@agentconnect.md/daemon 1.0.0-rc.281 → 1.0.0-rc.283

package/dist/{login-BPKCyqR_.js.map → login-eP4k_Gf_.js.map}

@@ -1 +1 @@
-{"version":3,"file":"login-BPKCyqR_.js","names":["realRunForeground"],"sources":["../src/cp/auth-probe.ts","../src/cli/login.ts"],"sourcesContent":["/**\n * `probeAuth` — a one-shot CP auth check used by `agentconnect login`. It dials\n * the CP, sends ONLY the `auth` frame (no `register`), and resolves with the\n * authoritative daemonId from `auth/ok`, or a human-readable failure reason on\n * a `4401` close, a correlated `error`, a dial failure, or a timeout. It always\n * closes the socket and never leaves a connection open.\n */\nimport { buildEnvelope, decodeEnvelope, encode, isFrame } from '@agentconnect.md/protocol'\nimport { ClientTransport, type Transport } from '@agentconnect.md/connection'\nimport { CP_SUBPROTOCOL, CP_WS_PATH } from './client.js'\n\nexport interface ProbeResult {\n  ok: boolean\n  daemonId?: string\n  reason?: string\n}\n\nexport interface ProbeOpts {\n  url: string\n  token: string\n  daemonId?: string\n  agentVersion?: string\n  timeoutMs?: number\n  /** Injectable for tests; defaults to dialing the real WebSocket. */\n  connect?: () => Promise<Transport>\n}\n\nexport async function probeAuth(opts: ProbeOpts): Promise<ProbeResult> {\n  const timeoutMs = opts.timeoutMs ?? 10_000\n  const dial = opts.connect ?? (() => ClientTransport.dial(opts.url, { subprotocol: CP_SUBPROTOCOL, path: CP_WS_PATH }))\n\n  let transport: Transport\n  try {\n    transport = await dial()\n  } catch (err) {\n    return { ok: false, reason: `cannot reach ${opts.url}: ${(err as Error).message}` }\n  }\n\n  const authPayload: Record<string, unknown> = {\n    apiKey: opts.token,\n    agentVersion: opts.agentVersion ?? 'probe'\n  }\n  if (opts.daemonId) authPayload.daemonId = opts.daemonId\n  const frame = buildEnvelope('auth', authPayload)\n\n  return await new Promise<ProbeResult>((resolve) => {\n    let settled = false\n    const done = (r: ProbeResult): void => {\n      if (settled) return\n      settled = true\n      clearTimeout(timer)\n      try {\n        transport.close(1000, 'probe done')\n      } catch {\n        // socket may already be closed\n      }\n      resolve(r)\n    }\n\n    const timer = setTimeout(\n      () => done({ ok: false, reason: `timed out after ${timeoutMs}ms waiting for auth/ok` }),\n      timeoutMs\n    )\n\n    transport.onMessage((text) => {\n      const decoded = decodeEnvelope(text)\n      if (!decoded.ok) return\n      const f = decoded.frame\n      if (f.corr !== frame.id) return\n      if (f.type === 'error') {\n        const e = f.payload as { code: string; message: string }\n        done({ ok: false, reason: `${e.code}: ${e.message}` })\n        return\n      }\n      if (isFrame('auth/ok')(f)) {\n        const ok = f.payload as { daemonId: string }\n        done({ ok: true, daemonId: ok.daemonId })\n      }\n    })\n\n    transport.onClose((code) => {\n      if (code === 4401) done({ ok: false, reason: 'authentication failed (4401) — check the daemon token' })\n      else done({ ok: false, reason: `connection closed (${code}) before auth/ok` })\n    })\n\n    transport.send(encode(frame))\n  })\n}\n","/**\n * `agentconnect login` — interactive onboarding. It tests the Control Plane auth\n * flow, persists credentials only on success, then offers to install the OS\n * service. If installed it starts the service (`up`) and returns; otherwise it\n * runs the daemon in the foreground (the same path as `agentconnect run`).\n *\n * `persistCredentials` is the pure config-merge half (token-only onboarding:\n * `daemonId` is omitted unless given — the first connect adopts it from the\n * token's `sub`). `runLogin` is the orchestrator, with injectable deps for tests.\n */\nimport { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { dirname } from 'node:path'\nimport { createInterface } from 'node:readline'\nimport { fileURLToPath } from 'node:url'\nimport { ConfigSchema } from '../config/config-schema.js'\nimport { resolveRoot, configPath } from '../paths.js'\nimport { DAEMON_VERSION } from '../version.js'\nimport { probeAuth, type ProbeResult } from '../cp/auth-probe.js'\nimport { resolveController, type InstallOpts } from '../service/index.js'\nimport { runForeground as realRunForeground } from './run-foreground.js'\n\nexport interface PersistCredsOpts {\n  cpUrl: string\n  cpKey: string\n  daemonId?: string\n  root?: string\n  configPath?: string\n}\n\n/** Merge url/token into config.json (validated), returning the written path. */\nexport function persistCredentials(opts: PersistCredsOpts): string {\n  const root = resolveRoot(opts.root)\n  const file = opts.configPath ?? configPath(root)\n  const raw: Record<string, unknown> = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { version: 1 }\n\n  const cp = (raw.controlPlane as Record<string, unknown> | undefined) ?? {}\n  raw.controlPlane = { ...cp, url: opts.cpUrl, key: opts.cpKey, enabled: true }\n  if (opts.daemonId) raw.daemonId = opts.daemonId\n\n  ConfigSchema.parse(raw) // fail before writing if the merge is invalid\n\n  mkdirSync(dirname(file), { recursive: true })\n  writeFileSync(file, JSON.stringify(raw, null, 2) + '\\n')\n  return file\n}\n\nexport interface RunLoginOpts {\n  cpUrl?: string\n  cpKey?: string\n  daemonId?: string\n  root?: string\n  configPath?: string\n  /** The resolved CLI entry path. Must be supplied by the CLI entry point\n   *  (index.ts) so the correct bundle path is used rather than inferring it\n   *  from login.ts's own import.meta.url (which is the same bundle but the\n   *  `../` path calculation would be wrong). Falls back to import.meta.url\n   *  for the pure test path where login.ts is loaded standalone. */\n  cliEntry?: string\n}\n\n/**\n * Build the InstallOpts for the OS service installer.\n *\n * Exported as a pure helper so it can be unit-tested independently of the\n * full `runLogin` orchestration. The caller (index.ts) passes `cliEntry` so\n * the correct bundle path always flows through; if omitted we fall back to\n * `import.meta.url` (correct only when login.ts is the entry, e.g. in tests).\n */\nexport function buildInstallOpts(opts: { root?: string; cliEntry?: string }): InstallOpts {\n  return {\n    execPath: process.execPath,\n    cliEntry: opts.cliEntry ?? fileURLToPath(import.meta.url),\n    includeRootEnv: resolveRoot(opts.root) !== resolveRoot(undefined)\n  }\n}\n\nexport interface LoginDeps {\n  probe: (o: { url: string; token: string }) => Promise<ProbeResult>\n  installService: () => Promise<void>\n  runForeground: () => Promise<void>\n  out: NodeJS.WritableStream\n  input: NodeJS.ReadableStream\n  isTTY: boolean\n}\n\nfunction realDeps(opts: RunLoginOpts): LoginDeps {\n  return {\n    probe: (o) => probeAuth({ url: o.url, token: o.token, agentVersion: DAEMON_VERSION }),\n    installService: async () => {\n      const controller = resolveController({ root: opts.root })\n      await controller.install(buildInstallOpts(opts))\n      await controller.up()\n    },\n    runForeground: () =>\n      realRunForeground({\n        root: opts.root,\n        overrides: { cpUrl: opts.cpUrl, cpKey: opts.cpKey, daemonId: opts.daemonId }\n      }),\n    out: process.stdout,\n    input: process.stdin,\n    isTTY: Boolean(process.stdin.isTTY)\n  }\n}\n\n/** Read the next line from a readline interface via async iterator. */\nasync function nextLine(\n  iter: AsyncIterableIterator<string>,\n  prompt: string,\n  out: NodeJS.WritableStream\n): Promise<string> {\n  out.write(prompt)\n  const { value, done } = await iter.next()\n  if (done) throw new Error(`unexpected end of input waiting for: ${prompt}`)\n  return (value as string).trim()\n}\n\nexport async function runLogin(opts: RunLoginOpts, partial: Partial<LoginDeps> = {}): Promise<void> {\n  const deps: LoginDeps = { ...realDeps(opts), ...partial }\n  const { out } = deps\n\n  // ── Non-interactive: flags required; probe; persist. No prompts, no handoff. ──\n  if (!deps.isTTY) {\n    if (!opts.cpUrl) throw new Error('login requires --cp-url <url>')\n    if (!opts.cpKey) throw new Error('login requires --cp-key <key>')\n    const r = await deps.probe({ url: opts.cpUrl, token: opts.cpKey })\n    if (!r.ok) throw new Error(`authentication failed: ${r.reason}`)\n    persistCredentials({ ...opts, cpUrl: opts.cpUrl, cpKey: opts.cpKey })\n    out.write(`✓ authenticated${r.daemonId ? ` (daemon ${r.daemonId})` : ''} — credentials saved\\n`)\n    return\n  }\n\n  // Both interactive handoffs read `<root>/config.json`: the installed service\n  // runs `… run` (no `--config`), and the foreground `Daemon` loads by root. A\n  // custom `--config` would persist credentials the daemon never reads, so the\n  // install/run branch would look successful but start without them. Reject it;\n  // `--root` is the knob that keeps persist + service + foreground in sync.\n  if (opts.configPath) {\n    throw new Error(\n      'interactive login does not support --config — use --root <dir> so the daemon and the installed service read the same config'\n    )\n  }\n\n  // ── Interactive ──\n  const rl = createInterface({ input: deps.input, output: out })\n  const iter = rl[Symbol.asyncIterator]()\n  let url = opts.cpUrl\n  let token = opts.cpKey\n  try {\n    if (!url) url = await nextLine(iter, 'Control Plane URL: ', out)\n\n    for (let attempt = 0; ; attempt++) {\n      if (!token) token = await nextLine(iter, 'Daemon API key: ', out)\n      out.write(`Testing connection to ${url}…\\n`)\n      const r = await deps.probe({ url: url!, token: token! })\n      if (r.ok) {\n        out.write(`✓ authenticated${r.daemonId ? ` (daemon ${r.daemonId})` : ''}\\n`)\n        break\n      }\n      out.write(`✗ ${r.reason}\\n`)\n      if (attempt >= 1) throw new Error('authentication failed')\n      token = undefined // re-prompt on retry\n    }\n\n    persistCredentials({ ...opts, cpUrl: url!, cpKey: token! })\n\n    const ans = (await nextLine(iter, 'Install AgentConnect as a background service? (y/N) ', out)).toLowerCase()\n    if (ans === 'y' || ans === 'yes') {\n      await deps.installService()\n      out.write('Service installed and started. Manage it with `agentconnect up` / `down` / `status`.\\n')\n      return\n    }\n    out.write('Starting in the foreground (Ctrl-C to stop)…\\n')\n  } finally {\n    rl.close()\n  }\n\n  await deps.runForeground()\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,eAAsB,UAAU,MAAuC;CACrE,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,OAAO,KAAK,kBAAkB,gBAAgB,KAAK,KAAK,KAAK;EAAE,aAAA;EAA6B,MAAA;CAAiB,CAAC;CAEpH,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,KAAK;CACzB,SAAS,KAAK;EACZ,OAAO;GAAE,IAAI;GAAO,QAAQ,gBAAgB,KAAK,IAAI,IAAK,IAAc;EAAU;CACpF;CAEA,MAAM,cAAuC;EAC3C,QAAQ,KAAK;EACb,cAAc,KAAK,gBAAgB;CACrC;CACA,IAAI,KAAK,UAAU,YAAY,WAAW,KAAK;CAC/C,MAAM,QAAQ,cAAc,QAAQ,WAAW;CAE/C,OAAO,MAAM,IAAI,SAAsB,YAAY;EACjD,IAAI,UAAU;EACd,MAAM,QAAQ,MAAyB;GACrC,IAAI,SAAS;GACb,UAAU;GACV,aAAa,KAAK;GAClB,IAAI;IACF,UAAU,MAAM,KAAM,YAAY;GACpC,QAAQ,CAER;GACA,QAAQ,CAAC;EACX;EAEA,MAAM,QAAQ,iBACN,KAAK;GAAE,IAAI;GAAO,QAAQ,mBAAmB,UAAU;EAAwB,CAAC,GACtF,SACF;EAEA,UAAU,WAAW,SAAS;GAC5B,MAAM,UAAU,eAAe,IAAI;GACnC,IAAI,CAAC,QAAQ,IAAI;GACjB,MAAM,IAAI,QAAQ;GAClB,IAAI,EAAE,SAAS,MAAM,IAAI;GACzB,IAAI,EAAE,SAAS,SAAS;IACtB,MAAM,IAAI,EAAE;IACZ,KAAK;KAAE,IAAI;KAAO,QAAQ,GAAG,EAAE,KAAK,IAAI,EAAE;IAAU,CAAC;IACrD;GACF;GACA,IAAI,QAAQ,SAAS,CAAC,CAAC,CAAC,GAAG;IACzB,MAAM,KAAK,EAAE;IACb,KAAK;KAAE,IAAI;KAAM,UAAU,GAAG;IAAS,CAAC;GAC1C;EACF,CAAC;EAED,UAAU,SAAS,SAAS;GAC1B,IAAI,SAAS,MAAM,KAAK;IAAE,IAAI;IAAO,QAAQ;GAAwD,CAAC;QACjG,KAAK;IAAE,IAAI;IAAO,QAAQ,sBAAsB,KAAK;GAAkB,CAAC;EAC/E,CAAC;EAED,UAAU,KAAK,OAAO,KAAK,CAAC;CAC9B,CAAC;AACH;;;;;;;;;;;;;;ACzDA,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,OAAO,YAAY,KAAK,IAAI;CAClC,MAAM,OAAO,KAAK,cAAc,WAAW,IAAI;CAC/C,MAAM,MAA+B,WAAW,IAAI,IAAI,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE;CAG9G,IAAI,eAAe;EAAE,GADT,IAAI,gBAAwD,CAAC;EAC7C,KAAK,KAAK;EAAO,KAAK,KAAK;EAAO,SAAS;CAAK;CAC5E,IAAI,KAAK,UAAU,IAAI,WAAW,KAAK;CAEvC,aAAa,MAAM,GAAG;CAEtB,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,cAAc,MAAM,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,IAAI;CACvD,OAAO;AACT;;;;;;;;;AAwBA,SAAgB,iBAAiB,MAAyD;CACxF,OAAO;EACL,UAAU,QAAQ;EAClB,UAAU,KAAK,YAAY,cAAc,OAAO,KAAK,GAAG;EACxD,gBAAgB,YAAY,KAAK,IAAI,MAAM,YAAY,KAAA,CAAS;CAClE;AACF;AAWA,SAAS,SAAS,MAA+B;CAC/C,OAAO;EACL,QAAQ,MAAM,UAAU;GAAE,KAAK,EAAE;GAAK,OAAO,EAAE;GAAO,cAAc;EAAe,CAAC;EACpF,gBAAgB,YAAY;GAC1B,MAAM,aAAa,kBAAkB,EAAE,MAAM,KAAK,KAAK,CAAC;GACxD,MAAM,WAAW,QAAQ,iBAAiB,IAAI,CAAC;GAC/C,MAAM,WAAW,GAAG;EACtB;EACA,qBACEA,cAAkB;GAChB,MAAM,KAAK;GACX,WAAW;IAAE,OAAO,KAAK;IAAO,OAAO,KAAK;IAAO,UAAU,KAAK;GAAS;EAC7E,CAAC;EACH,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,OAAO,QAAQ,QAAQ,MAAM,KAAK;CACpC;AACF;;AAGA,eAAe,SACb,MACA,QACA,KACiB;CACjB,IAAI,MAAM,MAAM;CAChB,MAAM,EAAE,OAAO,SAAS,MAAM,KAAK,KAAK;CACxC,IAAI,MAAM,MAAM,IAAI,MAAM,wCAAwC,QAAQ;CAC1E,OAAQ,MAAiB,KAAK;AAChC;AAEA,eAAsB,SAAS,MAAoB,UAA8B,CAAC,GAAkB;CAClG,MAAM,OAAkB;EAAE,GAAG,SAAS,IAAI;EAAG,GAAG;CAAQ;CACxD,MAAM,EAAE,QAAQ;CAGhB,IAAI,CAAC,KAAK,OAAO;EACf,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,MAAM,+BAA+B;EAChE,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,MAAM,+BAA+B;EAChE,MAAM,IAAI,MAAM,KAAK,MAAM;GAAE,KAAK,KAAK;GAAO,OAAO,KAAK;EAAM,CAAC;EACjE,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,MAAM,0BAA0B,EAAE,QAAQ;EAC/D,mBAAmB;GAAE,GAAG;GAAM,OAAO,KAAK;GAAO,OAAO,KAAK;EAAM,CAAC;EACpE,IAAI,MAAM,kBAAkB,EAAE,WAAW,YAAY,EAAE,SAAS,KAAK,GAAG,uBAAuB;EAC/F;CACF;CAOA,IAAI,KAAK,YACP,MAAM,IAAI,MACR,6HACF;CAIF,MAAM,KAAK,gBAAgB;EAAE,OAAO,KAAK;EAAO,QAAQ;CAAI,CAAC;CAC7D,MAAM,OAAO,GAAG,OAAO,cAAc,CAAC;CACtC,IAAI,MAAM,KAAK;CACf,IAAI,QAAQ,KAAK;CACjB,IAAI;EACF,IAAI,CAAC,KAAK,MAAM,MAAM,SAAS,MAAM,uBAAuB,GAAG;EAE/D,KAAK,IAAI,UAAU,IAAK,WAAW;GACjC,IAAI,CAAC,OAAO,QAAQ,MAAM,SAAS,MAAM,oBAAoB,GAAG;GAChE,IAAI,MAAM,yBAAyB,IAAI,IAAI;GAC3C,MAAM,IAAI,MAAM,KAAK,MAAM;IAAO;IAAa;GAAO,CAAC;GACvD,IAAI,EAAE,IAAI;IACR,IAAI,MAAM,kBAAkB,EAAE,WAAW,YAAY,EAAE,SAAS,KAAK,GAAG,GAAG;IAC3E;GACF;GACA,IAAI,MAAM,KAAK,EAAE,OAAO,GAAG;GAC3B,IAAI,WAAW,GAAG,MAAM,IAAI,MAAM,uBAAuB;GACzD,QAAQ,KAAA;EACV;EAEA,mBAAmB;GAAE,GAAG;GAAM,OAAO;GAAM,OAAO;EAAO,CAAC;EAE1D,MAAM,OAAO,MAAM,SAAS,MAAM,wDAAwD,GAAG,EAAA,CAAG,YAAY;EAC5G,IAAI,QAAQ,OAAO,QAAQ,OAAO;GAChC,MAAM,KAAK,eAAe;GAC1B,IAAI,MAAM,wFAAwF;GAClG;EACF;EACA,IAAI,MAAM,gDAAgD;CAC5D,UAAU;EACR,GAAG,MAAM;CACX;CAEA,MAAM,KAAK,cAAc;AAC3B"}
+{"version":3,"file":"login-eP4k_Gf_.js","names":["realRunForeground"],"sources":["../src/cp/auth-probe.ts","../src/cli/login.ts"],"sourcesContent":["/**\n * `probeAuth` — a one-shot CP auth check used by `agentconnect login`. It dials\n * the CP, sends ONLY the `auth` frame (no `register`), and resolves with the\n * authoritative daemonId from `auth/ok`, or a human-readable failure reason on\n * a `4401` close, a correlated `error`, a dial failure, or a timeout. It always\n * closes the socket and never leaves a connection open.\n */\nimport { buildEnvelope, decodeEnvelope, encode, isFrame } from '@agentconnect.md/protocol'\nimport { ClientTransport, type Transport } from '@agentconnect.md/connection'\nimport { CP_SUBPROTOCOL, CP_WS_PATH } from './client.js'\n\nexport interface ProbeResult {\n  ok: boolean\n  daemonId?: string\n  reason?: string\n}\n\nexport interface ProbeOpts {\n  url: string\n  token: string\n  daemonId?: string\n  agentVersion?: string\n  timeoutMs?: number\n  /** Injectable for tests; defaults to dialing the real WebSocket. */\n  connect?: () => Promise<Transport>\n}\n\nexport async function probeAuth(opts: ProbeOpts): Promise<ProbeResult> {\n  const timeoutMs = opts.timeoutMs ?? 10_000\n  const dial = opts.connect ?? (() => ClientTransport.dial(opts.url, { subprotocol: CP_SUBPROTOCOL, path: CP_WS_PATH }))\n\n  let transport: Transport\n  try {\n    transport = await dial()\n  } catch (err) {\n    return { ok: false, reason: `cannot reach ${opts.url}: ${(err as Error).message}` }\n  }\n\n  const authPayload: Record<string, unknown> = {\n    apiKey: opts.token,\n    agentVersion: opts.agentVersion ?? 'probe'\n  }\n  if (opts.daemonId) authPayload.daemonId = opts.daemonId\n  const frame = buildEnvelope('auth', authPayload)\n\n  return await new Promise<ProbeResult>((resolve) => {\n    let settled = false\n    const done = (r: ProbeResult): void => {\n      if (settled) return\n      settled = true\n      clearTimeout(timer)\n      try {\n        transport.close(1000, 'probe done')\n      } catch {\n        // socket may already be closed\n      }\n      resolve(r)\n    }\n\n    const timer = setTimeout(\n      () => done({ ok: false, reason: `timed out after ${timeoutMs}ms waiting for auth/ok` }),\n      timeoutMs\n    )\n\n    transport.onMessage((text) => {\n      const decoded = decodeEnvelope(text)\n      if (!decoded.ok) return\n      const f = decoded.frame\n      if (f.corr !== frame.id) return\n      if (f.type === 'error') {\n        const e = f.payload as { code: string; message: string }\n        done({ ok: false, reason: `${e.code}: ${e.message}` })\n        return\n      }\n      if (isFrame('auth/ok')(f)) {\n        const ok = f.payload as { daemonId: string }\n        done({ ok: true, daemonId: ok.daemonId })\n      }\n    })\n\n    transport.onClose((code) => {\n      if (code === 4401) done({ ok: false, reason: 'authentication failed (4401) — check the daemon token' })\n      else done({ ok: false, reason: `connection closed (${code}) before auth/ok` })\n    })\n\n    transport.send(encode(frame))\n  })\n}\n","/**\n * `agentconnect login` — interactive onboarding. It tests the Control Plane auth\n * flow, persists credentials only on success, then offers to install the OS\n * service. If installed it starts the service (`up`) and returns; otherwise it\n * runs the daemon in the foreground (the same path as `agentconnect run`).\n *\n * `persistCredentials` is the pure config-merge half (token-only onboarding:\n * `daemonId` is omitted unless given — the first connect adopts it from the\n * token's `sub`). `runLogin` is the orchestrator, with injectable deps for tests.\n */\nimport { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { dirname } from 'node:path'\nimport { createInterface } from 'node:readline'\nimport { fileURLToPath } from 'node:url'\nimport { ConfigSchema } from '../config/config-schema.js'\nimport { resolveRoot, configPath } from '../paths.js'\nimport { DAEMON_VERSION } from '../version.js'\nimport { probeAuth, type ProbeResult } from '../cp/auth-probe.js'\nimport { resolveController, type InstallOpts } from '../service/index.js'\nimport { runForeground as realRunForeground } from './run-foreground.js'\n\nexport interface PersistCredsOpts {\n  cpUrl: string\n  cpKey: string\n  daemonId?: string\n  root?: string\n  configPath?: string\n}\n\n/** Merge url/token into config.json (validated), returning the written path. */\nexport function persistCredentials(opts: PersistCredsOpts): string {\n  const root = resolveRoot(opts.root)\n  const file = opts.configPath ?? configPath(root)\n  const raw: Record<string, unknown> = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { version: 1 }\n\n  const cp = (raw.controlPlane as Record<string, unknown> | undefined) ?? {}\n  raw.controlPlane = { ...cp, url: opts.cpUrl, key: opts.cpKey, enabled: true }\n  if (opts.daemonId) raw.daemonId = opts.daemonId\n\n  ConfigSchema.parse(raw) // fail before writing if the merge is invalid\n\n  mkdirSync(dirname(file), { recursive: true })\n  writeFileSync(file, JSON.stringify(raw, null, 2) + '\\n')\n  return file\n}\n\nexport interface RunLoginOpts {\n  cpUrl?: string\n  cpKey?: string\n  daemonId?: string\n  root?: string\n  configPath?: string\n  /** The resolved CLI entry path. Must be supplied by the CLI entry point\n   *  (index.ts) so the correct bundle path is used rather than inferring it\n   *  from login.ts's own import.meta.url (which is the same bundle but the\n   *  `../` path calculation would be wrong). Falls back to import.meta.url\n   *  for the pure test path where login.ts is loaded standalone. */\n  cliEntry?: string\n}\n\n/**\n * Build the InstallOpts for the OS service installer.\n *\n * Exported as a pure helper so it can be unit-tested independently of the\n * full `runLogin` orchestration. The caller (index.ts) passes `cliEntry` so\n * the correct bundle path always flows through; if omitted we fall back to\n * `import.meta.url` (correct only when login.ts is the entry, e.g. in tests).\n */\nexport function buildInstallOpts(opts: { root?: string; cliEntry?: string }): InstallOpts {\n  return {\n    execPath: process.execPath,\n    cliEntry: opts.cliEntry ?? fileURLToPath(import.meta.url),\n    includeRootEnv: resolveRoot(opts.root) !== resolveRoot(undefined)\n  }\n}\n\nexport interface LoginDeps {\n  probe: (o: { url: string; token: string }) => Promise<ProbeResult>\n  installService: () => Promise<void>\n  runForeground: () => Promise<void>\n  out: NodeJS.WritableStream\n  input: NodeJS.ReadableStream\n  isTTY: boolean\n}\n\nfunction realDeps(opts: RunLoginOpts): LoginDeps {\n  return {\n    probe: (o) => probeAuth({ url: o.url, token: o.token, agentVersion: DAEMON_VERSION }),\n    installService: async () => {\n      const controller = resolveController({ root: opts.root })\n      await controller.install(buildInstallOpts(opts))\n      await controller.up()\n    },\n    runForeground: () =>\n      realRunForeground({\n        root: opts.root,\n        overrides: { cpUrl: opts.cpUrl, cpKey: opts.cpKey, daemonId: opts.daemonId }\n      }),\n    out: process.stdout,\n    input: process.stdin,\n    isTTY: Boolean(process.stdin.isTTY)\n  }\n}\n\n/** Read the next line from a readline interface via async iterator. */\nasync function nextLine(\n  iter: AsyncIterableIterator<string>,\n  prompt: string,\n  out: NodeJS.WritableStream\n): Promise<string> {\n  out.write(prompt)\n  const { value, done } = await iter.next()\n  if (done) throw new Error(`unexpected end of input waiting for: ${prompt}`)\n  return (value as string).trim()\n}\n\nexport async function runLogin(opts: RunLoginOpts, partial: Partial<LoginDeps> = {}): Promise<void> {\n  const deps: LoginDeps = { ...realDeps(opts), ...partial }\n  const { out } = deps\n\n  // ── Non-interactive: flags required; probe; persist. No prompts, no handoff. ──\n  if (!deps.isTTY) {\n    if (!opts.cpUrl) throw new Error('login requires --cp-url <url>')\n    if (!opts.cpKey) throw new Error('login requires --cp-key <key>')\n    const r = await deps.probe({ url: opts.cpUrl, token: opts.cpKey })\n    if (!r.ok) throw new Error(`authentication failed: ${r.reason}`)\n    persistCredentials({ ...opts, cpUrl: opts.cpUrl, cpKey: opts.cpKey })\n    out.write(`✓ authenticated${r.daemonId ? ` (daemon ${r.daemonId})` : ''} — credentials saved\\n`)\n    return\n  }\n\n  // Both interactive handoffs read `<root>/config.json`: the installed service\n  // runs `… run` (no `--config`), and the foreground `Daemon` loads by root. A\n  // custom `--config` would persist credentials the daemon never reads, so the\n  // install/run branch would look successful but start without them. Reject it;\n  // `--root` is the knob that keeps persist + service + foreground in sync.\n  if (opts.configPath) {\n    throw new Error(\n      'interactive login does not support --config — use --root <dir> so the daemon and the installed service read the same config'\n    )\n  }\n\n  // ── Interactive ──\n  const rl = createInterface({ input: deps.input, output: out })\n  const iter = rl[Symbol.asyncIterator]()\n  let url = opts.cpUrl\n  let token = opts.cpKey\n  try {\n    if (!url) url = await nextLine(iter, 'Control Plane URL: ', out)\n\n    for (let attempt = 0; ; attempt++) {\n      if (!token) token = await nextLine(iter, 'Daemon API key: ', out)\n      out.write(`Testing connection to ${url}…\\n`)\n      const r = await deps.probe({ url: url!, token: token! })\n      if (r.ok) {\n        out.write(`✓ authenticated${r.daemonId ? ` (daemon ${r.daemonId})` : ''}\\n`)\n        break\n      }\n      out.write(`✗ ${r.reason}\\n`)\n      if (attempt >= 1) throw new Error('authentication failed')\n      token = undefined // re-prompt on retry\n    }\n\n    persistCredentials({ ...opts, cpUrl: url!, cpKey: token! })\n\n    const ans = (await nextLine(iter, 'Install AgentConnect as a background service? (y/N) ', out)).toLowerCase()\n    if (ans === 'y' || ans === 'yes') {\n      await deps.installService()\n      out.write('Service installed and started. Manage it with `agentconnect up` / `down` / `status`.\\n')\n      return\n    }\n    out.write('Starting in the foreground (Ctrl-C to stop)…\\n')\n  } finally {\n    rl.close()\n  }\n\n  await deps.runForeground()\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,eAAsB,UAAU,MAAuC;CACrE,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,OAAO,KAAK,kBAAkB,gBAAgB,KAAK,KAAK,KAAK;EAAE,aAAA;EAA6B,MAAA;CAAiB,CAAC;CAEpH,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,KAAK;CACzB,SAAS,KAAK;EACZ,OAAO;GAAE,IAAI;GAAO,QAAQ,gBAAgB,KAAK,IAAI,IAAK,IAAc;EAAU;CACpF;CAEA,MAAM,cAAuC;EAC3C,QAAQ,KAAK;EACb,cAAc,KAAK,gBAAgB;CACrC;CACA,IAAI,KAAK,UAAU,YAAY,WAAW,KAAK;CAC/C,MAAM,QAAQ,cAAc,QAAQ,WAAW;CAE/C,OAAO,MAAM,IAAI,SAAsB,YAAY;EACjD,IAAI,UAAU;EACd,MAAM,QAAQ,MAAyB;GACrC,IAAI,SAAS;GACb,UAAU;GACV,aAAa,KAAK;GAClB,IAAI;IACF,UAAU,MAAM,KAAM,YAAY;GACpC,QAAQ,CAER;GACA,QAAQ,CAAC;EACX;EAEA,MAAM,QAAQ,iBACN,KAAK;GAAE,IAAI;GAAO,QAAQ,mBAAmB,UAAU;EAAwB,CAAC,GACtF,SACF;EAEA,UAAU,WAAW,SAAS;GAC5B,MAAM,UAAU,eAAe,IAAI;GACnC,IAAI,CAAC,QAAQ,IAAI;GACjB,MAAM,IAAI,QAAQ;GAClB,IAAI,EAAE,SAAS,MAAM,IAAI;GACzB,IAAI,EAAE,SAAS,SAAS;IACtB,MAAM,IAAI,EAAE;IACZ,KAAK;KAAE,IAAI;KAAO,QAAQ,GAAG,EAAE,KAAK,IAAI,EAAE;IAAU,CAAC;IACrD;GACF;GACA,IAAI,QAAQ,SAAS,CAAC,CAAC,CAAC,GAAG;IACzB,MAAM,KAAK,EAAE;IACb,KAAK;KAAE,IAAI;KAAM,UAAU,GAAG;IAAS,CAAC;GAC1C;EACF,CAAC;EAED,UAAU,SAAS,SAAS;GAC1B,IAAI,SAAS,MAAM,KAAK;IAAE,IAAI;IAAO,QAAQ;GAAwD,CAAC;QACjG,KAAK;IAAE,IAAI;IAAO,QAAQ,sBAAsB,KAAK;GAAkB,CAAC;EAC/E,CAAC;EAED,UAAU,KAAK,OAAO,KAAK,CAAC;CAC9B,CAAC;AACH;;;;;;;;;;;;;;ACzDA,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,OAAO,YAAY,KAAK,IAAI;CAClC,MAAM,OAAO,KAAK,cAAc,WAAW,IAAI;CAC/C,MAAM,MAA+B,WAAW,IAAI,IAAI,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE;CAG9G,IAAI,eAAe;EAAE,GADT,IAAI,gBAAwD,CAAC;EAC7C,KAAK,KAAK;EAAO,KAAK,KAAK;EAAO,SAAS;CAAK;CAC5E,IAAI,KAAK,UAAU,IAAI,WAAW,KAAK;CAEvC,aAAa,MAAM,GAAG;CAEtB,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,cAAc,MAAM,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,IAAI;CACvD,OAAO;AACT;;;;;;;;;AAwBA,SAAgB,iBAAiB,MAAyD;CACxF,OAAO;EACL,UAAU,QAAQ;EAClB,UAAU,KAAK,YAAY,cAAc,OAAO,KAAK,GAAG;EACxD,gBAAgB,YAAY,KAAK,IAAI,MAAM,YAAY,KAAA,CAAS;CAClE;AACF;AAWA,SAAS,SAAS,MAA+B;CAC/C,OAAO;EACL,QAAQ,MAAM,UAAU;GAAE,KAAK,EAAE;GAAK,OAAO,EAAE;GAAO,cAAc;EAAe,CAAC;EACpF,gBAAgB,YAAY;GAC1B,MAAM,aAAa,kBAAkB,EAAE,MAAM,KAAK,KAAK,CAAC;GACxD,MAAM,WAAW,QAAQ,iBAAiB,IAAI,CAAC;GAC/C,MAAM,WAAW,GAAG;EACtB;EACA,qBACEA,cAAkB;GAChB,MAAM,KAAK;GACX,WAAW;IAAE,OAAO,KAAK;IAAO,OAAO,KAAK;IAAO,UAAU,KAAK;GAAS;EAC7E,CAAC;EACH,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,OAAO,QAAQ,QAAQ,MAAM,KAAK;CACpC;AACF;;AAGA,eAAe,SACb,MACA,QACA,KACiB;CACjB,IAAI,MAAM,MAAM;CAChB,MAAM,EAAE,OAAO,SAAS,MAAM,KAAK,KAAK;CACxC,IAAI,MAAM,MAAM,IAAI,MAAM,wCAAwC,QAAQ;CAC1E,OAAQ,MAAiB,KAAK;AAChC;AAEA,eAAsB,SAAS,MAAoB,UAA8B,CAAC,GAAkB;CAClG,MAAM,OAAkB;EAAE,GAAG,SAAS,IAAI;EAAG,GAAG;CAAQ;CACxD,MAAM,EAAE,QAAQ;CAGhB,IAAI,CAAC,KAAK,OAAO;EACf,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,MAAM,+BAA+B;EAChE,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,MAAM,+BAA+B;EAChE,MAAM,IAAI,MAAM,KAAK,MAAM;GAAE,KAAK,KAAK;GAAO,OAAO,KAAK;EAAM,CAAC;EACjE,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,MAAM,0BAA0B,EAAE,QAAQ;EAC/D,mBAAmB;GAAE,GAAG;GAAM,OAAO,KAAK;GAAO,OAAO,KAAK;EAAM,CAAC;EACpE,IAAI,MAAM,kBAAkB,EAAE,WAAW,YAAY,EAAE,SAAS,KAAK,GAAG,uBAAuB;EAC/F;CACF;CAOA,IAAI,KAAK,YACP,MAAM,IAAI,MACR,6HACF;CAIF,MAAM,KAAK,gBAAgB;EAAE,OAAO,KAAK;EAAO,QAAQ;CAAI,CAAC;CAC7D,MAAM,OAAO,GAAG,OAAO,cAAc,CAAC;CACtC,IAAI,MAAM,KAAK;CACf,IAAI,QAAQ,KAAK;CACjB,IAAI;EACF,IAAI,CAAC,KAAK,MAAM,MAAM,SAAS,MAAM,uBAAuB,GAAG;EAE/D,KAAK,IAAI,UAAU,IAAK,WAAW;GACjC,IAAI,CAAC,OAAO,QAAQ,MAAM,SAAS,MAAM,oBAAoB,GAAG;GAChE,IAAI,MAAM,yBAAyB,IAAI,IAAI;GAC3C,MAAM,IAAI,MAAM,KAAK,MAAM;IAAO;IAAa;GAAO,CAAC;GACvD,IAAI,EAAE,IAAI;IACR,IAAI,MAAM,kBAAkB,EAAE,WAAW,YAAY,EAAE,SAAS,KAAK,GAAG,GAAG;IAC3E;GACF;GACA,IAAI,MAAM,KAAK,EAAE,OAAO,GAAG;GAC3B,IAAI,WAAW,GAAG,MAAM,IAAI,MAAM,uBAAuB;GACzD,QAAQ,KAAA;EACV;EAEA,mBAAmB;GAAE,GAAG;GAAM,OAAO;GAAM,OAAO;EAAO,CAAC;EAE1D,MAAM,OAAO,MAAM,SAAS,MAAM,wDAAwD,GAAG,EAAA,CAAG,YAAY;EAC5G,IAAI,QAAQ,OAAO,QAAQ,OAAO;GAChC,MAAM,KAAK,eAAe;GAC1B,IAAI,MAAM,wFAAwF;GAClG;EACF;EACA,IAAI,MAAM,gDAAgD;CAC5D,UAAU;EACR,GAAG,MAAM;CACX;CAEA,MAAM,KAAK,cAAc;AAC3B"}

package/dist/run-foreground-BFk_9xwW.js

@@ -0,0 +1,2 @@
+import { t as runForeground } from "./run-foreground-Cennaxiw.js";
+export { runForeground };

package/dist/{run-foreground-BBBkQ93M.js → run-foreground-Cennaxiw.js}

@@ -3,9 +3,9 @@ import { n as require_ms, t as require_src$3 } from "./src-DDtlVutj.js";
 import { n as init_esm_shims, t as __dirname } from "./esm-shims-DxGcm4Hw.js";
 import { t as DAEMON_VERSION } from "./version-DGaRXjBK.js";
 import { C as _coercedNumber, T as NEVER, a as array, d as literal, f as looseObject, i as any, m as object, o as boolean, p as number$1, t as ZodNumber, v as string, x as url$4 } from "./schemas-CQkO9hC5.js";
-import { C as ZodIssueCode, S as RESERVED_MCP_SERVER_NAME, _ as buildEnvelope, a as agentChildEnv, b as MAX_FRAME_BYTES, c as persistRelays, d as normalizeGitUrl, f as RELAY_DAEMON_SUBPROTOCOL, g as SHARED_CONFIG_ACTION_ID, h as decodeRelayDaemonFrame, i as selectAgent, m as buildRelayDaemonFrame, n as findAgentFiles, o as loadConfig, p as RELAY_DAEMON_WS_PATH, r as loadAgents, s as persistDaemonId, v as decodeEnvelope, y as encode } from "./load-agents-Amic2B8b.js";
+import { C as ZodIssueCode, S as RESERVED_MCP_SERVER_NAME, _ as buildEnvelope, a as agentChildEnv, b as MAX_FRAME_BYTES, c as persistRelays, d as normalizeGitUrl, f as RELAY_DAEMON_SUBPROTOCOL, g as SHARED_CONFIG_ACTION_ID, h as decodeRelayDaemonFrame, i as selectAgent, m as buildRelayDaemonFrame, n as findAgentFiles, o as loadConfig, p as RELAY_DAEMON_WS_PATH, r as loadAgents, s as persistDaemonId, v as decodeEnvelope, y as encode } from "./load-agents-DzCnR0cj.js";
 import { l as resolveRoot, o as mcpSocketPath, u as statePath } from "./paths-DEcUO8lC.js";
-import { S as resolveRuntimes, _ as writeMemoryFile, a as initGitInjection, b as cachedRuntimeNames, c as simpleGit, d as memoryProviderFor, f as MemoryConflictError, g as resolveInMemoryDir, h as listMemory, i as prepareWorkspace, l as createMemoryProvider, m as MemoryTooLargeError, n as installedRuntimes, o as probeGitVersion, p as MemoryPathError, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as memoryKindOf, v as MEMORY_TOOL_NAMES, x as cachedRuntimeVersions, y as toolsForIntegrations } from "./acp-host-CrjtbS3A.js";
+import { S as resolveRuntimes, _ as writeMemoryFile, a as initGitInjection, b as cachedRuntimeNames, c as simpleGit, d as memoryProviderFor, f as MemoryConflictError, g as resolveInMemoryDir, h as listMemory, i as prepareWorkspace, l as createMemoryProvider, m as MemoryTooLargeError, n as installedRuntimes, o as probeGitVersion, p as MemoryPathError, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as memoryKindOf, v as MEMORY_TOOL_NAMES, x as cachedRuntimeVersions, y as toolsForIntegrations } from "./acp-host-C-4zFhF8.js";
 import { i as GitCredentialCache, n as gitcredSocketPath, r as writeGitcredShim, t as GitCredServer } from "./gitcred-server-CMC80O_1.js";
 import { B as ToolListChangedNotificationSchema, D as ListPromptsResultSchema, E as ListChangedOptionsBaseSchema, F as PromptListChangedNotificationSchema, G as isZ4Schema, H as isJSONRPCRequest, I as ReadResourceResultSchema, J as encodeFrame, K as safeParse, L as ResourceListChangedNotificationSchema, M as ListToolsResultSchema, O as ListResourceTemplatesResultSchema, P as McpError, R as SUPPORTED_PROTOCOL_VERSIONS, S as InitializeResultSchema, T as LATEST_PROTOCOL_VERSION, U as isJSONRPCResultResponse, V as isInitializedNotification, W as getObjectShape, _ as ElicitResultSchema, a as AjvJsonSchemaValidator, b as GetPromptResultSchema, c as mergeCapabilities, d as CompleteResultSchema, f as CreateMessageRequestSchema, g as ElicitRequestSchema, h as CreateTaskResultSchema, i as assertToolsCallTaskCapability, k as ListResourcesResultSchema, m as CreateMessageResultWithToolsSchema, n as serializeMessage, o as require_fast_deep_equal, p as CreateMessageResultSchema, q as decodeFrames, r as assertClientRequestTaskCapability, s as Protocol, t as ReadBuffer, u as CallToolResultSchema, v as EmptyResultSchema, w as JSONRPCMessageSchema, y as ErrorCode } from "./stdio-DnS8WcXi.js";
 import { URL as URL$1 } from "url";
@@ -4516,6 +4516,9 @@ var CpClient = class {
 			case "relay/roster":
 				this.deps.configApply.applyRelayRoster(frame.payload.relays);
 				return;
+			case "collaboration/routes":
+				this.deps.configApply.applyCollabRoutes(frame.payload);
+				return;
 			case "agent/upsert": {
 				const u = frame.payload;
 				this.deps.configApply.applyAgentUpsert(u.agentId, u.spec);
@@ -6370,6 +6373,26 @@ var LocalStore = class {
       CREATE TABLE IF NOT EXISTS cron_runs (
         key TEXT PRIMARY KEY, lastRunAt INTEGER NOT NULL
       );
+      -- §6.9 #353 durable inbox: an ADMITTED-but-QUEUED message persisted BEFORE the
+      -- admission ACK, so a hard kill / agent move can't lose a message the caller was
+      -- already told delivered:true. Replayed FIFO-by-sessionKey on startup and removed
+      -- on every terminal path (success / reject / cancel / gate-drop). The id column is the
+      -- message's STABLE deliveryId/msgId (§6.3) so re-append and replay are idempotent
+      -- against the existing admission-idempotency maps. Webchat turns are NOT persisted
+      -- here (their live sink can't be restored — see §6.9 #367). enqueuedAt is a
+      -- monotonic decimal string (fixed-width ⇒ string order == numeric order) driving
+      -- FIFO within a sessionKey.
+      CREATE TABLE IF NOT EXISTS inbox (
+        id TEXT PRIMARY KEY,
+        sessionKey TEXT NOT NULL,
+        agentId TEXT NOT NULL,
+        msg TEXT NOT NULL,
+        integrationId TEXT,
+        callMeta TEXT,
+        isQueueCmd INTEGER,
+        enqueuedAt TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS inbox_fifo ON inbox (sessionKey, enqueuedAt);
     `);
 		this.migrateSessionUsage();
 		this.migrateTranscriptToolBody();
@@ -6724,6 +6747,32 @@ var LocalStore = class {
 	getCronLastRun(key) {
 		return this.db.prepare("SELECT lastRunAt FROM cron_runs WHERE key = ?").get(key)?.lastRunAt;
 	}
+	/** §6.9 #353 durable inbox: persist an admitted message BEFORE its admission ACK. Keyed
+	*  by the stable id (deliveryId/msgId) with INSERT OR IGNORE, so a re-append of the same
+	*  delivery (P2 retry / replay) is a no-op — idempotent against the admission maps. */
+	appendInbox(row) {
+		this.db.prepare(`INSERT OR IGNORE INTO inbox (id, sessionKey, agentId, msg, integrationId, callMeta, isQueueCmd, enqueuedAt)
+         VALUES (@id, @sessionKey, @agentId, @msg, @integrationId, @callMeta, @isQueueCmd, @enqueuedAt)`).run({
+			id: row.id,
+			sessionKey: row.sessionKey,
+			agentId: row.agentId,
+			msg: row.msg,
+			integrationId: row.integrationId ?? null,
+			callMeta: row.callMeta ?? null,
+			isQueueCmd: row.isQueueCmd ?? null,
+			enqueuedAt: row.enqueuedAt
+		});
+	}
+	/** Remove an inbox row once its turn reaches a terminal state (success / reject / cancel /
+	*  gate-drop) so it is never replayed. No-op on an unknown id. */
+	removeInbox(id) {
+		this.db.prepare("DELETE FROM inbox WHERE id = ?").run(id);
+	}
+	/** All pending inbox rows, ordered FIFO-by-sessionKey (sessionKey, then enqueuedAt) for
+	*  startup replay (§6.9 #353). Order within a sessionKey is preserved by `enqueuedAt`. */
+	listInboxBySessionKeyFifo() {
+		return this.db.prepare("SELECT * FROM inbox ORDER BY sessionKey ASC, enqueuedAt ASC").all();
+	}
 	close() {
 		this.db.close();
 	}
@@ -197213,6 +197262,18 @@ var RelayClient = class {
 	isReady() {
 		return this.state === "READY";
 	}
+	/**
+	* Send a cross-daemon agent-call to the relay (`rd/agentmsg` REQ, agent-collaboration
+	* §2.3/§6.4) and resolve with the relay's admission verdict. `claimedFromAgentId` is
+	* this daemon's trusted caller — the relay re-validates it against the socket's
+	* authenticated daemonId. Rejects (retryable) if the socket isn't READY.
+	*/
+	async sendAgentMsg(payload) {
+		if (this.state !== "READY") throw new WireError("INTERNAL", `rd link not ready (${this.state})`, true);
+		const rep = await this.sendRequest(buildRelayDaemonFrame("rd/agentmsg", payload));
+		if (rep.type !== "rd/agentmsg/ack") throw new WireError("INTERNAL", `expected rd/agentmsg/ack, got ${rep.type}`, false);
+		return rep.payload;
+	}
 	async attemptConnect() {
 		if (this.stopped || this.fatal) return;
 		const daemonId = this.deps.daemonId();
@@ -197264,6 +197325,10 @@ var RelayClient = class {
 			this.handleMsg(frame.id, frame.payload);
 			return;
 		}
+		if (frame.type === "rd/agentmsg/fwd") {
+			this.handleAgentMsgFwd(frame.id, frame.payload);
+			return;
+		}
 		this.deps.log.debug(`relay(${this.relayId}): ignoring ${frame.type}`);
 	}
 	/** An inbound rd/msg: dispatch it, reply `rd/ack`; only a webchat op streams
@@ -197274,7 +197339,22 @@ var RelayClient = class {
 		const ack = this.deps.onRelayMsg(msg, chat);
 		this.transport?.send(JSON.stringify(buildRelayDaemonFrame("rd/ack", ack, { corr: reqId })));
 	}
-	/** Send one reply chunk back over THIS relay's socket, stamping the per-chat `seq`. */
+	/** A forwarded cross-daemon agent-call: terminal-verify + dispatch, reply the typed
+	*  admission verdict (`rd/agentmsg/ack`, corr = the relay's fwd id). */
+	async handleAgentMsgFwd(reqId, msg) {
+		let ack;
+		try {
+			ack = await this.deps.onRelayAgentMsg(msg);
+		} catch (err) {
+			this.deps.log.error(`relay(${this.relayId}): rd/agentmsg/fwd handler threw: ${err.message}`);
+			ack = {
+				deliveryId: msg.deliveryId,
+				delivered: false,
+				reason: "offline"
+			};
+		}
+		this.transport?.send(JSON.stringify(buildRelayDaemonFrame("rd/agentmsg/ack", ack, { corr: reqId })));
+	}
 	sendChat(chatId, event) {
 		const seq = (this.seqByChat.get(chatId) ?? 0) + 1;
 		this.seqByChat.set(chatId, seq);
@@ -197346,6 +197426,45 @@ var RelayManager = class {
 	size() {
 		return this.clients.size;
 	}
+	/**
+	* Send a cross-daemon agent-call over ANY READY relay (agent-collaboration §2.3/§6.4).
+	* The all-to-all roster means any relay this daemon holds can route the call to the
+	* target's owning daemon via the CP's collaboration snapshot — so we pick the first
+	* READY client. Throws if none is READY (the caller reports the call undeliverable).
+	*/
+	async sendAgentMsg(payload) {
+		for (const client of this.clients.values()) if (client.isReady()) return client.sendAgentMsg(payload);
+		throw new Error("no READY relay to route agent-call");
+	}
+};
+//#endregion
+//#region src/cp/cp-collab-routes.ts
+var CpCollabRoutes = class {
+	generation = -1;
+	channels = /* @__PURE__ */ new Map();
+	key(orgId, platform, channelId) {
+		return orgId + "\0" + platform + "\0" + channelId;
+	}
+	/** FULL-REPLACE from a CP snapshot (converge-don't-diff); ignore an older generation.
+	*  Tolerates an absent snapshot (a pre-collab CP / hand-built test fixture) as a no-op. */
+	replace(snap) {
+		if (!snap) return;
+		if (snap.generation < this.generation) return;
+		this.generation = snap.generation;
+		this.channels.clear();
+		for (const ch of snap.channels) {
+			const byAgent = /* @__PURE__ */ new Map();
+			for (const a of ch.agents) byAgent.set(a.agentId, {
+				...a,
+				orgId: ch.orgId
+			});
+			this.channels.set(this.key(ch.orgId, ch.platform, ch.channelId), byAgent);
+		}
+	}
+	/** The placement of `agentId` in `(orgId,platform,channel)`, or undefined. */
+	resolve(orgId, platform, channelId, agentId) {
+		return this.channels.get(this.key(orgId, platform, channelId))?.get(agentId);
+	}
 };
 //#endregion
 //#region src/slack/permalink.ts
@@ -213917,6 +214036,10 @@ const IDLE_FLUSH_MS = 2e3;
 /** Public Web App console origin used for session deep links when neither a local
 *  `webAppUrl` config nor a CP-provided one is set — so "View session" always resolves. */
 const DEFAULT_WEB_APP_URL = "https://app.agentconnect.md";
+/** Per-in-flight-turn rendering state, keyed by ACP sessionId in `this.pending`. */
+/** Cap on agent→agent hop depth (design §2.4/§4.5) — reject a `messageAgent` that
+*  would push the outgoing hopCount past this, so an A↔B wake loop can't run away. */
+const MAX_AGENT_CALL_HOPS = 8;
 /** Build the wire SessionKey (protocol §5) for a pending turn — what `drain/done`
 *  reports as released so the CP may reassign it. Uses the real `thread` (absent for
 *  a channel-root message), NOT `statusThread` (which falls back to msgId): the CP
@@ -213992,6 +214115,7 @@ var Daemon = class Daemon {
 	cpIntegrations;
 	botUserIds = {};
 	cpRouting;
+	cpCollab = new CpCollabRoutes();
 	clock;
 	requestExit;
 	draining = false;
@@ -214217,6 +214341,7 @@ var Daemon = class Daemon {
 		};
 		this.watcher.on("add", debounced).on("change", debounced).on("unlink", debounced);
 		this.log.info(`watching ${this.agentsDir} for agent changes`);
+		this.replayInbox();
 		this.startCpClient(root);
 		this.armIdleSweep();
 		this.log.info("daemon ready");
@@ -215027,6 +215152,74 @@ var Daemon = class Daemon {
 			accepted: true
 		};
 	}
+	relayAgentMsgAcks = /* @__PURE__ */ new Map();
+	/**
+	* TARGET side of a cross-daemon `messageAgent` (agent-collaboration §2.3/§6.2, P2) —
+	* the mirror of {@link handleRelayIm} for a relay-forwarded `rd/agentmsg/fwd`. The
+	* relay already validated the caller and minted a TRUSTED claim
+	* (`trustedFromAgentId` + org/channel assertion), but we TERMINAL-VERIFY it against
+	* our OWN local snapshot/spec (defense in depth, §2.5 #4) before dispatching — never
+	* blindly trusting the relay. The ACK is returned on durable ADMISSION (the P4-gate
+	* enqueue), NOT after the model turn (§6.4).
+	*/
+	async handleRelayAgentMsg(msg) {
+		const nak = (reason) => ({
+			deliveryId: msg.deliveryId,
+			delivered: false,
+			...reason ? { reason } : {}
+		});
+		const dedupKey = `${msg.trustedFromAgentId}:${msg.deliveryId}`;
+		const prior = this.relayAgentMsgAcks.get(dedupKey);
+		if (prior) return prior;
+		const record = (ack) => {
+			if (this.relayAgentMsgAcks.size >= 2e3) this.relayAgentMsgAcks.clear();
+			this.relayAgentMsgAcks.set(dedupKey, ack);
+			return ack;
+		};
+		if (msg.hopCount > MAX_AGENT_CALL_HOPS) return record(nak("hop_limit"));
+		const { platform, channel, thread } = msg.coords;
+		if (!this.agents.get(msg.toAgentId)) return record(nak("not_found"));
+		const target = this.cpCollab.resolve(msg.orgId, platform, channel, msg.toAgentId);
+		const caller = this.cpCollab.resolve(msg.orgId, platform, channel, msg.trustedFromAgentId);
+		if (!target || !caller) {
+			this.log.warn(`relay: rd/agentmsg/fwd terminal-verify failed (no placement) for ${msg.toAgentId} — fail closed`);
+			return record(nak("not_allowed"));
+		}
+		if (target.callPolicy === "selected" && !target.allowedCallerAgentIds.includes(msg.trustedFromAgentId)) {
+			this.log.info(`relay: rd/agentmsg/fwd not_allowed — ${msg.trustedFromAgentId} → ${msg.toAgentId} (selected)`);
+			return record(nak("not_allowed"));
+		}
+		const callMeta = {
+			callFrom: msg.trustedFromAgentId,
+			...msg.correlationId !== void 0 ? { correlationId: msg.correlationId } : {},
+			hopCount: msg.hopCount,
+			deliveryId: msg.deliveryId
+		};
+		const narrowed = this.narrowPlatform(platform);
+		const resolved = this.resolveCpAgent(msg.toAgentId);
+		const integrationId = msg.integrationId ?? resolved?.integrationId;
+		const normalized = {
+			msgId: `agentcall:${channel}:${msg.deliveryId}`,
+			traceId: msg.deliveryId,
+			source: "agent",
+			platform: narrowed,
+			channel,
+			...thread !== void 0 ? { thread } : {},
+			sender: {
+				id: msg.trustedFromAgentId,
+				isBot: true
+			},
+			text: `@${msg.trustedFromAgentId} asked:\n${msg.text}`,
+			mentionedBots: resolved?.botUserId ? [resolved.botUserId] : [],
+			isDm: false
+		};
+		this.dispatch(msg.toAgentId, normalized, integrationId, void 0, callMeta).catch((err) => this.log.error(`relay agentmsg dispatch failed for agent "${msg.toAgentId}": ${formatErr(err)}`));
+		this.log.info(`relay: rd/agentmsg/fwd ${msg.trustedFromAgentId} → ${msg.toAgentId} delivery=${msg.deliveryId}`);
+		return record({
+			deliveryId: msg.deliveryId,
+			delivered: true
+		});
+	}
 	/**
 	* Same-daemon agent→agent delivery — the impl behind the `messageAgent` MCP tool
 	* (design §2.2/§2.3, P1). Wakes `toAgentId` by constructing a NormalizedMessage at
@@ -215061,11 +215254,16 @@ var Daemon = class Daemon {
 			return result;
 		};
 		const target = this.agents.get(req.toAgentId);
-		if (!target) return record({
-			delivered: false,
-			targetSession,
-			reason: "not_local"
-		});
+		if (!target) {
+			const coordPlatform = platform === "hook" ? "slack" : platform;
+			return record(await this.routeAgentMsgCrossDaemon(req, {
+				platform: coordPlatform,
+				channel,
+				thread,
+				deliveryId,
+				targetSession
+			}));
+		}
 		if (target.callPolicy === "selected" && !target.allowedCallerAgentIds.includes(req.callerAgentId)) {
 			this.log.info(`messageAgent: ${req.callerAgentId} not allowed to call ${req.toAgentId} (policy=selected)`);
 			return record({
@@ -215106,6 +215304,53 @@ var Daemon = class Daemon {
 			targetSession
 		});
 	}
+	/**
+	* Route a cross-daemon `messageAgent` over the relay data plane (agent-collaboration
+	* §2.3/§6.2/§6.4, P2) and map the relay's typed admission verdict to a
+	* {@link MessageAgentResult}. The `claimedFromAgentId` is our trusted caller — the
+	* relay re-validates it against our authenticated daemonId (a forged claim is
+	* rejected there). `hopCount` is the source turn's depth (0 in P1's minimal
+	* cross-turn model); the relay increments it (+1, cap 8). The body never touches
+	* the CP — only the relay.
+	*/
+	async routeAgentMsgCrossDaemon(req, ctx) {
+		if (!this.relays) return {
+			delivered: false,
+			targetSession: ctx.targetSession,
+			reason: "not_local"
+		};
+		try {
+			const ack = await this.relays.sendAgentMsg({
+				claimedFromAgentId: req.callerAgentId,
+				toAgentId: req.toAgentId,
+				text: req.text,
+				coords: {
+					platform: ctx.platform,
+					channel: ctx.channel,
+					...ctx.thread !== void 0 ? { thread: ctx.thread } : {}
+				},
+				...req.correlationId !== void 0 ? { correlationId: req.correlationId } : {},
+				hopCount: 0,
+				deliveryId: ctx.deliveryId
+			});
+			if (ack.delivered) return {
+				delivered: true,
+				targetSession: ctx.targetSession
+			};
+			return {
+				delivered: false,
+				targetSession: ctx.targetSession,
+				...ack.reason ? { reason: ack.reason } : {}
+			};
+		} catch (err) {
+			this.log.warn(`messageAgent: cross-daemon route failed for ${req.toAgentId}: ${formatErr(err)}`);
+			return {
+				delivered: false,
+				targetSession: ctx.targetSession,
+				reason: "offline"
+			};
+		}
+	}
 	/** Narrow the trusted session-context platform string to the NormalizedMessage union;
 	*  falls back to 'slack' for an unrecognized value (coords still resolve — the union is
 	*  a routing/key detail, not the trust basis). */
@@ -215339,6 +215584,10 @@ var Daemon = class Daemon {
 	}
 	inflight = /* @__PURE__ */ new Set();
 	serialQueue = /* @__PURE__ */ new Map();
+	/** §6.9 #353: stable ids of messages currently backed by a durable inbox row (admitted,
+	*  not yet terminal). Guards startup replay from re-admitting a row whose entry is already
+	*  live in the gate (idempotency — a duplicate/in-flight id is not double-processed). */
+	liveInboxIds = /* @__PURE__ */ new Set();
 	/**
 	* Resolve a command's target from the channel's latest session when the routing ladder
 	* couldn't (no mention entity / thread / dm rule matched — e.g. a group `/status@bot`).
@@ -215670,6 +215919,49 @@ var Daemon = class Daemon {
 		}
 	}
 	/**
+	* §6.9 #353 durable inbox: persist an ADMITTED entry BEFORE its admission ACK/return, so a
+	* hard kill / agent move can't lose a message the caller was already told delivered:true.
+	* Called ONLY on the two genuine admission branches in dispatch() (claim + enqueue), never
+	* on a rejected/gate-dropped admission — a queue-full or paused/draining drop persists
+	* nothing. WEBCHAT turns are skipped (§6.9 #367): their `sink` is a live in-memory transport
+	* that can't be restored across a restart and a dead browser socket can't be resumed, so a
+	* durable row would be un-replayable. Sets `entry.inboxId` so every terminal path can delete
+	* the row. The row id is the message's stable deliveryId/msgId (§6.3) — idempotent re-append.
+	*/
+	persistInbox(entry, key) {
+		if (entry.webchat) return;
+		const id = entry.callMeta?.deliveryId ?? entry.msg.msgId;
+		try {
+			this.store.appendInbox({
+				id,
+				sessionKey: key,
+				agentId: entry.agentId,
+				msg: JSON.stringify(entry.msg),
+				integrationId: entry.integrationId ?? null,
+				callMeta: entry.callMeta ? JSON.stringify(entry.callMeta) : null,
+				isQueueCmd: entry.isQueueCmd ? 1 : null,
+				enqueuedAt: monotonicTs()
+			});
+			entry.inboxId = id;
+			this.liveInboxIds.add(id);
+		} catch (err) {
+			this.log.warn(`durable inbox: append failed for ${id}: ${err.message}`);
+		}
+	}
+	/** Remove an entry's durable inbox row once its turn reaches ANY terminal state (success,
+	*  reject/fail-stop, cancel, gate-drop) so it is not replayed on the next startup. No-op
+	*  for a non-persisted entry (webchat / never-admitted). NOT called on graceful-shutdown
+	*  settle: those admitted-but-unrun rows are intentionally LEFT for startup replay. */
+	removeInbox(entry) {
+		if (!entry.inboxId) return;
+		this.liveInboxIds.delete(entry.inboxId);
+		try {
+			this.store.removeInbox(entry.inboxId);
+		} catch (err) {
+			this.log.warn(`durable inbox: remove failed for ${entry.inboxId}: ${err.message}`);
+		}
+	}
+	/**
 	* Terminate a QUEUED entry's webchat sink when it is gate-dropped/rejected without ever
 	* entering dispatchOne (drain/pause gate-drop, fail-stop of the queued rest, `!cancel`/`!stop`
 	* queue drop, shutdown). A webchat turn signals its client via the WebchatSink terminal
@@ -215717,9 +216009,11 @@ var Daemon = class Daemon {
 				}
 				q.push(entry);
 				this.serialQueue.set(key, q);
+				this.persistInbox(entry, key);
 				this.log.debug(`dispatch: queued behind in-flight turn for session ${key} (depth ${q.length})`);
 				return;
 			}
+			this.persistInbox(entry, key);
 			this.inflight.add(key);
 			this.runLoop(key, entry);
 		});
@@ -215741,11 +216035,13 @@ var Daemon = class Daemon {
 		while (entry) {
 			if (entry !== firstEntry && (this.draining || this.drainingAgents.has(entry.agentId) || this.paused(entry.agentId))) {
 				this.terminateQueuedSink(entry);
+				if (!this.draining) this.removeInbox(entry);
 				entry.resolve(null);
 				const rest = this.serialQueue.get(key) ?? [];
 				this.serialQueue.delete(key);
 				for (const e of rest) {
 					this.terminateQueuedSink(e);
+					if (!this.draining) this.removeInbox(e);
 					e.resolve(null);
 				}
 				this.inflight.delete(key);
@@ -215753,14 +216049,17 @@ var Daemon = class Daemon {
 			}
 			try {
 				const sessionId = await this.dispatchOne(entry, key);
+				this.removeInbox(entry);
 				entry.resolve(sessionId);
 			} catch (err) {
+				if (!this.draining) this.removeInbox(entry);
 				entry.reject(err);
 				const rest = this.serialQueue.get(key) ?? [];
 				this.serialQueue.delete(key);
 				for (const e of rest) {
 					const failStop = new FailStopError(key);
 					this.terminateQueuedSink(e, failStop.message);
+					if (!this.draining) this.removeInbox(e);
 					e.reject(failStop);
 				}
 				this.inflight.delete(key);
@@ -215932,6 +216231,7 @@ var Daemon = class Daemon {
 			this.serialQueue.delete(key);
 			for (const e of queued) {
 				this.terminateQueuedSink(e, reason);
+				this.removeInbox(e);
 				e.reject(new FailStopError(key));
 			}
 		}
@@ -216870,6 +217170,49 @@ var Daemon = class Daemon {
 		}
 		this.serialQueue.clear();
 	}
+	/**
+	* §6.9 #353 startup replay: re-admit durably-persisted admitted-but-not-completed inbox rows
+	* through the SAME serial gate (`dispatch`), FIFO-by-sessionKey (rows come back ordered by
+	* (sessionKey, enqueuedAt), so order within a sessionKey is preserved and the gate keeps them
+	* serial). Runs once on start() after the store is open, agents are loaded into `this.agents`,
+	* and platform connections/crons are up (so a re-admitted turn has its reply transport), as
+	* normal inbound begins. Idempotency: a row whose id is already live in the gate (`liveInboxIds`)
+	* is skipped — dispatch re-appends the same id with INSERT OR IGNORE so no double row is written,
+	* and the re-admitted entry adopts the existing row for later removal. Rows for an agent that no
+	* longer exists on this daemon are SKIPPED + logged (the simplest choice — another owner/daemon
+	* may hold that agent; we neither drop the row nor block on it). Webchat turns were never
+	* persisted, so none appear here.
+	*/
+	replayInbox() {
+		let rows;
+		try {
+			rows = this.store.listInboxBySessionKeyFifo();
+		} catch (err) {
+			this.log.warn(`durable inbox: replay read failed: ${err.message}`);
+			return;
+		}
+		if (rows.length === 0) return;
+		let replayed = 0;
+		for (const row of rows) {
+			if (this.liveInboxIds.has(row.id)) continue;
+			if (!this.agents.has(row.agentId)) {
+				this.log.warn(`durable inbox: skipping replay of ${row.id} — unknown agent "${row.agentId}"`);
+				continue;
+			}
+			let msg;
+			let callMeta;
+			try {
+				msg = JSON.parse(row.msg);
+				callMeta = row.callMeta ? JSON.parse(row.callMeta) : void 0;
+			} catch (err) {
+				this.log.warn(`durable inbox: skipping corrupt row ${row.id}: ${err.message}`);
+				continue;
+			}
+			this.dispatch(row.agentId, msg, row.integrationId ?? void 0, void 0, callMeta, row.isQueueCmd ? { isQueueCmd: true } : void 0).catch(() => {});
+			replayed++;
+		}
+		if (replayed) this.log.info(`durable inbox: replayed ${replayed} admitted message(s) through the serial gate`);
+	}
 	/** daemon/restart + daemon/upgrade (§8.3): ack now, then drain + stop + exit so
 	*  the supervisor relaunches (the new binary, for upgrade). */
 	scheduleFleetExit(kind, targetVersion) {
@@ -216901,6 +217244,7 @@ var Daemon = class Daemon {
 				this.cpAgents?.converge(snap.agents);
 				this.cpIntegrations?.converge(snap.integrations);
 				this.convergeRelays(snap.relays);
+				this.cpCollab.replace(snap.collabRoutes);
 				for (const id of snap.drop.crons) this.cpCrons?.remove(id);
 				this.cpCrons?.converge(snap.crons);
 				this.cpRouting?.converge({
@@ -216929,6 +217273,7 @@ var Daemon = class Daemon {
 			applyRouteAssign: (a) => this.cpRouting?.upsertAssign(a),
 			applyRouteUpdate: (u) => this.cpRouting?.applyUpdate(u),
 			applyRelayRoster: (relays) => this.convergeRelays(relays),
+			applyCollabRoutes: (snap) => this.cpCollab.replace(snap),
 			applyAgentLaunch: async (launch) => {
 				const agent = this.agents.get(launch.agentId);
 				if (!agent) throw new Error(`agent/launch: unknown agent ${launch.agentId}`);
@@ -217065,7 +217410,8 @@ var Daemon = class Daemon {
 				path: RELAY_DAEMON_WS_PATH
 			}),
 			log: this.log,
-			onRelayMsg: (msg, chat) => this.handleRelayMsg(msg, chat)
+			onRelayMsg: (msg, chat) => this.handleRelayMsg(msg, chat),
+			onRelayAgentMsg: (msg) => this.handleRelayAgentMsg(msg)
 		});
 		if (this.cfg.relays.length) this.relays.converge(this.cfg.relays);
 		this.cpClient = new CpClient({
@@ -217272,4 +217618,4 @@ async function runForeground(opts, deps = {}) {
 //#endregion
 export { ClientTransport as i, CP_SUBPROTOCOL as n, CP_WS_PATH as r, runForeground as t };
 
-//# sourceMappingURL=run-foreground-BBBkQ93M.js.map
+//# sourceMappingURL=run-foreground-Cennaxiw.js.map