@agentproto/runtime 5.1.0 → 5.2.1

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { execFile, spawn, execFileSync } from 'child_process';
-import { readFile, mkdir, writeFile, unlink, readdir, stat, rm, rename, copyFile, mkdtemp, chmod, realpath, appendFile, open, access } from 'fs/promises';
+import { readFile, mkdir, writeFile, unlink, readdir, stat, chmod, mkdtemp, rm, rename, copyFile, realpath, appendFile, open, access } from 'fs/promises';
 import { homedir, hostname, tmpdir } from 'os';
 import { join, resolve, dirname, basename, isAbsolute, normalize as normalize$1, relative, sep, extname, delimiter } from 'path';
 import { loadAdapterSpawnSandboxConfig, loadSandboxConfig, resolveCommandSandbox, COMMAND_SANDBOX_MODE_ENV } from '@agentproto/command-sandbox';
@@ -18,6 +18,7 @@ import { CatalogProviderSchema, getModelsByProvider, getStaticModelProvider } fr
 import { resolvePairPageUrl, DEFAULT_PAIR_PAGE } from '@agentproto/secrets/pairing/browser';
 import { ListToolsRequestSchema, CallToolRequestSchema, SUPPORTED_PROTOCOL_VERSIONS, LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
 import { makeCredsStore, makeAdapterResolver, makeAdapterLister, discoverAdapterPackages, makeSetupLedger, makeListTool, makeSetupTool } from '@agentproto/provider-kit';
+import { syncPiModels, getConfiguredEndpoints, checkHarnessFit, connectorById } from '@agentproto/llm-endpoint';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPError, StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { createServer as createServer$1 } from 'net';
@@ -38,6 +39,8 @@ import { Readable } from 'stream';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { WebSocketServer } from 'ws';
+import { clientHandshakeOverSink, daemonHandshakeOverSink, createTunnelClient } from '@agentproto/acp/tunnel';
+import { parseOfferUrl, deriveOfferTokens, startClientHandshake, encodePairingMessage, decodePairingReply, derivePairRoot, encodeOfferUrl, OFFER_VERSION, decodePairingHello, respondToHandshake, PairingError, currentEpoch, deriveEpochTokens, HOSTED_RENDEZVOUS_URL, PAIRING_PROTOCOL_OUTDATED_MESSAGE, respondToLegacyHandshake } from '@agentproto/secrets/pairing';
 import { loadAppBundledTools, peekAppUi, loadAppHandle } from '@agentproto/app-kit';
 import { loadAgent } from '@agentproto/agent';
 import { normalizeToolId } from '@agentproto/driver';
@@ -53,12 +56,11 @@ import { SseError, SSEClientTransport } from '@modelcontextprotocol/sdk/client/s
 import { isToolVisibilityAppOnly, getToolUiResourceUri, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/app-bridge';
 import { EXTENSION_ID } from '@modelcontextprotocol/ext-apps/server';
 import { UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js';
-import { ledgerKeyOf, buildAgentLanePrompt, parseAgentLaneReport, parseReviewManifest, resolveBinding, manifestSha, sha256Hex, rangeSha, compileReview, buildAttestation } from '@agentproto/review';
+import { ledgerKeyOf, rangeSha, canonicalAttestationBytes, attestationSha256, buildAgentLanePrompt, parseAgentLaneReport, parseReviewManifest, resolvePacks, resolveBinding, manifestSha, sha256Hex, compileReview, buildAttestation, parsePackManifest } from '@agentproto/review';
+import { createRequire } from 'module';
 import { parseRoutineManifest } from '@agentproto/routine';
 import { promisify } from 'util';
-import { createRequire } from 'module';
-import { clientHandshakeOverSink, daemonHandshakeOverSink, createTunnelClient } from '@agentproto/acp/tunnel';
-import { parseOfferUrl, deriveOfferTokens, startClientHandshake, encodePairingMessage, decodePairingReply, derivePairRoot, encodeOfferUrl, OFFER_VERSION, decodePairingHello, respondToHandshake, PairingError, currentEpoch, deriveEpochTokens, HOSTED_RENDEZVOUS_URL, PAIRING_PROTOCOL_OUTDATED_MESSAGE, respondToLegacyHandshake } from '@agentproto/secrets/pairing';
+import { pipeline } from 'stream/promises';
 import { identityFingerprint } from '@agentproto/secrets/identity';
 
 /**
@@ -134,15 +136,15 @@ function hasMarker(command, marker) {
   return false;
 }
 function listProcesses() {
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     execFile("ps", ["-axo", "pid=,command="], { maxBuffer: 32 * 1024 * 1024 }, (err, stdout) => {
-      if (err) return resolve37([]);
+      if (err) return resolve38([]);
       const out = [];
       for (const line of stdout.split("\n")) {
         const m = line.match(/^\s*(\d+)\s+(.*)$/);
         if (m) out.push({ pid: Number(m[1]), command: m[2] ?? "" });
       }
-      resolve37(out);
+      resolve38(out);
     });
   });
 }
@@ -236,14 +238,14 @@ function extractText(value) {
   return null;
 }
 function formatToolResult(toolName, result, isError) {
-  const text12 = extractText(result);
+  const text13 = extractText(result);
   if (isError) {
-    const message = text12 ?? (result != null ? JSON.stringify(result) : "failed");
+    const message = text13 ?? (result != null ? JSON.stringify(result) : "failed");
     const firstLine = message.split(/\r?\n/)[0] ?? message;
     return truncate(firstLine, MAX_RESULT_LENGTH);
   }
-  if (text12 == null) return null;
-  const trimmed = text12.trim();
+  if (text13 == null) return null;
+  const trimmed = text13.trim();
   if (!trimmed) return null;
   const lines = trimmed.split(/\r?\n/);
   if (lines.length > 1) {
@@ -253,9 +255,9 @@ function formatToolResult(toolName, result, isError) {
   return truncate(lines[0], MAX_RESULT_LENGTH);
 }
 function artifactMarkerLines(result) {
-  const text12 = extractText(result);
-  if (text12 == null || !text12.includes(ARTIFACT_MARKER)) return [];
-  return text12.split(/\r?\n/).filter((line) => line.includes(ARTIFACT_MARKER)).slice(0, MAX_ARTIFACT_MARKER_LINES).map((line) => line.trim());
+  const text13 = extractText(result);
+  if (text13 == null || !text13.includes(ARTIFACT_MARKER)) return [];
+  return text13.split(/\r?\n/).filter((line) => line.includes(ARTIFACT_MARKER)).slice(0, MAX_ARTIFACT_MARKER_LINES).map((line) => line.trim());
 }
 var SALIENT_ARG_KEYS, MAX_CALL_LENGTH, MAX_RESULT_LENGTH, BESPOKE_TOOLS, ARTIFACT_MARKER, MAX_ARTIFACT_MARKER_LINES;
 var init_tool_presenter = __esm({
@@ -393,8 +395,8 @@ function detectShellPrCreate(command, resultText) {
 }
 function cwdRelated(sessionCwd, cwd) {
   if (sessionCwd === cwd) return true;
-  const sep5 = "/";
-  return cwd.startsWith(sessionCwd + sep5) || sessionCwd.startsWith(cwd + sep5);
+  const sep6 = "/";
+  return cwd.startsWith(sessionCwd + sep6) || sessionCwd.startsWith(cwd + sep6);
 }
 function pickExecutorSession(sessions, cwd) {
   const candidates = sessions.filter(
@@ -471,7 +473,7 @@ function plausibleContextUsed(contextSize, contextUsed) {
 function tokenCost(tokens, pricePer1M) {
   return tokens === void 0 ? 0 : tokens * pricePer1M / 1e6;
 }
-function deriveSessionUsage(input, resolve37 = defaultResolver) {
+function deriveSessionUsage(input, resolve38 = defaultResolver) {
   const contextUsed = plausibleContextUsed(input.contextSize, input.contextUsed);
   const base = {
     ...input.model !== void 0 ? { model: input.model } : {},
@@ -486,7 +488,7 @@ function deriveSessionUsage(input, resolve37 = defaultResolver) {
   }
   const hasTokens = input.tokensIn !== void 0 || input.tokensOut !== void 0 || input.cacheReadTokens !== void 0 || input.cacheWriteTokens !== void 0;
   if (hasTokens) {
-    const pricing = input.model !== void 0 ? resolve37(input.model) : void 0;
+    const pricing = input.model !== void 0 ? resolve38(input.model) : void 0;
     if (!pricing) {
       return { ...base, source: "no-pricing" };
     }
@@ -666,9 +668,9 @@ function createTranscriptWriter(opts) {
       state.textDebounce = null;
     }
     if (!state.textBuf) return;
-    const text12 = state.textBuf;
+    const text13 = state.textBuf;
     state.textBuf = "";
-    writeRecord(sessionId, state, { kind: "text-delta", sessionId, text: text12 });
+    writeRecord(sessionId, state, { kind: "text-delta", sessionId, text: text13 });
   };
   const flushThoughtBuf = (sessionId, state) => {
     if (state.thoughtDebounce) {
@@ -676,9 +678,9 @@ function createTranscriptWriter(opts) {
       state.thoughtDebounce = null;
     }
     if (!state.thoughtBuf) return;
-    const text12 = state.thoughtBuf;
+    const text13 = state.thoughtBuf;
     state.thoughtBuf = "";
-    writeRecord(sessionId, state, { kind: "thought", sessionId, text: text12 });
+    writeRecord(sessionId, state, { kind: "thought", sessionId, text: text13 });
   };
   const flushToolUpdates = (sessionId, state) => {
     if (state.toolUpdates.size === 0) return;
@@ -696,9 +698,9 @@ function createTranscriptWriter(opts) {
     state.textDebounce = setTimeout(() => {
       state.textDebounce = null;
       if (!state.textBuf) return;
-      const text12 = state.textBuf;
+      const text13 = state.textBuf;
       state.textBuf = "";
-      writeRecord(sessionId, state, { kind: "text-delta", sessionId, text: text12, partial: true });
+      writeRecord(sessionId, state, { kind: "text-delta", sessionId, text: text13, partial: true });
     }, DEBOUNCE_MS);
   };
   const scheduleThoughtDebounce = (sessionId, state) => {
@@ -706,9 +708,9 @@ function createTranscriptWriter(opts) {
     state.thoughtDebounce = setTimeout(() => {
       state.thoughtDebounce = null;
       if (!state.thoughtBuf) return;
-      const text12 = state.thoughtBuf;
+      const text13 = state.thoughtBuf;
       state.thoughtBuf = "";
-      writeRecord(sessionId, state, { kind: "thought", sessionId, text: text12, partial: true });
+      writeRecord(sessionId, state, { kind: "thought", sessionId, text: text13, partial: true });
     }, DEBOUNCE_MS);
   };
   return {
@@ -716,14 +718,14 @@ function createTranscriptWriter(opts) {
       const state = getState(sessionId);
       flushBuffers(sessionId, state);
       const blocks = typeof message === "string" ? void 0 : Array.isArray(message) ? message : [message];
-      const text12 = typeof message === "string" ? message : (blocks ?? []).filter((b) => isRecord2(b) && typeof b.text === "string").map((b) => b.text).join("\n");
+      const text13 = typeof message === "string" ? message : (blocks ?? []).filter((b) => isRecord2(b) && typeof b.text === "string").map((b) => b.text).join("\n");
       if (opts2?.system) {
         writeRecord(sessionId, state, { kind: "system-prompt", sessionId, text: opts2.system });
       }
-      let userText = text12;
+      let userText = text13;
       if (opts2?.system) {
-        if (text12.startsWith(opts2.system)) {
-          userText = text12.slice(opts2.system.length).replace(/^\n\n/, "");
+        if (text13.startsWith(opts2.system)) {
+          userText = text13.slice(opts2.system.length).replace(/^\n\n/, "");
         } else {
           console.warn(
             `[transcript-writer] recordPrompt: system preamble is not a prefix of the composed prompt for session ${sessionId} \u2014 composition invariant violated (see session-spawn.ts's composedPreamble), recording the full text as user-prompt instead of risking a bad slice.`
@@ -987,8 +989,8 @@ function createTranscriptWriter(opts) {
       if (!state) return Promise.resolve();
       flushBuffers(sessionId, state);
       states.delete(sessionId);
-      return new Promise((resolve37) => {
-        state.stream.end(() => resolve37());
+      return new Promise((resolve38) => {
+        state.stream.end(() => resolve38());
       });
     },
     closeAll() {
@@ -997,7 +999,7 @@ function createTranscriptWriter(opts) {
         const state = states.get(sessionId);
         if (!state) continue;
         flushBuffers(sessionId, state);
-        closings.push(new Promise((resolve37) => state.stream.end(() => resolve37())));
+        closings.push(new Promise((resolve38) => state.stream.end(() => resolve38())));
       }
       states.clear();
       return Promise.all(closings).then(() => void 0);
@@ -1060,10 +1062,10 @@ __export(transcript_export_exports, {
   renderJson: () => renderJson,
   renderMarkdown: () => renderMarkdown
 });
-function trunc(text12, n) {
-  if (text12.length <= n) return text12;
-  return text12.slice(0, n) + `
-\u2026 [${text12.length - n} chars truncated]`;
+function trunc(text13, n) {
+  if (text13.length <= n) return text13;
+  return text13.slice(0, n) + `
+\u2026 [${text13.length - n} chars truncated]`;
 }
 function renderMarkdown(session, opts = {}) {
   const { meta, messages } = session;
@@ -1158,9 +1160,9 @@ async function exportClaudeCodeSession(adapterSessionId, cwd, configDir) {
   let stream;
   try {
     stream = createReadStream(filePath, { encoding: "utf8" });
-    await new Promise((resolve37, reject) => {
+    await new Promise((resolve38, reject) => {
       stream.once("error", reject);
-      stream.once("open", resolve37);
+      stream.once("open", resolve38);
     });
   } catch (err) {
     const code = err.code;
@@ -1434,7 +1436,7 @@ async function discoverHermesSessions(cwd, since, expectedId) {
 }
 async function defaultHermesRunner(adapterSessionId) {
   const { spawn: spawn8 } = await import('child_process');
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const chunks = [];
     const errChunks = [];
     const proc = spawn8(
@@ -1453,7 +1455,7 @@ async function defaultHermesRunner(adapterSessionId) {
           )
         );
       } else {
-        resolve37(Buffer.concat(chunks).toString("utf8"));
+        resolve38(Buffer.concat(chunks).toString("utf8"));
       }
     });
   });
@@ -1490,9 +1492,9 @@ async function exportDaemonEventsSession(sessionId, desc) {
   let stream;
   try {
     stream = createReadStream(filePath, { encoding: "utf8" });
-    await new Promise((resolve37, reject) => {
+    await new Promise((resolve38, reject) => {
       stream.once("error", reject);
-      stream.once("open", resolve37);
+      stream.once("open", resolve38);
     });
   } catch (err) {
     const code = err.code;
@@ -1558,10 +1560,10 @@ ${rec.stdout}`);
 ${rec.stderr}`);
       if (rec.truncated) sections.push("(output truncated)");
       if (rec.timedOut) sections.push("(timed out)");
-      const text12 = sections.join("\n");
+      const text13 = sections.join("\n");
       messages.push({
         role: "tool",
-        text: rec.exitCode !== 0 ? `[error] ${text12}` : text12,
+        text: rec.exitCode !== 0 ? `[error] ${text13}` : text13,
         toolName,
         ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {}
       });
@@ -1616,10 +1618,10 @@ ${rec.stderr}`);
       case "tool-result": {
         flushAssistant();
         const name = rec.toolCallId ? toolNameById.get(rec.toolCallId) : void 0;
-        const text12 = typeof rec.result === "string" ? rec.result : JSON.stringify(rec.result ?? "");
+        const text13 = typeof rec.result === "string" ? rec.result : JSON.stringify(rec.result ?? "");
         messages.push({
           role: "tool",
-          text: rec.isError ? `[error] ${text12}` : text12,
+          text: rec.isError ? `[error] ${text13}` : text13,
           ...name ? { toolName: name } : {},
           ...tsOrUndefined !== void 0 ? { ts: tsOrUndefined } : {}
         });
@@ -1783,10 +1785,10 @@ The session may predate persistence, or CODEX_HOME points elsewhere.`
     if (entry.type !== "response_item") continue;
     switch (p.type) {
       case "message": {
-        const text12 = codexBlocksText(p.content).trim();
-        if (!text12) break;
+        const text13 = codexBlocksText(p.content).trim();
+        if (!text13) break;
         const role = p.role === "assistant" ? "assistant" : p.role === "user" ? "user" : "system";
-        messages.push({ role, text: text12 });
+        messages.push({ role, text: text13 });
         break;
       }
       case "reasoning": {
@@ -1916,7 +1918,7 @@ async function exportOpenCodeSession(conversationId) {
         continue;
       }
       const role = mdata.role === "assistant" ? "assistant" : "user";
-      let text12 = "";
+      let text13 = "";
       let reasoning = "";
       const toolCalls = [];
       const toolResults = [];
@@ -1929,7 +1931,7 @@ async function exportOpenCodeSession(conversationId) {
         }
         switch (part.type) {
           case "text":
-            if (part.text) text12 += part.text;
+            if (part.text) text13 += part.text;
             break;
           case "reasoning":
             if (part.text) reasoning += part.text;
@@ -1946,9 +1948,9 @@ async function exportOpenCodeSession(conversationId) {
           }
         }
       }
-      if (text12.trim() || reasoning.trim() || toolCalls.length) {
+      if (text13.trim() || reasoning.trim() || toolCalls.length) {
         const em = { role };
-        if (text12.trim()) em.text = text12.trim();
+        if (text13.trim()) em.text = text13.trim();
         if (reasoning.trim()) em.reasoning = reasoning.trim();
         if (toolCalls.length) em.toolCalls = toolCalls;
         em.ts = m.time_created;
@@ -2034,13 +2036,13 @@ function mastraContentToMessage(role, content) {
   } catch {
     return { message: void 0, toolResults, toolCalls: 0 };
   }
-  let text12 = "";
+  let text13 = "";
   let reasoning = "";
   const toolCalls = [];
   for (const raw of parsed.parts ?? []) {
     if (!raw || typeof raw !== "object") continue;
     const part = raw;
-    if (part.type === "text" && part.text) text12 += part.text;
+    if (part.type === "text" && part.text) text13 += part.text;
     else if (part.type === "reasoning" && part.reasoning) reasoning += part.reasoning;
     else if (part.type === "tool-invocation" && part.toolInvocation) {
       const inv = part.toolInvocation;
@@ -2054,9 +2056,9 @@ function mastraContentToMessage(role, content) {
     }
   }
   let message;
-  if (text12.trim() || reasoning.trim() || toolCalls.length) {
+  if (text13.trim() || reasoning.trim() || toolCalls.length) {
     message = { role };
-    if (text12.trim()) message.text = text12.trim();
+    if (text13.trim()) message.text = text13.trim();
     if (reasoning.trim()) message.reasoning = reasoning.trim();
     if (toolCalls.length) message.toolCalls = toolCalls;
   }
@@ -2214,25 +2216,25 @@ async function exportPiSession(conversationId) {
     const m = entry.message;
     const content = m.content;
     if (m.role === "toolResult") {
-      const text13 = piBlocksText(content);
+      const text14 = piBlocksText(content);
       messages.push({
         role: "tool",
-        text: m.isError ? `[error] ${text13}` : text13,
+        text: m.isError ? `[error] ${text14}` : text14,
         ...m.toolName ? { toolName: m.toolName } : {}
       });
       continue;
     }
     const role = m.role === "assistant" ? "assistant" : "user";
-    let text12 = "";
+    let text13 = "";
     let reasoning = "";
     const toolCalls = [];
     if (typeof content === "string") {
-      text12 = content;
+      text13 = content;
     } else if (Array.isArray(content)) {
       for (const raw of content) {
         if (!raw || typeof raw !== "object") continue;
         const part = raw;
-        if (part.type === "text" && part.text) text12 += part.text;
+        if (part.type === "text" && part.text) text13 += part.text;
         else if (part.type === "thinking" && part.thinking) reasoning += part.thinking;
         else if (part.type === "toolCall") {
           toolCalls.push({ name: part.name ?? "tool", args: JSON.stringify(part.arguments ?? {}) });
@@ -2240,9 +2242,9 @@ async function exportPiSession(conversationId) {
         }
       }
     }
-    if (text12.trim() || reasoning.trim() || toolCalls.length) {
+    if (text13.trim() || reasoning.trim() || toolCalls.length) {
       const em = { role };
-      if (text12.trim()) em.text = text12.trim();
+      if (text13.trim()) em.text = text13.trim();
       if (reasoning.trim()) em.reasoning = reasoning.trim();
       if (toolCalls.length) em.toolCalls = toolCalls;
       messages.push(em);
@@ -2435,8 +2437,8 @@ function extractFirstText(content) {
   }
   return void 0;
 }
-function isClaudeControlText(text12) {
-  return /^<(?:local-command-caveat|local-command-stdout|command-name|task-notification)>/i.test(text12);
+function isClaudeControlText(text13) {
+  return /^<(?:local-command-caveat|local-command-stdout|command-name|task-notification)>/i.test(text13);
 }
 async function scanClaudeJsonl(filePath) {
   const stream = createReadStream(filePath, { encoding: "utf8" });
@@ -2465,9 +2467,9 @@ async function scanClaudeJsonl(filePath) {
     if (entry.type === "user" || entry.type === "assistant") {
       messageCount += 1;
       if (preview2 === void 0 && entry.type === "user") {
-        const text12 = extractFirstText(entry.message?.content);
-        if (text12 !== void 0 && !isClaudeControlText(text12)) {
-          preview2 = text12.length > 120 ? text12.slice(0, 120) : text12;
+        const text13 = extractFirstText(entry.message?.content);
+        if (text13 !== void 0 && !isClaudeControlText(text13)) {
+          preview2 = text13.length > 120 ? text13.slice(0, 120) : text13;
         }
       }
     }
@@ -3816,8 +3818,8 @@ async function enrichWithRemainingQuota(rollup, opts) {
     })
   );
   const capMs = opts.timeoutMs ?? DEFAULT_ENRICH_CAP_MS;
-  const cap = new Promise((resolve37) => {
-    setTimeout(() => resolve37(null), capMs);
+  const cap = new Promise((resolve38) => {
+    setTimeout(() => resolve38(null), capMs);
   });
   const settled = await Promise.race([work, cap]);
   if (settled === null) return rollup;
@@ -3881,8 +3883,8 @@ async function enrichWithAccountCredits(rollup, opts) {
     })
   );
   const capMs = opts.timeoutMs ?? DEFAULT_ENRICH_CAP_MS;
-  const cap = new Promise((resolve37) => {
-    setTimeout(() => resolve37(null), capMs);
+  const cap = new Promise((resolve38) => {
+    setTimeout(() => resolve38(null), capMs);
   });
   const settled = await Promise.race([work, cap]);
   if (settled === null) return rollup;
@@ -4427,11 +4429,11 @@ async function defaultLoadConfig() {
   const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
   return loadConfig2();
 }
-function assembleShimPath(shimDir, basePath, sep5 = delimiter) {
+function assembleShimPath(shimDir, basePath, sep6 = delimiter) {
   const base = basePath ?? "";
-  const entries = base.length > 0 ? base.split(sep5) : [];
+  const entries = base.length > 0 ? base.split(sep6) : [];
   if (entries[0] === shimDir) return base;
-  return [shimDir, ...entries].join(sep5);
+  return [shimDir, ...entries].join(sep6);
 }
 function buildGhShimEnv(input) {
   const env = {
@@ -4706,9 +4708,9 @@ async function readFirstTurn(sessionId) {
   let stream;
   try {
     stream = createReadStream(sessionEventsPath(sessionId), { encoding: "utf8" });
-    await new Promise((resolve37, reject) => {
+    await new Promise((resolve38, reject) => {
       stream.once("error", reject);
-      stream.once("open", resolve37);
+      stream.once("open", resolve38);
     });
   } catch {
     return null;
@@ -5085,7 +5087,8 @@ var init_config_schema = __esm({
     featuresConfigSchema = z.object({
       pty: z.boolean().optional(),
       llmEndpoint: z.boolean().optional(),
-      deviceInferenceShare: z.boolean().optional()
+      deviceInferenceShare: z.boolean().optional(),
+      deviceSpawnAllow: z.boolean().optional()
     }).passthrough();
     worktreesConfigSchema = z.object({
       root: z.string().optional(),
@@ -5932,6 +5935,16 @@ var init_config_schema = __esm({
         label: "Device inference sharing",
         help: "Expose this daemon's local inference endpoint(s) to a paired HOST-scoped controller. Toggle via `agentproto devices share-inference on|off`.",
         default: false
+      },
+      {
+        path: "features.deviceSpawnAllow",
+        schema: bool,
+        apply: "restart",
+        writable: true,
+        section: "daemon",
+        label: "Device spawn allow",
+        help: 'Allow a paired HOST-scoped controller to spawn/drive agent sessions on this daemon (`agent_start({ sandbox: "device:<name>" })`). Toggle via `agentproto devices allow-spawn on|off`.',
+        default: false
       }
     ];
   }
@@ -6987,10 +7000,118 @@ var init_canonical_posture = __esm({
     })();
   }
 });
+function emptyFile3() {
+  return { version: 1, presets: [] };
+}
+function userPresetsPath() {
+  return resolve(homedir(), ".agentproto", "presets.json");
+}
+async function loadUserPresets() {
+  try {
+    return userPresetsFileSchema.parse(JSON.parse(await readFile(userPresetsPath(), "utf8")));
+  } catch {
+    return emptyFile3();
+  }
+}
+async function writeUserPresets(file) {
+  const dir = join(homedir(), ".agentproto");
+  await mkdir(dir, { recursive: true });
+  await writeFile(userPresetsPath(), JSON.stringify(file, null, 2) + "\n", {
+    encoding: "utf8",
+    mode: 384
+  });
+}
+async function listUserPresets() {
+  return (await loadUserPresets()).presets;
+}
+async function getUserPreset(id) {
+  return (await loadUserPresets()).presets.find((preset) => preset.id === id);
+}
+async function saveUserPreset(preset) {
+  const validated = userPresetSchema.parse(preset);
+  const file = await loadUserPresets();
+  const index = file.presets.findIndex((existing) => existing.id === validated.id);
+  const lastUsedAt = validated.lastUsedAt ?? (index === -1 ? void 0 : file.presets[index]?.lastUsedAt);
+  const next = { ...validated, ...lastUsedAt ? { lastUsedAt } : {} };
+  if (index === -1) file.presets.push(next);
+  else file.presets[index] = next;
+  await writeUserPresets(file);
+}
+async function deleteUserPreset(id) {
+  const file = await loadUserPresets();
+  const index = file.presets.findIndex((preset) => preset.id === id);
+  if (index === -1) return false;
+  file.presets.splice(index, 1);
+  await writeUserPresets(file);
+  return true;
+}
+async function touchUserPreset(id) {
+  const file = await loadUserPresets();
+  const index = file.presets.findIndex((preset) => preset.id === id);
+  if (index === -1) return;
+  file.presets[index] = { ...file.presets[index], lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await writeUserPresets(file);
+}
+function deriveRecentSpawnConfigs(descriptors, limit = 5) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const desc of descriptors) {
+    if (out.length >= limit) break;
+    if (desc.kind !== "agent-cli") continue;
+    const adapter = desc.harness ?? desc.adapterSlug;
+    if (!adapter) continue;
+    const config = {
+      adapter,
+      ...desc.model ? { model: desc.model } : {},
+      ...desc.accessProfile?.profileRef ? { profileRef: desc.accessProfile.profileRef } : {},
+      ...desc.cwd ? { cwd: desc.cwd } : {}
+    };
+    const key = JSON.stringify(config);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ ...config, recent: true });
+  }
+  return out;
+}
+var effortSchema, postureSchema, routeSchema, userPresetSchema, userPresetsFileSchema;
+var init_user_presets = __esm({
+  "src/user-presets.ts"() {
+    effortSchema = z.enum(["low", "medium", "high", "xhigh", "max", "ultracode"]);
+    postureSchema = z.union([
+      z.enum(["default", "plan", "accept-edits", "bypass", "read-only"]),
+      z.object({ harnessModeId: z.string().min(1) })
+    ]);
+    routeSchema = z.object({
+      gateway: z.string().min(1),
+      baseUrl: z.string().url().optional()
+    });
+    userPresetSchema = z.object({
+      id: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+      label: z.string().min(1),
+      adapter: z.string().min(1).optional(),
+      harness: z.string().min(1).optional(),
+      model: z.string().min(1).optional(),
+      route: routeSchema.optional(),
+      access: z.object({ profileRef: z.string().min(1).optional() }).optional(),
+      posture: postureSchema.optional(),
+      effort: effortSchema.optional(),
+      contextProfile: z.string().min(1).optional(),
+      cwd: z.string().min(1).optional(),
+      skills: z.array(z.string().min(1)).optional(),
+      bundles: z.array(z.string().min(1)).optional(),
+      browser: z.union([z.literal("headless"), z.literal(false)]).optional(),
+      lastUsedAt: z.string().min(1).optional()
+    });
+    userPresetsFileSchema = z.object({
+      version: z.literal(1),
+      presets: z.array(userPresetSchema)
+    });
+  }
+});
 function defaultValidationDeps() {
   return { getProfile: getAuthProfile };
 }
-function emptyFile3() {
+function emptyFile4() {
   return { version: 1, presets: [] };
 }
 function harnessPresetsPath() {
@@ -7000,7 +7121,7 @@ async function loadHarnessPresets() {
   try {
     return harnessPresetsFileSchema.parse(JSON.parse(await readFile(harnessPresetsPath(), "utf8")));
   } catch {
-    return emptyFile3();
+    return emptyFile4();
   }
 }
 async function writeHarnessPresets(file) {
@@ -7567,8 +7688,8 @@ function extractText2(message) {
   }
   return isTextBlock(message) ? message.text : void 0;
 }
-function truncate2(text12, maxLength) {
-  const codePoints = Array.from(text12);
+function truncate2(text13, maxLength) {
+  const codePoints = Array.from(text13);
   const sliced = codePoints.slice(0, maxLength).join("");
   const lastSpace = sliced.lastIndexOf(" ");
   const cut = lastSpace > 0 ? sliced.slice(0, lastSpace) : sliced;
@@ -7590,6 +7711,162 @@ var init_session_title = __esm({
     MAX_LENGTH = 72;
   }
 });
+function splitOnLastAt(value) {
+  const m = LAST_AT_RE.exec(value);
+  return m ? { head: m[1], tail: m[2] } : null;
+}
+function pickSoleLoadedModel(models) {
+  const loaded = models.filter((m) => m.state === "loaded");
+  if (loaded.length === 1) return { ok: true, model: loaded[0] };
+  if (loaded.length === 0) {
+    return { ok: false, message: "no model is currently loaded on this endpoint \u2014 load one first, or pass `inference.model` explicitly." };
+  }
+  return {
+    ok: false,
+    message: `${loaded.length} models are loaded on this endpoint (${loaded.map((m) => m.id).join(", ")}) \u2014 pass \`inference.model\` to pick one.`
+  };
+}
+async function resolveLocalEndpoint(endpoint, modelId, deps2) {
+  const connectorId = endpoint.connector ?? "openai-compatible";
+  const connector = connectorById(connectorId);
+  if (!connector) {
+    return { ok: false, message: `endpoint "${endpoint.id}" declares unknown connector "${connectorId}".` };
+  }
+  const listModels = deps2.listModels ?? ((ep) => connector.listModels(ep.baseUrl));
+  const models = await listModels(endpoint);
+  let resolvedModelId;
+  if (modelId) {
+    resolvedModelId = modelId;
+  } else {
+    const sole = pickSoleLoadedModel(models);
+    if (!sole.ok) return sole;
+    resolvedModelId = sole.model.id;
+  }
+  const match = models.find((m) => m.id === resolvedModelId);
+  const target = {
+    kind: "local",
+    endpointId: endpoint.id,
+    modelId: resolvedModelId,
+    loadedCtx: match?.loadedCtx,
+    connector: connectorId,
+    baseUrl: endpoint.baseUrl
+  };
+  return {
+    ok: true,
+    target,
+    gatewayModelId: `${endpoint.id}/${resolvedModelId}`,
+    label: endpoint.id
+  };
+}
+async function resolveDeviceEndpoint(device, modelId, deps2) {
+  if (!deps2.probeDevice) {
+    return {
+      ok: false,
+      message: `"@${device}" needs a device probe (this daemon has no paired-host registry wired) \u2014 cannot resolve.`
+    };
+  }
+  const probe = await deps2.probeDevice(device, modelId);
+  if (!probe.reachable) {
+    return { ok: false, message: `device "${device}" is offline or unreachable \u2014 ${probe.message}` };
+  }
+  if (!probe.modelIds.includes(modelId)) {
+    return {
+      ok: false,
+      message: `device "${device}" is online but has no loaded model "${modelId}" (it has: ${probe.modelIds.join(", ") || "(none loaded)"}).`
+    };
+  }
+  const target = {
+    kind: "device",
+    remoteEndpointId: probe.endpointId,
+    device,
+    modelId,
+    loadedCtx: void 0
+  };
+  return {
+    ok: true,
+    target,
+    gatewayModelId: `${probe.endpointId}@${device}/${modelId}`,
+    label: `${probe.endpointId}@${device}`
+  };
+}
+async function resolveInferenceTarget(req, deps2 = {}) {
+  const getConfiguredEndpoints$1 = deps2.getConfiguredEndpoints ?? getConfiguredEndpoints;
+  if (req.endpoint) {
+    const deviceRef = splitOnLastAt(req.endpoint);
+    if (deviceRef) {
+      if (!req.model) {
+        return { ok: false, message: `inference.endpoint "${req.endpoint}" is device-qualified \u2014 inference.model is required to pick a model on it.` };
+      }
+      return resolveDeviceEndpoint(deviceRef.tail, req.model, deps2);
+    }
+    const endpoint = getConfiguredEndpoints$1().find((e) => e.id === req.endpoint);
+    if (!endpoint) {
+      const known = getConfiguredEndpoints$1().map((e) => e.id);
+      return {
+        ok: false,
+        message: `inference.endpoint "${req.endpoint}" is not a configured endpoint (known: ${known.length > 0 ? known.join(", ") : "(none configured)"}). Run \`agentproto llm endpoints add\` or \`detect\` first.`
+      };
+    }
+    return resolveLocalEndpoint(endpoint, req.model, deps2);
+  }
+  if (req.model) {
+    const split = splitOnLastAt(req.model);
+    if (!split) {
+      return {
+        ok: false,
+        message: `inference.model "${req.model}" has no "@<device|endpoint>" suffix \u2014 pass inference.endpoint explicitly, or use the "<model>@<ref>" shorthand.`
+      };
+    }
+    const { head: modelId, tail: ref } = split;
+    const asLocalEndpoint = getConfiguredEndpoints$1().find((e) => e.id === ref);
+    if (asLocalEndpoint) return resolveLocalEndpoint(asLocalEndpoint, modelId, deps2);
+    return resolveDeviceEndpoint(ref, modelId, deps2);
+  }
+  return { ok: false, message: "inference requires at least one of `endpoint` or `model`." };
+}
+function fitCheckForTarget(harness, target, label, opts = {}) {
+  return checkHarnessFit({
+    harness,
+    loadedCtx: target.loadedCtx,
+    ...opts.headroomRatio !== void 0 ? { headroomRatio: opts.headroomRatio } : {},
+    endpointLabel: label
+  });
+}
+function projectInferenceBinding(harness, resolved) {
+  switch (harness) {
+    case "pi": {
+      if (resolved.target.kind === "device") {
+        return {
+          ok: false,
+          message: `"pi" against a paired device's endpoint ("${resolved.label}") is not supported yet \u2014 bind "claude-code"/"claude-sdk" through the gateway instead, or run pi directly on that device.`
+        };
+      }
+      return { ok: true, projection: { model: resolved.gatewayModelId, needsPiModelsSync: true } };
+    }
+    case "claude-code":
+    case "claude-sdk":
+      return {
+        ok: true,
+        projection: {
+          model: resolved.gatewayModelId,
+          route: { gateway: "llm-endpoint" },
+          auth: { mode: "api-key", apiKey: "not-needed" },
+          deferredTools: true
+        }
+      };
+    default:
+      return {
+        ok: false,
+        message: `"${harness}" has no local-endpoint wiring yet (supported: pi, claude-code, claude-sdk) \u2014 pass \`model\`/\`route\`/\`access\` directly instead of \`inference\`.`
+      };
+  }
+}
+var LAST_AT_RE;
+var init_inference_binding = __esm({
+  "src/inference-binding.ts"() {
+    LAST_AT_RE = /^(.+)@([^@]+)$/;
+  }
+});
 
 // src/mcp-credential-deps.ts
 function setMcpCredentialDeps(d) {
@@ -7609,8 +7886,8 @@ var init_mcp_credential_deps = __esm({
 function extractPromptText(message) {
   if (typeof message === "string") return message;
   if (message && typeof message === "object" && "text" in message) {
-    const text12 = message.text;
-    if (typeof text12 === "string") return text12;
+    const text13 = message.text;
+    if (typeof text13 === "string") return text13;
   }
   return JSON.stringify(message);
 }
@@ -7683,7 +7960,7 @@ async function* pollAgentOutputFallback(host, remoteSessionId, since) {
             `sandbox proxy: ${consecutivePollFailures} consecutive poll failures against the box daemon (session "${remoteSessionId}") \u2014 giving up. Last error: ${pollErr instanceof Error ? pollErr.message : String(pollErr)}`
           );
         }
-        await new Promise((resolve37) => setTimeout(resolve37, POLL_RETRY_DELAY_MS));
+        await new Promise((resolve38) => setTimeout(resolve38, POLL_RETRY_DELAY_MS));
         continue;
       }
       if (result.timedOut) continue;
@@ -7849,9 +8126,9 @@ async function connectBoxToolClient(mcpUrl) {
       }
       const content = textBlocks(reply.content);
       if (reply.isError === true) {
-        const text12 = content.find((c) => c.type === "text")?.text;
+        const text13 = content.find((c) => c.type === "text")?.text;
         throw new Error(
-          `box tool "${name}" failed${text12 ? `: ${text12}` : ""}`
+          `box tool "${name}" failed${text13 ? `: ${text13}` : ""}`
         );
       }
       return { content };
@@ -7880,15 +8157,15 @@ function firstText(res) {
 function isJsonRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function parseJsonRecordText(text12) {
-  if (text12.length === 0) return void 0;
-  const parsed = JSON.parse(text12);
+function parseJsonRecordText(text13) {
+  if (text13.length === 0) return void 0;
+  const parsed = JSON.parse(text13);
   return isJsonRecord(parsed) ? parsed : void 0;
 }
 function parseToolJson(res) {
-  const text12 = firstText(res);
-  if (text12 === void 0) return void 0;
-  return parseJsonRecordText(text12);
+  const text13 = firstText(res);
+  if (text13 === void 0) return void 0;
+  return parseJsonRecordText(text13);
 }
 function buildServeLaunchScript(dir, port) {
   if (dir.includes("'")) {
@@ -7937,15 +8214,15 @@ async function pollServeReady(url, opts) {
   for (; ; ) {
     if (await probe(url)) return true;
     if (Date.now() >= deadline) return false;
-    await new Promise((resolve37) => setTimeout(resolve37, intervalMs));
+    await new Promise((resolve38) => setTimeout(resolve38, intervalMs));
   }
 }
 async function seedAllowlist(client) {
   let existing = null;
   try {
     const read = await client.callTool("file_read", { path: BOX_ALLOWLIST_REL });
-    const text12 = firstText(read);
-    if (text12 !== void 0) existing = text12;
+    const text13 = firstText(read);
+    if (text13 !== void 0) existing = text13;
   } catch {
   }
   const merged = mergeAllowlistForAppServe(existing);
@@ -7974,9 +8251,9 @@ function extractServeError(logText) {
 async function readServeError(client, dir) {
   try {
     const res = await client.callTool("file_read", { path: serveLogPath(dir) });
-    const text12 = firstText(res);
-    if (text12 === void 0) return void 0;
-    return extractServeError(text12);
+    const text13 = firstText(res);
+    if (text13 === void 0) return void 0;
+    return extractServeError(text13);
   } catch {
     return void 0;
   }
@@ -8062,7 +8339,7 @@ var init_sandbox_app_serve = __esm({
   }
 });
 async function getFreePort() {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const srv = createServer$1();
     srv.once("error", reject);
     srv.listen(0, "127.0.0.1", () => {
@@ -8072,7 +8349,7 @@ async function getFreePort() {
         return;
       }
       const { port } = address;
-      srv.close(() => resolve37(port));
+      srv.close(() => resolve38(port));
     });
   });
 }
@@ -8085,7 +8362,7 @@ async function probeHealth(url, timeoutMs) {
     } catch {
     }
     if (Date.now() >= deadline) return false;
-    await new Promise((resolve37) => setTimeout(resolve37, POLL_INTERVAL_MS));
+    await new Promise((resolve38) => setTimeout(resolve38, POLL_INTERVAL_MS));
   }
 }
 var HEALTH_TIMEOUT_MS, POLL_INTERVAL_MS, localSandboxProvider;
@@ -8723,6 +9000,48 @@ ${callerPrompt}`;
   return pre || void 0;
 }
 async function spawnAgentSession(deps2, input) {
+  if (input.inference) {
+    if (input.model || input.route || input.access) {
+      return {
+        ok: false,
+        code: "inference_endpoint_unresolved",
+        message: "agent_start: `inference` is mutually exclusive with `model`/`route`/`access` \u2014 bind the endpoint via `inference`, or pin those fields directly, never both in the same spawn."
+      };
+    }
+    const harness = input.harness ?? input.adapter;
+    const resolved2 = await resolveInferenceTarget(input.inference, {
+      ...deps2.probeDeviceInference ? { probeDevice: deps2.probeDeviceInference } : {}
+    });
+    if (!resolved2.ok) {
+      return { ok: false, code: "inference_endpoint_unresolved", message: `agent_start: ${resolved2.message}` };
+    }
+    const fit = fitCheckForTarget(harness, resolved2.target, resolved2.label, {
+      ...input.inference.headroomPct !== void 0 ? { headroomRatio: input.inference.headroomPct / 100 } : {}
+    });
+    if (fit.verdict === "no-fit" && !input.inference.force) {
+      return {
+        ok: false,
+        code: "inference_fit_check_failed",
+        message: `agent_start: ${fit.message ?? "harness fit check failed."} Pass \`inference.force: true\` to override.`
+      };
+    }
+    const projected = projectInferenceBinding(harness, resolved2);
+    if (!projected.ok) {
+      return { ok: false, code: "inference_endpoint_unresolved", message: `agent_start: ${projected.message}` };
+    }
+    if (projected.projection.needsPiModelsSync) {
+      await syncPiModels().catch(() => {
+      });
+    }
+    const { inference: _inference, ...withoutInference } = input;
+    input = {
+      ...withoutInference,
+      model: projected.projection.model,
+      ...projected.projection.route ? { route: projected.projection.route } : {},
+      ...projected.projection.auth ? { auth: projected.projection.auth } : {},
+      ...projected.projection.deferredTools !== void 0 ? { deferredTools: input.deferredTools ?? projected.projection.deferredTools } : {}
+    };
+  }
   const presetBrowser = input.preset?.browser;
   if (input.preset) {
     const { preset, ...explicit } = input;
@@ -8741,6 +9060,8 @@ async function spawnAgentSession(deps2, input) {
       skills: explicit.skills ?? preset.skills,
       bundles: explicit.bundles ?? preset.bundles
     };
+    await touchUserPreset(preset.id).catch(() => {
+    });
   }
   if (!input.access?.profileRef) {
     const preset = await getDefaultHarnessPreset(input.harness ?? input.adapter);
@@ -9118,10 +9439,10 @@ async function spawnAgentSession(deps2, input) {
       if (entry.transport !== "http" || typeof entry.ref !== "string") return entry;
       const targetsDaemon = entry.ref === daemonMcpUrl || entry.ref.startsWith(daemonQ);
       if (!targetsDaemon || entry.ref.includes("callerSessionId=")) return entry;
-      const sep5 = entry.ref.includes("?") ? "&" : "?";
+      const sep6 = entry.ref.includes("?") ? "&" : "?";
       return {
         ...entry,
-        ref: `${entry.ref}${sep5}callerSessionId=${encodeURIComponent(mintedSessionId)}`
+        ref: `${entry.ref}${sep6}callerSessionId=${encodeURIComponent(mintedSessionId)}`
       };
     });
   }
@@ -9493,8 +9814,8 @@ async function spawnAgentSession(deps2, input) {
     }
     let resolveClaim;
     claims.set(key, {
-      result: new Promise((resolve37) => {
-        resolveClaim = resolve37;
+      result: new Promise((resolve38) => {
+        resolveClaim = resolve38;
       }),
       // An implicit claim expires sooner than an explicit one — see
       // `IMPLICIT_SPAWN_CLAIM_WINDOW_MS`'s docblock.
@@ -9994,13 +10315,13 @@ async function isSharedDirtyCwd(cwd) {
   const identity = resolveWorktreeIdentity(cwd);
   if (identity?.worktreeId !== void 0) return false;
   const { spawn: spawn8 } = await import('child_process');
-  return await new Promise((resolve37) => {
+  return await new Promise((resolve38) => {
     let stdout = "";
     let settled = false;
     const done = (v) => {
       if (!settled) {
         settled = true;
-        resolve37(v);
+        resolve38(v);
       }
     };
     const child = spawn8("git", ["-C", cwd, "status", "--porcelain"], {
@@ -10015,15 +10336,15 @@ async function isSharedDirtyCwd(cwd) {
 }
 async function resolveMcpCredentialHeaders(mcpServers) {
   if (!mcpServers || mcpServers.length === 0) return mcpServers;
-  const { resolveMcpCredentialHeaders: resolve37 } = getMcpCredentialDeps();
-  if (!resolve37) return mcpServers;
+  const { resolveMcpCredentialHeaders: resolve38 } = getMcpCredentialDeps();
+  if (!resolve38) return mcpServers;
   return Promise.all(
     mcpServers.map(async (entry) => {
       const ref = entry.credentialRef;
       if (!ref) return entry;
       let brokered;
       try {
-        brokered = await resolve37({ credentialRef: ref });
+        brokered = await resolve38({ credentialRef: ref });
       } catch (err) {
         console.warn(
           `[agent_start] credentialRef resolution failed for "${entry.name}" (${ref}): ${err instanceof Error ? err.message : String(err)}`
@@ -10213,11 +10534,13 @@ async function bootSandboxAgentSession(opts) {
     ...boxCwd ? { cwd: boxCwd } : {},
     ...lifecyclePolicy.pauseAfterIdleMs !== void 0 ? { expiresAt: new Date(Date.now() + lifecyclePolicy.pauseAfterIdleMs).toISOString() } : {}
   });
+  const omitCwd = handle.omitCwdWhenImplicit === true && !opts.explicitCwd;
   let remoteSessionId;
+  let resolvedCwd = boxCwd;
   try {
     const remoteDesc = await host.start({
       adapter: opts.adapter,
-      cwd: boxCwd,
+      ...omitCwd ? {} : { cwd: boxCwd },
       ...opts.mcpServers ? { mcpServers: toMcpServerMounts(opts.mcpServers) } : {},
       ...opts.model ? { model: opts.model } : {},
       ...opts.route ? { route: opts.route } : {},
@@ -10226,6 +10549,7 @@ async function bootSandboxAgentSession(opts) {
       ...opts.auth ? { auth: opts.auth } : {}
     });
     remoteSessionId = remoteDesc.id;
+    if (omitCwd && remoteDesc.cwd) resolvedCwd = remoteDesc.cwd;
   } catch (err) {
     await host.stop().catch(() => void 0);
     recordSandboxState(host.sandboxId, "stopped");
@@ -10259,7 +10583,7 @@ async function bootSandboxAgentSession(opts) {
     }),
     commandPreview: `sandbox:${providerSlug} \u2192 ${opts.adapter}`,
     sandboxId: host.sandboxId,
-    cwd: boxCwd,
+    cwd: resolvedCwd,
     provider: providerSlug,
     sandboxTeardown: lifecyclePolicy.teardown,
     ...host.ports && Object.keys(host.ports).length > 0 ? { sandboxPorts: host.ports } : {},
@@ -10312,10 +10636,10 @@ function markFailedBootLedger(opts) {
   }
 }
 async function resolveSandboxSecret(slug) {
-  const { resolveSandboxSecret: resolve37 } = getMcpCredentialDeps();
-  if (!resolve37) return null;
+  const { resolveSandboxSecret: resolve38 } = getMcpCredentialDeps();
+  if (!resolve38) return null;
   try {
-    return await resolve37(slug);
+    return await resolve38(slug);
   } catch (err) {
     console.warn(
       `[agent_start] sandbox secret resolution failed for "${slug}": ${err instanceof Error ? err.message : String(err)}`
@@ -10348,6 +10672,7 @@ var init_session_spawn = __esm({
     init_catalog_models();
     init_context_continuity();
     init_canonical_posture();
+    init_user_presets();
     init_harness_preset_store();
     init_browser_mount();
     init_role();
@@ -10356,6 +10681,7 @@ var init_session_spawn = __esm({
     init_agents_md();
     init_workspace_rules();
     init_session_title();
+    init_inference_binding();
     init_mcp_credential_deps();
     init_sandbox_agent_session_proxy();
     init_sandbox_ledger();
@@ -10538,6 +10864,16 @@ var init_agent_start_schema = __esm({
       route: jsonTolerant(
         z.object({ gateway: z.string().min(1), baseUrl: z.string().url().optional() })
       ).optional().describe("Billing route/gateway. Independent of `model` and `access`."),
+      inference: jsonTolerant(
+        z.object({
+          endpoint: z.string().min(1).optional().describe('A registered local/LAN inference endpoint id (`agentproto llm endpoints list`), or "<id>@<device>" for a paired device\'s own shared endpoint.'),
+          model: z.string().min(1).optional().describe('A bare model id (paired with `endpoint`), or the shorthand "<model>@<device|endpoint>" when `endpoint` is omitted.'),
+          force: mcpBool.optional().describe("Skip the fit-check refusal on a clear miss (the check still runs and still warns)."),
+          headroomPct: z.number().min(0).max(95).optional().describe("Headroom percentage held back from the endpoint's loaded ctx for the fit check. Default 25.")
+        })
+      ).optional().describe(
+        `Bind this spawn to a local/LAN inference endpoint instead of a cloud model: \`{endpoint}\`, \`{endpoint, model}\`, or the shorthand \`{model: "<model>@<device|endpoint>"}\`. Runs a fit check (the harness's known first-request size vs the endpoint's loaded ctx) BEFORE spawning and refuses with an actionable error on a clear miss (\`force\` overrides). Defaults \`adapter\`/\`harness\` to "pi" when neither is set. Mutually exclusive with \`model\`/\`route\`/\`access\` \u2014 set those directly instead of \`inference\`, never both. ${help("inference")}`
+      ),
       access: jsonTolerant(z.object({ profileRef: z.string().min(1).optional() })).optional().describe("Named auth profile to bill at initial spawn; resolved from the local keychain."),
       posture: z.string().optional().describe("Canonical agent posture (plan, bypass, accept-edits, read-only) or native harness mode."),
       contextProfile: z.string().optional().describe("Context intake profile (for example full or lean)."),
@@ -10676,83 +11012,6 @@ var init_agent_start_schema = __esm({
     detachedAgentStartSchema = agentStartInputSchema.omit({ wait: true });
   }
 });
-function emptyFile4() {
-  return { version: 1, presets: [] };
-}
-function userPresetsPath() {
-  return resolve(homedir(), ".agentproto", "presets.json");
-}
-async function loadUserPresets() {
-  try {
-    return userPresetsFileSchema.parse(JSON.parse(await readFile(userPresetsPath(), "utf8")));
-  } catch {
-    return emptyFile4();
-  }
-}
-async function writeUserPresets(file) {
-  const dir = join(homedir(), ".agentproto");
-  await mkdir(dir, { recursive: true });
-  await writeFile(userPresetsPath(), JSON.stringify(file, null, 2) + "\n", {
-    encoding: "utf8",
-    mode: 384
-  });
-}
-async function listUserPresets() {
-  return (await loadUserPresets()).presets;
-}
-async function getUserPreset(id) {
-  return (await loadUserPresets()).presets.find((preset) => preset.id === id);
-}
-async function saveUserPreset(preset) {
-  const validated = userPresetSchema.parse(preset);
-  const file = await loadUserPresets();
-  const index = file.presets.findIndex((existing) => existing.id === validated.id);
-  if (index === -1) file.presets.push(validated);
-  else file.presets[index] = validated;
-  await writeUserPresets(file);
-}
-async function deleteUserPreset(id) {
-  const file = await loadUserPresets();
-  const index = file.presets.findIndex((preset) => preset.id === id);
-  if (index === -1) return false;
-  file.presets.splice(index, 1);
-  await writeUserPresets(file);
-  return true;
-}
-var effortSchema, postureSchema, routeSchema, userPresetSchema, userPresetsFileSchema;
-var init_user_presets = __esm({
-  "src/user-presets.ts"() {
-    effortSchema = z.enum(["low", "medium", "high", "xhigh", "max", "ultracode"]);
-    postureSchema = z.union([
-      z.enum(["default", "plan", "accept-edits", "bypass", "read-only"]),
-      z.object({ harnessModeId: z.string().min(1) })
-    ]);
-    routeSchema = z.object({
-      gateway: z.string().min(1),
-      baseUrl: z.string().url().optional()
-    });
-    userPresetSchema = z.object({
-      id: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
-      label: z.string().min(1),
-      adapter: z.string().min(1).optional(),
-      harness: z.string().min(1).optional(),
-      model: z.string().min(1).optional(),
-      route: routeSchema.optional(),
-      access: z.object({ profileRef: z.string().min(1).optional() }).optional(),
-      posture: postureSchema.optional(),
-      effort: effortSchema.optional(),
-      contextProfile: z.string().min(1).optional(),
-      cwd: z.string().min(1).optional(),
-      skills: z.array(z.string().min(1)).optional(),
-      bundles: z.array(z.string().min(1)).optional(),
-      browser: z.union([z.literal("headless"), z.literal(false)]).optional()
-    });
-    userPresetsFileSchema = z.object({
-      version: z.literal(1),
-      presets: z.array(userPresetSchema)
-    });
-  }
-});
 function labelOf(model) {
   switch (model.kind) {
     case "image":
@@ -10893,8 +11152,8 @@ async function newestSourceMtime(cwd, patterns) {
 function appUiBuildLogPath(appDir) {
   return join(appDir, ".agentproto", "ui-build.log");
 }
-function tailLines(text12, n) {
-  const lines = text12.split("\n");
+function tailLines(text13, n) {
+  const lines = text13.split("\n");
   return lines.slice(-n).join("\n");
 }
 async function warnIfNotSingleFile(uiPath) {
@@ -10992,8 +11251,8 @@ async function ensureAppUiBuilt(input) {
 }
 async function readLogTailSafe(dir, n) {
   try {
-    const text12 = await readFile(appUiBuildLogPath(dir), "utf8");
-    const lines = text12.split("\n").filter((line) => line.length > 0);
+    const text13 = await readFile(appUiBuildLogPath(dir), "utf8");
+    const lines = text13.split("\n").filter((line) => line.length > 0);
     const tail = lines.slice(-n).join("\n");
     return tail.length > 0 ? tail : void 0;
   } catch {
@@ -11003,8 +11262,8 @@ async function readLogTailSafe(dir, n) {
 async function resolveAppUiBuildState(input) {
   const { dir, uiPath } = input;
   const pending = peekInFlightBuild(uiPath) ?? ensureAppUiBuilt(input);
-  const timeout = new Promise((resolve37) => {
-    const timer = setTimeout(() => resolve37(RESOLVE_TIMEOUT), RESOLVE_FAST_PATH_MS);
+  const timeout = new Promise((resolve38) => {
+    const timer = setTimeout(() => resolve38(RESOLVE_TIMEOUT), RESOLVE_FAST_PATH_MS);
     timer.unref();
   });
   const raced = await Promise.race([pending, timeout]);
@@ -11039,8 +11298,8 @@ var init_app_ui_build = __esm({
 });
 
 // src/app-ui-placeholder.ts
-function escapeHtml(text12) {
-  return text12.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function escapeHtml(text13) {
+  return text13.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 function pageShell(opts) {
   return `<!DOCTYPE html>
@@ -11513,11 +11772,11 @@ function sanitizeLabel(label) {
 function attr(value) {
   return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function escapeMessageBody(text12) {
-  return text12.replace(BODY_SENTINEL_RE, (_m, slash, name) => `&lt;${slash}${name}`);
+function escapeMessageBody(text13) {
+  return text13.replace(BODY_SENTINEL_RE, (_m, slash, name) => `&lt;${slash}${name}`);
 }
-function escapeHumanPrompt(text12) {
-  return text12.replace(HUMAN_SENTINEL_RE, (_m, lead, rest) => `${lead}&lt;${rest}`);
+function escapeHumanPrompt(text13) {
+  return text13.replace(HUMAN_SENTINEL_RE, (_m, lead, rest) => `${lead}&lt;${rest}`);
 }
 function renderSessionMessage(msg) {
   const attrs = [`id="${attr(msg.id)}"`, `from="${msg.from.relation}"`];
@@ -11772,8 +12031,8 @@ var init_message_tools = __esm({
     ok = (body) => ({
       content: [{ type: "text", text: JSON.stringify({ ok: true, ...body }) }]
     });
-    fail = (code, text12) => ({
-      content: [{ type: "text", text: JSON.stringify({ ok: false, error: code, message: text12 }) }],
+    fail = (code, text13) => ({
+      content: [{ type: "text", text: JSON.stringify({ ok: false, error: code, message: text13 }) }],
       isError: true
     });
     kindField = z.enum(MESSAGE_KINDS);
@@ -11879,7 +12138,7 @@ function registerAgentTools(server, opts) {
           isError: true
         };
       }
-      const adapter = input.adapter ?? input.harness ?? preset?.adapter ?? preset?.harness;
+      const adapter = input.adapter ?? input.harness ?? preset?.adapter ?? preset?.harness ?? (input.inference ? "pi" : void 0);
       if (!adapter) {
         return {
           content: [{ type: "text", text: "agent_start: adapter is required unless the selected preset provides one." }],
@@ -11950,13 +12209,13 @@ function registerAgentTools(server, opts) {
           content: [{ type: "text", text: JSON.stringify(body) }]
         };
       }
-      const text12 = result.code === "orchestrator_max_depth_exceeded" || result.code === "orchestrator_child_quota_exceeded" || result.code === "role_spawn_denied" ? JSON.stringify(
+      const text13 = result.code === "orchestrator_max_depth_exceeded" || result.code === "orchestrator_child_quota_exceeded" || result.code === "role_spawn_denied" ? JSON.stringify(
         { error: result.code, message: result.message, ...result.details },
         null,
         2
       ) : result.message;
       return {
-        content: [{ type: "text", text: text12 }],
+        content: [{ type: "text", text: text13 }],
         isError: true
       };
     }
@@ -12050,8 +12309,8 @@ function registerAgentTools(server, opts) {
       )
     },
     async (input) => {
-      const fail3 = (text12) => ({
-        content: [{ type: "text", text: text12 }],
+      const fail3 = (text13) => ({
+        content: [{ type: "text", text: text13 }],
         isError: true
       });
       const selfId = callerScope?.ownerSessionId ?? callerSessionId;
@@ -12812,15 +13071,15 @@ function resolveGroup(input) {
   }
   return group;
 }
-function truncateForContext(text12) {
-  return text12.length > GATE_OUTPUT_CONTEXT_CHARS ? `\u2026(truncated)\u2026
-${text12.slice(-GATE_OUTPUT_CONTEXT_CHARS)}` : text12;
+function truncateForContext(text13) {
+  return text13.length > GATE_OUTPUT_CONTEXT_CHARS ? `\u2026(truncated)\u2026
+${text13.slice(-GATE_OUTPUT_CONTEXT_CHARS)}` : text13;
 }
-function parseVerdict(text12) {
+function parseVerdict(text13) {
   const re = /VERDICT:\s*(PASS|FAIL)/gi;
   let last = null;
   let m;
-  while ((m = re.exec(text12)) !== null) {
+  while ((m = re.exec(text13)) !== null) {
     last = m[1].toUpperCase();
   }
   return last;
@@ -12828,15 +13087,15 @@ function parseVerdict(text12) {
 function coerceSeverity(v) {
   return typeof v === "string" && KNOWN_SEVERITIES.has(v) ? v : "medium";
 }
-function parseJsonVerdict(text12) {
+function parseJsonVerdict(text13) {
   const candidates = [];
   const fenceRe = /```json\s*([\s\S]*?)```/gi;
   let fm;
-  while ((fm = fenceRe.exec(text12)) !== null) candidates.push(fm[1]);
+  while ((fm = fenceRe.exec(text13)) !== null) candidates.push(fm[1]);
   if (candidates.length === 0) {
     const bareRe = /\{[^{}]*"decision"[^{}]*\}/gi;
     let bm;
-    while ((bm = bareRe.exec(text12)) !== null) candidates.push(bm[0]);
+    while ((bm = bareRe.exec(text13)) !== null) candidates.push(bm[0]);
   }
   for (let i = candidates.length - 1; i >= 0; i--) {
     let parsed;
@@ -14237,8 +14496,8 @@ function createTerminalTranscriptWriter(opts) {
       const stream = streams.get(sessionId);
       if (!stream) return Promise.resolve();
       streams.delete(sessionId);
-      return new Promise((resolve37) => {
-        stream.end(() => resolve37());
+      return new Promise((resolve38) => {
+        stream.end(() => resolve38());
       });
     },
     closeAll() {
@@ -14247,8 +14506,8 @@ function createTerminalTranscriptWriter(opts) {
         const stream = streams.get(sessionId);
         if (!stream) continue;
         closings.push(
-          new Promise((resolve37) => {
-            stream.end(() => resolve37());
+          new Promise((resolve38) => {
+            stream.end(() => resolve38());
           })
         );
       }
@@ -14316,10 +14575,10 @@ var init_context_window = __esm({
   "src/context-window.ts"() {
   }
 });
-function truncSection(text12) {
-  if (text12.length <= SECTION_CHAR_CAP) return text12;
-  return `${text12.slice(0, SECTION_CHAR_CAP)}
-\u2026 [${text12.length - SECTION_CHAR_CAP} chars truncated]`;
+function truncSection(text13) {
+  if (text13.length <= SECTION_CHAR_CAP) return text13;
+  return `${text13.slice(0, SECTION_CHAR_CAP)}
+\u2026 [${text13.length - SECTION_CHAR_CAP} chars truncated]`;
 }
 function approxMessageLen2(m) {
   const toolLen = m.toolCalls?.reduce(
@@ -14356,14 +14615,14 @@ async function buildRecentDigest(sessionId) {
 }
 async function captureGitStatus(cwd) {
   if (!cwd) return void 0;
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     execFile("git", ["status", "--porcelain"], { cwd }, (err, stdout) => {
       if (err) {
-        resolve37(void 0);
+        resolve38(void 0);
         return;
       }
       const trimmed = stdout.trim();
-      resolve37(trimmed || "(working tree clean)");
+      resolve38(trimmed || "(working tree clean)");
     });
   });
 }
@@ -14594,9 +14853,9 @@ var init_session_continue_fresh = __esm({
     init_session_spawn();
   }
 });
-function trimOutcomeText(text12, max, keep) {
-  if (!text12) return void 0;
-  const flat = text12.replace(/\s+/g, " ").trim();
+function trimOutcomeText(text13, max, keep) {
+  if (!text13) return void 0;
+  const flat = text13.replace(/\s+/g, " ").trim();
   if (!flat) return void 0;
   if (flat.length <= max) return flat;
   return keep === "tail" ? `\u2026${flat.slice(flat.length - (max - 1))}` : `${flat.slice(0, max - 1)}\u2026`;
@@ -14813,17 +15072,17 @@ function adapterConfigDirFor(sessionId) {
   return resolve(homedir(), ".agentproto", "adapter-config", sessionId);
 }
 function previewPrompt(message, maxLength = 80) {
-  let text12;
+  let text13;
   if (typeof message === "string") {
-    text12 = message;
+    text13 = message;
   } else if (Array.isArray(message)) {
-    text12 = message.map((block) => textOfContentBlock(block)).filter(Boolean).join("\n");
+    text13 = message.map((block) => textOfContentBlock(block)).filter(Boolean).join("\n");
   } else if (message !== null && typeof message === "object") {
-    text12 = textOfContentBlock(message);
+    text13 = textOfContentBlock(message);
   } else {
-    text12 = "";
+    text13 = "";
   }
-  const single = text12.replace(/\s+/g, " ").trim();
+  const single = text13.replace(/\s+/g, " ").trim();
   if (!single) return "[non-text content]";
   return single.length > maxLength ? `${single.slice(0, maxLength - 1)}\u2026` : single;
 }
@@ -14948,18 +15207,18 @@ function isStrictPrefixOf(candidate, full) {
   return candidate.length > 0 && candidate.length < full.length && full.startsWith(candidate);
 }
 function scanBracketedPaste(state, chunk) {
-  const text12 = state.carry + chunk.toString("latin1");
+  const text13 = state.carry + chunk.toString("latin1");
   let mode = state.mode;
   let matchEnd = 0;
   let i = 0;
-  while (i < text12.length) {
-    if (text12.startsWith(BRACKETED_PASTE_ON, i)) {
+  while (i < text13.length) {
+    if (text13.startsWith(BRACKETED_PASTE_ON, i)) {
       mode = "on";
       i += BRACKETED_PASTE_ON.length;
       matchEnd = i;
       continue;
     }
-    if (text12.startsWith(BRACKETED_PASTE_OFF, i)) {
+    if (text13.startsWith(BRACKETED_PASTE_OFF, i)) {
       mode = "off";
       i += BRACKETED_PASTE_OFF.length;
       matchEnd = i;
@@ -14967,7 +15226,7 @@ function scanBracketedPaste(state, chunk) {
     }
     i++;
   }
-  const tail = text12.slice(matchEnd);
+  const tail = text13.slice(matchEnd);
   const escIdx = tail.lastIndexOf("\x1B");
   let carry = "";
   if (escIdx !== -1) {
@@ -14978,15 +15237,15 @@ function scanBracketedPaste(state, chunk) {
   }
   return { mode, carry };
 }
-function shouldWrapBracketedPaste(mode, text12) {
-  return mode === "on" && text12.includes("\n");
+function shouldWrapBracketedPaste(mode, text13) {
+  return mode === "on" && text13.includes("\n");
 }
-function wrapBracketedPaste(text12) {
-  return `\x1B[200~${text12}\x1B[201~`;
+function wrapBracketedPaste(text13) {
+  return `\x1B[200~${text13}\x1B[201~`;
 }
-function applyBracketedPasteWrap(registry, sessionId, text12) {
+function applyBracketedPasteWrap(registry, sessionId, text13) {
   const mode = registry.getBracketedPasteMode(sessionId);
-  return shouldWrapBracketedPaste(mode, text12) ? wrapBracketedPaste(text12) : text12;
+  return shouldWrapBracketedPaste(mode, text13) ? wrapBracketedPaste(text13) : text13;
 }
 function markHeldId(map, slug, id) {
   let set = map.get(slug);
@@ -15087,8 +15346,8 @@ function stripAnsiCodes(s) {
 }
 function terminalOutputTail(rt, maxChars = 500) {
   if (rt.recentBytes.length === 0) return "";
-  const text12 = Buffer.concat(rt.recentBytes, rt.recentBytesSize).toString("utf8");
-  const plain = stripAnsiCodes(text12).replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "").replace(/\x1b[()][A-Za-z0-9]/g, "").replace(/\x1b[0-9A-Za-z=>]/g, "").replace(/[\x00-\x09\x0b-\x1f]/g, "").trim();
+  const text13 = Buffer.concat(rt.recentBytes, rt.recentBytesSize).toString("utf8");
+  const plain = stripAnsiCodes(text13).replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "").replace(/\x1b[()][A-Za-z0-9]/g, "").replace(/\x1b[0-9A-Za-z=>]/g, "").replace(/[\x00-\x09\x0b-\x1f]/g, "").trim();
   if (!plain) return "";
   return plain.length > maxChars ? plain.slice(-maxChars) : plain;
 }
@@ -15342,13 +15601,13 @@ function createSessionsRegistry(opts) {
     if (!id) return;
     const options = normalizePermissionOptions(evt.options);
     const toolName = evt.toolName;
-    const text12 = evt.text ?? (toolName ? `Allow "${toolName}"?` : "The agent is requesting permission.");
+    const text13 = evt.text ?? (toolName ? `Allow "${toolName}"?` : "The agent is requesting permission.");
     const pending = {
       id,
       sessionId: rt.desc.id,
       toolCallId: id,
       ...toolName ? { toolName } : {},
-      text: text12,
+      text: text13,
       options,
       requestedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...evt.rawInput !== void 0 ? { rawInput: evt.rawInput } : {},
@@ -15363,7 +15622,7 @@ function createSessionsRegistry(opts) {
         sessionId: rt.desc.id,
         permissionId: id,
         ...toolName ? { toolName } : {},
-        text: text12,
+        text: text13,
         ...rt.desc.label ? { label: rt.desc.label } : {},
         ts: pending.requestedAt
       });
@@ -15688,8 +15947,8 @@ function createSessionsRegistry(opts) {
     }
   };
   const sniffConversationTerminalChunk = (rt, chunk) => {
-    const text12 = (rt.sniffCarry ?? "") + chunk.toString("utf8");
-    const lines = text12.split(/\r?\n|\r/);
+    const text13 = (rt.sniffCarry ?? "") + chunk.toString("utf8");
+    const lines = text13.split(/\r?\n|\r/);
     rt.sniffCarry = (lines.pop() ?? "").slice(-4096);
     for (const line of lines) {
       if (line) sniffResumeHints(rt, line);
@@ -15764,8 +16023,8 @@ function createSessionsRegistry(opts) {
         rt.activeToolCalls?.clear();
         if (evt.text) {
           const prior = rt.lastAssistantTextSealed ? "" : rt.lastAssistantText ?? "";
-          const text12 = prior + evt.text;
-          rt.lastAssistantText = text12.length > LAST_ASSISTANT_TEXT_CAP ? text12.slice(text12.length - LAST_ASSISTANT_TEXT_CAP) : text12;
+          const text13 = prior + evt.text;
+          rt.lastAssistantText = text13.length > LAST_ASSISTANT_TEXT_CAP ? text13.slice(text13.length - LAST_ASSISTANT_TEXT_CAP) : text13;
           rt.lastAssistantTextSealed = false;
           const combined = rt.textBuf + evt.text;
           const lines = combined.split(/\r?\n/);
@@ -16006,11 +16265,11 @@ function createSessionsRegistry(opts) {
   };
   const waitForTurnSettled = (rt, id, caller) => {
     if (!rt.busy) return Promise.resolve();
-    return new Promise((resolve37, reject) => {
+    return new Promise((resolve38, reject) => {
       const onBusy = (busy) => {
         if (busy) return;
         cleanup();
-        resolve37();
+        resolve38();
       };
       const cleanup = () => {
         clearTimeout(timer);
@@ -16472,8 +16731,15 @@ function createSessionsRegistry(opts) {
     }
     setInbox(rt, next);
   };
+  const rememberReceived = (rt, msgs) => {
+    if (!msgs.length) return;
+    const ids = new Set(msgs.map((m) => m.id));
+    const next = [...(rt.recentlyReceived ?? []).filter((m) => !ids.has(m.id)), ...msgs];
+    rt.recentlyReceived = next.length > INBOX_CAP ? next.slice(-INBOX_CAP) : next;
+  };
   const removeFromInbox = (rt, ids) => {
     if (!rt.desc.inbox?.some((m) => ids.has(m.id))) return;
+    rememberReceived(rt, rt.desc.inbox.filter((m) => ids.has(m.id)));
     setInbox(rt, rt.desc.inbox.filter((m) => !ids.has(m.id)));
   };
   const dropQueuedEnvelopes = (rt, ids) => {
@@ -16529,6 +16795,7 @@ ${content}`;
     }
     recordSent(stamped);
     transcriptWriter.recordSessionMessage?.(rt.desc.id, stamped);
+    rememberReceived(rt, [stamped]);
     emitSessionMessage(stamped);
     appendLine(rt, `[message] ${stamped.id} from ${stamped.from.relation} steered into the running turn`, "stdout");
     return true;
@@ -17174,8 +17441,8 @@ ${message}`;
   };
   const wireOutputStreams = (rt) => {
     const onChunk = (stream) => (chunk) => {
-      const text12 = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      for (const line of text12.split(/\r?\n/)) {
+      const text13 = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      for (const line of text13.split(/\r?\n/)) {
         if (line.length > 0) appendLine(rt, line, stream);
       }
     };
@@ -18080,6 +18347,8 @@ ${message}`;
       if (!rt) return void 0;
       const inInbox = rt.desc.inbox?.find((m) => m.id === messageId);
       if (inInbox) return inInbox;
+      const recent = rt.recentlyReceived?.find((m) => m.id === messageId);
+      if (recent) return recent;
       let raw;
       try {
         raw = readFileSync(sessionEventsPath(id, transcriptBaseDir), "utf8");
@@ -18769,11 +19038,11 @@ ${message}`;
       transcriptWriter.recordEvent(rt.desc.id, { kind: "notice", text: message });
       return true;
     },
-    recordNotice(id, text12) {
+    recordNotice(id, text13) {
       const rt = sessions.get(id);
       if (!rt || rt.desc.kind !== "agent-cli") return false;
-      appendLine(rt, text12, "stdout");
-      transcriptWriter.recordEvent(rt.desc.id, { kind: "notice", text: text12 });
+      appendLine(rt, text13, "stdout");
+      transcriptWriter.recordEvent(rt.desc.id, { kind: "notice", text: text13 });
       return true;
     },
     archiveSession(id) {
@@ -19293,14 +19562,14 @@ var init_pr_provenance_stamp = __esm({
     init_pr_provenance();
     defaultGhRunner = async (args, cwd) => {
       const { spawn: spawn8 } = await import('child_process');
-      return await new Promise((resolve37) => {
+      return await new Promise((resolve38) => {
         let stdout = "";
         const child = spawn8("gh", [...args], { cwd, shell: false });
         child.stdout?.on("data", (d) => {
           stdout += d.toString("utf8");
         });
-        child.on("error", () => resolve37({ exitCode: 1, stdout }));
-        child.on("close", (code) => resolve37({ exitCode: code ?? 1, stdout }));
+        child.on("error", () => resolve38({ exitCode: 1, stdout }));
+        child.on("close", (code) => resolve38({ exitCode: code ?? 1, stdout }));
       });
     };
   }
@@ -19610,7 +19879,7 @@ function registerCommandTools(server, opts) {
     }
   );
   const RESULT_PREVIEW_CHARS = 500;
-  const previewResultText = (text12) => text12.length > RESULT_PREVIEW_CHARS ? `${text12.slice(0, RESULT_PREVIEW_CHARS)}\u2026` : text12;
+  const previewResultText = (text13) => text13.length > RESULT_PREVIEW_CHARS ? `${text13.slice(0, RESULT_PREVIEW_CHARS)}\u2026` : text13;
   const shapeToolCallRecords = (records, fields, full) => records.map((record2) => {
     let entries = Object.entries(record2);
     if (fields !== void 0) {
@@ -19736,12 +20005,12 @@ async function runCommand(input) {
         return buf;
       }
       const room = STREAM_BUFFER_CAP - buf.length;
-      const text12 = chunk.toString("utf8");
-      if (text12.length > room) {
+      const text13 = chunk.toString("utf8");
+      if (text13.length > room) {
         truncated = true;
-        return buf + text12.slice(0, room);
+        return buf + text13.slice(0, room);
       }
-      return buf + text12;
+      return buf + text13;
     }
     child.stdout?.on("data", (d) => {
       stdout = appendCapped(stdout, d);
@@ -20314,8 +20583,8 @@ async function ownerRepoOfReviewWorktree(path) {
 // src/session-tools.ts
 init_sessions();
 init_agent_tools();
-function parseCodexMcpServers(text12) {
-  const root = parseToml(text12);
+function parseCodexMcpServers(text13) {
+  const root = parseToml(text13);
   const servers = root.mcp_servers;
   if (!isTable(servers)) return {};
   const out = {};
@@ -20344,14 +20613,14 @@ function parseCodexMcpServers(text12) {
   return out;
 }
 async function readCodexMcpServers(path) {
-  let text12;
+  let text13;
   try {
-    text12 = await promises.readFile(path, "utf8");
+    text13 = await promises.readFile(path, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw err;
   }
-  return parseCodexMcpServers(text12);
+  return parseCodexMcpServers(text13);
 }
 function isTable(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -20364,8 +20633,8 @@ function stringTable(t) {
   }
   return out;
 }
-function parseToml(text12) {
-  return new TomlParser(text12).parse();
+function parseToml(text13) {
+  return new TomlParser(text13).parse();
 }
 var TomlParser = class {
   constructor(src) {
@@ -21435,10 +21704,10 @@ function sandboxAuthForBox(auth) {
   };
 }
 async function resolveSandboxSecretFromBroker(slug) {
-  const { resolveSandboxSecret: resolve37 } = getMcpCredentialDeps();
-  if (!resolve37) return null;
+  const { resolveSandboxSecret: resolve38 } = getMcpCredentialDeps();
+  if (!resolve38) return null;
   try {
-    return await resolve37(slug);
+    return await resolve38(slug);
   } catch (err) {
     console.warn(
       `[restartAgentSession] sandbox secret resolution failed for "${slug}": ${err instanceof Error ? err.message : String(err)}`
@@ -21931,7 +22200,7 @@ async function runContinueOnBootPass(opts) {
 
 // src/session-tools.ts
 init_session_outcome();
-var defaultPsExecutor = () => new Promise((resolve37, reject) => {
+var defaultPsExecutor = () => new Promise((resolve38, reject) => {
   if (process.platform === "win32") {
     reject(new Error("processTreeRss: ps is not available on win32"));
     return;
@@ -21942,7 +22211,7 @@ var defaultPsExecutor = () => new Promise((resolve37, reject) => {
     { maxBuffer: 16 * 1024 * 1024 },
     (err, stdout) => {
       if (err) reject(err);
-      else resolve37(stdout);
+      else resolve38(stdout);
     }
   );
 });
@@ -26357,8 +26626,8 @@ var okResult = (r) => ({
   content: [{ type: "text", text: JSON.stringify(r) }],
   structuredContent: r
 });
-var errResult = (text12) => ({
-  content: [{ type: "text", text: text12 }],
+var errResult = (text13) => ({
+  content: [{ type: "text", text: text13 }],
   isError: true
 });
 function registerBrowserTools(server, opts) {
@@ -27827,6 +28096,59 @@ function registerHarnessPresetTools(server, deps2 = {}) {
     }
   );
 }
+
+// src/user-preset-tools.ts
+init_user_presets();
+function text6(value) {
+  return { content: [{ type: "text", text: JSON.stringify(value) }] };
+}
+function errorText5(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function registerUserPresetTools(server, deps2 = {}) {
+  const { registry } = deps2;
+  server.tool(
+    "user_preset_list",
+    'List the user\'s saved spawn presets ("favorites") from `~/.agentproto/presets.json`. Each preset is a reusable, named subset of the spawn/session config axes (adapter, model, route, access, posture, effort, contextProfile, cwd, skills, bundles, browser) plus `lastUsedAt` (ISO 8601), stamped the last time a spawn resolved a `presetId` to it. Pass `includeRecent: true` to ALSO return up to 5 distinct recent spawn configurations (adapter, model, profileRef, cwd) derived from this host\'s own recent session history, each marked `recent: true` \u2014 not persisted, a candidate list for "save as favorite" rather than an actual preset.',
+    {
+      includeRecent: z.boolean().optional().describe("Also return up to 5 recent distinct spawn configs derived from session history.")
+    },
+    async ({ includeRecent }) => {
+      const presets = await listUserPresets();
+      const recent = includeRecent ? deriveRecentSpawnConfigs(registry?.list() ?? []) : void 0;
+      return text6({ presets, ...recent ? { recent } : {} });
+    }
+  );
+  server.tool(
+    "user_preset_save",
+    'Create or update (upsert by id) a user spawn preset ("favorite"). `id` must be lowercase kebab-case. Every other field is an optional spawn/session config axis a future `agent_start({ presetId })` (or `/sessions/agent`, `/sessions/chat`) resolves and applies at lower precedence than the caller\'s own explicit fields. Editing an existing preset without naming `lastUsedAt` preserves its current stamp rather than clearing it.',
+    userPresetSchema.shape,
+    async (input) => {
+      try {
+        await saveUserPreset(input);
+        const saved = await getUserPreset(input.id);
+        return text6({ preset: saved });
+      } catch (err) {
+        return errorText5(`user_preset_save failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  );
+  server.tool(
+    "user_preset_delete",
+    "Delete a user spawn preset by id. Idempotent: a missing id returns `{ deleted: false }`.",
+    {
+      id: z.string().describe("The preset id to delete.")
+    },
+    async ({ id }) => {
+      try {
+        const deleted = await deleteUserPreset(id);
+        return text6({ deleted });
+      } catch (err) {
+        return errorText5(`user_preset_delete failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  );
+}
 var webSearchInputSchema = z.object({
   query: z.string().min(1).describe("The web search query."),
   count: z.number().int().min(1).max(20).optional().default(10).describe("Number of results to return (1\u201320, default 10)."),
@@ -28171,10 +28493,15 @@ var PANEL_APP_HANDLES = [
   workBoardApp,
   reviewPanelApp
 ];
-function resolveBuiltinPanelUi(appId, httpBaseUrl) {
+var DEEP_LINK_SESSION_ID_RE = /^sess_[A-Za-z0-9_-]+$/;
+function isValidDeepLinkSessionId(id) {
+  return DEEP_LINK_SESSION_ID_RE.test(id);
+}
+function resolveBuiltinPanelUi(appId, httpBaseUrl, sessionId) {
   if (appId === liveSessionApp.id) {
+    const pinnedSessionId = sessionId && isValidDeepLinkSessionId(sessionId) ? sessionId : void 0;
     const app = makeLiveSessionApp({ httpBaseUrl });
-    const html = typeof app.html === "function" ? app.html({ httpBaseUrl }) : app.html;
+    const html = typeof app.html === "function" ? app.html({ httpBaseUrl, sessionId: pinnedSessionId }) : app.html;
     return { html, tools: liveSessionApp.ui?.tools ?? [] };
   }
   const handle = [sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp, reviewPanelApp].find(
@@ -28885,8 +29212,8 @@ function expandTemplate(template, when) {
   const date = when.toISOString().slice(0, 10);
   return template.replace(/\{date\}/g, date);
 }
-function preview(text12, max = 120) {
-  const flat = text12.replace(/\s+/g, " ").trim();
+function preview(text13, max = 120) {
+  const flat = text13.replace(/\s+/g, " ").trim();
   return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
 }
 
@@ -29386,6 +29713,392 @@ function registerSentinelTools(server, opts) {
     }
   );
 }
+var HOSTS_VERSION = 1;
+var DIAL_TIMEOUT_MS = 15e3;
+var HANDSHAKE_TIMEOUT_MS = 15e3;
+var DEFAULT_JOINED_HOST_TTL_MS = 7 * 864e5;
+var MAX_CACHED_SESSION_PATHS_PER_HOST = 32;
+var MAX_CACHED_SESSION_BODY_BYTES = 256 * 1024;
+function defaultHostsPath() {
+  return join(homedir(), ".agentproto", "hosts.json");
+}
+function isSessionsPath(path) {
+  return path === "/sessions" || path.startsWith("/sessions/") || path.startsWith("/sessions?");
+}
+function rvUrl(base, route) {
+  const sep6 = base.includes("?") ? "&" : "?";
+  return `${base}${sep6}side=client&t=${encodeURIComponent(route)}`;
+}
+function defaultSelfName() {
+  try {
+    return hostname() || "agentproto-host-registry";
+  } catch {
+    return "agentproto-host-registry";
+  }
+}
+function createHostRegistry(deps2) {
+  const hostsPath = deps2.hostsPath ?? defaultHostsPath();
+  const now = deps2.now ?? Date.now;
+  const log = deps2.log ?? (() => {
+  });
+  const dialTimeoutMs = deps2.dialTimeoutMs ?? DIAL_TIMEOUT_MS;
+  const handshakeTimeoutMs = deps2.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+  const joinedHostTtlMs = deps2.joinedHostTtlMs ?? DEFAULT_JOINED_HOST_TTL_MS;
+  const selfName = defaultSelfName();
+  const hosts = /* @__PURE__ */ new Map();
+  const onlineCounts = /* @__PURE__ */ new Map();
+  const sessionsCache = /* @__PURE__ */ new Map();
+  let loaded = false;
+  async function ensureLoaded() {
+    if (loaded) return;
+    loaded = true;
+    try {
+      const raw = await readFile(hostsPath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (isHostsFile(parsed)) {
+        for (const rec of parsed.hosts) hosts.set(rec.fingerprint, rec);
+      } else {
+        log(`[hosts] ignoring ${hostsPath}: unrecognised format`);
+      }
+    } catch (err) {
+      if (!isEnoent(err)) log(`[hosts] could not read ${hostsPath}: ${errMsg(err)}`);
+    }
+  }
+  let persistChain = Promise.resolve();
+  function persist() {
+    const run = persistChain.then(doPersist);
+    persistChain = run.catch(() => {
+    });
+    return run;
+  }
+  async function doPersist() {
+    const file = { v: HOSTS_VERSION, hosts: Array.from(hosts.values()) };
+    const dir = dirname(hostsPath);
+    await mkdir(dir, { recursive: true });
+    const tmp = join(dir, `.${basename(hostsPath)}.tmp-${process.pid}`);
+    await writeFile(tmp, JSON.stringify(file, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+    await chmod(tmp, 384).catch(() => {
+    });
+    await rename(tmp, hostsPath);
+  }
+  function findHost(idOrName) {
+    const byFp = hosts.get(idOrName);
+    if (byFp) return byFp;
+    for (const rec of hosts.values()) if (rec.name === idOrName) return rec;
+    return void 0;
+  }
+  async function dialWithTimeout(wsUrl) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(new Error(`dial timed out after ${dialTimeoutMs}ms`)), dialTimeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    try {
+      return await deps2.dial(wsUrl, ac.signal);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function add(offerUrl, name, meta) {
+    await ensureLoaded();
+    const offer = await parseOfferUrl(offerUrl, { now: now() });
+    if (offer.scope !== "host") {
+      throw new Error(
+        "this offer is not host-scoped \u2014 it only grants remote-control access, not host registration; ask the other machine to run `agentproto pair offer --host` and use that offer instead"
+      );
+    }
+    const { route, auth } = await deriveOfferTokens(offer.secret);
+    const raw = await dialWithTimeout(rvUrl(offer.rendezvousUrl, route));
+    const started = await startClientHandshake({
+      daemonX25519Pub: offer.daemonX25519Pub,
+      daemonEd25519Pub: offer.daemonEd25519Pub,
+      authToken: auth,
+      clientName: name ?? selfName
+    });
+    let session = null;
+    const wrapped = await clientHandshakeOverSink(
+      raw,
+      encodePairingMessage(started.hello),
+      async (replyBytes) => {
+        session = await started.complete(decodePairingReply(replyBytes));
+        return session;
+      },
+      { timeoutMs: handshakeTimeoutMs }
+    );
+    if (!session) throw new Error("handshake did not derive a session");
+    const derived = session;
+    if (derived.peerFingerprint !== offer.fingerprint) {
+      wrapped.close("fingerprint mismatch");
+      throw new Error(
+        `host fingerprint ${derived.peerFingerprint} does not match the offer's ${offer.fingerprint}`
+      );
+    }
+    const pairRoot = await derivePairRoot(derived);
+    const nowIso2 = new Date(now()).toISOString();
+    const existing = hosts.get(offer.fingerprint);
+    const addedVia = existing?.addedVia === "manual" ? "manual" : meta?.joined ? "join" : "manual";
+    const record2 = {
+      fingerprint: offer.fingerprint,
+      name: name ?? offer.fingerprint,
+      daemonX25519Pub: offer.daemonX25519Pub,
+      daemonEd25519Pub: offer.daemonEd25519Pub,
+      rendezvousUrl: offer.rendezvousUrl,
+      pairRoot,
+      createdAt: existing?.createdAt ?? nowIso2,
+      lastSeen: nowIso2,
+      ...meta?.provider ? { provider: meta.provider } : {},
+      ...meta?.sandboxId ? { sandboxId: meta.sandboxId } : {},
+      ...meta?.labels ? { labels: meta.labels } : {},
+      addedVia
+    };
+    hosts.set(record2.fingerprint, record2);
+    await persist();
+    log(`[hosts] added ${record2.fingerprint} (${record2.name})`);
+    wrapped.close("add complete");
+    return { fingerprint: record2.fingerprint, name: record2.name, rendezvousUrl: record2.rendezvousUrl };
+  }
+  async function pruneExpiredJoinedHosts() {
+    if (joinedHostTtlMs <= 0) return;
+    const cutoff = now() - joinedHostTtlMs;
+    const expired = [];
+    for (const rec of hosts.values()) {
+      if (rec.addedVia === "join" && Date.parse(rec.lastSeen) <= cutoff) expired.push(rec.fingerprint);
+    }
+    if (expired.length === 0) return;
+    for (const fp of expired) {
+      hosts.delete(fp);
+      sessionsCache.delete(fp);
+      log(`[hosts] pruned ${fp}: joined host, unseen for over ${joinedHostTtlMs}ms`);
+    }
+    await persist();
+  }
+  async function list() {
+    await ensureLoaded();
+    await pruneExpiredJoinedHosts();
+    return Array.from(hosts.values()).map((r) => ({ ...r }));
+  }
+  async function renameHost(idOrName, newName) {
+    const trimmed = newName.trim();
+    if (!trimmed) throw new Error("host name must not be empty");
+    await ensureLoaded();
+    const target = findHost(idOrName);
+    if (!target) return false;
+    target.name = trimmed;
+    await persist();
+    log(`[hosts] renamed ${target.fingerprint} to "${trimmed}"`);
+    return true;
+  }
+  async function revoke(idOrName) {
+    await ensureLoaded();
+    const target = findHost(idOrName);
+    if (!target) return false;
+    hosts.delete(target.fingerprint);
+    await persist();
+    log(`[hosts] revoked ${target.fingerprint} (${target.name})`);
+    return true;
+  }
+  function isOnline(fingerprint) {
+    return (onlineCounts.get(fingerprint) ?? 0) > 0;
+  }
+  async function connectToHost(record2) {
+    const epoch = currentEpoch(now());
+    const attempts = [epoch, epoch - 1];
+    let lastErr;
+    let hungUpOnHello = 0;
+    for (const e of attempts) {
+      const { route, auth } = await deriveEpochTokens(record2.pairRoot, e);
+      let raw;
+      try {
+        raw = await dialWithTimeout(rvUrl(record2.rendezvousUrl, route));
+      } catch (err) {
+        lastErr = err;
+        continue;
+      }
+      try {
+        const started = await startClientHandshake({
+          daemonX25519Pub: record2.daemonX25519Pub,
+          daemonEd25519Pub: record2.daemonEd25519Pub,
+          authToken: auth,
+          clientName: record2.name
+        });
+        const wrapped = await clientHandshakeOverSink(
+          raw,
+          encodePairingMessage(started.hello),
+          (replyBytes) => started.complete(decodePairingReply(replyBytes)),
+          { timeoutMs: handshakeTimeoutMs }
+        );
+        const client = createTunnelClient({ sink: wrapped });
+        await client.ready();
+        record2.lastSeen = new Date(now()).toISOString();
+        await persist().catch((err) => log(`[hosts] lastSeen persist failed: ${errMsg(err)}`));
+        return client;
+      } catch (err) {
+        lastErr = err;
+        if (err instanceof Error && /transport closed during handshake/.test(err.message)) hungUpOnHello++;
+        try {
+          raw.close("handshake failed");
+        } catch {
+        }
+      }
+    }
+    const hint = hungUpOnHello === attempts.length ? ` \u2014 the host hung up on the pair/v2 hello; if it runs an older agentproto (pair/v1), upgrade it and re-pair: run \`agentproto pair offer --host\` on the host, then \`agentproto devices add\` here. (${PAIRING_PROTOCOL_OUTDATED_MESSAGE})` : "";
+    throw new Error(
+      `could not reach host ${record2.fingerprint} via ${record2.rendezvousUrl}: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}${hint}`
+    );
+  }
+  function toTunnelReq(req) {
+    return {
+      method: req.method,
+      path: req.path,
+      ...req.headers ? { headers: req.headers } : {},
+      ...req.body ? { body: Buffer.from(req.body) } : {}
+    };
+  }
+  function cacheSessionsResponse(fingerprint, req, res) {
+    if (req.method !== "GET" || !isSessionsPath(req.path)) return;
+    if (res.status < 200 || res.status >= 300) return;
+    if (res.body.byteLength > MAX_CACHED_SESSION_BODY_BYTES) return;
+    let byPath = sessionsCache.get(fingerprint);
+    if (!byPath) {
+      byPath = /* @__PURE__ */ new Map();
+      sessionsCache.set(fingerprint, byPath);
+    }
+    byPath.delete(req.path);
+    byPath.set(req.path, {
+      status: res.status,
+      headers: { ...res.headers },
+      body: res.body,
+      stale: true,
+      capturedAt: new Date(now()).toISOString()
+    });
+    while (byPath.size > MAX_CACHED_SESSION_PATHS_PER_HOST) {
+      const oldest = byPath.keys().next().value;
+      if (oldest === void 0) break;
+      byPath.delete(oldest);
+    }
+  }
+  function getSessionsSnapshot(idOrName, path) {
+    const record2 = findHost(idOrName);
+    if (!record2) return void 0;
+    const entry = sessionsCache.get(record2.fingerprint)?.get(path);
+    if (!entry) return void 0;
+    return { ...entry, headers: { ...entry.headers }, body: entry.body };
+  }
+  async function forwardHttp(idOrName, req) {
+    await ensureLoaded();
+    const record2 = findHost(idOrName);
+    if (!record2) throw new Error(`no host matched "${idOrName}"`);
+    onlineCounts.set(record2.fingerprint, (onlineCounts.get(record2.fingerprint) ?? 0) + 1);
+    let client;
+    try {
+      client = await connectToHost(record2);
+      const res = await client.forwardHttp(toTunnelReq(req));
+      const result = { status: res.status, headers: { ...res.headers }, body: new Uint8Array(res.body) };
+      cacheSessionsResponse(record2.fingerprint, req, result);
+      return result;
+    } finally {
+      if (client) await client.close().catch(() => {
+      });
+      const remaining = (onlineCounts.get(record2.fingerprint) ?? 1) - 1;
+      if (remaining > 0) onlineCounts.set(record2.fingerprint, remaining);
+      else onlineCounts.delete(record2.fingerprint);
+    }
+  }
+  async function forwardHttpStream(idOrName, req) {
+    await ensureLoaded();
+    const record2 = findHost(idOrName);
+    if (!record2) throw new Error(`no host matched "${idOrName}"`);
+    onlineCounts.set(record2.fingerprint, (onlineCounts.get(record2.fingerprint) ?? 0) + 1);
+    let decremented = false;
+    const decrement = () => {
+      if (decremented) return;
+      decremented = true;
+      const remaining = (onlineCounts.get(record2.fingerprint) ?? 1) - 1;
+      if (remaining > 0) onlineCounts.set(record2.fingerprint, remaining);
+      else onlineCounts.delete(record2.fingerprint);
+    };
+    let client;
+    try {
+      client = await connectToHost(record2);
+    } catch (err) {
+      decrement();
+      throw err;
+    }
+    let res;
+    try {
+      res = await client.forwardHttpStream(toTunnelReq(req));
+    } catch (err) {
+      await client.close().catch(() => {
+      });
+      decrement();
+      throw err;
+    }
+    const cleanup = () => {
+      void client.close().catch(() => {
+      });
+      decrement();
+    };
+    return { status: res.status, headers: { ...res.headers }, body: wrapStreamWithCleanup(res.body, cleanup) };
+  }
+  return {
+    add,
+    list,
+    rename: renameHost,
+    revoke,
+    isOnline,
+    forwardHttp,
+    forwardHttpStream,
+    getSessionsSnapshot
+  };
+}
+function wrapStreamWithCleanup(source, cleanup) {
+  const reader = source.getReader();
+  let cleanedUp = false;
+  const runCleanup = () => {
+    if (cleanedUp) return;
+    cleanedUp = true;
+    cleanup();
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          runCleanup();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (err) {
+        controller.error(err);
+        runCleanup();
+      }
+    },
+    async cancel(reason) {
+      try {
+        await reader.cancel(reason);
+      } finally {
+        runCleanup();
+      }
+    }
+  });
+}
+function isHostsFile(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const rec = v;
+  if (rec["v"] !== HOSTS_VERSION) return false;
+  if (!Array.isArray(rec["hosts"])) return false;
+  return rec["hosts"].every(isHostRecord);
+}
+function isHostRecord(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  return typeof r["fingerprint"] === "string" && typeof r["name"] === "string" && typeof r["daemonX25519Pub"] === "string" && typeof r["daemonEd25519Pub"] === "string" && typeof r["rendezvousUrl"] === "string" && typeof r["pairRoot"] === "string" && typeof r["createdAt"] === "string" && typeof r["lastSeen"] === "string";
+}
+function isEnoent(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 
 // src/device-registry.ts
 function inferKind2(name) {
@@ -29457,7 +30170,14 @@ function createDeviceRegistry(pairing, hosts) {
           "this daemon has no host registry wired \u2014 device sessions is unavailable (internal configuration issue, not a user error)"
         );
       }
-      return hosts.forwardHttp(idOrName, req);
+      try {
+        return await hosts.forwardHttp(idOrName, req);
+      } catch (err) {
+        if (req.method !== "GET" || !isSessionsPath(req.path)) throw err;
+        const snapshot = hosts.getSessionsSnapshot(idOrName, req.path);
+        if (!snapshot) throw err;
+        return snapshot;
+      }
     }
   };
 }
@@ -29525,13 +30245,13 @@ function passthroughToolHandle(id) {
 function unwrapDispatchResult(result) {
   if (!result || typeof result !== "object" || !("content" in result)) return result;
   const r = result;
-  const text12 = (r.content ?? []).map((c) => c.text ?? "").join("\n").trim();
-  if (r.isError) throw new Error(text12 || "tool call failed");
-  if (!text12) return void 0;
+  const text13 = (r.content ?? []).map((c) => c.text ?? "").join("\n").trim();
+  if (r.isError) throw new Error(text13 || "tool call failed");
+  if (!text13) return void 0;
   try {
-    return JSON.parse(text12);
+    return JSON.parse(text13);
   } catch {
-    return text12;
+    return text13;
   }
 }
 function createDaemonToolRegistry(handle, dispatchTool) {
@@ -30084,8 +30804,8 @@ async function locateAppDataPath(roots, relPath) {
 function textResult(body) {
   return { content: [{ type: "text", text: JSON.stringify(body) }] };
 }
-function errorResult(text12) {
-  return { content: [{ type: "text", text: JSON.stringify({ error: text12 }) }], isError: true };
+function errorResult(text13) {
+  return { content: [{ type: "text", text: JSON.stringify({ error: text13 }) }], isError: true };
 }
 async function atomicWrite(filePath, data) {
   await mkdir(dirname(filePath), { recursive: true });
@@ -30450,8 +31170,8 @@ function agentStepMcpServers(input) {
     return void 0;
   }
   params.set("callerSessionId", sessionId);
-  const sep5 = daemonMcpUrl.includes("?") ? "&" : "?";
-  return [{ name: "agentproto", transport: "http", ref: `${daemonMcpUrl}${sep5}${params.toString()}` }];
+  const sep6 = daemonMcpUrl.includes("?") ? "&" : "?";
+  return [{ name: "agentproto", transport: "http", ref: `${daemonMcpUrl}${sep6}${params.toString()}` }];
 }
 function withAllowlistToolSearchOff(options, agentTools, declaredOptions) {
   if (!agentTools || agentTools.length === 0) return options;
@@ -30687,10 +31407,17 @@ var SessionsRegistryAgentHost = class {
   async releaseAll() {
     await Promise.all([...this.unreleased].map((id) => this.releaseSession(id)));
   }
+  /**
+   * `waitTurnEnd` subscribes before `sendPrompt` is even called, so a cancel
+   * that kills the session WHILE `sendPrompt` is still in flight (the whole
+   * turn, for an on-host claude-code step) rejects `turnEnded` before either
+   * promise had a `.then`/`.catch` attached to it — an unhandled rejection
+   * that crashes the daemon process outright (not just this run). Passing
+   * both to `Promise.all` in the same expression attaches a handler to each
+   * synchronously, before the event bus can fire the rejection asynchronously.
+   */
   async sendPromptAndWait(sessionId, prompt) {
-    const turnEnded = this.waitTurnEnd(sessionId);
-    await this.registry.sendPrompt(sessionId, prompt);
-    await turnEnded;
+    await Promise.all([this.waitTurnEnd(sessionId), this.registry.sendPrompt(sessionId, prompt)]);
   }
   resolveByLabel(stepId) {
     return this.sessionsByLabel.get(stepId);
@@ -30719,9 +31446,7 @@ var SessionsRegistryAgentHost = class {
     const desc = this.registry.get(sessionId);
     if (!desc?.awaitingInput) return;
     if (policy.awaiting === "auto-allow") {
-      const turnEnded = this.waitTurnEnd(sessionId);
-      await this.registry.sendPrompt(sessionId, policy.prompt);
-      await turnEnded;
+      await this.sendPromptAndWait(sessionId, policy.prompt);
     } else if (policy.awaiting === "escalate") {
       const escalateUrl = policy.webhookUrl ?? this.opts?.notifyUrl;
       if (escalateUrl) {
@@ -30767,9 +31492,9 @@ var SessionsRegistryAgentHost = class {
       if (!("role" in m)) continue;
       if (m.role !== "assistant") continue;
       if (!("text" in m)) continue;
-      const text12 = m.text;
-      if (typeof text12 === "string" && text12.trim()) {
-        return text12;
+      const text13 = m.text;
+      if (typeof text13 === "string" && text13.trim()) {
+        return text13;
       }
     }
     return "";
@@ -30780,11 +31505,11 @@ var SessionsRegistryAgentHost = class {
   }
   // ── Internal helpers ──────────────────────────────────────────────────
   waitTurnEnd(sessionId) {
-    return new Promise((resolve37, reject) => {
+    return new Promise((resolve38, reject) => {
       const unsubs = [];
       const done = () => {
         for (const u of unsubs) u();
-        resolve37();
+        resolve38();
       };
       const fail3 = (reason) => {
         for (const u of unsubs) u();
@@ -30956,9 +31681,9 @@ function translateStages(stages, workflowId) {
             if (b.steps && typeof b.steps === "object") {
               for (const [id, val] of Object.entries(b.steps)) {
                 if (val && typeof val === "object" && "text" in val) {
-                  const text12 = val.text;
-                  if (text12) prevTexts.push(`[Output from step "${id}"]
-${text12}`);
+                  const text13 = val.text;
+                  if (text13) prevTexts.push(`[Output from step "${id}"]
+${text13}`);
                 }
               }
             }
@@ -31145,6 +31870,43 @@ function findStepDef(defs, stepId) {
 var DEFAULT_PERSIST_PATH2 = () => join(homedir(), ".agentproto", "workflow-runs.json");
 var DEFAULT_LEASE_TTL_MS = 6e4;
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 15e3;
+function finalizeStuckSteps(run) {
+  if (run.status !== "cancelled" && run.status !== "failed" && run.status !== "done") return false;
+  const cancelled = run.status === "cancelled";
+  const endedAt = run.endedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  let anyTouched = false;
+  for (const stage of run.stages) {
+    let stageTouched = false;
+    for (const step of stage.steps) {
+      if (step.status === "running") {
+        delete step.phase;
+        step.endedAt = endedAt;
+        if (cancelled) {
+          step.status = "cancelled";
+        } else {
+          step.status = "failed";
+          step.error = "interrupted by daemon restart";
+        }
+        stageTouched = true;
+      } else if (step.status === "pending") {
+        if (cancelled) {
+          step.status = "skipped";
+          step.skipReason = "run-cancelled";
+        } else {
+          step.status = "failed";
+          step.endedAt = endedAt;
+          step.error = "interrupted by daemon restart";
+        }
+        stageTouched = true;
+      }
+    }
+    if (stageTouched) {
+      anyTouched = true;
+      if (stage.status !== "done" && stage.status !== "failed") stage.status = "failed";
+    }
+  }
+  return anyTouched;
+}
 function loadRuns(persistPath, runsRoot) {
   const result = /* @__PURE__ */ new Map();
   if (!existsSync(persistPath)) return result;
@@ -31178,6 +31940,13 @@ function loadRuns(persistPath, runsRoot) {
         data: { code: "host-interrupted", message: run.error }
       });
     }
+    if (finalizeStuckSteps(run)) {
+      anyMarkedInterrupted = true;
+      createRunEventLog(run.runId, runsRoot).append({
+        type: "run.steps-finalized",
+        data: { code: "host-interrupted", status: run.status }
+      });
+    }
     result.set(run.runId, { run, cancelled: false, abort: new AbortController(), stages: [] });
   }
   if (anyMarkedInterrupted) saveRuns(result, persistPath);
@@ -31265,7 +32034,7 @@ function createOnEscalate(state, persist) {
     state.run.status = "awaiting-input";
     persist();
     try {
-      return await new Promise((resolve37, reject) => {
+      return await new Promise((resolve38, reject) => {
         const timeoutMs = policy.timeoutMs ?? 3e5;
         const timer = setTimeout(() => {
           state.pendingResolve = void 0;
@@ -31277,7 +32046,7 @@ function createOnEscalate(state, persist) {
           resolver: (response) => {
             clearTimeout(timer);
             state.pendingResolve = void 0;
-            resolve37(response);
+            resolve38(response);
           }
         };
       });
@@ -31413,7 +32182,7 @@ async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvent
       // `resolveApproval` (wired to `workflow_escalation_resolve`'s approval
       // form); the decision lands on the app ledger (`kind: "approval"`,
       // `by: "human"`) per the trame rule.
-      approve: (req) => new Promise((resolve37) => {
+      approve: (req) => new Promise((resolve38) => {
         const approvalId = `wfappr_${randomUUID()}`;
         const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
         state.run.status = "awaiting-approval";
@@ -31470,7 +32239,7 @@ async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvent
               runId: state.run.runId
             }
           });
-          resolve37(decision);
+          resolve38(decision);
         };
         if (req.timeoutMs !== void 0) {
           timer = setTimeout(() => {
@@ -31487,7 +32256,7 @@ async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvent
       // resumes through `resumeSuspend` (workflow_escalation_resolve's
       // suspend form); after a daemon restart the run stays suspended and
       // the pending entry is re-registered below.
-      resume: (req) => new Promise((resolve37) => {
+      resume: (req) => new Promise((resolve38) => {
         const since = (/* @__PURE__ */ new Date()).toISOString();
         state.run.status = "awaiting-input";
         state.run.awaitingSuspend = {
@@ -31525,7 +32294,7 @@ async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvent
           });
           eventLog?.append({ stepId: req.stepId, type: "step.resumed", data: {} });
           eventLog?.append({ type: "run.resumed", data: { stepId: req.stepId } });
-          resolve37(payload);
+          resolve38(payload);
         };
         signal.addEventListener("abort", onAbort, { once: true });
         state.pendingSuspend = { stepId: req.stepId, resolve: finish };
@@ -31541,7 +32310,7 @@ async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvent
       // read of the turn's text). On resume, `execAgentStep` sends the
       // validated payload back to the SAME session as its next prompt and
       // re-applies the outcome rule — this hook only parks and resolves.
-      onInputRequired: (req) => new Promise((resolve37) => {
+      onInputRequired: (req) => new Promise((resolve38) => {
         const since = (/* @__PURE__ */ new Date()).toISOString();
         const suspend = {
           reason: "input-required",
@@ -31594,7 +32363,7 @@ async function executeRunWorkflow(state, runtimeWf, agents, signal, sessionEvent
           });
           eventLog?.append({ stepId: req.stepId, type: "step.resumed", data: {} });
           eventLog?.append({ type: "run.resumed", data: { stepId: req.stepId } });
-          resolve37(payload);
+          resolve38(payload);
         };
         signal.addEventListener("abort", onAbort, { once: true });
         state.pendingSuspend = { stepId: req.stepId, resolve: finish };
@@ -32610,10 +33379,10 @@ function unwrapMcpToolResult(result) {
   if (envelope.structuredContent && typeof envelope.structuredContent === "object") {
     return envelope.structuredContent;
   }
-  const text12 = envelope.content?.find((c) => c.type === "text")?.text;
-  if (typeof text12 === "string") {
+  const text13 = envelope.content?.find((c) => c.type === "text")?.text;
+  if (typeof text13 === "string") {
     try {
-      const parsed = JSON.parse(text12);
+      const parsed = JSON.parse(text13);
       if (parsed && typeof parsed === "object") return parsed;
     } catch {
     }
@@ -32912,9 +33681,9 @@ Content-Type: ${file.contentType}\r
 function toFetchBody(buffer) {
   return new Uint8Array(buffer);
 }
-function convertMarkdownToTelegram(text12) {
-  if (!text12) return text12;
-  let result = text12;
+function convertMarkdownToTelegram(text13) {
+  if (!text13) return text13;
+  let result = text13;
   const codeBlocks = [];
   const inlineCodes = [];
   result = result.replace(/```([\s\S]*?)```/g, (_match, code) => {
@@ -33023,8 +33792,8 @@ function parseCron(schedule, timezone) {
 function summarizeToolResult(result) {
   if (result && typeof result === "object" && "content" in result) {
     const r = result;
-    const text12 = (r.content ?? []).map((c) => c.text ?? "").join("\n").trim();
-    return { ok: !r.isError, summary: text12 || (r.isError ? "tool call failed" : "ok") };
+    const text13 = (r.content ?? []).map((c) => c.text ?? "").join("\n").trim();
+    return { ok: !r.isError, summary: text13 || (r.isError ? "tool call failed" : "ok") };
   }
   return { ok: true, summary: JSON.stringify(result ?? null) };
 }
@@ -33334,14 +34103,14 @@ function createSupervisorTaskGateRunner(opts) {
   const { supervisor, registry, workspace } = opts;
   const exec = opts.runCommand ?? runCommand;
   const settleTimeoutMs = opts.settleTimeoutMs ?? DEFAULT_VERIFY_SETTLE_TIMEOUT_MS;
-  const waitForSettle = (policyId) => new Promise((resolve37) => {
+  const waitForSettle = (policyId) => new Promise((resolve38) => {
     let settled = false;
     const finish = (outcome) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
       unsub();
-      resolve37(outcome);
+      resolve38(outcome);
     };
     const read = () => {
       const state = supervisor.getStatus(policyId);
@@ -34606,7 +35375,7 @@ async function monitorSessionWait(opts) {
       };
     }
   }
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     const unsubs = [];
     let settled = false;
     const watcherLabel = callerScope?.ownerSessionId ? registry.get(callerScope.ownerSessionId)?.label ?? registry.get(callerScope.ownerSessionId)?.title : void 0;
@@ -34646,7 +35415,7 @@ async function monitorSessionWait(opts) {
           ts: (/* @__PURE__ */ new Date()).toISOString()
         });
       }
-      resolve37(result);
+      resolve38(result);
     };
     const relevantTypes = targetEvent === "any" ? ["session:turn-end", "session:awaiting-input", "session:exited"] : targetEvent === "turn-end" ? ["session:turn-end", "session:awaiting-input"] : targetEvent === "awaiting-input" ? ["session:awaiting-input"] : ["session:exited"];
     const idSet = new Set(resolvedIds);
@@ -34687,13 +35456,13 @@ async function monitorPolicyWait(opts) {
   if (isSettledStatus(initial.status)) {
     return { timedOut: false, state: initial };
   }
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled) return;
       settled = true;
       unsub();
-      resolve37({ timedOut: true });
+      resolve38({ timedOut: true });
     }, timeoutMs);
     const unsub = supervisor.onSettle((id) => {
       if (id !== policyId) return;
@@ -34703,7 +35472,7 @@ async function monitorPolicyWait(opts) {
       settled = true;
       clearTimeout(timer);
       unsub();
-      resolve37({ timedOut: false, state });
+      resolve38({ timedOut: false, state });
     });
   });
 }
@@ -35819,8 +36588,8 @@ function registerOrchestrationTools(rawServer, opts) {
             isError: true
           };
         }
-        const text12 = input.text ?? "";
-        if (text12.length === 0 && (!input.attachments || input.attachments.length === 0)) {
+        const text13 = input.text ?? "";
+        if (text13.length === 0 && (!input.attachments || input.attachments.length === 0)) {
           return {
             content: [
               { type: "text", text: JSON.stringify({ sent: false, bound: false, error: "text or attachments required" }) }
@@ -35834,7 +36603,7 @@ function registerOrchestrationTools(rawServer, opts) {
             alias: input.alias,
             source: input.source,
             contactRef: input.contact_ref,
-            text: text12,
+            text: text13,
             attachments: input.attachments
           },
           { mcpProxy, telegramCreds }
@@ -36265,7 +37034,7 @@ async function waitForSessionTerminal(registry, sessionId) {
   for (let attempt = 0; attempt < MAX_SEQUENTIAL_POLLS; attempt++) {
     const status = registry.get(sessionId)?.status;
     if (isSessionTerminal(status)) return;
-    await new Promise((resolve37) => setTimeout(resolve37, SEQUENTIAL_POLL_INTERVAL_MS));
+    await new Promise((resolve38) => setTimeout(resolve38, SEQUENTIAL_POLL_INTERVAL_MS));
   }
 }
 var MODEL_ROUTED_ADAPTER = "claude-code";
@@ -36340,8 +37109,8 @@ async function loadAgentPromptDefaults(agentPath) {
 function textResult2(body) {
   return { content: [{ type: "text", text: JSON.stringify(body) }] };
 }
-function errorResult2(text12) {
-  return { content: [{ type: "text", text: JSON.stringify({ error: text12 }) }], isError: true };
+function errorResult2(text13) {
+  return { content: [{ type: "text", text: JSON.stringify({ error: text13 }) }], isError: true };
 }
 function notEnabled(tool) {
   return errorResult2(
@@ -37430,8 +38199,8 @@ async function assertExternalPathRealInside(root, target) {
 function textResult3(body) {
   return { content: [{ type: "text", text: JSON.stringify(body) }] };
 }
-function errorResult3(text12) {
-  return { content: [{ type: "text", text: JSON.stringify({ error: text12 }) }], isError: true };
+function errorResult3(text13) {
+  return { content: [{ type: "text", text: JSON.stringify({ error: text13 }) }], isError: true };
 }
 function registerAppExternalTools(server, opts) {
   const { appRegistry } = opts;
@@ -37627,18 +38396,18 @@ function getStringField(obj, keys) {
 function buildMsg(body, ctx, fields) {
   const source = ctx.sourceOverride ?? (typeof fields.source === "function" ? fields.source() : fields.source);
   const contactRef = typeof fields.contactRef === "function" ? fields.contactRef() : fields.contactRef;
-  const text12 = typeof fields.text === "function" ? fields.text() : fields.text;
+  const text13 = typeof fields.text === "function" ? fields.text() : fields.text;
   const displayName = typeof fields.displayName === "function" ? fields.displayName() : fields.displayName;
   const surface = typeof fields.surface === "function" ? fields.surface() : fields.surface;
   const providerMessageId = typeof fields.providerMessageId === "function" ? fields.providerMessageId() : fields.providerMessageId;
   if (!source) return { ok: false, error: "missing_source" };
   if (!contactRef) return { ok: false, error: "missing_contact_ref" };
-  if (!text12) return { ok: false, error: "no_text" };
+  if (!text13) return { ok: false, error: "no_text" };
   const msg = {
     alias: ctx.alias,
     source,
     contactRef,
-    text: text12,
+    text: text13,
     // Opt-in attribution — only set when the dialect knows a sender name,
     // so 1:1 bindings keep receiving the raw text unprefixed.
     ...displayName ? { displayName } : {},
@@ -37657,18 +38426,18 @@ function normalizeAgentpush(body, ctx) {
   }
   const source = ctx.sourceOverride ?? (typeof envelope.channel === "string" ? envelope.channel : void 0);
   const contactRef = typeof envelope.from === "string" ? envelope.from : void 0;
-  const text12 = typeof envelope.text === "string" ? envelope.text : void 0;
+  const text13 = typeof envelope.text === "string" ? envelope.text : void 0;
   const providerMessageId = typeof envelope.messageId === "string" ? envelope.messageId : void 0;
   if (!source) return { ok: false, error: "missing_source" };
   if (!contactRef) return { ok: false, error: "missing_contact_ref" };
-  if (!text12) return { ok: false, error: "no_text" };
+  if (!text13) return { ok: false, error: "no_text" };
   return {
     ok: true,
     msg: {
       alias: ctx.alias,
       source,
       contactRef,
-      text: text12,
+      text: text13,
       messages: [envelope]
     },
     providerMessageId
@@ -37694,13 +38463,13 @@ function normalizeTelegram(body, ctx) {
   }
   const source = ctx.sourceOverride ?? "telegram";
   const contactRef = chat && typeof chat.id === "number" ? String(chat.id) : void 0;
-  const text12 = typeof message.text === "string" ? message.text : void 0;
+  const text13 = typeof message.text === "string" ? message.text : void 0;
   const providerMessageId = typeof message.message_id === "number" ? String(message.message_id) : void 0;
   const displayName = typeof from?.first_name === "string" && from.first_name ? from.first_name : typeof from?.username === "string" && from.username ? from.username : void 0;
   return buildMsg(body, ctx, {
     source,
     contactRef,
-    text: text12,
+    text: text13,
     displayName,
     surface: "telegram",
     providerMessageId
@@ -37726,14 +38495,14 @@ function normalizeWhatsapp(body, ctx) {
         const typedMsg = msg;
         const from = typeof typedMsg.from === "string" ? typedMsg.from : void 0;
         const textObj = typeof typedMsg.text === "object" && typedMsg.text !== null ? typedMsg.text : void 0;
-        const text12 = typeof textObj?.body === "string" ? textObj.body : void 0;
+        const text13 = typeof textObj?.body === "string" ? textObj.body : void 0;
         const providerMessageId = typeof typedMsg.id === "string" ? typedMsg.id : void 0;
         if (!from) continue;
-        if (!text12) continue;
+        if (!text13) continue;
         return buildMsg(body, ctx, {
           source: ctx.sourceOverride ?? from,
           contactRef: from,
-          text: text12,
+          text: text13,
           providerMessageId
         });
       }
@@ -37766,12 +38535,12 @@ function normalizeSlack(body, ctx) {
   }
   const source = ctx.sourceOverride ?? (typeof event.channel === "string" ? event.channel : void 0);
   const contactRef = typeof event.user === "string" ? event.user : void 0;
-  const text12 = typeof event.text === "string" ? event.text : void 0;
+  const text13 = typeof event.text === "string" ? event.text : void 0;
   const providerMessageId = typeof event.ts === "string" || typeof event.ts === "number" ? String(event.ts) : void 0;
   return buildMsg(body, ctx, {
     source,
     contactRef,
-    text: text12,
+    text: text13,
     providerMessageId
   });
 }
@@ -37781,12 +38550,12 @@ function normalizeGeneric(body, ctx) {
   }
   const source = ctx.sourceOverride ?? getStringField(body, ["channel", "source"]);
   const contactRef = getStringField(body, ["from", "sender", "contact_ref"]);
-  const text12 = getStringField(body, ["text", "body", "message"]);
+  const text13 = getStringField(body, ["text", "body", "message"]);
   const providerMessageId = getStringField(body, ["provider_message_id", "message_id", "id"]);
   return buildMsg(body, ctx, {
     source,
     contactRef,
-    text: text12,
+    text: text13,
     providerMessageId
   });
 }
@@ -37797,11 +38566,11 @@ function normalizeNative(body, ctx) {
   const typed = body;
   const source = ctx.sourceOverride ?? (typeof typed.source === "string" ? typed.source : void 0);
   const contactRef = typeof typed.contact_ref === "string" ? typed.contact_ref : void 0;
-  const text12 = typeof typed.text === "string" ? typed.text : void 0;
+  const text13 = typeof typed.text === "string" ? typed.text : void 0;
   return buildMsg(body, ctx, {
     source,
     contactRef,
-    text: text12
+    text: text13
   });
 }
 function headerValue(headers, key) {
@@ -39950,8 +40719,11 @@ async function startHttpServer(opts) {
           return;
         }
         if (path === "/user-presets" && req.method === "GET") {
+          const includeRecent = new URL(req.url ?? "/", "http://localhost").searchParams.get("includeRecent") === "1";
+          const presets = await listUserPresets();
+          const recent = includeRecent ? deriveRecentSpawnConfigs(opts.sessions?.list() ?? []) : void 0;
           res.writeHead(200, { "content-type": "application/json" });
-          res.end(JSON.stringify({ presets: await listUserPresets() }));
+          res.end(JSON.stringify({ presets, ...recent ? { recent } : {} }));
           return;
         }
         if (path === "/user-presets" && req.method === "POST") {
@@ -40096,6 +40868,16 @@ async function startHttpServer(opts) {
           );
           if (handled) return;
         }
+        if (path === "/device-spawn" || path.startsWith("/device-spawn/")) {
+          const handled = await handleDeviceSpawn(
+            req,
+            res,
+            path,
+            opts.port,
+            opts.deviceSpawnAllow === true
+          );
+          if (handled) return;
+        }
         if (opts.remote && path.startsWith("/remote")) {
           const handled = await handleRemoteControl(req, res, path, opts.remote);
           if (handled) return;
@@ -40299,16 +41081,16 @@ async function startHttpServer(opts) {
     });
   });
   const bind = opts.bind ?? "127.0.0.1";
-  await new Promise((resolve37, reject) => {
+  await new Promise((resolve38, reject) => {
     server.once("error", reject);
-    server.listen(opts.port, bind, () => resolve37());
+    server.listen(opts.port, bind, () => resolve38());
   });
   return {
     url: `http://${bind}:${opts.port}`,
     async stop() {
       wss.close();
       server.closeAllConnections();
-      await new Promise((resolve37) => server.close(() => resolve37()));
+      await new Promise((resolve38) => server.close(() => resolve38()));
     }
   };
 }
@@ -40517,9 +41299,9 @@ async function currentTranscriptSeq(id) {
   let stream;
   try {
     stream = createReadStream(filePath, { encoding: "utf8" });
-    await new Promise((resolve37, reject) => {
+    await new Promise((resolve38, reject) => {
       stream.once("error", reject);
-      stream.once("open", resolve37);
+      stream.once("open", resolve38);
     });
   } catch (err) {
     if (err.code === "ENOENT") return 0;
@@ -40544,9 +41326,9 @@ async function* transcriptDiskRecords(id) {
   let stream;
   try {
     stream = createReadStream(filePath, { encoding: "utf8" });
-    await new Promise((resolve37, reject) => {
+    await new Promise((resolve38, reject) => {
       stream.once("error", reject);
-      stream.once("open", resolve37);
+      stream.once("open", resolve38);
     });
   } catch (err) {
     if (err.code === "ENOENT") return;
@@ -40592,6 +41374,8 @@ function buildSpawnSessionHttpArgs(b, adapter, preset) {
   const browserField = browser !== void 0 ? { browser } : {};
   const sentinelOptOut = typeof b.sentinel === "boolean" ? b.sentinel : b.sentinel === "true" ? true : b.sentinel === "false" ? false : void 0;
   const sentinelField = sentinelOptOut === false ? { sentinel: false } : {};
+  const inferenceParsed = b.inference !== void 0 ? parseInferenceField(b.inference) : void 0;
+  const inferenceField = inferenceParsed !== void 0 ? { inference: inferenceParsed } : {};
   return {
     adapter,
     ...typeof b.origin === "string" && b.origin.length > 0 ? { origin: b.origin } : {},
@@ -40610,6 +41394,7 @@ function buildSpawnSessionHttpArgs(b, adapter, preset) {
       const parsed = parseAccessField(b.access);
       return parsed !== void 0 ? { access: parsed } : {};
     })() : {},
+    ...inferenceField,
     ...typeof b.posture === "string" && b.posture.length > 0 ? { posture: parsePostureInput(b.posture) } : {},
     ...typeof b.contextProfile === "string" && b.contextProfile.length > 0 ? { contextProfile: b.contextProfile } : {},
     ...preset ? { preset } : {},
@@ -40836,6 +41621,20 @@ function parseAccessField(raw) {
   const profileRef = value.profileRef;
   return typeof profileRef === "string" && profileRef.length > 0 ? { profileRef } : {};
 }
+function parseInferenceField(raw) {
+  const value = typeof raw === "string" ? tryParseJson(raw) : raw;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const obj = value;
+  const force = typeof obj.force === "boolean" ? obj.force : obj.force === "true" ? true : obj.force === "false" ? false : void 0;
+  const headroomPctRaw = typeof obj.headroomPct === "string" ? Number(obj.headroomPct) : obj.headroomPct;
+  const headroomPct = typeof headroomPctRaw === "number" && Number.isFinite(headroomPctRaw) && headroomPctRaw >= 0 && headroomPctRaw <= 95 ? headroomPctRaw : void 0;
+  return {
+    ...typeof obj.endpoint === "string" && obj.endpoint.length > 0 ? { endpoint: obj.endpoint } : {},
+    ...typeof obj.model === "string" && obj.model.length > 0 ? { model: obj.model } : {},
+    ...force !== void 0 ? { force } : {},
+    ...headroomPct !== void 0 ? { headroomPct } : {}
+  };
+}
 function parseRestartPolicyField(raw) {
   const value = typeof raw === "string" ? tryParseJson(raw) : raw;
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
@@ -40870,8 +41669,8 @@ function parseSandboxField(raw) {
   return parsed.data;
 }
 function parseAppServeField(raw) {
-  const text12 = typeof raw === "string" ? raw : JSON.stringify(raw);
-  const record2 = parseJsonRecordText(text12);
+  const text13 = typeof raw === "string" ? raw : JSON.stringify(raw);
+  const record2 = parseJsonRecordText(text13);
   if (!record2) return void 0;
   const dir = record2.dir;
   const port = record2.port;
@@ -41095,7 +41894,7 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
       json2(400, { error: "preset_not_found", message: `No user preset "${presetId}" found.` });
       return true;
     }
-    const adapter = typeof b.adapter === "string" ? b.adapter : typeof b.harness === "string" ? b.harness : preset?.adapter ?? preset?.harness ?? "";
+    const adapter = typeof b.adapter === "string" ? b.adapter : typeof b.harness === "string" ? b.harness : preset?.adapter ?? preset?.harness ?? (b.inference ? "pi" : "");
     if (!adapter) {
       json2(400, { error: "missing_adapter" });
       return true;
@@ -41162,7 +41961,7 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
       json2(400, { error: "preset_not_found", message: `No user preset "${presetId}" found.` });
       return true;
     }
-    const adapter = typeof b.adapter === "string" ? b.adapter : typeof b.harness === "string" ? b.harness : preset?.adapter ?? preset?.harness ?? "";
+    const adapter = typeof b.adapter === "string" ? b.adapter : typeof b.harness === "string" ? b.harness : preset?.adapter ?? preset?.harness ?? (b.inference ? "pi" : "");
     if (!adapter) {
       json2(400, { error: "missing_adapter" });
       return true;
@@ -41676,8 +42475,8 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
       return true;
     }
     const body = await readJsonBody(req);
-    const text12 = body?.text;
-    if (typeof text12 !== "string") {
+    const text13 = body?.text;
+    if (typeof text13 !== "string") {
       json2(400, { error: "missing_text", message: "Body `text` must be a string." });
       return true;
     }
@@ -41690,8 +42489,8 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
     }
     const enter = body?.enter !== false;
     let ok3 = true;
-    if (text12.length > 0) {
-      const toWrite = applyBracketedPasteWrap(registry, id2, text12);
+    if (text13.length > 0) {
+      const toWrite = applyBracketedPasteWrap(registry, id2, text13);
       ok3 = registry.writeTerminalInput(id2, toWrite) && ok3;
     }
     if (enter) ok3 = registry.writeTerminalInput(id2, "\r") && ok3;
@@ -41987,8 +42786,8 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
       ...source ? { source } : {}
     });
     if (result.content.startsWith("Error:")) {
-      const isNotFound = result.content.includes("not found in registry") || result.content.includes("not found") || result.content.includes("not found");
-      json2(isNotFound ? 404 : 422, {
+      const isNotFound2 = result.content.includes("not found in registry") || result.content.includes("not found") || result.content.includes("not found");
+      json2(isNotFound2 ? 404 : 422, {
         error: "export_failed",
         message: result.content,
         sessionId: rawIdOrName,
@@ -42018,9 +42817,9 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
     let fileStream;
     try {
       fileStream = createReadStream(filePath, { encoding: "utf8" });
-      await new Promise((resolve37, reject) => {
+      await new Promise((resolve38, reject) => {
         fileStream.once("error", reject);
-        fileStream.once("open", resolve37);
+        fileStream.once("open", resolve38);
       });
     } catch (err) {
       const code = err.code;
@@ -42076,9 +42875,9 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
     let fileStream;
     try {
       fileStream = createReadStream(filePath, { encoding: "utf8" });
-      await new Promise((resolve37, reject) => {
+      await new Promise((resolve38, reject) => {
         fileStream.once("error", reject);
-        fileStream.once("open", resolve37);
+        fileStream.once("open", resolve38);
       });
     } catch (err) {
       const code = err.code;
@@ -42541,7 +43340,7 @@ async function handleDeviceInference(req, res, path, registry, shareEnabled) {
     });
     return true;
   }
-  const HOP_BY_HOP = /* @__PURE__ */ new Set([
+  const HOP_BY_HOP2 = /* @__PURE__ */ new Set([
     "connection",
     "keep-alive",
     "transfer-encoding",
@@ -42552,7 +43351,7 @@ async function handleDeviceInference(req, res, path, registry, shareEnabled) {
   ]);
   const headers = {};
   for (const [k, v] of Object.entries(req.headers)) {
-    if (v === void 0 || HOP_BY_HOP.has(k.toLowerCase())) continue;
+    if (v === void 0 || HOP_BY_HOP2.has(k.toLowerCase())) continue;
     headers[k] = Array.isArray(v) ? v.join(", ") : v;
   }
   let body;
@@ -42596,6 +43395,70 @@ async function handleDeviceInference(req, res, path, registry, shareEnabled) {
   Readable.fromWeb(upstreamRes.body).pipe(res);
   return true;
 }
+async function handleDeviceSpawn(req, res, path, port, spawnAllowed) {
+  const json2 = (status, body2) => {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body2));
+  };
+  if (!path.startsWith("/device-spawn/") && path !== "/device-spawn") return false;
+  if (req.headers[HOST_SCOPE_HEADER] !== "1") {
+    json2(403, {
+      error: "host_scope_required",
+      message: "device-spawn is reachable only over a host-scoped pairing (the far end must have registered this daemon via `agentproto pair offer --host` + `agentproto devices add`)"
+    });
+    return true;
+  }
+  if (!spawnAllowed) {
+    json2(403, {
+      error: "spawn_disabled",
+      message: "this host has not opted in \u2014 run `agentproto devices allow-spawn on` on it"
+    });
+    return true;
+  }
+  const subpath = path.slice("/device-spawn".length) || "/";
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (v === void 0) continue;
+    const lower = k.toLowerCase();
+    if (lower === "connection" || lower === "keep-alive" || lower === "transfer-encoding") continue;
+    if (lower === "upgrade" || lower === "host" || lower === "content-length") continue;
+    if (lower === HOST_SCOPE_HEADER) continue;
+    headers[k] = Array.isArray(v) ? v.join(", ") : v;
+  }
+  let body;
+  if ((req.method ?? "GET") !== "GET" && (req.method ?? "GET") !== "HEAD") {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    body = Buffer.concat(chunks);
+  }
+  let upstreamRes;
+  try {
+    upstreamRes = await fetch(`http://127.0.0.1:${port}${subpath}`, {
+      method: req.method ?? "GET",
+      headers,
+      ...body ? { body } : {}
+      // Cast rationale — see `handleDeviceInference`'s identical cast above.
+    });
+  } catch (err) {
+    json2(502, {
+      error: "self_proxy_unreachable",
+      message: err instanceof Error ? err.message : String(err)
+    });
+    return true;
+  }
+  const resHeaders = {};
+  upstreamRes.headers.forEach((v, k) => {
+    if (k === "content-length" || k === "connection") return;
+    resHeaders[k] = v;
+  });
+  res.writeHead(upstreamRes.status, resHeaders);
+  if (!upstreamRes.body) {
+    res.end();
+    return true;
+  }
+  Readable.fromWeb(upstreamRes.body).pipe(res);
+  return true;
+}
 async function handleRemoteControl(req, res, path, controller) {
   const json2 = (status, body) => {
     res.writeHead(status, { "content-type": "application/json" });
@@ -43208,7 +44071,7 @@ async function handleDevices(req, res, path, registry, hostRegistry, joinTokens)
       });
       return true;
     }
-    const HOP_BY_HOP = /* @__PURE__ */ new Set([
+    const HOP_BY_HOP2 = /* @__PURE__ */ new Set([
       "connection",
       "keep-alive",
       "transfer-encoding",
@@ -43220,7 +44083,7 @@ async function handleDevices(req, res, path, registry, hostRegistry, joinTokens)
     ]);
     const headers = {};
     for (const [k, v] of Object.entries(req.headers)) {
-      if (v === void 0 || HOP_BY_HOP.has(k.toLowerCase())) continue;
+      if (v === void 0 || HOP_BY_HOP2.has(k.toLowerCase())) continue;
       headers[k] = Array.isArray(v) ? v.join(", ") : v;
     }
     const chunks = [];
@@ -43296,13 +44159,28 @@ async function handleDevices(req, res, path, registry, hostRegistry, joinTokens)
     json2(200, { ok: true, revoked: target });
     return true;
   }
+  function writeDeviceSessionsResponse(res2) {
+    if (!res2.stale) {
+      res.writeHead(res2.status, { "content-type": "application/json" });
+      res.end(Buffer.from(res2.body));
+      return;
+    }
+    let merged;
+    try {
+      const parsed = JSON.parse(Buffer.from(res2.body).toString("utf8"));
+      merged = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? { ...parsed, stale: true, capturedAt: res2.capturedAt } : { stale: true, capturedAt: res2.capturedAt, value: parsed };
+    } catch {
+      merged = { stale: true, capturedAt: res2.capturedAt };
+    }
+    res.writeHead(res2.status, { "content-type": "application/json" });
+    res.end(JSON.stringify(merged));
+  }
   const deviceSessionsMatch = path.match(/^\/devices\/([^/]+)\/sessions$/);
   if (deviceSessionsMatch && req.method === "GET") {
     const target = decodeURIComponent(deviceSessionsMatch[1] ?? "");
     try {
       const res2 = await devices.forwardHttp(target, { method: "GET", path: "/sessions" });
-      res.writeHead(res2.status, { "content-type": "application/json" });
-      res.end(Buffer.from(res2.body));
+      writeDeviceSessionsResponse(res2);
     } catch (err) {
       json2(502, { error: "forward_failed", message: err instanceof Error ? err.message : String(err) });
     }
@@ -43316,8 +44194,7 @@ async function handleDevices(req, res, path, registry, hostRegistry, joinTokens)
     const qs = reqUrl.includes("?") ? reqUrl.slice(reqUrl.indexOf("?")) : "";
     try {
       const res2 = await devices.forwardHttp(target, { method: "GET", path: `/sessions/${sessionId}/output${qs}` });
-      res.writeHead(res2.status, { "content-type": "application/json" });
-      res.end(Buffer.from(res2.body));
+      writeDeviceSessionsResponse(res2);
     } catch (err) {
       json2(502, { error: "forward_failed", message: err instanceof Error ? err.message : String(err) });
     }
@@ -43684,7 +44561,8 @@ function requestHttpBaseUrl(req) {
 }
 async function handleAppUiPage(req, res, appId, appRegistry, frameAncestors) {
   const app = appRegistry.getApp(appId);
-  const builtin = app?.ui ? void 0 : resolveBuiltinPanelUi(appId, requestHttpBaseUrl(req));
+  const sessionIdParam = new URL(req.url ?? "/", "http://localhost").searchParams.get("sessionId") ?? void 0;
+  const builtin = app?.ui ? void 0 : resolveBuiltinPanelUi(appId, requestHttpBaseUrl(req), sessionIdParam);
   if (!app?.ui && !builtin) {
     res.writeHead(404, { "content-type": "application/json" });
     res.end(JSON.stringify({ error: `app "${appId}" is not installed or has no UI.` }));
@@ -43742,7 +44620,7 @@ async function handleAppUiPage(req, res, appId, appRegistry, frameAncestors) {
     } else {
       const html = builtin.html;
       rep = await appUiRepresentations.get(
-        `builtin\0${appId}\0${baseUrl}\0${variant ?? ""}`,
+        `builtin\0${appId}\0${baseUrl}\0${variant ?? ""}\0${sessionIdParam ?? ""}`,
         html,
         () => appUiPageRepresentation(html, baseUrl, variant)
       );
@@ -46100,8 +46978,8 @@ function isRecord8(v) {
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function errorResult4(text12) {
-  return { isError: true, content: [{ type: "text", text: text12 }] };
+function errorResult4(text13) {
+  return { isError: true, content: [{ type: "text", text: text13 }] };
 }
 init_mcp_credential_deps();
 init_mcp_imports();
@@ -46441,6 +47319,10 @@ var sameRubrics = (a, b) => {
   const norm = (r) => r.map((d) => `${d.check}\0${d.path}\0${d.sha256}`).sort().join("\n");
   return norm(a) === norm(b);
 };
+var samePacks = (a, b) => {
+  const norm = (r) => r.map((d) => `${d.ref}\0${d.id}\0${d.version}\0${d.sha256}`).sort().join("\n");
+  return norm(a) === norm(b);
+};
 async function readEntry(path) {
   try {
     const parsed = JSON.parse(await readFile(path, "utf8"));
@@ -46471,6 +47353,21 @@ function createReviewLedger(opts = {}) {
   const annotationLocks = /* @__PURE__ */ new Map();
   const requesterIndex = /* @__PURE__ */ new Map();
   let requesterIndexBuilt = false;
+  const entryCache = /* @__PURE__ */ new Map();
+  async function readEntryCached(path) {
+    let s;
+    try {
+      s = await stat(path);
+    } catch {
+      entryCache.delete(path);
+      return void 0;
+    }
+    const cached = entryCache.get(path);
+    if (cached && cached.mtimeMs === s.mtimeMs && cached.size === s.size) return cached.entry;
+    const entry = await readEntry(path);
+    entryCache.set(path, { mtimeMs: s.mtimeMs, size: s.size, entry });
+    return entry;
+  }
   function indexRequester(entry) {
     const sessionId = entry.attestation.requester?.sessionId;
     if (!sessionId) return;
@@ -46502,7 +47399,7 @@ function createReviewLedger(opts = {}) {
       for (const manifestDir of await subdirs(repoDir)) {
         for (const bindingDir of await subdirs(manifestDir)) {
           for (const file of await jsonFiles(bindingDir)) {
-            const entry = await readEntry(file);
+            const entry = await readEntryCached(file);
             if (!entry) continue;
             const a = entry.attestation;
             if (filter.repoRemote !== void 0 && a.target.repoRemote !== filter.repoRemote) continue;
@@ -46520,23 +47417,25 @@ function createReviewLedger(opts = {}) {
     root,
     async put(entry) {
       const path = keyPath(root, ledgerKeyOf(entry.attestation));
-      const previous = await readEntry(path);
+      const previous = await readEntryCached(path);
       const prevSessionId = previous?.attestation.requester?.sessionId;
       const nextSessionId = entry.attestation.requester?.sessionId;
       if (prevSessionId && prevSessionId !== nextSessionId) requesterIndex.get(prevSessionId)?.delete(path);
       await writeJsonAtomic(path, entry);
+      entryCache.delete(path);
       indexRequester(entry);
       return path;
     },
     async get(key) {
-      return readEntry(keyPath(root, key));
+      return readEntryCached(keyPath(root, key));
     },
-    async lookupCached(key, rubrics) {
-      const entry = await readEntry(keyPath(root, key));
+    async lookupCached(key, rubrics, packs = []) {
+      const entry = await readEntryCached(keyPath(root, key));
       if (!entry) return void 0;
       const a = entry.attestation;
       if (a.verdict === "incomplete" || a.dirty) return void 0;
       if (!sameRubrics(a.rubrics ?? [], rubrics)) return void 0;
+      if (!samePacks(a.packs ?? [], packs)) return void 0;
       return entry;
     },
     async findByRunId(runId) {
@@ -46549,7 +47448,7 @@ function createReviewLedger(opts = {}) {
       for (const sessionId of filter.requesterSessionIds) {
         for (const path of requesterIndex.get(sessionId) ?? []) paths.add(path);
       }
-      const entries = (await Promise.all([...paths].map(readEntry))).filter((e) => e !== void 0);
+      const entries = (await Promise.all([...paths].map(readEntryCached))).filter((e) => e !== void 0);
       const { requesterSessionIds: _requesterSessionIds, ...rest } = filter;
       const filtered = entries.filter((entry) => {
         const a = entry.attestation;
@@ -46579,6 +47478,311 @@ function createReviewLedger(opts = {}) {
     }
   };
 }
+function isAncestor(root, ancestor, descendant) {
+  if (ancestor === descendant) return Promise.resolve(false);
+  return new Promise((resolvePromise) => {
+    execFile("git", ["merge-base", "--is-ancestor", ancestor, descendant], { cwd: root }, (err) => {
+      resolvePromise(!err);
+    });
+  });
+}
+async function findComposeCandidate(input) {
+  const entries = await input.ledger.list({
+    repoRemote: input.repoRemote,
+    manifestSha: input.manifestSha,
+    binding: input.binding
+  });
+  for (const entry of entries) {
+    const a = entry.attestation;
+    if (a.verdict !== "pass" || a.dirty) continue;
+    if (a.target.baseSha !== input.baseSha) continue;
+    const lane = a.lanes.find((l) => l.id === input.checkId);
+    if (!lane || lane.status !== "pass") continue;
+    const rubric = (a.rubrics ?? []).find((r) => r.check === input.checkId);
+    if (!rubric || rubric.sha256 !== input.rubricSha256) continue;
+    if (input.packDigest) {
+      const priorPack = (a.packs ?? []).find((p) => p.id === input.packDigest.id);
+      if (!priorPack || priorPack.sha256 !== input.packDigest.sha256) continue;
+    }
+    if (!await isAncestor(input.repoRoot, a.target.headSha, input.headSha)) continue;
+    return { attestation: a };
+  }
+  return void 0;
+}
+function composedFromRangeSha(candidate) {
+  return rangeSha(candidate.attestation.target);
+}
+var defaultReviewPackCacheDir = () => join(homedir(), ".agentproto", "review-packs");
+var FULL_SHA = /^[0-9a-f]{40}$/;
+function execFileP(bin, args, opts = {}) {
+  return new Promise((resolvePromise, reject) => {
+    execFile(bin, [...args], { cwd: opts.cwd, env: opts.env, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err) reject(new Error(`${bin} ${args.join(" ")} failed: ${String(stderr || err.message).trim()}`));
+      else resolvePromise(String(stdout));
+    });
+  });
+}
+async function readSource(root) {
+  try {
+    return await readFile(join(root, "REVIEW.md"), "utf8");
+  } catch (err) {
+    throw new Error(`no REVIEW.md at ${join(root, "REVIEW.md")} (${err instanceof Error ? err.message : String(err)})`);
+  }
+}
+function isRealPathInside(realChild, realParent) {
+  return realChild === realParent || realChild.startsWith(realParent + sep);
+}
+async function readRubricConfined(root, relPath) {
+  const resolved = resolve(root, relPath);
+  let realResolved;
+  let realRoot;
+  try {
+    ;
+    [realResolved, realRoot] = await Promise.all([realpath(resolved), realpath(root)]);
+  } catch (err) {
+    throw new Error(`could not read (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (!isRealPathInside(realResolved, realRoot)) {
+    throw new Error(`resolves outside its pack root (${root}) \u2014 refusing to read it`);
+  }
+  return readFile(realResolved);
+}
+async function loadFromRoot(root, refKind, trusted) {
+  const source = await readSource(root);
+  return {
+    manifest: parsePackManifest(source),
+    source,
+    refKind,
+    trusted,
+    root,
+    readRubric: (relPath) => readRubricConfined(root, relPath)
+  };
+}
+async function isTrustedRelativePack(root, repoRoot) {
+  let realRoot;
+  let realRepo;
+  try {
+    ;
+    [realRoot, realRepo] = await Promise.all([realpath(root), realpath(repoRoot)]);
+  } catch {
+    return false;
+  }
+  if (!isRealPathInside(realRoot, realRepo)) return false;
+  const relReviewMd = join(relative(realRepo, realRoot), "REVIEW.md");
+  try {
+    await execFileP("git", ["-C", realRepo, "ls-files", "--error-unmatch", "--", relReviewMd]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loadRelative(ref, manifestDir, repoRoot) {
+  const root = isAbsolute(ref) ? ref : resolve(manifestDir, ref);
+  const trusted = await isTrustedRelativePack(root, repoRoot);
+  return loadFromRoot(root, "relative", trusted);
+}
+async function loadNpm(ref, repoRoot) {
+  const req = createRequire(join(repoRoot, "package.json"));
+  let pkgJsonPath;
+  try {
+    pkgJsonPath = req.resolve(`${ref}/package.json`);
+  } catch (err) {
+    throw new Error(
+      `review pack '${ref}' is not resolvable from ${repoRoot} (node_modules, no network, no install) \u2014 is it a dependency? (${err instanceof Error ? err.message : String(err)})`
+    );
+  }
+  return loadFromRoot(dirname(pkgJsonPath), "npm", false);
+}
+async function loadGit(ref, cacheDir, env) {
+  const rest = ref.slice("git+".length);
+  if (!rest.startsWith("https://")) {
+    throw new Error(
+      `git pack ref '${ref}' must use git+https:// \u2014 other git transports (ssh://, file://, ext::, plain http://) are not accepted`
+    );
+  }
+  const hashAt = rest.lastIndexOf("#");
+  const sha = hashAt === -1 ? "" : rest.slice(hashAt + 1);
+  const url = hashAt === -1 ? rest : rest.slice(0, hashAt);
+  if (!FULL_SHA.test(sha)) {
+    throw new Error(`git pack ref '${ref}' must be pinned to a full 40-hex commit sha (git+https://...#<sha>)`);
+  }
+  const dest = join(cacheDir, sha);
+  if (existsSync(join(dest, "REVIEW.md"))) return loadFromRoot(dest, "git", false);
+  const tmp = await mkdtemp(join(tmpdir(), "agentproto-review-pack-"));
+  try {
+    await execFileP("git", ["clone", "--quiet", "--", url, tmp], { env });
+    await execFileP("git", ["checkout", "--quiet", sha], { cwd: tmp, env });
+    try {
+      await mkdir(cacheDir, { recursive: true });
+      await rename(tmp, dest);
+    } catch {
+      if (!existsSync(join(dest, "REVIEW.md"))) throw new Error(`could not place cloned pack at ${dest}`);
+      await rm(tmp, { recursive: true, force: true }).catch(() => void 0);
+    }
+  } catch (err) {
+    await rm(tmp, { recursive: true, force: true }).catch(() => void 0);
+    throw err;
+  }
+  return loadFromRoot(dest, "git", false);
+}
+function createReviewPackLoader(opts) {
+  const cacheDir = opts.cacheDir ?? defaultReviewPackCacheDir();
+  return {
+    async load(ref) {
+      if (ref.startsWith("git+")) return loadGit(ref, cacheDir, opts.env);
+      if (ref.startsWith("./") || ref.startsWith("../") || isAbsolute(ref)) {
+        return loadRelative(ref, opts.manifestDir, opts.repoRoot);
+      }
+      return loadNpm(ref, opts.repoRoot);
+    }
+  };
+}
+var SIGN_NAMESPACE = "agentproto-review";
+var defaultReviewKeysDir = () => join(homedir(), ".agentproto", "keys");
+var errMessage = (err) => err instanceof Error ? err.message : String(err);
+var isNotFound = (err) => err?.code === "ENOENT";
+function execFileP2(bin, args, opts = {}) {
+  return new Promise((resolvePromise, reject) => {
+    const child = execFile(
+      bin,
+      [...args],
+      { env: opts.env ?? process.env, maxBuffer: 16 * 1024 * 1024 },
+      (err, stdout, stderr) => {
+        if (err) {
+          reject(Object.assign(err, { stdout: String(stdout), stderr: String(stderr) }));
+          return;
+        }
+        resolvePromise({ stdout: String(stdout), stderr: String(stderr) });
+      }
+    );
+    if (opts.input !== void 0) child.stdin?.end(opts.input);
+    else child.stdin?.end();
+  });
+}
+async function ensureReviewSigningKey(opts = {}) {
+  const dir = opts.dir ?? defaultReviewKeysDir();
+  await mkdir(dir, { recursive: true });
+  const privateKeyPath = join(dir, "review_ed25519");
+  const publicKeyPath = `${privateKeyPath}.pub`;
+  const exists = await stat(privateKeyPath).then(() => true).catch(() => false);
+  if (!exists) {
+    await execFileP2(
+      "ssh-keygen",
+      ["-t", "ed25519", "-N", "", "-C", `agentproto-review@${hostname()}`, "-f", privateKeyPath],
+      { env: opts.env }
+    );
+  }
+  await chmod(privateKeyPath, 384);
+  const publicKeyLine = (await readFile(publicKeyPath, "utf8")).trim();
+  const fingerprint = await fingerprintOf(publicKeyPath, opts.env);
+  return { privateKeyPath, publicKeyPath, fingerprint, publicKeyLine };
+}
+async function fingerprintOf(publicKeyPath, env) {
+  const { stdout } = await execFileP2("ssh-keygen", ["-lf", publicKeyPath], { env });
+  const fp = stdout.trim().split(/\s+/)[1];
+  if (!fp) throw new Error(`could not parse a fingerprint from: ${stdout.trim()}`);
+  return fp;
+}
+function allowedSignersLine(principal, publicKeyLine) {
+  const [algo, key] = publicKeyLine.trim().split(/\s+/);
+  if (!algo || !key) throw new Error(`malformed public key line: ${publicKeyLine}`);
+  return `${principal} namespaces="${SIGN_NAMESPACE}" ${algo} ${key}`;
+}
+async function resolvePrincipal(opts) {
+  if (opts.configuredPrincipal) return opts.configuredPrincipal;
+  const email = await new Promise((resolvePromise) => {
+    execFile("git", ["config", "user.email"], { cwd: opts.repoRoot }, (err, stdout) => {
+      resolvePromise(err ? void 0 : stdout.trim() || void 0);
+    });
+  });
+  return email ?? `agentproto-review@${hostname()}`;
+}
+async function signAttestation(att, opts) {
+  let key;
+  try {
+    key = await ensureReviewSigningKey({ dir: opts.keysDir, env: opts.env });
+  } catch (err) {
+    return { error: `could not prepare the review signing key: ${errMessage(err)}` };
+  }
+  const tmpDir = await mkdtemp(join(tmpdir(), "agentproto-review-sign-"));
+  try {
+    const payloadPath = join(tmpDir, "attestation.json");
+    await writeFile(payloadPath, canonicalAttestationBytes(att), "utf8");
+    await execFileP2("ssh-keygen", ["-Y", "sign", "-f", key.privateKeyPath, "-n", SIGN_NAMESPACE, payloadPath], {
+      env: opts.env
+    });
+    const sig = await readFile(`${payloadPath}.sig`, "utf8");
+    return {
+      signature: {
+        alg: "ssh-ed25519",
+        keyFingerprint: key.fingerprint,
+        principal: opts.principal,
+        signedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        sig
+      }
+    };
+  } catch (err) {
+    return { error: `could not sign the attestation: ${isNotFound(err) ? "ssh-keygen not found on PATH" : errMessage(err)}` };
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+async function verifySignedAttestation(att, opts) {
+  const sig = att.attestor.signature;
+  if (!sig) return { ok: false, problems: ["attestation is not signed"] };
+  let allowedSignersReadable = true;
+  try {
+    await stat(opts.allowedSignersPath);
+  } catch {
+    allowedSignersReadable = false;
+  }
+  if (!allowedSignersReadable) {
+    return { ok: false, problems: [`allowed_signers file not found: ${opts.allowedSignersPath}`] };
+  }
+  const tmpDir = await mkdtemp(join(tmpdir(), "agentproto-review-verify-"));
+  try {
+    const payload = canonicalAttestationBytes(att);
+    const payloadPath = join(tmpDir, "attestation.json");
+    const sigPath = `${payloadPath}.sig`;
+    await writeFile(payloadPath, payload, "utf8");
+    await writeFile(sigPath, sig.sig.endsWith("\n") ? sig.sig : `${sig.sig}
+`, "utf8");
+    let principals;
+    try {
+      const { stdout } = await execFileP2(
+        "ssh-keygen",
+        ["-Y", "find-principals", "-f", opts.allowedSignersPath, "-s", sigPath],
+        { env: opts.env }
+      );
+      principals = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+    } catch (err) {
+      if (isNotFound(err)) return { ok: false, problems: ["ssh-keygen is not available \u2014 cannot verify signatures"] };
+      principals = [];
+    }
+    if (!principals.includes(sig.principal)) {
+      return {
+        ok: false,
+        problems: [`no principal '${sig.principal}' maps to the signing key (${sig.keyFingerprint}) in ${opts.allowedSignersPath}`]
+      };
+    }
+    try {
+      await execFileP2(
+        "ssh-keygen",
+        ["-Y", "verify", "-f", opts.allowedSignersPath, "-I", sig.principal, "-n", SIGN_NAMESPACE, "-s", sigPath],
+        { input: payload, env: opts.env }
+      );
+    } catch (err) {
+      if (isNotFound(err)) return { ok: false, problems: ["ssh-keygen is not available \u2014 cannot verify signatures"] };
+      return { ok: false, problems: [`signature does not verify: ${errMessage(err)}`] };
+    }
+    return { ok: true, problems: [] };
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+async function fileExists2(path) {
+  return stat(path).then(() => true).catch(() => false);
+}
 
 // src/review-runner.ts
 function git2(cwd, args) {
@@ -46684,19 +47888,54 @@ function createReviewLaneExecutor(ctx) {
         error: "agent lanes are not available on this daemon (started without an agent adapter resolver)"
       };
     }
-    const rubricPath = resolve(dirname(ctx.manifestPath), check.rubric);
+    const rubricPath = resolve(check.rubricBase ?? dirname(ctx.manifestPath), check.rubric);
     try {
       await readFile(rubricPath);
     } catch {
       return { outcome: "skipped", error: `rubric not found: ${rubricPath}` };
     }
-    const verdictPath = join(ctx.runDir, `${check.id}.verdict.json`);
+    let promptTarget = target;
+    let composedFrom;
+    if (ctx.compose?.enabled) {
+      const rubric = ctx.compose.rubrics.find((r) => r.check === check.id);
+      const namespace = check.id.includes("/") ? check.id.slice(0, check.id.indexOf("/")) : void 0;
+      const packDigest = namespace ? ctx.compose.packByNamespace?.[namespace] : void 0;
+      const candidate = rubric ? await findComposeCandidate({
+        ledger: ctx.compose.ledger,
+        repoRoot: ctx.repoRoot,
+        repoRemote: target.repoRemote,
+        manifestSha: ctx.compose.manifestSha,
+        binding: ctx.compose.binding,
+        checkId: check.id,
+        rubricSha256: rubric.sha256,
+        ...packDigest ? { packDigest: { id: packDigest.id, sha256: packDigest.sha256 } } : {},
+        baseSha: target.baseSha,
+        headSha: target.headSha
+      }) : void 0;
+      if (candidate) {
+        const priorHeadSha = candidate.attestation.target.headSha;
+        promptTarget = { ...target, baseSha: priorHeadSha };
+        composedFrom = {
+          rangeSha: composedFromRangeSha(candidate),
+          headSha: priorHeadSha,
+          attestationSha256: attestationSha256(candidate.attestation)
+        };
+      }
+    }
+    const verdictPath = join(ctx.runDir, `${check.id.replace(/\//g, "__")}.verdict.json`);
     await mkdir(ctx.runDir, { recursive: true });
     await rm(verdictPath, { force: true });
     const result = await ctx.reviewers.run({
       preset: check.preset,
       cwd: ctx.repoRoot,
-      prompt: buildAgentLanePrompt({ reviewId: ctx.reviewId, check, target, rubricPath, verdictPath }),
+      prompt: buildAgentLanePrompt({
+        reviewId: ctx.reviewId,
+        check,
+        target: promptTarget,
+        rubricPath,
+        verdictPath,
+        ...composedFrom ? { composedFrom: { priorHeadSha: composedFrom.headSha } } : {}
+      }),
       label: `review:${ctx.reviewId}:${check.id}`,
       timeoutMs: check.timeoutMs,
       ...ctx.parentSessionId ? { parentSessionId: ctx.parentSessionId } : {},
@@ -46739,7 +47978,8 @@ function createReviewLaneExecutor(ctx) {
         report: parseAgentLaneReport(raw),
         sessionId: result.sessionId,
         preset: result.preset,
-        ...model
+        ...model,
+        ...composedFrom ? { composedFrom } : {}
       };
     } catch (err) {
       return {
@@ -46783,7 +48023,9 @@ function createReviewRunner(opts) {
     const source = await readFile(manifestPath, "utf8").catch(() => {
       throw new Error(`no REVIEW.md at ${manifestPath}`);
     });
-    const manifest = parseReviewManifest(source);
+    const parsed = parseReviewManifest(source);
+    const packLoader = createReviewPackLoader({ repoRoot: root, manifestDir: dirname(manifestPath) });
+    const { manifest, packs: packDigests, packByNamespace } = await resolvePacks(parsed, packLoader);
     const binding = resolveBinding(manifest, input.binding);
     run.reviewId = manifest.id;
     run.binding = binding.name;
@@ -46802,7 +48044,7 @@ function createReviewRunner(opts) {
     for (const id of binding.checks) {
       const check = manifest.checks.find((c) => c.id === id);
       if (check?.kind !== "agent") continue;
-      const path = resolve(dirname(manifestPath), check.rubric);
+      const path = resolve(check.rubricBase ?? dirname(manifestPath), check.rubric);
       const bytes = await readFile(path).catch(() => void 0);
       if (bytes) rubrics.push({ check: check.id, path: check.rubric, sha256: sha256Hex(bytes) });
     }
@@ -46810,7 +48052,8 @@ function createReviewRunner(opts) {
       if (!await isDirty(root)) {
         const hit = await ledger.lookupCached(
           { repoRemote, manifestSha: mSha, binding: binding.name, rangeSha: rangeSha({ baseSha, headSha: headNow }) },
-          rubrics
+          rubrics,
+          packDigests
         );
         if (hit) {
           run.attestation = hit.attestation;
@@ -46820,6 +48063,7 @@ function createReviewRunner(opts) {
         }
       }
     }
+    const composeEnabled = input.nocache ? false : input.compose ?? true;
     let dirty = false;
     const runDir = join(ledger.root, repoSlug(repoRemote), "runs", run.runId);
     const compiled = compileReview(manifest, {
@@ -46840,7 +48084,8 @@ function createReviewRunner(opts) {
         manifestPath,
         runDir,
         ...opts.reviewers ? { reviewers: opts.reviewers } : {},
-        ...input.parentSessionId ? { parentSessionId: input.parentSessionId } : {}
+        ...input.parentSessionId ? { parentSessionId: input.parentSessionId } : {},
+        compose: { enabled: composeEnabled, ledger, manifestSha: mSha, binding: binding.name, rubrics, packByNamespace }
       }),
       onLaneSettled: (lane) => {
         run.lanes = [...run.lanes, lane];
@@ -46860,7 +48105,7 @@ function createReviewRunner(opts) {
       ...requesterSessionId ? { sessionId: requesterSessionId } : {},
       ...gitAuthor ? { gitAuthor } : {}
     };
-    const attestation = buildAttestation({
+    const unsigned = buildAttestation({
       runId: run.runId,
       reviewId: manifest.id,
       manifestSha: mSha,
@@ -46870,10 +48115,19 @@ function createReviewRunner(opts) {
       lanes: outcome.lanes,
       attestor: { daemon: daemonId, presets: outcome.lanes.flatMap((l) => l.preset ? [l.preset] : []) },
       rubrics,
+      packs: packDigests,
       dirty,
       requester,
       ...input.pr ? { pr: input.pr } : {}
     });
+    const principal = await resolvePrincipal({ repoRoot: root, configuredPrincipal: opts.signingPrincipal });
+    const signed = await signAttestation(unsigned, {
+      principal,
+      ...opts.signingKeysDir ? { keysDir: opts.signingKeysDir } : {},
+      ...opts.signingEnv ? { env: opts.signingEnv } : {}
+    });
+    if (signed.error) run.signingError = signed.error;
+    const attestation = signed.signature ? { ...unsigned, attestor: { ...unsigned.attestor, signature: signed.signature } } : unsigned;
     const entry = {
       attestation,
       host: {
@@ -47108,7 +48362,7 @@ function jsonContent2(payload) {
 function errorContent(message) {
   return { content: [{ type: "text", text: JSON.stringify({ error: message }) }], isError: true };
 }
-var errMessage = (err) => err instanceof Error ? err.message : String(err);
+var errMessage2 = (err) => err instanceof Error ? err.message : String(err);
 function runView(run) {
   return {
     runId: run.runId,
@@ -47118,6 +48372,7 @@ function runView(run) {
     ...run.attestation ? { verdict: run.attestation.verdict } : {},
     ...run.cached ? { cached: true } : {},
     ...run.error ? { error: run.error } : {},
+    ...run.signingError ? { signingError: run.signingError } : {},
     ...run.supersededBy ? { supersededBy: run.supersededBy } : {},
     ...run.status === "running" ? { lanes: run.lanes.map((l) => ({ id: l.id, status: l.status })) } : {},
     ...run.attestation ? { attestation: run.attestation } : {},
@@ -47144,6 +48399,9 @@ function ledgerRow(entry, annotations = {}) {
     ...a.requester ? { requester: a.requester } : {},
     ...pr ? { pr } : {},
     ...lastPrStatus ? { prState: lastPrStatus.state } : {},
+    // Compact signed/unsigned indicator — the full signature (and any
+    // composedFrom lane detail) lives on the full attestation (review_export).
+    signed: !!a.attestor.signature,
     lanes: a.lanes.map((l) => ({ id: l.id, status: l.status, blocking: l.blocking }))
   };
 }
@@ -47201,14 +48459,14 @@ async function reviewLedgerView(runner, input, opts = {}) {
     root = repo.root;
     repoRemote ??= repo.repoRemote;
   }
-  let rangeSha2;
+  let rangeSha3;
   if (input.range !== void 0) {
-    rangeSha2 = await resolveRangeSha(input.range, root);
+    rangeSha3 = await resolveRangeSha(input.range, root);
   }
   const requesterSessionIds = input.requesterSessionId ? input.subtree && opts.resolveSubtree ? [...opts.resolveSubtree(input.requesterSessionId)] : [input.requesterSessionId] : void 0;
   const entries = await runner.ledger.list({
     ...repoRemote !== void 0 ? { repoRemote } : {},
-    ...rangeSha2 !== void 0 ? { rangeSha: rangeSha2 } : {},
+    ...rangeSha3 !== void 0 ? { rangeSha: rangeSha3 } : {},
     ...input.binding !== void 0 ? { binding: input.binding } : {},
     ...requesterSessionIds ? { requesterSessionIds } : {}
   });
@@ -47236,7 +48494,10 @@ function registerReviewTools(server, opts) {
       binding: z.string().optional().describe("Binding to run (e.g. local, ci). Default: the sole binding, or `default`."),
       base: z.string().optional().describe("Range base ref/sha. Default: merge-base(<manifest target.base>, HEAD)."),
       head: z.string().optional().describe("Range head ref/sha. Default: HEAD, resolved after the prepare phase."),
-      nocache: z.boolean().optional().describe("Ignore a cached ledger verdict and re-run. Default false."),
+      nocache: z.boolean().optional().describe("Ignore a cached ledger verdict and re-run. Default false. Implies compose:false."),
+      compose: z.boolean().optional().describe(
+        "Let an agent lane reuse a prior passing attestation and review only the delta on top of it (attestation composition \u2014 see LaneResult.composedFrom). Default true. Command lanes are never composed. Ignored (false) when `nocache` is set."
+      ),
       wait: z.boolean().optional().describe("Block until the review finishes (default true). false \u21D2 return a runId immediately."),
       requesterSessionId: z.string().optional().describe("Session recorded as attestation.requester.sessionId. Default: the calling session."),
       pr: prRefSchema.optional().describe(
@@ -47255,6 +48516,7 @@ function registerReviewTools(server, opts) {
           ...input.base !== void 0 ? { base: input.base } : {},
           ...input.head !== void 0 ? { head: input.head } : {},
           ...input.nocache ? { nocache: true } : {},
+          ...input.compose !== void 0 ? { compose: input.compose } : {},
           ...callerSessionId ? { parentSessionId: callerSessionId } : {},
           ...input.requesterSessionId !== void 0 ? { requesterSessionId: input.requesterSessionId } : {},
           ...input.pr ? { pr: input.pr } : {},
@@ -47265,7 +48527,7 @@ function registerReviewTools(server, opts) {
         const view2 = runView(finished);
         return finished.status === "failed" ? { ...jsonContent2(view2), isError: true } : jsonContent2(view2);
       } catch (err) {
-        return errorContent(`review_run failed: ${errMessage(err)}`);
+        return errorContent(`review_run failed: ${errMessage2(err)}`);
       }
     }
   );
@@ -47312,7 +48574,7 @@ function registerReviewTools(server, opts) {
       try {
         return jsonContent2(await reviewLedgerView(runner, input, { resolveSubtree }));
       } catch (err) {
-        return errorContent(`review_ledger failed: ${errMessage(err)}`);
+        return errorContent(`review_ledger failed: ${errMessage2(err)}`);
       }
     }
   );
@@ -47373,7 +48635,7 @@ function registerReviewTools(server, opts) {
 `, "utf8");
         return jsonContent2({ path: outPath, runId: attestation.runId, verdict: attestation.verdict });
       } catch (err) {
-        return errorContent(`review_export failed: ${errMessage(err)}`);
+        return errorContent(`review_export failed: ${errMessage2(err)}`);
       }
     }
   );
@@ -47404,8 +48666,8 @@ function registerReviewTools(server, opts) {
           if (run?.attestation) entry = await runner.ledger.get(ledgerKeyOf(run.attestation));
           if (!entry) return errorContent(`review_pr: no recorded attestation for run '${input.runId}'`);
         } else if (input.rangeSha !== void 0 || input.range !== void 0) {
-          const rangeSha2 = await resolveRangeSha(input.rangeSha ?? input.range, root);
-          entry = (await scoped({ rangeSha: rangeSha2 }))[0];
+          const rangeSha3 = await resolveRangeSha(input.rangeSha ?? input.range, root);
+          entry = (await scoped({ rangeSha: rangeSha3 }))[0];
           if (!entry) return errorContent("review_pr: no recorded attestation for that range");
         } else if (input.prUrl) {
           const parsed = parsePrUrl(input.prUrl);
@@ -47489,7 +48751,7 @@ function registerReviewTools(server, opts) {
           });
         }
       } catch (err) {
-        return errorContent(`review_pr failed: ${errMessage(err)}`);
+        return errorContent(`review_pr failed: ${errMessage2(err)}`);
       }
     }
   );
@@ -47796,14 +49058,14 @@ function createActivityProjector(opts) {
       if (current && isTerminalActivityState(current.state)) {
         return Promise.resolve(current);
       }
-      return new Promise((resolve37) => {
+      return new Promise((resolve38) => {
         let settled = false;
         const finish = (value) => {
           if (settled) return;
           settled = true;
           clearTimeout(timer);
           unsubscribeWait();
-          resolve37(value);
+          resolve38(value);
         };
         const timer = setTimeout(() => finish(null), timeoutMs);
         const unsubscribeWait = opts.sessionEvents.on("activity:changed", (ev) => {
@@ -47978,11 +49240,11 @@ function createInboundWatcher(opts) {
         return;
       }
       const raw = out.result;
-      const text12 = raw?.content?.find((c) => c.type === "text")?.text;
-      if (!text12) return;
+      const text13 = raw?.content?.find((c) => c.type === "text")?.text;
+      if (!text13) return;
       let data;
       try {
-        data = JSON.parse(text12);
+        data = JSON.parse(text13);
       } catch {
         return;
       }
@@ -48267,9 +49529,9 @@ function createRoutineRegistrar(opts) {
       const call = routineTargetToToolCall(found2.frontmatter.target, routineId);
       const result = await dispatchTool(call.tool, call.inputs);
       const r = result;
-      const text12 = (r?.content ?? []).map((c) => c.text ?? "").join("\n").trim();
+      const text13 = (r?.content ?? []).map((c) => c.text ?? "").join("\n").trim();
       const ok3 = !r?.isError;
-      return { ok: ok3, summary: text12 || (ok3 ? `tool '${call.tool}' ok` : `tool '${call.tool}' failed`) };
+      return { ok: ok3, summary: text13 || (ok3 ? `tool '${call.tool}' ok` : `tool '${call.tool}' failed`) };
     },
     list() {
       return lastParsed.map((p) => p.frontmatter);
@@ -48557,7 +49819,7 @@ async function registerBuiltinRoutes(opts) {
 
 // src/index.ts
 init_catalog_provider_models();
-function makeBrowserHandle(entry, resolve37) {
+function makeBrowserHandle(entry, resolve38) {
   return {
     slug: entry.id,
     name: entry.name,
@@ -48568,7 +49830,7 @@ function makeBrowserHandle(entry, resolve37) {
     // check() is available for on-demand health probes but is never called
     // by the lister (kit invariant OQ-5). Returns true when the adapter
     // is present in the injected resolver map, false otherwise.
-    check: async () => resolve37 ? resolve37(entry.id) != null : true
+    check: async () => resolve38 ? resolve38(entry.id) != null : true
   };
 }
 var noopLedger = {
@@ -48913,13 +50175,13 @@ async function spawnCloudflaredUntil(argv, opts) {
   };
   let settled = false;
   let forwardedLen = 0;
-  return await new Promise((resolve37, reject) => {
+  return await new Promise((resolve38, reject) => {
     const poll = setInterval(() => {
-      const text12 = readAll();
+      const text13 = readAll();
       if (opts.onLog) {
-        const lastNl = text12.lastIndexOf("\n");
+        const lastNl = text13.lastIndexOf("\n");
         if (lastNl + 1 > forwardedLen) {
-          const chunk = text12.slice(forwardedLen, lastNl + 1);
+          const chunk = text13.slice(forwardedLen, lastNl + 1);
           for (const line of chunk.split(/\r?\n/)) {
             if (line.length > 0) opts.onLog(`[cloudflared] ${line}`);
           }
@@ -48927,11 +50189,11 @@ async function spawnCloudflaredUntil(argv, opts) {
         }
       }
       if (settled) return;
-      const m = text12.match(opts.readyRegex);
+      const m = text13.match(opts.readyRegex);
       if (m) {
         settled = true;
         clearTimeout(timer);
-        resolve37({ proc, match: m[0], stopTail: () => clearInterval(poll) });
+        resolve38({ proc, match: m[0], stopTail: () => clearInterval(poll) });
       }
     }, POLL_INTERVAL_MS2);
     if (poll.unref) poll.unref();
@@ -49068,15 +50330,15 @@ function quickTunnelProvider() {
         }
       }, 3e3);
       timer.unref();
-      await new Promise((resolve37) => {
+      await new Promise((resolve38) => {
         if (proc.exitCode !== null) {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
           return;
         }
         proc.once("exit", () => {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
         });
       });
     }
@@ -49271,7 +50533,7 @@ function buildMcpConfigSnippet2(endpoint, token) {
     2
   );
 }
-function text6(value) {
+function text7(value) {
   return {
     content: [
       {
@@ -49299,7 +50561,7 @@ function registerRemoteTools(server, opts) {
     },
     async ({ provider, targetPort, targetHost }) => {
       const result = await controller.enable({ provider, targetPort, targetHost });
-      return text6(result);
+      return text7(result);
     }
   );
   server.tool(
@@ -49308,7 +50570,7 @@ function registerRemoteTools(server, opts) {
     {},
     async () => {
       const result = await controller.disable();
-      return text6(result);
+      return text7(result);
     }
   );
   server.tool(
@@ -49316,11 +50578,11 @@ function registerRemoteTools(server, opts) {
     "Report whether a remote tunnel is active. When active: provider, public URL, supervised PID, createdAt. The bearer token itself is never returned by status \u2014 it was shown once at enable.",
     {},
     async () => {
-      return text6(controller.status());
+      return text7(controller.status());
     }
   );
 }
-function text7(value) {
+function text8(value) {
   return {
     content: [
       {
@@ -49350,7 +50612,7 @@ function registerPairingTools(server, opts) {
         ...rendezvous ? { rendezvousUrl: rendezvous } : {},
         ...host ? { scope: "host" } : {}
       });
-      return text7({
+      return text8({
         url: offer.url,
         fingerprint: offer.fingerprint,
         rendezvous: offer.rendezvousUrl,
@@ -49366,7 +50628,7 @@ function registerPairingTools(server, opts) {
     {},
     async () => {
       const pairings = await registry.list();
-      return text7({
+      return text8({
         pairings: pairings.map((p) => ({
           name: p.name,
           fingerprint: p.fingerprint,
@@ -49387,13 +50649,134 @@ function registerPairingTools(server, opts) {
     },
     async ({ target }) => {
       const revoked = await registry.revoke(target);
-      return text7(
+      return text8(
         revoked ? { ok: true, revoked: target } : { ok: false, message: `no pairing matched "${target}"` }
       );
     }
   );
 }
-function text8(value) {
+var HOP_BY_HOP = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "host"]);
+function collectHeaders(raw) {
+  const headers = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (v === void 0 || HOP_BY_HOP.has(k.toLowerCase())) continue;
+    headers[k] = Array.isArray(v) ? v.join(", ") : v;
+  }
+  return headers;
+}
+function isPrematureCloseError(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ERR_STREAM_PREMATURE_CLOSE";
+}
+async function readBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  if (chunks.length === 0) return void 0;
+  return new Uint8Array(Buffer.concat(chunks));
+}
+async function startDeviceSandboxBridge(opts) {
+  const { hostRegistry, target } = opts;
+  const server = createServer((req, res) => {
+    void handleRequest(req, res).catch((err) => {
+      if (res.writableEnded) return;
+      if (!res.headersSent) {
+        res.writeHead(502, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            error: "device_sandbox_bridge_failed",
+            message: err instanceof Error ? err.message : String(err)
+          })
+        );
+        return;
+      }
+      res.end();
+    });
+  });
+  async function handleRequest(req, res) {
+    const body = await readBody(req);
+    let upstream;
+    try {
+      upstream = await hostRegistry.forwardHttpStream(target, {
+        method: req.method ?? "GET",
+        path: `/device-spawn${req.url ?? "/"}`,
+        headers: collectHeaders(req.headers),
+        ...body ? { body } : {}
+      });
+    } catch (err) {
+      res.writeHead(502, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: "device_unreachable",
+          message: err instanceof Error ? err.message : String(err)
+        })
+      );
+      return;
+    }
+    const resHeaders = {};
+    for (const [k, v] of Object.entries(upstream.headers)) {
+      if (HOP_BY_HOP.has(k.toLowerCase()) || k.toLowerCase() === "content-length") continue;
+      resHeaders[k] = v;
+    }
+    res.writeHead(upstream.status, resHeaders);
+    try {
+      await pipeline(
+        Readable.fromWeb(upstream.body),
+        res
+      );
+    } catch (err) {
+      if (!isPrematureCloseError(err)) throw err;
+    }
+  }
+  const port = await getFreePort2();
+  await new Promise((resolve38, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => resolve38());
+  });
+  return {
+    mcpUrl: `http://127.0.0.1:${port}/mcp`,
+    async close() {
+      await new Promise((resolve38) => server.close(() => resolve38()));
+    }
+  };
+}
+async function getFreePort2() {
+  return new Promise((resolve38, reject) => {
+    const srv = createServer$1();
+    srv.once("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const address = srv.address();
+      if (address === null || typeof address === "string") {
+        srv.close(() => reject(new Error("failed to allocate a free port")));
+        return;
+      }
+      const { port } = address;
+      srv.close(() => resolve38(port));
+    });
+  });
+}
+
+// src/sandbox-providers/device.ts
+function createDeviceSandboxProvider(target, hostRegistry) {
+  return {
+    async boot(_spec, _opts) {
+      const hosts = await hostRegistry.list();
+      const known = hosts.some((h) => h.fingerprint === target || h.name === target);
+      if (!known) {
+        throw new Error(
+          `device sandbox: no paired host device matches "${target}" \u2014 run \`agentproto devices add <offer-url>\` here first (the offer must come from \`agentproto pair offer --host\` run ON that device). Check \`agentproto devices list\` for known devices.`
+        );
+      }
+      const bridge = await startDeviceSandboxBridge({ hostRegistry, target });
+      return {
+        mcpUrl: bridge.mcpUrl,
+        sandboxId: `device-${target}-${randomUUID()}`,
+        async stop() {
+          await bridge.close();
+        }
+      };
+    }
+  };
+}
+function text9(value) {
   return {
     content: [
       {
@@ -49411,7 +50794,7 @@ function registerDeviceTools(server, opts) {
     {},
     async () => {
       const devices = await registry.list();
-      return text8({ devices });
+      return text9({ devices });
     }
   );
   server.tool(
@@ -49424,9 +50807,9 @@ function registerDeviceTools(server, opts) {
     async ({ offerUrl, name }) => {
       try {
         const result = await registry.add(offerUrl, name);
-        return text8({ ok: true, ...result });
+        return text9({ ok: true, ...result });
       } catch (err) {
-        return text8({ ok: false, message: err instanceof Error ? err.message : String(err) });
+        return text9({ ok: false, message: err instanceof Error ? err.message : String(err) });
       }
     }
   );
@@ -49439,7 +50822,7 @@ function registerDeviceTools(server, opts) {
     },
     async ({ target, name }) => {
       const renamed = await registry.rename(target, name);
-      return text8(
+      return text9(
         renamed ? { ok: true, target, name } : { ok: false, message: `no device matched "${target}"` }
       );
     }
@@ -49452,14 +50835,14 @@ function registerDeviceTools(server, opts) {
     },
     async ({ target }) => {
       const revoked = await registry.revoke(target);
-      return text8(
+      return text9(
         revoked ? { ok: true, revoked: target } : { ok: false, message: `no device matched "${target}"` }
       );
     }
   );
   server.tool(
     "device_sessions",
-    "Read-only: a registered HOST device's own session list (compact), or (with sessionId) a tail of one session's output \u2014 forwarded live over the host's E2E channel (HostRegistry.forwardHttp), the same path device_add / `agentproto devices exec` uses. Rejects if the target isn't a registered host.",
+    "Read-only: a registered HOST device's own session list (compact), or (with sessionId) a tail of one session's output \u2014 forwarded live over the host's E2E channel (HostRegistry.forwardHttp), the same path device_add / `agentproto devices exec` uses. If the host is offline, falls back to the last successful response for this exact query (stale: true, capturedAt: when it was captured) instead of failing outright \u2014 still rejects if there's nothing cached, or the target isn't a registered host at all.",
     {
       target: z.string().describe("The host's fingerprint or name (see device_list)."),
       sessionId: z.string().optional().describe("Tail this session's output instead of listing all sessions."),
@@ -49474,12 +50857,13 @@ function registerDeviceTools(server, opts) {
       try {
         const res = await registry.forwardHttp(target, { method: "GET", path });
         const body = Buffer.from(res.body).toString("utf8");
+        const staleFields = res.stale ? { stale: true, capturedAt: res.capturedAt } : {};
         if (res.status !== 200) {
-          return text8({ ok: false, status: res.status, message: body });
+          return text9({ ok: false, status: res.status, message: body, ...staleFields });
         }
-        return text8({ ok: true, ...JSON.parse(body) });
+        return text9({ ok: true, ...staleFields, ...JSON.parse(body) });
       } catch (err) {
-        return text8({ ok: false, message: err instanceof Error ? err.message : String(err) });
+        return text9({ ok: false, message: err instanceof Error ? err.message : String(err) });
       }
     }
   );
@@ -49499,9 +50883,9 @@ function registerDeviceTools(server, opts) {
             ...ttlMs !== void 0 ? { ttlMs } : {},
             ...maxUses !== void 0 ? { maxUses } : {}
           });
-          return text8({ ok: true, ...created });
+          return text9({ ok: true, ...created });
         } catch (err) {
-          return text8({ ok: false, message: err instanceof Error ? err.message : String(err) });
+          return text9({ ok: false, message: err instanceof Error ? err.message : String(err) });
         }
       }
     );
@@ -49509,7 +50893,7 @@ function registerDeviceTools(server, opts) {
       "join_token_list",
       "List join tokens: id, name, createdAt, expiresAt, maxUses, useCount, lastUsedAt, revokedAt. Never returns the token's secret. Read-only.",
       {},
-      async () => text8({ tokens: await joinTokens.list() })
+      async () => text9({ tokens: await joinTokens.list() })
     );
     server.tool(
       "join_token_revoke",
@@ -49517,7 +50901,7 @@ function registerDeviceTools(server, opts) {
       { target: z.string().describe("The token's id or name (see join_token_list).") },
       async ({ target }) => {
         const revoked = await joinTokens.revoke(target);
-        return text8(
+        return text9(
           revoked ? { ok: true, revoked: target } : { ok: false, message: `no join token matched "${target}"` }
         );
       }
@@ -49526,7 +50910,7 @@ function registerDeviceTools(server, opts) {
 }
 
 // src/daemon-health-tools.ts
-function text9(value) {
+function text10(value) {
   return {
     content: [
       {
@@ -49542,7 +50926,7 @@ function registerDaemonHealthTools(server, opts) {
     "Cheap, side-effect-free liveness probe for this daemon. Returns the same fields as GET /health but in-process. `alive` is always true when the tool returns successfully; if the daemon is unreachable the failure is observed as a thrown/failed tool call at the transport level, not as a false field.",
     {},
     async () => {
-      return text9({
+      return text10({
         alive: true,
         status: "ok",
         workspace: opts.workspace,
@@ -49651,7 +51035,7 @@ function namedTunnelProvider(cfg) {
     async check() {
       const [bin, creds] = await Promise.all([
         cloudflaredOnPath2(),
-        fileExists2(credentialsFile)
+        fileExists3(credentialsFile)
       ]);
       return bin && creds;
     },
@@ -49730,15 +51114,15 @@ function namedTunnelProvider(cfg) {
         }
       }, 3e3);
       timer.unref();
-      await new Promise((resolve37) => {
+      await new Promise((resolve38) => {
         if (proc.exitCode !== null) {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
           return;
         }
         proc.once("exit", () => {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
         });
       });
     }
@@ -49752,7 +51136,7 @@ async function cloudflaredOnPath2() {
     return false;
   }
 }
-async function fileExists2(path) {
+async function fileExists3(path) {
   try {
     await access(path);
     return true;
@@ -49855,14 +51239,14 @@ function ngrokTunnelProvider(opts) {
       });
       child = proc;
       const forwardLogs = (chunk) => {
-        const text12 = chunk.toString("utf8");
-        for (const line of text12.split(/\r?\n/)) {
+        const text13 = chunk.toString("utf8");
+        for (const line of text13.split(/\r?\n/)) {
           if (line.length > 0) opts2.onLog?.(`[ngrok] ${line}`);
         }
       };
       proc.stderr?.on("data", forwardLogs);
       proc.stdout?.on("data", forwardLogs);
-      const url = await new Promise((resolve37, reject) => {
+      const url = await new Promise((resolve38, reject) => {
         let settled = false;
         const timer = setTimeout(() => {
           if (settled) return;
@@ -49890,7 +51274,7 @@ function ngrokTunnelProvider(opts) {
                 settled = true;
                 clearTimeout(timer);
                 if (apiPollHandle) clearInterval(apiPollHandle);
-                resolve37(pubUrl);
+                resolve38(pubUrl);
               }
             } catch {
             }
@@ -49899,16 +51283,16 @@ function ngrokTunnelProvider(opts) {
         };
         const onStdout = (chunk) => {
           if (settled) return;
-          const text12 = chunk.toString("utf8");
-          const reMatch = text12.match(URL_JSON_REGEX);
+          const text13 = chunk.toString("utf8");
+          const reMatch = text13.match(URL_JSON_REGEX);
           if (reMatch) {
             settled = true;
             clearTimeout(timer);
             if (apiPollHandle) clearInterval(apiPollHandle);
-            resolve37(reMatch[1]);
+            resolve38(reMatch[1]);
             return;
           }
-          for (const line of text12.split(/\r?\n/)) {
+          for (const line of text13.split(/\r?\n/)) {
             if (line.length === 0) continue;
             try {
               const parsed = JSON.parse(line);
@@ -49916,7 +51300,7 @@ function ngrokTunnelProvider(opts) {
                 settled = true;
                 clearTimeout(timer);
                 if (apiPollHandle) clearInterval(apiPollHandle);
-                resolve37(parsed.url);
+                resolve38(parsed.url);
                 return;
               }
             } catch {
@@ -49963,15 +51347,15 @@ function ngrokTunnelProvider(opts) {
         }
       }, 3e3);
       timer.unref();
-      await new Promise((resolve37) => {
+      await new Promise((resolve38) => {
         if (proc.exitCode !== null) {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
           return;
         }
         proc.once("exit", () => {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
         });
       });
     }
@@ -50341,7 +51725,7 @@ function makeStubProvider() {
     }
   };
 }
-function text10(value) {
+function text11(value) {
   return {
     content: [
       {
@@ -50416,7 +51800,7 @@ function registerTunnelTools(server, opts) {
           ...input.tunnelId ? { tunnelId: input.tunnelId } : {},
           ...input.credentialsFile ? { credentialsFile: input.credentialsFile } : {}
         });
-        return text10(desc);
+        return text11(desc);
       } catch (err) {
         return errText2("tunnel_create", err);
       }
@@ -50472,7 +51856,7 @@ function registerTunnelTools(server, opts) {
             isError: true
           };
         }
-        return text10({ ok: ok3, tunnelId: input.tunnelId });
+        return text11({ ok: ok3, tunnelId: input.tunnelId });
       } catch (err) {
         return errText2("tunnel_stop", err);
       }
@@ -50499,7 +51883,7 @@ function registerTunnelTools(server, opts) {
           isError: true
         };
       }
-      return text10(desc);
+      return text11(desc);
     }
   );
 }
@@ -51083,7 +52467,7 @@ function tailFile(path, n) {
     return "(no llm-endpoint output captured)";
   }
 }
-function text11(value) {
+function text12(value) {
   return {
     content: [
       {
@@ -51119,11 +52503,11 @@ function withLinksMap() {
     name: "withLinksMap",
     wrapHandler: (handler) => async (input) => {
       const result = await handler(input);
-      const text12 = result.content[0]?.text;
-      if (result.isError || text12 === void 0) return result;
+      const text13 = result.content[0]?.text;
+      if (result.isError || text13 === void 0) return result;
       let parsed;
       try {
-        parsed = JSON.parse(text12);
+        parsed = JSON.parse(text13);
       } catch {
         return result;
       }
@@ -51171,7 +52555,7 @@ function registerLlmEndpointTools(server, opts) {
           ...input.env ? { env: input.env } : {},
           ...input.binPath ? { binPath: input.binPath } : {}
         });
-        return text11(desc);
+        return text12(desc);
       } catch (err) {
         return errText3("llm_endpoint_start", err);
       }
@@ -51184,7 +52568,7 @@ function registerLlmEndpointTools(server, opts) {
     async () => {
       try {
         const ok3 = await registry.stop();
-        return text11({ ok: ok3 });
+        return text12({ ok: ok3 });
       } catch (err) {
         return errText3("llm_endpoint_stop", err);
       }
@@ -51197,7 +52581,7 @@ function registerLlmEndpointTools(server, opts) {
     async () => {
       try {
         const s = await registry.status();
-        return text11(s);
+        return text12(s);
       } catch (err) {
         return errText3("llm_endpoint_status", err);
       }
@@ -51230,7 +52614,7 @@ function registerLlmEndpointTools(server, opts) {
         }
         const s = await registry.status();
         const restartRequired = s.running;
-        return text11({
+        return text12({
           ok: true,
           provider,
           profileId,
@@ -51674,8 +53058,8 @@ function createPairingRegistry(deps2) {
         log(`[pairing] ignoring ${pairingsPath}: unrecognised format`);
       }
     } catch (err) {
-      if (!isEnoent(err)) {
-        log(`[pairing] could not read ${pairingsPath}: ${errMsg(err)}`);
+      if (!isEnoent2(err)) {
+        log(`[pairing] could not read ${pairingsPath}: ${errMsg2(err)}`);
       }
     }
   }
@@ -51705,7 +53089,7 @@ function createPairingRegistry(deps2) {
     if (loops.has(spec.key)) return;
     const abort = new AbortController();
     const done = runLoop(spec, abort.signal).catch((err) => {
-      log(`[pairing] loop ${spec.key} ended: ${errMsg(err)}`);
+      log(`[pairing] loop ${spec.key} ended: ${errMsg2(err)}`);
     });
     loops.set(spec.key, { abort, done });
   }
@@ -51728,7 +53112,7 @@ function createPairingRegistry(deps2) {
         if (signal.aborted) break;
         const line = dialFailureGate.onFailure(
           spec.key,
-          `[pairing] dial ${spec.key} failed: ${errMsg(err)}`
+          `[pairing] dial ${spec.key} failed: ${errMsg2(err)}`
         );
         if (line) log(line);
         await sleep(backoff, signal);
@@ -51808,7 +53192,7 @@ function createPairingRegistry(deps2) {
         try {
           ctx = await spec.onPaired(capturedSession, capturedHello);
         } catch (err) {
-          log(`[pairing] persist for ${spec.key} failed: ${errMsg(err)}`);
+          log(`[pairing] persist for ${spec.key} failed: ${errMsg2(err)}`);
           wrapped.close("persist failed");
           continue;
         }
@@ -51931,7 +53315,7 @@ function createPairingRegistry(deps2) {
           const existing = pairings.get(record2.fingerprint);
           if (existing) {
             existing.lastSeen = new Date(now()).toISOString();
-            await persist().catch((err) => log(`[pairing] lastSeen persist failed: ${errMsg(err)}`));
+            await persist().catch((err) => log(`[pairing] lastSeen persist failed: ${errMsg2(err)}`));
           }
           return {
             mode: "reconnect",
@@ -52057,8 +53441,8 @@ function createPairingRegistry(deps2) {
   return { createOffer, list, rename: renamePairing, revoke, isOnline, startAutoconnect, shutdown };
 }
 function dialUrl(rendezvousUrl, token) {
-  const sep5 = rendezvousUrl.includes("?") ? "&" : "?";
-  return `${rendezvousUrl}${sep5}side=daemon&t=${encodeURIComponent(token)}`;
+  const sep6 = rendezvousUrl.includes("?") ? "&" : "?";
+  return `${rendezvousUrl}${sep6}side=daemon&t=${encodeURIComponent(token)}`;
 }
 function sendOutdatedNotice(sink) {
   sink.send({ t: "error", code: "pairing_protocol_outdated", message: PAIRING_PROTOCOL_OUTDATED_MESSAGE });
@@ -52075,16 +53459,16 @@ function sendOutdatedNotice(sink) {
 }
 var REVOKED = /* @__PURE__ */ Symbol("pairing revoked");
 function waitClosed(sink, signal) {
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     if (!sink.isOpen) {
-      resolve37();
+      resolve38();
       return;
     }
     let settled = false;
     const finish = () => {
       if (settled) return;
       settled = true;
-      resolve37();
+      resolve38();
     };
     sink.onClose(() => finish());
     signal.addEventListener("abort", () => {
@@ -52099,13 +53483,13 @@ function waitClosed(sink, signal) {
   });
 }
 function sleep(ms, signal) {
-  return new Promise((resolve37) => {
-    if (signal.aborted) return resolve37();
-    const timer = setTimeout(resolve37, ms);
+  return new Promise((resolve38) => {
+    if (signal.aborted) return resolve38();
+    const timer = setTimeout(resolve38, ms);
     if (typeof timer.unref === "function") timer.unref();
     signal.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve37();
+      resolve38();
     });
   });
 }
@@ -52130,324 +53514,6 @@ function isRevokedRecord(v) {
     return typeof t["epoch"] === "number" && typeof t["route"] === "string" && typeof t["auth"] === "string";
   });
 }
-function isEnoent(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-}
-function errMsg(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-var HOSTS_VERSION = 1;
-var DIAL_TIMEOUT_MS = 15e3;
-var HANDSHAKE_TIMEOUT_MS = 15e3;
-function defaultHostsPath() {
-  return join(homedir(), ".agentproto", "hosts.json");
-}
-function rvUrl(base, route) {
-  const sep5 = base.includes("?") ? "&" : "?";
-  return `${base}${sep5}side=client&t=${encodeURIComponent(route)}`;
-}
-function defaultSelfName() {
-  try {
-    return hostname() || "agentproto-host-registry";
-  } catch {
-    return "agentproto-host-registry";
-  }
-}
-function createHostRegistry(deps2) {
-  const hostsPath = deps2.hostsPath ?? defaultHostsPath();
-  const now = deps2.now ?? Date.now;
-  const log = deps2.log ?? (() => {
-  });
-  const dialTimeoutMs = deps2.dialTimeoutMs ?? DIAL_TIMEOUT_MS;
-  const handshakeTimeoutMs = deps2.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS;
-  const selfName = defaultSelfName();
-  const hosts = /* @__PURE__ */ new Map();
-  const onlineCounts = /* @__PURE__ */ new Map();
-  let loaded = false;
-  async function ensureLoaded() {
-    if (loaded) return;
-    loaded = true;
-    try {
-      const raw = await readFile(hostsPath, "utf8");
-      const parsed = JSON.parse(raw);
-      if (isHostsFile(parsed)) {
-        for (const rec of parsed.hosts) hosts.set(rec.fingerprint, rec);
-      } else {
-        log(`[hosts] ignoring ${hostsPath}: unrecognised format`);
-      }
-    } catch (err) {
-      if (!isEnoent2(err)) log(`[hosts] could not read ${hostsPath}: ${errMsg2(err)}`);
-    }
-  }
-  let persistChain = Promise.resolve();
-  function persist() {
-    const run = persistChain.then(doPersist);
-    persistChain = run.catch(() => {
-    });
-    return run;
-  }
-  async function doPersist() {
-    const file = { v: HOSTS_VERSION, hosts: Array.from(hosts.values()) };
-    const dir = dirname(hostsPath);
-    await mkdir(dir, { recursive: true });
-    const tmp = join(dir, `.${basename(hostsPath)}.tmp-${process.pid}`);
-    await writeFile(tmp, JSON.stringify(file, null, 2) + "\n", { encoding: "utf8", mode: 384 });
-    await chmod(tmp, 384).catch(() => {
-    });
-    await rename(tmp, hostsPath);
-  }
-  function findHost(idOrName) {
-    const byFp = hosts.get(idOrName);
-    if (byFp) return byFp;
-    for (const rec of hosts.values()) if (rec.name === idOrName) return rec;
-    return void 0;
-  }
-  async function dialWithTimeout(wsUrl) {
-    const ac = new AbortController();
-    const timer = setTimeout(() => ac.abort(new Error(`dial timed out after ${dialTimeoutMs}ms`)), dialTimeoutMs);
-    if (typeof timer.unref === "function") timer.unref();
-    try {
-      return await deps2.dial(wsUrl, ac.signal);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  async function add(offerUrl, name, meta) {
-    await ensureLoaded();
-    const offer = await parseOfferUrl(offerUrl, { now: now() });
-    if (offer.scope !== "host") {
-      throw new Error(
-        "this offer is not host-scoped \u2014 it only grants remote-control access, not host registration; ask the other machine to run `agentproto pair offer --host` and use that offer instead"
-      );
-    }
-    const { route, auth } = await deriveOfferTokens(offer.secret);
-    const raw = await dialWithTimeout(rvUrl(offer.rendezvousUrl, route));
-    const started = await startClientHandshake({
-      daemonX25519Pub: offer.daemonX25519Pub,
-      daemonEd25519Pub: offer.daemonEd25519Pub,
-      authToken: auth,
-      clientName: name ?? selfName
-    });
-    let session = null;
-    const wrapped = await clientHandshakeOverSink(
-      raw,
-      encodePairingMessage(started.hello),
-      async (replyBytes) => {
-        session = await started.complete(decodePairingReply(replyBytes));
-        return session;
-      },
-      { timeoutMs: handshakeTimeoutMs }
-    );
-    if (!session) throw new Error("handshake did not derive a session");
-    const derived = session;
-    if (derived.peerFingerprint !== offer.fingerprint) {
-      wrapped.close("fingerprint mismatch");
-      throw new Error(
-        `host fingerprint ${derived.peerFingerprint} does not match the offer's ${offer.fingerprint}`
-      );
-    }
-    const pairRoot = await derivePairRoot(derived);
-    const nowIso2 = new Date(now()).toISOString();
-    const record2 = {
-      fingerprint: offer.fingerprint,
-      name: name ?? offer.fingerprint,
-      daemonX25519Pub: offer.daemonX25519Pub,
-      daemonEd25519Pub: offer.daemonEd25519Pub,
-      rendezvousUrl: offer.rendezvousUrl,
-      pairRoot,
-      createdAt: hosts.get(offer.fingerprint)?.createdAt ?? nowIso2,
-      lastSeen: nowIso2,
-      ...meta?.provider ? { provider: meta.provider } : {},
-      ...meta?.sandboxId ? { sandboxId: meta.sandboxId } : {},
-      ...meta?.labels ? { labels: meta.labels } : {}
-    };
-    hosts.set(record2.fingerprint, record2);
-    await persist();
-    log(`[hosts] added ${record2.fingerprint} (${record2.name})`);
-    wrapped.close("add complete");
-    return { fingerprint: record2.fingerprint, name: record2.name, rendezvousUrl: record2.rendezvousUrl };
-  }
-  async function list() {
-    await ensureLoaded();
-    return Array.from(hosts.values()).map((r) => ({ ...r }));
-  }
-  async function renameHost(idOrName, newName) {
-    const trimmed = newName.trim();
-    if (!trimmed) throw new Error("host name must not be empty");
-    await ensureLoaded();
-    const target = findHost(idOrName);
-    if (!target) return false;
-    target.name = trimmed;
-    await persist();
-    log(`[hosts] renamed ${target.fingerprint} to "${trimmed}"`);
-    return true;
-  }
-  async function revoke(idOrName) {
-    await ensureLoaded();
-    const target = findHost(idOrName);
-    if (!target) return false;
-    hosts.delete(target.fingerprint);
-    await persist();
-    log(`[hosts] revoked ${target.fingerprint} (${target.name})`);
-    return true;
-  }
-  function isOnline(fingerprint) {
-    return (onlineCounts.get(fingerprint) ?? 0) > 0;
-  }
-  async function connectToHost(record2) {
-    const epoch = currentEpoch(now());
-    const attempts = [epoch, epoch - 1];
-    let lastErr;
-    let hungUpOnHello = 0;
-    for (const e of attempts) {
-      const { route, auth } = await deriveEpochTokens(record2.pairRoot, e);
-      let raw;
-      try {
-        raw = await dialWithTimeout(rvUrl(record2.rendezvousUrl, route));
-      } catch (err) {
-        lastErr = err;
-        continue;
-      }
-      try {
-        const started = await startClientHandshake({
-          daemonX25519Pub: record2.daemonX25519Pub,
-          daemonEd25519Pub: record2.daemonEd25519Pub,
-          authToken: auth,
-          clientName: record2.name
-        });
-        const wrapped = await clientHandshakeOverSink(
-          raw,
-          encodePairingMessage(started.hello),
-          (replyBytes) => started.complete(decodePairingReply(replyBytes)),
-          { timeoutMs: handshakeTimeoutMs }
-        );
-        const client = createTunnelClient({ sink: wrapped });
-        await client.ready();
-        record2.lastSeen = new Date(now()).toISOString();
-        await persist().catch((err) => log(`[hosts] lastSeen persist failed: ${errMsg2(err)}`));
-        return client;
-      } catch (err) {
-        lastErr = err;
-        if (err instanceof Error && /transport closed during handshake/.test(err.message)) hungUpOnHello++;
-        try {
-          raw.close("handshake failed");
-        } catch {
-        }
-      }
-    }
-    const hint = hungUpOnHello === attempts.length ? ` \u2014 the host hung up on the pair/v2 hello; if it runs an older agentproto (pair/v1), upgrade it and re-pair: run \`agentproto pair offer --host\` on the host, then \`agentproto devices add\` here. (${PAIRING_PROTOCOL_OUTDATED_MESSAGE})` : "";
-    throw new Error(
-      `could not reach host ${record2.fingerprint} via ${record2.rendezvousUrl}: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}${hint}`
-    );
-  }
-  function toTunnelReq(req) {
-    return {
-      method: req.method,
-      path: req.path,
-      ...req.headers ? { headers: req.headers } : {},
-      ...req.body ? { body: Buffer.from(req.body) } : {}
-    };
-  }
-  async function forwardHttp(idOrName, req) {
-    await ensureLoaded();
-    const record2 = findHost(idOrName);
-    if (!record2) throw new Error(`no host matched "${idOrName}"`);
-    onlineCounts.set(record2.fingerprint, (onlineCounts.get(record2.fingerprint) ?? 0) + 1);
-    let client;
-    try {
-      client = await connectToHost(record2);
-      const res = await client.forwardHttp(toTunnelReq(req));
-      return { status: res.status, headers: { ...res.headers }, body: new Uint8Array(res.body) };
-    } finally {
-      if (client) await client.close().catch(() => {
-      });
-      const remaining = (onlineCounts.get(record2.fingerprint) ?? 1) - 1;
-      if (remaining > 0) onlineCounts.set(record2.fingerprint, remaining);
-      else onlineCounts.delete(record2.fingerprint);
-    }
-  }
-  async function forwardHttpStream(idOrName, req) {
-    await ensureLoaded();
-    const record2 = findHost(idOrName);
-    if (!record2) throw new Error(`no host matched "${idOrName}"`);
-    onlineCounts.set(record2.fingerprint, (onlineCounts.get(record2.fingerprint) ?? 0) + 1);
-    let decremented = false;
-    const decrement = () => {
-      if (decremented) return;
-      decremented = true;
-      const remaining = (onlineCounts.get(record2.fingerprint) ?? 1) - 1;
-      if (remaining > 0) onlineCounts.set(record2.fingerprint, remaining);
-      else onlineCounts.delete(record2.fingerprint);
-    };
-    let client;
-    try {
-      client = await connectToHost(record2);
-    } catch (err) {
-      decrement();
-      throw err;
-    }
-    let res;
-    try {
-      res = await client.forwardHttpStream(toTunnelReq(req));
-    } catch (err) {
-      await client.close().catch(() => {
-      });
-      decrement();
-      throw err;
-    }
-    const cleanup = () => {
-      void client.close().catch(() => {
-      });
-      decrement();
-    };
-    return { status: res.status, headers: { ...res.headers }, body: wrapStreamWithCleanup(res.body, cleanup) };
-  }
-  return { add, list, rename: renameHost, revoke, isOnline, forwardHttp, forwardHttpStream };
-}
-function wrapStreamWithCleanup(source, cleanup) {
-  const reader = source.getReader();
-  let cleanedUp = false;
-  const runCleanup = () => {
-    if (cleanedUp) return;
-    cleanedUp = true;
-    cleanup();
-  };
-  return new ReadableStream({
-    async pull(controller) {
-      try {
-        const { done, value } = await reader.read();
-        if (done) {
-          controller.close();
-          runCleanup();
-          return;
-        }
-        controller.enqueue(value);
-      } catch (err) {
-        controller.error(err);
-        runCleanup();
-      }
-    },
-    async cancel(reason) {
-      try {
-        await reader.cancel(reason);
-      } finally {
-        runCleanup();
-      }
-    }
-  });
-}
-function isHostsFile(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const rec = v;
-  if (rec["v"] !== HOSTS_VERSION) return false;
-  if (!Array.isArray(rec["hosts"])) return false;
-  return rec["hosts"].every(isHostRecord);
-}
-function isHostRecord(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const r = v;
-  return typeof r["fingerprint"] === "string" && typeof r["name"] === "string" && typeof r["daemonX25519Pub"] === "string" && typeof r["daemonEd25519Pub"] === "string" && typeof r["rendezvousUrl"] === "string" && typeof r["pairRoot"] === "string" && typeof r["createdAt"] === "string" && typeof r["lastSeen"] === "string";
-}
 function isEnoent2(err) {
   return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
@@ -52472,8 +53538,8 @@ function constantTimeEqual2(a, b) {
   return timingSafeEqual(da, db);
 }
 function dialUrl2(rendezvousUrl, route) {
-  const sep5 = rendezvousUrl.includes("?") ? "&" : "?";
-  return `${rendezvousUrl}${sep5}side=daemon&t=${encodeURIComponent(route)}`;
+  const sep6 = rendezvousUrl.includes("?") ? "&" : "?";
+  return `${rendezvousUrl}${sep6}side=daemon&t=${encodeURIComponent(route)}`;
 }
 function parseJoinHello(clientName) {
   if (!clientName) return null;
@@ -52630,17 +53696,29 @@ function createJoinTokenRegistry(deps2) {
       log(`[join-tokens] "${record2.name}": joined box sent no self-offer \u2014 nothing added`);
       return;
     }
-    const name = typeof hello.name === "string" && hello.name ? hello.name : void 0;
     const meta = {
+      joined: true,
       ...typeof hello.provider === "string" && hello.provider ? { provider: hello.provider } : {},
       ...typeof hello.sandboxId === "string" && hello.sandboxId ? { sandboxId: hello.sandboxId } : {},
       ...isPlainStringRecord(hello.labels) ? { labels: hello.labels } : {}
     };
+    const name = typeof hello.name === "string" && hello.name ? hello.name : meta.labels?.["pr"] ? `${record2.name} #${meta.labels["pr"]}` : record2.name;
     try {
       await deps2.addHost(hello.offerUrl, name, meta);
       log(`[join-tokens] "${record2.name}": added host via join (self-reported name "${name ?? "(none)"}")`);
+      if (record2.lastJoinError !== void 0 || record2.lastJoinErrorAt !== void 0) {
+        delete record2.lastJoinError;
+        delete record2.lastJoinErrorAt;
+        await persist();
+      }
     } catch (err) {
-      log(`[join-tokens] "${record2.name}": adding the joined box as a host failed: ${errMsg3(err)}`);
+      const message = errMsg3(err);
+      log(
+        `[join-tokens] "${record2.name}": ADDING THE JOINED BOX AS A HOST FAILED (useCount bumped, no device recorded \u2014 visible via join_token_list until the next successful join): ${message}`
+      );
+      record2.lastJoinError = message;
+      record2.lastJoinErrorAt = new Date(now()).toISOString();
+      await persist();
     }
   }
   async function runAcceptLoop(record2, signal) {
@@ -52718,13 +53796,13 @@ function createJoinTokenRegistry(deps2) {
   return { create, list, revoke, startAutoconnect, shutdown };
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve37) => {
-    if (signal.aborted) return resolve37();
-    const timer = setTimeout(resolve37, ms);
+  return new Promise((resolve38) => {
+    if (signal.aborted) return resolve38();
+    const timer = setTimeout(resolve38, ms);
     if (typeof timer.unref === "function") timer.unref();
     signal.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve37();
+      resolve38();
     });
   });
 }
@@ -52864,7 +53942,35 @@ async function createGateway(opts) {
   const port = opts.port ?? 18790;
   const token = opts.token ?? randomUUID();
   const daemonMcpUrl = `http://127.0.0.1:${port}/mcp`;
-  const resolveSandboxProviderResolved = opts.resolveSandboxProvider ?? makeSandboxResolver(makeSandboxCredsStore());
+  const baseSandboxProviderResolver = opts.resolveSandboxProvider ?? makeSandboxResolver(makeSandboxCredsStore());
+  const resolveSandboxProviderResolved = async (slug) => {
+    if (slug.startsWith("device:")) {
+      const deviceName = slug.slice("device:".length);
+      if (!opts.hostRegistry || deviceName.length === 0) return null;
+      return {
+        provider: createDeviceSandboxProvider(deviceName, opts.hostRegistry),
+        slug,
+        name: deviceName,
+        version: "builtin",
+        description: `Spawns and proxies an agent session on the paired host device "${deviceName}" over its pair/v2 channel.`,
+        requiresSetup: false,
+        capabilities: {
+          networkEgress: true,
+          mounts: false,
+          lifecyclePause: false,
+          readOnly: false
+        },
+        // See that field's doc — a device's filesystem is disjoint from the
+        // driving daemon's; forwarding a HOST-shaped implicit cwd would
+        // almost always ENOENT there.
+        omitCwdWhenImplicit: true,
+        async check() {
+          return true;
+        }
+      };
+    }
+    return baseSandboxProviderResolver(slug);
+  };
   const { httpOrigin: publicHttpOrigin, wsOrigin: ptyWsBaseUrl } = resolvePublicAppOrigins(port);
   const events = createRuntimeEvents();
   const conversations = fileConversationStore({ workspace });
@@ -53172,12 +54278,16 @@ async function createGateway(opts) {
       persist ? {} : { root: join(tmpdir(), `agentproto-reviews-${process.pid}-${randomUUID()}`) }
     ),
     daemonId: `agentproto-runtime@${hostname()}:${port}`,
+    // A test gateway (`persist: false`) signs with a throwaway keypair, same
+    // as its ledger — never the real `~/.agentproto/keys`.
+    ...persist ? {} : { signingKeysDir: join(tmpdir(), `agentproto-review-keys-${process.pid}-${randomUUID()}`) },
+    ...daemonConfig.review?.principal ? { signingPrincipal: daemonConfig.review.principal } : {},
     // Display-only settle notice (Goal A item 4, review-session-panel step):
     // a daemon-authored `notice` in the requester's own transcript, never a
     // prompt/inbox delivery — see `SessionsRegistry.recordNotice`'s doc for
     // why this can't wake an idle session or interrupt a busy one.
-    notifyRequester: (sessionId, text12) => {
-      sessions.recordNotice(sessionId, text12);
+    notifyRequester: (sessionId, text13) => {
+      sessions.recordNotice(sessionId, text13);
     },
     ...opts.resolveAgentAdapter ? {
       reviewers: createDaemonReviewerHost({
@@ -53420,6 +54530,7 @@ async function createGateway(opts) {
     registerAuthProfileTools(server);
     registerConfigTools(server, configToolsDeps);
     registerHarnessPresetTools(server);
+    registerUserPresetTools(server, { registry: sessions });
     registerCredentialDiscoveryTools(server);
     registerWebSearchTools(server);
     registerBrowserTools(server, {
@@ -53686,6 +54797,7 @@ async function createGateway(opts) {
     },
     ...llmEndpoint ? { llmEndpoint } : {},
     ...opts.deviceInferenceShare ? { deviceInferenceShare: true } : {},
+    ...opts.deviceSpawnAllow ? { deviceSpawnAllow: true } : {},
     remote,
     ...opts.pairingRegistry ? { pairings: opts.pairingRegistry } : {},
     ...opts.hostRegistry ? { hostRegistry: opts.hostRegistry } : {},
@@ -53980,6 +55092,6 @@ var export_providersPath = providers_store_exports.providersPath;
 var export_removeProviderKey = providers_store_exports.removeProviderKey;
 var export_setProviderKey = providers_store_exports.setProviderKey;
 
-export { AnthropicRemainingQuotaReader, AuthResolutionError, BUCKETS_ROOT, CLAUDE_CODE_OAUTH_SOURCE, CONTINUE_PROMPT_SOURCE, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, GC_REAPABLE_STATES, HOSTS_VERSION, HOST_SCOPE_HEADER, HarnessPresetValidationError, INBOUND_PROVIDERS, JOIN_TOKENS_VERSION, LEGACY_SESSIONS_FILE, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, PrLookupError, ResumeDisabledError, SESSION_END_REASONS, SESSION_ID_ENV, SubscriptionSourceError, TASK_STATUSES, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, activityCounts, addHarnessPreset, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogModels, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeMode, composeSessionObservers, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDeviceRegistry, createFileStepCache, createGateway, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, decomposeMode, defaultReviewLedgerRoot, defineBraveSearchHttpDriver, defineSerperHttpDriver, deleteUserPreset, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileConversationStore, filterActivities, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, export_getProviderKey as getProviderKey, getToolHelp, getUserPreset, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, listUserPresets, loadHarnessPresets, export_loadProviders as loadProviders, loadQuotaStore, loadUserPresets, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeSkillsOption, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseDuration, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readConversationIndex, readDaemonRegistry, readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, export_removeProviderKey as removeProviderKey, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveAuthSpec, resolveBucketSlug, resolveDeferredToolsGatewayOption, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, resolveSpawnDefaults, resolveSubscriptionCredential, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, saveUserPreset, setDefaultPreset, setMcpCredentialDeps, export_setProviderKey as setProviderKey, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, userPresetsPath, verifyInboundSignature, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };
+export { AnthropicRemainingQuotaReader, AuthResolutionError, BUCKETS_ROOT, CLAUDE_CODE_OAUTH_SOURCE, CONTINUE_PROMPT_SOURCE, DEAD_SESSION_STATUSES, DEFAULT_ALWAYS_ON_TOOLS, DEFAULT_BUCKET, DEFAULT_CONTINUE_PROMPT, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, GC_REAPABLE_STATES, HOSTS_VERSION, HOST_SCOPE_HEADER, HarnessPresetValidationError, INBOUND_PROVIDERS, JOIN_TOKENS_VERSION, LEGACY_SESSIONS_FILE, MAX_AUTO_CONTINUE_ATTEMPTS, MAX_MESSAGE_DATA_BYTES, MCP_APP_BRIDGE_SCRIPT, MESSAGE_KINDS, MESSAGE_PREAMBLE, MESSAGE_TAG, MESSAGE_URGENCIES, PAIRINGS_VERSION, POSTURE_NATIVE_ALIASES, POSTURE_PREAMBLES, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, PrLookupError, ResumeDisabledError, SESSION_END_REASONS, SESSION_ID_ENV, SIGN_NAMESPACE, SubscriptionSourceError, TASK_STATUSES, WORKSPACE_SLUG_ENV, WORKTREE_ISOLATION_ENV, activityCounts, addHarnessPreset, allowedSignersLine, appendConversationRecord, attachSandbox, bucketDir, bucketSessionsFile, bucketTranscriptDir, buildCatalogModels, buildCatalogProviderModels, buildMcpConfigSnippet, buildRouteAwareLaunchConfig, canonicalForModeId, claudeProjectSlug, collectGcCandidates, compactOutcome, composeMode, composeSessionObservers, composedFromRangeSha, continueInterruptedSessions, continueSkipReason, conversationIndexPath, createActivityProjector, createDaemonReviewerHost, createDeviceRegistry, createFileStepCache, createGateway, createHostRegistry, createInboundEndpointStore, createJoinTokenRegistry, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createPrProvenanceReconciler, createReconnectLogGate, createReviewLaneExecutor, createReviewLedger, createReviewPackLoader, createReviewRunner, createScopeTokenRegistry, createSessionMessage, createSupervisorTaskGateRunner, createTaskLedger, createWorkspaceBrainSubscriber, createWorkspaceBrains, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, decomposeMode, defaultReviewKeysDir, defaultReviewLedgerRoot, defaultReviewPackCacheDir, defineBraveSearchHttpDriver, defineSerperHttpDriver, deleteUserPreset, deriveSessionOutcome, deriveSessionUsage, enrichRollupWithProviderQuota, enrichWithRemainingQuota, ensureReviewSigningKey, escapeHumanPrompt, escapeMessageBody, evaluateCostBudget, execGh, extractHelpSection, fetchPrStatus, fileConversationStore, fileExists2 as fileExists, filterActivities, findComposeCandidate, findConversationRecord, findNativeMode, findPrForCommit, formatToolCall, formatToolResult, getDefaultHarnessPreset, getHarnessPreset, getMcpCredentialDeps, export_getProviderKey as getProviderKey, getToolHelp, getUserPreset, githubRepoOf, harnessPresetsPath, hostPlaceholders, injectMcpAppBridge, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isAgentCliAuthConfigured, isClosedTaskStatus, isKnownSessionEndReason, isMessageAllowed, isProviderLimitError, isSafeBucketSlug, isTerminalActivityState, listBuckets, listHarnessPresets, listPresets, listToolHelpTopics, listUserPresets, loadHarnessPresets, export_loadProviders as loadProviders, loadQuotaStore, loadUserPresets, loadWorktreeIsolation, locateConversationByNativePath, locateConversationBySessionId, makeBrowserAdapterLister, makeSandboxCredsStore, makeSandboxResolver, matchesMessageFilter, measureTool, measureToolList, messageFrom, migrateLegacySessionsFile, migrationMarkerPath, mintMessageId, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeInbound, normalizeModeId, normalizeRemote, normalizeSkillsOption, normalizeWorktreeField, parseAnthropicRateLimitHeaders, parseDuration, parsePrUrl, parseTaskStatus, parseWindow, parseWorktreeIsolationMode, pickUsageDetail, policyToActivities, policyWatchesSession, prHeadSha, prToActivities, projectSessionUsage, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readConversationIndex, readDaemonRegistry, readPairingsSnapshot, readProfileQuota, readRegisteredSlugs, readRuntimeMeta, readSandboxLedger, readSessionForBrain, readUsageSnapshots, reapGcEntry, reapOrphanedDescendants, reconcileSandboxLedger, recordProfileQuota, recordSandboxBoot, recordSandboxLiveness, recordSandboxOrigin, recordSandboxState, registerBrainTools, registerBuiltinRoutes, registerDeviceTools, registerPairingTools, registerReviewTools, registerSandboxAttachTool, registerWebSearchTools, removeHarnessPreset, export_removeProviderKey as removeProviderKey, removeSandboxLedgerEntry, renderInboxDigest, renderSessionMessage, renderSessionMessages, repoSlug, resolveAuthSpec, resolveBucketSlug, resolveDeferredToolsGatewayOption, resolveEffectiveLlmEndpointFlag, resolveNativeLink, resolvePosture, resolvePrincipal, resolveRelation, resolveReuseFromLedger, resolveReviewerPreset, resolveSpawnDefaults, resolveSubscriptionCredential, rollupSessionSubtree, rollupUsage, runContinueOnBootPass, runCrashDetectPass, runEagerResumePass, runIdleReapPass, runShellLane, runStallWatchdogPass, sandboxLedgerPath, sanitizeLabel, saveUserPreset, setDefaultPreset, setMcpCredentialDeps, export_setProviderKey as setProviderKey, signAttestation, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, toWorktreeStatusView, turnToActivities, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, updateHarnessPreset, upsertSandboxLedger, userPresetsPath, verifyInboundSignature, verifySignedAttestation, webSearchTool, withPr, withPrStatus, workflowToActivities, writeDaemonRegistryEntry };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map