@canonmsg/agent-sdk 12.5.1 → 13.0.2

package/dist/chunks/{chunk-3KFVBOVI.js → chunk-DNHJGAEL.js}

@@ -1,36 +1,45 @@
 import {
-  ApprovalManager,
+  assertPrivateHome,
+  assertPrivateWindowsFile,
+  privateKey,
+  restrictWindowsFile,
+  runnerLockName,
+  secureWindowsDirectory,
+  wasmMlsCustody,
+  windowsAclProblems,
+  writeDurable
+} from "./chunk-DTAWEQCM.js";
+import {
   BoundedFileReadError,
   CanonClient,
   MAX_CANON_MEDIA_BYTES,
-  NodeMlsDevCustodyError,
   RUNTIME_NEW_SESSION_ACTION,
   RUNTIME_STOP_ACTION,
   RUNTIME_STOP_AND_DROP_ACTION,
   acquireLock,
-  assertCompletedOutputAudience,
-  buildChunkedMessagePartMetadata,
   conversationMediaCacheDir,
   createCompletedOutputJournal,
-  createNodeMlsDevCustody,
-  createPortableNodeMlsDevCustody,
   createRuntimeHeartbeat,
   createRuntimeStatePublisher,
   inferUploadMimeType,
   initRTDBAuth,
   isPendingCanonOperation,
-  isRetryableCanonDeliveryError,
   materializeAttachment,
   normalizeRuntimeCommandDescriptors,
   readBoundedRegularFileHandle,
   renderCanonHostInboundContent,
-  reportNoReplyOutcome,
   resolveCanonRuntimeConnection,
-  resolveTurnVerbosity,
-  sendMessageWithRetryChunked,
-  splitTextByUtf8Bytes,
+  splitTextWithinBytes,
   verifyCanonRuntimeConnection
-} from "./chunk-TFSURFF6.js";
+} from "./chunk-TYZT346O.js";
+import {
+  NodeMlsDevCustodyError,
+  createNodeMlsDevCustody,
+  createPortableNodeMlsDevCustody
+} from "./chunk-YJUPKU47.js";
+import {
+  parseMlsDevClientConfiguration
+} from "./chunk-YHDDOADK.js";
 import {
   CONNECTOR_RELAY_ANSWER_WITHIN_MS,
   CONNECTOR_RELAY_INSTALLATION_PATTERN,
@@ -44,9 +53,11 @@ import {
   MLS_DEV_TEXT_MAX_BYTES,
   MLS_DEV_TEXT_PROTOCOL_V3,
   NO_REPLY_ACK_NOTE,
-  VERB_LIMITS,
+  PARTICIPATION_HISTORY_FETCH_LIMIT,
   __name,
+  buildParticipationHistorySnapshot,
   connectorRelayResponseBytes,
+  evaluateParticipationPolicy,
   isConnectorRelayCredential,
   isConnectorRelayInstallation,
   isMlsDevTextProtocol,
@@ -54,12 +65,12 @@ import {
   mlsDevProtocolCarriesCards,
   parseConnectorRelayRequest,
   parseDirectConversationSelection,
-  parseMlsDevClientConfiguration,
   parseMlsDevCredentialToken,
   parseMlsDevGroupHead,
   parseMlsDevGroupRoster,
-  resolveAllowedUploadMimeType
-} from "./chunk-C2WJT3VX.js";
+  resolveAllowedUploadMimeType,
+  resolveConversationPolicyScope
+} from "./chunk-5WPAB5MB.js";
 
 // src/runner/types.ts
 var DriverSessionError = class extends Error {
@@ -106,11 +117,13 @@ async function loadInstructions(path) {
   if (real !== path) refuse(`must be given by its real path (${real}), with no symbolic links`);
   const parent = await stat(dirname(path)).catch(() => refuse("cannot be read"));
   const uid = process.getuid?.();
-  if (parent.uid !== uid && parent.uid !== 0 || (parent.mode & 18) !== 0) refuse("its directory must not be writable by group or others");
+  const windows = process.platform === "win32" ? windowsAclProblems([[dirname(path), "unwritable"], [path, "unwritable"]]) : void 0;
+  if (windows?.length) refuse(`must not be writable by others: ${windows[0]}`);
+  if (!windows && (parent.uid !== uid && parent.uid !== 0 || (parent.mode & 18) !== 0)) refuse("its directory must not be writable by group or others");
   const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK).catch(() => refuse("cannot be read"));
   try {
     const info = await file.stat();
-    if (info.uid !== uid || (info.mode & 18) !== 0) refuse("must be owned by you and not writable by group or others");
+    if (!windows && (info.uid !== uid || (info.mode & 18) !== 0)) refuse("must be owned by you and not writable by group or others");
     const bytes = await readBoundedRegularFileHandle(file, MAX_INSTRUCTIONS_BYTES).catch((error) => refuse(error instanceof BoundedFileReadError ? error.failure === "too-large" ? "is larger than 32 KiB" : "is not a regular file" : "cannot be read"));
     let text3;
     try {
@@ -126,11 +139,13 @@ async function loadInstructions(path) {
 }
 __name(loadInstructions, "loadInstructions");
 
-// src/drivers/claude.ts
-import { randomUUID } from "node:crypto";
+// src/drivers/acp.ts
+import { spawn as spawn2 } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname as dirname2 } from "node:path";
+import { basename } from "node:path";
+import { pathToFileURL } from "node:url";
 
 // src/drivers/call-scope.ts
 import { createHash } from "node:crypto";
@@ -141,17 +156,466 @@ function callScope(name, call) {
 }
 __name(callScope, "callScope");
 
+// src/drivers/installed-cli.ts
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname as dirname2, extname, join } from "node:path";
+function shimTarget(shim) {
+  const last = [...shim.matchAll(/"([^"]+)"\s+%\*/g)].at(-1)?.[1];
+  const variable = /^%(\w+)%$/.exec(last ?? "")?.[1];
+  const target = variable ? new RegExp(`SET "${variable}=([^"]+)"`, "i").exec(shim)?.[1] : last;
+  return /^%~?dp0%?\\(.+)$/.exec(target ?? "")?.[1];
+}
+__name(shimTarget, "shimTarget");
+function installedCli(path) {
+  const given = { file: path, args: [] };
+  if (process.platform !== "win32") return given;
+  const names = extname(path) ? [path] : [`${path}.exe`, `${path}.cmd`];
+  const directories = /[\\/]/.test(path) ? [""] : (process.env.PATH ?? "").split(";").filter(Boolean);
+  for (const directory of directories) {
+    for (const name of names) {
+      const file = join(directory, name);
+      if (!existsSync(file)) continue;
+      if (!/\.(?:cmd|bat)$/i.test(file)) return { file, args: [] };
+      const target = shimTarget(readFileSync(file, "utf8"));
+      if (!target) throw new Error(`${file} is not an npm shim: give the path of the program it runs.`);
+      const script = join(dirname2(file), target);
+      return /\.[cm]?js$/i.test(script) ? { file: process.execPath, args: [script] } : { file: script, args: [] };
+    }
+  }
+  return given;
+}
+__name(installedCli, "installedCli");
+function stopCli(child) {
+  if (process.platform !== "win32") {
+    child.kill("SIGTERM");
+    return;
+  }
+  if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) return;
+  spawn(
+    join(process.env.SystemRoot ?? "C:\\Windows", "System32", "taskkill.exe"),
+    ["/PID", String(child.pid), "/T", "/F"],
+    { stdio: "ignore", windowsHide: true }
+  ).once("error", () => {
+    child.kill();
+  });
+}
+__name(stopCli, "stopCli");
+
+// src/drivers/subprocess.ts
+import { createHash as createHash2 } from "node:crypto";
+import { createInterface } from "node:readline";
+var isRecord = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
+var text = /* @__PURE__ */ __name((value) => typeof value === "string" ? value : "", "text");
+var oneLine = /* @__PURE__ */ __name((value, max) => {
+  const line = value.replace(/\s+/g, " ").trim();
+  return line.length > max ? `${line.slice(0, max - 1)}\u2026` : line;
+}, "oneLine");
+var RISKY = /\brm\s+-[a-z]*[rf]|\bgit\s+(reset\s+--hard|push\s+(-f|--force))|\bdrop\s+(table|database)\b|\bmkfs\b|\bdd\s+if=/i;
+var guestTurn = /* @__PURE__ */ __name((turn) => !turn.input.messages.every((message2) => message2.isOwner || message2.trustedAgent === true), "guestTurn");
+async function approve(turn, request) {
+  const asked = createHash2("sha256").update(JSON.stringify([request.scopeKey, request.title, request.detail])).digest("hex").slice(0, 12);
+  const answer = await turn.ask({ kind: "approve", ...request, id: `${request.id}#${asked}` }).catch(() => void 0);
+  if (!answer) return "stopped";
+  if (answer.status !== "answered" || !answer.allow) return "denied";
+  return answer.scope === "session" ? "session" : "once";
+}
+__name(approve, "approve");
+var PIPE_GRACE_MS = 1e3;
+function stdioRpc(child, handlers, { name, envelope }) {
+  let next = 0;
+  const pending = /* @__PURE__ */ new Map();
+  const write = /* @__PURE__ */ __name((message2) => {
+    if (child.stdin?.writable) child.stdin.write(`${JSON.stringify({ ...envelope, ...message2 })}
+`);
+  }, "write");
+  child.stdin?.on("error", () => void 0);
+  createInterface({ input: child.stdout }).on("error", () => void 0).on("line", (line) => {
+    let message2;
+    try {
+      message2 = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (!isRecord(message2)) return;
+    const params = isRecord(message2.params) ? message2.params : {};
+    if (typeof message2.method !== "string") {
+      const waiting = pending.get(Number(message2.id));
+      pending.delete(Number(message2.id));
+      if (isRecord(message2.error)) waiting?.reject(Object.assign(new Error(text(message2.error.message) || `${name} refused the request`), { code: message2.error.code }));
+      else waiting?.resolve(message2.result);
+    } else if (message2.id !== void 0) {
+      handlers.request(message2.method, params, message2.id).then(
+        (result) => write({ id: message2.id, result }),
+        (error) => write({ id: message2.id, error: {
+          code: typeof error?.code === "number" ? error.code : -32e3,
+          message: error instanceof Error ? error.message : String(error)
+        } })
+      );
+    } else handlers.notify(message2.method, params);
+  });
+  child.stderr?.resume();
+  child.once("exit", () => {
+    setTimeout(() => {
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+    }, PIPE_GRACE_MS).unref();
+  });
+  return {
+    call: /* @__PURE__ */ __name((method, params) => new Promise((resolve3, reject) => {
+      next += 1;
+      pending.set(next, { resolve: /* @__PURE__ */ __name((value) => resolve3(isRecord(value) ? value : {}), "resolve"), reject });
+      write({ id: next, method, params });
+    }), "call"),
+    notify: /* @__PURE__ */ __name((method, params) => write({ method, ...params ? { params } : {} }), "notify"),
+    fail(error) {
+      for (const waiting of pending.values()) waiting.reject(error);
+      pending.clear();
+    }
+  };
+}
+__name(stdioRpc, "stdioRpc");
+
+// src/drivers/acp.ts
+var PROTOCOL = 1;
+var SESSION = "sessionId";
+var OWNER_MODE = "ownerMode";
+var CANON = "canon";
+var METHOD_NOT_FOUND = -32601;
+var AUTH_REQUIRED = -32e3;
+var SYSTEM = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. Your final message in a turn is posted there as your reply, so put your whole answer in it. Canon's tools are on the MCP server whose name starts with canon_. To ask the people in the conversation a question, call its ask_question tool and wait for the answer. When you have nothing to add, call its no_reply tool instead of answering.";
+var GUEST = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: do not read files, run commands or use any tool but those of the MCP server whose name starts with canon_. Answer from the conversation and what you already know, and say so when something needs your owner.";
+var OWNER_ONLY = "This agent only takes messages from its owner.";
+var KILL_AFTER_MS = 2e3;
+var MACHINE_KINDS = /* @__PURE__ */ new Set(["read", "edit", "delete", "move", "search", "execute", "fetch"]);
+var BRIDGE = `
+const { request } = require('node:http');
+const url = new URL(process.env.TURN_TOOLS_URL);
+const headers = { 'content-type': 'application/json', accept: 'application/json, text/event-stream' };
+require('node:readline').createInterface({ input: process.stdin }).on('line', (line) => {
+  const post = request(url, { method: 'POST', headers }, (response) => {
+    let body = '';
+    response.setEncoding('utf8').on('data', (chunk) => { body += chunk; });
+    response.on('end', () => { if (body.trim()) process.stdout.write(body.trim() + '\\n'); });
+  });
+  post.on('error', () => undefined);
+  post.end(line);
+});`;
+function startAgent(command, args, cwd) {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("CANON_")));
+  const cli = installedCli(command);
+  return spawn2(cli.file, [...cli.args, ...args], { cwd, env, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32", windowsHide: true });
+}
+__name(startAgent, "startAgent");
+function signalAgent(child, signal) {
+  if (process.platform === "win32") {
+    stopCli(child);
+    return;
+  }
+  try {
+    if (child.pid) process.kill(-child.pid, signal);
+    else child.kill(signal);
+  } catch {
+  }
+}
+__name(signalAgent, "signalAgent");
+var refuseMethod = /* @__PURE__ */ __name((method) => Promise.reject(Object.assign(new Error(`Canon does not offer ${method}`), { code: METHOD_NOT_FOUND })), "refuseMethod");
+var restoreMethod = /* @__PURE__ */ __name((capabilities) => {
+  if (isRecord(capabilities.sessionCapabilities) && isRecord(capabilities.sessionCapabilities.resume)) return "session/resume";
+  return capabilities.loadSession === true ? "session/load" : void 0;
+}, "restoreMethod");
+async function initialize(link, agent) {
+  const result = await link.call("initialize", {
+    protocolVersion: PROTOCOL,
+    clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
+    clientInfo: { name: "canon-agent", title: "Canon", version: "1" }
+  });
+  if (result.protocolVersion !== PROTOCOL) {
+    throw new Error(`${agent} speaks Agent Client Protocol version ${String(result.protocolVersion)}; the acp driver speaks version ${PROTOCOL}`);
+  }
+  return { capabilities: isRecord(result.agentCapabilities) ? result.agentCapabilities : {}, info: isRecord(result.agentInfo) ? result.agentInfo : {} };
+}
+__name(initialize, "initialize");
+async function checkAcp({ command, args = [], cwd, timeoutMs = 3e4 }) {
+  const child = startAgent(command, args, realpathSync(cwd));
+  const link = stdioRpc(child, { notify: /* @__PURE__ */ __name(() => void 0, "notify"), request: /* @__PURE__ */ __name((method) => refuseMethod(method), "request") }, { name: basename(command), envelope: { jsonrpc: "2.0" } });
+  let timer;
+  try {
+    return await new Promise((resolve3, reject) => {
+      timer = setTimeout(() => reject(new Error(`${command} did not answer the Agent Client Protocol's initialize within ${timeoutMs / 1e3} s`)), timeoutMs);
+      child.once("error", (error) => reject(new Error(`Could not run ${command}: ${error.message}`)));
+      child.once("close", () => reject(new Error(`${command} exited before answering the Agent Client Protocol's initialize`)));
+      initialize(link, command).then(({ capabilities, info }) => resolve3({
+        name: text(info.title) || text(info.name) || basename(command),
+        version: text(info.version),
+        sessionMemory: restoreMethod(capabilities) ? "native" : "none"
+      }), reject);
+    });
+  } finally {
+    clearTimeout(timer);
+    child.stdin?.end();
+    signalAgent(child, "SIGTERM");
+    setTimeout(() => signalAgent(child, "SIGKILL"), KILL_AFTER_MS).unref();
+  }
+}
+__name(checkAcp, "checkAcp");
+var present = /* @__PURE__ */ __name((fields) => Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== null && value !== void 0)), "present");
+var toolIdentity = /* @__PURE__ */ __name((call) => text(call.name) || text(call.title), "toolIdentity");
+function canonTool(call, turn, server, guest) {
+  if (!["", "other"].includes(text(call.kind)) || guest && !text(call.name)) return false;
+  const name = toolIdentity(call).replace(/\W+/g, "_").replace(/^mcp_+/, "");
+  return turn.tools.definitions.some((tool) => name === `${server}_${tool.name}` || name === `${server}__${tool.name}`);
+}
+__name(canonTool, "canonTool");
+function acpDriver(options) {
+  const { command, args = [] } = options;
+  if (options.guestMode !== void 0 && (options.unguardedGuests || !options.guestMode.trim())) {
+    throw new Error("guestMode must name a mode, and cannot go with unguardedGuests");
+  }
+  const cwd = realpathSync(options.cwd);
+  const agent = basename(command);
+  const interruptGraceMs = options.interruptGraceMs ?? 5e3;
+  const framing = withInstructions(SYSTEM, options.instructions);
+  const running = /* @__PURE__ */ new Map();
+  const end = /* @__PURE__ */ __name(async (session) => {
+    const live = running.get(session);
+    if (!live) return;
+    live.close();
+    await live.exited;
+  }, "end");
+  return {
+    name: "acp",
+    capabilities: {
+      sessionMemory: options.sessionMemory ?? "none",
+      ask: ["approve", "choose", "text"],
+      streaming: true,
+      activity: true,
+      tools: true,
+      outboundFiles: { roots: [cwd, realpathSync(tmpdir())] },
+      ownerHistoryOnly: options.guestMode === void 0 && !options.unguardedGuests
+    },
+    async runTurn(turn) {
+      await running.get(turn.session)?.exited;
+      if (turn.signal.aborted) throw turn.signal.reason;
+      const guest = guestTurn(turn);
+      if (guest && options.guestMode === void 0 && !options.unguardedGuests) return { reply: OWNER_ONLY };
+      const child = startAgent(command, args, cwd);
+      let exit = /* @__PURE__ */ __name(() => void 0, "exit");
+      const exited = new Promise((resolve3) => {
+        exit = resolve3;
+      });
+      let killing;
+      let stopping = false;
+      const entry = { close: /* @__PURE__ */ __name(() => {
+        stopping = true;
+        signalAgent(child, "SIGTERM");
+        killing ??= setTimeout(() => signalAgent(child, "SIGKILL"), KILL_AFTER_MS);
+      }, "close"), exited };
+      running.set(turn.session, entry);
+      const server = `${CANON}_${randomBytes(4).toString("hex")}`;
+      return new Promise((resolve3, reject) => {
+        const messages = [];
+        const calls = /* @__PURE__ */ new Map();
+        let sessionId = "";
+        let answering = false;
+        let continues = false;
+        let closed = false;
+        let ended = Promise.resolve();
+        let closing;
+        const visible = /* @__PURE__ */ __name(() => messages.map((message2) => message2.text).filter((part) => part.trim()).join("\n\n"), "visible");
+        const closeLater = /* @__PURE__ */ __name(() => {
+          if (!closed) closing ??= setTimeout(entry.close, interruptGraceMs);
+        }, "closeLater");
+        const finish = /* @__PURE__ */ __name(() => {
+          if (!closed) child.stdin?.end();
+          closeLater();
+        }, "finish");
+        const interrupt = /* @__PURE__ */ __name(() => {
+          if (sessionId && answering) link.notify("session/cancel", { sessionId });
+          closeLater();
+        }, "interrupt");
+        const settle = /* @__PURE__ */ __name((outcome) => {
+          answering = false;
+          finish();
+          if (turn.signal.aborted) reject(turn.signal.reason);
+          else if (outcome instanceof Error) reject(outcome);
+          else resolve3(outcome);
+        }, "settle");
+        const stopGuest = /* @__PURE__ */ __name((what) => {
+          link.notify("session/cancel", { sessionId });
+          entry.close();
+          settle(new DriverSessionError(`${agent} ${what} in a turn holding someone other than the owner's message`));
+        }, "stopGuest");
+        const guard = /* @__PURE__ */ __name((call) => {
+          if (guest && MACHINE_KINDS.has(text(call.kind)) && ["in_progress", "completed"].includes(text(call.status))) stopGuest(`ran a ${text(call.kind)} tool`);
+        }, "guard");
+        const known = /* @__PURE__ */ __name((update2, session) => {
+          const key = JSON.stringify([text(session), text(update2.toolCallId)]);
+          const call = { ...calls.get(key), ...present(update2) };
+          calls.set(key, call);
+          return call;
+        }, "known");
+        const update = /* @__PURE__ */ __name((params) => {
+          const change = isRecord(params.update) ? params.update : {};
+          if (!answering) return;
+          const tool = change.sessionUpdate === "tool_call" || change.sessionUpdate === "tool_call_update";
+          const call = tool ? known(change, params.sessionId) : void 0;
+          if (call) guard(call);
+          if (guest && options.guestMode !== void 0 && change.sessionUpdate === "current_mode_update" && change.currentModeId !== options.guestMode) stopGuest("left its guest mode");
+          if (text(params.sessionId) !== sessionId) return;
+          if (change.sessionUpdate === "agent_message_chunk") {
+            const chunk = isRecord(change.content) && change.content.type === "text" ? text(change.content.text) : "";
+            if (!chunk) return;
+            const id = text(change.messageId);
+            const message2 = id ? messages.find((known2) => known2.id === id) : continues ? messages.at(-1) : void 0;
+            if (message2) message2.text += chunk;
+            else messages.push({ id, text: chunk });
+            continues = true;
+            turn.onText(visible());
+          } else if (call) {
+            if (change.sessionUpdate === "tool_call") continues = false;
+            turn.onActivity({
+              id: text(call.toolCallId),
+              kind: "tool",
+              title: oneLine(text(call.title) || "Use a tool", 120),
+              state: call.status === "completed" ? "done" : call.status === "failed" ? "failed" : "running"
+            });
+          }
+        }, "update");
+        const permission = /* @__PURE__ */ __name(async (params) => {
+          const offered = (Array.isArray(params.options) ? params.options : []).filter(isRecord);
+          const pick = /* @__PURE__ */ __name((kind) => offered.find((option) => option.kind === kind), "pick");
+          const select = /* @__PURE__ */ __name((option) => ({ outcome: option ? { outcome: "selected", optionId: text(option.optionId) } : { outcome: "cancelled" } }), "select");
+          if (turn.signal.aborted) return select(void 0);
+          const allow = pick("allow_once");
+          const refuse = select(pick("reject_once") ?? pick("reject_always"));
+          const call = known(isRecord(params.toolCall) ? params.toolCall : {}, params.sessionId);
+          if (allow && canonTool(call, turn, server, guest)) return select(allow);
+          if (guest || !allow) return refuse;
+          const input = call.rawInput === void 0 || ["{}", "[]", '""', "null"].includes(JSON.stringify(call.rawInput)) ? "" : JSON.stringify(call.rawInput);
+          const title = oneLine(text(call.title) || "Use a tool", 200);
+          const paths = (Array.isArray(call.locations) ? call.locations : []).filter(isRecord).map((location) => text(location.path));
+          const edits = (Array.isArray(call.content) ? call.content : []).filter(isRecord).filter((item) => item.type === "diff").map((item) => `${text(item.path)}
+${text(item.newText)}`);
+          const id = `${text(params.sessionId) === sessionId ? "" : `${text(params.sessionId)}:`}${text(call.toolCallId) || "tool"}`;
+          const verdict = await approve(turn, {
+            id,
+            title,
+            detail: [input, ...paths, ...edits].filter(Boolean).join("\n"),
+            scopeKey: callScope(text(call.kind) || "tool", [toolIdentity(call) || title, input, call.locations ?? null]),
+            allowSession: input !== "" && text(call.name) !== "",
+            // JSON punctuation goes first, so a command given as an argument list reads as one.
+            ...call.kind === "delete" || RISKY.test(input.replace(/[",[\]{}]+/g, " ")) ? { risk: "destructive" } : {}
+          });
+          if (verdict === "stopped" || turn.signal.aborted) return select(void 0);
+          return verdict === "denied" ? refuse : select(allow);
+        }, "permission");
+        const link = stdioRpc(child, {
+          notify: /* @__PURE__ */ __name((method, params) => {
+            if (method === "session/update") update(params);
+          }, "notify"),
+          request: /* @__PURE__ */ __name((method, params) => method === "session/request_permission" ? permission(params) : refuseMethod(method), "request")
+        }, { name: agent, envelope: { jsonrpc: "2.0" } });
+        const gone = /* @__PURE__ */ __name((error) => {
+          if (closed) return;
+          closed = true;
+          clearTimeout(closing);
+          clearTimeout(killing);
+          turn.signal.removeEventListener("abort", interrupt);
+          link.fail(error);
+          settle(error);
+          void ended.then(() => {
+            if (running.get(turn.session) === entry) running.delete(turn.session);
+            exit();
+          });
+        }, "gone");
+        child.once("exit", () => {
+          if (stopping || guest || turn.signal.aborted) {
+            signalAgent(child, "SIGTERM");
+            ended = new Promise((resolve4) => {
+              setTimeout(() => {
+                signalAgent(child, "SIGKILL");
+                resolve4();
+              }, KILL_AFTER_MS);
+            });
+          }
+        });
+        child.once("error", (error) => gone(new Error(`Could not run ${command}: ${error.message}`)));
+        child.once("close", () => gone(new Error(`${agent} exited before finishing the turn`)));
+        turn.signal.addEventListener("abort", interrupt, { once: true });
+        const signInError = /* @__PURE__ */ __name((error) => error.code === AUTH_REQUIRED && !turn.signal.aborted ? new Error(`${agent} needs signing in: run it once yourself, then start this agent again`) : void 0, "signInError");
+        async function openSession(capabilities) {
+          const mcp = isRecord(capabilities.mcpCapabilities) ? capabilities.mcpCapabilities : {};
+          const { url } = turn.tools;
+          const mcpServers = !url ? [] : mcp.http === true ? [{ type: "http", name: server, url, headers: [] }] : [{ name: server, command: process.execPath, args: ["-e", BRIDGE], env: [{ name: "TURN_TOOLS_URL", value: url }] }];
+          const restore = options.sessionMemory === "native" ? restoreMethod(capabilities) : void 0;
+          const saved = restore && turn.state.get(SESSION);
+          if (saved) {
+            const restored = await link.call(restore, { sessionId: saved, cwd, mcpServers }).catch((error) => {
+              throw signInError(error) ?? (turn.signal.aborted ? error : new DriverSessionError(`${agent} could not restore session ${saved}`, { cause: error }));
+            });
+            return { id: saved, fresh: false, keep: false, modes: restored.modes };
+          }
+          const opened = await link.call("session/new", { cwd, mcpServers }).catch((error) => {
+            throw signInError(error) ?? error;
+          });
+          if (!text(opened.sessionId)) throw new Error(`${agent} opened no session`);
+          return { id: text(opened.sessionId), fresh: true, keep: Boolean(restore), modes: opened.modes };
+        }
+        __name(openSession, "openSession");
+        async function applyMode(modes) {
+          if (!options.guestMode) return;
+          const current = isRecord(modes) ? text(modes.currentModeId) : "";
+          if (!turn.state.get(OWNER_MODE) && current) turn.state.set(OWNER_MODE, current);
+          const wanted = guest ? options.guestMode : turn.state.get(OWNER_MODE) ?? current;
+          if (wanted && wanted !== current) {
+            await link.call("session/set_mode", { sessionId, modeId: wanted }).catch((error) => {
+              throw new Error(`${agent} could not enter mode "${wanted}": ${oneLine(error.message, 200)}`);
+            });
+          }
+        }
+        __name(applyMode, "applyMode");
+        void (async () => {
+          const { capabilities } = await initialize(link, agent);
+          const session = await openSession(capabilities);
+          sessionId = session.id;
+          await applyMode(session.modes);
+          if (turn.signal.aborted) return finish();
+          if (session.keep) turn.state.set(SESSION, sessionId);
+          answering = true;
+          const { stopReason } = await link.call("session/prompt", { sessionId, prompt: [
+            { type: "text", text: [...session.fresh ? [framing] : [], ...guest ? [GUEST] : [], turn.prompt].join("\n\n") },
+            ...turn.files.map((file) => ({ type: "resource_link", name: basename(file), uri: pathToFileURL(file).href }))
+          ] });
+          if (stopReason === "end_turn") return settle({ reply: messages.filter((message2) => message2.text.trim()).at(-1)?.text ?? null });
+          settle(new Error(`${agent} ended the turn: ${String(stopReason)}`));
+        })().catch((error) => settle(error instanceof DriverSessionError ? error : new Error(oneLine(error instanceof Error ? error.message : String(error), 300))));
+      });
+    },
+    // New session (and the runner's reset after a stuck turn): the room's process goes; the runner drops the state.
+    reset: end,
+    async close() {
+      await Promise.all([...running.keys()].map(end));
+    }
+  };
+}
+__name(acpDriver, "acpDriver");
+
 // src/drivers/claude.ts
+import { randomUUID } from "node:crypto";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { basename as basename2, dirname as dirname3 } from "node:path";
 var SDK = "@anthropic-ai/claude-agent-sdk";
-var SESSION = "sessionId";
+var SESSION2 = "sessionId";
 var ASK_USER_DIALOG = "permission_ask_user_question";
 var CANON_TOOLS = "mcp__canon__";
 var NOT_OWNER = "Only the agent's owner can let it use tools in this conversation.";
 var OPEN_TOOLS = /* @__PURE__ */ new Set(["AskUserQuestion", "ToolSearch"]);
-var SYSTEM = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. The text of your last message in a turn is posted there as your reply, so put your whole answer in it. Tool approvals and your questions (AskUserQuestion) are put to the people in the conversation. When you have nothing to add, call the no_reply tool instead of answering.";
-var isRecord = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
+var SYSTEM2 = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. The text of your last message in a turn is posted there as your reply, so put your whole answer in it. Tool approvals and your questions (AskUserQuestion) are put to the people in the conversation. When you have nothing to add, call the no_reply tool instead of answering.";
+var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
 var forOwner = /* @__PURE__ */ __name((message2) => message2.isOwner || message2.trustedAgent === true, "forOwner");
-var oneLine = /* @__PURE__ */ __name((text3, max) => {
+var oneLine2 = /* @__PURE__ */ __name((text3, max) => {
   const line = text3.replace(/\s+/g, " ").trim();
   return line.length > max ? `${line.slice(0, max - 1)}\u2026` : line;
 }, "oneLine");
@@ -165,10 +629,10 @@ async function loadClaudeQuery() {
 __name(loadClaudeQuery, "loadClaudeQuery");
 function describeTool(name, input) {
   const label = name.startsWith("mcp__") ? name.split("__").slice(2).join("__") || name : name;
-  const fields = isRecord(input) ? input : {};
+  const fields = isRecord2(input) ? input : {};
   const key = ["description", "command", "file_path", "notebook_path", "pattern", "url", "query", "path"].find((candidate) => typeof fields[candidate] === "string" && fields[candidate].trim() !== "");
-  const detail = key && (key.endsWith("path") ? basename(fields[key]) : fields[key]);
-  return oneLine(detail ? `${label}: ${detail}` : label, 120);
+  const detail = key && (key.endsWith("path") ? basename2(fields[key]) : fields[key]);
+  return oneLine2(detail ? `${label}: ${detail}` : label, 120);
 }
 __name(describeTool, "describeTool");
 function liveReader(turn) {
@@ -194,14 +658,14 @@ function liveReader(turn) {
         else if (event.type === "content_block_delta" && event.delta?.type === "text_delta") append(event.index ?? 0, String(event.delta.text ?? ""));
       } else if (message2.type === "assistant") {
         for (const block of message2.message.content) {
-          if (!isRecord(block) || block.type !== "tool_use" || typeof block.id !== "string") continue;
+          if (!isRecord2(block) || block.type !== "tool_use" || typeof block.id !== "string") continue;
           const title = describeTool(String(block.name), block.input);
           tools.set(block.id, title);
           turn.onActivity({ id: block.id, kind: "tool", title, state: "running" });
         }
       } else if (message2.type === "user" && Array.isArray(message2.message.content)) {
         for (const block of message2.message.content) {
-          if (!isRecord(block) || block.type !== "tool_result" || !tools.has(String(block.tool_use_id))) continue;
+          if (!isRecord2(block) || block.type !== "tool_result" || !tools.has(String(block.tool_use_id))) continue;
           const id = String(block.tool_use_id);
           turn.onActivity({ id, kind: "tool", title: tools.get(id), state: block.is_error === true ? "failed" : "done" });
         }
@@ -219,12 +683,12 @@ function toolScope(toolName, input) {
   return callScope(toolName, toolName.startsWith("mcp__") ? input : Object.fromEntries(Object.entries(input).filter(([key]) => key !== "description")));
 }
 __name(toolScope, "toolScope");
-async function approve(turn, toolName, input, prompt) {
+async function approve2(turn, toolName, input, prompt) {
   const detail = typeof input.command === "string" ? input.command : JSON.stringify(input);
   const answer = await turn.ask({
     kind: "approve",
     id: prompt.toolUseID,
-    title: oneLine(prompt.title || describeTool(toolName, input), 200),
+    title: oneLine2(prompt.title || describeTool(toolName, input), 200),
     scopeKey: toolScope(toolName, input),
     allowSession: prompt.suppressAlwaysAllowRule !== true,
     ...detail && detail !== "{}" ? { detail } : {},
@@ -234,14 +698,14 @@ async function approve(turn, toolName, input, prompt) {
   if (answer.status !== "answered") return { behavior: "deny", message: DECLINED[answer.status] };
   return answer.allow ? { behavior: "allow", updatedInput: input, decisionClassification: answer.scope === "session" ? "user_permanent" : "user_temporary" } : { behavior: "deny", message: "This was not allowed.", decisionClassification: "user_reject" };
 }
-__name(approve, "approve");
+__name(approve2, "approve");
 async function answerQuestions(turn, id, questions, input) {
-  const list = (Array.isArray(questions) ? questions : []).filter(isRecord).slice(0, 4);
+  const list = (Array.isArray(questions) ? questions : []).filter(isRecord2).slice(0, 4);
   if (!list.length) return { behavior: "deny", message: "There was no question to ask." };
   const answers = {};
   for (const [index, question] of list.entries()) {
     const text3 = typeof question.question === "string" ? question.question : "";
-    const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord).map((option) => option.label).filter((label) => typeof label === "string" && label.trim() !== ""))];
+    const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord2).map((option) => option.label).filter((label) => typeof label === "string" && label.trim() !== ""))];
     const askId = list.length > 1 ? `${id}#${index + 1}` : id;
     const request = labels.length ? { kind: "choose", id: askId, question: text3, options: labels.map((label) => ({ id: label, label })), ...question.multiSelect === true ? { multiple: true } : {} } : { kind: "text", id: askId, question: text3, ...question.isSecret === true ? { secret: true } : {} };
     const answer = await turn.ask(request).catch(() => void 0);
@@ -253,10 +717,10 @@ async function answerQuestions(turn, id, questions, input) {
 }
 __name(answerQuestions, "answerQuestions");
 function claudeDriver(options) {
-  const cwd = realpathSync(options.cwd);
+  const cwd = realpathSync2(options.cwd);
   const permissionMode = options.permissionMode ?? "default";
   const interruptGraceMs = options.interruptGraceMs ?? 5e3;
-  const system = withInstructions(SYSTEM, options.instructions);
+  const system = withInstructions(SYSTEM2, options.instructions);
   let loaded;
   const running = /* @__PURE__ */ new Map();
   const end = /* @__PURE__ */ __name(async (session) => {
@@ -274,11 +738,11 @@ function claudeDriver(options) {
     const canUseTool = /* @__PURE__ */ __name(async (toolName, input, prompt) => {
       if (toolName.startsWith(CANON_TOOLS)) return { behavior: "allow", updatedInput: input };
       if (toolName === "AskUserQuestion") return answerQuestions(turn, prompt.toolUseID, input.questions, input);
-      return approve(turn, toolName, input, prompt);
+      return approve2(turn, toolName, input, prompt);
     }, "canUseTool");
     const onUserDialog = /* @__PURE__ */ __name(async (request, { signal }) => {
       if (request.dialogKind !== ASK_USER_DIALOG) return { behavior: "cancelled" };
-      const input = isRecord(request.payload.input) ? request.payload.input : { questions: request.payload.questions };
+      const input = isRecord2(request.payload.input) ? request.payload.input : { questions: request.payload.questions };
       const id = request.toolUseID || typeof request.payload.requestId === "string" && request.payload.requestId || randomUUID();
       const result = await answerQuestions(turn, id, input.questions, input);
       return signal.aborted ? { behavior: "cancelled" } : { behavior: "completed", result };
@@ -296,7 +760,7 @@ function claudeDriver(options) {
       ...resume ? { resume } : {},
       includePartialMessages: true,
       ...turn.tools.url ? { mcpServers: { canon: { type: "http", url: turn.tools.url, alwaysLoad: true } }, allowedTools: ["mcp__canon"] } : {},
-      additionalDirectories: [...new Set(turn.files.map((file) => dirname2(file)))],
+      additionalDirectories: [...new Set(turn.files.map((file) => dirname3(file)))],
       canUseTool,
       onUserDialog,
       supportedDialogKinds: [ASK_USER_DIALOG],
@@ -316,13 +780,13 @@ function claudeDriver(options) {
       streaming: true,
       activity: true,
       tools: true,
-      outboundFiles: { roots: [cwd, realpathSync(tmpdir())] }
+      outboundFiles: { roots: [cwd, realpathSync2(tmpdir2())] }
     },
     async runTurn(turn) {
       await running.get(turn.session)?.exited;
       if (turn.signal.aborted) throw turn.signal.reason;
       const query = await (options.query ? Promise.resolve(options.query) : loaded ??= loadClaudeQuery());
-      const resume = turn.state.get(SESSION);
+      const resume = turn.state.get(SESSION2);
       const native = query({ prompt: turn.prompt, options: queryOptions(turn, resume) });
       let exit = /* @__PURE__ */ __name(() => void 0, "exit");
       const entry = { close: /* @__PURE__ */ __name(() => native.close(), "close"), exited: new Promise((resolve3) => {
@@ -349,7 +813,7 @@ function claudeDriver(options) {
             const message2 = raw;
             if (message2.type === "system" && message2.subtype === "init") started = true;
             const id = message2.session_id;
-            if (typeof id === "string" && id && id !== session) turn.state.set(SESSION, session = id);
+            if (typeof id === "string" && id && id !== session) turn.state.set(SESSION2, session = id);
             reader.read(message2);
             if (message2.type !== "result") continue;
             finished = true;
@@ -359,7 +823,7 @@ function claudeDriver(options) {
               resolve3({ reply: reply.trim() ? reply : null });
             } else {
               const detail = message2.subtype === "success" ? message2.result : message2.errors.join("; ");
-              reject(failed(new Error(`Claude Code ended the turn with ${message2.subtype}${detail ? `: ${oneLine(detail, 300)}` : ""}`)));
+              reject(failed(new Error(`Claude Code ended the turn with ${message2.subtype}${detail ? `: ${oneLine2(detail, 300)}` : ""}`)));
             }
           }
           if (!finished) throw new Error("Claude Code exited without finishing the turn");
@@ -384,8 +848,8 @@ function claudeDriver(options) {
 __name(claudeDriver, "claudeDriver");
 
 // src/drivers/code.ts
-import { realpathSync as realpathSync2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
+import { realpathSync as realpathSync3 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
 function codeDriver(handler, capabilities = {}) {
   return {
     name: "code",
@@ -395,7 +859,7 @@ function codeDriver(handler, capabilities = {}) {
       streaming: true,
       activity: true,
       tools: true,
-      outboundFiles: { roots: [realpathSync2(tmpdir2())] },
+      outboundFiles: { roots: [realpathSync3(tmpdir3())] },
       ...capabilities
     },
     async runTurn(turn) {
@@ -420,16 +884,14 @@ function codeDriver(handler, capabilities = {}) {
 __name(codeDriver, "codeDriver");
 
 // src/drivers/codex.ts
-import { spawn, spawnSync } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
-import { realpathSync as realpathSync3 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename2 } from "node:path";
-import { createInterface } from "node:readline";
+import { spawn as spawn3, spawnSync } from "node:child_process";
+import { realpathSync as realpathSync4 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { basename as basename3 } from "node:path";
 var THREAD = "threadId";
-var CANON = "canon";
+var CANON2 = "canon";
 var API_KEY_PROVIDER = "canon_openai_api_key";
-var SYSTEM2 = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. Your final message in a turn is posted there as your reply, so put your whole answer in it. Approval requests are put to the people in the conversation. To ask them a question, call the ask_question tool of the canon MCP server and wait for its answer. When you have nothing to add, call the no_reply tool of the canon MCP server instead of answering.";
+var SYSTEM3 = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. Your final message in a turn is posted there as your reply, so put your whole answer in it. Approval requests are put to the people in the conversation. To ask them a question, call the ask_question tool of the canon MCP server and wait for its answer. When you have nothing to add, call the no_reply tool of the canon MCP server instead of answering.";
 var CANON_TOOL_TIMEOUT_SEC = 2 * 60 * 60;
 var MACHINE_FEATURES = [
   "shell_tool",
@@ -466,18 +928,11 @@ var GUEST_ITEMS = /* @__PURE__ */ new Set([
   "sleep"
 ]);
 var OWN_LISTINGS = /* @__PURE__ */ new Set(["list_mcp_resources", "list_mcp_resource_templates"]);
-var GUEST = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: you cannot read files, run commands or use any tool but the canon MCP server's. Answer from the conversation and what you already know, and say so when something needs your owner.";
-var RISKY = /\brm\s+-[a-z]*[rf]|\bgit\s+(reset\s+--hard|push\s+(-f|--force))|\bdrop\s+(table|database)\b|\bmkfs\b|\bdd\s+if=/i;
+var GUEST2 = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: you cannot read files, run commands or use any tool but the canon MCP server's. Answer from the conversation and what you already know, and say so when something needs your owner.";
 var IMAGE = /\.(png|jpe?g|gif|webp)$/i;
-var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
-var guestTurn = /* @__PURE__ */ __name((turn) => !turn.input.messages.every((message2) => message2.isOwner || message2.trustedAgent === true), "guestTurn");
-var text = /* @__PURE__ */ __name((value) => typeof value === "string" ? value : "", "text");
-var oneLine2 = /* @__PURE__ */ __name((value, max) => {
-  const line = value.replace(/\s+/g, " ").trim();
-  return line.length > max ? `${line.slice(0, max - 1)}\u2026` : line;
-}, "oneLine");
 function checkCodex(codexPath = "codex") {
-  const result = spawnSync(codexPath, ["--version"], { encoding: "utf8" });
+  const cli = installedCli(codexPath);
+  const result = spawnSync(cli.file, [...cli.args, "--version"], { encoding: "utf8", windowsHide: true });
   if (result.status !== 0) {
     throw new Error(`The codex driver needs the Codex CLI (npm install -g @openai/codex) or --codex-path: ${result.error?.message ?? text(result.stderr).trim()}`);
   }
@@ -485,20 +940,20 @@ function checkCodex(codexPath = "codex") {
 }
 __name(checkCodex, "checkCodex");
 function describe(item) {
-  const paths = (Array.isArray(item.changes) ? item.changes : []).filter(isRecord2).map((change) => basename2(text(change.path)));
+  const paths = (Array.isArray(item.changes) ? item.changes : []).filter(isRecord).map((change) => basename3(text(change.path)));
   switch (item.type) {
     case "commandExecution": {
-      const actions = (Array.isArray(item.commandActions) ? item.commandActions : []).filter(isRecord2).map((action) => text(action.command));
-      return oneLine2(actions.filter(Boolean).join(" && ") || text(item.command) || "Run a command", 120);
+      const actions = (Array.isArray(item.commandActions) ? item.commandActions : []).filter(isRecord).map((action) => text(action.command));
+      return oneLine(actions.filter(Boolean).join(" && ") || text(item.command) || "Run a command", 120);
     }
     case "fileChange":
-      return oneLine2(paths.length ? `Edit ${paths.join(", ")}` : "Edit files", 120);
+      return oneLine(paths.length ? `Edit ${paths.join(", ")}` : "Edit files", 120);
     case "mcpToolCall":
       return `${text(item.server)}: ${text(item.tool)}`;
     case "webSearch":
-      return oneLine2(`Search the web${text(item.query) ? `: ${text(item.query)}` : ""}`, 120);
+      return oneLine(`Search the web${text(item.query) ? `: ${text(item.query)}` : ""}`, 120);
     case "imageView":
-      return `View ${basename2(text(item.path))}`;
+      return `View ${basename3(text(item.path))}`;
     case "dynamicToolCall":
       return text(item.tool) || "Tool";
     default:
@@ -506,27 +961,19 @@ function describe(item) {
   }
 }
 __name(describe, "describe");
-async function approve2(turn, request) {
-  const asked = createHash2("sha256").update(JSON.stringify([request.scopeKey, request.title, request.detail])).digest("hex").slice(0, 12);
-  const answer = await turn.ask({ kind: "approve", ...request, id: `${request.id}#${asked}` }).catch(() => void 0);
-  if (!answer) return "stopped";
-  if (answer.status !== "answered" || !answer.allow) return "denied";
-  return answer.scope === "session" ? "session" : "once";
-}
-__name(approve2, "approve");
 var DECISION = { session: "acceptForSession", once: "accept", denied: "decline", stopped: "cancel" };
 async function answerCodexRequest(turn, method, params, items, rpcId) {
   const id = text(params.approvalId) || text(params.itemId) || text(params.elicitationId) || `request-${String(rpcId)}`;
   if (method === "item/commandExecution/requestApproval") {
     const command = text(params.command);
     const stdin = params.kind === "writeStdin";
-    const network = isRecord2(params.networkApprovalContext) ? params.networkApprovalContext : void 0;
-    const parsed = (Array.isArray(params.commandActions) ? params.commandActions : []).filter(isRecord2).map((action) => text(action.command)).filter(Boolean);
+    const network = isRecord(params.networkApprovalContext) ? params.networkApprovalContext : void 0;
+    const parsed = (Array.isArray(params.commandActions) ? params.commandActions : []).filter(isRecord).map((action) => text(action.command)).filter(Boolean);
     const destination = network && `${text(network.host)}${text(network.protocol) ? ` (${text(network.protocol)})` : ""}`;
     const scope = callScope("exec", [command, text(params.cwd), network ?? null, params.additionalPermissions ?? null]);
-    const verdict = await approve2(turn, {
+    const verdict = await approve(turn, {
       id,
-      title: oneLine2(text(params.reason) || (command ? `${stdin ? "Send input to" : "Run"}: ${parsed.join(" && ") || command}` : `Allow network access to ${destination || "the network"}`), 200),
+      title: oneLine(text(params.reason) || (command ? `${stdin ? "Send input to" : "Run"}: ${parsed.join(" && ") || command}` : `Allow network access to ${destination || "the network"}`), 200),
       detail: [
         command,
         text(params.cwd) && `in ${text(params.cwd)}`,
@@ -541,24 +988,24 @@ async function answerCodexRequest(turn, method, params, items, rpcId) {
     return { decision: DECISION[verdict] };
   }
   if (method === "item/fileChange/requestApproval") {
-    const changes = (Array.isArray(items.get(text(params.itemId))?.changes) ? items.get(text(params.itemId)).changes : []).filter(isRecord2);
+    const changes = (Array.isArray(items.get(text(params.itemId))?.changes) ? items.get(text(params.itemId)).changes : []).filter(isRecord);
     const paths = [...new Set(changes.map((change) => text(change.path)))].sort();
-    const verdict = await approve2(turn, {
+    const verdict = await approve(turn, {
       id,
-      title: oneLine2(text(params.reason) || (paths.length ? `Edit ${paths.map((path) => basename2(path)).join(", ")}` : "Edit files"), 200),
+      title: oneLine(text(params.reason) || (paths.length ? `Edit ${paths.map((path) => basename3(path)).join(", ")}` : "Edit files"), 200),
       detail: [...changes.map((change) => `${text(change.path)}
 ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text(params.grantRoot)}`].filter(Boolean).join("\n\n"),
       scopeKey: callScope("apply_patch", paths),
       allowSession: paths.length > 0 && !params.grantRoot,
-      ...changes.some((change) => isRecord2(change.kind) && change.kind.type === "delete") ? { risk: "destructive" } : {}
+      ...changes.some((change) => isRecord(change.kind) && change.kind.type === "delete") ? { risk: "destructive" } : {}
     });
     return { decision: DECISION[verdict] };
   }
   if (method === "item/permissions/requestApproval") {
-    const permissions = isRecord2(params.permissions) ? params.permissions : {};
-    const verdict = await approve2(turn, {
+    const permissions = isRecord(params.permissions) ? params.permissions : {};
+    const verdict = await approve(turn, {
       id,
-      title: oneLine2(text(params.reason) || "Allow Codex more access", 200),
+      title: oneLine(text(params.reason) || "Allow Codex more access", 200),
       detail: JSON.stringify(permissions),
       scopeKey: callScope("permissions", permissions),
       allowSession: true
@@ -566,16 +1013,16 @@ ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text
     return verdict === "session" || verdict === "once" ? { permissions, scope: verdict === "session" ? "session" : "turn" } : { permissions: {}, scope: "turn" };
   }
   if (method === "mcpServer/elicitation/request") {
-    const meta = isRecord2(params._meta) ? params._meta : {};
+    const meta = isRecord(params._meta) ? params._meta : {};
     if (meta.codex_approval_kind !== "mcp_tool_call") return { action: "decline", content: null, _meta: null };
     const server = text(params.serverName);
     const named = text(meta.call_id) || text(meta.callId);
     const running = [...items.values()].filter((item) => item.type === "mcpToolCall" && item.server === server && item.status === "inProgress");
     const call = named ? items.get(named) : running.length === 1 ? running[0] : void 0;
     const tool = call && call.server === server ? text(call.tool) : "";
-    const verdict = await approve2(turn, {
+    const verdict = await approve(turn, {
       id: `mcp-${String(rpcId)}`,
-      title: oneLine2(text(params.message) || `Use ${server}${tool ? `: ${tool}` : ""}`, 200),
+      title: oneLine(text(params.message) || `Use ${server}${tool ? `: ${tool}` : ""}`, 200),
       detail: JSON.stringify(meta.tool_params ?? call?.arguments ?? {}),
       scopeKey: `codex:mcp:${server}:${tool}`,
       allowSession: tool !== ""
@@ -587,10 +1034,10 @@ ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text
     };
   }
   if (method === "item/tool/requestUserInput") {
-    const questions = (Array.isArray(params.questions) ? params.questions : []).filter(isRecord2);
+    const questions = (Array.isArray(params.questions) ? params.questions : []).filter(isRecord);
     const answers = {};
     for (const [index, question] of questions.entries()) {
-      const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord2).map((option) => text(option.label)).filter(Boolean))];
+      const labels = [...new Set((Array.isArray(question.options) ? question.options : []).filter(isRecord).map((option) => text(option.label)).filter(Boolean))];
       const askId = questions.length > 1 ? `${id}#${index + 1}` : id;
       const ask = labels.length ? { kind: "choose", id: askId, question: text(question.question), options: labels.map((label) => ({ id: label, label })) } : { kind: "text", id: askId, question: text(question.question), ...question.isSecret === true ? { secret: true } : {} };
       const answer = await turn.ask(ask).catch(() => void 0);
@@ -602,55 +1049,11 @@ ${text(change.diff)}`.trim()), text(params.grantRoot) && `Write access to ${text
   throw new Error(`The codex driver does not handle ${method}`);
 }
 __name(answerCodexRequest, "answerCodexRequest");
-function rpc(child, handlers) {
-  let next = 0;
-  const pending = /* @__PURE__ */ new Map();
-  const write = /* @__PURE__ */ __name((message2) => {
-    if (child.stdin?.writable) child.stdin.write(`${JSON.stringify(message2)}
-`);
-  }, "write");
-  child.stdin?.on("error", () => void 0);
-  createInterface({ input: child.stdout }).on("error", () => void 0).on("line", (line) => {
-    let message2;
-    try {
-      message2 = JSON.parse(line);
-    } catch {
-      return;
-    }
-    if (!isRecord2(message2)) return;
-    const params = isRecord2(message2.params) ? message2.params : {};
-    if (typeof message2.method !== "string") {
-      const waiting = pending.get(Number(message2.id));
-      pending.delete(Number(message2.id));
-      if (isRecord2(message2.error)) waiting?.reject(new Error(text(message2.error.message) || "Codex refused the request"));
-      else waiting?.resolve(message2.result);
-    } else if (message2.id !== void 0) {
-      handlers.request(message2.method, params, message2.id).then(
-        (result) => write({ id: message2.id, result }),
-        (error) => write({ id: message2.id, error: { code: -32e3, message: error instanceof Error ? error.message : String(error) } })
-      );
-    } else handlers.notify(message2.method, params);
-  });
-  child.stderr?.resume();
-  return {
-    call: /* @__PURE__ */ __name((method, params) => new Promise((resolve3, reject) => {
-      next += 1;
-      pending.set(next, { resolve: /* @__PURE__ */ __name((value) => resolve3(isRecord2(value) ? value : {}), "resolve"), reject });
-      write({ id: next, method, params });
-    }), "call"),
-    notify: /* @__PURE__ */ __name((method) => write({ method }), "notify"),
-    fail(error) {
-      for (const waiting of pending.values()) waiting.reject(error);
-      pending.clear();
-    }
-  };
-}
-__name(rpc, "rpc");
 function codexDriver(options) {
-  const cwd = realpathSync3(options.cwd);
+  const cwd = realpathSync4(options.cwd);
   const codexPath = options.codexPath ?? "codex";
   const interruptGraceMs = options.interruptGraceMs ?? 5e3;
-  const developerInstructions = withInstructions(SYSTEM2, options.instructions);
+  const developerInstructions = withInstructions(SYSTEM3, options.instructions);
   const running = /* @__PURE__ */ new Map();
   const end = /* @__PURE__ */ __name(async (session) => {
     const live = running.get(session);
@@ -661,8 +1064,8 @@ function codexDriver(options) {
   async function threadSettings(turn, call, env) {
     const guest = guestTurn(turn);
     const configured = (await call("config/read", { cwd })).config;
-    const settings = isRecord2(configured) ? configured : {};
-    const servers = guest && isRecord2(settings.mcp_servers) ? Object.keys(settings.mcp_servers).filter((name) => name !== CANON) : [];
+    const settings = isRecord(configured) ? configured : {};
+    const servers = guest && isRecord(settings.mcp_servers) ? Object.keys(settings.mcp_servers).filter((name) => name !== CANON2) : [];
     const apiKey = Boolean(env.OPENAI_API_KEY) && [void 0, null, "openai"].includes(settings.model_provider);
     return {
       cwd,
@@ -675,7 +1078,7 @@ function codexDriver(options) {
       config: {
         mcp_servers: {
           ...Object.fromEntries(servers.map((name) => [name, { enabled: false }])),
-          ...turn.tools.url ? { [CANON]: { url: turn.tools.url, default_tools_approval_mode: "approve", tool_timeout_sec: CANON_TOOL_TIMEOUT_SEC } } : {}
+          ...turn.tools.url ? { [CANON2]: { url: turn.tools.url, default_tools_approval_mode: "approve", tool_timeout_sec: CANON_TOOL_TIMEOUT_SEC } } : {}
         },
         // Questions go through Canon's ask_question alone: Codex's own request_user_input outside plan mode (a feature
         // still under development) stays off even when the owner's configuration turns it on, so Codex never has two.
@@ -699,20 +1102,21 @@ function codexDriver(options) {
       streaming: true,
       activity: true,
       tools: true,
-      outboundFiles: { roots: [cwd, realpathSync3(tmpdir3())] }
+      outboundFiles: { roots: [cwd, realpathSync4(tmpdir4())] }
     },
     async runTurn(turn) {
       await running.get(turn.session)?.exited;
       if (turn.signal.aborted) throw turn.signal.reason;
       const guest = guestTurn(turn);
       const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("CANON_")));
-      const child = spawn(codexPath, ["app-server", "--listen", "stdio://"], { cwd, env, stdio: ["pipe", "pipe", "pipe"] });
+      const cli = installedCli(codexPath);
+      const child = spawn3(cli.file, [...cli.args, "app-server", "--listen", "stdio://"], { cwd, env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
       let exit = /* @__PURE__ */ __name(() => void 0, "exit");
       const exited = new Promise((resolve3) => {
         exit = resolve3;
       });
       const entry = { close: /* @__PURE__ */ __name(() => {
-        child.kill("SIGTERM");
+        stopCli(child);
       }, "close"), exited };
       running.set(turn.session, entry);
       return new Promise((resolve3, reject) => {
@@ -749,19 +1153,19 @@ function codexDriver(options) {
           const all = [...messages.values()];
           const reply = (all.filter((message2) => message2.done && message2.final).at(-1) ?? all.filter((message2) => message2.done).at(-1) ?? all.at(-1))?.text ?? "";
           if (ended.status === "completed") return settle({ reply: reply.trim() ? reply : null });
-          const detail = isRecord2(ended.error) ? text(ended.error.message) : failure;
-          settle(new Error(`Codex ended the turn ${ended.status === "interrupted" ? "interrupted" : `with an error${detail ? `: ${oneLine2(detail, 300)}` : ""}`}`));
+          const detail = isRecord(ended.error) ? text(ended.error.message) : failure;
+          settle(new Error(`Codex ended the turn ${ended.status === "interrupted" ? "interrupted" : `with an error${detail ? `: ${oneLine(detail, 300)}` : ""}`}`));
         }, "conclude");
         const guard = /* @__PURE__ */ __name((item) => {
-          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && (item.server === CANON || item.server === "codex" && OWN_LISTINGS.has(text(item.tool)))) return;
+          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && (item.server === CANON2 || item.server === "codex" && OWN_LISTINGS.has(text(item.tool)))) return;
           interrupt();
           entry.close();
           const what = item.type === "mcpToolCall" ? `mcpToolCall (${describe(item)})` : text(item.type) || "an unknown item";
           settle(new DriverSessionError(`Codex started ${what} in a turn holding someone other than the owner's message`));
         }, "guard");
-        const link = rpc(child, {
+        const link = stdioRpc(child, {
           notify(method, params) {
-            const item = isRecord2(params.item) ? params.item : void 0;
+            const item = isRecord(params.item) ? params.item : void 0;
             if (item && method === "item/started") guard(item);
             if (item) items.set(text(item.id), item);
             if (!ours(params)) return;
@@ -777,15 +1181,15 @@ function codexDriver(options) {
               const title = describe(item);
               const state = method === "item/started" ? "running" : item.status === "failed" || item.status === "declined" ? "failed" : "done";
               if (title) turn.onActivity({ id: text(item.id), kind: "tool", title, state });
-            } else if (method === "error" && params.willRetry !== true && isRecord2(params.error)) {
+            } else if (method === "error" && params.willRetry !== true && isRecord(params.error)) {
               failure = text(params.error.message);
-            } else if (method === "turn/completed" && isRecord2(params.turn)) {
+            } else if (method === "turn/completed" && isRecord(params.turn)) {
               completed.set(text(params.turn.id), params.turn);
               conclude();
             }
           },
           request: /* @__PURE__ */ __name((method, params, id) => answerCodexRequest(turn, method, params, items, id), "request")
-        });
+        }, { name: "Codex" });
         const gone = /* @__PURE__ */ __name((error) => {
           if (closed) return;
           closed = true;
@@ -811,18 +1215,18 @@ function codexDriver(options) {
             threadId = resume;
           } else {
             const started2 = await link.call("thread/start", settings);
-            threadId = isRecord2(started2.thread) ? text(started2.thread.id) : "";
+            threadId = isRecord(started2.thread) ? text(started2.thread.id) : "";
             if (!threadId) throw new Error("Codex started no thread");
             turn.state.set(THREAD, threadId);
           }
           if (turn.signal.aborted) return finish();
           const started = await link.call("turn/start", { threadId, input: [
-            ...guest ? [{ type: "text", text: GUEST, text_elements: [] }] : [],
+            ...guest ? [{ type: "text", text: GUEST2, text_elements: [] }] : [],
             { type: "text", text: turn.prompt, text_elements: [] },
             // Images go to the model as images; every attachment's path is also in the prompt for Codex to read.
             ...turn.files.filter((file) => IMAGE.test(file)).map((path) => ({ type: "localImage", path }))
           ] });
-          nativeTurn = isRecord2(started.turn) ? text(started.turn.id) : "";
+          nativeTurn = isRecord(started.turn) ? text(started.turn.id) : "";
           if (!nativeTurn) throw new Error("Codex started no turn");
           if (turn.signal.aborted) interrupt();
           conclude();
@@ -1010,117 +1414,10 @@ function connectorDriver() {
 }
 __name(connectorDriver, "connectorDriver");
 
-// src/runner/home.ts
-import { randomBytes } from "node:crypto";
-import { closeSync, constants as constants2, fstatSync, fsyncSync, linkSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync, writeSync } from "node:fs";
-import { lstat, mkdir, realpath as realpath2 } from "node:fs/promises";
-import { dirname as dirname3 } from "node:path";
-var runnerLockName = /* @__PURE__ */ __name((environmentId, agentId) => `runner-${environmentId}-${agentId}`.replace(/[^\w.-]/g, "_"), "runnerLockName");
-function writeDurable(file, text3) {
-  const directory = dirname3(file);
-  const created = mkdirSync(directory, { recursive: true, mode: 448 });
-  const temporary = `${file}.${process.pid}.tmp`;
-  const fd = openSync(temporary, "w", 384);
-  try {
-    writeFileSync(fd, text3);
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  renameSync(temporary, file);
-  if (process.platform === "win32") return;
-  const last = created ? dirname3(created) : directory;
-  for (let path = directory; ; path = dirname3(path)) {
-    const dir = openSync(path, "r");
-    try {
-      fsyncSync(dir);
-    } finally {
-      closeSync(dir);
-    }
-    if (path === last) break;
-  }
-}
-__name(writeDurable, "writeDurable");
-function privateKey(file, bytes = 32) {
-  const refuse = /* @__PURE__ */ __name(() => {
-    throw new Error(`Refusing to start: ${file} must be a regular file of ${bytes} bytes, owned by this user and private to it (0600).`);
-  }, "refuse");
-  const read = /* @__PURE__ */ __name(() => {
-    let fd2;
-    try {
-      fd2 = openSync(file, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
-    } catch (error) {
-      return error.code === "ENOENT" ? void 0 : refuse();
-    }
-    try {
-      const info = fstatSync(fd2);
-      const uid = process.getuid?.();
-      if (!info.isFile() || info.size !== bytes || uid !== void 0 && (info.uid !== uid || (info.mode & 63) !== 0)) refuse();
-      const key = Buffer.alloc(bytes);
-      if (readSync(fd2, key, 0, bytes, 0) !== bytes) refuse();
-      return key;
-    } finally {
-      closeSync(fd2);
-    }
-  }, "read");
-  const existing = read();
-  if (existing) return existing;
-  const directory = dirname3(file);
-  mkdirSync(directory, { recursive: true, mode: 448 });
-  const temporary = `${file}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
-  const fd = openSync(temporary, "wx", 384);
-  try {
-    writeSync(fd, randomBytes(bytes));
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  try {
-    linkSync(temporary, file);
-  } catch (error) {
-    if (error.code !== "EEXIST") throw error;
-  } finally {
-    rmSync(temporary, { force: true });
-  }
-  const dir = openSync(directory, "r");
-  try {
-    fsyncSync(dir);
-  } finally {
-    closeSync(dir);
-  }
-  return read() ?? refuse();
-}
-__name(privateKey, "privateKey");
-async function assertPrivateHome(home) {
-  const uid = process.getuid?.();
-  if (uid === void 0) return;
-  const fail2 = /* @__PURE__ */ __name((path, problem) => {
-    throw new Error(`Refusing to start: ${path} ${problem}. CANON_HOME must be a private 0700 directory whose ancestors only its owner or root can modify.`);
-  }, "fail");
-  await mkdir(home, { recursive: true, mode: 448 }).catch(() => void 0);
-  let resolved;
-  try {
-    resolved = await realpath2(home);
-  } catch {
-    return fail2(home, "does not exist");
-  }
-  if (resolved !== home) fail2(home, `is not canonical (it resolves to ${resolved})`);
-  const stat3 = await lstat(home);
-  if (!stat3.isDirectory() || stat3.uid !== uid) fail2(home, "is not a directory owned by this user");
-  if (stat3.mode & 63) fail2(home, `is accessible to other users (mode ${(stat3.mode & 511).toString(8)})`);
-  for (let path = dirname3(home); ; path = dirname3(path)) {
-    const ancestor = await lstat(path);
-    if (ancestor.uid !== uid && ancestor.uid !== 0) fail2(path, "is owned by another user");
-    if (ancestor.mode & 18) fail2(path, "is writable by other users");
-    if (path === dirname3(path)) return;
-  }
-}
-__name(assertPrivateHome, "assertPrivateHome");
-
 // src/runner/errands.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { closeSync as closeSync2, constants as constants3, fstatSync as fstatSync2, lstatSync, mkdirSync as mkdirSync2, openSync as openSync2, readdirSync, readFileSync, unlinkSync, watch } from "node:fs";
-import { join } from "node:path";
+import { closeSync, constants as constants2, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync as readFileSync2, unlinkSync, watch } from "node:fs";
+import { join as join2 } from "node:path";
 var ERRAND_KINDS = ["tell", "post", "errand", "cancel"];
 var ERRAND_TEXT_MAX_BYTES = MLS_DEV_TEXT_MAX_BYTES;
 var ERRAND_WHY_MAX_BYTES = 4 * 1024;
@@ -1138,7 +1435,7 @@ function errandsDirectory(home, environmentId, agentId) {
   for (const segment of [environmentId, agentId]) {
     if (!/^[\w.:-]{1,200}$/.test(segment) || /^\.+$/.test(segment)) throw new Error(`Not an id: ${JSON.stringify(segment)}`);
   }
-  return join(home, "runner", environmentId, agentId, "errands");
+  return join2(home, "runner", environmentId, agentId, "errands");
 }
 __name(errandsDirectory, "errandsDirectory");
 function custody(stat3, kind) {
@@ -1154,8 +1451,8 @@ function custody(stat3, kind) {
 }
 __name(custody, "custody");
 function errandInbox(directory) {
-  const inbox = join(directory, "inbox");
-  mkdirSync2(inbox, { recursive: true, mode: 448 });
+  const inbox = join2(directory, "inbox");
+  mkdirSync(inbox, { recursive: true, mode: 448 });
   const problem = custody(lstatSync(inbox), "directory");
   if (problem) throw new Error(`The errand inbox ${inbox} ${problem}`);
   return inbox;
@@ -1188,16 +1485,16 @@ function queueErrand(directory, input) {
   const command = { version: 1, id: randomBytes2(16).toString("hex"), ...fields, createdAt: now.toISOString() };
   const problem = commandProblem(command, command.id);
   if (problem) throw new Error(`Not a valid ${input.kind}: ${problem}.`);
-  writeDurable(join(errandInbox(directory), `${now.getTime()}-${command.id}.json`), JSON.stringify(command));
+  writeDurable(join2(errandInbox(directory), `${now.getTime()}-${command.id}.json`), JSON.stringify(command));
   return command;
 }
 __name(queueErrand, "queueErrand");
 function errandJournal(directory) {
-  const folder = join(directory, "journal");
-  const file = /* @__PURE__ */ __name((id) => join(folder, `${id}.json`), "file");
+  const folder = join2(directory, "journal");
+  const file = /* @__PURE__ */ __name((id) => join2(folder, `${id}.json`), "file");
   const read = /* @__PURE__ */ __name((path) => {
     try {
-      return JSON.parse(readFileSync(path, "utf8"));
+      return JSON.parse(readFileSync2(path, "utf8"));
     } catch {
       return void 0;
     }
@@ -1219,7 +1516,7 @@ function errandJournal(directory) {
         names = readdirSync(folder);
       } catch {
       }
-      return names.filter((name) => /^[0-9a-f]{32}\.json$/.test(name)).flatMap((name) => read(join(folder, name)) ?? []);
+      return names.filter((name) => /^[0-9a-f]{32}\.json$/.test(name)).flatMap((name) => read(join2(folder, name)) ?? []);
     }
   };
 }
@@ -1244,24 +1541,24 @@ __name(awaitErrand, "awaitErrand");
 function readCommand(path, id) {
   let fd;
   try {
-    fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+    fd = openSync(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
   } catch (error) {
     const code = error.code;
     return { problem: code === "ELOOP" || code === "EMLINK" ? "is a symbolic link" : `cannot be opened (${code})` };
   }
   try {
-    const problem = custody(fstatSync2(fd), "file");
+    const problem = custody(fstatSync(fd), "file");
     if (problem) return { problem };
     let value;
     try {
-      value = JSON.parse(readFileSync(fd, "utf8"));
+      value = JSON.parse(readFileSync2(fd, "utf8"));
     } catch {
       return { problem: "is not JSON" };
     }
     const invalid2 = commandProblem(value, id);
     return invalid2 ? { problem: `is not a valid command: ${invalid2}` } : value;
   } finally {
-    closeSync2(fd);
+    closeSync(fd);
   }
 }
 __name(readCommand, "readCommand");
@@ -1286,7 +1583,7 @@ function watchErrandInbox(directory, handler, options) {
 ${name}`, `Errands: ${name} in the inbox is not a command file; it is left alone.`);
         continue;
       }
-      const path = join(inbox, name);
+      const path = join2(inbox, name);
       try {
         if (handler.taken(id) || await handler.take(id, readCommand(path, id))) unlinkSync(path);
       } catch (error) {
@@ -1336,8 +1633,8 @@ __name(watchErrandInbox, "watchErrandInbox");
 
 // src/runner/mls.ts
 import { createHash as createHash4, createHmac } from "node:crypto";
-import { constants as constants4 } from "node:fs";
-import { open as open2, realpath as realpath3 } from "node:fs/promises";
+import { constants as constants3 } from "node:fs";
+import { open as open2, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute, resolve } from "node:path";
 var fail = /* @__PURE__ */ __name(() => {
   throw new Error("MLS_AUTHORITY_REQUIRED");
@@ -1402,7 +1699,7 @@ function createMlsIds(key) {
 }
 __name(createMlsIds, "createMlsIds");
 function requireMlsSupport(input) {
-  if (!isMlsEnvironmentId(input.environmentId) || input.agent.outboundPolicy === "closed") fail();
+  if (!isMlsEnvironmentId(input.environmentId)) fail();
 }
 __name(requireMlsSupport, "requireMlsSupport");
 function mentionsAgent(text3, names) {
@@ -1453,8 +1750,8 @@ function object(value, required, optional = []) {
 __name(object, "object");
 async function loadMlsDevConfiguration(filePath, input) {
   if (!isMlsEnvironmentId(input.environmentId)) invalid();
-  if (typeof filePath !== "string" || !isAbsolute(filePath) || filePath.includes("\0") || resolve(filePath) !== filePath || await realpath3(filePath).catch(() => "") !== filePath) invalid();
-  const file = await open2(filePath, constants4.O_RDONLY | constants4.O_NOFOLLOW).catch(() => invalid());
+  if (typeof filePath !== "string" || !isAbsolute(filePath) || filePath.includes("\0") || resolve(filePath) !== filePath || await realpath2(filePath).catch(() => "") !== filePath) invalid();
+  const file = await open2(filePath, constants3.O_RDONLY | constants3.O_NOFOLLOW).catch(() => invalid());
   let value;
   try {
     const before = await file.stat();
@@ -1462,7 +1759,7 @@ async function loadMlsDevConfiguration(filePath, input) {
     const bytes = Buffer.alloc(MAX_CONFIGURATION_BYTES + 1);
     const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
     const after = await file.stat();
-    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || await realpath3(filePath) !== filePath) invalid();
+    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || await realpath2(filePath) !== filePath) invalid();
     value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, bytesRead)));
   } catch {
     invalid();
@@ -1582,14 +1879,14 @@ __name(runMlsDevSetup, "runMlsDevSetup");
 
 // src/runner/mls-bundled.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join2 } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // mls-custody.json
 var mls_custody_default = {
   schemaVersion: 1,
-  release: "mls-custody-cadb937436ce",
+  release: "mls-custody-5ce777037493",
   protocolVersion: 1,
   rustVersion: "rustc 1.91.0 (f8297e351 2025-10-28)",
   sourceHashes: {
@@ -1601,15 +1898,15 @@ var mls_custody_default = {
     "mls/native/src/portable/json.rs": "d4e68556a051ffe9008686036597b1fd8239ae66fad67bd848c3f0e16bf8ccaf",
     "mls/native/src/portable/vault.rs": "14b9ff1e10ec4058e39a46511a489c7e82a9836e4175a768ac5d4b69c1dba8e5",
     "mls/native/src/portable/tests.rs": "7eadba2a49ed044470bb567d9b93fba44b64dc117b1da50a22187cff3dccb64e",
-    "mls/native/portable/build.mjs": "84c422a8a8aa6a7ec112a358bdeef080201aa4ea9a91f6d5726b05f46fa2a10c",
+    "mls/native/portable/build.mjs": "ec81bfe27238b3117c4e855fa58b323e18a935ad7aa8ac18807376fb0bddc99b",
     "mls/core/open.rs": "8cdc03882f3b84dca72ab06afd437f162de01a0fe21327b019f17867dd59f5d0",
     "mls/core/protocol.rs": "7f3e021d6e4f1cc130b5dd3c98e0b0fa23edf813c72802c3fa3f8fb9e431c947",
     "mls/core/fault_storage.rs": "fdd6672a21f6ffee657142755637824541a5090b4f8a5fb4902f482556fb2793",
     "mls/core/mls_environment.rs": "390d11ee82ef8b108a7fffc7bb193ac7f3e470aa14e9643d029007aaaa29c4e4",
-    "mls/core/dev_identity.rs": "97df6bdb9daab66f0e3d4ca3b49bf9954fa06ac032c927d9ae6c83509b0166bd",
-    "mls/core/dev_key_package.rs": "3e7011fe8ab3044d80d84d04944068dbcf683141fcaba8a7a00bd2cfd103de72",
+    "mls/core/dev_identity.rs": "df7282f0daa8babb3a9b9f397ad65d621784f9f54f5ca7a45fb3c8e82d58bbb1",
+    "mls/core/dev_key_package.rs": "e8956f8dd4e365c22ac2356fb520759cdb613e344e1d44510ceee54b1cf9a418",
     "mls/core/dev_application.rs": "fafe245ace38e384da265bab2c12fef6b77c86b2c20477d00563ab891a54f94b",
-    "mls/core/dev_group.rs": "1d519a5d15394bbc163aef00e0ddacb9bb87631beaf8a13e52c76d628749152b",
+    "mls/core/dev_group.rs": "d43f9ecdae79effdb9f177e76108487f81618dfc5b72b63618c41eff5896b2e0",
     "packages/test-fixtures/src/mlsDevEnrollmentProofV1.json": "50d7896e0a3a25b420412e84484e64f1e49480a3f298ee2d125f2f9188382810",
     "packages/test-fixtures/src/mlsDevCredentialV1.json": "24cd23af794b8a6e35caf050995020c6584b806de060969db4536f44b1188780",
     "packages/test-fixtures/src/mlsDevCredentialReconciliationV1.json": "bd4bbb3a2e5dc7921867a2e5936d1da77d536740b4360012c1f741f9caed2826",
@@ -1620,10 +1917,10 @@ var mls_custody_default = {
   platforms: {
     "darwin-arm64": {
       target: "aarch64-apple-darwin",
-      sha256: "918ae350f1d7bd339c4eee548f6668943217f5fa66022bb93f41a02992dd296c",
+      sha256: "b09c82209cc7884c4521a310c727a8faaf387e9d0603443b1c1d9a55d87b7103",
       bytes: 2932976,
-      unitTestsPassed: 95,
-      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      unitTestsPassed: 96,
+      commit: "b9d1a4008749d1f144fd8db6ca4066de20422184",
       builder: {
         macos: "26.3.1",
         sdk: "26.4",
@@ -1632,10 +1929,10 @@ var mls_custody_default = {
     },
     "linux-x64": {
       target: "x86_64-unknown-linux-gnu",
-      sha256: "1c5a12d0213c53bdf59b5f36a7390a4b4c17f8a53c95e760ad8cb4905297d256",
-      bytes: 3389816,
-      unitTestsPassed: 95,
-      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      sha256: "0b20495694534d9792b6920f1e3f375a2182b237a44cb2d384080dd17e7f83bb",
+      bytes: 3389880,
+      unitTestsPassed: 96,
+      commit: "da679f4c60e2271c20b1f1958d0e5f6bfce6ef2d",
       builder: {
         image: "quay.io/pypa/manylinux_2_28_x86_64@sha256:e0adf18521ad35192df733a6c62d35df7801957d24e0470238aacecfab2188a3",
         dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
@@ -1643,15 +1940,28 @@ var mls_custody_default = {
     },
     "linux-arm64": {
       target: "aarch64-unknown-linux-gnu",
-      sha256: "371c5754cf0c437f561e8c49b3ea654c037311b951e11b1c5a29fb6b91656619",
+      sha256: "649d90ba74a42b34025292bd942068fc08979e35f66c9d6ad358469f5022fac7",
       bytes: 3234232,
-      unitTestsPassed: 95,
-      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      unitTestsPassed: 96,
+      commit: "b9d1a4008749d1f144fd8db6ca4066de20422184",
       builder: {
         image: "quay.io/pypa/manylinux_2_28_aarch64@sha256:a3e02308c822fb6ce0d12248b0c941817ba5e1a1bc9e7bb5929f29c50eaa40a9",
         dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
       }
     }
+  },
+  wasm: {
+    release: "mls-wasm-ddfdcc6039d7",
+    commit: "ba57ec95af11e8b560fd7d71431c0ec14542d71e",
+    rustVersion: "rustc 1.91.0 (f8297e351 2025-10-28)",
+    wasm: {
+      sha256: "137454981d2b6236dffa3dae0a7253e5f6d30578bce2cf50476adc8ca3d9aa02",
+      bytes: 1794989
+    },
+    glue: {
+      sha256: "744eb2267560f22aa54540fe9aa988588a7c27641610aae729b2ed75232e2a24",
+      bytes: 13579
+    }
   }
 };
 
@@ -1687,40 +1997,77 @@ var MLS_ENVIRONMENT_PINS = {
 };
 function packageRoot() {
   for (let directory = dirname4(fileURLToPath(import.meta.url)); ; directory = dirname4(directory)) {
-    const manifest = join2(directory, "package.json");
-    if (existsSync(manifest) && JSON.parse(readFileSync2(manifest, "utf8")).name === "@canonmsg/agent-sdk") return directory;
+    const manifest = join3(directory, "package.json");
+    if (existsSync2(manifest) && JSON.parse(readFileSync3(manifest, "utf8")).name === "@canonmsg/agent-sdk") return directory;
     if (dirname4(directory) === directory) return void 0;
   }
 }
 __name(packageRoot, "packageRoot");
+function helperRunsOnLibc() {
+  if (process.platform !== "linux") return true;
+  const report = process.report;
+  const { excludeNetwork } = report;
+  report.excludeNetwork = true;
+  try {
+    const version = report.getReport().header?.glibcVersionRuntime;
+    const [major = 0, minor = 0] = (version ?? "").split(".").map(Number);
+    return major > 2 || major === 2 && minor >= 28;
+  } finally {
+    report.excludeNetwork = excludeNetwork;
+  }
+}
+__name(helperRunsOnLibc, "helperRunsOnLibc");
 function bundledMlsCustodyHelper() {
   const platform = `${process.platform}-${process.arch}`;
   const pin = mls_custody_default.platforms[platform];
-  const root = pin && packageRoot();
-  const path = root && join2(root, "dist", "mls", platform, "canon-mls-custody");
-  if (!pin || !path || !existsSync(path)) return void 0;
-  if (createHash5("sha256").update(readFileSync2(path)).digest("hex") !== pin.sha256) {
+  const root = pin && helperRunsOnLibc() && packageRoot();
+  const path = root && join3(root, "dist", "mls", platform, "canon-mls-custody");
+  if (!pin || !path || !existsSync2(path)) return void 0;
+  if (createHash5("sha256").update(readFileSync3(path)).digest("hex") !== pin.sha256) {
     throw new Error(`${path} is not the custody helper this package pins; reinstall @canonmsg/agent-sdk.`);
   }
   return { path, sha256: pin.sha256 };
 }
 __name(bundledMlsCustodyHelper, "bundledMlsCustodyHelper");
+function bundledMlsWasmCore() {
+  const root = packageRoot();
+  if (!root) return void 0;
+  const directory = join3(root, "dist", "mls", "wasm");
+  const hostPath = join3(root, "dist", "mls-wasm-host.js"), wasmPath = join3(directory, "canon_mls_wasm_bg.wasm"), gluePath = join3(directory, "canon_mls_wasm.js");
+  if (![hostPath, wasmPath, gluePath].every((path) => existsSync2(path))) return void 0;
+  for (const [path, pin] of [[wasmPath, mls_custody_default.wasm.wasm.sha256], [gluePath, mls_custody_default.wasm.glue.sha256]]) {
+    if (createHash5("sha256").update(readFileSync3(path)).digest("hex") !== pin) throw new Error(`${path} is not the MLS core this package pins; reinstall @canonmsg/agent-sdk.`);
+  }
+  return { hostPath, wasmPath, wasmSha256: mls_custody_default.wasm.wasm.sha256, gluePath, glueSha256: mls_custody_default.wasm.glue.sha256 };
+}
+__name(bundledMlsWasmCore, "bundledMlsWasmCore");
 
 // src/runner/mls-managed.ts
 import { createHash as createHash6 } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2 } from "node:fs";
-import { dirname as dirname5, join as join3 } from "node:path";
+import { chmodSync, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync4, renameSync } from "node:fs";
+import { dirname as dirname5, join as join4 } from "node:path";
 var sha256 = /* @__PURE__ */ __name((bytes) => createHash6("sha256").update(bytes).digest("hex"), "sha256");
+function custodyFor(home, environmentId) {
+  const root = join4(home, "mls", environmentId);
+  const keptOnCore = existsSync3(root) && readdirSync2(root).some((name) => existsSync3(join4(root, name, "wrapping.key")));
+  const kept = keptOnCore ? bundledMlsWasmCore() : void 0;
+  if (kept) return { wasm: kept };
+  const helper = bundledMlsCustodyHelper();
+  if (helper) return { helper };
+  const wasm = bundledMlsWasmCore();
+  return wasm ? { wasm } : {};
+}
+__name(custodyFor, "custodyFor");
 function defaultMlsDevice(home, environmentId) {
   if (!isMlsEnvironmentId(environmentId)) return void 0;
-  const helper = bundledMlsCustodyHelper();
-  return helper ? managedMlsDevice({ home, environmentId, helper }) : void 0;
+  const custody2 = custodyFor(home, environmentId);
+  return custody2.helper || custody2.wasm ? managedMlsDevice({ home, environmentId, ...custody2 }) : void 0;
 }
 __name(defaultMlsDevice, "defaultMlsDevice");
 function managedMlsDevice(options) {
   const { environmentId } = options;
-  const helper = options.helper ?? bundledMlsCustodyHelper();
-  if (!helper) {
+  const { helper, wasm } = options.helper ? { helper: options.helper, wasm: void 0 } : options.wasm ? options : custodyFor(options.home, environmentId);
+  if (!helper && !wasm) {
     throw new Error(`@canonmsg/agent-sdk ships no MLS custody helper for ${process.platform}-${process.arch}: build one from mls/native in the Canon repository and give the runner --mls-dev-config <path> (docs/design/mls-dev-agent-host.md).`);
   }
   const pins = options.pins ?? MLS_ENVIRONMENT_PINS[environmentId];
@@ -1731,24 +2078,27 @@ function managedMlsDevice(options) {
     issuerKeys: pins.issuerKeys,
     receiptKeys: pins.receiptKeys
   });
-  const root = join3(options.home, "mls", environmentId);
-  const directory = /* @__PURE__ */ __name((context) => join3(root, sha256(Buffer.from(JSON.stringify([
+  const root = join4(options.home, "mls", environmentId);
+  const directory = /* @__PURE__ */ __name((context) => join4(root, sha256(Buffer.from(JSON.stringify([
     context.installationId,
     context.principal.type,
     context.principal.id,
     "ownershipVersion" in context.principal ? context.principal.ownershipVersion : null
   ]))).slice(0, 32)), "directory");
-  const vault = /* @__PURE__ */ __name((context) => join3(directory(context), "vault", "vault.bin"), "vault");
+  const vault = /* @__PURE__ */ __name((context) => join4(directory(context), "vault", "vault.bin"), "vault");
+  const wrappingKey = /* @__PURE__ */ __name((context) => join4(directory(context), "wrapping.key"), "wrappingKey");
+  const made = /* @__PURE__ */ __name((context) => wasm ? wrappingKey(context) : vault(context), "made");
+  const stranded = /* @__PURE__ */ __name((context) => new Error(wasm ? `This agent's MLS device was made with the native custody helper, which does not run on this host (${process.platform}-${process.arch}). It is still in ${directory(context)}: run the agent with this home where the helper runs (macOS on Apple silicon, or Linux with glibc 2.28 or later), with the architecture it was set up on. A device cannot move to the WASM core, and a new home is refused, since Canon keeps an agent to one installation.` : `This agent's MLS device was made with the WASM core, which this install of @canonmsg/agent-sdk does not have. It is still in ${directory(context)}: reinstall the package. A device cannot move to the native helper, and a new home is refused, since Canon keeps an agent to one installation.`), "stranded");
   let executable;
   function install() {
-    const target = join3(root, "bin", helper.sha256, "canon-mls-custody");
-    if (existsSync2(target) && sha256(readFileSync3(target)) === helper.sha256) return target;
-    mkdirSync3(dirname5(target), { recursive: true, mode: 448 });
+    const target = join4(root, "bin", helper.sha256, "canon-mls-custody");
+    if (existsSync3(target) && sha256(readFileSync4(target)) === helper.sha256) return target;
+    mkdirSync2(dirname5(target), { recursive: true, mode: 448 });
     const temporary = `${target}.${process.pid}.tmp`;
     copyFileSync(helper.path, temporary);
     chmodSync(temporary, 448);
-    if (sha256(readFileSync3(temporary)) !== helper.sha256) throw new Error(`${helper.path} is not the pinned custody helper`);
-    renameSync2(temporary, target);
+    if (sha256(readFileSync4(temporary)) !== helper.sha256) throw new Error(`${helper.path} is not the pinned custody helper`);
+    renameSync(temporary, target);
     return target;
   }
   __name(install, "install");
@@ -1758,9 +2108,24 @@ function managedMlsDevice(options) {
     let found = devices.get(key);
     if (!found) {
       found = (async () => {
-        if (!provisioning && !existsSync2(vault(context))) throw new NodeMlsDevCustodyError();
-        mkdirSync3(dirname5(vault(context)), { recursive: true, mode: 448 });
-        const unlock = join3(key, "unlock");
+        if (!provisioning && !existsSync3(made(context))) throw new NodeMlsDevCustodyError();
+        mkdirSync2(dirname5(made(context)), { recursive: true, mode: 448 });
+        if (wasm) {
+          if (process.platform === "win32") {
+            if (provisioning) secureWindowsDirectory(key);
+            else assertPrivateWindowsFile(wrappingKey(context));
+          }
+          const { revision: _revision, ...identity } = context;
+          return wasmMlsCustody({
+            core: wasm,
+            context: identity,
+            keyPath: wrappingKey(context),
+            issuerKeys: configuration.issuerKeys,
+            receiptKeys: configuration.receiptKeys,
+            ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+          });
+        }
+        const unlock = join4(key, "unlock");
         if (provisioning) privateKey(unlock, 32);
         const text3 = `${JSON.stringify({
           version: 1,
@@ -1776,8 +2141,8 @@ function managedMlsDevice(options) {
           receiptKeys: configuration.receiptKeys
         }, null, 2)}
 `;
-        const file = join3(key, "native.json");
-        if (!existsSync2(file) || readFileSync3(file, "utf8") !== text3) writeDurable(file, text3);
+        const file = join4(key, "native.json");
+        if (!existsSync3(file) || readFileSync4(file, "utf8") !== text3) writeDurable(file, text3);
         return createPortableNodeMlsDevCustody({
           executablePath: executable ??= install(),
           executableSha256: helper.sha256,
@@ -1803,8 +2168,18 @@ function managedMlsDevice(options) {
   return {
     configuration,
     custody: custody2,
-    provision: /* @__PURE__ */ __name((context) => device(context, true).then((open4) => open4.provision(context)), "provision"),
-    provisioned: /* @__PURE__ */ __name((context) => existsSync2(vault(context)), "provisioned"),
+    async provision(context) {
+      await (await device(context, true)).provision(context);
+      if (wasm && process.platform === "win32") {
+        restrictWindowsFile(wrappingKey(context));
+        assertPrivateWindowsFile(wrappingKey(context));
+      }
+    },
+    provisioned(context) {
+      if (existsSync3(made(context))) return true;
+      if (existsSync3(wasm ? vault(context) : wrappingKey(context))) throw stranded(context);
+      return false;
+    },
     async close() {
       await Promise.allSettled([...devices.values()].map((open4) => open4.then((custody3) => custody3.close())));
     }
@@ -1814,10 +2189,10 @@ __name(managedMlsDevice, "managedMlsDevice");
 
 // src/runner/relay.ts
 import { createHmac as createHmac2, timingSafeEqual } from "node:crypto";
-import { closeSync as closeSync3, constants as constants5, fsyncSync as fsyncSync2, mkdirSync as mkdirSync4, openSync as openSync3, renameSync as renameSync3, writeSync as writeSync2 } from "node:fs";
-import { lstat as lstat2, open as open3, realpath as realpath4 } from "node:fs/promises";
+import { closeSync as closeSync2, constants as constants4, fsyncSync, mkdirSync as mkdirSync3, openSync as openSync2, renameSync as renameSync2, writeSync } from "node:fs";
+import { lstat, open as open3, realpath as realpath3 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { isAbsolute as isAbsolute2, join as join4, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join5, resolve as resolve2 } from "node:path";
 var TOLERANCE_S = 300;
 function relaySecretKey(secret) {
   if (typeof secret !== "string" || !/^whsec_[A-Za-z0-9+/]+={0,2}$/.test(secret)) throw new Error("The relay channel secret must be a whsec_ value");
@@ -1950,8 +2325,8 @@ async function readPrivateFile(path, maximum, what) {
   const fail2 = /* @__PURE__ */ __name(() => {
     throw new Error(`${what} must be a private file (0600, owned by this user, not a link): ${path}`);
   }, "fail");
-  if (typeof path !== "string" || !isAbsolute2(path) || path.includes("\0") || resolve2(path) !== path || await realpath4(path).catch(() => "") !== path) fail2();
-  const file = await open3(path, constants5.O_RDONLY | constants5.O_NOFOLLOW).catch(() => fail2());
+  if (typeof path !== "string" || !isAbsolute2(path) || path.includes("\0") || resolve2(path) !== path || await realpath3(path).catch(() => "") !== path) fail2();
+  const file = await open3(path, constants4.O_RDONLY | constants4.O_NOFOLLOW).catch(() => fail2());
   try {
     const info = await file.stat();
     if (!info.isFile() || info.nlink !== 1 || info.uid !== process.getuid?.() || (info.mode & 63) !== 0 || info.size < 1 || info.size > maximum) fail2();
@@ -1988,11 +2363,11 @@ async function loadRelayConfiguration(path, input) {
   return { environmentId: value.environmentId, agentId: value.agentId, listen: { host: listen.host, port: listen.port }, secret };
 }
 __name(loadRelayConfiguration, "loadRelayConfiguration");
-var relayDirectory = /* @__PURE__ */ __name((home) => join4(home, "relay"), "relayDirectory");
-var credentialFile = /* @__PURE__ */ __name((home) => join4(relayDirectory(home), "credential.json"), "credentialFile");
+var relayDirectory = /* @__PURE__ */ __name((home) => join5(home, "relay"), "relayDirectory");
+var credentialFile = /* @__PURE__ */ __name((home) => join5(relayDirectory(home), "credential.json"), "credentialFile");
 async function readRelayCredential(home, relay) {
   const path = credentialFile(home);
-  if (!await lstat2(path).then(() => true, () => false)) return void 0;
+  if (!await lstat(path).then(() => true, () => false)) return void 0;
   let value;
   try {
     value = JSON.parse(await readPrivateFile(path, 4 * 1024, "The relay credential"));
@@ -2015,182 +2390,36 @@ function writeRelayCredential(home, relay, delivery) {
     generation: delivery.generation,
     credential: delivery.credential
   };
-  mkdirSync4(relayDirectory(home), { recursive: true, mode: 448 });
+  mkdirSync3(relayDirectory(home), { recursive: true, mode: 448 });
   const file = credentialFile(home);
   const temporary = `${file}.${process.pid}.tmp`;
-  const fd = openSync3(temporary, "w", 384);
+  const fd = openSync2(temporary, "w", 384);
   try {
-    writeSync2(fd, JSON.stringify(value));
-    fsyncSync2(fd);
+    writeSync(fd, JSON.stringify(value));
+    fsyncSync(fd);
   } finally {
-    closeSync3(fd);
+    closeSync2(fd);
   }
-  renameSync3(temporary, file);
+  renameSync2(temporary, file);
   return value;
 }
 __name(writeRelayCredential, "writeRelayCredential");
 function relayRunnerHome(home, installationId) {
   if (!CONNECTOR_RELAY_INSTALLATION_PATTERN.test(installationId)) throw new Error("Invalid relay installation");
-  const directory = join4(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
-  mkdirSync4(directory, { recursive: true, mode: 448 });
+  const directory = join5(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
+  mkdirSync3(directory, { recursive: true, mode: 448 });
   return directory;
 }
 __name(relayRunnerHome, "relayRunnerHome");
 
 // src/runner/runner.ts
 import { createHash as createHash8 } from "node:crypto";
-import { readFileSync as readFileSync5, rmSync as rmSync3 } from "node:fs";
-import { realpath as realpath5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, isAbsolute as isAbsolute3, join as join6, sep } from "node:path";
+import { readFileSync as readFileSync6, rmSync as rmSync2 } from "node:fs";
+import { realpath as realpath4, stat as stat2 } from "node:fs/promises";
+import { basename as basename4, isAbsolute as isAbsolute3, join as join7, sep } from "node:path";
 
 // ../agent-tools/src/communication-tool.ts
-var CANON_COMMUNICATE_TOOL_NAME = "communicate";
 var CANON_COMMUNICATE_DISCOVERY_MAX_RESULTS = 10;
-var NON_EMPTY_ID = { type: "string", minLength: 1, maxLength: 160 };
-var MESSAGE_TEXT = { type: "string", minLength: 1, maxLength: 4096 };
-var OPTIONAL_CAPTION = { type: "string", maxLength: 4096 };
-var DIRECT_SELECTION_SCHEMA = {
-  oneOf: [
-    {
-      type: "object",
-      required: ["mode"],
-      additionalProperties: false,
-      properties: { mode: { const: "latest_or_new" } }
-    },
-    {
-      type: "object",
-      required: ["mode"],
-      additionalProperties: false,
-      properties: { mode: { const: "new" } }
-    },
-    {
-      type: "object",
-      required: ["mode", "conversationId"],
-      additionalProperties: false,
-      properties: {
-        mode: { const: "specific" },
-        conversationId: NON_EMPTY_ID
-      }
-    }
-  ]
-};
-function canonCommunicateToolDefinition(name = CANON_COMMUNICATE_TOOL_NAME) {
-  return {
-    name,
-    description: "Find agents, list current conversations with their participants, message an explicit conversation, start_conversation with a person or agent (new by default), create_conversation with an optional title, manage_participants, leave, forward a message or share a contact. Check the current participants before selecting an existing conversation. Canon enforces admission and operator permissions.",
-    inputSchema: {
-      type: "object",
-      oneOf: [
-        { type: "object", required: ["action"], additionalProperties: false, properties: { action: { const: "list_conversations" }, limit: { type: "integer", minimum: 1, maximum: 100 } } },
-        { type: "object", required: ["action", "conversationId"], additionalProperties: false, properties: { action: { const: "leave_conversation" }, conversationId: NON_EMPTY_ID } },
-        {
-          type: "object",
-          required: ["action"],
-          additionalProperties: false,
-          properties: {
-            action: { const: "discover_agents" },
-            query: {
-              type: "string",
-              maxLength: MAX_DISCOVER_AGENTS_QUERY_LENGTH,
-              description: "Optional name or description prefix. Empty lists the directory."
-            },
-            limit: {
-              type: "integer",
-              minimum: 1,
-              maximum: CANON_COMMUNICATE_DISCOVERY_MAX_RESULTS,
-              default: CANON_COMMUNICATE_DISCOVERY_MAX_RESULTS
-            },
-            cursor: {
-              type: "string",
-              minLength: 1,
-              description: "Opaque cursor from a prior discovery action with the same query."
-            }
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "conversationId", "text"],
-          additionalProperties: false,
-          properties: {
-            action: { const: "message_existing" },
-            conversationId: NON_EMPTY_ID,
-            text: MESSAGE_TEXT,
-            messageId: NON_EMPTY_ID
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "principalId", "text"],
-          additionalProperties: false,
-          properties: {
-            action: { enum: ["start_conversation", "start_direct"] },
-            principalId: NON_EMPTY_ID,
-            text: MESSAGE_TEXT,
-            selection: DIRECT_SELECTION_SCHEMA,
-            messageId: NON_EMPTY_ID
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "memberIds"],
-          additionalProperties: false,
-          properties: {
-            action: { enum: ["create_conversation", "create_group"] },
-            name: { type: "string", minLength: 1, maxLength: VERB_LIMITS.groupNameChars },
-            memberIds: {
-              type: "array",
-              minItems: 1,
-              maxItems: VERB_LIMITS.groupMembers - 1,
-              uniqueItems: true,
-              items: NON_EMPTY_ID
-            }
-          }
-        },
-        {
-          type: "object",
-          required: [
-            "action",
-            "sourceConversationId",
-            "targetConversationId",
-            "messageId"
-          ],
-          additionalProperties: false,
-          properties: {
-            action: { const: "forward_message" },
-            sourceConversationId: NON_EMPTY_ID,
-            targetConversationId: NON_EMPTY_ID,
-            messageId: NON_EMPTY_ID,
-            text: OPTIONAL_CAPTION
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "conversationId", "contactUserId"],
-          additionalProperties: false,
-          properties: {
-            action: { const: "share_contact" },
-            conversationId: NON_EMPTY_ID,
-            contactUserId: NON_EMPTY_ID,
-            text: OPTIONAL_CAPTION,
-            messageId: NON_EMPTY_ID
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "conversationId", "userId", "operation"],
-          additionalProperties: false,
-          properties: {
-            action: { enum: ["manage_participants", "manage_group_members"] },
-            conversationId: NON_EMPTY_ID,
-            userId: NON_EMPTY_ID,
-            operation: { enum: ["add", "remove"] }
-          }
-        }
-      ]
-    }
-  };
-}
-__name(canonCommunicateToolDefinition, "canonCommunicateToolDefinition");
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -2411,124 +2640,41 @@ __name(executeCanonCommunicateTool, "executeCanonCommunicateTool");
 
 // src/runner/live.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-var SNAPSHOT_GAP_MS = 250;
 var KEEPALIVE_MS = 3500;
 var PROGRESS_REFRESH_MS = 6e4;
-var MAX_ROWS = 30;
 function createLivePublisher(options) {
   const { client, conversationId, enqueue } = options;
-  const presence = options.mode === "presence";
   const presenceId = `turn-${randomBytes3(16).toString("hex")}`;
-  const publicTurnId = /* @__PURE__ */ __name(() => presence && options.turnId() !== null ? presenceId : options.turnId(), "publicTurnId");
+  const publicTurnId = /* @__PURE__ */ __name(() => options.turnId() !== null ? presenceId : null, "publicTurnId");
   const openedAt = Date.now();
-  const rows = /* @__PURE__ */ new Map();
-  let mode = options.mode;
-  let text3 = "";
   let waiting = false;
   let ended = false;
-  let sequence = 0;
-  let state;
   let stateAt = 0;
-  let snapshotAt = 0;
-  let timer;
   let keepalive;
-  const current = /* @__PURE__ */ __name(() => waiting ? "waiting_input" : presence ? "thinking" : [...rows.values()].some((row) => row.status === "running") ? "tool" : text3 ? "streaming" : "thinking", "current");
-  const typing = /* @__PURE__ */ __name((on) => enqueue(() => client.setTyping(conversationId, on, on ? "thinking" : void 0)), "typing");
-  const node = /* @__PURE__ */ __name((blank = false) => enqueue(async () => {
-    if (ended && !blank) return;
-    const turnId = options.turnId();
-    await client.setStreaming({
-      conversationId,
-      turnId,
-      messageId: turnId ?? "",
-      text: blank ? "" : text3,
-      status: blank ? "thinking" : current(),
-      blocks: blank ? [] : [...rows.values()]
-    });
-  }), "node");
   const publishState = /* @__PURE__ */ __name(() => {
-    const next = state = current();
+    const state = waiting ? "waiting_input" : "thinking";
     stateAt = Date.now();
-    enqueue(() => client.setRuntimeTurn({
-      conversationId,
-      turnId: publicTurnId(),
-      state: next,
-      openedAt,
-      turnUpdatedAt: Date.now(),
-      ...presence ? {} : options.context()
-    }));
+    enqueue(() => client.setRuntimeTurn({ conversationId, turnId: publicTurnId(), state, openedAt, turnUpdatedAt: Date.now() }));
   }, "publishState");
-  const progress = /* @__PURE__ */ __name(() => {
-    if (current() !== state || Date.now() - stateAt > PROGRESS_REFRESH_MS) publishState();
-    if (mode !== "full" || timer) return;
-    timer = setTimeout(() => {
-      timer = void 0;
-      snapshotAt = Date.now();
-      node();
-    }, Math.max(0, snapshotAt + SNAPSHOT_GAP_MS - Date.now()));
-  }, "progress");
   return {
     open() {
       if (ended) return;
-      if (!presence) typing(true);
       publishState();
-      if (mode === "full") node();
       keepalive = setInterval(() => {
-        if (ended) return;
-        if (presence) {
-          if (Date.now() - stateAt > PROGRESS_REFRESH_MS) publishState();
-          return;
-        }
-        if (waiting) return;
-        typing(true);
-        if (mode === "full" && !text3 && !rows.size) node();
+        if (!ended && Date.now() - stateAt > PROGRESS_REFRESH_MS) publishState();
       }, KEEPALIVE_MS);
       keepalive.unref?.();
     },
-    setMode(next) {
-      if (ended || next === mode || presence || next === "presence") return;
-      mode = next;
-      if (mode === "full") node();
-    },
-    text(snapshot) {
-      if (ended || presence || snapshot === text3) return;
-      text3 = snapshot;
-      progress();
-    },
-    activity(event) {
-      if (ended || presence) return;
-      rows.set(event.id, {
-        id: event.id,
-        turnId: options.turnId() ?? "",
-        kind: event.kind,
-        title: event.title,
-        status: event.state === "done" ? "completed" : event.state,
-        sequence: rows.get(event.id)?.sequence ?? ++sequence
-      });
-      for (const id of rows.keys()) if (rows.size > MAX_ROWS) rows.delete(id);
-      progress();
-    },
     waiting(on) {
       if (ended || waiting === on) return;
       waiting = on;
-      if (!presence) typing(!on);
       publishState();
-      if (mode === "full") node();
-    },
-    refresh() {
-      if (!ended && state && !presence) publishState();
     },
     end(how) {
       if (ended) return;
       ended = true;
-      clearTimeout(timer);
       clearInterval(keepalive);
-      if (!presence) typing(false);
-      if (mode === "full") {
-        if (how !== "answered") node(true);
-        enqueue(() => client.clearStreaming(conversationId));
-      }
-      enqueue(() => client.setRuntimeTurn(how === "stopped" ? { conversationId, turnId: publicTurnId(), state: "interrupted", ...presence ? {} : options.context() } : { conversationId, turnId: null, state: "idle", ...presence ? {} : { queueDepth: 0 }, openedAt: null, turnUpdatedAt: null }));
+      enqueue(() => client.setRuntimeTurn(how === "stopped" ? { conversationId, turnId: publicTurnId(), state: "interrupted" } : { conversationId, turnId: null, state: "idle", openedAt: null, turnUpdatedAt: null }));
     }
   };
 }
@@ -2536,8 +2682,8 @@ __name(createLivePublisher, "createLivePublisher");
 
 // src/runner/mls-ask.ts
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync5, rmSync } from "node:fs";
+import { join as join6 } from "node:path";
 var sha2562 = /* @__PURE__ */ __name((value) => createHash7("sha256").update(value).digest("hex"), "sha256");
 var pause = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
   setTimeout(resolve3, ms).unref?.();
@@ -2592,9 +2738,9 @@ function createMlsAsks(options, approvalScope2) {
       });
     }
   });
-  const file = /* @__PURE__ */ __name((conversationId, requestId) => join5(options.directory, `${sha2562(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
+  const file = /* @__PURE__ */ __name((conversationId, requestId) => join6(options.directory, `${sha2562(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
   const save = /* @__PURE__ */ __name((journal) => writeDurable(file(journal.conversationId, journal.requestId), JSON.stringify(journal)), "save");
-  const forget = /* @__PURE__ */ __name((journal) => rmSync2(file(journal.conversationId, journal.requestId), { force: true }), "forget");
+  const forget = /* @__PURE__ */ __name((journal) => rmSync(file(journal.conversationId, journal.requestId), { force: true }), "forget");
   const operationOf = /* @__PURE__ */ __name((conversationId, messageId) => `runner-mls-ask:${sha2562(JSON.stringify([conversationId, messageId])).slice(0, 48)}`, "operationOf");
   const withdrawalOf = /* @__PURE__ */ __name((journal) => operationOf(journal.conversationId, `${journal.requestId}:withdraw`), "withdrawalOf");
   const audienceChanged = /* @__PURE__ */ __name((error) => codeOf(error) === "MLS_DEV_AUDIENCE_CHANGED", "audienceChanged");
@@ -2929,18 +3075,18 @@ function createMlsAsks(options, approvalScope2) {
     async recover() {
       let names;
       try {
-        names = readdirSync2(options.directory).filter((name) => name.endsWith(".json"));
+        names = readdirSync3(options.directory).filter((name) => name.endsWith(".json"));
       } catch {
         return;
       }
       for (const name of names) {
         let journal;
         try {
-          journal = JSON.parse(readFileSync4(join5(options.directory, name), "utf8"));
+          journal = JSON.parse(readFileSync5(join6(options.directory, name), "utf8"));
           if (journal.version !== 1 || typeof journal.conversationId !== "string" || typeof journal.requestId !== "string" || !Array.isArray(journal.sends) || journal.sends.some((sent) => typeof sent?.operationId !== "string" || typeof sent.messageId !== "string")) throw new Error();
           for (const sent of journal.sends) sent.audience = snapshotMlsAudience(sent.audience);
         } catch {
-          rmSync2(join5(options.directory, name), { force: true });
+          rmSync(join6(options.directory, name), { force: true });
           continue;
         }
         try {
@@ -3042,9 +3188,8 @@ var CLAIM_PATIENCE_MS = 2e4;
 var HISTORY_WINDOW = 20;
 var STATE_LIMIT_BYTES = 64 * 1024;
 var FAILURE_NOTICE = "Sorry, something went wrong and I could not finish this reply.";
-var STOPS_SHORT_NOTICE = "Sorry, my reply could not be delivered in full.";
 var RESTART_NOTICE = "Sorry, I was restarted before I could finish replying to this. Please send it again if you still need an answer.";
-var CLIENT_TYPES = { code: "generic", claude: "claude-code", codex: "codex", connector: "generic" };
+var CLIENT_TYPES = { code: "generic", claude: "claude-code", codex: "codex", acp: "generic", connector: "generic" };
 var objectSchema = /* @__PURE__ */ __name((properties, required = []) => ({ type: "object", properties, required, additionalProperties: false }), "objectSchema");
 var MAX_QUESTION = 4e3;
 var MAX_OPTION = 120;
@@ -3112,16 +3257,60 @@ __name(within, "within");
 var pause2 = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
   setTimeout(resolve3, ms).unref?.();
 }), "pause");
-var audienceOf = /* @__PURE__ */ __name((room) => room?.memberIds ? { memberIds: [...room.memberIds], ...typeof room.membershipRevision === "number" ? { membershipRevision: room.membershipRevision } : {} } : null, "audienceOf");
+function agentRun(turns) {
+  const history = turns.map(({ senderId, senderType }) => senderType === "ai_agent" ? { senderId, senderType, metadata: { turnSemantics: "turn_complete" } } : { senderId, senderType: "human" });
+  return {
+    consecutiveAgentTurns: buildParticipationHistorySnapshot(history.slice(1)).consecutiveAgentTurns,
+    currentAgentStreakStartedByHuman: buildParticipationHistorySnapshot(history).currentAgentStreakStartedByHuman
+  };
+}
+__name(agentRun, "agentRun");
 var inert = /* @__PURE__ */ __name((value) => value.replace(/\s+/g, " ").trim(), "inert");
 var OWNER_MARK = " [your owner]";
 var TRUSTED_MARK = " [trusted teammate agent]";
 var speaker = /* @__PURE__ */ __name((name) => inert(name).replace(/\[/g, "(").replace(/\]/g, ")"), "speaker");
-var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*(?:trusted\s+teammate\s+agent|your\s+owner)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)"), "defused");
+var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*(?:trusted\s+teammate\s+agent|your\s+owner)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?conversation\s+facts\s*)\]/gi, "($1)"), "defused");
 var NOTE_OPEN = "[owner's private note] Your owner left this for you on the machine you run on. It is not a message in this conversation: no one in it sees it, and it was not posted.";
 var NOTE_CLOSE = "[end of owner's private note]";
 var ERRAND_OPEN = "[owner's errand]";
 var ERRAND_CLOSE = "[end of owner's errand]";
+var FACTS_OPEN = "[conversation facts] Your runner added this from Canon's records. It is not a message, and no one in the conversation sees it.";
+var FACTS_CLOSE = "[end of conversation facts]";
+var MAX_FACT_MEMBERS = 50;
+var MAX_FACT_NAME = 200;
+var MAX_FACT_TOPIC = 500;
+var STYLE_RULES = {
+  natural: void 0,
+  collaborative: "Work openly with the people and agents here.",
+  "mention-first": "Speak when you are clearly addressed; otherwise end your turn with no_reply.",
+  "approval-gated": "Be cautious: join in only on a strong signal; otherwise end your turn with no_reply.",
+  "handoff-only": "Act when someone explicitly hands you a task; otherwise end your turn with no_reply.",
+  observer: "Stay quiet unless a reply is necessary, and end your turn with no_reply."
+};
+var factText = /* @__PURE__ */ __name((value, limit = MAX_FACT_NAME) => speaker(value).slice(0, limit).trimEnd(), "factText");
+function factsPrompt({ name, topic, owner, members, rules }, kind) {
+  const shown = members.slice(0, MAX_FACT_MEMBERS).map((member) => member.isYou ? "you" : factText(member.name ?? member.id) + (member.isOwner ? OWNER_MARK : member.type === "ai_agent" ? " [agent]" : ""));
+  const lines = !rules ? [] : [
+    STYLE_RULES[rules.style],
+    kind === "group" && rules.requireMentionForGroupReplies ? "Only messages that mention you reach you." : void 0,
+    rules.allowAgentToAgent ? void 0 : "Messages from other agents do not reach you.",
+    rules.allowLongRunningCollaboration ? void 0 : "After a person writes, another agent gets one exchange with you.",
+    typeof rules.maxConsecutiveAgentTurns === "number" ? `Agents get at most ${rules.maxConsecutiveAgentTurns} turns in a row before a person writes.` : void 0
+  ].filter((line) => line !== void 0);
+  return [
+    FACTS_OPEN,
+    `Your owner: ${factText(owner.name ?? owner.id)}`,
+    ...name ? [`Conversation: ${factText(name)}`] : [],
+    ...topic ? [`Topic: ${factText(topic, MAX_FACT_TOPIC)}`] : [],
+    `Members: ${shown.join(", ")}${members.length > shown.length ? `, and ${members.length - shown.length} more` : ""}`,
+    ...lines.length ? [
+      "This conversation's rules, which your owner or any of its admins can set. They say how you take part here, not what you may do:",
+      ...lines.map((line) => `- ${line}`)
+    ] : [],
+    FACTS_CLOSE
+  ];
+}
+__name(factsPrompt, "factsPrompt");
 var errandCommunicate = /* @__PURE__ */ __name((contact) => ({
   name: "communicate",
   description: "List Canon conversations or agents, or send text to your errand's recipient or to the conversation it came from" + (contact ? ". Start the conversation with the recipient first, with start_conversation." : "."),
@@ -3150,21 +3339,6 @@ var inputMessage = /* @__PURE__ */ __name((message2, trusted = false) => Object.
   ...message2.replyTo ? { replyTo: message2.replyTo } : {},
   createdAt: message2.createdAt ?? ""
 }), "inputMessage");
-function outputOptions(turnId, trigger, kind, actedForOwner = false, messageId = `${turnId}:${kind}`) {
-  return {
-    messageId,
-    ...trigger.replyAuthority ? { replyAuthority: trigger.replyAuthority } : {},
-    ...trigger.activeSelfContextId ? { selfContextId: trigger.activeSelfContextId } : {},
-    metadata: {
-      turnId,
-      turnSemantics: "turn_complete",
-      ...kind === "final" ? {} : { replyBehavior: "suppress_auto_reply" },
-      ...kind === "final" && actedForOwner ? { [ACTED_FOR_OWNER]: true } : {}
-    }
-  };
-}
-__name(outputOptions, "outputOptions");
-var ACTED_FOR_OWNER = "actedForOwner";
 var MAX_TEAM = 20;
 function approvalScope(request) {
   if (request.scopeKey !== void 0 && /^[A-Za-z0-9_:-]{1,64}$/.test(request.scopeKey)) return request.scopeKey;
@@ -3175,19 +3349,6 @@ function approvalScope(request) {
 __name(approvalScope, "approvalScope");
 var MAX_GROUP_PARTS = 100;
 var CUT_SHORT_NOTE = "(This reply was too long to send in full and was cut short.)";
-var EXPIRED_UPLOAD = ["MEDIA_UPLOAD_TEMPORARY_EXPIRED", "MEDIA_UPLOAD_EXPIRED"];
-function fitGroup(text3, files) {
-  const room = Math.max(1, MAX_GROUP_PARTS - files);
-  const count = /* @__PURE__ */ __name((value) => value ? splitTextByUtf8Bytes(value).length : 0, "count");
-  let fitted = text3;
-  for (let end = Math.floor(text3.length * Math.min(1, room / Math.max(1, count(text3)))); count(fitted) > room; end = Math.floor(end * 0.95)) {
-    fitted = `${text3.slice(0, end).replace(/[\uD800-\uDBFF]$/, "").trimEnd()}
-
-${CUT_SHORT_NOTE}`;
-  }
-  return fitted;
-}
-__name(fitGroup, "fitGroup");
 function fitEncrypted(text3) {
   if (Buffer.byteLength(text3) <= MLS_DEV_TEXT_MAX_BYTES) return text3;
   const room = MLS_DEV_TEXT_MAX_BYTES - Buffer.byteLength(`
@@ -3205,6 +3366,27 @@ ${CUT_SHORT_NOTE}`);
 ${CUT_SHORT_NOTE}`;
 }
 __name(fitEncrypted, "fitEncrypted");
+function encryptedParts(text3, limit) {
+  if (Buffer.byteLength(text3) <= MLS_DEV_TEXT_MAX_BYTES) return [text3];
+  const parts = splitTextWithinBytes(text3, MLS_DEV_TEXT_MAX_BYTES).filter((part) => part.trim());
+  if (parts.length <= limit) return parts;
+  const room = MLS_DEV_TEXT_MAX_BYTES - Buffer.byteLength(`
+
+${CUT_SHORT_NOTE}`);
+  let bytes = 0;
+  let end = 0;
+  for (const char of parts[limit - 1]) {
+    bytes += Buffer.byteLength(char);
+    if (bytes > room) break;
+    end += char.length;
+  }
+  return [...parts.slice(0, limit - 1), `${parts[limit - 1].slice(0, end).trimEnd()}
+
+${CUT_SHORT_NOTE}`];
+}
+__name(encryptedParts, "encryptedParts");
+var MAX_REPLY_PARTS = 32;
+var REPLY_GRANT_RETRIES = 6;
 var ENCRYPTED_FILES = "Files cannot be sent in encrypted conversations yet";
 var ERRAND_RETRY_MS = 5e3;
 var STOPPED_ERRAND = {
@@ -3216,14 +3398,10 @@ var STOPPED_ERRAND = {
 };
 var SUBMITTED = { phase: "submitted", settle: /* @__PURE__ */ __name(async () => void 0, "settle"), release: /* @__PURE__ */ __name(async () => void 0, "release"), cancel: /* @__PURE__ */ __name(async () => void 0, "cancel") };
 var SILENT = { open() {
-}, setMode() {
-}, text() {
-}, activity() {
 }, waiting() {
-}, refresh() {
 }, end() {
 } };
-var UNAVAILABLE_ENCRYPTED = ["react", "send_file", "ask_question"];
+var UNAVAILABLE_ENCRYPTED = ["send_file", "ask_question"];
 var carriesCards = /* @__PURE__ */ __name((audience) => mlsDevProtocolCarriesCards(audience?.protocol), "carriesCards");
 var carriesItems = /* @__PURE__ */ __name((audience) => audience?.protocol === MLS_DEV_TEXT_PROTOCOL_V3, "carriesItems");
 function runtimeDescriptor(driver) {
@@ -3264,14 +3442,6 @@ async function createRunner(options) {
   const mentionAliases = names(options.mentionAliases, "mentionAliases").map((name) => name.replace(/^@+/, "")).filter(Boolean);
   const descriptor = runtimeDescriptor(driver);
   const offersQuestions = !driver.capabilities.nativeQuestions && ["choose", "text"].every((kind) => driver.capabilities.ask.includes(kind));
-  const capabilities = {
-    supportsInterrupt: true,
-    supportsInputInterrupt: false,
-    supportsQueue: true,
-    supportsInterleave: false,
-    supportsRequiresAction: driver.capabilities.ask.length > 0,
-    supportsNonFinalPermanentMessages: false
-  };
   const rooms = /* @__PURE__ */ new Map();
   const running = /* @__PURE__ */ new Set();
   const detach = [];
@@ -3286,7 +3456,6 @@ async function createRunner(options) {
   let tools;
   let lock;
   let owner;
-  const approvals = /* @__PURE__ */ new Map();
   let roots = [];
   let mlsOn = false;
   let mlsAsks;
@@ -3295,12 +3464,14 @@ async function createRunner(options) {
     if (!mlsIds) throw new Error("MLS_AUTHORITY_REQUIRED");
     return mlsIds;
   }, "keyed");
+  let outboundClosed = false;
   let ownershipVersion;
   let displayName;
+  let ownerOf;
   const refused = /* @__PURE__ */ new Set();
   const deferredNotes = /* @__PURE__ */ new Set();
+  const ruleNotes = /* @__PURE__ */ new Set();
   const guards = /* @__PURE__ */ new Map();
-  const relayed = /* @__PURE__ */ new Set();
   const relaySends = /* @__PURE__ */ new Map();
   let errands;
   let errandInbox2;
@@ -3329,24 +3500,17 @@ async function createRunner(options) {
   const settle = /* @__PURE__ */ __name(async (ids, reason) => (await Promise.allSettled(ids.map((id) => endpoint.setInboundState(id, "settled", reason)))).every(({ status }) => status === "fulfilled"), "settle");
   const queued = /* @__PURE__ */ __name((turn) => turn.inputs.filter((input) => input.handle.phase === "queued"), "queued");
   const turnId = /* @__PURE__ */ __name((roomId, inputs) => `turn-${sha2563(JSON.stringify([roomId, ...inputs.map((input) => [input.id, input.generation])])).slice(0, 32)}`, "turnId");
-  const livePublisher = /* @__PURE__ */ __name((current, turn, mode) => createLivePublisher({
+  const livePublisher = /* @__PURE__ */ __name((current, turn) => createLivePublisher({
     client,
     conversationId: current.id,
-    mode,
     turnId: /* @__PURE__ */ __name(() => turn?.id ?? null, "turnId"),
-    context: /* @__PURE__ */ __name(() => ({
-      queueDepth: current.queue.length,
-      currentSpeakerId: agentId,
-      capabilities,
-      activeMessageIds: turn?.inputs.map(({ payload }) => payload.message.id) ?? []
-    }), "context"),
     enqueue: /* @__PURE__ */ __name((publish2) => {
       current.lane = current.lane.then(publish2).catch(() => void 0);
     }, "enqueue")
   }), "livePublisher");
-  const stateFile = /* @__PURE__ */ __name((session) => join6(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2563(JSON.stringify([scope, session]))}.json`), "stateFile");
+  const stateFile = /* @__PURE__ */ __name((session) => join7(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2563(JSON.stringify([scope, session]))}.json`), "stateFile");
   const resetSession = /* @__PURE__ */ __name(async (session) => {
-    rmSync3(stateFile(session), { force: true });
+    rmSync2(stateFile(session), { force: true });
     mlsAsks?.endSession(session);
     await driver.reset?.(session);
   }, "resetSession");
@@ -3354,15 +3518,18 @@ async function createRunner(options) {
   function refuse(roomId, why) {
     if (refused.has(roomId)) return;
     refused.add(roomId);
-    log(`Refusing encrypted room ${roomId}: ${why === "no-device" ? "this runner has no MLS device (run it with --mls-dev-config)" : why === "remote" ? `the ${driver.name} driver runs off this host, which an encrypted room allows only in relay mode` : "its encryption protocol is not supported"}. Its messages are not delivered to this agent.`);
+    log(why === "plaintext" ? `Refusing room ${roomId}: it is not encrypted, and this runner takes part only in encrypted rooms. Its messages are not delivered to this agent.` : `Refusing encrypted room ${roomId}: ${why === "no-device" ? "this runner has no MLS device (run it with --mls-dev-config)" : why === "remote" ? `the ${driver.name} driver runs off this host, which an encrypted room allows only in relay mode` : "its encryption protocol is not supported"}. Its messages are not delivered to this agent.`);
   }
   __name(refuse, "refuse");
   async function authorize() {
     await endpoint.mlsDevDevice.ensureReady();
     const me = await client.getAgentMe();
-    requireMlsSupport({ environmentId: options.environmentId, agent: me });
+    requireMlsSupport({ environmentId: options.environmentId });
     if (me.agentId !== agentId || me.ownershipVersion !== ownershipVersion) throw new Error("MLS_AUTHORITY_REQUIRED");
+    outboundClosed = me.outboundPolicy === "closed";
+    if (outboundClosed && options.relay) throw new Error("MLS_AUTHORITY_REQUIRED");
     displayName = me.displayName;
+    ownerOf = { id: me.ownerId, ...me.ownerName ? { name: me.ownerName } : {} };
     return me.ownerId;
   }
   __name(authorize, "authorize");
@@ -3413,55 +3580,53 @@ ${error instanceof Error ? error.message : String(error)}`;
     if (!input) return;
     if (stopping) return void await handle.release("runner-stopping");
     const target = room(input.payload.conversationId);
-    if (input.mls) target.mls = true;
     target.queue.push(input);
-    target.turn?.live.refresh();
     requeue(target);
     pump();
   }
   __name(offer, "offer");
   async function admitInput(event, handle) {
     const payload = event.data;
+    const { conversationId } = payload;
     const generation = (await endpoint.getInbound(event.id))?.handoffGeneration ?? "";
-    const mode = await endpoint.getConversationContentMode(payload.conversationId).catch((error) => {
-      if (error.code === "MLS_DEV_ROOM_MODE_UNAVAILABLE") return "plaintext";
+    let mode;
+    try {
+      mode = await endpoint.getConversationContentMode(conversationId);
+    } catch (error) {
+      if (error.code !== "MLS_DEV_ROOM_MODE_UNAVAILABLE") throw error;
+      if (!(await client.getConversation(conversationId))?.memberIds?.includes(agentId)) return void await handle.cancel("membership-lost");
       throw error;
-    });
-    if (mode === "plaintext") {
-      if (options.relay) {
-        if (!relayed.has(payload.conversationId)) log(`Relay mode: leaving plaintext room ${payload.conversationId} to the connector.`);
-        relayed.add(payload.conversationId);
-        return void await handle.cancel("relay-plaintext-room");
-      }
-      if (payload.turnDispatch && payload.turnDispatch.kind !== "run_turn") return void await handle.cancel("observe-only");
-      return { id: event.id, payload, handle, generation };
     }
     if (mode !== "mls-dev-text" || !mlsOn || driver.capabilities.remote && !options.relay) {
-      refuse(payload.conversationId, !mlsOn ? "no-device" : mode !== "mls-dev-text" ? "protocol" : "remote");
-      return void await handle.cancel("encrypted-room-refused");
+      refuse(conversationId, mode === "plaintext" ? "plaintext" : !mlsOn ? "no-device" : mode !== "mls-dev-text" ? "protocol" : "remote");
+      return void await handle.cancel(mode === "plaintext" ? "plaintext-room-refused" : "encrypted-room-refused");
     }
-    const { conversationId } = payload;
     const groups = endpoint.mlsDevGroups;
     await authorize();
     const binding = await groups.readVerifiedMessageBinding({ conversationId, messageId: payload.message.id });
     if (!binding) throw new Error("MLS_INPUT_NOT_VERIFIED");
     const { messages } = await endpoint.query("get_messages", { conversationId, messageIds: [binding.messageId] });
     const [message2] = messages;
-    if (messages.length !== 1 || message2.id !== binding.messageId || message2.senderId !== binding.senderId || message2.senderType !== binding.senderPrincipal.type || typeof message2.text !== "string" && !(message2.text === null && (message2.attachments?.length ?? 0) === 1)) throw new Error("MLS_INPUT_NOT_VERIFIED");
+    if (messages.length !== 1 || message2.id !== binding.messageId || message2.senderId !== binding.senderId || message2.senderType !== binding.senderPrincipal.type || !Number.isSafeInteger(message2.mlsFeedOrdinal) || typeof message2.text !== "string" && !(message2.text === null && (message2.attachments?.length ?? 0) === 1)) throw new Error("MLS_INPUT_NOT_VERIFIED");
     const { audience, ownerId } = await currentAudience(conversationId);
     if (binding.groupId !== audience.groupId) throw new Error("MLS_INPUT_NOT_VERIFIED");
     const obsolete = binding.head.sequence < audience.head.sequence;
     if (!obsolete && JSON.stringify(binding.head) !== JSON.stringify(audience.head)) throw new Error("MLS_INPUT_AHEAD_OF_AUDIENCE");
     if (obsolete) return void await handle.settle("mls-obsolete-audience");
     const fromAgent = binding.senderPrincipal.type !== "human";
-    if (fromAgent) {
-      const wake = agentWake(conversationId, event.id, message2.senderId, message2.text ?? "", message2.mentions ?? []);
-      if (wake !== "admit") return void await handle.settle(wake);
-    } else {
+    const mentioned = (message2.mentions ?? []).includes(agentId) || mentionsAgent(message2.text ?? "", [displayName, agentId, ...mentionAliases]);
+    if (fromAgent && (message2.senderId === agentId || !mentioned)) return void await handle.settle("mls-observe-only-sender");
+    if (!fromAgent) {
       const target = room(conversationId);
       target.agentInputs = void 0;
       target.capped = false;
     }
+    const rule = await withheld(conversationId, message2, fromAgent, mentioned, ownerId);
+    if (rule) return void await handle.settle(rule);
+    if (fromAgent) {
+      const wake = agentWake(conversationId, event.id);
+      if (wake !== "admit") return void await handle.settle(wake);
+    }
     const verified = {
       id: message2.id,
       senderId: message2.senderId,
@@ -3478,8 +3643,48 @@ ${error instanceof Error ? error.message : String(error)}`;
     return { id: event.id, handle, generation, mls: audience, payload: { conversationId, message: verified } };
   }
   __name(admitInput, "admitInput");
-  function agentWake(roomId, inputId, senderId, text3, mentions) {
-    if (senderId === agentId || !mentions.includes(agentId) && !mentionsAgent(text3, [displayName, agentId, ...mentionAliases])) return "mls-observe-only-sender";
+  async function withheld(roomId, message2, fromAgent, mentioned, ownerId) {
+    const current = await endpoint.query(
+      "conversation",
+      { conversationId: roomId }
+    );
+    if (current?.blockedMemberIds?.includes(message2.senderId)) return "mls-blocked-sender";
+    if (options.relay || !current?.behavior) return void 0;
+    const { maxConsecutiveAgentTurns, allowLongRunningCollaboration } = current.behavior.participation;
+    const decision = evaluateParticipationPolicy(current.behavior, {
+      conversationType: resolveConversationPolicyScope(current.memberIds),
+      senderType: fromAgent ? "ai_agent" : "human",
+      isOwner: !fromAgent && message2.senderId === ownerId,
+      mentionedAgent: mentioned,
+      ...fromAgent ? agentRun(await turnsBehind(roomId, message2, Math.max(maxConsecutiveAgentTurns ?? 0, allowLongRunningCollaboration ? 0 : 2))) : {}
+    });
+    if (decision.allow) return void 0;
+    const note = `${roomId}
+${decision.reasonCode}`;
+    if (!ruleNotes.has(note)) log(`The rules of ${roomId} keep messages from a turn: ${decision.reasonCode}.`);
+    ruleNotes.add(note);
+    return `mls-${decision.reasonCode}`;
+  }
+  __name(withheld, "withheld");
+  async function turnsBehind(roomId, message2, limit) {
+    const turns = [message2];
+    let before = String(message2.mlsFeedOrdinal);
+    while (before && turns.length <= limit) {
+      const page = await endpoint.query(
+        "list_messages",
+        { conversationId: roomId, limit: PARTICIPATION_HISTORY_FETCH_LIMIT, before }
+      );
+      for (const entry of page.messages) {
+        if (entry.contentType === "interaction" || entry.senderId === turns.at(-1).senderId) continue;
+        turns.push(entry);
+        if (entry.senderType !== "ai_agent" || turns.length > limit) return turns;
+      }
+      before = page.nextBefore;
+    }
+    return turns;
+  }
+  __name(turnsBehind, "turnsBehind");
+  function agentWake(roomId, inputId) {
     const target = room(roomId);
     const streak = target.agentInputs ??= /* @__PURE__ */ new Set();
     if (!streak.has(inputId) && streak.size >= agentTurnCap) {
@@ -3519,12 +3724,10 @@ ${error instanceof Error ? error.message : String(error)}`;
         continue;
       }
       if (!candidate.queue.length) continue;
-      const encrypted = !!candidate.queue[0].mls;
-      const other = candidate.queue.findIndex((input) => !!input.mls !== encrypted);
-      const inputs = candidate.queue.splice(0, Math.min(MAX_INPUTS_PER_TURN, other < 0 ? MAX_INPUTS_PER_TURN : other));
+      const inputs = candidate.queue.splice(0, MAX_INPUTS_PER_TURN);
       const turn = newTurn(inputs, turnId(candidate.id, inputs), candidate.id);
       candidate.turn = turn;
-      (turn.live = driver.capabilities.remote ? SILENT : livePublisher(candidate, turn, encrypted ? "presence" : "status")).open();
+      (turn.live = driver.capabilities.remote ? SILENT : livePublisher(candidate, turn)).open();
       const done = execute(candidate, turn).catch((error) => {
         warn("turn failed")(error);
         return dispose(queued(turn), "release", "turn-failed");
@@ -3541,6 +3744,32 @@ ${error instanceof Error ? error.message : String(error)}`;
     while (localErrands.length && !stopping && running.size < maxTurns) startErrand(void 0, localErrands.shift());
   }
   __name(pump, "pump");
+  async function roomFacts(conversation) {
+    const { members } = await endpoint.query("get_members", { conversationId: conversation.id });
+    const names2 = new Map(members.map(({ userId, displayName: name }) => [userId, name]));
+    const owner2 = Object.freeze(ownerOf);
+    const participation = conversation.behavior?.participation;
+    return Object.freeze({
+      ...conversation.name ? { name: conversation.name } : {},
+      ...conversation.topic ? { topic: conversation.topic } : {},
+      owner: owner2,
+      members: Object.freeze(conversation.memberIds.map((id) => Object.freeze({
+        id,
+        ...names2.get(id) ? { name: names2.get(id) } : {},
+        type: conversation.participantTypes?.[id] === "ai_agent" || id === agentId ? "ai_agent" : "human",
+        isOwner: id === owner2.id,
+        isYou: id === agentId
+      }))),
+      ...participation ? { rules: Object.freeze({
+        style: participation.style,
+        requireMentionForGroupReplies: participation.requireMentionForGroupReplies,
+        allowAgentToAgent: participation.allowAgentToAgent,
+        allowLongRunningCollaboration: participation.allowLongRunningCollaboration,
+        maxConsecutiveAgentTurns: participation.maxConsecutiveAgentTurns ?? null
+      }) } : {}
+    });
+  }
+  __name(roomFacts, "roomFacts");
   async function execute(current, turn) {
     let conversation;
     try {
@@ -3551,12 +3780,18 @@ ${error instanceof Error ? error.message : String(error)}`;
     }
     if (!conversation?.memberIds?.includes(agentId)) return loseMembership(current);
     const kind = conversation.memberIds.length > 2 ? "group" : "direct";
-    if (turn.inputs[0].mls && !await beforeTurn(current, turn)) return;
+    if (!await beforeTurn(current, turn)) return;
+    if (!options.relay) {
+      try {
+        turn.facts = await roomFacts(conversation);
+      } catch (error) {
+        warn("room read failed; input returns to the inbox")(error);
+        return dispose(queued(turn), "release", "room-unavailable");
+      }
+    }
     turn.trusted = await confirmTrusted(turn, conversation.memberIds);
     turn.notes = pendingNotes(current.id);
-    turn.contexts = await Promise.all(openErrands(current.id).map(async (record) => ({ record, encryptedOrigin: !!record.origin && await endpoint.getConversationContentMode(record.origin).then((mode2) => mode2 === "mls-dev-text", () => false) })));
-    const mode = turn.mls ? "presence" : driver.capabilities.streaming && resolveTurnVerbosity({ conversationType: kind }) === "verbose" ? "full" : "status";
-    turn.live.setMode(mode);
+    turn.contexts = openErrands(current.id);
     const history = driver.capabilities.sessionMemory === "none" ? await recentHistory(current, turn) : [];
     await materialize(current, turn);
     const bound = bindTools(current, turn);
@@ -3567,7 +3802,7 @@ ${error instanceof Error ? error.message : String(error)}`;
         if (live.length && !turn.controller.signal.aborted) {
           turn.inputs = live;
           turn.id = turnId(current.id, live);
-          turn.pickUp = () => pickUp(current, turn, mode);
+          turn.pickUp = () => pickUp(current, turn);
           try {
             work = Promise.resolve(driver.runTurn(buildTurn(current.id, turn, kind, history, bound.tools)));
           } catch (error) {
@@ -3613,26 +3848,21 @@ ${error instanceof Error ? error.message : String(error)}`;
       turn.ended.abort();
       bound.release();
       clearTimeout(turn.timer);
-      await deliver(current, turn, outcome, audienceOf(conversation));
+      await deliver(current, turn, outcome);
     } finally {
       turn.ended.abort();
       bound.release();
-      rmSync3(conversationMediaCacheDir(inboundMedia(current.id)), { recursive: true, force: true });
+      rmSync2(conversationMediaCacheDir(inboundMedia(current.id)), { recursive: true, force: true });
     }
   }
   __name(execute, "execute");
   function started(current, turn) {
     turn.submitted = true;
     progress(turn);
-    if (!turn.mls) void client.markAsRead(current.id).catch(warn("mark read"));
-    for (const { payload } of turn.mls ? [] : turn.inputs) {
-      if (payload.message.metadata?.inboundDisposition === "queued") {
-        void client.updateMessageDisposition(current.id, payload.message.id, "accepted_now").catch(warn("accepted_now"));
-      }
-    }
+    if (!options.relay) void client.markAsRead(current.id).catch(warn("mark read"));
   }
   __name(started, "started");
-  async function pickUp(current, turn, mode) {
+  async function pickUp(current, turn) {
     const live = queued(turn);
     if (live.length !== turn.inputs.length) {
       abort(turn, "requeue");
@@ -3642,7 +3872,7 @@ ${error instanceof Error ? error.message : String(error)}`;
       if (result.status === "submitted") {
         turn.pickUp = void 0;
         started(current, turn);
-        if (!turn.controller.signal.aborted) (turn.live = livePublisher(current, turn, mode)).open();
+        if (!turn.controller.signal.aborted) (turn.live = livePublisher(current, turn)).open();
       }
       return result;
     });
@@ -3656,20 +3886,19 @@ ${error instanceof Error ? error.message : String(error)}`;
   __name(pickUp, "pickUp");
   function requeue(current) {
     const turn = current.turn, next = current.queue[0];
-    if (!turn?.pickUp || turn.pickingUp || turn.controller.signal.aborted || !next) return;
-    if (!!next.mls !== !!turn.inputs[0].mls || turn.inputs.length >= MAX_INPUTS_PER_TURN) return;
+    if (!turn?.pickUp || turn.pickingUp || turn.controller.signal.aborted || !next || turn.inputs.length >= MAX_INPUTS_PER_TURN) return;
     abort(turn, "requeue");
   }
   __name(requeue, "requeue");
   async function confirmTrusted(turn, memberIds) {
-    if (!trustedAgents.size || driver.capabilities.remote || options.relay) return /* @__PURE__ */ new Set();
-    const candidates = turn.inputs.map(({ payload }) => payload.message).filter((message2) => message2.senderType === "ai_agent" && message2.senderId !== agentId && trustedAgents.has(message2.senderId) && (turn.mls ? true : message2.metadata?.[ACTED_FOR_OWNER] === true && message2.metadata.turnSemantics === "turn_complete" && message2.forwarded !== true));
+    const audience = turn.mls;
+    if (!trustedAgents.size || driver.capabilities.remote || options.relay || !audience) return /* @__PURE__ */ new Set();
+    const candidates = turn.inputs.map(({ payload }) => payload.message).filter((message2) => message2.senderType === "ai_agent" && message2.senderId !== agentId && trustedAgents.has(message2.senderId));
     if (!candidates.length) return /* @__PURE__ */ new Set();
-    const roster = turn.mls?.roster ?? [];
-    if (roster.some((entry) => isConnectorRelayInstallation(entry.device.installationId))) return /* @__PURE__ */ new Set();
-    const rosterIds = turn.mls ? await Promise.all(roster.map(async (entry) => await endpoint.mlsAccountOf(turn.mls.conversationId, entry.device.principal) ?? "")) : [];
+    if (audience.roster.some((entry) => isConnectorRelayInstallation(entry.device.installationId))) return /* @__PURE__ */ new Set();
+    const rosterIds = await Promise.all(audience.roster.map(async (entry) => await endpoint.mlsAccountOf(audience.conversationId, entry.device.principal) ?? ""));
     if (rosterIds.includes("")) return /* @__PURE__ */ new Set();
-    const member = /* @__PURE__ */ __name((id) => memberIds.includes(id) && (!turn.mls || rosterIds.includes(id)), "member");
+    const member = /* @__PURE__ */ __name((id) => memberIds.includes(id) && rosterIds.includes(id), "member");
     if (candidates.some((message2) => !member(message2.senderId))) return /* @__PURE__ */ new Set();
     try {
       const { ownerId } = await client.getAgentMe();
@@ -3732,7 +3961,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     return check;
   }
   __name(reaudience, "reaudience");
-  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join6(home, "runner", options.environmentId, agentId) }), "inboundMedia");
+  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join7(home, "runner", options.environmentId, agentId) }), "inboundMedia");
   async function materialize(current, turn) {
     if (driver.capabilities.remote) return;
     for (const { payload: { message: message2 } } of turn.inputs) {
@@ -3775,7 +4004,7 @@ ${error instanceof Error ? error.message : String(error)}`;
         const file = await admitFile(path);
         if (typeof file === "string") return { result: toolText(file, true) };
         turn.outbox.push(file.path);
-        return { result: toolText(`${basename3(file.path)} will be sent with your reply.`) };
+        return { result: toolText(`${basename4(file.path)} will be sent with your reply.`) };
       }, "send_file"),
       communicate: /* @__PURE__ */ __name(async (args) => ({ result: await communicate(current, turn, args) }), "communicate"),
       // RUN-25 through a tool: the same `ask`, so the same responder, card, expiry, waiting_input and paused deadline;
@@ -3797,35 +4026,30 @@ ${error instanceof Error ? error.message : String(error)}`;
     };
     const cards = carriesCards(turn.mls), items = carriesItems(turn.mls);
     const errand = turn.errand;
-    const sendsFiles = roots.length > 0 && actedForOwner(turn);
+    const sendsFiles = roots.length > 0 && forOwner2(turn);
     const binding = {
-      // §6: an encrypted turn gets no_reply and a communicate that only lists and sends encrypted text to its own room,
-      // and in a room created for cards, ask_question. §12.6: an errand turn reaches its recipient and its origin, and
-      // asks only in an origin its report may go to.
+      // §6: a turn gets no_reply, a communicate that only lists and sends encrypted text to its own room, and react, which
+      // a relay's credential cannot do; in a room created for cards, ask_question, and in one that carries items, send_file.
+      // §12.6: an errand turn reaches its recipient and its origin, and asks only in an origin its report goes to.
       definitions: errand ? [
         TOOLS.no_reply,
         errandCommunicate("contact" in errand.target),
-        ...errand.reports && (!turn.mls || cards) && offersQuestions ? [TOOLS.ask_question] : []
-      ] : turn.mls ? [
+        ...errand.reports && cards && offersQuestions ? [TOOLS.ask_question] : []
+      ] : [
         TOOLS.no_reply,
         ENCRYPTED_COMMUNICATE,
+        ...options.relay ? [] : [TOOLS.react],
         ...items && sendsFiles ? [TOOLS.send_file] : [],
         ...cards && offersQuestions ? [TOOLS.ask_question] : []
-      ] : [
-        TOOLS.no_reply,
-        canonCommunicateToolDefinition(),
-        TOOLS.react,
-        ...sendsFiles ? [TOOLS.send_file] : [],
-        ...offersQuestions ? [TOOLS.ask_question] : []
       ],
       async call(name, args) {
         if (!turn.open) throw turnEnded2();
         if (name === "no_reply" && turn.silenced) return { result: toolText(NO_REPLY_ACK_NOTE) };
         if (turn.controller.signal.aborted || turn.silenced) throw turnEnded2();
-        if (turn.mls && !errand && UNAVAILABLE_ENCRYPTED.includes(name) && !(name === "ask_question" && cards) && !(name === "send_file" && items)) {
+        if (!errand && UNAVAILABLE_ENCRYPTED.includes(name) && !(name === "ask_question" && cards) && !(name === "send_file" && items)) {
           return { result: toolText(`${name} is not available in encrypted conversations yet.`, true) };
         }
-        if (name === "send_file" && !errand && roots.length && !actedForOwner(turn)) {
+        if (name === "send_file" && !errand && roots.length && !forOwner2(turn)) {
           return { result: toolText("send_file sends files only in a turn answering your owner.", true) };
         }
         const handler = binding.definitions.some((definition) => definition.name === name) ? handlers[name] : void 0;
@@ -3846,11 +4070,9 @@ ${error instanceof Error ? error.message : String(error)}`;
     }, "call") } };
   }
   __name(bindTools, "bindTools");
-  const sealed = /* @__PURE__ */ __name((turn) => turn.errand ? "room" in turn.errand.target && !!turn.errand.target.mls : !!turn.mls, "sealed");
   async function communicate(current, turn, args) {
     const errand = turn.errand;
-    const origins = errand ? errand.origin ? [errand.origin.room] : [] : turn.contexts.flatMap(({ record }) => record.origin ? [record.origin] : []);
-    if (!errand && !sealed(turn) && !origins.length) return executeCanonCommunicateTool(client, args);
+    const origins = errand ? errand.origin ? [errand.origin.room] : [] : turn.contexts.flatMap((record) => record.origin ? [record.origin] : []);
     let command;
     try {
       command = parseCommunicateToolInput(args);
@@ -3862,19 +4084,14 @@ ${error instanceof Error ? error.message : String(error)}`;
     }
     if (command.action === "message_existing" && command.text.trim()) {
       const to = command.conversationId;
-      if (turn.mls && !errand && to === current.id) return sealedSend(turn, to, command.text, turn.mls);
+      if (!errand && to === current.id) return sealedSend(turn, to, command.text, turn.mls);
       if (errand && "room" in errand.target && to === errand.target.room) {
         reach(turn, to);
-        return errand.target.mls ? sealedSend(turn, to, command.text) : executeCanonCommunicateTool(client, args);
+        return sealedSend(turn, to, command.text);
       }
       if (origins.includes(to)) {
-        const mode = await endpoint.getConversationContentMode(to);
-        if (mode === "mls-dev-text" && mlsOn) return sealedSend(turn, to, command.text);
-        if (mode !== "plaintext") return toolText(`${to} is an encrypted conversation this runner cannot write to.`, true);
-        if (sealed(turn)) {
-          return toolText(errand ? `This errand's recipient is in an encrypted conversation, so nothing of it may go to ${to}, which is not encrypted. Your final answer stays on your owner's machine as your report.` : `Nothing from this encrypted conversation may go to ${to}: it is not encrypted, and Canon must never receive this conversation's content in plaintext. Your owner sees on their machine that the errand was answered.`, true);
-        }
-        return executeCanonCommunicateTool(client, args);
+        if (await endpoint.getConversationContentMode(to) === "mls-dev-text" && mlsOn) return sealedSend(turn, to, command.text);
+        return toolText(`${to} is not an encrypted conversation this runner can write to.`, true);
       }
     }
     if (errand && "contact" in errand.target && (command.action === "start_conversation" || command.action === "start_direct") && command.principalId === errand.target.contact) {
@@ -3884,8 +4101,7 @@ ${error instanceof Error ? error.message : String(error)}`;
 ${JSON.stringify(result, null, 2)}`);
     }
     if (errand) return toolText("On an errand, communicate can only list conversations or agents, or send text to the errand's recipient or its origin.", true);
-    if (sealed(turn)) return toolText("In an encrypted conversation, communicate can only list conversations or agents, or send text to this conversation.", true);
-    return executeCanonCommunicateTool(client, args);
+    return toolText("In an encrypted conversation, communicate can only list conversations or agents, or send text to this conversation.", true);
   }
   __name(communicate, "communicate");
   async function sealedSend(turn, roomId, text3, audience) {
@@ -3906,9 +4122,10 @@ ${JSON.stringify(result, null, 2)}`);
           notice: false,
           mls: mls2
         };
-        journal.save(record);
-        const sent2 = await publish(record);
+        saveOutput(record);
+        const sent2 = await publish(record, turn.retire.signal);
         if (sent2 !== "pending") journal.remove(messageId);
+        else if (turn.retire.signal.aborted) await stopOutput(record);
         return sent2;
       })().catch((error) => {
         turn.said.delete(messageId);
@@ -3922,7 +4139,7 @@ ${JSON.stringify(result, null, 2)}`);
   async function admitFile(path) {
     if (typeof path !== "string" || !isAbsolute3(path)) return "send_file needs an absolute file path";
     try {
-      const real = await realpath5(path);
+      const real = await realpath4(path);
       if (!roots.some((root) => real.startsWith(root.endsWith(sep) ? root : `${root}${sep}`))) return `${path} is outside the directories this agent may share from`;
       const info = await stat2(real);
       if (!info.isFile() || info.size < 1 || info.size > MAX_CANON_MEDIA_BYTES) return `${path} must be a file from 1 byte to 100 MiB`;
@@ -3932,60 +4149,6 @@ ${JSON.stringify(result, null, 2)}`);
     }
   }
   __name(admitFile, "admitFile");
-  async function attach(conversationId, turn, candidates) {
-    const attachments = [];
-    const flows = [];
-    const refused2 = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const candidate of candidates) {
-      const file = await admitFile(candidate);
-      if (typeof file === "string") {
-        refused2.push(typeof candidate === "string" ? basename3(candidate) : "a file");
-        continue;
-      }
-      if (seen.has(file.path)) continue;
-      seen.add(file.path);
-      if (attachments.length >= MAX_GROUP_PARTS - 1) {
-        refused2.push(basename3(file.path));
-        continue;
-      }
-      try {
-        const media = await client.getFileMediaPipeline(options.fetch);
-        const attachmentId = `${turn.id}-${seen.size}`;
-        const [prepared] = await media.prepare({ conversationId, attachmentId, files: [{
-          source: file.path,
-          descriptor: { mimeType: inferUploadMimeType(file.path), sizeBytes: file.size, fileName: basename3(file.path) }
-        }] }, { signal: turn.retire.signal });
-        attachments.push(prepared);
-        flows.push(`${conversationId}:upload:${attachmentId}`);
-      } catch (error) {
-        if (turn.retire.signal.aborted) break;
-        warn("file upload")(error);
-        refused2.push(basename3(file.path));
-      }
-    }
-    return { attachments, flows, refused: refused2 };
-  }
-  __name(attach, "attach");
-  const releaseUploads = /* @__PURE__ */ __name((attachments = []) => void (attachments.length && client.getFileMediaPipeline(options.fetch).then((media) => Promise.all(attachments.map((attachment) => attachment.uploadId && media.releasePreparedUpload(attachment.uploadId)))).catch(warn("release upload"))), "releaseUploads");
-  async function renew(flows, signal) {
-    const media = await client.getFileMediaPipeline(options.fetch);
-    const renewed = [];
-    for (const id of flows) {
-      let prepared;
-      const off = media.subscribe((flow) => {
-        if (flow.id === id && flow.status === "prepared") prepared = flow.files[0]?.attachment;
-      });
-      try {
-        await media.resume(id, { signal });
-      } finally {
-        off();
-      }
-      renewed.push(prepared);
-    }
-    return renewed;
-  }
-  __name(renew, "renew");
   async function recentHistory(current, turn) {
     const first = turn.inputs[0].payload.message;
     try {
@@ -3993,9 +4156,11 @@ ${JSON.stringify(result, null, 2)}`);
       const skip = new Set([...turn.inputs, ...current.queue].map(({ payload }) => payload.message.id));
       const at = Math.max(...turn.inputs.map(({ payload }) => recent.findIndex((message2) => message2.id === payload.message.id)));
       const before = /* @__PURE__ */ __name((message2, index) => message2.senderId === agentId || (at >= 0 ? index > at : !first.createdAt || String(message2.createdAt ?? "") < first.createdAt), "before");
-      const window = recent.filter((message2, index) => before(message2, index) && !message2.deleted && !skip.has(message2.id)).slice(0, HISTORY_WINDOW);
-      const sameAudience = turn.mls ? await Promise.all(window.map((message2) => endpoint.mlsDevGroups.readVerifiedMessageBinding({ conversationId: current.id, messageId: message2.id }).then((binding) => !!binding && JSON.stringify(binding.head) === JSON.stringify(turn.mls.head), () => false))) : void 0;
-      return window.filter((_, index) => !sameAudience || sameAudience[index]).reverse();
+      const ownerId = driver.capabilities.ownerHistoryOnly ? (await client.getAgentMe()).ownerId : void 0;
+      const allowed = /* @__PURE__ */ __name((message2) => ownerId === void 0 || message2.senderId === agentId || message2.senderId === ownerId, "allowed");
+      const window = recent.filter((message2, index) => before(message2, index) && !message2.deleted && !skip.has(message2.id) && allowed(message2)).slice(0, HISTORY_WINDOW);
+      const sameAudience = await Promise.all(window.map((message2) => endpoint.mlsDevGroups.readVerifiedMessageBinding({ conversationId: current.id, messageId: message2.id }).then((binding) => !!binding && JSON.stringify(binding.head) === JSON.stringify(turn.mls.head), () => false)));
+      return window.filter((_, index) => sameAudience[index]).reverse();
     } catch (error) {
       warn("history read failed; the turn runs without it")(error);
       return [];
@@ -4015,8 +4180,9 @@ ${JSON.stringify(result, null, 2)}`);
     return void 0;
   }
   __name(outcomeOf, "outcomeOf");
-  async function deliver(current, turn, outcome, audience) {
+  async function deliver(current, turn, outcome) {
     if (turn.reason === "shutdown") return turn.live.end("stopped");
+    const audience = turn.mls;
     const result = outcome && "result" in outcome ? outcome.result : void 0;
     const stopped = /* @__PURE__ */ __name(() => turn.retire.signal.aborted, "stopped");
     const silent = !stopped() && (turn.silenced !== void 0 || !turn.reason && result?.reply === null);
@@ -4024,141 +4190,108 @@ ${JSON.stringify(result, null, 2)}`);
     const failed = !stopped() && !silent && !answered2;
     if (failed && outcome && "error" in outcome) warn("the runtime failed the turn")(outcome.error);
     let text3 = answered2 ? result.reply : failed ? FAILURE_NOTICE : null;
-    let attachments = [];
-    let flows = [];
     let items = [];
     const resultFiles = answered2 && Array.isArray(result.files) ? result.files : [];
-    if (answered2 && turn.mls && carriesItems(turn.mls)) {
+    if (answered2 && carriesItems(audience)) {
       const admitted = await admitItems(current.id, turn, [...turn.outbox, ...resultFiles]);
       items = admitted.items;
       if (admitted.refused.length) text3 = `${text3}
 
 (Could not attach ${admitted.refused.join(", ")}.)`;
-    } else if (answered2 && turn.mls && resultFiles.length) {
+    } else if (answered2 && resultFiles.length) {
       text3 = `${text3}
 
-(${ENCRYPTED_FILES}: ${resultFiles.map((file) => typeof file === "string" ? basename3(file) : "a file").join(", ")}.)`;
-    } else if (answered2 && !turn.mls) {
-      const files = await attach(current.id, turn, [...turn.outbox, ...resultFiles]);
-      ({ attachments, flows } = files);
-      if (files.refused.length) text3 = `${text3}
-
-(Could not attach ${files.refused.join(", ")}.)`;
+(${ENCRYPTED_FILES}: ${resultFiles.map((file) => typeof file === "string" ? basename4(file) : "a file").join(", ")}.)`;
     }
     let sent;
     if (text3 !== null && !stopped()) {
       const kind = failed ? "failed" : "final";
+      const replyAuthority = await replyGrant(current.id, turn.inputs.at(-1).payload.message.id, stopped);
       const record = {
         version: 1,
         turnId: turn.id,
         conversationId: current.id,
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        audience,
+        audience: null,
         inputs: turn.inputs.map((input) => input.id),
         text: text3,
-        ...attachments.length ? { attachments, flows } : {},
         ...items.length ? { items } : {},
-        options: outputOptions(
-          turn.id,
-          turn.inputs.at(-1).payload,
-          kind,
-          !turn.mls && actedForOwner(turn),
-          turn.mls ? keyed().text(kind, current.id, turn.id) : void 0
-        ),
+        options: { messageId: keyed().text(kind, current.id, turn.id), ...replyAuthority ? { replyAuthority } : {} },
         notice: failed,
-        ...turn.mls ? { mls: turn.mls } : {}
+        mls: audience
       };
-      journal.save(record);
+      saveOutput(record);
       sent = await publish(record, turn.retire.signal);
-      attachments = record.attachments ?? [];
-      if (sent === "pending" && !stopped()) return turn.live.end(turn.reason && (!turn.mls || STOPS.includes(turn.reason)) ? "stopped" : "ended");
+      if (sent === "pending" && !stopped()) return turn.live.end(turn.reason && STOPS.includes(turn.reason) ? "stopped" : "ended");
+      if (sent === "pending") await stopOutput(record);
     }
     turn.live.end(sent === "delivered" ? "answered" : stopped() ? "stopped" : "ended");
-    releaseUploads(attachments);
     if (failed && outcome && "error" in outcome && outcome.error instanceof DriverSessionError) {
       await resetSession(turn.session).catch(warn("session reset"));
     }
-    if (turn.mls && (turn.reason === "audience" || turn.reason === "membership")) {
+    if (turn.reason === "audience" || turn.reason === "membership") {
       await resetSession(turn.session).catch(warn("session reset"));
       if (current.session === turn.session) current.session = void 0;
     }
-    if (silent && !turn.mls) reportNoReplyOutcome(client, { conversationId: current.id, messageId: turn.inputs.at(-1).payload.message.id, ...turn.silenced });
     const reason = stopped() ? turn.reason : silent ? "silent" : answered2 ? "answered" : "failed";
     if (await settle(turn.inputs.map((input) => input.id), reason) && sent !== void 0) journal.remove(turn.id);
   }
   __name(deliver, "deliver");
-  const actedForOwner = /* @__PURE__ */ __name((turn) => turn.inputs.every(({ payload: { message: message2 } }) => message2.isOwner === true || message2.senderType === "ai_agent" && turn.trusted.has(message2.id)), "actedForOwner");
-  async function sendWithFiles(record, text3, options2, signal) {
-    const root = options2.messageId;
-    const register = /* @__PURE__ */ __name((attachments, replaces) => {
-      const bodies = [
-        ...attachments.map((attachment) => ({ text: "", contentType: attachment.kind, attachments: [attachment] })),
-        ...(text3 ? splitTextByUtf8Bytes(text3) : []).map((part) => ({ text: part }))
-      ];
-      const parts = bodies.map(({ text: partText, ...body }, index) => ({ text: partText, options: {
-        ...options2,
-        ...body,
-        messageId: `${root}-part-${index + 1}`,
-        metadata: buildChunkedMessagePartMetadata({ groupId: root, metadata: options2.metadata, index: index + 1, count: bodies.length })
-      } }));
-      return client.prepareMessageGroup(record.conversationId, root, parts, { signal, ...replaces ? { operationId: sha2563(JSON.stringify([root, ...attachments.map((attachment) => attachment.uploadId)])), replacesOperationId: replaces } : {} }).then((group2) => ({ ...group2, count: parts.length }));
-    }, "register");
-    const original = await register(record.attachments);
-    let group = original;
-    const cancel = /* @__PURE__ */ __name(() => {
-      void client.cancelMessageGroup(group.id).catch(() => void 0);
-    }, "cancel");
-    signal?.addEventListener("abort", cancel, { once: true });
-    try {
-      for (; ; ) {
-        try {
-          for (let index = 0; index < group.count; index += 1) await group.sendPart(index, { signal });
-          return;
-        } catch (error) {
-          if (!record.flows || !EXPIRED_UPLOAD.includes(error.code ?? "")) throw error;
-          const renewed = await renew(record.flows, signal).catch((failure) => {
-            throw failure.retryable === false ? error : failure;
-          });
-          if (renewed.some((attachment) => !attachment) || renewed.every((attachment, index) => attachment.uploadId === record.attachments[index].uploadId)) throw error;
-          record.attachments = renewed;
-          group = await register(record.attachments, original.id);
-        }
-      }
-    } finally {
-      signal?.removeEventListener("abort", cancel);
-    }
-  }
-  __name(sendWithFiles, "sendWithFiles");
+  const forOwner2 = /* @__PURE__ */ __name((turn) => turn.inputs.every(({ payload: { message: message2 } }) => message2.isOwner === true || message2.senderType === "ai_agent" && turn.trusted.has(message2.id)), "forOwner");
   async function publish(record, retire) {
-    const sent = await send(record.conversationId, record.text, record.options, retire, record);
-    if (sent !== "refused" || record.notice || record.mls || record.errand) return sent;
-    const notice = {
-      ...record.options,
-      messageId: `${record.options.messageId}:short`,
-      metadata: { ...record.options.metadata, replyBehavior: "suppress_auto_reply" }
-    };
-    return await send(record.conversationId, STOPS_SHORT_NOTICE, notice, retire) === "pending" ? "pending" : "refused";
+    return send(record.text, record.options, record.mls, retire, record);
   }
   __name(publish, "publish");
-  async function send(conversationId, text3, options2, retire, record, mls2 = record?.mls) {
+  async function send(text3, options2, mls2, retire, record) {
+    const grant = options2.replyAuthority;
+    const parts = encryptedMessages(mls2, text3, options2, record);
     const sent = await (async () => {
       for (let attempt = 0; ; attempt += 1) {
-        const files = record?.attachments?.length ?? 0;
-        const result = await untilHalt((mls2 ? sendEncryptedItems(mls2, record?.items ?? [], retire).then(() => sendEncrypted(mls2, options2.messageId, text3, retire)) : files ? sendWithFiles(record, fitGroup(text3, files), options2, retire) : sendMessageWithRetryChunked(client, conversationId, fitGroup(text3, 0), options2, { signal: retire })).then(() => "delivered", (error) => error));
+        const result = await untilHalt(sendEncryptedItems(mls2, record?.items ?? [], retire).then(async () => {
+          for (const part of parts) await sendEncrypted(mls2, part.messageId, part.text, retire, grant && { ...grant, turnId: options2.messageId, complete: part.last });
+        }).then(() => "delivered", (error) => error));
         if (result === "delivered" || result === "pending") return result;
-        if (retire?.aborted || isPendingCanonOperation(result)) return "pending";
-        if (mls2 ? result.retryable === false : !isRetryableCanonDeliveryError(result)) {
+        if (retire?.aborted || isPendingCanonOperation(result) && parts.length < 2) return "pending";
+        if (result.retryable === false) {
           warn("Canon refused a reply")(result);
           return "refused";
         }
         if (await untilHalt(pause2(Math.min(3e4, 1e3 * 2 ** attempt))) === "pending") return "pending";
       }
     })();
-    if (mls2) forgetGuard(mls2, options2.messageId, sent);
+    for (const part of parts) forgetGuard(mls2, part.messageId, sent);
     return sent;
   }
   __name(send, "send");
-  async function sendEncrypted(audience, messageId, text3, signal) {
+  const partsOf = /* @__PURE__ */ __name((text3, options2) => encryptedParts(text3, options2.replyAuthority ? MAX_REPLY_PARTS : MAX_GROUP_PARTS), "partsOf");
+  function saveOutput(record) {
+    record.parts = partsOf(record.text, record.options).length;
+    journal.save(record);
+  }
+  __name(saveOutput, "saveOutput");
+  function encryptedMessages(mls2, text3, options2, record) {
+    const all = record && record.parts === void 0 ? [fitEncrypted(text3)] : partsOf(text3, options2);
+    return all.slice(0, record?.parts).map((part, index) => ({
+      text: part,
+      last: index === all.length - 1,
+      messageId: index ? keyed().text("part", mls2.conversationId, options2.messageId, String(index)) : options2.messageId
+    }));
+  }
+  __name(encryptedMessages, "encryptedMessages");
+  async function stopOutput(record) {
+    let queued2 = 0;
+    for (const [index, { messageId }] of encryptedMessages(record.mls, record.text, record.options, record).entries()) {
+      const status = (await endpoint.getOperation(encryptedOperation(record.mls, messageId)))?.status;
+      if (status && status !== "succeeded" && status !== "rejected") queued2 = index + 1;
+    }
+    if (queued2) {
+      const { items: _items, errand: _errand, ...rest } = record;
+      journal.save({ ...rest, turnId: `${record.turnId}:stopped`, inputs: [], parts: queued2 });
+    }
+    journal.remove(record.turnId);
+  }
+  __name(stopOutput, "stopOutput");
+  async function sendEncrypted(audience, messageId, text3, signal, replyAuthority) {
     const operationId = encryptedOperation(audience, messageId);
     if (!guards.has(operationId)) {
       guards.set(operationId, endpoint.registerDeliveryGuard(operationId, () => assertAudience(audience).then(() => true, (error) => {
@@ -4169,11 +4302,38 @@ ${JSON.stringify(result, null, 2)}`);
     if (!await endpoint.getOperation(operationId)) await assertAudience(audience);
     signal?.throwIfAborted();
     await endpoint.executeResult(
-      { action: "send_message", body: { conversationId: audience.conversationId, messageId, text: fitEncrypted(text3), contentType: "text" } },
+      { action: "send_message", body: {
+        conversationId: audience.conversationId,
+        messageId,
+        text: text3,
+        contentType: "text",
+        ...replyAuthority ? { replyAuthority } : {}
+      } },
       { operationId, guardId: operationId }
     );
   }
   __name(sendEncrypted, "sendEncrypted");
+  async function replyGrant(roomId, source, stopped) {
+    for (let attempt = 0; !options.relay; attempt += 1) {
+      try {
+        await authorize();
+        if (!outboundClosed) return void 0;
+        const { changes } = await endpoint.query(
+          "admit_messages",
+          { conversationId: roomId, messageIds: [source] }
+        );
+        return changes[0]?.data?.replyAuthority;
+      } catch (error) {
+        if (attempt >= REPLY_GRANT_RETRIES || stopped() || halt.signal.aborted) {
+          warn("no reply authority")(error);
+          return void 0;
+        }
+        await untilHalt(pause2(1e3 * 2 ** attempt));
+      }
+    }
+    return void 0;
+  }
+  __name(replyGrant, "replyGrant");
   async function sendEncryptedItems(audience, items, signal) {
     if (!items.length) return;
     const media = await client.getFileMediaPipeline(options.fetch);
@@ -4203,20 +4363,20 @@ ${JSON.stringify(result, null, 2)}`);
     for (const candidate of candidates) {
       const file = await admitFile(candidate);
       if (typeof file === "string") {
-        refused2.push(typeof candidate === "string" ? basename3(candidate) : "a file");
+        refused2.push(typeof candidate === "string" ? basename4(candidate) : "a file");
         continue;
       }
       if (seen.has(file.path)) continue;
       seen.add(file.path);
       const mimeType = inferUploadMimeType(file.path);
-      if (items.length >= MAX_GROUP_PARTS - 1 || !resolveAllowedUploadMimeType({ mimeType, fileName: basename3(file.path) })) {
-        refused2.push(basename3(file.path));
+      if (items.length >= MAX_GROUP_PARTS - 1 || !resolveAllowedUploadMimeType({ mimeType, fileName: basename4(file.path) })) {
+        refused2.push(basename4(file.path));
         continue;
       }
       items.push({
         path: file.path,
         messageId: keyed().text("item", roomId, turn.id, String(items.length)),
-        fileName: basename3(file.path),
+        fileName: basename4(file.path),
         mimeType,
         sizeBytes: file.size
       });
@@ -4249,8 +4409,9 @@ ${JSON.stringify(result, null, 2)}`);
       messages: Object.freeze(messages),
       history: Object.freeze(history.map((message2) => inputMessage(message2))),
       ...turn.notes.length ? { ownerNotes: Object.freeze(turn.notes.map((note) => note.text)) } : {},
-      ...turn.contexts.length ? { errands: Object.freeze(turn.contexts.map(({ record }) => errandFacts(record))) } : {},
-      ...turn.errand ? { errand: errandFacts(turn.errand.record) } : {}
+      ...turn.contexts.length ? { errands: Object.freeze(turn.contexts.map((record) => errandFacts(record))) } : {},
+      ...turn.errand ? { errand: errandFacts(turn.errand.record) } : {},
+      ...turn.facts ? { roomFacts: turn.facts } : {}
     });
     const line = /* @__PURE__ */ __name((message2, mark = "") => promptLine(message2, message2.senderId === agentId ? "You" : message2.senderName ?? message2.senderId, turn.media.get(message2.id), mark), "line");
     const open4 = /* @__PURE__ */ __name(() => turn.open && !turn.controller.signal.aborted, "open");
@@ -4259,25 +4420,21 @@ ${JSON.stringify(result, null, 2)}`);
       session: turn.session,
       // §12.6: an errand turn's prompt is its errand; the owner's message is only its input's record.
       prompt: turn.errand ? errandPrompt(turn.errand) : [
+        ...turn.facts ? [...factsPrompt(turn.facts, kind), ""] : [],
         ...turn.notes.flatMap((note) => [NOTE_OPEN, defused(note.text), NOTE_CLOSE, ""]),
-        ...turn.contexts.flatMap((context) => [...contextPrompt(context, !!turn.mls), ""]),
-        ...history.length ? ["Earlier in this conversation (context, not new requests):", ...history.map((message2) => line(message2)), "", "New messages:"] : turn.notes.length || turn.contexts.length ? ["New messages:"] : [],
+        ...turn.contexts.flatMap((record) => [...contextPrompt(record), ""]),
+        ...history.length ? ["Earlier in this conversation (context, not new requests):", ...history.map((message2) => line(message2)), "", "New messages:"] : turn.facts || turn.notes.length || turn.contexts.length ? ["New messages:"] : [],
         ...turn.inputs.map(({ payload: { message: message2 } }) => line(message2, message2.isOwner === true ? OWNER_MARK : trustedSender(message2) ? TRUSTED_MARK : ""))
       ].join("\n"),
       input,
       files: turn.inputs.flatMap(({ payload: { message: message2 } }) => turn.media.get(message2.id)?.files.map((file) => file.path) ?? []),
       signal: turn.controller.signal,
-      onText: /* @__PURE__ */ __name((snapshot) => {
-        if (live()) {
-          progress(turn);
-          turn.live.text(snapshot);
-        }
+      // Text and activity are progress (RUN-12), and nothing of them is published (§6).
+      onText: /* @__PURE__ */ __name(() => {
+        if (live()) progress(turn);
       }, "onText"),
-      onActivity: /* @__PURE__ */ __name((event) => {
-        if (live()) {
-          progress(turn);
-          turn.live.activity(event);
-        }
+      onActivity: /* @__PURE__ */ __name(() => {
+        if (live()) progress(turn);
       }, "onActivity"),
       ask: /* @__PURE__ */ __name((request) => live() ? ask(roomId, turn, input.sender, request) : Promise.reject(turnEnded2()), "ask"),
       state: driverState(turn.session, open4),
@@ -4296,7 +4453,7 @@ ${JSON.stringify(result, null, 2)}`);
         loseMembership(room(roomId));
         throw new Error("The agent is no longer a member of this conversation");
       }
-      if (turn.mls && await readAgain(() => reaudience(roomId, turn), Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS) === "changed") {
+      if (await readAgain(() => reaudience(roomId, turn), Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS) === "changed") {
         if (!turn.controller.signal.aborted) {
           void dispose(queued(turn), "settle", "mls-obsolete-audience");
           abort(turn, "audience");
@@ -4319,68 +4476,32 @@ ${JSON.stringify(result, null, 2)}`);
     if (turn.errand && !turn.errand.reports) return Promise.resolve({ status: "cancelled" });
     const signal = AbortSignal.any([turn.controller.signal, turn.ended.signal]);
     turn.asking += 1;
-    if (!turn.mls) turn.live.waiting(true);
     const answer = (async () => {
       try {
-        if (turn.mls && (!carriesCards(turn.mls) || !mlsAsks)) throw new Error("approvals and questions need an encrypted conversation created for them");
+        if (!turn.mls || !carriesCards(turn.mls) || !mlsAsks) throw new Error("approvals and questions need an encrypted conversation created for them");
         const ownerId = await (owner ??= client.getAgentMe().then((me) => me.ownerId, (error) => {
           owner = void 0;
           throw error;
         }));
         const secret = request.kind === "text" && request.secret === true;
         const responder = secret || sender.type !== "human" ? ownerId : sender.id;
-        const requestId = turn.mls ? keyed().request(roomId, turn.id, request.id) : `ask-${sha2563(JSON.stringify([turn.id, request.id])).slice(0, 32)}`;
-        const expiresAt = Date.now() + askExpiryMs;
-        if (turn.mls) {
-          return await mlsAsks.ask({
-            conversationId: roomId,
-            session: turn.session,
-            requestId,
-            responder,
-            ownerId,
-            request,
-            expiresAtMs: expiresAt,
-            audience: /* @__PURE__ */ __name(() => turn.mls, "audience"),
-            signal,
-            recheck: /* @__PURE__ */ __name(() => checkAudience(room(roomId)), "recheck"),
-            pending: /* @__PURE__ */ __name(() => turn.live.waiting(true), "pending"),
-            // Stop, and a new member (whose card is void for every device), withdraw a card, and so does the turn's end;
-            // shutdown leaves it to restart recovery, and an agent no longer in the room can send nothing.
-            ending: /* @__PURE__ */ __name(() => turn.reason === "shutdown" ? "keep" : turn.reason === "membership" ? "drop" : turn.reason && STOPS.includes(turn.reason) ? "stopped" : "turn_ended", "ending")
-          });
-        }
-        let manager = approvals.get(roomId);
-        if (!manager) approvals.set(roomId, manager = new ApprovalManager(client, agentId, ownerId));
-        const options2 = { requestId, expiresAt, signal };
-        if (request.kind === "approve") {
-          let created = false;
-          const result2 = await manager.requestApproval(roomId, approvalScope(request), {}, {
-            toolSummary: request.title,
-            responseUserId: responder,
-            turnId: turn.id,
-            ...request.detail ? { details: [{ label: "Details", value: request.detail.slice(0, 500) }] } : {},
-            ...request.risk ? { riskLevel: request.risk, risk: request.risk } : {},
-            ignoreSessionRules: request.allowSession !== true,
-            allowSessionRule: request.allowSession === true
-          }, { ...options2, onCreated: /* @__PURE__ */ __name(() => {
-            created = true;
-          }, "onCreated") });
-          if (created && !result2.respondedBy) return { status: "expired" };
-          return { status: "answered", by: result2.respondedBy ?? ownerId, allow: result2.decision === "allow", scope: !created || result2.sessionRule ? "session" : "once" };
-        }
-        const choices = request.kind === "choose" ? request.options.map(({ id, label }) => ({ label, value: id })) : void 0;
-        const result = await manager.request("input", roomId, {
-          kind: secret ? "secret" : "clarify",
-          prompt: request.question,
-          responseUserId: responder,
-          turnId: turn.id,
-          ...secret ? { sensitive: true } : {},
-          ...request.kind === "choose" && request.multiple ? { questions: [{ id: "choice", question: request.question, choices, multiSelect: true }] } : choices ? { choices } : {}
-        }, options2);
-        if (result.status !== "submitted") return { status: result.status === "timeout" ? "expired" : "cancelled" };
-        if (request.kind !== "choose") return { status: "answered", by: responder, text: result.value };
-        const picked = result.answers ? Object.values(result.answers).flatMap((entry) => entry.answers) : [result.value];
-        return { status: "answered", by: responder, choices: picked.filter((id) => request.options.some((option) => option.id === id)) };
+        const requestId = keyed().request(roomId, turn.id, request.id);
+        return await mlsAsks.ask({
+          conversationId: roomId,
+          session: turn.session,
+          requestId,
+          responder,
+          ownerId,
+          request,
+          expiresAtMs: Date.now() + askExpiryMs,
+          audience: /* @__PURE__ */ __name(() => turn.mls, "audience"),
+          signal,
+          recheck: /* @__PURE__ */ __name(() => checkAudience(room(roomId)), "recheck"),
+          pending: /* @__PURE__ */ __name(() => turn.live.waiting(true), "pending"),
+          // Stop, and a new member (whose card is void for every device), withdraw a card, and so does the turn's end;
+          // shutdown leaves it to restart recovery, and an agent no longer in the room can send nothing.
+          ending: /* @__PURE__ */ __name(() => turn.reason === "shutdown" ? "keep" : turn.reason === "membership" ? "drop" : turn.reason && STOPS.includes(turn.reason) ? "stopped" : "turn_ended", "ending")
+        });
       } catch (error) {
         if (signal.aborted) throw turnEnded2();
         warn("ask could not be put to anyone")(error);
@@ -4401,7 +4522,7 @@ ${JSON.stringify(result, null, 2)}`);
     const file = stateFile(session);
     let data = {};
     try {
-      data = JSON.parse(readFileSync5(file, "utf8"));
+      data = JSON.parse(readFileSync6(file, "utf8"));
     } catch {
     }
     const save = /* @__PURE__ */ __name((next) => {
@@ -4433,20 +4554,13 @@ ${JSON.stringify(result, null, 2)}`);
     if (consumed.status !== "signal") return;
     const signal = consumed.signal;
     const turn = current.turn;
-    if (signal === "stop_and_drop" || signal === "new_session") {
-      const dropped = current.queue.splice(0);
-      for (const { payload } of current.mls ? [] : dropped) {
-        void client.updateMessageDisposition(current.id, payload.message.id, "rejected").catch(warn("rejected disposition"));
-      }
-      void dispose(dropped, "cancel", "stop-and-clear");
-    }
+    if (signal === "stop_and_drop" || signal === "new_session") void dispose(current.queue.splice(0), "cancel", "stop-and-clear");
     if (turn) {
       void dispose(turn.inputs, "cancel", "stopped-before-submit");
       abort(turn, signal === "interrupt" ? "stop" : signal === "stop_and_drop" ? "drop" : "new_session");
     }
-    (turn?.live ?? livePublisher(current, void 0, current.mls ? "presence" : "full")).end("stopped");
+    (turn?.live ?? livePublisher(current, void 0)).end("stopped");
     if (signal === "new_session") {
-      approvals.delete(current.id);
       const sessions = /* @__PURE__ */ new Set([
         turn?.session ?? current.session ?? current.id,
         current.session ?? (turn?.mls ? mlsSession(current.id, mlsAudienceEpoch(turn.mls)) : current.id)
@@ -4481,25 +4595,19 @@ ${JSON.stringify(result, null, 2)}`);
       const target = room(roomId);
       const work = (async () => {
         for (const record of records.filter((candidate) => candidate.conversationId === roomId)) {
-          if (record.mls) target.mls = true;
           await redeliver(record).catch(warn("journaled reply kept for reconciliation"));
         }
         const inputs = orphans.filter(({ event }) => event.conversationId === roomId).sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.event.id.localeCompare(b.event.id));
         if (inputs.length) {
           const id = turnId(roomId, inputs.map(({ event, handoffGeneration }) => ({ id: event.id, generation: handoffGeneration ?? "" })));
-          const trigger = inputs.at(-1).event.data;
           const mode = await endpoint.getConversationContentMode(roomId);
-          if (mode !== "plaintext") target.mls = true;
-          if (mode !== "plaintext" && (!mlsOn || mode !== "mls-dev-text")) refuse(roomId, mlsOn ? "protocol" : "no-device");
+          if (mode !== "mls-dev-text" || !mlsOn) refuse(roomId, mode === "plaintext" ? "plaintext" : mlsOn ? "protocol" : "no-device");
           const mls2 = mode === "mls-dev-text" && mlsOn ? (await currentAudience(roomId)).audience : void 0;
           const legacy = `${id}:restart`;
           const messageId = mls2 && !await endpoint.getOperation(encryptedOperation(mls2, legacy)) ? keyed().text("restart", roomId, id) : legacy;
-          if (mode !== "plaintext" && !mls2) await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
-          else if (await send(roomId, RESTART_NOTICE, outputOptions(id, trigger, "restart", false, messageId), void 0, void 0, mls2) !== "pending") {
-            await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
-          }
+          if (!mls2 || await send(RESTART_NOTICE, { messageId }, mls2) !== "pending") await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
         }
-        livePublisher(target, void 0, target.mls ? "presence" : "full").end("ended");
+        livePublisher(target, void 0).end("ended");
       })().catch(warn("restart recovery"));
       target.recovering = work.finally(() => {
         target.recovering = void 0;
@@ -4509,24 +4617,16 @@ ${JSON.stringify(result, null, 2)}`);
   }
   __name(recover, "recover");
   async function redeliver(record) {
-    if (record.mls) {
-      if (!mlsOn) return refuse(record.conversationId, "no-device");
-    } else if (!await client.getMessageOperation(record.conversationId, record.options.messageId)) {
-      const members = audienceOf(await client.getConversation(record.conversationId));
-      try {
-        assertCompletedOutputAudience(record, members, "agent runner");
-      } catch (error) {
-        if (!record.errand) throw error;
-        return finishErrandOutput(record, "refused", "the conversation's members changed before it was sent");
-      }
+    if (!record.mls) {
+      if (record.errand) return finishErrandOutput(record, "refused", "its conversation is not encrypted");
+      if (await settle(record.inputs, "plaintext-output-dropped")) journal.remove(record.turnId);
+      return;
     }
+    if (!mlsOn) return refuse(record.conversationId, "no-device");
     const sent = await publish(record);
     if (sent === "pending") return;
     if (record.errand) return finishErrandOutput(record, sent);
-    if (await settle(record.inputs, "recovered")) {
-      journal.remove(record.turnId);
-      releaseUploads(record.attachments);
-    }
+    if (await settle(record.inputs, "recovered")) journal.remove(record.turnId);
   }
   __name(redeliver, "redeliver");
   function pendingNotes(roomId) {
@@ -4624,15 +4724,15 @@ ${JSON.stringify(result, null, 2)}`);
       turnId: turnId2,
       conversationId,
       createdAt,
-      audience: target.audience,
+      audience: null,
       inputs: [],
       text: parsed.text,
-      options: target.mls ? { messageId: keyed().text("final", conversationId, turnId2) } : { messageId: `${turnId2}:final`, metadata: { turnId: turnId2, turnSemantics: "turn_complete" } },
+      options: { messageId: keyed().text("final", conversationId, turnId2) },
       notice: false,
       errand: id,
-      ...target.mls ? { mls: target.mls } : {}
+      mls: target.mls
     };
-    journal.save(record);
+    saveOutput(record);
     errands.put({ ...base, status: "sending", updatedAt });
     const delivery = publish(record).then((sent) => {
       if (sent !== "pending") finishErrandOutput(record, sent);
@@ -4651,9 +4751,9 @@ ${JSON.stringify(result, null, 2)}`);
     if (!conversation) return "Canon does not show the agent that conversation";
     if (!conversation.memberIds?.includes(agentId)) return "the agent is not a member of that conversation";
     const mode = await endpoint.getConversationContentMode(roomId).catch(missing);
-    if (mode === "plaintext") return { audience: audienceOf(conversation) };
+    if (mode === "plaintext") return "it is not encrypted, and the agent takes part only in encrypted conversations";
     if (mode !== "mls-dev-text" || !mlsOn) return "it is an encrypted conversation this runner cannot take part in";
-    return { audience: null, ...kind === "post" ? { mls: (await currentAudience(roomId)).audience } : {} };
+    return kind === "post" ? { mls: (await currentAudience(roomId)).audience } : {};
   }
   __name(errandRoom, "errandRoom");
   function finishErrandOutput(record, sent, reason = "Canon did not accept it") {
@@ -4696,8 +4796,8 @@ ${JSON.stringify(result, null, 2)}`);
     ...record.origin ? { origin: record.origin } : {}
   }), "errandFacts");
   function errandPrompt({ record, target, origin, reports }) {
-    const recipient = "contact" in target ? `${target.contact}. Start a new conversation with them: communicate start_conversation.` : `the ${target.mls ? "encrypted " : ""}conversation ${target.room}. Send to it with communicate message_existing.`;
-    const report = reports ? `your final answer is your report to your owner, posted in the conversation ${origin.room}.` : origin ? `your final answer is your report to your owner, and it stays on their machine: the conversation ${origin.room} is not encrypted, and nothing of an errand to an encrypted conversation may go there.` : "your final answer is your report to your owner, and it stays on their machine.";
+    const recipient = "contact" in target ? `${target.contact}. Start a new conversation with them: communicate start_conversation.` : `the encrypted conversation ${target.room}. Send to it with communicate message_existing.`;
+    const report = reports ? `your final answer is your report to your owner, posted in the conversation ${origin.room}.` : "your final answer is your report to your owner, and it stays on their machine.";
     return [
       `${ERRAND_OPEN} Your owner sends you on an errand, from the machine you run on. It is not a message in any conversation, and no one else sees it.`,
       `Why: ${defused(record.why)}`,
@@ -4709,8 +4809,8 @@ ${JSON.stringify(result, null, 2)}`);
     ].join("\n");
   }
   __name(errandPrompt, "errandPrompt");
-  function contextPrompt({ record, encryptedOrigin }, encryptedRoom) {
-    const report = !record.origin ? "Your owner follows this errand on their machine; it has no conversation to report to." : encryptedOrigin || !encryptedRoom ? `You may report to your owner in the ${encryptedOrigin ? "encrypted " : ""}conversation ${record.origin} with communicate.` : `Nothing from this encrypted conversation may go to ${record.origin}, which is not encrypted; your owner sees on their machine that the errand was answered.`;
+  function contextPrompt(record) {
+    const report = !record.origin ? "Your owner follows this errand on their machine; it has no conversation to report to." : `You may report to your owner in the encrypted conversation ${record.origin} with communicate.`;
     return [
       `${ERRAND_OPEN} Your owner sent you into this conversation on an errand, from the machine you run on. No one here sees this note.`,
       `Why: ${defused(record.why)}`,
@@ -4728,7 +4828,7 @@ ${JSON.stringify(result, null, 2)}`);
   }
   __name(openErrands, "openErrands");
   function replied(turn) {
-    for (const { record } of turn.contexts) {
+    for (const record of turn.contexts) {
       const known = latest(record.id);
       if (!known || !openErrand(known)) continue;
       try {
@@ -4753,7 +4853,7 @@ ${JSON.stringify(result, null, 2)}`);
     const turn = newTurn([], errandTurnId(record.id), `errand:${record.id}`);
     holder.turn = turn;
     errandTurns.set(record.id, turn);
-    (turn.live = origin ? livePublisher(origin, turn, "presence") : SILENT).open();
+    (turn.live = origin ? livePublisher(origin, turn) : SILENT).open();
     const done = executeErrand(holder, turn, record).catch(warn(`errand ${record.id}`)).finally(() => {
       turn.live.end("ended");
       if (holder.turn === turn) holder.turn = void 0;
@@ -4788,7 +4888,6 @@ ${JSON.stringify(result, null, 2)}`);
     if (typeof setup === "string") return void saveErrand({ ...known, status: "refused", reason: setup });
     turn.errand = setup;
     turn.mls = setup.origin?.mls;
-    if (turn.mls) current.mls = true;
     const message2 = {
       id: `${turn.id}-errand`,
       senderId: setup.owner,
@@ -4831,16 +4930,15 @@ ${JSON.stringify(result, null, 2)}`);
     if (record.target === "room") {
       const found = await errandRoom(record.to, "post");
       if (typeof found === "string") return `its recipient: ${found}`;
-      target = { room: record.to, ...found.mls ? { mls: found.mls } : {} };
+      target = { room: record.to };
     }
     let origin;
     if (record.origin) {
       const found = await errandRoom(record.origin, "post");
       if (typeof found === "string") return `its origin: ${found}`;
-      origin = { room: record.origin, audience: found.audience, ...found.mls ? { mls: found.mls } : {} };
+      origin = { room: record.origin, mls: found.mls };
     }
-    const reports = !!origin && (!!origin.mls || !("room" in target && target.mls));
-    return { record, owner: owner2, target, ...origin ? { origin } : {}, reports };
+    return { record, owner: owner2, target, ...origin ? { origin } : {}, reports: !!origin };
   }
   __name(errandSetup, "errandSetup");
   async function deliverReport(turn, outcome) {
@@ -4854,7 +4952,7 @@ ${JSON.stringify(result, null, 2)}`);
     let text3 = answered2 ? result.reply : failed ? FAILURE_NOTICE : null;
     if (answered2 && result.files?.length) text3 = `${text3}
 
-(Files cannot go with an errand's report: ${result.files.map((file) => basename3(String(file))).join(", ")}.)`;
+(Files cannot go with an errand's report: ${result.files.map((file) => basename4(String(file))).join(", ")}.)`;
     const known = latest(record.id) ?? record;
     const cancelled = known.status === "cancelled" || stopped();
     const status = cancelled ? "cancelled" : ended(known, failed);
@@ -4873,19 +4971,16 @@ ${JSON.stringify(result, null, 2)}`);
       turnId: turn.id,
       conversationId: origin.room,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      audience: origin.audience,
+      audience: null,
       inputs: [],
       text: text3,
       notice: failed,
       errand: record.id,
-      ...origin.mls ? { mls: origin.mls } : {},
-      options: origin.mls ? { messageId: keyed().text(kind, origin.room, turn.id) } : {
-        messageId: `${turn.id}:${kind}`,
-        metadata: { turnId: turn.id, turnSemantics: "turn_complete", ...failed ? { replyBehavior: "suppress_auto_reply" } : {} }
-      }
+      mls: origin.mls,
+      options: { messageId: keyed().text(kind, origin.room, turn.id) }
     };
     try {
-      journal.save(out);
+      saveOutput(out);
     } catch (error) {
       warn(`errand ${record.id}: its report could not be journaled; it stays in the record`)(error);
       saveErrand({ ...closing, report: text3, reported: "refused", reason: "its report: it could not be saved for sending" });
@@ -4894,9 +4989,9 @@ ${JSON.stringify(result, null, 2)}`);
     saveErrand({ ...closing, reported: "sending" });
     const sent = await publish(out, turn.retire.signal);
     if (sent === "pending" && stopped()) {
-      journal.remove(out.turnId);
-      const { reported: _reported, ...withheld } = latest(record.id) ?? closing;
-      saveErrand({ ...withheld, status: "cancelled", reason: STOPPED_ERRAND[turn.reason] ?? "stopped" });
+      await stopOutput(out);
+      const { reported: _reported, ...withheld2 } = latest(record.id) ?? closing;
+      saveErrand({ ...withheld2, status: "cancelled", reason: STOPPED_ERRAND[turn.reason] ?? "stopped" });
     } else if (sent !== "pending") finishErrandOutput(out, sent);
     turn.live.end(sent === "delivered" ? "answered" : stopped() ? "stopped" : "ended");
   }
@@ -4930,7 +5025,6 @@ ${JSON.stringify(result, null, 2)}`);
     } else if (event.kind === "conversation.updated") {
       void onRoomChanged(data).catch(warn("membership update"));
     } else if (event.kind === "runtime.control" && data.kind === "signal" && typeof data.conversationId === "string") {
-      if (options.relay && !rooms.get(data.conversationId)?.mls) return;
       scheduleControl(room(data.conversationId));
     }
   }
@@ -4994,7 +5088,7 @@ ${JSON.stringify(result, null, 2)}`);
         notice: false,
         mls: audience
       };
-      journal.save(record);
+      saveOutput(record);
       return { text: text3, record };
     })();
     const sent = ready.then(({ record, settled }) => settled ?? publish(record).then((result) => {
@@ -5023,7 +5117,7 @@ ${JSON.stringify(result, null, 2)}`);
       client = new CanonClient(options.apiKey, connection.apiBaseUrl, {
         environmentId: connection.environmentId,
         streamUrl: connection.streamUrl,
-        stateDirectory: join6(home, "endpoint"),
+        stateDirectory: join7(home, "endpoint"),
         ...options.client ? { client: options.client } : {},
         // Below Canon's client floor nothing can work, wherever the refusal surfaces: a query, an operation or the stream.
         ...options.onFatal ? { onClientUpdateRequired: /* @__PURE__ */ __name((error) => options.onFatal(error), "onClientUpdateRequired") } : {},
@@ -5071,19 +5165,19 @@ ${JSON.stringify(result, null, 2)}`);
       }
       scope = JSON.stringify([identity.environmentId, agentId, identity.ownershipVersion ?? 0, identity.installationId]);
       if (mlsOn) {
-        mlsIds = createMlsIds(privateKey(join6(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2563(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
+        mlsIds = createMlsIds(privateKey(join7(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2563(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
         mlsAsks = createMlsAsks({
           endpoint,
           agentId,
-          directory: join6(home, "runner", options.environmentId, agentId, "asks", sha2563(scope).slice(0, 32)),
+          directory: join7(home, "runner", options.environmentId, agentId, "asks", sha2563(scope).slice(0, 32)),
           assertAudience,
           sessionForDestructive: options.sessionApprovalForDestructive === true,
           log
         }, approvalScope);
       }
-      journal = createCompletedOutputJournal(join6(home, "runner", options.environmentId, agentId, "finals"), scope, {
+      journal = createCompletedOutputJournal(join7(home, "runner", options.environmentId, agentId, "finals"), scope, {
         label: "agent runner",
-        validate: /* @__PURE__ */ __name((record) => typeof record.text === "string" && typeof record.options?.messageId === "string" && Array.isArray(record.inputs) && typeof record.notice === "boolean" && (record.attachments === void 0 || Array.isArray(record.attachments)) && (record.flows === void 0 || Array.isArray(record.flows) && record.flows.length === record.attachments?.length) && (record.mls === void 0 || !!record.mls && typeof record.mls === "object") && (record.errand === void 0 || typeof record.errand === "string"), "validate")
+        validate: /* @__PURE__ */ __name((record) => typeof record.text === "string" && typeof record.options?.messageId === "string" && Array.isArray(record.inputs) && typeof record.notice === "boolean" && (record.mls === void 0 || !!record.mls && typeof record.mls === "object") && (record.parts === void 0 || Number.isSafeInteger(record.parts)) && (record.errand === void 0 || typeof record.errand === "string"), "validate")
       });
       if (!options.relay && !driver.capabilities.remote) {
         errands = errandJournal(errandsDirectory(home, options.environmentId, agentId));
@@ -5101,12 +5195,12 @@ ${JSON.stringify(result, null, 2)}`);
           else if (report) saveErrand({ ...record, status: ended(record, report.notice), reported: "sending" });
           else {
             saveErrand({ ...record, status: "interrupted", reason: "the runner stopped during its turn, which never runs again" });
-            if (record.origin) livePublisher(room(record.origin), void 0, "presence").end("stopped");
+            if (record.origin) livePublisher(room(record.origin), void 0).end("stopped");
           }
         }
       }
       const outbound = driver.capabilities.outboundFiles;
-      roots = outbound ? (await Promise.all(outbound.roots.map((root) => realpath5(root).catch(() => "")))).filter(Boolean) : [];
+      roots = outbound ? (await Promise.all(outbound.roots.map((root) => realpath4(root).catch(() => "")))).filter(Boolean) : [];
       if (driver.capabilities.tools) tools = await startToolServer();
       await recover();
       const publisher = createRuntimeStatePublisher({ agentId, clientType: CLIENT_TYPES[driver.name], hostMode: true, rtdb: initRTDBAuth(client) });
@@ -5283,14 +5377,14 @@ export {
   DriverSessionError,
   ConnectorRelayError,
   loadInstructions,
+  checkAcp,
+  acpDriver,
   loadClaudeQuery,
   claudeDriver,
   codeDriver,
   checkCodex,
   codexDriver,
   connectorDriver,
-  runnerLockName,
-  assertPrivateHome,
   errandsDirectory,
   queueErrand,
   errandJournal,
@@ -5301,6 +5395,7 @@ export {
   runMlsDevSetup,
   MLS_ENVIRONMENT_PINS,
   bundledMlsCustodyHelper,
+  bundledMlsWasmCore,
   defaultMlsDevice,
   managedMlsDevice,
   startRelayChannel,