jeden headless

Exact invocation#

jeden headless <addr> <server-cert.pem> <server-key.pem> <client-ca.pem> <identity-map.json> [revoked-serials.txt]

Inputs and options#

• Required: bind address, server certificate chain, server private key, client CA bundle, and a JSON identity map.
• Optional: a text file of revoked client-certificate serials.
• Each identity-map entry must supply san, principal, and tenant, and may supply workspaces: a list of absolute host directories that principal is granted.
• The same completion get, control and continue methods are available after session creation or open, subject to the existing tenant/workspace authorization. Continue uses the request metadata idempotency key and returns the same started, reattached or completed response as session/prompt.

Output and state effect#

Creates .jeden/headless service state, a durable reconnect key, tenant idempotency/replay stores, and an mTLS listener at the requested address. Beyond health/readiness, session/create, session/reconnect, session/prompt, session/replay and session/cancel, it serves session/list, session/open and session/history: a principal with granted workspaces lists the host's own sessions whose recorded cwd lies inside a grant, opens one under its own host session id so later prompts continue that very ledger, and reads its replayed turns without resuming it. A principal without workspaces keeps seeing only the sessions it created here, jailed to its tenant scratch workspace.

Refusals and boundaries#

• Any argument count other than five or six is refused with the exact usage line shown above.
• Unreadable or invalid identity maps, empty maps, invalid mappings, TLS material failures, revoked certificates, certificates without an identity SAN, and bind failures are refused.
• A workspaces entry that is not an absolute path, contains .., or is not an existing readable directory is named and refused when the identity map is loaded.
• session/open and session/history refuse access_denied for a principal without granted workspaces, for an id that is not a session directory under the session root, and for a session whose recorded cwd lies outside every grant; a missing or blank sessionId and a limit below one are invalid_request.
• A session directory whose state.json cannot be read is left out of session/list and counted in the reply's skipped field rather than silently dropped.
• Tenant request, session, and stored-byte limits are enforced instead of admitting excess work.