@agentproto/cli 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/index.mjs

@@ -1,15 +1,25 @@
-import { spawn } from 'child_process';
-import { createHash } from 'crypto';
-import { mkdtemp, writeFile, chmod, rm, mkdir, readFile } from 'fs/promises';
+import { execFile, spawn } from 'child_process';
+import { createHash, randomUUID, randomBytes } from 'crypto';
+import { mkdtemp, writeFile, chmod, rm, mkdir, readFile, readdir, stat } from 'fs/promises';
 import { tmpdir, userInfo, hostname, homedir, platform } from 'os';
-import { resolve, join, dirname } from 'path';
-import { parseArgs } from 'util';
-import { promises } from 'fs';
+import { resolve, join, dirname, isAbsolute, normalize, relative, basename } from 'path';
+import { promisify, parseArgs } from 'util';
+import { promises, existsSync } from 'fs';
 import { createInterface } from 'readline/promises';
 import { stdout, stdin } from 'process';
 import { createAgentCliRuntime } from '@agentproto/driver-agent-cli';
 import { wrapWebSocket, createTunnelServer } from '@agentproto/acp/tunnel';
-import { createGateway } from '@agentproto/runtime';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import matter from 'gray-matter';
+import { EventEmitter } from 'events';
+import { createServer } from 'http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
 import WebSocket from 'ws';
 
 /**
@@ -92,8 +102,8 @@ async function collectAgentprotoNamespaceRoots(start) {
   for (let depth = 0; depth < 16; depth++) {
     for (const candidate of candidatesAt(cur)) {
       try {
-        const stat = await promises.stat(candidate);
-        if (stat.isDirectory()) roots.push(candidate);
+        const stat2 = await promises.stat(candidate);
+        if (stat2.isDirectory()) roots.push(candidate);
       } catch {
       }
     }
@@ -249,10 +259,10 @@ async function runExternalStep(step, ledger, head) {
 `);
   const opener = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
   const args = platform() === "win32" ? ["/c", "start", step.url] : [step.url];
-  await new Promise((resolve) => {
+  await new Promise((resolve3) => {
     const child = spawn(opener, args, { stdio: "ignore", detached: true });
-    child.once("error", () => resolve());
-    child.once("spawn", () => resolve());
+    child.once("error", () => resolve3());
+    child.once("spawn", () => resolve3());
   });
   let value = "";
   if (step.callback?.param) {
@@ -325,7 +335,7 @@ async function promptString(question, opts) {
     process.stdin.setRawMode?.(true);
     let buf = "";
     process.stdout.write(prompt);
-    return new Promise((resolve) => {
+    return new Promise((resolve3) => {
       const onData = (chunk) => {
         for (const code of chunk) {
           if (code === 13 || code === 10) {
@@ -333,7 +343,7 @@ async function promptString(question, opts) {
             process.stdin.setRawMode?.(false);
             process.stdout.write("\n");
             rl.close();
-            resolve(buf || opts.defaultValue || "");
+            resolve3(buf || opts.defaultValue || "");
             return;
           }
           if (code === 3) {
@@ -415,7 +425,7 @@ async function resolveSelectOptions(options) {
   });
 }
 async function runShellCapturing(cmd, opts) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const child = spawn("bash", ["-lc", cmd], {
       stdio: opts.interactive ? "inherit" : ["ignore", "pipe", "pipe"]
     });
@@ -433,11 +443,11 @@ async function runShellCapturing(cmd, opts) {
     }, opts.timeoutMs);
     child.once("error", () => {
       clearTimeout(timer);
-      resolve({ exitCode: 127, stdout, stderr: stderr || "spawn error" });
+      resolve3({ exitCode: 127, stdout, stderr: stderr || "spawn error" });
     });
     child.once("exit", (code) => {
       clearTimeout(timer);
-      resolve({ exitCode: code ?? 0, stdout, stderr });
+      resolve3({ exitCode: code ?? 0, stdout, stderr });
     });
   });
 }
@@ -796,15 +806,15 @@ function homedir2() {
   return process.env["HOME"] ?? process.env["USERPROFILE"] ?? "/";
 }
 function spawnInherit(cmd, argv) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn(cmd, argv, { stdio: "inherit" });
     child.once("error", reject);
-    child.once("exit", (code) => resolve(code ?? 0));
+    child.once("exit", (code) => resolve3(code ?? 0));
   });
 }
 async function runVersionCheck(check) {
   if (!check) return { ok: false, message: "no version_check declared" };
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const child = spawn("bash", ["-lc", check.cmd], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -812,19 +822,19 @@ async function runVersionCheck(check) {
     child.stdout.on("data", (c) => {
       buf += c.toString("utf8");
     });
-    child.once("error", () => resolve({ ok: false, message: "check failed" }));
+    child.once("error", () => resolve3({ ok: false, message: "check failed" }));
     child.once("exit", (code) => {
       if (code !== 0) {
-        resolve({ ok: false, message: `check exited ${code}` });
+        resolve3({ ok: false, message: `check exited ${code}` });
         return;
       }
       const re = new RegExp(check.parse);
       const m = buf.match(re);
       if (!m || !m[1]) {
-        resolve({ ok: false, message: "could not parse version" });
+        resolve3({ ok: false, message: "could not parse version" });
         return;
       }
-      resolve({ ok: true, message: `version ${m[1]}` });
+      resolve3({ ok: true, message: `version ${m[1]}` });
     });
   });
 }
@@ -836,8 +846,8 @@ async function readStdinIfPiped() {
   for await (const chunk of process.stdin) {
     chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
   }
-  const text = Buffer.concat(chunks).toString("utf8").trim();
-  return text.length > 0 ? text : null;
+  const text3 = Buffer.concat(chunks).toString("utf8").trim();
+  return text3.length > 0 ? text3 : null;
 }
 
 // src/commands/run.ts
@@ -1008,6 +1018,3664 @@ function formatRelative(ms) {
   if (ms < 864e5) return `${Math.round(ms / 36e5)}h`;
   return `${Math.round(ms / 864e5)}d`;
 }
+
+// ../define-doctype/dist/index.mjs
+var DEFAULT_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{1,79}$/;
+var MAX_DESCRIPTION_LEN = 2e3;
+function createDoctype(opts) {
+  const idPattern = opts.idPattern ?? DEFAULT_ID_PATTERN;
+  const readIdentity = opts.readIdentity ?? ((def) => def.id);
+  const readDescription = opts.readDescription === false ? null : opts.readDescription ?? ((def) => def.description);
+  const maxLen = opts.maxDescriptionLen ?? MAX_DESCRIPTION_LEN;
+  const prefix = `define${capitalize(opts.name)}`;
+  const aipTag = `(AIP-${opts.aip})`;
+  return function constructDoctype(def) {
+    const identity = readIdentity(def);
+    if (typeof identity !== "string" || !idPattern.test(identity)) {
+      throw new Error(
+        `${prefix} ${aipTag}: invalid id '${String(
+          identity
+        )}' \u2014 must match ${idPattern}`
+      );
+    }
+    if (readDescription) {
+      const description = readDescription(def);
+      if (typeof description !== "string" || description.length === 0 || description.length > maxLen) {
+        throw new Error(
+          `${prefix} ${aipTag}: id='${identity}' description must be 1\u2013${maxLen} chars`
+        );
+      }
+    }
+    opts.validate?.(def);
+    return Object.freeze(opts.build(def));
+  };
+}
+function capitalize(s) {
+  return s.length === 0 ? s : s.charAt(0).toUpperCase() + s.slice(1);
+}
+function filterSerializable(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value === "function") return void 0;
+  if (typeof value === "object" && value !== null && Object.prototype.hasOwnProperty.call(value, "_def") && "parse" in value && typeof value.parse === "function") {
+    return void 0;
+  }
+  if (Array.isArray(value)) {
+    return value.map(filterSerializable).filter((v) => v !== void 0);
+  }
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const filtered = filterSerializable(v);
+      if (filtered !== void 0) out[k] = filtered;
+    }
+    return out;
+  }
+  return value;
+}
+var DEFAULT_SKIP_DIRS = [
+  "node_modules",
+  ".git",
+  "dist",
+  ".next",
+  ".turbo"
+];
+function createVerbs(spec) {
+  const filename = spec.filename ?? `${spec.name.toUpperCase()}.md`;
+  const toFrontmatter = spec.toFrontmatter ?? ((params) => filterSerializable({
+    schema: spec.schemaLiteral,
+    ...params
+  }));
+  async function create(params, opts) {
+    const handle = spec.define(params);
+    const relativePath = spec.pathOf(handle);
+    const path = join(opts.dir, relativePath);
+    const frontmatter = toFrontmatter(params);
+    const rendered = matter.stringify(
+      opts.body ?? defaultBody(spec, frontmatter),
+      frontmatter
+    );
+    if (!opts.dryRun) {
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, rendered, "utf8");
+    }
+    return { path, handle, rendered };
+  }
+  async function load(path) {
+    const source = await readFile(path, "utf8");
+    const { frontmatter, body } = spec.parse(source);
+    const handle = spec.define(frontmatter);
+    return { path, handle, body };
+  }
+  async function list(dir, opts = {}) {
+    const skip = new Set(opts.skipDirs ?? DEFAULT_SKIP_DIRS);
+    const out = [];
+    async function walk(current) {
+      let entries;
+      try {
+        entries = await readdir(current, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const entry of entries) {
+        const entryName = String(entry.name);
+        if (entry.isDirectory()) {
+          if (skip.has(entryName)) continue;
+          await walk(join(current, entryName));
+          continue;
+        }
+        if (!entry.isFile()) continue;
+        if (entryName !== filename) continue;
+        try {
+          const { handle } = await load(join(current, entryName));
+          if (!opts.filter || opts.filter(handle)) out.push(handle);
+        } catch {
+        }
+      }
+    }
+    await walk(dir);
+    return out;
+  }
+  async function update(path, mutator, opts = {}) {
+    const { handle, body } = await load(path);
+    const source = await readFile(path, "utf8");
+    const { frontmatter } = spec.parse(source);
+    const params = frontmatter;
+    const mutated = await mutator(params, { handle, body });
+    const newHandle = spec.define(mutated);
+    const newFrontmatter = toFrontmatter(mutated);
+    const rendered = matter.stringify(
+      opts.body ?? body,
+      newFrontmatter
+    );
+    if (!opts.dryRun) {
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, rendered, "utf8");
+    }
+    return { path, handle: newHandle, rendered };
+  }
+  async function resolve22(block, ctx = {}) {
+    if ("inline" in block) {
+      return spec.define(block.inline);
+    }
+    if ("file" in block) {
+      const baseDir = ctx.baseDir ?? ".";
+      const path = isAbsolute(block.file) ? block.file : join(baseDir, block.file);
+      const { handle } = await load(path);
+      return handle;
+    }
+    if ("ref" in block) {
+      if (!ctx.resolveRef) {
+        throw new Error(
+          `${spec.name}.resolve (AIP-${spec.aip}): block has \`ref: '${block.ref}'\` but no resolveRef provided in context \u2014 registries must inject their own resolver`
+        );
+      }
+      const resolved = await ctx.resolveRef(block.ref);
+      return spec.define(resolved);
+    }
+    throw new Error(
+      `${spec.name}.resolve (AIP-${spec.aip}): block must have one of inline | ref | file`
+    );
+  }
+  async function deleteFn(path) {
+    await rm(path, { force: true });
+  }
+  return { create, load, list, update, resolve: resolve22, delete: deleteFn };
+}
+function defaultBody(spec, frontmatter) {
+  const id = typeof frontmatter.name === "string" ? frontmatter.name : typeof frontmatter.id === "string" ? frontmatter.id : typeof frontmatter.slug === "string" ? frontmatter.slug : spec.name;
+  return `# ${id}
+`;
+}
+var extensionFrontmatterSchema = z.object({ "schema": z.literal("agentproto/extension/v1").describe("Pins the spec version this manifest conforms to."), "slug": z.string().regex(new RegExp("^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*[a-z0-9]$")).describe("Namespaced identifier \u2014 `<namespace>:<name>`. Lowercase, digits, dashes; single colon separator. Example: `acme:deal`."), "title": z.string().min(1).max(80).describe("Human-readable display name."), "description": z.string().min(1).max(2e3).describe("One-paragraph statement of the extension's purpose."), "version": z.string().regex(new RegExp("^\\d+\\.\\d+\\.\\d+(?:[-+][a-zA-Z0-9.-]+)?$")).describe("Extension's own semver. Bump on breaking change."), "status": z.literal("Local").describe("Extensions are perpetually Local \u2014 they never enter the public registry's Draft/Review/Final lifecycle."), "extends": z.union([z.string().regex(new RegExp("^aip-\\d+$")).describe("Inherit a public AIP's schema (e.g. `aip-14`)."), z.literal("none").describe("Brand-new doctype, no inheritance.")]).describe("Parent AIP this extension inherits from, or `none` for a root doctype."), "add_fields": z.object({ "properties": z.record(z.string(), z.any()).describe("JSON Schema property definitions to merge into the parent's properties. Collisions are an error \u2014 use `tighten` to narrow an existing field.").optional(), "required": z.array(z.string()).refine((arr) => arr.every((item, i) => arr.indexOf(item) == i), { message: "All items must be unique!" }).describe("Field names that become required in addition to parent's required[]. Unioned with parent's required, never replaces.").default([]) }).strict().describe("Schema-level additions: new properties + new required entries.").optional(), "tighten": z.record(z.string(), z.object({ "pattern": z.string().optional(), "enum": z.array(z.any()).optional(), "minLength": z.number().int().gte(0).optional(), "maxLength": z.number().int().gte(0).optional(), "minimum": z.number().optional(), "maximum": z.number().optional() }).strict()).describe("Per-field constraint overrides. Each entry MUST tighten (not loosen) the parent's constraints; runtimes verify monotonicity at registration.").optional(), "defaults": z.record(z.string(), z.any()).describe("Default values applied when a field is omitted. Layered on top of parent's defaults; extension's value wins on the same key.").optional(), "path_convention": z.string().min(1).describe("Filesystem convention template, e.g. `\"deals/<slug>/DEAL.md\"`. Tokens: `<slug>` (doctype identity), `<DOCTYPE>` (extension's slug name part). Falls back to parent's convention when omitted.").optional(), "requires": z.array(z.number().int().gte(1)).refine((arr) => arr.every((item, i) => arr.indexOf(item) == i), { message: "All items must be unique!" }).describe("Public AIPs the extension depends on, in addition to its parent.").default([]), "metadata": z.record(z.string(), z.any()).describe("Free-form vendor extensions under namespaced keys (`metadata.<vendor>.<field>`).").default({}) }).strict().describe("Validates the YAML frontmatter portion of an AIP-40 EXTENSION.md manifest. An extension declares a workspace-local doctype that inherits a public AIP's schema and may add fields, tighten constraints, set defaults, and override the path convention.");
+createDoctype({
+  aip: 40,
+  name: "extension",
+  // Extension slugs are namespaced: `<namespace>:<name>` (e.g.
+  // `acme:deal`). Override the default kebab-only pattern.
+  idPattern: /^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*[a-z0-9]$/,
+  readIdentity: (def) => def.slug,
+  validate(def) {
+    const result = extensionFrontmatterSchema.safeParse(def);
+    if (!result.success) {
+      throw new Error(
+        `defineExtension (AIP-40): ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`
+      );
+    }
+  },
+  build(def) {
+    return { ...def };
+  }
+});
+function parseExtensionManifest(source) {
+  const parsed = matter(source);
+  if (Object.keys(parsed.data).length === 0) {
+    throw new Error("parseExtensionManifest: missing or empty frontmatter");
+  }
+  const result = extensionFrontmatterSchema.safeParse(parsed.data);
+  if (!result.success) {
+    throw new Error(
+      `parseExtensionManifest: invalid frontmatter \u2014 ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`
+    );
+  }
+  return { frontmatter: result.data, body: parsed.content };
+}
+
+// ../extension/dist/index.mjs
+function specFromExtension(extension, opts = {}) {
+  const { parent } = opts;
+  const isRoot = extension.extends === "none";
+  if (!isRoot && !parent) {
+    throw new Error(
+      `specFromExtension (AIP-40): extension '${extension.slug}' extends '${extension.extends}' but no parent spec was provided in opts.parent`
+    );
+  }
+  if (isRoot && !extension.path_convention) {
+    throw new Error(
+      `specFromExtension (AIP-40): extension '${extension.slug}' is a root doctype (extends: none) and MUST declare path_convention`
+    );
+  }
+  if (parent && extension.tighten) {
+    verifyTightening(extension);
+  }
+  const slugName = extension.slug.split(":")[1] ?? extension.slug;
+  const pathTemplate = extension.path_convention ?? null;
+  const extensionKeys = new Set(
+    Object.keys(extension.add_fields?.properties ?? {})
+  );
+  const define = (params) => {
+    const withDefaults = { ...params };
+    if (extension.defaults) {
+      for (const [key, value] of Object.entries(extension.defaults)) {
+        if (withDefaults[key] === void 0 && value !== void 0) {
+          withDefaults[key] = value;
+        }
+      }
+    }
+    if (isRoot) {
+      return Object.freeze(withDefaults);
+    }
+    const parentOnly = {};
+    const extensionOnly = {};
+    for (const [key, value] of Object.entries(withDefaults)) {
+      if (extensionKeys.has(key)) extensionOnly[key] = value;
+      else parentOnly[key] = value;
+    }
+    const parentHandle = parent.define(parentOnly);
+    return Object.freeze({
+      ...parentHandle,
+      ...extensionOnly
+    });
+  };
+  const parse = isRoot ? rootParse(extension) : parent.parse;
+  const pathOf = (handle) => {
+    if (pathTemplate) {
+      return resolvePathTemplate(
+        pathTemplate,
+        handle,
+        slugName
+      );
+    }
+    return parent.pathOf(handle);
+  };
+  return {
+    name: extension.slug,
+    aip: 40,
+    schemaLiteral: parent?.schemaLiteral ?? `agentproto/extension/v1`,
+    pathOf,
+    define,
+    parse
+  };
+}
+function verifyTightening(extension, parent) {
+  const t = extension.tighten ?? {};
+  for (const [field, override] of Object.entries(t)) {
+    if (typeof override.minLength === "number" && typeof override.maxLength === "number" && override.minLength > override.maxLength) {
+      throw new Error(
+        `specFromExtension (AIP-40): extension '${extension.slug}' tighten.${field}: minLength (${override.minLength}) > maxLength (${override.maxLength})`
+      );
+    }
+    if (typeof override.minimum === "number" && typeof override.maximum === "number" && override.minimum > override.maximum) {
+      throw new Error(
+        `specFromExtension (AIP-40): extension '${extension.slug}' tighten.${field}: minimum (${override.minimum}) > maximum (${override.maximum})`
+      );
+    }
+    if (override.enum !== void 0 && !Array.isArray(override.enum)) {
+      throw new Error(
+        `specFromExtension (AIP-40): extension '${extension.slug}' tighten.${field}: enum must be an array`
+      );
+    }
+  }
+}
+function rootParse(extension) {
+  return (source) => {
+    throw new Error(
+      `specFromExtension (AIP-40): extension '${extension.slug}' is a root doctype \u2014 supply your own parser or extend a public AIP for parser inheritance`
+    );
+  };
+}
+function resolvePathTemplate(template, handle, doctypeSlug) {
+  const identity = typeof handle.id === "string" && handle.id || typeof handle.slug === "string" && handle.slug || typeof handle.name === "string" && handle.name || "unknown";
+  return template.replace(/<slug>/g, identity).replace(/<DOCTYPE>/g, doctypeSlug.toUpperCase());
+}
+
+// ../mcp-server/dist/index.mjs
+async function createMcpServer(opts) {
+  const server = new McpServer({
+    name: opts.name ?? "agentproto-mcp-server",
+    version: opts.version ?? "0.1.0-alpha"
+  });
+  const allSpecs = [...opts.specs];
+  if (opts.workspace) {
+    const extensions = await loadExtensions(opts.workspace, opts.specs);
+    allSpecs.push(...extensions);
+  }
+  const anchor = (p) => isAbsolute(p) || !opts.workspace ? p : join(opts.workspace, p);
+  for (const spec of allSpecs) {
+    registerVerbs(server, spec, anchor);
+  }
+  return {
+    server,
+    registered: allSpecs.map((s) => s.name)
+  };
+}
+function registerVerbs(server, spec, anchor) {
+  const verbs = createVerbs(spec);
+  const verbName = (verb) => `${verb}_${spec.name.replace(/[-:]/g, "_")}`;
+  const description = (verb, body) => `${verb} the AIP-${spec.aip} ${spec.name} doctype. ${body}`;
+  server.tool(
+    verbName("create"),
+    description(
+      "create",
+      "Author a new manifest from params. Returns { path, rendered }."
+    ),
+    {
+      params: z.record(z.string(), z.unknown()).describe(`The ${spec.name} definition fields.`),
+      dir: z.string().describe("Workspace-relative or absolute target directory."),
+      body: z.string().optional().describe("Markdown body after the frontmatter. Defaults to a stub."),
+      dryRun: z.boolean().optional().describe("Render only \u2014 don't write to disk.")
+    },
+    async ({ params, dir, body, dryRun }) => {
+      const result = await verbs.create(params, {
+        dir: anchor(dir),
+        body,
+        dryRun
+      });
+      return contentText({
+        path: result.path,
+        rendered: result.rendered
+      });
+    }
+  );
+  server.tool(
+    verbName("load"),
+    description("load", "Read a manifest from disk. Returns the parsed handle."),
+    {
+      path: z.string().describe("Absolute or workspace-relative path to the .md file.")
+    },
+    async ({ path }) => {
+      const result = await verbs.load(anchor(path));
+      return contentText({ path: result.path, handle: result.handle });
+    }
+  );
+  server.tool(
+    verbName("list"),
+    description(
+      "list",
+      "Walk a directory tree and return all manifests of this doctype."
+    ),
+    {
+      dir: z.string().describe("Directory to walk."),
+      skipDirs: z.array(z.string()).optional().describe("Subdir names to skip (default: node_modules, .git, dist).")
+    },
+    async ({ dir, skipDirs }) => {
+      const handles = await verbs.list(anchor(dir), { skipDirs });
+      return contentText({ count: handles.length, handles });
+    }
+  );
+  server.tool(
+    verbName("update"),
+    description(
+      "update",
+      "Patch an existing manifest. The patch is shallow-merged into the existing params."
+    ),
+    {
+      path: z.string().describe("Path to the manifest to update."),
+      patch: z.record(z.string(), z.unknown()).describe("Partial fields to merge into the existing manifest."),
+      body: z.string().optional().describe("New body markdown (default: keep existing).")
+    },
+    async ({ path, patch, body }) => {
+      const result = await verbs.update(
+        anchor(path),
+        (existing) => ({ ...existing, ...patch }),
+        { body }
+      );
+      return contentText({ path: result.path, rendered: result.rendered });
+    }
+  );
+  server.tool(
+    verbName("resolve"),
+    description(
+      "resolve",
+      "Resolve an inline | ref | file block to a fully-typed handle."
+    ),
+    {
+      block: z.union([
+        z.object({ inline: z.record(z.string(), z.unknown()) }),
+        z.object({ ref: z.string() }),
+        z.object({ file: z.string() })
+      ]).describe("The composition block."),
+      baseDir: z.string().optional().describe("Base dir for `file:` references.")
+    },
+    async ({ block, baseDir }) => {
+      const handle = await verbs.resolve(block, {
+        baseDir: baseDir ? anchor(baseDir) : void 0
+      });
+      return contentText({ handle });
+    }
+  );
+  server.tool(
+    verbName("delete"),
+    description("delete", "Remove a manifest file from disk."),
+    {
+      path: z.string().describe("Path to the manifest to delete.")
+    },
+    async ({ path }) => {
+      const target = anchor(path);
+      await verbs.delete(target);
+      return contentText({ deleted: target });
+    }
+  );
+}
+async function loadExtensions(workspace, specs) {
+  const extDir = resolve(workspace, "extensions");
+  if (!existsSync(extDir)) return [];
+  const out = [];
+  const { readdir: readdir3 } = await import('fs/promises');
+  let entries;
+  try {
+    entries = await readdir3(extDir, {
+      withFileTypes: true
+    });
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const manifestPath = join(extDir, String(entry.name), "EXTENSION.md");
+    if (!existsSync(manifestPath)) continue;
+    const source = await readFile(manifestPath, "utf8");
+    const parsed = parseExtensionManifest(source);
+    const ext = parsed.frontmatter;
+    let parent;
+    if (ext.extends && ext.extends !== "none") {
+      const aipMatch = ext.extends.match(/^aip-(\d+)$/);
+      if (!aipMatch) {
+        throw new Error(
+          `mcp-server: extension '${ext.slug}' has invalid extends '${ext.extends}'`
+        );
+      }
+      const parentAip = Number(aipMatch[1]);
+      parent = specs.find((s) => s.aip === parentAip);
+      if (!parent) {
+        throw new Error(
+          `mcp-server: extension '${ext.slug}' extends aip-${parentAip}, but no spec for that AIP was registered. Pass the parent spec in opts.specs.`
+        );
+      }
+    }
+    out.push(specFromExtension(ext, { parent }));
+  }
+  return out;
+}
+function contentText(payload) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(payload, null, 2)
+      }
+    ]
+  };
+}
+async function writeRuntimeMeta(workspace, meta) {
+  const dir = join(workspace, ".agentproto");
+  try {
+    await mkdir(dir, { recursive: true });
+    await writeFile(
+      join(dir, "runtime.json"),
+      JSON.stringify(meta, null, 2) + "\n",
+      "utf8"
+    );
+  } catch (err) {
+    console.error("[runtime] failed to write .agentproto/runtime.json:", err);
+  }
+}
+var DEFAULT_TIMEOUT_MS = 6e4;
+var MAX_TIMEOUT_MS = 6e5;
+var ALLOWLIST_REL = ".agentproto/allowed-commands.json";
+var allowlistCache = null;
+async function loadAllowlist(workspace) {
+  const path = resolve(workspace, ALLOWLIST_REL);
+  if (!existsSync(path)) {
+    allowlistCache = null;
+    return /* @__PURE__ */ new Set();
+  }
+  try {
+    const s = await stat(path);
+    if (allowlistCache && allowlistCache.path === path && allowlistCache.entry.mtimeMs === s.mtimeMs) {
+      return allowlistCache.entry.commands;
+    }
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw);
+    const list = Array.isArray(parsed.commands) ? parsed.commands : [];
+    const commands = new Set(
+      list.filter((x) => typeof x === "string" && x.length > 0).map((x) => x.trim())
+    );
+    allowlistCache = { path, entry: { mtimeMs: s.mtimeMs, commands } };
+    return commands;
+  } catch (err) {
+    console.error(
+      `[runtime] failed to load ${ALLOWLIST_REL} (will deny all):`,
+      err
+    );
+    allowlistCache = null;
+    return /* @__PURE__ */ new Set();
+  }
+}
+function makeCwdAnchor(workspace) {
+  const root = resolve(workspace);
+  return (input2) => {
+    if (!input2 || input2.length === 0) return root;
+    const candidate = isAbsolute(input2) ? normalize(input2) : normalize(join(root, input2));
+    const rel = relative(root, candidate);
+    if (rel.startsWith("..") || isAbsolute(rel)) {
+      throw new Error(
+        `cwd escapes the workspace: '${input2}' (workspace=${root})`
+      );
+    }
+    return candidate;
+  };
+}
+function registerCommandTools(server, opts) {
+  const anchorCwd = makeCwdAnchor(opts.workspace);
+  server.tool(
+    "execute_command",
+    "Run a shell command on the host running the runtime. The command basename must be in `<workspace>/.agentproto/allowed-commands.json`; default-deny otherwise. Captures stdout / stderr / exit code and returns them as JSON. Use this to drive local CLIs (Claude Code, gh, pnpm, \u2026) from a remote agent.",
+    {
+      command: z.string().min(1).describe(
+        "Executable name or absolute path. Must be allowlisted by basename in the workspace's allowed-commands.json."
+      ),
+      args: z.array(z.string()).optional().describe(
+        "Argv array. Passed verbatim \u2014 no shell expansion (we spawn with shell:false so quoting doesn't bite)."
+      ),
+      cwd: z.string().optional().describe(
+        "Working directory, workspace-relative or an absolute path inside the workspace. Defaults to the workspace root."
+      ),
+      stdin: z.string().optional().describe("Optional input piped to the process's stdin."),
+      timeoutMs: z.number().int().positive().max(MAX_TIMEOUT_MS).optional().describe(
+        `Hard kill after this many ms. Defaults to ${DEFAULT_TIMEOUT_MS}; capped at ${MAX_TIMEOUT_MS}.`
+      )
+    },
+    async ({ command, args, cwd, stdin, timeoutMs }) => {
+      const allowlist = await loadAllowlist(opts.workspace);
+      const baseName = basename(command);
+      if (!allowlist.has(baseName)) {
+        const allowed = [...allowlist].sort().join(", ") || "(empty)";
+        throw new Error(
+          `command '${baseName}' is not in the allowlist. Add it to ${join(opts.workspace, ALLOWLIST_REL)} under "commands": [...]. Currently allowed: ${allowed}.`
+        );
+      }
+      const resolvedCwd = anchorCwd(cwd);
+      const limit = Math.min(timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
+      const result = await runCommand({
+        command,
+        args: args ?? [],
+        cwd: resolvedCwd,
+        stdin,
+        timeoutMs: limit
+      });
+      return {
+        content: [{ type: "text", text: JSON.stringify(result) }]
+      };
+    }
+  );
+}
+var STREAM_BUFFER_CAP = 1048576;
+async function runCommand(input2) {
+  return new Promise((resolvePromise) => {
+    const startedAt = Date.now();
+    const child = spawn(input2.command, input2.args, {
+      cwd: input2.cwd,
+      shell: false,
+      // Inherit user env so PATH lookups for `claude`, `gh`, etc. work.
+      env: process.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let truncated = false;
+    let timedOut = false;
+    function appendCapped(buf, chunk) {
+      if (buf.length >= STREAM_BUFFER_CAP) {
+        truncated = true;
+        return buf;
+      }
+      const room = STREAM_BUFFER_CAP - buf.length;
+      const text3 = chunk.toString("utf8");
+      if (text3.length > room) {
+        truncated = true;
+        return buf + text3.slice(0, room);
+      }
+      return buf + text3;
+    }
+    child.stdout?.on("data", (d) => {
+      stdout = appendCapped(stdout, d);
+    });
+    child.stderr?.on("data", (d) => {
+      stderr = appendCapped(stderr, d);
+    });
+    if (input2.stdin) {
+      child.stdin?.write(input2.stdin);
+    }
+    child.stdin?.end();
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+      setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }, 2e3).unref();
+    }, input2.timeoutMs);
+    timer.unref();
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      resolvePromise({
+        exitCode: -1,
+        signal: null,
+        stdout,
+        stderr: stderr + (stderr ? "\n" : "") + err.message,
+        truncated,
+        durationMs: Date.now() - startedAt
+      });
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      resolvePromise({
+        exitCode: typeof code === "number" ? code : -1,
+        signal: signal ?? (timedOut ? "SIGTERM-timeout" : null),
+        stdout,
+        stderr,
+        truncated,
+        durationMs: Date.now() - startedAt
+      });
+    });
+  });
+}
+var FRONTMATTER_RE = /^---\n([\s\S]*?)\n---\n/;
+function fileConversationStore(opts) {
+  const dir = opts.dir ?? join(opts.workspace, "conversations");
+  const filePath = (id) => join(dir, `${id}.md`);
+  return {
+    pathFor: filePath,
+    async open(id, meta) {
+      await mkdir(dir, { recursive: true });
+      const path = filePath(id);
+      if (existsSync(path)) return;
+      const header = renderHeader({
+        id,
+        agent: meta.agent,
+        started: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "open"
+      });
+      await writeFile(path, header, "utf8");
+    },
+    async appendTurn(id, role, content, options) {
+      const path = filePath(id);
+      if (!existsSync(path)) {
+        await this.open(id, { agent: options?.attribution ?? "unknown" });
+      }
+      const block = renderTurn({
+        role,
+        at: options?.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+        attribution: options?.attribution,
+        content
+      });
+      await writeFile(path, block, { encoding: "utf8", flag: "a" });
+    },
+    async read(id) {
+      const path = filePath(id);
+      const source = await readFile(path, "utf8");
+      return parseConversation(source, id);
+    },
+    async list() {
+      if (!existsSync(dir)) return [];
+      const entries = await readdir(dir, { withFileTypes: true });
+      const out = [];
+      for (const entry of entries) {
+        if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+        const id = entry.name.slice(0, -3);
+        try {
+          const source = await readFile(join(dir, entry.name), "utf8");
+          const { meta } = parseConversation(source, id);
+          out.push({ id, meta });
+        } catch {
+        }
+      }
+      return out;
+    }
+  };
+}
+function renderHeader(meta) {
+  return [
+    "---",
+    `schema: conversation/v1`,
+    `id: ${meta.id}`,
+    `agent: ${meta.agent}`,
+    `started: ${meta.started}`,
+    `status: ${meta.status}`,
+    "---",
+    "",
+    ""
+  ].join("\n");
+}
+function renderTurn(turn) {
+  const heading = turn.attribution ? `## ${turn.role} \u2014 ${turn.at} (${turn.attribution})` : `## ${turn.role} \u2014 ${turn.at}`;
+  return `${heading}
+
+${turn.content.trimEnd()}
+
+`;
+}
+function parseConversation(source, fallbackId) {
+  const match = source.match(FRONTMATTER_RE);
+  let meta = {
+    id: fallbackId,
+    agent: "unknown",
+    started: "",
+    status: "open"
+  };
+  let body = source;
+  if (match) {
+    meta = parseFrontmatter(match[1] ?? "", fallbackId);
+    body = source.slice(match[0].length);
+  }
+  const turns = [];
+  const lines = body.split("\n");
+  let current = null;
+  let buffer = [];
+  const flush = () => {
+    if (!current) return;
+    current.content = buffer.join("\n").trim();
+    turns.push(current);
+    current = null;
+    buffer = [];
+  };
+  const headingRe = /^##\s+(user|assistant|system)\s+—\s+(\S+)(?:\s+\(([^)]+)\))?\s*$/;
+  for (const line of lines) {
+    const m = line.match(headingRe);
+    if (m) {
+      flush();
+      current = {
+        role: m[1],
+        at: m[2] ?? "",
+        attribution: m[3],
+        content: ""
+      };
+      continue;
+    }
+    if (current) buffer.push(line);
+  }
+  flush();
+  return { meta, turns };
+}
+function parseFrontmatter(raw, fallbackId) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    const colon = line.indexOf(":");
+    if (colon < 1) continue;
+    const key = line.slice(0, colon).trim();
+    const value = line.slice(colon + 1).trim();
+    out[key] = value;
+  }
+  return {
+    id: out.id ?? fallbackId,
+    agent: out.agent ?? "unknown",
+    started: out.started ?? "",
+    status: out.status === "closed" ? "closed" : "open"
+  };
+}
+function createRuntimeEvents() {
+  const ee = new EventEmitter();
+  ee.setMaxListeners(50);
+  return {
+    on(type, handler) {
+      const wrapped = (ev) => {
+        if (ev.type === type) handler(ev);
+      };
+      ee.on("event", wrapped);
+      return () => ee.off("event", wrapped);
+    },
+    onAny(handler) {
+      ee.on("event", handler);
+      return () => ee.off("event", handler);
+    },
+    emit(ev) {
+      ee.emit("event", ev);
+    }
+  };
+}
+var FsPathError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FsPathError";
+  }
+};
+function makeAnchor(workspace) {
+  const root = resolve(workspace);
+  return (input2) => {
+    if (typeof input2 !== "string" || input2.length === 0) {
+      throw new FsPathError("path must be a non-empty string");
+    }
+    const candidate = isAbsolute(input2) ? normalize(input2) : normalize(join(root, input2));
+    const rel = relative(root, candidate);
+    if (rel.startsWith("..") || isAbsolute(rel)) {
+      throw new FsPathError(`path escapes the workspace: '${input2}'`);
+    }
+    return candidate;
+  };
+}
+function text(value) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: typeof value === "string" ? value : JSON.stringify(value)
+      }
+    ]
+  };
+}
+function registerFsTools(server, opts) {
+  const anchor = makeAnchor(opts.workspace);
+  server.tool(
+    "read_file",
+    "Read a UTF-8 file from the workspace.",
+    { path: z.string().describe("Workspace-relative path to the file.") },
+    async ({ path }) => {
+      const abs = anchor(path);
+      const buf = await readFile(abs);
+      return text(buf.toString("utf8"));
+    }
+  );
+  server.tool(
+    "write_file",
+    "Write a file to the workspace. Parent directories are created on demand.",
+    {
+      path: z.string().describe("Workspace-relative path to the file."),
+      content: z.string().describe("File body (UTF-8).")
+    },
+    async ({ path, content }) => {
+      const abs = anchor(path);
+      await mkdir(dirname(abs), { recursive: true });
+      await writeFile(abs, content, "utf8");
+      return text("ok");
+    }
+  );
+  server.tool(
+    "list_directory",
+    "List entries of a directory in the workspace. Returns one '[FILE]' or '[DIR]' line per entry, mirroring `@modelcontextprotocol/server-filesystem`.",
+    {
+      path: z.string().optional().describe("Workspace-relative directory (defaults to workspace root).")
+    },
+    async ({ path }) => {
+      const abs = anchor(path && path.length > 0 ? path : ".");
+      const entries = await readdir(abs, { withFileTypes: true });
+      const lines = entries.map(
+        (e) => e.isDirectory() ? `[DIR]  ${e.name}` : `[FILE] ${e.name}`
+      );
+      return text(lines.join("\n"));
+    }
+  );
+  server.tool(
+    "get_file_info",
+    "Stat a file or directory in the workspace.",
+    { path: z.string().describe("Workspace-relative path.") },
+    async ({ path }) => {
+      const abs = anchor(path);
+      const info = await stat(abs);
+      return text({
+        name: abs.split("/").pop() ?? path,
+        path,
+        type: info.isDirectory() ? "directory" : "file",
+        size: info.size,
+        modified: info.mtime.toISOString(),
+        created: info.birthtime.toISOString()
+      });
+    }
+  );
+  server.tool(
+    "create_directory",
+    "Create a directory (recursive) in the workspace.",
+    { path: z.string().describe("Workspace-relative directory path.") },
+    async ({ path }) => {
+      const abs = anchor(path);
+      await mkdir(abs, { recursive: true });
+      return text("ok");
+    }
+  );
+  server.tool(
+    "delete_file",
+    "Delete a file or empty directory in the workspace.",
+    { path: z.string().describe("Workspace-relative path.") },
+    async ({ path }) => {
+      const abs = anchor(path);
+      await rm(abs, { recursive: true, force: true });
+      return text("ok");
+    }
+  );
+}
+var WORKSPACES_CONFIG_VERSION = 1;
+var DEFAULT_CONFIG_DIR = () => resolve(homedir(), ".agentproto");
+var DEFAULT_CONFIG_PATH = () => resolve(DEFAULT_CONFIG_DIR(), "workspaces.json");
+function sanitizeSlug(input2) {
+  const trimmed = input2.trim().toLowerCase();
+  const cleaned = trimmed.replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return cleaned || "workspace";
+}
+async function loadWorkspacesConfig(path = DEFAULT_CONFIG_PATH()) {
+  let raw;
+  try {
+    raw = await promises.readFile(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: WORKSPACES_CONFIG_VERSION, workspaces: [] };
+    }
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `agentproto: ${path} is not valid JSON (${err instanceof Error ? err.message : String(err)}). Delete the file or fix it manually.`
+    );
+  }
+  return normaliseConfig(parsed);
+}
+function findWorkspace(config, slug) {
+  return config.workspaces.find((w) => w.slug === sanitizeSlug(slug));
+}
+function getActiveWorkspace(config) {
+  if (!config.active) return config.workspaces[0];
+  return findWorkspace(config, config.active) ?? config.workspaces[0];
+}
+function normaliseConfig(parsed) {
+  if (!parsed || typeof parsed !== "object") {
+    return { version: WORKSPACES_CONFIG_VERSION, workspaces: [] };
+  }
+  const obj = parsed;
+  const workspaces = [];
+  if (Array.isArray(obj.workspaces)) {
+    for (const entry of obj.workspaces) {
+      if (!entry || typeof entry !== "object") continue;
+      const e = entry;
+      const slug = typeof e.slug === "string" ? sanitizeSlug(e.slug) : "";
+      const path = typeof e.path === "string" ? e.path : "";
+      if (!slug || !path) continue;
+      const addedAt = typeof e.addedAt === "string" ? e.addedAt : (/* @__PURE__ */ new Date()).toISOString();
+      const updatedAt = typeof e.updatedAt === "string" ? e.updatedAt : addedAt;
+      const we = { slug, path, addedAt, updatedAt };
+      if (typeof e.label === "string" && e.label.trim()) {
+        we.label = e.label.trim();
+      }
+      workspaces.push(we);
+    }
+  }
+  const dedup = /* @__PURE__ */ new Map();
+  for (const w of workspaces) dedup.set(w.slug, w);
+  const finalList = Array.from(dedup.values());
+  const active = typeof obj.active === "string" && finalList.some((w) => w.slug === obj.active) ? obj.active : finalList[0]?.slug;
+  const out = {
+    version: WORKSPACES_CONFIG_VERSION,
+    workspaces: finalList
+  };
+  if (active !== void 0) out.active = active;
+  return out;
+}
+async function discoverMcps(opts = {}) {
+  const home = opts.home ?? homedir();
+  const out = [];
+  const errors = [];
+  await Promise.all([
+    scanClaudeCode(home, out, errors),
+    scanCursor(home, out, errors),
+    scanGoose(home, out),
+    scanRegisteredWorkspaces(out, errors)
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  const dedup = [];
+  for (const m of out) {
+    const key = `${m.source}:${m.scope}:${m.name}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    dedup.push(m);
+  }
+  if (errors.length > 0) {
+    for (const e of errors) console.warn(`[mcp-discovery] ${e}`);
+  }
+  return dedup.sort((a, b) => {
+    if (a.source !== b.source) return a.source.localeCompare(b.source);
+    if (a.scope !== b.scope) return a.scope.localeCompare(b.scope);
+    return a.name.localeCompare(b.name);
+  });
+}
+async function scanClaudeCode(home, out, errors) {
+  const path = resolve(home, ".claude.json");
+  let raw;
+  try {
+    raw = await promises.readFile(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    errors.push(`claude-code: read ${path} \u2014 ${err.message}`);
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    errors.push(`claude-code: JSON parse ${path} \u2014 ${err.message}`);
+    return;
+  }
+  if (!parsed || typeof parsed !== "object") return;
+  const root = parsed;
+  const top = root.mcpServers;
+  if (top && typeof top === "object") {
+    pushMcpMap({
+      out,
+      source: "claude-code",
+      scope: "global",
+      map: top
+    });
+  }
+  const projects = root.projects;
+  if (projects && typeof projects === "object") {
+    for (const [projPath, proj] of Object.entries(
+      projects
+    )) {
+      if (!proj || typeof proj !== "object") continue;
+      const projMcps = proj.mcpServers;
+      if (!projMcps || typeof projMcps !== "object") continue;
+      pushMcpMap({
+        out,
+        source: "claude-code",
+        scope: `project:${projPath}`,
+        map: projMcps
+      });
+    }
+  }
+}
+async function scanCursor(home, out, errors) {
+  const path = resolve(home, ".cursor", "mcp.json");
+  let raw;
+  try {
+    raw = await promises.readFile(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    errors.push(`cursor: read ${path} \u2014 ${err.message}`);
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    errors.push(`cursor: JSON parse ${path} \u2014 ${err.message}`);
+    return;
+  }
+  if (!parsed || typeof parsed !== "object") return;
+  const root = parsed;
+  const map = root.mcpServers;
+  if (map && typeof map === "object") {
+    pushMcpMap({
+      out,
+      source: "cursor",
+      scope: "global",
+      map
+    });
+  }
+}
+async function scanGoose(home, out, errors) {
+  const path = resolve(home, ".config", "goose", "config.yaml");
+  try {
+    await promises.access(path);
+  } catch {
+    return;
+  }
+  out.push({
+    id: "goose:global:_detected",
+    source: "goose",
+    scope: "global",
+    name: "(goose config detected)",
+    type: "unknown",
+    parseNote: "Goose config found but YAML parsing is not yet implemented. Open ~/.config/goose/config.yaml to inspect MCP entries."
+  });
+}
+async function scanRegisteredWorkspaces(out, errors) {
+  let workspaces = [];
+  try {
+    const cfg = await loadWorkspacesConfig();
+    workspaces = cfg.workspaces;
+  } catch (err) {
+    errors.push(`workspaces: load failed \u2014 ${err.message}`);
+    return;
+  }
+  await Promise.all(
+    workspaces.map(async (ws) => {
+      const candidates = [
+        resolve(ws.path, ".mcp.json"),
+        resolve(ws.path, ".cursor", "mcp.json"),
+        resolve(ws.path, ".vscode", "mcp.json")
+      ];
+      for (const path of candidates) {
+        let raw;
+        try {
+          raw = await promises.readFile(path, "utf8");
+        } catch (err) {
+          if (err.code === "ENOENT") continue;
+          errors.push(
+            `workspace ${ws.slug}: read ${path} \u2014 ${err.message}`
+          );
+          continue;
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(raw);
+        } catch (err) {
+          errors.push(
+            `workspace ${ws.slug}: JSON parse ${path} \u2014 ${err.message}`
+          );
+          continue;
+        }
+        if (!parsed || typeof parsed !== "object") continue;
+        const map = parsed.mcpServers;
+        if (!map || typeof map !== "object") continue;
+        pushMcpMap({
+          out,
+          source: "workspace",
+          scope: `workspace:${ws.slug}`,
+          map
+        });
+      }
+    })
+  );
+}
+function pushMcpMap(args) {
+  for (const [name, raw] of Object.entries(args.map)) {
+    if (!raw || typeof raw !== "object") continue;
+    const entry = raw;
+    const id = `${args.source}:${args.scope}:${name}`;
+    const declared = typeof entry.type === "string" ? entry.type : null;
+    const url = typeof entry.url === "string" ? entry.url : void 0;
+    const command = typeof entry.command === "string" ? entry.command : void 0;
+    let type;
+    if (declared === "http" || declared === "sse" || declared === "stdio") {
+      type = declared;
+    } else if (url) {
+      type = "http";
+    } else if (command) {
+      type = "stdio";
+    } else {
+      type = "unknown";
+    }
+    const m = {
+      id,
+      source: args.source,
+      scope: args.scope,
+      name,
+      type
+    };
+    if (command !== void 0) m.command = command;
+    if (Array.isArray(entry.args)) {
+      m.args = entry.args.filter((a) => typeof a === "string");
+    }
+    if (entry.env && typeof entry.env === "object") {
+      m.env = stringifyValues(entry.env);
+    }
+    if (url !== void 0) m.url = url;
+    if (entry.headers && typeof entry.headers === "object") {
+      m.headers = stringifyValues(entry.headers);
+    }
+    if (type === "unknown") {
+      m.parseNote = "Entry has neither `command` nor `url` \u2014 couldn't classify transport.";
+    }
+    args.out.push(m);
+  }
+}
+function stringifyValues(raw) {
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (typeof v === "string") out[k] = v;
+    else if (v != null) out[k] = String(v);
+  }
+  return out;
+}
+var IMPORTED_MCPS_PATH = () => resolve(homedir(), ".agentproto", "imported-mcps.json");
+var IMPORTED_MCPS_VERSION = 1;
+var EMPTY = {
+  version: IMPORTED_MCPS_VERSION,
+  imports: []
+};
+async function loadImportedMcps(path = IMPORTED_MCPS_PATH()) {
+  let raw;
+  try {
+    raw = await promises.readFile(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return EMPTY;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `agentproto: ${path} is not valid JSON (${err instanceof Error ? err.message : String(err)}). Delete or fix manually.`
+    );
+  }
+  return normalise(parsed);
+}
+async function saveImportedMcps(config, path = IMPORTED_MCPS_PATH()) {
+  await promises.mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.tmp.${process.pid}`;
+  await promises.writeFile(tmp, JSON.stringify(config, null, 2) + "\n", "utf8");
+  await promises.rename(tmp, path);
+}
+function addImport(config, input2) {
+  const alias = (input2.alias ?? input2.snapshot.name).trim();
+  if (!alias) {
+    throw new Error("addImport: alias resolves to empty string");
+  }
+  const addedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const next = {
+    id: input2.snapshot.id,
+    alias,
+    addedAt,
+    snapshot: input2.snapshot
+  };
+  const others = config.imports.filter((e) => e.id !== input2.snapshot.id);
+  return { ...config, imports: [...others, next] };
+}
+function removeImport(config, id) {
+  return { ...config, imports: config.imports.filter((e) => e.id !== id) };
+}
+function normalise(parsed) {
+  if (!parsed || typeof parsed !== "object") return EMPTY;
+  const obj = parsed;
+  const imports = [];
+  if (Array.isArray(obj.imports)) {
+    for (const entry of obj.imports) {
+      if (!entry || typeof entry !== "object") continue;
+      const e = entry;
+      const id = typeof e.id === "string" ? e.id : "";
+      const alias = typeof e.alias === "string" ? e.alias : id;
+      const addedAt = typeof e.addedAt === "string" ? e.addedAt : (/* @__PURE__ */ new Date()).toISOString();
+      const snapshot = e.snapshot;
+      if (!id || !snapshot) continue;
+      imports.push({ id, alias, addedAt, snapshot });
+    }
+  }
+  return { version: IMPORTED_MCPS_VERSION, imports };
+}
+function registerSessionTools(server, opts) {
+  const { registry, resolveAgentAdapter, listAgentAdapters, mcpProxy } = opts;
+  server.tool(
+    "start_agent_session",
+    "Spawn a long-running agent CLI (claude-code, hermes, \u2026) on the host. The session stays alive across multiple turns \u2014 call `prompt_agent_session` to continue the conversation. Returns the session id + initial descriptor. When `workspaceSlug` is set, resolves the cwd via `~/.agentproto/workspaces.json`; otherwise pass `cwd` explicitly or fall back to the active workspace.",
+    {
+      adapter: z.string().min(1).describe(
+        "Adapter slug \u2014 one of the installed `@agentproto/adapter-*` packages (e.g. 'claude-code', 'hermes', 'aider')."
+      ),
+      workspaceSlug: z.string().optional().describe(
+        "Workspace slug from `agentproto workspace list`. The daemon resolves it to an absolute path. Omit to use the `cwd` field or the active workspace."
+      ),
+      cwd: z.string().optional().describe(
+        "Absolute path to spawn the agent in. Wins over `workspaceSlug` when both are set."
+      ),
+      prompt: z.string().optional().describe(
+        "Optional initial prompt. The session is spawned and the prompt dispatched in one shot \u2014 equivalent to `start` then `prompt` back-to-back. Skip to spawn idle."
+      ),
+      label: z.string().optional().describe(
+        "Free-text label that surfaces in `list_agent_sessions` and the UI \u2014 useful for tagging sessions with a conversation id or operator name."
+      )
+    },
+    async (input2) => {
+      if (!resolveAgentAdapter) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "start_agent_session is not enabled \u2014 the daemon was started without an adapter resolver. Re-run the daemon with the `@agentproto/cli` shim wired (see playground/scripts/gateway.ts)."
+            }
+          ],
+          isError: true
+        };
+      }
+      let cwd = input2.cwd;
+      let resolvedSlug = input2.workspaceSlug ?? "default";
+      if (!cwd) {
+        try {
+          const config = await loadWorkspacesConfig();
+          const ws = input2.workspaceSlug ? findWorkspace(config, input2.workspaceSlug) : getActiveWorkspace(config);
+          if (ws) {
+            cwd = ws.path;
+            resolvedSlug = ws.slug;
+          }
+        } catch {
+        }
+      }
+      if (!cwd) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "start_agent_session: no cwd resolvable. Pass `cwd` explicitly, or pass `workspaceSlug` matching `agentproto workspace list`, or set an active workspace via `agentproto workspace use <slug>`."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolved = await resolveAgentAdapter(input2.adapter);
+      if (!resolved) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `start_agent_session: adapter "${input2.adapter}" not found. Try \`agentproto install <slug>\` first.`
+            }
+          ],
+          isError: true
+        };
+      }
+      try {
+        const agentSession = await resolved.startSession({ cwd });
+        const desc = registry.spawnAgent({
+          workspaceSlug: resolvedSlug,
+          cwd,
+          agentSession,
+          adapterSlug: input2.adapter,
+          ...input2.prompt ? { initialPrompt: input2.prompt } : {},
+          ...input2.label ? { label: input2.label } : {},
+          ...resolved.commandPreview ? { commandPreview: resolved.commandPreview } : {}
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(desc, null, 2) }]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `start_agent_session: spawn failed \u2014 ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "prompt_agent_session",
+    "Send a follow-up prompt to a live agent session \u2014 multi-turn continuity without re-spawning. The session id comes from `start_agent_session` (or `list_agent_sessions`). Returns immediately; tail output via `get_agent_session_output` or the SSE /sessions/:id/stream endpoint.",
+    {
+      sessionId: z.string().describe("Session id returned by start_agent_session."),
+      prompt: z.string().min(1).describe("The next user turn (plain text).")
+    },
+    async (input2) => {
+      try {
+        void registry.sendPrompt(input2.sessionId, input2.prompt).catch(() => {
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                { ok: true, sessionId: input2.sessionId, queued: true },
+                null,
+                2
+              )
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `prompt_agent_session: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "list_agent_sessions",
+    "List all sessions tracked by the daemon \u2014 running, exited, killed. Use to find a session id when the operator's previous start call returned long ago, or to tell the user what's currently active on their machine.",
+    {
+      onlyAlive: z.boolean().optional().describe("Filter to status running/starting/mounting only. Default false.")
+    },
+    async (input2) => {
+      const all = registry.list();
+      const filtered = input2.onlyAlive ? all.filter(
+        (s) => s.status === "running" || s.status === "starting" || s.status === "mounting"
+      ) : all;
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ sessions: filtered }, null, 2)
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "get_agent_session_output",
+    "Tail the recent output of a session. Returns the last N lines of the ring buffer (stdout + stderr inter-leaved, newest last). Use this to read an agent's reply after `prompt_agent_session`.",
+    {
+      sessionId: z.string().describe("Session id."),
+      lastN: z.number().int().min(1).max(500).optional().describe("Max lines to return. Default 80, max 500.")
+    },
+    async (input2) => {
+      const desc = registry.get(input2.sessionId);
+      if (!desc) {
+        return {
+          content: [
+            { type: "text", text: `get_agent_session_output: no session "${input2.sessionId}"` }
+          ],
+          isError: true
+        };
+      }
+      const limit = input2.lastN ?? 80;
+      const lines = [];
+      const unsub = registry.attach(input2.sessionId, (line, _stream) => {
+        lines.push(line);
+      });
+      if (unsub) unsub();
+      const tail = lines.slice(-limit);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                sessionId: input2.sessionId,
+                status: desc.status,
+                lastOutputAt: desc.lastOutputAt,
+                lines: tail
+              },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "list_adapters",
+    "Enumerate every agent CLI adapter installed on the host (claude-code, hermes, aider, \u2026). Returns slug + display name + version + protocol so callers can let users pick from the installed set instead of guessing. Use before `start_agent_session` when the model doesn't already know what's available.",
+    {},
+    async () => {
+      if (!listAgentAdapters) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "list_adapters is not enabled \u2014 the daemon was started without an adapter lister. Wire `@agentproto/cli`'s `listInstalledAdapters` via `createGateway({ listAgentAdapters })`."
+            }
+          ],
+          isError: true
+        };
+      }
+      try {
+        const adapters = await listAgentAdapters();
+        return {
+          content: [{ type: "text", text: JSON.stringify({ adapters }, null, 2) }]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `list_adapters failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "list_discovered_mcps",
+    "Discover MCP servers already configured in the user's other agent tooling (claude-code, cursor, goose). Returns the union with source attribution so the operator can suggest 'I see you have a chrome-devtools MCP set up in claude \u2014 want me to use it?' instead of asking the user to re-configure. Read-only \u2014 does not modify any host's config.",
+    {},
+    async () => {
+      try {
+        const mcps = await discoverMcps();
+        return {
+          content: [{ type: "text", text: JSON.stringify({ mcps }, null, 2) }]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `list_discovered_mcps failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "list_imported_mcps",
+    "Return the user's curated set of MCP servers \u2014 the ones they've imported from claude / cursor / workspace configs into the daemon. Use to know which MCPs the operator may freely call vs. ones still showing up in `list_discovered_mcps` waiting on the user's blessing.",
+    {},
+    async () => {
+      try {
+        const config = await loadImportedMcps();
+        return {
+          content: [
+            { type: "text", text: JSON.stringify(config, null, 2) }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `list_imported_mcps failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "import_mcp",
+    "Import a discovered MCP into the daemon's curated set. The agent calls `list_discovered_mcps` first, asks the user, then commits the choice via this tool. The snapshot is captured at import time so the entry stays usable if the source config (claude/cursor) is later removed.",
+    {
+      sourceMcpId: z.string().min(1).describe(
+        "The discovered MCP id from `list_discovered_mcps` (e.g. 'claude-code:project:/path:chrome-devtools')."
+      ),
+      alias: z.string().optional().describe(
+        "Optional friendly name to display. Defaults to the source MCP's name."
+      )
+    },
+    async (input2) => {
+      try {
+        const discovered = await discoverMcps();
+        const snapshot = discovered.find((d) => d.id === input2.sourceMcpId);
+        if (!snapshot) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `import_mcp: discovered MCP "${input2.sourceMcpId}" not found. Re-run list_discovered_mcps to get current ids.`
+              }
+            ],
+            isError: true
+          };
+        }
+        const cfg = await loadImportedMcps();
+        const next = addImport(cfg, {
+          snapshot,
+          ...input2.alias ? { alias: input2.alias } : {}
+        });
+        await saveImportedMcps(next);
+        const entry = next.imports.find((e) => e.id === snapshot.id);
+        return {
+          content: [{ type: "text", text: JSON.stringify(entry, null, 2) }]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `import_mcp failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "remove_imported_mcp",
+    "Remove a previously-imported MCP from the daemon's curated set. Use when the user no longer wants the operator referencing it.",
+    {
+      id: z.string().min(1).describe(
+        "The imported MCP id (matches the discovered MCP id at import time)."
+      )
+    },
+    async (input2) => {
+      try {
+        const cfg = await loadImportedMcps();
+        if (!cfg.imports.some((e) => e.id === input2.id)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `remove_imported_mcp: id "${input2.id}" not in imports. Use list_imported_mcps to see current entries.`
+              }
+            ],
+            isError: true
+          };
+        }
+        await saveImportedMcps(removeImport(cfg, input2.id));
+        return {
+          content: [
+            { type: "text", text: JSON.stringify({ ok: true, id: input2.id }, null, 2) }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `remove_imported_mcp failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "mcp_imported_status",
+    "Snapshot every imported MCP server with its connection status, transport type, and tool count. Use this first when an operator wonders 'what MCPs do I actually have access to right now?' \u2014 the answer covers both 'imported but not yet connected' and 'connected with N tools'. Errors during connect surface in `lastError`.",
+    {},
+    async () => {
+      if (!mcpProxy) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "mcp_imported_status is not enabled \u2014 daemon was started without an MCP proxy. The host must wire `mcpProxy` in createGateway."
+            }
+          ],
+          isError: true
+        };
+      }
+      try {
+        const aliases = await mcpProxy.listAliases();
+        return {
+          content: [
+            { type: "text", text: JSON.stringify({ imports: aliases }, null, 2) }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `mcp_imported_status failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ],
+          isError: true
+        };
+      }
+    }
+  );
+  server.tool(
+    "mcp_imported_list_tools",
+    "List the tools exposed by one imported MCP server. The proxy lazily connects on first call \u2014 first-use latency includes the transport handshake (stdio: ~1-2s for npx-spawned servers; http/sse: <100ms). Returns the upstream `inputSchema` (JSON Schema) verbatim so the operator can build a valid `arguments` object for the follow-up `mcp_imported_call` invocation.",
+    {
+      alias: z.string().min(1).describe(
+        "Alias from `list_imported_mcps` / `mcp_imported_status` (typically the original MCP name, e.g. 'chrome-devtools')."
+      )
+    },
+    async (input2) => {
+      if (!mcpProxy) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "mcp_imported_list_tools is not enabled \u2014 see mcp_imported_status."
+            }
+          ],
+          isError: true
+        };
+      }
+      const out = await mcpProxy.listTools(input2.alias);
+      if (!out.ok) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `mcp_imported_list_tools "${input2.alias}": ${out.error}`
+            }
+          ],
+          isError: true
+        };
+      }
+      return {
+        content: [
+          { type: "text", text: JSON.stringify({ alias: input2.alias, tools: out.tools }, null, 2) }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "mcp_imported_call",
+    "Invoke a tool on an imported MCP server. The daemon proxies the call through the live client connection \u2014 the upstream server validates `arguments` against its own input schema (which you can fetch via `mcp_imported_list_tools`). The full upstream result is returned verbatim, including `isError` flags so the operator sees the original failure shape.",
+    {
+      alias: z.string().min(1).describe("Imported MCP alias."),
+      toolName: z.string().min(1).describe(
+        "Tool name as it appears in `mcp_imported_list_tools` (NOT a namespaced version \u2014 pass the upstream's own name)."
+      ),
+      args: z.record(z.string(), z.unknown()).optional().describe(
+        "Tool arguments as a JSON object. Schema is the upstream's \u2014 the proxy doesn't validate, only forwards. Default: empty object."
+      )
+    },
+    async (input2) => {
+      if (!mcpProxy) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "mcp_imported_call is not enabled \u2014 see mcp_imported_status."
+            }
+          ],
+          isError: true
+        };
+      }
+      const out = await mcpProxy.callTool(
+        input2.alias,
+        input2.toolName,
+        input2.args ?? {}
+      );
+      if (!out.ok) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `mcp_imported_call "${input2.alias}".${input2.toolName}: ${out.error}`
+            }
+          ],
+          isError: true
+        };
+      }
+      return out.result;
+    }
+  );
+  server.tool(
+    "kill_agent_session",
+    "Stop a session \u2014 SIGTERM the underlying child + close the agent protocol session. Use to free resources after the operator is done, or when a session is wedged.",
+    {
+      sessionId: z.string().describe("Session id.")
+    },
+    async (input2) => {
+      const ok = registry.kill(input2.sessionId);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ ok, sessionId: input2.sessionId }, null, 2)
+          }
+        ]
+      };
+    }
+  );
+}
+function startHeartbeat(opts) {
+  const filename = opts.filename ?? "HEARTBEAT.md";
+  const path = join(opts.workspace, filename);
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  let timer = null;
+  let currentEveryMs = null;
+  let firing = false;
+  async function load() {
+    if (!existsSync(path)) return null;
+    let source;
+    try {
+      source = await readFile(path, "utf8");
+    } catch {
+      return null;
+    }
+    const parsed = matter(source);
+    const fm = parsed.data;
+    const agent = typeof fm.agent === "string" ? fm.agent : null;
+    if (!agent) return null;
+    const enabled = fm.enabled === void 0 ? true : Boolean(fm.enabled);
+    const everyRaw = typeof fm.every === "string" ? fm.every : "60s";
+    const everyMs = parseDuration(everyRaw);
+    if (!everyMs) return null;
+    const conversationTemplate = typeof fm.conversation === "string" ? fm.conversation : "heartbeat-{date}";
+    return {
+      agent,
+      everyMs,
+      enabled,
+      conversationTemplate,
+      body: parsed.content.trim()
+    };
+  }
+  async function tick() {
+    if (firing) return;
+    if (opts.shouldFire && !opts.shouldFire()) return;
+    firing = true;
+    let agentId;
+    try {
+      const hb = await load();
+      if (!hb || !hb.enabled) return;
+      agentId = hb.agent;
+      const agent = await opts.buildAgent(hb.agent);
+      if (!agent) {
+        opts.events.emit({
+          type: "heartbeat-error",
+          at: now().toISOString(),
+          agent: hb.agent,
+          error: `buildAgent('${hb.agent}') returned null`
+        });
+        return;
+      }
+      if (!hb.body) {
+        opts.events.emit({
+          type: "heartbeat-error",
+          at: now().toISOString(),
+          agent: hb.agent,
+          error: "HEARTBEAT.md body is empty"
+        });
+        return;
+      }
+      const conversationId = expandTemplate(hb.conversationTemplate, now());
+      await opts.conversations.open(conversationId, { agent: hb.agent });
+      const startedAt = now();
+      await opts.conversations.appendTurn(
+        conversationId,
+        "user",
+        hb.body,
+        { at: startedAt.toISOString(), attribution: "heartbeat" }
+      );
+      opts.events.emit({
+        type: "conv-turn-appended",
+        at: startedAt.toISOString(),
+        conversationId,
+        role: "user",
+        contentPreview: preview(hb.body)
+      });
+      const t0 = Date.now();
+      const reply = await agent.generate(hb.body);
+      const durationMs = Date.now() - t0;
+      const finishedAt = now();
+      await opts.conversations.appendTurn(
+        conversationId,
+        "assistant",
+        reply.text,
+        { at: finishedAt.toISOString(), attribution: hb.agent }
+      );
+      opts.events.emit({
+        type: "conv-turn-appended",
+        at: finishedAt.toISOString(),
+        conversationId,
+        role: "assistant",
+        contentPreview: preview(reply.text)
+      });
+      opts.events.emit({
+        type: "heartbeat-fired",
+        at: finishedAt.toISOString(),
+        agent: hb.agent,
+        conversationId,
+        prompt: hb.body,
+        reply: reply.text,
+        durationMs
+      });
+      if (currentEveryMs !== null && currentEveryMs !== hb.everyMs) {
+        reschedule(hb.everyMs);
+      }
+    } catch (err) {
+      opts.events.emit({
+        type: "heartbeat-error",
+        at: now().toISOString(),
+        agent: agentId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    } finally {
+      firing = false;
+    }
+  }
+  function reschedule(everyMs) {
+    if (timer) clearInterval(timer);
+    currentEveryMs = everyMs;
+    timer = setInterval(() => {
+      void tick();
+    }, everyMs);
+  }
+  return {
+    start() {
+      if (timer) return;
+      void load().then((hb) => {
+        const everyMs = hb?.everyMs ?? 6e4;
+        reschedule(everyMs);
+      });
+    },
+    stop() {
+      if (timer) {
+        clearInterval(timer);
+        timer = null;
+        currentEveryMs = null;
+      }
+    },
+    async fireNow() {
+      await tick();
+    }
+  };
+}
+var DURATION_RE = /^(\d+)\s*(s|m|h|d)$/;
+function parseDuration(input2) {
+  const trimmed = input2.trim();
+  const match = trimmed.match(DURATION_RE);
+  if (!match) return null;
+  const n = Number(match[1]);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  switch (match[2]) {
+    case "s":
+      return n * 1e3;
+    case "m":
+      return n * 6e4;
+    case "h":
+      return n * 36e5;
+    case "d":
+      return n * 864e5;
+    default:
+      return null;
+  }
+}
+function expandTemplate(template, when) {
+  const date = when.toISOString().slice(0, 10);
+  return template.replace(/\{date\}/g, date);
+}
+function preview(text3, max = 120) {
+  const flat = text3.replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+}
+async function startHttpServer(opts) {
+  const startedAt = Date.now();
+  const authSource = opts.auth ?? { mode: "none" };
+  const readAuth = () => typeof authSource === "function" ? authSource() : authSource;
+  function isLoopback(req) {
+    const addr = req.socket.remoteAddress ?? "";
+    const isLocalAddr = addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+    if (!isLocalAddr) return false;
+    if (req.headers["x-forwarded-for"]) return false;
+    return true;
+  }
+  function authorize(req, res) {
+    const auth = readAuth();
+    if (auth.mode === "none") return true;
+    if (isLoopback(req)) return true;
+    const header = req.headers.authorization;
+    const expected = `Bearer ${auth.token}`;
+    if (header !== expected) {
+      res.writeHead(401, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "unauthorized" }));
+      return false;
+    }
+    return true;
+  }
+  async function handleMcp(req, res) {
+    if (!authorize(req, res)) return;
+    const server2 = await opts.mcpServerFactory();
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: void 0
+    });
+    transport.onerror = (err) => {
+      console.error("[mcp transport.onerror]", err);
+    };
+    res.on("close", () => {
+      void transport.close();
+      void server2.close();
+    });
+    try {
+      await server2.connect(transport);
+      await transport.handleRequest(req, res);
+    } catch (err) {
+      console.error("[mcp] handleRequest threw:", err);
+      if (!res.headersSent) {
+        res.writeHead(500, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            error: "mcp_transport_failed",
+            message: err instanceof Error ? err.message : String(err)
+          })
+        );
+      }
+    }
+  }
+  function handleHealth(_req, res) {
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(
+      JSON.stringify({
+        status: "ok",
+        workspace: opts.meta.workspace,
+        registered: opts.meta.registered,
+        uptimeMs: Date.now() - startedAt
+      })
+    );
+  }
+  function handleEvents(req, res) {
+    if (!authorize(req, res)) return;
+    res.writeHead(200, {
+      "content-type": "text/event-stream",
+      "cache-control": "no-cache, no-transform",
+      connection: "keep-alive"
+    });
+    res.write(`: connected
+
+`);
+    const off = opts.events.onAny((ev) => {
+      res.write(`data: ${JSON.stringify(ev)}
+
+`);
+    });
+    req.on("close", off);
+  }
+  async function handleListConversations(req, res) {
+    if (!authorize(req, res)) return;
+    const list = await opts.conversations.list();
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(JSON.stringify(list));
+  }
+  async function handleGetConversation(req, res, id) {
+    if (!authorize(req, res)) return;
+    try {
+      const data = await opts.conversations.read(id);
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify(data));
+    } catch (err) {
+      res.writeHead(404, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: "not_found",
+          message: err instanceof Error ? err.message : String(err)
+        })
+      );
+    }
+  }
+  async function handleHeartbeatTick(req, res) {
+    if (!authorize(req, res)) return;
+    await opts.heartbeat.fireNow();
+    res.writeHead(202, { "content-type": "application/json" });
+    res.end(JSON.stringify({ status: "fired" }));
+  }
+  function applyCors(req, res) {
+    const origin = req.headers.origin ?? "*";
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+    res.setHeader("Access-Control-Allow-Credentials", "true");
+    res.setHeader(
+      "Access-Control-Allow-Headers",
+      req.headers["access-control-request-headers"] ?? "authorization,content-type,mcp-session-id"
+    );
+    res.setHeader(
+      "Access-Control-Allow-Methods",
+      "GET,POST,PUT,PATCH,DELETE,OPTIONS"
+    );
+  }
+  const server = createServer((req, res) => {
+    void (async () => {
+      try {
+        const url = req.url ?? "/";
+        const path = url.split("?")[0] ?? "/";
+        if (req.headers["x-forwarded-for"]) {
+          opts.events.emit({
+            type: "remote-log",
+            at: (/* @__PURE__ */ new Date()).toISOString(),
+            line: `[http-in] ${req.method} ${url} host=${req.headers.host ?? "?"} xff=${String(req.headers["x-forwarded-for"])}`
+          });
+        }
+        applyCors(req, res);
+        if (req.method === "OPTIONS") {
+          res.writeHead(204);
+          res.end();
+          return;
+        }
+        if (path === "/health" && req.method === "GET") {
+          handleHealth(req, res);
+          return;
+        }
+        if (path === "/events" && req.method === "GET") {
+          handleEvents(req, res);
+          return;
+        }
+        if (path === "/mcp") {
+          await handleMcp(req, res);
+          return;
+        }
+        if (path === "/conversations" && req.method === "GET") {
+          await handleListConversations(req, res);
+          return;
+        }
+        if (path.startsWith("/conversations/") && req.method === "GET") {
+          const id = path.slice("/conversations/".length);
+          await handleGetConversation(req, res, id);
+          return;
+        }
+        if (path === "/heartbeat/tick" && req.method === "POST") {
+          await handleHeartbeatTick(req, res);
+          return;
+        }
+        if (opts.sessions && path.startsWith("/sessions")) {
+          const handled = await handleSessions(
+            req,
+            res,
+            path,
+            opts.sessions,
+            opts.resolveAgentAdapter
+          );
+          if (handled) return;
+        }
+        if (path === "/workspaces" && req.method === "GET") {
+          try {
+            const config = await loadWorkspacesConfig();
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify(config));
+          } catch (err) {
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: "workspaces_load_failed",
+                message: err instanceof Error ? err.message : String(err)
+              })
+            );
+          }
+          return;
+        }
+        if (path === "/mcps/imports" && req.method === "GET") {
+          const config = await loadImportedMcps();
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify(config));
+          return;
+        }
+        if (path === "/mcps/imports" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          if (!body || typeof body.sourceMcpId !== "string") {
+            res.writeHead(400, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "missing_sourceMcpId" }));
+            return;
+          }
+          const discovered = await discoverMcps();
+          const snapshot = discovered.find((d) => d.id === body.sourceMcpId);
+          if (!snapshot) {
+            res.writeHead(404, { "content-type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: "discovered_mcp_not_found",
+                sourceMcpId: body.sourceMcpId
+              })
+            );
+            return;
+          }
+          const cfg = await loadImportedMcps();
+          const next = addImport(cfg, {
+            snapshot,
+            ...body.alias ? { alias: body.alias } : {}
+          });
+          await saveImportedMcps(next);
+          res.writeHead(201, { "content-type": "application/json" });
+          res.end(JSON.stringify(next.imports.find((e) => e.id === snapshot.id)));
+          return;
+        }
+        const importMatch = path.match(/^\/mcps\/imports\/(.+)$/);
+        if (importMatch && req.method === "DELETE") {
+          const id = decodeURIComponent(importMatch[1] ?? "");
+          const cfg = await loadImportedMcps();
+          if (!cfg.imports.some((e) => e.id === id)) {
+            res.writeHead(404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "import_not_found", id }));
+            return;
+          }
+          await saveImportedMcps(removeImport(cfg, id));
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ ok: true, id }));
+          return;
+        }
+        if (path === "/mcps/discovered" && req.method === "GET") {
+          try {
+            const mcps = await discoverMcps();
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ mcps }));
+          } catch (err) {
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: "discovery_failed",
+                message: err instanceof Error ? err.message : String(err)
+              })
+            );
+          }
+          return;
+        }
+        if (path === "/mcps/proxy/status" && req.method === "GET") {
+          if (!opts.mcpProxy) {
+            res.writeHead(501, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "mcp_proxy_not_configured" }));
+            return;
+          }
+          try {
+            const imports = await opts.mcpProxy.listAliases();
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ imports }));
+          } catch (err) {
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: "proxy_status_failed",
+                message: err instanceof Error ? err.message : String(err)
+              })
+            );
+          }
+          return;
+        }
+        const proxyToolsMatch = path.match(/^\/mcps\/proxy\/tools\/(.+)$/);
+        if (proxyToolsMatch && req.method === "GET") {
+          if (!opts.mcpProxy) {
+            res.writeHead(501, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "mcp_proxy_not_configured" }));
+            return;
+          }
+          const alias = decodeURIComponent(proxyToolsMatch[1] ?? "");
+          const out = await opts.mcpProxy.listTools(alias);
+          res.writeHead(out.ok ? 200 : 502, {
+            "content-type": "application/json"
+          });
+          res.end(JSON.stringify(out));
+          return;
+        }
+        if (path === "/mcps/proxy/call" && req.method === "POST") {
+          if (!opts.mcpProxy) {
+            res.writeHead(501, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "mcp_proxy_not_configured" }));
+            return;
+          }
+          const body = await readJsonBody(req);
+          if (!body || typeof body.alias !== "string" || typeof body.toolName !== "string") {
+            res.writeHead(400, { "content-type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: "invalid_body",
+                message: "expected { alias, toolName, args? }"
+              })
+            );
+            return;
+          }
+          const result = await opts.mcpProxy.callTool(
+            body.alias,
+            body.toolName,
+            body.args ?? {}
+          );
+          res.writeHead(result.ok ? 200 : 502, {
+            "content-type": "application/json"
+          });
+          res.end(JSON.stringify(result));
+          return;
+        }
+        if (path === "/adapters" && req.method === "GET") {
+          if (!opts.listAgentAdapters) {
+            res.writeHead(501, { "content-type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: "lister_not_configured",
+                message: "Daemon was started without `listAgentAdapters` \u2014 see @agentproto/cli's `listInstalledAdapters` for the canonical impl."
+              })
+            );
+            return;
+          }
+          try {
+            const adapters = await opts.listAgentAdapters();
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ adapters }));
+          } catch (err) {
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(
+              JSON.stringify({
+                error: "list_failed",
+                message: err instanceof Error ? err.message : String(err)
+              })
+            );
+          }
+          return;
+        }
+        res.writeHead(404, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: "not_found", path }));
+      } catch (err) {
+        if (!res.headersSent) {
+          res.writeHead(500, { "content-type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: "internal_error",
+              message: err instanceof Error ? err.message : String(err)
+            })
+          );
+        }
+      }
+    })();
+  });
+  const bind = opts.bind ?? "127.0.0.1";
+  await new Promise((resolve7, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port, bind, () => resolve7());
+  });
+  return {
+    url: `http://${bind}:${opts.port}`,
+    async stop() {
+      await new Promise((resolve7) => server.close(() => resolve7()));
+    }
+  };
+}
+async function handleSessions(req, res, path, registry, resolveAgentAdapter) {
+  const json = (status, body) => {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+  };
+  if (path === "/sessions" && req.method === "GET") {
+    json(200, { sessions: registry.list() });
+    return true;
+  }
+  if (path === "/sessions/agent" && req.method === "POST") {
+    if (!resolveAgentAdapter) {
+      json(501, {
+        error: "agent_resolver_not_configured",
+        message: "POST /sessions/agent needs the host to inject `resolveAgentAdapter` (e.g. via @agentproto/cli's resolveAdapter shim)."
+      });
+      return true;
+    }
+    const body = await readJsonBody(req);
+    if (!body || typeof body !== "object") {
+      json(400, { error: "invalid_body" });
+      return true;
+    }
+    const b = body;
+    const adapter = typeof b.adapter === "string" ? b.adapter : "";
+    if (!adapter) {
+      json(400, { error: "missing_adapter" });
+      return true;
+    }
+    let cwd = typeof b.cwd === "string" && b.cwd.length > 0 ? b.cwd : null;
+    let workspaceSlug = typeof b.workspaceSlug === "string" ? b.workspaceSlug : "";
+    if (!cwd) {
+      try {
+        const config = await loadWorkspacesConfig();
+        const ws = workspaceSlug ? findWorkspace(config, workspaceSlug) : getActiveWorkspace(config);
+        if (ws) {
+          cwd = ws.path;
+          workspaceSlug = ws.slug;
+        }
+      } catch {
+      }
+    }
+    if (!cwd) {
+      cwd = process.cwd();
+      console.warn(
+        `[/sessions/agent] no cwd resolvable for adapter=${adapter} (no body.cwd, no workspaceSlug match in ~/.agentproto/workspaces.json, no active workspace) \u2014 falling back to daemon's cwd ${cwd}`
+      );
+    }
+    if (!workspaceSlug) workspaceSlug = "default";
+    const resolved = await resolveAgentAdapter(adapter);
+    if (!resolved) {
+      json(404, { error: "adapter_not_found", adapter });
+      return true;
+    }
+    try {
+      const agentSession = await resolved.startSession({ cwd });
+      const desc = registry.spawnAgent({
+        workspaceSlug,
+        cwd,
+        agentSession,
+        adapterSlug: adapter,
+        ...typeof b.prompt === "string" ? { initialPrompt: b.prompt } : {},
+        ...typeof b.label === "string" ? { label: b.label } : {},
+        ...resolved.commandPreview ? { commandPreview: resolved.commandPreview } : {}
+      });
+      json(201, desc);
+    } catch (err) {
+      json(500, {
+        error: "agent_spawn_failed",
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return true;
+  }
+  const promptMatch = path.match(/^\/sessions\/([^/]+)\/prompt$/);
+  if (promptMatch && req.method === "POST") {
+    const id2 = promptMatch[1];
+    if (!id2) return false;
+    const body = await readJsonBody(req);
+    const prompt = body?.prompt;
+    if (typeof prompt !== "string") {
+      json(400, { error: "missing_prompt" });
+      return true;
+    }
+    const reqUrl = req.url ?? "";
+    const queryString = reqUrl.includes("?") ? reqUrl.slice(reqUrl.indexOf("?") + 1) : "";
+    const wait = new URLSearchParams(queryString).get("wait");
+    const fireAndForget = wait === "false" || wait === "0";
+    try {
+      if (fireAndForget) {
+        registry.enqueuePrompt(id2, prompt);
+        json(202, { ok: true, id: id2, queued: true });
+      } else {
+        await registry.sendPrompt(id2, prompt);
+        json(200, { ok: true, id: id2 });
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const status = msg.includes("no session") ? 404 : msg.includes("not an agent") ? 400 : msg.includes("mid-turn") ? 409 : 500;
+      json(status, { error: "send_prompt_failed", message: msg });
+    }
+    return true;
+  }
+  if (path === "/sessions" && req.method === "POST") {
+    const body = await readJsonBody(req);
+    if (!body || typeof body !== "object") {
+      json(400, { error: "invalid_body" });
+      return true;
+    }
+    const b = body;
+    const argv = Array.isArray(b.argv) ? b.argv.filter((v) => typeof v === "string") : [];
+    if (argv.length === 0) {
+      json(400, { error: "missing_argv" });
+      return true;
+    }
+    try {
+      const desc = registry.spawn({
+        kind: b.kind === "terminal" || b.kind === "agent-cli" || b.kind === "command" ? b.kind : "command",
+        workspaceSlug: typeof b.workspaceSlug === "string" ? b.workspaceSlug : "default",
+        cwd: typeof b.cwd === "string" ? b.cwd : process.cwd(),
+        argv,
+        env: b.env && typeof b.env === "object" ? b.env : void 0,
+        label: typeof b.label === "string" ? b.label : void 0
+      });
+      json(201, desc);
+    } catch (err) {
+      json(500, {
+        error: "spawn_failed",
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return true;
+  }
+  const idMatch = path.match(/^\/sessions\/([^/]+)(\/stream|\/kill)?$/);
+  if (!idMatch) return false;
+  const [, id, suffix] = idMatch;
+  if (!id) return false;
+  if (suffix === "/stream" && req.method === "GET") {
+    const desc = registry.get(id);
+    if (!desc) {
+      json(404, { error: "session_not_found", id });
+      return true;
+    }
+    res.writeHead(200, {
+      "content-type": "text/event-stream",
+      "cache-control": "no-cache",
+      connection: "keep-alive"
+    });
+    const ping = setInterval(() => {
+      try {
+        res.write(`: keep-alive
+
+`);
+      } catch {
+        clearInterval(ping);
+      }
+    }, 25e3);
+    const unsub = registry.attach(id, (line, stream) => {
+      try {
+        res.write(
+          `data: ${JSON.stringify({ line, stream })}
+
+`
+        );
+      } catch {
+      }
+    });
+    if (!unsub) {
+      clearInterval(ping);
+      res.end();
+      return true;
+    }
+    req.once("close", () => {
+      unsub();
+      clearInterval(ping);
+    });
+    return true;
+  }
+  if (suffix === "/kill" && req.method === "POST") {
+    const ok = registry.kill(id);
+    json(ok ? 200 : 404, { ok, id });
+    return true;
+  }
+  if (!suffix && req.method === "GET") {
+    const desc = registry.get(id);
+    if (!desc) {
+      json(404, { error: "session_not_found", id });
+      return true;
+    }
+    json(200, desc);
+    return true;
+  }
+  if (!suffix && req.method === "DELETE") {
+    const ok = registry.forget(id);
+    json(ok ? 200 : 404, { ok, id });
+    return true;
+  }
+  return false;
+}
+async function readJsonBody(req) {
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  if (chunks.length === 0) return null;
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+var SESSIONS_FILE_PATH = () => resolve(homedir(), ".agentproto", "sessions.json");
+var RECENT_LINES_CAP = 500;
+var PERSIST_DEBOUNCE_MS = 1500;
+function createSessionsRegistry(opts) {
+  const persistPath = SESSIONS_FILE_PATH();
+  const sessions = /* @__PURE__ */ new Map();
+  let persistTimer = null;
+  const schedulePersist = () => {
+    if (persistTimer) clearTimeout(persistTimer);
+    persistTimer = setTimeout(() => {
+      void persistSnapshot();
+    }, PERSIST_DEBOUNCE_MS);
+  };
+  const persistSnapshot = async () => {
+    try {
+      const snapshot = {
+        savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        sessions: Array.from(sessions.values()).map((s) => s.desc)
+      };
+      await promises.mkdir(dirname(persistPath), { recursive: true });
+      await promises.writeFile(persistPath, JSON.stringify(snapshot, null, 2) + "\n");
+    } catch (err) {
+      console.warn(
+        `[sessions] persist failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  };
+  const appendLine = (rt, line, stream) => {
+    rt.recentLines.push(line);
+    if (rt.recentLines.length > RECENT_LINES_CAP) {
+      rt.recentLines.splice(0, rt.recentLines.length - RECENT_LINES_CAP);
+    }
+    rt.desc.lastOutputAt = (/* @__PURE__ */ new Date()).toISOString();
+    rt.emitter.emit("line", { line, stream });
+  };
+  const projectEvent = (rt, evt) => {
+    switch (evt.kind) {
+      case "text-delta":
+        if (evt.text) {
+          const combined = rt.textBuf + evt.text;
+          const lines = combined.split(/\r?\n/);
+          rt.textBuf = lines.pop() ?? "";
+          for (const line of lines) appendLine(rt, line, "stdout");
+        }
+        break;
+      case "thought":
+        if (evt.text) {
+          const combined = rt.thoughtBuf + evt.text;
+          const lines = combined.split(/\r?\n/);
+          rt.thoughtBuf = lines.pop() ?? "";
+          for (const line of lines) {
+            if (line.trim()) {
+              appendLine(rt, `\x1B[2m[thought] ${line}\x1B[0m`, "stdout");
+            }
+          }
+        }
+        break;
+      case "tool-call":
+        appendLine(
+          rt,
+          `\x1B[36m[tool] ${evt.toolName ?? "?"}\x1B[0m`,
+          "stdout"
+        );
+        break;
+      case "tool-result":
+        if (evt.isError)
+          appendLine(rt, `\x1B[31m[tool-error]\x1B[0m`, "stderr");
+        break;
+      case "agent-prompt":
+        appendLine(rt, `\x1B[33m[awaiting input]\x1B[0m`, "stdout");
+        break;
+      case "turn-end": {
+        if (rt.thoughtBuf.trim()) {
+          appendLine(
+            rt,
+            `\x1B[2m[thought] ${rt.thoughtBuf}\x1B[0m`,
+            "stdout"
+          );
+        }
+        rt.thoughtBuf = "";
+        if (rt.textBuf) {
+          appendLine(rt, rt.textBuf, "stdout");
+          rt.textBuf = "";
+        }
+        appendLine(
+          rt,
+          `\x1B[2m\u2500\u2500 turn-end (${evt.reason ?? "completed"}) \u2500\u2500\x1B[0m`,
+          "stdout"
+        );
+        break;
+      }
+      case "error": {
+        const code = typeof evt.error?.code === "number" ? ` (code ${evt.error.code})` : "";
+        appendLine(
+          rt,
+          `\x1B[31m[error]${code} ${evt.error?.message ?? "unknown"}\x1B[0m`,
+          "stderr"
+        );
+        const data = evt.error?.data;
+        if (data && typeof data === "object" && typeof data.stderr === "string") {
+          for (const line of data.stderr.split(/\r?\n/)) {
+            if (line) appendLine(rt, `\x1B[2m  ${line}\x1B[0m`, "stderr");
+          }
+        }
+        break;
+      }
+    }
+  };
+  const validateAgentTurn = (id, caller) => {
+    const rt = sessions.get(id);
+    if (!rt) throw new Error(`${caller}: no session "${id}"`);
+    if (!rt.agentSession) {
+      throw new Error(
+        `${caller}: session "${id}" is not an agent session (kind=${rt.desc.kind})`
+      );
+    }
+    if (rt.busy) {
+      throw new Error(
+        `${caller}: session "${id}" is mid-turn \u2014 wait for it to finish or cancel`
+      );
+    }
+    return rt;
+  };
+  const runAgentTurn = async (rt, message) => {
+    if (!rt.agentSession) {
+      throw new Error("runAgentTurn: session has no agentSession");
+    }
+    rt.busy = true;
+    try {
+      appendLine(
+        rt,
+        `\x1B[2m\u2500\u2500 \u25B6 ${typeof message === "string" ? message : JSON.stringify(message)} \u2500\u2500\x1B[0m`,
+        "stdout"
+      );
+      const wrapped = typeof message === "string" ? { type: "text", text: message } : message;
+      for await (const evt of rt.agentSession.send(wrapped)) {
+        projectEvent(rt, evt);
+      }
+    } catch (err) {
+      rt.desc.status = "error";
+      rt.desc.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+      appendLine(
+        rt,
+        `[turn error] ${err instanceof Error ? err.message : String(err)}`,
+        "stderr"
+      );
+      schedulePersist();
+    } finally {
+      rt.busy = false;
+    }
+  };
+  const wireOutputStreams = (rt) => {
+    const onChunk = (stream) => (chunk) => {
+      const text3 = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const line of text3.split(/\r?\n/)) {
+        if (line.length > 0) appendLine(rt, line, stream);
+      }
+    };
+    if (!rt.child) return;
+    rt.child.stdout?.on("data", onChunk("stdout"));
+    rt.child.stderr?.on("data", onChunk("stderr"));
+  };
+  return {
+    spawn(input2) {
+      const id = input2.id ?? `sess_${randomUUID().slice(0, 8)}`;
+      if (sessions.has(id)) {
+        throw new Error(`sessions.spawn: id "${id}" already in use`);
+      }
+      const env = { ...process.env, ...input2.env ?? {} };
+      delete env.NODE_OPTIONS;
+      const [bin, ...args] = input2.argv;
+      if (!bin) throw new Error("sessions.spawn: argv must include a binary");
+      const stdinMode = input2.keepStdin ? "pipe" : "ignore";
+      const child = spawn(bin, args, {
+        cwd: input2.cwd,
+        env,
+        stdio: [stdinMode, "pipe", "pipe"]
+      });
+      const desc = {
+        id,
+        kind: input2.kind,
+        workspaceSlug: input2.workspaceSlug,
+        command: [bin, ...args].map(quoteArg).join(" "),
+        pid: child.pid ?? null,
+        status: "starting",
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...input2.label ? { label: input2.label } : {}
+      };
+      const rt = {
+        desc,
+        child,
+        recentLines: [],
+        emitter: new EventEmitter(),
+        busy: false,
+        textBuf: "",
+        thoughtBuf: ""
+      };
+      rt.emitter.setMaxListeners(50);
+      sessions.set(id, rt);
+      wireOutputStreams(rt);
+      child.once("spawn", () => {
+        desc.status = "running";
+        rt.emitter.emit("status", desc.status);
+        schedulePersist();
+      });
+      child.once("error", (err) => {
+        desc.status = "error";
+        desc.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+        appendLine(rt, `[spawn error] ${err.message}`, "stderr");
+        rt.emitter.emit("status", desc.status);
+        schedulePersist();
+      });
+      child.once("exit", (code, signal) => {
+        if (signal && desc.status !== "killed") desc.status = "killed";
+        else if (desc.status === "running" || desc.status === "starting") {
+          desc.status = "exited";
+        }
+        desc.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+        if (typeof code === "number") desc.exitCode = code;
+        rt.emitter.emit("status", desc.status);
+        schedulePersist();
+      });
+      schedulePersist();
+      return desc;
+    },
+    register(input2) {
+      if (sessions.has(input2.id)) {
+        const existing = sessions.get(input2.id);
+        if (existing) return existing.desc;
+      }
+      const desc = {
+        id: input2.id,
+        kind: input2.kind ?? "command",
+        workspaceSlug: input2.workspaceSlug,
+        command: input2.command,
+        pid: input2.child.pid ?? null,
+        status: input2.child.killed ? "killed" : "running",
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...input2.label ? { label: input2.label } : {}
+      };
+      const rt = {
+        desc,
+        child: input2.child,
+        recentLines: [],
+        emitter: new EventEmitter(),
+        busy: false,
+        textBuf: "",
+        thoughtBuf: ""
+      };
+      rt.emitter.setMaxListeners(50);
+      sessions.set(input2.id, rt);
+      wireOutputStreams(rt);
+      input2.child.once("exit", (code, signal) => {
+        if (signal && desc.status !== "killed") desc.status = "killed";
+        else if (desc.status === "running") desc.status = "exited";
+        desc.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+        if (typeof code === "number") desc.exitCode = code;
+        rt.emitter.emit("status", desc.status);
+        schedulePersist();
+      });
+      input2.child.once("error", (err) => {
+        desc.status = "error";
+        desc.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+        appendLine(rt, `[child error] ${err.message}`, "stderr");
+        rt.emitter.emit("status", desc.status);
+        schedulePersist();
+      });
+      schedulePersist();
+      return desc;
+    },
+    spawnAgent(input2) {
+      const id = `sess_${randomUUID().slice(0, 8)}`;
+      const desc = {
+        id,
+        kind: "agent-cli",
+        workspaceSlug: input2.workspaceSlug,
+        command: input2.commandPreview ?? `${input2.adapterSlug} (agent)`,
+        pid: null,
+        status: "running",
+        // driver already started the session
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...input2.label ? { label: input2.label } : {}
+      };
+      const rt = {
+        desc,
+        agentSession: input2.agentSession,
+        adapterSlug: input2.adapterSlug,
+        recentLines: [],
+        emitter: new EventEmitter(),
+        busy: false,
+        textBuf: "",
+        thoughtBuf: ""
+      };
+      rt.emitter.setMaxListeners(50);
+      sessions.set(id, rt);
+      appendLine(
+        rt,
+        `\u2500\u2500 ${input2.adapterSlug} agent session ${input2.agentSession.sessionId} (cwd ${input2.cwd}) \u2500\u2500`,
+        "stdout"
+      );
+      schedulePersist();
+      if (input2.initialPrompt) {
+        void runAgentTurn(rt, input2.initialPrompt).catch((err) => {
+          appendLine(
+            rt,
+            `[turn error] ${err instanceof Error ? err.message : String(err)}`,
+            "stderr"
+          );
+        });
+      }
+      return desc;
+    },
+    async sendPrompt(id, message) {
+      const rt = validateAgentTurn(id, "sendPrompt");
+      await runAgentTurn(rt, message);
+    },
+    enqueuePrompt(id, message) {
+      const rt = validateAgentTurn(id, "enqueuePrompt");
+      void runAgentTurn(rt, message).catch(() => {
+      });
+    },
+    list() {
+      return Array.from(sessions.values()).map((s) => s.desc).sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+    },
+    get(id) {
+      return sessions.get(id)?.desc;
+    },
+    attach(id, onLine) {
+      const rt = sessions.get(id);
+      if (!rt) return null;
+      for (const line of rt.recentLines) onLine(line, "stdout");
+      const handler = (evt) => onLine(evt.line, evt.stream);
+      rt.emitter.on("line", handler);
+      return () => rt.emitter.off("line", handler);
+    },
+    kill(id, signal = "SIGTERM") {
+      const rt = sessions.get(id);
+      if (!rt) return false;
+      if (rt.desc.status === "exited" || rt.desc.status === "killed" || rt.desc.status === "error") {
+        return false;
+      }
+      rt.desc.status = "killed";
+      rt.desc.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+      if (rt.agentSession) {
+        void rt.agentSession.close().catch(() => void 0);
+      }
+      rt.child?.kill(signal);
+      schedulePersist();
+      return true;
+    },
+    forget(id) {
+      const rt = sessions.get(id);
+      if (!rt) return false;
+      rt.emitter.removeAllListeners();
+      sessions.delete(id);
+      schedulePersist();
+      return true;
+    },
+    shutdown() {
+      if (persistTimer) clearTimeout(persistTimer);
+      for (const rt of sessions.values()) {
+        rt.emitter.removeAllListeners();
+        if (rt.desc.status === "running" || rt.desc.status === "starting") {
+          if (rt.agentSession) {
+            void rt.agentSession.close().catch(() => void 0);
+          }
+          rt.child?.kill("SIGTERM");
+        }
+      }
+      sessions.clear();
+    }
+  };
+}
+function quoteArg(arg) {
+  if (arg === "") return '""';
+  if (/^[a-zA-Z0-9._/=:@,+-]+$/.test(arg)) return arg;
+  return `"${arg.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+var McpProxyRegistry = class {
+  clients = /* @__PURE__ */ new Map();
+  lastMtimeMs = 0;
+  /** Sentinel so we know whether the file has *ever* been read.
+   *  Distinguishes "file missing on first call" (legit empty state)
+   *  from "we've read it before and it's gone" (treat as empty too,
+   *  but only after closing live clients). */
+  hasReadOnce = false;
+  /**
+   * Reload the imports file when its mtime has advanced. Avoids
+   * repeated parsing when nothing changed — most calls are no-ops.
+   * Disconnects clients whose import was removed; connects the new
+   * set lazily (the first call that touches them).
+   */
+  async ensureCurrent() {
+    let mtimeMs = 0;
+    try {
+      const st = await promises.stat(IMPORTED_MCPS_PATH());
+      mtimeMs = st.mtimeMs;
+    } catch {
+      mtimeMs = 0;
+    }
+    if (this.hasReadOnce && mtimeMs === this.lastMtimeMs) return;
+    const config = await loadImportedMcps().catch(() => ({
+      version: 1,
+      imports: []
+    }));
+    const wantedIds = new Set(config.imports.map((e) => e.id));
+    for (const [id, c] of this.clients.entries()) {
+      if (!wantedIds.has(id)) {
+        await safeClose(c.client);
+        this.clients.delete(id);
+      }
+    }
+    for (const entry of config.imports) {
+      const existing = this.clients.get(entry.id);
+      if (existing) {
+        if (JSON.stringify(existing.entry.snapshot) !== JSON.stringify(entry.snapshot)) {
+          await safeClose(existing.client);
+          this.clients.set(entry.id, freshPlaceholder(entry));
+        } else {
+          existing.entry = entry;
+        }
+      } else {
+        this.clients.set(entry.id, freshPlaceholder(entry));
+      }
+    }
+    this.lastMtimeMs = mtimeMs;
+    this.hasReadOnce = true;
+  }
+  /**
+   * Lazy connect: the first call to `connectIfNeeded(alias)`
+   * actually opens the transport + handshakes. Subsequent calls
+   * reuse the live client.
+   */
+  async connectIfNeeded(alias) {
+    await this.ensureCurrent();
+    const handle = this.findByAlias(alias);
+    if (!handle) return null;
+    if (handle.client) return handle;
+    try {
+      const client = await openClient(handle.entry);
+      handle.client = client;
+      handle.lastError = null;
+      const t = await client.listTools();
+      handle.tools = t.tools.map(toDescriptor);
+      return handle;
+    } catch (err) {
+      handle.client = null;
+      handle.tools = null;
+      handle.lastError = err instanceof Error ? err.message : String(err);
+      return handle;
+    }
+  }
+  /** Find a client handle by alias *or* import id (defensive — agents
+   *  sometimes pass the id from `list_imported_mcps`). */
+  findByAlias(aliasOrId) {
+    for (const c of this.clients.values()) {
+      if (c.entry.alias === aliasOrId) return c;
+      if (c.entry.id === aliasOrId) return c;
+    }
+    return void 0;
+  }
+  async listAliases() {
+    await this.ensureCurrent();
+    return Array.from(this.clients.values()).map((c) => ({
+      alias: c.entry.alias,
+      importId: c.entry.id,
+      source: c.entry.snapshot.source,
+      type: c.entry.snapshot.type,
+      status: c.client ? "connected" : c.lastError ? "error" : "pending",
+      toolCount: c.tools?.length ?? 0,
+      ...c.lastError ? { lastError: c.lastError } : {}
+    }));
+  }
+  async listTools(alias) {
+    const handle = await this.connectIfNeeded(alias);
+    if (!handle) return { ok: false, error: `unknown alias "${alias}"` };
+    if (!handle.client || !handle.tools) {
+      return {
+        ok: false,
+        error: handle.lastError ?? "client not connected"
+      };
+    }
+    return { ok: true, tools: handle.tools };
+  }
+  async callTool(alias, toolName, args) {
+    const handle = await this.connectIfNeeded(alias);
+    if (!handle) return { ok: false, error: `unknown alias "${alias}"` };
+    if (!handle.client) {
+      return {
+        ok: false,
+        error: handle.lastError ?? "client not connected"
+      };
+    }
+    try {
+      const result = await handle.client.callTool({
+        name: toolName,
+        arguments: args && typeof args === "object" ? args : {}
+      });
+      return { ok: true, result };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/closed|disconnect|EPIPE|ECONNRESET/i.test(msg)) {
+        await safeClose(handle.client);
+        handle.client = null;
+        handle.tools = null;
+        handle.lastError = msg;
+      }
+      return { ok: false, error: msg };
+    }
+  }
+  async closeAll() {
+    await Promise.all(
+      Array.from(this.clients.values()).map((c) => safeClose(c.client))
+    );
+    this.clients.clear();
+  }
+};
+function freshPlaceholder(entry) {
+  return { entry, client: null, tools: null, lastError: null };
+}
+function toDescriptor(tool) {
+  return {
+    name: tool.name,
+    ...tool.description ? { description: tool.description } : {},
+    ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {}
+  };
+}
+function expandEnvPlaceholders(raw) {
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    const expanded = v.replace(
+      /\$\{([A-Z_][A-Z0-9_]*)(?::-([^}]*))?\}/gi,
+      (_match, name, fallback) => {
+        const fromEnv = process.env[name];
+        if (fromEnv !== void 0) return fromEnv;
+        if (fallback !== void 0) return fallback;
+        return "";
+      }
+    );
+    if (expanded.length === 0) continue;
+    out[k] = expanded;
+  }
+  return out;
+}
+async function safeClose(client) {
+  if (!client) return;
+  try {
+    await client.close();
+  } catch {
+  }
+}
+async function openClient(entry) {
+  const snap = entry.snapshot;
+  const client = new Client(
+    { name: "agentproto-daemon-proxy", version: "0.1.0" },
+    { capabilities: {} }
+  );
+  if (snap.type === "stdio") {
+    if (!snap.command) {
+      throw new Error(
+        `import "${entry.alias}" is stdio but has no command field`
+      );
+    }
+    const expandedEnv = expandEnvPlaceholders(snap.env ?? {});
+    const transport = new StdioClientTransport({
+      command: snap.command,
+      args: snap.args ?? [],
+      env: { ...process.env, ...expandedEnv }
+    });
+    await client.connect(transport);
+    return client;
+  }
+  if (snap.type === "http") {
+    if (!snap.url) throw new Error(`import "${entry.alias}" has no url`);
+    const transport = new StreamableHTTPClientTransport(new URL(snap.url), {
+      requestInit: {
+        headers: snap.headers ?? {}
+      }
+    });
+    await client.connect(transport);
+    return client;
+  }
+  if (snap.type === "sse") {
+    if (!snap.url) throw new Error(`import "${entry.alias}" has no url`);
+    const transport = new SSEClientTransport(new URL(snap.url), {
+      requestInit: {
+        headers: snap.headers ?? {}
+      }
+    });
+    await client.connect(transport);
+    return client;
+  }
+  throw new Error(
+    `import "${entry.alias}" has unsupported transport type "${snap.type}"`
+  );
+}
+var execFileAsync = promisify(execFile);
+var URL_REGEX = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+var STARTUP_TIMEOUT_MS = 3e4;
+function quickTunnelProvider() {
+  let child = null;
+  let configPath = null;
+  return {
+    id: "quick",
+    async start(opts) {
+      await assertCloudflaredOnPath();
+      const targetUrl = `http://${opts.target.host}:${opts.target.port}`;
+      const id = randomBytes(4).toString("hex");
+      const dir = join(opts.workspace, ".agentproto");
+      await mkdir(dir, { recursive: true });
+      configPath = join(dir, `cloudflared-${id}.yml`);
+      const configBody = [
+        `# generated by agentproto-runtime \u2014 sentinel only`,
+        `# overrides ~/.cloudflared/config.yml so its ingress rules`,
+        `# don't shadow the inline --url rule. Safe to delete when the`,
+        `# tunnel is down.`,
+        `no-autoupdate: true`,
+        `loglevel: debug`,
+        ``
+      ].join("\n");
+      await writeFile(configPath, configBody, "utf8");
+      const proc = spawn(
+        "cloudflared",
+        ["tunnel", "--config", configPath, "--url", targetUrl],
+        { stdio: ["ignore", "pipe", "pipe"], shell: false }
+      );
+      child = proc;
+      const url = await new Promise((resolve7, reject) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          try {
+            proc.kill("SIGTERM");
+          } catch {
+          }
+          reject(
+            new Error(
+              `cloudflared did not emit a public URL within ${STARTUP_TIMEOUT_MS / 1e3}s`
+            )
+          );
+        }, STARTUP_TIMEOUT_MS);
+        const onData = (chunk) => {
+          const text3 = chunk.toString("utf8");
+          for (const line of text3.split(/\r?\n/)) {
+            if (line.length > 0) opts.onLog?.(`[cloudflared] ${line}`);
+          }
+          if (settled) return;
+          const match = text3.match(URL_REGEX);
+          if (match) {
+            settled = true;
+            clearTimeout(timer);
+            resolve7(match[0]);
+          }
+        };
+        proc.stderr?.on("data", onData);
+        proc.stdout?.on("data", onData);
+        proc.once("error", (err) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          reject(err);
+        });
+        proc.once("exit", (code, signal) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          reject(
+            new Error(
+              `cloudflared exited before emitting a URL (code=${code}, signal=${signal})`
+            )
+          );
+        });
+      });
+      proc.once("exit", (code, signal) => {
+        opts.onLog?.(
+          `[cloudflared] exited (code=${code ?? "?"} signal=${signal ?? "-"})`
+        );
+      });
+      return { publicUrl: url, pid: proc.pid ?? null };
+    },
+    async stop() {
+      const proc = child;
+      const cfg = configPath;
+      child = null;
+      configPath = null;
+      if (cfg) {
+        try {
+          await rm(cfg, { force: true });
+        } catch {
+        }
+      }
+      if (!proc || proc.exitCode !== null) return;
+      proc.kill("SIGTERM");
+      const timer = setTimeout(() => {
+        try {
+          proc.kill("SIGKILL");
+        } catch {
+        }
+      }, 3e3);
+      timer.unref();
+      await new Promise((resolve7) => {
+        if (proc.exitCode !== null) {
+          clearTimeout(timer);
+          resolve7();
+          return;
+        }
+        proc.once("exit", () => {
+          clearTimeout(timer);
+          resolve7();
+        });
+      });
+    }
+  };
+}
+async function assertCloudflaredOnPath() {
+  try {
+    await execFileAsync("cloudflared", ["--version"], { timeout: 3e3 });
+  } catch {
+    throw new Error(
+      "cloudflared not found on PATH. Install it first:\n  macOS:    brew install cloudflared\n  Linux:    https://pkg.cloudflare.com/index.html\n  Windows:  winget install --id Cloudflare.cloudflared\nOr download a prebuilt binary from https://github.com/cloudflare/cloudflared/releases."
+    );
+  }
+}
+var RemoteController = class {
+  state = null;
+  bearerToken = null;
+  provider = null;
+  lastError;
+  opts;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  /**
+   * Auth getter handed to startHttpServer. The HTTP server calls this
+   * on every request so flipping enable/disable is effective without
+   * a restart.
+   */
+  readAuth = () => {
+    if (this.bearerToken === null) return { mode: "none" };
+    return { mode: "bearer", token: this.bearerToken };
+  };
+  status() {
+    if (!this.state) {
+      return { enabled: false, lastError: this.lastError };
+    }
+    return {
+      enabled: true,
+      provider: this.state.provider,
+      publicUrl: this.state.publicUrl,
+      pid: this.state.pid,
+      createdAt: this.state.createdAt,
+      target: this.state.target,
+      exposesGateway: this.state.exposesGateway,
+      lastError: this.lastError
+    };
+  }
+  async enable(input2) {
+    if (this.state) {
+      throw new Error(
+        "remote tunnel already active \u2014 call remote_disable first to rotate"
+      );
+    }
+    const providerId = input2.provider ?? "quick";
+    const provider = pickProvider(providerId);
+    this.lastError = void 0;
+    const target = {
+      host: input2.targetHost ?? "127.0.0.1",
+      port: input2.targetPort ?? this.opts.port
+    };
+    const exposesGateway = target.host === "127.0.0.1" && target.port === this.opts.port;
+    let started;
+    try {
+      started = await provider.start({
+        target,
+        workspace: this.opts.workspace,
+        onLog: (line) => {
+          this.opts.onLog?.(line);
+        }
+      });
+    } catch (err) {
+      this.lastError = errToMessage(err);
+      throw err;
+    }
+    let bearerToken = null;
+    let bearerTokenHash = "";
+    if (exposesGateway) {
+      bearerToken = randomBytes(32).toString("base64url");
+      bearerTokenHash = sha256(bearerToken);
+    }
+    const state = {
+      provider: providerId,
+      publicUrl: started.publicUrl,
+      bearerTokenHash,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      pid: started.pid,
+      target,
+      exposesGateway
+    };
+    this.state = state;
+    this.bearerToken = bearerToken;
+    this.provider = provider;
+    await persistState(this.opts.workspace, state);
+    const result = {
+      provider: providerId,
+      publicUrl: started.publicUrl,
+      target,
+      exposesGateway
+    };
+    if (exposesGateway && bearerToken) {
+      const mcpEndpoint = `${started.publicUrl}/mcp`;
+      result.bearerToken = bearerToken;
+      result.mcpEndpoint = mcpEndpoint;
+      result.mcpConfigSnippet = buildMcpConfigSnippet(mcpEndpoint, bearerToken);
+    }
+    return result;
+  }
+  async disable() {
+    if (!this.state) return { disabled: false };
+    const provider = this.provider;
+    this.state = null;
+    this.bearerToken = null;
+    this.provider = null;
+    if (provider) {
+      try {
+        await provider.stop();
+      } catch (err) {
+        this.lastError = errToMessage(err);
+      }
+    }
+    await clearState(this.opts.workspace);
+    return { disabled: true };
+  }
+  /**
+   * Stop the provider on gateway shutdown. Does NOT clear persisted
+   * state — that survives across restarts so the user can `remote_status`
+   * after rebooting and see "stale state, run remote_enable to refresh".
+   * (Stale-recovery semantics land in v2; today we just leave the file.)
+   */
+  async shutdown() {
+    if (this.provider) {
+      try {
+        await this.provider.stop();
+      } catch {
+      }
+    }
+  }
+};
+function pickProvider(id) {
+  if (id === "quick") return quickTunnelProvider();
+  const _exhaustive = id;
+  throw new Error(`unknown remote provider: ${String(_exhaustive)}`);
+}
+function sha256(input2) {
+  return createHash("sha256").update(input2).digest("hex");
+}
+function errToMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function persistState(workspace, state) {
+  const dir = join(workspace, ".agentproto");
+  await mkdir(dir, { recursive: true });
+  const file = join(dir, "remote.json");
+  await writeFile(file, JSON.stringify(state, null, 2) + "\n", "utf8");
+  try {
+    await chmod(file, 384);
+  } catch {
+  }
+}
+async function clearState(workspace) {
+  const file = join(workspace, ".agentproto/remote.json");
+  if (!existsSync(file)) return;
+  await rm(file, { force: true });
+}
+function buildMcpConfigSnippet(endpoint, token) {
+  return JSON.stringify(
+    {
+      mcpServers: {
+        "agentproto-remote": {
+          transport: "http",
+          url: endpoint,
+          headers: { Authorization: `Bearer ${token}` }
+        }
+      }
+    },
+    null,
+    2
+  );
+}
+function text2(value) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: typeof value === "string" ? value : JSON.stringify(value, null, 2)
+      }
+    ]
+  };
+}
+function registerRemoteTools(server, opts) {
+  const { controller } = opts;
+  server.tool(
+    "remote_enable",
+    "Publish a local port to the internet via Cloudflare. By default exposes this gateway and gates it with a bearer token (returned ONCE in the response \u2014 store it; only its hash is persisted). Pass `targetPort` to tunnel a different local service (Supabase, dev server, \u2026); in that mode the daemon does not gate the proxied traffic \u2014 the upstream service handles its own auth. Returns the public URL plus a paste-ready `.mcp.json` snippet (gateway mode only). Re-running while a tunnel is already up errors; call `remote_disable` first to rotate.",
+    {
+      provider: z.enum(["quick"]).optional().describe(
+        "Tunnel backend. `quick` = Cloudflare Quick Tunnel (no API key, ephemeral *.trycloudflare.com URL). Defaults to `quick`. Named-CF / Tailscale providers TBD."
+      ),
+      targetPort: z.number().int().min(1).max(65535).optional().describe(
+        "Local port to expose. Defaults to this gateway's own port (= publish the MCP server). Pass another port to tunnel a different local service (e.g. 54371 for Supabase) \u2014 in that mode bearer auth is OFF since the upstream handles its own gating."
+      ),
+      targetHost: z.string().optional().describe(
+        "Host the tunnel forwards to. Defaults to `127.0.0.1`. Use `localhost` only if the target is explicitly IPv6-bound; cloudflared resolves DNS and IPv6-first lookups can break IPv4-only origins."
+      )
+    },
+    async ({ provider, targetPort, targetHost }) => {
+      const result = await controller.enable({ provider, targetPort, targetHost });
+      return text2(result);
+    }
+  );
+  server.tool(
+    "remote_disable",
+    "Tear down the active remote tunnel and drop bearer auth back to loopback-only. Idempotent \u2014 calling when no tunnel is active is a no-op.",
+    {},
+    async () => {
+      const result = await controller.disable();
+      return text2(result);
+    }
+  );
+  server.tool(
+    "remote_status",
+    "Report whether a remote tunnel is active. When active: provider, public URL, supervised PID, createdAt. The bearer token itself is never returned by status \u2014 it was shown once at enable.",
+    {},
+    async () => {
+      return text2(controller.status());
+    }
+  );
+}
+var WorkspacePathError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WorkspacePathError";
+  }
+};
+function createWorkspaceFs(opts) {
+  const root = resolve(opts.workspace);
+  function resolvePath32(path) {
+    if (typeof path !== "string" || path.length === 0) {
+      throw new WorkspacePathError("path must be a non-empty string");
+    }
+    if (isAbsolute(path)) {
+      throw new WorkspacePathError(
+        "absolute paths are not allowed; use a workspace-relative path"
+      );
+    }
+    const joined = normalize(join(root, path));
+    const rel = relative(root, joined);
+    if (rel.startsWith("..") || isAbsolute(rel)) {
+      throw new WorkspacePathError(
+        `path escapes the workspace: '${path}'`
+      );
+    }
+    return joined;
+  }
+  return {
+    async readFile(path) {
+      const abs = resolvePath32(path);
+      const buf = await readFile(abs);
+      return buf.toString("utf8");
+    },
+    async writeFile(path, content) {
+      const abs = resolvePath32(path);
+      await mkdir(dirname(abs), { recursive: true });
+      await writeFile(abs, content);
+    },
+    async exists(path) {
+      try {
+        const abs = resolvePath32(path);
+        return existsSync(abs);
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+async function createGateway(opts) {
+  const workspace = resolve(opts.workspace);
+  if (!existsSync(workspace)) {
+    throw new Error(`runtime: workspace dir does not exist: ${workspace}`);
+  }
+  const port = opts.port ?? 18790;
+  const events = createRuntimeEvents();
+  const conversations = fileConversationStore({ workspace });
+  const workspaceFs = createWorkspaceFs({ workspace });
+  const remote = new RemoteController({
+    workspace,
+    port,
+    onLog: (line) => events.emit({
+      type: "remote-log",
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      line
+    })
+  });
+  const { registered } = await createMcpServer({
+    specs: opts.specs,
+    workspace,
+    name: opts.name ?? "agentproto-runtime",
+    version: opts.version ?? "0.1.0-alpha"
+  });
+  const sessions = createSessionsRegistry();
+  const mcpProxy = new McpProxyRegistry();
+  const mcpServerFactory = async () => {
+    const { server } = await createMcpServer({
+      specs: opts.specs,
+      workspace,
+      name: opts.name ?? "agentproto-runtime",
+      version: opts.version ?? "0.1.0-alpha"
+    });
+    registerFsTools(server, { workspace });
+    registerCommandTools(server, { workspace });
+    registerRemoteTools(server, { controller: remote });
+    registerSessionTools(server, {
+      registry: sessions,
+      mcpProxy,
+      ...opts.resolveAgentAdapter ? { resolveAgentAdapter: opts.resolveAgentAdapter } : {},
+      ...opts.listAgentAdapters ? { listAgentAdapters: opts.listAgentAdapters } : {}
+    });
+    return server;
+  };
+  if (opts.boot !== false) {
+    await runBoot(workspace, opts, conversations, events).catch((err) => {
+      events.emit({
+        type: "heartbeat-error",
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        agent: opts.defaultBootAgent,
+        error: `BOOT.md failed: ${err instanceof Error ? err.message : String(err)}`
+      });
+    });
+  }
+  const heartbeat = startHeartbeat({
+    workspace,
+    conversations,
+    events,
+    buildAgent: opts.buildAgent ?? noopBuildAgent
+  });
+  const http = await startHttpServer({
+    port,
+    bind: opts.bind,
+    // Auth is read on every request via this getter. `opts.auth`
+    // (when provided) is the startup default and represents the
+    // operator's intent — bearer-only deployments stay bearer-only
+    // even when no remote tunnel is up. The controller's auth wins
+    // once a tunnel is enabled (it issues a fresh token); on disable
+    // we fall back to `opts.auth` if set, otherwise `mode: "none"`.
+    auth: () => {
+      const remoteAuth = remote.readAuth();
+      if (remoteAuth.mode === "bearer") return remoteAuth;
+      return opts.auth ?? { mode: "none" };
+    },
+    mcpServerFactory,
+    conversations,
+    events,
+    heartbeat,
+    sessions,
+    mcpProxy,
+    ...opts.resolveAgentAdapter ? { resolveAgentAdapter: opts.resolveAgentAdapter } : {},
+    ...opts.listAgentAdapters ? { listAgentAdapters: opts.listAgentAdapters } : {},
+    meta: { workspace, registered }
+  });
+  heartbeat.start();
+  events.emit({
+    type: "boot",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    workspace,
+    registered
+  });
+  void writeRuntimeMeta(workspace, {
+    workspace,
+    port,
+    bind: opts.bind ?? "127.0.0.1",
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    name: opts.name ?? "agentproto-runtime",
+    registered
+  });
+  return {
+    url: http.url,
+    workspace,
+    workspaceFs,
+    registered,
+    sessions,
+    async stop() {
+      heartbeat.stop();
+      sessions.shutdown();
+      await mcpProxy.closeAll();
+      await remote.shutdown();
+      await http.stop();
+    }
+  };
+}
+var noopBuildAgent = async () => null;
+async function runBoot(workspace, opts, conversations, events) {
+  const path = join(workspace, "BOOT.md");
+  if (!existsSync(path)) return;
+  const body = (await readFile(path, "utf8")).trim();
+  if (!body) return;
+  if (!opts.buildAgent || !opts.defaultBootAgent) return;
+  const agent = await opts.buildAgent(opts.defaultBootAgent);
+  if (!agent) return;
+  const conversationId = `boot-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace(/[:.]/g, "-")}`;
+  await conversations.open(conversationId, { agent: opts.defaultBootAgent });
+  await conversations.appendTurn(conversationId, "user", body, {
+    attribution: "boot"
+  });
+  const reply = await agent.generate(body);
+  await conversations.appendTurn(conversationId, "assistant", reply.text, {
+    attribution: opts.defaultBootAgent
+  });
+  events.emit({
+    type: "heartbeat-fired",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    agent: opts.defaultBootAgent,
+    conversationId,
+    prompt: body,
+    reply: reply.text,
+    durationMs: 0
+  });
+}
 async function runServe(args) {
   const { values } = parseArgs({
     args: [...args],
@@ -1024,8 +4692,8 @@ async function runServe(args) {
   });
   const workspace = resolve(values.workspace ?? process.cwd());
   try {
-    const stat = await promises.stat(workspace);
-    if (!stat.isDirectory()) {
+    const stat2 = await promises.stat(workspace);
+    if (!stat2.isDirectory()) {
       process.stderr.write(
         `agentproto serve: --workspace "${workspace}" is not a directory.
 `
@@ -1139,8 +4807,8 @@ agentproto serve: ${signal} \u2014 shutting down.
       `agentproto serve: running local-only (no --connect). Press Ctrl-C to stop.
 `
     );
-    await new Promise((resolve) => {
-      aborter.signal.addEventListener("abort", () => resolve());
+    await new Promise((resolve3) => {
+      aborter.signal.addEventListener("abort", () => resolve3());
     });
     return 0;
   }
@@ -1175,10 +4843,10 @@ async function runOneTunnel(opts, gateway, signal) {
   };
   if (opts.token) headers.authorization = `Bearer ${opts.token}`;
   const ws = new WebSocket(opts.connect, { headers });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve3, reject) => {
     const onOpen = () => {
       ws.off("error", onError);
-      resolve();
+      resolve3();
     };
     const onError = (err) => {
       ws.off("open", onOpen);
@@ -1223,28 +4891,28 @@ async function runOneTunnel(opts, gateway, signal) {
       });
     }
   });
-  await new Promise((resolve) => {
+  await new Promise((resolve3) => {
     const offClose = sink.onClose(() => {
       offClose();
-      resolve();
+      resolve3();
     });
     if (signal.aborted) {
-      server.close().finally(() => resolve());
+      server.close().finally(() => resolve3());
     }
     signal.addEventListener("abort", () => {
-      server.close().finally(() => resolve());
+      server.close().finally(() => resolve3());
     });
   });
   process.stderr.write(`agentproto serve: tunnel closed.
 `);
 }
 function sleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal.aborted) return resolve();
-    const timer = setTimeout(resolve, ms);
+  return new Promise((resolve3) => {
+    if (signal.aborted) return resolve3();
+    const timer = setTimeout(resolve3, ms);
     signal.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve();
+      resolve3();
     });
   });
 }