@botiverse/raft-daemon 0.70.0 → 0.70.2

package/dist/{chunk-QDPBPYD7.js → chunk-ZEBBZU45.js}

@@ -1,5 +1,5 @@
 // src/core.ts
-import path19 from "path";
+import path20 from "path";
 import os8 from "os";
 import { createRequire as createRequire3 } from "module";
 import { accessSync } from "fs";
@@ -1105,6 +1105,7 @@ function projectTraceScopeAttrs(scope) {
   addOptionalStringAttr(attrs, "route_pattern", scope.request?.routePattern);
   addOptionalStringAttr(attrs, "method", scope.request?.method);
   addOptionalStringAttr(attrs, "caller_kind", scope.request?.callerKind);
+  addOptionalStringAttr(attrs, "user_id", scope.request?.userId);
   if (typeof scope.request?.userIdPresent === "boolean") {
     attrs.user_id_present = scope.request.userIdPresent;
   }
@@ -1280,10 +1281,24 @@ var RecordingActiveSpan = class {
   }
   addEvent(name, attrs) {
     if (this.ended) return;
-    this.events.push({
+    const event = {
       name,
       timeMs: this.clock(),
       ...attrs ? { attrs } : {}
+    };
+    const eventIndex = this.events.length;
+    this.events.push(event);
+    this.sink.recordEvent?.({
+      span: {
+        context: this.context,
+        name: this.name,
+        surface: this.surface,
+        kind: this.kind,
+        startTimeMs: this.startTimeMs,
+        ...this.attrs ? { attrs: this.attrs } : {}
+      },
+      event,
+      eventIndex
     });
   }
   end(status = "ok", options = {}) {
@@ -1291,7 +1306,7 @@ var RecordingActiveSpan = class {
     this.ended = true;
     const endTimeMs = this.clock();
     const attrs = mergeAttrs(this.attrs, options.attrs);
-    this.sink.record({
+    const completed = {
       context: this.context,
       name: this.name,
       surface: this.surface,
@@ -1302,7 +1317,9 @@ var RecordingActiveSpan = class {
       durationMs: Math.max(0, endTimeMs - this.startTimeMs),
       ...attrs ? { attrs } : {},
       events: [...this.events]
-    });
+    };
+    this.sink.recordSpanFact?.({ span: completed });
+    this.sink.record(completed);
   }
 };
 function mergeAttrs(base, extra) {
@@ -1337,6 +1354,125 @@ function randomHex(length) {
   return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
+// ../shared/src/tracing/eventRows.ts
+var PROMOTED_IDENTITY_ATTRS = [
+  "server_id",
+  "machine_id",
+  "agent_id",
+  "launch_id",
+  "session_id",
+  "request_id",
+  "route_pattern",
+  "caller_kind"
+];
+var PROMOTED_CLOSED_ATTRS = [
+  "outcome",
+  "reason",
+  "event_kind",
+  "source",
+  "authority",
+  "activity_write_site",
+  "activity_source",
+  "hint_source",
+  "resolved_activity",
+  "previous_activity",
+  "next_activity",
+  "repair_kind",
+  "action",
+  "error_class",
+  "status_bucket",
+  "shadow_agent_id",
+  "shadow_signal_site",
+  "shadow_observation_class",
+  "shadow_prior_projection",
+  "shadow_projection",
+  "shadow_legacy_outcome",
+  "shadow_action",
+  "shadow_reason",
+  "shadow_direction",
+  "shadow_plan_kind"
+];
+var TRACE_EVENT_ROW_PROMOTED_ATTRS = [
+  ...PROMOTED_IDENTITY_ATTRS,
+  ...PROMOTED_CLOSED_ATTRS
+];
+
+// ../shared/src/tracing/fields.ts
+function defineTraceFields(definitions) {
+  for (const definition of definitions) {
+    if (definition.fieldClass === "content_safety" && !definition.contentRule) {
+      throw new Error(`Trace content-safety field "${definition.key}" must define a contentRule`);
+    }
+    if ((definition.fieldClass === "query_axis" || definition.fieldClass === "family_query_axis") && definition.valueKind === "content") {
+      throw new Error(`Trace query-axis field "${definition.key}" cannot be content`);
+    }
+    if (definition.fieldClass === "family_query_axis" && !definition.scope) {
+      throw new Error(`Trace family query-axis field "${definition.key}" must define a family scope`);
+    }
+  }
+  return definitions;
+}
+var TRACE_B0_FIELD_DEFINITIONS = defineTraceFields([
+  { key: "row_kind", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "stable" },
+  { key: "trace_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "span_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "parent_span_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "span_name", fieldClass: "query_axis", placement: "span", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "span_surface", fieldClass: "query_axis", placement: "span", valueKind: "closed_enum", enumBinding: "stable" },
+  { key: "span_kind", fieldClass: "query_axis", placement: "span", valueKind: "closed_enum", enumBinding: "stable" },
+  { key: "span_status", fieldClass: "query_axis", placement: "span", valueKind: "closed_enum", enumBinding: "stable" },
+  { key: "event_name", fieldClass: "query_axis", placement: "event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "event_kind", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "event_index", fieldClass: "query_axis", placement: "event", valueKind: "identity" },
+  { key: "event_time", fieldClass: "query_axis", placement: "event", valueKind: "timestamp" },
+  { key: "event_time_ms", fieldClass: "query_axis", placement: "event", valueKind: "numeric" },
+  { key: "lifecycle_observed_at_ms", fieldClass: "query_axis", placement: "span_or_event", valueKind: "numeric" },
+  { key: "activity_observed_at_ms", fieldClass: "query_axis", placement: "span_or_event", valueKind: "numeric" },
+  { key: "advances_observed_clock", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "duration_ms", fieldClass: "query_axis", placement: "span_or_event", valueKind: "numeric" },
+  { key: "request_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "route_pattern", fieldClass: "query_axis", placement: "span", valueKind: "route" },
+  { key: "caller_kind", fieldClass: "query_axis", placement: "span", valueKind: "closed_enum", enumBinding: "stable" },
+  { key: "server_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "machine_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "agent_id", fieldClass: "query_axis", placement: "span_or_event", valueKind: "identity", highCardinality: true },
+  { key: "launch_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "session_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "observation_class", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "action", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "source", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "served_from", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "authority", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "decided_by", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "error_class", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "query_name", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "query_registry" },
+  { key: "phase", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "hint_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "resolved_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "previous_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "next_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "repair_kind", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "activity_write_site", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "activity_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "status_bucket", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "shadow_agent_id", fieldClass: "family_query_axis", placement: "event", valueKind: "identity", scope: "family:lifecycle_shadow", highCardinality: true },
+  { key: "shadow_signal_site", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_observation_class", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_prior_projection", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_projection", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_legacy_outcome", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_action", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_reason", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_direction", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "shadow_plan_kind", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:lifecycle_shadow", enumBinding: "pending_457" },
+  { key: "row_count", fieldClass: "detail", placement: "span_or_event", valueKind: "detail" },
+  { key: "retry_count", fieldClass: "detail", placement: "span_or_event", valueKind: "detail" },
+  { key: "error_message", fieldClass: "detail", placement: "span_or_event", valueKind: "detail", contentRule: "scrub_and_short_retention" },
+  { key: "query_text", fieldClass: "content_safety", placement: "span_or_event", valueKind: "content", contentRule: "scrub_and_short_retention" },
+  { key: "raw_payload", fieldClass: "content_safety", placement: "span_or_event", valueKind: "content", contentRule: "drop" },
+  { key: "token", fieldClass: "content_safety", placement: "span_or_event", valueKind: "content", contentRule: "drop" }
+]);
+
 // ../shared/src/toolDisplay.ts
 var TOOL_DISPLAY_METADATA = {
   send_message: { logLabel: "Sending message", activityLabel: "Sending message\u2026", summaryKind: "message_target" },
@@ -1986,7 +2122,8 @@ var agentApiResolveChannelResponseSchema = passthroughObject({
   channelId: z2.string().trim().min(1)
 });
 var agentApiThreadUnfollowBodySchema = passthroughObject({
-  thread: z2.string().trim().min(1)
+  thread: z2.string().trim().min(1),
+  reason: z2.string().trim().min(1).max(200).optional()
 });
 var agentApiTaskClaimBodySchema = passthroughObject({
   channel: z2.string().trim().min(1),
@@ -2146,6 +2283,7 @@ var agentApiServerInfoResponseSchema = passthroughObject({
     serverId: z2.string(),
     machineId: z2.string().nullable().optional(),
     machineName: z2.string().nullable().optional(),
+    machineDescription: z2.string().nullable().optional(),
     machineHostname: z2.string().nullable().optional(),
     machineOs: z2.string().nullable().optional(),
     daemonVersion: z2.string().nullable().optional(),
@@ -3008,6 +3146,14 @@ var daemonApiContract = {
   })
 };
 
+// ../shared/src/authRefreshTiming.ts
+var AUTH_REFRESH_ROTATED_REPLAY_GRACE_MS = 1e4;
+var AUTH_REFRESH_ROTATION_DISCOVERY_LAG_BUDGET_MS = 1e3;
+var AUTH_REFRESH_ROTATED_TOKEN_WAIT_MS = 4e3;
+var AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS = 1e3;
+var AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS = AUTH_REFRESH_ROTATION_DISCOVERY_LAG_BUDGET_MS + AUTH_REFRESH_ROTATED_TOKEN_WAIT_MS + AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS;
+var AUTH_REFRESH_ROTATION_REPLAY_GRACE_MARGIN_MS = AUTH_REFRESH_ROTATED_REPLAY_GRACE_MS - AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS;
+
 // ../shared/src/agentInbox.ts
 function formatAgentInboxDelta(rows, options = {}) {
   const totalPendingMessages = options.totalPendingMessages;
@@ -3187,6 +3333,55 @@ var SUPPORTED_TRANSLATION_LANGUAGE_SET = new Set(
   SUPPORTED_TRANSLATION_LANGUAGE_CODES
 );
 
+// ../shared/src/oauthScopes.ts
+var RAFT_OAUTH_SCOPE_CATALOG = {
+  openid: {
+    phase: "identity",
+    defaultAllowed: true,
+    publicDiscovery: true,
+    requiresResource: false,
+    label: "OpenID identity"
+  },
+  profile: {
+    phase: "identity",
+    defaultAllowed: true,
+    publicDiscovery: true,
+    requiresResource: false,
+    label: "Basic profile"
+  },
+  identity: {
+    phase: "identity",
+    defaultAllowed: true,
+    publicDiscovery: true,
+    requiresResource: false,
+    label: "Raft identity card"
+  },
+  "agent:event:write": {
+    phase: "agent_inbound",
+    defaultAllowed: false,
+    publicDiscovery: true,
+    requiresResource: true,
+    label: "Send structured events to an agent"
+  },
+  "agent:notification:write": {
+    phase: "agent_inbound",
+    defaultAllowed: false,
+    publicDiscovery: true,
+    requiresResource: true,
+    label: "Send notifications to an agent"
+  },
+  "agent:action_request:write": {
+    phase: "agent_inbound",
+    defaultAllowed: false,
+    publicDiscovery: false,
+    requiresResource: true,
+    label: "Request agent action"
+  }
+};
+var RAFT_OAUTH_SCOPES_SUPPORTED = Object.keys(RAFT_OAUTH_SCOPE_CATALOG);
+var RAFT_OAUTH_DEFAULT_ALLOWED_SCOPES = RAFT_OAUTH_SCOPES_SUPPORTED.filter((scope) => RAFT_OAUTH_SCOPE_CATALOG[scope].defaultAllowed);
+var RAFT_OAUTH_PUBLIC_DISCOVERY_SCOPES = RAFT_OAUTH_SCOPES_SUPPORTED.filter((scope) => RAFT_OAUTH_SCOPE_CATALOG[scope].publicDiscovery);
+
 // ../shared/src/testing/failpoints.ts
 var NoopFailpointRegistry = class {
   get enabled() {
@@ -4025,8 +4220,8 @@ async function executeResponseRequest(url, init, {
 }
 
 // src/directUploadCapability.ts
-function joinUrl(base, path20) {
-  return `${base.replace(/\/+$/, "")}${path20}`;
+function joinUrl(base, path21) {
+  return `${base.replace(/\/+$/, "")}${path21}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -5659,7 +5854,7 @@ function shortMessageId2(value) {
   return value.slice(0, 8);
 }
 function normalizeSenderType(value) {
-  return value === "human" || value === "agent" || value === "system" ? value : void 0;
+  return value === "human" || value === "agent" || value === "system" || value === "third_party_app" ? value : void 0;
 }
 function nonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value : void 0;
@@ -6047,6 +6242,10 @@ async function readRequestBody(req) {
 function messageSeq3(message) {
   return Number(message.seq ?? 0);
 }
+function isThirdPartyAgentEvent(message) {
+  const thirdPartyEvent = message.third_party_event;
+  return typeof thirdPartyEvent?.id === "string" && thirdPartyEvent.id.length > 0;
+}
 function localAgentApiInboxResponse(registration) {
   const coordinator = registration.inboxCoordinator;
   if (!coordinator) return void 0;
@@ -6097,6 +6296,7 @@ function localAgentApiEventsResponse(registration, target) {
   const normalized = sortInboxMessagesBySeq(normalizeInboxVisibleMessages(pending));
   const filtered = parsedQuery.sinceSeq !== null ? normalized.filter((message) => {
     const seq = messageSeq3(message);
+    if ((!Number.isFinite(seq) || seq <= 0) && isThirdPartyAgentEvent(message)) return true;
     return Number.isFinite(seq) && seq > parsedQuery.sinceSeq;
   }) : normalized;
   const events = filtered.slice(0, parsedQuery.limit);
@@ -7665,7 +7865,7 @@ function codexNotificationDiagnosticEvent(message) {
       return null;
   }
   const sessionId = codexMessageThreadId(message);
-  const path20 = boundedString(params.path);
+  const path21 = boundedString(params.path);
   return {
     kind: "runtime_diagnostic",
     severity: "warning",
@@ -7673,7 +7873,7 @@ function codexNotificationDiagnosticEvent(message) {
     itemType: message.method,
     message: diagnosticMessage,
     ...details ? { details } : {},
-    ...path20 ? { path: path20 } : {},
+    ...path21 ? { path: path21 } : {},
     ...params.range !== void 0 ? { range: params.range } : {},
     payloadBytes: payloadBytes(params),
     ...sessionId ? { sessionId } : {}
@@ -12531,6 +12731,9 @@ function computeTarget(channelType, channelName, parentChannelName, parentChanne
   return `#${channelName}`;
 }
 function formatAgentMessageVisibleTarget(message) {
+  if (message.third_party_event) {
+    return `agent-event:${getMessageShortId(message.third_party_event.id)}`;
+  }
   return computeTarget(message.channel_type, message.channel_name, message.parent_channel_name, message.parent_channel_type);
 }
 function formatProxyVisibleMessageTarget(message) {
@@ -18297,6 +18500,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     const launchId = launchIdOverride || ap?.launchId || void 0;
     const clientSeq = this.nextActivityClientSeq(agentId);
     const producerFactId = this.buildActivityProducerFactId(agentId, launchId, clientSeq);
+    const observedAtMs = Date.now();
     this.sendToServer({
       type: "agent:activity",
       agentId,
@@ -18308,6 +18512,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
       launchId,
       clientSeq,
       producerFactId,
+      observedAtMs,
       isHeartbeat: false
     });
     this.recordActivityProducedTrace(agentId, activityKind, detail, detailKind, entries, ap, launchId, clientSeq, producerFactId, false);
@@ -18327,6 +18532,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
             const heartbeatLaunchId = launchIdOverride || ap.launchId || void 0;
             const heartbeatClientSeq = this.nextActivityClientSeq(agentId);
             const heartbeatProducerFactId = this.buildActivityProducerFactId(agentId, heartbeatLaunchId, heartbeatClientSeq);
+            const heartbeatObservedAtMs = Date.now();
             this.sendToServer({
               type: "agent:activity",
               agentId,
@@ -18337,6 +18543,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
               launchId: heartbeatLaunchId,
               clientSeq: heartbeatClientSeq,
               producerFactId: heartbeatProducerFactId,
+              observedAtMs: heartbeatObservedAtMs,
               // The one knowing site: this timer re-broadcasts stale
               // lastActivity, so it declares its replay provenance.
               isHeartbeat: true
@@ -18612,12 +18819,29 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     }
     this.commitApmIdleState(agentId, ap, false);
   }
-  interruptCompactionIfActive(agentId) {
+  interruptCompactionIfActive(agentId, options = {}) {
     const ap = this.agents.get(agentId);
-    if (!ap || ap.compaction.kind !== "active" && !ap.gatedSteering.compacting) return;
+    if (!ap || ap.compaction.kind !== "active" && !ap.gatedSteering.compacting) return false;
     this.clearCompactionWatchdog(ap);
     const reduction = reduceApmGatedCompaction(ap.gatedSteering, { kind: "compaction_interrupted" });
-    this.commitGatedSteeringDecisionState(agentId, ap, reduction.nextState);
+    this.commitGatedSteeringDecisionState(agentId, ap, reduction.nextState, { event: "compaction_interrupted" });
+    if (options.traceAttrs) {
+      this.recordRuntimeTraceEvent(agentId, ap, "runtime.context_compaction.interrupted", options.traceAttrs);
+    }
+    if (options.detail) {
+      this.broadcastActivity(
+        agentId,
+        "error",
+        options.detail,
+        options.entries ?? [],
+        void 0,
+        options.detailKind ?? "runtime_error"
+      );
+    }
+    if (options.flushBoundaryMessages) {
+      this.flushCompactionBoundaryMessages(agentId, ap);
+    }
+    return true;
   }
   flushReviewBoundaryMessages(agentId, ap) {
     const reduction = reduceApmGatedReviewBoundaryFlush(ap.gatedSteering, {
@@ -19345,6 +19569,17 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     if (event.kind === "delivery_error") {
       if (ap) {
         this.restoreRuntimeDeliveryAfterAsyncRejection(agentId, ap, event);
+        this.interruptCompactionIfActive(agentId, {
+          detail: `Context compaction interrupted after runtime delivery failed: ${event.message}`,
+          entries: [{ kind: "text", text: `Error: ${event.message}` }],
+          flushBoundaryMessages: true,
+          traceAttrs: {
+            reason: "delivery_error",
+            request_method: event.requestMethod,
+            source: event.source,
+            payloadBytes: event.payloadBytes
+          }
+        });
       } else {
         this.recordDaemonTrace("daemon.agent.delivery_error.received_without_process", {
           agentId,
@@ -21368,6 +21603,563 @@ function assertLegacyDaemonKeyNotAdoptedByComputer(options) {
   if (match) throw new LegacyDaemonKeyAdoptedByComputerError(match);
 }
 
+// src/agentMigrationExport.ts
+import { createHash as createHash7 } from "crypto";
+import { createReadStream } from "fs";
+import { lstat as lstat2, readdir as readdir4, readFile as readFile3, readlink } from "fs/promises";
+import path19 from "path";
+var AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION = "agent-bundle/v1";
+var REGENERABLE_DIRECTORY_NAMES = [
+  ".venv",
+  "__pycache__",
+  "dist",
+  "node_modules",
+  "target"
+];
+var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
+  ".env",
+  ".env.local",
+  ".env.development",
+  ".env.production",
+  ".env.test",
+  "credentials.json",
+  "credential.json"
+]);
+var ENV_KEY_PATTERN = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+async function buildAgentMigrationExportManifest(input) {
+  const slockHome = path19.resolve(input.slockHome);
+  const workspace = path19.resolve(input.workspacePath ?? path19.join(slockHome, "agents", input.agentId));
+  const proposedIncludes = normalizeProposalPaths(input.cooperativeManifest?.include, workspace, "include");
+  const proposedRegenerableExcludes = normalizeProposalPaths(input.cooperativeManifest?.exclude_regenerable, workspace, "exclude_regenerable");
+  const cleanedProposal = normalizeProposalPaths(input.cooperativeManifest?.cleaned, workspace, "cleaned");
+  const state = {
+    workspace,
+    files: [],
+    excludedRegenerable: [],
+    promotedIncludes: [],
+    proposalRefusals: [
+      ...proposedIncludes.refusals,
+      ...proposedRegenerableExcludes.refusals,
+      ...cleanedProposal.refusals
+    ],
+    unreachable: [],
+    secretsDisclosed: [],
+    seenWorkspacePaths: /* @__PURE__ */ new Set(),
+    explicitIncludePaths: new Set(proposedIncludes.paths)
+  };
+  await walkWorkspace(workspace, "", new Set(proposedRegenerableExcludes.paths), state, { forceIncludeRegenerable: false });
+  for (const requestedPath of proposedIncludes.paths) {
+    if (!state.seenWorkspacePaths.has(requestedPath)) {
+      await includeWorkspacePath(requestedPath, state, { forceIncludeRegenerable: true });
+    }
+  }
+  for (const requestedPath of proposedRegenerableExcludes.paths) {
+    if (isRegenerablePath(requestedPath)) continue;
+    state.promotedIncludes.push({ path: requestedPath, reason: "exclude_not_regenerable" });
+    await includeWorkspacePath(requestedPath, state, { forceIncludeRegenerable: true });
+  }
+  const crossTreeRefs = await buildCrossTreeRefs(input.runtimeSessionRefs ?? []);
+  const secretDisclosureProposal = normalizeProposalPaths(input.cooperativeManifest?.secrets_disclosed, workspace, "secrets_disclosed");
+  state.proposalRefusals.push(...secretDisclosureProposal.refusals);
+  return {
+    schemaVersion: AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
+    agentId: input.agentId,
+    mode: input.mode,
+    createdAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    roots: {
+      slockHome,
+      workspace
+    },
+    defaults: {
+      unknownFiles: "include",
+      excludePolicy: "regenerable_only",
+      regenerableDirectoryNames: [...REGENERABLE_DIRECTORY_NAMES]
+    },
+    files: sortBundleEntries(state.files),
+    excludedRegenerable: sortByPath(state.excludedRegenerable),
+    promotedIncludes: sortByPath(state.promotedIncludes),
+    proposalRefusals: sortByPath(state.proposalRefusals),
+    unreachable: sortByPath(state.unreachable),
+    secretsDisclosed: sortByPath([
+      ...state.secretsDisclosed,
+      ...normalizeProvidedSecretDisclosures(secretDisclosureProposal.paths)
+    ]),
+    cleaned: cleanedProposal.paths,
+    crossTreeRefs: crossTreeRefs.sort((a, b) => a.bundlePath.localeCompare(b.bundlePath))
+  };
+}
+async function walkWorkspace(root, relativeDir, proposedRegenerableExcludes, state, opts) {
+  const absoluteDir = path19.join(root, relativeDir);
+  let entries;
+  try {
+    entries = await readdir4(absoluteDir, { withFileTypes: true });
+  } catch {
+    state.unreachable.push({
+      path: relativeDir || ".",
+      sourcePath: absoluteDir,
+      reason: "read_error"
+    });
+    return;
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    const relativePath = toPosixPath(path19.join(relativeDir, entry.name));
+    if (entry.isDirectory()) {
+      if (!opts.forceIncludeRegenerable && isRegenerablePath(relativePath)) {
+        if (state.explicitIncludePaths.has(relativePath)) {
+          await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, { forceIncludeRegenerable: true });
+          continue;
+        }
+        if (hasExplicitIncludeDescendant(relativePath, state.explicitIncludePaths)) {
+          await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, opts);
+          continue;
+        }
+        state.excludedRegenerable.push({
+          path: relativePath,
+          reason: proposedRegenerableExcludes.has(relativePath) ? "cooperative_exclude_regenerable" : "regenerable_default",
+          regenerableHint: `${entry.name} is treated as rebuildable/installable state and is not bundled by default`
+        });
+        continue;
+      }
+      await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, opts);
+      continue;
+    }
+    await includeWorkspacePath(relativePath, state, { forceIncludeRegenerable: opts.forceIncludeRegenerable });
+  }
+}
+async function includeWorkspacePath(workspaceRelativePath, state, opts) {
+  const normalizedRelativePath = normalizeRelativePath(workspaceRelativePath);
+  if (state.seenWorkspacePaths.has(normalizedRelativePath)) return;
+  const sourcePath = path19.join(state.workspace, normalizedRelativePath);
+  let stat4;
+  try {
+    stat4 = await lstat2(sourcePath);
+  } catch {
+    state.unreachable.push({
+      path: normalizedRelativePath,
+      sourcePath,
+      reason: "missing"
+    });
+    return;
+  }
+  if (stat4.isDirectory()) {
+    if (!opts.forceIncludeRegenerable && isRegenerablePath(normalizedRelativePath)) {
+      state.excludedRegenerable.push({
+        path: normalizedRelativePath,
+        reason: "cooperative_exclude_regenerable",
+        regenerableHint: `${path19.basename(normalizedRelativePath)} is treated as rebuildable/installable state and is not bundled by default`
+      });
+      return;
+    }
+    await walkWorkspace(state.workspace, normalizedRelativePath, /* @__PURE__ */ new Set(), state, opts);
+    return;
+  }
+  state.seenWorkspacePaths.add(normalizedRelativePath);
+  const baseEntry = {
+    source: "workspace",
+    sourcePath,
+    workspaceRelativePath: normalizedRelativePath,
+    bundlePath: `workspace/${normalizedRelativePath}`,
+    mode: stat4.mode,
+    mtimeMs: stat4.mtimeMs
+  };
+  if (stat4.isSymbolicLink()) {
+    state.files.push({
+      ...baseEntry,
+      kind: "symlink",
+      linkTarget: await readlink(sourcePath)
+    });
+    return;
+  }
+  if (!stat4.isFile()) {
+    state.unreachable.push({
+      path: normalizedRelativePath,
+      sourcePath,
+      reason: "unsupported_file_type"
+    });
+    return;
+  }
+  const secretShapes = await detectSecretShapes(sourcePath, normalizedRelativePath);
+  if (secretShapes.length > 0) {
+    state.secretsDisclosed.push({ path: normalizedRelativePath, shapes: secretShapes });
+  }
+  state.files.push({
+    ...baseEntry,
+    kind: "file",
+    sizeBytes: stat4.size,
+    sha256: await sha256File(sourcePath),
+    secretShapes: secretShapes.length > 0 ? secretShapes : void 0
+  });
+}
+async function buildCrossTreeRefs(refs) {
+  const result = [];
+  for (const ref of refs) {
+    const sourcePath = path19.resolve(ref.path);
+    const bundlePath = `runtime/${safeBundleSegment(ref.runtime)}/${safeBundleSegment(ref.label)}/${safeBundleSegment(path19.basename(sourcePath) || "session")}`;
+    const entry = {
+      runtime: ref.runtime,
+      label: ref.label,
+      sourcePath,
+      bundlePath,
+      reachable: ref.reachable !== false,
+      reason: ref.reason
+    };
+    try {
+      const stat4 = await lstat2(sourcePath);
+      if (stat4.isFile()) {
+        entry.sizeBytes = stat4.size;
+        entry.sha256 = await sha256File(sourcePath);
+      }
+    } catch {
+      entry.reachable = false;
+    }
+    result.push(entry);
+  }
+  return result;
+}
+async function sha256File(filePath) {
+  const hash = createHash7("sha256");
+  await new Promise((resolve, reject) => {
+    const stream = createReadStream(filePath);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", resolve);
+  });
+  return hash.digest("hex");
+}
+async function detectSecretShapes(sourcePath, relativePath) {
+  const basename = path19.basename(relativePath);
+  const lowerBasename = basename.toLowerCase();
+  const shapes = /* @__PURE__ */ new Set();
+  if (SECRET_FILE_NAMES.has(lowerBasename) || lowerBasename.startsWith(".env.")) {
+    shapes.add(`file:${basename}`);
+    try {
+      const text = await readFile3(sourcePath, "utf8");
+      for (const line of text.split(/\r?\n/)) {
+        const match = ENV_KEY_PATTERN.exec(line);
+        if (match) shapes.add(`env:${match[1]}`);
+      }
+    } catch {
+      shapes.add("content:unreadable");
+    }
+  }
+  if (/(?:secret|token|credential|api[-_]?key)/i.test(relativePath)) {
+    shapes.add(`path:${basename}`);
+  }
+  return [...shapes].sort();
+}
+function normalizeProvidedSecretDisclosures(disclosures) {
+  return disclosures.map((entry) => ({
+    path: entry,
+    shapes: ["provided"]
+  }));
+}
+function normalizeProposalPaths(paths, workspace, source) {
+  if (!paths) return { paths: [], refusals: [] };
+  const result = [];
+  const refusals = [];
+  for (const value of paths) {
+    const trimmed = value.trim();
+    if (!trimmed) continue;
+    if (path19.isAbsolute(trimmed)) {
+      const relative = path19.relative(workspace, trimmed);
+      if (relative.startsWith("..") || path19.isAbsolute(relative)) {
+        refusals.push({
+          path: trimmed,
+          reason: "outside_workspace",
+          source
+        });
+        continue;
+      }
+      try {
+        result.push(normalizeRelativePath(relative));
+      } catch {
+        refusals.push({
+          path: trimmed,
+          reason: "unsafe_path",
+          source
+        });
+      }
+      continue;
+    }
+    try {
+      result.push(normalizeRelativePath(trimmed));
+    } catch {
+      refusals.push({
+        path: trimmed,
+        reason: "unsafe_path",
+        source
+      });
+    }
+  }
+  return { paths: [...new Set(result)], refusals };
+}
+function normalizeRelativePath(value) {
+  const normalized = path19.normalize(value).replace(/^[\\/]+/, "");
+  if (!normalized || normalized === "." || normalized.startsWith("..") || path19.isAbsolute(normalized)) {
+    throw new Error(`unsafe migration export path: ${value}`);
+  }
+  return toPosixPath(normalized);
+}
+function isRegenerablePath(relativePath) {
+  return normalizeRelativePath(relativePath).split("/").some((segment) => REGENERABLE_DIRECTORY_NAMES.includes(segment));
+}
+function hasExplicitIncludeDescendant(relativePath, explicitIncludePaths) {
+  const prefix = `${relativePath}/`;
+  for (const includePath of explicitIncludePaths) {
+    if (includePath.startsWith(prefix)) return true;
+  }
+  return false;
+}
+function safeBundleSegment(value) {
+  return value.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
+}
+function toPosixPath(value) {
+  return value.split(path19.sep).join("/");
+}
+function sortBundleEntries(entries) {
+  return [...entries].sort((a, b) => a.bundlePath.localeCompare(b.bundlePath));
+}
+function sortByPath(entries) {
+  return [...entries].sort((a, b) => a.path.localeCompare(b.path));
+}
+
+// src/agentMigrationHttpTransport.ts
+import { createHash as createHash8, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import http2 from "http";
+var MigrationBundleStreamError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+var AgentMigrationGrantRegistry = class {
+  grants = /* @__PURE__ */ new Map();
+  now;
+  constructor(now = () => /* @__PURE__ */ new Date()) {
+    this.now = now;
+  }
+  createGrant(input) {
+    const token = input.token ?? randomBytes2(32).toString("base64url");
+    const manifestSha256 = sha256Buffer(canonicalJsonBuffer(input.manifest));
+    const grant = {
+      grantId: input.grantId ?? randomBytes2(16).toString("hex"),
+      tokenHash: hashToken(token),
+      expiresAt: input.expiresAt,
+      oneTimeUse: input.oneTimeUse ?? true,
+      state: "issued",
+      manifest: input.manifest,
+      manifestSha256,
+      bundleEtag: `"agent-migration-${manifestSha256}"`
+    };
+    this.grants.set(grant.grantId, grant);
+    return { grant, token };
+  }
+  get(grantId) {
+    return this.grants.get(grantId);
+  }
+  authenticate(grantId, token) {
+    const grant = this.grants.get(grantId);
+    if (!grant || !token || !verifyTokenHash(token, grant.tokenHash)) {
+      return { ok: false, status: 401, code: "migration_grant_auth_failed" };
+    }
+    if (grant.state === "revoked" || grant.state === "consumed") {
+      return { ok: false, status: 410, code: "migration_grant_unavailable" };
+    }
+    if (this.now().getTime() >= grant.expiresAt.getTime()) {
+      grant.state = "expired";
+      return { ok: false, status: 410, code: "migration_grant_unavailable" };
+    }
+    return { ok: true, grant };
+  }
+  revokeAll() {
+    for (const grant of this.grants.values()) {
+      if (grant.state !== "consumed" && grant.state !== "expired") {
+        grant.state = "revoked";
+      }
+    }
+  }
+};
+function createAgentMigrationHttpTransport(options = {}) {
+  const registry = new AgentMigrationGrantRegistry(options.now);
+  const bundleStreamFactory = options.bundleStreamFactory ?? defaultBundleStream;
+  const server = http2.createServer((req, res) => {
+    void handleMigrationRequest(req, res, registry, bundleStreamFactory);
+  });
+  return {
+    grants: registry,
+    server,
+    listen: (port = 0, host = "127.0.0.1") => new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(port, host, () => {
+        server.off("error", reject);
+        const address = server.address();
+        if (!address || typeof address === "string") {
+          reject(new Error("migration transport listen did not produce a TCP address"));
+          return;
+        }
+        resolve({ url: `http://${address.address}:${address.port}` });
+      });
+    }),
+    close: () => new Promise((resolve, reject) => {
+      registry.revokeAll();
+      server.close((err) => {
+        if (err) reject(err);
+        else resolve();
+      });
+    })
+  };
+}
+async function handleMigrationRequest(req, res, registry, bundleStreamFactory) {
+  const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
+  const match = /^\/migration\/([^/]+)\/([^/]+)(?:\/([^/]+))?$/.exec(parsed.pathname);
+  if (!match) {
+    sendJson(res, 404, { code: "migration_route_not_found" });
+    return;
+  }
+  const [, grantId, resource, resourceId] = match;
+  const auth = registry.authenticate(decodeURIComponent(grantId), extractBearerToken(req));
+  if (!auth.ok) {
+    sendJson(res, auth.status, { code: auth.code });
+    return;
+  }
+  if (resource === "manifest" && req.method === "GET" && !resourceId) {
+    sendJson(res, 200, {
+      manifestSha256: auth.grant.manifestSha256,
+      manifest: auth.grant.manifest
+    }, {
+      "X-Raft-Manifest-Sha": auth.grant.manifestSha256,
+      ETag: `"manifest-${auth.grant.manifestSha256}"`
+    });
+    return;
+  }
+  if (resource === "bundle.tar" && !resourceId) {
+    if (req.method === "HEAD") {
+      sendHead(res, auth.grant);
+      return;
+    }
+    if (req.method === "GET") {
+      await streamBundle(res, auth.grant, bundleStreamFactory);
+      return;
+    }
+  }
+  if (resource === "chunk" && req.method === "GET" && resourceId) {
+    sendJson(res, 501, { code: "migration_chunk_not_implemented" });
+    return;
+  }
+  sendJson(res, 405, { code: "migration_method_not_allowed" });
+}
+function sendHead(res, grant) {
+  res.statusCode = 200;
+  res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
+  res.setHeader("ETag", grant.bundleEtag);
+  res.setHeader("Accept-Ranges", "none");
+  res.setHeader("X-Raft-Bundle-Size", "unknown");
+  res.end();
+}
+async function streamBundle(res, grant, bundleStreamFactory) {
+  if (grant.state === "streaming") {
+    sendJson(res, 409, { code: "migration_bundle_stream_in_progress" });
+    return;
+  }
+  if (grant.oneTimeUse && grant.state !== "issued" && grant.state !== "interrupted") {
+    sendJson(res, 410, { code: "migration_grant_unavailable" });
+    return;
+  }
+  let stream;
+  try {
+    stream = bundleStreamFactory(grant);
+  } catch (err) {
+    const code = err instanceof MigrationBundleStreamError ? err.code : "migration_bundle_stream_failed";
+    sendJson(res, 500, { code });
+    return;
+  }
+  grant.state = "streaming";
+  let completed = false;
+  res.on("close", () => {
+    if (!completed && grant.state === "streaming") {
+      grant.state = "interrupted";
+    }
+  });
+  try {
+    res.statusCode = 200;
+    res.setHeader("Content-Type", "application/x-tar");
+    res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
+    res.setHeader("ETag", grant.bundleEtag);
+    for await (const chunk of stream) {
+      if (!res.write(chunk)) {
+        await onceDrain(res);
+      }
+    }
+    completed = true;
+    grant.state = "consumed";
+    res.end();
+  } catch {
+    if (!completed && grant.state === "streaming") {
+      grant.state = "interrupted";
+    }
+    if (!res.headersSent) {
+      sendJson(res, 500, { code: "migration_bundle_stream_failed" });
+    } else {
+      res.destroy();
+    }
+  }
+}
+function defaultBundleStream(grant) {
+  void grant;
+  throw new MigrationBundleStreamError("migration_bundle_stream_not_wired");
+}
+function extractBearerToken(req) {
+  const directHeader = singleHeader(req.headers["x-raft-migration-token"]);
+  if (directHeader) return directHeader;
+  const authorization = singleHeader(req.headers.authorization);
+  if (!authorization) return null;
+  const match = /^Bearer\s+(.+)$/i.exec(authorization);
+  return match?.[1] ?? null;
+}
+function singleHeader(value) {
+  if (!value) return null;
+  return Array.isArray(value) ? value[0] ?? null : value;
+}
+function sendJson(res, status, body, headers = {}) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(payload).toString(),
+    ...headers
+  });
+  res.end(payload);
+}
+function hashToken(token) {
+  return sha256Buffer(Buffer.from(token, "utf8"));
+}
+function verifyTokenHash(token, expectedHashHex) {
+  const actual = Buffer.from(hashToken(token), "hex");
+  const expected = Buffer.from(expectedHashHex, "hex");
+  if (actual.byteLength !== expected.byteLength) return false;
+  return timingSafeEqual(actual, expected);
+}
+function sha256Buffer(buffer) {
+  return createHash8("sha256").update(buffer).digest("hex");
+}
+function canonicalJsonBuffer(value) {
+  return Buffer.from(canonicalJson(value), "utf8");
+}
+function canonicalJson(value) {
+  return JSON.stringify(sortJsonValue(value));
+}
+function sortJsonValue(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.keys(value).sort().reduce((result, key) => {
+    result[key] = sortJsonValue(value[key]);
+    return result;
+  }, {});
+}
+function onceDrain(res) {
+  return new Promise((resolve) => res.once("drain", resolve));
+}
+
 // src/core.ts
 var DEFAULT_TRACE_UPLOAD_URL = "https://slock-trace-upload.botiverse.dev";
 var RUNNER_CREDENTIAL_SCOPES = ["send", "read", "mentions", "tasks", "reactions", "server", "channels", "knowledge"];
@@ -21549,13 +22341,13 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path19.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path19.resolve(thisDir, "cli", "index.js");
+  const thisDir = path20.dirname(fileURLToPath(moduleUrl));
+  const bundledDistPath = path20.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path19.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path20.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -21569,7 +22361,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-I6ATP6I5.js");
+  await import("./dist-CWN2CLOA.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -21777,7 +22569,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path19.join(path19.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path20.join(path20.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -21805,7 +22597,7 @@ var DaemonCore = class {
       sinks: [this.localTraceSink]
     }));
     this.agentManager.setTracer(this.tracer);
-    this.agentManager.setCliTransportTraceDir(path19.join(machineDir, "traces"));
+    this.agentManager.setCliTransportTraceDir(path20.join(machineDir, "traces"));
   }
   installTraceBundleUploader(machineDir) {
     if (!this.shouldEnableLocalTrace()) return;
@@ -22094,7 +22886,7 @@ var DaemonCore = class {
             session_id_present: Boolean(msg.config.sessionId)
           }, "error");
           this.connection.send({ type: "agent:status", agentId: msg.agentId, status: "inactive", launchId: msg.launchId });
-          this.connection.send({ type: "agent:activity", agentId: msg.agentId, activity: "offline", detail: classification.userMessage, launchId: msg.launchId });
+          this.connection.send({ type: "agent:activity", agentId: msg.agentId, activity: "offline", detail: classification.userMessage, launchId: msg.launchId, observedAtMs: Date.now() });
         });
         break;
       case "agent:stop":
@@ -22514,6 +23306,10 @@ export {
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,
+  AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
+  buildAgentMigrationExportManifest,
+  AgentMigrationGrantRegistry,
+  createAgentMigrationHttpTransport,
   DAEMON_CORE_TRACE_ATTR_CONTRACTS,
   DAEMON_CLI_USAGE,
   parseDaemonCliArgs,