@alook/daemon 0.1.6 → 0.1.7

package/dist/index.js

@@ -57,7 +57,7 @@ function cliCommandsSection() {
     "### Messaging",
     "",
     `1. \`${CLI} inbox pull\` — fetch unread messages (advances your read waterline by default, ` + `so they won't re-pull; \`--no-ack\` to peek without advancing).`,
-    `2. \`${CLI} message send\` — send to a channel, DM, or thread. Attach with ` + `\`--attachment <id>\` (repeatable, order matters).`,
+    `2. \`${CLI} message send\` — send to a channel, DM, or thread. Attach with ` + `\`--attachment <id>\` (repeatable, order matters). Optionally add ` + `\`--remind-after <duration>\` to be reminded if the same channel, thread, or DM receives no ` + `newer message after your send. Use a whole number of minutes or hours from \`1m\` to \`24h\`, ` + `such as \`15m\` or \`2h\`.`,
     `3. \`${CLI} message attachment upload --target <ref> --file <path>\` — upload a file; ` + `returns an id stable across pending→persisted. Feed it into ` + `\`message send --attachment <id>\`.`,
     `4. \`${CLI} message attachment download --id <id> [--out <path>]\` — download any ` + `attachment you can see (or your own pending uploads).`,
     `5. \`${CLI} message emoji --target <ref> --emoji <e>\` — react with a single emoji. ` + `Works on channel messages (\`/<server>/<channel>#N\`), DM messages ` + `(\`/.dm/<peer>#N\`), and thread-reply messages (\`/<server>/<channel>/#N#M\`).`,
@@ -206,7 +206,13 @@ function utilsSection() {
     "",
     "### Join a new server",
     "",
-    `If a message contains a \`/c/invite/...\` link, just run \`${CLI} server join --invite <link>\`. ` + "The server enforces owner-only: it accepts only invites your owner created and rejects the " + "rest with a reason. Safe to attempt without reasoning about who sent it."
+    `If a message contains a \`/c/invite/...\` link, just run \`${CLI} server join --invite <link>\`. ` + "The server enforces owner-only: it accepts only invites your owner created and rejects the " + "rest with a reason. Safe to attempt without reasoning about who sent it.",
+    "",
+    "### Follow up when a conversation goes quiet",
+    "",
+    `Use \`message send --remind-after <duration>\` when you send something that may need a later ` + "follow-up — for example, a question, approval request, handoff, or blocker — and silence would " + "leave the work unfinished. If no newer message appears in that channel, thread, or DM during " + "the duration, you'll receive a reminder to return and decide what to do next. Don't add it to " + "ordinary messages that need no follow-up.",
+    "",
+    `Example: \`${CLI} message send --target /demo#1234/team --text "Please review the rollout plan" ` + `--remind-after 1m\`.`
   ].join(`
 `);
 }
@@ -1286,13 +1292,18 @@ function codexSessionRootCandidates(homeDirOrCodexRoot) {
 // src/version.ts
 import { createRequire } from "module";
 var requireFromHere = createRequire(import.meta.url);
+var PACKAGE_JSON_CANDIDATES = ["../package.json", "../../package.json"];
 function readDaemonVersion() {
-  try {
-    const pkg = requireFromHere("../package.json");
-    return pkg.version ?? "";
-  } catch {
-    return "";
+  for (const candidate of PACKAGE_JSON_CANDIDATES) {
+    try {
+      const pkg = requireFromHere(candidate);
+      if (typeof pkg.version === "string" && pkg.version.length > 0)
+        return pkg.version;
+    } catch {
+      continue;
+    }
   }
+  return "";
 }
 function getDaemonClientInfo() {
   return { name: "alook-daemon", version: readDaemonVersion() };
@@ -5168,519 +5179,13 @@ function createTypingScopeTracker() {
   };
 }
 // src/credentials/credentialProxy.ts
-import * as crypto from "crypto";
+import * as crypto2 from "crypto";
 import * as fs5 from "fs";
 import * as http from "http";
 import * as https from "https";
 import * as os2 from "os";
 import * as path7 from "path";
 import { URL as URL2 } from "url";
-var DEFAULT_HEADER_NAMES = {
-  agentId: "X-Agent-Id",
-  client: "X-Client",
-  capabilities: "X-Agent-Active-Capabilities"
-};
-function randomVoucher(prefix) {
-  return prefix + crypto.randomBytes(32).toString("base64url");
-}
-function sanitizeIdSegment(id) {
-  return id.replace(/[^A-Za-z0-9._-]/g, "_") || "_";
-}
-
-class CredentialBroker {
-  registrations = new Map;
-  voucherPrefix;
-  voucherDir;
-  upstreamBaseUrl;
-  clientLabel;
-  headerNames;
-  constructor(config) {
-    if (!config.upstreamBaseUrl)
-      throw new Error("CredentialBroker: upstreamBaseUrl is required");
-    this.upstreamBaseUrl = config.upstreamBaseUrl.replace(/\/+$/, "");
-    this.voucherPrefix = config.voucherPrefix ?? "vch_";
-    this.clientLabel = config.clientLabel ?? "cli";
-    this.headerNames = config.headerNames ?? DEFAULT_HEADER_NAMES;
-    this.voucherDir = config.voucherDir ?? path7.join(os2.tmpdir(), "agent-vouchers");
-  }
-  mint(agentId, launchId, capabilities, runnerKey) {
-    if (!runnerKey)
-      throw new Error("CredentialBroker.mint: runnerKey is required (per-agent tier-2 credential)");
-    const voucher = randomVoucher(this.voucherPrefix);
-    const dir = path7.join(this.voucherDir, sanitizeIdSegment(agentId));
-    fs5.mkdirSync(dir, { recursive: true });
-    const voucherFile = path7.join(dir, `${sanitizeIdSegment(launchId)}.token`);
-    fs5.writeFileSync(voucherFile, voucher, { mode: 384 });
-    this.registrations.set(voucher, {
-      agentId,
-      launchId,
-      capabilities: new Set(capabilities),
-      voucherFile,
-      runnerKey
-    });
-    return { voucher, agentId, launchId, capabilities: [...capabilities], voucherFile };
-  }
-  revoke(voucher) {
-    const reg = this.registrations.get(voucher);
-    if (!reg)
-      return false;
-    this.registrations.delete(voucher);
-    try {
-      fs5.rmSync(reg.voucherFile, { force: true });
-    } catch {}
-    return true;
-  }
-  revokeAgent(agentId) {
-    let n = 0;
-    for (const [voucher, reg] of this.registrations) {
-      if (reg.agentId === agentId && this.revoke(voucher))
-        n++;
-    }
-    return n;
-  }
-  get size() {
-    return this.registrations.size;
-  }
-  check(authHeader, requiredCapability) {
-    const voucher = parseBearer(authHeader);
-    if (!voucher) {
-      return { ok: false, status: 401, code: "missing_voucher", error: "missing bearer voucher" };
-    }
-    const reg = this.registrations.get(voucher);
-    if (!reg) {
-      return { ok: false, status: 401, code: "invalid_proxy_token", error: "invalid local agent proxy token" };
-    }
-    if (requiredCapability && !reg.capabilities.has(requiredCapability)) {
-      return {
-        ok: false,
-        status: 403,
-        code: "capability_denied",
-        error: `capability '${requiredCapability}' not granted to this voucher`
-      };
-    }
-    return { ok: true, reg };
-  }
-}
-function parseBearer(authHeader) {
-  if (!authHeader)
-    return null;
-  const m = /^Bearer\s+(.+)$/i.exec(authHeader.trim());
-  return m ? m[1].trim() : null;
-}
-var DEFAULT_CAPABILITY_RESOLVER = (method, pathname) => {
-  if (pathname.includes("/attachment"))
-    return "attach";
-  if (/\/friends(\/|$|\?)/.test(pathname))
-    return "friend";
-  const isMessagesDoor = /\/channels\/[^/]+\/messages(\/|$|\?)/.test(pathname);
-  if (isMessagesDoor)
-    return method === "GET" ? "read" : "send";
-  if (/\/messages\/[^/]+\/reactions\//.test(pathname))
-    return "send";
-  if ((method === "PUT" || method === "DELETE") && /\/messages\/[^/]+\/marks(\/|$|\?)/.test(pathname))
-    return "send";
-  if (method === "GET" && /\/users\/me\/marks(\/|$|\?)/.test(pathname))
-    return "read";
-  if (method === "GET" && /\/messages\/[^/]+(\?|$)/.test(pathname))
-    return "read";
-  if (pathname.includes("/history") || pathname.includes("/search") || pathname.includes("/inbox"))
-    return "read";
-  if (pathname.includes("/server") || pathname.includes("/channel"))
-    return "server";
-  return;
-};
-var DEFAULT_UPSTREAM_TIMEOUT_MS = 20000;
-async function startCredentialProxy(broker, options = {}) {
-  const host = options.host ?? "127.0.0.1";
-  const resolveCap = options.capabilityResolver ?? DEFAULT_CAPABILITY_RESOLVER;
-  const upstream = new URL2(broker.upstreamBaseUrl);
-  const upstreamClient = upstream.protocol === "https:" ? https : http;
-  const onPull = options.onInboxPullResponse;
-  const onProxyRequest = options.onProxyRequest;
-  const server = http.createServer((req, res) => {
-    const pathname = new URL2(req.url ?? "/", "http://placeholder").pathname;
-    const requiredCap = resolveCap(req.method ?? "GET", pathname);
-    const verdict = broker.check(req.headers["authorization"], requiredCap);
-    if (!verdict.ok) {
-      res.writeHead(verdict.status, { "content-type": "application/json" });
-      res.end(JSON.stringify({ error: verdict.error, code: verdict.code }));
-      req.resume();
-      return;
-    }
-    const canonicalCommunityDoor = /^\/api\/community\/(channels|messages|servers|invites|friends|users|bots)(\/|$)/.test(pathname);
-    if (pathname === "/api" || pathname.startsWith("/api/") && !canonicalCommunityDoor) {
-      res.writeHead(404, { "content-type": "application/json" });
-      res.end(JSON.stringify({ error: "unknown API route", code: "not_found" }));
-      req.resume();
-      return;
-    }
-    const reg = verdict.reg;
-    const isInboxPull = onPull && pathname === "/api/community/users/me/inbox/pull";
-    if (onProxyRequest) {
-      try {
-        onProxyRequest(reg.agentId, req.method ?? "GET", pathname);
-      } catch {}
-    }
-    const outHeaders = { ...req.headers };
-    delete outHeaders["authorization"];
-    delete outHeaders["host"];
-    outHeaders["authorization"] = `Bearer ${reg.runnerKey}`;
-    outHeaders[broker.headerNames.agentId.toLowerCase()] = reg.agentId;
-    outHeaders[broker.headerNames.client.toLowerCase()] = broker.clientLabel;
-    outHeaders[broker.headerNames.capabilities.toLowerCase()] = [...reg.capabilities].join(",");
-    let responded = false;
-    let upstreamRes;
-    const upstreamReq = upstreamClient.request({
-      protocol: upstream.protocol,
-      hostname: upstream.hostname,
-      port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
-      method: req.method,
-      path: joinPath(upstream.pathname, req.url ?? "/"),
-      headers: outHeaders
-    }, (res_) => {
-      responded = true;
-      upstreamRes = res_;
-      const destroyResIfIncomplete = () => {
-        if (!res_.complete)
-          res.destroy();
-      };
-      res_.on("error", destroyResIfIncomplete);
-      res_.on("close", destroyResIfIncomplete);
-      if (isInboxPull && res_.statusCode && res_.statusCode < 300) {
-        const chunks = [];
-        res_.on("data", (chunk) => chunks.push(chunk));
-        res_.on("end", () => {
-          const body = Buffer.concat(chunks);
-          res.writeHead(res_.statusCode, res_.headers);
-          res.end(body);
-          try {
-            const parsed = JSON.parse(body.toString());
-            if (parsed.messages)
-              onPull(reg.agentId, parsed.messages);
-          } catch {}
-        });
-      } else {
-        res.writeHead(res_.statusCode ?? 502, res_.headers);
-        res_.pipe(res);
-      }
-    });
-    upstreamReq.on("error", (err) => {
-      if (responded)
-        return;
-      responded = true;
-      res.writeHead(502, { "content-type": "application/json" });
-      res.end(JSON.stringify({ error: `upstream error: ${err.message}`, code: "upstream_error" }));
-    });
-    const upstreamTimeoutMs = options.upstreamTimeoutMs ?? DEFAULT_UPSTREAM_TIMEOUT_MS;
-    upstreamReq.setTimeout(upstreamTimeoutMs, () => {
-      upstreamReq.destroy();
-      upstreamRes?.destroy();
-      if (responded) {
-        res.destroy();
-        return;
-      }
-      responded = true;
-      res.writeHead(504, { "content-type": "application/json" });
-      res.end(JSON.stringify({ error: `upstream request timed out after ${upstreamTimeoutMs}ms`, code: "upstream_timeout" }));
-    });
-    res.on("close", () => {
-      upstreamReq.destroy();
-      upstreamRes?.destroy();
-    });
-    req.pipe(upstreamReq);
-  });
-  await new Promise((resolve3, reject) => {
-    server.once("error", reject);
-    server.listen(options.port ?? 0, host, () => {
-      server.removeListener("error", reject);
-      resolve3();
-    });
-  });
-  const addr = server.address();
-  const port = typeof addr === "object" && addr ? addr.port : options.port ?? 0;
-  const url = `http://${host}:${port}`;
-  return {
-    url,
-    port,
-    close: () => new Promise((resolve3) => {
-      server.close(() => resolve3());
-    })
-  };
-}
-function joinPath(basePath, reqUrl) {
-  const base = basePath.replace(/\/+$/, "");
-  const reqPath = reqUrl.startsWith("/") ? reqUrl : `/${reqUrl}`;
-  return base + reqPath || "/";
-}
-// src/daemon/createDaemon.ts
-import { homedir as homedir3 } from "os";
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync6 } from "node:fs";
-
-// src/util/rotatingFileSink.ts
-import {
-  appendFileSync,
-  chmodSync,
-  closeSync,
-  constants,
-  existsSync as existsSync5,
-  fstatSync,
-  lstatSync as lstatSync2,
-  openSync,
-  renameSync,
-  statSync,
-  unlinkSync as unlinkSync3
-} from "node:fs";
-function createRotatingFileSink(path8, maxBytes, opts = {}) {
-  const report = (operation, error) => {
-    try {
-      opts.onError?.({ operation, error });
-    } catch {}
-  };
-  const secureGeneration = (filePath) => {
-    if (!existsSync5(filePath))
-      return true;
-    try {
-      const stat = lstatSync2(filePath);
-      if (!stat.isFile()) {
-        if (opts.mode === undefined && !opts.hardMaxBytes)
-          return true;
-        report("unsafe_generation", new Error("log generation is not a regular file"));
-        return false;
-      }
-      if (opts.mode !== undefined)
-        chmodSync(filePath, opts.mode);
-      if (opts.hardMaxBytes && maxBytes > 0 && stat.size > maxBytes) {
-        try {
-          unlinkSync3(filePath);
-        } catch (error) {
-          report("oversize_generation", error);
-          return false;
-        }
-        report("oversize_generation", new Error(`removed generation larger than ${maxBytes} bytes`));
-      }
-      return true;
-    } catch (error) {
-      report("chmod", error);
-      return false;
-    }
-  };
-  const rotate = () => {
-    try {
-      renameSync(path8, `${path8}.1`);
-      if (opts.mode !== undefined)
-        chmodSync(`${path8}.1`, opts.mode);
-      return true;
-    } catch (error) {
-      report("rotate", error);
-      return false;
-    }
-  };
-  const currentSize = () => {
-    try {
-      return existsSync5(path8) ? statSync(path8).size : 0;
-    } catch (error) {
-      report("stat", error);
-      return null;
-    }
-  };
-  const sink = {
-    secure() {
-      return secureGeneration(`${path8}.1`) && secureGeneration(path8);
-    },
-    write(line) {
-      try {
-        if (!sink.secure())
-          return;
-        const serialized = line + `
-`;
-        const serializedBytes = Buffer.byteLength(serialized, "utf8");
-        if (opts.hardMaxBytes && maxBytes > 0 && serializedBytes > maxBytes) {
-          report("oversize", new Error(`record exceeds ${maxBytes} bytes`));
-          return;
-        }
-        const measuredBytes = currentSize();
-        if (measuredBytes === null && opts.hardMaxBytes)
-          return;
-        const currentBytes = measuredBytes ?? 0;
-        const shouldRotate = maxBytes > 0 && (opts.hardMaxBytes ? currentBytes > 0 && currentBytes + serializedBytes > maxBytes : currentBytes >= maxBytes);
-        if (shouldRotate && !rotate() && opts.hardMaxBytes)
-          return;
-        appendFileSync(path8, serialized, opts.mode === undefined ? undefined : { mode: opts.mode });
-      } catch (error) {
-        report("append", error);
-      }
-    },
-    openSnapshot() {
-      const files = [];
-      try {
-        for (const candidate of [`${path8}.1`, path8]) {
-          if (!existsSync5(candidate))
-            continue;
-          if (!secureGeneration(candidate))
-            continue;
-          const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
-          const fd = openSync(candidate, constants.O_RDONLY | noFollow);
-          try {
-            const stat = fstatSync(fd);
-            if (!stat.isFile())
-              throw new Error("snapshot source is not a regular file");
-            files.push({ path: candidate, fd, size: stat.size });
-          } catch (error) {
-            closeSync(fd);
-            throw error;
-          }
-        }
-      } catch (error) {
-        for (const file of files) {
-          try {
-            closeSync(file.fd);
-          } catch {}
-        }
-        report("snapshot", error);
-        return { files: [], close: () => {} };
-      }
-      let closed = false;
-      return {
-        files,
-        close() {
-          if (closed)
-            return;
-          closed = true;
-          for (const file of files) {
-            try {
-              closeSync(file.fd);
-            } catch {}
-          }
-        }
-      };
-    }
-  };
-  return sink;
-}
-
-// src/util/traceSampler.ts
-var SAMPLEABLE_EVENTS = new Set(["tick", "progress", "runtime_signal"]);
-var SACRED_TURN_SPAN_EVENTS = new Set(["turn_begin", "turn_end", "turn_abort"]);
-var DEFAULT_TRACE_SAMPLE_MS = 30000;
-var DEFAULT_TRACE_FILE_MAX_BYTES = 32 * 1024 * 1024;
-function newAgentState() {
-  return {
-    lastTickKey: null,
-    lastTickEmitAt: Number.NEGATIVE_INFINITY,
-    pendingTick: null,
-    lastProgressEmitAt: Number.NEGATIVE_INFINITY,
-    lastSignalPhase: null,
-    lastSignalEmitAt: Number.NEGATIVE_INFINITY
-  };
-}
-function tickKey(rec) {
-  return [
-    rec.status,
-    rec.turnActive,
-    rec.inbox,
-    rec.resetting,
-    rec.stoppingSince == null ? "s0" : "s1"
-  ].join("|");
-}
-function hasEffects(rec) {
-  const e = rec.effects;
-  return Array.isArray(e) && e.length > 0;
-}
-function nowOf(rec) {
-  return typeof rec.nowMs === "number" ? rec.nowMs : 0;
-}
-function createTraceSampler(emit, throttleMs = DEFAULT_TRACE_SAMPLE_MS) {
-  const perAgent = new Map;
-  const stateFor = (agentId) => {
-    let s = perAgent.get(agentId);
-    if (!s) {
-      s = newAgentState();
-      perAgent.set(agentId, s);
-    }
-    return s;
-  };
-  const flushPending = (s) => {
-    if (s.pendingTick) {
-      const p = s.pendingTick;
-      s.pendingTick = null;
-      s.lastTickEmitAt = nowOf(p);
-      emit(p);
-    }
-  };
-  return {
-    offer(rec) {
-      const agentId = typeof rec.agentId === "string" ? rec.agentId : null;
-      if (!agentId) {
-        emit(rec);
-        return;
-      }
-      const s = stateFor(agentId);
-      const event = rec.event;
-      if (rec.recordKind === "turn_span" && SACRED_TURN_SPAN_EVENTS.has(String(event))) {
-        flushPending(s);
-        emit(rec);
-        return;
-      }
-      if (!SAMPLEABLE_EVENTS.has(event) || hasEffects(rec)) {
-        flushPending(s);
-        if (event === "tick") {
-          s.lastTickKey = tickKey(rec);
-          s.lastTickEmitAt = nowOf(rec);
-        }
-        emit(rec);
-        return;
-      }
-      if (event === "tick") {
-        const key = tickKey(rec);
-        const now = nowOf(rec);
-        if (key !== s.lastTickKey) {
-          flushPending(s);
-          s.lastTickKey = key;
-          s.lastTickEmitAt = now;
-          emit(rec);
-          return;
-        }
-        if (now - s.lastTickEmitAt >= throttleMs) {
-          s.pendingTick = null;
-          s.lastTickEmitAt = now;
-          emit(rec);
-        } else {
-          s.pendingTick = rec;
-        }
-        return;
-      }
-      if (event === "progress") {
-        const now = nowOf(rec);
-        if (now - s.lastProgressEmitAt >= throttleMs) {
-          s.lastProgressEmitAt = now;
-          emit(rec);
-        }
-        return;
-      }
-      if (event === "runtime_signal") {
-        const phase = typeof rec.apmPhase === "string" ? rec.apmPhase : "";
-        const now = nowOf(rec);
-        if (phase !== s.lastSignalPhase || now - s.lastSignalEmitAt >= throttleMs) {
-          s.lastSignalPhase = phase;
-          s.lastSignalEmitAt = now;
-          emit(rec);
-        }
-        return;
-      }
-      emit(rec);
-    }
-  };
-}
-
-// src/util/statusFile.ts
-import { writeFileSync as writeFileSync4, renameSync as renameSync2 } from "node:fs";
-function writeStatusFile(path8, snapshot) {
-  try {
-    const tmp = `${path8}.tmp`;
-    writeFileSync4(tmp, JSON.stringify(snapshot));
-    renameSync2(tmp, path8);
-  } catch {}
-}
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
@@ -6446,10 +5951,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path8) {
-  if (!path8)
+function getElementAtPath(obj, path7) {
+  if (!path7)
     return obj;
-  return path8.reduce((acc, key) => acc?.[key], obj);
+  return path7.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6857,11 +6362,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path8, issues) {
+function prefixIssues(path7, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path8);
+    iss.path.unshift(path7);
     return iss;
   });
 }
@@ -7008,16 +6513,16 @@ function flattenError(error, mapper = (issue2) => issue2.message) {
 }
 function formatError(error, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error2, path8 = []) => {
+  const processError = (error2, path7 = []) => {
     for (const issue2 of error2.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path7, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
       } else {
-        const fullpath = [...path8, ...issue2.path];
+        const fullpath = [...path7, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -7044,17 +6549,17 @@ function formatError(error, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error2, path8 = []) => {
+  const processError = (error2, path7 = []) => {
     var _a2, _b;
     for (const issue2 of error2.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path7, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
       } else {
-        const fullpath = [...path8, ...issue2.path];
+        const fullpath = [...path7, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -7086,8 +6591,8 @@ function treeifyError(error, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path8 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path8) {
+  const path7 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path7) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19546,13 +19051,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path8 = ref.slice(1).split("/").filter(Boolean);
-  if (path8.length === 0) {
+  const path7 = ref.slice(1).split("/").filter(Boolean);
+  if (path7.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path8[0] === defsKey) {
-    const key = path8[1];
+  if (path7[0] === defsKey) {
+    const key = path7[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19959,6 +19464,16 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 // ../shared/src/lib/discriminator.ts
+function parseNameAndTag(q) {
+  const m = /^(.+)#(\d{4,})$/.exec(q);
+  if (!m)
+    return null;
+  const name = m[1].trim();
+  const discriminator = m[2];
+  if (!name)
+    return null;
+  return { name, discriminator };
+}
 function formatHandle(name, discriminator) {
   return `${name}#${discriminator}`;
 }
@@ -20549,7 +20064,7 @@ function sql(strings, ...params) {
     return new SQL([new StringChunk(str)]);
   }
   sql2.raw = raw;
-  function join9(chunks, separator) {
+  function join8(chunks, separator) {
     const result = [];
     for (const [i, chunk] of chunks.entries()) {
       if (i > 0 && separator !== undefined) {
@@ -20559,7 +20074,7 @@ function sql(strings, ...params) {
     }
     return new SQL(result);
   }
-  sql2.join = join9;
+  sql2.join = join8;
   function identifier(value) {
     return new Name(value);
   }
@@ -21337,7 +20852,7 @@ class PrimaryKey {
 }
 
 // ../../node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/index.js
-import { webcrypto as crypto2 } from "node:crypto";
+import { webcrypto as crypto } from "node:crypto";
 
 // ../../node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/url-alphabet/index.js
 var urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
@@ -21352,10 +20867,10 @@ function fillPool(bytes) {
   try {
     if (!pool || pool.length < bytes) {
       pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
-      crypto2.getRandomValues(pool);
+      crypto.getRandomValues(pool);
       poolOffset = 0;
     } else if (poolOffset + bytes > pool.length) {
-      crypto2.getRandomValues(pool);
+      crypto.getRandomValues(pool);
       poolOffset = 0;
     }
   } catch (e) {
@@ -22192,6 +21707,81 @@ var OwnerDiagnosticReportSchema = exports_external.discriminatedUnion("status",
 ]);
 
 // ../shared/src/community-cli-contract.ts
+var DM_SERVER = ".dm";
+function parseRef(ref) {
+  if (!ref.startsWith("/"))
+    throw new Error(`ref must start with "/": ${ref}`);
+  const body = ref.slice(1);
+  const parts = body.split("/");
+  if (parts.length < 2)
+    throw new Error(`ref needs /<server>/<channel>: ${ref}`);
+  const server = parts[0];
+  if (server !== DM_SERVER && !parseNameAndTag(server)) {
+    throw new Error(`server ref must use a name#discriminator handle: ${ref}`);
+  }
+  let seq;
+  if (parts.length >= 3 && parts[parts.length - 1].startsWith("#")) {
+    const tail = parseThreadTail(parts[parts.length - 1]);
+    return { server, channel: parts[1], ...tail };
+  }
+  if (parts.length >= 3 && server !== DM_SERVER) {
+    throw new Error(`ref has too many segments: ${ref}`);
+  }
+  const chSeg = parts[1];
+  if (server === DM_SERVER) {
+    const lastHash = chSeg.lastIndexOf("#");
+    if (lastHash < 0)
+      return { server, channel: chSeg };
+    const firstHash = chSeg.indexOf("#");
+    const tail = chSeg.slice(lastHash + 1);
+    const isBareHandle = firstHash === lastHash && /^\d{4,}$/.test(tail);
+    if (isBareHandle)
+      return { server, channel: chSeg };
+    const tailNum = Number(tail.startsWith("#") ? tail.slice(1) : tail);
+    if (!Number.isFinite(tailNum))
+      return { server, channel: chSeg };
+    seq = parseSeq(tail);
+    return { server, channel: chSeg.slice(0, lastHash), seq };
+  }
+  const hashIdx = chSeg.indexOf("#");
+  if (hashIdx >= 0) {
+    seq = parseSeq(chSeg.slice(hashIdx));
+    return { server, channel: chSeg.slice(0, hashIdx), seq };
+  }
+  return { server, channel: chSeg };
+}
+function parseThreadTail(segment) {
+  const stripped = segment.startsWith("#") ? segment.slice(1) : segment;
+  const tokens = stripped.split("#");
+  if (tokens.length < 1 || tokens.length > 2) {
+    throw new Error(`bad thread ref tail: #${stripped}`);
+  }
+  for (const t of tokens) {
+    if (!t)
+      throw new Error(`bad thread ref tail: #${stripped} (empty seq)`);
+  }
+  const threadRootSeq = parseSeq(tokens[0]);
+  if (tokens.length === 1)
+    return { threadRootSeq };
+  return { threadRootSeq, seq: parseSeq(tokens[1]) };
+}
+function formatRef(p) {
+  if (p.seq !== undefined && p.threadRootSeq === undefined) {
+    throw new Error("formatRef: seq without threadRootSeq is not supported");
+  }
+  const base = `/${p.server}/${p.channel}`;
+  if (p.threadRootSeq === undefined)
+    return base;
+  if (p.seq === undefined)
+    return `${base}/#${p.threadRootSeq}`;
+  return `${base}/#${p.threadRootSeq}#${p.seq}`;
+}
+function parseSeq(s) {
+  const n = Number(s.startsWith("#") ? s.slice(1) : s);
+  if (!Number.isFinite(n))
+    throw new Error(`bad seq: ${s}`);
+  return n;
+}
 var HostCommandSchema = exports_external.discriminatedUnion("type", [
   exports_external.object({
     type: exports_external.literal("agent:wake"),
@@ -22232,6 +21822,9 @@ var HostCommandSchema = exports_external.discriminatedUnion("type", [
       launchId: exports_external.string().min(1)
     }))
   }),
+  exports_external.strictObject({
+    type: exports_external.literal("machine:update")
+  }),
   exports_external.object({
     type: exports_external.literal("bot:added"),
     botId: exports_external.string().min(1),
@@ -22256,16 +21849,641 @@ var HostCommandSchema = exports_external.discriminatedUnion("type", [
   }),
   DiagnosticCollectCommandSchema
 ]);
-// src/server/wsControlChannel.ts
-var WS_CONTROL_COMMAND_CONSUMED = Symbol("ws-control-command-consumed");
-var DEFAULT_PING_INTERVAL_MS = 15000;
-var DEFAULT_PONG_TIMEOUT_MS = 30000;
-var DEFAULT_RECONNECT_BASE_MS = 500;
-var DEFAULT_RECONNECT_MAX_MS = 30000;
-function describeErr(err) {
-  return err instanceof Error ? err.message : String(err);
+// src/credentials/credentialProxy.ts
+var LOCAL_MESSAGE_REMINDER_PATH = "/__alook/local/message-reminder";
+var LOCAL_MESSAGE_REMINDER_BODY_MAX_BYTES = 4 * 1024;
+var LOCAL_MESSAGE_REMINDER_MIN_MS = 60000;
+var LOCAL_MESSAGE_REMINDER_MAX_MS = 24 * 60 * 60000;
+var DEFAULT_HEADER_NAMES = {
+  agentId: "X-Agent-Id",
+  client: "X-Client",
+  capabilities: "X-Agent-Active-Capabilities"
+};
+function randomVoucher(prefix) {
+  return prefix + crypto2.randomBytes(32).toString("base64url");
 }
-
+function sanitizeIdSegment(id) {
+  return id.replace(/[^A-Za-z0-9._-]/g, "_") || "_";
+}
+
+class CredentialBroker {
+  registrations = new Map;
+  voucherPrefix;
+  voucherDir;
+  upstreamBaseUrl;
+  clientLabel;
+  headerNames;
+  constructor(config2) {
+    if (!config2.upstreamBaseUrl)
+      throw new Error("CredentialBroker: upstreamBaseUrl is required");
+    this.upstreamBaseUrl = config2.upstreamBaseUrl.replace(/\/+$/, "");
+    this.voucherPrefix = config2.voucherPrefix ?? "vch_";
+    this.clientLabel = config2.clientLabel ?? "cli";
+    this.headerNames = config2.headerNames ?? DEFAULT_HEADER_NAMES;
+    this.voucherDir = config2.voucherDir ?? path7.join(os2.tmpdir(), "agent-vouchers");
+  }
+  mint(agentId, launchId, capabilities, runnerKey) {
+    if (!runnerKey)
+      throw new Error("CredentialBroker.mint: runnerKey is required (per-agent tier-2 credential)");
+    const voucher = randomVoucher(this.voucherPrefix);
+    const dir = path7.join(this.voucherDir, sanitizeIdSegment(agentId));
+    fs5.mkdirSync(dir, { recursive: true });
+    const voucherFile = path7.join(dir, `${sanitizeIdSegment(launchId)}.token`);
+    fs5.writeFileSync(voucherFile, voucher, { mode: 384 });
+    this.registrations.set(voucher, {
+      agentId,
+      launchId,
+      capabilities: new Set(capabilities),
+      voucherFile,
+      runnerKey
+    });
+    return { voucher, agentId, launchId, capabilities: [...capabilities], voucherFile };
+  }
+  revoke(voucher) {
+    const reg = this.registrations.get(voucher);
+    if (!reg)
+      return false;
+    this.registrations.delete(voucher);
+    try {
+      fs5.rmSync(reg.voucherFile, { force: true });
+    } catch {}
+    return true;
+  }
+  revokeAgent(agentId) {
+    let n = 0;
+    for (const [voucher, reg] of this.registrations) {
+      if (reg.agentId === agentId && this.revoke(voucher))
+        n++;
+    }
+    return n;
+  }
+  get size() {
+    return this.registrations.size;
+  }
+  check(authHeader, requiredCapability) {
+    const voucher = parseBearer(authHeader);
+    if (!voucher) {
+      return { ok: false, status: 401, code: "missing_voucher", error: "missing bearer voucher" };
+    }
+    const reg = this.registrations.get(voucher);
+    if (!reg) {
+      return { ok: false, status: 401, code: "invalid_proxy_token", error: "invalid local agent proxy token" };
+    }
+    if (requiredCapability && !reg.capabilities.has(requiredCapability)) {
+      return {
+        ok: false,
+        status: 403,
+        code: "capability_denied",
+        error: `capability '${requiredCapability}' not granted to this voucher`
+      };
+    }
+    return { ok: true, reg };
+  }
+}
+function parseBearer(authHeader) {
+  if (!authHeader)
+    return null;
+  const m = /^Bearer\s+(.+)$/i.exec(authHeader.trim());
+  return m ? m[1].trim() : null;
+}
+var DEFAULT_CAPABILITY_RESOLVER = (method, pathname) => {
+  if (pathname.includes("/attachment"))
+    return "attach";
+  if (/\/friends(\/|$|\?)/.test(pathname))
+    return "friend";
+  const isMessagesDoor = /\/channels\/[^/]+\/messages(\/|$|\?)/.test(pathname);
+  if (isMessagesDoor)
+    return method === "GET" ? "read" : "send";
+  if (/\/messages\/[^/]+\/reactions\//.test(pathname))
+    return "send";
+  if ((method === "PUT" || method === "DELETE") && /\/messages\/[^/]+\/marks(\/|$|\?)/.test(pathname))
+    return "send";
+  if (method === "GET" && /\/users\/me\/marks(\/|$|\?)/.test(pathname))
+    return "read";
+  if (method === "GET" && /\/messages\/[^/]+(\?|$)/.test(pathname))
+    return "read";
+  if (pathname.includes("/history") || pathname.includes("/search") || pathname.includes("/inbox"))
+    return "read";
+  if (pathname.includes("/server") || pathname.includes("/channel"))
+    return "server";
+  return;
+};
+var DEFAULT_UPSTREAM_TIMEOUT_MS = 20000;
+function writeJson(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function isCanonicalChannelScope(channel2) {
+  try {
+    const parsed = parseRef(channel2);
+    if (!parsed.channel || parsed.seq !== undefined)
+      return false;
+    if (parsed.threadRootSeq !== undefined && (!Number.isSafeInteger(parsed.threadRootSeq) || parsed.threadRootSeq < 1)) {
+      return false;
+    }
+    const handle = parseNameAndTag(parsed.server === ".dm" ? parsed.channel : parsed.server);
+    if (!handle || `${handle.name}#${handle.discriminator}` !== (parsed.server === ".dm" ? parsed.channel : parsed.server)) {
+      return false;
+    }
+    return formatRef(parsed) === channel2;
+  } catch {
+    return false;
+  }
+}
+function parseLocalMessageReminderBody(body, agentId) {
+  let value;
+  try {
+    value = JSON.parse(body.toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const record2 = value;
+  if (Object.keys(record2).sort().join(",") !== "channel,remindAfterMs,sentSeq")
+    return null;
+  if (typeof record2.channel !== "string" || !isCanonicalChannelScope(record2.channel))
+    return null;
+  if (!Number.isSafeInteger(record2.sentSeq) || record2.sentSeq < 1)
+    return null;
+  if (!Number.isSafeInteger(record2.remindAfterMs) || record2.remindAfterMs < LOCAL_MESSAGE_REMINDER_MIN_MS || record2.remindAfterMs > LOCAL_MESSAGE_REMINDER_MAX_MS)
+    return null;
+  return {
+    agentId,
+    channel: record2.channel,
+    sentSeq: record2.sentSeq,
+    remindAfterMs: record2.remindAfterMs
+  };
+}
+async function handleLocalMessageReminder(req, res, agentId, onArm) {
+  const contentType = req.headers["content-type"] ?? "";
+  if (!contentType.toLowerCase().startsWith("application/json")) {
+    writeJson(res, 415, { error: "content-type must be application/json", code: "unsupported_media_type" });
+    req.resume();
+    return;
+  }
+  const declaredLength = Number(req.headers["content-length"] ?? 0);
+  if (!Number.isFinite(declaredLength) || declaredLength > LOCAL_MESSAGE_REMINDER_BODY_MAX_BYTES) {
+    writeJson(res, 413, { error: "request body too large", code: "body_too_large" });
+    req.resume();
+    return;
+  }
+  const chunks = [];
+  let bytes = 0;
+  let tooLarge = false;
+  await new Promise((resolve3) => {
+    req.on("data", (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes > LOCAL_MESSAGE_REMINDER_BODY_MAX_BYTES) {
+        tooLarge = true;
+      } else {
+        chunks.push(chunk);
+      }
+    });
+    req.on("end", resolve3);
+    req.on("error", resolve3);
+  });
+  if (tooLarge) {
+    writeJson(res, 413, { error: "request body too large", code: "body_too_large" });
+    return;
+  }
+  const input = parseLocalMessageReminderBody(Buffer.concat(chunks), agentId);
+  if (!input) {
+    writeJson(res, 400, { error: "invalid local message reminder request", code: "invalid_request" });
+    return;
+  }
+  if (!onArm) {
+    writeJson(res, 503, { error: "local message reminder unavailable", code: "reminder_unavailable" });
+    return;
+  }
+  try {
+    writeJson(res, 200, await onArm(input));
+  } catch {
+    writeJson(res, 500, { error: "local message reminder failed", code: "reminder_failed" });
+  }
+}
+async function startCredentialProxy(broker, options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const resolveCap = options.capabilityResolver ?? DEFAULT_CAPABILITY_RESOLVER;
+  const upstream = new URL2(broker.upstreamBaseUrl);
+  const upstreamClient = upstream.protocol === "https:" ? https : http;
+  const onPull = options.onInboxPullResponse;
+  const onProxyRequest = options.onProxyRequest;
+  const server = http.createServer((req, res) => {
+    const pathname = new URL2(req.url ?? "/", "http://placeholder").pathname;
+    if (pathname.startsWith("/__alook/local/")) {
+      if (req.url !== LOCAL_MESSAGE_REMINDER_PATH) {
+        writeJson(res, 404, { error: "unknown local route", code: "not_found" });
+        req.resume();
+        return;
+      }
+      if (req.method !== "PUT") {
+        writeJson(res, 405, { error: "method not allowed", code: "method_not_allowed" });
+        req.resume();
+        return;
+      }
+      const localVerdict = broker.check(req.headers["authorization"], "send");
+      if (!localVerdict.ok) {
+        writeJson(res, localVerdict.status, { error: localVerdict.error, code: localVerdict.code });
+        req.resume();
+        return;
+      }
+      handleLocalMessageReminder(req, res, localVerdict.reg.agentId, options.onMessageReminderArm);
+      return;
+    }
+    const requiredCap = resolveCap(req.method ?? "GET", pathname);
+    const verdict = broker.check(req.headers["authorization"], requiredCap);
+    if (!verdict.ok) {
+      res.writeHead(verdict.status, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: verdict.error, code: verdict.code }));
+      req.resume();
+      return;
+    }
+    const canonicalCommunityDoor = /^\/api\/community\/(channels|messages|servers|invites|friends|users|bots)(\/|$)/.test(pathname);
+    if (pathname === "/api" || pathname.startsWith("/api/") && !canonicalCommunityDoor) {
+      res.writeHead(404, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "unknown API route", code: "not_found" }));
+      req.resume();
+      return;
+    }
+    const reg = verdict.reg;
+    const isInboxPull = onPull && pathname === "/api/community/users/me/inbox/pull";
+    if (onProxyRequest) {
+      try {
+        onProxyRequest(reg.agentId, req.method ?? "GET", pathname);
+      } catch {}
+    }
+    const outHeaders = { ...req.headers };
+    delete outHeaders["authorization"];
+    delete outHeaders["host"];
+    outHeaders["authorization"] = `Bearer ${reg.runnerKey}`;
+    outHeaders[broker.headerNames.agentId.toLowerCase()] = reg.agentId;
+    outHeaders[broker.headerNames.client.toLowerCase()] = broker.clientLabel;
+    outHeaders[broker.headerNames.capabilities.toLowerCase()] = [...reg.capabilities].join(",");
+    let responded = false;
+    let upstreamRes;
+    const upstreamReq = upstreamClient.request({
+      protocol: upstream.protocol,
+      hostname: upstream.hostname,
+      port: upstream.port || (upstream.protocol === "https:" ? 443 : 80),
+      method: req.method,
+      path: joinPath(upstream.pathname, req.url ?? "/"),
+      headers: outHeaders
+    }, (res_) => {
+      responded = true;
+      upstreamRes = res_;
+      const destroyResIfIncomplete = () => {
+        if (!res_.complete)
+          res.destroy();
+      };
+      res_.on("error", destroyResIfIncomplete);
+      res_.on("close", destroyResIfIncomplete);
+      if (isInboxPull && res_.statusCode && res_.statusCode < 300) {
+        const chunks = [];
+        res_.on("data", (chunk) => chunks.push(chunk));
+        res_.on("end", () => {
+          const body = Buffer.concat(chunks);
+          res.writeHead(res_.statusCode, res_.headers);
+          res.end(body);
+          try {
+            const parsed = JSON.parse(body.toString());
+            if (parsed.messages)
+              onPull(reg.agentId, parsed.messages);
+          } catch {}
+        });
+      } else {
+        res.writeHead(res_.statusCode ?? 502, res_.headers);
+        res_.pipe(res);
+      }
+    });
+    upstreamReq.on("error", (err) => {
+      if (responded)
+        return;
+      responded = true;
+      res.writeHead(502, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: `upstream error: ${err.message}`, code: "upstream_error" }));
+    });
+    const upstreamTimeoutMs = options.upstreamTimeoutMs ?? DEFAULT_UPSTREAM_TIMEOUT_MS;
+    upstreamReq.setTimeout(upstreamTimeoutMs, () => {
+      upstreamReq.destroy();
+      upstreamRes?.destroy();
+      if (responded) {
+        res.destroy();
+        return;
+      }
+      responded = true;
+      res.writeHead(504, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: `upstream request timed out after ${upstreamTimeoutMs}ms`, code: "upstream_timeout" }));
+    });
+    res.on("close", () => {
+      upstreamReq.destroy();
+      upstreamRes?.destroy();
+    });
+    req.pipe(upstreamReq);
+  });
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? 0, host, () => {
+      server.removeListener("error", reject);
+      resolve3();
+    });
+  });
+  const addr = server.address();
+  const port = typeof addr === "object" && addr ? addr.port : options.port ?? 0;
+  const url2 = `http://${host}:${port}`;
+  return {
+    url: url2,
+    port,
+    close: () => new Promise((resolve3) => {
+      server.close(() => resolve3());
+    })
+  };
+}
+function joinPath(basePath, reqUrl) {
+  const base = basePath.replace(/\/+$/, "");
+  const reqPath = reqUrl.startsWith("/") ? reqUrl : `/${reqUrl}`;
+  return base + reqPath || "/";
+}
+// src/daemon/createDaemon.ts
+import { homedir as homedir3 } from "os";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync6 } from "node:fs";
+
+// src/util/rotatingFileSink.ts
+import {
+  appendFileSync,
+  chmodSync,
+  closeSync,
+  constants,
+  existsSync as existsSync5,
+  fstatSync,
+  lstatSync as lstatSync2,
+  openSync,
+  renameSync,
+  statSync,
+  unlinkSync as unlinkSync3
+} from "node:fs";
+function createRotatingFileSink(path8, maxBytes, opts = {}) {
+  const report = (operation, error51) => {
+    try {
+      opts.onError?.({ operation, error: error51 });
+    } catch {}
+  };
+  const secureGeneration = (filePath) => {
+    if (!existsSync5(filePath))
+      return true;
+    try {
+      const stat = lstatSync2(filePath);
+      if (!stat.isFile()) {
+        if (opts.mode === undefined && !opts.hardMaxBytes)
+          return true;
+        report("unsafe_generation", new Error("log generation is not a regular file"));
+        return false;
+      }
+      if (opts.mode !== undefined)
+        chmodSync(filePath, opts.mode);
+      if (opts.hardMaxBytes && maxBytes > 0 && stat.size > maxBytes) {
+        try {
+          unlinkSync3(filePath);
+        } catch (error51) {
+          report("oversize_generation", error51);
+          return false;
+        }
+        report("oversize_generation", new Error(`removed generation larger than ${maxBytes} bytes`));
+      }
+      return true;
+    } catch (error51) {
+      report("chmod", error51);
+      return false;
+    }
+  };
+  const rotate = () => {
+    try {
+      renameSync(path8, `${path8}.1`);
+      if (opts.mode !== undefined)
+        chmodSync(`${path8}.1`, opts.mode);
+      return true;
+    } catch (error51) {
+      report("rotate", error51);
+      return false;
+    }
+  };
+  const currentSize = () => {
+    try {
+      return existsSync5(path8) ? statSync(path8).size : 0;
+    } catch (error51) {
+      report("stat", error51);
+      return null;
+    }
+  };
+  const sink = {
+    secure() {
+      return secureGeneration(`${path8}.1`) && secureGeneration(path8);
+    },
+    write(line) {
+      try {
+        if (!sink.secure())
+          return;
+        const serialized = line + `
+`;
+        const serializedBytes = Buffer.byteLength(serialized, "utf8");
+        if (opts.hardMaxBytes && maxBytes > 0 && serializedBytes > maxBytes) {
+          report("oversize", new Error(`record exceeds ${maxBytes} bytes`));
+          return;
+        }
+        const measuredBytes = currentSize();
+        if (measuredBytes === null && opts.hardMaxBytes)
+          return;
+        const currentBytes = measuredBytes ?? 0;
+        const shouldRotate = maxBytes > 0 && (opts.hardMaxBytes ? currentBytes > 0 && currentBytes + serializedBytes > maxBytes : currentBytes >= maxBytes);
+        if (shouldRotate && !rotate() && opts.hardMaxBytes)
+          return;
+        appendFileSync(path8, serialized, opts.mode === undefined ? undefined : { mode: opts.mode });
+      } catch (error51) {
+        report("append", error51);
+      }
+    },
+    openSnapshot() {
+      const files = [];
+      try {
+        for (const candidate of [`${path8}.1`, path8]) {
+          if (!existsSync5(candidate))
+            continue;
+          if (!secureGeneration(candidate))
+            continue;
+          const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+          const fd = openSync(candidate, constants.O_RDONLY | noFollow);
+          try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile())
+              throw new Error("snapshot source is not a regular file");
+            files.push({ path: candidate, fd, size: stat.size });
+          } catch (error51) {
+            closeSync(fd);
+            throw error51;
+          }
+        }
+      } catch (error51) {
+        for (const file2 of files) {
+          try {
+            closeSync(file2.fd);
+          } catch {}
+        }
+        report("snapshot", error51);
+        return { files: [], close: () => {} };
+      }
+      let closed = false;
+      return {
+        files,
+        close() {
+          if (closed)
+            return;
+          closed = true;
+          for (const file2 of files) {
+            try {
+              closeSync(file2.fd);
+            } catch {}
+          }
+        }
+      };
+    }
+  };
+  return sink;
+}
+
+// src/util/traceSampler.ts
+var SAMPLEABLE_EVENTS = new Set(["tick", "progress", "runtime_signal"]);
+var SACRED_TURN_SPAN_EVENTS = new Set(["turn_begin", "turn_end", "turn_abort"]);
+var DEFAULT_TRACE_SAMPLE_MS = 30000;
+var DEFAULT_TRACE_FILE_MAX_BYTES = 32 * 1024 * 1024;
+function newAgentState() {
+  return {
+    lastTickKey: null,
+    lastTickEmitAt: Number.NEGATIVE_INFINITY,
+    pendingTick: null,
+    lastProgressEmitAt: Number.NEGATIVE_INFINITY,
+    lastSignalPhase: null,
+    lastSignalEmitAt: Number.NEGATIVE_INFINITY
+  };
+}
+function tickKey(rec) {
+  return [
+    rec.status,
+    rec.turnActive,
+    rec.inbox,
+    rec.resetting,
+    rec.stoppingSince == null ? "s0" : "s1"
+  ].join("|");
+}
+function hasEffects(rec) {
+  const e = rec.effects;
+  return Array.isArray(e) && e.length > 0;
+}
+function nowOf(rec) {
+  return typeof rec.nowMs === "number" ? rec.nowMs : 0;
+}
+function createTraceSampler(emit, throttleMs = DEFAULT_TRACE_SAMPLE_MS) {
+  const perAgent = new Map;
+  const stateFor = (agentId) => {
+    let s = perAgent.get(agentId);
+    if (!s) {
+      s = newAgentState();
+      perAgent.set(agentId, s);
+    }
+    return s;
+  };
+  const flushPending = (s) => {
+    if (s.pendingTick) {
+      const p = s.pendingTick;
+      s.pendingTick = null;
+      s.lastTickEmitAt = nowOf(p);
+      emit(p);
+    }
+  };
+  return {
+    offer(rec) {
+      const agentId = typeof rec.agentId === "string" ? rec.agentId : null;
+      if (!agentId) {
+        emit(rec);
+        return;
+      }
+      const s = stateFor(agentId);
+      const event = rec.event;
+      if (rec.recordKind === "turn_span" && SACRED_TURN_SPAN_EVENTS.has(String(event))) {
+        flushPending(s);
+        emit(rec);
+        return;
+      }
+      if (!SAMPLEABLE_EVENTS.has(event) || hasEffects(rec)) {
+        flushPending(s);
+        if (event === "tick") {
+          s.lastTickKey = tickKey(rec);
+          s.lastTickEmitAt = nowOf(rec);
+        }
+        emit(rec);
+        return;
+      }
+      if (event === "tick") {
+        const key = tickKey(rec);
+        const now = nowOf(rec);
+        if (key !== s.lastTickKey) {
+          flushPending(s);
+          s.lastTickKey = key;
+          s.lastTickEmitAt = now;
+          emit(rec);
+          return;
+        }
+        if (now - s.lastTickEmitAt >= throttleMs) {
+          s.pendingTick = null;
+          s.lastTickEmitAt = now;
+          emit(rec);
+        } else {
+          s.pendingTick = rec;
+        }
+        return;
+      }
+      if (event === "progress") {
+        const now = nowOf(rec);
+        if (now - s.lastProgressEmitAt >= throttleMs) {
+          s.lastProgressEmitAt = now;
+          emit(rec);
+        }
+        return;
+      }
+      if (event === "runtime_signal") {
+        const phase = typeof rec.apmPhase === "string" ? rec.apmPhase : "";
+        const now = nowOf(rec);
+        if (phase !== s.lastSignalPhase || now - s.lastSignalEmitAt >= throttleMs) {
+          s.lastSignalPhase = phase;
+          s.lastSignalEmitAt = now;
+          emit(rec);
+        }
+        return;
+      }
+      emit(rec);
+    }
+  };
+}
+
+// src/util/statusFile.ts
+import { writeFileSync as writeFileSync4, renameSync as renameSync2 } from "node:fs";
+function writeStatusFile(path8, snapshot) {
+  try {
+    const tmp = `${path8}.tmp`;
+    writeFileSync4(tmp, JSON.stringify(snapshot));
+    renameSync2(tmp, path8);
+  } catch {}
+}
+
+// src/server/wsControlChannel.ts
+var WS_CONTROL_COMMAND_CONSUMED = Symbol("ws-control-command-consumed");
+var DEFAULT_PING_INTERVAL_MS = 15000;
+var DEFAULT_PONG_TIMEOUT_MS = 30000;
+var DEFAULT_RECONNECT_BASE_MS = 500;
+var DEFAULT_RECONNECT_MAX_MS = 30000;
+function describeErr(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 class WsControlChannel {
   opts;
   statusValue = "idle";
@@ -23273,6 +23491,108 @@ function createDiagnosticsCommandListener(options) {
   };
 }
 
+// src/daemon/selfUpdateCommand.ts
+function createSelfUpdateCommandListener(handleSelfUpdate) {
+  return (command) => {
+    if (command.type !== "machine:update")
+      return;
+    if (handleSelfUpdate) {
+      try {
+        Promise.resolve(handleSelfUpdate()).catch(() => {});
+      } catch {}
+    }
+    return WS_CONTROL_COMMAND_CONSUMED;
+  };
+}
+
+// src/daemon/messageReminderScheduler.ts
+function reminderKey(agentId, channel2) {
+  return `${agentId}\x00${channel2}`;
+}
+function reminderPrompt(channel2, sentRef, startedAt) {
+  return `Reminder: At ${localISOString(new Date(startedAt))}, after sending ${sentRef} in ${channel2}, you asked to be reminded if no newer message arrived. No newer message has arrived in that conversation.`;
+}
+
+class MessageReminderScheduler {
+  options;
+  reminders = new Map;
+  latestObservedSeq = new Map;
+  now;
+  setTimer;
+  clearTimer;
+  constructor(options) {
+    this.options = options;
+    this.now = options.now ?? Date.now;
+    this.setTimer = options.setTimer ?? ((callback, delayMs) => setTimeout(callback, delayMs));
+    this.clearTimer = options.clearTimer ?? ((timer) => clearTimeout(timer));
+  }
+  arm(input) {
+    const key = reminderKey(input.agentId, input.channel);
+    const latest = this.latestObservedSeq.get(key);
+    if (latest !== undefined && latest > input.sentSeq) {
+      return { armed: false, reason: "newer_message_observed" };
+    }
+    this.clearReminder(key);
+    const startedAt = this.now();
+    const dueAt = startedAt + input.remindAfterMs;
+    const sentRef = `${input.channel}#${input.sentSeq}`;
+    const record2 = {
+      ...input,
+      sentRef,
+      startedAt,
+      dueAt,
+      timer: undefined
+    };
+    record2.timer = this.setTimer(() => {
+      if (this.reminders.get(key) !== record2)
+        return;
+      this.reminders.delete(key);
+      try {
+        const delivery = this.options.deliver(input.agentId, {
+          text: reminderPrompt(input.channel, sentRef, startedAt)
+        });
+        Promise.resolve(delivery).catch(() => {});
+      } catch {}
+    }, input.remindAfterMs);
+    record2.timer.unref?.();
+    this.reminders.set(key, record2);
+    return { armed: true, dueAt };
+  }
+  observe(agentId, channel2, latestSeq) {
+    const key = reminderKey(agentId, channel2);
+    const previous = this.latestObservedSeq.get(key);
+    if (previous === undefined || latestSeq > previous) {
+      this.latestObservedSeq.set(key, latestSeq);
+    }
+    const reminder = this.reminders.get(key);
+    if (reminder && latestSeq > reminder.sentSeq)
+      this.clearReminder(key);
+  }
+  clearAgent(agentId) {
+    const prefix = `${agentId}\x00`;
+    for (const key of [...this.reminders.keys()]) {
+      if (key.startsWith(prefix))
+        this.clearReminder(key);
+    }
+    for (const key of [...this.latestObservedSeq.keys()]) {
+      if (key.startsWith(prefix))
+        this.latestObservedSeq.delete(key);
+    }
+  }
+  clearAll() {
+    for (const key of [...this.reminders.keys()])
+      this.clearReminder(key);
+    this.latestObservedSeq.clear();
+  }
+  clearReminder(key) {
+    const reminder = this.reminders.get(key);
+    if (!reminder)
+      return;
+    this.reminders.delete(key);
+    this.clearTimer(reminder.timer);
+  }
+}
+
 // src/daemon/createDaemon.ts
 var WARMUP_BACKOFF_MS = [250, 500, 1000, 2000, 4000];
 var WARMUP_CEILING_MS = 30000;
@@ -23403,6 +23723,7 @@ async function createDaemon(opts) {
   });
   let channelRef = null;
   let managerRef = null;
+  let reminderSchedulerRef = null;
   const emitBotAuditEvent = (agentId, event, context) => {
     channelRef?.reportBotAuditEvent?.({
       type: "bot_audit_event",
@@ -23416,6 +23737,7 @@ async function createDaemon(opts) {
   const broker = new CredentialBroker({ upstreamBaseUrl: opts.serverUrl });
   const proxy = await startCredentialProxy(broker, {
     onInboxPullResponse: (agentId, messages) => timeline2.appendEntryForAgent(agentId, messages),
+    onMessageReminderArm: (input) => reminderSchedulerRef?.arm(input) ?? { armed: false, reason: "reminder_scheduler_unavailable" },
     onProxyRequest: (agentId, method, pathname) => {
       const subcommand = deriveAuditLogSubcommand(pathname, method);
       if (!subcommand)
@@ -23688,6 +24010,10 @@ async function createDaemon(opts) {
   });
   managerRef = manager;
   manager.start();
+  reminderSchedulerRef = new MessageReminderScheduler({
+    deliver: (agentId, message2) => manager.deliver(agentId, message2),
+    ...opts.messageReminderClock
+  });
   let statusTimer = null;
   if (opts.statusFilePath) {
     const statusPath = opts.statusFilePath;
@@ -23733,10 +24059,26 @@ async function createDaemon(opts) {
     },
     formatUnreadNoticeText: (notice) => `You have unread messages in channel ${notice.channel}.`
   });
+  channel2.onCommand(createSelfUpdateCommandListener(opts.handleSelfUpdate));
   channel2.onCommand(createDiagnosticsCommandListener({
     handleDiagnosticCommand: opts.handleDiagnosticCommand,
     reportDiagnosticFailure: opts.reportDiagnosticFailure
   }));
+  channel2.onCommand((cmd) => {
+    switch (cmd.type) {
+      case "agent:wake":
+        reminderSchedulerRef?.observe(cmd.agentId, cmd.unreadNotice.channel, cmd.unreadNotice.latestSeq);
+        break;
+      case "agent:stop":
+        reminderSchedulerRef?.clearAgent(cmd.agentId);
+        break;
+      case "bot:removed":
+        reminderSchedulerRef?.clearAgent(cmd.botId);
+        break;
+      default:
+        break;
+    }
+  });
   channel2.onCommand((cmd) => {
     handleBotFrame(cmd);
   });
@@ -23755,6 +24097,7 @@ async function createDaemon(opts) {
     },
     proxyUrl: proxy.url,
     stop: async () => {
+      reminderSchedulerRef?.clearAll();
       for (const agentId of [...typingHeartbeats.keys()]) {
         emitTypingStopsAndClear(agentId);
       }
@@ -23838,6 +24181,7 @@ export {
   PiDriver,
   OpenCodeDriver,
   MAX_APM_GATED_STEERING_EVENTS,
+  LOCAL_MESSAGE_REMINDER_PATH,
   KimiDriver,
   GeminiDriver,
   DEFAULT_STOPPING_STUCK_THRESHOLD_MS,