@aiden-ade/sandbox-agent 0.1.76 → 0.1.78

package/dist/index.cjs

@@ -1022,7 +1022,7 @@ var require_node = __commonJS({
     var tty = require("tty");
     var util = require("util");
     exports2.init = init;
-    exports2.log = log;
+    exports2.log = log2;
     exports2.formatArgs = formatArgs;
     exports2.save = save;
     exports2.load = load;
@@ -1157,7 +1157,7 @@ var require_node = __commonJS({
       }
       return (/* @__PURE__ */ new Date()).toISOString() + " ";
     }
-    function log(...args) {
+    function log2(...args) {
       return process.stderr.write(util.formatWithOptions(exports2.inspectOpts, ...args) + "\n");
     }
     function save(namespaces) {
@@ -3404,7 +3404,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes10, createHash: createHash13 } = require("crypto");
+    var { randomBytes: randomBytes13, createHash: createHash16 } = require("crypto");
     var { Duplex, Readable: Readable2 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -3931,7 +3931,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes10(16).toString("base64");
+      const key = randomBytes13(16).toString("base64");
       const request = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -4061,7 +4061,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash13("sha1").update(key + GUID).digest("base64");
+        const digest = createHash16("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -4428,7 +4428,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash13 } = require("crypto");
+    var { createHash: createHash16 } = require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -4725,7 +4725,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash13("sha1").update(key + GUID).digest("base64");
+        const digest = createHash16("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -6530,7 +6530,7 @@ var require_merge = __commonJS({
 var require_addPairToJSMap = __commonJS({
   "../../node_modules/yaml/dist/nodes/addPairToJSMap.js"(exports2) {
     "use strict";
-    var log = require_log();
+    var log2 = require_log();
     var merge2 = require_merge();
     var stringify2 = require_stringify();
     var identity = require_identity();
@@ -6579,7 +6579,7 @@ var require_addPairToJSMap = __commonJS({
           let jsonStr = JSON.stringify(strKey);
           if (jsonStr.length > 40)
             jsonStr = jsonStr.substring(0, 36) + '..."';
-          log.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
+          log2.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
           ctx.mapKeyWarned = true;
         }
         return strKey;
@@ -11995,7 +11995,7 @@ var require_public_api = __commonJS({
     var composer = require_composer();
     var Document = require_Document();
     var errors = require_errors2();
-    var log = require_log();
+    var log2 = require_log();
     var identity = require_identity();
     var lineCounter = require_line_counter();
     var parser = require_parser();
@@ -12047,7 +12047,7 @@ var require_public_api = __commonJS({
       const doc = parseDocument(src, options);
       if (!doc)
         return null;
-      doc.warnings.forEach((warning) => log.warn(doc.options.logLevel, warning));
+      doc.warnings.forEach((warning) => log2.warn(doc.options.logLevel, warning));
       if (doc.errors.length > 0) {
         if (doc.options.logLevel !== "silent")
           throw doc.errors[0];
@@ -13386,8 +13386,8 @@ var require_streamx = __commonJS({
             return this;
           },
           next() {
-            return new Promise(function(resolve14, reject) {
-              promiseResolve = resolve14;
+            return new Promise(function(resolve15, reject) {
+              promiseResolve = resolve15;
               promiseReject = reject;
               const data = stream.read();
               if (data !== null) ondata(data);
@@ -13420,11 +13420,11 @@ var require_streamx = __commonJS({
         }
         function destroy(err) {
           stream.destroy(err);
-          return new Promise((resolve14, reject) => {
-            if (stream._duplexState & DESTROYED) return resolve14({ value: void 0, done: true });
+          return new Promise((resolve15, reject) => {
+            if (stream._duplexState & DESTROYED) return resolve15({ value: void 0, done: true });
             stream.once("close", function() {
               if (err) reject(err);
-              else resolve14({ value: void 0, done: true });
+              else resolve15({ value: void 0, done: true });
             });
           });
         }
@@ -13468,8 +13468,8 @@ var require_streamx = __commonJS({
         const writes = pending + (ws._duplexState & WRITE_WRITING ? 1 : 0);
         if (writes === 0) return Promise.resolve(true);
         if (state.drains === null) state.drains = [];
-        return new Promise((resolve14) => {
-          state.drains.push({ writes, resolve: resolve14 });
+        return new Promise((resolve15) => {
+          state.drains.push({ writes, resolve: resolve15 });
         });
       }
       write(data) {
@@ -13574,10 +13574,10 @@ var require_streamx = __commonJS({
       cb(null);
     }
     function pipelinePromise(...streams) {
-      return new Promise((resolve14, reject) => {
+      return new Promise((resolve15, reject) => {
         return pipeline(...streams, (err) => {
           if (err) return reject(err);
-          resolve14();
+          resolve15();
         });
       });
     }
@@ -14249,16 +14249,16 @@ var require_extract = __commonJS({
           entryCallback = null;
           cb(err);
         }
-        function onnext(resolve14, reject) {
+        function onnext(resolve15, reject) {
           if (error61) {
             return reject(error61);
           }
           if (entryStream) {
-            resolve14({ value: entryStream, done: false });
+            resolve15({ value: entryStream, done: false });
             entryStream = null;
             return;
           }
-          promiseResolve = resolve14;
+          promiseResolve = resolve15;
           promiseReject = reject;
           consumeCallback(null);
           if (extract2._finished && promiseResolve) {
@@ -14286,11 +14286,11 @@ var require_extract = __commonJS({
         function destroy(err) {
           extract2.destroy(err);
           consumeCallback(err);
-          return new Promise((resolve14, reject) => {
-            if (extract2.destroyed) return resolve14({ value: void 0, done: true });
+          return new Promise((resolve15, reject) => {
+            if (extract2.destroyed) return resolve15({ value: void 0, done: true });
             extract2.once("close", function() {
               if (err) reject(err);
-              else resolve14({ value: void 0, done: true });
+              else resolve15({ value: void 0, done: true });
             });
           });
         }
@@ -14719,7 +14719,7 @@ function resolveViaWhere(command, env) {
   return null;
 }
 function runCliProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3, spawnOptions) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const isWin = (0, import_node_os.platform)() === "win32";
     let command = executable;
     let commandArgs = args;
@@ -14739,7 +14739,7 @@ function runCliProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3
         stdio: closeStdin ? ["pipe", "pipe", "pipe"] : void 0
       });
     } catch (error61) {
-      resolve14({ status: null, stdout: "", stderr: "", error: error61 });
+      resolve15({ status: null, stdout: "", stderr: "", error: error61 });
       return;
     }
     if (closeStdin) {
@@ -14753,10 +14753,10 @@ function runCliProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3
     child.stderr?.setEncoding("utf8").on("data", (chunk) => {
       stderr += chunk;
     });
-    child.once("error", (error61) => resolve14({ status: null, stdout, stderr, error: error61 }));
+    child.once("error", (error61) => resolve15({ status: null, stdout, stderr, error: error61 }));
     child.once(
       "close",
-      (status, signal) => resolve14({ status, stdout, stderr, signal: signal ?? null })
+      (status, signal) => resolve15({ status, stdout, stderr, signal: signal ?? null })
     );
   });
 }
@@ -14920,10 +14920,13 @@ Usage:
   alan-agent <command> [options]
 
 Commands:
+  install     Login/setup, install the daemon service, MCP, and supported hooks
   setup       Register this computer with a setup token from Alan
   login       Register this computer through browser authorization
   daemon      Start the durable runtime daemon
   service     Install, uninstall, or inspect the per-user daemon service
+  integrations Reconcile, inspect, or uninstall Alan CLI integrations
+  hook        Internal: durably spool a native CLI hook event (fail-open)
   stop        Stop the local daemon (or active runs only via the local API /stop)
   recover     Redial and safely restart a stuck local daemon connection
   status      Show local runtime configuration without secrets
@@ -14935,11 +14938,17 @@ Commands:
   run-session Internal: run one ephemeral sandbox/session from ALAN_* env vars
 
 Common flows:
+  alan-agent install
+  alan-agent install --setup-token <token>
   alan-agent login
   alan-agent login --cancel
   alan-agent setup --setup-token <token>
   alan-agent setup --setup-token <token> --scope user
   alan-agent service install
+  alan-agent integrations reconcile
+  alan-agent integrations status
+  alan-agent integrations capabilities
+  alan-agent integrations uninstall
   alan-agent stop
 
 Local development:
@@ -14963,7 +14972,7 @@ function resolveCommand(args, env) {
 }
 
 // src/daemon.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var import_node_os11 = require("os");
 
 // src/sleep-inhibitor.ts
@@ -14986,8 +14995,8 @@ var ChildProcessBackend = class {
    */
   unavailable = false;
   log;
-  constructor(log) {
-    this.log = log;
+  constructor(log2) {
+    this.log = log2;
   }
   /**
    * Let a multi-candidate backend react when its active helper terminates.
@@ -15120,14 +15129,14 @@ var WindowsPowerRequestBackend = class extends ChildProcessBackend {
   }
 };
 var externalBackends = /* @__PURE__ */ new Set();
-function createPlatformBackends(log, hasExternalBackend) {
+function createPlatformBackends(log2, hasExternalBackend) {
   switch (process.platform) {
     case "darwin":
-      return [new MacCaffeinateBackend(log)];
+      return [new MacCaffeinateBackend(log2)];
     case "linux":
-      return [new LinuxIdleInhibitBackend(log)];
+      return [new LinuxIdleInhibitBackend(log2)];
     case "win32":
-      return hasExternalBackend ? [] : [new WindowsPowerRequestBackend(log)];
+      return hasExternalBackend ? [] : [new WindowsPowerRequestBackend(log2)];
     default:
       return [];
   }
@@ -15231,7 +15240,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.76";
+var AGENT_VERSION = "0.1.78";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -16513,8 +16522,8 @@ async function withTimeout(promise2, timeoutMs, fallback) {
   try {
     return await Promise.race([
       promise2,
-      new Promise((resolve14) => {
-        timer = setTimeout(() => resolve14(fallback), timeoutMs);
+      new Promise((resolve15) => {
+        timer = setTimeout(() => resolve15(fallback), timeoutMs);
       })
     ]);
   } finally {
@@ -16527,7 +16536,7 @@ async function collectCodexLimits(env) {
   const codexCommand = resolveExecutable("codex", runtimeEnv, "ALAN_CODEX_PATH");
   if (!codexCommand)
     return [];
-  return withTimeout(new Promise((resolve14) => {
+  return withTimeout(new Promise((resolve15) => {
     const child = (0, import_node_child_process4.spawn)(codexCommand, ["-s", "read-only", "-a", "untrusted", "app-server"], {
       env: runtimeEnv,
       stdio: ["pipe", "pipe", "ignore"]
@@ -16539,7 +16548,7 @@ async function collectCodexLimits(env) {
       pending.clear();
       if (!child.killed)
         child.kill();
-      resolve14(windows);
+      resolve15(windows);
     };
     const request = (method, params = {}) => {
       const id = nextId++;
@@ -16686,7 +16695,7 @@ function antigravityWindow(groupLabel, raw) {
   };
 }
 function runOneShotCli(command, args, env, timeoutMs) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const child = (0, import_node_child_process4.spawn)(command, args, { env, stdio: ["ignore", "pipe", "ignore"] });
     let stdout = "";
     let settled = false;
@@ -16695,7 +16704,7 @@ function runOneShotCli(command, args, env, timeoutMs) {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve14(value2);
+      resolve15(value2);
     };
     const timer = setTimeout(() => {
       if (!child.killed)
@@ -35745,7 +35754,18 @@ function resolveEndpointProfileFromArgs(args) {
   const raw = index === -1 ? process.env.ALAN_AGENT_PROFILE : args[index + 1];
   return normalizeAgentEndpointProfile(raw) ?? "production";
 }
+function explicitConfigPathFromArgs(args) {
+  const index = args.indexOf("--config-path");
+  if (index >= 0) return args[index + 1]?.trim() || void 0;
+  const prefix = "--config-path=";
+  return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length).trim() || void 0;
+}
 function bindAgentConfigPathFromArgs(args) {
+  const argumentPath = explicitConfigPathFromArgs(args);
+  if (argumentPath) {
+    process.env.ALAN_AGENT_CONFIG_PATH = argumentPath;
+    return argumentPath;
+  }
   const explicit = process.env.ALAN_AGENT_CONFIG_PATH?.trim();
   if (explicit) return explicit;
   const profile = resolveEndpointProfileFromArgs(args);
@@ -37172,6 +37192,13 @@ var ACTIVE_AGENT_RUN_STATUSES = [
 ];
 var STOPPABLE_AGENT_RUN_STATUSES = [...ACTIVE_AGENT_RUN_STATUSES, "paused"];
 
+// ../shared/dist/agent/types.js
+function resolveEffectiveBackendKind(backendKind) {
+  if (backendKind === "codex")
+    return "codex_app_server";
+  return backendKind || "claude_cli";
+}
+
 // ../shared/dist/effort.js
 var EFFORT_LEVELS = ["minimal", "low", "medium", "high", "xhigh", "max", "ultra"];
 var CLAUDE_EFFORT_LEVELS = [
@@ -41653,7 +41680,7 @@ function createClaudeCliBackend(command = "claude", defaultArgs = []) {
       } else if (resumeId && context.config.systemPromptAppend?.trim()) {
         args.push("--append-system-prompt", context.config.systemPromptAppend.trim());
       }
-      if (context.config.teamId?.trim() && await cliSupportsFlag(command, "--approve-mcps", context.env)) {
+      if (context.config.alanMcp && await cliSupportsFlag(command, "--approve-mcps", context.env)) {
         args.push("--approve-mcps");
       }
       const baseModel = collapseModelIdToBase(context.config.selectedModel?.trim() || "");
@@ -42389,7 +42416,15 @@ function emitCodexFileChanges(context, state, itemId, changes) {
     const toolName = kind === "add" ? "write_file" : "edit_file";
     const toolId = changes.length > 1 ? `${itemId}:${index}` : itemId;
     trackCodexStreamedToolId(state, toolId);
-    void context.presenter.onToolUse(toolName, { file_path: filePath, kind }, toolId);
+    const diffMetadata = {};
+    for (const key of ["additions", "deletions", "patch", "diff"]) {
+      if (record2[key] !== void 0) diffMetadata[key] = record2[key];
+    }
+    void context.presenter.onToolUse(
+      toolName,
+      { file_path: filePath, kind, ...diffMetadata },
+      toolId
+    );
     void context.presenter.onToolResult?.(toolId, `${kind} ${filePath}`);
   });
 }
@@ -43794,7 +43829,7 @@ function createCursorAgentCliBackend(command = "cursor-agent", defaultArgs = [])
         context.config.images,
         context.cwd
       );
-      const approveMcps = context.config.teamId?.trim() ? await cliSupportsFlag(command, "--approve-mcps", context.env) : false;
+      const approveMcps = context.config.alanMcp ? await cliSupportsFlag(command, "--approve-mcps", context.env) : false;
       try {
         return await createGenericCliBackend({
           kind: "cursor_agent_cli",
@@ -46251,10 +46286,6 @@ ${ctx.promptText}` : ctx.promptText;
 }
 var DROID_DEFAULT_MODEL = "claude-opus-4-8";
 var AGENT_ACTIVITY_HEARTBEAT_MS = 1e4;
-function normalizeBackendKind(kind) {
-  if (kind === "codex") return "codex_app_server";
-  return kind || "claude_cli";
-}
 function firstCatalogModelId(backendKind) {
   const fromPicker = catalogModelsForProvider(backendKind, PROVIDER_MODELS[backendKind]).find(
     (model) => model.id.trim()
@@ -46501,7 +46532,7 @@ var BaseMachineAgent = class _BaseMachineAgent {
     return message.includes("aborted") || message.includes("interrupted") || message.includes("cancelled") || message.includes("canceled");
   }
   resolveBackendKind(config2) {
-    return normalizeBackendKind(this.runtime.backendKind || config2.backendKind);
+    return resolveEffectiveBackendKind(this.runtime.backendKind || config2.backendKind);
   }
   getDefaultSupportTier(backendKind) {
     switch (backendKind) {
@@ -49447,7 +49478,7 @@ async function discoverProviderModelDetails(provider, executable, env) {
 }
 
 // src/daemon-provider-scan.ts
-function normalizeBackendKind2(backendKind) {
+function normalizeBackendKind(backendKind) {
   if (backendKind === "codex") return "codex_app_server";
   return backendKind;
 }
@@ -49805,7 +49836,7 @@ function checkStoredEndpointConsistency(stored, endpointDefaults) {
 }
 function sleep(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 function scheduleRuntimeModelScan(getBaseMetadata, options) {
   const stored = readConfig();
@@ -49826,11 +49857,11 @@ function scheduleRuntimeModelScan(getBaseMetadata, options) {
 }
 
 // src/daemon-start.ts
-var import_node_crypto13 = require("crypto");
-var import_node_fs17 = require("fs");
+var import_node_crypto16 = require("crypto");
+var import_node_fs20 = require("fs");
 var import_node_http = __toESM(require("http"), 1);
 var import_node_os10 = require("os");
-var import_node_path20 = require("path");
+var import_node_path22 = require("path");
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
 var XMLHttpRequestModule = __toESM(require_XMLHttpRequest(), 1);
@@ -52386,9 +52417,9 @@ var Socket2 = class extends Emitter {
    * @return a Promise that will be fulfilled when the server acknowledges the event
    */
   emitWithAck(ev, ...args) {
-    return new Promise((resolve14, reject) => {
+    return new Promise((resolve15, reject) => {
       const fn = (arg1, arg2) => {
-        return arg1 ? reject(arg1) : resolve14(arg2);
+        return arg1 ? reject(arg1) : resolve15(arg2);
       };
       fn.withError = true;
       args.push(fn);
@@ -54553,7 +54584,7 @@ function versionPolicy(npmPackage) {
   return "latest";
 }
 function runNpmInstall(installSpec, env, timeoutMs) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const isWin = (0, import_node_os7.platform)() === "win32";
     let child;
     try {
@@ -54565,7 +54596,7 @@ function runNpmInstall(installSpec, env, timeoutMs) {
         stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (error61) {
-      resolve14({ status: null, stdout: "", stderr: "", error: error61 });
+      resolve15({ status: null, stdout: "", stderr: "", error: error61 });
       return;
     }
     let stdout = "";
@@ -54576,10 +54607,10 @@ function runNpmInstall(installSpec, env, timeoutMs) {
     child.stderr?.setEncoding("utf8").on("data", (chunk) => {
       stderr += chunk;
     });
-    child.once("error", (error61) => resolve14({ status: null, stdout, stderr, error: error61 }));
+    child.once("error", (error61) => resolve15({ status: null, stdout, stderr, error: error61 }));
     child.once(
       "close",
-      (status, signal) => resolve14({
+      (status, signal) => resolve15({
         status,
         stdout,
         stderr,
@@ -55322,6 +55353,147 @@ function parse5(toml, { maxDepth = 1e3, integersAsBigInt } = {}) {
   return res;
 }
 
+// ../../node_modules/smol-toml/dist/stringify.js
+var BARE_KEY = /^[a-z0-9-_]+$/i;
+function extendedTypeOf(obj) {
+  let type = typeof obj;
+  if (type === "object") {
+    if (Array.isArray(obj))
+      return "array";
+    if (obj instanceof Date)
+      return "date";
+  }
+  return type;
+}
+function isArrayOfTables(obj) {
+  for (let i = 0; i < obj.length; i++) {
+    if (extendedTypeOf(obj[i]) !== "object")
+      return false;
+  }
+  return obj.length != 0;
+}
+function formatString(s) {
+  return JSON.stringify(s).replace(/\x7f/g, "\\u007f");
+}
+function stringifyValue(val, type, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  if (type === "number") {
+    if (isNaN(val))
+      return "nan";
+    if (val === Infinity)
+      return "inf";
+    if (val === -Infinity)
+      return "-inf";
+    if (numberAsFloat && Number.isInteger(val))
+      return val.toFixed(1);
+    return val.toString();
+  }
+  if (type === "bigint" || type === "boolean") {
+    return val.toString();
+  }
+  if (type === "string") {
+    return formatString(val);
+  }
+  if (type === "date") {
+    if (isNaN(val.getTime())) {
+      throw new TypeError("cannot serialize invalid date");
+    }
+    return val.toISOString();
+  }
+  if (type === "object") {
+    return stringifyInlineTable(val, depth, numberAsFloat);
+  }
+  if (type === "array") {
+    return stringifyArray(val, depth, numberAsFloat);
+  }
+}
+function stringifyInlineTable(obj, depth, numberAsFloat) {
+  let keys = Object.keys(obj);
+  if (keys.length === 0)
+    return "{}";
+  let res = "{ ";
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (i)
+      res += ", ";
+    res += BARE_KEY.test(k) ? k : formatString(k);
+    res += " = ";
+    res += stringifyValue(obj[k], extendedTypeOf(obj[k]), depth - 1, numberAsFloat);
+  }
+  return res + " }";
+}
+function stringifyArray(array2, depth, numberAsFloat) {
+  if (array2.length === 0)
+    return "[]";
+  let res = "[ ";
+  for (let i = 0; i < array2.length; i++) {
+    if (i)
+      res += ", ";
+    if (array2[i] === null || array2[i] === void 0) {
+      throw new TypeError("arrays cannot contain null or undefined values");
+    }
+    res += stringifyValue(array2[i], extendedTypeOf(array2[i]), depth - 1, numberAsFloat);
+  }
+  return res + " ]";
+}
+function stringifyArrayTable(array2, key, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let res = "";
+  for (let i = 0; i < array2.length; i++) {
+    res += `${res && "\n"}[[${key}]]
+`;
+    res += stringifyTable(0, array2[i], key, depth, numberAsFloat);
+  }
+  return res;
+}
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
+  if (depth === 0) {
+    throw new Error("Could not stringify the object: maximum object depth exceeded");
+  }
+  let preamble = "";
+  let tables = "";
+  let keys = Object.keys(obj);
+  for (let i = 0; i < keys.length; i++) {
+    let k = keys[i];
+    if (obj[k] !== null && obj[k] !== void 0) {
+      let type = extendedTypeOf(obj[k]);
+      if (type === "symbol" || type === "function") {
+        throw new TypeError(`cannot serialize values of type '${type}'`);
+      }
+      let key = BARE_KEY.test(k) ? k : formatString(k);
+      if (type === "array" && isArrayOfTables(obj[k])) {
+        tables += (tables && "\n") + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
+      } else if (type === "object") {
+        let tblKey = prefix ? `${prefix}.${key}` : key;
+        tables += (tables && "\n") + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat);
+      } else {
+        preamble += key;
+        preamble += " = ";
+        preamble += stringifyValue(obj[k], type, depth, numberAsFloat);
+        preamble += "\n";
+      }
+    }
+  }
+  if (tableKey && (preamble || !tables))
+    preamble = preamble ? `[${tableKey}]
+${preamble}` : `[${tableKey}]`;
+  return preamble && tables ? `${preamble}
+${tables}` : preamble || tables;
+}
+function stringify(obj, { maxDepth = 1e3, numbersAsFloat = false } = {}) {
+  if (extendedTypeOf(obj) !== "object") {
+    throw new TypeError("stringify can only be called with an object");
+  }
+  let str = stringifyTable(0, obj, "", maxDepth, numbersAsFloat);
+  if (str[str.length - 1] !== "\n")
+    return str + "\n";
+  return str;
+}
+
 // src/mcp-registration.ts
 var CONFIG_LOCK_STALE_MS = 3e4;
 var CONFIG_LOCK_WAIT_MS = 2e3;
@@ -55450,7 +55622,7 @@ async function waitForConfigLock(lockPath) {
       if (Date.now() - startedAt >= CONFIG_LOCK_WAIT_MS) {
         throw new Error(`Alan could not safely update ${lockPath.slice(0, -".alan-lock".length)}`);
       }
-      await new Promise((resolve14) => setTimeout(resolve14, CONFIG_LOCK_POLL_MS));
+      await new Promise((resolve15) => setTimeout(resolve15, CONFIG_LOCK_POLL_MS));
     }
   }
 }
@@ -55596,6 +55768,22 @@ async function ensureAlanMcpRegistered(backendKind, registration, home = (0, imp
     return { ok: false, paths: [], error: err instanceof Error ? err.message : String(err) };
   }
 }
+async function restoreStaticAlanMcp(backendKind, apiUrl, home = (0, import_node_os8.homedir)()) {
+  let url3;
+  try {
+    url3 = new URL("/mcp", apiUrl).toString();
+  } catch (err) {
+    return {
+      ok: false,
+      paths: [],
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  return ensureAlanMcpRegistered(backendKind, { url: url3, headers: {} }, home, () => ({
+    ok: true,
+    verification: { method: "file" }
+  }));
+}
 async function verifyAlanMcpRegistered(backendKind, home = (0, import_node_os8.homedir)(), inspectCli = inspectAlanMcpThroughProviderCli) {
   const files = alanMcpConfigFilesForBackend(backendKind, {}, home);
   const missing = files.map((f) => f.path).filter((p) => !(0, import_node_fs14.existsSync)(p));
@@ -55667,45 +55855,6 @@ async function verifyAlanMcpRegistered(backendKind, home = (0, import_node_os8.h
     providerLoadStatus: providerLoadStatusForBackend(backendKind)
   };
 }
-function removeAlanFromJsonConfig(path2, existingContent) {
-  const config2 = parseJsonObject2(path2, existingContent);
-  for (const containerKey of ["mcpServers", "mcp"]) {
-    const container = config2[containerKey];
-    if (container && typeof container === "object" && !Array.isArray(container)) {
-      delete container.alan;
-    }
-  }
-  return JSON.stringify(config2);
-}
-async function unregisterAlanMcp(backendKind, home = (0, import_node_os8.homedir)()) {
-  const removedPaths = [];
-  const errors = [];
-  const files = alanMcpConfigFilesForBackend(backendKind, {}, home);
-  for (const file2 of files) {
-    if (!(0, import_node_fs14.existsSync)(file2.path)) continue;
-    const releaseLock = await waitForConfigLock(`${file2.path}.alan-lock`);
-    try {
-      const current = (0, import_node_fs14.readFileSync)(file2.path, "utf8");
-      let next;
-      if (file2.path.endsWith(".toml")) {
-        const stripped = stripCodexAlanMcpSection(current);
-        next = stripped ? `${stripped}
-` : "";
-      } else {
-        next = removeAlanFromJsonConfig(file2.path, current);
-      }
-      if (next !== current) {
-        atomicWriteManagedConfig(file2.path, next);
-        removedPaths.push(file2.path);
-      }
-    } catch (err) {
-      errors.push(err instanceof Error ? err.message : String(err));
-    } finally {
-      releaseLock();
-    }
-  }
-  return { removedPaths, errors };
-}
 function isHttpUrl(value2) {
   if (typeof value2 !== "string") return false;
   try {
@@ -55742,7 +55891,9 @@ function hasUsableRegistrationCredential(headers) {
   return Boolean(normalized.get("x-alan-run-reference") || normalized.get("authorization"));
 }
 function readAlanMcpRegistration(path2) {
-  const content = (0, import_node_fs14.readFileSync)(path2, "utf8");
+  return parseAlanMcpRegistration(path2, (0, import_node_fs14.readFileSync)(path2, "utf8"));
+}
+function parseAlanMcpRegistration(path2, content) {
   if (path2.endsWith(".toml")) {
     try {
       const parsed = parse5(content);
@@ -55795,12 +55946,14 @@ function readAlanMcpRegistration(path2) {
 var CoreAgent = class _CoreAgent extends BaseMachineAgent {
   childProcess = null;
   _aborted = false;
+  runId;
   providerApiKey;
   onProviderSpawned;
   /** How long to wait after SIGTERM before escalating to SIGKILL. */
   static SIGKILL_DELAY_MS = 3e3;
   constructor(presenter, runtime) {
     super(presenter, runtime);
+    this.runId = runtime.runId?.trim() || void 0;
     this.providerApiKey = runtime.providerApiKey;
     this.onProviderSpawned = runtime.onProviderSpawned;
   }
@@ -55931,6 +56084,9 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
   }
   async buildCliEnvironment() {
     const augmented = { ...getDaemonCliEnvironment() };
+    augmented.ALAN_MANAGED_RUN = "1";
+    if (this.runId) augmented.ALAN_RUN_ID = this.runId;
+    else delete augmented.ALAN_RUN_ID;
     const backendKind = this.runtime.backendKind ?? "";
     const providerApiKey = this.providerApiKey ?? "";
     if (backendKind === "antigravity_cli" && providerApiKey.trim()) {
@@ -60474,14 +60630,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve15, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve14();
+      resolve15();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -61320,7 +61476,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve14, reject) => {
+    return new Promise((resolve15, reject) => {
       const earlyReject = (error61) => {
         reject(error61);
       };
@@ -61388,7 +61544,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve14(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve15(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -61400,11 +61556,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve14(this._resolveNonCompleteResult(decoded, flow));
+          return resolve15(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve14(parseResult.data);
+          if (parseResult.success) resolve15(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -64318,7 +64474,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports2) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve14.call(this, root, ref);
+    let _sch = resolve15.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -64344,7 +64500,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports2) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve14(root, ref) {
+  function resolve15(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -64794,7 +64950,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports2, module2) => {
     else if (typeof uri === "object") uri = parse7(serialize(uri, options), options);
     return uri;
   }
-  function resolve14(baseURI, relativeURI, options) {
+  function resolve15(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse7(baseURI, schemelessOptions), parse7(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -64968,7 +65124,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports2, module2) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve14,
+    resolve: resolve15,
     resolveComponent,
     equal,
     serialize,
@@ -65444,10 +65600,10 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin(((exports2) => {
   Ajv2.ValidationError = validation_error_1.default;
   Ajv2.MissingRefError = ref_error_1.default;
   exports2.default = Ajv2;
-  function checkOptions(checkOpts, options, msg, log = "error") {
+  function checkOptions(checkOpts, options, msg, log2 = "error") {
     for (const key in checkOpts) {
       const opt = key;
-      if (opt in options) this.logger[log](`${msg}: option ${key}. ${checkOpts[opt]}`);
+      if (opt in options) this.logger[log2](`${msg}: option ${key}. ${checkOpts[opt]}`);
     }
   }
   function getSchEnv(keyRef) {
@@ -68771,8 +68927,8 @@ async function random(size) {
   const evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length;
   let result = "";
   while (result.length < size) {
-    const randomBytes10 = await getRandomValues(size - result.length);
-    for (const randomByte of randomBytes10) {
+    const randomBytes13 = await getRandomValues(size - result.length);
+    for (const randomByte of randomBytes13) {
       if (randomByte < evenDistCutoff) {
         result += mask[randomByte % mask.length];
       }
@@ -70410,14 +70566,14 @@ var ProbeWindow = class ProbeWindow2 {
   */
   async exchange(buildRequest, timeoutMs) {
     const id = `server-discover-probe-${++this._probeCounter}`;
-    return new Promise((resolve14) => {
+    return new Promise((resolve15) => {
       let settled = false;
       const settle = (reply) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
         if (this._pending?.id === id) this._pending = void 0;
-        resolve14(reply);
+        resolve15(reply);
       };
       const timer = setTimeout(() => settle({ kind: "timeout" }), timeoutMs);
       this._pending = {
@@ -71623,13 +71779,13 @@ var Client = class extends Protocol {
     let onCallerAbort;
     let resolveOpening;
     let rejectOpening;
-    const opening = new Promise((resolve14, reject) => {
-      resolveOpening = resolve14;
+    const opening = new Promise((resolve15, reject) => {
+      resolveOpening = resolve15;
       rejectOpening = reject;
     });
     let resolveClosed;
-    const closed = new Promise((resolve14) => {
-      resolveClosed = resolve14;
+    const closed = new Promise((resolve15) => {
+      resolveClosed = resolve15;
     });
     const settle = (outcome) => {
       if (state === "closed") return;
@@ -72688,7 +72844,7 @@ function failureFromError(error61, paths) {
   };
 }
 async function waitBeforeRetry() {
-  await new Promise((resolve14) => setTimeout(resolve14, RETRY_DELAY_MS2));
+  await new Promise((resolve15) => setTimeout(resolve15, RETRY_DELAY_MS2));
 }
 async function probeAlanMcpReadiness(registration, options = {}) {
   const paths = options.paths ?? [];
@@ -72928,7 +73084,7 @@ async function handleAgentExecute(ctx, payload) {
     });
     return;
   }
-  const backendKind = normalizeBackendKind2(payload.backendKind);
+  const backendKind = normalizeBackendKind(payload.backendKind);
   let runtimeCommand = resolveBackendRuntimeCommand(backendKind ?? payload.backendKind);
   if (!runtimeCommand && backendKind) {
     runtimeCommand = revalidateBackendRuntimeCommand(backendKind);
@@ -73113,12 +73269,13 @@ async function handleAgentExecute(ctx, payload) {
     });
     return;
   }
+  const registrationBackendKind = resolveEffectiveBackendKind(payload.backendKind);
   const authPromise = backendKind && runtimeCommand && !payload.providerApiKey ? preflightProviderAuth({
     backendKind,
     executable: runtimeCommand,
     env: getDaemonCliEnvironment()
   }).catch(() => ({ status: "unknown" })) : Promise.resolve({ status: "unknown" });
-  const mcpPromise = backendKind ? prepareAlanMcpForRun(backendKind, alanMcp, {
+  const mcpPromise = prepareAlanMcpForRun(registrationBackendKind, alanMcp, {
     // Observe mode resolves after the run has already been accepted, so
     // the verdict is logged here rather than folded into the result.
     onObservedResult: (failure) => {
@@ -73129,7 +73286,7 @@ async function handleAgentExecute(ctx, payload) {
         stage: failure.stage
       });
     }
-  }) : Promise.resolve(null);
+  });
   const skillTaskPromise = prepareSkillInvocationTask({
     manager: runtimeSkillManager,
     runtimeId,
@@ -73165,7 +73322,7 @@ async function handleAgentExecute(ctx, payload) {
     });
     return;
   }
-  if (backendKind && mcpOutcome && !mcpOutcome.ok) {
+  if (!mcpOutcome.ok) {
     pendingRunStarts.delete(payload.runId);
     releaseRunStart();
     const readinessCode = mcpOutcome.code;
@@ -73182,7 +73339,7 @@ async function handleAgentExecute(ctx, payload) {
     });
     return;
   }
-  if (backendKind && alanMcp && mcpOutcome && mcpOutcome.ok && "paths" in mcpOutcome) {
+  if ("paths" in mcpOutcome) {
     pushLog(
       `mcp-ready run=${payload.runId} verification=${"verification" in mcpOutcome ? mcpOutcome.verification : "file"}`
     );
@@ -73309,6 +73466,7 @@ async function handleAgentExecute(ctx, payload) {
     agent = new CoreAgent(presenter, {
       backendKind,
       runtimeCommand,
+      runId: payload.runId,
       providerApiKey: payload.providerApiKey,
       onProviderSpawned: (pid) => {
         releaseRunStart();
@@ -73351,10 +73509,8 @@ async function handleAgentExecute(ctx, payload) {
     workspaceLease: workspaceLeaseCapture.lease
   });
   pendingRunStarts.delete(payload.runId);
-  if (payload.alanMcp && backendKind) {
-    alanMcpRegisteredRuns.add(payload.runId);
-    alanMcpRegisteredBackends.add(backendKind);
-  }
+  alanMcpRegisteredRuns.set(payload.runId, alanMcp);
+  alanMcpRegisteredBackends.add(registrationBackendKind);
   void agent.run({
     task: preparedTask,
     maxIterations: payload.maxIterations ?? 50,
@@ -73708,6 +73864,473 @@ function respondWithLocalSkill(res, operation) {
   );
 }
 
+// src/native-hook-drain.ts
+var PermanentNativeHookDeliveryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PermanentNativeHookDeliveryError";
+  }
+};
+async function drainNativeHookInbox(input2) {
+  return input2.inbox.drain(async (envelope) => {
+    const isStart = envelope.eventType === "session_start" || envelope.eventType === "subagent_start";
+    const isTerminal2 = envelope.eventType === "stop" || envelope.eventType === "session_end" || envelope.eventType === "subagent_end";
+    const streamTranscript = async () => {
+      if (isStart || !input2.transcriptStreamer || !envelope.transcriptPath) {
+        return "unavailable";
+      }
+      try {
+        const streamed = await input2.transcriptStreamer.stream(
+          envelope,
+          (event) => input2.sink.deliver(event)
+        );
+        return streamed.complete ? streamed.assistantOutputDelivered ? "replayed" : "unavailable" : "deferred";
+      } catch (error61) {
+        if (error61 instanceof PermanentNativeHookDeliveryError) throw error61;
+        const normalizedError = error61 instanceof Error ? error61 : new Error(String(error61));
+        input2.onTranscriptError?.({
+          envelope,
+          error: normalizedError
+        });
+        if (isMissingTranscriptError(normalizedError) && transcriptGraceExpired(
+          envelope.observedAt,
+          input2.now?.() ?? Date.now(),
+          input2.missingTranscriptGraceMs ?? 1e4
+        )) {
+          return "unavailable";
+        }
+        return "deferred";
+      }
+    };
+    if (isTerminal2) {
+      const transcriptReplay = await streamTranscript();
+      if (transcriptReplay === "deferred") return false;
+      return input2.sink.deliver(
+        transcriptReplay === "replayed" ? { ...envelope, assistantOutputReplayed: true } : envelope
+      );
+    }
+    if (!await input2.sink.deliver(envelope)) return false;
+    return await streamTranscript() !== "deferred";
+  }, input2.limit);
+}
+function isMissingTranscriptError(error61) {
+  return error61.code === "ENOENT";
+}
+function transcriptGraceExpired(observedAt, now, graceMs) {
+  const observedAtMs = Date.parse(observedAt);
+  if (!Number.isFinite(observedAtMs)) return true;
+  return now - observedAtMs >= Math.max(0, graceMs);
+}
+
+// src/native-hook-inbox.ts
+var import_node_crypto8 = require("crypto");
+var import_node_fs16 = require("fs");
+var import_node_path14 = require("path");
+var INBOX_FILE_VERSION = 1;
+var DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
+var DEFAULT_MAX_ENTRIES = 1e4;
+function decodeKey2(encodedKey) {
+  const key = Buffer.from(encodedKey, "base64url");
+  if (key.length !== 32) throw new Error("native hook inbox key must contain exactly 32 bytes");
+  return key;
+}
+function encryptedEntryNames(path2) {
+  if (!(0, import_node_fs16.existsSync)(path2)) return [];
+  return (0, import_node_fs16.readdirSync)(path2).filter((name) => name.endsWith(".event") || name.includes(".processing-")).sort();
+}
+var EncryptedNativeHookInbox = class {
+  constructor(path2, encodedKey, options = {}) {
+    this.path = path2;
+    this.key = decodeKey2(encodedKey);
+    this.maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+    this.maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    this.onQuarantine = options.onQuarantine;
+    if (!Number.isSafeInteger(this.maxBytes) || this.maxBytes <= 0) {
+      throw new Error("native hook inbox maxBytes must be a positive integer");
+    }
+    if (!Number.isSafeInteger(this.maxEntries) || this.maxEntries <= 0) {
+      throw new Error("native hook inbox maxEntries must be a positive integer");
+    }
+    (0, import_node_fs16.mkdirSync)(this.path, { recursive: true, mode: 448 });
+    (0, import_node_fs16.chmodSync)(this.path, 448);
+    if (options.recoverClaims) this.recoverClaims();
+  }
+  key;
+  maxBytes;
+  maxEntries;
+  onQuarantine;
+  enqueue(envelope) {
+    const plaintext = Buffer.from(JSON.stringify(envelope), "utf8");
+    const iv = (0, import_node_crypto8.randomBytes)(12);
+    const cipher = (0, import_node_crypto8.createCipheriv)("aes-256-gcm", this.key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const file2 = {
+      version: INBOX_FILE_VERSION,
+      iv: iv.toString("base64url"),
+      authTag: cipher.getAuthTag().toString("base64url"),
+      ciphertext: ciphertext.toString("base64url")
+    };
+    const monotonic = process.hrtime.bigint().toString().padStart(20, "0");
+    const prefix = `${String(Date.now()).padStart(13, "0")}-${monotonic}-${envelope.eventId}`;
+    const temporaryPath = (0, import_node_path14.join)(this.path, `.${prefix}-${(0, import_node_crypto8.randomUUID)()}.tmp`);
+    const finalPath = (0, import_node_path14.join)(this.path, `${prefix}.event`);
+    (0, import_node_fs16.writeFileSync)(temporaryPath, JSON.stringify(file2), { mode: 384, flag: "wx" });
+    (0, import_node_fs16.chmodSync)(temporaryPath, 384);
+    (0, import_node_fs16.renameSync)(temporaryPath, finalPath);
+    try {
+      this.enforceBounds();
+    } catch (error61) {
+      (0, import_node_fs16.rmSync)(finalPath, { force: true });
+      throw error61;
+    }
+  }
+  size() {
+    return encryptedEntryNames(this.path).length;
+  }
+  async drain(consume, limit = 100) {
+    const result = { attempted: 0, acknowledged: 0, deferred: 0 };
+    const names = encryptedEntryNames(this.path).filter((name) => name.endsWith(".event")).slice(0, Math.max(0, limit));
+    for (const name of names) {
+      const sourcePath = (0, import_node_path14.join)(this.path, name);
+      const claimedName = `${name.slice(0, -".event".length)}.processing-${(0, import_node_crypto8.randomUUID)()}`;
+      const claimedPath = (0, import_node_path14.join)(this.path, claimedName);
+      try {
+        (0, import_node_fs16.renameSync)(sourcePath, claimedPath);
+      } catch {
+        continue;
+      }
+      result.attempted += 1;
+      try {
+        const envelope = this.readEntry(claimedPath);
+        if (await consume(envelope)) {
+          (0, import_node_fs16.rmSync)(claimedPath, { force: true });
+          result.acknowledged += 1;
+        } else {
+          (0, import_node_fs16.renameSync)(claimedPath, sourcePath);
+          result.deferred += 1;
+          break;
+        }
+      } catch (error61) {
+        if ((0, import_node_fs16.existsSync)(claimedPath)) {
+          const quarantinedPath = `${claimedPath}.quarantine`;
+          (0, import_node_fs16.renameSync)(claimedPath, quarantinedPath);
+          this.onQuarantine?.({
+            fileName: quarantinedPath.slice(quarantinedPath.lastIndexOf("/") + 1),
+            error: error61 instanceof Error ? error61 : new Error(String(error61))
+          });
+        }
+        result.deferred += 1;
+      }
+    }
+    return result;
+  }
+  readEntry(path2) {
+    const file2 = JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
+    if (file2.version !== INBOX_FILE_VERSION) throw new Error("unsupported native hook inbox entry");
+    const decipher = (0, import_node_crypto8.createDecipheriv)("aes-256-gcm", this.key, Buffer.from(file2.iv, "base64url"));
+    decipher.setAuthTag(Buffer.from(file2.authTag, "base64url"));
+    const plaintext = Buffer.concat([
+      decipher.update(Buffer.from(file2.ciphertext, "base64url")),
+      decipher.final()
+    ]);
+    return JSON.parse(plaintext.toString("utf8"));
+  }
+  recoverClaims() {
+    for (const name of encryptedEntryNames(this.path)) {
+      if (name.endsWith(".quarantine")) continue;
+      const marker = name.indexOf(".processing-");
+      if (marker === -1) continue;
+      const claimedPath = (0, import_node_path14.join)(this.path, name);
+      const eventPath = (0, import_node_path14.join)(this.path, `${name.slice(0, marker)}.event`);
+      if ((0, import_node_fs16.existsSync)(eventPath)) (0, import_node_fs16.rmSync)(claimedPath, { force: true });
+      else (0, import_node_fs16.renameSync)(claimedPath, eventPath);
+    }
+  }
+  enforceBounds() {
+    const entries = encryptedEntryNames(this.path).filter((name) => name.endsWith(".event")).map((name) => ({ name, bytes: (0, import_node_fs16.statSync)((0, import_node_path14.join)(this.path, name)).size }));
+    const totalBytes = entries.reduce((sum, entry) => sum + entry.bytes, 0);
+    if (entries.length > this.maxEntries || totalBytes > this.maxBytes) {
+      throw new Error(
+        `native hook inbox capacity exceeded (${entries.length} entries, ${totalBytes} bytes)`
+      );
+    }
+  }
+};
+function nativeHookInboxPath(configPath) {
+  return (0, import_node_path14.join)((0, import_node_path14.dirname)(configPath), "native-hook-inbox");
+}
+
+// src/native-transcript-cursor.ts
+var import_node_crypto9 = require("crypto");
+var import_node_fs17 = require("fs");
+var import_node_path15 = require("path");
+var CURSOR_FILE_VERSION = 1;
+function nativeTranscriptCursorKey(input2) {
+  return (0, import_node_crypto9.createHash)("sha256").update(`${input2.provider}\0${input2.externalSessionId}\0${input2.transcriptPath}`).digest("base64url");
+}
+var NativeTranscriptCursorStore = class {
+  constructor(path2) {
+    this.path = path2;
+    this.entries = this.read();
+  }
+  entries;
+  get(key) {
+    const value2 = this.entries[key];
+    return value2 ? { ...value2 } : void 0;
+  }
+  commit(key, cursor) {
+    if (!Number.isSafeInteger(cursor.offset) || cursor.offset < 0) {
+      throw new Error("native transcript cursor offset must be a non-negative safe integer");
+    }
+    this.entries[key] = { ...cursor };
+    this.persist();
+  }
+  read() {
+    if (!(0, import_node_fs17.existsSync)(this.path)) return {};
+    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(this.path, "utf8"));
+    if (parsed.version !== CURSOR_FILE_VERSION || !parsed.entries || typeof parsed.entries !== "object") {
+      throw new Error("unsupported native transcript cursor file");
+    }
+    return parsed.entries;
+  }
+  persist() {
+    (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(this.path), { recursive: true, mode: 448 });
+    const pendingPath = `${this.path}.pending-${process.pid}-${(0, import_node_crypto9.randomBytes)(6).toString("hex")}`;
+    try {
+      (0, import_node_fs17.writeFileSync)(
+        pendingPath,
+        JSON.stringify({
+          version: CURSOR_FILE_VERSION,
+          entries: this.entries
+        }),
+        { mode: 384 }
+      );
+      (0, import_node_fs17.chmodSync)(pendingPath, 384);
+      (0, import_node_fs17.renameSync)(pendingPath, this.path);
+    } finally {
+      (0, import_node_fs17.rmSync)(pendingPath, { force: true });
+    }
+  }
+};
+
+// src/native-transcript-stream.ts
+var import_node_crypto10 = require("crypto");
+var import_node_fs18 = require("fs");
+var DEFAULT_MAX_READ_BYTES = 4 * 1024 * 1024;
+var NativeTranscriptStreamer = class {
+  constructor(cursorStore, maxReadBytes = DEFAULT_MAX_READ_BYTES) {
+    this.cursorStore = cursorStore;
+    this.maxReadBytes = maxReadBytes;
+    if (!Number.isSafeInteger(maxReadBytes) || maxReadBytes <= 0) {
+      throw new Error("native transcript maxReadBytes must be a positive integer");
+    }
+  }
+  async stream(hook, deliver) {
+    if (!hook.transcriptPath) {
+      return {
+        complete: true,
+        recordsRead: 0,
+        eventsDelivered: 0,
+        assistantOutputDelivered: false
+      };
+    }
+    const key = nativeTranscriptCursorKey({
+      provider: hook.provider,
+      externalSessionId: hook.externalSessionId,
+      transcriptPath: hook.transcriptPath
+    });
+    let previous = this.cursorStore.get(key);
+    if (hook.eventType === "user_prompt" && previous && previous.assistantOutputTurnId !== hook.eventId) {
+      previous = {
+        ...previous,
+        assistantOutputSeen: false,
+        assistantOutputTurnId: hook.eventId
+      };
+      this.cursorStore.commit(key, previous);
+    }
+    const file2 = (0, import_node_fs18.statSync)(hook.transcriptPath);
+    const replaced = Boolean(previous) && (previous.device !== file2.dev || previous.inode !== file2.ino);
+    const truncated = Boolean(previous) && file2.size < previous.offset;
+    const start = !previous || replaced || truncated ? {
+      offset: 0,
+      generation: previous ? previous.generation + 1 : 0,
+      device: file2.dev,
+      inode: file2.ino,
+      assistantOutputSeen: previous?.assistantOutputSeen ?? false,
+      assistantOutputTurnId: hook.eventType === "user_prompt" ? hook.eventId : previous?.assistantOutputTurnId
+    } : previous;
+    let assistantOutputSeen = start.assistantOutputSeen ?? false;
+    if (file2.size <= start.offset) {
+      return {
+        complete: true,
+        recordsRead: 0,
+        eventsDelivered: 0,
+        assistantOutputDelivered: assistantOutputSeen
+      };
+    }
+    const bytesToRead = Math.min(file2.size - start.offset, this.maxReadBytes);
+    const buffer = Buffer.allocUnsafe(bytesToRead);
+    const fd = (0, import_node_fs18.openSync)(hook.transcriptPath, "r");
+    let bytesRead = 0;
+    try {
+      bytesRead = (0, import_node_fs18.readSync)(fd, buffer, 0, bytesToRead, start.offset);
+    } finally {
+      (0, import_node_fs18.closeSync)(fd);
+    }
+    const chunk = buffer.subarray(0, bytesRead);
+    const lastNewline = chunk.lastIndexOf(10);
+    if (lastNewline < 0) {
+      return {
+        complete: false,
+        recordsRead: 0,
+        eventsDelivered: 0,
+        assistantOutputDelivered: assistantOutputSeen
+      };
+    }
+    let recordStart = 0;
+    let recordsRead = 0;
+    let eventsDelivered = 0;
+    let committedOffset = start.offset;
+    while (recordStart <= lastNewline) {
+      const newline = chunk.indexOf(10, recordStart);
+      if (newline < 0 || newline > lastNewline) break;
+      const recordEndOffset = start.offset + newline + 1;
+      const raw = chunk.subarray(recordStart, newline).toString("utf8").trim();
+      recordStart = newline + 1;
+      if (!raw) {
+        committedOffset = recordEndOffset;
+        this.cursorStore.commit(key, {
+          ...start,
+          offset: committedOffset,
+          assistantOutputSeen
+        });
+        continue;
+      }
+      const parsed = parseJsonObject3(raw);
+      const events = parsed ? claudeRecordToAgentEvents(parsed) : [];
+      for (let index = 0; index < events.length; index += 1) {
+        const deliveredEvent = events[index];
+        const sourceCursor = `${start.generation}:${recordEndOffset}:${index}`;
+        const eventId = stableSourceEventId(hook, sourceCursor);
+        const accepted = await deliver({
+          schemaVersion: 1,
+          eventId,
+          provider: hook.provider,
+          externalSessionId: hook.externalSessionId,
+          sourceCursor,
+          observedAt: timestampOf(parsed) ?? hook.observedAt,
+          event: deliveredEvent
+        });
+        if (!accepted) {
+          return {
+            complete: false,
+            recordsRead,
+            eventsDelivered,
+            assistantOutputDelivered: assistantOutputSeen,
+            cursor: `${start.generation}:${committedOffset}`
+          };
+        }
+        eventsDelivered += 1;
+        if (deliveredEvent.type === "text" && deliveredEvent.text.length > 0) {
+          assistantOutputSeen = true;
+        }
+      }
+      committedOffset = recordEndOffset;
+      recordsRead += 1;
+      this.cursorStore.commit(key, {
+        ...start,
+        offset: committedOffset,
+        assistantOutputSeen
+      });
+    }
+    return {
+      complete: committedOffset >= file2.size,
+      recordsRead,
+      eventsDelivered,
+      assistantOutputDelivered: assistantOutputSeen,
+      cursor: `${start.generation}:${committedOffset}`
+    };
+  }
+};
+function stableSourceEventId(hook, sourceCursor) {
+  const bytes = (0, import_node_crypto10.createHash)("sha256").update(`${hook.provider}\0${hook.externalSessionId}\0${hook.transcriptPath}\0${sourceCursor}`).digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex3 = bytes.toString("hex");
+  return `${hex3.slice(0, 8)}-${hex3.slice(8, 12)}-${hex3.slice(12, 16)}-${hex3.slice(16, 20)}-${hex3.slice(20)}`;
+}
+function parseJsonObject3(value2) {
+  try {
+    const parsed = JSON.parse(value2);
+    return isRecord2(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function claudeRecordToAgentEvents(record2) {
+  const timestamp = timestampOf(record2) ? Date.parse(timestampOf(record2)) : Date.now();
+  const ts = Number.isFinite(timestamp) ? timestamp : Date.now();
+  const message = isRecord2(record2.message) ? record2.message : record2;
+  const content = message.content;
+  const role = typeof message.role === "string" ? message.role : typeof record2.type === "string" ? record2.type : null;
+  if (role === "user") {
+    if (!Array.isArray(content)) return [];
+    return content.flatMap((block) => {
+      if (!isRecord2(block) || block.type !== "tool_result") return [];
+      const id = typeof block.tool_use_id === "string" ? block.tool_use_id : typeof block.toolUseId === "string" ? block.toolUseId : null;
+      return id ? [{ type: "tool_result", id, content: extractText2(block.content), ts }] : [];
+    });
+  }
+  if (record2.type === "summary" && typeof record2.summary === "string") {
+    return [{ type: "session_notice", kind: "summary", message: record2.summary, ts }];
+  }
+  if (typeof record2.type === "string" && role !== "assistant") return [];
+  if (Array.isArray(content)) {
+    const events = content.flatMap((block) => {
+      if (!isRecord2(block)) return [];
+      if (block.type === "text" && typeof block.text === "string") {
+        return [{ type: "text", text: block.text, ts }];
+      }
+      if (block.type === "thinking" && typeof block.thinking === "string") {
+        return [{ type: "thinking", text: block.thinking, ts }];
+      }
+      if (block.type === "tool_use" && typeof block.id === "string" && typeof block.name === "string") {
+        return [{ type: "tool_use", id: block.id, name: block.name, input: block.input, ts }];
+      }
+      if (block.type === "tool_result" && typeof block.tool_use_id === "string") {
+        return [
+          { type: "tool_result", id: block.tool_use_id, content: extractText2(block.content), ts }
+        ];
+      }
+      return [];
+    });
+    if (events.length > 0) return events;
+  }
+  if (typeof content === "string" && content.length > 0)
+    return [{ type: "text", text: content, ts }];
+  return [];
+}
+function extractText2(value2) {
+  if (typeof value2 === "string") return value2;
+  if (Array.isArray(value2)) return value2.map(extractText2).filter(Boolean).join("\n");
+  if (isRecord2(value2)) {
+    if (typeof value2.text === "string") return value2.text;
+    if (typeof value2.content === "string") return value2.content;
+  }
+  return JSON.stringify(value2);
+}
+function timestampOf(record2) {
+  if (!record2) return null;
+  for (const key of ["timestamp", "created_at", "createdAt"]) {
+    const value2 = record2[key];
+    if (typeof value2 === "string" && !Number.isNaN(Date.parse(value2))) return value2;
+  }
+  return null;
+}
+function isRecord2(value2) {
+  return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
+}
+
 // src/network-diagnostics.ts
 function collectEvidence(error61) {
   const text = [];
@@ -73785,8 +74408,8 @@ var ObservableMap = class extends Map {
 };
 
 // src/run-journal.ts
-var import_node_fs16 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs19 = require("fs");
+var import_node_path16 = require("path");
 var JOURNAL_VERSION = 1;
 var INTERRUPTED_ENTRY_TTL_MS = 24 * 60 * 6e4;
 function isEntry(value2) {
@@ -73805,9 +74428,9 @@ function isEntry(value2) {
 var RuntimeRunJournal = class {
   constructor(path2, nowMs = Date.now()) {
     this.path = path2;
-    if (!(0, import_node_fs16.existsSync)(path2)) return;
+    if (!(0, import_node_fs19.existsSync)(path2)) return;
     try {
-      const parsed = JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs19.readFileSync)(path2, "utf8"));
       if (parsed.version !== JOURNAL_VERSION || !Array.isArray(parsed.entries)) {
         throw new Error("unsupported run journal format");
       }
@@ -73930,18 +74553,18 @@ var RuntimeRunJournal = class {
   }
   persist() {
     const pendingPath = `${this.path}.pending`;
-    (0, import_node_fs16.mkdirSync)((0, import_node_path14.dirname)(this.path), { recursive: true });
+    (0, import_node_fs19.mkdirSync)((0, import_node_path16.dirname)(this.path), { recursive: true });
     try {
-      (0, import_node_fs16.writeFileSync)(
+      (0, import_node_fs19.writeFileSync)(
         pendingPath,
         `${JSON.stringify({ version: JOURNAL_VERSION, entries: [...this.entries.values()] })}
 `,
         { mode: 384 }
       );
-      (0, import_node_fs16.chmodSync)(pendingPath, 384);
-      (0, import_node_fs16.renameSync)(pendingPath, this.path);
+      (0, import_node_fs19.chmodSync)(pendingPath, 384);
+      (0, import_node_fs19.renameSync)(pendingPath, this.path);
     } catch (error61) {
-      (0, import_node_fs16.rmSync)(pendingPath, { force: true });
+      (0, import_node_fs19.rmSync)(pendingPath, { force: true });
       throw error61;
     }
   }
@@ -73953,8 +74576,8 @@ var RunStartGate = class {
   async acquire() {
     const previous = this.tail;
     let releaseCurrent;
-    const current = new Promise((resolve14) => {
-      releaseCurrent = resolve14;
+    const current = new Promise((resolve15) => {
+      releaseCurrent = resolve15;
     });
     this.tail = previous.then(() => current);
     await previous;
@@ -73969,15 +74592,15 @@ var RunStartGate = class {
 
 // src/skills/local-skill-source.ts
 var import_node_buffer2 = require("buffer");
-var import_node_crypto9 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_promises2 = require("fs/promises");
-var import_node_path16 = __toESM(require("path"), 1);
+var import_node_path18 = __toESM(require("path"), 1);
 
 // ../shared/dist/node/skill-package.js
 var import_node_buffer = require("buffer");
-var import_node_crypto8 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var import_promises = require("fs/promises");
-var import_node_path15 = require("path");
+var import_node_path17 = require("path");
 var import_yaml = __toESM(require_dist2(), 1);
 
 // ../shared/dist/skills/domain.js
@@ -74401,7 +75024,7 @@ async function inspectSkillPackage(packageRoot, options = {}) {
   }
   const inspectedFiles = await Promise.all(files.map(readPackageFile));
   inspectedFiles.sort(comparePackageFiles);
-  const parsedMetadata = parseSkillMetadata(inspectedFiles.find((file2) => file2.manifest.path === "SKILL.md")?.bytes, options.expectedName === void 0 ? (0, import_node_path15.basename)(root) : options.expectedName);
+  const parsedMetadata = parseSkillMetadata(inspectedFiles.find((file2) => file2.manifest.path === "SKILL.md")?.bytes, options.expectedName === void 0 ? (0, import_node_path17.basename)(root) : options.expectedName);
   const manifestFiles = inspectedFiles.map((file2) => file2.manifest);
   const diagnostics = [
     ...parsedMetadata.conformance,
@@ -74425,7 +75048,7 @@ async function readSkillPackageFile(packageRoot, path2, expectedSha256) {
   if (!normalizedPath || normalizedPath !== path2 || normalizedPath.includes("\\") || components.some((component) => !component || component === "." || component === "..")) {
     throw new SkillPackageError("INVALID_PATH", `Invalid Skill package path: ${path2}`, path2);
   }
-  const absolutePath = await (0, import_promises.realpath)((0, import_node_path15.resolve)(root, ...components)).catch(() => null);
+  const absolutePath = await (0, import_promises.realpath)((0, import_node_path17.resolve)(root, ...components)).catch(() => null);
   if (!absolutePath || normalizeRelativePath(root, absolutePath) !== normalizedPath) {
     throw new SkillPackageError("INVALID_PATH", `Skill package file was not found: ${path2}`, path2);
   }
@@ -74446,7 +75069,7 @@ async function readSkillPackageFile(packageRoot, path2, expectedSha256) {
   return { file: read.manifest, bytes: read.bytes };
 }
 async function requirePackageRoot(packageRoot) {
-  const root = await (0, import_promises.realpath)((0, import_node_path15.resolve)(packageRoot)).catch(() => null);
+  const root = await (0, import_promises.realpath)((0, import_node_path17.resolve)(packageRoot)).catch(() => null);
   if (!root) {
     throw new SkillPackageError("INVALID_PACKAGE_ROOT", "Skill package directory does not exist");
   }
@@ -74472,7 +75095,7 @@ async function walkPackage(root, ignoredPaths) {
   async function walkDirectory(directory) {
     const entries = await (0, import_promises.readdir)(directory, { withFileTypes: true });
     for (const entry of entries) {
-      const absolutePath = (0, import_node_path15.resolve)(directory, entry.name);
+      const absolutePath = (0, import_node_path17.resolve)(directory, entry.name);
       const normalizedPath = normalizeRelativePath(root, absolutePath);
       if (isIgnored(normalizedPath, entry.name, entry.isDirectory(), ignored))
         continue;
@@ -74539,12 +75162,12 @@ function globToRegExp(pattern) {
   return new RegExp(`${source}(?:/.*)?$`);
 }
 function normalizeRelativePath(root, absolutePath) {
-  const nativeRelativePath = (0, import_node_path15.relative)(root, absolutePath);
-  if (!nativeRelativePath || nativeRelativePath.startsWith(`..${import_node_path15.sep}`) || nativeRelativePath === "..") {
+  const nativeRelativePath = (0, import_node_path17.relative)(root, absolutePath);
+  if (!nativeRelativePath || nativeRelativePath.startsWith(`..${import_node_path17.sep}`) || nativeRelativePath === "..") {
     throw new SkillPackageError("INVALID_PATH", "Skill package path escapes its root");
   }
-  const normalized = nativeRelativePath.split(import_node_path15.sep).join("/").normalize("NFC");
-  if (normalized.includes("\0") || normalized.includes("\uFFFD") || import_node_path15.posix.isAbsolute(normalized)) {
+  const normalized = nativeRelativePath.split(import_node_path17.sep).join("/").normalize("NFC");
+  if (normalized.includes("\0") || normalized.includes("\uFFFD") || import_node_path17.posix.isAbsolute(normalized)) {
     throw new SkillPackageError("INVALID_PATH", `Invalid Skill package path: ${normalized}`);
   }
   return normalized;
@@ -74579,7 +75202,7 @@ function requireSafeFile(path2, size, normalizedPaths) {
   }
 }
 function isSecretPath(path2) {
-  const name = import_node_path15.posix.basename(path2).toLowerCase();
+  const name = import_node_path17.posix.basename(path2).toLowerCase();
   if (SECRET_BASENAMES.has(name) || name.startsWith(".env."))
     return true;
   return name.endsWith(".private-key.pem") || name.endsWith(".private-key.key");
@@ -74607,12 +75230,12 @@ function classifyFileKind(path2) {
     return "reference";
   if (path2.startsWith("assets/"))
     return "asset";
-  if (/^(?:licen[cs]e|copying|notice)(?:\.|$)/i.test(import_node_path15.posix.basename(path2)))
+  if (/^(?:licen[cs]e|copying|notice)(?:\.|$)/i.test(import_node_path17.posix.basename(path2)))
     return "license";
   return "other";
 }
 function classifyPreview(path2, bytes) {
-  const extension = import_node_path15.posix.extname(path2).toLowerCase();
+  const extension = import_node_path17.posix.extname(path2).toLowerCase();
   if (IMAGE_EXTENSIONS.has(extension))
     return "image";
   if (bytes.includes(0))
@@ -74645,7 +75268,7 @@ function parseSkillMetadata(bytes, expectedName) {
   } catch (error61) {
     throw new SkillPackageError("INVALID_FRONTMATTER", `SKILL.md frontmatter is not valid YAML: ${error61 instanceof Error ? error61.message : String(error61)}`, "SKILL.md");
   }
-  if (!isRecord2(parsed)) {
+  if (!isRecord3(parsed)) {
     throw new SkillPackageError("INVALID_FRONTMATTER", "SKILL.md frontmatter must be a YAML mapping", "SKILL.md");
   }
   const admitted = skillFrontmatterAdmissionSchema.safeParse(parsed);
@@ -74716,7 +75339,7 @@ function normalizePackageReference(value2) {
   const withoutSuffix = trimmed.split(/[?#]/, 1)[0];
   if (!withoutSuffix)
     return null;
-  const normalized = import_node_path15.posix.normalize(withoutSuffix).replace(/^\.\//, "").normalize("NFC");
+  const normalized = import_node_path17.posix.normalize(withoutSuffix).replace(/^\.\//, "").normalize("NFC");
   if (normalized === ".." || normalized.startsWith("../"))
     return null;
   return normalized;
@@ -74724,14 +75347,14 @@ function normalizePackageReference(value2) {
 function looksLikeFileReference(value2) {
   return !/\s/.test(value2) && (value2.includes("/") || value2.includes("."));
 }
-function isRecord2(value2) {
+function isRecord3(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function comparePackageFiles(left, right) {
   return import_node_buffer.Buffer.compare(import_node_buffer.Buffer.from(left.manifest.path, "utf8"), import_node_buffer.Buffer.from(right.manifest.path, "utf8"));
 }
 function hashPackageTree(files) {
-  const hash2 = (0, import_node_crypto8.createHash)("sha256");
+  const hash2 = (0, import_node_crypto11.createHash)("sha256");
   hash2.update(TREE_HASH_PREFIX);
   for (const file2 of files) {
     const path2 = import_node_buffer.Buffer.from(file2.path, "utf8");
@@ -74744,7 +75367,7 @@ function hashPackageTree(files) {
   return `sha256:${hash2.digest("hex")}`;
 }
 function sha256(bytes) {
-  return `sha256:${(0, import_node_crypto8.createHash)("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto11.createHash)("sha256").update(bytes).digest("hex")}`;
 }
 function uint322(value2) {
   const buffer = import_node_buffer.Buffer.allocUnsafe(4);
@@ -74771,6 +75394,15 @@ var SKILL_PROVIDER_SOURCE_DEFINITIONS = [
     userDirectories: [".cursor/skills"],
     repositoryDirectories: [".cursor/skills"]
   },
+  {
+    // Canonical kind, not the `codex_cli` / `codex` aliases: LEGACY_PROVIDER_KIND_MAP
+    // normalizes both to this, and the enabled-provider set is built from
+    // normalized kinds, so a source declared under an alias never matches.
+    providerKind: "codex_app_server",
+    label: "Codex skills",
+    userDirectories: [".codex/skills"],
+    repositoryDirectories: [".codex/skills"]
+  },
   {
     providerKind: "copilot_cli",
     label: "Copilot skills",
@@ -74812,8 +75444,6 @@ function providerKindsForUserDirectory(relativeDirectory) {
   const providers = SKILL_PROVIDER_SOURCE_DEFINITIONS.flatMap((definition) => definition.userDirectories.includes(normalized) ? [definition.providerKind] : []);
   if (providers.length > 0)
     return providers;
-  if (normalized === ".codex/skills")
-    return ["cursor_agent_cli"];
   if (normalized === ".gemini/config/skills")
     return [];
   return void 0;
@@ -74849,6 +75479,11 @@ path = "~/.cursor/skills"
 label = "Cursor skills"
 providers = ["cursor_agent_cli"]
 
+[[skills.sources]]
+path = "~/.codex/skills"
+label = "Codex skills"
+providers = ["codex_app_server"]
+
 [[skills.sources]]
 path = "~/.copilot/skills"
 label = "Copilot skills"
@@ -74864,17 +75499,20 @@ var LocalSkillSource = class {
   locations = /* @__PURE__ */ new Map();
   inspectionCache = /* @__PURE__ */ new Map();
   async scan(input2) {
-    const attemptId = (0, import_node_crypto9.randomUUID)();
+    const attemptId = (0, import_node_crypto12.randomUUID)();
     const diagnostics = [];
     const candidates = [];
     const visitedDirectories = /* @__PURE__ */ new Set();
     let incompleteRoot = false;
-    for (const resolvedRoot of resolveScanRoots(input2.roots, input2.enabledProviderKinds ?? [])) {
+    const resolvedRoots = resolveScanRoots(input2.roots, input2.enabledProviderKinds ?? []);
+    const declaredRoots = await canonicalDirectories(resolvedRoots.map((root) => root.directory));
+    for (const resolvedRoot of resolvedRoots) {
       const rootResult = await this.scanRoot(
         resolvedRoot,
         visitedDirectories,
         input2.ignoredPaths ?? [],
-        input2.mode
+        input2.mode,
+        declaredRoots
       );
       candidates.push(...rootResult.candidates);
       diagnostics.push(...rootResult.diagnostics);
@@ -74929,7 +75567,63 @@ var LocalSkillSource = class {
     if (cached2?.contentHash === expectedContentHash) return cached2;
     return inspectSkillPackage(absolutePath, { expectedName: null });
   }
-  async scanRoot(resolvedRoot, visitedDirectories, ignoredPaths, mode) {
+  /**
+   * The root read as one package, or null when it does not hold a SKILL.md.
+   *
+   * `expectedName` is null here on purpose. A package inside a library must be
+   * named for its directory, but a root is whatever the person called the
+   * folder, so that rule would reject it with DIRECTORY_NAME_MISMATCH.
+   */
+  async scanRootAsPackage(resolvedRoot, ignoredPaths, mode) {
+    const directory = resolvedRoot.directory;
+    if (!await pathExists((0, import_node_path18.join)(directory, "SKILL.md"))) return null;
+    const canonicalRoot = await (0, import_promises2.realpath)(directory).catch(() => directory);
+    const name = import_node_path18.default.basename(canonicalRoot);
+    try {
+      const fingerprint = await fingerprintPackage(canonicalRoot);
+      const ignoreSignature = JSON.stringify(ignoredPaths);
+      const cached2 = this.inspectionCache.get(canonicalRoot);
+      const inspected = mode === "incremental" && cached2?.fingerprint === fingerprint && cached2.ignoreSignature === ignoreSignature ? cached2.inspected : await inspectSkillPackage(canonicalRoot, { ignoredPaths, expectedName: null });
+      this.inspectionCache.set(canonicalRoot, { fingerprint, ignoreSignature, inspected });
+      return {
+        candidates: [
+          {
+            absolutePath: canonicalRoot,
+            rootPath: canonicalRoot,
+            order: `${resolvedRoot.order}:${name}`,
+            candidate: {
+              localKey: createLocalKey(resolvedRoot.root, inspected.metadata.name),
+              name: inspected.metadata.name,
+              description: inspected.metadata.description,
+              contentHash: inspected.contentHash,
+              fileCount: inspected.fileCount,
+              totalBytes: inspected.totalBytes,
+              origin: candidateOrigin(resolvedRoot.root),
+              diagnostics: inspected.diagnostics
+            }
+          }
+        ],
+        diagnostics: [],
+        incomplete: false
+      };
+    } catch (error61) {
+      return {
+        candidates: [],
+        diagnostics: [
+          {
+            code: "INVALID_SKILL",
+            message: error61 instanceof Error ? error61.message : String(error61),
+            rootLabel: resolvedRoot.root.label,
+            localKey: createLocalKey(resolvedRoot.root, name)
+          }
+        ],
+        incomplete: false
+      };
+    }
+  }
+  async scanRoot(resolvedRoot, visitedDirectories, ignoredPaths, mode, declaredRoots) {
+    const rootPackage = await this.scanRootAsPackage(resolvedRoot, ignoredPaths, mode);
+    if (rootPackage) return rootPackage;
     let entries;
     try {
       entries = await (0, import_promises2.readdir)(resolvedRoot.directory, { withFileTypes: true });
@@ -74954,7 +75648,7 @@ var LocalSkillSource = class {
     );
     for (const entry of entries) {
       if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-      const candidatePath = (0, import_node_path16.join)(resolvedRoot.directory, entry.name);
+      const candidatePath = (0, import_node_path18.join)(resolvedRoot.directory, entry.name);
       const canonicalPath = await (0, import_promises2.realpath)(candidatePath).catch(() => null);
       if (!canonicalPath) {
         diagnostics.push({
@@ -74964,10 +75658,11 @@ var LocalSkillSource = class {
         });
         continue;
       }
-      if (!isWithinDirectory(canonicalRoot, canonicalPath)) {
+      const roots = declaredRoots.length > 0 ? declaredRoots : [canonicalRoot];
+      if (!roots.some((root) => isWithinDirectory(root, canonicalPath))) {
         diagnostics.push({
           code: "SOURCE_OUTSIDE_DECLARED_ROOT",
-          message: `Skill ${entry.name} resolves outside ${resolvedRoot.root.label}`,
+          message: `Skill ${entry.name} resolves outside every declared Skill source`,
           rootLabel: resolvedRoot.root.label
         });
         continue;
@@ -74985,6 +75680,7 @@ var LocalSkillSource = class {
         const localKey = createLocalKey(resolvedRoot.root, entry.name);
         candidates.push({
           absolutePath: canonicalPath,
+          rootPath: canonicalRoot,
           order: `${resolvedRoot.order}:${entry.name}`,
           candidate: {
             localKey,
@@ -75010,7 +75706,7 @@ var LocalSkillSource = class {
   }
 };
 async function fingerprintPackage(root) {
-  const hash2 = (0, import_node_crypto9.createHash)("sha256").update("alan-skill-stat-fingerprint-v1\0");
+  const hash2 = (0, import_node_crypto12.createHash)("sha256").update("alan-skill-stat-fingerprint-v1\0");
   await visit2(root, "");
   return `sha256:${hash2.digest("hex")}`;
   async function visit2(directory, relativeDirectory) {
@@ -75018,7 +75714,7 @@ async function fingerprintPackage(root) {
     entries.sort((left, right) => import_node_buffer2.Buffer.compare(import_node_buffer2.Buffer.from(left.name), import_node_buffer2.Buffer.from(right.name)));
     for (const entry of entries) {
       const path2 = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
-      const absolutePath = (0, import_node_path16.join)(directory, entry.name);
+      const absolutePath = (0, import_node_path18.join)(directory, entry.name);
       const metadata = await (0, import_promises2.lstat)(absolutePath);
       hash2.update(path2.normalize("NFC")).update("\0").update(
         entry.isDirectory() ? "d" : entry.isFile() ? "f" : entry.isSymbolicLink() ? "l" : "o"
@@ -75027,13 +75723,28 @@ async function fingerprintPackage(root) {
     }
   }
 }
+var CODEX_SOURCE_LABEL = "Codex skills";
+var STALE_CODEX_LABEL = "Legacy Cursor-compatible skills";
+var STALE_CODEX_PROVIDER = "cursor_agent_cli";
+function staleCodexDeclaration(relativeDirectory, label, providerKinds) {
+  const normalized = relativeDirectory.replaceAll("\\", "/").replace(/^\.\//, "");
+  if (normalized !== ".codex/skills") return false;
+  const ownedByCursor = providerKinds !== void 0 && providerKinds.length === 1 && providerKinds[0] === STALE_CODEX_PROVIDER;
+  return ownedByCursor || label === STALE_CODEX_LABEL;
+}
+async function canonicalDirectories(directories) {
+  const canonical = await Promise.all(
+    directories.map((directory) => (0, import_promises2.realpath)(directory).catch(() => directory))
+  );
+  return [...new Set(canonical)];
+}
 function isWithinDirectory(parent, candidate) {
-  const path2 = (0, import_node_path16.relative)(parent, candidate);
-  return path2 !== ".." && !path2.startsWith(`..${import_node_path16.sep}`) && !(0, import_node_path16.isAbsolute)(path2);
+  const path2 = (0, import_node_path18.relative)(parent, candidate);
+  return path2 !== ".." && !path2.startsWith(`..${import_node_path18.sep}`) && !(0, import_node_path18.isAbsolute)(path2);
 }
 async function loadSkillSourceConfig(homeDirectory) {
-  const configDirectory = (0, import_node_path16.join)(homeDirectory, ".alan");
-  const configPath = (0, import_node_path16.join)(configDirectory, "config.toml");
+  const configDirectory = (0, import_node_path18.join)(homeDirectory, ".alan");
+  const configPath = (0, import_node_path18.join)(configDirectory, "config.toml");
   await (0, import_promises2.mkdir)(configDirectory, { recursive: true, mode: 448 });
   let created = false;
   try {
@@ -75067,7 +75778,7 @@ async function resolveSkillScanInput(homeDirectory, declared) {
   }
   const { config: config2 } = loaded;
   if (!config2.enabled) return { ...declared, roots: [], ignoredPaths: config2.ignoredPaths };
-  const draftsPath = (0, import_node_path16.resolve)((0, import_node_path16.join)(homeDirectory, ".alan", "skill-sources"));
+  const draftsPath = (0, import_node_path18.resolve)((0, import_node_path18.join)(homeDirectory, ".alan", "skill-sources"));
   const enabledProviders = new Set(declared.enabledProviderKinds ?? []);
   const configured = [];
   for (const source of config2.sources) {
@@ -75075,7 +75786,7 @@ async function resolveSkillScanInput(homeDirectory, declared) {
       continue;
     }
     configured.push(
-      (0, import_node_path16.resolve)(source.path) === draftsPath ? { kind: "drafts", path: source.path, label: "Alan drafts" } : {
+      (0, import_node_path18.resolve)(source.path) === draftsPath ? { kind: "drafts", path: source.path, label: "Alan drafts" } : {
         kind: "configured",
         declarationId: source.declarationId,
         path: source.path,
@@ -75093,7 +75804,7 @@ async function resolveSkillScanInput(homeDirectory, declared) {
 }
 function parseSkillSourceConfig(content, homeDirectory) {
   const parsed = parse5(content);
-  if (!isRecord3(parsed) || parsed.version !== 1 || !isRecord3(parsed.skills)) {
+  if (!isRecord4(parsed) || parsed.version !== 1 || !isRecord4(parsed.skills)) {
     throw new Error("~/.alan/config.toml must contain version = 1 and a [skills] table");
   }
   const skills = parsed.skills;
@@ -75109,7 +75820,7 @@ function parseSkillSourceConfig(content, homeDirectory) {
     throw new Error("~/.alan/config.toml must declare at least one [[skills.sources]] table");
   }
   const sources = skills.sources.map((value2, index) => {
-    if (!isRecord3(value2) || typeof value2.path !== "string" || typeof value2.label !== "string") {
+    if (!isRecord4(value2) || typeof value2.path !== "string" || typeof value2.label !== "string") {
       throw new Error(
         `skills.sources entry ${index + 1} must contain string path and label values`
       );
@@ -75122,14 +75833,16 @@ function parseSkillSourceConfig(content, homeDirectory) {
       value2.providers,
       `skills.sources[${index}].providers`
     );
-    const relativeDirectory = import_node_path16.default.relative(homeDirectory, sourcePath);
+    const relativeDirectory = import_node_path18.default.relative(homeDirectory, sourcePath);
     const inferredProviders = providerKindsForUserDirectory(relativeDirectory);
+    const declaredProviders = value2.providers === void 0 ? inferredProviders : [...new Set(explicitProviders.map((provider) => provider.trim()).filter(Boolean))];
+    const stale = staleCodexDeclaration(relativeDirectory, label, declaredProviders);
     return {
       declarationId,
       path: sourcePath,
-      label,
+      label: stale ? CODEX_SOURCE_LABEL : label,
       precedence: index,
-      providerKinds: value2.providers === void 0 ? inferredProviders : [...new Set(explicitProviders.map((provider) => provider.trim()).filter(Boolean))]
+      providerKinds: stale ? inferredProviders : declaredProviders
     };
   });
   const duplicateId = sources.find(
@@ -75141,7 +75854,7 @@ function parseSkillSourceConfig(content, homeDirectory) {
   return { enabled, publishChanges, discoverRepositorySkills, ignoredPaths, sources };
 }
 function stableSourceDeclarationId(sourcePath) {
-  const digest = (0, import_node_crypto9.createHash)("sha256").update("alan-skill-source-v1\0").update(sourcePath.normalize("NFC")).digest("hex").slice(0, 24);
+  const digest = (0, import_node_crypto12.createHash)("sha256").update("alan-skill-source-v1\0").update(sourcePath.normalize("NFC")).digest("hex").slice(0, 24);
   return `source-${digest}`;
 }
 function requiredSourceId(value2, field) {
@@ -75150,7 +75863,7 @@ function requiredSourceId(value2, field) {
   }
   return value2;
 }
-function resolveSkillSourcePath(sourcePath, homeDirectory, pathApi = import_node_path16.default) {
+function resolveSkillSourcePath(sourcePath, homeDirectory, pathApi = import_node_path18.default) {
   const trimmed = sourcePath.trim();
   if (trimmed === "~") return pathApi.resolve(homeDirectory);
   if (trimmed.startsWith("~/") || trimmed.startsWith("~\\")) {
@@ -75185,7 +75898,7 @@ function resolveScanRoots(roots, enabledProviderKinds) {
       ).entries()) {
         resolved.push({
           root,
-          directory: (0, import_node_path16.join)(root.path, relativeDirectory),
+          directory: (0, import_node_path18.join)(root.path, relativeDirectory),
           order: `1:${root.repositoryId}:${String(index).padStart(2, "0")}`
         });
       }
@@ -75207,11 +75920,11 @@ function candidateOrigin(root) {
 }
 function createLocalKey(root, skillName) {
   const rootIdentity = root.kind === "configured" ? `configured:${root.declarationId}` : root.kind === "repository" ? `repository:${root.repositoryId}` : "drafts";
-  const digest = (0, import_node_crypto9.createHash)("sha256").update("alan-local-skill-v1\0").update(rootIdentity).update("\0").update(skillName.normalize("NFC")).digest("hex");
+  const digest = (0, import_node_crypto12.createHash)("sha256").update("alan-local-skill-v1\0").update(rootIdentity).update("\0").update(skillName.normalize("NFC")).digest("hex");
   return `local:${digest}`;
 }
 function hashInventory(candidates) {
-  const hash2 = (0, import_node_crypto9.createHash)("sha256");
+  const hash2 = (0, import_node_crypto12.createHash)("sha256");
   hash2.update("alan-skill-inventory-v1\0");
   for (const candidate of candidates) {
     hash2.update(candidate.localKey);
@@ -75224,16 +75937,27 @@ function hashInventory(candidates) {
   return `sha256:${hash2.digest("hex")}`;
 }
 function deduplicateCandidatesByContent(candidates) {
-  const seen = /* @__PURE__ */ new Set();
-  return candidates.filter(({ candidate }) => {
-    if (seen.has(candidate.contentHash)) return false;
-    seen.add(candidate.contentHash);
+  const bestByContent = /* @__PURE__ */ new Map();
+  for (const located of candidates) {
+    const existing = bestByContent.get(located.candidate.contentHash);
+    if (!existing || located.rootPath.length > existing.rootPath.length) {
+      bestByContent.set(located.candidate.contentHash, located);
+    }
+  }
+  const winners = new Set(bestByContent.values());
+  return candidates.filter((located) => winners.has(located));
+}
+async function pathExists(candidate) {
+  try {
+    await (0, import_promises2.access)(candidate);
     return true;
-  });
+  } catch {
+    return false;
+  }
 }
 async function hasManagedMarker(directory) {
   try {
-    await (0, import_promises2.access)((0, import_node_path16.join)(directory, ".alan-managed.json"));
+    await (0, import_promises2.access)((0, import_node_path18.join)(directory, ".alan-managed.json"));
     return true;
   } catch {
     return false;
@@ -75252,7 +75976,7 @@ function isMissingPath(error61) {
 function isAlreadyPresent(error61) {
   return typeof error61 === "object" && error61 !== null && "code" in error61 && error61.code === "EEXIST";
 }
-function isRecord3(value2) {
+function isRecord4(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 
@@ -75386,8 +76110,8 @@ var RuntimeSkillCoordinator = class {
   async runExclusively(work) {
     const previous = this.tail;
     let release2;
-    this.tail = new Promise((resolve14) => {
-      release2 = resolve14;
+    this.tail = new Promise((resolve15) => {
+      release2 = resolve15;
     });
     await previous;
     try {
@@ -75400,14 +76124,14 @@ var RuntimeSkillCoordinator = class {
 
 // src/skills/runtime-skill-manager.ts
 var import_node_buffer5 = require("buffer");
-var import_node_crypto12 = require("crypto");
+var import_node_crypto15 = require("crypto");
 var import_promises5 = require("fs/promises");
-var import_node_path19 = require("path");
+var import_node_path21 = require("path");
 
 // src/skills/managed-skill-store.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var import_promises3 = require("fs/promises");
-var import_node_path17 = require("path");
+var import_node_path19 = require("path");
 var EMPTY_STATE = {
   version: 1,
   sources: {},
@@ -75426,7 +76150,7 @@ var ManagedSkillStore = class _ManagedSkillStore {
   static async open(baseDirectory) {
     await (0, import_promises3.mkdir)(baseDirectory, { recursive: true, mode: 448 });
     try {
-      const parsed = JSON.parse(await (0, import_promises3.readFile)((0, import_node_path17.join)(baseDirectory, "state.json"), "utf8"));
+      const parsed = JSON.parse(await (0, import_promises3.readFile)((0, import_node_path19.join)(baseDirectory, "state.json"), "utf8"));
       return new _ManagedSkillStore(baseDirectory, parseState(parsed), "verified");
     } catch (error61) {
       if (isMissingPath2(error61)) {
@@ -75525,10 +76249,10 @@ var ManagedSkillStore = class _ManagedSkillStore {
     this.canRemoveManagedFiles = true;
   }
   async persist() {
-    const statePath = (0, import_node_path17.join)(this.baseDirectory, "state.json");
-    const pendingPath = (0, import_node_path17.join)(
+    const statePath = (0, import_node_path19.join)(this.baseDirectory, "state.json");
+    const pendingPath = (0, import_node_path19.join)(
       this.baseDirectory,
-      `.state.json.pending-${process.pid}-${(0, import_node_crypto10.randomBytes)(6).toString("hex")}`
+      `.state.json.pending-${process.pid}-${(0, import_node_crypto13.randomBytes)(6).toString("hex")}`
     );
     try {
       await (0, import_promises3.writeFile)(pendingPath, `${JSON.stringify(this.state, null, 2)}
@@ -75544,13 +76268,13 @@ var ManagedSkillStore = class _ManagedSkillStore {
   }
 };
 function parseState(value2) {
-  if (!isRecord4(value2) || value2.version !== 1) throw new Error("unsupported Skill state version");
-  if (!isRecord4(value2.sources) || !isRecord4(value2.projections)) {
+  if (!isRecord5(value2) || value2.version !== 1) throw new Error("unsupported Skill state version");
+  if (!isRecord5(value2.sources) || !isRecord5(value2.projections)) {
     throw new Error("invalid Skill state maps");
   }
   const sources = {};
   for (const [localKey, source] of Object.entries(value2.sources)) {
-    if (!localKey.startsWith("local:") || !isRecord4(source) || typeof source.absolutePath !== "string" || !isSha256(source.contentHash)) {
+    if (!localKey.startsWith("local:") || !isRecord5(source) || typeof source.absolutePath !== "string" || !isSha256(source.contentHash)) {
       throw new Error("invalid Skill source state");
     }
     const publication = parsePublication(source.publication, source.contentHash);
@@ -75562,7 +76286,7 @@ function parseState(value2) {
   }
   const projections = {};
   for (const [directory, projection] of Object.entries(value2.projections)) {
-    if (!directory || !isRecord4(projection) || typeof projection.skillId !== "string" || typeof projection.versionId !== "string" || !isSha256(projection.contentHash)) {
+    if (!directory || !isRecord5(projection) || typeof projection.skillId !== "string" || typeof projection.versionId !== "string" || !isSha256(projection.contentHash)) {
       throw new Error("invalid Skill projection state");
     }
     projections[directory] = {
@@ -75583,7 +76307,7 @@ function parseState(value2) {
 }
 function parsePublication(value2, sourceHash) {
   if (value2 === void 0) return void 0;
-  if (!isRecord4(value2) || typeof value2.skillId !== "string" || typeof value2.versionId !== "string" || !isSha256(value2.contentHash) || value2.contentHash !== sourceHash) {
+  if (!isRecord5(value2) || typeof value2.skillId !== "string" || typeof value2.versionId !== "string" || !isSha256(value2.contentHash) || value2.contentHash !== sourceHash) {
     throw new Error("invalid Skill source publication state");
   }
   return {
@@ -75600,7 +76324,7 @@ function optionalSha256(value2) {
 function isSha256(value2) {
   return typeof value2 === "string" && /^sha256:[a-f0-9]{64}$/.test(value2);
 }
-function isRecord4(value2) {
+function isRecord5(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function isMissingPath2(error61) {
@@ -75609,9 +76333,9 @@ function isMissingPath2(error61) {
 
 // ../shared/dist/node/skill-bundle.js
 var import_node_buffer3 = require("buffer");
-var import_node_crypto11 = require("crypto");
+var import_node_crypto14 = require("crypto");
 var import_promises4 = require("fs/promises");
-var import_node_path18 = require("path");
+var import_node_path20 = require("path");
 var import_node_stream = require("stream");
 var import_node_zlib = require("zlib");
 var import_tar_stream = __toESM(require_tar_stream(), 1);
@@ -75620,7 +76344,7 @@ async function createSkillBundle(packageRoot) {
   const archive = (0, import_tar_stream.pack)();
   const tarPromise = collectStream(archive);
   for (const file2 of before.files) {
-    const bytes2 = await (0, import_promises4.readFile)((0, import_node_path18.join)(packageRoot, ...file2.path.split("/")));
+    const bytes2 = await (0, import_promises4.readFile)((0, import_node_path20.join)(packageRoot, ...file2.path.split("/")));
     await addArchiveEntry(archive, {
       name: file2.path,
       type: "file",
@@ -75671,8 +76395,8 @@ async function collectStream(stream) {
   return import_node_buffer3.Buffer.concat(chunks);
 }
 function addArchiveEntry(archive, header, bytes) {
-  return new Promise((resolve14, reject) => {
-    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve14());
+  return new Promise((resolve15, reject) => {
+    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve15());
   });
 }
 async function decompressBounded(archiveBytes) {
@@ -75698,7 +76422,7 @@ async function extractTar(tarBytes, destination) {
   const extractor = (0, import_tar_stream.extract)();
   let fileCount = 0;
   let totalBytes = 0;
-  const completion = new Promise((resolve14, reject) => {
+  const completion = new Promise((resolve15, reject) => {
     extractor.on("entry", (header, stream, next) => {
       void extractEntry(header, stream, destination, {
         addFile(size) {
@@ -75713,7 +76437,7 @@ async function extractTar(tarBytes, destination) {
         }
       }).then(next, (error61) => extractor.destroy(error61 instanceof Error ? error61 : new Error(String(error61))));
     });
-    extractor.once("finish", resolve14);
+    extractor.once("finish", resolve15);
     extractor.once("error", reject);
   });
   import_node_stream.Readable.from(tarBytes).pipe(extractor);
@@ -75735,19 +76459,19 @@ async function extractEntry(header, stream, destination, limits) {
   if (bytes.byteLength !== declaredSize) {
     throw new Error(`Skill archive file size is invalid: ${path2}`);
   }
-  const outputPath = (0, import_node_path18.join)(destination, ...path2.split("/"));
-  await (0, import_promises4.mkdir)((0, import_node_path18.dirname)(outputPath), { recursive: true, mode: 448 });
+  const outputPath = (0, import_node_path20.join)(destination, ...path2.split("/"));
+  await (0, import_promises4.mkdir)((0, import_node_path20.dirname)(outputPath), { recursive: true, mode: 448 });
   await (0, import_promises4.writeFile)(outputPath, bytes, { mode: (header.mode ?? 420) & 73 ? 493 : 420 });
 }
 function requireSafeArchivePath(value2) {
   const normalized = value2.replaceAll("\\", "/").normalize("NFC");
-  if (!normalized || normalized.startsWith("/") || normalized.includes("\0") || import_node_path18.posix.normalize(normalized) !== normalized || normalized === ".." || normalized.startsWith("../")) {
+  if (!normalized || normalized.startsWith("/") || normalized.includes("\0") || import_node_path20.posix.normalize(normalized) !== normalized || normalized === ".." || normalized.startsWith("../")) {
     throw new Error(`Skill archive contains an unsafe path: ${value2}`);
   }
   return normalized;
 }
 function sha2562(bytes) {
-  return `sha256:${(0, import_node_crypto11.createHash)("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto14.createHash)("sha256").update(bytes).digest("hex")}`;
 }
 
 // src/skills/skill-control-client.ts
@@ -75820,14 +76544,14 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
   }
   reconcileTail = Promise.resolve();
   static async open(options) {
-    const skillsStateDirectory = (0, import_node_path19.join)(options.homeDirectory, ".alan", "skills");
-    const managedSkillsDirectory = (0, import_node_path19.join)(options.homeDirectory, ".agents", "skills");
+    const skillsStateDirectory = (0, import_node_path21.join)(options.homeDirectory, ".alan", "skills");
+    const managedSkillsDirectory = (0, import_node_path21.join)(options.homeDirectory, ".agents", "skills");
     const store = await ManagedSkillStore.open(skillsStateDirectory);
     return new _RuntimeSkillManager(
       skillsStateDirectory,
       managedSkillsDirectory,
-      (0, import_node_path19.join)(options.homeDirectory, ".claude", "skills"),
-      (0, import_node_path19.join)(options.homeDirectory, ".alan", "sync-manifest.json"),
+      (0, import_node_path21.join)(options.homeDirectory, ".claude", "skills"),
+      (0, import_node_path21.join)(options.homeDirectory, ".alan", "sync-manifest.json"),
       store,
       options.downloadBundle ?? downloadBundleWithFetch,
       options.localSource ?? new LocalSkillSource(),
@@ -75986,7 +76710,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     if (!runtimeDirectory) {
       throw new Error("Selected Skill version is not installed on this runtime");
     }
-    const packageDirectory = (0, import_node_path19.join)(this.managedSkillsDirectory, runtimeDirectory);
+    const packageDirectory = (0, import_node_path21.join)(this.managedSkillsDirectory, runtimeDirectory);
     const marker = await readMarker(packageDirectory);
     if (!marker || marker.skillId !== invocation.skillId || marker.versionId !== invocation.versionId) {
       throw new Error("Selected Skill projection is missing or no longer owned by Alan");
@@ -76000,11 +76724,11 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
   async reconcileUnlocked(manifest) {
     const desired = desiredSkillManifestSchema.parse(manifest);
     await (0, import_promises5.mkdir)(this.managedSkillsDirectory, { recursive: true, mode: 448 });
-    await (0, import_promises5.mkdir)((0, import_node_path19.join)(this.skillsStateDirectory, "cache", "sha256"), {
+    await (0, import_promises5.mkdir)((0, import_node_path21.join)(this.skillsStateDirectory, "cache", "sha256"), {
       recursive: true,
       mode: 448
     });
-    await (0, import_promises5.mkdir)((0, import_node_path19.join)(this.skillsStateDirectory, "tmp"), { recursive: true, mode: 448 });
+    await (0, import_promises5.mkdir)((0, import_node_path21.join)(this.skillsStateDirectory, "tmp"), { recursive: true, mode: 448 });
     const results = [];
     const nextProjections = {};
     for (const entry of desired.skills) {
@@ -76049,13 +76773,13 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
       await this.retireLegacySyncManifest();
     }
     return {
-      attemptId: (0, import_node_crypto12.randomUUID)(),
+      attemptId: (0, import_node_crypto15.randomUUID)(),
       desiredRevision: desired.revision,
       skills: results
     };
   }
   async reuseCurrentProjection(entry) {
-    const destination = (0, import_node_path19.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
+    const destination = (0, import_node_path21.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
     const marker = await readMarker(destination);
     if (marker?.skillId !== entry.skillId || marker.versionId !== entry.versionId || marker.contentHash !== entry.contentHash || !await packageMatches(destination, entry.contentHash)) {
       return null;
@@ -76064,19 +76788,19 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     return entry.contentHash;
   }
   async adoptLegacyProjection(entry) {
-    const destination = (0, import_node_path19.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
-    if (await pathExists(destination)) return;
+    const destination = (0, import_node_path21.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
+    if (await pathExists2(destination)) return;
     const manifest = await readLegacyManifest(this.legacyManifestPath);
     const legacy = manifest?.skills[entry.slug];
     if (!legacy) return;
-    const source = (0, import_node_path19.join)(this.managedSkillsDirectory, entry.slug);
+    const source = (0, import_node_path21.join)(this.managedSkillsDirectory, entry.slug);
     if (!await legacyFileMatches(source, legacy.hash) || !await packageMatches(source, entry.contentHash)) {
       return;
     }
     await (0, import_promises5.rename)(source, destination);
     try {
       await (0, import_promises5.writeFile)(
-        (0, import_node_path19.join)(destination, ".alan-managed.json"),
+        (0, import_node_path21.join)(destination, ".alan-managed.json"),
         `${JSON.stringify(markerFor(entry), null, 2)}
 `,
         { encoding: "utf8", flag: "wx", mode: 384 }
@@ -76085,19 +76809,19 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
       await (0, import_promises5.rename)(destination, source).catch(() => void 0);
       throw error61;
     }
-    await removeExactLegacySkill((0, import_node_path19.join)(this.compatibilitySkillsDirectory, entry.slug), legacy.hash);
+    await removeExactLegacySkill((0, import_node_path21.join)(this.compatibilitySkillsDirectory, entry.slug), legacy.hash);
   }
   async retireLegacySyncManifest() {
     const manifest = await readLegacyManifest(this.legacyManifestPath);
     if (!manifest) return;
     for (const [command, entry] of Object.entries(manifest.skills)) {
-      await removeExactLegacySkill((0, import_node_path19.join)(this.managedSkillsDirectory, command), entry.hash);
-      await removeExactLegacySkill((0, import_node_path19.join)(this.compatibilitySkillsDirectory, command), entry.hash);
+      await removeExactLegacySkill((0, import_node_path21.join)(this.managedSkillsDirectory, command), entry.hash);
+      await removeExactLegacySkill((0, import_node_path21.join)(this.compatibilitySkillsDirectory, command), entry.hash);
     }
     await (0, import_promises5.rm)(this.legacyManifestPath, { force: true });
   }
   async ensureCached(entry) {
-    const cacheDirectory = (0, import_node_path19.join)(
+    const cacheDirectory = (0, import_node_path21.join)(
       this.skillsStateDirectory,
       "cache",
       "sha256",
@@ -76111,10 +76835,10 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
         `Downloaded Skill bundle length ${bytes.byteLength} does not match ${entry.compressedBytes}`
       );
     }
-    const pendingDirectory = (0, import_node_path19.join)(
+    const pendingDirectory = (0, import_node_path21.join)(
       this.skillsStateDirectory,
       "tmp",
-      `cache-${process.pid}-${(0, import_node_crypto12.randomBytes)(8).toString("hex")}`
+      `cache-${process.pid}-${(0, import_node_crypto15.randomBytes)(8).toString("hex")}`
     );
     try {
       await extractSkillBundle(bytes, pendingDirectory, {
@@ -76132,22 +76856,22 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     return cacheDirectory;
   }
   async project(entry, cacheDirectory) {
-    const destination = (0, import_node_path19.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
+    const destination = (0, import_node_path21.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
     const existing = await readMarker(destination);
     if (existing?.skillId === entry.skillId && existing.versionId === entry.versionId && existing.contentHash === entry.contentHash && await packageMatches(destination, entry.contentHash)) {
       await this.ensureCompatibilityProjection(entry, destination);
       return entry.contentHash;
     }
-    const suffix = `${process.pid}-${(0, import_node_crypto12.randomBytes)(8).toString("hex")}`;
-    const pending = (0, import_node_path19.join)(this.managedSkillsDirectory, `.pending-${suffix}`);
-    const backup = (0, import_node_path19.join)(this.managedSkillsDirectory, `.backup-${suffix}`);
+    const suffix = `${process.pid}-${(0, import_node_crypto15.randomBytes)(8).toString("hex")}`;
+    const pending = (0, import_node_path21.join)(this.managedSkillsDirectory, `.pending-${suffix}`);
+    const backup = (0, import_node_path21.join)(this.managedSkillsDirectory, `.backup-${suffix}`);
     let movedExisting = false;
     let installedPending = false;
     let completed = false;
     try {
       await (0, import_promises5.cp)(cacheDirectory, pending, { recursive: true, errorOnExist: true, force: false });
       await (0, import_promises5.writeFile)(
-        (0, import_node_path19.join)(pending, ".alan-managed.json"),
+        (0, import_node_path21.join)(pending, ".alan-managed.json"),
         `${JSON.stringify(markerFor(entry), null, 2)}
 `,
         { encoding: "utf8", flag: "wx", mode: 384 }
@@ -76155,7 +76879,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
       if (!await packageMatches(pending, entry.contentHash)) {
         throw new Error("Pending managed Skill projection failed content verification");
       }
-      if (await pathExists(destination)) {
+      if (await pathExists2(destination)) {
         await (0, import_promises5.rename)(destination, backup);
         movedExisting = true;
       }
@@ -76177,7 +76901,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     } catch (error61) {
       if (!completed && installedPending) {
         await (0, import_promises5.rm)(destination, { recursive: true, force: true });
-        if (movedExisting && await pathExists(backup)) await (0, import_promises5.rename)(backup, destination);
+        if (movedExisting && await pathExists2(backup)) await (0, import_promises5.rename)(backup, destination);
       }
       throw error61;
     } finally {
@@ -76188,8 +76912,8 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     }
   }
   async requireReplaceable(entry) {
-    const destination = (0, import_node_path19.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
-    if (!await pathExists(destination)) return;
+    const destination = (0, import_node_path21.join)(this.managedSkillsDirectory, entry.runtimeDirectory);
+    if (!await pathExists2(destination)) return;
     const marker = await readMarker(destination);
     if (!marker) throw unmanagedPathConflict(entry.runtimeDirectory);
     if (marker.skillId === entry.skillId && marker.versionId === entry.versionId && marker.contentHash === entry.contentHash && await packageMatches(destination, entry.contentHash)) {
@@ -76205,10 +76929,10 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     if (!this.store.inspect().canRemoveManagedFiles) return failures;
     for (const [runtimeDirectory, recorded] of Object.entries(this.store.projections())) {
       if (desired[runtimeDirectory]) continue;
-      const destination = (0, import_node_path19.join)(this.managedSkillsDirectory, runtimeDirectory);
-      const compatibility = (0, import_node_path19.join)(this.compatibilitySkillsDirectory, runtimeDirectory);
+      const destination = (0, import_node_path21.join)(this.managedSkillsDirectory, runtimeDirectory);
+      const compatibility = (0, import_node_path21.join)(this.compatibilitySkillsDirectory, runtimeDirectory);
       const marker = await readMarker(destination);
-      if (!await pathExists(destination)) continue;
+      if (!await pathExists2(destination)) continue;
       if (marker && markerMatchesProjection(marker, recorded)) {
         if (!await removeCompatibilityProjection(compatibility, destination, recorded)) {
           failures.push({
@@ -76237,8 +76961,8 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
   }
   async ensureCompatibilityProjection(entry, canonicalDirectory) {
     await (0, import_promises5.mkdir)(this.compatibilitySkillsDirectory, { recursive: true, mode: 448 });
-    const destination = (0, import_node_path19.join)(this.compatibilitySkillsDirectory, entry.runtimeDirectory);
-    if (await pathExists(destination)) {
+    const destination = (0, import_node_path21.join)(this.compatibilitySkillsDirectory, entry.runtimeDirectory);
+    if (await pathExists2(destination)) {
       if (await compatibilityProjectionMatches(destination, canonicalDirectory, entry)) return;
       throw unmanagedCompatibilityConflict(entry.runtimeDirectory);
     }
@@ -76248,11 +76972,11 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     } catch (error61) {
       if (!isSymlinkUnsupported(error61)) throw error61;
     }
-    const pending = `${destination}.pending-${process.pid}-${(0, import_node_crypto12.randomBytes)(6).toString("hex")}`;
+    const pending = `${destination}.pending-${process.pid}-${(0, import_node_crypto15.randomBytes)(6).toString("hex")}`;
     try {
       await (0, import_promises5.cp)(canonicalDirectory, pending, { recursive: true, errorOnExist: true, force: false });
       await (0, import_promises5.writeFile)(
-        (0, import_node_path19.join)(pending, ".alan-compatibility.json"),
+        (0, import_node_path21.join)(pending, ".alan-compatibility.json"),
         `${JSON.stringify({ ...markerFor(entry), canonicalDirectory }, null, 2)}
 `,
         { encoding: "utf8", flag: "wx", mode: 384 }
@@ -76265,8 +76989,8 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
   async runExclusively(work) {
     const previous = this.reconcileTail;
     let release2;
-    this.reconcileTail = new Promise((resolve14) => {
-      release2 = resolve14;
+    this.reconcileTail = new Promise((resolve15) => {
+      release2 = resolve15;
     });
     await previous;
     try {
@@ -76277,14 +77001,14 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
   }
   async withMachineLock(work) {
     await (0, import_promises5.mkdir)(this.skillsStateDirectory, { recursive: true, mode: 448 });
-    const lockDirectory = (0, import_node_path19.join)(this.skillsStateDirectory, "manager.lock");
+    const lockDirectory = (0, import_node_path21.join)(this.skillsStateDirectory, "manager.lock");
     const deadline = Date.now() + 3e4;
     while (true) {
       try {
         await (0, import_promises5.mkdir)(lockDirectory, { mode: 448 });
         try {
           await (0, import_promises5.writeFile)(
-            (0, import_node_path19.join)(lockDirectory, "owner.json"),
+            (0, import_node_path21.join)(lockDirectory, "owner.json"),
             `${JSON.stringify({ pid: process.pid, acquiredAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
             { encoding: "utf8", flag: "wx", mode: 384 }
@@ -76334,7 +77058,7 @@ async function packageMatches(directory, expectedHash) {
 async function readMarker(directory) {
   try {
     const value2 = JSON.parse(
-      await (0, import_promises5.readFile)((0, import_node_path19.join)(directory, ".alan-managed.json"), "utf8")
+      await (0, import_promises5.readFile)((0, import_node_path21.join)(directory, ".alan-managed.json"), "utf8")
     );
     if (typeof value2 !== "object" || value2 === null || !("protocolVersion" in value2) || value2.protocolVersion !== SKILLS_PROTOCOL_VERSION || !("skillId" in value2) || typeof value2.skillId !== "string" || !("versionId" in value2) || typeof value2.versionId !== "string" || !("contentHash" in value2) || typeof value2.contentHash !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value2.contentHash)) {
       return null;
@@ -76348,18 +77072,18 @@ async function compatibilityProjectionMatches(destination, canonicalDirectory, e
   const metadata = await (0, import_promises5.lstat)(destination);
   if (metadata.isSymbolicLink()) {
     const target = await (0, import_promises5.readlink)(destination);
-    return (0, import_node_path19.resolve)((0, import_node_path19.dirname)(destination), target) === (0, import_node_path19.resolve)(canonicalDirectory);
+    return (0, import_node_path21.resolve)((0, import_node_path21.dirname)(destination), target) === (0, import_node_path21.resolve)(canonicalDirectory);
   }
   if (!metadata.isDirectory()) return false;
   const marker = await readCompatibilityMarker(destination);
   return marker?.canonicalDirectory === canonicalDirectory && marker.skillId === entry.skillId && marker.versionId === entry.versionId && marker.contentHash === entry.contentHash && await packageMatches(destination, entry.contentHash);
 }
 async function removeCompatibilityProjection(destination, canonicalDirectory, projection) {
-  if (!await pathExists(destination)) return true;
+  if (!await pathExists2(destination)) return true;
   const metadata = await (0, import_promises5.lstat)(destination);
   if (metadata.isSymbolicLink()) {
     const target = await (0, import_promises5.readlink)(destination);
-    if ((0, import_node_path19.resolve)((0, import_node_path19.dirname)(destination), target) !== (0, import_node_path19.resolve)(canonicalDirectory)) return false;
+    if ((0, import_node_path21.resolve)((0, import_node_path21.dirname)(destination), target) !== (0, import_node_path21.resolve)(canonicalDirectory)) return false;
     await (0, import_promises5.rm)(destination, { force: true });
     return true;
   }
@@ -76371,7 +77095,7 @@ async function removeCompatibilityProjection(destination, canonicalDirectory, pr
 async function readCompatibilityMarker(directory) {
   try {
     const value2 = JSON.parse(
-      await (0, import_promises5.readFile)((0, import_node_path19.join)(directory, ".alan-compatibility.json"), "utf8")
+      await (0, import_promises5.readFile)((0, import_node_path21.join)(directory, ".alan-compatibility.json"), "utf8")
     );
     if (value2.protocolVersion !== SKILLS_PROTOCOL_VERSION || typeof value2.skillId !== "string" || typeof value2.versionId !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value2.contentHash) || typeof value2.canonicalDirectory !== "string") {
       return null;
@@ -76411,15 +77135,15 @@ async function legacyFileMatches(directory, expectedHash) {
   try {
     const metadata = await (0, import_promises5.lstat)(directory);
     if (!metadata.isDirectory() || metadata.isSymbolicLink()) return false;
-    const content = await (0, import_promises5.readFile)((0, import_node_path19.join)(directory, "SKILL.md"));
-    return (0, import_node_crypto12.createHash)("sha256").update(content).digest("hex").slice(0, 16) === expectedHash;
+    const content = await (0, import_promises5.readFile)((0, import_node_path21.join)(directory, "SKILL.md"));
+    return (0, import_node_crypto15.createHash)("sha256").update(content).digest("hex").slice(0, 16) === expectedHash;
   } catch {
     return false;
   }
 }
 async function removeExactLegacySkill(directory, expectedHash) {
   if (!await legacyFileMatches(directory, expectedHash)) return;
-  await (0, import_promises5.rm)((0, import_node_path19.join)(directory, "SKILL.md"), { force: true });
+  await (0, import_promises5.rm)((0, import_node_path21.join)(directory, "SKILL.md"), { force: true });
   const remaining = await (0, import_promises5.readdir)(directory);
   if (remaining.length === 0) await (0, import_promises5.rm)(directory, { recursive: true, force: true });
 }
@@ -76442,7 +77166,7 @@ function localRasterMediaType(path2) {
 function localTextMediaType(path2) {
   return path2.toLowerCase().endsWith(".md") ? "text/markdown; charset=utf-8" : "text/plain; charset=utf-8";
 }
-async function pathExists(path2) {
+async function pathExists2(path2) {
   try {
     await (0, import_promises5.lstat)(path2);
     return true;
@@ -76537,10 +77261,10 @@ var SuspensionDetector = class {
 async function startDaemon(args) {
   bindConfigPath(args);
   const stored = readConfig();
-  const installationId = stored.installationId ?? (0, import_node_crypto13.randomUUID)();
+  const installationId = stored.installationId ?? (0, import_node_crypto16.randomUUID)();
   const configPath = getConfigPath();
   const endpointProfile = stored.endpointProfile ?? resolveEndpointProfile(args);
-  const daemonSessionId = (0, import_node_crypto13.randomUUID)();
+  const daemonSessionId = (0, import_node_crypto16.randomUUID)();
   let heartbeatSeq = 0;
   const runtimeId = argValue(args, "--runtime-id") ?? process.env.ALAN_RUNTIME_ID ?? stored.runtimeId;
   const runtimeTokenOverride = argValue(args, "--token") ?? process.env.ALAN_RUNTIME_TOKEN;
@@ -76557,11 +77281,11 @@ async function startDaemon(args) {
     wsUrl = endpointMismatch.expectedWsUrl;
   }
   let localApiPort = getLocalApiPort(args, stored);
-  const localApiToken = stored.localApiToken ?? (0, import_node_crypto13.randomBytes)(24).toString("hex");
-  const localServiceId = stored.localServiceId ?? (0, import_node_crypto13.randomUUID)();
-  const localServiceSecret = stored.localServiceSecret ?? (0, import_node_crypto13.randomBytes)(32).toString("base64url");
+  const localApiToken = stored.localApiToken ?? (0, import_node_crypto16.randomBytes)(24).toString("hex");
+  const localServiceId = stored.localServiceId ?? (0, import_node_crypto16.randomUUID)();
+  const localServiceSecret = stored.localServiceSecret ?? (0, import_node_crypto16.randomBytes)(32).toString("base64url");
   const localServiceStartedAtMs = Date.now();
-  const eventSpoolKey = stored.eventSpoolKey ?? (0, import_node_crypto13.randomBytes)(32).toString("base64url");
+  const eventSpoolKey = stored.eventSpoolKey ?? (0, import_node_crypto16.randomBytes)(32).toString("base64url");
   if (stored.daemonEpoch !== void 0 && (!Number.isSafeInteger(stored.daemonEpoch) || stored.daemonEpoch < 0 || stored.daemonEpoch >= Number.MAX_SAFE_INTEGER)) {
     throw new Error("daemon config contains an invalid durable epoch; repair the runtime config");
   }
@@ -76659,17 +77383,17 @@ async function startDaemon(args) {
     installationId
   });
   const recentLogs = [];
-  const daemonLogPath = (0, import_node_path20.join)((0, import_node_path20.dirname)(configPath), "logs", "daemon.log");
+  const daemonLogPath = (0, import_node_path22.join)((0, import_node_path22.dirname)(configPath), "logs", "daemon.log");
   const persistDaemonLog = (line) => {
     try {
-      (0, import_node_fs17.mkdirSync)((0, import_node_path20.dirname)(daemonLogPath), { recursive: true });
+      (0, import_node_fs20.mkdirSync)((0, import_node_path22.dirname)(daemonLogPath), { recursive: true });
       try {
-        if ((0, import_node_fs17.statSync)(daemonLogPath).size > 5 * 1024 * 1024) {
-          (0, import_node_fs17.renameSync)(daemonLogPath, `${daemonLogPath}.1`);
+        if ((0, import_node_fs20.statSync)(daemonLogPath).size > 5 * 1024 * 1024) {
+          (0, import_node_fs20.renameSync)(daemonLogPath, `${daemonLogPath}.1`);
         }
       } catch {
       }
-      (0, import_node_fs17.appendFileSync)(daemonLogPath, `${line}
+      (0, import_node_fs20.appendFileSync)(daemonLogPath, `${line}
 `, "utf8");
     } catch {
     }
@@ -76685,23 +77409,31 @@ async function startDaemon(args) {
   if (sleepInhibitor.backendNames().length > 0) {
     pushLog(`sleep-inhibitor backends=${sleepInhibitor.backendNames().join(",")}`);
   }
-  const alanMcpRegisteredRuns = /* @__PURE__ */ new Set();
+  const alanMcpRegisteredRuns = /* @__PURE__ */ new Map();
   const alanMcpRegisteredBackends = /* @__PURE__ */ new Set();
   const finalizeAlanMcpForRun = (runId) => {
     if (!alanMcpRegisteredRuns.delete(runId)) return;
     if (alanMcpRegisteredRuns.size > 0) return;
-    const backends = [...alanMcpRegisteredBackends];
-    alanMcpRegisteredBackends.clear();
     void (async () => {
-      for (const backend of backends) {
-        try {
-          const { removedPaths } = await unregisterAlanMcp(backend);
-          if (removedPaths.length > 0) {
-            pushLog(`mcp-unregistered backend=${backend} run=${runId}`);
+      const releaseRunStart = await runStartGate.acquire();
+      try {
+        if (alanMcpRegisteredRuns.size > 0) return;
+        const backends = [...alanMcpRegisteredBackends];
+        alanMcpRegisteredBackends.clear();
+        for (const backend of backends) {
+          try {
+            const result = await restoreStaticAlanMcp(backend, apiUrl);
+            if (result.ok) {
+              pushLog(`mcp-static-restored backend=${backend} run=${runId}`);
+            } else {
+              pushLog(`mcp-static-restore-failed backend=${backend} ${result.error ?? "unknown"}`);
+            }
+          } catch (err) {
+            pushLog(`mcp-static-restore-failed backend=${backend} ${err.message}`);
           }
-        } catch (err) {
-          pushLog(`mcp-unregister-failed backend=${backend} ${err.message}`);
         }
+      } finally {
+        releaseRunStart();
       }
     })();
   };
@@ -76713,6 +77445,8 @@ async function startDaemon(args) {
     return workspaceAccessTracker.recoveryPath() ?? void 0;
   };
   let eventOutbox;
+  let nativeHookInbox;
+  let nativeTranscriptStreamer;
   let runJournal;
   try {
     eventOutbox = new EncryptedEventOutbox(
@@ -76720,6 +77454,13 @@ async function startDaemon(args) {
       eventSpoolKey,
       pushLog
     );
+    nativeHookInbox = new EncryptedNativeHookInbox(nativeHookInboxPath(configPath), eventSpoolKey, {
+      recoverClaims: true,
+      onQuarantine: ({ fileName, error: error61 }) => pushLog(`native-hook-quarantined file=${fileName} error=${error61.message}`)
+    });
+    nativeTranscriptStreamer = new NativeTranscriptStreamer(
+      new NativeTranscriptCursorStore(`${configPath}.native-transcript-cursors.json`)
+    );
     runJournal = new RuntimeRunJournal(`${configPath}.run-journal.json`);
   } catch (error61) {
     releaseOwnerLease();
@@ -76727,9 +77468,57 @@ async function startDaemon(args) {
     throw error61;
   }
   const workspaceRelocations = /* @__PURE__ */ new Map();
+  let nativeHookDrainInFlight = false;
+  const flushNativeHookInbox = async () => {
+    if (nativeHookDrainInFlight || !socket.connected) return;
+    nativeHookDrainInFlight = true;
+    try {
+      const result = await drainNativeHookInbox({
+        inbox: nativeHookInbox,
+        transcriptStreamer: nativeTranscriptStreamer,
+        sink: {
+          deliver: (envelope) => new Promise((resolveDelivery, rejectDelivery) => {
+            socket.timeout(5e3).emit(
+              "native.session.event",
+              envelope,
+              (error61, acknowledgement) => {
+                const accepted = !error61 && acknowledgement?.ok === true;
+                if (!accepted) {
+                  pushLog(
+                    `native-hook-delivery-deferred event=${envelope.eventId} provider=${envelope.provider} error=${error61?.message ?? "none"} ack=${acknowledgement?.ok ?? "missing"} retryable=${acknowledgement?.retryable ?? "missing"}`
+                  );
+                }
+                if (!error61 && acknowledgement?.ok === false && acknowledgement.retryable === false) {
+                  rejectDelivery(
+                    new PermanentNativeHookDeliveryError(
+                      `backend permanently rejected native event ${envelope.eventId}`
+                    )
+                  );
+                  return;
+                }
+                resolveDelivery(accepted);
+              }
+            );
+          })
+        },
+        onTranscriptError: ({ envelope, error: error61 }) => pushLog(
+          `native-transcript-unavailable event=${envelope.eventId} provider=${envelope.provider} error=${error61.message}`
+        )
+      });
+      if (result.attempted > 0) {
+        pushLog(
+          `native-hook-drain attempted=${result.attempted} acknowledged=${result.acknowledged} deferred=${result.deferred}`
+        );
+      }
+    } catch (error61) {
+      pushLog(`native-hook-drain-failed ${error61.message}`);
+    } finally {
+      nativeHookDrainInFlight = false;
+    }
+  };
   for (const relocation of stored.workspaceRelocations ?? []) {
     if (relocation?.conversationId && relocation.runId && relocation.previousPath && relocation.canonicalPath) {
-      workspaceRelocations.set((0, import_node_path20.resolve)(relocation.previousPath), relocation);
+      workspaceRelocations.set((0, import_node_path22.resolve)(relocation.previousPath), relocation);
     }
   }
   if (stored.localApiPort !== localApiPort || stored.localApiToken !== localApiToken || stored.localServiceId !== localServiceId || stored.localServiceSecret !== localServiceSecret || stored.eventSpoolKey !== eventSpoolKey || stored.daemonEpoch !== daemonEpoch || stored.installationId !== installationId) {
@@ -76916,6 +77705,7 @@ async function startDaemon(args) {
     if (!socket.connected) return;
     emitRunnerPresence();
     flushWorkspaceRelocations();
+    void flushNativeHookInbox();
   }, 15e3);
   let pendingWakeGapMs = null;
   const flushWakeGap = () => {
@@ -77278,7 +78068,7 @@ async function startDaemon(args) {
       `${describeOccupiedLocalDaemon(localApiPort)} The token in ${getConfigPath()} no longer matches the running daemon; quit Alan desktop or run setup again.`
     );
   }
-  const localApiListening = new Promise((resolve14, reject) => {
+  const localApiListening = new Promise((resolve15, reject) => {
     const onError = (error61) => {
       clearInterval(heartbeat);
       clearInterval(versionRefresh);
@@ -77308,7 +78098,7 @@ async function startDaemon(args) {
       if (address && typeof address === "object") localApiPort = address.port;
       pushLog(`local_api listening port=${localApiPort}`);
       console.info("[alan-agent] Local daemon API listening", { port: localApiPort });
-      resolve14();
+      resolve15();
     });
   });
   try {
@@ -77328,7 +78118,7 @@ async function startDaemon(args) {
     clearInterval(workspaceLeaseMonitor);
     suspensionDetector.stop();
     socket.disconnect();
-    await new Promise((resolve14) => localServer.close(() => resolve14()));
+    await new Promise((resolve15) => localServer.close(() => resolve15()));
     releaseOwnerLease();
     releaseStartupLease();
     throw error61;
@@ -77338,6 +78128,8 @@ async function startDaemon(args) {
   skillSyncInterval.unref?.();
   const skillAuditInterval = setInterval(() => runSkillSync("refresh"), 24 * 60 * 6e4);
   skillAuditInterval.unref?.();
+  const nativeHookDrainInterval = setInterval(() => void flushNativeHookInbox(), 1e3);
+  nativeHookDrainInterval.unref?.();
   let stopped = false;
   const stop = async () => {
     if (stopped) return;
@@ -77348,14 +78140,15 @@ async function startDaemon(args) {
       clearInterval(workspaceLeaseMonitor);
       clearInterval(skillSyncInterval);
       clearInterval(skillAuditInterval);
+      clearInterval(nativeHookDrainInterval);
       suspensionDetector.stop();
       for (const entry of activeAgents.values()) {
         abortActiveAgent(entry, { userInitiated: true });
       }
       activeAgents.clear();
       socket.disconnect();
-      await new Promise((resolve14) => {
-        localServer.close(() => resolve14());
+      await new Promise((resolve15) => {
+        localServer.close(() => resolve15());
       });
     } finally {
       sleepInhibitor.dispose();
@@ -77435,7 +78228,7 @@ async function setupDaemon(args) {
   const token = argValue(args, "--token") ?? process.env.ALAN_SETUP_TOKEN;
   const displayName = argValue(args, "--name") ?? (0, import_node_os11.hostname)();
   const scope = argValue(args, "--scope") ?? process.env.ALAN_RUNTIME_SCOPE ?? (setupToken ? "team" : "user");
-  const installationId = argValue(args, "--installation-id") ?? previousConfig.installationId ?? (0, import_node_crypto14.randomUUID)();
+  const installationId = argValue(args, "--installation-id") ?? previousConfig.installationId ?? (0, import_node_crypto17.randomUUID)();
   if (scope !== "team" && scope !== "user") {
     throw new Error("setup --scope must be either 'team' or 'user'");
   }
@@ -77444,7 +78237,7 @@ async function setupDaemon(args) {
       "setup requires --setup-token <token> or --token <Alan access token>.\nFor normal setup, copy the setup token from Alan and run: alan-agent setup --setup-token <token>\nFor browser authorization, run: alan-agent login"
     );
   }
-  const registrationAttemptId = setupToken ? getOrCreateSetupAttemptId(setupToken) : (0, import_node_crypto14.randomUUID)();
+  const registrationAttemptId = setupToken ? getOrCreateSetupAttemptId(setupToken) : (0, import_node_crypto17.randomUUID)();
   const registrationUrl = `${apiUrl}/public/runtimes${setupToken ? "/register-with-setup-token" : ""}`;
   const registrationInit = {
     method: "POST",
@@ -77479,7 +78272,7 @@ async function setupDaemon(args) {
     }
     const retriableStatus = response && (response.status === 408 || response.status === 429 || response.status >= 500);
     if (response && (!retriableStatus || response.ok) || attempt === 3) break;
-    await new Promise((resolve14) => setTimeout(resolve14, attempt * 100));
+    await new Promise((resolve15) => setTimeout(resolve15, attempt * 100));
   }
   if (!response) {
     const detail = transportError instanceof Error ? transportError.message : String(transportError);
@@ -77510,10 +78303,10 @@ async function setupDaemon(args) {
     runtimeToken: body.runtimeToken,
     runtimeRenewalToken: body.runtimeRenewalToken,
     localApiPort: getLocalApiPort(args, {}),
-    localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto14.randomBytes)(24).toString("hex"),
-    localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto14.randomUUID)(),
-    localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto14.randomBytes)(32).toString("base64url"),
-    eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto14.randomBytes)(32).toString("base64url"),
+    localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto17.randomBytes)(24).toString("hex"),
+    localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto17.randomUUID)(),
+    localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto17.randomBytes)(32).toString("base64url"),
+    eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto17.randomBytes)(32).toString("base64url"),
     daemonEpoch: previousConfig.daemonEpoch,
     displayName: body.runtime.displayName ?? displayName,
     installationId
@@ -77543,7 +78336,7 @@ async function loginWithDeviceCode(args) {
     const displayName = argValue(args, "--name") ?? (0, import_node_os11.hostname)();
     const maxPolls = Number.parseInt(argValue(args, "--max-polls") ?? "300", 10);
     const resumed = readPendingDeviceAuthorization(apiUrl);
-    const installationId = resumed?.installationId ?? previousConfig.installationId ?? (0, import_node_crypto14.randomUUID)();
+    const installationId = resumed?.installationId ?? previousConfig.installationId ?? (0, import_node_crypto17.randomUUID)();
     let authorization = resumed ? { ...resumed, operationId: operation.id } : null;
     if (!authorization) {
       clearPendingDeviceAuthorization();
@@ -77619,10 +78412,10 @@ async function loginWithDeviceCode(args) {
         runtimeToken: body.runtimeToken,
         runtimeRenewalToken: body.runtimeRenewalToken,
         localApiPort: getLocalApiPort(args, {}),
-        localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto14.randomBytes)(24).toString("hex"),
-        localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto14.randomUUID)(),
-        localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto14.randomBytes)(32).toString("base64url"),
-        eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto14.randomBytes)(32).toString("base64url"),
+        localApiToken: previousConfig.localApiToken ?? (0, import_node_crypto17.randomBytes)(24).toString("hex"),
+        localServiceId: previousConfig.localServiceId ?? (0, import_node_crypto17.randomUUID)(),
+        localServiceSecret: previousConfig.localServiceSecret ?? (0, import_node_crypto17.randomBytes)(32).toString("base64url"),
+        eventSpoolKey: previousConfig.eventSpoolKey ?? (0, import_node_crypto17.randomBytes)(32).toString("base64url"),
         daemonEpoch: previousConfig.daemonEpoch,
         displayName: body.runtime.displayName ?? displayName,
         installationId
@@ -77973,6 +78766,860 @@ async function printDoctor(args = []) {
   );
 }
 
+// src/mcp-config-adapters.ts
+var import_node_crypto18 = require("crypto");
+var import_node_fs21 = require("fs");
+var import_node_os12 = require("os");
+var import_node_path23 = require("path");
+var log = {
+  info: (...args) => console.info("[mcp-config-adapters]", ...args),
+  warn: (...args) => console.warn("[mcp-config-adapters]", ...args),
+  debug: () => {
+  }
+};
+var HOME = (0, import_node_os12.homedir)();
+var PATHS = {
+  claude: (0, import_node_path23.join)(HOME, ".claude.json"),
+  codex: (0, import_node_path23.join)(HOME, ".codex", "config.toml"),
+  cursor: (0, import_node_path23.join)(HOME, ".cursor", "mcp.json"),
+  antigravity: (0, import_node_path23.join)(HOME, ".gemini", "config", "mcp_config.json"),
+  kimi: (0, import_node_path23.join)(HOME, ".kimi", "mcp.json"),
+  opencode: (0, import_node_path23.join)(HOME, ".config", "opencode", "opencode.json"),
+  factory: (0, import_node_path23.join)(HOME, ".factory", "mcp.json"),
+  amp: (0, import_node_path23.join)(HOME, ".config", "amp", "settings.json")
+};
+var MalformedToolConfigError = class extends Error {
+};
+function parseJsonSafe2(content) {
+  if (!content) return {};
+  try {
+    const parsed = JSON.parse(content);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  throw new MalformedToolConfigError("Existing tool config is malformed");
+}
+function readFileOr(path2) {
+  return (0, import_node_fs21.existsSync)(path2) ? (0, import_node_fs21.readFileSync)(path2, "utf-8") : null;
+}
+function acquireConfigLock2(path2) {
+  (0, import_node_fs21.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
+  const lockPath = `${path2}.alan-lock`;
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      (0, import_node_fs21.mkdirSync)(lockPath);
+      return () => (0, import_node_fs21.rmSync)(lockPath, { recursive: true, force: true });
+    } catch (error61) {
+      const code = error61 && typeof error61 === "object" && "code" in error61 ? error61.code : void 0;
+      if (code !== "EEXIST") throw error61;
+      try {
+        if (Date.now() - (0, import_node_fs21.statSync)(lockPath).mtimeMs > 3e4) {
+          (0, import_node_fs21.rmSync)(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() - startedAt >= 2e3) {
+        throw new Error(`Alan could not safely update ${path2}`);
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
+    }
+  }
+}
+function writeFileSafe2(path2, content) {
+  (0, import_node_fs21.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
+  const pendingPath = `${path2}.alan-pending-${process.pid}-${(0, import_node_crypto18.randomBytes)(6).toString("hex")}`;
+  try {
+    (0, import_node_fs21.writeFileSync)(pendingPath, content, { encoding: "utf8", mode: 384, flag: "wx" });
+    (0, import_node_fs21.renameSync)(pendingPath, path2);
+  } finally {
+    (0, import_node_fs21.rmSync)(pendingPath, { force: true });
+  }
+}
+function saveMalformedBackup2(path2, content) {
+  const hash2 = (0, import_node_crypto18.createHash)("sha256").update(content).digest("hex").slice(0, 16);
+  const backupPath = `${path2}.alan-backup-${hash2}`;
+  if (!(0, import_node_fs21.existsSync)(backupPath)) (0, import_node_fs21.copyFileSync)(path2, backupPath);
+  return backupPath;
+}
+var claudeAdapter = {
+  cli: "Claude Code",
+  configPath: PATHS.claude,
+  guardDir: HOME,
+  // ~/.claude.json lives in home — always exists
+  merge(existing, servers) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const s of servers) {
+      if (s.kind === "http") {
+        mcpServers[s.name] = { type: "http", url: s.url, headers: s.headers };
+      } else {
+        mcpServers[s.name] = {
+          command: s.command,
+          ...s.args?.length ? { args: s.args } : {},
+          ...s.env && Object.keys(s.env).length > 0 ? { env: s.env } : {}
+        };
+      }
+    }
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  },
+  remove(existing, serverNames) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const name of serverNames) delete mcpServers[name];
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  }
+};
+var codexAdapter = {
+  cli: "Codex",
+  configPath: PATHS.codex,
+  guardDir: (0, import_node_path23.join)(HOME, ".codex"),
+  merge(existing, servers) {
+    let config2 = {};
+    if (existing) {
+      try {
+        config2 = parse5(existing);
+      } catch {
+        throw new MalformedToolConfigError("Existing tool config is malformed");
+      }
+    }
+    const mcpServers = config2.mcp_servers ?? {};
+    for (const s of servers) {
+      if (s.kind === "http") {
+        mcpServers[s.name] = { url: s.url, http_headers: s.headers };
+      } else {
+        mcpServers[s.name] = {
+          command: s.command,
+          ...s.args?.length ? { args: s.args } : {},
+          ...s.env && Object.keys(s.env).length > 0 ? { env: s.env } : {}
+        };
+      }
+    }
+    config2.mcp_servers = mcpServers;
+    return stringify(config2);
+  },
+  remove(existing, serverNames) {
+    if (!existing) return "";
+    let config2 = {};
+    try {
+      config2 = parse5(existing);
+    } catch {
+      return existing;
+    }
+    const mcpServers = config2.mcp_servers ?? {};
+    for (const name of serverNames) delete mcpServers[name];
+    config2.mcp_servers = mcpServers;
+    return stringify(config2);
+  }
+};
+var cursorAdapter = {
+  cli: "Cursor",
+  configPath: PATHS.cursor,
+  guardDir: (0, import_node_path23.join)(HOME, ".cursor"),
+  merge(existing, servers) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const s of servers) {
+      if (s.kind === "http") {
+        mcpServers[s.name] = { type: "http", url: s.url, headers: s.headers };
+      } else {
+        mcpServers[s.name] = {
+          command: s.command,
+          ...s.args?.length ? { args: s.args } : {},
+          ...s.env && Object.keys(s.env).length > 0 ? { env: s.env } : {}
+        };
+      }
+    }
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  },
+  remove(existing, serverNames) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const name of serverNames) delete mcpServers[name];
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  }
+};
+function createAntigravityAdapter() {
+  return {
+    cli: "Antigravity CLI",
+    configPath: PATHS.antigravity,
+    guardDir: (0, import_node_path23.join)(HOME, ".gemini", "config"),
+    merge(existing, servers) {
+      const config2 = parseJsonSafe2(existing);
+      const mcpServers = config2.mcpServers ?? {};
+      for (const s of servers) {
+        if (s.kind === "http") {
+          mcpServers[s.name] = { serverUrl: s.url, headers: s.headers };
+        } else {
+          mcpServers[s.name] = {
+            command: s.command,
+            ...s.args?.length ? { args: s.args } : {},
+            ...s.env && Object.keys(s.env).length > 0 ? { env: s.env } : {}
+          };
+        }
+      }
+      config2.mcpServers = mcpServers;
+      return JSON.stringify(config2, null, 2);
+    },
+    remove(existing, serverNames) {
+      const config2 = parseJsonSafe2(existing);
+      const mcpServers = config2.mcpServers ?? {};
+      for (const name of serverNames) delete mcpServers[name];
+      config2.mcpServers = mcpServers;
+      return JSON.stringify(config2, null, 2);
+    }
+  };
+}
+var antigravityAdapter = createAntigravityAdapter();
+var kimiAdapter = {
+  cli: "Kimi CLI",
+  configPath: PATHS.kimi,
+  guardDir: (0, import_node_path23.join)(HOME, ".kimi"),
+  merge(existing, servers) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const s of servers) {
+      if (s.kind === "http") {
+        mcpServers[s.name] = { url: s.url, headers: s.headers };
+      } else {
+        mcpServers[s.name] = {
+          command: s.command,
+          ...s.args?.length ? { args: s.args } : {},
+          ...s.env && Object.keys(s.env).length > 0 ? { env: s.env } : {}
+        };
+      }
+    }
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  },
+  remove(existing, serverNames) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const name of serverNames) delete mcpServers[name];
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  }
+};
+var opencodeAdapter = {
+  cli: "OpenCode",
+  configPath: PATHS.opencode,
+  guardDir: (0, import_node_path23.join)(HOME, ".config", "opencode"),
+  merge(existing, servers) {
+    const config2 = parseJsonSafe2(existing);
+    const mcp = config2.mcp ?? {};
+    for (const s of servers) {
+      if (s.kind === "http") {
+        mcp[s.name] = { type: "remote", url: s.url, headers: s.headers };
+      } else {
+        mcp[s.name] = {
+          type: "local",
+          command: [s.command, ...s.args ?? []],
+          ...s.env && Object.keys(s.env).length > 0 ? { environment: s.env } : {}
+        };
+      }
+    }
+    config2.mcp = mcp;
+    return JSON.stringify(config2, null, 2);
+  },
+  remove(existing, serverNames) {
+    const config2 = parseJsonSafe2(existing);
+    const mcp = config2.mcp ?? {};
+    for (const name of serverNames) delete mcp[name];
+    config2.mcp = mcp;
+    return JSON.stringify(config2, null, 2);
+  }
+};
+var factoryAdapter = {
+  cli: "Factory Droid",
+  configPath: PATHS.factory,
+  guardDir: (0, import_node_path23.join)(HOME, ".factory"),
+  merge(existing, servers) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const s of servers) {
+      if (s.kind === "http") {
+        mcpServers[s.name] = {
+          type: "http",
+          url: s.url,
+          disabled: false,
+          ...s.headers && Object.keys(s.headers).length > 0 ? { headers: s.headers } : {}
+        };
+      } else {
+        mcpServers[s.name] = {
+          type: "stdio",
+          command: s.command,
+          disabled: false,
+          ...s.args?.length ? { args: s.args } : {},
+          ...s.env && Object.keys(s.env).length > 0 ? { env: s.env } : {}
+        };
+      }
+    }
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  },
+  remove(existing, serverNames) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2.mcpServers ?? {};
+    for (const name of serverNames) delete mcpServers[name];
+    config2.mcpServers = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  }
+};
+var ampAdapter = {
+  cli: "Amp",
+  configPath: PATHS.amp,
+  guardDir: (0, import_node_path23.join)(HOME, ".config", "amp"),
+  merge(existing, servers) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2["amp.mcpServers"] ?? {};
+    for (const s of servers) {
+      if (s.kind === "http") {
+        mcpServers[s.name] = { url: s.url, headers: s.headers };
+      } else {
+        mcpServers[s.name] = {
+          command: s.command,
+          ...s.args?.length ? { args: s.args } : {}
+        };
+      }
+    }
+    config2["amp.mcpServers"] = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  },
+  remove(existing, serverNames) {
+    const config2 = parseJsonSafe2(existing);
+    const mcpServers = config2["amp.mcpServers"] ?? {};
+    for (const name of serverNames) delete mcpServers[name];
+    config2["amp.mcpServers"] = mcpServers;
+    return JSON.stringify(config2, null, 2);
+  }
+};
+var ALL_ADAPTERS = [
+  claudeAdapter,
+  codexAdapter,
+  cursorAdapter,
+  antigravityAdapter,
+  kimiAdapter,
+  opencodeAdapter,
+  factoryAdapter,
+  ampAdapter
+];
+function serverEntry(adapter, content, name) {
+  if (adapter === codexAdapter) {
+    const parsed2 = parse5(content);
+    const servers2 = parsed2.mcp_servers;
+    return servers2 && typeof servers2 === "object" ? servers2[name] : void 0;
+  }
+  const parsed = parseJsonSafe2(content);
+  const key = adapter === opencodeAdapter ? "mcp" : adapter === ampAdapter ? "amp.mcpServers" : "mcpServers";
+  const servers = parsed[key];
+  return servers && typeof servers === "object" ? servers[name] : void 0;
+}
+function canonicalize(value2) {
+  if (Array.isArray(value2)) return value2.map(canonicalize);
+  if (value2 && typeof value2 === "object") {
+    return Object.fromEntries(
+      Object.entries(value2).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, canonicalize(entry)])
+    );
+  }
+  return value2;
+}
+function entriesMatch(actual, expected) {
+  return JSON.stringify(canonicalize(actual)) === JSON.stringify(canonicalize(expected));
+}
+var ALAN_SESSION_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "x-conversation-id",
+  "x-team-id",
+  "x-allowed-tools",
+  "x-alan-run-reference"
+]);
+function normalizeAlanSessionHeaders(actual, expected) {
+  if (!actual || typeof actual !== "object" || Array.isArray(actual)) return actual;
+  if (!expected || typeof expected !== "object" || Array.isArray(expected)) return actual;
+  const normalized = { ...actual };
+  const expectedHeaders = expected;
+  const hadAlanSessionMarker = Object.keys(normalized).some(
+    (key) => ALAN_SESSION_HEADER_NAMES.has(key.toLowerCase())
+  );
+  for (const key of Object.keys(normalized)) {
+    if (ALAN_SESSION_HEADER_NAMES.has(key.toLowerCase())) delete normalized[key];
+  }
+  if (hadAlanSessionMarker) {
+    const expectedAuthorization = Object.entries(expectedHeaders).find(
+      ([key]) => key.toLowerCase() === "authorization"
+    );
+    for (const key of Object.keys(normalized)) {
+      if (key.toLowerCase() === "authorization") delete normalized[key];
+    }
+    if (expectedAuthorization) {
+      normalized[expectedAuthorization[0]] = expectedAuthorization[1];
+    }
+  }
+  return normalized;
+}
+function normalizeAlanRuntimeEntry(actual, expected) {
+  if (Array.isArray(actual)) {
+    if (!Array.isArray(expected)) return actual;
+    return actual.map((entry, index) => normalizeAlanRuntimeEntry(entry, expected[index]));
+  }
+  if (!actual || typeof actual !== "object" || Array.isArray(actual)) return actual;
+  if (!expected || typeof expected !== "object" || Array.isArray(expected)) return actual;
+  const expectedRecord = expected;
+  return Object.fromEntries(
+    Object.entries(actual).map(([key, value2]) => [
+      key,
+      key.toLowerCase() === "headers" || key.toLowerCase() === "http_headers" ? normalizeAlanSessionHeaders(value2, expectedRecord[key]) : normalizeAlanRuntimeEntry(value2, expectedRecord[key])
+    ])
+  );
+}
+function matchesAlanManagedEntry(actual, expected) {
+  return entriesMatch(actual, expected) || entriesMatch(normalizeAlanRuntimeEntry(actual, expected), expected);
+}
+function hasAlanManagedSignature(entry) {
+  if (!entry || typeof entry !== "object") return false;
+  for (const [key, value2] of Object.entries(entry)) {
+    const lower = key.toLowerCase();
+    if ((lower === "headers" || lower === "http_headers") && value2 && typeof value2 === "object") {
+      const headerNames = Object.keys(value2);
+      if (headerNames.some((name) => ALAN_SESSION_HEADER_NAMES.has(name.toLowerCase()))) {
+        return true;
+      }
+    }
+    if (value2 && typeof value2 === "object" && hasAlanManagedSignature(value2)) return true;
+  }
+  return false;
+}
+function expectedServerEntry(adapter, server) {
+  return serverEntry(adapter, adapter.merge(null, [server]), server.name);
+}
+function isManagedServerList(entries) {
+  return entries.length === 0 || typeof entries[0] !== "string";
+}
+function syncMcpToAllClis(servers, oldManagedServers = []) {
+  const written = [];
+  const failures = [];
+  for (const adapter of ALL_ADAPTERS) {
+    if (!(0, import_node_fs21.existsSync)(adapter.guardDir)) {
+      log.debug("MCP Adapters", `Skipping ${adapter.cli} \u2014 guard dir not found`, {
+        guardDir: adapter.guardDir
+      });
+      continue;
+    }
+    const releaseLock = acquireConfigLock2(adapter.configPath);
+    try {
+      const existing = readFileOr(adapter.configPath);
+      const previousServers = isManagedServerList(oldManagedServers) ? oldManagedServers : [];
+      const previousByName = new Map(previousServers.map((server) => [server.name, server]));
+      if (existing) {
+        for (const server of servers) {
+          const currentEntry = serverEntry(adapter, existing, server.name);
+          if (currentEntry === void 0) continue;
+          const desiredEntry = expectedServerEntry(adapter, server);
+          const previous = previousByName.get(server.name);
+          const previousEntry = previous ? expectedServerEntry(adapter, previous) : void 0;
+          if (!hasAlanManagedSignature(currentEntry) && !matchesAlanManagedEntry(currentEntry, desiredEntry) && (!previousEntry || !matchesAlanManagedEntry(currentEntry, previousEntry))) {
+            throw new Error(`an unowned entry already uses the name ${server.name}`);
+          }
+        }
+      }
+      const currentNames = new Set(servers.map((s) => s.name));
+      const toRemove = previousServers.filter((server) => !currentNames.has(server.name));
+      let content;
+      if (toRemove.length > 0) {
+        const ownedNames = existing ? toRemove.filter(
+          (server) => matchesAlanManagedEntry(
+            serverEntry(adapter, existing, server.name),
+            expectedServerEntry(adapter, server)
+          )
+        ).map((server) => server.name) : [];
+        const cleaned = adapter.remove(existing, ownedNames);
+        content = adapter.merge(cleaned, servers);
+      } else {
+        content = adapter.merge(existing, servers);
+      }
+      writeFileSafe2(adapter.configPath, content);
+      written.push(adapter.cli);
+      log.info("MCP Adapters", `Synced to ${adapter.cli}`, {
+        configPath: adapter.configPath,
+        serverCount: servers.length
+      });
+    } catch (err) {
+      const existing = readFileOr(adapter.configPath);
+      const backupPath = err instanceof MalformedToolConfigError && existing !== null ? saveMalformedBackup2(adapter.configPath, existing) : void 0;
+      const message = `${adapter.cli}: ${err instanceof Error ? err.message : String(err)}${backupPath ? `; review ${backupPath}` : ""}`;
+      failures.push(message);
+      log.warn("MCP Adapters", `Failed to sync to ${adapter.cli}`, {
+        error: message
+      });
+    } finally {
+      releaseLock();
+    }
+  }
+  if (failures.length > 0) throw new Error(failures.join(" | "));
+  return written;
+}
+function removeMcpFromAllClis(managedServers) {
+  if (managedServers.length === 0) return;
+  const ownershipKnown = isManagedServerList(managedServers);
+  for (const adapter of ALL_ADAPTERS) {
+    if (!(0, import_node_fs21.existsSync)(adapter.guardDir)) continue;
+    const releaseLock = acquireConfigLock2(adapter.configPath);
+    try {
+      const existing = readFileOr(adapter.configPath);
+      if (!existing) continue;
+      const ownedNames = ownershipKnown ? managedServers.filter(
+        (server) => matchesAlanManagedEntry(
+          serverEntry(adapter, existing, server.name),
+          expectedServerEntry(adapter, server)
+        )
+      ).map((server) => server.name) : [];
+      if (ownedNames.length === 0) continue;
+      const content = adapter.remove(existing, ownedNames);
+      writeFileSafe2(adapter.configPath, content);
+      log.info("MCP Adapters", `Cleaned up ${adapter.cli}`, {
+        removed: ownedNames
+      });
+    } catch (err) {
+      const existing = readFileOr(adapter.configPath);
+      const backupPath = err instanceof MalformedToolConfigError && existing !== null ? saveMalformedBackup2(adapter.configPath, existing) : void 0;
+      log.warn("MCP Adapters", `Failed to clean up ${adapter.cli}`, {
+        error: `${err instanceof Error ? err.message : String(err)}${backupPath ? `; review ${backupPath}` : ""}`
+      });
+    } finally {
+      releaseLock();
+    }
+  }
+}
+var DEFAULT_ALAN_MCP_NAMES = ["alan"];
+function inspectAlanMcpPresence(expectedServers = [], candidateNames = DEFAULT_ALAN_MCP_NAMES) {
+  const configuredClis = [];
+  const inspectedClis = [];
+  const serverNamesFound = /* @__PURE__ */ new Set();
+  const names = /* @__PURE__ */ new Set([
+    ...candidateNames,
+    ...expectedServers.map((server) => server.name)
+  ]);
+  const expectedByName = new Map(expectedServers.map((server) => [server.name, server]));
+  for (const adapter of ALL_ADAPTERS) {
+    if (!(0, import_node_fs21.existsSync)(adapter.guardDir)) continue;
+    inspectedClis.push(adapter.cli);
+    const existing = readFileOr(adapter.configPath);
+    if (!existing) continue;
+    let foundOnCli = false;
+    for (const name of names) {
+      let entry;
+      try {
+        entry = serverEntry(adapter, existing, name);
+      } catch {
+        continue;
+      }
+      if (entry === void 0) continue;
+      const expected = expectedByName.get(name);
+      const matchesExpected = expected ? matchesAlanManagedEntry(entry, expectedServerEntry(adapter, expected)) : false;
+      if (!hasAlanManagedSignature(entry) && !matchesExpected) continue;
+      foundOnCli = true;
+      serverNamesFound.add(name);
+    }
+    if (foundOnCli) configuredClis.push(adapter.cli);
+  }
+  return {
+    configured: configuredClis.length > 0,
+    configuredClis,
+    inspectedClis,
+    serverNamesFound: [...serverNamesFound]
+  };
+}
+function toManagedMcpServers(mcpServers) {
+  const result = [];
+  for (const [name, config2] of Object.entries(mcpServers)) {
+    if (!config2 || typeof config2 !== "object") continue;
+    const c = config2;
+    if (c.command && typeof c.command === "string") {
+      result.push({
+        name,
+        kind: "stdio",
+        command: c.command,
+        args: c.args ?? void 0,
+        env: c.env ?? void 0
+      });
+    } else {
+      result.push({
+        name,
+        kind: "http",
+        url: c.url ?? "",
+        headers: c.headers ?? {}
+      });
+    }
+  }
+  return result;
+}
+
+// src/mcp-sync.ts
+var McpSyncService = class {
+  constructor(options) {
+    this.options = options;
+    this.managedServerNames = [...options.managedServerNames ?? ["alan"]];
+    this.legacyServerNames = [...options.legacyServerNames ?? []];
+  }
+  managedServerNames;
+  legacyServerNames;
+  getStatus() {
+    const presence = inspectAlanMcpPresence([], this.managedServerNames);
+    return {
+      configured: presence.configured,
+      lastSyncAt: null,
+      configuredClis: presence.configuredClis,
+      inspectedClis: presence.inspectedClis,
+      managedServerNames: [...this.managedServerNames],
+      mcpAutoInjectEnabled: this.options.enabled
+    };
+  }
+  async sync(apiUrl, token, onProgress) {
+    if (!this.options.enabled) return { errors: [], mcpServersUpdated: false };
+    onProgress?.({ phase: "fetching" });
+    let config2;
+    try {
+      const response = await fetch(`${apiUrl}/public/ade/config`, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(15e3)
+      });
+      if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText}`);
+      config2 = await response.json();
+    } catch (error61) {
+      return {
+        errors: [`Fetch failed: ${error61 instanceof Error ? error61.message : String(error61)}`],
+        mcpServersUpdated: false
+      };
+    }
+    return this.syncServers(config2.mcpServers, apiUrl, onProgress);
+  }
+  syncServers(mcpServers, apiUrl, onProgress) {
+    if (!this.options.enabled) return { errors: [], mcpServersUpdated: false };
+    onProgress?.({ phase: "mcp" });
+    try {
+      const rawServers = this.options.transformMcpServers ? this.options.transformMcpServers(mcpServers, apiUrl) : mcpServers;
+      const managed = toManagedMcpServers(rawServers);
+      const previousNames = [...this.managedServerNames, ...this.legacyServerNames];
+      const written = syncMcpToAllClis(managed, previousNames);
+      return { errors: [], mcpServersUpdated: written.length > 0 };
+    } catch (error61) {
+      return {
+        errors: [`MCP sync: ${error61 instanceof Error ? error61.message : String(error61)}`],
+        mcpServersUpdated: false
+      };
+    }
+  }
+  cleanup(previousServers = []) {
+    removeMcpFromAllClis(previousServers);
+  }
+};
+
+// src/native-hook-config.ts
+var import_node_fs22 = require("fs");
+var import_node_os13 = require("os");
+var import_node_path24 = require("path");
+var CLAUDE_HOOK_EVENTS = [
+  "SessionStart",
+  "UserPromptSubmit",
+  "PostToolUse",
+  "Stop",
+  "SubagentStart",
+  "SubagentStop",
+  "SessionEnd"
+];
+var ALAN_HOOK_MARKER = "# alan-native-session-hook";
+function shellQuote(value2) {
+  return `'${value2.replaceAll("'", `'\\''`)}'`;
+}
+function powershellQuote(value2) {
+  return `'${value2.replaceAll("'", "''")}'`;
+}
+function nativeHookCommand(input2) {
+  const args = [
+    input2.cliEntry,
+    "hook",
+    "--config-path",
+    input2.configPath,
+    "--provider",
+    input2.provider,
+    "--event",
+    input2.event,
+    ALAN_HOOK_MARKER
+  ];
+  const environment = Object.entries(input2.environment ?? {});
+  for (const [key] of environment) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      throw new Error(`Invalid native hook environment variable: ${key}`);
+    }
+  }
+  if (environment.length === 0) {
+    return {
+      type: "command",
+      command: input2.nodeExecutable,
+      args,
+      timeout: 5
+    };
+  }
+  if ((input2.platform ?? (0, import_node_os13.platform)()) === "win32") {
+    const environmentPrefix2 = environment.map(([key, value2]) => `$env:${key}=${powershellQuote(value2)}`).join("; ");
+    const command2 = [input2.nodeExecutable, ...args].map(powershellQuote).join(" ");
+    return {
+      type: "command",
+      shell: "powershell",
+      command: `${environmentPrefix2}; & ${command2}`,
+      timeout: 5
+    };
+  }
+  const environmentPrefix = environment.map(([key, value2]) => `${key}=${shellQuote(value2)}`).join(" ");
+  const command = [input2.nodeExecutable, ...args].map(shellQuote).join(" ");
+  return {
+    type: "command",
+    shell: "bash",
+    command: `${environmentPrefix} ${command}`,
+    timeout: 5
+  };
+}
+function readSettings(path2) {
+  if (!(0, import_node_fs22.existsSync)(path2)) return {};
+  try {
+    const value2 = JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
+    if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) {
+      throw new Error("settings root must be an object");
+    }
+    return value2;
+  } catch (error61) {
+    const backup = `${path2}.malformed-${Date.now()}.bak`;
+    (0, import_node_fs22.copyFileSync)(path2, backup);
+    throw new Error(
+      `Claude settings were malformed and moved to ${backup}: ${error61 instanceof Error ? error61.message : String(error61)}`
+    );
+  }
+}
+function withoutAlanHookGroups(value2) {
+  if (!Array.isArray(value2)) return [];
+  return value2.filter((group) => !JSON.stringify(group).includes(ALAN_HOOK_MARKER));
+}
+function writeSettings(path2, settings) {
+  (0, import_node_fs22.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true, mode: 448 });
+  const temporary = `${path2}.${process.pid}.tmp`;
+  (0, import_node_fs22.writeFileSync)(temporary, `${JSON.stringify(settings, null, 2)}
+`, { mode: 384 });
+  (0, import_node_fs22.renameSync)(temporary, path2);
+}
+function reconcileClaudeNativeHooks(input2) {
+  const homeDir = input2?.homeDir ?? (0, import_node_os13.homedir)();
+  const settingsPath = (0, import_node_path24.join)(homeDir, ".claude", "settings.json");
+  const nodeExecutable = input2?.nodeExecutable ?? process.execPath;
+  const cliEntry = input2?.cliEntry ?? process.argv[1];
+  const configPath = input2?.configPath ?? process.env.ALAN_AGENT_CONFIG_PATH;
+  if (!cliEntry) throw new Error("Cannot resolve the alan-agent CLI entrypoint");
+  if (!configPath?.trim()) {
+    throw new Error("Cannot install Claude hooks without an exact Alan agent config path");
+  }
+  const settings = readSettings(settingsPath);
+  const currentHooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
+  const hooks = { ...currentHooks };
+  for (const event of CLAUDE_HOOK_EVENTS) {
+    hooks[event] = [
+      ...withoutAlanHookGroups(currentHooks[event]),
+      {
+        hooks: [
+          nativeHookCommand({
+            configPath,
+            nodeExecutable,
+            cliEntry,
+            environment: input2?.environment,
+            platform: input2?.platform,
+            provider: "claude_cli",
+            event
+          })
+        ]
+      }
+    ];
+  }
+  const next = { ...settings, hooks };
+  const previous = (0, import_node_fs22.existsSync)(settingsPath) ? (0, import_node_fs22.readFileSync)(settingsPath, "utf8") : null;
+  const serialized = `${JSON.stringify(next, null, 2)}
+`;
+  if (previous === serialized) return false;
+  writeSettings(settingsPath, next);
+  return true;
+}
+function removeClaudeNativeHooks(homeDir = (0, import_node_os13.homedir)()) {
+  const settingsPath = (0, import_node_path24.join)(homeDir, ".claude", "settings.json");
+  if (!(0, import_node_fs22.existsSync)(settingsPath)) return false;
+  const settings = readSettings(settingsPath);
+  if (!settings.hooks || typeof settings.hooks !== "object" || Array.isArray(settings.hooks)) {
+    return false;
+  }
+  const hooks = {};
+  let removed = false;
+  for (const [event, groups] of Object.entries(settings.hooks)) {
+    const retained = withoutAlanHookGroups(groups);
+    if (Array.isArray(groups) && retained.length !== groups.length) removed = true;
+    if (retained.length > 0) hooks[event] = retained;
+  }
+  if (!removed) return false;
+  writeSettings(settingsPath, { ...settings, hooks });
+  return true;
+}
+
+// src/integration-cli.ts
+function alanMcpServers(apiUrl) {
+  return {
+    alan: {
+      type: "http",
+      url: new URL("/mcp", apiUrl).toString()
+    }
+  };
+}
+function runMcpIntegrationCommand(args, options = {}) {
+  bindConfigPath(args);
+  const action = args[0] ?? "status";
+  const config2 = readConfig();
+  const endpoints = resolveEndpoints(args.slice(1), config2);
+  const service = new McpSyncService({ enabled: true });
+  if (action === "status") {
+    process.stdout.write(`${JSON.stringify(service.getStatus(), null, 2)}
+`);
+    return;
+  }
+  if (action === "reconcile") {
+    if (!config2.runtimeId || !config2.runtimeToken) {
+      throw new Error(
+        "Alan is not configured. Run `alan-agent login` or `alan-agent setup` first."
+      );
+    }
+    const result = service.syncServers(alanMcpServers(endpoints.apiUrl), endpoints.apiUrl);
+    if (result.errors.length > 0) throw new Error(result.errors.join("; "));
+    const hooksUpdated = resolveCliExecutable("claude", getDaemonCliEnvironment()) ? reconcileClaudeNativeHooks({
+      configPath: getConfigPath(),
+      nodeExecutable: options.nativeHookRuntime?.executable,
+      cliEntry: options.nativeHookRuntime?.cliEntry,
+      environment: options.nativeHookRuntime?.environment
+    }) : false;
+    process.stdout.write(
+      `${result.mcpServersUpdated || hooksUpdated ? "Alan CLI integrations updated" : "Alan CLI integrations already current"}.
+`
+    );
+    return;
+  }
+  if (action === "uninstall") {
+    service.cleanup(toManagedMcpServers(alanMcpServers(endpoints.apiUrl)));
+    removeClaudeNativeHooks();
+    process.stdout.write("Removed Alan-owned MCP configuration.\n");
+    return;
+  }
+  throw new Error(`Unknown integrations action: ${action}`);
+}
+
 // src/lifecycle-logger.ts
 var AgentLifecycleLogger = class _AgentLifecycleLogger {
   context;
@@ -78045,6 +79692,293 @@ function omitUndefined(record2) {
   return Object.fromEntries(Object.entries(record2).filter(([, value2]) => value2 !== void 0));
 }
 
+// src/native-hook-command.ts
+var import_node_crypto19 = require("crypto");
+var import_node_fs23 = require("fs");
+var import_node_path25 = require("path");
+
+// src/native-session.ts
+var NATIVE_SESSION_PROVIDER_CAPABILITIES = [
+  {
+    providerKind: "claude_cli",
+    provider: "claude",
+    command: "claude",
+    capabilities: {
+      mcp: true,
+      lifecycleHooks: true,
+      transcriptDelta: true,
+      subagents: true,
+      sessionEnd: true,
+      state: "supported"
+    },
+    supportedHookEvents: [
+      "SessionStart",
+      "UserPromptSubmit",
+      "PostToolUse",
+      "Stop",
+      "SubagentStart",
+      "SubagentStop",
+      "SessionEnd"
+    ]
+  },
+  {
+    providerKind: "codex_app_server",
+    provider: "codex",
+    command: "codex",
+    capabilities: {
+      mcp: true,
+      lifecycleHooks: false,
+      transcriptDelta: false,
+      subagents: false,
+      sessionEnd: false,
+      state: "degraded",
+      reason: "Codex exposes a turn-complete notification, not full lifecycle hooks."
+    },
+    supportedHookEvents: ["agent-turn-complete"]
+  },
+  {
+    providerKind: "copilot_cli",
+    provider: "copilot",
+    command: "copilot",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  },
+  {
+    providerKind: "cursor_agent_cli",
+    provider: "cursor",
+    command: "cursor-agent",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  },
+  {
+    providerKind: "antigravity_cli",
+    provider: "antigravity",
+    command: "agy",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  },
+  {
+    providerKind: "kimi_cli",
+    provider: "kimi",
+    command: "kimi-cli",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  },
+  {
+    providerKind: "grok_cli",
+    provider: "grok",
+    command: "grok",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  },
+  {
+    providerKind: "opencode_cli",
+    provider: "opencode",
+    command: "opencode",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  },
+  {
+    providerKind: "droid_cli",
+    provider: "droid",
+    command: "droid",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  },
+  {
+    providerKind: "supatest_cli",
+    provider: "supatest",
+    command: "supatest",
+    capabilities: unsupportedMcpOnlyCapability(),
+    supportedHookEvents: []
+  }
+];
+function unsupportedMcpOnlyCapability() {
+  return {
+    mcp: true,
+    lifecycleHooks: false,
+    transcriptDelta: false,
+    subagents: false,
+    sessionEnd: false,
+    state: "unsupported",
+    reason: "No native hook adapter is installed for this provider."
+  };
+}
+var CAPABILITIES_BY_PROVIDER_KIND = new Map(
+  NATIVE_SESSION_PROVIDER_CAPABILITIES.map((capability) => [capability.providerKind, capability])
+);
+function isNativeSessionProviderKind(value2) {
+  return CAPABILITIES_BY_PROVIDER_KIND.has(value2);
+}
+
+// src/native-hook-command.ts
+var MAX_NATIVE_HOOK_STDIN_BYTES = 1024 * 1024;
+function argumentValue(args, name) {
+  const index = args.indexOf(name);
+  if (index >= 0) return args[index + 1];
+  const prefix = `${name}=`;
+  return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+}
+function stringField4(payload, ...names) {
+  for (const name of names) {
+    const value2 = payload[name];
+    if (typeof value2 === "string" && value2.trim()) return value2.trim();
+  }
+  return void 0;
+}
+function nonNegativeIntegerField(payload, ...names) {
+  for (const name of names) {
+    const value2 = payload[name];
+    if (typeof value2 === "number" && Number.isSafeInteger(value2) && value2 >= 0) return value2;
+  }
+  return void 0;
+}
+function parseNativeHookEnvelope(input2) {
+  if (!isNativeSessionProviderKind(input2.provider)) {
+    throw new Error(`unsupported native session provider: ${input2.provider}`);
+  }
+  const rawHookEvent = input2.hookEvent ?? stringField4(input2.payload, "hook_event_name", "hookEvent", "type") ?? "notification";
+  const cwd = stringField4(input2.payload, "cwd", "working_directory", "workingDirectory");
+  const transcriptPath = stringField4(input2.payload, "transcript_path", "transcriptPath");
+  const capability = NATIVE_SESSION_PROVIDER_CAPABILITIES.find(
+    (candidate) => candidate.providerKind === input2.provider
+  );
+  if (!capability) throw new Error(`unsupported native session provider: ${input2.provider}`);
+  const externalSessionId = stringField4(
+    input2.payload,
+    "session_id",
+    "sessionId",
+    "conversation_id",
+    "conversationId",
+    "thread_id",
+    "threadId"
+  );
+  if (!externalSessionId) throw new Error("hook payload is missing a provider session id");
+  const cursor = stringField4(input2.payload, "source_cursor", "sourceCursor") ?? nonNegativeIntegerField(input2.payload, "byte_offset", "byteOffset")?.toString() ?? nonNegativeIntegerField(input2.payload, "sequence", "seq")?.toString();
+  return {
+    schemaVersion: 1,
+    eventId: (0, import_node_crypto19.randomUUID)(),
+    provider: capability.provider,
+    eventType: normalizeHookEvent(rawHookEvent),
+    observedAt: (input2.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    externalSessionId,
+    parentExternalSessionId: stringField4(input2.payload, "parent_session_id", "parentSessionId"),
+    ...cwd ? { cwd: (0, import_node_path25.resolve)(cwd) } : {},
+    ...transcriptPath ? { transcriptPath: (0, import_node_path25.resolve)(transcriptPath) } : {},
+    ...cursor ? { sourceCursor: cursor } : {},
+    providerPayload: input2.payload
+  };
+}
+function normalizeHookEvent(raw) {
+  switch (raw.toLowerCase().replaceAll("-", "_").replaceAll(" ", "_")) {
+    case "sessionstart":
+    case "session_start":
+      return "session_start";
+    case "userpromptsubmit":
+    case "user_prompt":
+      return "user_prompt";
+    case "subagentstart":
+    case "subagent_start":
+      return "subagent_start";
+    case "subagentstop":
+    case "subagent_end":
+      return "subagent_end";
+    case "sessionend":
+    case "session_end":
+      return "session_end";
+    case "stop":
+    case "agent_turn_complete":
+      return "stop";
+    default:
+      return "transcript_update";
+  }
+}
+function readBoundedHookPayload(fd = 0, maxBytes = MAX_NATIVE_HOOK_STDIN_BYTES) {
+  const chunks = [];
+  let totalBytes = 0;
+  while (true) {
+    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1 - totalBytes));
+    const bytesRead = (0, import_node_fs23.readSync)(fd, chunk, 0, chunk.byteLength, null);
+    if (bytesRead === 0) break;
+    totalBytes += bytesRead;
+    if (totalBytes > maxBytes) throw new Error(`hook input exceeds ${maxBytes} bytes`);
+    chunks.push(chunk.subarray(0, bytesRead));
+  }
+  const body = Buffer.concat(chunks, totalBytes);
+  if (body.byteLength === 0) return {};
+  const parsed = JSON.parse(body.toString("utf8"));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("hook input must be a JSON object");
+  }
+  return parsed;
+}
+function enqueueNativeHookFromConfig(input2) {
+  if (process.env.ALAN_MANAGED_RUN === "1" || process.env.ALAN_RUN_ID?.trim()) return false;
+  bindConfigPath(input2.args);
+  const config2 = input2.config ?? readConfig();
+  const provider = argumentValue(input2.args, "--provider");
+  if (!provider) throw new Error("hook requires --provider");
+  if (!config2.eventSpoolKey) return false;
+  const envelope = parseNativeHookEnvelope({
+    provider,
+    hookEvent: argumentValue(input2.args, "--event"),
+    payload: input2.payload
+  });
+  new EncryptedNativeHookInbox(nativeHookInboxPath(getConfigPath()), config2.eventSpoolKey).enqueue(
+    envelope
+  );
+  return true;
+}
+function runNativeHookCommand(args) {
+  try {
+    const payload = readBoundedHookPayload();
+    const enqueued = enqueueNativeHookFromConfig({ args, payload });
+    const hookEvent = argumentValue(args, "--event")?.toLowerCase();
+    if (enqueued && (hookEvent === "userpromptsubmit" || hookEvent === "user_prompt")) {
+      const providerKind = argumentValue(args, "--provider");
+      const externalSessionId = stringField4(payload, "session_id", "sessionId");
+      const capability = providerKind ? NATIVE_SESSION_PROVIDER_CAPABILITIES.find(
+        (candidate) => candidate.providerKind === providerKind
+      ) : void 0;
+      if (capability && externalSessionId) {
+        process.stdout.write(
+          `${JSON.stringify({
+            hookSpecificOutput: {
+              hookEventName: "UserPromptSubmit",
+              additionalContext: `First call get_native_session_link_status with provider=${capability.provider} and externalSessionId=${externalSessionId}. If status is linked, continue without asking or linking again. If status is syncing, wait briefly and retry the status check. Only when status is pending, ask the user one question: work on an Alan task or continue as a direct session. Resolve a named task with find_records, then call link_native_session. Do not guess a task and do not change task status.`
+            }
+          })}
+`
+        );
+      }
+    }
+  } catch (error61) {
+    if (process.env.ALAN_HOOK_DEBUG === "1") {
+      process.stderr.write(
+        `[alan-agent] native hook skipped: ${error61 instanceof Error ? error61.message : String(error61)}
+`
+      );
+    }
+  }
+}
+function collectNativeIntegrationStatus(args = []) {
+  bindConfigPath(args);
+  const config2 = readConfig();
+  const env = getDaemonCliEnvironment();
+  return NATIVE_SESSION_PROVIDER_CAPABILITIES.map((capability) => ({
+    provider: capability.providerKind,
+    command: capability.command,
+    installed: resolveCliExecutable(capability.command, env) !== null,
+    hookCoverage: capability.capabilities.lifecycleHooks ? "lifecycle" : capability.capabilities.state === "degraded" ? "notification" : "none",
+    transcriptStreaming: capability.capabilities.transcriptDelta,
+    inboxReady: Boolean(config2.eventSpoolKey)
+  }));
+}
+function printNativeIntegrationStatus(args) {
+  process.stdout.write(`${JSON.stringify(collectNativeIntegrationStatus(args), null, 2)}
+`);
+}
+
 // src/resume-fallback-env.ts
 var RESUME_FALLBACK_CONTEXT_ENV = "ALAN_RESUME_FALLBACK_CONTEXT_B64";
 function decodeResumeFallbackContext(encoded) {
@@ -78058,7 +79992,7 @@ function decodeResumeFallbackContext(encoded) {
 }
 
 // src/sandbox.ts
-var import_node_os12 = require("os");
+var import_node_os14 = require("os");
 
 // src/execution-activity-tracker.ts
 var ExecutionActivityTracker = class {
@@ -78383,11 +80317,11 @@ async function readErrorBody(response) {
   }
 }
 function delay2(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 
 // src/web-presenter.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto20 = require("crypto");
 var WebPresenter = class {
   constructor(wsClient, conversationId, cwd) {
     this.conversationId = conversationId;
@@ -78573,7 +80507,7 @@ var WebPresenter = class {
     this.applicationProblem = createAlanProblem({
       domain: "application",
       code: input2.code,
-      id: (0, import_node_crypto15.randomUUID)(),
+      id: (0, import_node_crypto20.randomUUID)(),
       title: APPLICATION_PROBLEM_TITLES[input2.code],
       detail: input2.message,
       occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -78640,7 +80574,7 @@ var WebPresenter = class {
 };
 
 // src/ws-client.ts
-var import_node_crypto17 = require("crypto");
+var import_node_crypto22 = require("crypto");
 
 // ../shared/dist/agent-liveness.js
 var AGENT_LIVENESS_PROTOCOL_VERSION = 1;
@@ -78668,8 +80602,8 @@ var agentProbeAckSchema = external_exports.object({
 });
 
 // src/sandbox-outbox.ts
-var import_node_crypto16 = require("crypto");
-var import_node_fs18 = require("fs");
+var import_node_crypto21 = require("crypto");
+var import_node_fs24 = require("fs");
 var SANDBOX_EVENT_OUTBOX_ENV = "ALAN_EVENT_OUTBOX_ENABLED";
 function isSandboxEventOutboxEnabled(env = process.env) {
   return env[SANDBOX_EVENT_OUTBOX_ENV] === "true";
@@ -78678,7 +80612,7 @@ function deriveSandboxOutboxKey(sessionToken) {
   if (!sessionToken) {
     throw new Error("sandbox event outbox requires ALAN_SESSION_TOKEN for key derivation");
   }
-  return (0, import_node_crypto16.createHash)("sha256").update(sessionToken, "utf8").digest("base64url");
+  return (0, import_node_crypto21.createHash)("sha256").update(sessionToken, "utf8").digest("base64url");
 }
 function sandboxOutboxSpoolPath(conversationId) {
   return `/tmp/alan-agent-outbox-${conversationId}.enc`;
@@ -78692,7 +80626,7 @@ function createSandboxEventOutbox(input2) {
     input2.pushLog?.(
       `sandbox_outbox_spool_reset ${error61 instanceof Error ? error61.message : String(error61)}`
     );
-    (0, import_node_fs18.rmSync)(path2, { force: true });
+    (0, import_node_fs24.rmSync)(path2, { force: true });
     return new EncryptedEventOutbox(path2, key, input2.pushLog, input2.options);
   }
 }
@@ -78830,7 +80764,7 @@ var WSClient = class {
   }
   socket;
   /** Stable id for this agent process; fences stale heartbeats server-side. */
-  agentSessionId = (0, import_node_crypto17.randomUUID)();
+  agentSessionId = (0, import_node_crypto22.randomUUID)();
   /** Monotonic heartbeat sequence — advances on every hello + heartbeat. */
   heartbeatSeq = 0;
   heartbeatTimer = null;
@@ -78914,9 +80848,9 @@ var WSClient = class {
     });
   }
   waitForConnection(timeoutMs = 15e3) {
-    return new Promise((resolve14, reject) => {
+    return new Promise((resolve15, reject) => {
       if (this.socket.connected) {
-        resolve14();
+        resolve15();
         return;
       }
       let lastError;
@@ -78927,7 +80861,7 @@ var WSClient = class {
       };
       const handleConnect = () => {
         cleanup();
-        resolve14();
+        resolve15();
       };
       const handleConnectError = (error61) => {
         lastError = error61;
@@ -79260,9 +81194,9 @@ async function runSandbox(config2) {
       onUserMessage: (payload) => {
         if (payload === null) {
           if (pendingMessageResolve) {
-            const resolve14 = pendingMessageResolve;
+            const resolve15 = pendingMessageResolve;
             pendingMessageResolve = null;
-            resolve14(null);
+            resolve15(null);
           }
           return;
         }
@@ -79284,9 +81218,9 @@ async function runSandbox(config2) {
           fileCount: payload.files?.length ?? 0
         });
         if (pendingMessageResolve) {
-          const resolve14 = pendingMessageResolve;
+          const resolve15 = pendingMessageResolve;
           pendingMessageResolve = null;
-          resolve14(payload);
+          resolve15(payload);
         } else {
           queuedMessages.push(payload);
         }
@@ -79351,7 +81285,7 @@ async function runSandbox(config2) {
   }
   const presenter = new WebPresenter(wsClient, config2.sessionId, config2.projectPath);
   presenter.setSuppressSessionLifecycle(true);
-  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os12.homedir)() });
+  const runtimeSkillManager = await RuntimeSkillManager.open({ homeDirectory: (0, import_node_os14.homedir)() });
   let lastProviderSessionId = config2.providerSessionId;
   let resumeFallbackContext = config2.resumeFallbackContext;
   let activeBackendKind = config2.backendKind || "claude_cli";
@@ -79365,12 +81299,13 @@ async function runSandbox(config2) {
   let currentAlanMcp;
   while (!stopped) {
     if (currentTask?.trim() || currentSkillInvocation) {
+      const activeRunId = currentRunId ?? config2.runId;
       const agent = new CoreAgent(presenter, {
         backendKind: activeBackendKind,
+        runId: activeRunId,
         providerApiKey: activeProviderApiKey
       });
       currentAgent = agent;
-      const activeRunId = currentRunId ?? config2.runId;
       const rootExecutionActivity = executionActivityTracker && activeRunId && currentTaskId ? executionActivityTracker.register({
         ownerId: `root:${activeRunId}`,
         leaseRunId: activeRunId,
@@ -79558,8 +81493,8 @@ async function runSandbox(config2) {
       });
       if (stopped) break;
     }
-    const nextPayload = queuedMessages.shift() ?? await new Promise((resolve14) => {
-      pendingMessageResolve = resolve14;
+    const nextPayload = queuedMessages.shift() ?? await new Promise((resolve15) => {
+      pendingMessageResolve = resolve15;
     });
     if (nextPayload === null || stopped) {
       break;
@@ -79638,9 +81573,9 @@ async function runSandbox(config2) {
 
 // src/service-manager.ts
 var import_node_child_process9 = require("child_process");
-var import_node_fs19 = require("fs");
-var import_node_os13 = require("os");
-var import_node_path21 = require("path");
+var import_node_fs25 = require("fs");
+var import_node_os15 = require("os");
+var import_node_path26 = require("path");
 var SERVICE_LABEL = "ai.tryalan.agent";
 var SYSTEMD_UNIT = "alan-agent.service";
 var WINDOWS_TASK = "Alan Agent";
@@ -79660,9 +81595,16 @@ function buildDaemonServicePlan(input2) {
     if (userId === void 0) throw new Error("Cannot determine the current macOS user ID");
     const domain2 = `gui/${userId}`;
     const serviceTarget = `${domain2}/${SERVICE_LABEL}`;
-    const manifestPath = (0, import_node_path21.join)(input2.homeDir, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
-    const logDir = (0, import_node_path21.join)(input2.homeDir, ".alan", "agent", "logs");
+    const manifestPath = (0, import_node_path26.join)(input2.homeDir, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+    const logDir = (0, import_node_path26.join)(input2.homeDir, ".alan", "agent", "logs");
     const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
+    const environmentEntries = Object.entries(input2.environment ?? {}).map(([key, value2]) => `    <key>${xml(key)}</key>
+    <string>${xml(value2)}</string>`).join("\n");
+    const environmentBlock = environmentEntries ? `  <key>EnvironmentVariables</key>
+  <dict>
+${environmentEntries}
+  </dict>
+` : "";
     const manifest = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -79673,7 +81615,7 @@ function buildDaemonServicePlan(input2) {
   <array>
 ${programArguments}
   </array>
-  <key>RunAtLoad</key>
+${environmentBlock}  <key>RunAtLoad</key>
   <true/>
   <key>KeepAlive</key>
   <dict>
@@ -79683,9 +81625,9 @@ ${programArguments}
   <key>ThrottleInterval</key>
   <integer>5</integer>
   <key>StandardOutPath</key>
-  <string>${xml((0, import_node_path21.join)(logDir, "daemon.log"))}</string>
+  <string>${xml((0, import_node_path26.join)(logDir, "daemon.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xml((0, import_node_path21.join)(logDir, "daemon-error.log"))}</string>
+  <string>${xml((0, import_node_path26.join)(logDir, "daemon-error.log"))}</string>
 </dict>
 </plist>
 `;
@@ -79724,7 +81666,8 @@ ${programArguments}
     };
   }
   if (input2.platform === "linux") {
-    const manifestPath = (0, import_node_path21.join)(input2.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+    const manifestPath = (0, import_node_path26.join)(input2.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+    const environmentLines = Object.entries(input2.environment ?? {}).map(([key, value2]) => `Environment=${systemdArg(`${key}=${value2}`)}`).join("\n");
     const manifest = `[Unit]
 Description=Alan local agent daemon
 After=network-online.target
@@ -79734,7 +81677,8 @@ StartLimitBurst=3
 
 [Service]
 Type=simple
-ExecStart=${daemonArgs.map(systemdArg).join(" ")}
+${environmentLines ? `${environmentLines}
+` : ""}ExecStart=${daemonArgs.map(systemdArg).join(" ")}
 Restart=on-failure
 RestartSec=5
 
@@ -79775,9 +81719,11 @@ WantedBy=default.target
       }
     };
   }
-  const executable = powershellLiteral(input2.nodeExecutable);
+  const environmentPrefix = Object.entries(input2.environment ?? {}).map(([key, value2]) => `$env:${key} = ${powershellLiteral(value2)}`).join("; ");
+  const directArgument = [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ");
+  const executable = powershellLiteral(environmentPrefix ? "powershell.exe" : input2.nodeExecutable);
   const argument = powershellLiteral(
-    [input2.cliEntry, "daemon", "--profile", input2.profile].map((part) => part.includes(" ") ? `"${part}"` : part).join(" ")
+    environmentPrefix ? `-NoProfile -NonInteractive -WindowStyle Hidden -Command "${environmentPrefix}; & ${powershellLiteral(input2.nodeExecutable)} ${powershellLiteral(input2.cliEntry)} daemon --profile ${input2.profile}"` : directArgument
   );
   const installScript = [
     `$action = New-ScheduledTaskAction -Execute ${executable} -Argument ${argument}`,
@@ -79820,31 +81766,32 @@ WantedBy=default.target
     }
   };
 }
-function currentServicePlan(args) {
-  const currentPlatform = (0, import_node_os13.platform)();
+function currentServicePlan(args, runtime) {
+  const currentPlatform = (0, import_node_os15.platform)();
   if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
     throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
   }
   const profile = resolveEndpointProfileFromArgs(args);
-  const cliEntry = process.argv[1];
+  const cliEntry = runtime?.cliEntry ?? process.argv[1];
   if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
   return buildDaemonServicePlan({
     platform: currentPlatform,
-    homeDir: (0, import_node_os13.homedir)(),
-    nodeExecutable: process.execPath,
-    cliEntry: (0, import_node_path21.resolve)(cliEntry),
-    profile
+    homeDir: (0, import_node_os15.homedir)(),
+    nodeExecutable: runtime?.executable ?? process.execPath,
+    cliEntry: (0, import_node_path26.resolve)(cliEntry),
+    profile,
+    environment: runtime?.environment
   });
 }
 function writeManifest(path2, contents) {
-  (0, import_node_fs19.mkdirSync)((0, import_node_path21.dirname)(path2), { recursive: true, mode: 448 });
+  (0, import_node_fs25.mkdirSync)((0, import_node_path26.dirname)(path2), { recursive: true, mode: 448 });
   const pendingPath = `${path2}.pending-${process.pid}`;
   try {
-    (0, import_node_fs19.writeFileSync)(pendingPath, contents, { mode: 384 });
-    (0, import_node_fs19.chmodSync)(pendingPath, 384);
-    (0, import_node_fs19.renameSync)(pendingPath, path2);
+    (0, import_node_fs25.writeFileSync)(pendingPath, contents, { mode: 384 });
+    (0, import_node_fs25.chmodSync)(pendingPath, 384);
+    (0, import_node_fs25.renameSync)(pendingPath, path2);
   } finally {
-    (0, import_node_fs19.rmSync)(pendingPath, { force: true });
+    (0, import_node_fs25.rmSync)(pendingPath, { force: true });
   }
 }
 function runServiceCommand(command) {
@@ -79858,16 +81805,16 @@ function runServiceCommand(command) {
   }
   return { status, output: output2 };
 }
-function installDaemonService(args = []) {
+function installDaemonService(args = [], runtime) {
   const profile = resolveEndpointProfileFromArgs(args);
   const configPath = resolveAgentConfigPath({ profile });
   if (!configExistsAtPath(configPath)) {
     throw new Error(`No ${profile} runtime is configured. Run alan-agent setup or login first.`);
   }
-  const plan = currentServicePlan(args);
+  const plan = currentServicePlan(args, runtime);
   if (plan.manifestPath && plan.manifest) {
-    if ((0, import_node_os13.platform)() === "darwin") {
-      (0, import_node_fs19.mkdirSync)((0, import_node_path21.join)((0, import_node_os13.homedir)(), ".alan", "agent", "logs"), { recursive: true, mode: 448 });
+    if ((0, import_node_os15.platform)() === "darwin") {
+      (0, import_node_fs25.mkdirSync)((0, import_node_path26.join)((0, import_node_os15.homedir)(), ".alan", "agent", "logs"), { recursive: true, mode: 448 });
     }
     writeManifest(plan.manifestPath, plan.manifest);
   }
@@ -79877,7 +81824,7 @@ function installDaemonService(args = []) {
 function uninstallDaemonService(args = []) {
   const plan = currentServicePlan(args);
   for (const command of plan.uninstallCommands) runServiceCommand(command);
-  if (plan.manifestPath) (0, import_node_fs19.rmSync)(plan.manifestPath, { force: true });
+  if (plan.manifestPath) (0, import_node_fs25.rmSync)(plan.manifestPath, { force: true });
   console.info("[alan-agent] Per-user daemon service removed");
 }
 function printDaemonServiceStatus(args = []) {
@@ -79889,11 +81836,11 @@ function printDaemonServiceStatus(args = []) {
 
 // src/skills/skill-cli.ts
 var import_promises6 = require("fs/promises");
-var import_node_os14 = require("os");
-var import_node_path22 = require("path");
+var import_node_os16 = require("os");
+var import_node_path27 = require("path");
 async function runSkillsCommand(args) {
   const [subcommand, ...options] = args;
-  const homeDirectory = option(options, "--home") ?? (0, import_node_os14.homedir)();
+  const homeDirectory = option(options, "--home") ?? (0, import_node_os16.homedir)();
   const manager = await RuntimeSkillManager.open({ homeDirectory });
   if (subcommand === "scan") {
     const inputPath = option(options, "--input");
@@ -79934,7 +81881,7 @@ async function defaultScanInput(homeDirectory) {
   });
 }
 async function readProtectedJson(path2) {
-  const absolutePath = (0, import_node_path22.resolve)(path2);
+  const absolutePath = (0, import_node_path27.resolve)(path2);
   const stat2 = await (0, import_promises6.lstat)(absolutePath);
   if (!stat2.isFile()) throw new Error(`Skill input is not a regular file: ${absolutePath}`);
   if (process.platform !== "win32" && (stat2.mode & 63) !== 0) {
@@ -80084,6 +82031,17 @@ async function main() {
     await setupDaemon(commandArgs);
     return;
   }
+  if (command === "install") {
+    bindConfigPath(commandArgs);
+    const configured = readConfig();
+    if (!configured.runtimeId || !configured.runtimeToken) {
+      if (commandArgs.includes("--setup-token")) await setupDaemon(commandArgs);
+      else await loginWithDeviceCode(commandArgs);
+    }
+    installDaemonService(commandArgs);
+    runMcpIntegrationCommand(["reconcile", ...commandArgs]);
+    return;
+  }
   if (command === "login") {
     await loginWithDeviceCode(commandArgs);
     return;
@@ -80094,6 +82052,7 @@ async function main() {
   }
   if (command === "service" && commandArgs[0] === "install") {
     installDaemonService(commandArgs.slice(1));
+    runMcpIntegrationCommand(["reconcile", ...commandArgs.slice(1)]);
     return;
   }
   if (command === "service" && commandArgs[0] === "uninstall") {
@@ -80104,6 +82063,18 @@ async function main() {
     printDaemonServiceStatus(commandArgs.slice(1));
     return;
   }
+  if (command === "integrations" && commandArgs[0] === "capabilities") {
+    printNativeIntegrationStatus(commandArgs.slice(1));
+    return;
+  }
+  if (command === "integrations") {
+    runMcpIntegrationCommand(commandArgs);
+    return;
+  }
+  if (command === "hook") {
+    runNativeHookCommand(commandArgs);
+    return;
+  }
   if (command === "stop") {
     await stopDaemon(commandArgs);
     return;