@agentconnect.md/daemon 1.0.0-rc.240 → 1.0.0-rc.242

package/dist/{acp-host-M9PGQrVJ.js → acp-host-iKdfasdN.js}

@@ -2,8 +2,8 @@ import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-run
 import { t as require_src$1 } from "./src-DDtlVutj.js";
 import { T as NEVER, _ as record, a as array, b as unknown, c as discriminatedUnion, d as literal, l as int, m as object, n as _enum, o as boolean, p as number, u as intersection, v as string, x as url, y as union } from "./schemas-CQkO9hC5.js";
 import { c as registryPath, s as registryCachePath } from "./paths-DEcUO8lC.js";
-import { delimiter, dirname, join, normalize } from "node:path";
-import { accessSync, constants, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { delimiter, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import { accessSync, constants, existsSync, mkdirSync, promises, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { spawn } from "child_process";
 import { EventEmitter } from "node:events";
 import { execFile, spawn as spawn$1 } from "node:child_process";
@@ -172,6 +172,205 @@ async function resolveRuntimes(cfg, root, opts = {}) {
 	};
 }
 //#endregion
+//#region src/mcp/tools.ts
+const obj = (properties, required = []) => ({
+	type: "object",
+	properties,
+	required,
+	additionalProperties: false
+});
+/**
+* Tools injected when an agent has a Slack integration. `sendSlackMessage` is
+* the active-messaging tool from the design (token held by the daemon, invisible
+* to the model); the rest are channel/user read helpers.
+*/
+const SLACK_TOOLS = [
+	{
+		name: "sendSlackMessage",
+		description: "Send a message to a Slack channel. Omit `channel` to post in the channel this conversation is happening in. Omit `thread` to reply in the current thread; pass an empty string to post to the channel root instead.",
+		inputSchema: obj({
+			text: {
+				type: "string",
+				description: "Message body, in standard Markdown (CommonMark/GFM). Use `**bold**`, `~~strikethrough~~`, `# headings`, tables, etc. — Slack renders standard Markdown natively (do NOT use single-char Slack mrkdwn like `*bold*` or `~strike~`)."
+			},
+			channel: {
+				type: "string",
+				description: "Target channel ID (e.g. C0123ABC). Defaults to the current channel."
+			},
+			thread: {
+				type: "string",
+				description: "Thread timestamp to reply under. Defaults to the current thread; \"\" posts to the channel root."
+			}
+		}, ["text"])
+	},
+	{
+		name: "getCurrentChannel",
+		description: "Return the Slack channel (and thread) this conversation is bound to, including the channel name when available.",
+		inputSchema: obj({})
+	},
+	{
+		name: "listChannelMembers",
+		description: "List the users and bots in a channel (id, name, is_bot). Omit `channel` to list members of the current channel.",
+		inputSchema: obj({ channel: {
+			type: "string",
+			description: "Channel ID. Defaults to the current channel."
+		} })
+	},
+	{
+		name: "listChannels",
+		description: "List the public/private channels the bot is a member of and can post to.",
+		inputSchema: obj({})
+	},
+	{
+		name: "getUserProfile",
+		description: "Look up a Slack user or bot by id, returning their display name, real name, and bot flag.",
+		inputSchema: obj({ user: {
+			type: "string",
+			description: "User ID (e.g. U0123ABC)."
+		} }, ["user"])
+	},
+	{
+		name: "readSlackFile",
+		description: "Fetch the contents of a file shared in Slack, using the bot credentials. You do NOT have direct network access to Slack's private file URLs (they require the bot token) — use this tool instead of curl/fetch. Pass the file's `url` (the `url_private` / `uri` from a shared attachment or resource link). Images are returned as viewable image content; text files as text. Supply `mimeType` when known for correct handling.",
+		inputSchema: obj({
+			url: {
+				type: "string",
+				description: "The file's url_private (or url_private_download) / resource-link uri."
+			},
+			mimeType: {
+				type: "string",
+				description: "Optional MIME type hint, e.g. image/png or text/plain."
+			}
+		}, ["url"])
+	}
+];
+/**
+* Tools injected when an agent has a Telegram integration. Mirrors the Slack set
+* but for the Telegram data model: `channel` is a chat id (e.g. -1001234567890),
+* `thread` is a forum-topic `message_thread_id`, and there is no `listChannels`
+* (a bot cannot enumerate the chats it belongs to).
+*/
+const TELEGRAM_TOOLS = [
+	{
+		name: "sendTelegramMessage",
+		description: "Send a message to a Telegram chat. Omit `channel` to post in the chat this conversation is happening in. Omit `thread` to reply in the current forum topic; pass an empty string to post outside any topic.",
+		inputSchema: obj({
+			text: {
+				type: "string",
+				description: "Message body, in standard Markdown (CommonMark/GFM). Use `**bold**`, `*italic*`, `` `code` ``, `[links](url)`, lists, etc. — the daemon converts it to Telegram formatting and escapes special characters for you, so write plain Markdown (do NOT pre-escape with backslashes)."
+			},
+			channel: {
+				type: "string",
+				description: "Target chat id (e.g. -1001234567890, or a positive id for a private chat). Defaults to the current chat."
+			},
+			thread: {
+				type: "string",
+				description: "Forum-topic message_thread_id to reply under. Defaults to the current topic; \"\" posts outside any topic."
+			}
+		}, ["text"])
+	},
+	{
+		name: "getCurrentChannel",
+		description: "Return the Telegram chat (and forum topic) this conversation is bound to, including the chat title when available.",
+		inputSchema: obj({})
+	},
+	{
+		name: "listChannelMembers",
+		description: "List the users and bots in a chat (id, name, is_bot). Omit `channel` to list members of the current chat. Note: Telegram only exposes administrators for large groups.",
+		inputSchema: obj({ channel: {
+			type: "string",
+			description: "Chat id. Defaults to the current chat."
+		} })
+	},
+	{
+		name: "getUserProfile",
+		description: "Look up a Telegram user or bot by id, returning their display name, username, and bot flag.",
+		inputSchema: obj({ user: {
+			type: "string",
+			description: "Numeric user id (e.g. 12345678)."
+		} }, ["user"])
+	},
+	{
+		name: "readTelegramFile",
+		description: "Fetch the contents of a file shared in Telegram, using the bot credentials. You do NOT have direct network access to Telegram's file storage — use this tool instead of curl/fetch. Pass the file's `url` (the `file_id` from a shared attachment or the `uri` of a resource link). Images are returned as viewable image content; text files as text. Supply `mimeType` when known for correct handling.",
+		inputSchema: obj({
+			url: {
+				type: "string",
+				description: "The shared file's Telegram file_id (or resource-link uri)."
+			},
+			mimeType: {
+				type: "string",
+				description: "Optional MIME type hint, e.g. image/png or text/plain."
+			}
+		}, ["url"])
+	}
+];
+/**
+* The agent's long-term memory tools — available to EVERY agent regardless of
+* integrations. Memory is a directory (`<agent-root>/memory/`) with a `MEMORY.md`
+* index (injected into the prompt each session) plus `<topic>.md` files the agent
+* reads on demand. Keep the index short; move detail into topic files.
+*/
+const MEMORY_TOOLS = [
+	{
+		name: "listMemory",
+		description: "List your memory files — the MEMORY.md index plus any topic files you have written. Use this to discover what you have stored before reading or updating it.",
+		inputSchema: obj({})
+	},
+	{
+		name: "readMemory",
+		description: "Read one of your memory files. Omit `path` (or pass \"MEMORY.md\") to read the index; pass a topic file name (e.g. \"deploys.md\") to read that topic. The index is already shown to you at the start of each session — use this to pull the detail behind an index entry when it is relevant.",
+		inputSchema: obj({ path: {
+			type: "string",
+			description: "Memory file name (e.g. \"deploys.md\"). Defaults to the MEMORY.md index."
+		} })
+	},
+	{
+		name: "writeMemory",
+		description: "Save one of your memory files (whole-file overwrite). Omit `path` to write the MEMORY.md index; pass a topic file name (e.g. \"deploys.md\") for a topic. Keep the INDEX short — a scannable list that links to topic files (e.g. \"- [deploys](deploys.md) — how we ship\"); put the actual detail in the topic files. Use for durable facts across sessions: conventions, decisions, who to ask, things you had to re-learn. A flat directory — no subfolders in the path.",
+		inputSchema: obj({
+			path: {
+				type: "string",
+				description: "Memory file name (e.g. \"deploys.md\"). Defaults to the MEMORY.md index. No subdirectories."
+			},
+			content: {
+				type: "string",
+				description: "The full new file contents, in Markdown. Replaces the file."
+			}
+		}, ["content"])
+	}
+];
+/** The memory tool names — used to strip them for a `native`-memory agent (which
+*  uses the runtime's own memory instead). */
+const MEMORY_TOOL_NAMES = new Set(MEMORY_TOOLS.map((t) => t.name));
+[...new Set([
+	...SLACK_TOOLS,
+	...TELEGRAM_TOOLS,
+	...MEMORY_TOOLS
+].map((t) => t.name))];
+/**
+* The default MCP tool set for an agent. The memory tools are always present
+* (every agent has memory); the platform tools are gated by the agent's
+* integrations. Deduped by name so an agent bridging both platforms doesn't get
+* the shared read helpers (getCurrentChannel/listChannelMembers/getUserProfile)
+* twice — the first platform's variant wins, and both behave identically.
+*/
+function toolsForIntegrations(integrations) {
+	const tools = [];
+	const seen = /* @__PURE__ */ new Set();
+	const add = (set) => {
+		for (const t of set) {
+			if (seen.has(t.name)) continue;
+			seen.add(t.name);
+			tools.push(t);
+		}
+	};
+	add(MEMORY_TOOLS);
+	if (integrations.some((i) => i.platform === "slack")) add(SLACK_TOOLS);
+	if (integrations.some((i) => i.platform === "telegram")) add(TELEGRAM_TOOLS);
+	return tools;
+}
+//#endregion
 //#region ../protocol/dist/envelope.js
 /**
 * The protocol envelope — every frame, both directions, is wrapped in this.
@@ -468,6 +667,11 @@ const AgentSpec = object({
 	pause: boolean().optional(),
 	workspace: AgentWorkspace.optional(),
 	env: record(string(), string()).optional(),
+	memory: object({ provider: _enum([
+		"native",
+		"managed",
+		"external"
+	]) }).optional(),
 	mcpServers: array(string()).default([])
 });
 const AgentLaunch = object({
@@ -1722,6 +1926,492 @@ function isFrame(type) {
 	return (frame) => frame.type === type;
 }
 //#endregion
+//#region src/agents/memory.ts
+/**
+* Agent memory — a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE
+* the workspace so it survives a workspace reset / re-clone and is never committed
+* into a github-workspace repo.
+*
+* Index-plus-topics shape (the structure Claude Code's auto-memory uses): a lean
+* `MEMORY.md` index — injected into the prompt every session, so it must stay small
+* — plus any number of `<topic>.md` files the agent reads on demand. The agent
+* maintains it via the `readMemory` / `writeMemory` / `listMemory` MCP tools; the
+* daemon serves the same directory to the CP for the console.
+*
+* SECURITY: topic paths are agent/console-supplied, so every path is contained to
+* the memory dir — absolute paths and `..` escapes are rejected, and the resolved
+* path is re-checked so a symlink can't smuggle a target out. Flat by design (one
+* level): a topic is a file directly under `memory/`, no nested dirs.
+*/
+const MEMORY_DIRNAME = "memory";
+/** Max bytes of the index injected into the prompt each session — keeps a large
+*  memory from swelling the context (mirrors Claude Code's 25 KB entrypoint cap). */
+const MAX_INDEX_INJECT_BYTES = 25e3;
+/** Hard cap on a single memory file. Injected/read every session, so an unbounded
+*  file would swell the prompt and the wire; writes over this are rejected. */
+const MAX_MEMORY_FILE_BYTES = 256e3;
+/** Raised when a memory path escapes the memory dir. Surfaces as `BAD_PAYLOAD`. */
+var MemoryPathError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryPathError";
+	}
+};
+/** Raised when a write exceeds {@link MAX_MEMORY_FILE_BYTES}. `BAD_PAYLOAD`. */
+var MemoryTooLargeError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryTooLargeError";
+	}
+};
+/** Raised when an `ifMatchMtime` precondition fails (the file changed under the
+*  writer — e.g. a console edit racing a newer agent write). Surfaces as CONFLICT. */
+var MemoryConflictError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryConflictError";
+	}
+};
+/** The memory directory for an agent, given its root dir (where agent.json lives). */
+function memoryDir(agentDir) {
+	return join(agentDir, MEMORY_DIRNAME);
+}
+/** Resolve a memory-dir-relative path to an absolute one, contained to the dir.
+*  Rejects absolute paths, `..` escapes, and any nested directory (flat only). */
+function resolveInMemoryDir(agentDir, relPath) {
+	if (isAbsolute(relPath)) throw new MemoryPathError("absolute paths are not allowed");
+	const dir = memoryDir(agentDir);
+	const abs = resolve(dir, relPath);
+	if (abs !== dir && !abs.startsWith(dir + sep)) throw new MemoryPathError("path escapes the memory dir");
+	const rel = abs.slice(dir.length + 1);
+	if (rel.includes(sep)) throw new MemoryPathError("memory is a flat directory (no subdirectories)");
+	if (rel.length === 0) throw new MemoryPathError("a file name is required");
+	return abs;
+}
+/** Seed `<agent-root>/memory/MEMORY.md` with a header if the dir/index is absent
+*  (idempotent). Called at session start so a brand-new agent always has an index. */
+function ensureMemory(agentDir, agentName) {
+	const dir = memoryDir(agentDir);
+	mkdirSync(dir, { recursive: true });
+	const index = join(dir, MEMORY_INDEX);
+	if (!existsSync(index)) writeFileSync(index, `# ${agentName} memory\n\nYour long-term memory index. Keep it short — link out to topic files (e.g. \`[deploys](deploys.md)\`) for detail and read them on demand with the readMemory tool.\n`);
+}
+/** Read the memory index (`MEMORY.md`) for prompt injection, trimmed to the inject
+*  cap so a large index can't blow up the prompt; '' when absent. */
+async function readIndex(agentDir) {
+	const text = await readMemoryFile(agentDir, MEMORY_INDEX);
+	if (Buffer.byteLength(text) <= 25e3) return text;
+	return Buffer.from(text, "utf8").subarray(0, MAX_INDEX_INJECT_BYTES).toString("utf8") + "\n\n[…memory index truncated — trim MEMORY.md]";
+}
+/** Read a memory file's text; '' when it does not exist (never throws on ENOENT). */
+async function readMemoryFile(agentDir, relPath) {
+	const abs = resolveInMemoryDir(agentDir, relPath);
+	try {
+		return await promises.readFile(abs, "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return "";
+		throw err;
+	}
+}
+/** Overwrite a memory file with `content` (creating the dir if needed). Atomic
+*  (tmp + rename) so a concurrent read never sees a partial file.
+*
+*  - Rejects content over {@link MAX_MEMORY_FILE_BYTES} ({@link MemoryTooLargeError}).
+*  - `ifMatchMtime` (optimistic concurrency): when given, the current file's mtime
+*    must equal it, else {@link MemoryConflictError} — so a console edit can't
+*    clobber a newer write. A brand-new file (no mtime) matches `ifMatchMtime`
+*    only when the caller passes none (or the empty string). */
+async function writeMemoryFile(agentDir, relPath, content, ifMatchMtime) {
+	if (Buffer.byteLength(content) > 256e3) throw new MemoryTooLargeError(`memory file exceeds the ${MAX_MEMORY_FILE_BYTES}-byte limit`);
+	const abs = resolveInMemoryDir(agentDir, relPath);
+	if (ifMatchMtime) {
+		let current = null;
+		try {
+			current = (await promises.stat(abs)).mtime.toISOString();
+		} catch (err) {
+			if (err.code !== "ENOENT") throw err;
+		}
+		if (current !== ifMatchMtime) throw new MemoryConflictError("the memory file changed since it was read; reload and retry");
+	}
+	await promises.mkdir(memoryDir(agentDir), { recursive: true });
+	const tmp = `${abs}.tmp`;
+	await promises.writeFile(tmp, content, "utf8");
+	await promises.rename(tmp, abs);
+	const st = await promises.stat(abs);
+	return {
+		size: st.size,
+		mtime: st.mtime.toISOString()
+	};
+}
+/** List the files in the memory dir (flat; index + topics), sorted with the index
+*  first. Empty when the dir does not exist. `.tmp` write artifacts are skipped. */
+async function listMemory(agentDir) {
+	const dir = memoryDir(agentDir);
+	let dirents;
+	try {
+		dirents = await promises.readdir(dir, { withFileTypes: true });
+	} catch (err) {
+		if (err.code === "ENOENT") return [];
+		throw err;
+	}
+	const files = [];
+	for (const d of dirents) {
+		if (!d.isFile() || d.name.endsWith(".tmp")) continue;
+		try {
+			const st = await promises.stat(join(dir, d.name));
+			files.push({
+				name: d.name,
+				size: st.size,
+				mtime: st.mtime.toISOString()
+			});
+		} catch {}
+	}
+	files.sort((a, b) => a.name === "MEMORY.md" ? -1 : b.name === "MEMORY.md" ? 1 : a.name.localeCompare(b.name));
+	return files;
+}
+//#endregion
+//#region src/agents/native-memory.ts
+/**
+* Native-memory runtime levers + file surfacing.
+*
+* The `native` MemoryProvider (agents/memory-provider.ts) redirects the runtime's
+* OWN memory under the agent root — so each agent's native memory is isolated
+* instead of sharing the host's `~/.claude` / `~/.codex`. Two responsibilities:
+*
+*  1. `nativeRuntimeEnv` — the env delta that redirects (and, where needed, enables)
+*     the runtime's memory. This is an EXPLICIT per-runtime registry: we only set
+*     env for runtimes whose levers we've verified against their docs. A runtime not
+*     in the registry is `isNativeRuntimeSupported === false`, and selecting native
+*     for it fails loudly upstream — we never guess env for an unverified runtime.
+*
+*  2. `nativeMemoryList/Read/Write` — surface the runtime's memory files to the
+*     console from wherever the redirect points. Unlike managed's flat
+*     `<agent-root>/memory/`, the runtime dirs are nested (Claude keys memory by a
+*     sanitized-cwd subpath), so this uses a nested-but-contained walk.
+*
+* Levers verified 2026-07-08 (claude docs + binary strings; codex docs; and the
+* daemon's own `runtimes/probe.ts` home-override table):
+*  - claude → `CLAUDE_CONFIG_DIR=<root>/.claude`; auto-memory lands at
+*    `<root>/.claude/projects/<sanitized-cwd>/memory/`. Do NOT set the disable flag.
+*  - codex  → `CODEX_HOME=<root>/.codex`; memories at `<root>/.codex/memories/`.
+*/
+function cmdIncludes(runtime, needle) {
+	return [runtime.command, ...runtime.args].join(" ").toLowerCase().includes(needle);
+}
+/**
+* The explicit registry. ADD a runtime here only after verifying its env levers
+* against the tool's own docs (and, ideally, the installed binary) — mirroring the
+* home-override table the daemon already keeps in `runtimes/probe.ts`. An absent
+* runtime is intentionally unsupported for native memory.
+*/
+const NATIVE_RUNTIMES = [{
+	matches: (rt) => cmdIncludes(rt, "claude"),
+	env: (root) => ({ CLAUDE_CONFIG_DIR: join(root, ".claude") }),
+	readRoot: (root) => join(root, ".claude", "projects")
+}, {
+	matches: (rt) => cmdIncludes(rt, "codex"),
+	env: (root) => ({ CODEX_HOME: join(root, ".codex") }),
+	readRoot: (root) => join(root, ".codex", "memories")
+}];
+function specFor(runtime) {
+	if (!runtime) return void 0;
+	return NATIVE_RUNTIMES.find((s) => s.matches(runtime));
+}
+/** Whether native memory is supported (env levers registered) for this runtime. */
+function isNativeRuntimeSupported(runtime) {
+	return specFor(runtime) !== void 0;
+}
+/** The env delta redirecting the runtime's own memory under `agentRoot`. Empty for
+*  an unregistered runtime (callers should gate on `isNativeRuntimeSupported`). */
+function nativeRuntimeEnv(runtime, agentRoot) {
+	return specFor(runtime)?.env(agentRoot) ?? {};
+}
+/** Resolve a console-supplied relative path under `root`, allowing nested dirs but
+*  rejecting absolute paths, `..` escapes, and symlink-smuggled escapes. Unlike the
+*  managed dir (flat), native runtime dirs are nested. */
+function resolveContained(root, relPath) {
+	if (isAbsolute(relPath)) throw new MemoryPathError("absolute paths are not allowed");
+	const abs = resolve(root, relPath);
+	if (abs !== root && !abs.startsWith(root + sep)) throw new MemoryPathError("path escapes the memory dir");
+	if (abs === root) throw new MemoryPathError("a file name is required");
+	return abs;
+}
+/** Recursively list files under `dir` (relative names, posix-ish with `sep`), sorted.
+*  Empty when the dir is absent. Skips `.tmp` artifacts. */
+async function listUnder(dir) {
+	const out = [];
+	async function walk(cur) {
+		let dirents;
+		try {
+			dirents = await promises.readdir(cur, { withFileTypes: true });
+		} catch (err) {
+			if (err.code === "ENOENT") return;
+			throw err;
+		}
+		for (const d of dirents) {
+			const p = join(cur, d.name);
+			if (d.isDirectory()) await walk(p);
+			else if (d.isFile() && !d.name.endsWith(".tmp")) try {
+				const st = await promises.stat(p);
+				out.push({
+					name: relative(dir, p),
+					size: st.size,
+					mtime: st.mtime.toISOString()
+				});
+			} catch {}
+		}
+	}
+	await walk(dir);
+	out.sort((a, b) => a.name.localeCompare(b.name));
+	return out;
+}
+/** List the runtime's native memory files under the agent root. */
+async function nativeMemoryList(agentDir, runtime) {
+	const spec = specFor(runtime);
+	if (!spec) return [];
+	return listUnder(spec.readRoot(agentDir));
+}
+/** Read one native memory file (relative to the runtime's read root); '' when absent. */
+async function nativeMemoryRead(agentDir, runtime, path) {
+	const spec = specFor(runtime);
+	if (!spec) return {
+		path,
+		content: ""
+	};
+	const abs = resolveContained(spec.readRoot(agentDir), path);
+	try {
+		return {
+			path,
+			content: await promises.readFile(abs, "utf8")
+		};
+	} catch (err) {
+		if (err.code === "ENOENT") return {
+			path,
+			content: ""
+		};
+		throw err;
+	}
+}
+/** Overwrite one native memory file (console edit). Atomic tmp+rename; size-capped. */
+async function nativeMemoryWrite(agentDir, runtime, path, content, _ifMatch) {
+	const spec = specFor(runtime);
+	if (!spec) throw new MemoryPathError("native memory is not supported for this runtime");
+	if (Buffer.byteLength(content) > 256e3) throw new MemoryTooLargeError(`memory file exceeds the ${MAX_MEMORY_FILE_BYTES}-byte limit`);
+	const abs = resolveContained(spec.readRoot(agentDir), path);
+	const dir = abs.slice(0, abs.length - (abs.split(sep).pop()?.length ?? 0));
+	await promises.mkdir(dir, { recursive: true });
+	const tmp = `${abs}.tmp`;
+	await promises.writeFile(tmp, content, "utf8");
+	await promises.rename(tmp, abs);
+	const st = await promises.stat(abs);
+	return {
+		ok: true,
+		path,
+		size: st.size,
+		mtime: st.mtime.toISOString()
+	};
+}
+//#endregion
+//#region src/agents/memory-provider.ts
+/** Thrown when a provider can't be built for an agent (e.g. `external` not yet
+*  implemented, or `native` on a runtime whose memory env levers aren't registered). */
+var MemoryProviderUnavailableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MemoryProviderUnavailableError";
+	}
+};
+/**
+* `managed` memory: our `<agent-root>/memory/` directory. A thin facade over
+* `agents/memory.ts` — every method delegates to the existing primitive and lets
+* its error classes (`MemoryPathError` / `MemoryTooLargeError` /
+* `MemoryConflictError`) propagate raw, so the MCP + CP error mappings are unchanged.
+*/
+var ManagedMemoryProvider = class {
+	agentDirByAgent;
+	kind = "managed";
+	/** `agentDirByAgent` resolves an agent id → its root dir (which holds `memory/`),
+	*  or undefined for an unknown agent. */
+	constructor(agentDirByAgent) {
+		this.agentDirByAgent = agentDirByAgent;
+	}
+	dirFor(agentId) {
+		const dir = this.agentDirByAgent(agentId);
+		if (!dir) throw new Error(`unknown agent ${agentId}`);
+		return dir;
+	}
+	runtimeEnv(runtime) {
+		if (isClaudeRuntime(runtime)) return { CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" };
+		return {};
+	}
+	ensure(scope, agentName) {
+		ensureMemory(this.dirFor(scope.agentId), agentName);
+	}
+	async injectAtSessionStart(scope) {
+		return readIndex(this.dirFor(scope.agentId));
+	}
+	async recordTurn(_scope, _turn) {}
+	tools() {
+		return MEMORY_TOOLS;
+	}
+	async list(scope) {
+		return listMemory(this.dirFor(scope.agentId));
+	}
+	async read(scope, path) {
+		return {
+			path,
+			content: await readMemoryFile(this.dirFor(scope.agentId), path)
+		};
+	}
+	async write(scope, path, content, ifMatch) {
+		const { size, mtime } = await writeMemoryFile(this.dirFor(scope.agentId), path, content, ifMatch);
+		return {
+			ok: true,
+			path,
+			size,
+			mtime
+		};
+	}
+};
+/**
+* `native` memory: the runtime's OWN memory (Claude auto-memory / Codex memories),
+* redirected under the agent root via `runtimeEnv` for per-agent isolation. The
+* runtime writes and loads it itself, so we do NOT seed, inject, or expose tools —
+* doing so would create a second store the runtime never reads. `list`/`read`/`write`
+* surface the runtime's memory files for the console (see native-memory.ts).
+*
+* The per-runtime env levers are an explicit registry (native-memory.ts). An agent
+* selecting `native` on a runtime whose levers aren't registered fails loudly at
+* construction rather than silently mis-setting env — we don't guess env for a
+* runtime we haven't verified.
+*/
+var NativeMemoryProvider = class {
+	agentDirByAgent;
+	runtimeFor;
+	kind = "native";
+	constructor(agentDirByAgent, runtimeFor) {
+		this.agentDirByAgent = agentDirByAgent;
+		this.runtimeFor = runtimeFor;
+	}
+	dirFor(agentId) {
+		const dir = this.agentDirByAgent(agentId);
+		if (!dir) throw new Error(`unknown agent ${agentId}`);
+		return dir;
+	}
+	runtimeEnv(_runtime) {
+		throw new Error("NativeMemoryProvider.runtimeEnv must not be called — use memoryProviderFor at spawn");
+	}
+	ensure() {}
+	async injectAtSessionStart() {
+		return "";
+	}
+	async recordTurn() {}
+	tools() {
+		return [];
+	}
+	async list(scope) {
+		return nativeMemoryList(this.dirFor(scope.agentId), this.runtimeFor(scope.agentId));
+	}
+	async read(scope, path) {
+		return nativeMemoryRead(this.dirFor(scope.agentId), this.runtimeFor(scope.agentId), path);
+	}
+	async write(scope, path, content, ifMatch) {
+		return nativeMemoryWrite(this.dirFor(scope.agentId), this.runtimeFor(scope.agentId), path, content, ifMatch);
+	}
+};
+/** A claude runtime — its command/args reference `claude` (mirrors AcpHost.isClaudeRuntime). */
+function isClaudeRuntime(runtime) {
+	return [runtime.command, ...runtime.args].join(" ").toLowerCase().includes("claude");
+}
+/**
+* `DispatchingMemoryProvider` — the daemon's single `MemoryProvider`. Routes every
+* scope-bearing call to the agent's configured concrete provider (managed | native),
+* built lazily and cached (both are stateless facades over the resolvers). `external`
+* throws `MemoryProviderUnavailableError` when first needed.
+*
+* `runtimeEnv` is NOT the dispatch path (it has no scope); it throws here to make the
+* misuse obvious — the spawn path uses `memoryProviderFor` directly.
+*/
+var DispatchingMemoryProvider = class {
+	agentDirByAgent;
+	runtimeFor;
+	providerKindFor;
+	kind = "managed";
+	managed;
+	native;
+	constructor(agentDirByAgent, runtimeFor, providerKindFor) {
+		this.agentDirByAgent = agentDirByAgent;
+		this.runtimeFor = runtimeFor;
+		this.providerKindFor = providerKindFor;
+		this.managed = new ManagedMemoryProvider(agentDirByAgent);
+		this.native = new NativeMemoryProvider(agentDirByAgent, runtimeFor);
+	}
+	forAgent(agentId) {
+		const kind = this.providerKindFor(agentId);
+		if (kind === "managed") return this.managed;
+		if (kind === "native") return this.native;
+		throw new MemoryProviderUnavailableError(`memory provider "${kind}" is not yet implemented`);
+	}
+	runtimeEnv(_runtime) {
+		throw new Error("DispatchingMemoryProvider.runtimeEnv must not be called — use memoryProviderFor at spawn");
+	}
+	ensure(scope, agentName) {
+		this.forAgent(scope.agentId).ensure(scope, agentName);
+	}
+	injectAtSessionStart(scope) {
+		return this.forAgent(scope.agentId).injectAtSessionStart(scope);
+	}
+	recordTurn(scope, turn) {
+		return this.forAgent(scope.agentId).recordTurn(scope, turn);
+	}
+	list(scope) {
+		return this.forAgent(scope.agentId).list(scope);
+	}
+	read(scope, path) {
+		return this.forAgent(scope.agentId).read(scope, path);
+	}
+	write(scope, path, content, ifMatch) {
+		return this.forAgent(scope.agentId).write(scope, path, content, ifMatch);
+	}
+	/** The memory tools to inject for a specific agent (the daemon calls this in
+	*  `mcpServersFor` — native contributes none). Scope-carrying, unlike the
+	*  interface's scopeless `tools()`. */
+	toolsForAgent(agentId) {
+		return this.forAgent(agentId).tools();
+	}
+	/** Interface `tools()` has no scope; the daemon uses `toolsForAgent`. Return the
+	*  managed set as a safe default (never the live injection path). */
+	tools() {
+		return MEMORY_TOOLS;
+	}
+};
+/** The daemon-side memory provider kind for an agent (absent ⇒ managed default). */
+function memoryKindOf(agent) {
+	return agent.memory?.provider ?? "managed";
+}
+/**
+* Build the concrete provider for ONE agent — used at spawn (`daemon.ts` / `chat.ts`)
+* to source `runtimeEnv`, and validated eagerly so a misconfigured agent (external,
+* or native on an unregistered runtime) fails loudly with the agent's root bound.
+* Throws `MemoryProviderUnavailableError` on an unbuildable provider.
+*/
+function memoryProviderFor(agent, runtime) {
+	const kind = memoryKindOf(agent);
+	if (kind === "managed") {
+		const p = new ManagedMemoryProvider(() => agent.dir);
+		return { runtimeEnv: () => p.runtimeEnv(runtime) };
+	}
+	if (kind === "native") {
+		if (!isNativeRuntimeSupported(runtime)) throw new MemoryProviderUnavailableError(`native memory is not supported for this runtime (env levers unverified): ${runtime.command}`);
+		return { runtimeEnv: () => nativeRuntimeEnv(runtime, agent.dir) };
+	}
+	throw new MemoryProviderUnavailableError(`memory provider "${kind}" is not yet implemented`);
+}
+/** Build the daemon's dispatching memory provider over the agent resolvers. */
+function createMemoryProvider(agentDirByAgent, runtimeFor, providerKindFor) {
+	return new DispatchingMemoryProvider(agentDirByAgent, runtimeFor, providerKindFor);
+}
+//#endregion
 //#region ../../node_modules/.pnpm/@kwsites+file-exists@1.1.1/node_modules/@kwsites/file-exists/dist/src/index.js
 var require_src = /* @__PURE__ */ __commonJSMin(((exports) => {
 	var __importDefault = exports && exports.__importDefault || function(mod) {
@@ -10409,13 +11099,15 @@ const ULTRACODE_EFFORT = "ultracode";
 *    or with workflows unavailable the runtime reports `applied.ultracode=false` and
 *    the session still runs on its default effort — nothing to fail on our side.
 *  - `systemPrompt` (top-level, sibling of `claudeCode`): the agent's system-prompt
-*    seed. We send it as `{ append }` so it layers ON TOP of claude-acp's
-*    `claude_code` preset (keeping the coding scaffolding) rather than replacing it.
-*    Honored by claude-agent-acp #91; older runtimes ignore the unknown `_meta` key.
-*    This is the only channel for the system prompt — ACP session/new has no such
-*    field, and other runtimes have no equivalent yet (see cp-overlay.ts). */
-function claudeSessionMeta(reasoningEffort, isClaudeRuntime, systemPrompt) {
+*    seed PLUS, on a fresh session, the agent's memory index (standing context, not a
+*    user turn — see SessionManager). We send it as `{ append }` so it layers ON TOP
+*    of claude-acp's `claude_code` preset (keeping the coding scaffolding) rather than
+*    replacing it. Honored by claude-agent-acp #91; older runtimes ignore the unknown
+*    `_meta` key. This is the only channel for the system prompt — ACP session/new has
+*    no such field, and other runtimes have no equivalent yet (see cp-overlay.ts). */
+function claudeSessionMeta(reasoningEffort, isClaudeRuntime, systemPrompt, memoryAppend) {
 	if (!isClaudeRuntime) return void 0;
+	const append = [systemPrompt, memoryAppend].filter(Boolean).join("\n\n");
 	return {
 		claudeCode: { options: {
 			thinking: {
@@ -10427,7 +11119,7 @@ function claudeSessionMeta(reasoningEffort, isClaudeRuntime, systemPrompt) {
 				enableWorkflows: true
 			} } : {}
 		} },
-		...systemPrompt ? { systemPrompt: { append: systemPrompt } } : {}
+		...append ? { systemPrompt: { append } } : {}
 	};
 }
 /**
@@ -10531,7 +11223,6 @@ var AcpHost = class {
 				this.opts.log?.info(`acp: CLAUDE_CODE_EXECUTABLE not set — using claude on PATH (${claude})`);
 			}
 		}
-		if (this.isClaudeRuntime() && env.CLAUDE_CODE_DISABLE_AUTO_MEMORY === void 0) env.CLAUDE_CODE_DISABLE_AUTO_MEMORY = "1";
 		const child = spawn$1(resolveCommandPath(this.runtime.command, env) ?? this.runtime.command, this.runtime.args, {
 			stdio: [
 				"pipe",
@@ -10587,12 +11278,21 @@ var AcpHost = class {
 		if (!seed || this.isClaudeRuntime()) return void 0;
 		return seed;
 	}
+	/** Whether this runtime carries the system prompt (and the fresh-session memory
+	*  index) via `_meta.systemPrompt` — true for Claude, which gets them there rather
+	*  than as a leading inline block. Lets SessionManager route memory correctly:
+	*  Claude → `_meta` (via newSession's memoryAppend); others → an inline block. */
+	usesMetaSystemPrompt() {
+		return this.isClaudeRuntime();
+	}
 	/** Create a fresh ACP session. `effortOverride` (the sticky per-session effort choice,
 	*  when set) takes the place of the agent default in the Claude `_meta` — the only
 	*  channel `ultracode` can ride (the `thought_level` select rejects it); select-based
-	*  effort/model/fast overrides are layered on afterward by the daemon at turn start. */
-	async newSession(cwd, mcpServers = [], effortOverride) {
-		const _meta = claudeSessionMeta(effortOverride ?? this.opts.configPrefs?.reasoningEffort, this.isClaudeRuntime(), this.opts.configPrefs?.systemPrompt);
+	*  effort/model/fast overrides are layered on afterward by the daemon at turn start.
+	*  `memoryAppend` (the agent's memory index for a FRESH session) rides the same Claude
+	*  `_meta.systemPrompt` append — standing context, never a user turn (see #398). */
+	async newSession(cwd, mcpServers = [], effortOverride, memoryAppend) {
+		const _meta = claudeSessionMeta(effortOverride ?? this.opts.configPrefs?.reasoningEffort, this.isClaudeRuntime(), this.opts.configPrefs?.systemPrompt, memoryAppend);
 		const res = await this.conn.agent.request(methods.agent.session.new, {
 			cwd,
 			mcpServers,
@@ -10804,6 +11504,6 @@ var AcpHost = class {
 	}
 };
 //#endregion
-export { resolveRuntimes as C, cachedRuntimeVersions as S, encode as _, initGitInjection as a, RESERVED_MCP_SERVER_NAME as b, simpleGit as c, RELAY_DAEMON_SUBPROTOCOL as d, RELAY_DAEMON_WS_PATH as f, decodeEnvelope as g, buildEnvelope as h, prepareWorkspace as i, isFrame as l, decodeRelayDaemonFrame as m, installedRuntimes as n, probeGitVersion as o, buildRelayDaemonFrame as p, prefetchWorkspace as r, sessionGitEnv as s, AcpHost as t, normalizeGitUrl as u, MAX_FRAME_BYTES as v, cachedRuntimeNames as x, MEMORY_INDEX as y };
+export { toolsForIntegrations as A, decodeRelayDaemonFrame as C, MAX_FRAME_BYTES as D, encode as E, cachedRuntimeVersions as M, resolveRuntimes as N, RESERVED_MCP_SERVER_NAME as O, buildRelayDaemonFrame as S, decodeEnvelope as T, writeMemoryFile as _, initGitInjection as a, RELAY_DAEMON_SUBPROTOCOL as b, simpleGit as c, memoryProviderFor as d, MemoryConflictError as f, resolveInMemoryDir as g, listMemory as h, prepareWorkspace as i, cachedRuntimeNames as j, MEMORY_TOOL_NAMES as k, createMemoryProvider as l, MemoryTooLargeError as m, installedRuntimes as n, probeGitVersion as o, MemoryPathError as p, prefetchWorkspace as r, sessionGitEnv as s, AcpHost as t, memoryKindOf as u, isFrame as v, buildEnvelope as w, RELAY_DAEMON_WS_PATH as x, normalizeGitUrl as y };
 
-//# sourceMappingURL=acp-host-M9PGQrVJ.js.map
+//# sourceMappingURL=acp-host-iKdfasdN.js.map