@agentconnect.md/daemon 1.0.0-rc.55 → 1.0.0-rc.57

package/dist/index.js

@@ -11,8 +11,8 @@ import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline";
 import { cpus, freemem, homedir, hostname, tmpdir, totalmem, type } from "node:os";
 import { spawn as spawn$1 } from "child_process";
-import { Readable, Writable } from "node:stream";
 import { randomBytes, randomUUID } from "node:crypto";
+import { Readable, Writable } from "node:stream";
 import { lstat, open, readdir, realpath, stat as stat$1 } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
 import net from "node:net";
@@ -12788,437 +12788,1194 @@ function gitInstanceFactory(baseDir, options) {
 init_git_response_error();
 var simpleGit = gitInstanceFactory;
 //#endregion
-//#region src/workspace/workspace-manager.ts
-const PULL_TIMEOUT_MS = 4500;
-const cloneInFlight = /* @__PURE__ */ new Map();
-async function prepareWorkspace(agent) {
-	const cwd = agent.workspace.path;
-	mkdirSync(cwd, { recursive: true });
-	if (agent.workspace.mode === "from-scratch") {
-		const mem = join(cwd, "memory.md");
-		if (!existsSync(mem)) writeFileSync(mem, `# ${agent.name} memory\n`);
-		return cwd;
-	}
-	if (!existsSync(join(cwd, ".git"))) {
-		await cloneRepo(agent);
-		return cwd;
-	}
-	if (agent.workspace.pullOnNewSession) try {
-		await Promise.race([simpleGit(cwd).pull(["--ff-only"]), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("pull timeout")), PULL_TIMEOUT_MS))]);
-	} catch {}
-	return cwd;
-}
+//#region ../protocol/dist/envelope.js
 /**
-* Eagerly clone a git-repo workspace that has no checkout yet — for reconcile-time
-* prefetch so the repo is warm before the first message arrives. No-op for
-* from-scratch or an already-cloned checkout (the session-time `prepareWorkspace`
-* stays authoritative and still owns pull + hard-fail). Reuses the single-flight
-* lock so a prefetch and a concurrent session-start clone never race into the same
-* dir. The caller invokes this fire-and-forget and logs any rejection — clone
-* failure here is non-fatal because `prepareWorkspace` re-clones (and hard-fails)
-* on the first session as the backstop.
+* The protocol envelope — every frame, both directions, is wrapped in this.
+* Mirrors daemon-cp-ws-protocol.md §1.1.
+*
+* `payload` is left as `unknown` here and validated by the per-type schema in
+* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
+* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
+* instead of a hard close — forward-compat, protocol §1.
 */
-async function prefetchWorkspace(agent) {
-	if (agent.workspace.mode !== "git-repo") return;
-	const cwd = agent.workspace.path;
-	if (existsSync(join(cwd, ".git"))) return;
-	mkdirSync(cwd, { recursive: true });
-	await cloneRepo(agent);
-}
-/** Clone agent.workspace.gitRepo @ gitBranch into cwd, single-flight per cwd. */
-async function cloneRepo(agent) {
-	const cwd = agent.workspace.path;
-	const inflight = cloneInFlight.get(cwd);
-	if (inflight) return inflight;
-	const gitRepo = agent.workspace.gitRepo;
-	if (!gitRepo) throw new Error(`workspace clone: agent "${agent.id}" has git-repo mode but no gitRepo configured`);
-	const branch = agent.workspace.gitBranch;
-	const p = (async () => {
-		await simpleGit().clone(gitRepo, cwd, [
-			"--branch",
-			branch,
-			"--single-branch"
-		]);
-	})().finally(() => {
-		cloneInFlight.delete(cwd);
-	});
-	cloneInFlight.set(cwd, p);
-	return p;
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/index.js
-const AGENT_METHODS = {
-	initialize: "initialize",
-	authenticate: "authenticate",
-	providers_list: "providers/list",
-	providers_set: "providers/set",
-	providers_disable: "providers/disable",
-	session_new: "session/new",
-	session_load: "session/load",
-	session_set_mode: "session/set_mode",
-	session_set_config_option: "session/set_config_option",
-	session_prompt: "session/prompt",
-	session_cancel: "session/cancel",
-	mcp_message: "mcp/message",
-	session_list: "session/list",
-	session_delete: "session/delete",
-	session_fork: "session/fork",
-	session_resume: "session/resume",
-	session_close: "session/close",
-	logout: "logout",
-	nes_start: "nes/start",
-	nes_suggest: "nes/suggest",
-	nes_accept: "nes/accept",
-	nes_reject: "nes/reject",
-	nes_close: "nes/close",
-	document_did_open: "document/didOpen",
-	document_did_change: "document/didChange",
-	document_did_close: "document/didClose",
-	document_did_save: "document/didSave",
-	document_did_focus: "document/didFocus"
-};
-const CLIENT_METHODS = {
-	session_request_permission: "session/request_permission",
-	session_update: "session/update",
-	fs_write_text_file: "fs/write_text_file",
-	fs_read_text_file: "fs/read_text_file",
-	terminal_create: "terminal/create",
-	terminal_output: "terminal/output",
-	terminal_release: "terminal/release",
-	terminal_wait_for_exit: "terminal/wait_for_exit",
-	terminal_kill: "terminal/kill",
-	mcp_connect: "mcp/connect",
-	mcp_message: "mcp/message",
-	mcp_disconnect: "mcp/disconnect",
-	elicitation_create: "elicitation/create",
-	elicitation_complete: "elicitation/complete"
-};
-const PROTOCOL_METHODS = { cancel_request: "$/cancel_request" };
-//#endregion
-//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema-deserialize.js
-const skippedItem = Symbol("skippedItem");
-function defaultOnError(schema, fallback) {
-	return schema.catch(fallback);
-}
-function requiredDefaultOnError(schema, fallback) {
-	const schemaWithCatch = schema.catch(fallback);
-	return unknown().transform((value, context) => {
-		if (value !== void 0) return schemaWithCatch.parse(value);
-		context.addIssue({
-			code: "custom",
-			message: "Required value is missing"
-		});
-		return NEVER;
-	});
-}
-function vecSkipError(itemSchema) {
-	return array(itemSchema.catch(skippedItem)).transform((items) => items.filter((item) => item !== skippedItem));
-}
+const Envelope = object({
+	v: literal(1),
+	id: string().uuid(),
+	ts: string().datetime(),
+	type: string(),
+	corr: string().uuid().optional(),
+	payload: unknown()
+});
+object({
+	epoch: number().int(),
+	seq: number().int().optional(),
+	agentId: string().uuid().optional(),
+	launchId: string().uuid().optional()
+});
+/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
+const NIL_UUID = "00000000-0000-0000-0000-000000000000";
 //#endregion
-//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/zod.gen.js
+//#region ../protocol/dist/frames/auth.js
 /**
-* JSON RPC Request Id
-*
-* An identifier established by the Client that MUST contain a String, Number, or NULL value if included. If it is not included it is assumed to be a notification. The value SHOULD normally not be Null \[1\] and Numbers SHOULD NOT contain fractional parts \[2\]
-*
-* The Server MUST reply with the same value in the Response object if included. This member is used to correlate the context between the two objects.
-*
-* \[1\] The use of Null as a value for the id member in a Request object is discouraged, because this specification uses a value of Null for Responses with an unknown id. Also, because JSON-RPC 1.0 uses an id value of Null for Notifications this could cause confusion in handling.
+* Auth & identity — protocol §3.1 / §3.2.
 *
-* \[2\] Fractional parts may be problematic, since many decimal fractions cannot be represented exactly as binary fractions.
+* `auth` is the first frame after the socket opens. `auth/ok` carries the
+* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
+* resume verdict.
 */
-const zRequestId = union([number(), string()]).nullable();
+const AuthReq = object({
+	apiKey: string(),
+	daemonId: string().uuid().optional(),
+	machineId: string().uuid().optional(),
+	attestation: string().optional(),
+	agentVersion: string(),
+	resume: object({
+		lastEpoch: number().int(),
+		lastRecvSeq: record(string(), number())
+	}).optional()
+});
+const AuthOk = object({
+	daemonId: string().uuid(),
+	sessionEpoch: number().int(),
+	heartbeatSec: number().int(),
+	serverTime: string().datetime(),
+	resume: object({
+		accepted: boolean(),
+		redeliverFromSeq: record(string(), number()).optional()
+	}).optional()
+});
+//#endregion
+//#region ../protocol/dist/frames/route.js
 /**
-* A unique identifier for a conversation session between a client and agent.
-*
-* Sessions maintain their own context, conversation history, and state,
-* allowing multiple independent interactions with the same agent.
+* Routing & orchestration (C→D control) — protocol §5.
 *
-* See protocol docs: [Session ID](https://agentclientprotocol.com/protocol/session-setup#session-id)
+* `SessionKey` is the canonical session primitive shared across route/*,
+* agent/*, and event/session. Its canonical string form is
+* `${platform}:${channel}:${thread ?? "-"}`.
 */
-const zSessionId = string();
+const Platform = _enum(["slack", "telegram"]);
+const SessionKey = object({
+	platform: Platform,
+	channel: string(),
+	thread: string().optional()
+});
+/** Trigger-matching rule for a binding (protocol §5.1). */
+const BindRule = object({ match: discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
+]) });
+const RouteAssign = object({
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	workspaceId: string().uuid(),
+	bindRules: array(BindRule).default([])
+});
+const RouteAssignAck = object({
+	ok: boolean(),
+	sessionKey: SessionKey,
+	reason: string().optional()
+});
+const RouteUpdate = object({
+	routingEpoch: number().int(),
+	rules: array(object({
+		match: unknown(),
+		agentId: string().uuid()
+	}))
+});
+/** Graceful scale-down / rebalance — protocol §5.3. */
+const Drain = object({
+	scope: union([
+		object({
+			kind: literal("agent"),
+			agentId: string().uuid()
+		}),
+		object({ kind: literal("daemon") }),
+		object({
+			kind: literal("session"),
+			sessionKey: SessionKey
+		})
+	]),
+	deadline: string().datetime()
+});
+const DrainProgress = object({
+	remaining: number().int(),
+	drained: array(SessionKey)
+});
+const DrainDone = object({ released: array(SessionKey) });
+//#endregion
+//#region ../protocol/dist/frames/cron.js
 /**
-* Request to write content to a text file.
+* Cron sinks to the daemon (D5) — protocol §5.4.
 *
-* Only available if the client supports the `fs.writeTextFile` capability.
+* The CP owns the definition; the daemon owns firing + last-run persistence so
+* crons fire even when the CP is down.
 */
-const zWriteTextFileRequest = object({
-	sessionId: zSessionId,
-	path: string(),
-	content: string(),
-	_meta: record(string(), unknown()).nullish()
+const CronUpsert = object({
+	cronId: string().uuid(),
+	schedule: string(),
+	target: object({ channel: string() }),
+	trigger: string(),
+	enabled: boolean().default(true)
 });
+const CronRemove = object({ cronId: string().uuid() });
+//#endregion
+//#region ../protocol/dist/frames/secrets.js
 /**
-* Request to read content from a text file.
+* Secrets (C5 ↔ D10) — protocol §6.
 *
-* Only available if the client supports the `fs.readTextFile` capability.
+* Lease-based, no plaintext on the wire or in PG. Every frame carries a
+* REFERENCE to a Vault/KMS path, never the secret material itself.
 */
-const zReadTextFileRequest = object({
-	sessionId: zSessionId,
-	path: string(),
-	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
-	limit: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
-	_meta: record(string(), unknown()).nullish()
+const SecretsRequest = object({ scope: object({
+	platform: Platform,
+	workspaceId: string().uuid()
+}) });
+const SecretsGrant = object({
+	leaseId: string().uuid(),
+	scope: object({
+		platform: string(),
+		workspaceId: string().uuid()
+	}),
+	ref: string(),
+	ttl: number().int(),
+	renewBeforeSec: number().int()
+});
+const SecretsRenew = object({ leaseId: string().uuid() });
+const SecretsRevoke = object({
+	leaseId: string().uuid(),
+	reason: string()
+});
+/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
+const ScopeAttestation = object({
+	machineId: string().uuid(),
+	scope: _enum([
+		"attachment.put",
+		"attachment.get",
+		"facts.put"
+	]),
+	resourceRef: string(),
+	jws: string(),
+	exp: string().datetime()
 });
+//#endregion
+//#region ../protocol/dist/frames/agent.js
 /**
-* Unique identifier for a tool call within a session.
+* Agent lifecycle + delivery (protocol §4.3, §4.4, §7.4, §8).
+*
+* Body-locality invariant (protocol §12): no frame here carries
+* `NormalizedMessage.text`. `agent/prompt` ships a `NormalizedMessageRef` — a
+* reference the daemon resolves against its local body store.
 */
-const zToolCallId = string();
 /**
-* Categories of tools that can be invoked.
-*
-* Tool kinds help clients choose appropriate icons and optimize how they
-* display tool execution progress.
-*
-* See protocol docs: [Creating](https://agentclientprotocol.com/protocol/tool-calls#creating)
+* A REFERENCE/digest of a normalized message, NOT the body (protocol §4.3).
+* Enough for D4/D6 to fetch the local body and prompt.
 */
-const zToolKind = union([
-	literal("read"),
-	literal("edit"),
-	literal("delete"),
-	literal("move"),
-	literal("search"),
-	literal("execute"),
-	literal("think"),
-	literal("fetch"),
-	literal("switch_mode"),
-	literal("other")
-]);
+const NormalizedMessageRef = object({
+	sessionKey: SessionKey,
+	platformMsgId: string(),
+	seenUpToSeq: number().int()
+});
 /**
-* Execution status of a tool call.
-*
-* Tool calls progress through different statuses during their lifecycle.
+* Where the agent runs. Two modes; the **path is always daemon-generated** —
+* never specified by the caller (UX picks the mode, the machine owns the dir).
 *
-* See protocol docs: [Status](https://agentclientprotocol.com/protocol/tool-calls#status)
+* - `scratch`: a fresh empty working dir on the machine, no repo.
+* - `github`: the daemon clones `gitRepo` @ `branch` and runs the agent in
+*   `agentDir` (a subdir of the repo, repo-root if omitted). **Multiple agents
+*   may share one repo** — they differ by `agentDir`, so the repo is not an
+*   owned entity, just shared config on each agent.
 */
-const zToolCallStatus = union([
-	literal("pending"),
-	literal("in_progress"),
-	literal("completed"),
-	literal("failed")
-]);
+const AgentWorkspace = discriminatedUnion("mode", [object({ mode: literal("scratch") }), object({
+	mode: literal("github"),
+	gitRepo: string(),
+	branch: string().default("main"),
+	agentDir: string().optional()
+})]);
 /**
-* Optional annotations for the client. The client can use annotations to inform how objects are used or displayed
+* The editable agent definition the CP owns and the daemon needs to run it:
+* prompt + runtime selection. Raft ships this in the launch config and the
+* daemon synthesizes the system prompt locally; `description` IS the prompt.
 */
-const zAnnotations = object({
-	audience: defaultOnError(vecSkipError(union([literal("assistant"), literal("user")])).nullish(), () => void 0),
-	lastModified: string().nullish(),
-	priority: number().nullish(),
-	_meta: record(string(), unknown()).nullish()
+const AgentSpec = object({
+	name: string(),
+	description: string().optional(),
+	runtime: string().optional(),
+	model: string().optional(),
+	reasoningEffort: string().optional(),
+	executionMode: string().optional(),
+	workspace: AgentWorkspace.optional(),
+	env: record(string(), string()).optional()
 });
-/**
-* Text provided to or from an LLM.
-*/
-const zTextContent = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	text: string(),
-	_meta: record(string(), unknown()).nullish()
+const AgentLaunch = object({
+	agentId: string().uuid(),
+	runtime: string(),
+	workspaceId: string().uuid(),
+	capabilities: array(string()),
+	spec: AgentSpec,
+	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
 });
 /**
-* An image provided to or from an LLM.
+* Live agent CRUD (C→D): the console edited an agent's spec; push it so a
+* running daemon reloads without waiting for the next launch. `agent/remove`
+* tears the agent down. Deleting an agent never relaunches it.
 */
-const zImageContent = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	data: string(),
-	mimeType: string(),
-	uri: string().nullish(),
-	_meta: record(string(), unknown()).nullish()
+const AgentUpsert = object({
+	agentId: string().uuid(),
+	spec: AgentSpec
 });
-/**
-* Audio provided to or from an LLM.
-*/
-const zAudioContent = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	data: string(),
-	mimeType: string(),
-	_meta: record(string(), unknown()).nullish()
+const AgentRemove = object({ agentId: string().uuid() });
+const AgentLaunched = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	acpSessionId: string().optional(),
+	startedAt: string().datetime(),
+	runtime: string()
 });
-/**
-* A resource that the server is capable of reading, included in a prompt or tool call result.
-*/
-const zResourceLink = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	description: string().nullish(),
-	mimeType: string().nullish(),
-	name: string(),
-	size: number().nullish(),
-	title: string().nullish(),
-	uri: string(),
-	_meta: record(string(), unknown()).nullish()
+const AgentStop = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	reason: string()
 });
-/**
-* Resource content that can be embedded in a message.
-*/
-const zEmbeddedResourceResource = union([object({
-	mimeType: string().nullish(),
-	text: string(),
-	uri: string(),
-	_meta: record(string(), unknown()).nullish()
-}), object({
-	blob: string(),
-	mimeType: string().nullish(),
-	uri: string(),
-	_meta: record(string(), unknown()).nullish()
-})]);
-/**
-* The contents of a resource, embedded into a prompt or tool call result.
-*/
-const zEmbeddedResource = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	resource: zEmbeddedResourceResource,
-	_meta: record(string(), unknown()).nullish()
+const AgentPrompt = object({
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	content: NormalizedMessageRef,
+	seenUpToSeq: number().int()
+});
+const AgentPromptAck = object({
+	accepted: boolean(),
+	reason: _enum([
+		"queued",
+		"held",
+		"scope_denied",
+		"no_session",
+		"stale"
+	]).optional(),
+	seq: number().int()
+});
+const AgentActivity = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	state: _enum([
+		"thinking",
+		"tool_call",
+		"awaiting_permission",
+		"idle"
+	]),
+	ts: string().datetime()
+});
+const AgentScopeDenied = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	capability: string()
 });
+//#endregion
+//#region ../protocol/dist/frames/integration.js
 /**
-* Content blocks represent displayable information in the Agent Client Protocol.
+* Platform integration distribution (C→D) — the Slack "install" flow.
 *
-* They provide a structured way to handle various types of user-facing content—whether
-* it's text from language models, images for analysis, or embedded resources for context.
+* The Control Plane is the source of truth for platform integrations and pushes
+* them to the daemon that owns the integration's agent (`integration/upsert`, and
+* the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket
+* Mode connection from the delivered config (see slack/connection.ts).
 *
-* Content blocks appear in:
-* - User prompts sent via `session/prompt`
-* - Language model output streamed through `session/update` notifications
-* - Progress updates and results from tool calls
-*
-* This structure is compatible with the Model Context Protocol (MCP), enabling
-* agents to seamlessly forward content from MCP tool outputs without transformation.
+* SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT
+* platform tokens (botToken/appToken). These payloads MUST NEVER be logged — no
+* body dump on decode error, no register/ok snapshot debug dump. The daemon
+* persists them into the owning agent's local `agent.json` (same trust boundary
+* as hand-authored agents, which already keep tokens there) so integrations
+* survive a restart with the CP down.
 *
-* See protocol docs: [Content](https://agentclientprotocol.com/protocol/content)
+* `signingSecret` is intentionally absent: Socket Mode authenticates with the
+* app-level token, so the daemon never needs a signing secret.
 */
-const zContentBlock = union([
-	zTextContent.and(object({ type: literal("text") })),
-	zImageContent.and(object({ type: literal("image") })),
-	zAudioContent.and(object({ type: literal("audio") })),
-	zResourceLink.and(object({ type: literal("resource_link") })),
-	zEmbeddedResource.and(object({ type: literal("resource") }))
+/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */
+const BindMatch = discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
 ]);
-/**
-* Standard content block (text, images, resources).
-*/
-const zContent = object({
-	content: zContentBlock,
-	_meta: record(string(), unknown()).nullish()
+/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */
+const IntegrationBindRule = object({
+	channel: string().optional(),
+	thread: string().optional(),
+	match: BindMatch
 });
-/**
-* A diff representing file modifications.
-*
-* Shows changes to files in a format suitable for display in the client UI.
-*
-* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
-*/
-const zDiff = object({
-	path: string(),
-	oldText: string().nullish(),
-	newText: string(),
-	_meta: record(string(), unknown()).nullish()
+/** The Slack config the daemon needs to open + route a socket (no signingSecret). */
+const IntegrationSlackConfig = object({
+	botToken: string(),
+	appToken: string(),
+	allowedUserIds: array(string()).default([]),
+	notificationChannelId: string().optional(),
+	bindRules: array(IntegrationBindRule).default([])
 });
 /**
-* Typed identifier used for terminal values on the wire.
+* One platform integration, owned by exactly one agent. Also the element type of
+* `RegisterOk.integrations[]` (the per-daemon reconcile set).
 */
-const zTerminalId = string();
+const IntegrationSpec = object({
+	integrationId: string().uuid(),
+	agentId: string().uuid(),
+	platform: literal("slack"),
+	slack: IntegrationSlackConfig
+});
+/** C→D EVT — install/update an integration on the owning agent's daemon. */
+const IntegrationUpsert = IntegrationSpec;
+/** C→D EVT — remove an integration from the daemon. */
+const IntegrationRemove = object({ integrationId: string().uuid() });
+//#endregion
+//#region ../protocol/dist/frames/register.js
 /**
-* Embed a terminal created with `terminal/create` by its id.
-*
-* The terminal must be added before calling `terminal/release`.
+* Capability upload + the reconcile snapshot — protocol §3.3.
 *
-* See protocol docs: [Terminal](https://agentclientprotocol.com/protocol/terminals)
+* `register/ok` is the authoritative source of truth: the daemon converges its
+* local cache to it. CP wins all conflicts, so re-issuing the same snapshot is
+* idempotent.
 */
-const zTerminal = object({
-	terminalId: zTerminalId,
-	_meta: record(string(), unknown()).nullish()
+const RegisterReq = object({
+	host: string(),
+	capabilities: object({
+		platforms: array(Platform),
+		runtimes: array(string()),
+		acp: boolean(),
+		features: array(string()).default([])
+	}),
+	maxAgents: number().int(),
+	localState: object({
+		assignments: array(string()),
+		crons: array(string()),
+		leases: array(string())
+	})
+});
+const RegisterOk = object({
+	routingEpoch: number().int(),
+	assignments: array(RouteAssign),
+	agents: array(AgentSpec.extend({ agentId: string().uuid() })).default([]),
+	crons: array(CronUpsert),
+	integrations: array(IntegrationSpec).default([]),
+	leases: array(SecretsGrant),
+	drop: object({
+		assignments: array(string()),
+		crons: array(string())
+	})
 });
+//#endregion
+//#region ../protocol/dist/frames/session.js
 /**
-* Content produced by a tool call.
+* Session read-back (C→D REQ → REP) — the console's on-demand pulls.
 *
-* Tool calls can produce different types of content including
-* standard content blocks (text, images) or file diffs.
+* The CP stores NO session data — neither the list nor the bodies. Sessions are
+* created on the Slack→daemon path and live solely in the daemon's local store
+* (body-locality, §1/§12). So both the session **list** and a session's chat
+* **history** are pulled live from the owning daemon(s) and proxied to the
+* console — never persisted on the CP, never on the orchestration hot path.
 *
-* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
+* - `session/list`: the daemon's live sessions (CP fans this out to all the org's
+*   online daemons and merges, for "all sessions across the workspace").
+* - `session/history`: one cursor-paginated page of a session's transcript.
 */
-const zToolCallContent = union([
-	zContent.and(object({ type: literal("content") })),
-	zDiff.and(object({ type: literal("diff") })),
-	zTerminal.and(object({ type: literal("terminal") }))
-]);
 /**
-* A file location being accessed or modified by a tool.
-*
-* Enables clients to implement "follow-along" features that track
-* which files the agent is working with in real-time.
-*
-* See protocol docs: [Following the Agent](https://agentclientprotocol.com/protocol/tool-calls#following-the-agent)
+* Per-session token accounting, metered by the daemon from the agent's ACP usage
+* stream. Token counts are CUMULATIVE across the session's turns (summed from each
+* turn's `PromptResponse.usage`); context/cost are the LATEST snapshot from the
+* agent's `usage_update` stream. Every field is optional — a runtime that reports
+* no usage yields an absent field, not a zero.
 */
-const zToolCallLocation = object({
-	path: string(),
-	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
-	_meta: record(string(), unknown()).nullish()
+const SessionUsage = object({
+	totalTokens: number().int().optional(),
+	inputTokens: number().int().optional(),
+	outputTokens: number().int().optional(),
+	thoughtTokens: number().int().optional(),
+	cachedReadTokens: number().int().optional(),
+	cachedWriteTokens: number().int().optional(),
+	contextUsed: number().int().optional(),
+	contextSize: number().int().optional(),
+	costAmount: number().optional(),
+	costCurrency: string().optional()
+});
+/** One row in the session list (metadata + console metrics; NOT the transcript). */
+const SessionListItem = object({
+	sessionId: string(),
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	title: string().optional(),
+	status: string().optional(),
+	lastActivityAt: string().optional(),
+	usage: SessionUsage.optional(),
+	triggeredBy: string().optional()
+});
+/** C→D REQ: list the daemon's sessions (optionally just one agent's). */
+const SessionListReq = object({ agentId: string().uuid().optional() });
+/** D→C REP (corr = req id): the daemon's current sessions. */
+const SessionListPage = object({ sessions: array(SessionListItem) });
+/** One message in a session transcript page (a body — returned only for display). */
+const SessionMessage = object({
+	seq: number().int(),
+	sender: string(),
+	ts: string(),
+	kind: string(),
+	text: string()
+});
+/** C→D REQ: fetch one page of a session's history from the owning daemon. */
+const SessionHistoryReq = object({
+	sessionId: string(),
+	cursor: string().optional(),
+	limit: number().int().positive().max(200).default(50)
+});
+/** D→C REP (corr = the req id): a page of messages + the cursor for the next page. */
+const SessionHistoryPage = object({
+	sessionId: string(),
+	messages: array(SessionMessage),
+	nextCursor: string().optional()
 });
+//#endregion
+//#region ../protocol/dist/frame.js
 /**
-* An update to an existing tool call.
+* The single source of truth for the wire: `type` string → payload zod schema.
 *
-* Used to report progress and results as tools execute. All fields except
-* the tool call ID are optional - only changed fields need to be included.
+* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
+* frames) plus the correlated REP types named in the "Reply" column
+* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
+* travel on the wire and must be decodable.
 *
-* See protocol docs: [Updating](https://agentclientprotocol.com/protocol/tool-calls#updating)
-*/
-const zToolCallUpdate = object({
-	toolCallId: zToolCallId,
-	kind: defaultOnError(zToolKind.nullish(), () => void 0),
-	status: defaultOnError(zToolCallStatus.nullish(), () => void 0),
-	title: string().nullish(),
-	content: defaultOnError(vecSkipError(zToolCallContent).nullish(), () => void 0),
-	locations: defaultOnError(vecSkipError(zToolCallLocation).nullish(), () => void 0),
-	rawInput: unknown().optional(),
-	rawOutput: unknown().optional(),
-	_meta: record(string(), unknown()).nullish()
-});
-/**
-* Unique identifier for a permission option.
+* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
+* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
 */
-const zPermissionOptionId = string();
+const FRAME_SCHEMAS = {
+	auth: AuthReq,
+	"auth/ok": AuthOk,
+	register: RegisterReq,
+	"register/ok": RegisterOk,
+	heartbeat: object({
+		load: object({
+			cpu: number(),
+			mem: number(),
+			agents: number().int()
+		}),
+		health: _enum(["ok", "degraded"]),
+		activeSessions: number().int(),
+		degradedScopes: array(string()).default([])
+	}),
+	"agent/launch": AgentLaunch,
+	"agent/launched": AgentLaunched,
+	"agent/stop": AgentStop,
+	"agent/upsert": AgentUpsert,
+	"agent/remove": AgentRemove,
+	"agent/prompt": AgentPrompt,
+	"agent/prompt/ack": AgentPromptAck,
+	"agent/activity": AgentActivity,
+	"agent/scope-denied": AgentScopeDenied,
+	"route/assign": RouteAssign,
+	"route/assign/ack": RouteAssignAck,
+	"route/update": RouteUpdate,
+	"daemon/drain": Drain,
+	"drain/progress": DrainProgress,
+	"drain/done": DrainDone,
+	"cron/upsert": CronUpsert,
+	"cron/remove": CronRemove,
+	"integration/upsert": IntegrationUpsert,
+	"integration/remove": IntegrationRemove,
+	"secrets/request": SecretsRequest,
+	"secrets/grant": SecretsGrant,
+	"secrets/renew": SecretsRenew,
+	"secrets/revoke": SecretsRevoke,
+	"scope-attestation": ScopeAttestation,
+	"event/session": object({
+		sessionId: string().uuid(),
+		agentId: string().uuid(),
+		launchId: string().uuid(),
+		phase: _enum([
+			"start",
+			"plan",
+			"problem",
+			"end"
+		]),
+		link: string().optional(),
+		summary: string().optional(),
+		ts: string().datetime()
+	}),
+	"usage/report": object({
+		sessionId: string(),
+		agentId: string().uuid(),
+		platform: string().optional(),
+		channel: string().optional(),
+		lastActivityAt: string(),
+		usage: SessionUsage
+	}),
+	"facts/runtime-profile": object({
+		runtime: string(),
+		version: string(),
+		models: array(string()),
+		contextWindow: number().int().optional(),
+		acpSupport: _enum([
+			"full",
+			"partial",
+			"none"
+		]),
+		toolCalling: boolean()
+	}),
+	"session/list": SessionListReq,
+	"session/list/page": SessionListPage,
+	"session/history": SessionHistoryReq,
+	"session/history/page": SessionHistoryPage,
+	"config/push": object({ keys: record(string(), unknown()) }),
+	"daemon/restart": object({
+		reason: string(),
+		drainFirst: boolean().default(true)
+	}),
+	"daemon/upgrade": object({
+		targetVersion: string(),
+		drainFirst: boolean().default(true)
+	}),
+	"daemon/control/ack": object({
+		accepted: boolean(),
+		willDrainUntil: string().datetime().optional()
+	}),
+	ack: object({
+		ok: boolean(),
+		reason: string().optional()
+	}),
+	error: object({
+		code: _enum([
+			"UNKNOWN_FRAME",
+			"FRAME_TOO_LARGE",
+			"PROTOCOL_STATE",
+			"BAD_PAYLOAD",
+			"AUTH_FAILED",
+			"ATTESTATION_INVALID",
+			"STALE_EPOCH",
+			"STALE_LAUNCH",
+			"SEQ_GAP",
+			"NO_SESSION",
+			"HELD",
+			"SCOPE_DENIED",
+			"LEASE_EXPIRED",
+			"LEASE_DENIED",
+			"RATE_LIMITED",
+			"INTERNAL"
+		]),
+		message: string(),
+		retryable: boolean(),
+		details: record(string(), unknown()).optional()
+	})
+};
+Object.keys(FRAME_SCHEMAS);
 /**
-* The type of permission option being presented to the user.
-*
-* Helps clients choose appropriate icons and UI treatment.
+* Builds the envelope schema for one frame `type` with a `type` literal and the
+* typed payload, so the discriminated union infers `payload` precisely.
 */
-const zPermissionOptionKind = union([
-	literal("allow_once"),
-	literal("allow_always"),
-	literal("reject_once"),
-	literal("reject_always")
+function frame(type, payload) {
+	return object({
+		v: literal(1),
+		id: string().uuid(),
+		ts: string().datetime(),
+		type: literal(type),
+		corr: string().uuid().optional(),
+		payload
+	});
+}
+discriminatedUnion("type", [
+	frame("auth", FRAME_SCHEMAS["auth"]),
+	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
+	frame("register", FRAME_SCHEMAS["register"]),
+	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
+	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
+	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
+	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
+	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
+	frame("agent/upsert", FRAME_SCHEMAS["agent/upsert"]),
+	frame("agent/remove", FRAME_SCHEMAS["agent/remove"]),
+	frame("agent/prompt", FRAME_SCHEMAS["agent/prompt"]),
+	frame("agent/prompt/ack", FRAME_SCHEMAS["agent/prompt/ack"]),
+	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
+	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
+	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
+	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
+	frame("route/update", FRAME_SCHEMAS["route/update"]),
+	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
+	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
+	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
+	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
+	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
+	frame("integration/upsert", FRAME_SCHEMAS["integration/upsert"]),
+	frame("integration/remove", FRAME_SCHEMAS["integration/remove"]),
+	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
+	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
+	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
+	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
+	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
+	frame("event/session", FRAME_SCHEMAS["event/session"]),
+	frame("usage/report", FRAME_SCHEMAS["usage/report"]),
+	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
+	frame("session/list", FRAME_SCHEMAS["session/list"]),
+	frame("session/list/page", FRAME_SCHEMAS["session/list/page"]),
+	frame("session/history", FRAME_SCHEMAS["session/history"]),
+	frame("session/history/page", FRAME_SCHEMAS["session/history/page"]),
+	frame("config/push", FRAME_SCHEMAS["config/push"]),
+	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
+	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
+	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
+	frame("ack", FRAME_SCHEMAS["ack"]),
+	frame("error", FRAME_SCHEMAS["error"])
 ]);
+//#endregion
+//#region ../protocol/dist/codec.js
+/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
+const MAX_FRAME_BYTES = 256 * 1024;
+const textEncoder = new TextEncoder();
+function byteLength(text) {
+	return textEncoder.encode(text).length;
+}
+function extractControlExt(json) {
+	if (typeof json !== "object" || json === null) return void 0;
+	const o = json;
+	const ext = {};
+	if (typeof o.epoch === "number") ext.epoch = o.epoch;
+	if (typeof o.seq === "number") ext.seq = o.seq;
+	if (typeof o.agentId === "string") ext.agentId = o.agentId;
+	if (typeof o.launchId === "string") ext.launchId = o.launchId;
+	return Object.keys(ext).length > 0 ? ext : void 0;
+}
+function decodeEnvelope(text) {
+	if (byteLength(text) > 262144) return {
+		ok: false,
+		id: NIL_UUID,
+		msg: "FRAME_TOO_LARGE"
+	};
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		return {
+			ok: false,
+			id: NIL_UUID,
+			msg: "invalid json"
+		};
+	}
+	const env = Envelope.safeParse(json);
+	if (!env.success) return {
+		ok: false,
+		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
+		msg: env.error.message
+	};
+	const schema = FRAME_SCHEMAS[env.data.type];
+	if (!schema) return {
+		ok: false,
+		id: env.data.id,
+		msg: "UNKNOWN_FRAME"
+	};
+	const payload = schema.safeParse(env.data.payload);
+	if (!payload.success) return {
+		ok: false,
+		id: env.data.id,
+		msg: payload.error.message
+	};
+	const ext = extractControlExt(json);
+	return {
+		ok: true,
+		frame: {
+			...env.data,
+			payload: payload.data
+		},
+		...ext ? { ext } : {}
+	};
+}
+function buildEnvelope(type, payload, opts = {}) {
+	return {
+		v: 1,
+		id: opts.id ?? randomUUID(),
+		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+		type,
+		payload,
+		...opts.corr ? { corr: opts.corr } : {},
+		...opts.ext ?? {}
+	};
+}
+function encode(frame) {
+	return JSON.stringify(frame);
+}
+//#endregion
+//#region ../protocol/dist/git-url.js
 /**
-* Request for user permission to execute a tool call.
+* Git repo address helpers, shared by the CP (normalize on write) and the
+* daemon (defensive normalize before clone).
 *
-* Sent when the agent needs authorization before performing a sensitive operation.
-*
-* See protocol docs: [Requesting Permission](https://agentclientprotocol.com/protocol/tool-calls#requesting-permission)
+* STORAGE INVARIANT: `workspace.gitRepo` is persisted as a FULL cloneable git
+* address (e.g. `https://github.com/acme/infra`), never the `acme/infra`
+* shorthand a user may type. UIs shorten it back to `org/repo` for display
+* with `gitRepoLabel`.
 */
-const zRequestPermissionRequest = object({
-	sessionId: zSessionId,
-	toolCall: zToolCallUpdate,
-	options: array(object({
-		optionId: zPermissionOptionId,
-		name: string(),
-		kind: zPermissionOptionKind,
-		_meta: record(string(), unknown()).nullish()
-	})),
-	_meta: record(string(), unknown()).nullish()
-});
+/** Scheme-full address: https://, ssh://, git://, file://, … */
+const SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** scp-like ssh address: git@github.com:acme/infra(.git) */
+const SCP_RE = /^[\w.-]+@[\w.-]+:(.+)$/;
 /**
-* An environment variable to set when launching an MCP server.
+* Normalize a user-supplied repo reference into a full cloneable git address.
+* Idempotent — full addresses pass through unchanged.
+*
+* - `https://…` / `ssh://…` / `git://…` / `git@host:…` → as-is
+* - `github.com/acme/infra` (host-prefixed shorthand)  → `https://github.com/acme/infra`
+* - `acme/infra` (bare org/repo)                       → `https://github.com/acme/infra`
+* - anything else (e.g. a local path) → as-is
 */
-const zEnvVariable = object({
-	name: string(),
-	value: string(),
-	_meta: record(string(), unknown()).nullish()
-});
+function normalizeGitUrl(input) {
+	const s = input.trim().replace(/\/+$/, "");
+	if (!s || SCHEME_RE.test(s) || SCP_RE.test(s)) return s;
+	const segments = s.split("/");
+	if (segments.length >= 3 && segments[0].includes(".")) return `https://${s}`;
+	if (segments.length === 2 && segments.every((p) => p.length > 0)) return `https://github.com/${s}`;
+	return s;
+}
+//#endregion
+//#region ../protocol/dist/index.js
 /**
-* Request to create a new terminal and execute a command.
+* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
+* `AnyFrame` to the member whose `type` matches.
 */
-const zCreateTerminalRequest = object({
-	sessionId: zSessionId,
-	command: string(),
-	args: array(string()).optional(),
+function isFrame(type) {
+	return (frame) => frame.type === type;
+}
+//#endregion
+//#region src/workspace/workspace-manager.ts
+const PULL_TIMEOUT_MS = 4500;
+const cloneInFlight = /* @__PURE__ */ new Map();
+async function prepareWorkspace(agent) {
+	const cwd = agent.workspace.path;
+	mkdirSync(cwd, { recursive: true });
+	if (agent.workspace.mode === "from-scratch") {
+		const mem = join(cwd, "memory.md");
+		if (!existsSync(mem)) writeFileSync(mem, `# ${agent.name} memory\n`);
+		return cwd;
+	}
+	if (!existsSync(join(cwd, ".git"))) {
+		await cloneRepo(agent);
+		return cwd;
+	}
+	if (agent.workspace.pullOnNewSession) try {
+		await Promise.race([simpleGit(cwd).pull(["--ff-only"]), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("pull timeout")), PULL_TIMEOUT_MS))]);
+	} catch {}
+	return cwd;
+}
+/**
+* Eagerly clone a git-repo workspace that has no checkout yet — for reconcile-time
+* prefetch so the repo is warm before the first message arrives. No-op for
+* from-scratch or an already-cloned checkout (the session-time `prepareWorkspace`
+* stays authoritative and still owns pull + hard-fail). Reuses the single-flight
+* lock so a prefetch and a concurrent session-start clone never race into the same
+* dir. The caller invokes this fire-and-forget and logs any rejection — clone
+* failure here is non-fatal because `prepareWorkspace` re-clones (and hard-fails)
+* on the first session as the backstop.
+*/
+async function prefetchWorkspace(agent) {
+	if (agent.workspace.mode !== "git-repo") return;
+	const cwd = agent.workspace.path;
+	if (existsSync(join(cwd, ".git"))) return;
+	mkdirSync(cwd, { recursive: true });
+	await cloneRepo(agent);
+}
+/** Clone agent.workspace.gitRepo @ gitBranch into cwd, single-flight per cwd. */
+async function cloneRepo(agent) {
+	const cwd = agent.workspace.path;
+	const inflight = cloneInFlight.get(cwd);
+	if (inflight) return inflight;
+	const gitRepo = agent.workspace.gitRepo && normalizeGitUrl(agent.workspace.gitRepo);
+	if (!gitRepo) throw new Error(`workspace clone: agent "${agent.id}" has git-repo mode but no gitRepo configured`);
+	const branch = agent.workspace.gitBranch;
+	const p = (async () => {
+		await simpleGit().clone(gitRepo, cwd, [
+			"--branch",
+			branch,
+			"--single-branch"
+		]);
+	})().finally(() => {
+		cloneInFlight.delete(cwd);
+	});
+	cloneInFlight.set(cwd, p);
+	return p;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/index.js
+const AGENT_METHODS = {
+	initialize: "initialize",
+	authenticate: "authenticate",
+	providers_list: "providers/list",
+	providers_set: "providers/set",
+	providers_disable: "providers/disable",
+	session_new: "session/new",
+	session_load: "session/load",
+	session_set_mode: "session/set_mode",
+	session_set_config_option: "session/set_config_option",
+	session_prompt: "session/prompt",
+	session_cancel: "session/cancel",
+	mcp_message: "mcp/message",
+	session_list: "session/list",
+	session_delete: "session/delete",
+	session_fork: "session/fork",
+	session_resume: "session/resume",
+	session_close: "session/close",
+	logout: "logout",
+	nes_start: "nes/start",
+	nes_suggest: "nes/suggest",
+	nes_accept: "nes/accept",
+	nes_reject: "nes/reject",
+	nes_close: "nes/close",
+	document_did_open: "document/didOpen",
+	document_did_change: "document/didChange",
+	document_did_close: "document/didClose",
+	document_did_save: "document/didSave",
+	document_did_focus: "document/didFocus"
+};
+const CLIENT_METHODS = {
+	session_request_permission: "session/request_permission",
+	session_update: "session/update",
+	fs_write_text_file: "fs/write_text_file",
+	fs_read_text_file: "fs/read_text_file",
+	terminal_create: "terminal/create",
+	terminal_output: "terminal/output",
+	terminal_release: "terminal/release",
+	terminal_wait_for_exit: "terminal/wait_for_exit",
+	terminal_kill: "terminal/kill",
+	mcp_connect: "mcp/connect",
+	mcp_message: "mcp/message",
+	mcp_disconnect: "mcp/disconnect",
+	elicitation_create: "elicitation/create",
+	elicitation_complete: "elicitation/complete"
+};
+const PROTOCOL_METHODS = { cancel_request: "$/cancel_request" };
+//#endregion
+//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema-deserialize.js
+const skippedItem = Symbol("skippedItem");
+function defaultOnError(schema, fallback) {
+	return schema.catch(fallback);
+}
+function requiredDefaultOnError(schema, fallback) {
+	const schemaWithCatch = schema.catch(fallback);
+	return unknown().transform((value, context) => {
+		if (value !== void 0) return schemaWithCatch.parse(value);
+		context.addIssue({
+			code: "custom",
+			message: "Required value is missing"
+		});
+		return NEVER;
+	});
+}
+function vecSkipError(itemSchema) {
+	return array(itemSchema.catch(skippedItem)).transform((items) => items.filter((item) => item !== skippedItem));
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/zod.gen.js
+/**
+* JSON RPC Request Id
+*
+* An identifier established by the Client that MUST contain a String, Number, or NULL value if included. If it is not included it is assumed to be a notification. The value SHOULD normally not be Null \[1\] and Numbers SHOULD NOT contain fractional parts \[2\]
+*
+* The Server MUST reply with the same value in the Response object if included. This member is used to correlate the context between the two objects.
+*
+* \[1\] The use of Null as a value for the id member in a Request object is discouraged, because this specification uses a value of Null for Responses with an unknown id. Also, because JSON-RPC 1.0 uses an id value of Null for Notifications this could cause confusion in handling.
+*
+* \[2\] Fractional parts may be problematic, since many decimal fractions cannot be represented exactly as binary fractions.
+*/
+const zRequestId = union([number(), string()]).nullable();
+/**
+* A unique identifier for a conversation session between a client and agent.
+*
+* Sessions maintain their own context, conversation history, and state,
+* allowing multiple independent interactions with the same agent.
+*
+* See protocol docs: [Session ID](https://agentclientprotocol.com/protocol/session-setup#session-id)
+*/
+const zSessionId = string();
+/**
+* Request to write content to a text file.
+*
+* Only available if the client supports the `fs.writeTextFile` capability.
+*/
+const zWriteTextFileRequest = object({
+	sessionId: zSessionId,
+	path: string(),
+	content: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Request to read content from a text file.
+*
+* Only available if the client supports the `fs.readTextFile` capability.
+*/
+const zReadTextFileRequest = object({
+	sessionId: zSessionId,
+	path: string(),
+	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
+	limit: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Unique identifier for a tool call within a session.
+*/
+const zToolCallId = string();
+/**
+* Categories of tools that can be invoked.
+*
+* Tool kinds help clients choose appropriate icons and optimize how they
+* display tool execution progress.
+*
+* See protocol docs: [Creating](https://agentclientprotocol.com/protocol/tool-calls#creating)
+*/
+const zToolKind = union([
+	literal("read"),
+	literal("edit"),
+	literal("delete"),
+	literal("move"),
+	literal("search"),
+	literal("execute"),
+	literal("think"),
+	literal("fetch"),
+	literal("switch_mode"),
+	literal("other")
+]);
+/**
+* Execution status of a tool call.
+*
+* Tool calls progress through different statuses during their lifecycle.
+*
+* See protocol docs: [Status](https://agentclientprotocol.com/protocol/tool-calls#status)
+*/
+const zToolCallStatus = union([
+	literal("pending"),
+	literal("in_progress"),
+	literal("completed"),
+	literal("failed")
+]);
+/**
+* Optional annotations for the client. The client can use annotations to inform how objects are used or displayed
+*/
+const zAnnotations = object({
+	audience: defaultOnError(vecSkipError(union([literal("assistant"), literal("user")])).nullish(), () => void 0),
+	lastModified: string().nullish(),
+	priority: number().nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Text provided to or from an LLM.
+*/
+const zTextContent = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	text: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* An image provided to or from an LLM.
+*/
+const zImageContent = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	data: string(),
+	mimeType: string(),
+	uri: string().nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Audio provided to or from an LLM.
+*/
+const zAudioContent = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	data: string(),
+	mimeType: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* A resource that the server is capable of reading, included in a prompt or tool call result.
+*/
+const zResourceLink = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	description: string().nullish(),
+	mimeType: string().nullish(),
+	name: string(),
+	size: number().nullish(),
+	title: string().nullish(),
+	uri: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Resource content that can be embedded in a message.
+*/
+const zEmbeddedResourceResource = union([object({
+	mimeType: string().nullish(),
+	text: string(),
+	uri: string(),
+	_meta: record(string(), unknown()).nullish()
+}), object({
+	blob: string(),
+	mimeType: string().nullish(),
+	uri: string(),
+	_meta: record(string(), unknown()).nullish()
+})]);
+/**
+* The contents of a resource, embedded into a prompt or tool call result.
+*/
+const zEmbeddedResource = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	resource: zEmbeddedResourceResource,
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Content blocks represent displayable information in the Agent Client Protocol.
+*
+* They provide a structured way to handle various types of user-facing content—whether
+* it's text from language models, images for analysis, or embedded resources for context.
+*
+* Content blocks appear in:
+* - User prompts sent via `session/prompt`
+* - Language model output streamed through `session/update` notifications
+* - Progress updates and results from tool calls
+*
+* This structure is compatible with the Model Context Protocol (MCP), enabling
+* agents to seamlessly forward content from MCP tool outputs without transformation.
+*
+* See protocol docs: [Content](https://agentclientprotocol.com/protocol/content)
+*/
+const zContentBlock = union([
+	zTextContent.and(object({ type: literal("text") })),
+	zImageContent.and(object({ type: literal("image") })),
+	zAudioContent.and(object({ type: literal("audio") })),
+	zResourceLink.and(object({ type: literal("resource_link") })),
+	zEmbeddedResource.and(object({ type: literal("resource") }))
+]);
+/**
+* Standard content block (text, images, resources).
+*/
+const zContent = object({
+	content: zContentBlock,
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* A diff representing file modifications.
+*
+* Shows changes to files in a format suitable for display in the client UI.
+*
+* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
+*/
+const zDiff = object({
+	path: string(),
+	oldText: string().nullish(),
+	newText: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Typed identifier used for terminal values on the wire.
+*/
+const zTerminalId = string();
+/**
+* Embed a terminal created with `terminal/create` by its id.
+*
+* The terminal must be added before calling `terminal/release`.
+*
+* See protocol docs: [Terminal](https://agentclientprotocol.com/protocol/terminals)
+*/
+const zTerminal = object({
+	terminalId: zTerminalId,
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Content produced by a tool call.
+*
+* Tool calls can produce different types of content including
+* standard content blocks (text, images) or file diffs.
+*
+* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
+*/
+const zToolCallContent = union([
+	zContent.and(object({ type: literal("content") })),
+	zDiff.and(object({ type: literal("diff") })),
+	zTerminal.and(object({ type: literal("terminal") }))
+]);
+/**
+* A file location being accessed or modified by a tool.
+*
+* Enables clients to implement "follow-along" features that track
+* which files the agent is working with in real-time.
+*
+* See protocol docs: [Following the Agent](https://agentclientprotocol.com/protocol/tool-calls#following-the-agent)
+*/
+const zToolCallLocation = object({
+	path: string(),
+	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* An update to an existing tool call.
+*
+* Used to report progress and results as tools execute. All fields except
+* the tool call ID are optional - only changed fields need to be included.
+*
+* See protocol docs: [Updating](https://agentclientprotocol.com/protocol/tool-calls#updating)
+*/
+const zToolCallUpdate = object({
+	toolCallId: zToolCallId,
+	kind: defaultOnError(zToolKind.nullish(), () => void 0),
+	status: defaultOnError(zToolCallStatus.nullish(), () => void 0),
+	title: string().nullish(),
+	content: defaultOnError(vecSkipError(zToolCallContent).nullish(), () => void 0),
+	locations: defaultOnError(vecSkipError(zToolCallLocation).nullish(), () => void 0),
+	rawInput: unknown().optional(),
+	rawOutput: unknown().optional(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Unique identifier for a permission option.
+*/
+const zPermissionOptionId = string();
+/**
+* The type of permission option being presented to the user.
+*
+* Helps clients choose appropriate icons and UI treatment.
+*/
+const zPermissionOptionKind = union([
+	literal("allow_once"),
+	literal("allow_always"),
+	literal("reject_once"),
+	literal("reject_always")
+]);
+/**
+* Request for user permission to execute a tool call.
+*
+* Sent when the agent needs authorization before performing a sensitive operation.
+*
+* See protocol docs: [Requesting Permission](https://agentclientprotocol.com/protocol/tool-calls#requesting-permission)
+*/
+const zRequestPermissionRequest = object({
+	sessionId: zSessionId,
+	toolCall: zToolCallUpdate,
+	options: array(object({
+		optionId: zPermissionOptionId,
+		name: string(),
+		kind: zPermissionOptionKind,
+		_meta: record(string(), unknown()).nullish()
+	})),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* An environment variable to set when launching an MCP server.
+*/
+const zEnvVariable = object({
+	name: string(),
+	value: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Request to create a new terminal and execute a command.
+*/
+const zCreateTerminalRequest = object({
+	sessionId: zSessionId,
+	command: string(),
+	args: array(string()).optional(),
 	env: array(zEnvVariable).optional(),
 	cwd: string().nullish(),
 	outputByteLimit: number().nullish(),
@@ -16860,1123 +17617,398 @@ var ClientApp = class {
 			this[runClientConnectHandlers](state.connection);
 			return state;
 		}
-		const [thisStream, peerStream] = memoryStreamPair();
-		const peerRawConnection = target[appBuilder]().connect(peerStream);
-		const peerConnection = agentConnection(peerRawConnection);
-		const state = this.openStreamConnection(thisStream);
-		state.rawConnection.closed.then(() => peerConnection.close());
-		peerRawConnection.closed.then(() => state.connection.close());
-		try {
-			target[runAgentConnectHandlers](peerConnection);
-			this[runClientConnectHandlers](state.connection);
-		} catch (error) {
-			peerConnection.close(error);
-			state.connection.close(error);
-			throw error;
-		}
-		return state;
-	}
-	openStreamConnection(stream) {
-		const rawConnection = this.builder.connect(stream);
-		return {
-			rawConnection,
-			connection: clientConnection(rawConnection, this.connectHandlers)
-		};
-	}
-};
-AGENT_METHODS.initialize, AGENT_METHODS.authenticate, AGENT_METHODS.providers_list, AGENT_METHODS.providers_set, AGENT_METHODS.providers_disable, AGENT_METHODS.session_new, AGENT_METHODS.session_load, AGENT_METHODS.session_set_mode, AGENT_METHODS.session_set_config_option, AGENT_METHODS.session_prompt, AGENT_METHODS.session_list, AGENT_METHODS.session_delete, AGENT_METHODS.session_fork, AGENT_METHODS.session_resume, AGENT_METHODS.session_close, AGENT_METHODS.logout, AGENT_METHODS.nes_start, AGENT_METHODS.nes_suggest, AGENT_METHODS.nes_close;
-AGENT_METHODS.session_cancel, AGENT_METHODS.nes_accept, AGENT_METHODS.nes_reject, AGENT_METHODS.document_did_open, AGENT_METHODS.document_did_change, AGENT_METHODS.document_did_close, AGENT_METHODS.document_did_save, AGENT_METHODS.document_did_focus;
-CLIENT_METHODS.session_request_permission, CLIENT_METHODS.fs_write_text_file, CLIENT_METHODS.fs_read_text_file, CLIENT_METHODS.terminal_create, CLIENT_METHODS.terminal_output, CLIENT_METHODS.terminal_release, CLIENT_METHODS.terminal_wait_for_exit, CLIENT_METHODS.terminal_kill, CLIENT_METHODS.elicitation_create;
-CLIENT_METHODS.session_update, CLIENT_METHODS.elicitation_complete;
-//#endregion
-//#region src/runtimes/probe.ts
-/**
-* Host-availability probing for runtimes.
-*
-* `resolveRuntimes()` produces a runtime for every ACP-registry entry that has a
-* distribution for this platform — but that says nothing about whether the tool
-* is actually runnable *here*. This module answers that question so the daemon
-* only advertises genuinely-installed runtimes in `RegisterReq.capabilities`.
-*
-* Two layers:
-*  1. A generic launcher check — is the runtime's `command` resolvable? For a
-*     runtime distributed as a real binary (`command` is the tool's own
-*     executable) this is a meaningful signal: the binary on `$PATH` means it's
-*     installed.
-*  2. For runtimes distributed via a package launcher (`npx`/`uvx`), (1) is
-*     meaningless — the launcher fetches on demand, so "npx exists" is true on
-*     virtually every dev host and tells us nothing about the wrapped agent. For
-*     those we REQUIRE a per-runtime custom probe (`CUSTOM_PROBES`) that looks for
-*     the wrapped CLI's own config/state dir, which appears once the user has
-*     installed and run/initialized it. A launcher-distributed runtime with no
-*     probe is treated as NOT installed — otherwise every npx/uvx agent in the
-*     ACP registry would be falsely advertised just because `npx` is on `$PATH`.
-*
-* The custom probes test for the config *directory* (the "installed & initialized
-* on this host" signal). A stricter "is logged in" check would look for the auth
-* file instead (e.g. `~/.codex/auth.json`), but that yields false negatives for
-* users who authenticate via an API-key env var, so directory presence is the
-* pragmatic signal. Paths verified against each tool's docs (June 2026).
-*/
-const isWin = process.platform === "win32";
-function isExecutableFile(p) {
-	try {
-		accessSync(p, isWin ? constants.F_OK : constants.X_OK);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Resolve a launcher command the way a shell would. A command containing a path
-* separator is treated as a literal path; a bare name is searched across `$PATH`
-* (trying `$PATHEXT` extensions on Windows).
-*/
-function isCommandAvailable(command, env = process.env) {
-	return resolveCommandPath(command, env) !== void 0;
-}
-/**
-* Resolve a launcher/command to its absolute path the way a shell would — a path
-* containing a separator is checked literally; a bare name is searched across
-* `$PATH` (trying `$PATHEXT` extensions on Windows). Returns undefined if not found.
-*/
-function resolveCommandPath(command, env = process.env) {
-	const exts = isWin ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")] : [""];
-	if (command.includes("/") || isWin && command.includes("\\")) return exts.map((ext) => command + ext).find(isExecutableFile);
-	const dirs = (env.PATH ?? "").split(delimiter).filter(Boolean);
-	for (const dir of dirs) for (const ext of exts) {
-		const p = join(dir, command) + ext;
-		if (isExecutableFile(p)) return p;
-	}
-}
-function home(env) {
-	return (isWin ? env.USERPROFILE : env.HOME) || homedir();
-}
-function xdgConfigHome(env) {
-	return env.XDG_CONFIG_HOME || join(home(env), ".config");
-}
-function xdgDataHome(env) {
-	return env.XDG_DATA_HOME || join(home(env), ".local", "share");
-}
-function pathExists(p) {
-	return !!p && existsSync(p);
-}
-/** True if any candidate path exists (undefined candidates are skipped). */
-function anyExists(...candidates) {
-	return candidates.some(pathExists);
-}
-/**
-* Custom probes keyed by ACP-registry runtime id. Add an entry here whenever the
-* launcher-on-PATH check is too weak to mean "actually installed & set up".
-* Each tests for the tool's home/XDG config dir (or, where the dir is ambiguous,
-* a tool-specific file), honoring the documented env overrides.
-*/
-const CUSTOM_PROBES = {
-	"claude-acp": (env) => anyExists(join(home(env), ".claude"), join(home(env), ".claude.json")),
-	"codex-acp": (env) => anyExists(env.CODEX_HOME, join(home(env), ".codex")),
-	gemini: (env) => pathExists(join(home(env), ".gemini")),
-	"qwen-code": (env) => pathExists(join(home(env), ".qwen")),
-	"github-copilot-cli": (env) => anyExists(env.COPILOT_HOME, join(home(env), ".copilot")),
-	cursor: (env) => anyExists(env.CURSOR_CONFIG_DIR ? join(env.CURSOR_CONFIG_DIR, "cli-config.json") : void 0, join(home(env), ".cursor", "cli-config.json")),
-	opencode: (env) => anyExists(join(xdgConfigHome(env), "opencode"), join(xdgDataHome(env), "opencode", "auth.json")),
-	goose: (env) => pathExists(join(xdgConfigHome(env), "goose")),
-	"amp-acp": (env) => anyExists(env.AMP_SETTINGS_FILE, join(xdgConfigHome(env), "amp")),
-	auggie: (env) => pathExists(join(home(env), ".augment")),
-	cline: (env) => anyExists(env.CLINE_DATA_DIR, join(home(env), ".cline")),
-	"grok-build": (env) => pathExists(join(home(env), ".grok")),
-	kimi: (env) => anyExists(env.KIMI_CODE_HOME, join(home(env), ".kimi"), join(home(env), ".kimi-code")),
-	"factory-droid": (env) => pathExists(join(home(env), ".factory")),
-	devin: (env) => anyExists(join(xdgConfigHome(env), "devin"), join(xdgDataHome(env), "devin"))
-};
-/**
-* Package launchers that fetch-and-run on demand. When a runtime is launched via
-* one of these, the launcher being on `$PATH` says nothing about whether the
-* wrapped agent is installed, so such runtimes require a custom probe to count.
-*/
-const PACKAGE_LAUNCHERS = /* @__PURE__ */ new Set(["npx", "uvx"]);
-/** Is this runtime actually usable on this host? */
-function isRuntimeAvailable(id, rt, env = process.env) {
-	if (!isCommandAvailable(rt.command, env)) return false;
-	const custom = CUSTOM_PROBES[id];
-	if (custom) return custom(env);
-	return !PACKAGE_LAUNCHERS.has(rt.command);
-}
-/**
-* Filter a runtime map down to those installed on this host — what the daemon
-* should report to the Control Plane and is able to launch.
-*/
-function installedRuntimes(runtimes, env = process.env) {
-	const out = {};
-	for (const [id, rt] of Object.entries(runtimes)) if (isRuntimeAvailable(id, rt, env)) out[id] = rt;
-	return out;
-}
-//#endregion
-//#region src/acp/acp-host.ts
-const PROTOCOL_VERSION = 1;
-/**
-* Extract the model selector from a session's `configOptions`. ACP models are an
-* (experimental) session config option tagged `category: "model"`, `type:
-* "select"`; the selectable values (optionally grouped) are the model list.
-* Returns null when the agent advertises no model selector.
-*/
-function modelOptionsFrom(configOptions) {
-	const model = configOptions?.find((o) => o.category === "model" && o.type === "select");
-	if (!model || model.type !== "select") return null;
-	const models = model.options.flatMap((o) => "group" in o ? o.options : [o]).map((o) => o.value);
-	return {
-		current: model.currentValue,
-		models
-	};
-}
-var AcpHost = class {
-	runtime;
-	opts;
-	child;
-	conn;
-	live = /* @__PURE__ */ new Set();
-	loadingSessions = /* @__PURE__ */ new Set();
-	canLoad = false;
-	promptCaps = {};
-	lastModelOptions = null;
-	constructor(runtime, opts) {
-		this.runtime = runtime;
-		this.opts = opts;
-	}
-	/** A Claude Code runtime (its command/args reference `claude`) — these embed the
-	*  @anthropic-ai/claude-agent-sdk, which needs a Claude Code executable. */
-	isClaudeRuntime() {
-		return [this.runtime.command, ...this.runtime.args].join(" ").toLowerCase().includes("claude");
-	}
-	async start() {
-		if (this.child) throw new Error("AcpHost: already started");
-		const env = {
-			...process.env,
-			...Object.fromEntries(this.runtime.env.map((e) => [e.name, e.value])),
-			...this.opts.env ?? {}
-		};
-		if (!env.CLAUDE_CODE_EXECUTABLE && this.isClaudeRuntime()) {
-			const claude = resolveCommandPath("claude", env);
-			if (claude) {
-				env.CLAUDE_CODE_EXECUTABLE = claude;
-				this.opts.log?.info(`acp: CLAUDE_CODE_EXECUTABLE not set — using claude on PATH (${claude})`);
-			}
-		}
-		const child = spawn(this.runtime.command, this.runtime.args, {
-			stdio: [
-				"pipe",
-				"pipe",
-				"inherit"
-			],
-			env
-		});
-		this.child = child;
-		if (!child.stdin || !child.stdout) throw new Error("AcpHost: subprocess stdin/stdout are not piped");
-		const stream = ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
-		const self = this;
-		this.conn = client({ name: "agentconnect" }).onNotification(methods.client.session.update, (ctx) => {
-			if (self.loadingSessions.has(ctx.params.sessionId)) return;
-			self.opts.onUpdate(ctx.params.sessionId, ctx.params.update);
-		}).onRequest(methods.client.session.requestPermission, (ctx) => {
-			const optionId = (ctx.params.options.find((o) => o.kind === "allow_once" || o.kind === "allow_always") ?? ctx.params.options[0])?.optionId;
-			return { outcome: optionId ? {
-				outcome: "selected",
-				optionId
-			} : { outcome: "cancelled" } };
-		}).connect(stream);
-		const init = await this.conn.agent.request(methods.agent.initialize, {
-			protocolVersion: PROTOCOL_VERSION,
-			clientCapabilities: { fs: {
-				readTextFile: false,
-				writeTextFile: false
-			} }
-		});
-		this.canLoad = init.agentCapabilities?.loadSession ?? false;
-		this.promptCaps = init.agentCapabilities?.promptCapabilities ?? {};
-		this.opts.log?.debug(`acp: agent initialized (loadSession=${this.canLoad}, prompt caps: image=${!!this.promptCaps.image} audio=${!!this.promptCaps.audio} embeddedContext=${!!this.promptCaps.embeddedContext})`);
-	}
-	/** Whether the agent advertised support for a gated prompt content-block kind.
-	*  `text` and `resource_link` are baseline and always return true. */
-	promptSupports(kind) {
-		return Boolean(this.promptCaps[kind]);
-	}
-	async newSession(cwd, mcpServers = []) {
-		const res = await this.conn.agent.request(methods.agent.session.new, {
-			cwd,
-			mcpServers
-		});
-		this.lastModelOptions = modelOptionsFrom(res.configOptions);
-		this.live.add(res.sessionId);
-		return res.sessionId;
-	}
-	/** The model selector advertised by the most recent session/new, or null if the
-	*  agent exposed none. Used by the runtime probe to report available models. */
-	modelOptions() {
-		return this.lastModelOptions;
-	}
-	/** True iff THIS agent process created or loaded `sessionId` in its current lifetime. */
-	hasSession(sessionId) {
-		return this.live.has(sessionId);
-	}
-	/** Whether the agent advertised the `loadSession` capability (session/load is usable). */
-	loadSupported() {
-		return this.canLoad;
-	}
-	/** Resume a previously-created session by id (ACP `session/load`). The agent
-	*  restores its own history server-side; its replayed session/update stream is
-	*  suppressed so it isn't re-posted. Throws if the agent can't load the id
-	*  (caller falls back to newSession). */
-	async loadSession(sessionId, cwd) {
-		this.loadingSessions.add(sessionId);
-		try {
-			await this.conn.agent.request(methods.agent.session.load, {
-				sessionId,
-				cwd,
-				mcpServers: []
-			});
-			this.live.add(sessionId);
-			this.opts.log?.info(`acp: resumed session ${sessionId} via session/load`);
-		} catch (err) {
-			this.opts.log?.debug(`acp: session/load failed for ${sessionId} (${err.message}) — will recreate`);
-			throw err;
-		} finally {
-			this.loadingSessions.delete(sessionId);
-		}
-	}
-	/** Drive one turn to completion. Returns the stop reason plus the agent's token
-	*  `usage` when the runtime reports it (ACP's experimental per-turn usage, which
-	*  carries session-cumulative counts) — `undefined` when it doesn't. */
-	async prompt(sessionId, blocks) {
-		const res = await this.conn.agent.request(methods.agent.session.prompt, {
-			sessionId,
-			prompt: blocks
-		});
-		return {
-			stopReason: res.stopReason,
-			usage: res.usage ?? void 0
-		};
-	}
-	async cancel(sessionId) {
-		await this.conn.agent.notify(methods.agent.session.cancel, { sessionId });
-	}
-	/** Stop the adapter child: SIGTERM, then escalate to SIGKILL if it hasn't exited
-	*  within `deadlineMs` (a buggy/hung agent must never block daemon shutdown or an
-	*  idle reap). Idempotent — the child handle is cleared up front so a concurrent
-	*  stop (drain + reconcile racing) is a no-op rather than a double-kill. */
-	async stop(deadlineMs = 5e3) {
-		const child = this.child;
-		if (!child) return;
-		this.child = void 0;
-		child.kill("SIGTERM");
-		await new Promise((resolve) => {
-			let settled = false;
-			const done = () => {
-				if (settled) return;
-				settled = true;
-				clearTimeout(timer);
-				resolve();
-			};
-			const timer = setTimeout(() => {
-				this.opts.log?.warn(`acp: child ignored SIGTERM after ${deadlineMs}ms — sending SIGKILL`);
-				child.kill("SIGKILL");
-			}, deadlineMs);
-			child.once("exit", done);
-		});
-	}
-};
-//#endregion
-//#region src/cli/chat.ts
-function renderUpdate(out) {
-	return (_sessionId, update) => {
-		if (update.sessionUpdate === "agent_message_chunk" && update.content.type === "text") out.write(update.content.text);
-		else if (update.sessionUpdate === "tool_call") {
-			const title = "title" in update && update.title || update.toolCallId || "tool";
-			out.write(`\n[tool] ${title}\n`);
-		}
-	};
-}
-async function runChat(opts) {
-	const out = opts.out ?? process.stdout;
-	const root = resolveRoot(opts.root);
-	const cfg = loadConfig({
-		root: opts.root,
-		configPath: opts.configPath,
-		optional: true,
-		overrides: { agentsDir: opts.agentsDir }
-	});
-	const agent = selectAgent(cfg.agentsDir, opts.agentName);
-	const runtimes = await resolveRuntimes(cfg, root, {
-		neededRuntimes: [agent.runtime],
-		mode: "cache-first"
-	});
-	const runtime = runtimes[agent.runtime];
-	if (!runtime) {
-		const available = Object.keys(runtimes).sort().join(", ") || "(none)";
-		throw new Error(`runtime "${agent.runtime}" not found. Available: ${available}`);
-	}
-	const host = new AcpHost(runtime, {
-		onUpdate: renderUpdate(out),
-		env: agentChildEnv(agent)
-	});
-	await host.start();
-	try {
-		const cwd = await prepareWorkspace(agent);
-		const sessionId = await host.newSession(cwd);
-		const send = async (text) => {
-			const blocks = [{
-				type: "text",
-				text
-			}];
-			await host.prompt(sessionId, blocks);
-			out.write("\n");
-		};
-		if (typeof opts.message === "string" && opts.message.length > 0) {
-			await send(opts.message);
-			return;
-		}
-		const rl = createInterface({ input: opts.input ?? process.stdin });
-		out.write(`Chatting with ${agent.name} (${agent.id}). Type .exit to quit.\n> `);
-		try {
-			for await (const line of rl) {
-				const text = line.trim();
-				if (text === ".exit" || text === ".quit") break;
-				if (text.length > 0) await send(text);
-				out.write("> ");
-			}
-		} finally {
-			rl.close();
-		}
-	} finally {
-		await host.stop();
-	}
-}
-//#endregion
-//#region src/version.ts
-const DAEMON_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
-//#endregion
-//#region ../protocol/dist/envelope.js
-/**
-* The protocol envelope — every frame, both directions, is wrapped in this.
-* Mirrors daemon-cp-ws-protocol.md §1.1.
-*
-* `payload` is left as `unknown` here and validated by the per-type schema in
-* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
-* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
-* instead of a hard close — forward-compat, protocol §1.
-*/
-const Envelope = object({
-	v: literal(1),
-	id: string().uuid(),
-	ts: string().datetime(),
-	type: string(),
-	corr: string().uuid().optional(),
-	payload: unknown()
-});
-object({
-	epoch: number().int(),
-	seq: number().int().optional(),
-	agentId: string().uuid().optional(),
-	launchId: string().uuid().optional()
-});
-/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
-const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-//#endregion
-//#region ../protocol/dist/frames/auth.js
-/**
-* Auth & identity — protocol §3.1 / §3.2.
-*
-* `auth` is the first frame after the socket opens. `auth/ok` carries the
-* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
-* resume verdict.
-*/
-const AuthReq = object({
-	apiKey: string(),
-	daemonId: string().uuid().optional(),
-	machineId: string().uuid().optional(),
-	attestation: string().optional(),
-	agentVersion: string(),
-	resume: object({
-		lastEpoch: number().int(),
-		lastRecvSeq: record(string(), number())
-	}).optional()
-});
-const AuthOk = object({
-	daemonId: string().uuid(),
-	sessionEpoch: number().int(),
-	heartbeatSec: number().int(),
-	serverTime: string().datetime(),
-	resume: object({
-		accepted: boolean(),
-		redeliverFromSeq: record(string(), number()).optional()
-	}).optional()
-});
-//#endregion
-//#region ../protocol/dist/frames/route.js
-/**
-* Routing & orchestration (C→D control) — protocol §5.
-*
-* `SessionKey` is the canonical session primitive shared across route/*,
-* agent/*, and event/session. Its canonical string form is
-* `${platform}:${channel}:${thread ?? "-"}`.
-*/
-const Platform = _enum(["slack", "telegram"]);
-const SessionKey = object({
-	platform: Platform,
-	channel: string(),
-	thread: string().optional()
-});
-/** Trigger-matching rule for a binding (protocol §5.1). */
-const BindRule = object({ match: discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]) });
-const RouteAssign = object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	workspaceId: string().uuid(),
-	bindRules: array(BindRule).default([])
-});
-const RouteAssignAck = object({
-	ok: boolean(),
-	sessionKey: SessionKey,
-	reason: string().optional()
-});
-const RouteUpdate = object({
-	routingEpoch: number().int(),
-	rules: array(object({
-		match: unknown(),
-		agentId: string().uuid()
-	}))
-});
-/** Graceful scale-down / rebalance — protocol §5.3. */
-const Drain = object({
-	scope: union([
-		object({
-			kind: literal("agent"),
-			agentId: string().uuid()
-		}),
-		object({ kind: literal("daemon") }),
-		object({
-			kind: literal("session"),
-			sessionKey: SessionKey
-		})
-	]),
-	deadline: string().datetime()
-});
-const DrainProgress = object({
-	remaining: number().int(),
-	drained: array(SessionKey)
-});
-const DrainDone = object({ released: array(SessionKey) });
-//#endregion
-//#region ../protocol/dist/frames/cron.js
-/**
-* Cron sinks to the daemon (D5) — protocol §5.4.
-*
-* The CP owns the definition; the daemon owns firing + last-run persistence so
-* crons fire even when the CP is down.
-*/
-const CronUpsert = object({
-	cronId: string().uuid(),
-	schedule: string(),
-	target: object({ channel: string() }),
-	trigger: string(),
-	enabled: boolean().default(true)
-});
-const CronRemove = object({ cronId: string().uuid() });
-//#endregion
-//#region ../protocol/dist/frames/secrets.js
-/**
-* Secrets (C5 ↔ D10) — protocol §6.
-*
-* Lease-based, no plaintext on the wire or in PG. Every frame carries a
-* REFERENCE to a Vault/KMS path, never the secret material itself.
-*/
-const SecretsRequest = object({ scope: object({
-	platform: Platform,
-	workspaceId: string().uuid()
-}) });
-const SecretsGrant = object({
-	leaseId: string().uuid(),
-	scope: object({
-		platform: string(),
-		workspaceId: string().uuid()
-	}),
-	ref: string(),
-	ttl: number().int(),
-	renewBeforeSec: number().int()
-});
-const SecretsRenew = object({ leaseId: string().uuid() });
-const SecretsRevoke = object({
-	leaseId: string().uuid(),
-	reason: string()
-});
-/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
-const ScopeAttestation = object({
-	machineId: string().uuid(),
-	scope: _enum([
-		"attachment.put",
-		"attachment.get",
-		"facts.put"
-	]),
-	resourceRef: string(),
-	jws: string(),
-	exp: string().datetime()
-});
-//#endregion
-//#region ../protocol/dist/frames/agent.js
-/**
-* Agent lifecycle + delivery (protocol §4.3, §4.4, §7.4, §8).
-*
-* Body-locality invariant (protocol §12): no frame here carries
-* `NormalizedMessage.text`. `agent/prompt` ships a `NormalizedMessageRef` — a
-* reference the daemon resolves against its local body store.
-*/
-/**
-* A REFERENCE/digest of a normalized message, NOT the body (protocol §4.3).
-* Enough for D4/D6 to fetch the local body and prompt.
-*/
-const NormalizedMessageRef = object({
-	sessionKey: SessionKey,
-	platformMsgId: string(),
-	seenUpToSeq: number().int()
-});
-/**
-* Where the agent runs. Two modes; the **path is always daemon-generated** —
-* never specified by the caller (UX picks the mode, the machine owns the dir).
-*
-* - `scratch`: a fresh empty working dir on the machine, no repo.
-* - `github`: the daemon clones `gitRepo` @ `branch` and runs the agent in
-*   `agentDir` (a subdir of the repo, repo-root if omitted). **Multiple agents
-*   may share one repo** — they differ by `agentDir`, so the repo is not an
-*   owned entity, just shared config on each agent.
-*/
-const AgentWorkspace = discriminatedUnion("mode", [object({ mode: literal("scratch") }), object({
-	mode: literal("github"),
-	gitRepo: string(),
-	branch: string().default("main"),
-	agentDir: string().optional()
-})]);
-/**
-* The editable agent definition the CP owns and the daemon needs to run it:
-* prompt + runtime selection. Raft ships this in the launch config and the
-* daemon synthesizes the system prompt locally; `description` IS the prompt.
-*/
-const AgentSpec = object({
-	name: string(),
-	description: string().optional(),
-	runtime: string().optional(),
-	model: string().optional(),
-	reasoningEffort: string().optional(),
-	executionMode: string().optional(),
-	workspace: AgentWorkspace.optional(),
-	env: record(string(), string()).optional()
-});
-const AgentLaunch = object({
-	agentId: string().uuid(),
-	runtime: string(),
-	workspaceId: string().uuid(),
-	capabilities: array(string()),
-	spec: AgentSpec,
-	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
-});
-/**
-* Live agent CRUD (C→D): the console edited an agent's spec; push it so a
-* running daemon reloads without waiting for the next launch. `agent/remove`
-* tears the agent down. Deleting an agent never relaunches it.
-*/
-const AgentUpsert = object({
-	agentId: string().uuid(),
-	spec: AgentSpec
-});
-const AgentRemove = object({ agentId: string().uuid() });
-const AgentLaunched = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	acpSessionId: string().optional(),
-	startedAt: string().datetime(),
-	runtime: string()
-});
-const AgentStop = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	reason: string()
-});
-const AgentPrompt = object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	content: NormalizedMessageRef,
-	seenUpToSeq: number().int()
-});
-const AgentPromptAck = object({
-	accepted: boolean(),
-	reason: _enum([
-		"queued",
-		"held",
-		"scope_denied",
-		"no_session",
-		"stale"
-	]).optional(),
-	seq: number().int()
-});
-const AgentActivity = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	state: _enum([
-		"thinking",
-		"tool_call",
-		"awaiting_permission",
-		"idle"
-	]),
-	ts: string().datetime()
-});
-const AgentScopeDenied = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	capability: string()
-});
-//#endregion
-//#region ../protocol/dist/frames/integration.js
-/**
-* Platform integration distribution (C→D) — the Slack "install" flow.
-*
-* The Control Plane is the source of truth for platform integrations and pushes
-* them to the daemon that owns the integration's agent (`integration/upsert`, and
-* the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket
-* Mode connection from the delivered config (see slack/connection.ts).
-*
-* SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT
-* platform tokens (botToken/appToken). These payloads MUST NEVER be logged — no
-* body dump on decode error, no register/ok snapshot debug dump. The daemon
-* persists them into the owning agent's local `agent.json` (same trust boundary
-* as hand-authored agents, which already keep tokens there) so integrations
-* survive a restart with the CP down.
-*
-* `signingSecret` is intentionally absent: Socket Mode authenticates with the
-* app-level token, so the daemon never needs a signing secret.
-*/
-/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */
-const BindMatch = discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]);
-/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */
-const IntegrationBindRule = object({
-	channel: string().optional(),
-	thread: string().optional(),
-	match: BindMatch
-});
-/** The Slack config the daemon needs to open + route a socket (no signingSecret). */
-const IntegrationSlackConfig = object({
-	botToken: string(),
-	appToken: string(),
-	allowedUserIds: array(string()).default([]),
-	notificationChannelId: string().optional(),
-	bindRules: array(IntegrationBindRule).default([])
-});
-/**
-* One platform integration, owned by exactly one agent. Also the element type of
-* `RegisterOk.integrations[]` (the per-daemon reconcile set).
-*/
-const IntegrationSpec = object({
-	integrationId: string().uuid(),
-	agentId: string().uuid(),
-	platform: literal("slack"),
-	slack: IntegrationSlackConfig
-});
-/** C→D EVT — install/update an integration on the owning agent's daemon. */
-const IntegrationUpsert = IntegrationSpec;
-/** C→D EVT — remove an integration from the daemon. */
-const IntegrationRemove = object({ integrationId: string().uuid() });
-//#endregion
-//#region ../protocol/dist/frames/register.js
-/**
-* Capability upload + the reconcile snapshot — protocol §3.3.
-*
-* `register/ok` is the authoritative source of truth: the daemon converges its
-* local cache to it. CP wins all conflicts, so re-issuing the same snapshot is
-* idempotent.
-*/
-const RegisterReq = object({
-	host: string(),
-	capabilities: object({
-		platforms: array(Platform),
-		runtimes: array(string()),
-		acp: boolean(),
-		features: array(string()).default([])
-	}),
-	maxAgents: number().int(),
-	localState: object({
-		assignments: array(string()),
-		crons: array(string()),
-		leases: array(string())
-	})
-});
-const RegisterOk = object({
-	routingEpoch: number().int(),
-	assignments: array(RouteAssign),
-	agents: array(AgentSpec.extend({ agentId: string().uuid() })).default([]),
-	crons: array(CronUpsert),
-	integrations: array(IntegrationSpec).default([]),
-	leases: array(SecretsGrant),
-	drop: object({
-		assignments: array(string()),
-		crons: array(string())
-	})
-});
-//#endregion
-//#region ../protocol/dist/frames/session.js
-/**
-* Session read-back (C→D REQ → REP) — the console's on-demand pulls.
-*
-* The CP stores NO session data — neither the list nor the bodies. Sessions are
-* created on the Slack→daemon path and live solely in the daemon's local store
-* (body-locality, §1/§12). So both the session **list** and a session's chat
-* **history** are pulled live from the owning daemon(s) and proxied to the
-* console — never persisted on the CP, never on the orchestration hot path.
-*
-* - `session/list`: the daemon's live sessions (CP fans this out to all the org's
-*   online daemons and merges, for "all sessions across the workspace").
-* - `session/history`: one cursor-paginated page of a session's transcript.
-*/
-/**
-* Per-session token accounting, metered by the daemon from the agent's ACP usage
-* stream. Token counts are CUMULATIVE across the session's turns (summed from each
-* turn's `PromptResponse.usage`); context/cost are the LATEST snapshot from the
-* agent's `usage_update` stream. Every field is optional — a runtime that reports
-* no usage yields an absent field, not a zero.
-*/
-const SessionUsage = object({
-	totalTokens: number().int().optional(),
-	inputTokens: number().int().optional(),
-	outputTokens: number().int().optional(),
-	thoughtTokens: number().int().optional(),
-	cachedReadTokens: number().int().optional(),
-	cachedWriteTokens: number().int().optional(),
-	contextUsed: number().int().optional(),
-	contextSize: number().int().optional(),
-	costAmount: number().optional(),
-	costCurrency: string().optional()
-});
-/** One row in the session list (metadata + console metrics; NOT the transcript). */
-const SessionListItem = object({
-	sessionId: string(),
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	title: string().optional(),
-	status: string().optional(),
-	lastActivityAt: string().optional(),
-	usage: SessionUsage.optional(),
-	triggeredBy: string().optional()
-});
-/** C→D REQ: list the daemon's sessions (optionally just one agent's). */
-const SessionListReq = object({ agentId: string().uuid().optional() });
-/** D→C REP (corr = req id): the daemon's current sessions. */
-const SessionListPage = object({ sessions: array(SessionListItem) });
-/** One message in a session transcript page (a body — returned only for display). */
-const SessionMessage = object({
-	seq: number().int(),
-	sender: string(),
-	ts: string(),
-	kind: string(),
-	text: string()
-});
-/** C→D REQ: fetch one page of a session's history from the owning daemon. */
-const SessionHistoryReq = object({
-	sessionId: string(),
-	cursor: string().optional(),
-	limit: number().int().positive().max(200).default(50)
-});
-/** D→C REP (corr = the req id): a page of messages + the cursor for the next page. */
-const SessionHistoryPage = object({
-	sessionId: string(),
-	messages: array(SessionMessage),
-	nextCursor: string().optional()
-});
-//#endregion
-//#region ../protocol/dist/frame.js
-/**
-* The single source of truth for the wire: `type` string → payload zod schema.
-*
-* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
-* frames) plus the correlated REP types named in the "Reply" column
-* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
-* travel on the wire and must be decodable.
-*
-* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
-* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
-*/
-const FRAME_SCHEMAS = {
-	auth: AuthReq,
-	"auth/ok": AuthOk,
-	register: RegisterReq,
-	"register/ok": RegisterOk,
-	heartbeat: object({
-		load: object({
-			cpu: number(),
-			mem: number(),
-			agents: number().int()
-		}),
-		health: _enum(["ok", "degraded"]),
-		activeSessions: number().int(),
-		degradedScopes: array(string()).default([])
-	}),
-	"agent/launch": AgentLaunch,
-	"agent/launched": AgentLaunched,
-	"agent/stop": AgentStop,
-	"agent/upsert": AgentUpsert,
-	"agent/remove": AgentRemove,
-	"agent/prompt": AgentPrompt,
-	"agent/prompt/ack": AgentPromptAck,
-	"agent/activity": AgentActivity,
-	"agent/scope-denied": AgentScopeDenied,
-	"route/assign": RouteAssign,
-	"route/assign/ack": RouteAssignAck,
-	"route/update": RouteUpdate,
-	"daemon/drain": Drain,
-	"drain/progress": DrainProgress,
-	"drain/done": DrainDone,
-	"cron/upsert": CronUpsert,
-	"cron/remove": CronRemove,
-	"integration/upsert": IntegrationUpsert,
-	"integration/remove": IntegrationRemove,
-	"secrets/request": SecretsRequest,
-	"secrets/grant": SecretsGrant,
-	"secrets/renew": SecretsRenew,
-	"secrets/revoke": SecretsRevoke,
-	"scope-attestation": ScopeAttestation,
-	"event/session": object({
-		sessionId: string().uuid(),
-		agentId: string().uuid(),
-		launchId: string().uuid(),
-		phase: _enum([
-			"start",
-			"plan",
-			"problem",
-			"end"
-		]),
-		link: string().optional(),
-		summary: string().optional(),
-		ts: string().datetime()
-	}),
-	"usage/report": object({
-		sessionId: string(),
-		agentId: string().uuid(),
-		platform: string().optional(),
-		channel: string().optional(),
-		lastActivityAt: string(),
-		usage: SessionUsage
-	}),
-	"facts/runtime-profile": object({
-		runtime: string(),
-		version: string(),
-		models: array(string()),
-		contextWindow: number().int().optional(),
-		acpSupport: _enum([
-			"full",
-			"partial",
-			"none"
-		]),
-		toolCalling: boolean()
-	}),
-	"session/list": SessionListReq,
-	"session/list/page": SessionListPage,
-	"session/history": SessionHistoryReq,
-	"session/history/page": SessionHistoryPage,
-	"config/push": object({ keys: record(string(), unknown()) }),
-	"daemon/restart": object({
-		reason: string(),
-		drainFirst: boolean().default(true)
-	}),
-	"daemon/upgrade": object({
-		targetVersion: string(),
-		drainFirst: boolean().default(true)
-	}),
-	"daemon/control/ack": object({
-		accepted: boolean(),
-		willDrainUntil: string().datetime().optional()
-	}),
-	ack: object({
-		ok: boolean(),
-		reason: string().optional()
-	}),
-	error: object({
-		code: _enum([
-			"UNKNOWN_FRAME",
-			"FRAME_TOO_LARGE",
-			"PROTOCOL_STATE",
-			"BAD_PAYLOAD",
-			"AUTH_FAILED",
-			"ATTESTATION_INVALID",
-			"STALE_EPOCH",
-			"STALE_LAUNCH",
-			"SEQ_GAP",
-			"NO_SESSION",
-			"HELD",
-			"SCOPE_DENIED",
-			"LEASE_EXPIRED",
-			"LEASE_DENIED",
-			"RATE_LIMITED",
-			"INTERNAL"
-		]),
-		message: string(),
-		retryable: boolean(),
-		details: record(string(), unknown()).optional()
-	})
+		const [thisStream, peerStream] = memoryStreamPair();
+		const peerRawConnection = target[appBuilder]().connect(peerStream);
+		const peerConnection = agentConnection(peerRawConnection);
+		const state = this.openStreamConnection(thisStream);
+		state.rawConnection.closed.then(() => peerConnection.close());
+		peerRawConnection.closed.then(() => state.connection.close());
+		try {
+			target[runAgentConnectHandlers](peerConnection);
+			this[runClientConnectHandlers](state.connection);
+		} catch (error) {
+			peerConnection.close(error);
+			state.connection.close(error);
+			throw error;
+		}
+		return state;
+	}
+	openStreamConnection(stream) {
+		const rawConnection = this.builder.connect(stream);
+		return {
+			rawConnection,
+			connection: clientConnection(rawConnection, this.connectHandlers)
+		};
+	}
 };
-Object.keys(FRAME_SCHEMAS);
+AGENT_METHODS.initialize, AGENT_METHODS.authenticate, AGENT_METHODS.providers_list, AGENT_METHODS.providers_set, AGENT_METHODS.providers_disable, AGENT_METHODS.session_new, AGENT_METHODS.session_load, AGENT_METHODS.session_set_mode, AGENT_METHODS.session_set_config_option, AGENT_METHODS.session_prompt, AGENT_METHODS.session_list, AGENT_METHODS.session_delete, AGENT_METHODS.session_fork, AGENT_METHODS.session_resume, AGENT_METHODS.session_close, AGENT_METHODS.logout, AGENT_METHODS.nes_start, AGENT_METHODS.nes_suggest, AGENT_METHODS.nes_close;
+AGENT_METHODS.session_cancel, AGENT_METHODS.nes_accept, AGENT_METHODS.nes_reject, AGENT_METHODS.document_did_open, AGENT_METHODS.document_did_change, AGENT_METHODS.document_did_close, AGENT_METHODS.document_did_save, AGENT_METHODS.document_did_focus;
+CLIENT_METHODS.session_request_permission, CLIENT_METHODS.fs_write_text_file, CLIENT_METHODS.fs_read_text_file, CLIENT_METHODS.terminal_create, CLIENT_METHODS.terminal_output, CLIENT_METHODS.terminal_release, CLIENT_METHODS.terminal_wait_for_exit, CLIENT_METHODS.terminal_kill, CLIENT_METHODS.elicitation_create;
+CLIENT_METHODS.session_update, CLIENT_METHODS.elicitation_complete;
+//#endregion
+//#region src/runtimes/probe.ts
 /**
-* Builds the envelope schema for one frame `type` with a `type` literal and the
-* typed payload, so the discriminated union infers `payload` precisely.
+* Host-availability probing for runtimes.
+*
+* `resolveRuntimes()` produces a runtime for every ACP-registry entry that has a
+* distribution for this platform — but that says nothing about whether the tool
+* is actually runnable *here*. This module answers that question so the daemon
+* only advertises genuinely-installed runtimes in `RegisterReq.capabilities`.
+*
+* Two layers:
+*  1. A generic launcher check — is the runtime's `command` resolvable? For a
+*     runtime distributed as a real binary (`command` is the tool's own
+*     executable) this is a meaningful signal: the binary on `$PATH` means it's
+*     installed.
+*  2. For runtimes distributed via a package launcher (`npx`/`uvx`), (1) is
+*     meaningless — the launcher fetches on demand, so "npx exists" is true on
+*     virtually every dev host and tells us nothing about the wrapped agent. For
+*     those we REQUIRE a per-runtime custom probe (`CUSTOM_PROBES`) that looks for
+*     the wrapped CLI's own config/state dir, which appears once the user has
+*     installed and run/initialized it. A launcher-distributed runtime with no
+*     probe is treated as NOT installed — otherwise every npx/uvx agent in the
+*     ACP registry would be falsely advertised just because `npx` is on `$PATH`.
+*
+* The custom probes test for the config *directory* (the "installed & initialized
+* on this host" signal). A stricter "is logged in" check would look for the auth
+* file instead (e.g. `~/.codex/auth.json`), but that yields false negatives for
+* users who authenticate via an API-key env var, so directory presence is the
+* pragmatic signal. Paths verified against each tool's docs (June 2026).
 */
-function frame(type, payload) {
-	return object({
-		v: literal(1),
-		id: string().uuid(),
-		ts: string().datetime(),
-		type: literal(type),
-		corr: string().uuid().optional(),
-		payload
-	});
+const isWin = process.platform === "win32";
+function isExecutableFile(p) {
+	try {
+		accessSync(p, isWin ? constants.F_OK : constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
 }
-discriminatedUnion("type", [
-	frame("auth", FRAME_SCHEMAS["auth"]),
-	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
-	frame("register", FRAME_SCHEMAS["register"]),
-	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
-	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
-	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
-	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
-	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
-	frame("agent/upsert", FRAME_SCHEMAS["agent/upsert"]),
-	frame("agent/remove", FRAME_SCHEMAS["agent/remove"]),
-	frame("agent/prompt", FRAME_SCHEMAS["agent/prompt"]),
-	frame("agent/prompt/ack", FRAME_SCHEMAS["agent/prompt/ack"]),
-	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
-	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
-	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
-	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
-	frame("route/update", FRAME_SCHEMAS["route/update"]),
-	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
-	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
-	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
-	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
-	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
-	frame("integration/upsert", FRAME_SCHEMAS["integration/upsert"]),
-	frame("integration/remove", FRAME_SCHEMAS["integration/remove"]),
-	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
-	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
-	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
-	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
-	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
-	frame("event/session", FRAME_SCHEMAS["event/session"]),
-	frame("usage/report", FRAME_SCHEMAS["usage/report"]),
-	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
-	frame("session/list", FRAME_SCHEMAS["session/list"]),
-	frame("session/list/page", FRAME_SCHEMAS["session/list/page"]),
-	frame("session/history", FRAME_SCHEMAS["session/history"]),
-	frame("session/history/page", FRAME_SCHEMAS["session/history/page"]),
-	frame("config/push", FRAME_SCHEMAS["config/push"]),
-	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
-	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
-	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
-	frame("ack", FRAME_SCHEMAS["ack"]),
-	frame("error", FRAME_SCHEMAS["error"])
-]);
-//#endregion
-//#region ../protocol/dist/codec.js
-/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
-const MAX_FRAME_BYTES = 256 * 1024;
-const textEncoder = new TextEncoder();
-function byteLength(text) {
-	return textEncoder.encode(text).length;
+/**
+* Resolve a launcher command the way a shell would. A command containing a path
+* separator is treated as a literal path; a bare name is searched across `$PATH`
+* (trying `$PATHEXT` extensions on Windows).
+*/
+function isCommandAvailable(command, env = process.env) {
+	return resolveCommandPath(command, env) !== void 0;
 }
-function extractControlExt(json) {
-	if (typeof json !== "object" || json === null) return void 0;
-	const o = json;
-	const ext = {};
-	if (typeof o.epoch === "number") ext.epoch = o.epoch;
-	if (typeof o.seq === "number") ext.seq = o.seq;
-	if (typeof o.agentId === "string") ext.agentId = o.agentId;
-	if (typeof o.launchId === "string") ext.launchId = o.launchId;
-	return Object.keys(ext).length > 0 ? ext : void 0;
+/**
+* Resolve a launcher/command to its absolute path the way a shell would — a path
+* containing a separator is checked literally; a bare name is searched across
+* `$PATH` (trying `$PATHEXT` extensions on Windows). Returns undefined if not found.
+*/
+function resolveCommandPath(command, env = process.env) {
+	const exts = isWin ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")] : [""];
+	if (command.includes("/") || isWin && command.includes("\\")) return exts.map((ext) => command + ext).find(isExecutableFile);
+	const dirs = (env.PATH ?? "").split(delimiter).filter(Boolean);
+	for (const dir of dirs) for (const ext of exts) {
+		const p = join(dir, command) + ext;
+		if (isExecutableFile(p)) return p;
+	}
 }
-function decodeEnvelope(text) {
-	if (byteLength(text) > 262144) return {
-		ok: false,
-		id: NIL_UUID,
-		msg: "FRAME_TOO_LARGE"
+function home(env) {
+	return (isWin ? env.USERPROFILE : env.HOME) || homedir();
+}
+function xdgConfigHome(env) {
+	return env.XDG_CONFIG_HOME || join(home(env), ".config");
+}
+function xdgDataHome(env) {
+	return env.XDG_DATA_HOME || join(home(env), ".local", "share");
+}
+function pathExists(p) {
+	return !!p && existsSync(p);
+}
+/** True if any candidate path exists (undefined candidates are skipped). */
+function anyExists(...candidates) {
+	return candidates.some(pathExists);
+}
+/**
+* Custom probes keyed by ACP-registry runtime id. Add an entry here whenever the
+* launcher-on-PATH check is too weak to mean "actually installed & set up".
+* Each tests for the tool's home/XDG config dir (or, where the dir is ambiguous,
+* a tool-specific file), honoring the documented env overrides.
+*/
+const CUSTOM_PROBES = {
+	"claude-acp": (env) => anyExists(join(home(env), ".claude"), join(home(env), ".claude.json")),
+	"codex-acp": (env) => anyExists(env.CODEX_HOME, join(home(env), ".codex")),
+	gemini: (env) => pathExists(join(home(env), ".gemini")),
+	"qwen-code": (env) => pathExists(join(home(env), ".qwen")),
+	"github-copilot-cli": (env) => anyExists(env.COPILOT_HOME, join(home(env), ".copilot")),
+	cursor: (env) => anyExists(env.CURSOR_CONFIG_DIR ? join(env.CURSOR_CONFIG_DIR, "cli-config.json") : void 0, join(home(env), ".cursor", "cli-config.json")),
+	opencode: (env) => anyExists(join(xdgConfigHome(env), "opencode"), join(xdgDataHome(env), "opencode", "auth.json")),
+	goose: (env) => pathExists(join(xdgConfigHome(env), "goose")),
+	"amp-acp": (env) => anyExists(env.AMP_SETTINGS_FILE, join(xdgConfigHome(env), "amp")),
+	auggie: (env) => pathExists(join(home(env), ".augment")),
+	cline: (env) => anyExists(env.CLINE_DATA_DIR, join(home(env), ".cline")),
+	"grok-build": (env) => pathExists(join(home(env), ".grok")),
+	kimi: (env) => anyExists(env.KIMI_CODE_HOME, join(home(env), ".kimi"), join(home(env), ".kimi-code")),
+	"factory-droid": (env) => pathExists(join(home(env), ".factory")),
+	devin: (env) => anyExists(join(xdgConfigHome(env), "devin"), join(xdgDataHome(env), "devin"))
+};
+/**
+* Package launchers that fetch-and-run on demand. When a runtime is launched via
+* one of these, the launcher being on `$PATH` says nothing about whether the
+* wrapped agent is installed, so such runtimes require a custom probe to count.
+*/
+const PACKAGE_LAUNCHERS = /* @__PURE__ */ new Set(["npx", "uvx"]);
+/** Is this runtime actually usable on this host? */
+function isRuntimeAvailable(id, rt, env = process.env) {
+	if (!isCommandAvailable(rt.command, env)) return false;
+	const custom = CUSTOM_PROBES[id];
+	if (custom) return custom(env);
+	return !PACKAGE_LAUNCHERS.has(rt.command);
+}
+/**
+* Filter a runtime map down to those installed on this host — what the daemon
+* should report to the Control Plane and is able to launch.
+*/
+function installedRuntimes(runtimes, env = process.env) {
+	const out = {};
+	for (const [id, rt] of Object.entries(runtimes)) if (isRuntimeAvailable(id, rt, env)) out[id] = rt;
+	return out;
+}
+//#endregion
+//#region src/acp/acp-host.ts
+const PROTOCOL_VERSION = 1;
+/**
+* Extract the model selector from a session's `configOptions`. ACP models are an
+* (experimental) session config option tagged `category: "model"`, `type:
+* "select"`; the selectable values (optionally grouped) are the model list.
+* Returns null when the agent advertises no model selector.
+*/
+function modelOptionsFrom(configOptions) {
+	const model = configOptions?.find((o) => o.category === "model" && o.type === "select");
+	if (!model || model.type !== "select") return null;
+	const models = model.options.flatMap((o) => "group" in o ? o.options : [o]).map((o) => o.value);
+	return {
+		current: model.currentValue,
+		models
 	};
-	let json;
-	try {
-		json = JSON.parse(text);
-	} catch {
+}
+var AcpHost = class {
+	runtime;
+	opts;
+	child;
+	conn;
+	live = /* @__PURE__ */ new Set();
+	loadingSessions = /* @__PURE__ */ new Set();
+	canLoad = false;
+	promptCaps = {};
+	lastModelOptions = null;
+	constructor(runtime, opts) {
+		this.runtime = runtime;
+		this.opts = opts;
+	}
+	/** A Claude Code runtime (its command/args reference `claude`) — these embed the
+	*  @anthropic-ai/claude-agent-sdk, which needs a Claude Code executable. */
+	isClaudeRuntime() {
+		return [this.runtime.command, ...this.runtime.args].join(" ").toLowerCase().includes("claude");
+	}
+	async start() {
+		if (this.child) throw new Error("AcpHost: already started");
+		const env = {
+			...process.env,
+			...Object.fromEntries(this.runtime.env.map((e) => [e.name, e.value])),
+			...this.opts.env ?? {}
+		};
+		if (!env.CLAUDE_CODE_EXECUTABLE && this.isClaudeRuntime()) {
+			const claude = resolveCommandPath("claude", env);
+			if (claude) {
+				env.CLAUDE_CODE_EXECUTABLE = claude;
+				this.opts.log?.info(`acp: CLAUDE_CODE_EXECUTABLE not set — using claude on PATH (${claude})`);
+			}
+		}
+		const child = spawn(this.runtime.command, this.runtime.args, {
+			stdio: [
+				"pipe",
+				"pipe",
+				"inherit"
+			],
+			env
+		});
+		this.child = child;
+		if (!child.stdin || !child.stdout) throw new Error("AcpHost: subprocess stdin/stdout are not piped");
+		const stream = ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
+		const self = this;
+		this.conn = client({ name: "agentconnect" }).onNotification(methods.client.session.update, (ctx) => {
+			if (self.loadingSessions.has(ctx.params.sessionId)) return;
+			self.opts.onUpdate(ctx.params.sessionId, ctx.params.update);
+		}).onRequest(methods.client.session.requestPermission, (ctx) => {
+			const optionId = (ctx.params.options.find((o) => o.kind === "allow_once" || o.kind === "allow_always") ?? ctx.params.options[0])?.optionId;
+			return { outcome: optionId ? {
+				outcome: "selected",
+				optionId
+			} : { outcome: "cancelled" } };
+		}).connect(stream);
+		const init = await this.conn.agent.request(methods.agent.initialize, {
+			protocolVersion: PROTOCOL_VERSION,
+			clientCapabilities: { fs: {
+				readTextFile: false,
+				writeTextFile: false
+			} }
+		});
+		this.canLoad = init.agentCapabilities?.loadSession ?? false;
+		this.promptCaps = init.agentCapabilities?.promptCapabilities ?? {};
+		this.opts.log?.debug(`acp: agent initialized (loadSession=${this.canLoad}, prompt caps: image=${!!this.promptCaps.image} audio=${!!this.promptCaps.audio} embeddedContext=${!!this.promptCaps.embeddedContext})`);
+	}
+	/** Whether the agent advertised support for a gated prompt content-block kind.
+	*  `text` and `resource_link` are baseline and always return true. */
+	promptSupports(kind) {
+		return Boolean(this.promptCaps[kind]);
+	}
+	async newSession(cwd, mcpServers = []) {
+		const res = await this.conn.agent.request(methods.agent.session.new, {
+			cwd,
+			mcpServers
+		});
+		this.lastModelOptions = modelOptionsFrom(res.configOptions);
+		this.live.add(res.sessionId);
+		return res.sessionId;
+	}
+	/** The model selector advertised by the most recent session/new, or null if the
+	*  agent exposed none. Used by the runtime probe to report available models. */
+	modelOptions() {
+		return this.lastModelOptions;
+	}
+	/** True iff THIS agent process created or loaded `sessionId` in its current lifetime. */
+	hasSession(sessionId) {
+		return this.live.has(sessionId);
+	}
+	/** Whether the agent advertised the `loadSession` capability (session/load is usable). */
+	loadSupported() {
+		return this.canLoad;
+	}
+	/** Resume a previously-created session by id (ACP `session/load`). The agent
+	*  restores its own history server-side; its replayed session/update stream is
+	*  suppressed so it isn't re-posted. Throws if the agent can't load the id
+	*  (caller falls back to newSession). */
+	async loadSession(sessionId, cwd) {
+		this.loadingSessions.add(sessionId);
+		try {
+			await this.conn.agent.request(methods.agent.session.load, {
+				sessionId,
+				cwd,
+				mcpServers: []
+			});
+			this.live.add(sessionId);
+			this.opts.log?.info(`acp: resumed session ${sessionId} via session/load`);
+		} catch (err) {
+			this.opts.log?.debug(`acp: session/load failed for ${sessionId} (${err.message}) — will recreate`);
+			throw err;
+		} finally {
+			this.loadingSessions.delete(sessionId);
+		}
+	}
+	/** Drive one turn to completion. Returns the stop reason plus the agent's token
+	*  `usage` when the runtime reports it (ACP's experimental per-turn usage, which
+	*  carries session-cumulative counts) — `undefined` when it doesn't. */
+	async prompt(sessionId, blocks) {
+		const res = await this.conn.agent.request(methods.agent.session.prompt, {
+			sessionId,
+			prompt: blocks
+		});
 		return {
-			ok: false,
-			id: NIL_UUID,
-			msg: "invalid json"
+			stopReason: res.stopReason,
+			usage: res.usage ?? void 0
 		};
 	}
-	const env = Envelope.safeParse(json);
-	if (!env.success) return {
-		ok: false,
-		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
-		msg: env.error.message
-	};
-	const schema = FRAME_SCHEMAS[env.data.type];
-	if (!schema) return {
-		ok: false,
-		id: env.data.id,
-		msg: "UNKNOWN_FRAME"
-	};
-	const payload = schema.safeParse(env.data.payload);
-	if (!payload.success) return {
-		ok: false,
-		id: env.data.id,
-		msg: payload.error.message
-	};
-	const ext = extractControlExt(json);
-	return {
-		ok: true,
-		frame: {
-			...env.data,
-			payload: payload.data
-		},
-		...ext ? { ext } : {}
-	};
-}
-function buildEnvelope(type, payload, opts = {}) {
-	return {
-		v: 1,
-		id: opts.id ?? randomUUID(),
-		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
-		type,
-		payload,
-		...opts.corr ? { corr: opts.corr } : {},
-		...opts.ext ?? {}
+	async cancel(sessionId) {
+		await this.conn.agent.notify(methods.agent.session.cancel, { sessionId });
+	}
+	/** Stop the adapter child: SIGTERM, then escalate to SIGKILL if it hasn't exited
+	*  within `deadlineMs` (a buggy/hung agent must never block daemon shutdown or an
+	*  idle reap). Idempotent — the child handle is cleared up front so a concurrent
+	*  stop (drain + reconcile racing) is a no-op rather than a double-kill. */
+	async stop(deadlineMs = 5e3) {
+		const child = this.child;
+		if (!child) return;
+		this.child = void 0;
+		child.kill("SIGTERM");
+		await new Promise((resolve) => {
+			let settled = false;
+			const done = () => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				resolve();
+			};
+			const timer = setTimeout(() => {
+				this.opts.log?.warn(`acp: child ignored SIGTERM after ${deadlineMs}ms — sending SIGKILL`);
+				child.kill("SIGKILL");
+			}, deadlineMs);
+			child.once("exit", done);
+		});
+	}
+};
+//#endregion
+//#region src/cli/chat.ts
+function renderUpdate(out) {
+	return (_sessionId, update) => {
+		if (update.sessionUpdate === "agent_message_chunk" && update.content.type === "text") out.write(update.content.text);
+		else if (update.sessionUpdate === "tool_call") {
+			const title = "title" in update && update.title || update.toolCallId || "tool";
+			out.write(`\n[tool] ${title}\n`);
+		}
 	};
 }
-function encode(frame) {
-	return JSON.stringify(frame);
+async function runChat(opts) {
+	const out = opts.out ?? process.stdout;
+	const root = resolveRoot(opts.root);
+	const cfg = loadConfig({
+		root: opts.root,
+		configPath: opts.configPath,
+		optional: true,
+		overrides: { agentsDir: opts.agentsDir }
+	});
+	const agent = selectAgent(cfg.agentsDir, opts.agentName);
+	const runtimes = await resolveRuntimes(cfg, root, {
+		neededRuntimes: [agent.runtime],
+		mode: "cache-first"
+	});
+	const runtime = runtimes[agent.runtime];
+	if (!runtime) {
+		const available = Object.keys(runtimes).sort().join(", ") || "(none)";
+		throw new Error(`runtime "${agent.runtime}" not found. Available: ${available}`);
+	}
+	const host = new AcpHost(runtime, {
+		onUpdate: renderUpdate(out),
+		env: agentChildEnv(agent)
+	});
+	await host.start();
+	try {
+		const cwd = await prepareWorkspace(agent);
+		const sessionId = await host.newSession(cwd);
+		const send = async (text) => {
+			const blocks = [{
+				type: "text",
+				text
+			}];
+			await host.prompt(sessionId, blocks);
+			out.write("\n");
+		};
+		if (typeof opts.message === "string" && opts.message.length > 0) {
+			await send(opts.message);
+			return;
+		}
+		const rl = createInterface({ input: opts.input ?? process.stdin });
+		out.write(`Chatting with ${agent.name} (${agent.id}). Type .exit to quit.\n> `);
+		try {
+			for await (const line of rl) {
+				const text = line.trim();
+				if (text === ".exit" || text === ".quit") break;
+				if (text.length > 0) await send(text);
+				out.write("> ");
+			}
+		} finally {
+			rl.close();
+		}
+	} finally {
+		await host.stop();
+	}
 }
 //#endregion
-//#region ../protocol/dist/index.js
-/**
-* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
-* `AnyFrame` to the member whose `type` matches.
-*/
-function isFrame(type) {
-	return (frame) => frame.type === type;
-}
+//#region src/version.ts
+const DAEMON_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 //#endregion
 //#region ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js
 var require_constants$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -80832,9 +80864,13 @@ function splitIntoSections(text, maxLen = SLACK_SECTION_LIMIT) {
 const THINKING = "is thinking…";
 const MAX_ACTIVITY = 10;
 const MAX_LABEL = 100;
-function clampLabel(s) {
+const MAX_STATUS = 50;
+function clampTo(s, max) {
 	const t = s.trim();
-	return t.length > MAX_LABEL ? `${t.slice(0, MAX_LABEL - 1)}…` : t;
+	return t.length > max ? `${t.slice(0, max - 1)}…` : t;
+}
+function clampLabel(s) {
+	return clampTo(s, MAX_LABEL);
 }
 function planIcon(status) {
 	if (status === "completed") return ":white_check_mark:";
@@ -80878,7 +80914,7 @@ var OutputConverger = class {
 	* which throttles streamed thought chunks down to one status update per thinking run.
 	*/
 	pushActivity(raw) {
-		const label = clampLabel(raw);
+		const label = clampTo(raw, MAX_STATUS);
 		if (this.activity[this.activity.length - 1] === label) return [];
 		this.activity.push(label);
 		if (this.activity.length > MAX_ACTIVITY) this.activity.shift();
@@ -82369,7 +82405,7 @@ function applySpecFields(raw, spec, opts) {
 		const existing = typeof raw.workspace === "object" && raw.workspace !== null ? raw.workspace : {};
 		existing.mode = mapWorkspaceMode(ws.mode);
 		if (ws.mode === "github") {
-			existing.gitRepo = ws.gitRepo;
+			existing.gitRepo = normalizeGitUrl(ws.gitRepo);
 			existing.gitBranch = ws.branch;
 		}
 		if (opts.creating && existing.path === void 0) existing.path = join(opts.agentDir, "workspace");