@canonmsg/agent-sdk 12.3.2 → 12.5.1

package/dist/chunks/{chunk-JCBQCO3F.js → chunk-3KFVBOVI.js}

@@ -3,6 +3,7 @@ import {
   BoundedFileReadError,
   CanonClient,
   MAX_CANON_MEDIA_BYTES,
+  NodeMlsDevCustodyError,
   RUNTIME_NEW_SESSION_ACTION,
   RUNTIME_STOP_ACTION,
   RUNTIME_STOP_AND_DROP_ACTION,
@@ -29,7 +30,7 @@ import {
   sendMessageWithRetryChunked,
   splitTextByUtf8Bytes,
   verifyCanonRuntimeConnection
-} from "./chunk-RFNYPZXD.js";
+} from "./chunk-TFSURFF6.js";
 import {
   CONNECTOR_RELAY_ANSWER_WITHIN_MS,
   CONNECTOR_RELAY_INSTALLATION_PATTERN,
@@ -58,7 +59,7 @@ import {
   parseMlsDevGroupHead,
   parseMlsDevGroupRoster,
   resolveAllowedUploadMimeType
-} from "./chunk-5MI6Q3VS.js";
+} from "./chunk-C2WJT3VX.js";
 
 // src/runner/types.ts
 var DriverSessionError = class extends Error {
@@ -464,6 +465,8 @@ var GUEST_ITEMS = /* @__PURE__ */ new Set([
   "subAgentActivity",
   "sleep"
 ]);
+var OWN_LISTINGS = /* @__PURE__ */ new Set(["list_mcp_resources", "list_mcp_resource_templates"]);
+var GUEST = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: you cannot read files, run commands or use any tool but the canon MCP server's. Answer from the conversation and what you already know, and say so when something needs your owner.";
 var RISKY = /\brm\s+-[a-z]*[rf]|\bgit\s+(reset\s+--hard|push\s+(-f|--force))|\bdrop\s+(table|database)\b|\bmkfs\b|\bdd\s+if=/i;
 var IMAGE = /\.(png|jpe?g|gif|webp)$/i;
 var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
@@ -750,10 +753,11 @@ function codexDriver(options) {
           settle(new Error(`Codex ended the turn ${ended.status === "interrupted" ? "interrupted" : `with an error${detail ? `: ${oneLine2(detail, 300)}` : ""}`}`));
         }, "conclude");
         const guard = /* @__PURE__ */ __name((item) => {
-          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && item.server === CANON) return;
+          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && (item.server === CANON || item.server === "codex" && OWN_LISTINGS.has(text(item.tool)))) return;
           interrupt();
           entry.close();
-          settle(new DriverSessionError(`Codex started ${text(item.type) || "an unknown item"} in a turn holding someone other than the owner's message`));
+          const what = item.type === "mcpToolCall" ? `mcpToolCall (${describe(item)})` : text(item.type) || "an unknown item";
+          settle(new DriverSessionError(`Codex started ${what} in a turn holding someone other than the owner's message`));
         }, "guard");
         const link = rpc(child, {
           notify(method, params) {
@@ -813,6 +817,7 @@ function codexDriver(options) {
           }
           if (turn.signal.aborted) return finish();
           const started = await link.call("turn/start", { threadId, input: [
+            ...guest ? [{ type: "text", text: GUEST, text_elements: [] }] : [],
             { type: "text", text: turn.prompt, text_elements: [] },
             // Images go to the model as images; every attachment's path is also in the prompt for Codex to read.
             ...turn.files.filter((file) => IMAGE.test(file)).map((path) => ({ type: "localImage", path }))
@@ -908,31 +913,43 @@ function connectorDriver() {
     },
     async claim(inputId, requestId, options = {}) {
       const entry = find(inputId);
-      if (entry.state === "claiming") {
-        if (entry.requestId !== requestId) throw new ConnectorRelayError(409, "CONNECTOR_CLAIM_CONFLICT", "This input belongs to another claim");
-        throw new ConnectorRelayError(503, "CONNECTOR_RELAY_BUSY", "This claim is still being confirmed; try again");
+      if (entry.state === "claiming" && entry.requestId !== requestId) {
+        throw new ConnectorRelayError(409, "CONNECTOR_CLAIM_CONFLICT", "This input belongs to another claim");
       }
-      if (entry.state !== "pending") {
+      if (entry.state !== "pending" && entry.state !== "claiming") {
         if (entry.requestId !== void 0 && entry.requestId !== requestId) {
           throw new ConnectorRelayError(409, "CONNECTOR_CLAIM_CONFLICT", "This input belongs to another claim");
         }
         return { inputId, requestId, runAllowed: false, state: entry.state };
       }
-      entry.state = "claiming";
-      entry.requestId = requestId;
+      if (entry.confirmation) throw new ConnectorRelayError(503, "CONNECTOR_RELAY_BUSY", "This claim is still being confirmed; retry the same request id");
+      if (entry.state === "pending") {
+        entry.state = "claiming";
+        entry.requestId = requestId;
+      }
+      const confirmation = entry.confirm().then(() => "ok", () => {
+        if (entry.state === "claiming") {
+          entry.state = "pending";
+          entry.requestId = void 0;
+        }
+        return "refused";
+      }).finally(() => {
+        entry.confirmation = void 0;
+      });
+      entry.confirmation = confirmation;
       const deadline = options.deadline ?? Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS;
       let timer;
       const late = new Promise((resolve3) => {
         timer = setTimeout(resolve3, Math.max(0, deadline - Date.now()), "late");
       });
-      const confirmed = await Promise.race([entry.confirm().then(() => "ok", () => "refused"), late]).finally(() => clearTimeout(timer));
-      if (entry.state === "claiming" && confirmed === "ok") {
+      const confirmed = await Promise.race([confirmation, late]).finally(() => clearTimeout(timer));
+      const state = entry.state;
+      if (state === "claiming" && confirmed === "ok") {
         entry.state = "claimed";
         return { inputId, requestId, runAllowed: true, state: "claimed", input: entry.input };
       }
-      if (entry.state !== "claiming") throw withdrawn();
-      entry.state = "pending";
-      entry.requestId = void 0;
+      if (state === "claimed") return { inputId, requestId, runAllowed: false, state: "claimed" };
+      if (state === "withdrawn" || state === "answered") throw withdrawn();
       throw new ConnectorRelayError(503, "CONNECTOR_RELAY_BUSY", "Canon could not confirm this claim now; try again");
     },
     reply: /* @__PURE__ */ __name((inputId, requestId, text3) => answer(inputId, requestId, { outcome: "reply", text: text3 }), "reply"),
@@ -947,7 +964,10 @@ function connectorDriver() {
       activity: false,
       tools: false,
       outboundFiles: false,
-      remote: true
+      remote: true,
+      // A turn here is an input waiting for (or with) the assistant, not work on this host: one per room, so a room
+      // whose assistant is away never keeps another room's input from being offered.
+      maxConcurrentTurns: Number.POSITIVE_INFINITY
     },
     inbox,
     runTurn(turn) {
@@ -1485,7 +1505,7 @@ async function loadMlsDevConfiguration(filePath, input) {
   return { configuration, custody: custody2, close: /* @__PURE__ */ __name(() => custody2.close(), "close") };
 }
 __name(loadMlsDevConfiguration, "loadMlsDevConfiguration");
-var MLS_SETUP_ACTIONS = ["status", "provision", "enroll", "renew", "publish", "refresh"];
+var MLS_SETUP_ACTIONS = ["status", "setup", "provision", "enroll", "renew", "publish", "refresh"];
 function mlsDevRoomPackageId(identity, room) {
   const hex = createHash4("sha256").update(JSON.stringify([
     "canon.mls.dev-agent-room-package.v1",
@@ -1498,25 +1518,44 @@ function mlsDevRoomPackageId(identity, room) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 __name(mlsDevRoomPackageId, "mlsDevRoomPackageId");
-async function runMlsDevSetup(endpoint, action, room, provision) {
+async function assertMlsVaultInHome(endpoint, provisioned) {
+  const { status, binding } = await endpoint.mlsDevDevice.read();
+  if (status === "absent" || status === "revoked" || provisioned({ ...binding, revision: 0 })) return;
+  throw new Error("This agent's MLS device has no vault in this home. A device set up with an operator's configuration keeps needing it: run the agent with that --mls-dev-config <path> again (in createRunner, mls: await loadMlsDevConfiguration(path, { environmentId })). A vault that was lost cannot be recovered.");
+}
+__name(assertMlsVaultInHome, "assertMlsVaultInHome");
+async function runMlsDevSetup(endpoint, action, room, provision, provisioned) {
   const identity = await endpoint.ready();
-  if (!isMlsEnvironmentId(identity.environmentId) || !endpoint.mlsDevDevice || !endpoint.mlsDevKeyPackages || !endpoint.mlsDevGroups) throw new Error("MLS_DEV_SETUP_UNAVAILABLE");
+  const { environmentId } = identity, devices = endpoint.mlsDevDevice;
+  if (!isMlsEnvironmentId(environmentId) || !devices || !endpoint.mlsDevKeyPackages || !endpoint.mlsDevGroups) throw new Error("MLS_DEV_SETUP_UNAVAILABLE");
   if ((action === "publish" || action === "refresh") !== !!room) throw new Error("MLS_DEV_SETUP_ARGUMENTS_INVALID");
-  if (action === "provision") {
+  if (provisioned && action !== "status") await assertMlsVaultInHome(endpoint, provisioned);
+  const enroll = /* @__PURE__ */ __name(async () => {
+    await devices.enroll();
+    if ((await devices.read()).status !== "credential_committed") await devices.renew();
+  }, "enroll");
+  const provisionDevice = /* @__PURE__ */ __name(async (unlessProvisioned) => {
     if (!provision || identity.ownershipVersion === void 0) throw new Error("MLS_DEV_SETUP_UNAVAILABLE");
-    const device2 = await endpoint.mlsDevDevice.read();
+    const device2 = await devices.read();
     if (device2.registration || device2.status !== "absent") throw new Error("MLS_DEV_SETUP_ALREADY_PROVISIONED");
-    await provision({
+    const context = {
       version: 1,
-      environmentId: identity.environmentId,
+      environmentId,
       installationId: identity.installationId,
       principal: { type: "ai_agent", id: await endpoint.mlsPrincipalId(), ownershipVersion: identity.ownershipVersion },
       revision: 0
-    });
-  } else if (action === "enroll") {
-    await endpoint.mlsDevDevice.enroll();
-    if ((await endpoint.mlsDevDevice.read()).status !== "credential_committed") await endpoint.mlsDevDevice.renew();
-  } else if (action === "renew") await endpoint.mlsDevDevice.renew();
+    };
+    if (!unlessProvisioned || !provisioned?.(context)) await provision(context);
+  }, "provisionDevice");
+  if (action === "setup") {
+    const { status } = await devices.read();
+    if (status === "revoked") throw new Error("MLS_DEV_SETUP_REVOKED");
+    if (status === "absent") await provisionDevice(true);
+    if (status === "registered") await devices.ensureReady();
+    else if (status !== "credential_committed") await enroll();
+  } else if (action === "provision") await provisionDevice(false);
+  else if (action === "enroll") await enroll();
+  else if (action === "renew") await devices.renew();
   else if (action === "publish") {
     const keyPackageId = mlsDevRoomPackageId(identity, room);
     await endpoint.mlsDevKeyPackages.prepare({ keyPackageId });
@@ -1525,7 +1564,7 @@ async function runMlsDevSetup(endpoint, action, room, provision) {
     const group = await endpoint.mlsDevGroups.refresh(room);
     if (group?.status !== "active" || await endpoint.mlsDevGroups.readRecoveryFailure(room)) throw new Error("MLS_DEV_SETUP_ROOM_NOT_READY");
   }
-  const device = await endpoint.mlsDevDevice.read();
+  const device = await devices.read();
   return {
     version: 1,
     action,
@@ -1541,12 +1580,244 @@ async function runMlsDevSetup(endpoint, action, room, provision) {
 }
 __name(runMlsDevSetup, "runMlsDevSetup");
 
+// src/runner/mls-bundled.ts
+import { createHash as createHash5 } from "node:crypto";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { dirname as dirname4, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// mls-custody.json
+var mls_custody_default = {
+  schemaVersion: 1,
+  release: "mls-custody-cadb937436ce",
+  protocolVersion: 1,
+  rustVersion: "rustc 1.91.0 (f8297e351 2025-10-28)",
+  sourceHashes: {
+    "mls/native/Cargo.toml": "f93b48329951d5a11ef6d5830ff7c375cb847543bdb1c98a6fd8a8d02026db89",
+    "mls/native/Cargo.lock": "9c2e9a3bb0f79c14540942c091124cba4aa262ee14cef2cdd5490653cd4656f3",
+    "mls/native/src/lib.rs": "8e586bfaedc5fe376febbda78c32f8383aaa2ac92868000dd4c84ca083731571",
+    "mls/native/src/bin/canon-mls-custody.rs": "3ab54102bfe315e425b6c3cf0aa7feb66e44d047e135336b0291305507062459",
+    "mls/native/src/portable/mod.rs": "3005b60f7777a841347421ad96eb631b72063e85cebe96afd1c11fef095b0e34",
+    "mls/native/src/portable/json.rs": "d4e68556a051ffe9008686036597b1fd8239ae66fad67bd848c3f0e16bf8ccaf",
+    "mls/native/src/portable/vault.rs": "14b9ff1e10ec4058e39a46511a489c7e82a9836e4175a768ac5d4b69c1dba8e5",
+    "mls/native/src/portable/tests.rs": "7eadba2a49ed044470bb567d9b93fba44b64dc117b1da50a22187cff3dccb64e",
+    "mls/native/portable/build.mjs": "84c422a8a8aa6a7ec112a358bdeef080201aa4ea9a91f6d5726b05f46fa2a10c",
+    "mls/core/open.rs": "8cdc03882f3b84dca72ab06afd437f162de01a0fe21327b019f17867dd59f5d0",
+    "mls/core/protocol.rs": "7f3e021d6e4f1cc130b5dd3c98e0b0fa23edf813c72802c3fa3f8fb9e431c947",
+    "mls/core/fault_storage.rs": "fdd6672a21f6ffee657142755637824541a5090b4f8a5fb4902f482556fb2793",
+    "mls/core/mls_environment.rs": "390d11ee82ef8b108a7fffc7bb193ac7f3e470aa14e9643d029007aaaa29c4e4",
+    "mls/core/dev_identity.rs": "97df6bdb9daab66f0e3d4ca3b49bf9954fa06ac032c927d9ae6c83509b0166bd",
+    "mls/core/dev_key_package.rs": "3e7011fe8ab3044d80d84d04944068dbcf683141fcaba8a7a00bd2cfd103de72",
+    "mls/core/dev_application.rs": "fafe245ace38e384da265bab2c12fef6b77c86b2c20477d00563ab891a54f94b",
+    "mls/core/dev_group.rs": "1d519a5d15394bbc163aef00e0ddacb9bb87631beaf8a13e52c76d628749152b",
+    "packages/test-fixtures/src/mlsDevEnrollmentProofV1.json": "50d7896e0a3a25b420412e84484e64f1e49480a3f298ee2d125f2f9188382810",
+    "packages/test-fixtures/src/mlsDevCredentialV1.json": "24cd23af794b8a6e35caf050995020c6584b806de060969db4536f44b1188780",
+    "packages/test-fixtures/src/mlsDevCredentialReconciliationV1.json": "bd4bbb3a2e5dc7921867a2e5936d1da77d536740b4360012c1f741f9caed2826",
+    "packages/test-fixtures/src/mlsDevGroupV1.json": "10b7c0da00cfd3ecfb3c9e7f0118bc574be613cc82d97268766ba271c464ca9d",
+    "packages/test-fixtures/src/mlsDevApplicationV1.json": "77c05e728acb7793a70c03a6857bc8b0e522e586b117241432460eec05ae3673",
+    "packages/test-fixtures/src/mlsDevInteractionV1.json": "045ee34e1b5e126b67da94705b3f03a1d265774d7889ec3f4f272dd06ecef676"
+  },
+  platforms: {
+    "darwin-arm64": {
+      target: "aarch64-apple-darwin",
+      sha256: "918ae350f1d7bd339c4eee548f6668943217f5fa66022bb93f41a02992dd296c",
+      bytes: 2932976,
+      unitTestsPassed: 95,
+      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      builder: {
+        macos: "26.3.1",
+        sdk: "26.4",
+        linker: "@(#)PROGRAM:ld PROJECT:ld-1266.8"
+      }
+    },
+    "linux-x64": {
+      target: "x86_64-unknown-linux-gnu",
+      sha256: "1c5a12d0213c53bdf59b5f36a7390a4b4c17f8a53c95e760ad8cb4905297d256",
+      bytes: 3389816,
+      unitTestsPassed: 95,
+      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      builder: {
+        image: "quay.io/pypa/manylinux_2_28_x86_64@sha256:e0adf18521ad35192df733a6c62d35df7801957d24e0470238aacecfab2188a3",
+        dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
+      }
+    },
+    "linux-arm64": {
+      target: "aarch64-unknown-linux-gnu",
+      sha256: "371c5754cf0c437f561e8c49b3ea654c037311b951e11b1c5a29fb6b91656619",
+      bytes: 3234232,
+      unitTestsPassed: 95,
+      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      builder: {
+        image: "quay.io/pypa/manylinux_2_28_aarch64@sha256:a3e02308c822fb6ce0d12248b0c941817ba5e1a1bc9e7bb5929f29c50eaa40a9",
+        dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
+      }
+    }
+  }
+};
+
+// src/runner/mls-bundled.ts
+var MLS_ENVIRONMENT_PINS = {
+  "canon-prod-v1": {
+    issuerKeys: [{
+      keyVersion: "projects/canonmail-prod/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer/cryptoKeyVersions/1",
+      signaturePublicKey: "AYLEqY7gKOhQvRALb-31lz82XinehW2_gl0jKC-G8Pk"
+    }],
+    receiptKeys: [{
+      keyVersion: "projects/canonmail-prod/locations/europe-west1/keyRings/canon-mls/cryptoKeys/feed-receipt/cryptoKeyVersions/1",
+      signaturePublicKey: "sRi4mvMbFTL-LKzXilIJedefSqtqrF8Q-deM2AUSt40"
+    }]
+  },
+  "canon-dev-v1": {
+    // Dev signs with version 2 and still trusts version 1 until 2026-11-07.
+    issuerKeys: [
+      {
+        keyVersion: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer/cryptoKeyVersions/1",
+        signaturePublicKey: "Hm1ULJGsF9MIQbHYIWmpkK3j2dPcFzeJ71xbYVsPZNs"
+      },
+      {
+        keyVersion: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer/cryptoKeyVersions/2",
+        signaturePublicKey: "G2fwJdPQXP6Ar68LJveXQ_WAOtdtcsiyKdeEVb-9Gcw"
+      }
+    ],
+    receiptKeys: [{
+      keyVersion: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/feed-receipt/cryptoKeyVersions/1",
+      signaturePublicKey: "LSRMjRHH73Q4ExPFSTaU_KTvr8wQ4Cp9vtaBBrVZvig"
+    }]
+  }
+};
+function packageRoot() {
+  for (let directory = dirname4(fileURLToPath(import.meta.url)); ; directory = dirname4(directory)) {
+    const manifest = join2(directory, "package.json");
+    if (existsSync(manifest) && JSON.parse(readFileSync2(manifest, "utf8")).name === "@canonmsg/agent-sdk") return directory;
+    if (dirname4(directory) === directory) return void 0;
+  }
+}
+__name(packageRoot, "packageRoot");
+function bundledMlsCustodyHelper() {
+  const platform = `${process.platform}-${process.arch}`;
+  const pin = mls_custody_default.platforms[platform];
+  const root = pin && packageRoot();
+  const path = root && join2(root, "dist", "mls", platform, "canon-mls-custody");
+  if (!pin || !path || !existsSync(path)) return void 0;
+  if (createHash5("sha256").update(readFileSync2(path)).digest("hex") !== pin.sha256) {
+    throw new Error(`${path} is not the custody helper this package pins; reinstall @canonmsg/agent-sdk.`);
+  }
+  return { path, sha256: pin.sha256 };
+}
+__name(bundledMlsCustodyHelper, "bundledMlsCustodyHelper");
+
+// src/runner/mls-managed.ts
+import { createHash as createHash6 } from "node:crypto";
+import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2 } from "node:fs";
+import { dirname as dirname5, join as join3 } from "node:path";
+var sha256 = /* @__PURE__ */ __name((bytes) => createHash6("sha256").update(bytes).digest("hex"), "sha256");
+function defaultMlsDevice(home, environmentId) {
+  if (!isMlsEnvironmentId(environmentId)) return void 0;
+  const helper = bundledMlsCustodyHelper();
+  return helper ? managedMlsDevice({ home, environmentId, helper }) : void 0;
+}
+__name(defaultMlsDevice, "defaultMlsDevice");
+function managedMlsDevice(options) {
+  const { environmentId } = options;
+  const helper = options.helper ?? bundledMlsCustodyHelper();
+  if (!helper) {
+    throw new Error(`@canonmsg/agent-sdk ships no MLS custody helper for ${process.platform}-${process.arch}: build one from mls/native in the Canon repository and give the runner --mls-dev-config <path> (docs/design/mls-dev-agent-host.md).`);
+  }
+  const pins = options.pins ?? MLS_ENVIRONMENT_PINS[environmentId];
+  const configuration = parseMlsDevClientConfiguration({
+    version: 1,
+    environmentId,
+    enabled: true,
+    issuerKeys: pins.issuerKeys,
+    receiptKeys: pins.receiptKeys
+  });
+  const root = join3(options.home, "mls", environmentId);
+  const directory = /* @__PURE__ */ __name((context) => join3(root, sha256(Buffer.from(JSON.stringify([
+    context.installationId,
+    context.principal.type,
+    context.principal.id,
+    "ownershipVersion" in context.principal ? context.principal.ownershipVersion : null
+  ]))).slice(0, 32)), "directory");
+  const vault = /* @__PURE__ */ __name((context) => join3(directory(context), "vault", "vault.bin"), "vault");
+  let executable;
+  function install() {
+    const target = join3(root, "bin", helper.sha256, "canon-mls-custody");
+    if (existsSync2(target) && sha256(readFileSync3(target)) === helper.sha256) return target;
+    mkdirSync3(dirname5(target), { recursive: true, mode: 448 });
+    const temporary = `${target}.${process.pid}.tmp`;
+    copyFileSync(helper.path, temporary);
+    chmodSync(temporary, 448);
+    if (sha256(readFileSync3(temporary)) !== helper.sha256) throw new Error(`${helper.path} is not the pinned custody helper`);
+    renameSync2(temporary, target);
+    return target;
+  }
+  __name(install, "install");
+  const devices = /* @__PURE__ */ new Map();
+  function device(context, provisioning) {
+    const key = directory(context);
+    let found = devices.get(key);
+    if (!found) {
+      found = (async () => {
+        if (!provisioning && !existsSync2(vault(context))) throw new NodeMlsDevCustodyError();
+        mkdirSync3(dirname5(vault(context)), { recursive: true, mode: 448 });
+        const unlock = join3(key, "unlock");
+        if (provisioning) privateKey(unlock, 32);
+        const text3 = `${JSON.stringify({
+          version: 1,
+          environmentId,
+          context: {
+            version: 1,
+            environmentId: context.environmentId,
+            principal: context.principal,
+            installationId: context.installationId
+          },
+          vaultPath: vault(context),
+          issuerKeys: configuration.issuerKeys,
+          receiptKeys: configuration.receiptKeys
+        }, null, 2)}
+`;
+        const file = join3(key, "native.json");
+        if (!existsSync2(file) || readFileSync3(file, "utf8") !== text3) writeDurable(file, text3);
+        return createPortableNodeMlsDevCustody({
+          executablePath: executable ??= install(),
+          executableSha256: helper.sha256,
+          configurationPath: file,
+          configurationSha256: sha256(Buffer.from(text3)),
+          secretSource: { kind: "managed-file", path: unlock },
+          ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+        });
+      })();
+      devices.set(key, found);
+      found.catch(() => {
+        if (devices.get(key) === found) devices.delete(key);
+      });
+    }
+    return found;
+  }
+  __name(device, "device");
+  const custody2 = {
+    prepareProtected: /* @__PURE__ */ __name((context, ...rest) => device(context, false).then((open4) => open4.prepareProtected(context, ...rest)), "prepareProtected"),
+    prepareProtectedKeyPackage: /* @__PURE__ */ __name((context, ...rest) => device(context, false).then((open4) => open4.prepareProtectedKeyPackage(context, ...rest)), "prepareProtectedKeyPackage"),
+    prepareProtectedGroup: /* @__PURE__ */ __name((identity, ...rest) => device(identity, false).then((open4) => open4.prepareProtectedGroup(identity, ...rest)), "prepareProtectedGroup")
+  };
+  return {
+    configuration,
+    custody: custody2,
+    provision: /* @__PURE__ */ __name((context) => device(context, true).then((open4) => open4.provision(context)), "provision"),
+    provisioned: /* @__PURE__ */ __name((context) => existsSync2(vault(context)), "provisioned"),
+    async close() {
+      await Promise.allSettled([...devices.values()].map((open4) => open4.then((custody3) => custody3.close())));
+    }
+  };
+}
+__name(managedMlsDevice, "managedMlsDevice");
+
 // src/runner/relay.ts
 import { createHmac as createHmac2, timingSafeEqual } from "node:crypto";
-import { closeSync as closeSync3, constants as constants5, fsyncSync as fsyncSync2, mkdirSync as mkdirSync3, openSync as openSync3, renameSync as renameSync2, writeSync as writeSync2 } from "node:fs";
+import { closeSync as closeSync3, constants as constants5, fsyncSync as fsyncSync2, mkdirSync as mkdirSync4, openSync as openSync3, renameSync as renameSync3, writeSync as writeSync2 } from "node:fs";
 import { lstat as lstat2, open as open3, realpath as realpath4 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { isAbsolute as isAbsolute2, join as join2, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4, resolve as resolve2 } from "node:path";
 var TOLERANCE_S = 300;
 function relaySecretKey(secret) {
   if (typeof secret !== "string" || !/^whsec_[A-Za-z0-9+/]+={0,2}$/.test(secret)) throw new Error("The relay channel secret must be a whsec_ value");
@@ -1606,6 +1877,8 @@ async function startRelayChannel(options) {
         return served.runner.relayRead(request.args.conversationId, { limit: request.args.limit, before: request.args.before, deadline });
       case "send":
         return served.runner.relaySend(request.args.conversationId, request.args.messageId, request.args.text, { deadline });
+      case "start":
+        return served.runner.relayStart(request.args.targetUserId, request.args.messageId, request.args.text, request.args.selection, { deadline });
     }
   }
   __name(dispatch, "dispatch");
@@ -1715,8 +1988,8 @@ async function loadRelayConfiguration(path, input) {
   return { environmentId: value.environmentId, agentId: value.agentId, listen: { host: listen.host, port: listen.port }, secret };
 }
 __name(loadRelayConfiguration, "loadRelayConfiguration");
-var relayDirectory = /* @__PURE__ */ __name((home) => join2(home, "relay"), "relayDirectory");
-var credentialFile = /* @__PURE__ */ __name((home) => join2(relayDirectory(home), "credential.json"), "credentialFile");
+var relayDirectory = /* @__PURE__ */ __name((home) => join4(home, "relay"), "relayDirectory");
+var credentialFile = /* @__PURE__ */ __name((home) => join4(relayDirectory(home), "credential.json"), "credentialFile");
 async function readRelayCredential(home, relay) {
   const path = credentialFile(home);
   if (!await lstat2(path).then(() => true, () => false)) return void 0;
@@ -1742,7 +2015,7 @@ function writeRelayCredential(home, relay, delivery) {
     generation: delivery.generation,
     credential: delivery.credential
   };
-  mkdirSync3(relayDirectory(home), { recursive: true, mode: 448 });
+  mkdirSync4(relayDirectory(home), { recursive: true, mode: 448 });
   const file = credentialFile(home);
   const temporary = `${file}.${process.pid}.tmp`;
   const fd = openSync3(temporary, "w", 384);
@@ -1752,23 +2025,23 @@ function writeRelayCredential(home, relay, delivery) {
   } finally {
     closeSync3(fd);
   }
-  renameSync2(temporary, file);
+  renameSync3(temporary, file);
   return value;
 }
 __name(writeRelayCredential, "writeRelayCredential");
 function relayRunnerHome(home, installationId) {
   if (!CONNECTOR_RELAY_INSTALLATION_PATTERN.test(installationId)) throw new Error("Invalid relay installation");
-  const directory = join2(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
-  mkdirSync3(directory, { recursive: true, mode: 448 });
+  const directory = join4(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
+  mkdirSync4(directory, { recursive: true, mode: 448 });
   return directory;
 }
 __name(relayRunnerHome, "relayRunnerHome");
 
 // src/runner/runner.ts
-import { createHash as createHash6 } from "node:crypto";
-import { readFileSync as readFileSync3, rmSync as rmSync3 } from "node:fs";
+import { createHash as createHash8 } from "node:crypto";
+import { readFileSync as readFileSync5, rmSync as rmSync3 } from "node:fs";
 import { realpath as realpath5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, isAbsolute as isAbsolute3, join as join4, sep } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute3, join as join6, sep } from "node:path";
 
 // ../agent-tools/src/communication-tool.ts
 var CANON_COMMUNICATE_TOOL_NAME = "communicate";
@@ -2262,10 +2535,10 @@ function createLivePublisher(options) {
 __name(createLivePublisher, "createLivePublisher");
 
 // src/runner/mls-ask.ts
-import { createHash as createHash5 } from "node:crypto";
-import { readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
-import { join as join3 } from "node:path";
-var sha256 = /* @__PURE__ */ __name((value) => createHash5("sha256").update(value).digest("hex"), "sha256");
+import { createHash as createHash7 } from "node:crypto";
+import { readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+var sha2562 = /* @__PURE__ */ __name((value) => createHash7("sha256").update(value).digest("hex"), "sha256");
 var pause = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
   setTimeout(resolve3, ms).unref?.();
 }), "pause");
@@ -2319,10 +2592,10 @@ function createMlsAsks(options, approvalScope2) {
       });
     }
   });
-  const file = /* @__PURE__ */ __name((conversationId, requestId) => join3(options.directory, `${sha256(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
+  const file = /* @__PURE__ */ __name((conversationId, requestId) => join5(options.directory, `${sha2562(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
   const save = /* @__PURE__ */ __name((journal) => writeDurable(file(journal.conversationId, journal.requestId), JSON.stringify(journal)), "save");
   const forget = /* @__PURE__ */ __name((journal) => rmSync2(file(journal.conversationId, journal.requestId), { force: true }), "forget");
-  const operationOf = /* @__PURE__ */ __name((conversationId, messageId) => `runner-mls-ask:${sha256(JSON.stringify([conversationId, messageId])).slice(0, 48)}`, "operationOf");
+  const operationOf = /* @__PURE__ */ __name((conversationId, messageId) => `runner-mls-ask:${sha2562(JSON.stringify([conversationId, messageId])).slice(0, 48)}`, "operationOf");
   const withdrawalOf = /* @__PURE__ */ __name((journal) => operationOf(journal.conversationId, `${journal.requestId}:withdraw`), "withdrawalOf");
   const audienceChanged = /* @__PURE__ */ __name((error) => codeOf(error) === "MLS_DEV_AUDIENCE_CHANGED", "audienceChanged");
   const sameHead = /* @__PURE__ */ __name((a, b) => JSON.stringify(a.head) === JSON.stringify(b.head), "sameHead");
@@ -2663,11 +2936,11 @@ function createMlsAsks(options, approvalScope2) {
       for (const name of names) {
         let journal;
         try {
-          journal = JSON.parse(readFileSync2(join3(options.directory, name), "utf8"));
+          journal = JSON.parse(readFileSync4(join5(options.directory, name), "utf8"));
           if (journal.version !== 1 || typeof journal.conversationId !== "string" || typeof journal.requestId !== "string" || !Array.isArray(journal.sends) || journal.sends.some((sent) => typeof sent?.operationId !== "string" || typeof sent.messageId !== "string")) throw new Error();
           for (const sent of journal.sends) sent.audience = snapshotMlsAudience(sent.audience);
         } catch {
-          rmSync2(join3(options.directory, name), { force: true });
+          rmSync2(join5(options.directory, name), { force: true });
           continue;
         }
         try {
@@ -2825,7 +3098,7 @@ function answerText(answer) {
   return answer.text?.trim() ? answer.text : "They answered with an empty message.";
 }
 __name(answerText, "answerText");
-var sha2562 = /* @__PURE__ */ __name((value) => createHash6("sha256").update(value).digest("hex"), "sha256");
+var sha2563 = /* @__PURE__ */ __name((value) => createHash8("sha256").update(value).digest("hex"), "sha256");
 var toolText = /* @__PURE__ */ __name((text3, isError = false) => ({ content: [{ type: "text", text: text3 }], ...isError ? { isError } : {} }), "toolText");
 var turnEnded2 = /* @__PURE__ */ __name(() => new DOMException("This turn has ended", "AbortError"), "turnEnded");
 function within(promise, ms) {
@@ -2841,9 +3114,10 @@ var pause2 = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
 }), "pause");
 var audienceOf = /* @__PURE__ */ __name((room) => room?.memberIds ? { memberIds: [...room.memberIds], ...typeof room.membershipRevision === "number" ? { membershipRevision: room.membershipRevision } : {} } : null, "audienceOf");
 var inert = /* @__PURE__ */ __name((value) => value.replace(/\s+/g, " ").trim(), "inert");
+var OWNER_MARK = " [your owner]";
 var TRUSTED_MARK = " [trusted teammate agent]";
 var speaker = /* @__PURE__ */ __name((name) => inert(name).replace(/\[/g, "(").replace(/\]/g, ")"), "speaker");
-var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*trusted\s+teammate\s+agent\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)"), "defused");
+var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*(?:trusted\s+teammate\s+agent|your\s+owner)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)"), "defused");
 var NOTE_OPEN = "[owner's private note] Your owner left this for you on the machine you run on. It is not a message in this conversation: no one in it sees it, and it was not posted.";
 var NOTE_CLOSE = "[end of owner's private note]";
 var ERRAND_OPEN = "[owner's errand]";
@@ -2858,8 +3132,8 @@ var errandCommunicate = /* @__PURE__ */ __name((contact) => ({
     properties: { action: { const: "start_conversation" }, principalId: { type: "string", minLength: 1 }, text: { type: "string", minLength: 1 } }
   }] : []] }
 }), "errandCommunicate");
-var promptLine = /* @__PURE__ */ __name((message2, name, media, trusted = false) => [
-  `${speaker(name)}${trusted ? TRUSTED_MARK : ""}: ${defused(renderCanonHostInboundContent(message2, media?.files))}`,
+var promptLine = /* @__PURE__ */ __name((message2, name, media, mark = "") => [
+  `${speaker(name)}${mark}: ${defused(renderCanonHostInboundContent(message2, media?.files))}`,
   ...(media?.failed ?? []).map((label) => `[Attachment "${defused(inert(label))}" could not be downloaded]`)
 ].join("\n"), "promptLine");
 var inputMessage = /* @__PURE__ */ __name((message2, trusted = false) => Object.freeze({
@@ -2896,7 +3170,7 @@ function approvalScope(request) {
   if (request.scopeKey !== void 0 && /^[A-Za-z0-9_:-]{1,64}$/.test(request.scopeKey)) return request.scopeKey;
   const key = request.scopeKey ?? request.title;
   const slug = key.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 40) || "approval";
-  return `${slug}-${sha2562(JSON.stringify([request.scopeKey === void 0 ? "title" : "scope", key])).slice(0, 16)}`;
+  return `${slug}-${sha2563(JSON.stringify([request.scopeKey === void 0 ? "title" : "scope", key])).slice(0, 16)}`;
 }
 __name(approvalScope, "approvalScope");
 var MAX_GROUP_PARTS = 100;
@@ -2970,6 +3244,7 @@ __name(runtimeDescriptor, "runtimeDescriptor");
 async function createRunner(options) {
   const { driver, home } = options;
   await assertPrivateHome(home);
+  const mls = options.mls === false ? void 0 : options.mls ?? (options.endpoint ? void 0 : defaultMlsDevice(home, options.environmentId));
   const log = options.log ?? ((line) => console.error(`[canon-runner] ${line}`));
   const warn = /* @__PURE__ */ __name((what) => (error) => log(`${what}: ${error instanceof Error ? error.message : String(error)}`), "warn");
   const abortGraceMs = options.abortGraceMs ?? 1e4;
@@ -3053,7 +3328,7 @@ async function createRunner(options) {
   const dispose = /* @__PURE__ */ __name((inputs, kind, reason) => Promise.allSettled(inputs.map((input) => input.handle[kind](reason))).then(() => void 0), "dispose");
   const settle = /* @__PURE__ */ __name(async (ids, reason) => (await Promise.allSettled(ids.map((id) => endpoint.setInboundState(id, "settled", reason)))).every(({ status }) => status === "fulfilled"), "settle");
   const queued = /* @__PURE__ */ __name((turn) => turn.inputs.filter((input) => input.handle.phase === "queued"), "queued");
-  const turnId = /* @__PURE__ */ __name((roomId, inputs) => `turn-${sha2562(JSON.stringify([roomId, ...inputs.map((input) => [input.id, input.generation])])).slice(0, 32)}`, "turnId");
+  const turnId = /* @__PURE__ */ __name((roomId, inputs) => `turn-${sha2563(JSON.stringify([roomId, ...inputs.map((input) => [input.id, input.generation])])).slice(0, 32)}`, "turnId");
   const livePublisher = /* @__PURE__ */ __name((current, turn, mode) => createLivePublisher({
     client,
     conversationId: current.id,
@@ -3069,7 +3344,7 @@ async function createRunner(options) {
       current.lane = current.lane.then(publish2).catch(() => void 0);
     }, "enqueue")
   }), "livePublisher");
-  const stateFile = /* @__PURE__ */ __name((session) => join4(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2562(JSON.stringify([scope, session]))}.json`), "stateFile");
+  const stateFile = /* @__PURE__ */ __name((session) => join6(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2563(JSON.stringify([scope, session]))}.json`), "stateFile");
   const resetSession = /* @__PURE__ */ __name(async (session) => {
     rmSync3(stateFile(session), { force: true });
     mlsAsks?.endSession(session);
@@ -3141,6 +3416,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     if (input.mls) target.mls = true;
     target.queue.push(input);
     target.turn?.live.refresh();
+    requeue(target);
     pump();
   }
   __name(offer, "offer");
@@ -3189,6 +3465,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     const verified = {
       id: message2.id,
       senderId: message2.senderId,
+      ...message2.senderName ? { senderName: message2.senderName } : {},
       senderType: fromAgent ? "ai_agent" : "human",
       isOwner: !fromAgent && message2.senderId === ownerId,
       text: message2.text ?? void 0,
@@ -3247,7 +3524,7 @@ ${error instanceof Error ? error.message : String(error)}`;
       const inputs = candidate.queue.splice(0, Math.min(MAX_INPUTS_PER_TURN, other < 0 ? MAX_INPUTS_PER_TURN : other));
       const turn = newTurn(inputs, turnId(candidate.id, inputs), candidate.id);
       candidate.turn = turn;
-      (turn.live = livePublisher(candidate, turn, encrypted ? "presence" : "status")).open();
+      (turn.live = driver.capabilities.remote ? SILENT : livePublisher(candidate, turn, encrypted ? "presence" : "status")).open();
       const done = execute(candidate, turn).catch((error) => {
         warn("turn failed")(error);
         return dispose(queued(turn), "release", "turn-failed");
@@ -3277,14 +3554,28 @@ ${error instanceof Error ? error.message : String(error)}`;
     if (turn.inputs[0].mls && !await beforeTurn(current, turn)) return;
     turn.trusted = await confirmTrusted(turn, conversation.memberIds);
     turn.notes = pendingNotes(current.id);
-    turn.contexts = await Promise.all(openErrands(current.id).map(async (record) => ({ record, encryptedOrigin: !!record.origin && await endpoint.getConversationContentMode(record.origin).then((mode) => mode === "mls-dev-text", () => false) })));
-    turn.live.setMode(turn.mls ? "presence" : driver.capabilities.streaming && resolveTurnVerbosity({ conversationType: kind }) === "verbose" ? "full" : "status");
+    turn.contexts = await Promise.all(openErrands(current.id).map(async (record) => ({ record, encryptedOrigin: !!record.origin && await endpoint.getConversationContentMode(record.origin).then((mode2) => mode2 === "mls-dev-text", () => false) })));
+    const mode = turn.mls ? "presence" : driver.capabilities.streaming && resolveTurnVerbosity({ conversationType: kind }) === "verbose" ? "full" : "status";
+    turn.live.setMode(mode);
     const history = driver.capabilities.sessionMemory === "none" ? await recentHistory(current, turn) : [];
     await materialize(current, turn);
     const bound = bindTools(current, turn);
     try {
       let work;
-      for (let live = queued(turn), waited = 0; live.length && !turn.controller.signal.aborted; ) {
+      if (driver.capabilities.remote) {
+        const live = queued(turn);
+        if (live.length && !turn.controller.signal.aborted) {
+          turn.inputs = live;
+          turn.id = turnId(current.id, live);
+          turn.pickUp = () => pickUp(current, turn, mode);
+          try {
+            work = Promise.resolve(driver.runTurn(buildTurn(current.id, turn, kind, history, bound.tools)));
+          } catch (error) {
+            work = Promise.reject(error);
+          }
+          requeue(current);
+        }
+      } else for (let live = queued(turn), waited = 0; live.length && !turn.controller.signal.aborted; ) {
         turn.inputs = live;
         turn.id = turnId(current.id, live);
         let driverTurn = buildTurn(current.id, turn, kind, history, bound.tools);
@@ -3307,15 +3598,17 @@ ${error instanceof Error ? error.message : String(error)}`;
         live = next;
       }
       if (!work) return;
-      turn.submitted = true;
-      progress(turn);
-      if (!turn.mls) void client.markAsRead(current.id).catch(warn("mark read"));
-      for (const { payload } of turn.mls ? [] : turn.inputs) {
-        if (payload.message.metadata?.inboundDisposition === "queued") {
-          void client.updateMessageDisposition(current.id, payload.message.id, "accepted_now").catch(warn("accepted_now"));
-        }
-      }
+      if (!driver.capabilities.remote) started(current, turn);
       const outcome = await outcomeOf(turn, work);
+      if (!turn.submitted) await turn.claiming?.catch(() => void 0);
+      if (!turn.submitted) {
+        turn.pickUp = void 0;
+        if (turn.reason === "requeue") return void current.queue.unshift(...queued(turn));
+        if (turn.reason) return;
+        const claim = await endpoint.startInbound(queued(turn).map((input) => input.handle), () => void 0);
+        if (claim.status !== "submitted") return await dispose(queued(turn), "release", "claim-deferred");
+        started(current, turn);
+      }
       turn.open = false;
       turn.ended.abort();
       bound.release();
@@ -3328,6 +3621,46 @@ ${error instanceof Error ? error.message : String(error)}`;
     }
   }
   __name(execute, "execute");
+  function started(current, turn) {
+    turn.submitted = true;
+    progress(turn);
+    if (!turn.mls) void client.markAsRead(current.id).catch(warn("mark read"));
+    for (const { payload } of turn.mls ? [] : turn.inputs) {
+      if (payload.message.metadata?.inboundDisposition === "queued") {
+        void client.updateMessageDisposition(current.id, payload.message.id, "accepted_now").catch(warn("accepted_now"));
+      }
+    }
+  }
+  __name(started, "started");
+  async function pickUp(current, turn, mode) {
+    const live = queued(turn);
+    if (live.length !== turn.inputs.length) {
+      abort(turn, "requeue");
+      throw turnEnded2();
+    }
+    const claiming = endpoint.startInbound(live.map((input) => input.handle), () => void 0).then((result) => {
+      if (result.status === "submitted") {
+        turn.pickUp = void 0;
+        started(current, turn);
+        if (!turn.controller.signal.aborted) (turn.live = livePublisher(current, turn, mode)).open();
+      }
+      return result;
+    });
+    turn.claiming = claiming;
+    const claim = await claiming;
+    if (claim.status !== "submitted") {
+      if (claim.status !== "deferred") abort(turn, "requeue");
+      throw new Error("The input could not be claimed now");
+    }
+  }
+  __name(pickUp, "pickUp");
+  function requeue(current) {
+    const turn = current.turn, next = current.queue[0];
+    if (!turn?.pickUp || turn.pickingUp || turn.controller.signal.aborted || !next) return;
+    if (!!next.mls !== !!turn.inputs[0].mls || turn.inputs.length >= MAX_INPUTS_PER_TURN) return;
+    abort(turn, "requeue");
+  }
+  __name(requeue, "requeue");
   async function confirmTrusted(turn, memberIds) {
     if (!trustedAgents.size || driver.capabilities.remote || options.relay) return /* @__PURE__ */ new Set();
     const candidates = turn.inputs.map(({ payload }) => payload.message).filter((message2) => message2.senderType === "ai_agent" && message2.senderId !== agentId && trustedAgents.has(message2.senderId) && (turn.mls ? true : message2.metadata?.[ACTED_FOR_OWNER] === true && message2.metadata.turnSemantics === "turn_complete" && message2.forwarded !== true));
@@ -3399,7 +3732,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     return check;
   }
   __name(reaudience, "reaudience");
-  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join4(home, "runner", options.environmentId, agentId) }), "inboundMedia");
+  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join6(home, "runner", options.environmentId, agentId) }), "inboundMedia");
   async function materialize(current, turn) {
     if (driver.capabilities.remote) return;
     for (const { payload: { message: message2 } } of turn.inputs) {
@@ -3450,7 +3783,7 @@ ${error instanceof Error ? error.message : String(error)}`;
       ask_question: /* @__PURE__ */ __name(async (args) => {
         const question = questionOf(args);
         if (typeof question === "string") return { result: toolText(question, true) };
-        const key = sha2562(JSON.stringify(question));
+        const key = sha2563(JSON.stringify(question));
         const waiting = questions.get(key);
         const entry = waiting?.waiting ? waiting : { id: `canon:ask_question:${asked += 1}`, waiting: true };
         questions.set(key, entry);
@@ -3560,7 +3893,7 @@ ${JSON.stringify(result, null, 2)}`);
     let sending = turn.said.get(messageId);
     if (!sending) {
       turn.said.set(messageId, sending = (async () => {
-        const mls = audience ?? (await currentAudience(roomId)).audience;
+        const mls2 = audience ?? (await currentAudience(roomId)).audience;
         const record = {
           version: 1,
           turnId: messageId,
@@ -3571,7 +3904,7 @@ ${JSON.stringify(result, null, 2)}`);
           text: text3,
           options: { messageId },
           notice: false,
-          mls
+          mls: mls2
         };
         journal.save(record);
         const sent2 = await publish(record);
@@ -3768,7 +4101,7 @@ ${JSON.stringify(result, null, 2)}`);
         messageId: `${root}-part-${index + 1}`,
         metadata: buildChunkedMessagePartMetadata({ groupId: root, metadata: options2.metadata, index: index + 1, count: bodies.length })
       } }));
-      return client.prepareMessageGroup(record.conversationId, root, parts, { signal, ...replaces ? { operationId: sha2562(JSON.stringify([root, ...attachments.map((attachment) => attachment.uploadId)])), replacesOperationId: replaces } : {} }).then((group2) => ({ ...group2, count: parts.length }));
+      return client.prepareMessageGroup(record.conversationId, root, parts, { signal, ...replaces ? { operationId: sha2563(JSON.stringify([root, ...attachments.map((attachment) => attachment.uploadId)])), replacesOperationId: replaces } : {} }).then((group2) => ({ ...group2, count: parts.length }));
     }, "register");
     const original = await register(record.attachments);
     let group = original;
@@ -3807,21 +4140,21 @@ ${JSON.stringify(result, null, 2)}`);
     return await send(record.conversationId, STOPS_SHORT_NOTICE, notice, retire) === "pending" ? "pending" : "refused";
   }
   __name(publish, "publish");
-  async function send(conversationId, text3, options2, retire, record, mls = record?.mls) {
+  async function send(conversationId, text3, options2, retire, record, mls2 = record?.mls) {
     const sent = await (async () => {
       for (let attempt = 0; ; attempt += 1) {
         const files = record?.attachments?.length ?? 0;
-        const result = await untilHalt((mls ? sendEncryptedItems(mls, record?.items ?? [], retire).then(() => sendEncrypted(mls, options2.messageId, text3, retire)) : files ? sendWithFiles(record, fitGroup(text3, files), options2, retire) : sendMessageWithRetryChunked(client, conversationId, fitGroup(text3, 0), options2, { signal: retire })).then(() => "delivered", (error) => error));
+        const result = await untilHalt((mls2 ? sendEncryptedItems(mls2, record?.items ?? [], retire).then(() => sendEncrypted(mls2, options2.messageId, text3, retire)) : files ? sendWithFiles(record, fitGroup(text3, files), options2, retire) : sendMessageWithRetryChunked(client, conversationId, fitGroup(text3, 0), options2, { signal: retire })).then(() => "delivered", (error) => error));
         if (result === "delivered" || result === "pending") return result;
         if (retire?.aborted || isPendingCanonOperation(result)) return "pending";
-        if (mls ? result.retryable === false : !isRetryableCanonDeliveryError(result)) {
+        if (mls2 ? result.retryable === false : !isRetryableCanonDeliveryError(result)) {
           warn("Canon refused a reply")(result);
           return "refused";
         }
         if (await untilHalt(pause2(Math.min(3e4, 1e3 * 2 ** attempt))) === "pending") return "pending";
       }
     })();
-    if (mls) forgetGuard(mls, options2.messageId, sent);
+    if (mls2) forgetGuard(mls2, options2.messageId, sent);
     return sent;
   }
   __name(send, "send");
@@ -3891,7 +4224,7 @@ ${JSON.stringify(result, null, 2)}`);
     return { items, refused: refused2 };
   }
   __name(admitItems, "admitItems");
-  const encryptedOperation = /* @__PURE__ */ __name((audience, messageId) => `runner-mls:${sha2562(JSON.stringify([audience.conversationId, messageId])).slice(0, 48)}`, "encryptedOperation");
+  const encryptedOperation = /* @__PURE__ */ __name((audience, messageId) => `runner-mls:${sha2563(JSON.stringify([audience.conversationId, messageId])).slice(0, 48)}`, "encryptedOperation");
   function forgetGuard(audience, messageId, sent) {
     if (sent === "pending") return;
     const operationId = encryptedOperation(audience, messageId);
@@ -3919,7 +4252,7 @@ ${JSON.stringify(result, null, 2)}`);
       ...turn.contexts.length ? { errands: Object.freeze(turn.contexts.map(({ record }) => errandFacts(record))) } : {},
       ...turn.errand ? { errand: errandFacts(turn.errand.record) } : {}
     });
-    const line = /* @__PURE__ */ __name((message2, trusted = false) => promptLine(message2, message2.senderId === agentId ? "You" : message2.senderName ?? message2.senderId, turn.media.get(message2.id), trusted), "line");
+    const line = /* @__PURE__ */ __name((message2, mark = "") => promptLine(message2, message2.senderId === agentId ? "You" : message2.senderName ?? message2.senderId, turn.media.get(message2.id), mark), "line");
     const open4 = /* @__PURE__ */ __name(() => turn.open && !turn.controller.signal.aborted, "open");
     const live = /* @__PURE__ */ __name(() => open4() && !turn.silenced, "live");
     return {
@@ -3929,7 +4262,7 @@ ${JSON.stringify(result, null, 2)}`);
         ...turn.notes.flatMap((note) => [NOTE_OPEN, defused(note.text), NOTE_CLOSE, ""]),
         ...turn.contexts.flatMap((context) => [...contextPrompt(context, !!turn.mls), ""]),
         ...history.length ? ["Earlier in this conversation (context, not new requests):", ...history.map((message2) => line(message2)), "", "New messages:"] : turn.notes.length || turn.contexts.length ? ["New messages:"] : [],
-        ...turn.inputs.map(({ payload: { message: message2 } }) => line(message2, trustedSender(message2)))
+        ...turn.inputs.map(({ payload: { message: message2 } }) => line(message2, message2.isOwner === true ? OWNER_MARK : trustedSender(message2) ? TRUSTED_MARK : ""))
       ].join("\n"),
       input,
       files: turn.inputs.flatMap(({ payload: { message: message2 } }) => turn.media.get(message2.id)?.files.map((file) => file.path) ?? []),
@@ -3955,21 +4288,28 @@ ${JSON.stringify(result, null, 2)}`);
   __name(buildTurn, "buildTurn");
   async function confirmPickup(roomId, turn, open4) {
     if (!open4()) throw turnEnded2();
-    const current = await client.getConversation(roomId);
-    if (!open4()) throw turnEnded2();
-    if (!current?.memberIds?.includes(agentId)) {
-      loseMembership(room(roomId));
-      throw new Error("The agent is no longer a member of this conversation");
-    }
-    if (turn.mls && await readAgain(() => reaudience(roomId, turn), Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS) === "changed") {
-      if (!turn.controller.signal.aborted) {
-        void dispose(queued(turn), "settle", "mls-obsolete-audience");
-        abort(turn, "audience");
+    turn.pickingUp = true;
+    try {
+      const current = await client.getConversation(roomId);
+      if (!open4()) throw turnEnded2();
+      if (!current?.memberIds?.includes(agentId)) {
+        loseMembership(room(roomId));
+        throw new Error("The agent is no longer a member of this conversation");
+      }
+      if (turn.mls && await readAgain(() => reaudience(roomId, turn), Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS) === "changed") {
+        if (!turn.controller.signal.aborted) {
+          void dispose(queued(turn), "settle", "mls-obsolete-audience");
+          abort(turn, "audience");
+        }
+        throw new Error("Who can read this encrypted conversation changed");
       }
-      throw new Error("Who can read this encrypted conversation changed");
+      if (!open4()) throw turnEnded2();
+      if (turn.pickUp) await turn.pickUp();
+      progress(turn);
+    } finally {
+      turn.pickingUp = false;
+      requeue(room(roomId));
     }
-    if (!open4()) throw turnEnded2();
-    progress(turn);
   }
   __name(confirmPickup, "confirmPickup");
   function ask(roomId, turn, sender, request) {
@@ -3989,7 +4329,7 @@ ${JSON.stringify(result, null, 2)}`);
         }));
         const secret = request.kind === "text" && request.secret === true;
         const responder = secret || sender.type !== "human" ? ownerId : sender.id;
-        const requestId = turn.mls ? keyed().request(roomId, turn.id, request.id) : `ask-${sha2562(JSON.stringify([turn.id, request.id])).slice(0, 32)}`;
+        const requestId = turn.mls ? keyed().request(roomId, turn.id, request.id) : `ask-${sha2563(JSON.stringify([turn.id, request.id])).slice(0, 32)}`;
         const expiresAt = Date.now() + askExpiryMs;
         if (turn.mls) {
           return await mlsAsks.ask({
@@ -4061,7 +4401,7 @@ ${JSON.stringify(result, null, 2)}`);
     const file = stateFile(session);
     let data = {};
     try {
-      data = JSON.parse(readFileSync3(file, "utf8"));
+      data = JSON.parse(readFileSync5(file, "utf8"));
     } catch {
     }
     const save = /* @__PURE__ */ __name((next) => {
@@ -4151,11 +4491,11 @@ ${JSON.stringify(result, null, 2)}`);
           const mode = await endpoint.getConversationContentMode(roomId);
           if (mode !== "plaintext") target.mls = true;
           if (mode !== "plaintext" && (!mlsOn || mode !== "mls-dev-text")) refuse(roomId, mlsOn ? "protocol" : "no-device");
-          const mls = mode === "mls-dev-text" && mlsOn ? (await currentAudience(roomId)).audience : void 0;
+          const mls2 = mode === "mls-dev-text" && mlsOn ? (await currentAudience(roomId)).audience : void 0;
           const legacy = `${id}:restart`;
-          const messageId = mls && !await endpoint.getOperation(encryptedOperation(mls, legacy)) ? keyed().text("restart", roomId, id) : legacy;
-          if (mode !== "plaintext" && !mls) await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
-          else if (await send(roomId, RESTART_NOTICE, outputOptions(id, trigger, "restart", false, messageId), void 0, void 0, mls) !== "pending") {
+          const messageId = mls2 && !await endpoint.getOperation(encryptedOperation(mls2, legacy)) ? keyed().text("restart", roomId, id) : legacy;
+          if (mode !== "plaintext" && !mls2) await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
+          else if (await send(roomId, RESTART_NOTICE, outputOptions(id, trigger, "restart", false, messageId), void 0, void 0, mls2) !== "pending") {
             await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
           }
         }
@@ -4278,7 +4618,7 @@ ${JSON.stringify(result, null, 2)}`);
       log(`Errand ${id} (tell) kept for the next turn in ${conversationId}.`);
       return true;
     }
-    const turnId2 = `turn-${sha2562(JSON.stringify(["canon.runner.errand", id])).slice(0, 32)}`;
+    const turnId2 = `turn-${sha2563(JSON.stringify(["canon.runner.errand", id])).slice(0, 32)}`;
     const record = {
       version: 1,
       turnId: turnId2,
@@ -4347,7 +4687,7 @@ ${JSON.stringify(result, null, 2)}`);
     pump();
   }
   __name(enqueueErrand, "enqueueErrand");
-  const errandTurnId = /* @__PURE__ */ __name((id) => `turn-${sha2562(JSON.stringify(["canon.runner.errand-turn", id])).slice(0, 32)}`, "errandTurnId");
+  const errandTurnId = /* @__PURE__ */ __name((id) => `turn-${sha2563(JSON.stringify(["canon.runner.errand-turn", id])).slice(0, 32)}`, "errandTurnId");
   const errandFacts = /* @__PURE__ */ __name((record) => Object.freeze({
     id: record.id,
     why: record.why,
@@ -4683,12 +5023,12 @@ ${JSON.stringify(result, null, 2)}`);
       client = new CanonClient(options.apiKey, connection.apiBaseUrl, {
         environmentId: connection.environmentId,
         streamUrl: connection.streamUrl,
-        stateDirectory: join4(home, "endpoint"),
+        stateDirectory: join6(home, "endpoint"),
         ...options.client ? { client: options.client } : {},
         // Below Canon's client floor nothing can work, wherever the refusal surfaces: a query, an operation or the stream.
         ...options.onFatal ? { onClientUpdateRequired: /* @__PURE__ */ __name((error) => options.onFatal(error), "onClientUpdateRequired") } : {},
         ...options.installationId ? { installationId: options.installationId } : {},
-        ...options.mls ? { mlsDev: { configuration: options.mls.configuration, custody: options.mls.custody } } : {},
+        ...mls ? { mlsDev: { configuration: mls.configuration, custody: mls.custody } } : {},
         ...options.endpoint ? { endpoint: options.endpoint } : {},
         ...options.fetch ? { fetch: options.fetch } : {}
       });
@@ -4704,7 +5044,17 @@ ${JSON.stringify(result, null, 2)}`);
       if (options.wake !== void 0) await client.configureWake(options.wake);
       mlsOn = !!(endpoint.mlsDevDevice && endpoint.mlsDevGroups);
       if (!mlsOn && (await endpoint.capabilities().catch(() => null))?.mls?.roomMode === "default") {
-        throw new Error("Canon encrypts every new conversation here, and this runner has no MLS device: run it with --mls-dev-config <path> (set one up with canon-agent mls).");
+        throw new Error(`Canon encrypts every new conversation here, and this runner has no MLS device${options.mls === void 0 && !options.endpoint ? ` (@canonmsg/agent-sdk ships no custody helper for ${process.platform}-${process.arch})` : ""}: give it an operator's configuration (--mls-dev-config <path>, or mls: await loadMlsDevConfiguration(path, { environmentId })).`);
+      }
+      if (mlsOn && mls?.provisioned) {
+        await assertMlsVaultInHome(endpoint, mls.provisioned);
+        if ((await endpoint.mlsDevDevice.read()).status !== "credential_committed") {
+          log("Setting up this agent's MLS device");
+          const device = await runMlsDevSetup(endpoint, "setup", void 0, mls.provision, mls.provisioned).catch((error) => {
+            throw new Error(`Could not set up this agent's MLS device: ${error instanceof Error ? error.message : String(error)}`);
+          });
+          log(`MLS device ${device.deviceId} is ${device.status}`);
+        }
       }
       if (mlsOn) await endpoint.mlsDevDevice.ensureReady().catch(warn("MLS device not ready; encrypted rooms wait for it"));
       const keepPool = /* @__PURE__ */ __name(() => endpoint.mlsDevDevice.read().then(async (view) => {
@@ -4721,23 +5071,23 @@ ${JSON.stringify(result, null, 2)}`);
       }
       scope = JSON.stringify([identity.environmentId, agentId, identity.ownershipVersion ?? 0, identity.installationId]);
       if (mlsOn) {
-        mlsIds = createMlsIds(privateKey(join4(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2562(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
+        mlsIds = createMlsIds(privateKey(join6(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2563(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
         mlsAsks = createMlsAsks({
           endpoint,
           agentId,
-          directory: join4(home, "runner", options.environmentId, agentId, "asks", sha2562(scope).slice(0, 32)),
+          directory: join6(home, "runner", options.environmentId, agentId, "asks", sha2563(scope).slice(0, 32)),
           assertAudience,
           sessionForDestructive: options.sessionApprovalForDestructive === true,
           log
         }, approvalScope);
       }
-      journal = createCompletedOutputJournal(join4(home, "runner", options.environmentId, agentId, "finals"), scope, {
+      journal = createCompletedOutputJournal(join6(home, "runner", options.environmentId, agentId, "finals"), scope, {
         label: "agent runner",
         validate: /* @__PURE__ */ __name((record) => typeof record.text === "string" && typeof record.options?.messageId === "string" && Array.isArray(record.inputs) && typeof record.notice === "boolean" && (record.attachments === void 0 || Array.isArray(record.attachments)) && (record.flows === void 0 || Array.isArray(record.flows) && record.flows.length === record.attachments?.length) && (record.mls === void 0 || !!record.mls && typeof record.mls === "object") && (record.errand === void 0 || typeof record.errand === "string"), "validate")
       });
       if (!options.relay && !driver.capabilities.remote) {
         errands = errandJournal(errandsDirectory(home, options.environmentId, agentId));
-        errandScope = sha2562(scope).slice(0, 32);
+        errandScope = sha2563(scope).slice(0, 32);
         const pending = errands.list().filter((record) => record.kind === "tell" && record.status === "pending").sort((a, b) => (a.createdAt ?? "").localeCompare(b.createdAt ?? "") || a.id.localeCompare(b.id));
         for (const note of pending) {
           if (note.scope === errandScope) notes.set(note.conversationId, [...notes.get(note.conversationId) ?? [], note]);
@@ -4759,10 +5109,8 @@ ${JSON.stringify(result, null, 2)}`);
       roots = outbound ? (await Promise.all(outbound.roots.map((root) => realpath5(root).catch(() => "")))).filter(Boolean) : [];
       if (driver.capabilities.tools) tools = await startToolServer();
       await recover();
-      if (!options.relay) {
-        const publisher = createRuntimeStatePublisher({ agentId, clientType: CLIENT_TYPES[driver.name], hostMode: true, rtdb: initRTDBAuth(client) });
-        heartbeat = createRuntimeHeartbeat({ publisher, getRuntime: /* @__PURE__ */ __name(() => ({ runtimeDescriptor: descriptor }), "getRuntime"), onError: warn("runtime heartbeat") });
-      }
+      const publisher = createRuntimeStatePublisher({ agentId, clientType: CLIENT_TYPES[driver.name], hostMode: true, rtdb: initRTDBAuth(client) });
+      heartbeat = createRuntimeHeartbeat({ publisher, getRuntime: /* @__PURE__ */ __name(() => ({ runtimeDescriptor: descriptor }), "getRuntime"), onError: warn("runtime heartbeat") });
       inbound = endpoint.acceptInbound({ kind: "message.created", offer, onError: warn("inbox"), ...mlsOn ? { intervalMs: 1e3 } : {} });
       inbound.start();
       let reconnect = false;
@@ -4827,7 +5175,7 @@ ${JSON.stringify(result, null, 2)}`);
         for (const unregister of guards.values()) unregister();
         guards.clear();
         await client?.close();
-        await options.mls?.close?.().catch(warn("MLS custody close"));
+        await mls?.close?.().catch(warn("MLS custody close"));
       })().finally(() => lock?.release());
       return stopping;
     },
@@ -4858,7 +5206,7 @@ ${JSON.stringify(result, null, 2)}`);
         throw new ConnectorRelayError(400, "CONNECTOR_RELAY_INVALID", "A send needs a messageId and 1 byte to 32 KiB of text");
       }
       const deadline = options2.deadline ?? Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS;
-      const id = `relay-send-${sha2562(JSON.stringify([conversationId, messageId])).slice(0, 32)}`;
+      const id = `relay-send-${sha2563(JSON.stringify([conversationId, messageId])).slice(0, 32)}`;
       let entry = relaySends.get(id);
       if (!entry) relaySends.set(id, entry = prepareRelaySend(conversationId, id, text3, deadline));
       const prepared = await beforeDeadline(entry.ready, deadline);
@@ -4866,6 +5214,54 @@ ${JSON.stringify(result, null, 2)}`);
       const sent = await within(entry.sent, Math.max(0, deadline - Date.now()));
       if (sent === "refused") throw new ConnectorRelayError(409, "CONNECTOR_RELAY_SEND_REFUSED", "Canon did not accept the message; the conversation's members may have changed");
       return { conversationId, messageId, historyMessageId: id, status: sent === "delivered" ? "sent" : "pending" };
+    },
+    async relayStart(targetUserId, messageId, text3, selection, startOptions = {}) {
+      if (typeof targetUserId !== "string" || !targetUserId || targetUserId.length > 200 || targetUserId.includes("/") || typeof messageId !== "string" || !ENDPOINT_ID_PATTERN.test(messageId) || messageId.length > 120 || typeof text3 !== "string" || !text3.trim() || Buffer.byteLength(text3) > MLS_DEV_TEXT_MAX_BYTES) {
+        throw new ConnectorRelayError(400, "CONNECTOR_RELAY_INVALID", "A start needs a person or agent, a messageId and 1 byte to 32 KiB of text");
+      }
+      if (!options.relay || !client) throw new ConnectorRelayError(403, "CONNECTOR_RELAY_UNAVAILABLE", "This runner is not a relay");
+      if (!mlsOn) throw new ConnectorRelayError(503, "CONNECTOR_RELAY_NO_DEVICE", "The relay has no MLS device");
+      const deadline = startOptions.deadline ?? Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS;
+      const identity = { messageId, historyMessageId: `relay-start-${sha2563(messageId).slice(0, 32)}` };
+      const answer = await within(
+        endpoint.startWithheldOpener({
+          targetUserId,
+          text: text3,
+          messageId: identity.historyMessageId,
+          ...selection ? { selection } : {}
+        }).then((result2) => ({ result: result2 }), (error) => ({ error })),
+        Math.max(0, deadline - Date.now())
+      );
+      if (!answer || "error" in answer && answer.error?.retryable === true) {
+        return { ...identity, status: "starting" };
+      }
+      if ("error" in answer) {
+        const { status, code, message: message2 } = answer.error;
+        if (code === "OPERATION_ID_COLLISION") {
+          throw new ConnectorRelayError(409, "CONNECTOR_RELAY_MESSAGE_CONFLICT", "This messageId already started a conversation with other text or another person");
+        }
+        if ((status === 400 || status === 403 || status === 404 || status === 409) && typeof code === "string") {
+          throw new ConnectorRelayError(status, code, typeof message2 === "string" ? message2 : "Canon refused the start");
+        }
+        throw answer.error;
+      }
+      const result = answer.result;
+      if ("reason" in result) {
+        if (result.reason === "opening-text-required") {
+          throw new ConnectorRelayError(403, "CONNECTOR_RELAY_NOT_ENCRYPTED", "The relay serves only encrypted conversations its agent is in");
+        }
+        return { ...identity, status: result.status, reason: result.reason };
+      }
+      if ("requestId" in result) {
+        return { ...identity, status: result.status, requestId: result.requestId, ...result.conversationId ? { conversationId: result.conversationId } : {} };
+      }
+      return {
+        ...identity,
+        status: "messaged",
+        conversationId: result.conversationId,
+        ...result.created !== void 0 ? { created: result.created } : {},
+        ...result.reused !== void 0 ? { reused: result.reused } : {}
+      };
     }
   };
 }
@@ -4903,6 +5299,10 @@ export {
   MLS_SETUP_ACTIONS,
   mlsDevRoomPackageId,
   runMlsDevSetup,
+  MLS_ENVIRONMENT_PINS,
+  bundledMlsCustodyHelper,
+  defaultMlsDevice,
+  managedMlsDevice,
   startRelayChannel,
   loadRelayConfiguration,
   readRelayCredential,