@botiverse/raft-daemon 0.72.2 → 0.72.4-play.20260709142358

package/dist/{chunk-7RB6FSFI.js → chunk-OEK5FGK6.js}

@@ -1,5 +1,5 @@
 // src/core.ts
-import path20 from "path";
+import path22 from "path";
 import os8 from "os";
 import { createRequire as createRequire3 } from "module";
 import { accessSync } from "fs";
@@ -484,7 +484,7 @@ var RUNTIME_PROVIDER_DISPLAY_NAMES = {
   "openrouter": "OpenRouter",
   "xai": "xAI",
   "xiaomi": "Xiaomi MiMo",
-  "zai": "ZAI",
+  "zai": "ZAI Coding Plan (Global)",
   "zai-coding-cn": "ZAI Coding Plan (China)"
 };
 
@@ -2694,6 +2694,51 @@ var agentApiReminderResponseSchema = passthroughObject({
 var agentApiReminderLogResponseSchema = passthroughObject({
   events: z2.array(agentApiReminderEventSummarySchema)
 });
+var agentApiMigrationStateSchema = z2.enum(["prep", "ready", "in_transit", "arriving", "completed", "aborted", "failed"]);
+var agentApiMigrationSummarySchema = passthroughObject({
+  id: z2.string(),
+  agentId: z2.string(),
+  sourceMachineId: z2.string(),
+  targetMachineId: z2.string(),
+  state: agentApiMigrationStateSchema,
+  manifestPath: nullableStringSchema,
+  manifestSha256: nullableStringSchema,
+  arrivalReportPath: nullableStringSchema,
+  arrivalReportSha256: nullableStringSchema,
+  abortReason: nullableStringSchema,
+  failureReason: nullableStringSchema,
+  prepDeadlineAt: z2.string().datetime(),
+  transferDeadlineAt: z2.string().datetime(),
+  arrivalDeadlineAt: z2.string().datetime(),
+  readyAt: nullableStringSchema,
+  flippedAt: nullableStringSchema,
+  arrivedAt: nullableStringSchema,
+  completedAt: nullableStringSchema,
+  abortedAt: nullableStringSchema,
+  revision: z2.number().int().positive(),
+  createdAt: z2.string().datetime(),
+  updatedAt: z2.string().datetime()
+});
+var agentApiMigrationBeginBodySchema = passthroughObject({
+  targetMachineId: z2.string().trim().min(1),
+  prepDeadlineMs: z2.number().int().positive().optional(),
+  transferDeadlineMs: z2.number().int().positive().optional(),
+  arrivalDeadlineMs: z2.number().int().positive().optional()
+});
+var agentApiMigrationReadyBodySchema = passthroughObject({
+  manifestPath: z2.string().trim().min(1),
+  manifestSha256: optionalStringSchema
+});
+var agentApiMigrationArrivedBodySchema = passthroughObject({
+  reportPath: optionalStringSchema,
+  reportSha256: optionalStringSchema
+});
+var agentApiMigrationResponseSchema = passthroughObject({
+  migration: agentApiMigrationSummarySchema
+});
+var agentApiMigrationStatusResponseSchema = passthroughObject({
+  migration: agentApiMigrationSummarySchema.nullable()
+});
 function route(input) {
   return {
     ...input,
@@ -2941,6 +2986,46 @@ var agentApiContract = {
     request: { body: agentApiTaskUpdateStatusBodySchema },
     response: { body: agentApiTaskUpdateStatusResponseSchema }
   }),
+  migrationBegin: route({
+    key: "migrationBegin",
+    method: "POST",
+    path: "/migrations",
+    client: { resource: "migrations", method: "begin" },
+    capability: "server",
+    description: "Begin a migration for the bound agent credential.",
+    request: { body: agentApiMigrationBeginBodySchema },
+    response: { body: agentApiMigrationResponseSchema }
+  }),
+  migrationStatus: route({
+    key: "migrationStatus",
+    method: "GET",
+    path: "/migrations/current",
+    client: { resource: "migrations", method: "status" },
+    capability: "read",
+    description: "Read the active migration for the bound agent credential, if any.",
+    request: {},
+    response: { body: agentApiMigrationStatusResponseSchema }
+  }),
+  migrationReady: route({
+    key: "migrationReady",
+    method: "POST",
+    path: "/migrations/ready",
+    client: { resource: "migrations", method: "ready" },
+    capability: "read",
+    description: "Mark the bound agent's active migration prep phase ready.",
+    request: { body: agentApiMigrationReadyBodySchema },
+    response: { body: agentApiMigrationResponseSchema }
+  }),
+  migrationArrived: route({
+    key: "migrationArrived",
+    method: "POST",
+    path: "/migrations/arrived",
+    client: { resource: "migrations", method: "arrived" },
+    capability: "read",
+    description: "Mark the bound agent's active migration arrival phase complete.",
+    request: { body: agentApiMigrationArrivedBodySchema },
+    response: { body: agentApiMigrationResponseSchema }
+  }),
   reminderList: route({
     key: "reminderList",
     method: "GET",
@@ -3248,6 +3333,14 @@ var AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS = 1e3;
 var AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS = AUTH_REFRESH_ROTATION_DISCOVERY_LAG_BUDGET_MS + AUTH_REFRESH_ROTATED_TOKEN_WAIT_MS + AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS;
 var AUTH_REFRESH_ROTATION_REPLAY_GRACE_MARGIN_MS = AUTH_REFRESH_ROTATED_REPLAY_GRACE_MS - AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS;
 
+// ../shared/src/clock.ts
+function currentTimeMs() {
+  return Date.now();
+}
+function currentDate() {
+  return new Date(currentTimeMs());
+}
+
 // ../shared/src/agentInbox.ts
 function formatAgentInboxDelta(rows, options = {}) {
   const totalPendingMessages = options.totalPendingMessages;
@@ -3630,7 +3723,7 @@ var EXTERNAL_AGENT_RUNTIME_DISPLAY_NAME = "External agent";
 var RUNTIMES = [
   { id: "claude", displayName: "Claude Code", binary: "claude", supported: true },
   { id: "codex", displayName: "Codex CLI", binary: "codex", supported: true },
-  { id: "builtin", displayName: "Builtin Pi", binary: "", supported: true },
+  { id: "builtin", displayName: "Built-in Pi", binary: "", supported: true },
   { id: "antigravity", displayName: "Antigravity CLI", binary: "agy", supported: true },
   // Kimi: prefer the in-process SDK (`kimi-sdk` → "Kimi Code") for new agents.
   // The legacy `kimi` (kimi-cli child-process) entry stays for backward compat
@@ -4328,8 +4421,8 @@ async function executeResponseRequest(url, init, {
 }
 
 // src/directUploadCapability.ts
-function joinUrl(base, path21) {
-  return `${base.replace(/\/+$/, "")}${path21}`;
+function joinUrl(base, path23) {
+  return `${base.replace(/\/+$/, "")}${path23}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -5019,6 +5112,15 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -6600,7 +6702,9 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
 ];
 var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
   "agent-token",
@@ -6955,7 +7059,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     SLOCK_SERVER_URL: ctx.config.serverUrl,
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -7523,7 +7627,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -7549,7 +7653,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -7975,7 +8079,7 @@ function codexNotificationDiagnosticEvent(message) {
       return null;
   }
   const sessionId = codexMessageThreadId(message);
-  const path21 = boundedString(params.path);
+  const path23 = boundedString(params.path);
   return {
     kind: "runtime_diagnostic",
     severity: "warning",
@@ -7983,7 +8087,7 @@ function codexNotificationDiagnosticEvent(message) {
     itemType: message.method,
     message: diagnosticMessage,
     ...details ? { details } : {},
-    ...path21 ? { path: path21 } : {},
+    ...path23 ? { path: path23 } : {},
     ...params.range !== void 0 ? { range: params.range } : {},
     payloadBytes: payloadBytes(params),
     ...sessionId ? { sessionId } : {}
@@ -9633,11 +9737,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -9693,7 +9797,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -9830,12 +9934,15 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os4 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -9844,6 +9951,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os4.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -9867,7 +10041,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -9891,21 +10083,23 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(hydrateRuntimeConfig(ctx.config));
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -9913,7 +10107,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -10026,14 +10220,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir()) {
-  const configPath = path9.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os4.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -10712,7 +10901,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -11008,7 +11197,9 @@ function createPiSdkEventMappingState(sessionId = null) {
   return {
     sessionId,
     sessionAnnounced: false,
-    sawTextDelta: false
+    sawTextDelta: false,
+    thinkingBuffers: /* @__PURE__ */ new Map(),
+    announcedThinkingIndexes: /* @__PURE__ */ new Set()
   };
 }
 function buildPiSessionDir(workingDirectory) {
@@ -11223,10 +11414,40 @@ function pushSessionInitIfNeeded2(state, events) {
     state.sessionAnnounced = true;
   }
 }
+function piAssistantContentIndex(assistantEvent) {
+  return "contentIndex" in assistantEvent && typeof assistantEvent.contentIndex === "number" ? assistantEvent.contentIndex : 0;
+}
+function announcePiThinkingIfNeeded(index, state) {
+  if (state.announcedThinkingIndexes.has(index)) return [];
+  state.announcedThinkingIndexes.add(index);
+  return [{ kind: "thinking", text: "" }];
+}
+function resetPiThinking(index, state) {
+  state.thinkingBuffers.delete(index);
+  state.announcedThinkingIndexes.delete(index);
+}
 function mapPiAssistantMessageEvent(assistantEvent, state) {
   switch (assistantEvent.type) {
-    case "thinking_delta":
-      return typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0 ? [{ kind: "thinking", text: assistantEvent.delta }] : [];
+    case "thinking_start": {
+      const index = piAssistantContentIndex(assistantEvent);
+      resetPiThinking(index, state);
+      return announcePiThinkingIfNeeded(index, state);
+    }
+    case "thinking_delta": {
+      const index = piAssistantContentIndex(assistantEvent);
+      const events = announcePiThinkingIfNeeded(index, state);
+      if (typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0) {
+        state.thinkingBuffers.set(index, `${state.thinkingBuffers.get(index) ?? ""}${assistantEvent.delta}`);
+      }
+      return events;
+    }
+    case "thinking_end": {
+      const index = piAssistantContentIndex(assistantEvent);
+      const buffered = state.thinkingBuffers.get(index) ?? "";
+      const text = typeof assistantEvent.content === "string" && assistantEvent.content.length > 0 ? assistantEvent.content : buffered;
+      resetPiThinking(index, state);
+      return text ? [{ kind: "thinking", text }] : [];
+    }
     case "text_delta":
       if (typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0) {
         state.sawTextDelta = true;
@@ -11237,8 +11458,6 @@ function mapPiAssistantMessageEvent(assistantEvent, state) {
       return !state.sawTextDelta && typeof assistantEvent.content === "string" && assistantEvent.content.length > 0 ? [{ kind: "text", text: assistantEvent.content }] : [];
     case "error":
       return [{ kind: "error", message: piErrorMessage(assistantEvent.error.errorMessage || assistantEvent.error) }];
-    case "thinking_start":
-    case "thinking_end":
     case "text_start":
     case "toolcall_start":
     case "toolcall_delta":
@@ -11282,6 +11501,8 @@ function mapPiSdkEventToParsedEvents(event, state) {
     case "message_start":
       if (event.message.role === "assistant") {
         state.sawTextDelta = false;
+        state.thinkingBuffers.clear();
+        state.announcedThinkingIndexes.clear();
       }
       return events;
     case "message_update":
@@ -14758,8 +14979,9 @@ function classifyTerminalFailure(ap) {
     if (lower.includes("usage limit") || lower.includes("quota exceeded") || lower.includes("quota limit") || lower.includes("budget limit exceeded") || lower.includes("usage not included in your plan") || lower.includes("modelnotfounderror") || lower.includes("requested entity was not found") || lower.includes("model deprecated") || lower.includes("model not found") || lower.includes("model is not supported") || lower.includes("unsupported model") || /\bmodel\b.*\bnot supported\b/i.test(text) || diagnostics.spanAttrs.runtime_error_action_required === true || isProviderStreamFailureText(text) || isRuntimeStartTimeoutText(text)) {
       const actionRequired = diagnostics.spanAttrs.runtime_error_action_required === true;
       return {
-        detail: actionRequired ? formatRuntimeLoginRequiredMessage(ap.driver.id) : text,
-        actionRequired
+        detail: actionRequired ? formatRuntimeActionRequiredMessage(ap) : text,
+        actionRequired,
+        ...actionRequired ? { entries: buildRuntimeActionRequiredEntries(ap, text, diagnostics) } : {}
       };
     }
   }
@@ -14775,6 +14997,52 @@ function classifyStickyTerminalFailure(ap) {
   if (isRuntimeStartTimeoutText(terminalFailure.detail)) return null;
   return null;
 }
+function formatRuntimeActionRequiredMessage(ap) {
+  if (ap.driver.id === "claude" && isClaudeCustomProviderConfig(ap.config)) {
+    return "Claude Code custom provider authentication failed. Check this agent's custom Claude provider API key/API URL, then retry starting this agent.";
+  }
+  return formatRuntimeLoginRequiredMessage(ap.driver.id);
+}
+function buildRuntimeActionRequiredEntries(ap, text, diagnostics) {
+  const excerpt = String(diagnostics.eventAttrs.runtime_error_message_excerpt ?? "").trim();
+  const subtype = classifyRuntimeActionRequiredSubtype(ap, text);
+  const detail = formatRuntimeActionRequiredMessage(ap);
+  const entries = [
+    { kind: "text", text: `Error: ${detail}` },
+    { kind: "text", text: `Runtime auth diagnostic: ${subtype}` }
+  ];
+  if (excerpt) {
+    entries.push({ kind: "text", text: `Raw error excerpt (redacted): ${excerpt}` });
+  }
+  if (ap.driver.id === "claude") {
+    entries.push({
+      kind: "text",
+      text: isClaudeCustomProviderConfig(ap.config) ? "Claude auth mode: custom provider. Local Claude Code login does not fix this branch; check this agent's provider API key/API URL." : "Claude auth mode: default host login. If Terminal works, set this agent's Claude command to the absolute path from `which claude` and restart Raft Computer."
+    });
+  }
+  return entries;
+}
+function classifyRuntimeActionRequiredSubtype(ap, text) {
+  const lower = text.toLowerCase();
+  const customClaudeProvider = ap.driver.id === "claude" && isClaudeCustomProviderConfig(ap.config);
+  if (customClaudeProvider) {
+    if (/\bmissing\b.*\b(?:api\s*)?key\b|\b(?:api\s*)?key\b.*\bnot set\b|\bmissing\b.*\btoken\b|\bno\b.*\btoken\b/i.test(text)) {
+      return "custom_provider_missing_key";
+    }
+    if (/\binvalid\b.*\b(?:api\s*)?key\b|\bunauthorized\b|\b401\b|\b403\b|auth(?:entication)? failed/i.test(text)) {
+      return "custom_provider_invalid_key";
+    }
+    return "custom_provider_auth_error";
+  }
+  if (ap.driver.id === "claude") {
+    if (lower.includes("not logged in") || lower.includes("not signed in") || lower.includes("please log in") || lower.includes("login required")) {
+      return "host_claude_login_required";
+    }
+    return "runtime_auth_error";
+  }
+  if (ap.driver.id === "builtin") return "builtin_provider_auth_error";
+  return "runtime_auth_error";
+}
 function isAuthClassTerminalLine(text) {
   return buildRuntimeErrorDiagnosticEnvelope(text).spanAttrs.runtime_error_action_required === true;
 }
@@ -16976,7 +17244,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
                   agentId,
                   "error",
                   terminalFailureDetail.detail,
-                  [{ kind: "text", text: `Error: ${terminalFailureDetail.detail}` }],
+                  terminalFailureDetail.entries ?? [{ kind: "text", text: `Error: ${terminalFailureDetail.detail}` }],
                   ap.launchId,
                   "runtime_error"
                 );
@@ -17007,9 +17275,10 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           agentProcess.decisionErrorWindow.recordRuntimeError(startResult.error);
         }
         if (startResult.error && diagnostics?.spanAttrs.runtime_error_action_required === true) {
-          const visibleErrorMessage = formatRuntimeLoginRequiredMessage(agentProcess.driver.id);
+          const terminalFailure = classifyTerminalFailure(agentProcess);
+          const visibleErrorMessage = terminalFailure?.detail ?? formatRuntimeActionRequiredMessage(agentProcess);
           this.broadcastActivity(agentId, "error", visibleErrorMessage, [
-            { kind: "text", text: `Error: ${visibleErrorMessage}` }
+            ...terminalFailure?.entries ?? [{ kind: "text", text: `Error: ${visibleErrorMessage}` }]
           ], agentProcess.launchId, "runtime_error");
         }
         throw new Error(`Runtime session failed to start: ${startResult.reason}${startResult.error ? ` (${startResult.error})` : ""}`);
@@ -20172,11 +20441,12 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           ap.decisionErrorWindow.recordRuntimeError(event.message);
         }
         let visibleErrorMessage = event.message;
+        let visibleErrorEntries;
         if (ap) {
           const runtimeErrorDiagnostics = buildRuntimeErrorDiagnosticEnvelope(event.message);
           const runtimeErrorFingerprint = typeof runtimeErrorDiagnostics.spanAttrs.runtime_error_fingerprint === "string" ? runtimeErrorDiagnostics.spanAttrs.runtime_error_fingerprint : null;
           if (runtimeErrorDiagnostics.spanAttrs.runtime_error_action_required === true) {
-            visibleErrorMessage = formatRuntimeLoginRequiredMessage(ap.driver.id);
+            visibleErrorMessage = formatRuntimeActionRequiredMessage(ap);
           }
           const shouldDisableToolBoundaryFlush = ap.runtime.descriptor.busyDelivery === "gated" && this.isThinkingBlockMutationError(event.message);
           const backoffFailPoint = this.runtimeErrorDeliveryBackoffFailPointForTesting?.({
@@ -20202,6 +20472,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           if (fingerprintFence) {
             visibleErrorMessage = fingerprintFence.detail;
           }
+          visibleErrorEntries = terminalFailure?.entries;
           this.noteRuntimeErrorDeliveryBackoff(agentId, ap, event.message, terminalFailure, stickyTerminalFailure, backoffReasonOverride);
           if (reduction.shouldDisableToolBoundaryFlush) {
             this.recordGatedSteeringEvent(agentId, ap, "disabled", {
@@ -20248,9 +20519,14 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
             }
           }
         }
-        this.broadcastActivity(agentId, "error", visibleErrorMessage, [
-          { kind: "text", text: `Error: ${visibleErrorMessage}` }
-        ], void 0, "runtime_error");
+        this.broadcastActivity(
+          agentId,
+          "error",
+          visibleErrorMessage,
+          visibleErrorEntries ?? [{ kind: "text", text: `Error: ${visibleErrorMessage}` }],
+          void 0,
+          "runtime_error"
+        );
         break;
       }
     }
@@ -20917,8 +21193,11 @@ var DaemonConnection = class {
   doConnect() {
     if (!this.shouldConnect) return;
     if (this.ws && this.ws.readyState !== WebSocket.CLOSED) return;
-    const wsUrl = this.options.serverUrl.replace(/^http/, "ws") + `/daemon/connect?key=${this.options.apiKey}`;
-    const wsOptions = buildWebSocketOptions(wsUrl, this.options.proxyEnv ?? process.env);
+    const wsUrl = this.options.serverUrl.replace(/^http/, "ws") + "/daemon/connect";
+    const wsOptions = {
+      ...buildWebSocketOptions(wsUrl, this.options.proxyEnv ?? process.env),
+      headers: { Authorization: `Bearer ${this.options.apiKey}` }
+    };
     logger.info(`[Daemon] Connecting to ${this.options.serverUrl}...`);
     if (wsOptions?.agent) {
       logger.info("[Daemon] Using configured proxy for WebSocket connection");
@@ -21914,138 +22193,653 @@ function assertLegacyDaemonKeyNotAdoptedByComputer(options) {
   if (match) throw new LegacyDaemonKeyAdoptedByComputerError(match);
 }
 
-// src/agentMigrationExport.ts
-import { createHash as createHash7 } from "crypto";
-import { createReadStream } from "fs";
-import { lstat as lstat2, readdir as readdir4, readFile as readFile3, readlink } from "fs/promises";
-import path19 from "path";
-var AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION = "agent-bundle/v1";
-var REGENERABLE_DIRECTORY_NAMES = [
-  ".venv",
-  "__pycache__",
-  "dist",
-  "node_modules",
-  "target"
-];
-var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
-  ".env",
-  ".env.local",
-  ".env.development",
-  ".env.production",
-  ".env.test",
-  "credentials.json",
-  "credential.json"
-]);
-var ENV_KEY_PATTERN = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-async function buildAgentMigrationExportManifest(input) {
-  const slockHome = path19.resolve(input.slockHome);
-  const workspace = path19.resolve(input.workspacePath ?? path19.join(slockHome, "agents", input.agentId));
-  const proposedIncludes = normalizeProposalPaths(input.cooperativeManifest?.include, workspace, "include");
-  const proposedRegenerableExcludes = normalizeProposalPaths(input.cooperativeManifest?.exclude_regenerable, workspace, "exclude_regenerable");
-  const cleanedProposal = normalizeProposalPaths(input.cooperativeManifest?.cleaned, workspace, "cleaned");
-  const state = {
-    workspace,
-    files: [],
-    excludedRegenerable: [],
-    promotedIncludes: [],
-    proposalRefusals: [
-      ...proposedIncludes.refusals,
-      ...proposedRegenerableExcludes.refusals,
-      ...cleanedProposal.refusals
-    ],
-    unreachable: [],
-    secretsDisclosed: [],
-    seenWorkspacePaths: /* @__PURE__ */ new Set(),
-    explicitIncludePaths: new Set(proposedIncludes.paths)
-  };
-  await walkWorkspace(workspace, "", new Set(proposedRegenerableExcludes.paths), state, { forceIncludeRegenerable: false });
-  for (const requestedPath of proposedIncludes.paths) {
-    if (!state.seenWorkspacePaths.has(requestedPath)) {
-      await includeWorkspacePath(requestedPath, state, { forceIncludeRegenerable: true });
-    }
+// src/agentMigrationHttpTransport.ts
+import { createHash as createHash7, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import http2 from "http";
+import { Readable } from "stream";
+var AGENT_MIGRATION_TRANSPORT_HOST_ENV = "SLOCK_AGENT_MIGRATION_TRANSPORT_HOST";
+var AGENT_MIGRATION_TRANSPORT_PORT_ENV = "SLOCK_AGENT_MIGRATION_TRANSPORT_PORT";
+var AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV = "SLOCK_AGENT_MIGRATION_TRANSPORT_PUBLIC_URL";
+var AGENT_MIGRATION_CONTROL_SEAM_ENV = "SLOCK_AGENT_MIGRATION_CONTROL_SEAM";
+var CONTROL_REQUEST_MAX_BYTES = 8 * 1024 * 1024;
+var MigrationBundleStreamError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
   }
-  for (const requestedPath of proposedRegenerableExcludes.paths) {
-    if (isRegenerablePath(requestedPath)) continue;
-    state.promotedIncludes.push({ path: requestedPath, reason: "exclude_not_regenerable" });
-    await includeWorkspacePath(requestedPath, state, { forceIncludeRegenerable: true });
+};
+var AgentMigrationGrantRegistry = class {
+  grants = /* @__PURE__ */ new Map();
+  now;
+  constructor(now = currentDate) {
+    this.now = now;
   }
-  const crossTreeRefs = await buildCrossTreeRefs(input.runtimeSessionRefs ?? []);
-  const secretDisclosureProposal = normalizeProposalPaths(input.cooperativeManifest?.secrets_disclosed, workspace, "secrets_disclosed");
-  state.proposalRefusals.push(...secretDisclosureProposal.refusals);
-  return {
-    schemaVersion: AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
-    agentId: input.agentId,
-    mode: input.mode,
-    createdAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
-    roots: {
-      slockHome,
-      workspace
-    },
-    defaults: {
-      unknownFiles: "include",
-      excludePolicy: "regenerable_only",
-      regenerableDirectoryNames: [...REGENERABLE_DIRECTORY_NAMES]
-    },
-    files: sortBundleEntries(state.files),
-    excludedRegenerable: sortByPath(state.excludedRegenerable),
-    promotedIncludes: sortByPath(state.promotedIncludes),
-    proposalRefusals: sortByPath(state.proposalRefusals),
-    unreachable: sortByPath(state.unreachable),
-    secretsDisclosed: sortByPath([
-      ...state.secretsDisclosed,
-      ...normalizeProvidedSecretDisclosures(secretDisclosureProposal.paths)
-    ]),
-    cleaned: cleanedProposal.paths,
-    crossTreeRefs: crossTreeRefs.sort((a, b) => a.bundlePath.localeCompare(b.bundlePath))
-  };
-}
-async function walkWorkspace(root, relativeDir, proposedRegenerableExcludes, state, opts) {
-  const absoluteDir = path19.join(root, relativeDir);
-  let entries;
-  try {
-    entries = await readdir4(absoluteDir, { withFileTypes: true });
-  } catch {
-    state.unreachable.push({
-      path: relativeDir || ".",
-      sourcePath: absoluteDir,
-      reason: "read_error"
-    });
-    return;
+  createGrant(input) {
+    const token = input.token ?? randomBytes2(32).toString("base64url");
+    const manifestSha256 = sha256Buffer(canonicalJsonBuffer(input.manifest));
+    const grant = {
+      grantId: input.grantId ?? randomBytes2(16).toString("hex"),
+      tokenHash: hashToken(token),
+      expiresAt: input.expiresAt,
+      oneTimeUse: input.oneTimeUse ?? true,
+      state: "issued",
+      manifest: input.manifest,
+      manifestSha256,
+      bundleEtag: `"agent-migration-${manifestSha256}"`,
+      bundleSizeBytes: normalizeBundleSizeBytes(input.bundleSizeBytes)
+    };
+    this.grants.set(grant.grantId, grant);
+    return { grant, token };
   }
-  entries.sort((a, b) => a.name.localeCompare(b.name));
-  for (const entry of entries) {
-    const relativePath = toPosixPath(path19.join(relativeDir, entry.name));
-    if (entry.isDirectory()) {
-      if (!opts.forceIncludeRegenerable && isRegenerablePath(relativePath)) {
-        if (state.explicitIncludePaths.has(relativePath)) {
-          await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, { forceIncludeRegenerable: true });
-          continue;
-        }
-        if (hasExplicitIncludeDescendant(relativePath, state.explicitIncludePaths)) {
-          await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, opts);
-          continue;
-        }
-        state.excludedRegenerable.push({
-          path: relativePath,
-          reason: proposedRegenerableExcludes.has(relativePath) ? "cooperative_exclude_regenerable" : "regenerable_default",
-          regenerableHint: `${entry.name} is treated as rebuildable/installable state and is not bundled by default`
-        });
-        continue;
-      }
-      await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, opts);
-      continue;
-    }
-    await includeWorkspacePath(relativePath, state, { forceIncludeRegenerable: opts.forceIncludeRegenerable });
+  get(grantId) {
+    return this.grants.get(grantId);
   }
-}
-async function includeWorkspacePath(workspaceRelativePath, state, opts) {
-  const normalizedRelativePath = normalizeRelativePath(workspaceRelativePath);
-  if (state.seenWorkspacePaths.has(normalizedRelativePath)) return;
-  const sourcePath = path19.join(state.workspace, normalizedRelativePath);
-  let stat4;
-  try {
-    stat4 = await lstat2(sourcePath);
-  } catch {
+  authenticate(grantId, token) {
+    const grant = this.grants.get(grantId);
+    if (!grant || !token || !verifyTokenHash(token, grant.tokenHash)) {
+      return { ok: false, status: 401, code: "migration_grant_auth_failed" };
+    }
+    if (grant.state === "revoked" || grant.state === "consumed") {
+      return { ok: false, status: 410, code: "migration_grant_unavailable" };
+    }
+    if (this.now().getTime() >= grant.expiresAt.getTime()) {
+      grant.state = "expired";
+      return { ok: false, status: 410, code: "migration_grant_unavailable" };
+    }
+    return { ok: true, grant };
+  }
+  revokeAll() {
+    for (const grant of this.grants.values()) {
+      if (grant.state !== "consumed" && grant.state !== "expired") {
+        grant.state = "revoked";
+      }
+    }
+  }
+  beginBundleStream(grant) {
+    const current = this.grants.get(grant.grantId);
+    if (current !== grant) return false;
+    if (current.state !== "issued" && current.state !== "interrupted") return false;
+    current.state = "streaming";
+    return true;
+  }
+};
+function createAgentMigrationHttpTransport(options = {}) {
+  const now = options.now ?? currentDate;
+  const registry = new AgentMigrationGrantRegistry(now);
+  const controlBundles = /* @__PURE__ */ new Map();
+  const fallbackBundleStreamFactory = options.bundleStreamFactory ?? defaultBundleStream;
+  const bundleStreamFactory = (grant, request) => {
+    const bundle = controlBundles.get(grant.grantId);
+    if (bundle) {
+      const endExclusive = request.lengthBytes === null ? void 0 : request.offsetBytes + request.lengthBytes;
+      return Readable.from([bundle.subarray(request.offsetBytes, endExclusive)]);
+    }
+    return fallbackBundleStreamFactory(grant, request);
+  };
+  const listenDefaults = options.listen ?? resolveAgentMigrationHttpTransportListenOptions();
+  const controlSeamEnabled = options.controlSeam ?? resolveAgentMigrationControlSeamEnabled();
+  const server = http2.createServer((req, res) => {
+    const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (parsed.pathname.startsWith("/migration-control")) {
+      void handleMigrationControlRequest(req, res, parsed, {
+        enabled: controlSeamEnabled,
+        now,
+        registry,
+        controlBundles
+      });
+      return;
+    }
+    void handleMigrationRequest(req, res, registry, bundleStreamFactory);
+  });
+  return {
+    grants: registry,
+    server,
+    listen: (port = listenDefaults.port ?? 0, host = listenDefaults.host ?? "127.0.0.1") => new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(port, host, () => {
+        server.off("error", reject);
+        const address = server.address();
+        if (!address || typeof address === "string") {
+          reject(new Error("migration transport listen did not produce a TCP address"));
+          return;
+        }
+        resolve({ url: listenDefaults.publicUrl ?? `http://${formatListenAddress(address.address)}:${address.port}` });
+      });
+    }),
+    close: () => new Promise((resolve, reject) => {
+      registry.revokeAll();
+      server.close((err) => {
+        if (err) reject(err);
+        else resolve();
+      });
+    })
+  };
+}
+function resolveAgentMigrationHttpTransportListenOptions(env = process.env) {
+  const host = env[AGENT_MIGRATION_TRANSPORT_HOST_ENV]?.trim();
+  const port = parseOptionalPort(env[AGENT_MIGRATION_TRANSPORT_PORT_ENV]);
+  const publicUrl = env[AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV]?.trim();
+  return {
+    ...host ? { host } : {},
+    ...port !== void 0 ? { port } : {},
+    ...publicUrl ? { publicUrl } : {}
+  };
+}
+function resolveAgentMigrationControlSeamEnabled(env = process.env) {
+  return env[AGENT_MIGRATION_CONTROL_SEAM_ENV]?.trim() !== "0";
+}
+async function handleMigrationControlRequest(req, res, parsed, context) {
+  if (!context.enabled) {
+    sendJson(res, 404, { code: "migration_route_not_found" });
+    return;
+  }
+  if (parsed.pathname !== "/migration-control/grants") {
+    sendJson(res, 404, { code: "migration_route_not_found" });
+    return;
+  }
+  if (req.method !== "POST") {
+    sendJson(res, 405, { code: "migration_method_not_allowed" });
+    return;
+  }
+  let rawInput;
+  try {
+    rawInput = await readJsonRequestBody(req, CONTROL_REQUEST_MAX_BYTES);
+  } catch (err) {
+    if (err instanceof MigrationBundleStreamError) {
+      sendJson(res, err.code === "migration_control_payload_too_large" ? 413 : 400, { code: err.code });
+      return;
+    }
+    sendJson(res, 400, { code: "migration_control_invalid_json" });
+    return;
+  }
+  const input = parseControlGrantInput(rawInput, context.now);
+  if (!input.ok) {
+    sendJson(res, 400, { code: input.code });
+    return;
+  }
+  const { bundle, createGrantInput } = input;
+  const { grant, token } = context.registry.createGrant({
+    ...createGrantInput,
+    bundleSizeBytes: bundle.byteLength
+  });
+  context.controlBundles.set(grant.grantId, bundle);
+  sendJson(res, 201, {
+    grantId: grant.grantId,
+    token,
+    manifestSha256: grant.manifestSha256,
+    bundleSizeBytes: grant.bundleSizeBytes,
+    expiresAt: grant.expiresAt.toISOString(),
+    manifestUrl: `/migration/${encodeURIComponent(grant.grantId)}/manifest`,
+    bundleUrl: `/migration/${encodeURIComponent(grant.grantId)}/bundle.tar`
+  });
+}
+async function handleMigrationRequest(req, res, registry, bundleStreamFactory) {
+  const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
+  const match = /^\/migration\/([^/]+)\/([^/]+)(?:\/([^/]+))?$/.exec(parsed.pathname);
+  if (!match) {
+    sendJson(res, 404, { code: "migration_route_not_found" });
+    return;
+  }
+  const [, grantId, resource, resourceId] = match;
+  const auth = registry.authenticate(decodeURIComponent(grantId), extractBearerToken(req));
+  if (!auth.ok) {
+    sendJson(res, auth.status, { code: auth.code });
+    return;
+  }
+  if (resource === "manifest" && req.method === "GET" && !resourceId) {
+    sendJson(res, 200, {
+      manifestSha256: auth.grant.manifestSha256,
+      manifest: auth.grant.manifest
+    }, {
+      "X-Raft-Manifest-Sha": auth.grant.manifestSha256,
+      ETag: `"manifest-${auth.grant.manifestSha256}"`
+    });
+    return;
+  }
+  if (resource === "bundle.tar" && !resourceId) {
+    if (req.method === "HEAD") {
+      sendHead(res, auth.grant);
+      return;
+    }
+    if (req.method === "GET") {
+      await streamBundle(req, res, auth.grant, registry, bundleStreamFactory);
+      return;
+    }
+  }
+  if (resource === "chunk" && req.method === "GET" && resourceId) {
+    sendJson(res, 501, { code: "migration_chunk_not_implemented" });
+    return;
+  }
+  sendJson(res, 405, { code: "migration_method_not_allowed" });
+}
+function sendHead(res, grant) {
+  res.statusCode = 200;
+  res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
+  res.setHeader("ETag", grant.bundleEtag);
+  res.setHeader("Accept-Ranges", grant.bundleSizeBytes === null ? "none" : "bytes");
+  res.setHeader("X-Raft-Bundle-Size", grant.bundleSizeBytes === null ? "unknown" : grant.bundleSizeBytes.toString());
+  if (grant.bundleSizeBytes !== null) {
+    res.setHeader("Content-Length", grant.bundleSizeBytes.toString());
+  }
+  res.end();
+}
+async function streamBundle(req, res, grant, registry, bundleStreamFactory) {
+  if (grant.state === "streaming") {
+    sendJson(res, 409, { code: "migration_bundle_stream_in_progress" });
+    return;
+  }
+  if (grant.oneTimeUse && grant.state !== "issued" && grant.state !== "interrupted") {
+    sendJson(res, 410, { code: "migration_grant_unavailable" });
+    return;
+  }
+  const range = planRange(req, grant);
+  if (!range.ok) {
+    sendJson(res, 416, { code: range.code }, range.headers);
+    return;
+  }
+  const previousState = grant.state;
+  if (!registry.beginBundleStream(grant)) {
+    sendJson(res, 409, { code: "migration_bundle_stream_in_progress" });
+    return;
+  }
+  let stream;
+  try {
+    stream = bundleStreamFactory(grant, range.request);
+  } catch (err) {
+    grant.state = previousState;
+    const code = err instanceof MigrationBundleStreamError ? err.code : "migration_bundle_stream_failed";
+    sendJson(res, 500, { code });
+    return;
+  }
+  let completed = false;
+  res.on("close", () => {
+    if (!completed && grant.state === "streaming") {
+      grant.state = "interrupted";
+    }
+  });
+  try {
+    res.statusCode = 200;
+    res.setHeader("Content-Type", "application/x-tar");
+    res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
+    res.setHeader("ETag", grant.bundleEtag);
+    res.setHeader("Accept-Ranges", grant.bundleSizeBytes === null ? "none" : "bytes");
+    if (range.request.range) {
+      res.statusCode = 206;
+      res.setHeader("Content-Range", `bytes ${range.request.range.start}-${range.request.range.end}/${grant.bundleSizeBytes}`);
+    }
+    if (range.request.lengthBytes !== null) {
+      res.setHeader("Content-Length", range.request.lengthBytes.toString());
+    }
+    for await (const chunk of stream) {
+      if (!res.write(chunk)) {
+        await onceDrain(res);
+      }
+    }
+    completed = true;
+    grant.state = range.consumesGrant ? "consumed" : "interrupted";
+    res.end();
+  } catch {
+    if (!completed) {
+      grant.state = "interrupted";
+    }
+    if (!res.headersSent) {
+      sendJson(res, 500, { code: "migration_bundle_stream_failed" });
+    } else {
+      res.destroy();
+    }
+  }
+}
+function planRange(req, grant) {
+  const header = singleHeader(req.headers.range);
+  if (!header) {
+    return {
+      ok: true,
+      request: { range: null, offsetBytes: 0, lengthBytes: grant.bundleSizeBytes },
+      consumesGrant: true
+    };
+  }
+  if (grant.bundleSizeBytes === null) {
+    return {
+      ok: false,
+      code: "migration_range_not_available",
+      headers: { "Accept-Ranges": "none" }
+    };
+  }
+  const parsed = parseSingleByteRange(header, grant.bundleSizeBytes);
+  if (!parsed.ok) {
+    return {
+      ok: false,
+      code: parsed.code,
+      headers: {
+        "Accept-Ranges": "bytes",
+        "Content-Range": `bytes */${grant.bundleSizeBytes}`
+      }
+    };
+  }
+  return {
+    ok: true,
+    request: {
+      range: parsed.range,
+      offsetBytes: parsed.range.start,
+      lengthBytes: parsed.range.end - parsed.range.start + 1
+    },
+    consumesGrant: parsed.range.end === grant.bundleSizeBytes - 1
+  };
+}
+function parseSingleByteRange(header, sizeBytes) {
+  const match = /^bytes=(\d+)-(\d*)$/.exec(header.trim());
+  if (!match) {
+    return { ok: false, code: "migration_range_not_satisfiable" };
+  }
+  const start = Number(match[1]);
+  const requestedEnd = match[2] ? Number(match[2]) : sizeBytes - 1;
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(requestedEnd) || start < 0 || requestedEnd < start || start >= sizeBytes) {
+    return { ok: false, code: "migration_range_not_satisfiable" };
+  }
+  return {
+    ok: true,
+    range: {
+      start,
+      end: Math.min(requestedEnd, sizeBytes - 1)
+    }
+  };
+}
+function defaultBundleStream(grant) {
+  void grant;
+  throw new MigrationBundleStreamError("migration_bundle_stream_not_wired");
+}
+function parseControlGrantInput(rawInput, now) {
+  if (!rawInput || typeof rawInput !== "object" || Array.isArray(rawInput)) {
+    return { ok: false, code: "migration_control_invalid_payload" };
+  }
+  const input = rawInput;
+  const manifest = input.manifest;
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    return { ok: false, code: "migration_control_manifest_required" };
+  }
+  const bundle = decodeControlBundle(input);
+  if (!bundle.ok) return bundle;
+  const expiresAt = parseControlGrantExpiry(input, now);
+  if (!expiresAt.ok) return expiresAt;
+  const grantId = optionalNonEmptyString(input.grantId);
+  const token = optionalNonEmptyString(input.token);
+  const oneTimeUse = typeof input.oneTimeUse === "boolean" ? input.oneTimeUse : void 0;
+  return {
+    ok: true,
+    bundle: bundle.bundle,
+    createGrantInput: {
+      ...grantId ? { grantId } : {},
+      ...token ? { token } : {},
+      expiresAt: expiresAt.expiresAt,
+      manifest,
+      ...oneTimeUse === void 0 ? {} : { oneTimeUse }
+    }
+  };
+}
+function decodeControlBundle(input) {
+  if (typeof input.bundleBase64 === "string") {
+    const normalized = input.bundleBase64.trim();
+    if (!normalized) return { ok: false, code: "migration_control_bundle_required" };
+    const bundle = Buffer.from(normalized, "base64");
+    if (bundle.byteLength === 0) return { ok: false, code: "migration_control_bundle_required" };
+    return { ok: true, bundle };
+  }
+  if (typeof input.bundleText === "string") {
+    const bundle = Buffer.from(input.bundleText, "utf8");
+    if (bundle.byteLength === 0) return { ok: false, code: "migration_control_bundle_required" };
+    return { ok: true, bundle };
+  }
+  return { ok: false, code: "migration_control_bundle_required" };
+}
+function parseControlGrantExpiry(input, now) {
+  if (typeof input.expiresAt === "string" && input.expiresAt.trim()) {
+    const expiresAt = new Date(input.expiresAt);
+    if (Number.isNaN(expiresAt.getTime())) {
+      return { ok: false, code: "migration_control_invalid_expiry" };
+    }
+    return { ok: true, expiresAt };
+  }
+  if (input.expiresInSeconds !== void 0) {
+    const expiresInSeconds = input.expiresInSeconds;
+    if (typeof expiresInSeconds !== "number" || !Number.isSafeInteger(expiresInSeconds) || expiresInSeconds <= 0) {
+      return { ok: false, code: "migration_control_invalid_expiry" };
+    }
+    return { ok: true, expiresAt: new Date(now().getTime() + expiresInSeconds * 1e3) };
+  }
+  return { ok: true, expiresAt: new Date(now().getTime() + 15 * 60 * 1e3) };
+}
+function optionalNonEmptyString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function normalizeBundleSizeBytes(size) {
+  if (size === null || size === void 0) return null;
+  if (!Number.isSafeInteger(size) || size < 0) return null;
+  return size;
+}
+function parseOptionalPort(raw) {
+  const value = raw?.trim();
+  if (!value) return void 0;
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error(`${AGENT_MIGRATION_TRANSPORT_PORT_ENV} must be an integer from 0 to 65535`);
+  }
+  return port;
+}
+function formatListenAddress(address) {
+  if (address.includes(":") && !address.startsWith("[")) return `[${address}]`;
+  return address;
+}
+function extractBearerToken(req) {
+  const directHeader = singleHeader(req.headers["x-raft-migration-token"]);
+  if (directHeader) return directHeader;
+  const authorization = singleHeader(req.headers.authorization);
+  if (!authorization) return null;
+  const match = /^Bearer\s+(.+)$/i.exec(authorization);
+  return match?.[1] ?? null;
+}
+function singleHeader(value) {
+  if (!value) return null;
+  return Array.isArray(value) ? value[0] ?? null : value;
+}
+function sendJson(res, status, body, headers = {}) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(payload).toString(),
+    ...headers
+  });
+  res.end(payload);
+}
+function readJsonRequestBody(req, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let totalBytes = 0;
+    let rejected = false;
+    req.on("data", (chunk) => {
+      if (rejected) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      totalBytes += buffer.byteLength;
+      if (totalBytes > maxBytes) {
+        rejected = true;
+        reject(new MigrationBundleStreamError("migration_control_payload_too_large"));
+        return;
+      }
+      chunks.push(buffer);
+    });
+    req.on("error", reject);
+    req.on("end", () => {
+      if (rejected) return;
+      try {
+        const text = Buffer.concat(chunks).toString("utf8");
+        resolve(JSON.parse(text));
+      } catch {
+        reject(new MigrationBundleStreamError("migration_control_invalid_json"));
+      }
+    });
+  });
+}
+function hashToken(token) {
+  return sha256Buffer(Buffer.from(token, "utf8"));
+}
+function verifyTokenHash(token, expectedHashHex) {
+  const actual = Buffer.from(hashToken(token), "hex");
+  const expected = Buffer.from(expectedHashHex, "hex");
+  if (actual.byteLength !== expected.byteLength) return false;
+  return timingSafeEqual(actual, expected);
+}
+function sha256Buffer(buffer) {
+  return createHash7("sha256").update(buffer).digest("hex");
+}
+function canonicalJsonBuffer(value) {
+  return Buffer.from(canonicalJson(value), "utf8");
+}
+function canonicalJson(value) {
+  return JSON.stringify(sortJsonValue(value));
+}
+function sortJsonValue(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.keys(value).sort().reduce((result, key) => {
+    result[key] = sortJsonValue(value[key]);
+    return result;
+  }, {});
+}
+function onceDrain(res) {
+  return new Promise((resolve) => res.once("drain", resolve));
+}
+
+// src/agentMigrationExport.ts
+import { createHash as createHash8 } from "crypto";
+import { createReadStream } from "fs";
+import { lstat as lstat2, readdir as readdir4, readFile as readFile3, readlink } from "fs/promises";
+import path19 from "path";
+var AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION = "agent-bundle/v1";
+var REGENERABLE_DIRECTORY_NAMES = [
+  ".venv",
+  "__pycache__",
+  "dist",
+  "node_modules",
+  "target"
+];
+var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
+  ".env",
+  ".env.local",
+  ".env.development",
+  ".env.production",
+  ".env.test",
+  "credentials.json",
+  "credential.json"
+]);
+var ENV_KEY_PATTERN = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+async function buildAgentMigrationExportManifest(input) {
+  const slockHome = path19.resolve(input.slockHome);
+  const workspace = path19.resolve(input.workspacePath ?? path19.join(slockHome, "agents", input.agentId));
+  const proposedIncludes = normalizeProposalPaths(input.cooperativeManifest?.include, workspace, "include");
+  const proposedRegenerableExcludes = normalizeProposalPaths(input.cooperativeManifest?.exclude_regenerable, workspace, "exclude_regenerable");
+  const cleanedProposal = normalizeProposalPaths(input.cooperativeManifest?.cleaned, workspace, "cleaned");
+  const state = {
+    workspace,
+    files: [],
+    excludedRegenerable: [],
+    promotedIncludes: [],
+    proposalRefusals: [
+      ...proposedIncludes.refusals,
+      ...proposedRegenerableExcludes.refusals,
+      ...cleanedProposal.refusals
+    ],
+    unreachable: [],
+    secretsDisclosed: [],
+    seenWorkspacePaths: /* @__PURE__ */ new Set(),
+    explicitIncludePaths: new Set(proposedIncludes.paths)
+  };
+  await walkWorkspace(workspace, "", new Set(proposedRegenerableExcludes.paths), state, { forceIncludeRegenerable: false });
+  for (const requestedPath of proposedIncludes.paths) {
+    if (!state.seenWorkspacePaths.has(requestedPath)) {
+      await includeWorkspacePath(requestedPath, state, { forceIncludeRegenerable: true });
+    }
+  }
+  for (const requestedPath of proposedRegenerableExcludes.paths) {
+    if (isRegenerablePath(requestedPath)) continue;
+    state.promotedIncludes.push({ path: requestedPath, reason: "exclude_not_regenerable" });
+    await includeWorkspacePath(requestedPath, state, { forceIncludeRegenerable: true });
+  }
+  const crossTreeRefs = await buildCrossTreeRefs(input.runtimeSessionRefs ?? []);
+  const secretDisclosureProposal = normalizeProposalPaths(input.cooperativeManifest?.secrets_disclosed, workspace, "secrets_disclosed");
+  state.proposalRefusals.push(...secretDisclosureProposal.refusals);
+  return {
+    schemaVersion: AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
+    agentId: input.agentId,
+    mode: input.mode,
+    createdAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    roots: {
+      slockHome,
+      workspace
+    },
+    defaults: {
+      unknownFiles: "include",
+      excludePolicy: "regenerable_only",
+      regenerableDirectoryNames: [...REGENERABLE_DIRECTORY_NAMES]
+    },
+    files: sortBundleEntries(state.files),
+    excludedRegenerable: sortByPath(state.excludedRegenerable),
+    promotedIncludes: sortByPath(state.promotedIncludes),
+    proposalRefusals: sortByPath(state.proposalRefusals),
+    unreachable: sortByPath(state.unreachable),
+    secretsDisclosed: sortByPath([
+      ...state.secretsDisclosed,
+      ...normalizeProvidedSecretDisclosures(secretDisclosureProposal.paths)
+    ]),
+    cleaned: cleanedProposal.paths,
+    crossTreeRefs: crossTreeRefs.sort((a, b) => a.bundlePath.localeCompare(b.bundlePath))
+  };
+}
+async function walkWorkspace(root, relativeDir, proposedRegenerableExcludes, state, opts) {
+  const absoluteDir = path19.join(root, relativeDir);
+  let entries;
+  try {
+    entries = await readdir4(absoluteDir, { withFileTypes: true });
+  } catch {
+    state.unreachable.push({
+      path: relativeDir || ".",
+      sourcePath: absoluteDir,
+      reason: "read_error"
+    });
+    return;
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    const relativePath = toPosixPath(path19.join(relativeDir, entry.name));
+    if (entry.isDirectory()) {
+      if (!opts.forceIncludeRegenerable && isRegenerablePath(relativePath)) {
+        if (state.explicitIncludePaths.has(relativePath)) {
+          await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, { forceIncludeRegenerable: true });
+          continue;
+        }
+        if (hasExplicitIncludeDescendant(relativePath, state.explicitIncludePaths)) {
+          await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, opts);
+          continue;
+        }
+        state.excludedRegenerable.push({
+          path: relativePath,
+          reason: proposedRegenerableExcludes.has(relativePath) ? "cooperative_exclude_regenerable" : "regenerable_default",
+          regenerableHint: `${entry.name} is treated as rebuildable/installable state and is not bundled by default`
+        });
+        continue;
+      }
+      await walkWorkspace(root, relativePath, proposedRegenerableExcludes, state, opts);
+      continue;
+    }
+    await includeWorkspacePath(relativePath, state, { forceIncludeRegenerable: opts.forceIncludeRegenerable });
+  }
+}
+async function includeWorkspacePath(workspaceRelativePath, state, opts) {
+  const normalizedRelativePath = normalizeRelativePath(workspaceRelativePath);
+  if (state.seenWorkspacePaths.has(normalizedRelativePath)) return;
+  const sourcePath = path19.join(state.workspace, normalizedRelativePath);
+  let stat4;
+  try {
+    stat4 = await lstat2(sourcePath);
+  } catch {
     state.unreachable.push({
       path: normalizedRelativePath,
       sourcePath,
@@ -22129,7 +22923,7 @@ async function buildCrossTreeRefs(refs) {
   return result;
 }
 async function sha256File(filePath) {
-  const hash = createHash7("sha256");
+  const hash = createHash8("sha256");
   await new Promise((resolve, reject) => {
     const stream = createReadStream(filePath);
     stream.on("data", (chunk) => hash.update(chunk));
@@ -22235,240 +23029,239 @@ function sortByPath(entries) {
   return [...entries].sort((a, b) => a.path.localeCompare(b.path));
 }
 
-// src/agentMigrationHttpTransport.ts
-import { createHash as createHash8, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
-import http2 from "http";
-var MigrationBundleStreamError = class extends Error {
-  constructor(code) {
-    super(code);
-    this.code = code;
-  }
-};
-var AgentMigrationGrantRegistry = class {
-  grants = /* @__PURE__ */ new Map();
-  now;
-  constructor(now = () => /* @__PURE__ */ new Date()) {
-    this.now = now;
-  }
-  createGrant(input) {
-    const token = input.token ?? randomBytes2(32).toString("base64url");
-    const manifestSha256 = sha256Buffer(canonicalJsonBuffer(input.manifest));
-    const grant = {
-      grantId: input.grantId ?? randomBytes2(16).toString("hex"),
-      tokenHash: hashToken(token),
-      expiresAt: input.expiresAt,
-      oneTimeUse: input.oneTimeUse ?? true,
-      state: "issued",
-      manifest: input.manifest,
-      manifestSha256,
-      bundleEtag: `"agent-migration-${manifestSha256}"`
-    };
-    this.grants.set(grant.grantId, grant);
-    return { grant, token };
-  }
-  get(grantId) {
-    return this.grants.get(grantId);
-  }
-  authenticate(grantId, token) {
-    const grant = this.grants.get(grantId);
-    if (!grant || !token || !verifyTokenHash(token, grant.tokenHash)) {
-      return { ok: false, status: 401, code: "migration_grant_auth_failed" };
-    }
-    if (grant.state === "revoked" || grant.state === "consumed") {
-      return { ok: false, status: 410, code: "migration_grant_unavailable" };
-    }
-    if (this.now().getTime() >= grant.expiresAt.getTime()) {
-      grant.state = "expired";
-      return { ok: false, status: 410, code: "migration_grant_unavailable" };
-    }
-    return { ok: true, grant };
-  }
-  revokeAll() {
-    for (const grant of this.grants.values()) {
-      if (grant.state !== "consumed" && grant.state !== "expired") {
-        grant.state = "revoked";
-      }
-    }
+// src/agentMigrationImport.ts
+import { createHash as createHash9 } from "crypto";
+import { createReadStream as createReadStream2 } from "fs";
+import { access as access2, cp, lstat as lstat3, mkdir as mkdir3, readlink as readlink2, rename, writeFile as writeFile3 } from "fs/promises";
+import path20 from "path";
+async function buildAgentMigrationAdoptPlan(input) {
+  const slockHome = path20.resolve(input.slockHome);
+  let manifest;
+  if (input.sourceKind === "orphan_directory" && !input.manifest) {
+    manifest = await buildAgentMigrationExportManifest({
+      agentId: input.agentId,
+      slockHome,
+      workspacePath: path20.resolve(input.orphanWorkspacePath),
+      mode: "forensic",
+      now: input.now
+    });
+  } else if (input.manifest) {
+    manifest = input.manifest;
+  } else {
+    throw new Error("MIGRATION_MANIFEST_MISSING");
   }
-};
-function createAgentMigrationHttpTransport(options = {}) {
-  const registry = new AgentMigrationGrantRegistry(options.now);
-  const bundleStreamFactory = options.bundleStreamFactory ?? defaultBundleStream;
-  const server = http2.createServer((req, res) => {
-    void handleMigrationRequest(req, res, registry, bundleStreamFactory);
+  assertManifestIdentity({
+    manifest,
+    expectedAgentId: input.sourceKind === "orphan_directory" ? input.agentId : manifest.agentId
   });
+  const sourceWorkspacePath = path20.resolve(
+    input.sourceKind === "staged_bundle" ? input.stagingWorkspacePath : input.orphanWorkspacePath
+  );
+  const finalWorkspacePath = path20.resolve(input.finalWorkspacePath ?? path20.join(slockHome, "agents", manifest.agentId));
+  const reportPath = path20.resolve(input.reportPath ?? path20.join(
+    slockHome,
+    "migrations",
+    sanitizePathSegment(input.generation.grantKey),
+    "arrival-report.json"
+  ));
+  const manifestSha256 = hashAgentMigrationManifest(manifest);
+  if (input.manifestSha256 && input.manifestSha256 !== manifestSha256) {
+    throw new Error("MIGRATION_MANIFEST_SHA_MISMATCH");
+  }
   return {
-    grants: registry,
-    server,
-    listen: (port = 0, host = "127.0.0.1") => new Promise((resolve, reject) => {
-      server.once("error", reject);
-      server.listen(port, host, () => {
-        server.off("error", reject);
-        const address = server.address();
-        if (!address || typeof address === "string") {
-          reject(new Error("migration transport listen did not produce a TCP address"));
-          return;
-        }
-        resolve({ url: `http://${address.address}:${address.port}` });
-      });
-    }),
-    close: () => new Promise((resolve, reject) => {
-      registry.revokeAll();
-      server.close((err) => {
-        if (err) reject(err);
-        else resolve();
-      });
-    })
+    sourceKind: input.sourceKind,
+    agentId: manifest.agentId,
+    slockHome,
+    sourceWorkspacePath,
+    finalWorkspacePath,
+    reportPath,
+    manifest,
+    manifestSha256,
+    generation: input.generation,
+    attestationNonce: input.attestationNonce,
+    observedAttestationNonce: input.observedAttestationNonce
   };
 }
-async function handleMigrationRequest(req, res, registry, bundleStreamFactory) {
-  const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
-  const match = /^\/migration\/([^/]+)\/([^/]+)(?:\/([^/]+))?$/.exec(parsed.pathname);
-  if (!match) {
-    sendJson(res, 404, { code: "migration_route_not_found" });
-    return;
+async function verifyAgentMigrationAdoptPlan(plan) {
+  assertGeneration(plan.generation);
+  assertManifestIdentity({ manifest: plan.manifest, expectedAgentId: plan.agentId });
+  const actualManifestSha256 = hashAgentMigrationManifest(plan.manifest);
+  if (actualManifestSha256 !== plan.manifestSha256) {
+    throw new Error("MIGRATION_MANIFEST_SHA_MISMATCH");
+  }
+  let totalBytes = 0;
+  let fileCount = 0;
+  for (const entry of plan.manifest.files) {
+    await verifyManifestFileEntry(plan.sourceWorkspacePath, entry);
+    if (entry.kind === "file") {
+      fileCount += 1;
+      totalBytes += entry.sizeBytes ?? 0;
+    }
+  }
+  return { fileCount, totalBytes };
+}
+async function executeAgentMigrationAdoptPlan(plan, rebind, now = currentDate()) {
+  assertGeneration(plan.generation);
+  await assertFinalWorkspaceAvailable(plan.sourceWorkspacePath, plan.finalWorkspacePath);
+  const verified = await verifyAgentMigrationAdoptPlan(plan);
+  let migrationGeneration = plan.generation.migrationGeneration;
+  migrationGeneration = await assertRebindResult(plan, migrationGeneration, await rebind.startTransfer({
+    grantKey: plan.generation.grantKey,
+    migrationGeneration
+  }));
+  await placeWorkspace(plan.sourceWorkspacePath, plan.finalWorkspacePath);
+  migrationGeneration = await assertRebindResult(plan, migrationGeneration, await rebind.flipMachine({
+    grantKey: plan.generation.grantKey,
+    migrationGeneration
+  }));
+  const report = {
+    schemaVersion: "agent-arrival/v1",
+    agentId: plan.agentId,
+    sourceKind: plan.sourceKind,
+    grantKey: plan.generation.grantKey,
+    migrationGeneration,
+    sourceMachineId: plan.generation.sourceMachineId,
+    targetMachineId: plan.generation.targetMachineId,
+    manifestSha256: plan.manifestSha256,
+    finalWorkspacePath: plan.finalWorkspacePath,
+    verified,
+    attestation: {
+      noncePresent: Boolean(plan.attestationNonce),
+      nonceVerified: Boolean(plan.attestationNonce && plan.observedAttestationNonce === plan.attestationNonce)
+    },
+    arrivedAt: now.toISOString()
+  };
+  const reportSha256 = await writeArrivalReport(plan.reportPath, report);
+  await assertRebindResult(plan, migrationGeneration, await rebind.markArrived({
+    grantKey: plan.generation.grantKey,
+    migrationGeneration,
+    reportPath: plan.reportPath,
+    reportSha256
+  }));
+  return { report, reportPath: plan.reportPath, reportSha256 };
+}
+function hashAgentMigrationManifest(manifest) {
+  return sha256Buffer2(Buffer.from(canonicalJson2(manifest), "utf8"));
+}
+function assertManifestIdentity(input) {
+  if (input.manifest.schemaVersion !== AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION) {
+    throw new Error("MIGRATION_MANIFEST_SCHEMA_UNSUPPORTED");
   }
-  const [, grantId, resource, resourceId] = match;
-  const auth = registry.authenticate(decodeURIComponent(grantId), extractBearerToken(req));
-  if (!auth.ok) {
-    sendJson(res, auth.status, { code: auth.code });
-    return;
+  if (input.manifest.agentId !== input.expectedAgentId) {
+    throw new Error("MIGRATION_MANIFEST_AGENT_MISMATCH");
   }
-  if (resource === "manifest" && req.method === "GET" && !resourceId) {
-    sendJson(res, 200, {
-      manifestSha256: auth.grant.manifestSha256,
-      manifest: auth.grant.manifest
-    }, {
-      "X-Raft-Manifest-Sha": auth.grant.manifestSha256,
-      ETag: `"manifest-${auth.grant.manifestSha256}"`
-    });
-    return;
+}
+function assertGeneration(generation) {
+  if (generation.localMachineId !== generation.targetMachineId) {
+    throw new Error("MIGRATION_TARGET_MACHINE_MISMATCH");
   }
-  if (resource === "bundle.tar" && !resourceId) {
-    if (req.method === "HEAD") {
-      sendHead(res, auth.grant);
-      return;
-    }
-    if (req.method === "GET") {
-      await streamBundle(res, auth.grant, bundleStreamFactory);
-      return;
-    }
+  if (generation.sourceMachineId === generation.targetMachineId) {
+    throw new Error("MIGRATION_SOURCE_TARGET_MACHINE_MATCH");
   }
-  if (resource === "chunk" && req.method === "GET" && resourceId) {
-    sendJson(res, 501, { code: "migration_chunk_not_implemented" });
-    return;
+  if (!generation.grantKey || !generation.migrationGeneration) {
+    throw new Error("MIGRATION_GENERATION_MISSING");
   }
-  sendJson(res, 405, { code: "migration_method_not_allowed" });
 }
-function sendHead(res, grant) {
-  res.statusCode = 200;
-  res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
-  res.setHeader("ETag", grant.bundleEtag);
-  res.setHeader("Accept-Ranges", "none");
-  res.setHeader("X-Raft-Bundle-Size", "unknown");
-  res.end();
+async function assertRebindResult(plan, expectedGeneration, result) {
+  if (!result) return expectedGeneration;
+  if (result.grantKey && result.grantKey !== plan.generation.grantKey) {
+    throw new Error("MIGRATION_REBIND_GRANT_MISMATCH");
+  }
+  if (result.migrationGeneration !== void 0 && result.migrationGeneration.length === 0) {
+    throw new Error("MIGRATION_REBIND_GENERATION_MISMATCH");
+  }
+  if (result.sourceMachineId && result.sourceMachineId !== plan.generation.sourceMachineId) {
+    throw new Error("MIGRATION_REBIND_SOURCE_MACHINE_MISMATCH");
+  }
+  if (result.targetMachineId && result.targetMachineId !== plan.generation.targetMachineId) {
+    throw new Error("MIGRATION_REBIND_TARGET_MACHINE_MISMATCH");
+  }
+  return result.migrationGeneration ?? expectedGeneration;
 }
-async function streamBundle(res, grant, bundleStreamFactory) {
-  if (grant.state === "streaming") {
-    sendJson(res, 409, { code: "migration_bundle_stream_in_progress" });
-    return;
+async function verifyManifestFileEntry(sourceWorkspacePath, entry) {
+  if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
+    throw new Error("MIGRATION_MANIFEST_ENTRY_NOT_WORKSPACE");
   }
-  if (grant.oneTimeUse && grant.state !== "issued" && grant.state !== "interrupted") {
-    sendJson(res, 410, { code: "migration_grant_unavailable" });
+  const relative = normalizeWorkspaceRelativePath(entry.workspaceRelativePath);
+  const entryPath = path20.join(sourceWorkspacePath, relative);
+  const info = await lstat3(entryPath).catch(() => null);
+  if (!info) throw new Error("MIGRATION_MANIFEST_FILE_MISSING");
+  if (entry.kind === "symlink") {
+    if (!info.isSymbolicLink()) throw new Error("MIGRATION_MANIFEST_KIND_MISMATCH");
+    const linkTarget = await readlink2(entryPath);
+    if (entry.linkTarget !== linkTarget) throw new Error("MIGRATION_MANIFEST_LINK_MISMATCH");
     return;
   }
-  let stream;
-  try {
-    stream = bundleStreamFactory(grant);
-  } catch (err) {
-    const code = err instanceof MigrationBundleStreamError ? err.code : "migration_bundle_stream_failed";
-    sendJson(res, 500, { code });
-    return;
+  if (!info.isFile()) throw new Error("MIGRATION_MANIFEST_KIND_MISMATCH");
+  if (entry.sizeBytes !== void 0 && entry.sizeBytes !== info.size) {
+    throw new Error("MIGRATION_MANIFEST_FILE_SIZE_MISMATCH");
   }
-  grant.state = "streaming";
-  let completed = false;
-  res.on("close", () => {
-    if (!completed && grant.state === "streaming") {
-      grant.state = "interrupted";
-    }
-  });
-  try {
-    res.statusCode = 200;
-    res.setHeader("Content-Type", "application/x-tar");
-    res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
-    res.setHeader("ETag", grant.bundleEtag);
-    for await (const chunk of stream) {
-      if (!res.write(chunk)) {
-        await onceDrain(res);
-      }
-    }
-    completed = true;
-    grant.state = "consumed";
-    res.end();
-  } catch {
-    if (!completed && grant.state === "streaming") {
-      grant.state = "interrupted";
-    }
-    if (!res.headersSent) {
-      sendJson(res, 500, { code: "migration_bundle_stream_failed" });
-    } else {
-      res.destroy();
-    }
+  if (entry.sha256) {
+    const actual = await sha256File2(entryPath);
+    if (actual !== entry.sha256) throw new Error("MIGRATION_MANIFEST_FILE_SHA_MISMATCH");
   }
 }
-function defaultBundleStream(grant) {
-  void grant;
-  throw new MigrationBundleStreamError("migration_bundle_stream_not_wired");
-}
-function extractBearerToken(req) {
-  const directHeader = singleHeader(req.headers["x-raft-migration-token"]);
-  if (directHeader) return directHeader;
-  const authorization = singleHeader(req.headers.authorization);
-  if (!authorization) return null;
-  const match = /^Bearer\s+(.+)$/i.exec(authorization);
-  return match?.[1] ?? null;
-}
-function singleHeader(value) {
-  if (!value) return null;
-  return Array.isArray(value) ? value[0] ?? null : value;
+function normalizeWorkspaceRelativePath(relativePath) {
+  const normalized = path20.posix.normalize(relativePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path20.isAbsolute(normalized)) {
+    throw new Error("MIGRATION_MANIFEST_UNSAFE_PATH");
+  }
+  return normalized;
 }
-function sendJson(res, status, body, headers = {}) {
-  const payload = JSON.stringify(body);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Content-Length": Buffer.byteLength(payload).toString(),
-    ...headers
-  });
-  res.end(payload);
+async function assertFinalWorkspaceAvailable(sourceWorkspacePath, finalWorkspacePath) {
+  if (path20.resolve(sourceWorkspacePath) === path20.resolve(finalWorkspacePath)) return;
+  try {
+    await access2(finalWorkspacePath);
+    throw new Error("MIGRATION_WORKSPACE_ALREADY_EXISTS");
+  } catch (err) {
+    if (err instanceof Error && err.message === "MIGRATION_WORKSPACE_ALREADY_EXISTS") throw err;
+  }
 }
-function hashToken(token) {
-  return sha256Buffer(Buffer.from(token, "utf8"));
+async function placeWorkspace(sourceWorkspacePath, finalWorkspacePath) {
+  if (path20.resolve(sourceWorkspacePath) === path20.resolve(finalWorkspacePath)) return;
+  const stagingPath = `${finalWorkspacePath}.migration-${process.pid}-${Date.now()}`;
+  await mkdir3(path20.dirname(finalWorkspacePath), { recursive: true });
+  await cp(sourceWorkspacePath, stagingPath, { recursive: true, dereference: false, errorOnExist: true, force: false });
+  await rename(stagingPath, finalWorkspacePath);
 }
-function verifyTokenHash(token, expectedHashHex) {
-  const actual = Buffer.from(hashToken(token), "hex");
-  const expected = Buffer.from(expectedHashHex, "hex");
-  if (actual.byteLength !== expected.byteLength) return false;
-  return timingSafeEqual(actual, expected);
+async function writeArrivalReport(reportPath, report) {
+  const payload = `${canonicalJson2(report)}
+`;
+  await mkdir3(path20.dirname(reportPath), { recursive: true });
+  await writeFile3(reportPath, payload, { mode: 384 });
+  return sha256Buffer2(Buffer.from(payload, "utf8"));
 }
-function sha256Buffer(buffer) {
-  return createHash8("sha256").update(buffer).digest("hex");
+async function sha256File2(filePath) {
+  const hash = createHash9("sha256");
+  const stream = createReadStream2(filePath);
+  for await (const chunk of stream) {
+    hash.update(chunk);
+  }
+  return hash.digest("hex");
 }
-function canonicalJsonBuffer(value) {
-  return Buffer.from(canonicalJson(value), "utf8");
+function sha256Buffer2(buffer) {
+  return createHash9("sha256").update(buffer).digest("hex");
 }
-function canonicalJson(value) {
-  return JSON.stringify(sortJsonValue(value));
+function canonicalJson2(value) {
+  return JSON.stringify(sortJsonValue2(value));
 }
-function sortJsonValue(value) {
-  if (Array.isArray(value)) return value.map(sortJsonValue);
+function sortJsonValue2(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue2);
   if (!value || typeof value !== "object") return value;
   return Object.keys(value).sort().reduce((result, key) => {
-    result[key] = sortJsonValue(value[key]);
+    result[key] = sortJsonValue2(value[key]);
     return result;
   }, {});
 }
-function onceDrain(res) {
-  return new Promise((resolve) => res.once("drain", resolve));
+function sanitizePathSegment(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128) || "migration";
+}
+
+// src/secretFile.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import path21 from "path";
+function readSecretFileSync(filePath) {
+  return readFileSync9(filePath, "utf8").trim();
 }
 
 // src/core.ts
@@ -22597,7 +23390,7 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     spanAttrs: ["agentId", "event_kind", "runtime"]
   }
 };
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key-file <path>";
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -22636,9 +23429,18 @@ async function waitForRunnerCredentialRetry2() {
 function parseDaemonCliArgs(args) {
   let serverUrl = "";
   let apiKey = "";
+  let apiKeyFile = process.env.SLOCK_DAEMON_API_KEY_FILE ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
+    if (args[i] === "--api-key-file" && args[i + 1]) apiKeyFile = args[++i];
+  }
+  if (!apiKey && apiKeyFile) {
+    try {
+      apiKey = readSecretFileSync(apiKeyFile);
+    } catch {
+      apiKey = "";
+    }
   }
   if (!serverUrl || !apiKey) return null;
   return { serverUrl, apiKey };
@@ -22652,13 +23454,13 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path20.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path20.resolve(thisDir, "cli", "index.js");
+  const thisDir = path22.dirname(fileURLToPath(moduleUrl));
+  const bundledDistPath = path22.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path20.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path22.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -22672,7 +23474,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-V7E6IFYX.js");
+  await import("./dist-NS7NN3BV.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -22764,6 +23566,11 @@ function readPositiveIntegerEnv3(name, fallback) {
   if (!Number.isFinite(parsed) || parsed < 1) return fallback;
   return Math.floor(parsed);
 }
+function hasAgentMigrationHttpTransportListenConfig(env = process.env) {
+  return Boolean(
+    env[AGENT_MIGRATION_TRANSPORT_HOST_ENV]?.trim() || env[AGENT_MIGRATION_TRANSPORT_PORT_ENV]?.trim() || env[AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV]?.trim()
+  );
+}
 function formatChannelTarget(msg) {
   return msg.message.channel_type === "dm" ? `dm:@${msg.message.channel_name}` : `#${msg.message.channel_name}`;
 }
@@ -22828,6 +23635,9 @@ var DaemonCore = class {
   agentManager;
   connection;
   reminderCache;
+  migrationTransport;
+  migrationTransportListenPromise = null;
+  migrationTransportListening = false;
   tracer;
   injectedTracer;
   machineLock = null;
@@ -22851,6 +23661,7 @@ var DaemonCore = class {
       clock: options.reminderClock,
       onFire: (job) => this.onReminderFire(job)
     });
+    this.migrationTransport = options.migrationTransport === void 0 ? hasAgentMigrationHttpTransportListenConfig() ? createAgentMigrationHttpTransport() : null : options.migrationTransport;
     let connection;
     this.agentsDataDir = options.dataDir ?? resolveSlockHomePath("agents", this.slockHome);
     const traceUploadDisabled = process.env.SLOCK_DAEMON_TRACE_UPLOAD_DISABLED === "1";
@@ -22881,7 +23692,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path20.join(path20.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path22.join(path22.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -22909,7 +23720,7 @@ var DaemonCore = class {
       sinks: [this.localTraceSink]
     }));
     this.agentManager.setTracer(this.tracer);
-    this.agentManager.setCliTransportTraceDir(path20.join(machineDir, "traces"));
+    this.agentManager.setCliTransportTraceDir(path22.join(machineDir, "traces"));
   }
   installTraceBundleUploader(machineDir) {
     if (!this.shouldEnableLocalTrace()) return;
@@ -22959,9 +23770,11 @@ var DaemonCore = class {
       span.addEvent("daemon.machine_lock.acquired", { machine_dir_present: true });
       span.end("ok");
     }
+    this.startMigrationTransport();
     try {
       this.connection.connect();
     } catch (err) {
+      void this.stopMigrationTransport();
       this.traceBundleUploader?.stop();
       this.traceBundleUploader = null;
       this.machineLock.release();
@@ -23000,6 +23813,7 @@ var DaemonCore = class {
           shutdown_reason: shutdownReason
         });
       }
+      await this.stopMigrationTransport();
       this.connection.disconnect();
       span.addEvent("daemon.connection.disconnect_requested");
       this.machineLock?.release();
@@ -23025,6 +23839,44 @@ var DaemonCore = class {
     });
     span.end(status);
   }
+  startMigrationTransport() {
+    if (!this.migrationTransport || this.migrationTransportListenPromise) return;
+    this.migrationTransportListenPromise = this.migrationTransport.listen().then(({ url }) => {
+      this.migrationTransportListening = true;
+      logger.info(`[Slock Daemon] Agent migration HTTP transport listening: ${url}`);
+      this.recordDaemonTrace("daemon.migration_transport.listen", {
+        outcome: "listening",
+        url_present: Boolean(url)
+      });
+    }).catch((err) => {
+      this.migrationTransportListening = false;
+      logger.error("[Slock Daemon] Agent migration HTTP transport failed to listen", err);
+      this.recordDaemonTrace("daemon.migration_transport.listen", {
+        outcome: "failed",
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+    });
+  }
+  async stopMigrationTransport() {
+    if (!this.migrationTransport) return;
+    const listenPromise = this.migrationTransportListenPromise;
+    this.migrationTransportListenPromise = null;
+    if (listenPromise) await listenPromise;
+    if (!this.migrationTransportListening) return;
+    try {
+      await this.migrationTransport.close();
+      logger.info("[Slock Daemon] Agent migration HTTP transport stopped");
+      this.recordDaemonTrace("daemon.migration_transport.stop", { outcome: "stopped" });
+    } catch (err) {
+      logger.error("[Slock Daemon] Agent migration HTTP transport failed to stop", err);
+      this.recordDaemonTrace("daemon.migration_transport.stop", {
+        outcome: "failed",
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+    } finally {
+      this.migrationTransportListening = false;
+    }
+  }
   withDaemonTraceScope(tracer) {
     return {
       startSpan: (name, options) => createTraceScopeTracer(tracer, this.daemonTraceScope(), {
@@ -23524,6 +24376,7 @@ var DaemonCore = class {
       agentId: job.ownerAgentId,
       reminderId: job.reminderId,
       version: job.version,
+      // Accepted ambient clock: reminder telemetry reports the client wall-clock fire attempt.
       firedAtClient: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
@@ -23641,10 +24494,20 @@ export {
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,
-  AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
-  buildAgentMigrationExportManifest,
+  AGENT_MIGRATION_TRANSPORT_HOST_ENV,
+  AGENT_MIGRATION_TRANSPORT_PORT_ENV,
+  AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV,
+  AGENT_MIGRATION_CONTROL_SEAM_ENV,
   AgentMigrationGrantRegistry,
   createAgentMigrationHttpTransport,
+  resolveAgentMigrationHttpTransportListenOptions,
+  resolveAgentMigrationControlSeamEnabled,
+  AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
+  buildAgentMigrationExportManifest,
+  buildAgentMigrationAdoptPlan,
+  verifyAgentMigrationAdoptPlan,
+  executeAgentMigrationAdoptPlan,
+  hashAgentMigrationManifest,
   DAEMON_CORE_TRACE_ATTR_CONTRACTS,
   DAEMON_CLI_USAGE,
   parseDaemonCliArgs,