@agentconnect.md/daemon 1.0.0-rc.245 → 1.0.0-rc.247

package/dist/{acp-host-iKdfasdN.js → acp-host-CUct-2CR.js}

@@ -1,6 +1,7 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CE-6LUnI.js";
 import { t as require_src$1 } from "./src-DDtlVutj.js";
-import { T as NEVER, _ as record, a as array, b as unknown, c as discriminatedUnion, d as literal, l as int, m as object, n as _enum, o as boolean, p as number, u as intersection, v as string, x as url, y as union } from "./schemas-CQkO9hC5.js";
+import { T as NEVER, _ as record, a as array, b as unknown, d as literal, l as int, m as object, o as boolean, p as number, u as intersection, v as string, x as url, y as union } from "./schemas-CQkO9hC5.js";
+import { b as MEMORY_INDEX, d as normalizeGitUrl } from "./load-agents-NvLpcg5H.js";
 import { c as registryPath, s as registryCachePath } from "./paths-DEcUO8lC.js";
 import { delimiter, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { accessSync, constants, existsSync, mkdirSync, promises, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -8,7 +9,6 @@ import { spawn } from "child_process";
 import { EventEmitter } from "node:events";
 import { execFile, spawn as spawn$1 } from "node:child_process";
 import { homedir } from "node:os";
-import { randomUUID } from "node:crypto";
 import { Readable, Writable } from "node:stream";
 //#region src/runtimes/registry.ts
 const PackageDistSchema = object({
@@ -371,1561 +371,6 @@ function toolsForIntegrations(integrations) {
 	return tools;
 }
 //#endregion
-//#region ../protocol/dist/envelope.js
-/**
-* The protocol envelope — every frame, both directions, is wrapped in this.
-* Mirrors daemon-cp-ws-protocol.md §1.1.
-*
-* `payload` is left as `unknown` here and validated by the per-type schema in
-* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
-* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
-* instead of a hard close — forward-compat, protocol §1.
-*/
-const Envelope = object({
-	v: literal(1),
-	id: string().uuid(),
-	ts: string().datetime(),
-	type: string(),
-	corr: string().uuid().optional(),
-	payload: unknown()
-});
-object({
-	epoch: number().int(),
-	agentId: string().uuid().optional(),
-	launchId: string().uuid().optional()
-});
-/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
-const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-/**
-* Builds the envelope schema for one frame `type` — the `type` literal plus the
-* typed payload — so a wire's discriminated union infers `payload` precisely.
-* Shared by the daemon↔CP union (`frame.ts`) and the relay wire unions
-* (`frames/relay-cp.ts` / `frames/relay-daemon.ts`), which are deliberately
-* SEPARATE unions over the same envelope shape (shared-bot-relay.md §8).
-*/
-function frameSchema(type, payload) {
-	return object({
-		v: literal(1),
-		id: string().uuid(),
-		ts: string().datetime(),
-		type: literal(type),
-		corr: string().uuid().optional(),
-		payload
-	});
-}
-//#endregion
-//#region ../protocol/dist/frames/auth.js
-/**
-* Auth & identity — protocol §3.1 / §3.2.
-*
-* `auth` is the first frame after the socket opens. `auth/ok` carries the
-* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
-* resume verdict.
-*/
-const AuthReq = object({
-	apiKey: string(),
-	daemonId: string().uuid().optional(),
-	machineId: string().uuid().optional(),
-	attestation: string().optional(),
-	agentVersion: string(),
-	resume: object({ lastEpoch: number().int() }).optional()
-});
-const AuthOk = object({
-	daemonId: string().uuid(),
-	sessionEpoch: number().int(),
-	heartbeatSec: number().int(),
-	serverTime: string().datetime(),
-	webAppUrl: string().optional(),
-	orgSlug: string().optional(),
-	resume: object({ accepted: boolean() }).optional()
-});
-//#endregion
-//#region ../protocol/dist/frames/route.js
-/**
-* Routing & orchestration (C→D control) — protocol §5.
-*
-* `SessionKey` is the canonical session primitive shared across route/*,
-* agent/*, and event/session. Its canonical string form is
-* `${platform}:${channel}:${thread ?? "-"}`.
-*/
-const Platform = _enum([
-	"slack",
-	"telegram",
-	"webchat",
-	"discord"
-]);
-const SessionKey = object({
-	platform: Platform,
-	channel: string(),
-	thread: string().optional()
-});
-/** Trigger-matching rule for a binding (protocol §5.1). */
-const BindRule = object({ match: discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]) });
-const RouteAssign = object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	workspaceId: string().uuid(),
-	bindRules: array(BindRule).default([])
-});
-const RouteAssignAck = object({
-	ok: boolean(),
-	sessionKey: SessionKey,
-	reason: string().optional()
-});
-const RouteUpdate = object({
-	routingEpoch: number().int(),
-	rules: array(object({
-		match: unknown(),
-		agentId: string().uuid()
-	}))
-});
-/** Graceful scale-down / rebalance — protocol §5.3. */
-const Drain = object({
-	scope: union([
-		object({
-			kind: literal("agent"),
-			agentId: string().uuid()
-		}),
-		object({ kind: literal("daemon") }),
-		object({
-			kind: literal("session"),
-			sessionKey: SessionKey
-		})
-	]),
-	deadline: string().datetime()
-});
-const DrainProgress = object({
-	remaining: number().int(),
-	drained: array(SessionKey)
-});
-const DrainDone = object({ released: array(SessionKey) });
-//#endregion
-//#region ../protocol/dist/frames/cron.js
-/**
-* Cron sinks to the daemon (D5) — protocol §5.4.
-*
-* A cron periodically triggers ONE AGENT with a synthetic prompt (`trigger`) to
-* carry out some work. The CP owns the definition; the daemon owns firing +
-* last-run persistence, so crons fire even when the CP is down. On receipt the
-* daemon persists the def into the owning agent's `agent.json` `crons[]` (the
-* single source of truth, same model as integrations) — surviving a restart
-* with the CP down.
-*
-* `target` is OPTIONAL output routing: when present, the daemon posts the
-* trigger as a real message in that channel and the agent's session replies in
-* its thread; when absent the fire is headless (the agent works with no
-* platform output).
-*/
-const CronTarget = object({
-	platform: _enum([
-		"slack",
-		"telegram",
-		"discord"
-	]).default("slack"),
-	channel: string(),
-	integrationId: string().uuid().optional()
-});
-const CronUpsert = object({
-	cronId: string().uuid(),
-	agentId: string().uuid(),
-	schedule: string(),
-	target: CronTarget.optional(),
-	trigger: string(),
-	enabled: boolean().default(true)
-});
-const CronRemove = object({ cronId: string().uuid() });
-/**
-* `cron/report` (D→C EVT, fire-and-forget) — one CP-owned cron fired. The
-* daemon stamps the fire into its local store first (it stays authoritative,
-* §5.4) and reports it here so the console's `lastRunAt` converges; the CP
-* upsert is latest-wins, so the daemon re-asserting its stored stamps on
-* reconnect (fires while the CP was unreachable) is idempotent and can never
-* regress the value. Hand-authored (no-origin) crons are never reported.
-*
-* Two reports per fire, keyed by `(cronId, firedAt)`: the FIRE report (no
-* `status`) opens the run, and the COMPLETION report (with `status` + outcome
-* fields) closes it once the dispatched turn ends — feeding the console's
-* per-schedule run history. A completion without a prior fire report (CP was
-* down at fire time) still creates the run row.
-*/
-const CronRunStatus = _enum(["success", "failed"]);
-const CronReport = object({
-	cronId: string().uuid(),
-	agentId: string().uuid(),
-	firedAt: string().datetime(),
-	status: CronRunStatus.optional(),
-	durationMs: number().int().nonnegative().optional(),
-	sessionId: string().optional(),
-	reason: string().optional()
-});
-/**
-* `cron/run` (C→D REQ → ack) — fire one CP-owned cron NOW (console "Run now").
-* The daemon accepts (`ok:true`) and runs the fire asynchronously — outcome
-* arrives as normal `cron/report`s; `ok:false` when it holds no such cron.
-*/
-const CronRunNow = object({ cronId: string().uuid() });
-//#endregion
-//#region ../protocol/dist/frames/secrets.js
-/**
-* Secrets (C5 ↔ D10) — protocol §6.
-*
-* Lease-based, no plaintext on the wire or in PG. Every frame carries a
-* REFERENCE to a Vault/KMS path, never the secret material itself.
-*/
-const SecretsRequest = object({ scope: object({
-	platform: Platform,
-	workspaceId: string().uuid()
-}) });
-const SecretsGrant = object({
-	leaseId: string().uuid(),
-	scope: object({
-		platform: string(),
-		workspaceId: string().uuid()
-	}),
-	ref: string(),
-	ttl: number().int(),
-	renewBeforeSec: number().int()
-});
-const SecretsRenew = object({ leaseId: string().uuid() });
-const SecretsRevoke = object({
-	leaseId: string().uuid(),
-	reason: string()
-});
-/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
-const ScopeAttestation = object({
-	machineId: string().uuid(),
-	scope: _enum([
-		"attachment.put",
-		"attachment.get",
-		"facts.put"
-	]),
-	resourceRef: string(),
-	jws: string(),
-	exp: string().datetime()
-});
-//#endregion
-//#region ../protocol/dist/frames/agent.js
-/**
-* Agent lifecycle (protocol §4.4, §7.4, §8).
-*
-* There is no CP→daemon prompt-delivery frame: the daemon prompts an agent from
-* its own ingress (platform adapters, and webchat over its own `webchat/*`
-* frames), never the CP. The old `agent/prompt` + per-agent `seq` machinery was
-* reserved infrastructure with no live caller and has been removed.
-*/
-/**
-* Where the agent runs. Two modes; the **path is always daemon-generated** —
-* never specified by the caller (UX picks the mode, the machine owns the dir).
-*
-* - `scratch`: a fresh empty working dir on the machine, no repo.
-* - `github`: the daemon clones `gitRepo` @ `branch` and runs the agent in
-*   `agentDir` (a subdir of the repo, repo-root if omitted). **Multiple agents
-*   may share one repo** — they differ by `agentDir`, so the repo is not an
-*   owned entity, just shared config on each agent.
-*/
-const AgentWorkspace = discriminatedUnion("mode", [object({ mode: literal("scratch") }), object({
-	mode: literal("github"),
-	gitRepo: string(),
-	branch: string().default("main"),
-	agentDir: string().optional(),
-	gitCredential: _enum(["github-app"]).optional()
-})]);
-/**
-* MCP-server name reserved for the daemon's own injected stdio bridge (its
-* platform tools). A config-defined or agent-enabled server under this name
-* would collide with the bridge entry at ACP `session/new`, so the daemon
-* strips it and the CP rejects it in `AgentSpec.mcpServers` at the API edge.
-*/
-const RESERVED_MCP_SERVER_NAME = "agentconnect";
-/**
-* The editable agent definition the CP owns and the daemon needs to run it:
-* prompt + runtime selection. Raft ships this in the launch config and the
-* daemon synthesizes the system prompt locally; `description` IS the prompt.
-*/
-const AgentSpec = object({
-	name: string(),
-	description: string().optional(),
-	runtime: string().optional(),
-	model: string().nullable().optional(),
-	reasoningEffort: string().nullable().optional(),
-	executionMode: string().optional(),
-	outputMode: _enum([
-		"low",
-		"medium",
-		"high"
-	]).optional(),
-	fastMode: boolean().optional(),
-	permissionMode: string().nullable().optional(),
-	pause: boolean().optional(),
-	workspace: AgentWorkspace.optional(),
-	env: record(string(), string()).optional(),
-	memory: object({ provider: _enum([
-		"native",
-		"managed",
-		"external"
-	]) }).optional(),
-	mcpServers: array(string()).default([])
-});
-const AgentLaunch = object({
-	agentId: string().uuid(),
-	runtime: string(),
-	workspaceId: string().uuid(),
-	capabilities: array(string()),
-	spec: AgentSpec,
-	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
-});
-/**
-* Live agent CRUD (C→D): the console edited an agent's spec; push it so a
-* running daemon reloads without waiting for the next launch. `agent/remove`
-* tears the agent down. Deleting an agent never relaunches it.
-*/
-const AgentUpsert = object({
-	agentId: string().uuid(),
-	spec: AgentSpec
-});
-const AgentRemove = object({ agentId: string().uuid() });
-const AgentLaunched = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	acpSessionId: string().optional(),
-	startedAt: string().datetime(),
-	runtime: string()
-});
-const AgentStop = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	reason: string()
-});
-const AgentActivity = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	state: _enum([
-		"thinking",
-		"tool_call",
-		"awaiting_permission",
-		"idle"
-	]),
-	ts: string().datetime()
-});
-const AgentScopeDenied = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	capability: string()
-});
-//#endregion
-//#region ../protocol/dist/frames/integration.js
-/**
-* Platform integration distribution (C→D) — the Slack "install" flow.
-*
-* The Control Plane is the source of truth for platform integrations and pushes
-* them to the daemon that owns the integration's agent (`integration/upsert`, and
-* the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket
-* Mode connection from the delivered config (see slack/connection.ts).
-*
-* SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT
-* platform tokens (botToken/appToken). These payloads MUST NEVER be logged — no
-* body dump on decode error, no register/ok snapshot debug dump. The daemon
-* persists them into the owning agent's local `agent.json` (same trust boundary
-* as hand-authored agents, which already keep tokens there) so integrations
-* survive a restart with the CP down.
-*
-* `signingSecret` is intentionally absent: Socket Mode authenticates with the
-* app-level token, so the daemon never needs a signing secret.
-*/
-/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */
-const BindMatch = discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]);
-/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */
-const IntegrationBindRule = object({
-	channel: string().optional(),
-	thread: string().optional(),
-	match: BindMatch
-});
-/** The Slack config the daemon needs to open + route a socket (no signingSecret). */
-const IntegrationSlackConfig = object({
-	botToken: string(),
-	appToken: string(),
-	allowedUserIds: array(string()).default([]),
-	bindRules: array(IntegrationBindRule).default([])
-});
-/**
-* The Telegram config the daemon needs to open long-polling + route (grammY).
-* Telegram has a SINGLE BotFather HTTP token — no app-level token and no signing
-* secret (long-polling authenticates every getUpdates call with the bot token).
-*/
-const IntegrationTelegramConfig = object({
-	botToken: string(),
-	allowedUserIds: array(string()).default([]),
-	bindRules: array(IntegrationBindRule).default([])
-});
-/**
-* The Discord config the daemon needs to open the Gateway + route (discord.js).
-* Discord authenticates the Gateway with a SINGLE bot token — no Slack-style
-* app-level token and no signing secret. `applicationId` is public metadata (the
-* client id for the OAuth2 bot-invite URL); it is not secret material.
-*/
-const IntegrationDiscordConfig = object({
-	botToken: string(),
-	applicationId: string().optional(),
-	allowedUserIds: array(string()).default([]),
-	bindRules: array(IntegrationBindRule).default([])
-});
-/**
-* One platform integration, owned by exactly one agent. Also the element type of
-* `RegisterOk.integrations[]` (the per-daemon reconcile set). Discriminated on
-* `platform`: the daemon opens a Slack Socket Mode connection, a Telegram
-* long-poll, or a Discord Gateway from whichever variant is delivered.
-*/
-const IntegrationSpec = discriminatedUnion("platform", [
-	object({
-		integrationId: string().uuid(),
-		agentId: string().uuid(),
-		platform: literal("slack"),
-		slack: IntegrationSlackConfig
-	}),
-	object({
-		integrationId: string().uuid(),
-		agentId: string().uuid(),
-		platform: literal("telegram"),
-		telegram: IntegrationTelegramConfig
-	}),
-	object({
-		integrationId: string().uuid(),
-		agentId: string().uuid(),
-		platform: literal("discord"),
-		discord: IntegrationDiscordConfig
-	})
-]);
-/** C→D EVT — install/update an integration on the owning agent's daemon. */
-const IntegrationUpsert = IntegrationSpec;
-/** C→D EVT — remove an integration from the daemon. */
-const IntegrationRemove = object({ integrationId: string().uuid() });
-/** One channel the bot is currently a member of (metadata only — no messages). */
-const IntegrationChannel = object({
-	id: string(),
-	name: string().optional(),
-	isPrivate: boolean().optional()
-});
-/**
-* D→C EVT — the FULL set of channels the integration's bot is a member of
-* (fire-and-forget, latest-wins). Emitted on socket start and whenever the bot
-* is invited to / removed from a channel, so the console can offer per-channel
-* trigger config. Channel names are control metadata, never message content.
-*/
-const IntegrationChannels = object({
-	integrationId: string().uuid(),
-	channels: array(IntegrationChannel)
-});
-//#endregion
-//#region ../protocol/dist/frames/register.js
-/**
-* Capability upload + the reconcile snapshot — protocol §3.3.
-*
-* `register/ok` is the authoritative source of truth: the daemon converges its
-* local cache to it. CP wins all conflicts, so re-issuing the same snapshot is
-* idempotent.
-*/
-const RegisterReq = object({
-	host: string(),
-	capabilities: object({
-		platforms: array(Platform),
-		runtimes: array(string()),
-		acp: boolean(),
-		features: array(string()).default([])
-	}),
-	maxAgents: number().int(),
-	localState: object({
-		assignments: array(string()),
-		crons: array(string()),
-		leases: array(string())
-	})
-});
-/**
-* One relay the daemon SHOULD hold an outbound WS to (shared-bot-relay.md §5).
-* The roster is all-to-all by design: a webchat/webhook landing on ANY relay
-* instance must find this daemon's connection without cross-instance forwarding.
-* That only holds if `url` (the relay's registered `daemonUrl`) routes to that
-* SPECIFIC instance — the daemon confirms the landing spot against
-* `rd/hello/ok.relayId` and treats a mismatch as a deployment misroute.
-*/
-const RelayRosterEntry = object({
-	relayId: string().uuid(),
-	url: string()
-});
-/**
-* C→D EVT (`relay/roster`) — hot roster update (relay registered / swept).
-* Carries the WHOLE desired set, same converge-don't-diff semantics as the
-* `register/ok.relays` snapshot it refreshes.
-*/
-const RelayRosterUpdate = object({ relays: array(RelayRosterEntry) });
-const RegisterOk = object({
-	routingEpoch: number().int(),
-	assignments: array(RouteAssign),
-	agents: array(AgentSpec.extend({ agentId: string().uuid() })).default([]),
-	crons: array(CronUpsert),
-	integrations: array(IntegrationSpec).default([]),
-	leases: array(SecretsGrant),
-	relays: array(RelayRosterEntry).default([]),
-	drop: object({
-		assignments: array(string()),
-		crons: array(string())
-	})
-});
-//#endregion
-//#region ../protocol/dist/frames/gitcred.js
-/**
-* Git credentials (github-app workspaces) — daemon-pulled, CP-minted.
-*
-* The CP holds the GitHub App private key and mints short-lived (1h,
-* non-renewable) installation access tokens scoped to a single repository;
-* the daemon pulls one on demand right before a remote git operation and
-* holds it in memory only. Unlike `secrets/*` (lease + reference semantics,
-* still unwired), the grant here carries the TOKEN MATERIAL itself — same
-* plaintext-over-TLS-WS posture as `integration/upsert`, and the same
-* discipline: **never log the payload**.
-*
-* The daemon may only name an agentId — the CP resolves agent → workspace →
-* repo → installation itself, so a daemon can never pick a repo it wasn't
-* assigned. Failures come back as correlated `error` REPs: `SCOPE_DENIED`
-* (not a github-app workspace, or agent not placed on this daemon — stop
-* asking), `LEASE_DENIED` (installation uninstalled/suspended or the repo
-* left its grant set — recoverable only by an operator), `RATE_LIMITED`,
-* `INTERNAL`.
-*/
-const GitCredRequest = object({
-	agentId: string().uuid(),
-	reason: _enum([
-		"clone",
-		"fetch",
-		"pull",
-		"push",
-		"helper"
-	]).optional()
-});
-const GitCredGrant = object({
-	username: literal("x-access-token"),
-	token: string(),
-	ttlSec: number().int(),
-	expiresAt: string().datetime(),
-	repoFullName: string(),
-	access: _enum(["read", "write"])
-});
-//#endregion
-//#region ../protocol/dist/frames/session.js
-/**
-* Session read-back (C→D REQ → REP) — the console's on-demand pulls.
-*
-* Session bodies are daemon-local (body-locality, §1/§12). The CP may persist a
-* metadata-only session-list snapshot from daemon `event/session` events, while
-* transcript/tool bodies are pulled live from the owning daemon and proxied to
-* the console only for display.
-*
-* - `session/list`: the daemon's local metadata projection, used for snapshots
-*   and direct read-back/debugging.
-* - `session/history`: one cursor-paginated page of a session's transcript.
-*/
-/**
-* Per-session token accounting, metered by the daemon from the agent's ACP usage
-* stream. Token counts are CUMULATIVE across the session's turns (summed from each
-* turn's `PromptResponse.usage`); context/cost are the LATEST snapshot from the
-* agent's `usage_update` stream. Every field is optional — a runtime that reports
-* no usage yields an absent field, not a zero.
-*/
-const SessionUsage = object({
-	totalTokens: number().int().optional(),
-	inputTokens: number().int().optional(),
-	outputTokens: number().int().optional(),
-	thoughtTokens: number().int().optional(),
-	cachedReadTokens: number().int().optional(),
-	cachedWriteTokens: number().int().optional(),
-	contextUsed: number().int().optional(),
-	contextSize: number().int().optional(),
-	costAmount: number().optional(),
-	costCurrency: string().optional()
-});
-/** One row in the session list (metadata + console metrics; NOT the transcript). */
-const SessionListItem = object({
-	sessionId: string(),
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	title: string().optional(),
-	status: string().optional(),
-	lastActivityAt: string().optional(),
-	usage: SessionUsage.optional(),
-	triggeredBy: string().optional(),
-	channelName: string().optional(),
-	triggeredByName: string().optional(),
-	threadUrl: string().optional()
-});
-/** C→D REQ: list the daemon's sessions (optionally just one agent's). */
-const SessionListReq = object({ agentId: string().uuid().optional() });
-/** D→C REP (corr = req id): the daemon's current sessions. */
-const SessionListPage = object({ sessions: array(SessionListItem) });
-object({
-	toolCallId: string(),
-	kind: string().optional(),
-	status: string().optional(),
-	rawInput: unknown().optional(),
-	rawOutput: unknown().optional(),
-	content: array(unknown()).optional(),
-	locations: array(object({
-		path: string(),
-		line: number().int().optional()
-	})).optional(),
-	truncated: boolean().optional()
-});
-/** One message in a session transcript page (a body — returned only for display). */
-const SessionMessage = object({
-	seq: number().int(),
-	sender: string(),
-	senderName: string().optional(),
-	ts: string(),
-	kind: string(),
-	text: string(),
-	toolCallId: string().optional(),
-	toolStatus: string().optional(),
-	toolKind: string().optional(),
-	body: string().optional(),
-	bodyTruncated: boolean().optional(),
-	bodyBytes: number().int().optional()
-});
-/** C→D REQ: fetch one page of a session's history from the owning daemon. */
-const SessionHistoryReq = object({
-	sessionId: string(),
-	cursor: string().optional(),
-	limit: number().int().positive().max(200).default(50)
-});
-/** D→C REP (corr = the req id): a page of messages + the cursor for the next page. */
-const SessionHistoryPage = object({
-	sessionId: string(),
-	messages: array(SessionMessage),
-	nextCursor: string().optional()
-});
-/**
-* C→D REQ: fetch the FULL (untruncated) ToolBody JSON for one tool call, chunked.
-* The inline `SessionMessage.body` preview is capped at 32 KiB; when a body is
-* bigger the console pages the whole thing back through this frame by offset.
-*/
-const SessionToolBodyReq = object({
-	sessionId: string(),
-	toolCallId: string(),
-	offset: number().int().nonnegative().default(0)
-});
-/** D→C REP (corr = the req id): one frame-budgeted byte slice of the full ToolBody JSON. */
-const SessionToolBodyChunk = object({
-	sessionId: string(),
-	toolCallId: string(),
-	data: string(),
-	totalBytes: number().int(),
-	nextOffset: number().int().optional()
-});
-//#endregion
-//#region ../protocol/dist/frames/channel.js
-/**
-* Channel agent directory (D→C REQ → REP) — agent collaboration lookup.
-*
-* An agent asks (via a daemon-side tool) "who else is in this channel?". The
-* daemon forwards it to the CP — the ONLY authority for the FULL channel roster,
-* because agents in one channel may run on different daemons (each daemon knows
-* only its own agents). The CP joins the channel's integrations to their agents
-* and returns their public metadata (name / displayName / description / status).
-* Metadata only — never message content (§1/§12).
-*
-* Direction is daemon→CP (like `auth` / `register`): the daemon sends the REQ and
-* the CP replies with `channel/agents/ok` (corr = the req id).
-*/
-/** One agent visible in a channel — the collaboration directory entry. */
-const ChannelAgent = object({
-	agentId: string().uuid(),
-	name: string(),
-	displayName: string().optional(),
-	description: string().optional(),
-	status: _enum([
-		"active",
-		"inactive",
-		"paused"
-	])
-});
-/** D→C REQ: list the agents in a channel (for the asking agent's collaboration tool). */
-const ChannelAgentsReq = object({
-	platform: Platform,
-	channel: string()
-});
-/** C→D REP (corr = req id): every agent in the channel across all daemons. */
-const ChannelAgentsOk = object({
-	platform: Platform,
-	channel: string(),
-	agents: array(ChannelAgent)
-});
-//#endregion
-//#region ../protocol/dist/frames/workspace.js
-/**
-* Agent workspace file browsing (C→D REQ → REP) — the console's on-demand pulls.
-*
-* The CP stores NO workspace data — directory listings and file bytes are pulled
-* live from the owning daemon and proxied to the console, never persisted
-* (body-locality). Missing paths are DATA (`exists:false`), not errors; only
-* path-containment violations (`BAD_PAYLOAD`) and unexpected fs failures
-* (`INTERNAL`) come back as `error` frames.
-*
-* - `workspace/list`: one cursor-paginated page of a directory's entries.
-* - `workspace/read`: one byte slice of a file. `limit` is only a ceiling — the
-*   daemon returns FEWER bytes when needed to keep the JSON-escaped REP under the
-*   256 KiB frame cap (control bytes escape to `\uXXXX`, a 6× blowup), and always
-*   ends the slice on a UTF-8 character boundary. `nextOffset` is the authoritative
-*   byte offset to request next — callers must NOT recompute it from the decoded
-*   `content` (a split multi-byte char would make the byte count drift).
-*/
-/** One directory entry in a workspace listing (name-only; not a full path). */
-const WorkspaceEntry = object({
-	name: string(),
-	type: _enum([
-		"dir",
-		"file",
-		"symlink",
-		"other"
-	]),
-	size: number().int().nonnegative().optional(),
-	mtime: string().optional()
-});
-/** C→D REQ: list one page of a directory in the agent's workspace. */
-const WorkspaceListReq = object({
-	agentId: string().min(1),
-	path: string().default(""),
-	cursor: string().optional(),
-	limit: number().int().positive().max(500).default(200)
-});
-/** D→C REP (corr = the req id): a page of entries + the cursor for the next page. */
-const WorkspaceListPage = object({
-	agentId: string(),
-	path: string(),
-	exists: boolean(),
-	entries: array(WorkspaceEntry),
-	nextCursor: string().optional()
-});
-/** C→D REQ: read one byte slice of a file in the agent's workspace. */
-const WorkspaceReadReq = object({
-	agentId: string().min(1),
-	path: string().min(1),
-	offset: number().int().nonnegative().default(0),
-	limit: number().int().positive().max(65536).default(65536)
-});
-/** D→C REP (corr = the req id): the file slice (or `exists:false` / binary-detected). */
-const WorkspaceReadContent = object({
-	agentId: string(),
-	path: string(),
-	exists: boolean(),
-	size: number().int().nonnegative().optional(),
-	mtime: string().optional(),
-	encoding: _enum(["utf8", "none"]).optional(),
-	content: string().optional(),
-	offset: number().int().nonnegative().optional(),
-	nextOffset: number().int().nonnegative().optional(),
-	truncated: boolean().optional()
-});
-/**
-* Agent workspace git ops (C→D REQ → REP) — the console's on-demand controls for
-* a git-repo workspace. Like list/read these run daemon-local; the CP proxies the
-* outcome and stores nothing.
-*
-* These are DATA-oriented: a non-repo workspace (`isRepo:false`), a dirty tree,
-* or a pull that can't fast-forward (offline, diverged, local edits) all come
-* back as a normal REP — NOT an `error` frame. Only an unknown agent
-* (`BAD_PAYLOAD`) or an unexpected git/fs failure (`INTERNAL`) is an error.
-*/
-/** C→D REQ: report `git status` of the agent's workspace (is it clean?). */
-const WorkspaceGitStatusReq = object({ agentId: string().min(1) });
-/** One changed path in a `git status`. `index`/`workingDir` are git's per-file XY
-*  status chars (' ', 'M', 'A', 'D', 'R', 'C', 'U', '?', …). */
-const WorkspaceGitFile = object({
-	path: string(),
-	index: string(),
-	workingDir: string()
-});
-/** The HEAD commit of the checkout. */
-const WorkspaceGitCommit = object({
-	sha: string(),
-	shortSha: string(),
-	subject: string(),
-	committedAt: string()
-});
-/** D→C REP (corr = the req id): the working-tree status. */
-const WorkspaceGitStatus = object({
-	agentId: string(),
-	isRepo: boolean(),
-	clean: boolean(),
-	branch: string().optional(),
-	tracking: string().optional(),
-	ahead: number().int().nonnegative().optional(),
-	behind: number().int().nonnegative().optional(),
-	files: array(WorkspaceGitFile).optional(),
-	truncated: boolean().optional(),
-	lastCommit: WorkspaceGitCommit.optional(),
-	lastFetchAt: string().optional()
-});
-/** C→D REQ: force a fast-forward-only `git pull` in the agent's workspace now. */
-const WorkspaceGitPullReq = object({ agentId: string().min(1) });
-/** D→C REP (corr = the req id): the pull outcome. A failed pull is DATA
-*  (`ok:false` + `detail`), not an error frame (see the section docblock). */
-const WorkspaceGitPullResult = object({
-	agentId: string(),
-	isRepo: boolean(),
-	ok: boolean(),
-	detail: string().optional(),
-	changed: number().int().nonnegative().optional(),
-	insertions: number().int().nonnegative().optional(),
-	deletions: number().int().nonnegative().optional()
-});
-//#endregion
-//#region ../protocol/dist/frames/memory.js
-/**
-* Agent memory directory (C→D REQ → REP) — the console's read/write of an agent's
-* long-term memory, and the surface the daemon serves it from.
-*
-* Memory is a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE the
-* workspace — so it survives a workspace reset / re-clone and is never committed
-* into a github-workspace repo. It follows the index-plus-topics shape: a lean
-* `MEMORY.md` index (injected into the prompt every session, bounded) plus any
-* number of `<topic>.md` files the agent reads on demand. The agent maintains it
-* via MCP tools; these frames are the third channel — the CP reading/writing it
-* for the console — all pointing at the same directory.
-*
-* The CP stores NO memory content — bytes are pulled live from the owning daemon
-* and proxied to the console, never persisted (body-locality). A not-yet-created
-* file/dir is DATA (`exists:false`), not an error; only an unknown agent or a
-* path-containment violation (`BAD_PAYLOAD`) or an unexpected fs failure
-* (`INTERNAL`) comes back as an `error` frame.
-*
-* - `memory/list`: the topic files in the memory dir (flat; the index + topics).
-* - `memory/read`: one byte slice of a memory file (`path` relative to the memory
-*   dir; default `MEMORY.md`). `limit` is a ceiling — the daemon returns fewer
-*   bytes to keep the JSON-escaped REP under the 256 KiB frame cap and always ends
-*   on a UTF-8 boundary. `nextOffset` is authoritative — do NOT recompute it.
-* - `memory/write`: replace the whole named memory file with `content`.
-*/
-/** The default file name of the memory index (loaded into the prompt each session). */
-const MEMORY_INDEX = "MEMORY.md";
-/** One entry in a memory-dir listing (name-only; not a path). */
-const MemoryEntry = object({
-	name: string(),
-	size: number().int().nonnegative(),
-	mtime: string()
-});
-/** C→D REQ: list the files in the agent's memory dir. */
-const MemoryListReq = object({ agentId: string().min(1) });
-/** D→C REP (corr = the req id): the memory dir's files (or `exists:false`). */
-const MemoryListPage = object({
-	agentId: string(),
-	exists: boolean(),
-	entries: array(MemoryEntry)
-});
-/** C→D REQ: read one byte slice of a memory file (path relative to the memory dir). */
-const MemoryReadReq = object({
-	agentId: string().min(1),
-	path: string().default(MEMORY_INDEX),
-	offset: number().int().nonnegative().default(0),
-	limit: number().int().positive().max(65536).default(65536)
-});
-/** D→C REP (corr = the req id): the memory file slice (or `exists:false`). Always utf8 text. */
-const MemoryReadContent = object({
-	agentId: string(),
-	path: string(),
-	exists: boolean(),
-	size: number().int().nonnegative().optional(),
-	mtime: string().optional(),
-	content: string().optional(),
-	offset: number().int().nonnegative().optional(),
-	nextOffset: number().int().nonnegative().optional(),
-	truncated: boolean().optional()
-});
-/** C→D REQ: replace the whole named memory file with `content` (console edit). */
-const MemoryWriteReq = object({
-	agentId: string().min(1),
-	path: string().default(MEMORY_INDEX),
-	content: string(),
-	ifMatchMtime: string().optional()
-});
-/** D→C REP (corr = the req id): the written state, so the console can refresh. */
-const MemoryWriteOk = object({
-	agentId: string(),
-	path: string(),
-	size: number().int().nonnegative(),
-	mtime: string()
-});
-//#endregion
-//#region ../protocol/dist/frames/telemetry.js
-/**
-* Telemetry & facts (D→C) — protocol §7.
-*
-* The dashboard's real-time source. `event/session` is the converged milestone
-* feed (NOT the message stream); `facts/daemon-runtimes` is the observed runtime
-* capability feed; `heartbeat` drives the watchdog.
-*/
-const Heartbeat = object({
-	load: object({
-		cpu: number(),
-		mem: number(),
-		agents: number().int()
-	}),
-	health: _enum(["ok", "degraded"]),
-	activeSessions: number().int(),
-	degradedScopes: array(string()).default([])
-});
-/** Converged session lifecycle milestone — protocol §7.2. NOT the message stream. */
-const EventSession = object({
-	sessionId: string(),
-	agentId: string().uuid(),
-	launchId: string().uuid().optional(),
-	phase: _enum([
-		"start",
-		"plan",
-		"problem",
-		"end"
-	]),
-	platform: Platform.optional(),
-	channel: string().optional(),
-	thread: string().optional(),
-	link: string().optional(),
-	summary: string().optional(),
-	title: string().optional(),
-	status: string().optional(),
-	lastActivityAt: string().datetime().optional(),
-	triggeredBy: string().optional(),
-	channelName: string().optional(),
-	triggeredByName: string().optional(),
-	threadUrl: string().optional(),
-	ts: string().datetime()
-});
-/**
-* Per-session token-usage report — D→C EVT. The daemon meters usage from the
-* agent's ACP stream and reports the session's CUMULATIVE snapshot (latest-wins)
-* so the CP can persist it for the console's historical usage aggregates. This is
-* dashboard metadata (token counts + cost), never the message stream. Idempotent
-* by `sessionId`: re-sending the same snapshot is a no-op upsert on the CP.
-*/
-const UsageReport = object({
-	sessionId: string(),
-	agentId: string().uuid(),
-	platform: string().optional(),
-	channel: string().optional(),
-	lastActivityAt: string(),
-	usage: SessionUsage
-});
-/**
-* Observed capabilities of an installed runtime — protocol §7.3. The element
-* type of the `facts/daemon-runtimes` snapshot. As a standalone per-runtime
-* frame (`facts/runtime-profile`, upsert-only) it is DEPRECATED: current
-* daemons report the full snapshot instead; the CP keeps accepting the old
-* frame from older daemons.
-*/
-/**
-* MCP transports a runtime accepts on `session/new` `mcpServers` (from the ACP
-* `initialize` response's `agentCapabilities.mcpCapabilities`). Stdio is the ACP
-* baseline every agent must accept, so only the optional transports are listed.
-*/
-const McpTransportCapabilities = object({
-	http: boolean(),
-	sse: boolean()
-});
-const FactsRuntimeProfile = object({
-	runtime: string(),
-	version: string(),
-	models: array(string()),
-	contextWindow: number().int().optional(),
-	acpSupport: _enum([
-		"full",
-		"partial",
-		"none"
-	]),
-	acpProtocolVersion: number().int().optional(),
-	toolCalling: boolean(),
-	mcpCapabilities: McpTransportCapabilities.optional()
-});
-/**
-* Probe result for one daemon-configured MCP server (daemon config `mcpServers`).
-* The daemon connects to the server (MCP initialize + `tools/list`) so the
-* console can show what each server offers before the user enables it on an
-* agent. Metadata only — definitions (commands, URLs, headers) stay daemon-local.
-*/
-const FactsMcpServer = object({
-	name: string(),
-	transport: _enum([
-		"stdio",
-		"http",
-		"sse"
-	]),
-	/** True iff the MCP handshake succeeded. */
-	ok: boolean(),
-	tools: array(string()).default([]),
-	version: string().optional(),
-	error: string().optional()
-});
-/**
-* Full snapshot of the daemon's installed runtimes — D→C EVT (protocol §7.3a),
-* emitted on each register and again once the background probe sweep completes
-* (with the learned `models[]`). REPLACE semantics: the CP reconciles its
-* stored runtime list for the daemon to exactly `runtimes[]`, pruning runtimes
-* that are no longer installed. Idempotent (latest-wins). Supersedes the
-* per-runtime `facts/runtime-profile` upsert.
-*/
-const DaemonRuntimes = object({
-	runtimes: array(FactsRuntimeProfile),
-	mcpServers: array(FactsMcpServer).default([])
-});
-/** Non-secret config update — C→D EVT, protocol §8.3 / frame #26. */
-const ConfigPush = object({ keys: record(string(), unknown()) });
-/** Fleet: drain+exit, supervisor restarts — C→D REQ, protocol §8.3 / frame #27. */
-const DaemonRestart = object({
-	reason: string(),
-	drainFirst: boolean().default(true)
-});
-/** Fleet: drain+exit for version bump — C→D REQ, protocol §8.3 / frame #28. */
-const DaemonUpgrade = object({
-	targetVersion: string(),
-	drainFirst: boolean().default(true)
-});
-/** Reply to a fleet restart/upgrade REQ (protocol §8.3). */
-const DaemonControlAck = object({
-	accepted: boolean(),
-	willDrainUntil: string().datetime().optional()
-});
-/**
-* Generic acknowledgement for REQs whose reply is just `ack` in the frame index
-* (cron/upsert, cron/remove, agent/stop). Kept permissive but typed.
-*/
-const Ack = object({
-	ok: boolean(),
-	reason: string().optional()
-});
-const ErrorFrame = object({
-	code: _enum([
-		"UNKNOWN_FRAME",
-		"FRAME_TOO_LARGE",
-		"PROTOCOL_STATE",
-		"BAD_PAYLOAD",
-		"AUTH_FAILED",
-		"ATTESTATION_INVALID",
-		"STALE_EPOCH",
-		"STALE_LAUNCH",
-		"NO_SESSION",
-		"SCOPE_DENIED",
-		"LEASE_EXPIRED",
-		"LEASE_DENIED",
-		"RATE_LIMITED",
-		"CONFLICT",
-		"INTERNAL"
-	]),
-	message: string(),
-	retryable: boolean(),
-	details: record(string(), unknown()).optional()
-});
-object({
-	accepted: boolean(),
-	turnId: string().uuid(),
-	reason: _enum([
-		"queued",
-		"no_agent",
-		"busy",
-		"paused",
-		"draining"
-	]).optional()
-});
-const WebchatEvent = discriminatedUnion("kind", [
-	object({
-		kind: literal("message"),
-		text: string()
-	}),
-	object({
-		kind: literal("thinking"),
-		text: string()
-	}),
-	object({
-		kind: literal("tool_call"),
-		toolCallId: string(),
-		title: string(),
-		status: string()
-	}),
-	object({
-		kind: literal("tool_update"),
-		toolCallId: string(),
-		status: string()
-	}),
-	object({
-		kind: literal("session_info"),
-		title: string()
-	})
-]);
-const WebchatStatus = object({
-	model: string().optional(),
-	effort: string().optional(),
-	permissionMode: string().optional(),
-	fastMode: boolean().optional(),
-	contextUsed: number().int().optional(),
-	contextSize: number().int().optional(),
-	totalTokens: number().int().optional(),
-	costAmount: number().optional(),
-	costCurrency: string().optional(),
-	models: array(string()).optional(),
-	efforts: array(string()).optional(),
-	permissionModes: array(string()).optional(),
-	fastModeAvailable: boolean().optional(),
-	sessionId: string().optional()
-});
-const WebchatOutput = object({
-	conversationId: string().uuid(),
-	turnId: string().uuid(),
-	index: number().int(),
-	event: WebchatEvent.optional(),
-	status: WebchatStatus.optional()
-}).refine((o) => o.event !== void 0 || o.status !== void 0, { message: "WebchatOutput must carry event and/or status" });
-const WebchatDone = object({
-	conversationId: string().uuid(),
-	turnId: string().uuid(),
-	stopReason: string().optional(),
-	usage: object({
-		used: number().int().optional(),
-		cost: number().optional()
-	}).optional(),
-	error: string().optional()
-});
-//#endregion
-//#region ../protocol/dist/frame.js
-/**
-* The single source of truth for the wire: `type` string → payload zod schema.
-*
-* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
-* frames) plus the correlated REP types named in the "Reply" column
-* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
-* travel on the wire and must be decodable.
-*
-* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
-* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
-*/
-const FRAME_SCHEMAS = {
-	auth: AuthReq,
-	"auth/ok": AuthOk,
-	register: RegisterReq,
-	"register/ok": RegisterOk,
-	"relay/roster": RelayRosterUpdate,
-	heartbeat: Heartbeat,
-	"agent/launch": AgentLaunch,
-	"agent/launched": AgentLaunched,
-	"agent/stop": AgentStop,
-	"agent/upsert": AgentUpsert,
-	"agent/remove": AgentRemove,
-	"agent/activity": AgentActivity,
-	"agent/scope-denied": AgentScopeDenied,
-	"route/assign": RouteAssign,
-	"route/assign/ack": RouteAssignAck,
-	"route/update": RouteUpdate,
-	"daemon/drain": Drain,
-	"drain/progress": DrainProgress,
-	"drain/done": DrainDone,
-	"cron/upsert": CronUpsert,
-	"cron/remove": CronRemove,
-	"cron/report": CronReport,
-	"cron/run": CronRunNow,
-	"integration/upsert": IntegrationUpsert,
-	"integration/remove": IntegrationRemove,
-	"integration/channels": IntegrationChannels,
-	"gitcred/request": GitCredRequest,
-	"gitcred/grant": GitCredGrant,
-	"secrets/request": SecretsRequest,
-	"secrets/grant": SecretsGrant,
-	"secrets/renew": SecretsRenew,
-	"secrets/revoke": SecretsRevoke,
-	"scope-attestation": ScopeAttestation,
-	"event/session": EventSession,
-	"usage/report": UsageReport,
-	"facts/runtime-profile": FactsRuntimeProfile,
-	"facts/daemon-runtimes": DaemonRuntimes,
-	"session/list": SessionListReq,
-	"session/list/page": SessionListPage,
-	"session/history": SessionHistoryReq,
-	"session/history/page": SessionHistoryPage,
-	"session/tool-body": SessionToolBodyReq,
-	"session/tool-body/chunk": SessionToolBodyChunk,
-	"channel/agents": ChannelAgentsReq,
-	"channel/agents/ok": ChannelAgentsOk,
-	"workspace/list": WorkspaceListReq,
-	"workspace/list/page": WorkspaceListPage,
-	"workspace/read": WorkspaceReadReq,
-	"workspace/read/content": WorkspaceReadContent,
-	"workspace/gitstatus": WorkspaceGitStatusReq,
-	"workspace/gitstatus/result": WorkspaceGitStatus,
-	"workspace/gitpull": WorkspaceGitPullReq,
-	"workspace/gitpull/result": WorkspaceGitPullResult,
-	"memory/list": MemoryListReq,
-	"memory/list/page": MemoryListPage,
-	"memory/read": MemoryReadReq,
-	"memory/read/content": MemoryReadContent,
-	"memory/write": MemoryWriteReq,
-	"memory/write/ok": MemoryWriteOk,
-	"config/push": ConfigPush,
-	"daemon/restart": DaemonRestart,
-	"daemon/upgrade": DaemonUpgrade,
-	"daemon/control/ack": DaemonControlAck,
-	ack: Ack,
-	error: ErrorFrame
-};
-Object.keys(FRAME_SCHEMAS);
-/**
-* Builds the envelope schema for one frame `type` with a `type` literal and the
-* typed payload, so the discriminated union infers `payload` precisely.
-*
-* Kept as a local generic (payload pinned to `FRAME_SCHEMAS[T]`) so a
-* mispaired member — `frame('auth', FRAME_SCHEMAS['register'])` — is a compile
-* error; a bare `frameSchema` alias would accept it. The body is deliberately
-* inlined rather than delegated: `return frameSchema(type, payload)` under
-* THIS generic signature collapses every union member's `payload` to `unknown`
-* (113 × TS18046 under TS 6.0.3 / zod 4.4.3 — reproducible by making exactly
-* that substitution), while the small relay unions call `frameSchema` with
-* concrete schemas and infer fine.
-*/
-function frame(type, payload) {
-	return object({
-		v: literal(1),
-		id: string().uuid(),
-		ts: string().datetime(),
-		type: literal(type),
-		corr: string().uuid().optional(),
-		payload
-	});
-}
-discriminatedUnion("type", [
-	frame("auth", FRAME_SCHEMAS["auth"]),
-	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
-	frame("register", FRAME_SCHEMAS["register"]),
-	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
-	frame("relay/roster", FRAME_SCHEMAS["relay/roster"]),
-	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
-	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
-	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
-	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
-	frame("agent/upsert", FRAME_SCHEMAS["agent/upsert"]),
-	frame("agent/remove", FRAME_SCHEMAS["agent/remove"]),
-	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
-	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
-	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
-	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
-	frame("route/update", FRAME_SCHEMAS["route/update"]),
-	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
-	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
-	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
-	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
-	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
-	frame("cron/report", FRAME_SCHEMAS["cron/report"]),
-	frame("cron/run", FRAME_SCHEMAS["cron/run"]),
-	frame("integration/upsert", FRAME_SCHEMAS["integration/upsert"]),
-	frame("integration/remove", FRAME_SCHEMAS["integration/remove"]),
-	frame("integration/channels", FRAME_SCHEMAS["integration/channels"]),
-	frame("gitcred/request", FRAME_SCHEMAS["gitcred/request"]),
-	frame("gitcred/grant", FRAME_SCHEMAS["gitcred/grant"]),
-	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
-	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
-	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
-	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
-	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
-	frame("event/session", FRAME_SCHEMAS["event/session"]),
-	frame("usage/report", FRAME_SCHEMAS["usage/report"]),
-	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
-	frame("facts/daemon-runtimes", FRAME_SCHEMAS["facts/daemon-runtimes"]),
-	frame("session/list", FRAME_SCHEMAS["session/list"]),
-	frame("session/list/page", FRAME_SCHEMAS["session/list/page"]),
-	frame("session/history", FRAME_SCHEMAS["session/history"]),
-	frame("session/history/page", FRAME_SCHEMAS["session/history/page"]),
-	frame("session/tool-body", FRAME_SCHEMAS["session/tool-body"]),
-	frame("session/tool-body/chunk", FRAME_SCHEMAS["session/tool-body/chunk"]),
-	frame("channel/agents", FRAME_SCHEMAS["channel/agents"]),
-	frame("channel/agents/ok", FRAME_SCHEMAS["channel/agents/ok"]),
-	frame("workspace/list", FRAME_SCHEMAS["workspace/list"]),
-	frame("workspace/list/page", FRAME_SCHEMAS["workspace/list/page"]),
-	frame("workspace/read", FRAME_SCHEMAS["workspace/read"]),
-	frame("workspace/read/content", FRAME_SCHEMAS["workspace/read/content"]),
-	frame("workspace/gitstatus", FRAME_SCHEMAS["workspace/gitstatus"]),
-	frame("workspace/gitstatus/result", FRAME_SCHEMAS["workspace/gitstatus/result"]),
-	frame("workspace/gitpull", FRAME_SCHEMAS["workspace/gitpull"]),
-	frame("workspace/gitpull/result", FRAME_SCHEMAS["workspace/gitpull/result"]),
-	frame("memory/list", FRAME_SCHEMAS["memory/list"]),
-	frame("memory/list/page", FRAME_SCHEMAS["memory/list/page"]),
-	frame("memory/read", FRAME_SCHEMAS["memory/read"]),
-	frame("memory/read/content", FRAME_SCHEMAS["memory/read/content"]),
-	frame("memory/write", FRAME_SCHEMAS["memory/write"]),
-	frame("memory/write/ok", FRAME_SCHEMAS["memory/write/ok"]),
-	frame("config/push", FRAME_SCHEMAS["config/push"]),
-	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
-	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
-	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
-	frame("ack", FRAME_SCHEMAS["ack"]),
-	frame("error", FRAME_SCHEMAS["error"])
-]);
-//#endregion
-//#region ../protocol/dist/wire.js
-/**
-* Generic envelope codec — the schema-map-agnostic core shared by every wire.
-*
-* The daemon↔CP wire (`codec.ts` over `FRAME_SCHEMAS`) and the two relay wires
-* (`frames/relay-cp.ts` / `frames/relay-daemon.ts` over their OWN maps) all
-* decode the same envelope shape but accept disjoint frame families — a relay
-* socket must answer a daemon↔CP frame with `UNKNOWN_FRAME`, and vice versa
-* (shared-bot-relay.md §8 "独立帧 union，不混入 daemon 协议").
-*/
-/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
-const MAX_FRAME_BYTES = 256 * 1024;
-const textEncoder = new TextEncoder();
-function byteLength(text) {
-	return textEncoder.encode(text).length;
-}
-function extractControlExt(json) {
-	if (typeof json !== "object" || json === null) return void 0;
-	const o = json;
-	const ext = {};
-	if (typeof o.epoch === "number") ext.epoch = o.epoch;
-	if (typeof o.agentId === "string") ext.agentId = o.agentId;
-	if (typeof o.launchId === "string") ext.launchId = o.launchId;
-	return Object.keys(ext).length > 0 ? ext : void 0;
-}
-/**
-* Decode one wire frame against `schemas` (the wire's `type` → payload map).
-* Two-step parse: envelope first, then the per-type payload schema — an unknown
-* `type` is a typed `UNKNOWN_FRAME` failure (a REP, never a hard close).
-*/
-function decodeEnvelopeWith(schemas, text) {
-	if (byteLength(text) > 262144) return {
-		ok: false,
-		id: NIL_UUID,
-		msg: "FRAME_TOO_LARGE"
-	};
-	let json;
-	try {
-		json = JSON.parse(text);
-	} catch {
-		return {
-			ok: false,
-			id: NIL_UUID,
-			msg: "invalid json"
-		};
-	}
-	const env = Envelope.safeParse(json);
-	if (!env.success) return {
-		ok: false,
-		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
-		msg: env.error.message
-	};
-	const schema = schemas[env.data.type];
-	if (!schema) return {
-		ok: false,
-		id: env.data.id,
-		msg: "UNKNOWN_FRAME"
-	};
-	const payload = schema.safeParse(env.data.payload);
-	if (!payload.success) return {
-		ok: false,
-		id: env.data.id,
-		msg: payload.error.message
-	};
-	const ext = extractControlExt(json);
-	return {
-		ok: true,
-		frame: {
-			...env.data,
-			payload: payload.data
-		},
-		...ext ? { ext } : {}
-	};
-}
-/**
-* Wrap a payload in the wire envelope. Untyped core — each wire exports a typed
-* wrapper (`buildEnvelope` / `buildRelayCpFrame` / `buildRelayDaemonFrame`) that
-* pins `type` to its own union and casts the result.
-*/
-function buildEnvelopeRaw(type, payload, opts = {}) {
-	return {
-		v: 1,
-		id: opts.id ?? randomUUID(),
-		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
-		type,
-		payload,
-		...opts.corr ? { corr: opts.corr } : {},
-		...opts.ext ?? {}
-	};
-}
-//#endregion
-//#region ../protocol/dist/codec.js
-function decodeEnvelope(text) {
-	return decodeEnvelopeWith(FRAME_SCHEMAS, text);
-}
-function buildEnvelope(type, payload, opts = {}) {
-	return buildEnvelopeRaw(type, payload, opts);
-}
-function encode(frame) {
-	return JSON.stringify(frame);
-}
-//#endregion
-//#region ../protocol/dist/frames/relay-daemon.js
-/**
-* relay↔daemon frames (`rd/*`) — shared-bot-relay.md §7.2.
-*
-* The daemon dials OUT to every relay in its roster (one WS per (daemon, relay)
-* pair, multiplexing every source). This wire CARRIES MESSAGE CONTENT — it is
-* the ingress data plane — so nothing on it is ever logged with its payload.
-*
-* Direction per frame:
-*  - `rd/hello` (+ `rd/hello/ok`)  D→R REQ / R→D REP — authenticate the dial-in
-*  - `rd/msg`                      R→D REQ — one inbound item, already routed
-*  - `rd/ack`                      D→R REP — receipt (+ webchat turn verdict)
-*  - `rd/chat`                     D→R EVT — webchat output stream back to the
-*                                  browser (webchat is the one BIDIRECTIONAL
-*                                  source: its far end hangs off the relay)
-*
-* Milestone A carries the webchat slice only; `im` (shared bot) and `hook`
-* (webhook) members join the `rd/msg` union with milestone B.
-*/
-/** Subprotocol negotiated on the relay↔daemon socket. */
-const RELAY_DAEMON_SUBPROTOCOL = "agentconnect.rd.v1";
-/** The canonical path the relay mounts its daemon-facing `rd/*` server at, and
-*  the daemon appends to a roster `daemonUrl` origin when dialing (mirrors the
-*  daemon↔CP `/daemon/ws` convention). A roster url already ending in it is used
-*  verbatim. */
-const RELAY_DAEMON_WS_PATH = "/rd/ws";
-const RdHello = object({
-	apiKey: string().min(1),
-	daemonId: string().uuid()
-});
-const RdHelloOk = object({ relayId: string().uuid() });
-const RelayWebchatOp = discriminatedUnion("op", [
-	object({
-		op: literal("turn"),
-		text: string(),
-		user: string().optional()
-	}),
-	object({
-		op: literal("set_model"),
-		model: string()
-	}),
-	object({
-		op: literal("set_effort"),
-		effort: string()
-	}),
-	object({
-		op: literal("set_permission_mode"),
-		permissionMode: string()
-	}),
-	object({
-		op: literal("set_fast"),
-		fastMode: boolean()
-	}),
-	object({ op: literal("cancel") }),
-	object({ op: literal("close") })
-]);
-const RdMsg = discriminatedUnion("source", [object({
-	source: literal("webchat"),
-	agentId: string().uuid(),
-	sessionKey: string().min(1),
-	msgId: string().min(1),
-	chatId: string().uuid(),
-	payload: RelayWebchatOp
-})]);
-const RdAck = object({
-	msgId: string(),
-	accepted: boolean(),
-	turnId: string().uuid().optional(),
-	reason: string().optional()
-});
-const RdChatEvent = discriminatedUnion("kind", [object({
-	kind: literal("output"),
-	output: WebchatOutput
-}), object({
-	kind: literal("done"),
-	done: WebchatDone
-})]);
-/** `type` string → payload schema for the relay↔daemon wire. */
-const RELAY_DAEMON_SCHEMAS = {
-	"rd/hello": RdHello,
-	"rd/hello/ok": RdHelloOk,
-	"rd/msg": RdMsg,
-	"rd/ack": RdAck,
-	"rd/chat": object({
-		chatId: string().uuid(),
-		seq: number().int(),
-		event: RdChatEvent
-	}),
-	error: ErrorFrame
-};
-Object.keys(RELAY_DAEMON_SCHEMAS);
-discriminatedUnion("type", [
-	frameSchema("rd/hello", RELAY_DAEMON_SCHEMAS["rd/hello"]),
-	frameSchema("rd/hello/ok", RELAY_DAEMON_SCHEMAS["rd/hello/ok"]),
-	frameSchema("rd/msg", RELAY_DAEMON_SCHEMAS["rd/msg"]),
-	frameSchema("rd/ack", RELAY_DAEMON_SCHEMAS["rd/ack"]),
-	frameSchema("rd/chat", RELAY_DAEMON_SCHEMAS["rd/chat"]),
-	frameSchema("error", RELAY_DAEMON_SCHEMAS["error"])
-]);
-/** Decode one relay↔daemon wire frame (envelope + typed payload). */
-function decodeRelayDaemonFrame(text) {
-	return decodeEnvelopeWith(RELAY_DAEMON_SCHEMAS, text);
-}
-/** Build a relay↔daemon frame with a compile-time-typed payload. */
-function buildRelayDaemonFrame(type, payload, opts = {}) {
-	return buildEnvelopeRaw(type, payload, opts);
-}
-//#endregion
-//#region ../protocol/dist/git-url.js
-/**
-* Git repo address helpers, shared by the CP (normalize on write) and the
-* daemon (defensive normalize before clone).
-*
-* STORAGE INVARIANT: `workspace.gitRepo` is persisted as a FULL cloneable git
-* address (e.g. `https://github.com/acme/infra`), never the `acme/infra`
-* shorthand a user may type. UIs shorten it back to `org/repo` for display
-* with `gitRepoLabel`.
-*/
-/** Scheme-full address: https://, ssh://, git://, file://, … */
-const SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
-/** scp-like ssh address: git@github.com:acme/infra(.git) */
-const SCP_RE = /^[\w.-]+@[\w.-]+:(.+)$/;
-/**
-* Normalize a user-supplied repo reference into a full cloneable git address.
-* Idempotent — full addresses pass through unchanged.
-*
-* - `https://…` / `ssh://…` / `git://…` / `git@host:…` → as-is
-* - `github.com/acme/infra` (host-prefixed shorthand)  → `https://github.com/acme/infra`
-* - `acme/infra` (bare org/repo)                       → `https://github.com/acme/infra`
-* - anything else (e.g. a local path) → as-is
-*/
-function normalizeGitUrl(input) {
-	const s = input.trim().replace(/\/+$/, "");
-	if (!s || SCHEME_RE.test(s) || SCP_RE.test(s)) return s;
-	const segments = s.split("/");
-	if (segments.length >= 3 && segments[0].includes(".")) return `https://${s}`;
-	if (segments.length === 2 && segments.every((p) => p.length > 0)) return `https://github.com/${s}`;
-	return s;
-}
-//#endregion
-//#region ../protocol/dist/index.js
-/**
-* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
-* `AnyFrame` to the member whose `type` matches.
-*/
-function isFrame(type) {
-	return (frame) => frame.type === type;
-}
-//#endregion
 //#region src/agents/memory.ts
 /**
 * Agent memory — a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE
@@ -1950,6 +395,14 @@ const MAX_INDEX_INJECT_BYTES = 25e3;
 /** Hard cap on a single memory file. Injected/read every session, so an unbounded
 *  file would swell the prompt and the wire; writes over this are rejected. */
 const MAX_MEMORY_FILE_BYTES = 256e3;
+/** The append-only change log for an agent's memory, a sidecar beside the memory
+*  files (`<agent-root>/memory/.history`). One JSON line per write, for provenance
+*  (who/what/when changed a file). Dotfile so it never surfaces as a topic. */
+const MEMORY_HISTORY_FILENAME = ".history";
+/** Cap on a `before`/`after` snapshot stored in a history line — keeps a single log
+*  entry bounded even for a large file. Over this, the snapshot is truncated (with a
+*  `…` marker) rather than omitted, so the line stays small but still human-readable. */
+const MAX_HISTORY_VALUE_BYTES = 4e3;
 /** Raised when a memory path escapes the memory dir. Surfaces as `BAD_PAYLOAD`. */
 var MemoryPathError = class extends Error {
 	constructor(message) {
@@ -2013,17 +466,47 @@ async function readMemoryFile(agentDir, relPath) {
 		throw err;
 	}
 }
+/** Truncate a snapshot to the history value cap, on a UTF-8 boundary, flagging it. */
+function clampHistoryValue(text) {
+	if (Buffer.byteLength(text) <= 4e3) return {
+		value: text,
+		truncated: false
+	};
+	return {
+		value: Buffer.from(text, "utf8").subarray(0, MAX_HISTORY_VALUE_BYTES).toString("utf8") + "…",
+		truncated: true
+	};
+}
+/** Append one line to the memory change log (`<agent-root>/memory/.history`). A single
+*  `O_APPEND` write, so concurrent appends never interleave a partial line. Best-effort:
+*  a logging failure must never fail the write it describes, so errors are swallowed. */
+async function appendHistory(agentDir, record) {
+	try {
+		await promises.mkdir(memoryDir(agentDir), { recursive: true });
+		await promises.appendFile(join(memoryDir(agentDir), MEMORY_HISTORY_FILENAME), JSON.stringify(record) + "\n", "utf8");
+	} catch {}
+}
 /** Overwrite a memory file with `content` (creating the dir if needed). Atomic
-*  (tmp + rename) so a concurrent read never sees a partial file.
+*  (tmp + rename) so a concurrent read never sees a partial file. Appends a line to
+*  the change log (`.history`) recording the add/update, its `before`/`after`
+*  snapshot (bounded), and the `source`.
 *
 *  - Rejects content over {@link MAX_MEMORY_FILE_BYTES} ({@link MemoryTooLargeError}).
 *  - `ifMatchMtime` (optimistic concurrency): when given, the current file's mtime
 *    must equal it, else {@link MemoryConflictError} — so a console edit can't
 *    clobber a newer write. A brand-new file (no mtime) matches `ifMatchMtime`
 *    only when the caller passes none (or the empty string). */
-async function writeMemoryFile(agentDir, relPath, content, ifMatchMtime) {
+async function writeMemoryFile(agentDir, relPath, content, ifMatchMtime, source = "tool") {
 	if (Buffer.byteLength(content) > 256e3) throw new MemoryTooLargeError(`memory file exceeds the ${MAX_MEMORY_FILE_BYTES}-byte limit`);
 	const abs = resolveInMemoryDir(agentDir, relPath);
+	let before = "";
+	let existed = false;
+	try {
+		before = await promises.readFile(abs, "utf8");
+		existed = true;
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+	}
 	if (ifMatchMtime) {
 		let current = null;
 		try {
@@ -2038,6 +521,18 @@ async function writeMemoryFile(agentDir, relPath, content, ifMatchMtime) {
 	await promises.writeFile(tmp, content, "utf8");
 	await promises.rename(tmp, abs);
 	const st = await promises.stat(abs);
+	const beforeClamped = existed ? clampHistoryValue(before) : void 0;
+	const afterClamped = clampHistoryValue(content);
+	await appendHistory(agentDir, {
+		path: relPath,
+		event: existed ? "update" : "add",
+		...beforeClamped ? { before: beforeClamped.value } : {},
+		after: afterClamped.value,
+		at: st.mtime.toISOString(),
+		scope: "agent",
+		source,
+		...afterClamped.truncated || beforeClamped?.truncated ? { truncated: true } : {}
+	});
 	return {
 		size: st.size,
 		mtime: st.mtime.toISOString()
@@ -2056,7 +551,7 @@ async function listMemory(agentDir) {
 	}
 	const files = [];
 	for (const d of dirents) {
-		if (!d.isFile() || d.name.endsWith(".tmp")) continue;
+		if (!d.isFile() || d.name.endsWith(".tmp") || d.name.startsWith(".")) continue;
 		try {
 			const st = await promises.stat(join(dir, d.name));
 			files.push({
@@ -2263,8 +758,8 @@ var ManagedMemoryProvider = class {
 			content: await readMemoryFile(this.dirFor(scope.agentId), path)
 		};
 	}
-	async write(scope, path, content, ifMatch) {
-		const { size, mtime } = await writeMemoryFile(this.dirFor(scope.agentId), path, content, ifMatch);
+	async write(scope, path, content, ifMatch, source) {
+		const { size, mtime } = await writeMemoryFile(this.dirFor(scope.agentId), path, content, ifMatch, source);
 		return {
 			ok: true,
 			path,
@@ -2315,7 +810,7 @@ var NativeMemoryProvider = class {
 	async read(scope, path) {
 		return nativeMemoryRead(this.dirFor(scope.agentId), this.runtimeFor(scope.agentId), path);
 	}
-	async write(scope, path, content, ifMatch) {
+	async write(scope, path, content, ifMatch, _source) {
 		return nativeMemoryWrite(this.dirFor(scope.agentId), this.runtimeFor(scope.agentId), path, content, ifMatch);
 	}
 };
@@ -2370,8 +865,8 @@ var DispatchingMemoryProvider = class {
 	read(scope, path) {
 		return this.forAgent(scope.agentId).read(scope, path);
 	}
-	write(scope, path, content, ifMatch) {
-		return this.forAgent(scope.agentId).write(scope, path, content, ifMatch);
+	write(scope, path, content, ifMatch, source) {
+		return this.forAgent(scope.agentId).write(scope, path, content, ifMatch, source);
 	}
 	/** The memory tools to inject for a specific agent (the daemon calls this in
 	*  `mcpServersFor` — native contributes none). Scope-carrying, unlike the
@@ -11504,6 +9999,6 @@ var AcpHost = class {
 	}
 };
 //#endregion
-export { toolsForIntegrations as A, decodeRelayDaemonFrame as C, MAX_FRAME_BYTES as D, encode as E, cachedRuntimeVersions as M, resolveRuntimes as N, RESERVED_MCP_SERVER_NAME as O, buildRelayDaemonFrame as S, decodeEnvelope as T, writeMemoryFile as _, initGitInjection as a, RELAY_DAEMON_SUBPROTOCOL as b, simpleGit as c, memoryProviderFor as d, MemoryConflictError as f, resolveInMemoryDir as g, listMemory as h, prepareWorkspace as i, cachedRuntimeNames as j, MEMORY_TOOL_NAMES as k, createMemoryProvider as l, MemoryTooLargeError as m, installedRuntimes as n, probeGitVersion as o, MemoryPathError as p, prefetchWorkspace as r, sessionGitEnv as s, AcpHost as t, memoryKindOf as u, isFrame as v, buildEnvelope as w, RELAY_DAEMON_WS_PATH as x, normalizeGitUrl as y };
+export { resolveRuntimes as S, writeMemoryFile as _, initGitInjection as a, cachedRuntimeNames as b, simpleGit as c, memoryProviderFor as d, MemoryConflictError as f, resolveInMemoryDir as g, listMemory as h, prepareWorkspace as i, createMemoryProvider as l, MemoryTooLargeError as m, installedRuntimes as n, probeGitVersion as o, MemoryPathError as p, prefetchWorkspace as r, sessionGitEnv as s, AcpHost as t, memoryKindOf as u, MEMORY_TOOL_NAMES as v, cachedRuntimeVersions as x, toolsForIntegrations as y };
 
-//# sourceMappingURL=acp-host-iKdfasdN.js.map
+//# sourceMappingURL=acp-host-CUct-2CR.js.map