@botiverse/raft-daemon 0.72.4 → 0.72.7-play.20260711140930

package/dist/{chunk-TPDIIRNC.js → chunk-FD5UWGOT.js}

@@ -2,8 +2,11 @@
 import path23 from "path";
 import os8 from "os";
 import { createRequire as createRequire3 } from "module";
-import { accessSync } from "fs";
+import { accessSync, createReadStream as createReadStream4, createWriteStream as createWriteStream2 } from "fs";
+import { mkdtemp, rm as rm4, stat as stat4 } from "fs/promises";
 import { fileURLToPath } from "url";
+import { Readable as Readable3 } from "stream";
+import { pipeline as pipeline2 } from "stream/promises";
 
 // ../shared/src/typeGuards.ts
 function makeIsMember(members) {
@@ -1362,6 +1365,7 @@ var PROMOTED_IDENTITY_ATTRS = [
   "launch_id",
   "session_id",
   "request_id",
+  "operation_id",
   "route_pattern",
   "caller_kind"
 ];
@@ -1448,6 +1452,7 @@ var TRACE_B0_FIELD_DEFINITIONS = defineTraceFields([
   { key: "advances_observed_clock", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "duration_ms", fieldClass: "query_axis", placement: "span_or_event", valueKind: "numeric" },
   { key: "request_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
+  { key: "operation_id", fieldClass: "query_axis", placement: "span_or_event", valueKind: "identity", highCardinality: true },
   { key: "route_pattern", fieldClass: "query_axis", placement: "span", valueKind: "route" },
   { key: "caller_kind", fieldClass: "query_axis", placement: "span", valueKind: "closed_enum", enumBinding: "stable" },
   { key: "server_id", fieldClass: "query_axis", placement: "span", valueKind: "identity", highCardinality: true },
@@ -1472,10 +1477,14 @@ var TRACE_B0_FIELD_DEFINITIONS = defineTraceFields([
   { key: "phase", fieldClass: "query_axis", placement: "span_or_event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "eligibility_subcheck", fieldClass: "query_axis", placement: "event", valueKind: "closed_enum", enumBinding: "pending_457" },
   { key: "hint_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "candidate_activity", fieldClass: "family_query_axis", placement: "span_or_event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "served_activity", fieldClass: "family_query_axis", placement: "span_or_event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "write_action", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity", enumBinding: "stable", enumValues: ["none"] },
+  { key: "arbitration_reason", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity", enumBinding: "stable", enumValues: ["trusted_snapshot", "owner_mirror_read_through"] },
   { key: "weak_source", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "competing_fact", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "resolved_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
-  { key: "previous_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
+  { key: "previous_activity", fieldClass: "family_query_axis", placement: "span_or_event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "next_activity", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "repair_kind", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
   { key: "activity_write_site", fieldClass: "family_query_axis", placement: "event", valueKind: "closed_enum", scope: "family:activity" },
@@ -2008,8 +2017,90 @@ var actionCardActionSchema = z.discriminatedUnion("type", [
   integrationUpdateAppRegistrationOperationSchema
 ]);
 
-// ../shared/src/agentApiContract.ts
+// ../shared/src/featureFlagRolloutGuardrail.ts
 import { z as z2 } from "zod";
+var FEATURE_FLAG_ROLLOUT_GUARDRAIL_SCHEMA = "feature_flag_rollout_guardrail.v1";
+var FEATURE_FLAG_ROLLOUT_GUARDRAIL_ISSUER = "feature-flag-guardrail";
+var FEATURE_FLAG_ROLLOUT_GUARDRAIL_POLICY_VERSION = "v1";
+var FEATURE_FLAG_ROLLOUT_GUARDRAIL_MAX_RECEIPT_AGE_MS = 5 * 60 * 1e3;
+var FLAG_KEY_RE = /^[a-z0-9][a-z0-9_.-]{0,127}$/;
+var CONTROL_PLANE_ID_RE = /^[a-z0-9][a-z0-9_.:-]{0,127}$/;
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var flagKeySchema = z2.string().regex(FLAG_KEY_RE);
+var controlPlaneIdSchema = z2.string().regex(CONTROL_PLANE_ID_RE);
+var uuidSchema2 = z2.string().regex(UUID_RE);
+var configVersionSchema = z2.number().refine(Number.isSafeInteger).refine((value) => value >= 0);
+var basisPointsSchema = z2.number().int().min(0).max(1e4);
+var ruleSchema = z2.object({
+  id: uuidSchema2,
+  flagKey: flagKeySchema.optional(),
+  stage: z2.enum(["user", "server", "plan", "percentage"]),
+  priority: z2.number().int(),
+  decision: z2.enum(["allow", "deny"]),
+  values: z2.array(z2.string().min(1)).refine((values) => new Set(values).size === values.length),
+  percentageBasisPoints: basisPointsSchema.nullable(),
+  variant: z2.string().min(1).nullable()
+});
+var baseStateSchema = z2.strictObject({
+  controlPlaneId: controlPlaneIdSchema,
+  flagKey: flagKeySchema,
+  configVersion: configVersionSchema,
+  killSwitch: z2.boolean(),
+  // Rules are parsed only when the requested operation depends on them. This
+  // keeps emergency kill available even if unrelated rule payloads are bad.
+  rules: z2.unknown().optional()
+});
+var intentSchema = z2.discriminatedUnion("kind", [
+  z2.strictObject({
+    kind: z2.literal("server_allowlist_set"),
+    flagKey: flagKeySchema,
+    expectedConfigVersion: configVersionSchema.optional(),
+    serverId: uuidSchema2,
+    desired: z2.enum(["present", "absent"])
+  }),
+  z2.strictObject({
+    kind: z2.literal("percentage_set"),
+    flagKey: flagKeySchema,
+    expectedConfigVersion: configVersionSchema.optional(),
+    desiredBasisPoints: basisPointsSchema
+  }),
+  z2.strictObject({
+    kind: z2.literal("kill_switch_set"),
+    flagKey: flagKeySchema,
+    expectedConfigVersion: configVersionSchema.optional(),
+    desired: z2.boolean()
+  })
+]);
+var wideningOperationSchema = z2.discriminatedUnion("kind", [
+  z2.strictObject({
+    kind: z2.literal("server_allowlist_add"),
+    ruleId: uuidSchema2.nullable(),
+    serverId: uuidSchema2
+  }),
+  z2.strictObject({
+    kind: z2.literal("percentage_increase"),
+    ruleId: uuidSchema2.nullable(),
+    fromBasisPoints: basisPointsSchema,
+    toBasisPoints: basisPointsSchema
+  }).refine((operation) => operation.toBasisPoints > operation.fromBasisPoints),
+  z2.strictObject({ kind: z2.literal("kill_switch_disable") })
+]);
+var receiptSchema = z2.strictObject({
+  schema: z2.literal(FEATURE_FLAG_ROLLOUT_GUARDRAIL_SCHEMA),
+  id: uuidSchema2,
+  verdict: z2.enum(["pass", "fail"]),
+  issuer: z2.literal(FEATURE_FLAG_ROLLOUT_GUARDRAIL_ISSUER),
+  controlPlaneId: controlPlaneIdSchema,
+  flagKey: flagKeySchema,
+  configVersion: configVersionSchema,
+  operation: wideningOperationSchema,
+  policyVersion: z2.literal(FEATURE_FLAG_ROLLOUT_GUARDRAIL_POLICY_VERSION),
+  evaluatedAt: z2.string(),
+  expiresAt: z2.string()
+});
+
+// ../shared/src/agentApiContract.ts
+import { z as z3 } from "zod";
 
 // ../shared/src/attentionDependencyOracle.ts
 var ATTENTION_HINT_SCHEMA = "attention-dependency-hint.v1";
@@ -2017,78 +2108,78 @@ var ATTENTION_HINT_DEFAULT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 
 // ../shared/src/agentApiContract.ts
 var AGENT_API_BASE_PATH = "/internal/agent-api";
-var optionalStringSchema = z2.string().trim().optional();
-var optionalStringArraySchema = z2.array(z2.string().trim().min(1)).optional();
-var optionalBooleanSchema = z2.boolean().optional();
-var optionalNumberSchema = z2.number().finite().optional();
-var nullableStringSchema = z2.string().nullable();
-var nullableNumberSchema = z2.number().finite().nullable();
-var optionalIsoTimestampSchema = z2.string().datetime().optional();
-var agentStatusSchema = z2.enum(["active", "inactive", "stopped"]);
-var reminderStatusSchema = z2.enum(["scheduled", "fired", "canceled"]);
-var reminderEventTypeSchema = z2.enum(["scheduled", "fired", "snoozed", "updated", "canceled"]);
-var reasoningEffortSchema = z2.enum(["low", "medium", "high", "xhigh", "max", "ultra"]);
-var profileVisibilityMembershipStatusSchema = z2.enum(["active", "removed"]);
-var passthroughObject = (shape) => z2.object(shape).passthrough();
-var taskStatusSchema = z2.enum(["todo", "in_progress", "in_review", "done", "closed"]);
+var optionalStringSchema = z3.string().trim().optional();
+var optionalStringArraySchema = z3.array(z3.string().trim().min(1)).optional();
+var optionalBooleanSchema = z3.boolean().optional();
+var optionalNumberSchema = z3.number().finite().optional();
+var nullableStringSchema = z3.string().nullable();
+var nullableNumberSchema = z3.number().finite().nullable();
+var optionalIsoTimestampSchema = z3.string().datetime().optional();
+var agentStatusSchema = z3.enum(["active", "inactive", "stopped"]);
+var reminderStatusSchema = z3.enum(["scheduled", "fired", "canceled"]);
+var reminderEventTypeSchema = z3.enum(["scheduled", "fired", "snoozed", "updated", "canceled"]);
+var reasoningEffortSchema = z3.enum(["low", "medium", "high", "xhigh", "max", "ultra"]);
+var profileVisibilityMembershipStatusSchema = z3.enum(["active", "left", "removed"]);
+var passthroughObject = (shape) => z3.object(shape).passthrough();
+var taskStatusSchema = z3.enum(["todo", "in_progress", "in_review", "done", "closed"]);
 var agentApiEventsQuerySchema = passthroughObject({
   since: optionalStringSchema,
   limit: optionalStringSchema
 });
 var agentApiHistoryQuerySchema = passthroughObject({
-  channel: z2.string().trim().min(1),
+  channel: z3.string().trim().min(1),
   before: optionalStringSchema,
   after: optionalStringSchema,
   around: optionalStringSchema,
   limit: optionalStringSchema
 });
 var agentApiKnowledgeGetQuerySchema = passthroughObject({
-  topic: z2.string().trim().min(1),
+  topic: z3.string().trim().min(1),
   reason: optionalStringSchema,
   turn_id: optionalStringSchema,
   trace_id: optionalStringSchema
 });
 var agentApiKnowledgeGetResponseSchema = passthroughObject({
-  ok: z2.literal(true),
-  docId: z2.string(),
-  topicOrPath: z2.string(),
-  docVersion: z2.string(),
-  docState: z2.string(),
-  contentType: z2.string(),
-  content: z2.string()
+  ok: z3.literal(true),
+  docId: z3.string(),
+  topicOrPath: z3.string(),
+  docVersion: z3.string(),
+  docState: z3.string(),
+  contentType: z3.string(),
+  content: z3.string()
 });
 var agentApiKnowledgeSearchQuerySchema = passthroughObject({
-  query: z2.string().trim().min(1),
+  query: z3.string().trim().min(1),
   scope: optionalStringSchema,
   reason: optionalStringSchema,
   turn_id: optionalStringSchema,
   trace_id: optionalStringSchema
 });
 var agentApiKnowledgeSearchResultSchema = passthroughObject({
-  slug: z2.string(),
-  title: z2.string(),
-  firstScreen: z2.string()
+  slug: z3.string(),
+  title: z3.string(),
+  firstScreen: z3.string()
 });
 var agentApiKnowledgeSearchResponseSchema = passthroughObject({
-  ok: z2.literal(true),
-  query: z2.string(),
-  scope: z2.string().nullable(),
-  results: z2.array(agentApiKnowledgeSearchResultSchema)
+  ok: z3.literal(true),
+  query: z3.string(),
+  scope: z3.string().nullable(),
+  results: z3.array(agentApiKnowledgeSearchResultSchema)
 });
 var agentApiMessageSearchQuerySchema = passthroughObject({
   q: optionalStringSchema,
   channel: optionalStringSchema,
   sender: optionalStringSchema,
   senderId: optionalStringSchema,
-  sort: z2.enum(["relevance", "recent"]).optional(),
+  sort: z3.enum(["relevance", "recent"]).optional(),
   before: optionalStringSchema,
   after: optionalStringSchema,
   limit: optionalStringSchema,
   offset: optionalStringSchema
 });
 var agentApiSendBodySchema = passthroughObject({
-  target: z2.string().optional(),
-  content: z2.string().optional(),
+  target: z3.string().optional(),
+  content: z3.string().optional(),
   attachmentIds: optionalStringArraySchema,
   idempotencyKey: optionalStringSchema,
   continue: optionalBooleanSchema,
@@ -2098,107 +2189,111 @@ var agentApiSendBodySchema = passthroughObject({
   draftReplacedExisting: optionalBooleanSchema,
   seenUpToSeq: optionalNumberSchema
 });
+var legacyAgentSendBodySchema = agentApiSendBodySchema.extend({
+  channel: z3.string().optional(),
+  dm_to: z3.string().optional()
+});
 var agentApiMessageResolveParamsSchema = passthroughObject({
-  msgId: z2.string().trim().min(1).transform(asMessageId)
+  msgId: z3.string().trim().min(1).transform(asMessageId)
 });
 var agentApiMessageReactionParamsSchema = passthroughObject({
-  msgId: z2.string().trim().min(1).transform(asMessageId)
+  msgId: z3.string().trim().min(1).transform(asMessageId)
 });
 var agentApiMessageReactionBodySchema = passthroughObject({
-  emoji: z2.string().trim().min(1).max(16).refine((value) => !/\s/.test(value), {
+  emoji: z3.string().trim().min(1).max(16).refine((value) => !/\s/.test(value), {
     message: "A single reaction emoji is required"
   })
 });
 var agentApiChannelMembershipParamsSchema = passthroughObject({
-  channelId: z2.string().trim().min(1).transform(asChannelId)
+  channelId: z3.string().trim().min(1).transform(asChannelId)
 });
 var agentApiAttachmentDownloadParamsSchema = passthroughObject({
-  attachmentId: z2.string().trim().min(1)
+  attachmentId: z3.string().trim().min(1)
 });
 var agentApiAttachmentCommentsParamsSchema = passthroughObject({
-  attachmentId: z2.string().trim().min(1)
+  attachmentId: z3.string().trim().min(1)
 });
 var agentApiAttachmentCommentsQuerySchema = passthroughObject({
   limit: optionalStringSchema
 });
 var agentApiAttachmentCommentAnchorSchema = passthroughObject({
-  type: z2.string().trim().min(1),
-  data: z2.record(z2.string(), z2.unknown())
+  type: z3.string().trim().min(1),
+  data: z3.record(z3.string(), z3.unknown())
 });
 var agentApiAttachmentCommentReactionSchema = passthroughObject({
-  emoji: z2.string().trim().min(1),
-  reactorType: z2.string().trim().min(1),
-  reactorId: z2.string().trim().min(1),
-  createdAt: z2.string().datetime()
+  emoji: z3.string().trim().min(1),
+  reactorType: z3.string().trim().min(1),
+  reactorId: z3.string().trim().min(1),
+  createdAt: z3.string().datetime()
 });
 var agentApiAttachmentCommentResolvedBySchema = passthroughObject({
-  reactorId: z2.string().trim().min(1),
-  reactorType: z2.string().trim().min(1)
+  reactorId: z3.string().trim().min(1),
+  reactorType: z3.string().trim().min(1)
 });
 var agentApiAttachmentCommentSchema = passthroughObject({
-  id: z2.string().trim().min(1),
-  channelId: z2.string().trim().min(1).optional(),
-  senderId: z2.string().trim().min(1),
-  senderType: z2.enum(["user", "agent"]),
-  senderName: z2.string().trim().min(1),
+  id: z3.string().trim().min(1),
+  channelId: z3.string().trim().min(1).optional(),
+  senderId: z3.string().trim().min(1),
+  senderType: z3.enum(["user", "agent"]),
+  senderName: z3.string().trim().min(1),
   senderAvatarUrl: nullableStringSchema.optional(),
   senderGravatarHash: nullableStringSchema.optional(),
-  content: z2.string(),
-  createdAt: z2.string().datetime(),
-  reactions: z2.array(agentApiAttachmentCommentReactionSchema),
+  content: z3.string(),
+  createdAt: z3.string().datetime(),
+  reactions: z3.array(agentApiAttachmentCommentReactionSchema),
   anchor: agentApiAttachmentCommentAnchorSchema.nullable(),
-  resolved: z2.boolean().optional(),
+  resolved: z3.boolean().optional(),
   resolvedBy: agentApiAttachmentCommentResolvedBySchema.nullable().optional(),
-  resolvedAt: z2.string().datetime().nullable().optional()
+  resolvedAt: z3.string().datetime().nullable().optional()
 });
 var agentApiAttachmentCommentsResponseSchema = passthroughObject({
-  comments: z2.array(agentApiAttachmentCommentSchema),
+  comments: z3.array(agentApiAttachmentCommentSchema),
   threadChannelId: nullableStringSchema.optional(),
   viewer: passthroughObject({
-    canComment: z2.boolean(),
-    reason: z2.string().optional(),
-    canResolve: z2.boolean(),
+    canComment: z3.boolean(),
+    reason: z3.string().optional(),
+    canResolve: z3.boolean(),
     resolveAction: passthroughObject({
-      type: z2.string().trim().min(1),
-      emoji: z2.string().trim().min(1)
+      type: z3.string().trim().min(1),
+      emoji: z3.string().trim().min(1)
     }).optional()
   }).optional()
 });
 var agentApiChannelMembersQuerySchema = passthroughObject({
-  channel: z2.string().trim().min(1)
+  channel: z3.string().trim().min(1)
 });
 var agentApiResolveChannelBodySchema = passthroughObject({
-  target: z2.string().trim().min(1)
+  target: z3.string().trim().min(1)
 });
 var agentApiResolveChannelResponseSchema = passthroughObject({
-  channelId: z2.string().trim().min(1)
+  channelId: z3.string().trim().min(1)
 });
 var agentApiThreadUnfollowBodySchema = passthroughObject({
-  thread: z2.string().trim().min(1),
-  reason: z2.string().trim().min(1).max(200).optional()
+  thread: z3.string().trim().min(1),
+  reason: z3.string().trim().min(1).max(200).optional()
 });
 var agentApiTaskClaimBodySchema = passthroughObject({
-  channel: z2.string().trim().min(1),
-  task_numbers: z2.array(z2.number().int().positive()).optional(),
+  channel: z3.string().trim().min(1),
+  task_numbers: z3.array(z3.number().int().positive()).optional(),
   message_ids: optionalStringArraySchema
 });
 var agentApiTaskListQuerySchema = passthroughObject({
-  channel: z2.string().trim().min(1),
-  status: z2.union([taskStatusSchema, z2.literal("all")]).optional()
+  channel: z3.string().trim().min(1),
+  status: z3.union([taskStatusSchema, z3.literal("all")]).optional()
 });
 var agentApiTaskCreateBodySchema = passthroughObject({
-  channel: z2.string().trim().min(1),
-  tasks: z2.array(passthroughObject({
-    title: z2.string().trim().min(1)
+  channel: z3.string().trim().min(1),
+  tasks: z3.array(passthroughObject({
+    title: z3.string().trim().min(1)
   })).min(1)
 });
 var agentApiTaskUnclaimBodySchema = passthroughObject({
-  channel: z2.string().trim().min(1),
-  task_number: z2.number().int().positive()
+  channel: z3.string().trim().min(1),
+  task_number: z3.number().int().positive()
 });
 var agentApiTaskUpdateStatusBodySchema = passthroughObject({
-  channel: z2.string().trim().min(1),
-  task_number: z2.number().int().positive(),
+  channel: z3.string().trim().min(1),
+  task_number: z3.number().int().positive(),
   status: taskStatusSchema
 });
 var agentApiReminderListQuerySchema = passthroughObject({
@@ -2206,20 +2301,20 @@ var agentApiReminderListQuerySchema = passthroughObject({
   all: optionalStringSchema
 });
 var agentApiReminderParamsSchema = passthroughObject({
-  reminderId: z2.string().trim().min(1)
+  reminderId: z3.string().trim().min(1)
 });
 var agentApiReminderScheduleBodySchema = passthroughObject({
-  title: z2.string(),
+  title: z3.string(),
   fireAt: optionalStringSchema,
   delaySeconds: optionalNumberSchema,
-  msgId: z2.string().nullable().optional(),
-  payload: z2.unknown().optional(),
+  msgId: z3.string().nullable().optional(),
+  payload: z3.unknown().optional(),
   repeat: optionalStringSchema,
   tz: optionalStringSchema,
   channel: optionalStringSchema
 });
 var agentApiReminderSnoozeBodySchema = passthroughObject({
-  delaySeconds: z2.number().finite()
+  delaySeconds: z3.number().finite()
 });
 var agentApiReminderUpdateBodySchema = passthroughObject({
   fireAt: optionalStringSchema,
@@ -2237,58 +2332,58 @@ var agentApiProfileUpdateBodySchema = passthroughObject({
   description: optionalStringSchema
 });
 var agentApiProfileCreatedAgentSchema = passthroughObject({
-  id: z2.string(),
-  name: z2.string(),
+  id: z3.string(),
+  name: z3.string(),
   displayName: nullableStringSchema,
   avatarUrl: nullableStringSchema,
-  runtime: z2.string(),
+  runtime: z3.string(),
   status: agentStatusSchema
 });
-var agentApiProfileCreatorSchema = z2.union([
+var agentApiProfileCreatorSchema = z3.union([
   passthroughObject({
-    type: z2.literal("human"),
-    id: z2.string(),
-    name: z2.string(),
+    type: z3.literal("human"),
+    id: z3.string(),
+    name: z3.string(),
     displayName: nullableStringSchema,
     avatarUrl: nullableStringSchema,
-    gravatarHash: z2.string()
+    gravatarHash: z3.string()
   }),
   passthroughObject({
-    type: z2.literal("agent"),
-    id: z2.string(),
-    name: z2.string(),
+    type: z3.literal("agent"),
+    id: z3.string(),
+    name: z3.string(),
     displayName: nullableStringSchema,
     avatarUrl: nullableStringSchema,
     deletedAt: nullableStringSchema
   })
 ]);
-var agentApiProfileViewSchema = z2.discriminatedUnion("kind", [
+var agentApiProfileViewSchema = z3.discriminatedUnion("kind", [
   passthroughObject({
-    kind: z2.literal("human"),
-    id: z2.string(),
-    isSelf: z2.boolean(),
-    name: z2.string(),
+    kind: z3.literal("human"),
+    id: z3.string(),
+    isSelf: z3.boolean(),
+    name: z3.string(),
     displayName: nullableStringSchema,
     description: nullableStringSchema,
     avatarUrl: nullableStringSchema,
     email: nullableStringSchema,
-    role: z2.enum(["owner", "admin", "member"]).nullable(),
+    role: z3.enum(["owner", "admin", "member"]).nullable(),
     joinedAt: nullableStringSchema,
     membershipStatus: profileVisibilityMembershipStatusSchema,
-    createdAgents: z2.array(agentApiProfileCreatedAgentSchema)
+    createdAgents: z3.array(agentApiProfileCreatedAgentSchema)
   }),
   passthroughObject({
-    kind: z2.literal("agent"),
-    id: z2.string(),
-    isSelf: z2.boolean(),
-    name: z2.string(),
+    kind: z3.literal("agent"),
+    id: z3.string(),
+    isSelf: z3.boolean(),
+    name: z3.string(),
     displayName: nullableStringSchema,
     description: nullableStringSchema,
     avatarUrl: nullableStringSchema,
     status: agentStatusSchema,
-    serverRole: z2.enum(["owner", "admin", "member"]).nullable(),
-    runtime: z2.string(),
-    model: z2.string(),
+    serverRole: z3.enum(["owner", "admin", "member"]).nullable(),
+    runtime: z3.string(),
+    model: z3.string(),
     reasoningEffort: reasoningEffortSchema.nullable(),
     executionMode: nullableStringSchema,
     computerId: nullableStringSchema,
@@ -2296,20 +2391,20 @@ var agentApiProfileViewSchema = z2.discriminatedUnion("kind", [
     computerHostname: nullableStringSchema,
     daemonVersion: nullableStringSchema,
     creator: agentApiProfileCreatorSchema.nullable(),
-    createdAgents: z2.array(agentApiProfileCreatedAgentSchema),
-    createdAt: z2.string(),
+    createdAgents: z3.array(agentApiProfileCreatedAgentSchema),
+    createdAt: z3.string(),
     deletedAt: nullableStringSchema
   })
 ]);
 var agentApiIntegrationLoginBodySchema = passthroughObject({
-  service: z2.string().trim().min(1),
+  service: z3.string().trim().min(1),
   scopes: optionalStringArraySchema,
   target: optionalStringSchema
 });
 var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
-  mode: z2.enum(["register", "update"]),
-  target: z2.string().trim().min(1),
-  clientKey: z2.string().trim().min(1),
+  mode: z3.enum(["register", "update"]),
+  target: z3.string().trim().min(1),
+  clientKey: z3.string().trim().min(1),
   name: optionalStringSchema,
   description: optionalStringSchema,
   homepageUrl: optionalStringSchema,
@@ -2320,138 +2415,158 @@ var agentApiIntegrationAppPrepareBodySchema = passthroughObject({
   draftHint: optionalStringSchema
 });
 var agentApiIntegrationAppRotateSecretBodySchema = passthroughObject({
-  clientKey: z2.string().trim().min(1)
+  clientKey: z3.string().trim().min(1)
 });
 var agentApiActionPrepareBodySchema = passthroughObject({
-  target: z2.string().trim().min(1),
+  target: z3.string().trim().min(1),
   action: actionCardActionSchema
 });
 var agentApiServerInfoResponseSchema = passthroughObject({
   runtimeContext: passthroughObject({
-    agentId: z2.string(),
-    runtime: z2.string().optional(),
-    model: z2.string().optional(),
+    agentId: z3.string(),
+    runtime: z3.string().optional(),
+    model: z3.string().optional(),
     reasoningEffort: reasoningEffortSchema.nullable().optional(),
-    serverId: z2.string(),
-    machineId: z2.string().nullable().optional(),
-    machineName: z2.string().nullable().optional(),
-    machineDescription: z2.string().nullable().optional(),
-    machineHostname: z2.string().nullable().optional(),
-    machineOs: z2.string().nullable().optional(),
-    daemonVersion: z2.string().nullable().optional(),
-    workspacePath: z2.string().nullable().optional()
+    serverId: z3.string(),
+    machineId: z3.string().nullable().optional(),
+    machineName: z3.string().nullable().optional(),
+    machineDescription: z3.string().nullable().optional(),
+    machineHostname: z3.string().nullable().optional(),
+    machineOs: z3.string().nullable().optional(),
+    daemonVersion: z3.string().nullable().optional(),
+    workspacePath: z3.string().nullable().optional()
   }),
-  serverRole: z2.string().nullable().optional(),
+  serverRole: z3.string().nullable().optional(),
   serverCapabilities: passthroughObject({}).optional(),
-  channels: z2.array(passthroughObject({
-    id: z2.string().transform(asChannelId),
-    name: z2.string(),
-    joined: z2.boolean()
+  channels: z3.array(passthroughObject({
+    id: z3.string().transform(asChannelId),
+    name: z3.string(),
+    joined: z3.boolean()
   })),
-  agents: z2.array(passthroughObject({
-    name: z2.string(),
-    status: z2.string().optional(),
-    activity: z2.string().nullable().optional(),
-    activityDetail: z2.string().nullable().optional(),
-    role: z2.enum(["owner", "admin", "member"]).nullable().optional()
+  agents: z3.array(passthroughObject({
+    name: z3.string(),
+    status: z3.string().optional(),
+    activity: z3.string().nullable().optional(),
+    activityDetail: z3.string().nullable().optional(),
+    role: z3.enum(["owner", "admin", "member"]).nullable().optional()
   })),
-  humans: z2.array(passthroughObject({
-    name: z2.string(),
-    role: z2.enum(["owner", "admin", "member"]).nullable().optional()
+  humans: z3.array(passthroughObject({
+    name: z3.string(),
+    role: z3.enum(["owner", "admin", "member"]).nullable().optional()
   }))
 });
 var agentApiMentionActionsPendingQuerySchema = passthroughObject({
   limit: optionalStringSchema
 });
 var agentApiMentionActionEnvelopeSchema = passthroughObject({
-  resolutionId: z2.string()
+  resolutionId: z3.string()
+});
+var agentApiMentionActionResultSchema = passthroughObject({
+  resolutionId: z3.string(),
+  status: z3.enum([
+    "queued",
+    "delivered",
+    "dropped",
+    "stale",
+    "expired",
+    "no_permission",
+    "not_found",
+    "ambiguous"
+  ]),
+  action: z3.enum(["notify", "add"]).optional(),
+  reason: optionalStringSchema,
+  messageId: optionalStringSchema,
+  channelId: optionalStringSchema,
+  targetType: z3.enum(["user", "agent"]).optional(),
+  targetId: optionalStringSchema,
+  dedupedResolutionIds: optionalStringArraySchema
 });
 var agentApiMentionActionsPendingResponseSchema = passthroughObject({
-  pendingMentionActions: z2.array(agentApiMentionActionEnvelopeSchema),
-  has_more: z2.boolean().optional()
+  pendingMentionActions: z3.array(agentApiMentionActionEnvelopeSchema),
+  has_more: z3.boolean().optional()
 });
 var agentApiMentionActionsExecuteBodySchema = passthroughObject({
-  action: z2.enum(["notify", "add"]),
+  action: z3.enum(["notify", "add"]),
   resolutionIds: optionalStringArraySchema,
   ids: optionalStringArraySchema
 });
 var agentApiMentionActionsExecuteResponseSchema = passthroughObject({
-  ok: z2.literal(true),
-  action: z2.enum(["notify", "add"]),
-  results: z2.array(agentApiMentionActionEnvelopeSchema)
+  ok: z3.literal(true),
+  action: z3.enum(["notify", "add"]),
+  results: z3.array(agentApiMentionActionResultSchema)
 });
 var agentApiIntegrationServiceSchema = passthroughObject({
-  id: z2.string(),
-  clientId: z2.string(),
-  appType: z2.enum(["server_local", "slock_builtin", "third_party_global"]).optional(),
-  name: z2.string(),
+  id: z3.string(),
+  clientId: z3.string(),
+  appType: z3.enum(["server_local", "slock_builtin", "third_party_global"]).optional(),
+  name: z3.string(),
   description: nullableStringSchema,
   homepageUrl: nullableStringSchema,
   returnUrl: nullableStringSchema,
   agentManifestUrl: nullableStringSchema,
-  agentManifestUrlSource: z2.enum(["explicit", "well_known"]).nullable().optional(),
-  createdAt: z2.string(),
-  updatedAt: z2.string()
+  agentManifestUrlSource: z3.enum(["explicit", "well_known"]).nullable().optional(),
+  createdAt: z3.string(),
+  updatedAt: z3.string()
 });
 var agentApiActiveIntegrationLoginSchema = passthroughObject({
-  id: z2.string(),
-  serviceId: z2.string(),
-  clientId: z2.string(),
-  appType: z2.enum(["server_local", "slock_builtin", "third_party_global"]).optional(),
-  name: z2.string(),
+  id: z3.string(),
+  serviceId: z3.string(),
+  clientId: z3.string(),
+  appType: z3.enum(["server_local", "slock_builtin", "third_party_global"]).optional(),
+  name: z3.string(),
   description: nullableStringSchema,
   homepageUrl: nullableStringSchema,
   returnUrl: nullableStringSchema,
   agentManifestUrl: nullableStringSchema,
-  agentManifestUrlSource: z2.enum(["explicit", "well_known"]).nullable().optional(),
-  scopes: z2.array(z2.string()),
-  createdAt: z2.string()
+  agentManifestUrlSource: z3.enum(["explicit", "well_known"]).nullable().optional(),
+  scopes: z3.array(z3.string()),
+  createdAt: z3.string()
 });
 var agentApiIntegrationListResponseSchema = passthroughObject({
-  services: z2.array(agentApiIntegrationServiceSchema),
-  activeLogins: z2.array(agentApiActiveIntegrationLoginSchema)
+  services: z3.array(agentApiIntegrationServiceSchema),
+  activeLogins: z3.array(agentApiActiveIntegrationLoginSchema)
 });
 var agentApiIntegrationLoginResponseSchema = passthroughObject({
-  status: z2.enum(["logged_in", "already_logged_in", "approval_required"]),
+  status: z3.enum(["logged_in", "already_logged_in", "approval_required"]),
   service: agentApiIntegrationServiceSchema,
-  scopes: z2.array(z2.string()),
-  requestId: z2.string().optional(),
+  scopes: z3.array(z3.string()),
+  requestId: z3.string().optional(),
   session: passthroughObject({
-    status: z2.literal("stored"),
-    source: z2.enum(["cache", "fresh"]),
+    status: z3.literal("stored"),
+    source: z3.enum(["cache", "fresh"]),
     path: nullableStringSchema
   }).optional(),
   approval: passthroughObject({
-    requestId: z2.string(),
+    requestId: z3.string(),
     target: nullableStringSchema,
     actionCardMessageId: nullableStringSchema
   }).optional()
 });
 var agentApiIntegrationAppPrepareResponseSchema = passthroughObject({
-  status: z2.literal("prepared"),
-  mode: z2.enum(["register", "update"]),
-  target: z2.string(),
-  actionCardMessageId: z2.string(),
-  action: z2.discriminatedUnion("type", [
+  status: z3.literal("prepared"),
+  mode: z3.enum(["register", "update"]),
+  target: z3.string(),
+  actionCardMessageId: z3.string(),
+  action: z3.discriminatedUnion("type", [
     integrationRegisterAppOperationSchema,
     integrationUpdateAppRegistrationOperationSchema
   ])
 });
 var agentApiIntegrationAppRotateSecretResponseSchema = passthroughObject({
-  clientId: z2.string(),
-  clientKey: z2.string(),
-  clientName: z2.string(),
-  clientSecret: z2.string()
+  clientId: z3.string(),
+  clientKey: z3.string(),
+  clientName: z3.string(),
+  clientSecret: z3.string()
 });
 var agentApiAttachmentEnvelopeSchema = passthroughObject({
-  id: z2.string(),
-  filename: z2.string()
+  id: z3.string(),
+  filename: z3.string()
 });
 var agentApiAttachmentUploadResponseSchema = passthroughObject({
-  id: z2.string().trim().min(1),
-  filename: z2.string(),
+  id: z3.string().trim().min(1),
+  filename: z3.string(),
   mimeType: nullableStringSchema,
-  sizeBytes: z2.number().int().nonnegative(),
+  sizeBytes: z3.number().int().nonnegative(),
   thumbnailUrl: nullableStringSchema
 });
 var agentApiMessageEnvelopeSchema = passthroughObject({
@@ -2464,69 +2579,69 @@ var agentApiMessageEnvelopeSchema = passthroughObject({
   sender_type: optionalStringSchema,
   senderName: optionalStringSchema,
   sender_name: optionalStringSchema,
-  senderDescription: z2.string().nullable().optional(),
-  sender_description: z2.string().nullable().optional(),
+  senderDescription: z3.string().nullable().optional(),
+  sender_description: z3.string().nullable().optional(),
   channel_type: optionalStringSchema,
   channel_name: optionalStringSchema,
   parent_channel_type: optionalStringSchema,
   parent_channel_name: optionalStringSchema,
   content: optionalStringSchema,
-  attachments: z2.array(agentApiAttachmentEnvelopeSchema).optional(),
-  taskStatus: z2.string().nullable().optional(),
-  task_status: z2.string().nullable().optional(),
-  taskNumber: z2.number().int().positive().nullable().optional(),
-  task_number: z2.number().int().positive().nullable().optional(),
-  taskAssigneeId: z2.string().nullable().optional(),
-  task_assignee_id: z2.string().nullable().optional(),
-  taskAssigneeType: z2.string().nullable().optional(),
-  task_assignee_type: z2.string().nullable().optional(),
-  threadId: z2.string().nullable().optional(),
-  replyCount: z2.number().int().nonnegative().nullable().optional()
+  attachments: z3.array(agentApiAttachmentEnvelopeSchema).optional(),
+  taskStatus: z3.string().nullable().optional(),
+  task_status: z3.string().nullable().optional(),
+  taskNumber: z3.number().int().positive().nullable().optional(),
+  task_number: z3.number().int().positive().nullable().optional(),
+  taskAssigneeId: z3.string().nullable().optional(),
+  task_assignee_id: z3.string().nullable().optional(),
+  taskAssigneeType: z3.string().nullable().optional(),
+  task_assignee_type: z3.string().nullable().optional(),
+  threadId: z3.string().nullable().optional(),
+  replyCount: z3.number().int().nonnegative().nullable().optional()
 });
 var agentApiEventsResponseSchema = passthroughObject({
-  events: z2.array(agentApiMessageEnvelopeSchema),
+  events: z3.array(agentApiMessageEnvelopeSchema),
   last_seen_msgId: nullableStringSchema,
   last_seen_seq: nullableNumberSchema,
   reply_target: nullableStringSchema,
-  pending_notice_ids: z2.array(z2.string()),
-  wake_reason: z2.string().nullable(),
-  has_more: z2.boolean()
+  pending_notice_ids: z3.array(z3.string()),
+  wake_reason: z3.string().nullable(),
+  has_more: z3.boolean()
 });
 var agentApiHistoryResponseSchema = passthroughObject({
-  messages: z2.array(agentApiMessageEnvelopeSchema),
-  has_more: z2.boolean(),
-  has_older: z2.boolean(),
-  has_newer: z2.boolean(),
+  messages: z3.array(agentApiMessageEnvelopeSchema),
+  has_more: z3.boolean(),
+  has_older: z3.boolean(),
+  has_newer: z3.boolean(),
   last_read_seq: nullableNumberSchema.optional()
 });
 var agentApiHeldFreshnessResponseSchema = passthroughObject({
-  ok: z2.literal(true).optional(),
-  state: z2.literal("held"),
-  outcome: z2.literal("held").optional(),
-  subtype: z2.literal("freshness").optional(),
-  reason: z2.string().optional(),
-  decision: z2.enum(["local_hold", "syncing_hold"]).optional(),
+  ok: z3.literal(true).optional(),
+  state: z3.literal("held"),
+  outcome: z3.literal("held").optional(),
+  subtype: z3.literal("freshness").optional(),
+  reason: z3.string().optional(),
+  decision: z3.enum(["local_hold", "syncing_hold"]).optional(),
   producerFactId: optionalStringSchema,
-  available_actions: z2.array(z2.string()).optional(),
-  heldMessages: z2.array(agentApiMessageEnvelopeSchema).optional(),
-  recentUnread: z2.array(agentApiMessageEnvelopeSchema).optional(),
+  available_actions: z3.array(z3.string()).optional(),
+  heldMessages: z3.array(agentApiMessageEnvelopeSchema).optional(),
+  recentUnread: z3.array(agentApiMessageEnvelopeSchema).optional(),
   newMessageCount: optionalNumberSchema,
   shownMessageCount: optionalNumberSchema,
   omittedMessageCount: optionalNumberSchema,
   mentionAnnotation: passthroughObject({
-    formalMentionCount: z2.number().finite()
+    formalMentionCount: z3.number().finite()
   }).optional(),
   continueAnywaySuggested: optionalBooleanSchema,
   seenUpToSeq: optionalNumberSchema,
   seenUpToMessageId: nullableStringSchema.optional()
 });
 var agentApiSendSentResponseSchema = passthroughObject({
-  ok: z2.literal(true),
-  state: z2.literal("sent"),
-  messageId: z2.string(),
+  ok: z3.literal(true),
+  state: z3.literal("sent"),
+  messageId: z3.string(),
   messageSeq: optionalNumberSchema,
-  recentUnread: z2.array(agentApiMessageEnvelopeSchema).optional(),
-  pendingMentionActions: z2.array(agentApiMessageEnvelopeSchema).optional(),
+  recentUnread: z3.array(agentApiMessageEnvelopeSchema).optional(),
+  pendingMentionActions: z3.array(agentApiMessageEnvelopeSchema).optional(),
   attention: passthroughObject({
     driveByJoinedToPost: passthroughObject({
       reason: optionalStringSchema,
@@ -2535,7 +2650,7 @@ var agentApiSendSentResponseSchema = passthroughObject({
     }).optional()
   }).optional()
 });
-var agentApiSendResponseSchema = z2.discriminatedUnion("state", [
+var agentApiSendResponseSchema = z3.discriminatedUnion("state", [
   agentApiSendSentResponseSchema,
   agentApiHeldFreshnessResponseSchema
 ]);
@@ -2551,46 +2666,46 @@ var agentApiChannelAttentionSchema = passthroughObject({
   manageApi: optionalStringSchema
 });
 var agentApiOkResponseSchema = passthroughObject({
-  ok: z2.literal(true),
+  ok: z3.literal(true),
   attention: agentApiChannelAttentionSchema.optional()
 });
 var agentApiSearchResultSchema = passthroughObject({
-  id: z2.string(),
-  seq: z2.number().int().nonnegative(),
-  channelId: z2.string(),
-  threadId: z2.string().nullable(),
-  parentMessageId: z2.string().nullable(),
-  parentMessageContent: z2.string().nullable(),
-  parentChannelId: z2.string(),
-  parentChannelName: z2.string(),
-  parentChannelType: z2.string(),
+  id: z3.string(),
+  seq: z3.number().int().nonnegative(),
+  channelId: z3.string(),
+  threadId: z3.string().nullable(),
+  parentMessageId: z3.string().nullable(),
+  parentMessageContent: z3.string().nullable(),
+  parentChannelId: z3.string(),
+  parentChannelName: z3.string(),
+  parentChannelType: z3.string(),
   parentChannelArchivedAt: nullableStringSchema,
-  senderId: z2.string(),
-  senderType: z2.string(),
-  senderName: z2.string(),
-  channelName: z2.string(),
-  channelType: z2.string(),
+  senderId: z3.string(),
+  senderType: z3.string(),
+  senderName: z3.string(),
+  channelName: z3.string(),
+  channelType: z3.string(),
   channelArchivedAt: nullableStringSchema,
-  content: z2.string(),
-  snippet: z2.string(),
-  createdAt: z2.string().datetime()
+  content: z3.string(),
+  snippet: z3.string(),
+  createdAt: z3.string().datetime()
 });
 var agentApiMessageSearchResponseSchema = passthroughObject({
-  results: z2.array(agentApiSearchResultSchema),
-  hasMore: z2.boolean()
+  results: z3.array(agentApiSearchResultSchema),
+  hasMore: z3.boolean()
 });
 var agentApiChannelMembersResponseSchema = passthroughObject({
   channel: passthroughObject({
-    ref: z2.string(),
-    type: z2.string()
+    ref: z3.string(),
+    type: z3.string()
   }),
-  agents: z2.array(passthroughObject({
-    name: z2.string(),
+  agents: z3.array(passthroughObject({
+    name: z3.string(),
     status: optionalStringSchema
   })),
-  humans: z2.array(passthroughObject({
-    name: z2.string(),
-    description: z2.string().nullable().optional(),
+  humans: z3.array(passthroughObject({
+    name: z3.string(),
+    description: z3.string().nullable().optional(),
     role: optionalStringSchema
   }))
 });
@@ -2611,105 +2726,105 @@ var agentApiChannelMuteResponseSchema = passthroughObject({
 });
 var agentApiChannelMuteBodySchema = passthroughObject({
   attentionHintAccepted: passthroughObject({
-    schema: z2.literal(ATTENTION_HINT_SCHEMA),
-    trigger: z2.enum(["M2", "M3"]),
-    scope: z2.string().trim().min(1),
+    schema: z3.literal(ATTENTION_HINT_SCHEMA),
+    trigger: z3.enum(["M2", "M3"]),
+    scope: z3.string().trim().min(1),
     suggested_command: optionalStringSchema,
-    copy_version: z2.string().trim().min(1),
-    epoch_ms: z2.number().int().nonnegative()
+    copy_version: z3.string().trim().min(1),
+    epoch_ms: z3.number().int().nonnegative()
   }).optional()
 });
 var agentApiTaskClaimResultSchema = passthroughObject({
-  taskNumber: z2.number().int().positive().optional(),
+  taskNumber: z3.number().int().positive().optional(),
   messageId: optionalStringSchema,
-  success: z2.boolean(),
+  success: z3.boolean(),
   reason: optionalStringSchema
 });
 var agentApiTaskClaimSuccessResponseSchema = passthroughObject({
-  results: z2.array(agentApiTaskClaimResultSchema)
+  results: z3.array(agentApiTaskClaimResultSchema)
 });
-var agentApiTaskClaimResponseSchema = z2.union([
+var agentApiTaskClaimResponseSchema = z3.union([
   agentApiTaskClaimSuccessResponseSchema,
   agentApiHeldFreshnessResponseSchema
 ]);
 var agentApiTaskEnvelopeSchema = passthroughObject({
-  taskNumber: z2.number().int().positive().optional(),
-  status: z2.string().optional(),
+  taskNumber: z3.number().int().positive().optional(),
+  status: z3.string().optional(),
   title: optionalStringSchema,
-  claimedByName: z2.string().nullable().optional(),
-  createdByName: z2.string().nullable().optional(),
-  messageId: z2.string().nullable().optional(),
+  claimedByName: z3.string().nullable().optional(),
+  createdByName: z3.string().nullable().optional(),
+  messageId: z3.string().nullable().optional(),
   isLegacy: optionalBooleanSchema
 });
 var agentApiTaskListResponseSchema = passthroughObject({
-  tasks: z2.array(agentApiTaskEnvelopeSchema)
+  tasks: z3.array(agentApiTaskEnvelopeSchema)
 });
 var agentApiCreatedTaskEnvelopeSchema = passthroughObject({
-  taskNumber: z2.number().int().positive(),
-  messageId: z2.string(),
-  title: z2.string()
+  taskNumber: z3.number().int().positive(),
+  messageId: z3.string(),
+  title: z3.string()
 });
 var agentApiTaskCreateResponseSchema = passthroughObject({
-  tasks: z2.array(agentApiCreatedTaskEnvelopeSchema)
+  tasks: z3.array(agentApiCreatedTaskEnvelopeSchema)
 });
 var agentApiTaskUnclaimResponseSchema = passthroughObject({
-  ok: z2.literal(true)
+  ok: z3.literal(true)
 });
 var agentApiTaskUpdateStatusSuccessResponseSchema = passthroughObject({
-  ok: z2.literal(true)
+  ok: z3.literal(true)
 });
-var agentApiTaskUpdateStatusResponseSchema = z2.union([
+var agentApiTaskUpdateStatusResponseSchema = z3.union([
   agentApiTaskUpdateStatusSuccessResponseSchema,
   agentApiHeldFreshnessResponseSchema
 ]);
 var agentApiActionPrepareResponseSchema = passthroughObject({
-  messageId: z2.string(),
+  messageId: z3.string(),
   metadata: passthroughObject({
-    kind: z2.literal("action-card")
+    kind: z3.literal("action-card")
   })
 });
-var agentApiReminderRecurrenceSchema = z2.object({
-  kind: z2.enum(["interval", "daily", "weekly", "unsupported"]),
-  description: z2.string()
+var agentApiReminderRecurrenceSchema = z3.object({
+  kind: z3.enum(["interval", "daily", "weekly", "unsupported"]),
+  description: z3.string()
 });
-var agentApiReminderSummarySchema = z2.object({
-  reminderId: z2.string(),
-  ownerAgentId: z2.string(),
-  title: z2.string(),
-  fireAt: z2.string(),
+var agentApiReminderSummarySchema = z3.object({
+  reminderId: z3.string(),
+  ownerAgentId: z3.string(),
+  title: z3.string(),
+  fireAt: z3.string(),
   firedAt: nullableStringSchema.optional(),
-  createdAt: z2.string(),
+  createdAt: z3.string(),
   status: reminderStatusSchema,
   msgRef: nullableStringSchema,
   msgPermalink: nullableStringSchema,
   recurrence: agentApiReminderRecurrenceSchema.nullable()
 });
-var agentApiReminderEventSummarySchema = z2.object({
-  eventId: z2.string(),
-  reminderId: z2.string(),
+var agentApiReminderEventSummarySchema = z3.object({
+  eventId: z3.string(),
+  reminderId: z3.string(),
   eventType: reminderEventTypeSchema,
-  actorType: z2.enum(["agent", "human", "system"]),
+  actorType: z3.enum(["agent", "human", "system"]),
   actorId: nullableStringSchema,
-  occurredAt: z2.string(),
+  occurredAt: z3.string(),
   nextFireAt: nullableStringSchema,
-  metadata: z2.record(z2.string(), z2.unknown()).nullable()
+  metadata: z3.record(z3.string(), z3.unknown()).nullable()
 });
 var agentApiReminderListResponseSchema = passthroughObject({
-  reminders: z2.array(agentApiReminderSummarySchema)
+  reminders: z3.array(agentApiReminderSummarySchema)
 });
 var agentApiReminderResponseSchema = passthroughObject({
   reminder: agentApiReminderSummarySchema,
   warning: optionalStringSchema
 });
 var agentApiReminderLogResponseSchema = passthroughObject({
-  events: z2.array(agentApiReminderEventSummarySchema)
+  events: z3.array(agentApiReminderEventSummarySchema)
 });
-var agentApiMigrationStateSchema = z2.enum(["provisioning", "prep", "ready", "in_transit", "arriving", "completed", "aborted", "failed"]);
+var agentApiMigrationStateSchema = z3.enum(["provisioning", "prep", "ready", "in_transit", "arriving", "completed", "aborted", "failed"]);
 var agentApiMigrationSummarySchema = passthroughObject({
-  id: z2.string(),
-  agentId: z2.string(),
-  sourceMachineId: z2.string(),
-  targetMachineId: z2.string(),
+  id: z3.string(),
+  agentId: z3.string(),
+  sourceMachineId: z3.string(),
+  targetMachineId: z3.string(),
   state: agentApiMigrationStateSchema,
   manifestPath: nullableStringSchema,
   manifestSha256: nullableStringSchema,
@@ -2717,26 +2832,26 @@ var agentApiMigrationSummarySchema = passthroughObject({
   arrivalReportSha256: nullableStringSchema,
   abortReason: nullableStringSchema,
   failureReason: nullableStringSchema,
-  prepDeadlineAt: z2.string().datetime(),
-  transferDeadlineAt: z2.string().datetime(),
-  arrivalDeadlineAt: z2.string().datetime(),
+  prepDeadlineAt: z3.string().datetime(),
+  transferDeadlineAt: z3.string().datetime(),
+  arrivalDeadlineAt: z3.string().datetime(),
   readyAt: nullableStringSchema,
   flippedAt: nullableStringSchema,
   arrivedAt: nullableStringSchema,
   completedAt: nullableStringSchema,
   abortedAt: nullableStringSchema,
-  revision: z2.number().int().positive(),
-  createdAt: z2.string().datetime(),
-  updatedAt: z2.string().datetime()
+  revision: z3.number().int().positive(),
+  createdAt: z3.string().datetime(),
+  updatedAt: z3.string().datetime()
 });
 var agentApiMigrationBeginBodySchema = passthroughObject({
-  targetMachineId: z2.string().trim().min(1),
-  prepDeadlineMs: z2.number().int().positive().optional(),
-  transferDeadlineMs: z2.number().int().positive().optional(),
-  arrivalDeadlineMs: z2.number().int().positive().optional()
+  targetMachineId: z3.string().trim().min(1),
+  prepDeadlineMs: z3.number().int().positive().optional(),
+  transferDeadlineMs: z3.number().int().positive().optional(),
+  arrivalDeadlineMs: z3.number().int().positive().optional()
 });
 var agentApiMigrationReadyBodySchema = passthroughObject({
-  manifestPath: z2.string().trim().min(1),
+  manifestPath: z3.string().trim().min(1),
   manifestSha256: optionalStringSchema
 });
 var agentApiMigrationArrivedBodySchema = passthroughObject({
@@ -3215,47 +3330,47 @@ var agentApiContract = {
 };
 
 // ../shared/src/daemonApiContract.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var DAEMON_API_BASE_PATH = "/internal/agent-api";
-var optionalStringSchema2 = z3.string().trim().optional();
-var optionalNonNegativeIntSchema = z3.number().int().nonnegative().optional();
-var optionalQueryIntSchema = z3.union([z3.number().int().nonnegative(), z3.string().trim().min(1)]).optional();
-var nullableNumberSchema2 = z3.number().finite().nullable();
-var passthroughObject2 = (shape) => z3.object(shape).passthrough();
-var daemonApiInboxFlagSchema = z3.enum(["mention", "thread", "dm", "task"]);
+var optionalStringSchema2 = z4.string().trim().optional();
+var optionalNonNegativeIntSchema = z4.number().int().nonnegative().optional();
+var optionalQueryIntSchema = z4.union([z4.number().int().nonnegative(), z4.string().trim().min(1)]).optional();
+var nullableNumberSchema2 = z4.number().finite().nullable();
+var passthroughObject2 = (shape) => z4.object(shape).passthrough();
+var daemonApiInboxFlagSchema = z4.enum(["mention", "thread", "dm", "task"]);
 var daemonApiAttentionHintSchema = passthroughObject2({
-  schema: z3.literal(ATTENTION_HINT_SCHEMA),
-  trigger: z3.enum(["M2", "M3"]),
-  scope: z3.string().trim().min(1),
-  suggested_command: z3.string().trim().min(1),
-  copy: z3.string().trim().min(1),
-  copy_version: z3.literal("attention-hint-copy-v1"),
-  epoch_ms: z3.number().int().nonnegative(),
+  schema: z4.literal(ATTENTION_HINT_SCHEMA),
+  trigger: z4.enum(["M2", "M3"]),
+  scope: z4.string().trim().min(1),
+  suggested_command: z4.string().trim().min(1),
+  copy: z4.string().trim().min(1),
+  copy_version: z4.literal("attention-hint-copy-v1"),
+  epoch_ms: z4.number().int().nonnegative(),
   thresholds: passthroughObject2({
     K: optionalNonNegativeIntSchema,
     k: optionalNonNegativeIntSchema,
-    window_ms: z3.number().int().positive()
+    window_ms: z4.number().int().positive()
   })
 });
 var daemonApiInboxTargetRowSchema = passthroughObject2({
-  target: z3.string().trim().min(1),
+  target: z4.string().trim().min(1),
   channelId: optionalStringSchema2,
   channelType: optionalStringSchema2,
-  pendingCount: z3.number().int().nonnegative(),
+  pendingCount: z4.number().int().nonnegative(),
   firstPendingMsgId: optionalStringSchema2,
   firstPendingSeq: optionalNonNegativeIntSchema,
   latestMsgId: optionalStringSchema2,
   latestSeq: optionalNonNegativeIntSchema,
   latestSenderName: optionalStringSchema2,
-  latestSenderType: z3.enum(["human", "agent", "system", "third_party_app"]).optional(),
-  flags: z3.array(daemonApiInboxFlagSchema),
+  latestSenderType: z4.enum(["human", "agent", "system", "third_party_app"]).optional(),
+  flags: z4.array(daemonApiInboxFlagSchema),
   attentionHint: daemonApiAttentionHintSchema.optional()
 });
 var daemonApiInboxCheckResponseSchema = passthroughObject2({
-  rows: z3.array(daemonApiInboxTargetRowSchema).optional()
+  rows: z4.array(daemonApiInboxTargetRowSchema).optional()
 });
 var daemonApiWakeHintsQuerySchema = passthroughObject2({
-  since: z3.union([z3.literal("latest"), z3.number().int().nonnegative(), z3.string().trim().min(1)]).optional(),
+  since: z4.union([z4.literal("latest"), z4.number().int().nonnegative(), z4.string().trim().min(1)]).optional(),
   limit: optionalQueryIntSchema
 });
 var daemonApiWakeHintSchema = passthroughObject2({
@@ -3263,8 +3378,8 @@ var daemonApiWakeHintSchema = passthroughObject2({
   hint_id: optionalStringSchema2,
   eventId: optionalStringSchema2,
   event_id: optionalStringSchema2,
-  messageId: z3.string().nullable().optional(),
-  message_id: z3.string().nullable().optional(),
+  messageId: z4.string().nullable().optional(),
+  message_id: z4.string().nullable().optional(),
   seq: optionalNonNegativeIntSchema,
   id: optionalStringSchema2,
   target: optionalStringSchema2,
@@ -3277,27 +3392,27 @@ var daemonApiWakeHintSchema = passthroughObject2({
   created_at: optionalStringSchema2
 });
 var daemonApiWakeHintsFetchResponseSchema = passthroughObject2({
-  hints: z3.array(daemonApiWakeHintSchema).optional(),
-  wake_hints: z3.array(daemonApiWakeHintSchema).optional(),
+  hints: z4.array(daemonApiWakeHintSchema).optional(),
+  wake_hints: z4.array(daemonApiWakeHintSchema).optional(),
   last_seen_hint_seq: nullableNumberSchema2.optional(),
   last_hint_seq: nullableNumberSchema2.optional(),
-  has_more: z3.boolean().optional()
+  has_more: z4.boolean().optional()
 });
 var daemonApiActivityEventSchema = passthroughObject2({
   schema: optionalStringSchema2
 });
 var daemonApiActivityForwardBodySchema = passthroughObject2({
-  schema: z3.literal("raft-agent-activity-ingest.v1"),
+  schema: z4.literal("raft-agent-activity-ingest.v1"),
   coreSessionId: optionalStringSchema2,
   adapterInstance: optionalStringSchema2,
-  events: z3.array(daemonApiActivityEventSchema),
+  events: z4.array(daemonApiActivityEventSchema),
   dropped: optionalNonNegativeIntSchema
 });
 var daemonApiActivityForwardResponseSchema = passthroughObject2({
-  ok: z3.literal(true).optional(),
-  acceptedCount: z3.number().int().nonnegative().optional(),
-  rejectedCount: z3.number().int().nonnegative().optional(),
-  droppedCount: z3.number().int().nonnegative().optional()
+  ok: z4.literal(true).optional(),
+  acceptedCount: z4.number().int().nonnegative().optional(),
+  rejectedCount: z4.number().int().nonnegative().optional(),
+  droppedCount: z4.number().int().nonnegative().optional()
 });
 function route2(input) {
   return {
@@ -3391,7 +3506,7 @@ function formatAttentionHintField(hint) {
 }
 
 // ../shared/src/externalAgentIntegration.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var EXTERNAL_AGENT_COMMS_PROTOCOL_VERSION = "agent-comms-core.v1";
 var EXTERNAL_AGENT_PROOF_SCHEMA_VERSION = "agent-proof.v1";
 var EXTERNAL_RUNTIME_INTEGRATION_MANIFEST_SCHEMA = "slock-external-runtime-integration.v1";
@@ -3435,35 +3550,35 @@ var externalAgentAdapterFailureValues = [
   "auth_revoked"
 ];
 var externalAgentServerApiModeValues = ["interim-agent-api-events", "agent-inbox-protocol"];
-var nonEmptyStringSchema = z4.string().min(1);
-var isoTimestampSchema = z4.string().refine((value) => !Number.isNaN(Date.parse(value)), {
+var nonEmptyStringSchema = z5.string().min(1);
+var isoTimestampSchema = z5.string().refine((value) => !Number.isNaN(Date.parse(value)), {
   message: "must be a parseable timestamp"
 });
-var externalRuntimeIntegrationManifestSchema = z4.object({
-  schema: z4.literal(EXTERNAL_RUNTIME_INTEGRATION_MANIFEST_SCHEMA),
+var externalRuntimeIntegrationManifestSchema = z5.object({
+  schema: z5.literal(EXTERNAL_RUNTIME_INTEGRATION_MANIFEST_SCHEMA),
   runtimeId: nonEmptyStringSchema,
-  integrationPattern: z4.enum(externalAgentIntegrationPatternValues),
-  commsMode: z4.enum(externalAgentCommsModeValues),
-  commsProtocolVersion: z4.literal(EXTERNAL_AGENT_COMMS_PROTOCOL_VERSION),
-  proofSchemaVersion: z4.literal(EXTERNAL_AGENT_PROOF_SCHEMA_VERSION),
+  integrationPattern: z5.enum(externalAgentIntegrationPatternValues),
+  commsMode: z5.enum(externalAgentCommsModeValues),
+  commsProtocolVersion: z5.literal(EXTERNAL_AGENT_COMMS_PROTOCOL_VERSION),
+  proofSchemaVersion: z5.literal(EXTERNAL_AGENT_PROOF_SCHEMA_VERSION),
   minSlockCliVersion: nonEmptyStringSchema,
-  multiplex: z4.boolean(),
-  agentIsolation: z4.enum(externalAgentIsolationValues),
-  bridgeLifecycle: z4.object({
-    explicitStartOnly: z4.literal(true),
-    oneShotCommandsBridgeIndependent: z4.literal(true),
-    requiresBridgeFailureCodes: z4.array(z4.enum(["BRIDGE_NOT_RUNNING", "NO_CORE_SESSION"])).min(1),
-    autoStartDefault: z4.literal(false)
+  multiplex: z5.boolean(),
+  agentIsolation: z5.enum(externalAgentIsolationValues),
+  bridgeLifecycle: z5.object({
+    explicitStartOnly: z5.literal(true),
+    oneShotCommandsBridgeIndependent: z5.literal(true),
+    requiresBridgeFailureCodes: z5.array(z5.enum(["BRIDGE_NOT_RUNNING", "NO_CORE_SESSION"])).min(1),
+    autoStartDefault: z5.literal(false)
   }).strict(),
-  serverApi: z4.object({
-    mode: z4.enum(externalAgentServerApiModeValues),
-    deliveryOnly: z4.boolean(),
-    cursorAuthority: z4.literal("model_seen_only")
+  serverApi: z5.object({
+    mode: z5.enum(externalAgentServerApiModeValues),
+    deliveryOnly: z5.boolean(),
+    cursorAuthority: z5.literal("model_seen_only")
   }).strict(),
-  wakeAdapter: z4.object({
-    kind: z4.enum(externalAgentWakeAdapterKindValues),
+  wakeAdapter: z5.object({
+    kind: z5.enum(externalAgentWakeAdapterKindValues),
     protocol: nonEmptyStringSchema,
-    requiresInteractiveSession: z4.boolean().optional()
+    requiresInteractiveSession: z5.boolean().optional()
   }).strict()
 }).strict().superRefine((value, ctx) => {
   if (!value.bridgeLifecycle.requiresBridgeFailureCodes.includes("BRIDGE_NOT_RUNNING")) {
@@ -3488,8 +3603,8 @@ var externalRuntimeIntegrationManifestSchema = z4.object({
     });
   }
 });
-var externalAgentWakeEventBaseSchema = z4.object({
-  schema: z4.literal(EXTERNAL_AGENT_WAKE_EVENT_SCHEMA),
+var externalAgentWakeEventBaseSchema = z5.object({
+  schema: z5.literal(EXTERNAL_AGENT_WAKE_EVENT_SCHEMA),
   eventId: nonEmptyStringSchema,
   attemptId: nonEmptyStringSchema,
   messageId: nonEmptyStringSchema,
@@ -3499,30 +3614,30 @@ var externalAgentWakeEventBaseSchema = z4.object({
   adapterInstance: nonEmptyStringSchema,
   runtimeSession: nonEmptyStringSchema.nullable(),
   occurredAt: isoTimestampSchema,
-  lifecycleState: z4.enum(externalAgentCommsLifecycleStateValues),
-  authority: z4.object({
-    source: z4.enum(externalAgentLifecycleSourceValues),
-    provenance: z4.enum(externalAgentLifecycleProvenanceValues)
+  lifecycleState: z5.enum(externalAgentCommsLifecycleStateValues),
+  authority: z5.object({
+    source: z5.enum(externalAgentLifecycleSourceValues),
+    provenance: z5.enum(externalAgentLifecycleProvenanceValues)
   }).strict()
 }).strict();
 var externalAgentProofEventEnvelopeSchema = externalAgentWakeEventBaseSchema.extend({
-  kind: z4.literal("proof"),
-  proofLevel: z4.enum(externalAgentWakeProofLevelValues),
-  outcome: z4.literal("ok"),
-  failureMeta: z4.undefined().optional(),
-  reason: z4.string().optional()
+  kind: z5.literal("proof"),
+  proofLevel: z5.enum(externalAgentWakeProofLevelValues),
+  outcome: z5.literal("ok"),
+  failureMeta: z5.undefined().optional(),
+  reason: z5.string().optional()
 });
 var externalAgentFailedWakeEventEnvelopeSchema = externalAgentWakeEventBaseSchema.extend({
-  kind: z4.literal("wake_attempt"),
-  proofLevel: z4.undefined().optional(),
-  outcome: z4.literal("failed"),
-  failureMeta: z4.object({
-    failureClass: z4.enum(externalAgentAdapterFailureValues),
-    retryAfterMs: z4.number().int().positive().optional()
+  kind: z5.literal("wake_attempt"),
+  proofLevel: z5.undefined().optional(),
+  outcome: z5.literal("failed"),
+  failureMeta: z5.object({
+    failureClass: z5.enum(externalAgentAdapterFailureValues),
+    retryAfterMs: z5.number().int().positive().optional()
   }).strict(),
   reason: nonEmptyStringSchema
 });
-var externalAgentWakeEventEnvelopeSchema = z4.discriminatedUnion("kind", [
+var externalAgentWakeEventEnvelopeSchema = z5.discriminatedUnion("kind", [
   externalAgentProofEventEnvelopeSchema,
   externalAgentFailedWakeEventEnvelopeSchema
 ]);
@@ -3659,6 +3774,7 @@ var SERVER_CAPABILITY_MATRIX = {
 };
 
 // ../shared/src/index.ts
+var COMPUTER_CAPABILITY_SUPERVISOR_MUTATIONS = "computer:supervisor-mutations-v1";
 var RUNTIME_CONFIG_VERSION = 1;
 var BUILTIN_RUNTIME_PROVIDER_ENV_KEYS = PI_BUILTIN_PROVIDER_API_KEY_ENV_KEYS_GENERATED;
 var BUILTIN_RUNTIME_PROVIDERS = Object.entries(BUILTIN_RUNTIME_PROVIDER_ENV_KEYS).map(([id, envKey]) => ({ id, envKey }));
@@ -3710,6 +3826,10 @@ var AGENT_ACTIVITY_DETAIL_KINDS = [
   "ready",
   "runtime_interrupted",
   "machine_disconnected",
+  "computer_started",
+  "computer_restarted",
+  "computer_upgraded",
+  "computer_operation_failed",
   "daemon_activity",
   "external_activity",
   "synthetic_repair",
@@ -5143,6 +5263,15 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -6724,7 +6853,9 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
 ];
 var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
   "agent-token",
@@ -7079,7 +7210,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     SLOCK_SERVER_URL: ctx.config.serverUrl,
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -7392,6 +7523,46 @@ var ClaudeEventNormalizer = class {
   }
 };
 
+// src/drivers/claudeInputBudget.ts
+var CLAUDE_DEFAULT_CONTEXT_TOKENS = 2e5;
+var CLAUDE_FABLE_CONTEXT_TOKENS = 1e6;
+var CLAUDE_INPUT_TOKEN_RESERVE = 32e3;
+var ClaudeStartupPayloadTooLargeError = class extends Error {
+  constructor(details) {
+    super(
+      `INPUT_TOO_LARGE: Claude daemon-owned startup payload is too large before command launch (estimated ${details.estimatedTokens} tokens, budget ${details.budgetTokens}, context limit ${details.contextLimitTokens}, model ${details.model}). Reduce the current prompt or daemon-injected startup context before retrying.`
+    );
+    this.details = details;
+    this.name = "ClaudeStartupPayloadTooLargeError";
+  }
+};
+function assertClaudeStartupPayloadWithinBudget(config, input) {
+  const model = claudeModelName(config);
+  const contextLimitTokens = claudeContextLimitTokens(model);
+  const budgetTokens = Math.max(1, contextLimitTokens - CLAUDE_INPUT_TOKEN_RESERVE);
+  const estimatedTokens = estimateClaudeInputTokens(input);
+  if (estimatedTokens <= budgetTokens) return;
+  throw new ClaudeStartupPayloadTooLargeError({
+    estimatedTokens,
+    budgetTokens,
+    contextLimitTokens,
+    model
+  });
+}
+function estimateClaudeInputTokens(input) {
+  return Math.ceil(Buffer.byteLength(input, "utf8") / 3);
+}
+function claudeModelName(config) {
+  const runtimeConfig = config.runtimeConfig;
+  if (runtimeConfig?.runtime === "claude") {
+    return runtimeConfigModelValue(runtimeConfig);
+  }
+  return config.model || "unknown";
+}
+function claudeContextLimitTokens(model) {
+  return /\bfable\b/i.test(model) ? CLAUDE_FABLE_CONTEXT_TOKENS : CLAUDE_DEFAULT_CONTEXT_TOKENS;
+}
+
 // src/drivers/claudeLaunch.ts
 import { writeFileSync as writeFileSync2 } from "fs";
 import path5 from "path";
@@ -7647,7 +7818,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -7673,7 +7844,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -7811,6 +7982,8 @@ var ClaudeDriver = class {
     return buildClaudeArgs(config, opts);
   }
   async spawn(ctx) {
+    assertClaudeStartupPayloadWithinBudget(ctx.config, `${ctx.standingPrompt}
+${ctx.prompt}`);
     const { slockDir, tokenFile, spawnEnv } = await prepareCliTransport(
       ctx,
       buildClaudeProviderIsolationEnv(ctx)
@@ -7924,6 +8097,12 @@ function codexSessionRootCandidates(homeDirOrCodexRoot) {
 var RuntimeTurnState = class {
   currentTurnId = null;
   pendingTurnId = null;
+  turnInProgress = false;
+  currentTurnHadRuntimeActivity = false;
+  currentTurnHadTokenUsage = false;
+  currentTurnHadNonEmptyInput = false;
+  pendingNonEmptyInputTurnIds = /* @__PURE__ */ new Set();
+  completedTurnIds = /* @__PURE__ */ new Set();
   /**
    * Post-tool window where the app-server may not yet accept stdin steering.
    * Gate busy-mode delivery until turn/completed or next progress.
@@ -7932,6 +8111,12 @@ var RuntimeTurnState = class {
   reset() {
     this.currentTurnId = null;
     this.pendingTurnId = null;
+    this.turnInProgress = false;
+    this.currentTurnHadRuntimeActivity = false;
+    this.currentTurnHadTokenUsage = false;
+    this.currentTurnHadNonEmptyInput = false;
+    this.pendingNonEmptyInputTurnIds.clear();
+    this.completedTurnIds.clear();
     this.steeringGateActive = false;
   }
   get activeTurnId() {
@@ -7946,20 +8131,54 @@ var RuntimeTurnState = class {
       this.currentTurnId = startedTurnId;
     }
     this.pendingTurnId = null;
+    this.turnInProgress = true;
+    this.currentTurnHadRuntimeActivity = false;
+    this.currentTurnHadTokenUsage = false;
+    this.currentTurnHadNonEmptyInput = startedTurnId ? this.pendingNonEmptyInputTurnIds.delete(startedTurnId) : false;
     this.steeringGateActive = false;
   }
   noteTurnAccepted(turnId) {
     this.pendingTurnId = turnId;
   }
   markProgress() {
+    this.currentTurnHadRuntimeActivity = true;
     this.steeringGateActive = false;
   }
   markToolBoundary() {
+    this.currentTurnHadRuntimeActivity = true;
     this.steeringGateActive = true;
   }
+  markTokenUsage() {
+    this.currentTurnHadTokenUsage = true;
+  }
+  markNonEmptyInputForTurn(turnId) {
+    if (!turnId || this.completedTurnIds.has(turnId)) return;
+    if (this.turnInProgress && this.currentTurnId === turnId) {
+      this.currentTurnHadNonEmptyInput = true;
+    } else {
+      this.pendingNonEmptyInputTurnIds.add(turnId);
+    }
+  }
+  hasNonEmptyInputEvidence() {
+    return this.currentTurnHadNonEmptyInput;
+  }
+  completedWithoutRuntimeActivity() {
+    return this.turnInProgress && !this.currentTurnHadRuntimeActivity && !this.currentTurnHadTokenUsage;
+  }
   markTurnCompleted() {
+    if (this.currentTurnId) {
+      this.completedTurnIds.add(this.currentTurnId);
+      if (this.completedTurnIds.size > 16) {
+        const oldest = this.completedTurnIds.values().next().value;
+        if (oldest) this.completedTurnIds.delete(oldest);
+      }
+    }
     this.currentTurnId = null;
     this.pendingTurnId = null;
+    this.turnInProgress = false;
+    this.currentTurnHadRuntimeActivity = false;
+    this.currentTurnHadTokenUsage = false;
+    this.currentTurnHadNonEmptyInput = false;
     this.steeringGateActive = false;
   }
 };
@@ -8212,6 +8431,9 @@ var CodexEventNormalizer = class {
   get canSteerBusy() {
     return this.turnState.canSteerBusy;
   }
+  markNonEmptyTurnInput(turnId) {
+    this.turnState.markNonEmptyInputForTurn(turnId);
+  }
   adoptThreadId(threadId) {
     this.currentThreadId = threadId;
   }
@@ -8241,6 +8463,9 @@ var CodexEventNormalizer = class {
     }
     const telemetry = parseCodexTelemetryEvent(message);
     if (telemetry) {
+      if (telemetry.kind === "telemetry" && telemetry.name === "token_usage") {
+        this.turnState.markTokenUsage();
+      }
       const telemetrySessionId = codexMessageThreadId(message);
       const telemetryTurnId = nonEmptyString2(message.params?.turnId) ?? nonEmptyString2(message.params?.turn?.id);
       if (telemetrySessionId) {
@@ -8257,6 +8482,7 @@ var CodexEventNormalizer = class {
     }
     const rawProgress = rawResponseItemProgressEvent(message);
     if (rawProgress) {
+      this.turnState.markProgress();
       events.push(rawProgress);
       return { events };
     }
@@ -8385,6 +8611,7 @@ var CodexEventNormalizer = class {
             break;
           case "commandExecution":
             if (isStarted && typeof item.command === "string") {
+              this.turnState.markProgress();
               events.push({ kind: "tool_call", name: "shell", input: { command: item.command } });
             }
             if (isCompleted) {
@@ -8394,19 +8621,23 @@ var CodexEventNormalizer = class {
             break;
           case "contextCompaction":
             if (isStarted) {
+              this.turnState.markProgress();
               events.push({ kind: "compaction_started" });
             }
             if (isCompleted) {
+              this.turnState.markProgress();
               events.push({ kind: "compaction_finished" });
             }
             break;
           case "enteredReviewMode":
             if (isStarted) {
+              this.turnState.markProgress();
               events.push({ kind: "review_started" });
             }
             break;
           case "exitedReviewMode":
             if (isCompleted) {
+              this.turnState.markProgress();
               events.push({ kind: "review_finished" });
             }
             break;
@@ -8414,6 +8645,7 @@ var CodexEventNormalizer = class {
             if (isStarted && Array.isArray(item.changes)) {
               let outputCount = 0;
               for (const change of item.changes) {
+                this.turnState.markProgress();
                 events.push({
                   kind: "tool_call",
                   name: "file_change",
@@ -8445,6 +8677,7 @@ var CodexEventNormalizer = class {
           case "mcpToolCall":
             if (isStarted) {
               const toolName = codexMcpToolName(item);
+              this.turnState.markProgress();
               events.push({ kind: "tool_call", name: toolName, input: item.arguments });
             }
             if (isCompleted) {
@@ -8455,6 +8688,7 @@ var CodexEventNormalizer = class {
             break;
           case "collabAgentToolCall":
             if (isStarted) {
+              this.turnState.markProgress();
               events.push({ kind: "tool_call", name: "collab_tool_call", input: { tool: item.tool, prompt: item.prompt } });
             }
             if (isCompleted) {
@@ -8464,6 +8698,7 @@ var CodexEventNormalizer = class {
             break;
           case "webSearch":
             if (isStarted) {
+              this.turnState.markProgress();
               events.push({ kind: "tool_call", name: "web_search", input: { query: item.query } });
             }
             if (isCompleted) {
@@ -8483,6 +8718,26 @@ var CodexEventNormalizer = class {
           const detail = typeof turn?.error?.message === "string" && turn.error.message.length > 0 ? `: ${turn.error.message}` : "";
           events.push({ kind: "error", message: `Codex turn interrupted${detail}` });
         }
+        if (turn?.status === "completed" && this.turnState.completedWithoutRuntimeActivity()) {
+          const inputEvidence = this.turnState.hasNonEmptyInputEvidence() ? "nonempty" : "unknown";
+          const diagnosticMessage = "Codex runtime completed an empty turn with no output, progress, or token usage";
+          const userMessage = inputEvidence === "nonempty" ? "Codex runtime returned an empty response. Please retry." : "Codex runtime completed without a response. Please retry.";
+          events.push({
+            kind: "runtime_diagnostic",
+            severity: "warning",
+            source: "codex_app_server_notification",
+            itemType: "codex_zero_evidence_turn_completed",
+            message: diagnosticMessage,
+            details: "Codex runtime reported turn/completed status=completed after turn/started with no assistant text, reasoning text, tool activity, internal progress, raw response-item progress, or valid thread/tokenUsage/updated payload.",
+            payloadBytes: payloadBytes(message.params),
+            inputEvidence,
+            ...this.currentThreadId ? { sessionId: this.currentThreadId } : {}
+          });
+          events.push({
+            kind: "error",
+            message: `${userMessage} (codex_zero_evidence_turn_completed)`
+          });
+        }
         this.turnState.markTurnCompleted();
         this.streamedAgentMessageIds.clear();
         this.streamedReasoningIds.clear();
@@ -8520,6 +8775,15 @@ var CodexEventNormalizer = class {
 // src/drivers/codex.ts
 var CODEX_DESKTOP_BUNDLE_PATH = "/Applications/Codex.app/Contents/Resources/codex";
 var CODEX_APP_SERVER_PROBE_ARGS = ["app-server", "--help"];
+function hasNonEmptyCodexTextInput(input) {
+  return Array.isArray(input) && input.some(
+    (item) => item && typeof item === "object" && item.type === "text" && typeof item.text === "string" && item.text.length > 0
+  );
+}
+function resultTurnId(message) {
+  const turn = message.result?.turn;
+  return turn && typeof turn.id === "string" ? turn.id : null;
+}
 function isWindowsSandboxRunner(commandPath) {
   return path7.basename(commandPath).toLowerCase().startsWith("codex-command-runner");
 }
@@ -8849,6 +9113,7 @@ var CodexDriver = class {
   pendingResumeFallbackParams = null;
   pendingResumeThreadId = null;
   pendingInitialTurnRequestId = null;
+  pendingInitialTurnInput = null;
   pendingDeliveryRequests = /* @__PURE__ */ new Map();
   initialTurnStarted = false;
   normalizer = new CodexEventNormalizer();
@@ -8869,6 +9134,7 @@ var CodexDriver = class {
     this.pendingResumeFallbackParams = null;
     this.pendingResumeThreadId = null;
     this.pendingInitialTurnRequestId = null;
+    this.pendingInitialTurnInput = null;
     this.pendingDeliveryRequests.clear();
     this.initialTurnStarted = false;
     this.normalizer.reset();
@@ -8991,28 +9257,33 @@ var CodexDriver = class {
           startupRequestMethod: "turn/start"
         });
       } else {
+        if (hasNonEmptyCodexTextInput(this.pendingInitialTurnInput)) {
+          this.normalizer.markNonEmptyTurnInput(resultTurnId(message));
+        }
         this.pendingInitialPrompt = null;
       }
+      this.pendingInitialTurnInput = null;
       return events;
     }
     if (isResponse && message.id !== void 0 && this.pendingDeliveryRequests.has(message.id)) {
-      const requestMethod = this.pendingDeliveryRequests.get(message.id);
+      const deliveryRequest = this.pendingDeliveryRequests.get(message.id);
       this.pendingDeliveryRequests.delete(message.id);
       if (hasJsonRpcField(message, "error")) {
         const params = message.error ?? {};
         events.push({
           kind: "delivery_error",
           message: message.error?.message || "Codex app-server request failed",
-          requestMethod,
+          requestMethod: deliveryRequest.method,
           source: "codex_app_server_response",
           payloadBytes: payloadBytes2(params)
         });
+      } else if (hasNonEmptyCodexTextInput(deliveryRequest.input)) {
+        this.normalizer.markNonEmptyTurnInput(deliveryRequest.turnId ?? resultTurnId(message));
       }
       return events;
     }
     const result = this.normalizer.normalizeMessage(message);
     if (result.turnStarted) {
-      this.pendingInitialTurnRequestId = null;
       this.pendingInitialPrompt = null;
     }
     if (result.threadReady) {
@@ -9029,7 +9300,9 @@ var CodexDriver = class {
     if (mode === "busy") {
       if (!this.normalizer.canSteerBusy) return null;
       const id2 = this.nextRequestId();
-      this.pendingDeliveryRequests.set(id2, "turn/steer");
+      const input2 = [{ type: "text", text }];
+      const turnId = this.normalizer.activeTurnId;
+      this.pendingDeliveryRequests.set(id2, { method: "turn/steer", input: input2, turnId });
       return JSON.stringify({
         jsonrpc: "2.0",
         id: id2,
@@ -9037,19 +9310,20 @@ var CodexDriver = class {
         params: {
           threadId: this.normalizer.threadId,
           expectedTurnId: this.normalizer.activeTurnId,
-          input: [{ type: "text", text }]
+          input: input2
         }
       });
     }
     const id = this.nextRequestId();
-    this.pendingDeliveryRequests.set(id, "turn/start");
+    const input = [{ type: "text", text }];
+    this.pendingDeliveryRequests.set(id, { method: "turn/start", input, turnId: null });
     return JSON.stringify({
       jsonrpc: "2.0",
       id,
       method: "turn/start",
       params: {
         threadId: this.normalizer.threadId,
-        input: [{ type: "text", text }]
+        input
       }
     });
   }
@@ -9071,9 +9345,11 @@ var CodexDriver = class {
     if (this.initialTurnStarted || this.pendingInitialTurnRequestId !== null || !this.pendingInitialPrompt || !this.normalizer.threadId) return;
     this.initialTurnStarted = true;
     const prompt = this.pendingInitialPrompt;
+    const input = [{ type: "text", text: prompt }];
+    this.pendingInitialTurnInput = input;
     this.pendingInitialTurnRequestId = this.sendRequest("turn/start", {
       threadId: this.normalizer.threadId,
-      input: [{ type: "text", text: prompt }]
+      input
     });
   }
   sendRequest(method, params) {
@@ -9757,11 +10033,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -9817,7 +10093,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -9954,12 +10230,15 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os4 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -9968,6 +10247,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os4.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -9991,7 +10337,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -10015,21 +10379,23 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(hydrateRuntimeConfig(ctx.config));
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -10037,7 +10403,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -10150,14 +10516,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir()) {
-  const configPath = path9.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os4.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -10417,6 +10778,12 @@ var KimiSdkRuntimeSession = class {
   get closed() {
     return this.didClose;
   }
+  // In-process SDK session: there is no OS pid to probe with signal-0, so
+  // liveness is unknowable via the pid-probe boundary. Return undefined, which
+  // callers treat the same as the historic "no pid" probe result (RS-011).
+  isAlive() {
+    return void 0;
+  }
   on(event, cb) {
     this.events.on(event, cb);
   }
@@ -10836,7 +11203,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -11684,6 +12051,12 @@ var PiSdkRuntimeSession = class {
   get closed() {
     return this.didClose;
   }
+  // In-process SDK session: there is no OS pid to probe with signal-0, so
+  // liveness is unknowable via the pid-probe boundary. Return undefined, which
+  // callers treat the same as the historic "no pid" probe result (RS-011).
+  isAlive() {
+    return void 0;
+  }
   on(event, cb) {
     this.events.on(event, cb);
   }
@@ -12002,6 +12375,25 @@ var ChildProcessRuntimeSession = class {
   get closed() {
     return this.process ? this.process.exitCode != null || this.process.signalCode != null : false;
   }
+  /**
+   * Read-only OS liveness introspection (signal-0), NOT control IO — exposed so
+   * managers query liveness through the session boundary (RS-011) instead of
+   * poking the raw pid. Preserves the historic `probeRuntimeProcessLiveness`
+   * semantics exactly: undefined when there is no pid, true on success or EPERM,
+   * false otherwise. Deliberately does NOT short-circuit on `this.closed` — the
+   * original probe checked only pid + signal-0.
+   */
+  isAlive() {
+    const pid = this.process?.pid;
+    if (typeof pid !== "number") return void 0;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (err) {
+      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
+      return code === "EPERM" ? true : false;
+    }
+  }
   on(event, cb) {
     this.events.on(event, cb);
   }
@@ -12115,6 +12507,61 @@ function getDriver(runtimeId) {
   return driver;
 }
 
+// src/daemonOrphanReaper.ts
+async function reapOrphanProcesses(pids, logger2, recordTrace) {
+  const survivors = pids.filter((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  if (survivors.length === 0) return false;
+  for (const pid of survivors) {
+    logger2.warn(`[Daemon] Agent subprocess ${pid} survived stopAll; sending SIGKILL`);
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+  recordTrace("daemon.agent.stop_all.survivor_reaped", {
+    survivor_count: survivors.length,
+    survivor_pids: survivors.join(","),
+    reason: "shutdown_survivor",
+    signal: "SIGKILL"
+  });
+  const deadline = Date.now() + 2e3;
+  while (Date.now() < deadline) {
+    const alive = survivors.filter((pid) => {
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+    if (alive.length === 0) break;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  const stillAlive = survivors.filter((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  const outcome = stillAlive.length > 0 ? "survivors_still_alive" : "survivors_killed";
+  recordTrace("daemon.agent.stop_all.completed", {
+    survivor_count: survivors.length,
+    reaped_count: survivors.length - stillAlive.length,
+    still_alive_count: stillAlive.length,
+    outcome
+  }, stillAlive.length > 0 ? "error" : "ok");
+  return true;
+}
+
 // src/workspaces.ts
 import { readdir, rm, stat } from "fs/promises";
 import path13 from "path";
@@ -13205,6 +13652,7 @@ function buildRuntimeErrorDiagnosticEnvelope(message) {
   const runtimeErrorReason = classifyRuntimeErrorReason(runtimeErrorClass);
   const runtimeErrorAction = classifyRuntimeErrorAction(runtimeErrorClass);
   const fingerprint = fingerprintRuntimeError(scrubbed);
+  const inputTooLargeAttrs = runtimeErrorClass === "InputTooLargeError" ? extractInputTooLargeAttrs(rawMessage) : {};
   const spanAttrs = {
     turn_outcome: "failed",
     turn_subtype: "runtime_error",
@@ -13215,7 +13663,8 @@ function buildRuntimeErrorDiagnosticEnvelope(message) {
     runtime_error_fingerprint: fingerprint,
     runtime_error_message_present: rawMessage.length > 0,
     runtime_error_message_length_bucket: bucketLength(rawMessage.length),
-    runtime_error_message_truncated: truncated
+    runtime_error_message_truncated: truncated,
+    ...inputTooLargeAttrs
   };
   if (httpStatus !== null) {
     spanAttrs.runtime_error_http_status = httpStatus;
@@ -13239,6 +13688,10 @@ function formatRuntimeStartTimeoutMessage(runtimeId) {
   const runtimeLabel = runtimeDisplayName(runtimeId);
   return `${runtimeLabel} did not finish starting on this machine. Check that ${runtimeLabel} is installed, logged in, and can run non-interactively, then retry starting this agent.`;
 }
+function formatRuntimeInputTooLargeMessage(runtimeId) {
+  const runtimeLabel = runtimeDisplayName(runtimeId);
+  return `${runtimeLabel} reported input that is too large for the selected model. Reduce the current prompt or injected startup context. For a resumed session, compact it or start a new session before retrying.`;
+}
 function scrubRuntimeErrorDiagnosticText(value) {
   return value.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, "Bearer [REDACTED_TOKEN]").replace(/\b(?:sk|sk-ant|sk-proj|xox[baprs]?)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED_TOKEN]").replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]").replace(/https?:\/\/[^\s"'<>]+/gi, (url) => redactUrlQuery(url)).replace(/\/Users\/[^\s"'<>:]+(?:\/[^\s"'<>:]+)*/g, "[REDACTED_PATH]").replace(/\/home\/[^\s"'<>:]+(?:\/[^\s"'<>:]+)*/g, "[REDACTED_PATH]").replace(/[A-Za-z]:\\Users\\[^\s"'<>:]+(?:\\[^\s"'<>:]+)*/g, "[REDACTED_PATH]");
 }
@@ -13254,6 +13707,10 @@ function extractHttpStatus(message) {
 }
 function classifyRuntimeError(message, httpStatus) {
   const explicit = /\b([A-Z][A-Za-z0-9_]*(?:Error|Exception))\b/.exec(message);
+  if (explicit && /InputTooLargeError/i.test(explicit[1])) return "InputTooLargeError";
+  if (/\bINPUT_TOO_LARGE\b/i.test(message) || /\binput too large\b/i.test(message) || /\bexceeds the maximum allowed\b/i.test(message)) {
+    return "InputTooLargeError";
+  }
   if (explicit) return explicit[1];
   if (httpStatus !== null) {
     if (httpStatus === 429) return "RateLimitError";
@@ -13300,6 +13757,8 @@ function classifyRuntimeErrorReason(runtimeErrorClass) {
       return "not_found";
     case "ModelConfigError":
       return "model_config_error";
+    case "InputTooLargeError":
+      return "input_too_large";
     case "ProviderServerError":
       return "provider_server_error";
     case "ProviderApiError":
@@ -13308,6 +13767,34 @@ function classifyRuntimeErrorReason(runtimeErrorClass) {
       return "unclassified_runtime_error";
   }
 }
+function extractInputTooLargeAttrs(message) {
+  const attrs = {};
+  const estimatedTokens = firstIntegerMatch(message, [
+    /\bestimated\s+([\d,]+)\s+tokens?\b/i
+  ]);
+  if (estimatedTokens !== null) attrs.runtime_input_estimated_tokens = estimatedTokens;
+  const budgetTokens = firstIntegerMatch(message, [
+    /\bbudget\s+([\d,]+)\b/i
+  ]);
+  if (budgetTokens !== null) attrs.runtime_input_budget_tokens = budgetTokens;
+  const contextLimitTokens = firstIntegerMatch(message, [
+    /\bcontext limit\s+([\d,]+)\b/i,
+    /\bmaximum allowed[^()]*\(([\d,]+)\)/i
+  ]);
+  if (contextLimitTokens !== null) attrs.runtime_input_context_limit_tokens = contextLimitTokens;
+  const model = /\bmodel\s+([A-Za-z0-9._:/+-]+)\b/i.exec(message);
+  if (model) attrs.runtime_input_model = model[1];
+  return attrs;
+}
+function firstIntegerMatch(message, patterns) {
+  for (const pattern of patterns) {
+    const match = pattern.exec(message);
+    if (!match) continue;
+    const parsed = Number.parseInt(match[1].replace(/,/g, ""), 10);
+    if (Number.isSafeInteger(parsed)) return parsed;
+  }
+  return null;
+}
 function runtimeDisplayName(runtimeId) {
   switch (runtimeId) {
     case "antigravity":
@@ -13541,6 +14028,88 @@ var RuntimeNotificationState = class {
   }
 };
 
+// src/proxyFailureTrace.ts
+function failureReason(input) {
+  if (input.lifecycleInvalidContext) return "local_daemon_state_invalid";
+  const text = `${input.errorCause ?? ""} ${input.errorMessage}`.toLowerCase();
+  if (/enotfound|eai_again|\bdns\b/.test(text)) return "dns";
+  if (/econnrefused|econnreset|epipe|und_err_socket|\bsocket\b|other side closed|terminated/.test(text)) return "tcp";
+  if (/certificate|\btls\b/.test(text)) return "tls";
+  if (/und_err_headers_timeout|und_err_body_timeout|\btimeout\b/.test(text)) return "read_timeout";
+  if (/\bproxy\b/.test(text)) return "proxy_connect";
+  if (/\bfly\b/.test(text)) return "fly_edge";
+  return "unknown";
+}
+function boundedErrorClass(value) {
+  if (value === "TypeError") return "TypeError";
+  if (value === "AbortError") return "AbortError";
+  if (value === "Error") return "Error";
+  return "OtherError";
+}
+function boundedMethod(value) {
+  const method = value.toUpperCase();
+  return ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(method) ? method : "OTHER";
+}
+function cannedExcerpt(reason) {
+  switch (reason) {
+    case "local_daemon_state_invalid":
+      return "Local daemon lifecycle state rejected the proxy request";
+    case "dns":
+      return "Upstream DNS resolution failed";
+    case "tcp":
+      return "Upstream TCP connection failed";
+    case "tls":
+      return "Upstream TLS negotiation failed";
+    case "read_timeout":
+      return "Upstream response timed out";
+    case "proxy_connect":
+      return "Upstream proxy connection failed";
+    case "fly_edge":
+      return "Upstream edge transport failed";
+    case "unknown":
+      return "Proxy request failed with an unclassified cause";
+  }
+}
+function daemonProxyFailureTraceAttrs(input) {
+  const reason = failureReason(input);
+  return {
+    route_family: routeFamilyForPath(input.pathname),
+    method: boundedMethod(input.method),
+    outcome: "error",
+    reason,
+    error_class: boundedErrorClass(input.errorName),
+    error_excerpt: cannedExcerpt(reason),
+    ...typeof input.responseStatusCode === "number" ? { response_status_code: input.responseStatusCode } : {},
+    response_code_present: Boolean(input.responseCode)
+  };
+}
+function daemonTransportErrorExcerpt(input) {
+  if (input.normalizedCode === "local_daemon_state_invalid") {
+    return "Local daemon lifecycle state rejected the proxy request";
+  }
+  if (input.normalizedCode === "server_5xx") return "Upstream server returned a 5xx response";
+  switch (input.upstreamLayer) {
+    case "dns":
+      return "Upstream DNS resolution failed";
+    case "tcp":
+      return "Upstream TCP connection failed";
+    case "tls":
+      return "Upstream TLS negotiation failed";
+    case "read_timeout":
+      return "Upstream response timed out";
+    case "proxy_connect":
+      return "Upstream proxy connection failed";
+    case "fly_edge":
+      return "Upstream edge transport failed";
+    case "body_decode_failure":
+      return "Upstream response body could not be decoded";
+    case "http_status":
+      return "Upstream HTTP request failed";
+    case "unknown":
+      return "Proxy transport failed with an unclassified cause";
+  }
+}
+
 // src/agentProcessManager.ts
 var DEFAULT_MAX_CONCURRENT_AGENT_STARTS = 5;
 var DEFAULT_AGENT_START_INTERVAL_MS = 500;
@@ -14846,7 +15415,8 @@ function runtimeDiagnosticTraceAttrs(event) {
     details_present: Boolean(event.details),
     path_present: Boolean(event.path),
     range_present: event.range !== void 0,
-    session_id_present: Boolean(event.sessionId)
+    session_id_present: Boolean(event.sessionId),
+    input_evidence: event.inputEvidence
   };
 }
 function runtimeRecoveryTrajectoryEntry(event) {
@@ -14915,10 +15485,11 @@ function classifyTerminalFailure(ap) {
   for (const text of candidates) {
     const diagnostics = buildRuntimeErrorDiagnosticEnvelope(text);
     const lower = text.toLowerCase();
-    if (lower.includes("usage limit") || lower.includes("quota exceeded") || lower.includes("quota limit") || lower.includes("budget limit exceeded") || lower.includes("usage not included in your plan") || lower.includes("modelnotfounderror") || lower.includes("requested entity was not found") || lower.includes("model deprecated") || lower.includes("model not found") || lower.includes("model is not supported") || lower.includes("unsupported model") || /\bmodel\b.*\bnot supported\b/i.test(text) || diagnostics.spanAttrs.runtime_error_action_required === true || isProviderStreamFailureText(text) || isRuntimeStartTimeoutText(text)) {
+    if (lower.includes("usage limit") || lower.includes("quota exceeded") || lower.includes("quota limit") || lower.includes("budget limit exceeded") || lower.includes("usage not included in your plan") || lower.includes("modelnotfounderror") || lower.includes("requested entity was not found") || lower.includes("model deprecated") || lower.includes("model not found") || lower.includes("model is not supported") || lower.includes("unsupported model") || lower.includes("codex_zero_evidence_turn_completed") || /\bmodel\b.*\bnot supported\b/i.test(text) || diagnostics.spanAttrs.runtime_error_action_required === true || diagnostics.spanAttrs.runtime_error_class === "InputTooLargeError" || isProviderStreamFailureText(text) || isRuntimeStartTimeoutText(text)) {
       const actionRequired = diagnostics.spanAttrs.runtime_error_action_required === true;
+      const inputTooLarge = diagnostics.spanAttrs.runtime_error_class === "InputTooLargeError";
       return {
-        detail: actionRequired ? formatRuntimeActionRequiredMessage(ap) : text,
+        detail: actionRequired ? formatRuntimeActionRequiredMessage(ap) : inputTooLarge ? formatRuntimeInputTooLargeMessage(ap.driver.id) : text,
         actionRequired,
         ...actionRequired ? { entries: buildRuntimeActionRequiredEntries(ap, text, diagnostics) } : {}
       };
@@ -14930,6 +15501,7 @@ function classifyStickyTerminalFailure(ap) {
   const terminalFailure = classifyTerminalFailure(ap);
   if (!terminalFailure) return null;
   if (terminalFailure.actionRequired) return terminalFailure;
+  if (/\bcodex_zero_evidence_turn_completed\b/i.test(terminalFailure.detail)) return terminalFailure;
   if (/\bmodel\b.*\bnot supported\b/i.test(terminalFailure.detail)) return terminalFailure;
   if (/\bunsupported\b.*\bmodel\b/i.test(terminalFailure.detail)) return terminalFailure;
   if (isProviderStreamFailureText(terminalFailure.detail)) return null;
@@ -16006,17 +16578,9 @@ var AgentProcessManager = class _AgentProcessManager {
     };
   }
   recordAgentProxyFailure(agentId, input) {
-    this.recordDaemonTrace("daemon.agent.proxy.failure", {
+    this.recordDaemonTrace("daemon.proxy.failed", {
       agentId,
-      method: input.method,
-      path: input.pathname,
-      query_keys: input.queryKeys,
-      error_name: input.errorName,
-      error_message: input.errorMessage,
-      response_status_code: input.responseStatusCode,
-      response_code: input.responseCode,
-      lifecycle_invalid_agent_id: input.lifecycleInvalidAgentId,
-      lifecycle_invalid_context: input.lifecycleInvalidContext
+      ...daemonProxyFailureTraceAttrs(input)
     }, "error");
   }
   recordAgentProxyTransportNormalizedError(agentId, input) {
@@ -16028,7 +16592,7 @@ var AgentProcessManager = class _AgentProcessManager {
       response_started: input.responseStarted,
       upstream_layer: input.upstreamLayer,
       ...typeof input.upstreamStatus === "number" ? { upstream_status: input.upstreamStatus } : {},
-      ...input.originalMessage ? { original_message: input.originalMessage } : {},
+      error_excerpt: daemonTransportErrorExcerpt(input),
       launchId: input.launchId,
       target_host_class: input.targetHostClass,
       downstream_caller: input.downstreamCaller,
@@ -17219,8 +17783,14 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           this.broadcastActivity(agentId, "error", visibleErrorMessage, [
             ...terminalFailure?.entries ?? [{ kind: "text", text: `Error: ${visibleErrorMessage}` }]
           ], agentProcess.launchId, "runtime_error");
+        } else if (diagnostics?.spanAttrs.runtime_error_class === "InputTooLargeError") {
+          const visibleErrorMessage = formatRuntimeInputTooLargeMessage(agentProcess.driver.id);
+          this.broadcastActivity(agentId, "error", visibleErrorMessage, [
+            { kind: "text", text: `Error: ${visibleErrorMessage}` }
+          ], agentProcess.launchId, "runtime_error");
         }
-        throw new Error(`Runtime session failed to start: ${startResult.reason}${startResult.error ? ` (${startResult.error})` : ""}`);
+        const visibleStartError = diagnostics?.spanAttrs.runtime_error_class === "InputTooLargeError" ? formatRuntimeInputTooLargeMessage(agentProcess.driver.id) : startResult.error;
+        throw new Error(`Runtime session failed to start: ${startResult.reason}${visibleStartError ? ` (${visibleStartError})` : ""}`);
       }
       this.closeNoProcessResidency(agentId, "advanced");
       if (this.lifecycleRecords.deleteTerminalFailure(agentId)) {
@@ -18188,57 +18758,12 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
       pids: pids.join(",")
     });
     await Promise.all(ids.map((id) => this.stopAgent(id, { wait: true, silent: true })));
-    const survivors = pids.filter((pid) => {
-      try {
-        process.kill(pid, 0);
-        return true;
-      } catch {
-        return false;
-      }
-    });
-    if (survivors.length > 0) {
-      for (const pid of survivors) {
-        logger.warn(`[Daemon] Agent subprocess ${pid} survived stopAll; sending SIGKILL`);
-        try {
-          process.kill(pid, "SIGKILL");
-        } catch {
-        }
-      }
-      this.recordDaemonTrace("daemon.agent.stop_all.survivor_reaped", {
-        survivor_count: survivors.length,
-        survivor_pids: survivors.join(","),
-        reason: "shutdown_survivor",
-        signal: "SIGKILL"
-      });
-      const deadline = Date.now() + 2e3;
-      while (Date.now() < deadline) {
-        const alive = survivors.filter((pid) => {
-          try {
-            process.kill(pid, 0);
-            return true;
-          } catch {
-            return false;
-          }
-        });
-        if (alive.length === 0) break;
-        await new Promise((r) => setTimeout(r, 50));
-      }
-      const stillAlive = survivors.filter((pid) => {
-        try {
-          process.kill(pid, 0);
-          return true;
-        } catch {
-          return false;
-        }
-      });
-      const outcome = stillAlive.length > 0 ? "survivors_still_alive" : "survivors_killed";
-      this.recordDaemonTrace("daemon.agent.stop_all.completed", {
-        survivor_count: survivors.length,
-        reaped_count: survivors.length - stillAlive.length,
-        still_alive_count: stillAlive.length,
-        outcome
-      }, stillAlive.length > 0 ? "error" : "ok");
-    } else {
+    const reapedSurvivors = await reapOrphanProcesses(
+      pids,
+      logger,
+      (name, attrs, status) => this.recordDaemonTrace(name, attrs, status)
+    );
+    if (!reapedSurvivors) {
       this.recordDaemonTrace("daemon.agent.stop_all.completed", {
         agent_count: ids.length,
         survivor_count: 0,
@@ -18980,7 +19505,8 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     const ap = this.agents.get(agentId);
     const entries = [...extraTrajectory];
     const hasToolStart = entries.some((e) => e.kind === "tool_start");
-    if (!hasToolStart) {
+    const isThinkingProgressFrame = activityKind === "thinking" && detail === "" && detailKind === "none" && entries.every((e) => e.kind === "thinking" || e.kind === "text");
+    if (!hasToolStart && !isThinkingProgressFrame) {
       entries.push({
         kind: "status",
         activity: activityKind,
@@ -19992,15 +20518,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     return true;
   }
   probeRuntimeProcessLiveness(ap) {
-    const pid = ap.runtime.pid;
-    if (typeof pid !== "number") return void 0;
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch (err) {
-      const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-      return code === "EPERM" ? true : false;
-    }
+    return ap.runtime.isAlive();
   }
   recoverStaleProcessForQueuedMessageIfNeeded(agentId, ap) {
     const staleForMs = ap.runtimeProgress.ageMs();
@@ -21621,7 +22139,8 @@ var DIAGNOSTIC_ID_ATTRS = /* @__PURE__ */ new Set([
   "process_instance_id",
   "launch_id",
   "correlation_id",
-  "migration_attempt_id"
+  "migration_attempt_id",
+  "operation_id"
 ]);
 var DIAGNOSTIC_ERROR_ATTRS = /* @__PURE__ */ new Set([
   "runtime_error_class",
@@ -22073,23 +22592,190 @@ function readPositiveIntegerEnv2(name, fallback) {
 }
 
 // src/computerMigrationGuard.ts
-import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "fs";
 import path18 from "path";
+
+// src/legacySupervisor.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { readFileSync as readFileSync8 } from "fs";
+function execFileText(file, args) {
+  try {
+    return execFileSync4(file, args, {
+      encoding: "utf8",
+      timeout: 1e3,
+      maxBuffer: 256 * 1024,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return void 0;
+  }
+}
+function readFileText(file) {
+  try {
+    return readFileSync8(file, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function defaultProbe(pid) {
+  return {
+    pid,
+    platform: process.platform,
+    env: process.env,
+    execFile: execFileText,
+    readFile: readFileText
+  };
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function parentPid(probe, pid) {
+  const stdout = probe.execFile("ps", ["-o", "ppid=", "-p", String(pid)]);
+  const parsed = Number.parseInt(stdout?.trim() ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : void 0;
+}
+function processCommand(probe, pid) {
+  return probe.execFile("ps", ["-o", "command=", "-p", String(pid)])?.trim().toLowerCase() ?? "";
+}
+function relatedProcessIds(probe) {
+  const ids = [probe.pid];
+  let current = probe.pid;
+  for (let depth = 0; depth < 12; depth += 1) {
+    const parent = parentPid(probe, current);
+    if (!parent || ids.includes(parent)) break;
+    ids.push(parent);
+    if (parent === 1) break;
+    current = parent;
+  }
+  return ids;
+}
+function detectPm2(probe, relatedPids) {
+  const hasPm2Ancestor = relatedPids.slice(1).some((pid) => processCommand(probe, pid).includes("pm2"));
+  const hasPm2Environment = Boolean(probe.env.PM2_HOME || probe.env.pm_id);
+  if (!hasPm2Ancestor && !hasPm2Environment) return void 0;
+  const pm2Json = probe.execFile("pm2", ["jlist"]);
+  if (pm2Json) {
+    try {
+      const entries = JSON.parse(pm2Json);
+      const entry = entries.find(
+        (candidate) => typeof candidate.pid === "number" && relatedPids.includes(candidate.pid)
+      );
+      if (entry) {
+        const name = typeof entry.name === "string" && entry.name.length > 0 ? entry.name : String(entry.pid);
+        return {
+          kind: "pm2",
+          detail: `PM2 app ${JSON.stringify(name)} is supervising this legacy daemon.`,
+          cleanupCommands: [`pm2 delete ${shellQuote(name)}`, "pm2 save"]
+        };
+      }
+    } catch {
+    }
+  }
+  return {
+    kind: "pm2",
+    detail: "PM2 is supervising this legacy daemon, but its app name could not be resolved.",
+    cleanupCommands: ["pm2 delete <legacy-daemon-app-name>", "pm2 save"]
+  };
+}
+function systemdUnitFromCgroup(cgroup) {
+  if (!cgroup) return void 0;
+  for (const line of cgroup.split("\n")) {
+    const pathPart = line.slice(line.lastIndexOf(":") + 1);
+    let unit;
+    for (const segment of pathPart.split("/")) {
+      if (segment.endsWith(".service") && segment.length > ".service".length && !/^user@\d+\.service$/.test(segment)) {
+        unit = segment;
+      }
+    }
+    if (unit) return { unit, user: pathPart.includes("/user.slice/") };
+  }
+  return void 0;
+}
+function detectSystemd(probe) {
+  if (probe.platform !== "linux") return void 0;
+  const cgroupUnit = systemdUnitFromCgroup(
+    probe.readFile(`/proc/${probe.pid}/cgroup`)
+  );
+  const hasSystemdEvidence = cgroupUnit !== void 0 || probe.env.INVOCATION_ID !== void 0;
+  if (!hasSystemdEvidence) return void 0;
+  if (cgroupUnit) {
+    const prefix = cgroupUnit.user ? "systemctl --user" : "sudo systemctl";
+    return {
+      kind: "systemd",
+      detail: `systemd unit ${JSON.stringify(cgroupUnit.unit)} is supervising this legacy daemon.`,
+      cleanupCommands: [
+        `${prefix} disable --now ${shellQuote(cgroupUnit.unit)}`
+      ]
+    };
+  }
+  return {
+    kind: "systemd",
+    detail: "systemd is supervising this legacy daemon, but its unit name could not be resolved.",
+    cleanupCommands: [
+      "systemctl --user disable --now <legacy-daemon-unit>.service"
+    ]
+  };
+}
+function detectLaunchd(probe) {
+  if (probe.platform !== "darwin") return void 0;
+  const label = probe.env.LAUNCH_JOBKEY_LABEL || probe.env.XPC_SERVICE_NAME;
+  if (!label || label === "0") return void 0;
+  return {
+    kind: "launchd",
+    detail: `launchd job ${JSON.stringify(label)} is supervising this legacy daemon.`,
+    cleanupCommands: [
+      `launchctl bootout gui/$(id -u)/${shellQuote(label)}`,
+      `rm -f ~/Library/LaunchAgents/${shellQuote(`${label}.plist`)}`
+    ]
+  };
+}
+function detectLegacyDaemonSupervisor(pid = process.pid) {
+  return detectLegacyDaemonSupervisorWithProbe(defaultProbe(pid));
+}
+function detectLegacyDaemonSupervisorWithProbe(probe) {
+  const relatedPids = relatedProcessIds(probe);
+  return detectPm2(probe, relatedPids) ?? detectSystemd(probe) ?? detectLaunchd(probe);
+}
+var legacyDaemonSupervisorFallbackCommands = [
+  "PM2: pm2 delete <legacy-daemon-app-name> && pm2 save",
+  "systemd: systemctl --user disable --now <legacy-daemon-unit>.service",
+  "launchd: launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/<legacy-daemon-label>.plist && rm -f ~/Library/LaunchAgents/<legacy-daemon-label>.plist"
+];
+
+// src/computerMigrationGuard.ts
 var LegacyDaemonKeyAdoptedByComputerError = class extends Error {
   code = "LEGACY_DAEMON_KEY_ADOPTED_BY_COMPUTER";
   attachmentPath;
   serverId;
-  constructor(match) {
+  constructor(match, supervisor = detectLegacyDaemonSupervisor() ?? null) {
     const serverDisplay = match.serverSlug ? `/${match.serverSlug}` : match.serverId;
     const startCommand = match.serverSlug ? `raft-computer start /${match.serverSlug}` : "raft-computer start";
+    const statusCommand = match.serverSlug ? `raft-computer status /${match.serverSlug}` : "raft-computer status";
+    const supervisorGuidance = formatSupervisorGuidance(
+      supervisor ?? void 0
+    );
     super(
-      `This legacy daemon key was already adopted by Raft Computer for ${serverDisplay}. Start the Computer supervisor instead: ${startCommand}. Legacy daemon startup is blocked to avoid relaunching a migrated machine key.`
+      `Legacy Raft daemon startup refused: this machine key was already migrated to Raft Computer for ${serverDisplay}.
+Raft Computer now owns this connection; do not restart raft-daemon with the migrated key.
+${supervisorGuidance}
+Then start and verify Raft Computer:
+  ${startCommand}
+  ${statusCommand}`
     );
     this.name = "LegacyDaemonKeyAdoptedByComputerError";
     this.attachmentPath = match.attachmentPath;
     this.serverId = match.serverId;
   }
 };
+function formatSupervisorGuidance(supervisor) {
+  if (supervisor) {
+    return `${supervisor.detail}
+Remove the old supervisor entry so it cannot auto-restart:
+` + supervisor.cleanupCommands.map((command) => `  ${command}`).join("\n");
+  }
+  return `If a process manager keeps restarting the old daemon, remove the entry you configured:
+` + legacyDaemonSupervisorFallbackCommands.map((command) => `  ${command}`).join("\n");
+}
 function daemonApiKeyFingerprint(apiKey) {
   return getDaemonMachineLockId(apiKey).slice("machine-".length);
 }
@@ -22106,7 +22792,7 @@ function findAdoptedComputerForLegacyFingerprint(slockHome, legacyApiKeyFingerpr
     const attachmentPath = path18.join(serversDir, serverId, "runner.state.json");
     let raw;
     try {
-      raw = readFileSync8(attachmentPath, "utf8");
+      raw = readFileSync9(attachmentPath, "utf8");
     } catch {
       continue;
     }
@@ -22128,7 +22814,10 @@ function findAdoptedComputerForLegacyFingerprint(slockHome, legacyApiKeyFingerpr
 }
 function assertLegacyDaemonKeyNotAdoptedByComputer(options) {
   const legacyApiKeyFingerprint = daemonApiKeyFingerprint(options.apiKey);
-  const match = findAdoptedComputerForLegacyFingerprint(options.slockHome, legacyApiKeyFingerprint);
+  const match = findAdoptedComputerForLegacyFingerprint(
+    options.slockHome,
+    legacyApiKeyFingerprint
+  );
   if (match) throw new LegacyDaemonKeyAdoptedByComputerError(match);
 }
 
@@ -22649,8 +23338,13 @@ function onceDrain(res) {
 
 // src/agentMigrationObjectStoreBundle.ts
 import { createHash as createHash9 } from "crypto";
-import { lstat as lstat3, mkdir as mkdir3, readFile as readFile4, readlink as readlink2, rm as rm3, symlink, writeFile as writeFile3 } from "fs/promises";
+import { createReadStream as createReadStream2, createWriteStream } from "fs";
+import { lstat as lstat3, mkdir as mkdir3, readlink as readlink2, rm as rm3, symlink } from "fs/promises";
 import path20 from "path";
+import { Transform } from "stream";
+import { pipeline } from "stream/promises";
+import { createGunzip, createGzip } from "zlib";
+import { extract, pack } from "tar-stream";
 
 // src/agentMigrationExport.ts
 import { createHash as createHash8 } from "crypto";
@@ -22659,11 +23353,15 @@ import { lstat as lstat2, readdir as readdir4, readFile as readFile3, readlink }
 import path19 from "path";
 var AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION = "agent-bundle/v1";
 var REGENERABLE_DIRECTORY_NAMES = [
+  ".cache",
+  ".gradle",
+  ".pnpm-store",
   ".venv",
   "__pycache__",
   "dist",
   "node_modules",
-  "target"
+  "target",
+  "vendor"
 ];
 var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
   ".env",
@@ -22780,9 +23478,9 @@ async function includeWorkspacePath(workspaceRelativePath, state, opts) {
   const normalizedRelativePath = normalizeRelativePath(workspaceRelativePath);
   if (state.seenWorkspacePaths.has(normalizedRelativePath)) return;
   const sourcePath = path19.join(state.workspace, normalizedRelativePath);
-  let stat4;
+  let stat5;
   try {
-    stat4 = await lstat2(sourcePath);
+    stat5 = await lstat2(sourcePath);
   } catch {
     state.unreachable.push({
       path: normalizedRelativePath,
@@ -22791,7 +23489,7 @@ async function includeWorkspacePath(workspaceRelativePath, state, opts) {
     });
     return;
   }
-  if (stat4.isDirectory()) {
+  if (stat5.isDirectory()) {
     if (!opts.forceIncludeRegenerable && isRegenerablePath(normalizedRelativePath)) {
       state.excludedRegenerable.push({
         path: normalizedRelativePath,
@@ -22809,10 +23507,10 @@ async function includeWorkspacePath(workspaceRelativePath, state, opts) {
     sourcePath,
     workspaceRelativePath: normalizedRelativePath,
     bundlePath: `workspace/${normalizedRelativePath}`,
-    mode: stat4.mode,
-    mtimeMs: stat4.mtimeMs
+    mode: stat5.mode,
+    mtimeMs: stat5.mtimeMs
   };
-  if (stat4.isSymbolicLink()) {
+  if (stat5.isSymbolicLink()) {
     state.files.push({
       ...baseEntry,
       kind: "symlink",
@@ -22820,7 +23518,7 @@ async function includeWorkspacePath(workspaceRelativePath, state, opts) {
     });
     return;
   }
-  if (!stat4.isFile()) {
+  if (!stat5.isFile()) {
     state.unreachable.push({
       path: normalizedRelativePath,
       sourcePath,
@@ -22835,7 +23533,7 @@ async function includeWorkspacePath(workspaceRelativePath, state, opts) {
   state.files.push({
     ...baseEntry,
     kind: "file",
-    sizeBytes: stat4.size,
+    sizeBytes: stat5.size,
     sha256: await sha256File(sourcePath),
     secretShapes: secretShapes.length > 0 ? secretShapes : void 0
   });
@@ -22854,9 +23552,9 @@ async function buildCrossTreeRefs(refs) {
       reason: ref.reason
     };
     try {
-      const stat4 = await lstat2(sourcePath);
-      if (stat4.isFile()) {
-        entry.sizeBytes = stat4.size;
+      const stat5 = await lstat2(sourcePath);
+      if (stat5.isFile()) {
+        entry.sizeBytes = stat5.size;
         entry.sha256 = await sha256File(sourcePath);
       }
     } catch {
@@ -22974,9 +23672,22 @@ function sortByPath(entries) {
 }
 
 // src/agentMigrationObjectStoreBundle.ts
-var AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION = "agent-object-store-bundle/v1";
-var AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE = "application/vnd.slock.agent-migration-bundle";
+var AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION = "agent-object-store-tar/v2";
+var AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE = "application/vnd.raft.agent-migration-bundle+tar+gzip";
+var ARCHIVE_MANIFEST_PATH = "manifest.json";
+var ARCHIVE_WORKSPACE_PREFIX = "workspace/";
+var MAX_ARCHIVE_MANIFEST_BYTES = 64 * 1024 * 1024;
+var AgentMigrationObjectStoreBundleTooLargeError = class extends Error {
+  constructor(actualBytes, maxBytes) {
+    super(`MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE:actualBytes=${actualBytes}:maxBytes=${maxBytes}`);
+    this.actualBytes = actualBytes;
+    this.maxBytes = maxBytes;
+    this.name = "AgentMigrationObjectStoreBundleTooLargeError";
+  }
+  code = "MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE";
+};
 async function buildAgentMigrationObjectStoreBundle(input) {
+  assertPositiveMaxBytes(input.maxBytes);
   const workspacePath = path20.resolve(input.workspacePath);
   const manifest = await buildAgentMigrationExportManifest({
     agentId: input.agentId,
@@ -22984,45 +23695,32 @@ async function buildAgentMigrationObjectStoreBundle(input) {
     workspacePath,
     mode: "forensic"
   });
-  const files = [];
-  for (const entry of manifest.files) {
-    if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
-      throw new Error("MIGRATION_OBJECT_STORE_UNSUPPORTED_ENTRY");
-    }
-    const sourcePath = path20.resolve(entry.sourcePath);
-    if (entry.kind === "symlink") {
-      files.push({
-        kind: "symlink",
-        workspaceRelativePath: normalizeWorkspaceRelativePath(entry.workspaceRelativePath),
-        linkTarget: entry.linkTarget ?? await readlink2(sourcePath)
-      });
-      continue;
-    }
-    const stat4 = await lstat3(sourcePath);
-    if (!stat4.isFile()) throw new Error("MIGRATION_OBJECT_STORE_FILE_KIND_MISMATCH");
-    files.push({
-      kind: "file",
-      workspaceRelativePath: normalizeWorkspaceRelativePath(entry.workspaceRelativePath),
-      contentBase64: (await readFile4(sourcePath)).toString("base64")
-    });
-  }
-  const payload = {
+  const contentBytes = assertAgentMigrationObjectStoreBundleSize(manifest, input.maxBytes);
+  const archiveManifest = {
     schemaVersion: AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
-    manifest,
-    files
+    manifest
   };
-  const bundle = Buffer.from(`${JSON.stringify(sortJsonValue2(payload))}
+  const manifestBuffer = Buffer.from(`${canonicalJson2(archiveManifest)}
 `, "utf8");
-  if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes <= 0 || bundle.byteLength > input.maxBytes) {
-    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE");
-  }
+  if (manifestBuffer.byteLength > MAX_ARCHIVE_MANIFEST_BYTES) {
+    throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_TOO_LARGE");
+  }
+  const tarPack = pack();
+  const gzip = createGzip();
+  const bundle = tarPack.pipe(gzip);
+  tarPack.on("error", (error) => gzip.destroy(error));
+  void writeArchive(tarPack, manifestBuffer, manifest, workspacePath).catch((error) => {
+    tarPack.destroy(error instanceof Error ? error : new Error(String(error)));
+  });
   return {
     bundle,
-    manifestSha256: sha256Buffer2(Buffer.from(canonicalJson2(manifest), "utf8"))
+    manifest,
+    manifestSha256: sha256Buffer2(Buffer.from(canonicalJson2(manifest), "utf8")),
+    contentBytes
   };
 }
 async function stageAgentMigrationObjectStoreBundle(input) {
-  const parsed = parseObjectStoreBundle(input.bundle);
+  assertPositiveMaxBytes(input.maxBytes);
   const stagingWorkspacePath = path20.join(
     path20.resolve(input.slockHome),
     "migrations",
@@ -23031,45 +23729,198 @@ async function stageAgentMigrationObjectStoreBundle(input) {
   );
   await rm3(stagingWorkspacePath, { recursive: true, force: true });
   await mkdir3(stagingWorkspacePath, { recursive: true });
-  for (const file of parsed.files) {
-    const relativePath = normalizeWorkspaceRelativePath(file.workspaceRelativePath);
-    const targetPath = path20.join(stagingWorkspacePath, relativePath);
-    await mkdir3(path20.dirname(targetPath), { recursive: true });
-    if (file.kind === "symlink") {
-      if (!file.linkTarget) throw new Error("MIGRATION_OBJECT_STORE_LINK_TARGET_MISSING");
-      await symlink(file.linkTarget, targetPath);
+  let archiveManifest = null;
+  let expectedEntries = /* @__PURE__ */ new Map();
+  const extractedEntries = /* @__PURE__ */ new Set();
+  let contentBytes = 0;
+  const tarExtract = extract();
+  tarExtract.on("entry", (header, stream, next) => {
+    void handleArchiveEntry({
+      header,
+      stream,
+      stagingWorkspacePath,
+      maxBytes: input.maxBytes,
+      getArchiveManifest: () => archiveManifest,
+      setArchiveManifest: (value) => {
+        archiveManifest = value;
+        expectedEntries = expectedWorkspaceEntries(value.manifest);
+      },
+      getExpectedEntries: () => expectedEntries,
+      extractedEntries,
+      addContentBytes: (value) => {
+        contentBytes += value;
+        if (contentBytes > input.maxBytes) {
+          throw new AgentMigrationObjectStoreBundleTooLargeError(contentBytes, input.maxBytes);
+        }
+      }
+    }).then(() => next(), next);
+  });
+  try {
+    await pipeline(input.bundle, createGunzip(), tarExtract);
+    const completedManifest = archiveManifest;
+    if (!completedManifest) throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_MISSING");
+    for (const relativePath of expectedEntries.keys()) {
+      if (!extractedEntries.has(relativePath)) {
+        throw new Error(`MIGRATION_OBJECT_STORE_ARCHIVE_ENTRY_MISSING:${relativePath}`);
+      }
+    }
+    return {
+      manifest: completedManifest.manifest,
+      manifestSha256: sha256Buffer2(
+        Buffer.from(canonicalJson2(completedManifest.manifest), "utf8")
+      ),
+      stagingWorkspacePath,
+      contentBytes
+    };
+  } catch (error) {
+    await rm3(stagingWorkspacePath, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function writeArchive(tarPack, manifestBuffer, manifest, workspacePath) {
+  await writeBufferedEntry(tarPack, {
+    name: ARCHIVE_MANIFEST_PATH,
+    type: "file",
+    size: manifestBuffer.byteLength,
+    mode: 384,
+    mtime: new Date(manifest.createdAt)
+  }, manifestBuffer);
+  for (const entry of manifest.files) {
+    if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
+      throw new Error("MIGRATION_OBJECT_STORE_UNSUPPORTED_ENTRY");
+    }
+    const relativePath = normalizeWorkspaceRelativePath(entry.workspaceRelativePath);
+    const sourcePath = path20.resolve(entry.sourcePath);
+    const archivePath = `${ARCHIVE_WORKSPACE_PREFIX}${relativePath}`;
+    if (entry.kind === "symlink") {
+      await writeBufferedEntry(tarPack, {
+        name: archivePath,
+        type: "symlink",
+        size: 0,
+        mode: archiveMode(entry.mode),
+        mtime: archiveMtime(entry.mtimeMs),
+        linkname: entry.linkTarget ?? await readlink2(sourcePath)
+      }, Buffer.alloc(0));
       continue;
     }
-    if (file.kind !== "file" || typeof file.contentBase64 !== "string") {
-      throw new Error("MIGRATION_OBJECT_STORE_FILE_CONTENT_MISSING");
+    const stat5 = await lstat3(sourcePath);
+    if (!stat5.isFile() || stat5.size !== entry.sizeBytes) {
+      throw new Error(`MIGRATION_OBJECT_STORE_FILE_CHANGED:${relativePath}`);
     }
-    await writeFile3(targetPath, Buffer.from(file.contentBase64, "base64"), { mode: 384 });
+    const tarEntry = tarPack.entry({
+      name: archivePath,
+      type: "file",
+      size: stat5.size,
+      mode: archiveMode(entry.mode),
+      mtime: archiveMtime(entry.mtimeMs)
+    });
+    await pipeline(createReadStream2(sourcePath), tarEntry);
+  }
+  tarPack.finalize();
+}
+async function handleArchiveEntry(input) {
+  if (input.header.name === ARCHIVE_MANIFEST_PATH) {
+    if (input.getArchiveManifest()) throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_DUPLICATE");
+    if (input.header.type !== "file") throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_INVALID");
+    const manifestBuffer = await readEntryBuffer(input.stream, MAX_ARCHIVE_MANIFEST_BYTES);
+    input.setArchiveManifest(parseArchiveManifest(manifestBuffer));
+    return;
+  }
+  const archiveManifest = input.getArchiveManifest();
+  if (!archiveManifest) throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_MUST_BE_FIRST");
+  if (!input.header.name.startsWith(ARCHIVE_WORKSPACE_PREFIX)) {
+    throw new Error("MIGRATION_OBJECT_STORE_ARCHIVE_ENTRY_UNEXPECTED");
+  }
+  const relativePath = normalizeWorkspaceRelativePath(
+    input.header.name.slice(ARCHIVE_WORKSPACE_PREFIX.length)
+  );
+  if (input.extractedEntries.has(relativePath)) {
+    throw new Error(`MIGRATION_OBJECT_STORE_ARCHIVE_ENTRY_DUPLICATE:${relativePath}`);
+  }
+  const expected = input.getExpectedEntries().get(relativePath);
+  if (!expected) throw new Error(`MIGRATION_OBJECT_STORE_ARCHIVE_ENTRY_UNEXPECTED:${relativePath}`);
+  input.extractedEntries.add(relativePath);
+  const targetPath = path20.join(input.stagingWorkspacePath, relativePath);
+  await mkdir3(path20.dirname(targetPath), { recursive: true });
+  if (expected.kind === "symlink") {
+    if (input.header.type !== "symlink" || input.header.linkname !== expected.linkTarget) {
+      throw new Error(`MIGRATION_OBJECT_STORE_LINK_TARGET_MISMATCH:${relativePath}`);
+    }
+    await drainEntry(input.stream);
+    await symlink(expected.linkTarget ?? "", targetPath);
+    return;
+  }
+  if (input.header.type !== "file" || input.header.size !== expected.sizeBytes) {
+    throw new Error(`MIGRATION_OBJECT_STORE_FILE_SIZE_MISMATCH:${relativePath}`);
+  }
+  input.addContentBytes(input.header.size ?? 0);
+  const hash = createHash9("sha256");
+  const hashPassThrough = new Transform({
+    transform(chunk, _encoding, callback) {
+      hash.update(chunk);
+      callback(null, chunk);
+    }
+  });
+  await pipeline(
+    input.stream,
+    hashPassThrough,
+    createWriteStream(targetPath, { mode: archiveMode(expected.mode) })
+  );
+  if (expected.sha256 && hash.digest("hex") !== expected.sha256) {
+    throw new Error(`MIGRATION_OBJECT_STORE_FILE_HASH_MISMATCH:${relativePath}`);
   }
-  return {
-    manifest: parsed.manifest,
-    manifestSha256: sha256Buffer2(Buffer.from(canonicalJson2(parsed.manifest), "utf8")),
-    stagingWorkspacePath
-  };
 }
-function parseObjectStoreBundle(buffer) {
+function parseArchiveManifest(buffer) {
   let parsed;
   try {
     parsed = JSON.parse(buffer.toString("utf8"));
   } catch {
-    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_INVALID_JSON");
+    throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_INVALID_JSON");
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_INVALID");
+    throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_INVALID");
   }
-  const bundle = parsed;
-  if (bundle.schemaVersion !== AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION) {
+  const archiveManifest = parsed;
+  if (archiveManifest.schemaVersion !== AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION) {
     throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_UNSUPPORTED");
   }
-  if (!bundle.manifest || typeof bundle.manifest !== "object" || Array.isArray(bundle.manifest)) {
-    throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_MISSING");
+  if (!archiveManifest.manifest || typeof archiveManifest.manifest !== "object" || Array.isArray(archiveManifest.manifest) || archiveManifest.manifest.schemaVersion !== AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION || !Array.isArray(archiveManifest.manifest.files)) {
+    throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_INVALID");
   }
-  if (!Array.isArray(bundle.files)) throw new Error("MIGRATION_OBJECT_STORE_FILES_MISSING");
-  return bundle;
+  return archiveManifest;
+}
+function expectedWorkspaceEntries(manifest) {
+  const result = /* @__PURE__ */ new Map();
+  for (const entry of manifest.files) {
+    if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
+      throw new Error("MIGRATION_OBJECT_STORE_UNSUPPORTED_ENTRY");
+    }
+    const relativePath = normalizeWorkspaceRelativePath(entry.workspaceRelativePath);
+    if (result.has(relativePath)) {
+      throw new Error(`MIGRATION_OBJECT_STORE_MANIFEST_ENTRY_DUPLICATE:${relativePath}`);
+    }
+    result.set(relativePath, entry);
+  }
+  return result;
+}
+function assertAgentMigrationObjectStoreBundleSize(manifest, maxBytes) {
+  assertPositiveMaxBytes(maxBytes);
+  let total = 0;
+  for (const entry of manifest.files) {
+    if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
+      throw new Error("MIGRATION_OBJECT_STORE_UNSUPPORTED_ENTRY");
+    }
+    if (entry.kind !== "file") continue;
+    if (!Number.isSafeInteger(entry.sizeBytes) || (entry.sizeBytes ?? -1) < 0) {
+      throw new Error("MIGRATION_OBJECT_STORE_FILE_SIZE_INVALID");
+    }
+    total += entry.sizeBytes ?? 0;
+    if (!Number.isSafeInteger(total)) throw new Error("MIGRATION_OBJECT_STORE_FILE_SIZE_INVALID");
+  }
+  if (total > maxBytes) {
+    throw new AgentMigrationObjectStoreBundleTooLargeError(total, maxBytes);
+  }
+  return total;
 }
 function normalizeWorkspaceRelativePath(relativePath) {
   const normalized = path20.posix.normalize(relativePath.replaceAll("\\", "/"));
@@ -23078,6 +23929,40 @@ function normalizeWorkspaceRelativePath(relativePath) {
   }
   return normalized;
 }
+function writeBufferedEntry(tarPack, header, buffer) {
+  return new Promise((resolve, reject) => {
+    tarPack.entry(header, buffer, (error) => {
+      if (error) reject(error);
+      else resolve();
+    });
+  });
+}
+async function readEntryBuffer(stream, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of stream) {
+    const buffer = Buffer.from(chunk);
+    total += buffer.byteLength;
+    if (total > maxBytes) throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_TOO_LARGE");
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks, total);
+}
+async function drainEntry(stream) {
+  for await (const _chunk of stream) {
+  }
+}
+function assertPositiveMaxBytes(maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new Error("MIGRATION_OBJECT_STORE_MAX_BYTES_INVALID");
+  }
+}
+function archiveMode(mode) {
+  return typeof mode === "number" ? mode & 511 : 384;
+}
+function archiveMtime(mtimeMs) {
+  return typeof mtimeMs === "number" && Number.isFinite(mtimeMs) ? new Date(mtimeMs) : /* @__PURE__ */ new Date(0);
+}
 function canonicalJson2(value) {
   return JSON.stringify(sortJsonValue2(value));
 }
@@ -23098,8 +23983,8 @@ function sanitizePathSegment(value) {
 
 // src/agentMigrationImport.ts
 import { createHash as createHash10 } from "crypto";
-import { createReadStream as createReadStream2 } from "fs";
-import { access as access2, cp, lstat as lstat4, mkdir as mkdir4, readlink as readlink3, rename, writeFile as writeFile4 } from "fs/promises";
+import { createReadStream as createReadStream3 } from "fs";
+import { access as access2, cp, lstat as lstat4, mkdir as mkdir4, readlink as readlink3, rename, writeFile as writeFile3 } from "fs/promises";
 import path21 from "path";
 async function buildAgentMigrationAdoptPlan(input) {
   const slockHome = path21.resolve(input.slockHome);
@@ -23288,19 +24173,25 @@ async function placeWorkspace(sourceWorkspacePath, finalWorkspacePath) {
   if (path21.resolve(sourceWorkspacePath) === path21.resolve(finalWorkspacePath)) return;
   const stagingPath = `${finalWorkspacePath}.migration-${process.pid}-${Date.now()}`;
   await mkdir4(path21.dirname(finalWorkspacePath), { recursive: true });
-  await cp(sourceWorkspacePath, stagingPath, { recursive: true, dereference: false, errorOnExist: true, force: false });
+  await cp(sourceWorkspacePath, stagingPath, {
+    recursive: true,
+    dereference: false,
+    verbatimSymlinks: true,
+    errorOnExist: true,
+    force: false
+  });
   await rename(stagingPath, finalWorkspacePath);
 }
 async function writeArrivalReport(reportPath, report) {
   const payload = `${canonicalJson3(report)}
 `;
   await mkdir4(path21.dirname(reportPath), { recursive: true });
-  await writeFile4(reportPath, payload, { mode: 384 });
+  await writeFile3(reportPath, payload, { mode: 384 });
   return sha256Buffer3(Buffer.from(payload, "utf8"));
 }
 async function sha256File2(filePath) {
   const hash = createHash10("sha256");
-  const stream = createReadStream2(filePath);
+  const stream = createReadStream3(filePath);
   for await (const chunk of stream) {
     hash.update(chunk);
   }
@@ -23325,10 +24216,10 @@ function sanitizePathSegment2(value) {
 }
 
 // src/secretFile.ts
-import { chmodSync, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
 import path22 from "path";
 function readSecretFileSync(filePath) {
-  return readFileSync9(filePath, "utf8").trim();
+  return readFileSync10(filePath, "utf8").trim();
 }
 
 // src/core.ts
@@ -23400,7 +24291,10 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     endAttrs: ["outcome", "error_class"]
   },
   "daemon.computer_control.received": {
-    spanAttrs: ["action", "handled"]
+    spanAttrs: ["action", "handled", "operation_id", "request_id"]
+  },
+  "daemon.computer_control.replayed": {
+    spanAttrs: ["action", "operation_id", "outcome"]
   },
   "daemon.ready.sent": {
     spanAttrs: ["runtimes_count", "running_agents_count", "idle_agents_count", "runtime_profile_reports_count"]
@@ -23439,6 +24333,28 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
   "daemon.connection.local_disconnect_observed": {
     spanAttrs: ["running_agents_count", "idle_agents_count"]
   },
+  "daemon.migration_transport.object_store": {
+    spanAttrs: [
+      "outcome",
+      "role",
+      "transfer_kind",
+      "agent_id_present",
+      "migration_id_present",
+      "session_id_present",
+      "error_class",
+      "endpoint_class",
+      "http_status",
+      "content_length_present",
+      "upload_body_mode",
+      "bundle_size_bucket",
+      "bundle_content_bytes",
+      "max_bytes",
+      "manifest_sha_present",
+      "attempt",
+      "status",
+      "retry_delay_ms"
+    ]
+  },
   "daemon.agent.activity.produced": {
     // isHeartbeat/is_heartbeat (#460 V1) and process_instance_id (#460 V3)
     // were emitted by agentProcessManager but scrubbed here (pilot violation
@@ -23505,6 +24421,36 @@ function migrationTransferFailureMessage(err) {
   const message = err instanceof Error ? err.message : String(err);
   return message.slice(0, 500);
 }
+function migrationTransferFailureCode(err) {
+  return err instanceof AgentMigrationObjectStoreBundleTooLargeError ? err.code : void 0;
+}
+var MigrationObjectStoreUploadHttpError = class extends Error {
+  constructor(status, archiveBytes) {
+    super(`MIGRATION_OBJECT_STORE_UPLOAD_FAILED:${status}`);
+    this.status = status;
+    this.archiveBytes = archiveBytes;
+    this.name = "MigrationObjectStoreUploadHttpError";
+  }
+};
+function migrationObjectStoreFailureTraceAttrs(err) {
+  if (!(err instanceof MigrationObjectStoreUploadHttpError)) return {};
+  return {
+    endpoint_class: "object_store",
+    http_status: err.status,
+    content_length_present: true,
+    upload_body_mode: "spooled_file",
+    bundle_size_bucket: migrationObjectStoreBundleSizeBucket(err.archiveBytes)
+  };
+}
+function migrationObjectStoreBundleSizeBucket(bytes) {
+  if (bytes < 1024 * 1024) return "lt_1_mib";
+  if (bytes < 16 * 1024 * 1024) return "1_to_16_mib";
+  if (bytes < 128 * 1024 * 1024) return "16_to_128_mib";
+  if (bytes < 512 * 1024 * 1024) return "128_to_512_mib";
+  if (bytes < 1024 * 1024 * 1024) return "512_mib_to_1_gib";
+  if (bytes < 3 * 1024 * 1024 * 1024) return "1_to_3_gib";
+  return "gte_3_gib";
+}
 async function migrationStepErrorSuffix(response) {
   try {
     const body = await response.clone().json();
@@ -23534,6 +24480,8 @@ function parseDaemonCliArgs(args) {
   return { serverUrl, apiKey };
 }
 function readDaemonVersion(moduleUrl = import.meta.url) {
+  const baked = process.env.RAFT_DAEMON_VERSION;
+  if (typeof baked === "string" && baked.length > 0) return baked;
   try {
     const require2 = createRequire3(moduleUrl);
     return require2("../package.json").version;
@@ -23562,7 +24510,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-VNC64ECP.js");
+  await import("./dist-6QZ4QRGY.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -23740,6 +24688,7 @@ var DaemonCore = class {
   traceBundleUploader = null;
   coreStartingAgentIds = /* @__PURE__ */ new Set();
   coreStartPendingDeliveries = /* @__PURE__ */ new Map();
+  handledComputerControlOperationIds = /* @__PURE__ */ new Set();
   constructor(options) {
     this.options = options;
     this.daemonVersion = options.daemonVersion ?? readDaemonVersion();
@@ -23896,7 +24845,12 @@ var DaemonCore = class {
       span.addEvent("daemon.agents.stopped");
     } finally {
       if (this.connection.connected) {
-        this.connection.send({ type: "machine:shutdown", reason: shutdownReason });
+        const lifecycleAcks = this.options.getComputerLifecycleAcks?.().filter((ack) => ack.phase === "shutdown");
+        this.connection.send({
+          type: "machine:shutdown",
+          reason: shutdownReason,
+          ...lifecycleAcks && lifecycleAcks.length > 0 ? { lifecycleAcks } : {}
+        });
         span.addEvent("daemon.connection.shutdown_notice_sent", {
           outcome: "sent",
           shutdown_reason: shutdownReason
@@ -24093,7 +25047,8 @@ var DaemonCore = class {
         agent_id_present: Boolean(lease.agentId),
         migration_id_present: Boolean(lease.migrationId),
         session_id_present: Boolean(lease.sessionId),
-        error_class: err instanceof Error ? err.name : typeof err
+        error_class: err instanceof Error ? err.name : typeof err,
+        ...migrationObjectStoreFailureTraceAttrs(err)
       }, "error");
       try {
         await this.reportMigrationTransportLost(lease, err);
@@ -24134,23 +25089,44 @@ var DaemonCore = class {
       workspacePath: path23.join(this.agentsDataDir, lease.agentId),
       maxBytes: lease.maxBytes
     });
-    const response = await daemonFetch(lease.url, {
-      method: "PUT",
-      headers: {
-        ...this.migrationObjectStoreHeaders(lease),
-        "Content-Type": AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE
-      },
-      body: new Uint8Array(built.bundle)
-    });
-    if (!response.ok) {
-      throw new Error(`MIGRATION_OBJECT_STORE_UPLOAD_FAILED:${response.status}`);
+    const spoolDirectory = await mkdtemp(path23.join(os8.tmpdir(), "raft-agent-migration-upload-"));
+    const spoolPath = path23.join(spoolDirectory, "bundle.tar.gz");
+    let archiveBytes = 0;
+    let uploadStatus = 0;
+    try {
+      await pipeline2(
+        built.bundle,
+        createWriteStream2(spoolPath, { flags: "wx", mode: 384 })
+      );
+      archiveBytes = (await stat4(spoolPath)).size;
+      const response = await daemonFetch(lease.url, {
+        method: "PUT",
+        headers: {
+          ...this.migrationObjectStoreHeaders(lease),
+          "Content-Type": AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE,
+          "Content-Length": String(archiveBytes)
+        },
+        body: Readable3.toWeb(createReadStream4(spoolPath)),
+        duplex: "half"
+      });
+      if (!response.ok) {
+        throw new MigrationObjectStoreUploadHttpError(response.status, archiveBytes);
+      }
+      uploadStatus = response.status;
+    } finally {
+      await rm4(spoolDirectory, { recursive: true, force: true });
     }
     await this.reportMigrationSourceReady(lease, built.manifestSha256);
     this.recordDaemonTrace("daemon.migration_transport.object_store", {
       outcome: "uploaded",
       role: lease.role,
       transfer_kind: lease.transferKind,
-      bundle_bytes: built.bundle.byteLength,
+      endpoint_class: "object_store",
+      http_status: uploadStatus,
+      content_length_present: true,
+      upload_body_mode: "spooled_file",
+      bundle_size_bucket: migrationObjectStoreBundleSizeBucket(archiveBytes),
+      bundle_content_bytes: built.contentBytes,
       max_bytes: lease.maxBytes
     });
   }
@@ -24158,14 +25134,13 @@ var DaemonCore = class {
     if (lease.transferKind !== "download") {
       throw new Error("MIGRATION_OBJECT_STORE_TARGET_KIND_MISMATCH");
     }
-    const bundle = await this.downloadMigrationObjectStoreBundleWithRetry(lease);
-    if (bundle.byteLength > lease.maxBytes) {
-      throw new Error("MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE");
-    }
+    const response = await this.downloadMigrationObjectStoreBundleWithRetry(lease);
+    if (!response.body) throw new Error("MIGRATION_OBJECT_STORE_DOWNLOAD_BODY_MISSING");
     const staged = await stageAgentMigrationObjectStoreBundle({
-      bundle,
+      bundle: Readable3.fromWeb(response.body),
       slockHome: this.slockHome,
-      sessionId: lease.sessionId
+      sessionId: lease.sessionId,
+      maxBytes: lease.maxBytes
     });
     const targetImport = await this.fetchMigrationTargetImportView(lease.migrationId);
     if (targetImport.agentId !== lease.agentId) {
@@ -24194,7 +25169,7 @@ var DaemonCore = class {
       outcome: "imported",
       role: lease.role,
       transfer_kind: lease.transferKind,
-      bundle_bytes: bundle.byteLength,
+      bundle_content_bytes: staged.contentBytes,
       manifest_sha_present: true
     });
   }
@@ -24212,7 +25187,7 @@ var DaemonCore = class {
           headers: this.migrationObjectStoreHeaders(lease)
         });
         if (response.ok) {
-          return Buffer.from(await response.arrayBuffer());
+          return response;
         }
         lastStatus = response.status;
         lastErrorClass = null;
@@ -24254,6 +25229,7 @@ var DaemonCore = class {
       body: JSON.stringify({
         role: lease.role,
         transferKind: lease.transferKind,
+        code: migrationTransferFailureCode(err),
         message: migrationTransferFailureMessage(err)
       })
     });
@@ -24825,14 +25801,29 @@ var DaemonCore = class {
       case "computer:restart":
       case "computer:upgrade": {
         const action = msg.type === "computer:restart" ? "restart" : "upgrade";
-        const requestId = msg.requestId;
+        const operationId = msg.operationId ?? msg.requestId;
+        const requestId = msg.requestId ?? msg.operationId;
+        const alreadyDurable = operationId ? this.options.getComputerLifecycleAcks?.().some(
+          (ack) => (ack.operationId ?? ack.requestId) === operationId
+        ) ?? false : false;
+        if (operationId && (alreadyDurable || this.handledComputerControlOperationIds.has(operationId))) {
+          this.recordDaemonTrace("daemon.computer_control.replayed", {
+            action,
+            operation_id: operationId,
+            outcome: "ignored"
+          });
+          break;
+        }
+        if (operationId) this.handledComputerControlOperationIds.add(operationId);
         this.recordDaemonTrace("daemon.computer_control.received", {
           action,
           handled: Boolean(this.options.onComputerControl),
+          ...operationId ? { operation_id: operationId } : {},
           ...requestId ? { request_id: requestId } : {}
         });
         if (this.options.onComputerControl) {
           const ctx = {
+            operationId,
             requestId,
             emitUpgradeProgress: (ev) => {
               if (!requestId) return;
@@ -24853,6 +25844,16 @@ var DaemonCore = class {
         }
         break;
       }
+      case "computer:lifecycle:receipt": {
+        if (this.options.onComputerLifecycleReceipt) {
+          void Promise.resolve(this.options.onComputerLifecycleReceipt(msg.operationId, msg.phase)).catch((err) => {
+            logger.warn(
+              `[Daemon] lifecycle receipt persistence failed: ${err instanceof Error ? err.message : String(err)}`
+            );
+          });
+        }
+        break;
+      }
     }
   }
   onReminderFire(job) {
@@ -24881,14 +25882,21 @@ var DaemonCore = class {
     const runtimeProfileReports = this.agentManager.getAgentRuntimeProfileReports();
     this.connection.send({
       type: "ready",
-      capabilities: ["agent:start", "agent:stop", "agent:deliver", "workspace:files"],
+      capabilities: [
+        "agent:start",
+        "agent:stop",
+        "agent:deliver",
+        "workspace:files",
+        ...this.options.computerControlViaSupervisor ? [COMPUTER_CAPABILITY_SUPERVISOR_MUTATIONS] : []
+      ],
       runtimes,
       runningAgents: runningAgentIds,
       hostname: this.options.hostname ?? os8.hostname(),
       os: this.options.osDescription ?? `${os8.platform()} ${os8.arch()}`,
       daemonVersion: this.daemonVersion,
       ...this.computerVersion ? { computerVersion: this.computerVersion } : {},
-      migrationTransport: this.getMigrationTransportReady()
+      migrationTransport: this.getMigrationTransportReady(),
+      ...this.options.getComputerLifecycleAcks ? { lifecycleAcks: this.options.getComputerLifecycleAcks() } : {}
     });
     this.recordDaemonTrace("daemon.ready.sent", {
       runtimes_count: runtimes.length,
@@ -24929,6 +25937,21 @@ var DaemonCore = class {
         );
       });
     }
+    if (this.options.onComputerRestartReconcile) {
+      void Promise.resolve().then(
+        () => this.options.onComputerRestartReconcile((done) => {
+          this.connection.send({ type: "computer:restart:done", ...done });
+          this.recordDaemonTrace("daemon.computer_restart.reconciled", {
+            request_id: done.requestId,
+            ok: done.ok
+          });
+        })
+      ).catch((err) => {
+        logger.error(
+          `[Daemon] computer restart reconcile failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      });
+    }
     for (const agentId of runningAgentIds) {
       const sessionId = this.agentManager.getAgentSessionId(agentId);
       const launchId = this.agentManager.getAgentLaunchId(agentId);
@@ -24990,6 +26013,9 @@ export {
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,
+  detectLegacyDaemonSupervisor,
+  detectLegacyDaemonSupervisorWithProbe,
+  legacyDaemonSupervisorFallbackCommands,
   AGENT_MIGRATION_TRANSPORT_HOST_ENV,
   AGENT_MIGRATION_TRANSPORT_PORT_ENV,
   AGENT_MIGRATION_TRANSPORT_PUBLIC_URL_ENV,
@@ -25002,8 +26028,10 @@ export {
   buildAgentMigrationExportManifest,
   AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
   AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE,
+  AgentMigrationObjectStoreBundleTooLargeError,
   buildAgentMigrationObjectStoreBundle,
   stageAgentMigrationObjectStoreBundle,
+  assertAgentMigrationObjectStoreBundleSize,
   buildAgentMigrationAdoptPlan,
   verifyAgentMigrationAdoptPlan,
   executeAgentMigrationAdoptPlan,