@agentconnect.md/daemon 1.0.0-rc.220 → 1.0.0-rc.221

package/dist/{run-foreground-DLxz75b4.js → run-foreground-mvTzCScX.js}

@@ -1,16 +1,16 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CE-6LUnI.js";
 import { n as require_ms, t as require_src$2 } from "./src-DDtlVutj.js";
 import { t as DAEMON_VERSION } from "./version-DGaRXjBK.js";
-import { a as agentChildEnv, i as selectAgent, n as findAgentFiles, o as loadConfig, r as loadAgents, s as persistDaemonId } from "./load-agents-nWFFmN5-.js";
+import { a as agentChildEnv, i as selectAgent, n as findAgentFiles, o as loadConfig, r as loadAgents, s as persistDaemonId } from "./load-agents-C1m5Y9n_.js";
 import { l as resolveRoot, o as mcpSocketPath, u as statePath } from "./paths-DEcUO8lC.js";
-import { _ as resolveRuntimes, a as initGitInjection, c as simpleGit, d as MAX_FRAME_BYTES, f as buildEnvelope, g as cachedRuntimeVersions, h as cachedRuntimeNames, i as prepareWorkspace, m as encode, n as installedRuntimes, o as probeGitVersion, p as decodeEnvelope, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as normalizeGitUrl } from "./acp-host-CeJJZbtg.js";
+import { _ as cachedRuntimeVersions, a as initGitInjection, c as simpleGit, d as MAX_FRAME_BYTES, f as buildEnvelope, g as cachedRuntimeNames, h as MEMORY_INDEX, i as prepareWorkspace, m as encode, n as installedRuntimes, o as probeGitVersion, p as decodeEnvelope, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as normalizeGitUrl, v as resolveRuntimes } from "./acp-host-zyZ_j0yY.js";
 import { i as GitCredentialCache, n as gitcredSocketPath, r as writeGitcredShim, t as GitCredServer } from "./gitcred-server-Dcsq6QJe.js";
 import { n as encodeFrame, t as decodeFrames } from "./ipc-2Xbxe7uu.js";
 import { URL as URL$1 } from "url";
 import * as tls from "tls";
 import * as net$2 from "net";
 import * as sp from "node:path";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import * as http$6 from "http";
 import { Agent } from "https";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, promises, readFileSync, rmSync, stat, unwatchFile, watch, watchFile, writeFileSync } from "node:fs";
@@ -5333,6 +5333,7 @@ function hostSpawnSig(a) {
 		reasoningEffort: a.reasoningEffort,
 		executionMode: a.executionMode,
 		fastMode: a.fastMode,
+		permissionMode: a.permissionMode,
 		env: a.runtimeOverrides?.env
 	});
 }
@@ -5395,7 +5396,8 @@ var LocalStore = class {
         key TEXT PRIMARY KEY, agentId TEXT, platform TEXT, channel TEXT, thread TEXT,
         acpSessionId TEXT, state TEXT, lastDeliveredTs TEXT, updatedAt INTEGER,
         usage TEXT, muted INTEGER, triggeredBy TEXT, title TEXT, modelOverride TEXT,
-        effortOverride TEXT, fastModeOverride INTEGER, outputModeOverride TEXT
+        effortOverride TEXT, permissionModeOverride TEXT, fastModeOverride INTEGER,
+        outputModeOverride TEXT
       );
       -- Platform id → human display name (Slack channel/user names, daemon-resolved
       -- and cached here so session read-back can label ids without a Slack call).
@@ -5442,10 +5444,11 @@ var LocalStore = class {
 	}
 	/** Add the `sessions.usage` (JSON token accounting), `sessions.muted` (`!stop`
 	*  thread mute), `sessions.triggeredBy`, `sessions.title`, `sessions.modelOverride`,
-	*  `sessions.effortOverride` and `sessions.fastModeOverride` (the sticky per-session
-	*  model / reasoning-effort / fast-mode choices) columns to a pre-existing DB. CREATE
-	*  TABLE IF NOT EXISTS above adds them for fresh DBs but never alters an existing table,
-	*  so upgrade in place. No-op once the columns are present. */
+	*  `sessions.effortOverride`, `sessions.permissionModeOverride` and
+	*  `sessions.fastModeOverride` (the sticky per-session model / reasoning-effort /
+	*  permission-mode / fast-mode choices) columns to a pre-existing DB. CREATE TABLE IF
+	*  NOT EXISTS above adds them for fresh DBs but never alters an existing table, so
+	*  upgrade in place. No-op once the columns are present. */
 	migrateSessionUsage() {
 		const cols = this.db.prepare("PRAGMA table_info(sessions)").all();
 		if (!cols.some((c) => c.name === "usage")) this.db.exec("ALTER TABLE sessions ADD COLUMN usage TEXT");
@@ -5454,6 +5457,7 @@ var LocalStore = class {
 		if (!cols.some((c) => c.name === "title")) this.db.exec("ALTER TABLE sessions ADD COLUMN title TEXT");
 		if (!cols.some((c) => c.name === "modelOverride")) this.db.exec("ALTER TABLE sessions ADD COLUMN modelOverride TEXT");
 		if (!cols.some((c) => c.name === "effortOverride")) this.db.exec("ALTER TABLE sessions ADD COLUMN effortOverride TEXT");
+		if (!cols.some((c) => c.name === "permissionModeOverride")) this.db.exec("ALTER TABLE sessions ADD COLUMN permissionModeOverride TEXT");
 		if (!cols.some((c) => c.name === "fastModeOverride")) this.db.exec("ALTER TABLE sessions ADD COLUMN fastModeOverride INTEGER");
 		if (!cols.some((c) => c.name === "outputModeOverride")) this.db.exec("ALTER TABLE sessions ADD COLUMN outputModeOverride TEXT");
 	}
@@ -5563,6 +5567,15 @@ var LocalStore = class {
 	setEffortOverride(key, effort) {
 		this.db.prepare("UPDATE sessions SET effortOverride = ? WHERE key = ?").run(effort, key);
 	}
+	/** The session-scoped permission-mode override (set via status bars), or undefined if
+	*  the session runs on the agent's default. Sticky across turns and restarts. */
+	getPermissionModeOverride(key) {
+		return this.db.prepare("SELECT permissionModeOverride FROM sessions WHERE key = ?").get(key)?.permissionModeOverride ?? void 0;
+	}
+	/** Persist the session-scoped permission-mode override. No-op on an unknown key. */
+	setPermissionModeOverride(key, mode) {
+		this.db.prepare("UPDATE sessions SET permissionModeOverride = ? WHERE key = ?").run(mode, key);
+	}
 	/** The session-scoped fast-mode override (set via the status-bar fast toggle), or
 	*  undefined if the session runs on the agent's default. Stored as 0/1; sticky across
 	*  turns and restarts, re-applied to the ACP session on each dispatch. */
@@ -5757,6 +5770,150 @@ function monotonicTs() {
 	return String(last);
 }
 //#endregion
+//#region src/agents/memory.ts
+/**
+* Agent memory — a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE
+* the workspace so it survives a workspace reset / re-clone and is never committed
+* into a github-workspace repo.
+*
+* Index-plus-topics shape (the structure Claude Code's auto-memory uses): a lean
+* `MEMORY.md` index — injected into the prompt every session, so it must stay small
+* — plus any number of `<topic>.md` files the agent reads on demand. The agent
+* maintains it via the `readMemory` / `writeMemory` / `listMemory` MCP tools; the
+* daemon serves the same directory to the CP for the console.
+*
+* SECURITY: topic paths are agent/console-supplied, so every path is contained to
+* the memory dir — absolute paths and `..` escapes are rejected, and the resolved
+* path is re-checked so a symlink can't smuggle a target out. Flat by design (one
+* level): a topic is a file directly under `memory/`, no nested dirs.
+*/
+const MEMORY_DIRNAME = "memory";
+/** Max bytes of the index injected into the prompt each session — keeps a large
+*  memory from swelling the context (mirrors Claude Code's 25 KB entrypoint cap). */
+const MAX_INDEX_INJECT_BYTES = 25e3;
+/** Hard cap on a single memory file. Injected/read every session, so an unbounded
+*  file would swell the prompt and the wire; writes over this are rejected. */
+const MAX_MEMORY_FILE_BYTES = 256e3;
+/** Raised when a memory path escapes the memory dir. Surfaces as `BAD_PAYLOAD`. */
+var MemoryPathError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryPathError";
+	}
+};
+/** Raised when a write exceeds {@link MAX_MEMORY_FILE_BYTES}. `BAD_PAYLOAD`. */
+var MemoryTooLargeError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryTooLargeError";
+	}
+};
+/** Raised when an `ifMatchMtime` precondition fails (the file changed under the
+*  writer — e.g. a console edit racing a newer agent write). Surfaces as CONFLICT. */
+var MemoryConflictError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryConflictError";
+	}
+};
+/** The memory directory for an agent, given its root dir (where agent.json lives). */
+function memoryDir(agentDir) {
+	return join(agentDir, MEMORY_DIRNAME);
+}
+/** Resolve a memory-dir-relative path to an absolute one, contained to the dir.
+*  Rejects absolute paths, `..` escapes, and any nested directory (flat only). */
+function resolveInMemoryDir(agentDir, relPath) {
+	if (isAbsolute(relPath)) throw new MemoryPathError("absolute paths are not allowed");
+	const dir = memoryDir(agentDir);
+	const abs = resolve(dir, relPath);
+	if (abs !== dir && !abs.startsWith(dir + sep)) throw new MemoryPathError("path escapes the memory dir");
+	const rel = abs.slice(dir.length + 1);
+	if (rel.includes(sep)) throw new MemoryPathError("memory is a flat directory (no subdirectories)");
+	if (rel.length === 0) throw new MemoryPathError("a file name is required");
+	return abs;
+}
+/** Seed `<agent-root>/memory/MEMORY.md` with a header if the dir/index is absent
+*  (idempotent). Called at session start so a brand-new agent always has an index. */
+function ensureMemory(agentDir, agentName) {
+	const dir = memoryDir(agentDir);
+	mkdirSync(dir, { recursive: true });
+	const index = join(dir, MEMORY_INDEX);
+	if (!existsSync(index)) writeFileSync(index, `# ${agentName} memory\n\nYour long-term memory index. Keep it short — link out to topic files (e.g. \`[deploys](deploys.md)\`) for detail and read them on demand with the readMemory tool.\n`);
+}
+/** Read the memory index (`MEMORY.md`) for prompt injection, trimmed to the inject
+*  cap so a large index can't blow up the prompt; '' when absent. */
+async function readIndex(agentDir) {
+	const text = await readMemoryFile(agentDir, MEMORY_INDEX);
+	if (Buffer.byteLength(text) <= 25e3) return text;
+	return Buffer.from(text, "utf8").subarray(0, MAX_INDEX_INJECT_BYTES).toString("utf8") + "\n\n[…memory index truncated — trim MEMORY.md]";
+}
+/** Read a memory file's text; '' when it does not exist (never throws on ENOENT). */
+async function readMemoryFile(agentDir, relPath) {
+	const abs = resolveInMemoryDir(agentDir, relPath);
+	try {
+		return await promises.readFile(abs, "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return "";
+		throw err;
+	}
+}
+/** Overwrite a memory file with `content` (creating the dir if needed). Atomic
+*  (tmp + rename) so a concurrent read never sees a partial file.
+*
+*  - Rejects content over {@link MAX_MEMORY_FILE_BYTES} ({@link MemoryTooLargeError}).
+*  - `ifMatchMtime` (optimistic concurrency): when given, the current file's mtime
+*    must equal it, else {@link MemoryConflictError} — so a console edit can't
+*    clobber a newer write. A brand-new file (no mtime) matches `ifMatchMtime`
+*    only when the caller passes none (or the empty string). */
+async function writeMemoryFile(agentDir, relPath, content, ifMatchMtime) {
+	if (Buffer.byteLength(content) > 256e3) throw new MemoryTooLargeError(`memory file exceeds the ${MAX_MEMORY_FILE_BYTES}-byte limit`);
+	const abs = resolveInMemoryDir(agentDir, relPath);
+	if (ifMatchMtime) {
+		let current = null;
+		try {
+			current = (await promises.stat(abs)).mtime.toISOString();
+		} catch (err) {
+			if (err.code !== "ENOENT") throw err;
+		}
+		if (current !== ifMatchMtime) throw new MemoryConflictError("the memory file changed since it was read; reload and retry");
+	}
+	await promises.mkdir(memoryDir(agentDir), { recursive: true });
+	const tmp = `${abs}.tmp`;
+	await promises.writeFile(tmp, content, "utf8");
+	await promises.rename(tmp, abs);
+	const st = await promises.stat(abs);
+	return {
+		size: st.size,
+		mtime: st.mtime.toISOString()
+	};
+}
+/** List the files in the memory dir (flat; index + topics), sorted with the index
+*  first. Empty when the dir does not exist. `.tmp` write artifacts are skipped. */
+async function listMemory(agentDir) {
+	const dir = memoryDir(agentDir);
+	let dirents;
+	try {
+		dirents = await promises.readdir(dir, { withFileTypes: true });
+	} catch (err) {
+		if (err.code === "ENOENT") return [];
+		throw err;
+	}
+	const files = [];
+	for (const d of dirents) {
+		if (!d.isFile() || d.name.endsWith(".tmp")) continue;
+		try {
+			const st = await promises.stat(join(dir, d.name));
+			files.push({
+				name: d.name,
+				size: st.size,
+				mtime: st.mtime.toISOString()
+			});
+		} catch {}
+	}
+	files.sort((a, b) => a.name === "MEMORY.md" ? -1 : b.name === "MEMORY.md" ? 1 : a.name.localeCompare(b.name));
+	return files;
+}
+//#endregion
 //#region src/session/attachment-block.ts
 /**
 * Turn one Slack attachment into the richest ACP content block the agent can
@@ -5833,6 +5990,7 @@ var SessionManager = class {
 	async handle(agentId, msg) {
 		const agent = this.deps.agentById(agentId);
 		if (!agent) throw new Error(`unknown agent ${agentId}`);
+		ensureMemory(agent.dir, agent.name);
 		const { thread, ts: coordTs } = transcriptCoords(msg);
 		const ts = msg.platform === "webchat" ? monotonicTs() : coordTs;
 		const key = sessionKey(msg.platform, msg.channel, thread, agentId);
@@ -5925,6 +6083,13 @@ var SessionManager = class {
 				text: `${head}\n${ctxText}`
 			});
 		}
+		if (created) {
+			const index = (await readIndex(agent.dir)).trim();
+			if (index) blocks.push({
+				type: "text",
+				text: `# Your memory\nThis is your memory INDEX from earlier sessions. Read a linked topic file with the \`readMemory\` tool when relevant; revise memory with \`writeMemory\`.\n\n${index}`
+			});
+		}
 		blocks.push({
 			type: "text",
 			text: msg.text
@@ -6093,8 +6258,34 @@ function guessMimeFromUrl(url) {
 * missing connection — the caller turns that into an MCP `isError` result.
 */
 async function executeTool(ctx, name, args, deps) {
-	const gw = deps.gatewayFor(ctx.integrationId);
-	if (!gw) throw new Error(`no live Slack connection for integration ${ctx.integrationId}`);
+	if (name === "listMemory" || name === "readMemory" || name === "writeMemory") {
+		const dir = deps.memoryDirFor(ctx.agentId);
+		if (!dir) throw new Error(`unknown agent ${ctx.agentId}`);
+		try {
+			if (name === "listMemory") return { files: await listMemory(dir) };
+			if (name === "readMemory") {
+				const path = optionalString(args, "path") ?? "MEMORY.md";
+				return {
+					path,
+					content: await readMemoryFile(dir, path)
+				};
+			}
+			const path = optionalString(args, "path") ?? "MEMORY.md";
+			const { size, mtime } = await writeMemoryFile(dir, path, requireStringAllowEmpty(args, "content"));
+			return {
+				ok: true,
+				path,
+				size,
+				mtime
+			};
+		} catch (err) {
+			if (err instanceof MemoryPathError) throw new Error(`invalid memory path: ${err.message}`);
+			if (err instanceof MemoryTooLargeError) throw new Error(err.message);
+			throw err;
+		}
+	}
+	const gw = ctx.integrationId ? deps.gatewayFor(ctx.integrationId) : void 0;
+	if (!gw) throw new Error(`no live Slack connection for integration ${ctx.integrationId ?? "(none)"}`);
 	switch (name) {
 		case "sendSlackMessage": {
 			const text = requireString(args, "text");
@@ -6158,6 +6349,13 @@ function requireString(args, key) {
 	if (typeof v !== "string" || v.length === 0) throw new Error(`missing required string argument: ${key}`);
 	return v;
 }
+/** Like `requireString` but accepts '' — for `updateMemory`, where an empty string
+*  is a valid value (clear the memory). */
+function requireStringAllowEmpty(args, key) {
+	const v = args[key];
+	if (typeof v !== "string") throw new Error(`missing required string argument: ${key}`);
+	return v;
+}
 function optionalString(args, key) {
 	const v = args[key];
 	if (v === void 0 || v === null) return void 0;
@@ -6377,13 +6575,48 @@ const SLACK_TOOLS = [
 		}, ["url"])
 	}
 ];
-SLACK_TOOLS.map((t) => t.name);
 /**
-* The default MCP tool set for an agent, gated by its integrations. Today only
-* Slack is supported, so an agent with no Slack integration gets no tools.
+* The agent's long-term memory tools — available to EVERY agent regardless of
+* integrations. Memory is a directory (`<agent-root>/memory/`) with a `MEMORY.md`
+* index (injected into the prompt each session) plus `<topic>.md` files the agent
+* reads on demand. Keep the index short; move detail into topic files.
+*/
+const MEMORY_TOOLS = [
+	{
+		name: "listMemory",
+		description: "List your memory files — the MEMORY.md index plus any topic files you have written. Use this to discover what you have stored before reading or updating it.",
+		inputSchema: obj({})
+	},
+	{
+		name: "readMemory",
+		description: "Read one of your memory files. Omit `path` (or pass \"MEMORY.md\") to read the index; pass a topic file name (e.g. \"deploys.md\") to read that topic. The index is already shown to you at the start of each session — use this to pull the detail behind an index entry when it is relevant.",
+		inputSchema: obj({ path: {
+			type: "string",
+			description: "Memory file name (e.g. \"deploys.md\"). Defaults to the MEMORY.md index."
+		} })
+	},
+	{
+		name: "writeMemory",
+		description: "Save one of your memory files (whole-file overwrite). Omit `path` to write the MEMORY.md index; pass a topic file name (e.g. \"deploys.md\") for a topic. Keep the INDEX short — a scannable list that links to topic files (e.g. \"- [deploys](deploys.md) — how we ship\"); put the actual detail in the topic files. Use for durable facts across sessions: conventions, decisions, who to ask, things you had to re-learn. A flat directory — no subfolders in the path.",
+		inputSchema: obj({
+			path: {
+				type: "string",
+				description: "Memory file name (e.g. \"deploys.md\"). Defaults to the MEMORY.md index. No subdirectories."
+			},
+			content: {
+				type: "string",
+				description: "The full new file contents, in Markdown. Replaces the file."
+			}
+		}, ["content"])
+	}
+];
+[...SLACK_TOOLS, ...MEMORY_TOOLS].map((t) => t.name);
+/**
+* The default MCP tool set for an agent. The memory tools are always present
+* (every agent has memory); Slack tools are gated by a Slack integration.
 */
 function toolsForIntegrations(integrations) {
-	const tools = [];
+	const tools = [...MEMORY_TOOLS];
 	if (integrations.some((i) => i.platform === "slack")) tools.push(...SLACK_TOOLS);
 	return tools;
 }
@@ -63012,6 +63245,7 @@ const STATUS_ACTION = {
 	manage: "ac_manage",
 	setModel: "ac_set_model",
 	setEffort: "ac_set_effort",
+	setPermissionMode: "ac_set_permission_mode",
 	setFast: "ac_set_fast",
 	setOutput: "ac_set_output",
 	cancel: "ac_cancel",
@@ -63095,6 +63329,34 @@ function buildStatusModal(info, sessionKey, link) {
 			text: `*Model:* ${info.model}`
 		}
 	});
+	const permissionModes = info.permissionModes ?? [];
+	if (permissionModes.length > 0) {
+		const opts = info.permissionMode && !permissionModes.includes(info.permissionMode) ? [info.permissionMode, ...permissionModes] : permissionModes;
+		const option = (m) => ({
+			text: {
+				type: "plain_text",
+				text: clampTo(m, 75)
+			},
+			value: m
+		});
+		blocks.push({
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: "*Permission mode*"
+			},
+			accessory: {
+				type: "static_select",
+				action_id: STATUS_ACTION.setPermissionMode,
+				placeholder: {
+					type: "plain_text",
+					text: "Permission mode"
+				},
+				...info.permissionMode ? { initial_option: option(info.permissionMode) } : {},
+				options: opts.map(option)
+			}
+		});
+	}
 	const efforts = info.efforts ?? [];
 	if (efforts.length > 0) {
 		const opts = info.effort && !efforts.includes(info.effort) ? [info.effort, ...efforts] : efforts;
@@ -63459,6 +63721,7 @@ var SlackConnection = class {
 	deps;
 	app;
 	queue;
+	assistantDmThreads = /* @__PURE__ */ new Map();
 	botUserId = "";
 	/** The appToken this socket is keyed by (one socket per unique appToken). */
 	appToken;
@@ -63499,8 +63762,8 @@ var SlackConnection = class {
 		this.workspaceUrl = auth.url ?? "";
 		log?.debug(`slack: auth.test ok → bot user ${this.botUserId} (bot_id ${this.botId || "n/a"})`);
 		const deliver = (ev, kind) => {
-			const msg = normalizeSlackEvent(ev, { traceId: this.deps.newTraceId() });
-			log?.debug(`slack: inbound ${kind} ch=${msg.channel} user=${msg.sender.id} isBot=${msg.sender.isBot} isDm=${msg.isDm} mentions=[${msg.mentionedBots.join(",")}] text=${JSON.stringify(msg.text.slice(0, 80))}`);
+			const msg = normalizeSlackEvent(this.withAssistantThread(ev), { traceId: this.deps.newTraceId() });
+			log?.debug(`slack: inbound ${kind} ch=${msg.channel} thread=${msg.thread ?? "none"} user=${msg.sender.id} isBot=${msg.sender.isBot} isDm=${msg.isDm} mentions=[${msg.mentionedBots.join(",")}] text=${JSON.stringify(msg.text.slice(0, 80))}`);
 			this.deps.onMessage(msg);
 		};
 		this.app.message(async ({ message }) => {
@@ -63516,6 +63779,10 @@ var SlackConnection = class {
 			if (!ev.channel) return;
 			deliver(ev, "app_mention");
 		});
+		this.app.event("assistant_thread_started", async ({ event }) => {
+			const thread = this.rememberAssistantThread(event);
+			if (thread) log?.debug(`slack: assistant thread started ch=${thread.channel} thread=${thread.threadTs}`);
+		});
 		this.app.event("member_joined_channel", async ({ event }) => {
 			const ev = event;
 			if (ev.user !== this.botUserId) return;
@@ -63562,6 +63829,16 @@ var SlackConnection = class {
 				effort
 			});
 		});
+		this.app.action(STATUS_ACTION.setPermissionMode, async ({ ack, action, body }) => {
+			await ack();
+			const sessionKey = body?.view?.private_metadata ?? action.block_id;
+			const permissionMode = action.selected_option?.value;
+			if (sessionKey && permissionMode) this.deps.onStatusAction?.({
+				kind: "set-permission-mode",
+				sessionKey,
+				permissionMode
+			});
+		});
 		this.app.action(STATUS_ACTION.setFast, async ({ ack, action, body }) => {
 			await ack();
 			const sessionKey = body?.view?.private_metadata ?? action.block_id;
@@ -63597,6 +63874,25 @@ var SlackConnection = class {
 		await this.app.start();
 		log?.debug("slack: app.start resolved → socket established");
 	}
+	rememberAssistantThread(ev) {
+		const channel = ev.assistant_thread?.channel_id;
+		const threadTs = ev.assistant_thread?.thread_ts;
+		if (!channel || !threadTs) return null;
+		this.assistantDmThreads.set(channel, threadTs);
+		return {
+			channel,
+			threadTs
+		};
+	}
+	withAssistantThread(ev) {
+		if (ev.thread_ts || !ev.channel) return ev;
+		if (ev.channel_type !== "im" && !ev.channel.startsWith("D")) return ev;
+		const threadTs = this.assistantDmThreads.get(ev.channel);
+		return threadTs ? {
+			...ev,
+			thread_ts: threadTs
+		} : ev;
+	}
 	async postMessage(channel, text, threadTs) {
 		return this.queue.enqueue(async () => {
 			return (await this.app.client.chat.postMessage({
@@ -64852,6 +65148,50 @@ function makeLogger(level = "info") {
 	};
 }
 //#endregion
+//#region src/cp/wire-slice.ts
+/**
+* Pure helpers for slicing file bytes into a single WS frame — shared by the
+* workspace and memory readers so both honour the 256 KiB wire cap and never
+* split a UTF-8 character across slices.
+*/
+/** Encoded-payload ceiling, leaving headroom under MAX_FRAME_BYTES for the
+*  envelope (id/ts/type/corr + fencing ext, well under 4 KiB). */
+const REPLY_BUDGET$1 = MAX_FRAME_BYTES - 4096;
+/** The encoded size of the payload the wire will carry (JSON.stringify matches
+*  the codec's `encode`), measured in bytes. */
+function encodedBytes$1(payload) {
+	return Buffer.byteLength(JSON.stringify(payload));
+}
+/** Largest index ≤ `len` that lands on a UTF-8 character boundary — i.e. never
+*  cuts a multi-byte sequence. If the slice's trailing char is incomplete, the
+*  boundary is placed before that char (its bytes belong to the next slice). */
+function utf8Boundary$1(buf, len) {
+	if (len >= buf.length) len = buf.length;
+	if (len <= 0) return 0;
+	let start = len - 1;
+	while (start > 0 && ((buf[start] ?? 0) & 192) === 128) start--;
+	const lead = buf[start] ?? 0;
+	const seqLen = lead < 128 ? 1 : (lead & 224) === 192 ? 2 : (lead & 240) === 224 ? 3 : (lead & 248) === 240 ? 4 : 1;
+	return start + seqLen <= len ? len : start;
+}
+/** Shrink `content` (a utf8 view of `slice[0..end]`) until its JSON-escaped size
+*  fits `REPLY_BUDGET`, keeping the cut on a UTF-8 boundary. Returns the final
+*  `{ end, content }`. Control-byte-heavy text escapes ~6×, so the raw byte limit
+*  is not enough on its own. */
+function fitToBudget(slice, end) {
+	let content = slice.toString("utf8", 0, end);
+	while (end > 0 && encodedBytes$1(content) > REPLY_BUDGET$1) {
+		const factor = REPLY_BUDGET$1 / encodedBytes$1(content);
+		const shrunk = Math.max(1, Math.floor(end * factor * .9));
+		end = utf8Boundary$1(slice, Math.min(shrunk, end - 1));
+		content = slice.toString("utf8", 0, end);
+	}
+	return {
+		end,
+		content
+	};
+}
+//#endregion
 //#region src/cp/workspace-reader.ts
 /**
 * `WorkspaceReader` — the read-only seam answering the CP's `workspace/list` and
@@ -64876,9 +65216,6 @@ function makeLogger(level = "info") {
 */
 /** Bytes sniffed from the head of a file for binary (NUL byte) detection. */
 const SNIFF_BYTES = 8192;
-/** Encoded-payload ceiling, leaving headroom under MAX_FRAME_BYTES for the
-*  envelope (id/ts/type/corr + fencing ext, well under 4 KiB). */
-const REPLY_BUDGET$1 = MAX_FRAME_BYTES - 4096;
 /** Path-containment / bad-request violation → `BAD_PAYLOAD` on the wire. */
 var WorkspaceViolationError = class extends Error {
 	constructor(message) {
@@ -64886,29 +65223,12 @@ var WorkspaceViolationError = class extends Error {
 		this.name = "WorkspaceViolationError";
 	}
 };
-function isErrno(err, code) {
+function isErrno$1(err, code) {
 	return err?.code === code;
 }
 function under(root, p) {
 	return p === root || p.startsWith(root + sp.sep);
 }
-/** Largest index ≤ `len` that lands on a UTF-8 character boundary — i.e. never
-*  cuts a multi-byte sequence. If the slice's trailing char is incomplete, the
-*  boundary is placed before that char (its bytes belong to the next slice). */
-function utf8Boundary$1(buf, len) {
-	if (len >= buf.length) len = buf.length;
-	if (len <= 0) return 0;
-	let start = len - 1;
-	while (start > 0 && ((buf[start] ?? 0) & 192) === 128) start--;
-	const lead = buf[start] ?? 0;
-	const seqLen = lead < 128 ? 1 : (lead & 224) === 192 ? 2 : (lead & 240) === 224 ? 3 : (lead & 248) === 240 ? 4 : 1;
-	return start + seqLen <= len ? len : start;
-}
-/** The encoded size of the payload the wire will carry (JSON.stringify matches
-*  the codec's `encode`), measured in bytes. */
-function encodedBytes$1(payload) {
-	return Buffer.byteLength(JSON.stringify(payload));
-}
 function createWorkspaceReader(workspaceRootByAgent) {
 	function rootFor(agentId) {
 		const root = workspaceRootByAgent(agentId);
@@ -64930,7 +65250,7 @@ function createWorkspaceReader(workspaceRootByAgent) {
 				realRoot: await promises.realpath(root)
 			};
 		} catch (err) {
-			if (isErrno(err, "ENOENT")) return {
+			if (isErrno$1(err, "ENOENT")) return {
 				resolved,
 				realRoot: null
 			};
@@ -64959,14 +65279,14 @@ function createWorkspaceReader(workspaceRootByAgent) {
 			try {
 				target = await canonicalUnder(realRoot, resolved);
 			} catch (err) {
-				if (isErrno(err, "ENOENT")) return notFound;
+				if (isErrno$1(err, "ENOENT")) return notFound;
 				throw err;
 			}
 			let dirents;
 			try {
 				dirents = await promises.readdir(target, { withFileTypes: true });
 			} catch (err) {
-				if (isErrno(err, "ENOENT") || isErrno(err, "ENOTDIR")) return notFound;
+				if (isErrno$1(err, "ENOENT") || isErrno$1(err, "ENOTDIR")) return notFound;
 				throw err;
 			}
 			const entries = [];
@@ -65016,7 +65336,7 @@ function createWorkspaceReader(workspaceRootByAgent) {
 			try {
 				st = await promises.lstat(resolved);
 			} catch (err) {
-				if (isErrno(err, "ENOENT")) return notFound;
+				if (isErrno$1(err, "ENOENT")) return notFound;
 				throw err;
 			}
 			if (!st.isFile()) throw new WorkspaceViolationError("not a regular file");
@@ -65046,13 +65366,9 @@ function createWorkspaceReader(workspaceRootByAgent) {
 					slice = buf.subarray(0, bytesRead);
 				}
 				let end = utf8Boundary$1(slice, slice.length);
-				let content = slice.toString("utf8", 0, end);
-				while (end > 0 && encodedBytes$1(content) > REPLY_BUDGET$1) {
-					const factor = REPLY_BUDGET$1 / encodedBytes$1(content);
-					const shrunk = Math.max(1, Math.floor(end * factor * .9));
-					end = utf8Boundary$1(slice, Math.min(shrunk, end - 1));
-					content = slice.toString("utf8", 0, end);
-				}
+				const fitted = fitToBudget(slice, end);
+				end = fitted.end;
+				const content = fitted.content;
 				const nextOffset = req.offset + end;
 				return {
 					agentId: req.agentId,
@@ -65083,6 +65399,103 @@ function compareEntries(a, b) {
 	return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
 }
 //#endregion
+//#region src/cp/memory-reader.ts
+/**
+* `MemoryReader` — the seam answering the CP's `memory/list`, `memory/read` and
+* `memory/write` REQs for an agent's memory directory (`<agent-root>/memory/`).
+* The files live only on the daemon (§1/§12); reads stream single byte slices,
+* writes replace one whole file.
+*
+* Path containment lives in `agents/memory.ts` (`resolveInMemoryDir`): a topic
+* path that escapes the memory dir throws `MemoryPathError` → `BAD_PAYLOAD`. An
+* unknown agent is also `BAD_PAYLOAD`; a not-yet-created file/dir is data
+* (`exists:false`), not an error. Frame-size safety mirrors the workspace reader:
+* the read slice is bounded by the *encoded* reply size and ends on a UTF-8
+* boundary. Never log memory contents.
+*/
+/** Unknown-agent violation → `BAD_PAYLOAD` on the wire (path escapes surface as
+*  MemoryPathError from agents/memory.ts, mapped the same way by the dispatcher). */
+var MemoryViolationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryViolationError";
+	}
+};
+function isErrno(err, code) {
+	return err?.code === code;
+}
+/** `agentDirByAgent` resolves an agent id → its root dir (which holds `memory/`),
+*  or undefined for an unknown agent. */
+function createMemoryReader(agentDirByAgent) {
+	function dirFor(agentId) {
+		const dir = agentDirByAgent(agentId);
+		if (!dir) throw new MemoryViolationError(`unknown agent "${agentId}"`);
+		return dir;
+	}
+	return {
+		async list(req) {
+			const files = await listMemory(dirFor(req.agentId));
+			return {
+				agentId: req.agentId,
+				exists: files.length > 0,
+				entries: files
+			};
+		},
+		async read(req) {
+			const file = resolveInMemoryDir(dirFor(req.agentId), req.path);
+			const notFound = {
+				agentId: req.agentId,
+				path: req.path,
+				exists: false
+			};
+			let st;
+			try {
+				st = await promises.stat(file);
+			} catch (err) {
+				if (isErrno(err, "ENOENT")) return notFound;
+				throw err;
+			}
+			if (!st.isFile()) return notFound;
+			const size = st.size;
+			const mtime = st.mtime.toISOString();
+			const fh = await promises.open(file, "r");
+			try {
+				const want = Math.min(req.limit, Math.max(0, size - req.offset));
+				let slice = Buffer.alloc(0);
+				if (want > 0) {
+					const buf = Buffer.alloc(want);
+					const { bytesRead } = await fh.read(buf, 0, want, req.offset);
+					slice = buf.subarray(0, bytesRead);
+				}
+				const { end, content } = fitToBudget(slice, utf8Boundary$1(slice, slice.length));
+				const nextOffset = req.offset + end;
+				return {
+					agentId: req.agentId,
+					path: req.path,
+					exists: true,
+					size,
+					mtime,
+					content,
+					offset: req.offset,
+					nextOffset,
+					truncated: nextOffset < size
+				};
+			} finally {
+				await fh.close();
+			}
+		},
+		async write(req) {
+			const { size, mtime } = await writeMemoryFile(dirFor(req.agentId), req.path, req.content, req.ifMatchMtime);
+			return {
+				agentId: req.agentId,
+				path: req.path,
+				size,
+				mtime
+			};
+		}
+	};
+}
+//#endregion
 //#region src/cp/correlator.ts
 /** Transport-free representation of a typed wire `error` REP. */
 var WireError = class extends Error {
@@ -65547,6 +65960,15 @@ var CpClient = class {
 			case "workspace/gitpull":
 				this.deps.workspaceGit.pull(frame.payload.agentId).then((result) => this.reply(frame, "workspace/gitpull/result", result)).catch((err) => this.workspaceError(frame.id, "workspace/gitpull", err));
 				return;
+			case "memory/list":
+				this.deps.memoryReader.list(frame.payload).then((page) => this.reply(frame, "memory/list/page", page)).catch((err) => this.memoryError(frame.id, "memory/list", err));
+				return;
+			case "memory/read":
+				this.deps.memoryReader.read(frame.payload).then((content) => this.reply(frame, "memory/read/content", content)).catch((err) => this.memoryError(frame.id, "memory/read", err));
+				return;
+			case "memory/write":
+				this.deps.memoryReader.write(frame.payload).then((ok) => this.reply(frame, "memory/write/ok", ok)).catch((err) => this.memoryError(frame.id, "memory/write", err));
+				return;
 			case "webchat/message":
 				if (!this.deps.onWebchatMessage) {
 					this.sendError(frame.id, "INTERNAL", "webchat not supported", false);
@@ -65567,6 +65989,9 @@ var CpClient = class {
 			case "webchat/set-effort":
 				this.deps.onWebchatSetEffort?.(frame.payload);
 				return;
+			case "webchat/set-permission-mode":
+				this.deps.onWebchatSetPermissionMode?.(frame.payload);
+				return;
 			case "webchat/set-fast":
 				this.deps.onWebchatSetFast?.(frame.payload);
 				return;
@@ -65590,6 +66015,18 @@ var CpClient = class {
 		this.deps.log.warn(`cp: ${op} failed: ${err?.message}`);
 		this.sendError(corr, "INTERNAL", `${op} failed`, false);
 	}
+	memoryError(corr, op, err) {
+		if (err instanceof MemoryConflictError) {
+			this.sendError(corr, "CONFLICT", `${op} failed: ${err.message}`, false);
+			return;
+		}
+		if (err instanceof MemoryViolationError || err instanceof MemoryPathError || err instanceof MemoryTooLargeError) {
+			this.sendError(corr, "BAD_PAYLOAD", `${op} failed: ${err.message}`, false);
+			return;
+		}
+		this.deps.log.warn(`cp: ${op} failed: ${err?.message}`);
+		this.sendError(corr, "INTERNAL", `${op} failed`, false);
+	}
 	reply(req, type, payload) {
 		this.transport?.send(encode(buildEnvelope(type, payload, { corr: req.id })));
 	}
@@ -66040,6 +66477,7 @@ function applySpecFields(raw, spec, opts) {
 	if (spec.reasoningEffort !== void 0) raw.reasoningEffort = spec.reasoningEffort;
 	if (spec.executionMode !== void 0) raw.executionMode = spec.executionMode;
 	if (spec.fastMode !== void 0) raw.fastMode = spec.fastMode;
+	if (spec.permissionMode !== void 0) raw.permissionMode = spec.permissionMode;
 	if (spec.outputMode !== void 0) {
 		const out = typeof raw.output === "object" && raw.output !== null ? raw.output : {};
 		out.mode = spec.outputMode;
@@ -82267,6 +82705,7 @@ var Daemon = class Daemon {
 			log: this.log,
 			now: () => Date.now(),
 			gatewayFor: (integrationId) => this.connByIntegration.get(integrationId),
+			memoryDirFor: (agentId) => this.agents.get(agentId)?.dir,
 			recordOutbound: (ctx, channel, thread, text, ts) => this.store.appendTranscript({
 				channel,
 				thread: thread ?? ctx.thread,
@@ -82285,11 +82724,11 @@ var Daemon = class Daemon {
 			agentById: (id) => this.agents.get(id),
 			mcpServersFor: ({ agent, channel, thread }) => {
 				const tools = toolsForIntegrations(agent.integrations);
+				if (tools.length === 0) return [];
 				const integrationId = agent.integrations.find((i) => i.platform === "slack")?.id;
-				if (tools.length === 0 || !integrationId) return [];
 				const token = this.mcp.register({
 					agentId: agent.id,
-					integrationId,
+					...integrationId ? { integrationId } : {},
 					channel,
 					thread,
 					tools
@@ -82631,6 +83070,7 @@ var Daemon = class Daemon {
 				},
 				configPrefs: {
 					model: agent.runtimeOverrides?.model,
+					permissionMode: agent.permissionMode,
 					reasoningEffort: agent.reasoningEffort,
 					fastMode: agent.fastMode,
 					systemPrompt: agent.description
@@ -82653,6 +83093,10 @@ var Daemon = class Daemon {
 		}
 		this.seenMsgIds.add(msg.msgId);
 		if (this.seenMsgIds.size > 2e3) this.seenMsgIds.clear();
+		if (this.ownBotIdentities().has(msg.sender.id)) {
+			this.log.debug(`routing: dropping own bot echo ${msg.msgId}`);
+			return;
+		}
 		const command = parseCommand(msg.text);
 		if (command) {
 			this.handleCommand(command, msg);
@@ -82783,6 +83227,21 @@ var Daemon = class Daemon {
 		}
 		host.setSessionEffort(acpSessionId, effort).then(() => this.refreshStatusBarForKey(key)).catch((err) => this.log.warn(`set-effort failed: ${err.message}`));
 	}
+	/** Switch a session's permission/approval mode by its local key. Records the sticky
+	*  override and applies it live via ACP `mode` when the runtime advertises one. */
+	setPermissionModeByKey(key, permissionMode) {
+		const rec = this.store.getSession(key);
+		if (!rec) return;
+		this.store.setPermissionModeOverride(key, permissionMode);
+		this.log.info(`session ${key} permission-mode override → "${permissionMode}"`);
+		const acpSessionId = rec.acpSessionId;
+		const host = this.hosts.get(rec.agentId);
+		if (!acpSessionId || !host?.hasSession(acpSessionId)) {
+			this.refreshStatusBarForKey(key);
+			return;
+		}
+		host.setSessionPermissionMode(acpSessionId, permissionMode).then(() => this.refreshStatusBarForKey(key)).catch((err) => this.log.warn(`set-permission-mode failed: ${err.message}`));
+	}
 	/** Toggle a session's fast mode by its local key — the fast-mode counterpart of
 	*  {@link setModelByKey}. Records the sticky override and applies it live when the
 	*  current model offers a fast toggle. */
@@ -82823,6 +83282,10 @@ var Daemon = class Daemon {
 	handleWebchatSetEffort(m) {
 		this.setEffortByKey(this.webchatSessionKey(m.conversationId, m.agentId), m.effort);
 	}
+	/** Handle a webchat in-session permission-mode switch (C→D `webchat/set-permission-mode`). */
+	handleWebchatSetPermissionMode(m) {
+		this.setPermissionModeByKey(this.webchatSessionKey(m.conversationId, m.agentId), m.permissionMode);
+	}
 	/** Handle a webchat in-session fast-mode toggle (C→D `webchat/set-fast`). */
 	handleWebchatSetFast(m) {
 		this.setFastByKey(this.webchatSessionKey(m.conversationId, m.agentId), m.fastMode);
@@ -82846,6 +83309,8 @@ var Daemon = class Daemon {
 			if (a.model) this.setModelByKey(a.sessionKey, a.model);
 		} else if (a.kind === "set-effort") {
 			if (a.effort) this.setEffortByKey(a.sessionKey, a.effort);
+		} else if (a.kind === "set-permission-mode") {
+			if (a.permissionMode) this.setPermissionModeByKey(a.sessionKey, a.permissionMode);
 		} else if (a.kind === "set-fast") {
 			if (a.fastMode !== void 0) this.setFastByKey(a.sessionKey, a.fastMode);
 		} else if (a.kind === "set-output") {
@@ -83084,6 +83549,8 @@ var Daemon = class Daemon {
 			const host = await this.ensureHostAsync(agentId);
 			const override = this.store.getModelOverride(key);
 			if (override) await host.setSessionModel(sessionId, override).catch((err) => this.log.debug(`model override "${override}" not applied: ${err.message}`));
+			const permissionModeOverride = this.store.getPermissionModeOverride(key);
+			if (permissionModeOverride) await host.setSessionPermissionMode(sessionId, permissionModeOverride).catch((err) => this.log.debug(`permission-mode override "${permissionModeOverride}" not applied: ${err.message}`));
 			const effortOverride = this.store.getEffortOverride(key);
 			if (effortOverride) await host.setSessionEffort(sessionId, effortOverride).catch((err) => this.log.debug(`effort override "${effortOverride}" not applied: ${err.message}`));
 			const fastOverride = this.store.getFastModeOverride(key);
@@ -83347,12 +83814,15 @@ var Daemon = class Daemon {
 		const host = this.hosts.get(agentId);
 		const model = host?.modelOptions?.();
 		const effort = host?.effortOptions?.();
+		const permissionMode = host?.permissionModeOptions?.();
 		const fast = host?.fastModeOption?.();
 		const effortOverride = this.store.getEffortOverride(sessionKey);
+		const permissionModeOverride = this.store.getPermissionModeOverride(sessionKey);
 		const fastOverride = this.store.getFastModeOverride(sessionKey);
 		return {
 			model: model?.current ?? agent?.runtimeOverrides?.model,
 			effort: effortOverride ?? effort?.current ?? agent?.reasoningEffort,
+			permissionMode: permissionModeOverride ?? permissionMode?.current ?? agent?.permissionMode,
 			fastMode: fastOverride ?? fast?.current ?? agent?.fastMode,
 			contextUsed: usage.contextUsed,
 			contextSize: usage.contextSize,
@@ -83369,6 +83839,7 @@ var Daemon = class Daemon {
 			} : {},
 			...model?.models?.length ? { models: model.models } : {},
 			...effort?.efforts?.length ? { efforts: effort.efforts } : {},
+			...permissionMode?.modes?.length ? { permissionModes: permissionMode.modes } : {},
 			...fast ? { fastModeAvailable: true } : {},
 			...acpSessionId ? { sessionId: acpSessionId } : {}
 		};
@@ -83995,10 +84466,12 @@ var Daemon = class Daemon {
 			sessionRead: createSessionReader(this.store, (agentId) => this.replyConnFor(agentId)?.workspaceUrl),
 			workspaceRead: createWorkspaceReader((id) => this.agents.get(id)?.workspace.path),
 			workspaceGit: createWorkspaceGit((id) => this.agents.get(id)?.workspace.path),
+			memoryReader: createMemoryReader((id) => this.agents.get(id)?.dir),
 			onWebchatMessage: (m) => this.handleWebchatMessage(m),
 			onWebchatClose: (m) => this.handleWebchatClose(m),
 			onWebchatSetModel: (m) => this.handleWebchatSetModel(m),
 			onWebchatSetEffort: (m) => this.handleWebchatSetEffort(m),
+			onWebchatSetPermissionMode: (m) => this.handleWebchatSetPermissionMode(m),
 			onWebchatSetFast: (m) => this.handleWebchatSetFast(m),
 			onWebchatCancel: (m) => this.handleWebchatCancel(m),
 			clock: systemClock,
@@ -84115,4 +84588,4 @@ async function runForeground(opts, deps = {}) {
 //#endregion
 export { ClientTransport as n, runForeground as t };
 
-//# sourceMappingURL=run-foreground-DLxz75b4.js.map
+//# sourceMappingURL=run-foreground-mvTzCScX.js.map