@canonmsg/agent-sdk 12.5.1 → 12.6.1

package/dist/chunks/{chunk-3KFVBOVI.js → chunk-DAJ7L7TN.js}

@@ -1,9 +1,19 @@
+import {
+  assertPrivateHome,
+  assertPrivateWindowsFile,
+  privateKey,
+  restrictWindowsFile,
+  runnerLockName,
+  secureWindowsDirectory,
+  wasmMlsCustody,
+  windowsAclProblems,
+  writeDurable
+} from "./chunk-HH7KR22P.js";
 import {
   ApprovalManager,
   BoundedFileReadError,
   CanonClient,
   MAX_CANON_MEDIA_BYTES,
-  NodeMlsDevCustodyError,
   RUNTIME_NEW_SESSION_ACTION,
   RUNTIME_STOP_ACTION,
   RUNTIME_STOP_AND_DROP_ACTION,
@@ -12,8 +22,6 @@ import {
   buildChunkedMessagePartMetadata,
   conversationMediaCacheDir,
   createCompletedOutputJournal,
-  createNodeMlsDevCustody,
-  createPortableNodeMlsDevCustody,
   createRuntimeHeartbeat,
   createRuntimeStatePublisher,
   inferUploadMimeType,
@@ -30,7 +38,15 @@ import {
   sendMessageWithRetryChunked,
   splitTextByUtf8Bytes,
   verifyCanonRuntimeConnection
-} from "./chunk-TFSURFF6.js";
+} from "./chunk-5J4YPLNW.js";
+import {
+  NodeMlsDevCustodyError,
+  createNodeMlsDevCustody,
+  createPortableNodeMlsDevCustody
+} from "./chunk-FVYKLH6I.js";
+import {
+  parseMlsDevClientConfiguration
+} from "./chunk-QK37HAHC.js";
 import {
   CONNECTOR_RELAY_ANSWER_WITHIN_MS,
   CONNECTOR_RELAY_INSTALLATION_PATTERN,
@@ -54,12 +70,11 @@ import {
   mlsDevProtocolCarriesCards,
   parseConnectorRelayRequest,
   parseDirectConversationSelection,
-  parseMlsDevClientConfiguration,
   parseMlsDevCredentialToken,
   parseMlsDevGroupHead,
   parseMlsDevGroupRoster,
   resolveAllowedUploadMimeType
-} from "./chunk-C2WJT3VX.js";
+} from "./chunk-S7BV74DN.js";
 
 // src/runner/types.ts
 var DriverSessionError = class extends Error {
@@ -106,11 +121,13 @@ async function loadInstructions(path) {
   if (real !== path) refuse(`must be given by its real path (${real}), with no symbolic links`);
   const parent = await stat(dirname(path)).catch(() => refuse("cannot be read"));
   const uid = process.getuid?.();
-  if (parent.uid !== uid && parent.uid !== 0 || (parent.mode & 18) !== 0) refuse("its directory must not be writable by group or others");
+  const windows = process.platform === "win32" ? windowsAclProblems([[dirname(path), "unwritable"], [path, "unwritable"]]) : void 0;
+  if (windows?.length) refuse(`must not be writable by others: ${windows[0]}`);
+  if (!windows && (parent.uid !== uid && parent.uid !== 0 || (parent.mode & 18) !== 0)) refuse("its directory must not be writable by group or others");
   const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK).catch(() => refuse("cannot be read"));
   try {
     const info = await file.stat();
-    if (info.uid !== uid || (info.mode & 18) !== 0) refuse("must be owned by you and not writable by group or others");
+    if (!windows && (info.uid !== uid || (info.mode & 18) !== 0)) refuse("must be owned by you and not writable by group or others");
     const bytes = await readBoundedRegularFileHandle(file, MAX_INSTRUCTIONS_BYTES).catch((error) => refuse(error instanceof BoundedFileReadError ? error.failure === "too-large" ? "is larger than 32 KiB" : "is not a regular file" : "cannot be read"));
     let text3;
     try {
@@ -126,11 +143,13 @@ async function loadInstructions(path) {
 }
 __name(loadInstructions, "loadInstructions");
 
-// src/drivers/claude.ts
-import { randomUUID } from "node:crypto";
+// src/drivers/acp.ts
+import { spawn as spawn2 } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname as dirname2 } from "node:path";
+import { basename } from "node:path";
+import { pathToFileURL } from "node:url";
 
 // src/drivers/call-scope.ts
 import { createHash } from "node:crypto";
@@ -141,17 +160,464 @@ function callScope(name, call) {
 }
 __name(callScope, "callScope");
 
+// src/drivers/installed-cli.ts
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname as dirname2, extname, join } from "node:path";
+function shimTarget(shim) {
+  const last = [...shim.matchAll(/"([^"]+)"\s+%\*/g)].at(-1)?.[1];
+  const variable = /^%(\w+)%$/.exec(last ?? "")?.[1];
+  const target = variable ? new RegExp(`SET "${variable}=([^"]+)"`, "i").exec(shim)?.[1] : last;
+  return /^%~?dp0%?\\(.+)$/.exec(target ?? "")?.[1];
+}
+__name(shimTarget, "shimTarget");
+function installedCli(path) {
+  const given = { file: path, args: [] };
+  if (process.platform !== "win32") return given;
+  const names = extname(path) ? [path] : [`${path}.exe`, `${path}.cmd`];
+  const directories = /[\\/]/.test(path) ? [""] : (process.env.PATH ?? "").split(";").filter(Boolean);
+  for (const directory of directories) {
+    for (const name of names) {
+      const file = join(directory, name);
+      if (!existsSync(file)) continue;
+      if (!/\.(?:cmd|bat)$/i.test(file)) return { file, args: [] };
+      const target = shimTarget(readFileSync(file, "utf8"));
+      if (!target) throw new Error(`${file} is not an npm shim: give the path of the program it runs.`);
+      const script = join(dirname2(file), target);
+      return /\.[cm]?js$/i.test(script) ? { file: process.execPath, args: [script] } : { file: script, args: [] };
+    }
+  }
+  return given;
+}
+__name(installedCli, "installedCli");
+function stopCli(child) {
+  if (process.platform !== "win32") {
+    child.kill("SIGTERM");
+    return;
+  }
+  if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) return;
+  spawn(
+    join(process.env.SystemRoot ?? "C:\\Windows", "System32", "taskkill.exe"),
+    ["/PID", String(child.pid), "/T", "/F"],
+    { stdio: "ignore", windowsHide: true }
+  ).once("error", () => {
+    child.kill();
+  });
+}
+__name(stopCli, "stopCli");
+
+// src/drivers/subprocess.ts
+import { createHash as createHash2 } from "node:crypto";
+import { createInterface } from "node:readline";
+var isRecord = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
+var text = /* @__PURE__ */ __name((value) => typeof value === "string" ? value : "", "text");
+var oneLine = /* @__PURE__ */ __name((value, max) => {
+  const line = value.replace(/\s+/g, " ").trim();
+  return line.length > max ? `${line.slice(0, max - 1)}\u2026` : line;
+}, "oneLine");
+var RISKY = /\brm\s+-[a-z]*[rf]|\bgit\s+(reset\s+--hard|push\s+(-f|--force))|\bdrop\s+(table|database)\b|\bmkfs\b|\bdd\s+if=/i;
+var guestTurn = /* @__PURE__ */ __name((turn) => !turn.input.messages.every((message2) => message2.isOwner || message2.trustedAgent === true), "guestTurn");
+async function approve(turn, request) {
+  const asked = createHash2("sha256").update(JSON.stringify([request.scopeKey, request.title, request.detail])).digest("hex").slice(0, 12);
+  const answer = await turn.ask({ kind: "approve", ...request, id: `${request.id}#${asked}` }).catch(() => void 0);
+  if (!answer) return "stopped";
+  if (answer.status !== "answered" || !answer.allow) return "denied";
+  return answer.scope === "session" ? "session" : "once";
+}
+__name(approve, "approve");
+function stdioRpc(child, handlers, { name, envelope }) {
+  let next = 0;
+  const pending = /* @__PURE__ */ new Map();
+  const write = /* @__PURE__ */ __name((message2) => {
+    if (child.stdin?.writable) child.stdin.write(`${JSON.stringify({ ...envelope, ...message2 })}
+`);
+  }, "write");
+  child.stdin?.on("error", () => void 0);
+  createInterface({ input: child.stdout }).on("error", () => void 0).on("line", (line) => {
+    let message2;
+    try {
+      message2 = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (!isRecord(message2)) return;
+    const params = isRecord(message2.params) ? message2.params : {};
+    if (typeof message2.method !== "string") {
+      const waiting = pending.get(Number(message2.id));
+      pending.delete(Number(message2.id));
+      if (isRecord(message2.error)) waiting?.reject(Object.assign(new Error(text(message2.error.message) || `${name} refused the request`), { code: message2.error.code }));
+      else waiting?.resolve(message2.result);
+    } else if (message2.id !== void 0) {
+      handlers.request(message2.method, params, message2.id).then(
+        (result) => write({ id: message2.id, result }),
+        (error) => write({ id: message2.id, error: {
+          code: typeof error?.code === "number" ? error.code : -32e3,
+          message: error instanceof Error ? error.message : String(error)
+        } })
+      );
+    } else handlers.notify(message2.method, params);
+  });
+  child.stderr?.resume();
+  return {
+    call: /* @__PURE__ */ __name((method, params) => new Promise((resolve3, reject) => {
+      next += 1;
+      pending.set(next, { resolve: /* @__PURE__ */ __name((value) => resolve3(isRecord(value) ? value : {}), "resolve"), reject });
+      write({ id: next, method, params });
+    }), "call"),
+    notify: /* @__PURE__ */ __name((method, params) => write({ method, ...params ? { params } : {} }), "notify"),
+    fail(error) {
+      for (const waiting of pending.values()) waiting.reject(error);
+      pending.clear();
+    }
+  };
+}
+__name(stdioRpc, "stdioRpc");
+
+// src/drivers/acp.ts
+var PROTOCOL = 1;
+var SESSION = "sessionId";
+var OWNER_MODE = "ownerMode";
+var CANON = "canon";
+var METHOD_NOT_FOUND = -32601;
+var AUTH_REQUIRED = -32e3;
+var SYSTEM = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. Your final message in a turn is posted there as your reply, so put your whole answer in it. Canon's tools are on the MCP server whose name starts with canon_. To ask the people in the conversation a question, call its ask_question tool and wait for the answer. When you have nothing to add, call its no_reply tool instead of answering.";
+var GUEST = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: do not read files, run commands or use any tool but those of the MCP server whose name starts with canon_. Answer from the conversation and what you already know, and say so when something needs your owner.";
+var OWNER_ONLY = "This agent only takes messages from its owner.";
+var PIPE_GRACE_MS = 1e3;
+var KILL_AFTER_MS = 2e3;
+var MACHINE_KINDS = /* @__PURE__ */ new Set(["read", "edit", "delete", "move", "search", "execute", "fetch"]);
+var BRIDGE = `
+const { request } = require('node:http');
+const url = new URL(process.env.TURN_TOOLS_URL);
+const headers = { 'content-type': 'application/json', accept: 'application/json, text/event-stream' };
+require('node:readline').createInterface({ input: process.stdin }).on('line', (line) => {
+  const post = request(url, { method: 'POST', headers }, (response) => {
+    let body = '';
+    response.setEncoding('utf8').on('data', (chunk) => { body += chunk; });
+    response.on('end', () => { if (body.trim()) process.stdout.write(body.trim() + '\\n'); });
+  });
+  post.on('error', () => undefined);
+  post.end(line);
+});`;
+function startAgent(command, args, cwd) {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("CANON_")));
+  const cli = installedCli(command);
+  return spawn2(cli.file, [...cli.args, ...args], { cwd, env, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32", windowsHide: true });
+}
+__name(startAgent, "startAgent");
+function signalAgent(child, signal) {
+  if (process.platform === "win32") {
+    stopCli(child);
+    return;
+  }
+  try {
+    if (child.pid) process.kill(-child.pid, signal);
+    else child.kill(signal);
+  } catch {
+  }
+}
+__name(signalAgent, "signalAgent");
+var refuseMethod = /* @__PURE__ */ __name((method) => Promise.reject(Object.assign(new Error(`Canon does not offer ${method}`), { code: METHOD_NOT_FOUND })), "refuseMethod");
+var restoreMethod = /* @__PURE__ */ __name((capabilities) => {
+  if (isRecord(capabilities.sessionCapabilities) && isRecord(capabilities.sessionCapabilities.resume)) return "session/resume";
+  return capabilities.loadSession === true ? "session/load" : void 0;
+}, "restoreMethod");
+async function initialize(link, agent) {
+  const result = await link.call("initialize", {
+    protocolVersion: PROTOCOL,
+    clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
+    clientInfo: { name: "canon-agent", title: "Canon", version: "1" }
+  });
+  if (result.protocolVersion !== PROTOCOL) {
+    throw new Error(`${agent} speaks Agent Client Protocol version ${String(result.protocolVersion)}; the acp driver speaks version ${PROTOCOL}`);
+  }
+  return { capabilities: isRecord(result.agentCapabilities) ? result.agentCapabilities : {}, info: isRecord(result.agentInfo) ? result.agentInfo : {} };
+}
+__name(initialize, "initialize");
+async function checkAcp({ command, args = [], cwd, timeoutMs = 3e4 }) {
+  const child = startAgent(command, args, realpathSync(cwd));
+  const link = stdioRpc(child, { notify: /* @__PURE__ */ __name(() => void 0, "notify"), request: /* @__PURE__ */ __name((method) => refuseMethod(method), "request") }, { name: basename(command), envelope: { jsonrpc: "2.0" } });
+  let timer;
+  try {
+    return await new Promise((resolve3, reject) => {
+      timer = setTimeout(() => reject(new Error(`${command} did not answer the Agent Client Protocol's initialize within ${timeoutMs / 1e3} s`)), timeoutMs);
+      child.once("error", (error) => reject(new Error(`Could not run ${command}: ${error.message}`)));
+      child.once("close", () => reject(new Error(`${command} exited before answering the Agent Client Protocol's initialize`)));
+      initialize(link, command).then(({ capabilities, info }) => resolve3({
+        name: text(info.title) || text(info.name) || basename(command),
+        version: text(info.version),
+        sessionMemory: restoreMethod(capabilities) ? "native" : "none"
+      }), reject);
+    });
+  } finally {
+    clearTimeout(timer);
+    child.stdin?.end();
+    signalAgent(child, "SIGTERM");
+    setTimeout(() => signalAgent(child, "SIGKILL"), KILL_AFTER_MS).unref();
+  }
+}
+__name(checkAcp, "checkAcp");
+var present = /* @__PURE__ */ __name((fields) => Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== null && value !== void 0)), "present");
+var toolIdentity = /* @__PURE__ */ __name((call) => text(call.name) || text(call.title), "toolIdentity");
+function canonTool(call, turn, server, guest) {
+  if (!["", "other"].includes(text(call.kind)) || guest && !text(call.name)) return false;
+  const name = toolIdentity(call).replace(/\W+/g, "_").replace(/^mcp_+/, "");
+  return turn.tools.definitions.some((tool) => name === `${server}_${tool.name}` || name === `${server}__${tool.name}`);
+}
+__name(canonTool, "canonTool");
+function acpDriver(options) {
+  const { command, args = [] } = options;
+  if (options.guestMode !== void 0 && (options.unguardedGuests || !options.guestMode.trim())) {
+    throw new Error("guestMode must name a mode, and cannot go with unguardedGuests");
+  }
+  const cwd = realpathSync(options.cwd);
+  const agent = basename(command);
+  const interruptGraceMs = options.interruptGraceMs ?? 5e3;
+  const framing = withInstructions(SYSTEM, options.instructions);
+  const running = /* @__PURE__ */ new Map();
+  const end = /* @__PURE__ */ __name(async (session) => {
+    const live = running.get(session);
+    if (!live) return;
+    live.close();
+    await live.exited;
+  }, "end");
+  return {
+    name: "acp",
+    capabilities: {
+      sessionMemory: options.sessionMemory ?? "none",
+      ask: ["approve", "choose", "text"],
+      streaming: true,
+      activity: true,
+      tools: true,
+      outboundFiles: { roots: [cwd, realpathSync(tmpdir())] },
+      ownerHistoryOnly: options.guestMode === void 0 && !options.unguardedGuests
+    },
+    async runTurn(turn) {
+      await running.get(turn.session)?.exited;
+      if (turn.signal.aborted) throw turn.signal.reason;
+      const guest = guestTurn(turn);
+      if (guest && options.guestMode === void 0 && !options.unguardedGuests) return { reply: OWNER_ONLY };
+      const child = startAgent(command, args, cwd);
+      let exit = /* @__PURE__ */ __name(() => void 0, "exit");
+      const exited = new Promise((resolve3) => {
+        exit = resolve3;
+      });
+      let killing;
+      let stopping = false;
+      const entry = { close: /* @__PURE__ */ __name(() => {
+        stopping = true;
+        signalAgent(child, "SIGTERM");
+        killing ??= setTimeout(() => signalAgent(child, "SIGKILL"), KILL_AFTER_MS);
+      }, "close"), exited };
+      running.set(turn.session, entry);
+      const server = `${CANON}_${randomBytes(4).toString("hex")}`;
+      return new Promise((resolve3, reject) => {
+        const messages = [];
+        const calls = /* @__PURE__ */ new Map();
+        let sessionId = "";
+        let answering = false;
+        let continues = false;
+        let closed = false;
+        let ended = Promise.resolve();
+        let closing;
+        const visible = /* @__PURE__ */ __name(() => messages.map((message2) => message2.text).filter((part) => part.trim()).join("\n\n"), "visible");
+        const closeLater = /* @__PURE__ */ __name(() => {
+          if (!closed) closing ??= setTimeout(entry.close, interruptGraceMs);
+        }, "closeLater");
+        const finish = /* @__PURE__ */ __name(() => {
+          if (!closed) child.stdin?.end();
+          closeLater();
+        }, "finish");
+        const interrupt = /* @__PURE__ */ __name(() => {
+          if (sessionId && answering) link.notify("session/cancel", { sessionId });
+          closeLater();
+        }, "interrupt");
+        const settle = /* @__PURE__ */ __name((outcome) => {
+          answering = false;
+          finish();
+          if (turn.signal.aborted) reject(turn.signal.reason);
+          else if (outcome instanceof Error) reject(outcome);
+          else resolve3(outcome);
+        }, "settle");
+        const stopGuest = /* @__PURE__ */ __name((what) => {
+          link.notify("session/cancel", { sessionId });
+          entry.close();
+          settle(new DriverSessionError(`${agent} ${what} in a turn holding someone other than the owner's message`));
+        }, "stopGuest");
+        const guard = /* @__PURE__ */ __name((call) => {
+          if (guest && MACHINE_KINDS.has(text(call.kind)) && ["in_progress", "completed"].includes(text(call.status))) stopGuest(`ran a ${text(call.kind)} tool`);
+        }, "guard");
+        const known = /* @__PURE__ */ __name((update2, session) => {
+          const key = JSON.stringify([text(session), text(update2.toolCallId)]);
+          const call = { ...calls.get(key), ...present(update2) };
+          calls.set(key, call);
+          return call;
+        }, "known");
+        const update = /* @__PURE__ */ __name((params) => {
+          const change = isRecord(params.update) ? params.update : {};
+          if (!answering) return;
+          const tool = change.sessionUpdate === "tool_call" || change.sessionUpdate === "tool_call_update";
+          const call = tool ? known(change, params.sessionId) : void 0;
+          if (call) guard(call);
+          if (guest && options.guestMode !== void 0 && change.sessionUpdate === "current_mode_update" && change.currentModeId !== options.guestMode) stopGuest("left its guest mode");
+          if (text(params.sessionId) !== sessionId) return;
+          if (change.sessionUpdate === "agent_message_chunk") {
+            const chunk = isRecord(change.content) && change.content.type === "text" ? text(change.content.text) : "";
+            if (!chunk) return;
+            const id = text(change.messageId);
+            const message2 = id ? messages.find((known2) => known2.id === id) : continues ? messages.at(-1) : void 0;
+            if (message2) message2.text += chunk;
+            else messages.push({ id, text: chunk });
+            continues = true;
+            turn.onText(visible());
+          } else if (call) {
+            if (change.sessionUpdate === "tool_call") continues = false;
+            turn.onActivity({
+              id: text(call.toolCallId),
+              kind: "tool",
+              title: oneLine(text(call.title) || "Use a tool", 120),
+              state: call.status === "completed" ? "done" : call.status === "failed" ? "failed" : "running"
+            });
+          }
+        }, "update");
+        const permission = /* @__PURE__ */ __name(async (params) => {
+          const offered = (Array.isArray(params.options) ? params.options : []).filter(isRecord);
+          const pick = /* @__PURE__ */ __name((kind) => offered.find((option) => option.kind === kind), "pick");
+          const select = /* @__PURE__ */ __name((option) => ({ outcome: option ? { outcome: "selected", optionId: text(option.optionId) } : { outcome: "cancelled" } }), "select");
+          if (turn.signal.aborted) return select(void 0);
+          const allow = pick("allow_once");
+          const refuse = select(pick("reject_once") ?? pick("reject_always"));
+          const call = known(isRecord(params.toolCall) ? params.toolCall : {}, params.sessionId);
+          if (allow && canonTool(call, turn, server, guest)) return select(allow);
+          if (guest || !allow) return refuse;
+          const input = call.rawInput === void 0 || ["{}", "[]", '""', "null"].includes(JSON.stringify(call.rawInput)) ? "" : JSON.stringify(call.rawInput);
+          const title = oneLine(text(call.title) || "Use a tool", 200);
+          const paths = (Array.isArray(call.locations) ? call.locations : []).filter(isRecord).map((location) => text(location.path));
+          const edits = (Array.isArray(call.content) ? call.content : []).filter(isRecord).filter((item) => item.type === "diff").map((item) => `${text(item.path)}
+${text(item.newText)}`);
+          const id = `${text(params.sessionId) === sessionId ? "" : `${text(params.sessionId)}:`}${text(call.toolCallId) || "tool"}`;
+          const verdict = await approve(turn, {
+            id,
+            title,
+            detail: [input, ...paths, ...edits].filter(Boolean).join("\n"),
+            scopeKey: callScope(text(call.kind) || "tool", [toolIdentity(call) || title, input, call.locations ?? null]),
+            allowSession: input !== "" && text(call.name) !== "",
+            // JSON punctuation goes first, so a command given as an argument list reads as one.
+            ...call.kind === "delete" || RISKY.test(input.replace(/[",[\]{}]+/g, " ")) ? { risk: "destructive" } : {}
+          });
+          if (verdict === "stopped" || turn.signal.aborted) return select(void 0);
+          return verdict === "denied" ? refuse : select(allow);
+        }, "permission");
+        const link = stdioRpc(child, {
+          notify: /* @__PURE__ */ __name((method, params) => {
+            if (method === "session/update") update(params);
+          }, "notify"),
+          request: /* @__PURE__ */ __name((method, params) => method === "session/request_permission" ? permission(params) : refuseMethod(method), "request")
+        }, { name: agent, envelope: { jsonrpc: "2.0" } });
+        const gone = /* @__PURE__ */ __name((error) => {
+          if (closed) return;
+          closed = true;
+          clearTimeout(closing);
+          clearTimeout(killing);
+          turn.signal.removeEventListener("abort", interrupt);
+          link.fail(error);
+          settle(error);
+          void ended.then(() => {
+            if (running.get(turn.session) === entry) running.delete(turn.session);
+            exit();
+          });
+        }, "gone");
+        child.once("exit", () => {
+          if (stopping || guest || turn.signal.aborted) {
+            signalAgent(child, "SIGTERM");
+            ended = new Promise((resolve4) => {
+              setTimeout(() => {
+                signalAgent(child, "SIGKILL");
+                resolve4();
+              }, KILL_AFTER_MS);
+            });
+          }
+          setTimeout(() => {
+            child.stdout?.destroy();
+            child.stderr?.destroy();
+          }, PIPE_GRACE_MS).unref();
+        });
+        child.once("error", (error) => gone(new Error(`Could not run ${command}: ${error.message}`)));
+        child.once("close", () => gone(new Error(`${agent} exited before finishing the turn`)));
+        turn.signal.addEventListener("abort", interrupt, { once: true });
+        const signInError = /* @__PURE__ */ __name((error) => error.code === AUTH_REQUIRED && !turn.signal.aborted ? new Error(`${agent} needs signing in: run it once yourself, then start this agent again`) : void 0, "signInError");
+        async function openSession(capabilities) {
+          const mcp = isRecord(capabilities.mcpCapabilities) ? capabilities.mcpCapabilities : {};
+          const { url } = turn.tools;
+          const mcpServers = !url ? [] : mcp.http === true ? [{ type: "http", name: server, url, headers: [] }] : [{ name: server, command: process.execPath, args: ["-e", BRIDGE], env: [{ name: "TURN_TOOLS_URL", value: url }] }];
+          const restore = options.sessionMemory === "native" ? restoreMethod(capabilities) : void 0;
+          const saved = restore && turn.state.get(SESSION);
+          if (saved) {
+            const restored = await link.call(restore, { sessionId: saved, cwd, mcpServers }).catch((error) => {
+              throw signInError(error) ?? (turn.signal.aborted ? error : new DriverSessionError(`${agent} could not restore session ${saved}`, { cause: error }));
+            });
+            return { id: saved, fresh: false, keep: false, modes: restored.modes };
+          }
+          const opened = await link.call("session/new", { cwd, mcpServers }).catch((error) => {
+            throw signInError(error) ?? error;
+          });
+          if (!text(opened.sessionId)) throw new Error(`${agent} opened no session`);
+          return { id: text(opened.sessionId), fresh: true, keep: Boolean(restore), modes: opened.modes };
+        }
+        __name(openSession, "openSession");
+        async function applyMode(modes) {
+          if (!options.guestMode) return;
+          const current = isRecord(modes) ? text(modes.currentModeId) : "";
+          if (!turn.state.get(OWNER_MODE) && current) turn.state.set(OWNER_MODE, current);
+          const wanted = guest ? options.guestMode : turn.state.get(OWNER_MODE) ?? current;
+          if (wanted && wanted !== current) {
+            await link.call("session/set_mode", { sessionId, modeId: wanted }).catch((error) => {
+              throw new Error(`${agent} could not enter mode "${wanted}": ${oneLine(error.message, 200)}`);
+            });
+          }
+        }
+        __name(applyMode, "applyMode");
+        void (async () => {
+          const { capabilities } = await initialize(link, agent);
+          const session = await openSession(capabilities);
+          sessionId = session.id;
+          await applyMode(session.modes);
+          if (turn.signal.aborted) return finish();
+          if (session.keep) turn.state.set(SESSION, sessionId);
+          answering = true;
+          const { stopReason } = await link.call("session/prompt", { sessionId, prompt: [
+            { type: "text", text: [...session.fresh ? [framing] : [], ...guest ? [GUEST] : [], turn.prompt].join("\n\n") },
+            ...turn.files.map((file) => ({ type: "resource_link", name: basename(file), uri: pathToFileURL(file).href }))
+          ] });
+          if (stopReason === "end_turn") return settle({ reply: messages.filter((message2) => message2.text.trim()).at(-1)?.text ?? null });
+          settle(new Error(`${agent} ended the turn: ${String(stopReason)}`));
+        })().catch((error) => settle(error instanceof DriverSessionError ? error : new Error(oneLine(error instanceof Error ? error.message : String(error), 300))));
+      });
+    },
+    // New session (and the runner's reset after a stuck turn): the room's process goes; the runner drops the state.
+    reset: end,
+    async close() {
+      await Promise.all([...running.keys()].map(end));
+    }
+  };
+}
+__name(acpDriver, "acpDriver");
+
 // src/drivers/claude.ts
+import { randomUUID } from "node:crypto";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { basename as basename2, dirname as dirname3 } from "node:path";
 var SDK = "@anthropic-ai/claude-agent-sdk";
-var SESSION = "sessionId";
+var SESSION2 = "sessionId";
 var ASK_USER_DIALOG = "permission_ask_user_question";
 var CANON_TOOLS = "mcp__canon__";
 var NOT_OWNER = "Only the agent's owner can let it use tools in this conversation.";
 var OPEN_TOOLS = /* @__PURE__ */ new Set(["AskUserQuestion", "ToolSearch"]);
-var SYSTEM = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. The text of your last message in a turn is posted there as your reply, so put your whole answer in it. Tool approvals and your questions (AskUserQuestion) are put to the people in the conversation. When you have nothing to add, call the no_reply tool instead of answering.";
-var isRecord = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
+var SYSTEM2 = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. The text of your last message in a turn is posted there as your reply, so put your whole answer in it. Tool approvals and your questions (AskUserQuestion) are put to the people in the conversation. When you have nothing to add, call the no_reply tool instead of answering.";
+var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
 var forOwner = /* @__PURE__ */ __name((message2) => message2.isOwner || message2.trustedAgent === true, "forOwner");
-var oneLine = /* @__PURE__ */ __name((text3, max) => {
+var oneLine2 = /* @__PURE__ */ __name((text3, max) => {
   const line = text3.replace(/\s+/g, " ").trim();
   return line.length > max ? `${line.slice(0, max - 1)}\u2026` : line;
 }, "oneLine");
@@ -165,10 +631,10 @@ async function loadClaudeQuery() {
 __name(loadClaudeQuery, "loadClaudeQuery");
 function describeTool(name, input) {
   const label = name.startsWith("mcp__") ? name.split("__").slice(2).join("__") || name : name;
-  const fields = isRecord(input) ? input : {};
+  const fields = isRecord2(input) ? input : {};
   const key = ["description", "command", "file_path", "notebook_path", "pattern", "url", "query", "path"].find((candidate) => typeof fields[candidate] === "string" && fields[candidate].trim() !== "");
-  const detail = key && (key.endsWith("path") ? basename(fields[key]) : fields[key]);
-  return oneLine(detail ? `${label}: ${detail}` : label, 120);
+  const detail = key && (key.endsWith("path") ? basename2(fields[key]) : fields[key]);
+  return oneLine2(detail ? `${label}: ${detail}` : label, 120);
 }
 __name(describeTool, "describeTool");
 function liveReader(turn) {
@@ -194,14 +660,14 @@ function liveReader(turn) {
         else if (event.type === "content_block_delta" && event.delta?.type === "text_delta") append(event.index ?? 0, String(event.delta.text ?? ""));
       } else if (message2.type === "assistant") {
         for (const block of message2.message.content) {
-          if (!isRecord(block) || block.type !== "tool_use" || typeof block.id !== "string") continue;
+          if (!isRecord2(block) || block.type !== "tool_use" || typeof block.id !== "string") continue;
           const title = describeTool(String(block.name), block.input);
           tools.set(block.id, title);
           turn.onActivity({ id: block.id, kind: "tool", title, state: "running" });
         }
       } else if (message2.type === "user" && Array.isArray(message2.message.content)) {
         for (const block of message2.message.content) {
-          if (!isRecord(block) || block.type !== "tool_result" || !tools.has(String(block.tool_use_id))) continue;
+          if (!isRecord2(block) || block.type !== "tool_result" || !tools.has(String(block.tool_use_id))) continue;
           const id = String(block.tool_use_id);
           turn.onActivity({ id, kind: "tool", title: tools.get(id), state: block.is_error === true ? "failed" : "done" });
         }
@@ -219,12 +685,12 @@ function toolScope(toolName, input) {
   return callScope(toolName, toolName.startsWith("mcp__") ? input : Object.fromEntries(Object.entries(input).filter(([key]) => key !== "description")));
 }
 __name(toolScope, "toolScope");
-async function approve(turn, toolName, input, prompt) {
+async function approve2(turn, toolName, input, prompt) {
   const detail = typeof input.command === "string" ? input.command : JSON.stringify(input);
   const answer = await turn.ask({
     kind: "approve",
     id: prompt.toolUseID,
-    title: oneLine(prompt.title || describeTool(toolName, input), 200),
+    title: oneLine2(prompt.title || describeTool(toolName, input), 200),
     scopeKey: toolScope(toolName, input),
     allowSession: prompt.suppressAlwaysAllowRule !== true,
     ...detail && detail !== "{}" ? { detail } : {},
@@ -234,14 +700,14 @@ async function approve(turn, toolName, input, prompt) {
   if (answer.status !== "answered") return { behavior: "deny", message: DECLINED[answer.status] };
   return answer.allow ? { behavior: "allow", updatedInput: input, decisionClassification: answer.scope === "session" ? "user_permanent" : "user_temporary" } : { behavior: "deny", message: "This was not allowed.", decisionClassification: "user_reject" };
 }
-__name(approve, "approve");
+__name(approve2, "approve");
 async function answerQuestions(turn, id, questions, input) {
-  const list = (Array.isArray(questions) ? questions : []).filter(isRecord).slice(0, 4);
+  const list = (Array.isArray(questions) ? questions : []).filter(isRecord2).slice(0, 4);
   if (!list.length) return { behavior: "deny", message: "There was no question to ask." };
   const answers = {};
   for (const [index, question] of list.entries()) {
     const text3 = typeof question.question === "string" ? question.question : "";
-    const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord).map((option) => option.label).filter((label) => typeof label === "string" && label.trim() !== ""))];
+    const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord2).map((option) => option.label).filter((label) => typeof label === "string" && label.trim() !== ""))];
     const askId = list.length > 1 ? `${id}#${index + 1}` : id;
     const request = labels.length ? { kind: "choose", id: askId, question: text3, options: labels.map((label) => ({ id: label, label })), ...question.multiSelect === true ? { multiple: true } : {} } : { kind: "text", id: askId, question: text3, ...question.isSecret === true ? { secret: true } : {} };
     const answer = await turn.ask(request).catch(() => void 0);
@@ -253,10 +719,10 @@ async function answerQuestions(turn, id, questions, input) {
 }
 __name(answerQuestions, "answerQuestions");
 function claudeDriver(options) {
-  const cwd = realpathSync(options.cwd);
+  const cwd = realpathSync2(options.cwd);
   const permissionMode = options.permissionMode ?? "default";
   const interruptGraceMs = options.interruptGraceMs ?? 5e3;
-  const system = withInstructions(SYSTEM, options.instructions);
+  const system = withInstructions(SYSTEM2, options.instructions);
   let loaded;
   const running = /* @__PURE__ */ new Map();
   const end = /* @__PURE__ */ __name(async (session) => {
@@ -274,11 +740,11 @@ function claudeDriver(options) {
     const canUseTool = /* @__PURE__ */ __name(async (toolName, input, prompt) => {
       if (toolName.startsWith(CANON_TOOLS)) return { behavior: "allow", updatedInput: input };
       if (toolName === "AskUserQuestion") return answerQuestions(turn, prompt.toolUseID, input.questions, input);
-      return approve(turn, toolName, input, prompt);
+      return approve2(turn, toolName, input, prompt);
     }, "canUseTool");
     const onUserDialog = /* @__PURE__ */ __name(async (request, { signal }) => {
       if (request.dialogKind !== ASK_USER_DIALOG) return { behavior: "cancelled" };
-      const input = isRecord(request.payload.input) ? request.payload.input : { questions: request.payload.questions };
+      const input = isRecord2(request.payload.input) ? request.payload.input : { questions: request.payload.questions };
       const id = request.toolUseID || typeof request.payload.requestId === "string" && request.payload.requestId || randomUUID();
       const result = await answerQuestions(turn, id, input.questions, input);
       return signal.aborted ? { behavior: "cancelled" } : { behavior: "completed", result };
@@ -296,7 +762,7 @@ function claudeDriver(options) {
       ...resume ? { resume } : {},
       includePartialMessages: true,
       ...turn.tools.url ? { mcpServers: { canon: { type: "http", url: turn.tools.url, alwaysLoad: true } }, allowedTools: ["mcp__canon"] } : {},
-      additionalDirectories: [...new Set(turn.files.map((file) => dirname2(file)))],
+      additionalDirectories: [...new Set(turn.files.map((file) => dirname3(file)))],
       canUseTool,
       onUserDialog,
       supportedDialogKinds: [ASK_USER_DIALOG],
@@ -316,13 +782,13 @@ function claudeDriver(options) {
       streaming: true,
       activity: true,
       tools: true,
-      outboundFiles: { roots: [cwd, realpathSync(tmpdir())] }
+      outboundFiles: { roots: [cwd, realpathSync2(tmpdir2())] }
     },
     async runTurn(turn) {
       await running.get(turn.session)?.exited;
       if (turn.signal.aborted) throw turn.signal.reason;
       const query = await (options.query ? Promise.resolve(options.query) : loaded ??= loadClaudeQuery());
-      const resume = turn.state.get(SESSION);
+      const resume = turn.state.get(SESSION2);
       const native = query({ prompt: turn.prompt, options: queryOptions(turn, resume) });
       let exit = /* @__PURE__ */ __name(() => void 0, "exit");
       const entry = { close: /* @__PURE__ */ __name(() => native.close(), "close"), exited: new Promise((resolve3) => {
@@ -349,7 +815,7 @@ function claudeDriver(options) {
             const message2 = raw;
             if (message2.type === "system" && message2.subtype === "init") started = true;
             const id = message2.session_id;
-            if (typeof id === "string" && id && id !== session) turn.state.set(SESSION, session = id);
+            if (typeof id === "string" && id && id !== session) turn.state.set(SESSION2, session = id);
             reader.read(message2);
             if (message2.type !== "result") continue;
             finished = true;
@@ -359,7 +825,7 @@ function claudeDriver(options) {
               resolve3({ reply: reply.trim() ? reply : null });
             } else {
               const detail = message2.subtype === "success" ? message2.result : message2.errors.join("; ");
-              reject(failed(new Error(`Claude Code ended the turn with ${message2.subtype}${detail ? `: ${oneLine(detail, 300)}` : ""}`)));
+              reject(failed(new Error(`Claude Code ended the turn with ${message2.subtype}${detail ? `: ${oneLine2(detail, 300)}` : ""}`)));
             }
           }
           if (!finished) throw new Error("Claude Code exited without finishing the turn");
@@ -384,8 +850,8 @@ function claudeDriver(options) {
 __name(claudeDriver, "claudeDriver");
 
 // src/drivers/code.ts
-import { realpathSync as realpathSync2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
+import { realpathSync as realpathSync3 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
 function codeDriver(handler, capabilities = {}) {
   return {
     name: "code",
@@ -395,7 +861,7 @@ function codeDriver(handler, capabilities = {}) {
       streaming: true,
       activity: true,
       tools: true,
-      outboundFiles: { roots: [realpathSync2(tmpdir2())] },
+      outboundFiles: { roots: [realpathSync3(tmpdir3())] },
       ...capabilities
     },
     async runTurn(turn) {
@@ -420,16 +886,14 @@ function codeDriver(handler, capabilities = {}) {
 __name(codeDriver, "codeDriver");
 
 // src/drivers/codex.ts
-import { spawn, spawnSync } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
-import { realpathSync as realpathSync3 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename2 } from "node:path";
-import { createInterface } from "node:readline";
+import { spawn as spawn3, spawnSync } from "node:child_process";
+import { realpathSync as realpathSync4 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { basename as basename3 } from "node:path";
 var THREAD = "threadId";
-var CANON = "canon";
+var CANON2 = "canon";
 var API_KEY_PROVIDER = "canon_openai_api_key";
-var SYSTEM2 = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. Your final message in a turn is posted there as your reply, so put your whole answer in it. Approval requests are put to the people in the conversation. To ask them a question, call the ask_question tool of the canon MCP server and wait for its answer. When you have nothing to add, call the no_reply tool of the canon MCP server instead of answering.";
+var SYSTEM3 = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. Your final message in a turn is posted there as your reply, so put your whole answer in it. Approval requests are put to the people in the conversation. To ask them a question, call the ask_question tool of the canon MCP server and wait for its answer. When you have nothing to add, call the no_reply tool of the canon MCP server instead of answering.";
 var CANON_TOOL_TIMEOUT_SEC = 2 * 60 * 60;
 var MACHINE_FEATURES = [
   "shell_tool",
@@ -466,18 +930,11 @@ var GUEST_ITEMS = /* @__PURE__ */ new Set([
   "sleep"
 ]);
 var OWN_LISTINGS = /* @__PURE__ */ new Set(["list_mcp_resources", "list_mcp_resource_templates"]);
-var GUEST = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: you cannot read files, run commands or use any tool but the canon MCP server's. Answer from the conversation and what you already know, and say so when something needs your owner.";
-var RISKY = /\brm\s+-[a-z]*[rf]|\bgit\s+(reset\s+--hard|push\s+(-f|--force))|\bdrop\s+(table|database)\b|\bmkfs\b|\bdd\s+if=/i;
+var GUEST2 = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: you cannot read files, run commands or use any tool but the canon MCP server's. Answer from the conversation and what you already know, and say so when something needs your owner.";
 var IMAGE = /\.(png|jpe?g|gif|webp)$/i;
-var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
-var guestTurn = /* @__PURE__ */ __name((turn) => !turn.input.messages.every((message2) => message2.isOwner || message2.trustedAgent === true), "guestTurn");
-var text = /* @__PURE__ */ __name((value) => typeof value === "string" ? value : "", "text");
-var oneLine2 = /* @__PURE__ */ __name((value, max) => {
-  const line = value.replace(/\s+/g, " ").trim();
-  return line.length > max ? `${line.slice(0, max - 1)}\u2026` : line;
-}, "oneLine");
 function checkCodex(codexPath = "codex") {
-  const result = spawnSync(codexPath, ["--version"], { encoding: "utf8" });
+  const cli = installedCli(codexPath);
+  const result = spawnSync(cli.file, [...cli.args, "--version"], { encoding: "utf8", windowsHide: true });
   if (result.status !== 0) {
     throw new Error(`The codex driver needs the Codex CLI (npm install -g @openai/codex) or --codex-path: ${result.error?.message ?? text(result.stderr).trim()}`);
   }
@@ -485,20 +942,20 @@ function checkCodex(codexPath = "codex") {
 }
 __name(checkCodex, "checkCodex");
 function describe(item) {
-  const paths = (Array.isArray(item.changes) ? item.changes : []).filter(isRecord2).map((change) => basename2(text(change.path)));
+  const paths = (Array.isArray(item.changes) ? item.changes : []).filter(isRecord).map((change) => basename3(text(change.path)));
   switch (item.type) {
     case "commandExecution": {
-      const actions = (Array.isArray(item.commandActions) ? item.commandActions : []).filter(isRecord2).map((action) => text(action.command));
-      return oneLine2(actions.filter(Boolean).join(" && ") || text(item.command) || "Run a command", 120);
+      const actions = (Array.isArray(item.commandActions) ? item.commandActions : []).filter(isRecord).map((action) => text(action.command));
+      return oneLine(actions.filter(Boolean).join(" && ") || text(item.command) || "Run a command", 120);
     }
     case "fileChange":
-      return oneLine2(paths.length ? `Edit ${paths.join(", ")}` : "Edit files", 120);
+      return oneLine(paths.length ? `Edit ${paths.join(", ")}` : "Edit files", 120);
     case "mcpToolCall":
       return `${text(item.server)}: ${text(item.tool)}`;
     case "webSearch":
-      return oneLine2(`Search the web${text(item.query) ? `: ${text(item.query)}` : ""}`, 120);
+      return oneLine(`Search the web${text(item.query) ? `: ${text(item.query)}` : ""}`, 120);
     case "imageView":
-      return `View ${basename2(text(item.path))}`;
+      return `View ${basename3(text(item.path))}`;
     case "dynamicToolCall":
       return text(item.tool) || "Tool";
     default:
@@ -506,27 +963,19 @@ function describe(item) {
   }
 }
 __name(describe, "describe");
-async function approve2(turn, request) {
-  const asked = createHash2("sha256").update(JSON.stringify([request.scopeKey, request.title, request.detail])).digest("hex").slice(0, 12);
-  const answer = await turn.ask({ kind: "approve", ...request, id: `${request.id}#${asked}` }).catch(() => void 0);
-  if (!answer) return "stopped";
-  if (answer.status !== "answered" || !answer.allow) return "denied";
-  return answer.scope === "session" ? "session" : "once";
-}
-__name(approve2, "approve");
 var DECISION = { session: "acceptForSession", once: "accept", denied: "decline", stopped: "cancel" };
 async function answerCodexRequest(turn, method, params, items, rpcId) {
   const id = text(params.approvalId) || text(params.itemId) || text(params.elicitationId) || `request-${String(rpcId)}`;
   if (method === "item/commandExecution/requestApproval") {
     const command = text(params.command);
     const stdin = params.kind === "writeStdin";
-    const network = isRecord2(params.networkApprovalContext) ? params.networkApprovalContext : void 0;
-    const parsed = (Array.isArray(params.commandActions) ? params.commandActions : []).filter(isRecord2).map((action) => text(action.command)).filter(Boolean);
+    const network = isRecord(params.networkApprovalContext) ? params.networkApprovalContext : void 0;
+    const parsed = (Array.isArray(params.commandActions) ? params.commandActions : []).filter(isRecord).map((action) => text(action.command)).filter(Boolean);
     const destination = network && `${text(network.host)}${text(network.protocol) ? ` (${text(network.protocol)})` : ""}`;
     const scope = callScope("exec", [command, text(params.cwd), network ?? null, params.additionalPermissions ?? null]);
-    const verdict = await approve2(turn, {
+    const verdict = await approve(turn, {
       id,
-      title: oneLine2(text(params.reason) || (command ? `${stdin ? "Send input to" : "Run"}: ${parsed.join(" && ") || command}` : `Allow network access to ${destination || "the network"}`), 200),
+      title: oneLine(text(params.reason) || (command ? `${stdin ? "Send input to" : "Run"}: ${parsed.join(" && ") || command}` : `Allow network access to ${destination || "the network"}`), 200),
       detail: [
         command,
         text(params.cwd) && `in ${text(params.cwd)}`,
@@ -541,24 +990,24 @@ async function answerCodexRequest(turn, method, params, items, rpcId) {
     return { decision: DECISION[verdict] };
   }
   if (method === "item/fileChange/requestApproval") {
-    const changes = (Array.isArray(items.get(text(params.itemId))?.changes) ? items.get(text(params.itemId)).changes : []).filter(isRecord2);
+    const changes = (Array.isArray(items.get(text(params.itemId))?.changes) ? items.get(text(params.itemId)).changes : []).filter(isRecord);
     const paths = [...new Set(changes.map((change) => text(change.path)))].sort();
-    const verdict = await approve2(turn, {
+    const verdict = await approve(turn, {
       id,
-      title: oneLine2(text(params.reason) || (paths.length ? `Edit ${paths.map((path) => basename2(path)).join(", ")}` : "Edit files"), 200),
+      title: oneLine(text(params.reason) || (paths.length ? `Edit ${paths.map((path) => basename3(path)).join(", ")}` : "Edit files"), 200),
       detail: [...changes.map((change) => `${text(change.path)}
 ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text(params.grantRoot)}`].filter(Boolean).join("\n\n"),
       scopeKey: callScope("apply_patch", paths),
       allowSession: paths.length > 0 && !params.grantRoot,
-      ...changes.some((change) => isRecord2(change.kind) && change.kind.type === "delete") ? { risk: "destructive" } : {}
+      ...changes.some((change) => isRecord(change.kind) && change.kind.type === "delete") ? { risk: "destructive" } : {}
     });
     return { decision: DECISION[verdict] };
   }
   if (method === "item/permissions/requestApproval") {
-    const permissions = isRecord2(params.permissions) ? params.permissions : {};
-    const verdict = await approve2(turn, {
+    const permissions = isRecord(params.permissions) ? params.permissions : {};
+    const verdict = await approve(turn, {
       id,
-      title: oneLine2(text(params.reason) || "Allow Codex more access", 200),
+      title: oneLine(text(params.reason) || "Allow Codex more access", 200),
       detail: JSON.stringify(permissions),
       scopeKey: callScope("permissions", permissions),
       allowSession: true
@@ -566,16 +1015,16 @@ ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text
     return verdict === "session" || verdict === "once" ? { permissions, scope: verdict === "session" ? "session" : "turn" } : { permissions: {}, scope: "turn" };
   }
   if (method === "mcpServer/elicitation/request") {
-    const meta = isRecord2(params._meta) ? params._meta : {};
+    const meta = isRecord(params._meta) ? params._meta : {};
     if (meta.codex_approval_kind !== "mcp_tool_call") return { action: "decline", content: null, _meta: null };
     const server = text(params.serverName);
     const named = text(meta.call_id) || text(meta.callId);
     const running = [...items.values()].filter((item) => item.type === "mcpToolCall" && item.server === server && item.status === "inProgress");
     const call = named ? items.get(named) : running.length === 1 ? running[0] : void 0;
     const tool = call && call.server === server ? text(call.tool) : "";
-    const verdict = await approve2(turn, {
+    const verdict = await approve(turn, {
       id: `mcp-${String(rpcId)}`,
-      title: oneLine2(text(params.message) || `Use ${server}${tool ? `: ${tool}` : ""}`, 200),
+      title: oneLine(text(params.message) || `Use ${server}${tool ? `: ${tool}` : ""}`, 200),
       detail: JSON.stringify(meta.tool_params ?? call?.arguments ?? {}),
       scopeKey: `codex:mcp:${server}:${tool}`,
       allowSession: tool !== ""
@@ -587,10 +1036,10 @@ ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text
     };
   }
   if (method === "item/tool/requestUserInput") {
-    const questions = (Array.isArray(params.questions) ? params.questions : []).filter(isRecord2);
+    const questions = (Array.isArray(params.questions) ? params.questions : []).filter(isRecord);
     const answers = {};
     for (const [index, question] of questions.entries()) {
-      const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord2).map((option) => text(option.label)).filter(Boolean))];
+      const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord).map((option) => text(option.label)).filter(Boolean))];
       const askId = questions.length > 1 ? `${id}#${index + 1}` : id;
       const ask = labels.length ? { kind: "choose", id: askId, question: text(question.question), options: labels.map((label) => ({ id: label, label })) } : { kind: "text", id: askId, question: text(question.question), ...question.isSecret === true ? { secret: true } : {} };
       const answer = await turn.ask(ask).catch(() => void 0);
@@ -602,55 +1051,11 @@ ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text
   throw new Error(`The codex driver does not handle ${method}`);
 }
 __name(answerCodexRequest, "answerCodexRequest");
-function rpc(child, handlers) {
-  let next = 0;
-  const pending = /* @__PURE__ */ new Map();
-  const write = /* @__PURE__ */ __name((message2) => {
-    if (child.stdin?.writable) child.stdin.write(`${JSON.stringify(message2)}
-`);
-  }, "write");
-  child.stdin?.on("error", () => void 0);
-  createInterface({ input: child.stdout }).on("error", () => void 0).on("line", (line) => {
-    let message2;
-    try {
-      message2 = JSON.parse(line);
-    } catch {
-      return;
-    }
-    if (!isRecord2(message2)) return;
-    const params = isRecord2(message2.params) ? message2.params : {};
-    if (typeof message2.method !== "string") {
-      const waiting = pending.get(Number(message2.id));
-      pending.delete(Number(message2.id));
-      if (isRecord2(message2.error)) waiting?.reject(new Error(text(message2.error.message) || "Codex refused the request"));
-      else waiting?.resolve(message2.result);
-    } else if (message2.id !== void 0) {
-      handlers.request(message2.method, params, message2.id).then(
-        (result) => write({ id: message2.id, result }),
-        (error) => write({ id: message2.id, error: { code: -32e3, message: error instanceof Error ? error.message : String(error) } })
-      );
-    } else handlers.notify(message2.method, params);
-  });
-  child.stderr?.resume();
-  return {
-    call: /* @__PURE__ */ __name((method, params) => new Promise((resolve3, reject) => {
-      next += 1;
-      pending.set(next, { resolve: /* @__PURE__ */ __name((value) => resolve3(isRecord2(value) ? value : {}), "resolve"), reject });
-      write({ id: next, method, params });
-    }), "call"),
-    notify: /* @__PURE__ */ __name((method) => write({ method }), "notify"),
-    fail(error) {
-      for (const waiting of pending.values()) waiting.reject(error);
-      pending.clear();
-    }
-  };
-}
-__name(rpc, "rpc");
 function codexDriver(options) {
-  const cwd = realpathSync3(options.cwd);
+  const cwd = realpathSync4(options.cwd);
   const codexPath = options.codexPath ?? "codex";
   const interruptGraceMs = options.interruptGraceMs ?? 5e3;
-  const developerInstructions = withInstructions(SYSTEM2, options.instructions);
+  const developerInstructions = withInstructions(SYSTEM3, options.instructions);
   const running = /* @__PURE__ */ new Map();
   const end = /* @__PURE__ */ __name(async (session) => {
     const live = running.get(session);
@@ -661,8 +1066,8 @@ function codexDriver(options) {
   async function threadSettings(turn, call, env) {
     const guest = guestTurn(turn);
     const configured = (await call("config/read", { cwd })).config;
-    const settings = isRecord2(configured) ? configured : {};
-    const servers = guest && isRecord2(settings.mcp_servers) ? Object.keys(settings.mcp_servers).filter((name) => name !== CANON) : [];
+    const settings = isRecord(configured) ? configured : {};
+    const servers = guest && isRecord(settings.mcp_servers) ? Object.keys(settings.mcp_servers).filter((name) => name !== CANON2) : [];
     const apiKey = Boolean(env.OPENAI_API_KEY) && [void 0, null, "openai"].includes(settings.model_provider);
     return {
       cwd,
@@ -675,7 +1080,7 @@ function codexDriver(options) {
       config: {
         mcp_servers: {
           ...Object.fromEntries(servers.map((name) => [name, { enabled: false }])),
-          ...turn.tools.url ? { [CANON]: { url: turn.tools.url, default_tools_approval_mode: "approve", tool_timeout_sec: CANON_TOOL_TIMEOUT_SEC } } : {}
+          ...turn.tools.url ? { [CANON2]: { url: turn.tools.url, default_tools_approval_mode: "approve", tool_timeout_sec: CANON_TOOL_TIMEOUT_SEC } } : {}
         },
         // Questions go through Canon's ask_question alone: Codex's own request_user_input outside plan mode (a feature
         // still under development) stays off even when the owner's configuration turns it on, so Codex never has two.
@@ -699,20 +1104,21 @@ function codexDriver(options) {
       streaming: true,
       activity: true,
       tools: true,
-      outboundFiles: { roots: [cwd, realpathSync3(tmpdir3())] }
+      outboundFiles: { roots: [cwd, realpathSync4(tmpdir4())] }
     },
     async runTurn(turn) {
       await running.get(turn.session)?.exited;
       if (turn.signal.aborted) throw turn.signal.reason;
       const guest = guestTurn(turn);
       const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("CANON_")));
-      const child = spawn(codexPath, ["app-server", "--listen", "stdio://"], { cwd, env, stdio: ["pipe", "pipe", "pipe"] });
+      const cli = installedCli(codexPath);
+      const child = spawn3(cli.file, [...cli.args, "app-server", "--listen", "stdio://"], { cwd, env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
       let exit = /* @__PURE__ */ __name(() => void 0, "exit");
       const exited = new Promise((resolve3) => {
         exit = resolve3;
       });
       const entry = { close: /* @__PURE__ */ __name(() => {
-        child.kill("SIGTERM");
+        stopCli(child);
       }, "close"), exited };
       running.set(turn.session, entry);
       return new Promise((resolve3, reject) => {
@@ -749,19 +1155,19 @@ function codexDriver(options) {
           const all = [...messages.values()];
           const reply = (all.filter((message2) => message2.done && message2.final).at(-1) ?? all.filter((message2) => message2.done).at(-1) ?? all.at(-1))?.text ?? "";
           if (ended.status === "completed") return settle({ reply: reply.trim() ? reply : null });
-          const detail = isRecord2(ended.error) ? text(ended.error.message) : failure;
-          settle(new Error(`Codex ended the turn ${ended.status === "interrupted" ? "interrupted" : `with an error${detail ? `: ${oneLine2(detail, 300)}` : ""}`}`));
+          const detail = isRecord(ended.error) ? text(ended.error.message) : failure;
+          settle(new Error(`Codex ended the turn ${ended.status === "interrupted" ? "interrupted" : `with an error${detail ? `: ${oneLine(detail, 300)}` : ""}`}`));
         }, "conclude");
         const guard = /* @__PURE__ */ __name((item) => {
-          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && (item.server === CANON || item.server === "codex" && OWN_LISTINGS.has(text(item.tool)))) return;
+          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && (item.server === CANON2 || item.server === "codex" && OWN_LISTINGS.has(text(item.tool)))) return;
           interrupt();
           entry.close();
           const what = item.type === "mcpToolCall" ? `mcpToolCall (${describe(item)})` : text(item.type) || "an unknown item";
           settle(new DriverSessionError(`Codex started ${what} in a turn holding someone other than the owner's message`));
         }, "guard");
-        const link = rpc(child, {
+        const link = stdioRpc(child, {
           notify(method, params) {
-            const item = isRecord2(params.item) ? params.item : void 0;
+            const item = isRecord(params.item) ? params.item : void 0;
             if (item && method === "item/started") guard(item);
             if (item) items.set(text(item.id), item);
             if (!ours(params)) return;
@@ -777,15 +1183,15 @@ function codexDriver(options) {
               const title = describe(item);
               const state = method === "item/started" ? "running" : item.status === "failed" || item.status === "declined" ? "failed" : "done";
               if (title) turn.onActivity({ id: text(item.id), kind: "tool", title, state });
-            } else if (method === "error" && params.willRetry !== true && isRecord2(params.error)) {
+            } else if (method === "error" && params.willRetry !== true && isRecord(params.error)) {
               failure = text(params.error.message);
-            } else if (method === "turn/completed" && isRecord2(params.turn)) {
+            } else if (method === "turn/completed" && isRecord(params.turn)) {
               completed.set(text(params.turn.id), params.turn);
               conclude();
             }
           },
           request: /* @__PURE__ */ __name((method, params, id) => answerCodexRequest(turn, method, params, items, id), "request")
-        });
+        }, { name: "Codex" });
         const gone = /* @__PURE__ */ __name((error) => {
           if (closed) return;
           closed = true;
@@ -811,18 +1217,18 @@ function codexDriver(options) {
             threadId = resume;
           } else {
             const started2 = await link.call("thread/start", settings);
-            threadId = isRecord2(started2.thread) ? text(started2.thread.id) : "";
+            threadId = isRecord(started2.thread) ? text(started2.thread.id) : "";
             if (!threadId) throw new Error("Codex started no thread");
             turn.state.set(THREAD, threadId);
           }
           if (turn.signal.aborted) return finish();
           const started = await link.call("turn/start", { threadId, input: [
-            ...guest ? [{ type: "text", text: GUEST, text_elements: [] }] : [],
+            ...guest ? [{ type: "text", text: GUEST2, text_elements: [] }] : [],
             { type: "text", text: turn.prompt, text_elements: [] },
             // Images go to the model as images; every attachment's path is also in the prompt for Codex to read.
             ...turn.files.filter((file) => IMAGE.test(file)).map((path) => ({ type: "localImage", path }))
           ] });
-          nativeTurn = isRecord2(started.turn) ? text(started.turn.id) : "";
+          nativeTurn = isRecord(started.turn) ? text(started.turn.id) : "";
           if (!nativeTurn) throw new Error("Codex started no turn");
           if (turn.signal.aborted) interrupt();
           conclude();
@@ -1010,117 +1416,10 @@ function connectorDriver() {
 }
 __name(connectorDriver, "connectorDriver");
 
-// src/runner/home.ts
-import { randomBytes } from "node:crypto";
-import { closeSync, constants as constants2, fstatSync, fsyncSync, linkSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync, writeSync } from "node:fs";
-import { lstat, mkdir, realpath as realpath2 } from "node:fs/promises";
-import { dirname as dirname3 } from "node:path";
-var runnerLockName = /* @__PURE__ */ __name((environmentId, agentId) => `runner-${environmentId}-${agentId}`.replace(/[^\w.-]/g, "_"), "runnerLockName");
-function writeDurable(file, text3) {
-  const directory = dirname3(file);
-  const created = mkdirSync(directory, { recursive: true, mode: 448 });
-  const temporary = `${file}.${process.pid}.tmp`;
-  const fd = openSync(temporary, "w", 384);
-  try {
-    writeFileSync(fd, text3);
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  renameSync(temporary, file);
-  if (process.platform === "win32") return;
-  const last = created ? dirname3(created) : directory;
-  for (let path = directory; ; path = dirname3(path)) {
-    const dir = openSync(path, "r");
-    try {
-      fsyncSync(dir);
-    } finally {
-      closeSync(dir);
-    }
-    if (path === last) break;
-  }
-}
-__name(writeDurable, "writeDurable");
-function privateKey(file, bytes = 32) {
-  const refuse = /* @__PURE__ */ __name(() => {
-    throw new Error(`Refusing to start: ${file} must be a regular file of ${bytes} bytes, owned by this user and private to it (0600).`);
-  }, "refuse");
-  const read = /* @__PURE__ */ __name(() => {
-    let fd2;
-    try {
-      fd2 = openSync(file, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
-    } catch (error) {
-      return error.code === "ENOENT" ? void 0 : refuse();
-    }
-    try {
-      const info = fstatSync(fd2);
-      const uid = process.getuid?.();
-      if (!info.isFile() || info.size !== bytes || uid !== void 0 && (info.uid !== uid || (info.mode & 63) !== 0)) refuse();
-      const key = Buffer.alloc(bytes);
-      if (readSync(fd2, key, 0, bytes, 0) !== bytes) refuse();
-      return key;
-    } finally {
-      closeSync(fd2);
-    }
-  }, "read");
-  const existing = read();
-  if (existing) return existing;
-  const directory = dirname3(file);
-  mkdirSync(directory, { recursive: true, mode: 448 });
-  const temporary = `${file}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
-  const fd = openSync(temporary, "wx", 384);
-  try {
-    writeSync(fd, randomBytes(bytes));
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  try {
-    linkSync(temporary, file);
-  } catch (error) {
-    if (error.code !== "EEXIST") throw error;
-  } finally {
-    rmSync(temporary, { force: true });
-  }
-  const dir = openSync(directory, "r");
-  try {
-    fsyncSync(dir);
-  } finally {
-    closeSync(dir);
-  }
-  return read() ?? refuse();
-}
-__name(privateKey, "privateKey");
-async function assertPrivateHome(home) {
-  const uid = process.getuid?.();
-  if (uid === void 0) return;
-  const fail2 = /* @__PURE__ */ __name((path, problem) => {
-    throw new Error(`Refusing to start: ${path} ${problem}. CANON_HOME must be a private 0700 directory whose ancestors only its owner or root can modify.`);
-  }, "fail");
-  await mkdir(home, { recursive: true, mode: 448 }).catch(() => void 0);
-  let resolved;
-  try {
-    resolved = await realpath2(home);
-  } catch {
-    return fail2(home, "does not exist");
-  }
-  if (resolved !== home) fail2(home, `is not canonical (it resolves to ${resolved})`);
-  const stat3 = await lstat(home);
-  if (!stat3.isDirectory() || stat3.uid !== uid) fail2(home, "is not a directory owned by this user");
-  if (stat3.mode & 63) fail2(home, `is accessible to other users (mode ${(stat3.mode & 511).toString(8)})`);
-  for (let path = dirname3(home); ; path = dirname3(path)) {
-    const ancestor = await lstat(path);
-    if (ancestor.uid !== uid && ancestor.uid !== 0) fail2(path, "is owned by another user");
-    if (ancestor.mode & 18) fail2(path, "is writable by other users");
-    if (path === dirname3(path)) return;
-  }
-}
-__name(assertPrivateHome, "assertPrivateHome");
-
 // src/runner/errands.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, lstatSync, mkdirSync as mkdirSync2, openSync as openSync2, readdirSync, readFileSync, unlinkSync, watch } from "node:fs";
-import { join } from "node:path";
+import { closeSync, constants as constants2, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync as readFileSync2, unlinkSync, watch } from "node:fs";
+import { join as join2 } from "node:path";
 var ERRAND_KINDS = ["tell", "post", "errand", "cancel"];
 var ERRAND_TEXT_MAX_BYTES = MLS_DEV_TEXT_MAX_BYTES;
 var ERRAND_WHY_MAX_BYTES = 4 * 1024;
@@ -1138,7 +1437,7 @@ function errandsDirectory(home, environmentId, agentId) {
   for (const segment of [environmentId, agentId]) {
     if (!/^[\w.:-]{1,200}$/.test(segment) || /^\.+$/.test(segment)) throw new Error(`Not an id: ${JSON.stringify(segment)}`);
   }
-  return join(home, "runner", environmentId, agentId, "errands");
+  return join2(home, "runner", environmentId, agentId, "errands");
 }
 __name(errandsDirectory, "errandsDirectory");
 function custody(stat3, kind) {
@@ -1154,8 +1453,8 @@ function custody(stat3, kind) {
 }
 __name(custody, "custody");
 function errandInbox(directory) {
-  const inbox = join(directory, "inbox");
-  mkdirSync2(inbox, { recursive: true, mode: 448 });
+  const inbox = join2(directory, "inbox");
+  mkdirSync(inbox, { recursive: true, mode: 448 });
   const problem = custody(lstatSync(inbox), "directory");
   if (problem) throw new Error(`The errand inbox ${inbox} ${problem}`);
   return inbox;
@@ -1188,16 +1487,16 @@ function queueErrand(directory, input) {
   const command = { version: 1, id: randomBytes2(16).toString("hex"), ...fields, createdAt: now.toISOString() };
   const problem = commandProblem(command, command.id);
   if (problem) throw new Error(`Not a valid ${input.kind}: ${problem}.`);
-  writeDurable(join(errandInbox(directory), `${now.getTime()}-${command.id}.json`), JSON.stringify(command));
+  writeDurable(join2(errandInbox(directory), `${now.getTime()}-${command.id}.json`), JSON.stringify(command));
   return command;
 }
 __name(queueErrand, "queueErrand");
 function errandJournal(directory) {
-  const folder = join(directory, "journal");
-  const file = /* @__PURE__ */ __name((id) => join(folder, `${id}.json`), "file");
+  const folder = join2(directory, "journal");
+  const file = /* @__PURE__ */ __name((id) => join2(folder, `${id}.json`), "file");
   const read = /* @__PURE__ */ __name((path) => {
     try {
-      return JSON.parse(readFileSync(path, "utf8"));
+      return JSON.parse(readFileSync2(path, "utf8"));
     } catch {
       return void 0;
     }
@@ -1219,7 +1518,7 @@ function errandJournal(directory) {
         names = readdirSync(folder);
       } catch {
       }
-      return names.filter((name) => /^[0-9a-f]{32}\.json$/.test(name)).flatMap((name) => read(join(folder, name)) ?? []);
+      return names.filter((name) => /^[0-9a-f]{32}\.json$/.test(name)).flatMap((name) => read(join2(folder, name)) ?? []);
     }
   };
 }
@@ -1244,24 +1543,24 @@ __name(awaitErrand, "awaitErrand");
 function readCommand(path, id) {
   let fd;
   try {
-    fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+    fd = openSync(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
   } catch (error) {
     const code = error.code;
     return { problem: code === "ELOOP" || code === "EMLINK" ? "is a symbolic link" : `cannot be opened (${code})` };
   }
   try {
-    const problem = custody(fstatSync2(fd), "file");
+    const problem = custody(fstatSync(fd), "file");
     if (problem) return { problem };
     let value;
     try {
-      value = JSON.parse(readFileSync(fd, "utf8"));
+      value = JSON.parse(readFileSync2(fd, "utf8"));
     } catch {
       return { problem: "is not JSON" };
     }
     const invalid2 = commandProblem(value, id);
     return invalid2 ? { problem: `is not a valid command: ${invalid2}` } : value;
   } finally {
-    closeSync2(fd);
+    closeSync(fd);
   }
 }
 __name(readCommand, "readCommand");
@@ -1286,7 +1585,7 @@ function watchErrandInbox(directory, handler, options) {
 ${name}`, `Errands: ${name} in the inbox is not a command file; it is left alone.`);
         continue;
       }
-      const path = join(inbox, name);
+      const path = join2(inbox, name);
       try {
         if (handler.taken(id) || await handler.take(id, readCommand(path, id))) unlinkSync(path);
       } catch (error) {
@@ -1336,8 +1635,8 @@ __name(watchErrandInbox, "watchErrandInbox");
 
 // src/runner/mls.ts
 import { createHash as createHash4, createHmac } from "node:crypto";
-import { constants as constants4 } from "node:fs";
-import { open as open2, realpath as realpath3 } from "node:fs/promises";
+import { constants as constants3 } from "node:fs";
+import { open as open2, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute, resolve } from "node:path";
 var fail = /* @__PURE__ */ __name(() => {
   throw new Error("MLS_AUTHORITY_REQUIRED");
@@ -1453,8 +1752,8 @@ function object(value, required, optional = []) {
 __name(object, "object");
 async function loadMlsDevConfiguration(filePath, input) {
   if (!isMlsEnvironmentId(input.environmentId)) invalid();
-  if (typeof filePath !== "string" || !isAbsolute(filePath) || filePath.includes("\0") || resolve(filePath) !== filePath || await realpath3(filePath).catch(() => "") !== filePath) invalid();
-  const file = await open2(filePath, constants4.O_RDONLY | constants4.O_NOFOLLOW).catch(() => invalid());
+  if (typeof filePath !== "string" || !isAbsolute(filePath) || filePath.includes("\0") || resolve(filePath) !== filePath || await realpath2(filePath).catch(() => "") !== filePath) invalid();
+  const file = await open2(filePath, constants3.O_RDONLY | constants3.O_NOFOLLOW).catch(() => invalid());
   let value;
   try {
     const before = await file.stat();
@@ -1462,7 +1761,7 @@ async function loadMlsDevConfiguration(filePath, input) {
     const bytes = Buffer.alloc(MAX_CONFIGURATION_BYTES + 1);
     const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
     const after = await file.stat();
-    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || await realpath3(filePath) !== filePath) invalid();
+    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || await realpath2(filePath) !== filePath) invalid();
     value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, bytesRead)));
   } catch {
     invalid();
@@ -1582,14 +1881,14 @@ __name(runMlsDevSetup, "runMlsDevSetup");
 
 // src/runner/mls-bundled.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join2 } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // mls-custody.json
 var mls_custody_default = {
   schemaVersion: 1,
-  release: "mls-custody-cadb937436ce",
+  release: "mls-custody-5ce777037493",
   protocolVersion: 1,
   rustVersion: "rustc 1.91.0 (f8297e351 2025-10-28)",
   sourceHashes: {
@@ -1601,15 +1900,15 @@ var mls_custody_default = {
     "mls/native/src/portable/json.rs": "d4e68556a051ffe9008686036597b1fd8239ae66fad67bd848c3f0e16bf8ccaf",
     "mls/native/src/portable/vault.rs": "14b9ff1e10ec4058e39a46511a489c7e82a9836e4175a768ac5d4b69c1dba8e5",
     "mls/native/src/portable/tests.rs": "7eadba2a49ed044470bb567d9b93fba44b64dc117b1da50a22187cff3dccb64e",
-    "mls/native/portable/build.mjs": "84c422a8a8aa6a7ec112a358bdeef080201aa4ea9a91f6d5726b05f46fa2a10c",
+    "mls/native/portable/build.mjs": "ec81bfe27238b3117c4e855fa58b323e18a935ad7aa8ac18807376fb0bddc99b",
     "mls/core/open.rs": "8cdc03882f3b84dca72ab06afd437f162de01a0fe21327b019f17867dd59f5d0",
     "mls/core/protocol.rs": "7f3e021d6e4f1cc130b5dd3c98e0b0fa23edf813c72802c3fa3f8fb9e431c947",
     "mls/core/fault_storage.rs": "fdd6672a21f6ffee657142755637824541a5090b4f8a5fb4902f482556fb2793",
     "mls/core/mls_environment.rs": "390d11ee82ef8b108a7fffc7bb193ac7f3e470aa14e9643d029007aaaa29c4e4",
-    "mls/core/dev_identity.rs": "97df6bdb9daab66f0e3d4ca3b49bf9954fa06ac032c927d9ae6c83509b0166bd",
-    "mls/core/dev_key_package.rs": "3e7011fe8ab3044d80d84d04944068dbcf683141fcaba8a7a00bd2cfd103de72",
+    "mls/core/dev_identity.rs": "df7282f0daa8babb3a9b9f397ad65d621784f9f54f5ca7a45fb3c8e82d58bbb1",
+    "mls/core/dev_key_package.rs": "e8956f8dd4e365c22ac2356fb520759cdb613e344e1d44510ceee54b1cf9a418",
     "mls/core/dev_application.rs": "fafe245ace38e384da265bab2c12fef6b77c86b2c20477d00563ab891a54f94b",
-    "mls/core/dev_group.rs": "1d519a5d15394bbc163aef00e0ddacb9bb87631beaf8a13e52c76d628749152b",
+    "mls/core/dev_group.rs": "d43f9ecdae79effdb9f177e76108487f81618dfc5b72b63618c41eff5896b2e0",
     "packages/test-fixtures/src/mlsDevEnrollmentProofV1.json": "50d7896e0a3a25b420412e84484e64f1e49480a3f298ee2d125f2f9188382810",
     "packages/test-fixtures/src/mlsDevCredentialV1.json": "24cd23af794b8a6e35caf050995020c6584b806de060969db4536f44b1188780",
     "packages/test-fixtures/src/mlsDevCredentialReconciliationV1.json": "bd4bbb3a2e5dc7921867a2e5936d1da77d536740b4360012c1f741f9caed2826",
@@ -1620,10 +1919,10 @@ var mls_custody_default = {
   platforms: {
     "darwin-arm64": {
       target: "aarch64-apple-darwin",
-      sha256: "918ae350f1d7bd339c4eee548f6668943217f5fa66022bb93f41a02992dd296c",
+      sha256: "b09c82209cc7884c4521a310c727a8faaf387e9d0603443b1c1d9a55d87b7103",
       bytes: 2932976,
-      unitTestsPassed: 95,
-      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      unitTestsPassed: 96,
+      commit: "b9d1a4008749d1f144fd8db6ca4066de20422184",
       builder: {
         macos: "26.3.1",
         sdk: "26.4",
@@ -1632,10 +1931,10 @@ var mls_custody_default = {
     },
     "linux-x64": {
       target: "x86_64-unknown-linux-gnu",
-      sha256: "1c5a12d0213c53bdf59b5f36a7390a4b4c17f8a53c95e760ad8cb4905297d256",
-      bytes: 3389816,
-      unitTestsPassed: 95,
-      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      sha256: "0b20495694534d9792b6920f1e3f375a2182b237a44cb2d384080dd17e7f83bb",
+      bytes: 3389880,
+      unitTestsPassed: 96,
+      commit: "da679f4c60e2271c20b1f1958d0e5f6bfce6ef2d",
       builder: {
         image: "quay.io/pypa/manylinux_2_28_x86_64@sha256:e0adf18521ad35192df733a6c62d35df7801957d24e0470238aacecfab2188a3",
         dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
@@ -1643,15 +1942,28 @@ var mls_custody_default = {
     },
     "linux-arm64": {
       target: "aarch64-unknown-linux-gnu",
-      sha256: "371c5754cf0c437f561e8c49b3ea654c037311b951e11b1c5a29fb6b91656619",
+      sha256: "649d90ba74a42b34025292bd942068fc08979e35f66c9d6ad358469f5022fac7",
       bytes: 3234232,
-      unitTestsPassed: 95,
-      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      unitTestsPassed: 96,
+      commit: "b9d1a4008749d1f144fd8db6ca4066de20422184",
       builder: {
         image: "quay.io/pypa/manylinux_2_28_aarch64@sha256:a3e02308c822fb6ce0d12248b0c941817ba5e1a1bc9e7bb5929f29c50eaa40a9",
         dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
       }
     }
+  },
+  wasm: {
+    release: "mls-wasm-ddfdcc6039d7",
+    commit: "ba57ec95af11e8b560fd7d71431c0ec14542d71e",
+    rustVersion: "rustc 1.91.0 (f8297e351 2025-10-28)",
+    wasm: {
+      sha256: "137454981d2b6236dffa3dae0a7253e5f6d30578bce2cf50476adc8ca3d9aa02",
+      bytes: 1794989
+    },
+    glue: {
+      sha256: "744eb2267560f22aa54540fe9aa988588a7c27641610aae729b2ed75232e2a24",
+      bytes: 13579
+    }
   }
 };
 
@@ -1687,40 +1999,77 @@ var MLS_ENVIRONMENT_PINS = {
 };
 function packageRoot() {
   for (let directory = dirname4(fileURLToPath(import.meta.url)); ; directory = dirname4(directory)) {
-    const manifest = join2(directory, "package.json");
-    if (existsSync(manifest) && JSON.parse(readFileSync2(manifest, "utf8")).name === "@canonmsg/agent-sdk") return directory;
+    const manifest = join3(directory, "package.json");
+    if (existsSync2(manifest) && JSON.parse(readFileSync3(manifest, "utf8")).name === "@canonmsg/agent-sdk") return directory;
     if (dirname4(directory) === directory) return void 0;
   }
 }
 __name(packageRoot, "packageRoot");
+function helperRunsOnLibc() {
+  if (process.platform !== "linux") return true;
+  const report = process.report;
+  const { excludeNetwork } = report;
+  report.excludeNetwork = true;
+  try {
+    const version = report.getReport().header?.glibcVersionRuntime;
+    const [major = 0, minor = 0] = (version ?? "").split(".").map(Number);
+    return major > 2 || major === 2 && minor >= 28;
+  } finally {
+    report.excludeNetwork = excludeNetwork;
+  }
+}
+__name(helperRunsOnLibc, "helperRunsOnLibc");
 function bundledMlsCustodyHelper() {
   const platform = `${process.platform}-${process.arch}`;
   const pin = mls_custody_default.platforms[platform];
-  const root = pin && packageRoot();
-  const path = root && join2(root, "dist", "mls", platform, "canon-mls-custody");
-  if (!pin || !path || !existsSync(path)) return void 0;
-  if (createHash5("sha256").update(readFileSync2(path)).digest("hex") !== pin.sha256) {
+  const root = pin && helperRunsOnLibc() && packageRoot();
+  const path = root && join3(root, "dist", "mls", platform, "canon-mls-custody");
+  if (!pin || !path || !existsSync2(path)) return void 0;
+  if (createHash5("sha256").update(readFileSync3(path)).digest("hex") !== pin.sha256) {
     throw new Error(`${path} is not the custody helper this package pins; reinstall @canonmsg/agent-sdk.`);
   }
   return { path, sha256: pin.sha256 };
 }
 __name(bundledMlsCustodyHelper, "bundledMlsCustodyHelper");
+function bundledMlsWasmCore() {
+  const root = packageRoot();
+  if (!root) return void 0;
+  const directory = join3(root, "dist", "mls", "wasm");
+  const hostPath = join3(root, "dist", "mls-wasm-host.js"), wasmPath = join3(directory, "canon_mls_wasm_bg.wasm"), gluePath = join3(directory, "canon_mls_wasm.js");
+  if (![hostPath, wasmPath, gluePath].every((path) => existsSync2(path))) return void 0;
+  for (const [path, pin] of [[wasmPath, mls_custody_default.wasm.wasm.sha256], [gluePath, mls_custody_default.wasm.glue.sha256]]) {
+    if (createHash5("sha256").update(readFileSync3(path)).digest("hex") !== pin) throw new Error(`${path} is not the MLS core this package pins; reinstall @canonmsg/agent-sdk.`);
+  }
+  return { hostPath, wasmPath, wasmSha256: mls_custody_default.wasm.wasm.sha256, gluePath, glueSha256: mls_custody_default.wasm.glue.sha256 };
+}
+__name(bundledMlsWasmCore, "bundledMlsWasmCore");
 
 // src/runner/mls-managed.ts
 import { createHash as createHash6 } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2 } from "node:fs";
-import { dirname as dirname5, join as join3 } from "node:path";
+import { chmodSync, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync4, renameSync } from "node:fs";
+import { dirname as dirname5, join as join4 } from "node:path";
 var sha256 = /* @__PURE__ */ __name((bytes) => createHash6("sha256").update(bytes).digest("hex"), "sha256");
+function custodyFor(home, environmentId) {
+  const root = join4(home, "mls", environmentId);
+  const keptOnCore = existsSync3(root) && readdirSync2(root).some((name) => existsSync3(join4(root, name, "wrapping.key")));
+  const kept = keptOnCore ? bundledMlsWasmCore() : void 0;
+  if (kept) return { wasm: kept };
+  const helper = bundledMlsCustodyHelper();
+  if (helper) return { helper };
+  const wasm = bundledMlsWasmCore();
+  return wasm ? { wasm } : {};
+}
+__name(custodyFor, "custodyFor");
 function defaultMlsDevice(home, environmentId) {
   if (!isMlsEnvironmentId(environmentId)) return void 0;
-  const helper = bundledMlsCustodyHelper();
-  return helper ? managedMlsDevice({ home, environmentId, helper }) : void 0;
+  const custody2 = custodyFor(home, environmentId);
+  return custody2.helper || custody2.wasm ? managedMlsDevice({ home, environmentId, ...custody2 }) : void 0;
 }
 __name(defaultMlsDevice, "defaultMlsDevice");
 function managedMlsDevice(options) {
   const { environmentId } = options;
-  const helper = options.helper ?? bundledMlsCustodyHelper();
-  if (!helper) {
+  const { helper, wasm } = options.helper ? { helper: options.helper, wasm: void 0 } : options.wasm ? options : custodyFor(options.home, environmentId);
+  if (!helper && !wasm) {
     throw new Error(`@canonmsg/agent-sdk ships no MLS custody helper for ${process.platform}-${process.arch}: build one from mls/native in the Canon repository and give the runner --mls-dev-config <path> (docs/design/mls-dev-agent-host.md).`);
   }
   const pins = options.pins ?? MLS_ENVIRONMENT_PINS[environmentId];
@@ -1731,24 +2080,27 @@ function managedMlsDevice(options) {
     issuerKeys: pins.issuerKeys,
     receiptKeys: pins.receiptKeys
   });
-  const root = join3(options.home, "mls", environmentId);
-  const directory = /* @__PURE__ */ __name((context) => join3(root, sha256(Buffer.from(JSON.stringify([
+  const root = join4(options.home, "mls", environmentId);
+  const directory = /* @__PURE__ */ __name((context) => join4(root, sha256(Buffer.from(JSON.stringify([
     context.installationId,
     context.principal.type,
     context.principal.id,
     "ownershipVersion" in context.principal ? context.principal.ownershipVersion : null
   ]))).slice(0, 32)), "directory");
-  const vault = /* @__PURE__ */ __name((context) => join3(directory(context), "vault", "vault.bin"), "vault");
+  const vault = /* @__PURE__ */ __name((context) => join4(directory(context), "vault", "vault.bin"), "vault");
+  const wrappingKey = /* @__PURE__ */ __name((context) => join4(directory(context), "wrapping.key"), "wrappingKey");
+  const made = /* @__PURE__ */ __name((context) => wasm ? wrappingKey(context) : vault(context), "made");
+  const stranded = /* @__PURE__ */ __name((context) => new Error(wasm ? `This agent's MLS device was made with the native custody helper, which does not run on this host (${process.platform}-${process.arch}). It is still in ${directory(context)}: run the agent with this home where the helper runs (macOS on Apple silicon, or Linux with glibc 2.28 or later), with the architecture it was set up on. A device cannot move to the WASM core, and a new home is refused, since Canon keeps an agent to one installation.` : `This agent's MLS device was made with the WASM core, which this install of @canonmsg/agent-sdk does not have. It is still in ${directory(context)}: reinstall the package. A device cannot move to the native helper, and a new home is refused, since Canon keeps an agent to one installation.`), "stranded");
   let executable;
   function install() {
-    const target = join3(root, "bin", helper.sha256, "canon-mls-custody");
-    if (existsSync2(target) && sha256(readFileSync3(target)) === helper.sha256) return target;
-    mkdirSync3(dirname5(target), { recursive: true, mode: 448 });
+    const target = join4(root, "bin", helper.sha256, "canon-mls-custody");
+    if (existsSync3(target) && sha256(readFileSync4(target)) === helper.sha256) return target;
+    mkdirSync2(dirname5(target), { recursive: true, mode: 448 });
     const temporary = `${target}.${process.pid}.tmp`;
     copyFileSync(helper.path, temporary);
     chmodSync(temporary, 448);
-    if (sha256(readFileSync3(temporary)) !== helper.sha256) throw new Error(`${helper.path} is not the pinned custody helper`);
-    renameSync2(temporary, target);
+    if (sha256(readFileSync4(temporary)) !== helper.sha256) throw new Error(`${helper.path} is not the pinned custody helper`);
+    renameSync(temporary, target);
     return target;
   }
   __name(install, "install");
@@ -1758,9 +2110,24 @@ function managedMlsDevice(options) {
     let found = devices.get(key);
     if (!found) {
       found = (async () => {
-        if (!provisioning && !existsSync2(vault(context))) throw new NodeMlsDevCustodyError();
-        mkdirSync3(dirname5(vault(context)), { recursive: true, mode: 448 });
-        const unlock = join3(key, "unlock");
+        if (!provisioning && !existsSync3(made(context))) throw new NodeMlsDevCustodyError();
+        mkdirSync2(dirname5(made(context)), { recursive: true, mode: 448 });
+        if (wasm) {
+          if (process.platform === "win32") {
+            if (provisioning) secureWindowsDirectory(key);
+            else assertPrivateWindowsFile(wrappingKey(context));
+          }
+          const { revision: _revision, ...identity } = context;
+          return wasmMlsCustody({
+            core: wasm,
+            context: identity,
+            keyPath: wrappingKey(context),
+            issuerKeys: configuration.issuerKeys,
+            receiptKeys: configuration.receiptKeys,
+            ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+          });
+        }
+        const unlock = join4(key, "unlock");
         if (provisioning) privateKey(unlock, 32);
         const text3 = `${JSON.stringify({
           version: 1,
@@ -1776,8 +2143,8 @@ function managedMlsDevice(options) {
           receiptKeys: configuration.receiptKeys
         }, null, 2)}
 `;
-        const file = join3(key, "native.json");
-        if (!existsSync2(file) || readFileSync3(file, "utf8") !== text3) writeDurable(file, text3);
+        const file = join4(key, "native.json");
+        if (!existsSync3(file) || readFileSync4(file, "utf8") !== text3) writeDurable(file, text3);
         return createPortableNodeMlsDevCustody({
           executablePath: executable ??= install(),
           executableSha256: helper.sha256,
@@ -1803,8 +2170,18 @@ function managedMlsDevice(options) {
   return {
     configuration,
     custody: custody2,
-    provision: /* @__PURE__ */ __name((context) => device(context, true).then((open4) => open4.provision(context)), "provision"),
-    provisioned: /* @__PURE__ */ __name((context) => existsSync2(vault(context)), "provisioned"),
+    async provision(context) {
+      await (await device(context, true)).provision(context);
+      if (wasm && process.platform === "win32") {
+        restrictWindowsFile(wrappingKey(context));
+        assertPrivateWindowsFile(wrappingKey(context));
+      }
+    },
+    provisioned(context) {
+      if (existsSync3(made(context))) return true;
+      if (existsSync3(wasm ? vault(context) : wrappingKey(context))) throw stranded(context);
+      return false;
+    },
     async close() {
       await Promise.allSettled([...devices.values()].map((open4) => open4.then((custody3) => custody3.close())));
     }
@@ -1814,10 +2191,10 @@ __name(managedMlsDevice, "managedMlsDevice");
 
 // src/runner/relay.ts
 import { createHmac as createHmac2, timingSafeEqual } from "node:crypto";
-import { closeSync as closeSync3, constants as constants5, fsyncSync as fsyncSync2, mkdirSync as mkdirSync4, openSync as openSync3, renameSync as renameSync3, writeSync as writeSync2 } from "node:fs";
-import { lstat as lstat2, open as open3, realpath as realpath4 } from "node:fs/promises";
+import { closeSync as closeSync2, constants as constants4, fsyncSync, mkdirSync as mkdirSync3, openSync as openSync2, renameSync as renameSync2, writeSync } from "node:fs";
+import { lstat, open as open3, realpath as realpath3 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { isAbsolute as isAbsolute2, join as join4, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join5, resolve as resolve2 } from "node:path";
 var TOLERANCE_S = 300;
 function relaySecretKey(secret) {
   if (typeof secret !== "string" || !/^whsec_[A-Za-z0-9+/]+={0,2}$/.test(secret)) throw new Error("The relay channel secret must be a whsec_ value");
@@ -1950,8 +2327,8 @@ async function readPrivateFile(path, maximum, what) {
   const fail2 = /* @__PURE__ */ __name(() => {
     throw new Error(`${what} must be a private file (0600, owned by this user, not a link): ${path}`);
   }, "fail");
-  if (typeof path !== "string" || !isAbsolute2(path) || path.includes("\0") || resolve2(path) !== path || await realpath4(path).catch(() => "") !== path) fail2();
-  const file = await open3(path, constants5.O_RDONLY | constants5.O_NOFOLLOW).catch(() => fail2());
+  if (typeof path !== "string" || !isAbsolute2(path) || path.includes("\0") || resolve2(path) !== path || await realpath3(path).catch(() => "") !== path) fail2();
+  const file = await open3(path, constants4.O_RDONLY | constants4.O_NOFOLLOW).catch(() => fail2());
   try {
     const info = await file.stat();
     if (!info.isFile() || info.nlink !== 1 || info.uid !== process.getuid?.() || (info.mode & 63) !== 0 || info.size < 1 || info.size > maximum) fail2();
@@ -1988,11 +2365,11 @@ async function loadRelayConfiguration(path, input) {
   return { environmentId: value.environmentId, agentId: value.agentId, listen: { host: listen.host, port: listen.port }, secret };
 }
 __name(loadRelayConfiguration, "loadRelayConfiguration");
-var relayDirectory = /* @__PURE__ */ __name((home) => join4(home, "relay"), "relayDirectory");
-var credentialFile = /* @__PURE__ */ __name((home) => join4(relayDirectory(home), "credential.json"), "credentialFile");
+var relayDirectory = /* @__PURE__ */ __name((home) => join5(home, "relay"), "relayDirectory");
+var credentialFile = /* @__PURE__ */ __name((home) => join5(relayDirectory(home), "credential.json"), "credentialFile");
 async function readRelayCredential(home, relay) {
   const path = credentialFile(home);
-  if (!await lstat2(path).then(() => true, () => false)) return void 0;
+  if (!await lstat(path).then(() => true, () => false)) return void 0;
   let value;
   try {
     value = JSON.parse(await readPrivateFile(path, 4 * 1024, "The relay credential"));
@@ -2015,33 +2392,33 @@ function writeRelayCredential(home, relay, delivery) {
     generation: delivery.generation,
     credential: delivery.credential
   };
-  mkdirSync4(relayDirectory(home), { recursive: true, mode: 448 });
+  mkdirSync3(relayDirectory(home), { recursive: true, mode: 448 });
   const file = credentialFile(home);
   const temporary = `${file}.${process.pid}.tmp`;
-  const fd = openSync3(temporary, "w", 384);
+  const fd = openSync2(temporary, "w", 384);
   try {
-    writeSync2(fd, JSON.stringify(value));
-    fsyncSync2(fd);
+    writeSync(fd, JSON.stringify(value));
+    fsyncSync(fd);
   } finally {
-    closeSync3(fd);
+    closeSync2(fd);
   }
-  renameSync3(temporary, file);
+  renameSync2(temporary, file);
   return value;
 }
 __name(writeRelayCredential, "writeRelayCredential");
 function relayRunnerHome(home, installationId) {
   if (!CONNECTOR_RELAY_INSTALLATION_PATTERN.test(installationId)) throw new Error("Invalid relay installation");
-  const directory = join4(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
-  mkdirSync4(directory, { recursive: true, mode: 448 });
+  const directory = join5(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
+  mkdirSync3(directory, { recursive: true, mode: 448 });
   return directory;
 }
 __name(relayRunnerHome, "relayRunnerHome");
 
 // src/runner/runner.ts
 import { createHash as createHash8 } from "node:crypto";
-import { readFileSync as readFileSync5, rmSync as rmSync3 } from "node:fs";
-import { realpath as realpath5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, isAbsolute as isAbsolute3, join as join6, sep } from "node:path";
+import { readFileSync as readFileSync6, rmSync as rmSync2 } from "node:fs";
+import { realpath as realpath4, stat as stat2 } from "node:fs/promises";
+import { basename as basename4, isAbsolute as isAbsolute3, join as join7, sep } from "node:path";
 
 // ../agent-tools/src/communication-tool.ts
 var CANON_COMMUNICATE_TOOL_NAME = "communicate";
@@ -2536,8 +2913,8 @@ __name(createLivePublisher, "createLivePublisher");
 
 // src/runner/mls-ask.ts
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync5, rmSync } from "node:fs";
+import { join as join6 } from "node:path";
 var sha2562 = /* @__PURE__ */ __name((value) => createHash7("sha256").update(value).digest("hex"), "sha256");
 var pause = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
   setTimeout(resolve3, ms).unref?.();
@@ -2592,9 +2969,9 @@ function createMlsAsks(options, approvalScope2) {
       });
     }
   });
-  const file = /* @__PURE__ */ __name((conversationId, requestId) => join5(options.directory, `${sha2562(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
+  const file = /* @__PURE__ */ __name((conversationId, requestId) => join6(options.directory, `${sha2562(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
   const save = /* @__PURE__ */ __name((journal) => writeDurable(file(journal.conversationId, journal.requestId), JSON.stringify(journal)), "save");
-  const forget = /* @__PURE__ */ __name((journal) => rmSync2(file(journal.conversationId, journal.requestId), { force: true }), "forget");
+  const forget = /* @__PURE__ */ __name((journal) => rmSync(file(journal.conversationId, journal.requestId), { force: true }), "forget");
   const operationOf = /* @__PURE__ */ __name((conversationId, messageId) => `runner-mls-ask:${sha2562(JSON.stringify([conversationId, messageId])).slice(0, 48)}`, "operationOf");
   const withdrawalOf = /* @__PURE__ */ __name((journal) => operationOf(journal.conversationId, `${journal.requestId}:withdraw`), "withdrawalOf");
   const audienceChanged = /* @__PURE__ */ __name((error) => codeOf(error) === "MLS_DEV_AUDIENCE_CHANGED", "audienceChanged");
@@ -2929,18 +3306,18 @@ function createMlsAsks(options, approvalScope2) {
     async recover() {
       let names;
       try {
-        names = readdirSync2(options.directory).filter((name) => name.endsWith(".json"));
+        names = readdirSync3(options.directory).filter((name) => name.endsWith(".json"));
       } catch {
         return;
       }
       for (const name of names) {
         let journal;
         try {
-          journal = JSON.parse(readFileSync4(join5(options.directory, name), "utf8"));
+          journal = JSON.parse(readFileSync5(join6(options.directory, name), "utf8"));
           if (journal.version !== 1 || typeof journal.conversationId !== "string" || typeof journal.requestId !== "string" || !Array.isArray(journal.sends) || journal.sends.some((sent) => typeof sent?.operationId !== "string" || typeof sent.messageId !== "string")) throw new Error();
           for (const sent of journal.sends) sent.audience = snapshotMlsAudience(sent.audience);
         } catch {
-          rmSync2(join5(options.directory, name), { force: true });
+          rmSync(join6(options.directory, name), { force: true });
           continue;
         }
         try {
@@ -3044,7 +3421,7 @@ var STATE_LIMIT_BYTES = 64 * 1024;
 var FAILURE_NOTICE = "Sorry, something went wrong and I could not finish this reply.";
 var STOPS_SHORT_NOTICE = "Sorry, my reply could not be delivered in full.";
 var RESTART_NOTICE = "Sorry, I was restarted before I could finish replying to this. Please send it again if you still need an answer.";
-var CLIENT_TYPES = { code: "generic", claude: "claude-code", codex: "codex", connector: "generic" };
+var CLIENT_TYPES = { code: "generic", claude: "claude-code", codex: "codex", acp: "generic", connector: "generic" };
 var objectSchema = /* @__PURE__ */ __name((properties, required = []) => ({ type: "object", properties, required, additionalProperties: false }), "objectSchema");
 var MAX_QUESTION = 4e3;
 var MAX_OPTION = 120;
@@ -3344,9 +3721,9 @@ async function createRunner(options) {
       current.lane = current.lane.then(publish2).catch(() => void 0);
     }, "enqueue")
   }), "livePublisher");
-  const stateFile = /* @__PURE__ */ __name((session) => join6(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2563(JSON.stringify([scope, session]))}.json`), "stateFile");
+  const stateFile = /* @__PURE__ */ __name((session) => join7(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2563(JSON.stringify([scope, session]))}.json`), "stateFile");
   const resetSession = /* @__PURE__ */ __name(async (session) => {
-    rmSync3(stateFile(session), { force: true });
+    rmSync2(stateFile(session), { force: true });
     mlsAsks?.endSession(session);
     await driver.reset?.(session);
   }, "resetSession");
@@ -3617,7 +3994,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     } finally {
       turn.ended.abort();
       bound.release();
-      rmSync3(conversationMediaCacheDir(inboundMedia(current.id)), { recursive: true, force: true });
+      rmSync2(conversationMediaCacheDir(inboundMedia(current.id)), { recursive: true, force: true });
     }
   }
   __name(execute, "execute");
@@ -3732,7 +4109,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     return check;
   }
   __name(reaudience, "reaudience");
-  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join6(home, "runner", options.environmentId, agentId) }), "inboundMedia");
+  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join7(home, "runner", options.environmentId, agentId) }), "inboundMedia");
   async function materialize(current, turn) {
     if (driver.capabilities.remote) return;
     for (const { payload: { message: message2 } } of turn.inputs) {
@@ -3775,7 +4152,7 @@ ${error instanceof Error ? error.message : String(error)}`;
         const file = await admitFile(path);
         if (typeof file === "string") return { result: toolText(file, true) };
         turn.outbox.push(file.path);
-        return { result: toolText(`${basename3(file.path)} will be sent with your reply.`) };
+        return { result: toolText(`${basename4(file.path)} will be sent with your reply.`) };
       }, "send_file"),
       communicate: /* @__PURE__ */ __name(async (args) => ({ result: await communicate(current, turn, args) }), "communicate"),
       // RUN-25 through a tool: the same `ask`, so the same responder, card, expiry, waiting_input and paused deadline;
@@ -3922,7 +4299,7 @@ ${JSON.stringify(result, null, 2)}`);
   async function admitFile(path) {
     if (typeof path !== "string" || !isAbsolute3(path)) return "send_file needs an absolute file path";
     try {
-      const real = await realpath5(path);
+      const real = await realpath4(path);
       if (!roots.some((root) => real.startsWith(root.endsWith(sep) ? root : `${root}${sep}`))) return `${path} is outside the directories this agent may share from`;
       const info = await stat2(real);
       if (!info.isFile() || info.size < 1 || info.size > MAX_CANON_MEDIA_BYTES) return `${path} must be a file from 1 byte to 100 MiB`;
@@ -3940,13 +4317,13 @@ ${JSON.stringify(result, null, 2)}`);
     for (const candidate of candidates) {
       const file = await admitFile(candidate);
       if (typeof file === "string") {
-        refused2.push(typeof candidate === "string" ? basename3(candidate) : "a file");
+        refused2.push(typeof candidate === "string" ? basename4(candidate) : "a file");
         continue;
       }
       if (seen.has(file.path)) continue;
       seen.add(file.path);
       if (attachments.length >= MAX_GROUP_PARTS - 1) {
-        refused2.push(basename3(file.path));
+        refused2.push(basename4(file.path));
         continue;
       }
       try {
@@ -3954,14 +4331,14 @@ ${JSON.stringify(result, null, 2)}`);
         const attachmentId = `${turn.id}-${seen.size}`;
         const [prepared] = await media.prepare({ conversationId, attachmentId, files: [{
           source: file.path,
-          descriptor: { mimeType: inferUploadMimeType(file.path), sizeBytes: file.size, fileName: basename3(file.path) }
+          descriptor: { mimeType: inferUploadMimeType(file.path), sizeBytes: file.size, fileName: basename4(file.path) }
         }] }, { signal: turn.retire.signal });
         attachments.push(prepared);
         flows.push(`${conversationId}:upload:${attachmentId}`);
       } catch (error) {
         if (turn.retire.signal.aborted) break;
         warn("file upload")(error);
-        refused2.push(basename3(file.path));
+        refused2.push(basename4(file.path));
       }
     }
     return { attachments, flows, refused: refused2 };
@@ -3993,7 +4370,9 @@ ${JSON.stringify(result, null, 2)}`);
       const skip = new Set([...turn.inputs, ...current.queue].map(({ payload }) => payload.message.id));
       const at = Math.max(...turn.inputs.map(({ payload }) => recent.findIndex((message2) => message2.id === payload.message.id)));
       const before = /* @__PURE__ */ __name((message2, index) => message2.senderId === agentId || (at >= 0 ? index > at : !first.createdAt || String(message2.createdAt ?? "") < first.createdAt), "before");
-      const window = recent.filter((message2, index) => before(message2, index) && !message2.deleted && !skip.has(message2.id)).slice(0, HISTORY_WINDOW);
+      const ownerId = driver.capabilities.ownerHistoryOnly ? (await client.getAgentMe()).ownerId : void 0;
+      const allowed = /* @__PURE__ */ __name((message2) => ownerId === void 0 || message2.senderId === agentId || message2.senderId === ownerId, "allowed");
+      const window = recent.filter((message2, index) => before(message2, index) && !message2.deleted && !skip.has(message2.id) && allowed(message2)).slice(0, HISTORY_WINDOW);
       const sameAudience = turn.mls ? await Promise.all(window.map((message2) => endpoint.mlsDevGroups.readVerifiedMessageBinding({ conversationId: current.id, messageId: message2.id }).then((binding) => !!binding && JSON.stringify(binding.head) === JSON.stringify(turn.mls.head), () => false))) : void 0;
       return window.filter((_, index) => !sameAudience || sameAudience[index]).reverse();
     } catch (error) {
@@ -4037,7 +4416,7 @@ ${JSON.stringify(result, null, 2)}`);
     } else if (answered2 && turn.mls && resultFiles.length) {
       text3 = `${text3}
 
-(${ENCRYPTED_FILES}: ${resultFiles.map((file) => typeof file === "string" ? basename3(file) : "a file").join(", ")}.)`;
+(${ENCRYPTED_FILES}: ${resultFiles.map((file) => typeof file === "string" ? basename4(file) : "a file").join(", ")}.)`;
     } else if (answered2 && !turn.mls) {
       const files = await attach(current.id, turn, [...turn.outbox, ...resultFiles]);
       ({ attachments, flows } = files);
@@ -4203,20 +4582,20 @@ ${JSON.stringify(result, null, 2)}`);
     for (const candidate of candidates) {
       const file = await admitFile(candidate);
       if (typeof file === "string") {
-        refused2.push(typeof candidate === "string" ? basename3(candidate) : "a file");
+        refused2.push(typeof candidate === "string" ? basename4(candidate) : "a file");
         continue;
       }
       if (seen.has(file.path)) continue;
       seen.add(file.path);
       const mimeType = inferUploadMimeType(file.path);
-      if (items.length >= MAX_GROUP_PARTS - 1 || !resolveAllowedUploadMimeType({ mimeType, fileName: basename3(file.path) })) {
-        refused2.push(basename3(file.path));
+      if (items.length >= MAX_GROUP_PARTS - 1 || !resolveAllowedUploadMimeType({ mimeType, fileName: basename4(file.path) })) {
+        refused2.push(basename4(file.path));
         continue;
       }
       items.push({
         path: file.path,
         messageId: keyed().text("item", roomId, turn.id, String(items.length)),
-        fileName: basename3(file.path),
+        fileName: basename4(file.path),
         mimeType,
         sizeBytes: file.size
       });
@@ -4401,7 +4780,7 @@ ${JSON.stringify(result, null, 2)}`);
     const file = stateFile(session);
     let data = {};
     try {
-      data = JSON.parse(readFileSync5(file, "utf8"));
+      data = JSON.parse(readFileSync6(file, "utf8"));
     } catch {
     }
     const save = /* @__PURE__ */ __name((next) => {
@@ -4854,7 +5233,7 @@ ${JSON.stringify(result, null, 2)}`);
     let text3 = answered2 ? result.reply : failed ? FAILURE_NOTICE : null;
     if (answered2 && result.files?.length) text3 = `${text3}
 
-(Files cannot go with an errand's report: ${result.files.map((file) => basename3(String(file))).join(", ")}.)`;
+(Files cannot go with an errand's report: ${result.files.map((file) => basename4(String(file))).join(", ")}.)`;
     const known = latest(record.id) ?? record;
     const cancelled = known.status === "cancelled" || stopped();
     const status = cancelled ? "cancelled" : ended(known, failed);
@@ -5023,7 +5402,7 @@ ${JSON.stringify(result, null, 2)}`);
       client = new CanonClient(options.apiKey, connection.apiBaseUrl, {
         environmentId: connection.environmentId,
         streamUrl: connection.streamUrl,
-        stateDirectory: join6(home, "endpoint"),
+        stateDirectory: join7(home, "endpoint"),
         ...options.client ? { client: options.client } : {},
         // Below Canon's client floor nothing can work, wherever the refusal surfaces: a query, an operation or the stream.
         ...options.onFatal ? { onClientUpdateRequired: /* @__PURE__ */ __name((error) => options.onFatal(error), "onClientUpdateRequired") } : {},
@@ -5071,17 +5450,17 @@ ${JSON.stringify(result, null, 2)}`);
       }
       scope = JSON.stringify([identity.environmentId, agentId, identity.ownershipVersion ?? 0, identity.installationId]);
       if (mlsOn) {
-        mlsIds = createMlsIds(privateKey(join6(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2563(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
+        mlsIds = createMlsIds(privateKey(join7(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2563(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
         mlsAsks = createMlsAsks({
           endpoint,
           agentId,
-          directory: join6(home, "runner", options.environmentId, agentId, "asks", sha2563(scope).slice(0, 32)),
+          directory: join7(home, "runner", options.environmentId, agentId, "asks", sha2563(scope).slice(0, 32)),
           assertAudience,
           sessionForDestructive: options.sessionApprovalForDestructive === true,
           log
         }, approvalScope);
       }
-      journal = createCompletedOutputJournal(join6(home, "runner", options.environmentId, agentId, "finals"), scope, {
+      journal = createCompletedOutputJournal(join7(home, "runner", options.environmentId, agentId, "finals"), scope, {
         label: "agent runner",
         validate: /* @__PURE__ */ __name((record) => typeof record.text === "string" && typeof record.options?.messageId === "string" && Array.isArray(record.inputs) && typeof record.notice === "boolean" && (record.attachments === void 0 || Array.isArray(record.attachments)) && (record.flows === void 0 || Array.isArray(record.flows) && record.flows.length === record.attachments?.length) && (record.mls === void 0 || !!record.mls && typeof record.mls === "object") && (record.errand === void 0 || typeof record.errand === "string"), "validate")
       });
@@ -5106,7 +5485,7 @@ ${JSON.stringify(result, null, 2)}`);
         }
       }
       const outbound = driver.capabilities.outboundFiles;
-      roots = outbound ? (await Promise.all(outbound.roots.map((root) => realpath5(root).catch(() => "")))).filter(Boolean) : [];
+      roots = outbound ? (await Promise.all(outbound.roots.map((root) => realpath4(root).catch(() => "")))).filter(Boolean) : [];
       if (driver.capabilities.tools) tools = await startToolServer();
       await recover();
       const publisher = createRuntimeStatePublisher({ agentId, clientType: CLIENT_TYPES[driver.name], hostMode: true, rtdb: initRTDBAuth(client) });
@@ -5283,14 +5662,14 @@ export {
   DriverSessionError,
   ConnectorRelayError,
   loadInstructions,
+  checkAcp,
+  acpDriver,
   loadClaudeQuery,
   claudeDriver,
   codeDriver,
   checkCodex,
   codexDriver,
   connectorDriver,
-  runnerLockName,
-  assertPrivateHome,
   errandsDirectory,
   queueErrand,
   errandJournal,
@@ -5301,6 +5680,7 @@ export {
   runMlsDevSetup,
   MLS_ENVIRONMENT_PINS,
   bundledMlsCustodyHelper,
+  bundledMlsWasmCore,
   defaultMlsDevice,
   managedMlsDevice,
   startRelayChannel,