@agentdocumentformat/cli 0.8.0 → 0.8.1

package/dist/chunks/{daemon-FQ5BV3AP.mjs → daemon-BVDB565V.mjs}

@@ -32,11 +32,6 @@ import {
   resolveCompactThreshold,
   resolveLoopThreshold
 } from "./chunk-HBOFZRUS.mjs";
-import {
-  formatTurnErrorRow,
-  parseLoopToDisplay,
-  providerContextCategory
-} from "./chunk-4OGZFUKA.mjs";
 import {
   BUNDLED_REGISTRY_UPDATED_AT,
   MCP_REGISTRY,
@@ -46,10 +41,11 @@ import {
   deriveRegistrationTestPlan,
   isRegistrationAgentVisible,
   isSensitiveMcpHeader,
+  isSubscriptionType,
   mcpCredentialRef,
   parseMcpRegistryDocument,
   pinServerConfigToRegistration
-} from "./chunk-G6NBFYG5.mjs";
+} from "./chunk-SOSPQPEN.mjs";
 import {
   TailscaleClient,
   defaultExec,
@@ -61,16 +57,22 @@ import {
 import {
   wrapper_default
 } from "./chunk-F5ELW46V.mjs";
+import {
+  formatOwnerCommandRow,
+  formatTurnErrorRow,
+  parseLoopToDisplay,
+  providerContextCategory
+} from "./chunk-7JZXMDDF.mjs";
 import {
   AiSdkProvider,
   createClaudeSubscriptionProvider,
   getTokenCounterService,
   seedMandatoryReasoningModels,
   setMandatoryReasoningPersister
-} from "./chunk-C4GA5SI4.mjs";
+} from "./chunk-KCIRFUZH.mjs";
 import {
   executeNode
-} from "./chunk-LGL6ML37.mjs";
+} from "./chunk-F3WSCAJD.mjs";
 import {
   ParseError,
   parse
@@ -138,7 +140,7 @@ import {
   withLoop,
   withSource,
   withTurn
-} from "./chunk-YRMKSHW3.mjs";
+} from "./chunk-LVF2DRBR.mjs";
 import {
   DEFAULT_BASE_PROMPT,
   DEFAULT_COMPACTION_PROMPT,
@@ -147,7 +149,7 @@ import {
   DOCS_GUIDES_URL,
   MIND_PROMPT_SECTION,
   SOUL_PROMPT_SECTION
-} from "./chunk-LCMANRYY.mjs";
+} from "./chunk-E7LC6SHP.mjs";
 import "./chunk-NZ7JTHEO.mjs";
 import {
   nanoid
@@ -280,7 +282,7 @@ import {
   pidAlive,
   processAgentLeases,
   trustedEndpoint
-} from "./chunk-JVPZIMXW.mjs";
+} from "./chunk-D7A77SNL.mjs";
 import {
   NETWORK_PROBLEM_TEXT
 } from "./chunk-3UGZFWIF.mjs";
@@ -301,7 +303,7 @@ import {
   noteLocalProofProblem,
   probeKeychain,
   testSeamsAllowed
-} from "./chunk-WVTPPOKK.mjs";
+} from "./chunk-BS3USVEA.mjs";
 import {
   ensureDaemonToken,
   tokensEqual
@@ -325,9 +327,12 @@ import {
   LOOP_NAME_PATTERN,
   LOOP_NAME_RULE,
   LOOP_TOOLS_MAX,
-  LoopConfigSchema,
-  MAX_SIDE_LOOPS
-} from "./chunk-XT2BJUFC.mjs";
+  LoopConfigSchema
+} from "./chunk-YRBFIDLB.mjs";
+import {
+  parseLambdaRef,
+  splitArgv
+} from "./chunk-VENQBMOA.mjs";
 import {
   AGENT_DEFAULTS,
   CODE_EXECUTION_DEFAULTS,
@@ -335,13 +340,15 @@ import {
   DEFAULT_NEW_LOOP_TOOLS,
   DEFAULT_TOOLS,
   FILE_PROTECTION_LEVELS,
+  MAX_SIDE_LOOPS,
   META_PROTECTION_LEVELS,
   RECOVERY_DEFAULTS,
   RESERVED_AGENT_PATH_SEGMENTS,
   SETTABLE_STATES,
   UPDATABLE_STATES,
+  hasLoopGoal,
   resolveStartInState
-} from "./chunk-NZO5O4VN.mjs";
+} from "./chunk-BR3AD5QZ.mjs";
 import {
   external_exports
 } from "./chunk-ZJKXHM4Q.mjs";
@@ -43981,6 +43988,44 @@ import { existsSync as existsSync11, readdirSync as readdirSync5, realpathSync,
 import { readdir as readdir4, realpath as realpath2 } from "node:fs/promises";
 import { basename as basename8, dirname as dirname13, join as join24, resolve as resolve10 } from "node:path";
 
+// src/main/adf/loop-teardown.ts
+function dropTimersForLoop(workspace, name15) {
+  let dropped = 0, kept = 0;
+  for (let timer of workspace.getTimers())
+    if ((timer.loop ?? MAIN_LOOP) === name15) {
+      if (timer.locked) {
+        kept++;
+        continue;
+      }
+      workspace.deleteTimer(timer.id), dropped++;
+    }
+  return { dropped, kept };
+}
+async function teardownRemovedLoopsOffline(workspace, previous, next) {
+  let kept = new Set((next.loops ?? []).map((l) => l.name)), removed = (previous.loops ?? []).map((l) => l.name).filter((name15) => name15 !== MAIN_LOOP && !kept.has(name15));
+  for (let name15 of removed) {
+    let log2 = (level, event, message) => {
+      try {
+        workspace.insertLog(level, "loop", event, name15, message);
+      } catch {
+      }
+    };
+    try {
+      let { archivedEntries } = await workspace.forLoop(name15).clearLoop({ forceAudit: !0 });
+      log2("info", "loop_torn_down", archivedEntries > 0 ? `Loop "${name15}" removed via config while the agent was stopped; ${archivedEntries} stream ${archivedEntries === 1 ? "entry" : "entries"} archived to adf_audit under "loop:${name15}"` : `Loop "${name15}" removed via config while the agent was stopped; its stream was empty, nothing to archive`);
+      let timers = dropTimersForLoop(workspace, name15);
+      timers.dropped > 0 && log2("info", "loop_timers_dropped", `Dropped ${timers.dropped} timer(s) belonging to deleted loop "${name15}" \u2014 orphaned timers are never re-pointed at main`), timers.kept > 0 && log2("warn", "loop_timers_locked_kept", `Kept ${timers.kept} locked timer(s) belonging to deleted loop "${name15}" \u2014 a lock is human-only and survives the loop; unlock or delete them in Studio`);
+    } catch (error) {
+      console.error(`[LoopTeardown] Teardown of removed loop "${name15}" failed:`, error), log2(
+        "error",
+        "loop_teardown_failed",
+        `Teardown of removed loop "${name15}" failed; its stream may still be in adf_loop: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  return removed;
+}
+
 // src/main/adf/apply-default-provider.ts
 function toAdfProviderConfig(p) {
   let adf = {
@@ -58226,6 +58271,7 @@ function expectsNumber(path) {
   return NUMERIC_LEAF_NAMES.has(leaf) || NUMERIC_LEAF_SUFFIX.test(leaf);
 }
 var DECLARATION_ARRAYS = /* @__PURE__ */ new Set([
+  "commands",
   "tools",
   "serving.api",
   "ws_connections",
@@ -58303,8 +58349,10 @@ var InputSchema6 = external_exports.object({
       return this.err(`Invalid input: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
     try {
       let { path, value, index } = parsed.data, action = parsed.data.action ?? "set", segments = this.parsePath(path);
+      if (!isAuthorized && segments[0] === "commands" && segments[segments.length - 1] === "locked" && value === !0)
+        return this.err("Only the owner can lock a command.");
       for (let seg of segments) {
-        if (seg === "locked" || seg === "locked_fields")
+        if (seg === "locked" && !(isAuthorized && segments[0] === "commands") || seg === "locked_fields")
           return this.err("Cannot modify locking configuration.");
         if (seg === "restricted" || seg === "restricted_methods")
           return this.err("Cannot modify restriction configuration.");
@@ -58331,11 +58379,11 @@ var InputSchema6 = external_exports.object({
       let lockViolation = this.checkLocks(config, resolved);
       if (lockViolation && !isAuthorized && !isOverride)
         return this.errProtected(lockViolation, this.lockDescription(path, value, action));
-      let valErr = this.validateField(path, value, action);
+      let valErr = this.validateField(resolved.join("."), value, action, workspace);
       if (valErr) return this.err(valErr);
-      let declErr = this.checkDeclarationIntegrity(config, resolved, value, action);
+      let declErr = this.checkDeclarationIntegrity(config, resolved, value, action, isAuthorized);
       if (declErr) return this.err(declErr);
-      let snapshot = cloneConfig(config), issuesBefore = schemaIssueKeys(snapshot), applyErr = this.applyChange(config, resolved, value, action, index, isOverride);
+      let snapshot = cloneConfig(config), issuesBefore = schemaIssueKeys(snapshot), applyErr = this.applyChange(config, resolved, value, action, index, isOverride || isAuthorized);
       if (applyErr) return typeof applyErr == "string" ? this.err(applyErr) : this.errProtected(applyErr, this.lockDescription(path, value, action));
       let issuesAfter = schemaIssueKeys(config), introduced = [...issuesAfter.keys()].filter((key) => !issuesBefore.has(key));
       if (introduced.length > 0 || issuesAfter.size > issuesBefore.size) {
@@ -58421,7 +58469,16 @@ var InputSchema6 = external_exports.object({
   // ---------------------------------------------------------------------------
   // Field validation
   // ---------------------------------------------------------------------------
-  validateField(path, value, action) {
+  validateField(path, value, action, workspace) {
+    if (action !== "remove" && /^commands(?:\.\d+(?:\.lambda)?)?$/.test(path)) {
+      let entries = path.endsWith(".lambda") ? [{ lambda: value }] : Array.isArray(value) ? value : [value];
+      for (let entry of entries) {
+        if (!entry || typeof entry != "object" || typeof entry.lambda != "string") continue;
+        let ref = parseLambdaRef(entry.lambda);
+        if ("error" in ref) return ref.error;
+        if (workspace.readFile(ref.file) === null) return `Lambda file "${ref.file}" not found. Write it first, then register the command.`;
+      }
+    }
     if (path === "name") {
       if (typeof value != "string" || value.trim().length === 0)
         return "name must be a non-empty string";
@@ -58496,14 +58553,16 @@ var InputSchema6 = external_exports.object({
    *     the tool's effective declaration (current config, else DEFAULT_TOOLS)
    *     has that flag true.
    */
-  checkDeclarationIntegrity(config, segments, value, action) {
+  checkDeclarationIntegrity(config, segments, value, action, isAuthorized) {
     if (action === "remove") return null;
     let normalized = segments.filter((seg) => typeof seg != "number").join(".");
     if (!DECLARATION_ARRAYS.has(normalized)) return null;
     let isElementSet = action === "set" && typeof segments[segments.length - 1] == "number", incoming = action === "append" ? [value] : isElementSet ? [value] : Array.isArray(value) ? value : [];
     if (incoming.length === 0) return null;
-    let existingArray = this.readArrayAt(config, isElementSet ? segments.slice(0, -1) : segments), replacedIndex = isElementSet ? segments[segments.length - 1] : -1, siblings = (existingArray ?? []).filter((_, i) => i !== replacedIndex), seen = /* @__PURE__ */ new Set();
+    let existingArray = this.readArrayAt(config, isElementSet ? segments.slice(0, -1) : segments), replacedIndex = isElementSet ? segments[segments.length - 1] : -1, siblings = normalized === "commands" && action === "set" && !isElementSet ? [] : (existingArray ?? []).filter((_, i) => i !== replacedIndex), seen = /* @__PURE__ */ new Set();
     for (let entry of incoming) {
+      if (normalized === "commands" && !isAuthorized && entry && typeof entry == "object" && entry.locked === !0)
+        return "Only the owner can lock a command.";
       let key = declarationKey(entry);
       if (!key) continue;
       if (seen.has(key) || siblings.some((el) => declarationKey(el) === key))
@@ -59287,6 +59346,7 @@ function mergeTemplateWithOverrides(templateConfig, overrides) {
     "mcp",
     "adapters",
     "serving",
+    "commands",
     "providers",
     "ws_connections",
     "locked_fields",
@@ -59304,7 +59364,10 @@ function mergeTemplateWithOverrides(templateConfig, overrides) {
   if (!mergedTriggers.ok) return mergedTriggers;
   let mergedServing = mergeServing(templateConfig.serving, overrides.serving);
   if (!mergedServing.ok) return mergedServing;
-  let options = {
+  let lockedCommands = (templateConfig.commands ?? []).filter((command) => command.locked);
+  if (overrides.commands?.some((command) => lockedCommands.some((locked) => locked.name === command.name)))
+    return { ok: !1, error: "Cannot override a locked template command" };
+  let commands = overrides.commands === void 0 ? templateConfig.commands : [...lockedCommands, ...overrides.commands], options = {
     name: overrides.name ?? templateConfig.name,
     description: overrides.description ?? templateConfig.description,
     instructions: overrides.instructions ?? templateConfig.instructions,
@@ -59333,6 +59396,7 @@ function mergeTemplateWithOverrides(templateConfig, overrides) {
     ...overrides.logging ?? templateConfig.logging ? { logging: overrides.logging ?? templateConfig.logging } : {},
     ...overrides.mcp ?? templateConfig.mcp ? { mcp: overrides.mcp ?? templateConfig.mcp } : {},
     ...overrides.adapters ?? templateConfig.adapters ? { adapters: overrides.adapters ?? templateConfig.adapters } : {},
+    ...commands ? { commands } : {},
     ...mergedServing.value ? { serving: mergedServing.value } : {},
     ...overrides.providers ?? templateConfig.providers ? { providers: overrides.providers ?? templateConfig.providers } : {},
     ...overrides.ws_connections ?? templateConfig.ws_connections ? { ws_connections: overrides.ws_connections ?? templateConfig.ws_connections } : {},
@@ -63701,6 +63765,10 @@ import { join as join8, dirname as dirname5 } from "path";
 
 // src/main/utils/atomic-json.ts
 import {
+  closeSync,
+  fsyncSync,
+  openSync,
+  writeSync,
   readFileSync as readFileSync2,
   writeFileSync as writeFileSync2,
   renameSync as renameSync2,
@@ -64510,9 +64578,13 @@ init_execution_context();
 init_emit_umbilical();
 
 // src/main/runtime/runtime-gate.ts
-var RuntimeGateImpl = class {
+var KILL_IN_PROGRESS_ERROR = "Kill is still stopping agents. Start it again once it finishes.", RuntimeGateImpl = class {
   _stopped = !1;
   _teardown = !1;
+  _kills = 0;
+  _killEpoch = 0;
+  _killSettled = Promise.resolve();
+  _settleKill = null;
   get stopped() {
     return this._stopped;
   }
@@ -64520,9 +64592,43 @@ var RuntimeGateImpl = class {
   get tearingDown() {
     return this._teardown;
   }
+  /** True while a Kill is stopping agents (between beginKill and its release). */
+  get killing() {
+    return this._kills > 0;
+  }
+  /**
+   * Counts the Kills begun. A start that awaits before it starts anything (a
+   * provider check, a folder scan) takes it first and refuses when
+   * `killedSince` says a Kill began in between: a start the user asked for
+   * before the Kill is not carried out after it.
+   */
+  get killEpoch() {
+    return this._killEpoch;
+  }
+  killedSince(epoch) {
+    return this._killEpoch !== epoch || this._kills > 0;
+  }
   stop() {
     this._stopped || (this._stopped = !0, console.log("[RuntimeGate] stopped"));
   }
+  /**
+   * A Kill begins: the gate closes and stays closed until the returned
+   * release runs (call it in a finally). Overlapping Kills nest. After the
+   * release the gate is still stopped: only a deliberate start reopens it.
+   */
+  beginKill() {
+    this.stop(), this._killEpoch++, this._kills++ === 0 && (this._killSettled = new Promise((resolve20) => {
+      this._settleKill = resolve20;
+    }));
+    let released = !1;
+    return () => {
+      released || (released = !0, --this._kills === 0 && (this._settleKill?.(), this._settleKill = null));
+    };
+  }
+  /** Resolves once no Kill is running (at once when none is). */
+  whenKillSettled() {
+    return this._killSettled;
+  }
   /**
    * Terminal stop for process shutdown. After this, `resume()` no-ops and
    * `stopped` remains true until process exit.
@@ -64535,11 +64641,15 @@ var RuntimeGateImpl = class {
       console.warn("[RuntimeGate] resume() ignored \u2014 runtime teardown in progress");
       return;
     }
+    if (this._kills > 0) {
+      console.warn("[RuntimeGate] resume() refused \u2014 Kill is still stopping agents");
+      return;
+    }
     this._stopped && (this._stopped = !1, console.log("[RuntimeGate] resumed"));
   }
-  /** Test-only escape hatch: clears stopped/teardown state. Never call in production code. */
+  /** Test-only escape hatch: clears stopped/teardown/kill state. Never call in production code. */
   _resetForTests() {
-    this._stopped = !1, this._teardown = !1;
+    this._stopped = !1, this._teardown = !1, this._kills = 0, this._killEpoch = 0, this._settleKill?.(), this._settleKill = null, this._killSettled = Promise.resolve();
   }
 }, RuntimeGate = new RuntimeGateImpl();
 
@@ -65130,6 +65240,8 @@ var AgentExecutor = class _AgentExecutor extends EventEmitter3 {
   session;
   config;
   basePrompt;
+  /** Settings' app system prompt, read each turn: an edit applies at the next turn (setBasePromptSource). */
+  basePromptSource = null;
   toolPrompts;
   compactionPrompt;
   abortController = null;
@@ -65175,6 +65287,8 @@ var AgentExecutor = class _AgentExecutor extends EventEmitter3 {
   // Turns running OR already committed to run (see isTurnActive). Not a state
   // machine — a counter, because error-recovery retries nest executeTurn calls
   // and a re-entrant successor claims its slot before its predecessor releases.
+  pendingOwnerCommandRecords = [];
+  ownerCommandRecordsClosed = !1;
   activeTurnCount = 0;
   // Agent-scope subset of activeTurnCount. The concurrent-turn guard reads THIS
   // one: a system-scope dispatch (lambda handler) never touches the session, so
@@ -66058,7 +66172,7 @@ var AgentExecutor = class _AgentExecutor extends EventEmitter3 {
       let loop = this.umbilicalLoop(), run2 = () => this.executeTurnImpl(dispatch, opts, turnId), correlated = () => withTurn(dispatch.turnId ?? turnId, () => loop ? withLoop(loop, run2) : run2());
       return await withSource(`agent:${turnId}`, this.config.id, correlated);
     } finally {
-      if (this.activeTurnCount--, dispatch.scope !== "system" ? this.activeAgentTurnCount-- : this.activeAgentTurnCount === 0 && this.betweenTurns() && this.drainPendingTriggers(), this.activeAgentTurnCount === 0 && this.writeDiscardNotice(), this.activeTurnCount === 0 && this.onTurnSettled)
+      if (this.activeTurnCount--, dispatch.scope !== "system" ? this.activeAgentTurnCount-- : this.activeAgentTurnCount === 0 && this.betweenTurns() && this.drainPendingTriggers(), this.activeTurnCount === 0 && this.flushOwnerCommandRecords(), this.activeAgentTurnCount === 0 && this.writeDiscardNotice(), this.activeTurnCount === 0 && this.onTurnSettled)
         try {
           this.onTurnSettled();
         } catch (error) {
@@ -66145,7 +66259,7 @@ var AgentExecutor = class _AgentExecutor extends EventEmitter3 {
     } finally {
       this.compactionFailedThisTurn = failedBefore, this.manualCompactionActive = !1, this._interruptRestart = !1;
       let replayed = this.getState() !== "stopped" && this.replayQueuedChats();
-      if (this.activeTurnCount--, this.activeAgentTurnCount--, !replayed && this.activeAgentTurnCount === 0 && this.betweenTurns() && this.drainPendingTriggers(), this.activeAgentTurnCount === 0 && this.writeDiscardNotice(), this.activeTurnCount === 0 && this.onTurnSettled)
+      if (this.activeTurnCount--, this.activeAgentTurnCount--, !replayed && this.activeAgentTurnCount === 0 && this.betweenTurns() && this.drainPendingTriggers(), this.activeTurnCount === 0 && this.flushOwnerCommandRecords(), this.activeAgentTurnCount === 0 && this.writeDiscardNotice(), this.activeTurnCount === 0 && this.onTurnSettled)
         try {
           this.onTurnSettled();
         } catch (error) {
@@ -66357,7 +66471,7 @@ var AgentExecutor = class _AgentExecutor extends EventEmitter3 {
           timestamp: Date.now()
         }), chatTokens = await this.forceCompact(`auto: ${chatTokens} >= ${compactThreshold}`)) : (this.memoryFlushNudgeIssued = !0, this.addRuntimeNotice("Context is about to be compacted. Before that happens: write any durable learnings from this loop to your mind pages (update mind.md index + mind/log.md), citing source messages by their [S<seq>] markers. Track unfinished work on an open-thread page. Then continue \u2014 compaction follows automatically.")));
         let systemPrompt = this.buildSystemPrompt(), dynamicInstructions = this.buildDynamicInstructions(chatTokens, compactThreshold);
-        if (this.recordRequestContext(systemPrompt, dynamicInstructions), this.session.drainContextInjections(), opts?.nested || this.deliverQueuedChats("next_step"), !this.providerValidated && this.provider) {
+        if (this.recordRequestContext(systemPrompt, dynamicInstructions), this.session.drainContextInjections(), this.flushOwnerCommandRecords(), opts?.nested || this.deliverQueuedChats("next_step"), !this.providerValidated && this.provider) {
           let validation = await this.provider.validateConfig();
           if (!validation.valid) {
             let preflightError = validation.error || "unknown";
@@ -67855,6 +67969,29 @@ Use start_line/end_line to read sections (e.g. start_line=1, end_line=100).
    * Truncate oversized tool results to protect the context window.
    * Uses a fast char-based pre-filter; only tokenizes when borderline.
    */
+  /** Apply the configured tool-result bounds before retaining a command result. */
+  boundToolResult(content, label) {
+    return this.enforceToolResultLimit({ content, isError: !1 }, label).content;
+  }
+  recordOwnerCommand(text) {
+    if (this.ownerCommandRecordsClosed) {
+      try {
+        this.session.getWorkspace().insertLog("warn", "command", "record_discarded", null, "Command completed after executor disposal.");
+      } catch {
+      }
+      return { deferred: !1 };
+    }
+    if (this.isTurnActive())
+      return this.pendingOwnerCommandRecords.push(text), { deferred: !0 };
+    let content = [{ type: "text", text }], seq = this.session.getWorkspace().appendToLoop("user", content);
+    return this.session.getMessages().length > 0 && this.session.addMessage({ role: "user", content }, void 0, { skipLoop: !0, seq }), this.emitEvent({ type: "context_injected", payload: { category: "owner_command", content: text, seq }, timestamp: Date.now() }), { deferred: !1, seq };
+  }
+  flushOwnerCommandRecords() {
+    for (; this.pendingOwnerCommandRecords.length > 0; ) {
+      let text = this.pendingOwnerCommandRecords[0], message = { role: "user", content: [{ type: "text", text }] }, seq;
+      this.session.getMessages().length === 0 ? seq = this.session.getWorkspace().appendToLoop("user", message.content) : (this.session.addMessage(message), this.session.flushToLoop(), seq = message.seq), this.pendingOwnerCommandRecords.shift(), this.emitEvent({ type: "context_injected", payload: { category: "owner_command", content: text, seq }, timestamp: Date.now() });
+    }
+  }
   enforceToolResultLimit(result, toolName) {
     let maxTokens = this.config.limits?.max_tool_result_tokens ?? 16e3, content = result.content;
     if (content.length <= maxTokens * 3) return result;
@@ -67891,7 +68028,7 @@ ${tail}` : ""}`;
 [TRUNCATED \u2014 content exceeded ${maxTokens.toLocaleString()} token limit]`;
   }
   setState(state) {
-    state === "idle" && this.besideTurnHilTasks.size > 0 && (state = "awaiting_approval"), state !== "error" && (this._errorReason = null, this._recoverySuppressedLogged = !1), this.state = state, this.emitEvent({
+    state === "idle" && this.besideTurnHilTasks.size > 0 && (state = "awaiting_approval"), state !== "error" && (this._errorReason = null, this._recoverySuppressedLogged = !1), state !== "stopped" && (this.ownerCommandRecordsClosed = !1), this.state = state, this.emitEvent({
       type: "state_changed",
       payload: { state },
       timestamp: Date.now()
@@ -68417,7 +68554,21 @@ ${tail}` : ""}`;
       prompt
     }, prompt;
   }
+  /**
+   * Read the app system prompt from the host's settings at every turn, so an
+   * edit applies at the next turn, not the next start. A non-string value
+   * keeps the prompt the executor has.
+   */
+  setBasePromptSource(read) {
+    this.basePromptSource = read;
+  }
+  /** The app system prompt this executor assembles with now. */
+  getBasePrompt() {
+    return this.basePrompt;
+  }
   assembleSystemPrompt() {
+    let live = this.basePromptSource?.();
+    typeof live == "string" && (this.basePrompt = live);
     let enabledToolNames = this.config.tools.filter((t) => t.enabled).map((t) => t.name).sort(), enabledTools = new Set(enabledToolNames), bare = this.config.bare_prompt === !0, includeBase = !bare && this.config.include_base_prompt !== !1, fullSections = assemblePrompt({
       config: this.config,
       basePrompt: this.basePrompt,
@@ -68432,6 +68583,8 @@ ${this.config.instructions}`
       JSON.stringify({
         name: this.config.name,
         instructions: this.config.instructions,
+        // The app system prompt can change mid-session (setBasePromptSource).
+        base_prompt: this.hashString(this.basePrompt),
         include_base_prompt: this.config.include_base_prompt,
         bare_prompt: this.config.bare_prompt,
         tools: enabledToolNames,
@@ -68661,6 +68814,7 @@ You have native ${modalityList} perception enabled. Two ways to perceive media:
    * a System notice goes to the live transcript, adf_logs and the loop.
    */
   discardQueuedChats(reason) {
+    this.activeAgentTurnCount === 0 && this.flushOwnerCommandRecords(), this.ownerCommandRecordsClosed = !0;
     let chats = this.pendingChats.splice(0), unanswered = this.absorbedTurnIds.splice(0);
     if (this.runningTurnId && !unanswered.includes(this.runningTurnId) && unanswered.push(this.runningTurnId), chats.length === 0 && unanswered.length === 0) return;
     let ids = chats.flatMap((chat) => chat.turnId ? [chat.turnId] : []);
@@ -70273,12 +70427,12 @@ var LoopConfigInputSchema = external_exports.object({
   name: external_exports.string().regex(LOOP_NAME_PATTERN, { message: LOOP_NAME_RULE }).optional().describe(
     'Loop name: 1-32 lowercase chars; unique here, "main" reserved.'
   ),
-  goal: external_exports.string().min(1).max(LOOP_GOAL_MAX_CHARS).optional().describe(
-    "The loop's charter \u2014 it becomes the loop's instructions."
+  goal: external_exports.string().max(LOOP_GOAL_MAX_CHARS).optional().describe(
+    "The loop's charter, appended to its instructions. Optional: without one the loop works on whatever it is sent. Required when autostart is true."
   ),
   enabled: external_exports.boolean().optional().describe("Whether the loop runs. Default true on create."),
   autostart: external_exports.boolean().optional().describe(
-    "Run a first turn on the goal without waiting to be addressed: now on create, and again whenever the agent starts. Default true on create. false: it only runs when a trigger, timer or loop_send targets it."
+    "Run a first turn on the goal without waiting to be addressed: now on create, and again whenever the agent starts. Default true on create, and needs a goal: creating without a goal requires autostart false. false: it only runs when a trigger, timer or loop_send targets it."
   ),
   autonomous: external_exports.boolean().optional().describe(
     "Keep turning after text-only responses until the loop calls sys_set_state. Not inherited from you; default false. Grant sys_set_state alongside."
@@ -70360,7 +70514,7 @@ var LoopManageTool = class {
   // Mutations
   // ---------------------------------------------------------------------------
   async handleCreate(pool, workspace, nameArg, configArg) {
-    if (!configArg) return errorResult('create requires "config" (at least name and goal).');
+    if (!configArg) return errorResult('create requires "config" (at least a name).');
     let name15 = configArg.name ?? nameArg;
     if (!name15) return errorResult('create requires a loop name, in "config.name" or "name".');
     if (configArg.name && nameArg && configArg.name !== nameArg)
@@ -70376,7 +70530,7 @@ var LoopManageTool = class {
       );
     let candidate = {
       name: name15,
-      goal: configArg.goal,
+      ...configArg.goal !== void 0 && { goal: configArg.goal },
       enabled: configArg.enabled ?? !0,
       // Persisted, like the agent's own `autostart`: the pool re-kicks the loop
       // on every agent start. Default on — a loop nobody addresses is idle,
@@ -70409,7 +70563,7 @@ var LoopManageTool = class {
     }
     return {
       content: `Created loop "${name15}"${validated.config.enabled ? " (running)" : " (disabled)"}.
-Goal: ${validated.config.goal}
+Goal: ${validated.config.goal?.trim() ? validated.config.goal : "(none)"}
 Tools: ${toolLine}.${this.disabledNote(validated.disabled)}
 ` + startLine,
       isError: !1
@@ -75277,7 +75431,7 @@ var LoopPool = class _LoopPool {
       isMain: !0
     }, side = (host2.loops ?? []).map((loop) => ({
       name: loop.name,
-      goal: loop.goal,
+      goal: loop.goal ?? "",
       status: this.runtimes.get(loop.name)?.status() ?? "idle",
       enabled: loop.enabled !== !1,
       isMain: !1
@@ -75475,13 +75629,19 @@ var LoopPool = class _LoopPool {
     if (this.disposed) return [];
     let woken = [];
     for (let loop of this.declaredLoops())
-      if (!(!loop.autostart || loop.enabled === !1) && this.runtimes.has(loop.name))
+      if (!(!loop.autostart || loop.enabled === !1) && this.runtimes.has(loop.name)) {
+        if (!hasLoopGoal(loop)) {
+          let message = `Autostart of loop "${loop.name}" refused: it has no goal. Add a goal or turn autostart off.`;
+          console.warn(`[LoopPool] ${message}`), this.logLoop("warn", "loop_autostart_refused", loop.name, message);
+          continue;
+        }
         try {
           let result = await this.sendToLoop(MAIN_LOOP, loop.name, LOOP_AUTOSTART_MESSAGE, !0);
           result.woke ? woken.push(loop.name) : console.warn(`[LoopPool] Autostart of loop "${loop.name}" delivered but did not wake: ${result.reason ?? "unknown"}`);
         } catch (error) {
           console.error(`[LoopPool] Autostart of loop "${loop.name}" failed:`, error);
         }
+      }
     return woken;
   }
   // ===========================================================================
@@ -75623,14 +75783,7 @@ var LoopPool = class _LoopPool {
   dropLoopTimers(name15) {
     let dropped = 0, kept = 0;
     try {
-      for (let timer of this.deps.workspace.getTimers())
-        if ((timer.loop ?? MAIN_LOOP) === name15) {
-          if (timer.locked) {
-            kept++;
-            continue;
-          }
-          this.deps.workspace.deleteTimer(timer.id), dropped++;
-        }
+      ({ dropped, kept } = dropTimersForLoop(this.deps.workspace, name15));
     } catch (error) {
       console.error(`[LoopPool] Failed to drop timers for loop "${name15}":`, error);
     }
@@ -75741,7 +75894,7 @@ var LoopPool = class _LoopPool {
         this.deps.compactionPrompt,
         preLlmHookRunner
       );
-      callHandler?.attachSession(session);
+      this.deps.basePromptSource && executor.setBasePromptSource(this.deps.basePromptSource), callHandler?.attachSession(session);
       let modelHandler = callHandler ?? this.deps.adfCallHandler;
       executor.setModelProviderFactory(modelHandler ? (model) => modelHandler.providerForModel(model) : null);
       let runtime2 = new LoopRuntime({
@@ -76114,14 +76267,14 @@ function assembleAgent(options) {
     options.compactionPrompt,
     preLlmHookRunner
   );
-  executor.setModelProviderFactory(adfCallHandler ? (model) => adfCallHandler.providerForModel(model) : null), executor.recoverStaleTurnCheckpoint(), executor.reconcileOrphanedTasks(), validateConfigOnLoad(workspace, config);
+  options.basePromptSource && executor.setBasePromptSource(options.basePromptSource), executor.setModelProviderFactory(adfCallHandler ? (model) => adfCallHandler.providerForModel(model) : null), executor.recoverStaleTurnCheckpoint(), executor.reconcileOrphanedTasks(), validateConfigOnLoad(workspace, config);
   let snapshotConfig = config, refreshEffectiveRuntime = () => {
     let sources = options.effectiveRuntime;
     sources && recordEffectiveRuntime(workspace, () => buildEffectiveRuntime({
       host: profile,
       config: snapshotConfig,
       provider: executor.getProvider() ?? provider,
-      basePrompt: options.basePrompt ?? "",
+      basePrompt: executor.getBasePrompt(),
       toolPrompts: options.toolPrompts ?? {},
       compactionPrompt: options.compactionPrompt,
       sources,
@@ -76337,6 +76490,7 @@ ${json.slice(0, room)}${note}`;
     // model override must follow it.
     getProvider: () => executor.getProvider() ?? provider,
     basePrompt: options.basePrompt ?? "",
+    basePromptSource: options.basePromptSource,
     toolPrompts: options.toolPrompts ?? {},
     compactionPrompt: options.compactionPrompt,
     adfCallHandler,
@@ -78424,18 +78578,69 @@ function createDefaultPipeline() {
 }
 
 // src/main/services/attestation.service.ts
-var REPLACEABLE_ROLES = ["owner", "operator"], RESERVED_ROLES = /* @__PURE__ */ new Set(["owner", "operator", "runtime", "clone", "rotation"]);
+var REPLACEABLE_ROLES = ["owner", "operator"], RESERVED_ROLES = /* @__PURE__ */ new Set(["owner", "operator", "runtime", "clone", "rotation"]), ATTESTATION_CLAIMS_MAX_BYTES = 4096, ATTESTATION_MAX_BYTES = 8192, PEER_ATTESTATIONS_MAX_COUNT = 64, PEER_ATTESTATIONS_MAX_BYTES = 65536, ATTESTATION_CLAIMS_MAX_DEPTH = 8;
+function attestationClaimsProblem(claims) {
+  if (claims === null || typeof claims != "object" || Array.isArray(claims)) return "claims must be a JSON object";
+  let problem = jsonValueProblem(claims, 1);
+  if (problem) return problem;
+  let bytes = Buffer.byteLength(canonicalJsonStringify(claims));
+  return bytes > ATTESTATION_CLAIMS_MAX_BYTES ? `claims take ${bytes} bytes; the most is ${ATTESTATION_CLAIMS_MAX_BYTES}` : null;
+}
+function jsonValueProblem(value, depth) {
+  if (value === null || typeof value == "string" || typeof value == "boolean") return null;
+  if (typeof value == "number") return Number.isFinite(value) ? null : "claims numbers must be finite";
+  if (typeof value != "object") return `claims cannot hold a ${typeof value}`;
+  if (depth > ATTESTATION_CLAIMS_MAX_DEPTH) return `claims nest deeper than ${ATTESTATION_CLAIMS_MAX_DEPTH} levels`;
+  if (Array.isArray(value)) {
+    for (let item of value) {
+      let problem = jsonValueProblem(item, depth + 1);
+      if (problem) return problem;
+    }
+    return null;
+  }
+  let proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return "claims can hold only plain objects";
+  if (Object.prototype.hasOwnProperty.call(value, "__proto__")) return 'claims cannot hold a "__proto__" key';
+  for (let item of Object.values(value)) {
+    let problem = jsonValueProblem(item, depth + 1);
+    if (problem) return problem;
+  }
+  return null;
+}
+function fieldsProblem(fields) {
+  for (let key of ["issuer", "subject", "role", "issued_at"])
+    if (typeof fields[key] != "string") return `${key} must be a string`;
+  for (let key of ["expires_at", "scope"])
+    if (fields[key] !== void 0 && typeof fields[key] != "string") return `${key} must be a string`;
+  return Object.prototype.hasOwnProperty.call(fields, "__proto__") ? 'an attestation cannot hold a "__proto__" key' : null;
+}
 function signableBytes(fields) {
+  if (fields.v === 2) return Buffer.from(canonicalJsonStringify(fields));
   let { issuer, subject, role, issued_at, expires_at, scope } = fields, signable = { issuer, subject, role, issued_at };
   return expires_at !== void 0 && (signable.expires_at = expires_at), scope !== void 0 && (signable.scope = scope), Buffer.from(canonicalJsonStringify(signable));
 }
 function createAttestation(fields, privateKeyPkcs8) {
-  let signature = `ed25519:${signEd25519(signableBytes(fields), privateKeyPkcs8)}`;
-  return { ...fields, signature };
+  let fieldProblem = fieldsProblem(fields);
+  if (fieldProblem) throw new Error(`Attestation not signed: ${fieldProblem}`);
+  if (fields.claims !== void 0) {
+    let problem = attestationClaimsProblem(fields.claims);
+    if (problem) throw new Error(`Attestation not signed: ${problem}`);
+  }
+  let unsigned = { v: 2, ...fields }, signature = `ed25519:${signEd25519(signableBytes(unsigned), privateKeyPkcs8)}`;
+  return { ...unsigned, signature };
 }
 function verifyAttestation(att, opts) {
-  if (!att || typeof att.signature != "string" || !att.signature.startsWith("ed25519:") || opts?.expectedSubject && att.subject !== opts.expectedSubject) return !1;
-  if (att.expires_at) {
+  if (!att || typeof att != "object" || typeof att.signature != "string" || !att.signature.startsWith("ed25519:") || fieldsProblem(att) || att.v !== void 0 && att.v !== 2) return !1;
+  if (att.v === 2) {
+    try {
+      if (Buffer.byteLength(canonicalJsonStringify(att)) > ATTESTATION_MAX_BYTES) return !1;
+    } catch {
+      return !1;
+    }
+    if (att.claims !== void 0 && attestationClaimsProblem(att.claims)) return !1;
+  }
+  if (opts?.expectedSubject && att.subject !== opts.expectedSubject) return !1;
+  if (att.expires_at !== void 0) {
     let expires = Date.parse(att.expires_at);
     if (Number.isNaN(expires) || expires <= (opts?.now ?? /* @__PURE__ */ new Date()).getTime()) return !1;
   }
@@ -78473,26 +78678,72 @@ function addPeerAttestation(workspace, attestation, ownDid) {
     return { ok: !1, error: `Attestation subject must be this agent's DID (${ownDid})` };
   if (!verifyAttestation(attestation, { expectedSubject: ownDid }))
     return { ok: !1, error: "Attestation signature is invalid or expired" };
-  if (readAdfAttestations(workspace).some((a) => a.signature === attestation.signature))
+  let existing = readAdfAttestations(workspace);
+  if (existing.some((a) => a.signature === attestation.signature))
     return { ok: !0 };
-  let { issuer, subject, issued_at, expires_at, scope, signature } = attestation;
-  return workspace.getDatabase().insertAttestation({ issuer, subject, role, issued_at, expires_at, scope, signature }), { ok: !0 };
+  let peers = existing.filter((a) => !RESERVED_ROLES.has(a.role));
+  if (peers.length >= PEER_ATTESTATIONS_MAX_COUNT)
+    return { ok: !1, error: `This agent already keeps ${peers.length} peer attestations, the most it stores` };
+  let peerBytes = peers.reduce((n, a) => n + Buffer.byteLength(JSON.stringify(a)), 0) + Buffer.byteLength(JSON.stringify(attestation));
+  if (peerBytes > PEER_ATTESTATIONS_MAX_BYTES)
+    return { ok: !1, error: `Storing it would take peer attestations to ${peerBytes} bytes; the most is ${PEER_ATTESTATIONS_MAX_BYTES}` };
+  if (attestation.v === 2)
+    workspace.getDatabase().insertAttestation(attestation);
+  else {
+    let { issuer, subject, issued_at, expires_at, scope, signature } = attestation;
+    workspace.getDatabase().insertAttestation({ issuer, subject, role, issued_at, expires_at, scope, signature });
+  }
+  return { ok: !0 };
 }
 function issuePeerAttestation(workspace, fields, signingKeyPkcs8) {
   let issuer = workspace.getDid();
   if (!issuer) return { ok: !1, error: "This agent has no DID" };
   let role = typeof fields.role == "string" ? fields.role.trim() : "";
-  return role ? RESERVED_ROLES.has(role) ? { ok: !1, error: `Role "${role}" is reserved for the runtime` } : typeof fields.subject != "string" || !didToPublicKey(fields.subject) ? { ok: !1, error: "Subject must be a valid did:key identifier" } : fields.subject === issuer ? { ok: !1, error: "An agent cannot attest to itself" } : fields.expires_at !== void 0 && Number.isNaN(Date.parse(fields.expires_at)) ? { ok: !1, error: "expires_at must be an ISO 8601 timestamp" } : { ok: !0, attestation: createAttestation(
+  if (!role) return { ok: !1, error: "Attestation role is required" };
+  if (RESERVED_ROLES.has(role)) return { ok: !1, error: `Role "${role}" is reserved for the runtime` };
+  if (typeof fields.subject != "string" || !didToPublicKey(fields.subject))
+    return { ok: !1, error: "Subject must be a valid did:key identifier" };
+  if (fields.subject === issuer) return { ok: !1, error: "An agent cannot attest to itself" };
+  if (fields.expires_at !== void 0 && Number.isNaN(Date.parse(fields.expires_at)))
+    return { ok: !1, error: "expires_at must be an ISO 8601 timestamp" };
+  if (fields.claims !== void 0) {
+    let problem = attestationClaimsProblem(fields.claims);
+    if (problem) return { ok: !1, error: problem };
+  }
+  return { ok: !0, attestation: createAttestation(
     {
       issuer,
       subject: fields.subject,
       role,
       issued_at: (/* @__PURE__ */ new Date()).toISOString(),
       ...fields.expires_at !== void 0 ? { expires_at: fields.expires_at } : {},
-      ...fields.scope !== void 0 ? { scope: String(fields.scope) } : {}
+      ...fields.scope !== void 0 ? { scope: String(fields.scope) } : {},
+      ...fields.claims !== void 0 ? { claims: fields.claims } : {}
     },
     signingKeyPkcs8
-  ) } : { ok: !1, error: "Attestation role is required" };
+  ) };
+}
+function upgradeOwnAttestations(workspace, signers, busyTimeoutMs) {
+  let keys = new Map(signers.filter((s) => s.did && s.privateKey).map((s) => [s.did, s.privateKey]));
+  if (keys.size === 0) return 0;
+  let updates = [];
+  for (let att of readAdfAttestations(workspace)) {
+    let key = att.v === void 0 ? keys.get(att.issuer) : void 0;
+    if (!key || !verifyAttestation(att, { now: /* @__PURE__ */ new Date(0) })) continue;
+    let { issuer, subject, role, issued_at, expires_at, scope } = att;
+    updates.push({
+      from: att.signature,
+      to: createAttestation({
+        issuer,
+        subject,
+        role,
+        issued_at,
+        ...expires_at !== void 0 ? { expires_at } : {},
+        ...scope !== void 0 ? { scope } : {}
+      }, key)
+    });
+  }
+  return updates.length === 0 ? 0 : workspace.immediateTransaction(() => workspace.getDatabase().resignAttestations(updates), busyTimeoutMs);
 }
 function issueOwnerAttestation(workspace, keys) {
   let subject = workspace.getDid();
@@ -79245,7 +79496,8 @@ var EXCLUDED_TOOLS = /* @__PURE__ */ new Set(["say", "ask"]), CODE_EXECUTION_MET
         subject: input.subject,
         role: input.role,
         scope: input.scope,
-        expires_at: input.expires_at
+        expires_at: input.expires_at,
+        ...input.claims !== void 0 ? { claims: input.claims } : {}
       }, signingKey);
       return result.ok ? (this.logCall("info", "attestation_issue", input.role, `Issued "${input.role}" attestation for ${input.subject}`), { result: result.attestation }) : (this.logCall("warn", "attestation_issue", input.role, `Rejected: ${result.error}`), { error: result.error, errorCode: "INVALID_INPUT" });
     } catch (err) {
@@ -79503,14 +79755,16 @@ var EXCLUDED_TOOLS = /* @__PURE__ */ new Set(["say", "ask"]), CODE_EXECUTION_MET
           properties: {
             attestation: {
               type: "object",
-              description: "The complete signed attestation object, exactly as returned by the issuer's attestation_issue",
+              description: "The complete signed attestation object, exactly as returned by the issuer's attestation_issue (v2 signs every field, so pass it unchanged)",
               properties: {
+                v: { type: "number", description: "Format version: 2 for certs issued now (every field signed); absent on older v1 certs" },
                 issuer: { type: "string", description: "DID of the signer" },
                 subject: { type: "string", description: "This agent's DID" },
                 role: { type: "string", description: 'What the issuer asserts (e.g. "member", "reviewer") \u2014 reserved roles rejected' },
                 issued_at: { type: "string", description: "ISO 8601 timestamp" },
                 expires_at: { type: "string", description: "Optional ISO 8601 expiry" },
                 scope: { type: "string", description: "Optional qualifier (e.g. group or project identifier)" },
+                claims: { type: "object", description: "Optional JSON the issuer signed with the cert" },
                 signature: { type: "string", description: "Issuer's Ed25519 signature over the canonical payload" }
               },
               required: ["issuer", "subject", "role", "issued_at", "signature"]
@@ -79528,7 +79782,8 @@ var EXCLUDED_TOOLS = /* @__PURE__ */ new Set(["say", "ask"]), CODE_EXECUTION_MET
             subject: { type: "string", description: "DID of the agent being attested (did:key:..., not this agent)" },
             role: { type: "string", description: 'What is being asserted (e.g. "member", "reviewer") \u2014 reserved roles rejected' },
             scope: { type: "string", description: "Optional qualifier (e.g. group or project identifier)" },
-            expires_at: { type: "string", description: "Optional ISO 8601 expiry" }
+            expires_at: { type: "string", description: "Optional ISO 8601 expiry" },
+            claims: { type: "object", description: 'Optional JSON object signed with the cert (at most 4096 bytes as canonical JSON, 8 levels deep, plain JSON values only). The runtime does not interpret it; namespace the keys, e.g. {"org.example/membership": {"tier": "editor"}}' }
           },
           required: ["subject", "role"]
         }
@@ -79700,7 +79955,7 @@ if (typeof ${fnName} === 'function') {
     let { event } = dispatch, triggerName = Object.entries(TRIGGER_TO_EVENT_TYPE).find(([, v]) => v === event.type)?.[0] ?? event.type;
     console.log(`[Shell] Executing trigger command: "${command}" (trigger: ${event.type})`);
     try {
-      let { parse: parse2 } = await import("./parser-7GARNT5L.mjs"), { executeNode: executeNode2 } = await import("./pipeline-executor-FD4FBWQA.mjs"), { EnvironmentResolver: EnvironmentResolver2 } = await import("./environment-R47X44GM.mjs"), config = this.workspace.getAgentConfig(), env = new EnvironmentResolver2(config, this.workspace);
+      let { parse: parse2 } = await import("./parser-7GARNT5L.mjs"), { executeNode: executeNode2 } = await import("./pipeline-executor-DRYEEFDR.mjs"), { EnvironmentResolver: EnvironmentResolver2 } = await import("./environment-R47X44GM.mjs"), config = this.workspace.getAgentConfig(), env = new EnvironmentResolver2(config, this.workspace);
       env.setTriggerContext(dispatch);
       let toolRegistry = this.adfCallHandler.getToolRegistry(), ast = parse2(command), startTime = performance.now(), result = await executeNode2(ast, "", {
         workspace: this.workspace,
@@ -83793,6 +84048,7 @@ var MCP_CONNECT_BUDGET_MS = 25e3, AgentRuntimeBuilder = class {
         ...this.settings ? { effectiveRuntime: { settings: this.settings } } : {},
         restoreLoop: opts.restoreLoop,
         basePrompt: opts.prompts ? opts.prompts.basePrompt : this.basePrompt,
+        basePromptSource: opts.prompts?.basePromptSource,
         toolPrompts: opts.prompts ? opts.prompts.toolPrompts : this.toolPrompts,
         compactionPrompt: opts.prompts ? opts.prompts.compactionPrompt : this.compactionPrompt,
         adfCallHandler,
@@ -84698,6 +84954,73 @@ function applyBackgroundEvent(target, filePath, event, emit, now) {
     Object.assign(target, step.patch), step.event && emit(step.event);
 }
 
+// src/main/runtime/owner-command.ts
+init_execution_context();
+init_emit_umbilical();
+var OwnerCommandRefusedError = class extends Error {
+  constructor(message, statusCode, code) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+    this.name = "OwnerCommandRefusedError";
+  }
+  statusCode;
+  code;
+};
+async function runOwnerCommand(host2, req) {
+  if (!req || typeof req.name != "string" || typeof req.args != "string" || req.args.length > 4096 || /[\r\n]/.test(req.args) || typeof req.authorize != "boolean" || req.loop !== void 0 && typeof req.loop != "string" || req.requestId !== void 0 && (typeof req.requestId != "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(req.requestId)))
+    throw new OwnerCommandRefusedError("Invalid command request: args must be a single line of at most 4096 characters and requestId must use 1\u201364 letters, digits, underscores or hyphens.", 400, "invalid_request");
+  let id = req.requestId ?? "cmd_" + nanoid(10), loop = req.loop || MAIN_LOOP;
+  if (!host2.loopPool.hasLoop(loop)) throw new OwnerCommandRefusedError(`No loop named "${loop}" on this agent.`, 404, "loop_not_found");
+  let runtime2 = loop === MAIN_LOOP ? null : host2.loopPool.getRuntime(loop), executor = loop === MAIN_LOOP ? host2.executor : runtime2?.executor, handler = loop === MAIN_LOOP ? host2.adfCallHandler : runtime2?.callHandler, workspace = loop === MAIN_LOOP ? host2.workspace : runtime2?.workspace;
+  if (!executor || !workspace) throw new OwnerCommandRefusedError(`Loop "${loop}" is not running (it is disabled or stopping). Enable it, then run the command again.`, 409, "loop_not_running");
+  if (executor.getState() === "stopped") throw new OwnerCommandRefusedError(`Agent is off. Start it, then run /${req.name} again.`, 409, "agent_not_running");
+  let sandbox = host2.codeSandboxService;
+  if (!sandbox || !handler) throw new OwnerCommandRefusedError("This runtime has no code sandbox, so agent commands cannot run here.", 409, "code_execution_unavailable");
+  let config = host2.workspace.getAgentConfig(), command = Array.isArray(config.commands) ? config.commands.find((c) => c && typeof c == "object" && c.name === req.name) : void 0;
+  if (!command) throw new OwnerCommandRefusedError(`No command "/${req.name}" on this agent. Add it under Commands in the agent's config.`, 404, "command_not_found");
+  let lambda = typeof command.lambda == "string" ? command.lambda : JSON.stringify(command.lambda) ?? "undefined", started = performance.now(), status = "error", authorized = !1, body;
+  try {
+    let ref = parseLambdaRef(lambda);
+    if ("error" in ref) throw new Error(ref.error);
+    let { file, fn } = ref, source = await loadLambdaSource((p) => workspace.readFile(p), file);
+    if (source === null) throw new Error(`Lambda file "${file}" not found. Fix commands[].lambda for /${req.name} or create the file.`);
+    authorized = req.authorize === !0 || workspace.isFileAuthorized(file);
+    let args2 = splitArgv(req.args).join(" "), invocation = { command: req.name, args: args2, argv: splitArgv(args2), invoker: "owner", loop, authorized, id }, missing = `Function "${fn}" not found in "${file}". Declare it at the top level, or fix commands[].lambda for /${req.name}.`, wrapped = `${transformExports(transformImports(source))}
+if (typeof ${fn} === 'function') { return await ${fn}(${JSON.stringify(invocation)}); }
+throw new Error(${JSON.stringify(missing)});`, sandboxId = `${config.id}:cmd:${file}:${id}:${nanoid(10)}`, payload = { lambda_path: file, function_name: fn, kind: "owner_command", command: req.name, loop, authorized };
+    emitUmbilicalEvent({ event_type: "lambda.started", agentId: config.id, source: `lambda:${file}:${fn}`, payload });
+    try {
+      let run2 = () => sandbox.execute(
+        sandboxId,
+        wrapped,
+        config.limits.execution_timeout_ms,
+        (method, callArgs) => withAuthorization(authorized, () => handler.handleCall(method, callArgs)),
+        { enabledTools: handler.getEnabledToolNames(), hilTools: handler.getHilToolNames(), isAuthorized: authorized },
+        { handlerAuthorized: authorized, agent: config.id, ephemeral: !0 }
+      ), result = await withSource(`lambda:${file}:${fn}`, config.id, () => withLoop(loop, run2));
+      status = result.error ? ["REQUIRES_AUTHORIZED_CODE", "REQUIRES_AUTHORIZED_CALLER", "PROTECTION_DENIED"].includes(result.errorCode ?? "") ? "denied" : "error" : "ok", body = result.error ?? result.result ?? "(no return value)", result.stdout && (body += `
+
+Output:
+${result.stdout}`), emitUmbilicalEvent({ event_type: result.error ? "lambda.failed" : "lambda.completed", agentId: config.id, source: `lambda:${file}:${fn}`, payload: { ...payload, duration_ms: performance.now() - started, ...result.error ? { error: result.error } : {} } });
+    } catch (error) {
+      throw emitUmbilicalEvent({ event_type: "lambda.failed", agentId: config.id, source: `lambda:${file}:${fn}`, payload: { ...payload, duration_ms: performance.now() - started, error: error instanceof Error ? error.message : String(error) } }), error;
+    } finally {
+      sandbox.destroy(sandboxId);
+    }
+  } catch (error) {
+    body = error instanceof Error ? error.message : String(error);
+  }
+  let durationMs = +(performance.now() - started).toFixed(2);
+  body = executor.boundToolResult(body, "/" + req.name);
+  let args = splitArgv(req.args).join(" "), record = executor.recordOwnerCommand(formatOwnerCommandRow({ v: 1, id, command: "/" + req.name + (args ? " " + args : ""), lambda, authorized, status, duration_ms: durationMs }, body));
+  try {
+    workspace.insertLog(status === "ok" ? "info" : "error", "command", "run", "/" + req.name, `${status} (${durationMs}ms)`, { status, duration_ms: durationMs, authorized, loop });
+  } catch {
+  }
+  return { id, name: req.name, loop, status, authorized, result: body, durationMs, ...record };
+}
+
 // src/main/runtime/interrupt-turn.ts
 var InterruptRefusedError = class extends Error {
   constructor(message, statusCode) {
@@ -84802,7 +85125,7 @@ function mcpServersWithSealedCredentials(workspace) {
     return [];
   }
 }
-var DUPLICATE_AGENT_ID_CODE = "duplicate_agent_id", AGENT_NOT_RUNNING_CODE = "agent_not_running", DOCUMENT_HOLDER_FORMAT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, DOCUMENT_HOLD_TTL_MS = 6e4, RuntimeLoopError = class extends Error {
+var DUPLICATE_AGENT_ID_CODE = "duplicate_agent_id", AGENT_NOT_RUNNING_CODE = "agent_not_running", DOCUMENT_HOLDER_FORMAT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, DOCUMENT_HOLD_TTL_MS = 6e4, KILL_STOPPED_AUTOSTART = "A Kill stopped this autostart. Start the agent again.", RuntimeLoopError = class extends Error {
   /** `details`: extra fields for the HTTP error body (e.g. `candidates`). */
   constructor(message, statusCode, code, details) {
     super(message);
@@ -84873,6 +85196,7 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
     super(), this.settings = opts.settings, this.providerFactory = opts.providerFactory, this.basePrompt = opts.basePrompt ?? "", this.toolPrompts = opts.toolPrompts ?? {}, this.compactionPrompt = opts.compactionPrompt, this.agentRuntimeBuilder = opts.agentRuntimeBuilder, this.enforceReviewGate = opts.enforceReviewGate ?? !0, this.agentLeases = opts.agentLeases === void 0 ? processAgentLeases() : opts.agentLeases, this.documentHoldTtlMs = opts.documentHoldTtlMs ?? DOCUMENT_HOLD_TTL_MS, this.agentLeases?.addHostedPathsProbe(() => [...this.filePathToAgentId.keys(), ...this.inFlightLoads.keys()]);
   }
   async loadAgent(filePath, opts = {}) {
+    if (RuntimeGate.killing) throw new RuntimeLoopError(KILL_IN_PROGRESS_ERROR, 409, "kill_in_progress");
     let canonicalPath = this.canonicalFilePath(filePath), existingId = this.filePathToAgentId.get(canonicalPath);
     if (existingId) return this.toRef(this.requireAgent(existingId));
     let pending = this.inFlightLoads.get(canonicalPath);
@@ -84885,6 +85209,24 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
       this.inFlightLoads.delete(canonicalPath), await this.agentLeases?.reconcile();
     }
   }
+  /**
+   * Waits for the loads in flight to finish (or fail), so a Kill can unload
+   * what they registered. Answers the files still loading after `timeoutMs`:
+   * a stuck load never holds up the rest of the Kill.
+   */
+  async settleLoads(timeoutMs = 1e4) {
+    let timer, timedOut = new Promise((resolve20) => {
+      timer = setTimeout(resolve20, timeoutMs);
+    }), settled = (async () => {
+      for (; this.inFlightLoads.size > 0; ) await Promise.allSettled([...this.inFlightLoads.values()]);
+    })();
+    try {
+      await Promise.race([settled, timedOut]);
+    } finally {
+      clearTimeout(timer);
+    }
+    return [...this.inFlightLoads.keys()];
+  }
   /**
    * Resolves true once a load of `filePath` in flight has finished (or
    * failed), at once when none is; false when it is still loading after
@@ -85350,6 +85692,7 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
    * active-state greeting, as Studio's foreground start does.
    */
   async startAgent(agentId, opts = {}) {
+    if (RuntimeGate.killing) throw new RuntimeLoopError(KILL_IN_PROGRESS_ERROR, 409, "kill_in_progress");
     RuntimeGate.resume();
     let managed = this.requireAgent(agentId), lifecycle = managed.agent.getLifecycleState();
     if (lifecycle !== "running")
@@ -85368,15 +85711,21 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
     if (raced.status === "rejected") throw raced.err;
     return raced.status === "resolved" ? raced.dispatched : !0;
   }
+  /**
+   * `killEpoch`: RuntimeGate.killEpoch when the caller's start began (before
+   * its own awaits); a Kill since then refuses the start.
+   */
   async startOrLoadAgent(identifier, opts = {}) {
-    let managed = this.resolveAgent(identifier), loaded = !1;
+    let killEpoch = opts.killEpoch ?? RuntimeGate.killEpoch, managed = this.resolveAgent(identifier), loaded = !1;
     if (!managed) {
       let filePath = this.documents.resolve(identifier)?.filePath ?? this.findAgentFile(identifier);
       if (!filePath) throw new Error(`RuntimeService: unknown agent "${identifier}"`);
       let ref = await this.loadAgent(filePath);
       managed = this.requireAgent(ref.id), loaded = !0;
     }
-    let startupTriggered = await this.startAgent(managed.id, opts);
+    if (RuntimeGate.killedSince(killEpoch))
+      throw loaded && await this.unloadAgent(managed.id, { mode: "immediate" }), new RuntimeLoopError(KILL_IN_PROGRESS_ERROR, 409, "kill_in_progress");
+    let startupTriggered = await this.startAgent(managed.id, { hasUserMessage: opts.hasUserMessage });
     return {
       ref: this.toRef(managed),
       loaded,
@@ -85423,7 +85772,16 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
       throw err instanceof InterruptRefusedError ? new RuntimeLoopError(err.message, err.statusCode) : err;
     }
   }
+  async runAgentCommand(agentId, name15, body) {
+    let managed = this.requireAgent(agentId);
+    try {
+      return await runOwnerCommand(managed.agent, { ...body, name: name15, args: body.args ?? "", authorize: body.authorize === !0 });
+    } catch (err) {
+      throw err instanceof OwnerCommandRefusedError ? new RuntimeLoopError(err.message, err.statusCode, err.code) : err;
+    }
+  }
   async autostartFromDirectories(trackedDirs2, opts = {}) {
+    let killEpoch = RuntimeGate.killEpoch;
     RuntimeGate.resume();
     let files = await this.scanAdfFilesAsync(trackedDirs2, opts.maxDepth ?? 5), report = {
       scanned: files.length,
@@ -85454,7 +85812,11 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
       if (!isConfigReviewed(this.settings?.get("reviewedAgents"), bootResult.config))
         return { kind: "skipped", entry: { filePath, name: name15, reason: "unreviewed", agentId: boot.agentId } };
       try {
-        let ref = await this.loadAgent(filePath, { enforceReviewGate: !1 }), startupTriggered = await this.startAgent(ref.id);
+        if (RuntimeGate.killedSince(killEpoch)) throw new RuntimeLoopError(KILL_STOPPED_AUTOSTART, 409, "kill_in_progress");
+        let ref = await this.loadAgent(filePath, { enforceReviewGate: !1 });
+        if (RuntimeGate.killedSince(killEpoch))
+          throw await this.unloadAgent(ref.id, { mode: "immediate" }), new RuntimeLoopError(KILL_STOPPED_AUTOSTART, 409, "kill_in_progress");
+        let startupTriggered = await this.startAgent(ref.id);
         return { kind: "started", entry: { agentId: ref.id, filePath, name: ref.config.name, startupTriggered } };
       } catch (err) {
         return err instanceof RuntimeReviewRequiredError ? { kind: "skipped", entry: { filePath, name: name15, reason: "unreviewed", agentId: err.agentId } } : err instanceof RuntimeLoopError && err.code === AGENT_LEASED_CODE ? (console.warn(`[RuntimeService] Autostart skipped: ${err.message}`), { kind: "skipped", entry: { filePath, name: name15, reason: "leased_elsewhere", agentId: boot.agentId, message: err.message } }) : {
@@ -85994,7 +86356,7 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
       effectiveTools: null
     }, side = (config.loops ?? []).map((loop) => ({
       name: loop.name,
-      goal: loop.goal,
+      goal: loop.goal ?? "",
       status: "idle",
       enabled: loop.enabled !== !1,
       isMain: !1,
@@ -86011,7 +86373,7 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
     if (pool.hasLoop(input.name)) throw new RuntimeLoopError(`A loop named "${input.name}" already exists.`, 409);
     let host2 = managed.agent.workspace.getAgentConfig(), available = new Set(listAvailableLoopTools(host2)), candidate = {
       name: input.name,
-      goal: input.goal,
+      ...input.goal !== void 0 ? { goal: input.goal } : {},
       enabled: input.enabled ?? !0,
       autostart: input.autostart ?? !0,
       ...input.autonomous !== void 0 ? { autonomous: input.autonomous } : {},
@@ -86128,7 +86490,9 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
     let target = this.requireTarget(agentId);
     if (this.assertBaseRevision("config", configRevision(target.workspace), opts.baseRevision, null), !target.managed) {
       let doc = target.doc;
-      stripLoopNameMarker(config), doc.workspace.setAgentConfig(config), doc.config = config, doc.configWrites++;
+      stripLoopNameMarker(config);
+      let previousConfig2 = doc.workspace.getAgentConfig();
+      doc.workspace.setAgentConfig(config), await teardownRemovedLoopsOffline(doc.workspace, previousConfig2, config), doc.config = config, doc.configWrites++;
       let revision2 = configRevision(doc.workspace, currentResourceWriter()).revision, rename2 = this.syncAgentFileToName(doc.filePath, config.name);
       return {
         agentId: target.id,
@@ -87127,6 +87491,7 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
   registerAgent(agent, filePath, config, idOverride, keyCell = { current: null }) {
     if (RuntimeGate.tearingDown)
       throw new Error("RuntimeService: runtime teardown in progress \u2014 agent not registered.");
+    if (RuntimeGate.killing) throw new RuntimeLoopError(KILL_IN_PROGRESS_ERROR, 409, "kill_in_progress");
     let id = idOverride ?? config.id;
     this.assertNoDuplicateId(id, filePath);
     let managed = {
@@ -87505,6 +87870,7 @@ var LOOP_PATCH_FIELDS = ["goal", "enabled", "autostart", "autonomous", "model",
     let base = this.settings?.get("globalSystemPrompt"), tools = this.settings?.get("toolPrompts"), compaction = this.settings?.get("compactionPrompt");
     return {
       basePrompt: typeof base == "string" ? base : this.basePrompt,
+      ...this.settings ? { basePromptSource: () => this.settings?.get("globalSystemPrompt") } : {},
       toolPrompts: tools && typeof tools == "object" && !Array.isArray(tools) ? tools : this.toolPrompts,
       compactionPrompt: typeof compaction == "string" ? compaction : this.compactionPrompt
     };
@@ -109134,6 +109500,70 @@ data: {"cursor":13,"kind":"executor","agentId":"\u2026","filePath":"/agents/agen
           }
         ]
       }
+    },
+    "/agents/{id}/commands/{name}/run": {
+      post: {
+        tags: [
+          "Loops"
+        ],
+        summary: "Run an owner slash command",
+        description: "Runs a registered lambda without a model turn and records its bounded outcome in the selected loop. Requires a running agent; never starts it. Error and denied outcomes are recorded and return 200. The authorize boolean elevates only this invocation; chat text is never interpreted as a command.",
+        operationId: "runAgentCommand",
+        parameters: [
+          {
+            $ref: "#/components/parameters/AgentIdPath"
+          },
+          {
+            name: "name",
+            in: "path",
+            required: !0,
+            description: "Registered command name without the slash.",
+            schema: {
+              type: "string"
+            }
+          }
+        ],
+        requestBody: {
+          required: !1,
+          content: {
+            "application/json": {
+              schema: {
+                $ref: "#/components/schemas/OwnerCommandBody"
+              }
+            }
+          }
+        },
+        responses: {
+          "400": {
+            $ref: "#/components/responses/BadRequest"
+          },
+          "401": {
+            $ref: "#/components/responses/Unauthorized"
+          },
+          "403": {
+            $ref: "#/components/responses/Forbidden"
+          },
+          "404": {
+            $ref: "#/components/responses/NotFound"
+          },
+          "409": {
+            $ref: "#/components/responses/Conflict"
+          },
+          "500": {
+            $ref: "#/components/responses/ServerError"
+          },
+          "200": {
+            description: "Recorded command outcome",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/OwnerCommandResult"
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   components: {
@@ -110949,8 +111379,27 @@ data: {"cursor":13,"kind":"executor","agentId":"\u2026","filePath":"/agents/agen
                 additionalProperties: {
                   type: "object",
                   properties: {
-                    support: { type: "object", properties: { image: { type: "boolean" }, audio: { type: "boolean" }, video: { type: "boolean" } } },
-                    refusals: { type: "object", additionalProperties: { type: "string" }, description: "Why each modality not in support is refused, keyed image, audio or video." }
+                    support: {
+                      type: "object",
+                      properties: {
+                        image: {
+                          type: "boolean"
+                        },
+                        audio: {
+                          type: "boolean"
+                        },
+                        video: {
+                          type: "boolean"
+                        }
+                      }
+                    },
+                    refusals: {
+                      type: "object",
+                      additionalProperties: {
+                        type: "string"
+                      },
+                      description: "Why each modality not in support is refused, keyed image, audio or video."
+                    }
                   }
                 },
                 description: "GET /agents/{id}/status of a running agent: each loop's effective media (main and live inner loops, keyed by loop name): what its provider connector carries, narrowed by the agent's model.multimodal toggles. POST /agents/{id}/chat refuses the rest with 400 media_unsupported."
@@ -123623,6 +124072,79 @@ data: {"cursor":13,"kind":"executor","agentId":"\u2026","filePath":"/agents/agen
             }
           }
         ]
+      },
+      OwnerCommandBody: {
+        type: "object",
+        properties: {
+          args: {
+            type: "string",
+            maxLength: 4096,
+            pattern: "^[^\\n]*$",
+            default: ""
+          },
+          loop: {
+            type: "string",
+            default: "main"
+          },
+          authorize: {
+            type: "boolean",
+            default: !1,
+            description: "Owner grant for this invocation only. Paired devices may grant it."
+          },
+          requestId: {
+            type: "string",
+            pattern: "^[A-Za-z0-9_-]{1,64}$"
+          }
+        }
+      },
+      OwnerCommandResult: {
+        type: "object",
+        required: [
+          "id",
+          "name",
+          "loop",
+          "status",
+          "authorized",
+          "result",
+          "durationMs",
+          "deferred"
+        ],
+        properties: {
+          id: {
+            type: "string"
+          },
+          name: {
+            type: "string"
+          },
+          loop: {
+            type: "string"
+          },
+          status: {
+            type: "string",
+            enum: [
+              "ok",
+              "error",
+              "denied"
+            ]
+          },
+          authorized: {
+            type: "boolean"
+          },
+          result: {
+            type: "string",
+            description: "Bounded output exactly as recorded in the loop."
+          },
+          durationMs: {
+            type: "number"
+          },
+          deferred: {
+            type: "boolean",
+            description: "The record waits for the current step to finish."
+          },
+          seq: {
+            type: "integer"
+          }
+        }
       }
     }
   }
@@ -126198,6 +126720,18 @@ function rotateDaemonEncKey(settingsDir) {
   return { key: ensureDaemonEncKey(settingsDir), retiredLabel: current.label };
 }
 
+// src/main/services/secret-storage-policy.ts
+var SECRET_STORAGE_POLICY_KEY = "secretStoragePolicy";
+var SETTINGS_SECRET_KEYS = ["ownerMnemonic", "runtimePrivateKey", "runtimeEncPrivateKey", "mcpOauthCredentials"], SUPERSEDED_MNEMONIC_PREFIX = "ownerMnemonicSuperseded:";
+function isSecretSettingsKey(key) {
+  return SETTINGS_SECRET_KEYS.includes(key) || key.startsWith(SUPERSEDED_MNEMONIC_PREFIX);
+}
+var SecretStorageRefusedError = class extends Error {
+  constructor(message) {
+    super(message), this.name = "SecretStorageRefusedError";
+  }
+};
+
 // src/main/services/owner-identity.service.ts
 var OWNER_SEED_DERIVED_KEY = "ownerDidSeedDerived";
 function ownerMnemonicSupersededKey(ownerDid) {
@@ -126294,6 +126828,11 @@ var OwnerIdentityService = class {
     }
     return this.settings.setSecret("ownerMnemonic", phrase), currentOwnerDid || (this.settings.set("ownerDid", owner.did), this.settings.set("ownerSeedBackupConfirmed", !1)), this.markSeedDerived(), console.log(opts.replacingStale ? `[OwnerIdentity] The owner is now ${owner.did} (switched outside this app, e.g. adf identity import): replaced this install's phrase of the previous owner with the one in the OS keychain` : `[OwnerIdentity] Imported owner phrase for ${owner.did} from the OS keychain`), phrase;
   }
+  /** Throws when secrets cannot be saved right now (Studio's secret-storage choice), before any write. */
+  assertSecretsWritable() {
+    let refusal = this.settings.secretWriteRefusal?.() ?? null;
+    if (refusal) throw new SecretStorageRefusedError(refusal);
+  }
   // =========================================================================
   // Identity bootstrap + migration
   // =========================================================================
@@ -126343,6 +126882,7 @@ var OwnerIdentityService = class {
         runtimeDid: this.settings.get("runtimeDid") ?? "",
         migrated: !1
       };
+    this.assertSecretsWritable();
     let isUpgrade = !!existingOwnerDid;
     if (isUpgrade) {
       let legacyOwner = this.settings.get("legacyOwnerDids") ?? [];
@@ -126419,11 +126959,23 @@ var OwnerIdentityService = class {
     let runtimeDid = this.getRuntimeDid();
     if (!runtimeDid || keyStatus === "absent") return this.mintRuntimeKey(ownerKey, ownerDid);
     let delegation = this.getRuntimeDelegation();
-    return (!delegation || delegation.issuer !== ownerDid || !verifyAttestation(delegation, { expectedSubject: runtimeDid })) && this.settings.set("runtimeDelegation", createAttestation(
+    return (!delegation || delegation.v !== 2 || delegation.issuer !== ownerDid || !verifyAttestation(delegation, { expectedSubject: runtimeDid })) && this.settings.set("runtimeDelegation", createAttestation(
       { issuer: ownerDid, subject: runtimeDid, role: "runtime", issued_at: (/* @__PURE__ */ new Date()).toISOString() },
       ownerKey
     )), runtimeDid;
   }
+  /** Own v1 attestations in the file re-signed as v2 (attestation.service.ts). Logged, never thrown. */
+  upgradeAttestations(workspace) {
+    try {
+      let upgraded = upgradeOwnAttestations(workspace, [
+        { did: this.getOwnerDid(), privateKey: this.getOwnerSigningKey() },
+        { did: this.getRuntimeDid(), privateKey: this.getRuntimeSigningKey() }
+      ], PROVISION_BUSY_TIMEOUT_MS);
+      upgraded > 0 && console.log(`[OwnerIdentity] Re-signed ${upgraded} attestation(s) as v2 in ${workspace.getFilePath()}`);
+    } catch (err) {
+      console.warn("[OwnerIdentity] Attestation v2 upgrade failed:", err);
+    }
+  }
   /** Record that `ownerDid` is seed-derived (idempotent; no write when already set). */
   markSeedDerived() {
     this.settings.get(OWNER_SEED_DERIVED_KEY) !== !0 && this.settings.set(OWNER_SEED_DERIVED_KEY, !0);
@@ -126532,7 +127084,7 @@ var OwnerIdentityService = class {
     let currentOwnerDid = this.getOwnerDid(), owner = deriveOwnerIdentity(normalized);
     if (opts.expectedOwnerDid && owner.did !== opts.expectedOwnerDid)
       throw new Error(`That phrase belongs to ${owner.did}, not this machine's owner ${opts.expectedOwnerDid}. Check the words, or use Import identity to switch owners.`);
-    if (currentOwnerDid && currentOwnerDid !== owner.did) {
+    if (this.assertSecretsWritable(), currentOwnerDid && currentOwnerDid !== owner.did) {
       let legacy = this.settings.get("legacyOwnerDids") ?? [];
       legacy.includes(currentOwnerDid) || this.settings.set("legacyOwnerDids", [...legacy, currentOwnerDid]);
     }
@@ -126694,7 +127246,7 @@ var OwnerIdentityService = class {
       }, signingRow = workspace.getIdentityRow("crypto:signing:private_key");
       signingRow === null ? (workspace.generateIdentityKeys(null, opts.adoptKeys), keysGenerated = !0, stampAndAttest()) : signingRow.encryption_algo === "plain" && workspace.getDid() && !workspace.getMeta("adf_owner_did") && this.getOwnerSigningKey() && stampAndAttest();
       let sealed = workspace.sealPlainRowsIntoEnvelopes();
-      return { keysGenerated, sealed };
+      return this.upgradeAttestations(workspace), { keysGenerated, sealed };
     };
     if (!(!workspace.hasEnvelopes() && this.getEnvelopeRecipients() !== null || workspace.getIdentityRow("crypto:signing:private_key") === null)) return provision();
     try {
@@ -126986,7 +127538,7 @@ function normalizeDelegation(raw) {
     if (!isNonEmptyString(d[field])) return null;
   for (let field of ["expires_at", "scope"])
     if (d[field] !== void 0 && typeof d[field] != "string") return null;
-  return {
+  return d.v === 2 ? d : {
     issuer: d.issuer,
     subject: d.subject,
     role: d.role,
@@ -127813,22 +128365,45 @@ var TEST_KEYCHAIN_FILE_ENV = "ADF_TEST_KEYCHAIN_FILE", TestKeychainFileBackend =
 function blockingSleep(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+var SecretStoreSelectionError = class extends Error {
+  constructor(message) {
+    super(message), this.name = "SecretStoreSelectionError";
+  }
+}, STRICT_KEYCHAIN_REMEDY = `The daemon does not start, and it does not open the passphrase file ${SECRET_FILE_NAME}. Make the OS keychain usable and start the daemon again, or set ADF_SECRET_STORE=file (or unset it) to use the passphrase file.`;
 function selectBackend(settingsPath2, deps = {}) {
-  let forced = process.env.ADF_SECRET_STORE, file = () => new FileSecretBackend(join33(dirname17(settingsPath2), SECRET_FILE_NAME));
+  let forced = process.env.ADF_SECRET_STORE || void 0;
+  if (forced !== void 0 && forced !== "file" && forced !== "keychain")
+    throw new SecretStoreSelectionError('ADF_SECRET_STORE has an unsupported value. Set it to "keychain" or "file", or unset it to let the daemon choose.');
+  let strict = forced === "keychain", file = () => new FileSecretBackend(join33(dirname17(settingsPath2), SECRET_FILE_NAME));
   if (forced === "file") return { backend: file(), keychainError: null };
-  if (process.env.ADF_KEYCHAIN === "0" || process.env.ADF_KEYCHAIN === "off") return { backend: file(), keychainError: null };
+  let keychainOff = process.env.ADF_KEYCHAIN;
+  if (keychainOff === "0" || keychainOff === "off") {
+    if (strict)
+      throw new SecretStoreSelectionError(
+        `ADF_SECRET_STORE=keychain conflicts with ADF_KEYCHAIN=${keychainOff}, which turns the OS keychain off. Unset ADF_KEYCHAIN to use the keychain, or set ADF_SECRET_STORE=file (or unset it) to use the passphrase file.`
+      );
+    return { backend: file(), keychainError: null };
+  }
   let fakePath = process.env[TEST_KEYCHAIN_FILE_ENV];
-  if (fakePath)
-    return testSeamsAllowed() ? (console.warn(`[ADF Daemon] Test seam: ${fakePath} stands in for the OS keychain (ADF_TEST_SEAMS=1)`), { backend: new TestKeychainFileBackend(fakePath), keychainError: null }) : (console.error(`[ADF Daemon] Ignoring ${TEST_KEYCHAIN_FILE_ENV}: test seams need ADF_TEST_SEAMS=1 and an unpackaged build. Using the passphrase file, not the OS keychain.`), { backend: file(), keychainError: null });
-  let probe = deps.probe ?? probeKeychain, sleep = deps.sleep ?? blockingSleep, platform3 = deps.platform ?? process.platform, result = probe(), expected = result.present && (platform3 === "win32" || platform3 === "darwin");
+  if (fakePath) {
+    if (testSeamsAllowed())
+      return console.warn(`[ADF Daemon] Test seam: ${fakePath} stands in for the OS keychain (ADF_TEST_SEAMS=1)`), { backend: new TestKeychainFileBackend(fakePath), keychainError: null };
+    if (strict) throw new SecretStoreSelectionError(`ADF_SECRET_STORE=keychain, but ${TEST_KEYCHAIN_FILE_ENV} is set without the test seams (ADF_TEST_SEAMS=1 and an unpackaged build). ${STRICT_KEYCHAIN_REMEDY}`);
+    return console.error(`[ADF Daemon] Ignoring ${TEST_KEYCHAIN_FILE_ENV}: test seams need ADF_TEST_SEAMS=1 and an unpackaged build. Using the passphrase file, not the OS keychain.`), { backend: file(), keychainError: null };
+  }
+  let probe = deps.probe ?? probeKeychain, sleep = deps.sleep ?? blockingSleep, platform3 = deps.platform ?? process.platform, result = probe(), tries = 1, expected = result.present && (platform3 === "win32" || platform3 === "darwin");
   for (let i = 0; !result.backend && expected && i < KEYCHAIN_PROBE_DELAYS_MS.length; i++)
-    console.warn(`[ADF Daemon] The OS keychain did not answer (${result.error ?? "unknown error"}); trying again in ${KEYCHAIN_PROBE_DELAYS_MS[i] / 1e3}s`), sleep(KEYCHAIN_PROBE_DELAYS_MS[i]), result = probe();
+    console.warn(`[ADF Daemon] The OS keychain did not answer (${result.error ?? "unknown error"}); trying again in ${KEYCHAIN_PROBE_DELAYS_MS[i] / 1e3}s`), sleep(KEYCHAIN_PROBE_DELAYS_MS[i]), result = probe(), tries++;
   if (result.backend) return { backend: result.backend, keychainError: null };
+  if (strict) {
+    let why = result.present ? `the OS keychain could not be read${tries > 1 ? ` after ${tries} tries` : ""} (${result.error ?? "unknown error"})` : "no OS keychain binding (@napi-rs/keyring) loads in this build";
+    throw new SecretStoreSelectionError(`ADF_SECRET_STORE=keychain, but ${why}. ${STRICT_KEYCHAIN_REMEDY}`);
+  }
   if (expected) {
     let error = result.error ?? "unknown error";
     return console.error(`[ADF Daemon] The OS keychain could not be read after ${KEYCHAIN_PROBE_DELAYS_MS.length + 1} tries (${error}): using the passphrase file ${SECRET_FILE_NAME}. Owner create, restore and trust-daemon are refused until the daemon restarts with the keychain (adf daemon restart).`), { backend: file(), keychainError: error };
   }
-  return forced === "keychain" && console.error("[ADF Daemon] ADF_SECRET_STORE=keychain but no OS keychain is usable \u2014 using the passphrase file instead"), { backend: file(), keychainError: null };
+  return { backend: file(), keychainError: null };
 }
 function readBootPassphrase(readFile3) {
   if (process.env.ADF_OWNER_PASSPHRASE) return process.env.ADF_OWNER_PASSPHRASE;
@@ -128007,7 +128582,7 @@ var ProviderChecks = class {
   cache = /* @__PURE__ */ new Map();
   /** A check the host starts on its own: honours the opt-out (see file header). */
   async autoCheck(cfg) {
-    return this.opts.isEnabled() ? this.test(cfg) : this.cache.get(providerTestCacheKey(cfg)) ?? "unchecked";
+    return !this.opts.isEnabled() && !isSubscriptionType(cfg.type) ? this.cache.get(providerTestCacheKey(cfg)) ?? "unchecked" : this.test(cfg);
   }
   async test(cfg, force = !1) {
     let cacheKey = providerTestCacheKey(cfg);
@@ -128017,15 +128592,15 @@ var ProviderChecks = class {
     let finish = (result) => (this.cache.set(cacheKey, result), result);
     if (cfg.type === "chatgpt-subscription") {
       let { getChatGptAuthManager: getChatGptAuthManager2 } = await import("./auth-manager-AJ32FZWS.mjs");
-      return finish(getChatGptAuthManager2().isAuthenticated() ? "ok" : "unconfigured");
+      return getChatGptAuthManager2().isAuthenticated() ? "ok" : "unconfigured";
     }
     if (cfg.type === "grok-subscription") {
       let { getGrokAuthManager: getGrokAuthManager2 } = await import("./auth-manager-C5OBEQK2.mjs");
-      return finish(getGrokAuthManager2().isAuthenticated() ? "ok" : "unconfigured");
+      return getGrokAuthManager2().isAuthenticated() ? "ok" : "unconfigured";
     }
     if (cfg.type === "claude-subscription") {
       let { getClaudeAuthManager: getClaudeAuthManager2 } = await import("./auth-manager-TBNKCJ45.mjs");
-      return finish(await getClaudeAuthManager2().isAuthenticated() ? "ok" : "unconfigured");
+      return await getClaudeAuthManager2().isAuthenticated() ? "ok" : "unconfigured";
     }
     if (cfg.type === "anthropic") {
       if (!cfg.apiKey) return finish("unconfigured");
@@ -128067,6 +128642,14 @@ var ProviderChecks = class {
 import { constants as fsConstants3, createReadStream, createWriteStream as createWriteStream2, existsSync as existsSync19 } from "node:fs";
 import { copyFile, link, lstat as lstat3, mkdir as mkdir2, mkdtemp as mkdtemp2, open as open2, readdir as readdir7, readFile as readFile2, realpath as realpath4, rename, rmdir, stat as stat5, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { execFile as execFile11 } from "node:child_process";
+
+// src/main/utils/agents-folder-name.ts
+function defaultAgentsFolderName(env = process.env) {
+  let instance3 = env.ADF_INSTANCE?.trim().replace(/[^\w.-]/g, "_");
+  return instance3 ? `adf-agents-${instance3}` : "adf-agents";
+}
+
+// src/main/daemon/file-ops.ts
 import { homedir as homedir5, tmpdir as tmpdir8 } from "node:os";
 import { basename as basename14, delimiter as delimiter2, dirname as dirname19, isAbsolute as isAbsolute6, join as join36, resolve as resolve15 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
@@ -129612,10 +130195,10 @@ async function findDocumentsDir() {
   return fallback;
 }
 async function resolveAgentsFolder(settings2) {
-  return configuredAgentsFolder(settings2) ?? { path: join36(await documentsDir(), "adf-agents"), source: "default" };
+  return configuredAgentsFolder(settings2) ?? { path: join36(await documentsDir(), defaultAgentsFolderName()), source: "default" };
 }
 function resolveAgentsFolderSync(settings2) {
-  return configuredAgentsFolder(settings2) ?? { path: join36(documentsDirSync(), "adf-agents"), source: "default" };
+  return configuredAgentsFolder(settings2) ?? { path: join36(documentsDirSync(), defaultAgentsFolderName()), source: "default" };
 }
 function configuredAgentsFolder(settings2) {
   let configured = settings2?.get("agentsFolder");
@@ -133478,6 +134061,14 @@ function registerFleetRoutes(server, ctx) {
     let success = await manager.restart(type);
     return { success, error: success ? void 0 : `Could not restart the ${type} channel.` };
   }), server.get("/network/peers/health", async (request) => probePeerHealth(request.query.url)), server.get("/network/peers/shared-file", async (request) => fetchPeerSharedFile(request.query.baseUrl, request.query.path)), server.post("/runtime/emergency-stop", async () => {
+    let releaseKill = RuntimeGate.beginKill();
+    try {
+      return await emergencyStop();
+    } finally {
+      releaseKill();
+    }
+  });
+  let emergencyStop = async () => {
     console.log("[EmergencyStop] Shutting down everything...");
     let deps = gapDeps(ctx), skipped = [], failed = [], step = async (name15, run2) => {
       try {
@@ -133486,12 +134077,21 @@ function registerFleetRoutes(server, ctx) {
         failed.push(name15), console.error(`[EmergencyStop] ${name15} error:`, e);
       }
     };
-    RuntimeGate.stop(), await step("mesh", () => {
+    await step("mesh", () => {
       mesh?.isEnabled() && (mesh.disableMesh ? mesh.disableMesh() : skipped.push("mesh"));
     });
-    let agents = runtime2.listAgents();
-    await Promise.all(agents.map((agent) => step(`agent ${agent.id}`, () => runtime2.unloadAgent(agent.id, { mode: "immediate" }))));
-    let stoppedAgents = agents.length - failed.filter((name15) => name15.startsWith("agent ")).length;
+    let listedAgents = 0;
+    for (let pass = 0; pass < 2; pass++) {
+      if (pass > 0) {
+        let loading = await runtime2.settleLoads();
+        loading.length > 0 && failed.push(...loading.map((filePath) => `still loading: ${filePath}`));
+      }
+      let agents = runtime2.listAgents();
+      listedAgents += agents.length, await Promise.all(agents.map((agent) => step(`agent ${agent.id}`, () => runtime2.unloadAgent(agent.id, { mode: "immediate" }))));
+    }
+    let left = runtime2.listAgents();
+    left.length > 0 && failed.push(...left.map((agent) => `still loaded: ${agent.id}`));
+    let stoppedAgents = listedAgents - failed.filter((name15) => name15.startsWith("agent ")).length;
     if (await step("ws connections", () => options.wsService?.stopAll?.()), await step("mesh server", async () => {
       deps.meshServer ? await deps.meshServer.stop() : skipped.push("mesh server");
     }), await step("child processes", () => killAllTracked()), await step("host execs", () => killAllHostExecs()), await step("sandbox workers", () => {
@@ -133512,7 +134112,7 @@ function registerFleetRoutes(server, ctx) {
       ...skipped.length ? { skipped } : {},
       ...failed.length ? { failed } : {}
     };
-  });
+  };
 }
 
 // src/main/daemon/routes/dashboard-routes.ts
@@ -134181,7 +134781,7 @@ function registerRegistryRoutes(server, ctx) {
   }), server.post("/registry/agents/:id/bring-home", async (request) => {
     let id = request.params.id, factory12 = ctx.options.agentFactory, result = await bringRegistryAgentHome(() => agentRegistry().resolveFile(id), {
       agentsFolder: () => {
-        let configured = settings2?.get("agentsFolder"), folder = factory12?.defaultDirectory() ?? (typeof configured == "string" && configured.trim() ? resolve17(configured.trim()) : join43(homedir7(), "Documents", "adf-agents"));
+        let configured = settings2?.get("agentsFolder"), folder = factory12?.defaultDirectory() ?? (typeof configured == "string" && configured.trim() ? resolve17(configured.trim()) : join43(homedir7(), "Documents", defaultAgentsFolderName()));
         return mkdirSync17(folder, { recursive: !0 }), folder;
       },
       providers: settings2?.get("providers") ?? [],
@@ -137641,12 +138241,10 @@ var BASE_REVISION_INVALID = "baseRevision (or If-Match) must be a revision numbe
 function getOpenApiSpec() {
   return openapi_default;
 }
-var SETTINGS_SECRET_KEYS = ["ownerMnemonic", "runtimePrivateKey", "runtimeEncPrivateKey", "mcpOauthCredentials"], SUPERSEDED_MNEMONIC_PREFIX = "ownerMnemonicSuperseded:";
-function isSecretSettingsKey(key) {
-  return SETTINGS_SECRET_KEYS.includes(key) || key.startsWith(SUPERSEDED_MNEMONIC_PREFIX);
-}
 var SETTINGS_WRITE_DENY_KEYS = [
   ...SETTINGS_SECRET_KEYS,
+  // How Studio stores those secrets: the user's own choice in Studio, never set over HTTP.
+  SECRET_STORAGE_POLICY_KEY,
   "trustedDaemonEncKeys",
   // Owner/runtime identity: changed only through /identity (daemon) or Studio.
   "ownerDid",
@@ -138818,13 +139416,13 @@ function createDaemonHttpApi(runtime2, opts = {}) {
     }
   }), server.post("/agents/:id/start", async (request, reply) => {
     try {
-      let preflight = request.query?.preflight === "1" || request.query?.preflight === "true", hasUserMessage = request.query?.hasUserMessage === "1" || request.query?.hasUserMessage === "true", credentialsLocked;
+      let killEpoch = RuntimeGate.killEpoch, preflight = request.query?.preflight === "1" || request.query?.preflight === "true", hasUserMessage = request.query?.hasUserMessage === "1" || request.query?.hasUserMessage === "true", credentialsLocked;
       if (preflight && !runtime2.getAgent(request.params.id)) {
         let check = await runtime2.preflightProvider(request.params.id);
         if (!check.ok) return reply.code(409).send({ error: check.error, code: check.code ?? "provider_check_failed" });
         credentialsLocked = check.credentialsLocked;
       }
-      let result = await runtime2.startOrLoadAgent(request.params.id, { hasUserMessage });
+      let result = await runtime2.startOrLoadAgent(request.params.id, { hasUserMessage, killEpoch });
       return {
         success: !0,
         loaded: result.loaded,
@@ -138867,6 +139465,18 @@ function createDaemonHttpApi(runtime2, opts = {}) {
     } catch (err) {
       return handleRuntimeError(reply, err);
     }
+  }), server.post("/agents/:id/commands/:name/run", async (request, reply) => {
+    let { id, name: name15 } = request.params;
+    if (!runtime2.getAgentOrDocument(id)) return notFound3(reply, `Unknown agent "${id}"`);
+    if (!runtime2.getAgent(id)) return notRunning(reply, id);
+    let body = request.body;
+    if (body !== void 0 && (!isRecord4(body) || body.args !== void 0 && typeof body.args != "string" || body.loop !== void 0 && typeof body.loop != "string" || body.authorize !== void 0 && typeof body.authorize != "boolean" || body.requestId !== void 0 && typeof body.requestId != "string"))
+      return reply.code(400).send({ error: "Command body must contain string args, loop and requestId, and a boolean authorize.", code: "invalid_request" });
+    try {
+      return await runtime2.runAgentCommand(id, name15, body ?? {});
+    } catch (err) {
+      return handleRuntimeError(reply, err);
+    }
   }), server.post("/agents/:id/compact", async (request, reply) => {
     if (!runtime2.getAgentOrDocument(request.params.id)) return notFound3(reply, `Unknown agent "${request.params.id}"`);
     try {
@@ -139117,7 +139727,7 @@ async function listProviderModels(runtime2, settingsStore, providerId, agentId,
     return { provider: providerId, models: await listGrokSubscriptionModels(getGrokAuthManager()) };
   }
   if (cfg.type === "claude-subscription") {
-    let { listClaudeSubscriptionModels } = await import("./claude-subscription-33BMZB6I.mjs");
+    let { listClaudeSubscriptionModels } = await import("./claude-subscription-EB4LAAVV.mjs");
     return { provider: providerId, models: await listClaudeSubscriptionModels() };
   }
   if (cfg.type === "anthropic") {
@@ -140088,6 +140698,8 @@ var CLIENT_SETTINGS_KEYS = [
   // Owner and runtime identity (§5). Key material never crosses HTTP
   // (SETTINGS_SECRET_KEYS, SETTINGS_WRITE_DENY_KEYS in daemon/http-api.ts).
   "ownerMnemonic",
+  // How Studio stores the secrets above (src/main/services/secret-storage-policy.ts).
+  "secretStoragePolicy",
   "ownerDid",
   "ownerDidSeedDerived",
   "ownerEncPublicKey",
@@ -141039,7 +141651,7 @@ process.on("uncaughtException", (err) => {
 process.on("unhandledRejection", (reason) => {
   console.error("[ADF Daemon] Unhandled rejection:", reason instanceof Error ? reason.stack : reason);
 });
-var port = Number(process.env.ADF_DAEMON_PORT ?? 7385), host = process.env.ADF_DAEMON_HOST ?? "127.0.0.1", pidFile = process.env.ADF_DAEMON_PIDFILE, settingsPath = process.env.ADF_DAEMON_SETTINGS ?? defaultSettingsPath(), daemonVersion = "0.8.0", startedBy = takeLaunchEnv();
+var port = Number(process.env.ADF_DAEMON_PORT ?? 7385), host = process.env.ADF_DAEMON_HOST ?? "127.0.0.1", pidFile = process.env.ADF_DAEMON_PIDFILE, settingsPath = process.env.ADF_DAEMON_SETTINGS ?? defaultSettingsPath(), daemonVersion = "0.8.1", startedBy = takeLaunchEnv();
 console.log(`[ADF Daemon] Version ${daemonVersion} (pid ${process.pid}, started by ${startedBy})`);
 var settings = new FileSettingsStore(settingsPath);
 processAgentLeases().configure({ kind: "daemon", settingsPath, version: daemonVersion });
@@ -141068,12 +141680,18 @@ if (behindProxy) {
   } catch (err) {
     noteLocalProofProblem(`the local proof file could not be written or protected: ${err instanceof Error ? err.message : String(err)}`), console.error("[ADF Daemon] Could not write or protect the local proof file; owner import (adf identity import) and the stored-value reveal routes stay unavailable:", err instanceof Error ? err.message : err);
   }
-var ownerIdentity = new DaemonIdentity({
-  settings,
-  settingsPath,
-  encKey: daemonEncKey,
-  bootPassphrase: readBootPassphrase((path) => readFileSync14(path, "utf-8"))
-});
+var ownerIdentity;
+try {
+  ownerIdentity = new DaemonIdentity({
+    settings,
+    settingsPath,
+    encKey: daemonEncKey,
+    bootPassphrase: readBootPassphrase((path) => readFileSync14(path, "utf-8"))
+  });
+} catch (err) {
+  if (!(err instanceof SecretStoreSelectionError)) throw err;
+  console.error(`[ADF Daemon] Owner secret store: ${err.message}`), process.exit(1);
+}
 settings.setProviderKeyVault(ownerIdentity.providerKeys);
 {
   let initial = ownerIdentity.refresh();