[abhiabhijit]

What this adds

• Kernel controls for agent trees:
  • admin tools, work outside the agent, instruction files
  • per-agent approved programs and hosts, with hostnames resolved to IPs by DNS learning
• Agents can't install packages (new, on by default):
  • The kernel stops an agent's package manager before it runs. The daemon refuses installs (npm install, npx, pip install, uv add, cargo install, …) and resumes everything else (npm test, npm run).
  • The agent is told why on its stderr.
• Package managers are never mistaken for agents: npm i openclaw is npm, not OpenClaw.
• Discovery lists every agent, including Hermes Agent and OpenClaw.
• Live commentary (text): what each agent is doing and what was refused, in plain words; per-session transcript in Sessions.
• Security history (was Threats):
  • every refusal in the last 24 hours, none hidden, with the full path of refused files
  • actions: Change rule (password-gated) and Mark reviewed

Fixes

• A directory rule no longer blocks a file name everywhere.
• A worker thread exiting no longer untags its agent.
• opencode is enforced and narrated.
• Terminate works.
• polkit errors are clear.

Testing

• Workspace tests pass (daemon: 347). The eBPF object builds and loads cleanly under the verifier.
• Checked by hand on Ubuntu 26.04 (kernel 7.0):
  • npm install, npx and python -m pip install from an agent are refused.
  • npm test from an agent runs.
  • A person's own npm install works.
  • Refused file opens record the full path.