@agentproto/runtime 3.1.0 → 3.2.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { join, resolve, dirname, basename, isAbsolute, normalize, relative, extname, sep, delimiter } from 'path';
-import { createReadStream, promises, readdirSync, readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, chmodSync, openSync, closeSync, realpathSync, statSync, createWriteStream } from 'fs';
+import { createReadStream, promises, readFileSync, mkdirSync, writeFileSync, renameSync, readdirSync, existsSync, chmodSync, openSync, closeSync, realpathSync, statSync, createWriteStream } from 'fs';
 import { homedir, hostname, tmpdir } from 'os';
 import { createInterface } from 'readline';
 import { timingSafeEqual, createHmac, randomBytes, randomUUID, createHash } from 'crypto';
@@ -15,7 +15,7 @@ import { resolveCustomRoute, registerCustomRoute, formatModelRef, resolveLlmMode
 import { findAnthropicGatewayPreset, anthropicGatewayPresetList, getAnthropicGatewayPreset } from '@agentproto/provider-presets';
 import * as providers_store_star from '@agentproto/providers-store';
 import { makeCredsStore, makeAdapterResolver, makeAdapterLister, discoverAdapterPackages, makeSetupLedger, makeListTool, makeSetupTool } from '@agentproto/provider-kit';
-import { SandboxSpecSchema, resolveLifecyclePolicy, createSandboxAgentSessionHost } from '@agentproto/sandbox';
+import { SandboxSpecSchema, resolveLifecyclePolicy, createSandboxAgentSessionHost, isSandboxBoxGoneError, SandboxHostBootFailedError } from '@agentproto/sandbox';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { createServer as createServer$1 } from 'net';
@@ -25,7 +25,7 @@ import { inferLegacyModeKind, parseModelSwitchCommand, isModelSwitchAcknowledgem
 import { loadSandboxConfig, resolveCommandSandbox, COMMAND_SANDBOX_MODE_ENV } from '@agentproto/command-sandbox';
 import { createBrainManager, parseKnowledgeConfig } from '@agentproto/workspace-brain';
 import { defineHttpDriver } from '@agentproto/driver-http';
-import { makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeLiveSessionApp, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, liveSessionApp } from '@agentproto/apps';
+import { makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeLiveSessionApp, makeSessionChatApp, makeWorkBoardApp, SESSION_CHAT_APP_ID, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, liveSessionApp, sessionChatApp, workBoardApp } from '@agentproto/apps';
 import matter2 from 'gray-matter';
 import { createServer } from 'http';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
@@ -2647,6 +2647,135 @@ async function readCommandLogEntry(sessionId, baseDir) {
     return null;
   }
 }
+var sandboxLedgerPath = () => process.env.AGENTPROTO_SANDBOX_LEDGER ?? resolve(homedir(), ".agentproto", "sandboxes.json");
+var tmpSeq = 0;
+var serialize = (snapshot) => JSON.stringify(snapshot, null, 2) + "\n";
+var isLedgerState = (value) => value === "booted" || value === "paused" || value === "connected" || value === "stopped" || value === "gone";
+var isEntry = (value) => {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("sandboxId" in value) || !("provider" in value) || !("state" in value) || !("createdAt" in value) || !("updatedAt" in value)) {
+    return false;
+  }
+  return typeof value.sandboxId === "string" && value.sandboxId.length > 0 && typeof value.provider === "string" && isLedgerState(value.state) && typeof value.createdAt === "string" && typeof value.updatedAt === "string";
+};
+function readSandboxLedger(path) {
+  try {
+    const parsed = JSON.parse(
+      readFileSync(path ?? sandboxLedgerPath(), "utf8")
+    );
+    if (!Array.isArray(parsed.sandboxes)) return [];
+    return parsed.sandboxes.filter(isEntry);
+  } catch {
+    return [];
+  }
+}
+function upsertSandboxLedger(entry, path) {
+  try {
+    const target = path ?? sandboxLedgerPath();
+    const dir = join(target, "..");
+    mkdirSync(dir, { recursive: true });
+    const existing = readSandboxLedger(target);
+    const merged = [entry, ...existing.filter((e) => e.sandboxId !== entry.sandboxId)];
+    const snapshot = {
+      savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      sandboxes: merged
+    };
+    const tmp = `${target}.tmp.${process.pid}.${++tmpSeq}`;
+    writeFileSync(tmp, serialize(snapshot), "utf8");
+    renameSync(tmp, target);
+  } catch {
+  }
+}
+function removeSandboxLedgerEntry(sandboxId, path) {
+  try {
+    const target = path ?? sandboxLedgerPath();
+    const existing = readSandboxLedger(target);
+    if (!existing.some((e) => e.sandboxId === sandboxId)) return false;
+    const snapshot = {
+      savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      sandboxes: existing.filter((e) => e.sandboxId !== sandboxId)
+    };
+    const tmp = `${target}.tmp.${process.pid}.${++tmpSeq}`;
+    writeFileSync(tmp, serialize(snapshot), "utf8");
+    renameSync(tmp, target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
+function recordSandboxBoot(opts) {
+  try {
+    const target = opts.path ?? sandboxLedgerPath();
+    const existing = readSandboxLedger(target);
+    const prior = existing.find((e) => e.sandboxId === opts.sandboxId);
+    const ts = nowIso();
+    const entry = {
+      sandboxId: opts.sandboxId,
+      provider: opts.provider,
+      state: opts.state,
+      createdAt: prior?.createdAt ?? ts,
+      updatedAt: ts,
+      ...opts.label ? { label: opts.label } : prior?.label ? { label: prior.label } : {},
+      ...opts.cwd ? { cwd: opts.cwd } : prior?.cwd ? { cwd: prior.cwd } : {},
+      ...opts.originSessionId ? { originSessionId: opts.originSessionId } : prior?.originSessionId ? { originSessionId: prior.originSessionId } : {},
+      ...opts.expiresAt ? { expiresAt: opts.expiresAt } : {}
+    };
+    upsertSandboxLedger(entry, target);
+  } catch {
+  }
+}
+function recordSandboxState(sandboxId, state, path) {
+  try {
+    const target = path ?? sandboxLedgerPath();
+    const prior = readSandboxLedger(target).find((e) => e.sandboxId === sandboxId);
+    if (!prior) return;
+    upsertSandboxLedger(
+      { ...prior, state, updatedAt: nowIso() },
+      target
+    );
+  } catch {
+  }
+}
+function recordSandboxLiveness(sandboxId, alive, path) {
+  try {
+    const target = path ?? sandboxLedgerPath();
+    const prior = readSandboxLedger(target).find((e) => e.sandboxId === sandboxId);
+    if (!prior) return;
+    upsertSandboxLedger(
+      {
+        ...prior,
+        ...alive ? {} : { state: "gone" },
+        sandboxAlive: alive,
+        sandboxCheckedAt: nowIso(),
+        updatedAt: nowIso()
+      },
+      target
+    );
+  } catch {
+  }
+}
+function recordSandboxOrigin(sandboxId, originSessionId, path) {
+  try {
+    const target = path ?? sandboxLedgerPath();
+    const prior = readSandboxLedger(target).find((e) => e.sandboxId === sandboxId);
+    if (!prior) return;
+    upsertSandboxLedger(
+      { ...prior, originSessionId, updatedAt: nowIso() },
+      target
+    );
+  } catch {
+  }
+}
+function resolveReuseFromLedger(reuse, entries) {
+  const matches = entries.filter(
+    (e) => e.label === reuse || e.sandboxId.startsWith(reuse)
+  );
+  const sole = matches.length === 1 ? matches[0] : void 0;
+  if (sole) return { kind: "resolved", sandboxId: sole.sandboxId, entry: sole };
+  if (matches.length > 1) return { kind: "ambiguous", candidates: matches };
+  return { kind: "unresolved" };
+}
 
 // src/tool-call-log.ts
 init_transcript_writer();
@@ -4997,15 +5126,15 @@ function listBuckets(root) {
     return [];
   }
 }
-var serialize = (snapshot) => JSON.stringify(snapshot, null, 2) + "\n";
-var tmpSeq = 0;
-var tmpPathFor = (target) => `${target}.tmp.${process.pid}.${++tmpSeq}`;
+var serialize2 = (snapshot) => JSON.stringify(snapshot, null, 2) + "\n";
+var tmpSeq2 = 0;
+var tmpPathFor = (target) => `${target}.tmp.${process.pid}.${++tmpSeq2}`;
 async function writeBucketSnapshot(root, slug, snapshot) {
   const dir = bucketDir(root, slug);
   await promises.mkdir(dir, { recursive: true });
   const target = bucketSessionsFile(root, slug);
   const tmp = tmpPathFor(target);
-  await promises.writeFile(tmp, serialize(snapshot), "utf8");
+  await promises.writeFile(tmp, serialize2(snapshot), "utf8");
   await promises.rename(tmp, target);
 }
 function writeBucketSnapshotSync(root, slug, snapshot) {
@@ -5013,7 +5142,7 @@ function writeBucketSnapshotSync(root, slug, snapshot) {
   mkdirSync(dir, { recursive: true });
   const target = bucketSessionsFile(root, slug);
   const tmp = tmpPathFor(target);
-  writeFileSync(tmp, serialize(snapshot), "utf8");
+  writeFileSync(tmp, serialize2(snapshot), "utf8");
   renameSync(tmp, target);
 }
 function migrateLegacySessionsFile(opts) {
@@ -5181,117 +5310,6 @@ function setMcpCredentialDeps(d) {
 function getMcpCredentialDeps() {
   return deps;
 }
-var sandboxLedgerPath = () => process.env.AGENTPROTO_SANDBOX_LEDGER ?? resolve(homedir(), ".agentproto", "sandboxes.json");
-var tmpSeq2 = 0;
-var serialize2 = (snapshot) => JSON.stringify(snapshot, null, 2) + "\n";
-var isLedgerState = (value) => value === "booted" || value === "paused" || value === "connected" || value === "stopped";
-var isEntry = (value) => {
-  if (typeof value !== "object" || value === null) return false;
-  if (!("sandboxId" in value) || !("provider" in value) || !("state" in value) || !("createdAt" in value) || !("updatedAt" in value)) {
-    return false;
-  }
-  return typeof value.sandboxId === "string" && value.sandboxId.length > 0 && typeof value.provider === "string" && isLedgerState(value.state) && typeof value.createdAt === "string" && typeof value.updatedAt === "string";
-};
-function readSandboxLedger(path) {
-  try {
-    const parsed = JSON.parse(
-      readFileSync(path ?? sandboxLedgerPath(), "utf8")
-    );
-    if (!Array.isArray(parsed.sandboxes)) return [];
-    return parsed.sandboxes.filter(isEntry);
-  } catch {
-    return [];
-  }
-}
-function upsertSandboxLedger(entry, path) {
-  try {
-    const target = path ?? sandboxLedgerPath();
-    const dir = join(target, "..");
-    mkdirSync(dir, { recursive: true });
-    const existing = readSandboxLedger(target);
-    const merged = [entry, ...existing.filter((e) => e.sandboxId !== entry.sandboxId)];
-    const snapshot = {
-      savedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      sandboxes: merged
-    };
-    const tmp = `${target}.tmp.${process.pid}.${++tmpSeq2}`;
-    writeFileSync(tmp, serialize2(snapshot), "utf8");
-    renameSync(tmp, target);
-  } catch {
-  }
-}
-function removeSandboxLedgerEntry(sandboxId, path) {
-  try {
-    const target = path ?? sandboxLedgerPath();
-    const existing = readSandboxLedger(target);
-    if (!existing.some((e) => e.sandboxId === sandboxId)) return false;
-    const snapshot = {
-      savedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      sandboxes: existing.filter((e) => e.sandboxId !== sandboxId)
-    };
-    const tmp = `${target}.tmp.${process.pid}.${++tmpSeq2}`;
-    writeFileSync(tmp, serialize2(snapshot), "utf8");
-    renameSync(tmp, target);
-    return true;
-  } catch {
-    return false;
-  }
-}
-var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
-function recordSandboxBoot(opts) {
-  try {
-    const target = opts.path ?? sandboxLedgerPath();
-    const existing = readSandboxLedger(target);
-    const prior = existing.find((e) => e.sandboxId === opts.sandboxId);
-    const ts = nowIso();
-    const entry = {
-      sandboxId: opts.sandboxId,
-      provider: opts.provider,
-      state: opts.state,
-      createdAt: prior?.createdAt ?? ts,
-      updatedAt: ts,
-      ...opts.label ? { label: opts.label } : prior?.label ? { label: prior.label } : {},
-      ...opts.cwd ? { cwd: opts.cwd } : prior?.cwd ? { cwd: prior.cwd } : {},
-      ...opts.originSessionId ? { originSessionId: opts.originSessionId } : prior?.originSessionId ? { originSessionId: prior.originSessionId } : {},
-      ...opts.expiresAt ? { expiresAt: opts.expiresAt } : {}
-    };
-    upsertSandboxLedger(entry, target);
-  } catch {
-  }
-}
-function recordSandboxState(sandboxId, state, path) {
-  try {
-    const target = path ?? sandboxLedgerPath();
-    const prior = readSandboxLedger(target).find((e) => e.sandboxId === sandboxId);
-    if (!prior) return;
-    upsertSandboxLedger(
-      { ...prior, state, updatedAt: nowIso() },
-      target
-    );
-  } catch {
-  }
-}
-function recordSandboxOrigin(sandboxId, originSessionId, path) {
-  try {
-    const target = path ?? sandboxLedgerPath();
-    const prior = readSandboxLedger(target).find((e) => e.sandboxId === sandboxId);
-    if (!prior) return;
-    upsertSandboxLedger(
-      { ...prior, originSessionId, updatedAt: nowIso() },
-      target
-    );
-  } catch {
-  }
-}
-function resolveReuseFromLedger(reuse, entries) {
-  const matches = entries.filter(
-    (e) => e.label === reuse || e.sandboxId.startsWith(reuse)
-  );
-  const sole = matches.length === 1 ? matches[0] : void 0;
-  if (sole) return { kind: "resolved", sandboxId: sole.sandboxId, entry: sole };
-  if (matches.length > 1) return { kind: "ambiguous", candidates: matches };
-  return { kind: "unresolved" };
-}
 
 // src/sandbox-agent-session-proxy.ts
 var MAX_POLL_MS = 49e3;
@@ -5648,6 +5666,24 @@ async function installApp(client, dir) {
   }
   return appId;
 }
+function serveLogPath(dir) {
+  return `${dir.replace(/\/+$/, "")}/.agentproto/app-serve.log`;
+}
+function extractServeError(logText) {
+  const lines = logText.split("\n").map((l) => l.trimEnd()).filter((l) => l.includes("agentproto app serve:") && !l.includes("serving "));
+  if (lines.length === 0) return void 0;
+  return lines[lines.length - 1];
+}
+async function readServeError(client, dir) {
+  try {
+    const res = await client.callTool("file_read", { path: serveLogPath(dir) });
+    const text10 = firstText(res);
+    if (text10 === void 0) return void 0;
+    return extractServeError(text10);
+  } catch {
+    return void 0;
+  }
+}
 async function launchServeProcess(client, dir, port) {
   const script = buildServeLaunchScript(dir, port);
   const res = await client.callTool("command_execute", {
@@ -5703,9 +5739,13 @@ async function startSandboxAppServe(host, req, opts) {
       ...opts?.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
       ...opts?.intervalMs !== void 0 ? { intervalMs: opts.intervalMs } : {}
     });
+    let message;
+    if (!ready) {
+      message = await readServeError(client, req.dir);
+    }
     return {
       ok: true,
-      appServe: { appId, dir: req.dir, port, url, ready }
+      appServe: { appId, dir: req.dir, port, url, ready, ...message !== void 0 ? { message } : {} }
     };
   } catch (err) {
     return {
@@ -6452,6 +6492,12 @@ function gcSpawnClaims(claims, now) {
   resolved.sort((a, b) => a[1].resolvedAt - b[1].resolvedAt);
   for (const [k] of resolved.slice(0, excess)) claims.delete(k);
 }
+function findWorktreeLabelCwdCollision(registry, excludeId, label, cwd) {
+  if (!label) return void 0;
+  return registry.list().find(
+    (s) => s.id !== excludeId && s.label === label && s.cwd === cwd && (s.status === "running" || s.status === "starting")
+  );
+}
 function profileMethodToAuthMode(method) {
   return method === "oauth-bearer" ? "subscription" : "api-key";
 }
@@ -6844,6 +6890,9 @@ async function spawnAgentSession(deps2, input) {
         };
       }
       worktreeRequest = decision.request;
+      if (worktreeRequest.async === void 0) {
+        worktreeRequest = { ...worktreeRequest, async: !input.wait };
+      }
       worktreeAutoProvisioned = decision.implicit;
     }
   }
@@ -7347,6 +7396,16 @@ async function spawnAgentSession(deps2, input) {
           return;
         }
         const finalCwd = outcome.isolated ? outcome.cwd : baseCwd;
+        if (outcome.isolated) {
+          const dupe = findWorktreeLabelCwdCollision(registry, pendingDesc.id, input.label, finalCwd);
+          if (dupe) {
+            registry.settlePendingAgent(pendingDesc.id, {
+              ok: false,
+              message: `agent_start: refused \u2014 another LIVE session ("${dupe.id}") already has the same label ("${input.label}") and cwd ("${finalCwd}") as this worktree spawn. Not starting a second agent in the same worktree.`
+            });
+            return;
+          }
+        }
         try {
           const agentSession2 = await resolved.startSession({
             cwd: finalCwd,
@@ -7382,16 +7441,6 @@ ${asyncPrompt}`;
           }
           const commandPreview2 = resolved.commandPreview;
           const readUsage2 = resolved.readUsage ? () => resolved.readUsage(agentSession2.sessionId) : void 0;
-          if (pendingDesc.label) {
-            const dupe = registry.list().find(
-              (s) => s.id !== pendingDesc.id && s.label === pendingDesc.label && s.cwd === finalCwd && (s.status === "running" || s.status === "starting")
-            );
-            if (dupe) {
-              console.warn(
-                `[agent_start] another LIVE session ("${dupe.id}") already has the same label ("${pendingDesc.label}") and cwd ("${finalCwd}") as this one. If this is a retried spawn rather than a deliberate parallel run, both are now editing the same working directory concurrently \u2014 check before proceeding.`
-              );
-            }
-          }
           registry.settlePendingAgent(pendingDesc.id, {
             ok: true,
             agentSession: agentSession2,
@@ -7428,13 +7477,26 @@ ${asyncPrompt}`;
           message: `agent_start: worktree provisioning failed \u2014 ${err instanceof Error ? err.message : String(err)}`
         });
       }
-      if (outcome.isolated) cwd = outcome.cwd;
+      if (outcome.isolated) {
+        cwd = outcome.cwd;
+        const dupe = findWorktreeLabelCwdCollision(registry, mintedSessionId, input.label, cwd);
+        if (dupe) {
+          return finish({
+            ok: true,
+            descriptor: dupe,
+            deduped: true,
+            dedupeSource: "worktree-cwd",
+            ...spawnWarnings.length ? { warnings: spawnWarnings } : {}
+          });
+        }
+      }
     }
     let liveSessionId;
     let agentSession;
     let commandPreview;
     let readUsage;
     let sandboxId;
+    let sandboxProvider;
     let sandboxTeardown;
     let sandboxPorts;
     let appServe;
@@ -7471,6 +7533,7 @@ ${asyncPrompt}`;
       agentSession = booted.agentSession;
       commandPreview = booted.commandPreview;
       sandboxId = booted.sandboxId;
+      sandboxProvider = booted.provider;
       sandboxTeardown = booted.sandboxTeardown;
       sandboxPorts = booted.sandboxPorts;
       appServe = booted.appServe;
@@ -7635,6 +7698,7 @@ ${effectivePrompt}`;
         }
       } : {},
       ...sandboxId ? { remote: true, sandboxId } : {},
+      ...sandboxProvider ? { sandboxProvider } : {},
       ...sandboxTeardown ? { sandboxTeardown } : {},
       ...sandboxPorts ? { sandboxPorts } : {},
       ...appServe ? { appServe } : {},
@@ -7864,6 +7928,18 @@ async function bootSandboxAgentSession(opts) {
       secrets: { slugs, resolver: resolveSandboxSecret }
     });
   } catch (err) {
+    if (reuseSandboxId !== void 0 && isSandboxBoxGoneError(err)) {
+      recordSandboxLiveness(reuseSandboxId, false);
+    }
+    if (err instanceof SandboxHostBootFailedError) {
+      markFailedBootLedger({
+        sandboxId: err.sandboxId,
+        provider: providerSlug,
+        state: err.cleanedUp,
+        ...opts.label ? { label: opts.label } : {},
+        ...opts.cwd ? { cwd: opts.cwd } : {}
+      });
+    }
     return reuseSandboxId !== void 0 ? {
       ok: false,
       code: "sandbox_reconnect_failed",
@@ -7897,6 +7973,7 @@ async function bootSandboxAgentSession(opts) {
     remoteSessionId = remoteDesc.id;
   } catch (err) {
     await host.stop().catch(() => void 0);
+    recordSandboxState(host.sandboxId, "stopped");
     return {
       ok: false,
       code: "sandbox_proxy_failed",
@@ -7908,6 +7985,7 @@ async function bootSandboxAgentSession(opts) {
     const serve = await startSandboxAppServe(host, opts.appServe);
     if (!serve.ok) {
       await host.stop().catch(() => void 0);
+      recordSandboxState(host.sandboxId, "stopped");
       return {
         ok: false,
         code: "sandbox_app_serve_failed",
@@ -7926,6 +8004,7 @@ async function bootSandboxAgentSession(opts) {
     }),
     commandPreview: `sandbox:${providerSlug} \u2192 ${opts.adapter}`,
     sandboxId: host.sandboxId,
+    provider: providerSlug,
     sandboxTeardown: lifecyclePolicy.teardown,
     ...host.ports && Object.keys(host.ports).length > 0 ? { sandboxPorts: host.ports } : {},
     ...appServe ? { appServe } : {},
@@ -7955,6 +8034,27 @@ function sandboxAuthFromResolved(auth) {
     ...auth.mode === "api-key" ? auth.credential !== void 0 ? { apiKey: auth.credential } : {} : auth.credential !== void 0 ? { token: auth.credential } : {}
   };
 }
+function markFailedBootLedger(opts) {
+  try {
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const prior = readSandboxLedger().find((e) => e.sandboxId === opts.sandboxId);
+    if (prior) {
+      recordSandboxState(opts.sandboxId, opts.state);
+      return;
+    }
+    const entry = {
+      sandboxId: opts.sandboxId,
+      provider: opts.provider,
+      state: opts.state,
+      createdAt: ts,
+      updatedAt: ts,
+      ...opts.label ? { label: opts.label } : {},
+      ...opts.cwd ? { cwd: opts.cwd } : {}
+    };
+    upsertSandboxLedger(entry);
+  } catch {
+  }
+}
 async function resolveSandboxSecret(slug) {
   const { resolveSandboxSecret: resolve31 } = getMcpCredentialDeps();
   if (!resolve31) return null;
@@ -8201,7 +8301,7 @@ function registerAgentTools(server, opts) {
           "Caller-declared 'this is the same logical spawn' token \u2014 a PROMISE, not a guess. A retried agent_start call (e.g. after a slow/lost response) that repeats the same `idempotencyKey` for the same `adapter`+`cwd` within ~10min of a successful spawn gets that SAME session's descriptor back instead of forking a second process \u2014 the response carries `deduped: true` and `dedupeSource: \"explicit\"` so you can tell. Always wins over the daemon's own derived key (see `dedupe` below) when both would apply. Omitting this does NOT mean 'spawn unconditionally' \u2014 see `dedupe`."
         ),
         dedupe: mcpBool.optional().describe(
-          'Per-call override for the daemon\'s `spawn.dedupe` policy \u2014 what happens when NO `idempotencyKey` is supplied. By DEFAULT (`spawn.dedupe: "always"`) a spawn that carries a `label` gets an IMPLICIT key derived from that label plus a hash of `prompt`, and dedupes against it exactly like an explicit key \u2014 set `dedupeSource: "implicit"` on the response (alongside `deduped: true`) so you can tell it wasn\'t your own promise that matched. A spawn with no `label` is never touched by this \u2014 deliberate parallel fan-out into one cwd (a real, exercised pattern here) needs no label and stays exactly as many sessions as you asked for. Pass `dedupe: false` to opt this ONE spawn out of implicit derivation regardless of policy \u2014 the escape hatch, mirroring `attach: false` / `worktree: false`. `dedupe: true` forces derivation even under an `"on-request"` daemon policy, mirroring `attach: true`.'
+          'Per-call override for the daemon\'s `spawn.dedupe` policy \u2014 what happens when NO `idempotencyKey` is supplied. By DEFAULT (`spawn.dedupe: "always"`) a spawn that carries a `label` gets an IMPLICIT key derived from that label plus a hash of `prompt`, and dedupes against it exactly like an explicit key \u2014 set `dedupeSource: "implicit"` on the response (alongside `deduped: true`) so you can tell it wasn\'t your own promise that matched. A spawn with no `label` is never touched by this \u2014 deliberate parallel fan-out into one cwd (a real, exercised pattern here) needs no label and stays exactly as many sessions as you asked for. Pass `dedupe: false` to opt this ONE spawn out of implicit derivation regardless of policy \u2014 the escape hatch, mirroring `attach: false` / `worktree: false`. `dedupe: true` forces derivation even under an `"on-request"` daemon policy, mirroring `attach: true`. Unrelated and NOT covered by this flag: a `worktree` spawn that lands in a worktree another LIVE session already occupies under the same `label` is always refused (`dedupeSource: "worktree-cwd"`) \u2014 a shared worktree, unlike a shared plain cwd, is never a legitimate fan-out.'
         ),
         permissionHold: mcpBool.optional().describe(
           "Start the session in permission-hold mode: every ACP permission request the agent raises (Write, Bash, \u2026) is SURFACED and HELD in the cross-session inbox (`permissions_list` / `permissions_respond`) instead of auto-answered, and the agent blocks until a human/orchestrator approves or denies it. Default false = today's auto-answer behaviour. ACP adapters only; others ignore it."
@@ -8381,7 +8481,7 @@ function registerAgentTools(server, opts) {
               ),
               base: z.string().min(1).optional().describe("Git ref the worktree branch is cut from. Default 'origin/main'."),
               async: z.boolean().optional().describe(
-                'Return a real, registered session as soon as it\'s minted (status "starting") instead of blocking `agent_start`\'s response on `git worktree add` + the repo\'s setup hooks, which can run minutes. Provisioning + the driver spawn continue in the background; poll the session\'s `status` (flips to "running" on success, "error" with a readable `lastError` on failure \u2014 it never sits in "starting" forever). Any `prompt` is held and dispatched only once the tree and the driver session both exist. Incompatible with `wait` (there is no first-turn output to block on yet) \u2014 combining the two is rejected. Default false (synchronous, today\'s behaviour).'
+                'Return a real, registered session as soon as it\'s minted (status "starting") instead of blocking `agent_start`\'s response on `git worktree add` + the repo\'s setup hooks, which can run minutes. Provisioning + the driver spawn continue in the background; poll the session\'s `status` (flips to "running" on success, "error" with a readable `lastError` on failure \u2014 it never sits in "starting" forever). Any `prompt` is held and dispatched only once the tree and the driver session both exist. Incompatible with `wait` (there is no first-turn output to block on yet) \u2014 combining the two is rejected. Defaults to true for any spawn that provisions a worktree, UNLESS this call also sets `wait` (which falls back to the old synchronous path instead of conflicting). Pass `false` explicitly to force the old blocking ok/fail contract even without `wait`.'
               )
             }).strict()
           ])
@@ -8503,13 +8603,16 @@ function registerAgentTools(server, opts) {
   );
   server.tool(
     "agent_prompt",
-    "Send a follow-up prompt to a live agent session \u2014 multi-turn continuity without re-spawning. The session id comes from `agent_start` (or `agent_sessions_list`). Returns immediately; tail output via `agent_output` or the SSE /sessions/:id/stream endpoint. By default, a session mid-turn rejects the new prompt \u2014 pass `interrupt: true` to cancel the in-flight turn and redirect the SAME session onto this prompt instead, without losing its context (unlike `agent_kill`, which ends the session entirely). `interrupt` is a no-op on an already-idle session.",
+    "Send a follow-up prompt to a live agent session \u2014 multi-turn continuity without re-spawning. The session id comes from `agent_start` (or `agent_sessions_list`). Returns immediately; tail output via `agent_output` or the SSE /sessions/:id/stream endpoint. If the session is mid-turn, the prompt is queued (FIFO) and dispatched automatically when the current turn ends \u2014 so fan-in bursts are delivered in order instead of rejected. Pass `interrupt: true` to cancel the in-flight turn and redirect the SAME session onto this prompt instead, without losing its context (unlike `agent_kill`, which ends the session entirely). `interrupt` is a no-op on an already-idle session.",
     {
       sessionId: sessionIdField,
       id: sessionIdAliasField,
       prompt: z.string().min(1).describe("The next user turn (plain text)."),
       interrupt: z.boolean().optional().describe(
         "When true and the session is mid-turn, cancel the in-flight turn and deliver this prompt on the same session instead of rejecting. No-op when the session is already idle. Default false (mid-turn rejects, as today)."
+      ),
+      queue: z.boolean().optional().describe(
+        "When the session is mid-turn, queue this prompt (FIFO) and dispatch it automatically once the current turn ends instead of rejecting. Default true. Explicit false restores the old reject-when-busy behavior."
       )
     },
     async (input) => {
@@ -8519,6 +8622,11 @@ function registerAgentTools(server, opts) {
         const promptSource = callerScope?.ownerSessionId ?? callerSessionId;
         await registry.enqueuePrompt(sessionId, input.prompt, {
           interrupt: input.interrupt,
+          // Queue by default: a mid-turn session holds the prompt in its
+          // FIFO queue and dispatches it at turn end, so callers never
+          // lose a prompt to the busy rejection. Explicit `queue: false`
+          // restores the old reject-when-busy behavior.
+          queue: input.queue ?? true,
           ...promptSource ? { source: `agent:${promptSource}` } : {}
         });
         return {
@@ -8534,11 +8642,18 @@ function registerAgentTools(server, opts) {
           ]
         };
       } catch (err) {
+        let message = err instanceof Error ? err.message : String(err);
+        if (input.queue === false && message.includes("is mid-turn")) {
+          message = message.replace(
+            "wait for it to finish or cancel",
+            "pass queue: true, or use `agentproto sessions prompt`"
+          );
+        }
         return {
           content: [
             {
               type: "text",
-              text: `agent_prompt: ${err instanceof Error ? err.message : String(err)}`
+              text: `agent_prompt: ${message}`
             }
           ],
           isError: true
@@ -10861,7 +10976,9 @@ function toSessionSummary(desc) {
     sandboxId: desc.sandboxId,
     sandboxTeardown: desc.sandboxTeardown,
     sandboxPorts: desc.sandboxPorts,
-    appServe: desc.appServe
+    appServe: desc.appServe,
+    sandboxAlive: desc.sandboxAlive,
+    sandboxCheckedAt: desc.sandboxCheckedAt
   };
 }
 var BRACKETED_PASTE_ON = "\x1B[?2004h";
@@ -10924,7 +11041,15 @@ function markHeldId(map, slug, id) {
 }
 var HISTORY_CAP = 200;
 var INTERRUPT_SETTLE_TIMEOUT_MS = 6e4;
+function stampAlive(desc) {
+  desc.alive = desc.status === "running" || desc.status === "starting";
+}
+function stampReadLiveness(desc) {
+  stampProcessAlive(desc);
+  stampSandboxLiveness(desc);
+}
 function stampProcessAlive(desc) {
+  stampAlive(desc);
   if (desc.pid === null || desc.pid === void 0) {
     delete desc.processAlive;
     return;
@@ -10936,6 +11061,21 @@ function stampProcessAlive(desc) {
     desc.processAlive = false;
   }
 }
+function stampSandboxLiveness(desc) {
+  if (!desc.sandboxId) {
+    delete desc.sandboxAlive;
+    delete desc.sandboxCheckedAt;
+    return;
+  }
+  const row = readSandboxLedger().find((e) => e.sandboxId === desc.sandboxId);
+  if (!row || row.sandboxAlive === void 0) {
+    delete desc.sandboxAlive;
+    delete desc.sandboxCheckedAt;
+    return;
+  }
+  desc.sandboxAlive = row.sandboxAlive;
+  desc.sandboxCheckedAt = row.sandboxCheckedAt;
+}
 function killChildIfSpawned(child, signal) {
   if (!child) return;
   if (typeof child.pid !== "number" || child.pid <= 0) return;
@@ -12602,6 +12742,7 @@ ${message}`;
         ...priorCommandSessionId ? { priorCommandSessionId } : {},
         ...input.remote ? { remote: true } : {},
         ...input.sandboxId ? { sandboxId: input.sandboxId } : {},
+        ...input.sandboxProvider ? { sandboxProvider: input.sandboxProvider } : {},
         ...input.sandboxTeardown ? { sandboxTeardown: input.sandboxTeardown } : {},
         ...input.sandboxPorts ? { sandboxPorts: input.sandboxPorts } : {},
         ...input.appServe ? { appServe: input.appServe } : {},
@@ -12710,6 +12851,7 @@ ${message}`;
         ...priorCommandSessionId ? { priorCommandSessionId } : {},
         ...input.remote ? { remote: true } : {},
         ...input.sandboxId ? { sandboxId: input.sandboxId } : {},
+        ...input.sandboxProvider ? { sandboxProvider: input.sandboxProvider } : {},
         ...input.sandboxTeardown ? { sandboxTeardown: input.sandboxTeardown } : {},
         ...input.sandboxPorts ? { sandboxPorts: input.sandboxPorts } : {},
         ...input.resumedFrom ? { resumedFrom: input.resumedFrom } : {},
@@ -13383,7 +13525,7 @@ ${message}`;
       const childrenBusy = childrenBusyCounts();
       return Array.from(sessions.values()).filter((rt) => includeArchived || !rt.desc.archived).sort((a, b) => b.desc.startedAt.localeCompare(a.desc.startedAt)).map((rt) => {
         const desc = rt.desc;
-        stampProcessAlive(desc);
+        stampReadLiveness(desc);
         stampInterrupted(desc);
         stampCurrentStatus(rt);
         stampWatchers(desc);
@@ -13401,7 +13543,7 @@ ${message}`;
       const slice = all.slice(offset, offset + limit);
       const summaries = slice.map((rt) => {
         const desc = rt.desc;
-        stampProcessAlive(desc);
+        stampReadLiveness(desc);
         stampInterrupted(desc);
         stampCurrentStatus(rt);
         stampWatchers(desc);
@@ -13415,7 +13557,7 @@ ${message}`;
       const rt = sessions.get(id);
       const desc = rt?.desc;
       if (rt && desc) {
-        stampProcessAlive(desc);
+        stampReadLiveness(desc);
         stampInterrupted(desc);
         stampCurrentStatus(rt);
         stampWatchers(desc);
@@ -13491,14 +13633,14 @@ ${message}`;
     findByIdOrName(query) {
       const direct = sessions.get(query);
       if (direct) {
-        stampProcessAlive(direct.desc);
+        stampReadLiveness(direct.desc);
         stampInterrupted(direct.desc);
         stampCurrentStatus(direct);
         return direct.desc;
       }
       for (const rt of sessions.values()) {
         if (rt.desc.name === query) {
-          stampProcessAlive(rt.desc);
+          stampReadLiveness(rt.desc);
           stampInterrupted(rt.desc);
           stampCurrentStatus(rt);
           return rt.desc;
@@ -13696,7 +13838,7 @@ ${message}`;
       }
       rt.desc.archived = true;
       schedulePersist();
-      stampProcessAlive(rt.desc);
+      stampReadLiveness(rt.desc);
       return rt.desc;
     },
     unarchiveSession(id) {
@@ -13704,7 +13846,7 @@ ${message}`;
       if (!rt) throw new Error(`unarchiveSession: no session "${id}"`);
       rt.desc.archived = false;
       schedulePersist();
-      stampProcessAlive(rt.desc);
+      stampReadLiveness(rt.desc);
       return rt.desc;
     },
     gcSessions(opts2) {
@@ -13752,7 +13894,7 @@ ${message}`;
         renamedByUser: true,
         ts: (/* @__PURE__ */ new Date()).toISOString()
       });
-      stampProcessAlive(rt.desc);
+      stampReadLiveness(rt.desc);
       return rt.desc;
     },
     setKeepAlive(id, keepAlive) {
@@ -13760,7 +13902,7 @@ ${message}`;
       if (!rt) throw new Error(`setKeepAlive: no session "${id}"`);
       rt.desc.keepAlive = keepAlive;
       schedulePersist();
-      stampProcessAlive(rt.desc);
+      stampReadLiveness(rt.desc);
       return rt.desc;
     },
     setPinned(id, pinned) {
@@ -13774,7 +13916,7 @@ ${message}`;
         pinned,
         ts: (/* @__PURE__ */ new Date()).toISOString()
       });
-      stampProcessAlive(rt.desc);
+      stampReadLiveness(rt.desc);
       return rt.desc;
     },
     flagAwaitingInput(id, patch) {
@@ -13798,7 +13940,7 @@ ${message}`;
         ...rt.desc.label ? { label: rt.desc.label } : {},
         ts: (/* @__PURE__ */ new Date()).toISOString()
       });
-      stampProcessAlive(rt.desc);
+      stampReadLiveness(rt.desc);
       return rt.desc;
     },
     listPendingPermissions(filter) {
@@ -15565,6 +15707,7 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       } : {},
       remote: true,
       sandboxId: host.sandboxId,
+      sandboxProvider: providerSlug,
       sandboxTeardown: lifecyclePolicy.teardown,
       ...host.ports && Object.keys(host.ports).length > 0 ? { sandboxPorts: host.ports } : {},
       commandPreview: `sandbox:${providerSlug} \u2192 ${adapterSlug}`,
@@ -16255,6 +16398,7 @@ var compactSessionItem = (s) => ({
   name: s.name,
   label: s.label,
   status: s.status,
+  alive: s.alive,
   pty: s.pty,
   command: s.command,
   cwd: s.cwd,
@@ -20176,7 +20320,18 @@ function makeBuiltinPanelApps(ops) {
     // Live-session widget — resource ui://live_session/view, also bound to
     // `agent_start` via _meta.ui.resourceUri (agent-tools.ts) so a launch
     // auto-renders it.
-    makeLiveSessionApp({ httpBaseUrl: ops.httpBaseUrl })
+    makeLiveSessionApp({ httpBaseUrl: ops.httpBaseUrl }),
+    // Session-chat widget — thin launcher for the installed
+    // `@agentik/session-chat` app's standalone UI (deep-linked iframe when
+    // installed, install notice otherwise; see apps/src/session-chat).
+    makeSessionChatApp({
+      httpBaseUrl: ops.httpBaseUrl,
+      isSessionChatInstalled: ops.isSessionChatInstalled
+    }),
+    // Work-board widget — kanban over the Task ledger (see apps/src/
+    // work-board). Read path only; writes go through task_claim/
+    // task_update/task_create over the bridge, same as every other caller.
+    makeWorkBoardApp({ listTasks: ops.listTasks })
   ];
 }
 var PANEL_APP_HANDLES = [
@@ -20184,12 +20339,16 @@ var PANEL_APP_HANDLES = [
   agentsOverviewApp,
   bureauSessionsApp,
   sessionStoryApp,
-  liveSessionApp
+  liveSessionApp,
+  sessionChatApp,
+  workBoardApp
 ];
 function builtinPanelCatalogEntries() {
   const apps = makeBuiltinPanelApps({
     listSessions: () => [],
-    httpBaseUrl: "http://127.0.0.1:0"
+    httpBaseUrl: "http://127.0.0.1:0",
+    isSessionChatInstalled: () => false,
+    listTasks: (boardId) => ({ boardId: boardId ?? "ws:default", tasks: [] })
   });
   return apps.map((app, i) => {
     const handle = PANEL_APP_HANDLES[i];
@@ -22785,7 +22944,8 @@ async function makeInstalledAppUiApps(appRegistry, cache, existingToolNames) {
       ...ui.csp ? {
         csp: {
           ...ui.csp.connectDomains ? { connectDomains: [...ui.csp.connectDomains] } : {},
-          ...ui.csp.resourceDomains ? { resourceDomains: [...ui.csp.resourceDomains] } : {}
+          ...ui.csp.resourceDomains ? { resourceDomains: [...ui.csp.resourceDomains] } : {},
+          ...ui.csp.frameDomains ? { frameDomains: [...ui.csp.frameDomains] } : {}
         }
       } : {}
     });
@@ -23414,6 +23574,8 @@ function buildMsg(body, ctx, fields) {
   const source = ctx.sourceOverride ?? (typeof fields.source === "function" ? fields.source() : fields.source);
   const contactRef = typeof fields.contactRef === "function" ? fields.contactRef() : fields.contactRef;
   const text10 = typeof fields.text === "function" ? fields.text() : fields.text;
+  const displayName = typeof fields.displayName === "function" ? fields.displayName() : fields.displayName;
+  const surface = typeof fields.surface === "function" ? fields.surface() : fields.surface;
   const providerMessageId = typeof fields.providerMessageId === "function" ? fields.providerMessageId() : fields.providerMessageId;
   if (!source) return { ok: false, error: "missing_source" };
   if (!contactRef) return { ok: false, error: "missing_contact_ref" };
@@ -23423,6 +23585,10 @@ function buildMsg(body, ctx, fields) {
     source,
     contactRef,
     text: text10,
+    // Opt-in attribution — only set when the dialect knows a sender name,
+    // so 1:1 bindings keep receiving the raw text unprefixed.
+    ...displayName ? { displayName } : {},
+    ...surface ? { surface } : {},
     ...Array.isArray(body) ? { messages: body } : {}
   };
   return { ok: true, msg, providerMessageId };
@@ -23476,10 +23642,13 @@ function normalizeTelegram(body, ctx) {
   const contactRef = chat && typeof chat.id === "number" ? String(chat.id) : void 0;
   const text10 = typeof message.text === "string" ? message.text : void 0;
   const providerMessageId = typeof message.message_id === "number" ? String(message.message_id) : void 0;
+  const displayName = typeof from?.first_name === "string" && from.first_name ? from.first_name : typeof from?.username === "string" && from.username ? from.username : void 0;
   return buildMsg(body, ctx, {
     source,
     contactRef,
     text: text10,
+    displayName,
+    surface: "telegram",
     providerMessageId
   });
 }
@@ -27447,6 +27616,11 @@ async function startHttpServer(opts) {
           return;
         }
         if (path === "/mcps/imports" && req.method === "POST") {
+          const gate = checkSessionsToken(req);
+          if (gate !== "ok") {
+            rejectUnauthorizedSession(req, res, gate);
+            return;
+          }
           const body = await readJsonBody(req);
           if (!body || typeof body.sourceMcpId !== "string") {
             res.writeHead(400, { "content-type": "application/json" });
@@ -27477,6 +27651,11 @@ async function startHttpServer(opts) {
         }
         const importMatch = path.match(/^\/mcps\/imports\/(.+)$/);
         if (importMatch && req.method === "DELETE") {
+          const gate = checkSessionsToken(req);
+          if (gate !== "ok") {
+            rejectUnauthorizedSession(req, res, gate);
+            return;
+          }
           const id = decodeURIComponent(importMatch[1] ?? "");
           const cfg = await loadImportedMcps();
           if (!cfg.imports.some((e) => e.id === id)) {
@@ -27542,6 +27721,11 @@ async function startHttpServer(opts) {
           return;
         }
         if (path === "/mcps/proxy/call" && req.method === "POST") {
+          const gate = checkSessionsToken(req);
+          if (gate !== "ok") {
+            rejectUnauthorizedSession(req, res, gate);
+            return;
+          }
           if (!opts.mcpProxy) {
             res.writeHead(501, { "content-type": "application/json" });
             res.end(JSON.stringify({ error: "mcp_proxy_not_configured" }));
@@ -27815,6 +27999,17 @@ async function startHttpServer(opts) {
           const handled = await handleTasks(req, res, path, opts.taskLedger);
           if (handled) return;
         }
+        if (path.startsWith("/sandboxes")) {
+          if ((req.method ?? "GET") !== "GET") {
+            const gate = checkSessionsToken(req);
+            if (gate !== "ok") {
+              rejectUnauthorizedSession(req, res, gate);
+              return;
+            }
+          }
+          const handled = await handleSandboxes(req, res, path, opts.resolveSandboxProvider);
+          if (handled) return;
+        }
         if (opts.sessions && path.startsWith("/permissions")) {
           if ((req.method ?? "GET") !== "GET") {
             const gate = checkSessionsToken(req);
@@ -27848,9 +28043,15 @@ async function startHttpServer(opts) {
         if (opts.appRegistry && path.startsWith("/apps/")) {
           const uiMatch = path.match(/^\/apps\/(.+)\/ui$/);
           if (uiMatch && req.method === "GET") {
-            if (guardBrowserOrigin(req, res)) return;
+            const uiApp = opts.appRegistry.getApp(decodeURIComponent(uiMatch[1]));
+            if (!iframeEmbedOriginAllowed(req, uiApp ?? {}) && guardBrowserOrigin(req, res)) return;
             if (!authorize(req, res)) return;
-            await handleAppUiPage(res, decodeURIComponent(uiMatch[1]), opts.appRegistry);
+            await handleAppUiPage(
+              req,
+              res,
+              decodeURIComponent(uiMatch[1]),
+              opts.appRegistry
+            );
             return;
           }
           const toolCallMatch = path.match(/^\/apps\/(.+)\/tool-call$/);
@@ -28218,6 +28419,12 @@ async function* transcriptDiskRecords(id) {
   }
 }
 function buildSpawnSessionHttpArgs(b, adapter, preset) {
+  const maxCostUsdCap = b.maxCostUsd !== void 0 ? parseMaxCostUsdField(b.maxCostUsd) : void 0;
+  const costBudgetCap = b.costBudget !== void 0 ? parseCostBudgetField(b.costBudget) : void 0;
+  const spendCaps = {
+    ...maxCostUsdCap !== void 0 ? maxCostUsdCap : {},
+    ...costBudgetCap !== void 0 ? { costBudget: costBudgetCap } : {}
+  };
   return {
     adapter,
     ...typeof b.origin === "string" && b.origin.length > 0 ? { origin: b.origin } : {},
@@ -28247,6 +28454,8 @@ function buildSpawnSessionHttpArgs(b, adapter, preset) {
       const parsed = parseAuthField(b.auth);
       return parsed !== void 0 ? { auth: parsed } : {};
     })() : {},
+    // Spend caps (parsed above) — see `spendCaps`.
+    ...spendCaps,
     ...typeof b.prompt === "string" ? { prompt: b.prompt } : {},
     ...typeof b.label === "string" ? { label: b.label } : {},
     // Explicit title override (SPEC-3 FIX C, `--title`) — wins over the
@@ -28431,6 +28640,20 @@ function parseRouteField(raw) {
     ...typeof obj.baseUrl === "string" && obj.baseUrl.length > 0 ? { baseUrl: obj.baseUrl } : {}
   };
 }
+function parseMaxCostUsdField(raw) {
+  const n = typeof raw === "string" ? Number(raw) : raw;
+  return typeof n === "number" && Number.isFinite(n) && n > 0 ? { maxCostUsd: n } : void 0;
+}
+function parseCostBudgetField(raw) {
+  const value = typeof raw === "string" ? tryParseJson(raw) : raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const obj = value;
+  const usd = typeof obj.maxCostUsd === "string" ? Number(obj.maxCostUsd) : obj.maxCostUsd;
+  if (typeof usd !== "number" || !Number.isFinite(usd) || usd <= 0) return void 0;
+  if (typeof obj.window !== "string" || obj.window.length === 0) return void 0;
+  if (obj.scope !== "session" && obj.scope !== "profile") return void 0;
+  return { maxCostUsd: usd, window: obj.window, scope: obj.scope };
+}
 function parseAccessField(raw) {
   const value = typeof raw === "string" ? tryParseJson(raw) : raw;
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -28491,6 +28714,61 @@ async function resolveSlugFromCwd(cwd) {
     return void 0;
   }
 }
+async function handleSandboxes(_req, res, path, resolveSandboxProvider2) {
+  const json = (status, body) => {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+  };
+  const match = path.match(/^\/sandboxes\/([^/]+)\/alive$/);
+  if (!match || _req.method !== "GET") return false;
+  const sandboxId = decodeURIComponent(match[1]);
+  const row = readSandboxLedger().find((e) => e.sandboxId === sandboxId);
+  if (!row) {
+    json(404, {
+      error: `sandbox "${sandboxId}" is not in the sandbox ledger (~/.agentproto/sandboxes.json)`
+    });
+    return true;
+  }
+  const resolver = resolveSandboxProvider2 ?? makeSandboxResolver(makeSandboxCredsStore());
+  let handle;
+  try {
+    handle = await resolver(row.provider);
+  } catch (err) {
+    json(502, {
+      alive: null,
+      state: row.state,
+      error: `sandbox provider "${row.provider}" could not be resolved \u2014 ${err instanceof Error ? err.message : String(err)}`
+    });
+    return true;
+  }
+  if (!handle?.provider?.probe) {
+    json(501, {
+      alive: null,
+      state: row.state,
+      error: `sandbox provider "${row.provider}" has no probe() \u2014 liveness unknown`
+    });
+    return true;
+  }
+  let probe;
+  try {
+    probe = await handle.provider.probe(row.sandboxId);
+  } catch (err) {
+    json(502, {
+      alive: null,
+      state: row.state,
+      error: `liveness probe failed \u2014 ${err instanceof Error ? err.message : String(err)}`
+    });
+    return true;
+  }
+  recordSandboxLiveness(row.sandboxId, probe.alive);
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (!probe.alive) {
+    json(410, { alive: false, state: "gone", checkedAt });
+    return true;
+  }
+  json(200, { alive: true, ...probe.state ? { state: probe.state } : { state: row.state }, checkedAt });
+  return true;
+}
 async function handleSessions(req, res, path, registry, resolveAgentAdapter, ptyEnabled = false, resolveBrowserAdapter, listBrowserAdapters, sessionEvents, eventRing, buildOrchestratorMcp, daemonMcpUrl, provisionWorktree, listCatalogModels, resolveSandboxProvider2) {
   const json = (status, body) => {
     res.writeHead(status, { "content-type": "application/json" });
@@ -29187,7 +29465,7 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
     return true;
   }
   const idMatch = path.match(
-    /^\/sessions\/([^/]+)(\/events\/stream|\/stream|\/kill|\/pin|\/preview|\/export|\/conversation|\/events|\/wait|\/chat)?$/
+    /^\/sessions\/([^/]+)(\/events\/stream|\/stream|\/kill|\/pin|\/preview|\/export|\/conversation|\/events|\/wait|\/chat|\/alive)?$/
   );
   if (!idMatch) return false;
   const [, rawIdOrName, suffix] = idMatch;
@@ -29546,6 +29824,15 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
     }
     return true;
   }
+  if (suffix === "/alive" && req.method === "GET") {
+    if (!resolvedDesc) {
+      json(404, { error: "session_not_found", id: rawIdOrName });
+      return true;
+    }
+    const alive = resolvedDesc.status === "running" || resolvedDesc.status === "starting";
+    json(alive ? 200 : 410, { alive, status: resolvedDesc.status });
+    return true;
+  }
   if (!suffix && req.method === "GET") {
     if (!resolvedDesc) {
       json(404, { error: "session_not_found", id: rawIdOrName });
@@ -30296,6 +30583,16 @@ async function handleNativeInbound(req, res, deps2) {
     res.end(JSON.stringify({ error: "missing_text" }));
     return;
   }
+  if (body.display_name !== void 0 && typeof body.display_name !== "string") {
+    res.writeHead(400, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid_display_name" }));
+    return;
+  }
+  if (body.surface !== void 0 && typeof body.surface !== "string") {
+    res.writeHead(400, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "invalid_surface" }));
+    return;
+  }
   let mode = "route-or-spawn";
   if (body.mode !== void 0) {
     if (!isInboundRouteMode(String(body.mode))) {
@@ -30325,6 +30622,10 @@ async function handleNativeInbound(req, res, deps2) {
     source: body.source,
     contactRef: body.contact_ref,
     text: body.text,
+    // Attribution is opt-in — an absent field must not exist on the message
+    // at all, or attributeInboundText would prefix every 1:1 turn.
+    ...typeof body.display_name === "string" ? { displayName: body.display_name } : {},
+    ...typeof body.surface === "string" ? { surface: body.surface } : {},
     ...Array.isArray(body.messages) ? { messages: body.messages } : {}
   };
   const result = await deps2.routeInboundMessage(msg, mode);
@@ -30448,7 +30749,7 @@ async function handleProviderInbound(req, res, slug, deps2) {
   res.writeHead(200, { "content-type": "application/json" });
   res.end(JSON.stringify(result));
 }
-async function handleAppUiPage(res, appId, appRegistry) {
+async function handleAppUiPage(req, res, appId, appRegistry) {
   const app = appRegistry.getApp(appId);
   if (!app?.ui) {
     res.writeHead(404, { "content-type": "application/json" });
@@ -30467,14 +30768,59 @@ async function handleAppUiPage(res, appId, appRegistry) {
     );
     return;
   }
-  res.writeHead(200, {
+  const embedRequested = new URL(req.url ?? "/", "http://localhost").searchParams.get("embed") === "1";
+  const headers = {
     "content-type": "text/html; charset=utf-8",
-    "cache-control": "no-store",
-    "x-frame-options": "DENY",
-    "content-security-policy": "frame-ancestors 'none'"
-  });
+    "cache-control": "no-store"
+  };
+  if (!(embedRequested && iframeEmbedAllowed(req, app))) {
+    headers["x-frame-options"] = "DENY";
+    headers["content-security-policy"] = "frame-ancestors 'none'";
+  }
+  res.writeHead(200, headers);
   res.end(injectStandaloneAppBridge(raw));
 }
+function iframeEmbedAllowed(req, app) {
+  const secFetchDest = req.headers["sec-fetch-dest"];
+  if (secFetchDest !== void 0 && secFetchDest !== "iframe") return false;
+  const origin = typeof req.headers.origin === "string" && req.headers.origin.length > 0 ? req.headers.origin : null;
+  const referer = typeof req.headers.referer === "string" && req.headers.referer.length > 0 ? req.headers.referer : null;
+  if (!origin && !referer) return false;
+  const candidates = /* @__PURE__ */ new Set();
+  if (origin) candidates.add(origin);
+  if (referer) {
+    try {
+      candidates.add(new URL(referer).origin);
+    } catch {
+    }
+  }
+  const host = req.headers.host;
+  const daemonOrigins = host ? [`http://${host}`, `https://${host}`] : [];
+  for (const candidate of candidates) {
+    if (candidate.startsWith("vscode-webview://")) return true;
+    if (daemonOrigins.includes(candidate)) return true;
+    if ((app.ui?.csp?.frameDomains ?? []).includes(candidate)) return true;
+  }
+  return false;
+}
+function iframeEmbedOriginAllowed(req, app) {
+  const origin = typeof req.headers.origin === "string" && req.headers.origin.length > 0 ? req.headers.origin : null;
+  const referer = typeof req.headers.referer === "string" && req.headers.referer.length > 0 ? req.headers.referer : null;
+  if (!origin && !referer) return false;
+  const candidates = /* @__PURE__ */ new Set();
+  if (origin) candidates.add(origin);
+  if (referer) {
+    try {
+      candidates.add(new URL(referer).origin);
+    } catch {
+    }
+  }
+  for (const candidate of candidates) {
+    if (candidate.startsWith("vscode-webview://")) return true;
+    if ((app.ui?.csp?.frameDomains ?? []).includes(candidate)) return true;
+  }
+  return false;
+}
 function outboundKindForExt(ext) {
   const e = ext.toLowerCase();
   if ([".png", ".jpg", ".jpeg", ".gif", ".webp"].includes(e)) return "photo";
@@ -31177,6 +31523,14 @@ function createInboundEndpointStore(opts) {
 }
 
 // src/inbound-router.ts
+function attributeInboundText(msg) {
+  const displayName = typeof msg.displayName === "string" && msg.displayName.trim() !== "" ? msg.displayName : void 0;
+  const surface = typeof msg.surface === "string" && msg.surface.trim() !== "" ? msg.surface : void 0;
+  if (!displayName && !surface) return msg.text;
+  if (!surface) return `[${displayName}] ${msg.text}`;
+  const name = displayName ?? msg.contactRef;
+  return `[${name} \xB7 ${surface}] ${msg.text}`;
+}
 async function routeInboundMessage(deps2, msg, mode) {
   const log = deps2.log ?? (() => {
   });
@@ -31199,7 +31553,7 @@ async function routeInboundMessage(deps2, msg, mode) {
     return { action: "skipped" };
   }
   const routeInto = async (sessionId) => {
-    await deps2.enqueuePrompt(sessionId, msg.text);
+    await deps2.enqueuePrompt(sessionId, attributeInboundText(msg), { queue: true });
     deps2.bindings.upsert({
       alias: binding.alias,
       source: binding.source,
@@ -34728,6 +35082,63 @@ function registerSandboxAttachTool(server, opts = {}) {
   );
 }
 
+// src/sandbox-gc.ts
+var DEAD_SESSION_STATUSES = /* @__PURE__ */ new Set(["error", "killed", "exited"]);
+function collectGcCandidates(entries, sessionStatuses) {
+  return entries.filter((e) => e.originSessionId !== void 0 && e.state !== "stopped").map((entry) => ({
+    entry,
+    sessionStatus: sessionStatuses.get(entry.originSessionId)
+  })).filter(
+    (c) => c.sessionStatus !== void 0 && DEAD_SESSION_STATUSES.has(c.sessionStatus)
+  );
+}
+async function reapGcEntry(entry, opts) {
+  let handle;
+  try {
+    handle = await opts.resolveProvider(entry.provider);
+  } catch (err) {
+    return {
+      ok: false,
+      error: `provider "${entry.provider}" could not be resolved \u2014 ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!handle) return { ok: false, error: `provider "${entry.provider}" not found.` };
+  if (!handle.provider.connect) {
+    return {
+      ok: false,
+      error: `provider "${entry.provider}" has no connect() \u2014 cannot reach the existing box.`
+    };
+  }
+  let booted;
+  try {
+    booted = await handle.provider.connect(
+      entry.sandboxId,
+      { provider: entry.provider, config: {} },
+      { env: {} }
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/\b404\b|doesn't exist|does not exist|not found|no such/i.test(message)) {
+      recordSandboxState(entry.sandboxId, "stopped", opts.ledgerPath);
+      return { ok: true, action: "stopped" };
+    }
+    return { ok: false, error: `connect to "${entry.sandboxId}" failed \u2014 ${message}` };
+  }
+  const action = opts.pause === true && booted.pause ? "paused" : "stopped";
+  try {
+    if (action === "paused") await booted.pause();
+    else await booted.stop();
+  } catch (err) {
+    return {
+      ok: false,
+      error: `tearing down "${entry.sandboxId}" failed \u2014 ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  recordSandboxState(entry.sandboxId, action, opts.ledgerPath);
+  return { ok: true, action };
+}
+var GC_REAPABLE_STATES = ["booted", "connected", "paused"];
+
 // src/index.ts
 init_tool_presenter();
 var POLL_INTERVAL_MS2 = 200;
@@ -37909,7 +38320,30 @@ async function createGateway(opts) {
         listSessions: listSessionsFiltered,
         // httpBaseUrl = this daemon's own origin (SSE stream + bridge
         // fallback for the live-session widget).
-        httpBaseUrl: `http://127.0.0.1:${port}`
+        httpBaseUrl: `http://127.0.0.1:${port}`,
+        // The session-chat widget is a thin launcher for the installed
+        // `@agentik/session-chat` studio app — resolve installed-ness from
+        // the AppRegistry at call time (not boot) so `app_install`/
+        // `app_uninstall` of that app is reflected without a daemon restart.
+        isSessionChatInstalled: () => {
+          try {
+            return appRegistry.getApp(SESSION_CHAT_APP_ID)?.ui != null;
+          } catch {
+            return false;
+          }
+        },
+        // Work-board widget's read path — the root `/mcp` endpoint has no
+        // scope, so this mount is always the operator caller (default
+        // board `ws:<slug>`); `canAccessBoard` lets the operator read any
+        // board (including a `tree:*` one) when an explicit boardId is
+        // passed in from the panel's board switcher.
+        listTasks: (boardId) => ({
+          boardId: taskLedger.resolveBoardId({ kind: "operator" }, boardId),
+          tasks: taskLedger.list(
+            { ...boardId ? { boardId } : {}, includeClosed: true },
+            { kind: "operator" }
+          )
+        })
       }),
       // Same ptyEnabled gate as terminal_start/terminal_input/… in
       // session-tools.ts — the panel would be able to open the WS but
@@ -38312,6 +38746,6 @@ var export_providersPath = providers_store_exports.providersPath;
 var export_removeProviderKey = providers_store_exports.removeProviderKey;
 var export_setProviderKey = providers_store_exports.setProviderKey;
 
-export { AnthropicRemainingQuotaReader, AuthResolutionError, BUCKETS_ROOT, CLAUDE_CODE_OAUTH_SOURCE, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, HarnessPresetValidationError, INBOUND_PROVIDERS, LEGACY_SESSIONS_FILE, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, ResumeDisabledError, SESSION_ID_ENV, SubscriptionSourceError, TASK_STATUSES, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogModels, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, composeMode, composeSessionObservers, conversationIndexPath, createActivityProjector, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createScopeTokenRegistry, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, decomposeMode, defineBraveSearchHttpDriver, defineSerperHttpDriver, deleteUserPreset, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, evaluateCostBudget, fileConversationStore, filterActivities, findConversationRecord, findNativeMode, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, export_getProviderKey as getProviderKey, getUserPreset, harnessPresetsPath, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isAgentCliAuthConfigured, isClosedTaskStatus, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listUserPresets, loadHarnessPresets, export_loadProviders as loadProviders, loadQuotaStore, loadUserPresets, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeSkillsOption, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseDuration, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prToActivities, projectSessionUsage, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapOrphanedDescendants, recordProfileQuota, registerBrainTools, registerBuiltinRoutes, registerPairingTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, export_removeProviderKey as removeProviderKey, removeSandboxLedgerEntry, resolveAuthSpec, resolveBucketSlug, resolveNativeLink, resolvePosture, resolveReuseFromLedger, resolveSpawnDefaults, resolveSubscriptionCredential, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runStallWatchdogPass, sandboxLedgerPath, saveUserPreset, setDefaultPreset, setMcpCredentialDeps, export_setProviderKey as setProviderKey, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, userPresetsPath, verifyInboundSignature, webSearchTool, workflowToActivities, writeDaemonRegistryEntry };
+export { AnthropicRemainingQuotaReader, AuthResolutionError, BUCKETS_ROOT, CLAUDE_CODE_OAUTH_SOURCE, DEAD_SESSION_STATUSES, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, GC_REAPABLE_STATES, HarnessPresetValidationError, INBOUND_PROVIDERS, LEGACY_SESSIONS_FILE, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, ResumeDisabledError, SESSION_ID_ENV, SubscriptionSourceError, TASK_STATUSES, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogModels, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, composeMode, composeSessionObservers, conversationIndexPath, createActivityProjector, createFileStepCache, createGateway, createInboundEndpointStore, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createScopeTokenRegistry, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, decomposeMode, defineBraveSearchHttpDriver, defineSerperHttpDriver, deleteUserPreset, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, evaluateCostBudget, fileConversationStore, filterActivities, findConversationRecord, findNativeMode, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, export_getProviderKey as getProviderKey, getUserPreset, harnessPresetsPath, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isAgentCliAuthConfigured, isClosedTaskStatus, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listUserPresets, loadHarnessPresets, export_loadProviders as loadProviders, loadQuotaStore, loadUserPresets, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeSkillsOption, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseDuration, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, policyToActivities, policyWatchesSession, prToActivities, projectSessionUsage, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readConversationIndex, readDaemonRegistry, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerPairingTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, export_removeProviderKey as removeProviderKey, removeSandboxLedgerEntry, resolveAuthSpec, resolveBucketSlug, resolveNativeLink, resolvePosture, resolveReuseFromLedger, resolveSpawnDefaults, resolveSubscriptionCredential, rollupUsage, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runStallWatchdogPass, sandboxLedgerPath, saveUserPreset, setDefaultPreset, setMcpCredentialDeps, export_setProviderKey as setProviderKey, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, userPresetsPath, verifyInboundSignature, webSearchTool, workflowToActivities, writeDaemonRegistryEntry };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map