@clawos-dev/clawd 0.2.71-beta.137.a346461 → 0.2.71-beta.138.2a35bba

package/dist/cli.cjs

@@ -92,6 +92,10 @@ var init_methods = __esm({
       "persona:get",
       "persona:update",
       "persona:delete",
+      // token 颁发 / 吊销：file-sharing HTTP Bearer 鉴权用（PersonaRegistry.findByToken
+      // 反查 personaId / label）。owner UI 在 PersonaSettingsDrawer "分享 Token" section 管理。
+      "persona:issueToken",
+      "persona:revokeToken",
       // ---- session:pty 双向透传（仅 CLAWD_CC_MODE=tui 才生效，对应 session:pty push 帧的上行） ----
       // session:pty:input — UI 把用户键盘字节（base64 UTF-8）发给 daemon，daemon 直写 pty stdin。
       //   高频帧（每次按键 1 帧），不入 reducer / 不广播。response 是 fire-and-forget 风格 ack。
@@ -102,50 +106,16 @@ var init_methods = __esm({
       // ---- attachment.* file-sharing（详见 attachment-schemas.ts） ----
       // 命名警告：这里的 `attachment.*` RPC 与 CC v2.x 上行 `type:"attachment"` 系统行
       // （attachment-skills / attachment-deferred-tools / attachment_memories）是不同概念。
-      // 全部管理类 RPC dispatcher grant 限 owner（capability admin-only）；
-      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，HMAC 签名自包含，不在白名单内）。
+      // 全部管理类 RPC handler 入口 requireOwner（personal token 调任意一个都 403）；
+      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，签名验证），不在白名单内。
       "attachment.signUrl",
       "attachment.groupAdd",
       "attachment.groupRemove",
       "attachment.groupList",
-      // ---- capability:* (capability platform 鉴权底座) ----
-      // owner 颁发 / 列出 / 删除给 guest 的 capability。三者均需 admin 权限（METHOD_GRANT_MAP
-      // 在 daemon 端固定为 `{ resource: '*', action: 'admin' }`，owner 自动满足）。
-      // 颁发后 daemon 推 'capability:tokenIssued' 帧；删除推 'capability:tokenDeleted' 帧。
-      // 删除是 hard delete：CapabilityStore 物理移除 + 关该 cap 的所有活跃 ws + rm
-      // personas/<pid>/.clawd/sessions/guests/<capId>/ guest sessions 目录。
-      "capability:issue",
-      "capability:list",
-      "capability:delete",
-      // ---- inbox:* (capability platform Phase 3 跨用户通知 + Phase 4 DM) ----
-      // owner 接 guest 的 cross-principal 消息事件 + DM 双向私聊.
-      // inbox:list / markRead: admin-only (Phase 3); inbox:postMessage: DM 自带能力,
-      // 任何 principal (owner/guest) 可调 (Phase 4).
-      "inbox:list",
-      "inbox:markRead",
-      "inbox:postMessage",
-      // ---- remote-persona:* (Phase 4 远程 persona, v1 仅本地存储, 不接 outgoing WS) ----
-      // owner 添加 / 列出 / 删除远程 persona 入口. admin-only.
-      "remote-persona:add",
-      "remote-persona:list",
-      "remote-persona:remove",
-      // ---- whoami (v2 capability platform) ----
-      // 任何 authed connection 都能调；返回 owner 显示名 + 当前 capability wire 形态 +
-      // grants 对应的 persona 元数据 (id + displayName)。UI 端 AddRemotePersonaDialog
-      // 的 preview 一次性临时 client 用它判定身份和可用 persona。
-      "whoami",
+      // v2：跨 session 聚合（本期 UI 不调，保留槽位用于 HTTP ACL 内部判定 / 未来 "All files" tab）
+      "attachment.groupListPersona",
       "info",
-      "ping",
-      // ---- person:* (Person identity Phase 1, spec v5) ----
-      // Person 抽象 = People panel 顶层 entity（一个 Person 聚合 N 个 cap + M 个 remote
-      // alias）。owner admin-only。daemon 维护 PersonStore + PersonAliasStore。
-      //   - list 返回 PersonWithLinks[]（含派生 linkedCapabilityIds / linkedRemoteAliases）
-      //   - create / update / delete 操作 Person 实体（delete 触发 cascade：revoke 全部
-      //     linked cap + remove subscribed alias + clear linked inbox events）
-      "person:list",
-      "person:create",
-      "person:update",
-      "person:delete"
+      "ping"
     ];
   }
 });
@@ -635,8 +605,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path38, errorMaps, issueData } = params;
-      const fullPath = [...path38, ...issueData.path || []];
+      const { data, path: path32, errorMaps, issueData } = params;
+      const fullPath = [...path32, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -947,11 +917,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path38, key) {
+      constructor(parent, value, path32, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path38;
+        this._path = path32;
         this._key = key;
       }
       get path() {
@@ -4335,12 +4305,12 @@ var init_zod = __esm({
 });
 
 // ../protocol/src/attachment-schemas.ts
-var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema;
+var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema, AttachmentGroupListPersonaArgs, AttachmentGroupListPersonaResponseSchema;
 var init_attachment_schemas = __esm({
   "../protocol/src/attachment-schemas.ts"() {
     "use strict";
     init_zod();
-    TOKEN_ROLES = ["owner"];
+    TOKEN_ROLES = ["owner", "personal"];
     GROUP_FILE_SOURCES = ["agent", "owner"];
     GroupFileEntrySchema = external_exports.object({
       /** daemon 派发的稳定 id（用于 RPC remove / UI key） */
@@ -4361,9 +4331,11 @@ var init_attachment_schemas = __esm({
       stale: external_exports.boolean().optional()
     });
     AttachmentSignUrlArgs = external_exports.object({
-      /** 要分享的绝对路径；签名只关心 absPath，不区分 persona/session */
-      absPath: external_exports.string().min(1),
-      /** TTL 秒数；缺省 24h；'never' 走 null 不带 exp 字段（永久有效） */
+      /** 群文件所属的 session */
+      sessionId: external_exports.string().min(1),
+      /** 相对 session.cwd 的路径；允许传绝对路径，daemon 端会归一化（必须在 cwd 内） */
+      relPath: external_exports.string().min(1),
+      /** TTL 秒数；缺省 24h；null 走永久 URL（不带 exp 字段） */
       ttlSeconds: external_exports.number().int().positive().nullable().optional()
     });
     AttachmentSignUrlResponseSchema = external_exports.object({
@@ -4394,15 +4366,31 @@ var init_attachment_schemas = __esm({
     AttachmentGroupListResponseSchema = external_exports.object({
       entries: external_exports.array(GroupFileEntrySchema)
     });
+    AttachmentGroupListPersonaArgs = external_exports.object({
+      personaId: external_exports.string().min(1)
+    });
+    AttachmentGroupListPersonaResponseSchema = external_exports.object({
+      perSession: external_exports.array(
+        external_exports.object({
+          sessionId: external_exports.string().min(1),
+          entries: external_exports.array(GroupFileEntrySchema)
+        })
+      )
+    });
   }
 });
 
 // ../protocol/src/persona-schemas.ts
-var PersonaFileSchema, PersonaSkillSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema;
+var PersonaTokenEntrySchema, PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema, PersonaIssueTokenArgsSchema, PersonaRevokeTokenArgsSchema;
 var init_persona_schemas = __esm({
   "../protocol/src/persona-schemas.ts"() {
     "use strict";
     init_zod();
+    PersonaTokenEntrySchema = external_exports.object({
+      label: external_exports.string(),
+      issuedAt: external_exports.number(),
+      revoked: external_exports.boolean()
+    });
     PersonaFileSchema = external_exports.object({
       personaId: external_exports.string(),
       label: external_exports.string(),
@@ -4411,6 +4399,13 @@ var init_persona_schemas = __esm({
       // 8-key set defined UI-side in `lib/session-icons.ts`; protocol stays plain string
       // for forward compatibility, consumer fallbacks to default when key not found.
       iconKey: external_exports.string().optional(),
+      /**
+       * Persona token 列表：file-sharing HTTP Bearer 鉴权用。
+       * - 写：`PersonaManager.issueToken` / `revokeToken`
+       * - 读：`PersonaRegistry.findByToken` 反向查表（需 persona.public === true）
+       * - optional：兼容历史 persona.json 不含此字段的情形（旧 daemon 写文件时省略）
+       */
+      tokenMap: external_exports.record(external_exports.string(), PersonaTokenEntrySchema).optional(),
       createdAt: external_exports.number(),
       updatedAt: external_exports.number()
     }).strict();
@@ -4420,6 +4415,10 @@ var init_persona_schemas = __esm({
       // SKILL.md frontmatter `description:`；缺省时省略字段
       description: external_exports.string().optional()
     });
+    PersonaPluginSummarySchema = external_exports.object({
+      // settings.json 中 enabledPlugins 的 key，例如 'superpowers@claude-plugins-official'
+      id: external_exports.string().min(1)
+    });
     PersonaSandboxSettingsSchema = external_exports.object({
       permissions: external_exports.object({
         defaultMode: external_exports.string().optional()
@@ -4440,6 +4439,8 @@ var init_persona_schemas = __esm({
       personality: external_exports.string().optional(),
       // 仅 'persona:get' 携带；null = 文件不存在 / parse 失败；undefined = 不在该响应类型上
       skills: external_exports.array(PersonaSkillSummarySchema).optional(),
+      // 仅 'persona:get' 携带；空数组 = 没启用任何插件 / settings.json 不存在；undefined = 不在该响应类型上
+      plugins: external_exports.array(PersonaPluginSummarySchema).optional(),
       sandboxSettings: PersonaSandboxSettingsSchema.nullable().optional()
     });
     PersonaCreateArgsSchema = external_exports.object({
@@ -4463,11 +4464,19 @@ var init_persona_schemas = __esm({
         iconKey: external_exports.string().nullable().optional()
       }).strict()
     }).strict();
+    PersonaIssueTokenArgsSchema = external_exports.object({
+      personaId: external_exports.string().min(1),
+      label: external_exports.string().min(1)
+    });
+    PersonaRevokeTokenArgsSchema = external_exports.object({
+      personaId: external_exports.string().min(1),
+      token: external_exports.string().min(1)
+    });
   }
 });
 
 // ../protocol/src/schemas.ts
-var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelExitedEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
+var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelExitedEventSchema, TunnelUnavailableEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
 var init_schemas = __esm({
   "../protocol/src/schemas.ts"() {
     "use strict";
@@ -4569,15 +4578,6 @@ var init_schemas = __esm({
       // 才能让 alice 重连同一 sub-session（持久化在 alice localStorage 之外，由 daemon push 同步）。
       // optional 是因为 owner-mode session 不带；只要写入就是 listener-mode 必填三元组。
       chatId: external_exports.string().min(1).optional(),
-      /**
-       * 创建该 session 的 principal id（owner uuid 或 guest cap.id），从 session:create handler
-       * 的 ctx.principal.id 派生。Person identity Q2「按对端人聚合 sessions」需要它：
-       * UI 端按 `creatorPrincipalId === ownerPrincipalId` 区分「我自己」vs「别人接入」，
-       * 后者再通过 PersonAlias 表反查 personId 二级分组。
-       *
-       * optional：兼容 2026-05-21 之前的老 session 数据，新建一定有值。
-       */
-      creatorPrincipalId: external_exports.string().min(1).optional(),
       createdAt: external_exports.string().min(1),
       updatedAt: external_exports.string().min(1)
     });
@@ -4987,18 +4987,7 @@ var init_schemas = __esm({
     AuthRequestFrameSchema = external_exports.object({
       type: external_exports.literal("auth"),
       token: external_exports.string().min(1),
-      scheme: external_exports.literal("bearer").optional(),
-      /**
-       * Person identity Phase 1: 如果 guest 自己也是 daemon owner，把自己的稳定
-       * ownerPrincipalId 主动上报，让对端 daemon 反查 PersonAliasStore 自动 link 到
-       * 已有 Person（避免出现"两个 Bob"）。纯访客 / 老 daemon 客户端可省略。
-       *
-       * daemon transport/auth.ts 在 verify token 成功后：
-       *   - 若 cap.linkedPrincipalId 未设 → 更新 cap.linkedPrincipalId = selfPrincipalId
-       *     + PersonAliasStore.rekey(cap.id, selfPrincipalId)
-       *   - 若已设但与本次不一致 → 仅 warn log（潜在协议异常但不阻断）
-       */
-      selfPrincipalId: external_exports.string().min(1).optional()
+      scheme: external_exports.literal("bearer").optional()
     });
     AuthOkFrameSchema = external_exports.object({
       type: external_exports.literal("auth:ok"),
@@ -5011,6 +5000,11 @@ var init_schemas = __esm({
       subdomain: external_exports.string().nullable(),
       url: external_exports.string().nullable()
     });
+    TunnelUnavailableEventSchema = external_exports.object({
+      type: external_exports.literal("tunnel:unavailable"),
+      reason: external_exports.string().min(1),
+      failedAt: external_exports.string().min(1)
+    });
     InfoRunningSessionSchema = external_exports.object({
       sessionId: external_exports.string().min(1),
       status: SessionStatusSchema,
@@ -5031,9 +5025,10 @@ var init_schemas = __esm({
       // PR 2 daemon 实现 single HTTP server + auth-context 后，daemon 必返这五个字段，
       // 届时可考虑改成 required。spec §11 第 3 条："tokenRole 是协议字段，daemon 查 token
       // 表后显式下发，UI 不自行推导"——所以 UI 一律读这里，禁止本地推导。
-      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）。来源 TOKEN_ROLES（spec §11 #1 中央真理源）。
-       *  历史 'personal' role（persona file-sharing token）在 2026-05-21 删除；tokenPersonaId 一同移除。 */
+      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）；'personal' = persona 派发的访客 token。来源 TOKEN_ROLES（spec §11 #1 中央真理源） */
       tokenRole: external_exports.enum(TOKEN_ROLES).optional(),
+      /** tokenRole='personal' 时携带（绑定到具体 persona）；owner 不携带 */
+      tokenPersonaId: external_exports.string().min(1).optional(),
       /** socket.remoteAddress 是否落在 127.0.0.1 / ::1；本期无 RPC 消费，保留协议槽位给未来 "Reveal in Finder" 等本机动作 */
       isLoopback: external_exports.boolean().optional(),
       /** UI 拼 file-sharing HTTP 路由的前缀（http(s)://host:port），不含尾斜杠；frpc 反代时返反代地址 */
@@ -5060,239 +5055,6 @@ var init_persona_mode = __esm({
   }
 });
 
-// ../protocol/src/principal.ts
-function makeOwnerPrincipal(id, displayName) {
-  return PrincipalSchema.parse({ id, kind: "owner", displayName });
-}
-var PrincipalKindSchema, PrincipalSchema;
-var init_principal = __esm({
-  "../protocol/src/principal.ts"() {
-    "use strict";
-    init_zod();
-    PrincipalKindSchema = external_exports.enum(["owner", "guest"]);
-    PrincipalSchema = external_exports.object({
-      id: external_exports.string().min(1),
-      kind: PrincipalKindSchema,
-      displayName: external_exports.string()
-    }).strict();
-  }
-});
-
-// ../protocol/src/capability.ts
-function stripSecretHash(cap) {
-  const { secretHash: _hash, ...wire } = cap;
-  return wire;
-}
-var ResourceSchema, ActionSchema, GrantSchema, CapabilitySchema, CapabilityWireSchema, CapabilityErrorCodeSchema, WhoamiResponseSchema, CapabilityIssueArgsSchema;
-var init_capability = __esm({
-  "../protocol/src/capability.ts"() {
-    "use strict";
-    init_zod();
-    ResourceSchema = external_exports.discriminatedUnion("type", [
-      external_exports.object({ type: external_exports.literal("persona"), id: external_exports.string().min(1) }).strict(),
-      external_exports.object({ type: external_exports.literal("chat"), id: external_exports.string().min(1) }).strict(),
-      external_exports.object({ type: external_exports.literal("*") }).strict()
-    ]);
-    ActionSchema = external_exports.enum(["read", "send", "admin"]);
-    GrantSchema = external_exports.object({
-      resource: ResourceSchema,
-      actions: external_exports.array(ActionSchema).min(1)
-    }).strict();
-    CapabilitySchema = external_exports.object({
-      id: external_exports.string().min(1),
-      // sha256(token) hex 64
-      secretHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
-      displayName: external_exports.string(),
-      // 空数组合法 = 纯访客（只能 DM）
-      grants: external_exports.array(GrantSchema),
-      issuedAt: external_exports.number().int().nonnegative(),
-      expiresAt: external_exports.number().int().positive().optional(),
-      maxUses: external_exports.number().int().positive().optional(),
-      usedCount: external_exports.number().int().nonnegative(),
-      /**
-       * Person identity per-People token (2026-05-21): cap 直接绑死 Person 主人。
-       * 一 Person 一 cap：capability:issue 同 person 第二次调用 = 合并 grants，
-       * 不新建 cap。删 PersonAlias 表整套（cap.personId 直接含信息，无需反查）。
-       */
-      personId: external_exports.string().min(1)
-    }).strict();
-    CapabilityWireSchema = CapabilitySchema.omit({ secretHash: true });
-    CapabilityErrorCodeSchema = external_exports.enum([
-      "TOKEN_INVALID",
-      "TOKEN_REVOKED",
-      "TOKEN_EXPIRED",
-      "TOKEN_EXHAUSTED"
-    ]);
-    WhoamiResponseSchema = external_exports.object({
-      type: external_exports.literal("whoami:ok"),
-      owner: external_exports.object({
-        id: external_exports.string(),
-        kind: external_exports.enum(["owner", "guest"]),
-        displayName: external_exports.string()
-      }).strict(),
-      capability: CapabilityWireSchema,
-      grantedPersonas: external_exports.array(
-        external_exports.object({
-          id: external_exports.string().min(1),
-          displayName: external_exports.string()
-        }).strict()
-      )
-    }).strict();
-    CapabilityIssueArgsSchema = external_exports.object({
-      displayName: external_exports.string().min(1),
-      grants: external_exports.array(GrantSchema),
-      personId: external_exports.string().min(1),
-      expiresAt: external_exports.number().int().positive().optional(),
-      maxUses: external_exports.number().int().positive().optional()
-    }).strict();
-  }
-});
-
-// ../protocol/src/inbox.ts
-var InboxMessageSchema, InboxPostMessageArgsSchema, InboxListArgsSchema, InboxMarkReadArgsSchema;
-var init_inbox = __esm({
-  "../protocol/src/inbox.ts"() {
-    "use strict";
-    init_zod();
-    InboxMessageSchema = external_exports.object({
-      id: external_exports.string().min(1),
-      capabilityId: external_exports.string().min(1),
-      senderPrincipalId: external_exports.string().min(1),
-      text: external_exports.string().min(1),
-      createdAt: external_exports.number().int().nonnegative(),
-      readBy: external_exports.record(external_exports.string().min(1), external_exports.number().int().positive()).default({})
-    }).strict();
-    InboxPostMessageArgsSchema = external_exports.object({
-      capabilityId: external_exports.string().min(1),
-      text: external_exports.string().min(1)
-    }).strict();
-    InboxListArgsSchema = external_exports.object({
-      capabilityId: external_exports.string().min(1),
-      sinceCreatedAt: external_exports.number().int().nonnegative().optional()
-    }).strict();
-    InboxMarkReadArgsSchema = external_exports.object({
-      capabilityId: external_exports.string().min(1),
-      upToCreatedAt: external_exports.number().int().nonnegative()
-    }).strict();
-  }
-});
-
-// ../protocol/src/remote-persona.ts
-function stripRemotePersonaSecret(rp) {
-  const { capabilityToken: _t, ...wire } = rp;
-  return wire;
-}
-var RemotePersonaSchema, RemotePersonaWireSchema, RemotePersonaAddArgsSchema, RemotePersonaRemoveArgsSchema;
-var init_remote_persona = __esm({
-  "../protocol/src/remote-persona.ts"() {
-    "use strict";
-    init_zod();
-    RemotePersonaSchema = external_exports.object({
-      alias: external_exports.string().min(1),
-      remoteUrl: external_exports.string().min(1),
-      capabilityToken: external_exports.string().min(1),
-      // v2 Phase 7: 远端 daemon 给我颁发的 capability id。preview 时 whoami 返回的
-      // capability.id 直接存进来。旧 v1 持久化文件没此字段 → schema parse fail →
-      // RemotePersonaStore.list 静默跳过 (alpha 阶段可接受, 老板重新 add 即可)。
-      myCapabilityId: external_exports.string().min(1),
-      // owner-id stabilization: 远端 daemon 的稳定 ownerPrincipalId（whoami.owner.id）。
-      // UI DM 时作为 peerPrincipalId 传给远端 daemon（取代字面量 'owner' sentinel），
-      // 让 inbox event from/to 路由 + UI useDm fromOwner 判定都用真实 id。
-      // 旧持久化文件缺该字段 → schema parse fail → store.list 静默跳过（同 myCapabilityId）。
-      ownerPrincipalId: external_exports.string().min(1),
-      remotePersonaId: external_exports.string().min(1),
-      remoteDisplayName: external_exports.string(),
-      ownerDisplayName: external_exports.string().optional(),
-      addedAt: external_exports.number().int().nonnegative(),
-      lastConnectedAt: external_exports.number().int().positive().optional(),
-      /**
-       * Person identity per-People token (2026-05-21): RemotePersona 直接绑死本地 Person。
-       * 删 PersonAlias 表后由该字段提供"远端 owner principal 对应本地哪个 person"。
-       */
-      personId: external_exports.string().min(1)
-    }).strict();
-    RemotePersonaWireSchema = RemotePersonaSchema.omit({ capabilityToken: true });
-    RemotePersonaAddArgsSchema = external_exports.object({
-      alias: external_exports.string().min(1),
-      remoteUrl: external_exports.string().min(1),
-      capabilityToken: external_exports.string().min(1),
-      // v2 Phase 7: UI 调 preview 后从 whoami response 取 capability.id 传入
-      myCapabilityId: external_exports.string().min(1),
-      // owner-id stabilization: UI 从 whoami.owner.id 取，远端 daemon 稳定身份
-      ownerPrincipalId: external_exports.string().min(1),
-      remotePersonaId: external_exports.string().min(1),
-      remoteDisplayName: external_exports.string(),
-      ownerDisplayName: external_exports.string().optional(),
-      /**
-       * Person identity per-People token: add 时必须关联到一个 Person（owner 视角的"对方是谁"）。
-       * daemon handler 内 atomic 写 RemotePersona.personId（PersonAlias 表 2026-05-21 删除）。
-       */
-      personId: external_exports.string().min(1)
-    }).strict();
-    RemotePersonaRemoveArgsSchema = external_exports.object({
-      alias: external_exports.string().min(1)
-    }).strict();
-  }
-});
-
-// ../protocol/src/person.ts
-var PersonSchema, PersonWithLinksSchema, PersonCreateArgsSchema, PersonUpdateArgsSchema, PersonDeleteArgsSchema, PersonListResponseSchema, PersonCreateResponseSchema, PersonUpdateResponseSchema, PersonDeleteResponseSchema;
-var init_person = __esm({
-  "../protocol/src/person.ts"() {
-    "use strict";
-    init_zod();
-    PersonSchema = external_exports.object({
-      id: external_exports.string().min(1),
-      displayName: external_exports.string().min(1),
-      notes: external_exports.string().optional(),
-      /** 默认 true（owner 可关闭以阻断该 Person 的入站 DM） */
-      dmEnabled: external_exports.boolean(),
-      createdAt: external_exports.number().int().nonnegative(),
-      updatedAt: external_exports.number().int().nonnegative()
-    }).strict();
-    PersonWithLinksSchema = PersonSchema.extend({
-      linkedCapabilityIds: external_exports.array(external_exports.string()),
-      linkedRemoteAliases: external_exports.array(external_exports.string())
-    }).strict();
-    PersonCreateArgsSchema = external_exports.object({
-      displayName: external_exports.string().min(1),
-      notes: external_exports.string().optional(),
-      /** 缺省 true（在 daemon handler 内 default） */
-      dmEnabled: external_exports.boolean().optional()
-    }).strict();
-    PersonUpdateArgsSchema = external_exports.object({
-      id: external_exports.string().min(1),
-      displayName: external_exports.string().min(1).optional(),
-      notes: external_exports.string().optional(),
-      dmEnabled: external_exports.boolean().optional()
-    }).strict();
-    PersonDeleteArgsSchema = external_exports.object({
-      id: external_exports.string().min(1)
-    }).strict();
-    PersonListResponseSchema = external_exports.object({
-      type: external_exports.literal("person:list:ok"),
-      persons: external_exports.array(PersonWithLinksSchema)
-    }).strict();
-    PersonCreateResponseSchema = external_exports.object({
-      type: external_exports.literal("person:create:ok"),
-      person: PersonSchema
-    }).strict();
-    PersonUpdateResponseSchema = external_exports.object({
-      type: external_exports.literal("person:update:ok"),
-      person: PersonSchema
-    }).strict();
-    PersonDeleteResponseSchema = external_exports.object({
-      type: external_exports.literal("person:delete:ok"),
-      /** cascade 删了哪些 capability id */
-      deletedCapabilityIds: external_exports.array(external_exports.string()),
-      /** cascade 移除了哪些 remote alias */
-      removedRemoteAliases: external_exports.array(external_exports.string()),
-      /** cascade 清掉了多少条 inbox 事件 */
-      deletedInboxEvents: external_exports.number().int().nonnegative()
-    }).strict();
-  }
-});
-
 // ../protocol/src/runtime.ts
 var init_runtime = __esm({
   "../protocol/src/runtime.ts"() {
@@ -5305,11 +5067,6 @@ var init_runtime = __esm({
     init_persona_schemas();
     init_persona_mode();
     init_attachment_schemas();
-    init_principal();
-    init_capability();
-    init_inbox();
-    init_remote_persona();
-    init_person();
   }
 });
 
@@ -5584,8 +5341,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path38 = req.path;
-        _req.url = typeof path38 === "string" ? path38 : req.url ? req.url.path || req.url : void 0;
+        const path32 = req.path;
+        _req.url = typeof path32 === "string" ? path32 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -5750,14 +5507,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path38) {
+    function parsePath(path32) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path38.length; i++) {
-        const char = path38[i];
+      for (let i = 0; i < path32.length; i++) {
+        const char = path32[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -5888,10 +5645,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path38 of paths) {
-        const parts = parsePath(path38);
+      for (const path32 of paths) {
+        const parts = parsePath(path32);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path38, remove);
+          redactWildcardPath(obj, parts, censor, path32, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -5976,8 +5733,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path38) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path38];
+            const wrappedCensor = typeof censor === "function" ? (value, path32) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path32];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -6012,8 +5769,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path38 of pathsToClone) {
-        const parts = parsePath(path38);
+      for (const path32 of pathsToClone) {
+        const parts = parsePath(path32);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -6065,24 +5822,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path38) {
-      if (typeof path38 !== "string") {
+    function validatePath(path32) {
+      if (typeof path32 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path38 === "") {
+      if (path32 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path38.includes("..")) {
-        throw new Error(`Invalid redaction path (${path38})`);
+      if (path32.includes("..")) {
+        throw new Error(`Invalid redaction path (${path32})`);
       }
-      if (path38.includes(",")) {
-        throw new Error(`Invalid redaction path (${path38})`);
+      if (path32.includes(",")) {
+        throw new Error(`Invalid redaction path (${path32})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path38.length; i++) {
-        const char = path38[i];
+      for (let i = 0; i < path32.length; i++) {
+        const char = path32[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -6096,20 +5853,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path38})`);
+            throw new Error(`Invalid redaction path (${path32})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path38})`);
+        throw new Error(`Invalid redaction path (${path32})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path38 of paths) {
-        validatePath(path38);
+      for (const path32 of paths) {
+        validatePath(path32);
       }
     }
     function slowRedact(options = {}) {
@@ -6277,8 +6034,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path38) => {
-            return censor(value, [k2, ...path38]);
+          const wrappedCensor = typeof censor === "function" ? (value, path32) => {
+            return censor(value, [k2, ...path32]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6496,10 +6253,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs34 = require("fs");
+    var fs28 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path38 = require("path");
+    var path32 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6553,20 +6310,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs34.mkdirSync(path38.dirname(file), { recursive: true });
-          const fd = fs34.openSync(file, flags, mode);
+          if (sonic.mkdir) fs28.mkdirSync(path32.dirname(file), { recursive: true });
+          const fd = fs28.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs34.mkdir(path38.dirname(file), { recursive: true }, (err) => {
+        fs28.mkdir(path32.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs34.open(file, flags, mode, fileOpened);
+          fs28.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs34.open(file, flags, mode, fileOpened);
+        fs28.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -6607,8 +6364,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs34.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs34.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs28.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs28.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -6617,15 +6374,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs34.writeSync(this.fd, this._writingBuf);
+            return fs28.writeSync(this.fd, this._writingBuf);
           }
-          return fs34.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs28.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs34.write(this.fd, this._writingBuf, this.release);
+            return fs28.write(this.fd, this._writingBuf, this.release);
           }
-          return fs34.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs28.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -6682,7 +6439,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs34.fsyncSync(this.fd);
+          fs28.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -6796,7 +6553,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs34.fsync(this.fd, (err) => {
+            fs28.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -6898,7 +6655,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs34.close(fd, (err) => {
+          fs28.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -6947,7 +6704,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs34.writeSync(this.fd, buf) : fs34.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs28.writeSync(this.fd, buf) : fs28.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -6963,7 +6720,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs34.fsyncSync(this.fd);
+        fs28.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -6984,7 +6741,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs34.writeSync(this.fd, buf);
+          const n = fs28.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -7012,13 +6769,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs34.writeSync(this.fd, this._writingBuf) : fs34.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs28.writeSync(this.fd, this._writingBuf) : fs28.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs34.write(this.fd, this._writingBuf, release);
+        fs28.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -7027,7 +6784,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs34.writeSync(this.fd, this._writingBuf);
+          const written = fs28.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -7036,7 +6793,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs34.write(this.fd, this._writingBuf, release);
+        fs28.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -7052,12 +6809,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs34.fsync(sonic.fd, closeWrapped);
+        fs28.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs34.close(sonic.fd, done);
+          fs28.close(sonic.fd, done);
         } else {
           done();
         }
@@ -7314,7 +7071,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join11 } = require("path");
+    var { join: join4 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -7350,7 +7107,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join11(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join4(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         trackUnmanagedFds: false,
@@ -7736,7 +7493,7 @@ var require_transport = __commonJS({
     "use strict";
     var { createRequire } = require("module");
     var getCallers = require_caller();
-    var { join: join11, isAbsolute, sep: sep2 } = require("path");
+    var { join: join4, isAbsolute, sep } = require("path");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
     var ThreadStream = require_thread_stream();
@@ -7799,7 +7556,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -7817,7 +7574,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -7839,12 +7596,12 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join11(__dirname, "..", "file.js");
+          return join4(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
           try {
-            const context = filePath === "node:repl" ? process.cwd() + sep2 : filePath;
+            const context = filePath === "node:repl" ? process.cwd() + sep : filePath;
             fixTarget2 = createRequire(context).resolve(origin);
             break;
           } catch (err) {
@@ -8829,7 +8586,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join11 = ",";
+            let join4 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -8843,7 +8600,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join11 = `,
+                join4 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8851,13 +8608,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join11;
+                res += join4;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8878,7 +8635,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join11 = `,
+              join4 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8892,13 +8649,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join11;
+                separator = join4;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join11;
+              separator = join4;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -8939,7 +8696,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join11 = ",";
+            let join4 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -8952,7 +8709,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join11 = `,
+                join4 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8960,13 +8717,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join11;
+                res += join4;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8979,7 +8736,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join11 = `,
+              join4 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8988,7 +8745,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join11;
+                separator = join4;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -9046,20 +8803,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join12 = `,
+              const join5 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join12;
+                res2 += join5;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join12}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join5}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -9075,16 +8832,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join11 = `,
+            const join4 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join11, maximumBreadth);
+              res += stringifyTypedArray(value, join4, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join11;
+              separator = join4;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -9095,13 +8852,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join11;
+                separator = join4;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join11;
+              separator = join4;
             }
             if (separator !== "") {
               res = `
@@ -10192,11 +9949,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path38, added, removed, oldPosInc, options) {
-        var last = path38.lastComponent;
+      addToPath: function addToPath(path32, added, removed, oldPosInc, options) {
+        var last = path32.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path38.oldPos + oldPosInc,
+            oldPos: path32.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -10206,7 +9963,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path38.oldPos + oldPosInc,
+            oldPos: path32.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10264,7 +10021,7 @@ var init_lib = __esm({
       tokenize: function tokenize(value) {
         return Array.from(value);
       },
-      join: function join4(chars) {
+      join: function join3(chars) {
         return chars.join("");
       },
       postProcess: function postProcess(changeObjects) {
@@ -10637,10 +10394,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path38 = typeof rec.path === "string" ? rec.path : null;
+      const path32 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path38 || content == null) return null;
-      const entry = { path: path38, content };
+      if (!path32 || content == null) return null;
+      const entry = { path: path32, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11100,27 +10857,6 @@ var init_claude_history = __esm({
   }
 });
 
-// src/tools/sandbox.ts
-function shouldSandbox(cwd, personaRoot) {
-  if (!personaRoot) return false;
-  const sep2 = personaRoot.endsWith(path12.sep) ? "" : path12.sep;
-  return cwd.startsWith(personaRoot + sep2) && cwd !== personaRoot;
-}
-function inferSandboxSettingsPath(cwd, personaRoot) {
-  if (!shouldSandbox(cwd, personaRoot)) return null;
-  const rel = path12.relative(personaRoot, cwd);
-  const personaId = rel.split(path12.sep)[0];
-  if (!personaId) return null;
-  return path12.join(personaRoot, personaId, ".clawd", "sandbox-settings.json");
-}
-var path12;
-var init_sandbox = __esm({
-  "src/tools/sandbox.ts"() {
-    "use strict";
-    path12 = __toESM(require("path"), 1);
-  }
-});
-
 // src/tools/claude.ts
 function macOSDesktopCandidates(home) {
   return [
@@ -11185,8 +10921,7 @@ function buildSpawnArgs(ctx) {
       throw new Error(`unexpected personaMode: ${String(_exhaustive)}`);
     }
   }
-  const sandboxSettings = ctx.extraSettings ?? inferSandboxSettingsPath(ctx.cwd, ctx.personaRoot);
-  if (sandboxSettings) args.push("--settings", sandboxSettings);
+  if (ctx.extraSettings) args.push("--settings", ctx.extraSettings);
   if (ctx.extraSystemPrompt) args.push("--append-system-prompt", ctx.extraSystemPrompt);
   if (ctx.effort) args.push("--effort", ctx.effort);
   if (ctx.toolSessionId) args.push("--resume", ctx.toolSessionId);
@@ -11466,10 +11201,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path38 = typeof rec.path === "string" ? rec.path : null;
+      const path32 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path38 || content == null) return null;
-      const out = { path: path38, content };
+      if (!path32 || content == null) return null;
+      const out = { path: path32, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -11585,7 +11320,6 @@ var init_claude = __esm({
     init_protocol();
     init_claude_history();
     init_tool_result_extra();
-    init_sandbox();
     ATTACHMENT_SILENT_SUBTYPES2 = /* @__PURE__ */ new Set([
       "hook_additional_context",
       "hook_success",
@@ -18968,7 +18702,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes3, createHash: createHash3 } = require("crypto");
+    var { randomBytes, createHash } = require("crypto");
     var { Duplex, Readable: Readable3 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -19498,7 +19232,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes3(16).toString("base64");
+      const key = randomBytes(16).toString("base64");
       const request = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -19628,7 +19362,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -19995,7 +19729,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash3 } = require("crypto");
+    var { createHash } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -20296,7 +20030,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -20384,7 +20118,7 @@ var require_websocket_server = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path27.default.dirname(opts.recordPath);
+  const dir = import_node_path28.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -20424,12 +20158,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs25, import_node_path27;
+var import_node_fs25, import_node_path28;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
     import_node_fs25 = __toESM(require("fs"), 1);
-    import_node_path27 = __toESM(require("path"), 1);
+    import_node_path28 = __toESM(require("path"), 1);
   }
 });
 
@@ -20472,7 +20206,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path28.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path29.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -20639,13 +20373,13 @@ async function runController(opts) {
   }
   return exitCode ?? 0;
 }
-var import_node_fs26, import_node_os14, import_node_path28;
+var import_node_fs26, import_node_os14, import_node_path29;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
     import_node_fs26 = require("fs");
     import_node_os14 = __toESM(require("os"), 1);
-    import_node_path28 = __toESM(require("path"), 1);
+    import_node_path29 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -20877,7 +20611,7 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path26 = __toESM(require("path"), 1);
+var import_node_path27 = __toESM(require("path"), 1);
 var import_node_fs24 = __toESM(require("fs"), 1);
 
 // src/logger.ts
@@ -20915,9 +20649,6 @@ function createLogger(opts = {}) {
   return wrap(base);
 }
 
-// src/session/store-factory.ts
-var path5 = __toESM(require("path"), 1);
-
 // src/session/store.ts
 var import_node_fs3 = __toESM(require("fs"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
@@ -20955,16 +20686,12 @@ function safeFileName(sessionId) {
 var SessionStore = class {
   root;
   constructor(opts) {
-    if ("root" in opts) {
-      this.root = opts.root;
-    } else {
-      const scope = opts.scope ?? { kind: "default" };
-      this.root = import_node_path4.default.join(
-        opts.dataDir,
-        "sessions",
-        ...scopeSubPath(scope).map(safeFileName)
-      );
-    }
+    const scope = opts.scope ?? { kind: "default" };
+    this.root = import_node_path4.default.join(
+      opts.dataDir,
+      "sessions",
+      ...scopeSubPath(scope).map(safeFileName)
+    );
   }
   filePath(sessionId) {
     return import_node_path4.default.join(this.root, `${safeFileName(sessionId)}.json`);
@@ -21029,66 +20756,6 @@ var SessionStore = class {
   }
 };
 
-// src/session/store-factory.ts
-var SessionStoreFactory = class {
-  dataDir;
-  bareStore = null;
-  vmOwnerStores = /* @__PURE__ */ new Map();
-  // vmGuest 索引 key = `${pid}::${personId}`（per-People token: 一 person 一目录）
-  vmGuestStores = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.dataDir = opts.dataDir;
-  }
-  // ---- root path 派生（暴露给 migration / revoke cascade 等外部消费方） ----
-  bareRoot() {
-    return path5.join(this.dataDir, "sessions");
-  }
-  vmOwnerRoot(personaId) {
-    return path5.join(
-      this.dataDir,
-      "personas",
-      safeFileName(personaId),
-      ".clawd",
-      "sessions",
-      "owner"
-    );
-  }
-  vmGuestRoot(personaId, personId) {
-    return path5.join(
-      this.dataDir,
-      "personas",
-      safeFileName(personaId),
-      ".clawd",
-      "sessions",
-      "guests",
-      safeFileName(personId)
-    );
-  }
-  // ---- SessionStore 工厂（缓存） ----
-  forBare() {
-    if (!this.bareStore) {
-      this.bareStore = new SessionStore({ root: this.bareRoot() });
-    }
-    return this.bareStore;
-  }
-  forVmOwner(personaId) {
-    const key = personaId;
-    const cached = this.vmOwnerStores.get(key);
-    if (cached) return cached;
-    const st = new SessionStore({ root: this.vmOwnerRoot(personaId) });
-    this.vmOwnerStores.set(key, st);
-    return st;
-  }
-  forVmGuest(personaId, personId) {
-    const key = `${personaId}::${personId}`;
-    const cached = this.vmGuestStores.get(key);
-    if (cached) return cached;
-    const st = new SessionStore({ root: this.vmGuestRoot(personaId, personId) });
-    this.vmGuestStores.set(key, st);
-    return st;
-  }
-};
-
 // src/session/manager.ts
 var import_node_fs5 = __toESM(require("fs"), 1);
 var import_node_path6 = __toESM(require("path"), 1);
@@ -21248,10 +20915,7 @@ function buildSpawnContext(state, deps) {
     toolSessionId: file.toolSessionId,
     model: file.model,
     permissionMode: file.permissionMode,
-    effort: file.effort,
-    // Phase 2 capability platform (plan §3): personaRoot 透传给 buildSpawnArgs;
-    // 内部 shouldSandbox(cwd, personaRoot) 决定是否注入 --settings sandbox-settings.
-    personaRoot: deps.personaRoot
+    effort: file.effort
   };
   const meta = state.subSessionMeta;
   if (meta?.personaMode) {
@@ -21978,8 +21642,7 @@ var SessionRunner = class {
       now: this.hooks.now ?? Date.now,
       resolveContextWindow: this.hooks.resolveContextWindow,
       genUuid: this.hooks.genUuid ?? v4_default,
-      ownerDisplayName: this.hooks.ownerDisplayName,
-      personaRoot: this.hooks.personaRoot
+      ownerDisplayName: this.hooks.ownerDisplayName
     };
     const { state, effects } = reduceSession(this.state, inputMsg, deps);
     this.state = state;
@@ -22403,20 +22066,9 @@ var SessionManager = class {
   attachObserver(observer) {
     this.attachedObserver = observer;
   }
-  // 按 scope 拿对应的 SessionStore.
-  // Phase 2 (capability platform plan §1) 路由切到 SessionStoreFactory:
-  //   default              → factory.forBare()        <dataDir>/sessions/
-  //   persona/<pid>/owner  → factory.forVmOwner(pid)  <dataDir>/personas/<pid>/.clawd/sessions/owner/
-  //   persona/<pid>/listener → throw (listener 角色 #698 已下线, schema 字段保留但运行时不该出现)
-  // 缺省 (无 factory 注入): 回退 dataDir+scope 老路径 (向后兼容旧 spec).
+  // 按 scope 拿对应的 SessionStore。default scope 复用 deps.store（保证与
+  // bootstrap 注入的 store 一致）；persona scope 第一次访问时按需创建并缓存。
   storeFor(scope) {
-    if (this.deps.storeFactory) {
-      if (scope.kind === "default") return this.deps.storeFactory.forBare();
-      if (scope.mode === "owner") return this.deps.storeFactory.forVmOwner(scope.personaId);
-      throw new Error(
-        `SessionManager: listener scope is deprecated (#698); use forVmGuest in Phase 3+ instead`
-      );
-    }
     if (scope.kind === "default") return this.deps.store;
     const key = scopeKey(scope);
     const cached = this.storesByScope.get(key);
@@ -22444,13 +22096,11 @@ var SessionManager = class {
   scopeForFile(file) {
     return file.ownerPersonaId ? { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" } : { kind: "default" };
   }
-  // 扫所有 persona 命名空间. 用于 findOwnedSession / listAllOwned 跨 scope 查询.
-  // Phase 2 capability platform: 新布局下 persona 资产在 <dataDir>/personas/<pid>/,
-  // 直接 readdir 这个目录拿所有 personaId. 老布局 (无 storeFactory) fallback 扫
-  // <dataDir>/sessions/ 列子目录 (排除 'default').
+  // 扫 <dataDir>/sessions/ 列出所有 persona 命名空间（不含 'default'）。
+  // 用于 findOwnedSession / listAllOwned 跨 scope 查询。
   listPersonaIdsOnDisk() {
     if (!this.deps.dataDir) return [];
-    const root = this.deps.storeFactory ? import_node_path6.default.join(this.deps.dataDir, "personas") : import_node_path6.default.join(this.deps.dataDir, "sessions");
+    const root = import_node_path6.default.join(this.deps.dataDir, "sessions");
     let entries;
     try {
       entries = import_node_fs5.default.readdirSync(root, { withFileTypes: true });
@@ -22462,9 +22112,19 @@ var SessionManager = class {
     return entries.filter((e) => e.isDirectory() && e.name !== "default").map((e) => e.name);
   }
   // owner / default 两个分类下按 sessionId 找文件——前端只传 sessionId 不带 scope，
-  // SessionManager 在这里扫盘定位（default 直接试，未命中再轮询所有 persona owner 目录）。
+  // SessionManager 在这里定位。三层快慢路径：
+  //   1) active runner（用户当前在用的 session）：runner.state.file 是 SessionFile 内存权威副本，
+  //      直接返回，零磁盘 I/O。覆盖 attachment / file-sharing 等"用户操作 → 紧接着 RPC"的
+  //      绝大多数场景
+  //   2) default scope 磁盘：inactive default session 命中
+  //   3) 所有 persona owner 目录扫盘：inactive persona owner session 命中
   // listener sub-session 不走这条——transport 始终明确传 (personaId, sessionId)。
+  //
+  // 公开方法：attachment / file-sharing handler 通过 deps 闭包消费，不应直接持 SessionStore
+  // （持 default-only store 是 file-sharing v1 的预存 bug 根因——见 fix #703）
   findOwnedSession(sessionId) {
+    const runner = this.runners.get(sessionId);
+    if (runner) return runner.getState().file;
     const dflt = this.deps.store.read(sessionId);
     if (dflt) return dflt;
     for (const personaId of this.listPersonaIdsOnDisk()) {
@@ -22474,6 +22134,13 @@ var SessionManager = class {
     }
     return null;
   }
+  // findOwnedSession + scopeForFile 收口。把"sessionId → SessionScope"的派生
+  // 集中到 manager（scope 单一来源），调用方拿 scope 不再自己拼 object 也不依赖
+  // ownerPersonaId 字段语义。给 attachment handler 通过 deps.getSessionScope 闭包消费。
+  findOwnedSessionScope(sessionId) {
+    const file = this.findOwnedSession(sessionId);
+    return file ? this.scopeForFile(file) : null;
+  }
   // 合并 default + 所有 persona owner 的 SessionFile —— 桌面 App 主 session 列表入口。
   // 同样不含 listener sub-session（listener 走 persona:listSubSessions RPC 单独入口）。
   listAllOwned() {
@@ -22525,9 +22192,6 @@ var SessionManager = class {
       dataDir: this.deps.dataDir,
       personaStore: this.deps.personaStore,
       ownerDisplayName: this.deps.ownerDisplayName,
-      // Phase 2 capability platform (plan §3): 透传 personaRoot, buildSpawnArgs 据
-      // cwd 是否在 personaRoot 下自动决定是否注入 --settings sandbox-settings.json.
-      personaRoot: this.deps.personaRoot,
       // file-sharing (spec §6 PR 3)：闭包 scope + sessionId，runner 只暴露 tool/relPath/cwd
       onFileEdit: attachmentGroup ? (input) => attachmentGroup.onFileEdit({
         scope,
@@ -22622,7 +22286,7 @@ var SessionManager = class {
     }
   }
   // ---- 命令方法：均返回 { response, broadcast[] }，由 dispatcher 聚合 ----
-  create(args, creatorPrincipalId) {
+  create(args) {
     let cwd;
     if (args.ownerPersonaId) {
       cwd = derivePersonaSpawnCwd(
@@ -22663,7 +22327,6 @@ var SessionManager = class {
       iconKey: args.iconKey,
       forkedFromSessionId: args.forkedFromSessionId,
       ownerPersonaId: args.ownerPersonaId,
-      creatorPrincipalId,
       createdAt: iso,
       updatedAt: iso
     };
@@ -23541,7 +23204,7 @@ var SessionManager = class {
 
 // src/persona/store.ts
 var fs6 = __toESM(require("fs"), 1);
-var path8 = __toESM(require("path"), 1);
+var path7 = __toESM(require("path"), 1);
 init_protocol();
 var DEFAULT_SETTINGS = {
   permissions: {
@@ -23570,13 +23233,13 @@ var PersonaStore = class {
   }
   root;
   personaDir(personaId) {
-    return path8.join(this.root, safeFileName(personaId));
+    return path7.join(this.root, safeFileName(personaId));
   }
   metaPath(personaId) {
-    return path8.join(this.personaDir(personaId), ".clawd", "persona.json");
+    return path7.join(this.personaDir(personaId), ".clawd", "persona.json");
   }
   claudeMdPath(personaId) {
-    return path8.join(this.personaDir(personaId), "CLAUDE.md");
+    return path7.join(this.personaDir(personaId), "CLAUDE.md");
   }
   /**
    * Sandbox settings 落盘路径 —— 故意放在 `.clawd/` 而不是 `.claude/`，让 CC 的
@@ -23586,11 +23249,11 @@ var PersonaStore = class {
    * 加载 persona 人格，只有 listener 多一层 OS sandbox。
    */
   sandboxSettingsPath(personaId) {
-    return path8.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
+    return path7.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
   }
   write(persona, personality) {
     const dir = this.personaDir(persona.personaId);
-    fs6.mkdirSync(path8.join(dir, ".clawd"), { recursive: true });
+    fs6.mkdirSync(path7.join(dir, ".clawd"), { recursive: true });
     this.atomicWrite(this.claudeMdPath(persona.personaId), personality);
     this.atomicWrite(
       this.sandboxSettingsPath(persona.personaId),
@@ -23608,10 +23271,6 @@ var PersonaStore = class {
     const p2 = this.metaPath(personaId);
     if (!fs6.existsSync(p2)) return null;
     const raw = JSON.parse(fs6.readFileSync(p2, "utf8"));
-    if (raw && typeof raw === "object" && "tokenMap" in raw) {
-      delete raw.tokenMap;
-      this.atomicWrite(p2, JSON.stringify(raw, null, 2));
-    }
     return PersonaFileSchema.parse(raw);
   }
   has(personaId) {
@@ -23637,12 +23296,48 @@ var PersonaStore = class {
   }
   /** Persona 私有 skills 目录路径：<personaDir>/.claude/skills */
   skillsDir(personaId) {
-    return path8.join(this.personaDir(personaId), ".claude", "skills");
+    return path7.join(this.personaDir(personaId), ".claude", "skills");
+  }
+  /**
+   * Claude Code 项目级 settings 路径：`<personaDir>/.claude/settings.json`。
+   * 这里只读 `enabledPlugins` 字段，由 owner 通过 CC `/plugin` 之类命令维护，daemon 不写。
+   */
+  claudeSettingsPath(personaId) {
+    return path7.join(this.personaDir(personaId), ".claude", "settings.json");
+  }
+  /**
+   * 读取 persona 的 `.claude/settings.json` 中 `enabledPlugins` map，把 value === true
+   * 的 key 转成 `{ id }[]` 给 UI 做只读展示。
+   *
+   * 兜底范围（来自老板规则：不要无事实依据的兜底）：
+   *   - 文件不存在 → []（plugin 未被启用是合法初始态）
+   *   - JSON 解析失败 → []（owner 手改文件，schema 漂移交给 UI 兜底）
+   *   - `enabledPlugins` 字段缺失 / 非 object → []
+   *   - 单 value 非 boolean → 跳过该 entry
+   * 其他错误（fs 权限等）原样抛出，由上层 handler 转 ws error 帧。
+   */
+  readEnabledPlugins(personaId) {
+    const p2 = this.claudeSettingsPath(personaId);
+    if (!fs6.existsSync(p2)) return [];
+    let raw;
+    try {
+      raw = JSON.parse(fs6.readFileSync(p2, "utf8"));
+    } catch {
+      return [];
+    }
+    if (!raw || typeof raw !== "object") return [];
+    const enabled = raw.enabledPlugins;
+    if (!enabled || typeof enabled !== "object" || Array.isArray(enabled)) return [];
+    const out = [];
+    for (const [id, value] of Object.entries(enabled)) {
+      if (value === true && id.length > 0) out.push({ id });
+    }
+    return out;
   }
   list() {
     if (!fs6.existsSync(this.root)) return [];
     return fs6.readdirSync(this.root).filter((name) => {
-      return fs6.existsSync(path8.join(this.root, name, ".clawd", "persona.json"));
+      return fs6.existsSync(path7.join(this.root, name, ".clawd", "persona.json"));
     });
   }
   remove(personaId) {
@@ -23667,19 +23362,12 @@ var PersonaRegistry = class {
   }
   store;
   cache = /* @__PURE__ */ new Map();
-  /**
-   * 从 store 全量重建缓存（boot 时 + 测试 setup 时）。
-   * 单个 persona 读失败（损坏的 persona.json / schema 不匹配）不应阻塞 daemon 启动 ——
-   * try/catch 隔离，让其它 persona 仍能加载。
-   */
+  /** 从 store 全量重建缓存（boot 时 + 测试 setup 时） */
   reload() {
     this.cache.clear();
     for (const id of this.store.list()) {
-      try {
-        const p2 = this.store.read(id);
-        if (p2) this.cache.set(p2.personaId, p2);
-      } catch {
-      }
+      const p2 = this.store.read(id);
+      if (p2) this.cache.set(p2.personaId, p2);
     }
   }
   get(personaId) {
@@ -23695,6 +23383,21 @@ var PersonaRegistry = class {
   list() {
     return Array.from(this.cache.values());
   }
+  /**
+   * file-sharing HTTP auth-context 用的逆向查表：只有 Bearer token，没有 personaId。
+   * 线性扫所有 persona.tokenMap 找到第一条 ok 命中的；revoked / non-public persona 跳过。
+   * persona 数量通常 < 100，性能可忽略。
+   */
+  findByToken(token) {
+    if (!token) return null;
+    for (const persona of this.cache.values()) {
+      if (!persona.public) continue;
+      const entry = persona.tokenMap?.[token];
+      if (!entry || entry.revoked) continue;
+      return { personaId: persona.personaId, label: entry.label };
+    }
+    return null;
+  }
 };
 
 // src/persona/manager.ts
@@ -23988,6 +23691,9 @@ var PersonaManager = class {
       model: args.model,
       public: args.public ?? false,
       iconKey: args.iconKey,
+      // 初始化空 token 集合；后续由 issueToken / revokeToken 维护，
+      // file-sharing HTTP Bearer 鉴权用 PersonaRegistry.findByToken 反查
+      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -24024,28 +23730,65 @@ var PersonaManager = class {
   listSkills(personaId) {
     return listSkillsForDir(this.deps.store.skillsDir(personaId), "project");
   }
+  /**
+   * 读取 persona `.claude/settings.json` 中已启用的插件列表（value === true 的 key）。
+   * 文件不存在 / 解析失败 / 字段缺失 → 空数组。供 persona:get handler 拼响应。
+   */
+  listEnabledPlugins(personaId) {
+    return this.deps.store.readEnabledPlugins(personaId);
+  }
   /** 读 sandbox-settings.json；不存在 / 损坏返回 null。供 persona:get handler 拼响应。 */
   readSandboxSettings(personaId) {
     return this.deps.store.readSandboxSettings(personaId);
   }
   /**
    * 删除 persona。
-   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录,
-   * Phase 2 capability platform 新布局下含 .clawd/sessions/owner/ +
-   * .clawd/sessions/guests/<capId>/, rmSync recursive force 一锅清.
-   *
-   * ⚠️ TODO (Phase 3+ design gap, reviewer P1 flagged):
-   * ~/.clawd/capabilities.json 里若有 cap.grants 含本 personaId, grant 会变成
-   * 悬空引用 (guest 仍能持 token 接入, 但调依赖该 persona 的 RPC 会 fail).
-   * 选项: (A) 这里扫所有 cap 过滤掉该 personaId 的 grant; (B) revoke 所有 grant
-   * 含该 personaId 的 cap. 当前因 cleanupGuestSessionsForCapability 用 rmSync
-   * force=true 吞 ENOENT 不会 crash, 但 UI CapabilityManagerDrawer 会展示
-   * "无效的 persona" grant. Phase 3 加 cross-reference 矩阵后正式实现.
+   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录。
    */
   delete(personaId) {
     this.deps.store.remove(personaId);
     this.deps.registry.remove(personaId);
   }
+  /**
+   * 生成 32-char base64url token 并写入 tokenMap，给 file-sharing HTTP Bearer
+   * 鉴权用（PersonaRegistry.findByToken 反查 personaId/label）。
+   */
+  issueToken(personaId, label) {
+    const existing = this.deps.registry.get(personaId);
+    if (!existing) throw new Error(`persona not found: ${personaId}`);
+    const token = import_node_crypto3.default.randomBytes(24).toString("base64url");
+    const entry = {
+      label,
+      issuedAt: Date.now(),
+      revoked: false
+    };
+    const updated = {
+      ...existing,
+      tokenMap: { ...existing.tokenMap ?? {}, [token]: entry },
+      updatedAt: Date.now()
+    };
+    this.deps.store.writeMeta(updated);
+    this.deps.registry.set(updated);
+    return { token, persona: updated };
+  }
+  /** 标记 token 为 revoked（保留条目用于审计）；不存在的 token 抛错。 */
+  revokeToken(personaId, token) {
+    const existing = this.deps.registry.get(personaId);
+    if (!existing) throw new Error(`persona not found: ${personaId}`);
+    const tokenEntry = existing.tokenMap?.[token];
+    if (!tokenEntry) throw new Error(`token not found in persona ${personaId}`);
+    const updated = {
+      ...existing,
+      tokenMap: {
+        ...existing.tokenMap ?? {},
+        [token]: { ...tokenEntry, revoked: true }
+      },
+      updatedAt: Date.now()
+    };
+    this.deps.store.writeMeta(updated);
+    this.deps.registry.set(updated);
+    return updated;
+  }
   /**
    * label 转 4-16 char slug。优先用 `persona-<slug>`；若 slug 已被占用，追加 4 char
    * base64url 随机后缀直到不撞为止（最多 5 次，理论冲突 ≈ 2^-24，留个 panic 上限）。
@@ -24065,7 +23808,7 @@ var PersonaManager = class {
 
 // src/persona/seed.ts
 var fs8 = __toESM(require("fs"), 1);
-var path10 = __toESM(require("path"), 1);
+var path9 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var import_meta = {};
 var DEFAULT_PERSONAS = [
@@ -24101,14 +23844,14 @@ var DEFAULT_PERSONAS = [
 function findDefaultsRoot() {
   const candidates = [];
   try {
-    const here = path10.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    candidates.push(path10.resolve(here, "defaults"));
-    candidates.push(path10.resolve(here, "persona-defaults"));
+    const here = path9.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    candidates.push(path9.resolve(here, "defaults"));
+    candidates.push(path9.resolve(here, "persona-defaults"));
   } catch {
   }
   if (process.argv[1]) {
-    const argvDir = path10.dirname(process.argv[1]);
-    candidates.push(path10.resolve(argvDir, "persona-defaults"));
+    const argvDir = path9.dirname(process.argv[1]);
+    candidates.push(path9.resolve(argvDir, "persona-defaults"));
   }
   for (const c of candidates) {
     try {
@@ -24125,7 +23868,7 @@ function seedDefaultPersonas(args) {
       args.logger.info("persona.seed.skip", { personaId: entry.personaId, reason: "exists" });
       continue;
     }
-    const bundleDir = path10.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path9.join(args.defaultsRoot, entry.personaId);
     if (!fs8.existsSync(bundleDir)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -24134,7 +23877,7 @@ function seedDefaultPersonas(args) {
       });
       continue;
     }
-    const claudeMdPath = path10.join(bundleDir, "CLAUDE.md");
+    const claudeMdPath = path9.join(bundleDir, "CLAUDE.md");
     if (!fs8.existsSync(claudeMdPath)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -24151,6 +23894,7 @@ function seedDefaultPersonas(args) {
       model: entry.model,
       public: entry.public,
       iconKey: entry.iconKey,
+      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -24162,8 +23906,8 @@ function seedDefaultPersonas(args) {
 function copyBundleExtras(srcDir, dstDir) {
   for (const entry of fs8.readdirSync(srcDir, { withFileTypes: true })) {
     if (entry.name === "CLAUDE.md" || entry.name === ".clawd") continue;
-    const srcPath = path10.join(srcDir, entry.name);
-    const dstPath = path10.join(dstDir, entry.name);
+    const srcPath = path9.join(srcDir, entry.name);
+    const dstPath = path9.join(dstDir, entry.name);
     if (entry.isDirectory()) {
       fs8.cpSync(srcPath, dstPath, { recursive: true, dereference: true });
     } else if (entry.isFile()) {
@@ -25545,9 +25289,6 @@ var LocalWsServer = class {
   httpServer = null;
   frameHandler = null;
   clients = /* @__PURE__ */ new Map();
-  // Task 1.7 capability platform：capId → Set<clientId>，撤销时 O(1) 找到该 cap 的
-  // 所有活跃连接做关闭级联（Task 1.10）。同一 cap 可能多端同时连（多设备 / 多 tab）。
-  capabilityIdToClients = /* @__PURE__ */ new Map();
   logger;
   pingIntervalMs;
   async start() {
@@ -25638,49 +25379,6 @@ var LocalWsServer = class {
       this.safeSend(c.ws, frame);
     }
   }
-  // Task 1.9 capability platform：仅广播给 owner 连接（跳过 guest ws）。
-  // 用于 capability:tokenIssued / capability:tokenDeleted 等 owner-only push frame——
-  // guest 没必要也无法消费这类管理帧。noAuth localhost ws 没有 ctx, 视作 owner.
-  broadcastToOwners(frame) {
-    const gate = this.opts.authGate;
-    for (const c of this.clients.values()) {
-      if (gate && !gate.isAuthed(c.handle.id)) continue;
-      if (c.ctx && c.ctx.principal.kind !== "owner") continue;
-      this.safeSend(c.ws, frame);
-    }
-  }
-  // capability platform v3 inbox 重写: 推给某条 cap channel 的两端 ws.
-  //   - 所有 owner ws (owner 看自家所有 channel)
-  //   - 该 capabilityId 的所有 guest ws (该 cap 持有人的多端/多 tab)
-  // 一次调用同时推两端, inbox:event push 帧由此走.
-  broadcastToCapabilityChannel(capabilityId, frame) {
-    this.broadcastToOwners(frame);
-    const set = this.capabilityIdToClients.get(capabilityId);
-    if (!set) return;
-    for (const id of set) {
-      const c = this.clients.get(id);
-      if (!c) continue;
-      this.safeSend(c.ws, frame);
-    }
-  }
-  // Phase 4 capability platform DM: 广播到指定 principal 的所有活跃 ws.
-  //   principalId === ownerPrincipalId  → 同 broadcastToOwners (所有 owner ws)
-  //   principalId === 'owner' sentinel  → 同上（向后兼容遗留 caller / 协议层 sentinel）
-  //   principalId === 'cap_xxx'         → 该 capability 的所有 guest ws (多端 / 多 tab)
-  // 用于 DM inbox:event 路由: from + to 两侧各播一次, 让双方 UI 实时看到 thread 更新.
-  broadcastToPrincipal(principalId, frame) {
-    if (principalId === "owner" || principalId === this.opts.ownerPrincipalId) {
-      this.broadcastToOwners(frame);
-      return;
-    }
-    const set = this.capabilityIdToClients.get(principalId);
-    if (!set) return;
-    for (const id of set) {
-      const c = this.clients.get(id);
-      if (!c) continue;
-      this.safeSend(c.ws, frame);
-    }
-  }
   firstSubscriber(sessionId) {
     for (const c of this.clients.values()) {
       if (c.handle.subscribedSessions.has(sessionId)) return c.handle;
@@ -25702,40 +25400,6 @@ var LocalWsServer = class {
     if (!c) return;
     this.safeSend(c.ws, frame);
   }
-  // Task 1.7 capability platform：AuthGate.onAuthed 回调里调本方法，把 ConnectionContext
-  // 绑到 client；guest 连接同时进 capId 索引（Task 1.10 撤销级联用）。
-  attachClientContext(clientId, ctx) {
-    const c = this.clients.get(clientId);
-    if (!c) return;
-    c.ctx = ctx;
-    if (ctx.capabilityId) {
-      let set = this.capabilityIdToClients.get(ctx.capabilityId);
-      if (!set) {
-        set = /* @__PURE__ */ new Set();
-        this.capabilityIdToClients.set(ctx.capabilityId, set);
-      }
-      set.add(clientId);
-    }
-  }
-  // 测试 / Task 1.8 dispatcher 用：拿 client 当前 ConnectionContext（null = 未鉴权 / noAuth）
-  getClientContext(clientId) {
-    return this.clients.get(clientId)?.ctx ?? null;
-  }
-  // Task 1.10 撤销级联：关闭某 capability 的所有活跃 ws 连接。close code 4401
-  // 让客户端识别 'capability revoked' 而非普通断连。
-  closeConnectionsByCapability(capabilityId, code = 4401, reason = "TOKEN_REVOKED") {
-    const set = this.capabilityIdToClients.get(capabilityId);
-    if (!set) return;
-    const ids = [...set];
-    for (const id of ids) {
-      const c = this.clients.get(id);
-      if (!c) continue;
-      try {
-        c.ws.close(code, reason);
-      } catch {
-      }
-    }
-  }
   // URL path 路由：'/' → 主连接路径；其他 → close 4404
   routeConnection(socket, req) {
     const remoteAddress = req?.socket?.remoteAddress;
@@ -25770,7 +25434,7 @@ var LocalWsServer = class {
       } catch {
       }
     }, this.pingIntervalMs);
-    this.clients.set(id, { handle, ws: socket, pingTimer, ctx: null });
+    this.clients.set(id, { handle, ws: socket, pingTimer });
     this.logger?.info("client connected", { clientId: id, total: this.clients.size, remoteAddress });
     const authGate = this.opts.authGate;
     let authed = true;
@@ -25794,12 +25458,6 @@ var LocalWsServer = class {
     socket.on("close", () => {
       const c = this.clients.get(id);
       if (c?.pingTimer) clearInterval(c.pingTimer);
-      const capId = c?.ctx?.capabilityId;
-      if (capId) {
-        const set = this.capabilityIdToClients.get(capId);
-        set?.delete(id);
-        if (set && set.size === 0) this.capabilityIdToClients.delete(capId);
-      }
       this.clients.delete(id);
       authGate?.unregister(id);
       this.logger?.info("client disconnected", { clientId: id, remaining: this.clients.size });
@@ -25832,11 +25490,6 @@ var LocalWsServer = class {
         return;
       }
     } else if (frame.type === "auth") {
-      const token = typeof frame.token === "string" ? frame.token ?? "" : "";
-      if (token && this.opts.tryVerifyCapabilityToken) {
-        const guestCtx = this.opts.tryVerifyCapabilityToken(token);
-        if (guestCtx) this.attachClientContext(client.id, guestCtx);
-      }
       this.safeSend(this.clients.get(client.id).ws, { type: "auth:ok" });
       return;
     }
@@ -25953,27 +25606,15 @@ var AuthGate = class {
       this.markFailed(handle.id);
       return frame.type === "auth" ? "consumed" : "reject";
     }
-    let ctx = null;
-    if (this.opts.authenticate) {
-      const r = this.opts.authenticate(parsed.data.token, parsed.data.selfPrincipalId);
-      if (!r.ok) {
-        this.opts.closeConnection(handle, 4401, r.code);
-        this.markFailed(handle.id);
-        return "consumed";
-      }
-      ctx = r.context;
-    } else {
-      if (!this.opts.expectedToken) {
-        this.opts.closeConnection(handle, 1008, "auth not configured");
-        this.markFailed(handle.id);
-        return "consumed";
-      }
-      if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
-        this.opts.closeConnection(handle, 1008, "auth failed");
-        this.markFailed(handle.id);
-        return "consumed";
-      }
-      ctx = this.opts.buildOwnerContext?.() ?? null;
+    if (!this.opts.expectedToken) {
+      this.opts.closeConnection(handle, 1008, "auth not configured");
+      this.markFailed(handle.id);
+      return "consumed";
+    }
+    if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
+      this.opts.closeConnection(handle, 1008, "auth failed");
+      this.markFailed(handle.id);
+      return "consumed";
     }
     if (st.timer != null) {
       const clear = this.opts.clearTimer ?? ((h) => clearTimeout(h));
@@ -25981,7 +25622,6 @@ var AuthGate = class {
     }
     st.authed = true;
     st.timer = null;
-    if (ctx && this.opts.onAuthed) this.opts.onAuthed(handle, ctx);
     this.opts.sendOk(handle, { type: "auth:ok" });
     return "consumed";
   }
@@ -26017,7 +25657,7 @@ var AuthContextResolver = class {
   }
   opts;
   /**
-   * 从 `Authorization` 头解析。null = 无凭证 / 不识别，调用方一律 401。
+   * 从 `Authorization` 头解析。null = 无凭证 / 不识别 / revoked，调用方一律 401。
    * remoteAddress 用于 isLoopback 判定（loopback = 127.0.0.1 / ::1 / ::ffff:127.0.0.1）。
    */
   resolveFromHeader(authHeader, remoteAddress) {
@@ -26027,6 +25667,15 @@ var AuthContextResolver = class {
     if (this.opts.ownerToken && constantTimeEqual2(token, this.opts.ownerToken)) {
       return { role: "owner", isLoopback };
     }
+    const personalHit = this.opts.personaRegistry.findByToken(token);
+    if (personalHit) {
+      return {
+        role: "personal",
+        personaId: personalHit.personaId,
+        label: personalHit.label,
+        isLoopback
+      };
+    }
     return null;
   }
 };
@@ -26048,759 +25697,206 @@ function constantTimeEqual2(a, b2) {
   return diff2 === 0;
 }
 
-// ../protocol/src/index.ts
-init_runtime();
-
-// src/transport/connection-context.ts
-function ownerContext(ownerPrincipalId, displayName) {
-  return {
-    principal: makeOwnerPrincipal(ownerPrincipalId, displayName),
-    grants: [{ resource: { type: "*" }, actions: ["admin"] }]
-  };
-}
-function guestContext(cap) {
-  return {
-    principal: { id: cap.id, kind: "guest", displayName: cap.displayName },
-    grants: cap.grants,
-    capabilityId: cap.id
-  };
-}
-function authenticate(token, deps) {
-  if (!token) return { ok: false, code: "NO_TOKEN" };
-  if (deps.isOwnerToken(token)) {
-    return { ok: true, context: ownerContext(deps.ownerPrincipalId, deps.ownerDisplayName) };
-  }
-  if (!deps.capabilityRegistry) return { ok: false, code: "BAD_TOKEN" };
-  const v2 = deps.capabilityRegistry.verifyToken(token);
-  if (v2.ok) return { ok: true, context: guestContext(v2.capability) };
-  if (v2.code === "TOKEN_INVALID") return { ok: false, code: "BAD_TOKEN" };
-  return { ok: false, code: v2.code };
-}
+// src/transport/http-router.ts
+var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
 
-// src/permission/capability-store.ts
-var fs15 = __toESM(require("fs"), 1);
-var path18 = __toESM(require("path"), 1);
-var CAPABILITIES_FILE_NAME = "capabilities.json";
-var FILE_VERSION = 1;
-var CapabilityStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    fs15.mkdirSync(dataDir, { recursive: true });
-    this.cache = this.readFromDisk();
-  }
+// src/attachment/group.ts
+var import_node_fs13 = __toESM(require("fs"), 1);
+var import_node_path14 = __toESM(require("path"), 1);
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+init_protocol();
+var GroupFileStore = class {
   dataDir;
-  cache;
-  list() {
-    return [...this.cache];
+  logger;
+  cache = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dataDir = opts.dataDir;
+    this.logger = opts.logger;
   }
-  upsert(cap) {
-    const idx = this.cache.findIndex((c) => c.id === cap.id);
-    if (idx >= 0) {
-      this.cache[idx] = cap;
-    } else {
-      this.cache.push(cap);
-    }
-    this.flush();
+  rootForScope(scope) {
+    return import_node_path14.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
   }
-  remove(id) {
-    const next = this.cache.filter((c) => c.id !== id);
-    if (next.length === this.cache.length) return;
-    this.cache = next;
-    this.flush();
-  }
-  filePath() {
-    return path18.join(this.dataDir, CAPABILITIES_FILE_NAME);
-  }
-  readFromDisk() {
-    const file = this.filePath();
-    let raw;
-    try {
-      raw = fs15.readFileSync(file, "utf8");
-    } catch (err) {
-      if (err?.code === "ENOENT") return [];
-      return [];
-    }
-    if (!raw.trim()) return [];
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      return [];
-    }
-    if (!parsed || typeof parsed !== "object") return [];
-    const arr = parsed.capabilities;
-    if (!Array.isArray(arr)) return [];
-    const out = [];
-    for (const item of arr) {
-      const r = CapabilitySchema.safeParse(item);
-      if (r.success) out.push(r.data);
-    }
-    return out;
-  }
-  flush() {
-    const content = { version: FILE_VERSION, capabilities: this.cache };
-    this.atomicWrite(this.filePath(), JSON.stringify(content, null, 2));
-  }
-  atomicWrite(file, content) {
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    fs15.writeFileSync(tmp, content, { mode: 384 });
-    fs15.renameSync(tmp, file);
-    try {
-      fs15.chmodSync(file, 384);
-    } catch {
-    }
-  }
-};
-
-// src/permission/capability-registry.ts
-var crypto4 = __toESM(require("crypto"), 1);
-var CapabilityRegistry = class {
-  constructor(store, now = () => Date.now()) {
-    this.store = store;
-    this.now = now;
-    for (const cap of store.list()) {
-      this.bySecretHash.set(cap.secretHash, cap);
-    }
-  }
-  store;
-  now;
-  // sha256(token) → Capability
-  bySecretHash = /* @__PURE__ */ new Map();
-  list() {
-    return this.store.list();
-  }
-  verifyToken(token) {
-    if (!token) return { ok: false, code: "TOKEN_INVALID" };
-    const hash = sha256Hex(token);
-    const cap = this.bySecretHash.get(hash);
-    if (!cap) return { ok: false, code: "TOKEN_INVALID" };
-    if (cap.expiresAt && this.now() >= cap.expiresAt) {
-      return { ok: false, code: "TOKEN_EXPIRED" };
-    }
-    if (cap.maxUses && cap.usedCount >= cap.maxUses) {
-      return { ok: false, code: "TOKEN_EXHAUSTED" };
-    }
-    const updated = { ...cap, usedCount: cap.usedCount + 1 };
-    this.bySecretHash.set(hash, updated);
-    this.store.upsert(updated);
-    return { ok: true, capability: updated };
-  }
-  upsertCapability(cap) {
-    this.bySecretHash.set(cap.secretHash, cap);
-    this.store.upsert(cap);
-  }
-  /**
-   * Hard delete：从 store 物理移除 + 从 Map 清掉 secretHash 索引。
-   * 后续 verifyToken 该 token 走 'TOKEN_INVALID' 分支（secretHash 已不在 Map）。
-   * idempotent：不存在 → null。
-   */
-  delete(id) {
-    const current = this.store.list().find((c) => c.id === id);
-    if (!current) return null;
-    this.bySecretHash.delete(current.secretHash);
-    this.store.remove(id);
-    return current;
-  }
-  findById(id) {
-    return this.store.list().find((c) => c.id === id) ?? null;
-  }
-};
-function sha256Hex(s) {
-  return crypto4.createHash("sha256").update(s).digest("hex");
-}
-
-// src/permission/capability-manager.ts
-var crypto5 = __toESM(require("crypto"), 1);
-var CapabilityManager = class {
-  constructor(registry2, hooks = {}) {
-    this.registry = registry2;
-    this.hooks = hooks;
-  }
-  registry;
-  hooks;
-  list() {
-    return this.registry.list();
-  }
-  // whoami handler 用：根据 capabilityId 反查 caller 的 capability 实体。
-  // 返回 Capability 持久化形态；handler 调 stripSecretHash 后再上 wire。
-  findById(id) {
-    return this.registry.findById(id);
-  }
-  issue(args) {
-    if (!args.displayName.trim()) {
-      throw new Error("CapabilityManager.issue: displayName must be non-empty");
-    }
-    const token = (this.hooks.generateToken ?? defaultGenerateToken)();
-    const id = (this.hooks.generateId ?? defaultGenerateId)();
-    const now = (this.hooks.now ?? Date.now)();
-    const cap = {
-      id,
-      secretHash: sha256Hex2(token),
-      displayName: args.displayName,
-      grants: args.grants,
-      issuedAt: now,
-      usedCount: 0,
-      personId: args.personId,
-      ...args.expiresAt !== void 0 ? { expiresAt: args.expiresAt } : {},
-      ...args.maxUses !== void 0 ? { maxUses: args.maxUses } : {}
-    };
-    this.registry.upsertCapability(cap);
-    this.hooks.onIssued?.(cap, token);
-    return { token, capability: cap };
-  }
-  /**
-   * Per-People token: 同 personId 已有 cap 时 add grants（merge unique by resource+action）。
-   * 返回 updated cap。如果 personId 没有 cap 返 null（caller 应该调 issue 新建）。
-   */
-  addGrantsToPerson(personId, newGrants) {
-    const existing = this.registry.list().find((c) => c.personId === personId);
-    if (!existing) return null;
-    const merged = mergeGrants(existing.grants, newGrants);
-    const updated = { ...existing, grants: merged };
-    this.registry.upsertCapability(updated);
-    this.hooks.onIssued?.(updated, "__merged__");
-    return updated;
-  }
-  /** 按 personId 反查现有 cap（per-People token dedupe）。 */
-  findByPerson(personId) {
-    return this.registry.list().find((c) => c.personId === personId) ?? null;
-  }
-  /**
-   * Hard delete：从 registry / store 物理移除 capability。
-   * idempotent：不存在 → null（handler 翻译成 VALIDATION_ERROR）
-   * onDeleted hook 在 daemon/index.ts wire 负责 close 连接 + cleanup 文件 + 广播
-   */
-  delete(id) {
-    const removed = this.registry.delete(id);
-    if (!removed) return null;
-    this.hooks.onDeleted?.(removed);
-    return { capability: removed };
-  }
-};
-function mergeGrants(existing, add) {
-  const key = (g2) => JSON.stringify({ r: g2.resource, a: [...g2.actions].sort() });
-  const seen = new Set(existing.map(key));
-  const out = [...existing];
-  for (const g2 of add) {
-    if (!seen.has(key(g2))) {
-      out.push(g2);
-      seen.add(key(g2));
-    }
-  }
-  return out;
-}
-function defaultGenerateToken() {
-  return crypto5.randomBytes(24).toString("base64url");
-}
-function defaultGenerateId() {
-  return "cap_" + crypto5.randomBytes(6).toString("base64url");
-}
-function sha256Hex2(s) {
-  return crypto5.createHash("sha256").update(s).digest("hex");
-}
-
-// src/permission/cleanup.ts
-var fs16 = __toESM(require("fs"), 1);
-function cleanupGuestSessionsForCapability(cap, factory) {
-  const removed = [];
-  for (const g2 of cap.grants) {
-    if (g2.resource.type !== "persona") continue;
-    const dir = factory.vmGuestRoot(g2.resource.id, cap.personId);
-    try {
-      fs16.rmSync(dir, { recursive: true, force: true });
-      removed.push(dir);
-    } catch {
-    }
-  }
-  return { removed };
-}
-
-// src/inbox/inbox-store.ts
-var fs17 = __toESM(require("fs"), 1);
-var path19 = __toESM(require("path"), 1);
-var INBOX_SUBDIR = "inbox";
-var InboxStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    fs17.mkdirSync(this.dirPath(), { recursive: true });
+  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
+  filePath(scope, sessionId) {
+    return import_node_path14.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
   }
-  dataDir;
-  /**
-   * 列出某条 channel 的消息, 按 createdAt 升序.
-   * sinceCreatedAt 缺省时返回全量; 提供时仅返回 createdAt > sinceCreatedAt 的增量.
-   * channel 文件不存在时返回 [] (不抛, 不创建).
-   */
-  list(capabilityId, sinceCreatedAt) {
-    const file = this.filePath(capabilityId);
-    let raw;
-    try {
-      raw = fs17.readFileSync(file, "utf8");
-    } catch (err) {
-      if (err?.code === "ENOENT") return [];
-      return [];
-    }
-    const all = parseAllLines(raw);
-    if (sinceCreatedAt === void 0) return all;
-    return all.filter((m2) => m2.createdAt > sinceCreatedAt);
+  cacheKey(scope, sessionId) {
+    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
   }
-  /**
-   * 列出所有 channel 的 capabilityId (扫目录所有 *.jsonl 文件名).
-   * 用于 daemon 启动时构建 index (跨 cap 聚合 unread 计数等).
-   */
-  listAllCapabilityIds() {
-    const dir = this.dirPath();
-    let entries;
+  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
+  readFile(scope, sessionId) {
+    const file = this.filePath(scope, sessionId);
     try {
-      entries = fs17.readdirSync(dir);
+      const raw = import_node_fs13.default.readFileSync(file, "utf8");
+      const parsed = JSON.parse(raw);
+      if (!Array.isArray(parsed)) {
+        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
+          file
+        });
+        return [];
+      }
+      const out = [];
+      for (const entry of parsed) {
+        const r = GroupFileEntrySchema.safeParse(entry);
+        if (r.success) out.push(r.data);
+      }
+      return out;
     } catch (err) {
-      if (err?.code === "ENOENT") return [];
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      this.logger?.warn("GroupFileStore.readFile failed", {
+        file,
+        err: err.message
+      });
       return [];
     }
-    return entries.filter((name) => name.endsWith(".jsonl")).map((name) => name.slice(0, -".jsonl".length));
   }
-  append(message) {
-    const file = this.filePath(message.capabilityId);
-    const line = JSON.stringify(message) + "\n";
-    fs17.appendFileSync(file, line, { mode: 384 });
-    try {
-      fs17.chmodSync(file, 384);
-    } catch {
-    }
+  writeFile(scope, sessionId, entries) {
+    const file = this.filePath(scope, sessionId);
+    import_node_fs13.default.mkdirSync(import_node_path14.default.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    import_node_fs13.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    import_node_fs13.default.renameSync(tmp, file);
   }
-  /**
-   * 把该 channel 所有 createdAt<=upToCreatedAt 且 sender!=principalId 的消息
-   * readBy[principalId] 写成 upToCreatedAt. O(N) rewrite 整个 channel 文件.
-   * 返写入了几条 (用于测试断言 / index 维护).
-   */
-  markRead(capabilityId, principalId, upToCreatedAt) {
-    const messages = this.list(capabilityId);
-    let changed = 0;
-    const next = messages.map((m2) => {
-      if (m2.senderPrincipalId === principalId) return m2;
-      if (m2.createdAt > upToCreatedAt) return m2;
-      const cur = m2.readBy[principalId];
-      if (cur !== void 0 && cur >= upToCreatedAt) return m2;
-      changed++;
-      return { ...m2, readBy: { ...m2.readBy, [principalId]: upToCreatedAt } };
-    });
-    if (changed === 0) return 0;
-    this.rewriteChannel(capabilityId, next);
-    return changed;
+  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
+  list(scope, sessionId) {
+    const key = this.cacheKey(scope, sessionId);
+    const cached = this.cache.get(key);
+    if (cached) return cached.entries;
+    const entries = this.readFile(scope, sessionId);
+    this.cache.set(key, { entries, scope });
+    return entries;
   }
   /**
-   * 删整条 channel (capability:delete cascade). 文件不存在 no-op.
+   * upsert：
+   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
+   *     （保留首次入群人 / 入群时刻）
+   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
+   *
+   * 返回最新 entry（caller 可用来 broadcast 通知）。
    */
-  removeByCapabilityId(capabilityId) {
-    const file = this.filePath(capabilityId);
-    try {
-      fs17.unlinkSync(file);
-    } catch (err) {
-      if (err?.code === "ENOENT") return;
-    }
-  }
-  rewriteChannel(capabilityId, messages) {
-    const file = this.filePath(capabilityId);
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    const content = messages.map((m2) => JSON.stringify(m2)).join("\n") + (messages.length > 0 ? "\n" : "");
-    fs17.writeFileSync(tmp, content, { mode: 384 });
-    fs17.renameSync(tmp, file);
-    try {
-      fs17.chmodSync(file, 384);
-    } catch {
-    }
-  }
-  dirPath() {
-    return path19.join(this.dataDir, INBOX_SUBDIR);
-  }
-  filePath(capabilityId) {
-    return path19.join(this.dirPath(), `${capabilityId}.jsonl`);
-  }
-};
-function parseAllLines(raw) {
-  const out = [];
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(trimmed);
-    } catch {
-      continue;
+  upsert(scope, sessionId, input, now = Date.now()) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === input.relPath);
+    let next;
+    if (idx >= 0) {
+      const prev = entries[idx];
+      next = {
+        ...prev,
+        size: input.size,
+        mime: input.mime,
+        lastEditedAt: now,
+        stale: false
+        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
+      };
+      entries[idx] = next;
+    } else {
+      next = {
+        id: `gf-${import_node_crypto4.default.randomBytes(6).toString("base64url")}`,
+        relPath: input.relPath,
+        from: input.from,
+        label: input.label,
+        size: input.size,
+        mime: input.mime,
+        addedAt: now
+        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
+      };
+      entries.push(next);
     }
-    const r = InboxMessageSchema.safeParse(parsed);
-    if (r.success) out.push(r.data);
-  }
-  return out;
-}
-
-// src/inbox/inbox-manager.ts
-var crypto6 = __toESM(require("crypto"), 1);
-var InboxManager = class {
-  constructor(store, broadcast, opts = {}) {
-    this.store = store;
-    this.broadcast = broadcast;
-    this.now = opts.now ?? Date.now;
-    this.genId = opts.genId ?? defaultGenId;
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
+    return next;
   }
-  store;
-  broadcast;
-  now;
-  genId;
   /**
-   * 写入一条消息到 channel + broadcast 给该 channel 两端 ws.
-   * caller 必须已通过 handler 鉴权 (guest ctx.capabilityId === args.capabilityId, 否则拦截).
+   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
+   * - 命中 → stale=true，UI 灰显
+   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
+   *
+   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
    */
-  postMessage(args) {
-    const msg = {
-      id: this.genId(),
-      capabilityId: args.capabilityId,
-      senderPrincipalId: args.senderPrincipalId,
-      text: args.text,
-      createdAt: this.now(),
-      readBy: {}
-    };
-    this.store.append(msg);
-    this.broadcast(args.capabilityId, { type: "inbox:event", message: msg });
-    return msg;
-  }
-  list(capabilityId, sinceCreatedAt) {
-    return this.store.list(capabilityId, sinceCreatedAt);
+  markStale(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return;
+    if (entries[idx].stale) return;
+    entries[idx] = { ...entries[idx], stale: true };
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
   }
   /**
-   * 标已读. 返写入了几条 (sender !== self 且 createdAt <= upToCreatedAt 的消息).
-   * broadcast 已更新 readBy 的每条消息 (单帧一消息, 复用 inbox:event 通道),
-   * 让对端 UI 实时看到 "对方已读到哪了".
+   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
+   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
+   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
+   *
+   * 返回值：true=命中并删除；false=relPath 不在群里。
    */
-  markRead(args) {
-    const before = this.store.list(args.capabilityId);
-    const changed = this.store.markRead(args.capabilityId, args.principalId, args.upToCreatedAt);
-    if (changed === 0) return 0;
-    const after = this.store.list(args.capabilityId);
-    const beforeById = new Map(before.map((m2) => [m2.id, m2]));
-    for (const m2 of after) {
-      const prev = beforeById.get(m2.id);
-      if (!prev) continue;
-      if (prev.readBy[args.principalId] === m2.readBy[args.principalId]) continue;
-      this.broadcast(args.capabilityId, { type: "inbox:event", message: m2 });
-    }
-    return changed;
-  }
-  /** capability:delete cascade. 删整个 channel 文件. */
-  removeChannel(capabilityId) {
-    this.store.removeByCapabilityId(capabilityId);
-  }
-};
-function defaultGenId() {
-  return "m_" + crypto6.randomBytes(6).toString("base64url");
-}
-
-// src/remote-persona/store.ts
-var fs18 = __toESM(require("fs"), 1);
-var path20 = __toESM(require("path"), 1);
-var REMOTE_PERSONAS_DIR = "remote-personas";
-var RemotePersonaStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    fs18.mkdirSync(this.rootDir(), { recursive: true });
-  }
-  dataDir;
-  list() {
-    let entries;
-    try {
-      entries = fs18.readdirSync(this.rootDir());
-    } catch (err) {
-      if (err?.code === "ENOENT") return [];
-      return [];
-    }
-    const out = [];
-    for (const name of entries) {
-      if (!name.endsWith(".json")) continue;
-      if (name.includes(".tmp-")) continue;
-      const file = path20.join(this.rootDir(), name);
-      let raw;
-      try {
-        raw = fs18.readFileSync(file, "utf8");
-      } catch {
-        continue;
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(raw);
-      } catch {
-        continue;
-      }
-      const r = RemotePersonaSchema.safeParse(parsed);
-      if (r.success) out.push(r.data);
-    }
-    return out.sort((a, b2) => a.addedAt > b2.addedAt ? -1 : a.addedAt < b2.addedAt ? 1 : 0);
-  }
-  get(alias) {
-    const file = this.filePath(alias);
-    let raw;
-    try {
-      raw = fs18.readFileSync(file, "utf8");
-    } catch {
-      return null;
-    }
-    try {
-      const parsed = JSON.parse(raw);
-      const r = RemotePersonaSchema.safeParse(parsed);
-      return r.success ? r.data : null;
-    } catch {
-      return null;
-    }
-  }
-  add(rp) {
-    const file = this.filePath(rp.alias);
-    if (fs18.existsSync(file)) {
-      throw new Error(`RemotePersonaStore.add: alias already exists: ${rp.alias}`);
-    }
-    this.atomicWrite(file, rp);
-  }
-  remove(alias) {
-    const file = this.filePath(alias);
-    try {
-      fs18.unlinkSync(file);
-      return true;
-    } catch (err) {
-      if (err?.code === "ENOENT") return false;
-      throw err;
-    }
+  remove(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return false;
+    entries.splice(idx, 1);
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
+    return true;
   }
   /**
-   * patch lastConnectedAt (v2 outgoing client 连上时更新). 其他字段不动.
-   * 不存在 alias → no-op.
+   * 跨 session 聚合查询（spec §4 HTTP ACL：personal 视野并集）。
+   *
+   * 扫 <dataDir>/sessions/<personaId>/owner/*.group-files.json 和
+   * <dataDir>/sessions/<personaId>/listener/*.group-files.json，每文件读一份。
+   *
+   * 复杂度 O(N sessions × N entries)，N 通常 < 100，可接受。
    */
-  updateLastConnectedAt(alias, at) {
-    const cur = this.get(alias);
-    if (!cur) return;
-    this.atomicWrite(this.filePath(alias), { ...cur, lastConnectedAt: at });
-  }
-  rootDir() {
-    return path20.join(this.dataDir, REMOTE_PERSONAS_DIR);
-  }
-  filePath(alias) {
-    return path20.join(this.rootDir(), `${safeFileName(alias)}.json`);
-  }
-  atomicWrite(file, content) {
-    fs18.mkdirSync(this.rootDir(), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    fs18.writeFileSync(tmp, JSON.stringify(content, null, 2), { mode: 384 });
-    fs18.renameSync(tmp, file);
-    try {
-      fs18.chmodSync(file, 384);
-    } catch {
-    }
-  }
-};
-
-// src/person/store.ts
-var fs19 = __toESM(require("fs"), 1);
-var path21 = __toESM(require("path"), 1);
-var PERSONS_DIR = "persons";
-var PersonStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    fs19.mkdirSync(this.rootDir(), { recursive: true });
-  }
-  dataDir;
-  list() {
-    let entries;
-    try {
-      entries = fs19.readdirSync(this.rootDir());
-    } catch (err) {
-      if (err?.code === "ENOENT") return [];
-      return [];
-    }
+  listByPersona(personaId) {
     const out = [];
-    for (const name of entries) {
-      if (!name.endsWith(".json")) continue;
-      if (name.includes(".tmp-")) continue;
-      const file = path21.join(this.rootDir(), name);
-      let raw;
+    for (const mode of ["owner", "listener"]) {
+      const scope = { kind: "persona", personaId, mode };
+      const root = this.rootForScope(scope);
+      let names;
       try {
-        raw = fs19.readFileSync(file, "utf8");
-      } catch {
+        names = import_node_fs13.default.readdirSync(root);
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") continue;
         continue;
       }
-      let parsed;
-      try {
-        parsed = JSON.parse(raw);
-      } catch {
-        continue;
+      for (const name of names) {
+        if (!name.endsWith(".group-files.json")) continue;
+        const sessionId = name.slice(0, -".group-files.json".length);
+        if (!sessionId) continue;
+        const entries = this.list(scope, sessionId);
+        out.push({ sessionId, entries });
       }
-      const r = PersonSchema.safeParse(parsed);
-      if (r.success) out.push(r.data);
-    }
-    return out.sort((a, b2) => a.updatedAt > b2.updatedAt ? -1 : a.updatedAt < b2.updatedAt ? 1 : 0);
-  }
-  get(id) {
-    const file = this.filePath(id);
-    let raw;
-    try {
-      raw = fs19.readFileSync(file, "utf8");
-    } catch {
-      return null;
-    }
-    try {
-      const parsed = JSON.parse(raw);
-      const r = PersonSchema.safeParse(parsed);
-      return r.success ? r.data : null;
-    } catch {
-      return null;
-    }
-  }
-  add(person) {
-    const file = this.filePath(person.id);
-    if (fs19.existsSync(file)) {
-      throw new Error(`PersonStore.add: person id already exists: ${person.id}`);
-    }
-    this.atomicWrite(file, person);
-  }
-  /**
-   * Merge patch into existing person + bump updatedAt to `now`.
-   * 不存在 id → no-op（caller 应预先 get 校验）。
-   * 只允许 patch displayName / notes / dmEnabled（id / createdAt 不可改）。
-   */
-  update(id, patch, now) {
-    const cur = this.get(id);
-    if (!cur) return;
-    const next = {
-      ...cur,
-      ...patch.displayName !== void 0 ? { displayName: patch.displayName } : {},
-      ...patch.notes !== void 0 ? { notes: patch.notes } : {},
-      ...patch.dmEnabled !== void 0 ? { dmEnabled: patch.dmEnabled } : {},
-      updatedAt: now
-    };
-    this.atomicWrite(this.filePath(id), next);
-  }
-  remove(id) {
-    const file = this.filePath(id);
-    try {
-      fs19.unlinkSync(file);
-      return true;
-    } catch (err) {
-      if (err?.code === "ENOENT") return false;
-      throw err;
-    }
-  }
-  rootDir() {
-    return path21.join(this.dataDir, PERSONS_DIR);
-  }
-  filePath(id) {
-    return path21.join(this.rootDir(), `${safeFileName(id)}.json`);
-  }
-  atomicWrite(file, content) {
-    fs19.mkdirSync(this.rootDir(), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    fs19.writeFileSync(tmp, JSON.stringify(content, null, 2), { mode: 384 });
-    fs19.renameSync(tmp, file);
-    try {
-      fs19.chmodSync(file, 384);
-    } catch {
     }
+    return out;
   }
 };
-
-// src/migrations/2026-05-20-flatten-sessions.ts
-var fs20 = __toESM(require("fs"), 1);
-var path22 = __toESM(require("path"), 1);
-var MIGRATION_FLAG_NAME = ".migration.v1.done";
-function migrateFlattenSessions(opts) {
-  const dataDir = opts.dataDir;
-  const now = opts.now ?? Date.now;
-  const sessionsDir = path22.join(dataDir, "sessions");
-  const flagPath = path22.join(sessionsDir, MIGRATION_FLAG_NAME);
-  if (existsSync5(flagPath)) {
-    return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
-  }
-  let movedBare = 0;
-  let movedVmOwner = 0;
-  let archivedListener = 0;
-  const defaultDir = path22.join(sessionsDir, "default");
-  if (existsSync5(defaultDir)) {
-    for (const entry of readdirSafe(defaultDir)) {
-      if (!entry.endsWith(".json")) continue;
-      const src = path22.join(defaultDir, entry);
-      const dst = path22.join(sessionsDir, entry);
-      fs20.renameSync(src, dst);
-      movedBare += 1;
-    }
-    rmdirIfEmpty(defaultDir);
-  }
-  for (const pid of readdirSafe(sessionsDir)) {
-    const personaDir = path22.join(sessionsDir, pid);
-    if (!isDir(personaDir)) continue;
-    if (pid === "default") continue;
-    const ownerSrc = path22.join(personaDir, "owner");
-    if (existsSync5(ownerSrc) && isDir(ownerSrc)) {
-      const ownerDst = path22.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
-      fs20.mkdirSync(ownerDst, { recursive: true });
-      for (const file of readdirSafe(ownerSrc)) {
-        if (!file.endsWith(".json")) continue;
-        fs20.renameSync(path22.join(ownerSrc, file), path22.join(ownerDst, file));
-        movedVmOwner += 1;
-      }
-      rmdirIfEmpty(ownerSrc);
-    }
-    const listenerSrc = path22.join(personaDir, "listener");
-    if (existsSync5(listenerSrc) && isDir(listenerSrc)) {
-      const archiveDst = path22.join(dataDir, ".legacy", `listener-${pid}`);
-      fs20.mkdirSync(archiveDst, { recursive: true });
-      for (const file of readdirSafe(listenerSrc)) {
-        if (!file.endsWith(".json")) continue;
-        fs20.renameSync(path22.join(listenerSrc, file), path22.join(archiveDst, file));
-        archivedListener += 1;
-      }
-      rmdirIfEmpty(listenerSrc);
-    }
-    rmdirIfEmpty(personaDir);
-  }
-  fs20.mkdirSync(sessionsDir, { recursive: true });
-  fs20.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
-  return {
-    skipped: false,
-    flagWritten: true,
-    movedBare,
-    movedVmOwner,
-    archivedListener
-  };
-}
-function existsSync5(p2) {
-  try {
-    fs20.statSync(p2);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isDir(p2) {
-  try {
-    return fs20.statSync(p2).isDirectory();
-  } catch {
+function personalViewable(groupStore, personaDir, personaId, absPath) {
+  const realTarget = safeRealpath(absPath);
+  if (!realTarget) {
     return false;
   }
-}
-function readdirSafe(p2) {
-  try {
-    return fs20.readdirSync(p2);
-  } catch {
-    return [];
+  const personasUnion = groupStore.listByPersona(personaId);
+  for (const { entries } of personasUnion) {
+    for (const e of entries) {
+      if (e.stale) continue;
+      const realEntry = safeRealpath(import_node_path14.default.join(personaDir, e.relPath));
+      if (realEntry && realEntry === realTarget) return true;
+    }
   }
+  return false;
 }
-function rmdirIfEmpty(p2) {
+function safeRealpath(p2) {
   try {
-    fs20.rmdirSync(p2);
+    return import_node_fs13.default.realpathSync(p2);
   } catch {
+    return null;
   }
 }
 
-// src/transport/http-router.ts
-var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path15 = __toESM(require("path"), 1);
-
 // src/attachment/mime.ts
-var import_node_path14 = __toESM(require("path"), 1);
+var import_node_path15 = __toESM(require("path"), 1);
 var TEXT_PLAIN = "text/plain; charset=utf-8";
 var EXT_TO_NATIVE_MIME = {
   // 图片
@@ -26907,14 +26003,14 @@ var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mk"
 ]);
 function lookupMime(filePathOrName) {
-  const ext = import_node_path14.default.extname(filePathOrName).toLowerCase();
+  const ext = import_node_path15.default.extname(filePathOrName).toLowerCase();
   if (EXT_TO_NATIVE_MIME[ext]) return EXT_TO_NATIVE_MIME[ext];
   if (TEXT_EXTENSIONS.has(ext)) return TEXT_PLAIN;
   return "application/octet-stream";
 }
 
 // src/attachment/sign-url.ts
-var import_node_crypto4 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 var HMAC_ALGO = "sha256";
 function base64urlEncode(buf) {
   const b2 = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
@@ -26931,7 +26027,7 @@ function decodeAbsPathFromUrl(encoded) {
 }
 function computeSig(secret, absPath, e) {
   const msg = e === null ? absPath : `${absPath}|${e}`;
-  return import_node_crypto4.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
+  return import_node_crypto5.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
 }
 function signUrlParts(secret, absPath, ttlSeconds, now = Date.now) {
   const e = ttlSeconds === null ? null : Math.floor(now() / 1e3) + ttlSeconds;
@@ -26966,7 +26062,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
   if (provided.length !== expected.length) {
     return { ok: false, code: "BAD_SIG" };
   }
-  if (!import_node_crypto4.default.timingSafeEqual(provided, expected)) {
+  if (!import_node_crypto5.default.timingSafeEqual(provided, expected)) {
     return { ok: false, code: "BAD_SIG" };
   }
   if (e !== null && now() / 1e3 > e) {
@@ -26987,7 +26083,7 @@ function createHttpRouter(deps) {
       sendJson(res, 200, { ok: true, version: deps.daemonVersion });
       return true;
     }
-    if (!url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
+    if (!url.pathname.startsWith("/persona/") && !url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
       return false;
     }
     if (url.pathname.startsWith("/files/") && req.method === "GET") {
@@ -27027,8 +26123,43 @@ function createHttpRouter(deps) {
       sendJson(res, 401, { code: "UNAUTHORIZED", message: "missing or invalid bearer token" });
       return true;
     }
+    const personaFilesMatch = url.pathname.match(/^\/persona\/([^/]+)\/files$/);
+    if (personaFilesMatch && req.method === "GET") {
+      const pid = personaFilesMatch[1];
+      const pathParam = url.searchParams.get("path");
+      if (!pathParam) {
+        sendJson(res, 400, { code: "INVALID_PARAM", message: "missing `path` query" });
+        return true;
+      }
+      if (!deps.personaStore || !deps.groupFileStore) {
+        sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "files endpoint not wired" }));
+        return true;
+      }
+      const personaDir = deps.personaStore.personaDirPath(pid);
+      const absPath = import_node_path16.default.isAbsolute(pathParam) ? pathParam : import_node_path16.default.join(personaDir, pathParam);
+      if (!import_node_path16.default.isAbsolute(pathParam) && !isContainedIn(absPath, personaDir)) {
+        sendJson(res, 400, { code: "PATH_TRAVERSAL", message: "rel path escapes personaDir" });
+        return true;
+      }
+      if (ctx.role === "personal") {
+        if (ctx.personaId !== pid) {
+          sendJson(res, 403, { code: "FORBIDDEN", message: "personal token bound to other persona" });
+          return true;
+        }
+        if (!personalViewable(deps.groupFileStore, personaDir, pid, absPath)) {
+          sendJson(res, 403, { code: "FORBIDDEN", message: "path not in personal viewable scope" });
+          return true;
+        }
+      }
+      streamFile(res, absPath, deps.logger);
+      return true;
+    }
     const sessionFilesMatch = url.pathname.match(/^\/session\/([^/]+)\/files$/);
     if (sessionFilesMatch && req.method === "GET") {
+      if (ctx.role !== "owner") {
+        sendJson(res, 403, { code: "FORBIDDEN", message: "direct session files are owner-only" });
+        return true;
+      }
       const sid = sessionFilesMatch[1];
       const pathParam = url.searchParams.get("path");
       if (!pathParam) {
@@ -27036,7 +26167,7 @@ function createHttpRouter(deps) {
         return true;
       }
       let absPath;
-      if (import_node_path15.default.isAbsolute(pathParam)) {
+      if (import_node_path16.default.isAbsolute(pathParam)) {
         absPath = pathParam;
       } else if (deps.sessionStore) {
         const file = deps.sessionStore.read(sid);
@@ -27044,7 +26175,7 @@ function createHttpRouter(deps) {
           sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sid} not found` });
           return true;
         }
-        absPath = import_node_path15.default.join(file.cwd, pathParam);
+        absPath = import_node_path16.default.join(file.cwd, pathParam);
       } else {
         sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "sessionStore not wired" }));
         return true;
@@ -27069,12 +26200,18 @@ function sendJson(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function withCtx(ctx, body) {
-  return { ...body, role: ctx.role };
+  return { ...body, role: ctx.role, personaId: ctx.personaId };
+}
+function isContainedIn(abs, root) {
+  const normalized = import_node_path16.default.resolve(abs);
+  const normalizedRoot = import_node_path16.default.resolve(root);
+  if (normalized === normalizedRoot) return true;
+  return normalized.startsWith(normalizedRoot + import_node_path16.default.sep);
 }
 function streamFile(res, absPath, logger) {
   let stat;
   try {
-    stat = import_node_fs13.default.statSync(absPath);
+    stat = import_node_fs14.default.statSync(absPath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -27089,7 +26226,7 @@ function streamFile(res, absPath, logger) {
     return;
   }
   const mime = lookupMime(absPath);
-  const basename = import_node_path15.default.basename(absPath);
+  const basename = import_node_path16.default.basename(absPath);
   res.writeHead(200, {
     "Content-Type": mime,
     "Content-Length": String(stat.size),
@@ -27097,154 +26234,13 @@ function streamFile(res, absPath, logger) {
     // 防止浏览器把任意 mime 当 html 渲染
     "X-Content-Type-Options": "nosniff"
   });
-  const stream = import_node_fs13.default.createReadStream(absPath);
+  const stream = import_node_fs14.default.createReadStream(absPath);
   stream.on("error", (err) => {
-    logger?.warn("streamFile read error", { absPath, err: err.message });
-    res.destroy();
-  });
-  stream.pipe(res);
-}
-
-// src/attachment/group.ts
-var import_node_fs14 = __toESM(require("fs"), 1);
-var import_node_path16 = __toESM(require("path"), 1);
-var import_node_crypto5 = __toESM(require("crypto"), 1);
-init_protocol();
-var GroupFileStore = class {
-  dataDir;
-  logger;
-  cache = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.dataDir = opts.dataDir;
-    this.logger = opts.logger;
-  }
-  rootForScope(scope) {
-    return import_node_path16.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
-  }
-  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
-  filePath(scope, sessionId) {
-    return import_node_path16.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
-  }
-  cacheKey(scope, sessionId) {
-    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
-  }
-  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
-  readFile(scope, sessionId) {
-    const file = this.filePath(scope, sessionId);
-    try {
-      const raw = import_node_fs14.default.readFileSync(file, "utf8");
-      const parsed = JSON.parse(raw);
-      if (!Array.isArray(parsed)) {
-        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
-          file
-        });
-        return [];
-      }
-      const out = [];
-      for (const entry of parsed) {
-        const r = GroupFileEntrySchema.safeParse(entry);
-        if (r.success) out.push(r.data);
-      }
-      return out;
-    } catch (err) {
-      const code = err?.code;
-      if (code === "ENOENT") return [];
-      this.logger?.warn("GroupFileStore.readFile failed", {
-        file,
-        err: err.message
-      });
-      return [];
-    }
-  }
-  writeFile(scope, sessionId, entries) {
-    const file = this.filePath(scope, sessionId);
-    import_node_fs14.default.mkdirSync(import_node_path16.default.dirname(file), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-    import_node_fs14.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
-    import_node_fs14.default.renameSync(tmp, file);
-  }
-  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
-  list(scope, sessionId) {
-    const key = this.cacheKey(scope, sessionId);
-    const cached = this.cache.get(key);
-    if (cached) return cached.entries;
-    const entries = this.readFile(scope, sessionId);
-    this.cache.set(key, { entries });
-    return entries;
-  }
-  /**
-   * upsert：
-   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
-   *     （保留首次入群人 / 入群时刻）
-   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
-   *
-   * 返回最新 entry（caller 可用来 broadcast 通知）。
-   */
-  upsert(scope, sessionId, input, now = Date.now()) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === input.relPath);
-    let next;
-    if (idx >= 0) {
-      const prev = entries[idx];
-      next = {
-        ...prev,
-        size: input.size,
-        mime: input.mime,
-        lastEditedAt: now,
-        stale: false
-        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
-      };
-      entries[idx] = next;
-    } else {
-      next = {
-        id: `gf-${import_node_crypto5.default.randomBytes(6).toString("base64url")}`,
-        relPath: input.relPath,
-        from: input.from,
-        label: input.label,
-        size: input.size,
-        mime: input.mime,
-        addedAt: now
-        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
-      };
-      entries.push(next);
-    }
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries });
-    return next;
-  }
-  /**
-   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
-   * - 命中 → stale=true，UI 灰显
-   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
-   *
-   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
-   */
-  markStale(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return;
-    if (entries[idx].stale) return;
-    entries[idx] = { ...entries[idx], stale: true };
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries });
-  }
-  /**
-   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
-   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
-   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
-   *
-   * 返回值：true=命中并删除；false=relPath 不在群里。
-   */
-  remove(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return false;
-    entries.splice(idx, 1);
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries });
-    return true;
-  }
-};
+    logger?.warn("streamFile read error", { absPath, err: err.message });
+    res.destroy();
+  });
+  stream.pipe(res);
+}
 
 // src/discovery/state-file.ts
 var import_node_fs15 = __toESM(require("fs"), 1);
@@ -27922,44 +26918,39 @@ var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
   return import_node_path22.default.join(dataDir, AUTH_FILE_NAME);
 }
-function loadOrCreateAuth(opts) {
+function loadOrCreateAuthFile(opts) {
   const file = authFilePath(opts.dataDir);
+  const generate = opts.generate ?? defaultGenerate;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const existing = readAuthFile(file);
-  const genToken = opts.generate ?? defaultGenerateToken2;
-  const genId = opts.genOwnerPrincipalId ?? defaultGenerateOwnerPrincipalId;
-  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
-  if (existing) {
-    if (!existing.ownerPrincipalId) {
-      const ownerPrincipalId2 = genId();
-      writeAuthFile(file, {
-        token: existing.token,
-        ownerPrincipalId: ownerPrincipalId2,
-        createdAt: existing.createdAt
-      });
-      return { token: existing.token, ownerPrincipalId: ownerPrincipalId2 };
-    }
-    return { token: existing.token, ownerPrincipalId: existing.ownerPrincipalId };
+  if (existing && existing.token && existing.signSecret) {
+    return {
+      token: existing.token,
+      signSecret: existing.signSecret,
+      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
+    };
   }
-  const token = genToken();
-  const ownerPrincipalId = genId();
-  writeAuthFile(file, { token, ownerPrincipalId, createdAt: now.toISOString() });
-  return { token, ownerPrincipalId };
+  const token = existing?.token || generate();
+  const signSecret = existing?.signSecret || generate();
+  const createdAt = existing?.createdAt || now().toISOString();
+  const next = { token, signSecret, createdAt };
+  writeAuthFile(file, next);
+  return next;
 }
-function defaultGenerateToken2() {
+function defaultGenerate() {
   return import_node_crypto8.default.randomBytes(32).toString("base64url");
 }
-function defaultGenerateOwnerPrincipalId() {
-  return `owner-${import_node_crypto8.default.randomUUID()}`;
-}
 function readAuthFile(file) {
   try {
     const raw = import_node_fs20.default.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
-    if (typeof parsed?.token !== "string" || parsed.token.length === 0) return null;
+    if (typeof parsed?.token !== "string" || parsed.token.length === 0) {
+      return null;
+    }
     return {
       token: parsed.token,
-      ownerPrincipalId: typeof parsed.ownerPrincipalId === "string" && parsed.ownerPrincipalId.length > 0 ? parsed.ownerPrincipalId : "",
-      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date(0)).toISOString()
+      signSecret: typeof parsed.signSecret === "string" && parsed.signSecret.length > 0 ? parsed.signSecret : void 0,
+      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0
     };
   } catch (err) {
     const code = err?.code;
@@ -28072,62 +27063,10 @@ function forkSession(input) {
   return { forkedToolSessionId, forkedFilePath };
 }
 
-// src/permission/capability.ts
-function matchResource(grant, target) {
-  if (grant.type === "*") return true;
-  if (grant.type !== target.type) return false;
-  return grant.id === target.id;
-}
-function assertGrant(grants, resource, action) {
-  for (const g2 of grants) {
-    if (!matchResource(g2.resource, resource)) continue;
-    if (g2.actions.includes(action)) return true;
-    if (g2.actions.includes("admin")) return true;
-  }
-  return false;
-}
-
-// src/permission/session-access.ts
-function canAccessSession(ctx, sessionId, action, deps) {
-  if (ctx.principal.kind === "owner") return true;
-  const file = deps.readSession(sessionId);
-  if (!file) return true;
-  return canAccessPersona(ctx.grants, file.ownerPersonaId, action);
-}
-function canAccessPersona(grants, personaId, action) {
-  if (!personaId) return false;
-  const resource = { type: "persona", id: personaId };
-  return assertGrant(grants, resource, action);
-}
-
 // src/handlers/session.ts
-init_protocol();
 function buildSessionHandlers(deps) {
-  const { manager, observer, getAdapter: getAdapter2, store } = deps;
-  const ensureSessionAccess = (ctx, sessionId, action) => {
-    if (!ctx) return;
-    const ok = canAccessSession(ctx, sessionId, action, {
-      readSession: (sid) => store.read(sid)
-    });
-    if (!ok) {
-      throw new ClawdError(
-        ERROR_CODES.UNAUTHORIZED,
-        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} session ${sessionId}`
-      );
-    }
-  };
-  const ensurePersonaAccess = (ctx, personaId, action) => {
-    if (!ctx) return;
-    if (ctx.principal.kind === "owner") return;
-    const ok = canAccessPersona(ctx.grants, personaId, action);
-    if (!ok) {
-      throw new ClawdError(
-        ERROR_CODES.UNAUTHORIZED,
-        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} on persona:${personaId ?? "<none>"}`
-      );
-    }
-  };
-  const create = async (frame, _client, ctx) => {
+  const { manager, observer, getAdapter: getAdapter2 } = deps;
+  const create = async (frame) => {
     const args = SessionCreateArgs.parse(frame);
     if (args.ownerPersonaId) {
       const persona = deps.personaRegistry.get(args.ownerPersonaId);
@@ -28135,84 +27074,58 @@ function buildSessionHandlers(deps) {
         throw new Error(`persona not found: ${args.ownerPersonaId}`);
       }
     }
-    ensurePersonaAccess(ctx, args.ownerPersonaId, "send");
-    let creatorPrincipalId = "";
-    if (ctx) {
-      if (ctx.principal.kind === "guest" && ctx.capabilityId && deps.capabilityManager) {
-        const cap = deps.capabilityManager.findById(ctx.capabilityId);
-        creatorPrincipalId = cap?.personId ?? ctx.principal.id;
-      } else {
-        creatorPrincipalId = ctx.principal.id;
-      }
-    }
-    const { response, broadcast } = manager.create(args, creatorPrincipalId);
+    const { response, broadcast } = manager.create(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const list = async (_frame, _client, ctx) => {
+  const list = async () => {
     const { response } = manager.list();
-    if (ctx && ctx.principal.kind === "guest") {
-      const sessions = response.sessions ?? [];
-      const filtered = sessions.filter(
-        (s) => canAccessPersona(ctx.grants, s.ownerPersonaId, "read")
-      );
-      return { response: { type: "session:list", sessions: filtered } };
-    }
     return { response: { type: "session:list", ...response } };
   };
-  const get = async (frame, _client, ctx) => {
+  const get = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.get(args);
     return { response: { type: "session:info", ...response } };
   };
-  const update = async (frame, _client, ctx) => {
+  const update = async (frame) => {
     const args = SessionUpdateArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.update(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const del = async (frame, _client, ctx) => {
+  const del = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.delete(args);
     return {
       response: { type: "session:deleted", sessionId: args.sessionId },
       broadcast
     };
   };
-  const send = async (frame, _client, ctx) => {
+  const send = async (frame) => {
     const args = SessionSendArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.send(args);
     return { response: { type: "session:send", ok: true }, broadcast };
   };
-  const stop = async (frame, _client, ctx) => {
+  const stop = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.stop(args);
     return { response: { type: "session:stop", ok: true }, broadcast };
   };
-  const interrupt = async (frame, _client, ctx) => {
+  const interrupt = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.interrupt(args);
     return { response: { type: "session:interrupt", ok: true }, broadcast };
   };
-  const rewind = async (frame, _client, ctx) => {
+  const rewind = async (frame) => {
     const args = SessionRewindArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.rewind(args);
     return { response: { type: "session:rewind", ...response }, broadcast };
   };
-  const rewindDiff = async (frame, _client, ctx) => {
+  const rewindDiff = async (frame) => {
     const args = SessionRewindDiffArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = await manager.rewindDiff(args);
     return { response: { type: "session:rewind-diff", ...response } };
   };
-  const rewindableMessageIds = async (frame, _client, ctx) => {
+  const rewindableMessageIds = async (frame) => {
     const args = SessionRewindableMessageIdsArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.rewindableMessageIds(args);
     return {
       response: { type: "session:rewindable-message-ids", ...response }
@@ -28223,22 +27136,19 @@ function buildSessionHandlers(deps) {
     const result = forkSession(args);
     return { response: { type: "session:fork", ...result } };
   };
-  const newSession = async (frame, _client, ctx) => {
+  const newSession = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     observer.stop(args.sessionId);
     const { response, broadcast } = manager.newSession(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const resume = async (frame, _client, ctx) => {
+  const resume = async (frame) => {
     const args = SessionResumeArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.resume(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const observe = async (frame, _client, ctx) => {
+  const observe = async (frame) => {
     const args = SessionObserveArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response: file } = manager.get({ sessionId: args.sessionId });
     const sessionFile = file;
     manager.ensureSession(sessionFile);
@@ -28252,17 +27162,14 @@ function buildSessionHandlers(deps) {
     });
     return { response: { type: "session:observe", ok: true } };
   };
-  const events = async (frame, _client, ctx) => {
+  const events = async (frame) => {
     const args = SessionEventsArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.getEvents(args);
     return { response: { type: "session:events", ...response } };
   };
-  const subscribe = async (frame, client, ctx) => {
-    if (typeof frame.sessionId === "string") {
-      ensureSessionAccess(ctx, frame.sessionId, "read");
+  const subscribe = async (frame, client) => {
+    if (typeof frame.sessionId === "string")
       addSubscription(client, frame.sessionId);
-    }
     return {
       response: { type: "subscribed", sessionId: frame.sessionId }
     };
@@ -28274,9 +27181,8 @@ function buildSessionHandlers(deps) {
       response: { type: "unsubscribed", sessionId: frame.sessionId }
     };
   };
-  const pin = async (frame, _client, ctx) => {
+  const pin = async (frame) => {
     const args = SessionPinArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.pin(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
@@ -28285,15 +27191,13 @@ function buildSessionHandlers(deps) {
     const { response, broadcast } = manager.reorderPins(args);
     return { response: { type: "session:reorderPins", ...response }, broadcast };
   };
-  const answerQuestion = async (frame, _client, ctx) => {
+  const answerQuestion = async (frame) => {
     const args = AnswerQuestionArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.answerQuestion(args);
     return { response: { type: "session:answerQuestion", ...response }, broadcast };
   };
-  const cancelQuestion = async (frame, _client, ctx) => {
+  const cancelQuestion = async (frame) => {
     const args = CancelQuestionArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.cancelQuestion(args);
     return { response: { type: "session:cancelQuestion", ...response }, broadcast };
   };
@@ -28591,282 +27495,6 @@ function buildCapabilitiesHandlers(deps) {
   };
 }
 
-// src/handlers/capability.ts
-init_zod();
-init_protocol();
-var DeleteArgsSchema = external_exports.object({
-  capabilityId: external_exports.string().min(1)
-}).strict();
-function buildCapabilityHandlers(deps) {
-  const { manager, getShareBaseUrl, personStore } = deps;
-  const issue = async (frame) => {
-    const { type: _type, requestId: _requestId, ...rest } = frame;
-    const args = CapabilityIssueArgsSchema.parse(rest);
-    if (!personStore.get(args.personId)) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `Person not found: ${args.personId}`
-      );
-    }
-    const existing = manager.findByPerson(args.personId);
-    if (existing) {
-      const updated = manager.addGrantsToPerson(args.personId, args.grants);
-      if (!updated) {
-        throw new ClawdError(ERROR_CODES.INTERNAL, "addGrantsToPerson returned null");
-      }
-      return {
-        response: {
-          type: "capability:issued",
-          token: "__merged__",
-          shareUrl: "",
-          capability: stripSecretHash(updated)
-        }
-      };
-    }
-    const { personId, ...managerArgs } = args;
-    const { token, capability } = manager.issue({
-      ...managerArgs,
-      personId
-    });
-    const base = getShareBaseUrl().replace(/\/$/, "");
-    const shareUrl = `${base}/?token=${encodeURIComponent(token)}`;
-    return {
-      response: {
-        type: "capability:issued",
-        token,
-        shareUrl,
-        capability: stripSecretHash(capability)
-      }
-    };
-  };
-  const list = async () => {
-    return {
-      response: {
-        type: "capability:list",
-        capabilities: manager.list().map(stripSecretHash)
-      }
-    };
-  };
-  const del = async (frame) => {
-    const { type: _type, requestId: _requestId, ...rest } = frame;
-    const args = DeleteArgsSchema.parse(rest);
-    const result = manager.delete(args.capabilityId);
-    if (!result) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `capability not found: ${args.capabilityId}`
-      );
-    }
-    return {
-      response: {
-        type: "capability:deleted",
-        capabilityId: args.capabilityId
-      }
-    };
-  };
-  return {
-    "capability:issue": issue,
-    "capability:list": list,
-    "capability:delete": del
-  };
-}
-
-// src/handlers/inbox.ts
-init_protocol();
-function assertChannelAccess(ctx, capabilityId) {
-  if (ctx.principal.kind === "owner") return;
-  if (ctx.capabilityId === capabilityId) return;
-  throw new ClawdError(
-    ERROR_CODES.UNAUTHORIZED,
-    `inbox: guest can only access own channel (capabilityId=${capabilityId}, ctx.capabilityId=${ctx.capabilityId ?? "none"})`
-  );
-}
-function buildInboxHandlers(deps) {
-  const { manager, personStore, capabilityManager } = deps;
-  const postMessage = async (frame, _client, ctx) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = InboxPostMessageArgsSchema.parse(rest);
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:postMessage: missing ConnectionContext");
-    }
-    assertChannelAccess(ctx, args.capabilityId);
-    if (ctx.principal.kind === "guest" && ctx.capabilityId) {
-      const cap = capabilityManager.findById(ctx.capabilityId);
-      if (cap) {
-        const person = personStore.get(cap.personId);
-        if (person && !person.dmEnabled) {
-          throw new ClawdError(
-            ERROR_CODES.VALIDATION_ERROR,
-            `DM_BLOCKED: Person ${person.displayName} has DM disabled`
-          );
-        }
-      }
-    }
-    const message = manager.postMessage({
-      capabilityId: args.capabilityId,
-      senderPrincipalId: ctx.principal.id,
-      text: args.text
-    });
-    return {
-      response: { type: "inbox:postMessage:ok", message }
-    };
-  };
-  const list = async (frame, _client, ctx) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = InboxListArgsSchema.parse(rest);
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:list: missing ConnectionContext");
-    }
-    assertChannelAccess(ctx, args.capabilityId);
-    const messages = manager.list(args.capabilityId, args.sinceCreatedAt);
-    return {
-      response: { type: "inbox:list:ok", capabilityId: args.capabilityId, messages }
-    };
-  };
-  const markRead = async (frame, _client, ctx) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = InboxMarkReadArgsSchema.parse(rest);
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:markRead: missing ConnectionContext");
-    }
-    assertChannelAccess(ctx, args.capabilityId);
-    const updated = manager.markRead({
-      capabilityId: args.capabilityId,
-      principalId: ctx.principal.id,
-      upToCreatedAt: args.upToCreatedAt
-    });
-    return {
-      response: {
-        type: "inbox:markRead:ok",
-        capabilityId: args.capabilityId,
-        upToCreatedAt: args.upToCreatedAt,
-        updated
-      }
-    };
-  };
-  return {
-    "inbox:postMessage": postMessage,
-    "inbox:list": list,
-    "inbox:markRead": markRead
-  };
-}
-
-// src/handlers/remote-persona.ts
-init_protocol();
-function buildRemotePersonaHandlers(deps) {
-  const { store, personStore } = deps;
-  const now = deps.now ?? Date.now;
-  const add = async (frame) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = RemotePersonaAddArgsSchema.parse(rest);
-    if (!personStore.get(args.personId)) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `Person not found: ${args.personId}`
-      );
-    }
-    const rp = {
-      ...args,
-      addedAt: now()
-    };
-    try {
-      store.add(rp);
-    } catch (err) {
-      if (err.message?.includes("alias already exists")) {
-        throw new ClawdError(
-          ERROR_CODES.VALIDATION_ERROR,
-          `remote-persona alias already exists: ${args.alias}`
-        );
-      }
-      throw err;
-    }
-    return {
-      response: { type: "remote-persona:add:ok", remotePersona: stripRemotePersonaSecret(rp) }
-    };
-  };
-  const list = async (_frame, _client, ctx) => {
-    const all = store.list();
-    const projected = ctx?.principal.kind === "owner" ? all : all.map(stripRemotePersonaSecret);
-    return {
-      response: {
-        type: "remote-persona:list",
-        remotePersonas: projected
-      }
-    };
-  };
-  const remove = async (frame) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = RemotePersonaRemoveArgsSchema.parse(rest);
-    const removed = store.remove(args.alias);
-    return {
-      response: { type: "remote-persona:remove:ok", alias: args.alias, removed }
-    };
-  };
-  return {
-    "remote-persona:add": add,
-    "remote-persona:list": list,
-    "remote-persona:remove": remove
-  };
-}
-
-// src/handlers/whoami.ts
-init_protocol();
-function buildWhoamiHandler(deps) {
-  return async (_frame, _client, ctx) => {
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "whoami: missing ConnectionContext");
-    }
-    const owner = makeOwnerPrincipal(deps.ownerPrincipalId, deps.ownerDisplayName);
-    let capability;
-    if (ctx.principal.kind === "owner") {
-      capability = {
-        id: deps.ownerPrincipalId,
-        displayName: deps.ownerDisplayName,
-        grants: ctx.grants,
-        issuedAt: 0,
-        usedCount: 0,
-        // owner self cap 没有真实 Person 主人；用 ownerPrincipalId 自指，UI 不会反查这条
-        personId: deps.ownerPrincipalId
-      };
-    } else {
-      if (!ctx.capabilityId) {
-        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "whoami: guest ctx without capabilityId");
-      }
-      const cap = deps.capabilityManager.findById(ctx.capabilityId);
-      if (!cap) {
-        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, `whoami: capability not found: ${ctx.capabilityId}`);
-      }
-      capability = stripSecretHash(cap);
-    }
-    const grantedPersonas = [];
-    const isGuest = ctx.principal.kind === "guest";
-    const hasWildcard = capability.grants.some((g2) => g2.resource.type === "*");
-    if (hasWildcard) {
-      for (const id of deps.personaStore.list()) {
-        const file = deps.personaStore.read(id);
-        if (!file) continue;
-        if (isGuest && !file.public) continue;
-        grantedPersonas.push({ id: file.personaId, displayName: file.label });
-      }
-    } else {
-      for (const g2 of capability.grants) {
-        if (g2.resource.type !== "persona") continue;
-        const file = deps.personaStore.read(g2.resource.id);
-        if (!file) continue;
-        grantedPersonas.push({ id: file.personaId, displayName: file.label });
-      }
-    }
-    return {
-      response: {
-        type: "whoami:ok",
-        owner,
-        capability,
-        grantedPersonas
-      }
-    };
-  };
-}
-
 // src/handlers/meta.ts
 var import_node_os13 = __toESM(require("os"), 1);
 init_protocol();
@@ -28943,6 +27571,7 @@ function buildPersonaHandlers(deps) {
     }
     const personality = personaManager.readPersonality(args.personaId) ?? "";
     const skills = personaManager.listSkills(args.personaId);
+    const plugins = personaManager.listEnabledPlugins(args.personaId);
     const sandboxSettings = personaManager.readSandboxSettings(args.personaId);
     return {
       response: {
@@ -28950,6 +27579,7 @@ function buildPersonaHandlers(deps) {
         ...persona,
         personality,
         skills,
+        plugins,
         sandboxSettings
       }
     };
@@ -28968,129 +27598,31 @@ function buildPersonaHandlers(deps) {
       response: { type: "persona:deleted", personaId: args.personaId }
     };
   };
+  const issueToken = async (frame) => {
+    const args = PersonaIssueTokenArgsSchema.parse(frame);
+    const { token, persona } = personaManager.issueToken(args.personaId, args.label);
+    return {
+      response: { type: "persona:tokenIssued", token, persona }
+    };
+  };
+  const revokeToken = async (frame) => {
+    const args = PersonaRevokeTokenArgsSchema.parse(frame);
+    const persona = personaManager.revokeToken(args.personaId, args.token);
+    return { response: { type: "persona:info", ...persona } };
+  };
   return {
     "persona:create": create,
     "persona:list": list,
     "persona:get": get,
     "persona:update": update,
-    "persona:delete": del
+    "persona:delete": del,
+    "persona:issueToken": issueToken,
+    "persona:revokeToken": revokeToken
   };
 }
 
-// src/handlers/person.ts
-var import_node_crypto9 = require("crypto");
-init_protocol();
-
-// src/person/cascade.ts
-var EMPTY_RESULT = {
-  deletedCapabilityIds: [],
-  removedRemoteAliases: [],
-  deletedInboxEvents: 0
-};
-function cascadeDeletePerson(personId, deps) {
-  if (!deps.personStore.get(personId)) return { ...EMPTY_RESULT };
-  const allCaps = deps.capabilityManager.list();
-  const capsToDelete = allCaps.filter((c) => c.personId === personId);
-  let deletedInboxEvents = 0;
-  for (const c of capsToDelete) {
-    deletedInboxEvents += deps.inboxStore.list(c.id).length;
-  }
-  const deletedCapabilityIds = [];
-  for (const c of capsToDelete) {
-    if (deps.capabilityManager.delete(c.id) !== null) {
-      deletedCapabilityIds.push(c.id);
-    }
-  }
-  const allRemotes = deps.remotePersonaStore.list();
-  const remotesToRemove = allRemotes.filter((r) => r.personId === personId);
-  const removedRemoteAliases = [];
-  for (const r of remotesToRemove) {
-    if (deps.remotePersonaStore.remove(r.alias)) {
-      removedRemoteAliases.push(r.alias);
-    }
-  }
-  deps.personStore.remove(personId);
-  return { deletedCapabilityIds, removedRemoteAliases, deletedInboxEvents };
-}
-
-// src/handlers/person.ts
-function buildPersonHandlers(deps) {
-  const now = deps.now ?? Date.now;
-  const genId = deps.genId ?? defaultGenId2;
-  const list = async () => {
-    const persons = deps.personStore.list();
-    const allCaps = deps.capabilityManager.list();
-    const allRemotes = deps.remotePersonaStore.list();
-    const out = persons.map((p2) => ({
-      ...p2,
-      linkedCapabilityIds: allCaps.filter((c) => c.personId === p2.id).map((c) => c.id),
-      linkedRemoteAliases: allRemotes.filter((r) => r.personId === p2.id).map((r) => r.alias)
-    }));
-    return { response: { type: "person:list:ok", persons: out } };
-  };
-  const create = async (frame) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = PersonCreateArgsSchema.parse(rest);
-    const t = now();
-    const person = {
-      id: genId(),
-      displayName: args.displayName,
-      ...args.notes !== void 0 ? { notes: args.notes } : {},
-      dmEnabled: args.dmEnabled ?? true,
-      createdAt: t,
-      updatedAt: t
-    };
-    deps.personStore.add(person);
-    return { response: { type: "person:create:ok", person } };
-  };
-  const update = async (frame) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = PersonUpdateArgsSchema.parse(rest);
-    const existing = deps.personStore.get(args.id);
-    if (!existing) {
-      throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `Person not found: ${args.id}`);
-    }
-    const t = now();
-    deps.personStore.update(
-      args.id,
-      {
-        ...args.displayName !== void 0 ? { displayName: args.displayName } : {},
-        ...args.notes !== void 0 ? { notes: args.notes } : {},
-        ...args.dmEnabled !== void 0 ? { dmEnabled: args.dmEnabled } : {}
-      },
-      t
-    );
-    const next = deps.personStore.get(args.id);
-    return { response: { type: "person:update:ok", person: next } };
-  };
-  const del = async (frame) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = PersonDeleteArgsSchema.parse(rest);
-    if (!deps.personStore.get(args.id)) {
-      throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, `Person not found: ${args.id}`);
-    }
-    const result = cascadeDeletePerson(args.id, deps);
-    return {
-      response: {
-        type: "person:delete:ok",
-        deletedCapabilityIds: result.deletedCapabilityIds,
-        removedRemoteAliases: result.removedRemoteAliases,
-        deletedInboxEvents: result.deletedInboxEvents
-      }
-    };
-  };
-  return {
-    "person:list": list,
-    "person:create": create,
-    "person:update": update,
-    "person:delete": del
-  };
-}
-function defaultGenId2() {
-  return `p_${(0, import_node_crypto9.randomUUID)()}`;
-}
-
 // src/handlers/attachment.ts
+var import_node_path26 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -29115,8 +27647,41 @@ function buildAttachmentHandlers(deps) {
         "httpBaseUrl unavailable (daemon HTTP not ready)"
       );
     }
+    if (!deps.sessionStore || !deps.getSessionScope || !deps.groupFileStore) {
+      throw new ClawdError(
+        ERROR_CODES.METHOD_NOT_IMPLEMENTED,
+        "signUrl requires session/group stores"
+      );
+    }
+    const sessionFile = deps.sessionStore.read(args.sessionId);
+    if (!sessionFile) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `session ${args.sessionId} not found`
+      );
+    }
+    const scope = deps.getSessionScope(args.sessionId);
+    if (!scope) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `session ${args.sessionId} scope unresolved`
+      );
+    }
+    const cwdAbs = import_node_path26.default.resolve(sessionFile.cwd);
+    const candidateAbs = import_node_path26.default.isAbsolute(args.relPath) ? import_node_path26.default.resolve(args.relPath) : import_node_path26.default.resolve(cwdAbs, args.relPath);
+    const entries = deps.groupFileStore.list(scope, args.sessionId);
+    const entry = entries.find((e) => {
+      const storedAbs = import_node_path26.default.isAbsolute(e.relPath) ? import_node_path26.default.resolve(e.relPath) : import_node_path26.default.resolve(cwdAbs, e.relPath);
+      return storedAbs === candidateAbs && !e.stale;
+    });
+    if (!entry) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `relPath not in session group files or stale: ${args.relPath}`
+      );
+    }
     const ttl = args.ttlSeconds === null ? null : args.ttlSeconds ?? DEFAULT_TTL_SECONDS;
-    const parts = signUrlParts(secret, args.absPath, ttl);
+    const parts = signUrlParts(secret, candidateAbs, ttl);
     const url = buildSignedFileUrl(httpBaseUrl, parts);
     return {
       response: {
@@ -29183,11 +27748,23 @@ function buildAttachmentHandlers(deps) {
     const entries = deps.groupFileStore.list(scope, parsed.data.sessionId);
     return { response: { type: "attachment.groupList", entries } };
   };
+  const groupListPersona = async (frame) => {
+    if (!deps.groupFileStore) {
+      throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "groupFileStore not wired");
+    }
+    const parsed = AttachmentGroupListPersonaArgs.safeParse(frame);
+    if (!parsed.success) {
+      throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
+    }
+    const perSession = deps.groupFileStore.listByPersona(parsed.data.personaId);
+    return { response: { type: "attachment.groupListPersona", perSession } };
+  };
   return {
     "attachment.signUrl": signUrl,
     "attachment.groupAdd": groupAdd,
     "attachment.groupRemove": groupRemove,
-    "attachment.groupList": groupList
+    "attachment.groupList": groupList,
+    "attachment.groupListPersona": groupListPersona
   };
 }
 
@@ -29205,143 +27782,15 @@ function buildMethodHandlers(deps) {
       personaManager: deps.personaManager,
       personaRegistry: deps.personaRegistry
     }),
-    ...buildCapabilityHandlers({
-      manager: deps.capabilityManager,
-      getShareBaseUrl: deps.getShareBaseUrl,
-      personStore: deps.personStore
-    }),
-    ...buildInboxHandlers({
-      manager: deps.inboxManager,
-      personStore: deps.personStore,
-      capabilityManager: deps.capabilityManager
-    }),
-    ...buildRemotePersonaHandlers({
-      store: deps.remotePersonaStore,
-      personStore: deps.personStore
-    }),
-    ...buildPersonHandlers({
-      personStore: deps.personStore,
-      capabilityManager: deps.capabilityManager,
-      remotePersonaStore: deps.remotePersonaStore,
-      inboxStore: deps.inboxStore
-    }),
-    whoami: buildWhoamiHandler({
-      ownerDisplayName: deps.ownerDisplayName,
-      ownerPrincipalId: deps.ownerPrincipalId,
-      personaStore: deps.personaStore,
-      capabilityManager: deps.capabilityManager
-    }),
     ...deps.attachment ? buildAttachmentHandlers(deps.attachment) : {}
   };
 }
 
-// src/handlers/method-grants.ts
-var ADMIN_ANY = {
-  kind: "fixed",
-  resource: { type: "*" },
-  action: "admin"
-};
-var CAPABILITY_SCOPED = { kind: "capability-scoped" };
-var METHOD_GRANT_MAP = {
-  // ---- public（meta-only，guest 也能调） ----
-  "info": { kind: "public" },
-  "ping": { kind: "public" },
-  // v2 Phase 6: whoami 是身份反查，任何 authed connection (owner / guest) 都能调；
-  // handler 内部按 ctx.principal.kind 决定返回 "合成 owner self capability" 还是
-  // "查 capabilityManager 拿 caller 的 guest capability"。
-  "whoami": { kind: "public" },
-  // ---- capability platform（admin-only，本 PR 新增） ----
-  "capability:issue": ADMIN_ANY,
-  "capability:list": ADMIN_ANY,
-  "capability:delete": ADMIN_ANY,
-  // ---- inbox: channel-based IM (capability platform v3) ----
-  // 三条都 'public' — capability 本身就是授权凭证. handler 内额外校验
-  // guest ctx.capabilityId === args.capabilityId, 防 guest 越权操作别的 channel.
-  "inbox:list": { kind: "public" },
-  "inbox:markRead": { kind: "public" },
-  "inbox:postMessage": { kind: "public" },
-  // Phase 4 Task 4.3: 远程 persona 仅 owner 管理 (admin-only)
-  "remote-persona:add": ADMIN_ANY,
-  "remote-persona:list": ADMIN_ANY,
-  "remote-persona:remove": ADMIN_ANY,
-  // Person identity Phase 1: 联系人本质是 owner 视角的 People 列表，仅 owner 管理。
-  "person:list": ADMIN_ANY,
-  "person:create": ADMIN_ANY,
-  "person:update": ADMIN_ANY,
-  "person:delete": ADMIN_ANY,
-  // ---- session:* / chat:* 业务方法（v2 Phase 8 两层模型）----
-  // dispatcher 不验资源，handler 内按 ctx + frame.args 反查 ownerPersonaId 调 assertGrant。
-  // owner 自动通过（ctx 自带 '*':'admin' grant 一切 match）；guest 在被授权 persona 内可调。
-  "session:create": CAPABILITY_SCOPED,
-  "session:list": CAPABILITY_SCOPED,
-  "session:get": CAPABILITY_SCOPED,
-  "session:update": CAPABILITY_SCOPED,
-  "session:delete": CAPABILITY_SCOPED,
-  "session:send": CAPABILITY_SCOPED,
-  "session:stop": CAPABILITY_SCOPED,
-  "session:interrupt": CAPABILITY_SCOPED,
-  "session:rewind": CAPABILITY_SCOPED,
-  "session:rewind-diff": CAPABILITY_SCOPED,
-  "session:rewindable-message-ids": CAPABILITY_SCOPED,
-  "session:fork": CAPABILITY_SCOPED,
-  "session:new": CAPABILITY_SCOPED,
-  "session:resume": CAPABILITY_SCOPED,
-  "session:observe": CAPABILITY_SCOPED,
-  "session:events": CAPABILITY_SCOPED,
-  "session:subscribe": CAPABILITY_SCOPED,
-  "session:unsubscribe": CAPABILITY_SCOPED,
-  "session:pin": CAPABILITY_SCOPED,
-  "session:reorderPins": ADMIN_ANY,
-  // owner 全局操作，无 personaId 维度
-  "permission:respond": CAPABILITY_SCOPED,
-  "session:answerQuestion": CAPABILITY_SCOPED,
-  "session:cancelQuestion": CAPABILITY_SCOPED,
-  "history:projects": ADMIN_ANY,
-  "history:list": ADMIN_ANY,
-  "history:read": ADMIN_ANY,
-  "history:subagents": ADMIN_ANY,
-  "history:subagent-read": ADMIN_ANY,
-  "history:recentDirs": ADMIN_ANY,
-  "workspace:list": ADMIN_ANY,
-  "workspace:read": ADMIN_ANY,
-  "skills:list": ADMIN_ANY,
-  "agents:list": ADMIN_ANY,
-  "git:root": ADMIN_ANY,
-  "git:branch": ADMIN_ANY,
-  "git:branches": ADMIN_ANY,
-  "capabilities:get": ADMIN_ANY,
-  "persona:create": ADMIN_ANY,
-  "persona:list": ADMIN_ANY,
-  "persona:get": ADMIN_ANY,
-  "persona:update": ADMIN_ANY,
-  "persona:delete": ADMIN_ANY,
-  "session:pty:input": ADMIN_ANY,
-  "session:pty:resize": ADMIN_ANY,
-  // file-sharing attachment.* RPC：dispatcher 用 admin-only 兜底（wire-level 拦），
-  // 实际只有 owner 能调（personal token 链路 2026-05-21 删除，HTTP Bearer 只识别 owner）
-  "attachment.signUrl": ADMIN_ANY,
-  "attachment.groupAdd": ADMIN_ANY,
-  "attachment.groupRemove": ADMIN_ANY,
-  "attachment.groupList": ADMIN_ANY
-};
-function computeGrantForFrame(method, frame) {
-  const rule = METHOD_GRANT_MAP[method];
-  if (!rule) return { kind: "public" };
-  if (rule.kind === "public") return { kind: "public" };
-  if (rule.kind === "capability-scoped") return { kind: "public" };
-  if (rule.kind === "fixed") {
-    return { kind: "check", resource: rule.resource, action: rule.action };
-  }
-  const picked = rule.pick(frame);
-  if (!picked) return { kind: "public" };
-  return { kind: "check", resource: picked.resource, action: picked.action };
-}
-
 // src/index.ts
 async function startDaemon(config) {
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path26.default.join(config.dataDir, "clawd.log")
+    file: import_node_path27.default.join(config.dataDir, "clawd.log")
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
@@ -29352,103 +27801,45 @@ async function startDaemon(config) {
   if (pre.status === "stale") {
     logger.warn("stale state file detected, overwriting", { pid: pre.existing.pid });
   }
-  const auth = loadOrCreateAuth({ dataDir: config.dataDir });
   let resolvedAuthToken = null;
+  let authFile = null;
   if (config.authToken && config.authToken.trim()) {
     resolvedAuthToken = config.authToken.trim();
   } else if (config.tunnel) {
-    resolvedAuthToken = auth.token;
+    authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
+    resolvedAuthToken = authFile.token;
   }
-  const ownerPrincipalId = auth.ownerPrincipalId;
-  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
-  const inboxStore = new InboxStore(config.dataDir);
-  const inboxManager = new InboxManager(inboxStore, (capabilityId, frame) => {
-    wsServer?.broadcastToCapabilityChannel(capabilityId, frame);
-  });
-  const capabilityStore = new CapabilityStore(config.dataDir);
-  const capabilityRegistry = new CapabilityRegistry(capabilityStore);
-  const capabilityManager = new CapabilityManager(capabilityRegistry, {
-    onIssued: (cap, token) => {
-      wsServer?.broadcastToOwners({
-        type: "capability:tokenIssued",
-        capability: stripSecretHash(cap),
-        token
-      });
-    },
-    onDeleted: (cap) => {
-      const deletedAt = Date.now();
-      wsServer?.broadcastToOwners({
-        type: "capability:tokenDeleted",
-        capabilityId: cap.id,
-        deletedAt
-      });
-      wsServer?.closeConnectionsByCapability(cap.id);
-      const cleanup = cleanupGuestSessionsForCapability(cap, sessionStoreFactory);
-      if (cleanup.removed.length > 0) {
-        logger.info("capability delete cascade: guest sessions removed", {
-          capabilityId: cap.id,
-          removedDirs: cleanup.removed
-        });
-      }
-      inboxManager.removeChannel(cap.id);
-    }
-  });
-  const remotePersonaStore = new RemotePersonaStore(config.dataDir);
-  const personStore = new PersonStore(config.dataDir);
   let wsServer = null;
   const authGate = authMode === "first-message" ? new AuthGate({
     shouldEnforce: buildShouldEnforce({ tunnel: config.tunnel }),
-    // Task 1.7：authenticate 注入路径替代 expectedToken 单 token 比对。
-    // owner 路径 constantTimeEqual 防侧信道；guest 路径走 capabilityRegistry.
     expectedToken: resolvedAuthToken,
-    authenticate: (t, _selfPrincipalId) => {
-      return authenticate(t, {
-        isOwnerToken: (x) => resolvedAuthToken != null && constantTimeEqual(x, resolvedAuthToken),
-        ownerPrincipalId,
-        ownerDisplayName,
-        capabilityRegistry
-      });
-    },
-    onAuthed: (h, ctx) => wsServer?.attachClientContext(h.id, ctx),
-    buildOwnerContext: () => ownerContext(ownerPrincipalId, ownerDisplayName),
     closeConnection: (h, code, reason) => wsServer?.closeClient(h.id, code, reason),
     sendOk: (h, payload) => wsServer?.sendToClient(h.id, payload)
   }) : null;
   resetRegistry();
-  const migrateResult = migrateFlattenSessions({ dataDir: config.dataDir });
-  if (!migrateResult.skipped && (migrateResult.movedBare || migrateResult.movedVmOwner || migrateResult.archivedListener)) {
-    logger.info("sessions migration applied", {
-      movedBare: migrateResult.movedBare,
-      movedVmOwner: migrateResult.movedVmOwner,
-      archivedListener: migrateResult.archivedListener
-    });
-  }
-  const sessionStoreFactory = new SessionStoreFactory({ dataDir: config.dataDir });
-  const store = sessionStoreFactory.forBare();
+  const store = new SessionStore({ dataDir: config.dataDir });
   const workspace = new WorkspaceBrowser();
   const skills = new SkillsScanner();
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path26.default.join(config.dataDir, "personas"));
+  const personaStore = new PersonaStore(import_node_path27.default.join(config.dataDir, "personas"));
   const defaultsRoot = findDefaultsRoot();
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
   } else {
     logger.warn("persona.seed.skip", { reason: "defaults-root-not-found" });
   }
+  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const manager = new SessionManager({
     store,
-    // Phase 2 (capability platform plan §1): factory 注入后 manager.storeFor 走
-    // 新布局派生 (sessions/* + personas/<pid>/.clawd/sessions/owner/*)
-    storeFactory: sessionStoreFactory,
     logger,
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path26.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path27.default.join(config.dataDir, "personas"),
     personaStore,
     ownerDisplayName,
     mode: config.mode,
@@ -29471,7 +27862,7 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path26.default.isAbsolute(input.relPath) ? input.relPath : import_node_path26.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path27.default.isAbsolute(input.relPath) ? input.relPath : import_node_path27.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
           size = import_node_fs24.default.statSync(absPath).size;
@@ -29570,62 +27961,43 @@ async function startDaemon(config) {
     httpToken: resolvedAuthToken,
     // file-sharing attachment.* RPC。signUrl 用 owner token 做 HMAC secret；group RPC
     // 根据 sessionId 反查 scope 写盘。
+    //
+    // sessionStore / getSessionScope 都走 manager 的跨 scope 公开 API（findOwnedSession /
+    // findOwnedSessionScope）—— 否则 default-only SessionStore 找不到 persona owner-mode
+    // session，attachment 整套 RPC 对 persona session 都会报 "session not found"。
+    // 详见 fix(daemon) #703：file-sharing v1 预存 wiring bug，#701 把 desktop 默认 --tunnel
+    // 后首次让 desktop 用户用上 file-sharing 才被暴露。
     attachment: {
       groupFileStore,
+      sessionStore: { read: (sid) => manager.findOwnedSession(sid) },
       getHttpBaseUrl,
-      // HMAC sign secret：复用 ~/.clawd/auth.json owner token（持久跨重启）。
-      // noAuth 模式 resolvedAuthToken 为 null → handler 自己返 NOT_IMPLEMENTED。
-      getSignSecret: () => resolvedAuthToken ?? "",
-      // group RPC：根据 sessionId 反查 scope；owner-mode persona session 走
+      // HMAC sign secret：~/.clawd/auth.json signSecret 字段（与 WS Bearer token 独立）。
+      // --auth-token CLI 模式 / noAuth 模式 authFile 为 null → handler 自己返 NOT_IMPLEMENTED。
+      getSignSecret: () => authFile?.signSecret ?? "",
+      // group RPC + sign 都用：根据 sessionId 反查 scope。owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
-      getSessionScope: (sessionId) => {
-        const file = store.read(sessionId);
-        if (!file) return null;
-        if (file.ownerPersonaId) {
-          return { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" };
-        }
-        return { kind: "default" };
-      }
-    },
-    // Task 1.9: capability:issue/list/revoke handler 依赖
-    capabilityManager,
-    // v2 Phase 5: capability:issue 返回的 shareUrl 用此 base URL 拼接。
-    // tunnel 拉起后切到反代 wss://... 地址；否则本机 ws://host:port。
-    getShareBaseUrl: () => currentTunnelUrl ?? `ws://${config.host}:${config.port}`,
-    // v2 Phase 6: whoami handler 装在 owner principal.displayName + persona 解析
-    ownerDisplayName,
-    // owner-id stabilization: whoami 用稳定 ownerPrincipalId 替代 'owner' 字面量
-    ownerPrincipalId,
-    personaStore,
-    // capability handler 也用 (capability:issue 走 registry / capability:list)
-    capabilityRegistry,
-    // capability platform v3 inbox: handler 接 manager (post/list/markRead),
-    // cascade 接 store (list 统计 deletedInboxEvents).
-    inboxManager,
-    inboxStore,
-    // Phase 4 Task 4.3: remote-persona:* handler 依赖 (本地存储, v1 不接 outgoing WS)
-    remotePersonaStore,
-    // Per-People token (2026-05-21): person:* RPC handlers + cap/remote 自带
-    // personId 字段（PersonAlias 表已删）
-    personStore
+      getSessionScope: (sid) => manager.findOwnedSessionScope(sid)
+    }
   });
   const authResolver = new AuthContextResolver({
-    ownerToken: resolvedAuthToken
+    ownerToken: resolvedAuthToken,
+    personaRegistry
   });
   const httpRouter = createHttpRouter({
     authResolver,
     daemonVersion: version,
     logger,
+    personaStore,
+    groupFileStore,
     sessionStore: store,
-    // /files HMAC verify 用同一份 owner token 做 secret（与 attachment.signUrl 同源）
-    getSignSecret: () => resolvedAuthToken ?? null
+    // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
+    // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
+    getSignSecret: () => authFile?.signSecret ?? null
   });
   wsServer = new LocalWsServer({
     host: config.host,
     port: config.port,
     logger,
-    // broadcastToPrincipal 用此 id 路由 owner-targeted 帧（替代字面量 'owner' sentinel）
-    ownerPrincipalId,
     readyFrameBuilder: (ctx) => buildReadyFrame(
       {
         manager,
@@ -29641,19 +28013,6 @@ async function startDaemon(config) {
     ),
     protocolVersion: PROTOCOL_VERSION,
     authGate: authGate ?? void 0,
-    // noAuth 模式下仍验 capability token: 修 capability platform 漏洞 — 远端 client
-    // 用 cap token 连 noAuth daemon 时若无此 hook 会 fallback owner ctx, whoami 错返
-    // capability.id = ownerPrincipalId, 导致 myCapabilityId 写错 → inbox channel 写错.
-    // 命中 cap → attach guest ctx; 空 token / 未命中 → 保持 noAuth 行为 (handler fallback owner).
-    tryVerifyCapabilityToken: (token) => {
-      const v2 = capabilityRegistry.verifyToken(token);
-      if (!v2.ok) return null;
-      return {
-        principal: { id: v2.capability.id, kind: "guest", displayName: v2.capability.displayName },
-        grants: v2.capability.grants,
-        capabilityId: v2.capability.id
-      };
-    },
     // file-sharing HTTP 路由复用 daemon 同端口（spec §5 第 3 条）；router 自己处理 auth + 404
     httpRequestHandler: httpRouter,
     // 订阅成功后给该 client 重放 in-flight pendingQuestions（plan: clawd-question-server-truth）。
@@ -29706,18 +28065,7 @@ async function startDaemon(config) {
     const requestId = typeof frame.requestId === "string" ? frame.requestId : void 0;
     const handler = handlers[type];
     if (!handler) throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, `not implemented: ${type}`);
-    const ctx = wsServer.getClientContext(client.id) ?? ownerContext(ownerPrincipalId, ownerDisplayName);
-    const verdict = computeGrantForFrame(type, frame);
-    if (verdict.kind === "check") {
-      const ok = assertGrant(ctx.grants, verdict.resource, verdict.action);
-      if (!ok) {
-        throw new ClawdError(
-          ERROR_CODES.UNAUTHORIZED,
-          `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${verdict.action} on ${verdict.resource.type}${"id" in verdict.resource ? ":" + verdict.resource.id : ""}`
-        );
-      }
-    }
-    const result = await handler(frame, client, ctx);
+    const result = await handler(frame, client);
     if (requestId && result.response) {
       client.send({ ...result.response, requestId });
     }
@@ -29775,15 +28123,15 @@ async function startDaemon(config) {
     });
     try {
       const r = await tunnelMgr.start({ localPort: config.port });
-      stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url };
+      stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url, tunnelError: void 0 };
       stateMgr.write(stateSnapshot);
       currentTunnelUrl = r.url;
       const connectUrl = resolvedAuthToken ? `${r.url}#token=${resolvedAuthToken}` : r.url;
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path26.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path26.default.join(config.dataDir, "frpc.log")}`
+        `Frpc config: ${import_node_path27.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path27.default.join(config.dataDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -29796,19 +28144,30 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path26.default.join(config.dataDir, "connect.txt");
+        const connectPath = import_node_path27.default.join(config.dataDir, "connect.txt");
         import_node_fs24.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
+      const tunnelError = err?.message ?? String(err);
       try {
         await tunnelMgr.stop();
       } catch {
       }
       tunnelMgr = null;
-      stateMgr.delete();
-      await wss.stop();
-      throw err;
+      stateSnapshot = { ...stateSnapshot, tunnelUrl: void 0, tunnelError };
+      try {
+        stateMgr.write(stateSnapshot);
+      } catch {
+      }
+      wss.broadcastAll({
+        type: "tunnel:unavailable",
+        reason: tunnelError,
+        failedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      process.stdout.write(`Tunnel:      unavailable (local mode) \u2014 ${tunnelError}
+`);
+      logger.warn("tunnel unavailable, degraded to local mode", { reason: tunnelError });
     }
   }
   const shutdown = async () => {