@botiverse/raft-daemon 0.63.1 → 0.63.2-play.20260620140456

package/dist/{chunk-RENPNQK3.js → chunk-COT7JNSQ.js}

@@ -1,6 +1,6 @@
 // src/core.ts
 import path18 from "path";
-import os9 from "os";
+import os8 from "os";
 import { createRequire as createRequire3 } from "module";
 import { accessSync } from "fs";
 import { fileURLToPath } from "url";
@@ -1599,12 +1599,12 @@ var DISPLAY_PLAN_CONFIG = {
 var FREE_MONTHLY_FILE_UPLOAD_LIMIT_BYTES = 100 * 1024 * 1024;
 
 // src/agentProcessManager.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync, writeFileSync as writeFileSync4 } from "fs";
 import { mkdir, writeFile, access, readdir as readdir2, stat as stat2, readFile, rm as rm2, lstat, realpath, open } from "fs/promises";
 import { createHash as createHash3, randomUUID as randomUUID5 } from "crypto";
 import path14 from "path";
 import { gzipSync } from "zlib";
-import os7 from "os";
+import os6 from "os";
 
 // src/proxy.ts
 import { HttpsProxyAgent } from "https-proxy-agent";
@@ -2582,6 +2582,19 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonAuthEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  return env;
+}
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -4148,7 +4161,9 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
 ];
 var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
   "agent-token",
@@ -4500,7 +4515,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     SLOCK_SERVER_URL: ctx.config.serverUrl,
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -4769,12 +4784,101 @@ var ClaudeEventNormalizer = class {
 
 // src/drivers/claudeLaunch.ts
 import { writeFileSync as writeFileSync2 } from "fs";
-import path4 from "path";
+import path5 from "path";
+
+// src/drivers/claudeProviderIsolation.ts
+import { readdirSync as readdirSync2 } from "fs";
+import path3 from "path";
+var LEGACY_CLAUDE_PROVIDER_CONFIG_DIR = path3.join(".slock", "claude-provider", "home", ".claude");
+var warnedLegacyClaudeProviderConfigDirs = /* @__PURE__ */ new Set();
+var CLAUDE_CUSTOM_PROVIDER_HOST_ENV_KEYS = [
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_CUSTOM_HEADERS",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+  "ANTHROPIC_FEDERATION_RULE_ID",
+  "ANTHROPIC_ORGANIZATION_ID",
+  "ANTHROPIC_MODEL",
+  "ANTHROPIC_SMALL_FAST_MODEL",
+  "ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_SKIP_BEDROCK_AUTH",
+  "AWS_BEARER_TOKEN_BEDROCK",
+  "ANTHROPIC_BEDROCK_BASE_URL",
+  "ANTHROPIC_BEDROCK_SERVICE_TIER",
+  "CLAUDE_CODE_USE_MANTLE",
+  "CLAUDE_CODE_SKIP_MANTLE_AUTH",
+  "ANTHROPIC_BEDROCK_MANTLE_API_KEY",
+  "ANTHROPIC_BEDROCK_MANTLE_BASE_URL",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_SKIP_VERTEX_AUTH",
+  "ANTHROPIC_VERTEX_PROJECT_ID",
+  "ANTHROPIC_VERTEX_BASE_URL",
+  "CLOUD_ML_REGION",
+  "CLAUDE_CODE_USE_FOUNDRY",
+  "CLAUDE_CODE_SKIP_FOUNDRY_AUTH",
+  "ANTHROPIC_FOUNDRY_API_KEY",
+  "ANTHROPIC_FOUNDRY_AUTH_TOKEN",
+  "ANTHROPIC_FOUNDRY_RESOURCE",
+  "ANTHROPIC_FOUNDRY_BASE_URL",
+  "CLAUDE_CODE_USE_ANTHROPIC_AWS",
+  "CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH",
+  "CLAUDE_CODE_USE_GATEWAY",
+  "CLAUDE_CODE_USE_CCR_V2"
+];
+function isClaudeCustomProviderConfig(config) {
+  const launchRuntimeFields = runtimeConfigToLaunchFields(config);
+  return launchRuntimeFields.runtime === "claude" && Boolean(launchRuntimeFields.envVars?.ANTHROPIC_BASE_URL) && Boolean(launchRuntimeFields.envVars?.ANTHROPIC_API_KEY);
+}
+function clearInheritedClaudeProviderEnv(explicitEnv) {
+  const env = {};
+  for (const key of CLAUDE_CUSTOM_PROVIDER_HOST_ENV_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(explicitEnv ?? {}, key)) {
+      env[key] = void 0;
+    }
+  }
+  return env;
+}
+var LEGACY_CLAUDE_PROVIDER_CONFIG_ENTRIES = /* @__PURE__ */ new Set([
+  "agents",
+  "commands",
+  "projects",
+  "settings.json",
+  "skills",
+  "todos"
+]);
+function hasLegacyClaudeProviderConfigEntry(directory) {
+  try {
+    return readdirSync2(directory).some((entry) => LEGACY_CLAUDE_PROVIDER_CONFIG_ENTRIES.has(entry));
+  } catch {
+    return false;
+  }
+}
+function shouldWarnLegacyClaudeProviderConfigDir(workingDirectory) {
+  const legacyConfigDir = path3.resolve(workingDirectory, LEGACY_CLAUDE_PROVIDER_CONFIG_DIR);
+  if (!hasLegacyClaudeProviderConfigEntry(legacyConfigDir)) {
+    return false;
+  }
+  if (warnedLegacyClaudeProviderConfigDirs.has(legacyConfigDir)) {
+    return false;
+  }
+  warnedLegacyClaudeProviderConfigDirs.add(legacyConfigDir);
+  return true;
+}
+function buildClaudeProviderIsolationEnv(ctx) {
+  if (!isClaudeCustomProviderConfig(ctx.config)) {
+    return {};
+  }
+  const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
+  return {
+    ...clearInheritedClaudeProviderEnv(launchRuntimeFields.envVars)
+  };
+}
 
 // src/drivers/probe.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync3 } from "fs";
-import path3 from "path";
+import path4 from "path";
 function normalizeExecOutput(raw) {
   return Buffer.isBuffer(raw) ? raw.toString("utf8") : String(raw ?? "");
 }
@@ -4907,13 +5011,13 @@ function resolveCommandOnWindows(command, env, execFileSyncFn, existsSyncFn) {
     if (!resolved) return null;
     const lowerResolved = resolved.toLowerCase();
     if (lowerResolved.endsWith(".ps1")) {
-      const dir = path3.dirname(resolved);
-      const base = path3.basename(resolved, ".ps1");
+      const dir = path4.dirname(resolved);
+      const base = path4.basename(resolved, ".ps1");
       const alternatives = [
-        path3.join(dir, `${base}.cmd`),
-        path3.join(dir, `${base}.bat`),
-        path3.join(dir, `${base}.exe`),
-        path3.join(dir, base)
+        path4.join(dir, `${base}.cmd`),
+        path4.join(dir, `${base}.bat`),
+        path4.join(dir, `${base}.exe`),
+        path4.join(dir, base)
       ];
       for (const alt of alternatives) {
         if (existsSyncFn(alt)) return alt;
@@ -4933,7 +5037,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -4959,7 +5063,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -4974,11 +5078,11 @@ function readCommandVersion(command, args = [], deps = {}) {
 }
 function resolveHomePath(relativePath, deps = {}) {
   const homeDir = deps.homeDir ?? deps.env?.HOME ?? process.env.HOME ?? "";
-  return path3.join(homeDir, relativePath);
+  return path4.join(homeDir, relativePath);
 }
 
 // src/drivers/claudeLaunch.ts
-var CLAUDE_DESKTOP_CLI_RELATIVE_PATH = path4.join("Applications", "Claude Code URL Handler.app", "Contents", "MacOS", "claude");
+var CLAUDE_DESKTOP_CLI_RELATIVE_PATH = path5.join("Applications", "Claude Code URL Handler.app", "Contents", "MacOS", "claude");
 var CLAUDE_DESKTOP_CLI_SYSTEM_PATH = "/Applications/Claude Code URL Handler.app/Contents/MacOS/claude";
 var CLAUDE_SYSTEM_PROMPT_FILE = "claude-system-prompt.md";
 var CLAUDE_DISALLOWED_TOOLS = [
@@ -5033,6 +5137,9 @@ function buildClaudeArgs(config, opts) {
   if (launchRuntimeFields.reasoningEffort) {
     args.push("--effort", launchRuntimeFields.reasoningEffort);
   }
+  if (isClaudeCustomProviderConfig(config)) {
+    args.push("--setting-sources", "project,local");
+  }
   if (launchRuntimeFields.mode.kind === "fast") {
     args.push("--settings", JSON.stringify({ fastMode: true }));
   }
@@ -5042,7 +5149,7 @@ function buildClaudeArgs(config, opts) {
   return args;
 }
 function writeClaudeSystemPromptFile(standingPrompt, slockDir) {
-  const systemPromptPath = path4.join(slockDir, CLAUDE_SYSTEM_PROMPT_FILE);
+  const systemPromptPath = path5.join(slockDir, CLAUDE_SYSTEM_PROMPT_FILE);
   writeFileSync2(systemPromptPath, standingPrompt, { mode: 384 });
   return systemPromptPath;
 }
@@ -5057,52 +5164,6 @@ function buildClaudeSpawnSpec(claudeCommand, platform = process.platform) {
   };
 }
 
-// src/drivers/claudeProviderIsolation.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, symlinkSync } from "fs";
-import os2 from "os";
-import path5 from "path";
-function isClaudeCustomProviderConfig(config) {
-  const launchRuntimeFields = runtimeConfigToLaunchFields(config);
-  return launchRuntimeFields.runtime === "claude" && Boolean(launchRuntimeFields.envVars?.ANTHROPIC_BASE_URL) && Boolean(launchRuntimeFields.envVars?.ANTHROPIC_API_KEY);
-}
-function getClaudeProviderStatePaths(workingDirectory) {
-  const root = path5.join(workingDirectory, ".slock", "claude-provider");
-  const home = path5.join(root, "home");
-  return {
-    root,
-    home,
-    configDir: path5.join(home, ".claude")
-  };
-}
-function linkIfPresent(source, target) {
-  try {
-    if (!existsSync4(source) || existsSync4(target)) return;
-    mkdirSync2(path5.dirname(target), { recursive: true, mode: 448 });
-    symlinkSync(source, target, "dir");
-  } catch {
-  }
-}
-function ensureClaudeProviderStatePaths(workingDirectory, hostClaudeHome = path5.join(os2.homedir(), ".claude")) {
-  const paths = getClaudeProviderStatePaths(workingDirectory);
-  mkdirSync2(paths.home, { recursive: true, mode: 448 });
-  mkdirSync2(paths.configDir, { recursive: true, mode: 448 });
-  linkIfPresent(path5.join(hostClaudeHome, "skills"), path5.join(paths.configDir, "skills"));
-  linkIfPresent(path5.join(hostClaudeHome, "commands"), path5.join(paths.configDir, "commands"));
-  return paths;
-}
-function buildClaudeProviderIsolationEnv(ctx) {
-  if (!isClaudeCustomProviderConfig(ctx.config)) {
-    return {};
-  }
-  const paths = ensureClaudeProviderStatePaths(ctx.workingDirectory);
-  return {
-    HOME: paths.home,
-    USERPROFILE: paths.home,
-    CLAUDE_CONFIG_DIR: paths.configDir,
-    CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST: "1"
-  };
-}
-
 // src/drivers/claude.ts
 var ClaudeDriver = class {
   id = "claude";
@@ -5140,6 +5201,11 @@ var ClaudeDriver = class {
       ctx,
       buildClaudeProviderIsolationEnv(ctx)
     );
+    if (isClaudeCustomProviderConfig(ctx.config) && shouldWarnLegacyClaudeProviderConfigDir(ctx.workingDirectory)) {
+      logger.warn(
+        `[Agent ${ctx.agentId}] Legacy Claude custom-provider config directory ${LEGACY_CLAUDE_PROVIDER_CONFIG_DIR} is no longer used; custom-provider Claude now uses host Claude state plus explicit provider env.`
+      );
+    }
     const systemPromptPath = writeClaudeSystemPromptFile(ctx.standingPrompt, slockDir);
     const args = this.buildClaudeArgs(ctx.config, {
       standingPromptFilePath: systemPromptPath
@@ -5197,12 +5263,12 @@ var ClaudeDriver = class {
 
 // src/drivers/codex.ts
 import { spawn as spawn2, execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
-import os4 from "os";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import os3 from "os";
 import path7 from "path";
 
 // src/drivers/codexHome.ts
-import os3 from "os";
+import os2 from "os";
 import path6 from "path";
 function readConfiguredCodexHome(env) {
   const raw = env.CODEX_HOME;
@@ -5213,7 +5279,7 @@ function resolveCodexHomeRootFromEnv(env = process.env, opts = {}) {
   if (raw) {
     return path6.resolve(opts.cwd ?? process.cwd(), raw);
   }
-  return path6.join(opts.defaultHomeDir ?? os3.homedir(), ".codex");
+  return path6.join(opts.defaultHomeDir ?? os2.homedir(), ".codex");
 }
 function hasConfiguredCodexHome(config, baseEnv = process.env) {
   const launchRuntimeFields = config ? runtimeConfigToLaunchFields(config) : null;
@@ -5844,7 +5910,7 @@ function isWindowsSandboxRunner(commandPath) {
   return path7.basename(commandPath).toLowerCase().startsWith("codex-command-runner");
 }
 function resolveWindowsNpmCodexEntry(deps = {}) {
-  const existsSyncFn = deps.existsSyncFn ?? existsSync5;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync4;
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync2;
   const env = deps.env ?? process.env;
   const winPath = path7.win32;
@@ -5866,7 +5932,7 @@ function resolveWindowsNpmCodexEntry(deps = {}) {
   return null;
 }
 function resolveWindowsCodexDesktopEntry(deps = {}) {
-  const existsSyncFn = deps.existsSyncFn ?? existsSync5;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync4;
   const env = deps.env ?? process.env;
   const homeDir = deps.homeDir;
   const winPath = path7.win32;
@@ -6194,7 +6260,7 @@ var CodexDriver = class {
     this.normalizer.reset();
     this.spawnWorkingDirectory = ctx.workingDirectory;
     this.codexHomeRoot = resolveCodexHomeRootFromEnv(spawnEnv, {
-      defaultHomeDir: os4.homedir(),
+      defaultHomeDir: os3.homedir(),
       cwd: ctx.workingDirectory
     });
     const args = ["app-server", "--listen", "stdio://"];
@@ -6618,7 +6684,7 @@ function detectCodexModels(home = resolveCodexHomeRootFromEnv()) {
   let configPath = null;
   for (const root of codexStateRootCandidates(home)) {
     const candidate = path7.join(root, "models_cache.json");
-    if (existsSync5(candidate)) {
+    if (existsSync4(candidate)) {
       cachePath = candidate;
       configPath = path7.join(root, "config.toml");
       break;
@@ -7077,11 +7143,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -7093,7 +7159,7 @@ function runCursorModelsCommand() {
 
 // src/drivers/gemini.ts
 import { execFileSync as execFileSync3, spawn as spawn6 } from "child_process";
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import path8 from "path";
 async function buildGeminiSpawnEnv(ctx, platform = process.platform) {
   const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" }, platform);
@@ -7136,8 +7202,8 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
     return { command: resolveCommandOnPath("gemini", deps) ?? "gemini", args: commandArgs };
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
-  const existsSyncFn = deps.existsSyncFn ?? existsSync6;
-  const env = deps.env ?? process.env;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync5;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -7274,12 +7340,15 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import os5 from "os";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import os4 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -7288,6 +7357,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os4.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -7311,7 +7447,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -7325,7 +7479,7 @@ var KimiDriver = class {
     this.promptRequestId = randomUUID2();
     const systemPromptPath = path9.join(ctx.workingDirectory, KIMI_SYSTEM_PROMPT_FILE);
     const agentFilePath = path9.join(ctx.workingDirectory, KIMI_AGENT_FILE);
-    if (!isResume || !existsSync7(systemPromptPath)) {
+    if (!isResume || !existsSync6(systemPromptPath)) {
       writeFileSync3(systemPromptPath, ctx.prompt, "utf8");
     }
     writeFileSync3(agentFilePath, [
@@ -7335,21 +7489,23 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -7357,7 +7513,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -7470,14 +7626,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os5.homedir()) {
-  const configPath = path9.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os4.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -7499,7 +7650,7 @@ function detectKimiModels(home = os5.homedir()) {
 // src/drivers/kimi-sdk.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync4 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "fs";
 import path10 from "path";
 import { createRequire as createRequire2 } from "module";
 import {
@@ -7648,12 +7799,12 @@ var KIMI_SDK_RUNTIME_SESSION_DESCRIPTOR = {
 };
 async function createKimiAgentSessionForContext(ctx, sessionId) {
   const sessionDir = buildKimiSessionDir(ctx.workingDirectory);
-  mkdirSync3(sessionDir, { recursive: true });
+  mkdirSync2(sessionDir, { recursive: true });
   const cliTransport = await prepareCliTransport(ctx, { NO_COLOR: "1" });
   const spawnEnv = cliTransport.spawnEnv;
   const wrapperPath = cliTransport.wrapperPath;
   const homeDir = spawnEnv.KIMI_HOME || (process.env.HOME ? path10.join(process.env.HOME, ".kimi") : path10.join(ctx.workingDirectory, ".kimi"));
-  mkdirSync3(homeDir, { recursive: true });
+  mkdirSync2(homeDir, { recursive: true });
   const harness = createKimiHarness({
     homeDir,
     identity: {
@@ -7984,8 +8135,8 @@ var KimiSdkDriver = class {
 
 // src/drivers/opencode.ts
 import { spawn as spawn8, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
-import os6 from "os";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import os5 from "os";
 import path11 from "path";
 var SLOCK_AGENT_NAME = "slock";
 var NO_MESSAGE_PROMPT = "No new messages are pending. Stop now.";
@@ -8014,7 +8165,7 @@ function parseUserOpenCodeConfig(ctx) {
   const raw = runtimeConfigToLaunchFields(ctx.config).envVars?.OPENCODE_CONFIG_CONTENT;
   return parseOpenCodeConfigContent(raw);
 }
-function readLocalOpenCodeConfig(home = os6.homedir()) {
+function readLocalOpenCodeConfig(home = os5.homedir()) {
   const configPath = path11.join(home, ".config", "opencode", "opencode.json");
   try {
     return parseOpenCodeConfigContent(readFileSync5(configPath, "utf8"));
@@ -8075,7 +8226,7 @@ function mergeOpenCodeConfigs(localConfig, envConfig) {
     }
   };
 }
-function buildOpenCodeConfig(ctx, home = os6.homedir()) {
+function buildOpenCodeConfig(ctx, home = os5.homedir()) {
   const userConfig = mergeOpenCodeConfigs(readLocalOpenCodeConfig(home), parseUserOpenCodeConfig(ctx));
   const userAgents = recordField(userConfig.agent);
   const userSlockAgent = recordField(userAgents[SLOCK_AGENT_NAME]);
@@ -8093,7 +8244,7 @@ function buildOpenCodeConfig(ctx, home = os6.homedir()) {
     mcp: recordField(userConfig.mcp)
   };
 }
-async function buildOpenCodeLaunchOptions(ctx, home = os6.homedir(), version = null) {
+async function buildOpenCodeLaunchOptions(ctx, home = os5.homedir(), version = null) {
   const slock = await prepareCliTransport(ctx, { NO_COLOR: "1" });
   const config = buildOpenCodeConfig(ctx, home);
   const env = {
@@ -8192,7 +8343,7 @@ function formatOpenCodeLabelToken(token) {
   if (/^\d/.test(token)) return token;
   return normalized.charAt(0).toUpperCase() + normalized.slice(1);
 }
-function detectOpenCodeModels(home = os6.homedir(), runCommand = runOpenCodeModelsCommand) {
+function detectOpenCodeModels(home = os5.homedir(), runCommand = runOpenCodeModelsCommand) {
   const commandResult = runCommand(home);
   if (commandResult.error || commandResult.status !== 0) return null;
   return parseOpenCodeModelsOutput(commandResult.stdout);
@@ -8201,7 +8352,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -8232,7 +8383,7 @@ function openCodeSpecForEntry(entry, commandArgs) {
   return { command: process.execPath, args: [entry, ...commandArgs], shell: false };
 }
 function resolveWindowsOpenCodePackageEntry(commandPath, deps = {}) {
-  const existsSyncFn = deps.existsSyncFn ?? existsSync8;
+  const existsSyncFn = deps.existsSyncFn ?? existsSync7;
   const execFileSyncFn = deps.execFileSyncFn;
   const env = deps.env ?? process.env;
   const winPath = path11.win32;
@@ -8393,7 +8544,7 @@ var OpenCodeDriver = class {
     if (unsupportedMessage) {
       throw new Error(unsupportedMessage);
     }
-    const launch = await buildOpenCodeLaunchOptions(ctx, os6.homedir(), version);
+    const launch = await buildOpenCodeLaunchOptions(ctx, os5.homedir(), version);
     const spawnSpec = resolveOpenCodeSpawn(launch.args);
     const proc = spawn8(spawnSpec.command, spawnSpec.args, {
       cwd: ctx.workingDirectory,
@@ -8460,7 +8611,7 @@ var OpenCodeDriver = class {
 // src/drivers/pi.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
-import { mkdirSync as mkdirSync4, readdirSync as readdirSync2 } from "fs";
+import { mkdirSync as mkdirSync3, readdirSync as readdirSync3 } from "fs";
 import path12 from "path";
 import {
   AuthStorage,
@@ -8504,7 +8655,7 @@ function resolvePiModelFromRegistry(modelId, modelRegistry) {
 function findPiSessionFile(sessionDir, sessionId) {
   let entries;
   try {
-    entries = readdirSync2(sessionDir);
+    entries = readdirSync3(sessionDir);
   } catch {
     return null;
   }
@@ -8728,7 +8879,7 @@ var PI_IDLE_PROMPT_RETRY_MS = 25;
 var PI_IDLE_PROMPT_MAX_WAIT_MS = 1e3;
 async function createPiAgentSessionForContext(ctx, sessionId) {
   const sessionDir = buildPiSessionDir(ctx.workingDirectory);
-  mkdirSync4(sessionDir, { recursive: true });
+  mkdirSync3(sessionDir, { recursive: true });
   const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
   const requestedModel = launchRuntimeFields.model || "default";
   const traceSpan = ctx.tracer?.startSpan("daemon.pi.session.create", {
@@ -9958,7 +10109,7 @@ function findSessionJsonl(root, predicate) {
     if (depth < 0 || visited >= maxEntries) return null;
     let entries;
     try {
-      entries = readdirSync3(dir, { withFileTypes: true }).sort((a, b) => b.name.localeCompare(a.name));
+      entries = readdirSync4(dir, { withFileTypes: true }).sort((a, b) => b.name.localeCompare(a.name));
     } catch {
       return null;
     }
@@ -9985,7 +10136,7 @@ function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
       if (!line.trim()) continue;
       try {
         const entry = JSON.parse(line);
-        if (entry.sessionId === sessionId && entry.sessionDir && existsSync9(entry.sessionDir)) {
+        if (entry.sessionId === sessionId && entry.sessionDir && existsSync8(entry.sessionDir)) {
           return entry.sessionDir;
         }
       } catch {
@@ -9996,10 +10147,10 @@ function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
   const sessionsRoot = path14.join(homeDir, ".kimi", "sessions");
   try {
     const prefix = agentId ? `wd_${agentId}_` : `wd_`;
-    for (const entry of readdirSync3(sessionsRoot, { withFileTypes: true })) {
+    for (const entry of readdirSync4(sessionsRoot, { withFileTypes: true })) {
       if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
       const candidate = path14.join(sessionsRoot, entry.name, `session_${sessionId}`);
-      if (existsSync9(candidate)) return candidate;
+      if (existsSync8(candidate)) return candidate;
     }
   } catch {
   }
@@ -10009,7 +10160,7 @@ function findPiSessionFile2(sessionId, workingDirectory, homeDir) {
   if (workingDirectory) {
     const piSessionsDir = path14.join(workingDirectory, ".pi-sessions");
     try {
-      const files = readdirSync3(piSessionsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => ({ name: e.name, path: path14.join(piSessionsDir, e.name), stat: statSync(path14.join(piSessionsDir, e.name)) })).filter((f) => f.stat.isFile() && f.name.includes(sessionId)).sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
+      const files = readdirSync4(piSessionsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => ({ name: e.name, path: path14.join(piSessionsDir, e.name), stat: statSync(path14.join(piSessionsDir, e.name)) })).filter((f) => f.stat.isFile() && f.name.includes(sessionId)).sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
       if (files[0]) return files[0].path;
     } catch {
     }
@@ -10031,7 +10182,7 @@ function safeSessionFilename(value) {
 function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   try {
     const dir = path14.join(fallbackDir, ".slock", "runtime-sessions");
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
     const filePath = path14.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
     writeFileSync4(filePath, JSON.stringify({
       type: "runtime_session_handoff",
@@ -10052,28 +10203,22 @@ function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   }
 }
 function resolveRuntimeHomeDir(config, defaultHomeDir, workspacePath, opts = {}) {
-  if (isClaudeCustomProviderConfig(config)) {
-    return getClaudeProviderStatePaths(workspacePath).home;
-  }
   if (config.runtime === "codex") {
     return resolveCodexHomeRootFromConfig(config, defaultHomeDir, workspacePath, process.env, opts);
   }
   return defaultHomeDir;
 }
 function ensureRuntimeHomeDir(config, defaultHomeDir, workspacePath, opts = {}) {
-  if (isClaudeCustomProviderConfig(config)) {
-    return ensureClaudeProviderStatePaths(workspacePath).home;
-  }
   if (config.runtime === "codex") {
     const home = resolveCodexHomeRootFromConfig(config, defaultHomeDir, workspacePath, process.env, opts);
     if (opts.agentId) {
-      mkdirSync5(home, { recursive: true });
+      mkdirSync4(home, { recursive: true });
     }
     return home;
   }
   return defaultHomeDir;
 }
-function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os7.homedir(), fallbackDir, opts) {
+function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os6.homedir(), fallbackDir, opts) {
   let resolvedPath = null;
   let lookupMethod = "none";
   if (runtime === "claude") {
@@ -11198,7 +11343,7 @@ var AgentProcessManager = class _AgentProcessManager {
     this.serverUrl = opts.serverUrl;
     this.slockHome = opts.slockHome ? path14.resolve(opts.slockHome) : resolveSlockHome();
     this.dataDir = opts.dataDir || resolveSlockHomePath("agents", this.slockHome);
-    this.runtimeSessionHomeDir = opts.runtimeSessionHomeDir || os7.homedir();
+    this.runtimeSessionHomeDir = opts.runtimeSessionHomeDir || os6.homedir();
     this.driverResolver = opts.driverResolver || getDriver;
     this.defaultAgentEnvVarsProvider = opts.defaultAgentEnvVarsProvider || null;
     this.tracer = opts.tracer ?? noopTracer;
@@ -11890,7 +12035,25 @@ var AgentProcessManager = class _AgentProcessManager {
       queue_depth: this.agentStartQueue.length,
       active_starts: this.activeAgentStartCount,
       max_concurrent_starts: this.maxConcurrentAgentStarts,
-      min_start_interval_ms: this.agentStartIntervalMs
+      min_start_interval_ms: this.agentStartIntervalMs,
+      ...this.runtimeLaunchPolicyTraceAttrs(config)
+    };
+  }
+  runtimeLaunchPolicyTraceAttrs(config) {
+    if (config.runtime !== "claude") return {};
+    const customProvider = isClaudeCustomProviderConfig(config);
+    if (!customProvider) {
+      return {
+        claude_custom_provider: false
+      };
+    }
+    return {
+      claude_custom_provider: true,
+      claude_custom_provider_settings_sources_policy: "project,local",
+      claude_custom_provider_inherited_provider_scrub: true,
+      claude_custom_provider_host_managed_flag: false,
+      claude_custom_provider_home_override: false,
+      claude_custom_provider_config_dir_override: false
     };
   }
   getDeliveryTraceContext(message) {
@@ -14136,7 +14299,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     const config = agent?.config ?? idle?.config ?? null;
     const runtime = runtimeHint || config?.runtime || "claude";
     const workspaceDir = path14.join(this.dataDir, agentId);
-    const hostHome = os7.homedir();
+    const hostHome = os6.homedir();
     const home = agent?.runtime.currentRuntimeHomeDir || (config ? ensureRuntimeHomeDir(config, hostHome, workspaceDir, { agentId, slockHome: this.slockHome }) : runtime === "codex" ? resolveCodexHomeRootFromEnv(process.env, { defaultHomeDir: hostHome, cwd: workspaceDir }) : hostHome);
     const paths = _AgentProcessManager.SKILL_PATHS[runtime] || _AgentProcessManager.SKILL_PATHS.claude;
     const globalDirs = runtime === "codex" ? [
@@ -14591,6 +14754,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
         hasSession: Boolean(ap.sessionId),
         ...this.messagesTraceAttrs(messages),
         ...inputTraceAttrs,
+        ...this.runtimeLaunchPolicyTraceAttrs(ap.config),
         ...this.runtimeProfileTurnControlTraceAttrs(ap.runtimeProfileTurnControl)
       }
     });
@@ -14598,6 +14762,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
       reason,
       ...this.messagesTraceAttrs(messages),
       ...inputTraceAttrs,
+      ...this.runtimeLaunchPolicyTraceAttrs(ap.config),
       ...this.runtimeProfileTurnControlTraceAttrs(ap.runtimeProfileTurnControl)
     });
     ap.runtimeTraceSpan = span;
@@ -16230,8 +16395,8 @@ var ReminderCache = class {
 
 // src/machineLock.ts
 import { createHash as createHash4, randomUUID as randomUUID6 } from "crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
-import os8 from "os";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import os7 from "os";
 import path15 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
 var DaemonMachineLockConflictError = class extends Error {
@@ -16287,14 +16452,14 @@ function acquireDaemonMachineLock(options) {
   const machineDir = path15.join(rootDir, lockId);
   const lockDir = path15.join(machineDir, "daemon.lock");
   const token = randomUUID6();
-  mkdirSync6(machineDir, { recursive: true });
+  mkdirSync5(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      mkdirSync6(lockDir);
+      mkdirSync5(lockDir);
       const owner = {
         pid: process.pid,
         token,
-        hostname: os8.hostname(),
+        hostname: os7.hostname(),
         startedAt: (/* @__PURE__ */ new Date()).toISOString(),
         serverUrl: options.serverUrl,
         apiKeyFingerprint: fingerprint.slice(0, 16)
@@ -16344,8 +16509,8 @@ function acquireDaemonMachineLock(options) {
   throw new DaemonMachineLockConflictError(lockDir, readOwner(lockDir));
 }
 
-// src/localTraceSink.ts
-import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+// ../trace-client/src/localTraceSink.ts
+import { appendFileSync, mkdirSync as mkdirSync6, readdirSync as readdirSync5, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
 import path16 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
@@ -16409,7 +16574,7 @@ var LocalRotatingTraceSink = class {
     return this.currentFile;
   }
   ensureFile(nextBytes) {
-    mkdirSync7(this.traceDir, { recursive: true, mode: 448 });
+    mkdirSync6(this.traceDir, { recursive: true, mode: 448 });
     const nowMs = this.nowMsProvider();
     const shouldRotateForAge = this.currentFileOpenedAtMs !== null && nowMs - this.currentFileOpenedAtMs >= this.maxFileAgeMs;
     if (!this.currentFile || this.currentSize + nextBytes > this.maxFileBytes || shouldRotateForAge) {
@@ -16424,7 +16589,7 @@ var LocalRotatingTraceSink = class {
     }
   }
   pruneOldFiles() {
-    const files = readdirSync4(this.traceDir).filter((name) => name.startsWith("daemon-trace-") && name.endsWith(".jsonl")).sort();
+    const files = readdirSync5(this.traceDir).filter((name) => name.startsWith("daemon-trace-") && name.endsWith(".jsonl")).sort();
     const excess = files.length - this.maxFiles;
     if (excess <= 0) return;
     for (const file of files.slice(0, excess)) {
@@ -16515,13 +16680,7 @@ function isDiagnosticErrorAttr(key) {
   return DIAGNOSTIC_ERROR_ATTRS.has(key);
 }
 
-// src/traceBundleUpload.ts
-import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
-import { gzipSync as gzipSync2 } from "zlib";
-import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
-import path17 from "path";
-
-// src/traceJitter.ts
+// ../trace-client/src/traceJitter.ts
 import { createHash as createHash5 } from "crypto";
 var INITIAL_UPLOAD_DELAY_SPAN_MS = 3e4;
 var UPLOAD_INTERVAL_JITTER_SPAN_MS = 6e4;
@@ -16550,7 +16709,68 @@ function bucketDelayMs(delayMs) {
   return "10m+";
 }
 
+// ../trace-client/src/traceClient.ts
+var MultiSink = class {
+  sinks;
+  onSinkError;
+  constructor(sinks, onSinkError) {
+    this.sinks = sinks;
+    this.onSinkError = onSinkError;
+  }
+  record(span) {
+    for (const sink of this.sinks) {
+      try {
+        sink.record(span);
+      } catch (err) {
+        this.onSinkError?.(sink, err);
+      }
+    }
+  }
+};
+var SourceForcingActiveSpan = class {
+  context;
+  inner;
+  constructor(inner) {
+    this.inner = inner;
+    this.context = inner.context;
+  }
+  addEvent(name, attrs) {
+    this.inner.addEvent(name, attrs);
+  }
+  end(status, options) {
+    if (!options?.attrs) {
+      this.inner.end(status, options);
+      return;
+    }
+    const { source: _stripped, ...rest } = options.attrs;
+    this.inner.end(status, { ...options, attrs: rest });
+  }
+};
+var SourceForcingTracer = class {
+  inner;
+  source;
+  constructor(inner, source) {
+    this.inner = inner;
+    this.source = source;
+  }
+  startSpan(name, options) {
+    const callerAttrs = options.attrs ?? {};
+    const attrs = { ...callerAttrs, source: this.source };
+    const innerSpan = this.inner.startSpan(name, { ...options, attrs });
+    return new SourceForcingActiveSpan(innerSpan);
+  }
+};
+function createTraceClient(options) {
+  const sink = new MultiSink(options.sinks);
+  const baseTracer = new BasicTracer({ sink });
+  return new SourceForcingTracer(baseTracer, options.source);
+}
+
 // src/traceBundleUpload.ts
+import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
+import { gzipSync as gzipSync2 } from "zlib";
+import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
+import path17 from "path";
 var TRACE_UPLOAD_SCOPE = "daemon-trace-bundle:create";
 var DEFAULT_UPLOAD_INTERVAL_MS = 5 * 60 * 1e3;
 var DEFAULT_MIN_FILE_AGE_MS = 60 * 1e3;
@@ -16814,7 +17034,7 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     spanAttrs: ["agentId", "event_kind", "runtime"]
   }
 };
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -16850,9 +17070,9 @@ function runnerCredentialErrorDetail2(error) {
 async function waitForRunnerCredentialRetry2() {
   await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
 }
-function parseDaemonCliArgs(args) {
+function parseDaemonCliArgs(args, env = {}) {
   let serverUrl = "";
-  let apiKey = "";
+  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -16889,7 +17109,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-5BEASCX5.js");
+  await import("./dist-4KV4FRQE.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -17117,8 +17337,9 @@ var DaemonCore = class {
       maxFileAgeJitterMs: jitter.maxFileAgeJitterMs,
       maxFiles: this.options.localTraceMaxFiles ?? readPositiveIntegerEnv3("SLOCK_DAEMON_TRACE_MAX_FILES", 8)
     });
-    this.tracer = this.withDaemonTraceScope(new BasicTracer({
-      sink: this.localTraceSink
+    this.tracer = this.withDaemonTraceScope(createTraceClient({
+      source: "daemon",
+      sinks: [this.localTraceSink]
     }));
     this.agentManager.setTracer(this.tracer);
     this.agentManager.setCliTransportTraceDir(path18.join(machineDir, "traces"));
@@ -17694,8 +17915,8 @@ var DaemonCore = class {
       capabilities: ["agent:start", "agent:stop", "agent:deliver", "workspace:files"],
       runtimes,
       runningAgents: runningAgentIds,
-      hostname: this.options.hostname ?? os9.hostname(),
-      os: this.options.osDescription ?? `${os9.platform()} ${os9.arch()}`,
+      hostname: this.options.hostname ?? os8.hostname(),
+      os: this.options.osDescription ?? `${os8.platform()} ${os8.arch()}`,
       daemonVersion: this.daemonVersion,
       ...this.computerVersion ? { computerVersion: this.computerVersion } : {}
     });
@@ -17776,6 +17997,8 @@ var DaemonCore = class {
 
 export {
   subscribeDaemonLogs,
+  DAEMON_API_KEY_ENV,
+  scrubDaemonAuthEnv,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,

package/dist/cli/index.js

@@ -18337,6 +18337,7 @@ function formatHeldSendOutput(target, data) {
   ${MESSAGE_HEREDOC_DELIMITER}
 To send the current draft unchanged:
   raft message send --send-draft --target "${target}"
+You can also choose not to send anything.
 `,
     continueAnywayInstruction: `If repeated updates keep blocking the same draft and this is still the right reply, you may use:
   raft message send --send-draft --anyway --target "${target}"

package/dist/core.js

@@ -1,4 +1,5 @@
 import {
+  DAEMON_API_KEY_ENV,
   DAEMON_CLI_USAGE,
   DaemonCore,
   deleteWorkspaceDirectory,
@@ -10,9 +11,11 @@ import {
   resolveWorkspaceDirectoryPath,
   runBundledSlockCli,
   scanWorkspaceDirectories,
+  scrubDaemonAuthEnv,
   subscribeDaemonLogs
-} from "./chunk-RENPNQK3.js";
+} from "./chunk-COT7JNSQ.js";
 export {
+  DAEMON_API_KEY_ENV,
   DAEMON_CLI_USAGE,
   DaemonCore,
   deleteWorkspaceDirectory,
@@ -24,5 +27,6 @@ export {
   resolveWorkspaceDirectoryPath,
   runBundledSlockCli,
   scanWorkspaceDirectories,
+  scrubDaemonAuthEnv,
   subscribeDaemonLogs
 };

package/dist/{dist-5BEASCX5.js → dist-4KV4FRQE.js}

@@ -18099,6 +18099,7 @@ function formatHeldSendOutput(target, data) {
   ${MESSAGE_HEREDOC_DELIMITER}
 To send the current draft unchanged:
   raft message send --send-draft --target "${target}"
+You can also choose not to send anything.
 `,
     continueAnywayInstruction: `If repeated updates keep blocking the same draft and this is still the right reply, you may use:
   raft message send --send-draft --anyway --target "${target}"

package/dist/index.js

@@ -2,11 +2,13 @@
 import {
   DAEMON_CLI_USAGE,
   DaemonCore,
-  parseDaemonCliArgs
-} from "./chunk-RENPNQK3.js";
+  parseDaemonCliArgs,
+  scrubDaemonAuthEnv
+} from "./chunk-COT7JNSQ.js";
 
 // src/index.ts
-var parsedArgs = parseDaemonCliArgs(process.argv.slice(2));
+var parsedArgs = parseDaemonCliArgs(process.argv.slice(2), process.env);
+scrubDaemonAuthEnv(process.env);
 if (!parsedArgs) {
   console.error(DAEMON_CLI_USAGE);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/raft-daemon",
-  "version": "0.63.1",
+  "version": "0.63.2-play.20260620140456",
   "type": "module",
   "bin": {
     "raft-daemon": "dist/raft-daemon.js",
@@ -59,6 +59,7 @@
   "devDependencies": {
     "@botiverse/raft": "workspace:*",
     "@slock-ai/shared": "workspace:*",
+    "@slock-ai/trace-client": "workspace:*",
     "@types/node": "^25.5.0",
     "@types/ws": "^8.18.1",
     "tsup": "^8.5.1",