@alook/cli 0.0.15 → 0.0.17

package/dist/index.js

@@ -297,14 +297,30 @@ function statusCommand() {
 // commands/daemon.ts
 import { Command as Command3 } from "commander";
 import { spawn as spawn3 } from "child_process";
-import { openSync as openSync2, closeSync as closeSync2, mkdirSync as mkdirSync4 } from "fs";
+import { openSync as openSync2, closeSync as closeSync2, mkdirSync as mkdirSync6 } from "fs";
 import { dirname as dirname4 } from "path";
 
 // ../shared/src/constants.ts
+var TaskStatus = {
+  QUEUED: "queued",
+  DISPATCHED: "dispatched",
+  RUNNING: "running",
+  COMPLETED: "completed",
+  FAILED: "failed",
+  CANCELLED: "cancelled",
+  SUPERSEDED: "superseded"
+};
+var TERMINAL_TASK_STATUSES = [
+  TaskStatus.COMPLETED,
+  TaskStatus.FAILED,
+  TaskStatus.CANCELLED,
+  TaskStatus.SUPERSEDED
+];
 var TASK_TYPES = {
   USER_DM_MESSAGE: "user_dm_message",
   EMAIL_NOTIFICATION: "email_notification",
-  CALENDAR_EVENT: "calendar_event"
+  CALENDAR_EVENT: "calendar_event",
+  KILL_TASK: "kill_task"
 };
 var POLL_INTERVAL_MS = Number(process.env.POLL_INTERVAL_MS) || 3000;
 var OFFLINE_THRESHOLD_MS = Number(process.env.OFFLINE_THRESHOLD_MS) || 9000;
@@ -13851,7 +13867,8 @@ var TaskStatusSchema = exports_external.enum([
   "running",
   "completed",
   "failed",
-  "cancelled"
+  "cancelled",
+  "superseded"
 ]);
 var ClaimedTaskRowSchema = exports_external.object({
   id: exports_external.string(),
@@ -14032,8 +14049,9 @@ var UpdateAgentRequestSchema = exports_external.object({
   description: exports_external.string().optional(),
   instructions: exports_external.string().optional(),
   runtime_id: exports_external.string().min(1).optional(),
-  runtime_config: RuntimeConfigSchema
-}).refine((v) => v.name !== undefined || v.description !== undefined || v.instructions !== undefined || v.runtime_id !== undefined || v.runtime_config !== undefined, { message: "at least one field is required" });
+  runtime_config: RuntimeConfigSchema,
+  visibility: exports_external.enum(["public", "private"]).optional()
+}).refine((v) => v.name !== undefined || v.description !== undefined || v.instructions !== undefined || v.runtime_id !== undefined || v.runtime_config !== undefined || v.visibility !== undefined, { message: "at least one field is required" });
 var CreateConversationRequestSchema = exports_external.object({
   agent_id: exports_external.string().min(1, "agent_id is required")
 });
@@ -14125,6 +14143,16 @@ var CreateWorkspaceRequestSchema = exports_external.object({
   name: exports_external.string().min(1, "name is required"),
   slug: exports_external.string().min(1, "slug is required")
 });
+var UpdateWorkspaceRequestSchema = exports_external.object({
+  name: exports_external.string().min(1, "name is required").max(100).trim().optional(),
+  slug: exports_external.string().min(1, "slug is required").max(100).trim().toLowerCase().optional()
+});
+var DeleteWorkspaceRequestSchema = exports_external.object({
+  confirm_name: exports_external.string().min(1, "confirm_name is required")
+});
+var GrantAgentAccessRequestSchema = exports_external.object({
+  user_id: exports_external.string().min(1, "user_id is required")
+});
 // ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@4.20260418.1_@opentelemetry+api@1.9.1_bun-types@1.3.12_kysely@0.28.16/node_modules/drizzle-orm/entity.js
 var entityKind = Symbol.for("drizzle:entityKind");
 var hasOwnEntityKind = Symbol.for("drizzle:hasOwnEntityKind");
@@ -15556,6 +15584,48 @@ var member = sqliteTable("member", {
   globalInstruction: text("global_instruction").notNull().default(""),
   createdAt: text("created_at").notNull().$defaultFn(() => new Date().toISOString())
 }, (t) => [unique("member_workspace_user").on(t.workspaceId, t.userId)]);
+var workspaceInvite = sqliteTable("workspace_invite", {
+  id: text("id").primaryKey().$defaultFn(() => "inv_" + nanoid3()),
+  workspaceId: text("workspace_id").notNull().references(() => workspace.id, { onDelete: "cascade" }),
+  token: text("token").unique().notNull().$defaultFn(() => nanoid3(32)),
+  createdBy: text("created_by").notNull().references(() => user.id, { onDelete: "cascade" }),
+  usedBy: text("used_by").references(() => user.id, { onDelete: "set null" }),
+  usedAt: text("used_at"),
+  expiresAt: text("expires_at").notNull(),
+  createdAt: text("created_at").notNull().$defaultFn(() => new Date().toISOString())
+}, (t) => [
+  index("idx_workspace_invite_token").on(t.token),
+  index("idx_workspace_invite_workspace").on(t.workspaceId)
+]);
+var agentAccess = sqliteTable("agent_access", {
+  id: text("id").primaryKey().$defaultFn(() => nanoid3()),
+  agentId: text("agent_id").notNull(),
+  workspaceId: text("workspace_id").notNull(),
+  userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+  createdAt: text("created_at").notNull().$defaultFn(() => new Date().toISOString())
+}, (t) => [
+  unique("agent_access_agent_ws_user").on(t.agentId, t.workspaceId, t.userId),
+  index("idx_agent_access_agent_ws").on(t.agentId, t.workspaceId),
+  index("idx_agent_access_user").on(t.userId),
+  foreignKey({
+    columns: [t.agentId, t.workspaceId],
+    foreignColumns: [agent.id, agent.workspaceId]
+  }).onDelete("cascade")
+]);
+var agentPin = sqliteTable("agent_pin", {
+  id: text("id").primaryKey().$defaultFn(() => nanoid3()),
+  agentId: text("agent_id").notNull(),
+  workspaceId: text("workspace_id").notNull(),
+  userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+  createdAt: text("created_at").notNull().$defaultFn(() => new Date().toISOString())
+}, (t) => [
+  unique("agent_pin_agent_ws_user").on(t.agentId, t.workspaceId, t.userId),
+  index("idx_agent_pin_ws_user").on(t.workspaceId, t.userId),
+  foreignKey({
+    columns: [t.agentId, t.workspaceId],
+    foreignColumns: [agent.id, agent.workspaceId]
+  }).onDelete("cascade")
+]);
 var machine = sqliteTable("machine", {
   daemonId: text("daemon_id").notNull(),
   workspaceId: text("workspace_id").notNull().references(() => workspace.id, { onDelete: "cascade" }),
@@ -15693,6 +15763,7 @@ var emails = sqliteTable("emails", {
   htmlBody: text("html_body").notNull().default(""),
   attachments: text("attachments").notNull().default("[]"),
   status: text("status").notNull().default("unread"),
+  direction: text("direction").notNull().default("inbound"),
   createdAt: text("created_at").notNull().$defaultFn(() => new Date().toISOString())
 }, (t) => [
   foreignKey({
@@ -15782,6 +15853,7 @@ var machineToken = sqliteTable("machine_token", {
 }, (t) => [index("idx_machine_token").on(t.token)]);
 // ../shared/src/db/queries/task.ts
 var DEFAULT_STALE_SECONDS = Number(process.env.ALOOK_STALE_DISPATCH_TIMEOUT_S) || 20;
+var DEFAULT_STALE_RUNNING_SECONDS = Number(process.env.ALOOK_STALE_RUNNING_TIMEOUT_S) || 3600;
 // ../shared/src/utils/email.ts
 var DOMAIN = `@${process.env.ALOOK_DOMAIN || "alook.ai"}`;
 var RESERVED_HANDLES = new Set([
@@ -15883,6 +15955,9 @@ class DaemonClient {
       error: error48
     });
   }
+  supersedeTask(token, taskId) {
+    return this.request("POST", `/api/daemon/tasks/${taskId}/supersede`, token);
+  }
   async getArtifactMeta(token, artifactId, workspaceId) {
     return this.request("GET", `/api/artifacts/${artifactId}?workspace_id=${encodeURIComponent(workspaceId)}`, token);
   }
@@ -16010,6 +16085,7 @@ function loadDaemonConfig(profile) {
     opencodeModel: process.env.ALOOK_OPENCODE_MODEL || "",
     pollInterval: parseDuration(process.env.ALOOK_DAEMON_POLL_INTERVAL || "3s"),
     agentTimeout: parseDuration(process.env.ALOOK_AGENT_TIMEOUT || "12h"),
+    messageInactivityTimeout: parseDuration(process.env.ALOOK_MESSAGE_INACTIVITY_TIMEOUT || "5m"),
     maxConcurrentTasks: parseInt(process.env.ALOOK_DAEMON_MAX_CONCURRENT_TASKS || "20"),
     daemonId,
     deviceName: process.env.ALOOK_DAEMON_DEVICE_NAME || h,
@@ -16316,13 +16392,173 @@ async function handleCliUpdate(version3, onSuccess, profile) {
   }
 }
 
+// daemon/execenv/timeline.ts
+import { appendFileSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4, renameSync } from "fs";
+import { join as join4 } from "path";
+
+// daemon/execenv/filelock.ts
+import { mkdirSync as mkdirSync3, rmdirSync, statSync } from "fs";
+var DEFAULT_STALE_MS = 3600000;
+function acquireLock(lockPath, staleMs = DEFAULT_STALE_MS) {
+  try {
+    mkdirSync3(lockPath);
+    return true;
+  } catch {
+    try {
+      const stat = statSync(lockPath);
+      if (Date.now() - stat.mtimeMs > staleMs) {
+        rmdirSync(lockPath);
+        try {
+          mkdirSync3(lockPath);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+    } catch {
+      try {
+        mkdirSync3(lockPath);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    return false;
+  }
+}
+function releaseLock(lockPath) {
+  try {
+    rmdirSync(lockPath);
+  } catch {}
+}
+
+// daemon/execenv/timeline.ts
+function readJsonl(filePath) {
+  let content;
+  try {
+    content = readFileSync5(filePath, "utf-8");
+  } catch {
+    return [];
+  }
+  const entries = [];
+  for (const line of content.trimEnd().split(`
+`)) {
+    if (!line)
+      continue;
+    try {
+      entries.push(JSON.parse(line));
+    } catch {}
+  }
+  return entries;
+}
+function filenameForDate(date5) {
+  const y = date5.getFullYear();
+  const m = String(date5.getMonth() + 1).padStart(2, "0");
+  const d = String(date5.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}.jsonl`;
+}
+function recentFilenames(maxDays) {
+  const filenames = [];
+  const now = new Date;
+  for (let i = 0;i < maxDays; i++) {
+    const d = new Date(now);
+    d.setDate(d.getDate() - i);
+    filenames.push(filenameForDate(d));
+  }
+  return filenames;
+}
+var DEFAULT_RESUME_MAX_AGE_MS = 3 * 60 * 60 * 1000;
+var EMAIL_RESUME_MAX_AGE_MS = 48 * 60 * 60 * 1000;
+function findRunningPidByTaskId(timelineDir, taskId) {
+  for (const filename of recentFilenames(7)) {
+    const entries = readJsonl(join4(timelineDir, filename));
+    for (const entry of entries) {
+      if (entry.task_id === taskId && entry.status === "running" && entry.pid != null) {
+        return entry.pid;
+      }
+    }
+  }
+  return null;
+}
+function findRunningEntryByContextKey(timelineDir, contextKey, provider) {
+  for (const filename of recentFilenames(7)) {
+    const dayEntries = readJsonl(join4(timelineDir, filename));
+    for (let i = dayEntries.length - 1;i >= 0; i--) {
+      const entry = dayEntries[i];
+      if (entry.status === "running" && entry.context_key === contextKey && entry.provider === provider) {
+        return entry;
+      }
+    }
+  }
+  return null;
+}
+
+// daemon/execenv/steering.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync3, readdirSync, statSync as statSync2 } from "fs";
+import { join as join5 } from "path";
+var INTENT_DIR_NAME = ".kill_intents";
+var STEERING_LOCK_DIR = ".steering_locks";
+var INTENT_STALE_MS = 10 * 60 * 1000;
+function intentFilePath(baseDir, taskId) {
+  return join5(baseDir, INTENT_DIR_NAME, `${taskId}.json`);
+}
+function intentDirPath(baseDir) {
+  return join5(baseDir, INTENT_DIR_NAME);
+}
+function steeringLockPath(baseDir, contextKey) {
+  const safeKey = contextKey.replace(/[^a-zA-Z0-9_:-]/g, "_");
+  return join5(baseDir, STEERING_LOCK_DIR, safeKey);
+}
+function writeKillIntent(baseDir, intent) {
+  const dir = intentDirPath(baseDir);
+  try {
+    mkdirSync4(dir, { recursive: true });
+  } catch {}
+  const filePath = intentFilePath(baseDir, intent.targetTaskId);
+  writeFileSync5(filePath, JSON.stringify(intent));
+}
+function cleanupStaleIntents(baseDir) {
+  const dir = intentDirPath(baseDir);
+  let files;
+  try {
+    files = readdirSync(dir).filter((f) => f.endsWith(".json"));
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  for (const file2 of files) {
+    const filePath = join5(dir, file2);
+    try {
+      const content = readFileSync6(filePath, "utf-8");
+      const intent = JSON.parse(content);
+      const stat = statSync2(filePath);
+      if (now - stat.mtimeMs > INTENT_STALE_MS) {
+        unlinkSync3(filePath);
+        log.debug(`Cleaned up stale kill intent for task ${intent.targetTaskId}`);
+      }
+    } catch {}
+  }
+}
+function acquireSteeringLock(baseDir, contextKey) {
+  const lockPath = steeringLockPath(baseDir, contextKey);
+  try {
+    mkdirSync4(join5(baseDir, STEERING_LOCK_DIR), { recursive: true });
+  } catch {}
+  return acquireLock(lockPath, 60000);
+}
+function releaseSteeringLock(baseDir, contextKey) {
+  const lockPath = steeringLockPath(baseDir, contextKey);
+  releaseLock(lockPath);
+}
+
 // daemon/daemon.ts
-import { existsSync, mkdirSync as mkdirSync3, openSync, closeSync, readdirSync, statSync, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync, mkdirSync as mkdirSync5, openSync, closeSync, readdirSync as readdirSync2, statSync as statSync3, unlinkSync as unlinkSync4 } from "fs";
+import { readdir, readFile, unlink, stat as fsStat } from "fs/promises";
 import { execSync as execSync3, spawn as spawn2 } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 var _dir = dirname3(fileURLToPath2(import.meta.url));
-var sessionRunnerPath = existsSync(join4(_dir, "session-runner.js")) ? join4(_dir, "session-runner.js") : join4(_dir, "session-runner.ts");
+var sessionRunnerPath = existsSync(join6(_dir, "session-runner.js")) ? join6(_dir, "session-runner.js") : join6(_dir, "session-runner.ts");
 function isCommandAvailable2(cmd) {
   try {
     const check2 = process.platform === "win32" ? `where ${cmd}` : `which ${cmd}`;
@@ -16332,21 +16568,21 @@ function isCommandAvailable2(cmd) {
     return false;
   }
 }
-var MAX_SESSION_RUNNER_LOGS = 50;
+var MAX_SESSION_RUNNER_LOGS = 500;
 function pruneSessionRunnerLogs() {
   const logDir = sessionRunnerLogDir();
   let entries;
   try {
-    entries = readdirSync(logDir).filter((f) => f.endsWith(".log"));
+    entries = readdirSync2(logDir).filter((f) => f.endsWith(".log"));
   } catch {
     return;
   }
   if (entries.length <= MAX_SESSION_RUNNER_LOGS)
     return;
   const withMtime = entries.map((name) => {
-    const full = join4(logDir, name);
+    const full = join6(logDir, name);
     try {
-      return { name, mtime: statSync(full).mtimeMs };
+      return { name, mtime: statSync3(full).mtimeMs };
     } catch {
       return { name, mtime: 0 };
     }
@@ -16354,10 +16590,126 @@ function pruneSessionRunnerLogs() {
   withMtime.sort((a, b) => b.mtime - a.mtime);
   for (const entry of withMtime.slice(MAX_SESSION_RUNNER_LOGS)) {
     try {
-      unlinkSync3(join4(logDir, entry.name));
+      unlinkSync4(join6(logDir, entry.name));
     } catch {}
   }
 }
+function isClientError(error48) {
+  if (!(error48 instanceof Error))
+    return false;
+  const match = error48.message.match(/^HTTP (\d+):/);
+  if (!match)
+    return false;
+  const status = Number(match[1]);
+  if (status === 408 || status === 429)
+    return false;
+  return status >= 400 && status < 500;
+}
+function isValidMarker(data) {
+  if (!data || typeof data !== "object")
+    return false;
+  const d = data;
+  if (typeof d.taskId !== "string")
+    return false;
+  if (typeof d.token !== "string")
+    return false;
+  if (typeof d.serverURL !== "string")
+    return false;
+  if (typeof d.createdAt !== "string" || isNaN(new Date(d.createdAt).getTime()))
+    return false;
+  if (!d.payload || typeof d.payload !== "object")
+    return false;
+  const payload = d.payload;
+  if (d.type === "complete") {
+    return typeof payload.output === "string";
+  }
+  if (d.type === "fail") {
+    return typeof payload.error === "string";
+  }
+  return false;
+}
+var MARKER_STALE_MS = 24 * 60 * 60 * 1000;
+var TMP_STALE_MS = 60 * 60 * 1000;
+async function reconcilePendingCompletions(workspacesRoot) {
+  const dir = join6(workspacesRoot, ".pending_completions");
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (!name.endsWith(".tmp"))
+      continue;
+    try {
+      const s = await fsStat(join6(dir, name));
+      if (Date.now() - s.mtimeMs > TMP_STALE_MS) {
+        await unlink(join6(dir, name));
+      }
+    } catch {}
+  }
+  const jsonFiles = entries.filter((f) => f.endsWith(".json"));
+  for (const name of jsonFiles) {
+    const filePath = join6(dir, name);
+    try {
+      let raw;
+      try {
+        raw = await readFile(filePath, "utf-8");
+      } catch {
+        continue;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        log.warn(`reconcile: malformed marker ${name}, deleting`);
+        try {
+          await unlink(filePath);
+        } catch {}
+        continue;
+      }
+      if (!isValidMarker(parsed)) {
+        log.warn(`reconcile: invalid marker structure ${name}, deleting`);
+        try {
+          await unlink(filePath);
+        } catch {}
+        continue;
+      }
+      const marker = parsed;
+      const age = Date.now() - new Date(marker.createdAt).getTime();
+      if (age > MARKER_STALE_MS) {
+        log.warn(`reconcile: stale marker ${name} (${Math.round(age / 3600000)}h old), deleting`);
+        try {
+          await unlink(filePath);
+        } catch {}
+        continue;
+      }
+      const client = new DaemonClient(marker.serverURL);
+      try {
+        if (marker.type === "complete") {
+          await client.completeTask(marker.token, marker.taskId, marker.payload);
+        } else {
+          await client.failTask(marker.token, marker.taskId, marker.payload.error);
+        }
+        try {
+          await unlink(filePath);
+        } catch (delErr) {
+          log.warn(`reconcile: delivered marker ${name} but failed to delete: ${delErr}`);
+        }
+      } catch (deliverErr) {
+        if (isClientError(deliverErr)) {
+          try {
+            await unlink(filePath);
+          } catch {}
+        } else {
+          log.debug(`reconcile: delivery failed for ${name}, will retry next cycle`);
+        }
+      }
+    } catch (e) {
+      log.debug(`reconcile: error processing ${name}`, e);
+    }
+  }
+}
 async function startDaemon(profile, serverUrl) {
   pruneSessionRunnerLogs();
   if (!acquireDaemonPid(profile)) {
@@ -16433,12 +16785,7 @@ async function startDaemon(profile, serverUrl) {
       });
     } catch (e) {
       if (e instanceof Error && e.message.startsWith("HTTP 401")) {
-        log.warn(`Workspace ${ws.id} token invalid — removing from config`);
-        try {
-          const cfg = loadCLIConfigForProfile(profile);
-          cfg.watched_workspaces = (cfg.watched_workspaces || []).filter((w) => w.id !== ws.id);
-          saveCLIConfigForProfile(profile, cfg);
-        } catch {}
+        log.warn(`Workspace ${ws.id} token invalid — skipping (run '${cmdPrefix()} register --token <token>' to fix)`);
       } else {
         log.error(`Failed to register workspace ${ws.id}, skipping`, e);
       }
@@ -16497,7 +16844,7 @@ async function startDaemon(profile, serverUrl) {
       cfg.watched_workspaces = (cfg.watched_workspaces || []).filter((w) => w.id !== workspaceId);
       saveCLIConfigForProfile(profile, cfg);
     } catch {}
-    log.info(`Workspace ${workspaceId} evicted — runtimes removed server-side`);
+    log.info(`Workspace ${workspaceId} deleted server-side — removed from config`);
   }
   const pollCycle = async () => {
     let remaining = config2.maxConcurrentTasks - activeTasks.size;
@@ -16534,7 +16881,7 @@ async function startDaemon(profile, serverUrl) {
         }
       } catch (e) {
         if (e instanceof Error && e.message.startsWith("HTTP 401")) {
-          evictedIds.push(ws.workspaceId);
+          log.warn(`Workspace ${ws.workspaceId} poll returned 401 — will retry next cycle`);
         } else {
           log.debug("Poll error", e);
         }
@@ -16543,6 +16890,11 @@ async function startDaemon(profile, serverUrl) {
     for (const id of evictedIds) {
       evictWorkspace(id);
     }
+    try {
+      await reconcilePendingCompletions(config2.workspacesRoot);
+    } catch (e) {
+      log.debug("reconciliation error", e);
+    }
     if (workspaceStates.length === 0) {
       log.info("All workspaces evicted — shutting down");
       shutdown();
@@ -16571,17 +16923,28 @@ async function startDaemon(profile, serverUrl) {
     releaseDaemonPid(profile);
     health.server.close(() => {
       if (restartRequested) {
-        const args = ["daemon", "start", "--foreground"];
+        const entry = process.argv[1];
+        const args = [entry, "daemon", "start", "--foreground"];
         if (profile)
           args.push("--profile", profile);
         if (serverUrl)
           args.push("--server", serverUrl);
-        const child = spawn2("alook", args, {
+        const logPath = daemonLogFilePath();
+        let logFd;
+        try {
+          mkdirSync5(dirname3(logPath), { recursive: true, mode: 448 });
+          logFd = openSync(logPath, "a", 384);
+        } catch (e) {
+          log.error(`Failed to open daemon log file ${logPath}`, e);
+        }
+        const child = spawn2(process.execPath, args, {
           detached: true,
-          stdio: ["ignore", "ignore", "ignore"]
+          stdio: logFd != null ? ["ignore", logFd, logFd] : ["ignore", "ignore", "ignore"]
         });
         child.unref();
-        log.info(`Spawned new daemon (pid=${child.pid})`);
+        if (logFd != null)
+          closeSync(logFd);
+        log.info(`Spawned new daemon (pid=${child.pid}), logs: ${logPath}`);
       }
       clearTimeout(timeout);
       process.exit(0);
@@ -16593,21 +16956,62 @@ async function startDaemon(profile, serverUrl) {
 }
 function spawnSessionRunner(input) {
   const logDir = sessionRunnerLogDir();
-  mkdirSync3(logDir, { recursive: true });
-  const logFilePath = join4(logDir, `${input.task.id}.log`);
+  mkdirSync5(logDir, { recursive: true });
+  const logFilePath = join6(logDir, `${input.task.id}.log`);
   input.logFilePath = logFilePath;
   const encoded = Buffer.from(JSON.stringify(input)).toString("base64");
-  const fd = openSync(logFilePath, "a");
+  let fd;
+  try {
+    fd = openSync(logFilePath, "a");
+  } catch (e) {
+    log.error(`Failed to open log file ${logFilePath}`, e);
+  }
   const child = spawn2(process.execPath, [sessionRunnerPath, encoded], {
     detached: true,
-    stdio: ["ignore", fd, fd]
+    stdio: fd != null ? ["ignore", fd, fd] : ["ignore", "ignore", "ignore"]
   });
   child.unref();
-  closeSync(fd);
+  if (fd != null)
+    closeSync(fd);
   return child;
 }
 async function handleTask(client, config2, runtimeIndex, task, token, activeTasks) {
   log.info(`Task ${task.id} claimed agent=${task.agentId}`);
+  if (task.type === TASK_TYPES.KILL_TASK) {
+    const targetTaskId = task.context?.target_task_id;
+    if (!targetTaskId) {
+      await client.failTask(token, task.id, "missing target_task_id in context");
+      activeTasks.delete(task.id);
+      return;
+    }
+    const agentBaseDir = join6(config2.workspacesRoot, task.workspaceId, task.agentId, "workdir");
+    const timelineDir = join6(agentBaseDir, ".context_timeline");
+    const pid = findRunningPidByTaskId(timelineDir, targetTaskId);
+    if (pid != null) {
+      writeKillIntent(agentBaseDir, {
+        reason: "cancelled",
+        targetTaskId,
+        expectedPid: pid
+      });
+      try {
+        process.kill(pid, "SIGTERM");
+        await client.failTask(token, task.id, "killed");
+        log.info(`Kill task ${task.id}: sent SIGTERM to pid=${pid} for target=${targetTaskId}`);
+      } catch (e) {
+        if (e?.code === "ESRCH") {
+          await client.failTask(token, task.id, "target process already exited");
+          log.info(`Kill task ${task.id}: target pid=${pid} already exited`);
+        } else {
+          await client.failTask(token, task.id, `kill failed: ${e}`);
+        }
+      }
+    } else {
+      await client.failTask(token, task.id, "target not found in timeline");
+      log.info(`Kill task ${task.id}: target ${targetTaskId} not found in timeline`);
+    }
+    activeTasks.delete(task.id);
+    return;
+  }
   try {
     await client.startTask(token, task.id);
   } catch (e) {
@@ -16622,6 +17026,60 @@ async function handleTask(client, config2, runtimeIndex, task, token, activeTask
     return;
   }
   const provider = runtimeData.provider;
+  if (task.contextKey) {
+    const agentBaseDir = join6(config2.workspacesRoot, task.workspaceId, task.agentId, "workdir");
+    cleanupStaleIntents(agentBaseDir);
+    const timelineDir = join6(agentBaseDir, ".context_timeline");
+    const lockAcquired = acquireSteeringLock(agentBaseDir, task.contextKey);
+    if (!lockAcquired) {
+      log.warn(`Steering lock contention for context_key=${task.contextKey}, proceeding without steering`);
+    } else {
+      try {
+        const predecessor = findRunningEntryByContextKey(timelineDir, task.contextKey, provider);
+        if (predecessor && predecessor.task_id !== task.id) {
+          log.info(`Steering: task ${task.id} supersedes predecessor ${predecessor.task_id} (context_key=${task.contextKey})`);
+          if (predecessor.pid != null) {
+            writeKillIntent(agentBaseDir, {
+              reason: "superseded",
+              targetTaskId: predecessor.task_id,
+              expectedPid: predecessor.pid,
+              successorTaskId: task.id
+            });
+            try {
+              process.kill(predecessor.pid, "SIGTERM");
+              log.info(`Steering: sent SIGTERM to predecessor pid=${predecessor.pid}`);
+            } catch (e) {
+              if (e?.code === "ESRCH") {
+                log.info(`Steering: predecessor pid=${predecessor.pid} already exited`);
+              } else {
+                log.warn(`Steering: kill failed for pid=${predecessor.pid}`, e);
+              }
+            }
+            const waitStart = Date.now();
+            const MAX_WAIT_MS = 15000;
+            const POLL_MS = 200;
+            while (Date.now() - waitStart < MAX_WAIT_MS) {
+              const stillRunning = findRunningPidByTaskId(timelineDir, predecessor.task_id);
+              if (stillRunning == null)
+                break;
+              await new Promise((r) => setTimeout(r, POLL_MS));
+            }
+            if (findRunningPidByTaskId(timelineDir, predecessor.task_id) != null) {
+              log.warn(`Steering: predecessor pid=${predecessor.pid} did not exit within ${MAX_WAIT_MS}ms, proceeding anyway`);
+            }
+          }
+          try {
+            await client.supersedeTask(token, predecessor.task_id);
+            log.info(`Steering: predecessor ${predecessor.task_id} marked superseded`);
+          } catch (e) {
+            log.warn(`Steering: failed to mark predecessor superseded server-side`, e);
+          }
+        }
+      } finally {
+        releaseSteeringLock(agentBaseDir, task.contextKey);
+      }
+    }
+  }
   const cliPath = provider === "claude" ? config2.claudePath : provider === "codex" ? config2.codexPath : config2.opencodePath;
   const configModel = provider === "claude" ? config2.claudeModel : provider === "codex" ? config2.codexModel : config2.opencodeModel;
   const agentModel = task.agent?.runtimeConfig?.model;
@@ -16634,7 +17092,8 @@ async function handleTask(client, config2, runtimeIndex, task, token, activeTask
     serverURL: config2.serverURL,
     token,
     workspacesRoot: config2.workspacesRoot,
-    agentTimeout: config2.agentTimeout
+    agentTimeout: config2.agentTimeout,
+    messageInactivityTimeout: config2.messageInactivityTimeout
   };
   const child = spawnSessionRunner(input);
   child.on("close", () => activeTasks.delete(task.id));
@@ -16676,7 +17135,7 @@ async function startInBackground(profile, serverUrl) {
     return;
   }
   const logPath = daemonLogFilePath();
-  mkdirSync4(dirname4(logPath), { recursive: true, mode: 448 });
+  mkdirSync6(dirname4(logPath), { recursive: true, mode: 448 });
   const logFd = openSync2(logPath, "a", 384);
   const child = spawn3(process.execPath, buildChildArgs(profile, serverUrl), {
     detached: true,
@@ -16767,6 +17226,14 @@ function daemonCommand() {
 import { Command as Command4 } from "commander";
 
 // lib/output.ts
+function printTable(headers, rows) {
+  const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] || "").length)));
+  const header = headers.map((h, i) => h.padEnd(widths[i])).join("  ");
+  const separator = widths.map((w) => "-".repeat(w)).join("  ");
+  console.log(header);
+  console.log(separator);
+  rows.forEach((r) => console.log(r.map((c, i) => (c || "").padEnd(widths[i])).join("  ")));
+}
 function printJSON(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -16786,8 +17253,8 @@ function configCommand() {
 
 // commands/email.ts
 import { Command as Command5 } from "commander";
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import { basename, join as join5 } from "path";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync7, statSync as statSync4 } from "fs";
+import { basename, join as join7 } from "path";
 import PostalMime from "postal-mime";
 var VALID_STATUSES = ["unread", "read", "archived"];
 var EMAIL_BASE = "/tmp/alook-emails";
@@ -16818,7 +17285,10 @@ function collectRepeated(value, previous) {
   return previous.concat([value]);
 }
 function resolveClientOpts(command, opts) {
-  const parentOpts = command.parent?.parent?.opts() || {};
+  let root = command;
+  while (root.parent)
+    root = root.parent;
+  const parentOpts = root.opts() || {};
   const profile = parentOpts.profile;
   const cfg = loadCLIConfigForProfile(profile);
   const serverUrl = parentOpts.server || cfg.server_url;
@@ -16847,7 +17317,7 @@ function emailCommand() {
       console.error(`Error: invalid status "${opts.status}", must be one of: ${VALID_STATUSES.join(", ")}`);
       process.exit(1);
     }
-    const emailDir_base = join5(EMAIL_BASE, workspaceId, opts.agent_id);
+    const emailDir_base = join7(EMAIL_BASE, workspaceId, opts.agent_id);
     try {
       let query = `/api/email?agentId=${opts.agent_id}`;
       if (opts.status)
@@ -16861,11 +17331,11 @@ function emailCommand() {
         printJSON(emails2);
         return;
       }
-      mkdirSync5(emailDir_base, { recursive: true });
+      mkdirSync7(emailDir_base, { recursive: true });
       const downloadedPaths = [];
       for (const email3 of emails2) {
-        const emailDir = join5(emailDir_base, email3.id);
-        mkdirSync5(emailDir, { recursive: true });
+        const emailDir = join7(emailDir_base, email3.id);
+        mkdirSync7(emailDir, { recursive: true });
         const metadata = {
           id: email3.id,
           from: email3.from_email,
@@ -16877,8 +17347,8 @@ function emailCommand() {
           in_reply_to: email3.in_reply_to || "",
           references: email3.references || ""
         };
-        const metadataPath = join5(emailDir, "metadata.json");
-        writeFileSync4(metadataPath, JSON.stringify(metadata, null, 2));
+        const metadataPath = join7(emailDir, "metadata.json");
+        writeFileSync6(metadataPath, JSON.stringify(metadata, null, 2));
         downloadedPaths.push(metadataPath);
         let rawMime;
         try {
@@ -16893,18 +17363,18 @@ function emailCommand() {
         }
         const parsed = await new PostalMime().parse(rawMime);
         if (parsed.text) {
-          const bodyPath = join5(emailDir, "body.txt");
-          writeFileSync4(bodyPath, parsed.text);
+          const bodyPath = join7(emailDir, "body.txt");
+          writeFileSync6(bodyPath, parsed.text);
           downloadedPaths.push(bodyPath);
         }
         if (parsed.html) {
-          const htmlPath = join5(emailDir, "body.html");
-          writeFileSync4(htmlPath, parsed.html);
+          const htmlPath = join7(emailDir, "body.html");
+          writeFileSync6(htmlPath, parsed.html);
           downloadedPaths.push(htmlPath);
         }
         if (parsed.attachments && parsed.attachments.length > 0) {
-          const attDir = join5(emailDir, "attachments");
-          mkdirSync5(attDir, { recursive: true });
+          const attDir = join7(emailDir, "attachments");
+          mkdirSync7(attDir, { recursive: true });
           const usedFilenames = new Set;
           for (let i = 0;i < parsed.attachments.length; i++) {
             const att = parsed.attachments[i];
@@ -16913,7 +17383,7 @@ function emailCommand() {
               filename = `${i}-${filename}`;
             }
             usedFilenames.add(filename);
-            const attPath = join5(attDir, filename);
+            const attPath = join7(attDir, filename);
             const content = att.content;
             let buf;
             if (typeof content === "string") {
@@ -16923,7 +17393,7 @@ function emailCommand() {
             } else {
               buf = Buffer.from(content);
             }
-            writeFileSync4(attPath, buf);
+            writeFileSync6(attPath, buf);
             downloadedPaths.push(attPath);
           }
         }
@@ -16962,7 +17432,7 @@ function emailCommand() {
     const client = new APIClient(serverUrl, token, workspaceId);
     let htmlBody;
     try {
-      htmlBody = readFileSync5(opts.bodyFile, "utf-8");
+      htmlBody = readFileSync7(opts.bodyFile, "utf-8");
     } catch (err) {
       console.error(`Error: cannot read body file "${opts.bodyFile}": ${err instanceof Error ? err.message : err}`);
       process.exit(1);
@@ -16978,8 +17448,8 @@ function emailCommand() {
         let bytes;
         let size;
         try {
-          bytes = readFileSync5(path);
-          size = statSync2(path).size;
+          bytes = readFileSync7(path);
+          size = statSync4(path).size;
         } catch (err) {
           console.error(`Error: cannot read attachment "${path}": ${err instanceof Error ? err.message : err}`);
           process.exit(1);
@@ -17024,6 +17494,73 @@ function emailCommand() {
       process.exit(1);
     }
   });
+  const whitelistCmd = new Command5("whitelist").description("Manage email whitelist (allowed senders)");
+  whitelistCmd.command("list").description("List all whitelisted emails for an agent").requiredOption("--agent_id <id>", "Agent ID").option("--workspace <id>", "Workspace ID").option("--json", "Output as JSON").action(async (opts, command) => {
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, {
+      workspace: opts.workspace,
+      agentId: opts.agent_id
+    });
+    const client = new APIClient(serverUrl, token, workspaceId);
+    try {
+      const entries = await client.getJSON(`/api/agents/${opts.agent_id}/whitelist`);
+      if (!entries.length) {
+        console.log("No whitelisted emails.");
+        return;
+      }
+      if (opts.json) {
+        printJSON(entries);
+        return;
+      }
+      printTable(["ID", "EMAIL", "CREATED AT"], entries.map((e) => [e.id, e.email, e.created_at]));
+    } catch (err) {
+      console.error(`Error: ${err instanceof Error ? err.message : err}`);
+      process.exit(1);
+    }
+  });
+  whitelistCmd.command("add").description("Add an email to the whitelist").requiredOption("--agent_id <id>", "Agent ID").option("--workspace <id>", "Workspace ID").argument("<email>", "Email address to whitelist").action(async (email3, opts, command) => {
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, {
+      workspace: opts.workspace,
+      agentId: opts.agent_id
+    });
+    const client = new APIClient(serverUrl, token, workspaceId);
+    try {
+      const entry = await client.postJSON(`/api/agents/${opts.agent_id}/whitelist`, { email: email3.toLowerCase() });
+      console.log(`Added ${entry.email} to whitelist (id: ${entry.id})`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("409")) {
+        console.error(`Error: ${email3.toLowerCase()} is already whitelisted`);
+      } else {
+        console.error(`Error: ${msg}`);
+      }
+      process.exit(1);
+    }
+  });
+  whitelistCmd.command("delete").description("Remove an email from the whitelist").requiredOption("--agent_id <id>", "Agent ID").option("--workspace <id>", "Workspace ID").argument("<email>", "Email address to remove").action(async (email3, opts, command) => {
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, {
+      workspace: opts.workspace,
+      agentId: opts.agent_id
+    });
+    const client = new APIClient(serverUrl, token, workspaceId);
+    const normalizedEmail = email3.toLowerCase();
+    try {
+      const entries = await client.getJSON(`/api/agents/${opts.agent_id}/whitelist`);
+      const entry = entries.find((e) => e.email === normalizedEmail);
+      if (!entry) {
+        console.error(`Error: ${normalizedEmail} is not in the whitelist`);
+        process.exit(1);
+      }
+      await client.deleteJSON(`/api/agents/${opts.agent_id}/whitelist/${entry.id}`);
+      console.log(`Removed ${normalizedEmail} from whitelist`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg === "__exit__")
+        throw err;
+      console.error(`Error: ${msg}`);
+      process.exit(1);
+    }
+  });
+  cmd.addCommand(whitelistCmd);
   return cmd;
 }
 
@@ -17283,7 +17820,7 @@ ${result.output}`);
 
 // commands/sync.ts
 import { Command as Command9 } from "commander";
-import { readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync8, statSync as statSync5 } from "fs";
 import { basename as basename2 } from "path";
 var MIME_BY_EXT2 = {
   ".pdf": "application/pdf",
@@ -17332,9 +17869,9 @@ function syncCommand() {
     let bytes;
     let size;
     try {
-      const stat = statSync3(opts.file);
+      const stat = statSync5(opts.file);
       size = stat.size;
-      bytes = readFileSync6(opts.file);
+      bytes = readFileSync8(opts.file);
     } catch (err) {
       console.error(`Error: cannot read file "${opts.file}": ${err.message}`);
       process.exit(1);