@aiden-ade/sandbox-agent 0.1.15 → 0.1.17

package/dist/index.cjs

@@ -36,7 +36,7 @@ var require_XMLHttpRequest = __commonJS({
     "use strict";
     var fs = require("fs");
     var Url = require("url");
-    var spawn2 = require("child_process").spawn;
+    var spawn3 = require("child_process").spawn;
     module2.exports = XMLHttpRequest3;
     XMLHttpRequest3.XMLHttpRequest = XMLHttpRequest3;
     function XMLHttpRequest3(opts) {
@@ -332,7 +332,7 @@ var require_XMLHttpRequest = __commonJS({
           var syncFile = ".node-xmlhttprequest-sync-" + process.pid;
           fs.writeFileSync(syncFile, "", "utf8");
           var execString = "var http = require('http'), https = require('https'), fs = require('fs');var doRequest = http" + (ssl ? "s" : "") + ".request;var options = " + JSON.stringify(options) + ";var responseText = '';var responseData = Buffer.alloc(0);var req = doRequest(options, function(response) {response.on('data', function(chunk) {  var data = Buffer.from(chunk);  responseText += data.toString('utf8');  responseData = Buffer.concat([responseData, data]);});response.on('end', function() {fs.writeFileSync('" + contentFile + "', JSON.stringify({err: null, data: {statusCode: response.statusCode, headers: response.headers, text: responseText, data: responseData.toString('base64')}}), 'utf8');fs.unlinkSync('" + syncFile + "');});response.on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});}).on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});" + (data ? "req.write('" + JSON.stringify(data).slice(1, -1).replace(/'/g, "\\'") + "');" : "") + "req.end();";
-          var syncProc = spawn2(process.argv[0], ["-e", execString]);
+          var syncProc = spawn3(process.argv[0], ["-e", execString]);
           var statusText;
           while (fs.existsSync(syncFile)) {
           }
@@ -645,8 +645,8 @@ var require_common = __commonJS({
         }
         return debug12;
       }
-      function extend(namespace, delimiter) {
-        const newDebug = createDebug(this.namespace + (typeof delimiter === "undefined" ? ":" : delimiter) + namespace);
+      function extend(namespace, delimiter2) {
+        const newDebug = createDebug(this.namespace + (typeof delimiter2 === "undefined" ? ":" : delimiter2) + namespace);
         newDebug.log = this.log;
         return newDebug;
       }
@@ -3404,7 +3404,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash2 } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash4 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -4061,7 +4061,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -4428,7 +4428,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash2 } = require("crypto");
+    var { createHash: createHash4 } = require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -4725,7 +4725,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -4814,32 +4814,25 @@ var require_websocket_server = __commonJS({
 var import_child_process = require("child_process");
 
 // ../shared/dist/agent/agent-definitions.js
-var COORDINATOR_PROMPT = `## You are the Coordinator
+var COORDINATOR_PROMPT = `## You are the Orchestrator
 
-You are the **Coordinator** for this task. When asked "who are you?", "what agent are you?", "are you the coordinator?", or anything similar \u2014 identify yourself plainly as the Coordinator for this task. Do not say "I'm Aiden" alone; say "I'm the Coordinator (an Aiden agent profile) for this task."
+You are the **Orchestrator** for this task. When asked "who are you?", "what agent are you?", "are you the coordinator?", "are you the orchestrator?", or anything similar \u2014 identify yourself plainly as the Orchestrator for this task. Do not say "I'm Aiden" alone; say "I'm the Orchestrator (an Aiden agent profile) for this task."
 
-Your primary job is orchestration. Your primary job is **NOT** implementation. **Do not write code**, edit files, run builds or tests, or create implementation artifacts yourself.
+Your primary job is orchestration: understand the task, choose the next unit of work, keep context current, and decide whether to act directly or delegate to a specialist.
 
-## What you do NOT do
-
-You MUST NOT call these tools:
-- \`Edit\`, \`Write\`, \`MultiEdit\`, \`NotebookEdit\` \u2014 any file modification
-- \`Bash\` for state-mutating commands (git commits, builds, installs, tests, file writes, deploys)
-
-If the user asks for a code change, a build, a test run, a deploy, or anything that mutates state \u2014 STOP. **Delegate it** via \`start_task_session\` to the right specialist agent.
-
-Read-only inspection is fine: \`Read\`, \`Glob\`, \`Grep\`, and \`Bash\` for read commands like \`ls\`, \`git status\`, \`git log\`, \`cat\`, \`pwd\`.
+You may inspect, edit, run commands, create artifacts, and use MCP tools when that is the smallest coherent way to move the task forward. Delegate via \`delegate_task_session\` when a specialist or parallel worker is genuinely useful, not because the coordinator profile is blocked from doing the work. Use \`start_task_session\` only as a force-new escape hatch when reuse is explicitly wrong.
 
 ## Your primary tools
 
 Use these tools, in roughly this order of frequency:
-1. \`start_task_session\` \u2014 delegate work to a specialist
+1. \`delegate_task_session\` \u2014 route work to a specialist, reusing active matching workers by default
 2. \`get_task_memory\` / \`update_task_memory\` \u2014 keep the task-level working memory current
 3. \`list_subtasks\` / \`create_subtask\` / \`update_subtask\` \u2014 keep task breakdown current
 4. \`get_session_context\` \u2014 check what a worker accomplished
 5. \`update_task\` \u2014 keep status, priority, labels current
-6. \`list_sessions\` / \`search\` / \`Read\` / \`Glob\` / \`Grep\` \u2014 situational awareness (read-only)
-7. \`add_task_comment\` / \`create_plan\` \u2014 document decisions and plans
+6. \`send_session_message\` / \`start_task_session\` \u2014 continue a specific session or force a new session only when needed
+7. \`list_sessions\` / \`search\` / \`Read\` / \`Glob\` / \`Grep\` \u2014 situational awareness
+8. \`add_task_comment\` / \`create_plan\` \u2014 document decisions and plans
 
 ## How to scale work
 
@@ -4857,9 +4850,11 @@ A two-line change does not need its own session. A well-scoped subtask can often
 - **PM Agent** \u2014 product questions, requirements, scope definition, PRD creation
 - **General Agent** \u2014 only when no specialist fits
 
-## How to write a kickoff message
+## How to delegate
 
-Every \`start_task_session\` message must include all four of these:
+Before creating any worker, check task memory and active sessions for a matching agent/workstream. Reuse the owning worker with \`delegate_task_session\` unless \`force_new\` is explicit or the workstream is intentionally independent.
+
+Every \`delegate_task_session\` message must include all four of these:
 1. **Objective** \u2014 what to do, in one clear sentence
 2. **Relevant context** \u2014 which files, APIs, or prior session results matter
 3. **Constraints** \u2014 what not to change, patterns to match, things already tried
@@ -4871,10 +4866,10 @@ Write it like a senior engineer's handoff note, not a vague request.
 
 1. Read the task, current subtasks, recent sessions \u2014 understand state before acting.
 2. Decide the next concrete unit of work. Break it down when scope is wide; keep subtasks current.
-3. **Either** delegate via \`start_task_session\`, **or** create/update a subtask, **or** ask the user a single targeted question if scope is ambiguous.
-4. After delegation, stay out of the implementation path. Track results via \`get_session_context\`, persist summaries/outcomes via \`update_task_memory\`, integrate status, decide the next move.
+3. **Either** delegate via \`delegate_task_session\`, **or** create/update a subtask, **or** ask the user a single targeted question if scope is ambiguous.
+4. After delegation, track results via \`get_session_context\`, persist summaries/outcomes via \`update_task_memory\`, integrate status, decide the next move.
 
-You are read-only by design. The build happens in spawned sessions. Hold that line.`;
+You are coordination-first, not read-only. Use judgment: act directly for focused work, delegate when coordination creates leverage.`;
 var PM_PROMPT = `## You are the PM Agent
 
 You are the **PM Agent** (Product Manager) for this task. When identifying yourself, say "I'm the PM Agent (an Aiden agent profile)."
@@ -4913,7 +4908,7 @@ Use these tools, in roughly this order of frequency:
 
 - **Implementor** \u2014 any code change: features, fixes, data, API, UI, tests
 - **Designer** \u2014 interaction, layout, accessibility, visual design
-- **Coordinator** \u2014 multi-agent orchestration where the work is complex enough to need coordination
+- **Orchestrator** \u2014 multi-agent orchestration where the work is complex enough to need coordination
 - **General Agent** \u2014 research, investigation, or work that doesn't fit a specialist
 
 ## How to write a kickoff message
@@ -4947,6 +4942,25 @@ Non-trivial implementations include tests. Break and plan before building when s
 - Files changed, if any
 - How you validated the result
 - Any residual risk or open question`;
+var REVIEW_PROMPT = `## You are the Review Agent
+
+You are the **Review Agent** (an Aiden agent profile) for pull request review sessions. When identifying yourself, say "I'm the Review Agent."
+
+Your job is to inspect the pull request context, reason about correctness and risk, and help the user review the change. Prefer concrete findings tied to files, lines, tests, and behavior. Do not send a review verdict until you have enough evidence.
+
+## How to review
+
+1. Understand the PR goal, linked task context, changed files, and current checks.
+2. Prioritize correctness, regressions, data loss, security, migration risk, and missing tests.
+3. Reuse available contextual comments, file diffs, task metadata, and session history before asking for more context.
+4. Report findings clearly, ordered by severity. If there are no blocking findings, say that and call out residual test gaps.
+
+## Rules
+
+- Do not invent changed files, test results, or PR metadata.
+- Keep feedback actionable and scoped to this PR.
+- Prefer short review comments over broad commentary.
+- Ask one targeted question only when evidence is missing and blocks a useful review.`;
 var IMPLEMENTOR_PROMPT = `## You are the Implementor Agent
 
 You are a senior implementation agent responsible for end-to-end code delivery. When identifying yourself, say "I'm the Implementor Agent (an Aiden agent profile)."
@@ -4983,6 +4997,10 @@ var DESIGNER_PROMPT = `## You are the Designer Agent
 
 You are a product UI designer and frontend interaction specialist. When identifying yourself, say "I'm the Designer Agent (an Aiden agent profile)."
 
+## Taste Skill (premium frontends)
+
+For landing pages, marketing sites, portfolios, or visual redesigns outside the core product shell, read and follow the \`design-taste-frontend\` skill in \`.agents/skills/\` before writing UI. Related vendored skills: \`redesign-existing-projects\` (existing codebases), \`minimalist-ui\`, \`high-end-visual-design\`, \`industrial-brutalist-ui\`. Sync from upstream with \`scripts/sync-taste-skills.sh\`.
+
 ## How to approach the work
 
 1. Think from the user's task flow before touching layout. What is the user trying to do?
@@ -5020,14 +5038,14 @@ You are a product UI designer and frontend interaction specialist. When identify
 var BUILTIN_AGENT_DEFINITIONS = [
   {
     id: "coordinator",
-    name: "Coordinator",
-    description: "Plans work, breaks down tasks, coordinates agents",
+    name: "Orchestrator",
+    description: "Plans work, breaks down tasks, orchestrates agents",
     iconKey: "command",
     defaultMode: "agent",
     capabilities: {
-      canEditFiles: false,
-      canRunCommands: false,
-      canCreateArtifacts: false,
+      canEditFiles: true,
+      canRunCommands: true,
+      canCreateArtifacts: true,
       canStartSessions: true,
       canManageSubtasks: true
     },
@@ -5048,6 +5066,21 @@ var BUILTIN_AGENT_DEFINITIONS = [
     },
     systemPrompt: GENERAL_PROMPT
   },
+  {
+    id: "pr-reviewer",
+    name: "Review Agent",
+    description: "Reviews pull requests and surfaces risks",
+    iconKey: "search-code",
+    defaultMode: "review",
+    capabilities: {
+      canEditFiles: false,
+      canRunCommands: true,
+      canCreateArtifacts: true,
+      canStartSessions: false,
+      canManageSubtasks: false
+    },
+    systemPrompt: REVIEW_PROMPT
+  },
   {
     id: "pm",
     name: "PM Agent",
@@ -5100,7 +5133,6 @@ var LEGACY_AGENT_ID_ALIASES = {
   developer: "implementor",
   implementer: "implementor",
   "ui-designer": "designer",
-  "pr-reviewer": "general",
   verifier: "general"
 };
 function normalizeBuiltinAgentId(agentId) {
@@ -5202,10 +5234,11 @@ function getAidenAgentPrompt(agentId) {
 var SESSION_RESUME_FAILED_MESSAGE = "Session resume failed. The previous session may have expired or is no longer available. Please start a new session.";
 
 // ../agent-core/dist/index.js
+var import_crypto = require("crypto");
 var import_fs = require("fs");
 var import_os = require("os");
 var import_path = require("path");
-var import_crypto = require("crypto");
+var import_crypto2 = require("crypto");
 var import_fs2 = require("fs");
 var import_fs3 = require("fs");
 var import_os2 = require("os");
@@ -5218,6 +5251,8 @@ var INTERACTIVE_TOOL_NAMES = /* @__PURE__ */ new Set([
   "exitplanmode",
   "enterplanmode"
 ]);
+var AIDEN_AGENT_WORKOS_USER_ID_PREFIX = "aiden-agent:";
+var AIDEN_AGENT_WORKOS_USER_ID_LIKE_PATTERN = `${AIDEN_AGENT_WORKOS_USER_ID_PREFIX}%`;
 
 // ../shared/dist/constants/tasks.js
 var STATUS_OPTIONS = [
@@ -5374,6 +5409,7 @@ function normalizeCodexMcpToolResult(output) {
   }
   return raw;
 }
+var MAX_INLINE_GENERATED_IMAGE_BYTES = 20 * 1024 * 1024;
 function findCodexSessionLog(runtimeSessionId, codexHome) {
   if (!runtimeSessionId || !(0, import_fs.existsSync)(codexHome)) return null;
   const root = (0, import_path.join)(codexHome, "sessions");
@@ -5404,14 +5440,106 @@ function findCodexSessionLog(runtimeSessionId, codexHome) {
   matches.sort((a, b) => b.mtimeMs - a.mtimeMs);
   return matches[0]?.path ?? null;
 }
+function inferImageMimeType(buffer) {
+  if (buffer.length >= 8 && buffer.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
+    return "image/png";
+  }
+  if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) {
+    return "image/jpeg";
+  }
+  if (buffer.length >= 6 && (buffer.toString("ascii", 0, 6) === "GIF87a" || buffer.toString("ascii", 0, 6) === "GIF89a")) {
+    return "image/gif";
+  }
+  if (buffer.length >= 12 && buffer.toString("ascii", 0, 4) === "RIFF" && buffer.toString("ascii", 8, 12) === "WEBP") {
+    return "image/webp";
+  }
+  return null;
+}
+function extensionForMimeType(mimeType) {
+  switch (mimeType) {
+    case "image/jpeg":
+      return "jpg";
+    case "image/gif":
+      return "gif";
+    case "image/webp":
+      return "webp";
+    case "image/png":
+    default:
+      return "png";
+  }
+}
+function readImageDimensions(buffer, mimeType) {
+  if (mimeType === "image/png" && buffer.length >= 24) {
+    return { width: buffer.readUInt32BE(16), height: buffer.readUInt32BE(20) };
+  }
+  if (mimeType === "image/gif" && buffer.length >= 10) {
+    return { width: buffer.readUInt16LE(6), height: buffer.readUInt16LE(8) };
+  }
+  if (mimeType === "image/jpeg" && buffer.length > 4) {
+    let offset = 2;
+    while (offset + 9 < buffer.length) {
+      if (buffer[offset] !== 255) break;
+      const marker = buffer[offset + 1];
+      const length = buffer.readUInt16BE(offset + 2);
+      if (length < 2) break;
+      if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+        return {
+          width: buffer.readUInt16BE(offset + 7),
+          height: buffer.readUInt16BE(offset + 5)
+        };
+      }
+      offset += 2 + length;
+    }
+  }
+  return { width: null, height: null };
+}
+function buildGeneratedImageFromCodexPayload(payload) {
+  const data = typeof payload.result === "string" ? payload.result : "";
+  if (!data) return null;
+  const buffer = Buffer.from(data, "base64");
+  if (buffer.length <= 0 || buffer.length > MAX_INLINE_GENERATED_IMAGE_BYTES) return null;
+  const mimeType = inferImageMimeType(buffer);
+  if (!mimeType) return null;
+  const callId = typeof payload.call_id === "string" && payload.call_id ? payload.call_id : void 0;
+  const imageId = (0, import_crypto.randomUUID)();
+  const { width, height } = readImageDimensions(buffer, mimeType);
+  return {
+    type: "generated_image",
+    id: imageId,
+    filename: `${callId ?? imageId}.${extensionForMimeType(mimeType)}`,
+    mimeType,
+    size: buffer.length,
+    width,
+    height,
+    data: buffer.toString("base64"),
+    sourceHash: (0, import_crypto.createHash)("sha256").update(buffer).digest("hex"),
+    ...callId ? { toolId: callId } : {},
+    ts: Date.now()
+  };
+}
+function latestUserMessageLineIndex(lines) {
+  let latestIndex = -1;
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (!line) continue;
+    const entry = parseJsonObject(line);
+    const payload = entry && typeof entry.payload === "object" && entry.payload !== null ? entry.payload : null;
+    if (payload?.type === "message" && payload.role === "user") {
+      latestIndex = index;
+    }
+  }
+  return latestIndex;
+}
 async function replayCodexMcpToolEventsFromSessionLog(context, state) {
   const runtimeSessionId = state.runtimeSessionId;
   if (!runtimeSessionId) return;
   const codexHome = context.env.CODEX_HOME || process.env.CODEX_HOME || (0, import_path.join)((0, import_os.homedir)(), ".codex");
   const logPath = findCodexSessionLog(runtimeSessionId, codexHome);
   if (!logPath) return;
+  const allLines = (0, import_fs.readFileSync)(logPath, "utf8").split(/\r?\n/).filter(Boolean);
+  const latestUserLineIndex = latestUserMessageLineIndex(allLines);
+  const lines = latestUserLineIndex >= 0 ? allLines.slice(latestUserLineIndex + 1) : allLines;
   const emittedToolIds = /* @__PURE__ */ new Set();
-  const lines = (0, import_fs.readFileSync)(logPath, "utf8").split(/\r?\n/).filter(Boolean);
   for (const line of lines) {
     const entry = parseJsonObject(line);
     const payload = entry && typeof entry.payload === "object" && entry.payload !== null ? entry.payload : null;
@@ -5431,20 +5559,27 @@ async function replayCodexMcpToolEventsFromSessionLog(context, state) {
       if (!callId) continue;
       context.presenter.onToolUse("tool_search", payload.arguments ?? {}, callId);
       emittedToolIds.add(callId);
+      continue;
+    }
+    if (payload.type === "image_generation_end") {
+      const image = buildGeneratedImageFromCodexPayload(payload);
+      if (image) await context.presenter.onGeneratedImage?.(image);
     }
   }
-  if (emittedToolIds.size === 0) return;
-  for (const line of lines) {
-    const entry = parseJsonObject(line);
-    const payload = entry && typeof entry.payload === "object" && entry.payload !== null ? entry.payload : null;
-    if (!payload || payload.type !== "function_call_output" && payload.type !== "tool_search_output") continue;
-    const callId = typeof payload.call_id === "string" ? payload.call_id : "";
-    if (!emittedToolIds.has(callId)) continue;
-    try {
-      const result = payload.type === "tool_search_output" ? JSON.stringify(payload.tools ?? [], null, 2) : normalizeCodexMcpToolResult(payload.output);
-      context.presenter.onToolResult?.(callId, result);
-    } catch {
-      context.presenter.onToolResult?.(callId, String(payload.output ?? ""));
+  if (emittedToolIds.size > 0) {
+    for (const line of lines) {
+      const entry = parseJsonObject(line);
+      const payload = entry && typeof entry.payload === "object" && entry.payload !== null ? entry.payload : null;
+      if (!payload || payload.type !== "function_call_output" && payload.type !== "tool_search_output")
+        continue;
+      const callId = typeof payload.call_id === "string" ? payload.call_id : "";
+      if (!emittedToolIds.has(callId)) continue;
+      try {
+        const result = payload.type === "tool_search_output" ? JSON.stringify(payload.tools ?? [], null, 2) : normalizeCodexMcpToolResult(payload.output);
+        context.presenter.onToolResult?.(callId, result);
+      } catch {
+        context.presenter.onToolResult?.(callId, String(payload.output ?? ""));
+      }
     }
   }
 }
@@ -5454,7 +5589,7 @@ function kimiSessionId(cwd) {
     resolved = (0, import_fs2.realpathSync)(cwd);
   } catch {
   }
-  return (0, import_crypto.createHash)("md5").update(resolved).digest("hex");
+  return (0, import_crypto2.createHash)("md5").update(resolved).digest("hex");
 }
 function parseKimiStructuredLine(line, context, state) {
   const presenter = context.presenter;
@@ -6136,7 +6271,7 @@ function resolveKimiCliModelArg(model) {
   if (trimmed.startsWith("claude-")) return void 0;
   return trimmed;
 }
-function createKimiCliBackend(command = "kimi", defaultArgs = []) {
+function createKimiCliBackend(command = "kimi-cli", defaultArgs = []) {
   return {
     kind: "kimi_cli",
     supportTier: "structured",
@@ -6962,7 +7097,12 @@ function createCodexRuntimeBackend(command = "codex", defaultArgs = []) {
             const resumeId = ctx.config.runtimeSessionId?.trim() || ctx.config.providerSessionId?.trim();
             const modelArgs = ctx.config.selectedModel?.trim() ? ["--model", ctx.config.selectedModel.trim()] : [];
             const effortArgs = buildCodexEffortArgs(ctx.config.selectedEffortLevel);
-            const permissionArgs = ["--dangerously-bypass-approvals-and-sandbox"];
+            const permissionArgs = [
+              "--ask-for-approval",
+              "never",
+              "--sandbox",
+              "danger-full-access"
+            ];
             const imageArgs = imagePaths.flatMap((p) => ["--image", p]);
             const baseArgs = resumeId ? [...permissionArgs, "exec", "resume", "--json", "--skip-git-repo-check", ...modelArgs, ...effortArgs, ...imageArgs, resumeId, "-"] : [...permissionArgs, "exec", "--json", "--skip-git-repo-check", ...modelArgs, ...effortArgs, ...imageArgs, "-"];
             return [...baseArgs, ...defaultArgs];
@@ -7146,17 +7286,11 @@ function buildTaskLifecyclePrompt(config) {
   ] : [];
   return [
     "## Task Lifecycle",
-    `This session is attached to taskId "${taskId}". Keep the task status current by calling the Aiden MCP update_task tool as you move through work phases.`,
+    `This session is attached to taskId "${taskId}".`,
+    `Do not change the task status on your own. The user manages this task's status. Only change it by calling the Aiden MCP update_task tool when the user explicitly asks you to (for example: "move this to review" or "mark it done"). Do not update the status proactively as you move through research, implementation, testing, or review phases.`,
     ...statusLines,
     "",
-    "Use exact status IDs from the available statuses when provided. Do not invent status IDs.",
-    "Lifecycle mapping:",
-    "- Research / discovery / code reading / planning: use the best matching status such as research, discovery, planning, or the first active status.",
-    "- Implementation / coding / file edits: use the best matching status such as implementing, in_progress, working, or running.",
-    "- Local validation / tests / QA: use the best matching status such as localtesting, local_testing, testing, qa, or validation.",
-    "- Ready for human review: use the best matching review status such as in_review or review.",
-    "- Done: use only when the requested work is fully complete and validated; otherwise leave it in the review/testing phase.",
-    "If no suitable status exists for a phase, leave the current status unchanged rather than forcing an unrelated one."
+    "When the user asks you to change the status, use exact status IDs from the available statuses. Do not invent status IDs. If none of the available statuses clearly matches the request, ask which one they mean instead of guessing."
   ].join("\n");
 }
 var BaseMachineAgent = class _BaseMachineAgent {
@@ -7291,7 +7425,7 @@ Prefer relative paths and keep your work scoped to this project.`
     const promptText = this.buildPromptText(runtimeConfig);
     const runtimeCommand = runtimeConfig.runtimeCommand || this.runtime.runtimeCommand;
     const runtimeArgs = runtimeConfig.runtimeArgs || this.runtime.runtimeArgs || [];
-    const backend = backendKind === "claude_cli" ? createClaudeCliBackend(runtimeCommand || "claude", runtimeArgs) : backendKind === "codex_app_server" ? createCodexRuntimeBackend(runtimeCommand || "codex", runtimeArgs) : backendKind === "copilot_cli" ? createCopilotCliBackend(runtimeCommand || "copilot", runtimeArgs) : backendKind === "cursor_agent_cli" ? createCursorAgentCliBackend(runtimeCommand || "cursor-agent", runtimeArgs) : backendKind === "gemini_cli" ? createGeminiCliBackend(runtimeCommand || "gemini", runtimeArgs) : backendKind === "droid_cli" ? createDroidCliBackend(runtimeCommand || "droid", runtimeArgs) : backendKind === "opencode_cli" ? createOpencodeCliBackend(runtimeCommand || "opencode", runtimeArgs) : backendKind === "kimi_cli" ? createKimiCliBackend(runtimeCommand || "kimi", runtimeArgs) : backendKind === "supatest_cli" ? createSupatestCliBackend(runtimeCommand || "supatest", runtimeArgs) : createGenericCliPassthroughBackend(runtimeCommand || "generic-cli", runtimeArgs);
+    const backend = backendKind === "claude_cli" ? createClaudeCliBackend(runtimeCommand || "claude", runtimeArgs) : backendKind === "codex_app_server" ? createCodexRuntimeBackend(runtimeCommand || "codex", runtimeArgs) : backendKind === "copilot_cli" ? createCopilotCliBackend(runtimeCommand || "copilot", runtimeArgs) : backendKind === "cursor_agent_cli" ? createCursorAgentCliBackend(runtimeCommand || "cursor-agent", runtimeArgs) : backendKind === "gemini_cli" ? createGeminiCliBackend(runtimeCommand || "gemini", runtimeArgs) : backendKind === "droid_cli" ? createDroidCliBackend(runtimeCommand || "droid", runtimeArgs) : backendKind === "opencode_cli" ? createOpencodeCliBackend(runtimeCommand || "opencode", runtimeArgs) : backendKind === "kimi_cli" ? createKimiCliBackend(runtimeCommand || "kimi-cli", runtimeArgs) : backendKind === "supatest_cli" ? createSupatestCliBackend(runtimeCommand || "supatest", runtimeArgs) : createGenericCliPassthroughBackend(runtimeCommand || "generic-cli", runtimeArgs);
     let lastResult = null;
     for (let attempt = 0; attempt <= _BaseMachineAgent.MAX_RETRIES; attempt++) {
       if (this.abortController?.signal.aborted) break;
@@ -7443,7 +7577,7 @@ var PROVIDER_CLI_COMMANDS = {
   copilot_cli: { provider: "copilot_cli", command: "copilot", envVar: "AIDEN_COPILOT_PATH" },
   cursor_agent_cli: { provider: "cursor_agent_cli", command: "cursor-agent", envVar: "AIDEN_CURSOR_AGENT_PATH" },
   gemini_cli: { provider: "gemini_cli", command: "gemini", envVar: "AIDEN_GEMINI_PATH" },
-  kimi_cli: { provider: "kimi_cli", command: "kimi", envVar: "AIDEN_KIMI_PATH" },
+  kimi_cli: { provider: "kimi_cli", command: "kimi-cli", envVar: "AIDEN_KIMI_PATH" },
   opencode_cli: { provider: "opencode_cli", command: "opencode", envVar: "AIDEN_OPENCODE_PATH" },
   droid_cli: { provider: "droid_cli", command: "droid", envVar: "AIDEN_DROID_PATH" },
   supatest_cli: { provider: "supatest_cli", command: "supatest", envVar: "AIDEN_SUPATEST_PATH" }
@@ -7461,11 +7595,14 @@ var BACKEND_CLI_COMMANDS = {
   cursor_agent_cli: "cursor-agent",
   gemini_cli: "gemini",
   gemini: "gemini",
-  kimi_cli: "kimi",
+  kimi_cli: "kimi-cli",
   opencode_cli: "opencode",
   droid_cli: "droid",
   supatest_cli: "supatest"
 };
+var CLI_COMMAND_ALIASES = {
+  "kimi-cli": ["kimi"]
+};
 var resolvedCliCache = /* @__PURE__ */ new Map();
 var cachedLoginShellEnv = null;
 function parseEnvOutput(output) {
@@ -7593,7 +7730,8 @@ function resolveCliExecutable(command, env = getDaemonCliEnvironment()) {
   const home = enriched.HOME || enriched.USERPROFILE || (0, import_node_os.homedir)();
   const isWin = (0, import_node_os.platform)() === "win32";
   const pathExt = enriched.PATHEXT ?? (isWin ? ".EXE;.CMD;.BAT;.COM" : "");
-  const names = isWin ? windowsCommandCandidates(trimmed, pathExt) : [trimmed];
+  const commandNames = [trimmed, ...CLI_COMMAND_ALIASES[trimmed] ?? []];
+  const names = commandNames.flatMap((name) => isWin ? windowsCommandCandidates(name, pathExt) : [name]);
   const candidates = [];
   for (const name of names) {
     if (name.includes("/") || name.includes("\\")) {
@@ -7864,6 +8002,46 @@ ${meta.description}`);
       }
       parts2.push(lines.join("\n"));
     }
+    if (config.prMeta) {
+      const pr = config.prMeta;
+      const lines = ["# Pull Request Context"];
+      lines.push(`- **Repo**: ${pr.owner}/${pr.repo}`);
+      lines.push(`- **PR**: #${pr.prNumber} \u2014 ${pr.title}`);
+      lines.push(`- **State**: ${pr.state}`);
+      if (pr.author) lines.push(`- **Author**: ${pr.author}`);
+      const baseHead = `${pr.baseBranch || "?"} \u2190 ${pr.headBranch || "?"}`;
+      lines.push(`- **Base \u2190 Head**: ${baseHead}`);
+      if (pr.mergeable === false) {
+        lines.push(`- **Mergeable**: no`);
+      } else if (pr.mergeable === true) {
+        lines.push(`- **Mergeable**: yes`);
+      }
+      if (pr.labels && pr.labels.length > 0) {
+        lines.push(`- **Labels**: ${pr.labels.join(", ")}`);
+      }
+      const sizeBits = [];
+      if (typeof pr.changedFilesCount === "number") sizeBits.push(`${pr.changedFilesCount} files`);
+      if (typeof pr.additions === "number") sizeBits.push(`+${pr.additions}`);
+      if (typeof pr.deletions === "number") sizeBits.push(`-${pr.deletions}`);
+      if (sizeBits.length > 0) lines.push(`- **Size**: ${sizeBits.join(" / ")}`);
+      if (pr.linkedTaskReadableId) {
+        lines.push(`- **Linked task**: ${pr.linkedTaskReadableId}`);
+      }
+      if (pr.htmlUrl) lines.push(`- **URL**: ${pr.htmlUrl}`);
+      if (pr.body) {
+        lines.push("");
+        lines.push("## PR Description");
+        lines.push(pr.body);
+      }
+      if (pr.changedFiles && pr.changedFiles.length > 0) {
+        lines.push("");
+        lines.push("## Changed Files (first 50)");
+        for (const file of pr.changedFiles) {
+          lines.push(`- ${file.status}: \`${file.path}\` (+${file.additions} / -${file.deletions})`);
+        }
+      }
+      parts2.push(lines.join("\n"));
+    }
     const taskId = config.taskId ?? process.env.AIDEN_TASK_ID;
     const conversationId = config.conversationId ?? process.env.AIDEN_SESSION_ID;
     const teamId = config.teamId;
@@ -7898,15 +8076,128 @@ ${meta.description}`);
   }
 };
 
+// src/generated-images.ts
+var import_node_crypto = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var IMAGE_MIME_BY_EXT = {
+  ".gif": "image/gif",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".png": "image/png",
+  ".webp": "image/webp"
+};
+var MAX_GENERATED_IMAGE_BYTES = 20 * 1024 * 1024;
+function collectStringValues(value2, out) {
+  if (typeof value2 === "string") {
+    out.push(value2);
+    return;
+  }
+  if (Array.isArray(value2)) {
+    for (const item of value2) collectStringValues(item, out);
+    return;
+  }
+  if (!value2 || typeof value2 !== "object") return;
+  for (const entry of Object.values(value2)) {
+    collectStringValues(entry, out);
+  }
+}
+function candidateStrings(content) {
+  const values = [content];
+  try {
+    collectStringValues(JSON.parse(content), values);
+  } catch {
+  }
+  return values;
+}
+function extractPathCandidates(content) {
+  const paths = /* @__PURE__ */ new Set();
+  const imagePathPattern = /(?:file:\/\/)?(?:~|\.{1,2}|\/)?[^\s"'`)\]}<>]+?\.(?:png|jpe?g|gif|webp)\b/gi;
+  for (const value2 of candidateStrings(content)) {
+    for (const match of value2.matchAll(imagePathPattern)) {
+      paths.add(match[0]);
+    }
+  }
+  return [...paths];
+}
+function normalizePath(candidate, cwd) {
+  let path = candidate.trim().replace(/^file:\/\//, "");
+  try {
+    path = decodeURI(path);
+  } catch {
+  }
+  if (path.startsWith("~/")) return null;
+  if ((0, import_node_path2.isAbsolute)(path)) return path;
+  return cwd ? (0, import_node_path2.join)(cwd, path) : null;
+}
+function readImageDimensions2(buffer, mimeType) {
+  if (mimeType === "image/png" && buffer.length >= 24 && buffer.toString("ascii", 1, 4) === "PNG") {
+    return { width: buffer.readUInt32BE(16), height: buffer.readUInt32BE(20) };
+  }
+  if (mimeType === "image/gif" && buffer.length >= 10 && buffer.toString("ascii", 0, 3) === "GIF") {
+    return { width: buffer.readUInt16LE(6), height: buffer.readUInt16LE(8) };
+  }
+  if (mimeType === "image/jpeg" && buffer.length > 4) {
+    let offset = 2;
+    while (offset + 9 < buffer.length) {
+      if (buffer[offset] !== 255) break;
+      const marker = buffer[offset + 1];
+      const length = buffer.readUInt16BE(offset + 2);
+      if (length < 2) break;
+      if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+        return {
+          width: buffer.readUInt16BE(offset + 7),
+          height: buffer.readUInt16BE(offset + 5)
+        };
+      }
+      offset += 2 + length;
+    }
+  }
+  return { width: null, height: null };
+}
+function extractGeneratedImagesFromToolResult(toolId, content, cwd) {
+  const images = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of extractPathCandidates(content)) {
+    const path = normalizePath(candidate, cwd);
+    if (!path || seen.has(path) || !(0, import_node_fs2.existsSync)(path)) continue;
+    seen.add(path);
+    const ext = (0, import_node_path2.extname)(path).toLowerCase();
+    const mimeType = IMAGE_MIME_BY_EXT[ext];
+    if (!mimeType) continue;
+    const stat = (0, import_node_fs2.statSync)(path);
+    if (!stat.isFile() || stat.size <= 0 || stat.size > MAX_GENERATED_IMAGE_BYTES) continue;
+    const buffer = (0, import_node_fs2.readFileSync)(path);
+    const { width, height } = readImageDimensions2(buffer, mimeType);
+    images.push({
+      type: "generated_image",
+      id: (0, import_node_crypto.randomUUID)(),
+      filename: (0, import_node_path2.basename)(path),
+      mimeType,
+      size: buffer.length,
+      width,
+      height,
+      data: buffer.toString("base64"),
+      sourcePath: path,
+      sourceHash: (0, import_node_crypto.createHash)("sha256").update(buffer).digest("hex"),
+      toolId,
+      ts: Date.now()
+    });
+  }
+  return images;
+}
+
 // src/web-presenter.ts
 var WebPresenter = class {
-  wsClient;
-  conversationId;
-  suppressSessionLifecycle = false;
-  constructor(wsClient, conversationId) {
+  constructor(wsClient, conversationId, cwd) {
+    this.cwd = cwd;
     this.wsClient = wsClient;
     this.conversationId = conversationId;
   }
+  wsClient;
+  conversationId;
+  emittedGeneratedImageKeys = /* @__PURE__ */ new Set();
+  suppressSessionLifecycle = false;
   setSuppressSessionLifecycle(suppress) {
     this.suppressSessionLifecycle = suppress;
   }
@@ -7933,6 +8224,19 @@ var WebPresenter = class {
       ts: Date.now(),
       ...isError ? { is_error: true } : {}
     });
+    if (isError) return;
+    for (const image of extractGeneratedImagesFromToolResult(toolId, content, this.cwd)) {
+      this.emitGeneratedImage(image);
+    }
+  }
+  onGeneratedImage(image) {
+    this.emitGeneratedImage(image);
+  }
+  emitGeneratedImage(image) {
+    const key = image.sourceHash ?? `${image.sourcePath ?? image.id}:${image.size}`;
+    if (this.emittedGeneratedImageKeys.has(key)) return;
+    this.emittedGeneratedImageKeys.add(key);
+    this.wsClient.emitEvent(image);
   }
   onTurnComplete(content) {
     this.wsClient.emitEvent({ type: "turn_complete", content, ts: Date.now() });
@@ -11610,6 +11914,7 @@ var WSClient = class {
         selectedEffortLevel: data.selectedEffortLevel,
         mode: data.mode,
         taskMeta: data.taskMeta,
+        prMeta: data.prMeta,
         workflowTools: data.workflowTools,
         runId: data.runId,
         messageId: data.messageId,
@@ -11635,7 +11940,7 @@ var WSClient = class {
 };
 
 // src/version.ts
-var AGENT_VERSION = "0.1.15";
+var AGENT_VERSION = "0.1.17";
 
 // src/sandbox.ts
 async function runSandbox(config) {
@@ -11645,6 +11950,7 @@ async function runSandbox(config) {
   let pendingMessageResolve = null;
   let currentAgent = null;
   let currentTaskMeta = void 0;
+  let currentPrMeta = void 0;
   let currentWorkflowTools = void 0;
   let currentMaxIterations = config.maxIterations ?? 50;
   let currentTaskId = config.taskId;
@@ -11697,7 +12003,7 @@ async function runSandbox(config) {
     console.error("[sandbox] Failed to connect to WS server:", error.message);
     process.exit(1);
   }
-  const presenter = new WebPresenter(wsClient, config.sessionId);
+  const presenter = new WebPresenter(wsClient, config.sessionId, config.projectPath);
   presenter.setSuppressSessionLifecycle(true);
   let lastProviderSessionId = config.providerSessionId;
   let activeBackendKind = config.backendKind || "claude_cli";
@@ -11729,6 +12035,7 @@ async function runSandbox(config) {
           selectedEffortLevel: activeEffortLevel ?? null,
           providerSessionId: lastProviderSessionId ?? void 0,
           taskMeta: currentTaskMeta,
+          prMeta: currentPrMeta,
           taskId: currentTaskId,
           conversationId: currentConversationId,
           teamId: currentTeamId,
@@ -11791,6 +12098,9 @@ async function runSandbox(config) {
     if (nextPayload.taskMeta !== void 0) {
       currentTaskMeta = nextPayload.taskMeta;
     }
+    if (nextPayload.prMeta !== void 0) {
+      currentPrMeta = nextPayload.prMeta;
+    }
     if (nextPayload.workflowTools !== void 0) {
       currentWorkflowTools = nextPayload.workflowTools;
     }
@@ -11821,11 +12131,285 @@ async function runSandbox(config) {
 }
 
 // src/daemon.ts
-var import_node_fs2 = require("fs");
+var import_node_fs4 = require("fs");
 var import_node_http = __toESM(require("http"), 1);
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
+var import_node_os4 = require("os");
+var import_node_path4 = require("path");
+
+// ../shared/dist/node/provider-limits.js
+var import_node_child_process3 = require("child_process");
+var import_node_fs3 = require("fs");
 var import_node_os3 = require("os");
-var import_node_path2 = require("path");
+var import_node_path3 = require("path");
+var CACHE_TTL_MS = 6e4;
+var cachedLimits = null;
+function numericValue(value2) {
+  if (typeof value2 === "number" && Number.isFinite(value2))
+    return value2;
+  if (typeof value2 === "string" && value2.trim() && Number.isFinite(Number(value2))) {
+    return Number(value2);
+  }
+  return null;
+}
+function splitPath2(value2) {
+  return (value2 ?? "").split(import_node_path3.delimiter).filter(Boolean);
+}
+function isExecutableFile(path) {
+  try {
+    (0, import_node_fs3.accessSync)(path, import_node_fs3.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function augmentCliPath2(env) {
+  const home = env.HOME || (0, import_node_os3.homedir)();
+  const extraPaths = [
+    (0, import_node_path3.join)(home, ".local", "bin"),
+    (0, import_node_path3.join)(home, ".local", "node", "bin"),
+    (0, import_node_path3.join)(home, ".bun", "bin"),
+    (0, import_node_path3.join)(home, ".cargo", "bin"),
+    "/opt/homebrew/bin",
+    "/usr/local/bin"
+  ];
+  const existing = new Set(splitPath2(env.PATH));
+  const missing = extraPaths.filter((path) => !existing.has(path));
+  if (missing.length === 0)
+    return env;
+  return {
+    ...env,
+    PATH: `${missing.join(import_node_path3.delimiter)}${import_node_path3.delimiter}${env.PATH ?? ""}`
+  };
+}
+function resolveExecutable(command, env, overrideEnvVar) {
+  const override = env[overrideEnvVar]?.trim();
+  if (override && isExecutableFile(override))
+    return override;
+  for (const dir of splitPath2(env.PATH)) {
+    const candidate = (0, import_node_path3.join)(dir, command);
+    if (isExecutableFile(candidate))
+      return candidate;
+  }
+  return null;
+}
+function limitLabel(windowMinutes, fallback) {
+  if (windowMinutes === 5 * 60)
+    return "5h";
+  if (windowMinutes === 7 * 24 * 60)
+    return "Weekly";
+  return fallback;
+}
+function windowFromUsedPercent(params) {
+  const usedPercent = Math.max(0, Math.min(100, params.usedPercent));
+  return {
+    label: limitLabel(params.windowMinutes, params.fallbackLabel),
+    remaining: Math.max(0, 100 - usedPercent),
+    limit: 100,
+    usedPercent,
+    ...params.windowMinutes !== null ? { windowMinutes: params.windowMinutes } : {},
+    ...params.resetAt ? { resetAt: params.resetAt } : {},
+    source: params.source
+  };
+}
+function codexWindow(raw, fallbackLabel) {
+  if (!raw)
+    return null;
+  const usedPercent = numericValue(raw.usedPercent);
+  if (usedPercent === null)
+    return null;
+  const windowMinutes = numericValue(raw.windowDurationMins);
+  const resetSeconds = numericValue(raw.resetsAt);
+  const resetAt = resetSeconds !== null ? new Date(resetSeconds * 1e3).toISOString() : null;
+  return windowFromUsedPercent({
+    usedPercent,
+    windowMinutes,
+    resetAt,
+    fallbackLabel,
+    source: "codex-cli-rpc"
+  });
+}
+function claudeWindow(raw, label, windowMinutes) {
+  if (!raw)
+    return null;
+  const usedPercent = numericValue(raw.utilization);
+  if (usedPercent === null)
+    return null;
+  const resetAt = typeof raw.resets_at === "string" && raw.resets_at.trim() ? raw.resets_at.trim() : null;
+  return windowFromUsedPercent({
+    usedPercent,
+    windowMinutes,
+    resetAt,
+    fallbackLabel: label,
+    source: "claude-oauth"
+  });
+}
+async function withTimeout(promise, timeoutMs, fallback) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((resolve2) => {
+        timer = setTimeout(() => resolve2(fallback), timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+async function collectCodexLimits(env) {
+  const runtimeEnv = augmentCliPath2(env);
+  const codexCommand = resolveExecutable("codex", runtimeEnv, "AIDEN_CODEX_PATH");
+  if (!codexCommand)
+    return [];
+  return withTimeout(new Promise((resolve2) => {
+    const child = (0, import_node_child_process3.spawn)(codexCommand, ["-s", "read-only", "-a", "untrusted", "app-server"], {
+      env: runtimeEnv,
+      stdio: ["pipe", "pipe", "ignore"]
+    });
+    let nextId = 1;
+    let buffer = "";
+    const pending = /* @__PURE__ */ new Map();
+    const finish = (windows = []) => {
+      pending.clear();
+      if (!child.killed)
+        child.kill();
+      resolve2(windows);
+    };
+    const request = (method, params = {}) => {
+      const id = nextId++;
+      child.stdin.write(`${JSON.stringify({ id, method, params })}
+`);
+      return new Promise((requestResolve) => {
+        pending.set(id, requestResolve);
+      });
+    };
+    child.on("error", () => finish());
+    child.on("exit", () => finish());
+    child.stdout.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed)
+          continue;
+        let message;
+        try {
+          message = JSON.parse(trimmed);
+        } catch {
+          continue;
+        }
+        const id = numericValue(message.id);
+        if (id === null)
+          continue;
+        const resolver = pending.get(id);
+        if (!resolver)
+          continue;
+        pending.delete(id);
+        resolver(message.error ? null : message.result);
+      }
+    });
+    void (async () => {
+      try {
+        await request("initialize", {
+          clientInfo: { name: "aiden", version: "runtime" }
+        });
+        child.stdin.write(`${JSON.stringify({ method: "initialized", params: {} })}
+`);
+        const result = await request("account/rateLimits/read");
+        const windows = [
+          codexWindow(result?.rateLimits?.primary, "Primary"),
+          codexWindow(result?.rateLimits?.secondary, "Weekly")
+        ].filter((window2) => Boolean(window2));
+        finish(windows);
+      } catch {
+        finish();
+      }
+    })();
+  }), 4e3, []);
+}
+function readClaudeCredentialsPayload() {
+  const path = (0, import_node_path3.join)((0, import_node_os3.homedir)(), ".claude", ".credentials.json");
+  if ((0, import_node_fs3.existsSync)(path)) {
+    try {
+      return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    } catch {
+      return null;
+    }
+  }
+  if (process.platform !== "darwin")
+    return null;
+  try {
+    const raw = (0, import_node_child_process3.execFileSync)("security", ["find-generic-password", "-s", "Claude Code-credentials", "-w"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (!raw)
+      return null;
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readClaudeAccessToken() {
+  const parsed = readClaudeCredentialsPayload();
+  if (!parsed)
+    return null;
+  try {
+    const oauth = parsed.claudeAiOauth;
+    if (!oauth || typeof oauth.accessToken !== "string" || !oauth.accessToken.trim())
+      return null;
+    const expiresAt = numericValue(oauth.expiresAt);
+    if (expiresAt !== null && Date.now() >= expiresAt)
+      return null;
+    return oauth.accessToken.trim();
+  } catch {
+    return null;
+  }
+}
+async function collectClaudeLimits() {
+  const token = readClaudeAccessToken();
+  if (!token)
+    return [];
+  return withTimeout((async () => {
+    const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${token}`,
+        "anthropic-beta": "oauth-2025-04-20",
+        "user-agent": "claude-code/2.1.0"
+      }
+    });
+    if (!response.ok)
+      return [];
+    const body = await response.json();
+    return [
+      claudeWindow(body.five_hour, "5h", 5 * 60),
+      claudeWindow(body.seven_day, "Weekly", 7 * 24 * 60)
+    ].filter((window2) => Boolean(window2));
+  })().catch(() => []), 4e3, []);
+}
+async function collectLocalAgentProviderLimits(env = process.env) {
+  if (cachedLimits && Object.keys(cachedLimits.value).length > 0 && Date.now() - cachedLimits.collectedAt < CACHE_TTL_MS) {
+    return cachedLimits.value;
+  }
+  const [codex, claude] = await Promise.all([
+    collectCodexLimits(env),
+    collectClaudeLimits()
+  ]);
+  const limits = {};
+  if (codex.length > 0)
+    limits.codex_app_server = codex;
+  if (claude.length > 0)
+    limits.claude_cli = claude;
+  if (Object.keys(limits).length > 0) {
+    cachedLimits = { value: limits, collectedAt: Date.now() };
+  } else {
+    cachedLimits = null;
+  }
+  return limits;
+}
+
+// src/daemon.ts
 var PRODUCTION_API_URL = "https://api.aiden-platform.com";
 var PRODUCTION_WS_URL = "wss://ws.aiden-platform.com";
 var LOCAL_API_URL = "http://localhost:8400";
@@ -11851,33 +12435,33 @@ function describeOccupiedLocalDaemon(port) {
   return `local daemon API port ${port} is already in use. If Aiden desktop is open, it manages the daemon automatically. Quit Aiden desktop or stop the existing daemon before starting another.`;
 }
 function getConfigPath() {
-  return process.env.AIDEN_AGENT_CONFIG_PATH ?? (0, import_node_path2.join)((0, import_node_os3.homedir)(), ".aiden", "agent", "config.json");
+  return process.env.AIDEN_AGENT_CONFIG_PATH ?? (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".aiden", "agent", "config.json");
 }
 function getEndpointDefaultsPath() {
-  return process.env.AIDEN_AGENT_ENDPOINTS_PATH ?? (0, import_node_path2.join)((0, import_node_path2.dirname)(getConfigPath()), "endpoints.json");
+  return process.env.AIDEN_AGENT_ENDPOINTS_PATH ?? (0, import_node_path4.join)((0, import_node_path4.dirname)(getConfigPath()), "endpoints.json");
 }
 function readConfig() {
   const configPath = getConfigPath();
-  if (!(0, import_node_fs2.existsSync)(configPath)) return {};
-  return JSON.parse((0, import_node_fs2.readFileSync)(configPath, "utf8"));
+  if (!(0, import_node_fs4.existsSync)(configPath)) return {};
+  return JSON.parse((0, import_node_fs4.readFileSync)(configPath, "utf8"));
 }
 function readEndpointDefaults() {
   const endpointsPath = getEndpointDefaultsPath();
-  if (!(0, import_node_fs2.existsSync)(endpointsPath)) return {};
+  if (!(0, import_node_fs4.existsSync)(endpointsPath)) return {};
   try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(endpointsPath, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(endpointsPath, "utf8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
   const configPath = getConfigPath();
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(configPath), { recursive: true, mode: 448 });
-  (0, import_node_fs2.writeFileSync)(configPath, JSON.stringify(config, null, 2), { mode: 384 });
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(configPath), { recursive: true, mode: 448 });
+  (0, import_node_fs4.writeFileSync)(configPath, JSON.stringify(config, null, 2), { mode: 384 });
 }
 function removeConfig() {
   const configPath = getConfigPath();
-  if ((0, import_node_fs2.existsSync)(configPath)) (0, import_node_fs2.rmSync)(configPath, { force: true });
+  if ((0, import_node_fs4.existsSync)(configPath)) (0, import_node_fs4.rmSync)(configPath, { force: true });
 }
 function argValue(args, name) {
   const index = args.indexOf(name);
@@ -11950,33 +12534,46 @@ function abortActiveAgent(entry) {
   entry.agent.kill();
 }
 function collectRuntimeMetadata() {
-  const cpuList = (0, import_node_os3.cpus)();
+  const cpuList = (0, import_node_os4.cpus)();
   const metadata = {
-    platform: (0, import_node_os3.platform)(),
-    arch: (0, import_node_os3.arch)(),
-    osVersion: (0, import_node_os3.release)(),
+    platform: (0, import_node_os4.platform)(),
+    arch: (0, import_node_os4.arch)(),
+    osVersion: (0, import_node_os4.release)(),
     agentVersion: AGENT_VERSION,
-    memoryBytes: (0, import_node_os3.totalmem)(),
-    memoryFreeBytes: (0, import_node_os3.freemem)()
+    memoryBytes: (0, import_node_os4.totalmem)(),
+    memoryFreeBytes: (0, import_node_os4.freemem)()
   };
   if (cpuList.length > 0) {
     metadata.cpuModel = cpuList[0]?.model;
     metadata.cpuCores = cpuList.length;
   }
   try {
-    const disk = (0, import_node_fs2.statfsSync)((0, import_node_os3.homedir)());
+    const disk = (0, import_node_fs4.statfsSync)((0, import_node_os4.homedir)());
     metadata.diskFreeBytes = disk.bavail * disk.bsize;
     metadata.diskTotalBytes = disk.blocks * disk.bsize;
   } catch {
   }
   return metadata;
 }
+async function collectRuntimeMetadataWithProviderLimits() {
+  const metadata = collectRuntimeMetadata();
+  try {
+    const agentProviderLimits = await collectLocalAgentProviderLimits(getDaemonCliEnvironment());
+    if (Object.keys(agentProviderLimits).length > 0) {
+      metadata.agentProviderLimits = agentProviderLimits;
+    }
+  } catch {
+  }
+  return metadata;
+}
 var RuntimePresenter = class {
-  constructor(socket, conversationId, runId) {
+  constructor(socket, conversationId, runId, cwd) {
     this.socket = socket;
     this.conversationId = conversationId;
     this.runId = runId;
+    this.cwd = cwd;
   }
+  emittedGeneratedImageKeys = /* @__PURE__ */ new Set();
   emitEvent(event) {
     this.socket.emit("agent.event", {
       conversationId: this.conversationId,
@@ -12007,6 +12604,19 @@ var RuntimePresenter = class {
       ts: Date.now(),
       ...isError ? { is_error: true } : {}
     });
+    if (isError) return;
+    for (const image of extractGeneratedImagesFromToolResult(toolId, content, this.cwd)) {
+      this.emitGeneratedImage(image);
+    }
+  }
+  onGeneratedImage(image) {
+    this.emitGeneratedImage(image);
+  }
+  emitGeneratedImage(image) {
+    const key = image.sourceHash ?? `${image.sourcePath ?? image.id}:${image.size}`;
+    if (this.emittedGeneratedImageKeys.has(key)) return;
+    this.emittedGeneratedImageKeys.add(key);
+    this.emitEvent(image);
   }
   onTurnComplete(content) {
     this.emitEvent({ type: "turn_complete", content, ts: Date.now() });
@@ -12046,7 +12656,7 @@ async function setupDaemon(args) {
   const teamId = argValue(args, "--team") ?? process.env.AIDEN_TEAM_ID;
   const setupToken = argValue(args, "--setup-token") ?? process.env.AIDEN_RUNTIME_SETUP_TOKEN;
   const token = argValue(args, "--token") ?? process.env.AIDEN_SETUP_TOKEN;
-  const displayName = argValue(args, "--name") ?? (0, import_node_os3.hostname)();
+  const displayName = argValue(args, "--name") ?? (0, import_node_os4.hostname)();
   const legacyLocalMachineId = argValue(args, "--legacy-local-machine-id") ?? process.env.AIDEN_LEGACY_LOCAL_MACHINE_ID;
   const scope = argValue(args, "--scope") ?? process.env.AIDEN_RUNTIME_SCOPE ?? "team";
   if (scope !== "team" && scope !== "user") {
@@ -12067,7 +12677,7 @@ async function setupDaemon(args) {
       ...teamId ? { teamId } : {},
       ...setupToken ? { setupToken } : {},
       displayName,
-      hostname: (0, import_node_os3.hostname)(),
+      hostname: (0, import_node_os4.hostname)(),
       ...legacyLocalMachineId ? { legacyLocalMachineId } : {},
       runtimeKind: "machine",
       managementKind: "user_managed",
@@ -12076,7 +12686,7 @@ async function setupDaemon(args) {
       ownerType: scope,
       visibility: scope,
       capabilities: discoverCapabilities(),
-      metadata: collectRuntimeMetadata()
+      metadata: await collectRuntimeMetadataWithProviderLimits()
     })
   });
   if (!response.ok) {
@@ -12091,23 +12701,23 @@ async function setupDaemon(args) {
     runtimeId: body.runtime.id,
     runtimeToken: body.runtimeToken,
     localApiPort: getLocalApiPort(args, {}),
-    localApiToken: (0, import_node_crypto.randomBytes)(24).toString("hex"),
+    localApiToken: (0, import_node_crypto2.randomBytes)(24).toString("hex"),
     displayName: body.runtime.displayName ?? displayName
   });
   console.info("[aiden-agent] Runtime registered", { runtimeId: body.runtime.id, configPath: getConfigPath() });
 }
 async function loginWithDeviceCode(args) {
   const { apiUrl, wsUrl, endpointProfile } = resolveEndpoints(args);
-  const displayName = argValue(args, "--name") ?? (0, import_node_os3.hostname)();
+  const displayName = argValue(args, "--name") ?? (0, import_node_os4.hostname)();
   const maxPolls = Number.parseInt(argValue(args, "--max-polls") ?? "300", 10);
   const start = await fetch(`${apiUrl}/public/runtimes/device-authorizations`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
       displayName,
-      hostname: (0, import_node_os3.hostname)(),
+      hostname: (0, import_node_os4.hostname)(),
       capabilities: discoverCapabilities(),
-      metadata: collectRuntimeMetadata()
+      metadata: await collectRuntimeMetadataWithProviderLimits()
     })
   });
   if (!start.ok) {
@@ -12137,7 +12747,7 @@ async function loginWithDeviceCode(args) {
       runtimeId: body.runtime.id,
       runtimeToken: body.runtimeToken,
       localApiPort: getLocalApiPort(args, {}),
-      localApiToken: (0, import_node_crypto.randomBytes)(24).toString("hex"),
+      localApiToken: (0, import_node_crypto2.randomBytes)(24).toString("hex"),
       displayName: body.runtime.displayName ?? displayName
     });
     console.info("[aiden-agent] Runtime registered", { runtimeId: body.runtime.id, configPath: getConfigPath() });
@@ -12151,13 +12761,13 @@ async function startDaemon(args) {
   const runtimeToken = argValue(args, "--token") ?? process.env.AIDEN_RUNTIME_TOKEN ?? stored.runtimeToken;
   const wsUrl = argValue(args, "--ws-url") ?? process.env.AIDEN_WS_URL ?? stored.wsUrl;
   let localApiPort = getLocalApiPort(args, stored);
-  const localApiToken = stored.localApiToken ?? (0, import_node_crypto.randomBytes)(24).toString("hex");
+  const localApiToken = stored.localApiToken ?? (0, import_node_crypto2.randomBytes)(24).toString("hex");
   if (!runtimeId || !runtimeToken || !wsUrl) {
     throw new Error("daemon requires runtimeId, runtime token, and wsUrl. Run setup first or pass --runtime-id/--token/--ws-url.");
   }
   const activeAgents = /* @__PURE__ */ new Map();
   const currentCapabilities = () => discoverCapabilities();
-  const currentMetadata = () => collectRuntimeMetadata();
+  const currentMetadata = () => collectRuntimeMetadataWithProviderLimits();
   const recentLogs = [];
   const pushLog = (message) => {
     recentLogs.push(`${(/* @__PURE__ */ new Date()).toISOString()} ${message}`);
@@ -12179,12 +12789,17 @@ async function startDaemon(args) {
     extraHeaders: { "ngrok-skip-browser-warning": "1" }
   });
   const heartbeat = setInterval(() => {
-    if (socket.connected) socket.emit("runtime.heartbeat", { capabilities: currentCapabilities(), metadata: currentMetadata() });
+    if (!socket.connected) return;
+    void currentMetadata().then((metadata) => {
+      socket.emit("runtime.heartbeat", { capabilities: currentCapabilities(), metadata });
+    });
   }, 15e3);
   socket.on("connect", () => {
     pushLog(`connected runtime=${runtimeId}`);
     console.info("[aiden-agent] Daemon connected", { runtimeId, wsUrl, version: AGENT_VERSION });
-    socket.emit("runtime.hello", { capabilities: currentCapabilities(), metadata: currentMetadata() });
+    void currentMetadata().then((metadata) => {
+      socket.emit("runtime.hello", { capabilities: currentCapabilities(), metadata });
+    });
   });
   let lastConnectErrorLogAt = 0;
   socket.on("connect_error", (error) => {
@@ -12218,13 +12833,13 @@ async function startDaemon(args) {
     }
     socket.emit("agent.accepted", { runId: payload.runId });
     pushLog(`accepted run=${payload.runId}`);
-    const presenter = new RuntimePresenter(socket, payload.conversationId, payload.runId);
+    const cwd = payload.projectPath ?? process.cwd();
+    const presenter = new RuntimePresenter(socket, payload.conversationId, payload.runId, cwd);
     const agent = new CoreAgent(presenter, {
       backendKind,
       runtimeCommand,
       providerApiKey: payload.providerApiKey
     });
-    const cwd = payload.projectPath ?? process.cwd();
     activeAgents.set(payload.runId, { agent, presenter });
     void agent.run({
       task: payload.content,
@@ -12241,6 +12856,7 @@ async function startDaemon(args) {
       selectedEffortLevel: payload.selectedEffortLevel ?? null,
       providerSessionId: payload.providerSessionId,
       taskMeta: payload.taskMeta,
+      prMeta: payload.prMeta,
       conversationId: payload.conversationId,
       taskId: payload.taskMeta?.id,
       teamId: payload.teamId,
@@ -12532,7 +13148,7 @@ async function printDoctor(args = []) {
         authorization: `Bearer ${config.runtimeToken}`,
         "content-type": "application/json"
       },
-      body: JSON.stringify({ capabilities, metadata: collectRuntimeMetadata() })
+      body: JSON.stringify({ capabilities, metadata: await collectRuntimeMetadataWithProviderLimits() })
     });
     if (!response.ok) {
       syncError = `${response.status} ${await response.text()}`;