@agentconnect.md/daemon 1.0.0-rc.233 → 1.0.0-rc.235

package/dist/{run-foreground-DrL_bDro.js → run-foreground-B5RyE_L1.js}

@@ -4,13 +4,13 @@ import { t as DAEMON_VERSION } from "./version-DGaRXjBK.js";
 import { C as _coercedNumber, T as NEVER, a as array, d as literal, f as looseObject, i as any, m as object, o as boolean, p as number$1, t as ZodNumber, v as string, x as url$4 } from "./schemas-CQkO9hC5.js";
 import { a as agentChildEnv, i as selectAgent, n as findAgentFiles, o as loadConfig, r as loadAgents, s as persistDaemonId } from "./load-agents-tb8Rcwan.js";
 import { l as resolveRoot, o as mcpSocketPath, u as statePath } from "./paths-DEcUO8lC.js";
-import { _ as cachedRuntimeNames, a as initGitInjection, c as simpleGit, d as buildEnvelope, f as decodeEnvelope, g as RESERVED_MCP_SERVER_NAME, h as MEMORY_INDEX, i as prepareWorkspace, m as MAX_FRAME_BYTES, n as installedRuntimes, o as probeGitVersion, p as encode, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as normalizeGitUrl, v as cachedRuntimeVersions, y as resolveRuntimes } from "./acp-host-CF3j4yST.js";
+import { C as resolveRuntimes, S as cachedRuntimeVersions, _ as encode, a as initGitInjection, b as RESERVED_MCP_SERVER_NAME, c as simpleGit, d as RELAY_DAEMON_SUBPROTOCOL, f as RELAY_DAEMON_WS_PATH, g as decodeEnvelope, h as buildEnvelope, i as prepareWorkspace, m as decodeRelayDaemonFrame, n as installedRuntimes, o as probeGitVersion, p as buildRelayDaemonFrame, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as normalizeGitUrl, v as MAX_FRAME_BYTES, x as cachedRuntimeNames, y as MEMORY_INDEX } from "./acp-host-D9z7hKHJ.js";
 import { i as GitCredentialCache, n as gitcredSocketPath, r as writeGitcredShim, t as GitCredServer } from "./gitcred-server-Dcsq6QJe.js";
 import { B as isInitializedNotification, C as JSONRPCMessageSchema, D as ListResourceTemplatesResultSchema, E as ListPromptsResultSchema, F as ReadResourceResultSchema, G as safeParse, H as isJSONRPCResultResponse, I as ResourceListChangedNotificationSchema, K as decodeFrames, L as SUPPORTED_PROTOCOL_VERSIONS, N as McpError, O as ListResourcesResultSchema, P as PromptListChangedNotificationSchema, T as ListChangedOptionsBaseSchema, U as getObjectShape, V as isJSONRPCRequest, W as isZ4Schema, _ as EmptyResultSchema, a as AjvJsonSchemaValidator, d as CreateMessageRequestSchema, f as CreateMessageResultSchema, g as ElicitResultSchema, h as ElicitRequestSchema, i as assertToolsCallTaskCapability, j as ListToolsResultSchema, l as CallToolResultSchema, m as CreateTaskResultSchema, n as serializeMessage, o as Protocol, p as CreateMessageResultWithToolsSchema, q as encodeFrame, r as assertClientRequestTaskCapability, s as mergeCapabilities, t as ReadBuffer, u as CompleteResultSchema, v as ErrorCode, w as LATEST_PROTOCOL_VERSION, x as InitializeResultSchema, y as GetPromptResultSchema, z as ToolListChangedNotificationSchema } from "./stdio-CwrB9yrX.js";
 import { URL as URL$1 } from "url";
 import * as tls from "tls";
 import * as net$2 from "net";
-import * as sp from "node:path";
+import * as path$13 from "node:path";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import * as http$7 from "http";
 import { Agent } from "https";
@@ -48,6 +48,145 @@ function number(params) {
 	return _coercedNumber(ZodNumber, params);
 }
 //#endregion
+//#region ../connection/dist/clock.js
+var SystemClock = class {
+	now() {
+		return Date.now();
+	}
+	setTimeout(fn, ms) {
+		return globalThis.setTimeout(fn, ms);
+	}
+	clearTimeout(h) {
+		globalThis.clearTimeout(h);
+	}
+};
+const systemClock = new SystemClock();
+/**
+* A small stateful backoff helper: `next()` yields the delay for the current
+* attempt and advances the counter; `reset()` returns to attempt 0 (call on a
+* successful connect). Keeps the exponent/jitter math in one place instead of
+* inline in each client FSM.
+*/
+var Backoff = class {
+	attempt = 0;
+	baseMs;
+	capMs;
+	jitter;
+	constructor(opts = {}) {
+		this.baseMs = opts.baseMs ?? 1e3;
+		this.capMs = opts.capMs ?? 3e4;
+		this.jitter = opts.jitter ?? Math.random;
+	}
+	/** The delay for the current attempt, then advance (so the next call grows). */
+	next() {
+		const base = Math.min(this.capMs, this.baseMs * 2 ** this.attempt);
+		const delay = Math.min(this.capMs, base + Math.floor(this.jitter() * base));
+		this.attempt += 1;
+		return delay;
+	}
+	/** Reset to attempt 0 — call once a connect succeeds. */
+	reset() {
+		this.attempt = 0;
+	}
+};
+//#endregion
+//#region ../connection/dist/correlator.js
+/** Transport-free representation of a typed wire `error` REP. */
+var WireError = class extends Error {
+	code;
+	retryable;
+	details;
+	constructor(code, message, retryable = false, details) {
+		super(message);
+		this.name = "WireError";
+		this.code = code;
+		this.retryable = retryable;
+		if (details) this.details = details;
+	}
+};
+var ReqRep = class {
+	clock;
+	ackTimeoutMs;
+	maxTries;
+	pending = /* @__PURE__ */ new Map();
+	constructor(clock, ackTimeoutMs, maxTries = 5) {
+		this.clock = clock;
+		this.ackTimeoutMs = ackTimeoutMs;
+		this.maxTries = maxTries;
+	}
+	request(frame, write, opts = {}) {
+		const encoded = JSON.stringify(frame);
+		return new Promise((resolve, reject) => {
+			const entry = {
+				id: frame.id,
+				encoded,
+				resolve,
+				reject,
+				tries: 1,
+				maxTries: opts.maxTries ?? this.maxTries
+			};
+			this.pending.set(frame.id, entry);
+			this.arm(entry, write, opts.ackTimeoutMs ?? this.ackTimeoutMs);
+			try {
+				write(encoded);
+			} catch (e) {
+				this.fail(entry, new WireError("INTERNAL", `send failed: ${e.message}`, true));
+			}
+		});
+	}
+	arm(entry, write, ackTimeoutMs) {
+		entry.timer = this.clock.setTimeout(() => {
+			if (!this.pending.has(entry.id)) return;
+			if (entry.tries >= entry.maxTries) {
+				this.pending.delete(entry.id);
+				entry.reject(new WireError("INTERNAL", `no ack after ${entry.maxTries} tries for ${entry.id}`, true));
+				return;
+			}
+			entry.tries += 1;
+			this.arm(entry, write, ackTimeoutMs);
+			try {
+				write(entry.encoded);
+			} catch (e) {
+				this.fail(entry, new WireError("INTERNAL", `send failed: ${e.message}`, true));
+			}
+		}, ackTimeoutMs);
+	}
+	fail(entry, err) {
+		if (!this.pending.has(entry.id)) return;
+		this.pending.delete(entry.id);
+		if (entry.timer !== void 0) this.clock.clearTimeout(entry.timer);
+		entry.reject(err);
+	}
+	/**
+	* Settle a pending REQ from an inbound correlated frame. Returns true when
+	* `frame.corr` matched a pending REQ (a REP resolves it; an `error` frame
+	* rejects with a {@link WireError}), false when it correlates nothing.
+	*/
+	settle(frame) {
+		const corr = frame.corr;
+		if (!corr) return false;
+		const entry = this.pending.get(corr);
+		if (!entry) return false;
+		this.pending.delete(corr);
+		if (entry.timer !== void 0) this.clock.clearTimeout(entry.timer);
+		if (frame.type === "error") {
+			const e = frame.payload;
+			entry.reject(new WireError(e.code, e.message, e.retryable, e.details));
+		} else entry.resolve(frame);
+		return true;
+	}
+	inflight() {
+		return this.pending.size;
+	}
+	rejectAll(err) {
+		for (const entry of this.pending.values()) {
+			if (entry.timer !== void 0) this.clock.clearTimeout(entry.timer);
+			entry.reject(err);
+		}
+		this.pending.clear();
+	}
+};
+//#endregion
 //#region ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js
 var require_constants$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const BINARY_TYPES = [
@@ -3616,9 +3755,6 @@ var require_websocket_server = /* @__PURE__ */ __commonJSMin(((exports, module)
 		} else abortHandshake(socket, code, message, headers);
 	}
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/wrapper.mjs
-var import_src = /* @__PURE__ */ __toESM(require_src$2(), 1);
 require_stream();
 require_extension();
 require_permessage_deflate();
@@ -3629,25 +3765,25 @@ var import_websocket = /* @__PURE__ */ __toESM(require_websocket(), 1);
 require_websocket_server();
 var wrapper_default = import_websocket.default;
 //#endregion
-//#region src/cp/transport.ts
+//#region ../connection/dist/ws-client-transport.js
 /**
-* Transport seam — the no-real-socket boundary for the daemon's CP client. The
-* FSM depends ONLY on this interface, so tests inject a `FakeTransport`.
-* `ClientTransport` is the production impl: it DIALS OUT (the daemon connects to
-* the CP, never the reverse) and resolves once the socket is open.
+* Dial-out WS transport seam — the no-real-socket boundary a client FSM depends
+* on, so tests inject a fake. {@link ClientTransport} is the production impl: it
+* DIALS OUT (the daemon/relay connects to its peer, never the reverse), resolves
+* once the socket is open, and arms a receive-idle watchdog to detect a half-open
+* peer. Wire-agnostic: the subprotocol and dial path are passed in, so the same
+* transport serves the daemon↔CP, relay↔CP, and relay↔daemon wires.
 */
-const SUBPROTOCOL = "agentconnect.v1";
-const DEFAULT_WS_PATH = "/daemon/ws";
-const HANDSHAKE_TIMEOUT_MS = 1e4;
-const SELF_PING_MS = 15e3;
-const RX_IDLE_MS = 45e3;
+const DEFAULT_HANDSHAKE_TIMEOUT_MS = 1e4;
+const DEFAULT_SELF_PING_MS = 15e3;
+const DEFAULT_RX_IDLE_MS = 45e3;
 /**
 * Arm a receive-idle watchdog on an open socket: every `selfPingMs` send a ping
 * (the peer auto-pongs, which counts as inbound), and if NOTHING has arrived for
 * `idleMs`, `terminate()` the socket — routing a dead half-open connection into
 * the normal `close` → reconnect path. Any inbound frame (message/ping/pong)
-* resets the idle clock. Cleared on `close`. Kept off the FSM's injected Clock
-* so it never perturbs the fake-clock CpClient tests.
+* resets the idle clock. Cleared on `close`. Kept off the FSM's injected Clock so
+* it never perturbs the fake-clock client tests.
 */
 function armRxWatchdog(ws, opts) {
 	const now = opts.now ?? (() => Date.now());
@@ -3675,24 +3811,26 @@ var ClientTransport = class ClientTransport {
 	get subprotocol() {
 		return this.ws.protocol;
 	}
-	constructor(ws) {
+	constructor(ws, selfPingMs, idleMs) {
 		this.ws = ws;
 		armRxWatchdog(ws, {
-			selfPingMs: SELF_PING_MS,
-			idleMs: RX_IDLE_MS
+			selfPingMs,
+			idleMs
 		});
 	}
 	/**
-	* Dial `wss://<host>/daemon/ws` with the `agentconnect.v1` subprotocol.
+	* Dial `<url normalized to end in opts.path>` with `opts.subprotocol`.
 	* Resolves once the socket is open; rejects on any error before open
 	* (refused, bad handshake/subprotocol → HTTP 400).
 	*/
-	static dial(url) {
-		const wsUrl = url.endsWith(DEFAULT_WS_PATH) ? url : url.replace(/\/+$/, "") + DEFAULT_WS_PATH;
+	static dial(url, opts) {
+		const wsUrl = url.endsWith(opts.path) ? url : url.replace(/\/+$/, "") + opts.path;
+		const selfPingMs = opts.selfPingMs ?? DEFAULT_SELF_PING_MS;
+		const idleMs = opts.idleMs ?? DEFAULT_RX_IDLE_MS;
 		return new Promise((resolve, reject) => {
-			const ws = new wrapper_default(wsUrl, [SUBPROTOCOL], {
+			const ws = new wrapper_default(wsUrl, [opts.subprotocol], {
 				maxPayload: MAX_FRAME_BYTES,
-				handshakeTimeout: HANDSHAKE_TIMEOUT_MS
+				handshakeTimeout: opts.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS
 			});
 			const onPreOpenError = (err) => {
 				ws.removeAllListeners();
@@ -3702,7 +3840,7 @@ var ClientTransport = class ClientTransport {
 			ws.once("open", () => {
 				ws.removeListener("error", onPreOpenError);
 				ws.on("error", () => ws.terminate());
-				resolve(new ClientTransport(ws));
+				resolve(new ClientTransport(ws, selfPingMs, idleMs));
 			});
 		});
 	}
@@ -3723,6 +3861,957 @@ var ClientTransport = class ClientTransport {
 	}
 };
 //#endregion
+//#region src/cp/wire-slice.ts
+var import_src = /* @__PURE__ */ __toESM(require_src$2(), 1);
+/**
+* Pure helpers for slicing file bytes into a single WS frame — shared by the
+* workspace and memory readers so both honour the 256 KiB wire cap and never
+* split a UTF-8 character across slices.
+*/
+/** Encoded-payload ceiling, leaving headroom under MAX_FRAME_BYTES for the
+*  envelope (id/ts/type/corr + fencing ext, well under 4 KiB). */
+const REPLY_BUDGET$1 = MAX_FRAME_BYTES - 4096;
+/** The encoded size of the payload the wire will carry (JSON.stringify matches
+*  the codec's `encode`), measured in bytes. */
+function encodedBytes$1(payload) {
+	return Buffer.byteLength(JSON.stringify(payload));
+}
+/** Largest index ≤ `len` that lands on a UTF-8 character boundary — i.e. never
+*  cuts a multi-byte sequence. If the slice's trailing char is incomplete, the
+*  boundary is placed before that char (its bytes belong to the next slice). */
+function utf8Boundary$1(buf, len) {
+	if (len >= buf.length) len = buf.length;
+	if (len <= 0) return 0;
+	let start = len - 1;
+	while (start > 0 && ((buf[start] ?? 0) & 192) === 128) start--;
+	const lead = buf[start] ?? 0;
+	const seqLen = lead < 128 ? 1 : (lead & 224) === 192 ? 2 : (lead & 240) === 224 ? 3 : (lead & 248) === 240 ? 4 : 1;
+	return start + seqLen <= len ? len : start;
+}
+/** Shrink `content` (a utf8 view of `slice[0..end]`) until its JSON-escaped size
+*  fits `REPLY_BUDGET`, keeping the cut on a UTF-8 boundary. Returns the final
+*  `{ end, content }`. Control-byte-heavy text escapes ~6×, so the raw byte limit
+*  is not enough on its own. */
+function fitToBudget(slice, end) {
+	let content = slice.toString("utf8", 0, end);
+	while (end > 0 && encodedBytes$1(content) > REPLY_BUDGET$1) {
+		const factor = REPLY_BUDGET$1 / encodedBytes$1(content);
+		const shrunk = Math.max(1, Math.floor(end * factor * .9));
+		end = utf8Boundary$1(slice, Math.min(shrunk, end - 1));
+		content = slice.toString("utf8", 0, end);
+	}
+	return {
+		end,
+		content
+	};
+}
+//#endregion
+//#region src/cp/workspace-reader.ts
+/**
+* `WorkspaceReader` — the read-only seam answering the CP's `workspace/list` and
+* `workspace/read` REQs from the agent's local workspace directory. File bytes
+* live only on the daemon (§1/§12); this streams single pages/slices to the CP,
+* never whole trees or files.
+*
+* Containment is to `workspace.path` EXACTLY — the parent directory holds
+* `agent.json` and `.env` secrets, so escaping even one level is a secret leak.
+* Every request path is (1) rejected if absolute, (2) lexically resolved against
+* the root and prefix-checked, then (3) canonicalised with `realpath` and
+* re-verified so symlinks (including an intermediate directory component swapped
+* to a symlink after the check) cannot smuggle a target outside the root; all
+* I/O runs on the canonical path. Violations throw `WorkspaceViolationError`,
+* which the dispatcher maps to a `BAD_PAYLOAD` error frame; missing paths are
+* data (`exists:false`), not errors. Never log file contents.
+*
+* Frame-size safety: every REP must serialise under the 256 KiB wire cap. JSON
+* escaping of control bytes is a 6× blowup, so `read` bounds the slice by the
+* *encoded* reply size (not the raw byte `limit`) and `list` stops a page early
+* when the encoded entries would overflow — both leave headroom for the envelope.
+*/
+/** Bytes sniffed from the head of a file for binary (NUL byte) detection. */
+const SNIFF_BYTES = 8192;
+/** Path-containment / bad-request violation → `BAD_PAYLOAD` on the wire. */
+var WorkspaceViolationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WorkspaceViolationError";
+	}
+};
+function isErrno$1(err, code) {
+	return err?.code === code;
+}
+function under(root, p) {
+	return p === root || p.startsWith(root + path$13.sep);
+}
+function createWorkspaceReader(workspaceRootByAgent) {
+	function rootFor(agentId) {
+		const root = workspaceRootByAgent(agentId);
+		if (!root) throw new WorkspaceViolationError(`unknown agent "${agentId}"`);
+		return root;
+	}
+	/**
+	* Lexical containment. Rejects absolute paths and `..` escapes; returns the
+	* lexically-resolved path plus the canonical (realpath'd) root, or `null` for
+	* `realRoot` when the root does not exist yet (callers report `exists:false`).
+	*/
+	async function resolveContained(root, relPath) {
+		if (path$13.isAbsolute(relPath)) throw new WorkspaceViolationError("absolute paths are not allowed");
+		const resolved = path$13.resolve(root, relPath);
+		if (!under(root, resolved)) throw new WorkspaceViolationError("path escapes the workspace root");
+		try {
+			return {
+				resolved,
+				realRoot: await promises.realpath(root)
+			};
+		} catch (err) {
+			if (isErrno$1(err, "ENOENT")) return {
+				resolved,
+				realRoot: null
+			};
+			throw err;
+		}
+	}
+	/** Canonicalise an existing target and re-verify containment on the REAL path,
+	*  closing the check-vs-use gap (a symlinked intermediate component resolves
+	*  out and is rejected here). Returns the canonical path used for I/O. */
+	async function canonicalUnder(realRoot, abs) {
+		const canon = await promises.realpath(abs);
+		if (!under(realRoot, canon)) throw new WorkspaceViolationError("path resolves outside the workspace root");
+		return canon;
+	}
+	return {
+		async list(req) {
+			const { resolved, realRoot } = await resolveContained(rootFor(req.agentId), req.path);
+			const notFound = {
+				agentId: req.agentId,
+				path: req.path,
+				exists: false,
+				entries: []
+			};
+			if (realRoot === null) return notFound;
+			let target;
+			try {
+				target = await canonicalUnder(realRoot, resolved);
+			} catch (err) {
+				if (isErrno$1(err, "ENOENT")) return notFound;
+				throw err;
+			}
+			let dirents;
+			try {
+				dirents = await promises.readdir(target, { withFileTypes: true });
+			} catch (err) {
+				if (isErrno$1(err, "ENOENT") || isErrno$1(err, "ENOTDIR")) return notFound;
+				throw err;
+			}
+			const entries = [];
+			for (const d of dirents) {
+				if (d.name === ".git") continue;
+				const type = d.isDirectory() ? "dir" : d.isFile() ? "file" : d.isSymbolicLink() ? "symlink" : "other";
+				const entry = {
+					name: d.name,
+					type
+				};
+				if (type === "file") try {
+					const st = await promises.lstat(path$13.join(target, d.name));
+					entry.size = st.size;
+					entry.mtime = st.mtime.toISOString();
+				} catch {}
+				entries.push(entry);
+			}
+			entries.sort(compareEntries);
+			const start = req.cursor !== void 0 && /^\d+$/.test(req.cursor) ? Number(req.cursor) : 0;
+			const page = [];
+			let acc = 0;
+			for (let i = start; i < entries.length && page.length < req.limit; i++) {
+				const e = entries[i];
+				const enc = encodedBytes$1(e) + 1;
+				if (page.length > 0 && acc + enc > REPLY_BUDGET$1) break;
+				page.push(e);
+				acc += enc;
+			}
+			const consumed = start + page.length;
+			return {
+				agentId: req.agentId,
+				path: req.path,
+				exists: true,
+				entries: page,
+				...consumed < entries.length ? { nextCursor: String(consumed) } : {}
+			};
+		},
+		async read(req) {
+			const { resolved, realRoot } = await resolveContained(rootFor(req.agentId), req.path);
+			const notFound = {
+				agentId: req.agentId,
+				path: req.path,
+				exists: false
+			};
+			if (realRoot === null) return notFound;
+			let st;
+			try {
+				st = await promises.lstat(resolved);
+			} catch (err) {
+				if (isErrno$1(err, "ENOENT")) return notFound;
+				throw err;
+			}
+			if (!st.isFile()) throw new WorkspaceViolationError("not a regular file");
+			const target = await canonicalUnder(realRoot, resolved);
+			const size = st.size;
+			const mtime = st.mtime.toISOString();
+			const fh = await promises.open(target, "r");
+			try {
+				const sniffLen = Math.min(SNIFF_BYTES, size);
+				if (sniffLen > 0) {
+					const sniff = Buffer.alloc(sniffLen);
+					const { bytesRead } = await fh.read(sniff, 0, sniffLen, 0);
+					if (sniff.subarray(0, bytesRead).includes(0)) return {
+						agentId: req.agentId,
+						path: req.path,
+						exists: true,
+						size,
+						mtime,
+						encoding: "none"
+					};
+				}
+				const want = Math.min(req.limit, Math.max(0, size - req.offset));
+				let slice = Buffer.alloc(0);
+				if (want > 0) {
+					const buf = Buffer.alloc(want);
+					const { bytesRead } = await fh.read(buf, 0, want, req.offset);
+					slice = buf.subarray(0, bytesRead);
+				}
+				let end = utf8Boundary$1(slice, slice.length);
+				const fitted = fitToBudget(slice, end);
+				end = fitted.end;
+				const content = fitted.content;
+				const nextOffset = req.offset + end;
+				return {
+					agentId: req.agentId,
+					path: req.path,
+					exists: true,
+					size,
+					mtime,
+					encoding: "utf8",
+					content,
+					offset: req.offset,
+					nextOffset,
+					truncated: nextOffset < size
+				};
+			} finally {
+				await fh.close();
+			}
+		}
+	};
+}
+/** dirs first, then case-insensitive alphabetical (stable within the page). */
+function compareEntries(a, b) {
+	const aDir = a.type === "dir" ? 0 : 1;
+	const bDir = b.type === "dir" ? 0 : 1;
+	if (aDir !== bDir) return aDir - bDir;
+	const al = a.name.toLowerCase();
+	const bl = b.name.toLowerCase();
+	if (al !== bl) return al < bl ? -1 : 1;
+	return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+}
+//#endregion
+//#region src/agents/memory.ts
+/**
+* Agent memory — a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE
+* the workspace so it survives a workspace reset / re-clone and is never committed
+* into a github-workspace repo.
+*
+* Index-plus-topics shape (the structure Claude Code's auto-memory uses): a lean
+* `MEMORY.md` index — injected into the prompt every session, so it must stay small
+* — plus any number of `<topic>.md` files the agent reads on demand. The agent
+* maintains it via the `readMemory` / `writeMemory` / `listMemory` MCP tools; the
+* daemon serves the same directory to the CP for the console.
+*
+* SECURITY: topic paths are agent/console-supplied, so every path is contained to
+* the memory dir — absolute paths and `..` escapes are rejected, and the resolved
+* path is re-checked so a symlink can't smuggle a target out. Flat by design (one
+* level): a topic is a file directly under `memory/`, no nested dirs.
+*/
+const MEMORY_DIRNAME = "memory";
+/** Max bytes of the index injected into the prompt each session — keeps a large
+*  memory from swelling the context (mirrors Claude Code's 25 KB entrypoint cap). */
+const MAX_INDEX_INJECT_BYTES = 25e3;
+/** Hard cap on a single memory file. Injected/read every session, so an unbounded
+*  file would swell the prompt and the wire; writes over this are rejected. */
+const MAX_MEMORY_FILE_BYTES = 256e3;
+/** Raised when a memory path escapes the memory dir. Surfaces as `BAD_PAYLOAD`. */
+var MemoryPathError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryPathError";
+	}
+};
+/** Raised when a write exceeds {@link MAX_MEMORY_FILE_BYTES}. `BAD_PAYLOAD`. */
+var MemoryTooLargeError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryTooLargeError";
+	}
+};
+/** Raised when an `ifMatchMtime` precondition fails (the file changed under the
+*  writer — e.g. a console edit racing a newer agent write). Surfaces as CONFLICT. */
+var MemoryConflictError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryConflictError";
+	}
+};
+/** The memory directory for an agent, given its root dir (where agent.json lives). */
+function memoryDir(agentDir) {
+	return join(agentDir, MEMORY_DIRNAME);
+}
+/** Resolve a memory-dir-relative path to an absolute one, contained to the dir.
+*  Rejects absolute paths, `..` escapes, and any nested directory (flat only). */
+function resolveInMemoryDir(agentDir, relPath) {
+	if (isAbsolute(relPath)) throw new MemoryPathError("absolute paths are not allowed");
+	const dir = memoryDir(agentDir);
+	const abs = resolve(dir, relPath);
+	if (abs !== dir && !abs.startsWith(dir + sep)) throw new MemoryPathError("path escapes the memory dir");
+	const rel = abs.slice(dir.length + 1);
+	if (rel.includes(sep)) throw new MemoryPathError("memory is a flat directory (no subdirectories)");
+	if (rel.length === 0) throw new MemoryPathError("a file name is required");
+	return abs;
+}
+/** Seed `<agent-root>/memory/MEMORY.md` with a header if the dir/index is absent
+*  (idempotent). Called at session start so a brand-new agent always has an index. */
+function ensureMemory(agentDir, agentName) {
+	const dir = memoryDir(agentDir);
+	mkdirSync(dir, { recursive: true });
+	const index = join(dir, MEMORY_INDEX);
+	if (!existsSync(index)) writeFileSync(index, `# ${agentName} memory\n\nYour long-term memory index. Keep it short — link out to topic files (e.g. \`[deploys](deploys.md)\`) for detail and read them on demand with the readMemory tool.\n`);
+}
+/** Read the memory index (`MEMORY.md`) for prompt injection, trimmed to the inject
+*  cap so a large index can't blow up the prompt; '' when absent. */
+async function readIndex(agentDir) {
+	const text = await readMemoryFile(agentDir, MEMORY_INDEX);
+	if (Buffer.byteLength(text) <= 25e3) return text;
+	return Buffer.from(text, "utf8").subarray(0, MAX_INDEX_INJECT_BYTES).toString("utf8") + "\n\n[…memory index truncated — trim MEMORY.md]";
+}
+/** Read a memory file's text; '' when it does not exist (never throws on ENOENT). */
+async function readMemoryFile(agentDir, relPath) {
+	const abs = resolveInMemoryDir(agentDir, relPath);
+	try {
+		return await promises.readFile(abs, "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return "";
+		throw err;
+	}
+}
+/** Overwrite a memory file with `content` (creating the dir if needed). Atomic
+*  (tmp + rename) so a concurrent read never sees a partial file.
+*
+*  - Rejects content over {@link MAX_MEMORY_FILE_BYTES} ({@link MemoryTooLargeError}).
+*  - `ifMatchMtime` (optimistic concurrency): when given, the current file's mtime
+*    must equal it, else {@link MemoryConflictError} — so a console edit can't
+*    clobber a newer write. A brand-new file (no mtime) matches `ifMatchMtime`
+*    only when the caller passes none (or the empty string). */
+async function writeMemoryFile(agentDir, relPath, content, ifMatchMtime) {
+	if (Buffer.byteLength(content) > 256e3) throw new MemoryTooLargeError(`memory file exceeds the ${MAX_MEMORY_FILE_BYTES}-byte limit`);
+	const abs = resolveInMemoryDir(agentDir, relPath);
+	if (ifMatchMtime) {
+		let current = null;
+		try {
+			current = (await promises.stat(abs)).mtime.toISOString();
+		} catch (err) {
+			if (err.code !== "ENOENT") throw err;
+		}
+		if (current !== ifMatchMtime) throw new MemoryConflictError("the memory file changed since it was read; reload and retry");
+	}
+	await promises.mkdir(memoryDir(agentDir), { recursive: true });
+	const tmp = `${abs}.tmp`;
+	await promises.writeFile(tmp, content, "utf8");
+	await promises.rename(tmp, abs);
+	const st = await promises.stat(abs);
+	return {
+		size: st.size,
+		mtime: st.mtime.toISOString()
+	};
+}
+/** List the files in the memory dir (flat; index + topics), sorted with the index
+*  first. Empty when the dir does not exist. `.tmp` write artifacts are skipped. */
+async function listMemory(agentDir) {
+	const dir = memoryDir(agentDir);
+	let dirents;
+	try {
+		dirents = await promises.readdir(dir, { withFileTypes: true });
+	} catch (err) {
+		if (err.code === "ENOENT") return [];
+		throw err;
+	}
+	const files = [];
+	for (const d of dirents) {
+		if (!d.isFile() || d.name.endsWith(".tmp")) continue;
+		try {
+			const st = await promises.stat(join(dir, d.name));
+			files.push({
+				name: d.name,
+				size: st.size,
+				mtime: st.mtime.toISOString()
+			});
+		} catch {}
+	}
+	files.sort((a, b) => a.name === "MEMORY.md" ? -1 : b.name === "MEMORY.md" ? 1 : a.name.localeCompare(b.name));
+	return files;
+}
+//#endregion
+//#region src/cp/memory-reader.ts
+/**
+* `MemoryReader` — the seam answering the CP's `memory/list`, `memory/read` and
+* `memory/write` REQs for an agent's memory directory (`<agent-root>/memory/`).
+* The files live only on the daemon (§1/§12); reads stream single byte slices,
+* writes replace one whole file.
+*
+* Path containment lives in `agents/memory.ts` (`resolveInMemoryDir`): a topic
+* path that escapes the memory dir throws `MemoryPathError` → `BAD_PAYLOAD`. An
+* unknown agent is also `BAD_PAYLOAD`; a not-yet-created file/dir is data
+* (`exists:false`), not an error. Frame-size safety mirrors the workspace reader:
+* the read slice is bounded by the *encoded* reply size and ends on a UTF-8
+* boundary. Never log memory contents.
+*/
+/** Unknown-agent violation → `BAD_PAYLOAD` on the wire (path escapes surface as
+*  MemoryPathError from agents/memory.ts, mapped the same way by the dispatcher). */
+var MemoryViolationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryViolationError";
+	}
+};
+function isErrno(err, code) {
+	return err?.code === code;
+}
+/** `agentDirByAgent` resolves an agent id → its root dir (which holds `memory/`),
+*  or undefined for an unknown agent. */
+function createMemoryReader(agentDirByAgent) {
+	function dirFor(agentId) {
+		const dir = agentDirByAgent(agentId);
+		if (!dir) throw new MemoryViolationError(`unknown agent "${agentId}"`);
+		return dir;
+	}
+	return {
+		async list(req) {
+			const files = await listMemory(dirFor(req.agentId));
+			return {
+				agentId: req.agentId,
+				exists: files.length > 0,
+				entries: files
+			};
+		},
+		async read(req) {
+			const file = resolveInMemoryDir(dirFor(req.agentId), req.path);
+			const notFound = {
+				agentId: req.agentId,
+				path: req.path,
+				exists: false
+			};
+			let st;
+			try {
+				st = await promises.stat(file);
+			} catch (err) {
+				if (isErrno(err, "ENOENT")) return notFound;
+				throw err;
+			}
+			if (!st.isFile()) return notFound;
+			const size = st.size;
+			const mtime = st.mtime.toISOString();
+			const fh = await promises.open(file, "r");
+			try {
+				const want = Math.min(req.limit, Math.max(0, size - req.offset));
+				let slice = Buffer.alloc(0);
+				if (want > 0) {
+					const buf = Buffer.alloc(want);
+					const { bytesRead } = await fh.read(buf, 0, want, req.offset);
+					slice = buf.subarray(0, bytesRead);
+				}
+				const { end, content } = fitToBudget(slice, utf8Boundary$1(slice, slice.length));
+				const nextOffset = req.offset + end;
+				return {
+					agentId: req.agentId,
+					path: req.path,
+					exists: true,
+					size,
+					mtime,
+					content,
+					offset: req.offset,
+					nextOffset,
+					truncated: nextOffset < size
+				};
+			} finally {
+				await fh.close();
+			}
+		},
+		async write(req) {
+			const { size, mtime } = await writeMemoryFile(dirFor(req.agentId), req.path, req.content, req.ifMatchMtime);
+			return {
+				agentId: req.agentId,
+				path: req.path,
+				size,
+				mtime
+			};
+		}
+	};
+}
+//#endregion
+//#region src/cp/client.ts
+/** The daemon↔CP wire's subprotocol + mount path — the two values the shared
+*  `ClientTransport.dial` needs (formerly hardcoded in the daemon-local transport). */
+const CP_SUBPROTOCOL = "agentconnect.v1";
+const CP_WS_PATH = "/daemon/ws";
+const ACK_TIMEOUT_MS$1 = 5e3;
+const BACKOFF_BASE_MS = 1e3;
+const BACKOFF_CAP_MS = 3e4;
+var CpClient = class {
+	deps;
+	state = "CLOSED";
+	sessionEpoch = 0;
+	routingEpoch = 0;
+	transport;
+	correlator;
+	stopped = false;
+	fatal = false;
+	attempt = 0;
+	reconnectTimer;
+	lastAuthedEpoch = 0;
+	heartbeatTimer;
+	heartbeatMs = 0;
+	constructor(deps) {
+		this.deps = deps;
+		this.correlator = new ReqRep(deps.clock, ACK_TIMEOUT_MS$1);
+	}
+	/** Non-blocking: kicks off the connect loop and returns. */
+	start() {
+		this.stopped = false;
+		this.fatal = false;
+		this.attemptConnect();
+	}
+	async stop() {
+		this.stopped = true;
+		if (this.reconnectTimer !== void 0) {
+			this.deps.clock.clearTimeout(this.reconnectTimer);
+			this.reconnectTimer = void 0;
+		}
+		this.stopHeartbeat();
+		this.correlator.rejectAll(/* @__PURE__ */ new Error("stopping"));
+		this.transport?.close(1e3, "shutdown");
+		this.state = "CLOSED";
+	}
+	async attemptConnect() {
+		if (this.stopped || this.fatal) return;
+		this.state = "CONNECTING";
+		try {
+			const t = await this.deps.connect();
+			if (this.stopped || this.fatal) {
+				t.close(1e3, "shutdown");
+				return;
+			}
+			this.transport = t;
+			t.onMessage((txt) => void this.onText(txt));
+			t.onClose((c, r) => this.onClose(c, r));
+			await this.handshake();
+			this.attempt = 0;
+		} catch (err) {
+			this.deps.log.warn(`cp: connect/handshake failed: ${err.message}`);
+			this.transport?.close(1011, "handshake failed");
+			this.transport = void 0;
+			this.scheduleReconnect();
+		}
+	}
+	scheduleReconnect() {
+		if (this.stopped || this.fatal) return;
+		if (this.reconnectTimer !== void 0) return;
+		const jitter = this.deps.jitter ?? Math.random;
+		const base = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** this.attempt);
+		const delay = Math.min(BACKOFF_CAP_MS, base + Math.floor(jitter() * base));
+		this.attempt += 1;
+		this.reconnectTimer = this.deps.clock.setTimeout(() => {
+			this.reconnectTimer = void 0;
+			this.attemptConnect();
+		}, delay);
+	}
+	async handshake() {
+		this.state = "AUTHENTICATING";
+		const authPayload = {
+			apiKey: this.deps.token,
+			agentVersion: this.deps.agentVersion
+		};
+		if (this.deps.daemonId) authPayload.daemonId = this.deps.daemonId;
+		if (this.lastAuthedEpoch > 0) authPayload.resume = { lastEpoch: this.lastAuthedEpoch };
+		const ok = (await this.request("auth", authPayload)).payload;
+		this.sessionEpoch = ok.sessionEpoch;
+		this.lastAuthedEpoch = ok.sessionEpoch;
+		if (ok.daemonId && ok.daemonId !== this.deps.daemonId) {
+			this.deps.daemonId = ok.daemonId;
+			this.deps.onDaemonId?.(ok.daemonId);
+		}
+		this.deps.onWebAppUrl?.(ok.webAppUrl);
+		this.deps.onOrgSlug?.(ok.orgSlug);
+		this.state = "REGISTERING";
+		const snap = (await this.request("register", {
+			host: this.deps.host,
+			capabilities: this.deps.capabilities(),
+			maxAgents: this.deps.maxAgents,
+			localState: this.deps.localState()
+		})).payload;
+		this.routingEpoch = snap.routingEpoch;
+		this.deps.configApply.applyReconcileSnapshot(snap);
+		this.state = "READY";
+		this.heartbeatMs = ok.heartbeatSec > 0 ? ok.heartbeatSec * 1e3 : this.deps.heartbeatDefaultMs;
+		this.armHeartbeat();
+		this.deps.log.info(`cp: READY (epoch=${this.sessionEpoch}, routingEpoch=${this.routingEpoch})`);
+		this.emitDaemonRuntimes(this.deps.runtimeProfiles(), this.deps.mcpServerFacts?.() ?? []);
+		this.deps.onReady?.();
+	}
+	/**
+	* Push the full runtime snapshot (D→C `facts/daemon-runtimes` EVT,
+	* fire-and-forget) — sent on each register and again when a probe sweep
+	* completes. REPLACE semantics on the CP: it reconciles the daemon's stored
+	* runtime list to exactly this snapshot, pruning runtimes that are no longer
+	* installed. No-op unless READY/DRAINING.
+	*/
+	emitDaemonRuntimes(runtimes, mcpServers = []) {
+		if (this.state !== "READY" && this.state !== "DRAINING") return;
+		this.transport?.send(encode(buildEnvelope("facts/daemon-runtimes", {
+			runtimes,
+			mcpServers
+		})));
+	}
+	/**
+	* Report a session's cumulative token usage (D→C `usage/report` EVT,
+	* fire-and-forget). No-op unless READY/DRAINING — usage is dashboard telemetry,
+	* so a dropped report just means that turn's delta is absent from the CP's
+	* historical aggregates until the next report (which re-sends the cumulative
+	* snapshot, latest-wins). Never blocks the turn.
+	*/
+	emitUsageReport(report) {
+		if (this.state !== "READY" && this.state !== "DRAINING") return;
+		this.transport?.send(encode(buildEnvelope("usage/report", report)));
+	}
+	/**
+	* Report a session's converged milestone + sessionKey echo (D→C `event/session`
+	* EVT, fire-and-forget, latest-wins per `sessionId`). This is what lets the CP
+	* store session metadata so a deep-link detail page (…/sessions/:id) resolves
+	* even when the daemon is offline. Metadata only — never the message stream
+	* (that stays daemon-local, §1/§12). No-op unless READY/DRAINING; a dropped
+	* `start` is re-covered by the next milestone (the CP upsert is latest-wins).
+	*/
+	emitEventSession(event) {
+		if (this.state !== "READY" && this.state !== "DRAINING") return;
+		this.transport?.send(encode(buildEnvelope("event/session", event)));
+	}
+	/**
+	* Report an integration's channel-membership snapshot (D→C `integration/channels`
+	* EVT, fire-and-forget, latest-wins). No-op unless READY/DRAINING — the daemon
+	* re-emits its cached snapshots on each (re)connect (see onReady in daemon.ts),
+	* so a dropped report only delays the console's channel list, never loses it.
+	*/
+	emitIntegrationChannels(snapshot) {
+		if (this.state !== "READY" && this.state !== "DRAINING") return;
+		this.transport?.send(encode(buildEnvelope("integration/channels", snapshot)));
+	}
+	/**
+	* Report a CP-owned cron fire (D→C `cron/report` EVT, fire-and-forget) so the
+	* console's `lastRunAt` converges. The local D11 stamp stays authoritative and
+	* the CP upsert is latest-wins, so re-asserting stored stamps on each
+	* (re)connect (see onReady in daemon.ts) makes a dropped report only a delay,
+	* never a loss. No-op unless READY/DRAINING.
+	*/
+	emitCronReport(report) {
+		if (this.state !== "READY" && this.state !== "DRAINING") return;
+		this.transport?.send(encode(buildEnvelope("cron/report", report)));
+	}
+	/**
+	* Emit one chunk of a webchat turn's reply stream (D→C `webchat/output` EVT).
+	* Ordered per-connection (TCP); `output.index` is the per-turn assembly counter.
+	* No-op unless READY/DRAINING — a dropped chunk is lost (unlike latest-wins
+	* telemetry), so the daemon only emits while connected. Content is inline, bounded
+	* by the 256 KiB frame cap; the caller chunks any oversize single event.
+	*/
+	emitWebchatOutput(output) {
+		if (this.state !== "READY" && this.state !== "DRAINING") return;
+		this.transport?.send(encode(buildEnvelope("webchat/output", output)));
+	}
+	/** Emit a webchat turn's completion (D→C `webchat/done` EVT). No-op unless READY/DRAINING. */
+	emitWebchatDone(done) {
+		if (this.state !== "READY" && this.state !== "DRAINING") return;
+		this.transport?.send(encode(buildEnvelope("webchat/done", done)));
+	}
+	request(type, payload) {
+		const frame = buildEnvelope(type, payload);
+		return this.correlator.request(frame, (e) => this.transport.send(e));
+	}
+	/**
+	* `gitcred/request` (D→C REQ) → grant payload. The FIRST post-handshake
+	* daemon-issued REQ, so unlike the handshake `request()` it is state-GATED:
+	* outside READY/DRAINING it fails immediately (the credential cache degrades
+	* to its unexpired copy or errors) — never queued, never a bare
+	* `transport!.send` on a dead socket. Single send + 10s budget: the default
+	* 5s×5 retransmit would blow every git-side timeout, and CP-side mint
+	* single-flight makes a later fresh request cheap anyway.
+	*/
+	async requestGitCred(payload) {
+		if (this.state !== "READY" && this.state !== "DRAINING" || !this.transport) throw new WireError("INTERNAL", `control plane unreachable (client ${this.state})`, true);
+		const frame = buildEnvelope("gitcred/request", payload);
+		const rep = await this.correlator.request(frame, (e) => this.transport.send(e), {
+			maxTries: 1,
+			ackTimeoutMs: 1e4
+		});
+		if (rep.type !== "gitcred/grant") throw new WireError("INTERNAL", `expected gitcred/grant, got ${rep.type}`, false);
+		return rep.payload;
+	}
+	async onText(text) {
+		const decoded = decodeEnvelope(text);
+		if (!decoded.ok) {
+			this.sendError(decoded.id, this.decodeErrorCode(decoded.msg), decoded.msg, false);
+			return;
+		}
+		const frame = decoded.frame;
+		if (frame.corr && this.correlator.settle(frame)) return;
+		if (this.state !== "READY" && this.state !== "DRAINING") {
+			this.sendError(frame.id, "PROTOCOL_STATE", `${frame.type} illegal in ${this.state}`, false);
+			return;
+		}
+		if (decoded.ext?.epoch !== void 0 && decoded.ext.epoch < this.sessionEpoch) {
+			this.sendError(frame.id, "STALE_EPOCH", "epoch < current", true);
+			return;
+		}
+		this.dispatchControl(frame);
+	}
+	decodeErrorCode(msg) {
+		if (msg === "FRAME_TOO_LARGE") return "FRAME_TOO_LARGE";
+		if (msg === "UNKNOWN_FRAME") return "UNKNOWN_FRAME";
+		return "BAD_PAYLOAD";
+	}
+	sendError(corr, code, message, retryable) {
+		if (!this.transport) return;
+		this.transport.send(encode(buildEnvelope("error", {
+			code,
+			message,
+			retryable
+		}, { corr })));
+	}
+	onClose(code, _reason) {
+		this.stopHeartbeat();
+		this.transport = void 0;
+		this.correlator.rejectAll(new WireError("INTERNAL", "connection closed", true));
+		if (code === 4401) {
+			this.fatal = true;
+			this.state = "CLOSED";
+			this.deps.log.error("cp: AUTH_FAILED (4401) — not reconnecting; re-mint the daemon token");
+			return;
+		}
+		if (this.stopped) {
+			this.state = "CLOSED";
+			return;
+		}
+		this.state = "DEGRADED";
+		this.scheduleReconnect();
+	}
+	armHeartbeat() {
+		this.heartbeatTimer = this.deps.clock.setTimeout(() => {
+			if (this.state === "READY") this.transport?.send(encode(buildEnvelope("heartbeat", {
+				load: this.deps.loadSnapshot(),
+				health: "ok",
+				activeSessions: this.deps.activeSessions(),
+				degradedScopes: this.deps.degradedScopes?.() ?? []
+			})));
+			if (this.state === "READY" || this.state === "DRAINING") this.armHeartbeat();
+		}, this.heartbeatMs);
+	}
+	stopHeartbeat() {
+		if (this.heartbeatTimer !== void 0) {
+			this.deps.clock.clearTimeout(this.heartbeatTimer);
+			this.heartbeatTimer = void 0;
+		}
+	}
+	/** C→D control dispatch. The CP changes config, never live routing. */
+	dispatchControl(frame) {
+		switch (frame.type) {
+			case "config/push":
+				this.deps.configApply.applyConfigPush(frame.payload.keys);
+				return;
+			case "cron/upsert":
+				try {
+					this.deps.configApply.upsertCron(frame.payload);
+					this.reply(frame, "ack", { ok: true });
+				} catch (err) {
+					this.sendError(frame.id, "BAD_PAYLOAD", `cron upsert failed: ${err.message}`, false);
+				}
+				return;
+			case "cron/remove":
+				this.deps.configApply.removeCron(frame.payload.cronId);
+				this.reply(frame, "ack", { ok: true });
+				return;
+			case "cron/run":
+				this.reply(frame, "ack", this.deps.configApply.runCron(frame.payload.cronId));
+				return;
+			case "route/assign": {
+				const a = frame.payload;
+				this.deps.configApply.applyRouteAssign(a);
+				this.reply(frame, "route/assign/ack", {
+					ok: true,
+					sessionKey: a.sessionKey
+				});
+				return;
+			}
+			case "route/update":
+				this.deps.configApply.applyRouteUpdate(frame.payload);
+				return;
+			case "relay/roster":
+				this.deps.configApply.applyRelayRoster(frame.payload.relays);
+				return;
+			case "agent/upsert": {
+				const u = frame.payload;
+				this.deps.configApply.applyAgentUpsert(u.agentId, u.spec);
+				return;
+			}
+			case "agent/remove":
+				this.deps.configApply.applyAgentRemove(frame.payload.agentId);
+				return;
+			case "integration/upsert":
+				this.deps.configApply.applyIntegrationUpsert(frame.payload);
+				return;
+			case "integration/remove":
+				this.deps.configApply.applyIntegrationRemove(frame.payload.integrationId);
+				return;
+			case "agent/launch": {
+				const launch = frame.payload;
+				this.deps.configApply.applyAgentLaunch(launch).then((launched) => this.reply(frame, "agent/launched", launched)).catch((err) => this.sendError(frame.id, "INTERNAL", `agent/launch failed: ${err.message}`, false));
+				return;
+			}
+			case "agent/stop": {
+				const stop = frame.payload;
+				this.deps.configApply.applyAgentStop(stop).then((ack) => this.reply(frame, "ack", ack)).catch((err) => this.sendError(frame.id, "INTERNAL", `agent/stop failed: ${err.message}`, false));
+				return;
+			}
+			case "daemon/drain": {
+				const drain = frame.payload;
+				this.state = "DRAINING";
+				this.deps.configApply.applyDaemonDrain(drain, (p) => this.emit("drain/progress", p)).then((done) => {
+					this.reply(frame, "drain/done", done);
+					if (this.state === "DRAINING") this.state = "READY";
+				}).catch((err) => {
+					this.sendError(frame.id, "INTERNAL", `drain failed: ${err.message}`, false);
+					if (this.state === "DRAINING") this.state = "READY";
+				});
+				return;
+			}
+			case "daemon/restart":
+				this.reply(frame, "daemon/control/ack", this.deps.configApply.applyDaemonRestart(frame.payload));
+				return;
+			case "daemon/upgrade":
+				this.reply(frame, "daemon/control/ack", this.deps.configApply.applyDaemonUpgrade(frame.payload));
+				return;
+			case "session/list":
+				try {
+					this.reply(frame, "session/list/page", this.deps.sessionRead.list(frame.payload));
+				} catch (err) {
+					this.sendError(frame.id, "INTERNAL", `session/list failed: ${err.message}`, false);
+				}
+				return;
+			case "session/history":
+				try {
+					this.reply(frame, "session/history/page", this.deps.sessionRead.history(frame.payload));
+				} catch (err) {
+					this.sendError(frame.id, "INTERNAL", `session/history failed: ${err.message}`, false);
+				}
+				return;
+			case "session/tool-body":
+				try {
+					this.reply(frame, "session/tool-body/chunk", this.deps.sessionRead.toolBody(frame.payload));
+				} catch (err) {
+					this.sendError(frame.id, "INTERNAL", `session/tool-body failed: ${err.message}`, false);
+				}
+				return;
+			case "workspace/list":
+				this.deps.workspaceRead.list(frame.payload).then((page) => this.reply(frame, "workspace/list/page", page)).catch((err) => this.workspaceError(frame.id, "workspace/list", err));
+				return;
+			case "workspace/read":
+				this.deps.workspaceRead.read(frame.payload).then((content) => this.reply(frame, "workspace/read/content", content)).catch((err) => this.workspaceError(frame.id, "workspace/read", err));
+				return;
+			case "workspace/gitstatus":
+				this.deps.workspaceGit.status(frame.payload.agentId).then((status) => this.reply(frame, "workspace/gitstatus/result", status)).catch((err) => this.workspaceError(frame.id, "workspace/gitstatus", err));
+				return;
+			case "workspace/gitpull":
+				this.deps.workspaceGit.pull(frame.payload.agentId).then((result) => this.reply(frame, "workspace/gitpull/result", result)).catch((err) => this.workspaceError(frame.id, "workspace/gitpull", err));
+				return;
+			case "memory/list":
+				this.deps.memoryReader.list(frame.payload).then((page) => this.reply(frame, "memory/list/page", page)).catch((err) => this.memoryError(frame.id, "memory/list", err));
+				return;
+			case "memory/read":
+				this.deps.memoryReader.read(frame.payload).then((content) => this.reply(frame, "memory/read/content", content)).catch((err) => this.memoryError(frame.id, "memory/read", err));
+				return;
+			case "memory/write":
+				this.deps.memoryReader.write(frame.payload).then((ok) => this.reply(frame, "memory/write/ok", ok)).catch((err) => this.memoryError(frame.id, "memory/write", err));
+				return;
+			case "webchat/message":
+				if (!this.deps.onWebchatMessage) {
+					this.sendError(frame.id, "INTERNAL", "webchat not supported", false);
+					return;
+				}
+				try {
+					this.reply(frame, "webchat/ack", this.deps.onWebchatMessage(frame.payload));
+				} catch (err) {
+					this.sendError(frame.id, "INTERNAL", `webchat/message failed: ${err.message}`, false);
+				}
+				return;
+			case "webchat/close":
+				this.deps.onWebchatClose?.(frame.payload);
+				return;
+			case "webchat/set-model":
+				this.deps.onWebchatSetModel?.(frame.payload);
+				return;
+			case "webchat/set-effort":
+				this.deps.onWebchatSetEffort?.(frame.payload);
+				return;
+			case "webchat/set-permission-mode":
+				this.deps.onWebchatSetPermissionMode?.(frame.payload);
+				return;
+			case "webchat/set-fast":
+				this.deps.onWebchatSetFast?.(frame.payload);
+				return;
+			case "webchat/cancel":
+				this.deps.onWebchatCancel?.(frame.payload);
+				return;
+			default:
+				this.deps.log.debug(`cp: ignoring ${frame.type}`);
+				return;
+		}
+	}
+	/** Map a workspace read failure onto the wire: containment/bad-request
+	*  violations → BAD_PAYLOAD (their messages are hand-written and path-free);
+	*  anything else → INTERNAL with a GENERIC message — raw fs errors (ELOOP,
+	*  EACCES, …) embed absolute host paths that must not leak to the CP/UI. */
+	workspaceError(corr, op, err) {
+		if (err instanceof WorkspaceViolationError) {
+			this.sendError(corr, "BAD_PAYLOAD", `${op} failed: ${err.message}`, false);
+			return;
+		}
+		this.deps.log.warn(`cp: ${op} failed: ${err?.message}`);
+		this.sendError(corr, "INTERNAL", `${op} failed`, false);
+	}
+	memoryError(corr, op, err) {
+		if (err instanceof MemoryConflictError) {
+			this.sendError(corr, "CONFLICT", `${op} failed: ${err.message}`, false);
+			return;
+		}
+		if (err instanceof MemoryViolationError || err instanceof MemoryPathError || err instanceof MemoryTooLargeError) {
+			this.sendError(corr, "BAD_PAYLOAD", `${op} failed: ${err.message}`, false);
+			return;
+		}
+		this.deps.log.warn(`cp: ${op} failed: ${err?.message}`);
+		this.sendError(corr, "INTERNAL", `${op} failed`, false);
+	}
+	reply(req, type, payload) {
+		this.transport?.send(encode(buildEnvelope(type, payload, { corr: req.id })));
+	}
+	/** Emit an uncorrelated EVT (e.g. `drain/progress`). */
+	emit(type, payload) {
+		this.transport?.send(encode(buildEnvelope(type, payload)));
+	}
+};
+//#endregion
 //#region ../../node_modules/.pnpm/readdirp@5.0.0/node_modules/readdirp/index.js
 const EntryTypes = {
 	FILE_TYPE: "files",
@@ -4252,7 +5341,7 @@ const binaryExtensions = /* @__PURE__ */ new Set([
 	"zip",
 	"zipx"
 ]);
-const isBinaryPath = (filePath) => binaryExtensions.has(sp.extname(filePath).slice(1).toLowerCase());
+const isBinaryPath = (filePath) => binaryExtensions.has(path$13.extname(filePath).slice(1).toLowerCase());
 const foreach = (val, fn) => {
 	if (val instanceof Set) val.forEach(fn);
 	else fn(val);
@@ -4287,7 +5376,7 @@ function createFsWatchInstance(path, options, listener, errHandler, emitRaw) {
 	const handleEvent = (rawEvent, evPath) => {
 		listener(path);
 		emitRaw(rawEvent, evPath, { watchedPath: path });
-		if (evPath && path !== evPath) fsWatchBroadcast(sp.resolve(path, evPath), KEY_LISTENERS, sp.join(path, evPath));
+		if (evPath && path !== evPath) fsWatchBroadcast(path$13.resolve(path, evPath), KEY_LISTENERS, path$13.join(path, evPath));
 	};
 	try {
 		return watch(path, { persistent: options.persistent }, handleEvent);
@@ -4429,10 +5518,10 @@ var NodeFsHandler = class {
 	*/
 	_watchWithNodeFs(path, listener) {
 		const opts = this.fsw.options;
-		const directory = sp.dirname(path);
-		const basename = sp.basename(path);
+		const directory = path$13.dirname(path);
+		const basename = path$13.basename(path);
 		this.fsw._getWatchedDir(directory).add(basename);
-		const absolutePath = sp.resolve(path);
+		const absolutePath = path$13.resolve(path);
 		const options = { persistent: opts.persistent };
 		if (!listener) listener = EMPTY_FN;
 		let closer;
@@ -4455,8 +5544,8 @@ var NodeFsHandler = class {
 	*/
 	_handleFile(file, stats, initialAdd) {
 		if (this.fsw.closed) return;
-		const dirname = sp.dirname(file);
-		const basename = sp.basename(file);
+		const dirname = path$13.dirname(file);
+		const basename = path$13.basename(file);
 		const parent = this.fsw._getWatchedDir(dirname);
 		let prevStats = stats;
 		if (parent.has(basename)) return;
@@ -4530,7 +5619,7 @@ var NodeFsHandler = class {
 		this.fsw._symlinkPaths.set(full, true);
 	}
 	_handleRead(directory, initialAdd, wh, target, dir, depth, throttler) {
-		directory = sp.join(directory, "");
+		directory = path$13.join(directory, "");
 		const throttleKey = target ? `${directory}:${target}` : directory;
 		throttler = this.fsw._throttle("readdir", throttleKey, 1e3);
 		if (!throttler) return;
@@ -4547,7 +5636,7 @@ var NodeFsHandler = class {
 				return;
 			}
 			const item = entry.path;
-			let path = sp.join(directory, item);
+			let path = path$13.join(directory, item);
 			current.add(item);
 			if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path, item)) return;
 			if (this.fsw.closed) {
@@ -4556,7 +5645,7 @@ var NodeFsHandler = class {
 			}
 			if (item === target || !target && !previous.has(item)) {
 				this.fsw._incrReadyCount();
-				path = sp.join(dir, sp.relative(dir, path));
+				path = path$13.join(dir, path$13.relative(dir, path));
 				this._addToNodeFs(path, initialAdd, wh, depth + 1);
 			}
 		}).on(EV.ERROR, this._boundHandleError);
@@ -4591,10 +5680,10 @@ var NodeFsHandler = class {
 	* @returns closer for the watcher instance.
 	*/
 	async _handleDir(dir, stats, initialAdd, depth, target, wh, realpath) {
-		const parentDir = this.fsw._getWatchedDir(sp.dirname(dir));
-		const tracked = parentDir.has(sp.basename(dir));
+		const parentDir = this.fsw._getWatchedDir(path$13.dirname(dir));
+		const tracked = parentDir.has(path$13.basename(dir));
 		if (!(initialAdd && this.fsw.options.ignoreInitial) && !target && !tracked) this.fsw._emit(EV.ADD_DIR, dir, stats);
-		parentDir.add(sp.basename(dir));
+		parentDir.add(path$13.basename(dir));
 		this.fsw._getWatchedDir(dir);
 		let throttler;
 		let closer;
@@ -4641,7 +5730,7 @@ var NodeFsHandler = class {
 			const follow = this.fsw.options.followSymlinks;
 			let closer;
 			if (stats.isDirectory()) {
-				const absPath = sp.resolve(path);
+				const absPath = path$13.resolve(path);
 				const targetPath = follow ? await realpath(path) : path;
 				if (this.fsw.closed) return;
 				closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
@@ -4650,12 +5739,12 @@ var NodeFsHandler = class {
 			} else if (stats.isSymbolicLink()) {
 				const targetPath = follow ? await realpath(path) : path;
 				if (this.fsw.closed) return;
-				const parent = sp.dirname(wh.watchPath);
+				const parent = path$13.dirname(wh.watchPath);
 				this.fsw._getWatchedDir(parent).add(wh.watchPath);
 				this.fsw._emit(EV.ADD, wh.watchPath, stats);
 				closer = await this._handleDir(parent, stats, initialAdd, depth, path, wh, targetPath);
 				if (this.fsw.closed) return;
-				if (targetPath !== void 0) this.fsw._symlinkPaths.set(sp.resolve(path), targetPath);
+				if (targetPath !== void 0) this.fsw._symlinkPaths.set(path$13.resolve(path), targetPath);
 			} else closer = this._handleFile(wh.watchPath, stats, initialAdd);
 			ready();
 			if (closer) this.fsw._addPathCloser(path, closer);
@@ -4691,9 +5780,9 @@ function createPattern(matcher) {
 	if (typeof matcher === "object" && matcher !== null) return (string) => {
 		if (matcher.path === string) return true;
 		if (matcher.recursive) {
-			const relative = sp.relative(matcher.path, string);
+			const relative = path$13.relative(matcher.path, string);
 			if (!relative) return false;
-			return !relative.startsWith("..") && !sp.isAbsolute(relative);
+			return !relative.startsWith("..") && !path$13.isAbsolute(relative);
 		}
 		return false;
 	};
@@ -4701,7 +5790,7 @@ function createPattern(matcher) {
 }
 function normalizePath(path) {
 	if (typeof path !== "string") throw new Error("string expected");
-	path = sp.normalize(path);
+	path = path$13.normalize(path);
 	path = path.replace(/\\/g, "/");
 	let prepend = false;
 	if (path.startsWith("//")) prepend = true;
@@ -4738,14 +5827,14 @@ const toUnix = (string) => {
 	if (prepend) str = SLASH + str;
 	return str;
 };
-const normalizePathToUnix = (path) => toUnix(sp.normalize(toUnix(path)));
+const normalizePathToUnix = (path) => toUnix(path$13.normalize(toUnix(path)));
 const normalizeIgnored = (cwd = "") => (path) => {
-	if (typeof path === "string") return normalizePathToUnix(sp.isAbsolute(path) ? path : sp.join(cwd, path));
+	if (typeof path === "string") return normalizePathToUnix(path$13.isAbsolute(path) ? path : path$13.join(cwd, path));
 	else return path;
 };
 const getAbsolutePath = (path, cwd) => {
-	if (sp.isAbsolute(path)) return path;
-	return sp.join(cwd, path);
+	if (path$13.isAbsolute(path)) return path;
+	return path$13.join(cwd, path);
 };
 const EMPTY_SET = Object.freeze(/* @__PURE__ */ new Set());
 /**
@@ -4774,7 +5863,7 @@ var DirEntry = class {
 		try {
 			await readdir(dir);
 		} catch (err) {
-			if (this._removeWatcher) this._removeWatcher(sp.dirname(dir), sp.basename(dir));
+			if (this._removeWatcher) this._removeWatcher(path$13.dirname(dir), path$13.basename(dir));
 		}
 	}
 	has(item) {
@@ -4810,7 +5899,7 @@ var WatchHelper = class {
 		const watchPath = path;
 		this.path = path = path.replace(REPLACER_RE, "");
 		this.watchPath = watchPath;
-		this.fullWatchPath = sp.resolve(watchPath);
+		this.fullWatchPath = path$13.resolve(watchPath);
 		this.dirParts = [];
 		this.dirParts.forEach((parts) => {
 			if (parts.length > 1) parts.pop();
@@ -4819,7 +5908,7 @@ var WatchHelper = class {
 		this.statMethod = follow ? STAT_METHOD_F : STAT_METHOD_L;
 	}
 	entryPath(entry) {
-		return sp.join(this.watchPath, sp.relative(this.watchPath, entry.fullPath));
+		return path$13.join(this.watchPath, path$13.relative(this.watchPath, entry.fullPath));
 	}
 	filterPath(entry) {
 		const { stats } = entry;
@@ -4955,7 +6044,7 @@ var FSWatcher = class extends EventEmitter {
 		})).then((results) => {
 			if (this.closed) return;
 			results.forEach((item) => {
-				if (item) this.add(sp.dirname(item), sp.basename(_origAdd || item));
+				if (item) this.add(path$13.dirname(item), path$13.basename(_origAdd || item));
 			});
 		});
 		return this;
@@ -4968,9 +6057,9 @@ var FSWatcher = class extends EventEmitter {
 		const paths = unifyPaths(paths_);
 		const { cwd } = this.options;
 		paths.forEach((path) => {
-			if (!sp.isAbsolute(path) && !this._closers.has(path)) {
-				if (cwd) path = sp.join(cwd, path);
-				path = sp.resolve(path);
+			if (!path$13.isAbsolute(path) && !this._closers.has(path)) {
+				if (cwd) path = path$13.join(cwd, path);
+				path = path$13.resolve(path);
 			}
 			this._closePath(path);
 			this._addIgnoredPath(path);
@@ -5014,7 +6103,7 @@ var FSWatcher = class extends EventEmitter {
 	getWatched() {
 		const watchList = {};
 		this._watched.forEach((entry, dir) => {
-			const index = (this.options.cwd ? sp.relative(this.options.cwd, dir) : dir) || ONE_DOT;
+			const index = (this.options.cwd ? path$13.relative(this.options.cwd, dir) : dir) || ONE_DOT;
 			watchList[index] = entry.getChildren().sort();
 		});
 		return watchList;
@@ -5034,8 +6123,8 @@ var FSWatcher = class extends EventEmitter {
 	async _emit(event, path, stats) {
 		if (this.closed) return;
 		const opts = this.options;
-		if (isWindows) path = sp.normalize(path);
-		if (opts.cwd) path = sp.relative(opts.cwd, path);
+		if (isWindows) path = path$13.normalize(path);
+		if (opts.cwd) path = path$13.relative(opts.cwd, path);
 		const args = [path];
 		if (stats != null) args.push(stats);
 		const awf = opts.awaitWriteFinish;
@@ -5080,7 +6169,7 @@ var FSWatcher = class extends EventEmitter {
 			if (!this._throttle(EVENTS.CHANGE, path, 50)) return this;
 		}
 		if (opts.alwaysStat && stats === void 0 && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-			const fullPath = opts.cwd ? sp.join(opts.cwd, path) : path;
+			const fullPath = opts.cwd ? path$13.join(opts.cwd, path) : path;
 			let stats;
 			try {
 				stats = await stat$1(fullPath);
@@ -5151,7 +6240,7 @@ var FSWatcher = class extends EventEmitter {
 		const pollInterval = awf.pollInterval;
 		let timeoutHandler;
 		let fullPath = path;
-		if (this.options.cwd && !sp.isAbsolute(path)) fullPath = sp.join(this.options.cwd, path);
+		if (this.options.cwd && !path$13.isAbsolute(path)) fullPath = path$13.join(this.options.cwd, path);
 		const now = /* @__PURE__ */ new Date();
 		const writes = this._pendingWrites;
 		function awaitWriteFinishFn(prevStat) {
@@ -5208,7 +6297,7 @@ var FSWatcher = class extends EventEmitter {
 	* @param directory path of the directory
 	*/
 	_getWatchedDir(directory) {
-		const dir = sp.resolve(directory);
+		const dir = path$13.resolve(directory);
 		if (!this._watched.has(dir)) this._watched.set(dir, new DirEntry(dir, this._boundRemove));
 		return this._watched.get(dir);
 	}
@@ -5227,8 +6316,8 @@ var FSWatcher = class extends EventEmitter {
 	* @param item      base path of item/directory
 	*/
 	_remove(directory, item, isDirectory) {
-		const path = sp.join(directory, item);
-		const fullPath = sp.resolve(path);
+		const path = path$13.join(directory, item);
+		const fullPath = path$13.resolve(path);
 		isDirectory = isDirectory != null ? isDirectory : this._watched.has(path) || this._watched.has(fullPath);
 		if (!this._throttle("remove", path, 100)) return;
 		if (!isDirectory && this._watched.size === 1) this.add(directory, item, true);
@@ -5238,7 +6327,7 @@ var FSWatcher = class extends EventEmitter {
 		parent.remove(item);
 		if (this._symlinkPaths.has(fullPath)) this._symlinkPaths.delete(fullPath);
 		let relPath = path;
-		if (this.options.cwd) relPath = sp.relative(this.options.cwd, path);
+		if (this.options.cwd) relPath = path$13.relative(this.options.cwd, path);
 		if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
 			if (this._pendingWrites.get(relPath).cancelWait() === EVENTS.ADD) return;
 		}
@@ -5253,8 +6342,8 @@ var FSWatcher = class extends EventEmitter {
 	*/
 	_closePath(path) {
 		this._closeFile(path);
-		const dir = sp.dirname(path);
-		this._getWatchedDir(dir).remove(sp.basename(path));
+		const dir = path$13.dirname(path);
+		this._getWatchedDir(dir).remove(path$13.basename(path));
 	}
 	/**
 	* Closes only file-specific watchers
@@ -5820,150 +6909,6 @@ function monotonicTs() {
 	return String(last);
 }
 //#endregion
-//#region src/agents/memory.ts
-/**
-* Agent memory — a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE
-* the workspace so it survives a workspace reset / re-clone and is never committed
-* into a github-workspace repo.
-*
-* Index-plus-topics shape (the structure Claude Code's auto-memory uses): a lean
-* `MEMORY.md` index — injected into the prompt every session, so it must stay small
-* — plus any number of `<topic>.md` files the agent reads on demand. The agent
-* maintains it via the `readMemory` / `writeMemory` / `listMemory` MCP tools; the
-* daemon serves the same directory to the CP for the console.
-*
-* SECURITY: topic paths are agent/console-supplied, so every path is contained to
-* the memory dir — absolute paths and `..` escapes are rejected, and the resolved
-* path is re-checked so a symlink can't smuggle a target out. Flat by design (one
-* level): a topic is a file directly under `memory/`, no nested dirs.
-*/
-const MEMORY_DIRNAME = "memory";
-/** Max bytes of the index injected into the prompt each session — keeps a large
-*  memory from swelling the context (mirrors Claude Code's 25 KB entrypoint cap). */
-const MAX_INDEX_INJECT_BYTES = 25e3;
-/** Hard cap on a single memory file. Injected/read every session, so an unbounded
-*  file would swell the prompt and the wire; writes over this are rejected. */
-const MAX_MEMORY_FILE_BYTES = 256e3;
-/** Raised when a memory path escapes the memory dir. Surfaces as `BAD_PAYLOAD`. */
-var MemoryPathError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "MemoryPathError";
-	}
-};
-/** Raised when a write exceeds {@link MAX_MEMORY_FILE_BYTES}. `BAD_PAYLOAD`. */
-var MemoryTooLargeError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "MemoryTooLargeError";
-	}
-};
-/** Raised when an `ifMatchMtime` precondition fails (the file changed under the
-*  writer — e.g. a console edit racing a newer agent write). Surfaces as CONFLICT. */
-var MemoryConflictError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "MemoryConflictError";
-	}
-};
-/** The memory directory for an agent, given its root dir (where agent.json lives). */
-function memoryDir(agentDir) {
-	return join(agentDir, MEMORY_DIRNAME);
-}
-/** Resolve a memory-dir-relative path to an absolute one, contained to the dir.
-*  Rejects absolute paths, `..` escapes, and any nested directory (flat only). */
-function resolveInMemoryDir(agentDir, relPath) {
-	if (isAbsolute(relPath)) throw new MemoryPathError("absolute paths are not allowed");
-	const dir = memoryDir(agentDir);
-	const abs = resolve(dir, relPath);
-	if (abs !== dir && !abs.startsWith(dir + sep)) throw new MemoryPathError("path escapes the memory dir");
-	const rel = abs.slice(dir.length + 1);
-	if (rel.includes(sep)) throw new MemoryPathError("memory is a flat directory (no subdirectories)");
-	if (rel.length === 0) throw new MemoryPathError("a file name is required");
-	return abs;
-}
-/** Seed `<agent-root>/memory/MEMORY.md` with a header if the dir/index is absent
-*  (idempotent). Called at session start so a brand-new agent always has an index. */
-function ensureMemory(agentDir, agentName) {
-	const dir = memoryDir(agentDir);
-	mkdirSync(dir, { recursive: true });
-	const index = join(dir, MEMORY_INDEX);
-	if (!existsSync(index)) writeFileSync(index, `# ${agentName} memory\n\nYour long-term memory index. Keep it short — link out to topic files (e.g. \`[deploys](deploys.md)\`) for detail and read them on demand with the readMemory tool.\n`);
-}
-/** Read the memory index (`MEMORY.md`) for prompt injection, trimmed to the inject
-*  cap so a large index can't blow up the prompt; '' when absent. */
-async function readIndex(agentDir) {
-	const text = await readMemoryFile(agentDir, MEMORY_INDEX);
-	if (Buffer.byteLength(text) <= 25e3) return text;
-	return Buffer.from(text, "utf8").subarray(0, MAX_INDEX_INJECT_BYTES).toString("utf8") + "\n\n[…memory index truncated — trim MEMORY.md]";
-}
-/** Read a memory file's text; '' when it does not exist (never throws on ENOENT). */
-async function readMemoryFile(agentDir, relPath) {
-	const abs = resolveInMemoryDir(agentDir, relPath);
-	try {
-		return await promises.readFile(abs, "utf8");
-	} catch (err) {
-		if (err.code === "ENOENT") return "";
-		throw err;
-	}
-}
-/** Overwrite a memory file with `content` (creating the dir if needed). Atomic
-*  (tmp + rename) so a concurrent read never sees a partial file.
-*
-*  - Rejects content over {@link MAX_MEMORY_FILE_BYTES} ({@link MemoryTooLargeError}).
-*  - `ifMatchMtime` (optimistic concurrency): when given, the current file's mtime
-*    must equal it, else {@link MemoryConflictError} — so a console edit can't
-*    clobber a newer write. A brand-new file (no mtime) matches `ifMatchMtime`
-*    only when the caller passes none (or the empty string). */
-async function writeMemoryFile(agentDir, relPath, content, ifMatchMtime) {
-	if (Buffer.byteLength(content) > 256e3) throw new MemoryTooLargeError(`memory file exceeds the ${MAX_MEMORY_FILE_BYTES}-byte limit`);
-	const abs = resolveInMemoryDir(agentDir, relPath);
-	if (ifMatchMtime) {
-		let current = null;
-		try {
-			current = (await promises.stat(abs)).mtime.toISOString();
-		} catch (err) {
-			if (err.code !== "ENOENT") throw err;
-		}
-		if (current !== ifMatchMtime) throw new MemoryConflictError("the memory file changed since it was read; reload and retry");
-	}
-	await promises.mkdir(memoryDir(agentDir), { recursive: true });
-	const tmp = `${abs}.tmp`;
-	await promises.writeFile(tmp, content, "utf8");
-	await promises.rename(tmp, abs);
-	const st = await promises.stat(abs);
-	return {
-		size: st.size,
-		mtime: st.mtime.toISOString()
-	};
-}
-/** List the files in the memory dir (flat; index + topics), sorted with the index
-*  first. Empty when the dir does not exist. `.tmp` write artifacts are skipped. */
-async function listMemory(agentDir) {
-	const dir = memoryDir(agentDir);
-	let dirents;
-	try {
-		dirents = await promises.readdir(dir, { withFileTypes: true });
-	} catch (err) {
-		if (err.code === "ENOENT") return [];
-		throw err;
-	}
-	const files = [];
-	for (const d of dirents) {
-		if (!d.isFile() || d.name.endsWith(".tmp")) continue;
-		try {
-			const st = await promises.stat(join(dir, d.name));
-			files.push({
-				name: d.name,
-				size: st.size,
-				mtime: st.mtime.toISOString()
-			});
-		} catch {}
-	}
-	files.sort((a, b) => a.name === "MEMORY.md" ? -1 : b.name === "MEMORY.md" ? 1 : a.name.localeCompare(b.name));
-	return files;
-}
-//#endregion
 //#region src/session/attachment-block.ts
 /**
 * Turn one Slack attachment into the richest ACP content block the agent can
@@ -119024,469 +119969,41 @@ function makeLogger(level = "info") {
 	};
 }
 //#endregion
-//#region src/cp/wire-slice.ts
-/**
-* Pure helpers for slicing file bytes into a single WS frame — shared by the
-* workspace and memory readers so both honour the 256 KiB wire cap and never
-* split a UTF-8 character across slices.
-*/
-/** Encoded-payload ceiling, leaving headroom under MAX_FRAME_BYTES for the
-*  envelope (id/ts/type/corr + fencing ext, well under 4 KiB). */
-const REPLY_BUDGET$1 = MAX_FRAME_BYTES - 4096;
-/** The encoded size of the payload the wire will carry (JSON.stringify matches
-*  the codec's `encode`), measured in bytes. */
-function encodedBytes$1(payload) {
-	return Buffer.byteLength(JSON.stringify(payload));
-}
-/** Largest index ≤ `len` that lands on a UTF-8 character boundary — i.e. never
-*  cuts a multi-byte sequence. If the slice's trailing char is incomplete, the
-*  boundary is placed before that char (its bytes belong to the next slice). */
-function utf8Boundary$1(buf, len) {
-	if (len >= buf.length) len = buf.length;
-	if (len <= 0) return 0;
-	let start = len - 1;
-	while (start > 0 && ((buf[start] ?? 0) & 192) === 128) start--;
-	const lead = buf[start] ?? 0;
-	const seqLen = lead < 128 ? 1 : (lead & 224) === 192 ? 2 : (lead & 240) === 224 ? 3 : (lead & 248) === 240 ? 4 : 1;
-	return start + seqLen <= len ? len : start;
-}
-/** Shrink `content` (a utf8 view of `slice[0..end]`) until its JSON-escaped size
-*  fits `REPLY_BUDGET`, keeping the cut on a UTF-8 boundary. Returns the final
-*  `{ end, content }`. Control-byte-heavy text escapes ~6×, so the raw byte limit
-*  is not enough on its own. */
-function fitToBudget(slice, end) {
-	let content = slice.toString("utf8", 0, end);
-	while (end > 0 && encodedBytes$1(content) > REPLY_BUDGET$1) {
-		const factor = REPLY_BUDGET$1 / encodedBytes$1(content);
-		const shrunk = Math.max(1, Math.floor(end * factor * .9));
-		end = utf8Boundary$1(slice, Math.min(shrunk, end - 1));
-		content = slice.toString("utf8", 0, end);
-	}
-	return {
-		end,
-		content
-	};
-}
-//#endregion
-//#region src/cp/workspace-reader.ts
+//#region src/cp/relay-client.ts
 /**
-* `WorkspaceReader` — the read-only seam answering the CP's `workspace/list` and
-* `workspace/read` REQs from the agent's local workspace directory. File bytes
-* live only on the daemon (§1/§12); this streams single pages/slices to the CP,
-* never whole trees or files.
+* `RelayClient` — the daemon's dial-out client to ONE relay over the `rd/*` wire
+* (shared-bot-relay.md §11 / §7.2). The daemon holds one to every relay in its
+* roster; {@link RelayManager} set-converges them.
 *
-* Containment is to `workspace.path` EXACTLY — the parent directory holds
-* `agent.json` and `.env` secrets, so escaping even one level is a secret leak.
-* Every request path is (1) rejected if absolute, (2) lexically resolved against
-* the root and prefix-checked, then (3) canonicalised with `realpath` and
-* re-verified so symlinks (including an intermediate directory component swapped
-* to a symlink after the check) cannot smuggle a target outside the root; all
-* I/O runs on the canonical path. Violations throw `WorkspaceViolationError`,
-* which the dispatcher maps to a `BAD_PAYLOAD` error frame; missing paths are
-* data (`exists:false`), not errors. Never log file contents.
-*
-* Frame-size safety: every REP must serialise under the 256 KiB wire cap. JSON
-* escaping of control bytes is a 6× blowup, so `read` bounds the slice by the
-* *encoded* reply size (not the raw byte `limit`) and `list` stops a page early
-* when the encoded entries would overflow — both leave headroom for the envelope.
+* Milestone A2 establishes the connection: dial → `rd/hello` (presenting the
+* daemon's existing CP API key, which the relay delegates to the CP via
+* `rc/verify`) → `rd/hello/ok`, whose echoed `relayId` MUST match the roster entry
+* dialed (a mismatch = a pool LB in front of the daemon dial path → close +
+* backoff, never continue on the wrong instance, §5). Content (`rd/msg`) flows in
+* PR 3. Built on the shared `@agentconnect.md/connection` primitives — the first
+* daemon consumer of that package.
 */
-/** Bytes sniffed from the head of a file for binary (NUL byte) detection. */
-const SNIFF_BYTES = 8192;
-/** Path-containment / bad-request violation → `BAD_PAYLOAD` on the wire. */
-var WorkspaceViolationError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "WorkspaceViolationError";
-	}
-};
-function isErrno$1(err, code) {
-	return err?.code === code;
-}
-function under(root, p) {
-	return p === root || p.startsWith(root + sp.sep);
-}
-function createWorkspaceReader(workspaceRootByAgent) {
-	function rootFor(agentId) {
-		const root = workspaceRootByAgent(agentId);
-		if (!root) throw new WorkspaceViolationError(`unknown agent "${agentId}"`);
-		return root;
-	}
-	/**
-	* Lexical containment. Rejects absolute paths and `..` escapes; returns the
-	* lexically-resolved path plus the canonical (realpath'd) root, or `null` for
-	* `realRoot` when the root does not exist yet (callers report `exists:false`).
-	*/
-	async function resolveContained(root, relPath) {
-		if (sp.isAbsolute(relPath)) throw new WorkspaceViolationError("absolute paths are not allowed");
-		const resolved = sp.resolve(root, relPath);
-		if (!under(root, resolved)) throw new WorkspaceViolationError("path escapes the workspace root");
-		try {
-			return {
-				resolved,
-				realRoot: await promises.realpath(root)
-			};
-		} catch (err) {
-			if (isErrno$1(err, "ENOENT")) return {
-				resolved,
-				realRoot: null
-			};
-			throw err;
-		}
-	}
-	/** Canonicalise an existing target and re-verify containment on the REAL path,
-	*  closing the check-vs-use gap (a symlinked intermediate component resolves
-	*  out and is rejected here). Returns the canonical path used for I/O. */
-	async function canonicalUnder(realRoot, abs) {
-		const canon = await promises.realpath(abs);
-		if (!under(realRoot, canon)) throw new WorkspaceViolationError("path resolves outside the workspace root");
-		return canon;
-	}
-	return {
-		async list(req) {
-			const { resolved, realRoot } = await resolveContained(rootFor(req.agentId), req.path);
-			const notFound = {
-				agentId: req.agentId,
-				path: req.path,
-				exists: false,
-				entries: []
-			};
-			if (realRoot === null) return notFound;
-			let target;
-			try {
-				target = await canonicalUnder(realRoot, resolved);
-			} catch (err) {
-				if (isErrno$1(err, "ENOENT")) return notFound;
-				throw err;
-			}
-			let dirents;
-			try {
-				dirents = await promises.readdir(target, { withFileTypes: true });
-			} catch (err) {
-				if (isErrno$1(err, "ENOENT") || isErrno$1(err, "ENOTDIR")) return notFound;
-				throw err;
-			}
-			const entries = [];
-			for (const d of dirents) {
-				if (d.name === ".git") continue;
-				const type = d.isDirectory() ? "dir" : d.isFile() ? "file" : d.isSymbolicLink() ? "symlink" : "other";
-				const entry = {
-					name: d.name,
-					type
-				};
-				if (type === "file") try {
-					const st = await promises.lstat(sp.join(target, d.name));
-					entry.size = st.size;
-					entry.mtime = st.mtime.toISOString();
-				} catch {}
-				entries.push(entry);
-			}
-			entries.sort(compareEntries);
-			const start = req.cursor !== void 0 && /^\d+$/.test(req.cursor) ? Number(req.cursor) : 0;
-			const page = [];
-			let acc = 0;
-			for (let i = start; i < entries.length && page.length < req.limit; i++) {
-				const e = entries[i];
-				const enc = encodedBytes$1(e) + 1;
-				if (page.length > 0 && acc + enc > REPLY_BUDGET$1) break;
-				page.push(e);
-				acc += enc;
-			}
-			const consumed = start + page.length;
-			return {
-				agentId: req.agentId,
-				path: req.path,
-				exists: true,
-				entries: page,
-				...consumed < entries.length ? { nextCursor: String(consumed) } : {}
-			};
-		},
-		async read(req) {
-			const { resolved, realRoot } = await resolveContained(rootFor(req.agentId), req.path);
-			const notFound = {
-				agentId: req.agentId,
-				path: req.path,
-				exists: false
-			};
-			if (realRoot === null) return notFound;
-			let st;
-			try {
-				st = await promises.lstat(resolved);
-			} catch (err) {
-				if (isErrno$1(err, "ENOENT")) return notFound;
-				throw err;
-			}
-			if (!st.isFile()) throw new WorkspaceViolationError("not a regular file");
-			const target = await canonicalUnder(realRoot, resolved);
-			const size = st.size;
-			const mtime = st.mtime.toISOString();
-			const fh = await promises.open(target, "r");
-			try {
-				const sniffLen = Math.min(SNIFF_BYTES, size);
-				if (sniffLen > 0) {
-					const sniff = Buffer.alloc(sniffLen);
-					const { bytesRead } = await fh.read(sniff, 0, sniffLen, 0);
-					if (sniff.subarray(0, bytesRead).includes(0)) return {
-						agentId: req.agentId,
-						path: req.path,
-						exists: true,
-						size,
-						mtime,
-						encoding: "none"
-					};
-				}
-				const want = Math.min(req.limit, Math.max(0, size - req.offset));
-				let slice = Buffer.alloc(0);
-				if (want > 0) {
-					const buf = Buffer.alloc(want);
-					const { bytesRead } = await fh.read(buf, 0, want, req.offset);
-					slice = buf.subarray(0, bytesRead);
-				}
-				let end = utf8Boundary$1(slice, slice.length);
-				const fitted = fitToBudget(slice, end);
-				end = fitted.end;
-				const content = fitted.content;
-				const nextOffset = req.offset + end;
-				return {
-					agentId: req.agentId,
-					path: req.path,
-					exists: true,
-					size,
-					mtime,
-					encoding: "utf8",
-					content,
-					offset: req.offset,
-					nextOffset,
-					truncated: nextOffset < size
-				};
-			} finally {
-				await fh.close();
-			}
-		}
-	};
-}
-/** dirs first, then case-insensitive alphabetical (stable within the page). */
-function compareEntries(a, b) {
-	const aDir = a.type === "dir" ? 0 : 1;
-	const bDir = b.type === "dir" ? 0 : 1;
-	if (aDir !== bDir) return aDir - bDir;
-	const al = a.name.toLowerCase();
-	const bl = b.name.toLowerCase();
-	if (al !== bl) return al < bl ? -1 : 1;
-	return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
-}
-//#endregion
-//#region src/cp/memory-reader.ts
-/**
-* `MemoryReader` — the seam answering the CP's `memory/list`, `memory/read` and
-* `memory/write` REQs for an agent's memory directory (`<agent-root>/memory/`).
-* The files live only on the daemon (§1/§12); reads stream single byte slices,
-* writes replace one whole file.
-*
-* Path containment lives in `agents/memory.ts` (`resolveInMemoryDir`): a topic
-* path that escapes the memory dir throws `MemoryPathError` → `BAD_PAYLOAD`. An
-* unknown agent is also `BAD_PAYLOAD`; a not-yet-created file/dir is data
-* (`exists:false`), not an error. Frame-size safety mirrors the workspace reader:
-* the read slice is bounded by the *encoded* reply size and ends on a UTF-8
-* boundary. Never log memory contents.
-*/
-/** Unknown-agent violation → `BAD_PAYLOAD` on the wire (path escapes surface as
-*  MemoryPathError from agents/memory.ts, mapped the same way by the dispatcher). */
-var MemoryViolationError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "MemoryViolationError";
-	}
-};
-function isErrno(err, code) {
-	return err?.code === code;
-}
-/** `agentDirByAgent` resolves an agent id → its root dir (which holds `memory/`),
-*  or undefined for an unknown agent. */
-function createMemoryReader(agentDirByAgent) {
-	function dirFor(agentId) {
-		const dir = agentDirByAgent(agentId);
-		if (!dir) throw new MemoryViolationError(`unknown agent "${agentId}"`);
-		return dir;
-	}
-	return {
-		async list(req) {
-			const files = await listMemory(dirFor(req.agentId));
-			return {
-				agentId: req.agentId,
-				exists: files.length > 0,
-				entries: files
-			};
-		},
-		async read(req) {
-			const file = resolveInMemoryDir(dirFor(req.agentId), req.path);
-			const notFound = {
-				agentId: req.agentId,
-				path: req.path,
-				exists: false
-			};
-			let st;
-			try {
-				st = await promises.stat(file);
-			} catch (err) {
-				if (isErrno(err, "ENOENT")) return notFound;
-				throw err;
-			}
-			if (!st.isFile()) return notFound;
-			const size = st.size;
-			const mtime = st.mtime.toISOString();
-			const fh = await promises.open(file, "r");
-			try {
-				const want = Math.min(req.limit, Math.max(0, size - req.offset));
-				let slice = Buffer.alloc(0);
-				if (want > 0) {
-					const buf = Buffer.alloc(want);
-					const { bytesRead } = await fh.read(buf, 0, want, req.offset);
-					slice = buf.subarray(0, bytesRead);
-				}
-				const { end, content } = fitToBudget(slice, utf8Boundary$1(slice, slice.length));
-				const nextOffset = req.offset + end;
-				return {
-					agentId: req.agentId,
-					path: req.path,
-					exists: true,
-					size,
-					mtime,
-					content,
-					offset: req.offset,
-					nextOffset,
-					truncated: nextOffset < size
-				};
-			} finally {
-				await fh.close();
-			}
-		},
-		async write(req) {
-			const { size, mtime } = await writeMemoryFile(dirFor(req.agentId), req.path, req.content, req.ifMatchMtime);
-			return {
-				agentId: req.agentId,
-				path: req.path,
-				size,
-				mtime
-			};
-		}
-	};
-}
-//#endregion
-//#region src/cp/correlator.ts
-/** Transport-free representation of a typed wire `error` REP. */
-var WireError = class extends Error {
-	code;
-	retryable;
-	details;
-	constructor(code, message, retryable = false, details) {
-		super(message);
-		this.name = "WireError";
-		this.code = code;
-		this.retryable = retryable;
-		if (details) this.details = details;
-	}
-};
-var ReqRep = class {
-	clock;
-	ackTimeoutMs;
-	maxTries;
-	pending = /* @__PURE__ */ new Map();
-	constructor(clock, ackTimeoutMs, maxTries = 5) {
-		this.clock = clock;
-		this.ackTimeoutMs = ackTimeoutMs;
-		this.maxTries = maxTries;
-	}
-	request(frame, write, opts = {}) {
-		const encoded = JSON.stringify(frame);
-		return new Promise((resolve, reject) => {
-			const entry = {
-				id: frame.id,
-				encoded,
-				resolve,
-				reject,
-				tries: 1,
-				maxTries: opts.maxTries ?? this.maxTries
-			};
-			this.pending.set(frame.id, entry);
-			this.arm(entry, write, opts.ackTimeoutMs ?? this.ackTimeoutMs);
-			try {
-				write(encoded);
-			} catch (e) {
-				this.fail(entry, new WireError("INTERNAL", `send failed: ${e.message}`, true));
-			}
-		});
-	}
-	arm(entry, write, ackTimeoutMs) {
-		entry.timer = this.clock.setTimeout(() => {
-			if (!this.pending.has(entry.id)) return;
-			if (entry.tries >= entry.maxTries) {
-				this.pending.delete(entry.id);
-				entry.reject(new WireError("INTERNAL", `no ack after ${entry.maxTries} tries for ${entry.id}`, true));
-				return;
-			}
-			entry.tries += 1;
-			this.arm(entry, write, ackTimeoutMs);
-			try {
-				write(entry.encoded);
-			} catch (e) {
-				this.fail(entry, new WireError("INTERNAL", `send failed: ${e.message}`, true));
-			}
-		}, ackTimeoutMs);
-	}
-	fail(entry, err) {
-		if (!this.pending.has(entry.id)) return;
-		this.pending.delete(entry.id);
-		if (entry.timer !== void 0) this.clock.clearTimeout(entry.timer);
-		entry.reject(err);
-	}
-	settle(frame) {
-		const corr = frame.corr;
-		if (!corr) return false;
-		const entry = this.pending.get(corr);
-		if (!entry) return false;
-		this.pending.delete(corr);
-		if (entry.timer !== void 0) this.clock.clearTimeout(entry.timer);
-		if (frame.type === "error") {
-			const e = frame.payload;
-			entry.reject(new WireError(e.code, e.message, e.retryable, e.details));
-		} else entry.resolve(frame);
-		return true;
-	}
-	inflight() {
-		return this.pending.size;
-	}
-	rejectAll(err) {
-		for (const entry of this.pending.values()) {
-			if (entry.timer !== void 0) this.clock.clearTimeout(entry.timer);
-			entry.reject(err);
-		}
-		this.pending.clear();
-	}
-};
-//#endregion
-//#region src/cp/client.ts
 const ACK_TIMEOUT_MS = 5e3;
-const BACKOFF_BASE_MS = 1e3;
-const BACKOFF_CAP_MS = 3e4;
-var CpClient = class {
+/** rd/hello definitively rejected (bad/revoked key, daemonId mismatch) → stop dialing THIS relay. */
+const CLOSE_AUTH_FAILED = 4401;
+var RelayClient = class {
+	relayId;
+	url;
 	deps;
 	state = "CLOSED";
-	sessionEpoch = 0;
-	routingEpoch = 0;
 	transport;
 	correlator;
+	backoff;
 	stopped = false;
 	fatal = false;
-	attempt = 0;
 	reconnectTimer;
-	lastAuthedEpoch = 0;
-	heartbeatTimer;
-	heartbeatMs = 0;
-	constructor(deps) {
+	constructor(relayId, url, deps) {
+		this.relayId = relayId;
+		this.url = url;
 		this.deps = deps;
 		this.correlator = new ReqRep(deps.clock, ACK_TIMEOUT_MS);
+		this.backoff = new Backoff(deps.jitter ? { jitter: deps.jitter } : {});
 	}
-	/** Non-blocking: kicks off the connect loop and returns. */
 	start() {
 		this.stopped = false;
 		this.fatal = false;
@@ -119498,16 +120015,24 @@ var CpClient = class {
 			this.deps.clock.clearTimeout(this.reconnectTimer);
 			this.reconnectTimer = void 0;
 		}
-		this.stopHeartbeat();
 		this.correlator.rejectAll(/* @__PURE__ */ new Error("stopping"));
 		this.transport?.close(1e3, "shutdown");
 		this.state = "CLOSED";
 	}
+	isReady() {
+		return this.state === "READY";
+	}
 	async attemptConnect() {
 		if (this.stopped || this.fatal) return;
+		const daemonId = this.deps.daemonId();
+		if (!daemonId) {
+			this.state = "DEGRADED";
+			this.scheduleReconnect();
+			return;
+		}
 		this.state = "CONNECTING";
 		try {
-			const t = await this.deps.connect();
+			const t = await this.deps.connect(this.url);
 			if (this.stopped || this.fatal) {
 				t.close(1e3, "shutdown");
 				return;
@@ -119515,196 +120040,44 @@ var CpClient = class {
 			this.transport = t;
 			t.onMessage((txt) => void this.onText(txt));
 			t.onClose((c, r) => this.onClose(c, r));
-			await this.handshake();
-			this.attempt = 0;
+			await this.handshake(daemonId);
+			this.backoff.reset();
 		} catch (err) {
-			this.deps.log.warn(`cp: connect/handshake failed: ${err.message}`);
+			this.deps.log.warn(`relay(${this.relayId}): connect/hello failed: ${err.message}`);
 			this.transport?.close(1011, "handshake failed");
 			this.transport = void 0;
 			this.scheduleReconnect();
 		}
 	}
-	scheduleReconnect() {
-		if (this.stopped || this.fatal) return;
-		if (this.reconnectTimer !== void 0) return;
-		const jitter = this.deps.jitter ?? Math.random;
-		const base = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** this.attempt);
-		const delay = Math.min(BACKOFF_CAP_MS, base + Math.floor(jitter() * base));
-		this.attempt += 1;
-		this.reconnectTimer = this.deps.clock.setTimeout(() => {
-			this.reconnectTimer = void 0;
-			this.attemptConnect();
-		}, delay);
-	}
-	async handshake() {
-		this.state = "AUTHENTICATING";
-		const authPayload = {
-			apiKey: this.deps.token,
-			agentVersion: this.deps.agentVersion
-		};
-		if (this.deps.daemonId) authPayload.daemonId = this.deps.daemonId;
-		if (this.lastAuthedEpoch > 0) authPayload.resume = { lastEpoch: this.lastAuthedEpoch };
-		const ok = (await this.request("auth", authPayload)).payload;
-		this.sessionEpoch = ok.sessionEpoch;
-		this.lastAuthedEpoch = ok.sessionEpoch;
-		if (ok.daemonId && ok.daemonId !== this.deps.daemonId) {
-			this.deps.daemonId = ok.daemonId;
-			this.deps.onDaemonId?.(ok.daemonId);
-		}
-		this.deps.onWebAppUrl?.(ok.webAppUrl);
-		this.deps.onOrgSlug?.(ok.orgSlug);
-		this.state = "REGISTERING";
-		const snap = (await this.request("register", {
-			host: this.deps.host,
-			capabilities: this.deps.capabilities(),
-			maxAgents: this.deps.maxAgents,
-			localState: this.deps.localState()
-		})).payload;
-		this.routingEpoch = snap.routingEpoch;
-		this.deps.configApply.applyReconcileSnapshot(snap);
+	async handshake(daemonId) {
+		this.state = "HELLO";
+		const rep = await this.sendRequest(buildRelayDaemonFrame("rd/hello", {
+			apiKey: this.deps.apiKey(),
+			daemonId
+		}));
+		if (rep.type !== "rd/hello/ok") throw new WireError("INTERNAL", `expected rd/hello/ok, got ${rep.type}`, false);
+		const ok = rep.payload;
+		if (ok.relayId !== this.relayId) throw new WireError("INTERNAL", `relay misroute: dialed ${this.relayId}, reached ${ok.relayId}`, true);
 		this.state = "READY";
-		this.heartbeatMs = ok.heartbeatSec > 0 ? ok.heartbeatSec * 1e3 : this.deps.heartbeatDefaultMs;
-		this.armHeartbeat();
-		this.deps.log.info(`cp: READY (epoch=${this.sessionEpoch}, routingEpoch=${this.routingEpoch})`);
-		this.emitDaemonRuntimes(this.deps.runtimeProfiles(), this.deps.mcpServerFacts?.() ?? []);
-		this.deps.onReady?.();
-	}
-	/**
-	* Push the full runtime snapshot (D→C `facts/daemon-runtimes` EVT,
-	* fire-and-forget) — sent on each register and again when a probe sweep
-	* completes. REPLACE semantics on the CP: it reconciles the daemon's stored
-	* runtime list to exactly this snapshot, pruning runtimes that are no longer
-	* installed. No-op unless READY/DRAINING.
-	*/
-	emitDaemonRuntimes(runtimes, mcpServers = []) {
-		if (this.state !== "READY" && this.state !== "DRAINING") return;
-		this.transport?.send(encode(buildEnvelope("facts/daemon-runtimes", {
-			runtimes,
-			mcpServers
-		})));
-	}
-	/**
-	* Report a session's cumulative token usage (D→C `usage/report` EVT,
-	* fire-and-forget). No-op unless READY/DRAINING — usage is dashboard telemetry,
-	* so a dropped report just means that turn's delta is absent from the CP's
-	* historical aggregates until the next report (which re-sends the cumulative
-	* snapshot, latest-wins). Never blocks the turn.
-	*/
-	emitUsageReport(report) {
-		if (this.state !== "READY" && this.state !== "DRAINING") return;
-		this.transport?.send(encode(buildEnvelope("usage/report", report)));
-	}
-	/**
-	* Report a session's converged milestone + sessionKey echo (D→C `event/session`
-	* EVT, fire-and-forget, latest-wins per `sessionId`). This is what lets the CP
-	* store session metadata so a deep-link detail page (…/sessions/:id) resolves
-	* even when the daemon is offline. Metadata only — never the message stream
-	* (that stays daemon-local, §1/§12). No-op unless READY/DRAINING; a dropped
-	* `start` is re-covered by the next milestone (the CP upsert is latest-wins).
-	*/
-	emitEventSession(event) {
-		if (this.state !== "READY" && this.state !== "DRAINING") return;
-		this.transport?.send(encode(buildEnvelope("event/session", event)));
-	}
-	/**
-	* Report an integration's channel-membership snapshot (D→C `integration/channels`
-	* EVT, fire-and-forget, latest-wins). No-op unless READY/DRAINING — the daemon
-	* re-emits its cached snapshots on each (re)connect (see onReady in daemon.ts),
-	* so a dropped report only delays the console's channel list, never loses it.
-	*/
-	emitIntegrationChannels(snapshot) {
-		if (this.state !== "READY" && this.state !== "DRAINING") return;
-		this.transport?.send(encode(buildEnvelope("integration/channels", snapshot)));
+		this.deps.log.info(`relay(${this.relayId}): rd/* connected`);
 	}
-	/**
-	* Report a CP-owned cron fire (D→C `cron/report` EVT, fire-and-forget) so the
-	* console's `lastRunAt` converges. The local D11 stamp stays authoritative and
-	* the CP upsert is latest-wins, so re-asserting stored stamps on each
-	* (re)connect (see onReady in daemon.ts) makes a dropped report only a delay,
-	* never a loss. No-op unless READY/DRAINING.
-	*/
-	emitCronReport(report) {
-		if (this.state !== "READY" && this.state !== "DRAINING") return;
-		this.transport?.send(encode(buildEnvelope("cron/report", report)));
-	}
-	/**
-	* Emit one chunk of a webchat turn's reply stream (D→C `webchat/output` EVT).
-	* Ordered per-connection (TCP); `output.index` is the per-turn assembly counter.
-	* No-op unless READY/DRAINING — a dropped chunk is lost (unlike latest-wins
-	* telemetry), so the daemon only emits while connected. Content is inline, bounded
-	* by the 256 KiB frame cap; the caller chunks any oversize single event.
-	*/
-	emitWebchatOutput(output) {
-		if (this.state !== "READY" && this.state !== "DRAINING") return;
-		this.transport?.send(encode(buildEnvelope("webchat/output", output)));
-	}
-	/** Emit a webchat turn's completion (D→C `webchat/done` EVT). No-op unless READY/DRAINING. */
-	emitWebchatDone(done) {
-		if (this.state !== "READY" && this.state !== "DRAINING") return;
-		this.transport?.send(encode(buildEnvelope("webchat/done", done)));
-	}
-	request(type, payload) {
-		const frame = buildEnvelope(type, payload);
+	sendRequest(frame) {
 		return this.correlator.request(frame, (e) => this.transport.send(e));
 	}
-	/**
-	* `gitcred/request` (D→C REQ) → grant payload. The FIRST post-handshake
-	* daemon-issued REQ, so unlike the handshake `request()` it is state-GATED:
-	* outside READY/DRAINING it fails immediately (the credential cache degrades
-	* to its unexpired copy or errors) — never queued, never a bare
-	* `transport!.send` on a dead socket. Single send + 10s budget: the default
-	* 5s×5 retransmit would blow every git-side timeout, and CP-side mint
-	* single-flight makes a later fresh request cheap anyway.
-	*/
-	async requestGitCred(payload) {
-		if (this.state !== "READY" && this.state !== "DRAINING" || !this.transport) throw new WireError("INTERNAL", `control plane unreachable (client ${this.state})`, true);
-		const frame = buildEnvelope("gitcred/request", payload);
-		const rep = await this.correlator.request(frame, (e) => this.transport.send(e), {
-			maxTries: 1,
-			ackTimeoutMs: 1e4
-		});
-		if (rep.type !== "gitcred/grant") throw new WireError("INTERNAL", `expected gitcred/grant, got ${rep.type}`, false);
-		return rep.payload;
-	}
 	async onText(text) {
-		const decoded = decodeEnvelope(text);
-		if (!decoded.ok) {
-			this.sendError(decoded.id, this.decodeErrorCode(decoded.msg), decoded.msg, false);
-			return;
-		}
+		const decoded = decodeRelayDaemonFrame(text);
+		if (!decoded.ok) return;
 		const frame = decoded.frame;
 		if (frame.corr && this.correlator.settle(frame)) return;
-		if (this.state !== "READY" && this.state !== "DRAINING") {
-			this.sendError(frame.id, "PROTOCOL_STATE", `${frame.type} illegal in ${this.state}`, false);
-			return;
-		}
-		if (decoded.ext?.epoch !== void 0 && decoded.ext.epoch < this.sessionEpoch) {
-			this.sendError(frame.id, "STALE_EPOCH", "epoch < current", true);
-			return;
-		}
-		this.dispatchControl(frame);
-	}
-	decodeErrorCode(msg) {
-		if (msg === "FRAME_TOO_LARGE") return "FRAME_TOO_LARGE";
-		if (msg === "UNKNOWN_FRAME") return "UNKNOWN_FRAME";
-		return "BAD_PAYLOAD";
-	}
-	sendError(corr, code, message, retryable) {
-		if (!this.transport) return;
-		this.transport.send(encode(buildEnvelope("error", {
-			code,
-			message,
-			retryable
-		}, { corr })));
+		this.deps.log.debug(`relay(${this.relayId}): ignoring ${frame.type}`);
 	}
 	onClose(code, _reason) {
-		this.stopHeartbeat();
 		this.transport = void 0;
 		this.correlator.rejectAll(new WireError("INTERNAL", "connection closed", true));
-		if (code === 4401) {
+		if (code === CLOSE_AUTH_FAILED) {
 			this.fatal = true;
 			this.state = "CLOSED";
-			this.deps.log.error("cp: AUTH_FAILED (4401) — not reconnecting; re-mint the daemon token");
+			this.deps.log.warn(`relay(${this.relayId}): rd/hello rejected (4401) — not redialing`);
 			return;
 		}
 		if (this.stopped) {
@@ -119714,204 +120087,50 @@ var CpClient = class {
 		this.state = "DEGRADED";
 		this.scheduleReconnect();
 	}
-	armHeartbeat() {
-		this.heartbeatTimer = this.deps.clock.setTimeout(() => {
-			if (this.state === "READY") this.transport?.send(encode(buildEnvelope("heartbeat", {
-				load: this.deps.loadSnapshot(),
-				health: "ok",
-				activeSessions: this.deps.activeSessions(),
-				degradedScopes: this.deps.degradedScopes?.() ?? []
-			})));
-			if (this.state === "READY" || this.state === "DRAINING") this.armHeartbeat();
-		}, this.heartbeatMs);
-	}
-	stopHeartbeat() {
-		if (this.heartbeatTimer !== void 0) {
-			this.deps.clock.clearTimeout(this.heartbeatTimer);
-			this.heartbeatTimer = void 0;
-		}
-	}
-	/** C→D control dispatch. The CP changes config, never live routing. */
-	dispatchControl(frame) {
-		switch (frame.type) {
-			case "config/push":
-				this.deps.configApply.applyConfigPush(frame.payload.keys);
-				return;
-			case "cron/upsert":
-				try {
-					this.deps.configApply.upsertCron(frame.payload);
-					this.reply(frame, "ack", { ok: true });
-				} catch (err) {
-					this.sendError(frame.id, "BAD_PAYLOAD", `cron upsert failed: ${err.message}`, false);
-				}
-				return;
-			case "cron/remove":
-				this.deps.configApply.removeCron(frame.payload.cronId);
-				this.reply(frame, "ack", { ok: true });
-				return;
-			case "cron/run":
-				this.reply(frame, "ack", this.deps.configApply.runCron(frame.payload.cronId));
-				return;
-			case "route/assign": {
-				const a = frame.payload;
-				this.deps.configApply.applyRouteAssign(a);
-				this.reply(frame, "route/assign/ack", {
-					ok: true,
-					sessionKey: a.sessionKey
-				});
-				return;
-			}
-			case "route/update":
-				this.deps.configApply.applyRouteUpdate(frame.payload);
-				return;
-			case "agent/upsert": {
-				const u = frame.payload;
-				this.deps.configApply.applyAgentUpsert(u.agentId, u.spec);
-				return;
-			}
-			case "agent/remove":
-				this.deps.configApply.applyAgentRemove(frame.payload.agentId);
-				return;
-			case "integration/upsert":
-				this.deps.configApply.applyIntegrationUpsert(frame.payload);
-				return;
-			case "integration/remove":
-				this.deps.configApply.applyIntegrationRemove(frame.payload.integrationId);
-				return;
-			case "agent/launch": {
-				const launch = frame.payload;
-				this.deps.configApply.applyAgentLaunch(launch).then((launched) => this.reply(frame, "agent/launched", launched)).catch((err) => this.sendError(frame.id, "INTERNAL", `agent/launch failed: ${err.message}`, false));
-				return;
-			}
-			case "agent/stop": {
-				const stop = frame.payload;
-				this.deps.configApply.applyAgentStop(stop).then((ack) => this.reply(frame, "ack", ack)).catch((err) => this.sendError(frame.id, "INTERNAL", `agent/stop failed: ${err.message}`, false));
-				return;
-			}
-			case "daemon/drain": {
-				const drain = frame.payload;
-				this.state = "DRAINING";
-				this.deps.configApply.applyDaemonDrain(drain, (p) => this.emit("drain/progress", p)).then((done) => {
-					this.reply(frame, "drain/done", done);
-					if (this.state === "DRAINING") this.state = "READY";
-				}).catch((err) => {
-					this.sendError(frame.id, "INTERNAL", `drain failed: ${err.message}`, false);
-					if (this.state === "DRAINING") this.state = "READY";
-				});
-				return;
-			}
-			case "daemon/restart":
-				this.reply(frame, "daemon/control/ack", this.deps.configApply.applyDaemonRestart(frame.payload));
-				return;
-			case "daemon/upgrade":
-				this.reply(frame, "daemon/control/ack", this.deps.configApply.applyDaemonUpgrade(frame.payload));
-				return;
-			case "session/list":
-				try {
-					this.reply(frame, "session/list/page", this.deps.sessionRead.list(frame.payload));
-				} catch (err) {
-					this.sendError(frame.id, "INTERNAL", `session/list failed: ${err.message}`, false);
-				}
-				return;
-			case "session/history":
-				try {
-					this.reply(frame, "session/history/page", this.deps.sessionRead.history(frame.payload));
-				} catch (err) {
-					this.sendError(frame.id, "INTERNAL", `session/history failed: ${err.message}`, false);
-				}
-				return;
-			case "session/tool-body":
-				try {
-					this.reply(frame, "session/tool-body/chunk", this.deps.sessionRead.toolBody(frame.payload));
-				} catch (err) {
-					this.sendError(frame.id, "INTERNAL", `session/tool-body failed: ${err.message}`, false);
-				}
-				return;
-			case "workspace/list":
-				this.deps.workspaceRead.list(frame.payload).then((page) => this.reply(frame, "workspace/list/page", page)).catch((err) => this.workspaceError(frame.id, "workspace/list", err));
-				return;
-			case "workspace/read":
-				this.deps.workspaceRead.read(frame.payload).then((content) => this.reply(frame, "workspace/read/content", content)).catch((err) => this.workspaceError(frame.id, "workspace/read", err));
-				return;
-			case "workspace/gitstatus":
-				this.deps.workspaceGit.status(frame.payload.agentId).then((status) => this.reply(frame, "workspace/gitstatus/result", status)).catch((err) => this.workspaceError(frame.id, "workspace/gitstatus", err));
-				return;
-			case "workspace/gitpull":
-				this.deps.workspaceGit.pull(frame.payload.agentId).then((result) => this.reply(frame, "workspace/gitpull/result", result)).catch((err) => this.workspaceError(frame.id, "workspace/gitpull", err));
-				return;
-			case "memory/list":
-				this.deps.memoryReader.list(frame.payload).then((page) => this.reply(frame, "memory/list/page", page)).catch((err) => this.memoryError(frame.id, "memory/list", err));
-				return;
-			case "memory/read":
-				this.deps.memoryReader.read(frame.payload).then((content) => this.reply(frame, "memory/read/content", content)).catch((err) => this.memoryError(frame.id, "memory/read", err));
-				return;
-			case "memory/write":
-				this.deps.memoryReader.write(frame.payload).then((ok) => this.reply(frame, "memory/write/ok", ok)).catch((err) => this.memoryError(frame.id, "memory/write", err));
-				return;
-			case "webchat/message":
-				if (!this.deps.onWebchatMessage) {
-					this.sendError(frame.id, "INTERNAL", "webchat not supported", false);
-					return;
-				}
-				try {
-					this.reply(frame, "webchat/ack", this.deps.onWebchatMessage(frame.payload));
-				} catch (err) {
-					this.sendError(frame.id, "INTERNAL", `webchat/message failed: ${err.message}`, false);
-				}
-				return;
-			case "webchat/close":
-				this.deps.onWebchatClose?.(frame.payload);
-				return;
-			case "webchat/set-model":
-				this.deps.onWebchatSetModel?.(frame.payload);
-				return;
-			case "webchat/set-effort":
-				this.deps.onWebchatSetEffort?.(frame.payload);
-				return;
-			case "webchat/set-permission-mode":
-				this.deps.onWebchatSetPermissionMode?.(frame.payload);
-				return;
-			case "webchat/set-fast":
-				this.deps.onWebchatSetFast?.(frame.payload);
-				return;
-			case "webchat/cancel":
-				this.deps.onWebchatCancel?.(frame.payload);
-				return;
-			default:
-				this.deps.log.debug(`cp: ignoring ${frame.type}`);
-				return;
-		}
+	scheduleReconnect() {
+		if (this.stopped || this.fatal) return;
+		if (this.reconnectTimer !== void 0) return;
+		const delay = this.backoff.next();
+		this.reconnectTimer = this.deps.clock.setTimeout(() => {
+			this.reconnectTimer = void 0;
+			this.attemptConnect();
+		}, delay);
 	}
-	/** Map a workspace read failure onto the wire: containment/bad-request
-	*  violations → BAD_PAYLOAD (their messages are hand-written and path-free);
-	*  anything else → INTERNAL with a GENERIC message — raw fs errors (ELOOP,
-	*  EACCES, …) embed absolute host paths that must not leak to the CP/UI. */
-	workspaceError(corr, op, err) {
-		if (err instanceof WorkspaceViolationError) {
-			this.sendError(corr, "BAD_PAYLOAD", `${op} failed: ${err.message}`, false);
-			return;
-		}
-		this.deps.log.warn(`cp: ${op} failed: ${err?.message}`);
-		this.sendError(corr, "INTERNAL", `${op} failed`, false);
+};
+//#endregion
+//#region src/cp/relay-manager.ts
+var RelayManager = class {
+	deps;
+	clients = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
 	}
-	memoryError(corr, op, err) {
-		if (err instanceof MemoryConflictError) {
-			this.sendError(corr, "CONFLICT", `${op} failed: ${err.message}`, false);
-			return;
+	/**
+	* Converge to EXACTLY `roster`: stop clients for relays no longer present (or whose
+	* url moved), and start a dial loop for newly-listed relays. Idempotent — re-applying
+	* the same roster is a no-op.
+	*/
+	converge(roster) {
+		const desired = new Map(roster.map((r) => [r.relayId, r.url]));
+		for (const [relayId, client] of this.clients) if (desired.get(relayId) !== client.url) {
+			client.stop();
+			this.clients.delete(relayId);
 		}
-		if (err instanceof MemoryViolationError || err instanceof MemoryPathError || err instanceof MemoryTooLargeError) {
-			this.sendError(corr, "BAD_PAYLOAD", `${op} failed: ${err.message}`, false);
-			return;
+		for (const { relayId, url } of roster) {
+			if (this.clients.has(relayId)) continue;
+			const client = new RelayClient(relayId, url, this.deps);
+			this.clients.set(relayId, client);
+			client.start();
 		}
-		this.deps.log.warn(`cp: ${op} failed: ${err?.message}`);
-		this.sendError(corr, "INTERNAL", `${op} failed`, false);
 	}
-	reply(req, type, payload) {
-		this.transport?.send(encode(buildEnvelope(type, payload, { corr: req.id })));
+	/** Tear down every relay connection (daemon shutdown). */
+	async stop() {
+		await Promise.allSettled([...this.clients.values()].map((c) => c.stop()));
+		this.clients.clear();
 	}
-	/** Emit an uncorrelated EVT (e.g. `drain/progress`). */
-	emit(type, payload) {
-		this.transport?.send(encode(buildEnvelope(type, payload)));
+	/** Number of relays currently being dialed (observability / tests). */
+	size() {
+		return this.clients.size;
 	}
 };
 //#endregion
@@ -120776,20 +120995,6 @@ function mergeConfigPush(cfg, keys) {
 	};
 }
 //#endregion
-//#region src/cp/clock.ts
-var SystemClock = class {
-	now() {
-		return Date.now();
-	}
-	setTimeout(fn, ms) {
-		return globalThis.setTimeout(fn, ms);
-	}
-	clearTimeout(h) {
-		globalThis.clearTimeout(h);
-	}
-};
-const systemClock = new SystemClock();
-//#endregion
 //#region ../../node_modules/.pnpm/systeminformation@5.31.12/node_modules/systeminformation/package.json
 var require_package = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
@@ -136507,6 +136712,7 @@ var Daemon = class Daemon {
 	probing = false;
 	lastProbeAtMs = 0;
 	cpClient;
+	relays;
 	cpCrons;
 	channelSnapshots = /* @__PURE__ */ new Map();
 	cpAgents;
@@ -138608,6 +138814,7 @@ var Daemon = class Daemon {
 			applyReconcileSnapshot: (snap) => {
 				this.cpAgents?.converge(snap.agents);
 				this.cpIntegrations?.converge(snap.integrations);
+				this.relays?.converge(snap.relays);
 				for (const id of snap.drop.crons) this.cpCrons?.remove(id);
 				this.cpCrons?.converge(snap.crons);
 				this.cpRouting?.converge({
@@ -138635,6 +138842,7 @@ var Daemon = class Daemon {
 			runCron: (cronId) => this.runCronNow(cronId),
 			applyRouteAssign: (a) => this.cpRouting?.upsertAssign(a),
 			applyRouteUpdate: (u) => this.cpRouting?.applyUpdate(u),
+			applyRelayRoster: (relays) => this.relays?.converge(relays),
 			applyAgentLaunch: async (launch) => {
 				const agent = this.agents.get(launch.agentId);
 				if (!agent) throw new Error(`agent/launch: unknown agent ${launch.agentId}`);
@@ -138737,6 +138945,17 @@ var Daemon = class Daemon {
 		this.metrics.start();
 		const echoDaemonId = this.opts.overrides?.daemonId;
 		const url = cp.url;
+		const cpKey = cp.key;
+		this.relays = new RelayManager({
+			apiKey: () => cpKey,
+			daemonId: () => this.cfg.daemonId,
+			clock: systemClock,
+			connect: (relayUrl) => ClientTransport.dial(relayUrl, {
+				subprotocol: RELAY_DAEMON_SUBPROTOCOL,
+				path: RELAY_DAEMON_WS_PATH
+			}),
+			log: this.log
+		});
 		this.cpClient = new CpClient({
 			url,
 			token: cp.key,
@@ -138809,7 +139028,10 @@ var Daemon = class Daemon {
 			onWebchatSetFast: (m) => this.handleWebchatSetFast(m),
 			onWebchatCancel: (m) => this.handleWebchatCancel(m),
 			clock: systemClock,
-			connect: () => ClientTransport.dial(url),
+			connect: () => ClientTransport.dial(url, {
+				subprotocol: CP_SUBPROTOCOL,
+				path: CP_WS_PATH
+			}),
 			log: this.log
 		});
 		this.cpClient.start();
@@ -138897,6 +139119,7 @@ var Daemon = class Daemon {
 		const errors = [];
 		this.scheduler?.stop();
 		await Promise.resolve(this.cpClient?.stop()).catch((e) => errors.push(e));
+		await Promise.resolve(this.relays?.stop()).catch((e) => errors.push(e));
 		for (const c of this.connections) await Promise.resolve(c.stop()).catch((e) => errors.push(e));
 		for (const c of this.telegramConns) await Promise.resolve(c.stop()).catch((e) => errors.push(e));
 		for (const h of this.hosts.values()) await Promise.resolve(h.stop()).catch((e) => errors.push(e));
@@ -138932,6 +139155,6 @@ async function runForeground(opts, deps = {}) {
 	});
 }
 //#endregion
-export { ClientTransport as n, runForeground as t };
+export { ClientTransport as i, CP_SUBPROTOCOL as n, CP_WS_PATH as r, runForeground as t };
 
-//# sourceMappingURL=run-foreground-DrL_bDro.js.map
+//# sourceMappingURL=run-foreground-B5RyE_L1.js.map