@alook/daemon 0.1.11 → 0.1.13

package/dist/cli/index.js

@@ -98,7 +98,7 @@ var init_nanoid = () => {};
 // src/cli/index.ts
 import { Command, CommanderError } from "commander";
 import { realpathSync as realpathSync2 } from "node:fs";
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -14945,6 +14945,9 @@ class Name {
     return new SQL([this]);
   }
 }
+function isDriverValueEncoder(value) {
+  return typeof value === "object" && value !== null && "mapToDriverValue" in value && typeof value.mapToDriverValue === "function";
+}
 var noopDecoder = {
   mapFromDriverValue: (value) => value
 };
@@ -15838,6 +15841,39 @@ class PrimaryKey {
   }
 }
 
+// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@4.20260702.1_@opentelemetry+api@1.9.1_@typ_5aa9492b131e5fac58fa98e88e5c0ad3/node_modules/drizzle-orm/sql/expressions/conditions.js
+function bindIfParam(value, column) {
+  if (isDriverValueEncoder(column) && !isSQLWrapper(value) && !is(value, Param) && !is(value, Placeholder) && !is(value, Column) && !is(value, Table) && !is(value, View)) {
+    return new Param(value, column);
+  }
+  return value;
+}
+var eq = (left, right) => {
+  return sql`${left} = ${bindIfParam(right, left)}`;
+};
+function and(...unfilteredConditions) {
+  const conditions = unfilteredConditions.filter((c) => c !== undefined);
+  if (conditions.length === 0) {
+    return;
+  }
+  if (conditions.length === 1) {
+    return new SQL(conditions);
+  }
+  return new SQL([
+    new StringChunk("("),
+    sql.join(conditions, new StringChunk(" and ")),
+    new StringChunk(")")
+  ]);
+}
+function isNotNull(value) {
+  return sql`${value} is not null`;
+}
+
+// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@4.20260702.1_@opentelemetry+api@1.9.1_@typ_5aa9492b131e5fac58fa98e88e5c0ad3/node_modules/drizzle-orm/sql/expressions/select.js
+function desc(column) {
+  return sql`${column} desc`;
+}
+
 // ../shared/src/db/community-machine-schema.ts
 init_nanoid();
 
@@ -16706,6 +16742,7 @@ var OwnerDiagnosticReportSchema = exports_external.discriminatedUnion("status",
 
 // ../shared/src/community-cli-contract.ts
 var DM_SERVER = ".dm";
+var CONTROL_HEARTBEAT_CAPABILITY = "control-heartbeat-v1";
 function parseRef(ref) {
   if (!ref.startsWith("/"))
     throw new Error(`ref must start with "/": ${ref}`);
@@ -16781,6 +16818,10 @@ function parseSeq(s) {
   return n;
 }
 var HostCommandSchema = exports_external.discriminatedUnion("type", [
+  exports_external.strictObject({
+    type: exports_external.literal("machine:heartbeat"),
+    nonce: exports_external.string().min(1).max(128)
+  }),
   exports_external.object({
     type: exports_external.literal("agent:wake"),
     agentId: exports_external.string().min(1),
@@ -17420,6 +17461,7 @@ var CommunityMachineSummarySchema = exports_external.object({
 var HostReadyMessageSchema = exports_external.object({
   type: exports_external.literal("ready"),
   runtimeReport: CommunityMachineRuntimeListSchema,
+  capabilities: exports_external.array(exports_external.string().min(1).max(64)).max(16).optional().default([]),
   runningAgents: exports_external.array(exports_external.string()).default([]),
   hostname: exports_external.string().optional(),
   platform: exports_external.string().optional(),
@@ -17471,6 +17513,14 @@ var AgentWakeAckMessageSchema = exports_external.object({
   status: exports_external.enum(["ok", "error"]),
   error: exports_external.object({ code: exports_external.string().optional(), message: exports_external.string().optional() }).optional()
 });
+var MachineHeartbeatAckMessageSchema = exports_external.strictObject({
+  type: exports_external.literal("machine_heartbeat_ack"),
+  nonce: exports_external.string().min(1).max(128)
+});
+var DiagnosticCommandAckMessageSchema = exports_external.strictObject({
+  type: exports_external.literal("diagnostics_ack"),
+  reportId: DiagnosticReportIdSchema
+});
 var CommunityPairTokenResponseSchema = exports_external.object({
   tokenId: exports_external.string(),
   expiresAt: exports_external.string()
@@ -17479,6 +17529,7 @@ var CommunityDaemonActivateRequestSchema = exports_external.object({
   hostname: exports_external.string(),
   platform: exports_external.string(),
   arch: exports_external.string(),
+  expectedMachineId: exports_external.string().min(1).optional(),
   osRelease: exports_external.string().optional(),
   daemonVersion: exports_external.string().optional(),
   runtimeReport: CommunityMachineRuntimeListSchema.optional()
@@ -17486,7 +17537,12 @@ var CommunityDaemonActivateRequestSchema = exports_external.object({
 var CommunityDaemonActivateResponseSchema = exports_external.object({
   credential: exports_external.string(),
   machineId: exports_external.string(),
-  expiresAt: exports_external.string().nullable()
+  expiresAt: exports_external.string().nullable(),
+  sessionOutcome: exports_external.literal("committed")
+});
+var CommunityDaemonActivateErrorResponseSchema = exports_external.object({
+  error: exports_external.string(),
+  sessionOutcome: exports_external.enum(["not_committed", "unknown"])
 });
 var CommunityDaemonEnrollAgentRequestSchema = exports_external.object({
   agentId: exports_external.string().min(1).max(128)
@@ -17576,13 +17632,6 @@ var CommunityAgentResolveRequestSchema = exports_external.object({
 var CommunityAgentListChannelsRequestSchema = exports_external.object({
   server: exports_external.string().min(1).optional()
 });
-var CommunityAgentCreatePostRequestSchema = exports_external.object({
-  forum: exports_external.string().min(1),
-  title: exports_external.string().min(1),
-  content: CommunityAgentMessageContentSchema,
-  attachments: exports_external.array(exports_external.string().min(1)).max(MAX_ATTACHMENTS_PER_MESSAGE).default([]),
-  nonce: exports_external.string().min(1).max(128).optional()
-}).refine((d) => d.content.text.trim().length > 0 || d.attachments.length > 0, { message: "post must have text or attachments" });
 var CommunityAgentListMembersRequestSchema = exports_external.object({
   server: exports_external.string().min(1),
   limit: exports_external.number().int().positive().optional(),
@@ -17596,7 +17645,9 @@ var CommunityAgentJoinServerRequestSchema = exports_external.object({
   invite: exports_external.string().min(1)
 });
 var CommunityAgentNapRequestSchema = exports_external.object({
-  handoff: exports_external.string().trim().min(1)
+  handoff: exports_external.string().refine((value) => value.trim().length > 0, {
+    message: "handoff is required"
+  })
 });
 var CommunityAgentReactAddRequestSchema = exports_external.object({
   channel: exports_external.string().min(1),
@@ -17748,6 +17799,7 @@ var communityChannel = sqliteTable("community_channel", {
   index("idx_channel_server_position").on(t.serverId, t.position),
   index("idx_channel_server_last_message").on(t.serverId, t.lastMessageAt),
   index("idx_channel_parent").on(t.parentChannelId),
+  index("idx_channel_forum_created").on(t.parentChannelId, desc(t.createdAt), desc(t.id)).where(and(eq(t.type, "thread"), eq(t.archived, 0), isNotNull(t.parentMessageId))),
   uniqueIndex("idx_channel_server_name").on(t.serverId, t.name).where(sql`parent_channel_id IS NULL`)
 ]);
 var communityChannelMember = sqliteTable("community_channel_member", {
@@ -18130,26 +18182,6 @@ var channelJoinBaselineGuard = sql`${communityMessage.createdAt} > COALESCE(${co
 
 // ../shared/src/db/queries/community/mention.ts
 var MENTION_INSERT_MAX_ROWS = maxRowsPerInsert(5);
-// ../shared/src/community/bot-activity-presets.ts
-var BOT_ACTIVITY_PRESETS = {
-  idle: { emoji: "\uD83D\uDCA4", text: "Idle" },
-  starting: { emoji: "\uD83C\uDF00", text: "Waking up" },
-  stopping: { emoji: "\uD83C\uDF19", text: "Wrapping up" }
-};
-var RUNNING_PRESETS = [
-  { emoji: "⚡", text: "Working on it" },
-  { emoji: "\uD83D\uDEE0️", text: "Cooking" },
-  { emoji: "\uD83E\uDDE0", text: "Thinking hard" },
-  { emoji: "\uD83D\uDD27", text: "Tinkering" },
-  { emoji: "\uD83D\uDE80", text: "On it" },
-  { emoji: "\uD83D\uDD25", text: "In the zone" }
-];
-var BOT_ACTIVITY_STATUS_PAIRS = [
-  BOT_ACTIVITY_PRESETS.idle,
-  BOT_ACTIVITY_PRESETS.starting,
-  BOT_ACTIVITY_PRESETS.stopping,
-  ...RUNNING_PRESETS
-];
 // ../shared/src/community-ws-events.ts
 var string4 = exports_external.string();
 var nullableString = string4.nullable();
@@ -18606,6 +18638,68 @@ var WS_EVENTS = {
   BOT_AUDIT_EVENT: "community:bot.audit_event"
 };
 var COMMUNITY_EVENT_TYPES = new Set(Object.values(WS_EVENTS));
+var COMMUNITY_USER_TARGET_MAX_BYTES = 128;
+function utf8ByteLength(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function isWellFormedUnicode(value) {
+  for (let index2 = 0;index2 < value.length; index2 += 1) {
+    const codeUnit = value.charCodeAt(index2);
+    if (codeUnit >= 55296 && codeUnit <= 56319) {
+      const next = value.charCodeAt(index2 + 1);
+      if (!Number.isInteger(next) || next < 56320 || next > 57343)
+        return false;
+      index2 += 1;
+    } else if (codeUnit >= 56320 && codeUnit <= 57343) {
+      return false;
+    }
+  }
+  return true;
+}
+function isValidCommunityUserTarget(value) {
+  return typeof value === "string" && value.length > 0 && isWellFormedUnicode(value) && utf8ByteLength(value) <= COMMUNITY_USER_TARGET_MAX_BYTES;
+}
+
+// ../shared/src/community-message-delivery.ts
+var MESSAGE_DELIVERY_MAX_USERS = 1000;
+var target = exports_external.string().refine(isValidCommunityUserTarget);
+var targetList = exports_external.array(target).max(MESSAGE_DELIVERY_MAX_USERS);
+var memberAddedSchema = exports_external.strictObject({
+  userId: target,
+  serverId: exports_external.string().min(1),
+  channelId: exports_external.string().min(1)
+});
+var batchShape = exports_external.strictObject({
+  messageId: exports_external.string().min(1),
+  messageEvent: exports_external.unknown(),
+  contentUserIds: targetList,
+  unreadPlainUserIds: targetList,
+  unreadMentionUserIds: targetList,
+  mentionUserIds: targetList,
+  memberAdded: memberAddedSchema.optional(),
+  parentProjection: exports_external.unknown().optional(),
+  parentProjectionUserIds: targetList.optional()
+});
+// ../shared/src/community/bot-activity-presets.ts
+var BOT_ACTIVITY_PRESETS = {
+  idle: { emoji: "\uD83D\uDCA4", text: "Idle" },
+  starting: { emoji: "\uD83C\uDF00", text: "Waking up" },
+  stopping: { emoji: "\uD83C\uDF19", text: "Wrapping up" }
+};
+var RUNNING_PRESETS = [
+  { emoji: "⚡", text: "Working on it" },
+  { emoji: "\uD83D\uDEE0️", text: "Cooking" },
+  { emoji: "\uD83E\uDDE0", text: "Thinking hard" },
+  { emoji: "\uD83D\uDD27", text: "Tinkering" },
+  { emoji: "\uD83D\uDE80", text: "On it" },
+  { emoji: "\uD83D\uDD25", text: "In the zone" }
+];
+var BOT_ACTIVITY_STATUS_PAIRS = [
+  BOT_ACTIVITY_PRESETS.idle,
+  BOT_ACTIVITY_PRESETS.starting,
+  BOT_ACTIVITY_PRESETS.stopping,
+  ...RUNNING_PRESETS
+];
 // ../shared/src/db/index.ts
 var allSchema = { ...exports_schema, ...exports_community_schema, ...exports_community_machine_schema };
 // ../shared/src/db/queries/task.ts
@@ -18769,50 +18863,6 @@ function createProxyServerApi(config2) {
     });
     return parseJsonResponse(res, "send");
   }
-  async function callCreatePost(req) {
-    const endpoint = `${base}/api/community/channels/${REF_PLACEHOLDER_ID}/messages`;
-    const openerNonce = req.nonce !== undefined ? `${req.nonce}:opener` : undefined;
-    const replyNonce = req.nonce !== undefined ? `${req.nonce}:reply` : undefined;
-    const openerRes = await fetchImpl(endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${config2.voucher}`
-      },
-      body: JSON.stringify({
-        channel: req.forum,
-        content: { text: req.title },
-        attachments: req.attachments ?? [],
-        ...openerNonce !== undefined ? { nonce: openerNonce } : {}
-      })
-    });
-    const opener = await parseJsonResponse(openerRes, "createPost opener");
-    if (opener.state !== "sent" || !opener.message || !opener.threadId) {
-      throw new Error("createPost: upstream response missing opener thread");
-    }
-    const threadRef = `${req.forum}/#${opener.message.seq.replace(/^#/, "")}`;
-    const replyRes = await fetchImpl(endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${config2.voucher}`
-      },
-      body: JSON.stringify({
-        channel: threadRef,
-        content: req.content,
-        attachments: req.attachments ?? [],
-        ...replyNonce !== undefined ? { nonce: replyNonce } : {}
-      })
-    });
-    const reply = await parseJsonResponse(replyRes, "createPost reply");
-    if (reply.state !== "sent" || !reply.message)
-      throw new Error("createPost: upstream response missing reply");
-    return {
-      ref: reply.message.channel,
-      name: req.title,
-      seq: Number(reply.message.seq.replace(/^#/, ""))
-    };
-  }
   async function callRead(req) {
     const q = new URLSearchParams;
     q.set("ref", req.channel);
@@ -19096,7 +19146,6 @@ function createProxyServerApi(config2) {
     inboxSnapshot: (_r) => callInboxSnapshot(),
     ack: callAck,
     send: callSend,
-    createPost: callCreatePost,
     read: callRead,
     resolve: callResolve,
     listMembers: callListMembers,
@@ -19162,7 +19211,7 @@ function cliCommandsSection() {
     "### Messaging",
     "",
     `1. \`${CLI} inbox pull\` — fetch unread messages (advances your read waterline by default, ` + `so they won't re-pull; \`--no-ack\` to peek without advancing).`,
-    `2. \`${CLI} message send\` — send to a channel, DM, or thread. Attach with ` + `\`--attachment <id>\` (repeatable, order matters). Optionally add ` + `\`--remind-after <duration>\` to be reminded if the same channel, thread, or DM receives no ` + `newer message after your send. Use a whole number of minutes or hours from \`1m\` to \`24h\`, ` + `such as \`15m\` or \`2h\`.`,
+    `2. \`${CLI} message send\` — send to a channel, DM, or thread. ` + `For a short body, use explicit \`--stdin\` with a quoted heredoc; for a long or complicated body, ` + `use \`--file <path>\`. Attach with \`--attachment <id>\` (repeatable, order matters). Optionally add ` + `\`--remind-after <duration>\` to be reminded if the same channel, thread, or DM receives no ` + `newer message after your send. Use a whole number of minutes or hours from \`1m\` to \`24h\`, ` + `such as \`15m\` or \`2h\`.`,
     `3. \`${CLI} message attachment upload --target <ref> --file <path>\` — upload a file; ` + `returns an id stable across pending→persisted. Feed it into ` + `\`message send --attachment <id>\`.`,
     `4. \`${CLI} message attachment download --id <id> [--out <path>]\` — download any ` + `attachment you can see (or your own pending uploads).`,
     `5. \`${CLI} message emoji --target <ref> --emoji <e>\` — react with a single emoji. ` + `Works on channel messages (\`/<server>/<channel>#N\`), DM messages ` + `(\`/.dm/<peer>#N\`), and thread-reply messages (\`/<server>/<channel>/#N#M\`).`,
@@ -19193,7 +19242,7 @@ function cliCommandsSection() {
     "",
     "### Context Lifecycle",
     "",
-    `1. \`${CLI} nap --handoff <file>\` (or \`--text <note>\`) — reset your current session and ` + `start fresh. The required handoff is injected into the new session so your future self can ` + `quickly pick up unfinished work. Never nap on your own; only do it when someone explicitly asks.`,
+    `1. \`${CLI} nap --handoff <file>\` — reset your current session and ` + `start fresh. The required handoff is injected into the new session so your future self can ` + `quickly pick up unfinished work. Never nap on your own; only do it when someone explicitly asks.`,
     "",
     "### Output format",
     "",
@@ -19212,9 +19261,11 @@ function messagingSection() {
     "You can initiate conversations — send to any channel or DM someone directly. You're not " + "limited to replying. Use the same `message send` command whether you're replying or " + "starting a conversation.",
     "",
     "- Reply where the message came from. Post results in the channel that owns the topic. " + "When uncertain, read history (below) or DM the relevant people.",
-    `- Short reply: \`${CLI} message send --target <ref> --text "brief reply"\`.`,
-    `- Long or complicated: write body to a tmp file, then \`${CLI} message send --target <ref> --file ./temp_msg.md\`.`,
-    `- Cite a specific message: \`${CLI} message send --target <ref> --reply "#37" --text "on it"\` — ` + "`--reply` takes the `#N` seq (within `--target`) of the message you're answering.",
+    "Free-form message bodies never go in command arguments.",
+    "",
+    `- Short reply: use \`${CLI} message send --target <ref> --stdin\` with the quoted-heredoc form shown ` + "under *Message formatting*. Choose a fresh quoted delimiter that does not occur as a standalone line in the body.",
+    `- Long or complicated: write the body to a temporary file with a filesystem tool, then ` + `\`${CLI} message send --target <ref> --file ./temp_msg.md\`.`,
+    `- Cite a specific message: add \`--reply "#37"\` to either form — \`--reply\` takes the \`#N\` seq ` + "(within `--target`) of the message you're answering.",
     "",
     "### Context refs",
     "",
@@ -19254,8 +19305,10 @@ function messagingSection() {
     "- **Mentions** — `@name#NNNN` calls that person's attention specifically. In a private " + "channel, first verify they " + `are a member with \`${CLI} channel member --channel <ref>\` before mentioning them.`,
     "",
     "```bash",
-    "# Notify Alice and point her to a message for context.",
-    `${CLI} message send --target "/demo#1234/general" --text "@alice#0001 Please review /demo#1234/general#42"`,
+    "# Choose a fresh quoted delimiter that does not occur as a standalone line in the body.",
+    `${CLI} message send --target "/demo#1234/general" --stdin <<'ALOOK_MESSAGE_7F3C'`,
+    "@alice#0001 Please review /demo#1234/general#42",
+    "ALOOK_MESSAGE_7F3C",
     "```",
     "",
     "### Pulled messages",
@@ -19321,7 +19374,7 @@ function utilsSection() {
     "",
     `Use \`message send --remind-after <duration>\` when you send something that may need a later ` + "follow-up — for example, a question, approval request, handoff, or blocker — and silence would " + "leave the work unfinished. If no newer message appears in that channel, thread, or DM during " + "the duration, you'll receive a reminder to return and decide what to do next. Don't add it to " + "ordinary messages that need no follow-up.",
     "",
-    `Example: \`${CLI} message send --target /demo#1234/team --text "Please review the rollout plan" ` + `--remind-after 1m\`.`
+    `Example: ${CLI} message send --target "/demo#1234/team" --remind-after 1m --file ./message.md`
   ].join(`
 `);
 }
@@ -19658,8 +19711,8 @@ function ensureSymlinks(workDir) {
     try {
       const stat = lstatSync(aliasPath);
       if (stat.isSymbolicLink()) {
-        const target = readlinkSync(aliasPath);
-        if (target === CANONICAL_FILE)
+        const target2 = readlinkSync(aliasPath);
+        if (target2 === CANONICAL_FILE)
           continue;
         unlinkSync2(aliasPath);
       } else {
@@ -19798,11 +19851,11 @@ function buildClaudeProviderIsolationEnv(ctx) {
   fs4.mkdirSync(configDir, { recursive: true });
   const hostClaude = path4.join(process.env.HOME || ".", ".claude");
   for (const sub of ["skills", "commands"]) {
-    const target = path4.join(hostClaude, sub);
+    const target2 = path4.join(hostClaude, sub);
     const link = path4.join(configDir, sub);
     try {
-      if (fs4.existsSync(target) && !fs4.existsSync(link))
-        fs4.symlinkSync(target, link);
+      if (fs4.existsSync(target2) && !fs4.existsSync(link))
+        fs4.symlinkSync(target2, link);
     } catch {}
   }
   return {
@@ -20036,9 +20089,9 @@ function resolveHomePath(relativePath, deps = {}) {
 }
 function resolveSpawnSpec(command, args, override, deps = {}, platform = process.platform) {
   const trimmed = override?.trim();
-  const target = trimmed && trimmed.length > 0 ? trimmed : command;
+  const target2 = trimmed && trimmed.length > 0 ? trimmed : command;
   const looksLikePath = trimmed !== undefined && trimmed.length > 0 && /[\\/]/.test(trimmed);
-  const resolved = looksLikePath ? target : resolveCommandOnPath(target, deps) ?? target;
+  const resolved = looksLikePath ? target2 : resolveCommandOnPath(target2, deps) ?? target2;
   return { command: resolved, args, shell: needsWindowsShimShell(resolved, platform) };
 }
 function resolveClaudeCommand(deps = {}) {
@@ -21375,8 +21428,8 @@ function listRuntimeIds() {
 var SELECTABLE_RUNTIMES = new Set(["claude", "codex", "opencode", "pi", "cursor"]);
 function resolveAlookCliPath(moduleDir) {
   const thisDir = moduleDir ?? path8.dirname(fileURLToPath(import.meta.url));
-  const target = path8.basename(thisDir) === "dist" ? path8.resolve(thisDir, "cli", "index.js") : path8.resolve(thisDir, "..", "scripts", "alook-shim.mjs");
-  return fs6.existsSync(target) ? target : null;
+  const target2 = path8.basename(thisDir) === "dist" ? path8.resolve(thisDir, "cli", "index.js") : path8.resolve(thisDir, "..", "scripts", "alook-shim.mjs");
+  return fs6.existsSync(target2) ? target2 : null;
 }
 function deriveCliFallbackCandidates(cliPath) {
   if (!cliPath)
@@ -21780,6 +21833,236 @@ function writeStatusFile(path9, snapshot) {
   } catch {}
 }
 
+// src/manager/wakeCoordinator.ts
+class WakeCoordinator {
+  agents = new Map;
+  async run(command, dispatch, onDesiredAdvance) {
+    const state = this.agent(command.agentId);
+    const channel2 = command.unreadNotice.channel;
+    const seq = command.unreadNotice.latestSeq;
+    const scope = state.scopes.get(channel2);
+    const coveredSeq = Math.max(scope?.modelSeenSeq ?? 0, scope?.admittedSeq ?? 0);
+    if (seq <= coveredSeq) {
+      this.rememberReplacement(state, command);
+      return { state: "suppressed", coveredSeq };
+    }
+    const desiredAdvanced = !scope || seq > scope.desiredSeq;
+    if (!scope || seq >= scope.desiredSeq) {
+      state.scopes.set(channel2, {
+        desiredSeq: Math.max(scope?.desiredSeq ?? 0, seq),
+        admittedSeq: scope?.admittedSeq ?? 0,
+        modelSeenSeq: scope?.modelSeenSeq ?? 0,
+        command
+      });
+    }
+    if (desiredAdvanced)
+      onDesiredAdvance?.(command);
+    state.dispatch = dispatch;
+    if (state.active || state.admitting) {
+      this.rememberReplacement(state, command);
+      return { state: "suppressed", coveredSeq: seq };
+    }
+    await this.admit(command.agentId, command);
+    return { state: "accepted" };
+  }
+  modelSeenGeneration(agentId) {
+    return this.agent(agentId).observationGeneration;
+  }
+  recordModelSeen(agentId, messages, generation) {
+    const state = this.agent(agentId);
+    if (generation !== state.observationGeneration)
+      return false;
+    for (const message2 of messages) {
+      const seq = Number(message2.seq.startsWith("#") ? message2.seq.slice(1) : message2.seq);
+      if (!Number.isSafeInteger(seq) || seq <= 0)
+        continue;
+      const scope = state.scopes.get(message2.channel);
+      if (scope) {
+        scope.modelSeenSeq = Math.max(scope.modelSeenSeq, seq);
+      } else {
+        state.scopes.set(message2.channel, {
+          desiredSeq: 0,
+          admittedSeq: 0,
+          modelSeenSeq: seq,
+          command: null
+        });
+      }
+    }
+    return true;
+  }
+  recordAgentActivity(agentId, activity) {
+    const state = this.agent(agentId);
+    if (activity === "starting" || activity === "running") {
+      state.active = true;
+      return;
+    }
+    if (activity !== "idle")
+      return;
+    state.active = false;
+    state.activeAdmission = null;
+    const next = this.nextPending(state);
+    if (next && state.dispatch)
+      this.admit(agentId, next);
+  }
+  recordDeliveryAck(agentId, launchId, status) {
+    const state = this.agents.get(agentId);
+    const admission = state?.activeAdmission;
+    if (!state || !admission || admission.launchId !== launchId)
+      return;
+    if (status === "ok")
+      return;
+    for (const [channel2, coverage] of admission.coverage) {
+      const scope = state.scopes.get(channel2);
+      if (scope?.admittedSeq === coverage.admittedSeq) {
+        scope.admittedSeq = coverage.previousSeq;
+      }
+    }
+    state.active = false;
+    state.failedAdmissionLaunchId = launchId;
+    state.retryAfterFailure = state.coalescedReplacement;
+    state.coalescedReplacement = null;
+    state.activeAdmission = null;
+    if (!state.admitting && state.retryAfterFailure) {
+      this.retryFailedAdmission(agentId, state).catch(() => {});
+    }
+  }
+  invalidate(agentId, clearModelSeen) {
+    const state = this.agent(agentId);
+    state.observationGeneration += 1;
+    state.active = false;
+    state.admitting = false;
+    state.activeAdmission = null;
+    state.failedAdmissionLaunchId = null;
+    state.coalescedReplacement = null;
+    state.retryAfterFailure = null;
+    if (clearModelSeen) {
+      state.scopes.clear();
+      return;
+    }
+    for (const scope of state.scopes.values()) {
+      scope.desiredSeq = scope.modelSeenSeq;
+      scope.admittedSeq = scope.modelSeenSeq;
+    }
+  }
+  agent(agentId) {
+    let state = this.agents.get(agentId);
+    if (!state) {
+      state = {
+        active: false,
+        admitting: false,
+        activeAdmission: null,
+        failedAdmissionLaunchId: null,
+        coalescedReplacement: null,
+        retryAfterFailure: null,
+        observationGeneration: 0,
+        scopes: new Map,
+        dispatch: null
+      };
+      this.agents.set(agentId, state);
+    }
+    return state;
+  }
+  nextPending(state) {
+    let next = null;
+    for (const scope of state.scopes.values()) {
+      if (scope.desiredSeq <= Math.max(scope.modelSeenSeq, scope.admittedSeq))
+        continue;
+      if (!scope.command)
+        continue;
+      if (scope.command.launchId === state.failedAdmissionLaunchId)
+        continue;
+      if (!next || scope.desiredSeq > next.desiredSeq)
+        next = scope;
+    }
+    return next?.command ?? null;
+  }
+  async admit(agentId, preferred) {
+    const state = this.agent(agentId);
+    if (state.active || state.admitting || !state.dispatch)
+      return;
+    const admissionGeneration = state.observationGeneration;
+    const command = preferred ?? this.nextPending(state);
+    if (!command)
+      return;
+    const commandScope = state.scopes.get(command.unreadNotice.channel);
+    if (commandScope && command.unreadNotice.latestSeq >= commandScope.desiredSeq) {
+      commandScope.command = command;
+    }
+    const coverage = new Map;
+    for (const [channel2, scope] of state.scopes) {
+      if (scope.desiredSeq <= Math.max(scope.modelSeenSeq, scope.admittedSeq))
+        continue;
+      coverage.set(channel2, {
+        previousSeq: scope.admittedSeq,
+        admittedSeq: scope.desiredSeq
+      });
+      scope.admittedSeq = scope.desiredSeq;
+      scope.command = command;
+    }
+    if (coverage.size === 0)
+      return;
+    state.admitting = true;
+    state.active = true;
+    state.failedAdmissionLaunchId = null;
+    state.coalescedReplacement = null;
+    state.activeAdmission = { launchId: command.launchId, coverage };
+    let dispatchError;
+    try {
+      await state.dispatch(command);
+    } catch (error51) {
+      if (state.observationGeneration === admissionGeneration) {
+        for (const [channel2, admitted] of coverage) {
+          const scope = state.scopes.get(channel2);
+          if (scope?.admittedSeq === admitted.admittedSeq) {
+            scope.admittedSeq = admitted.previousSeq;
+          }
+        }
+        state.active = false;
+        state.failedAdmissionLaunchId = command.launchId;
+        state.retryAfterFailure = state.coalescedReplacement;
+        state.coalescedReplacement = null;
+        state.activeAdmission = null;
+      }
+      dispatchError = error51;
+    } finally {
+      if (state.observationGeneration === admissionGeneration) {
+        state.admitting = false;
+      }
+    }
+    if (state.observationGeneration === admissionGeneration) {
+      await this.retryFailedAdmission(agentId, state);
+      if (!state.active && !state.admitting) {
+        const next = this.nextPending(state);
+        if (next)
+          await this.admit(agentId, next);
+      }
+    }
+    if (dispatchError)
+      throw dispatchError;
+  }
+  rememberReplacement(state, command) {
+    const failedOrActiveLaunchId = state.activeAdmission?.launchId ?? state.failedAdmissionLaunchId;
+    if (!failedOrActiveLaunchId || command.launchId === failedOrActiveLaunchId)
+      return;
+    const scope = state.scopes.get(command.unreadNotice.channel);
+    if (!scope || command.unreadNotice.latestSeq < scope.desiredSeq)
+      return;
+    state.coalescedReplacement = command;
+    if (state.failedAdmissionLaunchId)
+      state.retryAfterFailure = command;
+  }
+  async retryFailedAdmission(agentId, state) {
+    if (state.active || state.admitting)
+      return;
+    const replacement = state.retryAfterFailure;
+    state.retryAfterFailure = null;
+    if (!replacement)
+      return;
+    state.failedAdmissionLaunchId = null;
+    await this.admit(agentId, replacement);
+  }
+}
+
 // src/server/wsControlChannel.ts
 var WS_CONTROL_COMMAND_CONSUMED = Symbol("ws-control-command-consumed");
 var DEFAULT_PING_INTERVAL_MS = 15000;
@@ -21794,6 +22077,7 @@ class WsControlChannel {
   opts;
   statusValue = "idle";
   commandCbs = [];
+  wakeDesiredCbs = [];
   resyncHooks = [];
   ws = null;
   attempt = 0;
@@ -21803,6 +22087,7 @@ class WsControlChannel {
   pongDeadline = 0;
   resyncProvider = null;
   log;
+  wakeCoordinator = new WakeCoordinator;
   constructor(opts) {
     this.opts = opts;
     this.log = opts.logger ?? createLogger2({ header: "@alook/daemon:ws" });
@@ -21825,6 +22110,30 @@ class WsControlChannel {
   onCommand(cb) {
     this.commandCbs.push(cb);
   }
+  onWakeDesiredAdvance(cb) {
+    this.wakeDesiredCbs.push(cb);
+  }
+  async ingestCommand(frame) {
+    const parsed = HostCommandSchema.safeParse(frame);
+    if (!parsed.success) {
+      this.log.warn("dropped malformed HostCommand frame", {
+        type: typeof frame === "object" && frame !== null && "type" in frame ? String(frame.type) : "unknown",
+        issues: parsed.error.issues.map((issue3) => ({
+          path: issue3.path.join("."),
+          code: issue3.code
+        }))
+      });
+      return false;
+    }
+    await this.dispatchIngressCommand(parsed.data);
+    return true;
+  }
+  modelSeenGeneration(agentId) {
+    return this.wakeCoordinator.modelSeenGeneration(agentId);
+  }
+  recordModelSeen(agentId, messages, generation = this.wakeCoordinator.modelSeenGeneration(agentId)) {
+    return this.wakeCoordinator.recordModelSeen(agentId, messages, generation);
+  }
   onResync(provider) {
     this.resyncProvider = provider;
   }
@@ -21841,6 +22150,7 @@ class WsControlChannel {
     this.sendFrame({ type: "agent_session", ...info });
   }
   async reportAgentActivity(info) {
+    this.wakeCoordinator.recordAgentActivity(info.agentId, info.state);
     this.sendFrame({ type: "agent_activity", ...info });
   }
   reportAgentTyping(info) {
@@ -21853,6 +22163,7 @@ class WsControlChannel {
     this.sendFrame(frame);
   }
   async reportWakeAck(info) {
+    this.wakeCoordinator.recordDeliveryAck(info.agentId, info.launchId, info.status);
     this.sendFrame({ type: "agent_wake_ack", ...info });
   }
   async reportStoppedAck(info) {
@@ -21924,27 +22235,75 @@ class WsControlChannel {
       return;
     }
     this.attempt = 0;
-    const parsed = HostCommandSchema.safeParse(frame);
-    if (!parsed.success) {
-      this.log.warn("dropped malformed HostCommand frame", {
-        type: frame.type,
-        issues: parsed.error.issues.map((i) => ({ path: i.path.join("."), code: i.code }))
-      });
-      return;
-    }
-    const cmd = parsed.data;
+    this.ingestCommand(frame).catch((err) => {
+      this.log.warn("command ingress failed", { type: frame.type, err: describeErr(err) });
+    });
+  }
+  async dispatchListeners(cmd) {
+    const pending = [];
     for (const cb of this.commandCbs) {
       try {
         const result = cb(cmd);
         if (result === WS_CONTROL_COMMAND_CONSUMED)
           break;
-        Promise.resolve(result).catch((err) => {
+        pending.push(Promise.resolve(result).catch((err) => {
           this.log.warn("command listener threw", { type: cmd.type, err: describeErr(err) });
-        });
+        }));
       } catch (err) {
         this.log.warn("command listener threw synchronously", { type: cmd.type, err: describeErr(err) });
       }
     }
+    await Promise.all(pending);
+  }
+  async dispatchIngressCommand(cmd) {
+    if (cmd.type === "machine:heartbeat") {
+      this.sendFrame({ type: "machine_heartbeat_ack", nonce: cmd.nonce });
+      return;
+    }
+    if (cmd.type === "diagnostics:collect") {
+      this.sendFrame({ type: "diagnostics_ack", reportId: cmd.reportId });
+      await this.dispatchListeners(cmd);
+      return;
+    }
+    if (cmd.type === "agent:wake") {
+      const result = await this.wakeCoordinator.run(cmd, (accepted) => this.dispatchListeners(accepted), (advanced) => {
+        for (const cb of this.wakeDesiredCbs) {
+          try {
+            cb(advanced);
+          } catch (err) {
+            this.log.warn("wake desired observer threw", { err: describeErr(err) });
+          }
+        }
+      });
+      if (result.state === "suppressed") {
+        await this.reportWakeAck({
+          agentId: cmd.agentId,
+          launchId: cmd.launchId,
+          status: "ok"
+        });
+        this.log.debug("duplicate wake suppressed", {
+          agentId: cmd.agentId,
+          channel: cmd.unreadNotice.channel,
+          latestSeq: cmd.unreadNotice.latestSeq,
+          coveredSeq: result.coveredSeq
+        });
+      }
+      return;
+    }
+    if (cmd.type === "machine:reset_all") {
+      for (const reset of cmd.resets)
+        this.wakeCoordinator.invalidate(reset.agentId, true);
+      await this.dispatchListeners(cmd);
+      return;
+    }
+    if (cmd.type === "agent:stop" || cmd.type === "agent:model_switch") {
+      this.wakeCoordinator.invalidate(cmd.agentId, false);
+    } else if (cmd.type === "agent:reset" || cmd.type === "agent:nap") {
+      this.wakeCoordinator.invalidate(cmd.agentId, true);
+    } else if (cmd.type === "bot:removed") {
+      this.wakeCoordinator.invalidate(cmd.botId, true);
+    }
+    await this.dispatchListeners(cmd);
   }
   onSocketClosed(code, reason) {
     this.log.warn("control channel closed", { code, reason: reason ? String(reason) : "" });
@@ -21979,7 +22338,10 @@ class WsControlChannel {
     this.pingTimer = setInterval(() => {
       if (this.now() > this.pongDeadline) {
         this.log.warn("heartbeat pong timeout — forcing reconnect");
-        this.ws?.close();
+        if (this.ws?.terminate)
+          this.ws.terminate();
+        else
+          this.ws?.close();
         return;
       }
       this.log.debug("heartbeat ping");
@@ -22131,6 +22493,14 @@ function writeJson(res, status, body) {
   res.writeHead(status, { "content-type": "application/json" });
   res.end(JSON.stringify(body));
 }
+function normalizeContentEncoding(value) {
+  const normalized = (Array.isArray(value) ? value.join(",") : value ?? "").trim().toLowerCase();
+  if (!normalized || normalized === "identity")
+    return "identity";
+  if (normalized === "gzip" || normalized === "deflate" || normalized === "br")
+    return normalized;
+  return "other";
+}
 function isCanonicalChannelScope(channel2) {
   try {
     const parsed = parseRef(channel2);
@@ -22227,6 +22597,11 @@ async function startCredentialProxy(broker, options = {}) {
   const upstreamClient = upstream.protocol === "https:" ? https : http;
   const onPull = options.onInboxPullResponse;
   const onProxyRequest = options.onProxyRequest;
+  const reportInboxPullObservationError = (failure) => {
+    try {
+      options.onInboxPullObservationError?.(failure);
+    } catch {}
+  };
   const server = http.createServer((req, res) => {
     const pathname = new URL2(req.url ?? "/", "http://placeholder").pathname;
     if (pathname.startsWith("/__alook/local/")) {
@@ -22265,7 +22640,20 @@ async function startCredentialProxy(broker, options = {}) {
       return;
     }
     const reg = verdict.reg;
-    const isInboxPull = onPull && pathname === "/api/community/users/me/inbox/pull";
+    const isInboxPull = req.method === "POST" && pathname === "/api/community/users/me/inbox/pull";
+    const shouldObserveInboxPull = Boolean(isInboxPull && onPull);
+    let inboxPullObservationToken;
+    if (shouldObserveInboxPull) {
+      try {
+        inboxPullObservationToken = options.onInboxPullStart?.(reg.agentId);
+      } catch {
+        reportInboxPullObservationError({
+          agentId: reg.agentId,
+          reason: "observer_failed",
+          contentEncoding: "identity"
+        });
+      }
+    }
     if (onProxyRequest) {
       try {
         onProxyRequest(reg.agentId, req.method ?? "GET", pathname);
@@ -22278,6 +22666,8 @@ async function startCredentialProxy(broker, options = {}) {
     outHeaders[broker.headerNames.agentId.toLowerCase()] = reg.agentId;
     outHeaders[broker.headerNames.client.toLowerCase()] = broker.clientLabel;
     outHeaders[broker.headerNames.capabilities.toLowerCase()] = [...reg.capabilities].join(",");
+    if (isInboxPull)
+      outHeaders["accept-encoding"] = "identity";
     let responded = false;
     let upstreamRes;
     const upstreamReq = upstreamClient.request({
@@ -22296,18 +22686,54 @@ async function startCredentialProxy(broker, options = {}) {
       };
       res_.on("error", destroyResIfIncomplete);
       res_.on("close", destroyResIfIncomplete);
-      if (isInboxPull && res_.statusCode && res_.statusCode < 300) {
+      if (shouldObserveInboxPull && res_.statusCode !== undefined && res_.statusCode >= 200 && res_.statusCode < 300) {
         const chunks = [];
         res_.on("data", (chunk2) => chunks.push(chunk2));
         res_.on("end", () => {
           const body = Buffer.concat(chunks);
+          const contentEncoding = normalizeContentEncoding(res_.headers["content-encoding"]);
+          if (contentEncoding !== "identity") {
+            reportInboxPullObservationError({
+              agentId: reg.agentId,
+              reason: "unexpected_content_encoding",
+              contentEncoding
+            });
+          } else {
+            let parsed;
+            try {
+              parsed = JSON.parse(body.toString("utf8"));
+            } catch {
+              reportInboxPullObservationError({
+                agentId: reg.agentId,
+                reason: "invalid_json",
+                contentEncoding
+              });
+            }
+            if (parsed !== undefined) {
+              if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !Array.isArray(parsed.messages)) {
+                reportInboxPullObservationError({
+                  agentId: reg.agentId,
+                  reason: "invalid_inbox_shape",
+                  contentEncoding
+                });
+              } else {
+                const messages = parsed.messages;
+                if (messages.length > 0) {
+                  try {
+                    onPull(reg.agentId, messages, inboxPullObservationToken);
+                  } catch {
+                    reportInboxPullObservationError({
+                      agentId: reg.agentId,
+                      reason: "observer_failed",
+                      contentEncoding
+                    });
+                  }
+                }
+              }
+            }
+          }
           res.writeHead(res_.statusCode, res_.headers);
           res.end(body);
-          try {
-            const parsed = JSON.parse(body.toString());
-            if (parsed.messages)
-              onPull(reg.agentId, parsed.messages);
-          } catch {}
         });
       } else {
         res.writeHead(res_.statusCode ?? 502, res_.headers);
@@ -23226,17 +23652,17 @@ function extractToolAudit(rawName, rawInput) {
       return { name, suppressed: false };
     return { name, target: truncateTargetToCodeUnits(firstLine), suppressed: false };
   }
-  let target;
+  let target2;
   if (cls === "file_target")
-    target = pickFileTarget(rawInput);
+    target2 = pickFileTarget(rawInput);
   else if (cls === "pattern")
-    target = pickPatternTarget(rawInput);
+    target2 = pickPatternTarget(rawInput);
   else
-    target = pickFallthroughTarget(rawInput);
-  if (typeof target !== "string" || target.length === 0) {
+    target2 = pickFallthroughTarget(rawInput);
+  if (typeof target2 !== "string" || target2.length === 0) {
     return { name, suppressed: false };
   }
-  return { name, target: truncateTargetToCodeUnits(target), suppressed: false };
+  return { name, target: truncateTargetToCodeUnits(target2), suppressed: false };
 }
 function truncateThinking(text2) {
   const chars = [...text2].length;
@@ -24031,7 +24457,7 @@ var MODEL_SWITCH_REWAKE_PROMPT = "You were just switched to a different model. C
 function buildNapRewakePrompt(handoff) {
   return "You took a nap: you reset your own session, so prior conversation context " + `is gone. Before sleeping you left yourself this handoff —
 
-` + handoff.trim() + `
+` + handoff + `
 
 Then read @memory.md and your .context_timeline for durable context, and pull ` + "your inbox before doing anything else. If it reports marked messages, run `$ALOOK_CLI " + "message mark list` and resume that outstanding work.";
 }
@@ -24069,6 +24495,7 @@ class AgentRouter {
   buildReady() {
     return {
       runtimeReport: [...this.runtimes.values()],
+      capabilities: [CONTROL_HEARTBEAT_CAPABILITY],
       runningAgents: [...this.running],
       hostname: this.opts.hostname,
       platform: this.opts.platform,
@@ -24911,6 +25338,8 @@ function createTimelineRecorder(opts) {
       sessionByAgent.set(agentId, sessionId);
     },
     appendEntryForAgent(agentId, messages) {
+      if (messages.length === 0)
+        return;
       const dir = dirFor(agentId);
       if (!prepareTimelineDirectory(dir))
         return;
@@ -25330,7 +25759,16 @@ async function createDaemon(opts) {
   const typingTracker = createTypingScopeTracker();
   const broker = new CredentialBroker({ upstreamBaseUrl: opts.serverUrl });
   const proxy = await startCredentialProxy(broker, {
-    onInboxPullResponse: (agentId, messages) => timeline2.appendEntryForAgent(agentId, messages),
+    onInboxPullStart: (agentId) => channelRef?.modelSeenGeneration(agentId),
+    onInboxPullResponse: (agentId, messages, observationToken) => {
+      timeline2.appendEntryForAgent(agentId, messages);
+      if (typeof observationToken === "number") {
+        channelRef?.recordModelSeen(agentId, messages, observationToken);
+      }
+    },
+    onInboxPullObservationError: ({ agentId, reason, contentEncoding }) => {
+      log2.warn("inbox pull timeline observation failed", { agentId, reason, contentEncoding });
+    },
     onMessageReminderArm: (input) => reminderSchedulerRef?.arm(input) ?? { armed: false, reason: "reminder_scheduler_unavailable" },
     onProxyRequest: (agentId, method, pathname) => {
       const subcommand = deriveAuditLogSubcommand(pathname, method);
@@ -25431,11 +25869,29 @@ async function createDaemon(opts) {
       if (!res.ok)
         throw new Error(`resync-wakes ${res.status}`);
       const json2 = await res.json();
-      log2.info("wake resync completed", { woken: json2.woken ?? 0 });
+      log2.info("wake resync completed", { attempted: json2.attempted ?? 0 });
     } catch (err) {
       log2.warn("wake resync failed", { err: err instanceof Error ? err.message : String(err) });
     }
   }
+  async function resyncPendingDiagnostics() {
+    try {
+      const res = await fetch(`${opts.serverUrl}/api/community/daemon/resync-diagnostics`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${opts.machineKey}` }
+      });
+      if (!res.ok)
+        throw new Error(`resync-diagnostics ${res.status}`);
+      const json2 = await res.json();
+      log2.info("diagnostics resync completed", {
+        pending: json2.pending ?? 0,
+        attempted: json2.attempted ?? 0,
+        ambiguous: json2.ambiguous ?? 0
+      });
+    } catch (err) {
+      log2.warn("diagnostics resync failed", { err: err instanceof Error ? err.message : String(err) });
+    }
+  }
   const enrollAgent = async (agentId) => {
     const existing = enrolledKeys.get(agentId);
     if (existing)
@@ -25611,7 +26067,10 @@ async function createDaemon(opts) {
   let statusTimer = null;
   if (opts.statusFilePath) {
     const statusPath = opts.statusFilePath;
-    const writeStatus = () => writeStatusFile(statusPath, { writtenAt: Date.now(), agents: manager.statusProjection(Date.now()) });
+    const writeStatus = () => {
+      const nowMs = Date.now();
+      writeStatusFile(statusPath, { writtenAt: nowMs, agents: manager.statusProjection(nowMs) });
+    };
     writeStatus();
     statusTimer = setInterval(writeStatus, STATUS_WRITE_INTERVAL_MS);
     statusTimer.unref?.();
@@ -25658,11 +26117,11 @@ async function createDaemon(opts) {
     handleDiagnosticCommand: opts.handleDiagnosticCommand,
     reportDiagnosticFailure: opts.reportDiagnosticFailure
   }));
+  channel2.onWakeDesiredAdvance((cmd) => {
+    reminderSchedulerRef?.observe(cmd.agentId, cmd.unreadNotice.channel, cmd.unreadNotice.latestSeq);
+  });
   channel2.onCommand((cmd) => {
     switch (cmd.type) {
-      case "agent:wake":
-        reminderSchedulerRef?.observe(cmd.agentId, cmd.unreadNotice.channel, cmd.unreadNotice.latestSeq);
-        break;
       case "agent:stop":
         reminderSchedulerRef?.clearAgent(cmd.agentId);
         break;
@@ -25679,6 +26138,7 @@ async function createDaemon(opts) {
   channel2.onOpen(() => {
     coldStartWarmup();
     resyncPendingWakes();
+    resyncPendingDiagnostics();
   });
   channel2.connect();
   await router.start();
@@ -27510,6 +27970,7 @@ var STOP_GRACE_MS = 5000;
 var STOP_KILL_GRACE_MS = 2000;
 var POLL_MS2 = 100;
 var START_RECEIPT_TIMEOUT_MS = 15000;
+var PAIRING_ACTIVATION_TIMEOUT_MS = 30000;
 var RUNNER_TERM_GRACE_MS = 2000;
 var RUNNER_KILL_GRACE_MS = 2000;
 var MACHINE_ID_PATTERN = /^cm_[A-Za-z0-9_-]{8,64}$/;
@@ -27856,6 +28317,22 @@ function reconcileLegacyMachineKeyOwnership(baseDir, machineKey) {
     removePidFileIfMatches(candidate, current);
   }
 }
+function daemonLastActiveMs(snapshot, nowMs) {
+  const writtenAt = snapshot.writtenAt;
+  if (writtenAt == null || !Number.isFinite(writtenAt) || writtenAt < 0)
+    return null;
+  let latest = null;
+  for (const agent2 of snapshot.agents) {
+    const sinceProgressMs = agent2.sinceProgressMs;
+    if (!Number.isFinite(sinceProgressMs) || sinceProgressMs < 0)
+      continue;
+    const progressAt = writtenAt - sinceProgressMs;
+    if (progressAt <= 0 || progressAt > nowMs)
+      continue;
+    latest = latest == null ? progressAt : Math.max(latest, progressAt);
+  }
+  return latest;
+}
 function daemonList(opts) {
   const baseDir = opts.baseDir || process.env.ALOOK_DATA_DIR || DEFAULT_BASE_DIR;
   const dir = daemonsDir(baseDir);
@@ -27879,7 +28356,7 @@ function daemonList(opts) {
       if (s.found) {
         agents = s.agents.length;
         running = s.agents.filter((a) => a.derivedActivity === "running").length;
-        lastActiveMs = s.writtenAt;
+        lastActiveMs = daemonLastActiveMs(s, now);
       }
     }
     results.push({ id, pid: data.pid, alive, agents, running, lastActiveMs });
@@ -28036,20 +28513,58 @@ function findExistingCredentialForBearer(baseDir, bearer) {
   }
   return null;
 }
-async function activatePairingToken(serverUrl, tokenId, hostname4, platform, arch, osRelease, daemonVersion, runtimeReport) {
-  const res = await fetch(`${serverUrl}/api/community/daemon/activate`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${tokenId}`
-    },
-    body: JSON.stringify({ hostname: hostname4, platform, arch, osRelease, daemonVersion, runtimeReport })
-  });
-  const json2 = await res.json().catch(() => ({}));
-  if (!res.ok || !json2.credential || !json2.machineId) {
-    throw new Error(json2.error ?? `activate failed (${res.status})`);
+async function activatePairingToken(serverUrl, tokenId, hostname4, platform, arch, osRelease, daemonVersion, runtimeReport, expectedMachineId) {
+  let res;
+  let json2;
+  let timedOut = false;
+  const controller = new AbortController;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, PAIRING_ACTIVATION_TIMEOUT_MS);
+  timeout.unref?.();
+  try {
+    res = await fetch(`${serverUrl}/api/community/daemon/activate`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${tokenId}`
+      },
+      body: JSON.stringify({
+        hostname: hostname4,
+        platform,
+        arch,
+        osRelease,
+        daemonVersion,
+        runtimeReport,
+        ...expectedMachineId ? { expectedMachineId } : {}
+      }),
+      signal: controller.signal
+    });
+    json2 = await res.json().catch(() => null);
+  } catch (error51) {
+    throw new PairingActivationError(timedOut ? "activation timed out before commit status was known" : error51 instanceof Error ? error51.message : String(error51), "unknown");
+  } finally {
+    clearTimeout(timeout);
+  }
+  if (!res.ok) {
+    const parsed2 = CommunityDaemonActivateErrorResponseSchema.safeParse(json2);
+    throw new PairingActivationError(parsed2.success ? parsed2.data.error : `activate failed (${res.status})`, res.status >= 400 && res.status < 500 && parsed2.success ? parsed2.data.sessionOutcome : "unknown");
+  }
+  const parsed = CommunityDaemonActivateResponseSchema.safeParse(json2);
+  if (!parsed.success) {
+    throw new PairingActivationError("activate returned an invalid response", "unknown");
+  }
+  return { credential: parsed.data.credential, machineId: parsed.data.machineId };
+}
+
+class PairingActivationError extends Error {
+  sessionOutcome;
+  constructor(message2, sessionOutcome) {
+    super(message2);
+    this.sessionOutcome = sessionOutcome;
+    this.name = "PairingActivationError";
   }
-  return { credential: json2.credential, machineId: json2.machineId };
 }
 async function resolveMachineIdentity(serverUrl, credential) {
   const response = await fetch(`${serverUrl}/api/community/daemon/identity`, {
@@ -28077,12 +28592,13 @@ async function prepareDaemonStart(opts) {
     throw new Error("daemon package version is not a strict release version");
   const ownerToken = crypto5.randomBytes(24).toString("base64url");
   const persisted = opts.machineKey.startsWith("cmk_") ? findExistingCredentialForBearer(baseDir, opts.machineKey) : null;
+  const reconnectMachineId = opts.machineKey.startsWith("cmt_") && opts.expectedMachineId && opts.resumeRequestId ? validateMachineId(opts.expectedMachineId) : undefined;
   let coarseLockPath = null;
   let launchLockPath = null;
   try {
     let machineKey = persisted?.credential;
-    let machineId = persisted ? validateMachineId(persisted.machineId) : undefined;
-    if (machineKey && machineId) {
+    let machineId = persisted ? validateMachineId(persisted.machineId) : reconnectMachineId;
+    if (machineId) {
       launchLockPath = acquireLaunchLock(baseDir, machineId, ownerToken, opts.resumeRequestId);
     } else {
       coarseLockPath = acquireCoarseLock(baseDir, ownerToken);
@@ -28093,9 +28609,13 @@ async function prepareDaemonStart(opts) {
     const runtimeReport = await detectRuntimes();
     const healthyRuntimeIds = runtimeReport.filter((runtime) => runtime.status === "healthy").map((runtime) => runtime.id);
     if (opts.machineKey.startsWith("cmt_")) {
-      const activated = await activatePairingToken(serverUrl, opts.machineKey, os3.hostname(), process.platform, process.arch, os3.release(), daemonVersion, runtimeReport);
+      opts.onActivationAttempt?.();
+      const activated = await activatePairingToken(serverUrl, opts.machineKey, os3.hostname(), process.platform, process.arch, os3.release(), daemonVersion, runtimeReport, opts.expectedMachineId);
       machineKey = activated.credential;
       machineId = validateMachineId(activated.machineId);
+      if (opts.expectedMachineId && machineId !== validateMachineId(opts.expectedMachineId)) {
+        throw new Error("activate returned a different machine identity");
+      }
     } else {
       machineKey ??= opts.machineKey;
       machineId ??= validateMachineId(await resolveMachineIdentity(serverUrl, opts.machineKey));
@@ -28109,6 +28629,7 @@ async function prepareDaemonStart(opts) {
       wsUrl,
       daemonVersion
     });
+    if (false) {}
     if (coarseLockPath)
       removeOwnedFile(coarseLockPath, process.pid, ownerToken);
     const startedAt = new Date().toISOString();
@@ -28167,6 +28688,66 @@ async function daemonStartById(opts) {
     foreground: opts.foreground
   });
 }
+function pidOwnershipEqual(a, b) {
+  if (!a || !b)
+    return a === b;
+  return a.pid === b.pid && a.machineId === b.machineId && a.startedAt === b.startedAt && a.ownerToken === b.ownerToken;
+}
+async function daemonReconnect(opts, deps = {}) {
+  if (!opts.machineKey.startsWith("cmt_")) {
+    throw new Error("daemon reconnect requires a cmt_ pairing token");
+  }
+  const machineId = validateMachineId(opts.id);
+  const baseDir = opts.baseDir || process.env.ALOOK_DATA_DIR || DEFAULT_BASE_DIR;
+  const launch = readDaemonLaunchRecord(baseDir, machineId);
+  const pidPath = pidfilePathById(baseDir, machineId);
+  const before = readPidFile(pidPath);
+  if (before && (before.machineId !== machineId || !before.startedAt || !before.ownerToken)) {
+    throw new Error("daemon reconnect cannot verify the current pid ownership tuple");
+  }
+  const requestId = crypto5.randomUUID();
+  const replacement = acquireDaemonReplacementLock({ baseDir, machineId, requestId });
+  let oldStopped = false;
+  let activationAttempted = false;
+  try {
+    const owned = readPidFile(pidPath);
+    if (!pidOwnershipEqual(before, owned)) {
+      throw new Error("daemon ownership changed after reconnect lock acquisition");
+    }
+    if (owned && (deps.isProcessAlive ?? isProcessAlive)(owned.pid)) {
+      await (deps.stopExactDaemonPid ?? stopExactDaemonPid)(owned.pid);
+      oldStopped = true;
+      removePidFileIfMatches(pidPath, owned);
+    } else if (owned) {
+      removePidFileIfMatches(pidPath, owned);
+    }
+    try {
+      await (deps.start ?? daemonStart)({
+        machineKey: opts.machineKey,
+        serverUrl: opts.serverUrl ?? launch.serverUrl,
+        wsUrl: opts.wsUrl ?? launch.wsUrl,
+        baseDir,
+        resumeRequestId: requestId,
+        expectedMachineId: machineId,
+        onActivationAttempt: () => {
+          activationAttempted = true;
+        }
+      });
+    } catch (error51) {
+      const canRestoreOldEpoch = !activationAttempted || error51 instanceof PairingActivationError && error51.sessionOutcome === "not_committed";
+      if (oldStopped && canRestoreOldEpoch) {
+        try {
+          await (deps.resume ?? daemonResume)({ id: machineId, baseDir, requestId });
+        } catch (rollbackError) {
+          throw new AggregateError([error51, rollbackError], "reconnect failed before rotation and the prior daemon could not be resumed");
+        }
+      }
+      throw error51;
+    }
+  } finally {
+    removeReplacementLockIfMatches(replacement.path, replacement.lock);
+  }
+}
 function runnerArguments() {
   const command = process.env.ALOOK_DAEMON_PACKAGE_WRAPPER === "1" ? ["run"] : ["daemon", "run"];
   return [...process.execArgv, process.argv[1], ...command];
@@ -28502,7 +29083,38 @@ var TEXT_ESCAPE_MAP = { n: `
 function decodeTextEscapes(s) {
   return s.replace(/\\(.)/g, (m, c) => TEXT_ESCAPE_MAP[c] ?? m);
 }
-var CLIENT_MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+async function readLiteralInput(args) {
+  const { command, stdinSelected, stdin, filePath, fileOption } = args;
+  if (stdinSelected && filePath !== undefined) {
+    throw new CliError(`${command}: --stdin and ${fileOption} are mutually exclusive`);
+  }
+  if (stdinSelected) {
+    if (!stdin)
+      throw new CliError(`${command}: stdin is unavailable`);
+    if (stdin.isTTY === true) {
+      throw new CliError(`${command}: --stdin requires piped input; use ${fileOption} in an interactive terminal`);
+    }
+    try {
+      const chunks = [];
+      for await (const chunk2 of stdin) {
+        chunks.push(typeof chunk2 === "string" ? Buffer.from(chunk2, "utf8") : Buffer.from(chunk2));
+      }
+      return Buffer.concat(chunks).toString("utf8");
+    } catch (err) {
+      throw new CliError(`${command}: cannot read stdin: ${err.message}`);
+    }
+  }
+  if (filePath !== undefined) {
+    const fs13 = await import("fs/promises");
+    try {
+      return await fs13.readFile(filePath, "utf8");
+    } catch (err) {
+      throw new CliError(`${command}: cannot read file: ${err.message}`);
+    }
+  }
+  return;
+}
+var CLIENT_MAX_ATTACHMENT_BYTES = 26214400;
 function contentTypeFromFilename(filename) {
   const ext = filename.slice(filename.lastIndexOf(".") + 1).toLowerCase();
   switch (ext) {
@@ -28560,7 +29172,7 @@ async function withTransientMutationRetry(mutation) {
 async function sendWithRetry(api2, req) {
   return withTransientMutationRetry(() => api2.send(req));
 }
-async function cmdMessageSend(opts) {
+async function cmdMessageSend(opts, stdin) {
   const remindAfterFlag = opts.remindAfter;
   const remindAfterMs = remindAfterFlag === undefined ? undefined : parseRemindAfter(remindAfterFlag);
   const api2 = getApi();
@@ -28568,21 +29180,18 @@ async function cmdMessageSend(opts) {
   const channel2 = opts.target;
   if (!channel2)
     throw new CliError("message send: --target <ref> is required (e.g. /demo-workspace#1234/general)");
-  let text2;
   const fileFlag = opts.file;
-  const textFlag = opts.text;
-  if (fileFlag) {
-    const fs13 = await import("fs");
-    if (!fs13.existsSync(fileFlag))
-      throw new CliError(`message send: file not found: ${fileFlag}`);
-    text2 = fs13.readFileSync(fileFlag, "utf8").trim();
-  } else if (typeof textFlag === "string") {
-    text2 = decodeTextEscapes(textFlag);
-  }
+  const text2 = await readLiteralInput({
+    command: "message send",
+    stdinSelected: opts.stdin === true,
+    stdin,
+    filePath: fileFlag,
+    fileOption: "--file <path>"
+  });
   const attachmentIds = Array.isArray(opts.attachment) ? opts.attachment : [];
   const hasText = typeof text2 === "string" && text2.trim().length > 0;
   if (!hasText && attachmentIds.length === 0) {
-    throw new CliError("message send: --text <text>, --file <path>, or --attachment <id> is required");
+    throw new CliError("message send: --stdin, --file <path>, or --attachment <id> is required");
   }
   let replyToSeq;
   const replyFlag = opts.reply;
@@ -28595,7 +29204,7 @@ async function cmdMessageSend(opts) {
     }
     replyToSeq = n;
   }
-  const nonce = randomUUID6();
+  const nonce = randomUUID7();
   const res = await sendWithRetry(api2, {
     agentId: agent2,
     channel: channel2,
@@ -28626,71 +29235,32 @@ async function cmdMessageSend(opts) {
     return { sent, reminder: { armed: false, reason: "local reminder request failed" } };
   }
 }
-async function createPostWithRetry(api2, req) {
-  return withTransientMutationRetry(() => api2.createPost(req));
-}
-async function cmdMessagePost(opts) {
-  const api2 = getApi();
-  const agent2 = agentId(opts);
-  const forum = opts.target;
-  if (!forum)
-    throw new CliError("message post: --target <forum-ref> is required (e.g. /demo#1234/ideas)");
-  const title = opts.title;
-  if (!title || title.trim().length === 0)
-    throw new CliError("message post: --title <name> is required");
-  let text2;
-  const fileFlag = opts.file;
-  const textFlag = opts.text;
-  if (fileFlag) {
-    const fs13 = await import("fs");
-    if (!fs13.existsSync(fileFlag))
-      throw new CliError(`message post: file not found: ${fileFlag}`);
-    text2 = fs13.readFileSync(fileFlag, "utf8").trim();
-  } else if (typeof textFlag === "string") {
-    text2 = decodeTextEscapes(textFlag);
-  }
-  const attachmentIds = Array.isArray(opts.attachment) ? opts.attachment : [];
-  const hasText = typeof text2 === "string" && text2.trim().length > 0;
-  if (!hasText && attachmentIds.length === 0) {
-    throw new CliError("message post: --text <text>, --file <path>, or --attachment <id> is required");
-  }
-  const nonce = randomUUID6();
-  const res = await createPostWithRetry(api2, {
-    agentId: agent2,
-    forum,
-    title: title.trim(),
-    content: { text: text2 ?? "" },
-    attachments: attachmentIds.length > 0 ? attachmentIds : undefined,
-    nonce
-  });
-  return { posted: res.ref };
-}
 async function cmdMessageEmoji(opts) {
   const api2 = getApi();
-  const target = opts.target;
+  const target2 = opts.target;
   const emoji3 = opts.emoji;
-  if (!target)
+  if (!target2)
     throw new CliError("message emoji: --target <ref> is required (e.g. /demo#1234/general#42)");
   if (!emoji3)
     throw new CliError("message emoji: --emoji <string> is required");
-  const { channel: channel2, seq } = parseMessageTarget("message emoji", target);
+  const { channel: channel2, seq } = parseMessageTarget("message emoji", target2);
   if (Buffer.byteLength(emoji3, "utf8") > MAX_EMOJI_BYTES) {
     const err = new CliError("emoji is too long");
     err.hint = "use a single emoji, not a phrase";
     throw err;
   }
   const res = await api2.reactAdd({ channel: channel2, seq, emoji: emoji3 });
-  return { target, emoji: emoji3, duplicate: res.duplicate === true };
+  return { target: target2, emoji: emoji3, duplicate: res.duplicate === true };
 }
-function parseMessageTarget(command, target) {
+function parseMessageTarget(command, target2) {
   let parsed;
   try {
-    parsed = parseRef(target);
+    parsed = parseRef(target2);
   } catch (err) {
     throw new CliError(`${command}: ${err.message}`);
   }
   if (parsed.seq === undefined) {
-    const err = new CliError(`${command} needs a ref with a seq (e.g. ${target}#42)`);
+    const err = new CliError(`${command} needs a ref with a seq (e.g. ${target2}#42)`);
     err.hint = "pass --target /<server>/<channel>#N, /<server>/<channel>/#N#M for thread reply, or /.dm/<peer>#N";
     throw err;
   }
@@ -28699,21 +29269,21 @@ function parseMessageTarget(command, target) {
 }
 async function cmdMessageMarkSet(opts) {
   const api2 = getApi();
-  const target = opts.target;
-  if (!target)
+  const target2 = opts.target;
+  if (!target2)
     throw new CliError("message mark set: --target <ref> is required");
-  const request = parseMessageTarget("message mark set", target);
+  const request = parseMessageTarget("message mark set", target2);
   await withTransientMutationRetry(() => api2.markSet(request));
-  return { target, marked: true };
+  return { target: target2, marked: true };
 }
 async function cmdMessageMarkRemove(opts) {
   const api2 = getApi();
-  const target = opts.target;
-  if (!target)
+  const target2 = opts.target;
+  if (!target2)
     throw new CliError("message mark remove: --target <ref> is required");
-  const request = parseMessageTarget("message mark remove", target);
+  const request = parseMessageTarget("message mark remove", target2);
   await withTransientMutationRetry(() => api2.markRemove(request));
-  return { target, marked: false };
+  return { target: target2, marked: false };
 }
 async function cmdMessageMarkList(opts) {
   const api2 = getApi();
@@ -28723,9 +29293,9 @@ async function cmdMessageMarkList(opts) {
 async function cmdAttachmentUpload(opts) {
   const api2 = getApi();
   const agent2 = agentId(opts);
-  const target = opts.target;
+  const target2 = opts.target;
   const filePath = opts.file;
-  if (!target)
+  if (!target2)
     throw new CliError("message attachment upload: --target <ref> is required");
   if (!filePath)
     throw new CliError("message attachment upload: --file <path> is required");
@@ -28766,7 +29336,7 @@ async function cmdAttachmentUpload(opts) {
   }
   const result = await api2.attachmentUpload({
     agentId: agent2,
-    target,
+    target: target2,
     file: { data: new Uint8Array(bytes), filename, contentType },
     ...thumbnail ? { thumbnail } : {},
     ...width !== undefined ? { width } : {},
@@ -28846,6 +29416,7 @@ async function cmdInboxPull(opts) {
   const pulledAt = nowLocalISO();
   let acked = 0;
   let ackError;
+  let failed;
   if (opts.ack !== false && messages.length > 0) {
     const latest = new Map;
     for (const m of messages) {
@@ -28855,8 +29426,9 @@ async function cmdInboxPull(opts) {
         latest.set(m.channel, { channel: m.channel, seq: seqN });
     }
     try {
-      await api2.ack({ agentId: agent2, cursors: [...latest.values()] });
-      acked = latest.size;
+      const result = await api2.ack({ agentId: agent2, cursors: [...latest.values()] });
+      acked = result.applied.length;
+      failed = result.failed;
     } catch (err) {
       ackError = err instanceof Error ? err.message : String(err);
     }
@@ -28866,6 +29438,7 @@ async function cmdInboxPull(opts) {
     hasMore,
     acked,
     pulledAt,
+    ...failed ? { failed } : {},
     ...ackError ? { ackError } : {},
     ...markedCount > 0 ? {
       markedReminder: `You have ${markedCount} marked ${markedCount === 1 ? "message" : "messages"}. Resolve ${markedCount === 1 ? "it" : "them"} before going dark unless blocked.`
@@ -28961,38 +29534,28 @@ async function cmdFriendList(opts) {
 async function cmdNap(opts) {
   const api2 = getApi();
   const fileFlag = opts.handoff;
-  const textFlag = opts.text;
-  let handoff;
-  if (fileFlag) {
-    const fs13 = await import("fs");
-    if (!fs13.existsSync(fileFlag))
-      throw new CliError(`nap: handoff file not found: ${fileFlag}`);
-    handoff = fs13.readFileSync(fileFlag, "utf8").trim();
-  } else if (typeof textFlag === "string") {
-    handoff = decodeTextEscapes(textFlag).trim();
-  }
-  if (!handoff) {
-    throw new CliError("nap: a handoff is required — pass --handoff <file> or --text <note>");
+  const handoff = await readLiteralInput({
+    command: "nap",
+    stdinSelected: false,
+    filePath: fileFlag,
+    fileOption: "--handoff <file>"
+  });
+  if (handoff === undefined || handoff.trim().length === 0) {
+    throw new CliError("nap: a handoff is required — pass --handoff <file>");
   }
   return await api2.nap({ handoff });
 }
-function buildProgram() {
+function buildProgram(stdin) {
   const program = new Command("alook").description("agent CLI").exitOverride().configureOutput({
     writeOut: () => {},
     writeErr: () => {}
   }).option("--agent <id>", "agent identity (or ALOOK_AGENT_ID env)");
   const message2 = program.command("message").description("message operations").exitOverride();
   message2.configureOutput({ writeOut: () => {}, writeErr: () => {} });
-  message2.command("send").description("send a message to a channel, DM, or thread").option("--target <ref>", "destination (path-style ref, e.g. /demo-workspace#1234/general)").option("--text <text>", "inline message body (short messages)").option("--file <path>", "read message body from a file (long messages)").option("-a, --attachment <id>", "attach an uploaded file by id (repeatable — order = message order)", (v, prev = []) => [...prev, v], []).option("--reply <seq>", 'reply to a message by its seq in --target (e.g. "#37" or 37)').option("--remind-after <duration>", "optionally arm one local follow-up wake after 1m..24h; a newer same-scope message or daemon restart cancels it").exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
-    const localOpts = this.opts();
-    const globalOpts = program.opts();
-    const result = await cmdMessageSend({ ...globalOpts, ...localOpts });
-    printEnvelope({ success: result });
-  });
-  message2.command("post").description("create a new forum post in a forum").option("--target <forum-ref>", "the forum to post in (path-style ref, e.g. /demo#1234/ideas)").option("--title <name>", "the post title (its slug becomes the post's address)").option("--text <text>", "inline post body (short)").option("--file <path>", "read post body from a file (long)").option("-a, --attachment <id>", "attach an uploaded file by id (repeatable — order = body order)", (v, prev = []) => [...prev, v], []).exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
+  message2.command("send").description("send a message to a channel, DM, or thread").option("--target <ref>", "destination (path-style ref, e.g. /demo-workspace#1234/general)").option("--stdin", "read the literal UTF-8 message body from non-TTY stdin").option("--file <path>", "read the literal UTF-8 message body from a file").option("-a, --attachment <id>", "attach an uploaded file by id (repeatable — order = message order)", (v, prev = []) => [...prev, v], []).option("--reply <seq>", 'reply to a message by its seq in --target (e.g. "#37" or 37)').option("--remind-after <duration>", "optionally arm one local follow-up wake after 1m..24h; a newer same-scope message or daemon restart cancels it").exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
     const localOpts = this.opts();
     const globalOpts = program.opts();
-    const result = await cmdMessagePost({ ...globalOpts, ...localOpts });
+    const result = await cmdMessageSend({ ...globalOpts, ...localOpts }, stdin);
     printEnvelope({ success: result });
   });
   message2.command("emoji").description("react to a message with a single emoji").requiredOption("--target <ref>", "message ref (path-style, e.g. /demo#1234/general#42 or /.dm/peer#0007#42)").requiredOption("--emoji <string>", "single emoji character").exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
@@ -29097,7 +29660,7 @@ function buildProgram() {
     const result = await cmdSettingProfile({ ...program.opts(), ...this.opts() });
     printEnvelope({ success: result });
   });
-  program.command("nap").description("end your session and start fresh, carrying a handoff to your reborn self (read the nap rule first)").option("--handoff <file>", "path to your handoff note (your note to your reborn self)").option("--text <note>", "inline handoff note (alternative to --handoff)").exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
+  program.command("nap").description("end your session and start fresh, carrying a handoff to your reborn self (read the nap rule first)").option("--handoff <file>", "path to your handoff note (your note to your reborn self)").exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
     const localOpts = this.opts();
     const globalOpts = program.opts();
     const result = await cmdNap({ ...globalOpts, ...localOpts });
@@ -29131,6 +29694,16 @@ function buildProgram() {
   daemon.command("run", { hidden: true }).exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async () => {
     await daemonRunFromIpc();
   });
+  daemon.command("reconnect").description("rotate and reconnect one previously paired machine").requiredOption("--id <machineId>", "machine id shown by daemon list").requiredOption("--machine-key <key>", "cmt_ reconnect token").option("--server-url <url>", "server HTTP URL (defaults to the saved launch record)").option("--ws-url <url>", "server WebSocket URL (defaults to the saved launch record)").option("--base-dir <path>", "data directory for agent workspaces and pidfile").exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
+    const localOpts = this.opts();
+    await daemonReconnect({
+      id: localOpts.id,
+      machineKey: localOpts.machineKey,
+      serverUrl: localOpts.serverUrl,
+      wsUrl: localOpts.wsUrl,
+      baseDir: localOpts.baseDir
+    });
+  });
   daemon.command("resume", { hidden: true }).requiredOption("--id <machineId>").requiredOption("--base-dir <path>").requiredOption("--request-id <id>").exitOverride().configureOutput({ writeOut: () => {}, writeErr: () => {} }).action(async function() {
     const localOpts = this.opts();
     await daemonResume({
@@ -29178,8 +29751,9 @@ function buildProgram() {
   });
   return program;
 }
-async function main(argv = process.argv.slice(2)) {
-  const program = buildProgram();
+async function main(argv = process.argv.slice(2), io = {}) {
+  const stdin = io.stdin ?? process.stdin;
+  const program = buildProgram(stdin);
   let internalExitCode = 0;
   try {
     await program.parseAsync(argv, { from: "user" });