")
         return launchdPlan(input, id, superviseArgs);
     if (input.platform === "linux")
@@ -96,7 +120,7 @@ function windowsPlan(input, id, args) {
         stop: { command: "schtasks.exe", args: ["/End", "/TN", id] },
         uninstall: { command: "schtasks.exe", args: ["/Delete", "/TN", id, "/F"] } };
 }
-function currentPlanInput(options) {
+function currentPlanInput(options, serviceGeneration) {
     const platform = options.platform ?? process.platform;
     if (platform !== "win32" && platform !== "linux" && platform !== "darwin")
         throw new Error(`Gateway service installation is not supported on ${platform}.`);
@@ -104,9 +128,15 @@ function currentPlanInput(options) {
     const env = options.env ?? process.env;
     const serviceHome = platform === "win32" ? join(env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "Witnora", "services")
         : platform === "darwin" ? join(homedir(), "Library", "LaunchAgents") : join(homedir(), ".config", "systemd", "user");
-    return { platform, repository, gatewayDirectory: resolve(repository, options.gatewayDirectory ?? ".witnora/gateway"), cliEntry: resolve(options.cliEntry), nodeExecutable: options.nodeExecutable ?? process.execPath, serviceHome, userId: platform === "win32" ? `${env.USERDOMAIN ? `${env.USERDOMAIN}\\` : ""}${env.USERNAME ?? userInfo().username}` : userInfo().username, configHome: options.configHome ?? env.WITNORA_CONFIG_HOME };
+    return { platform, repository, gatewayDirectory: resolve(repository, options.gatewayDirectory ?? ".witnora/gateway"), cliEntry: resolve(options.cliEntry), nodeExecutable: options.nodeExecutable ?? process.execPath, serviceHome, userId: platform === "win32" ? `${env.USERDOMAIN ? `${env.USERDOMAIN}\\` : ""}${env.USERNAME ?? userInfo().username}` : userInfo().username, configHome: options.configHome ?? env.WITNORA_CONFIG_HOME, serviceGeneration };
 }
 async function runCommand(command, args) { await execFileAsync(command, args, { windowsHide: true }); }
+function wait(milliseconds) {
+    return new Promise((resolveWait) => setTimeout(resolveWait, milliseconds));
+}
+async function removeFile(path) {
+    await rm(path, { force: true });
+}
 function systemdPlan(input, id, args) {
     const unit = `${id}.service`;
     const definitionPath = `${input.serviceHome}/${unit}`;

package/dist/gateway.js

@@ -3,7 +3,7 @@ import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 import { access, chmod, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { createServer as createNetServer } from "node:net";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { loadConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
@@ -56,7 +56,7 @@ export async function initializeCustomerGateway(options) {
         projectId: authorization.projectId,
         server: authorization.server,
         connectionName: authorization.connectionName,
-        collectorId: `${slug}-collector`,
+        collectorId: collectorIdForRepository(repository, options.projectId),
         host: process.env.WITNORA_GATEWAY_HOST?.trim() || "127.0.0.1",
         port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, 8787),
         storageDirectory: "data",
@@ -223,8 +223,18 @@ export async function ensureCustomerGatewayPortAvailable(options) {
     const httpActionRaw = await readFile(httpActionPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
     const httpAction = httpActionRaw ? parseCustomerHttpActionConfig(httpActionRaw) : undefined;
     const httpActionGuideRaw = httpAction ? await readFile(httpActionGuidePath, "utf8") : undefined;
-    const health = await localCollector(current.host, current.port, options.fetch ?? fetch);
-    if (health === current.collectorId || (!health && await canListen(current.host, current.port))) {
+    const requestFetch = options.fetch ?? fetch;
+    let health = await localCollector(current.host, current.port, requestFetch);
+    if (!health && await canListen(current.host, current.port)) {
+        // A supervised Gateway can leave a short window between process exit and
+        // recovery. Recheck before claiming the port so another repository's
+        // supervisor cannot reclaim it between this probe and service startup.
+        await (options.sleep ?? wait)(600);
+        health = await localCollector(current.host, current.port, requestFetch);
+        if (!health && await canListen(current.host, current.port))
+            return { changed: false, port: current.port };
+    }
+    if (health === current.collectorId) {
         return { changed: false, port: current.port };
     }
     if (clientRaw !== gatewayClient(current) || readmeRaw !== gatewayReadme(current)
@@ -649,6 +659,11 @@ async function configManagedWorkflowHarnessImport() {
 function configBusinessTaskEvaluatorImport() {
     return import(new URL("./vendor/onegent-runtime/business-task-evaluator.js", import.meta.url).href);
 }
+export function workflowHarnessTickDidWork(result) {
+    return (result.evaluationsCompleted ?? 0) > 0
+        || (result.evaluationsFailed ?? 0) > 0
+        || (result.runtimeWatchObservationsUploaded ?? 0) > 0;
+}
 export async function createConfiguredWorkflowHarness(input) {
     const requestFetch = input.fetch ?? fetch;
     let managedEvaluator;
@@ -717,6 +732,8 @@ export async function createConfiguredWorkflowHarness(input) {
         && input.config.realPathActivations[0].actionPathIds.length === 1
         ? input.config.realPathActivations[0]
         : undefined;
+    const basePollIntervalMs = input.config.pollIntervalMs ?? 5_000;
+    const maxIdlePollIntervalMs = Math.max(basePollIntervalMs, 15 * 60_000);
     const runtimeWatch = runtimeWatchConfiguration
         && input.managed.ManagedFailureRuntimeWatch
         && input.managed.FileFailureRuntimeWatchCheckpointStore
@@ -730,7 +747,7 @@ export async function createConfiguredWorkflowHarness(input) {
                 fetch: requestFetch,
             }),
             checkpoints: new input.managed.FileFailureRuntimeWatchCheckpointStore(join(input.directory, "data", "failure-runtime-watch")),
-            intervalMs: input.config.pollIntervalMs ?? 5_000,
+            intervalMs: maxIdlePollIntervalMs,
             ...(activation ? { bindings: [{ taskContractId: activation.taskContractId, actionPathId: activation.actionPathIds[0], environment: "sandbox" }] } : {}),
             readOutcome: async ({ resourceId, actions, receipts }) => input.managed.readLocalSandboxRuntimeWatchOutcome({
                 path: join(input.directory, "data", "runtime-sandbox", "fixture", "audit.jsonl"),
@@ -744,6 +761,7 @@ export async function createConfiguredWorkflowHarness(input) {
         : undefined;
     let timer;
     let closing = false;
+    let idleTicks = 0;
     let lastTickAt;
     let lastError;
     let lastProviderHealthAt = 0;
@@ -778,14 +796,33 @@ export async function createConfiguredWorkflowHarness(input) {
         start() {
             if (timer || closing)
                 return;
-            void tick().catch((error) => process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`));
-            timer = setInterval(() => void tick().catch((error) => process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`)), input.config.pollIntervalMs ?? 5_000);
-            timer.unref?.();
+            const schedule = (delayMs) => {
+                if (closing)
+                    return;
+                timer = setTimeout(() => void run(), delayMs);
+                timer.unref?.();
+            };
+            const run = async () => {
+                let didWork = false;
+                try {
+                    const result = await tick();
+                    didWork = workflowHarnessTickDidWork(result);
+                }
+                catch (error) {
+                    process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`);
+                }
+                if (closing)
+                    return;
+                idleTicks = didWork ? 0 : idleTicks + 1;
+                const multiplier = 2 ** Math.max(0, idleTicks - 1);
+                schedule(Math.min(maxIdlePollIntervalMs, basePollIntervalMs * multiplier));
+            };
+            schedule(0);
         },
         async close() {
             closing = true;
             if (timer)
-                clearInterval(timer);
+                clearTimeout(timer);
             timer = undefined;
             await managedEvaluator?.close();
         },
@@ -1014,9 +1051,7 @@ async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
     if (!repositoryRelative || repositoryRelative.startsWith("..") || resolve(repository, repositoryRelative) !== modulePath) {
         throw new Error("Managed evaluator module escaped the Agent repository.");
     }
-    const [realRepository, realModulePath] = await Promise.all([realpath(repository), realpath(modulePath)]);
-    const realRelative = relative(realRepository, realModulePath);
-    if (!realRelative || realRelative.startsWith("..") || resolve(realRepository, realRelative) !== realModulePath) {
+    if (!await isRealPathContained(repository, modulePath)) {
         throw new Error("Managed evaluator module symlink escaped the Agent repository.");
     }
     const source = await readFile(modulePath);
@@ -1319,12 +1354,15 @@ export async function statusManagedCustomerGateway(options = {}) {
         pid: runtime?.pid,
         logPath: runtime?.logPath,
     };
-    if (health && health.collectorId !== config.collectorId) {
-        return { ...base, state: "CONFLICT", healthy: false, managed: false, detail: `Port ${config.port} is occupied by collector ${health.collectorId}, not ${config.collectorId}.` };
-    }
     if (runtime && !runtimeMatches(runtime, config)) {
+        if (!pidRunning(runtime.pid)) {
+            return { ...base, state: "STALE", healthy: false, managed: false, detail: "Managed Gateway runtime metadata belongs to an older generated identity and its recorded process is no longer running." };
+        }
         return { ...base, state: "CONFLICT", healthy: false, managed: false, detail: "Managed Gateway runtime metadata belongs to a different project or collector." };
     }
+    if (health && health.collectorId !== config.collectorId) {
+        return { ...base, state: "CONFLICT", healthy: false, managed: false, detail: `Port ${config.port} is occupied by collector ${health.collectorId}, not ${config.collectorId}.` };
+    }
     if (health) {
         const managed = Boolean(runtime && pidRunning(runtime.pid));
         return {
@@ -1392,20 +1430,47 @@ export async function restartManagedCustomerGateway(options = {}) {
 export async function superviseManagedCustomerGateway(options = {}) {
     const inspect = options.inspect ?? (() => statusManagedCustomerGateway({ repository: options.repository, dir: options.dir }));
     const start = options.start ?? (() => startManagedCustomerGateway({ repository: options.repository, dir: options.dir, configHome: options.configHome }));
+    const stop = options.stop ?? (() => stopManagedCustomerGateway({ repository: options.repository, dir: options.dir, configHome: options.configHome }));
     const sleep = options.sleep ?? wait;
     const maxCycles = options.maxCycles ?? Number.POSITIVE_INFINITY;
+    if (Boolean(options.serviceLeasePath) !== Boolean(options.serviceGeneration)) {
+        throw new Error("A service-owned Gateway supervisor requires both its lease path and generation.");
+    }
+    const readServiceLease = options.readServiceLease ?? ((path) => readFile(path, "utf8"));
+    const leaseRevoked = async () => {
+        if (!options.serviceLeasePath || !options.serviceGeneration)
+            return false;
+        try {
+            return (await readServiceLease(options.serviceLeasePath)).trim() !== options.serviceGeneration;
+        }
+        catch {
+            return true;
+        }
+    };
+    const stopForRevokedLease = async () => {
+        if (!await leaseRevoked())
+            return false;
+        await stop();
+        return true;
+    };
     let recoveries = 0;
     for (let cycle = 0; cycle < maxCycles; cycle += 1) {
+        if (await stopForRevokedLease())
+            return;
         const status = await inspect();
+        if (await stopForRevokedLease())
+            return;
         if (status.state === "CONFLICT")
             throw new Error(status.detail);
         if (status.state === "STOPPED" || status.state === "STALE") {
             await start();
             recoveries += 1;
             options.output?.(`Recovered customer-owned Gateway (${recoveries}).\n`);
+            if (await stopForRevokedLease())
+                return;
         }
         if (cycle + 1 < maxCycles)
-            await sleep(options.intervalMs ?? 5_000);
+            await sleep(options.intervalMs ?? (options.serviceLeasePath ? 250 : 5_000));
     }
 }
 export async function readManagedCustomerGatewayLogs(options = {}) {
@@ -1744,9 +1809,7 @@ export async function activateManagedWorkflowHarness(options) {
     if (!moduleRelativeToRepository || moduleRelativeToRepository.startsWith("..") || resolve(repository, moduleRelativeToRepository) !== absoluteModulePath) {
         throw new Error("The customer Assurance Harness module must remain inside the Agent repository.");
     }
-    const [realRepository, realModulePath] = await Promise.all([realpath(repository), realpath(absoluteModulePath).catch(() => absoluteModulePath)]);
-    const realRelative = relative(realRepository, realModulePath);
-    if (realRelative.startsWith("..") || resolve(realRepository, realRelative) !== realModulePath) {
+    if (!await isRealPathContained(repository, absoluteModulePath)) {
         throw new Error("The customer Assurance Harness module symlink must remain inside the Agent repository.");
     }
     const source = await readFile(absoluteModulePath, "utf8").catch((error) => {
@@ -1795,6 +1858,25 @@ export async function activateManagedWorkflowHarness(options) {
     }
     return { state: "READY_TO_START", path, modulePath: evaluatorModulePath, config, created, changed };
 }
+export async function isRealPathContained(repository, candidate, resolveRealPath = realpath) {
+    const canonicalExistingPath = async (path) => {
+        const resolvedPath = await resolveRealPath(path);
+        const resolvedParent = await resolveRealPath(dirname(resolvedPath));
+        return join(resolvedParent, basename(resolvedPath));
+    };
+    const realRepository = await canonicalExistingPath(repository);
+    let realCandidate;
+    try {
+        realCandidate = await canonicalExistingPath(candidate);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        realCandidate = join(await canonicalExistingPath(dirname(candidate)), basename(candidate));
+    }
+    const realRelative = relative(realRepository, realCandidate);
+    return realRelative === "" || (realRelative !== ".." && !realRelative.startsWith(`..${sep}`) && !isAbsolute(realRelative));
+}
 function isExactGeneratedHarnessUpgrade(current, next, previousGeneratedModuleSha256) {
     if (!previousGeneratedModuleSha256 || current.evaluatorModuleSha256 !== previousGeneratedModuleSha256 || current.evaluatorContractSha256 !== previousGeneratedModuleSha256)
         return false;
@@ -2139,6 +2221,11 @@ function wait(milliseconds) {
 function safeSlug(value) {
     return (value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent-repository").slice(0, 48);
 }
+function collectorIdForRepository(repository, projectId) {
+    const readable = safeSlug(basename(repository)).slice(0, 36);
+    const identity = createHash("sha256").update(`${resolve(repository)}\n${projectId}`).digest("hex").slice(0, 10);
+    return `${readable}-${identity}-collector`;
+}
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/onboard.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
+import { credentialsPath, DEFAULT_WITNORA_SERVER, loadConnection, saveConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
 import { inferPrivateCapabilities, runPrivateCapabilityDiscovery } from "./private-discovery.js";
@@ -26,7 +26,15 @@ export async function runOnboard(options) {
         framework: frameworkForTemplate(repository.template),
     };
     const connectionName = options.name ?? repository.slug;
-    const token = await authorizeProjectConnection({
+    const reusableConnection = await loadMatchingOnboardConnection({
+        repository: repositoryPath,
+        projectId: options.projectId,
+        server,
+        connectionName,
+        configHome: options.configHome,
+        fetch: requestFetch,
+    });
+    const token = reusableConnection ?? await authorizeProjectConnection({
         projectId: options.projectId,
         connectionName,
         credentialProfile: "autopilot",
@@ -38,6 +46,8 @@ export async function runOnboard(options) {
         output,
         configHome: options.configHome,
     });
+    if (reusableConnection)
+        output("Reusing the previously approved project-scoped setup connection; no new browser approval is required.\n");
     const credentialsPath = token.credentialsPath;
     await verifyControlPlaneConnection({ baseUrl: server, projectId: token.projectId, apiKey: token.apiKey, fetch: requestFetch });
     const planSnapshot = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/setup-plans`, {
@@ -211,7 +221,7 @@ export async function runOnboard(options) {
                         if (!(error instanceof RuntimeSetupNotReadyError))
                             throw error;
                         runtimeLimitation = `Local sandbox Runtime references were found but did not establish readiness: ${error.message}`;
-                        output("\nExisting customer-owned Gateway remains RECORDED_ONLY because its Runtime references did not pass readiness checks.\n");
+                        output(`\nExisting customer-owned Gateway remains RECORDED_ONLY because its Runtime references did not pass readiness checks: ${error.message}\n`);
                     }
                 }
                 else {
@@ -336,7 +346,7 @@ export async function runOnboard(options) {
             output(`Action transport: ${actionTransportTest.transport.toUpperCase()} is waiting for one exact sandbox Task/action path. ${actionTransportTest.limitation}\n`);
         }
         output(actionTransportTest?.state === "WAITING_FOR_ACTION_PATH"
-            ? `Base Gateway connected, but ${actionTransportTest.transport.toUpperCase()} Action is not verified yet. Go to Overview, run the Agent once, confirm one exact sandbox Business Task/action path, then rerun this same command.\n`
+            ? `Base Gateway connected, but ${actionTransportTest.transport.toUpperCase()} Action is not verified yet. Run the Agent's normal sandbox workflow from this repository; there is no Run button in Overview. Once Overview receives the activity, confirm one sandbox Business Task and choose its exact discovered Agent action, then rerun this same command.\n`
             : "Connected. Nora is monitoring this Agent. Run it normally whenever it is ready; the first source-signed activity will appear automatically without blocking setup.\n");
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
@@ -368,6 +378,35 @@ export async function runOnboard(options) {
         throw new Error(`Witnora Setup Autopilot rolled back this install attempt: ${diagnosis}`);
     }
 }
+const AUTOPILOT_CONNECTION_SCOPES = [
+    "runs:read", "runs:write", "events:write", "evidence:write", "collector:manage",
+    "actions:read", "actions:propose", "actions:execute",
+];
+async function loadMatchingOnboardConnection(options) {
+    const gateway = await inspectCustomerGatewayFiles({ repository: options.repository });
+    try {
+        let candidateName = options.connectionName;
+        if (gateway.status === "complete") {
+            const config = JSON.parse(await readFile(join(gateway.directory, "gateway.json"), "utf8"));
+            if (config.projectId !== options.projectId || config.server !== options.server || typeof config.connectionName !== "string")
+                return undefined;
+            candidateName = config.connectionName;
+        }
+        const stored = await loadConnection(candidateName, { configHome: options.configHome });
+        if (!stored || stored.projectId !== options.projectId || stored.server !== options.server)
+            return undefined;
+        await verifyControlPlaneConnection({ baseUrl: stored.server, projectId: stored.projectId, apiKey: stored.apiKey, fetch: options.fetch });
+        return {
+            ...stored,
+            connectionName: candidateName,
+            credentialsPath: credentialsPath({ configHome: options.configHome }),
+            scopes: [...AUTOPILOT_CONNECTION_SCOPES],
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
 async function runActionTransportTest(options) {
     if (!options.httpActionReady)
         return {
@@ -378,13 +417,13 @@ async function runActionTransportTest(options) {
     const binding = await loadCustomerMcpActionBinding({ repository: options.repository });
     const checkedAt = new Date().toISOString();
     const passed = options.transport === "http"
-        ? {
+        ? await verifyHttpActionConnection(binding, options.fetch).then((endpoint) => ({
             state: "PASSED",
             transport: "http",
             checkedAt,
             actionId: binding.action.id,
-            endpoint: `${binding.baseUrl}${binding.action.path}`,
-        }
+            endpoint,
+        }))
         : await import("./mcp.js").then(async ({ testWitnoraMcpConnection }) => {
             const result = await testWitnoraMcpConnection({ repository: options.repository, fetch: options.fetch });
             return {
@@ -420,6 +459,24 @@ async function runActionTransportTest(options) {
     options.generatedFiles.push(receiptPath);
     return { ...passed, receiptPath };
 }
+async function verifyHttpActionConnection(binding, requestFetch) {
+    const endpoint = `${binding.baseUrl}${binding.action.path}`;
+    const response = await requestFetch(endpoint, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${binding.actionToken}`,
+            "content-type": "application/json",
+            "idempotency-key": `witnora-transport-test-${binding.action.id}`,
+        },
+        body: "{}",
+        signal: AbortSignal.timeout(5_000),
+    });
+    const body = await response.json().catch(() => ({}));
+    if (response.status !== 400 || body.error !== "resourceId is required and must use URL-safe identifier characters.") {
+        throw new Error(`HTTP Action connection test failed closed (${response.status}). The exact customer-owned endpoint, Action binding, or action-scoped token is unavailable.`);
+    }
+    return endpoint;
+}
 async function waitForInstalledGatewayService(options) {
     const pause = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
     const deadline = Date.now() + (options.timeoutMs ?? 12_000);

package/dist/vendor/onegent-runtime/failure-runtime-watch.js

@@ -87,8 +87,8 @@ export class ManagedFailureRuntimeWatch {
         this.#now = options.now ?? (() => new Date());
         this.#readOutcome = options.readOutcome;
         this.#bindings = options.bindings ? new Set(options.bindings.map(bindingKey)) : undefined;
-        if (!Number.isSafeInteger(this.#intervalMs) || this.#intervalMs < 1_000 || this.#intervalMs > 60_000) {
-            throw new Error("Failure Runtime Watch intervalMs must be between 1000 and 60000.");
+        if (!Number.isSafeInteger(this.#intervalMs) || this.#intervalMs < 1_000 || this.#intervalMs > 15 * 60_000) {
+            throw new Error("Failure Runtime Watch intervalMs must be between 1000 and 900000.");
         }
     }
     tick() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",