@agentconnect.md/daemon 1.0.0-rc.16 → 1.0.0-rc.18

package/dist/index.js

@@ -12,6 +12,7 @@ import { createInterface } from "node:readline";
 import { freemem, homedir, hostname, loadavg, totalmem, type } from "node:os";
 import { spawn as spawn$1 } from "child_process";
 import { Readable, Writable } from "node:stream";
+import { MAX_FRAME_BYTES, buildEnvelope, decodeEnvelope, encode, isFrame } from "@agentconnect.md/protocol";
 import { randomUUID } from "node:crypto";
 import { lstat, open, readdir, realpath, stat as stat$1 } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
@@ -16871,535 +16872,6 @@ async function runChat(opts) {
 //#region src/version.ts
 const DAEMON_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 //#endregion
-//#region ../protocol/src/envelope.ts
-/**
-* The protocol envelope — every frame, both directions, is wrapped in this.
-* Mirrors daemon-cp-ws-protocol.md §1.1.
-*
-* `payload` is left as `unknown` here and validated by the per-type schema in
-* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
-* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
-* instead of a hard close — forward-compat, protocol §1.
-*/
-const Envelope = object({
-	v: literal(1),
-	id: string().uuid(),
-	ts: string().datetime(),
-	type: string(),
-	corr: string().uuid().optional(),
-	payload: unknown()
-});
-object({
-	epoch: number().int(),
-	seq: number().int().optional(),
-	agentId: string().uuid().optional(),
-	launchId: string().uuid().optional()
-});
-/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
-const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-//#endregion
-//#region ../protocol/src/frames/auth.ts
-/**
-* Auth & identity — protocol §3.1 / §3.2.
-*
-* `auth` is the first frame after the socket opens. `auth/ok` carries the
-* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
-* resume verdict.
-*/
-const AuthReq = object({
-	daemonToken: string(),
-	daemonId: string().uuid().optional(),
-	machineId: string().uuid().optional(),
-	attestation: string().optional(),
-	agentVersion: string(),
-	resume: object({
-		lastEpoch: number().int(),
-		lastRecvSeq: record(string(), number())
-	}).optional()
-});
-const AuthOk = object({
-	daemonId: string().uuid(),
-	sessionEpoch: number().int(),
-	heartbeatSec: number().int(),
-	serverTime: string().datetime(),
-	resume: object({
-		accepted: boolean(),
-		redeliverFromSeq: record(string(), number()).optional()
-	}).optional()
-});
-//#endregion
-//#region ../protocol/src/frames/route.ts
-/**
-* Routing & orchestration (C→D control) — protocol §5.
-*
-* `SessionKey` is the canonical session primitive shared across route/*,
-* agent/*, and event/session. Its canonical string form is
-* `${platform}:${channel}:${thread ?? "-"}`.
-*/
-const Platform = _enum(["slack", "telegram"]);
-const SessionKey = object({
-	platform: Platform,
-	channel: string(),
-	thread: string().optional()
-});
-/** Trigger-matching rule for a binding (protocol §5.1). */
-const BindRule = object({ match: discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]) });
-const RouteAssign = object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	workspaceId: string().uuid(),
-	bindRules: array(BindRule).default([])
-});
-const RouteAssignAck = object({
-	ok: boolean(),
-	sessionKey: SessionKey,
-	reason: string().optional()
-});
-const RouteUpdate = object({
-	routingEpoch: number().int(),
-	rules: array(object({
-		match: unknown(),
-		agentId: string().uuid()
-	}))
-});
-/** Graceful scale-down / rebalance — protocol §5.3. */
-const Drain = object({
-	scope: union([
-		object({
-			kind: literal("agent"),
-			agentId: string().uuid()
-		}),
-		object({ kind: literal("daemon") }),
-		object({
-			kind: literal("session"),
-			sessionKey: SessionKey
-		})
-	]),
-	deadline: string().datetime()
-});
-const DrainProgress = object({
-	remaining: number().int(),
-	drained: array(SessionKey)
-});
-const DrainDone = object({ released: array(SessionKey) });
-//#endregion
-//#region ../protocol/src/frames/cron.ts
-/**
-* Cron sinks to the daemon (D5) — protocol §5.4.
-*
-* The CP owns the definition; the daemon owns firing + last-run persistence so
-* crons fire even when the CP is down.
-*/
-const CronUpsert = object({
-	cronId: string().uuid(),
-	schedule: string(),
-	target: object({ channel: string() }),
-	trigger: string(),
-	enabled: boolean().default(true)
-});
-const CronRemove = object({ cronId: string().uuid() });
-//#endregion
-//#region ../protocol/src/frames/secrets.ts
-/**
-* Secrets (C5 ↔ D10) — protocol §6.
-*
-* Lease-based, no plaintext on the wire or in PG. Every frame carries a
-* REFERENCE to a Vault/KMS path, never the secret material itself.
-*/
-const SecretsRequest = object({ scope: object({
-	platform: Platform,
-	workspaceId: string().uuid()
-}) });
-const SecretsGrant = object({
-	leaseId: string().uuid(),
-	scope: object({
-		platform: string(),
-		workspaceId: string().uuid()
-	}),
-	ref: string(),
-	ttl: number().int(),
-	renewBeforeSec: number().int()
-});
-const SecretsRenew = object({ leaseId: string().uuid() });
-const SecretsRevoke = object({
-	leaseId: string().uuid(),
-	reason: string()
-});
-/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
-const ScopeAttestation = object({
-	machineId: string().uuid(),
-	scope: _enum([
-		"attachment.put",
-		"attachment.get",
-		"facts.put"
-	]),
-	resourceRef: string(),
-	jws: string(),
-	exp: string().datetime()
-});
-//#endregion
-//#region ../protocol/src/frames/register.ts
-/**
-* Capability upload + the reconcile snapshot — protocol §3.3.
-*
-* `register/ok` is the authoritative source of truth: the daemon converges its
-* local cache to it. CP wins all conflicts, so re-issuing the same snapshot is
-* idempotent.
-*/
-const RegisterReq = object({
-	host: string(),
-	capabilities: object({
-		platforms: array(Platform),
-		runtimes: array(string()),
-		acp: boolean(),
-		features: array(string()).default([])
-	}),
-	maxAgents: number().int(),
-	localState: object({
-		assignments: array(string()),
-		crons: array(string()),
-		leases: array(string())
-	})
-});
-const RegisterOk = object({
-	routingEpoch: number().int(),
-	assignments: array(RouteAssign),
-	crons: array(CronUpsert),
-	leases: array(SecretsGrant),
-	drop: object({
-		assignments: array(string()),
-		crons: array(string())
-	})
-});
-//#endregion
-//#region ../protocol/src/frames/agent.ts
-/**
-* Agent lifecycle + delivery (protocol §4.3, §4.4, §7.4, §8).
-*
-* Body-locality invariant (protocol §12): no frame here carries
-* `NormalizedMessage.text`. `agent/prompt` ships a `NormalizedMessageRef` — a
-* reference the daemon resolves against its local body store.
-*/
-/**
-* A REFERENCE/digest of a normalized message, NOT the body (protocol §4.3).
-* Enough for D4/D6 to fetch the local body and prompt.
-*/
-const NormalizedMessageRef = object({
-	sessionKey: SessionKey,
-	platformMsgId: string(),
-	seenUpToSeq: number().int()
-});
-const AgentLaunch = object({
-	agentId: string().uuid(),
-	runtime: string(),
-	workspaceId: string().uuid(),
-	capabilities: array(string()),
-	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
-});
-const AgentLaunched = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	acpSessionId: string().optional(),
-	startedAt: string().datetime(),
-	runtime: string()
-});
-const AgentStop = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	reason: string()
-});
-const AgentPrompt = object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	content: NormalizedMessageRef,
-	seenUpToSeq: number().int()
-});
-const AgentPromptAck = object({
-	accepted: boolean(),
-	reason: _enum([
-		"queued",
-		"held",
-		"scope_denied",
-		"no_session",
-		"stale"
-	]).optional(),
-	seq: number().int()
-});
-const AgentActivity = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	state: _enum([
-		"thinking",
-		"tool_call",
-		"awaiting_permission",
-		"idle"
-	]),
-	ts: string().datetime()
-});
-const AgentScopeDenied = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	capability: string()
-});
-//#endregion
-//#region ../protocol/src/frame.ts
-/**
-* The single source of truth for the wire: `type` string → payload zod schema.
-*
-* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
-* frames) plus the correlated REP types named in the "Reply" column
-* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
-* travel on the wire and must be decodable.
-*
-* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
-* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
-*/
-const FRAME_SCHEMAS = {
-	auth: AuthReq,
-	"auth/ok": AuthOk,
-	register: RegisterReq,
-	"register/ok": RegisterOk,
-	heartbeat: object({
-		load: object({
-			cpu: number(),
-			mem: number(),
-			agents: number().int()
-		}),
-		health: _enum(["ok", "degraded"]),
-		activeSessions: number().int(),
-		degradedScopes: array(string()).default([])
-	}),
-	"agent/launch": AgentLaunch,
-	"agent/launched": AgentLaunched,
-	"agent/stop": AgentStop,
-	"agent/prompt": AgentPrompt,
-	"agent/prompt/ack": AgentPromptAck,
-	"agent/activity": AgentActivity,
-	"agent/scope-denied": AgentScopeDenied,
-	"route/assign": RouteAssign,
-	"route/assign/ack": RouteAssignAck,
-	"route/update": RouteUpdate,
-	"daemon/drain": Drain,
-	"drain/progress": DrainProgress,
-	"drain/done": DrainDone,
-	"cron/upsert": CronUpsert,
-	"cron/remove": CronRemove,
-	"secrets/request": SecretsRequest,
-	"secrets/grant": SecretsGrant,
-	"secrets/renew": SecretsRenew,
-	"secrets/revoke": SecretsRevoke,
-	"scope-attestation": ScopeAttestation,
-	"event/session": object({
-		sessionId: string().uuid(),
-		agentId: string().uuid(),
-		launchId: string().uuid(),
-		phase: _enum([
-			"start",
-			"plan",
-			"problem",
-			"end"
-		]),
-		link: string().optional(),
-		summary: string().optional(),
-		ts: string().datetime()
-	}),
-	"facts/runtime-profile": object({
-		runtime: string(),
-		version: string(),
-		models: array(string()),
-		contextWindow: number().int().optional(),
-		acpSupport: _enum([
-			"full",
-			"partial",
-			"none"
-		]),
-		toolCalling: boolean()
-	}),
-	"config/push": object({ keys: record(string(), unknown()) }),
-	"daemon/restart": object({
-		reason: string(),
-		drainFirst: boolean().default(true)
-	}),
-	"daemon/upgrade": object({
-		targetVersion: string(),
-		drainFirst: boolean().default(true)
-	}),
-	"daemon/control/ack": object({
-		accepted: boolean(),
-		willDrainUntil: string().datetime().optional()
-	}),
-	ack: object({
-		ok: boolean(),
-		reason: string().optional()
-	}),
-	error: object({
-		code: _enum([
-			"UNKNOWN_FRAME",
-			"FRAME_TOO_LARGE",
-			"PROTOCOL_STATE",
-			"BAD_PAYLOAD",
-			"AUTH_FAILED",
-			"ATTESTATION_INVALID",
-			"STALE_EPOCH",
-			"STALE_LAUNCH",
-			"SEQ_GAP",
-			"NO_SESSION",
-			"HELD",
-			"SCOPE_DENIED",
-			"LEASE_EXPIRED",
-			"LEASE_DENIED",
-			"RATE_LIMITED",
-			"INTERNAL"
-		]),
-		message: string(),
-		retryable: boolean(),
-		details: record(string(), unknown()).optional()
-	})
-};
-Object.keys(FRAME_SCHEMAS);
-/**
-* Builds the envelope schema for one frame `type` with a `type` literal and the
-* typed payload, so the discriminated union infers `payload` precisely.
-*/
-function frame(type, payload) {
-	return object({
-		v: literal(1),
-		id: string().uuid(),
-		ts: string().datetime(),
-		type: literal(type),
-		corr: string().uuid().optional(),
-		payload
-	});
-}
-discriminatedUnion("type", [
-	frame("auth", FRAME_SCHEMAS["auth"]),
-	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
-	frame("register", FRAME_SCHEMAS["register"]),
-	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
-	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
-	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
-	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
-	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
-	frame("agent/prompt", FRAME_SCHEMAS["agent/prompt"]),
-	frame("agent/prompt/ack", FRAME_SCHEMAS["agent/prompt/ack"]),
-	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
-	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
-	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
-	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
-	frame("route/update", FRAME_SCHEMAS["route/update"]),
-	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
-	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
-	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
-	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
-	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
-	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
-	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
-	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
-	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
-	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
-	frame("event/session", FRAME_SCHEMAS["event/session"]),
-	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
-	frame("config/push", FRAME_SCHEMAS["config/push"]),
-	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
-	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
-	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
-	frame("ack", FRAME_SCHEMAS["ack"]),
-	frame("error", FRAME_SCHEMAS["error"])
-]);
-//#endregion
-//#region ../protocol/src/codec.ts
-/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
-const MAX_FRAME_BYTES = 256 * 1024;
-const textEncoder = new TextEncoder();
-function byteLength(text) {
-	return textEncoder.encode(text).length;
-}
-function extractControlExt(json) {
-	if (typeof json !== "object" || json === null) return void 0;
-	const o = json;
-	const ext = {};
-	if (typeof o.epoch === "number") ext.epoch = o.epoch;
-	if (typeof o.seq === "number") ext.seq = o.seq;
-	if (typeof o.agentId === "string") ext.agentId = o.agentId;
-	if (typeof o.launchId === "string") ext.launchId = o.launchId;
-	return Object.keys(ext).length > 0 ? ext : void 0;
-}
-function decodeEnvelope(text) {
-	if (byteLength(text) > 262144) return {
-		ok: false,
-		id: NIL_UUID,
-		msg: "FRAME_TOO_LARGE"
-	};
-	let json;
-	try {
-		json = JSON.parse(text);
-	} catch {
-		return {
-			ok: false,
-			id: NIL_UUID,
-			msg: "invalid json"
-		};
-	}
-	const env = Envelope.safeParse(json);
-	if (!env.success) return {
-		ok: false,
-		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
-		msg: env.error.message
-	};
-	const schema = FRAME_SCHEMAS[env.data.type];
-	if (!schema) return {
-		ok: false,
-		id: env.data.id,
-		msg: "UNKNOWN_FRAME"
-	};
-	const payload = schema.safeParse(env.data.payload);
-	if (!payload.success) return {
-		ok: false,
-		id: env.data.id,
-		msg: payload.error.message
-	};
-	const ext = extractControlExt(json);
-	return {
-		ok: true,
-		frame: {
-			...env.data,
-			payload: payload.data
-		},
-		...ext ? { ext } : {}
-	};
-}
-function buildEnvelope(type, payload, opts = {}) {
-	return {
-		v: 1,
-		id: opts.id ?? randomUUID(),
-		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
-		type,
-		payload,
-		...opts.corr ? { corr: opts.corr } : {},
-		...opts.ext ?? {}
-	};
-}
-function encode(frame) {
-	return JSON.stringify(frame);
-}
-//#endregion
-//#region ../protocol/src/index.ts
-/**
-* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
-* `AnyFrame` to the member whose `type` matches.
-*/
-function isFrame(type) {
-	return (frame) => frame.type === type;
-}
-//#endregion
 //#region ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js
 var require_constants$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const BINARY_TYPES = [
@@ -23126,6 +22598,34 @@ function routeRules(msg, rules, threadOwner) {
 	return null;
 }
 //#endregion
+//#region src/commands/commands.ts
+/** Accepted command prefixes (Slack uses `!`; `/` is for future platforms). */
+const COMMAND_PREFIXES = ["!", "/"];
+const STOP_WORDS = /* @__PURE__ */ new Set(["stop", "cancel"]);
+const QUEUE_WORDS = /* @__PURE__ */ new Set(["queue"]);
+/**
+* Parse a leading control command from a message's text. Returns `null` when the
+* text is not a recognized command (so it flows to the agent unchanged). The
+* prefix must be the first non-whitespace character and be followed immediately by
+* a known command word, so ordinary text like `hello!` or `! note` is never a
+* command.
+*/
+function parseCommand(raw) {
+	const text = raw.trimStart();
+	const prefix = COMMAND_PREFIXES.find((p) => text.startsWith(p));
+	if (!prefix) return null;
+	const m = /^([a-zA-Z]+)([\s\S]*)$/.exec(text.slice(prefix.length));
+	if (!m) return null;
+	const word = m[1].toLowerCase();
+	const arg = (m[2] ?? "").trim();
+	if (STOP_WORDS.has(word)) return { kind: "stop" };
+	if (QUEUE_WORDS.has(word)) return {
+		kind: "queue",
+		text: arg
+	};
+	return null;
+}
+//#endregion
 //#region src/router/routing-rule.ts
 /**
 * Resolve an agent to its first Slack integration's `{ integrationId, botUserId }`.
@@ -80536,6 +80036,7 @@ const LOADING_MSGS = [
 	"Crunching through it…",
 	"Hang tight…"
 ];
+const MAX_QUEUED_PER_SESSION = 10;
 var Daemon = class {
 	opts;
 	store;
@@ -80697,6 +80198,11 @@ var Daemon = class {
 		}
 		this.seenMsgIds.add(msg.msgId);
 		if (this.seenMsgIds.size > 2e3) this.seenMsgIds.clear();
+		const command = parseCommand(msg.text);
+		if (command) {
+			this.handleCommand(command, msg);
+			return;
+		}
 		const result = routeRules(msg, this.mergedRules(), (c, t) => this.sessions.threadOwner(c, t));
 		if (!result) {
 			this.log.debug(`routing: dropped message in ch=${msg.channel} (no agent matched — not a mention of a known bot, not a subscribed 'all' channel, not a thread/DM hit)`);
@@ -80705,6 +80211,67 @@ var Daemon = class {
 		this.log.info(`routing: ch=${msg.channel} → agent "${result.agentId}" (integration ${result.integrationId})`);
 		this.dispatch(result.agentId, msg, result.integrationId).catch((err) => this.log.error(`dispatch failed for agent "${result.agentId}": ${err.stack ?? err}`));
 	}
+	queued = /* @__PURE__ */ new Map();
+	/**
+	* Handle an in-conversation control command. Resolves the target agent via the
+	* same routing ladder as a normal message (so thread-affinity + per-integration
+	* `allowedUserIds` authz apply), then acts on that agent's session in this
+	* (channel, thread).
+	*/
+	handleCommand(command, msg) {
+		const target = routeRules(msg, this.mergedRules(), (c, t) => this.sessions.threadOwner(c, t));
+		if (!target) {
+			this.log.debug(`command: '${command.kind}' in ch=${msg.channel} — no agent resolved, ignoring`);
+			return;
+		}
+		const conn = this.replyConnFor(target.agentId, target.integrationId);
+		const thread = msg.thread ?? msg.msgId;
+		const acpSessionId = this.store.getSession(sessionKey(msg.platform, msg.channel, thread, target.agentId))?.acpSessionId;
+		const inflight = !!(acpSessionId && this.pending.has(acpSessionId));
+		if (command.kind === "stop") {
+			if (!inflight) {
+				conn?.postMessage(msg.channel, "Nothing is running to stop.", thread);
+				return;
+			}
+			this.queued.delete(acpSessionId);
+			this.log.info(`command: stop → agent "${target.agentId}" session ${acpSessionId}`);
+			this.hosts.get(target.agentId)?.cancel(acpSessionId).catch((err) => this.log.error(`command stop: cancel failed: ${err.message}`));
+			conn?.postMessage(msg.channel, "🛑 Stopped.", thread);
+			return;
+		}
+		if (!command.text) {
+			conn?.postMessage(msg.channel, "Usage: `!queue <message>` — runs when the current turn finishes.", thread);
+			return;
+		}
+		const payload = {
+			...msg,
+			text: command.text
+		};
+		if (!inflight) {
+			this.log.info(`command: queue → agent "${target.agentId}" idle, dispatching now`);
+			this.dispatch(target.agentId, payload, target.integrationId).catch((err) => this.log.error(`queued dispatch failed for agent "${target.agentId}": ${err.stack ?? err}`));
+			return;
+		}
+		const q = this.queued.get(acpSessionId) ?? [];
+		if (q.length >= MAX_QUEUED_PER_SESSION) {
+			this.log.warn(`command: queue → agent "${target.agentId}" session ${acpSessionId} full (${q.length}), rejected`);
+			conn?.postMessage(msg.channel, `Queue is full (${MAX_QUEUED_PER_SESSION} pending) — wait for the current turn to finish.`, thread);
+			return;
+		}
+		q.push(payload);
+		this.queued.set(acpSessionId, q);
+		this.log.info(`command: queue → agent "${target.agentId}" session ${acpSessionId} (depth ${q.length})`);
+		conn?.postMessage(msg.channel, `📥 Queued (#${q.length}) — will run when the current turn finishes.`, thread);
+	}
+	/** Drain one buffered message for a session whose turn just finished (FIFO). */
+	flushQueued(agentId, sessionId, integrationId) {
+		const q = this.queued.get(sessionId);
+		if (!q || q.length === 0) return;
+		const next = q.shift();
+		if (q.length === 0) this.queued.delete(sessionId);
+		this.log.info(`queue: dispatching buffered message to agent "${agentId}" session ${sessionId} (${q.length} left)`);
+		this.dispatch(agentId, next, integrationId).catch((err) => this.log.error(`queued dispatch failed for agent "${agentId}": ${err.stack ?? err}`));
+	}
 	/** Local layer (agent.json) ∪ resolved CP layer; unservable CP rules are dropped + warn-logged. */
 	mergedRules() {
 		const local = [...this.agents.values()].flatMap((a) => rulesFromAgent(a, this.botUserIds));
@@ -80747,6 +80314,7 @@ var Daemon = class {
 		} finally {
 			this.pending.delete(sessionId);
 		}
+		this.flushQueued(agentId, sessionId, integrationId);
 	}
 	/** Route a converger action: set-status → setStatus (loading_messages only when not clearing); else postMessage. */
 	async applyAction(action, conn, channel, thread) {