feat(daemon): reconstruct managed session catalog

[sethkarten]

Summary

• reconstruct immutable managed-session family catalog authorization across resident, saved, passive, and remote sessions
• thread one duplicate-fail-closed topology snapshot through message, observe, hydration, and supervisor delivery
• preserve passive lifecycle surfaces and closing-session fences while rejecting incompatible persisted/live or malformed remote topology

Stack

• Draft child of feat(kernel): dispatch host requests as capabilities #1243 (core02-host-request-dispatcher)

Validation

• Focused configured catalog suite: 228/228
• Post-commit exact configured suite: 228/228
• Nonwriting Biome on six paths: pass
• Root tsgo --noEmit: pass
• git diff-check / clean hygiene: pass

Exclusions

• no MCP/project settings, kernel host-request, launchEnv/lifecycle recovery, probe, or saved-sibling follow-up

---

Note

High Risk
Changes authentication-adjacent agent family reach, cross-worker messaging, and catalog I/O; ambiguous or hostile topology now hard-denies ACL surfaces that previously might have succeeded.

Overview
Replaces ad-hoc sibling/parent inference with a managed family catalog built from saved sessions, RLM registries, and live workers. The catalog process gains family / listCatalogFamilySessions, openat-based trusted reads, and strict topology checks (depth, cycles, duplicates, symlinks); siblings are derived from that graph instead of loose registry scans.

agent-messages now resolves siblings only when the catalog yields a single unambiguous parent; contradictory id/path parent claims are rejected. Name reservation can still use direct parent claims when a passive child outlives its parent row, without widening family reach.

Daemon and supervisor build agentFamilyCatalogEntries / familyCatalogEntries by merging persisted, artifact, passive, resident, and remote rows (duplicate or conflicting topology fails closed). Agent-origin send, observe, roster, and wake authorize against one captured snapshot; post-wake session substitution is rejected. CLI sends stay deliverable with advisory relationship labels when the catalog is ambiguous or unavailable.

rename_saved_session bumps to schema revision 17 with optional sessionDir so inactive renames and name checks use the correct catalog root. readSessionInfoFromBuffer lets catalog parsing reuse bound file bytes without reopening paths.

^{Reviewed by Cursor Bugbot for commit 8a3c33f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Reconstruct managed session catalog with authoritative topology snapshots for daemon ACL enforcement

• Introduces listCatalogFamilySessions in daemon-catalog-process.ts, which traverses the session family graph securely using O_NOFOLLOW directory handles and a Python descriptor-relative file reader to mitigate TOCTOU races and path traversal attacks.
• Adds agentFamilyCatalogEntries to daemon-mode.ts, merging saved, passive, resident, and remote session sources into a single immutable authorization snapshot; agent-origin message delivery is now gated against this snapshot rather than mutable live state.
• Updates sameAgentFamilyParent and isAgentFamilyParent in agent-messages.ts to require catalog-resolved, unambiguous single parents for sibling classification; direct identifier equality without catalog resolution no longer qualifies.
• Extends daemon-supervisor.ts with familyCatalogEntries and authoritativeFamilyCatalogEntry to scope rename, name-availability, and send-message authorization to a specific sessionDir; conflicting persisted vs. live topology now fails closed.
• Bumps daemon schema to revision 17 and adds optional sessionDir to the rename_saved_session command, requiring protocol>=7 and schemaRevision>=17.
• Risk: listSavedSessionSiblings now throws if the target session is absent from the authoritative family traversal, and malformed remote peer topology raises AGENT_FAMILY_REACH_ERROR instead of being silently coerced.

^{Macroscope summarized 8a3c33f.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5b96482. Configure here.}

[sethkarten]

Follow-up fix in 8a3c33f9ded05383424baafc415cf1623a9f7da2: during independent review of the CLI sibling-label fix, we found that malformed endpoint catalog authority or catalog acquisition failure could incorrectly block an otherwise valid CLI delivery. CLI topology is now best-effort label metadata: acquisition failures emit a scoped diagnostic, and family-authority ambiguity omits the relationship label. Agent-origin acquisition and reachability authorization remain fail-closed and unchanged.

Validation: exact Biome 2.5.5; root tsgo --noEmit; six focused daemon-mode cases passed (disjoint topology, valid siblings, ambiguous parent, duplicate sender, duplicate target, and acquisition failure, with paired agent-origin rejection coverage). Fresh independent exact-diff review approved.

[sethkarten]

Superseded by #1333 as part of the physical Core/MCP stack split. The replacement preserves this PR’s reviewed semantic delta on the corrected shared #1243 foundation. Closing this PR to avoid duplicate review; branch retained for provenance.