[callumflack]

Summary

connectors desktop → upstream build → immutable local inbox
  → Sources review → explicit Enable/Update and import
desktop-status → inspect receipt
desktop-resume --open → reopen matching review

Add the CLI side of the same-Mac private connector workflow. Frozen payload bytes bind the owner, Account authority, environment, network and streams. Unchanged inputs reuse the handoff ID; edits require a new Desktop review. Machine modes return an actionable approval-required outcome and never open or activate Desktop. Status/resume verify the payload without rebuilding or recollecting.

Draft for CI and review only. Merges, releases and deployments are held. Released 0.48.2 is the base; this command also requires the matching Desktop/runtime candidate. Maciej's existing CLI #114–116 retain their separate ownership.

Evidence

• Before: no immutable CLI → Desktop private-snapshot handoff. After: packaging and CLI tests cover identity reuse, changed bytes, strict payload checks, context binding and non-interactive behavior.
• Focused tests, build, lint and format passed locally. Normal dev CLI sign-in and --open reached native review; actual dev consent and automatic same-browser app return passed in the recorded integration run.
• Fresh packaging without --open produced the synthetic v0.0.7 update. Native Sources discovered it, explicit import completed, and desktop-status returned desktop_enabled. The existing SDK app consumed and retained changed output through the same grant, without provider collection or payment.
• Local integration is dev Account/Moksha on one Mac. GitHub CI covers the Node matrix, Linux/Windows standalone smoke tests and demo generation; attached checks carry the current result.

Merge Danger

Door: two-way.

Blast Radius: onboarding.

Deliver the matching signed Desktop/runtime and ready Account schema/API before releasing CLI onboarding. Packaging does not publish, sign, approve or execute the connector. Public connector distribution and Mobile remain outside this slice.