@botiverse/raft-daemon 0.72.3 → 0.72.4-play.20260710140617

package/dist/{chunk-GMOJFVE4.js → chunk-R56QPYOR.js}

@@ -1,5 +1,5 @@
 // src/core.ts
-import path20 from "path";
+import path23 from "path";
 import os8 from "os";
 import { createRequire as createRequire3 } from "module";
 import { accessSync } from "fs";
@@ -636,12 +636,12 @@ function parseModelConfig(runtimeModels, runtime, value, fallback, usesLegacyCla
   if (value.kind === "custom" && typeof value.name === "string" && value.name.trim()) {
     return { kind: "custom", name: value.name.trim() };
   }
-  if (value.kind === "preset" && typeof value.id === "string" && value.id.trim() && isPresetRuntimeModel(runtimeModels, runtime, value.id.trim())) {
-    return { kind: "preset", id: value.id.trim() };
-  }
   if (usesLegacyClaudeCustomProvider && runtime === "claude" && legacyCustomModel?.trim()) {
     return { kind: "custom", name: legacyCustomModel.trim() };
   }
+  if (value.kind === "preset" && typeof value.id === "string" && value.id.trim()) {
+    return { kind: "preset", id: value.id.trim() };
+  }
   return modelConfigFromLegacy(runtimeModels, runtime, fallback);
 }
 function parseModeConfig(value) {
@@ -1366,6 +1366,9 @@ var PROMOTED_IDENTITY_ATTRS = [
   "caller_kind"
 ];
 var PROMOTED_CLOSED_ATTRS = [
+  "router_reason",
+  "stale_owner_cleanup_result",
+  "stale_owner_cleanup_reason",
   "outcome",
   "reason",
   "event_kind",
@@ -1374,6 +1377,8 @@ var PROMOTED_CLOSED_ATTRS = [
   "activity_write_site",
   "activity_source",
   "hint_source",
+  "weak_source",
+  "competing_fact",
   "resolved_activity",
   "previous_activity",
   "next_activity",
@@ -1459,11 +1464,20 @@ var TRACE_B0_FIELD_DEFINITIONS = defineTraceFields([
   { key: "served_from", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "authority", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "decided_by", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "router_reason", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "stale_owner_cleanup_result", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "stale_owner_cleanup_reason", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "error_class", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "query_name", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "query_registry" },
   { key: "phase", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "eligibility_subcheck", fieldClass: "query_axis", placement: "event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "hint_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "candidate_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "served_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "write_action", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity", enumBinding: "stable", enumValues: ["none"] },
+  { key: "arbitration_reason", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity", enumBinding: "stable", enumValues: ["trusted_snapshot", "owner_mirror_read_through"] },
+  { key: "weak_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "competing_fact", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "resolved_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "previous_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "next_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
@@ -1989,23 +2003,13 @@ var integrationUpdateAppRegistrationOperationSchema = integrationAppDraftFieldsS
   unsafeDemoUrlOverride: z.boolean().optional(),
   draftHint: draftHintSchema
 });
-var migrationExportOperationSchema = z.object({
-  type: z.literal("migration:export"),
-  targetComputer: idOrHandleSchema,
-  mode: z.enum(["cooperative", "forensic"]).default("cooperative"),
-  prepDeadlineMs: z.number().int().positive().optional(),
-  transferDeadlineMs: z.number().int().positive().optional(),
-  arrivalDeadlineMs: z.number().int().positive().optional(),
-  draftHint: draftHintSchema
-});
 var actionCardActionSchema = z.discriminatedUnion("type", [
   channelCreateOperationSchema,
   agentCreateOperationSchema,
   channelAddMemberOperationSchema,
   integrationApproveAgentLoginOperationSchema,
   integrationRegisterAppOperationSchema,
-  integrationUpdateAppRegistrationOperationSchema,
-  migrationExportOperationSchema
+  integrationUpdateAppRegistrationOperationSchema
 ]);
 
 // ../shared/src/agentApiContract.ts
@@ -2027,8 +2031,8 @@ var optionalIsoTimestampSchema = z2.string().datetime().optional();
 var agentStatusSchema = z2.enum(["active", "inactive", "stopped"]);
 var reminderStatusSchema = z2.enum(["scheduled", "fired", "canceled"]);
 var reminderEventTypeSchema = z2.enum(["scheduled", "fired", "snoozed", "updated", "canceled"]);
-var reasoningEffortSchema = z2.enum(["low", "medium", "high", "xhigh"]);
-var profileVisibilityMembershipStatusSchema = z2.enum(["active", "removed"]);
+var reasoningEffortSchema = z2.enum(["low", "medium", "high", "xhigh", "max", "ultra"]);
+var profileVisibilityMembershipStatusSchema = z2.enum(["active", "left", "removed"]);
 var passthroughObject = (shape) => z2.object(shape).passthrough();
 var taskStatusSchema = z2.enum(["todo", "in_progress", "in_review", "done", "closed"]);
 var agentApiEventsQuerySchema = passthroughObject({
@@ -2098,6 +2102,10 @@ var agentApiSendBodySchema = passthroughObject({
   draftReplacedExisting: optionalBooleanSchema,
   seenUpToSeq: optionalNumberSchema
 });
+var legacyAgentSendBodySchema = agentApiSendBodySchema.extend({
+  channel: z2.string().optional(),
+  dm_to: z2.string().optional()
+});
 var agentApiMessageResolveParamsSchema = passthroughObject({
   msgId: z2.string().trim().min(1).transform(asMessageId)
 });
@@ -2704,6 +2712,51 @@ var agentApiReminderResponseSchema = passthroughObject({
 var agentApiReminderLogResponseSchema = passthroughObject({
   events: z2.array(agentApiReminderEventSummarySchema)
 });
+var agentApiMigrationStateSchema = z2.enum(["provisioning", "prep", "ready", "in_transit", "arriving", "completed", "aborted", "failed"]);
+var agentApiMigrationSummarySchema = passthroughObject({
+  id: z2.string(),
+  agentId: z2.string(),
+  sourceMachineId: z2.string(),
+  targetMachineId: z2.string(),
+  state: agentApiMigrationStateSchema,
+  manifestPath: nullableStringSchema,
+  manifestSha256: nullableStringSchema,
+  arrivalReportPath: nullableStringSchema,
+  arrivalReportSha256: nullableStringSchema,
+  abortReason: nullableStringSchema,
+  failureReason: nullableStringSchema,
+  prepDeadlineAt: z2.string().datetime(),
+  transferDeadlineAt: z2.string().datetime(),
+  arrivalDeadlineAt: z2.string().datetime(),
+  readyAt: nullableStringSchema,
+  flippedAt: nullableStringSchema,
+  arrivedAt: nullableStringSchema,
+  completedAt: nullableStringSchema,
+  abortedAt: nullableStringSchema,
+  revision: z2.number().int().positive(),
+  createdAt: z2.string().datetime(),
+  updatedAt: z2.string().datetime()
+});
+var agentApiMigrationBeginBodySchema = passthroughObject({
+  targetMachineId: z2.string().trim().min(1),
+  prepDeadlineMs: z2.number().int().positive().optional(),
+  transferDeadlineMs: z2.number().int().positive().optional(),
+  arrivalDeadlineMs: z2.number().int().positive().optional()
+});
+var agentApiMigrationReadyBodySchema = passthroughObject({
+  manifestPath: z2.string().trim().min(1),
+  manifestSha256: optionalStringSchema
+});
+var agentApiMigrationArrivedBodySchema = passthroughObject({
+  reportPath: optionalStringSchema,
+  reportSha256: optionalStringSchema
+});
+var agentApiMigrationResponseSchema = passthroughObject({
+  migration: agentApiMigrationSummarySchema
+});
+var agentApiMigrationStatusResponseSchema = passthroughObject({
+  migration: agentApiMigrationSummarySchema.nullable()
+});
 function route(input) {
   return {
     ...input,
@@ -2951,6 +3004,46 @@ var agentApiContract = {
     request: { body: agentApiTaskUpdateStatusBodySchema },
     response: { body: agentApiTaskUpdateStatusResponseSchema }
   }),
+  migrationBegin: route({
+    key: "migrationBegin",
+    method: "POST",
+    path: "/migrations",
+    client: { resource: "migrations", method: "begin" },
+    capability: "server",
+    description: "Begin a migration for the bound agent credential.",
+    request: { body: agentApiMigrationBeginBodySchema },
+    response: { body: agentApiMigrationResponseSchema }
+  }),
+  migrationStatus: route({
+    key: "migrationStatus",
+    method: "GET",
+    path: "/migrations/current",
+    client: { resource: "migrations", method: "status" },
+    capability: "read",
+    description: "Read the active migration for the bound agent credential, if any.",
+    request: {},
+    response: { body: agentApiMigrationStatusResponseSchema }
+  }),
+  migrationReady: route({
+    key: "migrationReady",
+    method: "POST",
+    path: "/migrations/ready",
+    client: { resource: "migrations", method: "ready" },
+    capability: "read",
+    description: "Mark the bound agent's active migration prep phase ready.",
+    request: { body: agentApiMigrationReadyBodySchema },
+    response: { body: agentApiMigrationResponseSchema }
+  }),
+  migrationArrived: route({
+    key: "migrationArrived",
+    method: "POST",
+    path: "/migrations/arrived",
+    client: { resource: "migrations", method: "arrived" },
+    capability: "read",
+    description: "Mark the bound agent's active migration arrival phase complete.",
+    request: { body: agentApiMigrationArrivedBodySchema },
+    response: { body: agentApiMigrationResponseSchema }
+  }),
   reminderList: route({
     key: "reminderList",
     method: "GET",
@@ -3258,6 +3351,14 @@ var AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS = 1e3;
 var AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS = AUTH_REFRESH_ROTATION_DISCOVERY_LAG_BUDGET_MS + AUTH_REFRESH_ROTATED_TOKEN_WAIT_MS + AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS;
 var AUTH_REFRESH_ROTATION_REPLAY_GRACE_MARGIN_MS = AUTH_REFRESH_ROTATED_REPLAY_GRACE_MS - AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS;
 
+// ../shared/src/clock.ts
+function currentTimeMs() {
+  return Date.now();
+}
+function currentDate() {
+  return new Date(currentTimeMs());
+}
+
 // ../shared/src/agentInbox.ts
 function formatAgentInboxDelta(rows, options = {}) {
   const totalPendingMessages = options.totalPendingMessages;
@@ -3640,7 +3741,7 @@ var EXTERNAL_AGENT_RUNTIME_DISPLAY_NAME = "External agent";
 var RUNTIMES = [
   { id: "claude", displayName: "Claude Code", binary: "claude", supported: true },
   { id: "codex", displayName: "Codex CLI", binary: "codex", supported: true },
-  { id: "builtin", displayName: "Builtin Pi", binary: "", supported: true },
+  { id: "builtin", displayName: "Built-in Pi", binary: "", supported: true },
   { id: "antigravity", displayName: "Antigravity CLI", binary: "agy", supported: true },
   // Kimi: prefer the in-process SDK (`kimi-sdk` → "Kimi Code") for new agents.
   // The legacy `kimi` (kimi-cli child-process) entry stays for backward compat
@@ -3672,6 +3773,27 @@ var RUNTIME_MODELS = {
     { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" }
   ],
   codex: [
+    {
+      id: "gpt-5.6-sol",
+      label: "GPT-5.6 Sol",
+      supportedReasoningEfforts: ["low", "medium", "high", "xhigh", "max", "ultra"],
+      defaultReasoningEffort: "medium",
+      verified: "launchable"
+    },
+    {
+      id: "gpt-5.6-terra",
+      label: "GPT-5.6 Terra",
+      supportedReasoningEfforts: ["low", "medium", "high", "xhigh", "max", "ultra"],
+      defaultReasoningEffort: "medium",
+      verified: "launchable"
+    },
+    {
+      id: "gpt-5.6-luna",
+      label: "GPT-5.6 Luna",
+      supportedReasoningEfforts: ["low", "medium", "high", "xhigh", "max"],
+      defaultReasoningEffort: "medium",
+      verified: "launchable"
+    },
     { id: "gpt-5.5", label: "GPT-5.5" },
     { id: "gpt-5.4", label: "GPT-5.4" },
     { id: "gpt-5.3-codex", label: "GPT-5.3 Codex" },
@@ -4338,8 +4460,8 @@ async function executeResponseRequest(url, init, {
 }
 
 // src/directUploadCapability.ts
-function joinUrl(base, path21) {
-  return `${base.replace(/\/+$/, "")}${path21}`;
+function joinUrl(base, path24) {
+  return `${base.replace(/\/+$/, "")}${path24}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -5029,6 +5151,15 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -6610,7 +6741,9 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
 ];
 var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
   "agent-token",
@@ -6965,7 +7098,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     SLOCK_SERVER_URL: ctx.config.serverUrl,
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -7533,7 +7666,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -7559,7 +7692,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -7985,7 +8118,7 @@ function codexNotificationDiagnosticEvent(message) {
       return null;
   }
   const sessionId = codexMessageThreadId(message);
-  const path21 = boundedString(params.path);
+  const path24 = boundedString(params.path);
   return {
     kind: "runtime_diagnostic",
     severity: "warning",
@@ -7993,7 +8126,7 @@ function codexNotificationDiagnosticEvent(message) {
     itemType: message.method,
     message: diagnosticMessage,
     ...details ? { details } : {},
-    ...path21 ? { path: path21 } : {},
+    ...path24 ? { path: path24 } : {},
     ...params.range !== void 0 ? { range: params.range } : {},
     payloadBytes: payloadBytes(params),
     ...sessionId ? { sessionId } : {}
@@ -9643,11 +9776,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -9703,7 +9836,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -9840,12 +9973,15 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os4 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -9854,6 +9990,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os4.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -9877,7 +10080,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -9901,21 +10122,23 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(hydrateRuntimeConfig(ctx.config));
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -9923,7 +10146,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -10036,14 +10259,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir()) {
-  const configPath = path9.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os4.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -10303,6 +10521,12 @@ var KimiSdkRuntimeSession = class {
   get closed() {
     return this.didClose;
   }
+  // In-process SDK session: there is no OS pid to probe with signal-0, so
+  // liveness is unknowable via the pid-probe boundary. Return undefined, which
+  // callers treat the same as the historic "no pid" probe result (RS-011).
+  isAlive() {
+    return void 0;
+  }
   on(event, cb) {
     this.events.on(event, cb);
   }
@@ -10722,7 +10946,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -11018,7 +11242,9 @@ function createPiSdkEventMappingState(sessionId = null) {
   return {
     sessionId,
     sessionAnnounced: false,
-    sawTextDelta: false
+    sawTextDelta: false,
+    thinkingBuffers: /* @__PURE__ */ new Map(),
+    announcedThinkingIndexes: /* @__PURE__ */ new Set()
   };
 }
 function buildPiSessionDir(workingDirectory) {
@@ -11233,10 +11459,40 @@ function pushSessionInitIfNeeded2(state, events) {
     state.sessionAnnounced = true;
   }
 }
+function piAssistantContentIndex(assistantEvent) {
+  return "contentIndex" in assistantEvent && typeof assistantEvent.contentIndex === "number" ? assistantEvent.contentIndex : 0;
+}
+function announcePiThinkingIfNeeded(index, state) {
+  if (state.announcedThinkingIndexes.has(index)) return [];
+  state.announcedThinkingIndexes.add(index);
+  return [{ kind: "thinking", text: "" }];
+}
+function resetPiThinking(index, state) {
+  state.thinkingBuffers.delete(index);
+  state.announcedThinkingIndexes.delete(index);
+}
 function mapPiAssistantMessageEvent(assistantEvent, state) {
   switch (assistantEvent.type) {
-    case "thinking_delta":
-      return typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0 ? [{ kind: "thinking", text: assistantEvent.delta }] : [];
+    case "thinking_start": {
+      const index = piAssistantContentIndex(assistantEvent);
+      resetPiThinking(index, state);
+      return announcePiThinkingIfNeeded(index, state);
+    }
+    case "thinking_delta": {
+      const index = piAssistantContentIndex(assistantEvent);
+      const events = announcePiThinkingIfNeeded(index, state);
+      if (typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0) {
+        state.thinkingBuffers.set(index, `${state.thinkingBuffers.get(index) ?? ""}${assistantEvent.delta}`);
+      }
+      return events;
+    }
+    case "thinking_end": {
+      const index = piAssistantContentIndex(assistantEvent);
+      const buffered = state.thinkingBuffers.get(index) ?? "";
+      const text = typeof assistantEvent.content === "string" && assistantEvent.content.length > 0 ? assistantEvent.content : buffered;
+      resetPiThinking(index, state);
+      return text ? [{ kind: "thinking", text }] : [];
+    }
     case "text_delta":
       if (typeof assistantEvent.delta === "string" && assistantEvent.delta.length > 0) {
         state.sawTextDelta = true;
@@ -11247,8 +11503,6 @@ function mapPiAssistantMessageEvent(assistantEvent, state) {
       return !state.sawTextDelta && typeof assistantEvent.content === "string" && assistantEvent.content.length > 0 ? [{ kind: "text", text: assistantEvent.content }] : [];
     case "error":
       return [{ kind: "error", message: piErrorMessage(assistantEvent.error.errorMessage || assistantEvent.error) }];
-    case "thinking_start":
-    case "thinking_end":
     case "text_start":
     case "toolcall_start":
     case "toolcall_delta":
@@ -11292,6 +11546,8 @@ function mapPiSdkEventToParsedEvents(event, state) {
     case "message_start":
       if (event.message.role === "assistant") {
         state.sawTextDelta = false;
+        state.thinkingBuffers.clear();
+        state.announcedThinkingIndexes.clear();
       }
       return events;
     case "message_update":
@@ -11316,10 +11572,8 @@ function mapPiSdkEventToParsedEvents(event, state) {
     case "agent_end":
       events.push({ kind: "turn_end", sessionId: state.sessionId || void 0 });
       return events;
-    default: {
-      const _exhaustive = event;
-      return _exhaustive;
-    }
+    default:
+      return events;
   }
 }
 var PI_RUNTIME_SESSION_DESCRIPTOR = {
@@ -11504,15 +11758,21 @@ async function createPiAgentSessionForContext(ctx, sessionId, opts = {}) {
   }
 }
 var PiSdkRuntimeSession = class {
-  constructor(ctx, setCurrentSessionId, sessionFactory = createPiAgentSessionForContext) {
+  constructor(ctx, setCurrentSessionId, sessionFactory = createPiAgentSessionForContext, opts = {}) {
     this.ctx = ctx;
     this.setCurrentSessionId = setCurrentSessionId;
     this.sessionFactory = sessionFactory;
     this.mappingState = createPiSdkEventMappingState(ctx.config.sessionId || null);
+    const runtimeConfig = hydrateRuntimeConfig(ctx.config);
+    const launchRuntimeFields = runtimeConfigToLaunchFields(runtimeConfig);
+    this.sdkCallEnvPatch = buildPiSessionCreateEnvPatch(runtimeConfig, launchRuntimeFields.envVars);
+    this.sdkCallEnvRemoveFirst = opts.isolateHostProviderEnv ? BUILTIN_BLOCKED_HOST_PROVIDER_ENV_KEYS : void 0;
   }
   descriptor = PI_RUNTIME_SESSION_DESCRIPTOR;
   events = new EventEmitter2();
   mappingState;
+  sdkCallEnvPatch;
+  sdkCallEnvRemoveFirst;
   session = null;
   unsubscribe = null;
   started = false;
@@ -11534,6 +11794,12 @@ var PiSdkRuntimeSession = class {
   get closed() {
     return this.didClose;
   }
+  // In-process SDK session: there is no OS pid to probe with signal-0, so
+  // liveness is unknowable via the pid-probe boundary. Return undefined, which
+  // callers treat the same as the historic "no pid" probe result (RS-011).
+  isAlive() {
+    return void 0;
+  }
   on(event, cb) {
     this.events.on(event, cb);
   }
@@ -11642,7 +11908,7 @@ var PiSdkRuntimeSession = class {
     setImmediate(() => {
       if (this.didClose) return;
       try {
-        void invoke().catch((error) => {
+        void withProcessEnvPatch(this.sdkCallEnvPatch, invoke, { removeFirst: this.sdkCallEnvRemoveFirst }).catch((error) => {
           if (this.didClose) return;
           this.events.emit("runtime_event", {
             kind: "error",
@@ -11775,7 +12041,7 @@ var BuiltInDriver = class extends PiDriver {
       exposeLaunchTraceEvidence: true,
       exposeLaunchEnvToTools: false,
       isolateHostProviderEnv: true
-    }));
+    }), { isolateHostProviderEnv: true });
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
@@ -11852,6 +12118,25 @@ var ChildProcessRuntimeSession = class {
   get closed() {
     return this.process ? this.process.exitCode != null || this.process.signalCode != null : false;
   }
+  /**
+   * Read-only OS liveness introspection (signal-0), NOT control IO — exposed so
+   * managers query liveness through the session boundary (RS-011) instead of
+   * poking the raw pid. Preserves the historic `probeRuntimeProcessLiveness`
+   * semantics exactly: undefined when there is no pid, true on success or EPERM,
+   * false otherwise. Deliberately does NOT short-circuit on `this.closed` — the
+   * original probe checked only pid + signal-0.
+   */
+  isAlive() {
+    const pid = this.process?.pid;
+    if (typeof pid !== "number") return void 0;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (err) {
+      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
+      return code === "EPERM" ? true : false;
+    }
+  }
   on(event, cb) {
     this.events.on(event, cb);
   }
@@ -11965,6 +12250,61 @@ function getDriver(runtimeId) {
   return driver;
 }
 
+// src/daemonOrphanReaper.ts
+async function reapOrphanProcesses(pids, logger2, recordTrace) {
+  const survivors = pids.filter((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  if (survivors.length === 0) return false;
+  for (const pid of survivors) {
+    logger2.warn(`[Daemon] Agent subprocess ${pid} survived stopAll; sending SIGKILL`);
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+  recordTrace("daemon.agent.stop_all.survivor_reaped", {
+    survivor_count: survivors.length,
+    survivor_pids: survivors.join(","),
+    reason: "shutdown_survivor",
+    signal: "SIGKILL"
+  });
+  const deadline = Date.now() + 2e3;
+  while (Date.now() < deadline) {
+    const alive = survivors.filter((pid) => {
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+    if (alive.length === 0) break;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  const stillAlive = survivors.filter((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  const outcome = stillAlive.length > 0 ? "survivors_still_alive" : "survivors_killed";
+  recordTrace("daemon.agent.stop_all.completed", {
+    survivor_count: survivors.length,
+    reaped_count: survivors.length - stillAlive.length,
+    still_alive_count: stillAlive.length,
+    outcome
+  }, stillAlive.length > 0 ? "error" : "ok");
+  return true;
+}
+
 // src/workspaces.ts
 import { readdir, rm, stat } from "fs/promises";
 import path13 from "path";
@@ -13391,6 +13731,88 @@ var RuntimeNotificationState = class {
   }
 };
 
+// src/proxyFailureTrace.ts
+function failureReason(input) {
+  if (input.lifecycleInvalidContext) return "local_daemon_state_invalid";
+  const text = `${input.errorCause ?? ""} ${input.errorMessage}`.toLowerCase();
+  if (/enotfound|eai_again|\bdns\b/.test(text)) return "dns";
+  if (/econnrefused|econnreset|epipe|und_err_socket|\bsocket\b|other side closed|terminated/.test(text)) return "tcp";
+  if (/certificate|\btls\b/.test(text)) return "tls";
+  if (/und_err_headers_timeout|und_err_body_timeout|\btimeout\b/.test(text)) return "read_timeout";
+  if (/\bproxy\b/.test(text)) return "proxy_connect";
+  if (/\bfly\b/.test(text)) return "fly_edge";
+  return "unknown";
+}
+function boundedErrorClass(value) {
+  if (value === "TypeError") return "TypeError";
+  if (value === "AbortError") return "AbortError";
+  if (value === "Error") return "Error";
+  return "OtherError";
+}
+function boundedMethod(value) {
+  const method = value.toUpperCase();
+  return ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(method) ? method : "OTHER";
+}
+function cannedExcerpt(reason) {
+  switch (reason) {
+    case "local_daemon_state_invalid":
+      return "Local daemon lifecycle state rejected the proxy request";
+    case "dns":
+      return "Upstream DNS resolution failed";
+    case "tcp":
+      return "Upstream TCP connection failed";
+    case "tls":
+      return "Upstream TLS negotiation failed";
+    case "read_timeout":
+      return "Upstream response timed out";
+    case "proxy_connect":
+      return "Upstream proxy connection failed";
+    case "fly_edge":
+      return "Upstream edge transport failed";
+    case "unknown":
+      return "Proxy request failed with an unclassified cause";
+  }
+}
+function daemonProxyFailureTraceAttrs(input) {
+  const reason = failureReason(input);
+  return {
+    route_family: routeFamilyForPath(input.pathname),
+    method: boundedMethod(input.method),
+    outcome: "error",
+    reason,
+    error_class: boundedErrorClass(input.errorName),
+    error_excerpt: cannedExcerpt(reason),
+    ...typeof input.responseStatusCode === "number" ? { response_status_code: input.responseStatusCode } : {},
+    response_code_present: Boolean(input.responseCode)
+  };
+}
+function daemonTransportErrorExcerpt(input) {
+  if (input.normalizedCode === "local_daemon_state_invalid") {
+    return "Local daemon lifecycle state rejected the proxy request";
+  }
+  if (input.normalizedCode === "server_5xx") return "Upstream server returned a 5xx response";
+  switch (input.upstreamLayer) {
+    case "dns":
+      return "Upstream DNS resolution failed";
+    case "tcp":
+      return "Upstream TCP connection failed";
+    case "tls":
+      return "Upstream TLS negotiation failed";
+    case "read_timeout":
+      return "Upstream response timed out";
+    case "proxy_connect":
+      return "Upstream proxy connection failed";
+    case "fly_edge":
+      return "Upstream edge transport failed";
+    case "body_decode_failure":
+      return "Upstream response body could not be decoded";
+    case "http_status":
+      return "Upstream HTTP request failed";
+    case "unknown":
+      return "Proxy transport failed with an unclassified cause";
+  }
+}
+
 // src/agentProcessManager.ts
 var DEFAULT_MAX_CONCURRENT_AGENT_STARTS = 5;
 var DEFAULT_AGENT_START_INTERVAL_MS = 500;
@@ -14768,8 +15190,9 @@ function classifyTerminalFailure(ap) {
     if (lower.includes("usage limit") || lower.includes("quota exceeded") || lower.includes("quota limit") || lower.includes("budget limit exceeded") || lower.includes("usage not included in your plan") || lower.includes("modelnotfounderror") || lower.includes("requested entity was not found") || lower.includes("model deprecated") || lower.includes("model not found") || lower.includes("model is not supported") || lower.includes("unsupported model") || /\bmodel\b.*\bnot supported\b/i.test(text) || diagnostics.spanAttrs.runtime_error_action_required === true || isProviderStreamFailureText(text) || isRuntimeStartTimeoutText(text)) {
       const actionRequired = diagnostics.spanAttrs.runtime_error_action_required === true;
       return {
-        detail: actionRequired ? formatRuntimeLoginRequiredMessage(ap.driver.id) : text,
-        actionRequired
+        detail: actionRequired ? formatRuntimeActionRequiredMessage(ap) : text,
+        actionRequired,
+        ...actionRequired ? { entries: buildRuntimeActionRequiredEntries(ap, text, diagnostics) } : {}
       };
     }
   }
@@ -14785,6 +15208,52 @@ function classifyStickyTerminalFailure(ap) {
   if (isRuntimeStartTimeoutText(terminalFailure.detail)) return null;
   return null;
 }
+function formatRuntimeActionRequiredMessage(ap) {
+  if (ap.driver.id === "claude" && isClaudeCustomProviderConfig(ap.config)) {
+    return "Claude Code custom provider authentication failed. Check this agent's custom Claude provider API key/API URL, then retry starting this agent.";
+  }
+  return formatRuntimeLoginRequiredMessage(ap.driver.id);
+}
+function buildRuntimeActionRequiredEntries(ap, text, diagnostics) {
+  const excerpt = String(diagnostics.eventAttrs.runtime_error_message_excerpt ?? "").trim();
+  const subtype = classifyRuntimeActionRequiredSubtype(ap, text);
+  const detail = formatRuntimeActionRequiredMessage(ap);
+  const entries = [
+    { kind: "text", text: `Error: ${detail}` },
+    { kind: "text", text: `Runtime auth diagnostic: ${subtype}` }
+  ];
+  if (excerpt) {
+    entries.push({ kind: "text", text: `Raw error excerpt (redacted): ${excerpt}` });
+  }
+  if (ap.driver.id === "claude") {
+    entries.push({
+      kind: "text",
+      text: isClaudeCustomProviderConfig(ap.config) ? "Claude auth mode: custom provider. Local Claude Code login does not fix this branch; check this agent's provider API key/API URL." : "Claude auth mode: default host login. If Terminal works, set this agent's Claude command to the absolute path from `which claude` and restart Raft Computer."
+    });
+  }
+  return entries;
+}
+function classifyRuntimeActionRequiredSubtype(ap, text) {
+  const lower = text.toLowerCase();
+  const customClaudeProvider = ap.driver.id === "claude" && isClaudeCustomProviderConfig(ap.config);
+  if (customClaudeProvider) {
+    if (/\bmissing\b.*\b(?:api\s*)?key\b|\b(?:api\s*)?key\b.*\bnot set\b|\bmissing\b.*\btoken\b|\bno\b.*\btoken\b/i.test(text)) {
+      return "custom_provider_missing_key";
+    }
+    if (/\binvalid\b.*\b(?:api\s*)?key\b|\bunauthorized\b|\b401\b|\b403\b|auth(?:entication)? failed/i.test(text)) {
+      return "custom_provider_invalid_key";
+    }
+    return "custom_provider_auth_error";
+  }
+  if (ap.driver.id === "claude") {
+    if (lower.includes("not logged in") || lower.includes("not signed in") || lower.includes("please log in") || lower.includes("login required")) {
+      return "host_claude_login_required";
+    }
+    return "runtime_auth_error";
+  }
+  if (ap.driver.id === "builtin") return "builtin_provider_auth_error";
+  return "runtime_auth_error";
+}
 function isAuthClassTerminalLine(text) {
   return buildRuntimeErrorDiagnosticEnvelope(text).spanAttrs.runtime_error_action_required === true;
 }
@@ -15809,17 +16278,9 @@ var AgentProcessManager = class _AgentProcessManager {
     };
   }
   recordAgentProxyFailure(agentId, input) {
-    this.recordDaemonTrace("daemon.agent.proxy.failure", {
+    this.recordDaemonTrace("daemon.proxy.failed", {
       agentId,
-      method: input.method,
-      path: input.pathname,
-      query_keys: input.queryKeys,
-      error_name: input.errorName,
-      error_message: input.errorMessage,
-      response_status_code: input.responseStatusCode,
-      response_code: input.responseCode,
-      lifecycle_invalid_agent_id: input.lifecycleInvalidAgentId,
-      lifecycle_invalid_context: input.lifecycleInvalidContext
+      ...daemonProxyFailureTraceAttrs(input)
     }, "error");
   }
   recordAgentProxyTransportNormalizedError(agentId, input) {
@@ -15831,7 +16292,7 @@ var AgentProcessManager = class _AgentProcessManager {
       response_started: input.responseStarted,
       upstream_layer: input.upstreamLayer,
       ...typeof input.upstreamStatus === "number" ? { upstream_status: input.upstreamStatus } : {},
-      ...input.originalMessage ? { original_message: input.originalMessage } : {},
+      error_excerpt: daemonTransportErrorExcerpt(input),
       launchId: input.launchId,
       target_host_class: input.targetHostClass,
       downstream_caller: input.downstreamCaller,
@@ -16986,7 +17447,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
                   agentId,
                   "error",
                   terminalFailureDetail.detail,
-                  [{ kind: "text", text: `Error: ${terminalFailureDetail.detail}` }],
+                  terminalFailureDetail.entries ?? [{ kind: "text", text: `Error: ${terminalFailureDetail.detail}` }],
                   ap.launchId,
                   "runtime_error"
                 );
@@ -17017,9 +17478,10 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           agentProcess.decisionErrorWindow.recordRuntimeError(startResult.error);
         }
         if (startResult.error && diagnostics?.spanAttrs.runtime_error_action_required === true) {
-          const visibleErrorMessage = formatRuntimeLoginRequiredMessage(agentProcess.driver.id);
+          const terminalFailure = classifyTerminalFailure(agentProcess);
+          const visibleErrorMessage = terminalFailure?.detail ?? formatRuntimeActionRequiredMessage(agentProcess);
           this.broadcastActivity(agentId, "error", visibleErrorMessage, [
-            { kind: "text", text: `Error: ${visibleErrorMessage}` }
+            ...terminalFailure?.entries ?? [{ kind: "text", text: `Error: ${visibleErrorMessage}` }]
           ], agentProcess.launchId, "runtime_error");
         }
         throw new Error(`Runtime session failed to start: ${startResult.reason}${startResult.error ? ` (${startResult.error})` : ""}`);
@@ -17990,57 +18452,12 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
       pids: pids.join(",")
     });
     await Promise.all(ids.map((id) => this.stopAgent(id, { wait: true, silent: true })));
-    const survivors = pids.filter((pid) => {
-      try {
-        process.kill(pid, 0);
-        return true;
-      } catch {
-        return false;
-      }
-    });
-    if (survivors.length > 0) {
-      for (const pid of survivors) {
-        logger.warn(`[Daemon] Agent subprocess ${pid} survived stopAll; sending SIGKILL`);
-        try {
-          process.kill(pid, "SIGKILL");
-        } catch {
-        }
-      }
-      this.recordDaemonTrace("daemon.agent.stop_all.survivor_reaped", {
-        survivor_count: survivors.length,
-        survivor_pids: survivors.join(","),
-        reason: "shutdown_survivor",
-        signal: "SIGKILL"
-      });
-      const deadline = Date.now() + 2e3;
-      while (Date.now() < deadline) {
-        const alive = survivors.filter((pid) => {
-          try {
-            process.kill(pid, 0);
-            return true;
-          } catch {
-            return false;
-          }
-        });
-        if (alive.length === 0) break;
-        await new Promise((r) => setTimeout(r, 50));
-      }
-      const stillAlive = survivors.filter((pid) => {
-        try {
-          process.kill(pid, 0);
-          return true;
-        } catch {
-          return false;
-        }
-      });
-      const outcome = stillAlive.length > 0 ? "survivors_still_alive" : "survivors_killed";
-      this.recordDaemonTrace("daemon.agent.stop_all.completed", {
-        survivor_count: survivors.length,
-        reaped_count: survivors.length - stillAlive.length,
-        still_alive_count: stillAlive.length,
-        outcome
-      }, stillAlive.length > 0 ? "error" : "ok");
-    } else {
+    const reapedSurvivors = await reapOrphanProcesses(
+      pids,
+      logger,
+      (name, attrs, status) => this.recordDaemonTrace(name, attrs, status)
+    );
+    if (!reapedSurvivors) {
       this.recordDaemonTrace("daemon.agent.stop_all.completed", {
         agent_count: ids.length,
         survivor_count: 0,
@@ -18782,7 +19199,8 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     const ap = this.agents.get(agentId);
     const entries = [...extraTrajectory];
     const hasToolStart = entries.some((e) => e.kind === "tool_start");
-    if (!hasToolStart) {
+    const isThinkingProgressFrame = activityKind === "thinking" && detail === "" && detailKind === "none" && entries.every((e) => e.kind === "thinking" || e.kind === "text");
+    if (!hasToolStart && !isThinkingProgressFrame) {
       entries.push({
         kind: "status",
         activity: activityKind,
@@ -19794,15 +20212,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     return true;
   }
   probeRuntimeProcessLiveness(ap) {
-    const pid = ap.runtime.pid;
-    if (typeof pid !== "number") return void 0;
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch (err) {
-      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-      return code === "EPERM" ? true : false;
-    }
+    return ap.runtime.isAlive();
   }
   recoverStaleProcessForQueuedMessageIfNeeded(agentId, ap) {
     const staleForMs = ap.runtimeProgress.ageMs();
@@ -20182,11 +20592,12 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           ap.decisionErrorWindow.recordRuntimeError(event.message);
         }
         let visibleErrorMessage = event.message;
+        let visibleErrorEntries;
         if (ap) {
           const runtimeErrorDiagnostics = buildRuntimeErrorDiagnosticEnvelope(event.message);
           const runtimeErrorFingerprint = typeof runtimeErrorDiagnostics.spanAttrs.runtime_error_fingerprint === "string" ? runtimeErrorDiagnostics.spanAttrs.runtime_error_fingerprint : null;
           if (runtimeErrorDiagnostics.spanAttrs.runtime_error_action_required === true) {
-            visibleErrorMessage = formatRuntimeLoginRequiredMessage(ap.driver.id);
+            visibleErrorMessage = formatRuntimeActionRequiredMessage(ap);
           }
           const shouldDisableToolBoundaryFlush = ap.runtime.descriptor.busyDelivery === "gated" && this.isThinkingBlockMutationError(event.message);
           const backoffFailPoint = this.runtimeErrorDeliveryBackoffFailPointForTesting?.({
@@ -20212,6 +20623,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           if (fingerprintFence) {
             visibleErrorMessage = fingerprintFence.detail;
           }
+          visibleErrorEntries = terminalFailure?.entries;
           this.noteRuntimeErrorDeliveryBackoff(agentId, ap, event.message, terminalFailure, stickyTerminalFailure, backoffReasonOverride);
           if (reduction.shouldDisableToolBoundaryFlush) {
             this.recordGatedSteeringEvent(agentId, ap, "disabled", {
@@ -20258,9 +20670,14 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
             }
           }
         }
-        this.broadcastActivity(agentId, "error", visibleErrorMessage, [
-          { kind: "text", text: `Error: ${visibleErrorMessage}` }
-        ], void 0, "runtime_error");
+        this.broadcastActivity(
+          agentId,
+          "error",
+          visibleErrorMessage,
+          visibleErrorEntries ?? [{ kind: "text", text: `Error: ${visibleErrorMessage}` }],
+          void 0,
+          "runtime_error"
+        );
         break;
       }
     }
@@ -20927,8 +21344,11 @@ var DaemonConnection = class {
   doConnect() {
     if (!this.shouldConnect) return;
     if (this.ws && this.ws.readyState !== WebSocket.CLOSED) return;
-    const wsUrl = this.options.serverUrl.replace(/^http/, "ws") + `/daemon/connect?key=${this.options.apiKey}`;
-    const wsOptions = buildWebSocketOptions(wsUrl, this.options.proxyEnv ?? process.env);
+    const wsUrl = this.options.serverUrl.replace(/^http/, "ws") + "/daemon/connect";
+    const wsOptions = {
+      ...buildWebSocketOptions(wsUrl, this.options.proxyEnv ?? process.env),
+      headers: { Authorization: `Bearer ${this.options.apiKey}` }
+    };
     logger.info(`[Daemon] Connecting to ${this.options.serverUrl}...`);
     if (wsOptions?.agent) {
       logger.info("[Daemon] Using configured proxy for WebSocket connection");
@@ -21865,45 +22285,212 @@ function readPositiveIntegerEnv2(name, fallback) {
 }
 
 // src/computerMigrationGuard.ts
-import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "fs";
 import path18 from "path";
-var LegacyDaemonKeyAdoptedByComputerError = class extends Error {
-  code = "LEGACY_DAEMON_KEY_ADOPTED_BY_COMPUTER";
-  attachmentPath;
-  serverId;
-  constructor(match) {
-    const serverDisplay = match.serverSlug ? `/${match.serverSlug}` : match.serverId;
-    const startCommand = match.serverSlug ? `raft-computer start /${match.serverSlug}` : "raft-computer start";
-    super(
-      `This legacy daemon key was already adopted by Raft Computer for ${serverDisplay}. Start the Computer supervisor instead: ${startCommand}. Legacy daemon startup is blocked to avoid relaunching a migrated machine key.`
-    );
-    this.name = "LegacyDaemonKeyAdoptedByComputerError";
-    this.attachmentPath = match.attachmentPath;
-    this.serverId = match.serverId;
+
+// src/legacySupervisor.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { readFileSync as readFileSync8 } from "fs";
+function execFileText(file, args) {
+  try {
+    return execFileSync4(file, args, {
+      encoding: "utf8",
+      timeout: 1e3,
+      maxBuffer: 256 * 1024,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return void 0;
   }
-};
-function daemonApiKeyFingerprint(apiKey) {
-  return getDaemonMachineLockId(apiKey).slice("machine-".length);
 }
-function findAdoptedComputerForLegacyFingerprint(slockHome, legacyApiKeyFingerprint) {
-  const serversDir = path18.join(slockHome, "computer", "servers");
-  if (!existsSync9(serversDir)) return null;
-  let serverDirs;
+function readFileText(file) {
   try {
-    serverDirs = readdirSync6(serversDir);
+    return readFileSync8(file, "utf8");
   } catch {
-    return null;
+    return void 0;
   }
-  for (const serverId of serverDirs) {
-    const attachmentPath = path18.join(serversDir, serverId, "runner.state.json");
-    let raw;
+}
+function defaultProbe(pid) {
+  return {
+    pid,
+    platform: process.platform,
+    env: process.env,
+    execFile: execFileText,
+    readFile: readFileText
+  };
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function parentPid(probe, pid) {
+  const stdout = probe.execFile("ps", ["-o", "ppid=", "-p", String(pid)]);
+  const parsed = Number.parseInt(stdout?.trim() ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : void 0;
+}
+function processCommand(probe, pid) {
+  return probe.execFile("ps", ["-o", "command=", "-p", String(pid)])?.trim().toLowerCase() ?? "";
+}
+function relatedProcessIds(probe) {
+  const ids = [probe.pid];
+  let current = probe.pid;
+  for (let depth = 0; depth < 12; depth += 1) {
+    const parent = parentPid(probe, current);
+    if (!parent || ids.includes(parent)) break;
+    ids.push(parent);
+    if (parent === 1) break;
+    current = parent;
+  }
+  return ids;
+}
+function detectPm2(probe, relatedPids) {
+  const hasPm2Ancestor = relatedPids.slice(1).some((pid) => processCommand(probe, pid).includes("pm2"));
+  const hasPm2Environment = Boolean(probe.env.PM2_HOME || probe.env.pm_id);
+  if (!hasPm2Ancestor && !hasPm2Environment) return void 0;
+  const pm2Json = probe.execFile("pm2", ["jlist"]);
+  if (pm2Json) {
     try {
-      raw = readFileSync8(attachmentPath, "utf8");
+      const entries = JSON.parse(pm2Json);
+      const entry = entries.find(
+        (candidate) => typeof candidate.pid === "number" && relatedPids.includes(candidate.pid)
+      );
+      if (entry) {
+        const name = typeof entry.name === "string" && entry.name.length > 0 ? entry.name : String(entry.pid);
+        return {
+          kind: "pm2",
+          detail: `PM2 app ${JSON.stringify(name)} is supervising this legacy daemon.`,
+          cleanupCommands: [`pm2 delete ${shellQuote(name)}`, "pm2 save"]
+        };
+      }
     } catch {
-      continue;
     }
-    try {
-      const attachment = JSON.parse(raw);
+  }
+  return {
+    kind: "pm2",
+    detail: "PM2 is supervising this legacy daemon, but its app name could not be resolved.",
+    cleanupCommands: ["pm2 delete <legacy-daemon-app-name>", "pm2 save"]
+  };
+}
+function systemdUnitFromCgroup(cgroup) {
+  if (!cgroup) return void 0;
+  for (const line of cgroup.split("\n")) {
+    const pathPart = line.slice(line.lastIndexOf(":") + 1);
+    let unit;
+    for (const segment of pathPart.split("/")) {
+      if (segment.endsWith(".service") && segment.length > ".service".length && !/^user@\d+\.service$/.test(segment)) {
+        unit = segment;
+      }
+    }
+    if (unit) return { unit, user: pathPart.includes("/user.slice/") };
+  }
+  return void 0;
+}
+function detectSystemd(probe) {
+  if (probe.platform !== "linux") return void 0;
+  const cgroupUnit = systemdUnitFromCgroup(
+    probe.readFile(`/proc/${probe.pid}/cgroup`)
+  );
+  const hasSystemdEvidence = cgroupUnit !== void 0 || probe.env.INVOCATION_ID !== void 0;
+  if (!hasSystemdEvidence) return void 0;
+  if (cgroupUnit) {
+    const prefix = cgroupUnit.user ? "systemctl --user" : "sudo systemctl";
+    return {
+      kind: "systemd",
+      detail: `systemd unit ${JSON.stringify(cgroupUnit.unit)} is supervising this legacy daemon.`,
+      cleanupCommands: [
+        `${prefix} disable --now ${shellQuote(cgroupUnit.unit)}`
+      ]
+    };
+  }
+  return {
+    kind: "systemd",
+    detail: "systemd is supervising this legacy daemon, but its unit name could not be resolved.",
+    cleanupCommands: [
+      "systemctl --user disable --now <legacy-daemon-unit>.service"
+    ]
+  };
+}
+function detectLaunchd(probe) {
+  if (probe.platform !== "darwin") return void 0;
+  const label = probe.env.LAUNCH_JOBKEY_LABEL || probe.env.XPC_SERVICE_NAME;
+  if (!label || label === "0") return void 0;
+  return {
+    kind: "launchd",
+    detail: `launchd job ${JSON.stringify(label)} is supervising this legacy daemon.`,
+    cleanupCommands: [
+      `launchctl bootout gui/$(id -u)/${shellQuote(label)}`,
+      `rm -f ~/Library/LaunchAgents/${shellQuote(`${label}.plist`)}`
+    ]
+  };
+}
+function detectLegacyDaemonSupervisor(pid = process.pid) {
+  return detectLegacyDaemonSupervisorWithProbe(defaultProbe(pid));
+}
+function detectLegacyDaemonSupervisorWithProbe(probe) {
+  const relatedPids = relatedProcessIds(probe);
+  return detectPm2(probe, relatedPids) ?? detectSystemd(probe) ?? detectLaunchd(probe);
+}
+var legacyDaemonSupervisorFallbackCommands = [
+  "PM2: pm2 delete <legacy-daemon-app-name> && pm2 save",
+  "systemd: systemctl --user disable --now <legacy-daemon-unit>.service",
+  "launchd: launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/<legacy-daemon-label>.plist && rm -f ~/Library/LaunchAgents/<legacy-daemon-label>.plist"
+];
+
+// src/computerMigrationGuard.ts
+var LegacyDaemonKeyAdoptedByComputerError = class extends Error {
+  code = "LEGACY_DAEMON_KEY_ADOPTED_BY_COMPUTER";
+  attachmentPath;
+  serverId;
+  constructor(match, supervisor = detectLegacyDaemonSupervisor() ?? null) {
+    const serverDisplay = match.serverSlug ? `/${match.serverSlug}` : match.serverId;
+    const startCommand = match.serverSlug ? `raft-computer start /${match.serverSlug}` : "raft-computer start";
+    const statusCommand = match.serverSlug ? `raft-computer status /${match.serverSlug}` : "raft-computer status";
+    const supervisorGuidance = formatSupervisorGuidance(
+      supervisor ?? void 0
+    );
+    super(
+      `Legacy Raft daemon startup refused: this machine key was already migrated to Raft Computer for ${serverDisplay}.
+Raft Computer now owns this connection; do not restart raft-daemon with the migrated key.
+${supervisorGuidance}
+Then start and verify Raft Computer:
+  ${startCommand}
+  ${statusCommand}`
+    );
+    this.name = "LegacyDaemonKeyAdoptedByComputerError";
+    this.attachmentPath = match.attachmentPath;
+    this.serverId = match.serverId;
+  }
+};
+function formatSupervisorGuidance(supervisor) {
+  if (supervisor) {
+    return `${supervisor.detail}
+Remove the old supervisor entry so it cannot auto-restart:
+` + supervisor.cleanupCommands.map((command) => `  ${command}`).join("\n");
+  }
+  return `If a process manager keeps restarting the old daemon, remove the entry you configured:
+` + legacyDaemonSupervisorFallbackCommands.map((command) => `  ${command}`).join("\n");
+}
+function daemonApiKeyFingerprint(apiKey) {
+  return getDaemonMachineLockId(apiKey).slice("machine-".length);
+}
+function findAdoptedComputerForLegacyFingerprint(slockHome, legacyApiKeyFingerprint) {
+  const serversDir = path18.join(slockHome, "computer", "servers");
+  if (!existsSync9(serversDir)) return null;
+  let serverDirs;
+  try {
+    serverDirs = readdirSync6(serversDir);
+  } catch {
+    return null;
+  }
+  for (const serverId of serverDirs) {
+    const attachmentPath = path18.join(serversDir, serverId, "runner.state.json");
+    let raw;
+    try {
+      raw = readFileSync9(attachmentPath, "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      const attachment = JSON.parse(raw);
       if (attachment.kind === "computer-attachment" && attachment.adoptedFromLegacy === true && attachment.legacyApiKeyFingerprint === legacyApiKeyFingerprint) {
         return {
           attachmentPath,
@@ -21912,20 +22499,543 @@ function findAdoptedComputerForLegacyFingerprint(slockHome, legacyApiKeyFingerpr
           serverMachineId: typeof attachment.serverMachineId === "string" && attachment.serverMachineId.length > 0 ? attachment.serverMachineId : void 0
         };
       }
-    } catch {
-      continue;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function assertLegacyDaemonKeyNotAdoptedByComputer(options) {
+  const legacyApiKeyFingerprint = daemonApiKeyFingerprint(options.apiKey);
+  const match = findAdoptedComputerForLegacyFingerprint(
+    options.slockHome,
+    legacyApiKeyFingerprint
+  );
+  if (match) throw new LegacyDaemonKeyAdoptedByComputerError(match);
+}
+
+// src/agentMigrationHttpTransport.ts
+import { createHash as createHash7, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import http2 from "http";
+import { Readable } from "stream";
+var AGENT_MIGRATION_TRANSPORT_HOST_ENV = "SLOCK_AGENT_MIGRATION_TRANSPORT_HOST";
+var AGENT_MIGRATION_TRANSPORT_PORT_ENV = "SLOCK_AGENT_MIGRATION_TRANSPORT_PORT";
+var AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV = "SLOCK_AGENT_MIGRATION_TRANSPORT_PUBLIC_URL";
+var AGENT_MIGRATION_CONTROL_SEAM_ENV = "SLOCK_AGENT_MIGRATION_CONTROL_SEAM";
+var CONTROL_REQUEST_MAX_BYTES = 8 * 1024 * 1024;
+var MigrationBundleStreamError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+var AgentMigrationGrantRegistry = class {
+  grants = /* @__PURE__ */ new Map();
+  now;
+  constructor(now = currentDate) {
+    this.now = now;
+  }
+  createGrant(input) {
+    const token = input.token ?? randomBytes2(32).toString("base64url");
+    const manifestSha256 = sha256Buffer(canonicalJsonBuffer(input.manifest));
+    const grant = {
+      grantId: input.grantId ?? randomBytes2(16).toString("hex"),
+      tokenHash: hashToken(token),
+      expiresAt: input.expiresAt,
+      oneTimeUse: input.oneTimeUse ?? true,
+      state: "issued",
+      manifest: input.manifest,
+      manifestSha256,
+      bundleEtag: `"agent-migration-${manifestSha256}"`,
+      bundleSizeBytes: normalizeBundleSizeBytes(input.bundleSizeBytes)
+    };
+    this.grants.set(grant.grantId, grant);
+    return { grant, token };
+  }
+  get(grantId) {
+    return this.grants.get(grantId);
+  }
+  authenticate(grantId, token) {
+    const grant = this.grants.get(grantId);
+    if (!grant || !token || !verifyTokenHash(token, grant.tokenHash)) {
+      return { ok: false, status: 401, code: "migration_grant_auth_failed" };
+    }
+    if (grant.state === "revoked" || grant.state === "consumed") {
+      return { ok: false, status: 410, code: "migration_grant_unavailable" };
+    }
+    if (this.now().getTime() >= grant.expiresAt.getTime()) {
+      grant.state = "expired";
+      return { ok: false, status: 410, code: "migration_grant_unavailable" };
+    }
+    return { ok: true, grant };
+  }
+  revokeAll() {
+    for (const grant of this.grants.values()) {
+      if (grant.state !== "consumed" && grant.state !== "expired") {
+        grant.state = "revoked";
+      }
+    }
+  }
+  beginBundleStream(grant) {
+    const current = this.grants.get(grant.grantId);
+    if (current !== grant) return false;
+    if (current.state !== "issued" && current.state !== "interrupted") return false;
+    current.state = "streaming";
+    return true;
+  }
+};
+function createAgentMigrationHttpTransport(options = {}) {
+  const now = options.now ?? currentDate;
+  const registry = new AgentMigrationGrantRegistry(now);
+  const controlBundles = /* @__PURE__ */ new Map();
+  const fallbackBundleStreamFactory = options.bundleStreamFactory ?? defaultBundleStream;
+  const bundleStreamFactory = (grant, request) => {
+    const bundle = controlBundles.get(grant.grantId);
+    if (bundle) {
+      const endExclusive = request.lengthBytes === null ? void 0 : request.offsetBytes + request.lengthBytes;
+      return Readable.from([bundle.subarray(request.offsetBytes, endExclusive)]);
+    }
+    return fallbackBundleStreamFactory(grant, request);
+  };
+  const listenDefaults = options.listen ?? resolveAgentMigrationHttpTransportListenOptions();
+  const controlSeamEnabled = options.controlSeam ?? resolveAgentMigrationControlSeamEnabled();
+  const server = http2.createServer((req, res) => {
+    const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (parsed.pathname.startsWith("/migration-control")) {
+      void handleMigrationControlRequest(req, res, parsed, {
+        enabled: controlSeamEnabled,
+        now,
+        registry,
+        controlBundles
+      });
+      return;
+    }
+    void handleMigrationRequest(req, res, registry, bundleStreamFactory);
+  });
+  return {
+    grants: registry,
+    server,
+    listen: (port = listenDefaults.port ?? 0, host = listenDefaults.host ?? "127.0.0.1") => new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(port, host, () => {
+        server.off("error", reject);
+        const address = server.address();
+        if (!address || typeof address === "string") {
+          reject(new Error("migration transport listen did not produce a TCP address"));
+          return;
+        }
+        resolve({ url: listenDefaults.publicUrl ?? `http://${formatListenAddress(address.address)}:${address.port}` });
+      });
+    }),
+    close: () => new Promise((resolve, reject) => {
+      registry.revokeAll();
+      server.close((err) => {
+        if (err) reject(err);
+        else resolve();
+      });
+    })
+  };
+}
+function resolveAgentMigrationHttpTransportListenOptions(env = process.env) {
+  const host = env[AGENT_MIGRATION_TRANSPORT_HOST_ENV]?.trim();
+  const port = parseOptionalPort(env[AGENT_MIGRATION_TRANSPORT_PORT_ENV]);
+  const publicUrl = env[AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV]?.trim();
+  return {
+    ...host ? { host } : {},
+    ...port !== void 0 ? { port } : {},
+    ...publicUrl ? { publicUrl } : {}
+  };
+}
+function resolveAgentMigrationControlSeamEnabled(env = process.env) {
+  return env[AGENT_MIGRATION_CONTROL_SEAM_ENV]?.trim() !== "0";
+}
+async function handleMigrationControlRequest(req, res, parsed, context) {
+  if (!context.enabled) {
+    sendJson(res, 404, { code: "migration_route_not_found" });
+    return;
+  }
+  if (parsed.pathname !== "/migration-control/grants") {
+    sendJson(res, 404, { code: "migration_route_not_found" });
+    return;
+  }
+  if (req.method !== "POST") {
+    sendJson(res, 405, { code: "migration_method_not_allowed" });
+    return;
+  }
+  let rawInput;
+  try {
+    rawInput = await readJsonRequestBody(req, CONTROL_REQUEST_MAX_BYTES);
+  } catch (err) {
+    if (err instanceof MigrationBundleStreamError) {
+      sendJson(res, err.code === "migration_control_payload_too_large" ? 413 : 400, { code: err.code });
+      return;
+    }
+    sendJson(res, 400, { code: "migration_control_invalid_json" });
+    return;
+  }
+  const input = parseControlGrantInput(rawInput, context.now);
+  if (!input.ok) {
+    sendJson(res, 400, { code: input.code });
+    return;
+  }
+  const { bundle, createGrantInput } = input;
+  const { grant, token } = context.registry.createGrant({
+    ...createGrantInput,
+    bundleSizeBytes: bundle.byteLength
+  });
+  context.controlBundles.set(grant.grantId, bundle);
+  sendJson(res, 201, {
+    grantId: grant.grantId,
+    token,
+    manifestSha256: grant.manifestSha256,
+    bundleSizeBytes: grant.bundleSizeBytes,
+    expiresAt: grant.expiresAt.toISOString(),
+    manifestUrl: `/migration/${encodeURIComponent(grant.grantId)}/manifest`,
+    bundleUrl: `/migration/${encodeURIComponent(grant.grantId)}/bundle.tar`
+  });
+}
+async function handleMigrationRequest(req, res, registry, bundleStreamFactory) {
+  const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
+  const match = /^\/migration\/([^/]+)\/([^/]+)(?:\/([^/]+))?$/.exec(parsed.pathname);
+  if (!match) {
+    sendJson(res, 404, { code: "migration_route_not_found" });
+    return;
+  }
+  const [, grantId, resource, resourceId] = match;
+  const auth = registry.authenticate(decodeURIComponent(grantId), extractBearerToken(req));
+  if (!auth.ok) {
+    sendJson(res, auth.status, { code: auth.code });
+    return;
+  }
+  if (resource === "manifest" && req.method === "GET" && !resourceId) {
+    sendJson(res, 200, {
+      manifestSha256: auth.grant.manifestSha256,
+      manifest: auth.grant.manifest
+    }, {
+      "X-Raft-Manifest-Sha": auth.grant.manifestSha256,
+      ETag: `"manifest-${auth.grant.manifestSha256}"`
+    });
+    return;
+  }
+  if (resource === "bundle.tar" && !resourceId) {
+    if (req.method === "HEAD") {
+      sendHead(res, auth.grant);
+      return;
+    }
+    if (req.method === "GET") {
+      await streamBundle(req, res, auth.grant, registry, bundleStreamFactory);
+      return;
+    }
+  }
+  if (resource === "chunk" && req.method === "GET" && resourceId) {
+    sendJson(res, 501, { code: "migration_chunk_not_implemented" });
+    return;
+  }
+  sendJson(res, 405, { code: "migration_method_not_allowed" });
+}
+function sendHead(res, grant) {
+  res.statusCode = 200;
+  res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
+  res.setHeader("ETag", grant.bundleEtag);
+  res.setHeader("Accept-Ranges", grant.bundleSizeBytes === null ? "none" : "bytes");
+  res.setHeader("X-Raft-Bundle-Size", grant.bundleSizeBytes === null ? "unknown" : grant.bundleSizeBytes.toString());
+  if (grant.bundleSizeBytes !== null) {
+    res.setHeader("Content-Length", grant.bundleSizeBytes.toString());
+  }
+  res.end();
+}
+async function streamBundle(req, res, grant, registry, bundleStreamFactory) {
+  if (grant.state === "streaming") {
+    sendJson(res, 409, { code: "migration_bundle_stream_in_progress" });
+    return;
+  }
+  if (grant.oneTimeUse && grant.state !== "issued" && grant.state !== "interrupted") {
+    sendJson(res, 410, { code: "migration_grant_unavailable" });
+    return;
+  }
+  const range = planRange(req, grant);
+  if (!range.ok) {
+    sendJson(res, 416, { code: range.code }, range.headers);
+    return;
+  }
+  const previousState = grant.state;
+  if (!registry.beginBundleStream(grant)) {
+    sendJson(res, 409, { code: "migration_bundle_stream_in_progress" });
+    return;
+  }
+  let stream;
+  try {
+    stream = bundleStreamFactory(grant, range.request);
+  } catch (err) {
+    grant.state = previousState;
+    const code = err instanceof MigrationBundleStreamError ? err.code : "migration_bundle_stream_failed";
+    sendJson(res, 500, { code });
+    return;
+  }
+  let completed = false;
+  res.on("close", () => {
+    if (!completed && grant.state === "streaming") {
+      grant.state = "interrupted";
+    }
+  });
+  try {
+    res.statusCode = 200;
+    res.setHeader("Content-Type", "application/x-tar");
+    res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
+    res.setHeader("ETag", grant.bundleEtag);
+    res.setHeader("Accept-Ranges", grant.bundleSizeBytes === null ? "none" : "bytes");
+    if (range.request.range) {
+      res.statusCode = 206;
+      res.setHeader("Content-Range", `bytes ${range.request.range.start}-${range.request.range.end}/${grant.bundleSizeBytes}`);
+    }
+    if (range.request.lengthBytes !== null) {
+      res.setHeader("Content-Length", range.request.lengthBytes.toString());
+    }
+    for await (const chunk of stream) {
+      if (!res.write(chunk)) {
+        await onceDrain(res);
+      }
+    }
+    completed = true;
+    grant.state = range.consumesGrant ? "consumed" : "interrupted";
+    res.end();
+  } catch {
+    if (!completed) {
+      grant.state = "interrupted";
+    }
+    if (!res.headersSent) {
+      sendJson(res, 500, { code: "migration_bundle_stream_failed" });
+    } else {
+      res.destroy();
+    }
+  }
+}
+function planRange(req, grant) {
+  const header = singleHeader(req.headers.range);
+  if (!header) {
+    return {
+      ok: true,
+      request: { range: null, offsetBytes: 0, lengthBytes: grant.bundleSizeBytes },
+      consumesGrant: true
+    };
+  }
+  if (grant.bundleSizeBytes === null) {
+    return {
+      ok: false,
+      code: "migration_range_not_available",
+      headers: { "Accept-Ranges": "none" }
+    };
+  }
+  const parsed = parseSingleByteRange(header, grant.bundleSizeBytes);
+  if (!parsed.ok) {
+    return {
+      ok: false,
+      code: parsed.code,
+      headers: {
+        "Accept-Ranges": "bytes",
+        "Content-Range": `bytes */${grant.bundleSizeBytes}`
+      }
+    };
+  }
+  return {
+    ok: true,
+    request: {
+      range: parsed.range,
+      offsetBytes: parsed.range.start,
+      lengthBytes: parsed.range.end - parsed.range.start + 1
+    },
+    consumesGrant: parsed.range.end === grant.bundleSizeBytes - 1
+  };
+}
+function parseSingleByteRange(header, sizeBytes) {
+  const match = /^bytes=(\d+)-(\d*)$/.exec(header.trim());
+  if (!match) {
+    return { ok: false, code: "migration_range_not_satisfiable" };
+  }
+  const start = Number(match[1]);
+  const requestedEnd = match[2] ? Number(match[2]) : sizeBytes - 1;
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(requestedEnd) || start < 0 || requestedEnd < start || start >= sizeBytes) {
+    return { ok: false, code: "migration_range_not_satisfiable" };
+  }
+  return {
+    ok: true,
+    range: {
+      start,
+      end: Math.min(requestedEnd, sizeBytes - 1)
+    }
+  };
+}
+function defaultBundleStream(grant) {
+  void grant;
+  throw new MigrationBundleStreamError("migration_bundle_stream_not_wired");
+}
+function parseControlGrantInput(rawInput, now) {
+  if (!rawInput || typeof rawInput !== "object" || Array.isArray(rawInput)) {
+    return { ok: false, code: "migration_control_invalid_payload" };
+  }
+  const input = rawInput;
+  const manifest = input.manifest;
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    return { ok: false, code: "migration_control_manifest_required" };
+  }
+  const bundle = decodeControlBundle(input);
+  if (!bundle.ok) return bundle;
+  const expiresAt = parseControlGrantExpiry(input, now);
+  if (!expiresAt.ok) return expiresAt;
+  const grantId = optionalNonEmptyString(input.grantId);
+  const token = optionalNonEmptyString(input.token);
+  const oneTimeUse = typeof input.oneTimeUse === "boolean" ? input.oneTimeUse : void 0;
+  return {
+    ok: true,
+    bundle: bundle.bundle,
+    createGrantInput: {
+      ...grantId ? { grantId } : {},
+      ...token ? { token } : {},
+      expiresAt: expiresAt.expiresAt,
+      manifest,
+      ...oneTimeUse === void 0 ? {} : { oneTimeUse }
     }
+  };
+}
+function decodeControlBundle(input) {
+  if (typeof input.bundleBase64 === "string") {
+    const normalized = input.bundleBase64.trim();
+    if (!normalized) return { ok: false, code: "migration_control_bundle_required" };
+    const bundle = Buffer.from(normalized, "base64");
+    if (bundle.byteLength === 0) return { ok: false, code: "migration_control_bundle_required" };
+    return { ok: true, bundle };
   }
-  return null;
+  if (typeof input.bundleText === "string") {
+    const bundle = Buffer.from(input.bundleText, "utf8");
+    if (bundle.byteLength === 0) return { ok: false, code: "migration_control_bundle_required" };
+    return { ok: true, bundle };
+  }
+  return { ok: false, code: "migration_control_bundle_required" };
 }
-function assertLegacyDaemonKeyNotAdoptedByComputer(options) {
-  const legacyApiKeyFingerprint = daemonApiKeyFingerprint(options.apiKey);
-  const match = findAdoptedComputerForLegacyFingerprint(options.slockHome, legacyApiKeyFingerprint);
-  if (match) throw new LegacyDaemonKeyAdoptedByComputerError(match);
+function parseControlGrantExpiry(input, now) {
+  if (typeof input.expiresAt === "string" && input.expiresAt.trim()) {
+    const expiresAt = new Date(input.expiresAt);
+    if (Number.isNaN(expiresAt.getTime())) {
+      return { ok: false, code: "migration_control_invalid_expiry" };
+    }
+    return { ok: true, expiresAt };
+  }
+  if (input.expiresInSeconds !== void 0) {
+    const expiresInSeconds = input.expiresInSeconds;
+    if (typeof expiresInSeconds !== "number" || !Number.isSafeInteger(expiresInSeconds) || expiresInSeconds <= 0) {
+      return { ok: false, code: "migration_control_invalid_expiry" };
+    }
+    return { ok: true, expiresAt: new Date(now().getTime() + expiresInSeconds * 1e3) };
+  }
+  return { ok: true, expiresAt: new Date(now().getTime() + 15 * 60 * 1e3) };
+}
+function optionalNonEmptyString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function normalizeBundleSizeBytes(size) {
+  if (size === null || size === void 0) return null;
+  if (!Number.isSafeInteger(size) || size < 0) return null;
+  return size;
+}
+function parseOptionalPort(raw) {
+  const value = raw?.trim();
+  if (!value) return void 0;
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error(`${AGENT_MIGRATION_TRANSPORT_PORT_ENV} must be an integer from 0 to 65535`);
+  }
+  return port;
+}
+function formatListenAddress(address) {
+  if (address.includes(":") && !address.startsWith("[")) return `[${address}]`;
+  return address;
+}
+function extractBearerToken(req) {
+  const directHeader = singleHeader(req.headers["x-raft-migration-token"]);
+  if (directHeader) return directHeader;
+  const authorization = singleHeader(req.headers.authorization);
+  if (!authorization) return null;
+  const match = /^Bearer\s+(.+)$/i.exec(authorization);
+  return match?.[1] ?? null;
+}
+function singleHeader(value) {
+  if (!value) return null;
+  return Array.isArray(value) ? value[0] ?? null : value;
+}
+function sendJson(res, status, body, headers = {}) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(payload).toString(),
+    ...headers
+  });
+  res.end(payload);
+}
+function readJsonRequestBody(req, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let totalBytes = 0;
+    let rejected = false;
+    req.on("data", (chunk) => {
+      if (rejected) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      totalBytes += buffer.byteLength;
+      if (totalBytes > maxBytes) {
+        rejected = true;
+        reject(new MigrationBundleStreamError("migration_control_payload_too_large"));
+        return;
+      }
+      chunks.push(buffer);
+    });
+    req.on("error", reject);
+    req.on("end", () => {
+      if (rejected) return;
+      try {
+        const text = Buffer.concat(chunks).toString("utf8");
+        resolve(JSON.parse(text));
+      } catch {
+        reject(new MigrationBundleStreamError("migration_control_invalid_json"));
+      }
+    });
+  });
+}
+function hashToken(token) {
+  return sha256Buffer(Buffer.from(token, "utf8"));
+}
+function verifyTokenHash(token, expectedHashHex) {
+  const actual = Buffer.from(hashToken(token), "hex");
+  const expected = Buffer.from(expectedHashHex, "hex");
+  if (actual.byteLength !== expected.byteLength) return false;
+  return timingSafeEqual(actual, expected);
+}
+function sha256Buffer(buffer) {
+  return createHash7("sha256").update(buffer).digest("hex");
+}
+function canonicalJsonBuffer(value) {
+  return Buffer.from(canonicalJson(value), "utf8");
 }
+function canonicalJson(value) {
+  return JSON.stringify(sortJsonValue(value));
+}
+function sortJsonValue(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.keys(value).sort().reduce((result, key) => {
+    result[key] = sortJsonValue(value[key]);
+    return result;
+  }, {});
+}
+function onceDrain(res) {
+  return new Promise((resolve) => res.once("drain", resolve));
+}
+
+// src/agentMigrationObjectStoreBundle.ts
+import { createHash as createHash9 } from "crypto";
+import { lstat as lstat3, mkdir as mkdir3, readFile as readFile4, readlink as readlink2, rm as rm3, symlink, writeFile as writeFile3 } from "fs/promises";
+import path20 from "path";
 
 // src/agentMigrationExport.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat2, readdir as readdir4, readFile as readFile3, readlink } from "fs/promises";
 import path19 from "path";
@@ -22139,7 +23249,7 @@ async function buildCrossTreeRefs(refs) {
   return result;
 }
 async function sha256File(filePath) {
-  const hash = createHash7("sha256");
+  const hash = createHash8("sha256");
   await new Promise((resolve, reject) => {
     const stream = createReadStream(filePath);
     stream.on("data", (chunk) => hash.update(chunk));
@@ -22245,240 +23355,362 @@ function sortByPath(entries) {
   return [...entries].sort((a, b) => a.path.localeCompare(b.path));
 }
 
-// src/agentMigrationHttpTransport.ts
-import { createHash as createHash8, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
-import http2 from "http";
-var MigrationBundleStreamError = class extends Error {
-  constructor(code) {
-    super(code);
-    this.code = code;
-  }
-};
-var AgentMigrationGrantRegistry = class {
-  grants = /* @__PURE__ */ new Map();
-  now;
-  constructor(now = () => /* @__PURE__ */ new Date()) {
-    this.now = now;
-  }
-  createGrant(input) {
-    const token = input.token ?? randomBytes2(32).toString("base64url");
-    const manifestSha256 = sha256Buffer(canonicalJsonBuffer(input.manifest));
-    const grant = {
-      grantId: input.grantId ?? randomBytes2(16).toString("hex"),
-      tokenHash: hashToken(token),
-      expiresAt: input.expiresAt,
-      oneTimeUse: input.oneTimeUse ?? true,
-      state: "issued",
-      manifest: input.manifest,
-      manifestSha256,
-      bundleEtag: `"agent-migration-${manifestSha256}"`
-    };
-    this.grants.set(grant.grantId, grant);
-    return { grant, token };
+// src/agentMigrationObjectStoreBundle.ts
+var AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION = "agent-object-store-bundle/v1";
+var AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE = "application/vnd.slock.agent-migration-bundle";
+async function buildAgentMigrationObjectStoreBundle(input) {
+  const workspacePath = path20.resolve(input.workspacePath);
+  const manifest = await buildAgentMigrationExportManifest({
+    agentId: input.agentId,
+    slockHome: input.slockHome,
+    workspacePath,
+    mode: "forensic"
+  });
+  const files = [];
+  for (const entry of manifest.files) {
+    if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
+      throw new Error("MIGRATION_OBJECT_STORE_UNSUPPORTED_ENTRY");
+    }
+    const sourcePath = path20.resolve(entry.sourcePath);
+    if (entry.kind === "symlink") {
+      files.push({
+        kind: "symlink",
+        workspaceRelativePath: normalizeWorkspaceRelativePath(entry.workspaceRelativePath),
+        linkTarget: entry.linkTarget ?? await readlink2(sourcePath)
+      });
+      continue;
+    }
+    const stat4 = await lstat3(sourcePath);
+    if (!stat4.isFile()) throw new Error("MIGRATION_OBJECT_STORE_FILE_KIND_MISMATCH");
+    files.push({
+      kind: "file",
+      workspaceRelativePath: normalizeWorkspaceRelativePath(entry.workspaceRelativePath),
+      contentBase64: (await readFile4(sourcePath)).toString("base64")
+    });
   }
-  get(grantId) {
-    return this.grants.get(grantId);
+  const payload = {
+    schemaVersion: AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
+    manifest,
+    files
+  };
+  const bundle = Buffer.from(`${JSON.stringify(sortJsonValue2(payload))}
+`, "utf8");
+  if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes <= 0 || bundle.byteLength > input.maxBytes) {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE");
   }
-  authenticate(grantId, token) {
-    const grant = this.grants.get(grantId);
-    if (!grant || !token || !verifyTokenHash(token, grant.tokenHash)) {
-      return { ok: false, status: 401, code: "migration_grant_auth_failed" };
-    }
-    if (grant.state === "revoked" || grant.state === "consumed") {
-      return { ok: false, status: 410, code: "migration_grant_unavailable" };
-    }
-    if (this.now().getTime() >= grant.expiresAt.getTime()) {
-      grant.state = "expired";
-      return { ok: false, status: 410, code: "migration_grant_unavailable" };
+  return {
+    bundle,
+    manifestSha256: sha256Buffer2(Buffer.from(canonicalJson2(manifest), "utf8"))
+  };
+}
+async function stageAgentMigrationObjectStoreBundle(input) {
+  const parsed = parseObjectStoreBundle(input.bundle);
+  const stagingWorkspacePath = path20.join(
+    path20.resolve(input.slockHome),
+    "migrations",
+    sanitizePathSegment(input.sessionId),
+    "workspace"
+  );
+  await rm3(stagingWorkspacePath, { recursive: true, force: true });
+  await mkdir3(stagingWorkspacePath, { recursive: true });
+  for (const file of parsed.files) {
+    const relativePath = normalizeWorkspaceRelativePath(file.workspaceRelativePath);
+    const targetPath = path20.join(stagingWorkspacePath, relativePath);
+    await mkdir3(path20.dirname(targetPath), { recursive: true });
+    if (file.kind === "symlink") {
+      if (!file.linkTarget) throw new Error("MIGRATION_OBJECT_STORE_LINK_TARGET_MISSING");
+      await symlink(file.linkTarget, targetPath);
+      continue;
     }
-    return { ok: true, grant };
-  }
-  revokeAll() {
-    for (const grant of this.grants.values()) {
-      if (grant.state !== "consumed" && grant.state !== "expired") {
-        grant.state = "revoked";
-      }
+    if (file.kind !== "file" || typeof file.contentBase64 !== "string") {
+      throw new Error("MIGRATION_OBJECT_STORE_FILE_CONTENT_MISSING");
     }
+    await writeFile3(targetPath, Buffer.from(file.contentBase64, "base64"), { mode: 384 });
   }
-};
-function createAgentMigrationHttpTransport(options = {}) {
-  const registry = new AgentMigrationGrantRegistry(options.now);
-  const bundleStreamFactory = options.bundleStreamFactory ?? defaultBundleStream;
-  const server = http2.createServer((req, res) => {
-    void handleMigrationRequest(req, res, registry, bundleStreamFactory);
-  });
   return {
-    grants: registry,
-    server,
-    listen: (port = 0, host = "127.0.0.1") => new Promise((resolve, reject) => {
-      server.once("error", reject);
-      server.listen(port, host, () => {
-        server.off("error", reject);
-        const address = server.address();
-        if (!address || typeof address === "string") {
-          reject(new Error("migration transport listen did not produce a TCP address"));
-          return;
-        }
-        resolve({ url: `http://${address.address}:${address.port}` });
-      });
-    }),
-    close: () => new Promise((resolve, reject) => {
-      registry.revokeAll();
-      server.close((err) => {
-        if (err) reject(err);
-        else resolve();
-      });
-    })
+    manifest: parsed.manifest,
+    manifestSha256: sha256Buffer2(Buffer.from(canonicalJson2(parsed.manifest), "utf8")),
+    stagingWorkspacePath
   };
 }
-async function handleMigrationRequest(req, res, registry, bundleStreamFactory) {
-  const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
-  const match = /^\/migration\/([^/]+)\/([^/]+)(?:\/([^/]+))?$/.exec(parsed.pathname);
-  if (!match) {
-    sendJson(res, 404, { code: "migration_route_not_found" });
-    return;
+function parseObjectStoreBundle(buffer) {
+  let parsed;
+  try {
+    parsed = JSON.parse(buffer.toString("utf8"));
+  } catch {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_INVALID_JSON");
   }
-  const [, grantId, resource, resourceId] = match;
-  const auth = registry.authenticate(decodeURIComponent(grantId), extractBearerToken(req));
-  if (!auth.ok) {
-    sendJson(res, auth.status, { code: auth.code });
-    return;
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_INVALID");
   }
-  if (resource === "manifest" && req.method === "GET" && !resourceId) {
-    sendJson(res, 200, {
-      manifestSha256: auth.grant.manifestSha256,
-      manifest: auth.grant.manifest
-    }, {
-      "X-Raft-Manifest-Sha": auth.grant.manifestSha256,
-      ETag: `"manifest-${auth.grant.manifestSha256}"`
+  const bundle = parsed;
+  if (bundle.schemaVersion !== AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION) {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_UNSUPPORTED");
+  }
+  if (!bundle.manifest || typeof bundle.manifest !== "object" || Array.isArray(bundle.manifest)) {
+    throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_MISSING");
+  }
+  if (!Array.isArray(bundle.files)) throw new Error("MIGRATION_OBJECT_STORE_FILES_MISSING");
+  return bundle;
+}
+function normalizeWorkspaceRelativePath(relativePath) {
+  const normalized = path20.posix.normalize(relativePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path20.isAbsolute(normalized)) {
+    throw new Error("MIGRATION_OBJECT_STORE_UNSAFE_PATH");
+  }
+  return normalized;
+}
+function canonicalJson2(value) {
+  return JSON.stringify(sortJsonValue2(value));
+}
+function sortJsonValue2(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue2);
+  if (!value || typeof value !== "object") return value;
+  return Object.keys(value).sort().reduce((result, key) => {
+    result[key] = sortJsonValue2(value[key]);
+    return result;
+  }, {});
+}
+function sha256Buffer2(buffer) {
+  return createHash9("sha256").update(buffer).digest("hex");
+}
+function sanitizePathSegment(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128) || "migration";
+}
+
+// src/agentMigrationImport.ts
+import { createHash as createHash10 } from "crypto";
+import { createReadStream as createReadStream2 } from "fs";
+import { access as access2, cp, lstat as lstat4, mkdir as mkdir4, readlink as readlink3, rename, writeFile as writeFile4 } from "fs/promises";
+import path21 from "path";
+async function buildAgentMigrationAdoptPlan(input) {
+  const slockHome = path21.resolve(input.slockHome);
+  let manifest;
+  if (input.sourceKind === "orphan_directory" && !input.manifest) {
+    manifest = await buildAgentMigrationExportManifest({
+      agentId: input.agentId,
+      slockHome,
+      workspacePath: path21.resolve(input.orphanWorkspacePath),
+      mode: "forensic",
+      now: input.now
     });
-    return;
+  } else if (input.manifest) {
+    manifest = input.manifest;
+  } else {
+    throw new Error("MIGRATION_MANIFEST_MISSING");
   }
-  if (resource === "bundle.tar" && !resourceId) {
-    if (req.method === "HEAD") {
-      sendHead(res, auth.grant);
-      return;
-    }
-    if (req.method === "GET") {
-      await streamBundle(res, auth.grant, bundleStreamFactory);
-      return;
-    }
+  assertManifestIdentity({
+    manifest,
+    expectedAgentId: input.sourceKind === "orphan_directory" ? input.agentId : manifest.agentId
+  });
+  const sourceWorkspacePath = path21.resolve(
+    input.sourceKind === "staged_bundle" ? input.stagingWorkspacePath : input.orphanWorkspacePath
+  );
+  const finalWorkspacePath = path21.resolve(input.finalWorkspacePath ?? path21.join(slockHome, "agents", manifest.agentId));
+  const reportPath = path21.resolve(input.reportPath ?? path21.join(
+    slockHome,
+    "migrations",
+    sanitizePathSegment2(input.generation.grantKey),
+    "arrival-report.json"
+  ));
+  const manifestSha256 = hashAgentMigrationManifest(manifest);
+  if (input.manifestSha256 && input.manifestSha256 !== manifestSha256) {
+    throw new Error("MIGRATION_MANIFEST_SHA_MISMATCH");
+  }
+  return {
+    sourceKind: input.sourceKind,
+    agentId: manifest.agentId,
+    slockHome,
+    sourceWorkspacePath,
+    finalWorkspacePath,
+    reportPath,
+    manifest,
+    manifestSha256,
+    generation: input.generation,
+    attestationNonce: input.attestationNonce,
+    observedAttestationNonce: input.observedAttestationNonce
+  };
+}
+async function verifyAgentMigrationAdoptPlan(plan) {
+  assertGeneration(plan.generation);
+  assertManifestIdentity({ manifest: plan.manifest, expectedAgentId: plan.agentId });
+  const actualManifestSha256 = hashAgentMigrationManifest(plan.manifest);
+  if (actualManifestSha256 !== plan.manifestSha256) {
+    throw new Error("MIGRATION_MANIFEST_SHA_MISMATCH");
+  }
+  let totalBytes = 0;
+  let fileCount = 0;
+  for (const entry of plan.manifest.files) {
+    await verifyManifestFileEntry(plan.sourceWorkspacePath, entry);
+    if (entry.kind === "file") {
+      fileCount += 1;
+      totalBytes += entry.sizeBytes ?? 0;
+    }
+  }
+  return { fileCount, totalBytes };
+}
+async function executeAgentMigrationAdoptPlan(plan, rebind, now = currentDate()) {
+  assertGeneration(plan.generation);
+  await assertFinalWorkspaceAvailable(plan.sourceWorkspacePath, plan.finalWorkspacePath);
+  const verified = await verifyAgentMigrationAdoptPlan(plan);
+  let migrationGeneration = plan.generation.migrationGeneration;
+  migrationGeneration = await assertRebindResult(plan, migrationGeneration, await rebind.startTransfer({
+    grantKey: plan.generation.grantKey,
+    migrationGeneration
+  }));
+  await placeWorkspace(plan.sourceWorkspacePath, plan.finalWorkspacePath);
+  migrationGeneration = await assertRebindResult(plan, migrationGeneration, await rebind.flipMachine({
+    grantKey: plan.generation.grantKey,
+    migrationGeneration
+  }));
+  const report = {
+    schemaVersion: "agent-arrival/v1",
+    agentId: plan.agentId,
+    sourceKind: plan.sourceKind,
+    grantKey: plan.generation.grantKey,
+    migrationGeneration,
+    sourceMachineId: plan.generation.sourceMachineId,
+    targetMachineId: plan.generation.targetMachineId,
+    manifestSha256: plan.manifestSha256,
+    finalWorkspacePath: plan.finalWorkspacePath,
+    verified,
+    attestation: {
+      noncePresent: Boolean(plan.attestationNonce),
+      nonceVerified: Boolean(plan.attestationNonce && plan.observedAttestationNonce === plan.attestationNonce)
+    },
+    arrivedAt: now.toISOString()
+  };
+  const reportSha256 = await writeArrivalReport(plan.reportPath, report);
+  await assertRebindResult(plan, migrationGeneration, await rebind.markArrived({
+    grantKey: plan.generation.grantKey,
+    migrationGeneration,
+    reportPath: plan.reportPath,
+    reportSha256
+  }));
+  return { report, reportPath: plan.reportPath, reportSha256 };
+}
+function hashAgentMigrationManifest(manifest) {
+  return sha256Buffer3(Buffer.from(canonicalJson3(manifest), "utf8"));
+}
+function assertManifestIdentity(input) {
+  if (input.manifest.schemaVersion !== AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION) {
+    throw new Error("MIGRATION_MANIFEST_SCHEMA_UNSUPPORTED");
   }
-  if (resource === "chunk" && req.method === "GET" && resourceId) {
-    sendJson(res, 501, { code: "migration_chunk_not_implemented" });
-    return;
+  if (input.manifest.agentId !== input.expectedAgentId) {
+    throw new Error("MIGRATION_MANIFEST_AGENT_MISMATCH");
   }
-  sendJson(res, 405, { code: "migration_method_not_allowed" });
 }
-function sendHead(res, grant) {
-  res.statusCode = 200;
-  res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
-  res.setHeader("ETag", grant.bundleEtag);
-  res.setHeader("Accept-Ranges", "none");
-  res.setHeader("X-Raft-Bundle-Size", "unknown");
-  res.end();
+function assertGeneration(generation) {
+  if (generation.localMachineId !== generation.targetMachineId) {
+    throw new Error("MIGRATION_TARGET_MACHINE_MISMATCH");
+  }
+  if (generation.sourceMachineId === generation.targetMachineId) {
+    throw new Error("MIGRATION_SOURCE_TARGET_MACHINE_MATCH");
+  }
+  if (!generation.grantKey || !generation.migrationGeneration) {
+    throw new Error("MIGRATION_GENERATION_MISSING");
+  }
 }
-async function streamBundle(res, grant, bundleStreamFactory) {
-  if (grant.state === "streaming") {
-    sendJson(res, 409, { code: "migration_bundle_stream_in_progress" });
-    return;
+async function assertRebindResult(plan, expectedGeneration, result) {
+  if (!result) return expectedGeneration;
+  if (result.grantKey && result.grantKey !== plan.generation.grantKey) {
+    throw new Error("MIGRATION_REBIND_GRANT_MISMATCH");
   }
-  if (grant.oneTimeUse && grant.state !== "issued" && grant.state !== "interrupted") {
-    sendJson(res, 410, { code: "migration_grant_unavailable" });
-    return;
+  if (result.migrationGeneration !== void 0 && result.migrationGeneration.length === 0) {
+    throw new Error("MIGRATION_REBIND_GENERATION_MISMATCH");
   }
-  let stream;
-  try {
-    stream = bundleStreamFactory(grant);
-  } catch (err) {
-    const code = err instanceof MigrationBundleStreamError ? err.code : "migration_bundle_stream_failed";
-    sendJson(res, 500, { code });
-    return;
+  if (result.sourceMachineId && result.sourceMachineId !== plan.generation.sourceMachineId) {
+    throw new Error("MIGRATION_REBIND_SOURCE_MACHINE_MISMATCH");
   }
-  grant.state = "streaming";
-  let completed = false;
-  res.on("close", () => {
-    if (!completed && grant.state === "streaming") {
-      grant.state = "interrupted";
-    }
-  });
-  try {
-    res.statusCode = 200;
-    res.setHeader("Content-Type", "application/x-tar");
-    res.setHeader("X-Raft-Manifest-Sha", grant.manifestSha256);
-    res.setHeader("ETag", grant.bundleEtag);
-    for await (const chunk of stream) {
-      if (!res.write(chunk)) {
-        await onceDrain(res);
-      }
-    }
-    completed = true;
-    grant.state = "consumed";
-    res.end();
-  } catch {
-    if (!completed && grant.state === "streaming") {
-      grant.state = "interrupted";
-    }
-    if (!res.headersSent) {
-      sendJson(res, 500, { code: "migration_bundle_stream_failed" });
-    } else {
-      res.destroy();
-    }
+  if (result.targetMachineId && result.targetMachineId !== plan.generation.targetMachineId) {
+    throw new Error("MIGRATION_REBIND_TARGET_MACHINE_MISMATCH");
   }
+  return result.migrationGeneration ?? expectedGeneration;
 }
-function defaultBundleStream(grant) {
-  void grant;
-  throw new MigrationBundleStreamError("migration_bundle_stream_not_wired");
-}
-function extractBearerToken(req) {
-  const directHeader = singleHeader(req.headers["x-raft-migration-token"]);
-  if (directHeader) return directHeader;
-  const authorization = singleHeader(req.headers.authorization);
-  if (!authorization) return null;
-  const match = /^Bearer\s+(.+)$/i.exec(authorization);
-  return match?.[1] ?? null;
+async function verifyManifestFileEntry(sourceWorkspacePath, entry) {
+  if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
+    throw new Error("MIGRATION_MANIFEST_ENTRY_NOT_WORKSPACE");
+  }
+  const relative = normalizeWorkspaceRelativePath2(entry.workspaceRelativePath);
+  const entryPath = path21.join(sourceWorkspacePath, relative);
+  const info = await lstat4(entryPath).catch(() => null);
+  if (!info) throw new Error("MIGRATION_MANIFEST_FILE_MISSING");
+  if (entry.kind === "symlink") {
+    if (!info.isSymbolicLink()) throw new Error("MIGRATION_MANIFEST_KIND_MISMATCH");
+    const linkTarget = await readlink3(entryPath);
+    if (entry.linkTarget !== linkTarget) throw new Error("MIGRATION_MANIFEST_LINK_MISMATCH");
+    return;
+  }
+  if (!info.isFile()) throw new Error("MIGRATION_MANIFEST_KIND_MISMATCH");
+  if (entry.sizeBytes !== void 0 && entry.sizeBytes !== info.size) {
+    throw new Error("MIGRATION_MANIFEST_FILE_SIZE_MISMATCH");
+  }
+  if (entry.sha256) {
+    const actual = await sha256File2(entryPath);
+    if (actual !== entry.sha256) throw new Error("MIGRATION_MANIFEST_FILE_SHA_MISMATCH");
+  }
 }
-function singleHeader(value) {
-  if (!value) return null;
-  return Array.isArray(value) ? value[0] ?? null : value;
+function normalizeWorkspaceRelativePath2(relativePath) {
+  const normalized = path21.posix.normalize(relativePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path21.isAbsolute(normalized)) {
+    throw new Error("MIGRATION_MANIFEST_UNSAFE_PATH");
+  }
+  return normalized;
 }
-function sendJson(res, status, body, headers = {}) {
-  const payload = JSON.stringify(body);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Content-Length": Buffer.byteLength(payload).toString(),
-    ...headers
-  });
-  res.end(payload);
+async function assertFinalWorkspaceAvailable(sourceWorkspacePath, finalWorkspacePath) {
+  if (path21.resolve(sourceWorkspacePath) === path21.resolve(finalWorkspacePath)) return;
+  try {
+    await access2(finalWorkspacePath);
+    throw new Error("MIGRATION_WORKSPACE_ALREADY_EXISTS");
+  } catch (err) {
+    if (err instanceof Error && err.message === "MIGRATION_WORKSPACE_ALREADY_EXISTS") throw err;
+  }
 }
-function hashToken(token) {
-  return sha256Buffer(Buffer.from(token, "utf8"));
+async function placeWorkspace(sourceWorkspacePath, finalWorkspacePath) {
+  if (path21.resolve(sourceWorkspacePath) === path21.resolve(finalWorkspacePath)) return;
+  const stagingPath = `${finalWorkspacePath}.migration-${process.pid}-${Date.now()}`;
+  await mkdir4(path21.dirname(finalWorkspacePath), { recursive: true });
+  await cp(sourceWorkspacePath, stagingPath, { recursive: true, dereference: false, errorOnExist: true, force: false });
+  await rename(stagingPath, finalWorkspacePath);
 }
-function verifyTokenHash(token, expectedHashHex) {
-  const actual = Buffer.from(hashToken(token), "hex");
-  const expected = Buffer.from(expectedHashHex, "hex");
-  if (actual.byteLength !== expected.byteLength) return false;
-  return timingSafeEqual(actual, expected);
+async function writeArrivalReport(reportPath, report) {
+  const payload = `${canonicalJson3(report)}
+`;
+  await mkdir4(path21.dirname(reportPath), { recursive: true });
+  await writeFile4(reportPath, payload, { mode: 384 });
+  return sha256Buffer3(Buffer.from(payload, "utf8"));
 }
-function sha256Buffer(buffer) {
-  return createHash8("sha256").update(buffer).digest("hex");
+async function sha256File2(filePath) {
+  const hash = createHash10("sha256");
+  const stream = createReadStream2(filePath);
+  for await (const chunk of stream) {
+    hash.update(chunk);
+  }
+  return hash.digest("hex");
 }
-function canonicalJsonBuffer(value) {
-  return Buffer.from(canonicalJson(value), "utf8");
+function sha256Buffer3(buffer) {
+  return createHash10("sha256").update(buffer).digest("hex");
 }
-function canonicalJson(value) {
-  return JSON.stringify(sortJsonValue(value));
+function canonicalJson3(value) {
+  return JSON.stringify(sortJsonValue3(value));
 }
-function sortJsonValue(value) {
-  if (Array.isArray(value)) return value.map(sortJsonValue);
+function sortJsonValue3(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue3);
   if (!value || typeof value !== "object") return value;
   return Object.keys(value).sort().reduce((result, key) => {
-    result[key] = sortJsonValue(value[key]);
+    result[key] = sortJsonValue3(value[key]);
     return result;
   }, {});
 }
-function onceDrain(res) {
-  return new Promise((resolve) => res.once("drain", resolve));
+function sanitizePathSegment2(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128) || "migration";
+}
+
+// src/secretFile.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import path22 from "path";
+function readSecretFileSync(filePath) {
+  return readFileSync10(filePath, "utf8").trim();
 }
 
 // src/core.ts
@@ -22486,6 +23718,8 @@ var DEFAULT_TRACE_UPLOAD_URL = "https://slock-trace-upload.botiverse.dev";
 var RUNNER_CREDENTIAL_SCOPES = ["send", "read", "mentions", "tasks", "reactions", "server", "channels", "knowledge"];
 var RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2 = 3;
 var RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2 = 250;
+var MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_INITIAL_MS = 25;
+var MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_MAX_MS = 250;
 var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
   "daemon.lifecycle.start": {
     spanAttrs: ["machine_dir_present", "local_trace_enabled"],
@@ -22607,7 +23841,7 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     spanAttrs: ["agentId", "event_kind", "runtime"]
   }
 };
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key-file <path>";
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -22640,20 +23874,50 @@ function runnerCredentialErrorDetail2(error) {
     retryable: true
   };
 }
+async function waitForAmbientBackoff(delayMs) {
+  await new Promise((resolve) => setTimeout(resolve, delayMs));
+}
 async function waitForRunnerCredentialRetry2() {
-  await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
+  await waitForAmbientBackoff(RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2);
+}
+function isRetryableMigrationObjectStoreDownloadStatus(status) {
+  return status === 404 || status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;
+}
+function migrationTransferFailureMessage(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return message.slice(0, 500);
+}
+async function migrationStepErrorSuffix(response) {
+  try {
+    const body = await response.clone().json();
+    if (typeof body.code === "string" && body.code.length > 0) return body.code.slice(0, 120);
+    if (typeof body.error === "string" && body.error.length > 0) return body.error.slice(0, 120);
+  } catch {
+  }
+  return response.statusText || "unknown";
 }
 function parseDaemonCliArgs(args) {
   let serverUrl = "";
   let apiKey = "";
+  let apiKeyFile = process.env.SLOCK_DAEMON_API_KEY_FILE ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
+    if (args[i] === "--api-key-file" && args[i + 1]) apiKeyFile = args[++i];
+  }
+  if (!apiKey && apiKeyFile) {
+    try {
+      apiKey = readSecretFileSync(apiKeyFile);
+    } catch {
+      apiKey = "";
+    }
   }
   if (!serverUrl || !apiKey) return null;
   return { serverUrl, apiKey };
 }
 function readDaemonVersion(moduleUrl = import.meta.url) {
+  const baked = process.env.RAFT_DAEMON_VERSION;
+  if (typeof baked === "string" && baked.length > 0) return baked;
   try {
     const require2 = createRequire3(moduleUrl);
     return require2("../package.json").version;
@@ -22662,13 +23926,13 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path20.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path20.resolve(thisDir, "cli", "index.js");
+  const thisDir = path23.dirname(fileURLToPath(moduleUrl));
+  const bundledDistPath = path23.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path20.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path23.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -22682,7 +23946,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-YOKZZD4F.js");
+  await import("./dist-CRXPFW5L.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -22774,6 +24038,11 @@ function readPositiveIntegerEnv3(name, fallback) {
   if (!Number.isFinite(parsed) || parsed < 1) return fallback;
   return Math.floor(parsed);
 }
+function hasAgentMigrationHttpTransportListenConfig(env = process.env) {
+  return Boolean(
+    env[AGENT_MIGRATION_TRANSPORT_HOST_ENV]?.trim() || env[AGENT_MIGRATION_TRANSPORT_PORT_ENV]?.trim() || env[AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV]?.trim()
+  );
+}
 function formatChannelTarget(msg) {
   return msg.message.channel_type === "dm" ? `dm:@${msg.message.channel_name}` : `#${msg.message.channel_name}`;
 }
@@ -22809,6 +24078,8 @@ function summarizeIncomingMessage(msg) {
       return `(directory=${msg.directoryName})`;
     case "machine:runtime_models:detect":
       return `(runtime=${msg.runtime}, req=${msg.requestId})`;
+    case "machine:migration_transport:lease":
+      return `(agent=${msg.agentId}, migration=${msg.migrationId}, session=${msg.sessionId}, provider=${msg.provider}, role=${msg.role}, kind=${msg.transferKind}, url=${msg.url ? "set" : "missing"})`;
     case "reminder.upsert":
       return `(agent=${msg.agentId}, id=${msg.reminder.reminderId}, v${msg.reminder.version}, fireAt=${msg.reminder.fireAt})`;
     case "reminder.cancel":
@@ -22838,6 +24109,12 @@ var DaemonCore = class {
   agentManager;
   connection;
   reminderCache;
+  migrationTransport;
+  migrationTransportListenPromise = null;
+  migrationTransportListening = false;
+  migrationTransportUrl = null;
+  migrationTransferLease = null;
+  migrationTransferRuns = /* @__PURE__ */ new Set();
   tracer;
   injectedTracer;
   machineLock = null;
@@ -22861,6 +24138,7 @@ var DaemonCore = class {
       clock: options.reminderClock,
       onFire: (job) => this.onReminderFire(job)
     });
+    this.migrationTransport = options.migrationTransport === void 0 ? hasAgentMigrationHttpTransportListenConfig() ? createAgentMigrationHttpTransport() : null : options.migrationTransport;
     let connection;
     this.agentsDataDir = options.dataDir ?? resolveSlockHomePath("agents", this.slockHome);
     const traceUploadDisabled = process.env.SLOCK_DAEMON_TRACE_UPLOAD_DISABLED === "1";
@@ -22891,7 +24169,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path20.join(path20.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path23.join(path23.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -22919,7 +24197,7 @@ var DaemonCore = class {
       sinks: [this.localTraceSink]
     }));
     this.agentManager.setTracer(this.tracer);
-    this.agentManager.setCliTransportTraceDir(path20.join(machineDir, "traces"));
+    this.agentManager.setCliTransportTraceDir(path23.join(machineDir, "traces"));
   }
   installTraceBundleUploader(machineDir) {
     if (!this.shouldEnableLocalTrace()) return;
@@ -22969,9 +24247,13 @@ var DaemonCore = class {
       span.addEvent("daemon.machine_lock.acquired", { machine_dir_present: true });
       span.end("ok");
     }
+    if (this.migrationTransport) {
+      this.startMigrationTransport();
+    }
     try {
       this.connection.connect();
     } catch (err) {
+      void this.stopMigrationTransport();
       this.traceBundleUploader?.stop();
       this.traceBundleUploader = null;
       this.machineLock.release();
@@ -23010,6 +24292,7 @@ var DaemonCore = class {
           shutdown_reason: shutdownReason
         });
       }
+      await this.stopMigrationTransport();
       this.connection.disconnect();
       span.addEvent("daemon.connection.disconnect_requested");
       this.machineLock?.release();
@@ -23035,6 +24318,432 @@ var DaemonCore = class {
     });
     span.end(status);
   }
+  getMigrationTransportReady() {
+    const transferLease = this.getActiveMigrationTransferLease();
+    if (transferLease) {
+      return {
+        provisioned: true,
+        endpoint: transferLease.url,
+        leaseSource: "server",
+        provider: transferLease.provider,
+        role: transferLease.role,
+        transferKind: transferLease.transferKind,
+        url: transferLease.url,
+        expiresAt: transferLease.expiresAt,
+        maxBytes: transferLease.maxBytes,
+        observedAt: currentDate().toISOString()
+      };
+    }
+    const endpoint = this.migrationTransportListening ? this.migrationTransportUrl : null;
+    return {
+      provisioned: Boolean(endpoint),
+      endpoint,
+      leaseSource: endpoint ? "env" : null,
+      observedAt: currentDate().toISOString()
+    };
+  }
+  startMigrationTransport() {
+    if (!this.migrationTransport || this.migrationTransportListenPromise) return;
+    this.migrationTransportListenPromise = this.migrationTransport.listen().then(({ url }) => {
+      this.migrationTransportListening = true;
+      this.migrationTransportUrl = url;
+      logger.info(`[Slock Daemon] Agent migration HTTP transport listening: ${url}`);
+      this.recordDaemonTrace("daemon.migration_transport.listen", {
+        outcome: "listening",
+        url_present: Boolean(url)
+      });
+    }).catch((err) => {
+      this.migrationTransportListening = false;
+      this.migrationTransportUrl = null;
+      logger.error("[Slock Daemon] Agent migration HTTP transport failed to listen", err);
+      this.recordDaemonTrace("daemon.migration_transport.listen", {
+        outcome: "failed",
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+    });
+  }
+  async stopMigrationTransport() {
+    if (!this.migrationTransport) return;
+    const listenPromise = this.migrationTransportListenPromise;
+    this.migrationTransportListenPromise = null;
+    if (listenPromise) await listenPromise;
+    if (!this.migrationTransportListening) return;
+    try {
+      await this.migrationTransport.close();
+      this.migrationTransportUrl = null;
+      logger.info("[Slock Daemon] Agent migration HTTP transport stopped");
+      this.recordDaemonTrace("daemon.migration_transport.stop", { outcome: "stopped" });
+    } catch (err) {
+      logger.error("[Slock Daemon] Agent migration HTTP transport failed to stop", err);
+      this.recordDaemonTrace("daemon.migration_transport.stop", {
+        outcome: "failed",
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+    } finally {
+      this.migrationTransportListening = false;
+      this.migrationTransportUrl = null;
+    }
+  }
+  getActiveMigrationTransferLease() {
+    const lease = this.migrationTransferLease;
+    if (!lease) return null;
+    const expiresAtMs = Date.parse(lease.expiresAt);
+    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= currentTimeMs()) return null;
+    return lease;
+  }
+  validateMigrationTransferLease(lease) {
+    if (!lease.agentId.trim()) throw new Error("migration transfer lease agent id is required");
+    if (!lease.migrationId.trim()) throw new Error("migration transfer lease migration id is required");
+    if (!lease.migrationGeneration.trim()) throw new Error("migration transfer lease migrationGeneration is required");
+    if (!lease.sessionId.trim()) throw new Error("migration transfer lease session id is required");
+    if (lease.provider !== "object_store") throw new Error(`unsupported migration transfer provider: ${lease.provider}`);
+    if (lease.leaseSource !== "server") throw new Error(`unsupported migration transfer lease source: ${lease.leaseSource}`);
+    if (lease.role !== "source" && lease.role !== "target") throw new Error(`unsupported migration transfer role: ${lease.role}`);
+    if (lease.transferKind !== "upload" && lease.transferKind !== "download") {
+      throw new Error(`unsupported migration transfer kind: ${lease.transferKind}`);
+    }
+    if (!lease.url.trim()) throw new Error("migration transfer lease url is required");
+    if (!lease.bearerToken.trim()) throw new Error("migration transfer lease bearer token is required");
+    const expiresAtMs = Date.parse(lease.expiresAt);
+    if (!lease.expiresAt.trim() || !Number.isFinite(expiresAtMs) || expiresAtMs <= currentTimeMs()) {
+      throw new Error("migration transfer lease expiresAt must be a future timestamp");
+    }
+    if (!Number.isInteger(lease.maxBytes) || lease.maxBytes <= 0) {
+      throw new Error("migration transfer lease maxBytes must be a positive integer");
+    }
+  }
+  handleMigrationTransportLease(lease) {
+    try {
+      this.applyMigrationTransferLease(lease);
+    } catch (err) {
+      logger.error("[Slock Daemon] Failed to apply migration transport lease", err);
+      this.recordDaemonTrace("daemon.migration_transport.lease", {
+        outcome: "failed",
+        lease_present: true,
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+    }
+  }
+  applyMigrationTransferLease(lease) {
+    this.validateMigrationTransferLease(lease);
+    if (this.migrationTransferLease?.agentId === lease.agentId && this.migrationTransferLease?.migrationId === lease.migrationId && this.migrationTransferLease?.migrationGeneration === lease.migrationGeneration && this.migrationTransferLease?.sessionId === lease.sessionId && this.migrationTransferLease?.role === lease.role) {
+      this.migrationTransferLease = lease;
+      this.emitReadyIfConnected();
+      this.recordDaemonTrace("daemon.migration_transport.lease", {
+        outcome: "unchanged",
+        agent_id_present: true,
+        migration_id_present: true,
+        session_id_present: true,
+        migration_generation: lease.migrationGeneration,
+        provider: lease.provider,
+        role: lease.role,
+        transfer_kind: lease.transferKind
+      });
+      this.startMigrationTransferRun(lease);
+      return;
+    }
+    this.migrationTransferLease = lease;
+    this.emitReadyIfConnected();
+    this.recordDaemonTrace("daemon.migration_transport.lease", {
+      outcome: "applied",
+      agent_id_present: true,
+      migration_id_present: true,
+      session_id_present: true,
+      migration_generation: lease.migrationGeneration,
+      provider: lease.provider,
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      url_present: Boolean(lease.url),
+      bearer_token_present: Boolean(lease.bearerToken)
+    });
+    this.startMigrationTransferRun(lease);
+  }
+  startMigrationTransferRun(lease) {
+    const key = [
+      lease.agentId,
+      lease.migrationId,
+      lease.migrationGeneration,
+      lease.sessionId,
+      lease.role
+    ].join(":");
+    if (this.migrationTransferRuns.has(key)) return;
+    this.migrationTransferRuns.add(key);
+    void this.runMigrationTransferLease(lease).catch(async (err) => {
+      logger.error("[Slock Daemon] Migration object-store transfer failed", err);
+      this.recordDaemonTrace("daemon.migration_transport.object_store", {
+        outcome: "failed",
+        role: lease.role,
+        transfer_kind: lease.transferKind,
+        agent_id_present: Boolean(lease.agentId),
+        migration_id_present: Boolean(lease.migrationId),
+        session_id_present: Boolean(lease.sessionId),
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+      try {
+        await this.reportMigrationTransportLost(lease, err);
+      } catch (reportErr) {
+        logger.error("[Slock Daemon] Failed to report migration transport loss", reportErr);
+        this.recordDaemonTrace("daemon.migration_transport.object_store", {
+          outcome: "transport_lost_report_failed",
+          role: lease.role,
+          transfer_kind: lease.transferKind,
+          migration_id_present: Boolean(lease.migrationId),
+          error_class: reportErr instanceof Error ? reportErr.name : typeof reportErr
+        }, "error");
+      }
+    }).finally(() => {
+      this.migrationTransferRuns.delete(key);
+    });
+  }
+  async runMigrationTransferLease(lease) {
+    if (lease.provider !== "object_store") return;
+    if (lease.role === "source") {
+      await this.uploadMigrationObjectStoreBundle(lease);
+      return;
+    }
+    await this.downloadAndImportMigrationObjectStoreBundle(lease);
+  }
+  migrationObjectStoreHeaders(lease) {
+    return {
+      "X-Raft-Migration-Token": lease.bearerToken
+    };
+  }
+  async uploadMigrationObjectStoreBundle(lease) {
+    if (lease.transferKind !== "upload") {
+      throw new Error("MIGRATION_OBJECT_STORE_SOURCE_KIND_MISMATCH");
+    }
+    const built = await buildAgentMigrationObjectStoreBundle({
+      agentId: lease.agentId,
+      slockHome: this.slockHome,
+      workspacePath: path23.join(this.agentsDataDir, lease.agentId),
+      maxBytes: lease.maxBytes
+    });
+    const response = await daemonFetch(lease.url, {
+      method: "PUT",
+      headers: {
+        ...this.migrationObjectStoreHeaders(lease),
+        "Content-Type": AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE
+      },
+      body: new Uint8Array(built.bundle)
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_OBJECT_STORE_UPLOAD_FAILED:${response.status}`);
+    }
+    await this.reportMigrationSourceReady(lease, built.manifestSha256);
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "uploaded",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      bundle_bytes: built.bundle.byteLength,
+      max_bytes: lease.maxBytes
+    });
+  }
+  async downloadAndImportMigrationObjectStoreBundle(lease) {
+    if (lease.transferKind !== "download") {
+      throw new Error("MIGRATION_OBJECT_STORE_TARGET_KIND_MISMATCH");
+    }
+    const bundle = await this.downloadMigrationObjectStoreBundleWithRetry(lease);
+    if (bundle.byteLength > lease.maxBytes) {
+      throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE");
+    }
+    const staged = await stageAgentMigrationObjectStoreBundle({
+      bundle,
+      slockHome: this.slockHome,
+      sessionId: lease.sessionId
+    });
+    const targetImport = await this.fetchMigrationTargetImportView(lease.migrationId);
+    if (targetImport.agentId !== lease.agentId) {
+      throw new Error("MIGRATION_TARGET_IMPORT_AGENT_MISMATCH");
+    }
+    if (targetImport.manifestSha256 && targetImport.manifestSha256 !== staged.manifestSha256) {
+      throw new Error("MIGRATION_TARGET_IMPORT_MANIFEST_SHA_MISMATCH");
+    }
+    const plan = await buildAgentMigrationAdoptPlan({
+      sourceKind: "staged_bundle",
+      slockHome: this.slockHome,
+      stagingWorkspacePath: staged.stagingWorkspacePath,
+      finalWorkspacePath: path23.join(this.agentsDataDir, lease.agentId),
+      manifest: staged.manifest,
+      manifestSha256: staged.manifestSha256,
+      generation: {
+        grantKey: targetImport.grantKey,
+        migrationGeneration: targetImport.migrationGeneration,
+        sourceMachineId: targetImport.sourceMachineId,
+        targetMachineId: targetImport.targetMachineId,
+        localMachineId: targetImport.targetMachineId
+      }
+    });
+    await executeAgentMigrationAdoptPlan(plan, this.migrationRebindClient(targetImport.grantKey));
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "imported",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      bundle_bytes: bundle.byteLength,
+      manifest_sha_present: true
+    });
+  }
+  async downloadMigrationObjectStoreBundleWithRetry(lease) {
+    const expiresAtMs = Date.parse(lease.expiresAt);
+    let attempt = 0;
+    let delayMs = MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_INITIAL_MS;
+    let lastStatus = null;
+    let lastErrorClass = null;
+    while (currentTimeMs() < expiresAtMs) {
+      attempt += 1;
+      try {
+        const response = await daemonFetch(lease.url, {
+          method: "GET",
+          headers: this.migrationObjectStoreHeaders(lease)
+        });
+        if (response.ok) {
+          return Buffer.from(await response.arrayBuffer());
+        }
+        lastStatus = response.status;
+        lastErrorClass = null;
+        if (!isRetryableMigrationObjectStoreDownloadStatus(response.status)) {
+          throw new Error(`MIGRATION_OBJECT_STORE_DOWNLOAD_FAILED:${response.status}`);
+        }
+      } catch (err) {
+        if (err instanceof Error && err.message.startsWith("MIGRATION_OBJECT_STORE_DOWNLOAD_FAILED:")) {
+          throw err;
+        }
+        lastErrorClass = err instanceof Error ? err.name : typeof err;
+      }
+      const remainingMs = expiresAtMs - currentTimeMs();
+      if (remainingMs <= 0) break;
+      const sleepMs = Math.min(delayMs, remainingMs);
+      this.recordDaemonTrace("daemon.migration_transport.object_store", {
+        outcome: "download_retry",
+        role: lease.role,
+        transfer_kind: lease.transferKind,
+        attempt,
+        status: lastStatus,
+        error_class: lastErrorClass,
+        retry_delay_ms: sleepMs
+      });
+      await waitForAmbientBackoff(sleepMs);
+      delayMs = Math.min(delayMs * 2, MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_MAX_MS);
+    }
+    const suffix = lastStatus !== null ? String(lastStatus) : lastErrorClass ?? "unknown";
+    throw new Error(`MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_EXHAUSTED:${suffix}`);
+  }
+  async reportMigrationTransportLost(lease, err) {
+    const url = new URL(`/internal/computer/agent-migrations/by-id/${encodeURIComponent(lease.migrationId)}/transport-lost`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "POST",
+      headers: {
+        ...this.internalComputerHeaders(),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        role: lease.role,
+        transferKind: lease.transferKind,
+        message: migrationTransferFailureMessage(err)
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_TRANSPORT_LOST_REPORT_FAILED:${response.status}`);
+    }
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "transport_lost_reported",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      migration_id_present: Boolean(lease.migrationId)
+    });
+  }
+  async reportMigrationSourceReady(lease, manifestSha256) {
+    const url = new URL(`/internal/computer/agent-migrations/by-id/${encodeURIComponent(lease.migrationId)}/source-ready`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "POST",
+      headers: {
+        ...this.internalComputerHeaders(),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        manifestPath: `object-store:${lease.sessionId}/manifest.json`,
+        manifestSha256
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_SOURCE_READY_REPORT_FAILED:${response.status}:${await migrationStepErrorSuffix(response)}`);
+    }
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "source_ready_reported",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      migration_id_present: Boolean(lease.migrationId)
+    });
+  }
+  async fetchMigrationTargetImportView(migrationId) {
+    const url = new URL(`/internal/computer/agent-migrations/by-id/${encodeURIComponent(migrationId)}`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "GET",
+      headers: this.internalComputerHeaders()
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_TARGET_IMPORT_LOOKUP_FAILED:${response.status}`);
+    }
+    const body = await response.json();
+    if (!body.migration) throw new Error("MIGRATION_TARGET_IMPORT_VIEW_MISSING");
+    return body.migration;
+  }
+  async fetchMigrationTargetImportViewByGrantKey(grantKey) {
+    const url = new URL(`/internal/computer/agent-migrations/${encodeURIComponent(grantKey)}`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "GET",
+      headers: this.internalComputerHeaders()
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_TARGET_IMPORT_LOOKUP_FAILED:${response.status}`);
+    }
+    const body = await response.json();
+    if (!body.migration) throw new Error("MIGRATION_TARGET_IMPORT_VIEW_MISSING");
+    return body.migration;
+  }
+  migrationRebindClient(grantKey) {
+    return {
+      startTransfer: (input) => this.postMigrationTargetImportStep(grantKey, "start-transfer", input),
+      flipMachine: (input) => this.postMigrationTargetImportStep(grantKey, "flip-machine", input),
+      markArrived: (input) => this.postMigrationTargetImportStep(grantKey, "arrived", input)
+    };
+  }
+  async postMigrationTargetImportStep(grantKey, step, body) {
+    return await this.postMigrationTargetImportStepOnce(grantKey, step, body, true);
+  }
+  async postMigrationTargetImportStepOnce(grantKey, step, body, allowStartGenerationRefresh) {
+    const url = new URL(`/internal/computer/agent-migrations/${encodeURIComponent(grantKey)}/${step}`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "POST",
+      headers: {
+        ...this.internalComputerHeaders(),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const suffix = await migrationStepErrorSuffix(response);
+      if (step === "start-transfer" && response.status === 409 && suffix === "migration_generation_stale" && allowStartGenerationRefresh) {
+        const current = await this.fetchMigrationTargetImportViewByGrantKey(grantKey);
+        if (current.state === "in_transit") return current;
+        if (current.state === "ready" && current.migrationGeneration !== body.migrationGeneration) {
+          return await this.postMigrationTargetImportStepOnce(grantKey, step, {
+            ...body,
+            migrationGeneration: current.migrationGeneration
+          }, false);
+        }
+      }
+      throw new Error(`MIGRATION_TARGET_IMPORT_${step.toUpperCase().replace("-", "_")}_FAILED:${response.status}:${suffix}`);
+    }
+    const responseBody = await response.json();
+    if (!responseBody.migration) throw new Error("MIGRATION_TARGET_IMPORT_VIEW_MISSING");
+    return responseBody.migration;
+  }
+  internalComputerHeaders() {
+    return {
+      "Authorization": `Bearer ${this.options.apiKey}`,
+      "X-Slock-Client": "daemon-migration-object-store"
+    };
+  }
   withDaemonTraceScope(tracer) {
     return {
       startSpan: (name, options) => createTraceScopeTracer(tracer, this.daemonTraceScope(), {
@@ -23481,6 +25190,9 @@ var DaemonCore = class {
         });
         break;
       }
+      case "machine:migration_transport:lease":
+        this.handleMigrationTransportLease(msg);
+        break;
       case "reminder.upsert":
         this.reminderCache.upsert(msg.reminder);
         break;
@@ -23534,27 +25246,20 @@ var DaemonCore = class {
       agentId: job.ownerAgentId,
       reminderId: job.reminderId,
       version: job.version,
+      // Accepted ambient clock: reminder telemetry reports the client wall-clock fire attempt.
       firedAtClient: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
-  handleConnect() {
+  emitReadyIfConnected() {
+    if (this.connection.connected) this.emitReady();
+  }
+  emitReady() {
     const { ids: runtimes, versions: runtimeVersions, diagnostics: runtimeDiagnostics = {} } = this.runtimeDetector();
     const runtimeInfo = runtimes.map((id) => runtimeVersions[id] ? `${id} (${runtimeVersions[id]})` : id);
     logger.info(`[Daemon] Detected runtimes: ${runtimeInfo.join(", ") || "none"}`);
     for (const [runtime, diagnostic] of Object.entries(runtimeDiagnostics)) {
       logger.warn(`[Daemon] Runtime ${runtime} diagnostic: ${diagnostic}`);
     }
-    if (!this.opencliWrappersRegenerated) {
-      this.opencliWrappersRegenerated = true;
-      try {
-        const { scanned, rewritten } = regenerateExistingOpencliWrappers(this.agentsDataDir);
-        if (scanned > 0) {
-          logger.info(`[Daemon] Refreshed ${rewritten}/${scanned} opencli wrapper(s) to current self-healing form`);
-        }
-      } catch (err) {
-        logger.warn(`[Daemon] opencli wrapper refresh skipped: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    }
     const runningAgentIds = this.agentManager.getRunningAgentIds();
     const idleAgentSessions = this.agentManager.getIdleAgentSessionIds();
     const runtimeProfileReports = this.agentManager.getAgentRuntimeProfileReports();
@@ -23566,7 +25271,8 @@ var DaemonCore = class {
       hostname: this.options.hostname ?? os8.hostname(),
       os: this.options.osDescription ?? `${os8.platform()} ${os8.arch()}`,
       daemonVersion: this.daemonVersion,
-      ...this.computerVersion ? { computerVersion: this.computerVersion } : {}
+      ...this.computerVersion ? { computerVersion: this.computerVersion } : {},
+      migrationTransport: this.getMigrationTransportReady()
     });
     this.recordDaemonTrace("daemon.ready.sent", {
       runtimes_count: runtimes.length,
@@ -23574,6 +25280,23 @@ var DaemonCore = class {
       idle_agents_count: idleAgentSessions.length,
       runtime_profile_reports_count: runtimeProfileReports.length
     });
+  }
+  handleConnect() {
+    if (!this.opencliWrappersRegenerated) {
+      this.opencliWrappersRegenerated = true;
+      try {
+        const { scanned, rewritten } = regenerateExistingOpencliWrappers(this.agentsDataDir);
+        if (scanned > 0) {
+          logger.info(`[Daemon] Refreshed ${rewritten}/${scanned} opencli wrapper(s) to current self-healing form`);
+        }
+      } catch (err) {
+        logger.warn(`[Daemon] opencli wrapper refresh skipped: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    this.emitReady();
+    const runningAgentIds = this.agentManager.getRunningAgentIds();
+    const idleAgentSessions = this.agentManager.getIdleAgentSessionIds();
+    const runtimeProfileReports = this.agentManager.getAgentRuntimeProfileReports();
     if (this.options.onComputerUpgradeReconcile) {
       void Promise.resolve().then(
         () => this.options.onComputerUpgradeReconcile((done) => {
@@ -23651,10 +25374,27 @@ export {
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,
-  AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
-  buildAgentMigrationExportManifest,
+  detectLegacyDaemonSupervisor,
+  detectLegacyDaemonSupervisorWithProbe,
+  legacyDaemonSupervisorFallbackCommands,
+  AGENT_MIGRATION_TRANSPORT_HOST_ENV,
+  AGENT_MIGRATION_TRANSPORT_PORT_ENV,
+  AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV,
+  AGENT_MIGRATION_CONTROL_SEAM_ENV,
   AgentMigrationGrantRegistry,
   createAgentMigrationHttpTransport,
+  resolveAgentMigrationHttpTransportListenOptions,
+  resolveAgentMigrationControlSeamEnabled,
+  AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
+  buildAgentMigrationExportManifest,
+  AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
+  AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE,
+  buildAgentMigrationObjectStoreBundle,
+  stageAgentMigrationObjectStoreBundle,
+  buildAgentMigrationAdoptPlan,
+  verifyAgentMigrationAdoptPlan,
+  executeAgentMigrationAdoptPlan,
+  hashAgentMigrationManifest,
   DAEMON_CORE_TRACE_ATTR_CONTRACTS,
   DAEMON_CLI_USAGE,
   parseDaemonCliArgs,