@alan-ai-hq/agent-manager 0.1.104 → 0.1.106

package/dist/index.cjs

@@ -15504,7 +15504,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.104";
+var AGENT_VERSION = "0.1.106";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -35724,6 +35724,8 @@ var AGENT_CONFIG_KEYS = /* @__PURE__ */ new Map([
   ["teamId", "string"],
   ["runtimeId", "string"],
   ["runtimeToken", "string"],
+  ["runtimeRenewalToken", "string"],
+  ["runtimeTokenExpiresAt", "string"],
   ["localApiPort", "number"],
   ["localApiToken", "string"],
   ["displayName", "string"]
@@ -36556,7 +36558,7 @@ function isBrowserRecordingToolName(toolName) {
 }
 
 // ../shared/dist/agent/mcp-config.js
-var ALAN_AGENT_CREDENTIAL_ENV = "ALAN_AGENT_CREDENTIAL";
+var ALAN_MCP_AUTHORIZATION_ENV = "ALAN_MCP_AUTHORIZATION";
 var ALAN_RUN_ID_ENV = "ALAN_RUN_ID";
 var MCP_CONFIG_KEY = /^[A-Za-z0-9_-]+$/;
 function isExternalMcpServerName(name) {
@@ -38160,20 +38162,22 @@ var import_util9 = require("util");
 var import_fs6 = require("fs");
 var import_os5 = require("os");
 var import_path6 = require("path");
+var import_promises = require("fs/promises");
+var import_path7 = require("path");
 var import_fs7 = require("fs");
 var import_os6 = require("os");
-var import_path7 = require("path");
+var import_path8 = require("path");
 var import_fs8 = require("fs");
 var import_os7 = require("os");
-var import_path8 = require("path");
+var import_path9 = require("path");
 var import_fs9 = require("fs");
 var import_os8 = require("os");
-var import_path9 = require("path");
+var import_path10 = require("path");
 var import_readline2 = require("readline");
 var import_url2 = require("url");
 var import_crypto4 = require("crypto");
 var import_fs10 = require("fs");
-var import_path10 = require("path");
+var import_path11 = require("path");
 var MAX_PARSED_ATTACHMENTS = 3;
 var MAX_PARSED_ATTACHMENT_CHARS = 12e3;
 var MAX_METADATA_CHARS = 240;
@@ -40806,8 +40810,12 @@ function requiredHeader(registration, name) {
   if (!value2) throw new Error(`Alan MCP ${name} header is missing`);
   return value2;
 }
-function requireManagedAgentCredential(registration) {
-  return requiredHeader(registration, "x-alan-agent-credential");
+function requireManagedAuthorization(registration) {
+  const authorization = requiredHeader(registration, "authorization");
+  if (!authorization.startsWith("Bearer ") || !authorization.slice(7).trim()) {
+    throw new Error("Alan MCP authorization header must contain a bearer token");
+  }
+  return authorization;
 }
 function requireManagedRunId(registration) {
   return requiredHeader(registration, "x-alan-run-id");
@@ -41288,7 +41296,7 @@ function buildClaudeManagedMcpArgs(registration, options = {}) {
     type: "http",
     url: registration.url,
     headers: {
-      "x-alan-agent-credential": `\${${ALAN_AGENT_CREDENTIAL_ENV}}`,
+      Authorization: `\${${ALAN_MCP_AUTHORIZATION_ENV}}`,
       "x-alan-run-id": `\${${ALAN_RUN_ID_ENV}}`
     }
   };
@@ -41310,7 +41318,7 @@ function createClaudeCliBackend(command = "claude", defaultArgs = []) {
         env: {
           ...context.env,
           ...externalMcp?.env,
-          [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(managedRegistration),
+          [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(managedRegistration),
           [ALAN_RUN_ID_ENV]: requireManagedRunId(managedRegistration)
         }
       } : context;
@@ -42566,7 +42574,7 @@ function buildCodexManagedMcpArgs(registration, options = {}) {
     "-c",
     `mcp_servers.alan.url=${JSON.stringify(registration.url)}`,
     "-c",
-    `mcp_servers.alan.env_http_headers.x-alan-agent-credential=${JSON.stringify(ALAN_AGENT_CREDENTIAL_ENV)}`,
+    `mcp_servers.alan.env_http_headers.Authorization=${JSON.stringify(ALAN_MCP_AUTHORIZATION_ENV)}`,
     "-c",
     `mcp_servers.alan.env_http_headers.x-alan-run-id=${JSON.stringify(ALAN_RUN_ID_ENV)}`,
     "-c",
@@ -42613,7 +42621,7 @@ function createCodexRuntimeBackend(command = "codex", defaultArgs = []) {
         env: {
           ...context.env,
           ...externalMcp?.env,
-          [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(managedRegistration),
+          [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(managedRegistration),
           [ALAN_RUN_ID_ENV]: requireManagedRunId(managedRegistration)
         }
       } : context;
@@ -43000,6 +43008,39 @@ function createCopilotCliBackend(command = "copilot", defaultArgs = []) {
     }
   };
 }
+async function withCursorProjectMcpEntry(cwd, url3, run) {
+  const path2 = (0, import_path7.join)(cwd, ".cursor", "mcp.json");
+  const original = await (0, import_promises.readFile)(path2, "utf8").catch(() => null);
+  const config2 = parseConfig(original);
+  const servers = config2.mcpServers ?? {};
+  config2.mcpServers = servers;
+  servers.alan = {
+    type: "http",
+    url: url3,
+    headers: {
+      Authorization: `\${env:${ALAN_MCP_AUTHORIZATION_ENV}}`,
+      "x-alan-run-id": `\${env:${ALAN_RUN_ID_ENV}}`
+    }
+  };
+  await (0, import_promises.mkdir)((0, import_path7.dirname)(path2), { recursive: true });
+  await (0, import_promises.writeFile)(path2, `${JSON.stringify(config2, null, 2)}
+`);
+  try {
+    return await run();
+  } finally {
+    if (original === null) await (0, import_promises.rm)(path2, { force: true });
+    else await (0, import_promises.writeFile)(path2, original);
+  }
+}
+function parseConfig(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
 function asRecord4(value2) {
   return typeof value2 === "object" && value2 !== null ? value2 : null;
 }
@@ -43192,10 +43233,10 @@ function emitCursorSubagentTranscript(transcriptPath, parentToolUseId, presenter
 function cursorTranscriptsRoot(context) {
   const projectKey = context.cwd.replace(/^[/\\]+/, "").replace(/[/\\]+/g, "-");
   const home = context.env.HOME || process.env.HOME || (0, import_os6.homedir)();
-  return (0, import_path7.join)(home, ".cursor", "projects", projectKey, "agent-transcripts");
+  return (0, import_path8.join)(home, ".cursor", "projects", projectKey, "agent-transcripts");
 }
 function cursorTranscriptPathForAgent(context, agentId) {
-  return (0, import_path7.join)(cursorTranscriptsRoot(context), agentId, `${agentId}.jsonl`);
+  return (0, import_path8.join)(cursorTranscriptsRoot(context), agentId, `${agentId}.jsonl`);
 }
 function resolveCursorSubagentTranscriptPath(success2, context) {
   const explicit = success2?.transcriptPath ?? success2?.transcript_path;
@@ -43579,88 +43620,90 @@ function createCursorAgentCliBackend(command = "cursor-agent", defaultArgs = [])
         ...context,
         env: {
           ...context.env,
-          [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(context.config.alanMcp),
+          [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(context.config.alanMcp),
           [ALAN_RUN_ID_ENV]: requireManagedRunId(context.config.alanMcp)
         }
       } : context;
-      try {
-        return await createGenericCliBackend({
-          kind: "cursor_agent_cli",
-          supportTier: "structured",
-          command,
-          args: [],
-          buildArgs: (ctx, _prompt) => {
-            const args = [
-              "--print",
-              "--output-format",
-              "stream-json",
-              "--trust",
-              "--workspace",
-              ctx.cwd
-            ];
-            if (approveMcps) {
-              args.push("--approve-mcps");
-            }
-            const resumeId = ctx.config.runtimeSessionId?.trim() || ctx.config.providerSessionId?.trim();
-            if (shouldForceCursorAgent(ctx.config)) args.push("--force");
-            if (ctx.config.mode === "plan" || ctx.config.mode === "review") {
-              args.push("--mode", "plan");
-            } else if (ctx.config.mode === "ask") {
-              args.push("--mode", "ask");
-            } else if (shouldUseReadOnlyRuntimePermissions(ctx.config)) {
-              args.push("--mode", "plan");
-            }
-            if (resumeId) {
-              args.push("--resume", resumeId);
-              logResumeObservability("agent_resume_requested", {
-                backendKind: "cursor_agent_cli",
-                requestedResumeId: resumeId
-              });
-            }
-            const model = ctx.config.selectedModel?.trim();
-            if (model && isDispatchableCursorModel(model)) {
-              const modelDef = findModelDef("cursor_agent_cli", model) ?? findModelDef("cursor_agent_cli", model.replace(/-fast$/, ""));
-              args.push(
-                "--model",
-                buildCursorAgentModelArg(model, {
-                  selectedEffortLevel: ctx.config.selectedEffortLevel,
-                  selectedContextWindow: ctx.config.selectedContextWindow,
-                  effortLevels: modelDef?.capabilities?.effortLevels,
-                  contextWindows: modelDef?.capabilities?.contextWindows
-                })
-              );
-            }
-            return [...args, ...defaultArgs];
-          },
-          // Prompt over stdin with immediate EOF (verified live on cursor-agent
-          // 2026.07.09): vibe-kanban's mitigation for cursor-agent's documented
-          // headless hangs. The result-race/grace-kill stays active via
-          // keepStdinOpen; closeStdinAfterPrompt only skips holding stdin open,
-          // which cursor never reads after the prompt anyway.
-          promptViaStdin: true,
-          keepStdinOpen: true,
-          closeStdinAfterPrompt: true,
-          // cursor-agent headless has a documented failure mode of hanging at startup
-          // with zero output; without this watchdog only the 30-min server reaper
-          // would end the run.
-          startupTimeoutMs: 18e4,
-          // Post-startup hang bound: cursor's asks use the non-blocking MCP model and it
-          // never populates the idle timer's ask/background fire conditions, so a cursor
-          // process that produced output then went silent (no result event) is otherwise
-          // bounded only by the ~30-min external reaper. Poll every 5 min; kill after 15
-          // min of continuous silence.
-          resultIdleTimeoutMs: 5 * 6e4,
-          postStartupSilenceTimeoutMs: 15 * 6e4,
-          augmentPrompt: (ctx) => {
-            const isResume = Boolean(
-              ctx.config.runtimeSessionId?.trim() || ctx.config.providerSessionId?.trim()
+      const runBackend = () => createGenericCliBackend({
+        kind: "cursor_agent_cli",
+        supportTier: "structured",
+        command,
+        args: [],
+        buildArgs: (ctx, _prompt) => {
+          const args = [
+            "--print",
+            "--output-format",
+            "stream-json",
+            "--trust",
+            "--workspace",
+            ctx.cwd
+          ];
+          if (approveMcps) {
+            args.push("--approve-mcps");
+          }
+          const resumeId = ctx.config.runtimeSessionId?.trim() || ctx.config.providerSessionId?.trim();
+          if (shouldForceCursorAgent(ctx.config)) args.push("--force");
+          if (ctx.config.mode === "plan" || ctx.config.mode === "review") {
+            args.push("--mode", "plan");
+          } else if (ctx.config.mode === "ask") {
+            args.push("--mode", "ask");
+          } else if (shouldUseReadOnlyRuntimePermissions(ctx.config)) {
+            args.push("--mode", "plan");
+          }
+          if (resumeId) {
+            args.push("--resume", resumeId);
+            logResumeObservability("agent_resume_requested", {
+              backendKind: "cursor_agent_cli",
+              requestedResumeId: resumeId
+            });
+          }
+          const model = ctx.config.selectedModel?.trim();
+          if (model && isDispatchableCursorModel(model)) {
+            const modelDef = findModelDef("cursor_agent_cli", model) ?? findModelDef("cursor_agent_cli", model.replace(/-fast$/, ""));
+            args.push(
+              "--model",
+              buildCursorAgentModelArg(model, {
+                selectedEffortLevel: ctx.config.selectedEffortLevel,
+                selectedContextWindow: ctx.config.selectedContextWindow,
+                effortLevels: modelDef?.capabilities?.effortLevels,
+                contextWindows: modelDef?.capabilities?.contextWindows
+              })
             );
-            const base = buildResumeAwarePrompt(ctx.config, ctx.promptText, { isResume });
-            const prompt = ctx.config.mode === "plan" ? buildPlanModePrefix(base) : base;
-            return appendImagePathReferences(prompt, imageFiles);
-          },
-          parseStructuredLine: parseCursorStructuredLine
-        }).run(runContext);
+          }
+          return [...args, ...defaultArgs];
+        },
+        // Prompt over stdin with immediate EOF (verified live on cursor-agent
+        // 2026.07.09): vibe-kanban's mitigation for cursor-agent's documented
+        // headless hangs. The result-race/grace-kill stays active via
+        // keepStdinOpen; closeStdinAfterPrompt only skips holding stdin open,
+        // which cursor never reads after the prompt anyway.
+        promptViaStdin: true,
+        keepStdinOpen: true,
+        closeStdinAfterPrompt: true,
+        // cursor-agent headless has a documented failure mode of hanging at startup
+        // with zero output; without this watchdog only the 30-min server reaper
+        // would end the run.
+        startupTimeoutMs: 18e4,
+        // Post-startup hang bound: cursor's asks use the non-blocking MCP model and it
+        // never populates the idle timer's ask/background fire conditions, so a cursor
+        // process that produced output then went silent (no result event) is otherwise
+        // bounded only by the ~30-min external reaper. Poll every 5 min; kill after 15
+        // min of continuous silence.
+        resultIdleTimeoutMs: 5 * 6e4,
+        postStartupSilenceTimeoutMs: 15 * 6e4,
+        augmentPrompt: (ctx) => {
+          const isResume = Boolean(
+            ctx.config.runtimeSessionId?.trim() || ctx.config.providerSessionId?.trim()
+          );
+          const base = buildResumeAwarePrompt(ctx.config, ctx.promptText, { isResume });
+          const prompt = ctx.config.mode === "plan" ? buildPlanModePrefix(base) : base;
+          return appendImagePathReferences(prompt, imageFiles);
+        },
+        parseStructuredLine: parseCursorStructuredLine
+      }).run(runContext);
+      const managed = context.config.alanMcp;
+      try {
+        return await (managed ? withCursorProjectMcpEntry(context.cwd, managed.url, runBackend) : runBackend());
       } finally {
         cleanup();
       }
@@ -44414,9 +44457,9 @@ function buildGrokAgentArgs(config2, defaultArgs = []) {
   return args;
 }
 var DEFAULT_SKILL_ROOTS = [
-  (0, import_path9.join)((0, import_os8.homedir)(), ".agents", "skills"),
-  (0, import_path9.join)((0, import_os8.homedir)(), ".claude", "skills"),
-  (0, import_path9.join)((0, import_os8.homedir)(), ".config", "opencode", "skills")
+  (0, import_path10.join)((0, import_os8.homedir)(), ".agents", "skills"),
+  (0, import_path10.join)((0, import_os8.homedir)(), ".claude", "skills"),
+  (0, import_path10.join)((0, import_os8.homedir)(), ".config", "opencode", "skills")
 ];
 function parseFrontmatter(content) {
   if (!content.startsWith("---\n")) return {};
@@ -44436,7 +44479,7 @@ function listSkillFiles(root) {
   const files = [];
   for (const entry of (0, import_fs9.readdirSync)(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const skillPath = (0, import_path9.join)(root, entry.name, "SKILL.md");
+    const skillPath = (0, import_path10.join)(root, entry.name, "SKILL.md");
     if ((0, import_fs9.existsSync)(skillPath)) files.push(skillPath);
   }
   return files;
@@ -44735,7 +44778,7 @@ function buildKimiMcpConfig(registration, externalServers = {}) {
   mcpServers[managedMcpServerName()] = {
     url: registration.url,
     headers: {
-      "x-alan-agent-credential": requireManagedAgentCredential(registration),
+      Authorization: requireManagedAuthorization(registration),
       "x-alan-run-id": requireManagedRunId(registration)
     }
   };
@@ -44747,8 +44790,8 @@ function createKimiCliBackend(command = "kimi-cli", defaultArgs = []) {
     supportTier: "structured",
     async run(context) {
       const registration = context.config.alanMcp;
-      const mcpDirectory = registration ? (0, import_fs8.mkdtempSync)((0, import_path8.join)((0, import_os7.tmpdir)(), "alan-kimi-mcp-")) : null;
-      const mcpConfigPath = mcpDirectory ? (0, import_path8.join)(mcpDirectory, "mcp.json") : null;
+      const mcpDirectory = registration ? (0, import_fs8.mkdtempSync)((0, import_path9.join)((0, import_os7.tmpdir)(), "alan-kimi-mcp-")) : null;
+      const mcpConfigPath = mcpDirectory ? (0, import_path9.join)(mcpDirectory, "mcp.json") : null;
       if (registration && mcpConfigPath) {
         (0, import_fs8.writeFileSync)(
           mcpConfigPath,
@@ -44827,7 +44870,7 @@ function buildManagedOpenCodeConfigContent(existing, registration) {
         type: "remote",
         url: registration.url,
         headers: {
-          "x-alan-agent-credential": `{env:${ALAN_AGENT_CREDENTIAL_ENV}}`,
+          Authorization: `{env:${ALAN_MCP_AUTHORIZATION_ENV}}`,
           "x-alan-run-id": `{env:${ALAN_RUN_ID_ENV}}`
         },
         oauth: false,
@@ -44843,7 +44886,7 @@ function withManagedOpenCodeMcp(context) {
     ...context,
     env: {
       ...context.env,
-      [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(registration),
+      [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(registration),
       [ALAN_RUN_ID_ENV]: requireManagedRunId(registration),
       OPENCODE_CONFIG_CONTENT: buildManagedOpenCodeConfigContent(
         context.env.OPENCODE_CONFIG_CONTENT,
@@ -46706,14 +46749,14 @@ function normalizePath(candidate, cwd) {
   } catch {
   }
   if (path2.startsWith("~/")) return null;
-  if ((0, import_path10.isAbsolute)(path2)) return path2;
-  return cwd ? (0, import_path10.join)(cwd, path2) : null;
+  if ((0, import_path11.isAbsolute)(path2)) return path2;
+  return cwd ? (0, import_path11.join)(cwd, path2) : null;
 }
 function resolveToolCwd(cwd, toolInput) {
   if (!isRecord(toolInput)) return cwd;
   const raw = typeof toolInput.cwd === "string" ? toolInput.cwd : typeof toolInput.workdir === "string" ? toolInput.workdir : typeof toolInput.workingDirectory === "string" ? toolInput.workingDirectory : null;
   if (!raw) return cwd;
-  return (0, import_path10.isAbsolute)(raw) || !cwd ? raw : (0, import_path10.join)(cwd, raw);
+  return (0, import_path11.isAbsolute)(raw) || !cwd ? raw : (0, import_path11.join)(cwd, raw);
 }
 function extractBrowserMediaPathHints(content, cwd, toolName, options = {}, kind = "video") {
   if (!isAgentBrowserMediaInvocation(toolName, content, options.toolInput, kind)) return [];
@@ -46758,7 +46801,7 @@ function extractGeneratedImagesFromToolResult(toolId, content, cwd, toolName, op
     const path2 = normalizePath(candidate, effectiveCwd);
     if (!path2 || seen.has(path2) || !(0, import_fs10.existsSync)(path2)) continue;
     seen.add(path2);
-    const ext = (0, import_path10.extname)(path2).toLowerCase();
+    const ext = (0, import_path11.extname)(path2).toLowerCase();
     const mimeType = IMAGE_MIME_BY_EXT[ext];
     if (!mimeType) continue;
     const stat2 = (0, import_fs10.statSync)(path2);
@@ -46768,7 +46811,7 @@ function extractGeneratedImagesFromToolResult(toolId, content, cwd, toolName, op
     images.push({
       type: "generated_image",
       id: (0, import_crypto4.randomUUID)(),
-      filename: (0, import_path10.basename)(path2),
+      filename: (0, import_path11.basename)(path2),
       mimeType,
       size: buffer.length,
       width,
@@ -46797,7 +46840,7 @@ function extractSessionMediaFromToolResult(toolId, content, cwd, toolName, optio
     const path2 = normalizePath(candidate, effectiveCwd);
     if (!path2 || seen.has(path2) || !(0, import_fs10.existsSync)(path2)) continue;
     seen.add(path2);
-    const ext = (0, import_path10.extname)(path2).toLowerCase();
+    const ext = (0, import_path11.extname)(path2).toLowerCase();
     const mimeType = mimeByExt[ext];
     if (!mimeType) continue;
     const stat2 = (0, import_fs10.statSync)(path2);
@@ -46808,7 +46851,7 @@ function extractSessionMediaFromToolResult(toolId, content, cwd, toolName, optio
       type: "session_media",
       kind,
       id: (0, import_crypto4.randomUUID)(),
-      filename: (0, import_path10.basename)(path2),
+      filename: (0, import_path11.basename)(path2),
       mimeType,
       size: buffer.length,
       width: dimensions?.width,
@@ -55520,7 +55563,7 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
   childProcess = null;
   _aborted = false;
   runId;
-  agentCredential;
+  runtimeToken;
   providerApiKey;
   onProviderSpawned;
   cliEnvOverrides;
@@ -55529,7 +55572,7 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
   constructor(presenter, runtime) {
     super(presenter, runtime);
     this.runId = runtime.runId?.trim() || void 0;
-    this.agentCredential = runtime.agentCredential?.trim() || void 0;
+    this.runtimeToken = runtime.runtimeToken?.trim() || void 0;
     this.providerApiKey = runtime.providerApiKey;
     this.onProviderSpawned = runtime.onProviderSpawned;
     this.cliEnvOverrides = runtime.cliEnvOverrides ?? {};
@@ -55667,8 +55710,8 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
     augmented.ALAN_MANAGED_RUN = "1";
     if (this.runId) augmented.ALAN_RUN_ID = this.runId;
     else delete augmented.ALAN_RUN_ID;
-    if (this.agentCredential) augmented.ALAN_AGENT_CREDENTIAL = this.agentCredential;
-    else delete augmented.ALAN_AGENT_CREDENTIAL;
+    if (this.runtimeToken) augmented.ALAN_MCP_AUTHORIZATION = `Bearer ${this.runtimeToken}`;
+    else delete augmented.ALAN_MCP_AUTHORIZATION;
     const backendKind = this.runtime.backendKind ?? "";
     const providerApiKey = this.providerApiKey ?? "";
     if (backendKind === "antigravity_cli" && providerApiKey.trim()) {
@@ -55843,14 +55886,14 @@ ${meta3.description}`);
 
 // src/managed-mcp.ts
 function buildManagedAlanMcp(input2) {
-  const agentCredential = input2.agentCredential.trim();
+  const runtimeToken = input2.runtimeToken.trim();
   const runId = input2.runId.trim();
-  if (!agentCredential) throw new Error("Alan agent credential is missing");
+  if (!runtimeToken) throw new Error("Alan runtime token is missing");
   if (!runId) throw new Error("Alan run ID is missing");
   return {
     url: new URL("/mcp", input2.apiUrl).toString(),
     headers: {
-      "x-alan-agent-credential": agentCredential,
+      Authorization: `Bearer ${runtimeToken}`,
       "x-alan-run-id": runId
     }
   };
@@ -56379,6 +56422,7 @@ async function handleAgentExecute(ctx, payload) {
     runtimeId,
     runtimeSkillManager,
     getRuntimeToken,
+    ensureRuntimeTokenForLaunch,
     eventOutbox,
     daemonSessionId,
     daemonEpoch,
@@ -56396,12 +56440,22 @@ async function handleAgentExecute(ctx, payload) {
     maintenanceReason,
     verifyActiveWorkspaceLease
   } = ctx;
-  const runtimeToken = getRuntimeToken();
   const heartbeatSeq = getHeartbeatSeq();
   const disconnectedSinceMs = getDisconnectedSinceMs();
   if (!payload?.runId || !payload.conversationId || typeof payload.content !== "string") {
     return;
   }
+  const tokenReadiness = ensureRuntimeTokenForLaunch();
+  const tokenReady = typeof tokenReadiness === "boolean" ? tokenReadiness : await tokenReadiness;
+  if (!tokenReady) {
+    socket.emit("agent.rejected", {
+      runId: payload.runId,
+      message: "This Computer could not renew its expired Alan credential. Run setup again.",
+      code: "runtime_token_expired"
+    });
+    return;
+  }
+  const runtimeToken = getRuntimeToken();
   const isTaskWorkspacePayload = Boolean(
     payload.worktreeInfo?.worktreePath || payload.worktreeInfo?.allWorktrees?.length
   );
@@ -56641,7 +56695,7 @@ async function handleAgentExecute(ctx, payload) {
   };
   const alanMcp = buildManagedAlanMcp({
     apiUrl,
-    agentCredential: runtimeToken,
+    runtimeToken,
     runId: payload.runId
   });
   if (!socket.connected) {
@@ -56811,7 +56865,7 @@ async function handleAgentExecute(ctx, payload) {
       backendKind,
       runtimeCommand,
       runId: payload.runId,
-      agentCredential: runtimeToken,
+      runtimeToken,
       providerApiKey: payload.providerApiKey,
       onProviderSpawned: (pid) => {
         const entry = activeAgents.get(payload.runId);
@@ -58201,7 +58255,7 @@ async function exchangeRuntimeSetupGrant(input2, setupSignal) {
     throw new Error(`runtime registration failed: ${response.status} ${responseBody}`);
   }
   const body = await response.json();
-  if (typeof body.runtime?.id !== "string" || typeof body.runtime.credentialGeneration !== "number" || typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_") || typeof body.runtimeRenewalToken !== "string" || !body.runtimeRenewalToken.startsWith("alan_runtime_renew_")) {
+  if (typeof body.runtime?.id !== "string" || typeof body.runtime.credentialGeneration !== "number" || typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_") || typeof body.runtimeRenewalToken !== "string" || !body.runtimeRenewalToken.startsWith("alan_runtime_renew_") || body.runtimeTokenExpiresAt !== void 0 && (typeof body.runtimeTokenExpiresAt !== "string" || !Number.isFinite(Date.parse(body.runtimeTokenExpiresAt)))) {
     throw new Error("runtime registration returned an invalid credential bundle");
   }
   return {
@@ -58209,7 +58263,8 @@ async function exchangeRuntimeSetupGrant(input2, setupSignal) {
     displayName: typeof body.runtime.displayName === "string" ? body.runtime.displayName : input2.displayName,
     credentialGeneration: body.runtime.credentialGeneration,
     runtimeToken: body.runtimeToken,
-    runtimeRenewalToken: body.runtimeRenewalToken
+    runtimeRenewalToken: body.runtimeRenewalToken,
+    runtimeTokenExpiresAt: typeof body.runtimeTokenExpiresAt === "string" ? body.runtimeTokenExpiresAt : void 0
   };
 }
 async function handoffRuntimeSetupGrant(input2) {
@@ -58236,13 +58291,13 @@ async function handoffRuntimeSetupGrant(input2) {
 // src/skills/local-skill-source.ts
 var import_node_buffer2 = require("buffer");
 var import_node_crypto14 = require("crypto");
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_node_path20 = __toESM(require("path"), 1);
 
 // ../shared/dist/node/skill-package.js
 var import_node_buffer = require("buffer");
 var import_node_crypto13 = require("crypto");
-var import_promises = require("fs/promises");
+var import_promises2 = require("fs/promises");
 var import_node_path19 = require("path");
 var import_yaml = __toESM(require_dist(), 1);
 var TREE_HASH_PREFIX = import_node_buffer.Buffer.from("alan-skill-tree-v1\0", "utf8");
@@ -58335,11 +58390,11 @@ async function readSkillPackageFile(packageRoot, path2, expectedSha256) {
   if (!normalizedPath || normalizedPath !== path2 || normalizedPath.includes("\\") || components.some((component) => !component || component === "." || component === "..")) {
     throw new SkillPackageError("INVALID_PATH", `Invalid Skill package path: ${path2}`, path2);
   }
-  const absolutePath = await (0, import_promises.realpath)((0, import_node_path19.resolve)(root, ...components)).catch(() => null);
+  const absolutePath = await (0, import_promises2.realpath)((0, import_node_path19.resolve)(root, ...components)).catch(() => null);
   if (!absolutePath || normalizeRelativePath(root, absolutePath) !== normalizedPath) {
     throw new SkillPackageError("INVALID_PATH", `Skill package file was not found: ${path2}`, path2);
   }
-  const entryStat = await (0, import_promises.lstat)(absolutePath);
+  const entryStat = await (0, import_promises2.lstat)(absolutePath);
   if (!entryStat.isFile()) {
     throw new SkillPackageError("SPECIAL_FILE_BLOCKED", `Only regular files are allowed in Skill packages: ${path2}`, path2);
   }
@@ -58356,11 +58411,11 @@ async function readSkillPackageFile(packageRoot, path2, expectedSha256) {
   return { file: read.manifest, bytes: read.bytes };
 }
 async function requirePackageRoot(packageRoot) {
-  const root = await (0, import_promises.realpath)((0, import_node_path19.resolve)(packageRoot)).catch(() => null);
+  const root = await (0, import_promises2.realpath)((0, import_node_path19.resolve)(packageRoot)).catch(() => null);
   if (!root) {
     throw new SkillPackageError("INVALID_PACKAGE_ROOT", "Skill package directory does not exist");
   }
-  const rootStat = await (0, import_promises.lstat)(root);
+  const rootStat = await (0, import_promises2.lstat)(root);
   if (!rootStat.isDirectory()) {
     throw new SkillPackageError("INVALID_PACKAGE_ROOT", "Skill package root must be a directory");
   }
@@ -58380,13 +58435,13 @@ async function walkPackage(root, ignoredPaths) {
   }
   return files;
   async function walkDirectory(directory) {
-    const entries = await (0, import_promises.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises2.readdir)(directory, { withFileTypes: true });
     for (const entry of entries) {
       const absolutePath = (0, import_node_path19.resolve)(directory, entry.name);
       const normalizedPath = normalizeRelativePath(root, absolutePath);
       if (isIgnored(normalizedPath, entry.name, entry.isDirectory(), ignored))
         continue;
-      const entryStat = await (0, import_promises.lstat)(absolutePath);
+      const entryStat = await (0, import_promises2.lstat)(absolutePath);
       if (entryStat.isSymbolicLink()) {
         throw new SkillPackageError("SYMLINK_BLOCKED", `Nested symbolic links are not allowed in Skill packages: ${normalizedPath}`, normalizedPath);
       }
@@ -58495,7 +58550,7 @@ function isSecretPath(path2) {
   return name.endsWith(".private-key.pem") || name.endsWith(".private-key.key");
 }
 async function readPackageFile(file2) {
-  const bytes = await (0, import_promises.readFile)(file2.absolutePath);
+  const bytes = await (0, import_promises2.readFile)(file2.absolutePath);
   return {
     bytes,
     manifest: {
@@ -59622,7 +59677,7 @@ var LocalSkillSource = class {
   async scanRootAsPackage(resolvedRoot, ignoredPaths, mode) {
     const directory = resolvedRoot.directory;
     if (!await pathExists((0, import_node_path20.join)(directory, "SKILL.md"))) return null;
-    const canonicalRoot = await (0, import_promises2.realpath)(directory).catch(() => directory);
+    const canonicalRoot = await (0, import_promises3.realpath)(directory).catch(() => directory);
     const name = import_node_path20.default.basename(canonicalRoot);
     try {
       const fingerprint = await fingerprintPackage(canonicalRoot);
@@ -59671,7 +59726,7 @@ var LocalSkillSource = class {
     if (rootPackage) return rootPackage;
     let entries;
     try {
-      entries = await (0, import_promises2.readdir)(resolvedRoot.directory, { withFileTypes: true });
+      entries = await (0, import_promises3.readdir)(resolvedRoot.directory, { withFileTypes: true });
     } catch (error61) {
       if (isAbsentDirectory(error61)) return { candidates: [], diagnostics: [], incomplete: false };
       return {
@@ -59688,13 +59743,13 @@ var LocalSkillSource = class {
     }
     const candidates = [];
     const diagnostics = [];
-    const canonicalRoot = await (0, import_promises2.realpath)(resolvedRoot.directory).catch(
+    const canonicalRoot = await (0, import_promises3.realpath)(resolvedRoot.directory).catch(
       () => resolvedRoot.directory
     );
     for (const entry of entries) {
       if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
       const candidatePath = (0, import_node_path20.join)(resolvedRoot.directory, entry.name);
-      const canonicalPath = await (0, import_promises2.realpath)(candidatePath).catch(() => null);
+      const canonicalPath = await (0, import_promises3.realpath)(candidatePath).catch(() => null);
       if (!canonicalPath) {
         diagnostics.push({
           code: "SOURCE_UNREADABLE",
@@ -59755,12 +59810,12 @@ async function fingerprintPackage(root) {
   await visit2(root, "");
   return `sha256:${hash2.digest("hex")}`;
   async function visit2(directory, relativeDirectory) {
-    const entries = await (0, import_promises2.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises3.readdir)(directory, { withFileTypes: true });
     entries.sort((left, right) => import_node_buffer2.Buffer.compare(import_node_buffer2.Buffer.from(left.name), import_node_buffer2.Buffer.from(right.name)));
     for (const entry of entries) {
       const path2 = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
       const absolutePath = (0, import_node_path20.join)(directory, entry.name);
-      const metadata = await (0, import_promises2.lstat)(absolutePath);
+      const metadata = await (0, import_promises3.lstat)(absolutePath);
       hash2.update(path2.normalize("NFC")).update("\0").update(
         entry.isDirectory() ? "d" : entry.isFile() ? "f" : entry.isSymbolicLink() ? "l" : "o"
       ).update("\0").update(String(metadata.size)).update("\0").update(String(metadata.mtimeMs)).update("\0").update(String(metadata.mode & 511)).update("\0");
@@ -59779,7 +59834,7 @@ function staleCodexDeclaration(relativeDirectory, label, providerKinds) {
 }
 async function canonicalDirectories(directories) {
   const canonical = await Promise.all(
-    directories.map((directory) => (0, import_promises2.realpath)(directory).catch(() => directory))
+    directories.map((directory) => (0, import_promises3.realpath)(directory).catch(() => directory))
   );
   return [...new Set(canonical)];
 }
@@ -59790,10 +59845,10 @@ function isWithinDirectory(parent, candidate) {
 async function loadSkillSourceConfig(homeDirectory2) {
   const configDirectory = (0, import_node_path20.join)(homeDirectory2, ".alan");
   const configPath = (0, import_node_path20.join)(configDirectory, "config.toml");
-  await (0, import_promises2.mkdir)(configDirectory, { recursive: true, mode: 448 });
+  await (0, import_promises3.mkdir)(configDirectory, { recursive: true, mode: 448 });
   let created = false;
   try {
-    await (0, import_promises2.writeFile)(configPath, DEFAULT_SKILL_CONFIG, {
+    await (0, import_promises3.writeFile)(configPath, DEFAULT_SKILL_CONFIG, {
       encoding: "utf8",
       flag: "wx",
       mode: 384
@@ -59802,7 +59857,7 @@ async function loadSkillSourceConfig(homeDirectory2) {
   } catch (error61) {
     if (!isAlreadyPresent(error61)) throw error61;
   }
-  const content = await (0, import_promises2.readFile)(configPath, "utf8");
+  const content = await (0, import_promises3.readFile)(configPath, "utf8");
   try {
     return { state: "ready", config: parseSkillSourceConfig(content, homeDirectory2), created };
   } catch (error61) {
@@ -59988,7 +60043,7 @@ function deduplicateCandidatesByContent(candidates) {
 }
 async function pathExists(candidate) {
   try {
-    await (0, import_promises2.access)(candidate);
+    await (0, import_promises3.access)(candidate);
     return true;
   } catch {
     return false;
@@ -59996,7 +60051,7 @@ async function pathExists(candidate) {
 }
 async function hasManagedMarker(directory) {
   try {
-    await (0, import_promises2.access)((0, import_node_path20.join)(directory, ".alan-managed.json"));
+    await (0, import_promises3.access)((0, import_node_path20.join)(directory, ".alan-managed.json"));
     return true;
   } catch {
     return false;
@@ -60004,7 +60059,7 @@ async function hasManagedMarker(directory) {
 }
 async function isDirectory(path2) {
   try {
-    return (await (0, import_promises2.lstat)(path2)).isDirectory();
+    return (await (0, import_promises3.lstat)(path2)).isDirectory();
   } catch {
     return false;
   }
@@ -60175,12 +60230,12 @@ var RuntimeSkillCoordinator = class {
 // src/skills/runtime-skill-manager.ts
 var import_node_buffer5 = require("buffer");
 var import_node_crypto17 = require("crypto");
-var import_promises5 = require("fs/promises");
+var import_promises6 = require("fs/promises");
 var import_node_path23 = require("path");
 
 // src/skills/managed-skill-store.ts
 var import_node_crypto15 = require("crypto");
-var import_promises3 = require("fs/promises");
+var import_promises4 = require("fs/promises");
 var import_node_path21 = require("path");
 var EMPTY_STATE = {
   version: 1,
@@ -60198,9 +60253,9 @@ var ManagedSkillStore = class _ManagedSkillStore {
   integrity;
   canRemoveManagedFiles;
   static async open(baseDirectory) {
-    await (0, import_promises3.mkdir)(baseDirectory, { recursive: true, mode: 448 });
+    await (0, import_promises4.mkdir)(baseDirectory, { recursive: true, mode: 448 });
     try {
-      const parsed = JSON.parse(await (0, import_promises3.readFile)((0, import_node_path21.join)(baseDirectory, "state.json"), "utf8"));
+      const parsed = JSON.parse(await (0, import_promises4.readFile)((0, import_node_path21.join)(baseDirectory, "state.json"), "utf8"));
       return new _ManagedSkillStore(baseDirectory, parseState(parsed), "verified");
     } catch (error61) {
       if (isMissingPath(error61)) {
@@ -60266,15 +60321,15 @@ var ManagedSkillStore = class _ManagedSkillStore {
       `.state.json.pending-${process.pid}-${(0, import_node_crypto15.randomBytes)(6).toString("hex")}`
     );
     try {
-      await (0, import_promises3.writeFile)(pendingPath, `${JSON.stringify(this.state, null, 2)}
+      await (0, import_promises4.writeFile)(pendingPath, `${JSON.stringify(this.state, null, 2)}
 `, {
         encoding: "utf8",
         flag: "wx",
         mode: 384
       });
-      await (0, import_promises3.rename)(pendingPath, statePath);
+      await (0, import_promises4.rename)(pendingPath, statePath);
     } finally {
-      await (0, import_promises3.rm)(pendingPath, { force: true });
+      await (0, import_promises4.rm)(pendingPath, { force: true });
     }
   }
 };
@@ -60332,7 +60387,7 @@ function isMissingPath(error61) {
 // ../shared/dist/node/skill-bundle.js
 var import_node_buffer3 = require("buffer");
 var import_node_crypto16 = require("crypto");
-var import_promises4 = require("fs/promises");
+var import_promises5 = require("fs/promises");
 var import_node_path22 = require("path");
 var import_node_stream = require("stream");
 var import_node_zlib = require("zlib");
@@ -60342,7 +60397,7 @@ async function createSkillBundle(packageRoot, options = {}) {
   const archive = (0, import_tar_stream.pack)();
   const tarPromise = collectStream(archive);
   for (const file2 of before.files) {
-    const bytes2 = await (0, import_promises4.readFile)((0, import_node_path22.join)(packageRoot, ...file2.path.split("/")));
+    const bytes2 = await (0, import_promises5.readFile)((0, import_node_path22.join)(packageRoot, ...file2.path.split("/")));
     await addArchiveEntry(archive, {
       name: file2.path,
       type: "file",
@@ -60374,7 +60429,7 @@ async function extractSkillBundle(archiveBytes, destination, expected) {
     throw new Error("Skill archive hash does not match the expected immutable Version");
   }
   const tarBytes = await decompressBounded(archiveBytes);
-  await (0, import_promises4.mkdir)(destination, { recursive: false, mode: 448 });
+  await (0, import_promises5.mkdir)(destination, { recursive: false, mode: 448 });
   try {
     await extractTar(tarBytes, destination);
     const inspected = await inspectSkillPackage(destination, { expectedName: null });
@@ -60382,7 +60437,7 @@ async function extractSkillBundle(archiveBytes, destination, expected) {
       throw new Error("Extracted Skill package hash does not match the expected immutable Version");
     }
   } catch (error61) {
-    await (0, import_promises4.rm)(destination, { recursive: true, force: true });
+    await (0, import_promises5.rm)(destination, { recursive: true, force: true });
     throw error61;
   }
 }
@@ -60458,8 +60513,8 @@ async function extractEntry(header, stream, destination, limits) {
     throw new Error(`Skill archive file size is invalid: ${path2}`);
   }
   const outputPath = (0, import_node_path22.join)(destination, ...path2.split("/"));
-  await (0, import_promises4.mkdir)((0, import_node_path22.dirname)(outputPath), { recursive: true, mode: 448 });
-  await (0, import_promises4.writeFile)(outputPath, bytes, { mode: (header.mode ?? 420) & 73 ? 493 : 420 });
+  await (0, import_promises5.mkdir)((0, import_node_path22.dirname)(outputPath), { recursive: true, mode: 448 });
+  await (0, import_promises5.writeFile)(outputPath, bytes, { mode: (header.mode ?? 420) & 73 ? 493 : 420 });
 }
 function requireSafeArchivePath(value2) {
   const normalized = value2.replaceAll("\\", "/").normalize("NFC");
@@ -60719,12 +60774,12 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
   }
   async reconcileUnlocked(manifest) {
     const desired = desiredSkillManifestSchema.parse(manifest);
-    await (0, import_promises5.mkdir)(this.managedSkillsDirectory, { recursive: true, mode: 448 });
-    await (0, import_promises5.mkdir)((0, import_node_path23.join)(this.skillsStateDirectory, "cache", "sha256"), {
+    await (0, import_promises6.mkdir)(this.managedSkillsDirectory, { recursive: true, mode: 448 });
+    await (0, import_promises6.mkdir)((0, import_node_path23.join)(this.skillsStateDirectory, "cache", "sha256"), {
       recursive: true,
       mode: 448
     });
-    await (0, import_promises5.mkdir)((0, import_node_path23.join)(this.skillsStateDirectory, "tmp"), { recursive: true, mode: 448 });
+    await (0, import_promises6.mkdir)((0, import_node_path23.join)(this.skillsStateDirectory, "tmp"), { recursive: true, mode: 448 });
     const results = [];
     const nextProjections = {};
     for (const entry of desired.skills) {
@@ -60847,52 +60902,52 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     let sourceMoved = false;
     let destinationInstalled = false;
     try {
-      await (0, import_promises5.rename)(source, backup);
+      await (0, import_promises6.rename)(source, backup);
       sourceMoved = true;
-      await (0, import_promises5.cp)(backup, pending, { recursive: true, errorOnExist: true, force: false });
+      await (0, import_promises6.cp)(backup, pending, { recursive: true, errorOnExist: true, force: false });
       const skillMarkdown = (0, import_node_path23.join)(pending, "SKILL.md");
-      await (0, import_promises5.writeFile)(
+      await (0, import_promises6.writeFile)(
         skillMarkdown,
-        rewriteSkillMarkdownName(await (0, import_promises5.readFile)(skillMarkdown, "utf8"), name),
+        rewriteSkillMarkdownName(await (0, import_promises6.readFile)(skillMarkdown, "utf8"), name),
         {
           encoding: "utf8",
           mode: 420
         }
       );
       await inspectSkillPackage(pending, { expectedName: name });
-      await (0, import_promises5.rename)(pending, destination);
+      await (0, import_promises6.rename)(pending, destination);
       destinationInstalled = true;
-      await (0, import_promises5.rm)(backup, { recursive: true, force: true });
+      await (0, import_promises6.rm)(backup, { recursive: true, force: true });
     } catch (error61) {
-      if (destinationInstalled) await (0, import_promises5.rm)(destination, { recursive: true, force: true });
+      if (destinationInstalled) await (0, import_promises6.rm)(destination, { recursive: true, force: true });
       if (sourceMoved && await pathExists2(backup) && !await pathExists2(source)) {
-        await (0, import_promises5.rename)(backup, source);
+        await (0, import_promises6.rename)(backup, source);
       }
       throw error61;
     } finally {
-      await (0, import_promises5.rm)(pending, { recursive: true, force: true });
+      await (0, import_promises6.rm)(pending, { recursive: true, force: true });
       if (!sourceMoved || destinationInstalled) {
-        await (0, import_promises5.rm)(backup, { recursive: true, force: true });
+        await (0, import_promises6.rm)(backup, { recursive: true, force: true });
       }
     }
   }
   async overwriteLocalConflict(input2, entry, conflict, manifest) {
     const source = this.conflictDirectory(entry.runtimeDirectory, conflict.kind);
     const backup = `${source}.overwrite-backup-${process.pid}-${(0, import_node_crypto17.randomBytes)(8).toString("hex")}`;
-    await (0, import_promises5.rename)(source, backup);
+    await (0, import_promises6.rename)(source, backup);
     try {
       const reconciled = await this.reconcileUnlocked(manifest);
       const result = resolutionFromReconcile(input2, reconciled);
       if (result.state !== "applied") {
         await this.removeResolvedProjection(entry, conflict.kind);
-        await (0, import_promises5.rename)(backup, source);
+        await (0, import_promises6.rename)(backup, source);
         return result;
       }
-      await (0, import_promises5.rm)(backup, { recursive: true, force: true });
+      await (0, import_promises6.rm)(backup, { recursive: true, force: true });
       return result;
     } catch (error61) {
       await this.removeResolvedProjection(entry, conflict.kind).catch(() => void 0);
-      if (!await pathExists2(source) && await pathExists2(backup)) await (0, import_promises5.rename)(backup, source);
+      if (!await pathExists2(source) && await pathExists2(backup)) await (0, import_promises6.rename)(backup, source);
       throw error61;
     }
   }
@@ -60902,7 +60957,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     if (conflictKind === "managed_destination") {
       const marker = await readMarker(destination);
       if (marker?.skillId === entry.skillId && marker.versionId === entry.versionId && marker.contentHash === entry.contentHash) {
-        await (0, import_promises5.rm)(destination, { recursive: true, force: true });
+        await (0, import_promises6.rm)(destination, { recursive: true, force: true });
       }
       return;
     }
@@ -60934,16 +60989,16 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     if (!await legacyFileMatches(source, legacy.hash) || !await packageMatches(source, entry.contentHash)) {
       return;
     }
-    await (0, import_promises5.rename)(source, destination);
+    await (0, import_promises6.rename)(source, destination);
     try {
-      await (0, import_promises5.writeFile)(
+      await (0, import_promises6.writeFile)(
         (0, import_node_path23.join)(destination, ".alan-managed.json"),
         `${JSON.stringify(markerFor(entry), null, 2)}
 `,
         { encoding: "utf8", flag: "wx", mode: 384 }
       );
     } catch (error61) {
-      await (0, import_promises5.rename)(destination, source).catch(() => void 0);
+      await (0, import_promises6.rename)(destination, source).catch(() => void 0);
       throw error61;
     }
     await removeExactLegacySkill((0, import_node_path23.join)(this.compatibilitySkillsDirectory, entry.slug), legacy.hash);
@@ -60956,7 +61011,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
       await removeExactLegacySkill((0, import_node_path23.join)(this.managedSkillsDirectory, command), entry.hash);
       await removeExactLegacySkill((0, import_node_path23.join)(this.compatibilitySkillsDirectory, command), entry.hash);
     }
-    await (0, import_promises5.rm)(this.legacyManifestPath, { force: true });
+    await (0, import_promises6.rm)(this.legacyManifestPath, { force: true });
   }
   async ensureCached(entry) {
     const cacheDirectory = (0, import_node_path23.join)(
@@ -60966,7 +61021,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
       entry.contentHash.slice("sha256:".length)
     );
     if (await packageMatches(cacheDirectory, entry.contentHash)) return cacheDirectory;
-    await (0, import_promises5.rm)(cacheDirectory, { recursive: true, force: true });
+    await (0, import_promises6.rm)(cacheDirectory, { recursive: true, force: true });
     const bytes = await this.downloadBundle(entry);
     if (bytes.byteLength !== entry.compressedBytes) {
       throw new Error(
@@ -60984,12 +61039,12 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
         expectedContentHash: entry.contentHash
       });
       try {
-        await (0, import_promises5.rename)(pendingDirectory, cacheDirectory);
+        await (0, import_promises6.rename)(pendingDirectory, cacheDirectory);
       } catch (error61) {
         if (!await packageMatches(cacheDirectory, entry.contentHash)) throw error61;
       }
     } finally {
-      await (0, import_promises5.rm)(pendingDirectory, { recursive: true, force: true });
+      await (0, import_promises6.rm)(pendingDirectory, { recursive: true, force: true });
     }
     return cacheDirectory;
   }
@@ -61007,8 +61062,8 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     let installedPending = false;
     let completed = false;
     try {
-      await (0, import_promises5.cp)(cacheDirectory, pending, { recursive: true, errorOnExist: true, force: false });
-      await (0, import_promises5.writeFile)(
+      await (0, import_promises6.cp)(cacheDirectory, pending, { recursive: true, errorOnExist: true, force: false });
+      await (0, import_promises6.writeFile)(
         (0, import_node_path23.join)(pending, ".alan-managed.json"),
         `${JSON.stringify(markerFor(entry), null, 2)}
 `,
@@ -61018,14 +61073,14 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
         throw new Error("Pending managed Skill projection failed content verification");
       }
       if (await pathExists2(destination)) {
-        await (0, import_promises5.rename)(destination, backup);
+        await (0, import_promises6.rename)(destination, backup);
         movedExisting = true;
       }
       try {
-        await (0, import_promises5.rename)(pending, destination);
+        await (0, import_promises6.rename)(pending, destination);
         installedPending = true;
       } catch (error61) {
-        if (movedExisting) await (0, import_promises5.rename)(backup, destination);
+        if (movedExisting) await (0, import_promises6.rename)(backup, destination);
         throw error61;
       }
       const inspected = await inspectSkillPackage(destination, { expectedName: null });
@@ -61034,18 +61089,18 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
       }
       await this.ensureCompatibilityProjection(entry, destination);
       completed = true;
-      await (0, import_promises5.rm)(backup, { recursive: true, force: true });
+      await (0, import_promises6.rm)(backup, { recursive: true, force: true });
       return inspected.contentHash;
     } catch (error61) {
       if (!completed && installedPending) {
-        await (0, import_promises5.rm)(destination, { recursive: true, force: true });
-        if (movedExisting && await pathExists2(backup)) await (0, import_promises5.rename)(backup, destination);
+        await (0, import_promises6.rm)(destination, { recursive: true, force: true });
+        if (movedExisting && await pathExists2(backup)) await (0, import_promises6.rename)(backup, destination);
       }
       throw error61;
     } finally {
-      await (0, import_promises5.rm)(pending, { recursive: true, force: true });
+      await (0, import_promises6.rm)(pending, { recursive: true, force: true });
       if (completed || !movedExisting) {
-        await (0, import_promises5.rm)(backup, { recursive: true, force: true });
+        await (0, import_promises6.rm)(backup, { recursive: true, force: true });
       }
     }
   }
@@ -61086,7 +61141,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
           });
           continue;
         }
-        await (0, import_promises5.rm)(destination, { recursive: true, force: true });
+        await (0, import_promises6.rm)(destination, { recursive: true, force: true });
       } else {
         failures.push({
           skillId: recorded.skillId,
@@ -61101,7 +61156,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     return failures;
   }
   async ensureCompatibilityProjection(entry, canonicalDirectory) {
-    await (0, import_promises5.mkdir)(this.compatibilitySkillsDirectory, { recursive: true, mode: 448 });
+    await (0, import_promises6.mkdir)(this.compatibilitySkillsDirectory, { recursive: true, mode: 448 });
     const destination = (0, import_node_path23.join)(
       this.compatibilitySkillsDirectory,
       this.projectionDirectoryName(entry.runtimeDirectory)
@@ -61111,23 +61166,23 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
       throw unmanagedCompatibilityConflict(entry.runtimeDirectory);
     }
     try {
-      await (0, import_promises5.symlink)(canonicalDirectory, destination, "dir");
+      await (0, import_promises6.symlink)(canonicalDirectory, destination, "dir");
       return;
     } catch (error61) {
       if (!isSymlinkUnsupported(error61)) throw error61;
     }
     const pending = `${destination}.pending-${process.pid}-${(0, import_node_crypto17.randomBytes)(6).toString("hex")}`;
     try {
-      await (0, import_promises5.cp)(canonicalDirectory, pending, { recursive: true, errorOnExist: true, force: false });
-      await (0, import_promises5.writeFile)(
+      await (0, import_promises6.cp)(canonicalDirectory, pending, { recursive: true, errorOnExist: true, force: false });
+      await (0, import_promises6.writeFile)(
         (0, import_node_path23.join)(pending, ".alan-compatibility.json"),
         `${JSON.stringify({ ...markerFor(entry), canonicalDirectory }, null, 2)}
 `,
         { encoding: "utf8", flag: "wx", mode: 384 }
       );
-      await (0, import_promises5.rename)(pending, destination);
+      await (0, import_promises6.rename)(pending, destination);
     } finally {
-      await (0, import_promises5.rm)(pending, { recursive: true, force: true });
+      await (0, import_promises6.rm)(pending, { recursive: true, force: true });
     }
   }
   async runExclusively(work) {
@@ -61151,29 +61206,29 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     return this.storageNamespace ? `${runtimeDirectory}--alan-${this.storageNamespace}` : runtimeDirectory;
   }
   async withMachineLock(work) {
-    await (0, import_promises5.mkdir)(this.skillsStateDirectory, { recursive: true, mode: 448 });
+    await (0, import_promises6.mkdir)(this.skillsStateDirectory, { recursive: true, mode: 448 });
     const lockDirectory = (0, import_node_path23.join)(this.skillsStateDirectory, "manager.lock");
     const deadline = Date.now() + 3e4;
     while (true) {
       try {
-        await (0, import_promises5.mkdir)(lockDirectory, { mode: 448 });
+        await (0, import_promises6.mkdir)(lockDirectory, { mode: 448 });
         try {
-          await (0, import_promises5.writeFile)(
+          await (0, import_promises6.writeFile)(
             (0, import_node_path23.join)(lockDirectory, "owner.json"),
             `${JSON.stringify({ pid: process.pid, acquiredAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
             { encoding: "utf8", flag: "wx", mode: 384 }
           );
         } catch (error61) {
-          await (0, import_promises5.rm)(lockDirectory, { recursive: true, force: true });
+          await (0, import_promises6.rm)(lockDirectory, { recursive: true, force: true });
           throw error61;
         }
         break;
       } catch (error61) {
         if (!isAlreadyPresent2(error61)) throw error61;
-        const ageMs = await (0, import_promises5.stat)(lockDirectory).then((metadata) => Date.now() - metadata.mtimeMs).catch(() => 0);
+        const ageMs = await (0, import_promises6.stat)(lockDirectory).then((metadata) => Date.now() - metadata.mtimeMs).catch(() => 0);
         if (ageMs > 15 * 6e4) {
-          await (0, import_promises5.rm)(lockDirectory, { recursive: true, force: true });
+          await (0, import_promises6.rm)(lockDirectory, { recursive: true, force: true });
           continue;
         }
         if (Date.now() >= deadline) {
@@ -61187,7 +61242,7 @@ var RuntimeSkillManager = class _RuntimeSkillManager {
     try {
       return await work();
     } finally {
-      await (0, import_promises5.rm)(lockDirectory, { recursive: true, force: true });
+      await (0, import_promises6.rm)(lockDirectory, { recursive: true, force: true });
     }
   }
 };
@@ -61209,7 +61264,7 @@ async function packageMatches(directory, expectedHash) {
 async function readMarker(directory) {
   try {
     const value2 = JSON.parse(
-      await (0, import_promises5.readFile)((0, import_node_path23.join)(directory, ".alan-managed.json"), "utf8")
+      await (0, import_promises6.readFile)((0, import_node_path23.join)(directory, ".alan-managed.json"), "utf8")
     );
     if (typeof value2 !== "object" || value2 === null || !("protocolVersion" in value2) || value2.protocolVersion !== SKILLS_PROTOCOL_VERSION || !("skillId" in value2) || typeof value2.skillId !== "string" || !("versionId" in value2) || typeof value2.versionId !== "string" || !("contentHash" in value2) || typeof value2.contentHash !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value2.contentHash)) {
       return null;
@@ -61220,9 +61275,9 @@ async function readMarker(directory) {
   }
 }
 async function compatibilityProjectionMatches(destination, canonicalDirectory, entry) {
-  const metadata = await (0, import_promises5.lstat)(destination);
+  const metadata = await (0, import_promises6.lstat)(destination);
   if (metadata.isSymbolicLink()) {
-    const target = await (0, import_promises5.readlink)(destination);
+    const target = await (0, import_promises6.readlink)(destination);
     return (0, import_node_path23.resolve)((0, import_node_path23.dirname)(destination), target) === (0, import_node_path23.resolve)(canonicalDirectory);
   }
   if (!metadata.isDirectory()) return false;
@@ -61231,22 +61286,22 @@ async function compatibilityProjectionMatches(destination, canonicalDirectory, e
 }
 async function removeCompatibilityProjection(destination, canonicalDirectory, projection) {
   if (!await pathExists2(destination)) return true;
-  const metadata = await (0, import_promises5.lstat)(destination);
+  const metadata = await (0, import_promises6.lstat)(destination);
   if (metadata.isSymbolicLink()) {
-    const target = await (0, import_promises5.readlink)(destination);
+    const target = await (0, import_promises6.readlink)(destination);
     if ((0, import_node_path23.resolve)((0, import_node_path23.dirname)(destination), target) !== (0, import_node_path23.resolve)(canonicalDirectory)) return false;
-    await (0, import_promises5.rm)(destination, { force: true });
+    await (0, import_promises6.rm)(destination, { force: true });
     return true;
   }
   const marker = await readCompatibilityMarker(destination);
   if (!marker || !markerMatchesProjection(marker, projection)) return false;
-  await (0, import_promises5.rm)(destination, { recursive: true, force: true });
+  await (0, import_promises6.rm)(destination, { recursive: true, force: true });
   return true;
 }
 async function readCompatibilityMarker(directory) {
   try {
     const value2 = JSON.parse(
-      await (0, import_promises5.readFile)((0, import_node_path23.join)(directory, ".alan-compatibility.json"), "utf8")
+      await (0, import_promises6.readFile)((0, import_node_path23.join)(directory, ".alan-compatibility.json"), "utf8")
     );
     if (value2.protocolVersion !== SKILLS_PROTOCOL_VERSION || typeof value2.skillId !== "string" || typeof value2.versionId !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value2.contentHash) || typeof value2.canonicalDirectory !== "string") {
       return null;
@@ -61266,7 +61321,7 @@ function markerFor(entry) {
 }
 async function readLegacyManifest(path2) {
   try {
-    const value2 = JSON.parse(await (0, import_promises5.readFile)(path2, "utf8"));
+    const value2 = JSON.parse(await (0, import_promises6.readFile)(path2, "utf8"));
     if (!value2 || typeof value2 !== "object" || !("skills" in value2)) return null;
     const skillsValue = value2.skills;
     if (!skillsValue || typeof skillsValue !== "object" || Array.isArray(skillsValue)) return null;
@@ -61284,9 +61339,9 @@ async function readLegacyManifest(path2) {
 }
 async function legacyFileMatches(directory, expectedHash) {
   try {
-    const metadata = await (0, import_promises5.lstat)(directory);
+    const metadata = await (0, import_promises6.lstat)(directory);
     if (!metadata.isDirectory() || metadata.isSymbolicLink()) return false;
-    const content = await (0, import_promises5.readFile)((0, import_node_path23.join)(directory, "SKILL.md"));
+    const content = await (0, import_promises6.readFile)((0, import_node_path23.join)(directory, "SKILL.md"));
     return (0, import_node_crypto17.createHash)("sha256").update(content).digest("hex").slice(0, 16) === expectedHash;
   } catch {
     return false;
@@ -61294,9 +61349,9 @@ async function legacyFileMatches(directory, expectedHash) {
 }
 async function removeExactLegacySkill(directory, expectedHash) {
   if (!await legacyFileMatches(directory, expectedHash)) return;
-  await (0, import_promises5.rm)((0, import_node_path23.join)(directory, "SKILL.md"), { force: true });
-  const remaining = await (0, import_promises5.readdir)(directory);
-  if (remaining.length === 0) await (0, import_promises5.rm)(directory, { recursive: true, force: true });
+  await (0, import_promises6.rm)((0, import_node_path23.join)(directory, "SKILL.md"), { force: true });
+  const remaining = await (0, import_promises6.readdir)(directory);
+  if (remaining.length === 0) await (0, import_promises6.rm)(directory, { recursive: true, force: true });
 }
 function markerMatchesProjection(marker, projection) {
   return marker.skillId === projection.skillId && marker.versionId === projection.versionId && marker.contentHash === projection.contentHash;
@@ -61389,7 +61444,7 @@ function localTextMediaType(path2) {
 }
 async function pathExists2(path2) {
   try {
-    await (0, import_promises5.lstat)(path2);
+    await (0, import_promises6.lstat)(path2);
     return true;
   } catch (error61) {
     if (isMissingPath2(error61)) return false;
@@ -61479,6 +61534,12 @@ var SuspensionDetector = class {
 };
 
 // src/daemon-start.ts
+var RUNTIME_TOKEN_RENEWAL_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function runtimeTokenNeedsRenewal(expiresAt, nowMs = Date.now()) {
+  if (!expiresAt) return true;
+  const expiresAtMs = Date.parse(expiresAt);
+  return !Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs + RUNTIME_TOKEN_RENEWAL_WINDOW_MS;
+}
 async function startDaemon(args) {
   bindConfigPath(args);
   const stored = readConfig();
@@ -61491,6 +61552,7 @@ async function startDaemon(args) {
   const runtimeTokenOverride = argValue(args, "--token") ?? process.env.ALAN_RUNTIME_TOKEN;
   let runtimeToken = runtimeTokenOverride ?? stored.runtimeToken;
   let runtimeRenewalToken = runtimeTokenOverride ? void 0 : stored.runtimeRenewalToken;
+  let runtimeTokenExpiresAt = runtimeTokenOverride ? void 0 : stored.runtimeTokenExpiresAt;
   const wsUrlOverride = argValue(args, "--ws-url") ?? process.env.ALAN_WS_URL;
   const endpointMismatch = wsUrlOverride ? null : checkStoredEndpointConsistency(stored, readEndpointDefaults());
   let wsUrl = wsUrlOverride ?? stored.wsUrl;
@@ -61835,14 +61897,14 @@ async function startDaemon(args) {
     if (runtimeRenewalInFlight) return runtimeRenewalInFlight;
     const attempt = runCredentialOperation(async () => {
       const renewalToken = runtimeRenewalToken;
-      if (!stored.apiUrl || !renewalToken) {
+      if (!renewalToken) {
         return false;
       }
       let response = null;
       let transportError = null;
       for (let retry = 1; retry <= 3; retry += 1) {
         try {
-          response = await fetch(`${stored.apiUrl}/public/runtimes/${runtimeId}/tokens/renew`, {
+          response = await fetch(`${apiUrl}/public/runtimes/${runtimeId}/tokens/renew`, {
             method: "POST",
             headers: {
               authorization: `Bearer ${renewalToken}`,
@@ -61874,7 +61936,7 @@ async function startDaemon(args) {
         return false;
       }
       const body = await response.json();
-      if (typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_")) {
+      if (typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_") || typeof body.runtimeTokenExpiresAt !== "string" || !Number.isFinite(Date.parse(body.runtimeTokenExpiresAt))) {
         rememberConnectErrorCode("runtime_renewal_failed");
         lastConnectError = "Runtime renewal returned an invalid access token";
         pushLog("runtime-renewal-invalid-response");
@@ -61887,8 +61949,13 @@ async function startDaemon(args) {
         pushLog("runtime-renewal-superseded");
         return false;
       }
+      const replacementExpiresAt = body.runtimeTokenExpiresAt;
       try {
-        writeConfig({ ...current, runtimeToken: body.runtimeToken });
+        writeConfig({
+          ...current,
+          runtimeToken: body.runtimeToken,
+          runtimeTokenExpiresAt: replacementExpiresAt
+        });
       } catch (error61) {
         rememberConnectErrorCode("config_write_failed");
         lastConnectError = `Runtime renewal could not save its replacement: ${error61.message}`;
@@ -61896,6 +61963,7 @@ async function startDaemon(args) {
         return false;
       }
       runtimeToken = body.runtimeToken;
+      runtimeTokenExpiresAt = replacementExpiresAt;
       socket.auth = { token: body.runtimeToken };
       clearConnectErrors();
       pushLog("runtime-renewal-succeeded");
@@ -61909,6 +61977,14 @@ async function startDaemon(args) {
     });
     return attempt;
   };
+  const ensureRuntimeTokenForLaunch = () => {
+    if (!runtimeRenewalToken || !runtimeTokenNeedsRenewal(runtimeTokenExpiresAt)) return true;
+    return renewRuntimeLease().then((renewed) => {
+      if (renewed) return true;
+      if (!runtimeTokenExpiresAt) return socket.connected;
+      return Date.parse(runtimeTokenExpiresAt) > Date.now();
+    });
+  };
   let queueIdentityRestart = () => {
   };
   let runtimeSetupInFlight = null;
@@ -61935,6 +62011,7 @@ async function startDaemon(args) {
           runtimeId: bundle.runtimeId,
           runtimeToken: bundle.runtimeToken,
           runtimeRenewalToken: bundle.runtimeRenewalToken,
+          runtimeTokenExpiresAt: bundle.runtimeTokenExpiresAt,
           displayName: bundle.displayName
         });
         clearPendingSetupIntent();
@@ -61952,11 +62029,13 @@ async function startDaemon(args) {
         ...current,
         runtimeToken: bundle.runtimeToken,
         runtimeRenewalToken: bundle.runtimeRenewalToken,
+        runtimeTokenExpiresAt: bundle.runtimeTokenExpiresAt,
         displayName: bundle.displayName
       });
       clearPendingSetupIntent();
       runtimeToken = bundle.runtimeToken;
       runtimeRenewalToken = bundle.runtimeRenewalToken;
+      runtimeTokenExpiresAt = bundle.runtimeTokenExpiresAt;
       socket.auth = { token: bundle.runtimeToken };
       clearConnectErrors();
       const ready = new Promise((resolveReady, rejectReady) => {
@@ -62272,6 +62351,7 @@ async function startDaemon(args) {
         runtimeId,
         runtimeSkillManager,
         getRuntimeToken: () => runtimeToken,
+        ensureRuntimeTokenForLaunch,
         eventOutbox,
         daemonSessionId,
         daemonEpoch,
@@ -62725,6 +62805,7 @@ async function setupDaemon(args, options = {}) {
     runtimeId: body.runtimeId,
     runtimeToken: body.runtimeToken,
     runtimeRenewalToken: body.runtimeRenewalToken,
+    runtimeTokenExpiresAt: body.runtimeTokenExpiresAt,
     displayName: body.displayName,
     installationId
   });
@@ -62829,6 +62910,7 @@ async function loginWithDeviceCode(args) {
         runtimeId: body.runtime.id,
         runtimeToken: body.runtimeToken,
         runtimeRenewalToken: body.runtimeRenewalToken,
+        runtimeTokenExpiresAt: body.runtimeTokenExpiresAt,
         displayName: body.runtime.displayName ?? displayName,
         installationId
       });
@@ -63046,7 +63128,8 @@ async function rotateRuntimeToken(args) {
     apiUrl,
     runtimeId,
     runtimeToken: body.runtimeToken,
-    runtimeRenewalToken: body.runtimeRenewalToken
+    runtimeRenewalToken: body.runtimeRenewalToken,
+    runtimeTokenExpiresAt: body.runtimeTokenExpiresAt
   });
   console.info("[alan-agent] Runtime token rotated", { runtimeId });
 }
@@ -63174,7 +63257,7 @@ async function printDoctor(args = []) {
 }
 
 // src/install-command.ts
-var import_promises6 = require("timers/promises");
+var import_promises7 = require("timers/promises");
 
 // src/mcp-config-adapters.ts
 var import_node_crypto20 = require("crypto");
@@ -63347,10 +63430,7 @@ var cursorAdapter = {
         mcpServers[s.name] = {
           type: "http",
           url: s.url,
-          headers: s.name === "alan" ? {
-            "x-alan-agent-credential": `\${env:ALAN_AGENT_CREDENTIAL}`,
-            "x-alan-run-id": `\${env:ALAN_RUN_ID}`
-          } : s.headers
+          headers: s.headers
         };
       } else {
         mcpServers[s.name] = {
@@ -63583,7 +63663,6 @@ var ALAN_SESSION_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-team-id",
   "x-allowed-tools",
   "x-alan-run-reference",
-  "x-alan-agent-credential",
   "x-alan-run-id"
 ]);
 function normalizeAlanSessionHeaders(actual, expected) {
@@ -63901,11 +63980,7 @@ function buildAlanMcpServers(apiUrl) {
   return {
     alan: {
       type: "http",
-      url: new URL("/mcp", apiUrl).toString(),
-      headers: {
-        "x-alan-agent-credential": `\${ALAN_AGENT_CREDENTIAL}`,
-        "x-alan-run-id": `\${ALAN_RUN_ID}`
-      }
+      url: new URL("/mcp", apiUrl).toString()
     }
   };
 }
@@ -65497,7 +65572,7 @@ async function setupWindowsRuntime(commandArgs) {
       throw new Error("Windows runtime setup completed without a local readiness endpoint");
     }
     const probe = () => probeLocalDaemon(localApiPort, localApiToken, Math.min(250, remainingMs()));
-    const poll = () => (0, import_promises6.setTimeout)(Math.min(100, remainingMs()), void 0, { signal: controller.signal });
+    const poll = () => (0, import_promises7.setTimeout)(Math.min(100, remainingMs()), void 0, { signal: controller.signal });
     if (runtimeIdentityChanged) {
       while (true) {
         const status = await probe();
@@ -66842,7 +66917,7 @@ function cgroupDirectory(text) {
 }
 async function collectAgentResourceDiagnostics(options = {}) {
   const platform6 = options.platform ?? process.platform;
-  const readFile7 = async (path2) => {
+  const readFile8 = async (path2) => {
     try {
       return await (options.readFile ?? readResourceFile)(path2);
     } catch {
@@ -66859,11 +66934,11 @@ async function collectAgentResourceDiagnostics(options = {}) {
   };
   if (platform6 !== "linux") return sample;
   const [meminfo, memoryPsi, cpuPsi, ioPsi, cgroup] = await Promise.all([
-    readFile7("/proc/meminfo"),
-    readFile7("/proc/pressure/memory"),
-    readFile7("/proc/pressure/cpu"),
-    readFile7("/proc/pressure/io"),
-    readFile7("/proc/self/cgroup")
+    readFile8("/proc/meminfo"),
+    readFile8("/proc/pressure/memory"),
+    readFile8("/proc/pressure/cpu"),
+    readFile8("/proc/pressure/io"),
+    readFile8("/proc/self/cgroup")
   ]);
   sample.memoryAvailableBytes = meminfoBytes(meminfo, "MemAvailable");
   sample.swapTotalBytes = meminfoBytes(meminfo, "SwapTotal");
@@ -66875,9 +66950,9 @@ async function collectAgentResourceDiagnostics(options = {}) {
   const directory = cgroupDirectory(cgroup);
   if (!directory) return sample;
   const [current, limit, events] = await Promise.all([
-    readFile7(`${directory}/memory.current`),
-    readFile7(`${directory}/memory.max`),
-    readFile7(`${directory}/memory.events`)
+    readFile8(`${directory}/memory.current`),
+    readFile8(`${directory}/memory.max`),
+    readFile8(`${directory}/memory.events`)
   ]);
   sample.cgroupMemoryCurrentBytes = counter(current?.trim());
   sample.cgroupMemoryLimitBytes = counter(limit?.trim());
@@ -67661,7 +67736,7 @@ async function runSandbox(config2) {
       const agent = new CoreAgent(presenter, {
         backendKind: activeBackendKind,
         runId: activeRunId,
-        agentCredential: config2.sessionToken,
+        runtimeToken: config2.sessionToken,
         providerApiKey: activeProviderApiKey
       });
       currentAgent = agent;
@@ -67710,7 +67785,7 @@ async function runSandbox(config2) {
         }
         const alanMcp = buildManagedAlanMcp({
           apiUrl: config2.apiUrl,
-          agentCredential: config2.sessionToken,
+          runtimeToken: config2.sessionToken,
           runId: activeRunId
         });
         const preparedTask = await prepareSkillInvocationTask({
@@ -67886,7 +67961,7 @@ async function runSandbox(config2) {
 }
 
 // src/skills/skill-cli.ts
-var import_promises7 = require("fs/promises");
+var import_promises8 = require("fs/promises");
 var import_node_os20 = require("os");
 var import_node_path31 = require("path");
 async function runSkillsCommand(args) {
@@ -67933,7 +68008,7 @@ async function defaultScanInput(homeDirectory2) {
 }
 async function readProtectedJson(path2) {
   const absolutePath = (0, import_node_path31.resolve)(path2);
-  const stat2 = await (0, import_promises7.lstat)(absolutePath);
+  const stat2 = await (0, import_promises8.lstat)(absolutePath);
   if (!stat2.isFile()) throw new Error(`Skill input is not a regular file: ${absolutePath}`);
   if (process.platform !== "win32" && (stat2.mode & 63) !== 0) {
     throw new Error(`Skill input must not be accessible by group or other users: ${absolutePath}`);
@@ -67942,7 +68017,7 @@ async function readProtectedJson(path2) {
     throw new Error(`Skill input must be owned by the current user: ${absolutePath}`);
   }
   if (stat2.size > 2 * 1024 * 1024) throw new Error("Skill input exceeds 2 MiB");
-  return JSON.parse(await (0, import_promises7.readFile)(absolutePath, "utf8"));
+  return JSON.parse(await (0, import_promises8.readFile)(absolutePath, "utf8"));
 }
 function option(args, name) {
   const index = args.indexOf(name);