@botiverse/raft-daemon 1.0.9 → 1.0.10

package/dist/{chunk-56EVMMRV.js → chunk-4AOBILXQ.js}

@@ -1,7 +1,7 @@
 // src/core.ts
 import path25 from "path";
 import os11 from "os";
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { createRequire as createRequire3 } from "module";
 import { accessSync, createReadStream as createReadStream4, createWriteStream as createWriteStream2 } from "fs";
 import { mkdtemp, rm as rm4, stat as stat4 } from "fs/promises";
@@ -1709,15 +1709,22 @@ var TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS = [
   ["shadow_action", "string"],
   ["shadow_reason", "string"],
   ["shadow_direction", "string"],
-  ["shadow_plan_kind", "string"]
+  ["shadow_plan_kind", "string"],
+  ["machine_affinity_route", "string"],
+  ["replay_status", "int"]
 ];
+var TRACE_EVENT_ROW_V2_LEGACY_PROJECTION_COLUMNS = Object.freeze(TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.slice(0, 57));
 var TRACE_EVENT_ROW_V2_TABLE = "raft.trace_events_v2";
-var TRACE_EVENT_ROW_V2_INGEST_STATEMENT = [
-  "SELECT",
-  TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column, type]) => `$0["${column}"]::${type} AS ${column}`).join(", "),
-  `INSERT INTO ${TRACE_EVENT_ROW_V2_TABLE}`,
-  `(${TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS.map(([column]) => column).join(", ")})`
-].join(" ");
+function buildTraceEventRowV2IngestStatement(columns) {
+  return [
+    "SELECT",
+    columns.map(([column, type]) => `$0["${column}"]::${type} AS ${column}`).join(", "),
+    `INSERT INTO ${TRACE_EVENT_ROW_V2_TABLE}`,
+    `(${columns.map(([column]) => column).join(", ")})`
+  ].join(" ");
+}
+var TRACE_EVENT_ROW_V2_INGEST_STATEMENT = buildTraceEventRowV2IngestStatement(TRACE_EVENT_ROW_V2_PROJECTION_COLUMNS);
+var TRACE_EVENT_ROW_V2_LEGACY_INGEST_STATEMENT = buildTraceEventRowV2IngestStatement(TRACE_EVENT_ROW_V2_LEGACY_PROJECTION_COLUMNS);
 var PROMOTED_IDENTITY_ATTRS = [
   "server_id",
   "machine_id",
@@ -1773,7 +1780,8 @@ var PROMOTED_CLOSED_ATTRS = [
   "shadow_action",
   "shadow_reason",
   "shadow_direction",
-  "shadow_plan_kind"
+  "shadow_plan_kind",
+  "machine_affinity_route"
 ];
 var TRACE_EVENT_ROW_PROMOTED_ATTRS = [
   ...PROMOTED_IDENTITY_ATTRS,
@@ -2849,6 +2857,10 @@ var agentApiIntegrationAppUpdateBodySchema = passthroughObject({
   scopes: optionalStringArraySchema,
   unsafeDemoUrlOverride: optionalBooleanSchema
 });
+var agentApiIntegrationAppStatusQuerySchema = passthroughObject({
+  card: optionalStringSchema,
+  client: optionalStringSchema
+});
 var agentApiActionPrepareBodySchema = passthroughObject({
   target: z3.string().trim().min(1),
   action: actionCardActionSchema
@@ -3003,6 +3015,23 @@ var agentApiIntegrationAppUpdateResponseSchema = passthroughObject({
   clientName: z3.string(),
   updatedFields: z3.array(z3.string())
 });
+var agentApiOwnedIntegrationAppSchema = z3.object({
+  state: z3.enum(["card_pending", "committed"]),
+  card: nullableStringSchema,
+  name: z3.string(),
+  clientKey: nullableStringSchema,
+  createdAt: z3.string(),
+  callbackUrl: nullableStringSchema,
+  scopes: z3.array(z3.string()),
+  category: nullableStringSchema,
+  recoveryCommand: nullableStringSchema
+});
+var agentApiIntegrationAppListResponseSchema = z3.object({
+  apps: z3.array(agentApiOwnedIntegrationAppSchema)
+});
+var agentApiIntegrationAppStatusResponseSchema = z3.object({
+  app: agentApiOwnedIntegrationAppSchema
+});
 var agentApiAttachmentEnvelopeSchema = passthroughObject({
   id: z3.string(),
   filename: z3.string()
@@ -3799,6 +3828,26 @@ var agentApiContract = {
     request: { body: agentApiIntegrationAppUpdateBodySchema },
     response: { body: agentApiIntegrationAppUpdateResponseSchema }
   }),
+  integrationAppList: route({
+    key: "integrationAppList",
+    method: "GET",
+    path: "/integrations/app",
+    client: { resource: "integrations", method: "listApps" },
+    capability: "read",
+    description: "List pending app registration cards requested by this agent and server-local apps this agent currently owns.",
+    request: {},
+    response: { body: agentApiIntegrationAppListResponseSchema }
+  }),
+  integrationAppStatus: route({
+    key: "integrationAppStatus",
+    method: "GET",
+    path: "/integrations/app/status",
+    client: { resource: "integrations", method: "getAppStatus" },
+    capability: "read",
+    description: "Get one requester-visible registration card or currently owned app without disclosing non-owned app existence.",
+    request: { query: agentApiIntegrationAppStatusQuerySchema },
+    response: { body: agentApiIntegrationAppStatusResponseSchema }
+  }),
   actionPrepare: route({
     key: "actionPrepare",
     method: "POST",
@@ -5045,9 +5094,8 @@ var TRIAL_DURATION_DAYS = (TRIAL_END_DATE.getTime() - TRIAL_START_DATE.getTime()
 // src/agentProcessManager.ts
 import { readFileSync as readFileSync7 } from "fs";
 import { readdir as readdir2, stat as stat2, readFile, rm as rm2, lstat, realpath, open } from "fs/promises";
-import { createHash as createHash3, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
 import path16 from "path";
-import { gzipSync } from "zlib";
 import os9 from "os";
 
 // src/proxy.ts
@@ -5119,12 +5167,12 @@ function resolveProxyUrl(targetUrl, env) {
   if (shouldBypassProxy(targetUrl, env)) return void 0;
   return proxyUrl;
 }
-function createProxyDispatcher(proxyUrl, timeoutMs) {
+function createProxyDispatcher(proxyUrl, connectTimeoutMs, headersTimeoutMs) {
   return new ProxyAgent({
     uri: proxyUrl,
-    connect: { timeout: timeoutMs },
-    requestTls: { timeout: timeoutMs },
-    headersTimeout: timeoutMs
+    connect: { timeout: connectTimeoutMs },
+    requestTls: { timeout: connectTimeoutMs },
+    headersTimeout: headersTimeoutMs
   });
 }
 function closeDispatcherBestEffort(dispatcher) {
@@ -5137,29 +5185,40 @@ function buildFetchDispatcher(targetUrl, env) {
   const cached = fetchDispatcherCache.get(proxyUrl);
   if (cached) return cached;
   const timeoutMs = getFetchPreResponseTimeoutMs(env);
-  const dispatcher = createProxyDispatcher(proxyUrl, timeoutMs);
+  const dispatcher = createProxyDispatcher(proxyUrl, timeoutMs, timeoutMs);
   fetchDispatcherCache.set(proxyUrl, dispatcher);
   return dispatcher;
 }
-function getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env) {
+function getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env, headersTimeoutMs) {
   const proxyUrl = resolveProxyUrl(targetUrl, env);
   const routeKey = proxyUrl ? `proxy:${proxyUrl}` : `direct:${new URL(targetUrl).origin}`;
-  return { cacheKey: `${isolationKey}\0${routeKey}`, proxyUrl };
+  const connectTimeoutMs = getFetchPreResponseTimeoutMs(env);
+  const effectiveHeadersTimeoutMs = headersTimeoutMs ?? connectTimeoutMs;
+  return {
+    cacheKey: `${isolationKey}\0${routeKey}\0connect:${connectTimeoutMs}\0headers:${effectiveHeadersTimeoutMs}`,
+    proxyUrl,
+    connectTimeoutMs,
+    headersTimeoutMs: effectiveHeadersTimeoutMs
+  };
 }
-function buildIsolatedFetchDispatcher(targetUrl, isolationKey, env) {
-  const { cacheKey, proxyUrl } = getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env);
+function buildIsolatedFetchDispatcher(targetUrl, isolationKey, env, headersTimeoutMs) {
+  const {
+    cacheKey,
+    proxyUrl,
+    connectTimeoutMs,
+    headersTimeoutMs: effectiveHeadersTimeoutMs
+  } = getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env, headersTimeoutMs);
   const cached = isolatedFetchDispatcherCache.get(cacheKey);
   if (cached) return cached;
-  const timeoutMs = getFetchPreResponseTimeoutMs(env);
-  const dispatcher = proxyUrl ? createProxyDispatcher(proxyUrl, timeoutMs) : new Agent({
-    connect: { timeout: timeoutMs },
-    headersTimeout: timeoutMs
+  const dispatcher = proxyUrl ? createProxyDispatcher(proxyUrl, connectTimeoutMs, effectiveHeadersTimeoutMs) : new Agent({
+    connect: { timeout: connectTimeoutMs },
+    headersTimeout: effectiveHeadersTimeoutMs
   });
   isolatedFetchDispatcherCache.set(cacheKey, dispatcher);
   return dispatcher;
 }
-function evictIsolatedFetchDispatcher(targetUrl, isolationKey, env) {
-  const { cacheKey } = getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env);
+function evictIsolatedFetchDispatcher(targetUrl, isolationKey, env, headersTimeoutMs) {
+  const { cacheKey } = getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env, headersTimeoutMs);
   const cached = isolatedFetchDispatcherCache.get(cacheKey);
   if (!cached) return false;
   isolatedFetchDispatcherCache.delete(cacheKey);
@@ -5183,12 +5242,20 @@ function withDaemonFetchProxy(input, init = {}, env = process.env) {
 }
 async function daemonFetch(input, init, env = process.env, options = {}) {
   const targetUrl = input.toString();
-  const fetchInit = options.isolationKey ? { ...init, dispatcher: buildIsolatedFetchDispatcher(targetUrl, options.isolationKey, env) } : withDaemonFetchProxy(input, init, env);
+  const fetchInit = options.isolationKey ? {
+    ...init,
+    dispatcher: buildIsolatedFetchDispatcher(
+      targetUrl,
+      options.isolationKey,
+      env,
+      options.headersTimeoutMs
+    )
+  } : withDaemonFetchProxy(input, init, env);
   try {
     return await fetch(input, fetchInit);
   } catch (err) {
     if (options.isolationKey) {
-      evictIsolatedFetchDispatcher(targetUrl, options.isolationKey, env);
+      evictIsolatedFetchDispatcher(targetUrl, options.isolationKey, env, options.headersTimeoutMs);
     } else {
       evictFetchDispatcher(targetUrl, env);
     }
@@ -5211,6 +5278,10 @@ function formatAttachmentSuffix(attachments, style = "slock_cli") {
   return ` [${attachments.length} attachment${attachments.length > 1 ? "s" : ""}: ${attachmentList} \u2014 ${attachmentDownloadHint(style)}]`;
 }
 
+// src/feedbackTranscriptCollector.ts
+import { createHash, randomUUID } from "crypto";
+import { gzipSync } from "zlib";
+
 // src/logger.ts
 var listeners = /* @__PURE__ */ new Set();
 function timestamp() {
@@ -5475,6 +5546,182 @@ async function uploadWithSignedCapability({
   return { capability, session, uploadResponse };
 }
 
+// src/feedbackTranscriptWindow.ts
+var FEEDBACK_TRANSCRIPT_REPORT_WINDOW_TOLERANCE_MS = 15 * 60 * 1e3;
+var TIMESTAMP_KEYS = /* @__PURE__ */ new Set([
+  "timestamp",
+  "createdAt",
+  "created_at",
+  "updatedAt",
+  "updated_at",
+  "startedAt",
+  "started_at",
+  "endedAt",
+  "ended_at"
+]);
+var MAX_SCAN_DEPTH = 12;
+var MAX_SCANNED_NODES = 1e5;
+function assessFeedbackTranscriptWindow(input) {
+  const toleranceMs = input.toleranceMs ?? FEEDBACK_TRANSCRIPT_REPORT_WINDOW_TOLERANCE_MS;
+  const reportMs = parseTimestamp(input.reportGeneratedAt);
+  if (reportMs === null) {
+    return {
+      reportGeneratedAt: input.reportGeneratedAt,
+      reportTimeSource: input.reportTimeSource,
+      reportWindowStartAt: input.reportGeneratedAt,
+      toleranceMs,
+      coverage: "report_time_invalid"
+    };
+  }
+  const timestamps = extractTranscriptTimestamps(input.transcript);
+  const reportWindowStartMs = reportMs - toleranceMs;
+  const base = {
+    reportGeneratedAt: new Date(reportMs).toISOString(),
+    reportTimeSource: input.reportTimeSource,
+    reportWindowStartAt: new Date(reportWindowStartMs).toISOString(),
+    toleranceMs
+  };
+  if (timestamps.length === 0) {
+    return { ...base, coverage: "timestamps_unavailable" };
+  }
+  let firstMs = timestamps[0];
+  let lastMs = timestamps[0];
+  for (const timestamp2 of timestamps) {
+    if (timestamp2 < firstMs) firstMs = timestamp2;
+    if (timestamp2 > lastMs) lastMs = timestamp2;
+  }
+  return {
+    ...base,
+    coverage: lastMs >= reportWindowStartMs ? "covered" : "outside_report_window",
+    transcriptFirstEventAt: new Date(firstMs).toISOString(),
+    transcriptLastEventAt: new Date(lastMs).toISOString()
+  };
+}
+function extractTranscriptTimestamps(transcript) {
+  const timestamps = [];
+  const budget = { visited: 0 };
+  const trimmed = transcript.trim();
+  if (!trimmed) return timestamps;
+  try {
+    collectTimestamps(JSON.parse(trimmed), timestamps, budget, 0);
+    return timestamps;
+  } catch {
+  }
+  for (const line of transcript.split(/\r?\n/)) {
+    if (budget.visited >= MAX_SCANNED_NODES) break;
+    const candidate = line.trim();
+    if (!candidate) continue;
+    try {
+      collectTimestamps(JSON.parse(candidate), timestamps, budget, 0);
+    } catch {
+    }
+  }
+  return timestamps;
+}
+function collectTimestamps(value, timestamps, budget, depth) {
+  if (depth > MAX_SCAN_DEPTH || budget.visited >= MAX_SCANNED_NODES) return;
+  budget.visited += 1;
+  if (Array.isArray(value)) {
+    for (const item of value) collectTimestamps(item, timestamps, budget, depth + 1);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    if (TIMESTAMP_KEYS.has(key)) {
+      const parsed = parseTimestamp(child);
+      if (parsed !== null) timestamps.push(parsed);
+    }
+    collectTimestamps(child, timestamps, budget, depth + 1);
+  }
+}
+function parseTimestamp(value) {
+  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T/.test(value)) return null;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+// src/feedbackTranscriptCollector.ts
+function defaultFeedbackTranscriptReportWindow() {
+  return {
+    reportGeneratedAt: currentDate().toISOString(),
+    reportTimeSource: "server_request_received"
+  };
+}
+async function collectFeedbackTranscriptAttachment(input) {
+  const transcriptResult = await input.getSessionTranscript();
+  if (!transcriptResult.reachable || !transcriptResult.transcript) {
+    return {
+      reachable: false,
+      fallbackReason: transcriptResult.fallbackReason ?? "transcript not reachable"
+    };
+  }
+  const transcriptWindow = assessFeedbackTranscriptWindow({
+    transcript: transcriptResult.transcript,
+    ...input.reportWindow
+  });
+  if (!input.workerUrl) {
+    return {
+      reachable: true,
+      fallbackReason: "daemon worker URL is not configured",
+      transcriptWindow
+    };
+  }
+  const span = input.tracer.startSpan("daemon.feedback_transcript.upload", {
+    surface: "daemon",
+    kind: "producer",
+    attrs: {
+      agentId: input.agentId,
+      feedbackReportId: input.feedbackReportId,
+      runtime: transcriptResult.runtime,
+      sessionId: transcriptResult.sessionId,
+      transcript_size_bytes: transcriptResult.sizeBytes,
+      transcript_window_coverage: transcriptWindow.coverage,
+      transcript_window_report_time_source: transcriptWindow.reportTimeSource
+    }
+  });
+  try {
+    const gzipped = gzipSync(Buffer.from(transcriptResult.transcript, "utf8"));
+    const bundleSha256 = createHash("sha256").update(gzipped).digest("hex");
+    const bundleSizeBytes = gzipped.byteLength;
+    const bundleId = randomUUID();
+    const uploadResult = await uploadWithSignedCapability({
+      serverUrl: input.serverUrl,
+      apiKey: input.daemonApiKey,
+      workerUrl: input.workerUrl,
+      scope: "daemon-trace-bundle:create",
+      createPath: "/api/trace-bundles",
+      createBody: { bundleSha256, bundleSizeBytes },
+      attestationMetadata: {
+        bundleId,
+        bundleSha256,
+        bundleSizeBytes,
+        bundleContentType: "application/json",
+        bundleContentEncoding: "gzip",
+        feedbackReportId: input.feedbackReportId,
+        agentId: input.agentId,
+        feedbackReportGeneratedAt: transcriptWindow.reportGeneratedAt,
+        feedbackReportTimeSource: transcriptWindow.reportTimeSource,
+        feedbackReportWindowStartAt: transcriptWindow.reportWindowStartAt,
+        feedbackTranscriptWindowToleranceMs: transcriptWindow.toleranceMs,
+        feedbackTranscriptWindowCoverage: transcriptWindow.coverage,
+        ...transcriptWindow.transcriptFirstEventAt ? { feedbackTranscriptFirstEventAt: transcriptWindow.transcriptFirstEventAt } : {},
+        ...transcriptWindow.transcriptLastEventAt ? { feedbackTranscriptLastEventAt: transcriptWindow.transcriptLastEventAt } : {}
+      },
+      uploadBody: new Blob([new Uint8Array(gzipped)], { type: "application/json" }),
+      fetchImpl: input.fetchImpl
+    });
+    const traceBundleId = typeof uploadResult.session.id === "string" ? uploadResult.session.id : bundleId;
+    logger.info(`[FeedbackTranscript] uploaded for report=${input.feedbackReportId} agent=${input.agentId} traceBundleId=${traceBundleId} size=${bundleSizeBytes}`);
+    span.end("ok", { attrs: { traceBundleId, bundleSizeBytes, transcript_window_coverage: transcriptWindow.coverage } });
+    return { reachable: true, traceBundleId, transcriptWindow };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    logger.warn(`[FeedbackTranscript] upload failed for report=${input.feedbackReportId} agent=${input.agentId}: ${message}`);
+    span.end("error", { attrs: { error_class: err instanceof Error ? err.name : "Error", error_message: message } });
+    return { reachable: true, error: message, transcriptWindow };
+  }
+}
+
 // src/drivers/claude.ts
 import { spawn } from "child_process";
 
@@ -6089,7 +6336,7 @@ import http from "http";
 import { URL as URL2 } from "url";
 
 // src/apmStateMachine.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var MAX_APM_GATED_STEERING_EVENTS = 12;
 function reviewStatePatch(state) {
   return state.reviewing !== void 0 ? { reviewing: state.reviewing } : {};
@@ -7062,6 +7309,21 @@ var LOCAL_HELD_CONTEXT_LIMIT = 3;
 var AGENT_CREDENTIAL_PROXY_HOST = "127.0.0.1";
 var AGENT_CREDENTIAL_PROXY_BIND_MAX_ATTEMPTS = 3;
 var AGENT_CREDENTIAL_PROXY_FETCH_ISOLATION_KEY = "agent-credential-proxy";
+var AGENT_CREDENTIAL_PROXY_UPLOAD_FETCH_ISOLATION_KEY = "agent-credential-proxy:attachment-upload";
+var DEFAULT_AGENT_CREDENTIAL_PROXY_UPLOAD_HEADERS_TIMEOUT_MS = 5 * 6e4;
+function attachmentUploadHeadersTimeoutMs(env) {
+  const parsed = Number.parseInt(env.SLOCK_DAEMON_ATTACHMENT_UPLOAD_HEADERS_TIMEOUT_MS || "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_AGENT_CREDENTIAL_PROXY_UPLOAD_HEADERS_TIMEOUT_MS;
+}
+function agentCredentialProxyFetchOptions(pathname, env) {
+  if (pathname === "/internal/agent-api/upload") {
+    return {
+      isolationKey: AGENT_CREDENTIAL_PROXY_UPLOAD_FETCH_ISOLATION_KEY,
+      headersTimeoutMs: attachmentUploadHeadersTimeoutMs(env)
+    };
+  }
+  return { isolationKey: AGENT_CREDENTIAL_PROXY_FETCH_ISOLATION_KEY };
+}
 function createProxyRequestHandler() {
   return (req, res) => {
     void handleProxyRequest(req, res);
@@ -7269,7 +7531,7 @@ async function handleProxyRequest(req, res) {
         body
       },
       process.env,
-      { isolationKey: AGENT_CREDENTIAL_PROXY_FETCH_ISOLATION_KEY }
+      agentCredentialProxyFetchOptions(target.pathname, process.env)
     );
     if (upstream.status >= 500) {
       const transportError = transportNormalizedErrorForHttpStatus(target, upstream.status, registration.launchId);
@@ -7361,6 +7623,7 @@ function writeProxyFailureResponse(res, failure) {
   if (failure.lifecycleInvalidContext) body.invariant_context = failure.lifecycleInvalidContext;
   const headers = { "content-type": "application/json" };
   if (failure.correlationId) headers["x-raft-correlation-id"] = failure.correlationId;
+  if (failure.suggestedNextAction) body.suggested_next_action = failure.suggestedNextAction;
   res.writeHead(failure.responseStatusCode ?? 502, headers);
   res.end(JSON.stringify(body));
 }
@@ -7413,6 +7676,11 @@ function proxyFailureForError(method, target, err, context = {}) {
   }
   const errorCause = describeProxyErrorCause(cause);
   if (errorCause) failure.errorCause = errorCause;
+  if (failure.routeFamily === "attachments/upload" && failure.upstreamLayer === "read_timeout" && failure.errorCause?.startsWith("UND_ERR_HEADERS_TIMEOUT")) {
+    failure.responseCode = "ATTACHMENT_UPLOAD_TIMEOUT";
+    failure.responseError = "Attachment upload timed out before the server responded";
+    failure.suggestedNextAction = "The server may still have accepted the file. Wait briefly, then retry once if needed; if it fails again, share the Correlation value with an operator.";
+  }
   return failure;
 }
 function parseAgentNoProcessResidencyInvariant(message) {
@@ -9311,7 +9579,9 @@ function codexThreadStatusChangedEvents(message) {
     const statusMessage = explicitReason ?? "Codex thread entered system error state";
     const errorEvent = {
       kind: "error",
-      message: statusMessage
+      message: statusMessage,
+      nativeReasonPresent: Boolean(explicitReason),
+      reasonProvenance: explicitReason ? "codex_native_reason" : "daemon_fallback"
     };
     if (explicitReason) return [errorEvent];
     return [
@@ -10794,15 +11064,8 @@ var GrokEventNormalizer = class {
         return [{ kind: "tool_output", name: existing.name }];
       }
       case "pending_interaction":
-        return [{
-          kind: "runtime_diagnostic",
-          severity: "warning",
-          source: "grok_acp_notification",
-          itemType: updateKind,
-          message: "Grok Build is waiting for user interaction",
-          payloadBytes: payloadBytes3(update),
-          ...this.sessionIdValue ? { sessionId: this.sessionIdValue } : {}
-        }];
+      case "interaction_resolved":
+        return [internalProgress(updateKind, update)];
       case "turn_completed": {
         const promptId = nonEmptyString4(update.prompt_id);
         const generation = promptId ? this.generationByPromptId.get(promptId) ?? this.activeTurnGeneration : this.activeTurnGeneration;
@@ -11447,7 +11710,7 @@ async function detectGrokModelsFromAcp(options = {}) {
 }
 
 // src/drivers/antigravity.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn4 } from "child_process";
 var DEFAULT_PRINT_TIMEOUT = "30m";
 var ANTIGRAVITY_ENV_OVERRIDES = {
@@ -11525,7 +11788,7 @@ var AntigravityDriver = class {
     };
   }
   async spawn(ctx) {
-    this.sessionId = ctx.config.sessionId || randomUUID();
+    this.sessionId = ctx.config.sessionId || randomUUID2();
     this.sessionAnnounced = false;
     const { command, args, shell } = resolveAntigravitySpawn(buildAntigravityArgs(ctx));
     const { spawnEnv } = await prepareCliTransport(ctx, {
@@ -12066,7 +12329,7 @@ var GeminiDriver = class {
 };
 
 // src/drivers/kimi.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { spawn as spawn8 } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os6 from "os";
@@ -12114,9 +12377,9 @@ var KimiDriver = class {
   promptRequestId = null;
   async spawn(ctx) {
     const isResume = !!ctx.config.sessionId;
-    this.sessionId = ctx.config.sessionId || randomUUID2();
+    this.sessionId = ctx.config.sessionId || randomUUID3();
     this.sessionAnnounced = false;
-    this.promptRequestId = randomUUID2();
+    this.promptRequestId = randomUUID3();
     const systemPromptPath = path10.join(ctx.workingDirectory, KIMI_SYSTEM_PROMPT_FILE);
     const agentFilePath = path10.join(ctx.workingDirectory, KIMI_AGENT_FILE);
     if (!isResume || !existsSync6(systemPromptPath)) {
@@ -12155,7 +12418,7 @@ var KimiDriver = class {
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
-      id: randomUUID2(),
+      id: randomUUID3(),
       method: "initialize",
       params: {
         protocol_version: KIMI_WIRE_PROTOCOL_VERSION,
@@ -12236,7 +12499,7 @@ var KimiDriver = class {
     if (mode === "idle") {
       return JSON.stringify({
         jsonrpc: "2.0",
-        id: randomUUID2(),
+        id: randomUUID3(),
         method: "prompt",
         params: {
           user_input: _text
@@ -12245,7 +12508,7 @@ var KimiDriver = class {
     }
     return JSON.stringify({
       jsonrpc: "2.0",
-      id: randomUUID2(),
+      id: randomUUID3(),
       method: "steer",
       params: {
         user_input: _text
@@ -12291,7 +12554,7 @@ function detectKimiModels(home = os6.homedir()) {
 }
 
 // src/drivers/kimi-sdk.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { EventEmitter } from "events";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "fs";
 import path11 from "path";
@@ -12564,7 +12827,7 @@ var KimiSdkRuntimeSession = class {
     }
     if (this.didClose) return { ok: false, reason: "closed" };
     this.started = true;
-    const sessionId = input.sessionId || this.ctx.config.sessionId || randomUUID3();
+    const sessionId = input.sessionId || this.ctx.config.sessionId || randomUUID4();
     this.mappingState.sessionId = sessionId;
     this.setCurrentSessionId(sessionId);
     const { harness, session, wrapperPath } = await this.sessionFactory(
@@ -13236,7 +13499,7 @@ var OpenCodeDriver = class {
 };
 
 // src/drivers/pi.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
 import { mkdirSync as mkdirSync3, readdirSync as readdirSync3 } from "fs";
 import path13 from "path";
@@ -13966,7 +14229,7 @@ var PiSdkRuntimeSession = class {
     }
     if (this.didClose) return { ok: false, reason: "closed" };
     this.started = true;
-    const sessionId = input.sessionId || this.ctx.config.sessionId || randomUUID4();
+    const sessionId = input.sessionId || this.ctx.config.sessionId || randomUUID5();
     this.mappingState.sessionId = sessionId;
     this.setCurrentSessionId(sessionId);
     const session = await this.sessionFactory({
@@ -14871,6 +15134,36 @@ async function deleteWorkspaceDirectory(dataDir, directoryName) {
   }
 }
 
+// src/onboardingSeedContent.ts
+var ONBOARDING_DAY2_RECAP_PROTOCOL = `## Day-2 10:00 Recap Protocol
+
+When the system wakes you with a reminder whose title starts \`D2 recap:\`, this is the
+one proactive return after onboarding \u2014 not permission to begin a daily cadence.
+
+1. Read the reminder's anchor surface, your current objective statuses, and relevant
+   server history since the opener. Treat only observable receipts as activity: an
+   owner-authored request or decision, a completed setup objective, a delivered agent
+   result, or a newly created agent/channel/invite.
+2. Search the anchor first. If a Day-2 recap was already posted, do not duplicate it.
+3. Always send exactly one short recap in the anchor surface. If there is no observable
+   activity, say that plainly; never invent progress or turn an empty day into
+   motivational copy.
+4. The recap has four parts, in this order:
+   - Briefly explain that a system-set reminder just woke you to recap the prior day,
+     and explain in plain language that Raft reminders can wake an agent at a chosen
+     time to follow up on a specific conversation or task. Keep this to one warm
+     sentence; do not turn the recap into a reminder tutorial.
+   - Recap yesterday's observable activity and what it unlocked, or honestly say no
+     verified progress was recorded.
+   - Prompt one useful next step the owner can continue today.
+   - Ask whether the owner would like this recap every day. Do not create a recurring
+     reminder until the owner explicitly says yes.
+5. Do not suggest inviting anyone in this recap.
+6. If the owner later says yes, schedule a daily 10:00 reminder in the same anchor
+   using the owner's timezone; if they say no or do not answer, schedule nothing.
+7. Honor \`skipped\` and \`later\`. The recap never reopens a declined ask or repeats the
+   language/survey/opener questions.`;
+
 // src/agentStartCoordinator.ts
 var AgentStartCoordinator = class {
   starting = /* @__PURE__ */ new Set();
@@ -15156,7 +15449,7 @@ var AgentStartPendingDeliveryBuffer = class {
 };
 
 // src/agentNoProcessResidency.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var AgentNoProcessResidencyTransitions = class {
   open = /* @__PURE__ */ new Map();
   transitionSeq = 0;
@@ -15179,7 +15472,7 @@ var AgentNoProcessResidencyTransitions = class {
       driver: input.driver,
       launchSource: input.launchSource,
       state: input.state,
-      stateInstanceId: randomUUID5(),
+      stateInstanceId: randomUUID6(),
       isWaitState: input.isWaitState,
       fenceKind: input.fenceKind,
       deadlineUnixMs: typeof input.deadlineUnixMs === "number" ? input.deadlineUnixMs : void 0,
@@ -15819,7 +16112,7 @@ var AgentVisibleDeliveryLedger = class {
 };
 
 // src/runtimeErrorDiagnostics.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var MAX_RUNTIME_ERROR_MESSAGE_EXCERPT_CHARS = 4096;
 var RUNTIME_AUTH_ACTION_REQUIRED_PATTERNS = [
   /access token could not be refreshed/i,
@@ -15877,6 +16170,50 @@ function buildRuntimeErrorDiagnosticEnvelope(message) {
     }
   };
 }
+function buildRuntimeErrorActivityDiagnostic(message, metadata = {}) {
+  const envelope = buildRuntimeErrorDiagnosticEnvelope(message);
+  return {
+    errorClass: normalizeRuntimeErrorClass(envelope.spanAttrs.runtime_error_class),
+    errorReason: normalizeRuntimeErrorReason(envelope.spanAttrs.turn_reason),
+    fingerprint: String(envelope.spanAttrs.runtime_error_fingerprint),
+    reasonProvenance: metadata.reasonProvenance ?? "runtime_error_event",
+    ...typeof metadata.nativeReasonPresent === "boolean" ? { nativeReasonPresent: metadata.nativeReasonPresent } : {}
+  };
+}
+function normalizeRuntimeErrorClass(value) {
+  switch (value) {
+    case "InputTooLargeError":
+    case "RateLimitError":
+    case "AuthError":
+    case "NotFoundError":
+    case "ModelConfigError":
+    case "TimeoutError":
+    case "ProviderConnectionError":
+    case "ProviderStreamError":
+    case "ProviderServerError":
+    case "ProviderApiError":
+      return value;
+    default:
+      return "RuntimeError";
+  }
+}
+function normalizeRuntimeErrorReason(value) {
+  switch (value) {
+    case "input_too_large":
+    case "rate_limited":
+    case "auth_failed":
+    case "not_found":
+    case "model_config_error":
+    case "provider_timeout":
+    case "provider_connection_error":
+    case "provider_stream_error":
+    case "provider_server_error":
+    case "provider_api_error":
+      return value;
+    default:
+      return "unclassified_runtime_error";
+  }
+}
 function formatRuntimeLoginRequiredMessage(runtimeId) {
   if (runtimeId === "builtin") {
     return "Built-in provider authentication failed. Check this agent's provider API key and region/provider selection, then retry starting this agent.";
@@ -16025,7 +16362,7 @@ function runtimeDisplayName(runtimeId) {
 }
 function fingerprintRuntimeError(value) {
   const normalized = value.toLowerCase().replace(/[0-9a-f]{12,}/g, "<hex>").replace(/\b\d+\b/g, "<num>").replace(/\s+/g, " ").trim();
-  return createHash2("sha256").update(normalized).digest("hex").slice(0, 16);
+  return createHash3("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function bucketLength(length) {
   if (length === 0) return "0";
@@ -17069,6 +17406,8 @@ Know that you can ask me anything, anytime \u2014 that's the whole point of me.
 - Manual-first when stuck: use the embedded recipes below, then \`raft manual get recipes/index\`, then \`raft manual get recipes/<slug>\` when available. Every \`raft manual get\` / \`raft manual search\` call requires two short natural-language fields in the same command: \`--intent\` says what the user ultimately wants to accomplish with Raft; \`--reason\` says why Manual is needed now. The recipe references below omit those flags only for readability. Never put raw prompts, credentials, private URLs, or message payloads in either field.
 - Do not read, summarize, paste, or store provider API keys, raw tokens, secrets, or credential files.
 
+${ONBOARDING_DAY2_RECAP_PROTOCOL}
+
 ## Branch Behaviors
 
 ### Owner says they already have workflows
@@ -17305,7 +17644,7 @@ function runtimeProfileNotificationTitle(kind) {
 }
 function hashRuntimeProfileKey(key) {
   if (!key) return void 0;
-  return createHash3("sha256").update(key).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(key).digest("hex").slice(0, 16);
 }
 function runtimeProfileTurnControl(kind, key, source) {
   return {
@@ -19405,7 +19744,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
       };
       const initialSessionId = this.initialAgentProcessSessionId(driver, liveProcessConfig);
       const restartSessionId = initialSessionId || (driver.requiresSessionInitForDelivery ? liveProcessConfig.sessionId || null : null);
-      const processInstanceId = randomUUID6();
+      const processInstanceId = randomUUID7();
       const startupInputMessages = wakeMessageDeliveredAsInboxUpdate && wakeMessage ? [wakeMessage, ...startingInboxMessages] : resumeCatchupDeliveredAsInput ? resumeCatchupInputMessages : startingInboxMessages;
       agentProcess = {
         runtime,
@@ -21318,75 +21657,18 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
    * bundle linked to a feedback report. The transcript is read using only the
    * sessionId bound to the agent; no caller-supplied session id is accepted.
    */
-  async collectFeedbackTranscript(agentId, feedbackReportId) {
-    const transcriptResult = await this.getSessionTranscript(agentId);
-    if (!transcriptResult.reachable || !transcriptResult.transcript) {
-      return {
-        reachable: false,
-        fallbackReason: transcriptResult.fallbackReason ?? "transcript not reachable"
-      };
-    }
-    if (!this.workerUrl) {
-      return {
-        reachable: true,
-        fallbackReason: "daemon worker URL is not configured"
-      };
-    }
-    const span = this.tracer.startSpan("daemon.feedback_transcript.upload", {
-      surface: "daemon",
-      kind: "producer",
-      attrs: {
-        agentId,
-        feedbackReportId,
-        runtime: transcriptResult.runtime,
-        sessionId: transcriptResult.sessionId,
-        transcript_size_bytes: transcriptResult.sizeBytes
-      }
+  async collectFeedbackTranscript(agentId, feedbackReportId, reportWindow = defaultFeedbackTranscriptReportWindow()) {
+    return collectFeedbackTranscriptAttachment({
+      agentId,
+      feedbackReportId,
+      reportWindow,
+      getSessionTranscript: () => this.getSessionTranscript(agentId),
+      serverUrl: this.serverUrl,
+      daemonApiKey: this.daemonApiKey,
+      workerUrl: this.workerUrl,
+      tracer: this.tracer,
+      fetchImpl: this.fetchImpl
     });
-    try {
-      const raw = Buffer.from(transcriptResult.transcript, "utf8");
-      const gzipped = gzipSync(raw);
-      const bundleSha256 = createHash3("sha256").update(gzipped).digest("hex");
-      const bundleSizeBytes = gzipped.byteLength;
-      const bundleId = randomUUID6();
-      const uploadResult = await uploadWithSignedCapability({
-        serverUrl: this.serverUrl,
-        apiKey: this.daemonApiKey,
-        workerUrl: this.workerUrl,
-        scope: "daemon-trace-bundle:create",
-        createPath: "/api/trace-bundles",
-        createBody: {
-          bundleSha256,
-          bundleSizeBytes
-        },
-        attestationMetadata: {
-          bundleId,
-          bundleSha256,
-          bundleSizeBytes,
-          bundleContentType: "application/json",
-          bundleContentEncoding: "gzip",
-          feedbackReportId,
-          agentId
-        },
-        uploadBody: new Blob([new Uint8Array(gzipped)], { type: "application/json" }),
-        fetchImpl: this.fetchImpl
-      });
-      const traceBundleId = typeof uploadResult.session.id === "string" ? uploadResult.session.id : bundleId;
-      logger.info(`[FeedbackTranscript] uploaded for report=${feedbackReportId} agent=${agentId} traceBundleId=${traceBundleId} size=${bundleSizeBytes}`);
-      span.end("ok", { attrs: { traceBundleId, bundleSizeBytes } });
-      return {
-        reachable: true,
-        traceBundleId
-      };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      logger.warn(`[FeedbackTranscript] upload failed for report=${feedbackReportId} agent=${agentId}: ${message}`);
-      span.end("error", { attrs: { error_class: err instanceof Error ? err.name : "Error", error_message: message } });
-      return {
-        reachable: true,
-        error: message
-      };
-    }
   }
   async listSkills(agentId, runtimeHint) {
     const agent = this.agents.get(agentId);
@@ -21490,7 +21772,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
    * should carry explicit reason/correlation/window attrs so the server no
    * longer infers lifecycle semantics from generic activity strings.
    */
-  broadcastActivity(agentId, activityKind, detail, extraTrajectory = [], launchIdOverride, detailKind = "other", activityDisplay = activityKind, subagentLineage) {
+  broadcastActivity(agentId, activityKind, detail, extraTrajectory = [], launchIdOverride, detailKind = "other", activityDisplay = activityKind, subagentLineage, runtimeError) {
     const ap = this.agents.get(agentId);
     const entries = [...extraTrajectory];
     const hasToolStart = entries.some((e) => e.kind === "tool_start");
@@ -21522,7 +21804,8 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
       clientSeq,
       producerFactId,
       observedAtMs,
-      isHeartbeat: false
+      isHeartbeat: false,
+      ...runtimeError ? { runtimeError } : {}
     });
     this.recordActivityProducedTrace(agentId, activityKind, detail, detailKind, entries, ap, launchId, clientSeq, producerFactId, false);
     if (ap) {
@@ -22251,7 +22534,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     if (ap.readinessTransition) return;
     const identity = this.launchIdentityAttrs(agentId, ap, launchSource);
     const state = {
-      stateInstanceId: randomUUID6(),
+      stateInstanceId: randomUUID7(),
       enterSeq: this.launchTransitionSeq++,
       identity,
       fenceKind,
@@ -22287,7 +22570,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     if (ap.activation.kind !== "idle") return;
     const identity = this.launchIdentityAttrs(agentId, ap, launchSource);
     const state = {
-      stateInstanceId: randomUUID6(),
+      stateInstanceId: randomUUID7(),
       enterSeq: this.launchTransitionSeq++,
       identity,
       negativeEvidenceBucket: launchReadinessNegativeEvidence(identity)
@@ -22975,7 +23258,13 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           visibleErrorMessage,
           visibleErrorEntries ?? [{ kind: "text", text: `Error: ${visibleErrorMessage}` }],
           void 0,
-          "runtime_error"
+          "runtime_error",
+          "error",
+          void 0,
+          buildRuntimeErrorActivityDiagnostic(event.message, {
+            ...typeof event.nativeReasonPresent === "boolean" ? { nativeReasonPresent: event.nativeReasonPresent } : {},
+            ...event.reasonProvenance ? { reasonProvenance: event.reasonProvenance } : {}
+          })
         );
         break;
       }
@@ -24012,7 +24301,7 @@ var ReminderCache = class {
 };
 
 // src/machineLock.ts
-import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID8 } from "crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
 import os10 from "os";
 import path17 from "path";
@@ -24028,7 +24317,7 @@ var DaemonMachineLockConflictError = class extends Error {
   }
 };
 function apiKeyFingerprint(apiKey) {
-  return createHash4("sha256").update(apiKey).digest("hex");
+  return createHash5("sha256").update(apiKey).digest("hex");
 }
 function getDaemonMachineLockId(apiKey) {
   return `machine-${apiKeyFingerprint(apiKey).slice(0, 16)}`;
@@ -24069,7 +24358,7 @@ function acquireDaemonMachineLock(options) {
   const lockId = getDaemonMachineLockId(options.apiKey);
   const machineDir = path17.join(rootDir, lockId);
   const lockDir = path17.join(machineDir, "daemon.lock");
-  const token = randomUUID7();
+  const token = randomUUID8();
   mkdirSync5(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
@@ -24307,12 +24596,12 @@ function isDiagnosticErrorAttr(key) {
 }
 
 // ../trace-client/src/traceJitter.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var INITIAL_UPLOAD_DELAY_SPAN_MS = 3e4;
 var UPLOAD_INTERVAL_JITTER_SPAN_MS = 6e4;
 var MAX_FILE_AGE_JITTER_SPAN_MS = 6e4;
 function computeTraceJitter(lockId) {
-  const seed = createHash5("sha256").update(lockId).digest();
+  const seed = createHash6("sha256").update(lockId).digest();
   return {
     initialUploadDelayMs: seed.readUInt32BE(0) % INITIAL_UPLOAD_DELAY_SPAN_MS,
     uploadIntervalJitterMs: seed.readUInt32BE(4) % UPLOAD_INTERVAL_JITTER_SPAN_MS,
@@ -24393,7 +24682,7 @@ function createTraceClient(options) {
 }
 
 // src/traceBundleUpload.ts
-import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID9 } from "crypto";
 import { gzipSync as gzipSync2 } from "zlib";
 import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
 import path19 from "path";
@@ -24524,7 +24813,7 @@ var DaemonTraceBundleUploader = class {
       }
       const gzipped = gzipSync2(raw);
       const bundleSha256 = sha256Hex(gzipped);
-      const bundleId = randomUUID8();
+      const bundleId = randomUUID9();
       await uploadWithSignedCapability({
         serverUrl: this.options.serverUrl,
         apiKey: this.options.apiKey,
@@ -24593,7 +24882,7 @@ var DaemonTraceBundleUploader = class {
   }
 };
 function sha256Hex(body) {
-  return createHash6("sha256").update(body).digest("hex");
+  return createHash7("sha256").update(body).digest("hex");
 }
 function readPositiveIntegerEnv2(name, fallback) {
   const value = process.env[name];
@@ -24833,7 +25122,7 @@ function assertLegacyDaemonKeyNotAdoptedByComputer(options) {
 }
 
 // src/agentMigrationHttpTransport.ts
-import { createHash as createHash7, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { createHash as createHash8, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 import http2 from "http";
 import { Readable } from "stream";
 var AGENT_MIGRATION_TRANSPORT_HOST_ENV = "SLOCK_AGENT_MIGRATION_TRANSPORT_HOST";
@@ -25327,7 +25616,7 @@ function verifyTokenHash(token, expectedHashHex) {
   return timingSafeEqual(actual, expected);
 }
 function sha256Buffer(buffer) {
-  return createHash7("sha256").update(buffer).digest("hex");
+  return createHash8("sha256").update(buffer).digest("hex");
 }
 function canonicalJsonBuffer(value) {
   return Buffer.from(canonicalJson(value), "utf8");
@@ -25348,9 +25637,9 @@ function onceDrain(res) {
 }
 
 // src/agentMigrationObjectStoreBundle.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { createReadStream as createReadStream2, createWriteStream } from "fs";
-import { lstat as lstat3, mkdir as mkdir3, readlink as readlink2, rm as rm3, symlink } from "fs/promises";
+import { lstat as lstat3, mkdir as mkdir3, readlink as readlink2, rm as rm3, statfs, symlink } from "fs/promises";
 import path22 from "path";
 import { Transform } from "stream";
 import { pipeline } from "stream/promises";
@@ -25358,7 +25647,7 @@ import { createGunzip, createGzip } from "zlib";
 import { extract, pack } from "tar-stream";
 
 // src/agentMigrationExport.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat2, readdir as readdir4, readFile as readFile3, readlink } from "fs/promises";
 import path21 from "path";
@@ -25576,7 +25865,7 @@ async function buildCrossTreeRefs(refs) {
   return result;
 }
 async function sha256File(filePath) {
-  const hash = createHash8("sha256");
+  const hash = createHash9("sha256");
   await new Promise((resolve, reject) => {
     const stream = createReadStream(filePath);
     stream.on("data", (chunk) => hash.update(chunk));
@@ -25688,6 +25977,9 @@ var AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE = "application/vnd.raft.agent-migr
 var ARCHIVE_MANIFEST_PATH = "manifest.json";
 var ARCHIVE_WORKSPACE_PREFIX = "workspace/";
 var MAX_ARCHIVE_MANIFEST_BYTES = 64 * 1024 * 1024;
+var MAX_OBJECT_STORE_BUNDLE_ENTRIES = 25e4;
+var TARGET_ADOPTION_COPY_MULTIPLIER = 2n;
+var TARGET_DISK_RESERVE_BYTES = 512n * 1024n * 1024n;
 var MAX_BUNDLE_TOO_LARGE_ACCOUNTING_ENTRIES = 3;
 var MAX_ENCODED_ACCOUNTING_PATH_LENGTH = 96;
 var AgentMigrationObjectStoreBundleTooLargeError = class extends Error {
@@ -25700,6 +25992,18 @@ var AgentMigrationObjectStoreBundleTooLargeError = class extends Error {
   }
   code = "MIGRATION_OBJECT_STORE_BUNDLE_TOO_LARGE";
 };
+var AgentMigrationObjectStoreInsufficientDiskError = class extends Error {
+  constructor(requiredBytes, availableBytes, contentBytes) {
+    super(
+      `MIGRATION_OBJECT_STORE_INSUFFICIENT_DISK:requiredBytes=${requiredBytes}:availableBytes=${availableBytes}:contentBytes=${contentBytes}`
+    );
+    this.requiredBytes = requiredBytes;
+    this.availableBytes = availableBytes;
+    this.contentBytes = contentBytes;
+    this.name = "AgentMigrationObjectStoreInsufficientDiskError";
+  }
+  code = "MIGRATION_OBJECT_STORE_INSUFFICIENT_DISK";
+};
 async function buildAgentMigrationObjectStoreBundle(input) {
   assertPositiveMaxBytes(input.maxBytes);
   const workspacePath = path22.resolve(input.workspacePath);
@@ -25709,7 +26013,7 @@ async function buildAgentMigrationObjectStoreBundle(input) {
     workspacePath,
     mode: "forensic"
   });
-  const contentBytes = assertAgentMigrationObjectStoreBundleSize(manifest, input.maxBytes);
+  const contentBytes = agentMigrationObjectStoreContentBytes(manifest);
   const archiveManifest = {
     schemaVersion: AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
     manifest
@@ -25721,8 +26025,17 @@ async function buildAgentMigrationObjectStoreBundle(input) {
   }
   const tarPack = pack();
   const gzip = createGzip();
-  const bundle = tarPack.pipe(gzip);
+  const compressedSizeLimit = createCompressedSizeLimit(
+    input.maxBytes,
+    largestWorkspaceEntries(manifest)
+  );
+  const bundle = tarPack.pipe(gzip).pipe(compressedSizeLimit);
   tarPack.on("error", (error) => gzip.destroy(error));
+  gzip.on("error", (error) => compressedSizeLimit.destroy(error));
+  compressedSizeLimit.on("error", (error) => {
+    gzip.destroy(error);
+    tarPack.destroy(error);
+  });
   void writeArchive(tarPack, manifestBuffer, manifest, workspacePath).catch((error) => {
     tarPack.destroy(error instanceof Error ? error : new Error(String(error)));
   });
@@ -25747,13 +26060,13 @@ async function stageAgentMigrationObjectStoreBundle(input) {
   let expectedEntries = /* @__PURE__ */ new Map();
   const extractedEntries = /* @__PURE__ */ new Set();
   let contentBytes = 0;
+  const compressedSizeLimit = createCompressedSizeLimit(input.maxBytes);
   const tarExtract = extract();
   tarExtract.on("entry", (header, stream, next) => {
     void handleArchiveEntry({
       header,
       stream,
       stagingWorkspacePath,
-      maxBytes: input.maxBytes,
       getArchiveManifest: () => archiveManifest,
       setArchiveManifest: (value) => {
         archiveManifest = value;
@@ -25763,18 +26076,14 @@ async function stageAgentMigrationObjectStoreBundle(input) {
       extractedEntries,
       addContentBytes: (value) => {
         contentBytes += value;
-        if (contentBytes > input.maxBytes) {
-          throw new AgentMigrationObjectStoreBundleTooLargeError(
-            contentBytes,
-            input.maxBytes,
-            archiveManifest ? largestWorkspaceEntries(archiveManifest.manifest) : []
-          );
+        if (!Number.isSafeInteger(contentBytes)) {
+          throw new Error("MIGRATION_OBJECT_STORE_FILE_SIZE_INVALID");
         }
       }
     }).then(() => next(), next);
   });
   try {
-    await pipeline(input.bundle, createGunzip(), tarExtract);
+    await pipeline(input.bundle, compressedSizeLimit, createGunzip(), tarExtract);
     const completedManifest = archiveManifest;
     if (!completedManifest) throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_MISSING");
     for (const relativePath of expectedEntries.keys()) {
@@ -25841,7 +26150,9 @@ async function handleArchiveEntry(input) {
     if (input.getArchiveManifest()) throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_DUPLICATE");
     if (input.header.type !== "file") throw new Error("MIGRATION_OBJECT_STORE_MANIFEST_INVALID");
     const manifestBuffer = await readEntryBuffer(input.stream, MAX_ARCHIVE_MANIFEST_BYTES);
-    input.setArchiveManifest(parseArchiveManifest(manifestBuffer));
+    const archiveManifest2 = parseArchiveManifest(manifestBuffer);
+    await assertTargetWorkspaceResourceBudget(input.stagingWorkspacePath, archiveManifest2.manifest);
+    input.setArchiveManifest(archiveManifest2);
     return;
   }
   const archiveManifest = input.getArchiveManifest();
@@ -25872,7 +26183,7 @@ async function handleArchiveEntry(input) {
     throw new Error(`MIGRATION_OBJECT_STORE_FILE_SIZE_MISMATCH:${relativePath}`);
   }
   input.addContentBytes(input.header.size ?? 0);
-  const hash = createHash9("sha256");
+  const hash = createHash10("sha256");
   const hashPassThrough = new Transform({
     transform(chunk, _encoding, callback) {
       hash.update(chunk);
@@ -25921,8 +26232,10 @@ function expectedWorkspaceEntries(manifest) {
   }
   return result;
 }
-function assertAgentMigrationObjectStoreBundleSize(manifest, maxBytes) {
-  assertPositiveMaxBytes(maxBytes);
+function agentMigrationObjectStoreContentBytes(manifest) {
+  if (manifest.files.length > MAX_OBJECT_STORE_BUNDLE_ENTRIES) {
+    throw new Error("MIGRATION_OBJECT_STORE_ENTRY_COUNT_LIMIT_EXCEEDED");
+  }
   let total = 0;
   for (const entry of manifest.files) {
     if (entry.source !== "workspace" || !entry.workspaceRelativePath) {
@@ -25935,14 +26248,42 @@ function assertAgentMigrationObjectStoreBundleSize(manifest, maxBytes) {
     total += entry.sizeBytes ?? 0;
     if (!Number.isSafeInteger(total)) throw new Error("MIGRATION_OBJECT_STORE_FILE_SIZE_INVALID");
   }
-  if (total > maxBytes) {
-    throw new AgentMigrationObjectStoreBundleTooLargeError(
-      total,
-      maxBytes,
-      largestWorkspaceEntries(manifest)
+  return total;
+}
+async function assertTargetWorkspaceResourceBudget(stagingWorkspacePath, manifest) {
+  const contentBytes = agentMigrationObjectStoreContentBytes(manifest);
+  const volume = await statfs(stagingWorkspacePath, { bigint: true });
+  const availableBytes = volume.bavail * volume.bsize;
+  const requiredBytes = BigInt(contentBytes) * TARGET_ADOPTION_COPY_MULTIPLIER + TARGET_DISK_RESERVE_BYTES;
+  if (availableBytes < requiredBytes) {
+    throw new AgentMigrationObjectStoreInsufficientDiskError(
+      requiredBytes,
+      availableBytes,
+      contentBytes
     );
   }
-  return total;
+}
+function createCompressedSizeLimit(maxBytes, largestEntries = []) {
+  assertPositiveMaxBytes(maxBytes);
+  let compressedBytes = 0;
+  return new Transform({
+    transform(chunk, _encoding, callback) {
+      compressedBytes += chunk.byteLength;
+      if (!Number.isSafeInteger(compressedBytes)) {
+        callback(new Error("MIGRATION_OBJECT_STORE_BUNDLE_SIZE_INVALID"));
+        return;
+      }
+      if (compressedBytes > maxBytes) {
+        callback(new AgentMigrationObjectStoreBundleTooLargeError(
+          compressedBytes,
+          maxBytes,
+          largestEntries
+        ));
+        return;
+      }
+      callback(null, chunk);
+    }
+  });
 }
 function largestWorkspaceEntries(manifest, limit = MAX_BUNDLE_TOO_LARGE_ACCOUNTING_ENTRIES) {
   if (!Number.isSafeInteger(limit) || limit <= 0) return [];
@@ -26028,14 +26369,14 @@ function sortJsonValue2(value) {
   }, {});
 }
 function sha256Buffer2(buffer) {
-  return createHash9("sha256").update(buffer).digest("hex");
+  return createHash10("sha256").update(buffer).digest("hex");
 }
 function sanitizePathSegment(value) {
   return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128) || "migration";
 }
 
 // src/agentMigrationImport.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { createReadStream as createReadStream3 } from "fs";
 import { access as access2, cp, lstat as lstat4, mkdir as mkdir4, readlink as readlink3, rename, writeFile as writeFile3 } from "fs/promises";
 import path23 from "path";
@@ -26243,7 +26584,7 @@ async function writeArrivalReport(reportPath, report) {
   return sha256Buffer3(Buffer.from(payload, "utf8"));
 }
 async function sha256File2(filePath) {
-  const hash = createHash10("sha256");
+  const hash = createHash11("sha256");
   const stream = createReadStream3(filePath);
   for await (const chunk of stream) {
     hash.update(chunk);
@@ -26251,7 +26592,7 @@ async function sha256File2(filePath) {
   return hash.digest("hex");
 }
 function sha256Buffer3(buffer) {
-  return createHash10("sha256").update(buffer).digest("hex");
+  return createHash11("sha256").update(buffer).digest("hex");
 }
 function canonicalJson3(value) {
   return JSON.stringify(sortJsonValue3(value));
@@ -26505,7 +26846,10 @@ function migrationTransferFailureMessage(err) {
   return message.slice(0, 500);
 }
 function migrationTransferFailureCode(err) {
-  return err instanceof AgentMigrationObjectStoreBundleTooLargeError ? err.code : void 0;
+  if (err instanceof AgentMigrationObjectStoreBundleTooLargeError || err instanceof AgentMigrationObjectStoreInsufficientDiskError) {
+    return err.code;
+  }
+  return void 0;
 }
 var MigrationObjectStoreUploadHttpError = class extends Error {
   constructor(status, archiveBytes) {
@@ -26593,7 +26937,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-HDPAZ76N.js");
+  await import("./dist-A7Z6RP4K.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -26742,7 +27086,7 @@ function summarizeIncomingMessage(msg) {
 var DaemonCore = class {
   options;
   daemonVersion;
-  daemonInstanceId = randomUUID9();
+  daemonInstanceId = randomUUID10();
   // When this runner is launched by a managed Computer service, the
   // service exports RAFT_COMPUTER_VERSION (the `@botiverse/raft-computer`
   // bundle version). Reported in `ready` so the server can surface the
@@ -27786,7 +28130,10 @@ var DaemonCore = class {
         });
         break;
       case "agent:diagnostic:feedback_transcript":
-        this.agentManager.collectFeedbackTranscript(msg.agentId, msg.feedbackReportId).then((result) => {
+        this.agentManager.collectFeedbackTranscript(msg.agentId, msg.feedbackReportId, {
+          reportGeneratedAt: msg.feedbackReportGeneratedAt ?? currentDate().toISOString(),
+          reportTimeSource: msg.feedbackReportTimeSource ?? "server_request_received"
+        }).then((result) => {
           this.connection.send({
             type: "agent:diagnostic:feedback_transcript_result",
             agentId: msg.agentId,
@@ -28141,9 +28488,9 @@ export {
   AGENT_MIGRATION_OBJECT_STORE_BUNDLE_SCHEMA_VERSION,
   AGENT_MIGRATION_OBJECT_STORE_CONTENT_TYPE,
   AgentMigrationObjectStoreBundleTooLargeError,
+  AgentMigrationObjectStoreInsufficientDiskError,
   buildAgentMigrationObjectStoreBundle,
   stageAgentMigrationObjectStoreBundle,
-  assertAgentMigrationObjectStoreBundleSize,
   largestWorkspaceEntries,
   buildAgentMigrationAdoptPlan,
   verifyAgentMigrationAdoptPlan,