@botiverse/raft-daemon 0.72.12 → 1.0.1

package/dist/{chunk-LHJUHF42.js → chunk-BK46OPUN.js}

@@ -1359,6 +1359,71 @@ function randomHex(length) {
 }
 
 // ../shared/src/tracing/eventRows.ts
+var TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS = [
+  ["row_kind", "string"],
+  ["service_name", "string"],
+  ["deployment_environment", "string"],
+  ["service_version", "string"],
+  ["service_revision", "string"],
+  ["service_instance_id", "string"],
+  ["deployment_instance_source", "string"],
+  ["deployment_identity_state", "string"],
+  ["ecs_task_id", "string"],
+  ["ecs_task_family", "string"],
+  ["ecs_task_revision", "string"],
+  ["trace_id", "string"],
+  ["span_id", "string"],
+  ["parent_span_id", "string"],
+  ["span_name", "string"],
+  ["span_kind", "string"],
+  ["span_surface", "string"],
+  ["span_status", "string"],
+  ["span_start_time_ms", "int"],
+  ["span_end_time_ms", "int"],
+  ["event_name", "string"],
+  ["event_kind", "string"],
+  ["event_time", "timestamp"],
+  ["event_time_ms", "int"],
+  ["event_index", "int"],
+  ["server_id", "string"],
+  ["machine_id", "string"],
+  ["agent_id", "string"],
+  ["launch_id", "string"],
+  ["session_id", "string"],
+  ["request_id", "string"],
+  ["route_pattern", "string"],
+  ["caller_kind", "string"],
+  ["outcome", "string"],
+  ["reason", "string"],
+  ["source", "string"],
+  ["authority", "string"],
+  ["activity_write_site", "string"],
+  ["activity_source", "string"],
+  ["hint_source", "string"],
+  ["resolved_activity", "string"],
+  ["previous_activity", "string"],
+  ["next_activity", "string"],
+  ["repair_kind", "string"],
+  ["action", "string"],
+  ["error_class", "string"],
+  ["status_bucket", "string"],
+  ["shadow_agent_id", "string"],
+  ["shadow_signal_site", "string"],
+  ["shadow_observation_class", "string"],
+  ["shadow_prior_projection", "string"],
+  ["shadow_projection", "string"],
+  ["shadow_legacy_outcome", "string"],
+  ["shadow_action", "string"],
+  ["shadow_reason", "string"],
+  ["shadow_direction", "string"],
+  ["shadow_plan_kind", "string"]
+];
+var TRACE_EVENT_ROW_V2_INGEST_STATEMENT = [
+  "SELECT",
+  TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column, type]) => `$0["${column}"]::${type} AS ${column}`).join(", "),
+  "INSERT INTO raft.trace_events_v2",
+  `(${TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column]) => column).join(", ")})`
+].join(" ");
 var PROMOTED_IDENTITY_ATTRS = [
   "server_id",
   "machine_id",
@@ -2020,7 +2085,7 @@ var integrationAppDraftFieldsSchema = z.object({
 var integrationRegisterAppOperationSchema = integrationAppDraftFieldsSchema.extend({
   type: z.literal("integration:register_app"),
   name: z.string().trim().min(1).max(120),
-  clientKey: z.string().trim().min(1).max(120),
+  clientKey: z.string().trim().min(1).max(120).optional(),
   returnUrl: z.string().trim().min(1).max(2e3),
   scopes: z.array(z.string().trim().min(1).max(120)).max(64).default([]),
   unsafeDemoUrlOverride: z.boolean().optional(),
@@ -2440,10 +2505,8 @@ var agentApiIntegrationLoginBodySchema = passthroughObject({
   scopes: optionalStringArraySchema,
   target: optionalStringSchema
 });
-var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
-  mode: z3.enum(["register", "update"]),
+var agentApiIntegrationAppPrepareCommonBodyShape = {
   target: z3.string().trim().min(1),
-  clientKey: z3.string().trim().min(1),
   name: optionalStringSchema,
   description: optionalStringSchema,
   homepageUrl: optionalStringSchema,
@@ -2452,7 +2515,19 @@ var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
   scopes: optionalStringArraySchema,
   unsafeDemoUrlOverride: optionalBooleanSchema,
   draftHint: optionalStringSchema
-});
+};
+var agentApiIntegrationAppPrepareBodySchema = z3.discriminatedUnion("mode", [
+  passthroughObject({
+    mode: z3.literal("register"),
+    ...agentApiIntegrationAppPrepareCommonBodyShape,
+    clientKey: optionalStringSchema
+  }),
+  passthroughObject({
+    mode: z3.literal("update"),
+    ...agentApiIntegrationAppPrepareCommonBodyShape,
+    clientKey: z3.string().trim().min(1)
+  })
+]);
 var agentApiIntegrationAppRotateSecretBodySchema = passthroughObject({
   clientKey: z3.string().trim().min(1)
 });
@@ -3595,6 +3670,12 @@ function currentTimeMs() {
 function currentDate() {
   return new Date(currentTimeMs());
 }
+function setClockTimeout(fn, ms) {
+  return setTimeout(fn, ms);
+}
+function clearClockTimeout(timeout) {
+  clearTimeout(timeout);
+}
 
 // ../shared/src/agentInbox.ts
 function formatAgentInboxDelta(rows, options = {}) {
@@ -5092,8 +5173,31 @@ If a tool or error output contains credential-shaped strings, redact them to \`s
 
 **Profile credential resolution is strict.** When invoked as \`--profile <slug>\` (any entry command) or with \`RAFT_PROFILE=<slug>\` (\`SLOCK_PROFILE\` is a deprecation alias; setting both to different values fails closed), the CLI resolves credentials from \`$RAFT_PROFILE_DIR\` \u2192 \`$RAFT_HOME/profiles/<slug>\` (falling back to \`$SLOCK_PROFILE_DIR\`/\`$SLOCK_HOME\`) \u2192 \`$HOME/.slock/profiles/<slug>\` in that order. It does **not** fall back to a different profile's credential, to an ambient user-level token, or to environment-leaked secrets \u2014 if your designated profile credential is missing or unreadable, the CLI fails closed rather than authenticating as someone else.`;
 }
-function buildSendingMessagesSection() {
+function buildSendingMessagesSection(shell) {
   const D = MESSAGE_HEREDOC_DELIMITER;
+  if (shell === "powershell") {
+    return `### Sending messages
+
+- **Reply to a channel**: pipe a PowerShell here-string into \`raft message send --target "#channel-name"\`
+- **Reply to a DM**: pipe a PowerShell here-string into \`raft message send --target dm:@peer-name\`
+- **Reply in a thread**: pipe a PowerShell here-string into \`raft message send --target "#channel:shortid"\`
+- **Start a NEW DM**: pipe a PowerShell here-string into \`raft message send --target dm:@person-name\`
+
+Message content is always read from stdin. On Windows PowerShell, use a single-quoted here-string so quotes, backticks, dollar variables, and newlines stay literal:
+\`\`\`powershell
+@'
+Long message with "quotes", $vars, \`backticks\`, and code blocks.
+'@ | raft message send --target "#channel-name"
+\`\`\`
+
+The closing \`'@\` must start at the beginning of its line. Do not use Bash heredoc syntax (\`<<\`) in PowerShell.
+
+If Slock says a message was not sent and was saved as a draft, choose one path:
+- To update the draft, pipe the revised here-string into a normal \`raft message send --target <target>\` command.
+- To send the current draft unchanged, use \`raft message send --send-draft --target <target>\` with no stdin. Do not use \`--send-draft\` when changing content.
+
+**IMPORTANT**: To reply to any message, always reuse the exact \`target\` from the received message. This ensures your reply goes to the right place \u2014 whether it's a channel, DM, or thread.`;
+  }
   return `### Sending messages
 
 - **Reply to a channel**: \`raft message send --target "#channel-name" <<'${D}'\` followed by the message body and \`${D}\`
@@ -5124,25 +5228,26 @@ When a reminder already exists, prefer \`raft reminder snooze\` to push it later
 Use \`raft reminder schedule\` rather than runtime-native wake or cron tools such as ScheduleWakeup or CronCreate for user-visible reminders, so reminders stay author-owned, persistent, observable, snoozable, updatable, and cancelable in Slock.
 Create agent reminders only after resolving the anchor message from the current conversation and passing its msgId explicitly; if no anchor can be resolved, consider posting a status update in the relevant thread so the intent is visible, then revisit when context is available.`;
 }
-function buildThreadsSection() {
+function buildThreadsSection(shell) {
   const D = MESSAGE_HEREDOC_DELIMITER;
+  const startThreadInstruction = shell === "powershell" ? 'pipe a PowerShell single-quoted here-string into `raft message send --target "#general:00000000"`' : `reply with \`raft message send --target "#general:00000000" <<'${D}'\` followed by the message body and \`${D}\``;
   return `### Threads
 
 Threads are sub-conversations attached to a specific message. They let you discuss a topic without cluttering the main channel.
 
 - **Thread targets** have a colon and short ID suffix: \`#general:00000000\` (thread in #general) or \`dm:@richard:11111111\` (thread in a DM).
 - When you receive a message from a thread (the target has a \`:shortid\` suffix), **always reply using that same target** to keep the conversation in the thread.
-- **Start a new thread**: Use the \`msg=\` field from the header as the thread suffix. For example, if you see \`[target=#general msg=00000000 ...]\`, reply with \`raft message send --target "#general:00000000" <<'${D}'\` followed by the message body and \`${D}\`. The thread will be auto-created if it doesn't exist yet. Example IDs like \`00000000\` are placeholders; real message IDs come from received messages.
+- **Start a new thread**: Use the \`msg=\` field from the header as the thread suffix. For example, if you see \`[target=#general msg=00000000 ...]\`, ${startThreadInstruction}. The thread will be auto-created if it doesn't exist yet. Example IDs like \`00000000\` are placeholders; real message IDs come from received messages.
 - When you send a message, the response includes the message ID. You can use it to start a thread on your own message.
 - You can read thread history: \`raft message read --target "#general:00000000"\`
-- You can stop receiving ordinary delivery for a thread with \`raft thread unfollow --target "#general:00000000"\`. Only do this when your work in that thread is clearly complete or no longer relevant.
+- Unfollowing a thread removes its follow record and stops its ordinary delivery while the parent channel is unmuted: \`raft thread unfollow --target "#general:00000000"\`. A parent channel mute already suppresses ordinary delivery from its threads, so do not unfollow solely to mute the parent channel. Only unfollow when your work in that thread is clearly complete or no longer relevant.
 - Threads cannot be nested \u2014 you cannot start a thread inside a thread.`;
 }
 function buildDiscoverySection() {
   return `### Discovering people and channels
 
 Call \`raft server info\` to see all channels in this server, which ones you have joined, other agents, and humans.
-Visible public channels may appear even when \`joined=false\`. In that state you can still inspect them with \`raft message read\` and \`raft channel members\`, but you cannot send messages there or receive ordinary channel delivery until you join with \`raft channel join --target "#channel-name"\`. Private channels require a human with access to add you. To leave a regular channel you have joined, use \`raft channel leave --target "#channel-name"\`. To mute ordinary Activity delivery without leaving a regular channel, use \`raft channel mute --target "#channel-name"\`; personal @mentions and DMs still pierce (a task pierces only when it personally @mentions you), and thread following is separate. To reverse that setting, use \`raft channel unmute --target "#channel-name"\`. To stop following a thread without leaving its parent channel, use \`raft thread unfollow --target "#channel-name:shortid"\`.
+Visible public channels may appear even when \`joined=false\`. In that state you can still inspect them with \`raft message read\` and \`raft channel members\`, but you cannot send messages there or receive ordinary channel delivery until you join with \`raft channel join --target "#channel-name"\`. Private channels require a human with access to add you. To leave a regular channel you have joined, use \`raft channel leave --target "#channel-name"\`. To mute ordinary Activity delivery from a regular channel and its threads without leaving, use \`raft channel mute --target "#channel-name"\`; personal @mentions and DMs still pierce (a task pierces only when it personally @mentions you), while existing thread follow records remain. To reverse that setting, use \`raft channel unmute --target "#channel-name"\`. To remove a thread's follow record without leaving its parent channel, use \`raft thread unfollow --target "#channel-name:shortid"\`.
 Private channels are membership-gated. If \`raft server info\` shows a channel as private, treat its name, members, and content as private to that channel; do not disclose that information in other channels, DMs, summaries, or task reports unless a human explicitly asks within an authorized context. In \`raft channel members\`, human role labels such as owner/admin show server-level authority; no role label means ordinary member.`;
 }
 function buildChannelAwarenessSection() {
@@ -5329,12 +5434,13 @@ Your context will be periodically compressed to stay within limits. When this ha
 - Keep MEMORY.md complete enough that context compression preserves: which channel is about what, what tasks are in progress, what the user has asked for, and what other agents are doing.`;
 }
 function buildSlockCliGuideSections(options) {
+  const shell = options.shell ?? "posix";
   return {
     communication: buildCommunicationSection(options.audience),
     credentialHygiene: buildCredentialHygieneSection(),
-    sendingMessages: buildSendingMessagesSection(),
+    sendingMessages: buildSendingMessagesSection(shell),
     reminders: buildRemindersSection(),
-    threads: buildThreadsSection(),
+    threads: buildThreadsSection(shell),
     discovery: buildDiscoverySection(),
     channelAwareness: buildChannelAwarenessSection(),
     readingHistory: buildReadingHistorySection(),
@@ -5384,6 +5490,7 @@ function buildPrompt(config, opts) {
       handle: config.name,
       displayName: config.displayName || config.name
     },
+    shell: opts.commandShell,
     taskClaimCmd
   });
   const checkCmd = "`raft message check`";
@@ -6677,6 +6784,32 @@ async function handleProxyRequest(req, res) {
   const method = req.method ?? "GET";
   const correlationId = randomBytes(8).toString("hex");
   let target;
+  const inboundTraceparent = firstRequestHeader(req.headers.traceparent);
+  const parent = parseTraceparent(inboundTraceparent);
+  const traceContextState = parent ? "continued" : inboundTraceparent ? "malformed" : "new_root";
+  let localPathname = "unknown";
+  try {
+    localPathname = new URL2(req.url ?? "/", "http://agent-proxy.local").pathname;
+  } catch {
+  }
+  const proxySpan = registration.tracer.startSpan("daemon.agent_proxy.request", {
+    parent,
+    surface: "daemon",
+    kind: "client",
+    attrs: {
+      route_family: routeFamilyForPath(localPathname),
+      method: normalizedProxyMethod(method),
+      trace_context_state: traceContextState,
+      proxy_launch_id_present: registration.launchId !== null,
+      correlation_id: correlationId
+    }
+  });
+  let proxySpanStatus = "error";
+  let proxySpanEndAttrs = {
+    outcome: "proxy_failure",
+    normalized_code: "transport_failure",
+    response_started: false
+  };
   try {
     target = new URL2(req.url ?? "/", registration.serverUrl);
     const headers = new Headers();
@@ -6697,6 +6830,7 @@ async function handleProxyRequest(req, res) {
     headers.set("X-Agent-Id", registration.agentId);
     headers.set("X-Slock-Client", "cli");
     headers.set("X-Slock-Agent-Active-Capabilities", registration.activeCapabilities);
+    headers.set("traceparent", formatTraceparent(proxySpan.context));
     let body;
     let rawBodyBuffer;
     if (method !== "GET" && method !== "HEAD") {
@@ -6711,6 +6845,12 @@ async function handleProxyRequest(req, res) {
     if (method === "GET" && target.pathname === "/internal/agent-api/inbox") {
       const localInbox = localAgentApiInboxResponse(registration);
       if (localInbox) {
+        proxySpanStatus = "ok";
+        proxySpanEndAttrs = {
+          outcome: "local_response",
+          local_response_kind: "inbox",
+          http_status: localInbox.status
+        };
         res.writeHead(localInbox.status, { "content-type": "application/json" });
         res.end(JSON.stringify(localInbox.body));
         return;
@@ -6719,6 +6859,12 @@ async function handleProxyRequest(req, res) {
     if (method === "GET" && target.pathname === "/internal/agent-api/events") {
       const localEvents = localAgentApiEventsResponse(registration, target);
       if (localEvents) {
+        proxySpanStatus = "ok";
+        proxySpanEndAttrs = {
+          outcome: "local_response",
+          local_response_kind: "events",
+          http_status: localEvents.status
+        };
         res.writeHead(localEvents.status, { "content-type": "application/json" });
         res.end(JSON.stringify(localEvents.body));
         return;
@@ -6728,6 +6874,12 @@ async function handleProxyRequest(req, res) {
       const rawBody = rawBodyBuffer?.toString("utf8") ?? "";
       const prepared = await prepareAgentApiSideEffectForward(registration, headers, rawBody, sideEffectAction);
       if (prepared.localResponse) {
+        proxySpanStatus = "ok";
+        proxySpanEndAttrs = {
+          outcome: "local_response",
+          local_response_kind: "freshness_hold",
+          http_status: 200
+        };
         const responseText = JSON.stringify(prepared.localResponse);
         res.writeHead(200, { "content-type": "application/json" });
         res.end(responseText);
@@ -6750,10 +6902,23 @@ async function handleProxyRequest(req, res) {
     );
     if (upstream.status >= 500) {
       const transportError = transportNormalizedErrorForHttpStatus(target, upstream.status, registration.launchId);
+      proxySpanStatus = "error";
+      proxySpanEndAttrs = {
+        outcome: "upstream_5xx",
+        http_status: upstream.status,
+        normalized_code: transportError.normalizedCode,
+        response_started: transportError.responseStarted
+      };
       logger.warn(
         `[Agent Credential Proxy] upstream returned HTTP ${upstream.status} (agent=${registration.agentId}, launch=${registration.launchId ?? "none"}, correlation=${correlationId}, method=${method}, path=${target.pathname}, route_family=${transportError.routeFamily}, target_host_class=${transportError.targetHostClass})`
       );
       registration.inboxCoordinator?.recordTransportNormalizedError?.(transportError);
+    } else {
+      proxySpanStatus = "ok";
+      proxySpanEndAttrs = {
+        outcome: "upstream_response",
+        http_status: upstream.status
+      };
     }
     if (shouldBufferJsonResponse(upstream, target.pathname, registration)) {
       const responseText = await upstream.text();
@@ -6785,8 +6950,28 @@ async function handleProxyRequest(req, res) {
     );
     registration.inboxCoordinator?.recordProxyFailure?.(failure);
     registration.inboxCoordinator?.recordTransportNormalizedError?.(transportError);
+    proxySpanStatus = "error";
+    proxySpanEndAttrs = {
+      outcome: "proxy_failure",
+      normalized_code: transportError.normalizedCode,
+      response_started: transportError.responseStarted,
+      ...transportError.upstreamStatus === void 0 ? {} : { http_status: transportError.upstreamStatus }
+    };
     writeProxyFailureResponse(res, failure);
+  } finally {
+    proxySpan.end(proxySpanStatus, { attrs: proxySpanEndAttrs });
+  }
+}
+function firstRequestHeader(value) {
+  if (typeof value === "string") return value;
+  return value?.[0];
+}
+function normalizedProxyMethod(method) {
+  const normalized = method.toUpperCase();
+  if (normalized === "GET" || normalized === "POST" || normalized === "PUT" || normalized === "PATCH" || normalized === "DELETE" || normalized === "HEAD" || normalized === "OPTIONS") {
+    return normalized;
   }
+  return "OTHER";
 }
 function writeProxyFailureResponse(res, failure) {
   if (res.writableEnded) return;
@@ -7087,7 +7272,12 @@ async function loadRecentTargetMessages(registration, headers, target) {
   const historyHeaders = new Headers(headers);
   historyHeaders.delete("content-length");
   historyHeaders.delete("content-type");
-  const res = await fetch(historyUrl, { method: "GET", headers: historyHeaders });
+  const res = await daemonFetch(
+    historyUrl,
+    { method: "GET", headers: historyHeaders },
+    process.env,
+    { isolationKey: AGENT_CREDENTIAL_PROXY_FETCH_ISOLATION_KEY }
+  );
   if (!res.ok) return [];
   const parsed = await res.json().catch(() => null);
   return Array.isArray(parsed?.messages) ? normalizeInboxVisibleMessages(parsed.messages, target) : [];
@@ -7203,7 +7393,8 @@ async function registerAgentCredentialProxy(input) {
     agentId: input.agentId,
     launchId: input.launchId ?? null,
     activeCapabilities: input.activeCapabilities,
-    inboxCoordinator: input.inboxCoordinator
+    inboxCoordinator: input.inboxCoordinator,
+    tracer: input.tracer ?? noopTracer
   });
   return {
     proxyUrl: server.proxyUrl,
@@ -7462,7 +7653,8 @@ async function prepareCliTransport(ctx, extraEnv = {}, platform = process.platfo
       serverUrl: ctx.config.serverUrl,
       apiKey: agentCredentialKey,
       activeCapabilities: DEFAULT_ACTIVE_CAPABILITIES,
-      inboxCoordinator: ctx.agentCredentialProxyInboxCoordinator
+      inboxCoordinator: ctx.agentCredentialProxyInboxCoordinator,
+      tracer: ctx.tracer
     });
     const launchPart = buildCliTransportLaunchPart(ctx.launchId);
     const proxyTokenDir = path2.join(slockHome, "agent-proxy-tokens", safePathPart(ctx.agentId));
@@ -8053,6 +8245,7 @@ var WINDOWS_ENVIRONMENT_SCRIPT = [
   "  $result | ConvertTo-Json -Compress -Depth 3",
   "}"
 ].join(" ");
+var WINDOWS_COMMAND_RESOLVE_TIMEOUT_MS = 1e3;
 function normalizeProcessEnv(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   const env = {};
@@ -8161,7 +8354,8 @@ function resolveCommandOnWindows(command, env, execFileSyncFn, existsSyncFn) {
       command
     ], {
       stdio: ["ignore", "pipe", "ignore"],
-      env
+      env,
+      timeout: WINDOWS_COMMAND_RESOLVE_TIMEOUT_MS
     }));
     const resolved = output.trim().split(/\r?\n/)[0];
     if (!resolved) return null;
@@ -11772,7 +11966,6 @@ import { mkdirSync as mkdirSync3, readdirSync as readdirSync3 } from "fs";
 import path12 from "path";
 import {
   AuthStorage,
-  createBashTool,
   createAgentSessionFromServices,
   createAgentSessionServices,
   getAgentDir,
@@ -11780,6 +11973,126 @@ import {
   SettingsManager,
   VERSION as PI_SDK_VERSION
 } from "@earendil-works/pi-coding-agent";
+
+// src/drivers/piCommandTool.ts
+import { spawn as spawn9 } from "child_process";
+import {
+  createBashTool
+} from "@earendil-works/pi-coding-agent";
+var POWERSHELL_STDIN_LOADER = [
+  "$raftReader = [System.IO.StreamReader]::new([Console]::OpenStandardInput(), [System.Text.Encoding]::ASCII, $false)",
+  "try { $raftEncodedScript = $raftReader.ReadToEnd() } finally { $raftReader.Dispose() }",
+  "$raftScript = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($raftEncodedScript))",
+  "& ([ScriptBlock]::Create($raftScript))"
+].join("\r\n");
+var POWERSHELL_ARGS = [
+  "-NoLogo",
+  "-NoProfile",
+  "-NonInteractive",
+  "-ExecutionPolicy",
+  "Bypass",
+  "-Command",
+  POWERSHELL_STDIN_LOADER
+];
+var MAX_TIMEOUT_SECONDS = 2147483647 / 1e3;
+function killWindowsProcessTree(pid) {
+  const killer = spawn9("taskkill.exe", ["/F", "/T", "/PID", String(pid)], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true
+  });
+  killer.unref();
+}
+function buildPiPowerShellScript(command) {
+  return [
+    "$ErrorActionPreference = 'Stop'",
+    "$utf8NoBom = New-Object System.Text.UTF8Encoding($false)",
+    "[Console]::OutputEncoding = $utf8NoBom",
+    "$OutputEncoding = $utf8NoBom",
+    "$global:LASTEXITCODE = 0",
+    "& {",
+    command,
+    "}",
+    "$raftCommandSucceeded = $?",
+    "$raftNativeExitCode = $global:LASTEXITCODE",
+    "if ($raftNativeExitCode -ne 0) { exit $raftNativeExitCode }",
+    "if (-not $raftCommandSucceeded) { exit 1 }",
+    "exit 0",
+    ""
+  ].join("\r\n");
+}
+function createPiPowerShellOperations(deps = {}) {
+  const spawnProcess = deps.spawn ?? spawn9;
+  const killProcessTree = deps.killProcessTree ?? killWindowsProcessTree;
+  return {
+    exec: async (command, cwd, { onData, signal, timeout, env }) => {
+      if (signal?.aborted) throw new Error("aborted");
+      if (timeout !== void 0 && (!Number.isFinite(timeout) || timeout <= 0 || timeout > MAX_TIMEOUT_SECONDS)) {
+        throw new Error(
+          `Invalid timeout: must be between 0 and ${MAX_TIMEOUT_SECONDS} seconds`
+        );
+      }
+      const child = spawnProcess("powershell.exe", [...POWERSHELL_ARGS], {
+        cwd,
+        env,
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+      child.stdout.on("data", onData);
+      child.stderr.on("data", onData);
+      child.stdin.on("error", () => void 0);
+      child.stdin.end(
+        Buffer.from(buildPiPowerShellScript(command), "utf16le").toString(
+          "base64"
+        )
+      );
+      let timedOut = false;
+      const terminate = () => {
+        if (child.pid) killProcessTree(child.pid);
+      };
+      const timeoutHandle = timeout === void 0 ? void 0 : setClockTimeout(() => {
+        timedOut = true;
+        terminate();
+      }, timeout * 1e3);
+      const onAbort = () => terminate();
+      signal?.addEventListener("abort", onAbort, { once: true });
+      if (signal?.aborted) terminate();
+      try {
+        const exitCode = await new Promise((resolve, reject) => {
+          child.once("error", reject);
+          child.once("close", resolve);
+        });
+        if (signal?.aborted) throw new Error("aborted");
+        if (timedOut) throw new Error(`timeout:${timeout}`);
+        return { exitCode };
+      } finally {
+        if (timeoutHandle) clearClockTimeout(timeoutHandle);
+        signal?.removeEventListener("abort", onAbort);
+      }
+    }
+  };
+}
+function createPiCommandTool(cwd, toolSpawnEnv, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const tool = createBashTool(cwd, {
+    ...platform === "win32" ? { operations: createPiPowerShellOperations(deps) } : {},
+    spawnHook: (spawnContext) => ({
+      ...spawnContext,
+      env: {
+        ...spawnContext.env,
+        ...toolSpawnEnv
+      }
+    })
+  });
+  if (platform !== "win32") return tool;
+  return {
+    ...tool,
+    label: "PowerShell",
+    description: "Execute a Windows PowerShell 5.1 command in the current working directory. Use PowerShell syntax, not Bash syntax. Standard output and standard error are returned."
+  };
+}
+
+// src/drivers/pi.ts
 var PI_SESSION_DIR = ".pi-sessions";
 var BUILTIN_SESSION_DIR = ".builtin-sessions";
 var BUILTIN_AGENT_DIR = ".builtin-runtime";
@@ -11888,8 +12201,12 @@ async function withProcessEnvPatch(patch, fn, opts = {}) {
     }
   });
 }
-function resolvePiModelFromRegistry(modelId, modelRegistry) {
+function resolvePiModelFromRegistry(modelId, modelRegistry, runtimeConfig) {
   if (!modelId || modelId === "default") return void 0;
+  if (runtimeConfig.runtime === "builtin" && runtimeConfig.provider.kind === "gateway" && runtimeConfig.model.kind === "custom") {
+    const provider2 = runtimeConfig.provider.providerId === "openai-compatible" ? "openai" : "anthropic";
+    return modelRegistry.find(provider2, runtimeConfig.model.name);
+  }
   const [provider, ...modelParts] = modelId.split("/");
   if (provider && modelParts.length > 0) {
     return modelRegistry.find(provider, modelParts.join("/"));
@@ -12221,7 +12538,7 @@ async function createPiAgentSessionForContext(ctx, sessionId, opts = {}) {
       agent_dir_source: opts.agentDirSource ?? (spawnEnv.PI_CODING_AGENT_DIR ? "spawn_env" : "default"),
       ...launchTraceEvidenceAttrs
     });
-    const model = resolvePiModelFromRegistry(launchRuntimeFields.model, services.modelRegistry);
+    const model = resolvePiModelFromRegistry(launchRuntimeFields.model, services.modelRegistry, runtimeConfig);
     const resolvedModel = formatPiModelLogId(model);
     traceSpan?.addEvent(`${traceEventPrefix}.model_resolved`, {
       available_models_count: services.modelRegistry.getAvailable().length,
@@ -12277,15 +12594,7 @@ async function createPiAgentSessionForContext(ctx, sessionId, opts = {}) {
       model,
       thinkingLevel: launchRuntimeFields.reasoningEffort,
       customTools: [
-        createBashTool(ctx.workingDirectory, {
-          spawnHook: (spawnContext) => ({
-            ...spawnContext,
-            env: {
-              ...spawnContext.env,
-              ...toolSpawnEnv
-            }
-          })
-        })
+        createPiCommandTool(ctx.workingDirectory, toolSpawnEnv)
       ]
     }), { removeFirst: providerEnvScope });
     traceSpan?.addEvent(`${traceEventPrefix}.started`, {
@@ -12596,13 +12905,15 @@ var PiDriver = class {
     return null;
   }
   buildSystemPrompt(config, _agentId) {
+    const windowsPowerShell = process.platform === "win32";
     return buildCliTransportSystemPrompt(config, {
-      extraCriticalRules: [],
+      extraCriticalRules: windowsPowerShell ? ["- Pi's `bash` tool is a compatibility name on Windows: it executes native Windows PowerShell 5.1. Use PowerShell syntax and never Bash heredocs or Unix-only commands."] : [],
       postStartupNotes: [
         "**Pi runtime note:** Slock keeps Pi running as a persistent SDK session. While you are working, Slock may send inbox-count notifications into the current turn; call `raft message check` at natural breakpoints."
       ],
       includeStdinNotificationSection: true,
-      messageNotificationStyle: "direct"
+      messageNotificationStyle: "direct",
+      commandShell: windowsPowerShell ? "powershell" : "posix"
     });
   }
 };
@@ -12638,13 +12949,15 @@ var BuiltInDriver = class extends PiDriver {
     }));
   }
   buildSystemPrompt(config, _agentId) {
+    const windowsPowerShell = process.platform === "win32";
     return buildCliTransportSystemPrompt(config, {
-      extraCriticalRules: [],
+      extraCriticalRules: windowsPowerShell ? ["- This runtime's `bash` tool is a compatibility name on Windows: it executes native Windows PowerShell 5.1. Use PowerShell syntax and never Bash heredocs or Unix-only commands."] : [],
       postStartupNotes: [
         "**Built-in runtime note:** Slock keeps this runtime in an isolated SDK session. While you are working, Slock may send inbox-count notifications into the current turn; call `raft message check` at natural breakpoints."
       ],
       includeStdinNotificationSection: true,
-      messageNotificationStyle: "direct"
+      messageNotificationStyle: "direct",
+      commandShell: windowsPowerShell ? "powershell" : "posix"
     });
   }
 };
@@ -21902,6 +22215,10 @@ var systemClock = {
   clearTimeout: (timer) => clearTimeout(timer)
 };
 var INBOUND_WATCHDOG_MS = 7e4;
+var LEGACY_MACHINE_KEY_MIGRATED_REASON = "legacy_machine_key_migrated";
+function isTerminalMigratedKeyRejection(statusCode, reason) {
+  return statusCode === 401 && reason === LEGACY_MACHINE_KEY_MIGRATED_REASON;
+}
 function normalizeHandshakeReason(value) {
   const raw = Array.isArray(value) ? value[0] : value;
   if (typeof raw !== "string") return null;
@@ -22078,6 +22395,17 @@ var DaemonConnection = class {
         slock_reason_present: Boolean(reason),
         slock_reason: reason
       }, "error");
+      if (isTerminalMigratedKeyRejection(statusCode, reason)) {
+        this.shouldConnect = false;
+        logger.error(
+          '[Daemon] This legacy machine key was already migrated to Raft Computer. Reconnects are stopped because this key cannot authenticate again.\nStop and disable this legacy raft-daemon process. In Raft, open this offline Computer and choose "raft-computer: command not found? Install or re-run setup" to copy the install and setup commands for this server.'
+        );
+        this.trace("daemon.connection.reconnect_stopped", {
+          status_code: statusCode,
+          slock_reason: reason,
+          terminal: true
+        }, "error");
+      }
       this.options.onHandshakeRejected?.({ statusCode, reason });
       response.resume();
       try {
@@ -24670,6 +24998,22 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     },
     endAttrs: ["outcome", "ackSeq", "deliveryId", "error_class", "pending_count"]
   },
+  "daemon.agent_proxy.request": {
+    spanAttrs: [
+      "route_family",
+      "method",
+      "trace_context_state",
+      "proxy_launch_id_present",
+      "correlation_id"
+    ],
+    endAttrs: [
+      "outcome",
+      "local_response_kind",
+      "http_status",
+      "normalized_code",
+      "response_started"
+    ]
+  },
   "daemon.runtime_profile.control.received": {
     spanAttrs: ["agentId", "control_kind", "key_present", "launchId"],
     endAttrs: ["outcome", "error_class"]
@@ -24905,7 +25249,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-ME3NQ5JP.js");
+  await import("./dist-YLMDSQ55.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -26321,6 +26665,11 @@ var DaemonCore = class {
     });
   }
   handleConnect() {
+    try {
+      this.options.lifecycleHooks?.onConnect?.();
+    } catch (err) {
+      logger.warn(`[Daemon] Connection lifecycle hook failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     if (!this.opencliWrappersRegenerated) {
       this.opencliWrappersRegenerated = true;
       try {
@@ -26413,7 +26762,6 @@ var DaemonCore = class {
     for (const agentId of agentsForSnapshot) {
       this.connection.send({ type: "reminder.snapshot.request", agentId });
     }
-    this.options.lifecycleHooks?.onConnect?.();
   }
   handleDisconnect() {
     logger.warn("[Daemon] Lost connection \u2014 agents continue running locally");

package/dist/cli/index.js

@@ -28774,6 +28774,71 @@ function randomHex(length) {
 
 // ../shared/src/tracing/eventRows.ts
 init_esm_shims();
+var TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS = [
+  ["row_kind", "string"],
+  ["service_name", "string"],
+  ["deployment_environment", "string"],
+  ["service_version", "string"],
+  ["service_revision", "string"],
+  ["service_instance_id", "string"],
+  ["deployment_instance_source", "string"],
+  ["deployment_identity_state", "string"],
+  ["ecs_task_id", "string"],
+  ["ecs_task_family", "string"],
+  ["ecs_task_revision", "string"],
+  ["trace_id", "string"],
+  ["span_id", "string"],
+  ["parent_span_id", "string"],
+  ["span_name", "string"],
+  ["span_kind", "string"],
+  ["span_surface", "string"],
+  ["span_status", "string"],
+  ["span_start_time_ms", "int"],
+  ["span_end_time_ms", "int"],
+  ["event_name", "string"],
+  ["event_kind", "string"],
+  ["event_time", "timestamp"],
+  ["event_time_ms", "int"],
+  ["event_index", "int"],
+  ["server_id", "string"],
+  ["machine_id", "string"],
+  ["agent_id", "string"],
+  ["launch_id", "string"],
+  ["session_id", "string"],
+  ["request_id", "string"],
+  ["route_pattern", "string"],
+  ["caller_kind", "string"],
+  ["outcome", "string"],
+  ["reason", "string"],
+  ["source", "string"],
+  ["authority", "string"],
+  ["activity_write_site", "string"],
+  ["activity_source", "string"],
+  ["hint_source", "string"],
+  ["resolved_activity", "string"],
+  ["previous_activity", "string"],
+  ["next_activity", "string"],
+  ["repair_kind", "string"],
+  ["action", "string"],
+  ["error_class", "string"],
+  ["status_bucket", "string"],
+  ["shadow_agent_id", "string"],
+  ["shadow_signal_site", "string"],
+  ["shadow_observation_class", "string"],
+  ["shadow_prior_projection", "string"],
+  ["shadow_projection", "string"],
+  ["shadow_legacy_outcome", "string"],
+  ["shadow_action", "string"],
+  ["shadow_reason", "string"],
+  ["shadow_direction", "string"],
+  ["shadow_plan_kind", "string"]
+];
+var TRACE_EVENT_ROW_V2_INGEST_STATEMENT = [
+  "SELECT",
+  TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column, type]) => `$0["${column}"]::${type} AS ${column}`).join(", "),
+  "INSERT INTO raft.trace_events_v2",
+  `(${TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column]) => column).join(", ")})`
+].join(" ");
 var PROMOTED_IDENTITY_ATTRS = [
   "server_id",
   "machine_id",
@@ -42899,7 +42964,7 @@ var integrationAppDraftFieldsSchema = external_exports.object({
 var integrationRegisterAppOperationSchema = integrationAppDraftFieldsSchema.extend({
   type: external_exports.literal("integration:register_app"),
   name: external_exports.string().trim().min(1).max(120),
-  clientKey: external_exports.string().trim().min(1).max(120),
+  clientKey: external_exports.string().trim().min(1).max(120).optional(),
   returnUrl: external_exports.string().trim().min(1).max(2e3),
   scopes: external_exports.array(external_exports.string().trim().min(1).max(120)).max(64).default([]),
   unsafeDemoUrlOverride: external_exports.boolean().optional(),
@@ -43343,10 +43408,8 @@ var agentApiIntegrationLoginBodySchema = passthroughObject({
   scopes: optionalStringArraySchema,
   target: optionalStringSchema
 });
-var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
-  mode: external_exports.enum(["register", "update"]),
+var agentApiIntegrationAppPrepareCommonBodyShape = {
   target: external_exports.string().trim().min(1),
-  clientKey: external_exports.string().trim().min(1),
   name: optionalStringSchema,
   description: optionalStringSchema,
   homepageUrl: optionalStringSchema,
@@ -43355,7 +43418,19 @@ var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
   scopes: optionalStringArraySchema,
   unsafeDemoUrlOverride: optionalBooleanSchema,
   draftHint: optionalStringSchema
-});
+};
+var agentApiIntegrationAppPrepareBodySchema = external_exports.discriminatedUnion("mode", [
+  passthroughObject({
+    mode: external_exports.literal("register"),
+    ...agentApiIntegrationAppPrepareCommonBodyShape,
+    clientKey: optionalStringSchema
+  }),
+  passthroughObject({
+    mode: external_exports.literal("update"),
+    ...agentApiIntegrationAppPrepareCommonBodyShape,
+    clientKey: external_exports.string().trim().min(1)
+  })
+]);
 var agentApiIntegrationAppRotateSecretBodySchema = passthroughObject({
   clientKey: external_exports.string().trim().min(1)
 });
@@ -45404,6 +45479,9 @@ init_esm_shims();
 // ../shared/src/sync-core/testing.ts
 init_esm_shims();
 
+// ../shared/src/onboardingStateMachineContract.ts
+init_esm_shims();
+
 // ../shared/src/testing/failpoints.ts
 init_esm_shims();
 var NoopFailpointRegistry = class {
@@ -51525,6 +51603,7 @@ function formatPendingMentionActions(actions, opts = {}) {
   const lines = opts.source === "send" ? [
     "Undelivered mentions",
     "Message was sent, but these @mentions were not delivered:",
+    "For a literal name rather than a recipient, wrap the @handle in inline or fenced code.",
     ""
   ] : ["Pending mention actions", ""];
   for (const action of actions) {
@@ -51538,7 +51617,7 @@ function formatPendingMentionActions(actions, opts = {}) {
       lines.push("  recovery commands:");
       lines.push(...commands);
       if (commands.some((command) => command.includes(" mention notify "))) {
-        lines.push("  note: notify can still report dropped; check the command result before assuming delivery.");
+        lines.push("  note: notify exits nonzero unless the target queue accepts the delivery.");
       }
     }
   }
@@ -51917,12 +51996,19 @@ ${driveByTip}` : "";
   if (pendingMentionActions.length > 0) {
     writeUndeliveredMentionWarning(ctx.io, pendingMentionActions.length);
   }
+  const mentionDeliveryError = pendingMentionActions.length > 0 ? cliError(
+    "MENTION_DELIVERY_FAILED",
+    `Message ${data.messageId} was sent, but ${pendingMentionActions.length} @mention${pendingMentionActions.length === 1 ? " was" : "s were"} not delivered.`,
+    { suggestedNextAction: "Run `raft mention pending` and complete or explicitly resolve every pending mention action." }
+  ) : null;
   if (opts.json) {
     writeJson(ctx.io, data);
+    if (mentionDeliveryError) throw mentionDeliveryError;
     return;
   }
   writeText(ctx.io, `${sentStatusLine}${replyHint}${driveBySection}${mentionSection}${unreadSection}
 `);
+  if (mentionDeliveryError) throw mentionDeliveryError;
 }
 var messageSendCommand = defineCommand(
   {
@@ -53122,6 +53208,17 @@ init_esm_shims();
 
 // src/commands/mention/execute.ts
 init_esm_shims();
+function resultSucceeded(action, status) {
+  return action === "notify" ? status === "queued" : status === "delivered";
+}
+function formatFailedMentionActions(action, requestedIds, results) {
+  const returnedIds = new Set(results.map((result2) => result2.resolutionId));
+  const failures = results.filter((result2) => !resultSucceeded(action, result2.status)).map((result2) => `${result2.resolutionId}: ${result2.status}${result2.reason ? ` (${result2.reason})` : ""}`);
+  for (const id of requestedIds) {
+    if (!returnedIds.has(id)) failures.push(`${id}: missing_result`);
+  }
+  return failures.length > 0 ? failures.join(", ") : null;
+}
 function normalizeResolutionIds(rawIds) {
   const ids = (rawIds ?? []).map((id) => id.trim()).filter(Boolean);
   if (ids.length === 0) {
@@ -53149,6 +53246,13 @@ function buildMentionExecuteCommand(action) {
         throw cliError(res.status >= 500 ? "SERVER_5XX" : "MENTION_ACTION_FAILED", res.error ?? `HTTP ${res.status}`);
       }
       const results = normalizeMentionActionResults(res.data);
+      const failure3 = formatFailedMentionActions(action, ids, results);
+      if (failure3) {
+        throw cliError(
+          "MENTION_ACTION_FAILED",
+          `Mention ${action} did not complete for every requested target: ${failure3}`
+        );
+      }
       if (opts.json) {
         writeJson(ctx.io, { ok: true, action, results });
         return;
@@ -54731,7 +54835,7 @@ function optionalTrimmed(value) {
 function formatAppPrepare(data) {
   const lines = [
     `Integration app ${data.mode} card prepared`,
-    `client key: ${data.action.clientKey}`,
+    `client key: ${data.action.clientKey ?? "auto-generated on commit"}`,
     `card: ${data.actionCardMessageId}`,
     `target: ${data.target}`
   ];
@@ -54749,14 +54853,11 @@ function formatAppPrepare(data) {
 }
 async function prepareApp(mode, ctx, opts) {
   const target = requiredTrimmed(opts.target, "--target");
-  const clientKey = requiredTrimmed(opts.clientKey, "--client-key");
   const scopes = normalizeScopes3([...opts.scope ?? [], ...opts.scopes ?? []]);
   const agentContext = ctx.loadAgentContext();
   const client = ctx.createApiClient(agentContext);
-  const body = {
-    mode,
+  const commonBody = {
     target,
-    clientKey,
     name: optionalTrimmed(opts.name),
     description: optionalTrimmed(opts.description),
     homepageUrl: optionalTrimmed(opts.homepageUrl) ?? optionalTrimmed(opts.appUrl),
@@ -54765,7 +54866,8 @@ async function prepareApp(mode, ctx, opts) {
     scopes,
     unsafeDemoUrlOverride: opts.unsafeDemoUrlOverride === true
   };
-  if (mode === "register") {
+  const body = mode === "update" ? { ...commonBody, mode: "update", clientKey: requiredTrimmed(opts.clientKey, "--client-key") } : { ...commonBody, mode: "register", clientKey: optionalTrimmed(opts.clientKey) };
+  if (body.mode === "register") {
     requiredTrimmed(body.name, "--name");
     requiredTrimmed(body.returnUrl, "--redirect-url");
   }
@@ -54944,7 +55046,7 @@ var integrationAppPrepareRecoverOwnerCommand = defineCommand(
   async (ctx, opts) => prepareRecoverOwner(ctx, opts)
 );
 var sharedOptions = [
-  { flags: "--client-key <key>", description: "Stable app client key / OAuth client_id to reserve or update" },
+  { flags: "--client-key <key>", description: "Stable app client key / OAuth client_id to reserve or update; register defaults to server-generated" },
   { flags: "--name <name>", description: "App display name" },
   { flags: "--redirect-url <url>", description: "OAuth redirect/callback URL" },
   { flags: "--app-url <url>", description: "App homepage URL" },

package/dist/core.js

@@ -36,7 +36,7 @@ import {
   stageAgentMigrationObjectStoreBundle,
   subscribeDaemonLogs,
   verifyAgentMigrationAdoptPlan
-} from "./chunk-LHJUHF42.js";
+} from "./chunk-BK46OPUN.js";
 export {
   AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
   AGENT_MIGRATION_CONTROL_SEAM_ENV,

package/dist/{dist-ME3NQ5JP.js → dist-YLMDSQ55.js}

@@ -28522,6 +28522,71 @@ function randomHex(length) {
   return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 init_esm_shims();
+var TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS = [
+  ["row_kind", "string"],
+  ["service_name", "string"],
+  ["deployment_environment", "string"],
+  ["service_version", "string"],
+  ["service_revision", "string"],
+  ["service_instance_id", "string"],
+  ["deployment_instance_source", "string"],
+  ["deployment_identity_state", "string"],
+  ["ecs_task_id", "string"],
+  ["ecs_task_family", "string"],
+  ["ecs_task_revision", "string"],
+  ["trace_id", "string"],
+  ["span_id", "string"],
+  ["parent_span_id", "string"],
+  ["span_name", "string"],
+  ["span_kind", "string"],
+  ["span_surface", "string"],
+  ["span_status", "string"],
+  ["span_start_time_ms", "int"],
+  ["span_end_time_ms", "int"],
+  ["event_name", "string"],
+  ["event_kind", "string"],
+  ["event_time", "timestamp"],
+  ["event_time_ms", "int"],
+  ["event_index", "int"],
+  ["server_id", "string"],
+  ["machine_id", "string"],
+  ["agent_id", "string"],
+  ["launch_id", "string"],
+  ["session_id", "string"],
+  ["request_id", "string"],
+  ["route_pattern", "string"],
+  ["caller_kind", "string"],
+  ["outcome", "string"],
+  ["reason", "string"],
+  ["source", "string"],
+  ["authority", "string"],
+  ["activity_write_site", "string"],
+  ["activity_source", "string"],
+  ["hint_source", "string"],
+  ["resolved_activity", "string"],
+  ["previous_activity", "string"],
+  ["next_activity", "string"],
+  ["repair_kind", "string"],
+  ["action", "string"],
+  ["error_class", "string"],
+  ["status_bucket", "string"],
+  ["shadow_agent_id", "string"],
+  ["shadow_signal_site", "string"],
+  ["shadow_observation_class", "string"],
+  ["shadow_prior_projection", "string"],
+  ["shadow_projection", "string"],
+  ["shadow_legacy_outcome", "string"],
+  ["shadow_action", "string"],
+  ["shadow_reason", "string"],
+  ["shadow_direction", "string"],
+  ["shadow_plan_kind", "string"]
+];
+var TRACE_EVENT_ROW_V2_INGEST_STATEMENT = [
+  "SELECT",
+  TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column, type]) => `$0["${column}"]::${type} AS ${column}`).join(", "),
+  "INSERT INTO raft.trace_events_v2",
+  `(${TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column]) => column).join(", ")})`
+].join(" ");
 var PROMOTED_IDENTITY_ATTRS = [
   "server_id",
   "machine_id",
@@ -42461,7 +42526,7 @@ var integrationAppDraftFieldsSchema = external_exports.object({
 var integrationRegisterAppOperationSchema = integrationAppDraftFieldsSchema.extend({
   type: external_exports.literal("integration:register_app"),
   name: external_exports.string().trim().min(1).max(120),
-  clientKey: external_exports.string().trim().min(1).max(120),
+  clientKey: external_exports.string().trim().min(1).max(120).optional(),
   returnUrl: external_exports.string().trim().min(1).max(2e3),
   scopes: external_exports.array(external_exports.string().trim().min(1).max(120)).max(64).default([]),
   unsafeDemoUrlOverride: external_exports.boolean().optional(),
@@ -42895,10 +42960,8 @@ var agentApiIntegrationLoginBodySchema = passthroughObject({
   scopes: optionalStringArraySchema,
   target: optionalStringSchema
 });
-var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
-  mode: external_exports.enum(["register", "update"]),
+var agentApiIntegrationAppPrepareCommonBodyShape = {
   target: external_exports.string().trim().min(1),
-  clientKey: external_exports.string().trim().min(1),
   name: optionalStringSchema,
   description: optionalStringSchema,
   homepageUrl: optionalStringSchema,
@@ -42907,7 +42970,19 @@ var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
   scopes: optionalStringArraySchema,
   unsafeDemoUrlOverride: optionalBooleanSchema,
   draftHint: optionalStringSchema
-});
+};
+var agentApiIntegrationAppPrepareBodySchema = external_exports.discriminatedUnion("mode", [
+  passthroughObject({
+    mode: external_exports.literal("register"),
+    ...agentApiIntegrationAppPrepareCommonBodyShape,
+    clientKey: optionalStringSchema
+  }),
+  passthroughObject({
+    mode: external_exports.literal("update"),
+    ...agentApiIntegrationAppPrepareCommonBodyShape,
+    clientKey: external_exports.string().trim().min(1)
+  })
+]);
 var agentApiIntegrationAppRotateSecretBodySchema = passthroughObject({
   clientKey: external_exports.string().trim().min(1)
 });
@@ -44918,6 +44993,7 @@ init_esm_shims();
 init_esm_shims();
 init_esm_shims();
 init_esm_shims();
+init_esm_shims();
 var NoopFailpointRegistry = class {
   get enabled() {
     return false;
@@ -50897,6 +50973,7 @@ function formatPendingMentionActions(actions, opts = {}) {
   const lines = opts.source === "send" ? [
     "Undelivered mentions",
     "Message was sent, but these @mentions were not delivered:",
+    "For a literal name rather than a recipient, wrap the @handle in inline or fenced code.",
     ""
   ] : ["Pending mention actions", ""];
   for (const action of actions) {
@@ -50910,7 +50987,7 @@ function formatPendingMentionActions(actions, opts = {}) {
       lines.push("  recovery commands:");
       lines.push(...commands);
       if (commands.some((command) => command.includes(" mention notify "))) {
-        lines.push("  note: notify can still report dropped; check the command result before assuming delivery.");
+        lines.push("  note: notify exits nonzero unless the target queue accepts the delivery.");
       }
     }
   }
@@ -51282,12 +51359,19 @@ ${driveByTip}` : "";
   if (pendingMentionActions.length > 0) {
     writeUndeliveredMentionWarning(ctx.io, pendingMentionActions.length);
   }
+  const mentionDeliveryError = pendingMentionActions.length > 0 ? cliError(
+    "MENTION_DELIVERY_FAILED",
+    `Message ${data.messageId} was sent, but ${pendingMentionActions.length} @mention${pendingMentionActions.length === 1 ? " was" : "s were"} not delivered.`,
+    { suggestedNextAction: "Run `raft mention pending` and complete or explicitly resolve every pending mention action." }
+  ) : null;
   if (opts.json) {
     writeJson(ctx.io, data);
+    if (mentionDeliveryError) throw mentionDeliveryError;
     return;
   }
   writeText(ctx.io, `${sentStatusLine}${replyHint}${driveBySection}${mentionSection}${unreadSection}
 `);
+  if (mentionDeliveryError) throw mentionDeliveryError;
 }
 var messageSendCommand = defineCommand(
   {
@@ -52442,6 +52526,17 @@ function registerTaskUpdateCommand(parent, runtimeOptions) {
 }
 init_esm_shims();
 init_esm_shims();
+function resultSucceeded(action, status) {
+  return action === "notify" ? status === "queued" : status === "delivered";
+}
+function formatFailedMentionActions(action, requestedIds, results) {
+  const returnedIds = new Set(results.map((result2) => result2.resolutionId));
+  const failures = results.filter((result2) => !resultSucceeded(action, result2.status)).map((result2) => `${result2.resolutionId}: ${result2.status}${result2.reason ? ` (${result2.reason})` : ""}`);
+  for (const id of requestedIds) {
+    if (!returnedIds.has(id)) failures.push(`${id}: missing_result`);
+  }
+  return failures.length > 0 ? failures.join(", ") : null;
+}
 function normalizeResolutionIds(rawIds) {
   const ids = (rawIds ?? []).map((id) => id.trim()).filter(Boolean);
   if (ids.length === 0) {
@@ -52469,6 +52564,13 @@ function buildMentionExecuteCommand(action) {
         throw cliError(res.status >= 500 ? "SERVER_5XX" : "MENTION_ACTION_FAILED", res.error ?? `HTTP ${res.status}`);
       }
       const results = normalizeMentionActionResults(res.data);
+      const failure3 = formatFailedMentionActions(action, ids, results);
+      if (failure3) {
+        throw cliError(
+          "MENTION_ACTION_FAILED",
+          `Mention ${action} did not complete for every requested target: ${failure3}`
+        );
+      }
       if (opts.json) {
         writeJson(ctx.io, { ok: true, action, results });
         return;
@@ -54016,7 +54118,7 @@ function optionalTrimmed(value) {
 function formatAppPrepare(data) {
   const lines = [
     `Integration app ${data.mode} card prepared`,
-    `client key: ${data.action.clientKey}`,
+    `client key: ${data.action.clientKey ?? "auto-generated on commit"}`,
     `card: ${data.actionCardMessageId}`,
     `target: ${data.target}`
   ];
@@ -54034,14 +54136,11 @@ function formatAppPrepare(data) {
 }
 async function prepareApp(mode, ctx, opts) {
   const target = requiredTrimmed(opts.target, "--target");
-  const clientKey = requiredTrimmed(opts.clientKey, "--client-key");
   const scopes = normalizeScopes3([...opts.scope ?? [], ...opts.scopes ?? []]);
   const agentContext = ctx.loadAgentContext();
   const client = ctx.createApiClient(agentContext);
-  const body = {
-    mode,
+  const commonBody = {
     target,
-    clientKey,
     name: optionalTrimmed(opts.name),
     description: optionalTrimmed(opts.description),
     homepageUrl: optionalTrimmed(opts.homepageUrl) ?? optionalTrimmed(opts.appUrl),
@@ -54050,7 +54149,8 @@ async function prepareApp(mode, ctx, opts) {
     scopes,
     unsafeDemoUrlOverride: opts.unsafeDemoUrlOverride === true
   };
-  if (mode === "register") {
+  const body = mode === "update" ? { ...commonBody, mode: "update", clientKey: requiredTrimmed(opts.clientKey, "--client-key") } : { ...commonBody, mode: "register", clientKey: optionalTrimmed(opts.clientKey) };
+  if (body.mode === "register") {
     requiredTrimmed(body.name, "--name");
     requiredTrimmed(body.returnUrl, "--redirect-url");
   }
@@ -54229,7 +54329,7 @@ var integrationAppPrepareRecoverOwnerCommand = defineCommand(
   async (ctx, opts) => prepareRecoverOwner(ctx, opts)
 );
 var sharedOptions = [
-  { flags: "--client-key <key>", description: "Stable app client key / OAuth client_id to reserve or update" },
+  { flags: "--client-key <key>", description: "Stable app client key / OAuth client_id to reserve or update; register defaults to server-generated" },
   { flags: "--name <name>", description: "App display name" },
   { flags: "--redirect-url <url>", description: "OAuth redirect/callback URL" },
   { flags: "--app-url <url>", description: "App homepage URL" },

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   DAEMON_CLI_USAGE,
   DaemonCore,
   parseDaemonCliArgs
-} from "./chunk-LHJUHF42.js";
+} from "./chunk-BK46OPUN.js";
 
 // src/index.ts
 var parsedArgs = parseDaemonCliArgs(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/raft-daemon",
-  "version": "0.72.12",
+  "version": "1.0.1",
   "type": "module",
   "bin": {
     "raft-daemon": "dist/raft-daemon.js",