npm - @botiverse/raft-daemon - Versions diffs - 0.62.0 → 0.63.1-play.20260619141001 - Mend

@botiverse/raft-daemon 0.62.0 → 0.63.1-play.20260619141001

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/{chunk-H3G23UPM.js → chunk-R3YQ3ZXU.js} +1013 -212
package/dist/cli/index.js +3 -3
package/dist/core.js +5 -1
package/dist/{dist-DSRBN3VD.js → dist-5BEASCX5.js} +3 -3
package/dist/index.js +5 -3
package/package.json +1 -1

package/dist/{chunk-H3G23UPM.js → chunk-R3YQ3ZXU.js} RENAMED Viewed

@@ -1,6 +1,6 @@
 // src/core.ts
-import path17 from "path";
-import os8 from "os";
+import path18 from "path";
+import os9 from "os";
 import { createRequire as createRequire3 } from "module";
 import { accessSync } from "fs";
 import { fileURLToPath } from "url";
@@ -1602,9 +1602,9 @@ var FREE_MONTHLY_FILE_UPLOAD_LIMIT_BYTES = 100 * 1024 * 1024;
 import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
 import { mkdir, writeFile, access, readdir as readdir2, stat as stat2, readFile, rm as rm2, lstat, realpath, open } from "fs/promises";
 import { createHash as createHash3, randomUUID as randomUUID5 } from "crypto";
-import path13 from "path";
+import path14 from "path";
 import { gzipSync } from "zlib";
-import os6 from "os";
+import os7 from "os";
 // src/proxy.ts
 import { HttpsProxyAgent } from "https-proxy-agent";
@@ -1873,8 +1873,8 @@ async function executeResponseRequest(url, init, {
 }
 // src/directUploadCapability.ts
-function joinUrl(base, path18) {
-  return `${base.replace(/\/+$/, "")}${path18}`;
+function joinUrl(base, path19) {
+  return `${base.replace(/\/+$/, "")}${path19}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -2582,6 +2582,19 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonAuthEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  return env;
+}
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -3024,7 +3037,7 @@ function projectApmRuntimeStallDiagnostic(input) {
       gatedPhase: input.runtimeDescriptorBusyDelivery === "gated" ? input.gatedPhase : void 0,
       outstandingToolUses: input.outstandingToolUses,
       compacting: input.compacting,
-      reviewing: input.reviewing === true ? true : void 0,
+      ...input.reviewing === true ? { reviewing: true } : {},
       recentStderrCount: input.recentStderrCount,
       recentStdoutCount: input.recentStdoutCount,
       ...input.runtimeTraceCounterAttrs ?? {}
@@ -4148,7 +4161,20 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
+];
+var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
+  "agent-token",
+  "slock",
+  "slock.cmd",
+  "slock.ps1",
+  "raft",
+  "raft.cmd",
+  "raft.ps1",
+  "opencli",
+  "opencli.cmd"
 ];
 function deriveCliFallbackCandidates(cliPath) {
   if (!cliPath || cliPath === "__cli") return [];
@@ -4210,6 +4236,18 @@ function resolveOpencliBinPath() {
     return null;
   }
 }
+function buildCliTransportDir(slockHome, agentId, launchId) {
+  return path2.join(slockHome, "cli-transport", safePathPart(agentId), buildCliTransportLaunchPart(launchId));
+}
+function buildCliTransportLaunchPart(launchId) {
+  return safePathPart(launchId || `pid-${process.pid}`);
+}
+function cleanupWorkspaceCliTransportFiles(workingDirectory) {
+  const legacySlockDir = path2.join(workingDirectory, ".slock");
+  for (const filename of WORKSPACE_CLI_TRANSPORT_FILENAMES) {
+    rmSync(path2.join(legacySlockDir, filename), { force: true });
+  }
+}
 function writeOpencliWrapper(slockDir, opencliBinPath, platform = process.platform) {
   const fallbacks = deriveOpencliFallbackCandidates(opencliBinPath);
   let binPath = opencliBinPath;
@@ -4340,9 +4378,10 @@ async function prepareCliTransport(ctx, extraEnv = {}, platform = process.platfo
       );
     }
   }
-  const slockDir = path2.join(ctx.workingDirectory, ".slock");
+  const slockHome = ctx.slockHome ? path2.resolve(ctx.slockHome) : resolveSlockHome();
+  cleanupWorkspaceCliTransportFiles(ctx.workingDirectory);
+  const slockDir = buildCliTransportDir(slockHome, ctx.agentId, ctx.launchId);
   mkdirSync(slockDir, { recursive: true });
-  const slockHome = resolveSlockHome();
   const tokenFile = path2.join(slockDir, "agent-token");
   const agentCredentialKey = ctx.config.agentCredentialKey;
   let agentCredentialProxy = null;
@@ -4357,7 +4396,7 @@ async function prepareCliTransport(ctx, extraEnv = {}, platform = process.platfo
       activeCapabilities: DEFAULT_ACTIVE_CAPABILITIES,
       inboxCoordinator: ctx.agentCredentialProxyInboxCoordinator
     });
-    const launchPart = safePathPart(ctx.launchId || `pid-${process.pid}`);
+    const launchPart = buildCliTransportLaunchPart(ctx.launchId);
     const proxyTokenDir = path2.join(slockHome, "agent-proxy-tokens", safePathPart(ctx.agentId));
     mkdirSync(proxyTokenDir, { recursive: true, mode: 448 });
     agentCredentialProxyTokenFile = path2.join(proxyTokenDir, `${launchPart}.token`);
@@ -4474,10 +4513,9 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     ...ctx.launchId ? { SLOCK_AGENT_LAUNCH_ID: ctx.launchId } : {},
     ...ctx.cliTransportTraceDir ? { [CLI_TRANSPORT_TRACE_DIR_ENV]: ctx.cliTransportTraceDir } : {},
     SLOCK_SERVER_URL: ctx.config.serverUrl,
-    ...agentCredentialProxy ? {} : { SLOCK_AGENT_TOKEN_FILE: tokenFile },
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -4485,9 +4523,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
   delete spawnEnv.SLOCK_AGENT_PROXY_TOKEN;
   delete spawnEnv.SLOCK_AGENT_PROXY_TOKEN_FILE;
   delete spawnEnv.SLOCK_AGENT_ACTIVE_CAPABILITIES;
-  if (agentCredentialProxy) {
-    delete spawnEnv.SLOCK_AGENT_TOKEN_FILE;
-  }
+  delete spawnEnv.SLOCK_AGENT_TOKEN_FILE;
   return {
     slockDir,
     tokenFile,
@@ -4912,7 +4948,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -4938,7 +4974,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -5177,8 +5213,47 @@ var ClaudeDriver = class {
 // src/drivers/codex.ts
 import { spawn as spawn2, execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
+import os4 from "os";
+import path7 from "path";
+// src/drivers/codexHome.ts
 import os3 from "os";
 import path6 from "path";
+function readConfiguredCodexHome(env) {
+  const raw = env.CODEX_HOME;
+  return typeof raw === "string" && raw.trim().length > 0 ? raw : null;
+}
+function resolveCodexHomeRootFromEnv(env = process.env, opts = {}) {
+  const raw = readConfiguredCodexHome(env);
+  if (raw) {
+    return path6.resolve(opts.cwd ?? process.cwd(), raw);
+  }
+  return path6.join(opts.defaultHomeDir ?? os3.homedir(), ".codex");
+}
+function hasConfiguredCodexHome(config, baseEnv = process.env) {
+  const launchRuntimeFields = config ? runtimeConfigToLaunchFields(config) : null;
+  return Boolean(readConfiguredCodexHome({
+    ...baseEnv,
+    ...launchRuntimeFields?.envVars || {}
+  }));
+}
+function resolveCodexHomeRootFromConfig(config, defaultHomeDir, cwd, baseEnv = process.env, _opts = {}) {
+  const launchRuntimeFields = runtimeConfigToLaunchFields(config);
+  const env = {
+    ...baseEnv,
+    ...launchRuntimeFields.envVars || {}
+  };
+  return resolveCodexHomeRootFromEnv(env, { defaultHomeDir, cwd });
+}
+function codexStateRootCandidates(homeDirOrCodexRoot) {
+  return [
+    homeDirOrCodexRoot,
+    path6.join(homeDirOrCodexRoot, ".codex")
+  ];
+}
+function codexSessionRootCandidates(homeDirOrCodexRoot) {
+  return codexStateRootCandidates(homeDirOrCodexRoot).map((root) => path6.join(root, "sessions"));
+}
 // src/runtimeTurnState.ts
 var RuntimeTurnState = class {
@@ -5359,7 +5434,7 @@ function codexNotificationDiagnosticEvent(message) {
       return null;
   }
   const sessionId = codexMessageThreadId(message);
-  const path18 = boundedString(params.path);
+  const path19 = boundedString(params.path);
   return {
     kind: "runtime_diagnostic",
     severity: "warning",
@@ -5367,12 +5442,42 @@ function codexNotificationDiagnosticEvent(message) {
     itemType: message.method,
     message: diagnosticMessage,
     ...details ? { details } : {},
-    ...path18 ? { path: path18 } : {},
+    ...path19 ? { path: path19 } : {},
     ...params.range !== void 0 ? { range: params.range } : {},
     payloadBytes: payloadBytes(params),
     ...sessionId ? { sessionId } : {}
   };
 }
+function codexThreadStatusChangedEvent(message) {
+  if (message.method !== "thread/status/changed") return null;
+  const params = message.params ?? {};
+  const status = params.status ?? params.thread?.status;
+  if (!status || typeof status !== "object") return null;
+  const statusType = nonEmptyString2(status.type);
+  const sessionId = codexMessageThreadId(message);
+  if (statusType === "systemError") {
+    const statusMessage = boundedString(status.message) ?? boundedString(status.error?.message) ?? getCodexNotificationErrorMessage(params) ?? "Codex thread entered system error state";
+    return {
+      kind: "error",
+      message: statusMessage
+    };
+  }
+  if (statusType !== "active" || !Array.isArray(status.activeFlags)) return null;
+  const activeFlags = status.activeFlags.filter((flag) => typeof flag === "string");
+  const waitFlags = activeFlags.filter((flag) => flag === "waitingOnApproval" || flag === "waitingOnUserInput");
+  if (waitFlags.length === 0) return null;
+  const waitLabel = waitFlags.includes("waitingOnApproval") && waitFlags.includes("waitingOnUserInput") ? "approval and user input" : waitFlags.includes("waitingOnApproval") ? "approval" : "user input";
+  return {
+    kind: "runtime_diagnostic",
+    severity: "warning",
+    source: "codex_app_server_notification",
+    itemType: "thread/status/changed",
+    message: `Codex thread is waiting on ${waitLabel}`,
+    details: `Active flags: ${waitFlags.join(", ")}`,
+    payloadBytes: payloadBytes(params),
+    ...sessionId ? { sessionId } : {}
+  };
+}
 function joinReasoningSummaryText(item) {
   const summary = Array.isArray(item.summary) ? item.summary.filter((entry) => typeof entry === "string") : [];
   return summary.join("\n").trim();
@@ -5400,10 +5505,27 @@ function codexMcpToolName(item) {
 function codexMessageThreadId(message) {
   return nonEmptyString2(message.params?.threadId) ?? nonEmptyString2(message.params?.thread?.id) ?? nonEmptyString2(message.params?.sessionId);
 }
+function codexAgentMessagePhase(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function codexAgentMessageDeltaPhase(message) {
+  return codexAgentMessagePhase(message.params?.phase) ?? codexAgentMessagePhase(message.params?.item?.phase);
+}
+function isUserVisibleAgentMessagePhase(phase) {
+  return phase === null || phase === "final_answer";
+}
+function codexSuppressedAgentMessageEvent(itemType, phase, text, itemId) {
+  return codexNotificationProgressEvent(itemType, {
+    ...typeof itemId === "string" ? { itemId } : {},
+    ...phase ? { phase } : {},
+    bytes: Buffer.byteLength(text, "utf8")
+  });
+}
 var CodexEventNormalizer = class {
   currentThreadId = null;
   sessionAnnounced = false;
   streamedAgentMessageIds = /* @__PURE__ */ new Set();
+  agentMessagePhases = /* @__PURE__ */ new Map();
   streamedReasoningIds = /* @__PURE__ */ new Set();
   fileChangeToolCallCounts = /* @__PURE__ */ new Map();
   turnState = new RuntimeTurnState();
@@ -5412,6 +5534,7 @@ var CodexEventNormalizer = class {
     this.turnState.reset();
     this.sessionAnnounced = false;
     this.streamedAgentMessageIds.clear();
+    this.agentMessagePhases.clear();
     this.streamedReasoningIds.clear();
     this.fileChangeToolCallCounts.clear();
   }
@@ -5489,12 +5612,17 @@ var CodexEventNormalizer = class {
       case "item/agentMessage/delta": {
         const delta = message.params?.delta;
         const itemId = message.params?.itemId;
+        const phase = codexAgentMessageDeltaPhase(message) ?? (typeof itemId === "string" ? this.agentMessagePhases.get(itemId) ?? null : null);
         if (typeof itemId === "string") {
           this.streamedAgentMessageIds.add(itemId);
         }
         if (typeof delta === "string" && delta.length > 0) {
           this.turnState.markProgress();
-          events.push({ kind: "text", text: delta });
+          if (isUserVisibleAgentMessagePhase(phase)) {
+            events.push({ kind: "text", text: delta });
+          } else {
+            events.push(codexSuppressedAgentMessageEvent("agent_message_non_final_delta", phase, delta, itemId));
+          }
         }
         break;
       }
@@ -5545,6 +5673,13 @@ var CodexEventNormalizer = class {
         }
         break;
       }
+      case "thread/status/changed": {
+        const event = codexThreadStatusChangedEvent(message);
+        if (event) {
+          events.push(event);
+        }
+        break;
+      }
       case "item/started":
       case "item/completed": {
         const item = message.params?.item;
@@ -5566,12 +5701,21 @@ var CodexEventNormalizer = class {
             }
             break;
           case "agentMessage":
+            if ((isStarted || isCompleted) && typeof item.id === "string") {
+              this.agentMessagePhases.set(item.id, codexAgentMessagePhase(item.phase));
+            }
             if (isCompleted && typeof item.id === "string" && !this.streamedAgentMessageIds.has(item.id) && typeof item.text === "string" && item.text.length > 0) {
+              const phase = codexAgentMessagePhase(item.phase);
               this.turnState.markProgress();
-              events.push({ kind: "text", text: item.text });
+              if (isUserVisibleAgentMessagePhase(phase)) {
+                events.push({ kind: "text", text: item.text });
+              } else {
+                events.push(codexSuppressedAgentMessageEvent("agent_message_non_final_completed", phase, item.text, item.id));
+              }
             }
             if (isCompleted && typeof item.id === "string") {
               this.streamedAgentMessageIds.delete(item.id);
+              this.agentMessagePhases.delete(item.id);
             }
             break;
           case "commandExecution":
@@ -5710,14 +5854,15 @@ var CodexEventNormalizer = class {
 // src/drivers/codex.ts
 var CODEX_DESKTOP_BUNDLE_PATH = "/Applications/Codex.app/Contents/Resources/codex";
+var CODEX_APP_SERVER_PROBE_ARGS = ["app-server", "--help"];
 function isWindowsSandboxRunner(commandPath) {
-  return path6.basename(commandPath).toLowerCase().startsWith("codex-command-runner");
+  return path7.basename(commandPath).toLowerCase().startsWith("codex-command-runner");
 }
 function resolveWindowsNpmCodexEntry(deps = {}) {
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync2;
   const env = deps.env ?? process.env;
-  const winPath = path6.win32;
+  const winPath = path7.win32;
   try {
     const globalRoot = String(execFileSyncFn("npm", ["root", "-g"], {
       encoding: "utf8",
@@ -5739,7 +5884,7 @@ function resolveWindowsCodexDesktopEntry(deps = {}) {
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
   const env = deps.env ?? process.env;
   const homeDir = deps.homeDir;
-  const winPath = path6.win32;
+  const winPath = path7.win32;
   const candidates = [
     env.LOCALAPPDATA ? winPath.join(env.LOCALAPPDATA, "OpenAI", "Codex", "bin", "codex.exe") : null,
     env.USERPROFILE ? winPath.join(env.USERPROFILE, "AppData", "Local", "OpenAI", "Codex", "bin", "codex.exe") : null,
@@ -5750,69 +5895,158 @@ function resolveWindowsCodexDesktopEntry(deps = {}) {
   }
   return null;
 }
-function resolveCodexCommand(deps = {}) {
+function codexSpawnCandidates(deps = {}) {
   const platform = deps.platform ?? process.platform;
   if (platform === "win32") {
+    const candidates2 = [];
     const npmEntry = resolveWindowsNpmCodexEntry(deps);
-    if (npmEntry) return npmEntry;
+    if (npmEntry) {
+      candidates2.push({
+        source: "npm_global",
+        command: process.execPath,
+        argsPrefix: [npmEntry],
+        shell: false
+      });
+    }
     const command = resolveCommandOnPath("codex", deps);
-    if (command && !isWindowsSandboxRunner(command)) return command;
-    return resolveWindowsCodexDesktopEntry(deps);
+    if (command && !isWindowsSandboxRunner(command)) {
+      candidates2.push({
+        source: "path",
+        command,
+        argsPrefix: [],
+        shell: requiresWindowsShell(command, platform)
+      });
+    }
+    const desktopEntry = resolveWindowsCodexDesktopEntry(deps);
+    if (desktopEntry && !candidates2.some((candidate) => candidate.command === desktopEntry)) {
+      candidates2.push({
+        source: "desktop_install",
+        command: desktopEntry,
+        argsPrefix: [],
+        shell: false
+      });
+    }
+    return candidates2;
   }
+  const candidates = [];
   const pathCommand = resolveCommandOnPath("codex", deps);
-  if (pathCommand) return pathCommand;
+  if (pathCommand) {
+    candidates.push({
+      source: "path",
+      command: pathCommand,
+      argsPrefix: [],
+      shell: false
+    });
+  }
   if (platform === "darwin") {
-    return firstExistingPath([CODEX_DESKTOP_BUNDLE_PATH], deps);
+    const bundleCommand = firstExistingPath([CODEX_DESKTOP_BUNDLE_PATH], deps);
+    if (bundleCommand && !candidates.some((candidate) => candidate.command === bundleCommand)) {
+      candidates.push({
+        source: "desktop_bundle",
+        command: bundleCommand,
+        argsPrefix: [],
+        shell: false
+      });
+    }
   }
-  return null;
+  return candidates;
+}
+function formatCodexCandidate(candidate) {
+  return [candidate.command, ...candidate.argsPrefix].join(" ");
+}
+function describeCodexProbeFailure(error) {
+  if (error && typeof error === "object") {
+    const candidate = error;
+    if (typeof candidate.status === "number") return `exit status ${candidate.status}`;
+    if (typeof candidate.signal === "string") return `terminated by ${candidate.signal}`;
+    if (typeof candidate.code === "string") return candidate.code;
+  }
+  return "probe failed";
+}
+function validateCodexAppServer(candidate, deps = {}) {
+  const execFileSyncFn = deps.execFileSyncFn ?? execFileSync2;
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  try {
+    execFileSyncFn(candidate.command, [...candidate.argsPrefix, ...CODEX_APP_SERVER_PROBE_ARGS], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env,
+      timeout: 5e3,
+      shell: candidate.shell
+    });
+    return null;
+  } catch (error) {
+    return describeCodexProbeFailure(error);
+  }
+}
+function readCodexCandidateVersion(candidate, deps = {}) {
+  const execFileSyncFn = deps.execFileSyncFn ?? execFileSync2;
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  try {
+    const output = execFileSyncFn(candidate.command, [...candidate.argsPrefix, "--version"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env,
+      timeout: 5e3,
+      shell: candidate.shell
+    });
+    return (Buffer.isBuffer(output) ? output.toString("utf8") : String(output ?? "")).trim().split(/\r?\n/)[0] || null;
+  } catch {
+    return null;
+  }
+}
+function resolveCompatibleCodexCandidate(deps = {}) {
+  const rejected = [];
+  for (const candidate of codexSpawnCandidates(deps)) {
+    const failure = validateCodexAppServer(candidate, deps);
+    if (!failure) return { candidate, rejected };
+    rejected.push(`${candidate.source} ${formatCodexCandidate(candidate)} rejected: app-server probe ${failure}`);
+  }
+  return { candidate: null, rejected };
 }
 function probeCodex(deps = {}) {
-  if ((deps.platform ?? process.platform) === "win32") {
-    try {
-      const resolved = resolveCodexSpawn([], deps);
-      return {
-        available: true,
-        version: readCommandVersion(resolved.command, resolved.args, deps) ?? void 0
-      };
-    } catch {
-      return { available: false };
-    }
+  const { candidate, rejected } = resolveCompatibleCodexCandidate(deps);
+  const diagnostic = rejected.length > 0 ? rejected.join("; ") : void 0;
+  if (!candidate) {
+    return {
+      available: false,
+      diagnostic: diagnostic ?? "No Codex CLI app-server candidate was found."
+    };
   }
-  const command = resolveCodexCommand(deps);
-  if (!command) return { available: false };
   return {
     available: true,
-    version: readCommandVersion(command, [], deps) ?? void 0
+    version: readCodexCandidateVersion(candidate, deps) ?? void 0,
+    ...diagnostic ? { diagnostic } : {}
   };
 }
 function resolveCodexSpawn(commandArgs, deps = {}) {
-  if ((deps.platform ?? process.platform) !== "win32") {
-    return { command: resolveCodexCommand(deps) ?? "codex", args: commandArgs, shell: false };
-  }
-  const codexEntry = resolveWindowsNpmCodexEntry(deps);
-  if (codexEntry) {
-    return {
-      command: process.execPath,
-      args: [codexEntry, ...commandArgs],
-      shell: false
-    };
-  }
-  const command = resolveCommandOnPath("codex", deps);
-  if (command && !isWindowsSandboxRunner(command)) {
-    return { command, args: commandArgs, shell: requiresWindowsShell(command, deps.platform) };
+  const { candidate, rejected } = resolveCompatibleCodexCandidate(deps);
+  if (candidate) {
+    return { command: candidate.command, args: [...candidate.argsPrefix, ...commandArgs], shell: candidate.shell };
   }
-  const desktopEntry = resolveWindowsCodexDesktopEntry(deps);
-  if (desktopEntry) {
-    return { command: desktopEntry, args: commandArgs, shell: false };
+  const diagnostic = rejected.length > 0 ? ` Rejected candidates: ${rejected.join("; ")}.` : "";
+  if ((deps.platform ?? process.platform) === "win32") {
+    throw new Error(
+      "Cannot resolve a compatible Codex CLI app-server entry point on Windows. Install Codex Desktop or install @openai/codex globally via npm (npm i -g @openai/codex). Ignoring .codex/.sandbox-bin/codex-command-runner because it is a sandbox helper, not the Codex CLI." + diagnostic
+    );
   }
-  throw new Error(
-    "Cannot resolve Codex CLI entry point on Windows. Install Codex Desktop or install @openai/codex globally via npm (npm i -g @openai/codex). Ignoring .codex/.sandbox-bin/codex-command-runner because it is a sandbox helper, not the Codex CLI."
-  );
+  throw new Error(`Cannot resolve a compatible Codex CLI app-server entry point.${diagnostic}`);
 }
 function isCodexMissingRolloutError(message) {
   return /\bno\s+rollout\s+found\b/i.test(message) || /\bmissing\s+rollout\b/i.test(message) || /\brollout\b.*\b(not found|missing)\b/i.test(message) || /\bthread\b.*\b(not found|missing)\b/i.test(message) || /\bmissing\s+thread\b/i.test(message);
 }
-function classifyCodexResumeError(message) {
+function codexMissingRolloutRecoveryMessage() {
+  return "Codex could not resume its previous thread; Slock started a fresh Codex thread.";
+}
+function codexMissingRolloutRecoveryDetails() {
+  return "Use Slock conversation history and local MEMORY.md/notes as the recovery point; do not assume prior Codex thread context is loaded.";
+}
+function prependCodexRecoveryNotice(prompt, recovery) {
+  return `${recovery.message}
+${recovery.details}
+${prompt}`;
+}
+function classifyCodexResumeError(message, requestedSessionId) {
   if (isCodexMissingRolloutError(message)) {
     return {
       kind: "missing_rollout",
@@ -5826,6 +6060,15 @@ function classifyCodexResumeError(message) {
           resume_error_class: "missing_rollout",
           recovery_action: "fallback_fresh_thread"
         }
+      },
+      recovery: {
+        kind: "runtime_recovery",
+        source: "codex_resume_missing_rollout",
+        resumeErrorClass: "missing_rollout",
+        recoveryAction: "fallback_fresh_thread",
+        message: codexMissingRolloutRecoveryMessage(),
+        details: codexMissingRolloutRecoveryDetails(),
+        ...requestedSessionId ? { requestedSessionId } : {}
       }
     };
   }
@@ -5849,6 +6092,26 @@ function isJsonRpcResponse(message) {
 function isCodexServerRequest(message) {
   return message.id !== void 0 && typeof message.method === "string" && !isJsonRpcResponse(message);
 }
+function payloadBytes2(value) {
+  try {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function extractCodexHome(result) {
+  if (!result || typeof result !== "object") return null;
+  const candidate = result.codexHome;
+  return typeof candidate === "string" && candidate.trim().length > 0 ? candidate : null;
+}
+function isCompatibleInitializeResult(result) {
+  if (!result || typeof result !== "object" || Array.isArray(result)) return false;
+  const userAgent = result.userAgent;
+  return typeof userAgent === "string" && userAgent.trim().length > 0;
+}
+function unsupportedInitializeResultMessage() {
+  return "Codex app-server initialize response is missing the expected userAgent handshake field; upgrade Codex CLI to a compatible app-server build.";
+}
 var CodexDriver = class {
   id = "codex";
   lifecycle = {
@@ -5919,9 +6182,16 @@ var CodexDriver = class {
   pendingThreadRequestId = null;
   pendingThreadRequestMethod = null;
   pendingResumeFallbackParams = null;
+  pendingResumeThreadId = null;
   pendingInitialTurnRequestId = null;
+  pendingDeliveryRequests = /* @__PURE__ */ new Map();
   initialTurnStarted = false;
   normalizer = new CodexEventNormalizer();
+  codexHomeRoot = null;
+  spawnWorkingDirectory = null;
+  get currentRuntimeHomeDir() {
+    return this.codexHomeRoot;
+  }
   async spawn(ctx) {
     const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" });
     this.process = null;
@@ -5932,9 +6202,16 @@ var CodexDriver = class {
     this.pendingThreadRequestId = null;
     this.pendingThreadRequestMethod = null;
     this.pendingResumeFallbackParams = null;
+    this.pendingResumeThreadId = null;
     this.pendingInitialTurnRequestId = null;
+    this.pendingDeliveryRequests.clear();
     this.initialTurnStarted = false;
     this.normalizer.reset();
+    this.spawnWorkingDirectory = ctx.workingDirectory;
+    this.codexHomeRoot = resolveCodexHomeRootFromEnv(spawnEnv, {
+      defaultHomeDir: os4.homedir(),
+      cwd: ctx.workingDirectory
+    });
     const args = ["app-server", "--listen", "stdio://"];
     const { command, args: spawnArgs, shell } = resolveCodexSpawn(args);
     const proc = spawn2(command, spawnArgs, {
@@ -5969,6 +6246,24 @@ var CodexDriver = class {
     const isResponse = isJsonRpcResponse(message);
     if (isResponse && hasJsonRpcField(message, "result")) {
       if (message.id === this.initializeRequestId) {
+        if (!isCompatibleInitializeResult(message.result)) {
+          this.initializeRequestId = null;
+          this.pendingThreadRequest = null;
+          this.pendingThreadRequestId = null;
+          this.pendingThreadRequestMethod = null;
+          this.pendingResumeFallbackParams = null;
+          this.pendingResumeThreadId = null;
+          events.push({
+            kind: "error",
+            message: unsupportedInitializeResultMessage(),
+            startupRequestMethod: "initialize"
+          });
+          return events;
+        }
+        const codexHome = extractCodexHome(message.result);
+        if (codexHome) {
+          this.codexHomeRoot = path7.resolve(this.spawnWorkingDirectory ?? process.cwd(), codexHome);
+        }
         this.initializeRequestId = null;
         this.sendNotification("initialized", {});
         if (this.pendingThreadRequest) {
@@ -5984,6 +6279,7 @@ var CodexDriver = class {
       this.pendingThreadRequestId = null;
       this.pendingThreadRequestMethod = null;
       this.pendingResumeFallbackParams = null;
+      this.pendingResumeThreadId = null;
       events.push({
         kind: "error",
         message: message.error?.message || "Codex app-server request failed",
@@ -5995,9 +6291,16 @@ var CodexDriver = class {
       if (hasJsonRpcField(message, "error")) {
         const errorMessage = message.error?.message || "Codex app-server request failed";
         const requestMethod = this.pendingThreadRequestMethod;
-        const resumeErrorClassification = requestMethod === "thread/resume" ? classifyCodexResumeError(errorMessage) : null;
+        const resumeErrorClassification = requestMethod === "thread/resume" ? classifyCodexResumeError(errorMessage, this.pendingResumeThreadId || void 0) : null;
         if (this.pendingResumeFallbackParams && resumeErrorClassification?.kind === "missing_rollout") {
           events.push(resumeErrorClassification.telemetry);
+          events.push(resumeErrorClassification.recovery);
+          if (this.pendingInitialPrompt) {
+            this.pendingInitialPrompt = prependCodexRecoveryNotice(
+              this.pendingInitialPrompt,
+              resumeErrorClassification.recovery
+            );
+          }
           this.sendThreadRequest("thread/start", this.pendingResumeFallbackParams);
           this.pendingResumeFallbackParams = null;
           return events;
@@ -6005,12 +6308,14 @@ var CodexDriver = class {
         this.pendingThreadRequestId = null;
         this.pendingThreadRequestMethod = null;
         this.pendingResumeFallbackParams = null;
+        this.pendingResumeThreadId = null;
         events.push(requestMethod ? { kind: "error", message: errorMessage, startupRequestMethod: requestMethod } : { kind: "error", message: errorMessage });
         return events;
       }
       this.pendingThreadRequestId = null;
       this.pendingThreadRequestMethod = null;
       this.pendingResumeFallbackParams = null;
+      this.pendingResumeThreadId = null;
     }
     if (isResponse && message.id === this.pendingInitialTurnRequestId) {
       this.pendingInitialTurnRequestId = null;
@@ -6025,6 +6330,21 @@ var CodexDriver = class {
       }
       return events;
     }
+    if (isResponse && message.id !== void 0 && this.pendingDeliveryRequests.has(message.id)) {
+      const requestMethod = this.pendingDeliveryRequests.get(message.id);
+      this.pendingDeliveryRequests.delete(message.id);
+      if (hasJsonRpcField(message, "error")) {
+        const params = message.error ?? {};
+        events.push({
+          kind: "delivery_error",
+          message: message.error?.message || "Codex app-server request failed",
+          requestMethod,
+          source: "codex_app_server_response",
+          payloadBytes: payloadBytes2(params)
+        });
+      }
+      return events;
+    }
     const result = this.normalizer.normalizeMessage(message);
     if (result.turnStarted) {
       this.pendingInitialTurnRequestId = null;
@@ -6043,9 +6363,11 @@ var CodexDriver = class {
     const mode = opts?.mode || "busy";
     if (mode === "busy") {
       if (!this.normalizer.canSteerBusy) return null;
+      const id2 = this.nextRequestId();
+      this.pendingDeliveryRequests.set(id2, "turn/steer");
       return JSON.stringify({
         jsonrpc: "2.0",
-        id: this.nextRequestId(),
+        id: id2,
         method: "turn/steer",
         params: {
           threadId: this.normalizer.threadId,
@@ -6054,9 +6376,11 @@ var CodexDriver = class {
         }
       });
     }
+    const id = this.nextRequestId();
+    this.pendingDeliveryRequests.set(id, "turn/start");
     return JSON.stringify({
       jsonrpc: "2.0",
-      id: this.nextRequestId(),
+      id,
       method: "turn/start",
       params: {
         threadId: this.normalizer.threadId,
@@ -6112,9 +6436,11 @@ var CodexDriver = class {
     this.pendingThreadRequestId = id;
     this.pendingThreadRequestMethod = method;
     this.pendingResumeFallbackParams = null;
+    this.pendingResumeThreadId = null;
     if (method === "thread/resume") {
       const { threadId: _threadId, ...freshParams } = params;
       this.pendingResumeFallbackParams = freshParams;
+      this.pendingResumeThreadId = typeof _threadId === "string" && _threadId.trim() ? _threadId.trim() : null;
     }
     return id;
   }
@@ -6126,12 +6452,194 @@ var CodexDriver = class {
     }) + "\n");
   }
   async detectModels() {
-    return detectCodexModels();
+    return await detectCodexModelsFromAppServer() ?? detectCodexModels(resolveCodexHomeRootFromEnv());
   }
 };
-function detectCodexModels(home = os3.homedir()) {
-  const cachePath = path6.join(home, ".codex", "models_cache.json");
-  const configPath = path6.join(home, ".codex", "config.toml");
+function asNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function modelListPage(result) {
+  if (!result || typeof result !== "object") return null;
+  const object = result;
+  const entries = Array.isArray(object.data) ? object.data : Array.isArray(object.models) ? object.models : null;
+  if (!entries) return null;
+  return {
+    entries,
+    nextCursor: asNonEmptyString(object.nextCursor)
+  };
+}
+function modelListRequestParams(cursor) {
+  return cursor ? { cursor } : {};
+}
+function stringArray(values, read) {
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const item = read(value);
+    if (!item || seen.has(item)) continue;
+    seen.add(item);
+    result.push(item);
+  }
+  return result;
+}
+function codexReasoningEfforts(value) {
+  if (!Array.isArray(value)) return [];
+  return stringArray(value, (entry) => {
+    if (typeof entry === "string") return asNonEmptyString(entry);
+    if (!entry || typeof entry !== "object") return null;
+    const object = entry;
+    return asNonEmptyString(object.reasoningEffort) ?? asNonEmptyString(object.id);
+  });
+}
+function codexServiceTierIds(value) {
+  if (!Array.isArray(value)) return [];
+  return stringArray(value, (entry) => {
+    if (typeof entry === "string") return asNonEmptyString(entry);
+    if (!entry || typeof entry !== "object") return null;
+    const object = entry;
+    return asNonEmptyString(object.id) ?? asNonEmptyString(object.serviceTier);
+  });
+}
+function codexModelInfoFromAppServer(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return null;
+  const object = entry;
+  if (object.hidden === true) return null;
+  const id = asNonEmptyString(object.id) ?? asNonEmptyString(object.model) ?? asNonEmptyString(object.slug);
+  if (!id) return null;
+  const label = asNonEmptyString(object.displayName) ?? asNonEmptyString(object.display_name) ?? asNonEmptyString(object.label) ?? id;
+  const supportedReasoningEfforts = codexReasoningEfforts(object.supportedReasoningEfforts);
+  const serviceTiers = codexServiceTierIds(object.serviceTiers);
+  const additionalSpeedTiers = codexServiceTierIds(object.additionalSpeedTiers);
+  const runtimeServiceTiers = serviceTiers.length > 0 ? serviceTiers : additionalSpeedTiers;
+  const defaultReasoningEffort = asNonEmptyString(object.defaultReasoningEffort);
+  const defaultServiceTier = asNonEmptyString(object.defaultServiceTier);
+  return {
+    id,
+    label,
+    verified: "launchable",
+    ...supportedReasoningEfforts.length > 0 ? { supportedReasoningEfforts } : {},
+    ...defaultReasoningEffort ? { defaultReasoningEffort } : {},
+    ...runtimeServiceTiers.length > 0 ? { serviceTiers: runtimeServiceTiers } : {},
+    ...defaultServiceTier ? { defaultServiceTier } : {}
+  };
+}
+function codexModelSetFromAppServerEntries(entries) {
+  const models = [];
+  let defaultModel;
+  for (const entry of entries) {
+    const model = codexModelInfoFromAppServer(entry);
+    if (!model) continue;
+    models.push(model);
+    if (!defaultModel && typeof entry === "object" && entry && entry.isDefault === true) {
+      defaultModel = model.id;
+    }
+  }
+  return models.length > 0 ? { models, default: defaultModel } : null;
+}
+async function detectCodexModelsFromAppServer(options = {}) {
+  const env = options.env ?? process.env;
+  let launch;
+  try {
+    launch = resolveCodexSpawn(["app-server", "--listen", "stdio://"], { env });
+  } catch {
+    return null;
+  }
+  return await new Promise((resolve) => {
+    const timeoutMs = options.timeoutMs ?? 5e3;
+    const proc = spawn2(launch.command, launch.args, {
+      cwd: options.cwd ?? process.cwd(),
+      stdio: ["pipe", "pipe", "ignore"],
+      env,
+      shell: launch.shell
+    });
+    let settled = false;
+    let buffer = "";
+    let requestId = 0;
+    let initializeRequestId = null;
+    let modelListRequestId = null;
+    let pageCount = 0;
+    const entries = [];
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      proc.kill();
+      resolve(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const sendRequest = (method, params) => {
+      requestId += 1;
+      const id = requestId;
+      proc.stdin?.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
+      return id;
+    };
+    const sendNotification = (method, params) => {
+      proc.stdin?.write(JSON.stringify({ jsonrpc: "2.0", method, params }) + "\n");
+    };
+    const requestModelPage = (cursor) => {
+      pageCount += 1;
+      modelListRequestId = sendRequest("model/list", modelListRequestParams(cursor));
+    };
+    proc.once("error", () => finish(null));
+    proc.once("exit", () => finish(null));
+    proc.stdout?.on("data", (chunk) => {
+      if (settled) return;
+      buffer += chunk.toString();
+      for (; ; ) {
+        const newline = buffer.indexOf("\n");
+        if (newline === -1) break;
+        const line = buffer.slice(0, newline).trim();
+        buffer = buffer.slice(newline + 1);
+        if (!line) continue;
+        const message = parseCodexJsonRpcLine(line);
+        if (!message || !isJsonRpcResponse(message)) continue;
+        if (message.id === initializeRequestId) {
+          if (!hasJsonRpcField(message, "result") || !isCompatibleInitializeResult(message.result)) {
+            finish(null);
+            return;
+          }
+          sendNotification("initialized", {});
+          requestModelPage(null);
+          continue;
+        }
+        if (message.id === modelListRequestId) {
+          if (!hasJsonRpcField(message, "result")) {
+            finish(null);
+            return;
+          }
+          const page = modelListPage(message.result);
+          if (!page) {
+            finish(null);
+            return;
+          }
+          entries.push(...page.entries);
+          if (page.nextCursor && pageCount < 5) {
+            requestModelPage(page.nextCursor);
+            continue;
+          }
+          finish(codexModelSetFromAppServerEntries(entries));
+          return;
+        }
+      }
+    });
+    initializeRequestId = sendRequest("initialize", {
+      clientInfo: { name: "slock-daemon", version: "1.0.0" },
+      capabilities: { experimentalApi: true }
+    });
+  });
+}
+function detectCodexModels(home = resolveCodexHomeRootFromEnv()) {
+  let cachePath = null;
+  let configPath = null;
+  for (const root of codexStateRootCandidates(home)) {
+    const candidate = path7.join(root, "models_cache.json");
+    if (existsSync5(candidate)) {
+      cachePath = candidate;
+      configPath = path7.join(root, "config.toml");
+      break;
+    }
+  }
+  if (!cachePath || !configPath) return null;
   let models = [];
   try {
     const raw = readFileSync2(cachePath, "utf8");
@@ -6584,11 +7092,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -6601,7 +7109,7 @@ function runCursorModelsCommand() {
 // src/drivers/gemini.ts
 import { execFileSync as execFileSync3, spawn as spawn6 } from "child_process";
 import { existsSync as existsSync6 } from "fs";
-import path7 from "path";
+import path8 from "path";
 async function buildGeminiSpawnEnv(ctx, platform = process.platform) {
   const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" }, platform);
   const launchEnvVars = runtimeConfigToLaunchFields(ctx.config).envVars;
@@ -6644,8 +7152,8 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync6;
-  const env = deps.env ?? process.env;
-  const winPath = path7.win32;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
+  const winPath = path8.win32;
   let geminiEntry = null;
   try {
     const globalRoot = normalizeExecOutput2(execFileSyncFn("npm", ["root", "-g"], {
@@ -6781,12 +7289,15 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import os4 from "os";
-import path8 from "path";
+import { chmodSync, existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import os5 from "os";
+import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -6795,6 +7306,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os5.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os5.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -6818,7 +7396,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -6830,8 +7426,8 @@ var KimiDriver = class {
     this.sessionId = ctx.config.sessionId || randomUUID2();
     this.sessionAnnounced = false;
     this.promptRequestId = randomUUID2();
-    const systemPromptPath = path8.join(ctx.workingDirectory, KIMI_SYSTEM_PROMPT_FILE);
-    const agentFilePath = path8.join(ctx.workingDirectory, KIMI_AGENT_FILE);
+    const systemPromptPath = path9.join(ctx.workingDirectory, KIMI_SYSTEM_PROMPT_FILE);
+    const agentFilePath = path9.join(ctx.workingDirectory, KIMI_AGENT_FILE);
     if (!isResume || !existsSync7(systemPromptPath)) {
       writeFileSync3(systemPromptPath, ctx.prompt, "utf8");
     }
@@ -6842,21 +7438,23 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -6864,7 +7462,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -6977,14 +7575,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir()) {
-  const configPath = path8.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os5.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -7007,7 +7600,7 @@ function detectKimiModels(home = os4.homedir()) {
 import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync4 } from "fs";
-import path9 from "path";
+import path10 from "path";
 import { createRequire as createRequire2 } from "module";
 import {
   createKimiHarness,
@@ -7032,7 +7625,7 @@ function createKimiSdkEventMappingState(sessionId = null) {
   };
 }
 function buildKimiSessionDir(workingDirectory) {
-  return path9.join(workingDirectory, KIMI_SESSION_DIR);
+  return path10.join(workingDirectory, KIMI_SESSION_DIR);
 }
 function kimiErrorMessage(error) {
   if (typeof error === "string" && error.trim()) return error.trim();
@@ -7159,7 +7752,7 @@ async function createKimiAgentSessionForContext(ctx, sessionId) {
   const cliTransport = await prepareCliTransport(ctx, { NO_COLOR: "1" });
   const spawnEnv = cliTransport.spawnEnv;
   const wrapperPath = cliTransport.wrapperPath;
-  const homeDir = spawnEnv.KIMI_HOME || (process.env.HOME ? path9.join(process.env.HOME, ".kimi") : path9.join(ctx.workingDirectory, ".kimi"));
+  const homeDir = spawnEnv.KIMI_HOME || (process.env.HOME ? path10.join(process.env.HOME, ".kimi") : path10.join(ctx.workingDirectory, ".kimi"));
   mkdirSync3(homeDir, { recursive: true });
   const harness = createKimiHarness({
     homeDir,
@@ -7384,7 +7977,7 @@ So instead of \`raft message send ...\`, run \`${this.wrapperPath} message send
 };
 function detectKimiSdkModels(home = resolveKimiHome(), ctx = {}) {
   const span = ctx.span;
-  const configPath = path9.join(home, "config.toml");
+  const configPath = path10.join(home, "config.toml");
   const homeFromEnv = Boolean(process.env.KIMI_CODE_HOME);
   const emit2 = (outcome, extra = {}) => {
     span?.addEvent("daemon.kimi_sdk.models.config", {
@@ -7492,8 +8085,8 @@ var KimiSdkDriver = class {
 // src/drivers/opencode.ts
 import { spawn as spawn8, spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
-import os5 from "os";
-import path10 from "path";
+import os6 from "os";
+import path11 from "path";
 var SLOCK_AGENT_NAME = "slock";
 var NO_MESSAGE_PROMPT = "No new messages are pending. Stop now.";
 var FIRST_MESSAGE_TASK_PREFIX = "First message task (system-triggered):";
@@ -7521,8 +8114,8 @@ function parseUserOpenCodeConfig(ctx) {
   const raw = runtimeConfigToLaunchFields(ctx.config).envVars?.OPENCODE_CONFIG_CONTENT;
   return parseOpenCodeConfigContent(raw);
 }
-function readLocalOpenCodeConfig(home = os5.homedir()) {
-  const configPath = path10.join(home, ".config", "opencode", "opencode.json");
+function readLocalOpenCodeConfig(home = os6.homedir()) {
+  const configPath = path11.join(home, ".config", "opencode", "opencode.json");
   try {
     return parseOpenCodeConfigContent(readFileSync5(configPath, "utf8"));
   } catch {
@@ -7582,7 +8175,7 @@ function mergeOpenCodeConfigs(localConfig, envConfig) {
     }
   };
 }
-function buildOpenCodeConfig(ctx, home = os5.homedir()) {
+function buildOpenCodeConfig(ctx, home = os6.homedir()) {
   const userConfig = mergeOpenCodeConfigs(readLocalOpenCodeConfig(home), parseUserOpenCodeConfig(ctx));
   const userAgents = recordField(userConfig.agent);
   const userSlockAgent = recordField(userAgents[SLOCK_AGENT_NAME]);
@@ -7600,7 +8193,7 @@ function buildOpenCodeConfig(ctx, home = os5.homedir()) {
     mcp: recordField(userConfig.mcp)
   };
 }
-async function buildOpenCodeLaunchOptions(ctx, home = os5.homedir(), version = null) {
+async function buildOpenCodeLaunchOptions(ctx, home = os6.homedir(), version = null) {
   const slock = await prepareCliTransport(ctx, { NO_COLOR: "1" });
   const config = buildOpenCodeConfig(ctx, home);
   const env = {
@@ -7699,7 +8292,7 @@ function formatOpenCodeLabelToken(token) {
   if (/^\d/.test(token)) return token;
   return normalized.charAt(0).toUpperCase() + normalized.slice(1);
 }
-function detectOpenCodeModels(home = os5.homedir(), runCommand = runOpenCodeModelsCommand) {
+function detectOpenCodeModels(home = os6.homedir(), runCommand = runOpenCodeModelsCommand) {
   const commandResult = runCommand(home);
   if (commandResult.error || commandResult.status !== 0) return null;
   return parseOpenCodeModelsOutput(commandResult.stdout);
@@ -7708,7 +8301,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -7720,11 +8313,11 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   };
 }
 function isWindowsCommandShim(commandPath) {
-  const ext = path10.win32.extname(commandPath).toLowerCase();
+  const ext = path11.win32.extname(commandPath).toLowerCase();
   return ext === ".cmd" || ext === ".bat";
 }
 function opencodePackageEntryCandidates(packageRoot) {
-  const winPath = path10.win32;
+  const winPath = path11.win32;
   return [
     winPath.join(packageRoot, "bin", "opencode.exe"),
     winPath.join(packageRoot, "bin", "opencode.js"),
@@ -7733,7 +8326,7 @@ function opencodePackageEntryCandidates(packageRoot) {
   ];
 }
 function openCodeSpecForEntry(entry, commandArgs) {
-  if (path10.win32.extname(entry).toLowerCase() === ".exe") {
+  if (path11.win32.extname(entry).toLowerCase() === ".exe") {
     return { command: entry, args: commandArgs, shell: false };
   }
   return { command: process.execPath, args: [entry, ...commandArgs], shell: false };
@@ -7742,7 +8335,7 @@ function resolveWindowsOpenCodePackageEntry(commandPath, deps = {}) {
   const existsSyncFn = deps.existsSyncFn ?? existsSync8;
   const execFileSyncFn = deps.execFileSyncFn;
   const env = deps.env ?? process.env;
-  const winPath = path10.win32;
+  const winPath = path11.win32;
   const candidates = [];
   if (execFileSyncFn) {
     try {
@@ -7770,7 +8363,7 @@ function resolveWindowsOpenCodePackageEntry(commandPath, deps = {}) {
 function extractWindowsShimTargets(commandPath, deps = {}) {
   if (!isWindowsCommandShim(commandPath)) return [];
   const readFileSyncFn = deps.readFileSyncFn ?? readFileSync5;
-  const commandDir = path10.win32.dirname(commandPath);
+  const commandDir = path11.win32.dirname(commandPath);
   let raw;
   try {
     raw = String(readFileSyncFn(commandPath, "utf8"));
@@ -7781,7 +8374,7 @@ function extractWindowsShimTargets(commandPath, deps = {}) {
   const dp0Pattern = /%~dp0\\?([^"\r\n]*?opencode\.(?:exe|js|mjs|cjs))/gi;
   for (const match of raw.matchAll(dp0Pattern)) {
     const relative = match[1]?.replace(/^\\+/, "");
-    if (relative) candidates.push(path10.win32.normalize(path10.win32.join(commandDir, relative)));
+    if (relative) candidates.push(path11.win32.normalize(path11.win32.join(commandDir, relative)));
   }
   return candidates;
 }
@@ -7795,7 +8388,7 @@ function resolveOpenCodeSpawn(commandArgs, deps = {}) {
     };
   }
   const command = resolveCommandOnPath("opencode", deps);
-  if (command && path10.win32.extname(command).toLowerCase() === ".exe") {
+  if (command && path11.win32.extname(command).toLowerCase() === ".exe") {
     return { command, args: commandArgs, shell: false };
   }
   const packageEntry = resolveWindowsOpenCodePackageEntry(command, deps);
@@ -7900,7 +8493,7 @@ var OpenCodeDriver = class {
     if (unsupportedMessage) {
       throw new Error(unsupportedMessage);
     }
-    const launch = await buildOpenCodeLaunchOptions(ctx, os5.homedir(), version);
+    const launch = await buildOpenCodeLaunchOptions(ctx, os6.homedir(), version);
     const spawnSpec = resolveOpenCodeSpawn(launch.args);
     const proc = spawn8(spawnSpec.command, spawnSpec.args, {
       cwd: ctx.workingDirectory,
@@ -7968,7 +8561,7 @@ var OpenCodeDriver = class {
 import { randomUUID as randomUUID4 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
 import { mkdirSync as mkdirSync4, readdirSync as readdirSync2 } from "fs";
-import path11 from "path";
+import path12 from "path";
 import {
   AuthStorage,
   createBashTool,
@@ -7995,7 +8588,7 @@ function createPiSdkEventMappingState(sessionId = null) {
   };
 }
 function buildPiSessionDir(workingDirectory) {
-  return path11.join(workingDirectory, PI_SESSION_DIR);
+  return path12.join(workingDirectory, PI_SESSION_DIR);
 }
 async function buildPiSpawnEnv(ctx) {
   return (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
@@ -8017,7 +8610,7 @@ function findPiSessionFile(sessionDir, sessionId) {
   }
   const suffix = `_${sessionId}.jsonl`;
   const match = entries.find((entry) => entry.endsWith(suffix));
-  return match ? path11.join(sessionDir, match) : null;
+  return match ? path12.join(sessionDir, match) : null;
 }
 function detectPiModelsFromRegistry(modelRegistry) {
   const models = [];
@@ -8253,7 +8846,7 @@ async function createPiAgentSessionForContext(ctx, sessionId) {
   try {
     const spawnEnv = await buildPiSpawnEnv(ctx);
     const agentDir = spawnEnv.PI_CODING_AGENT_DIR || getAgentDir();
-    const authStorage = AuthStorage.create(path11.join(agentDir, "auth.json"));
+    const authStorage = AuthStorage.create(path12.join(agentDir, "auth.json"));
     const settingsManager = SettingsManager.create(ctx.workingDirectory, agentDir);
     const services = await createAgentSessionServices({
       cwd: ctx.workingDirectory,
@@ -8652,6 +9245,9 @@ var ChildProcessRuntimeSession = class {
   get currentSessionId() {
     return this.driver.currentSessionId;
   }
+  get currentRuntimeHomeDir() {
+    return this.driver.currentRuntimeHomeDir;
+  }
   get exitCode() {
     return this.process?.exitCode ?? null;
   }
@@ -8775,7 +9371,7 @@ function getDriver(runtimeId) {
 // src/workspaces.ts
 import { readdir, rm, stat } from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 function isValidWorkspaceDirectoryName(directoryName) {
   return !directoryName.includes("/") && !directoryName.includes("\\") && !directoryName.includes("..");
 }
@@ -8783,7 +9379,7 @@ function resolveWorkspaceDirectoryPath(dataDir, directoryName) {
   if (!isValidWorkspaceDirectoryName(directoryName)) {
     return null;
   }
-  return path12.join(dataDir, directoryName);
+  return path13.join(dataDir, directoryName);
 }
 function emptyWorkspaceDirectorySummary(latestMtime = /* @__PURE__ */ new Date(0)) {
   return {
@@ -8832,7 +9428,7 @@ async function summarizeWorkspaceDirectory(dirPath) {
     return summary;
   }
   const childSummaries = await Promise.all(
-    entries.map((entry) => summarizeWorkspaceEntry(path12.join(dirPath, entry.name), entry))
+    entries.map((entry) => summarizeWorkspaceEntry(path13.join(dirPath, entry.name), entry))
   );
   for (const childSummary of childSummaries) {
     summary = mergeWorkspaceDirectorySummaries(summary, childSummary);
@@ -8851,7 +9447,7 @@ async function scanWorkspaceDirectories(dataDir) {
       if (!entry.isDirectory()) {
         return null;
       }
-      const dirPath = path12.join(dataDir, entry.name);
+      const dirPath = path13.join(dataDir, entry.name);
       try {
         const summary = await summarizeWorkspaceDirectory(dirPath);
         return {
@@ -9400,17 +9996,17 @@ function allowedTranscriptRootsForRuntime(runtime, homeDir, workspaceDir) {
   const roots = [workspaceDir];
   switch (runtime) {
     case "claude":
-      roots.push(path13.join(homeDir, ".claude"));
+      roots.push(path14.join(homeDir, ".claude"));
       break;
     case "codex":
-      roots.push(path13.join(homeDir, ".codex"));
+      roots.push(homeDir, path14.join(homeDir, ".codex"));
       break;
     case "kimi":
     case "kimi-sdk":
-      roots.push(path13.join(homeDir, ".kimi"));
+      roots.push(path14.join(homeDir, ".kimi"));
       break;
     case "pi":
-      roots.push(path13.join(homeDir, ".pi"), path13.join(homeDir, ".pi", "agent"));
+      roots.push(path14.join(homeDir, ".pi"), path14.join(homeDir, ".pi", "agent"));
       break;
   }
   return roots;
@@ -9421,8 +10017,8 @@ async function isPathWithinAllowedRoots(filePath, roots) {
   for (const root of roots) {
     const realRoot = await realpath(root).catch(() => null);
     if (!realRoot) continue;
-    const rel = path13.relative(realRoot, real);
-    if (!rel.startsWith("..") && !path13.isAbsolute(rel)) return true;
+    const rel = path14.relative(realRoot, real);
+    if (!rel.startsWith("..") && !path14.isAbsolute(rel)) return true;
   }
   return false;
 }
@@ -9469,12 +10065,12 @@ function findSessionJsonl(root, predicate) {
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isFile() || !predicate(entry.name)) continue;
-      return path13.join(dir, entry.name);
+      return path14.join(dir, entry.name);
     }
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isDirectory()) continue;
-      const found = visit(path13.join(dir, entry.name), depth - 1);
+      const found = visit(path14.join(dir, entry.name), depth - 1);
       if (found) return found;
     }
     return null;
@@ -9482,7 +10078,7 @@ function findSessionJsonl(root, predicate) {
   return visit(root, maxDepth);
 }
 function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
-  const indexPath = path13.join(homeDir, ".kimi", "session_index.jsonl");
+  const indexPath = path14.join(homeDir, ".kimi", "session_index.jsonl");
   try {
     const index = readFileSync6(indexPath, "utf8");
     for (const line of index.split("\n")) {
@@ -9497,12 +10093,12 @@ function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
     }
   } catch {
   }
-  const sessionsRoot = path13.join(homeDir, ".kimi", "sessions");
+  const sessionsRoot = path14.join(homeDir, ".kimi", "sessions");
   try {
     const prefix = agentId ? `wd_${agentId}_` : `wd_`;
     for (const entry of readdirSync3(sessionsRoot, { withFileTypes: true })) {
       if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
-      const candidate = path13.join(sessionsRoot, entry.name, `session_${sessionId}`);
+      const candidate = path14.join(sessionsRoot, entry.name, `session_${sessionId}`);
       if (existsSync9(candidate)) return candidate;
     }
   } catch {
@@ -9511,16 +10107,16 @@ function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
 }
 function findPiSessionFile2(sessionId, workingDirectory, homeDir) {
   if (workingDirectory) {
-    const piSessionsDir = path13.join(workingDirectory, ".pi-sessions");
+    const piSessionsDir = path14.join(workingDirectory, ".pi-sessions");
     try {
-      const files = readdirSync3(piSessionsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => ({ name: e.name, path: path13.join(piSessionsDir, e.name), stat: statSync(path13.join(piSessionsDir, e.name)) })).filter((f) => f.stat.isFile() && f.name.includes(sessionId)).sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
+      const files = readdirSync3(piSessionsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => ({ name: e.name, path: path14.join(piSessionsDir, e.name), stat: statSync(path14.join(piSessionsDir, e.name)) })).filter((f) => f.stat.isFile() && f.name.includes(sessionId)).sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
       if (files[0]) return files[0].path;
     } catch {
     }
   }
   const legacyRoots = [
-    path13.join(homeDir, ".pi", "agent"),
-    path13.join(homeDir, ".pi")
+    path14.join(homeDir, ".pi", "agent"),
+    path14.join(homeDir, ".pi")
   ];
   for (const root of legacyRoots) {
     const found = findSessionJsonl(root, (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId));
@@ -9534,9 +10130,9 @@ function safeSessionFilename(value) {
 }
 function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   try {
-    const dir = path13.join(fallbackDir, ".slock", "runtime-sessions");
+    const dir = path14.join(fallbackDir, ".slock", "runtime-sessions");
     mkdirSync5(dir, { recursive: true });
-    const filePath = path13.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
+    const filePath = path14.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
     writeFileSync4(filePath, JSON.stringify({
       type: "runtime_session_handoff",
       runtime,
@@ -9555,27 +10151,40 @@ function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
     return null;
   }
 }
-function resolveRuntimeHomeDir(config, defaultHomeDir, workspacePath) {
+function resolveRuntimeHomeDir(config, defaultHomeDir, workspacePath, opts = {}) {
   if (isClaudeCustomProviderConfig(config)) {
     return getClaudeProviderStatePaths(workspacePath).home;
   }
+  if (config.runtime === "codex") {
+    return resolveCodexHomeRootFromConfig(config, defaultHomeDir, workspacePath, process.env, opts);
+  }
   return defaultHomeDir;
 }
-function ensureRuntimeHomeDir(config, defaultHomeDir, workspacePath) {
+function ensureRuntimeHomeDir(config, defaultHomeDir, workspacePath, opts = {}) {
   if (isClaudeCustomProviderConfig(config)) {
     return ensureClaudeProviderStatePaths(workspacePath).home;
   }
+  if (config.runtime === "codex") {
+    const home = resolveCodexHomeRootFromConfig(config, defaultHomeDir, workspacePath, process.env, opts);
+    if (opts.agentId) {
+      mkdirSync5(home, { recursive: true });
+    }
+    return home;
+  }
   return defaultHomeDir;
 }
-function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os6.homedir(), fallbackDir, opts) {
+function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os7.homedir(), fallbackDir, opts) {
   let resolvedPath = null;
   let lookupMethod = "none";
   if (runtime === "claude") {
     lookupMethod = "claude_jsonl";
-    resolvedPath = findSessionJsonl(path13.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`);
+    resolvedPath = findSessionJsonl(path14.join(homeDir, ".claude", "projects"), (filename) => filename === `${sessionId}.jsonl`);
   } else if (runtime === "codex") {
     lookupMethod = "codex_jsonl";
-    resolvedPath = findSessionJsonl(path13.join(homeDir, ".codex", "sessions"), (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId));
+    for (const root of codexSessionRootCandidates(homeDir)) {
+      resolvedPath = findSessionJsonl(root, (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId));
+      if (resolvedPath) break;
+    }
   } else if (runtime === "kimi-sdk" || runtime === "kimi") {
     lookupMethod = "kimi_sdk_index";
     resolvedPath = findKimiSdkSessionDir(sessionId, opts?.agentId, homeDir);
@@ -10312,6 +10921,28 @@ function runtimeDiagnosticTraceAttrs(event) {
     session_id_present: Boolean(event.sessionId)
   };
 }
+function runtimeRecoveryTrajectoryEntry(event) {
+  const lines = [event.message];
+  if (event.details && event.details !== event.message) {
+    lines.push(event.details);
+  }
+  return {
+    kind: "system",
+    title: "Codex resume recovery",
+    text: lines.join("\n")
+  };
+}
+function runtimeRecoveryTraceAttrs(event) {
+  return {
+    kind: event.kind,
+    source: event.source,
+    resume_error_class: event.resumeErrorClass,
+    recovery_action: event.recoveryAction,
+    requested_session_id_present: Boolean(event.requestedSessionId),
+    message_present: Boolean(event.message),
+    details_present: Boolean(event.details)
+  };
+}
 function currentErrorCandidates(ap) {
   return [
     ap.runtimeErrorSinceProgress ? ap.lastRuntimeError : null,
@@ -10635,6 +11266,7 @@ var AgentProcessManager = class _AgentProcessManager {
   sendToServer;
   daemonApiKey;
   serverUrl;
+  slockHome;
   dataDir;
   runtimeSessionHomeDir;
   driverResolver;
@@ -10664,8 +11296,9 @@ var AgentProcessManager = class _AgentProcessManager {
     this.sendToServer = sendToServer;
     this.daemonApiKey = daemonApiKey;
     this.serverUrl = opts.serverUrl;
-    this.dataDir = opts.dataDir || resolveSlockHomePath("agents");
-    this.runtimeSessionHomeDir = opts.runtimeSessionHomeDir || os6.homedir();
+    this.slockHome = opts.slockHome ? path14.resolve(opts.slockHome) : resolveSlockHome();
+    this.dataDir = opts.dataDir || resolveSlockHomePath("agents", this.slockHome);
+    this.runtimeSessionHomeDir = opts.runtimeSessionHomeDir || os7.homedir();
     this.driverResolver = opts.driverResolver || getDriver;
     this.defaultAgentEnvVarsProvider = opts.defaultAgentEnvVarsProvider || null;
     this.tracer = opts.tracer ?? noopTracer;
@@ -10794,6 +11427,70 @@ var AgentProcessManager = class _AgentProcessManager {
       this.sendStdinNotification(agentId);
     }, delayMs);
   }
+  flushAsyncRejectedIdleDelivery(agentId) {
+    const ap = this.agents.get(agentId);
+    if (!ap) return false;
+    const count = ap.notifications.takePendingAndClearTimer();
+    if (count === 0) return false;
+    if (!ap.driver.supportsStdinNotification || !ap.sessionId || ap.inbox.length === 0) {
+      ap.notifications.add(count);
+      this.recordDaemonTrace("daemon.agent.stdin_delivery.async_rejected.retry", {
+        agentId,
+        runtime: ap.config.runtime,
+        model: ap.config.model,
+        launchId: ap.launchId || void 0,
+        mode: "idle",
+        outcome: "queued_without_stdin",
+        inbox_count: ap.inbox.length,
+        pending_notification_count: ap.notifications.pendingCount,
+        session_id_present: Boolean(ap.sessionId),
+        supports_stdin_notification: ap.driver.supportsStdinNotification
+      });
+      return false;
+    }
+    if (!this.isApmIdle(ap)) {
+      ap.notifications.add(count);
+      return this.sendStdinNotification(agentId, { forceUnsupportedRetry: true });
+    }
+    ap.notifications.pruneContributedToPending(ap.inbox, ap.sessionId);
+    const messages = ap.notifications.filterUncontributedMessages(ap.inbox, ap.sessionId);
+    if (messages.length === 0) {
+      this.recordDaemonTrace("daemon.agent.stdin_delivery.async_rejected.retry", {
+        agentId,
+        runtime: ap.config.runtime,
+        model: ap.config.model,
+        launchId: ap.launchId || void 0,
+        mode: "idle",
+        outcome: "suppressed_already_contributed",
+        inbox_count: ap.inbox.length,
+        pending_notification_count: count,
+        session_id_present: true
+      });
+      return false;
+    }
+    this.commitApmIdleState(agentId, ap, false);
+    this.startRuntimeTrace(agentId, ap, "async-rejected-idle-delivery-retry", messages);
+    this.broadcastActivity(agentId, "working", "Message received");
+    const accepted = this.deliverInboxUpdateViaStdin(
+      agentId,
+      ap,
+      messages,
+      "idle",
+      "async_rejected_idle_delivery_retry"
+    );
+    this.recordDaemonTrace("daemon.agent.stdin_delivery.async_rejected.retry", {
+      agentId,
+      runtime: ap.config.runtime,
+      model: ap.config.model,
+      launchId: ap.launchId || void 0,
+      mode: "idle",
+      outcome: accepted ? "written" : "not_written",
+      inbox_count: ap.inbox.length,
+      messages_count: messages.length,
+      session_id_present: true
+    });
+    return accepted;
+  }
   isApmIdle(ap) {
     return ap.gatedSteering.isIdle;
   }
@@ -11252,6 +11949,23 @@ var AgentProcessManager = class _AgentProcessManager {
       ...runtimeDiagnosticTraceAttrs(event)
     });
   }
+  recordRuntimeRecoveryActivity(agentId, ap, event) {
+    this.sendToServer({
+      type: "agent:activity",
+      agentId,
+      activity: ap.lastActivity || "online",
+      detail: ap.lastActivityDetail || "",
+      entries: [runtimeRecoveryTrajectoryEntry(event)],
+      launchId: ap.launchId || void 0,
+      clientSeq: this.nextActivityClientSeq(agentId)
+    });
+    this.recordDaemonTrace("daemon.runtime.recovery.visible", {
+      agentId,
+      launchId: ap.launchId || void 0,
+      runtime: ap.config.runtime,
+      ...runtimeRecoveryTraceAttrs(event)
+    });
+  }
   recordDaemonTrace(name, attrs, status = "ok", parentTraceparent) {
     const span = this.tracer.startSpan(name, {
       parent: parseTraceparent(parentTraceparent),
@@ -11589,26 +12303,26 @@ var AgentProcessManager = class _AgentProcessManager {
     let pendingStartRebind;
     const originalLaunchId = launchId || null;
     try {
-      const agentDataDir = path13.join(this.dataDir, agentId);
+      const agentDataDir = path14.join(this.dataDir, agentId);
       await mkdir(agentDataDir, { recursive: true });
       const initialRuntimeConfig = withLocalRuntimeContext(config, agentId, agentDataDir);
-      const memoryMdPath = path13.join(agentDataDir, "MEMORY.md");
+      const memoryMdPath = path14.join(agentDataDir, "MEMORY.md");
       try {
         await access(memoryMdPath);
       } catch {
         const initialMemoryMd = buildInitialMemoryMd(initialRuntimeConfig);
         await writeFile(memoryMdPath, initialMemoryMd);
       }
-      const notesDir = path13.join(agentDataDir, "notes");
+      const notesDir = path14.join(agentDataDir, "notes");
       await mkdir(notesDir, { recursive: true });
       if (getOnboardingSeedMode(config) === FIRST_CINDY_SEED_MODE) {
         const seedFiles = buildOnboardingSeedFiles();
         for (const { relativePath, content } of seedFiles) {
-          const fullPath = path13.join(agentDataDir, relativePath);
+          const fullPath = path14.join(agentDataDir, relativePath);
           try {
             await access(fullPath);
           } catch {
-            await mkdir(path13.dirname(fullPath), { recursive: true });
+            await mkdir(path14.dirname(fullPath), { recursive: true });
             await writeFile(fullPath, content);
           }
         }
@@ -11762,6 +12476,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
         workingDirectory: agentDataDir,
         slockCliPath: this.slockCliPath,
         daemonApiKey: this.daemonApiKey,
+        slockHome: this.slockHome,
         launchId: effectiveLaunchId,
         agentCredentialProxyInboxCoordinator: this.createAgentProxyInboxCoordinator(agentId),
         cliTransportTraceDir: this.cliTransportTraceDir,
@@ -12921,7 +13636,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     return true;
   }
   async resetWorkspace(agentId) {
-    const agentDataDir = path13.join(this.dataDir, agentId);
+    const agentDataDir = path14.join(this.dataDir, agentId);
     try {
       await rm2(agentDataDir, { recursive: true, force: true });
       logger.info(`[Agent ${agentId}] Workspace reset complete (${agentDataDir})`);
@@ -12981,9 +13696,9 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     }
     return result;
   }
-  buildRuntimeProfileReport(agentId, config, sessionId, launchId) {
-    const workspacePath = path13.join(this.dataDir, agentId);
-    const runtimeHomeDir = resolveRuntimeHomeDir(config, this.runtimeSessionHomeDir, workspacePath);
+  buildRuntimeProfileReport(agentId, config, sessionId, launchId, observedRuntimeHomeDir) {
+    const workspacePath = path14.join(this.dataDir, agentId);
+    const runtimeHomeDir = observedRuntimeHomeDir || resolveRuntimeHomeDir(config, this.runtimeSessionHomeDir, workspacePath, { agentId, slockHome: this.slockHome });
     return {
       agentId,
       launchId,
@@ -13004,7 +13719,13 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
   getAgentRuntimeProfileReport(agentId) {
     const running = this.agents.get(agentId);
     if (running) {
-      return this.buildRuntimeProfileReport(agentId, running.config, running.sessionId, running.launchId);
+      return this.buildRuntimeProfileReport(
+        agentId,
+        running.config,
+        running.sessionId,
+        running.launchId,
+        running.runtime.currentRuntimeHomeDir
+      );
     }
     const idle = this.idleAgentConfigs.get(agentId);
     if (idle) {
@@ -13277,7 +13998,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
   }
   // Workspace file browsing
   async getFileTree(agentId, dirPath) {
-    const agentDir = path13.join(this.dataDir, agentId);
+    const agentDir = path14.join(this.dataDir, agentId);
     try {
       await stat2(agentDir);
     } catch {
@@ -13285,8 +14006,8 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     }
     let targetDir = agentDir;
     if (dirPath) {
-      const resolved = path13.resolve(agentDir, dirPath);
-      if (!resolved.startsWith(agentDir + path13.sep) && resolved !== agentDir) {
+      const resolved = path14.resolve(agentDir, dirPath);
+      if (!resolved.startsWith(agentDir + path14.sep) && resolved !== agentDir) {
         return [];
       }
       targetDir = resolved;
@@ -13294,14 +14015,14 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     return this.listDirectoryChildren(targetDir, agentDir);
   }
   async readFile(agentId, filePath) {
-    const agentDir = path13.join(this.dataDir, agentId);
-    const resolved = path13.resolve(agentDir, filePath);
-    if (!resolved.startsWith(agentDir + path13.sep) && resolved !== agentDir) {
+    const agentDir = path14.join(this.dataDir, agentId);
+    const resolved = path14.resolve(agentDir, filePath);
+    if (!resolved.startsWith(agentDir + path14.sep) && resolved !== agentDir) {
       throw new Error("Access denied");
     }
     const info = await stat2(resolved);
     if (info.isDirectory()) throw new Error("Cannot read a directory");
-    const ext = path13.extname(resolved).toLowerCase();
+    const ext = path14.extname(resolved).toLowerCase();
     if (WORKSPACE_TEXT_EXTENSIONS.has(ext) || ext === "") {
       if (info.size > WORKSPACE_TEXT_FILE_MAX_BYTES) throw new Error("File too large");
       const content = await readFile(resolved, "utf-8");
@@ -13352,8 +14073,8 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
       };
     }
     const runtime = config.runtime;
-    const workspaceDir = path13.join(this.dataDir, agentId);
-    const homeDir = ensureRuntimeHomeDir(config, this.runtimeSessionHomeDir, workspaceDir);
+    const workspaceDir = path14.join(this.dataDir, agentId);
+    const homeDir = agent?.runtime.currentRuntimeHomeDir || ensureRuntimeHomeDir(config, this.runtimeSessionHomeDir, workspaceDir, { agentId, slockHome: this.slockHome });
     if (!actualSessionId) {
       return {
         runtime,
@@ -13391,7 +14112,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     let redacted = false;
     if (ref.reachable && ref.path) {
       try {
-        const resolved = path13.resolve(ref.path);
+        const resolved = path14.resolve(ref.path);
         const allowedRoots = allowedTranscriptRootsForRuntime(runtime, homeDir, workspaceDir);
         if (!await isPathWithinAllowedRoots(resolved, allowedRoots)) {
           throw new Error("resolved session path is outside allowed runtime directories");
@@ -13402,7 +14123,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
           throw new Error("symbolic links are not allowed");
         }
         if (info.isDirectory()) {
-          targetPath = path13.join(resolved, "state.json");
+          targetPath = path14.join(resolved, "state.json");
         }
         if (!await isPathWithinAllowedRoots(targetPath, allowedRoots)) {
           throw new Error("resolved session state path is outside allowed runtime directories");
@@ -13514,14 +14235,22 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     const idle = this.idleAgentConfigs.get(agentId);
     const config = agent?.config ?? idle?.config ?? null;
     const runtime = runtimeHint || config?.runtime || "claude";
-    const workspaceDir = path13.join(this.dataDir, agentId);
-    const home = config ? ensureRuntimeHomeDir(config, os6.homedir(), workspaceDir) : os6.homedir();
+    const workspaceDir = path14.join(this.dataDir, agentId);
+    const hostHome = os7.homedir();
+    const home = agent?.runtime.currentRuntimeHomeDir || (config ? ensureRuntimeHomeDir(config, hostHome, workspaceDir, { agentId, slockHome: this.slockHome }) : runtime === "codex" ? resolveCodexHomeRootFromEnv(process.env, { defaultHomeDir: hostHome, cwd: workspaceDir }) : hostHome);
     const paths = _AgentProcessManager.SKILL_PATHS[runtime] || _AgentProcessManager.SKILL_PATHS.claude;
+    const globalDirs = runtime === "codex" ? [
+      path14.join(home, "skills"),
+      path14.join(home, "skills", ".system"),
+      path14.join(home, ".agents", "skills"),
+      ...hasConfiguredCodexHome(config) ? [] : [path14.join(hostHome, ".agents", "skills")]
+    ] : paths.global.map((p) => path14.join(home, p));
+    const workspaceDirs = paths.workspace.map((p) => path14.join(workspaceDir, p));
     const globalResults = await Promise.all(
-      paths.global.map((p) => this.scanSkillsDir(path13.join(home, p)))
+      globalDirs.map((dir) => this.scanSkillsDir(dir))
     );
     const workspaceResults = await Promise.all(
-      paths.workspace.map((p) => this.scanSkillsDir(path13.join(workspaceDir, p)))
+      workspaceDirs.map((dir) => this.scanSkillsDir(dir))
     );
     const dedup = (skills) => {
       const seen = /* @__PURE__ */ new Set();
@@ -13550,7 +14279,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     const skills = [];
     for (const entry of entries) {
       if (entry.isDirectory() || entry.isSymbolicLink()) {
-        const skillMd = path13.join(dir, entry.name, "SKILL.md");
+        const skillMd = path14.join(dir, entry.name, "SKILL.md");
         try {
           const content = await readFile(skillMd, "utf-8");
           const skill = this.parseSkillMd(entry.name, content);
@@ -13561,7 +14290,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
       } else if (entry.name.endsWith(".md")) {
         const cmdName = entry.name.replace(/\.md$/, "");
         try {
-          const content = await readFile(path13.join(dir, entry.name), "utf-8");
+          const content = await readFile(path14.join(dir, entry.name), "utf-8");
           const skill = this.parseSkillMd(cmdName, content);
           skill.sourcePath = dir;
           skills.push(skill);
@@ -13982,6 +14711,43 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
   recordRuntimeTraceEvent(agentId, ap, name, attrs) {
     this.startRuntimeTrace(agentId, ap, "runtime-progress").addEvent(name, attrs);
   }
+  restoreRuntimeDeliveryAfterAsyncRejection(agentId, ap, event) {
+    const pendingBefore = ap.notifications.pendingCount;
+    const restoredMessages = ap.inbox.filter(
+      (message) => ap.notifications.hasContributedMessage(message, ap.sessionId)
+    );
+    ap.notifications.clearNoticeFingerprint();
+    const restoredNotificationCount = ap.driver.supportsStdinNotification && ap.sessionId && restoredMessages.length > 0 ? ap.notifications.add(restoredMessages.length) : 0;
+    if (event.requestMethod === "turn/start") {
+      this.commitApmIdleState(agentId, ap, true);
+    }
+    const idleRetryScheduled = event.requestMethod === "turn/start" && restoredNotificationCount > 0 ? ap.notifications.schedule(() => {
+      this.flushAsyncRejectedIdleDelivery(agentId);
+    }, this.stdinNotificationRetryMs) : false;
+    const attrs = {
+      request_method: event.requestMethod,
+      source: event.source,
+      payloadBytes: event.payloadBytes,
+      inbox_count: ap.inbox.length,
+      restored_messages_count: restoredMessages.length,
+      pending_notification_count_before: pendingBefore,
+      pending_notification_count_after: ap.notifications.pendingCount,
+      restored_notification_count: restoredNotificationCount,
+      session_id_present: Boolean(ap.sessionId),
+      supports_stdin_notification: ap.driver.supportsStdinNotification,
+      busy_delivery_mode: ap.driver.busyDeliveryMode,
+      restored_idle_state: event.requestMethod === "turn/start",
+      idle_retry_scheduled: idleRetryScheduled
+    };
+    this.recordRuntimeTraceEvent(agentId, ap, "runtime.delivery.async_rejected", attrs);
+    this.recordDaemonTrace("daemon.agent.stdin_delivery.async_rejected", {
+      agentId,
+      launchId: ap.launchId || void 0,
+      runtime: ap.config.runtime,
+      model: ap.config.model,
+      ...attrs
+    }, "error");
+  }
   noteRuntimeProgress(ap, eventKind) {
     ap.runtimeProgress.noteRuntimeEvent(eventKind);
     this.invalidateRecoveryErrorView(ap);
@@ -14170,7 +14936,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     if ((ap.driver.startupReadiness ?? "first_event") !== "initial_turn") {
       return true;
     }
-    return event.kind !== "session_init" && event.kind !== "internal_progress" && event.kind !== "runtime_diagnostic";
+    return event.kind !== "session_init" && event.kind !== "internal_progress" && event.kind !== "runtime_diagnostic" && event.kind !== "runtime_recovery";
   }
   handleRuntimeStartupTimeout(agentId, ap, timeoutMs) {
     const current = this.agents.get(agentId);
@@ -14366,6 +15132,21 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
       if (ap) this.recordRuntimeTelemetry(agentId, ap, event);
       return;
     }
+    if (event.kind === "delivery_error") {
+      if (ap) {
+        this.restoreRuntimeDeliveryAfterAsyncRejection(agentId, ap, event);
+      } else {
+        this.recordDaemonTrace("daemon.agent.delivery_error.received_without_process", {
+          agentId,
+          event_kind: event.kind,
+          runtime: driver.id,
+          request_method: event.requestMethod,
+          source: event.source,
+          payloadBytes: event.payloadBytes
+        });
+      }
+      return;
+    }
     if (ap && isStartupRequestErrorEvent(event)) {
       this.handleRuntimeStartupRequestError(agentId, ap, event);
       return;
@@ -14382,13 +15163,15 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
         source: event.source,
         itemType: event.itemType,
         payloadBytes: event.payloadBytes
-      } : event.kind === "runtime_diagnostic" ? runtimeDiagnosticTraceAttrs(event) : { kind: event.kind };
+      } : event.kind === "runtime_diagnostic" ? runtimeDiagnosticTraceAttrs(event) : event.kind === "runtime_recovery" ? runtimeRecoveryTraceAttrs(event) : { kind: event.kind };
       this.recordRuntimeTraceEvent(agentId, ap, "runtime.event.received", eventAttrs);
-      if (wasStalled) {
+      const recordProgressObservedAfterStall = () => {
+        if (!wasStalled) return;
         this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.observed", { afterStall: true });
-      }
+      };
       if (event.kind === "internal_progress") {
         ap.runtimeProgress.noteInternalProgress();
+        recordProgressObservedAfterStall();
         this.invalidateRecoveryErrorView(ap);
         this.clearRuntimeErrorDeliveryBackoffAfterProgress(agentId, ap, event.kind);
         this.recordRuntimeTraceEvent(agentId, ap, "runtime.progress.internal_observed", {
@@ -14405,11 +15188,17 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
       }
       if (event.kind === "runtime_diagnostic") {
         this.noteRuntimeProgress(ap, event.kind);
+        recordProgressObservedAfterStall();
         this.clearRuntimeErrorDeliveryBackoffAfterProgress(agentId, ap, event.kind);
         this.recordRuntimeDiagnosticActivity(agentId, ap, event);
         return;
       }
+      if (event.kind === "runtime_recovery") {
+        this.recordRuntimeRecoveryActivity(agentId, ap, event);
+        return;
+      }
       this.noteRuntimeProgress(ap, event.kind);
+      recordProgressObservedAfterStall();
     } else if (event.kind !== "internal_progress") {
       this.recordDaemonTrace("daemon.agent.event.received_without_process", {
         agentId,
@@ -15166,8 +15955,8 @@ ${RESPONSE_TARGET_HINT}`);
     const nodes = [];
     for (const entry of entries) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      const fullPath = path13.join(dir, entry.name);
-      const relativePath = path13.relative(rootDir, fullPath);
+      const fullPath = path14.join(dir, entry.name);
+      const relativePath = path14.relative(rootDir, fullPath);
       let info;
       try {
         info = await stat2(fullPath);
@@ -15542,8 +16331,8 @@ var ReminderCache = class {
 // src/machineLock.ts
 import { createHash as createHash4, randomUUID as randomUUID6 } from "crypto";
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
-import os7 from "os";
-import path14 from "path";
+import os8 from "os";
+import path15 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
 var DaemonMachineLockConflictError = class extends Error {
   code = "DAEMON_MACHINE_LOCK_HELD";
@@ -15565,7 +16354,7 @@ function resolveDefaultMachineStateRoot() {
   return resolveSlockHomePath("machines");
 }
 function ownerPath(lockDir) {
-  return path14.join(lockDir, "owner.json");
+  return path15.join(lockDir, "owner.json");
 }
 function readOwner(lockDir) {
   try {
@@ -15595,8 +16384,8 @@ function acquireDaemonMachineLock(options) {
   const rootDir = options.rootDir ?? resolveDefaultMachineStateRoot();
   const fingerprint = apiKeyFingerprint(options.apiKey);
   const lockId = getDaemonMachineLockId(options.apiKey);
-  const machineDir = path14.join(rootDir, lockId);
-  const lockDir = path14.join(machineDir, "daemon.lock");
+  const machineDir = path15.join(rootDir, lockId);
+  const lockDir = path15.join(machineDir, "daemon.lock");
   const token = randomUUID6();
   mkdirSync6(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -15605,7 +16394,7 @@ function acquireDaemonMachineLock(options) {
       const owner = {
         pid: process.pid,
         token,
-        hostname: os7.hostname(),
+        hostname: os8.hostname(),
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         serverUrl: options.serverUrl,
         apiKeyFingerprint: fingerprint.slice(0, 16)
@@ -15657,7 +16446,7 @@ function acquireDaemonMachineLock(options) {
 // src/localTraceSink.ts
 import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import path15 from "path";
+import path16 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
 var DEFAULT_MAX_FILES = 8;
@@ -15694,7 +16483,7 @@ var LocalRotatingTraceSink = class {
   currentSize = 0;
   sequence = 0;
   constructor(options) {
-    this.traceDir = path15.join(options.machineDir, "traces");
+    this.traceDir = path16.join(options.machineDir, "traces");
     this.maxFileBytes = Math.max(1024, Math.floor(options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES));
     const baseAgeMs = Math.max(1e3, Math.floor(options.maxFileAgeMs ?? DEFAULT_MAX_FILE_AGE_MS));
     const ageJitterMs = Math.max(0, Math.floor(options.maxFileAgeJitterMs ?? 0));
@@ -15724,7 +16513,7 @@ var LocalRotatingTraceSink = class {
     const nowMs = this.nowMsProvider();
     const shouldRotateForAge = this.currentFileOpenedAtMs !== null && nowMs - this.currentFileOpenedAtMs >= this.maxFileAgeMs;
     if (!this.currentFile || this.currentSize + nextBytes > this.maxFileBytes || shouldRotateForAge) {
-      this.currentFile = path15.join(
+      this.currentFile = path16.join(
         this.traceDir,
         `daemon-trace-${safeTimestamp(nowMs)}-${process.pid}-${String(this.sequence++).padStart(4, "0")}.jsonl`
       );
@@ -15739,7 +16528,7 @@ var LocalRotatingTraceSink = class {
     const excess = files.length - this.maxFiles;
     if (excess <= 0) return;
     for (const file of files.slice(0, excess)) {
-      rmSync4(path15.join(this.traceDir, file), { force: true });
+      rmSync4(path16.join(this.traceDir, file), { force: true });
     }
   }
 };
@@ -15830,7 +16619,7 @@ function isDiagnosticErrorAttr(key) {
 import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
 import { gzipSync as gzipSync2 } from "zlib";
 import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 // src/traceJitter.ts
 import { createHash as createHash5 } from "crypto";
@@ -15929,7 +16718,7 @@ var DaemonTraceBundleUploader = class {
     }, nextMs);
   }
   async findUploadCandidates() {
-    const traceDir = path16.join(this.options.machineDir, "traces");
+    const traceDir = path17.join(this.options.machineDir, "traces");
     let names;
     try {
       names = await readdir3(traceDir);
@@ -15941,8 +16730,8 @@ var DaemonTraceBundleUploader = class {
     const currentFile = this.options.currentFileProvider?.();
     const candidates = [];
     for (const name of names.filter((entry) => entry.startsWith("daemon-trace-") && entry.endsWith(".jsonl")).sort()) {
-      const file = path16.join(traceDir, name);
-      if (currentFile && path16.resolve(file) === path16.resolve(currentFile)) continue;
+      const file = path17.join(traceDir, name);
+      if (currentFile && path17.resolve(file) === path17.resolve(currentFile)) continue;
       if (await this.isUploaded(file)) continue;
       try {
         const info = await stat3(file);
@@ -16016,8 +16805,8 @@ var DaemonTraceBundleUploader = class {
     }
   }
   uploadStatePath(file) {
-    const stateDir = path16.join(this.options.machineDir, "trace-uploads");
-    return path16.join(stateDir, `${path16.basename(file)}.uploaded.json`);
+    const stateDir = path17.join(this.options.machineDir, "trace-uploads");
+    return path17.join(stateDir, `${path17.basename(file)}.uploaded.json`);
   }
   async isUploaded(file) {
     try {
@@ -16029,9 +16818,9 @@ var DaemonTraceBundleUploader = class {
   }
   async markUploaded(file, metadata) {
     const stateFile = this.uploadStatePath(file);
-    await mkdir2(path16.dirname(stateFile), { recursive: true, mode: 448 });
+    await mkdir2(path17.dirname(stateFile), { recursive: true, mode: 448 });
     await writeFile2(stateFile, `${JSON.stringify({
-      file: path16.basename(file),
+      file: path17.basename(file),
       uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...metadata
     }, null, 2)}
@@ -16125,7 +16914,7 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     spanAttrs: ["agentId", "event_kind", "runtime"]
   }
 };
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -16161,9 +16950,9 @@ function runnerCredentialErrorDetail2(error) {
 async function waitForRunnerCredentialRetry2() {
   await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
 }
-function parseDaemonCliArgs(args) {
+function parseDaemonCliArgs(args, env = {}) {
   let serverUrl = "";
-  let apiKey = "";
+  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -16180,13 +16969,13 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path17.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path17.resolve(thisDir, "cli", "index.js");
+  const thisDir = path18.dirname(fileURLToPath(moduleUrl));
+  const bundledDistPath = path18.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path17.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path18.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -16200,11 +16989,12 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-DSRBN3VD.js");
+  await import("./dist-5BEASCX5.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
   const versions = {};
+  const diagnostics = {};
   const span = tracer.startSpan("daemon.runtime.detect", {
     surface: "daemon",
     kind: "internal",
@@ -16220,20 +17010,26 @@ function detectRuntimes(tracer = noopTracer) {
         const probe = driver.probe();
         if (!probe.available) {
           if (probe.version) versions[runtime.id] = probe.version;
+          if (probe.diagnostic) diagnostics[runtime.id] = probe.diagnostic;
           span.addEvent("daemon.runtime.detect.checked", {
             runtime: runtime.id,
             outcome: "unavailable",
             version_present: Boolean(probe.version),
+            diagnostic_present: Boolean(probe.diagnostic),
+            ...probe.diagnostic ? { diagnostic: probe.diagnostic } : {},
             binary_path_present: false
           });
           continue;
         }
         ids.push(runtime.id);
         if (probe.version) versions[runtime.id] = probe.version;
+        if (probe.diagnostic) diagnostics[runtime.id] = probe.diagnostic;
         span.addEvent("daemon.runtime.detect.checked", {
           runtime: runtime.id,
           outcome: "available",
           version_present: Boolean(probe.version),
+          diagnostic_present: Boolean(probe.diagnostic),
+          ...probe.diagnostic ? { diagnostic: probe.diagnostic } : {},
           binary_path_present: false
         });
         continue;
@@ -16276,7 +17072,7 @@ function detectRuntimes(tracer = noopTracer) {
       detected_runtime_count: ids.length
     }
   });
-  return { ids, versions };
+  return { ids, versions, ...Object.keys(diagnostics).length > 0 ? { diagnostics } : {} };
 }
 function readPositiveIntegerEnv3(name, fallback) {
   const raw = process.env[name];
@@ -16398,7 +17194,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path17.join(path17.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path18.join(path18.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -16425,7 +17221,7 @@ var DaemonCore = class {
       sink: this.localTraceSink
     }));
     this.agentManager.setTracer(this.tracer);
-    this.agentManager.setCliTransportTraceDir(path17.join(machineDir, "traces"));
+    this.agentManager.setCliTransportTraceDir(path18.join(machineDir, "traces"));
   }
   installTraceBundleUploader(machineDir) {
     if (!this.shouldEnableLocalTrace()) return;
@@ -16973,9 +17769,12 @@ var DaemonCore = class {
     });
   }
   handleConnect() {
-    const { ids: runtimes, versions: runtimeVersions } = this.runtimeDetector();
+    const { ids: runtimes, versions: runtimeVersions, diagnostics: runtimeDiagnostics = {} } = this.runtimeDetector();
     const runtimeInfo = runtimes.map((id) => runtimeVersions[id] ? `${id} (${runtimeVersions[id]})` : id);
     logger.info(`[Daemon] Detected runtimes: ${runtimeInfo.join(", ") || "none"}`);
+    for (const [runtime, diagnostic] of Object.entries(runtimeDiagnostics)) {
+      logger.warn(`[Daemon] Runtime ${runtime} diagnostic: ${diagnostic}`);
+    }
     if (!this.opencliWrappersRegenerated) {
       this.opencliWrappersRegenerated = true;
       try {
@@ -16995,8 +17794,8 @@ var DaemonCore = class {
       capabilities: ["agent:start", "agent:stop", "agent:deliver", "workspace:files"],
       runtimes,
       runningAgents: runningAgentIds,
-      hostname: this.options.hostname ?? os8.hostname(),
-      os: this.options.osDescription ?? `${os8.platform()} ${os8.arch()}`,
+      hostname: this.options.hostname ?? os9.hostname(),
+      os: this.options.osDescription ?? `${os9.platform()} ${os9.arch()}`,
       daemonVersion: this.daemonVersion,
       ...this.computerVersion ? { computerVersion: this.computerVersion } : {}
     });
@@ -17077,6 +17876,8 @@ var DaemonCore = class {
 export {
   subscribeDaemonLogs,
+  DAEMON_API_KEY_ENV,
+  scrubDaemonAuthEnv,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,