@agentproto/runtime 3.5.0 → 4.0.0

package/dist/session-presence.mjs

@@ -1,13 +1,3580 @@
-import { promises } from 'fs';
+import { createHash } from 'crypto';
+import { join, resolve } from 'path';
+import { createReadStream, promises } from 'fs';
 import { homedir } from 'os';
-import { join } from 'path';
+import { createInterface } from 'readline';
+import 'fs/promises';
+import * as providers_store_star from '@agentproto/providers-store';
+import '@agentproto/model-catalog/llm';
+import '@agentproto/model-catalog/route-identity';
+import '@agentproto/provider-presets';
+import '@agentproto/secrets/provision/recipe';
+import { z } from 'zod';
+import '@agentproto/auth';
+import 'child_process';
+import '@agentproto/command-sandbox';
+import '@agentproto/plugin-local-browser';
+import '@modelcontextprotocol/sdk/types.js';
+import '@agentproto/provider-kit';
+import '@modelcontextprotocol/sdk/client/index.js';
+import '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import 'net';
+import { SandboxSpecSchema } from '@agentproto/sandbox';
+import { CatalogProviderSchema } from '@agentproto/model-catalog';
+import '@agentproto/app-client/runner-select';
+import '@agentproto/app-client/display-mode';
+import '@agentproto/tool';
+import '@agentproto/mcp-server';
+import '@agentproto/apps';
+import 'events';
+import '@agentproto/driver-agent-cli';
+import { resolvePairPageUrl, DEFAULT_PAIR_PAGE } from '@agentproto/secrets/pairing/browser';
 
 /**
  * @agentproto/runtime v0.1.0-alpha
  * Long-running gateway: MCP server + HTTP transport + HEARTBEAT autonomy + conversation persistence over a workspace dir.
  */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget);
+
+// src/worktree-isolation.ts
+var WORKTREE_ISOLATION_ENV, DEFAULT_WORKTREE_ISOLATION;
+var init_worktree_isolation = __esm({
+  "src/worktree-isolation.ts"() {
+    init_config();
+    WORKTREE_ISOLATION_ENV = "AGENTPROTO_WORKTREES_ISOLATION";
+    DEFAULT_WORKTREE_ISOLATION = "on-request";
+  }
+});
+
+// src/spawn-attach.ts
+var SPAWN_ATTACH_ENV, DEFAULT_SPAWN_ATTACH;
+var init_spawn_attach = __esm({
+  "src/spawn-attach.ts"() {
+    init_config();
+    SPAWN_ATTACH_ENV = "AGENTPROTO_SPAWN_ATTACH";
+    DEFAULT_SPAWN_ATTACH = "always";
+  }
+});
+var SPAWN_DEDUPE_ENV, DEFAULT_SPAWN_DEDUPE;
+var init_spawn_dedupe = __esm({
+  "src/spawn-dedupe.ts"() {
+    init_config();
+    SPAWN_DEDUPE_ENV = "AGENTPROTO_SPAWN_DEDUPE";
+    DEFAULT_SPAWN_DEDUPE = "always";
+  }
+});
+var init_pr_provenance = __esm({
+  "src/pr-provenance.ts"() {
+  }
+});
+
+// src/tool-presenter.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function truncate(value, max) {
+  const oneLine = value.replace(/\s+/g, " ").trim();
+  return oneLine.length > max ? `${oneLine.slice(0, max - 1)}\u2026` : oneLine;
+}
+function formatArgValue(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return `${value.length} item${value.length === 1 ? "" : "s"}`;
+  if (isRecord(value)) return JSON.stringify(value);
+  return String(value);
+}
+function pickSalientArg(args) {
+  for (const key of SALIENT_ARG_KEYS) {
+    const value = args[key];
+    if (value !== void 0 && value !== null && value !== "") {
+      return formatArgValue(value);
+    }
+  }
+  return null;
+}
+function subagentSummary(args) {
+  const description = typeof args.description === "string" ? args.description : typeof args.prompt === "string" ? args.prompt : "subagent";
+  return `\u21B3 subagent: ${truncate(description, MAX_CALL_LENGTH)}`;
+}
+function formatToolCall(toolName, args) {
+  const name = toolName || "tool";
+  const argsRecord = isRecord(args) ? args : {};
+  const bespoke = BESPOKE_TOOLS[name.toLowerCase()];
+  if (bespoke) return bespoke(argsRecord);
+  const salient = pickSalientArg(argsRecord);
+  if (salient !== null) {
+    if (name.toLowerCase().includes(salient.toLowerCase())) {
+      return truncate(name, MAX_CALL_LENGTH);
+    }
+    return truncate(`${name} ${salient}`, MAX_CALL_LENGTH);
+  }
+  if (Object.keys(argsRecord).length === 0) return name;
+  return truncate(`${name} ${JSON.stringify(args)}`, MAX_CALL_LENGTH);
+}
+var SALIENT_ARG_KEYS, MAX_CALL_LENGTH, BESPOKE_TOOLS;
+var init_tool_presenter = __esm({
+  "src/tool-presenter.ts"() {
+    SALIENT_ARG_KEYS = [
+      "file_path",
+      "path",
+      "filePath",
+      "file",
+      "command",
+      "pattern",
+      "query",
+      "q",
+      "url",
+      "todos",
+      "description",
+      "prompt"
+    ];
+    MAX_CALL_LENGTH = 120;
+    BESPOKE_TOOLS = {
+      schedulewakeup: (args) => {
+        const delay = args.delaySeconds ?? args.delay ?? "?";
+        const reason = typeof args.reason === "string" ? args.reason : "";
+        return reason ? `\u23F0 wake in ${delay}s \u2014 ${reason}` : `\u23F0 wake in ${delay}s`;
+      },
+      task: subagentSummary,
+      agent: subagentSummary,
+      todowrite: (args) => {
+        const todos = Array.isArray(args.todos) ? args.todos : [];
+        return `\u2611 todos (${todos.length})`;
+      },
+      exitplanmode: () => "\u{1F4CB} plan ready"
+    };
+  }
+});
 
-var CONFIG_FILE_PATH = () => join(homedir(), ".agentproto", "config.json");
+// src/tool-call-record.ts
+var init_tool_call_record = __esm({
+  "src/tool-call-record.ts"() {
+  }
+});
+function defaultTranscriptBaseDir() {
+  return join(homedir(), ".agentproto", "sessions");
+}
+function sessionTranscriptDir(sessionId, baseDir) {
+  return join(defaultTranscriptBaseDir(), sessionId);
+}
+function sessionEventsPath(sessionId, baseDir) {
+  return join(sessionTranscriptDir(sessionId), "events.jsonl");
+}
+var init_transcript_writer = __esm({
+  "src/transcript-writer.ts"() {
+    init_tool_call_record();
+    init_pr_provenance();
+  }
+});
+
+// src/transcript-export.ts
+var transcript_export_exports = {};
+__export(transcript_export_exports, {
+  crossValidateHermesExport: () => crossValidateHermesExport,
+  discoverCodexSessions: () => discoverCodexSessions,
+  discoverHermesSessions: () => discoverHermesSessions,
+  discoverMastracodeInprocessSessions: () => discoverMastracodeInprocessSessions,
+  discoverOpenCodeSessions: () => discoverOpenCodeSessions,
+  discoverPiSessions: () => discoverPiSessions,
+  exportAgentSession: () => exportAgentSession,
+  exportClaudeCodeSession: () => exportClaudeCodeSession,
+  exportCodexSession: () => exportCodexSession,
+  exportDaemonEventsSession: () => exportDaemonEventsSession,
+  exportHermesSession: () => exportHermesSession,
+  exportMastracodeInprocessSession: () => exportMastracodeInprocessSession,
+  exportOpenCodeSession: () => exportOpenCodeSession,
+  exportPiSession: () => exportPiSession,
+  renderJson: () => renderJson,
+  renderMarkdown: () => renderMarkdown
+});
+function trunc(text, n) {
+  if (text.length <= n) return text;
+  return text.slice(0, n) + `
+\u2026 [${text.length - n} chars truncated]`;
+}
+function renderMarkdown(session, opts = {}) {
+  const { meta, messages } = session;
+  const maxToolChars = opts.maxToolChars ?? 1200;
+  const out = [];
+  out.push(`# ${meta.title ?? "(untitled)"}`);
+  out.push("");
+  const sourceNote = meta.source ? ` \xB7 source \`${meta.source}\`` : "";
+  const originNote = meta.origin ? ` \xB7 origin \`${meta.origin}\`` : "";
+  const callerNote = meta.callerSessionId ? ` \xB7 caller \`${meta.callerSessionId}\`` : "";
+  out.push(`> Session${sourceNote}${originNote}${callerNote}`);
+  out.push("");
+  out.push("| | |");
+  out.push("|---|---|");
+  if (meta.model) out.push(`| Model | \`${meta.model}\` |`);
+  if (meta.startedAt || meta.endedAt) {
+    out.push(`| Start \u2192 end | ${meta.startedAt ?? "?"} \u2192 ${meta.endedAt ?? "?"} |`);
+  }
+  if (meta.messageCount !== void 0 || meta.toolCallCount !== void 0) {
+    const parts = [];
+    if (meta.messageCount !== void 0) parts.push(`${meta.messageCount} messages`);
+    if (meta.toolCallCount !== void 0) parts.push(`${meta.toolCallCount} tool calls`);
+    out.push(`| Count | ${parts.join(" \xB7 ")} |`);
+  }
+  if (meta.tokens && Object.keys(meta.tokens).length) {
+    const t = meta.tokens;
+    const parts = [];
+    if (t.input !== void 0) parts.push(`in ${t.input.toLocaleString("en-US")}`);
+    if (t.output !== void 0) parts.push(`out ${t.output.toLocaleString("en-US")}`);
+    if (t.cacheRead !== void 0 || t.cacheWrite !== void 0) {
+      parts.push(
+        `cache r/w ${(t.cacheRead ?? 0).toLocaleString("en-US")}/${(t.cacheWrite ?? 0).toLocaleString("en-US")}`
+      );
+    }
+    if (t.reasoning !== void 0) parts.push(`reason. ${t.reasoning.toLocaleString("en-US")}`);
+    if (parts.length) out.push(`| Tokens | ${parts.join(" \xB7 ")} |`);
+  }
+  if (meta.costUsd !== void 0) {
+    out.push(`| Cost | $${meta.costUsd.toFixed(4)} |`);
+  }
+  out.push("");
+  out.push("---");
+  out.push("");
+  for (const m of messages) {
+    const icon = ROLE_ICON[m.role] ?? m.role;
+    const nameSuffix = m.toolName ? ` \xB7 \`${m.toolName}\`` : m.from ? ` \xB7 from ${m.from.relation} \`${m.from.label ?? m.from.sessionId ?? ""}\` (${m.from.kind})` : "";
+    out.push(`### ${icon}${nameSuffix}`);
+    if (m.reasoning?.trim()) {
+      out.push("");
+      out.push("<details><summary>\u{1F4AD} reasoning</summary>");
+      out.push("");
+      out.push(trunc(m.reasoning, 4e3));
+      out.push("");
+      out.push("</details>");
+    }
+    if (m.text?.trim()) {
+      out.push("");
+      if (m.role === "tool") {
+        out.push("```");
+        out.push(trunc(m.text, maxToolChars));
+        out.push("```");
+      } else {
+        out.push(m.text.trim());
+      }
+    }
+    if (m.toolCalls?.length) {
+      out.push("");
+      for (const tc of m.toolCalls) {
+        let parsedArgs;
+        try {
+          parsedArgs = JSON.parse(tc.args);
+        } catch {
+          parsedArgs = tc.args;
+        }
+        out.push(`> \u{1F4DE} ${formatToolCall(tc.name, parsedArgs)}`);
+      }
+    }
+    out.push("");
+  }
+  return out.join("\n");
+}
+function renderJson(session) {
+  return JSON.stringify(session, null, 2);
+}
+async function exportClaudeCodeSession(adapterSessionId, cwd, configDir) {
+  if (!cwd) {
+    throw new Error(
+      "claude-code exporter: cwd is required to locate the JSONL file.\nPass cwd explicitly or use a session id that is in the registry."
+    );
+  }
+  const filePath = join(claudeCodeProjectDir(cwd, configDir), `${adapterSessionId}.jsonl`);
+  let stream;
+  try {
+    stream = createReadStream(filePath, { encoding: "utf8" });
+    await new Promise((resolve16, reject) => {
+      stream.once("error", reject);
+      stream.once("open", resolve16);
+    });
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      throw new Error(
+        `claude-code: JSONL file not found: ${filePath}
+Verify cwd="${cwd}" and adapterSessionId="${adapterSessionId}".`
+      );
+    }
+    throw err;
+  }
+  const messages = [];
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  for await (const line of rl) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry;
+    try {
+      entry = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (IGNORED_CLAUDE_TYPES.has(entry.type)) continue;
+    if (entry.type !== "user" && entry.type !== "assistant") continue;
+    const msg = entry.message;
+    if (!msg) continue;
+    const role = msg.role === "assistant" ? "assistant" : "user";
+    const content = msg.content;
+    if (typeof content === "string") {
+      if (content.trim()) messages.push({ role, text: content.trim() });
+      continue;
+    }
+    if (!Array.isArray(content)) continue;
+    let textAcc = "";
+    let reasoningAcc = "";
+    const toolCalls = [];
+    const toolResults = [];
+    for (const block of content) {
+      switch (block.type) {
+        case "text": {
+          textAcc += block.text;
+          break;
+        }
+        case "thinking": {
+          reasoningAcc += block.thinking;
+          break;
+        }
+        case "tool_use": {
+          const tb = block;
+          const args = typeof tb.input === "string" ? tb.input : JSON.stringify(tb.input ?? {});
+          toolCalls.push({ name: tb.name, args });
+          break;
+        }
+        case "tool_result": {
+          const tb = block;
+          let resultText = "";
+          if (typeof tb.content === "string") {
+            resultText = tb.content;
+          } else if (Array.isArray(tb.content)) {
+            for (const c of tb.content) {
+              if (c.type === "text") resultText += c.text;
+            }
+          }
+          toolResults.push({ text: resultText });
+          break;
+        }
+      }
+    }
+    if (textAcc.trim() || toolCalls.length || reasoningAcc) {
+      const m = { role };
+      if (textAcc.trim()) m.text = textAcc.trim();
+      if (reasoningAcc) m.reasoning = reasoningAcc;
+      if (toolCalls.length) m.toolCalls = toolCalls;
+      messages.push(m);
+    }
+    for (const tr of toolResults) {
+      messages.push({ role: "tool", text: tr.text });
+    }
+  }
+  return { meta: { source: "claude-code" }, messages };
+}
+async function importNodeSqlite() {
+  return import(
+    /* @vite-ignore */
+    NODE_SQLITE
+  );
+}
+async function openHermesDb(dbPath) {
+  let DatabaseSync;
+  try {
+    const sqlite = await importNodeSqlite();
+    DatabaseSync = sqlite.DatabaseSync;
+  } catch {
+    throw new Error("hermes: node:sqlite unavailable. Requires Node.js \u226522.5.0.");
+  }
+  try {
+    return new DatabaseSync(dbPath, { readOnly: true });
+  } catch (err) {
+    const msg = String(err);
+    if (err.code === "ENOENT" || msg.includes("unable to open database file")) {
+      throw new Error(
+        `hermes: state.db not found at ${dbPath}. Has hermes been run at least once?`
+      );
+    }
+    if (msg.includes("SQLITE_BUSY") || msg.includes("database is locked")) {
+      throw new Error(
+        `hermes: database is locked (SQLITE_BUSY). Hermes may be writing. Try again in a moment.`
+      );
+    }
+    throw err;
+  }
+}
+function withRetryOnBusy(fn) {
+  try {
+    return fn();
+  } catch (err) {
+    const msg = String(err);
+    if (msg.includes("SQLITE_BUSY") || msg.includes("database is locked")) {
+      try {
+        return fn();
+      } catch {
+        throw new Error(
+          `hermes: database is locked. Hermes may be actively writing. Try again.`
+        );
+      }
+    }
+    throw err;
+  }
+}
+async function openReadonlySqlite(dbPath, label) {
+  let DatabaseSync;
+  try {
+    const sqlite = await importNodeSqlite();
+    DatabaseSync = sqlite.DatabaseSync;
+  } catch {
+    throw new Error(`${label}: node:sqlite unavailable. Requires Node.js \u226522.5.0.`);
+  }
+  try {
+    return new DatabaseSync(dbPath, { readOnly: true });
+  } catch (err) {
+    const msg = String(err);
+    if (err.code === "ENOENT" || msg.includes("unable to open database file")) {
+      throw new Error(`${label}: database not found at ${dbPath}. Has ${label} been run at least once?`);
+    }
+    if (msg.includes("SQLITE_BUSY") || msg.includes("database is locked")) {
+      throw new Error(`${label}: database is locked (SQLITE_BUSY). It may be writing. Try again in a moment.`);
+    }
+    throw err;
+  }
+}
+async function exportHermesSession(adapterSessionId) {
+  const dbPath = join(homedir(), ".hermes", "state.db");
+  const db = await openHermesDb(dbPath);
+  const session = withRetryOnBusy(
+    () => db.prepare("SELECT * FROM sessions WHERE id = ?").get(adapterSessionId)
+  );
+  if (!session) {
+    db.close();
+    throw new Error(
+      `hermes: session "${adapterSessionId}" not found in ${dbPath}. ACP sessions are indexed by the agentproto UUID passed as resumeSessionId.`
+    );
+  }
+  const rows = withRetryOnBusy(
+    () => db.prepare(
+      "SELECT * FROM messages WHERE session_id = ? ORDER BY id ASC"
+    ).all(adapterSessionId)
+  );
+  db.close();
+  const cost = session.actual_cost_usd != null ? session.actual_cost_usd : session.estimated_cost_usd;
+  const startedAt = session.started_at ? new Date(session.started_at * 1e3).toISOString().replace("T", " ").slice(0, 19) : void 0;
+  const endedAt = session.ended_at ? new Date(session.ended_at * 1e3).toISOString().replace("T", " ").slice(0, 19) : void 0;
+  const meta = {
+    ...session.title ? { title: session.title } : {},
+    ...session.model ? { model: session.model } : {},
+    ...startedAt ? { startedAt } : {},
+    ...endedAt ? { endedAt } : {},
+    ...session.message_count !== void 0 ? { messageCount: session.message_count } : {},
+    ...session.tool_call_count !== void 0 ? { toolCallCount: session.tool_call_count } : {},
+    ...cost != null ? { costUsd: Number(cost) } : {},
+    ...session.source ? { source: session.source } : {}
+  };
+  const tokensInput = session.input_tokens;
+  const tokensOutput = session.output_tokens;
+  const tokensCacheRead = session.cache_read_tokens;
+  const tokensCacheWrite = session.cache_write_tokens;
+  const tokensReasoning = session.reasoning_tokens;
+  if (tokensInput !== void 0 || tokensOutput !== void 0 || tokensCacheRead !== void 0 || tokensCacheWrite !== void 0 || tokensReasoning !== void 0) {
+    meta.tokens = {
+      ...tokensInput !== void 0 ? { input: tokensInput } : {},
+      ...tokensOutput !== void 0 ? { output: tokensOutput } : {},
+      ...tokensCacheRead !== void 0 ? { cacheRead: tokensCacheRead } : {},
+      ...tokensCacheWrite !== void 0 ? { cacheWrite: tokensCacheWrite } : {},
+      ...tokensReasoning !== void 0 ? { reasoning: tokensReasoning } : {}
+    };
+  }
+  const messages = rows.map((row) => {
+    const validRoles = /* @__PURE__ */ new Set(["user", "assistant", "tool", "system"]);
+    const role = validRoles.has(row.role) ? row.role : "user";
+    const reasoning = row.reasoning ?? row.reasoning_content;
+    let toolCalls;
+    if (row.tool_calls) {
+      try {
+        const tc = JSON.parse(row.tool_calls);
+        if (Array.isArray(tc) && tc.length) {
+          toolCalls = tc.map((c) => {
+            const entry = c;
+            const fn = entry.function != null ? entry.function : entry;
+            const name = String(fn.name ?? entry.name ?? "tool");
+            const args = typeof fn.arguments === "string" ? fn.arguments : JSON.stringify(fn.arguments ?? {});
+            return { name, args };
+          });
+        }
+      } catch {
+      }
+    }
+    const m = { role };
+    if (row.content?.trim()) m.text = row.content.trim();
+    if (reasoning && String(reasoning).trim()) m.reasoning = String(reasoning);
+    if (row.tool_name) m.toolName = row.tool_name;
+    if (toolCalls) m.toolCalls = toolCalls;
+    if (row.timestamp) m.ts = row.timestamp;
+    return m;
+  });
+  void crossValidateHermesExport(adapterSessionId, messages.length).catch(() => {
+  });
+  return { meta, messages };
+}
+function hermesRowToCandidate(row) {
+  const startedAtIso = row.started_at !== void 0 ? new Date(row.started_at * 1e3).toISOString() : void 0;
+  const lastActivitySec = row.ended_at ?? row.started_at;
+  const lastActivityIso = lastActivitySec !== void 0 ? new Date(lastActivitySec * 1e3).toISOString() : void 0;
+  return {
+    conversationId: row.id,
+    ...startedAtIso ? { startedAt: startedAtIso } : {},
+    ...lastActivityIso ? { lastActivityAt: lastActivityIso } : {},
+    ...row.message_count !== void 0 ? { messageCount: row.message_count } : {},
+    ...row.title ? { preview: row.title } : {},
+    ...row.source ? { lastWriter: row.source } : {}
+  };
+}
+async function discoverHermesSessions(cwd, since, expectedId) {
+  const dbPath = join(homedir(), ".hermes", "state.db");
+  let db;
+  try {
+    db = await openHermesDb(dbPath);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("state.db not found")) return [];
+    throw err;
+  }
+  try {
+    if (expectedId) {
+      const row = withRetryOnBusy(
+        () => db.prepare("SELECT * FROM sessions WHERE id = ?").get(expectedId)
+      );
+      return row ? [hermesRowToCandidate(row)] : [];
+    }
+    const rows = withRetryOnBusy(
+      () => db.prepare("SELECT * FROM sessions WHERE cwd = ?").all(cwd)
+    );
+    const sinceMs = since ? Date.parse(since) : NaN;
+    return rows.filter((row) => {
+      if (!Number.isFinite(sinceMs)) return true;
+      const lastActivitySec = row.ended_at ?? row.started_at;
+      if (lastActivitySec === void 0) return true;
+      return lastActivitySec * 1e3 >= sinceMs - 1e3;
+    }).map(hermesRowToCandidate);
+  } finally {
+    db.close();
+  }
+}
+async function defaultHermesRunner(adapterSessionId) {
+  const { spawn: spawn4 } = await import('child_process');
+  return new Promise((resolve16, reject) => {
+    const chunks = [];
+    const errChunks = [];
+    const proc = spawn4(
+      "hermes",
+      ["sessions", "export", "--session-id", adapterSessionId, "-"],
+      { stdio: ["ignore", "pipe", "pipe"] }
+    );
+    proc.stdout.on("data", (chunk) => chunks.push(chunk));
+    proc.stderr.on("data", (chunk) => errChunks.push(chunk));
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        reject(
+          new Error(
+            `hermes exited with code ${code}: ${Buffer.concat(errChunks).toString()}`
+          )
+        );
+      } else {
+        resolve16(Buffer.concat(chunks).toString("utf8"));
+      }
+    });
+  });
+}
+async function crossValidateHermesExport(adapterSessionId, sqliteCount, _runner = defaultHermesRunner) {
+  let stdout;
+  try {
+    stdout = await _runner(adapterSessionId);
+  } catch (err) {
+    const msg = String(err);
+    if (err.code === "ENOENT" || msg.includes("ENOENT") || msg.includes("not found")) {
+      return { sqliteCount, binaryCount: -1, matched: true, binaryUnavailable: true };
+    }
+    return null;
+  }
+  const binaryCount = stdout.split("\n").filter((l) => l.trim()).filter((l) => {
+    try {
+      const obj = JSON.parse(l);
+      return typeof obj.role === "string";
+    } catch {
+      return false;
+    }
+  }).length;
+  const matched = binaryCount === sqliteCount;
+  if (!matched) {
+    console.warn(
+      `[hermes export] cross-validation mismatch for session ${adapterSessionId}: SQLite=${sqliteCount} messages, binary=${binaryCount} messages. The state.db schema may have changed \u2014 check the SQLite reader in transcript-export.ts.`
+    );
+  }
+  return { sqliteCount, binaryCount, matched };
+}
+async function exportDaemonEventsSession(sessionId, desc) {
+  const filePath = sessionEventsPath(sessionId);
+  let stream;
+  try {
+    stream = createReadStream(filePath, { encoding: "utf8" });
+    await new Promise((resolve16, reject) => {
+      stream.once("error", reject);
+      stream.once("open", resolve16);
+    });
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      throw new Error(
+        `daemon-events: no events.jsonl for session "${sessionId}" (${filePath}).
+Either the session never drove an agent-cli turn, or it predates this feature.`
+      );
+    }
+    throw err;
+  }
+  const messages = [];
+  const toolNameById = /* @__PURE__ */ new Map();
+  let toolCallCount = 0;
+  let lastUsage;
+  let asmText = "";
+  let asmReasoning = "";
+  let asmToolCalls = [];
+  let asmTs;
+  const flushAssistant = () => {
+    if (!asmText.trim() && !asmReasoning.trim() && asmToolCalls.length === 0) return;
+    const m = { role: "assistant" };
+    if (asmText.trim()) m.text = asmText.trim();
+    if (asmReasoning.trim()) m.reasoning = asmReasoning.trim();
+    if (asmToolCalls.length) m.toolCalls = asmToolCalls;
+    if (asmTs !== void 0) m.ts = asmTs;
+    messages.push(m);
+    asmText = "";
+    asmReasoning = "";
+    asmToolCalls = [];
+    asmTs = void 0;
+  };
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  for await (const line of rl) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let rec;
+    try {
+      rec = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const ts = Date.parse(rec.ts);
+    const tsOrUndefined = Number.isNaN(ts) ? void 0 : ts;
+    if (rec.kind === void 0 && typeof rec.command === "string" && typeof rec.exitCode === "number") {
+      flushAssistant();
+      const toolName = "command_execute";
+      const argsJson = JSON.stringify({
+        command: rec.command,
+        args: Array.isArray(rec.args) ? rec.args : [],
+        ...rec.cwd !== void 0 ? { cwd: rec.cwd } : {}
+      });
+      messages.push({
+        role: "assistant",
+        toolCalls: [{ name: toolName, args: argsJson }],
+        ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {}
+      });
+      const header = `exit code ${rec.exitCode}` + (rec.signal ? `, signal ${rec.signal}` : "") + (typeof rec.durationMs === "number" ? `, ${rec.durationMs}ms` : "");
+      const sections = [header];
+      if (rec.stdout) sections.push(`stdout:
+${rec.stdout}`);
+      if (rec.stderr) sections.push(`stderr:
+${rec.stderr}`);
+      if (rec.truncated) sections.push("(output truncated)");
+      if (rec.timedOut) sections.push("(timed out)");
+      const text = sections.join("\n");
+      messages.push({
+        role: "tool",
+        text: rec.exitCode !== 0 ? `[error] ${text}` : text,
+        toolName,
+        ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {}
+      });
+      toolCallCount += 1;
+      continue;
+    }
+    switch (rec.kind) {
+      case "user-prompt":
+        flushAssistant();
+        messages.push({ role: "user", text: rec.text ?? "", ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {} });
+        break;
+      case "session-message": {
+        flushAssistant();
+        const m = rec.message;
+        if (!m) break;
+        const relation = m.from?.relation ?? "system";
+        messages.push({
+          role: "user",
+          text: m.text ?? "",
+          from: {
+            ...m.from?.sessionId ? { sessionId: m.from.sessionId } : {},
+            ...m.from?.label ? { label: m.from.label } : {},
+            relation,
+            kind: m.kind ?? "report",
+            messageId: m.id
+          },
+          ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {}
+        });
+        break;
+      }
+      case "system-prompt":
+        flushAssistant();
+        messages.push({ role: "system", text: rec.text ?? "", ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {} });
+        break;
+      case "text-delta":
+        if (asmTs === void 0) asmTs = tsOrUndefined;
+        asmText += rec.text ?? "";
+        break;
+      case "thought":
+        if (asmTs === void 0) asmTs = tsOrUndefined;
+        asmReasoning += rec.text ?? "";
+        break;
+      case "tool-call": {
+        if (asmTs === void 0) asmTs = tsOrUndefined;
+        const name = rec.toolName ?? "tool";
+        if (rec.toolCallId) toolNameById.set(rec.toolCallId, name);
+        const args = typeof rec.arguments === "string" ? rec.arguments : JSON.stringify(rec.arguments ?? {});
+        asmToolCalls.push({ name, args });
+        toolCallCount += 1;
+        break;
+      }
+      case "tool-result": {
+        flushAssistant();
+        const name = rec.toolCallId ? toolNameById.get(rec.toolCallId) : void 0;
+        const text = typeof rec.result === "string" ? rec.result : JSON.stringify(rec.result ?? "");
+        messages.push({
+          role: "tool",
+          text: rec.isError ? `[error] ${text}` : text,
+          ...name ? { toolName: name } : {},
+          ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {}
+        });
+        break;
+      }
+      case "agent-prompt":
+        flushAssistant();
+        messages.push({ role: "system", text: "[awaiting input] agent requested a decision" });
+        break;
+      case "plan": {
+        flushAssistant();
+        const entries = rec.entries ?? [];
+        const done = entries.filter((e) => e.status === "completed").length;
+        const list = entries.map((e) => e.content).join("; ");
+        messages.push({ role: "system", text: `[plan] ${done}/${entries.length} ${list}`.trim() });
+        break;
+      }
+      case "usage_update":
+        lastUsage = { size: rec.size, used: rec.used, cost: rec.cost };
+        break;
+      case "error":
+        flushAssistant();
+        messages.push({ role: "system", text: `[error] ${rec.error?.message ?? "unknown"}` });
+        break;
+      case "turn-end":
+        flushAssistant();
+        break;
+      case "notice":
+        flushAssistant();
+        messages.push({ role: "system", text: rec.text ?? "" });
+        break;
+    }
+  }
+  flushAssistant();
+  const meta = { source: "daemon-events" };
+  if (desc?.label) meta.title = desc.label;
+  else if (desc?.command) {
+    meta.title = desc.command.length > 120 ? `${desc.command.slice(0, 120)}\u2026` : desc.command;
+  }
+  if (desc?.model) meta.model = desc.model;
+  if (desc?.startedAt) meta.startedAt = desc.startedAt;
+  if (desc?.endedAt) meta.endedAt = desc.endedAt;
+  if (desc?.origin) meta.origin = desc.origin;
+  if (desc?.callerSessionId) meta.callerSessionId = desc.callerSessionId;
+  meta.messageCount = messages.length;
+  meta.toolCallCount = toolCallCount;
+  if (desc?.costUsd !== void 0) meta.costUsd = desc.costUsd;
+  else if (lastUsage?.cost) meta.costUsd = lastUsage.cost.amount;
+  if (desc?.tokensIn !== void 0 || desc?.tokensOut !== void 0) {
+    meta.tokens = {
+      ...desc?.tokensIn !== void 0 ? { input: desc.tokensIn } : {},
+      ...desc?.tokensOut !== void 0 ? { output: desc.tokensOut } : {}
+    };
+  }
+  return { meta, messages };
+}
+async function readFirstJsonLine(path) {
+  const stream = createReadStream(path, { encoding: "utf8" });
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  try {
+    for await (const line of rl) {
+      const t = line.trim();
+      if (t) return t;
+    }
+    return void 0;
+  } finally {
+    rl.close();
+    stream.destroy();
+  }
+}
+function codexHome() {
+  return process.env.CODEX_HOME ?? join(homedir(), ".codex");
+}
+function codexSessionsDir() {
+  return join(codexHome(), "sessions");
+}
+async function walkCodexRollouts(dir) {
+  let entries;
+  try {
+    entries = await promises.readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) {
+      out.push(...await walkCodexRollouts(p));
+    } else if (e.isFile() && e.name.startsWith("rollout-") && e.name.endsWith(".jsonl")) {
+      out.push(p);
+    }
+  }
+  return out;
+}
+function codexBlocksText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  let acc = "";
+  for (const c of content) {
+    if (c && typeof c === "object") {
+      const b = c;
+      if (typeof b.text === "string" && (b.type === "input_text" || b.type === "output_text" || b.type === "text")) {
+        acc += b.text;
+      }
+    }
+  }
+  return acc;
+}
+async function findCodexRolloutFile(conversationId) {
+  const files = await walkCodexRollouts(codexSessionsDir());
+  const byName = files.find((f) => f.endsWith(`-${conversationId}.jsonl`));
+  if (byName) return byName;
+  for (const f of files) {
+    const first = await readFirstJsonLine(f);
+    if (!first) continue;
+    let meta;
+    try {
+      meta = JSON.parse(first);
+    } catch {
+      continue;
+    }
+    const p = meta.payload;
+    if (p && (p.id === conversationId || p.session_id === conversationId)) return f;
+  }
+  return void 0;
+}
+async function exportCodexSession(conversationId) {
+  const file = await findCodexRolloutFile(conversationId);
+  if (!file) {
+    throw new Error(
+      `codex: no rollout file for conversation "${conversationId}" under ${codexSessionsDir()}.
+The session may predate persistence, or CODEX_HOME points elsewhere.`
+    );
+  }
+  const stream = createReadStream(file, { encoding: "utf8" });
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  const messages = [];
+  const toolNameByCall = /* @__PURE__ */ new Map();
+  let toolCallCount = 0;
+  let startedAt;
+  let model;
+  for await (const line of rl) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry;
+    try {
+      entry = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const p = entry.payload ?? {};
+    if (entry.type === "session_meta") {
+      startedAt = p.timestamp ?? entry.timestamp;
+      if (typeof p.model === "string") model = p.model;
+      continue;
+    }
+    if (entry.type === "turn_context") {
+      if (!model && typeof p.model === "string") model = p.model;
+      continue;
+    }
+    if (entry.type !== "response_item") continue;
+    switch (p.type) {
+      case "message": {
+        const text = codexBlocksText(p.content).trim();
+        if (!text) break;
+        const role = p.role === "assistant" ? "assistant" : p.role === "user" ? "user" : "system";
+        messages.push({ role, text });
+        break;
+      }
+      case "reasoning": {
+        const r = (p.summary ?? []).map((s) => s.text ?? "").join("\n").trim();
+        if (r) messages.push({ role: "assistant", reasoning: r });
+        break;
+      }
+      case "function_call":
+      case "custom_tool_call": {
+        const name = p.name ?? "tool";
+        if (typeof p.call_id === "string") toolNameByCall.set(p.call_id, name);
+        const raw = p.type === "custom_tool_call" ? p.input : p.arguments;
+        const args = typeof raw === "string" ? raw : JSON.stringify(raw ?? {});
+        messages.push({ role: "assistant", toolCalls: [{ name, args }] });
+        toolCallCount += 1;
+        break;
+      }
+      case "function_call_output":
+      case "custom_tool_call_output": {
+        const name = typeof p.call_id === "string" ? toolNameByCall.get(p.call_id) : void 0;
+        const out = codexBlocksText(p.output) || (typeof p.output === "string" ? p.output : "");
+        messages.push({ role: "tool", text: out, ...name ? { toolName: name } : {} });
+        break;
+      }
+    }
+  }
+  const meta = { source: "codex" };
+  if (startedAt) meta.startedAt = startedAt;
+  if (model) meta.model = model;
+  meta.messageCount = messages.length;
+  meta.toolCallCount = toolCallCount;
+  return { meta, messages };
+}
+async function discoverCodexSessions(cwd, since, until, expectedId) {
+  const files = await walkCodexRollouts(codexSessionsDir());
+  const sinceMs = since ? Date.parse(since) : NaN;
+  const untilMs = until ? Date.parse(until) : NaN;
+  const scored = [];
+  for (const f of files) {
+    let mtimeMs;
+    try {
+      mtimeMs = (await promises.stat(f)).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (Number.isFinite(sinceMs) && mtimeMs < sinceMs - 1e3) continue;
+    const first = await readFirstJsonLine(f);
+    if (!first) continue;
+    let meta;
+    try {
+      meta = JSON.parse(first);
+    } catch {
+      continue;
+    }
+    if (meta.type !== "session_meta") continue;
+    const p = meta.payload ?? {};
+    const id = p.id ?? p.session_id;
+    if (!id) continue;
+    if (expectedId) {
+      if (id !== expectedId) continue;
+    } else if (p.cwd !== cwd) {
+      continue;
+    }
+    const startedAt = p.timestamp;
+    if (Number.isFinite(untilMs) && startedAt) {
+      const startedMs = Date.parse(startedAt);
+      if (Number.isFinite(startedMs) && startedMs > untilMs) continue;
+    }
+    scored.push({
+      candidate: {
+        conversationId: id,
+        ...startedAt ? { startedAt } : {},
+        lastActivityAt: new Date(mtimeMs).toISOString()
+      },
+      mtimeMs
+    });
+  }
+  scored.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return scored.map((s) => s.candidate);
+}
+function openCodeDbPath() {
+  const dataHome = process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share");
+  return join(dataHome, "opencode", "opencode.db");
+}
+function openCodeModelLabel(raw) {
+  if (!raw) return void 0;
+  try {
+    const m = JSON.parse(raw);
+    const id = m.modelID ?? m.id;
+    if (!id) return void 0;
+    return m.providerID ? `${m.providerID}/${id}` : id;
+  } catch {
+    return void 0;
+  }
+}
+async function exportOpenCodeSession(conversationId) {
+  const dbPath = openCodeDbPath();
+  const db = await openReadonlySqlite(dbPath, "opencode");
+  try {
+    const session = withRetryOnBusy(
+      () => db.prepare("SELECT * FROM session WHERE id = ?").get(conversationId)
+    );
+    if (!session) {
+      throw new Error(
+        `opencode: session "${conversationId}" not found in ${dbPath}. Sessions are keyed by the ACP session id (ses_\u2026) recorded as adapterSessionId.`
+      );
+    }
+    const msgRows = withRetryOnBusy(
+      () => db.prepare("SELECT id, data, time_created FROM message WHERE session_id = ? ORDER BY time_created ASC, id ASC").all(conversationId)
+    );
+    const partRows = withRetryOnBusy(
+      () => db.prepare("SELECT message_id, data, time_created FROM part WHERE session_id = ? ORDER BY time_created ASC, id ASC").all(conversationId)
+    );
+    const partsByMsg = /* @__PURE__ */ new Map();
+    for (const r of partRows) {
+      const list = partsByMsg.get(r.message_id) ?? [];
+      list.push(r);
+      partsByMsg.set(r.message_id, list);
+    }
+    const messages = [];
+    let toolCallCount = 0;
+    for (const m of msgRows) {
+      let mdata;
+      try {
+        mdata = JSON.parse(m.data);
+      } catch {
+        continue;
+      }
+      const role = mdata.role === "assistant" ? "assistant" : "user";
+      let text = "";
+      let reasoning = "";
+      const toolCalls = [];
+      const toolResults = [];
+      for (const pr of partsByMsg.get(m.id) ?? []) {
+        let part;
+        try {
+          part = JSON.parse(pr.data);
+        } catch {
+          continue;
+        }
+        switch (part.type) {
+          case "text":
+            if (part.text) text += part.text;
+            break;
+          case "reasoning":
+            if (part.text) reasoning += part.text;
+            break;
+          case "tool": {
+            const name = part.tool ?? "tool";
+            toolCalls.push({ name, args: JSON.stringify(part.state?.input ?? {}) });
+            toolCallCount += 1;
+            const output = part.state?.output;
+            if (output !== void 0 && output !== null && output !== "") {
+              toolResults.push({ name, text: typeof output === "string" ? output : JSON.stringify(output) });
+            }
+            break;
+          }
+        }
+      }
+      if (text.trim() || reasoning.trim() || toolCalls.length) {
+        const em = { role };
+        if (text.trim()) em.text = text.trim();
+        if (reasoning.trim()) em.reasoning = reasoning.trim();
+        if (toolCalls.length) em.toolCalls = toolCalls;
+        em.ts = m.time_created;
+        messages.push(em);
+      }
+      for (const tr of toolResults) {
+        messages.push({ role: "tool", text: tr.text, ...tr.name ? { toolName: tr.name } : {} });
+      }
+    }
+    const meta = { source: "opencode" };
+    if (session.title) meta.title = session.title;
+    const model = openCodeModelLabel(session.model);
+    if (model) meta.model = model;
+    if (session.time_created) meta.startedAt = new Date(session.time_created).toISOString();
+    if (session.time_updated) meta.endedAt = new Date(session.time_updated).toISOString();
+    meta.messageCount = messages.length;
+    meta.toolCallCount = toolCallCount;
+    if (session.cost != null) meta.costUsd = Number(session.cost);
+    const tk = {
+      ...session.tokens_input != null ? { input: session.tokens_input } : {},
+      ...session.tokens_output != null ? { output: session.tokens_output } : {},
+      ...session.tokens_cache_read != null ? { cacheRead: session.tokens_cache_read } : {},
+      ...session.tokens_cache_write != null ? { cacheWrite: session.tokens_cache_write } : {},
+      ...session.tokens_reasoning != null ? { reasoning: session.tokens_reasoning } : {}
+    };
+    if (Object.keys(tk).length) meta.tokens = tk;
+    return { meta, messages };
+  } finally {
+    db.close();
+  }
+}
+async function discoverOpenCodeSessions(cwd, since, expectedId) {
+  const dbPath = openCodeDbPath();
+  let db;
+  try {
+    db = await openReadonlySqlite(dbPath, "opencode");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("database not found")) return [];
+    throw err;
+  }
+  try {
+    if (expectedId) {
+      const row = withRetryOnBusy(
+        () => db.prepare("SELECT * FROM session WHERE id = ?").get(expectedId)
+      );
+      return row ? [openCodeRowToCandidate(row)] : [];
+    }
+    const rows = withRetryOnBusy(
+      () => db.prepare("SELECT * FROM session WHERE directory = ?").all(cwd)
+    );
+    const sinceMs = since ? Date.parse(since) : NaN;
+    return rows.filter((r) => {
+      if (!Number.isFinite(sinceMs)) return true;
+      if (r.time_created === void 0) return false;
+      return r.time_created >= sinceMs - 1e3;
+    }).map(openCodeRowToCandidate);
+  } finally {
+    db.close();
+  }
+}
+function openCodeRowToCandidate(row) {
+  return {
+    conversationId: row.id,
+    ...row.time_created ? { startedAt: new Date(row.time_created).toISOString() } : {},
+    ...row.time_updated ? { lastActivityAt: new Date(row.time_updated).toISOString() } : {},
+    ...row.title ? { preview: row.title } : {}
+  };
+}
+function mastracodeInprocessDbPath() {
+  const home = process.env.AGENTPROTO_HOME ?? join(homedir(), ".agentproto");
+  return join(home, "mastracode-inprocess", "storage.db");
+}
+function mastraThreadId(conversationId) {
+  const idx = conversationId.indexOf(":");
+  return idx > 0 ? conversationId.slice(idx + 1) : conversationId;
+}
+function mastraContentToMessage(role, content) {
+  const toolResults = [];
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return { message: void 0, toolResults, toolCalls: 0 };
+  }
+  let text = "";
+  let reasoning = "";
+  const toolCalls = [];
+  for (const raw of parsed.parts ?? []) {
+    if (!raw || typeof raw !== "object") continue;
+    const part = raw;
+    if (part.type === "text" && part.text) text += part.text;
+    else if (part.type === "reasoning" && part.reasoning) reasoning += part.reasoning;
+    else if (part.type === "tool-invocation" && part.toolInvocation) {
+      const inv = part.toolInvocation;
+      const name = inv.toolName ?? "tool";
+      toolCalls.push({ name, args: JSON.stringify(inv.args ?? {}) });
+      if (inv.result !== void 0) {
+        const r = inv.result;
+        const rtext = Array.isArray(r?.content) ? r.content.filter((c) => c?.type === "text").map((c) => c.text ?? "").join("") : typeof inv.result === "string" ? inv.result : JSON.stringify(inv.result);
+        toolResults.push({ name, text: rtext });
+      }
+    }
+  }
+  let message;
+  if (text.trim() || reasoning.trim() || toolCalls.length) {
+    message = { role };
+    if (text.trim()) message.text = text.trim();
+    if (reasoning.trim()) message.reasoning = reasoning.trim();
+    if (toolCalls.length) message.toolCalls = toolCalls;
+  }
+  return { message, toolResults, toolCalls: toolCalls.length };
+}
+async function exportMastracodeInprocessSession(conversationId) {
+  const threadId = mastraThreadId(conversationId);
+  const dbPath = mastracodeInprocessDbPath();
+  const db = await openReadonlySqlite(dbPath, "mastracode-inprocess");
+  try {
+    const thread = withRetryOnBusy(
+      () => db.prepare("SELECT * FROM mastra_threads WHERE id = ?").get(threadId)
+    );
+    if (!thread) {
+      throw new Error(
+        `mastracode-inprocess: thread "${threadId}" not found in ${dbPath}. The sessionId is "<resourceId>:<threadId>"; only the threadId is looked up.`
+      );
+    }
+    const rows = withRetryOnBusy(
+      () => db.prepare('SELECT role, content, createdAt FROM mastra_messages WHERE thread_id = ? ORDER BY "createdAt" ASC').all(threadId)
+    );
+    const messages = [];
+    let toolCallCount = 0;
+    for (const r of rows) {
+      const role = r.role === "assistant" ? "assistant" : "user";
+      const { message, toolResults, toolCalls } = mastraContentToMessage(role, r.content);
+      if (message) messages.push(message);
+      toolCallCount += toolCalls;
+      for (const tr of toolResults) {
+        messages.push({ role: "tool", text: tr.text, ...tr.name ? { toolName: tr.name } : {} });
+      }
+    }
+    const meta = { source: "mastracode-inprocess" };
+    if (thread.title) meta.title = thread.title;
+    if (thread.createdAt) meta.startedAt = thread.createdAt;
+    if (thread.updatedAt) meta.endedAt = thread.updatedAt;
+    meta.messageCount = messages.length;
+    meta.toolCallCount = toolCallCount;
+    return { meta, messages };
+  } finally {
+    db.close();
+  }
+}
+async function discoverMastracodeInprocessSessions(_cwd, since, expectedId) {
+  const dbPath = mastracodeInprocessDbPath();
+  let db;
+  try {
+    db = await openReadonlySqlite(dbPath, "mastracode-inprocess");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("database not found")) return [];
+    throw err;
+  }
+  try {
+    if (!expectedId) return [];
+    const threadId = mastraThreadId(expectedId);
+    const thread = withRetryOnBusy(
+      () => db.prepare("SELECT * FROM mastra_threads WHERE id = ?").get(threadId)
+    );
+    if (!thread) return [];
+    const sinceMs = since ? Date.parse(since) : NaN;
+    if (Number.isFinite(sinceMs) && thread.updatedAt) {
+      const upd = Date.parse(thread.updatedAt);
+      if (Number.isFinite(upd) && upd < sinceMs - 1e3) return [];
+    }
+    return [
+      {
+        // Echo back the full composite id so callers/read() round-trip it.
+        conversationId: expectedId,
+        ...thread.createdAt ? { startedAt: thread.createdAt } : {},
+        ...thread.updatedAt ? { lastActivityAt: thread.updatedAt } : {},
+        ...thread.title ? { preview: thread.title } : {}
+      }
+    ];
+  } finally {
+    db.close();
+  }
+}
+function piSessionsDir() {
+  return join(homedir(), ".pi", "agent", "sessions");
+}
+function piBlocksText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  let acc = "";
+  for (const c of content) {
+    if (c && typeof c === "object") {
+      const b = c;
+      if (b.type === "text" && typeof b.text === "string") acc += b.text;
+    }
+  }
+  return acc;
+}
+async function walkPiSessionFiles(dir) {
+  let entries;
+  try {
+    entries = await promises.readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) out.push(...await walkPiSessionFiles(p));
+    else if (e.isFile() && e.name.endsWith(".jsonl")) out.push(p);
+  }
+  return out;
+}
+async function findPiSessionFile(conversationId) {
+  const files = await walkPiSessionFiles(piSessionsDir());
+  const byName = files.find((f) => f.endsWith(`_${conversationId}.jsonl`));
+  if (byName) return byName;
+  for (const f of files) {
+    const first = await readFirstJsonLine(f);
+    if (!first) continue;
+    try {
+      const meta = JSON.parse(first);
+      if (meta.type === "session" && meta.id === conversationId) return f;
+    } catch {
+    }
+  }
+  return void 0;
+}
+async function exportPiSession(conversationId) {
+  const file = await findPiSessionFile(conversationId);
+  if (!file) {
+    throw new Error(
+      `pi: no session file for conversation "${conversationId}" under ${piSessionsDir()}.`
+    );
+  }
+  const stream = createReadStream(file, { encoding: "utf8" });
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  const messages = [];
+  let toolCallCount = 0;
+  let startedAt;
+  let model;
+  for await (const line of rl) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry;
+    try {
+      entry = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (entry.type === "session") {
+      startedAt = entry.timestamp;
+      continue;
+    }
+    if (entry.type === "model_change") {
+      model = entry.provider ? `${entry.provider}/${entry.modelId ?? ""}` : entry.modelId;
+      continue;
+    }
+    if (entry.type !== "message" || !entry.message) continue;
+    const m = entry.message;
+    const content = m.content;
+    if (m.role === "toolResult") {
+      const text2 = piBlocksText(content);
+      messages.push({
+        role: "tool",
+        text: m.isError ? `[error] ${text2}` : text2,
+        ...m.toolName ? { toolName: m.toolName } : {}
+      });
+      continue;
+    }
+    const role = m.role === "assistant" ? "assistant" : "user";
+    let text = "";
+    let reasoning = "";
+    const toolCalls = [];
+    if (typeof content === "string") {
+      text = content;
+    } else if (Array.isArray(content)) {
+      for (const raw of content) {
+        if (!raw || typeof raw !== "object") continue;
+        const part = raw;
+        if (part.type === "text" && part.text) text += part.text;
+        else if (part.type === "thinking" && part.thinking) reasoning += part.thinking;
+        else if (part.type === "toolCall") {
+          toolCalls.push({ name: part.name ?? "tool", args: JSON.stringify(part.arguments ?? {}) });
+          toolCallCount += 1;
+        }
+      }
+    }
+    if (text.trim() || reasoning.trim() || toolCalls.length) {
+      const em = { role };
+      if (text.trim()) em.text = text.trim();
+      if (reasoning.trim()) em.reasoning = reasoning.trim();
+      if (toolCalls.length) em.toolCalls = toolCalls;
+      messages.push(em);
+    }
+  }
+  const meta = { source: "pi" };
+  if (startedAt) meta.startedAt = startedAt;
+  if (model) meta.model = model;
+  meta.messageCount = messages.length;
+  meta.toolCallCount = toolCallCount;
+  return { meta, messages };
+}
+async function discoverPiSessions(cwd, since, until, expectedId) {
+  const files = await walkPiSessionFiles(piSessionsDir());
+  const sinceMs = since ? Date.parse(since) : NaN;
+  const untilMs = until ? Date.parse(until) : NaN;
+  const scored = [];
+  for (const f of files) {
+    let mtimeMs;
+    try {
+      mtimeMs = (await promises.stat(f)).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (Number.isFinite(sinceMs) && mtimeMs < sinceMs - 1e3) continue;
+    const first = await readFirstJsonLine(f);
+    if (!first) continue;
+    let meta;
+    try {
+      meta = JSON.parse(first);
+    } catch {
+      continue;
+    }
+    if (meta.type !== "session" || !meta.id) continue;
+    if (expectedId) {
+      if (meta.id !== expectedId) continue;
+    } else if (meta.cwd !== cwd) {
+      continue;
+    }
+    const startedAt = meta.timestamp;
+    if (Number.isFinite(untilMs) && startedAt) {
+      const s = Date.parse(startedAt);
+      if (Number.isFinite(s) && s > untilMs) continue;
+    }
+    scored.push({
+      candidate: {
+        conversationId: meta.id,
+        ...startedAt ? { startedAt } : {},
+        lastActivityAt: new Date(mtimeMs).toISOString()
+      },
+      mtimeMs
+    });
+  }
+  scored.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return scored.map((s) => s.candidate);
+}
+async function exportAgentSession(input) {
+  const { sessionId, registry, format = "markdown", maxToolChars = 1200 } = input;
+  const source = input.source ?? "auto";
+  let adapterSlug = input.adapter;
+  let cwd = input.cwd;
+  let adapterSessionId = sessionId;
+  let configDir;
+  const err = (msg) => ({
+    sessionId,
+    adapter: adapterSlug ?? "unknown",
+    format,
+    meta: {},
+    content: `Error: ${msg}`
+  });
+  const desc = registry.findByIdOrName(sessionId);
+  const daemonSessionId = desc?.id ?? sessionId;
+  if (desc) {
+    adapterSlug = adapterSlug ?? desc.adapterSlug;
+    cwd = cwd ?? desc.cwd;
+    configDir = desc.adapterConfigDir;
+    if (desc.adapterSessionId) adapterSessionId = desc.adapterSessionId;
+  }
+  const tryNative = async () => {
+    if (!adapterSlug) {
+      throw new Error(
+        `session "${sessionId}" not found in registry and no adapter override supplied.
+Pass adapter explicitly or use a known session id (sess_xxx or name).`
+      );
+    }
+    const exporter = EXPORT_STRATEGIES[adapterSlug];
+    if (!exporter) {
+      const supported = Object.keys(EXPORT_STRATEGIES).join(", ");
+      throw new Error(
+        `no exporter for adapter "${adapterSlug}". Supported: ${supported}.
+Only sessions spawned via claude-code or hermes can be exported.`
+      );
+    }
+    return exporter.exportSession(adapterSessionId, cwd, configDir);
+  };
+  const tryDaemon = () => exportDaemonEventsSession(daemonSessionId, desc);
+  let session;
+  try {
+    if (source === "native") {
+      session = await tryNative();
+    } else if (source === "daemon") {
+      session = await tryDaemon();
+    } else {
+      try {
+        session = await tryNative();
+      } catch (nativeErr) {
+        try {
+          session = await tryDaemon();
+        } catch (daemonErr) {
+          const nativeMsg = nativeErr instanceof Error ? nativeErr.message : String(nativeErr);
+          const daemonMsg = daemonErr instanceof Error ? daemonErr.message : String(daemonErr);
+          return err(`${nativeMsg}
+(daemon-events fallback also failed: ${daemonMsg})`);
+        }
+      }
+    }
+  } catch (e) {
+    return err(e instanceof Error ? e.message : String(e));
+  }
+  const content = format === "json" ? renderJson(session) : renderMarkdown(session, { maxToolChars });
+  return {
+    sessionId,
+    adapter: adapterSlug ?? (session.meta.source === "daemon-events" ? "daemon" : "unknown"),
+    format,
+    meta: session.meta,
+    content
+  };
+}
+var ROLE_ICON, IGNORED_CLAUDE_TYPES, NODE_SQLITE, EXPORT_STRATEGIES;
+var init_transcript_export = __esm({
+  "src/transcript-export.ts"() {
+    init_tool_presenter();
+    init_transcript_writer();
+    init_conversation_store();
+    ROLE_ICON = {
+      user: "\u{1F9D1} User",
+      assistant: "\u{1F916} Assistant",
+      tool: "\u{1F527} Tool",
+      system: "\u2699\uFE0F System"
+    };
+    IGNORED_CLAUDE_TYPES = /* @__PURE__ */ new Set([
+      "queue-operation",
+      "attachment",
+      "file-history-snapshot",
+      "ai-title",
+      "last-prompt"
+    ]);
+    NODE_SQLITE = "node:sqlite";
+    EXPORT_STRATEGIES = {
+      "claude-code": {
+        exportSession: exportClaudeCodeSession
+      },
+      hermes: {
+        exportSession: (id) => exportHermesSession(id)
+      },
+      codex: {
+        exportSession: (id) => exportCodexSession(id)
+      },
+      opencode: {
+        exportSession: (id) => exportOpenCodeSession(id)
+      },
+      "mastracode-inprocess": {
+        exportSession: (id) => exportMastracodeInprocessSession(id)
+      },
+      pi: {
+        exportSession: (id) => exportPiSession(id)
+      }
+    };
+  }
+});
+function claudeProjectSlug(cwd) {
+  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
+}
+function claudeCodeProjectDir(cwd, configDir) {
+  const base = configDir ?? resolve(homedir(), ".claude");
+  return resolve(base, "projects", claudeProjectSlug(cwd));
+}
+function extractFirstText(content) {
+  if (typeof content === "string") {
+    const t = content.trim();
+    return t || void 0;
+  }
+  if (Array.isArray(content)) {
+    for (const block of content) {
+      if (block && typeof block === "object" && block.type === "text" && typeof block.text === "string") {
+        const t = block.text.trim();
+        if (t) return t;
+      }
+    }
+  }
+  return void 0;
+}
+function isClaudeControlText(text) {
+  return /^<(?:local-command-caveat|local-command-stdout|command-name|task-notification)>/i.test(text);
+}
+async function scanClaudeJsonl(filePath) {
+  const stream = createReadStream(filePath, { encoding: "utf8" });
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  let startedAt;
+  let lastActivityAt;
+  let messageCount = 0;
+  let preview;
+  let lastWriter;
+  for await (const line of rl) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry;
+    try {
+      entry = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (typeof entry.timestamp === "string") {
+      if (!startedAt) startedAt = entry.timestamp;
+      lastActivityAt = entry.timestamp;
+    }
+    if (typeof entry.entrypoint === "string") {
+      lastWriter = entry.entrypoint;
+    }
+    if (entry.type === "user" || entry.type === "assistant") {
+      messageCount += 1;
+      if (preview === void 0 && entry.type === "user") {
+        const text = extractFirstText(entry.message?.content);
+        if (text !== void 0 && !isClaudeControlText(text)) {
+          preview = text.length > 120 ? text.slice(0, 120) : text;
+        }
+      }
+    }
+  }
+  return { startedAt, lastActivityAt, messageCount, preview, lastWriter };
+}
+async function buildClaudeCandidate(filePath, conversationId) {
+  const scanned = await scanClaudeJsonl(filePath);
+  return { conversationId, ...scanned };
+}
+function claudeEntrypointFor(mode) {
+  return mode === "native" ? "cli" : "sdk-ts";
+}
+async function discoverClaudeCode(input) {
+  const { cwd, since, until, attachmentMode, configDir, expectedId } = input;
+  const dir = claudeCodeProjectDir(cwd, configDir);
+  if (expectedId) {
+    const filePath = join(dir, `${expectedId}.jsonl`);
+    try {
+      await promises.stat(filePath);
+    } catch {
+      return [];
+    }
+    return [await buildClaudeCandidate(filePath, expectedId)];
+  }
+  let entries;
+  try {
+    entries = await promises.readdir(dir);
+  } catch {
+    return [];
+  }
+  const jsonlFiles = entries.filter((e) => e.endsWith(".jsonl"));
+  if (jsonlFiles.length === 0) return [];
+  const sinceMs = since ? Date.parse(since) : NaN;
+  const untilMs = until ? Date.parse(until) : NaN;
+  const wantEntrypoint = attachmentMode ? claudeEntrypointFor(attachmentMode) : void 0;
+  const scored = [];
+  for (const f of jsonlFiles) {
+    const filePath = join(dir, f);
+    let mtimeMs;
+    try {
+      mtimeMs = (await promises.stat(filePath)).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (Number.isFinite(sinceMs) && mtimeMs < sinceMs - 1e3) continue;
+    const conversationId = f.replace(/\.jsonl$/, "");
+    const candidate = await buildClaudeCandidate(filePath, conversationId);
+    if (Number.isFinite(untilMs) && candidate.startedAt !== void 0) {
+      const startedMs = Date.parse(candidate.startedAt);
+      if (Number.isFinite(startedMs) && startedMs > untilMs) continue;
+    }
+    if (wantEntrypoint !== void 0 && candidate.lastWriter !== void 0 && candidate.lastWriter !== wantEntrypoint) {
+      continue;
+    }
+    scored.push({ candidate, mtimeMs });
+  }
+  scored.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return scored.map((s) => s.candidate);
+}
+async function readClaudeCode(conversationId, cwd, configDir) {
+  const { exportClaudeCodeSession: exportClaudeCodeSession2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return exportClaudeCodeSession2(conversationId, cwd, configDir);
+}
+async function discoverHermes(input) {
+  const { discoverHermesSessions: discoverHermesSessions2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return discoverHermesSessions2(input.cwd, input.since, input.expectedId);
+}
+async function readHermes(conversationId) {
+  const { exportHermesSession: exportHermesSession2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return exportHermesSession2(conversationId);
+}
+async function discoverCodex(input) {
+  const { discoverCodexSessions: discoverCodexSessions2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return discoverCodexSessions2(input.cwd, input.since, input.until, input.expectedId);
+}
+async function readCodex(conversationId) {
+  const { exportCodexSession: exportCodexSession2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return exportCodexSession2(conversationId);
+}
+async function discoverOpenCode(input) {
+  const { discoverOpenCodeSessions: discoverOpenCodeSessions2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return discoverOpenCodeSessions2(input.cwd, input.since, input.expectedId);
+}
+async function readOpenCode(conversationId) {
+  const { exportOpenCodeSession: exportOpenCodeSession2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return exportOpenCodeSession2(conversationId);
+}
+async function discoverMastracodeInprocess(input) {
+  const { discoverMastracodeInprocessSessions: discoverMastracodeInprocessSessions2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return discoverMastracodeInprocessSessions2(input.cwd, input.since, input.expectedId);
+}
+async function readMastracodeInprocess(conversationId) {
+  const { exportMastracodeInprocessSession: exportMastracodeInprocessSession2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return exportMastracodeInprocessSession2(conversationId);
+}
+async function discoverPi(input) {
+  const { discoverPiSessions: discoverPiSessions2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return discoverPiSessions2(input.cwd, input.since, input.until, input.expectedId);
+}
+async function readPi(conversationId) {
+  const { exportPiSession: exportPiSession2 } = await Promise.resolve().then(() => (init_transcript_export(), transcript_export_exports));
+  return exportPiSession2(conversationId);
+}
+var CONVERSATION_STORES;
+var init_conversation_store = __esm({
+  "src/conversation-store.ts"() {
+    CONVERSATION_STORES = {
+      "claude-code": {
+        storeAs: "claudeResumeId",
+        // Printed by claude on graceful exit when session persistence is on
+        // (default). Example: `claude --resume 0e483f81-1a44-4bec-9667-b37158450296`
+        outputHint: /claude\s+--resume\s+([0-9a-f-]{8,})/i,
+        attachArgv: (conversationId) => ["claude", "--resume", conversationId],
+        transcriptPath: (cwd, conversationId, configDir) => join(claudeCodeProjectDir(cwd, configDir), `${conversationId}.jsonl`),
+        configDirEnvVar: "CLAUDE_CONFIG_DIR",
+        discover: discoverClaudeCode,
+        read: readClaudeCode
+      },
+      hermes: {
+        storeAs: "hermesResumeId",
+        // `hermes acp` is the ACP arm (bin_args in adapters/hermes/src/index.ts);
+        // `--resume SESSION --tui` is the native TUI resume path — same binary,
+        // different flags, unlike claude-code where the two arms are different
+        // binaries. Verified via `hermes --help`: `--resume SESSION, -r` =
+        // "Resume a previous session by ID or title", `--tui` = the real TUI.
+        attachArgv: (conversationId) => ["hermes", "--resume", conversationId, "--tui"],
+        discover: discoverHermes,
+        read: readHermes
+      },
+      // codex-acp writes no resume flag we sniff, and there's no native PTY
+      // reattach argv to declare — export/read only, so no outputHint/attachArgv.
+      codex: {
+        storeAs: "codexResumeId",
+        discover: discoverCodex,
+        read: readCodex
+      },
+      opencode: {
+        storeAs: "openCodeResumeId",
+        // Match the adapter's portable npx installation: a direct `opencode`
+        // binary is not guaranteed to be on the daemon's PATH on every host.
+        attachArgv: (conversationId) => ["npx", "-y", "opencode-ai", "-s", conversationId],
+        discover: discoverOpenCode,
+        read: readOpenCode
+      },
+      "mastracode-inprocess": {
+        storeAs: "mastracodeInprocessResumeId",
+        discover: discoverMastracodeInprocess,
+        read: readMastracodeInprocess
+      },
+      pi: {
+        storeAs: "piResumeId",
+        discover: discoverPi,
+        read: readPi
+      }
+    };
+    new Set(
+      Object.values(CONVERSATION_STORES).map((s) => s.storeAs)
+    );
+  }
+});
+var init_resume_strategies = __esm({
+  "src/resume-strategies.ts"() {
+    init_conversation_store();
+    Object.fromEntries(
+      Object.entries(CONVERSATION_STORES).filter(([, store]) => typeof store.attachArgv === "function").map(([slug, store]) => {
+        const s = store;
+        return [
+          slug,
+          {
+            outputHint: store.outputHint,
+            storeAs: store.storeAs,
+            ...store.configDirEnvVar ? { configDirEnvVar: store.configDirEnvVar } : {},
+            ...store.transcriptPath ? { transcriptPath: store.transcriptPath } : {},
+            fsProbe: async (cwd, prevStartedAt, expectedId, configDir) => {
+              const candidates = await s.discover({
+                cwd,
+                since: prevStartedAt,
+                expectedId,
+                configDir
+              });
+              return candidates[0]?.conversationId ?? null;
+            },
+            spawnArgs: s.attachArgv
+          }
+        ];
+      })
+    );
+  }
+});
+var init_command_log = __esm({
+  "src/command-log.ts"() {
+    init_transcript_writer();
+  }
+});
+var init_sandbox_ledger = __esm({
+  "src/sandbox-ledger.ts"() {
+  }
+});
+var init_tool_call_log = __esm({
+  "src/tool-call-log.ts"() {
+    init_transcript_writer();
+  }
+});
+var init_usage_snapshot_log = __esm({
+  "src/usage-snapshot-log.ts"() {
+    init_transcript_writer();
+  }
+});
+var init_hooks_config = __esm({
+  "src/hooks-config.ts"() {
+  }
+});
+
+// src/providers-store.ts
+var providers_store_exports = {};
+var init_providers_store = __esm({
+  "src/providers-store.ts"() {
+    __reExport(providers_store_exports, providers_store_star);
+  }
+});
+var init_spawn_defaults = __esm({
+  "src/spawn-defaults.ts"() {
+    init_providers_store();
+  }
+});
+var init_claude_code_oauth_source = __esm({
+  "src/claude-code-oauth-source.ts"() {
+    init_spawn_defaults();
+  }
+});
+var remainingQuotaSchema, storedProfileQuotaSchema;
+var init_remaining_quota_store = __esm({
+  "src/remaining-quota-store.ts"() {
+    remainingQuotaSchema = z.object({
+      window: z.string(),
+      remaining: z.number(),
+      resetsAt: z.string(),
+      basis: z.literal("provider")
+    });
+    storedProfileQuotaSchema = z.object({
+      profileRef: z.string(),
+      windows: z.object({
+        "5h": remainingQuotaSchema.optional(),
+        "7d": remainingQuotaSchema.optional()
+      }),
+      fetchedAt: z.string()
+    });
+    z.object({
+      version: z.literal(1),
+      profiles: z.record(z.string(), storedProfileQuotaSchema)
+    });
+  }
+});
+
+// src/remaining-quota.ts
+var init_remaining_quota = __esm({
+  "src/remaining-quota.ts"() {
+    init_claude_code_oauth_source();
+    init_remaining_quota_store();
+  }
+});
+var init_account_credits = __esm({
+  "src/account-credits.ts"() {
+    z.object({
+      data: z.object({ limit_remaining: z.number().nullable().optional() }).passthrough()
+    }).passthrough();
+    z.object({
+      data: z.object({ available_balance: z.number() }).passthrough()
+    }).passthrough();
+  }
+});
+var init_usage_rollup_service = __esm({
+  "src/usage-rollup-service.ts"() {
+    init_remaining_quota();
+    init_account_credits();
+  }
+});
+
+// src/usage-rollup.ts
+var init_usage_rollup = __esm({
+  "src/usage-rollup.ts"() {
+  }
+});
+
+// src/cost-budget.ts
+var init_cost_budget = __esm({
+  "src/cost-budget.ts"() {
+  }
+});
+var init_pr_provenance_stamp = __esm({
+  "src/pr-provenance-stamp.ts"() {
+    init_pr_provenance();
+  }
+});
+var init_command_allowlist = __esm({
+  "src/command-allowlist.ts"() {
+  }
+});
+var init_command_tools = __esm({
+  "src/command-tools.ts"() {
+    init_sessions();
+    init_pr_provenance_stamp();
+    init_command_allowlist();
+    init_command_allowlist();
+  }
+});
+var init_workspaces_config = __esm({
+  "src/workspaces-config.ts"() {
+  }
+});
+var init_worktree_identity = __esm({
+  "src/worktree-identity.ts"() {
+    z.object({ worktreeId: z.string() });
+  }
+});
+var init_catalog_models = __esm({
+  "src/catalog-models.ts"() {
+    init_spawn_defaults();
+  }
+});
+var init_model_wire = __esm({
+  "src/model-wire.ts"() {
+    init_catalog_models();
+  }
+});
+
+// src/launch-config.ts
+var init_launch_config = __esm({
+  "src/launch-config.ts"() {
+    init_model_wire();
+    init_spawn_defaults();
+  }
+});
+
+// src/context-continuity.ts
+var init_context_continuity = __esm({
+  "src/context-continuity.ts"() {
+  }
+});
+
+// src/canonical-posture.ts
+function normalizeModeId(id) {
+  return id.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+var POSTURE_NATIVE_ALIASES, CANONICAL_POSTURES;
+var init_canonical_posture = __esm({
+  "src/canonical-posture.ts"() {
+    POSTURE_NATIVE_ALIASES = {
+      default: ["default", "build", "normal", "standard"],
+      plan: ["plan", "planning", "plan-mode"],
+      "accept-edits": ["accept-edits", "auto-accept", "auto-edit"],
+      bypass: ["bypass", "bypass-permissions", "full-access", "yolo", "dangerously-skip-permissions"],
+      "read-only": ["read-only", "chat", "ask"]
+    };
+    CANONICAL_POSTURES = Object.keys(
+      POSTURE_NATIVE_ALIASES
+    );
+    new Set(CANONICAL_POSTURES);
+    (() => {
+      const index = /* @__PURE__ */ new Map();
+      for (const [posture, aliases] of Object.entries(POSTURE_NATIVE_ALIASES)) {
+        for (const alias of aliases) index.set(normalizeModeId(alias), posture);
+      }
+      return index;
+    })();
+  }
+});
+var harnessPresetSchema;
+var init_harness_preset_store = __esm({
+  "src/harness-preset-store.ts"() {
+    harnessPresetSchema = z.object({
+      id: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+      harnessSlug: z.string().min(1),
+      name: z.string().min(1),
+      profileRef: z.string().min(1),
+      defaultModel: z.string().min(1),
+      isDefault: z.boolean()
+    });
+    z.object({
+      version: z.literal(1),
+      presets: z.array(harnessPresetSchema)
+    });
+  }
+});
+var init_browser_mount = __esm({
+  "src/browser-mount.ts"() {
+  }
+});
+
+// src/role.ts
+var EXECUTOR_ROLE, SUPERVISOR_ROLE, DEFAULT_ROLE_DEPTH_CUTOFF;
+var init_role = __esm({
+  "src/role.ts"() {
+    EXECUTOR_ROLE = {
+      name: "executor",
+      disposition: "You are the executor. Do the task yourself, using only the tools provided \u2014 never spawn or delegate to another agent, even if it looks convenient. This includes any subagent/Task tool your own CLI ships natively: it is not routed through agentproto and this daemon cannot strip it out, so the rule holds regardless of which tools appear available to you.",
+      toolPolicy: { delegation: "deny" },
+      skills: [],
+      // The floor of the lattice — in practice spawns nothing, since
+      // `toolPolicy.delegation: "deny"` already strips `agent_start` before
+      // the level comparison is ever reached. NOTE: that strip only covers
+      // the daemon's own MCP gateway (agent_start/agent_prompt) — a native
+      // subagent/Task tool bundled with the CLI itself (e.g. claude-code's
+      // Task tool) isn't an MCP tool and can't be gated here at all, which
+      // is why the disposition above spells it out explicitly.
+      level: 0,
+      // Executors are the primary consumer of the deferred-tools surface: they
+      // never delegate (agent_start/agent_prompt are already stripped above),
+      // so the bulk of the ~190-tool daemon gateway is dead weight at turn 0.
+      // Default ON regardless of the daemon's own global
+      // `defaults.mcp.deferredTools` setting — an operator who hasn't opted the
+      // whole daemon in still gets a lean executor by default.
+      deferredTools: true
+    };
+    SUPERVISOR_ROLE = {
+      name: "supervisor",
+      disposition: "You are the supervisor. Decompose the work and delegate the parts that genuinely benefit from a separate agent, then verify each result before relying on it. Delegate through the `agent_start` MCP tool (on the `agentproto` MCP server), not your CLI's native subagent/Task tool \u2014 a native subagent is invisible to this daemon (no session id, no tracking, no kill switch), whereas agent_start gives you a session you can observe and supervise. Prefer doing small work inline.",
+      toolPolicy: { delegation: "allow" },
+      level: 100
+    };
+    ({
+      [EXECUTOR_ROLE.name]: EXECUTOR_ROLE,
+      [SUPERVISOR_ROLE.name]: SUPERVISOR_ROLE
+    });
+    DEFAULT_ROLE_DEPTH_CUTOFF = 1;
+  }
+});
+var init_deferred_tools = __esm({
+  "src/deferred-tools.ts"() {
+  }
+});
+
+// src/role-pack.ts
+var init_role_pack = __esm({
+  "src/role-pack.ts"() {
+    init_browser_mount();
+  }
+});
+var init_role_registry = __esm({
+  "src/role-registry.ts"() {
+    init_config();
+    init_role_pack();
+  }
+});
+var DEFAULT_AGENTS_MD_INLINE_MAX_KB;
+var init_agents_md = __esm({
+  "src/agents-md.ts"() {
+    init_config();
+    DEFAULT_AGENTS_MD_INLINE_MAX_KB = 8;
+  }
+});
+var init_workspace_buckets = __esm({
+  "src/workspace-buckets.ts"() {
+    init_workspaces_config();
+  }
+});
+var init_workspace_rules = __esm({
+  "src/workspace-rules.ts"() {
+    init_workspace_buckets();
+  }
+});
+
+// src/session-title.ts
+var init_session_title = __esm({
+  "src/session-title.ts"() {
+  }
+});
+
+// src/mcp-credential-deps.ts
+var init_mcp_credential_deps = __esm({
+  "src/mcp-credential-deps.ts"() {
+  }
+});
+
+// src/sandbox-agent-session-proxy.ts
+var init_sandbox_agent_session_proxy = __esm({
+  "src/sandbox-agent-session-proxy.ts"() {
+    init_sandbox_ledger();
+  }
+});
+var init_sandbox_app_serve = __esm({
+  "src/sandbox-app-serve.ts"() {
+  }
+});
+var init_local = __esm({
+  "src/sandbox-providers/local.ts"() {
+  }
+});
+
+// src/sandbox-providers/registry.ts
+var CAPABILITIES_TODAY;
+var init_registry = __esm({
+  "src/sandbox-providers/registry.ts"() {
+    init_local();
+    CAPABILITIES_TODAY = {
+      networkEgress: true,
+      mounts: false,
+      lifecyclePause: false,
+      readOnly: false
+    };
+    ({
+      ...CAPABILITIES_TODAY,
+      lifecyclePause: true
+    });
+    ({
+      ...CAPABILITIES_TODAY,
+      lifecyclePause: true
+    });
+  }
+});
+var init_sandbox_adapters = __esm({
+  "src/sandbox-adapters.ts"() {
+    init_registry();
+  }
+});
+var init_session_spawn = __esm({
+  "src/session-spawn.ts"() {
+    init_sessions();
+    init_workspaces_config();
+    init_config();
+    init_worktree_identity();
+    init_spawn_defaults();
+    init_launch_config();
+    init_claude_code_oauth_source();
+    init_providers_store();
+    init_catalog_models();
+    init_context_continuity();
+    init_canonical_posture();
+    init_harness_preset_store();
+    init_browser_mount();
+    init_role();
+    init_deferred_tools();
+    init_role_registry();
+    init_agents_md();
+    init_workspace_rules();
+    init_session_title();
+    init_mcp_credential_deps();
+    init_sandbox_agent_session_proxy();
+    init_sandbox_ledger();
+    init_sandbox_app_serve();
+    init_sandbox_adapters();
+    init_worktree_isolation();
+    init_spawn_attach();
+    init_spawn_dedupe();
+    init_gh_provenance_shim();
+  }
+});
+function tryParseJson(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function jsonTolerant(schema) {
+  return z.preprocess(
+    (v) => typeof v === "string" ? tryParseJson(v) : v,
+    schema
+  );
+}
+var init_json_tolerant = __esm({
+  "src/json-tolerant.ts"() {
+  }
+});
+var sandboxSpecWithReuseSchema;
+var init_sandbox_spec_schema = __esm({
+  "src/sandbox-spec-schema.ts"() {
+    sandboxSpecWithReuseSchema = z.object({
+      ...SandboxSpecSchema.shape,
+      reuse: z.string().min(1).optional().describe(
+        "Reconnect to an existing box instead of booting a new one. Accepts a prior session's exact `sandboxId`, a ledger `label` (exact match), or an unambiguous prefix of a ledger sandboxId \u2014 resolved against the local sandbox ledger (`~/.agentproto/sandboxes.json`, see `agentproto sandbox list`). A prefix matching more than one ledger entry fails with `sandbox_reuse_ambiguous` listing the candidates. Requires the provider to support reconnect (e.g. e2b); omit to boot fresh (default)."
+      )
+    }).strict();
+  }
+});
+var commandSandboxSchema, attachFieldSchema, contextContinuityInputSchema;
+var init_spawn_field_schemas = __esm({
+  "src/spawn-field-schemas.ts"() {
+    commandSandboxSchema = z.enum(["off", "workspace", "strict"]);
+    attachFieldSchema = z.union([
+      z.boolean(),
+      z.object({ parent: z.string().min(1).optional() })
+    ]);
+    contextContinuityInputSchema = z.object({
+      mode: z.enum(["manual", "ask", "auto"]).optional(),
+      warnAtPct: z.number().int().min(0).max(100).optional(),
+      compactAtPct: z.number().int().min(0).max(100).optional(),
+      continueFreshAtPct: z.number().int().min(0).max(100).optional(),
+      hardStopAtPct: z.number().int().min(0).max(100).optional(),
+      goal: z.boolean().optional(),
+      plan: z.boolean().optional(),
+      decisions: z.boolean().optional(),
+      changedFiles: z.boolean().optional(),
+      gitStatus: z.boolean().optional(),
+      tests: z.boolean().optional(),
+      errors: z.boolean().optional(),
+      risks: z.boolean().optional(),
+      nextStep: z.boolean().optional(),
+      config: z.boolean().optional(),
+      label: z.string().optional()
+    });
+  }
+});
+var mcpBool, mcpPositiveNumber, agentStartInputShape, agentStartInputSchema;
+var init_agent_start_schema = __esm({
+  "src/agent-start-schema.ts"() {
+    init_json_tolerant();
+    init_sandbox_spec_schema();
+    init_spawn_field_schemas();
+    mcpBool = z.preprocess(
+      (v) => v === "true" ? true : v === "false" ? false : v,
+      z.boolean()
+    );
+    mcpPositiveNumber = z.preprocess(
+      (v) => typeof v === "string" && v.trim() !== "" ? Number(v) : v,
+      z.number().positive()
+    );
+    agentStartInputShape = {
+      adapter: z.string().min(1).optional().describe(
+        "Adapter slug \u2014 one of the installed `@agentproto/adapter-*` packages (e.g. 'claude-code', 'hermes', 'aider'). Omit only when `presetId` names a saved preset with an adapter."
+      ),
+      harness: z.string().min(1).optional().describe(
+        "Canonical harness slug \u2014 alias for `adapter`. Accepts the same values; use whichever field your caller produces."
+      ),
+      presetId: z.string().min(1).optional().describe(
+        "Saved user spawn preset id from `agentproto preset list`. Its adapter and decomposed axes are applied first; explicit fields on this call override it."
+      ),
+      workspaceSlug: z.string().optional().describe(
+        "Workspace slug from `agentproto workspace list`. The daemon resolves it to an absolute path. Omit to use the `cwd` field or the active workspace."
+      ),
+      cwd: z.string().optional().describe(
+        "Absolute path to spawn the agent in. Wins over `workspaceSlug` when both are set."
+      ),
+      prompt: z.string().optional().describe(
+        "Optional initial prompt. The session is spawned and the prompt dispatched in one shot \u2014 equivalent to `start` then `prompt` back-to-back. Skip to spawn idle."
+      ),
+      label: z.string().optional().describe(
+        "Free-text label that surfaces in `agent_sessions_list` and the UI \u2014 useful for tagging sessions with a conversation id or operator name."
+      ),
+      mode: z.string().optional().describe(
+        "Manifest-declared mode id (AIP-45 `modes`) applied at spawn time, BEFORE the child process starts \u2014 e.g. claude-code's 'plan' (read-only: reasons and proposes but does not edit or run commands), 'accept-edits', 'bypass-permissions'; codex's 'read-only' / 'full-access'; mastracode/opencode's 'plan' / 'build'. Adapters that don't declare `modes` (e.g. hermes) reject ANY value here \u2014 only pass this for adapters known to support it. Omit for the adapter's normal interactive mode."
+      ),
+      origin: z.string().min(1).optional().describe(
+        "Source label for this spawn \u2014 the calling channel/harness (codex, cowork, vscode, cron, \u2026). Descriptor-only: groups the session under a source node in the tree. In-repo callers set it; the mcp-bridge can auto-stamp it from the host clientInfo."
+      ),
+      parentSessionId: z.string().min(1).optional().describe(
+        "Parent-lineage hint: attribute this spawn to a logical parent session so it nests under that node in the sessions tree instead of appearing as a depth-0 root. Pass the `id` of the session doing the spawning (e.g. an agent-to-agent `agent_start`). The child's `depth` is derived from the parent (parent depth + 1); you don't set it. Ignored when this call arrives through the scoped orchestrator gateway \u2014 that path derives the parent from its own token, which always wins over this hint."
+      ),
+      attach: jsonTolerant(attachFieldSchema).optional().describe(
+        'Parent-attach control, mirroring `worktree`. By DEFAULT (omitted) a spawn attaches under the session that made it \u2014 the daemon derives that parent from the trusted caller id, so a supervisor\'s executors nest instead of appearing as depth-0 roots, no `parentSessionId` needed. Pass `false` to launch an INDEPENDENT root (no parent) \u2014 the deliberate detached spawn. `true` forces attach even under an `on-request` daemon policy; `{ parent: "<id>" }` pins an explicit parent. Ignored when this call arrives through the scoped orchestrator gateway (the scope token wins). Descriptor-only lineage: never relaxes a depth-gated worktree/role guard.'
+      ),
+      boardId: z.string().min(1).optional().describe(
+        "Task-board pin for the spawned child, stamped onto its descriptor as `meta.boardId`. The Task ledger resolves the child's default board from this BEFORE walking `parentSessionId` lineage \u2014 so a client spawning several depth-0 root sessions (no shared lineage) can join them all onto ONE shared board. An explicit `boardId` passed on a task verb still wins over this pin. Omit for the lineage-derived `tree:<root>` default."
+      ),
+      idempotencyKey: z.string().min(1).optional().describe(
+        "Caller-declared 'this is the same logical spawn' token \u2014 a PROMISE, not a guess. A retried agent_start call (e.g. after a slow/lost response) that repeats the same `idempotencyKey` for the same `adapter`+`cwd` within ~10min of a successful spawn gets that SAME session's descriptor back instead of forking a second process \u2014 the response carries `deduped: true` and `dedupeSource: \"explicit\"` so you can tell. Always wins over the daemon's own derived key (see `dedupe` below) when both would apply. Omitting this does NOT mean 'spawn unconditionally' \u2014 see `dedupe`."
+      ),
+      dedupe: mcpBool.optional().describe(
+        'Per-call override for the daemon\'s `spawn.dedupe` policy \u2014 what happens when NO `idempotencyKey` is supplied. By DEFAULT (`spawn.dedupe: "always"`) a spawn that carries a `label` gets an IMPLICIT key derived from that label plus a hash of `prompt`, and dedupes against it exactly like an explicit key \u2014 set `dedupeSource: "implicit"` on the response (alongside `deduped: true`) so you can tell it wasn\'t your own promise that matched. A spawn with no `label` is never touched by this \u2014 deliberate parallel fan-out into one cwd (a real, exercised pattern here) needs no label and stays exactly as many sessions as you asked for. Pass `dedupe: false` to opt this ONE spawn out of implicit derivation regardless of policy \u2014 the escape hatch, mirroring `attach: false` / `worktree: false`. `dedupe: true` forces derivation even under an `"on-request"` daemon policy, mirroring `attach: true`. Unrelated and NOT covered by this flag: a `worktree` spawn that lands in a worktree another LIVE session already occupies under the same `label` is always refused (`dedupeSource: "worktree-cwd"`) \u2014 a shared worktree, unlike a shared plain cwd, is never a legitimate fan-out.'
+      ),
+      permissionHold: mcpBool.optional().describe(
+        "Start the session in permission-hold mode: every ACP permission request the agent raises (Write, Bash, \u2026) is SURFACED and HELD in the cross-session inbox (`permissions_list` / `permissions_respond`) instead of auto-answered, and the agent blocks until a human/orchestrator approves or denies it. Default false = today's auto-answer behaviour. ACP adapters only; others ignore it."
+      ),
+      notifyParentOnCrash: mcpBool.optional().describe(
+        "Opt this spawn into a direct in-band crash notice to its parent: if THIS session later crashes (adapter process gone between turns), the parent (`parentSessionId`, direct or inherited) is told via `[child-crashed] <label/id>: <reason> \u2014 <lastError>` \u2014 enqueued immediately if the parent is alive and idle, or queued for its next turn (never interrupting an in-flight one) if it's busy. Default false. The free external webhook (`notifyUrl`) already fires on any crash regardless of this flag \u2014 this only adds the direct signal into the parent's OWN session, for a delegating supervisor that wants to react to a child's death without polling."
+      ),
+      allowSharedCwd: mcpBool.optional().describe(
+        "Acknowledge that this nested spawn WILL run in place inside its parent's working tree even when that tree has uncommitted changes and isn't an isolated worktree \u2014 silencing the shared-dirty-cwd warning agent_start otherwise returns in `warnings`. Only relevant for a delegated (depth > 0) spawn with no `worktree` and no `sandbox`; ignored otherwise. Default false = warn."
+      ),
+      keepAlive: mcpBool.optional().describe(
+        "Exempt this session from the idle-reaper: it is never auto-retired for sitting idle, no matter how long. For a supervisor that legitimately parks \u2014 waiting on a child, waiting on a scheduled wake \u2014 idle looks identical to finished, and the reaper would otherwise pull it out from under you. Default false = today's behaviour. Toggle later with `session_set_keepalive`."
+      ),
+      options: jsonTolerant(
+        z.record(z.string(), z.union([z.boolean(), z.number(), z.string()]))
+      ).optional().describe(
+        "Manifest-declared option id \u2192 value map (AIP-45 `options`), applied at spawn time alongside `mode` \u2014 e.g. hermes' `skills` (string, prepended before the subcommand) or a boolean flag appended when true. Each value is validated against the option's declared `type`/`enum`/`min`/`max`; unknown ids reject. Adapters that don't declare a given option id reject it."
+      ),
+      skills: jsonTolerant(z.array(z.string())).optional().describe(
+        "Normalized, adapter-agnostic skill ids for this session (e.g. ['agentproto']). Merges with `~/.agentproto/config.json`'s `defaults.skills` / `defaults.adapters.<slug>.skills` (global < per-adapter < this field, which REPLACES rather than unions the config defaults when provided \u2014 a deliberate exact set). Folded into `options.skills` using the resolved adapter's declared shape (e.g. hermes' comma-joined `--skills a,b`); adapters with no declared `skills` option (e.g. claude-code, which auto-discovers from `~/.claude/skills`) ignore this \u2014 no-op."
+      ),
+      model: z.string().optional().describe(
+        "Model identifier to pass to the adapter (e.g. 'claude-opus-4-8'). For ACP adapters (claude-code) applied via session/set_config_option after newSession \u2014 NOT via a CLI flag. Others may ignore it."
+      ),
+      effort: z.string().optional().describe(
+        "Reasoning effort level (e.g. 'low', 'medium', 'high', 'xhigh', 'max', 'ultracode'). IMPORTANT: effort is calibrated per model \u2014 the same label maps to different compute budgets across models, and defaults differ by model (Sonnet 4.6 / Opus 4.8 default 'high'; Opus 4.7 default 'xhigh'). 'max' and 'ultracode' are session-only. Omit to keep the model's own default."
+      ),
+      route: jsonTolerant(
+        z.object({ gateway: z.string().min(1), baseUrl: z.string().url().optional() })
+      ).optional().describe("Billing route/gateway. This is independent of model and named access profile."),
+      access: jsonTolerant(z.object({ profileRef: z.string().min(1).optional() })).optional().describe("Named auth profile to bill at initial spawn; resolved from the local keychain."),
+      posture: z.string().optional().describe("Canonical agent posture (plan, bypass, accept-edits, read-only) or native harness mode."),
+      contextProfile: z.string().optional().describe("Context intake profile (for example full or lean)."),
+      auth: jsonTolerant(
+        z.object({
+          mode: z.enum(["subscription", "api-key"]).optional(),
+          token: z.string().optional(),
+          source: z.string().optional(),
+          apiKey: z.string().optional()
+        })
+      ).optional().describe(
+        "Deterministic billing-auth mode + EXPLICIT credential for adapters that declare it (today: claude-code). EXPLICIT credential selection, not scrub-by-absence: `mode` picks 'subscription' (default) or 'api-key'; `token`/`apiKey` (matching the resolved mode) is the secret VALUE, merged against `~/.agentproto/config.json`'s `defaults.adapters.claude-code.auth` (this field's `mode` wins; the credential for the resolved mode wins over the matching config field). For claude-code, 'subscription' SETS CLAUDE_CODE_OAUTH_TOKEN to `token` (a bearer token minted via `claude setup-token` \u2014 bills the Max/Pro subscription, not API credits) and DELETES ANTHROPIC_API_KEY + the cloud-provider redirect toggles + ANTHROPIC_BASE_URL. 'api-key' SETS ANTHROPIC_API_KEY to `apiKey` and DELETES ANTHROPIC_AUTH_TOKEN \u2014 the deliberate 'bill the API' choice. FAILS FAST (refuses the spawn, no fallback) when the resolved mode has no credential configured anywhere. The secret is never logged or echoed back \u2014 only a fingerprint appears on the session descriptor / `agent_sessions_list`. Adapters that don't declare this vocabulary ignore this field entirely. `source: \"claude-code-oauth\"` (subscription mode, opt-in) instead reads the bearer FRESH on every spawn from the local Claude Code login (Keychain / ~/.claude/.credentials.json) \u2014 effectively self-refreshing; an explicit `token` still wins over it."
+      ),
+      mcpServers: jsonTolerant(
+        z.array(
+          z.object({
+            name: z.string(),
+            transport: z.enum(["stdio", "http", "sse"]),
+            ref: z.string().optional(),
+            headers: z.record(z.string(), z.string()).optional().describe(
+              "Static HTTP headers sent with every request to an `http` or `sse` MCP server (e.g. a fixed auth token). Ignored for `stdio` transports."
+            ),
+            credentialRef: z.string().optional().describe(
+              "Brokered credential path resolved at spawn time into additional `headers` (typically `Authorization`). The actual secret never lives in env or config; brokered headers win on collision with `headers`."
+            ),
+            args: z.array(z.string()).optional().describe("`stdio` only: argv passed to the `ref` command. Ignored for `http`/`sse`."),
+            env: z.record(z.string(), z.string()).optional().describe("`stdio` only: extra environment for the launched server. Ignored for `http`/`sse`.")
+          })
+        )
+      ).optional().describe(
+        "MCP servers to mount into the spawned agent's session at spawn time. Forwarded verbatim to `session/new.mcpServers` on the ACP arm \u2014 gives the child agent a host-chosen scoped toolset (e.g. the daemon's own orchestration gateway so it can spawn + supervise sub-agents). Adapters that don't model MCP mounting ignore it."
+      ),
+      orchestrator: jsonTolerant(
+        z.union([
+          z.boolean(),
+          z.object({
+            tools: z.array(z.string()).optional().describe(
+              "Explicit allowlist \u2014 narrows the orchestration toolset to \u2286 the default subset. Names outside the default are dropped (a child can never widen its own scope). Omit for the full default subset."
+            ),
+            maxDepth: z.number().int().min(1).max(8).optional().describe(
+              "Max recursion depth reachable through this child (default 3, hard ceiling 8). A spawn that would exceed it is rejected. For a recursive spawn it can only LOWER the inherited cap, never raise it."
+            ),
+            maxChildren: z.number().int().min(1).optional().describe(
+              "Max concurrently-alive sub-agents this child may spawn (default 8). For a recursive spawn it can only lower the inherited quota."
+            )
+          })
+        ])
+      ).optional().describe(
+        "Make this child a SCOPED orchestrator \u2014 auto-mount the daemon's own orchestration MCP tools (start/prompt/wait/poll/output + subtree list/kill) so it can spawn and supervise its OWN sub-agents. `true` = the default curated subset; `{ tools: [...] }` narrows it. The daemon mints a per-child scope-token, injects the scoped sub-gateway URL into the child's session (alongside any `mcpServers` you pass), and revokes the token when the session exits. Shell/fs/remote/import/terminal tools are NEVER exposed this way."
+      ),
+      notifyUrl: z.string().url().optional().describe(
+        "Optional per-session webhook URL. POSTed (fire-and-forget) on this session's turn-end / awaiting-input / exited events, in addition to any global notify URL."
+      ),
+      wait: mcpBool.optional().describe(
+        "Block until the spawned session's first turn completes and include the cleaned output in the response. Default false = return the descriptor immediately. Note this blocks for the child's ENTIRE first turn (~40-90s+), not just the spawn. Batching several `wait: true` calls in one turn does NOT run them in parallel: harnesses that execute tool calls sequentially serialize them, each wait blocking its slot until its child's turn ends. For parallel fan-out spawn with `wait: false` (all spawns return in seconds), then wait on completion separately via `agentproto sessions wait <id> --until turn-end` (detached/background) or a completion policy via `policy_attach`."
+      ),
+      maxCostUsd: mcpPositiveNumber.optional().describe(
+        "Hard ceiling on cumulative session cost (USD). The session is stopped at a turn-end once exceeded."
+      ),
+      costBudget: jsonTolerant(
+        z.object({
+          maxCostUsd: z.number().positive().describe("Windowed spend ceiling in USD."),
+          window: z.string().min(1).describe('Rolling window spec ("5h"/"7d"/"P7D").'),
+          scope: z.enum(["session", "profile"]).describe("Spend surface: this session, or every session on its auth profile.")
+        })
+      ).optional().describe(
+        "Windowed cost-budget cap (DISTINCT from `maxCostUsd`). Auto-attaches a governance policy that trips `policy:failed` when the rolling windowed spend for `scope` crosses `maxCostUsd`. Never kills the session \u2014 it trips a policy for a supervisor to act on."
+      ),
+      restartPolicy: jsonTolerant(
+        z.object({
+          on: z.array(z.enum(["crashed", "error"])).min(1).describe(
+            'Which automatic death reasons trigger a restart: "crashed" (the crash-detect sweep found the adapter process gone) and/or "error" (an unexpected turn error with no other intentional reason). Never restarts a clean exit, an operator kill, an idle-reap, a daemon-restart death, or a cost-budget kill, regardless of this list.'
+          ),
+          maxRetries: z.number().int().positive().describe(
+            "Rolling-window crash-loop cap: give up (leave the session dead, no further auto-restart) once this many restarts have fired within `windowMs`."
+          ),
+          windowMs: z.number().int().positive().describe("Rolling window (ms) `maxRetries` counts restarts over."),
+          baseDelayMs: z.number().int().positive().describe("First restart's backoff delay (ms), before `factor` compounds it."),
+          factor: z.number().positive().describe("Exponential backoff multiplier applied per consecutive restart."),
+          maxDelayMs: z.number().int().positive().describe("Backoff ceiling (ms) \u2014 the computed delay never grows past this."),
+          resume: z.boolean().optional().describe(
+            "Reserved for a future explicit resume-vs-fresh-spawn toggle; this PR always revives in place (same session id, same conversation)."
+          )
+        })
+      ).optional().describe(
+        "Opt-in auto-restart policy (restart-scheduler PR-2). When set, an unexpected death (`crashed` and/or `error`, per `on`) is automatically revived IN PLACE (reusing the resume machinery \u2014 same session id, same conversation) after an exponential backoff, up to a rolling-window crash-loop cap. Omit for today's behaviour: a dead session stays dead until a human/orchestrator prompts or restarts it."
+      ),
+      contextContinuity: jsonTolerant(contextContinuityInputSchema).optional().describe(
+        "Context-continuity policy for this session \u2014 controls warning, opportunistic compaction, fresh-continuation, and hard-stop thresholds. Resolved from global \u2192 per-adapter \u2192 explicit override."
+      ),
+      role: z.string().optional().describe(
+        "Spawn-time role gating whether this child may itself delegate (spawn/drive further children) and, if it can, which roles IT may in turn spawn. Built-ins: 'executor' = leaf, cannot delegate \u2014 `orchestrator` is ignored and `agent_start`/`agent_prompt` are stripped from its default toolset, regardless of `promptAppend`. 'supervisor' = may delegate (today's default behaviour). Custom roles installed as role packs (see `role_list`) resolve the same way. A spawn made THROUGH an orchestrator is additionally gated by the privilege lattice: the calling role may only spawn a role allowlisted in its `spawnableRoles`, or \u2014 open mode, the default \u2014 at or below its own `level` (never something MORE privileged than itself). Omit `role` to derive from spawn depth (root spawns default to supervisor; spawns made through an orchestrator default to executor \u2014 see `defaultRoleDepthCutoff` in config.json's `defaults` block)."
+      ),
+      promptAppend: z.string().optional().describe(
+        "One-off runtime text layered ON TOP of the resolved role's disposition and prepended to `prompt` \u2014 it specializes the disposition, it cannot replace it, and it cannot re-open the tool gate (an executor asked to 'delegate anyway' via this field still has no delegation tools)."
+      ),
+      deferredTools: z.boolean().optional().describe(
+        "Override deferred/lazy MCP tool loading for this spawn's daemon self-mount: `true` hides every tool outside a small always-on set from `tools/list` (still fully callable \u2014 use `tool_search` to look up a hidden tool's schema by keyword before calling it), `false` keeps the full eager surface. Omit to use the resolved role's own default ('executor' defaults ON, since it can't delegate anyway and rarely needs the full ~190-tool surface); omit AND spawn a role with no opinion to fall through to the daemon's own boot-time `defaults.mcp.deferredTools` config."
+      ),
+      browser: z.preprocess(
+        // `true` is sugar for the only mode; stringified booleans tolerated.
+        (v) => v === true || v === "true" ? "headless" : v === "false" ? false : v,
+        z.union([z.literal("headless"), z.literal(false)])
+      ).optional().describe(
+        '`"headless"` gives the spawned agent its own isolated headless Chrome (1440x900, temporary profile) as a per-session `browser` MCP server (chrome-devtools-mcp: navigate_page, take_screenshot, evaluate_script, click, list_console_messages, \u2026), torn down with the session (`true` = `"headless"`). Works for any adapter that mounts stdio MCP servers; runs inside the session\'s `commandSandbox` (`strict` \u21D2 file:// only). `false` = none. Omit to use the role / preset / `defaults.spawn.browser` default (off). Not supported with `sandbox`.'
+      ),
+      trace: z.boolean().optional().describe(
+        "Emit Langfuse observability traces for this session (prompt/completion + tool spans + tokens/cost). Off by default; requires langfuse eval-reporter creds configured."
+      ),
+      sandbox: jsonTolerant(
+        z.union([
+          z.string().min(1).describe("Sandbox provider slug from `list_sandbox_providers` (e.g. 'local', 'e2b')."),
+          sandboxSpecWithReuseSchema.describe(
+            "Inline AIP-36 SandboxDefinition \u2014 boots this exact spec instead of a catalog slug. Set `reuse` (sandboxId, ledger label, or unique sandboxId prefix \u2014 see `agentproto sandbox list`) to reconnect to an existing sandbox instead of booting fresh."
+          )
+        ])
+      ).optional().describe(
+        "Run this session inside a sandbox instead of on the host \u2014 pass a provider slug (see `list_sandbox_providers`) or an inline AIP-36 SandboxDefinition object. The daemon boots the sandbox, spawns `adapter` on the box's OWN agentproto daemon, and proxies the conversation back onto this session \u2014 `agent_prompt`/`agent_output`/`agent_kill` behave exactly as they do for a local spawn, and the transcript stays readable here even after the box is torn down. Omit to run locally (default). Pass an inline spec with `reuse: \"<sandboxId>\"` (from a prior session's `sandboxId`) to reconnect to an existing box instead \u2014 by default such a box is PAUSED (not killed) on session close so it stays reusable; set `lifecycle.destroy_on` to always kill it. DO NOT CONFUSE with `commandSandbox` below \u2014 this field boots a WHOLE SEPARATE machine/box; `commandSandbox` confines THIS host's own spawn argv in place. The two are independent and combine (or not) freely; `commandSandbox` is ignored for a `sandbox` spawn (the box's own daemon would need to apply it)."
+      ),
+      appServe: jsonTolerant(
+        z.object({
+          dir: z.string().min(1).describe("Absolute path to the app's directory INSIDE the sandbox box (e.g. '/home/user/apps/<slug>')."),
+          port: z.number().int().min(1).max(65535).optional().describe("Port the UI binds inside the box (default 3210). The port is exposed by the sandbox provider and its public URL returned.")
+        }).strict()
+      ).optional().describe(
+        "WP3 \u2014 serve an agentproto app's UI from INSIDE the sandbox box and return its public URL. Requires `sandbox` (rejected otherwise). The box daemon installs the app (`app_install` on the in-box `dir`), launches `agentproto app serve --host 0.0.0.0 --port <port>` detached through the box's `command_execute`, and the spawn result + descriptor carry `appServe: { appId, dir, port, url, ready }` \u2014 `url` is the provider-resolved public URL for the served UI (the port is also added to the spec's `extraPorts` and echoed in `sandboxPorts`)."
+      ),
+      commandSandbox: commandSandboxSchema.optional().describe(
+        'OS-level process confinement (macOS Seatbelt / Linux bubblewrap) for the adapter\'s OWN spawned process on THIS host \u2014 NOT the `sandbox` field above, which boots an entirely separate remote box. This wraps the exact argv `adapter` spawns as (e.g. `claude`, `npx @agentclientprotocol/claude-agent-acp`) so its process tree is denied filesystem access outside the session\'s `cwd` \u2014 confinement an ACP permission seam can never provide, since it only sees tool calls the adapter chooses to report, not what an in-process Bash actually touches. `"off"` (default when omitted AND no `.agentproto/command-sandbox.json` sets an `adapterSpawn.mode`) = unconfined, unchanged behaviour. `"workspace"` = deny reads/writes to $HOME outside the workspace (protects ~/.ssh, ~/.aws, credentials, \u2026); network stays allowed. `"strict"` = `"workspace"` + deny all network. A workspace can set this same axis persistently via the `adapterSpawn` key of `.agentproto/command-sandbox.json` (a DISTINCT key from the top-level `mode` that key file also carries for `command_execute` \u2014 the two are never shared; misconfiguring the whole-session adapter jail is a bigger blast radius than misconfiguring one shell command) \u2014 this param, when set, overrides that file. Ignored for a `sandbox` spawn. `"workspace"`/`"strict"` with no backend installed for this platform (macOS needs `sandbox-exec`, Linux needs `bwrap`) FAILS the spawn rather than silently running unconfined.'
+      ),
+      worktree: jsonTolerant(
+        z.union([
+          mcpBool,
+          z.object({
+            slug: z.string().regex(
+              /^[a-z0-9][a-z0-9-]*$/,
+              "slug must be lowercase kebab-case (letters, digits, hyphens)"
+            ).optional().describe(
+              "Pin the worktree's slug (names its branch `wt/<slug>` and its directory). Omit to auto-mint a collision-free one from the label."
+            ),
+            base: z.string().min(1).optional().describe("Git ref the worktree branch is cut from. Default 'origin/main'."),
+            async: z.boolean().optional().describe(
+              'Return a real, registered session as soon as it\'s minted (status "starting") instead of blocking `agent_start`\'s response on `git worktree add` + the repo\'s setup hooks, which can run minutes. Provisioning + the driver spawn continue in the background; poll the session\'s `status` (flips to "running" on success, "error" with a readable `lastError` on failure \u2014 it never sits in "starting" forever). Any `prompt` is held and dispatched only once the tree and the driver session both exist. Incompatible with `wait` (there is no first-turn output to block on yet) \u2014 combining the two is rejected. Defaults to true for any spawn that provisions a worktree, UNLESS this call also sets `wait` (which falls back to the old synchronous path instead of conflicting). Pass `false` explicitly to force the old blocking ok/fail contract even without `wait`.'
+            )
+          }).strict()
+        ])
+      ).optional().describe(
+        "Isolate this session in its OWN git worktree instead of spawning directly in `cwd` \u2014 so a parallel agent can't collide on the working tree. `true` provisions a worktree on a fresh branch `wt/<slug>` cut from origin/main (slug auto-minted from `label`); pass `{ slug, base, async }` to pin either, or opt into an early return (`async`, see that field's own description). The daemon boots the worktree (git worktree add + the repo's agentproto.json setup hooks) and spawns `adapter` THERE; the session's cwd, and every path it edits, live inside the worktree. Honoured only for a ROOT spawn (a spawn made THROUGH an orchestrator inherits its parent's tree \u2014 no second worktree; an EXPLICIT `worktree` on such a nested spawn is REJECTED, not silently ignored \u2014 use `sandbox` to isolate a child) and only when `cwd` is inside a git repo (nothing to isolate otherwise \u21D2 spawns plain, no error). The daemon's `worktrees.isolation` policy may force this ON for every root spawn (`always`) or OFF (`never`, which REJECTS an explicit `worktree`). Ignored for a `sandbox` spawn (the box already isolates). The worktree is NOT auto-removed on session close \u2014 it holds the agent's work; tear it down with `agentproto worktree rm|archive|gc`."
+      )
+    };
+    agentStartInputSchema = z.object(agentStartInputShape);
+    agentStartInputSchema.omit({ wait: true });
+  }
+});
+var effortSchema, postureSchema, routeSchema, userPresetSchema;
+var init_user_presets = __esm({
+  "src/user-presets.ts"() {
+    effortSchema = z.enum(["low", "medium", "high", "xhigh", "max", "ultracode"]);
+    postureSchema = z.union([
+      z.enum(["default", "plan", "accept-edits", "bypass", "read-only"]),
+      z.object({ harnessModeId: z.string().min(1) })
+    ]);
+    routeSchema = z.object({
+      gateway: z.string().min(1),
+      baseUrl: z.string().url().optional()
+    });
+    userPresetSchema = z.object({
+      id: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+      label: z.string().min(1),
+      adapter: z.string().min(1).optional(),
+      harness: z.string().min(1).optional(),
+      model: z.string().min(1).optional(),
+      route: routeSchema.optional(),
+      access: z.object({ profileRef: z.string().min(1).optional() }).optional(),
+      posture: postureSchema.optional(),
+      effort: effortSchema.optional(),
+      contextProfile: z.string().min(1).optional(),
+      cwd: z.string().min(1).optional(),
+      skills: z.array(z.string().min(1)).optional(),
+      browser: z.union([z.literal("headless"), z.literal(false)]).optional()
+    });
+    z.object({
+      version: z.literal(1),
+      presets: z.array(userPresetSchema)
+    });
+  }
+});
+var init_catalog_provider_models = __esm({
+  "src/catalog-provider-models.ts"() {
+  }
+});
+var init_app_ui_apps = __esm({
+  "src/app-ui-apps.ts"() {
+  }
+});
+var MESSAGE_KINDS, MESSAGE_URGENCIES;
+var init_session_message = __esm({
+  "src/session-message.ts"() {
+    MESSAGE_KINDS = ["report", "question", "blocker", "done", "notice"];
+    MESSAGE_URGENCIES = ["fyi", "next-turn", "steer", "interrupt"];
+  }
+});
+var init_message_tools = __esm({
+  "src/message-tools.ts"() {
+    init_session_message();
+    z.enum(MESSAGE_KINDS);
+    z.enum(MESSAGE_URGENCIES);
+    z.unknown().optional().describe("Not settable \u2014 leave it out: the daemon attests the sender from your session identity.");
+  }
+});
+var init_agent_tools = __esm({
+  "src/agent-tools.ts"() {
+    init_transcript_export();
+    init_agent_start_schema();
+    init_session_spawn();
+    init_canonical_posture();
+    init_user_presets();
+    init_role();
+    init_role_registry();
+    init_catalog_provider_models();
+    init_app_ui_apps();
+    init_session_message();
+    init_message_tools();
+    z.string().optional().describe(
+      "Session id (as returned by agent_start). Accepts either `sessionId` or its alias `id` \u2014 pass whichever you have."
+    );
+    z.string().optional().describe("Alias for `sessionId` \u2014 the `id` field returned by agent_start.");
+  }
+});
+var init_supervisor = __esm({
+  "src/supervisor.ts"() {
+    init_sessions();
+    init_usage_rollup_service();
+    init_usage_rollup();
+    init_cost_budget();
+    init_command_tools();
+    init_session_spawn();
+    init_agent_tools();
+  }
+});
+
+// src/session-activity.ts
+var init_session_activity = __esm({
+  "src/session-activity.ts"() {
+  }
+});
+var DEFAULT_BG_TASK_WAKE_GRACE_MS;
+var init_background_task_wake = __esm({
+  "src/background-task-wake.ts"() {
+    DEFAULT_BG_TASK_WAKE_GRACE_MS = 2e4;
+  }
+});
+
+// src/session-observer.ts
+var init_session_observer = __esm({
+  "src/session-observer.ts"() {
+  }
+});
+var DEFAULT_TITLER_MODEL;
+var init_session_titler = __esm({
+  "src/session-titler.ts"() {
+    init_config();
+    init_transcript_writer();
+    DEFAULT_TITLER_MODEL = "z-ai/glm-5.2@openrouter";
+  }
+});
+
+// src/resume-context-digest.ts
+var init_resume_context_digest = __esm({
+  "src/resume-context-digest.ts"() {
+    init_transcript_export();
+  }
+});
+var init_conversation_index = __esm({
+  "src/conversation-index.ts"() {
+    init_conversation_store();
+    init_workspace_buckets();
+  }
+});
+var init_terminal_transcript_writer = __esm({
+  "src/terminal-transcript-writer.ts"() {
+    init_transcript_writer();
+  }
+});
+var init_usage = __esm({
+  "src/usage.ts"() {
+  }
+});
+var init_context_window = __esm({
+  "src/context-window.ts"() {
+  }
+});
+var init_context_checkpoint = __esm({
+  "src/context-checkpoint.ts"() {
+    init_transcript_export();
+    init_transcript_writer();
+  }
+});
+
+// src/session-continue-fresh.ts
+var init_session_continue_fresh = __esm({
+  "src/session-continue-fresh.ts"() {
+    init_context_checkpoint();
+    init_context_continuity();
+    init_session_spawn();
+  }
+});
+var init_session_outcome = __esm({
+  "src/session-outcome.ts"() {
+  }
+});
+
+// src/session-end-reason.ts
+var init_session_end_reason = __esm({
+  "src/session-end-reason.ts"() {
+  }
+});
+var init_sessions = __esm({
+  "src/sessions.ts"() {
+    init_resume_strategies();
+    init_conversation_store();
+    init_command_log();
+    init_sandbox_ledger();
+    init_tool_call_log();
+    init_usage_snapshot_log();
+    init_tool_call_record();
+    init_hooks_config();
+    init_supervisor();
+    init_session_title();
+    init_session_activity();
+    init_canonical_posture();
+    init_background_task_wake();
+    init_catalog_models();
+    init_model_wire();
+    init_session_observer();
+    init_tool_presenter();
+    init_transcript_writer();
+    init_session_titler();
+    init_resume_context_digest();
+    init_conversation_index();
+    init_workspace_buckets();
+    init_terminal_transcript_writer();
+    init_usage();
+    init_context_window();
+    init_worktree_identity();
+    init_context_continuity();
+    init_session_continue_fresh();
+    init_session_outcome();
+    init_session_end_reason();
+    init_session_message();
+  }
+});
+var PROVENANCE_WRAP_GH_ENV, DEFAULT_WRAP_GH;
+var init_gh_provenance_shim = __esm({
+  "src/gh-provenance-shim.ts"() {
+    init_pr_provenance();
+    init_sessions();
+    PROVENANCE_WRAP_GH_ENV = "AGENTPROTO_PROVENANCE_WRAP_GH";
+    DEFAULT_WRAP_GH = false;
+  }
+});
+function validateConfig(raw) {
+  const result = agentprotoConfigSchema.safeParse(raw);
+  if (result.success) return { ok: true, issues: [] };
+  const issues = result.error.issues.map((issue) => {
+    const path = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+    return `${path}: ${issue.message}`;
+  });
+  return { ok: false, issues };
+}
+var contextContinuityPolicySchema, deferredToolsConfigSchema, spawnBrowserModeSchema, optionsMapSchema, defaultsAdapterAuthConfigSchema, defaultsAdapterConfigSchema, mcpDefaultsConfigSchema, spawnDefaultsConfigSchema, daemonConfigSchema, titlerConfigSchema, tunnelConfigSchema, featuresConfigSchema, worktreesConfigSchema, spawnConfigSchema, provenanceConfigSchema, sessionsConfigSchema, agentsMdConfigSchema, pairPageSchema, pairingConfigSchema, profileConfigSchema, acpAgentConfigEntrySchema, terminalPresetSchema, agentprotoConfigSchema, bool, str, num, strArray;
+var init_config_schema = __esm({
+  "src/config-schema.ts"() {
+    init_worktree_isolation();
+    init_spawn_attach();
+    init_spawn_dedupe();
+    init_session_presence();
+    init_gh_provenance_shim();
+    init_agents_md();
+    init_session_titler();
+    init_background_task_wake();
+    init_role();
+    contextContinuityPolicySchema = z.object({
+      mode: z.enum(["manual", "ask", "auto"]).optional(),
+      warnAtPct: z.number().optional(),
+      compactAtPct: z.number().optional(),
+      continueFreshAtPct: z.number().optional(),
+      hardStopAtPct: z.number().optional(),
+      goal: z.boolean().optional(),
+      plan: z.boolean().optional(),
+      decisions: z.boolean().optional(),
+      changedFiles: z.boolean().optional(),
+      gitStatus: z.boolean().optional(),
+      tests: z.boolean().optional(),
+      errors: z.boolean().optional(),
+      risks: z.boolean().optional(),
+      nextStep: z.boolean().optional(),
+      config: z.boolean().optional(),
+      label: z.string().optional()
+    }).passthrough();
+    deferredToolsConfigSchema = z.union([
+      z.boolean(),
+      z.object({ alwaysOn: z.array(z.string()) }).passthrough()
+    ]);
+    spawnBrowserModeSchema = z.union([
+      z.literal("headless"),
+      z.literal(false)
+    ]);
+    optionsMapSchema = z.record(z.string(), z.union([z.boolean(), z.number(), z.string()]));
+    defaultsAdapterAuthConfigSchema = z.object({
+      mode: z.enum(["subscription", "api-key"]).optional(),
+      token: z.string().optional(),
+      source: z.string().optional(),
+      apiKey: z.string().optional(),
+      provider: CatalogProviderSchema.optional()
+    }).passthrough();
+    defaultsAdapterConfigSchema = z.object({
+      skills: z.array(z.string()).optional(),
+      options: optionsMapSchema.optional(),
+      auth: defaultsAdapterAuthConfigSchema.optional(),
+      contextContinuity: contextContinuityPolicySchema.optional()
+    }).passthrough();
+    mcpDefaultsConfigSchema = z.object({
+      deferredTools: deferredToolsConfigSchema.optional()
+    }).passthrough();
+    spawnDefaultsConfigSchema = z.object({
+      skills: z.array(z.string()).optional(),
+      options: optionsMapSchema.optional(),
+      adapters: z.record(z.string(), defaultsAdapterConfigSchema).optional(),
+      contextContinuity: contextContinuityPolicySchema.optional(),
+      defaultRoleDepthCutoff: z.number().optional(),
+      maxGrantableDelegation: z.number().optional(),
+      langfuseTracing: z.boolean().optional(),
+      backgroundTaskWake: z.object({ enabled: z.boolean().optional(), graceMs: z.number().optional() }).passthrough().optional(),
+      traceRedactor: z.string().optional(),
+      agentPromptInterrupt: z.boolean().optional(),
+      messaging: z.object({
+        allowSiblings: z.boolean().optional(),
+        agentInterrupt: z.enum(["allow", "deny"]).optional()
+      }).passthrough().optional(),
+      mcp: mcpDefaultsConfigSchema.optional(),
+      spawn: z.object({ browser: spawnBrowserModeSchema.optional() }).passthrough().optional()
+    }).passthrough();
+    daemonConfigSchema = z.object({
+      workspace: z.string().optional(),
+      port: z.number().optional(),
+      bind: z.string().optional(),
+      allowedOrigins: z.array(z.string()).optional(),
+      strictOrigins: z.boolean().optional(),
+      label: z.string().optional(),
+      authToken: z.string().optional(),
+      resumeSessionsOnBoot: z.boolean().optional(),
+      idleReapAfterMs: z.number().optional(),
+      crashDetectIntervalMs: z.number().optional(),
+      restartSweepIntervalMs: z.number().optional(),
+      turnStallAfterMs: z.number().optional()
+    }).passthrough();
+    titlerConfigSchema = z.object({
+      enabled: z.boolean().optional(),
+      model: z.string().optional()
+    }).passthrough();
+    tunnelConfigSchema = z.object({
+      host: z.string().optional(),
+      token: z.string().optional(),
+      autoconnect: z.boolean().optional(),
+      e2e: z.boolean().optional()
+    }).passthrough();
+    featuresConfigSchema = z.object({
+      pty: z.boolean().optional(),
+      llmEndpoint: z.boolean().optional()
+    }).passthrough();
+    worktreesConfigSchema = z.object({
+      root: z.string().optional(),
+      isolation: z.enum(["always", "on-request", "never"]).optional()
+    }).passthrough();
+    spawnConfigSchema = z.object({
+      attach: z.enum(["always", "on-request"]).optional(),
+      dedupe: z.enum(["always", "on-request"]).optional()
+    }).passthrough();
+    provenanceConfigSchema = z.object({ wrapGh: z.boolean().optional() }).passthrough();
+    sessionsConfigSchema = z.object({
+      attentionDelaySec: z.number().optional(),
+      eventsDir: z.string().optional()
+    }).passthrough();
+    agentsMdConfigSchema = z.object({ inlineMaxKb: z.number().optional() }).passthrough();
+    pairPageSchema = z.string().superRefine((value, ctx) => {
+      try {
+        resolvePairPageUrl(value, "0123456789abcdef");
+      } catch (err) {
+        ctx.addIssue({ code: "custom", message: err instanceof Error ? err.message : String(err) });
+      }
+    });
+    pairingConfigSchema = z.object({
+      rendezvous: z.string().optional(),
+      autoconnect: z.boolean().optional(),
+      pairPage: pairPageSchema.optional()
+    }).passthrough();
+    profileConfigSchema = z.object({
+      daemon: daemonConfigSchema.optional(),
+      tunnel: tunnelConfigSchema.optional(),
+      features: featuresConfigSchema.optional()
+    }).passthrough();
+    acpAgentConfigEntrySchema = z.object({
+      name: z.string().optional(),
+      description: z.string().optional(),
+      bin: z.string(),
+      bin_args: z.array(z.string()).optional(),
+      env: z.record(z.string(), z.string()).optional(),
+      cwd_flag: z.string().optional(),
+      resumable: z.boolean().optional(),
+      models: z.object({
+        default: z.string().optional(),
+        allowed: z.array(z.string()).optional()
+      }).passthrough().optional(),
+      provider: z.string().optional(),
+      install_hint: z.string().optional()
+    }).passthrough();
+    terminalPresetSchema = z.object({
+      argv: z.array(z.string()).optional(),
+      env: z.record(z.string(), z.string()).optional(),
+      cwd: z.string().optional(),
+      workspace: z.string().optional(),
+      name: z.string().optional(),
+      label: z.string().optional()
+    }).passthrough();
+    agentprotoConfigSchema = z.object({
+      version: z.number().optional(),
+      daemon: daemonConfigSchema.optional(),
+      tunnel: tunnelConfigSchema.optional(),
+      features: featuresConfigSchema.optional(),
+      pairing: pairingConfigSchema.optional(),
+      worktrees: worktreesConfigSchema.optional(),
+      spawn: spawnConfigSchema.optional(),
+      sessions: sessionsConfigSchema.optional(),
+      provenance: provenanceConfigSchema.optional(),
+      agentsMd: agentsMdConfigSchema.optional(),
+      titler: titlerConfigSchema.optional(),
+      profiles: z.record(z.string(), profileConfigSchema).optional(),
+      activeProfile: z.string().optional(),
+      defaults: spawnDefaultsConfigSchema.optional(),
+      acpAgents: z.record(z.string(), acpAgentConfigEntrySchema).optional(),
+      terminalPresets: z.record(z.string(), terminalPresetSchema).optional()
+    }).passthrough();
+    bool = z.boolean();
+    str = z.string();
+    num = z.number();
+    strArray = z.array(z.string());
+    [
+      // ── daemon ──
+      {
+        path: "daemon.workspace",
+        schema: str,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "Workspace",
+        help: "Absolute path the daemon binds to at boot."
+      },
+      {
+        path: "daemon.port",
+        schema: num,
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Port",
+        help: "Local HTTP port. Changing this from a UI served BY the daemon can cut the UI off; hand-edit only.",
+        default: 18790
+      },
+      {
+        path: "daemon.bind",
+        schema: str,
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Bind address",
+        help: "Bind address. Lockout: a bad value here can make the daemon unreachable.",
+        default: "127.0.0.1"
+      },
+      {
+        path: "daemon.allowedOrigins",
+        schema: strArray,
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Allowed origins",
+        help: "Trusted browser origins for mutating /sessions/* routes, in addition to the hardcoded localhost defaults. Lockout: a bad value can lock a browser UI out."
+      },
+      {
+        path: "daemon.strictOrigins",
+        schema: bool,
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Strict origins",
+        help: "When true, only origins in allowedOrigins are trusted (no auto-trust of localhost-on-any-port). Lockout: pairs with allowedOrigins.",
+        default: false
+      },
+      {
+        path: "daemon.label",
+        schema: str,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "Server label",
+        help: "Label sent in tunnel hello frames."
+      },
+      {
+        path: "daemon.authToken",
+        schema: str,
+        apply: "restart",
+        secret: true,
+        writable: false,
+        section: "daemon",
+        label: "Auth token",
+        help: 'Bearer token gating the gateway at boot. Unset \u21D2 mode "none" (open on loopback). Set via the CLI, never through config_set.'
+      },
+      {
+        path: "daemon.resumeSessionsOnBoot",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "Resume sessions on boot",
+        help: "Eagerly re-spawn eligible agent-cli sessions that died from a daemon restart.",
+        default: false
+      },
+      {
+        path: "daemon.idleReapAfterMs",
+        schema: num,
+        apply: "restart",
+        env: "AGENTPROTO_IDLE_REAP_AFTER_MS",
+        writable: true,
+        section: "daemon",
+        label: "Idle reap after (ms)",
+        help: "Retire idle agent-cli sessions after this many ms. Unset/0/negative \u21D2 the reaper never runs.",
+        default: 0
+      },
+      {
+        path: "daemon.crashDetectIntervalMs",
+        schema: num,
+        apply: "restart",
+        env: "AGENTPROTO_CRASH_DETECT_INTERVAL_MS",
+        writable: true,
+        section: "daemon",
+        label: "Crash-detect interval (ms)",
+        help: "Crash-detect sweep interval. Default-on (non-destructive observability); a non-positive value disables it.",
+        default: 3e4
+      },
+      {
+        path: "daemon.restartSweepIntervalMs",
+        schema: num,
+        apply: "restart",
+        env: "AGENTPROTO_RESTART_SWEEP_INTERVAL_MS",
+        writable: true,
+        section: "daemon",
+        label: "Restart-sweep interval (ms)",
+        help: "Sweep interval that executes already-scheduled session restarts. Off by default.",
+        default: 0
+      },
+      {
+        path: "daemon.turnStallAfterMs",
+        schema: num,
+        apply: "restart",
+        env: "AGENTPROTO_TURN_STALL_AFTER_MS",
+        writable: true,
+        section: "daemon",
+        label: "Turn-stall threshold (ms)",
+        help: "Turn-liveness watchdog threshold. Default-on (non-destructive observability); a non-positive value disables it.",
+        default: 3e5
+      },
+      {
+        path: "sessions.eventsDir",
+        schema: str,
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Sessions events dir",
+        help: "Root directory for per-session transcripts. Lockout: existing transcripts do not move when this changes, and a bad path can break every session reader.",
+        default: "~/.agentproto/sessions"
+      },
+      {
+        path: "profiles",
+        schema: z.record(str, profileConfigSchema),
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Connection profiles",
+        help: "Named daemon/tunnel/features overrides selected via --profile. Lockout in v1: edit the file by hand."
+      },
+      {
+        path: "activeProfile",
+        schema: str,
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Active profile",
+        help: "Profile used when --profile isn't passed. Lockout in v1: edit the file by hand."
+      },
+      // ── remote (tunnel + pairing) ──
+      {
+        path: "tunnel.host",
+        schema: str,
+        apply: "restart",
+        writable: true,
+        section: "remote",
+        label: "Tunnel host",
+        help: "Cloud WS URL. With autoconnect=true, `serve` bootstraps with --connect <host>."
+      },
+      {
+        path: "tunnel.token",
+        schema: str,
+        apply: "restart",
+        env: "AGENTPROTO_TOKEN",
+        secret: true,
+        writable: false,
+        section: "remote",
+        label: "Tunnel token",
+        help: "Daemon token presented at the tunnel upgrade. Set via the CLI, never through config_set."
+      },
+      {
+        path: "tunnel.autoconnect",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "remote",
+        label: "Tunnel autoconnect",
+        help: "Whether `daemon start` connects the tunnel by default.",
+        default: false
+      },
+      {
+        path: "tunnel.e2e",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "remote",
+        label: "Tunnel end-to-end encryption",
+        help: "Opt into E2E encryption of the outbound tunnel. Requires tunnel.token.",
+        default: false
+      },
+      {
+        path: "pairing.rendezvous",
+        schema: str,
+        apply: "restart",
+        writable: true,
+        section: "remote",
+        label: "Pairing rendezvous URL",
+        help: "Rendezvous broker WS URL used by pair_offer and autoconnect on boot."
+      },
+      {
+        path: "pairing.autoconnect",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "remote",
+        label: "Pairing autoconnect",
+        help: "Open standing rendezvous connections for every persisted pairing on boot.",
+        default: true
+      },
+      {
+        path: "pairing.pairPage",
+        schema: pairPageSchema,
+        // Read by `pair offer --qr` on every run, not at daemon boot.
+        apply: "hot",
+        writable: true,
+        section: "remote",
+        label: "Phone pair page",
+        help: "Web page the `pair offer --qr` link opens (the offer rides in its URL fragment). A template with {fp} in the hostname gives one browser origin per daemon (the default, https://{fp}.agentproto.cloud/pair); a plain http(s) URL is one shared origin. `--pair-page` overrides it.",
+        default: DEFAULT_PAIR_PAGE
+      },
+      // ── models ──
+      {
+        path: "titler.model",
+        schema: str,
+        apply: "hot",
+        writable: true,
+        section: "models",
+        label: "Titler model",
+        help: "OpenRouter model id used to generate session titles. Requires OPENROUTER_API_KEY.",
+        default: DEFAULT_TITLER_MODEL
+      },
+      // ── defaults: spawn ──
+      {
+        path: "defaults.skills",
+        schema: strArray,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Default skills",
+        help: "Skills auto-applied to every agent_start spawn (unioned with per-adapter skills)."
+      },
+      {
+        path: "defaults.options",
+        schema: optionsMapSchema,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Default options",
+        help: "AIP-45 options auto-applied to every agent_start spawn."
+      },
+      {
+        path: "defaults.defaultRoleDepthCutoff",
+        schema: num,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Default role depth cutoff",
+        help: "Spawn depth at/after which an agent_start with no explicit role defaults to executor rather than supervisor.",
+        default: DEFAULT_ROLE_DEPTH_CUTOFF
+      },
+      {
+        path: "defaults.maxGrantableDelegation",
+        schema: num,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Max grantable delegation",
+        help: "Caps the delegation level a role pack may self-grant. Unset \u21D2 no cap."
+      },
+      {
+        path: "defaults.spawn.browser",
+        schema: spawnBrowserModeSchema,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Default spawn browser mode",
+        help: "Default agent_start.browser when neither the call, its role, nor its preset says otherwise.",
+        default: false
+      },
+      {
+        path: "worktrees.root",
+        schema: str,
+        apply: "hot",
+        env: "AGENTPROTO_WORKTREES_ROOT",
+        writable: true,
+        section: "defaults",
+        label: "Worktrees root",
+        help: "Absolute path new `worktree new` worktrees are created under.",
+        default: "~/.agentproto/worktrees"
+      },
+      {
+        path: "worktrees.isolation",
+        schema: z.enum(["always", "on-request", "never"]),
+        apply: "hot",
+        env: WORKTREE_ISOLATION_ENV,
+        writable: true,
+        section: "defaults",
+        label: "Worktree isolation policy",
+        help: "Whether a freshly-spawned agent_start session is isolated into its own git worktree.",
+        default: DEFAULT_WORKTREE_ISOLATION
+      },
+      {
+        path: "spawn.attach",
+        schema: z.enum(["always", "on-request"]),
+        apply: "hot",
+        env: SPAWN_ATTACH_ENV,
+        writable: true,
+        section: "defaults",
+        label: "Spawn attach policy",
+        help: "Whether a spawn auto-attaches to its calling session as parent lineage.",
+        default: DEFAULT_SPAWN_ATTACH
+      },
+      {
+        path: "spawn.dedupe",
+        schema: z.enum(["always", "on-request"]),
+        apply: "hot",
+        env: SPAWN_DEDUPE_ENV,
+        writable: true,
+        section: "defaults",
+        label: "Spawn dedupe policy",
+        help: "Whether agent_start derives an implicit idempotency key when the caller passes none.",
+        default: DEFAULT_SPAWN_DEDUPE
+      },
+      {
+        path: "provenance.wrapGh",
+        schema: bool,
+        apply: "hot",
+        env: PROVENANCE_WRAP_GH_ENV,
+        writable: true,
+        section: "defaults",
+        label: "gh provenance shim",
+        help: "Opt-in gh PATH shim that stamps PR bodies with agentproto provenance.",
+        default: DEFAULT_WRAP_GH
+      },
+      {
+        path: "agentsMd.inlineMaxKb",
+        schema: num,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "AGENTS.md inline threshold (KiB)",
+        help: "A resolved AGENTS.md strictly under this size is inlined into the spawn prompt; at/above it, a pointer is injected instead.",
+        default: DEFAULT_AGENTS_MD_INLINE_MAX_KB
+      },
+      // ── defaults: context continuity ──
+      {
+        path: "defaults.contextContinuity",
+        schema: contextContinuityPolicySchema,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Default context-continuity policy",
+        help: "Global context-continuity policy fragment (mode + thresholds + checkpoint sections). Validated as one cross-field unit."
+      },
+      // ── defaults: observability ──
+      {
+        path: "titler.enabled",
+        schema: bool,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Session titler enabled",
+        help: "Generate a short title from the first completed turn of eligible sessions. Default off.",
+        default: false
+      },
+      {
+        path: "defaults.langfuseTracing",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "defaults",
+        label: "Langfuse tracing default",
+        help: "Default per-session Langfuse tracing opt-in when agent_start omits `trace`.",
+        default: false
+      },
+      {
+        path: "defaults.traceRedactor",
+        schema: str,
+        apply: "restart",
+        writable: true,
+        section: "defaults",
+        label: "Trace redactor",
+        help: "Redactor slug applied to traced session content before it reaches Langfuse.",
+        default: "secrets"
+      },
+      {
+        path: "sessions.attentionDelaySec",
+        schema: num,
+        apply: "hot",
+        env: ATTENTION_DELAY_ENV,
+        writable: true,
+        section: "defaults",
+        label: "Attention delay (s)",
+        help: 'How long a session stays shown as "running" after its last turn ends before settling to attention/quiet.',
+        default: DEFAULT_ATTENTION_DELAY_SEC
+      },
+      {
+        path: "defaults.mcp.deferredTools",
+        schema: deferredToolsConfigSchema,
+        apply: "restart",
+        writable: true,
+        section: "defaults",
+        label: "Deferred MCP tools",
+        help: "Gateway-wide lazy tools/list loading. false/absent \u21D2 eager (today's behaviour).",
+        default: false
+      },
+      {
+        path: "defaults.backgroundTaskWake.enabled",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "defaults",
+        label: "Background-task wake enabled",
+        help: "Wake an idle agent session when one of its background tasks settles.",
+        default: true
+      },
+      {
+        path: "defaults.backgroundTaskWake.graceMs",
+        schema: num,
+        apply: "restart",
+        writable: true,
+        section: "defaults",
+        label: "Background-task wake grace (ms)",
+        help: "How long the daemon waits for the agent to wake itself before prompting it.",
+        default: DEFAULT_BG_TASK_WAKE_GRACE_MS
+      },
+      // ── defaults: messaging ──
+      {
+        path: "defaults.agentPromptInterrupt",
+        schema: bool,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Default agent_prompt interrupt",
+        help: "Default `interrupt` applied when agent_prompt/message_parent leaves it unset. Takes effect on the next call.",
+        default: false
+      },
+      {
+        path: "defaults.messaging.allowSiblings",
+        schema: bool,
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Allow sibling messaging",
+        help: "Let message_send/message_reply reach a sibling session (same parent). Takes effect on the next call.",
+        default: false
+      },
+      {
+        path: "defaults.messaging.agentInterrupt",
+        schema: z.enum(["allow", "deny"]),
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Agent-sender interrupt urgency",
+        help: 'Whether a SESSION sender may use urgency "interrupt" (vs. downgraded to "steer"). Takes effect on the next call.',
+        default: "deny"
+      },
+      // ── harnesses: per-adapter defaults ──
+      {
+        path: "defaults.adapters.*.skills",
+        schema: strArray,
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter default skills",
+        help: "Skills auto-applied to spawns of this adapter (unioned with the global default)."
+      },
+      {
+        path: "defaults.adapters.*.options",
+        schema: optionsMapSchema,
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter default options",
+        help: "AIP-45 options auto-applied to spawns of this adapter."
+      },
+      {
+        path: "defaults.adapters.*.contextContinuity",
+        schema: contextContinuityPolicySchema,
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter context-continuity policy",
+        help: "Per-adapter context-continuity policy fragment, overriding the global default. Validated as one cross-field unit."
+      },
+      {
+        path: "defaults.adapters.*.auth.mode",
+        schema: z.enum(["subscription", "api-key"]),
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter auth mode",
+        help: '"subscription" or "api-key". Omitted \u21D2 resolver picks by ordered preference.'
+      },
+      {
+        path: "defaults.adapters.*.auth.token",
+        schema: str,
+        apply: "hot",
+        secret: true,
+        writable: false,
+        section: "harnesses",
+        label: "Adapter subscription token",
+        help: "Subscription bearer token. Wallet secrets belong in auth profiles; this field is not writable through config_set."
+      },
+      {
+        path: "defaults.adapters.*.auth.source",
+        schema: str,
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter subscription source",
+        help: 'Opt-in self-refreshing subscription source, e.g. "claude-code-oauth".'
+      },
+      {
+        path: "defaults.adapters.*.auth.apiKey",
+        schema: str,
+        apply: "hot",
+        secret: true,
+        writable: false,
+        section: "harnesses",
+        label: "Adapter API key",
+        help: 'Explicit API key for "api-key" mode. Wallet secrets belong in auth profiles; this field is not writable through config_set.'
+      },
+      {
+        path: "defaults.adapters.*.auth.provider",
+        schema: CatalogProviderSchema,
+        apply: "hot",
+        writable: true,
+        section: "harnesses",
+        label: "Adapter auth provider pin",
+        help: "Per-adapter provider pin, overriding the adapter's fixed/model-derived provider."
+      },
+      // ── harnesses: user ACP agents ──
+      //
+      // Every leaf here is `writable: false`: these fields name a BINARY, argv,
+      // and environment that the daemon executes on the host, the same reasoning
+      // that keeps `adapter_install` off the app surface (PLAN.md Q6). The write
+      // path in v1 is the CLI (`agentproto acp add/rm`, which is exempt from this
+      // flag entirely) or a hand edit, never a future config_set.
+      {
+        path: "acpAgents.*.name",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent display name",
+        help: "Display name. Defaults to the slug when omitted. Set via `agentproto acp add`."
+      },
+      {
+        path: "acpAgents.*.description",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent description",
+        help: "One-line description surfaced in `acp ls`. Set via `agentproto acp add`."
+      },
+      {
+        path: "acpAgents.*.bin",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent executable",
+        help: "Executable the daemon spawns on the host. Set via `agentproto acp add`; not writable through config_set."
+      },
+      {
+        path: "acpAgents.*.bin_args",
+        schema: strArray,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent argv",
+        help: "Extra argv appended after `bin`. Set via `agentproto acp add`; not writable through config_set."
+      },
+      {
+        path: "acpAgents.*.env",
+        schema: z.record(str, str),
+        apply: "hot",
+        secret: true,
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent environment",
+        help: "Extra environment variables for the spawned process; values may hold secrets, so a reader redacts them. Set via `agentproto acp add`; not writable through config_set."
+      },
+      {
+        path: "acpAgents.*.cwd_flag",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent cwd flag",
+        help: "Flag the CLI uses to receive the working directory, if it needs one passed explicitly. Set via `agentproto acp add`."
+      },
+      {
+        path: "acpAgents.*.resumable",
+        schema: bool,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent resumable",
+        help: "Advertise resumable + native-resume continuation. Set via `agentproto acp add`."
+      },
+      {
+        path: "acpAgents.*.models.default",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent default model",
+        help: "Known default model id (informational + validation hint). Set via `agentproto acp add`."
+      },
+      {
+        path: "acpAgents.*.models.allowed",
+        schema: strArray,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent allowed models",
+        help: "Known allowed model ids (informational + validation hint). Set via `agentproto acp add`."
+      },
+      {
+        path: "acpAgents.*.provider",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent billing provider",
+        help: "Billing endpoint this CLI's own auth bills, if a single known one applies. Set via `agentproto acp add`."
+      },
+      {
+        path: "acpAgents.*.install_hint",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "harnesses",
+        label: "ACP agent install hint",
+        help: "Shown when `bin` is missing from PATH. Set via `agentproto acp add`."
+      },
+      // ── advanced: terminal/TUI presets ──
+      //
+      // Same reasoning as the ACP agents above: `writable: false` on every leaf,
+      // since these name a command, argv, and environment run on the host. The
+      // write path in v1 is `agentproto config set` (exempt from this flag) or a
+      // hand edit, never a future config_set.
+      {
+        path: "terminalPresets.*.argv",
+        schema: strArray,
+        apply: "hot",
+        writable: false,
+        section: "advanced",
+        label: "Terminal preset argv",
+        help: "Command + args to spawn. Not writable through config_set; set via `agentproto config set` or a hand edit."
+      },
+      {
+        path: "terminalPresets.*.env",
+        schema: z.record(str, str),
+        apply: "hot",
+        secret: true,
+        writable: false,
+        section: "advanced",
+        label: "Terminal preset environment",
+        help: "Extra environment variables layered on the daemon's inherited env; values may hold secrets, so a reader redacts them. Not writable through config_set."
+      },
+      {
+        path: "terminalPresets.*.cwd",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "advanced",
+        label: "Terminal preset cwd",
+        help: "Working directory for the PTY session. Not writable through config_set."
+      },
+      {
+        path: "terminalPresets.*.workspace",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "advanced",
+        label: "Terminal preset workspace",
+        help: "Workspace slug used for cwd fallback when `cwd` is omitted. Not writable through config_set."
+      },
+      {
+        path: "terminalPresets.*.name",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "advanced",
+        label: "Terminal preset session name",
+        help: "Stable session name passed to the registry. Not writable through config_set."
+      },
+      {
+        path: "terminalPresets.*.label",
+        schema: str,
+        apply: "hot",
+        writable: false,
+        section: "advanced",
+        label: "Terminal preset label",
+        help: "Human-readable label surfaced in session listings. Not writable through config_set."
+      },
+      // ── daemon-adjacent (no dedicated UI section yet — features toggles) ──
+      {
+        path: "features.pty",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "PTY feature hint",
+        help: "Informational hint that PTY is desired; the daemon still detects node-pty's presence at runtime."
+      },
+      {
+        path: "features.llmEndpoint",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "LLM Endpoint feature",
+        help: "Enable the local LLM Endpoint proxy sidecar (route + MCP tools + child-process lifecycle).",
+        default: false
+      }
+    ];
+  }
+});
 function sanitizeAcpAgents(raw, target) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
     console.warn(
@@ -27,6 +3594,9 @@ function sanitizeAcpAgents(raw, target) {
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
+function hashConfigContent(raw) {
+  return createHash("sha256").update(raw, "utf8").digest("hex");
+}
 async function loadConfig(path) {
   const target = path ?? CONFIG_FILE_PATH();
   try {
@@ -37,6 +3607,18 @@ async function loadConfig(path) {
       if (cfg.acpAgents !== void 0) {
         cfg.acpAgents = sanitizeAcpAgents(cfg.acpAgents, target);
       }
+      const validation = validateConfig(cfg);
+      if (!validation.ok) {
+        const contentHash = hashConfigContent(raw);
+        if (warnedInvalidConfigHashes.get(target) !== contentHash) {
+          warnedInvalidConfigHashes.set(target, contentHash);
+          const shown = validation.issues.slice(0, 5);
+          const more = validation.issues.length > shown.length ? ` (+${validation.issues.length - shown.length} more)` : "";
+          console.warn(
+            `[runtime/config] ${target}: ${validation.issues.length} schema issue(s): ${shown.join("; ")}${more}`
+          );
+        }
+      }
       return cfg;
     }
     console.warn(
@@ -53,11 +3635,16 @@ async function loadConfig(path) {
     return {};
   }
 }
+var CONFIG_FILE_PATH, warnedInvalidConfigHashes;
+var init_config = __esm({
+  "src/config.ts"() {
+    init_config_schema();
+    CONFIG_FILE_PATH = () => join(homedir(), ".agentproto", "config.json");
+    warnedInvalidConfigHashes = /* @__PURE__ */ new Map();
+  }
+});
 
 // src/session-presence.ts
-var ATTENTION_DELAY_ENV = "AGENTPROTO_SESSIONS_ATTENTION_DELAY_SEC";
-var DEFAULT_ATTENTION_DELAY_SEC = 60;
-var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["exited", "killed", "error"]);
 function inAttentionGrace(s, opts) {
   const delaySec = opts?.attentionDelaySec ?? DEFAULT_ATTENTION_DELAY_SEC;
   if (delaySec <= 0) return false;
@@ -97,6 +3684,16 @@ async function resolveAttentionDelaySec(loadCfg = loadConfig) {
   }
   return DEFAULT_ATTENTION_DELAY_SEC;
 }
+var ATTENTION_DELAY_ENV, DEFAULT_ATTENTION_DELAY_SEC, TERMINAL_STATUSES;
+var init_session_presence = __esm({
+  "src/session-presence.ts"() {
+    init_config();
+    ATTENTION_DELAY_ENV = "AGENTPROTO_SESSIONS_ATTENTION_DELAY_SEC";
+    DEFAULT_ATTENTION_DELAY_SEC = 60;
+    TERMINAL_STATUSES = /* @__PURE__ */ new Set(["exited", "killed", "error"]);
+  }
+});
+init_session_presence();
 
 export { ATTENTION_DELAY_ENV, DEFAULT_ATTENTION_DELAY_SEC, inAttentionGrace, presenceFor, resolveAttentionDelaySec };
 //# sourceMappingURL=session-presence.mjs.map