@agentconnect.md/daemon 1.0.0-rc.56 → 1.0.0-rc.58

package/dist/index.js

@@ -11,8 +11,8 @@ import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline";
 import { cpus, freemem, homedir, hostname, tmpdir, totalmem, type } from "node:os";
 import { spawn as spawn$1 } from "child_process";
-import { Readable, Writable } from "node:stream";
 import { randomBytes, randomUUID } from "node:crypto";
+import { Readable, Writable } from "node:stream";
 import { lstat, open, readdir, realpath, stat as stat$1 } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
 import net from "node:net";
@@ -12788,437 +12788,1194 @@ function gitInstanceFactory(baseDir, options) {
 init_git_response_error();
 var simpleGit = gitInstanceFactory;
 //#endregion
-//#region src/workspace/workspace-manager.ts
-const PULL_TIMEOUT_MS = 4500;
-const cloneInFlight = /* @__PURE__ */ new Map();
-async function prepareWorkspace(agent) {
-	const cwd = agent.workspace.path;
-	mkdirSync(cwd, { recursive: true });
-	if (agent.workspace.mode === "from-scratch") {
-		const mem = join(cwd, "memory.md");
-		if (!existsSync(mem)) writeFileSync(mem, `# ${agent.name} memory\n`);
-		return cwd;
-	}
-	if (!existsSync(join(cwd, ".git"))) {
-		await cloneRepo(agent);
-		return cwd;
-	}
-	if (agent.workspace.pullOnNewSession) try {
-		await Promise.race([simpleGit(cwd).pull(["--ff-only"]), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("pull timeout")), PULL_TIMEOUT_MS))]);
-	} catch {}
-	return cwd;
-}
+//#region ../protocol/dist/envelope.js
 /**
-* Eagerly clone a git-repo workspace that has no checkout yet — for reconcile-time
-* prefetch so the repo is warm before the first message arrives. No-op for
-* from-scratch or an already-cloned checkout (the session-time `prepareWorkspace`
-* stays authoritative and still owns pull + hard-fail). Reuses the single-flight
-* lock so a prefetch and a concurrent session-start clone never race into the same
-* dir. The caller invokes this fire-and-forget and logs any rejection — clone
-* failure here is non-fatal because `prepareWorkspace` re-clones (and hard-fails)
-* on the first session as the backstop.
+* The protocol envelope — every frame, both directions, is wrapped in this.
+* Mirrors daemon-cp-ws-protocol.md §1.1.
+*
+* `payload` is left as `unknown` here and validated by the per-type schema in
+* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
+* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
+* instead of a hard close — forward-compat, protocol §1.
 */
-async function prefetchWorkspace(agent) {
-	if (agent.workspace.mode !== "git-repo") return;
-	const cwd = agent.workspace.path;
-	if (existsSync(join(cwd, ".git"))) return;
-	mkdirSync(cwd, { recursive: true });
-	await cloneRepo(agent);
-}
-/** Clone agent.workspace.gitRepo @ gitBranch into cwd, single-flight per cwd. */
-async function cloneRepo(agent) {
-	const cwd = agent.workspace.path;
-	const inflight = cloneInFlight.get(cwd);
-	if (inflight) return inflight;
-	const gitRepo = agent.workspace.gitRepo;
-	if (!gitRepo) throw new Error(`workspace clone: agent "${agent.id}" has git-repo mode but no gitRepo configured`);
-	const branch = agent.workspace.gitBranch;
-	const p = (async () => {
-		await simpleGit().clone(gitRepo, cwd, [
-			"--branch",
-			branch,
-			"--single-branch"
-		]);
-	})().finally(() => {
-		cloneInFlight.delete(cwd);
-	});
-	cloneInFlight.set(cwd, p);
-	return p;
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/index.js
-const AGENT_METHODS = {
-	initialize: "initialize",
-	authenticate: "authenticate",
-	providers_list: "providers/list",
-	providers_set: "providers/set",
-	providers_disable: "providers/disable",
-	session_new: "session/new",
-	session_load: "session/load",
-	session_set_mode: "session/set_mode",
-	session_set_config_option: "session/set_config_option",
-	session_prompt: "session/prompt",
-	session_cancel: "session/cancel",
-	mcp_message: "mcp/message",
-	session_list: "session/list",
-	session_delete: "session/delete",
-	session_fork: "session/fork",
-	session_resume: "session/resume",
-	session_close: "session/close",
-	logout: "logout",
-	nes_start: "nes/start",
-	nes_suggest: "nes/suggest",
-	nes_accept: "nes/accept",
-	nes_reject: "nes/reject",
-	nes_close: "nes/close",
-	document_did_open: "document/didOpen",
-	document_did_change: "document/didChange",
-	document_did_close: "document/didClose",
-	document_did_save: "document/didSave",
-	document_did_focus: "document/didFocus"
-};
-const CLIENT_METHODS = {
-	session_request_permission: "session/request_permission",
-	session_update: "session/update",
-	fs_write_text_file: "fs/write_text_file",
-	fs_read_text_file: "fs/read_text_file",
-	terminal_create: "terminal/create",
-	terminal_output: "terminal/output",
-	terminal_release: "terminal/release",
-	terminal_wait_for_exit: "terminal/wait_for_exit",
-	terminal_kill: "terminal/kill",
-	mcp_connect: "mcp/connect",
-	mcp_message: "mcp/message",
-	mcp_disconnect: "mcp/disconnect",
-	elicitation_create: "elicitation/create",
-	elicitation_complete: "elicitation/complete"
-};
-const PROTOCOL_METHODS = { cancel_request: "$/cancel_request" };
-//#endregion
-//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema-deserialize.js
-const skippedItem = Symbol("skippedItem");
-function defaultOnError(schema, fallback) {
-	return schema.catch(fallback);
-}
-function requiredDefaultOnError(schema, fallback) {
-	const schemaWithCatch = schema.catch(fallback);
-	return unknown().transform((value, context) => {
-		if (value !== void 0) return schemaWithCatch.parse(value);
-		context.addIssue({
-			code: "custom",
-			message: "Required value is missing"
-		});
-		return NEVER;
-	});
-}
-function vecSkipError(itemSchema) {
-	return array(itemSchema.catch(skippedItem)).transform((items) => items.filter((item) => item !== skippedItem));
-}
+const Envelope = object({
+	v: literal(1),
+	id: string().uuid(),
+	ts: string().datetime(),
+	type: string(),
+	corr: string().uuid().optional(),
+	payload: unknown()
+});
+object({
+	epoch: number().int(),
+	seq: number().int().optional(),
+	agentId: string().uuid().optional(),
+	launchId: string().uuid().optional()
+});
+/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
+const NIL_UUID = "00000000-0000-0000-0000-000000000000";
 //#endregion
-//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/zod.gen.js
+//#region ../protocol/dist/frames/auth.js
 /**
-* JSON RPC Request Id
-*
-* An identifier established by the Client that MUST contain a String, Number, or NULL value if included. If it is not included it is assumed to be a notification. The value SHOULD normally not be Null \[1\] and Numbers SHOULD NOT contain fractional parts \[2\]
-*
-* The Server MUST reply with the same value in the Response object if included. This member is used to correlate the context between the two objects.
-*
-* \[1\] The use of Null as a value for the id member in a Request object is discouraged, because this specification uses a value of Null for Responses with an unknown id. Also, because JSON-RPC 1.0 uses an id value of Null for Notifications this could cause confusion in handling.
+* Auth & identity — protocol §3.1 / §3.2.
 *
-* \[2\] Fractional parts may be problematic, since many decimal fractions cannot be represented exactly as binary fractions.
+* `auth` is the first frame after the socket opens. `auth/ok` carries the
+* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
+* resume verdict.
 */
-const zRequestId = union([number(), string()]).nullable();
+const AuthReq = object({
+	apiKey: string(),
+	daemonId: string().uuid().optional(),
+	machineId: string().uuid().optional(),
+	attestation: string().optional(),
+	agentVersion: string(),
+	resume: object({
+		lastEpoch: number().int(),
+		lastRecvSeq: record(string(), number())
+	}).optional()
+});
+const AuthOk = object({
+	daemonId: string().uuid(),
+	sessionEpoch: number().int(),
+	heartbeatSec: number().int(),
+	serverTime: string().datetime(),
+	resume: object({
+		accepted: boolean(),
+		redeliverFromSeq: record(string(), number()).optional()
+	}).optional()
+});
+//#endregion
+//#region ../protocol/dist/frames/route.js
 /**
-* A unique identifier for a conversation session between a client and agent.
-*
-* Sessions maintain their own context, conversation history, and state,
-* allowing multiple independent interactions with the same agent.
+* Routing & orchestration (C→D control) — protocol §5.
 *
-* See protocol docs: [Session ID](https://agentclientprotocol.com/protocol/session-setup#session-id)
+* `SessionKey` is the canonical session primitive shared across route/*,
+* agent/*, and event/session. Its canonical string form is
+* `${platform}:${channel}:${thread ?? "-"}`.
 */
-const zSessionId = string();
+const Platform = _enum(["slack", "telegram"]);
+const SessionKey = object({
+	platform: Platform,
+	channel: string(),
+	thread: string().optional()
+});
+/** Trigger-matching rule for a binding (protocol §5.1). */
+const BindRule = object({ match: discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
+]) });
+const RouteAssign = object({
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	workspaceId: string().uuid(),
+	bindRules: array(BindRule).default([])
+});
+const RouteAssignAck = object({
+	ok: boolean(),
+	sessionKey: SessionKey,
+	reason: string().optional()
+});
+const RouteUpdate = object({
+	routingEpoch: number().int(),
+	rules: array(object({
+		match: unknown(),
+		agentId: string().uuid()
+	}))
+});
+/** Graceful scale-down / rebalance — protocol §5.3. */
+const Drain = object({
+	scope: union([
+		object({
+			kind: literal("agent"),
+			agentId: string().uuid()
+		}),
+		object({ kind: literal("daemon") }),
+		object({
+			kind: literal("session"),
+			sessionKey: SessionKey
+		})
+	]),
+	deadline: string().datetime()
+});
+const DrainProgress = object({
+	remaining: number().int(),
+	drained: array(SessionKey)
+});
+const DrainDone = object({ released: array(SessionKey) });
+//#endregion
+//#region ../protocol/dist/frames/cron.js
 /**
-* Request to write content to a text file.
+* Cron sinks to the daemon (D5) — protocol §5.4.
 *
-* Only available if the client supports the `fs.writeTextFile` capability.
+* The CP owns the definition; the daemon owns firing + last-run persistence so
+* crons fire even when the CP is down.
 */
-const zWriteTextFileRequest = object({
-	sessionId: zSessionId,
-	path: string(),
-	content: string(),
-	_meta: record(string(), unknown()).nullish()
+const CronUpsert = object({
+	cronId: string().uuid(),
+	schedule: string(),
+	target: object({ channel: string() }),
+	trigger: string(),
+	enabled: boolean().default(true)
 });
+const CronRemove = object({ cronId: string().uuid() });
+//#endregion
+//#region ../protocol/dist/frames/secrets.js
 /**
-* Request to read content from a text file.
+* Secrets (C5 ↔ D10) — protocol §6.
 *
-* Only available if the client supports the `fs.readTextFile` capability.
+* Lease-based, no plaintext on the wire or in PG. Every frame carries a
+* REFERENCE to a Vault/KMS path, never the secret material itself.
 */
-const zReadTextFileRequest = object({
-	sessionId: zSessionId,
-	path: string(),
-	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
-	limit: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
-	_meta: record(string(), unknown()).nullish()
+const SecretsRequest = object({ scope: object({
+	platform: Platform,
+	workspaceId: string().uuid()
+}) });
+const SecretsGrant = object({
+	leaseId: string().uuid(),
+	scope: object({
+		platform: string(),
+		workspaceId: string().uuid()
+	}),
+	ref: string(),
+	ttl: number().int(),
+	renewBeforeSec: number().int()
+});
+const SecretsRenew = object({ leaseId: string().uuid() });
+const SecretsRevoke = object({
+	leaseId: string().uuid(),
+	reason: string()
+});
+/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
+const ScopeAttestation = object({
+	machineId: string().uuid(),
+	scope: _enum([
+		"attachment.put",
+		"attachment.get",
+		"facts.put"
+	]),
+	resourceRef: string(),
+	jws: string(),
+	exp: string().datetime()
 });
+//#endregion
+//#region ../protocol/dist/frames/agent.js
 /**
-* Unique identifier for a tool call within a session.
+* Agent lifecycle + delivery (protocol §4.3, §4.4, §7.4, §8).
+*
+* Body-locality invariant (protocol §12): no frame here carries
+* `NormalizedMessage.text`. `agent/prompt` ships a `NormalizedMessageRef` — a
+* reference the daemon resolves against its local body store.
 */
-const zToolCallId = string();
 /**
-* Categories of tools that can be invoked.
-*
-* Tool kinds help clients choose appropriate icons and optimize how they
-* display tool execution progress.
-*
-* See protocol docs: [Creating](https://agentclientprotocol.com/protocol/tool-calls#creating)
+* A REFERENCE/digest of a normalized message, NOT the body (protocol §4.3).
+* Enough for D4/D6 to fetch the local body and prompt.
 */
-const zToolKind = union([
-	literal("read"),
-	literal("edit"),
-	literal("delete"),
-	literal("move"),
-	literal("search"),
-	literal("execute"),
-	literal("think"),
-	literal("fetch"),
-	literal("switch_mode"),
-	literal("other")
-]);
+const NormalizedMessageRef = object({
+	sessionKey: SessionKey,
+	platformMsgId: string(),
+	seenUpToSeq: number().int()
+});
 /**
-* Execution status of a tool call.
-*
-* Tool calls progress through different statuses during their lifecycle.
+* Where the agent runs. Two modes; the **path is always daemon-generated** —
+* never specified by the caller (UX picks the mode, the machine owns the dir).
 *
-* See protocol docs: [Status](https://agentclientprotocol.com/protocol/tool-calls#status)
+* - `scratch`: a fresh empty working dir on the machine, no repo.
+* - `github`: the daemon clones `gitRepo` @ `branch` and runs the agent in
+*   `agentDir` (a subdir of the repo, repo-root if omitted). **Multiple agents
+*   may share one repo** — they differ by `agentDir`, so the repo is not an
+*   owned entity, just shared config on each agent.
 */
-const zToolCallStatus = union([
-	literal("pending"),
-	literal("in_progress"),
-	literal("completed"),
-	literal("failed")
-]);
+const AgentWorkspace = discriminatedUnion("mode", [object({ mode: literal("scratch") }), object({
+	mode: literal("github"),
+	gitRepo: string(),
+	branch: string().default("main"),
+	agentDir: string().optional()
+})]);
 /**
-* Optional annotations for the client. The client can use annotations to inform how objects are used or displayed
+* The editable agent definition the CP owns and the daemon needs to run it:
+* prompt + runtime selection. Raft ships this in the launch config and the
+* daemon synthesizes the system prompt locally; `description` IS the prompt.
 */
-const zAnnotations = object({
-	audience: defaultOnError(vecSkipError(union([literal("assistant"), literal("user")])).nullish(), () => void 0),
-	lastModified: string().nullish(),
-	priority: number().nullish(),
-	_meta: record(string(), unknown()).nullish()
+const AgentSpec = object({
+	name: string(),
+	description: string().optional(),
+	runtime: string().optional(),
+	model: string().optional(),
+	reasoningEffort: string().optional(),
+	executionMode: string().optional(),
+	workspace: AgentWorkspace.optional(),
+	env: record(string(), string()).optional()
 });
-/**
-* Text provided to or from an LLM.
-*/
-const zTextContent = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	text: string(),
-	_meta: record(string(), unknown()).nullish()
+const AgentLaunch = object({
+	agentId: string().uuid(),
+	runtime: string(),
+	workspaceId: string().uuid(),
+	capabilities: array(string()),
+	spec: AgentSpec,
+	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
 });
 /**
-* An image provided to or from an LLM.
+* Live agent CRUD (C→D): the console edited an agent's spec; push it so a
+* running daemon reloads without waiting for the next launch. `agent/remove`
+* tears the agent down. Deleting an agent never relaunches it.
 */
-const zImageContent = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	data: string(),
-	mimeType: string(),
-	uri: string().nullish(),
-	_meta: record(string(), unknown()).nullish()
+const AgentUpsert = object({
+	agentId: string().uuid(),
+	spec: AgentSpec
 });
-/**
-* Audio provided to or from an LLM.
-*/
-const zAudioContent = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	data: string(),
-	mimeType: string(),
-	_meta: record(string(), unknown()).nullish()
+const AgentRemove = object({ agentId: string().uuid() });
+const AgentLaunched = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	acpSessionId: string().optional(),
+	startedAt: string().datetime(),
+	runtime: string()
 });
-/**
-* A resource that the server is capable of reading, included in a prompt or tool call result.
-*/
-const zResourceLink = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	description: string().nullish(),
-	mimeType: string().nullish(),
-	name: string(),
-	size: number().nullish(),
-	title: string().nullish(),
-	uri: string(),
-	_meta: record(string(), unknown()).nullish()
+const AgentStop = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	reason: string()
 });
-/**
-* Resource content that can be embedded in a message.
-*/
-const zEmbeddedResourceResource = union([object({
-	mimeType: string().nullish(),
-	text: string(),
-	uri: string(),
-	_meta: record(string(), unknown()).nullish()
-}), object({
-	blob: string(),
-	mimeType: string().nullish(),
-	uri: string(),
-	_meta: record(string(), unknown()).nullish()
-})]);
-/**
-* The contents of a resource, embedded into a prompt or tool call result.
-*/
-const zEmbeddedResource = object({
-	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
-	resource: zEmbeddedResourceResource,
-	_meta: record(string(), unknown()).nullish()
+const AgentPrompt = object({
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	content: NormalizedMessageRef,
+	seenUpToSeq: number().int()
+});
+const AgentPromptAck = object({
+	accepted: boolean(),
+	reason: _enum([
+		"queued",
+		"held",
+		"scope_denied",
+		"no_session",
+		"stale"
+	]).optional(),
+	seq: number().int()
+});
+const AgentActivity = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	state: _enum([
+		"thinking",
+		"tool_call",
+		"awaiting_permission",
+		"idle"
+	]),
+	ts: string().datetime()
+});
+const AgentScopeDenied = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	capability: string()
 });
+//#endregion
+//#region ../protocol/dist/frames/integration.js
 /**
-* Content blocks represent displayable information in the Agent Client Protocol.
+* Platform integration distribution (C→D) — the Slack "install" flow.
 *
-* They provide a structured way to handle various types of user-facing content—whether
-* it's text from language models, images for analysis, or embedded resources for context.
+* The Control Plane is the source of truth for platform integrations and pushes
+* them to the daemon that owns the integration's agent (`integration/upsert`, and
+* the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket
+* Mode connection from the delivered config (see slack/connection.ts).
 *
-* Content blocks appear in:
-* - User prompts sent via `session/prompt`
-* - Language model output streamed through `session/update` notifications
-* - Progress updates and results from tool calls
-*
-* This structure is compatible with the Model Context Protocol (MCP), enabling
-* agents to seamlessly forward content from MCP tool outputs without transformation.
+* SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT
+* platform tokens (botToken/appToken). These payloads MUST NEVER be logged — no
+* body dump on decode error, no register/ok snapshot debug dump. The daemon
+* persists them into the owning agent's local `agent.json` (same trust boundary
+* as hand-authored agents, which already keep tokens there) so integrations
+* survive a restart with the CP down.
 *
-* See protocol docs: [Content](https://agentclientprotocol.com/protocol/content)
+* `signingSecret` is intentionally absent: Socket Mode authenticates with the
+* app-level token, so the daemon never needs a signing secret.
 */
-const zContentBlock = union([
-	zTextContent.and(object({ type: literal("text") })),
-	zImageContent.and(object({ type: literal("image") })),
-	zAudioContent.and(object({ type: literal("audio") })),
-	zResourceLink.and(object({ type: literal("resource_link") })),
-	zEmbeddedResource.and(object({ type: literal("resource") }))
+/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */
+const BindMatch = discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
 ]);
-/**
-* Standard content block (text, images, resources).
-*/
-const zContent = object({
-	content: zContentBlock,
-	_meta: record(string(), unknown()).nullish()
+/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */
+const IntegrationBindRule = object({
+	channel: string().optional(),
+	thread: string().optional(),
+	match: BindMatch
 });
-/**
-* A diff representing file modifications.
-*
-* Shows changes to files in a format suitable for display in the client UI.
-*
-* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
-*/
-const zDiff = object({
-	path: string(),
-	oldText: string().nullish(),
-	newText: string(),
-	_meta: record(string(), unknown()).nullish()
+/** The Slack config the daemon needs to open + route a socket (no signingSecret). */
+const IntegrationSlackConfig = object({
+	botToken: string(),
+	appToken: string(),
+	allowedUserIds: array(string()).default([]),
+	notificationChannelId: string().optional(),
+	bindRules: array(IntegrationBindRule).default([])
 });
 /**
-* Typed identifier used for terminal values on the wire.
+* One platform integration, owned by exactly one agent. Also the element type of
+* `RegisterOk.integrations[]` (the per-daemon reconcile set).
 */
-const zTerminalId = string();
+const IntegrationSpec = object({
+	integrationId: string().uuid(),
+	agentId: string().uuid(),
+	platform: literal("slack"),
+	slack: IntegrationSlackConfig
+});
+/** C→D EVT — install/update an integration on the owning agent's daemon. */
+const IntegrationUpsert = IntegrationSpec;
+/** C→D EVT — remove an integration from the daemon. */
+const IntegrationRemove = object({ integrationId: string().uuid() });
+//#endregion
+//#region ../protocol/dist/frames/register.js
 /**
-* Embed a terminal created with `terminal/create` by its id.
-*
-* The terminal must be added before calling `terminal/release`.
+* Capability upload + the reconcile snapshot — protocol §3.3.
 *
-* See protocol docs: [Terminal](https://agentclientprotocol.com/protocol/terminals)
+* `register/ok` is the authoritative source of truth: the daemon converges its
+* local cache to it. CP wins all conflicts, so re-issuing the same snapshot is
+* idempotent.
 */
-const zTerminal = object({
-	terminalId: zTerminalId,
-	_meta: record(string(), unknown()).nullish()
+const RegisterReq = object({
+	host: string(),
+	capabilities: object({
+		platforms: array(Platform),
+		runtimes: array(string()),
+		acp: boolean(),
+		features: array(string()).default([])
+	}),
+	maxAgents: number().int(),
+	localState: object({
+		assignments: array(string()),
+		crons: array(string()),
+		leases: array(string())
+	})
+});
+const RegisterOk = object({
+	routingEpoch: number().int(),
+	assignments: array(RouteAssign),
+	agents: array(AgentSpec.extend({ agentId: string().uuid() })).default([]),
+	crons: array(CronUpsert),
+	integrations: array(IntegrationSpec).default([]),
+	leases: array(SecretsGrant),
+	drop: object({
+		assignments: array(string()),
+		crons: array(string())
+	})
 });
+//#endregion
+//#region ../protocol/dist/frames/session.js
 /**
-* Content produced by a tool call.
+* Session read-back (C→D REQ → REP) — the console's on-demand pulls.
 *
-* Tool calls can produce different types of content including
-* standard content blocks (text, images) or file diffs.
+* The CP stores NO session data — neither the list nor the bodies. Sessions are
+* created on the Slack→daemon path and live solely in the daemon's local store
+* (body-locality, §1/§12). So both the session **list** and a session's chat
+* **history** are pulled live from the owning daemon(s) and proxied to the
+* console — never persisted on the CP, never on the orchestration hot path.
 *
-* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
+* - `session/list`: the daemon's live sessions (CP fans this out to all the org's
+*   online daemons and merges, for "all sessions across the workspace").
+* - `session/history`: one cursor-paginated page of a session's transcript.
 */
-const zToolCallContent = union([
-	zContent.and(object({ type: literal("content") })),
-	zDiff.and(object({ type: literal("diff") })),
-	zTerminal.and(object({ type: literal("terminal") }))
-]);
 /**
-* A file location being accessed or modified by a tool.
-*
-* Enables clients to implement "follow-along" features that track
-* which files the agent is working with in real-time.
-*
-* See protocol docs: [Following the Agent](https://agentclientprotocol.com/protocol/tool-calls#following-the-agent)
+* Per-session token accounting, metered by the daemon from the agent's ACP usage
+* stream. Token counts are CUMULATIVE across the session's turns (summed from each
+* turn's `PromptResponse.usage`); context/cost are the LATEST snapshot from the
+* agent's `usage_update` stream. Every field is optional — a runtime that reports
+* no usage yields an absent field, not a zero.
 */
-const zToolCallLocation = object({
-	path: string(),
-	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
-	_meta: record(string(), unknown()).nullish()
+const SessionUsage = object({
+	totalTokens: number().int().optional(),
+	inputTokens: number().int().optional(),
+	outputTokens: number().int().optional(),
+	thoughtTokens: number().int().optional(),
+	cachedReadTokens: number().int().optional(),
+	cachedWriteTokens: number().int().optional(),
+	contextUsed: number().int().optional(),
+	contextSize: number().int().optional(),
+	costAmount: number().optional(),
+	costCurrency: string().optional()
+});
+/** One row in the session list (metadata + console metrics; NOT the transcript). */
+const SessionListItem = object({
+	sessionId: string(),
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	title: string().optional(),
+	status: string().optional(),
+	lastActivityAt: string().optional(),
+	usage: SessionUsage.optional(),
+	triggeredBy: string().optional()
+});
+/** C→D REQ: list the daemon's sessions (optionally just one agent's). */
+const SessionListReq = object({ agentId: string().uuid().optional() });
+/** D→C REP (corr = req id): the daemon's current sessions. */
+const SessionListPage = object({ sessions: array(SessionListItem) });
+/** One message in a session transcript page (a body — returned only for display). */
+const SessionMessage = object({
+	seq: number().int(),
+	sender: string(),
+	ts: string(),
+	kind: string(),
+	text: string()
+});
+/** C→D REQ: fetch one page of a session's history from the owning daemon. */
+const SessionHistoryReq = object({
+	sessionId: string(),
+	cursor: string().optional(),
+	limit: number().int().positive().max(200).default(50)
+});
+/** D→C REP (corr = the req id): a page of messages + the cursor for the next page. */
+const SessionHistoryPage = object({
+	sessionId: string(),
+	messages: array(SessionMessage),
+	nextCursor: string().optional()
 });
+//#endregion
+//#region ../protocol/dist/frame.js
 /**
-* An update to an existing tool call.
+* The single source of truth for the wire: `type` string → payload zod schema.
 *
-* Used to report progress and results as tools execute. All fields except
-* the tool call ID are optional - only changed fields need to be included.
+* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
+* frames) plus the correlated REP types named in the "Reply" column
+* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
+* travel on the wire and must be decodable.
 *
-* See protocol docs: [Updating](https://agentclientprotocol.com/protocol/tool-calls#updating)
-*/
-const zToolCallUpdate = object({
-	toolCallId: zToolCallId,
-	kind: defaultOnError(zToolKind.nullish(), () => void 0),
-	status: defaultOnError(zToolCallStatus.nullish(), () => void 0),
-	title: string().nullish(),
-	content: defaultOnError(vecSkipError(zToolCallContent).nullish(), () => void 0),
-	locations: defaultOnError(vecSkipError(zToolCallLocation).nullish(), () => void 0),
-	rawInput: unknown().optional(),
-	rawOutput: unknown().optional(),
-	_meta: record(string(), unknown()).nullish()
-});
-/**
-* Unique identifier for a permission option.
+* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
+* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
 */
-const zPermissionOptionId = string();
+const FRAME_SCHEMAS = {
+	auth: AuthReq,
+	"auth/ok": AuthOk,
+	register: RegisterReq,
+	"register/ok": RegisterOk,
+	heartbeat: object({
+		load: object({
+			cpu: number(),
+			mem: number(),
+			agents: number().int()
+		}),
+		health: _enum(["ok", "degraded"]),
+		activeSessions: number().int(),
+		degradedScopes: array(string()).default([])
+	}),
+	"agent/launch": AgentLaunch,
+	"agent/launched": AgentLaunched,
+	"agent/stop": AgentStop,
+	"agent/upsert": AgentUpsert,
+	"agent/remove": AgentRemove,
+	"agent/prompt": AgentPrompt,
+	"agent/prompt/ack": AgentPromptAck,
+	"agent/activity": AgentActivity,
+	"agent/scope-denied": AgentScopeDenied,
+	"route/assign": RouteAssign,
+	"route/assign/ack": RouteAssignAck,
+	"route/update": RouteUpdate,
+	"daemon/drain": Drain,
+	"drain/progress": DrainProgress,
+	"drain/done": DrainDone,
+	"cron/upsert": CronUpsert,
+	"cron/remove": CronRemove,
+	"integration/upsert": IntegrationUpsert,
+	"integration/remove": IntegrationRemove,
+	"secrets/request": SecretsRequest,
+	"secrets/grant": SecretsGrant,
+	"secrets/renew": SecretsRenew,
+	"secrets/revoke": SecretsRevoke,
+	"scope-attestation": ScopeAttestation,
+	"event/session": object({
+		sessionId: string().uuid(),
+		agentId: string().uuid(),
+		launchId: string().uuid(),
+		phase: _enum([
+			"start",
+			"plan",
+			"problem",
+			"end"
+		]),
+		link: string().optional(),
+		summary: string().optional(),
+		ts: string().datetime()
+	}),
+	"usage/report": object({
+		sessionId: string(),
+		agentId: string().uuid(),
+		platform: string().optional(),
+		channel: string().optional(),
+		lastActivityAt: string(),
+		usage: SessionUsage
+	}),
+	"facts/runtime-profile": object({
+		runtime: string(),
+		version: string(),
+		models: array(string()),
+		contextWindow: number().int().optional(),
+		acpSupport: _enum([
+			"full",
+			"partial",
+			"none"
+		]),
+		toolCalling: boolean()
+	}),
+	"session/list": SessionListReq,
+	"session/list/page": SessionListPage,
+	"session/history": SessionHistoryReq,
+	"session/history/page": SessionHistoryPage,
+	"config/push": object({ keys: record(string(), unknown()) }),
+	"daemon/restart": object({
+		reason: string(),
+		drainFirst: boolean().default(true)
+	}),
+	"daemon/upgrade": object({
+		targetVersion: string(),
+		drainFirst: boolean().default(true)
+	}),
+	"daemon/control/ack": object({
+		accepted: boolean(),
+		willDrainUntil: string().datetime().optional()
+	}),
+	ack: object({
+		ok: boolean(),
+		reason: string().optional()
+	}),
+	error: object({
+		code: _enum([
+			"UNKNOWN_FRAME",
+			"FRAME_TOO_LARGE",
+			"PROTOCOL_STATE",
+			"BAD_PAYLOAD",
+			"AUTH_FAILED",
+			"ATTESTATION_INVALID",
+			"STALE_EPOCH",
+			"STALE_LAUNCH",
+			"SEQ_GAP",
+			"NO_SESSION",
+			"HELD",
+			"SCOPE_DENIED",
+			"LEASE_EXPIRED",
+			"LEASE_DENIED",
+			"RATE_LIMITED",
+			"INTERNAL"
+		]),
+		message: string(),
+		retryable: boolean(),
+		details: record(string(), unknown()).optional()
+	})
+};
+Object.keys(FRAME_SCHEMAS);
 /**
-* The type of permission option being presented to the user.
-*
-* Helps clients choose appropriate icons and UI treatment.
+* Builds the envelope schema for one frame `type` with a `type` literal and the
+* typed payload, so the discriminated union infers `payload` precisely.
 */
-const zPermissionOptionKind = union([
-	literal("allow_once"),
-	literal("allow_always"),
-	literal("reject_once"),
-	literal("reject_always")
+function frame(type, payload) {
+	return object({
+		v: literal(1),
+		id: string().uuid(),
+		ts: string().datetime(),
+		type: literal(type),
+		corr: string().uuid().optional(),
+		payload
+	});
+}
+discriminatedUnion("type", [
+	frame("auth", FRAME_SCHEMAS["auth"]),
+	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
+	frame("register", FRAME_SCHEMAS["register"]),
+	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
+	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
+	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
+	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
+	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
+	frame("agent/upsert", FRAME_SCHEMAS["agent/upsert"]),
+	frame("agent/remove", FRAME_SCHEMAS["agent/remove"]),
+	frame("agent/prompt", FRAME_SCHEMAS["agent/prompt"]),
+	frame("agent/prompt/ack", FRAME_SCHEMAS["agent/prompt/ack"]),
+	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
+	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
+	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
+	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
+	frame("route/update", FRAME_SCHEMAS["route/update"]),
+	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
+	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
+	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
+	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
+	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
+	frame("integration/upsert", FRAME_SCHEMAS["integration/upsert"]),
+	frame("integration/remove", FRAME_SCHEMAS["integration/remove"]),
+	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
+	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
+	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
+	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
+	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
+	frame("event/session", FRAME_SCHEMAS["event/session"]),
+	frame("usage/report", FRAME_SCHEMAS["usage/report"]),
+	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
+	frame("session/list", FRAME_SCHEMAS["session/list"]),
+	frame("session/list/page", FRAME_SCHEMAS["session/list/page"]),
+	frame("session/history", FRAME_SCHEMAS["session/history"]),
+	frame("session/history/page", FRAME_SCHEMAS["session/history/page"]),
+	frame("config/push", FRAME_SCHEMAS["config/push"]),
+	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
+	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
+	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
+	frame("ack", FRAME_SCHEMAS["ack"]),
+	frame("error", FRAME_SCHEMAS["error"])
 ]);
+//#endregion
+//#region ../protocol/dist/codec.js
+/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
+const MAX_FRAME_BYTES = 256 * 1024;
+const textEncoder = new TextEncoder();
+function byteLength(text) {
+	return textEncoder.encode(text).length;
+}
+function extractControlExt(json) {
+	if (typeof json !== "object" || json === null) return void 0;
+	const o = json;
+	const ext = {};
+	if (typeof o.epoch === "number") ext.epoch = o.epoch;
+	if (typeof o.seq === "number") ext.seq = o.seq;
+	if (typeof o.agentId === "string") ext.agentId = o.agentId;
+	if (typeof o.launchId === "string") ext.launchId = o.launchId;
+	return Object.keys(ext).length > 0 ? ext : void 0;
+}
+function decodeEnvelope(text) {
+	if (byteLength(text) > 262144) return {
+		ok: false,
+		id: NIL_UUID,
+		msg: "FRAME_TOO_LARGE"
+	};
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		return {
+			ok: false,
+			id: NIL_UUID,
+			msg: "invalid json"
+		};
+	}
+	const env = Envelope.safeParse(json);
+	if (!env.success) return {
+		ok: false,
+		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
+		msg: env.error.message
+	};
+	const schema = FRAME_SCHEMAS[env.data.type];
+	if (!schema) return {
+		ok: false,
+		id: env.data.id,
+		msg: "UNKNOWN_FRAME"
+	};
+	const payload = schema.safeParse(env.data.payload);
+	if (!payload.success) return {
+		ok: false,
+		id: env.data.id,
+		msg: payload.error.message
+	};
+	const ext = extractControlExt(json);
+	return {
+		ok: true,
+		frame: {
+			...env.data,
+			payload: payload.data
+		},
+		...ext ? { ext } : {}
+	};
+}
+function buildEnvelope(type, payload, opts = {}) {
+	return {
+		v: 1,
+		id: opts.id ?? randomUUID(),
+		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+		type,
+		payload,
+		...opts.corr ? { corr: opts.corr } : {},
+		...opts.ext ?? {}
+	};
+}
+function encode(frame) {
+	return JSON.stringify(frame);
+}
+//#endregion
+//#region ../protocol/dist/git-url.js
 /**
-* Request for user permission to execute a tool call.
+* Git repo address helpers, shared by the CP (normalize on write) and the
+* daemon (defensive normalize before clone).
 *
-* Sent when the agent needs authorization before performing a sensitive operation.
-*
-* See protocol docs: [Requesting Permission](https://agentclientprotocol.com/protocol/tool-calls#requesting-permission)
+* STORAGE INVARIANT: `workspace.gitRepo` is persisted as a FULL cloneable git
+* address (e.g. `https://github.com/acme/infra`), never the `acme/infra`
+* shorthand a user may type. UIs shorten it back to `org/repo` for display
+* with `gitRepoLabel`.
 */
-const zRequestPermissionRequest = object({
-	sessionId: zSessionId,
-	toolCall: zToolCallUpdate,
-	options: array(object({
-		optionId: zPermissionOptionId,
-		name: string(),
-		kind: zPermissionOptionKind,
-		_meta: record(string(), unknown()).nullish()
-	})),
-	_meta: record(string(), unknown()).nullish()
-});
+/** Scheme-full address: https://, ssh://, git://, file://, … */
+const SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** scp-like ssh address: git@github.com:acme/infra(.git) */
+const SCP_RE = /^[\w.-]+@[\w.-]+:(.+)$/;
 /**
-* An environment variable to set when launching an MCP server.
+* Normalize a user-supplied repo reference into a full cloneable git address.
+* Idempotent — full addresses pass through unchanged.
+*
+* - `https://…` / `ssh://…` / `git://…` / `git@host:…` → as-is
+* - `github.com/acme/infra` (host-prefixed shorthand)  → `https://github.com/acme/infra`
+* - `acme/infra` (bare org/repo)                       → `https://github.com/acme/infra`
+* - anything else (e.g. a local path) → as-is
 */
-const zEnvVariable = object({
-	name: string(),
-	value: string(),
-	_meta: record(string(), unknown()).nullish()
-});
+function normalizeGitUrl(input) {
+	const s = input.trim().replace(/\/+$/, "");
+	if (!s || SCHEME_RE.test(s) || SCP_RE.test(s)) return s;
+	const segments = s.split("/");
+	if (segments.length >= 3 && segments[0].includes(".")) return `https://${s}`;
+	if (segments.length === 2 && segments.every((p) => p.length > 0)) return `https://github.com/${s}`;
+	return s;
+}
+//#endregion
+//#region ../protocol/dist/index.js
 /**
-* Request to create a new terminal and execute a command.
+* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
+* `AnyFrame` to the member whose `type` matches.
 */
-const zCreateTerminalRequest = object({
-	sessionId: zSessionId,
-	command: string(),
-	args: array(string()).optional(),
+function isFrame(type) {
+	return (frame) => frame.type === type;
+}
+//#endregion
+//#region src/workspace/workspace-manager.ts
+const PULL_TIMEOUT_MS = 4500;
+const cloneInFlight = /* @__PURE__ */ new Map();
+async function prepareWorkspace(agent) {
+	const cwd = agent.workspace.path;
+	mkdirSync(cwd, { recursive: true });
+	if (agent.workspace.mode === "from-scratch") {
+		const mem = join(cwd, "memory.md");
+		if (!existsSync(mem)) writeFileSync(mem, `# ${agent.name} memory\n`);
+		return cwd;
+	}
+	if (!existsSync(join(cwd, ".git"))) {
+		await cloneRepo(agent);
+		return cwd;
+	}
+	if (agent.workspace.pullOnNewSession) try {
+		await Promise.race([simpleGit(cwd).pull(["--ff-only"]), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("pull timeout")), PULL_TIMEOUT_MS))]);
+	} catch {}
+	return cwd;
+}
+/**
+* Eagerly clone a git-repo workspace that has no checkout yet — for reconcile-time
+* prefetch so the repo is warm before the first message arrives. No-op for
+* from-scratch or an already-cloned checkout (the session-time `prepareWorkspace`
+* stays authoritative and still owns pull + hard-fail). Reuses the single-flight
+* lock so a prefetch and a concurrent session-start clone never race into the same
+* dir. The caller invokes this fire-and-forget and logs any rejection — clone
+* failure here is non-fatal because `prepareWorkspace` re-clones (and hard-fails)
+* on the first session as the backstop.
+*/
+async function prefetchWorkspace(agent) {
+	if (agent.workspace.mode !== "git-repo") return;
+	const cwd = agent.workspace.path;
+	if (existsSync(join(cwd, ".git"))) return;
+	mkdirSync(cwd, { recursive: true });
+	await cloneRepo(agent);
+}
+/** Clone agent.workspace.gitRepo @ gitBranch into cwd, single-flight per cwd. */
+async function cloneRepo(agent) {
+	const cwd = agent.workspace.path;
+	const inflight = cloneInFlight.get(cwd);
+	if (inflight) return inflight;
+	const gitRepo = agent.workspace.gitRepo && normalizeGitUrl(agent.workspace.gitRepo);
+	if (!gitRepo) throw new Error(`workspace clone: agent "${agent.id}" has git-repo mode but no gitRepo configured`);
+	const branch = agent.workspace.gitBranch;
+	const p = (async () => {
+		await simpleGit().clone(gitRepo, cwd, [
+			"--branch",
+			branch,
+			"--single-branch"
+		]);
+	})().finally(() => {
+		cloneInFlight.delete(cwd);
+	});
+	cloneInFlight.set(cwd, p);
+	return p;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/index.js
+const AGENT_METHODS = {
+	initialize: "initialize",
+	authenticate: "authenticate",
+	providers_list: "providers/list",
+	providers_set: "providers/set",
+	providers_disable: "providers/disable",
+	session_new: "session/new",
+	session_load: "session/load",
+	session_set_mode: "session/set_mode",
+	session_set_config_option: "session/set_config_option",
+	session_prompt: "session/prompt",
+	session_cancel: "session/cancel",
+	mcp_message: "mcp/message",
+	session_list: "session/list",
+	session_delete: "session/delete",
+	session_fork: "session/fork",
+	session_resume: "session/resume",
+	session_close: "session/close",
+	logout: "logout",
+	nes_start: "nes/start",
+	nes_suggest: "nes/suggest",
+	nes_accept: "nes/accept",
+	nes_reject: "nes/reject",
+	nes_close: "nes/close",
+	document_did_open: "document/didOpen",
+	document_did_change: "document/didChange",
+	document_did_close: "document/didClose",
+	document_did_save: "document/didSave",
+	document_did_focus: "document/didFocus"
+};
+const CLIENT_METHODS = {
+	session_request_permission: "session/request_permission",
+	session_update: "session/update",
+	fs_write_text_file: "fs/write_text_file",
+	fs_read_text_file: "fs/read_text_file",
+	terminal_create: "terminal/create",
+	terminal_output: "terminal/output",
+	terminal_release: "terminal/release",
+	terminal_wait_for_exit: "terminal/wait_for_exit",
+	terminal_kill: "terminal/kill",
+	mcp_connect: "mcp/connect",
+	mcp_message: "mcp/message",
+	mcp_disconnect: "mcp/disconnect",
+	elicitation_create: "elicitation/create",
+	elicitation_complete: "elicitation/complete"
+};
+const PROTOCOL_METHODS = { cancel_request: "$/cancel_request" };
+//#endregion
+//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema-deserialize.js
+const skippedItem = Symbol("skippedItem");
+function defaultOnError(schema, fallback) {
+	return schema.catch(fallback);
+}
+function requiredDefaultOnError(schema, fallback) {
+	const schemaWithCatch = schema.catch(fallback);
+	return unknown().transform((value, context) => {
+		if (value !== void 0) return schemaWithCatch.parse(value);
+		context.addIssue({
+			code: "custom",
+			message: "Required value is missing"
+		});
+		return NEVER;
+	});
+}
+function vecSkipError(itemSchema) {
+	return array(itemSchema.catch(skippedItem)).transform((items) => items.filter((item) => item !== skippedItem));
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.0.0_zod@4.4.3/node_modules/@agentclientprotocol/sdk/dist/schema/zod.gen.js
+/**
+* JSON RPC Request Id
+*
+* An identifier established by the Client that MUST contain a String, Number, or NULL value if included. If it is not included it is assumed to be a notification. The value SHOULD normally not be Null \[1\] and Numbers SHOULD NOT contain fractional parts \[2\]
+*
+* The Server MUST reply with the same value in the Response object if included. This member is used to correlate the context between the two objects.
+*
+* \[1\] The use of Null as a value for the id member in a Request object is discouraged, because this specification uses a value of Null for Responses with an unknown id. Also, because JSON-RPC 1.0 uses an id value of Null for Notifications this could cause confusion in handling.
+*
+* \[2\] Fractional parts may be problematic, since many decimal fractions cannot be represented exactly as binary fractions.
+*/
+const zRequestId = union([number(), string()]).nullable();
+/**
+* A unique identifier for a conversation session between a client and agent.
+*
+* Sessions maintain their own context, conversation history, and state,
+* allowing multiple independent interactions with the same agent.
+*
+* See protocol docs: [Session ID](https://agentclientprotocol.com/protocol/session-setup#session-id)
+*/
+const zSessionId = string();
+/**
+* Request to write content to a text file.
+*
+* Only available if the client supports the `fs.writeTextFile` capability.
+*/
+const zWriteTextFileRequest = object({
+	sessionId: zSessionId,
+	path: string(),
+	content: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Request to read content from a text file.
+*
+* Only available if the client supports the `fs.readTextFile` capability.
+*/
+const zReadTextFileRequest = object({
+	sessionId: zSessionId,
+	path: string(),
+	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
+	limit: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Unique identifier for a tool call within a session.
+*/
+const zToolCallId = string();
+/**
+* Categories of tools that can be invoked.
+*
+* Tool kinds help clients choose appropriate icons and optimize how they
+* display tool execution progress.
+*
+* See protocol docs: [Creating](https://agentclientprotocol.com/protocol/tool-calls#creating)
+*/
+const zToolKind = union([
+	literal("read"),
+	literal("edit"),
+	literal("delete"),
+	literal("move"),
+	literal("search"),
+	literal("execute"),
+	literal("think"),
+	literal("fetch"),
+	literal("switch_mode"),
+	literal("other")
+]);
+/**
+* Execution status of a tool call.
+*
+* Tool calls progress through different statuses during their lifecycle.
+*
+* See protocol docs: [Status](https://agentclientprotocol.com/protocol/tool-calls#status)
+*/
+const zToolCallStatus = union([
+	literal("pending"),
+	literal("in_progress"),
+	literal("completed"),
+	literal("failed")
+]);
+/**
+* Optional annotations for the client. The client can use annotations to inform how objects are used or displayed
+*/
+const zAnnotations = object({
+	audience: defaultOnError(vecSkipError(union([literal("assistant"), literal("user")])).nullish(), () => void 0),
+	lastModified: string().nullish(),
+	priority: number().nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Text provided to or from an LLM.
+*/
+const zTextContent = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	text: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* An image provided to or from an LLM.
+*/
+const zImageContent = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	data: string(),
+	mimeType: string(),
+	uri: string().nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Audio provided to or from an LLM.
+*/
+const zAudioContent = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	data: string(),
+	mimeType: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* A resource that the server is capable of reading, included in a prompt or tool call result.
+*/
+const zResourceLink = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	description: string().nullish(),
+	mimeType: string().nullish(),
+	name: string(),
+	size: number().nullish(),
+	title: string().nullish(),
+	uri: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Resource content that can be embedded in a message.
+*/
+const zEmbeddedResourceResource = union([object({
+	mimeType: string().nullish(),
+	text: string(),
+	uri: string(),
+	_meta: record(string(), unknown()).nullish()
+}), object({
+	blob: string(),
+	mimeType: string().nullish(),
+	uri: string(),
+	_meta: record(string(), unknown()).nullish()
+})]);
+/**
+* The contents of a resource, embedded into a prompt or tool call result.
+*/
+const zEmbeddedResource = object({
+	annotations: defaultOnError(zAnnotations.nullish(), () => void 0),
+	resource: zEmbeddedResourceResource,
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Content blocks represent displayable information in the Agent Client Protocol.
+*
+* They provide a structured way to handle various types of user-facing content—whether
+* it's text from language models, images for analysis, or embedded resources for context.
+*
+* Content blocks appear in:
+* - User prompts sent via `session/prompt`
+* - Language model output streamed through `session/update` notifications
+* - Progress updates and results from tool calls
+*
+* This structure is compatible with the Model Context Protocol (MCP), enabling
+* agents to seamlessly forward content from MCP tool outputs without transformation.
+*
+* See protocol docs: [Content](https://agentclientprotocol.com/protocol/content)
+*/
+const zContentBlock = union([
+	zTextContent.and(object({ type: literal("text") })),
+	zImageContent.and(object({ type: literal("image") })),
+	zAudioContent.and(object({ type: literal("audio") })),
+	zResourceLink.and(object({ type: literal("resource_link") })),
+	zEmbeddedResource.and(object({ type: literal("resource") }))
+]);
+/**
+* Standard content block (text, images, resources).
+*/
+const zContent = object({
+	content: zContentBlock,
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* A diff representing file modifications.
+*
+* Shows changes to files in a format suitable for display in the client UI.
+*
+* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
+*/
+const zDiff = object({
+	path: string(),
+	oldText: string().nullish(),
+	newText: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Typed identifier used for terminal values on the wire.
+*/
+const zTerminalId = string();
+/**
+* Embed a terminal created with `terminal/create` by its id.
+*
+* The terminal must be added before calling `terminal/release`.
+*
+* See protocol docs: [Terminal](https://agentclientprotocol.com/protocol/terminals)
+*/
+const zTerminal = object({
+	terminalId: zTerminalId,
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Content produced by a tool call.
+*
+* Tool calls can produce different types of content including
+* standard content blocks (text, images) or file diffs.
+*
+* See protocol docs: [Content](https://agentclientprotocol.com/protocol/tool-calls#content)
+*/
+const zToolCallContent = union([
+	zContent.and(object({ type: literal("content") })),
+	zDiff.and(object({ type: literal("diff") })),
+	zTerminal.and(object({ type: literal("terminal") }))
+]);
+/**
+* A file location being accessed or modified by a tool.
+*
+* Enables clients to implement "follow-along" features that track
+* which files the agent is working with in real-time.
+*
+* See protocol docs: [Following the Agent](https://agentclientprotocol.com/protocol/tool-calls#following-the-agent)
+*/
+const zToolCallLocation = object({
+	path: string(),
+	line: int().gte(0).max(4294967295, { error: "Invalid value: Expected uint32 to be <= 4294967295" }).nullish(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* An update to an existing tool call.
+*
+* Used to report progress and results as tools execute. All fields except
+* the tool call ID are optional - only changed fields need to be included.
+*
+* See protocol docs: [Updating](https://agentclientprotocol.com/protocol/tool-calls#updating)
+*/
+const zToolCallUpdate = object({
+	toolCallId: zToolCallId,
+	kind: defaultOnError(zToolKind.nullish(), () => void 0),
+	status: defaultOnError(zToolCallStatus.nullish(), () => void 0),
+	title: string().nullish(),
+	content: defaultOnError(vecSkipError(zToolCallContent).nullish(), () => void 0),
+	locations: defaultOnError(vecSkipError(zToolCallLocation).nullish(), () => void 0),
+	rawInput: unknown().optional(),
+	rawOutput: unknown().optional(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Unique identifier for a permission option.
+*/
+const zPermissionOptionId = string();
+/**
+* The type of permission option being presented to the user.
+*
+* Helps clients choose appropriate icons and UI treatment.
+*/
+const zPermissionOptionKind = union([
+	literal("allow_once"),
+	literal("allow_always"),
+	literal("reject_once"),
+	literal("reject_always")
+]);
+/**
+* Request for user permission to execute a tool call.
+*
+* Sent when the agent needs authorization before performing a sensitive operation.
+*
+* See protocol docs: [Requesting Permission](https://agentclientprotocol.com/protocol/tool-calls#requesting-permission)
+*/
+const zRequestPermissionRequest = object({
+	sessionId: zSessionId,
+	toolCall: zToolCallUpdate,
+	options: array(object({
+		optionId: zPermissionOptionId,
+		name: string(),
+		kind: zPermissionOptionKind,
+		_meta: record(string(), unknown()).nullish()
+	})),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* An environment variable to set when launching an MCP server.
+*/
+const zEnvVariable = object({
+	name: string(),
+	value: string(),
+	_meta: record(string(), unknown()).nullish()
+});
+/**
+* Request to create a new terminal and execute a command.
+*/
+const zCreateTerminalRequest = object({
+	sessionId: zSessionId,
+	command: string(),
+	args: array(string()).optional(),
 	env: array(zEnvVariable).optional(),
 	cwd: string().nullish(),
 	outputByteLimit: number().nullish(),
@@ -17253,731 +18010,6 @@ async function runChat(opts) {
 //#region src/version.ts
 const DAEMON_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 //#endregion
-//#region ../protocol/dist/envelope.js
-/**
-* The protocol envelope — every frame, both directions, is wrapped in this.
-* Mirrors daemon-cp-ws-protocol.md §1.1.
-*
-* `payload` is left as `unknown` here and validated by the per-type schema in
-* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
-* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
-* instead of a hard close — forward-compat, protocol §1.
-*/
-const Envelope = object({
-	v: literal(1),
-	id: string().uuid(),
-	ts: string().datetime(),
-	type: string(),
-	corr: string().uuid().optional(),
-	payload: unknown()
-});
-object({
-	epoch: number().int(),
-	seq: number().int().optional(),
-	agentId: string().uuid().optional(),
-	launchId: string().uuid().optional()
-});
-/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
-const NIL_UUID = "00000000-0000-0000-0000-000000000000";
-//#endregion
-//#region ../protocol/dist/frames/auth.js
-/**
-* Auth & identity — protocol §3.1 / §3.2.
-*
-* `auth` is the first frame after the socket opens. `auth/ok` carries the
-* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
-* resume verdict.
-*/
-const AuthReq = object({
-	apiKey: string(),
-	daemonId: string().uuid().optional(),
-	machineId: string().uuid().optional(),
-	attestation: string().optional(),
-	agentVersion: string(),
-	resume: object({
-		lastEpoch: number().int(),
-		lastRecvSeq: record(string(), number())
-	}).optional()
-});
-const AuthOk = object({
-	daemonId: string().uuid(),
-	sessionEpoch: number().int(),
-	heartbeatSec: number().int(),
-	serverTime: string().datetime(),
-	resume: object({
-		accepted: boolean(),
-		redeliverFromSeq: record(string(), number()).optional()
-	}).optional()
-});
-//#endregion
-//#region ../protocol/dist/frames/route.js
-/**
-* Routing & orchestration (C→D control) — protocol §5.
-*
-* `SessionKey` is the canonical session primitive shared across route/*,
-* agent/*, and event/session. Its canonical string form is
-* `${platform}:${channel}:${thread ?? "-"}`.
-*/
-const Platform = _enum(["slack", "telegram"]);
-const SessionKey = object({
-	platform: Platform,
-	channel: string(),
-	thread: string().optional()
-});
-/** Trigger-matching rule for a binding (protocol §5.1). */
-const BindRule = object({ match: discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]) });
-const RouteAssign = object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	workspaceId: string().uuid(),
-	bindRules: array(BindRule).default([])
-});
-const RouteAssignAck = object({
-	ok: boolean(),
-	sessionKey: SessionKey,
-	reason: string().optional()
-});
-const RouteUpdate = object({
-	routingEpoch: number().int(),
-	rules: array(object({
-		match: unknown(),
-		agentId: string().uuid()
-	}))
-});
-/** Graceful scale-down / rebalance — protocol §5.3. */
-const Drain = object({
-	scope: union([
-		object({
-			kind: literal("agent"),
-			agentId: string().uuid()
-		}),
-		object({ kind: literal("daemon") }),
-		object({
-			kind: literal("session"),
-			sessionKey: SessionKey
-		})
-	]),
-	deadline: string().datetime()
-});
-const DrainProgress = object({
-	remaining: number().int(),
-	drained: array(SessionKey)
-});
-const DrainDone = object({ released: array(SessionKey) });
-//#endregion
-//#region ../protocol/dist/frames/cron.js
-/**
-* Cron sinks to the daemon (D5) — protocol §5.4.
-*
-* The CP owns the definition; the daemon owns firing + last-run persistence so
-* crons fire even when the CP is down.
-*/
-const CronUpsert = object({
-	cronId: string().uuid(),
-	schedule: string(),
-	target: object({ channel: string() }),
-	trigger: string(),
-	enabled: boolean().default(true)
-});
-const CronRemove = object({ cronId: string().uuid() });
-//#endregion
-//#region ../protocol/dist/frames/secrets.js
-/**
-* Secrets (C5 ↔ D10) — protocol §6.
-*
-* Lease-based, no plaintext on the wire or in PG. Every frame carries a
-* REFERENCE to a Vault/KMS path, never the secret material itself.
-*/
-const SecretsRequest = object({ scope: object({
-	platform: Platform,
-	workspaceId: string().uuid()
-}) });
-const SecretsGrant = object({
-	leaseId: string().uuid(),
-	scope: object({
-		platform: string(),
-		workspaceId: string().uuid()
-	}),
-	ref: string(),
-	ttl: number().int(),
-	renewBeforeSec: number().int()
-});
-const SecretsRenew = object({ leaseId: string().uuid() });
-const SecretsRevoke = object({
-	leaseId: string().uuid(),
-	reason: string()
-});
-/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
-const ScopeAttestation = object({
-	machineId: string().uuid(),
-	scope: _enum([
-		"attachment.put",
-		"attachment.get",
-		"facts.put"
-	]),
-	resourceRef: string(),
-	jws: string(),
-	exp: string().datetime()
-});
-//#endregion
-//#region ../protocol/dist/frames/agent.js
-/**
-* Agent lifecycle + delivery (protocol §4.3, §4.4, §7.4, §8).
-*
-* Body-locality invariant (protocol §12): no frame here carries
-* `NormalizedMessage.text`. `agent/prompt` ships a `NormalizedMessageRef` — a
-* reference the daemon resolves against its local body store.
-*/
-/**
-* A REFERENCE/digest of a normalized message, NOT the body (protocol §4.3).
-* Enough for D4/D6 to fetch the local body and prompt.
-*/
-const NormalizedMessageRef = object({
-	sessionKey: SessionKey,
-	platformMsgId: string(),
-	seenUpToSeq: number().int()
-});
-/**
-* Where the agent runs. Two modes; the **path is always daemon-generated** —
-* never specified by the caller (UX picks the mode, the machine owns the dir).
-*
-* - `scratch`: a fresh empty working dir on the machine, no repo.
-* - `github`: the daemon clones `gitRepo` @ `branch` and runs the agent in
-*   `agentDir` (a subdir of the repo, repo-root if omitted). **Multiple agents
-*   may share one repo** — they differ by `agentDir`, so the repo is not an
-*   owned entity, just shared config on each agent.
-*/
-const AgentWorkspace = discriminatedUnion("mode", [object({ mode: literal("scratch") }), object({
-	mode: literal("github"),
-	gitRepo: string(),
-	branch: string().default("main"),
-	agentDir: string().optional()
-})]);
-/**
-* The editable agent definition the CP owns and the daemon needs to run it:
-* prompt + runtime selection. Raft ships this in the launch config and the
-* daemon synthesizes the system prompt locally; `description` IS the prompt.
-*/
-const AgentSpec = object({
-	name: string(),
-	description: string().optional(),
-	runtime: string().optional(),
-	model: string().optional(),
-	reasoningEffort: string().optional(),
-	executionMode: string().optional(),
-	workspace: AgentWorkspace.optional(),
-	env: record(string(), string()).optional()
-});
-const AgentLaunch = object({
-	agentId: string().uuid(),
-	runtime: string(),
-	workspaceId: string().uuid(),
-	capabilities: array(string()),
-	spec: AgentSpec,
-	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
-});
-/**
-* Live agent CRUD (C→D): the console edited an agent's spec; push it so a
-* running daemon reloads without waiting for the next launch. `agent/remove`
-* tears the agent down. Deleting an agent never relaunches it.
-*/
-const AgentUpsert = object({
-	agentId: string().uuid(),
-	spec: AgentSpec
-});
-const AgentRemove = object({ agentId: string().uuid() });
-const AgentLaunched = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	acpSessionId: string().optional(),
-	startedAt: string().datetime(),
-	runtime: string()
-});
-const AgentStop = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	reason: string()
-});
-const AgentPrompt = object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	content: NormalizedMessageRef,
-	seenUpToSeq: number().int()
-});
-const AgentPromptAck = object({
-	accepted: boolean(),
-	reason: _enum([
-		"queued",
-		"held",
-		"scope_denied",
-		"no_session",
-		"stale"
-	]).optional(),
-	seq: number().int()
-});
-const AgentActivity = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	state: _enum([
-		"thinking",
-		"tool_call",
-		"awaiting_permission",
-		"idle"
-	]),
-	ts: string().datetime()
-});
-const AgentScopeDenied = object({
-	agentId: string().uuid(),
-	launchId: string().uuid(),
-	capability: string()
-});
-//#endregion
-//#region ../protocol/dist/frames/integration.js
-/**
-* Platform integration distribution (C→D) — the Slack "install" flow.
-*
-* The Control Plane is the source of truth for platform integrations and pushes
-* them to the daemon that owns the integration's agent (`integration/upsert`, and
-* the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket
-* Mode connection from the delivered config (see slack/connection.ts).
-*
-* SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT
-* platform tokens (botToken/appToken). These payloads MUST NEVER be logged — no
-* body dump on decode error, no register/ok snapshot debug dump. The daemon
-* persists them into the owning agent's local `agent.json` (same trust boundary
-* as hand-authored agents, which already keep tokens there) so integrations
-* survive a restart with the CP down.
-*
-* `signingSecret` is intentionally absent: Socket Mode authenticates with the
-* app-level token, so the daemon never needs a signing secret.
-*/
-/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */
-const BindMatch = discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]);
-/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */
-const IntegrationBindRule = object({
-	channel: string().optional(),
-	thread: string().optional(),
-	match: BindMatch
-});
-/** The Slack config the daemon needs to open + route a socket (no signingSecret). */
-const IntegrationSlackConfig = object({
-	botToken: string(),
-	appToken: string(),
-	allowedUserIds: array(string()).default([]),
-	notificationChannelId: string().optional(),
-	bindRules: array(IntegrationBindRule).default([])
-});
-/**
-* One platform integration, owned by exactly one agent. Also the element type of
-* `RegisterOk.integrations[]` (the per-daemon reconcile set).
-*/
-const IntegrationSpec = object({
-	integrationId: string().uuid(),
-	agentId: string().uuid(),
-	platform: literal("slack"),
-	slack: IntegrationSlackConfig
-});
-/** C→D EVT — install/update an integration on the owning agent's daemon. */
-const IntegrationUpsert = IntegrationSpec;
-/** C→D EVT — remove an integration from the daemon. */
-const IntegrationRemove = object({ integrationId: string().uuid() });
-//#endregion
-//#region ../protocol/dist/frames/register.js
-/**
-* Capability upload + the reconcile snapshot — protocol §3.3.
-*
-* `register/ok` is the authoritative source of truth: the daemon converges its
-* local cache to it. CP wins all conflicts, so re-issuing the same snapshot is
-* idempotent.
-*/
-const RegisterReq = object({
-	host: string(),
-	capabilities: object({
-		platforms: array(Platform),
-		runtimes: array(string()),
-		acp: boolean(),
-		features: array(string()).default([])
-	}),
-	maxAgents: number().int(),
-	localState: object({
-		assignments: array(string()),
-		crons: array(string()),
-		leases: array(string())
-	})
-});
-const RegisterOk = object({
-	routingEpoch: number().int(),
-	assignments: array(RouteAssign),
-	agents: array(AgentSpec.extend({ agentId: string().uuid() })).default([]),
-	crons: array(CronUpsert),
-	integrations: array(IntegrationSpec).default([]),
-	leases: array(SecretsGrant),
-	drop: object({
-		assignments: array(string()),
-		crons: array(string())
-	})
-});
-//#endregion
-//#region ../protocol/dist/frames/session.js
-/**
-* Session read-back (C→D REQ → REP) — the console's on-demand pulls.
-*
-* The CP stores NO session data — neither the list nor the bodies. Sessions are
-* created on the Slack→daemon path and live solely in the daemon's local store
-* (body-locality, §1/§12). So both the session **list** and a session's chat
-* **history** are pulled live from the owning daemon(s) and proxied to the
-* console — never persisted on the CP, never on the orchestration hot path.
-*
-* - `session/list`: the daemon's live sessions (CP fans this out to all the org's
-*   online daemons and merges, for "all sessions across the workspace").
-* - `session/history`: one cursor-paginated page of a session's transcript.
-*/
-/**
-* Per-session token accounting, metered by the daemon from the agent's ACP usage
-* stream. Token counts are CUMULATIVE across the session's turns (summed from each
-* turn's `PromptResponse.usage`); context/cost are the LATEST snapshot from the
-* agent's `usage_update` stream. Every field is optional — a runtime that reports
-* no usage yields an absent field, not a zero.
-*/
-const SessionUsage = object({
-	totalTokens: number().int().optional(),
-	inputTokens: number().int().optional(),
-	outputTokens: number().int().optional(),
-	thoughtTokens: number().int().optional(),
-	cachedReadTokens: number().int().optional(),
-	cachedWriteTokens: number().int().optional(),
-	contextUsed: number().int().optional(),
-	contextSize: number().int().optional(),
-	costAmount: number().optional(),
-	costCurrency: string().optional()
-});
-/** One row in the session list (metadata + console metrics; NOT the transcript). */
-const SessionListItem = object({
-	sessionId: string(),
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	title: string().optional(),
-	status: string().optional(),
-	lastActivityAt: string().optional(),
-	usage: SessionUsage.optional(),
-	triggeredBy: string().optional()
-});
-/** C→D REQ: list the daemon's sessions (optionally just one agent's). */
-const SessionListReq = object({ agentId: string().uuid().optional() });
-/** D→C REP (corr = req id): the daemon's current sessions. */
-const SessionListPage = object({ sessions: array(SessionListItem) });
-/** One message in a session transcript page (a body — returned only for display). */
-const SessionMessage = object({
-	seq: number().int(),
-	sender: string(),
-	ts: string(),
-	kind: string(),
-	text: string()
-});
-/** C→D REQ: fetch one page of a session's history from the owning daemon. */
-const SessionHistoryReq = object({
-	sessionId: string(),
-	cursor: string().optional(),
-	limit: number().int().positive().max(200).default(50)
-});
-/** D→C REP (corr = the req id): a page of messages + the cursor for the next page. */
-const SessionHistoryPage = object({
-	sessionId: string(),
-	messages: array(SessionMessage),
-	nextCursor: string().optional()
-});
-//#endregion
-//#region ../protocol/dist/frame.js
-/**
-* The single source of truth for the wire: `type` string → payload zod schema.
-*
-* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
-* frames) plus the correlated REP types named in the "Reply" column
-* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
-* travel on the wire and must be decodable.
-*
-* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
-* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
-*/
-const FRAME_SCHEMAS = {
-	auth: AuthReq,
-	"auth/ok": AuthOk,
-	register: RegisterReq,
-	"register/ok": RegisterOk,
-	heartbeat: object({
-		load: object({
-			cpu: number(),
-			mem: number(),
-			agents: number().int()
-		}),
-		health: _enum(["ok", "degraded"]),
-		activeSessions: number().int(),
-		degradedScopes: array(string()).default([])
-	}),
-	"agent/launch": AgentLaunch,
-	"agent/launched": AgentLaunched,
-	"agent/stop": AgentStop,
-	"agent/upsert": AgentUpsert,
-	"agent/remove": AgentRemove,
-	"agent/prompt": AgentPrompt,
-	"agent/prompt/ack": AgentPromptAck,
-	"agent/activity": AgentActivity,
-	"agent/scope-denied": AgentScopeDenied,
-	"route/assign": RouteAssign,
-	"route/assign/ack": RouteAssignAck,
-	"route/update": RouteUpdate,
-	"daemon/drain": Drain,
-	"drain/progress": DrainProgress,
-	"drain/done": DrainDone,
-	"cron/upsert": CronUpsert,
-	"cron/remove": CronRemove,
-	"integration/upsert": IntegrationUpsert,
-	"integration/remove": IntegrationRemove,
-	"secrets/request": SecretsRequest,
-	"secrets/grant": SecretsGrant,
-	"secrets/renew": SecretsRenew,
-	"secrets/revoke": SecretsRevoke,
-	"scope-attestation": ScopeAttestation,
-	"event/session": object({
-		sessionId: string().uuid(),
-		agentId: string().uuid(),
-		launchId: string().uuid(),
-		phase: _enum([
-			"start",
-			"plan",
-			"problem",
-			"end"
-		]),
-		link: string().optional(),
-		summary: string().optional(),
-		ts: string().datetime()
-	}),
-	"usage/report": object({
-		sessionId: string(),
-		agentId: string().uuid(),
-		platform: string().optional(),
-		channel: string().optional(),
-		lastActivityAt: string(),
-		usage: SessionUsage
-	}),
-	"facts/runtime-profile": object({
-		runtime: string(),
-		version: string(),
-		models: array(string()),
-		contextWindow: number().int().optional(),
-		acpSupport: _enum([
-			"full",
-			"partial",
-			"none"
-		]),
-		toolCalling: boolean()
-	}),
-	"session/list": SessionListReq,
-	"session/list/page": SessionListPage,
-	"session/history": SessionHistoryReq,
-	"session/history/page": SessionHistoryPage,
-	"config/push": object({ keys: record(string(), unknown()) }),
-	"daemon/restart": object({
-		reason: string(),
-		drainFirst: boolean().default(true)
-	}),
-	"daemon/upgrade": object({
-		targetVersion: string(),
-		drainFirst: boolean().default(true)
-	}),
-	"daemon/control/ack": object({
-		accepted: boolean(),
-		willDrainUntil: string().datetime().optional()
-	}),
-	ack: object({
-		ok: boolean(),
-		reason: string().optional()
-	}),
-	error: object({
-		code: _enum([
-			"UNKNOWN_FRAME",
-			"FRAME_TOO_LARGE",
-			"PROTOCOL_STATE",
-			"BAD_PAYLOAD",
-			"AUTH_FAILED",
-			"ATTESTATION_INVALID",
-			"STALE_EPOCH",
-			"STALE_LAUNCH",
-			"SEQ_GAP",
-			"NO_SESSION",
-			"HELD",
-			"SCOPE_DENIED",
-			"LEASE_EXPIRED",
-			"LEASE_DENIED",
-			"RATE_LIMITED",
-			"INTERNAL"
-		]),
-		message: string(),
-		retryable: boolean(),
-		details: record(string(), unknown()).optional()
-	})
-};
-Object.keys(FRAME_SCHEMAS);
-/**
-* Builds the envelope schema for one frame `type` with a `type` literal and the
-* typed payload, so the discriminated union infers `payload` precisely.
-*/
-function frame(type, payload) {
-	return object({
-		v: literal(1),
-		id: string().uuid(),
-		ts: string().datetime(),
-		type: literal(type),
-		corr: string().uuid().optional(),
-		payload
-	});
-}
-discriminatedUnion("type", [
-	frame("auth", FRAME_SCHEMAS["auth"]),
-	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
-	frame("register", FRAME_SCHEMAS["register"]),
-	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
-	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
-	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
-	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
-	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
-	frame("agent/upsert", FRAME_SCHEMAS["agent/upsert"]),
-	frame("agent/remove", FRAME_SCHEMAS["agent/remove"]),
-	frame("agent/prompt", FRAME_SCHEMAS["agent/prompt"]),
-	frame("agent/prompt/ack", FRAME_SCHEMAS["agent/prompt/ack"]),
-	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
-	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
-	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
-	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
-	frame("route/update", FRAME_SCHEMAS["route/update"]),
-	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
-	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
-	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
-	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
-	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
-	frame("integration/upsert", FRAME_SCHEMAS["integration/upsert"]),
-	frame("integration/remove", FRAME_SCHEMAS["integration/remove"]),
-	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
-	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
-	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
-	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
-	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
-	frame("event/session", FRAME_SCHEMAS["event/session"]),
-	frame("usage/report", FRAME_SCHEMAS["usage/report"]),
-	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
-	frame("session/list", FRAME_SCHEMAS["session/list"]),
-	frame("session/list/page", FRAME_SCHEMAS["session/list/page"]),
-	frame("session/history", FRAME_SCHEMAS["session/history"]),
-	frame("session/history/page", FRAME_SCHEMAS["session/history/page"]),
-	frame("config/push", FRAME_SCHEMAS["config/push"]),
-	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
-	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
-	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
-	frame("ack", FRAME_SCHEMAS["ack"]),
-	frame("error", FRAME_SCHEMAS["error"])
-]);
-//#endregion
-//#region ../protocol/dist/codec.js
-/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
-const MAX_FRAME_BYTES = 256 * 1024;
-const textEncoder = new TextEncoder();
-function byteLength(text) {
-	return textEncoder.encode(text).length;
-}
-function extractControlExt(json) {
-	if (typeof json !== "object" || json === null) return void 0;
-	const o = json;
-	const ext = {};
-	if (typeof o.epoch === "number") ext.epoch = o.epoch;
-	if (typeof o.seq === "number") ext.seq = o.seq;
-	if (typeof o.agentId === "string") ext.agentId = o.agentId;
-	if (typeof o.launchId === "string") ext.launchId = o.launchId;
-	return Object.keys(ext).length > 0 ? ext : void 0;
-}
-function decodeEnvelope(text) {
-	if (byteLength(text) > 262144) return {
-		ok: false,
-		id: NIL_UUID,
-		msg: "FRAME_TOO_LARGE"
-	};
-	let json;
-	try {
-		json = JSON.parse(text);
-	} catch {
-		return {
-			ok: false,
-			id: NIL_UUID,
-			msg: "invalid json"
-		};
-	}
-	const env = Envelope.safeParse(json);
-	if (!env.success) return {
-		ok: false,
-		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
-		msg: env.error.message
-	};
-	const schema = FRAME_SCHEMAS[env.data.type];
-	if (!schema) return {
-		ok: false,
-		id: env.data.id,
-		msg: "UNKNOWN_FRAME"
-	};
-	const payload = schema.safeParse(env.data.payload);
-	if (!payload.success) return {
-		ok: false,
-		id: env.data.id,
-		msg: payload.error.message
-	};
-	const ext = extractControlExt(json);
-	return {
-		ok: true,
-		frame: {
-			...env.data,
-			payload: payload.data
-		},
-		...ext ? { ext } : {}
-	};
-}
-function buildEnvelope(type, payload, opts = {}) {
-	return {
-		v: 1,
-		id: opts.id ?? randomUUID(),
-		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
-		type,
-		payload,
-		...opts.corr ? { corr: opts.corr } : {},
-		...opts.ext ?? {}
-	};
-}
-function encode(frame) {
-	return JSON.stringify(frame);
-}
-//#endregion
-//#region ../protocol/dist/index.js
-/**
-* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
-* `AnyFrame` to the member whose `type` matches.
-*/
-function isFrame(type) {
-	return (frame) => frame.type === type;
-}
-//#endregion
 //#region ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js
 var require_constants$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const BINARY_TYPES = [
@@ -82373,7 +82405,7 @@ function applySpecFields(raw, spec, opts) {
 		const existing = typeof raw.workspace === "object" && raw.workspace !== null ? raw.workspace : {};
 		existing.mode = mapWorkspaceMode(ws.mode);
 		if (ws.mode === "github") {
-			existing.gitRepo = ws.gitRepo;
+			existing.gitRepo = normalizeGitUrl(ws.gitRepo);
 			existing.gitBranch = ws.branch;
 		}
 		if (opts.creating && existing.path === void 0) existing.path = join(opts.agentDir, "workspace");