@botiverse/raft-daemon 0.72.4-play.20260709142358 → 0.72.4

package/dist/{chunk-OEK5FGK6.js → chunk-TPDIIRNC.js}

@@ -1,5 +1,5 @@
 // src/core.ts
-import path22 from "path";
+import path23 from "path";
 import os8 from "os";
 import { createRequire as createRequire3 } from "module";
 import { accessSync } from "fs";
@@ -636,12 +636,12 @@ function parseModelConfig(runtimeModels, runtime, value, fallback, usesLegacyCla
   if (value.kind === "custom" && typeof value.name === "string" && value.name.trim()) {
     return { kind: "custom", name: value.name.trim() };
   }
-  if (value.kind === "preset" && typeof value.id === "string" && value.id.trim() && isPresetRuntimeModel(runtimeModels, runtime, value.id.trim())) {
-    return { kind: "preset", id: value.id.trim() };
-  }
   if (usesLegacyClaudeCustomProvider && runtime === "claude" && legacyCustomModel?.trim()) {
     return { kind: "custom", name: legacyCustomModel.trim() };
   }
+  if (value.kind === "preset" && typeof value.id === "string" && value.id.trim()) {
+    return { kind: "preset", id: value.id.trim() };
+  }
   return modelConfigFromLegacy(runtimeModels, runtime, fallback);
 }
 function parseModeConfig(value) {
@@ -1366,6 +1366,9 @@ var PROMOTED_IDENTITY_ATTRS = [
   "caller_kind"
 ];
 var PROMOTED_CLOSED_ATTRS = [
+  "router_reason",
+  "stale_owner_cleanup_result",
+  "stale_owner_cleanup_reason",
   "outcome",
   "reason",
   "event_kind",
@@ -1374,6 +1377,8 @@ var PROMOTED_CLOSED_ATTRS = [
   "activity_write_site",
   "activity_source",
   "hint_source",
+  "weak_source",
+  "competing_fact",
   "resolved_activity",
   "previous_activity",
   "next_activity",
@@ -1459,11 +1464,16 @@ var TRACE_B0_FIELD_DEFINITIONS = defineTraceFields([
   { key: "served_from", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "authority", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "decided_by", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "router_reason", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "stale_owner_cleanup_result", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
+  { key: "stale_owner_cleanup_reason", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "error_class", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "query_name", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "query_registry" },
   { key: "phase", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "eligibility_subcheck", fieldClass: "query_axis", placement: "event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "hint_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "weak_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "competing_fact", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "resolved_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "previous_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "next_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
@@ -2017,7 +2027,7 @@ var optionalIsoTimestampSchema = z2.string().datetime().optional();
 var agentStatusSchema = z2.enum(["active", "inactive", "stopped"]);
 var reminderStatusSchema = z2.enum(["scheduled", "fired", "canceled"]);
 var reminderEventTypeSchema = z2.enum(["scheduled", "fired", "snoozed", "updated", "canceled"]);
-var reasoningEffortSchema = z2.enum(["low", "medium", "high", "xhigh"]);
+var reasoningEffortSchema = z2.enum(["low", "medium", "high", "xhigh", "max", "ultra"]);
 var profileVisibilityMembershipStatusSchema = z2.enum(["active", "removed"]);
 var passthroughObject = (shape) => z2.object(shape).passthrough();
 var taskStatusSchema = z2.enum(["todo", "in_progress", "in_review", "done", "closed"]);
@@ -2694,7 +2704,7 @@ var agentApiReminderResponseSchema = passthroughObject({
 var agentApiReminderLogResponseSchema = passthroughObject({
   events: z2.array(agentApiReminderEventSummarySchema)
 });
-var agentApiMigrationStateSchema = z2.enum(["prep", "ready", "in_transit", "arriving", "completed", "aborted", "failed"]);
+var agentApiMigrationStateSchema = z2.enum(["provisioning", "prep", "ready", "in_transit", "arriving", "completed", "aborted", "failed"]);
 var agentApiMigrationSummarySchema = passthroughObject({
   id: z2.string(),
   agentId: z2.string(),
@@ -3755,6 +3765,27 @@ var RUNTIME_MODELS = {
     { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" }
   ],
   codex: [
+    {
+      id: "gpt-5.6-sol",
+      label: "GPT-5.6 Sol",
+      supportedReasoningEfforts: ["low", "medium", "high", "xhigh", "max", "ultra"],
+      defaultReasoningEffort: "medium",
+      verified: "launchable"
+    },
+    {
+      id: "gpt-5.6-terra",
+      label: "GPT-5.6 Terra",
+      supportedReasoningEfforts: ["low", "medium", "high", "xhigh", "max", "ultra"],
+      defaultReasoningEffort: "medium",
+      verified: "launchable"
+    },
+    {
+      id: "gpt-5.6-luna",
+      label: "GPT-5.6 Luna",
+      supportedReasoningEfforts: ["low", "medium", "high", "xhigh", "max"],
+      defaultReasoningEffort: "medium",
+      verified: "launchable"
+    },
     { id: "gpt-5.5", label: "GPT-5.5" },
     { id: "gpt-5.4", label: "GPT-5.4" },
     { id: "gpt-5.3-codex", label: "GPT-5.3 Codex" },
@@ -4421,8 +4452,8 @@ async function executeResponseRequest(url, init, {
 }
 
 // src/directUploadCapability.ts
-function joinUrl(base, path23) {
-  return `${base.replace(/\/+$/, "")}${path23}`;
+function joinUrl(base, path24) {
+  return `${base.replace(/\/+$/, "")}${path24}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -5112,15 +5143,6 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
-// src/authEnv.ts
-var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
-var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
-function scrubDaemonChildEnv(env) {
-  delete env[DAEMON_API_KEY_ENV];
-  delete env[SLOCK_AGENT_TOKEN_ENV];
-  return env;
-}
-
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -6702,9 +6724,7 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_TOKEN",
-  "SLOCK_AGENT_CREDENTIAL_KEY",
-  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
+  "SLOCK_AGENT_CREDENTIAL_KEY"
 ];
 var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
   "agent-token",
@@ -7059,7 +7079,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     SLOCK_SERVER_URL: ctx.config.serverUrl,
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  scrubDaemonChildEnv(spawnEnv);
+  delete spawnEnv.SLOCK_AGENT_TOKEN;
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -7627,7 +7647,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -7653,7 +7673,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -8079,7 +8099,7 @@ function codexNotificationDiagnosticEvent(message) {
       return null;
   }
   const sessionId = codexMessageThreadId(message);
-  const path23 = boundedString(params.path);
+  const path24 = boundedString(params.path);
   return {
     kind: "runtime_diagnostic",
     severity: "warning",
@@ -8087,7 +8107,7 @@ function codexNotificationDiagnosticEvent(message) {
     itemType: message.method,
     message: diagnosticMessage,
     ...details ? { details } : {},
-    ...path23 ? { path: path23 } : {},
+    ...path24 ? { path: path24 } : {},
     ...params.range !== void 0 ? { range: params.range } : {},
     payloadBytes: payloadBytes(params),
     ...sessionId ? { sessionId } : {}
@@ -9737,11 +9757,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return scrubDaemonChildEnv(withWindowsUserEnvironment({
+  return withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps));
+  }, deps);
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -9797,7 +9817,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
+  const env = deps.env ?? process.env;
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -9934,15 +9954,12 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os4 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
-var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
-var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
-var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -9951,73 +9968,6 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
-function readKimiConfigSource(home = os4.homedir(), env = process.env) {
-  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
-  if (inlineConfig && inlineConfig.trim()) {
-    return {
-      raw: inlineConfig,
-      explicitPath: null,
-      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
-    };
-  }
-  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
-  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
-  try {
-    return {
-      raw: readFileSync3(configPath, "utf8"),
-      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
-      sourcePath: configPath
-    };
-  } catch {
-    return {
-      raw: null,
-      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
-      sourcePath: configPath
-    };
-  }
-}
-function buildKimiSpawnEnv(env = process.env) {
-  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
-  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
-  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
-  return scrubDaemonChildEnv(spawnEnv);
-}
-function buildKimiEffectiveEnv(ctx, overrideEnv) {
-  return {
-    ...process.env,
-    ...ctx.config.envVars || {},
-    ...overrideEnv || {}
-  };
-}
-function buildKimiLaunchOptions(ctx, opts = {}) {
-  const env = buildKimiEffectiveEnv(ctx, opts.env);
-  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
-  const args = [];
-  let configFilePath = null;
-  let configContent = null;
-  if (source.explicitPath) {
-    configFilePath = source.explicitPath;
-  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
-    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
-    configContent = source.raw;
-    if (opts.writeGeneratedConfig !== false) {
-      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
-      chmodSync(configFilePath, 384);
-    }
-  }
-  if (configFilePath) {
-    args.push("--config-file", configFilePath);
-  }
-  if (ctx.config.model && ctx.config.model !== "default") {
-    args.push("--model", ctx.config.model);
-  }
-  return {
-    args,
-    env: buildKimiSpawnEnv(env),
-    configFilePath,
-    configContent
-  };
-}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -10041,25 +9991,7 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId, ctx, opts) => {
-      if (!ctx) return { args: ["--model", modelId] };
-      const launchCtx = {
-        ...ctx,
-        config: {
-          ...ctx.config,
-          model: modelId
-        }
-      };
-      const launch = buildKimiLaunchOptions(launchCtx, {
-        home: opts?.home,
-        writeGeneratedConfig: false
-      });
-      return {
-        args: launch.args,
-        env: launch.env,
-        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
-      };
-    }
+    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -10083,23 +10015,21 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
-    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId,
-      ...launch.args
+      this.sessionId
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(hydrateRuntimeConfig(ctx.config));
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const spawnTarget = resolveKimiSpawn(args);
-    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
+    const launch = resolveKimiSpawn(args);
+    const proc = spawn7(launch.command, launch.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -10107,7 +10037,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: spawnTarget.shell
+      shell: launch.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -10220,9 +10150,14 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir(), opts = {}) {
-  const raw = readKimiConfigSource(home, opts.env).raw;
-  if (raw === null) return null;
+function detectKimiModels(home = os4.homedir()) {
+  const configPath = path9.join(home, ".kimi", "config.toml");
+  let raw;
+  try {
+    raw = readFileSync3(configPath, "utf8");
+  } catch {
+    return null;
+  }
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -10901,7 +10836,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
+    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -11527,10 +11462,8 @@ function mapPiSdkEventToParsedEvents(event, state) {
     case "agent_end":
       events.push({ kind: "turn_end", sessionId: state.sessionId || void 0 });
       return events;
-    default: {
-      const _exhaustive = event;
-      return _exhaustive;
-    }
+    default:
+      return events;
   }
 }
 var PI_RUNTIME_SESSION_DESCRIPTOR = {
@@ -11715,15 +11648,21 @@ async function createPiAgentSessionForContext(ctx, sessionId, opts = {}) {
   }
 }
 var PiSdkRuntimeSession = class {
-  constructor(ctx, setCurrentSessionId, sessionFactory = createPiAgentSessionForContext) {
+  constructor(ctx, setCurrentSessionId, sessionFactory = createPiAgentSessionForContext, opts = {}) {
     this.ctx = ctx;
     this.setCurrentSessionId = setCurrentSessionId;
     this.sessionFactory = sessionFactory;
     this.mappingState = createPiSdkEventMappingState(ctx.config.sessionId || null);
+    const runtimeConfig = hydrateRuntimeConfig(ctx.config);
+    const launchRuntimeFields = runtimeConfigToLaunchFields(runtimeConfig);
+    this.sdkCallEnvPatch = buildPiSessionCreateEnvPatch(runtimeConfig, launchRuntimeFields.envVars);
+    this.sdkCallEnvRemoveFirst = opts.isolateHostProviderEnv ? BUILTIN_BLOCKED_HOST_PROVIDER_ENV_KEYS : void 0;
   }
   descriptor = PI_RUNTIME_SESSION_DESCRIPTOR;
   events = new EventEmitter2();
   mappingState;
+  sdkCallEnvPatch;
+  sdkCallEnvRemoveFirst;
   session = null;
   unsubscribe = null;
   started = false;
@@ -11853,7 +11792,7 @@ var PiSdkRuntimeSession = class {
     setImmediate(() => {
       if (this.didClose) return;
       try {
-        void invoke().catch((error) => {
+        void withProcessEnvPatch(this.sdkCallEnvPatch, invoke, { removeFirst: this.sdkCallEnvRemoveFirst }).catch((error) => {
           if (this.didClose) return;
           this.events.emit("runtime_event", {
             kind: "error",
@@ -11986,7 +11925,7 @@ var BuiltInDriver = class extends PiDriver {
       exposeLaunchTraceEvidence: true,
       exposeLaunchEnvToTools: false,
       isolateHostProviderEnv: true
-    }));
+    }), { isolateHostProviderEnv: true });
   }
   buildSystemPrompt(config, _agentId) {
     return buildCliTransportSystemPrompt(config, {
@@ -22708,6 +22647,11 @@ function onceDrain(res) {
   return new Promise((resolve) => res.once("drain", resolve));
 }
 
+// src/agentMigrationObjectStoreBundle.ts
+import { createHash as createHash9 } from "crypto";
+import { lstat as lstat3, mkdir as mkdir3, readFile as readFile4, readlink as readlink2, rm as rm3, symlink, writeFile as writeFile3 } from "fs/promises";
+import path20 from "path";
+
 // src/agentMigrationExport.ts
 import { createHash as createHash8 } from "crypto";
 import { createReadStream } from "fs";
@@ -23029,19 +22973,142 @@ function sortByPath(entries) {
   return [...entries].sort((a, b) => a.path.localeCompare(b.path));
 }
 
+// src/agentMigrationObjectStoreBundle.ts
+var AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION = "agent-object-store-bundle/v1";
+var AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE = "application/vnd.slock.agent-migration-bundle";
+async function buildAgentMigrationObjectStoreBundle(input) {
+  const workspacePath = path20.resolve(input.workspacePath);
+  const manifest = await buildAgentMigrationExportManifest({
+    agentId: input.agentId,
+    slockHome: input.slockHome,
+    workspacePath,
+    mode: "forensic"
+  });
+  const files = [];
+  for (const entry of manifest.files) {
+    if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
+      throw new Error("MIGRATION_OBJECT_STORE_UNSUPPORTED_ENTRY");
+    }
+    const sourcePath = path20.resolve(entry.sourcePath);
+    if (entry.kind === "symlink") {
+      files.push({
+        kind: "symlink",
+        workspaceRelativePath: normalizeWorkspaceRelativePath(entry.workspaceRelativePath),
+        linkTarget: entry.linkTarget ?? await readlink2(sourcePath)
+      });
+      continue;
+    }
+    const stat4 = await lstat3(sourcePath);
+    if (!stat4.isFile()) throw new Error("MIGRATION_OBJECT_STORE_FILE_KIND_MISMATCH");
+    files.push({
+      kind: "file",
+      workspaceRelativePath: normalizeWorkspaceRelativePath(entry.workspaceRelativePath),
+      contentBase64: (await readFile4(sourcePath)).toString("base64")
+    });
+  }
+  const payload = {
+    schemaVersion: AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
+    manifest,
+    files
+  };
+  const bundle = Buffer.from(`${JSON.stringify(sortJsonValue2(payload))}
+`, "utf8");
+  if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes <= 0 || bundle.byteLength > input.maxBytes) {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE");
+  }
+  return {
+    bundle,
+    manifestSha256: sha256Buffer2(Buffer.from(canonicalJson2(manifest), "utf8"))
+  };
+}
+async function stageAgentMigrationObjectStoreBundle(input) {
+  const parsed = parseObjectStoreBundle(input.bundle);
+  const stagingWorkspacePath = path20.join(
+    path20.resolve(input.slockHome),
+    "migrations",
+    sanitizePathSegment(input.sessionId),
+    "workspace"
+  );
+  await rm3(stagingWorkspacePath, { recursive: true, force: true });
+  await mkdir3(stagingWorkspacePath, { recursive: true });
+  for (const file of parsed.files) {
+    const relativePath = normalizeWorkspaceRelativePath(file.workspaceRelativePath);
+    const targetPath = path20.join(stagingWorkspacePath, relativePath);
+    await mkdir3(path20.dirname(targetPath), { recursive: true });
+    if (file.kind === "symlink") {
+      if (!file.linkTarget) throw new Error("MIGRATION_OBJECT_STORE_LINK_TARGET_MISSING");
+      await symlink(file.linkTarget, targetPath);
+      continue;
+    }
+    if (file.kind !== "file" || typeof file.contentBase64 !== "string") {
+      throw new Error("MIGRATION_OBJECT_STORE_FILE_CONTENT_MISSING");
+    }
+    await writeFile3(targetPath, Buffer.from(file.contentBase64, "base64"), { mode: 384 });
+  }
+  return {
+    manifest: parsed.manifest,
+    manifestSha256: sha256Buffer2(Buffer.from(canonicalJson2(parsed.manifest), "utf8")),
+    stagingWorkspacePath
+  };
+}
+function parseObjectStoreBundle(buffer) {
+  let parsed;
+  try {
+    parsed = JSON.parse(buffer.toString("utf8"));
+  } catch {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_INVALID_JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_INVALID");
+  }
+  const bundle = parsed;
+  if (bundle.schemaVersion !== AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION) {
+    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_UNSUPPORTED");
+  }
+  if (!bundle.manifest || typeof bundle.manifest !== "object" || Array.isArray(bundle.manifest)) {
+    throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_MISSING");
+  }
+  if (!Array.isArray(bundle.files)) throw new Error("MIGRATION_OBJECT_STORE_FILES_MISSING");
+  return bundle;
+}
+function normalizeWorkspaceRelativePath(relativePath) {
+  const normalized = path20.posix.normalize(relativePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path20.isAbsolute(normalized)) {
+    throw new Error("MIGRATION_OBJECT_STORE_UNSAFE_PATH");
+  }
+  return normalized;
+}
+function canonicalJson2(value) {
+  return JSON.stringify(sortJsonValue2(value));
+}
+function sortJsonValue2(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue2);
+  if (!value || typeof value !== "object") return value;
+  return Object.keys(value).sort().reduce((result, key) => {
+    result[key] = sortJsonValue2(value[key]);
+    return result;
+  }, {});
+}
+function sha256Buffer2(buffer) {
+  return createHash9("sha256").update(buffer).digest("hex");
+}
+function sanitizePathSegment(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128) || "migration";
+}
+
 // src/agentMigrationImport.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { createReadStream as createReadStream2 } from "fs";
-import { access as access2, cp, lstat as lstat3, mkdir as mkdir3, readlink as readlink2, rename, writeFile as writeFile3 } from "fs/promises";
-import path20 from "path";
+import { access as access2, cp, lstat as lstat4, mkdir as mkdir4, readlink as readlink3, rename, writeFile as writeFile4 } from "fs/promises";
+import path21 from "path";
 async function buildAgentMigrationAdoptPlan(input) {
-  const slockHome = path20.resolve(input.slockHome);
+  const slockHome = path21.resolve(input.slockHome);
   let manifest;
   if (input.sourceKind === "orphan_directory" && !input.manifest) {
     manifest = await buildAgentMigrationExportManifest({
       agentId: input.agentId,
       slockHome,
-      workspacePath: path20.resolve(input.orphanWorkspacePath),
+      workspacePath: path21.resolve(input.orphanWorkspacePath),
       mode: "forensic",
       now: input.now
     });
@@ -23054,14 +23121,14 @@ async function buildAgentMigrationAdoptPlan(input) {
     manifest,
     expectedAgentId: input.sourceKind === "orphan_directory" ? input.agentId : manifest.agentId
   });
-  const sourceWorkspacePath = path20.resolve(
+  const sourceWorkspacePath = path21.resolve(
     input.sourceKind === "staged_bundle" ? input.stagingWorkspacePath : input.orphanWorkspacePath
   );
-  const finalWorkspacePath = path20.resolve(input.finalWorkspacePath ?? path20.join(slockHome, "agents", manifest.agentId));
-  const reportPath = path20.resolve(input.reportPath ?? path20.join(
+  const finalWorkspacePath = path21.resolve(input.finalWorkspacePath ?? path21.join(slockHome, "agents", manifest.agentId));
+  const reportPath = path21.resolve(input.reportPath ?? path21.join(
     slockHome,
     "migrations",
-    sanitizePathSegment(input.generation.grantKey),
+    sanitizePathSegment2(input.generation.grantKey),
     "arrival-report.json"
   ));
   const manifestSha256 = hashAgentMigrationManifest(manifest);
@@ -23141,7 +23208,7 @@ async function executeAgentMigrationAdoptPlan(plan, rebind, now = currentDate())
   return { report, reportPath: plan.reportPath, reportSha256 };
 }
 function hashAgentMigrationManifest(manifest) {
-  return sha256Buffer2(Buffer.from(canonicalJson2(manifest), "utf8"));
+  return sha256Buffer3(Buffer.from(canonicalJson3(manifest), "utf8"));
 }
 function assertManifestIdentity(input) {
   if (input.manifest.schemaVersion !== AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION) {
@@ -23182,13 +23249,13 @@ async function verifyManifestFileEntry(sourceWorkspacePath, entry) {
   if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
     throw new Error("MIGRATION_MANIFEST_ENTRY_NOT_WORKSPACE");
   }
-  const relative = normalizeWorkspaceRelativePath(entry.workspaceRelativePath);
-  const entryPath = path20.join(sourceWorkspacePath, relative);
-  const info = await lstat3(entryPath).catch(() => null);
+  const relative = normalizeWorkspaceRelativePath2(entry.workspaceRelativePath);
+  const entryPath = path21.join(sourceWorkspacePath, relative);
+  const info = await lstat4(entryPath).catch(() => null);
   if (!info) throw new Error("MIGRATION_MANIFEST_FILE_MISSING");
   if (entry.kind === "symlink") {
     if (!info.isSymbolicLink()) throw new Error("MIGRATION_MANIFEST_KIND_MISMATCH");
-    const linkTarget = await readlink2(entryPath);
+    const linkTarget = await readlink3(entryPath);
     if (entry.linkTarget !== linkTarget) throw new Error("MIGRATION_MANIFEST_LINK_MISMATCH");
     return;
   }
@@ -23201,15 +23268,15 @@ async function verifyManifestFileEntry(sourceWorkspacePath, entry) {
     if (actual !== entry.sha256) throw new Error("MIGRATION_MANIFEST_FILE_SHA_MISMATCH");
   }
 }
-function normalizeWorkspaceRelativePath(relativePath) {
-  const normalized = path20.posix.normalize(relativePath.replaceAll("\\", "/"));
-  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path20.isAbsolute(normalized)) {
+function normalizeWorkspaceRelativePath2(relativePath) {
+  const normalized = path21.posix.normalize(relativePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path21.isAbsolute(normalized)) {
     throw new Error("MIGRATION_MANIFEST_UNSAFE_PATH");
   }
   return normalized;
 }
 async function assertFinalWorkspaceAvailable(sourceWorkspacePath, finalWorkspacePath) {
-  if (path20.resolve(sourceWorkspacePath) === path20.resolve(finalWorkspacePath)) return;
+  if (path21.resolve(sourceWorkspacePath) === path21.resolve(finalWorkspacePath)) return;
   try {
     await access2(finalWorkspacePath);
     throw new Error("MIGRATION_WORKSPACE_ALREADY_EXISTS");
@@ -23218,48 +23285,48 @@ async function assertFinalWorkspaceAvailable(sourceWorkspacePath, finalWorkspace
   }
 }
 async function placeWorkspace(sourceWorkspacePath, finalWorkspacePath) {
-  if (path20.resolve(sourceWorkspacePath) === path20.resolve(finalWorkspacePath)) return;
+  if (path21.resolve(sourceWorkspacePath) === path21.resolve(finalWorkspacePath)) return;
   const stagingPath = `${finalWorkspacePath}.migration-${process.pid}-${Date.now()}`;
-  await mkdir3(path20.dirname(finalWorkspacePath), { recursive: true });
+  await mkdir4(path21.dirname(finalWorkspacePath), { recursive: true });
   await cp(sourceWorkspacePath, stagingPath, { recursive: true, dereference: false, errorOnExist: true, force: false });
   await rename(stagingPath, finalWorkspacePath);
 }
 async function writeArrivalReport(reportPath, report) {
-  const payload = `${canonicalJson2(report)}
+  const payload = `${canonicalJson3(report)}
 `;
-  await mkdir3(path20.dirname(reportPath), { recursive: true });
-  await writeFile3(reportPath, payload, { mode: 384 });
-  return sha256Buffer2(Buffer.from(payload, "utf8"));
+  await mkdir4(path21.dirname(reportPath), { recursive: true });
+  await writeFile4(reportPath, payload, { mode: 384 });
+  return sha256Buffer3(Buffer.from(payload, "utf8"));
 }
 async function sha256File2(filePath) {
-  const hash = createHash9("sha256");
+  const hash = createHash10("sha256");
   const stream = createReadStream2(filePath);
   for await (const chunk of stream) {
     hash.update(chunk);
   }
   return hash.digest("hex");
 }
-function sha256Buffer2(buffer) {
-  return createHash9("sha256").update(buffer).digest("hex");
+function sha256Buffer3(buffer) {
+  return createHash10("sha256").update(buffer).digest("hex");
 }
-function canonicalJson2(value) {
-  return JSON.stringify(sortJsonValue2(value));
+function canonicalJson3(value) {
+  return JSON.stringify(sortJsonValue3(value));
 }
-function sortJsonValue2(value) {
-  if (Array.isArray(value)) return value.map(sortJsonValue2);
+function sortJsonValue3(value) {
+  if (Array.isArray(value)) return value.map(sortJsonValue3);
   if (!value || typeof value !== "object") return value;
   return Object.keys(value).sort().reduce((result, key) => {
-    result[key] = sortJsonValue2(value[key]);
+    result[key] = sortJsonValue3(value[key]);
     return result;
   }, {});
 }
-function sanitizePathSegment(value) {
+function sanitizePathSegment2(value) {
   return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128) || "migration";
 }
 
 // src/secretFile.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
-import path21 from "path";
+import { chmodSync, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import path22 from "path";
 function readSecretFileSync(filePath) {
   return readFileSync9(filePath, "utf8").trim();
 }
@@ -23269,6 +23336,8 @@ var DEFAULT_TRACE_UPLOAD_URL = "https://slock-trace-upload.botiverse.dev";
 var RUNNER_CREDENTIAL_SCOPES = ["send", "read", "mentions", "tasks", "reactions", "server", "channels", "knowledge"];
 var RUNNER_CREDENTIAL_MINT_MAX_ATTEMPTS2 = 3;
 var RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2 = 250;
+var MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_INITIAL_MS = 25;
+var MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_MAX_MS = 250;
 var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
   "daemon.lifecycle.start": {
     spanAttrs: ["machine_dir_present", "local_trace_enabled"],
@@ -23423,8 +23492,27 @@ function runnerCredentialErrorDetail2(error) {
     retryable: true
   };
 }
+async function waitForAmbientBackoff(delayMs) {
+  await new Promise((resolve) => setTimeout(resolve, delayMs));
+}
 async function waitForRunnerCredentialRetry2() {
-  await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
+  await waitForAmbientBackoff(RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2);
+}
+function isRetryableMigrationObjectStoreDownloadStatus(status) {
+  return status === 404 || status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;
+}
+function migrationTransferFailureMessage(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return message.slice(0, 500);
+}
+async function migrationStepErrorSuffix(response) {
+  try {
+    const body = await response.clone().json();
+    if (typeof body.code === "string" && body.code.length > 0) return body.code.slice(0, 120);
+    if (typeof body.error === "string" && body.error.length > 0) return body.error.slice(0, 120);
+  } catch {
+  }
+  return response.statusText || "unknown";
 }
 function parseDaemonCliArgs(args) {
   let serverUrl = "";
@@ -23454,13 +23542,13 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path22.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path22.resolve(thisDir, "cli", "index.js");
+  const thisDir = path23.dirname(fileURLToPath(moduleUrl));
+  const bundledDistPath = path23.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path22.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path23.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -23474,7 +23562,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-NS7NN3BV.js");
+  await import("./dist-VNC64ECP.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -23606,6 +23694,8 @@ function summarizeIncomingMessage(msg) {
       return `(directory=${msg.directoryName})`;
     case "machine:runtime_models:detect":
       return `(runtime=${msg.runtime}, req=${msg.requestId})`;
+    case "machine:migration_transport:lease":
+      return `(agent=${msg.agentId}, migration=${msg.migrationId}, session=${msg.sessionId}, provider=${msg.provider}, role=${msg.role}, kind=${msg.transferKind}, url=${msg.url ? "set" : "missing"})`;
     case "reminder.upsert":
       return `(agent=${msg.agentId}, id=${msg.reminder.reminderId}, v${msg.reminder.version}, fireAt=${msg.reminder.fireAt})`;
     case "reminder.cancel":
@@ -23638,6 +23728,9 @@ var DaemonCore = class {
   migrationTransport;
   migrationTransportListenPromise = null;
   migrationTransportListening = false;
+  migrationTransportUrl = null;
+  migrationTransferLease = null;
+  migrationTransferRuns = /* @__PURE__ */ new Set();
   tracer;
   injectedTracer;
   machineLock = null;
@@ -23692,7 +23785,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path22.join(path22.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path23.join(path23.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -23720,7 +23813,7 @@ var DaemonCore = class {
       sinks: [this.localTraceSink]
     }));
     this.agentManager.setTracer(this.tracer);
-    this.agentManager.setCliTransportTraceDir(path22.join(machineDir, "traces"));
+    this.agentManager.setCliTransportTraceDir(path23.join(machineDir, "traces"));
   }
   installTraceBundleUploader(machineDir) {
     if (!this.shouldEnableLocalTrace()) return;
@@ -23770,7 +23863,9 @@ var DaemonCore = class {
       span.addEvent("daemon.machine_lock.acquired", { machine_dir_present: true });
       span.end("ok");
     }
-    this.startMigrationTransport();
+    if (this.migrationTransport) {
+      this.startMigrationTransport();
+    }
     try {
       this.connection.connect();
     } catch (err) {
@@ -23839,10 +23934,35 @@ var DaemonCore = class {
     });
     span.end(status);
   }
+  getMigrationTransportReady() {
+    const transferLease = this.getActiveMigrationTransferLease();
+    if (transferLease) {
+      return {
+        provisioned: true,
+        endpoint: transferLease.url,
+        leaseSource: "server",
+        provider: transferLease.provider,
+        role: transferLease.role,
+        transferKind: transferLease.transferKind,
+        url: transferLease.url,
+        expiresAt: transferLease.expiresAt,
+        maxBytes: transferLease.maxBytes,
+        observedAt: currentDate().toISOString()
+      };
+    }
+    const endpoint = this.migrationTransportListening ? this.migrationTransportUrl : null;
+    return {
+      provisioned: Boolean(endpoint),
+      endpoint,
+      leaseSource: endpoint ? "env" : null,
+      observedAt: currentDate().toISOString()
+    };
+  }
   startMigrationTransport() {
     if (!this.migrationTransport || this.migrationTransportListenPromise) return;
     this.migrationTransportListenPromise = this.migrationTransport.listen().then(({ url }) => {
       this.migrationTransportListening = true;
+      this.migrationTransportUrl = url;
       logger.info(`[Slock Daemon] Agent migration HTTP transport listening: ${url}`);
       this.recordDaemonTrace("daemon.migration_transport.listen", {
         outcome: "listening",
@@ -23850,6 +23970,7 @@ var DaemonCore = class {
       });
     }).catch((err) => {
       this.migrationTransportListening = false;
+      this.migrationTransportUrl = null;
       logger.error("[Slock Daemon] Agent migration HTTP transport failed to listen", err);
       this.recordDaemonTrace("daemon.migration_transport.listen", {
         outcome: "failed",
@@ -23865,6 +23986,7 @@ var DaemonCore = class {
     if (!this.migrationTransportListening) return;
     try {
       await this.migrationTransport.close();
+      this.migrationTransportUrl = null;
       logger.info("[Slock Daemon] Agent migration HTTP transport stopped");
       this.recordDaemonTrace("daemon.migration_transport.stop", { outcome: "stopped" });
     } catch (err) {
@@ -23875,7 +23997,368 @@ var DaemonCore = class {
       }, "error");
     } finally {
       this.migrationTransportListening = false;
+      this.migrationTransportUrl = null;
+    }
+  }
+  getActiveMigrationTransferLease() {
+    const lease = this.migrationTransferLease;
+    if (!lease) return null;
+    const expiresAtMs = Date.parse(lease.expiresAt);
+    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= currentTimeMs()) return null;
+    return lease;
+  }
+  validateMigrationTransferLease(lease) {
+    if (!lease.agentId.trim()) throw new Error("migration transfer lease agent id is required");
+    if (!lease.migrationId.trim()) throw new Error("migration transfer lease migration id is required");
+    if (!lease.migrationGeneration.trim()) throw new Error("migration transfer lease migrationGeneration is required");
+    if (!lease.sessionId.trim()) throw new Error("migration transfer lease session id is required");
+    if (lease.provider !== "object_store") throw new Error(`unsupported migration transfer provider: ${lease.provider}`);
+    if (lease.leaseSource !== "server") throw new Error(`unsupported migration transfer lease source: ${lease.leaseSource}`);
+    if (lease.role !== "source" && lease.role !== "target") throw new Error(`unsupported migration transfer role: ${lease.role}`);
+    if (lease.transferKind !== "upload" && lease.transferKind !== "download") {
+      throw new Error(`unsupported migration transfer kind: ${lease.transferKind}`);
+    }
+    if (!lease.url.trim()) throw new Error("migration transfer lease url is required");
+    if (!lease.bearerToken.trim()) throw new Error("migration transfer lease bearer token is required");
+    const expiresAtMs = Date.parse(lease.expiresAt);
+    if (!lease.expiresAt.trim() || !Number.isFinite(expiresAtMs) || expiresAtMs <= currentTimeMs()) {
+      throw new Error("migration transfer lease expiresAt must be a future timestamp");
+    }
+    if (!Number.isInteger(lease.maxBytes) || lease.maxBytes <= 0) {
+      throw new Error("migration transfer lease maxBytes must be a positive integer");
+    }
+  }
+  handleMigrationTransportLease(lease) {
+    try {
+      this.applyMigrationTransferLease(lease);
+    } catch (err) {
+      logger.error("[Slock Daemon] Failed to apply migration transport lease", err);
+      this.recordDaemonTrace("daemon.migration_transport.lease", {
+        outcome: "failed",
+        lease_present: true,
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+    }
+  }
+  applyMigrationTransferLease(lease) {
+    this.validateMigrationTransferLease(lease);
+    if (this.migrationTransferLease?.agentId === lease.agentId && this.migrationTransferLease?.migrationId === lease.migrationId && this.migrationTransferLease?.migrationGeneration === lease.migrationGeneration && this.migrationTransferLease?.sessionId === lease.sessionId && this.migrationTransferLease?.role === lease.role) {
+      this.migrationTransferLease = lease;
+      this.emitReadyIfConnected();
+      this.recordDaemonTrace("daemon.migration_transport.lease", {
+        outcome: "unchanged",
+        agent_id_present: true,
+        migration_id_present: true,
+        session_id_present: true,
+        migration_generation: lease.migrationGeneration,
+        provider: lease.provider,
+        role: lease.role,
+        transfer_kind: lease.transferKind
+      });
+      this.startMigrationTransferRun(lease);
+      return;
+    }
+    this.migrationTransferLease = lease;
+    this.emitReadyIfConnected();
+    this.recordDaemonTrace("daemon.migration_transport.lease", {
+      outcome: "applied",
+      agent_id_present: true,
+      migration_id_present: true,
+      session_id_present: true,
+      migration_generation: lease.migrationGeneration,
+      provider: lease.provider,
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      url_present: Boolean(lease.url),
+      bearer_token_present: Boolean(lease.bearerToken)
+    });
+    this.startMigrationTransferRun(lease);
+  }
+  startMigrationTransferRun(lease) {
+    const key = [
+      lease.agentId,
+      lease.migrationId,
+      lease.migrationGeneration,
+      lease.sessionId,
+      lease.role
+    ].join(":");
+    if (this.migrationTransferRuns.has(key)) return;
+    this.migrationTransferRuns.add(key);
+    void this.runMigrationTransferLease(lease).catch(async (err) => {
+      logger.error("[Slock Daemon] Migration object-store transfer failed", err);
+      this.recordDaemonTrace("daemon.migration_transport.object_store", {
+        outcome: "failed",
+        role: lease.role,
+        transfer_kind: lease.transferKind,
+        agent_id_present: Boolean(lease.agentId),
+        migration_id_present: Boolean(lease.migrationId),
+        session_id_present: Boolean(lease.sessionId),
+        error_class: err instanceof Error ? err.name : typeof err
+      }, "error");
+      try {
+        await this.reportMigrationTransportLost(lease, err);
+      } catch (reportErr) {
+        logger.error("[Slock Daemon] Failed to report migration transport loss", reportErr);
+        this.recordDaemonTrace("daemon.migration_transport.object_store", {
+          outcome: "transport_lost_report_failed",
+          role: lease.role,
+          transfer_kind: lease.transferKind,
+          migration_id_present: Boolean(lease.migrationId),
+          error_class: reportErr instanceof Error ? reportErr.name : typeof reportErr
+        }, "error");
+      }
+    }).finally(() => {
+      this.migrationTransferRuns.delete(key);
+    });
+  }
+  async runMigrationTransferLease(lease) {
+    if (lease.provider !== "object_store") return;
+    if (lease.role === "source") {
+      await this.uploadMigrationObjectStoreBundle(lease);
+      return;
+    }
+    await this.downloadAndImportMigrationObjectStoreBundle(lease);
+  }
+  migrationObjectStoreHeaders(lease) {
+    return {
+      "X-Raft-Migration-Token": lease.bearerToken
+    };
+  }
+  async uploadMigrationObjectStoreBundle(lease) {
+    if (lease.transferKind !== "upload") {
+      throw new Error("MIGRATION_OBJECT_STORE_SOURCE_KIND_MISMATCH");
     }
+    const built = await buildAgentMigrationObjectStoreBundle({
+      agentId: lease.agentId,
+      slockHome: this.slockHome,
+      workspacePath: path23.join(this.agentsDataDir, lease.agentId),
+      maxBytes: lease.maxBytes
+    });
+    const response = await daemonFetch(lease.url, {
+      method: "PUT",
+      headers: {
+        ...this.migrationObjectStoreHeaders(lease),
+        "Content-Type": AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE
+      },
+      body: new Uint8Array(built.bundle)
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_OBJECT_STORE_UPLOAD_FAILED:${response.status}`);
+    }
+    await this.reportMigrationSourceReady(lease, built.manifestSha256);
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "uploaded",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      bundle_bytes: built.bundle.byteLength,
+      max_bytes: lease.maxBytes
+    });
+  }
+  async downloadAndImportMigrationObjectStoreBundle(lease) {
+    if (lease.transferKind !== "download") {
+      throw new Error("MIGRATION_OBJECT_STORE_TARGET_KIND_MISMATCH");
+    }
+    const bundle = await this.downloadMigrationObjectStoreBundleWithRetry(lease);
+    if (bundle.byteLength > lease.maxBytes) {
+      throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE");
+    }
+    const staged = await stageAgentMigrationObjectStoreBundle({
+      bundle,
+      slockHome: this.slockHome,
+      sessionId: lease.sessionId
+    });
+    const targetImport = await this.fetchMigrationTargetImportView(lease.migrationId);
+    if (targetImport.agentId !== lease.agentId) {
+      throw new Error("MIGRATION_TARGET_IMPORT_AGENT_MISMATCH");
+    }
+    if (targetImport.manifestSha256 && targetImport.manifestSha256 !== staged.manifestSha256) {
+      throw new Error("MIGRATION_TARGET_IMPORT_MANIFEST_SHA_MISMATCH");
+    }
+    const plan = await buildAgentMigrationAdoptPlan({
+      sourceKind: "staged_bundle",
+      slockHome: this.slockHome,
+      stagingWorkspacePath: staged.stagingWorkspacePath,
+      finalWorkspacePath: path23.join(this.agentsDataDir, lease.agentId),
+      manifest: staged.manifest,
+      manifestSha256: staged.manifestSha256,
+      generation: {
+        grantKey: targetImport.grantKey,
+        migrationGeneration: targetImport.migrationGeneration,
+        sourceMachineId: targetImport.sourceMachineId,
+        targetMachineId: targetImport.targetMachineId,
+        localMachineId: targetImport.targetMachineId
+      }
+    });
+    await executeAgentMigrationAdoptPlan(plan, this.migrationRebindClient(targetImport.grantKey));
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "imported",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      bundle_bytes: bundle.byteLength,
+      manifest_sha_present: true
+    });
+  }
+  async downloadMigrationObjectStoreBundleWithRetry(lease) {
+    const expiresAtMs = Date.parse(lease.expiresAt);
+    let attempt = 0;
+    let delayMs = MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_INITIAL_MS;
+    let lastStatus = null;
+    let lastErrorClass = null;
+    while (currentTimeMs() < expiresAtMs) {
+      attempt += 1;
+      try {
+        const response = await daemonFetch(lease.url, {
+          method: "GET",
+          headers: this.migrationObjectStoreHeaders(lease)
+        });
+        if (response.ok) {
+          return Buffer.from(await response.arrayBuffer());
+        }
+        lastStatus = response.status;
+        lastErrorClass = null;
+        if (!isRetryableMigrationObjectStoreDownloadStatus(response.status)) {
+          throw new Error(`MIGRATION_OBJECT_STORE_DOWNLOAD_FAILED:${response.status}`);
+        }
+      } catch (err) {
+        if (err instanceof Error && err.message.startsWith("MIGRATION_OBJECT_STORE_DOWNLOAD_FAILED:")) {
+          throw err;
+        }
+        lastErrorClass = err instanceof Error ? err.name : typeof err;
+      }
+      const remainingMs = expiresAtMs - currentTimeMs();
+      if (remainingMs <= 0) break;
+      const sleepMs = Math.min(delayMs, remainingMs);
+      this.recordDaemonTrace("daemon.migration_transport.object_store", {
+        outcome: "download_retry",
+        role: lease.role,
+        transfer_kind: lease.transferKind,
+        attempt,
+        status: lastStatus,
+        error_class: lastErrorClass,
+        retry_delay_ms: sleepMs
+      });
+      await waitForAmbientBackoff(sleepMs);
+      delayMs = Math.min(delayMs * 2, MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_MAX_MS);
+    }
+    const suffix = lastStatus !== null ? String(lastStatus) : lastErrorClass ?? "unknown";
+    throw new Error(`MIGRATION_OBJECT_STORE_DOWNLOAD_RETRY_EXHAUSTED:${suffix}`);
+  }
+  async reportMigrationTransportLost(lease, err) {
+    const url = new URL(`/internal/computer/agent-migrations/by-id/${encodeURIComponent(lease.migrationId)}/transport-lost`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "POST",
+      headers: {
+        ...this.internalComputerHeaders(),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        role: lease.role,
+        transferKind: lease.transferKind,
+        message: migrationTransferFailureMessage(err)
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_TRANSPORT_LOST_REPORT_FAILED:${response.status}`);
+    }
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "transport_lost_reported",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      migration_id_present: Boolean(lease.migrationId)
+    });
+  }
+  async reportMigrationSourceReady(lease, manifestSha256) {
+    const url = new URL(`/internal/computer/agent-migrations/by-id/${encodeURIComponent(lease.migrationId)}/source-ready`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "POST",
+      headers: {
+        ...this.internalComputerHeaders(),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        manifestPath: `object-store:${lease.sessionId}/manifest.json`,
+        manifestSha256
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_SOURCE_READY_REPORT_FAILED:${response.status}:${await migrationStepErrorSuffix(response)}`);
+    }
+    this.recordDaemonTrace("daemon.migration_transport.object_store", {
+      outcome: "source_ready_reported",
+      role: lease.role,
+      transfer_kind: lease.transferKind,
+      migration_id_present: Boolean(lease.migrationId)
+    });
+  }
+  async fetchMigrationTargetImportView(migrationId) {
+    const url = new URL(`/internal/computer/agent-migrations/by-id/${encodeURIComponent(migrationId)}`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "GET",
+      headers: this.internalComputerHeaders()
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_TARGET_IMPORT_LOOKUP_FAILED:${response.status}`);
+    }
+    const body = await response.json();
+    if (!body.migration) throw new Error("MIGRATION_TARGET_IMPORT_VIEW_MISSING");
+    return body.migration;
+  }
+  async fetchMigrationTargetImportViewByGrantKey(grantKey) {
+    const url = new URL(`/internal/computer/agent-migrations/${encodeURIComponent(grantKey)}`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "GET",
+      headers: this.internalComputerHeaders()
+    });
+    if (!response.ok) {
+      throw new Error(`MIGRATION_TARGET_IMPORT_LOOKUP_FAILED:${response.status}`);
+    }
+    const body = await response.json();
+    if (!body.migration) throw new Error("MIGRATION_TARGET_IMPORT_VIEW_MISSING");
+    return body.migration;
+  }
+  migrationRebindClient(grantKey) {
+    return {
+      startTransfer: (input) => this.postMigrationTargetImportStep(grantKey, "start-transfer", input),
+      flipMachine: (input) => this.postMigrationTargetImportStep(grantKey, "flip-machine", input),
+      markArrived: (input) => this.postMigrationTargetImportStep(grantKey, "arrived", input)
+    };
+  }
+  async postMigrationTargetImportStep(grantKey, step, body) {
+    return await this.postMigrationTargetImportStepOnce(grantKey, step, body, true);
+  }
+  async postMigrationTargetImportStepOnce(grantKey, step, body, allowStartGenerationRefresh) {
+    const url = new URL(`/internal/computer/agent-migrations/${encodeURIComponent(grantKey)}/${step}`, this.options.serverUrl);
+    const response = await daemonFetch(url, {
+      method: "POST",
+      headers: {
+        ...this.internalComputerHeaders(),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const suffix = await migrationStepErrorSuffix(response);
+      if (step === "start-transfer" && response.status === 409 && suffix === "migration_generation_stale" && allowStartGenerationRefresh) {
+        const current = await this.fetchMigrationTargetImportViewByGrantKey(grantKey);
+        if (current.state === "in_transit") return current;
+        if (current.state === "ready" && current.migrationGeneration !== body.migrationGeneration) {
+          return await this.postMigrationTargetImportStepOnce(grantKey, step, {
+            ...body,
+            migrationGeneration: current.migrationGeneration
+          }, false);
+        }
+      }
+      throw new Error(`MIGRATION_TARGET_IMPORT_${step.toUpperCase().replace("-", "_")}_FAILED:${response.status}:${suffix}`);
+    }
+    const responseBody = await response.json();
+    if (!responseBody.migration) throw new Error("MIGRATION_TARGET_IMPORT_VIEW_MISSING");
+    return responseBody.migration;
+  }
+  internalComputerHeaders() {
+    return {
+      "Authorization": `Bearer ${this.options.apiKey}`,
+      "X-Slock-Client": "daemon-migration-object-store"
+    };
   }
   withDaemonTraceScope(tracer) {
     return {
@@ -24323,6 +24806,9 @@ var DaemonCore = class {
         });
         break;
       }
+      case "machine:migration_transport:lease":
+        this.handleMigrationTransportLease(msg);
+        break;
       case "reminder.upsert":
         this.reminderCache.upsert(msg.reminder);
         break;
@@ -24380,24 +24866,16 @@ var DaemonCore = class {
       firedAtClient: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
-  handleConnect() {
+  emitReadyIfConnected() {
+    if (this.connection.connected) this.emitReady();
+  }
+  emitReady() {
     const { ids: runtimes, versions: runtimeVersions, diagnostics: runtimeDiagnostics = {} } = this.runtimeDetector();
     const runtimeInfo = runtimes.map((id) => runtimeVersions[id] ? `${id} (${runtimeVersions[id]})` : id);
     logger.info(`[Daemon] Detected runtimes: ${runtimeInfo.join(", ") || "none"}`);
     for (const [runtime, diagnostic] of Object.entries(runtimeDiagnostics)) {
       logger.warn(`[Daemon] Runtime ${runtime} diagnostic: ${diagnostic}`);
     }
-    if (!this.opencliWrappersRegenerated) {
-      this.opencliWrappersRegenerated = true;
-      try {
-        const { scanned, rewritten } = regenerateExistingOpencliWrappers(this.agentsDataDir);
-        if (scanned > 0) {
-          logger.info(`[Daemon] Refreshed ${rewritten}/${scanned} opencli wrapper(s) to current self-healing form`);
-        }
-      } catch (err) {
-        logger.warn(`[Daemon] opencli wrapper refresh skipped: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    }
     const runningAgentIds = this.agentManager.getRunningAgentIds();
     const idleAgentSessions = this.agentManager.getIdleAgentSessionIds();
     const runtimeProfileReports = this.agentManager.getAgentRuntimeProfileReports();
@@ -24409,7 +24887,8 @@ var DaemonCore = class {
       hostname: this.options.hostname ?? os8.hostname(),
       os: this.options.osDescription ?? `${os8.platform()} ${os8.arch()}`,
       daemonVersion: this.daemonVersion,
-      ...this.computerVersion ? { computerVersion: this.computerVersion } : {}
+      ...this.computerVersion ? { computerVersion: this.computerVersion } : {},
+      migrationTransport: this.getMigrationTransportReady()
     });
     this.recordDaemonTrace("daemon.ready.sent", {
       runtimes_count: runtimes.length,
@@ -24417,6 +24896,23 @@ var DaemonCore = class {
       idle_agents_count: idleAgentSessions.length,
       runtime_profile_reports_count: runtimeProfileReports.length
     });
+  }
+  handleConnect() {
+    if (!this.opencliWrappersRegenerated) {
+      this.opencliWrappersRegenerated = true;
+      try {
+        const { scanned, rewritten } = regenerateExistingOpencliWrappers(this.agentsDataDir);
+        if (scanned > 0) {
+          logger.info(`[Daemon] Refreshed ${rewritten}/${scanned} opencli wrapper(s) to current self-healing form`);
+        }
+      } catch (err) {
+        logger.warn(`[Daemon] opencli wrapper refresh skipped: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    this.emitReady();
+    const runningAgentIds = this.agentManager.getRunningAgentIds();
+    const idleAgentSessions = this.agentManager.getIdleAgentSessionIds();
+    const runtimeProfileReports = this.agentManager.getAgentRuntimeProfileReports();
     if (this.options.onComputerUpgradeReconcile) {
       void Promise.resolve().then(
         () => this.options.onComputerUpgradeReconcile((done) => {
@@ -24504,6 +25000,10 @@ export {
   resolveAgentMigrationControlSeamEnabled,
   AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
   buildAgentMigrationExportManifest,
+  AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
+  AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE,
+  buildAgentMigrationObjectStoreBundle,
+  stageAgentMigrationObjectStoreBundle,
   buildAgentMigrationAdoptPlan,
   verifyAgentMigrationAdoptPlan,
   executeAgentMigrationAdoptPlan,