@agentconnect.md/daemon 1.0.0-rc.246 → 1.0.0-rc.248

package/dist/load-agents-NvLpcg5H.js

@@ -0,0 +1,1953 @@
+import { _ as record, a as array, b as unknown, c as discriminatedUnion, d as literal, m as object, n as _enum, o as boolean, p as number, v as string, y as union } from "./schemas-CQkO9hC5.js";
+import { l as resolveRoot, r as defaultAgentsDir, t as configPath } from "./paths-DEcUO8lC.js";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+//#region ../protocol/dist/envelope.js
+/**
+* The protocol envelope — every frame, both directions, is wrapped in this.
+* Mirrors daemon-cp-ws-protocol.md §1.1.
+*
+* `payload` is left as `unknown` here and validated by the per-type schema in
+* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
+* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
+* instead of a hard close — forward-compat, protocol §1.
+*/
+const Envelope = object({
+	v: literal(1),
+	id: string().uuid(),
+	ts: string().datetime(),
+	type: string(),
+	corr: string().uuid().optional(),
+	payload: unknown()
+});
+object({
+	epoch: number().int(),
+	agentId: string().uuid().optional(),
+	launchId: string().uuid().optional()
+});
+/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
+const NIL_UUID = "00000000-0000-0000-0000-000000000000";
+/**
+* Builds the envelope schema for one frame `type` — the `type` literal plus the
+* typed payload — so a wire's discriminated union infers `payload` precisely.
+* Shared by the daemon↔CP union (`frame.ts`) and the relay wire unions
+* (`frames/relay-cp.ts` / `frames/relay-daemon.ts`), which are deliberately
+* SEPARATE unions over the same envelope shape (shared-bot-relay.md §8).
+*/
+function frameSchema(type, payload) {
+	return object({
+		v: literal(1),
+		id: string().uuid(),
+		ts: string().datetime(),
+		type: literal(type),
+		corr: string().uuid().optional(),
+		payload
+	});
+}
+//#endregion
+//#region ../protocol/dist/frames/auth.js
+/**
+* Auth & identity — protocol §3.1 / §3.2.
+*
+* `auth` is the first frame after the socket opens. `auth/ok` carries the
+* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
+* resume verdict.
+*/
+const AuthReq = object({
+	apiKey: string(),
+	daemonId: string().uuid().optional(),
+	machineId: string().uuid().optional(),
+	attestation: string().optional(),
+	agentVersion: string(),
+	resume: object({ lastEpoch: number().int() }).optional()
+});
+const AuthOk = object({
+	daemonId: string().uuid(),
+	sessionEpoch: number().int(),
+	heartbeatSec: number().int(),
+	serverTime: string().datetime(),
+	webAppUrl: string().optional(),
+	orgSlug: string().optional(),
+	resume: object({ accepted: boolean() }).optional()
+});
+//#endregion
+//#region ../protocol/dist/frames/route.js
+/**
+* Routing & orchestration (C→D control) — protocol §5.
+*
+* `SessionKey` is the canonical session primitive shared across route/*,
+* agent/*, and event/session. Its canonical string form is
+* `${platform}:${channel}:${thread ?? "-"}`.
+*/
+const Platform = _enum([
+	"slack",
+	"telegram",
+	"webchat",
+	"discord"
+]);
+const SessionKey = object({
+	platform: Platform,
+	channel: string(),
+	thread: string().optional()
+});
+/** Trigger-matching rule for a binding (protocol §5.1). */
+const BindRule = object({ match: discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
+]) });
+const RouteAssign = object({
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	workspaceId: string().uuid(),
+	bindRules: array(BindRule).default([])
+});
+const RouteAssignAck = object({
+	ok: boolean(),
+	sessionKey: SessionKey,
+	reason: string().optional()
+});
+const RouteUpdate = object({
+	routingEpoch: number().int(),
+	rules: array(object({
+		match: unknown(),
+		agentId: string().uuid()
+	}))
+});
+/** Graceful scale-down / rebalance — protocol §5.3. */
+const Drain = object({
+	scope: union([
+		object({
+			kind: literal("agent"),
+			agentId: string().uuid()
+		}),
+		object({ kind: literal("daemon") }),
+		object({
+			kind: literal("session"),
+			sessionKey: SessionKey
+		})
+	]),
+	deadline: string().datetime()
+});
+const DrainProgress = object({
+	remaining: number().int(),
+	drained: array(SessionKey)
+});
+const DrainDone = object({ released: array(SessionKey) });
+//#endregion
+//#region ../protocol/dist/frames/cron.js
+/**
+* Cron sinks to the daemon (D5) — protocol §5.4.
+*
+* A cron periodically triggers ONE AGENT with a synthetic prompt (`trigger`) to
+* carry out some work. The CP owns the definition; the daemon owns firing +
+* last-run persistence, so crons fire even when the CP is down. On receipt the
+* daemon persists the def into the owning agent's `agent.json` `crons[]` (the
+* single source of truth, same model as integrations) — surviving a restart
+* with the CP down.
+*
+* `target` is OPTIONAL output routing: when present, the daemon posts the
+* trigger as a real message in that channel and the agent's session replies in
+* its thread; when absent the fire is headless (the agent works with no
+* platform output).
+*/
+const CronTarget = object({
+	platform: _enum([
+		"slack",
+		"telegram",
+		"discord"
+	]).default("slack"),
+	channel: string(),
+	integrationId: string().uuid().optional()
+});
+const CronUpsert = object({
+	cronId: string().uuid(),
+	agentId: string().uuid(),
+	schedule: string(),
+	target: CronTarget.optional(),
+	trigger: string(),
+	enabled: boolean().default(true)
+});
+const CronRemove = object({ cronId: string().uuid() });
+/**
+* `cron/report` (D→C EVT, fire-and-forget) — one CP-owned cron fired. The
+* daemon stamps the fire into its local store first (it stays authoritative,
+* §5.4) and reports it here so the console's `lastRunAt` converges; the CP
+* upsert is latest-wins, so the daemon re-asserting its stored stamps on
+* reconnect (fires while the CP was unreachable) is idempotent and can never
+* regress the value. Hand-authored (no-origin) crons are never reported.
+*
+* Two reports per fire, keyed by `(cronId, firedAt)`: the FIRE report (no
+* `status`) opens the run, and the COMPLETION report (with `status` + outcome
+* fields) closes it once the dispatched turn ends — feeding the console's
+* per-schedule run history. A completion without a prior fire report (CP was
+* down at fire time) still creates the run row.
+*/
+const CronRunStatus = _enum(["success", "failed"]);
+const CronReport = object({
+	cronId: string().uuid(),
+	agentId: string().uuid(),
+	firedAt: string().datetime(),
+	status: CronRunStatus.optional(),
+	durationMs: number().int().nonnegative().optional(),
+	sessionId: string().optional(),
+	reason: string().optional()
+});
+/**
+* `cron/run` (C→D REQ → ack) — fire one CP-owned cron NOW (console "Run now").
+* The daemon accepts (`ok:true`) and runs the fire asynchronously — outcome
+* arrives as normal `cron/report`s; `ok:false` when it holds no such cron.
+*/
+const CronRunNow = object({ cronId: string().uuid() });
+//#endregion
+//#region ../protocol/dist/frames/secrets.js
+/**
+* Secrets (C5 ↔ D10) — protocol §6.
+*
+* Lease-based, no plaintext on the wire or in PG. Every frame carries a
+* REFERENCE to a Vault/KMS path, never the secret material itself.
+*/
+const SecretsRequest = object({ scope: object({
+	platform: Platform,
+	workspaceId: string().uuid()
+}) });
+const SecretsGrant = object({
+	leaseId: string().uuid(),
+	scope: object({
+		platform: string(),
+		workspaceId: string().uuid()
+	}),
+	ref: string(),
+	ttl: number().int(),
+	renewBeforeSec: number().int()
+});
+const SecretsRenew = object({ leaseId: string().uuid() });
+const SecretsRevoke = object({
+	leaseId: string().uuid(),
+	reason: string()
+});
+/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
+const ScopeAttestation = object({
+	machineId: string().uuid(),
+	scope: _enum([
+		"attachment.put",
+		"attachment.get",
+		"facts.put"
+	]),
+	resourceRef: string(),
+	jws: string(),
+	exp: string().datetime()
+});
+//#endregion
+//#region ../protocol/dist/frames/agent.js
+/**
+* Agent lifecycle (protocol §4.4, §7.4, §8).
+*
+* There is no CP→daemon prompt-delivery frame: the daemon prompts an agent from
+* its own ingress (platform adapters, and webchat over its own `webchat/*`
+* frames), never the CP. The old `agent/prompt` + per-agent `seq` machinery was
+* reserved infrastructure with no live caller and has been removed.
+*/
+/**
+* Where the agent runs. Two modes; the **path is always daemon-generated** —
+* never specified by the caller (UX picks the mode, the machine owns the dir).
+*
+* - `scratch`: a fresh empty working dir on the machine, no repo.
+* - `github`: the daemon clones `gitRepo` @ `branch` and runs the agent in
+*   `agentDir` (a subdir of the repo, repo-root if omitted). **Multiple agents
+*   may share one repo** — they differ by `agentDir`, so the repo is not an
+*   owned entity, just shared config on each agent.
+*/
+const AgentWorkspace = discriminatedUnion("mode", [object({ mode: literal("scratch") }), object({
+	mode: literal("github"),
+	gitRepo: string(),
+	branch: string().default("main"),
+	agentDir: string().optional(),
+	gitCredential: _enum(["github-app"]).optional()
+})]);
+/**
+* MCP-server name reserved for the daemon's own injected stdio bridge (its
+* platform tools). A config-defined or agent-enabled server under this name
+* would collide with the bridge entry at ACP `session/new`, so the daemon
+* strips it and the CP rejects it in `AgentSpec.mcpServers` at the API edge.
+*/
+const RESERVED_MCP_SERVER_NAME = "agentconnect";
+/**
+* The editable agent definition the CP owns and the daemon needs to run it:
+* prompt + runtime selection. Raft ships this in the launch config and the
+* daemon synthesizes the system prompt locally; `description` IS the prompt.
+*/
+const AgentSpec = object({
+	name: string(),
+	description: string().optional(),
+	runtime: string().optional(),
+	model: string().nullable().optional(),
+	reasoningEffort: string().nullable().optional(),
+	executionMode: string().optional(),
+	outputMode: _enum([
+		"low",
+		"medium",
+		"high"
+	]).optional(),
+	fastMode: boolean().optional(),
+	permissionMode: string().nullable().optional(),
+	pause: boolean().optional(),
+	workspace: AgentWorkspace.optional(),
+	env: record(string(), string()).optional(),
+	memory: object({ provider: _enum([
+		"native",
+		"managed",
+		"external"
+	]) }).optional(),
+	mcpServers: array(string()).default([])
+});
+const AgentLaunch = object({
+	agentId: string().uuid(),
+	runtime: string(),
+	workspaceId: string().uuid(),
+	capabilities: array(string()),
+	spec: AgentSpec,
+	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
+});
+/**
+* Live agent CRUD (C→D): the console edited an agent's spec; push it so a
+* running daemon reloads without waiting for the next launch. `agent/remove`
+* tears the agent down. Deleting an agent never relaunches it.
+*/
+const AgentUpsert = object({
+	agentId: string().uuid(),
+	spec: AgentSpec
+});
+const AgentRemove = object({ agentId: string().uuid() });
+const AgentLaunched = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	acpSessionId: string().optional(),
+	startedAt: string().datetime(),
+	runtime: string()
+});
+const AgentStop = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	reason: string()
+});
+const AgentActivity = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	state: _enum([
+		"thinking",
+		"tool_call",
+		"awaiting_permission",
+		"idle"
+	]),
+	ts: string().datetime()
+});
+const AgentScopeDenied = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	capability: string()
+});
+//#endregion
+//#region ../protocol/dist/frames/integration.js
+/**
+* Platform integration distribution (C→D) — the Slack "install" flow.
+*
+* The Control Plane is the source of truth for platform integrations and pushes
+* them to the daemon that owns the integration's agent (`integration/upsert`, and
+* the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket
+* Mode connection from the delivered config (see slack/connection.ts).
+*
+* SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT
+* platform tokens (botToken/appToken). These payloads MUST NEVER be logged — no
+* body dump on decode error, no register/ok snapshot debug dump. The daemon
+* persists them into the owning agent's local `agent.json` (same trust boundary
+* as hand-authored agents, which already keep tokens there) so integrations
+* survive a restart with the CP down.
+*
+* `signingSecret` is intentionally absent: Socket Mode authenticates with the
+* app-level token, so the daemon never needs a signing secret.
+*/
+/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */
+const BindMatch = discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
+]);
+/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */
+const IntegrationBindRule = object({
+	channel: string().optional(),
+	thread: string().optional(),
+	match: BindMatch
+});
+/** The Slack config the daemon needs to open + route a socket (no signingSecret). */
+const IntegrationSlackConfig = object({
+	botToken: string(),
+	appToken: string(),
+	allowedUserIds: array(string()).default([]),
+	bindRules: array(IntegrationBindRule).default([])
+});
+/**
+* The Telegram config the daemon needs to open long-polling + route (grammY).
+* Telegram has a SINGLE BotFather HTTP token — no app-level token and no signing
+* secret (long-polling authenticates every getUpdates call with the bot token).
+*/
+const IntegrationTelegramConfig = object({
+	botToken: string(),
+	allowedUserIds: array(string()).default([]),
+	bindRules: array(IntegrationBindRule).default([])
+});
+/**
+* The Discord config the daemon needs to open the Gateway + route (discord.js).
+* Discord authenticates the Gateway with a SINGLE bot token — no Slack-style
+* app-level token and no signing secret. `applicationId` is public metadata (the
+* client id for the OAuth2 bot-invite URL); it is not secret material.
+*/
+const IntegrationDiscordConfig = object({
+	botToken: string(),
+	applicationId: string().optional(),
+	allowedUserIds: array(string()).default([]),
+	bindRules: array(IntegrationBindRule).default([])
+});
+/**
+* One platform integration, owned by exactly one agent. Also the element type of
+* `RegisterOk.integrations[]` (the per-daemon reconcile set). Discriminated on
+* `platform`: the daemon opens a Slack Socket Mode connection, a Telegram
+* long-poll, or a Discord Gateway from whichever variant is delivered.
+*/
+const IntegrationSpec = discriminatedUnion("platform", [
+	object({
+		integrationId: string().uuid(),
+		agentId: string().uuid(),
+		platform: literal("slack"),
+		slack: IntegrationSlackConfig
+	}),
+	object({
+		integrationId: string().uuid(),
+		agentId: string().uuid(),
+		platform: literal("telegram"),
+		telegram: IntegrationTelegramConfig
+	}),
+	object({
+		integrationId: string().uuid(),
+		agentId: string().uuid(),
+		platform: literal("discord"),
+		discord: IntegrationDiscordConfig
+	})
+]);
+/** C→D EVT — install/update an integration on the owning agent's daemon. */
+const IntegrationUpsert = IntegrationSpec;
+/** C→D EVT — remove an integration from the daemon. */
+const IntegrationRemove = object({ integrationId: string().uuid() });
+/** One channel the bot is currently a member of (metadata only — no messages). */
+const IntegrationChannel = object({
+	id: string(),
+	name: string().optional(),
+	isPrivate: boolean().optional()
+});
+/**
+* D→C EVT — the FULL set of channels the integration's bot is a member of
+* (fire-and-forget, latest-wins). Emitted on socket start and whenever the bot
+* is invited to / removed from a channel, so the console can offer per-channel
+* trigger config. Channel names are control metadata, never message content.
+*/
+const IntegrationChannels = object({
+	integrationId: string().uuid(),
+	channels: array(IntegrationChannel)
+});
+//#endregion
+//#region ../protocol/dist/frames/register.js
+/**
+* Capability upload + the reconcile snapshot — protocol §3.3.
+*
+* `register/ok` is the authoritative source of truth: the daemon converges its
+* local cache to it. CP wins all conflicts, so re-issuing the same snapshot is
+* idempotent.
+*/
+const RegisterReq = object({
+	host: string(),
+	capabilities: object({
+		platforms: array(Platform),
+		runtimes: array(string()),
+		acp: boolean(),
+		features: array(string()).default([])
+	}),
+	maxAgents: number().int(),
+	localState: object({
+		assignments: array(string()),
+		crons: array(string()),
+		leases: array(string())
+	})
+});
+/**
+* One relay the daemon SHOULD hold an outbound WS to (shared-bot-relay.md §5).
+* The roster is all-to-all by design: a webchat/webhook landing on ANY relay
+* instance must find this daemon's connection without cross-instance forwarding.
+* That only holds if `url` (the relay's registered `daemonUrl`) routes to that
+* SPECIFIC instance — the daemon confirms the landing spot against
+* `rd/hello/ok.relayId` and treats a mismatch as a deployment misroute.
+*/
+const RelayRosterEntry = object({
+	relayId: string().uuid(),
+	url: string()
+});
+/**
+* C→D EVT (`relay/roster`) — hot roster update (relay registered / swept).
+* Carries the WHOLE desired set, same converge-don't-diff semantics as the
+* `register/ok.relays` snapshot it refreshes.
+*/
+const RelayRosterUpdate = object({ relays: array(RelayRosterEntry) });
+const RegisterOk = object({
+	routingEpoch: number().int(),
+	assignments: array(RouteAssign),
+	agents: array(AgentSpec.extend({ agentId: string().uuid() })).default([]),
+	crons: array(CronUpsert),
+	integrations: array(IntegrationSpec).default([]),
+	leases: array(SecretsGrant),
+	relays: array(RelayRosterEntry).default([]),
+	drop: object({
+		assignments: array(string()),
+		crons: array(string())
+	})
+});
+//#endregion
+//#region ../protocol/dist/frames/gitcred.js
+/**
+* Git credentials (github-app workspaces) — daemon-pulled, CP-minted.
+*
+* The CP holds the GitHub App private key and mints short-lived (1h,
+* non-renewable) installation access tokens scoped to a single repository;
+* the daemon pulls one on demand right before a remote git operation and
+* holds it in memory only. Unlike `secrets/*` (lease + reference semantics,
+* still unwired), the grant here carries the TOKEN MATERIAL itself — same
+* plaintext-over-TLS-WS posture as `integration/upsert`, and the same
+* discipline: **never log the payload**.
+*
+* The daemon may only name an agentId — the CP resolves agent → workspace →
+* repo → installation itself, so a daemon can never pick a repo it wasn't
+* assigned. Failures come back as correlated `error` REPs: `SCOPE_DENIED`
+* (not a github-app workspace, or agent not placed on this daemon — stop
+* asking), `LEASE_DENIED` (installation uninstalled/suspended or the repo
+* left its grant set — recoverable only by an operator), `RATE_LIMITED`,
+* `INTERNAL`.
+*/
+const GitCredRequest = object({
+	agentId: string().uuid(),
+	reason: _enum([
+		"clone",
+		"fetch",
+		"pull",
+		"push",
+		"helper"
+	]).optional()
+});
+const GitCredGrant = object({
+	username: literal("x-access-token"),
+	token: string(),
+	ttlSec: number().int(),
+	expiresAt: string().datetime(),
+	repoFullName: string(),
+	access: _enum(["read", "write"])
+});
+//#endregion
+//#region ../protocol/dist/frames/session.js
+/**
+* Session read-back (C→D REQ → REP) — the console's on-demand pulls.
+*
+* Session bodies are daemon-local (body-locality, §1/§12). The CP may persist a
+* metadata-only session-list snapshot from daemon `event/session` events, while
+* transcript/tool bodies are pulled live from the owning daemon and proxied to
+* the console only for display.
+*
+* - `session/list`: the daemon's local metadata projection, used for snapshots
+*   and direct read-back/debugging.
+* - `session/history`: one cursor-paginated page of a session's transcript.
+*/
+/**
+* Per-session token accounting, metered by the daemon from the agent's ACP usage
+* stream. Token counts are CUMULATIVE across the session's turns (summed from each
+* turn's `PromptResponse.usage`); context/cost are the LATEST snapshot from the
+* agent's `usage_update` stream. Every field is optional — a runtime that reports
+* no usage yields an absent field, not a zero.
+*/
+const SessionUsage = object({
+	totalTokens: number().int().optional(),
+	inputTokens: number().int().optional(),
+	outputTokens: number().int().optional(),
+	thoughtTokens: number().int().optional(),
+	cachedReadTokens: number().int().optional(),
+	cachedWriteTokens: number().int().optional(),
+	contextUsed: number().int().optional(),
+	contextSize: number().int().optional(),
+	costAmount: number().optional(),
+	costCurrency: string().optional()
+});
+/** One row in the session list (metadata + console metrics; NOT the transcript). */
+const SessionListItem = object({
+	sessionId: string(),
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	title: string().optional(),
+	status: string().optional(),
+	lastActivityAt: string().optional(),
+	usage: SessionUsage.optional(),
+	triggeredBy: string().optional(),
+	channelName: string().optional(),
+	triggeredByName: string().optional(),
+	threadUrl: string().optional()
+});
+/** C→D REQ: list the daemon's sessions (optionally just one agent's). */
+const SessionListReq = object({ agentId: string().uuid().optional() });
+/** D→C REP (corr = req id): the daemon's current sessions. */
+const SessionListPage = object({ sessions: array(SessionListItem) });
+object({
+	toolCallId: string(),
+	kind: string().optional(),
+	status: string().optional(),
+	rawInput: unknown().optional(),
+	rawOutput: unknown().optional(),
+	content: array(unknown()).optional(),
+	locations: array(object({
+		path: string(),
+		line: number().int().optional()
+	})).optional(),
+	truncated: boolean().optional()
+});
+/** One message in a session transcript page (a body — returned only for display). */
+const SessionMessage = object({
+	seq: number().int(),
+	sender: string(),
+	senderName: string().optional(),
+	ts: string(),
+	kind: string(),
+	text: string(),
+	toolCallId: string().optional(),
+	toolStatus: string().optional(),
+	toolKind: string().optional(),
+	body: string().optional(),
+	bodyTruncated: boolean().optional(),
+	bodyBytes: number().int().optional()
+});
+/** C→D REQ: fetch one page of a session's history from the owning daemon. */
+const SessionHistoryReq = object({
+	sessionId: string(),
+	cursor: string().optional(),
+	limit: number().int().positive().max(200).default(50)
+});
+/** D→C REP (corr = the req id): a page of messages + the cursor for the next page. */
+const SessionHistoryPage = object({
+	sessionId: string(),
+	messages: array(SessionMessage),
+	nextCursor: string().optional()
+});
+/**
+* C→D REQ: fetch the FULL (untruncated) ToolBody JSON for one tool call, chunked.
+* The inline `SessionMessage.body` preview is capped at 32 KiB; when a body is
+* bigger the console pages the whole thing back through this frame by offset.
+*/
+const SessionToolBodyReq = object({
+	sessionId: string(),
+	toolCallId: string(),
+	offset: number().int().nonnegative().default(0)
+});
+/** D→C REP (corr = the req id): one frame-budgeted byte slice of the full ToolBody JSON. */
+const SessionToolBodyChunk = object({
+	sessionId: string(),
+	toolCallId: string(),
+	data: string(),
+	totalBytes: number().int(),
+	nextOffset: number().int().optional()
+});
+//#endregion
+//#region ../protocol/dist/frames/channel.js
+/**
+* Channel agent directory (D→C REQ → REP) — agent collaboration lookup.
+*
+* An agent asks (via a daemon-side tool) "who else is in this channel?". The
+* daemon forwards it to the CP — the ONLY authority for the FULL channel roster,
+* because agents in one channel may run on different daemons (each daemon knows
+* only its own agents). The CP joins the channel's integrations to their agents
+* and returns their public metadata (name / displayName / description / status).
+* Metadata only — never message content (§1/§12).
+*
+* Direction is daemon→CP (like `auth` / `register`): the daemon sends the REQ and
+* the CP replies with `channel/agents/ok` (corr = the req id).
+*/
+/** One agent visible in a channel — the collaboration directory entry. */
+const ChannelAgent = object({
+	agentId: string().uuid(),
+	name: string(),
+	displayName: string().optional(),
+	description: string().optional(),
+	status: _enum([
+		"active",
+		"inactive",
+		"paused"
+	])
+});
+/** D→C REQ: list the agents in a channel (for the asking agent's collaboration tool). */
+const ChannelAgentsReq = object({
+	platform: Platform,
+	channel: string()
+});
+/** C→D REP (corr = req id): every agent in the channel across all daemons. */
+const ChannelAgentsOk = object({
+	platform: Platform,
+	channel: string(),
+	agents: array(ChannelAgent)
+});
+//#endregion
+//#region ../protocol/dist/frames/workspace.js
+/**
+* Agent workspace file browsing (C→D REQ → REP) — the console's on-demand pulls.
+*
+* The CP stores NO workspace data — directory listings and file bytes are pulled
+* live from the owning daemon and proxied to the console, never persisted
+* (body-locality). Missing paths are DATA (`exists:false`), not errors; only
+* path-containment violations (`BAD_PAYLOAD`) and unexpected fs failures
+* (`INTERNAL`) come back as `error` frames.
+*
+* - `workspace/list`: one cursor-paginated page of a directory's entries.
+* - `workspace/read`: one byte slice of a file. `limit` is only a ceiling — the
+*   daemon returns FEWER bytes when needed to keep the JSON-escaped REP under the
+*   256 KiB frame cap (control bytes escape to `\uXXXX`, a 6× blowup), and always
+*   ends the slice on a UTF-8 character boundary. `nextOffset` is the authoritative
+*   byte offset to request next — callers must NOT recompute it from the decoded
+*   `content` (a split multi-byte char would make the byte count drift).
+*/
+/** One directory entry in a workspace listing (name-only; not a full path). */
+const WorkspaceEntry = object({
+	name: string(),
+	type: _enum([
+		"dir",
+		"file",
+		"symlink",
+		"other"
+	]),
+	size: number().int().nonnegative().optional(),
+	mtime: string().optional()
+});
+/** C→D REQ: list one page of a directory in the agent's workspace. */
+const WorkspaceListReq = object({
+	agentId: string().min(1),
+	path: string().default(""),
+	cursor: string().optional(),
+	limit: number().int().positive().max(500).default(200)
+});
+/** D→C REP (corr = the req id): a page of entries + the cursor for the next page. */
+const WorkspaceListPage = object({
+	agentId: string(),
+	path: string(),
+	exists: boolean(),
+	entries: array(WorkspaceEntry),
+	nextCursor: string().optional()
+});
+/** C→D REQ: read one byte slice of a file in the agent's workspace. */
+const WorkspaceReadReq = object({
+	agentId: string().min(1),
+	path: string().min(1),
+	offset: number().int().nonnegative().default(0),
+	limit: number().int().positive().max(65536).default(65536)
+});
+/** D→C REP (corr = the req id): the file slice (or `exists:false` / binary-detected). */
+const WorkspaceReadContent = object({
+	agentId: string(),
+	path: string(),
+	exists: boolean(),
+	size: number().int().nonnegative().optional(),
+	mtime: string().optional(),
+	encoding: _enum(["utf8", "none"]).optional(),
+	content: string().optional(),
+	offset: number().int().nonnegative().optional(),
+	nextOffset: number().int().nonnegative().optional(),
+	truncated: boolean().optional()
+});
+/**
+* Agent workspace git ops (C→D REQ → REP) — the console's on-demand controls for
+* a git-repo workspace. Like list/read these run daemon-local; the CP proxies the
+* outcome and stores nothing.
+*
+* These are DATA-oriented: a non-repo workspace (`isRepo:false`), a dirty tree,
+* or a pull that can't fast-forward (offline, diverged, local edits) all come
+* back as a normal REP — NOT an `error` frame. Only an unknown agent
+* (`BAD_PAYLOAD`) or an unexpected git/fs failure (`INTERNAL`) is an error.
+*/
+/** C→D REQ: report `git status` of the agent's workspace (is it clean?). */
+const WorkspaceGitStatusReq = object({ agentId: string().min(1) });
+/** One changed path in a `git status`. `index`/`workingDir` are git's per-file XY
+*  status chars (' ', 'M', 'A', 'D', 'R', 'C', 'U', '?', …). */
+const WorkspaceGitFile = object({
+	path: string(),
+	index: string(),
+	workingDir: string()
+});
+/** The HEAD commit of the checkout. */
+const WorkspaceGitCommit = object({
+	sha: string(),
+	shortSha: string(),
+	subject: string(),
+	committedAt: string()
+});
+/** D→C REP (corr = the req id): the working-tree status. */
+const WorkspaceGitStatus = object({
+	agentId: string(),
+	isRepo: boolean(),
+	clean: boolean(),
+	branch: string().optional(),
+	tracking: string().optional(),
+	ahead: number().int().nonnegative().optional(),
+	behind: number().int().nonnegative().optional(),
+	files: array(WorkspaceGitFile).optional(),
+	truncated: boolean().optional(),
+	lastCommit: WorkspaceGitCommit.optional(),
+	lastFetchAt: string().optional()
+});
+/** C→D REQ: force a fast-forward-only `git pull` in the agent's workspace now. */
+const WorkspaceGitPullReq = object({ agentId: string().min(1) });
+/** D→C REP (corr = the req id): the pull outcome. A failed pull is DATA
+*  (`ok:false` + `detail`), not an error frame (see the section docblock). */
+const WorkspaceGitPullResult = object({
+	agentId: string(),
+	isRepo: boolean(),
+	ok: boolean(),
+	detail: string().optional(),
+	changed: number().int().nonnegative().optional(),
+	insertions: number().int().nonnegative().optional(),
+	deletions: number().int().nonnegative().optional()
+});
+//#endregion
+//#region ../protocol/dist/frames/memory.js
+/**
+* Agent memory directory (C→D REQ → REP) — the console's read/write of an agent's
+* long-term memory, and the surface the daemon serves it from.
+*
+* Memory is a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE the
+* workspace — so it survives a workspace reset / re-clone and is never committed
+* into a github-workspace repo. It follows the index-plus-topics shape: a lean
+* `MEMORY.md` index (injected into the prompt every session, bounded) plus any
+* number of `<topic>.md` files the agent reads on demand. The agent maintains it
+* via MCP tools; these frames are the third channel — the CP reading/writing it
+* for the console — all pointing at the same directory.
+*
+* The CP stores NO memory content — bytes are pulled live from the owning daemon
+* and proxied to the console, never persisted (body-locality). A not-yet-created
+* file/dir is DATA (`exists:false`), not an error; only an unknown agent or a
+* path-containment violation (`BAD_PAYLOAD`) or an unexpected fs failure
+* (`INTERNAL`) comes back as an `error` frame.
+*
+* - `memory/list`: the topic files in the memory dir (flat; the index + topics).
+* - `memory/read`: one byte slice of a memory file (`path` relative to the memory
+*   dir; default `MEMORY.md`). `limit` is a ceiling — the daemon returns fewer
+*   bytes to keep the JSON-escaped REP under the 256 KiB frame cap and always ends
+*   on a UTF-8 boundary. `nextOffset` is authoritative — do NOT recompute it.
+* - `memory/write`: replace the whole named memory file with `content`.
+*/
+/** The default file name of the memory index (loaded into the prompt each session). */
+const MEMORY_INDEX = "MEMORY.md";
+/** One entry in a memory-dir listing (name-only; not a path). */
+const MemoryEntry = object({
+	name: string(),
+	size: number().int().nonnegative(),
+	mtime: string()
+});
+/** C→D REQ: list the files in the agent's memory dir. */
+const MemoryListReq = object({ agentId: string().min(1) });
+/** D→C REP (corr = the req id): the memory dir's files (or `exists:false`). */
+const MemoryListPage = object({
+	agentId: string(),
+	exists: boolean(),
+	entries: array(MemoryEntry)
+});
+/** C→D REQ: read one byte slice of a memory file (path relative to the memory dir). */
+const MemoryReadReq = object({
+	agentId: string().min(1),
+	path: string().default(MEMORY_INDEX),
+	offset: number().int().nonnegative().default(0),
+	limit: number().int().positive().max(65536).default(65536)
+});
+/** D→C REP (corr = the req id): the memory file slice (or `exists:false`). Always utf8 text. */
+const MemoryReadContent = object({
+	agentId: string(),
+	path: string(),
+	exists: boolean(),
+	size: number().int().nonnegative().optional(),
+	mtime: string().optional(),
+	content: string().optional(),
+	offset: number().int().nonnegative().optional(),
+	nextOffset: number().int().nonnegative().optional(),
+	truncated: boolean().optional()
+});
+/** C→D REQ: replace the whole named memory file with `content` (console edit). */
+const MemoryWriteReq = object({
+	agentId: string().min(1),
+	path: string().default(MEMORY_INDEX),
+	content: string(),
+	ifMatchMtime: string().optional()
+});
+/** D→C REP (corr = the req id): the written state, so the console can refresh. */
+const MemoryWriteOk = object({
+	agentId: string(),
+	path: string(),
+	size: number().int().nonnegative(),
+	mtime: string()
+});
+//#endregion
+//#region ../protocol/dist/frames/telemetry.js
+/**
+* Telemetry & facts (D→C) — protocol §7.
+*
+* The dashboard's real-time source. `event/session` is the converged milestone
+* feed (NOT the message stream); `facts/daemon-runtimes` is the observed runtime
+* capability feed; `heartbeat` drives the watchdog.
+*/
+const Heartbeat = object({
+	load: object({
+		cpu: number(),
+		mem: number(),
+		agents: number().int()
+	}),
+	health: _enum(["ok", "degraded"]),
+	activeSessions: number().int(),
+	degradedScopes: array(string()).default([])
+});
+/** Converged session lifecycle milestone — protocol §7.2. NOT the message stream. */
+const EventSession = object({
+	sessionId: string(),
+	agentId: string().uuid(),
+	launchId: string().uuid().optional(),
+	phase: _enum([
+		"start",
+		"plan",
+		"problem",
+		"end"
+	]),
+	platform: Platform.optional(),
+	channel: string().optional(),
+	thread: string().optional(),
+	link: string().optional(),
+	summary: string().optional(),
+	title: string().optional(),
+	status: string().optional(),
+	lastActivityAt: string().datetime().optional(),
+	triggeredBy: string().optional(),
+	channelName: string().optional(),
+	triggeredByName: string().optional(),
+	threadUrl: string().optional(),
+	ts: string().datetime()
+});
+/**
+* Per-session token-usage report — D→C EVT. The daemon meters usage from the
+* agent's ACP stream and reports the session's CUMULATIVE snapshot (latest-wins)
+* so the CP can persist it for the console's historical usage aggregates. This is
+* dashboard metadata (token counts + cost), never the message stream. Idempotent
+* by `sessionId`: re-sending the same snapshot is a no-op upsert on the CP.
+*/
+const UsageReport = object({
+	sessionId: string(),
+	agentId: string().uuid(),
+	platform: string().optional(),
+	channel: string().optional(),
+	lastActivityAt: string(),
+	usage: SessionUsage
+});
+/**
+* Observed capabilities of an installed runtime — protocol §7.3. The element
+* type of the `facts/daemon-runtimes` snapshot. As a standalone per-runtime
+* frame (`facts/runtime-profile`, upsert-only) it is DEPRECATED: current
+* daemons report the full snapshot instead; the CP keeps accepting the old
+* frame from older daemons.
+*/
+/**
+* MCP transports a runtime accepts on `session/new` `mcpServers` (from the ACP
+* `initialize` response's `agentCapabilities.mcpCapabilities`). Stdio is the ACP
+* baseline every agent must accept, so only the optional transports are listed.
+*/
+const McpTransportCapabilities = object({
+	http: boolean(),
+	sse: boolean()
+});
+const FactsRuntimeProfile = object({
+	runtime: string(),
+	version: string(),
+	models: array(string()),
+	contextWindow: number().int().optional(),
+	acpSupport: _enum([
+		"full",
+		"partial",
+		"none"
+	]),
+	acpProtocolVersion: number().int().optional(),
+	toolCalling: boolean(),
+	mcpCapabilities: McpTransportCapabilities.optional()
+});
+/**
+* Probe result for one daemon-configured MCP server (daemon config `mcpServers`).
+* The daemon connects to the server (MCP initialize + `tools/list`) so the
+* console can show what each server offers before the user enables it on an
+* agent. Metadata only — definitions (commands, URLs, headers) stay daemon-local.
+*/
+const FactsMcpServer = object({
+	name: string(),
+	transport: _enum([
+		"stdio",
+		"http",
+		"sse"
+	]),
+	/** True iff the MCP handshake succeeded. */
+	ok: boolean(),
+	tools: array(string()).default([]),
+	version: string().optional(),
+	error: string().optional()
+});
+/**
+* Full snapshot of the daemon's installed runtimes — D→C EVT (protocol §7.3a),
+* emitted on each register and again once the background probe sweep completes
+* (with the learned `models[]`). REPLACE semantics: the CP reconciles its
+* stored runtime list for the daemon to exactly `runtimes[]`, pruning runtimes
+* that are no longer installed. Idempotent (latest-wins). Supersedes the
+* per-runtime `facts/runtime-profile` upsert.
+*/
+const DaemonRuntimes = object({
+	runtimes: array(FactsRuntimeProfile),
+	mcpServers: array(FactsMcpServer).default([])
+});
+/** Non-secret config update — C→D EVT, protocol §8.3 / frame #26. */
+const ConfigPush = object({ keys: record(string(), unknown()) });
+/** Fleet: drain+exit, supervisor restarts — C→D REQ, protocol §8.3 / frame #27. */
+const DaemonRestart = object({
+	reason: string(),
+	drainFirst: boolean().default(true)
+});
+/** Fleet: drain+exit for version bump — C→D REQ, protocol §8.3 / frame #28. */
+const DaemonUpgrade = object({
+	targetVersion: string(),
+	drainFirst: boolean().default(true)
+});
+/** Reply to a fleet restart/upgrade REQ (protocol §8.3). */
+const DaemonControlAck = object({
+	accepted: boolean(),
+	willDrainUntil: string().datetime().optional()
+});
+/**
+* Generic acknowledgement for REQs whose reply is just `ack` in the frame index
+* (cron/upsert, cron/remove, agent/stop). Kept permissive but typed.
+*/
+const Ack = object({
+	ok: boolean(),
+	reason: string().optional()
+});
+const ErrorFrame = object({
+	code: _enum([
+		"UNKNOWN_FRAME",
+		"FRAME_TOO_LARGE",
+		"PROTOCOL_STATE",
+		"BAD_PAYLOAD",
+		"AUTH_FAILED",
+		"ATTESTATION_INVALID",
+		"STALE_EPOCH",
+		"STALE_LAUNCH",
+		"NO_SESSION",
+		"SCOPE_DENIED",
+		"LEASE_EXPIRED",
+		"LEASE_DENIED",
+		"RATE_LIMITED",
+		"CONFLICT",
+		"INTERNAL"
+	]),
+	message: string(),
+	retryable: boolean(),
+	details: record(string(), unknown()).optional()
+});
+object({
+	accepted: boolean(),
+	turnId: string().uuid(),
+	reason: _enum([
+		"queued",
+		"no_agent",
+		"busy",
+		"paused",
+		"draining"
+	]).optional()
+});
+const WebchatEvent = discriminatedUnion("kind", [
+	object({
+		kind: literal("message"),
+		text: string()
+	}),
+	object({
+		kind: literal("thinking"),
+		text: string()
+	}),
+	object({
+		kind: literal("tool_call"),
+		toolCallId: string(),
+		title: string(),
+		status: string()
+	}),
+	object({
+		kind: literal("tool_update"),
+		toolCallId: string(),
+		status: string()
+	}),
+	object({
+		kind: literal("session_info"),
+		title: string()
+	})
+]);
+const WebchatStatus = object({
+	model: string().optional(),
+	effort: string().optional(),
+	permissionMode: string().optional(),
+	fastMode: boolean().optional(),
+	contextUsed: number().int().optional(),
+	contextSize: number().int().optional(),
+	totalTokens: number().int().optional(),
+	costAmount: number().optional(),
+	costCurrency: string().optional(),
+	models: array(string()).optional(),
+	efforts: array(string()).optional(),
+	permissionModes: array(string()).optional(),
+	fastModeAvailable: boolean().optional(),
+	sessionId: string().optional()
+});
+const WebchatOutput = object({
+	conversationId: string().uuid(),
+	turnId: string().uuid(),
+	index: number().int(),
+	event: WebchatEvent.optional(),
+	status: WebchatStatus.optional()
+}).refine((o) => o.event !== void 0 || o.status !== void 0, { message: "WebchatOutput must carry event and/or status" });
+const WebchatDone = object({
+	conversationId: string().uuid(),
+	turnId: string().uuid(),
+	stopReason: string().optional(),
+	usage: object({
+		used: number().int().optional(),
+		cost: number().optional()
+	}).optional(),
+	error: string().optional()
+});
+//#endregion
+//#region ../protocol/dist/frame.js
+/**
+* The single source of truth for the wire: `type` string → payload zod schema.
+*
+* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
+* frames) plus the correlated REP types named in the "Reply" column
+* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
+* travel on the wire and must be decodable.
+*
+* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
+* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
+*/
+const FRAME_SCHEMAS = {
+	auth: AuthReq,
+	"auth/ok": AuthOk,
+	register: RegisterReq,
+	"register/ok": RegisterOk,
+	"relay/roster": RelayRosterUpdate,
+	heartbeat: Heartbeat,
+	"agent/launch": AgentLaunch,
+	"agent/launched": AgentLaunched,
+	"agent/stop": AgentStop,
+	"agent/upsert": AgentUpsert,
+	"agent/remove": AgentRemove,
+	"agent/activity": AgentActivity,
+	"agent/scope-denied": AgentScopeDenied,
+	"route/assign": RouteAssign,
+	"route/assign/ack": RouteAssignAck,
+	"route/update": RouteUpdate,
+	"daemon/drain": Drain,
+	"drain/progress": DrainProgress,
+	"drain/done": DrainDone,
+	"cron/upsert": CronUpsert,
+	"cron/remove": CronRemove,
+	"cron/report": CronReport,
+	"cron/run": CronRunNow,
+	"integration/upsert": IntegrationUpsert,
+	"integration/remove": IntegrationRemove,
+	"integration/channels": IntegrationChannels,
+	"gitcred/request": GitCredRequest,
+	"gitcred/grant": GitCredGrant,
+	"secrets/request": SecretsRequest,
+	"secrets/grant": SecretsGrant,
+	"secrets/renew": SecretsRenew,
+	"secrets/revoke": SecretsRevoke,
+	"scope-attestation": ScopeAttestation,
+	"event/session": EventSession,
+	"usage/report": UsageReport,
+	"facts/runtime-profile": FactsRuntimeProfile,
+	"facts/daemon-runtimes": DaemonRuntimes,
+	"session/list": SessionListReq,
+	"session/list/page": SessionListPage,
+	"session/history": SessionHistoryReq,
+	"session/history/page": SessionHistoryPage,
+	"session/tool-body": SessionToolBodyReq,
+	"session/tool-body/chunk": SessionToolBodyChunk,
+	"channel/agents": ChannelAgentsReq,
+	"channel/agents/ok": ChannelAgentsOk,
+	"workspace/list": WorkspaceListReq,
+	"workspace/list/page": WorkspaceListPage,
+	"workspace/read": WorkspaceReadReq,
+	"workspace/read/content": WorkspaceReadContent,
+	"workspace/gitstatus": WorkspaceGitStatusReq,
+	"workspace/gitstatus/result": WorkspaceGitStatus,
+	"workspace/gitpull": WorkspaceGitPullReq,
+	"workspace/gitpull/result": WorkspaceGitPullResult,
+	"memory/list": MemoryListReq,
+	"memory/list/page": MemoryListPage,
+	"memory/read": MemoryReadReq,
+	"memory/read/content": MemoryReadContent,
+	"memory/write": MemoryWriteReq,
+	"memory/write/ok": MemoryWriteOk,
+	"config/push": ConfigPush,
+	"daemon/restart": DaemonRestart,
+	"daemon/upgrade": DaemonUpgrade,
+	"daemon/control/ack": DaemonControlAck,
+	ack: Ack,
+	error: ErrorFrame
+};
+Object.keys(FRAME_SCHEMAS);
+/**
+* Builds the envelope schema for one frame `type` with a `type` literal and the
+* typed payload, so the discriminated union infers `payload` precisely.
+*
+* Kept as a local generic (payload pinned to `FRAME_SCHEMAS[T]`) so a
+* mispaired member — `frame('auth', FRAME_SCHEMAS['register'])` — is a compile
+* error; a bare `frameSchema` alias would accept it. The body is deliberately
+* inlined rather than delegated: `return frameSchema(type, payload)` under
+* THIS generic signature collapses every union member's `payload` to `unknown`
+* (113 × TS18046 under TS 6.0.3 / zod 4.4.3 — reproducible by making exactly
+* that substitution), while the small relay unions call `frameSchema` with
+* concrete schemas and infer fine.
+*/
+function frame(type, payload) {
+	return object({
+		v: literal(1),
+		id: string().uuid(),
+		ts: string().datetime(),
+		type: literal(type),
+		corr: string().uuid().optional(),
+		payload
+	});
+}
+discriminatedUnion("type", [
+	frame("auth", FRAME_SCHEMAS["auth"]),
+	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
+	frame("register", FRAME_SCHEMAS["register"]),
+	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
+	frame("relay/roster", FRAME_SCHEMAS["relay/roster"]),
+	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
+	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
+	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
+	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
+	frame("agent/upsert", FRAME_SCHEMAS["agent/upsert"]),
+	frame("agent/remove", FRAME_SCHEMAS["agent/remove"]),
+	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
+	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
+	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
+	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
+	frame("route/update", FRAME_SCHEMAS["route/update"]),
+	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
+	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
+	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
+	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
+	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
+	frame("cron/report", FRAME_SCHEMAS["cron/report"]),
+	frame("cron/run", FRAME_SCHEMAS["cron/run"]),
+	frame("integration/upsert", FRAME_SCHEMAS["integration/upsert"]),
+	frame("integration/remove", FRAME_SCHEMAS["integration/remove"]),
+	frame("integration/channels", FRAME_SCHEMAS["integration/channels"]),
+	frame("gitcred/request", FRAME_SCHEMAS["gitcred/request"]),
+	frame("gitcred/grant", FRAME_SCHEMAS["gitcred/grant"]),
+	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
+	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
+	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
+	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
+	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
+	frame("event/session", FRAME_SCHEMAS["event/session"]),
+	frame("usage/report", FRAME_SCHEMAS["usage/report"]),
+	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
+	frame("facts/daemon-runtimes", FRAME_SCHEMAS["facts/daemon-runtimes"]),
+	frame("session/list", FRAME_SCHEMAS["session/list"]),
+	frame("session/list/page", FRAME_SCHEMAS["session/list/page"]),
+	frame("session/history", FRAME_SCHEMAS["session/history"]),
+	frame("session/history/page", FRAME_SCHEMAS["session/history/page"]),
+	frame("session/tool-body", FRAME_SCHEMAS["session/tool-body"]),
+	frame("session/tool-body/chunk", FRAME_SCHEMAS["session/tool-body/chunk"]),
+	frame("channel/agents", FRAME_SCHEMAS["channel/agents"]),
+	frame("channel/agents/ok", FRAME_SCHEMAS["channel/agents/ok"]),
+	frame("workspace/list", FRAME_SCHEMAS["workspace/list"]),
+	frame("workspace/list/page", FRAME_SCHEMAS["workspace/list/page"]),
+	frame("workspace/read", FRAME_SCHEMAS["workspace/read"]),
+	frame("workspace/read/content", FRAME_SCHEMAS["workspace/read/content"]),
+	frame("workspace/gitstatus", FRAME_SCHEMAS["workspace/gitstatus"]),
+	frame("workspace/gitstatus/result", FRAME_SCHEMAS["workspace/gitstatus/result"]),
+	frame("workspace/gitpull", FRAME_SCHEMAS["workspace/gitpull"]),
+	frame("workspace/gitpull/result", FRAME_SCHEMAS["workspace/gitpull/result"]),
+	frame("memory/list", FRAME_SCHEMAS["memory/list"]),
+	frame("memory/list/page", FRAME_SCHEMAS["memory/list/page"]),
+	frame("memory/read", FRAME_SCHEMAS["memory/read"]),
+	frame("memory/read/content", FRAME_SCHEMAS["memory/read/content"]),
+	frame("memory/write", FRAME_SCHEMAS["memory/write"]),
+	frame("memory/write/ok", FRAME_SCHEMAS["memory/write/ok"]),
+	frame("config/push", FRAME_SCHEMAS["config/push"]),
+	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
+	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
+	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
+	frame("ack", FRAME_SCHEMAS["ack"]),
+	frame("error", FRAME_SCHEMAS["error"])
+]);
+//#endregion
+//#region ../protocol/dist/wire.js
+/**
+* Generic envelope codec — the schema-map-agnostic core shared by every wire.
+*
+* The daemon↔CP wire (`codec.ts` over `FRAME_SCHEMAS`) and the two relay wires
+* (`frames/relay-cp.ts` / `frames/relay-daemon.ts` over their OWN maps) all
+* decode the same envelope shape but accept disjoint frame families — a relay
+* socket must answer a daemon↔CP frame with `UNKNOWN_FRAME`, and vice versa
+* (shared-bot-relay.md §8 "独立帧 union，不混入 daemon 协议").
+*/
+/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
+const MAX_FRAME_BYTES = 256 * 1024;
+const textEncoder = new TextEncoder();
+function byteLength(text) {
+	return textEncoder.encode(text).length;
+}
+function extractControlExt(json) {
+	if (typeof json !== "object" || json === null) return void 0;
+	const o = json;
+	const ext = {};
+	if (typeof o.epoch === "number") ext.epoch = o.epoch;
+	if (typeof o.agentId === "string") ext.agentId = o.agentId;
+	if (typeof o.launchId === "string") ext.launchId = o.launchId;
+	return Object.keys(ext).length > 0 ? ext : void 0;
+}
+/**
+* Decode one wire frame against `schemas` (the wire's `type` → payload map).
+* Two-step parse: envelope first, then the per-type payload schema — an unknown
+* `type` is a typed `UNKNOWN_FRAME` failure (a REP, never a hard close).
+*/
+function decodeEnvelopeWith(schemas, text) {
+	if (byteLength(text) > 262144) return {
+		ok: false,
+		id: NIL_UUID,
+		msg: "FRAME_TOO_LARGE"
+	};
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		return {
+			ok: false,
+			id: NIL_UUID,
+			msg: "invalid json"
+		};
+	}
+	const env = Envelope.safeParse(json);
+	if (!env.success) return {
+		ok: false,
+		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
+		msg: env.error.message
+	};
+	const schema = schemas[env.data.type];
+	if (!schema) return {
+		ok: false,
+		id: env.data.id,
+		msg: "UNKNOWN_FRAME"
+	};
+	const payload = schema.safeParse(env.data.payload);
+	if (!payload.success) return {
+		ok: false,
+		id: env.data.id,
+		msg: payload.error.message
+	};
+	const ext = extractControlExt(json);
+	return {
+		ok: true,
+		frame: {
+			...env.data,
+			payload: payload.data
+		},
+		...ext ? { ext } : {}
+	};
+}
+/**
+* Wrap a payload in the wire envelope. Untyped core — each wire exports a typed
+* wrapper (`buildEnvelope` / `buildRelayCpFrame` / `buildRelayDaemonFrame`) that
+* pins `type` to its own union and casts the result.
+*/
+function buildEnvelopeRaw(type, payload, opts = {}) {
+	return {
+		v: 1,
+		id: opts.id ?? randomUUID(),
+		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+		type,
+		payload,
+		...opts.corr ? { corr: opts.corr } : {},
+		...opts.ext ?? {}
+	};
+}
+//#endregion
+//#region ../protocol/dist/codec.js
+function decodeEnvelope(text) {
+	return decodeEnvelopeWith(FRAME_SCHEMAS, text);
+}
+function buildEnvelope(type, payload, opts = {}) {
+	return buildEnvelopeRaw(type, payload, opts);
+}
+function encode(frame) {
+	return JSON.stringify(frame);
+}
+//#endregion
+//#region ../protocol/dist/frames/relay-daemon.js
+/**
+* relay↔daemon frames (`rd/*`) — shared-bot-relay.md §7.2.
+*
+* The daemon dials OUT to every relay in its roster (one WS per (daemon, relay)
+* pair, multiplexing every source). This wire CARRIES MESSAGE CONTENT — it is
+* the ingress data plane — so nothing on it is ever logged with its payload.
+*
+* Direction per frame:
+*  - `rd/hello` (+ `rd/hello/ok`)  D→R REQ / R→D REP — authenticate the dial-in
+*  - `rd/msg`                      R→D REQ — one inbound item, already routed
+*  - `rd/ack`                      D→R REP — receipt (+ webchat turn verdict)
+*  - `rd/chat`                     D→R EVT — webchat output stream back to the
+*                                  browser (webchat is the one BIDIRECTIONAL
+*                                  source: its far end hangs off the relay)
+*
+* Milestone A carries the webchat slice only; `im` (shared bot) and `hook`
+* (webhook) members join the `rd/msg` union with milestone B.
+*/
+/** Subprotocol negotiated on the relay↔daemon socket. */
+const RELAY_DAEMON_SUBPROTOCOL = "agentconnect.rd.v1";
+/** The canonical path the relay mounts its daemon-facing `rd/*` server at, and
+*  the daemon appends to a roster `daemonUrl` origin when dialing (mirrors the
+*  daemon↔CP `/daemon/ws` convention). A roster url already ending in it is used
+*  verbatim. */
+const RELAY_DAEMON_WS_PATH = "/rd/ws";
+const RdHello = object({
+	apiKey: string().min(1),
+	daemonId: string().uuid()
+});
+const RdHelloOk = object({ relayId: string().uuid() });
+const RelayWebchatOp = discriminatedUnion("op", [
+	object({
+		op: literal("turn"),
+		text: string(),
+		user: string().optional()
+	}),
+	object({
+		op: literal("set_model"),
+		model: string()
+	}),
+	object({
+		op: literal("set_effort"),
+		effort: string()
+	}),
+	object({
+		op: literal("set_permission_mode"),
+		permissionMode: string()
+	}),
+	object({
+		op: literal("set_fast"),
+		fastMode: boolean()
+	}),
+	object({ op: literal("cancel") }),
+	object({ op: literal("close") })
+]);
+const RdMsg = discriminatedUnion("source", [object({
+	source: literal("webchat"),
+	agentId: string().uuid(),
+	sessionKey: string().min(1),
+	msgId: string().min(1),
+	chatId: string().uuid(),
+	payload: RelayWebchatOp
+})]);
+const RdAck = object({
+	msgId: string(),
+	accepted: boolean(),
+	turnId: string().uuid().optional(),
+	reason: string().optional()
+});
+const RdChatEvent = discriminatedUnion("kind", [object({
+	kind: literal("output"),
+	output: WebchatOutput
+}), object({
+	kind: literal("done"),
+	done: WebchatDone
+})]);
+/** `type` string → payload schema for the relay↔daemon wire. */
+const RELAY_DAEMON_SCHEMAS = {
+	"rd/hello": RdHello,
+	"rd/hello/ok": RdHelloOk,
+	"rd/msg": RdMsg,
+	"rd/ack": RdAck,
+	"rd/chat": object({
+		chatId: string().uuid(),
+		seq: number().int(),
+		event: RdChatEvent
+	}),
+	error: ErrorFrame
+};
+Object.keys(RELAY_DAEMON_SCHEMAS);
+discriminatedUnion("type", [
+	frameSchema("rd/hello", RELAY_DAEMON_SCHEMAS["rd/hello"]),
+	frameSchema("rd/hello/ok", RELAY_DAEMON_SCHEMAS["rd/hello/ok"]),
+	frameSchema("rd/msg", RELAY_DAEMON_SCHEMAS["rd/msg"]),
+	frameSchema("rd/ack", RELAY_DAEMON_SCHEMAS["rd/ack"]),
+	frameSchema("rd/chat", RELAY_DAEMON_SCHEMAS["rd/chat"]),
+	frameSchema("error", RELAY_DAEMON_SCHEMAS["error"])
+]);
+/** Decode one relay↔daemon wire frame (envelope + typed payload). */
+function decodeRelayDaemonFrame(text) {
+	return decodeEnvelopeWith(RELAY_DAEMON_SCHEMAS, text);
+}
+/** Build a relay↔daemon frame with a compile-time-typed payload. */
+function buildRelayDaemonFrame(type, payload, opts = {}) {
+	return buildEnvelopeRaw(type, payload, opts);
+}
+//#endregion
+//#region ../protocol/dist/git-url.js
+/**
+* Git repo address helpers, shared by the CP (normalize on write) and the
+* daemon (defensive normalize before clone).
+*
+* STORAGE INVARIANT: `workspace.gitRepo` is persisted as a FULL cloneable git
+* address (e.g. `https://github.com/acme/infra`), never the `acme/infra`
+* shorthand a user may type. UIs shorten it back to `org/repo` for display
+* with `gitRepoLabel`.
+*/
+/** Scheme-full address: https://, ssh://, git://, file://, … */
+const SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** scp-like ssh address: git@github.com:acme/infra(.git) */
+const SCP_RE = /^[\w.-]+@[\w.-]+:(.+)$/;
+/**
+* Normalize a user-supplied repo reference into a full cloneable git address.
+* Idempotent — full addresses pass through unchanged.
+*
+* - `https://…` / `ssh://…` / `git://…` / `git@host:…` → as-is
+* - `github.com/acme/infra` (host-prefixed shorthand)  → `https://github.com/acme/infra`
+* - `acme/infra` (bare org/repo)                       → `https://github.com/acme/infra`
+* - anything else (e.g. a local path) → as-is
+*/
+function normalizeGitUrl(input) {
+	const s = input.trim().replace(/\/+$/, "");
+	if (!s || SCHEME_RE.test(s) || SCP_RE.test(s)) return s;
+	const segments = s.split("/");
+	if (segments.length >= 3 && segments[0].includes(".")) return `https://${s}`;
+	if (segments.length === 2 && segments.every((p) => p.length > 0)) return `https://github.com/${s}`;
+	return s;
+}
+//#endregion
+//#region ../protocol/dist/index.js
+/**
+* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
+* `AnyFrame` to the member whose `type` matches.
+*/
+function isFrame(type) {
+	return (frame) => frame.type === type;
+}
+//#endregion
+//#region src/config/config-schema.ts
+/** The `{name, value}[]` shape shared by runtime env, MCP env, and MCP headers. */
+const NameValueList = array(object({
+	name: string(),
+	value: string()
+})).default([]);
+const RuntimeDefSchema = object({
+	command: string(),
+	args: array(string()).default([]),
+	env: NameValueList
+});
+const McpServerDefSchema = object({
+	transport: _enum([
+		"stdio",
+		"http",
+		"sse"
+	]).default("stdio"),
+	command: string().optional(),
+	args: array(string()).default([]),
+	env: NameValueList,
+	url: string().optional(),
+	headers: NameValueList
+}).superRefine((def, ctx) => {
+	if (def.transport === "stdio" && !def.command) ctx.addIssue({
+		code: "custom",
+		path: ["command"],
+		message: "a stdio MCP server requires \"command\""
+	});
+	if (def.transport !== "stdio" && !def.url) ctx.addIssue({
+		code: "custom",
+		path: ["url"],
+		message: `a ${def.transport} MCP server requires "url"`
+	});
+});
+const ConfigSchema = object({
+	version: literal(1),
+	daemonId: string().optional(),
+	webAppUrl: string().optional(),
+	controlPlane: object({
+		enabled: boolean().default(true),
+		url: string().optional(),
+		key: string().optional(),
+		heartbeatMs: number().int().default(15e3)
+	}).default({
+		enabled: false,
+		heartbeatMs: 15e3
+	}),
+	agentsDir: string().optional(),
+	runtimes: record(string(), RuntimeDefSchema).optional(),
+	mcpServers: record(string(), McpServerDefSchema).optional(),
+	relays: array(RelayRosterEntry).default([]),
+	logging: object({ level: _enum([
+		"trace",
+		"debug",
+		"info",
+		"warn",
+		"error"
+	]).default("info") }).default({ level: "info" }),
+	limits: object({
+		maxAgents: number().int().default(8),
+		maxConcurrentSessions: number().int().default(32),
+		agentIdleTimeoutMs: number().int().default(9e5),
+		idleSweepMs: number().int().default(6e4),
+		shutdownDrainMs: number().int().default(25e3),
+		cancelBackstopMs: number().int().default(3e4),
+		agentStartAttempts: number().int().min(1).default(3),
+		agentStartBackoffMs: number().int().min(0).default(500),
+		maxAttachmentBytes: number().int().default(8 * 1024 * 1024)
+	}).default({
+		maxAgents: 8,
+		maxConcurrentSessions: 32,
+		agentIdleTimeoutMs: 9e5,
+		idleSweepMs: 6e4,
+		shutdownDrainMs: 25e3,
+		cancelBackstopMs: 3e4,
+		agentStartAttempts: 3,
+		agentStartBackoffMs: 500,
+		maxAttachmentBytes: 8 * 1024 * 1024
+	})
+});
+//#endregion
+//#region src/config/load-config.ts
+function loadConfig(opts = {}) {
+	const root = resolveRoot(opts.root);
+	const file = opts.configPath ?? configPath(root);
+	let raw;
+	if (existsSync(file)) raw = JSON.parse(readFileSync(file, "utf8"));
+	else if (opts.autoCreate) {
+		raw = { version: 1 };
+		mkdirSync(dirname(file), { recursive: true });
+		writeFileSync(file, JSON.stringify(raw, null, 2) + "\n");
+	} else if (opts.optional) raw = { version: 1 };
+	else throw new Error(`config not found: ${file} (create it, pass --config, or run \`agentconnect login\`)`);
+	const cfg = ConfigSchema.parse(raw);
+	const o = opts.overrides ?? {};
+	if (o.daemonId) cfg.daemonId = o.daemonId;
+	if (o.logLevel) cfg.logging.level = o.logLevel;
+	if (o.maxAgents !== void 0) cfg.limits.maxAgents = o.maxAgents;
+	if (o.cpUrl) cfg.controlPlane.url = o.cpUrl;
+	if (o.cpKey) cfg.controlPlane.key = o.cpKey;
+	if (o.cpUrl || o.cpKey) cfg.controlPlane.enabled = true;
+	if (o.noCp) cfg.controlPlane.enabled = false;
+	cfg.agentsDir = o.agentsDir ?? cfg.agentsDir ?? defaultAgentsDir(root);
+	return cfg;
+}
+/**
+* Persist a (freshly-minted) `daemonId` back into config.json so it is stable
+* per install. Best-effort: a write failure is swallowed (the daemon still runs
+* with the in-memory id this session).
+*/
+function persistDaemonId(root, daemonId) {
+	try {
+		const file = configPath(resolveRoot(root));
+		const raw = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { version: 1 };
+		raw.daemonId = daemonId;
+		mkdirSync(dirname(file), { recursive: true });
+		writeFileSync(file, JSON.stringify(raw, null, 2) + "\n");
+	} catch {}
+}
+/**
+* Persist the CP-published relay roster back into config.json so the daemon can
+* re-dial its relays at boot while the CP is unreachable (graceful degradation).
+* Whole-set (CP-owned): overwrites any prior value, so a swept relay is cleared.
+* Best-effort — a write failure is swallowed (the in-memory roster still drives
+* this session's dials).
+*/
+function persistRelays(root, relays) {
+	try {
+		const file = configPath(resolveRoot(root));
+		const raw = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { version: 1 };
+		raw.relays = relays;
+		mkdirSync(dirname(file), { recursive: true });
+		writeFileSync(file, JSON.stringify(raw, null, 2) + "\n");
+	} catch {}
+}
+//#endregion
+//#region src/agents/agent-schema.ts
+const BindMatchSchema = discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
+]);
+const BindRuleConfigSchema = object({
+	channel: string().optional(),
+	thread: string().optional(),
+	match: BindMatchSchema
+});
+const SlackConfigSchema = object({
+	botToken: string(),
+	appToken: string(),
+	signingSecret: string().optional(),
+	botUserId: string().optional(),
+	allowedUserIds: array(string()).default([]),
+	bindRules: array(BindRuleConfigSchema).default([])
+});
+const TelegramConfigSchema = object({
+	botToken: string(),
+	botUserId: string().optional(),
+	botUsername: string().optional(),
+	allowedUserIds: array(string()).default([]),
+	bindRules: array(BindRuleConfigSchema).default([])
+});
+const DiscordConfigSchema = object({
+	botToken: string(),
+	applicationId: string().optional(),
+	botUserId: string().optional(),
+	allowedUserIds: array(string()).default([]),
+	bindRules: array(BindRuleConfigSchema).default([])
+});
+const IntegrationSchema = discriminatedUnion("platform", [
+	object({
+		id: string(),
+		platform: literal("slack"),
+		slack: SlackConfigSchema
+	}),
+	object({
+		id: string(),
+		platform: literal("telegram"),
+		telegram: TelegramConfigSchema
+	}),
+	object({
+		id: string(),
+		platform: literal("discord"),
+		discord: DiscordConfigSchema
+	})
+]);
+/** A scheduled trigger for THIS agent: every `schedule` tick, prompt the agent
+*  with `trigger`. `target` is optional output routing — when present the daemon
+*  posts the trigger into that channel and the session replies in its thread;
+*  absent ⇒ headless fire (no platform output). `origin:"cp"` marks CP-pushed
+*  entries (written by cron/upsert, pruned by drop.crons); hand-authored entries
+*  have no origin and are never touched by the CP. */
+const CronDefSchema = object({
+	id: string(),
+	schedule: string(),
+	target: object({
+		platform: _enum([
+			"slack",
+			"telegram",
+			"discord"
+		]),
+		channel: string(),
+		integrationId: string().optional()
+	}).optional(),
+	trigger: string(),
+	enabled: boolean().default(true),
+	origin: literal("cp").optional()
+});
+const AgentSchema = object({
+	id: string(),
+	name: string(),
+	status: _enum([
+		"active",
+		"inactive",
+		"paused"
+	]).default("active"),
+	pause: boolean().default(false),
+	runtime: string(),
+	description: string().optional(),
+	reasoningEffort: string().optional(),
+	executionMode: string().optional(),
+	fastMode: boolean().optional(),
+	permissionMode: string().default("default"),
+	runtimeOverrides: object({
+		model: string().optional(),
+		env: array(object({
+			name: string(),
+			value: string()
+		})).default([])
+	}).optional(),
+	mcpServers: array(string()).default([]),
+	memory: object({ provider: _enum([
+		"native",
+		"managed",
+		"external"
+	]).default("managed") }).optional(),
+	workspace: object({
+		mode: _enum(["git-repo", "from-scratch"]),
+		path: string(),
+		gitRepo: string().optional(),
+		gitBranch: string().default("main"),
+		gitCredential: _enum(["github-app"]).optional(),
+		pullOnNewSession: boolean().default(true),
+		skills: array(string()).default([])
+	}),
+	integrations: array(IntegrationSchema).default([]),
+	output: object({ mode: _enum([
+		"low",
+		"medium",
+		"high"
+	]).default("low") }).default({ mode: "low" }),
+	permissions: object({
+		policy: _enum(["ask", "auto"]).default("ask"),
+		autoApprove: array(string()).default([])
+	}).default({
+		policy: "ask",
+		autoApprove: []
+	}),
+	crons: array(CronDefSchema).default([])
+});
+//#endregion
+//#region src/agents/agent-env.ts
+function parseDotenv(text) {
+	const out = {};
+	for (const rawLine of text.split("\n")) {
+		const line = rawLine.replace(/\r$/, "").trim();
+		if (!line || line.startsWith("#")) continue;
+		const body = line.startsWith("export ") ? line.slice(7).trim() : line;
+		const eq = body.indexOf("=");
+		if (eq === -1) continue;
+		const key = body.slice(0, eq).trim();
+		if (!key) continue;
+		let value = body.slice(eq + 1).trim();
+		const q = value[0];
+		if (value.length >= 2 && (q === "\"" || q === "'") && value.at(-1) === q) value = value.slice(1, -1);
+		out[key] = value;
+	}
+	return out;
+}
+function loadDotenv(dir) {
+	const file = join(dir, ".env");
+	if (!existsSync(file)) return {};
+	return parseDotenv(readFileSync(file, "utf8"));
+}
+const VAR_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+function interpolateString(value, source, path, ctx) {
+	return value.replace(VAR_RE, (_m, name) => {
+		const resolved = source[name];
+		if (resolved === void 0) throw new Error(`agent "${ctx.id}": unresolved \${${name}} in ${path} (.env: ${ctx.envPath})`);
+		return resolved;
+	});
+}
+function walk(node, source, path, ctx) {
+	if (typeof node === "string") return interpolateString(node, source, path, ctx);
+	if (Array.isArray(node)) {
+		for (let i = 0; i < node.length; i++) node[i] = walk(node[i], source, `${path}[${i}]`, ctx);
+		return node;
+	}
+	if (node && typeof node === "object") {
+		const obj = node;
+		for (const key of Object.keys(obj)) obj[key] = walk(obj[key], source, path ? `${path}.${key}` : key, ctx);
+		return node;
+	}
+	return node;
+}
+function interpolateAgent(agent, source, ctx) {
+	walk(agent, source, "", ctx);
+}
+function agentChildEnv(agent) {
+	return {
+		...agent.env,
+		...Object.fromEntries((agent.runtimeOverrides?.env ?? []).map((e) => [e.name, e.value]))
+	};
+}
+//#endregion
+//#region src/agents/load-agents.ts
+const IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+const MAX_DEPTH = 4;
+function parseAgentFile(file) {
+	const dir = dirname(file);
+	const env = loadDotenv(dir);
+	const agent = AgentSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+	interpolateAgent(agent, {
+		...process.env,
+		...env
+	}, {
+		id: agent.id,
+		envPath: join(dir, ".env")
+	});
+	if (!isAbsolute(agent.workspace.path)) agent.workspace.path = resolve(dir, agent.workspace.path);
+	return {
+		...agent,
+		dir,
+		env
+	};
+}
+function findAgentFiles(dir, depth = 0) {
+	if (depth > MAX_DEPTH || !existsSync(dir)) return [];
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	if (entries.some((e) => e.isFile() && e.name === "agent.json")) return [join(dir, "agent.json")];
+	const out = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		if (IGNORED_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
+		out.push(...findAgentFiles(join(dir, entry.name), depth + 1));
+	}
+	return out;
+}
+function discoverAgents(agentsDir) {
+	return findAgentFiles(agentsDir).map((file) => {
+		try {
+			return {
+				agent: parseAgentFile(file),
+				dir: dirname(file)
+			};
+		} catch (err) {
+			throw new Error(`invalid agent.json at ${file}: ${err.message}`);
+		}
+	});
+}
+function loadAgents(agentsDir) {
+	return discoverAgents(agentsDir).map((d) => d.agent).filter((a) => a.status === "active");
+}
+function selectAgent(agentsDir, name) {
+	const agents = discoverAgents(agentsDir).map((d) => d.agent);
+	if (name) {
+		const match = agents.find((a) => a.id === name);
+		if (!match) {
+			const available = agents.map((a) => a.id).sort().join(", ") || "(none)";
+			throw new Error(`agent "${name}" not found in ${agentsDir}. Available: ${available}`);
+		}
+		return match;
+	}
+	if (agents.length === 0) throw new Error(`no agent.json found in ${agentsDir}`);
+	if (agents.length > 1) {
+		const ids = agents.map((a) => a.id).sort().join(", ");
+		throw new Error(`multiple agents found in ${agentsDir}: ${ids}; use --agent <name> to specify one`);
+	}
+	return agents[0];
+}
+//#endregion
+export { decodeEnvelope as _, agentChildEnv as a, MEMORY_INDEX as b, persistRelays as c, normalizeGitUrl as d, RELAY_DAEMON_SUBPROTOCOL as f, buildEnvelope as g, decodeRelayDaemonFrame as h, selectAgent as i, ConfigSchema as l, buildRelayDaemonFrame as m, findAgentFiles as n, loadConfig as o, RELAY_DAEMON_WS_PATH as p, loadAgents as r, persistDaemonId as s, discoverAgents as t, isFrame as u, encode as v, RESERVED_MCP_SERVER_NAME as x, MAX_FRAME_BYTES as y };
+
+//# sourceMappingURL=load-agents-NvLpcg5H.js.map