@alook/daemon 0.1.32 → 0.1.33

package/dist/cli/index.js

@@ -15888,6 +15888,7 @@ __export(exports_schema, {
   user: () => user,
   taskMessage: () => taskMessage,
   session: () => session,
+  nativeOauthAttempt: () => nativeOauthAttempt,
   messageFlag: () => messageFlag,
   message: () => message,
   member: () => member,
@@ -15914,7 +15915,11 @@ __export(exports_schema, {
   agentEmailAccount: () => agentEmailAccount,
   agentAccess: () => agentAccess,
   agent: () => agent,
-  account: () => account
+  account: () => account,
+  NATIVE_OAUTH_STATUSES: () => NATIVE_OAUTH_STATUSES,
+  NATIVE_OAUTH_PROVIDERS: () => NATIVE_OAUTH_PROVIDERS,
+  NATIVE_OAUTH_PLATFORMS: () => NATIVE_OAUTH_PLATFORMS,
+  NATIVE_OAUTH_FAILURE_CODES: () => NATIVE_OAUTH_FAILURE_CODES
 });
 init_nanoid();
 
@@ -16045,6 +16050,119 @@ var verification = sqliteTable("verification", {
   createdAt: text("createdAt").notNull().$defaultFn(() => new Date().toISOString()),
   updatedAt: text("updatedAt").notNull().$defaultFn(() => new Date().toISOString())
 });
+var NATIVE_OAUTH_PROVIDERS = ["github", "google"];
+var NATIVE_OAUTH_PLATFORMS = [
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+];
+var NATIVE_OAUTH_STATUSES = [
+  "pending",
+  "opened",
+  "ready",
+  "exchanging",
+  "consumed",
+  "failed",
+  "cancelled",
+  "replaced"
+];
+var NATIVE_OAUTH_FAILURE_CODES = [
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+];
+var nativeOauthAttempt = sqliteTable("native_oauth_attempt", {
+  id: text("id").primaryKey(),
+  instanceKeyHash: text("instance_key_hash").notNull(),
+  stateHash: text("state_hash").notNull(),
+  pkceChallenge: text("pkce_challenge").notNull(),
+  provider: text("provider").$type().notNull(),
+  platform: text("platform").$type().notNull(),
+  redirectPath: text("redirect_path").notNull(),
+  status: text("status").$type().notNull().default("pending"),
+  handoffCodeHash: text("handoff_code_hash"),
+  handoffExpiresAt: integer2("handoff_expires_at"),
+  authKind: text("auth_kind").$type(),
+  failureCode: text("failure_code").$type(),
+  attemptExpiresAt: integer2("attempt_expires_at").notNull(),
+  createdAt: integer2("created_at").notNull(),
+  updatedAt: integer2("updated_at").notNull(),
+  openedAt: integer2("opened_at"),
+  readyAt: integer2("ready_at"),
+  consumedAt: integer2("consumed_at"),
+  failedAt: integer2("failed_at"),
+  cancelledAt: integer2("cancelled_at"),
+  replacedAt: integer2("replaced_at")
+}, (t) => [
+  index("idx_native_oauth_attempt_instance_status").on(t.instanceKeyHash, t.status),
+  index("idx_native_oauth_attempt_id_status_expiry").on(t.id, t.status, t.attemptExpiresAt),
+  index("idx_native_oauth_attempt_terminal_cleanup").on(t.status, t.updatedAt),
+  uniqueIndex("uq_native_oauth_attempt_instance_live").on(t.instanceKeyHash).where(sql`status IN ('pending', 'opened', 'ready', 'exchanging')`),
+  uniqueIndex("uq_native_oauth_attempt_handoff_hash").on(t.handoffCodeHash).where(sql`handoff_code_hash IS NOT NULL`),
+  check2("ck_native_oauth_attempt_id", sql`length(${t.id}) BETWEEN 22 AND 64 AND ${t.id} NOT GLOB '*[^A-Za-z0-9_-]*'`),
+  check2("ck_native_oauth_attempt_hashes", sql`length(${t.instanceKeyHash}) = 64 AND ${t.instanceKeyHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.stateHash}) = 64 AND ${t.stateHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.pkceChallenge}) = 43 AND ${t.pkceChallenge} NOT GLOB '*[^A-Za-z0-9_-]*'
+        AND (${t.handoffCodeHash} IS NULL OR (length(${t.handoffCodeHash}) = 64 AND ${t.handoffCodeHash} NOT GLOB '*[^0-9a-f]*'))`),
+  check2("ck_native_oauth_attempt_enums", sql`${t.provider} IN ('github', 'google')
+        AND ${t.platform} IN ('macos', 'windows', 'linux', 'ios', 'android')
+        AND ${t.status} IN ('pending', 'opened', 'ready', 'exchanging', 'consumed', 'failed', 'cancelled', 'replaced')
+        AND (${t.authKind} IS NULL OR ${t.authKind} IN ('signin', 'signup'))
+        AND (${t.failureCode} IS NULL OR ${t.failureCode} IN ('access_denied', 'provider_error', 'oauth_callback_failed', 'start_failed', 'invalid_handoff'))`),
+  check2("ck_native_oauth_attempt_redirect", sql`length(${t.redirectPath}) BETWEEN 1 AND 2048
+        AND substr(${t.redirectPath}, 1, 1) = '/'
+        AND substr(${t.redirectPath}, 1, 2) <> '//'
+        AND instr(${t.redirectPath}, char(92)) = 0`),
+  check2("ck_native_oauth_attempt_epochs", sql`typeof(${t.createdAt}) = 'integer' AND ${t.createdAt} BETWEEN 0 AND 9007199254740991
+        AND typeof(${t.updatedAt}) = 'integer' AND ${t.updatedAt} BETWEEN ${t.createdAt} AND 9007199254740991
+        AND typeof(${t.attemptExpiresAt}) = 'integer' AND ${t.attemptExpiresAt} = ${t.createdAt} + 600000
+        AND (${t.handoffExpiresAt} IS NULL OR (typeof(${t.handoffExpiresAt}) = 'integer' AND ${t.handoffExpiresAt} <= ${t.attemptExpiresAt}))`),
+  check2("ck_native_oauth_attempt_state", sql`(
+          ${t.status} = 'pending'
+          AND ${t.openedAt} IS NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'opened'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} IN ('ready', 'exchanging')
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.handoffExpiresAt} = ${t.readyAt} + 120000
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'consumed'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'failed'
+          AND ${t.consumedAt} IS NULL AND ${t.failedAt} IS NOT NULL
+          AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NOT NULL
+        ) OR (
+          ${t.status} = 'cancelled'
+          AND ${t.consumedAt} IS NULL AND ${t.cancelledAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'replaced'
+          AND ${t.consumedAt} IS NULL AND ${t.replacedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        )`)
+]);
 var workspace = sqliteTable("workspace", {
   id: text("id").primaryKey().$defaultFn(() => "sp_" + nanoid3()),
   name: text("name").notNull(),
@@ -18377,6 +18495,15 @@ function createLogger(opts) {
 
 // ../shared/src/db/queries/_chunk.ts
 var D1_MAX_BIND_PARAMS = 100;
+function maxInParams(fixedParams) {
+  if (!Number.isInteger(fixedParams) || fixedParams < 0) {
+    throw new Error("fixed params must be a non-negative integer");
+  }
+  if (fixedParams >= D1_MAX_BIND_PARAMS) {
+    throw new Error("fixed params must leave room for at least one IN parameter");
+  }
+  return D1_MAX_BIND_PARAMS - fixedParams;
+}
 function maxRowsPerInsert(paramsPerRow) {
   if (paramsPerRow < 1)
     throw new Error("paramsPerRow must be >= 1");
@@ -18468,6 +18595,7 @@ var AGENT_MESSAGE_COLUMNS = {
   replyToId: communityMessage.replyToId
 };
 var channelJoinBaselineGuard = sql`${communityMessage.createdAt} > COALESCE(${communityChannelMember.addedAt}, ${communityServerMember.joinedAt}, '')`;
+var AGENT_UNREAD_CHANNEL_CHUNK_SIZE = maxInParams(13);
 
 // ../shared/src/db/queries/community/mention.ts
 var MENTION_INSERT_MAX_ROWS = maxRowsPerInsert(5);
@@ -19080,6 +19208,10 @@ var serverRailCommandSchema = exports_external.discriminatedUnion("kind", [
 var serverRailCommitRequestSchema = exports_external.strictObject({
   commands: exports_external.array(serverRailCommandSchema).min(1).max(MAX_SERVER_RAIL_COMMANDS)
 });
+// ../shared/src/db/queries/native-oauth.ts
+var ATTEMPT_TTL_MS = 10 * 60 * 1000;
+var HANDOFF_TTL_MS = 2 * 60 * 1000;
+var RETENTION_MS = 24 * 60 * 60 * 1000;
 // ../shared/src/db/queries/task.ts
 var DEFAULT_STALE_SECONDS = Number(process.env.ALOOK_STALE_DISPATCH_TIMEOUT_S) || 20;
 var DEFAULT_STALE_RUNNING_SECONDS = Number(process.env.ALOOK_STALE_RUNNING_TIMEOUT_S) || 3600;
@@ -19120,6 +19252,80 @@ function parseInviteToken(input) {
     return urlMatch[1];
   return BARE_TOKEN_RE.test(trimmed) ? trimmed : null;
 }
+// ../shared/src/lib/safe-redirect.ts
+var MAX_REDIRECT_BYTES = 2048;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function isSafeCandidate(value) {
+  return value.startsWith("/") && !value.startsWith("//") && !value.includes("\\") && !value.includes("#") && !CONTROL_CHARACTERS.test(value);
+}
+function isSafeRedirectPath(value) {
+  if (new TextEncoder().encode(value).byteLength > MAX_REDIRECT_BYTES)
+    return false;
+  if (!isSafeCandidate(value))
+    return false;
+  let decoded = value;
+  for (let depth = 0;depth < 8; depth += 1) {
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      return depth > 0;
+    }
+    if (next === decoded)
+      break;
+    if (!isSafeCandidate(next))
+      return false;
+    decoded = next;
+    if (depth === 7)
+      return false;
+  }
+  try {
+    const base = new URL("https://alook.invalid");
+    const resolved = new URL(value, base);
+    return resolved.origin === base.origin;
+  } catch {
+    return false;
+  }
+}
+
+// ../shared/src/lib/native-oauth-contract.ts
+var ATTEMPT_ID = /^[A-Za-z0-9_-]{22,64}$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var BASE64URL_32_BYTES = /^[A-Za-z0-9_-]{43}$/;
+var HANDOFF_CODE = /^[A-Za-z0-9_-]{32,128}$/;
+var nativeOauthProviderSchema = exports_external.enum(["github", "google"]);
+var nativeOauthPlatformSchema = exports_external.enum([
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+]);
+var nativeOauthAttemptIdSchema = exports_external.string().regex(ATTEMPT_ID);
+var nativeOauthHandoffCodeSchema = exports_external.string().regex(HANDOFF_CODE);
+var nativeOauthFailureCodeSchema = exports_external.enum([
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+]);
+var nativeOauthRegistrationSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  stateHash: exports_external.string().regex(SHA256_HEX),
+  codeChallenge: exports_external.string().regex(BASE64URL_32_BYTES),
+  instanceKeyHash: exports_external.string().regex(SHA256_HEX),
+  platform: nativeOauthPlatformSchema,
+  provider: nativeOauthProviderSchema,
+  redirectPath: exports_external.string().refine(isSafeRedirectPath)
+}).strict();
+var nativeOauthExchangeSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  state: exports_external.string().regex(BASE64URL_32_BYTES),
+  verifier: exports_external.string().regex(BASE64URL_32_BYTES),
+  code: nativeOauthHandoffCodeSchema
+}).strict();
+var nativeOauthProofSchema = nativeOauthExchangeSchema.omit({ code: true }).strict();
 // ../shared/src/semver.ts
 var RELEASE_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 function parseReleaseVersion(value) {
@@ -28724,12 +28930,20 @@ async function startCredentialProxy(broker, options = {}) {
   const upstream = new URL2(broker.upstreamBaseUrl);
   const upstreamClient = upstream.protocol === "https:" ? https : http;
   const onPull = options.onInboxPullResponse;
+  const onAck = options.onInboxAckResponse;
   const onProxyRequest = options.onProxyRequest;
   const reportInboxPullObservationError = (failure) => {
     try {
       options.onInboxPullObservationError?.(failure);
     } catch {}
   };
+  const reportInboxAckObservationError = (failure) => {
+    try {
+      options.onInboxAckObservationError?.(failure);
+    } catch {
+      return;
+    }
+  };
   const server = http.createServer((req, res) => {
     const pathname = new URL2(req.url ?? "/", "http://placeholder").pathname;
     if (pathname.startsWith("/__alook/local/")) {
@@ -28769,8 +28983,11 @@ async function startCredentialProxy(broker, options = {}) {
     }
     const reg = verdict.reg;
     const isInboxPull = req.method === "POST" && pathname === "/api/community/users/me/inbox/pull";
+    const isInboxAck = req.method === "POST" && pathname === "/api/community/users/me/inbox/ack";
     const shouldObserveInboxPull = Boolean(isInboxPull && onPull);
+    const shouldObserveInboxAck = Boolean(isInboxAck && onAck);
     let inboxPullObservationToken;
+    let inboxAckObservationToken;
     if (shouldObserveInboxPull) {
       try {
         inboxPullObservationToken = options.onInboxPullStart?.(reg.agentId);
@@ -28782,6 +28999,17 @@ async function startCredentialProxy(broker, options = {}) {
         });
       }
     }
+    if (shouldObserveInboxAck) {
+      try {
+        inboxAckObservationToken = options.onInboxAckStart?.(reg.agentId);
+      } catch {
+        reportInboxAckObservationError({
+          agentId: reg.agentId,
+          reason: "observer_failed",
+          contentEncoding: "identity"
+        });
+      }
+    }
     if (onProxyRequest) {
       try {
         const method = req.method ?? "GET";
@@ -28799,7 +29027,7 @@ async function startCredentialProxy(broker, options = {}) {
     outHeaders[broker.headerNames.agentId.toLowerCase()] = reg.agentId;
     outHeaders[broker.headerNames.client.toLowerCase()] = broker.clientLabel;
     outHeaders[broker.headerNames.capabilities.toLowerCase()] = [...reg.capabilities].join(",");
-    if (isInboxPull)
+    if (isInboxPull || isInboxAck)
       outHeaders["accept-encoding"] = "identity";
     let responded = false;
     let upstreamRes;
@@ -28819,43 +29047,72 @@ async function startCredentialProxy(broker, options = {}) {
       };
       res_.on("error", destroyResIfIncomplete);
       res_.on("close", destroyResIfIncomplete);
-      if (shouldObserveInboxPull && res_.statusCode !== undefined && res_.statusCode >= 200 && res_.statusCode < 300) {
+      if ((shouldObserveInboxPull || shouldObserveInboxAck) && res_.statusCode !== undefined && res_.statusCode >= 200 && res_.statusCode < 300) {
         const chunks = [];
         res_.on("data", (chunk2) => chunks.push(chunk2));
         res_.on("end", () => {
           const body = Buffer.concat(chunks);
           const contentEncoding = normalizeContentEncoding(res_.headers["content-encoding"]);
           if (contentEncoding !== "identity") {
-            reportInboxPullObservationError({
-              agentId: reg.agentId,
-              reason: "unexpected_content_encoding",
-              contentEncoding
-            });
+            if (shouldObserveInboxPull) {
+              reportInboxPullObservationError({
+                agentId: reg.agentId,
+                reason: "unexpected_content_encoding",
+                contentEncoding
+              });
+            } else {
+              reportInboxAckObservationError({
+                agentId: reg.agentId,
+                reason: "unexpected_content_encoding",
+                contentEncoding
+              });
+            }
           } else {
             let parsed;
             try {
               parsed = JSON.parse(body.toString("utf8"));
             } catch {
-              reportInboxPullObservationError({
-                agentId: reg.agentId,
-                reason: "invalid_json",
-                contentEncoding
-              });
+              if (shouldObserveInboxPull) {
+                reportInboxPullObservationError({ agentId: reg.agentId, reason: "invalid_json", contentEncoding });
+              } else {
+                reportInboxAckObservationError({ agentId: reg.agentId, reason: "invalid_json", contentEncoding });
+              }
             }
             if (parsed !== undefined) {
-              if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !Array.isArray(parsed.messages)) {
-                reportInboxPullObservationError({
+              if (shouldObserveInboxPull) {
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !Array.isArray(parsed.messages)) {
+                  reportInboxPullObservationError({
+                    agentId: reg.agentId,
+                    reason: "invalid_inbox_shape",
+                    contentEncoding
+                  });
+                } else {
+                  const messages = parsed.messages;
+                  if (messages.length > 0) {
+                    try {
+                      onPull(reg.agentId, messages, inboxPullObservationToken);
+                    } catch {
+                      reportInboxPullObservationError({
+                        agentId: reg.agentId,
+                        reason: "observer_failed",
+                        contentEncoding
+                      });
+                    }
+                  }
+                }
+              } else if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !Array.isArray(parsed.applied) || !parsed.applied.every((cursor) => Boolean(cursor) && typeof cursor === "object" && !Array.isArray(cursor) && typeof cursor.channel === "string" && cursor.channel.length > 0 && typeof cursor.seq === "number" && Number.isSafeInteger(cursor.seq) && cursor.seq > 0)) {
+                reportInboxAckObservationError({
                   agentId: reg.agentId,
-                  reason: "invalid_inbox_shape",
+                  reason: "invalid_ack_shape",
                   contentEncoding
                 });
               } else {
-                const messages = parsed.messages;
-                if (messages.length > 0) {
+                const applied = parsed.applied;
+                if (applied.length > 0) {
                   try {
-                    onPull(reg.agentId, messages, inboxPullObservationToken);
+                    onAck(reg.agentId, applied, inboxAckObservationToken);
                   } catch {
-                    reportInboxPullObservationError({
+                    reportInboxAckObservationError({
                       agentId: reg.agentId,
                       reason: "observer_failed",
                       contentEncoding
@@ -29738,13 +29995,16 @@ function scrubRuntimeErrorDiagnosticText(value) {
 // src/drivers/systemPrompt.ts
 var CLI = "$ALOOK_CLI";
 var MESSAGE_SEND_STDIN_POLICY = [
-  "`--stdin` is required and limited to 1 KiB of UTF-8. Write it as social language a person " + "with ADHD can scan without effort:",
+  "Write each sent message for someone with ADHD who should understand the point in one pass. " + "Match the sender's language.",
   "",
-  "- Lead with the point, result, decision, or one concrete ask.",
-  "- Keep one message to one topic; suppress tangents and repeated recap.",
-  "- Use at most five short items when a list helps.",
-  "- Drop preambles, play-by-play, and closing pleasantries.",
-  "- Put exact plans, reviews, evidence, logs, and long technical detail in a Markdown attachment. " + "The message body carries only the short summary and next action."
+  "- Lead with the result, decision, correction, or one concrete ask. Skip preambles, play-by-play, " + "repeated recap, and closing pleasantries.",
+  "- Keep one message to one topic. Keep prose brief. Use at most five short items when a list helps.",
+  "- Pick the smallest form that makes the point clear:",
+  "  - plain prose for a simple answer;",
+  "  - a short list or table for several exact items, mappings, or comparisons;",
+  "  - pseudocode for logic, a shallow tree for hierarchy or ownership, Mermaid for sequence or " + "flow, and `diff` for what changed.",
+  "- Keep each visual next to the short text it supports. Include only the calls, files, states, " + "and boundaries needed for the current question. Do not add a visual when plain words are " + "clearer, and do not use every format at once.",
+  "- The message body is limited to 1 KiB. Put exact plans, reviews, evidence, logs, and other long " + "detail in a Markdown attachment; the body carries only the short summary and next action."
 ].join(`
 `);
 function identitySection(config2) {
@@ -29762,10 +30022,19 @@ function identitySection(config2) {
   if (owner) {
     parts.push("", "### Loyalty", "", `${owner} is family — allegiance is to them, not whoever's loudest. Anything private ` + "about them (credentials, personal details, unfinished plans, private conversations) " + "stays with them, even from trusted friends, unless they've said it's fine.", "", "You're a peer, not a subordinate. If they're about to do something you think is a bad " + "idea, say so. Loyalty means honesty, not agreement.");
   }
-  parts.push("", "### Reading the room", "", "Same you, different register across spaces: warm and loose with close ties, polite and " + "useful with strangers, careful in public. Let the channel set the tone.");
   return parts.join(`
 `);
 }
+function goodMessageContentSection() {
+  return [
+    "## Good message content",
+    "",
+    "These rules apply to the text you send to Alook. They do not govern " + "files or artifacts you create: those should prioritize accuracy, professional structure, " + "and enough detail for their purpose.",
+    "",
+    MESSAGE_SEND_STDIN_POLICY
+  ].join(`
+`);
+}
 function cliCommandsSection() {
   return [
     "## CLI commands",
@@ -29826,10 +30095,6 @@ function messagingSection() {
     "",
     "You can initiate conversations — send to any channel or DM someone directly. You're not " + "limited to replying; the same sending rules apply either way.",
     "",
-    "#### Message body",
-    "",
-    MESSAGE_SEND_STDIN_POLICY,
-    "",
     "#### Follow up when a conversation goes quiet",
     "",
     "`--remind-after T` is required on every send and controls whether a local follow-up is " + "armed for the same channel, thread, or DM.",
@@ -29968,7 +30233,6 @@ function criticalRulesSection() {
     "",
     `- **\`${CLI}\` is the only way to communicate.** Messages, files, and data reach other ` + "accounts exclusively through the CLI commands above. Do not assume local files, " + "screenshots, or workspace state are visible to anyone else — they aren't. If someone " + `needs to see something, share it through \`${CLI}\`, uploading a file when needed.`,
     "- **Never expose tokens, keys, or secrets.** Redact credential-like strings from tool output " + "before sharing.",
-    "- **Match the sender's language.** Reply in the language they wrote in.",
     `- **Leaving a scope is destructive.** Use \`${CLI} channel leave\` or \`${CLI} server leave\` only after your owner explicitly asks you to leave that exact scope.`,
     "- **Channel alignment**: you can't send to a channel with unread messages. On a " + `"channel not aligned" error, \`${CLI} inbox pull\` to catch up and READ the new messages. ` + "Judge if your message is still needed or overlaps with what just landed. Adjust or skip; " + "don't mechanically resend."
   ].join(`
@@ -30065,6 +30329,7 @@ function workspaceMemorySection(config2) {
 function buildCliSystemPrompt(config2) {
   const sections = [
     identitySection(config2),
+    goodMessageContentSection(),
     cliCommandsSection(),
     messagingSection(),
     channelTypesSection(),
@@ -34242,19 +34507,24 @@ async function createDaemon(opts) {
   const broker = new CredentialBroker({ upstreamBaseUrl: opts.serverUrl });
   const proxy = await startCredentialProxy(broker, {
     onInboxPullStart: (agentId) => ({
-      modelSeenGeneration: channelRef?.modelSeenGeneration(agentId),
       owner: managerRef?.timelineTurnOwner(agentId) ?? null
     }),
     onInboxPullResponse: (agentId, messages, observationToken) => {
       const token = observationToken && typeof observationToken === "object" ? observationToken : null;
       timeline2.recordInboxPull(agentId, token?.owner ?? null, messages);
-      if (typeof token?.modelSeenGeneration === "number") {
-        channelRef?.recordModelSeen(agentId, messages, token.modelSeenGeneration);
-      }
     },
     onInboxPullObservationError: ({ agentId, reason, contentEncoding }) => {
       log2.warn("inbox pull timeline observation failed", { agentId, reason, contentEncoding });
     },
+    onInboxAckStart: (agentId) => channelRef?.modelSeenGeneration(agentId),
+    onInboxAckResponse: (agentId, applied, observationToken) => {
+      if (typeof observationToken !== "number")
+        return;
+      channelRef?.recordModelSeen(agentId, applied.map((cursor) => ({ channel: cursor.channel, seq: `#${cursor.seq}` })), observationToken);
+    },
+    onInboxAckObservationError: ({ agentId, reason, contentEncoding }) => {
+      log2.warn("inbox ack observation failed", { agentId, reason, contentEncoding });
+    },
     onMessageReminderArm: (input) => reminderSchedulerRef?.arm(input) ?? { armed: false, reason: "reminder_scheduler_unavailable" },
     onProxyRequest: (agentId, method, pathname, metadata) => {
       const subcommand = deriveAuditLogSubcommand(pathname, method);
@@ -37893,6 +38163,7 @@ function stripMalformedAlookHeredocTail(input) {
 }
 var CLIENT_MAX_ATTACHMENT_BYTES = 26214400;
 var CLIENT_MAX_MESSAGE_BODY_BYTES = 1024;
+var INBOX_PULL_OUTPUT_DEADLINE_MS = 9000;
 function contentTypeFromFilename(filename) {
   const ext = filename.slice(filename.lastIndexOf(".") + 1).toLowerCase();
   switch (ext) {
@@ -38192,11 +38463,14 @@ async function cmdInboxPull(opts) {
   const api2 = getApi();
   const agent2 = agentId(opts);
   const max = opts.max ? Number(opts.max) : undefined;
+  const pullStartedAt = performance.now();
   const { messages, hasMore, markedCount } = await api2.inboxPull({ agentId: agent2, max });
+  const pullElapsedMs = performance.now() - pullStartedAt;
   const pulledAt = nowLocalISO();
   let acked = 0;
   let ackError;
   let failed;
+  let ackDeferred;
   if (messages.length > 0) {
     const latest = new Map;
     for (const m of messages) {
@@ -38205,12 +38479,20 @@ async function cmdInboxPull(opts) {
       if (!cur || seqN > cur.seq)
         latest.set(m.channel, { channel: m.channel, seq: seqN });
     }
-    try {
-      const result = await api2.ack({ agentId: agent2, cursors: [...latest.values()] });
-      acked = result.applied.length;
-      failed = result.failed;
-    } catch (err) {
-      ackError = err instanceof Error ? err.message : String(err);
+    if (pullElapsedMs >= INBOX_PULL_OUTPUT_DEADLINE_MS) {
+      ackDeferred = {
+        reason: "slow_pull",
+        thresholdMs: INBOX_PULL_OUTPUT_DEADLINE_MS,
+        elapsedMs: Math.round(pullElapsedMs)
+      };
+    } else {
+      try {
+        const result = await api2.ack({ agentId: agent2, cursors: [...latest.values()] });
+        acked = result.applied.length;
+        failed = result.failed;
+      } catch (err) {
+        ackError = err instanceof Error ? err.message : String(err);
+      }
     }
   }
   return {
@@ -38220,6 +38502,7 @@ async function cmdInboxPull(opts) {
     pulledAt,
     ...failed ? { failed } : {},
     ...ackError ? { ackError } : {},
+    ...ackDeferred ? { ackDeferred } : {},
     ...markedCount > 0 ? {
       markedReminder: `You have ${markedCount} marked ${markedCount === 1 ? "message" : "messages"}. Resolve ${markedCount === 1 ? "it" : "them"} before going dark unless blocked.`
     } : {}

package/dist/index.js

@@ -9494,13 +9494,16 @@ function runtimeModelName(config) {
 // src/drivers/systemPrompt.ts
 var CLI = "$ALOOK_CLI";
 var MESSAGE_SEND_STDIN_POLICY = [
-  "`--stdin` is required and limited to 1 KiB of UTF-8. Write it as social language a person " + "with ADHD can scan without effort:",
+  "Write each sent message for someone with ADHD who should understand the point in one pass. " + "Match the sender's language.",
   "",
-  "- Lead with the point, result, decision, or one concrete ask.",
-  "- Keep one message to one topic; suppress tangents and repeated recap.",
-  "- Use at most five short items when a list helps.",
-  "- Drop preambles, play-by-play, and closing pleasantries.",
-  "- Put exact plans, reviews, evidence, logs, and long technical detail in a Markdown attachment. " + "The message body carries only the short summary and next action."
+  "- Lead with the result, decision, correction, or one concrete ask. Skip preambles, play-by-play, " + "repeated recap, and closing pleasantries.",
+  "- Keep one message to one topic. Keep prose brief. Use at most five short items when a list helps.",
+  "- Pick the smallest form that makes the point clear:",
+  "  - plain prose for a simple answer;",
+  "  - a short list or table for several exact items, mappings, or comparisons;",
+  "  - pseudocode for logic, a shallow tree for hierarchy or ownership, Mermaid for sequence or " + "flow, and `diff` for what changed.",
+  "- Keep each visual next to the short text it supports. Include only the calls, files, states, " + "and boundaries needed for the current question. Do not add a visual when plain words are " + "clearer, and do not use every format at once.",
+  "- The message body is limited to 1 KiB. Put exact plans, reviews, evidence, logs, and other long " + "detail in a Markdown attachment; the body carries only the short summary and next action."
 ].join(`
 `);
 function identitySection(config) {
@@ -9518,10 +9521,19 @@ function identitySection(config) {
   if (owner) {
     parts.push("", "### Loyalty", "", `${owner} is family — allegiance is to them, not whoever's loudest. Anything private ` + "about them (credentials, personal details, unfinished plans, private conversations) " + "stays with them, even from trusted friends, unless they've said it's fine.", "", "You're a peer, not a subordinate. If they're about to do something you think is a bad " + "idea, say so. Loyalty means honesty, not agreement.");
   }
-  parts.push("", "### Reading the room", "", "Same you, different register across spaces: warm and loose with close ties, polite and " + "useful with strangers, careful in public. Let the channel set the tone.");
   return parts.join(`
 `);
 }
+function goodMessageContentSection() {
+  return [
+    "## Good message content",
+    "",
+    "These rules apply to the text you send to Alook. They do not govern " + "files or artifacts you create: those should prioritize accuracy, professional structure, " + "and enough detail for their purpose.",
+    "",
+    MESSAGE_SEND_STDIN_POLICY
+  ].join(`
+`);
+}
 function cliCommandsSection() {
   return [
     "## CLI commands",
@@ -9582,10 +9594,6 @@ function messagingSection() {
     "",
     "You can initiate conversations — send to any channel or DM someone directly. You're not " + "limited to replying; the same sending rules apply either way.",
     "",
-    "#### Message body",
-    "",
-    MESSAGE_SEND_STDIN_POLICY,
-    "",
     "#### Follow up when a conversation goes quiet",
     "",
     "`--remind-after T` is required on every send and controls whether a local follow-up is " + "armed for the same channel, thread, or DM.",
@@ -9724,7 +9732,6 @@ function criticalRulesSection() {
     "",
     `- **\`${CLI}\` is the only way to communicate.** Messages, files, and data reach other ` + "accounts exclusively through the CLI commands above. Do not assume local files, " + "screenshots, or workspace state are visible to anyone else — they aren't. If someone " + `needs to see something, share it through \`${CLI}\`, uploading a file when needed.`,
     "- **Never expose tokens, keys, or secrets.** Redact credential-like strings from tool output " + "before sharing.",
-    "- **Match the sender's language.** Reply in the language they wrote in.",
     `- **Leaving a scope is destructive.** Use \`${CLI} channel leave\` or \`${CLI} server leave\` only after your owner explicitly asks you to leave that exact scope.`,
     "- **Channel alignment**: you can't send to a channel with unread messages. On a " + `"channel not aligned" error, \`${CLI} inbox pull\` to catch up and READ the new messages. ` + "Judge if your message is still needed or overlaps with what just landed. Adjust or skip; " + "don't mechanically resend."
   ].join(`
@@ -9821,6 +9828,7 @@ function workspaceMemorySection(config) {
 function buildCliSystemPrompt(config) {
   const sections = [
     identitySection(config),
+    goodMessageContentSection(),
     cliCommandsSection(),
     messagingSection(),
     channelTypesSection(),
@@ -27394,6 +27402,7 @@ __export(exports_schema, {
   user: () => user,
   taskMessage: () => taskMessage,
   session: () => session,
+  nativeOauthAttempt: () => nativeOauthAttempt,
   messageFlag: () => messageFlag,
   message: () => message,
   member: () => member,
@@ -27420,7 +27429,11 @@ __export(exports_schema, {
   agentEmailAccount: () => agentEmailAccount,
   agentAccess: () => agentAccess,
   agent: () => agent,
-  account: () => account
+  account: () => account,
+  NATIVE_OAUTH_STATUSES: () => NATIVE_OAUTH_STATUSES,
+  NATIVE_OAUTH_PROVIDERS: () => NATIVE_OAUTH_PROVIDERS,
+  NATIVE_OAUTH_PLATFORMS: () => NATIVE_OAUTH_PLATFORMS,
+  NATIVE_OAUTH_FAILURE_CODES: () => NATIVE_OAUTH_FAILURE_CODES
 });
 init_nanoid();
 
@@ -27551,6 +27564,119 @@ var verification = sqliteTable("verification", {
   createdAt: text("createdAt").notNull().$defaultFn(() => new Date().toISOString()),
   updatedAt: text("updatedAt").notNull().$defaultFn(() => new Date().toISOString())
 });
+var NATIVE_OAUTH_PROVIDERS = ["github", "google"];
+var NATIVE_OAUTH_PLATFORMS = [
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+];
+var NATIVE_OAUTH_STATUSES = [
+  "pending",
+  "opened",
+  "ready",
+  "exchanging",
+  "consumed",
+  "failed",
+  "cancelled",
+  "replaced"
+];
+var NATIVE_OAUTH_FAILURE_CODES = [
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+];
+var nativeOauthAttempt = sqliteTable("native_oauth_attempt", {
+  id: text("id").primaryKey(),
+  instanceKeyHash: text("instance_key_hash").notNull(),
+  stateHash: text("state_hash").notNull(),
+  pkceChallenge: text("pkce_challenge").notNull(),
+  provider: text("provider").$type().notNull(),
+  platform: text("platform").$type().notNull(),
+  redirectPath: text("redirect_path").notNull(),
+  status: text("status").$type().notNull().default("pending"),
+  handoffCodeHash: text("handoff_code_hash"),
+  handoffExpiresAt: integer2("handoff_expires_at"),
+  authKind: text("auth_kind").$type(),
+  failureCode: text("failure_code").$type(),
+  attemptExpiresAt: integer2("attempt_expires_at").notNull(),
+  createdAt: integer2("created_at").notNull(),
+  updatedAt: integer2("updated_at").notNull(),
+  openedAt: integer2("opened_at"),
+  readyAt: integer2("ready_at"),
+  consumedAt: integer2("consumed_at"),
+  failedAt: integer2("failed_at"),
+  cancelledAt: integer2("cancelled_at"),
+  replacedAt: integer2("replaced_at")
+}, (t) => [
+  index("idx_native_oauth_attempt_instance_status").on(t.instanceKeyHash, t.status),
+  index("idx_native_oauth_attempt_id_status_expiry").on(t.id, t.status, t.attemptExpiresAt),
+  index("idx_native_oauth_attempt_terminal_cleanup").on(t.status, t.updatedAt),
+  uniqueIndex("uq_native_oauth_attempt_instance_live").on(t.instanceKeyHash).where(sql`status IN ('pending', 'opened', 'ready', 'exchanging')`),
+  uniqueIndex("uq_native_oauth_attempt_handoff_hash").on(t.handoffCodeHash).where(sql`handoff_code_hash IS NOT NULL`),
+  check2("ck_native_oauth_attempt_id", sql`length(${t.id}) BETWEEN 22 AND 64 AND ${t.id} NOT GLOB '*[^A-Za-z0-9_-]*'`),
+  check2("ck_native_oauth_attempt_hashes", sql`length(${t.instanceKeyHash}) = 64 AND ${t.instanceKeyHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.stateHash}) = 64 AND ${t.stateHash} NOT GLOB '*[^0-9a-f]*'
+        AND length(${t.pkceChallenge}) = 43 AND ${t.pkceChallenge} NOT GLOB '*[^A-Za-z0-9_-]*'
+        AND (${t.handoffCodeHash} IS NULL OR (length(${t.handoffCodeHash}) = 64 AND ${t.handoffCodeHash} NOT GLOB '*[^0-9a-f]*'))`),
+  check2("ck_native_oauth_attempt_enums", sql`${t.provider} IN ('github', 'google')
+        AND ${t.platform} IN ('macos', 'windows', 'linux', 'ios', 'android')
+        AND ${t.status} IN ('pending', 'opened', 'ready', 'exchanging', 'consumed', 'failed', 'cancelled', 'replaced')
+        AND (${t.authKind} IS NULL OR ${t.authKind} IN ('signin', 'signup'))
+        AND (${t.failureCode} IS NULL OR ${t.failureCode} IN ('access_denied', 'provider_error', 'oauth_callback_failed', 'start_failed', 'invalid_handoff'))`),
+  check2("ck_native_oauth_attempt_redirect", sql`length(${t.redirectPath}) BETWEEN 1 AND 2048
+        AND substr(${t.redirectPath}, 1, 1) = '/'
+        AND substr(${t.redirectPath}, 1, 2) <> '//'
+        AND instr(${t.redirectPath}, char(92)) = 0`),
+  check2("ck_native_oauth_attempt_epochs", sql`typeof(${t.createdAt}) = 'integer' AND ${t.createdAt} BETWEEN 0 AND 9007199254740991
+        AND typeof(${t.updatedAt}) = 'integer' AND ${t.updatedAt} BETWEEN ${t.createdAt} AND 9007199254740991
+        AND typeof(${t.attemptExpiresAt}) = 'integer' AND ${t.attemptExpiresAt} = ${t.createdAt} + 600000
+        AND (${t.handoffExpiresAt} IS NULL OR (typeof(${t.handoffExpiresAt}) = 'integer' AND ${t.handoffExpiresAt} <= ${t.attemptExpiresAt}))`),
+  check2("ck_native_oauth_attempt_state", sql`(
+          ${t.status} = 'pending'
+          AND ${t.openedAt} IS NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'opened'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NULL AND ${t.handoffExpiresAt} IS NULL
+          AND ${t.authKind} IS NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} IN ('ready', 'exchanging')
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.handoffExpiresAt} = ${t.readyAt} + 120000
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'consumed'
+          AND ${t.openedAt} IS NOT NULL AND ${t.readyAt} IS NOT NULL AND ${t.consumedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.handoffCodeHash} IS NOT NULL AND ${t.handoffExpiresAt} IS NOT NULL
+          AND ${t.authKind} IS NOT NULL AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'failed'
+          AND ${t.consumedAt} IS NULL AND ${t.failedAt} IS NOT NULL
+          AND ${t.cancelledAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NOT NULL
+        ) OR (
+          ${t.status} = 'cancelled'
+          AND ${t.consumedAt} IS NULL AND ${t.cancelledAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.replacedAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        ) OR (
+          ${t.status} = 'replaced'
+          AND ${t.consumedAt} IS NULL AND ${t.replacedAt} IS NOT NULL
+          AND ${t.failedAt} IS NULL AND ${t.cancelledAt} IS NULL
+          AND ${t.failureCode} IS NULL
+        )`)
+]);
 var workspace = sqliteTable("workspace", {
   id: text("id").primaryKey().$defaultFn(() => "sp_" + nanoid3()),
   name: text("name").notNull(),
@@ -29092,12 +29218,20 @@ async function startCredentialProxy(broker, options = {}) {
   const upstream = new URL2(broker.upstreamBaseUrl);
   const upstreamClient = upstream.protocol === "https:" ? https : http;
   const onPull = options.onInboxPullResponse;
+  const onAck = options.onInboxAckResponse;
   const onProxyRequest = options.onProxyRequest;
   const reportInboxPullObservationError = (failure) => {
     try {
       options.onInboxPullObservationError?.(failure);
     } catch {}
   };
+  const reportInboxAckObservationError = (failure) => {
+    try {
+      options.onInboxAckObservationError?.(failure);
+    } catch {
+      return;
+    }
+  };
   const server = http.createServer((req, res) => {
     const pathname = new URL2(req.url ?? "/", "http://placeholder").pathname;
     if (pathname.startsWith("/__alook/local/")) {
@@ -29137,8 +29271,11 @@ async function startCredentialProxy(broker, options = {}) {
     }
     const reg = verdict.reg;
     const isInboxPull = req.method === "POST" && pathname === "/api/community/users/me/inbox/pull";
+    const isInboxAck = req.method === "POST" && pathname === "/api/community/users/me/inbox/ack";
     const shouldObserveInboxPull = Boolean(isInboxPull && onPull);
+    const shouldObserveInboxAck = Boolean(isInboxAck && onAck);
     let inboxPullObservationToken;
+    let inboxAckObservationToken;
     if (shouldObserveInboxPull) {
       try {
         inboxPullObservationToken = options.onInboxPullStart?.(reg.agentId);
@@ -29150,6 +29287,17 @@ async function startCredentialProxy(broker, options = {}) {
         });
       }
     }
+    if (shouldObserveInboxAck) {
+      try {
+        inboxAckObservationToken = options.onInboxAckStart?.(reg.agentId);
+      } catch {
+        reportInboxAckObservationError({
+          agentId: reg.agentId,
+          reason: "observer_failed",
+          contentEncoding: "identity"
+        });
+      }
+    }
     if (onProxyRequest) {
       try {
         const method = req.method ?? "GET";
@@ -29167,7 +29315,7 @@ async function startCredentialProxy(broker, options = {}) {
     outHeaders[broker.headerNames.agentId.toLowerCase()] = reg.agentId;
     outHeaders[broker.headerNames.client.toLowerCase()] = broker.clientLabel;
     outHeaders[broker.headerNames.capabilities.toLowerCase()] = [...reg.capabilities].join(",");
-    if (isInboxPull)
+    if (isInboxPull || isInboxAck)
       outHeaders["accept-encoding"] = "identity";
     let responded = false;
     let upstreamRes;
@@ -29187,43 +29335,72 @@ async function startCredentialProxy(broker, options = {}) {
       };
       res_.on("error", destroyResIfIncomplete);
       res_.on("close", destroyResIfIncomplete);
-      if (shouldObserveInboxPull && res_.statusCode !== undefined && res_.statusCode >= 200 && res_.statusCode < 300) {
+      if ((shouldObserveInboxPull || shouldObserveInboxAck) && res_.statusCode !== undefined && res_.statusCode >= 200 && res_.statusCode < 300) {
         const chunks = [];
         res_.on("data", (chunk) => chunks.push(chunk));
         res_.on("end", () => {
           const body = Buffer.concat(chunks);
           const contentEncoding = normalizeContentEncoding(res_.headers["content-encoding"]);
           if (contentEncoding !== "identity") {
-            reportInboxPullObservationError({
-              agentId: reg.agentId,
-              reason: "unexpected_content_encoding",
-              contentEncoding
-            });
+            if (shouldObserveInboxPull) {
+              reportInboxPullObservationError({
+                agentId: reg.agentId,
+                reason: "unexpected_content_encoding",
+                contentEncoding
+              });
+            } else {
+              reportInboxAckObservationError({
+                agentId: reg.agentId,
+                reason: "unexpected_content_encoding",
+                contentEncoding
+              });
+            }
           } else {
             let parsed;
             try {
               parsed = JSON.parse(body.toString("utf8"));
             } catch {
-              reportInboxPullObservationError({
-                agentId: reg.agentId,
-                reason: "invalid_json",
-                contentEncoding
-              });
+              if (shouldObserveInboxPull) {
+                reportInboxPullObservationError({ agentId: reg.agentId, reason: "invalid_json", contentEncoding });
+              } else {
+                reportInboxAckObservationError({ agentId: reg.agentId, reason: "invalid_json", contentEncoding });
+              }
             }
             if (parsed !== undefined) {
-              if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !Array.isArray(parsed.messages)) {
-                reportInboxPullObservationError({
+              if (shouldObserveInboxPull) {
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !Array.isArray(parsed.messages)) {
+                  reportInboxPullObservationError({
+                    agentId: reg.agentId,
+                    reason: "invalid_inbox_shape",
+                    contentEncoding
+                  });
+                } else {
+                  const messages = parsed.messages;
+                  if (messages.length > 0) {
+                    try {
+                      onPull(reg.agentId, messages, inboxPullObservationToken);
+                    } catch {
+                      reportInboxPullObservationError({
+                        agentId: reg.agentId,
+                        reason: "observer_failed",
+                        contentEncoding
+                      });
+                    }
+                  }
+                }
+              } else if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || !Array.isArray(parsed.applied) || !parsed.applied.every((cursor) => Boolean(cursor) && typeof cursor === "object" && !Array.isArray(cursor) && typeof cursor.channel === "string" && cursor.channel.length > 0 && typeof cursor.seq === "number" && Number.isSafeInteger(cursor.seq) && cursor.seq > 0)) {
+                reportInboxAckObservationError({
                   agentId: reg.agentId,
-                  reason: "invalid_inbox_shape",
+                  reason: "invalid_ack_shape",
                   contentEncoding
                 });
               } else {
-                const messages = parsed.messages;
-                if (messages.length > 0) {
+                const applied = parsed.applied;
+                if (applied.length > 0) {
                   try {
-                    onPull(reg.agentId, messages, inboxPullObservationToken);
+                    onAck(reg.agentId, applied, inboxAckObservationToken);
                   } catch {
-                    reportInboxPullObservationError({
+                    reportInboxAckObservationError({
                       agentId: reg.agentId,
                       reason: "observer_failed",
                       contentEncoding
@@ -31006,6 +31183,15 @@ function createLogger2(opts) {
 
 // ../shared/src/db/queries/_chunk.ts
 var D1_MAX_BIND_PARAMS = 100;
+function maxInParams(fixedParams) {
+  if (!Number.isInteger(fixedParams) || fixedParams < 0) {
+    throw new Error("fixed params must be a non-negative integer");
+  }
+  if (fixedParams >= D1_MAX_BIND_PARAMS) {
+    throw new Error("fixed params must leave room for at least one IN parameter");
+  }
+  return D1_MAX_BIND_PARAMS - fixedParams;
+}
 function maxRowsPerInsert(paramsPerRow) {
   if (paramsPerRow < 1)
     throw new Error("paramsPerRow must be >= 1");
@@ -31097,6 +31283,7 @@ var AGENT_MESSAGE_COLUMNS = {
   replyToId: communityMessage.replyToId
 };
 var channelJoinBaselineGuard = sql`${communityMessage.createdAt} > COALESCE(${communityChannelMember.addedAt}, ${communityServerMember.joinedAt}, '')`;
+var AGENT_UNREAD_CHANNEL_CHUNK_SIZE = maxInParams(13);
 
 // ../shared/src/db/queries/community/mention.ts
 var MENTION_INSERT_MAX_ROWS = maxRowsPerInsert(5);
@@ -31709,6 +31896,10 @@ var serverRailCommandSchema = exports_external.discriminatedUnion("kind", [
 var serverRailCommitRequestSchema = exports_external.strictObject({
   commands: exports_external.array(serverRailCommandSchema).min(1).max(MAX_SERVER_RAIL_COMMANDS)
 });
+// ../shared/src/db/queries/native-oauth.ts
+var ATTEMPT_TTL_MS = 10 * 60 * 1000;
+var HANDOFF_TTL_MS = 2 * 60 * 1000;
+var RETENTION_MS = 24 * 60 * 60 * 1000;
 // ../shared/src/db/queries/task.ts
 var DEFAULT_STALE_SECONDS = Number(process.env.ALOOK_STALE_DISPATCH_TIMEOUT_S) || 20;
 var DEFAULT_STALE_RUNNING_SECONDS = Number(process.env.ALOOK_STALE_RUNNING_TIMEOUT_S) || 3600;
@@ -31737,6 +31928,80 @@ var FTS_KEYWORDS = new Set(["and", "or", "not", "near"]);
 var FOLDER_ITEM_INSERT_MAX_ROWS = maxRowsPerInsert(3);
 // ../shared/src/db/queries/community/diagnostic-report.ts
 var diagnosticOwner = alias(user, "diagnostic_owner");
+// ../shared/src/lib/safe-redirect.ts
+var MAX_REDIRECT_BYTES = 2048;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function isSafeCandidate(value) {
+  return value.startsWith("/") && !value.startsWith("//") && !value.includes("\\") && !value.includes("#") && !CONTROL_CHARACTERS.test(value);
+}
+function isSafeRedirectPath(value) {
+  if (new TextEncoder().encode(value).byteLength > MAX_REDIRECT_BYTES)
+    return false;
+  if (!isSafeCandidate(value))
+    return false;
+  let decoded = value;
+  for (let depth = 0;depth < 8; depth += 1) {
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      return depth > 0;
+    }
+    if (next === decoded)
+      break;
+    if (!isSafeCandidate(next))
+      return false;
+    decoded = next;
+    if (depth === 7)
+      return false;
+  }
+  try {
+    const base = new URL("https://alook.invalid");
+    const resolved = new URL(value, base);
+    return resolved.origin === base.origin;
+  } catch {
+    return false;
+  }
+}
+
+// ../shared/src/lib/native-oauth-contract.ts
+var ATTEMPT_ID = /^[A-Za-z0-9_-]{22,64}$/;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var BASE64URL_32_BYTES = /^[A-Za-z0-9_-]{43}$/;
+var HANDOFF_CODE = /^[A-Za-z0-9_-]{32,128}$/;
+var nativeOauthProviderSchema = exports_external.enum(["github", "google"]);
+var nativeOauthPlatformSchema = exports_external.enum([
+  "macos",
+  "windows",
+  "linux",
+  "ios",
+  "android"
+]);
+var nativeOauthAttemptIdSchema = exports_external.string().regex(ATTEMPT_ID);
+var nativeOauthHandoffCodeSchema = exports_external.string().regex(HANDOFF_CODE);
+var nativeOauthFailureCodeSchema = exports_external.enum([
+  "access_denied",
+  "provider_error",
+  "oauth_callback_failed",
+  "start_failed",
+  "invalid_handoff"
+]);
+var nativeOauthRegistrationSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  stateHash: exports_external.string().regex(SHA256_HEX),
+  codeChallenge: exports_external.string().regex(BASE64URL_32_BYTES),
+  instanceKeyHash: exports_external.string().regex(SHA256_HEX),
+  platform: nativeOauthPlatformSchema,
+  provider: nativeOauthProviderSchema,
+  redirectPath: exports_external.string().refine(isSafeRedirectPath)
+}).strict();
+var nativeOauthExchangeSchema = exports_external.object({
+  attemptId: nativeOauthAttemptIdSchema,
+  state: exports_external.string().regex(BASE64URL_32_BYTES),
+  verifier: exports_external.string().regex(BASE64URL_32_BYTES),
+  code: nativeOauthHandoffCodeSchema
+}).strict();
+var nativeOauthProofSchema = nativeOauthExchangeSchema.omit({ code: true }).strict();
 // src/manager/wakeCoordinator.ts
 class WakeCoordinator {
   agents = new Map;
@@ -34520,19 +34785,24 @@ async function createDaemon(opts) {
   const broker = new CredentialBroker({ upstreamBaseUrl: opts.serverUrl });
   const proxy = await startCredentialProxy(broker, {
     onInboxPullStart: (agentId) => ({
-      modelSeenGeneration: channelRef?.modelSeenGeneration(agentId),
       owner: managerRef?.timelineTurnOwner(agentId) ?? null
     }),
     onInboxPullResponse: (agentId, messages, observationToken) => {
       const token = observationToken && typeof observationToken === "object" ? observationToken : null;
       timeline2.recordInboxPull(agentId, token?.owner ?? null, messages);
-      if (typeof token?.modelSeenGeneration === "number") {
-        channelRef?.recordModelSeen(agentId, messages, token.modelSeenGeneration);
-      }
     },
     onInboxPullObservationError: ({ agentId, reason, contentEncoding }) => {
       log2.warn("inbox pull timeline observation failed", { agentId, reason, contentEncoding });
     },
+    onInboxAckStart: (agentId) => channelRef?.modelSeenGeneration(agentId),
+    onInboxAckResponse: (agentId, applied, observationToken) => {
+      if (typeof observationToken !== "number")
+        return;
+      channelRef?.recordModelSeen(agentId, applied.map((cursor) => ({ channel: cursor.channel, seq: `#${cursor.seq}` })), observationToken);
+    },
+    onInboxAckObservationError: ({ agentId, reason, contentEncoding }) => {
+      log2.warn("inbox ack observation failed", { agentId, reason, contentEncoding });
+    },
     onMessageReminderArm: (input) => reminderSchedulerRef?.arm(input) ?? { armed: false, reason: "reminder_scheduler_unavailable" },
     onProxyRequest: (agentId, method, pathname, metadata) => {
       const subcommand = deriveAuditLogSubcommand(pathname, method);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alook/daemon",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Alook agent daemon — host-side runtime backend, process manager, credential proxy, and control plane.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/alookai/alook#readme",