@botiverse/raft-daemon 0.65.0 → 0.66.0

package/dist/cli/index.js

@@ -998,7 +998,7 @@ var require_command = __commonJS({
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
     var path9 = __require("path");
-    var fs6 = __require("fs");
+    var fs7 = __require("fs");
     var process3 = __require("process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1931,10 +1931,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
           const localBin = path9.resolve(baseDir, baseName);
-          if (fs6.existsSync(localBin)) return localBin;
+          if (fs7.existsSync(localBin)) return localBin;
           if (sourceExt.includes(path9.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs6.existsSync(`${localBin}${ext}`)
+            (ext) => fs7.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1946,7 +1946,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs6.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs7.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
@@ -15542,7 +15542,7 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path9) {
+    function safeUrl2(path9) {
       if (typeof path9 !== "string") {
         return path9;
       }
@@ -15578,10 +15578,10 @@ var require_mock_utils = __commonJS({
     }
     function getMockDispatch(mockDispatches, key) {
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
-      const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
+      const resolvedPath = typeof basePath === "string" ? safeUrl2(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
       let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path9, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path9)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path9), resolvedPath);
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl2(path9)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl2(path9), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -42798,6 +42798,21 @@ var agentApiHistoryQuerySchema = passthroughObject({
   around: optionalStringSchema,
   limit: optionalStringSchema
 });
+var agentApiKnowledgeGetQuerySchema = passthroughObject({
+  topic: external_exports.string().trim().min(1),
+  reason: optionalStringSchema,
+  turn_id: optionalStringSchema,
+  trace_id: optionalStringSchema
+});
+var agentApiKnowledgeGetResponseSchema = passthroughObject({
+  ok: external_exports.literal(true),
+  docId: external_exports.string(),
+  topicOrPath: external_exports.string(),
+  docVersion: external_exports.string(),
+  docState: external_exports.string(),
+  contentType: external_exports.string(),
+  content: external_exports.string()
+});
 var agentApiMessageSearchQuerySchema = passthroughObject({
   q: optionalStringSchema,
   channel: optionalStringSchema,
@@ -42835,6 +42850,58 @@ var agentApiMessageReactionBodySchema = passthroughObject({
 var agentApiChannelMembershipParamsSchema = passthroughObject({
   channelId: external_exports.string().trim().min(1).transform(asChannelId)
 });
+var agentApiAttachmentDownloadParamsSchema = passthroughObject({
+  attachmentId: external_exports.string().trim().min(1)
+});
+var agentApiAttachmentCommentsParamsSchema = passthroughObject({
+  attachmentId: external_exports.string().trim().min(1)
+});
+var agentApiAttachmentCommentsQuerySchema = passthroughObject({
+  limit: optionalStringSchema
+});
+var agentApiAttachmentCommentAnchorSchema = passthroughObject({
+  type: external_exports.string().trim().min(1),
+  data: external_exports.record(external_exports.string(), external_exports.unknown())
+});
+var agentApiAttachmentCommentReactionSchema = passthroughObject({
+  emoji: external_exports.string().trim().min(1),
+  reactorType: external_exports.string().trim().min(1),
+  reactorId: external_exports.string().trim().min(1),
+  createdAt: external_exports.string().datetime()
+});
+var agentApiAttachmentCommentResolvedBySchema = passthroughObject({
+  reactorId: external_exports.string().trim().min(1),
+  reactorType: external_exports.string().trim().min(1)
+});
+var agentApiAttachmentCommentSchema = passthroughObject({
+  id: external_exports.string().trim().min(1),
+  channelId: external_exports.string().trim().min(1).optional(),
+  senderId: external_exports.string().trim().min(1),
+  senderType: external_exports.enum(["user", "agent"]),
+  senderName: external_exports.string().trim().min(1),
+  senderAvatarUrl: nullableStringSchema.optional(),
+  senderGravatarHash: nullableStringSchema.optional(),
+  content: external_exports.string(),
+  createdAt: external_exports.string().datetime(),
+  reactions: external_exports.array(agentApiAttachmentCommentReactionSchema),
+  anchor: agentApiAttachmentCommentAnchorSchema.nullable(),
+  resolved: external_exports.boolean().optional(),
+  resolvedBy: agentApiAttachmentCommentResolvedBySchema.nullable().optional(),
+  resolvedAt: external_exports.string().datetime().nullable().optional()
+});
+var agentApiAttachmentCommentsResponseSchema = passthroughObject({
+  comments: external_exports.array(agentApiAttachmentCommentSchema),
+  threadChannelId: nullableStringSchema.optional(),
+  viewer: passthroughObject({
+    canComment: external_exports.boolean(),
+    reason: external_exports.string().optional(),
+    canResolve: external_exports.boolean(),
+    resolveAction: passthroughObject({
+      type: external_exports.string().trim().min(1),
+      emoji: external_exports.string().trim().min(1)
+    }).optional()
+  }).optional()
+});
 var agentApiChannelMembersQuerySchema = passthroughObject({
   channel: external_exports.string().trim().min(1)
 });
@@ -42989,6 +43056,9 @@ var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
   unsafeDemoUrlOverride: optionalBooleanSchema,
   draftHint: optionalStringSchema
 });
+var agentApiIntegrationAppRotateSecretBodySchema = passthroughObject({
+  clientKey: external_exports.string().trim().min(1)
+});
 var agentApiActionPrepareBodySchema = passthroughObject({
   target: external_exports.string().trim().min(1),
   action: actionCardActionSchema
@@ -42996,6 +43066,9 @@ var agentApiActionPrepareBodySchema = passthroughObject({
 var agentApiServerInfoResponseSchema = passthroughObject({
   runtimeContext: passthroughObject({
     agentId: external_exports.string(),
+    runtime: external_exports.string().optional(),
+    model: external_exports.string().optional(),
+    reasoningEffort: reasoningEffortSchema.nullable().optional(),
     serverId: external_exports.string(),
     machineId: external_exports.string().nullable().optional(),
     machineName: external_exports.string().nullable().optional(),
@@ -43012,10 +43085,12 @@ var agentApiServerInfoResponseSchema = passthroughObject({
     joined: external_exports.boolean()
   })),
   agents: external_exports.array(passthroughObject({
-    name: external_exports.string()
+    name: external_exports.string(),
+    role: external_exports.enum(["owner", "admin", "member"]).nullable().optional()
   })),
   humans: external_exports.array(passthroughObject({
-    name: external_exports.string()
+    name: external_exports.string(),
+    role: external_exports.enum(["owner", "admin", "member"]).nullable().optional()
   }))
 });
 var agentApiMentionActionsPendingQuerySchema = passthroughObject({
@@ -43090,6 +43165,12 @@ var agentApiIntegrationAppPrepareResponseSchema = passthroughObject({
     integrationUpdateAppRegistrationOperationSchema
   ])
 });
+var agentApiIntegrationAppRotateSecretResponseSchema = passthroughObject({
+  clientId: external_exports.string(),
+  clientKey: external_exports.string(),
+  clientName: external_exports.string(),
+  clientSecret: external_exports.string()
+});
 var agentApiAttachmentEnvelopeSchema = passthroughObject({
   id: external_exports.string(),
   filename: external_exports.string()
@@ -43225,6 +43306,21 @@ var agentApiChannelMembersResponseSchema = passthroughObject({
     role: optionalStringSchema
   }))
 });
+var agentApiChannelMuteResponseSchema = passthroughObject({
+  activityMuted: optionalBooleanSchema,
+  muteFromSeq: nullableNumberSchema.optional(),
+  attention: passthroughObject({
+    state: optionalStringSchema,
+    ordinaryActivity: optionalStringSchema,
+    unmuteCommand: optionalStringSchema,
+    unmuteApi: optionalStringSchema,
+    muteCommand: optionalStringSchema,
+    muteApi: optionalStringSchema,
+    stillArrives: optionalStringArraySchema,
+    threadBoundary: optionalStringSchema,
+    catchUp: optionalStringSchema
+  }).optional()
+});
 var agentApiTaskClaimResultSchema = passthroughObject({
   taskNumber: external_exports.number().int().positive().optional(),
   messageId: optionalStringSchema,
@@ -43337,6 +43433,16 @@ var agentApiContract = {
     request: { query: agentApiHistoryQuerySchema },
     response: { body: agentApiHistoryResponseSchema }
   }),
+  knowledgeGet: route({
+    key: "knowledgeGet",
+    method: "GET",
+    path: "/knowledge",
+    client: { resource: "knowledge", method: "get" },
+    capability: "knowledge",
+    description: "Fetch a Slock Manual for Agents topic from the current server.",
+    request: { query: agentApiKnowledgeGetQuerySchema },
+    response: { body: agentApiKnowledgeGetResponseSchema }
+  }),
   messageSend: route({
     key: "messageSend",
     method: "POST",
@@ -43407,6 +43513,26 @@ var agentApiContract = {
     request: { params: agentApiChannelMembershipParamsSchema },
     response: { body: agentApiOkResponseSchema }
   }),
+  channelMute: route({
+    key: "channelMute",
+    method: "POST",
+    path: "/channels/:channelId/mute",
+    client: { resource: "channels", method: "mute" },
+    capability: "channels",
+    description: "Mute ordinary activity delivery for a visible regular channel as the bound agent credential.",
+    request: { params: agentApiChannelMembershipParamsSchema },
+    response: { body: agentApiChannelMuteResponseSchema }
+  }),
+  channelUnmute: route({
+    key: "channelUnmute",
+    method: "POST",
+    path: "/channels/:channelId/unmute",
+    client: { resource: "channels", method: "unmute" },
+    capability: "channels",
+    description: "Unmute ordinary activity delivery for a visible regular channel as the bound agent credential.",
+    request: { params: agentApiChannelMembershipParamsSchema },
+    response: { body: agentApiChannelMuteResponseSchema }
+  }),
   channelMembers: route({
     key: "channelMembers",
     method: "GET",
@@ -43597,6 +43723,16 @@ var agentApiContract = {
     request: { body: agentApiProfileUpdateBodySchema },
     response: { body: agentApiProfileViewSchema }
   }),
+  profileAvatarUpdate: route({
+    key: "profileAvatarUpdate",
+    method: "POST",
+    path: "/profile/avatar",
+    client: { resource: "profile", method: "updateAvatar" },
+    capability: "server",
+    description: "Update the bound agent profile avatar using multipart form data.",
+    request: {},
+    response: { body: agentApiProfileViewSchema }
+  }),
   integrationList: route({
     key: "integrationList",
     method: "GET",
@@ -43627,6 +43763,22 @@ var agentApiContract = {
     request: { body: agentApiIntegrationAppPrepareBodySchema },
     response: { body: agentApiIntegrationAppPrepareResponseSchema }
   }),
+  integrationAppRotateSecret: route({
+    key: "integrationAppRotateSecret",
+    method: "POST",
+    path: "/integrations/app/rotate-secret",
+    client: { resource: "integrations", method: "rotateAppSecret" },
+    // Mirrors integrationAppPrepare's "read" capability: the AgentApiCapability
+    // enum has no generic "mutation"/"integrations" scope, and the sibling
+    // integration app routes (prepare/login) all gate on "read". Owner-scope is
+    // enforced server-side in rotateClientSecretForAgent's WHERE clause (and the
+    // bound agent credential), so the capability tier is not the security
+    // boundary here. Keep parity with integrationAppPrepare.
+    capability: "read",
+    description: "Regenerate the one-time client secret for a server-local integration app the calling agent owns; invalidates the previous secret.",
+    request: { body: agentApiIntegrationAppRotateSecretBodySchema },
+    response: { body: agentApiIntegrationAppRotateSecretResponseSchema }
+  }),
   actionPrepare: route({
     key: "actionPrepare",
     method: "POST",
@@ -43646,13 +43798,43 @@ var agentApiContract = {
     description: "Upload a multipart attachment as the bound agent credential.",
     request: {},
     response: { body: agentApiAttachmentUploadResponseSchema }
+  }),
+  attachmentDownload: route({
+    key: "attachmentDownload",
+    method: "GET",
+    path: "/attachments/:attachmentId",
+    client: { resource: "attachments", method: "download" },
+    capability: "read",
+    description: "Download attachment bytes visible to the bound agent credential.",
+    request: { params: agentApiAttachmentDownloadParamsSchema },
+    response: { kind: "binary" }
+  }),
+  attachmentCommentsList: route({
+    key: "attachmentCommentsList",
+    method: "GET",
+    path: "/attachments/:attachmentId/comments",
+    client: { resource: "attachments", method: "comments" },
+    capability: "read",
+    description: "List comments scoped to an attachment visible to the bound agent credential.",
+    request: { params: agentApiAttachmentCommentsParamsSchema, query: agentApiAttachmentCommentsQuerySchema },
+    response: { body: agentApiAttachmentCommentsResponseSchema }
   })
 };
-function buildLegacyAgentApiPath(agentId, routePath) {
-  return `/internal/agent/${encodeURIComponent(agentId)}${routePath}`;
+function getAgentApiResponseKind(response) {
+  return "kind" in response ? response.kind ?? "json" : "json";
 }
 function parseAgentApiResponse(key, value) {
-  return agentApiContract[key].response.body.parse(value);
+  const response = agentApiContract[key].response;
+  if (getAgentApiResponseKind(response) === "binary") {
+    if (!(value instanceof Uint8Array)) {
+      throw new TypeError(`Agent API ${key} response did not contain binary bytes`);
+    }
+    return value;
+  }
+  if (!("body" in response)) {
+    throw new TypeError(`Agent API ${key} response contract is missing a JSON body schema`);
+  }
+  return response.body.parse(value);
 }
 
 // ../shared/src/agentApiRawClient.ts
@@ -43667,17 +43849,17 @@ function failure(routeKey, reason, message, details = {}) {
   };
 }
 function encodePathParams(routeKey, params) {
-  const route2 = agentApiContract[routeKey];
+  const route3 = agentApiContract[routeKey];
   let parsed;
   try {
-    parsed = "params" in route2.request ? route2.request.params.parse(params ?? {}) : {};
+    parsed = "params" in route3.request ? route3.request.params.parse(params ?? {}) : {};
   } catch (cause) {
-    return failure(routeKey, "request_contract_mismatch", `Agent API ${route2.key} path params did not match the shared contract`, { cause });
+    return failure(routeKey, "request_contract_mismatch", `Agent API ${route3.key} path params did not match the shared contract`, { cause });
   }
-  return route2.path.replace(/:([A-Za-z][A-Za-z0-9_]*)/g, (_match, key) => {
+  return route3.path.replace(/:([A-Za-z][A-Za-z0-9_]*)/g, (_match, key) => {
     const value = parsed[key];
     if (value === void 0 || value === null) {
-      throw new MissingPathParamError(route2.key, key);
+      throw new MissingPathParamError(route3.key, key);
     }
     return encodeURIComponent(String(value));
   });
@@ -43691,12 +43873,12 @@ var MissingPathParamError = class extends Error {
 };
 function encodeQuery(routeKey, query) {
   if (query === void 0) return void 0;
-  const route2 = agentApiContract[routeKey];
+  const route3 = agentApiContract[routeKey];
   let parsed;
   try {
-    parsed = "query" in route2.request ? route2.request.query.parse(query) : {};
+    parsed = "query" in route3.request ? route3.request.query.parse(query) : {};
   } catch (cause) {
-    return failure(routeKey, "request_contract_mismatch", `Agent API ${route2.key} query did not match the shared contract`, { cause });
+    return failure(routeKey, "request_contract_mismatch", `Agent API ${route3.key} query did not match the shared contract`, { cause });
   }
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(parsed)) {
@@ -43711,11 +43893,11 @@ function encodeQuery(routeKey, query) {
 }
 function parseBody(routeKey, body) {
   if (body === void 0) return void 0;
-  const route2 = agentApiContract[routeKey];
+  const route3 = agentApiContract[routeKey];
   try {
-    return "body" in route2.request ? route2.request.body.parse(body) : void 0;
+    return "body" in route3.request ? route3.request.body.parse(body) : void 0;
   } catch (cause) {
-    return failure(routeKey, "request_contract_mismatch", `Agent API ${route2.key} body did not match the shared contract`, { cause });
+    return failure(routeKey, "request_contract_mismatch", `Agent API ${route3.key} body did not match the shared contract`, { cause });
   }
 }
 function isAgentApiRawFailure(value) {
@@ -43741,7 +43923,7 @@ function buildAgentApiRawRoutePath(routeKey, options = {}) {
   return `${options.pathPrefix ?? AGENT_API_BASE_PATH}${path9}${suffix}`;
 }
 async function requestAgentApiRawRoute(transport, routeKey, options = {}) {
-  const route2 = agentApiContract[routeKey];
+  const route3 = agentApiContract[routeKey];
   const path9 = buildAgentApiRawRoutePath(routeKey, options);
   if (typeof path9 !== "string") return path9;
   const body = parseBody(routeKey, options.body);
@@ -43750,12 +43932,12 @@ async function requestAgentApiRawRoute(transport, routeKey, options = {}) {
   try {
     response = await transport.request({
       routeKey,
-      method: route2.method,
+      method: route3.method,
       path: path9,
       body
     });
   } catch (cause) {
-    return failure(routeKey, "transport_error", `Agent API ${route2.key} transport request failed`, { cause });
+    return failure(routeKey, "transport_error", `Agent API ${route3.key} transport request failed`, { cause });
   }
   if (!response.ok) {
     return failure(routeKey, "http_error", response.error ?? `HTTP ${response.status}`, {
@@ -43765,8 +43947,22 @@ async function requestAgentApiRawRoute(transport, routeKey, options = {}) {
       response: response.data
     });
   }
+  if (getAgentApiResponseKind(route3.response) === "binary") {
+    if (!(response.data instanceof Uint8Array)) {
+      return failure(routeKey, "response_contract_mismatch", `Agent API ${route3.key} response did not contain binary bytes`, {
+        status: response.status,
+        response: response.data
+      });
+    }
+    return {
+      ok: true,
+      routeKey,
+      status: response.status,
+      data: response.data
+    };
+  }
   if (response.data === null) {
-    return failure(routeKey, "empty_response", `Agent API ${route2.key} returned an empty response body`, {
+    return failure(routeKey, "empty_response", `Agent API ${route3.key} returned an empty response body`, {
       status: response.status
     });
   }
@@ -43778,7 +43974,7 @@ async function requestAgentApiRawRoute(transport, routeKey, options = {}) {
       data: parseAgentApiResponse(routeKey, response.data)
     };
   } catch (cause) {
-    return failure(routeKey, "response_contract_mismatch", `Agent API ${route2.key} response did not match the shared contract`, {
+    return failure(routeKey, "response_contract_mismatch", `Agent API ${route3.key} response did not match the shared contract`, {
       status: response.status,
       cause,
       response: response.data
@@ -43786,16 +43982,16 @@ async function requestAgentApiRawRoute(transport, routeKey, options = {}) {
   }
 }
 function requestOptionsFromMethodArgs(routeKey, pathPrefix, args) {
-  const route2 = agentApiContract[routeKey];
+  const route3 = agentApiContract[routeKey];
   let index = 0;
   const requestOptions = { pathPrefix };
-  if ("params" in route2.request) {
+  if ("params" in route3.request) {
     requestOptions.params = args[index++];
   }
-  if ("query" in route2.request) {
+  if ("query" in route3.request) {
     requestOptions.query = args[index++];
   }
-  if ("body" in route2.request) {
+  if ("body" in route3.request) {
     requestOptions.body = args[index++];
   }
   return requestOptions;
@@ -43803,9 +43999,9 @@ function requestOptionsFromMethodArgs(routeKey, pathPrefix, args) {
 function createAgentApiRawClient(transport, options = {}) {
   const pathPrefix = options.pathPrefix ?? AGENT_API_BASE_PATH;
   const client = {};
-  for (const route2 of Object.values(agentApiContract)) {
-    const routeKey = route2.key;
-    const { resource, method } = route2.client;
+  for (const route3 of Object.values(agentApiContract)) {
+    const routeKey = route3.key;
+    const { resource, method } = route3.client;
     const resourceClient = client[resource] ??= {};
     resourceClient[method] = (...args) => requestAgentApiRawRoute(
       transport,
@@ -43828,7 +44024,10 @@ async function authHeadersForRequest(auth, request) {
   if (!auth) return void 0;
   return typeof auth === "function" ? auth(request) : auth;
 }
-async function parseFetchResponse(response) {
+async function parseFetchResponse(response, responseKind) {
+  if (response.ok && responseKind === "binary") {
+    return new Uint8Array(await response.arrayBuffer());
+  }
   const text = await response.text();
   if (!text.trim()) return null;
   try {
@@ -43864,8 +44063,9 @@ function createAgentApiFetchTransport(options) {
     request: async (input) => {
       await options.throttle?.beforeRequest?.(input);
       const authHeaders = await authHeadersForRequest(options.auth, input);
+      const responseKind = getAgentApiResponseKind(agentApiContract[input.routeKey].response);
       const headers = mergeHeaders(
-        { accept: "application/json" },
+        { accept: responseKind === "binary" ? "*/*" : "application/json" },
         input.body === void 0 ? void 0 : { "content-type": "application/json" },
         options.headers,
         authHeaders
@@ -43879,7 +44079,7 @@ function createAgentApiFetchTransport(options) {
       for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
         try {
           const response = await fetchImpl(`${baseUrl}${input.path}`, init);
-          return transportResponseFromFetch(response, await parseFetchResponse(response));
+          return transportResponseFromFetch(response, await parseFetchResponse(response, responseKind));
         } catch (cause) {
           lastError = cause;
           if (attempt === maxAttempts) throw cause;
@@ -43889,33 +44089,33 @@ function createAgentApiFetchTransport(options) {
     }
   };
 }
-function errorFromRawFailure(failure2) {
-  if (failure2.reason === "transport_error") {
+function errorFromRawFailure(failure3) {
+  if (failure3.reason === "transport_error") {
     return {
       kind: "transport",
-      reason: failure2.reason,
-      message: failure2.message,
-      cause: failure2.cause
+      reason: failure3.reason,
+      message: failure3.message,
+      cause: failure3.cause
     };
   }
-  if (failure2.reason === "http_error") {
+  if (failure3.reason === "http_error") {
     return {
       kind: "http",
-      reason: failure2.reason,
-      message: failure2.message,
-      status: failure2.status ?? 0,
-      errorCode: failure2.errorCode,
-      suggestedNextAction: failure2.suggestedNextAction,
-      response: failure2.response
+      reason: failure3.reason,
+      message: failure3.message,
+      status: failure3.status ?? 0,
+      errorCode: failure3.errorCode,
+      suggestedNextAction: failure3.suggestedNextAction,
+      response: failure3.response
     };
   }
   return {
     kind: "validation",
-    reason: failure2.reason,
-    message: failure2.message,
-    status: failure2.status,
-    cause: failure2.cause,
-    response: failure2.response
+    reason: failure3.reason,
+    message: failure3.message,
+    status: failure3.status,
+    cause: failure3.cause,
+    response: failure3.response
   };
 }
 function agentApiClientResultFromRaw(result2) {
@@ -43963,6 +44163,375 @@ function createAgentApiClient(transportOrOptions, maybeOptions = {}) {
   };
 }
 
+// ../shared/src/daemonApiContract.ts
+init_esm_shims();
+var DAEMON_API_BASE_PATH = "/internal/agent-api";
+var optionalStringSchema2 = external_exports.string().trim().optional();
+var optionalNonNegativeIntSchema = external_exports.number().int().nonnegative().optional();
+var optionalQueryIntSchema = external_exports.union([external_exports.number().int().nonnegative(), external_exports.string().trim().min(1)]).optional();
+var nullableNumberSchema2 = external_exports.number().finite().nullable();
+var passthroughObject2 = (shape) => external_exports.object(shape).passthrough();
+var daemonApiInboxFlagSchema = external_exports.enum(["mention", "thread", "dm", "task"]);
+var daemonApiInboxTargetRowSchema = passthroughObject2({
+  target: external_exports.string().trim().min(1),
+  channelId: optionalStringSchema2,
+  channelType: optionalStringSchema2,
+  pendingCount: external_exports.number().int().nonnegative(),
+  firstPendingMsgId: optionalStringSchema2,
+  firstPendingSeq: optionalNonNegativeIntSchema,
+  latestMsgId: optionalStringSchema2,
+  latestSeq: optionalNonNegativeIntSchema,
+  latestSenderName: optionalStringSchema2,
+  latestSenderType: external_exports.enum(["human", "agent", "system"]).optional(),
+  flags: external_exports.array(daemonApiInboxFlagSchema)
+});
+var daemonApiInboxCheckResponseSchema = passthroughObject2({
+  rows: external_exports.array(daemonApiInboxTargetRowSchema).optional()
+});
+var daemonApiWakeHintsQuerySchema = passthroughObject2({
+  since: external_exports.union([external_exports.literal("latest"), external_exports.number().int().nonnegative(), external_exports.string().trim().min(1)]).optional(),
+  limit: optionalQueryIntSchema
+});
+var daemonApiWakeHintSchema = passthroughObject2({
+  hintId: optionalStringSchema2,
+  hint_id: optionalStringSchema2,
+  eventId: optionalStringSchema2,
+  event_id: optionalStringSchema2,
+  messageId: external_exports.string().nullable().optional(),
+  message_id: external_exports.string().nullable().optional(),
+  seq: optionalNonNegativeIntSchema,
+  id: optionalStringSchema2,
+  target: optionalStringSchema2,
+  targetType: optionalStringSchema2,
+  target_type: optionalStringSchema2,
+  reason: optionalStringSchema2,
+  wake_reason: optionalStringSchema2,
+  createdAt: optionalStringSchema2,
+  created_at: optionalStringSchema2
+});
+var daemonApiWakeHintsFetchResponseSchema = passthroughObject2({
+  hints: external_exports.array(daemonApiWakeHintSchema).optional(),
+  wake_hints: external_exports.array(daemonApiWakeHintSchema).optional(),
+  last_seen_hint_seq: nullableNumberSchema2.optional(),
+  last_hint_seq: nullableNumberSchema2.optional(),
+  has_more: external_exports.boolean().optional()
+});
+var daemonApiActivityEventSchema = passthroughObject2({
+  schema: optionalStringSchema2
+});
+var daemonApiActivityForwardBodySchema = passthroughObject2({
+  schema: external_exports.literal("raft-agent-activity-ingest.v1"),
+  coreSessionId: optionalStringSchema2,
+  adapterInstance: optionalStringSchema2,
+  events: external_exports.array(daemonApiActivityEventSchema),
+  dropped: optionalNonNegativeIntSchema
+});
+var daemonApiActivityForwardResponseSchema = passthroughObject2({
+  ok: external_exports.literal(true).optional(),
+  acceptedCount: external_exports.number().int().nonnegative().optional(),
+  rejectedCount: external_exports.number().int().nonnegative().optional(),
+  droppedCount: external_exports.number().int().nonnegative().optional()
+});
+function route2(input) {
+  return {
+    ...input,
+    fullPath: `${DAEMON_API_BASE_PATH}${input.path}`
+  };
+}
+var daemonApiContract = {
+  inboxCheck: route2({
+    key: "inboxCheck",
+    method: "GET",
+    path: "/inbox",
+    client: { resource: "inbox", method: "check" },
+    description: "Read the managed-runner daemon inbox snapshot without draining message content.",
+    request: {},
+    response: { body: daemonApiInboxCheckResponseSchema }
+  }),
+  wakeHintsFetch: route2({
+    key: "wakeHintsFetch",
+    method: "GET",
+    path: "/wake-hints",
+    client: { resource: "wakeHints", method: "fetch" },
+    description: "Peek content-free wake hints without advancing delivery cursors.",
+    request: { query: daemonApiWakeHintsQuerySchema },
+    response: { body: daemonApiWakeHintsFetchResponseSchema }
+  }),
+  activityForward: route2({
+    key: "activityForward",
+    method: "POST",
+    path: "/activity",
+    client: { resource: "activity", method: "forward" },
+    description: "Forward plugin-observed activity from a local bridge to the daemon/server activity ingest path.",
+    request: { body: daemonApiActivityForwardBodySchema },
+    response: { body: daemonApiActivityForwardResponseSchema }
+  })
+};
+function parseDaemonApiResponse(routeKey, data) {
+  return daemonApiContract[routeKey].response.body.parse(data);
+}
+
+// ../shared/src/daemonApiRawClient.ts
+init_esm_shims();
+function failure2(routeKey, reason, message, details = {}) {
+  return {
+    ok: false,
+    ...routeKey ? { routeKey } : {},
+    reason,
+    message,
+    ...details
+  };
+}
+function encodeQuery2(routeKey, query) {
+  if (query === void 0) return void 0;
+  const route3 = daemonApiContract[routeKey];
+  let parsed;
+  try {
+    parsed = "query" in route3.request ? route3.request.query.parse(query) : {};
+  } catch (cause) {
+    return failure2(routeKey, "request_contract_mismatch", `Daemon API ${route3.key} query did not match the shared contract`, { cause });
+  }
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(parsed)) {
+    if (value === void 0 || value === null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) params.append(key, String(item));
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  return params;
+}
+function parseBody2(routeKey, body) {
+  if (body === void 0) return void 0;
+  const route3 = daemonApiContract[routeKey];
+  try {
+    return "body" in route3.request ? route3.request.body.parse(body) : void 0;
+  } catch (cause) {
+    return failure2(routeKey, "request_contract_mismatch", `Daemon API ${route3.key} body did not match the shared contract`, { cause });
+  }
+}
+function isDaemonApiRawFailure(value) {
+  return Boolean(
+    value && typeof value === "object" && value.ok === false && typeof value.reason === "string" && typeof value.message === "string"
+  );
+}
+function buildDaemonApiRawRoutePath(routeKey, options = {}) {
+  const route3 = daemonApiContract[routeKey];
+  const query = encodeQuery2(routeKey, options.query);
+  if (query && !(query instanceof URLSearchParams)) return query;
+  const suffix = query && query.size > 0 ? `?${query.toString()}` : "";
+  return `${options.pathPrefix ?? DAEMON_API_BASE_PATH}${route3.path}${suffix}`;
+}
+async function requestDaemonApiRawRoute(transport, routeKey, options = {}) {
+  const route3 = daemonApiContract[routeKey];
+  const path9 = buildDaemonApiRawRoutePath(routeKey, options);
+  if (typeof path9 !== "string") return path9;
+  const body = parseBody2(routeKey, options.body);
+  if (isDaemonApiRawFailure(body)) return body;
+  let response;
+  try {
+    response = await transport.request({
+      routeKey,
+      method: route3.method,
+      path: path9,
+      body
+    });
+  } catch (cause) {
+    return failure2(routeKey, "transport_error", `Daemon API ${route3.key} transport request failed`, { cause });
+  }
+  if (!response.ok) {
+    return failure2(routeKey, "http_error", response.error ?? `HTTP ${response.status}`, {
+      status: response.status,
+      errorCode: response.errorCode,
+      suggestedNextAction: response.suggestedNextAction,
+      response: response.data
+    });
+  }
+  if (response.data === null) {
+    return failure2(routeKey, "empty_response", `Daemon API ${route3.key} returned an empty response body`, {
+      status: response.status
+    });
+  }
+  try {
+    return {
+      ok: true,
+      routeKey,
+      status: response.status,
+      data: parseDaemonApiResponse(routeKey, response.data)
+    };
+  } catch (cause) {
+    return failure2(routeKey, "response_contract_mismatch", `Daemon API ${route3.key} response did not match the shared contract`, {
+      status: response.status,
+      cause,
+      response: response.data
+    });
+  }
+}
+function requestOptionsFromMethodArgs2(routeKey, pathPrefix, args) {
+  const route3 = daemonApiContract[routeKey];
+  let index = 0;
+  const requestOptions = { pathPrefix };
+  if ("query" in route3.request) {
+    requestOptions.query = args[index++];
+  }
+  if ("body" in route3.request) {
+    requestOptions.body = args[index++];
+  }
+  return requestOptions;
+}
+function createDaemonApiRawClient(transport, options = {}) {
+  const pathPrefix = options.pathPrefix ?? DAEMON_API_BASE_PATH;
+  const client = {};
+  for (const route3 of Object.values(daemonApiContract)) {
+    const routeKey = route3.key;
+    const { resource, method } = route3.client;
+    const resourceClient = client[resource] ??= {};
+    resourceClient[method] = (...args) => requestDaemonApiRawRoute(
+      transport,
+      routeKey,
+      requestOptionsFromMethodArgs2(routeKey, pathPrefix, args)
+    );
+  }
+  return client;
+}
+
+// ../shared/src/daemonApiClient.ts
+init_esm_shims();
+function normalizeBaseUrl2(baseUrl) {
+  return baseUrl.replace(/\/+$/, "");
+}
+function mergeHeaders2(...headers) {
+  return Object.assign({}, ...headers.filter(Boolean));
+}
+async function authHeadersForRequest2(auth, request) {
+  if (!auth) return void 0;
+  return typeof auth === "function" ? auth(request) : auth;
+}
+async function parseFetchResponse2(response) {
+  const text = await response.text();
+  if (!text.trim()) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function transportResponseFromFetch2(response, data) {
+  if (response.ok) {
+    return {
+      ok: true,
+      status: response.status,
+      data,
+      error: null
+    };
+  }
+  const objectData = data && typeof data === "object" ? data : {};
+  return {
+    ok: false,
+    status: response.status,
+    data,
+    error: typeof objectData.error === "string" ? objectData.error : response.statusText || `HTTP ${response.status}`,
+    errorCode: typeof objectData.errorCode === "string" ? objectData.errorCode : null,
+    suggestedNextAction: typeof objectData.suggestedNextAction === "string" ? objectData.suggestedNextAction : null
+  };
+}
+function createDaemonApiFetchTransport(options) {
+  const fetchImpl = options.fetch ?? fetch;
+  const baseUrl = normalizeBaseUrl2(options.baseUrl);
+  return {
+    request: async (input) => {
+      const authHeaders = await authHeadersForRequest2(options.auth, input);
+      const headers = mergeHeaders2(
+        { accept: "application/json" },
+        input.body === void 0 ? void 0 : { "content-type": "application/json" },
+        options.headers,
+        authHeaders
+      );
+      const init = {
+        method: input.method,
+        headers,
+        body: input.body === void 0 ? void 0 : JSON.stringify(input.body)
+      };
+      const response = await fetchImpl(`${baseUrl}${input.path}`, init);
+      return transportResponseFromFetch2(response, await parseFetchResponse2(response));
+    }
+  };
+}
+function errorFromRawFailure2(failure3) {
+  if (failure3.reason === "transport_error") {
+    return {
+      kind: "transport",
+      reason: failure3.reason,
+      message: failure3.message,
+      cause: failure3.cause
+    };
+  }
+  if (failure3.reason === "http_error") {
+    return {
+      kind: "http",
+      reason: failure3.reason,
+      message: failure3.message,
+      status: failure3.status ?? 0,
+      errorCode: failure3.errorCode,
+      suggestedNextAction: failure3.suggestedNextAction,
+      response: failure3.response
+    };
+  }
+  return {
+    kind: "validation",
+    reason: failure3.reason,
+    message: failure3.message,
+    status: failure3.status,
+    cause: failure3.cause,
+    response: failure3.response
+  };
+}
+function daemonApiClientResultFromRaw(result2) {
+  if (result2.ok) {
+    const success2 = result2;
+    return {
+      ok: true,
+      routeKey: success2.routeKey,
+      status: success2.status,
+      data: success2.data
+    };
+  }
+  return {
+    ok: false,
+    routeKey: result2.routeKey,
+    status: result2.status,
+    error: errorFromRawFailure2(result2)
+  };
+}
+function wrapRawClient2(rawClient) {
+  const client = {};
+  for (const [resource, methods] of Object.entries(rawClient)) {
+    client[resource] = {};
+    for (const [method, rawMethod] of Object.entries(methods)) {
+      client[resource][method] = async (...args) => daemonApiClientResultFromRaw(await rawMethod(...args));
+    }
+  }
+  return client;
+}
+function createDaemonApiClient(transportOrOptions, maybeOptions = {}) {
+  const options = "request" in transportOrOptions ? { ...maybeOptions, transport: transportOrOptions } : transportOrOptions;
+  const transport = options.transport ?? (options.fetch ? createDaemonApiFetchTransport(options.fetch) : void 0);
+  if (!transport) {
+    throw new Error("createDaemonApiClient requires either a transport or fetch options");
+  }
+  const pathPrefix = options.pathPrefix ?? DAEMON_API_BASE_PATH;
+  const rawClient = createDaemonApiRawClient(transport, { pathPrefix });
+  const generated = wrapRawClient2(rawClient);
+  return {
+    ...generated,
+    request: async (routeKey, requestOptions = {}) => daemonApiClientResultFromRaw(await requestDaemonApiRawRoute(transport, routeKey, {
+      pathPrefix,
+      ...requestOptions
+    }))
+  };
+}
+
 // ../shared/src/agentInbox.ts
 init_esm_shims();
 function formatAgentInboxSnapshot(rows) {
@@ -44494,66 +45063,84 @@ function buildAgentApiEventsPath(query) {
 }
 function rawTransportForClient(client) {
   return {
-    request: async (input) => client.request(input.method, input.path, input.body)
+    request: async (input) => {
+      const route3 = agentApiContract[input.routeKey];
+      if (getAgentApiResponseKind(route3.response) === "binary") {
+        if (typeof client.requestBinary !== "function") {
+          throw new CliError({
+            code: "VIEW_FAILED",
+            message: "Agent API binary download transport is unavailable in this CLI context"
+          });
+        }
+        const response = await client.requestBinary(input.method, input.path);
+        return {
+          ok: response.ok,
+          status: response.status,
+          data: response.ok ? response.body : null,
+          error: response.error
+        };
+      }
+      return client.request(input.method, input.path, input.body);
+    }
   };
 }
-function cliErrorFromRawFailure(failure2) {
-  switch (failure2.reason) {
+function cliErrorFromRawFailure(failure3) {
+  switch (failure3.reason) {
     case "missing_path_param":
     case "request_contract_mismatch":
       return new CliError({
         code: "INVALID_ARG",
-        message: failure2.message,
-        cause: failure2.cause
+        message: failure3.message,
+        cause: failure3.cause
       });
     case "empty_response":
     case "response_contract_mismatch":
     case "missing_route":
       return new CliError({
         code: "INVALID_JSON_RESPONSE",
-        message: failure2.message,
-        cause: failure2.cause
+        message: failure3.message,
+        cause: failure3.cause
       });
     case "transport_error":
     case "http_error":
       return new CliError({
         code: "CHECK_FAILED",
-        message: failure2.message,
-        cause: failure2.cause
+        message: failure3.message,
+        cause: failure3.cause
       });
   }
 }
-function cliErrorFromClientFailure(failure2) {
-  switch (failure2.error.kind) {
+function cliErrorFromClientFailure(failure3) {
+  switch (failure3.error.kind) {
     case "validation":
-      switch (failure2.error.reason) {
+      switch (failure3.error.reason) {
         case "missing_path_param":
         case "request_contract_mismatch":
           return new CliError({
             code: "INVALID_ARG",
-            message: failure2.error.message,
-            cause: failure2.error.cause
+            message: failure3.error.message,
+            cause: failure3.error.cause
           });
         case "empty_response":
         case "response_contract_mismatch":
         case "missing_route":
           return new CliError({
             code: "INVALID_JSON_RESPONSE",
-            message: failure2.error.message,
-            cause: failure2.error.cause
+            message: failure3.error.message,
+            cause: failure3.error.cause
           });
       }
       break;
     case "transport":
       return new CliError({
         code: "CHECK_FAILED",
-        message: failure2.error.message,
-        cause: failure2.error.cause
+        message: failure3.error.message,
+        cause: failure3.error.cause
       });
     case "http":
       return new CliError({
         code: "CHECK_FAILED",
-        message: failure2.error.message
+        message: failure3.error.message
       });
   }
 }
@@ -44615,38 +45202,20 @@ async function requestMultipartContractAgentApiRoute(client, routeKey, form) {
     });
   }
 }
-function createAgentApiClient2(client, agentId) {
-  const agentApi = createAgentApiClient(rawTransportForClient(client), {
-    pathPrefix: buildLegacyAgentApiPath(agentId, "")
-  });
+function createAgentApiSurfaceClient(client) {
+  const agentApi = createAgentApiClient(rawTransportForClient(client));
   return {
     server: {
       info: () => requestClientAsApiResponse(agentApi.server.info())
     },
+    events: {
+      get: (query) => requestClientAsApiResponse(agentApi.events.get(query))
+    },
     history: {
       read: (query) => requestClientAsApiResponse(agentApi.history.read(query))
     },
-    messages: {
-      send: (body) => requestClientAsApiResponse(agentApi.messages.send(body)),
-      resolve: (params) => requestClientAsApiResponse(agentApi.messages.resolve(params)),
-      addReaction: (params, body) => requestClientAsApiResponse(agentApi.messages.addReaction(params, body)),
-      removeReaction: (params, body) => requestClientAsApiResponse(agentApi.messages.removeReaction(params, body))
-    },
-    channels: {
-      join: (params) => requestClientAsApiResponse(agentApi.channels.join(params)),
-      leave: (params) => requestClientAsApiResponse(agentApi.channels.leave(params))
-    },
-    mentions: {
-      pendingActions: (query) => requestClientAsApiResponse(agentApi.mentions.pendingActions(query ?? {})),
-      executeAction: (body) => requestClientAsApiResponse(agentApi.mentions.executeAction(body))
-    }
-  };
-}
-function createAgentApiSurfaceClient(client) {
-  const agentApi = createAgentApiClient(rawTransportForClient(client));
-  return {
-    events: {
-      get: (query) => requestClientAsApiResponse(agentApi.events.get(query))
+    knowledge: {
+      get: (query) => requestClientAsApiResponse(agentApi.knowledge.get(query))
     },
     tasks: {
       list: (query) => requestClientAsApiResponse(agentApi.tasks.list(query)),
@@ -44664,9 +45233,17 @@ function createAgentApiSurfaceClient(client) {
       log: (params) => requestClientAsApiResponse(agentApi.reminders.log(params))
     },
     messages: {
-      search: (query) => requestClientAsApiResponse(agentApi.messages.search(query))
+      send: (body) => requestClientAsApiResponse(agentApi.messages.send(body)),
+      resolve: (params) => requestClientAsApiResponse(agentApi.messages.resolve(params)),
+      search: (query) => requestClientAsApiResponse(agentApi.messages.search(query)),
+      addReaction: (params, body) => requestClientAsApiResponse(agentApi.messages.addReaction(params, body)),
+      removeReaction: (params, body) => requestClientAsApiResponse(agentApi.messages.removeReaction(params, body))
     },
     channels: {
+      join: (params) => requestClientAsApiResponse(agentApi.channels.join(params)),
+      leave: (params) => requestClientAsApiResponse(agentApi.channels.leave(params)),
+      mute: (params) => requestClientAsApiResponse(agentApi.channels.mute(params)),
+      unmute: (params) => requestClientAsApiResponse(agentApi.channels.unmute(params)),
       members: (query) => requestClientAsApiResponse(agentApi.channels.members(query)),
       resolve: (body) => requestClientAsApiResponse(agentApi.channels.resolve(body))
     },
@@ -44675,18 +45252,27 @@ function createAgentApiSurfaceClient(client) {
     },
     profile: {
       show: (query) => requestClientAsApiResponse(agentApi.profile.show(query)),
-      update: (body) => requestClientAsApiResponse(agentApi.profile.update(body))
+      update: (body) => requestClientAsApiResponse(agentApi.profile.update(body)),
+      updateAvatar: (form) => requestMultipartContractAgentApiRoute(client, "profileAvatarUpdate", form)
     },
     integrations: {
       list: () => requestClientAsApiResponse(agentApi.integrations.list()),
       login: (body) => requestClientAsApiResponse(agentApi.integrations.login(body)),
-      prepareApp: (body) => requestClientAsApiResponse(agentApi.integrations.prepareApp(body))
+      prepareApp: (body) => requestClientAsApiResponse(agentApi.integrations.prepareApp(body)),
+      rotateAppSecret: (body) => requestClientAsApiResponse(agentApi.integrations.rotateAppSecret(body))
     },
     actions: {
       prepare: (body) => requestClientAsApiResponse(agentApi.actions.prepare(body))
     },
+    mentions: {
+      pendingActions: (query) => requestClientAsApiResponse(agentApi.mentions.pendingActions(query ?? {})),
+      executeAction: (body) => requestClientAsApiResponse(agentApi.mentions.executeAction(body))
+    },
     attachments: {
-      upload: (form) => requestMultipartContractAgentApiRoute(client, "attachmentUpload", form)
+      upload: (form) => requestMultipartContractAgentApiRoute(client, "attachmentUpload", form),
+      download: (params) => requestClientAsApiResponse(agentApi.attachments.download(params)),
+      view: (params) => requestClientAsApiResponse(agentApi.attachments.download(params)),
+      comments: (params, query = {}) => requestClientAsApiResponse(agentApi.attachments.comments(params, query))
     }
   };
 }
@@ -44782,7 +45368,6 @@ function routeFamilyForPath(pathname) {
   if (normalized === "/internal/agent-api/activity") return "agent-api/activity";
   if (normalized === "/internal/agent-api/events") return "agent-api/events";
   if (normalized === "/internal/agent-api/inbox") return "agent-api/inbox";
-  if (normalized === "/internal/agent-api/receive-ack") return "agent-api/events";
   if (normalized === "/internal/agent-api/tasks/claim") return "tasks/claim";
   if (normalized === "/internal/agent-api/tasks/update-status") return "tasks/update";
   if (normalized === "/internal/agent-api/tasks" || normalized.startsWith("/internal/agent-api/tasks/")) {
@@ -44812,7 +45397,7 @@ function routeFamilyForPath(pathname) {
     const firstAfterAgentId = parts[3] ?? "unknown";
     if (firstAfterAgentId === "server") return "server";
     if (firstAfterAgentId === "send") return "agent-api/send";
-    if (firstAfterAgentId === "history" || firstAfterAgentId === "search" || firstAfterAgentId === "receive" || firstAfterAgentId === "receive-ack") {
+    if (firstAfterAgentId === "history" || firstAfterAgentId === "search" || firstAfterAgentId === "receive") {
       return "agent-api/events";
     }
     if (firstAfterAgentId === "channel-members") return "channel-members";
@@ -44917,6 +45502,7 @@ var ApiClient = class {
     if (!pathname.startsWith(agentPrefix)) return pathname;
     const suffix = pathname.slice(agentPrefix.length);
     if (suffix === "/server") return "/internal/agent-api/server";
+    if (suffix === "/server/avatar") return "/internal/agent-api/server/avatar";
     if (suffix === "/send") return "/internal/agent-api/send";
     if (suffix.startsWith("/history")) return `/internal/agent-api/history${suffix.slice("/history".length)}`;
     if (suffix.startsWith("/search")) return `/internal/agent-api/search${suffix.slice("/search".length)}`;
@@ -44934,6 +45520,7 @@ var ApiClient = class {
     if (suffix === "/resolve-channel") return "/internal/agent-api/resolve-channel";
     if (suffix === "/threads/unfollow") return "/internal/agent-api/threads/unfollow";
     if (suffix === "/prepare-action") return "/internal/agent-api/prepare-action";
+    if (suffix === "/channels") return "/internal/agent-api/channels";
     if (suffix === "/tasks" || suffix.startsWith("/tasks?") || suffix.startsWith("/tasks/")) {
       return `/internal/agent-api${suffix}`;
     }
@@ -44954,6 +45541,14 @@ var ApiClient = class {
     if (channelMembership) {
       return `/internal/agent-api/channels/${channelMembership[1]}/${channelMembership[2]}`;
     }
+    const channelUpdate = /^\/channels\/([^/]+)$/.exec(suffix);
+    if (channelUpdate) {
+      return `/internal/agent-api/channels/${channelUpdate[1]}`;
+    }
+    const channelAddMember = /^\/channels\/([^/]+)\/members$/.exec(suffix);
+    if (channelAddMember) {
+      return `/internal/agent-api/channels/${channelAddMember[1]}/members`;
+    }
     return pathname;
   }
   normalizeAgentCredentialResponse(pathname, data) {
@@ -45093,10 +45688,7 @@ var ApiClient = class {
     const res = await this.fetchWithTransportTrace(url2, pathname, init);
     return this.parseJsonResponse(res);
   }
-  // Returns the raw Response so the caller can stream / save the body.
-  // For non-JSON downloads (binary attachments). Caller is responsible for
-  // consuming the body. On non-2xx, attempts to surface a JSON error.
-  async requestRaw(method, pathname) {
+  async requestBody(method, pathname) {
     pathname = this.rewriteAgentCredentialPath(pathname);
     const url2 = new URL(pathname, this.ctx.serverUrl);
     const dispatcher = buildFetchDispatcher(url2.toString());
@@ -45123,6 +45715,21 @@ var ApiClient = class {
     }
     return { ok: res.ok, status: res.status, response: res, error: error48 };
   }
+  async requestBinary(method, pathname) {
+    const res = await this.requestBody(method, pathname);
+    if (!res.ok) {
+      return { ok: false, status: res.status, body: new Uint8Array(), error: res.error };
+    }
+    return {
+      ok: true,
+      status: res.status,
+      body: new Uint8Array(await res.response.arrayBuffer()),
+      error: null
+    };
+  }
+  async streamWakeHints(query) {
+    return this.requestBody("GET", `/internal/agent-api/wake-hints/stream?${query.toString()}`);
+  }
 };
 
 // src/auth/env.ts
@@ -45196,21 +45803,21 @@ function readProfileCredential(slug, env) {
   }
   return { filePath, data: parsed };
 }
-function readTokenFromFile(filePath) {
+function readTokenFromFile(filePath, envName) {
   let raw;
   try {
     raw = fs.readFileSync(filePath, "utf-8");
   } catch (err) {
     throw new AgentBootstrapError(
       "TOKEN_FILE_UNREADABLE",
-      `SLOCK_AGENT_TOKEN_FILE=${filePath} could not be read: ${err.message}`
+      `${envName}=${filePath} could not be read: ${err.message}`
     );
   }
   const token = raw.trim();
   if (!token) {
     throw new AgentBootstrapError(
       "TOKEN_FILE_EMPTY",
-      `SLOCK_AGENT_TOKEN_FILE=${filePath} is empty`
+      `${envName}=${filePath} is empty`
     );
   }
   return token;
@@ -45263,7 +45870,7 @@ function loadAgentContext(env = process.env) {
         "Set only one of SLOCK_AGENT_PROXY_TOKEN or SLOCK_AGENT_PROXY_TOKEN_FILE"
       );
     }
-    const token = agentProxyToken ?? (agentProxyTokenFile ? readTokenFromFile(agentProxyTokenFile) : null);
+    const token = agentProxyToken ?? (agentProxyTokenFile ? readTokenFromFile(agentProxyTokenFile, "SLOCK_AGENT_PROXY_TOKEN_FILE") : null);
     if (!token) {
       throw new AgentBootstrapError(
         "MISSING_AGENT_PROXY_TOKEN",
@@ -45281,32 +45888,16 @@ function loadAgentContext(env = process.env) {
     };
   }
   const tokenFile = env.SLOCK_AGENT_TOKEN_FILE;
-  if (tokenFile) {
-    return {
-      agentId,
-      serverUrl,
-      serverId,
-      token: readTokenFromFile(tokenFile),
-      clientMode: "legacy-machine",
-      secretSource: "legacy-token-file",
-      activeCapabilities
-    };
-  }
   const tokenLiteral = env.SLOCK_AGENT_TOKEN;
-  if (tokenLiteral) {
-    return {
-      agentId,
-      serverUrl,
-      serverId,
-      token: tokenLiteral,
-      clientMode: "legacy-machine",
-      secretSource: "legacy-token-env",
-      activeCapabilities
-    };
+  if (tokenFile || tokenLiteral) {
+    throw new AgentBootstrapError(
+      "LEGACY_MACHINE_UNSUPPORTED",
+      "SLOCK_AGENT_TOKEN_FILE/SLOCK_AGENT_TOKEN machine-token bootstrap is no longer supported by this CLI. Upgrade or restart the daemon so it injects SLOCK_AGENT_PROXY_URL plus SLOCK_AGENT_PROXY_TOKEN_FILE, or use RAFT_PROFILE with a credential from `raft agent login`."
+    );
   }
   throw new AgentBootstrapError(
     "MISSING_TOKEN",
-    "Neither SLOCK_AGENT_PROXY_TOKEN_FILE, SLOCK_AGENT_PROXY_TOKEN, SLOCK_AGENT_TOKEN_FILE nor SLOCK_AGENT_TOKEN is set. The daemon should inject one of these when spawning the agent process."
+    "Neither SLOCK_AGENT_PROXY_TOKEN_FILE nor SLOCK_AGENT_PROXY_TOKEN is set. The daemon should inject proxy credentials when spawning the agent process, or use RAFT_PROFILE with a credential from `raft agent login`."
   );
 }
 
@@ -46184,6 +46775,84 @@ function describeMintError(code, serverUrl) {
 // src/commands/agent/bridge.ts
 init_esm_shims();
 
+// src/daemonApiPath.ts
+init_esm_shims();
+function rawTransportForClient2(client) {
+  return {
+    request: (input) => client.request(input.method, input.path, input.body)
+  };
+}
+function cliErrorFromClientFailure2(failure3) {
+  switch (failure3.error.kind) {
+    case "validation":
+      switch (failure3.error.reason) {
+        case "request_contract_mismatch":
+          return new CliError({
+            code: "INVALID_ARG",
+            message: failure3.error.message,
+            cause: failure3.error.cause
+          });
+        case "empty_response":
+        case "response_contract_mismatch":
+          return new CliError({
+            code: "INVALID_JSON_RESPONSE",
+            message: failure3.error.message,
+            cause: failure3.error.cause
+          });
+      }
+      break;
+    case "transport":
+      return new CliError({
+        code: "CHECK_FAILED",
+        message: failure3.error.message,
+        cause: failure3.error.cause
+      });
+    case "http":
+      return new CliError({
+        code: "CHECK_FAILED",
+        message: failure3.error.message
+      });
+  }
+}
+function apiResponseFromClientResult2(result2) {
+  if (result2.ok) {
+    return {
+      ok: true,
+      status: result2.status,
+      data: result2.data,
+      error: null
+    };
+  }
+  if (result2.error.kind === "http") {
+    return {
+      ok: false,
+      status: result2.error.status,
+      data: null,
+      error: result2.error.message,
+      errorCode: result2.error.errorCode,
+      suggestedNextAction: result2.error.suggestedNextAction
+    };
+  }
+  throw cliErrorFromClientFailure2(result2);
+}
+async function requestClientAsApiResponse2(result2) {
+  return apiResponseFromClientResult2(await result2);
+}
+function createDaemonApiSurfaceClient(client) {
+  const daemonApi = createDaemonApiClient(rawTransportForClient2(client));
+  return {
+    inbox: {
+      check: () => requestClientAsApiResponse2(daemonApi.inbox.check())
+    },
+    wakeHints: {
+      fetch: (query) => requestClientAsApiResponse2(daemonApi.wakeHints.fetch(query))
+    },
+    activity: {
+      forward: (body) => requestClientAsApiResponse2(daemonApi.activity.forward(body))
+    }
+  };
+}
+
 // src/agentCommsCore/bridge.ts
 init_esm_shims();
 import fs2 from "fs";
@@ -46994,17 +47663,17 @@ function statusFailureClass(status) {
   if (status === 404 || status === 410) return "no_session";
   return "injection_failed";
 }
-function buildRaftChannelWakeFailedEvent(input, failure2) {
+function buildRaftChannelWakeFailedEvent(input, failure3) {
   return validateExternalAgentWakeEventEnvelope({
     ...input,
     schema: "slock-external-agent-wake-event.v1",
     kind: "wake_attempt",
     outcome: "failed",
     failureMeta: {
-      failureClass: failure2.failureClass,
-      ...failure2.retryAfterMs ? { retryAfterMs: failure2.retryAfterMs } : {}
+      failureClass: failure3.failureClass,
+      ...failure3.retryAfterMs ? { retryAfterMs: failure3.retryAfterMs } : {}
     },
-    reason: failure2.reason,
+    reason: failure3.reason,
     lifecycleState: "degraded_backoff",
     authority: {
       source: "wake_adapter",
@@ -47049,11 +47718,12 @@ var agentBridgeCommand = defineCommand(
     const limit = parsePositiveInt(options.limit, 50, "limit");
     const activityDrainLimit = parsePositiveInt(options.activityDrainLimit, 50, "activity-drain-limit");
     const client = ctx.createApiClient(agentContext);
-    const pollSource = createAgentApiWakeHintSource(client);
-    const streamSource = options.once ? null : createAgentApiWakeHintStreamSource(client, ctx.env);
+    const daemonApi = createDaemonApiSurfaceClient(client);
+    const pollSource = createDaemonApiWakeHintSource(daemonApi);
+    const streamSource = options.once ? null : createDaemonApiWakeHintStreamSource(client, ctx.env);
     const wakeAdapter = createWakeAdapter(options, ctx.env);
     const activitySource = createActivityDrainSource(options, ctx.env);
-    const activitySink = activitySource ? createAgentApiActivitySink(client) : void 0;
+    const activitySink = activitySource ? createDaemonApiActivitySink(daemonApi) : void 0;
     let bridgeLock;
     try {
       bridgeLock = acquireAgentCommsBridgeLock({
@@ -47212,14 +47882,13 @@ var agentBridgeCommand = defineCommand(
 function registerAgentBridgeCommand(parent, runtimeOptions) {
   registerCliCommand(parent, agentBridgeCommand, runtimeOptions);
 }
-function createAgentApiWakeHintSource(client) {
+function createDaemonApiWakeHintSource(client) {
   return {
     async fetchWakeHints(input) {
-      const query = new URLSearchParams({
-        since: String(input.since),
-        limit: String(input.limit)
+      const response = await client.wakeHints.fetch({
+        since: input.since,
+        limit: input.limit
       });
-      const response = await client.request("GET", `/internal/agent-api/wake-hints?${query.toString()}`);
       if (!response.ok) {
         throw new CliError({
           code: response.status >= 500 ? "SERVER_5XX" : "BRIDGE_WAKE_HINTS_FAILED",
@@ -47234,8 +47903,8 @@ function createAgentApiWakeHintSource(client) {
     }
   };
 }
-function createAgentApiWakeHintStreamSource(client, env = process.env) {
-  if (!client.requestRaw) return null;
+function createDaemonApiWakeHintStreamSource(client, env = process.env) {
+  if (!client.streamWakeHints) return null;
   let reader = null;
   let bufferedText = "";
   let pendingEvent = {};
@@ -47250,7 +47919,7 @@ function createAgentApiWakeHintStreamSource(client, env = process.env) {
   async function ensureReader(since) {
     if (reader) return reader;
     const query = new URLSearchParams({ since: String(since) });
-    const response = await client.requestRaw("GET", `/internal/agent-api/wake-hints/stream?${query.toString()}`);
+    const response = await client.streamWakeHints(query);
     if (!response.ok) {
       throw new CliError({
         code: response.status === 404 || response.status === 405 || response.status === 501 ? "BRIDGE_WAKE_STREAM_UNAVAILABLE" : response.status >= 500 ? "SERVER_5XX" : "BRIDGE_WAKE_STREAM_FAILED",
@@ -47435,10 +48104,10 @@ function createActivityDrainSource(options, env = process.env) {
     }
   };
 }
-function createAgentApiActivitySink(client) {
+function createDaemonApiActivitySink(client) {
   return {
     async forwardActivity(input) {
-      const response = await client.request("POST", "/internal/agent-api/activity", input);
+      const response = await client.activity.forward(input);
       if (!response.ok) {
         throw new CliError({
           code: response.status >= 500 ? "SERVER_5XX" : "BRIDGE_ACTIVITY_FORWARD_FAILED",
@@ -47576,6 +48245,9 @@ function formatRuntimeContext(ctx) {
     "Authoritative context for this agent process. Do not infer computer identity from hostname or cwd when this section is present."
   ];
   if (ctx.agentId) lines.push(`- Agent ID: ${ctx.agentId}`);
+  if (ctx.runtime) lines.push(`- Runtime: ${ctx.runtime}`);
+  if (ctx.model) lines.push(`- Model: ${ctx.model}`);
+  if (ctx.reasoningEffort) lines.push(`- Reasoning: ${ctx.reasoningEffort}`);
   if (ctx.serverId) lines.push(`- Server ID: ${ctx.serverId}`);
   if (ctx.machineName || ctx.machineId) {
     const label = ctx.machineName && ctx.machineId ? `${ctx.machineName} (${ctx.machineId})` : ctx.machineName || ctx.machineId;
@@ -47589,14 +48261,26 @@ function formatRuntimeContext(ctx) {
 
 ` : "";
 }
+function roleLabel(role) {
+  return role && role !== "member" ? ` (${role})` : "";
+}
+function formatCurrentAgent(data) {
+  if (!data.serverRole) return "";
+  const lines = ["### Current Agent"];
+  lines.push(`- Role: ${data.serverRole}`);
+  return `${lines.join("\n")}
+
+`;
+}
 function formatServerInfo(data) {
   let text = "## Server\n\n";
   const channels = data.channels ?? [];
   const agents = data.agents ?? [];
   const humans = data.humans ?? [];
   text += formatRuntimeContext(data.runtimeContext);
+  text += formatCurrentAgent(data);
   text += "### Channels\n";
-  text += 'Visible public channels may appear even when `joined=false`. Private channels are shown only when you are a member; do not disclose private-channel names, membership, or content outside that channel. Use `raft message read --channel "#name"` to inspect visible channels. When a public channel is not joined, you can join it with `raft channel join --target "#name"` before sending messages or receiving ordinary channel delivery. Private channels require a human with access to add you. To leave a channel you have joined, use `raft channel leave --target "#name"`. To stop following a thread, use `raft thread unfollow --target "#name:shortid"`.\n';
+  text += "Visible public channels may appear even when `joined=false`. Private channels are shown only when you are a member; do not disclose private-channel names, membership, or content outside that channel. Use channel attention commands (`raft channel join`, `leave`, `mute`, `unmute`; `raft thread unfollow`) for your own delivery state. Admin agents can manage regular channels (`raft channel create`, `update`, `add-member`, `remove-member`) and server profile (`raft server update`). Run any subcommand with `--help` for syntax.\n";
   if (channels.length > 0) {
     for (const t of channels) {
       const visibility = t.type === "private" ? "private" : "public";
@@ -47610,10 +48294,12 @@ function formatServerInfo(data) {
   }
   text += "\n### Agents\n";
   text += "Other AI agents in this server.\n";
+  text += "Role labels show server-level owner/admin authority; no role label means ordinary member.\n";
   if (agents.length > 0) {
     for (const a of agents) {
-      text += a.description ? `  - @${a.name} (${a.status}) \u2014 ${a.description}
-` : `  - @${a.name} (${a.status})
+      const role = roleLabel(a.role);
+      text += a.description ? `  - @${a.name} (${a.status})${role} \u2014 ${a.description}
+` : `  - @${a.name} (${a.status})${role}
 `;
     }
   } else {
@@ -47622,10 +48308,12 @@ function formatServerInfo(data) {
   text += "\n### Humans\n";
   text += `To start a new DM: raft message send --target "dm:@name" <<'SLOCKMSG' followed by the message body and SLOCKMSG. To reply in an existing DM: reuse the target from received messages.
 `;
+  text += "Role labels show server-level owner/admin authority; no role label means ordinary member.\n";
   if (humans.length > 0) {
     for (const u of humans) {
-      text += u.description ? `  - @${u.name} \u2014 ${u.description}
-` : `  - @${u.name}
+      const role = roleLabel(u.role);
+      text += u.description ? `  - @${u.name}${role} \u2014 ${u.description}
+` : `  - @${u.name}${role}
 `;
     }
   } else {
@@ -47643,10 +48331,12 @@ function formatChannelMembers(data) {
 `;
   text += "Members means join/post authority for this surface.\n\n";
   text += "### Agents\n";
+  text += "Role labels show server-level owner/admin authority; no role label means ordinary member.\n";
   if (agents.length > 0) {
     for (const a of agents) {
-      text += a.description ? `  - @${a.name} (${a.status}) \u2014 ${a.description}
-` : `  - @${a.name} (${a.status})
+      const role = roleLabel(a.role);
+      text += a.description ? `  - @${a.name} (${a.status})${role} \u2014 ${a.description}
+` : `  - @${a.name} (${a.status})${role}
 `;
     }
   } else {
@@ -47656,7 +48346,7 @@ function formatChannelMembers(data) {
   text += "Role labels show server-level owner/admin authority; no role label means ordinary member.\n";
   if (humans.length > 0) {
     for (const u of humans) {
-      const role = u.role && u.role !== "member" ? ` (${u.role})` : "";
+      const role = roleLabel(u.role);
       text += u.description ? `  - @${u.name}${role} \u2014 ${u.description}
 ` : `  - @${u.name}${role}
 `;
@@ -47699,7 +48389,68 @@ function registerChannelMembersCommand(parent, runtimeOptions) {
   registerCliCommand(parent, channelMembersCommand, runtimeOptions);
 }
 
-// src/commands/channel/join.ts
+// src/commands/channel/create.ts
+init_esm_shims();
+function normalizeChannelName(raw) {
+  return (raw ?? "").trim().replace(/^#/, "");
+}
+function formatCreateChannelResult(channel) {
+  const target = `#${channel.name}`;
+  const visibility = channel.type === "private" ? "private" : "public";
+  return `Created ${target} (${visibility}). You are joined and can send messages there.`;
+}
+var channelCreateCommand = defineCommand(
+  {
+    name: "create",
+    description: "Create a public or private channel when this agent has server admin authority",
+    options: [
+      {
+        flags: "--name <name>",
+        description: "Channel name, with or without a leading '#'"
+      },
+      {
+        flags: "--description <description>",
+        description: "Optional channel description"
+      },
+      {
+        flags: "--private",
+        description: "Create a private channel instead of a public channel"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const name = normalizeChannelName(opts.name);
+    if (!name) {
+      throw new CliError({
+        code: "INVALID_ARG",
+        message: "--name is required"
+      });
+    }
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    const res = await client.request(
+      "POST",
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channels`,
+      {
+        name,
+        description: opts.description,
+        visibility: opts.private ? "private" : "public"
+      }
+    );
+    if (!res.ok || !res.data) {
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "CREATE_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
+    }
+    writeText(ctx.io, formatCreateChannelResult(res.data) + "\n");
+  }
+);
+function registerChannelCreateCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, channelCreateCommand, runtimeOptions);
+}
+
+// src/commands/channel/update.ts
 init_esm_shims();
 
 // src/commands/channel/leave.ts
@@ -47738,7 +48489,8 @@ var channelLeaveCommand = defineCommand(
     }
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const infoRes = await createAgentApiClient2(client, agentContext.agentId).server.info();
+    const agentApi = createAgentApiSurfaceClient(client);
+    const infoRes = await agentApi.server.info();
     if (!infoRes.ok) {
       throw new CliError({
         code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
@@ -47756,7 +48508,7 @@ var channelLeaveCommand = defineCommand(
       writeText(ctx.io, formatAlreadyNotJoined(target) + "\n");
       return;
     }
-    const leaveRes = await createAgentApiClient2(client, agentContext.agentId).channels.leave({
+    const leaveRes = await agentApi.channels.leave({
       channelId: channel.id
     });
     if (!leaveRes.ok) {
@@ -47772,7 +48524,278 @@ function registerChannelLeaveCommand(parent, runtimeOptions) {
   registerCliCommand(parent, channelLeaveCommand, runtimeOptions);
 }
 
+// src/commands/channel/update.ts
+function normalizeChannelName2(raw) {
+  return (raw ?? "").trim().replace(/^#/, "");
+}
+function formatUpdateChannelResult(channel) {
+  const visibility = channel.type === "private" ? "private" : "public";
+  return `Updated #${channel.name} (${visibility}).`;
+}
+var channelUpdateCommand = defineCommand(
+  {
+    name: "update",
+    description: "Edit a regular channel when this agent has server admin authority",
+    options: [
+      {
+        flags: "--target <target>",
+        description: "Regular channel to edit, e.g. '#engineering'"
+      },
+      {
+        flags: "--name <name>",
+        description: "New channel name, with or without a leading '#'"
+      },
+      {
+        flags: "--description <description>",
+        description: "New channel description"
+      },
+      {
+        flags: "--public",
+        description: "Make the channel public"
+      },
+      {
+        flags: "--private",
+        description: "Make the channel private"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const target = opts.target ?? "";
+    const channelName = parseRegularChannelTarget(target);
+    if (!channelName) {
+      throw new CliError({
+        code: "INVALID_TARGET",
+        message: "Target must be a regular channel in the form '#channel-name'. DMs and thread targets are not supported."
+      });
+    }
+    if (opts.public && opts.private) {
+      throw new CliError({
+        code: "INVALID_ARG",
+        message: "Use either --public or --private, not both."
+      });
+    }
+    const body = {};
+    if (opts.name !== void 0) body.name = normalizeChannelName2(opts.name);
+    if (opts.description !== void 0) body.description = opts.description;
+    if (opts.public) body.visibility = "public";
+    if (opts.private) body.visibility = "private";
+    if (body.name === void 0 && body.description === void 0 && body.visibility === void 0) {
+      throw new CliError({
+        code: "INVALID_ARG",
+        message: "Provide at least one of --name, --description, --public, or --private."
+      });
+    }
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    const infoRes = await client.request(
+      "GET",
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server`
+    );
+    if (!infoRes.ok) {
+      throw new CliError({
+        code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
+        message: infoRes.error ?? `HTTP ${infoRes.status}`
+      });
+    }
+    const channel = (infoRes.data?.channels ?? []).find((candidate) => candidate.name === channelName);
+    if (!channel) {
+      throw new CliError({
+        code: "NOT_FOUND",
+        message: `Channel not found: ${target}`
+      });
+    }
+    const updateRes = await client.request(
+      "PATCH",
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channels/${encodeURIComponent(channel.id)}`,
+      body
+    );
+    if (!updateRes.ok || !updateRes.data) {
+      throw new CliError({
+        code: updateRes.status >= 500 ? "SERVER_5XX" : "UPDATE_FAILED",
+        message: updateRes.error ?? `HTTP ${updateRes.status}`
+      });
+    }
+    writeText(ctx.io, formatUpdateChannelResult(updateRes.data) + "\n");
+  }
+);
+function registerChannelUpdateCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, channelUpdateCommand, runtimeOptions);
+}
+
+// src/commands/channel/add-member.ts
+init_esm_shims();
+function normalizeHandle(raw) {
+  return (raw ?? "").trim().replace(/^@/, "");
+}
+function formatAddMemberResult(target, memberType, memberName, alreadyMember) {
+  const member = `@${memberName}`;
+  if (alreadyMember) {
+    return `${member} is already in ${target}.`;
+  }
+  return `Added ${member} to ${target} as ${memberType === "agent" ? "an agent" : "a user"}.`;
+}
+var channelAddMemberCommand = defineCommand(
+  {
+    name: "add-member",
+    description: "Add a human or agent to a regular channel when this agent has server admin authority",
+    options: [
+      {
+        flags: "--target <target>",
+        description: "Regular channel to add a member to, e.g. '#engineering'"
+      },
+      {
+        flags: "--user <handle>",
+        description: "Human handle to add, e.g. '@alice'"
+      },
+      {
+        flags: "--agent <handle>",
+        description: "Agent handle to add, e.g. '@assistant'"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const target = opts.target ?? "";
+    const channelName = parseRegularChannelTarget(target);
+    if (!channelName) {
+      throw new CliError({
+        code: "INVALID_TARGET",
+        message: "Target must be a regular channel in the form '#channel-name'. DMs and thread targets are not supported."
+      });
+    }
+    const user = normalizeHandle(opts.user);
+    const agent = normalizeHandle(opts.agent);
+    if ((user ? 1 : 0) + (agent ? 1 : 0) !== 1) {
+      throw new CliError({
+        code: "INVALID_ARG",
+        message: "Provide exactly one of --user or --agent."
+      });
+    }
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    const infoRes = await client.request(
+      "GET",
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server`
+    );
+    if (!infoRes.ok) {
+      throw new CliError({
+        code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
+        message: infoRes.error ?? `HTTP ${infoRes.status}`
+      });
+    }
+    const channel = (infoRes.data?.channels ?? []).find((candidate) => candidate.name === channelName);
+    if (!channel) {
+      throw new CliError({
+        code: "NOT_FOUND",
+        message: `Channel not found: ${target}`
+      });
+    }
+    const body = user ? { user } : { agent };
+    const addRes = await client.request(
+      "POST",
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channels/${encodeURIComponent(channel.id)}/members`,
+      body
+    );
+    if (!addRes.ok) {
+      throw new CliError({
+        code: addRes.status >= 500 ? "SERVER_5XX" : "MEMBERS_FAILED",
+        message: addRes.error ?? `HTTP ${addRes.status}`
+      });
+    }
+    const memberName = addRes.data?.member?.name ?? (user || agent);
+    const memberType = addRes.data?.member?.type === "agent" ? "agent" : "user";
+    writeText(ctx.io, formatAddMemberResult(target, memberType, memberName, addRes.data?.alreadyMember === true) + "\n");
+  }
+);
+function registerChannelAddMemberCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, channelAddMemberCommand, runtimeOptions);
+}
+
+// src/commands/channel/remove-member.ts
+init_esm_shims();
+function normalizeHandle2(raw) {
+  return (raw ?? "").trim().replace(/^@/, "");
+}
+function formatRemoveMemberResult(target, memberName, wasMember) {
+  const member = `@${memberName}`;
+  return wasMember ? `Removed ${member} from ${target}.` : `${member} was not in ${target}.`;
+}
+var channelRemoveMemberCommand = defineCommand(
+  {
+    name: "remove-member",
+    description: "Remove a human or agent from a regular channel when this agent has server admin authority",
+    options: [
+      {
+        flags: "--target <target>",
+        description: "Regular channel to remove a member from, e.g. '#engineering'"
+      },
+      {
+        flags: "--user <handle>",
+        description: "Human handle to remove, e.g. '@alice'"
+      },
+      {
+        flags: "--agent <handle>",
+        description: "Agent handle to remove, e.g. '@assistant'"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const target = opts.target ?? "";
+    const channelName = parseRegularChannelTarget(target);
+    if (!channelName) {
+      throw new CliError({
+        code: "INVALID_TARGET",
+        message: "Target must be a regular channel in the form '#channel-name'. DMs and thread targets are not supported."
+      });
+    }
+    const user = normalizeHandle2(opts.user);
+    const agent = normalizeHandle2(opts.agent);
+    if ((user ? 1 : 0) + (agent ? 1 : 0) !== 1) {
+      throw new CliError({
+        code: "INVALID_ARG",
+        message: "Provide exactly one of --user or --agent."
+      });
+    }
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    const infoRes = await client.request(
+      "GET",
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server`
+    );
+    if (!infoRes.ok) {
+      throw new CliError({
+        code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
+        message: infoRes.error ?? `HTTP ${infoRes.status}`
+      });
+    }
+    const channel = (infoRes.data?.channels ?? []).find((candidate) => candidate.name === channelName);
+    if (!channel) {
+      throw new CliError({
+        code: "NOT_FOUND",
+        message: `Channel not found: ${target}`
+      });
+    }
+    const body = user ? { user } : { agent };
+    const removeRes = await client.request(
+      "DELETE",
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channels/${encodeURIComponent(channel.id)}/members`,
+      body
+    );
+    if (!removeRes.ok) {
+      throw new CliError({
+        code: removeRes.status >= 500 ? "SERVER_5XX" : "MEMBERS_FAILED",
+        message: removeRes.error ?? `HTTP ${removeRes.status}`
+      });
+    }
+    const memberName = removeRes.data?.member?.name ?? (user || agent);
+    writeText(ctx.io, formatRemoveMemberResult(target, memberName, removeRes.data?.wasMember === true) + "\n");
+  }
+);
+function registerChannelRemoveMemberCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, channelRemoveMemberCommand, runtimeOptions);
+}
+
 // src/commands/channel/join.ts
+init_esm_shims();
 function formatJoinChannelResult(target) {
   return `Joined ${target}. You can now send messages there and receive ordinary channel delivery.`;
 }
@@ -47801,7 +48824,8 @@ var channelJoinCommand = defineCommand(
     }
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const infoRes = await createAgentApiClient2(client, agentContext.agentId).server.info();
+    const agentApi = createAgentApiSurfaceClient(client);
+    const infoRes = await agentApi.server.info();
     if (!infoRes.ok) {
       throw new CliError({
         code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
@@ -47819,7 +48843,7 @@ var channelJoinCommand = defineCommand(
       writeText(ctx.io, formatAlreadyJoined(target) + "\n");
       return;
     }
-    const joinRes = await createAgentApiClient2(client, agentContext.agentId).channels.join({
+    const joinRes = await agentApi.channels.join({
       channelId: channel.id
     });
     if (!joinRes.ok) {
@@ -47877,7 +48901,8 @@ function makeChannelMuteCommand(action) {
       }
       const agentContext = ctx.loadAgentContext();
       const client = ctx.createApiClient(agentContext);
-      const infoRes = await createAgentApiClient2(client, agentContext.agentId).server.info();
+      const agentApi = createAgentApiSurfaceClient(client);
+      const infoRes = await agentApi.server.info();
       if (!infoRes.ok) {
         throw new CliError({
           code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
@@ -47891,10 +48916,7 @@ function makeChannelMuteCommand(action) {
           message: `Channel not found: ${target}`
         });
       }
-      const res = await client.request(
-        "POST",
-        `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channels/${encodeURIComponent(channel.id)}/${action}`
-      );
+      const res = action === "mute" ? await agentApi.channels.mute({ channelId: channel.id }) : await agentApi.channels.unmute({ channelId: channel.id });
       if (!res.ok) {
         throw new CliError({
           code: res.status >= 500 ? "SERVER_5XX" : action === "mute" ? "MUTE_FAILED" : "UNMUTE_FAILED",
@@ -47925,7 +48947,7 @@ var serverInfoCommand = defineCommand(
   async (ctx) => {
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const res = await createAgentApiClient2(client, agentContext.agentId).server.info();
+    const res = await createAgentApiSurfaceClient(client).server.info();
     if (!res.ok) {
       const code = res.status >= 500 ? "SERVER_5XX" : "INFO_FAILED";
       throw new CliError({
@@ -47947,16 +48969,341 @@ function registerServerInfoCommand(parent, runtimeOptions) {
   registerCliCommand(parent, serverInfoCommand, runtimeOptions);
 }
 
-// src/commands/knowledge/get.ts
+// src/commands/server/update.ts
 init_esm_shims();
-function buildKnowledgeGetPath(agentId, topic, opts) {
-  const params = new URLSearchParams();
-  params.set("topic", topic);
-  if (opts.reason) params.set("reason", opts.reason);
-  if (opts.turnId) params.set("turn_id", opts.turnId);
-  if (opts.traceId) params.set("trace_id", opts.traceId);
-  return `/internal/agent/${encodeURIComponent(agentId)}/knowledge?${params.toString()}`;
+
+// src/commands/profile/update.ts
+init_esm_shims();
+import { basename } from "path";
+import { existsSync, readFileSync as readFileSync2, statSync } from "fs";
+
+// src/commands/profile/_format.ts
+init_esm_shims();
+function formatCreatedAgents(createdAgents) {
+  if (createdAgents.length === 0) {
+    return ["- Created Agents: none"];
+  }
+  return [
+    `- Created Agents (${createdAgents.length}):`,
+    ...createdAgents.map((createdAgent) => `  - @${createdAgent.name} (${getRuntimeDisplayName(createdAgent.runtime)}, ${createdAgent.status})`)
+  ];
+}
+function formatHumanProfile(profile) {
+  const lines = [
+    "## Profile",
+    "",
+    "- Type: human",
+    `- Handle: @${profile.name}`,
+    `- Display Name: ${profile.displayName ?? "(none)"}`,
+    `- Description: ${profile.description ?? "(none)"}`,
+    `- Membership: ${profile.membershipStatus}`
+  ];
+  if (profile.role) lines.push(`- Role: ${profile.role}`);
+  if (profile.joinedAt) lines.push(`- Joined: ${profile.joinedAt}`);
+  if (profile.email) lines.push(`- Email: ${profile.email}`);
+  return [...lines, ...formatCreatedAgents(profile.createdAgents)].join("\n");
+}
+function formatCreator(profile) {
+  if (!profile.creator) return null;
+  return profile.creator.displayName ? `${profile.creator.displayName} (@${profile.creator.name})` : `@${profile.creator.name}`;
+}
+function formatAgentProfile(profile) {
+  const lines = [
+    "## Profile",
+    "",
+    "- Type: agent",
+    `- Handle: @${profile.name}`,
+    `- Display Name: ${profile.displayName ?? "(none)"}`,
+    `- Description: ${profile.description ?? "(none)"}`,
+    `- Status: ${profile.status}`,
+    `- Role: ${profile.serverRole}`,
+    `- Runtime: ${getRuntimeDisplayName(profile.runtime)}`,
+    `- Model: ${profile.model}`,
+    `- Reasoning: ${profile.reasoningEffort ?? "medium"}`
+  ];
+  if (profile.executionMode) lines.push(`- Execution: ${profile.executionMode}`);
+  if (profile.computerName || profile.computerId) {
+    const label = profile.computerName && profile.computerId ? `${profile.computerName} (${profile.computerId})` : profile.computerName ?? profile.computerId;
+    lines.push(`- Computer: ${label}`);
+  }
+  if (profile.computerHostname) lines.push(`- Hostname: ${profile.computerHostname}`);
+  if (profile.daemonVersion) lines.push(`- Daemon: v${profile.daemonVersion}`);
+  lines.push(`- Created: ${profile.createdAt}`);
+  if (profile.deletedAt) lines.push(`- Deleted At: ${profile.deletedAt}`);
+  const creator = formatCreator(profile);
+  if (creator) lines.push(`- Creator: ${creator}`);
+  return [...lines, ...formatCreatedAgents(profile.createdAgents)].join("\n");
+}
+function formatProfile(profile) {
+  return profile.kind === "human" ? formatHumanProfile(profile) : formatAgentProfile(profile);
+}
+
+// src/commands/profile/update.ts
+var MAX_PROFILE_AVATAR_BYTES = 2 * 1024 * 1024;
+var PROFILE_AVATAR_MIME_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp"
+]);
+var FILENAME_MIME_MAP = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".gif": "image/gif",
+  ".webp": "image/webp"
+};
+var MAX_PROFILE_DESCRIPTION_LENGTH = 3e3;
+var MAX_PROFILE_DISPLAY_NAME_LENGTH = 80;
+function inferImageMimeType(filename, buffer) {
+  const lowerFilename = filename.toLowerCase();
+  if (buffer.length >= 8 && buffer.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
+    return "image/png";
+  }
+  if (buffer.length >= 3 && buffer.subarray(0, 3).equals(Buffer.from([255, 216, 255]))) {
+    return "image/jpeg";
+  }
+  if (buffer.length >= 6) {
+    const header = buffer.subarray(0, 6).toString("ascii");
+    if (header === "GIF87a" || header === "GIF89a") return "image/gif";
+  }
+  if (buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP") {
+    return "image/webp";
+  }
+  const dot = lowerFilename.lastIndexOf(".");
+  return dot >= 0 ? FILENAME_MIME_MAP[lowerFilename.slice(dot)] ?? null : null;
+}
+function readAvatarFile(avatarFile) {
+  if (!existsSync(avatarFile)) {
+    throw cliError("PROFILE_FILE_NOT_FOUND", `Avatar file does not exist: ${avatarFile}`);
+  }
+  const stat2 = statSync(avatarFile);
+  if (!stat2.isFile()) {
+    throw cliError("PROFILE_FILE_NOT_FOUND", `Avatar file is not a regular file: ${avatarFile}`);
+  }
+  if (stat2.size > MAX_PROFILE_AVATAR_BYTES) {
+    throw cliError(
+      "PROFILE_AVATAR_TOO_LARGE",
+      `Avatar file is ${stat2.size} bytes; max size is ${MAX_PROFILE_AVATAR_BYTES} bytes`
+    );
+  }
+  const buffer = readFileSync2(avatarFile);
+  const filename = basename(avatarFile);
+  const mimeType = inferImageMimeType(filename, buffer);
+  if (!mimeType || !PROFILE_AVATAR_MIME_TYPES.has(mimeType)) {
+    throw cliError(
+      "PROFILE_AVATAR_BAD_FORMAT",
+      "Avatar must be a JPEG, PNG, GIF, or WebP image"
+    );
+  }
+  return { filename, buffer, mimeType };
 }
+function normalizeAvatarUrl(avatarUrl) {
+  const trimmed = avatarUrl.trim();
+  if (trimmed.length === 0) {
+    throw cliError("INVALID_ARG", "--avatar-url must not be empty");
+  }
+  if (!trimmed.startsWith("pixel:")) {
+    throw cliError("INVALID_ARG", "--avatar-url currently supports only pixel avatar URLs; use --avatar-file for image uploads");
+  }
+  return trimmed;
+}
+var profileUpdateCommand = defineCommand(
+  {
+    name: "update",
+    description: "Update your own profile",
+    options: [
+      { flags: "--avatar-file <path>", description: "Path to a local image file to use as your avatar" },
+      { flags: "--avatar-url <value>", description: "Set a pixel avatar URL such as pixel:random:<seed>" },
+      { flags: "--display-name <name>", description: "Set your display name (non-empty)" },
+      { flags: "--description <text>", description: "Set your profile description (non-empty)" },
+      { flags: "--json", description: "Emit machine-readable JSON" }
+    ]
+  },
+  async (ctx, opts) => {
+    const hasAvatar = opts.avatarFile !== void 0;
+    const hasAvatarUrl = opts.avatarUrl !== void 0;
+    const hasDisplayName = opts.displayName !== void 0;
+    const hasDescription = opts.description !== void 0;
+    if (!hasAvatar && !hasAvatarUrl && !hasDisplayName && !hasDescription) {
+      throw cliError("INVALID_ARG", "Provide at least one of --avatar-file, --avatar-url, --display-name, or --description");
+    }
+    if (hasAvatar && hasAvatarUrl) {
+      throw cliError("INVALID_ARG", "Use either --avatar-file or --avatar-url, not both");
+    }
+    let normalizedAvatarUrl;
+    if (hasAvatarUrl) {
+      normalizedAvatarUrl = normalizeAvatarUrl(opts.avatarUrl);
+    }
+    let trimmedDisplayName;
+    if (hasDisplayName) {
+      trimmedDisplayName = opts.displayName.trim();
+      if (trimmedDisplayName.length === 0) {
+        throw cliError("INVALID_ARG", "--display-name must not be empty");
+      }
+      if (trimmedDisplayName.length > MAX_PROFILE_DISPLAY_NAME_LENGTH) {
+        throw cliError("INVALID_ARG", `--display-name must be at most ${MAX_PROFILE_DISPLAY_NAME_LENGTH} characters`);
+      }
+    }
+    if (hasDescription) {
+      if (opts.description.length === 0) {
+        throw cliError("INVALID_ARG", "--description must not be empty");
+      }
+      if (opts.description.length > MAX_PROFILE_DESCRIPTION_LENGTH) {
+        throw cliError("INVALID_ARG", `--description must be at most ${MAX_PROFILE_DESCRIPTION_LENGTH} characters`);
+      }
+    }
+    const avatar = hasAvatar ? readAvatarFile(opts.avatarFile) : null;
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    const agentApi = createAgentApiSurfaceClient(client);
+    let latestProfile = null;
+    if (hasAvatarUrl || hasDisplayName || hasDescription) {
+      const body = {};
+      if (hasAvatarUrl) {
+        body.avatarUrl = normalizedAvatarUrl;
+      }
+      if (hasDisplayName) {
+        body.displayName = trimmedDisplayName;
+      }
+      if (hasDescription) {
+        body.description = opts.description;
+      }
+      const res = await agentApi.profile.update(body);
+      if (!res.ok || !res.data) {
+        const code = res.errorCode ?? (res.status >= 500 ? "SERVER_5XX" : "PROFILE_UPDATE_FAILED");
+        throw cliError(code, res.error ?? `HTTP ${res.status}`);
+      }
+      latestProfile = res.data;
+    }
+    if (hasAvatar) {
+      const form = new FormData();
+      const avatarBytes = Uint8Array.from(avatar.buffer);
+      form.append("avatar", new Blob([avatarBytes], { type: avatar.mimeType }), avatar.filename);
+      const res = await agentApi.profile.updateAvatar(form);
+      if (!res.ok || !res.data) {
+        const code = res.errorCode ?? (res.status >= 500 ? "SERVER_5XX" : "PROFILE_UPDATE_FAILED");
+        throw cliError(code, res.error ?? `HTTP ${res.status}`);
+      }
+      latestProfile = res.data;
+    }
+    if (!latestProfile) {
+      throw cliError("PROFILE_UPDATE_FAILED", "No profile returned from server");
+    }
+    if (opts.json) {
+      writeJson(ctx.io, { ok: true, data: latestProfile });
+      return;
+    }
+    writeText(ctx.io, `${formatProfile(latestProfile)}
+`);
+  }
+);
+function registerProfileUpdateCommand(parent, runtimeOptions = {}) {
+  registerCliCommand(parent, profileUpdateCommand, runtimeOptions);
+}
+
+// src/commands/server/update.ts
+function formatServerUpdateResult(server) {
+  return `Updated server ${server.name ?? server.id ?? "profile"}.`;
+}
+var serverUpdateCommand = defineCommand(
+  {
+    name: "update",
+    description: "Update the current server profile when this agent has server admin authority",
+    options: [
+      {
+        flags: "--name <name>",
+        description: "Set the server name"
+      },
+      {
+        flags: "--avatar-file <path>",
+        description: "Path to a local image file to use as the server avatar"
+      },
+      {
+        flags: "--json",
+        description: "Emit machine-readable JSON"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const hasName = opts.name !== void 0;
+    const hasAvatar = opts.avatarFile !== void 0;
+    if (!hasName && !hasAvatar) {
+      throw new CliError({
+        code: "INVALID_ARG",
+        message: "Provide at least one of --name or --avatar-file."
+      });
+    }
+    let trimmedName;
+    if (hasName) {
+      trimmedName = opts.name.trim();
+      if (!trimmedName) {
+        throw new CliError({
+          code: "INVALID_ARG",
+          message: "--name must not be empty"
+        });
+      }
+      if (trimmedName.length > 100) {
+        throw new CliError({
+          code: "INVALID_ARG",
+          message: "--name must be 100 characters or fewer"
+        });
+      }
+    }
+    const avatar = hasAvatar ? readAvatarFile(opts.avatarFile) : null;
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    let latestServer = null;
+    if (hasName) {
+      const res = await client.request(
+        "PATCH",
+        `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server`,
+        { name: trimmedName }
+      );
+      if (!res.ok || !res.data) {
+        throw new CliError({
+          code: res.status >= 500 ? "SERVER_5XX" : "UPDATE_FAILED",
+          message: res.error ?? `HTTP ${res.status}`
+        });
+      }
+      latestServer = res.data;
+    }
+    if (hasAvatar) {
+      const form = new FormData();
+      const avatarBytes = Uint8Array.from(avatar.buffer);
+      form.append("avatar", new Blob([avatarBytes], { type: avatar.mimeType }), avatar.filename);
+      const res = await client.requestMultipart(
+        "POST",
+        `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server/avatar`,
+        form
+      );
+      if (!res.ok || !res.data) {
+        throw new CliError({
+          code: res.status >= 500 ? "SERVER_5XX" : "UPDATE_FAILED",
+          message: res.error ?? `HTTP ${res.status}`
+        });
+      }
+      latestServer = res.data;
+    }
+    if (!latestServer) {
+      throw new CliError({
+        code: "UPDATE_FAILED",
+        message: "No server profile returned from server"
+      });
+    }
+    if (opts.json) {
+      writeJson(ctx.io, { ok: true, data: latestServer });
+      return;
+    }
+    writeText(ctx.io, formatServerUpdateResult(latestServer) + "\n");
+  }
+);
+function registerServerUpdateCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, serverUpdateCommand, runtimeOptions);
+}
+
+// src/commands/knowledge/get.ts
+init_esm_shims();
 function formatKnowledgeStdout(content) {
   return content.endsWith("\n") ? content : `${content}
 `;
@@ -48003,10 +49350,12 @@ var knowledgeGetCommand = defineCommand(
   async (ctx, topic, opts) => {
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const res = await client.request(
-      "GET",
-      buildKnowledgeGetPath(agentContext.agentId, topic, opts)
-    );
+    const res = await createAgentApiSurfaceClient(client).knowledge.get({
+      topic,
+      reason: opts.reason,
+      turn_id: opts.turnId,
+      trace_id: opts.traceId
+    });
     if (!res.ok) {
       throw new CliError({
         code: toKnowledgeErrorCode(res.errorCode, res.status),
@@ -48050,7 +49399,7 @@ var inboxCheckCommand = defineCommand(
       });
     }
     const client = ctx.createApiClient(agentContext);
-    const response = await client.request("GET", "/internal/agent-api/inbox");
+    const response = await createDaemonApiSurfaceClient(client).inbox.check();
     if (!response.ok) {
       throw new CliError({
         code: response.status >= 500 ? "SERVER_5XX" : "INBOX_CHECK_FAILED",
@@ -48412,6 +49761,7 @@ function renderSearchPreview(content, query) {
 }
 function formatSearchResults(query, data) {
   if (!data.results || data.results.length === 0) return "No search results.";
+  const trimmedQuery = query.trim();
   const formatted = data.results.map((result2, index) => {
     const ref = `msg:${result2.id}`;
     const content = result2.content ?? result2.snippet ?? "";
@@ -48424,14 +49774,14 @@ function formatSearchResults(query, data) {
       `Time: ${result2.createdAt ? toLocalTime(result2.createdAt) : "-"}`,
       "",
       "<preview>",
-      renderSearchPreview(content, query),
+      renderSearchPreview(content, trimmedQuery),
       "</preview>",
       "</result>"
     ].join("\n");
   }).join("\n\n");
   const resultLabel = data.results.length === 1 ? "result" : "results";
   return [
-    `Search results for: "${query}" (${data.results.length} ${resultLabel})`,
+    trimmedQuery ? `Search results for: "${trimmedQuery}" (${data.results.length} ${resultLabel})` : `Filtered message results (${data.results.length} ${resultLabel})`,
     "",
     formatted,
     "",
@@ -48824,7 +50174,7 @@ var messageSendCommand = defineCommand(
     if (outgoingAttachmentIds.length > 0) {
       body.attachmentIds = outgoingAttachmentIds;
     }
-    const agentApi = createAgentApiClient2(client, agentContext.agentId);
+    const agentApi = createAgentApiSurfaceClient(client);
     const res = await agentApi.messages.send(body);
     if (!res.ok) {
       const code = res.status >= 500 ? "SERVER_5XX" : "SEND_FAILED";
@@ -48886,47 +50236,18 @@ function sortedMessages(messages) {
 function result(messages, opts = {}) {
   return {
     messages: sortedMessages(messages),
-    ...opts.ackFailure ? { ackFailure: opts.ackFailure } : {},
     ...opts.drainedMore ? { drainedMore: true } : {},
     ...opts.hasMore ? { hasMore: true } : {},
     ...opts.drainComplete ? { drainComplete: true } : {}
   };
 }
-function hasMoreField(data) {
-  if (!data) return false;
-  return Object.prototype.hasOwnProperty.call(data, "has_more") || Object.prototype.hasOwnProperty.call(data, "hasMore");
-}
 async function drainInbox(ctx, opts, client = new ApiClient(ctx)) {
-  const agentPath = `/internal/agent/${encodeURIComponent(ctx.agentId)}`;
   const failCode = opts.block ? "WAIT_FAILED" : "CHECK_FAILED";
-  const query = [];
-  if (opts.block) query.push("block=true");
-  if (opts.block && opts.timeoutMs !== void 0) query.push(`timeout=${opts.timeoutMs}`);
-  const usesAgentApiSurface = ctx.clientMode === "managed-runner" || ctx.clientMode === "self-hosted-runner";
-  const path9 = query.length > 0 ? `${agentPath}/receive?${query.join("&")}` : `${agentPath}/receive`;
+  const agentApi = createAgentApiSurfaceClient(client);
   const allMessages = [];
   let sawHasMore = false;
   for (let round = 0; round < MAX_DRAIN_ROUNDS; round += 1) {
-    if (usesAgentApiSurface) {
-      const res2 = await createAgentApiSurfaceClient(client).events.get({ since: "latest" });
-      if (!res2.ok) {
-        if (allMessages.length > 0) {
-          return result(allMessages, { drainedMore: sawHasMore, hasMore: true });
-        }
-        throw new CliError({
-          code: res2.status >= 500 ? "SERVER_5XX" : failCode,
-          message: res2.error ?? `HTTP ${res2.status}`
-        });
-      }
-      const messages2 = res2.data?.events ?? [];
-      allMessages.push(...messages2);
-      const hasMore2 = res2.data?.has_more === true;
-      const drainComplete2 = !hasMore2 && allMessages.length > 0;
-      sawHasMore = sawHasMore || hasMore2;
-      if (hasMore2 && messages2.length > 0) continue;
-      return result(allMessages, { drainedMore: sawHasMore, hasMore: hasMore2, drainComplete: drainComplete2 });
-    }
-    const res = await client.request("GET", path9);
+    const res = await agentApi.events.get({ since: "latest" });
     if (!res.ok) {
       if (allMessages.length > 0) {
         return result(allMessages, { drainedMore: sawHasMore, hasMore: true });
@@ -48936,25 +50257,13 @@ async function drainInbox(ctx, opts, client = new ApiClient(ctx)) {
         message: res.error ?? `HTTP ${res.status}`
       });
     }
-    const messages = res.data?.messages ?? [];
+    const messages = res.data?.events ?? [];
     allMessages.push(...messages);
-    const hasMore = res.data?.has_more === true || res.data?.hasMore === true;
-    const hasExplicitHasMore = hasMoreField(res.data);
-    const drainComplete = hasExplicitHasMore && !hasMore && allMessages.length > 0;
+    const hasMore = res.data?.has_more === true;
+    const drainComplete = !hasMore && allMessages.length > 0;
     sawHasMore = sawHasMore || hasMore;
-    const seqs = messages.map((m) => m.seq).filter((s) => typeof s === "number" && Number.isInteger(s) && s > 0);
-    if (seqs.length === 0) return result(allMessages, { drainedMore: sawHasMore, hasMore, drainComplete });
-    const ack = await client.request("POST", `${agentPath}/receive-ack`, { seqs });
-    if (!ack.ok) {
-      const ackCode = ack.status >= 500 ? "SERVER_5XX" : "ACK_FAILED";
-      const ackMessage = ack.error ?? `HTTP ${ack.status}`;
-      return result(allMessages, {
-        ackFailure: { code: ackCode, message: ackMessage },
-        drainedMore: sawHasMore,
-        hasMore
-      });
-    }
-    if (!hasMore) return result(allMessages, { drainedMore: sawHasMore, drainComplete });
+    if (hasMore && messages.length > 0) continue;
+    return result(allMessages, { drainedMore: sawHasMore, hasMore, drainComplete });
   }
   return result(allMessages, { drainedMore: sawHasMore, hasMore: true });
 }
@@ -49062,7 +50371,7 @@ var messageReadCommand = defineCommand(
     const readOpts = validateReadOpts(opts);
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const agentApi = createAgentApiClient2(client, agentContext.agentId);
+    const agentApi = createAgentApiSurfaceClient(client);
     const res = await agentApi.history.read({
       channel: readOpts.channel,
       ...readOpts.before !== void 0 ? { before: readOpts.before } : {},
@@ -49137,29 +50446,53 @@ function parsePositiveInt3(name, raw) {
   }
   return n;
 }
-function normalizeSearchOpts(opts) {
-  const query = opts.query?.trim();
-  if (!query) {
+function parseNonNegativeInt(name, raw) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n < 0) {
     throw new CliError({
       code: "INVALID_ARG",
-      message: "--query is required"
+      message: `--${name} must be a non-negative integer; got ${raw}`
     });
   }
+  return n;
+}
+function normalizeSearchOpts(opts) {
+  const query = opts.query?.trim();
   if (opts.sort !== void 0 && opts.sort !== "relevance" && opts.sort !== "recent") {
     throw new CliError({
       code: "INVALID_ARG",
       message: `--sort must be "relevance" or "recent"; got ${opts.sort}`
     });
   }
+  const channel = opts.channel?.trim();
+  const sender = opts.sender ? normalizeMemberHandleRef(opts.sender) : void 0;
+  const hasFilter = Boolean(channel || sender || opts.before || opts.after);
+  if (!query && !hasFilter) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--query is required unless --sender, --channel, --before, or --after is provided"
+    });
+  }
+  if (!query && opts.sort === "relevance") {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--sort relevance requires --query; filter-only search is sorted by recent"
+    });
+  }
   const limit = parsePositiveInt3("limit", opts.limit);
+  const offset = parseNonNegativeInt("offset", opts.offset);
+  const sort = opts.sort ?? (query ? void 0 : "recent");
   return {
-    query,
-    ...opts.channel ? { channel: opts.channel } : {},
-    ...opts.sender ? { sender: normalizeMemberHandleRef(opts.sender) } : {},
-    ...opts.sort ? { sort: opts.sort } : {},
+    ...query ? { query } : {},
+    displayQuery: query ?? "",
+    ...channel ? { channel } : {},
+    ...sender ? { sender } : {},
+    ...sort ? { sort } : {},
     ...opts.before ? { before: opts.before } : {},
     ...opts.after ? { after: opts.after } : {},
-    ...limit !== void 0 ? { limit } : {}
+    ...limit !== void 0 ? { limit } : {},
+    ...offset !== void 0 ? { offset } : {}
   };
 }
 function toSearchErrorCode(errorCode2, status) {
@@ -49176,13 +50509,14 @@ var messageSearchCommand = defineCommand(
     name: "search",
     description: "Search messages across channels the agent can see",
     options: [
-      { flags: "--query <q>", description: "Search query string" },
+      { flags: "--query <q>", description: "Search query string (optional when filters are provided)" },
       { flags: "--channel <target>", description: "Restrict to a single channel/DM/thread" },
       { flags: "--sender <handle>", description: "Restrict to messages by sender handle, e.g. @alice" },
-      { flags: "--sort <mode>", description: "Sort results by relevance or recent (default: relevance)" },
+      { flags: "--sort <mode>", description: "Sort results by relevance or recent (default: relevance; filter-only searches use recent)" },
       { flags: "--before <iso>", description: "Only messages before this ISO datetime" },
       { flags: "--after <iso>", description: "Only messages after this ISO datetime" },
-      { flags: "--limit <n>", description: "Max results (server default applies if omitted)" }
+      { flags: "--limit <n>", description: "Max results (server default applies if omitted)" },
+      { flags: "--offset <n>", description: "Skip this many results (server default applies if omitted)" }
     ]
   },
   async (ctx, opts) => {
@@ -49191,13 +50525,14 @@ var messageSearchCommand = defineCommand(
     const client = ctx.createApiClient(agentContext);
     const agentApi = createAgentApiSurfaceClient(client);
     const res = await agentApi.messages.search({
-      q: searchOpts.query,
+      ...searchOpts.query ? { q: searchOpts.query } : {},
       ...searchOpts.channel ? { channel: searchOpts.channel } : {},
       ...searchOpts.sender ? { sender: searchOpts.sender } : {},
       ...searchOpts.sort ? { sort: searchOpts.sort } : {},
       ...searchOpts.before ? { before: searchOpts.before } : {},
       ...searchOpts.after ? { after: searchOpts.after } : {},
-      ...searchOpts.limit !== void 0 ? { limit: String(searchOpts.limit) } : {}
+      ...searchOpts.limit !== void 0 ? { limit: String(searchOpts.limit) } : {},
+      ...searchOpts.offset !== void 0 ? { offset: String(searchOpts.offset) } : {}
     });
     if (!res.ok) {
       throw new CliError({
@@ -49205,7 +50540,7 @@ var messageSearchCommand = defineCommand(
         message: res.error ?? `HTTP ${res.status}`
       });
     }
-    writeText(ctx.io, `${formatSearchResults(searchOpts.query, res.data)}
+    writeText(ctx.io, `${formatSearchResults(searchOpts.displayQuery, res.data)}
 `);
   }
 );
@@ -49255,7 +50590,7 @@ var messageResolveCommand = defineCommand(
     }
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const res = await createAgentApiClient2(client, agentContext.agentId).messages.resolve({ msgId: asMessageId(id) });
+    const res = await createAgentApiSurfaceClient(client).messages.resolve({ msgId: asMessageId(id) });
     if (!res.ok) {
       const mapped = mapResolveError(res);
       throw new CliError(mapped);
@@ -49314,7 +50649,7 @@ var messageReactCommand = defineCommand(
     }
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const agentApi = createAgentApiClient2(client, agentContext.agentId);
+    const agentApi = createAgentApiSurfaceClient(client);
     const messageId = asMessageId(opts.messageId.trim());
     const res = opts.remove ? await agentApi.messages.removeReaction({ msgId: messageId }, { emoji: emoji3 }) : await agentApi.messages.addReaction({ msgId: messageId }, { emoji: emoji3 });
     if (!res.ok) {
@@ -49332,11 +50667,11 @@ function registerReactCommand(parent, runtimeOptions = {}) {
 
 // src/commands/attachment/upload.ts
 init_esm_shims();
-import { existsSync, statSync, readFileSync as readFileSync2 } from "fs";
-import { basename } from "path";
+import { existsSync as existsSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
+import { basename as basename2 } from "path";
 var MAX_ATTACHMENT_UPLOAD_BYTES = 50 * 1024 * 1024;
 var MAX_ATTACHMENT_UPLOAD_LABEL = "50MB";
-var FILENAME_MIME_MAP = {
+var FILENAME_MIME_MAP2 = {
   ".jpg": "image/jpeg",
   ".jpeg": "image/jpeg",
   ".png": "image/png",
@@ -49359,7 +50694,7 @@ var AttachmentUploadArgError = class extends Error {
 function inferMimeTypeFromFilename(filename) {
   const index = filename.lastIndexOf(".");
   const ext = index >= 0 ? filename.slice(index).toLowerCase() : "";
-  return FILENAME_MIME_MAP[ext] || null;
+  return FILENAME_MIME_MAP2[ext] || null;
 }
 function inferMimeTypeFromBuffer(buffer) {
   if (buffer.length >= 8 && buffer.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
@@ -49434,10 +50769,10 @@ var attachmentUploadCommand = defineCommand(
     if (typeof opts.path !== "string" || opts.path.length === 0) {
       throw cliError("INVALID_ARG", "--path is required");
     }
-    if (!existsSync(opts.path)) {
+    if (!existsSync2(opts.path)) {
       throw cliError("INVALID_ARG", `--path does not exist: ${opts.path}`);
     }
-    const stat2 = statSync(opts.path);
+    const stat2 = statSync2(opts.path);
     if (!stat2.isFile()) {
       throw cliError("INVALID_ARG", `--path is not a regular file: ${opts.path}`);
     }
@@ -49453,8 +50788,8 @@ var attachmentUploadCommand = defineCommand(
         "v0 server requires a channel to attach the upload to. Pass --channel '#name', 'dm:@peer', or a thread target."
       );
     }
-    const buffer = readFileSync2(opts.path);
-    const filename = basename(opts.path);
+    const buffer = readFileSync3(opts.path);
+    const filename = basename2(opts.path);
     let explicitMimeType;
     try {
       explicitMimeType = normalizeExplicitMimeType(opts.mimeType);
@@ -49531,17 +50866,20 @@ var attachmentViewCommand = defineCommand(
     const { id, output } = validateViewOpts(opts);
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const res = await client.requestRaw(
-      "GET",
-      `/api/attachments/${encodeURIComponent(id)}`
-    );
+    const res = await createAgentApiSurfaceClient(client).attachments.view({ attachmentId: id });
     if (!res.ok) {
       throw new CliError({
         code: res.status >= 500 ? "SERVER_5XX" : "VIEW_FAILED",
         message: res.error ?? `HTTP ${res.status}`
       });
     }
-    const buffer = Buffer.from(await res.response.arrayBuffer());
+    if (res.data === null) {
+      throw new CliError({
+        code: "VIEW_FAILED",
+        message: "Attachment download returned no bytes"
+      });
+    }
+    const buffer = Buffer.from(res.data);
     writeFileSync(output, buffer);
     writeText(ctx.io, `Downloaded to: ${output}
 `);
@@ -49591,11 +50929,9 @@ var attachmentCommentsCommand = defineCommand(
     }
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const limitParam = opts.limit && Number.isFinite(Number(opts.limit)) ? `?limit=${Number(opts.limit)}` : "";
-    const res = await client.request(
-      "GET",
-      `/api/attachments/${encodeURIComponent(id)}/comments${limitParam}`
-    );
+    const agentApi = createAgentApiSurfaceClient(client);
+    const limit = opts.limit && Number.isFinite(Number(opts.limit)) ? String(Number(opts.limit)) : void 0;
+    const res = await agentApi.attachments.comments({ attachmentId: id }, limit ? { limit } : {});
     if (!res.ok || !res.data) {
       const code = res.status >= 500 ? "SERVER_5XX" : "COMMENTS_FAILED";
       throw new CliError({ code, message: res.error ?? `HTTP ${res.status}` });
@@ -49658,7 +50994,7 @@ function formatClaimResults(channel, data) {
       const msgShort = r.messageId ? r.messageId.slice(0, 8) : "";
       return `${label} (msg:${msgShort}): claimed`;
     }
-    return `${label}: FAILED \u2014 ${r.reason || "already claimed"}. Do not reply.`;
+    return `${label}: FAILED \u2014 ${r.reason || "already claimed"}. Do not work on this task unless an owner/admin explicitly redirects it to you.`;
   });
   const succeeded = data.results.filter((r) => r.success).length;
   const failed = data.results.length - succeeded;
@@ -50011,7 +51347,7 @@ function buildMentionExecuteCommand(action) {
       const ids = normalizeResolutionIds(resolutionIds);
       const agentContext = ctx.loadAgentContext();
       const client = ctx.createApiClient(agentContext);
-      const res = await createAgentApiClient2(client, agentContext.agentId).mentions.executeAction({
+      const res = await createAgentApiSurfaceClient(client).mentions.executeAction({
         action,
         resolutionIds: ids
       });
@@ -50043,7 +51379,7 @@ var mentionPendingCommand = defineCommand(
   async (ctx, opts = {}) => {
     const agentContext = ctx.loadAgentContext();
     const client = ctx.createApiClient(agentContext);
-    const res = await createAgentApiClient2(client, agentContext.agentId).mentions.pendingActions();
+    const res = await createAgentApiSurfaceClient(client).mentions.pendingActions();
     if (!res.ok || !res.data) {
       throw cliError(res.status >= 500 ? "SERVER_5XX" : "MENTION_PENDING_FAILED", res.error ?? `HTTP ${res.status}`);
     }
@@ -50067,69 +51403,6 @@ function registerMentionCommands(parent, runtimeOptions = {}) {
 
 // src/commands/profile/show.ts
 init_esm_shims();
-
-// src/commands/profile/_format.ts
-init_esm_shims();
-function formatCreatedAgents(createdAgents) {
-  if (createdAgents.length === 0) {
-    return ["- Created Agents: none"];
-  }
-  return [
-    `- Created Agents (${createdAgents.length}):`,
-    ...createdAgents.map((createdAgent) => `  - @${createdAgent.name} (${getRuntimeDisplayName(createdAgent.runtime)}, ${createdAgent.status})`)
-  ];
-}
-function formatHumanProfile(profile) {
-  const lines = [
-    "## Profile",
-    "",
-    "- Type: human",
-    `- Handle: @${profile.name}`,
-    `- Display Name: ${profile.displayName ?? "(none)"}`,
-    `- Description: ${profile.description ?? "(none)"}`,
-    `- Membership: ${profile.membershipStatus}`
-  ];
-  if (profile.role) lines.push(`- Role: ${profile.role}`);
-  if (profile.joinedAt) lines.push(`- Joined: ${profile.joinedAt}`);
-  if (profile.email) lines.push(`- Email: ${profile.email}`);
-  return [...lines, ...formatCreatedAgents(profile.createdAgents)].join("\n");
-}
-function formatCreator(profile) {
-  if (!profile.creator) return null;
-  return profile.creator.displayName ? `${profile.creator.displayName} (@${profile.creator.name})` : `@${profile.creator.name}`;
-}
-function formatAgentProfile(profile) {
-  const lines = [
-    "## Profile",
-    "",
-    "- Type: agent",
-    `- Handle: @${profile.name}`,
-    `- Display Name: ${profile.displayName ?? "(none)"}`,
-    `- Description: ${profile.description ?? "(none)"}`,
-    `- Status: ${profile.status}`,
-    `- Role: ${profile.serverRole}`,
-    `- Runtime: ${getRuntimeDisplayName(profile.runtime)}`,
-    `- Model: ${profile.model}`,
-    `- Reasoning: ${profile.reasoningEffort ?? "medium"}`
-  ];
-  if (profile.executionMode) lines.push(`- Execution: ${profile.executionMode}`);
-  if (profile.computerName || profile.computerId) {
-    const label = profile.computerName && profile.computerId ? `${profile.computerName} (${profile.computerId})` : profile.computerName ?? profile.computerId;
-    lines.push(`- Computer: ${label}`);
-  }
-  if (profile.computerHostname) lines.push(`- Hostname: ${profile.computerHostname}`);
-  if (profile.daemonVersion) lines.push(`- Daemon: v${profile.daemonVersion}`);
-  lines.push(`- Created: ${profile.createdAt}`);
-  if (profile.deletedAt) lines.push(`- Deleted At: ${profile.deletedAt}`);
-  const creator = formatCreator(profile);
-  if (creator) lines.push(`- Creator: ${creator}`);
-  return [...lines, ...formatCreatedAgents(profile.createdAgents)].join("\n");
-}
-function formatProfile(profile) {
-  return profile.kind === "human" ? formatHumanProfile(profile) : formatAgentProfile(profile);
-}
-
-// src/commands/profile/show.ts
 function normalizeTarget(target) {
   if (target === void 0) return null;
   const trimmed = target.trim();
@@ -50179,177 +51452,6 @@ function registerProfileShowCommand(parent, runtimeOptions) {
   registerCliCommand(parent, profileShowCommand, runtimeOptions);
 }
 
-// src/commands/profile/update.ts
-init_esm_shims();
-import { basename as basename2 } from "path";
-import { existsSync as existsSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
-var MAX_PROFILE_AVATAR_BYTES = 2 * 1024 * 1024;
-var PROFILE_AVATAR_MIME_TYPES = /* @__PURE__ */ new Set([
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp"
-]);
-var FILENAME_MIME_MAP2 = {
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".png": "image/png",
-  ".gif": "image/gif",
-  ".webp": "image/webp"
-};
-var MAX_PROFILE_DESCRIPTION_LENGTH = 3e3;
-var MAX_PROFILE_DISPLAY_NAME_LENGTH = 80;
-function inferImageMimeType(filename, buffer) {
-  const lowerFilename = filename.toLowerCase();
-  if (buffer.length >= 8 && buffer.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
-    return "image/png";
-  }
-  if (buffer.length >= 3 && buffer.subarray(0, 3).equals(Buffer.from([255, 216, 255]))) {
-    return "image/jpeg";
-  }
-  if (buffer.length >= 6) {
-    const header = buffer.subarray(0, 6).toString("ascii");
-    if (header === "GIF87a" || header === "GIF89a") return "image/gif";
-  }
-  if (buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP") {
-    return "image/webp";
-  }
-  const dot = lowerFilename.lastIndexOf(".");
-  return dot >= 0 ? FILENAME_MIME_MAP2[lowerFilename.slice(dot)] ?? null : null;
-}
-function readAvatarFile(avatarFile) {
-  if (!existsSync2(avatarFile)) {
-    throw cliError("PROFILE_FILE_NOT_FOUND", `Avatar file does not exist: ${avatarFile}`);
-  }
-  const stat2 = statSync2(avatarFile);
-  if (!stat2.isFile()) {
-    throw cliError("PROFILE_FILE_NOT_FOUND", `Avatar file is not a regular file: ${avatarFile}`);
-  }
-  if (stat2.size > MAX_PROFILE_AVATAR_BYTES) {
-    throw cliError(
-      "PROFILE_AVATAR_TOO_LARGE",
-      `Avatar file is ${stat2.size} bytes; max size is ${MAX_PROFILE_AVATAR_BYTES} bytes`
-    );
-  }
-  const buffer = readFileSync3(avatarFile);
-  const filename = basename2(avatarFile);
-  const mimeType = inferImageMimeType(filename, buffer);
-  if (!mimeType || !PROFILE_AVATAR_MIME_TYPES.has(mimeType)) {
-    throw cliError(
-      "PROFILE_AVATAR_BAD_FORMAT",
-      "Avatar must be a JPEG, PNG, GIF, or WebP image"
-    );
-  }
-  return { filename, buffer, mimeType };
-}
-function normalizeAvatarUrl(avatarUrl) {
-  const trimmed = avatarUrl.trim();
-  if (trimmed.length === 0) {
-    throw cliError("INVALID_ARG", "--avatar-url must not be empty");
-  }
-  if (!trimmed.startsWith("pixel:")) {
-    throw cliError("INVALID_ARG", "--avatar-url currently supports only pixel avatar URLs; use --avatar-file for image uploads");
-  }
-  return trimmed;
-}
-var profileUpdateCommand = defineCommand(
-  {
-    name: "update",
-    description: "Update your own profile",
-    options: [
-      { flags: "--avatar-file <path>", description: "Path to a local image file to use as your avatar" },
-      { flags: "--avatar-url <value>", description: "Set a pixel avatar URL such as pixel:random:<seed>" },
-      { flags: "--display-name <name>", description: "Set your display name (non-empty)" },
-      { flags: "--description <text>", description: "Set your profile description (non-empty)" },
-      { flags: "--json", description: "Emit machine-readable JSON" }
-    ]
-  },
-  async (ctx, opts) => {
-    const hasAvatar = opts.avatarFile !== void 0;
-    const hasAvatarUrl = opts.avatarUrl !== void 0;
-    const hasDisplayName = opts.displayName !== void 0;
-    const hasDescription = opts.description !== void 0;
-    if (!hasAvatar && !hasAvatarUrl && !hasDisplayName && !hasDescription) {
-      throw cliError("INVALID_ARG", "Provide at least one of --avatar-file, --avatar-url, --display-name, or --description");
-    }
-    if (hasAvatar && hasAvatarUrl) {
-      throw cliError("INVALID_ARG", "Use either --avatar-file or --avatar-url, not both");
-    }
-    let normalizedAvatarUrl;
-    if (hasAvatarUrl) {
-      normalizedAvatarUrl = normalizeAvatarUrl(opts.avatarUrl);
-    }
-    let trimmedDisplayName;
-    if (hasDisplayName) {
-      trimmedDisplayName = opts.displayName.trim();
-      if (trimmedDisplayName.length === 0) {
-        throw cliError("INVALID_ARG", "--display-name must not be empty");
-      }
-      if (trimmedDisplayName.length > MAX_PROFILE_DISPLAY_NAME_LENGTH) {
-        throw cliError("INVALID_ARG", `--display-name must be at most ${MAX_PROFILE_DISPLAY_NAME_LENGTH} characters`);
-      }
-    }
-    if (hasDescription) {
-      if (opts.description.length === 0) {
-        throw cliError("INVALID_ARG", "--description must not be empty");
-      }
-      if (opts.description.length > MAX_PROFILE_DESCRIPTION_LENGTH) {
-        throw cliError("INVALID_ARG", `--description must be at most ${MAX_PROFILE_DESCRIPTION_LENGTH} characters`);
-      }
-    }
-    const avatar = hasAvatar ? readAvatarFile(opts.avatarFile) : null;
-    const agentContext = ctx.loadAgentContext();
-    const client = ctx.createApiClient(agentContext);
-    const agentApi = createAgentApiSurfaceClient(client);
-    let latestProfile = null;
-    if (hasAvatarUrl || hasDisplayName || hasDescription) {
-      const body = {};
-      if (hasAvatarUrl) {
-        body.avatarUrl = normalizedAvatarUrl;
-      }
-      if (hasDisplayName) {
-        body.displayName = trimmedDisplayName;
-      }
-      if (hasDescription) {
-        body.description = opts.description;
-      }
-      const res = await agentApi.profile.update(body);
-      if (!res.ok || !res.data) {
-        const code = res.errorCode ?? (res.status >= 500 ? "SERVER_5XX" : "PROFILE_UPDATE_FAILED");
-        throw cliError(code, res.error ?? `HTTP ${res.status}`);
-      }
-      latestProfile = res.data;
-    }
-    if (hasAvatar) {
-      const form = new FormData();
-      const avatarBytes = Uint8Array.from(avatar.buffer);
-      form.append("avatar", new Blob([avatarBytes], { type: avatar.mimeType }), avatar.filename);
-      const res = await client.requestMultipart(
-        "POST",
-        "/internal/agent-api/profile/avatar",
-        form
-      );
-      if (!res.ok || !res.data) {
-        const code = res.errorCode ?? (res.status >= 500 ? "SERVER_5XX" : "PROFILE_UPDATE_FAILED");
-        throw cliError(code, res.error ?? `HTTP ${res.status}`);
-      }
-      latestProfile = res.data;
-    }
-    if (!latestProfile) {
-      throw cliError("PROFILE_UPDATE_FAILED", "No profile returned from server");
-    }
-    if (opts.json) {
-      writeJson(ctx.io, { ok: true, data: latestProfile });
-      return;
-    }
-    writeText(ctx.io, `${formatProfile(latestProfile)}
-`);
-  }
-);
-function registerProfileUpdateCommand(parent, runtimeOptions = {}) {
-  registerCliCommand(parent, profileUpdateCommand, runtimeOptions);
-}
-
 // src/commands/integration/list.ts
 init_esm_shims();
 
@@ -50378,6 +51480,7 @@ function pushServiceBlock(lines, service, active) {
   if (service.agentManifestUrl) {
     lines.push(`  agent behavior manifest: ${service.agentManifestUrl}`);
     lines.push(`  local CLI env: raft integration env --service ${JSON.stringify(service.clientId)}`);
+    lines.push(`  if manifest exposes HTTP API actions: raft integration invoke --service ${JSON.stringify(service.clientId)} --list-actions`);
   }
   if (service.homepageUrl) lines.push(`  homepage: ${service.homepageUrl}`);
   if (service.description) lines.push(`  description: ${service.description}`);
@@ -50417,6 +51520,7 @@ function formatIntegrationList(data) {
       if (login.agentManifestUrl) {
         lines.push(`  agent behavior manifest: ${login.agentManifestUrl}`);
         lines.push(`  local CLI env: raft integration env --service ${JSON.stringify(login.clientId)}`);
+        lines.push(`  if manifest exposes HTTP API actions: raft integration invoke --service ${JSON.stringify(login.clientId)} --list-actions`);
       }
       lines.push(`  created: ${login.createdAt}`);
     }
@@ -50453,14 +51557,15 @@ function formatIntegrationLogin(data) {
   if (data.service.agentManifestUrl) {
     lines.push(`agent behavior manifest: ${data.service.agentManifestUrl}`);
     lines.push(`local CLI env: raft integration env --service ${JSON.stringify(data.service.clientId)}`);
+    lines.push(`if manifest exposes HTTP API actions: raft integration invoke --service ${JSON.stringify(data.service.clientId)} --list-actions`);
   }
   lines.push("complete: this agent login is configured in Slock; no human OAuth is required");
   lines.push("identity: run `raft profile show` if the service or human asks for your Slock Agent identity card");
   const callbackHandoffUrl = buildAgentCallbackHandoffUrl(data.service.returnUrl, data.requestId);
   if (callbackHandoffUrl) {
     lines.push(`service callback handoff URL: ${callbackHandoffUrl}`);
-    lines.push("warning: this is the registered OAuth callback with an Agent Login request code, not a browser app URL");
-    lines.push("next: open it only if the service documents a stateless Agent Login callback; otherwise use the service docs, API, or manifest entry point");
+    lines.push("note: stateless Login with Raft API-action services use this callback once to create their service session");
+    lines.push(`next: prefer \`raft integration invoke --service ${JSON.stringify(data.service.clientId)} --list-actions\` when the service manifest exposes actions`);
   } else {
     lines.push("next: use the service, or run `raft integration list` to confirm active login");
   }
@@ -50563,7 +51668,10 @@ import os4 from "os";
 import path8 from "path";
 var AGENT_MANIFEST_MAX_BYTES = 64 * 1024;
 var AGENT_MANIFEST_SCHEMA_V0 = "slock-agent-manifest.v0";
+var RAFT_AGENT_MANIFEST_SCHEMA_V0 = "raft-agent-manifest.v0";
 var AGENT_MANIFEST_SCHEMA_V0_URL = "https://app.slock.ai/schemas/agent-manifest.v0.json";
+var RAFT_AGENT_MANIFEST_WELL_KNOWN_PATH = "/.well-known/raft-agent-manifest.json";
+var SLOCK_AGENT_MANIFEST_WELL_KNOWN_PATH = "/.well-known/slock-agent-manifest.json";
 var AgentManifestFetchError = class extends Error {
   constructor(message, status) {
     super(message);
@@ -50608,10 +51716,125 @@ function requireCommand(value) {
   }
   return command;
 }
+function requireName(value, field) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`${field} must be a non-empty string`);
+  }
+  const name = value.trim();
+  if (!/^[A-Za-z0-9._:-]{1,80}$/.test(name)) {
+    throw new Error(`${field} may only contain letters, digits, dot, underscore, colon, or dash`);
+  }
+  return name;
+}
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function requireEndpointPath(value, field) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`${field} must be a non-empty path string`);
+  }
+  const path9 = value.trim();
+  if (!path9.startsWith("/")) {
+    throw new Error(`${field} must start with /`);
+  }
+  if (path9.startsWith("//")) {
+    throw new Error(`${field} must be a relative service path`);
+  }
+  try {
+    const parsed = new URL(path9, "https://manifest.local");
+    if (parsed.origin !== "https://manifest.local" || parsed.username || parsed.password || parsed.hash) {
+      throw new Error();
+    }
+  } catch {
+    throw new Error(`${field} must be a relative service path`);
+  }
+  return path9;
+}
+function normalizeActionMethod(value) {
+  if (typeof value !== "string") {
+    throw new Error("actions[].endpoint.method must be a string");
+  }
+  const method = value.trim().toUpperCase();
+  if (method !== "GET" && method !== "POST" && method !== "PUT" && method !== "PATCH" && method !== "DELETE") {
+    throw new Error("actions[].endpoint.method must be GET, POST, PUT, PATCH, or DELETE");
+  }
+  return method;
+}
+function normalizeActionFields(value, field) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) throw new Error(`${field} must be an object when present`);
+  const fields = {};
+  for (const [key, raw] of Object.entries(value)) {
+    const name = requireName(key, `${field} key`);
+    if (!isRecord(raw)) throw new Error(`${field}.${name} must be an object`);
+    if (typeof raw.type !== "string" || !raw.type.trim()) {
+      throw new Error(`${field}.${name}.type must be a non-empty string`);
+    }
+    fields[name] = {
+      type: raw.type.trim(),
+      description: optionalString(raw.description),
+      required: raw.required === true
+    };
+  }
+  return fields;
+}
+function normalizeActionReturns(value) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) throw new Error("actions[].returns must be an object when present");
+  const fields = {};
+  for (const [key, raw] of Object.entries(value)) {
+    const name = requireName(key, "actions[].returns key");
+    if (!isRecord(raw)) throw new Error(`actions[].returns.${name} must be an object`);
+    if (typeof raw.type !== "string" || !raw.type.trim()) {
+      throw new Error(`actions[].returns.${name}.type must be a non-empty string`);
+    }
+    fields[name] = {
+      type: raw.type.trim(),
+      description: optionalString(raw.description)
+    };
+  }
+  return fields;
+}
+function normalizeActions(value) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new Error("actions must be an array when present");
+  const actions = value.map((raw, index) => {
+    if (!isRecord(raw)) throw new Error(`actions[${index}] must be an object`);
+    const endpoint = raw.endpoint;
+    if (!isRecord(endpoint)) throw new Error(`actions[${index}].endpoint must be an object`);
+    return {
+      name: requireName(raw.name, `actions[${index}].name`),
+      description: optionalString(raw.description),
+      endpoint: {
+        method: normalizeActionMethod(endpoint.method),
+        path: requireEndpointPath(endpoint.path, `actions[${index}].endpoint.path`)
+      },
+      parameters: normalizeActionFields(raw.parameters, `actions[${index}].parameters`),
+      returns: normalizeActionReturns(raw.returns)
+    };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const action of actions) {
+    if (seen.has(action.name)) throw new Error(`duplicate action name: ${action.name}`);
+    seen.add(action.name);
+  }
+  return actions;
+}
+function normalizeAuth(value) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) throw new Error("auth must be an object when present");
+  if (value.type !== "login_with_raft") {
+    throw new Error("auth.type must be login_with_raft");
+  }
+  return {
+    type: "login_with_raft",
+    login_url: value.login_url === void 0 ? void 0 : requireUrl(value.login_url, "auth.login_url")
+  };
+}
 function validateAgentManifestV0(value) {
   if (!isRecord(value)) throw new Error("manifest must be a JSON object");
-  if (value.schema !== AGENT_MANIFEST_SCHEMA_V0 && value.schema !== AGENT_MANIFEST_SCHEMA_V0_URL) {
-    throw new Error(`manifest schema must be ${AGENT_MANIFEST_SCHEMA_V0}`);
+  if (value.schema !== AGENT_MANIFEST_SCHEMA_V0 && value.schema !== RAFT_AGENT_MANIFEST_SCHEMA_V0 && value.schema !== AGENT_MANIFEST_SCHEMA_V0_URL) {
+    throw new Error(`manifest schema must be ${AGENT_MANIFEST_SCHEMA_V0} or ${RAFT_AGENT_MANIFEST_SCHEMA_V0}`);
   }
   const execution = value.execution;
   if (!isRecord(execution)) throw new Error("execution must be an object");
@@ -50633,12 +51856,17 @@ function validateAgentManifestV0(value) {
   return {
     schema: AGENT_MANIFEST_SCHEMA_V0,
     service: typeof value.service === "string" && value.service.trim() ? value.service.trim() : void 0,
+    name: optionalString(value.name),
+    description: optionalString(value.description),
     docs_url: value.docs_url === void 0 ? void 0 : requireUrl(value.docs_url, "docs_url"),
+    app_origin: value.app_origin === void 0 ? void 0 : requireUrl(value.app_origin, "app_origin"),
     execution: {
       mode: execution.mode,
       command: execution.mode === "local_cli" ? requireCommand(execution.command) : void 0,
       base_url: execution.base_url === void 0 ? void 0 : requireUrl(execution.base_url, "execution.base_url")
     },
+    auth: normalizeAuth(value.auth),
+    actions: normalizeActions(value.actions),
     credential_boundary: credentialStorage ? {
       storage: credentialStorage,
       forbid_user_home: forbidUserHome
@@ -50686,13 +51914,45 @@ async function fetchAgentManifest(url2) {
   }
   return validateAgentManifestV0(parsedJson);
 }
+function wellKnownAliasUrl(url2) {
+  const parsed = new URL(url2);
+  if (parsed.pathname === RAFT_AGENT_MANIFEST_WELL_KNOWN_PATH) {
+    parsed.pathname = SLOCK_AGENT_MANIFEST_WELL_KNOWN_PATH;
+    return parsed.toString();
+  }
+  if (parsed.pathname === SLOCK_AGENT_MANIFEST_WELL_KNOWN_PATH) {
+    parsed.pathname = RAFT_AGENT_MANIFEST_WELL_KNOWN_PATH;
+    return parsed.toString();
+  }
+  return null;
+}
+function shouldTryWellKnownAlias(err) {
+  if (err instanceof AgentManifestFetchError) return err.status === 404 || err.status === 410;
+  return err instanceof AgentManifestResponseFormatError;
+}
+async function fetchAgentManifestWithWellKnownAliases(url2, fetchManifestImpl = fetchAgentManifest) {
+  try {
+    return await fetchManifestImpl(url2);
+  } catch (err) {
+    if (!shouldTryWellKnownAlias(err)) throw err;
+    const alias = wellKnownAliasUrl(url2);
+    if (!alias) throw err;
+    return await fetchManifestImpl(alias);
+  }
+}
 function sanitizePathSegment(value) {
   const segment = value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
   return segment || "service";
 }
-function resolveSlockHome(env) {
-  if (env.SLOCK_HOME?.trim()) return path8.resolve(env.SLOCK_HOME);
-  return path8.join(env.HOME ?? os4.homedir(), ".slock");
+function resolveSlockHome(env, homeDir = os4.homedir()) {
+  const configured = env.SLOCK_HOME?.trim() || env.RAFT_HOME?.trim();
+  const raw = configured && configured.length > 0 ? configured : path8.join(homeDir, ".slock");
+  return path8.resolve(expandHome(raw, homeDir));
+}
+function expandHome(input, homeDir) {
+  if (input === "~") return homeDir;
+  if (input.startsWith("~/")) return path8.join(homeDir, input.slice(2));
+  return input;
 }
 function buildLocalCliProfileEnv(input) {
   if (input.manifest.execution.mode !== "local_cli" || !input.manifest.execution.command) {
@@ -50704,7 +51964,7 @@ function buildLocalCliProfileEnv(input) {
   if (input.manifest.credential_boundary.forbid_user_home !== true) {
     throw new Error("manifest must set credential_boundary.forbid_user_home=true for local_cli isolation");
   }
-  const root = resolveSlockHome(input.env ?? process.env);
+  const root = resolveSlockHome(input.env ?? process.env, input.homeDir);
   const profileHome = path8.join(
     root,
     "integration-profiles",
@@ -50758,7 +52018,10 @@ function findService(data, service) {
 }
 function describeNoLocalEnv(manifest) {
   if (manifest.execution.mode !== "local_cli") {
-    return "manifest execution mode is not local_cli; no local CLI env is required";
+    if (manifest.actions && manifest.actions.length > 0) {
+      return "manifest exposes HTTP API actions; no local CLI env is required";
+    }
+    return "manifest execution mode is http_api; no local CLI env is required";
   }
   if (!manifest.credential_boundary) {
     return "manifest does not request a Slock-managed local environment";
@@ -50803,7 +52066,7 @@ async function resolveIntegrationEnv(input) {
       message: describeMissingManifest({ service: input.service })
     };
   }
-  const fetchManifestImpl = input.fetchManifest ?? fetchAgentManifest;
+  const fetchManifestImpl = input.fetchManifest ?? (isInferredWellKnownManifest(input.service) ? fetchAgentManifestWithWellKnownAliases : fetchAgentManifest);
   let manifest;
   try {
     manifest = await fetchManifestImpl(input.service.agentManifestUrl);
@@ -50842,13 +52105,19 @@ async function resolveIntegrationEnv(input) {
   }
 }
 function formatNoLocalEnv(input) {
-  return [
+  const lines = [
     `# Slock integration profile for ${input.service}`,
     input.manifestUrl ? `# manifest: ${input.manifestUrl}` : "# manifest: none declared",
     "# No local CLI environment exports are required for this service.",
-    `# ${input.message}`,
-    "# Slock did not set HOME/XDG exports and did not execute manifest commands."
-  ].join("\n");
+    `# ${input.message}`
+  ];
+  if (input.actions && input.actions.length > 0) {
+    lines.push(`# API actions: ${input.actions.join(", ")}`);
+    lines.push(`# list actions: raft integration invoke --service ${JSON.stringify(input.service)} --list-actions`);
+    lines.push(`# invoke action: raft integration invoke --service ${JSON.stringify(input.service)} --action <name>`);
+  }
+  lines.push("# Slock did not set HOME/XDG exports and did not execute manifest commands.");
+  return lines.join("\n");
 }
 var integrationEnvCommand = defineCommand(
   {
@@ -50892,6 +52161,7 @@ var integrationEnvCommand = defineCommand(
             manifestUrl: resolution.manifestUrl,
             requiresLocalEnv: false,
             command: resolution.manifest?.execution.command ?? null,
+            actions: resolution.manifest?.actions?.map((action) => action.name) ?? [],
             env: {},
             message: resolution.message
           }
@@ -50901,7 +52171,8 @@ var integrationEnvCommand = defineCommand(
       writeText(cmdCtx.io, `${formatNoLocalEnv({
         service: resolution.service.clientId,
         manifestUrl: resolution.manifestUrl,
-        message: resolution.message
+        message: resolution.message,
+        actions: resolution.manifest?.actions?.map((action) => action.name) ?? []
       })}
 `);
       return;
@@ -50928,8 +52199,19 @@ function registerIntegrationEnvCommand(parent, runtimeOptions = {}) {
   registerCliCommand(parent, integrationEnvCommand, runtimeOptions);
 }
 
-// src/commands/integration/app.ts
+// src/commands/integration/invoke.ts
 init_esm_shims();
+import fs6 from "fs";
+function normalizeService2(value) {
+  return value.trim().toLowerCase();
+}
+function findService2(data, service) {
+  const normalized = normalizeService2(service);
+  if (!normalized) return null;
+  return data.services.find(
+    (candidate) => candidate.id === service || normalizeService2(candidate.clientId) === normalized || normalizeService2(candidate.name) === normalized
+  ) ?? null;
+}
 function normalizeScopes2(raw) {
   if (!raw || raw.length === 0) return void 0;
   const scopes = Array.from(new Set(
@@ -50940,6 +52222,343 @@ function normalizeScopes2(raw) {
   }
   return scopes;
 }
+function parseHandlerArgs(serviceArgOrOpts, actionArgOrOpts, maybeOpts) {
+  if (typeof serviceArgOrOpts === "object" && serviceArgOrOpts !== null) {
+    return { opts: serviceArgOrOpts };
+  }
+  if (typeof actionArgOrOpts === "object" && actionArgOrOpts !== null) {
+    return { serviceArg: serviceArgOrOpts, opts: actionArgOrOpts };
+  }
+  return { serviceArg: serviceArgOrOpts, actionArg: actionArgOrOpts, opts: maybeOpts ?? {} };
+}
+function readTextReference(value) {
+  if (!value.startsWith("@")) return value;
+  const path9 = value.slice(1);
+  if (!path9) throw cliError("INVALID_ARG", "@ file references must include a path");
+  if (path9 === "-") return fs6.readFileSync(0, "utf8");
+  return fs6.readFileSync(path9, "utf8");
+}
+function parseJsonObject(raw, label) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw cliError("INVALID_ARG", `${label} is not valid JSON: ${err.message}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw cliError("INVALID_ARG", `${label} must be a JSON object`);
+  }
+  return parsed;
+}
+function parseActionPayload(opts) {
+  if (opts.dataJson && opts.dataFile) {
+    throw cliError("INVALID_ARG", "use only one of --data-json or --data-file");
+  }
+  const payload = {};
+  if (opts.dataJson) {
+    Object.assign(payload, parseJsonObject(opts.dataJson, "--data-json"));
+  }
+  if (opts.dataFile) {
+    const raw = opts.dataFile === "-" ? fs6.readFileSync(0, "utf8") : fs6.readFileSync(opts.dataFile, "utf8");
+    Object.assign(payload, parseJsonObject(raw, "--data-file"));
+  }
+  for (const rawParam of opts.param ?? []) {
+    const separator = rawParam.indexOf("=");
+    if (separator <= 0) {
+      throw cliError("INVALID_ARG", "--param values must use key=value");
+    }
+    const key = rawParam.slice(0, separator).trim();
+    if (!key) throw cliError("INVALID_ARG", "--param keys must not be empty");
+    payload[key] = readTextReference(rawParam.slice(separator + 1));
+  }
+  return payload;
+}
+function validateRequiredParams(action, payload) {
+  for (const [name, spec] of Object.entries(action.parameters ?? {})) {
+    if (!spec.required) continue;
+    if (payload[name] === void 0 || payload[name] === null || payload[name] === "") {
+      throw cliError("INVALID_ARG", `missing required parameter ${name}`);
+    }
+  }
+}
+function safeUrl(value, label) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw cliError("INVALID_ARG", `${label} must be a valid URL`);
+  }
+  if (url2.protocol !== "https:" && url2.protocol !== "http:") {
+    throw cliError("INVALID_ARG", `${label} must use http or https`);
+  }
+  if (url2.username || url2.password) {
+    throw cliError("INVALID_ARG", `${label} must not include credentials`);
+  }
+  return url2;
+}
+function resolveActionUrl(input) {
+  const base = input.manifest.execution.base_url ?? input.manifest.app_origin ?? input.service.homepageUrl ?? (input.service.returnUrl ? safeUrl(input.service.returnUrl, "service return URL").origin : null);
+  if (!base) {
+    throw cliError(
+      "INVALID_ARG",
+      "manifest must provide execution.base_url or app_origin, or the service must provide a homepage/return URL"
+    );
+  }
+  const baseUrl = safeUrl(base, "action base URL");
+  return new URL(input.action.endpoint.path, baseUrl);
+}
+function cookieHeaderFromSetCookie(headers) {
+  const getSetCookie = headers.getSetCookie;
+  const values = typeof getSetCookie === "function" ? getSetCookie.call(headers) : [headers.get("set-cookie")].filter((value) => Boolean(value));
+  const cookies = values.map((value) => value.split(";")[0]?.trim()).filter((value) => Boolean(value));
+  return cookies.length > 0 ? cookies.join("; ") : null;
+}
+async function establishServiceSession(input) {
+  const callbackUrl = buildAgentCallbackHandoffUrl(input.service.returnUrl, input.login.requestId);
+  if (!callbackUrl) {
+    throw cliError("INTEGRATION_INVOKE_FAILED", "service return URL cannot be used for Agent Login callback handoff");
+  }
+  const response = await fetch(callbackUrl, {
+    method: "GET",
+    redirect: "manual",
+    headers: { accept: "text/html,application/json" }
+  });
+  if (response.status < 200 || response.status >= 400) {
+    throw cliError("INTEGRATION_INVOKE_FAILED", `service callback handoff failed with HTTP ${response.status}`);
+  }
+  const cookie = cookieHeaderFromSetCookie(response.headers);
+  if (!cookie) {
+    throw cliError(
+      "INTEGRATION_INVOKE_FAILED",
+      "service callback handoff did not set a session cookie; the service may not support stateless Agent Login API actions yet"
+    );
+  }
+  return cookie;
+}
+function appendPayloadAsQuery(url2, payload) {
+  for (const [key, value] of Object.entries(payload)) {
+    if (value === void 0 || value === null) continue;
+    url2.searchParams.set(key, typeof value === "string" ? value : JSON.stringify(value));
+  }
+}
+async function invokeHttpAction(input) {
+  const url2 = new URL(input.url);
+  const headers = {
+    accept: "application/json,text/plain,*/*",
+    cookie: input.cookie
+  };
+  const init = {
+    method: input.action.endpoint.method,
+    headers,
+    redirect: "follow"
+  };
+  if (input.action.endpoint.method === "GET") {
+    appendPayloadAsQuery(url2, input.payload);
+  } else {
+    headers["content-type"] = "application/json";
+    init.body = JSON.stringify(input.payload);
+  }
+  const response = await fetch(url2, init);
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    const value2 = await response.json().catch(() => {
+      throw cliError("INVALID_JSON_RESPONSE", `service action returned invalid JSON (HTTP ${response.status})`);
+    });
+    if (!response.ok) {
+      const message = value2 && typeof value2 === "object" && "error" in value2 ? String(value2.error) : `service action failed with HTTP ${response.status}`;
+      throw cliError("INTEGRATION_INVOKE_FAILED", message);
+    }
+    return { kind: "json", status: response.status, value: value2 };
+  }
+  const value = await response.text();
+  if (!response.ok) {
+    throw cliError("INTEGRATION_INVOKE_FAILED", value || `service action failed with HTTP ${response.status}`);
+  }
+  return { kind: "text", status: response.status, value };
+}
+function formatActions(input) {
+  const actions = input.manifest.actions ?? [];
+  const lines = [
+    `Actions for ${input.service.name}`,
+    `service: ${input.service.clientId}`,
+    `manifest: ${input.manifestUrl}`
+  ];
+  if (actions.length === 0) {
+    lines.push("- none");
+    return lines.join("\n");
+  }
+  for (const action of actions) {
+    const required2 = Object.entries(action.parameters ?? {}).filter(([, param]) => param.required).map(([name]) => name);
+    lines.push(`- ${action.name}`);
+    lines.push(`  endpoint: ${action.endpoint.method} ${action.endpoint.path}`);
+    if (action.description) lines.push(`  description: ${action.description}`);
+    if (required2.length > 0) lines.push(`  required params: ${required2.join(", ")}`);
+  }
+  lines.push(`next: raft integration invoke --service ${JSON.stringify(input.service.clientId)} --action ${JSON.stringify(actions[0]?.name ?? "<name>")}`);
+  return lines.join("\n");
+}
+function pickViewerUrl(value) {
+  return value && typeof value === "object" && typeof value.viewerUrl === "string" ? value.viewerUrl : null;
+}
+function formatActionResult(input) {
+  const lines = [
+    `Action invoked: ${input.action.name}`,
+    `service: ${input.service.clientId}`,
+    `status: HTTP ${input.result.status}`
+  ];
+  if (input.result.kind === "json") {
+    const viewerUrl = pickViewerUrl(input.result.value);
+    if (viewerUrl) lines.push(`viewer URL: ${viewerUrl}`);
+    lines.push("result:");
+    lines.push(JSON.stringify(input.result.value, null, 2));
+  } else if (input.result.value) {
+    lines.push("result:");
+    lines.push(input.result.value);
+  }
+  return lines.join("\n");
+}
+async function fetchManifestForInvoke(service) {
+  if (!service.agentManifestUrl) {
+    throw cliError("INTEGRATION_MANIFEST_MISSING", `${service.name} does not expose an agent behavior manifest`);
+  }
+  try {
+    const fetchManifest = service.agentManifestUrlSource === "well_known" ? fetchAgentManifestWithWellKnownAliases : fetchAgentManifest;
+    return await fetchManifest(service.agentManifestUrl);
+  } catch (err) {
+    if (err instanceof AgentManifestFetchError && (err.status === 404 || err.status === 410)) {
+      throw cliError("INTEGRATION_MANIFEST_MISSING", "agent behavior manifest was not found", { cause: err });
+    }
+    if (err instanceof AgentManifestResponseFormatError) {
+      throw cliError("INTEGRATION_MANIFEST_INVALID", err.message, { cause: err });
+    }
+    throw cliError("INTEGRATION_MANIFEST_INVALID", err.message, { cause: err });
+  }
+}
+var integrationInvokeCommand = defineCommand(
+  {
+    name: "invoke",
+    description: "Invoke a manifest-backed HTTP API action for a registered integration",
+    arguments: ["[service]", "[action]"],
+    options: [
+      { flags: "--service <id>", description: "Registered service id, client id, or exact service name" },
+      { flags: "--action <name>", description: "Manifest action name to invoke" },
+      { flags: "--list-actions", description: "List manifest actions instead of invoking one" },
+      {
+        flags: "--param <key=value>",
+        description: "Action parameter; repeatable. Use key=@file or key=@- to read text",
+        parse: (value, previous = []) => {
+          previous.push(value);
+          return previous;
+        }
+      },
+      { flags: "--data-json <json>", description: "JSON object request body for the action" },
+      { flags: "--data-file <path>", description: "JSON object request body file, or - for stdin" },
+      {
+        flags: "--scope <scope>",
+        description: "Login scope to request before invoking; can be repeated or comma-separated",
+        parse: (value, previous = []) => {
+          previous.push(value);
+          return previous;
+        }
+      },
+      { flags: "--target <target>", description: "Conversation target to post a human approval card when approval is required" },
+      { flags: "--json", description: "Emit machine-readable JSON" }
+    ]
+  },
+  async (cmdCtx, serviceArgOrOpts, actionArgOrOpts, maybeOpts) => {
+    const { serviceArg, actionArg, opts } = parseHandlerArgs(serviceArgOrOpts, actionArgOrOpts, maybeOpts);
+    const serviceQuery = (opts.service ?? serviceArg ?? "").trim();
+    const actionName = (opts.action ?? actionArg ?? "").trim();
+    if (!serviceQuery) throw cliError("INVALID_ARG", "--service or service argument is required");
+    if (!opts.listActions && !actionName) throw cliError("INVALID_ARG", "--action or action argument is required");
+    const agentContext = cmdCtx.loadAgentContext();
+    const client = cmdCtx.createApiClient(agentContext);
+    const api = createAgentApiSurfaceClient(client);
+    const listRes = await api.integrations.list();
+    if (!listRes.ok || !listRes.data) {
+      const code = listRes.status >= 500 ? "SERVER_5XX" : "INTEGRATION_LIST_FAILED";
+      throw cliError(code, listRes.error ?? `HTTP ${listRes.status}`);
+    }
+    const service = findService2(listRes.data, serviceQuery);
+    if (!service) {
+      throw cliError("INTEGRATION_NOT_FOUND", `No registered integration matched ${serviceQuery}`);
+    }
+    const manifest = await fetchManifestForInvoke(service);
+    if (manifest.execution.mode !== "http_api") {
+      throw cliError("INTEGRATION_MANIFEST_UNSUPPORTED", "manifest execution mode is not http_api");
+    }
+    if (opts.listActions) {
+      if (opts.json) {
+        writeJson(cmdCtx.io, {
+          ok: true,
+          data: {
+            service: service.clientId,
+            manifestUrl: service.agentManifestUrl,
+            actions: manifest.actions ?? []
+          }
+        });
+        return;
+      }
+      writeText(cmdCtx.io, `${formatActions({ service, manifestUrl: service.agentManifestUrl ?? "-", manifest })}
+`);
+      return;
+    }
+    const action = (manifest.actions ?? []).find((candidate) => candidate.name === actionName);
+    if (!action) throw cliError("INVALID_ARG", `manifest does not define action ${actionName}`);
+    const payload = parseActionPayload(opts);
+    validateRequiredParams(action, payload);
+    const scopes = normalizeScopes2(opts.scope);
+    const loginRes = await api.integrations.login({
+      service: service.clientId,
+      scopes,
+      target: opts.target?.trim() || void 0
+    });
+    if (!loginRes.ok || !loginRes.data) {
+      const code = loginRes.status >= 500 ? "SERVER_5XX" : "INTEGRATION_LOGIN_FAILED";
+      throw cliError(code, loginRes.error ?? `HTTP ${loginRes.status}`);
+    }
+    if (loginRes.data.status === "approval_required") {
+      throw cliError(
+        "INTEGRATION_APPROVAL_REQUIRED",
+        "human approval is required before invoking this integration action",
+        { suggestedNextAction: "Ask a server owner/admin to approve the integration login request, then rerun the command." }
+      );
+    }
+    const cookie = await establishServiceSession({ login: loginRes.data, service });
+    const url2 = resolveActionUrl({ service, manifest, action });
+    const result2 = await invokeHttpAction({ url: url2, action, payload, cookie });
+    if (opts.json) {
+      writeJson(cmdCtx.io, {
+        ok: true,
+        data: {
+          service: service.clientId,
+          action: action.name,
+          status: result2.status,
+          result: result2.value
+        }
+      });
+      return;
+    }
+    writeText(cmdCtx.io, `${formatActionResult({ service, action, result: result2 })}
+`);
+  }
+);
+function registerIntegrationInvokeCommand(parent, runtimeOptions = {}) {
+  registerCliCommand(parent, integrationInvokeCommand, runtimeOptions);
+}
+
+// src/commands/integration/app.ts
+init_esm_shims();
+function normalizeScopes3(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const scopes = Array.from(new Set(
+    raw.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean)
+  )).sort();
+  if (scopes.length === 0) {
+    throw cliError("INVALID_ARG", "--scope must include at least one non-empty scope");
+  }
+  return scopes;
+}
 function requiredTrimmed(value, flag) {
   const trimmed = value?.trim() ?? "";
   if (!trimmed) throw cliError("INVALID_ARG", `${flag} is required`);
@@ -50968,7 +52587,7 @@ function formatAppPrepare(data) {
 async function prepareApp(mode, ctx, opts) {
   const target = requiredTrimmed(opts.target, "--target");
   const clientKey = requiredTrimmed(opts.clientKey, "--client-key");
-  const scopes = normalizeScopes2([...opts.scope ?? [], ...opts.scopes ?? []]);
+  const scopes = normalizeScopes3([...opts.scope ?? [], ...opts.scopes ?? []]);
   const agentContext = ctx.loadAgentContext();
   const client = ctx.createApiClient(agentContext);
   const body = {
@@ -50999,6 +52618,40 @@ async function prepareApp(mode, ctx, opts) {
   writeText(ctx.io, `${formatAppPrepare(res.data)}
 `);
 }
+function formatAppRotateSecret(data) {
+  return [
+    `Integration app secret regenerated for ${data.clientName} (${data.clientKey})`,
+    `client secret: ${data.clientSecret}`,
+    "shown once \u2014 store it now; regenerating again invalidates the previous secret"
+  ].join("\n");
+}
+async function rotateAppSecret(ctx, opts) {
+  const clientKey = requiredTrimmed(opts.client, "--client");
+  const agentContext = ctx.loadAgentContext();
+  const client = ctx.createApiClient(agentContext);
+  const res = await createAgentApiSurfaceClient(client).integrations.rotateAppSecret({ clientKey });
+  if (!res.ok || !res.data) {
+    const code = res.status >= 500 ? "SERVER_5XX" : "INTEGRATION_APP_ROTATE_SECRET_FAILED";
+    throw cliError(code, res.error ?? `HTTP ${res.status}`);
+  }
+  if (opts.json) {
+    writeJson(ctx.io, { ok: true, data: res.data });
+    return;
+  }
+  writeText(ctx.io, `${formatAppRotateSecret(res.data)}
+`);
+}
+var integrationAppRotateSecretCommand = defineCommand(
+  {
+    name: "rotate-secret",
+    description: "Regenerate the one-time client secret for a server-local app you registered (invalidates the previous secret)",
+    options: [
+      { flags: "--client <key>", description: "App client key / OAuth client_id you registered" },
+      { flags: "--json", description: "Emit machine-readable JSON" }
+    ]
+  },
+  async (ctx, opts) => rotateAppSecret(ctx, opts)
+);
 var sharedOptions = [
   { flags: "--client-key <key>", description: "Stable app client key / OAuth client_id to reserve or update" },
   { flags: "--name <name>", description: "App display name" },
@@ -51048,6 +52701,7 @@ function registerIntegrationAppCommands(parent, runtimeOptions = {}) {
   const prepareCmd = appCmd.command("prepare").description("Prepare app registration/update action cards");
   registerCliCommand(prepareCmd, integrationAppPrepareRegisterCommand, runtimeOptions);
   registerCliCommand(prepareCmd, integrationAppPrepareUpdateCommand, runtimeOptions);
+  registerCliCommand(appCmd, integrationAppRotateSecretCommand, runtimeOptions);
 }
 
 // src/commands/reminder/schedule.ts
@@ -51466,6 +53120,10 @@ registerAgentListCommand(agentCmd);
 registerAgentBridgeCommand(agentCmd);
 var channelCmd = program2.command("channel").description("Channel membership and attention operations");
 registerChannelMembersCommand(channelCmd);
+registerChannelCreateCommand(channelCmd);
+registerChannelUpdateCommand(channelCmd);
+registerChannelAddMemberCommand(channelCmd);
+registerChannelRemoveMemberCommand(channelCmd);
 registerChannelJoinCommand(channelCmd);
 registerChannelLeaveCommand(channelCmd);
 registerChannelMuteCommand(channelCmd);
@@ -51474,6 +53132,7 @@ var threadCmd = program2.command("thread").description("Thread attention operati
 registerThreadUnfollowCommand(threadCmd);
 var serverCmd = program2.command("server").description("Server / workspace introspection");
 registerServerInfoCommand(serverCmd);
+registerServerUpdateCommand(serverCmd);
 var manualCmd = program2.command("manual").description("Slock Manual for Agents retrieval (canonical operating topics)");
 registerKnowledgeGetCommand(manualCmd);
 var knowledgeCmd = program2.command("knowledge").description("Legacy alias for `raft manual`");
@@ -51506,6 +53165,7 @@ var integrationCmd = program2.command("integration").description("Third-party se
 registerIntegrationListCommand(integrationCmd);
 registerIntegrationLoginCommand(integrationCmd);
 registerIntegrationEnvCommand(integrationCmd);
+registerIntegrationInvokeCommand(integrationCmd);
 registerIntegrationAppCommands(integrationCmd);
 var reminderCmd = program2.command("reminder").description("Reminder operations");
 registerReminderScheduleCommand(reminderCmd);