@clawos-dev/clawd 0.2.71-beta.138.2a35bba → 0.2.72-beta.139.d7294dd

package/dist/cli.cjs

@@ -87,15 +87,16 @@ var init_methods = __esm({
       "git:branches",
       "capabilities:get",
       // ---- persona:* (persona 管理) ----
+      // persona:list 响应 shape 不分流（统一返 PersonaFile[]），但 daemon handler 按
+      // ConnectionContext 投影不同子集：
+      //   owner ctx → 返全量 personas（含 private）
+      //   guest ctx → persona.public === true ∧ assertGrant(ctx.grants, {persona,p.id}, 'read')
+      // method-grants.ts: persona:list 是 CAPABILITY_SCOPED；其它 persona:* 仍 ADMIN_ANY。
       "persona:create",
       "persona:list",
       "persona:get",
       "persona:update",
       "persona:delete",
-      // token 颁发 / 吊销：file-sharing HTTP Bearer 鉴权用（PersonaRegistry.findByToken
-      // 反查 personaId / label）。owner UI 在 PersonaSettingsDrawer "分享 Token" section 管理。
-      "persona:issueToken",
-      "persona:revokeToken",
       // ---- session:pty 双向透传（仅 CLAWD_CC_MODE=tui 才生效，对应 session:pty push 帧的上行） ----
       // session:pty:input — UI 把用户键盘字节（base64 UTF-8）发给 daemon，daemon 直写 pty stdin。
       //   高频帧（每次按键 1 帧），不入 reducer / 不广播。response 是 fire-and-forget 风格 ack。
@@ -106,14 +107,45 @@ var init_methods = __esm({
       // ---- attachment.* file-sharing（详见 attachment-schemas.ts） ----
       // 命名警告：这里的 `attachment.*` RPC 与 CC v2.x 上行 `type:"attachment"` 系统行
       // （attachment-skills / attachment-deferred-tools / attachment_memories）是不同概念。
-      // 全部管理类 RPC handler 入口 requireOwner（personal token 调任意一个都 403）；
-      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，签名验证），不在白名单内。
+      // 全部管理类 RPC dispatcher grant 限 owner（capability admin-only）；
+      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，HMAC 签名自包含，不在白名单内）。
       "attachment.signUrl",
       "attachment.groupAdd",
       "attachment.groupRemove",
       "attachment.groupList",
-      // v2：跨 session 聚合（本期 UI 不调，保留槽位用于 HTTP ACL 内部判定 / 未来 "All files" tab）
-      "attachment.groupListPersona",
+      // ---- capability:* (capability platform 鉴权底座) ----
+      // owner 颁发 / 列出 / 删除给 guest 的 capability。三者均需 admin 权限（METHOD_GRANT_MAP
+      // 在 daemon 端固定为 `{ resource: '*', action: 'admin' }`，owner 自动满足）。
+      // 颁发后 daemon 推 'capability:tokenIssued' 帧；删除推 'capability:tokenDeleted' 帧。
+      // 删除是 hard delete：CapabilityStore 物理移除 + 关该 cap 的所有活跃 ws + rm
+      // personas/<pid>/.clawd/sessions/guests/<capId>/ guest sessions 目录。
+      "capability:issue",
+      "capability:list",
+      "capability:delete",
+      // bidirectional cap 视角 B 2026-05-23: owner 主动告诉 daemon "我颁的某 cap 给了谁"
+      // (UI 在 accept dialog 4 步流程里调; 等价于 recordPeerHello 但不经 ws auth path).
+      // 否则 B 端颁回的 cap 因为 A 不连 B → peerOwnerId 永不回写 → useContacts 派生 pending.
+      "capability:bindPeer",
+      // ---- inbox:* (capability platform Phase 3 跨用户通知 + Phase 4 DM) ----
+      // owner 接 guest 的 cross-principal 消息事件 + DM 双向私聊.
+      // inbox:list / markRead: admin-only (Phase 3); inbox:postMessage: DM 自带能力,
+      // 任何 principal (owner/guest) 可调 (Phase 4).
+      "inbox:list",
+      "inbox:markRead",
+      "inbox:postMessage",
+      // ---- received-capability:* (对方颁给我的 cap, 视角 B 双向授权模型, 2026-05-23) ----
+      // owner 入口: list / add / remove
+      // guest 端: autoAttach (B 接 A 的 token 后通过 cap channel ws 推 cap 给 A)
+      // 详见 received-capability.ts JSDoc + spec 2026-05-23-bidirectional-cap-design.md
+      "received-capability:list",
+      "received-capability:add",
+      "received-capability:remove",
+      "received-capability:autoAttach",
+      // ---- whoami (v2 capability platform) ----
+      // 任何 authed connection 都能调；返回 owner 显示名 + 当前 capability wire 形态 +
+      // grants 对应的 persona 元数据 (id + displayName)。UI 端 AddRemotePersonaDialog
+      // 的 preview 一次性临时 client 用它判定身份和可用 persona。
+      "whoami",
       "info",
       "ping"
     ];
@@ -605,8 +637,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path32, errorMaps, issueData } = params;
-      const fullPath = [...path32, ...issueData.path || []];
+      const { data, path: path38, errorMaps, issueData } = params;
+      const fullPath = [...path38, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -917,11 +949,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path32, key) {
+      constructor(parent, value, path38, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path32;
+        this._path = path38;
         this._key = key;
       }
       get path() {
@@ -4305,12 +4337,12 @@ var init_zod = __esm({
 });
 
 // ../protocol/src/attachment-schemas.ts
-var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema, AttachmentGroupListPersonaArgs, AttachmentGroupListPersonaResponseSchema;
+var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema;
 var init_attachment_schemas = __esm({
   "../protocol/src/attachment-schemas.ts"() {
     "use strict";
     init_zod();
-    TOKEN_ROLES = ["owner", "personal"];
+    TOKEN_ROLES = ["owner"];
     GROUP_FILE_SOURCES = ["agent", "owner"];
     GroupFileEntrySchema = external_exports.object({
       /** daemon 派发的稳定 id（用于 RPC remove / UI key） */
@@ -4331,11 +4363,9 @@ var init_attachment_schemas = __esm({
       stale: external_exports.boolean().optional()
     });
     AttachmentSignUrlArgs = external_exports.object({
-      /** 群文件所属的 session */
-      sessionId: external_exports.string().min(1),
-      /** 相对 session.cwd 的路径；允许传绝对路径，daemon 端会归一化（必须在 cwd 内） */
-      relPath: external_exports.string().min(1),
-      /** TTL 秒数；缺省 24h；null 走永久 URL（不带 exp 字段） */
+      /** 要分享的绝对路径；签名只关心 absPath，不区分 persona/session */
+      absPath: external_exports.string().min(1),
+      /** TTL 秒数；缺省 24h；'never' 走 null 不带 exp 字段（永久有效） */
       ttlSeconds: external_exports.number().int().positive().nullable().optional()
     });
     AttachmentSignUrlResponseSchema = external_exports.object({
@@ -4366,31 +4396,15 @@ var init_attachment_schemas = __esm({
     AttachmentGroupListResponseSchema = external_exports.object({
       entries: external_exports.array(GroupFileEntrySchema)
     });
-    AttachmentGroupListPersonaArgs = external_exports.object({
-      personaId: external_exports.string().min(1)
-    });
-    AttachmentGroupListPersonaResponseSchema = external_exports.object({
-      perSession: external_exports.array(
-        external_exports.object({
-          sessionId: external_exports.string().min(1),
-          entries: external_exports.array(GroupFileEntrySchema)
-        })
-      )
-    });
   }
 });
 
 // ../protocol/src/persona-schemas.ts
-var PersonaTokenEntrySchema, PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema, PersonaIssueTokenArgsSchema, PersonaRevokeTokenArgsSchema;
+var PersonaFileSchema, PersonaSkillSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema;
 var init_persona_schemas = __esm({
   "../protocol/src/persona-schemas.ts"() {
     "use strict";
     init_zod();
-    PersonaTokenEntrySchema = external_exports.object({
-      label: external_exports.string(),
-      issuedAt: external_exports.number(),
-      revoked: external_exports.boolean()
-    });
     PersonaFileSchema = external_exports.object({
       personaId: external_exports.string(),
       label: external_exports.string(),
@@ -4399,13 +4413,6 @@ var init_persona_schemas = __esm({
       // 8-key set defined UI-side in `lib/session-icons.ts`; protocol stays plain string
       // for forward compatibility, consumer fallbacks to default when key not found.
       iconKey: external_exports.string().optional(),
-      /**
-       * Persona token 列表：file-sharing HTTP Bearer 鉴权用。
-       * - 写：`PersonaManager.issueToken` / `revokeToken`
-       * - 读：`PersonaRegistry.findByToken` 反向查表（需 persona.public === true）
-       * - optional：兼容历史 persona.json 不含此字段的情形（旧 daemon 写文件时省略）
-       */
-      tokenMap: external_exports.record(external_exports.string(), PersonaTokenEntrySchema).optional(),
       createdAt: external_exports.number(),
       updatedAt: external_exports.number()
     }).strict();
@@ -4415,10 +4422,6 @@ var init_persona_schemas = __esm({
       // SKILL.md frontmatter `description:`；缺省时省略字段
       description: external_exports.string().optional()
     });
-    PersonaPluginSummarySchema = external_exports.object({
-      // settings.json 中 enabledPlugins 的 key，例如 'superpowers@claude-plugins-official'
-      id: external_exports.string().min(1)
-    });
     PersonaSandboxSettingsSchema = external_exports.object({
       permissions: external_exports.object({
         defaultMode: external_exports.string().optional()
@@ -4439,8 +4442,6 @@ var init_persona_schemas = __esm({
       personality: external_exports.string().optional(),
       // 仅 'persona:get' 携带；null = 文件不存在 / parse 失败；undefined = 不在该响应类型上
       skills: external_exports.array(PersonaSkillSummarySchema).optional(),
-      // 仅 'persona:get' 携带；空数组 = 没启用任何插件 / settings.json 不存在；undefined = 不在该响应类型上
-      plugins: external_exports.array(PersonaPluginSummarySchema).optional(),
       sandboxSettings: PersonaSandboxSettingsSchema.nullable().optional()
     });
     PersonaCreateArgsSchema = external_exports.object({
@@ -4464,19 +4465,11 @@ var init_persona_schemas = __esm({
         iconKey: external_exports.string().nullable().optional()
       }).strict()
     }).strict();
-    PersonaIssueTokenArgsSchema = external_exports.object({
-      personaId: external_exports.string().min(1),
-      label: external_exports.string().min(1)
-    });
-    PersonaRevokeTokenArgsSchema = external_exports.object({
-      personaId: external_exports.string().min(1),
-      token: external_exports.string().min(1)
-    });
   }
 });
 
 // ../protocol/src/schemas.ts
-var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelExitedEventSchema, TunnelUnavailableEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
+var SessionStatusSchema, UsageSchema, ContextUsageSchema, sessionMetaShape, SessionMetaSchema, ModelInfoSchema, ModeInfoSchema, ConfigFieldSchemaSchema, CapabilitiesGetArgs, CapabilitiesResponseSchema, AllowRuleSchema, SessionFileSchema, ParsedEventBase, HistoryUserMetaSchema, SubagentToolStatsSchema, StructuredPatchHunkSchema, ToolResultExtraSchema, MemoryEntrySchema, AskQuestionOptionSchema, AskQuestionItemSchema, ParsedEventSchema, SessionCreateArgs, SessionIdArgs, SessionUpdateArgs, SessionSendArgs, SessionRewindArgs, SessionRewindResponseSchema, SessionRewindDiffArgs, RewindDiffHunkSchema, RewindDiffFileSchema, SessionRewindDiffResponseSchema, SessionRewindableMessageIdsArgs, SessionRewindableMessageIdsResponseSchema, SessionResumeArgs, SessionForkArgs, SessionForkResponseSchema, SessionObserveArgs, SessionEventsArgs, PermissionRespondArgs, HistoryListArgs, HistoryReadArgs, HistorySubagentsArgs, HistorySubagentReadArgs, WorkspaceListArgs, WorkspaceReadArgs, SkillsListArgs, SkillEntrySchema, AgentEntrySchema, AgentsListArgs, AgentsListResponseSchema, SessionSubscribeArgs, SessionPinArgs, SessionReorderPinsArgs, GitRootArgs, GitRootResponseSchema, GitBranchArgs, GitBranchResponseSchema, GitBranchesArgs, GitBranchesResponseSchema, HistoryRecentDirsArgs, RecentDirEntrySchema, HistoryRecentDirsResponseSchema, SessionQuestionFrameSchema, SessionQuestionClearedFrameSchema, AnswerQuestionArgs, AnswerQuestionResponseSchema, CancelQuestionArgs, CancelQuestionResponseSchema, AuthRequestFrameSchema, AuthOkFrameSchema, TunnelExitedEventSchema, InfoRunningSessionSchema, InfoResponseSchema;
 var init_schemas = __esm({
   "../protocol/src/schemas.ts"() {
     "use strict";
@@ -4578,6 +4571,15 @@ var init_schemas = __esm({
       // 才能让 alice 重连同一 sub-session（持久化在 alice localStorage 之外，由 daemon push 同步）。
       // optional 是因为 owner-mode session 不带；只要写入就是 listener-mode 必填三元组。
       chatId: external_exports.string().min(1).optional(),
+      /**
+       * 创建该 session 的 principal id（owner uuid 或 guest cap.id），从 session:create handler
+       * 的 ctx.principal.id 派生。Person identity Q2「按对端人聚合 sessions」需要它：
+       * UI 端按 `creatorPrincipalId === ownerPrincipalId` 区分「我自己」vs「别人接入」，
+       * 后者再通过 PersonAlias 表反查 personId 二级分组。
+       *
+       * optional：兼容 2026-05-21 之前的老 session 数据，新建一定有值。
+       */
+      creatorPrincipalId: external_exports.string().min(1).optional(),
       createdAt: external_exports.string().min(1),
       updatedAt: external_exports.string().min(1)
     });
@@ -4987,7 +4989,20 @@ var init_schemas = __esm({
     AuthRequestFrameSchema = external_exports.object({
       type: external_exports.literal("auth"),
       token: external_exports.string().min(1),
-      scheme: external_exports.literal("bearer").optional()
+      scheme: external_exports.literal("bearer").optional(),
+      /**
+       * guest 端 ws 接入时自报对端稳定 ownerPrincipalId。AuthGate.authenticate 收到
+       * 后调 capabilityManager.recordPeerHello(capId, ownerPrincipalId, displayName)
+       * 把 cap.peerOwnerId / firstUsedByPeerAt 字段回写，让 owner 端 UI 在 People
+       * tab 顶层 PeerOwner 视图 + Personas tab 二级分组拿到对端身份。
+       */
+      selfPrincipalId: external_exports.string().min(1).optional(),
+      /**
+       * 同 selfPrincipalId：自报 owner displayName（人类可读），让对端 daemon 把
+       * 显示名写入 cap.peerOwnerDisplayName（cap.displayName 本来就是 owner 颁时填
+       * 的"颁给谁/用途"，hello 收到的 displayName 是辅助）。
+       */
+      selfDisplayName: external_exports.string().optional()
     });
     AuthOkFrameSchema = external_exports.object({
       type: external_exports.literal("auth:ok"),
@@ -5000,11 +5015,6 @@ var init_schemas = __esm({
       subdomain: external_exports.string().nullable(),
       url: external_exports.string().nullable()
     });
-    TunnelUnavailableEventSchema = external_exports.object({
-      type: external_exports.literal("tunnel:unavailable"),
-      reason: external_exports.string().min(1),
-      failedAt: external_exports.string().min(1)
-    });
     InfoRunningSessionSchema = external_exports.object({
       sessionId: external_exports.string().min(1),
       status: SessionStatusSchema,
@@ -5025,10 +5035,9 @@ var init_schemas = __esm({
       // PR 2 daemon 实现 single HTTP server + auth-context 后，daemon 必返这五个字段，
       // 届时可考虑改成 required。spec §11 第 3 条："tokenRole 是协议字段，daemon 查 token
       // 表后显式下发，UI 不自行推导"——所以 UI 一律读这里，禁止本地推导。
-      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）；'personal' = persona 派发的访客 token。来源 TOKEN_ROLES（spec §11 #1 中央真理源） */
+      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）。来源 TOKEN_ROLES（spec §11 #1 中央真理源）。
+       *  历史 'personal' role（persona file-sharing token）在 2026-05-21 删除；tokenPersonaId 一同移除。 */
       tokenRole: external_exports.enum(TOKEN_ROLES).optional(),
-      /** tokenRole='personal' 时携带（绑定到具体 persona）；owner 不携带 */
-      tokenPersonaId: external_exports.string().min(1).optional(),
       /** socket.remoteAddress 是否落在 127.0.0.1 / ::1；本期无 RPC 消费，保留协议槽位给未来 "Reveal in Finder" 等本机动作 */
       isLoopback: external_exports.boolean().optional(),
       /** UI 拼 file-sharing HTTP 路由的前缀（http(s)://host:port），不含尾斜杠；frpc 反代时返反代地址 */
@@ -5055,6 +5064,194 @@ var init_persona_mode = __esm({
   }
 });
 
+// ../protocol/src/principal.ts
+function makeOwnerPrincipal(id, displayName) {
+  return PrincipalSchema.parse({ id, kind: "owner", displayName });
+}
+var PrincipalKindSchema, PrincipalSchema;
+var init_principal = __esm({
+  "../protocol/src/principal.ts"() {
+    "use strict";
+    init_zod();
+    PrincipalKindSchema = external_exports.enum(["owner", "guest"]);
+    PrincipalSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      kind: PrincipalKindSchema,
+      displayName: external_exports.string()
+    }).strict();
+  }
+});
+
+// ../protocol/src/capability.ts
+function stripSecretHash(cap) {
+  const { secretHash: _hash, ...wire } = cap;
+  return wire;
+}
+var ResourceSchema, ActionSchema, GrantSchema, CapabilitySchema, CapabilityWireSchema, CapabilityErrorCodeSchema, WhoamiResponseSchema, CapabilityIssueArgsSchema, CapabilityBindPeerArgsSchema;
+var init_capability = __esm({
+  "../protocol/src/capability.ts"() {
+    "use strict";
+    init_zod();
+    ResourceSchema = external_exports.discriminatedUnion("type", [
+      external_exports.object({ type: external_exports.literal("persona"), id: external_exports.string().min(1) }).strict(),
+      external_exports.object({ type: external_exports.literal("chat"), id: external_exports.string().min(1) }).strict(),
+      external_exports.object({ type: external_exports.literal("*") }).strict()
+    ]);
+    ActionSchema = external_exports.enum(["read", "send", "admin"]);
+    GrantSchema = external_exports.object({
+      resource: ResourceSchema,
+      actions: external_exports.array(ActionSchema).min(1)
+    }).strict();
+    CapabilitySchema = external_exports.object({
+      id: external_exports.string().min(1),
+      // sha256(token) hex 64
+      secretHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      displayName: external_exports.string(),
+      // 空数组合法 = 纯访客（只能 DM）
+      grants: external_exports.array(GrantSchema),
+      issuedAt: external_exports.number().int().nonnegative(),
+      expiresAt: external_exports.number().int().positive().optional(),
+      maxUses: external_exports.number().int().positive().optional(),
+      usedCount: external_exports.number().int().nonnegative(),
+      /**
+       * guest 在 auth 帧捎带 selfPrincipalId 时由 AuthGate.authenticate 回写；
+       * 未被消费的 cap 此字段缺失。
+       */
+      peerOwnerId: external_exports.string().min(1).optional(),
+      /** 首次 client hello 时间戳（与 peerOwnerId 同步写入） */
+      firstUsedByPeerAt: external_exports.number().int().positive().optional(),
+      /**
+       * 对方 daemon owner 的 displayName，guest auth 帧 selfDisplayName 触发
+       * recordPeerHello 时同步回写。视角 B (2026-05-23) UI 派生联系人列表用此字段
+       * 显示对方名字（避免 fallback 到我颁 cap 时填的 displayName）。
+       */
+      peerDisplayName: external_exports.string().optional()
+    }).strict();
+    CapabilityWireSchema = CapabilitySchema.omit({ secretHash: true });
+    CapabilityErrorCodeSchema = external_exports.enum([
+      "TOKEN_INVALID",
+      "TOKEN_REVOKED",
+      "TOKEN_EXPIRED",
+      "TOKEN_EXHAUSTED"
+    ]);
+    WhoamiResponseSchema = external_exports.object({
+      type: external_exports.literal("whoami:ok"),
+      owner: external_exports.object({
+        id: external_exports.string(),
+        kind: external_exports.enum(["owner", "guest"]),
+        displayName: external_exports.string()
+      }).strict(),
+      capability: CapabilityWireSchema,
+      grantedPersonas: external_exports.array(
+        external_exports.object({
+          id: external_exports.string().min(1),
+          displayName: external_exports.string()
+        }).strict()
+      )
+    }).strict();
+    CapabilityIssueArgsSchema = external_exports.object({
+      displayName: external_exports.string().min(1),
+      grants: external_exports.array(GrantSchema),
+      expiresAt: external_exports.number().int().positive().optional(),
+      maxUses: external_exports.number().int().positive().optional()
+    }).strict();
+    CapabilityBindPeerArgsSchema = external_exports.object({
+      capabilityId: external_exports.string().min(1),
+      peerOwnerId: external_exports.string().min(1),
+      peerDisplayName: external_exports.string()
+    }).strict();
+  }
+});
+
+// ../protocol/src/inbox.ts
+var InboxMessageSchema, InboxPostMessageArgsSchema, InboxListArgsSchema, InboxMarkReadArgsSchema;
+var init_inbox = __esm({
+  "../protocol/src/inbox.ts"() {
+    "use strict";
+    init_zod();
+    InboxMessageSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      peerOwnerId: external_exports.string().min(1),
+      senderPrincipalId: external_exports.string().min(1),
+      text: external_exports.string().min(1),
+      createdAt: external_exports.number().int().nonnegative(),
+      readBy: external_exports.record(external_exports.string().min(1), external_exports.number().int().positive()).default({})
+    }).strict();
+    InboxPostMessageArgsSchema = external_exports.object({
+      peerOwnerId: external_exports.string().min(1).optional(),
+      id: external_exports.string().min(1),
+      text: external_exports.string().min(1),
+      createdAt: external_exports.number().int().nonnegative()
+    }).strict();
+    InboxListArgsSchema = external_exports.object({
+      peerOwnerId: external_exports.string().min(1),
+      sinceCreatedAt: external_exports.number().int().nonnegative().optional()
+    }).strict();
+    InboxMarkReadArgsSchema = external_exports.object({
+      peerOwnerId: external_exports.string().min(1),
+      upToCreatedAt: external_exports.number().int().nonnegative()
+    }).strict();
+  }
+});
+
+// ../protocol/src/received-capability.ts
+var ReceivedCapabilitySchema, ReceivedCapabilityWireSchema, ReceivedCapabilityAddArgsSchema, ReceivedCapabilityAddOkSchema, ReceivedCapabilityRemoveArgsSchema, ReceivedCapabilityRemoveOkSchema, ReceivedCapabilityListOkSchema, ReceivedCapabilityAutoAttachArgsSchema, ReceivedCapabilityAutoAttachOkSchema, ReceivedCapabilityAddedFrameSchema, ReceivedCapabilityRemovedFrameSchema;
+var init_received_capability = __esm({
+  "../protocol/src/received-capability.ts"() {
+    "use strict";
+    init_zod();
+    init_capability();
+    ReceivedCapabilitySchema = external_exports.object({
+      ownerPrincipalId: external_exports.string().min(1),
+      ownerDisplayName: external_exports.string(),
+      remoteUrl: external_exports.string().min(1),
+      capabilityId: external_exports.string().min(1),
+      capabilityToken: external_exports.string().min(1),
+      grants: external_exports.array(GrantSchema),
+      receivedAt: external_exports.number().int().nonnegative()
+    }).strict();
+    ReceivedCapabilityWireSchema = ReceivedCapabilitySchema;
+    ReceivedCapabilityAddArgsSchema = external_exports.object({
+      remoteUrl: external_exports.string().min(1),
+      token: external_exports.string().min(1)
+    }).strict();
+    ReceivedCapabilityAddOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:add:ok"),
+      receivedCap: ReceivedCapabilityWireSchema
+    }).strict();
+    ReceivedCapabilityRemoveArgsSchema = external_exports.object({
+      ownerPrincipalId: external_exports.string().min(1)
+    }).strict();
+    ReceivedCapabilityRemoveOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:remove:ok"),
+      ownerPrincipalId: external_exports.string().min(1)
+    }).strict();
+    ReceivedCapabilityListOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:list:ok"),
+      receivedCaps: external_exports.array(ReceivedCapabilityWireSchema)
+    }).strict();
+    ReceivedCapabilityAutoAttachArgsSchema = external_exports.object({
+      ownerPrincipalId: external_exports.string().min(1),
+      ownerDisplayName: external_exports.string(),
+      remoteUrl: external_exports.string().min(1),
+      capabilityId: external_exports.string().min(1),
+      token: external_exports.string().min(1),
+      grants: external_exports.array(GrantSchema)
+    }).strict();
+    ReceivedCapabilityAutoAttachOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:autoAttach:ok")
+    }).strict();
+    ReceivedCapabilityAddedFrameSchema = external_exports.object({
+      type: external_exports.literal("received-capability:added"),
+      receivedCap: ReceivedCapabilityWireSchema
+    }).strict();
+    ReceivedCapabilityRemovedFrameSchema = external_exports.object({
+      type: external_exports.literal("received-capability:removed"),
+      ownerPrincipalId: external_exports.string().min(1)
+    }).strict();
+  }
+});
+
 // ../protocol/src/runtime.ts
 var init_runtime = __esm({
   "../protocol/src/runtime.ts"() {
@@ -5067,6 +5264,10 @@ var init_runtime = __esm({
     init_persona_schemas();
     init_persona_mode();
     init_attachment_schemas();
+    init_principal();
+    init_capability();
+    init_inbox();
+    init_received_capability();
   }
 });
 
@@ -5341,8 +5542,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path32 = req.path;
-        _req.url = typeof path32 === "string" ? path32 : req.url ? req.url.path || req.url : void 0;
+        const path38 = req.path;
+        _req.url = typeof path38 === "string" ? path38 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -5507,14 +5708,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path32) {
+    function parsePath(path38) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path38.length; i++) {
+        const char = path38[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -5645,10 +5846,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path32 of paths) {
-        const parts = parsePath(path32);
+      for (const path38 of paths) {
+        const parts = parsePath(path38);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path32, remove);
+          redactWildcardPath(obj, parts, censor, path38, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -5733,8 +5934,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path32];
+            const wrappedCensor = typeof censor === "function" ? (value, path38) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path38];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -5769,8 +5970,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path32 of pathsToClone) {
-        const parts = parsePath(path32);
+      for (const path38 of pathsToClone) {
+        const parts = parsePath(path38);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -5822,24 +6023,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path32) {
-      if (typeof path32 !== "string") {
+    function validatePath(path38) {
+      if (typeof path38 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path32 === "") {
+      if (path38 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path32.includes("..")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path38.includes("..")) {
+        throw new Error(`Invalid redaction path (${path38})`);
       }
-      if (path32.includes(",")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path38.includes(",")) {
+        throw new Error(`Invalid redaction path (${path38})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path38.length; i++) {
+        const char = path38[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -5853,20 +6054,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path32})`);
+            throw new Error(`Invalid redaction path (${path38})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path32})`);
+        throw new Error(`Invalid redaction path (${path38})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path32 of paths) {
-        validatePath(path32);
+      for (const path38 of paths) {
+        validatePath(path38);
       }
     }
     function slowRedact(options = {}) {
@@ -6034,8 +6235,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-            return censor(value, [k2, ...path32]);
+          const wrappedCensor = typeof censor === "function" ? (value, path38) => {
+            return censor(value, [k2, ...path38]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6253,10 +6454,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs28 = require("fs");
+    var fs34 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path32 = require("path");
+    var path38 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6310,20 +6511,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs28.mkdirSync(path32.dirname(file), { recursive: true });
-          const fd = fs28.openSync(file, flags, mode);
+          if (sonic.mkdir) fs34.mkdirSync(path38.dirname(file), { recursive: true });
+          const fd = fs34.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs28.mkdir(path32.dirname(file), { recursive: true }, (err) => {
+        fs34.mkdir(path38.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs28.open(file, flags, mode, fileOpened);
+          fs34.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs28.open(file, flags, mode, fileOpened);
+        fs34.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -6364,8 +6565,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs28.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs28.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs34.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs34.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -6374,15 +6575,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs28.writeSync(this.fd, this._writingBuf);
+            return fs34.writeSync(this.fd, this._writingBuf);
           }
-          return fs28.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs34.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs28.write(this.fd, this._writingBuf, this.release);
+            return fs34.write(this.fd, this._writingBuf, this.release);
           }
-          return fs28.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs34.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -6439,7 +6640,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs28.fsyncSync(this.fd);
+          fs34.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -6553,7 +6754,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs28.fsync(this.fd, (err) => {
+            fs34.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -6655,7 +6856,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs28.close(fd, (err) => {
+          fs34.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -6704,7 +6905,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs28.writeSync(this.fd, buf) : fs28.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs34.writeSync(this.fd, buf) : fs34.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -6720,7 +6921,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs28.fsyncSync(this.fd);
+        fs34.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -6741,7 +6942,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs28.writeSync(this.fd, buf);
+          const n = fs34.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -6769,13 +6970,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs28.writeSync(this.fd, this._writingBuf) : fs28.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs34.writeSync(this.fd, this._writingBuf) : fs34.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs28.write(this.fd, this._writingBuf, release);
+        fs34.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -6784,7 +6985,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs28.writeSync(this.fd, this._writingBuf);
+          const written = fs34.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -6793,7 +6994,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs28.write(this.fd, this._writingBuf, release);
+        fs34.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -6809,12 +7010,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs28.fsync(sonic.fd, closeWrapped);
+        fs34.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs28.close(sonic.fd, done);
+          fs34.close(sonic.fd, done);
         } else {
           done();
         }
@@ -7071,7 +7272,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join4 } = require("path");
+    var { join: join11 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -7107,7 +7308,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join4(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join11(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         trackUnmanagedFds: false,
@@ -7493,7 +7694,7 @@ var require_transport = __commonJS({
     "use strict";
     var { createRequire } = require("module");
     var getCallers = require_caller();
-    var { join: join4, isAbsolute, sep } = require("path");
+    var { join: join11, isAbsolute, sep: sep2 } = require("path");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
     var ThreadStream = require_thread_stream();
@@ -7556,7 +7757,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -7574,7 +7775,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -7596,12 +7797,12 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join4(__dirname, "..", "file.js");
+          return join11(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
           try {
-            const context = filePath === "node:repl" ? process.cwd() + sep : filePath;
+            const context = filePath === "node:repl" ? process.cwd() + sep2 : filePath;
             fixTarget2 = createRequire(context).resolve(origin);
             break;
           } catch (err) {
@@ -8586,7 +8787,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join4 = ",";
+            let join11 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -8600,7 +8801,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join4 = `,
+                join11 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8608,13 +8809,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join4;
+                res += join11;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8635,7 +8836,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join4 = `,
+              join11 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8649,13 +8850,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join4;
+                separator = join11;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join4;
+              separator = join11;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -8696,7 +8897,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join4 = ",";
+            let join11 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -8709,7 +8910,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join4 = `,
+                join11 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8717,13 +8918,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join4;
+                res += join11;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8736,7 +8937,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join4 = `,
+              join11 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8745,7 +8946,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join4;
+                separator = join11;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -8803,20 +9004,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join5 = `,
+              const join12 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join5;
+                res2 += join12;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join5}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join12}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -8832,16 +9033,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join4 = `,
+            const join11 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join4, maximumBreadth);
+              res += stringifyTypedArray(value, join11, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join4;
+              separator = join11;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -8852,13 +9053,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join4;
+                separator = join11;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join4;
+              separator = join11;
             }
             if (separator !== "") {
               res = `
@@ -9949,11 +10150,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path32, added, removed, oldPosInc, options) {
-        var last = path32.lastComponent;
+      addToPath: function addToPath(path38, added, removed, oldPosInc, options) {
+        var last = path38.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path38.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -9963,7 +10164,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path38.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10021,7 +10222,7 @@ var init_lib = __esm({
       tokenize: function tokenize(value) {
         return Array.from(value);
       },
-      join: function join3(chars) {
+      join: function join4(chars) {
         return chars.join("");
       },
       postProcess: function postProcess(changeObjects) {
@@ -10394,10 +10595,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path38 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const entry = { path: path32, content };
+      if (!path38 || content == null) return null;
+      const entry = { path: path38, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -10857,6 +11058,27 @@ var init_claude_history = __esm({
   }
 });
 
+// src/tools/sandbox.ts
+function shouldSandbox(cwd, personaRoot) {
+  if (!personaRoot) return false;
+  const sep2 = personaRoot.endsWith(path12.sep) ? "" : path12.sep;
+  return cwd.startsWith(personaRoot + sep2) && cwd !== personaRoot;
+}
+function inferSandboxSettingsPath(cwd, personaRoot) {
+  if (!shouldSandbox(cwd, personaRoot)) return null;
+  const rel = path12.relative(personaRoot, cwd);
+  const personaId = rel.split(path12.sep)[0];
+  if (!personaId) return null;
+  return path12.join(personaRoot, personaId, ".clawd", "sandbox-settings.json");
+}
+var path12;
+var init_sandbox = __esm({
+  "src/tools/sandbox.ts"() {
+    "use strict";
+    path12 = __toESM(require("path"), 1);
+  }
+});
+
 // src/tools/claude.ts
 function macOSDesktopCandidates(home) {
   return [
@@ -10906,7 +11128,7 @@ function buildSpawnArgs(ctx) {
   ];
   if (ctx.model) args.push("--model", ctx.model);
   switch (ctx.personaMode) {
-    case "listener":
+    case "guest":
       args.push("--setting-sources", "project,local");
       break;
     case "owner":
@@ -10921,7 +11143,8 @@ function buildSpawnArgs(ctx) {
       throw new Error(`unexpected personaMode: ${String(_exhaustive)}`);
     }
   }
-  if (ctx.extraSettings) args.push("--settings", ctx.extraSettings);
+  const sandboxSettings = ctx.extraSettings ?? inferSandboxSettingsPath(ctx.cwd, ctx.personaRoot);
+  if (sandboxSettings) args.push("--settings", sandboxSettings);
   if (ctx.extraSystemPrompt) args.push("--append-system-prompt", ctx.extraSystemPrompt);
   if (ctx.effort) args.push("--effort", ctx.effort);
   if (ctx.toolSessionId) args.push("--resume", ctx.toolSessionId);
@@ -11201,10 +11424,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path38 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const out = { path: path32, content };
+      if (!path38 || content == null) return null;
+      const out = { path: path38, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -11320,6 +11543,7 @@ var init_claude = __esm({
     init_protocol();
     init_claude_history();
     init_tool_result_extra();
+    init_sandbox();
     ATTACHMENT_SILENT_SUBTYPES2 = /* @__PURE__ */ new Set([
       "hook_additional_context",
       "hook_success",
@@ -18702,7 +18926,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash3 } = require("crypto");
     var { Duplex, Readable: Readable3 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -19232,7 +19456,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes2(16).toString("base64");
       const request = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -19362,7 +19586,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -19729,7 +19953,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash } = require("crypto");
+    var { createHash: createHash3 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -20030,7 +20254,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -20118,7 +20342,7 @@ var require_websocket_server = __commonJS({
 // src/run-case/recorder.ts
 function startRunCaseRecorder(opts) {
   const now = opts.now ?? Date.now;
-  const dir = import_node_path28.default.dirname(opts.recordPath);
+  const dir = import_node_path27.default.dirname(opts.recordPath);
   let stream = null;
   let closing = false;
   let closedSettled = false;
@@ -20158,12 +20382,12 @@ function startRunCaseRecorder(opts) {
   };
   return { tap, close, closed };
 }
-var import_node_fs25, import_node_path28;
+var import_node_fs25, import_node_path27;
 var init_recorder = __esm({
   "src/run-case/recorder.ts"() {
     "use strict";
     import_node_fs25 = __toESM(require("fs"), 1);
-    import_node_path28 = __toESM(require("path"), 1);
+    import_node_path27 = __toESM(require("path"), 1);
   }
 });
 
@@ -20206,7 +20430,7 @@ var init_wire = __esm({
 // src/run-case/controller.ts
 async function runController(opts) {
   const now = opts.now ?? Date.now;
-  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path29.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
+  const cwd = opts.cwd ?? (0, import_node_fs26.mkdtempSync)(import_node_path28.default.join(import_node_os14.default.tmpdir(), "clawd-runcase-"));
   const ownsCwd = opts.cwd === void 0;
   const recorder = startRunCaseRecorder({ recordPath: opts.record, now });
   const spawnCtx = { cwd };
@@ -20373,13 +20597,13 @@ async function runController(opts) {
   }
   return exitCode ?? 0;
 }
-var import_node_fs26, import_node_os14, import_node_path29;
+var import_node_fs26, import_node_os14, import_node_path28;
 var init_controller = __esm({
   "src/run-case/controller.ts"() {
     "use strict";
     import_node_fs26 = require("fs");
     import_node_os14 = __toESM(require("os"), 1);
-    import_node_path29 = __toESM(require("path"), 1);
+    import_node_path28 = __toESM(require("path"), 1);
     init_claude();
     init_stdout_splitter();
     init_permission_stdio();
@@ -20611,7 +20835,7 @@ Env (advanced):
 `;
 
 // src/index.ts
-var import_node_path27 = __toESM(require("path"), 1);
+var import_node_path26 = __toESM(require("path"), 1);
 var import_node_fs24 = __toESM(require("fs"), 1);
 
 // src/logger.ts
@@ -20649,6 +20873,9 @@ function createLogger(opts = {}) {
   return wrap(base);
 }
 
+// src/session/store-factory.ts
+var path5 = __toESM(require("path"), 1);
+
 // src/session/store.ts
 var import_node_fs3 = __toESM(require("fs"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
@@ -20657,10 +20884,14 @@ init_protocol();
 // src/session/scope.ts
 var import_node_path3 = __toESM(require("path"), 1);
 function scopeKey(scope) {
-  return scope.kind === "default" ? "default" : `persona:${scope.personaId}:${scope.mode}`;
+  if (scope.kind === "default") return "default";
+  if (scope.mode === "guest") return `persona:${scope.personaId}:guest:${scope.capId}`;
+  return `persona:${scope.personaId}:${scope.mode}`;
 }
 function scopeSubPath(scope) {
-  return scope.kind === "default" ? ["default"] : [scope.personaId, scope.mode];
+  if (scope.kind === "default") return ["default"];
+  if (scope.mode === "guest") return [scope.personaId, "guests", scope.capId];
+  return [scope.personaId, scope.mode];
 }
 function metaFromScope(scope, personaRoot) {
   if (scope.kind === "default") return void 0;
@@ -20669,10 +20900,18 @@ function metaFromScope(scope, personaRoot) {
   }
   return {
     idleKillEnabled: true,
-    personaMode: "listener",
+    personaMode: "guest",
     extraSettings: import_node_path3.default.join(personaRoot, scope.personaId, ".clawd", "sandbox-settings.json")
   };
 }
+function scopeForFile(file, ownerPrincipalId) {
+  if (!file.ownerPersonaId) return { kind: "default" };
+  const creator = file.creatorPrincipalId;
+  if (ownerPrincipalId && creator && creator !== ownerPrincipalId) {
+    return { kind: "persona", personaId: file.ownerPersonaId, mode: "guest", capId: creator };
+  }
+  return { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" };
+}
 
 // src/session/store.ts
 function safeFileName(sessionId) {
@@ -20686,12 +20925,16 @@ function safeFileName(sessionId) {
 var SessionStore = class {
   root;
   constructor(opts) {
-    const scope = opts.scope ?? { kind: "default" };
-    this.root = import_node_path4.default.join(
-      opts.dataDir,
-      "sessions",
-      ...scopeSubPath(scope).map(safeFileName)
-    );
+    if ("root" in opts) {
+      this.root = opts.root;
+    } else {
+      const scope = opts.scope ?? { kind: "default" };
+      this.root = import_node_path4.default.join(
+        opts.dataDir,
+        "sessions",
+        ...scopeSubPath(scope).map(safeFileName)
+      );
+    }
   }
   filePath(sessionId) {
     return import_node_path4.default.join(this.root, `${safeFileName(sessionId)}.json`);
@@ -20756,6 +20999,66 @@ var SessionStore = class {
   }
 };
 
+// src/session/store-factory.ts
+var SessionStoreFactory = class {
+  dataDir;
+  bareStore = null;
+  vmOwnerStores = /* @__PURE__ */ new Map();
+  // vmGuest 索引 key = `${pid}::${capId}`（按 cap.id 隔离，一张 cap 一个目录）
+  vmGuestStores = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dataDir = opts.dataDir;
+  }
+  // ---- root path 派生（暴露给 migration / revoke cascade 等外部消费方） ----
+  bareRoot() {
+    return path5.join(this.dataDir, "sessions");
+  }
+  vmOwnerRoot(personaId) {
+    return path5.join(
+      this.dataDir,
+      "personas",
+      safeFileName(personaId),
+      ".clawd",
+      "sessions",
+      "owner"
+    );
+  }
+  vmGuestRoot(personaId, capId) {
+    return path5.join(
+      this.dataDir,
+      "personas",
+      safeFileName(personaId),
+      ".clawd",
+      "sessions",
+      "guests",
+      safeFileName(capId)
+    );
+  }
+  // ---- SessionStore 工厂（缓存） ----
+  forBare() {
+    if (!this.bareStore) {
+      this.bareStore = new SessionStore({ root: this.bareRoot() });
+    }
+    return this.bareStore;
+  }
+  forVmOwner(personaId) {
+    const key = personaId;
+    const cached = this.vmOwnerStores.get(key);
+    if (cached) return cached;
+    const st = new SessionStore({ root: this.vmOwnerRoot(personaId) });
+    this.vmOwnerStores.set(key, st);
+    return st;
+  }
+  forVmGuest(personaId, capId) {
+    const key = `${personaId}::${capId}`;
+    const cached = this.vmGuestStores.get(key);
+    if (cached) return cached;
+    const st = new SessionStore({ root: this.vmGuestRoot(personaId, capId) });
+    this.vmGuestStores.set(key, st);
+    return st;
+  }
+};
+
 // src/session/manager.ts
 var import_node_fs5 = __toESM(require("fs"), 1);
 var import_node_path6 = __toESM(require("path"), 1);
@@ -20875,7 +21178,7 @@ function cloneState(s) {
     subSessionMeta: s.subSessionMeta
   };
 }
-var IDLE_KILL_DELAY_MS = 5e3;
+var IDLE_KILL_DELAY_MS = 6e4;
 var SEEN_UUID_CAP = 2e3;
 function applyEventBatch(state, events, deps) {
   if (events.length === 0) return { state, effects: [] };
@@ -20915,7 +21218,10 @@ function buildSpawnContext(state, deps) {
     toolSessionId: file.toolSessionId,
     model: file.model,
     permissionMode: file.permissionMode,
-    effort: file.effort
+    effort: file.effort,
+    // Phase 2 capability platform (plan §3): personaRoot 透传给 buildSpawnArgs;
+    // 内部 shouldSandbox(cwd, personaRoot) 决定是否注入 --settings sandbox-settings.
+    personaRoot: deps.personaRoot
   };
   const meta = state.subSessionMeta;
   if (meta?.personaMode) {
@@ -21642,7 +21948,8 @@ var SessionRunner = class {
       now: this.hooks.now ?? Date.now,
       resolveContextWindow: this.hooks.resolveContextWindow,
       genUuid: this.hooks.genUuid ?? v4_default,
-      ownerDisplayName: this.hooks.ownerDisplayName
+      ownerDisplayName: this.hooks.ownerDisplayName,
+      personaRoot: this.hooks.personaRoot
     };
     const { state, effects } = reduceSession(this.state, inputMsg, deps);
     this.state = state;
@@ -22066,9 +22373,18 @@ var SessionManager = class {
   attachObserver(observer) {
     this.attachedObserver = observer;
   }
-  // 按 scope 拿对应的 SessionStore。default scope 复用 deps.store（保证与
-  // bootstrap 注入的 store 一致）；persona scope 第一次访问时按需创建并缓存。
+  // 按 scope 拿对应的 SessionStore.
+  // Phase 2 (capability platform plan §1) 路由切到 SessionStoreFactory:
+  //   default              → factory.forBare()                  <dataDir>/sessions/
+  //   persona/<pid>/owner  → factory.forVmOwner(pid)            <dataDir>/personas/<pid>/.clawd/sessions/owner/
+  //   persona/<pid>/guest  → factory.forVmGuest(pid, capId)     <dataDir>/personas/<pid>/.clawd/sessions/guests/<capId>/
+  // 缺省 (无 factory 注入): 回退 dataDir+scope 老路径 (向后兼容旧 spec).
   storeFor(scope) {
+    if (this.deps.storeFactory) {
+      if (scope.kind === "default") return this.deps.storeFactory.forBare();
+      if (scope.mode === "owner") return this.deps.storeFactory.forVmOwner(scope.personaId);
+      return this.deps.storeFactory.forVmGuest(scope.personaId, scope.capId);
+    }
     if (scope.kind === "default") return this.deps.store;
     const key = scopeKey(scope);
     const cached = this.storesByScope.get(key);
@@ -22088,19 +22404,18 @@ var SessionManager = class {
     this.capabilitiesCache.set(tool, caps);
     return caps;
   }
-  // 由 SessionFile.ownerPersonaId schema 字段推回写入 scope。
-  // ownerPersonaId 由 create({ownerPersonaId}) 在 schema 落盘时记入，永远只反映
-  // session 出身（不可变）；此函数只用于 SessionStore 的写入路由，不参与运行时行为
-  // 决策（personaMode='owner' 等由路径 → scope → metaFromScope 派生）。
-  // 仅覆盖 owner + default 两类——listener sub-session 不会从 default RPC 路径进来。
+  // 由 SessionFile 反推 scope 的 thin wrapper —— 决策矩阵收敛到 scope.scopeForFile
+  // free function（scope.spec.ts transition 表驱动测试），manager 只负责注入 deps.
   scopeForFile(file) {
-    return file.ownerPersonaId ? { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" } : { kind: "default" };
+    return scopeForFile(file, this.deps.ownerPrincipalId);
   }
-  // 扫 <dataDir>/sessions/ 列出所有 persona 命名空间（不含 'default'）。
-  // 用于 findOwnedSession / listAllOwned 跨 scope 查询。
+  // 扫所有 persona 命名空间. 用于 findOwnedSession / listAllOwned 跨 scope 查询.
+  // Phase 2 capability platform: 新布局下 persona 资产在 <dataDir>/personas/<pid>/,
+  // 直接 readdir 这个目录拿所有 personaId. 老布局 (无 storeFactory) fallback 扫
+  // <dataDir>/sessions/ 列子目录 (排除 'default').
   listPersonaIdsOnDisk() {
     if (!this.deps.dataDir) return [];
-    const root = import_node_path6.default.join(this.deps.dataDir, "sessions");
+    const root = this.deps.storeFactory ? import_node_path6.default.join(this.deps.dataDir, "personas") : import_node_path6.default.join(this.deps.dataDir, "sessions");
     let entries;
     try {
       entries = import_node_fs5.default.readdirSync(root, { withFileTypes: true });
@@ -22111,60 +22426,79 @@ var SessionManager = class {
     }
     return entries.filter((e) => e.isDirectory() && e.name !== "default").map((e) => e.name);
   }
-  // owner / default 两个分类下按 sessionId 找文件——前端只传 sessionId 不带 scope，
-  // SessionManager 在这里定位。三层快慢路径：
-  //   1) active runner（用户当前在用的 session）：runner.state.file 是 SessionFile 内存权威副本，
-  //      直接返回，零磁盘 I/O。覆盖 attachment / file-sharing 等"用户操作 → 紧接着 RPC"的
-  //      绝大多数场景
-  //   2) default scope 磁盘：inactive default session 命中
-  //   3) 所有 persona owner 目录扫盘：inactive persona owner session 命中
-  // listener sub-session 不走这条——transport 始终明确传 (personaId, sessionId)。
-  //
-  // 公开方法：attachment / file-sharing handler 通过 deps 闭包消费，不应直接持 SessionStore
-  // （持 default-only store 是 file-sharing v1 的预存 bug 根因——见 fix #703）
+  // 扫某 persona 下 guests/ 子目录, 拿所有 capId.
+  // 路径: <dataDir>/personas/<pid>/.clawd/sessions/guests/<capId>/
+  // 只在 storeFactory 注入 (新布局) 下生效, 老布局无 guest 目录.
+  listGuestCapIdsForPersona(personaId) {
+    if (!this.deps.dataDir || !this.deps.storeFactory) return [];
+    const root = import_node_path6.default.join(
+      this.deps.dataDir,
+      "personas",
+      personaId,
+      ".clawd",
+      "sessions",
+      "guests"
+    );
+    let entries;
+    try {
+      entries = import_node_fs5.default.readdirSync(root, { withFileTypes: true });
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      throw err;
+    }
+    return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+  }
+  // owned 类目下按 sessionId 找文件——前端只传 sessionId 不带 scope.
+  // 扫盘顺序: default → 每个 persona 的 owner/ → 每个 persona 的 guests/<capId>/.
   findOwnedSession(sessionId) {
-    const runner = this.runners.get(sessionId);
-    if (runner) return runner.getState().file;
     const dflt = this.deps.store.read(sessionId);
     if (dflt) return dflt;
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
-      const file = ownerStore.read(sessionId);
-      if (file) return file;
+      const found = ownerStore.read(sessionId);
+      if (found) return found;
+      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
+        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
+        const g2 = guestStore.read(sessionId);
+        if (g2) return g2;
+      }
     }
     return null;
   }
-  // findOwnedSession + scopeForFile 收口。把"sessionId → SessionScope"的派生
-  // 集中到 manager（scope 单一来源），调用方拿 scope 不再自己拼 object 也不依赖
-  // ownerPersonaId 字段语义。给 attachment handler 通过 deps.getSessionScope 闭包消费。
-  findOwnedSessionScope(sessionId) {
-    const file = this.findOwnedSession(sessionId);
-    return file ? this.scopeForFile(file) : null;
-  }
-  // 合并 default + 所有 persona owner 的 SessionFile —— 桌面 App 主 session 列表入口。
-  // 同样不含 listener sub-session（listener 走 persona:listSubSessions RPC 单独入口）。
+  // 合并 default + 每个 persona 的 owner/ + guests/<capId>/ —— 桌面 App 主 session 列表入口.
+  // guest sessions 由 handlers/session.ts list 处按 ctx.principal.kind === 'guest' 做权限过滤
+  // (creatorPrincipalId === capId), 这里仅负责数据源汇总.
   listAllOwned() {
     const out = [];
     out.push(...this.deps.store.list());
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
       out.push(...ownerStore.list());
+      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
+        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
+        out.push(...guestStore.list());
+      }
     }
     return out.sort(
       (a, b2) => a.updatedAt > b2.updatedAt ? -1 : a.updatedAt < b2.updatedAt ? 1 : 0
     );
   }
-  // 写回 SessionFile，自动根据 ownerPersonaId 派生写入 scope。
-  // 调用方原先都是 `deps.store.write(updated)`，全部走这里收口路由。
+  // 写回 SessionFile，自动根据 ownerPersonaId / creatorPrincipalId 派生写入 scope.
+  // 调用方原先都是 `deps.store.write(updated)`，全部走这里收口路由.
   writeOwned(file) {
     return this.storeFor(this.scopeForFile(file)).write(file);
   }
-  // 删除 owned SessionFile（default 或 persona/owner），与 findOwnedSession 对称扫盘。
+  // 删除 owned SessionFile（default / persona owner / persona guest），与 findOwnedSession 对称扫盘.
   deleteOwned(sessionId) {
     if (this.deps.store.delete(sessionId)) return true;
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
       if (ownerStore.delete(sessionId)) return true;
+      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
+        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
+        if (guestStore.delete(sessionId)) return true;
+      }
     }
     return false;
   }
@@ -22172,8 +22506,8 @@ var SessionManager = class {
   // 经过 compressFrameForWire 后决定是 push collector 还是走 deps.broadcastFrame。
   // scope 决定两件事：SessionStore 路由 + SubSessionMeta 派生（metaFromScope）。
   //   - default → 复用 deps.store，无 subSessionMeta（普通 session）
-  //   - persona/owner → <dataDir>/sessions/<personaId>/owner/，meta={idleKillEnabled:false, personaMode:'owner'}
-  //   - persona/listener → <dataDir>/sessions/<personaId>/listener/，meta={idleKillEnabled:true, personaMode:'listener', extraSettings:<sandbox>}
+  //   - persona/owner → personas/<pid>/.clawd/sessions/owner/，meta={idleKillEnabled:false, personaMode:'owner'}
+  //   - persona/guest → personas/<pid>/.clawd/sessions/guests/<capId>/，meta={idleKillEnabled:true, personaMode:'guest', extraSettings:<sandbox>}
   newRunner(file, scope) {
     const adapter = this.deps.getAdapter(file.tool ?? "claude");
     const store = this.storeFor(scope);
@@ -22192,6 +22526,9 @@ var SessionManager = class {
       dataDir: this.deps.dataDir,
       personaStore: this.deps.personaStore,
       ownerDisplayName: this.deps.ownerDisplayName,
+      // Phase 2 capability platform (plan §3): 透传 personaRoot, buildSpawnArgs 据
+      // cwd 是否在 personaRoot 下自动决定是否注入 --settings sandbox-settings.json.
+      personaRoot: this.deps.personaRoot,
       // file-sharing (spec §6 PR 3)：闭包 scope + sessionId，runner 只暴露 tool/relPath/cwd
       onFileEdit: attachmentGroup ? (input) => attachmentGroup.onFileEdit({
         scope,
@@ -22286,7 +22623,7 @@ var SessionManager = class {
     }
   }
   // ---- 命令方法：均返回 { response, broadcast[] }，由 dispatcher 聚合 ----
-  create(args) {
+  create(args, creatorPrincipalId) {
     let cwd;
     if (args.ownerPersonaId) {
       cwd = derivePersonaSpawnCwd(
@@ -22327,10 +22664,11 @@ var SessionManager = class {
       iconKey: args.iconKey,
       forkedFromSessionId: args.forkedFromSessionId,
       ownerPersonaId: args.ownerPersonaId,
+      creatorPrincipalId,
       createdAt: iso,
       updatedAt: iso
     };
-    const scope = args.ownerPersonaId ? { kind: "persona", personaId: args.ownerPersonaId, mode: "owner" } : { kind: "default" };
+    const scope = this.scopeForFile(file);
     const written = this.storeFor(scope).write(file);
     return { response: written, broadcast: [] };
   }
@@ -22755,28 +23093,18 @@ var SessionManager = class {
     this.runners.set(file.sessionId, r);
     return r;
   }
-  // ---------------- persona / listener sub-session 专用 API ----------------
+  // ---------------- scope-explicit sub-session API ----------------
   //
-  // PersonaManager 是 SessionManager 之上的薄编排层，listener sub-session 的持久化
-  // （SessionFile）仍由 SessionManager 持有。区别于普通 / owner session：
-  //   - SessionFile 落到 <dataDir>/sessions/<personaId>/listener/（拓扑分类）
-  //   - reducer state.subSessionMeta.idleKillEnabled = true（turn_end 自动 idle-kill）
-  //   - sessionId 由 PersonaManager 派生（personaId-<tokenHash>），不走自动 newSessionId
+  // 区别于 owner / default 单 sessionId 入口，这些 API 接 SessionScope 参数 ——
+  // 调用方（PersonaManager / observer 等）明确传 scope，由 storeFor 路由到正确目录:
+  //   - {kind:'persona', personaId, mode:'guest', capId} → guests/<capId>/，meta={idleKill:true, sandbox}
+  //   - {kind:'persona', personaId, mode:'owner'}       → owner/，meta={idleKill:false}
   //
-  // 这些 API 接 SessionScope 参数（不再是单参 agentId）—— transport 始终明确传
-  // {kind:'persona', personaId, mode:'listener'}，与 owner / default 分类隔离。
+  // SubSessionMeta 由 scope → metaFromScope 派生，不进 SessionFile schema。
   /** 按 scope 读取 SessionFile；不存在返回 null */
   readForScope(sessionId, scope) {
     return this.storeFor(scope).read(sessionId);
   }
-  /**
-   * 列出指定 persona 在指定 mode 下的所有 SessionFile。
-   * persona:listSubSessions RPC 入口（mode='listener'）；
-   * 路径下还未写过任何 session 时 list() 返回空数组（SessionStore.list 内部 ENOENT 处理）
-   */
-  listPersonaSessions(personaId, mode) {
-    return this.storeFor({ kind: "persona", personaId, mode }).list();
-  }
   /**
    * 创建 sub-session 的 SessionFile + 准备 runner（不 spawn）。
    * SubSessionMeta 不进 SessionFile schema，运行时由 scope → metaFromScope 派生。
@@ -22921,7 +23249,7 @@ var SessionManager = class {
     return { response: { ok: true }, broadcast };
   }
   /**
-   * 改 SessionFile.label（用于 listener-bound chat:rename RPC）。
+   * 改 SessionFile.label（scope-explicit sub-session 重命名入口）。
    * 不存在抛 SESSION_NOT_FOUND。
    */
   renameForScope(args) {
@@ -22936,7 +23264,7 @@ var SessionManager = class {
     store.write({ ...file, label: args.label });
   }
   /**
-   * 删除 listener-scope sub-session（用于 chat:delete RPC）。
+   * 删除 scope-explicit sub-session。
    * - 若 runner 存在：走 reducer 'delete' command 收尾（SIGKILL + 文件 unlink + broadcast）
    * - 若 runner 不存在：直接删 scope store 文件 + 广播 session:deleted
    * 不存在抛 SESSION_NOT_FOUND。
@@ -23204,7 +23532,7 @@ var SessionManager = class {
 
 // src/persona/store.ts
 var fs6 = __toESM(require("fs"), 1);
-var path7 = __toESM(require("path"), 1);
+var path8 = __toESM(require("path"), 1);
 init_protocol();
 var DEFAULT_SETTINGS = {
   permissions: {
@@ -23233,13 +23561,13 @@ var PersonaStore = class {
   }
   root;
   personaDir(personaId) {
-    return path7.join(this.root, safeFileName(personaId));
+    return path8.join(this.root, safeFileName(personaId));
   }
   metaPath(personaId) {
-    return path7.join(this.personaDir(personaId), ".clawd", "persona.json");
+    return path8.join(this.personaDir(personaId), ".clawd", "persona.json");
   }
   claudeMdPath(personaId) {
-    return path7.join(this.personaDir(personaId), "CLAUDE.md");
+    return path8.join(this.personaDir(personaId), "CLAUDE.md");
   }
   /**
    * Sandbox settings 落盘路径 —— 故意放在 `.clawd/` 而不是 `.claude/`，让 CC 的
@@ -23249,11 +23577,11 @@ var PersonaStore = class {
    * 加载 persona 人格，只有 listener 多一层 OS sandbox。
    */
   sandboxSettingsPath(personaId) {
-    return path7.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
+    return path8.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
   }
   write(persona, personality) {
     const dir = this.personaDir(persona.personaId);
-    fs6.mkdirSync(path7.join(dir, ".clawd"), { recursive: true });
+    fs6.mkdirSync(path8.join(dir, ".clawd"), { recursive: true });
     this.atomicWrite(this.claudeMdPath(persona.personaId), personality);
     this.atomicWrite(
       this.sandboxSettingsPath(persona.personaId),
@@ -23271,6 +23599,10 @@ var PersonaStore = class {
     const p2 = this.metaPath(personaId);
     if (!fs6.existsSync(p2)) return null;
     const raw = JSON.parse(fs6.readFileSync(p2, "utf8"));
+    if (raw && typeof raw === "object" && "tokenMap" in raw) {
+      delete raw.tokenMap;
+      this.atomicWrite(p2, JSON.stringify(raw, null, 2));
+    }
     return PersonaFileSchema.parse(raw);
   }
   has(personaId) {
@@ -23296,48 +23628,12 @@ var PersonaStore = class {
   }
   /** Persona 私有 skills 目录路径：<personaDir>/.claude/skills */
   skillsDir(personaId) {
-    return path7.join(this.personaDir(personaId), ".claude", "skills");
-  }
-  /**
-   * Claude Code 项目级 settings 路径：`<personaDir>/.claude/settings.json`。
-   * 这里只读 `enabledPlugins` 字段，由 owner 通过 CC `/plugin` 之类命令维护，daemon 不写。
-   */
-  claudeSettingsPath(personaId) {
-    return path7.join(this.personaDir(personaId), ".claude", "settings.json");
-  }
-  /**
-   * 读取 persona 的 `.claude/settings.json` 中 `enabledPlugins` map，把 value === true
-   * 的 key 转成 `{ id }[]` 给 UI 做只读展示。
-   *
-   * 兜底范围（来自老板规则：不要无事实依据的兜底）：
-   *   - 文件不存在 → []（plugin 未被启用是合法初始态）
-   *   - JSON 解析失败 → []（owner 手改文件，schema 漂移交给 UI 兜底）
-   *   - `enabledPlugins` 字段缺失 / 非 object → []
-   *   - 单 value 非 boolean → 跳过该 entry
-   * 其他错误（fs 权限等）原样抛出，由上层 handler 转 ws error 帧。
-   */
-  readEnabledPlugins(personaId) {
-    const p2 = this.claudeSettingsPath(personaId);
-    if (!fs6.existsSync(p2)) return [];
-    let raw;
-    try {
-      raw = JSON.parse(fs6.readFileSync(p2, "utf8"));
-    } catch {
-      return [];
-    }
-    if (!raw || typeof raw !== "object") return [];
-    const enabled = raw.enabledPlugins;
-    if (!enabled || typeof enabled !== "object" || Array.isArray(enabled)) return [];
-    const out = [];
-    for (const [id, value] of Object.entries(enabled)) {
-      if (value === true && id.length > 0) out.push({ id });
-    }
-    return out;
+    return path8.join(this.personaDir(personaId), ".claude", "skills");
   }
   list() {
     if (!fs6.existsSync(this.root)) return [];
     return fs6.readdirSync(this.root).filter((name) => {
-      return fs6.existsSync(path7.join(this.root, name, ".clawd", "persona.json"));
+      return fs6.existsSync(path8.join(this.root, name, ".clawd", "persona.json"));
     });
   }
   remove(personaId) {
@@ -23362,12 +23658,19 @@ var PersonaRegistry = class {
   }
   store;
   cache = /* @__PURE__ */ new Map();
-  /** 从 store 全量重建缓存（boot 时 + 测试 setup 时） */
+  /**
+   * 从 store 全量重建缓存（boot 时 + 测试 setup 时）。
+   * 单个 persona 读失败（损坏的 persona.json / schema 不匹配）不应阻塞 daemon 启动 ——
+   * try/catch 隔离，让其它 persona 仍能加载。
+   */
   reload() {
     this.cache.clear();
     for (const id of this.store.list()) {
-      const p2 = this.store.read(id);
-      if (p2) this.cache.set(p2.personaId, p2);
+      try {
+        const p2 = this.store.read(id);
+        if (p2) this.cache.set(p2.personaId, p2);
+      } catch {
+      }
     }
   }
   get(personaId) {
@@ -23383,21 +23686,6 @@ var PersonaRegistry = class {
   list() {
     return Array.from(this.cache.values());
   }
-  /**
-   * file-sharing HTTP auth-context 用的逆向查表：只有 Bearer token，没有 personaId。
-   * 线性扫所有 persona.tokenMap 找到第一条 ok 命中的；revoked / non-public persona 跳过。
-   * persona 数量通常 < 100，性能可忽略。
-   */
-  findByToken(token) {
-    if (!token) return null;
-    for (const persona of this.cache.values()) {
-      if (!persona.public) continue;
-      const entry = persona.tokenMap?.[token];
-      if (!entry || entry.revoked) continue;
-      return { personaId: persona.personaId, label: entry.label };
-    }
-    return null;
-  }
 };
 
 // src/persona/manager.ts
@@ -23691,9 +23979,6 @@ var PersonaManager = class {
       model: args.model,
       public: args.public ?? false,
       iconKey: args.iconKey,
-      // 初始化空 token 集合；后续由 issueToken / revokeToken 维护，
-      // file-sharing HTTP Bearer 鉴权用 PersonaRegistry.findByToken 反查
-      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -23730,65 +24015,28 @@ var PersonaManager = class {
   listSkills(personaId) {
     return listSkillsForDir(this.deps.store.skillsDir(personaId), "project");
   }
-  /**
-   * 读取 persona `.claude/settings.json` 中已启用的插件列表（value === true 的 key）。
-   * 文件不存在 / 解析失败 / 字段缺失 → 空数组。供 persona:get handler 拼响应。
-   */
-  listEnabledPlugins(personaId) {
-    return this.deps.store.readEnabledPlugins(personaId);
-  }
   /** 读 sandbox-settings.json；不存在 / 损坏返回 null。供 persona:get handler 拼响应。 */
   readSandboxSettings(personaId) {
     return this.deps.store.readSandboxSettings(personaId);
   }
   /**
    * 删除 persona。
-   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录。
+   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录,
+   * Phase 2 capability platform 新布局下含 .clawd/sessions/owner/ +
+   * .clawd/sessions/guests/<capId>/, rmSync recursive force 一锅清.
+   *
+   * ⚠️ TODO (Phase 3+ design gap, reviewer P1 flagged):
+   * ~/.clawd/capabilities.json 里若有 cap.grants 含本 personaId, grant 会变成
+   * 悬空引用 (guest 仍能持 token 接入, 但调依赖该 persona 的 RPC 会 fail).
+   * 选项: (A) 这里扫所有 cap 过滤掉该 personaId 的 grant; (B) revoke 所有 grant
+   * 含该 personaId 的 cap. 当前因 cleanupGuestSessionsForCapability 用 rmSync
+   * force=true 吞 ENOENT 不会 crash, 但 UI CapabilityManagerDrawer 会展示
+   * "无效的 persona" grant. Phase 3 加 cross-reference 矩阵后正式实现.
    */
   delete(personaId) {
     this.deps.store.remove(personaId);
     this.deps.registry.remove(personaId);
   }
-  /**
-   * 生成 32-char base64url token 并写入 tokenMap，给 file-sharing HTTP Bearer
-   * 鉴权用（PersonaRegistry.findByToken 反查 personaId/label）。
-   */
-  issueToken(personaId, label) {
-    const existing = this.deps.registry.get(personaId);
-    if (!existing) throw new Error(`persona not found: ${personaId}`);
-    const token = import_node_crypto3.default.randomBytes(24).toString("base64url");
-    const entry = {
-      label,
-      issuedAt: Date.now(),
-      revoked: false
-    };
-    const updated = {
-      ...existing,
-      tokenMap: { ...existing.tokenMap ?? {}, [token]: entry },
-      updatedAt: Date.now()
-    };
-    this.deps.store.writeMeta(updated);
-    this.deps.registry.set(updated);
-    return { token, persona: updated };
-  }
-  /** 标记 token 为 revoked（保留条目用于审计）；不存在的 token 抛错。 */
-  revokeToken(personaId, token) {
-    const existing = this.deps.registry.get(personaId);
-    if (!existing) throw new Error(`persona not found: ${personaId}`);
-    const tokenEntry = existing.tokenMap?.[token];
-    if (!tokenEntry) throw new Error(`token not found in persona ${personaId}`);
-    const updated = {
-      ...existing,
-      tokenMap: {
-        ...existing.tokenMap ?? {},
-        [token]: { ...tokenEntry, revoked: true }
-      },
-      updatedAt: Date.now()
-    };
-    this.deps.store.writeMeta(updated);
-    this.deps.registry.set(updated);
-    return updated;
-  }
   /**
    * label 转 4-16 char slug。优先用 `persona-<slug>`；若 slug 已被占用，追加 4 char
    * base64url 随机后缀直到不撞为止（最多 5 次，理论冲突 ≈ 2^-24，留个 panic 上限）。
@@ -23808,7 +24056,7 @@ var PersonaManager = class {
 
 // src/persona/seed.ts
 var fs8 = __toESM(require("fs"), 1);
-var path9 = __toESM(require("path"), 1);
+var path10 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var import_meta = {};
 var DEFAULT_PERSONAS = [
@@ -23844,14 +24092,14 @@ var DEFAULT_PERSONAS = [
 function findDefaultsRoot() {
   const candidates = [];
   try {
-    const here = path9.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    candidates.push(path9.resolve(here, "defaults"));
-    candidates.push(path9.resolve(here, "persona-defaults"));
+    const here = path10.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    candidates.push(path10.resolve(here, "defaults"));
+    candidates.push(path10.resolve(here, "persona-defaults"));
   } catch {
   }
   if (process.argv[1]) {
-    const argvDir = path9.dirname(process.argv[1]);
-    candidates.push(path9.resolve(argvDir, "persona-defaults"));
+    const argvDir = path10.dirname(process.argv[1]);
+    candidates.push(path10.resolve(argvDir, "persona-defaults"));
   }
   for (const c of candidates) {
     try {
@@ -23868,7 +24116,7 @@ function seedDefaultPersonas(args) {
       args.logger.info("persona.seed.skip", { personaId: entry.personaId, reason: "exists" });
       continue;
     }
-    const bundleDir = path9.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path10.join(args.defaultsRoot, entry.personaId);
     if (!fs8.existsSync(bundleDir)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -23877,7 +24125,7 @@ function seedDefaultPersonas(args) {
       });
       continue;
     }
-    const claudeMdPath = path9.join(bundleDir, "CLAUDE.md");
+    const claudeMdPath = path10.join(bundleDir, "CLAUDE.md");
     if (!fs8.existsSync(claudeMdPath)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -23894,7 +24142,6 @@ function seedDefaultPersonas(args) {
       model: entry.model,
       public: entry.public,
       iconKey: entry.iconKey,
-      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -23906,8 +24153,8 @@ function seedDefaultPersonas(args) {
 function copyBundleExtras(srcDir, dstDir) {
   for (const entry of fs8.readdirSync(srcDir, { withFileTypes: true })) {
     if (entry.name === "CLAUDE.md" || entry.name === ".clawd") continue;
-    const srcPath = path9.join(srcDir, entry.name);
-    const dstPath = path9.join(dstDir, entry.name);
+    const srcPath = path10.join(srcDir, entry.name);
+    const dstPath = path10.join(dstDir, entry.name);
     if (entry.isDirectory()) {
       fs8.cpSync(srcPath, dstPath, { recursive: true, dereference: true });
     } else if (entry.isFile()) {
@@ -25275,6 +25522,7 @@ var import_sender = __toESM(require_sender(), 1);
 var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
+var wrapper_default = import_websocket.default;
 
 // src/transport/local-ws-server.ts
 var import_node_http = __toESM(require("http"), 1);
@@ -25289,6 +25537,9 @@ var LocalWsServer = class {
   httpServer = null;
   frameHandler = null;
   clients = /* @__PURE__ */ new Map();
+  // Task 1.7 capability platform：capId → Set<clientId>，撤销时 O(1) 找到该 cap 的
+  // 所有活跃连接做关闭级联（Task 1.10）。同一 cap 可能多端同时连（多设备 / 多 tab）。
+  capabilityIdToClients = /* @__PURE__ */ new Map();
   logger;
   pingIntervalMs;
   async start() {
@@ -25379,6 +25630,49 @@ var LocalWsServer = class {
       this.safeSend(c.ws, frame);
     }
   }
+  // Task 1.9 capability platform：仅广播给 owner 连接（跳过 guest ws）。
+  // 用于 capability:tokenIssued / capability:tokenDeleted 等 owner-only push frame——
+  // guest 没必要也无法消费这类管理帧。noAuth localhost ws 没有 ctx, 视作 owner.
+  broadcastToOwners(frame) {
+    const gate = this.opts.authGate;
+    for (const c of this.clients.values()) {
+      if (gate && !gate.isAuthed(c.handle.id)) continue;
+      if (c.ctx && c.ctx.principal.kind !== "owner") continue;
+      this.safeSend(c.ws, frame);
+    }
+  }
+  // capability platform v3 inbox 重写: 推给某条 cap channel 的两端 ws.
+  //   - 所有 owner ws (owner 看自家所有 channel)
+  //   - 该 capabilityId 的所有 guest ws (该 cap 持有人的多端/多 tab)
+  // 一次调用同时推两端, inbox:event push 帧由此走.
+  broadcastToCapabilityChannel(capabilityId, frame) {
+    this.broadcastToOwners(frame);
+    const set = this.capabilityIdToClients.get(capabilityId);
+    if (!set) return;
+    for (const id of set) {
+      const c = this.clients.get(id);
+      if (!c) continue;
+      this.safeSend(c.ws, frame);
+    }
+  }
+  // Phase 4 capability platform DM: 广播到指定 principal 的所有活跃 ws.
+  //   principalId === ownerPrincipalId  → 同 broadcastToOwners (所有 owner ws)
+  //   principalId === 'owner' sentinel  → 同上（向后兼容遗留 caller / 协议层 sentinel）
+  //   principalId === 'cap_xxx'         → 该 capability 的所有 guest ws (多端 / 多 tab)
+  // 用于 DM inbox:event 路由: from + to 两侧各播一次, 让双方 UI 实时看到 thread 更新.
+  broadcastToPrincipal(principalId, frame) {
+    if (principalId === "owner" || principalId === this.opts.ownerPrincipalId) {
+      this.broadcastToOwners(frame);
+      return;
+    }
+    const set = this.capabilityIdToClients.get(principalId);
+    if (!set) return;
+    for (const id of set) {
+      const c = this.clients.get(id);
+      if (!c) continue;
+      this.safeSend(c.ws, frame);
+    }
+  }
   firstSubscriber(sessionId) {
     for (const c of this.clients.values()) {
       if (c.handle.subscribedSessions.has(sessionId)) return c.handle;
@@ -25400,6 +25694,40 @@ var LocalWsServer = class {
     if (!c) return;
     this.safeSend(c.ws, frame);
   }
+  // Task 1.7 capability platform：AuthGate.onAuthed 回调里调本方法，把 ConnectionContext
+  // 绑到 client；guest 连接同时进 capId 索引（Task 1.10 撤销级联用）。
+  attachClientContext(clientId, ctx) {
+    const c = this.clients.get(clientId);
+    if (!c) return;
+    c.ctx = ctx;
+    if (ctx.capabilityId) {
+      let set = this.capabilityIdToClients.get(ctx.capabilityId);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        this.capabilityIdToClients.set(ctx.capabilityId, set);
+      }
+      set.add(clientId);
+    }
+  }
+  // 测试 / Task 1.8 dispatcher 用：拿 client 当前 ConnectionContext（null = 未鉴权 / noAuth）
+  getClientContext(clientId) {
+    return this.clients.get(clientId)?.ctx ?? null;
+  }
+  // Task 1.10 撤销级联：关闭某 capability 的所有活跃 ws 连接。close code 4401
+  // 让客户端识别 'capability revoked' 而非普通断连。
+  closeConnectionsByCapability(capabilityId, code = 4401, reason = "TOKEN_REVOKED") {
+    const set = this.capabilityIdToClients.get(capabilityId);
+    if (!set) return;
+    const ids = [...set];
+    for (const id of ids) {
+      const c = this.clients.get(id);
+      if (!c) continue;
+      try {
+        c.ws.close(code, reason);
+      } catch {
+      }
+    }
+  }
   // URL path 路由：'/' → 主连接路径；其他 → close 4404
   routeConnection(socket, req) {
     const remoteAddress = req?.socket?.remoteAddress;
@@ -25434,7 +25762,7 @@ var LocalWsServer = class {
       } catch {
       }
     }, this.pingIntervalMs);
-    this.clients.set(id, { handle, ws: socket, pingTimer });
+    this.clients.set(id, { handle, ws: socket, pingTimer, ctx: null });
     this.logger?.info("client connected", { clientId: id, total: this.clients.size, remoteAddress });
     const authGate = this.opts.authGate;
     let authed = true;
@@ -25458,6 +25786,12 @@ var LocalWsServer = class {
     socket.on("close", () => {
       const c = this.clients.get(id);
       if (c?.pingTimer) clearInterval(c.pingTimer);
+      const capId = c?.ctx?.capabilityId;
+      if (capId) {
+        const set = this.capabilityIdToClients.get(capId);
+        set?.delete(id);
+        if (set && set.size === 0) this.capabilityIdToClients.delete(capId);
+      }
       this.clients.delete(id);
       authGate?.unregister(id);
       this.logger?.info("client disconnected", { clientId: id, remaining: this.clients.size });
@@ -25490,6 +25824,17 @@ var LocalWsServer = class {
         return;
       }
     } else if (frame.type === "auth") {
+      const token = typeof frame.token === "string" ? frame.token ?? "" : "";
+      const selfPrincipalId = typeof frame.selfPrincipalId === "string" ? frame.selfPrincipalId ?? "" : "";
+      const selfDisplayName = typeof frame.selfDisplayName === "string" ? frame.selfDisplayName ?? "" : "";
+      if (token && this.opts.tryVerifyCapabilityToken) {
+        const guestCtx = this.opts.tryVerifyCapabilityToken(
+          token,
+          selfPrincipalId || void 0,
+          selfDisplayName || void 0
+        );
+        if (guestCtx) this.attachClientContext(client.id, guestCtx);
+      }
       this.safeSend(this.clients.get(client.id).ws, { type: "auth:ok" });
       return;
     }
@@ -25606,15 +25951,31 @@ var AuthGate = class {
       this.markFailed(handle.id);
       return frame.type === "auth" ? "consumed" : "reject";
     }
-    if (!this.opts.expectedToken) {
-      this.opts.closeConnection(handle, 1008, "auth not configured");
-      this.markFailed(handle.id);
-      return "consumed";
-    }
-    if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
-      this.opts.closeConnection(handle, 1008, "auth failed");
-      this.markFailed(handle.id);
-      return "consumed";
+    let ctx = null;
+    if (this.opts.authenticate) {
+      const r = this.opts.authenticate(
+        parsed.data.token,
+        parsed.data.selfPrincipalId,
+        parsed.data.selfDisplayName
+      );
+      if (!r.ok) {
+        this.opts.closeConnection(handle, 4401, r.code);
+        this.markFailed(handle.id);
+        return "consumed";
+      }
+      ctx = r.context;
+    } else {
+      if (!this.opts.expectedToken) {
+        this.opts.closeConnection(handle, 1008, "auth not configured");
+        this.markFailed(handle.id);
+        return "consumed";
+      }
+      if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
+        this.opts.closeConnection(handle, 1008, "auth failed");
+        this.markFailed(handle.id);
+        return "consumed";
+      }
+      ctx = this.opts.buildOwnerContext?.() ?? null;
     }
     if (st.timer != null) {
       const clear = this.opts.clearTimer ?? ((h) => clearTimeout(h));
@@ -25622,6 +25983,7 @@ var AuthGate = class {
     }
     st.authed = true;
     st.timer = null;
+    if (ctx && this.opts.onAuthed) this.opts.onAuthed(handle, ctx);
     this.opts.sendOk(handle, { type: "auth:ok" });
     return "consumed";
   }
@@ -25657,7 +26019,7 @@ var AuthContextResolver = class {
   }
   opts;
   /**
-   * 从 `Authorization` 头解析。null = 无凭证 / 不识别 / revoked，调用方一律 401。
+   * 从 `Authorization` 头解析。null = 无凭证 / 不识别，调用方一律 401。
    * remoteAddress 用于 isLoopback 判定（loopback = 127.0.0.1 / ::1 / ::ffff:127.0.0.1）。
    */
   resolveFromHeader(authHeader, remoteAddress) {
@@ -25667,15 +26029,6 @@ var AuthContextResolver = class {
     if (this.opts.ownerToken && constantTimeEqual2(token, this.opts.ownerToken)) {
       return { role: "owner", isLoopback };
     }
-    const personalHit = this.opts.personaRegistry.findByToken(token);
-    if (personalHit) {
-      return {
-        role: "personal",
-        personaId: personalHit.personaId,
-        label: personalHit.label,
-        isLoopback
-      };
-    }
     return null;
   }
 };
@@ -25697,206 +26050,753 @@ function constantTimeEqual2(a, b2) {
   return diff2 === 0;
 }
 
-// src/transport/http-router.ts
-var import_node_fs14 = __toESM(require("fs"), 1);
-var import_node_path16 = __toESM(require("path"), 1);
+// ../protocol/src/index.ts
+init_runtime();
 
-// src/attachment/group.ts
-var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path14 = __toESM(require("path"), 1);
-var import_node_crypto4 = __toESM(require("crypto"), 1);
-init_protocol();
-var GroupFileStore = class {
-  dataDir;
-  logger;
-  cache = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.dataDir = opts.dataDir;
-    this.logger = opts.logger;
-  }
-  rootForScope(scope) {
-    return import_node_path14.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
+// src/transport/connection-context.ts
+function ownerContext(ownerPrincipalId, displayName) {
+  return {
+    principal: makeOwnerPrincipal(ownerPrincipalId, displayName),
+    grants: [{ resource: { type: "*" }, actions: ["admin"] }]
+  };
+}
+function guestContext(cap) {
+  return {
+    principal: { id: cap.id, kind: "guest", displayName: cap.displayName },
+    grants: cap.grants,
+    capabilityId: cap.id
+  };
+}
+function authenticate(token, deps) {
+  if (!token) return { ok: false, code: "NO_TOKEN" };
+  if (deps.isOwnerToken(token)) {
+    return { ok: true, context: ownerContext(deps.ownerPrincipalId, deps.ownerDisplayName) };
+  }
+  if (!deps.capabilityRegistry) return { ok: false, code: "BAD_TOKEN" };
+  const v2 = deps.capabilityRegistry.verifyToken(token);
+  if (!v2.ok) {
+    if (v2.code === "TOKEN_INVALID") return { ok: false, code: "BAD_TOKEN" };
+    return { ok: false, code: v2.code };
+  }
+  if (deps.selfPrincipalId && deps.selfDisplayName && deps.onGuestHello) {
+    try {
+      deps.onGuestHello(v2.capability.id, deps.selfPrincipalId, deps.selfDisplayName);
+    } catch (e) {
+      if (e.message === "TOKEN_SHARED_LEAK") {
+        return { ok: false, code: "TOKEN_REVOKED" };
+      }
+      throw e;
+    }
   }
-  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
-  filePath(scope, sessionId) {
-    return import_node_path14.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
+  return { ok: true, context: guestContext(v2.capability) };
+}
+
+// src/permission/capability-store.ts
+var fs15 = __toESM(require("fs"), 1);
+var path18 = __toESM(require("path"), 1);
+var CAPABILITIES_FILE_NAME = "capabilities.json";
+var FILE_VERSION = 1;
+var CapabilityStore = class {
+  constructor(dataDir) {
+    this.dataDir = dataDir;
+    fs15.mkdirSync(dataDir, { recursive: true });
+    this.cache = this.readFromDisk();
   }
-  cacheKey(scope, sessionId) {
-    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
+  dataDir;
+  cache;
+  list() {
+    return [...this.cache];
   }
-  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
-  readFile(scope, sessionId) {
-    const file = this.filePath(scope, sessionId);
+  upsert(cap) {
+    const idx = this.cache.findIndex((c) => c.id === cap.id);
+    if (idx >= 0) {
+      this.cache[idx] = cap;
+    } else {
+      this.cache.push(cap);
+    }
+    this.flush();
+  }
+  remove(id) {
+    const next = this.cache.filter((c) => c.id !== id);
+    if (next.length === this.cache.length) return;
+    this.cache = next;
+    this.flush();
+  }
+  filePath() {
+    return path18.join(this.dataDir, CAPABILITIES_FILE_NAME);
+  }
+  readFromDisk() {
+    const file = this.filePath();
+    let raw;
     try {
-      const raw = import_node_fs13.default.readFileSync(file, "utf8");
-      const parsed = JSON.parse(raw);
-      if (!Array.isArray(parsed)) {
-        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
-          file
-        });
-        return [];
-      }
-      const out = [];
-      for (const entry of parsed) {
-        const r = GroupFileEntrySchema.safeParse(entry);
-        if (r.success) out.push(r.data);
-      }
-      return out;
+      raw = fs15.readFileSync(file, "utf8");
     } catch (err) {
-      const code = err?.code;
-      if (code === "ENOENT") return [];
-      this.logger?.warn("GroupFileStore.readFile failed", {
-        file,
-        err: err.message
-      });
+      if (err?.code === "ENOENT") return [];
+      return [];
+    }
+    if (!raw.trim()) return [];
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
       return [];
     }
+    if (!parsed || typeof parsed !== "object") return [];
+    const arr = parsed.capabilities;
+    if (!Array.isArray(arr)) return [];
+    const out = [];
+    for (const item of arr) {
+      const r = CapabilitySchema.safeParse(item);
+      if (r.success) out.push(r.data);
+    }
+    return out;
   }
-  writeFile(scope, sessionId, entries) {
-    const file = this.filePath(scope, sessionId);
-    import_node_fs13.default.mkdirSync(import_node_path14.default.dirname(file), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-    import_node_fs13.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
-    import_node_fs13.default.renameSync(tmp, file);
+  flush() {
+    const content = { version: FILE_VERSION, capabilities: this.cache };
+    this.atomicWrite(this.filePath(), JSON.stringify(content, null, 2));
   }
-  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
-  list(scope, sessionId) {
-    const key = this.cacheKey(scope, sessionId);
-    const cached = this.cache.get(key);
-    if (cached) return cached.entries;
-    const entries = this.readFile(scope, sessionId);
-    this.cache.set(key, { entries, scope });
-    return entries;
+  atomicWrite(file, content) {
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    fs15.writeFileSync(tmp, content, { mode: 384 });
+    fs15.renameSync(tmp, file);
+    try {
+      fs15.chmodSync(file, 384);
+    } catch {
+    }
+  }
+};
+
+// src/permission/capability-registry.ts
+var crypto4 = __toESM(require("crypto"), 1);
+var CapabilityRegistry = class {
+  constructor(store, now = () => Date.now()) {
+    this.store = store;
+    this.now = now;
+    for (const cap of store.list()) {
+      this.bySecretHash.set(cap.secretHash, cap);
+    }
+  }
+  store;
+  now;
+  // sha256(token) → Capability
+  bySecretHash = /* @__PURE__ */ new Map();
+  list() {
+    return this.store.list();
+  }
+  verifyToken(token) {
+    if (!token) return { ok: false, code: "TOKEN_INVALID" };
+    const hash = sha256Hex(token);
+    const cap = this.bySecretHash.get(hash);
+    if (!cap) return { ok: false, code: "TOKEN_INVALID" };
+    if (cap.expiresAt && this.now() >= cap.expiresAt) {
+      return { ok: false, code: "TOKEN_EXPIRED" };
+    }
+    if (cap.maxUses && cap.usedCount >= cap.maxUses) {
+      return { ok: false, code: "TOKEN_EXHAUSTED" };
+    }
+    const updated = { ...cap, usedCount: cap.usedCount + 1 };
+    this.bySecretHash.set(hash, updated);
+    this.store.upsert(updated);
+    return { ok: true, capability: updated };
+  }
+  upsertCapability(cap) {
+    this.bySecretHash.set(cap.secretHash, cap);
+    this.store.upsert(cap);
   }
   /**
-   * upsert：
-   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
-   *     （保留首次入群人 / 入群时刻）
-   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
-   *
-   * 返回最新 entry（caller 可用来 broadcast 通知）。
+   * Hard delete：从 store 物理移除 + 从 Map 清掉 secretHash 索引。
+   * 后续 verifyToken 该 token 走 'TOKEN_INVALID' 分支（secretHash 已不在 Map）。
+   * idempotent：不存在 → null。
    */
-  upsert(scope, sessionId, input, now = Date.now()) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === input.relPath);
-    let next;
-    if (idx >= 0) {
-      const prev = entries[idx];
-      next = {
-        ...prev,
-        size: input.size,
-        mime: input.mime,
-        lastEditedAt: now,
-        stale: false
-        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
-      };
-      entries[idx] = next;
-    } else {
-      next = {
-        id: `gf-${import_node_crypto4.default.randomBytes(6).toString("base64url")}`,
-        relPath: input.relPath,
-        from: input.from,
-        label: input.label,
-        size: input.size,
-        mime: input.mime,
-        addedAt: now
-        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
-      };
-      entries.push(next);
+  delete(id) {
+    const current = this.store.list().find((c) => c.id === id);
+    if (!current) return null;
+    this.bySecretHash.delete(current.secretHash);
+    this.store.remove(id);
+    return current;
+  }
+  findById(id) {
+    return this.store.list().find((c) => c.id === id) ?? null;
+  }
+};
+function sha256Hex(s) {
+  return crypto4.createHash("sha256").update(s).digest("hex");
+}
+
+// src/permission/capability-manager.ts
+var crypto5 = __toESM(require("crypto"), 1);
+var CapabilityManager = class {
+  constructor(registry2, hooks = {}) {
+    this.registry = registry2;
+    this.hooks = hooks;
+  }
+  registry;
+  hooks;
+  list() {
+    return this.registry.list();
+  }
+  // whoami handler 用：根据 capabilityId 反查 caller 的 capability 实体。
+  // 返回 Capability 持久化形态；handler 调 stripSecretHash 后再上 wire。
+  findById(id) {
+    return this.registry.findById(id);
+  }
+  issue(args) {
+    if (!args.displayName.trim()) {
+      throw new Error("CapabilityManager.issue: displayName must be non-empty");
     }
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
-    return next;
+    const token = (this.hooks.generateToken ?? defaultGenerateToken)();
+    const id = (this.hooks.generateId ?? defaultGenerateId)();
+    const now = (this.hooks.now ?? Date.now)();
+    const cap = {
+      id,
+      secretHash: sha256Hex2(token),
+      displayName: args.displayName,
+      grants: args.grants,
+      issuedAt: now,
+      usedCount: 0,
+      ...args.expiresAt !== void 0 ? { expiresAt: args.expiresAt } : {},
+      ...args.maxUses !== void 0 ? { maxUses: args.maxUses } : {}
+    };
+    this.registry.upsertCapability(cap);
+    this.hooks.onIssued?.(cap, token);
+    return { token, capability: cap };
   }
   /**
-   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
-   * - 命中 → stale=true，UI 灰显
-   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
-   *
-   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
+   * guest 端 auth 帧捎带 selfPrincipalId/selfDisplayName 时，AuthGate.authenticate
+   * 校验 cap token 通过后调本方法把 peer 字段写回 cap：
+   *   - 首次（cap.firstUsedByPeerAt 未设）→ 写盘 + 触发 onIssued 复用 push 频道
+   *     让 owner UI 通过 capability:updated 实时拿到 peer 字段
+   *   - 重复（同 peerOwnerId）→ noop
+   *   - 冲突（不同 peerOwnerId）→ throw TOKEN_SHARED_LEAK，AuthGate 转 close 4401
    */
-  markStale(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return;
-    if (entries[idx].stale) return;
-    entries[idx] = { ...entries[idx], stale: true };
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
+  recordPeerHello(capId, args) {
+    const cap = this.registry.findById(capId);
+    if (!cap) return { changed: false };
+    if (cap.firstUsedByPeerAt != null) {
+      if (cap.peerOwnerId !== args.ownerPrincipalId) {
+        throw new Error("TOKEN_SHARED_LEAK");
+      }
+      return { changed: false };
+    }
+    const updated = {
+      ...cap,
+      peerOwnerId: args.ownerPrincipalId,
+      firstUsedByPeerAt: args.now,
+      peerDisplayName: args.displayName
+    };
+    this.registry.upsertCapability(updated);
+    this.hooks.onIssued?.(updated, "__peer_hello__");
+    return { changed: true };
   }
   /**
-   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
-   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
-   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
-   *
-   * 返回值：true=命中并删除；false=relPath 不在群里。
+   * Hard delete：从 registry / store 物理移除 capability。
+   * idempotent：不存在 → null（handler 翻译成 VALIDATION_ERROR）
+   * onDeleted hook 在 daemon/index.ts wire 负责 close 连接 + cleanup 文件 + 广播
    */
-  remove(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return false;
-    entries.splice(idx, 1);
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
-    return true;
+  delete(id) {
+    const removed = this.registry.delete(id);
+    if (!removed) return null;
+    this.hooks.onDeleted?.(removed);
+    return { capability: removed };
+  }
+};
+function defaultGenerateToken() {
+  return crypto5.randomBytes(24).toString("base64url");
+}
+function defaultGenerateId() {
+  return "cap_" + crypto5.randomBytes(6).toString("base64url");
+}
+function sha256Hex2(s) {
+  return crypto5.createHash("sha256").update(s).digest("hex");
+}
+
+// src/permission/cleanup.ts
+var fs16 = __toESM(require("fs"), 1);
+function cleanupGuestSessionsForCapability(cap, factory) {
+  const removed = [];
+  for (const g2 of cap.grants) {
+    if (g2.resource.type !== "persona") continue;
+    const dir = factory.vmGuestRoot(g2.resource.id, cap.id);
+    try {
+      fs16.rmSync(dir, { recursive: true, force: true });
+      removed.push(dir);
+    } catch {
+    }
+  }
+  return { removed };
+}
+
+// src/inbox/inbox-store.ts
+var fs17 = __toESM(require("fs"), 1);
+var path19 = __toESM(require("path"), 1);
+var INBOX_SUBDIR = "inbox";
+var InboxStore = class {
+  constructor(dataDir) {
+    this.dataDir = dataDir;
+    fs17.mkdirSync(this.dirPath(), { recursive: true });
   }
+  dataDir;
   /**
-   * 跨 session 聚合查询（spec §4 HTTP ACL：personal 视野并集）。
-   *
-   * 扫 <dataDir>/sessions/<personaId>/owner/*.group-files.json 和
-   * <dataDir>/sessions/<personaId>/listener/*.group-files.json，每文件读一份。
+   * 列出某 peer 的消息, 按 createdAt 升序.
+   * sinceCreatedAt 缺省时返回全量; 提供时仅返回 createdAt > sinceCreatedAt 的增量.
+   * 文件不存在时返回 [] (不抛, 不创建).
+   */
+  list(peerOwnerId, sinceCreatedAt) {
+    const file = this.filePath(peerOwnerId);
+    let raw;
+    try {
+      raw = fs17.readFileSync(file, "utf8");
+    } catch (err) {
+      if (err?.code === "ENOENT") return [];
+      return [];
+    }
+    const all = parseAllLines(raw);
+    if (sinceCreatedAt === void 0) return all;
+    return all.filter((m2) => m2.createdAt > sinceCreatedAt);
+  }
+  /**
+   * 列出所有 peer 的 peerOwnerId (扫目录所有 *.jsonl 文件名).
+   */
+  listAllPeerOwnerIds() {
+    const dir = this.dirPath();
+    let entries;
+    try {
+      entries = fs17.readdirSync(dir);
+    } catch (err) {
+      if (err?.code === "ENOENT") return [];
+      return [];
+    }
+    return entries.filter((name) => name.endsWith(".jsonl")).map((name) => name.slice(0, -".jsonl".length));
+  }
+  /**
+   * 追加一条消息，按 message.id 幂等去重。
+   * 双投 + 重试场景下保护 — 同 id 已存在则 no-op，不重写不覆盖。
+   */
+  append(message) {
+    const existing = this.list(message.peerOwnerId);
+    if (existing.some((m2) => m2.id === message.id)) return;
+    const file = this.filePath(message.peerOwnerId);
+    const line = JSON.stringify(message) + "\n";
+    fs17.appendFileSync(file, line, { mode: 384 });
+    try {
+      fs17.chmodSync(file, 384);
+    } catch {
+    }
+  }
+  /**
+   * 把该 peer 所有 createdAt<=upToCreatedAt 且 sender!=principalId 的消息
+   * readBy[principalId] 写成 upToCreatedAt. O(N) rewrite 整个文件.
+   * 返写入了几条.
+   */
+  markRead(peerOwnerId, principalId, upToCreatedAt) {
+    const messages = this.list(peerOwnerId);
+    let changed = 0;
+    const next = messages.map((m2) => {
+      if (m2.senderPrincipalId === principalId) return m2;
+      if (m2.createdAt > upToCreatedAt) return m2;
+      const cur = m2.readBy[principalId];
+      if (cur !== void 0 && cur >= upToCreatedAt) return m2;
+      changed++;
+      return { ...m2, readBy: { ...m2.readBy, [principalId]: upToCreatedAt } };
+    });
+    if (changed === 0) return 0;
+    this.rewriteFile(peerOwnerId, next);
+    return changed;
+  }
+  /**
+   * 删整个 peer 的 jsonl (peer:remove cascade). 不存在 no-op.
+   */
+  removeByPeerOwnerId(peerOwnerId) {
+    const file = this.filePath(peerOwnerId);
+    try {
+      fs17.unlinkSync(file);
+    } catch (err) {
+      if (err?.code === "ENOENT") return;
+    }
+  }
+  rewriteFile(peerOwnerId, messages) {
+    const file = this.filePath(peerOwnerId);
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const content = messages.map((m2) => JSON.stringify(m2)).join("\n") + (messages.length > 0 ? "\n" : "");
+    fs17.writeFileSync(tmp, content, { mode: 384 });
+    fs17.renameSync(tmp, file);
+    try {
+      fs17.chmodSync(file, 384);
+    } catch {
+    }
+  }
+  dirPath() {
+    return path19.join(this.dataDir, INBOX_SUBDIR);
+  }
+  filePath(peerOwnerId) {
+    return path19.join(this.dirPath(), `${peerOwnerId}.jsonl`);
+  }
+};
+function parseAllLines(raw) {
+  const out = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const r = InboxMessageSchema.safeParse(parsed);
+    if (r.success) out.push(r.data);
+  }
+  return out;
+}
+
+// src/inbox/inbox-manager.ts
+var InboxManager = class {
+  constructor(store, broadcast) {
+    this.store = store;
+    this.broadcast = broadcast;
+  }
+  store;
+  broadcast;
+  /**
+   * 写一条消息到 peer.jsonl + broadcast 给本机所有 owner ws。
+   * 按 id 幂等：同 id 已落盘则 no-op（不广播、不重写）。
    *
-   * 复杂度 O(N sessions × N entries)，N 通常 < 100，可接受。
+   * caller 必须已通过 handler 鉴权
+   * （owner ctx 必填 args.peerOwnerId；guest ctx 由 handler 反查 peer-store）。
    */
-  listByPersona(personaId) {
-    const out = [];
-    for (const mode of ["owner", "listener"]) {
-      const scope = { kind: "persona", personaId, mode };
-      const root = this.rootForScope(scope);
-      let names;
+  postMessage(args) {
+    const beforeLen = this.store.list(args.peerOwnerId).length;
+    const msg = {
+      id: args.id,
+      peerOwnerId: args.peerOwnerId,
+      senderPrincipalId: args.senderPrincipalId,
+      text: args.text,
+      createdAt: args.createdAt,
+      readBy: {}
+    };
+    this.store.append(msg);
+    const afterLen = this.store.list(args.peerOwnerId).length;
+    if (afterLen === beforeLen) return msg;
+    this.broadcast(args.peerOwnerId, {
+      type: "inbox:event",
+      peerOwnerId: args.peerOwnerId,
+      message: msg
+    });
+    return msg;
+  }
+  list(peerOwnerId, sinceCreatedAt) {
+    return this.store.list(peerOwnerId, sinceCreatedAt);
+  }
+  /**
+   * 标已读. 返写入了几条 (sender !== self 且 createdAt <= upToCreatedAt 的消息).
+   * broadcast 已更新 readBy 的每条消息 (单帧一消息, 复用 inbox:event 通道).
+   */
+  markRead(args) {
+    const before = this.store.list(args.peerOwnerId);
+    const changed = this.store.markRead(args.peerOwnerId, args.principalId, args.upToCreatedAt);
+    if (changed === 0) return 0;
+    const after = this.store.list(args.peerOwnerId);
+    const beforeById = new Map(before.map((m2) => [m2.id, m2]));
+    for (const m2 of after) {
+      const prev = beforeById.get(m2.id);
+      if (!prev) continue;
+      if (prev.readBy[args.principalId] === m2.readBy[args.principalId]) continue;
+      this.broadcast(args.peerOwnerId, {
+        type: "inbox:event",
+        peerOwnerId: args.peerOwnerId,
+        message: m2
+      });
+    }
+    return changed;
+  }
+  /** peer:remove cascade. 删整个 peer 的 jsonl. */
+  removeChannel(peerOwnerId) {
+    this.store.removeByPeerOwnerId(peerOwnerId);
+  }
+};
+
+// src/state/received-capability-store.ts
+var fs18 = __toESM(require("fs"), 1);
+var path20 = __toESM(require("path"), 1);
+var FILE_NAME = "received-capabilities.json";
+var ReceivedCapabilityStore = class {
+  constructor(dataDir) {
+    this.dataDir = dataDir;
+  }
+  dataDir;
+  caps = /* @__PURE__ */ new Map();
+  load() {
+    this.caps.clear();
+    const file = path20.join(this.dataDir, FILE_NAME);
+    let raw;
+    try {
+      raw = fs18.readFileSync(file, "utf8");
+    } catch (err) {
+      if (err?.code !== "ENOENT") this.renameBak(file);
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      this.renameBak(file);
+      return;
+    }
+    const arr = parsed?.receivedCaps;
+    if (!Array.isArray(arr)) return;
+    for (const entry of arr) {
+      const r = ReceivedCapabilitySchema.safeParse(entry);
+      if (r.success) this.caps.set(r.data.ownerPrincipalId, r.data);
+    }
+  }
+  list() {
+    return Array.from(this.caps.values());
+  }
+  get(ownerPrincipalId) {
+    return this.caps.get(ownerPrincipalId) ?? null;
+  }
+  hasOwner(ownerPrincipalId) {
+    return this.caps.has(ownerPrincipalId);
+  }
+  upsert(cap) {
+    this.caps.set(cap.ownerPrincipalId, cap);
+    this.flush();
+  }
+  remove(ownerPrincipalId) {
+    if (!this.caps.delete(ownerPrincipalId)) return;
+    this.flush();
+  }
+  flush() {
+    const file = path20.join(this.dataDir, FILE_NAME);
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    const content = JSON.stringify(
+      { receivedCaps: Array.from(this.caps.values()) },
+      null,
+      2
+    );
+    fs18.mkdirSync(this.dataDir, { recursive: true });
+    fs18.writeFileSync(tmp, content, { mode: 384 });
+    fs18.renameSync(tmp, file);
+  }
+  renameBak(file) {
+    try {
+      fs18.renameSync(file, `${file}.bak`);
+    } catch {
+    }
+  }
+};
+
+// src/state/legacy-migration.ts
+var fs19 = __toESM(require("fs"), 1);
+var path21 = __toESM(require("path"), 1);
+var TARGETS = [
+  { src: "capabilities.json", bak: "capabilities.legacy.bak" },
+  { src: "remote-personas", bak: "remote-personas.legacy.bak" },
+  { src: "peers.json", bak: "peers.legacy.bak" }
+];
+function migrateLegacyFiles(dataDir) {
+  for (const t of TARGETS) {
+    const srcPath = path21.join(dataDir, t.src);
+    const bakPath = path21.join(dataDir, t.bak);
+    if (!fs19.existsSync(srcPath)) continue;
+    if (fs19.existsSync(bakPath)) continue;
+    try {
+      fs19.renameSync(srcPath, bakPath);
+    } catch {
+    }
+  }
+}
+
+// src/received-capability/connect-remote.ts
+var crypto6 = __toESM(require("crypto"), 1);
+var HANDSHAKE_TIMEOUT_MS = 5e3;
+var RPC_TIMEOUT_MS = 5e3;
+async function connectRemote(args) {
+  const ws = new wrapper_default(args.url);
+  await new Promise((resolve2, reject) => {
+    const onError = (e) => reject(e);
+    ws.once("open", () => {
+      ws.off("error", onError);
+      resolve2();
+    });
+    ws.once("error", onError);
+  });
+  ws.send(
+    JSON.stringify({
+      type: "auth",
+      token: args.token,
+      selfPrincipalId: args.selfPrincipalId,
+      selfDisplayName: args.selfDisplayName
+    })
+  );
+  await new Promise((resolve2, reject) => {
+    const onMessage = (raw) => {
+      let f;
       try {
-        names = import_node_fs13.default.readdirSync(root);
-      } catch (err) {
-        const code = err?.code;
-        if (code === "ENOENT") continue;
-        continue;
+        f = JSON.parse(raw.toString());
+      } catch {
+        return;
       }
-      for (const name of names) {
-        if (!name.endsWith(".group-files.json")) continue;
-        const sessionId = name.slice(0, -".group-files.json".length);
-        if (!sessionId) continue;
-        const entries = this.list(scope, sessionId);
-        out.push({ sessionId, entries });
+      if (f.type === "auth:ok" || f.type === "ready") {
+        ws.off("message", onMessage);
+        resolve2();
+        return;
+      }
+      if (f.type === "auth:error" || f.code === 4401) {
+        ws.off("message", onMessage);
+        reject(new Error(`auth failed: ${f.message ?? f.type ?? "unknown"}`));
+      }
+    };
+    ws.on("message", onMessage);
+    setTimeout(() => {
+      ws.off("message", onMessage);
+      reject(new Error("auth handshake timeout"));
+    }, HANDSHAKE_TIMEOUT_MS);
+  });
+  function call(method, payload) {
+    const requestId = crypto6.randomUUID();
+    return new Promise((resolve2, reject) => {
+      const onMessage = (raw) => {
+        let f;
+        try {
+          f = JSON.parse(raw.toString());
+        } catch {
+          return;
+        }
+        if (f.requestId !== requestId) return;
+        ws.off("message", onMessage);
+        if (f.error || f.type?.endsWith(":error")) {
+          reject(new Error(f.message ?? f.error ?? "rpc error"));
+        } else {
+          resolve2(f);
+        }
+      };
+      ws.on("message", onMessage);
+      ws.send(JSON.stringify({ type: method, requestId, ...payload }));
+      setTimeout(() => {
+        ws.off("message", onMessage);
+        reject(new Error(`${method} timeout`));
+      }, RPC_TIMEOUT_MS);
+    });
+  }
+  return {
+    whoami: async () => {
+      const f = await call("whoami", {});
+      return {
+        ownerId: f.owner.id,
+        displayName: f.owner.displayName,
+        capabilityId: f.capability.id,
+        grants: f.capability.grants
+      };
+    },
+    close: () => {
+      try {
+        ws.close();
+      } catch {
       }
     }
-    return out;
+  };
+}
+
+// src/migrations/2026-05-20-flatten-sessions.ts
+var fs20 = __toESM(require("fs"), 1);
+var path22 = __toESM(require("path"), 1);
+var MIGRATION_FLAG_NAME = ".migration.v1.done";
+function migrateFlattenSessions(opts) {
+  const dataDir = opts.dataDir;
+  const now = opts.now ?? Date.now;
+  const sessionsDir = path22.join(dataDir, "sessions");
+  const flagPath = path22.join(sessionsDir, MIGRATION_FLAG_NAME);
+  if (existsSync4(flagPath)) {
+    return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
+  }
+  let movedBare = 0;
+  let movedVmOwner = 0;
+  let archivedListener = 0;
+  const defaultDir = path22.join(sessionsDir, "default");
+  if (existsSync4(defaultDir)) {
+    for (const entry of readdirSafe(defaultDir)) {
+      if (!entry.endsWith(".json")) continue;
+      const src = path22.join(defaultDir, entry);
+      const dst = path22.join(sessionsDir, entry);
+      fs20.renameSync(src, dst);
+      movedBare += 1;
+    }
+    rmdirIfEmpty(defaultDir);
+  }
+  for (const pid of readdirSafe(sessionsDir)) {
+    const personaDir = path22.join(sessionsDir, pid);
+    if (!isDir(personaDir)) continue;
+    if (pid === "default") continue;
+    const ownerSrc = path22.join(personaDir, "owner");
+    if (existsSync4(ownerSrc) && isDir(ownerSrc)) {
+      const ownerDst = path22.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
+      fs20.mkdirSync(ownerDst, { recursive: true });
+      for (const file of readdirSafe(ownerSrc)) {
+        if (!file.endsWith(".json")) continue;
+        fs20.renameSync(path22.join(ownerSrc, file), path22.join(ownerDst, file));
+        movedVmOwner += 1;
+      }
+      rmdirIfEmpty(ownerSrc);
+    }
+    const listenerSrc = path22.join(personaDir, "listener");
+    if (existsSync4(listenerSrc) && isDir(listenerSrc)) {
+      const archiveDst = path22.join(dataDir, ".legacy", `listener-${pid}`);
+      fs20.mkdirSync(archiveDst, { recursive: true });
+      for (const file of readdirSafe(listenerSrc)) {
+        if (!file.endsWith(".json")) continue;
+        fs20.renameSync(path22.join(listenerSrc, file), path22.join(archiveDst, file));
+        archivedListener += 1;
+      }
+      rmdirIfEmpty(listenerSrc);
+    }
+    rmdirIfEmpty(personaDir);
+  }
+  fs20.mkdirSync(sessionsDir, { recursive: true });
+  fs20.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
+  return {
+    skipped: false,
+    flagWritten: true,
+    movedBare,
+    movedVmOwner,
+    archivedListener
+  };
+}
+function existsSync4(p2) {
+  try {
+    fs20.statSync(p2);
+    return true;
+  } catch {
+    return false;
   }
-};
-function personalViewable(groupStore, personaDir, personaId, absPath) {
-  const realTarget = safeRealpath(absPath);
-  if (!realTarget) {
+}
+function isDir(p2) {
+  try {
+    return fs20.statSync(p2).isDirectory();
+  } catch {
     return false;
   }
-  const personasUnion = groupStore.listByPersona(personaId);
-  for (const { entries } of personasUnion) {
-    for (const e of entries) {
-      if (e.stale) continue;
-      const realEntry = safeRealpath(import_node_path14.default.join(personaDir, e.relPath));
-      if (realEntry && realEntry === realTarget) return true;
-    }
+}
+function readdirSafe(p2) {
+  try {
+    return fs20.readdirSync(p2);
+  } catch {
+    return [];
   }
-  return false;
 }
-function safeRealpath(p2) {
+function rmdirIfEmpty(p2) {
   try {
-    return import_node_fs13.default.realpathSync(p2);
+    fs20.rmdirSync(p2);
   } catch {
-    return null;
   }
 }
 
-// src/attachment/mime.ts
+// src/transport/http-router.ts
+var import_node_fs13 = __toESM(require("fs"), 1);
 var import_node_path15 = __toESM(require("path"), 1);
+
+// src/attachment/mime.ts
+var import_node_path14 = __toESM(require("path"), 1);
 var TEXT_PLAIN = "text/plain; charset=utf-8";
 var EXT_TO_NATIVE_MIME = {
   // 图片
@@ -26003,14 +26903,14 @@ var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mk"
 ]);
 function lookupMime(filePathOrName) {
-  const ext = import_node_path15.default.extname(filePathOrName).toLowerCase();
+  const ext = import_node_path14.default.extname(filePathOrName).toLowerCase();
   if (EXT_TO_NATIVE_MIME[ext]) return EXT_TO_NATIVE_MIME[ext];
   if (TEXT_EXTENSIONS.has(ext)) return TEXT_PLAIN;
   return "application/octet-stream";
 }
 
 // src/attachment/sign-url.ts
-var import_node_crypto5 = __toESM(require("crypto"), 1);
+var import_node_crypto4 = __toESM(require("crypto"), 1);
 var HMAC_ALGO = "sha256";
 function base64urlEncode(buf) {
   const b2 = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
@@ -26027,7 +26927,7 @@ function decodeAbsPathFromUrl(encoded) {
 }
 function computeSig(secret, absPath, e) {
   const msg = e === null ? absPath : `${absPath}|${e}`;
-  return import_node_crypto5.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
+  return import_node_crypto4.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
 }
 function signUrlParts(secret, absPath, ttlSeconds, now = Date.now) {
   const e = ttlSeconds === null ? null : Math.floor(now() / 1e3) + ttlSeconds;
@@ -26062,7 +26962,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
   if (provided.length !== expected.length) {
     return { ok: false, code: "BAD_SIG" };
   }
-  if (!import_node_crypto5.default.timingSafeEqual(provided, expected)) {
+  if (!import_node_crypto4.default.timingSafeEqual(provided, expected)) {
     return { ok: false, code: "BAD_SIG" };
   }
   if (e !== null && now() / 1e3 > e) {
@@ -26083,7 +26983,7 @@ function createHttpRouter(deps) {
       sendJson(res, 200, { ok: true, version: deps.daemonVersion });
       return true;
     }
-    if (!url.pathname.startsWith("/persona/") && !url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
+    if (!url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
       return false;
     }
     if (url.pathname.startsWith("/files/") && req.method === "GET") {
@@ -26123,43 +27023,8 @@ function createHttpRouter(deps) {
       sendJson(res, 401, { code: "UNAUTHORIZED", message: "missing or invalid bearer token" });
       return true;
     }
-    const personaFilesMatch = url.pathname.match(/^\/persona\/([^/]+)\/files$/);
-    if (personaFilesMatch && req.method === "GET") {
-      const pid = personaFilesMatch[1];
-      const pathParam = url.searchParams.get("path");
-      if (!pathParam) {
-        sendJson(res, 400, { code: "INVALID_PARAM", message: "missing `path` query" });
-        return true;
-      }
-      if (!deps.personaStore || !deps.groupFileStore) {
-        sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "files endpoint not wired" }));
-        return true;
-      }
-      const personaDir = deps.personaStore.personaDirPath(pid);
-      const absPath = import_node_path16.default.isAbsolute(pathParam) ? pathParam : import_node_path16.default.join(personaDir, pathParam);
-      if (!import_node_path16.default.isAbsolute(pathParam) && !isContainedIn(absPath, personaDir)) {
-        sendJson(res, 400, { code: "PATH_TRAVERSAL", message: "rel path escapes personaDir" });
-        return true;
-      }
-      if (ctx.role === "personal") {
-        if (ctx.personaId !== pid) {
-          sendJson(res, 403, { code: "FORBIDDEN", message: "personal token bound to other persona" });
-          return true;
-        }
-        if (!personalViewable(deps.groupFileStore, personaDir, pid, absPath)) {
-          sendJson(res, 403, { code: "FORBIDDEN", message: "path not in personal viewable scope" });
-          return true;
-        }
-      }
-      streamFile(res, absPath, deps.logger);
-      return true;
-    }
     const sessionFilesMatch = url.pathname.match(/^\/session\/([^/]+)\/files$/);
     if (sessionFilesMatch && req.method === "GET") {
-      if (ctx.role !== "owner") {
-        sendJson(res, 403, { code: "FORBIDDEN", message: "direct session files are owner-only" });
-        return true;
-      }
       const sid = sessionFilesMatch[1];
       const pathParam = url.searchParams.get("path");
       if (!pathParam) {
@@ -26167,7 +27032,7 @@ function createHttpRouter(deps) {
         return true;
       }
       let absPath;
-      if (import_node_path16.default.isAbsolute(pathParam)) {
+      if (import_node_path15.default.isAbsolute(pathParam)) {
         absPath = pathParam;
       } else if (deps.sessionStore) {
         const file = deps.sessionStore.read(sid);
@@ -26175,7 +27040,7 @@ function createHttpRouter(deps) {
           sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sid} not found` });
           return true;
         }
-        absPath = import_node_path16.default.join(file.cwd, pathParam);
+        absPath = import_node_path15.default.join(file.cwd, pathParam);
       } else {
         sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "sessionStore not wired" }));
         return true;
@@ -26200,18 +27065,12 @@ function sendJson(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function withCtx(ctx, body) {
-  return { ...body, role: ctx.role, personaId: ctx.personaId };
-}
-function isContainedIn(abs, root) {
-  const normalized = import_node_path16.default.resolve(abs);
-  const normalizedRoot = import_node_path16.default.resolve(root);
-  if (normalized === normalizedRoot) return true;
-  return normalized.startsWith(normalizedRoot + import_node_path16.default.sep);
+  return { ...body, role: ctx.role };
 }
 function streamFile(res, absPath, logger) {
   let stat;
   try {
-    stat = import_node_fs14.default.statSync(absPath);
+    stat = import_node_fs13.default.statSync(absPath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -26226,7 +27085,7 @@ function streamFile(res, absPath, logger) {
     return;
   }
   const mime = lookupMime(absPath);
-  const basename = import_node_path16.default.basename(absPath);
+  const basename = import_node_path15.default.basename(absPath);
   res.writeHead(200, {
     "Content-Type": mime,
     "Content-Length": String(stat.size),
@@ -26234,7 +27093,7 @@ function streamFile(res, absPath, logger) {
     // 防止浏览器把任意 mime 当 html 渲染
     "X-Content-Type-Options": "nosniff"
   });
-  const stream = import_node_fs14.default.createReadStream(absPath);
+  const stream = import_node_fs13.default.createReadStream(absPath);
   stream.on("error", (err) => {
     logger?.warn("streamFile read error", { absPath, err: err.message });
     res.destroy();
@@ -26242,6 +27101,147 @@ function streamFile(res, absPath, logger) {
   stream.pipe(res);
 }
 
+// src/attachment/group.ts
+var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
+init_protocol();
+var GroupFileStore = class {
+  dataDir;
+  logger;
+  cache = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dataDir = opts.dataDir;
+    this.logger = opts.logger;
+  }
+  rootForScope(scope) {
+    return import_node_path16.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
+  }
+  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
+  filePath(scope, sessionId) {
+    return import_node_path16.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
+  }
+  cacheKey(scope, sessionId) {
+    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
+  }
+  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
+  readFile(scope, sessionId) {
+    const file = this.filePath(scope, sessionId);
+    try {
+      const raw = import_node_fs14.default.readFileSync(file, "utf8");
+      const parsed = JSON.parse(raw);
+      if (!Array.isArray(parsed)) {
+        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
+          file
+        });
+        return [];
+      }
+      const out = [];
+      for (const entry of parsed) {
+        const r = GroupFileEntrySchema.safeParse(entry);
+        if (r.success) out.push(r.data);
+      }
+      return out;
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      this.logger?.warn("GroupFileStore.readFile failed", {
+        file,
+        err: err.message
+      });
+      return [];
+    }
+  }
+  writeFile(scope, sessionId, entries) {
+    const file = this.filePath(scope, sessionId);
+    import_node_fs14.default.mkdirSync(import_node_path16.default.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    import_node_fs14.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    import_node_fs14.default.renameSync(tmp, file);
+  }
+  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
+  list(scope, sessionId) {
+    const key = this.cacheKey(scope, sessionId);
+    const cached = this.cache.get(key);
+    if (cached) return cached.entries;
+    const entries = this.readFile(scope, sessionId);
+    this.cache.set(key, { entries });
+    return entries;
+  }
+  /**
+   * upsert：
+   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
+   *     （保留首次入群人 / 入群时刻）
+   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
+   *
+   * 返回最新 entry（caller 可用来 broadcast 通知）。
+   */
+  upsert(scope, sessionId, input, now = Date.now()) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === input.relPath);
+    let next;
+    if (idx >= 0) {
+      const prev = entries[idx];
+      next = {
+        ...prev,
+        size: input.size,
+        mime: input.mime,
+        lastEditedAt: now,
+        stale: false
+        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
+      };
+      entries[idx] = next;
+    } else {
+      next = {
+        id: `gf-${import_node_crypto5.default.randomBytes(6).toString("base64url")}`,
+        relPath: input.relPath,
+        from: input.from,
+        label: input.label,
+        size: input.size,
+        mime: input.mime,
+        addedAt: now
+        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
+      };
+      entries.push(next);
+    }
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries });
+    return next;
+  }
+  /**
+   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
+   * - 命中 → stale=true，UI 灰显
+   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
+   *
+   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
+   */
+  markStale(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return;
+    if (entries[idx].stale) return;
+    entries[idx] = { ...entries[idx], stale: true };
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries });
+  }
+  /**
+   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
+   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
+   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
+   *
+   * 返回值：true=命中并删除；false=relPath 不在群里。
+   */
+  remove(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return false;
+    entries.splice(idx, 1);
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries });
+    return true;
+  }
+};
+
 // src/discovery/state-file.ts
 var import_node_fs15 = __toESM(require("fs"), 1);
 var import_node_path17 = __toESM(require("path"), 1);
@@ -26918,39 +27918,44 @@ var AUTH_FILE_NAME = "auth.json";
 function authFilePath(dataDir) {
   return import_node_path22.default.join(dataDir, AUTH_FILE_NAME);
 }
-function loadOrCreateAuthFile(opts) {
+function loadOrCreateAuth(opts) {
   const file = authFilePath(opts.dataDir);
-  const generate = opts.generate ?? defaultGenerate;
-  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const existing = readAuthFile(file);
-  if (existing && existing.token && existing.signSecret) {
-    return {
-      token: existing.token,
-      signSecret: existing.signSecret,
-      createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
-    };
+  const genToken = opts.generate ?? defaultGenerateToken2;
+  const genId = opts.genOwnerPrincipalId ?? defaultGenerateOwnerPrincipalId;
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  if (existing) {
+    if (!existing.ownerPrincipalId) {
+      const ownerPrincipalId2 = genId();
+      writeAuthFile(file, {
+        token: existing.token,
+        ownerPrincipalId: ownerPrincipalId2,
+        createdAt: existing.createdAt
+      });
+      return { token: existing.token, ownerPrincipalId: ownerPrincipalId2 };
+    }
+    return { token: existing.token, ownerPrincipalId: existing.ownerPrincipalId };
   }
-  const token = existing?.token || generate();
-  const signSecret = existing?.signSecret || generate();
-  const createdAt = existing?.createdAt || now().toISOString();
-  const next = { token, signSecret, createdAt };
-  writeAuthFile(file, next);
-  return next;
+  const token = genToken();
+  const ownerPrincipalId = genId();
+  writeAuthFile(file, { token, ownerPrincipalId, createdAt: now.toISOString() });
+  return { token, ownerPrincipalId };
 }
-function defaultGenerate() {
+function defaultGenerateToken2() {
   return import_node_crypto8.default.randomBytes(32).toString("base64url");
 }
+function defaultGenerateOwnerPrincipalId() {
+  return `owner-${import_node_crypto8.default.randomUUID()}`;
+}
 function readAuthFile(file) {
   try {
     const raw = import_node_fs20.default.readFileSync(file, "utf8");
     const parsed = JSON.parse(raw);
-    if (typeof parsed?.token !== "string" || parsed.token.length === 0) {
-      return null;
-    }
+    if (typeof parsed?.token !== "string" || parsed.token.length === 0) return null;
     return {
       token: parsed.token,
-      signSecret: typeof parsed.signSecret === "string" && parsed.signSecret.length > 0 ? parsed.signSecret : void 0,
-      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0
+      ownerPrincipalId: typeof parsed.ownerPrincipalId === "string" && parsed.ownerPrincipalId.length > 0 ? parsed.ownerPrincipalId : "",
+      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date(0)).toISOString()
     };
   } catch (err) {
     const code = err?.code;
@@ -27063,10 +28068,63 @@ function forkSession(input) {
   return { forkedToolSessionId, forkedFilePath };
 }
 
+// src/permission/capability.ts
+function matchResource(grant, target) {
+  if (grant.type === "*") return true;
+  if (grant.type !== target.type) return false;
+  if (grant.id === "*") return true;
+  return grant.id === target.id;
+}
+function assertGrant(grants, resource, action) {
+  for (const g2 of grants) {
+    if (!matchResource(g2.resource, resource)) continue;
+    if (g2.actions.includes(action)) return true;
+    if (g2.actions.includes("admin")) return true;
+  }
+  return false;
+}
+
+// src/permission/session-access.ts
+function canAccessSession(ctx, sessionId, action, deps) {
+  if (ctx.principal.kind === "owner") return true;
+  const file = deps.readSession(sessionId);
+  if (!file) return true;
+  return canAccessPersona(ctx.grants, file.ownerPersonaId, action);
+}
+function canAccessPersona(grants, personaId, action) {
+  if (!personaId) return false;
+  const resource = { type: "persona", id: personaId };
+  return assertGrant(grants, resource, action);
+}
+
 // src/handlers/session.ts
+init_protocol();
 function buildSessionHandlers(deps) {
-  const { manager, observer, getAdapter: getAdapter2 } = deps;
-  const create = async (frame) => {
+  const { manager, observer, getAdapter: getAdapter2, store, ownerPrincipalId } = deps;
+  const ensureSessionAccess = (ctx, sessionId, action) => {
+    if (!ctx) return;
+    const ok = canAccessSession(ctx, sessionId, action, {
+      readSession: (sid) => store.read(sid)
+    });
+    if (!ok) {
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} session ${sessionId}`
+      );
+    }
+  };
+  const ensurePersonaAccess = (ctx, personaId, action) => {
+    if (!ctx) return;
+    if (ctx.principal.kind === "owner") return;
+    const ok = canAccessPersona(ctx.grants, personaId, action);
+    if (!ok) {
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} on persona:${personaId ?? "<none>"}`
+      );
+    }
+  };
+  const create = async (frame, _client, ctx) => {
     const args = SessionCreateArgs.parse(frame);
     if (args.ownerPersonaId) {
       const persona = deps.personaRegistry.get(args.ownerPersonaId);
@@ -27074,58 +28132,75 @@ function buildSessionHandlers(deps) {
         throw new Error(`persona not found: ${args.ownerPersonaId}`);
       }
     }
-    const { response, broadcast } = manager.create(args);
+    ensurePersonaAccess(ctx, args.ownerPersonaId, "send");
+    const creatorPrincipalId = ctx?.principal.id ?? ownerPrincipalId;
+    const { response, broadcast } = manager.create(args, creatorPrincipalId);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const list = async () => {
+  const list = async (_frame, _client, ctx) => {
     const { response } = manager.list();
+    if (ctx && ctx.principal.kind === "guest") {
+      const sessions = response.sessions ?? [];
+      const capId = ctx.capabilityId;
+      const filtered = sessions.filter((s) => canAccessPersona(ctx.grants, s.ownerPersonaId, "read")).filter((s) => s.creatorPrincipalId === capId);
+      return { response: { type: "session:list", sessions: filtered } };
+    }
     return { response: { type: "session:list", ...response } };
   };
-  const get = async (frame) => {
+  const get = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.get(args);
     return { response: { type: "session:info", ...response } };
   };
-  const update = async (frame) => {
+  const update = async (frame, _client, ctx) => {
     const args = SessionUpdateArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.update(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const del = async (frame) => {
+  const del = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.delete(args);
     return {
       response: { type: "session:deleted", sessionId: args.sessionId },
       broadcast
     };
   };
-  const send = async (frame) => {
+  const send = async (frame, _client, ctx) => {
     const args = SessionSendArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.send(args);
     return { response: { type: "session:send", ok: true }, broadcast };
   };
-  const stop = async (frame) => {
+  const stop = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.stop(args);
     return { response: { type: "session:stop", ok: true }, broadcast };
   };
-  const interrupt = async (frame) => {
+  const interrupt = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.interrupt(args);
     return { response: { type: "session:interrupt", ok: true }, broadcast };
   };
-  const rewind = async (frame) => {
+  const rewind = async (frame, _client, ctx) => {
     const args = SessionRewindArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.rewind(args);
     return { response: { type: "session:rewind", ...response }, broadcast };
   };
-  const rewindDiff = async (frame) => {
+  const rewindDiff = async (frame, _client, ctx) => {
     const args = SessionRewindDiffArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = await manager.rewindDiff(args);
     return { response: { type: "session:rewind-diff", ...response } };
   };
-  const rewindableMessageIds = async (frame) => {
+  const rewindableMessageIds = async (frame, _client, ctx) => {
     const args = SessionRewindableMessageIdsArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.rewindableMessageIds(args);
     return {
       response: { type: "session:rewindable-message-ids", ...response }
@@ -27136,19 +28211,22 @@ function buildSessionHandlers(deps) {
     const result = forkSession(args);
     return { response: { type: "session:fork", ...result } };
   };
-  const newSession = async (frame) => {
+  const newSession = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     observer.stop(args.sessionId);
     const { response, broadcast } = manager.newSession(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const resume = async (frame) => {
+  const resume = async (frame, _client, ctx) => {
     const args = SessionResumeArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.resume(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const observe = async (frame) => {
+  const observe = async (frame, _client, ctx) => {
     const args = SessionObserveArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response: file } = manager.get({ sessionId: args.sessionId });
     const sessionFile = file;
     manager.ensureSession(sessionFile);
@@ -27162,14 +28240,17 @@ function buildSessionHandlers(deps) {
     });
     return { response: { type: "session:observe", ok: true } };
   };
-  const events = async (frame) => {
+  const events = async (frame, _client, ctx) => {
     const args = SessionEventsArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.getEvents(args);
     return { response: { type: "session:events", ...response } };
   };
-  const subscribe = async (frame, client) => {
-    if (typeof frame.sessionId === "string")
+  const subscribe = async (frame, client, ctx) => {
+    if (typeof frame.sessionId === "string") {
+      ensureSessionAccess(ctx, frame.sessionId, "read");
       addSubscription(client, frame.sessionId);
+    }
     return {
       response: { type: "subscribed", sessionId: frame.sessionId }
     };
@@ -27181,8 +28262,9 @@ function buildSessionHandlers(deps) {
       response: { type: "unsubscribed", sessionId: frame.sessionId }
     };
   };
-  const pin = async (frame) => {
+  const pin = async (frame, _client, ctx) => {
     const args = SessionPinArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.pin(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
@@ -27191,13 +28273,15 @@ function buildSessionHandlers(deps) {
     const { response, broadcast } = manager.reorderPins(args);
     return { response: { type: "session:reorderPins", ...response }, broadcast };
   };
-  const answerQuestion = async (frame) => {
+  const answerQuestion = async (frame, _client, ctx) => {
     const args = AnswerQuestionArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.answerQuestion(args);
     return { response: { type: "session:answerQuestion", ...response }, broadcast };
   };
-  const cancelQuestion = async (frame) => {
+  const cancelQuestion = async (frame, _client, ctx) => {
     const args = CancelQuestionArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.cancelQuestion(args);
     return { response: { type: "session:cancelQuestion", ...response }, broadcast };
   };
@@ -27292,6 +28376,7 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/handlers/history.ts
+init_protocol();
 function buildHistoryHandlers(deps) {
   const { manager, history, store } = deps;
   const projects = async () => {
@@ -27303,17 +28388,27 @@ function buildHistoryHandlers(deps) {
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
-  const read = async (frame) => {
+  const read = async (frame, _client, ctx) => {
     const args = HistoryReadArgs.parse(frame);
     const { response: file } = manager.get({ sessionId: args.sessionId });
-    if (!file.toolSessionId) {
+    const f = file;
+    if (ctx && ctx.principal.kind === "guest") {
+      const ok = canAccessPersona(ctx.grants, f.ownerPersonaId, "read") && f.creatorPrincipalId === ctx.capabilityId;
+      if (!ok) {
+        throw new ClawdError(
+          ERROR_CODES.UNAUTHORIZED,
+          `principal guest:${ctx.principal.id} cannot read history of session ${args.sessionId}`
+        );
+      }
+    }
+    if (!f.toolSessionId) {
       return {
         response: { type: "history:read", messages: [], total: 0, offset: 0 }
       };
     }
     const res = await history.read({
-      cwd: file.cwd,
-      toolSessionId: file.toolSessionId,
+      cwd: f.cwd,
+      toolSessionId: f.toolSessionId,
       limit: args.limit,
       offset: args.offset
     });
@@ -27495,6 +28590,345 @@ function buildCapabilitiesHandlers(deps) {
   };
 }
 
+// src/handlers/capability.ts
+init_zod();
+init_protocol();
+var DeleteArgsSchema = external_exports.object({
+  capabilityId: external_exports.string().min(1)
+}).strict();
+function buildCapabilityHandlers(deps) {
+  const { manager, getShareBaseUrl } = deps;
+  const issue = async (frame) => {
+    const { type: _type, requestId: _requestId, ...rest } = frame;
+    const args = CapabilityIssueArgsSchema.parse(rest);
+    const { token, capability } = manager.issue({
+      displayName: args.displayName,
+      grants: args.grants,
+      ...args.expiresAt !== void 0 ? { expiresAt: args.expiresAt } : {},
+      ...args.maxUses !== void 0 ? { maxUses: args.maxUses } : {}
+    });
+    const base = getShareBaseUrl().replace(/\/$/, "");
+    const shareUrl = `${base}/?token=${encodeURIComponent(token)}`;
+    return {
+      response: {
+        type: "capability:issued",
+        token,
+        shareUrl,
+        capability: stripSecretHash(capability)
+      }
+    };
+  };
+  const list = async () => {
+    return {
+      response: {
+        type: "capability:list",
+        capabilities: manager.list().map(stripSecretHash)
+      }
+    };
+  };
+  const del = async (frame) => {
+    const { type: _type, requestId: _requestId, ...rest } = frame;
+    const args = DeleteArgsSchema.parse(rest);
+    const result = manager.delete(args.capabilityId);
+    if (!result) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `capability not found: ${args.capabilityId}`
+      );
+    }
+    return {
+      response: {
+        type: "capability:deleted",
+        capabilityId: args.capabilityId
+      }
+    };
+  };
+  const bindPeer = async (frame) => {
+    const { type: _type, requestId: _requestId, ...rest } = frame;
+    const args = CapabilityBindPeerArgsSchema.parse(rest);
+    try {
+      manager.recordPeerHello(args.capabilityId, {
+        ownerPrincipalId: args.peerOwnerId,
+        displayName: args.peerDisplayName,
+        now: Date.now()
+      });
+    } catch (e) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `capability:bindPeer: ${e.message}`
+      );
+    }
+    return {
+      response: { type: "capability:bindPeer:ok", capabilityId: args.capabilityId }
+    };
+  };
+  return {
+    "capability:issue": issue,
+    "capability:list": list,
+    "capability:delete": del,
+    "capability:bindPeer": bindPeer
+  };
+}
+
+// src/handlers/inbox.ts
+init_protocol();
+function resolvePeerOwnerId(ctx, argsPeerOwnerId, capManager) {
+  if (ctx.principal.kind === "owner") {
+    if (!argsPeerOwnerId) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "inbox: owner ctx requires peerOwnerId"
+      );
+    }
+    return argsPeerOwnerId;
+  }
+  if (!ctx.capabilityId) {
+    throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "inbox: guest ctx missing capabilityId");
+  }
+  const cap = capManager.findById(ctx.capabilityId);
+  if (!cap?.peerOwnerId) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `inbox: guest cap ${ctx.capabilityId} has no peerOwnerId (recordPeerHello not yet)`
+    );
+  }
+  if (argsPeerOwnerId && argsPeerOwnerId !== cap.peerOwnerId) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `inbox: guest args.peerOwnerId mismatch (cap.peerOwnerId=${cap.peerOwnerId}, args=${argsPeerOwnerId})`
+    );
+  }
+  return cap.peerOwnerId;
+}
+function buildInboxHandlers(deps) {
+  const { manager, capManager } = deps;
+  const postMessage = async (frame, _client, ctx) => {
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = InboxPostMessageArgsSchema.parse(rest);
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:postMessage: missing ConnectionContext");
+    }
+    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
+    const message = manager.postMessage({
+      peerOwnerId,
+      senderPrincipalId: ctx.principal.id,
+      text: args.text,
+      id: args.id,
+      createdAt: args.createdAt
+    });
+    return {
+      response: { type: "inbox:postMessage:ok", message }
+    };
+  };
+  const list = async (frame, _client, ctx) => {
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = InboxListArgsSchema.parse(rest);
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:list: missing ConnectionContext");
+    }
+    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
+    const messages = manager.list(peerOwnerId, args.sinceCreatedAt);
+    return {
+      response: { type: "inbox:list:ok", peerOwnerId, messages }
+    };
+  };
+  const markRead = async (frame, _client, ctx) => {
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = InboxMarkReadArgsSchema.parse(rest);
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:markRead: missing ConnectionContext");
+    }
+    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
+    const updated = manager.markRead({
+      peerOwnerId,
+      principalId: ctx.principal.id,
+      upToCreatedAt: args.upToCreatedAt
+    });
+    return {
+      response: {
+        type: "inbox:markRead:ok",
+        peerOwnerId,
+        upToCreatedAt: args.upToCreatedAt,
+        updated
+      }
+    };
+  };
+  return {
+    "inbox:postMessage": postMessage,
+    "inbox:list": list,
+    "inbox:markRead": markRead
+  };
+}
+
+// src/handlers/received-capability.ts
+init_protocol();
+function ensureOwner(ctx) {
+  if (!ctx || ctx.principal.kind !== "owner") {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      "UNAUTHORIZED: received-capability:* requires owner ctx"
+    );
+  }
+}
+function ensureGuestCtx(ctx) {
+  if (!ctx || ctx.principal.kind !== "guest" || !ctx.capabilityId) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      "UNAUTHORIZED: received-capability:autoAttach requires guest cap ctx"
+    );
+  }
+}
+function buildReceivedCapabilityHandlers(deps) {
+  const now = deps.now ?? Date.now;
+  const list = async (_frame, _client, ctx) => {
+    ensureOwner(ctx);
+    return {
+      response: {
+        type: "received-capability:list:ok",
+        receivedCaps: deps.store.list()
+      }
+    };
+  };
+  const add = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = ReceivedCapabilityAddArgsSchema.parse(rest);
+    let conn;
+    try {
+      conn = await deps.connectRemote({
+        url: args.remoteUrl,
+        token: args.token,
+        selfPrincipalId: deps.selfPrincipalId(),
+        selfDisplayName: deps.selfDisplayName()
+      });
+    } catch (e) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `INVITE_REMOTE_UNREACHABLE: ${e.message}`
+      );
+    }
+    try {
+      const wh = await conn.whoami();
+      const rc = {
+        ownerPrincipalId: wh.ownerId,
+        ownerDisplayName: wh.displayName,
+        remoteUrl: args.remoteUrl,
+        capabilityId: wh.capabilityId,
+        capabilityToken: args.token,
+        grants: wh.grants,
+        receivedAt: now()
+      };
+      deps.store.upsert(rc);
+      deps.broadcast({ type: "received-capability:added", receivedCap: rc });
+      return {
+        response: { type: "received-capability:add:ok", receivedCap: rc }
+      };
+    } finally {
+      try {
+        conn.close();
+      } catch {
+      }
+    }
+  };
+  const remove = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = ReceivedCapabilityRemoveArgsSchema.parse(rest);
+    deps.store.remove(args.ownerPrincipalId);
+    deps.broadcast({
+      type: "received-capability:removed",
+      ownerPrincipalId: args.ownerPrincipalId
+    });
+    return {
+      response: {
+        type: "received-capability:remove:ok",
+        ownerPrincipalId: args.ownerPrincipalId
+      }
+    };
+  };
+  const autoAttach = async (frame, _client, ctx) => {
+    ensureGuestCtx(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = ReceivedCapabilityAutoAttachArgsSchema.parse(rest);
+    const rc = {
+      ownerPrincipalId: args.ownerPrincipalId,
+      ownerDisplayName: args.ownerDisplayName,
+      remoteUrl: args.remoteUrl,
+      capabilityId: args.capabilityId,
+      capabilityToken: args.token,
+      grants: args.grants,
+      receivedAt: now()
+    };
+    deps.store.upsert(rc);
+    deps.broadcast({ type: "received-capability:added", receivedCap: rc });
+    return {
+      response: { type: "received-capability:autoAttach:ok" }
+    };
+  };
+  return {
+    "received-capability:list": list,
+    "received-capability:add": add,
+    "received-capability:remove": remove,
+    "received-capability:autoAttach": autoAttach
+  };
+}
+
+// src/handlers/whoami.ts
+init_protocol();
+function buildWhoamiHandler(deps) {
+  return async (_frame, _client, ctx) => {
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "whoami: missing ConnectionContext");
+    }
+    const owner = makeOwnerPrincipal(deps.ownerPrincipalId, deps.ownerDisplayName);
+    let capability;
+    if (ctx.principal.kind === "owner") {
+      capability = {
+        id: deps.ownerPrincipalId,
+        displayName: deps.ownerDisplayName,
+        grants: ctx.grants,
+        issuedAt: 0,
+        usedCount: 0
+      };
+    } else {
+      if (!ctx.capabilityId) {
+        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "whoami: guest ctx without capabilityId");
+      }
+      const cap = deps.capabilityManager.findById(ctx.capabilityId);
+      if (!cap) {
+        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, `whoami: capability not found: ${ctx.capabilityId}`);
+      }
+      capability = stripSecretHash(cap);
+    }
+    const grantedPersonas = [];
+    const isGuest = ctx.principal.kind === "guest";
+    const hasWildcard = capability.grants.some((g2) => g2.resource.type === "*");
+    if (hasWildcard) {
+      for (const id of deps.personaStore.list()) {
+        const file = deps.personaStore.read(id);
+        if (!file) continue;
+        if (isGuest && !file.public) continue;
+        grantedPersonas.push({ id: file.personaId, displayName: file.label });
+      }
+    } else {
+      for (const g2 of capability.grants) {
+        if (g2.resource.type !== "persona") continue;
+        const file = deps.personaStore.read(g2.resource.id);
+        if (!file) continue;
+        grantedPersonas.push({ id: file.personaId, displayName: file.label });
+      }
+    }
+    return {
+      response: {
+        type: "whoami:ok",
+        owner,
+        capability,
+        grantedPersonas
+      }
+    };
+  };
+}
+
 // src/handlers/meta.ts
 var import_node_os13 = __toESM(require("os"), 1);
 init_protocol();
@@ -27558,9 +28992,14 @@ function buildPersonaHandlers(deps) {
     const persona = personaManager.create(args);
     return { response: { type: "persona:info", ...persona } };
   };
-  const list = async () => {
+  const list = async (_frame, _client, ctx) => {
+    const all = personaRegistry.list();
+    const isGuest = ctx?.principal.kind === "guest";
+    const personas = isGuest ? all.filter(
+      (p2) => p2.public && assertGrant(ctx.grants, { type: "persona", id: p2.personaId }, "read")
+    ) : all;
     return {
-      response: { type: "persona:list", personas: personaRegistry.list() }
+      response: { type: "persona:list", personas }
     };
   };
   const get = async (frame) => {
@@ -27571,7 +29010,6 @@ function buildPersonaHandlers(deps) {
     }
     const personality = personaManager.readPersonality(args.personaId) ?? "";
     const skills = personaManager.listSkills(args.personaId);
-    const plugins = personaManager.listEnabledPlugins(args.personaId);
     const sandboxSettings = personaManager.readSandboxSettings(args.personaId);
     return {
       response: {
@@ -27579,7 +29017,6 @@ function buildPersonaHandlers(deps) {
         ...persona,
         personality,
         skills,
-        plugins,
         sandboxSettings
       }
     };
@@ -27598,31 +29035,16 @@ function buildPersonaHandlers(deps) {
       response: { type: "persona:deleted", personaId: args.personaId }
     };
   };
-  const issueToken = async (frame) => {
-    const args = PersonaIssueTokenArgsSchema.parse(frame);
-    const { token, persona } = personaManager.issueToken(args.personaId, args.label);
-    return {
-      response: { type: "persona:tokenIssued", token, persona }
-    };
-  };
-  const revokeToken = async (frame) => {
-    const args = PersonaRevokeTokenArgsSchema.parse(frame);
-    const persona = personaManager.revokeToken(args.personaId, args.token);
-    return { response: { type: "persona:info", ...persona } };
-  };
   return {
     "persona:create": create,
     "persona:list": list,
     "persona:get": get,
     "persona:update": update,
-    "persona:delete": del,
-    "persona:issueToken": issueToken,
-    "persona:revokeToken": revokeToken
+    "persona:delete": del
   };
 }
 
 // src/handlers/attachment.ts
-var import_node_path26 = __toESM(require("path"), 1);
 init_protocol();
 init_protocol();
 var DEFAULT_TTL_SECONDS = 24 * 3600;
@@ -27647,41 +29069,8 @@ function buildAttachmentHandlers(deps) {
         "httpBaseUrl unavailable (daemon HTTP not ready)"
       );
     }
-    if (!deps.sessionStore || !deps.getSessionScope || !deps.groupFileStore) {
-      throw new ClawdError(
-        ERROR_CODES.METHOD_NOT_IMPLEMENTED,
-        "signUrl requires session/group stores"
-      );
-    }
-    const sessionFile = deps.sessionStore.read(args.sessionId);
-    if (!sessionFile) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `session ${args.sessionId} not found`
-      );
-    }
-    const scope = deps.getSessionScope(args.sessionId);
-    if (!scope) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `session ${args.sessionId} scope unresolved`
-      );
-    }
-    const cwdAbs = import_node_path26.default.resolve(sessionFile.cwd);
-    const candidateAbs = import_node_path26.default.isAbsolute(args.relPath) ? import_node_path26.default.resolve(args.relPath) : import_node_path26.default.resolve(cwdAbs, args.relPath);
-    const entries = deps.groupFileStore.list(scope, args.sessionId);
-    const entry = entries.find((e) => {
-      const storedAbs = import_node_path26.default.isAbsolute(e.relPath) ? import_node_path26.default.resolve(e.relPath) : import_node_path26.default.resolve(cwdAbs, e.relPath);
-      return storedAbs === candidateAbs && !e.stale;
-    });
-    if (!entry) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `relPath not in session group files or stale: ${args.relPath}`
-      );
-    }
     const ttl = args.ttlSeconds === null ? null : args.ttlSeconds ?? DEFAULT_TTL_SECONDS;
-    const parts = signUrlParts(secret, candidateAbs, ttl);
+    const parts = signUrlParts(secret, args.absPath, ttl);
     const url = buildSignedFileUrl(httpBaseUrl, parts);
     return {
       response: {
@@ -27748,23 +29137,11 @@ function buildAttachmentHandlers(deps) {
     const entries = deps.groupFileStore.list(scope, parsed.data.sessionId);
     return { response: { type: "attachment.groupList", entries } };
   };
-  const groupListPersona = async (frame) => {
-    if (!deps.groupFileStore) {
-      throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "groupFileStore not wired");
-    }
-    const parsed = AttachmentGroupListPersonaArgs.safeParse(frame);
-    if (!parsed.success) {
-      throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
-    }
-    const perSession = deps.groupFileStore.listByPersona(parsed.data.personaId);
-    return { response: { type: "attachment.groupListPersona", perSession } };
-  };
   return {
     "attachment.signUrl": signUrl,
     "attachment.groupAdd": groupAdd,
     "attachment.groupRemove": groupRemove,
-    "attachment.groupList": groupList,
-    "attachment.groupListPersona": groupListPersona
+    "attachment.groupList": groupList
   };
 }
 
@@ -27782,15 +29159,141 @@ function buildMethodHandlers(deps) {
       personaManager: deps.personaManager,
       personaRegistry: deps.personaRegistry
     }),
+    ...buildCapabilityHandlers({
+      manager: deps.capabilityManager,
+      getShareBaseUrl: deps.getShareBaseUrl
+    }),
+    ...buildInboxHandlers({
+      manager: deps.inboxManager,
+      capManager: deps.capabilityManager
+    }),
+    ...buildReceivedCapabilityHandlers({
+      store: deps.receivedCapabilityStore,
+      connectRemote: deps.connectRemote,
+      broadcast: deps.broadcastToOwners,
+      selfPrincipalId: () => deps.ownerPrincipalId,
+      selfDisplayName: () => deps.ownerDisplayName
+    }),
+    whoami: buildWhoamiHandler({
+      ownerDisplayName: deps.ownerDisplayName,
+      ownerPrincipalId: deps.ownerPrincipalId,
+      personaStore: deps.personaStore,
+      capabilityManager: deps.capabilityManager
+    }),
     ...deps.attachment ? buildAttachmentHandlers(deps.attachment) : {}
   };
 }
 
+// src/handlers/method-grants.ts
+var ADMIN_ANY = {
+  kind: "fixed",
+  resource: { type: "*" },
+  action: "admin"
+};
+var CAPABILITY_SCOPED = { kind: "capability-scoped" };
+var METHOD_GRANT_MAP = {
+  // ---- public（meta-only，guest 也能调） ----
+  "info": { kind: "public" },
+  "ping": { kind: "public" },
+  // v2 Phase 6: whoami 是身份反查，任何 authed connection (owner / guest) 都能调；
+  // handler 内部按 ctx.principal.kind 决定返回 "合成 owner self capability" 还是
+  // "查 capabilityManager 拿 caller 的 guest capability"。
+  "whoami": { kind: "public" },
+  // ---- capability platform（admin-only，本 PR 新增） ----
+  "capability:issue": ADMIN_ANY,
+  "capability:list": ADMIN_ANY,
+  "capability:delete": ADMIN_ANY,
+  "capability:bindPeer": ADMIN_ANY,
+  // ---- inbox: channel-based IM (capability platform v3) ----
+  // 三条都 'public' — capability 本身就是授权凭证. handler 内额外校验
+  // guest ctx.capabilityId === args.capabilityId, 防 guest 越权操作别的 channel.
+  "inbox:list": { kind: "public" },
+  "inbox:markRead": { kind: "public" },
+  "inbox:postMessage": { kind: "public" },
+  // ---- received-capability:* (bidirectional cap 视角 B 2026-05-23) ----
+  // owner-only: list / add / remove；guest-only: autoAttach (capability 本身是凭证)
+  "received-capability:list": ADMIN_ANY,
+  "received-capability:add": ADMIN_ANY,
+  "received-capability:remove": ADMIN_ANY,
+  "received-capability:autoAttach": { kind: "public" },
+  // ---- session:* / chat:* 业务方法（v2 Phase 8 两层模型）----
+  // dispatcher 不验资源，handler 内按 ctx + frame.args 反查 ownerPersonaId 调 assertGrant。
+  // owner 自动通过（ctx 自带 '*':'admin' grant 一切 match）；guest 在被授权 persona 内可调。
+  "session:create": CAPABILITY_SCOPED,
+  "session:list": CAPABILITY_SCOPED,
+  "session:get": CAPABILITY_SCOPED,
+  "session:update": CAPABILITY_SCOPED,
+  "session:delete": CAPABILITY_SCOPED,
+  "session:send": CAPABILITY_SCOPED,
+  "session:stop": CAPABILITY_SCOPED,
+  "session:interrupt": CAPABILITY_SCOPED,
+  "session:rewind": CAPABILITY_SCOPED,
+  "session:rewind-diff": CAPABILITY_SCOPED,
+  "session:rewindable-message-ids": CAPABILITY_SCOPED,
+  "session:fork": CAPABILITY_SCOPED,
+  "session:new": CAPABILITY_SCOPED,
+  "session:resume": CAPABILITY_SCOPED,
+  "session:observe": CAPABILITY_SCOPED,
+  "session:events": CAPABILITY_SCOPED,
+  "session:subscribe": CAPABILITY_SCOPED,
+  "session:unsubscribe": CAPABILITY_SCOPED,
+  "session:pin": CAPABILITY_SCOPED,
+  "session:reorderPins": ADMIN_ANY,
+  // owner 全局操作，无 personaId 维度
+  "permission:respond": CAPABILITY_SCOPED,
+  "session:answerQuestion": CAPABILITY_SCOPED,
+  "session:cancelQuestion": CAPABILITY_SCOPED,
+  "history:projects": ADMIN_ANY,
+  "history:list": ADMIN_ANY,
+  // history:read 取一条 session 的 CC JSONL 历史。guest 进 persona VM 后必须能读自己
+  // 创建的 session 历史（chat view 加载历史消息走这条），所以下沉到 capability-scoped；
+  // handler 内按 ctx.capabilityId === file.creatorPrincipalId 拦越权。
+  "history:read": CAPABILITY_SCOPED,
+  "history:subagents": ADMIN_ANY,
+  "history:subagent-read": ADMIN_ANY,
+  "history:recentDirs": ADMIN_ANY,
+  "workspace:list": ADMIN_ANY,
+  "workspace:read": ADMIN_ANY,
+  "skills:list": ADMIN_ANY,
+  "agents:list": ADMIN_ANY,
+  "git:root": ADMIN_ANY,
+  "git:branch": ADMIN_ANY,
+  "git:branches": ADMIN_ANY,
+  "capabilities:get": ADMIN_ANY,
+  "persona:create": ADMIN_ANY,
+  // persona:list 下沉到 CAPABILITY_SCOPED：guest 调用合法（用于 People 面板展开
+  // 对方分享的 personas），handler 端按 ctx + persona.public + assertGrant 过滤。
+  "persona:list": CAPABILITY_SCOPED,
+  "persona:get": ADMIN_ANY,
+  "persona:update": ADMIN_ANY,
+  "persona:delete": ADMIN_ANY,
+  "session:pty:input": ADMIN_ANY,
+  "session:pty:resize": ADMIN_ANY,
+  // file-sharing attachment.* RPC：dispatcher 用 admin-only 兜底（wire-level 拦），
+  // 实际只有 owner 能调（personal token 链路 2026-05-21 删除，HTTP Bearer 只识别 owner）
+  "attachment.signUrl": ADMIN_ANY,
+  "attachment.groupAdd": ADMIN_ANY,
+  "attachment.groupRemove": ADMIN_ANY,
+  "attachment.groupList": ADMIN_ANY
+};
+function computeGrantForFrame(method, frame) {
+  const rule = METHOD_GRANT_MAP[method];
+  if (!rule) return { kind: "public" };
+  if (rule.kind === "public") return { kind: "public" };
+  if (rule.kind === "capability-scoped") return { kind: "public" };
+  if (rule.kind === "fixed") {
+    return { kind: "check", resource: rule.resource, action: rule.action };
+  }
+  const picked = rule.pick(frame);
+  if (!picked) return { kind: "public" };
+  return { kind: "check", resource: picked.resource, action: picked.action };
+}
+
 // src/index.ts
 async function startDaemon(config) {
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path27.default.join(config.dataDir, "clawd.log")
+    file: import_node_path26.default.join(config.dataDir, "clawd.log")
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
@@ -27801,47 +29304,116 @@ async function startDaemon(config) {
   if (pre.status === "stale") {
     logger.warn("stale state file detected, overwriting", { pid: pre.existing.pid });
   }
+  const auth = loadOrCreateAuth({ dataDir: config.dataDir });
   let resolvedAuthToken = null;
-  let authFile = null;
   if (config.authToken && config.authToken.trim()) {
     resolvedAuthToken = config.authToken.trim();
   } else if (config.tunnel) {
-    authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
-    resolvedAuthToken = authFile.token;
+    resolvedAuthToken = auth.token;
   }
+  const ownerPrincipalId = auth.ownerPrincipalId;
+  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
+  migrateLegacyFiles(config.dataDir);
+  const inboxStore = new InboxStore(config.dataDir);
+  const inboxManager = new InboxManager(inboxStore, (_peerOwnerId, frame) => {
+    wsServer?.broadcastToOwners(frame);
+  });
+  const receivedCapabilityStore = new ReceivedCapabilityStore(config.dataDir);
+  receivedCapabilityStore.load();
+  const capabilityStore = new CapabilityStore(config.dataDir);
+  const capabilityRegistry = new CapabilityRegistry(capabilityStore);
+  const capabilityManager = new CapabilityManager(capabilityRegistry, {
+    onIssued: (cap, token) => {
+      wsServer?.broadcastToOwners({
+        type: "capability:tokenIssued",
+        capability: stripSecretHash(cap),
+        token
+      });
+    },
+    onDeleted: (cap) => {
+      const deletedAt = Date.now();
+      wsServer?.broadcastToOwners({
+        type: "capability:tokenDeleted",
+        capabilityId: cap.id,
+        deletedAt
+      });
+      wsServer?.closeConnectionsByCapability(cap.id);
+      const cleanup = cleanupGuestSessionsForCapability(cap, sessionStoreFactory);
+      if (cleanup.removed.length > 0) {
+        logger.info("capability delete cascade: guest sessions removed", {
+          capabilityId: cap.id,
+          removedDirs: cleanup.removed
+        });
+      }
+    }
+  });
+  migrateDropPersonsDir(config.dataDir);
   let wsServer = null;
   const authGate = authMode === "first-message" ? new AuthGate({
     shouldEnforce: buildShouldEnforce({ tunnel: config.tunnel }),
+    // Task 1.7：authenticate 注入路径替代 expectedToken 单 token 比对。
+    // owner 路径 constantTimeEqual 防侧信道；guest 路径走 capabilityRegistry.
     expectedToken: resolvedAuthToken,
+    authenticate: (t, selfPrincipalId, selfDisplayName) => {
+      return authenticate(t, {
+        isOwnerToken: (x) => resolvedAuthToken != null && constantTimeEqual(x, resolvedAuthToken),
+        ownerPrincipalId,
+        ownerDisplayName,
+        capabilityRegistry,
+        selfPrincipalId,
+        selfDisplayName,
+        onGuestHello: (capId, ownerId, name) => {
+          capabilityManager.recordPeerHello(capId, {
+            ownerPrincipalId: ownerId,
+            displayName: name,
+            now: Date.now()
+          });
+        }
+      });
+    },
+    onAuthed: (h, ctx) => wsServer?.attachClientContext(h.id, ctx),
+    buildOwnerContext: () => ownerContext(ownerPrincipalId, ownerDisplayName),
     closeConnection: (h, code, reason) => wsServer?.closeClient(h.id, code, reason),
     sendOk: (h, payload) => wsServer?.sendToClient(h.id, payload)
   }) : null;
   resetRegistry();
-  const store = new SessionStore({ dataDir: config.dataDir });
+  const migrateResult = migrateFlattenSessions({ dataDir: config.dataDir });
+  if (!migrateResult.skipped && (migrateResult.movedBare || migrateResult.movedVmOwner || migrateResult.archivedListener)) {
+    logger.info("sessions migration applied", {
+      movedBare: migrateResult.movedBare,
+      movedVmOwner: migrateResult.movedVmOwner,
+      archivedListener: migrateResult.archivedListener
+    });
+  }
+  const sessionStoreFactory = new SessionStoreFactory({ dataDir: config.dataDir });
+  const store = sessionStoreFactory.forBare();
   const workspace = new WorkspaceBrowser();
   const skills = new SkillsScanner();
   const agents = new AgentsScanner();
   const history = new ClaudeHistoryReader();
   let transport = null;
-  const personaStore = new PersonaStore(import_node_path27.default.join(config.dataDir, "personas"));
+  const personaStore = new PersonaStore(import_node_path26.default.join(config.dataDir, "personas"));
   const defaultsRoot = findDefaultsRoot();
   if (defaultsRoot) {
     seedDefaultPersonas({ store: personaStore, defaultsRoot, logger });
   } else {
     logger.warn("persona.seed.skip", { reason: "defaults-root-not-found" });
   }
-  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const manager = new SessionManager({
     store,
+    // Phase 2 (capability platform plan §1): factory 注入后 manager.storeFor 走
+    // 新布局派生 (sessions/* + personas/<pid>/.clawd/sessions/owner/*)
+    storeFactory: sessionStoreFactory,
     logger,
     getAdapter,
     historyReader: history,
     dataDir: config.dataDir,
-    personaRoot: import_node_path27.default.join(config.dataDir, "personas"),
+    personaRoot: import_node_path26.default.join(config.dataDir, "personas"),
     personaStore,
     ownerDisplayName,
+    ownerPrincipalId,
     mode: config.mode,
     broadcastFrame: (frame, target) => {
       if (target === "all") {
@@ -27862,7 +29434,7 @@ async function startDaemon(config) {
     // 文件可能 agent 写完又被自己删（罕见），用 size=0 / fallback mime 兜底。
     attachmentGroup: {
       onFileEdit: (input) => {
-        const absPath = import_node_path27.default.isAbsolute(input.relPath) ? input.relPath : import_node_path27.default.join(input.cwd, input.relPath);
+        const absPath = import_node_path26.default.isAbsolute(input.relPath) ? input.relPath : import_node_path26.default.join(input.cwd, input.relPath);
         let size = 0;
         try {
           size = import_node_fs24.default.statSync(absPath).size;
@@ -27961,43 +29533,63 @@ async function startDaemon(config) {
     httpToken: resolvedAuthToken,
     // file-sharing attachment.* RPC。signUrl 用 owner token 做 HMAC secret；group RPC
     // 根据 sessionId 反查 scope 写盘。
-    //
-    // sessionStore / getSessionScope 都走 manager 的跨 scope 公开 API（findOwnedSession /
-    // findOwnedSessionScope）—— 否则 default-only SessionStore 找不到 persona owner-mode
-    // session，attachment 整套 RPC 对 persona session 都会报 "session not found"。
-    // 详见 fix(daemon) #703：file-sharing v1 预存 wiring bug，#701 把 desktop 默认 --tunnel
-    // 后首次让 desktop 用户用上 file-sharing 才被暴露。
     attachment: {
       groupFileStore,
-      sessionStore: { read: (sid) => manager.findOwnedSession(sid) },
       getHttpBaseUrl,
-      // HMAC sign secret：~/.clawd/auth.json signSecret 字段（与 WS Bearer token 独立）。
-      // --auth-token CLI 模式 / noAuth 模式 authFile 为 null → handler 自己返 NOT_IMPLEMENTED。
-      getSignSecret: () => authFile?.signSecret ?? "",
-      // group RPC + sign 都用：根据 sessionId 反查 scope。owner-mode persona session 走
+      // HMAC sign secret：复用 ~/.clawd/auth.json owner token（持久跨重启）。
+      // noAuth 模式 resolvedAuthToken 为 null → handler 自己返 NOT_IMPLEMENTED。
+      getSignSecret: () => resolvedAuthToken ?? "",
+      // group RPC：根据 sessionId 反查 scope；owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
-      getSessionScope: (sid) => manager.findOwnedSessionScope(sid)
-    }
+      getSessionScope: (sessionId) => {
+        const file = store.read(sessionId);
+        if (!file) return null;
+        if (file.ownerPersonaId) {
+          return { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" };
+        }
+        return { kind: "default" };
+      }
+    },
+    // Task 1.9: capability:issue/list/revoke handler 依赖
+    capabilityManager,
+    // v2 Phase 5: capability:issue 返回的 shareUrl 用此 base URL 拼接。
+    // tunnel 拉起后切到反代 wss://... 地址；否则本机 ws://host:port。
+    getShareBaseUrl: () => currentTunnelUrl ?? `ws://${config.host}:${config.port}`,
+    // v2 Phase 6: whoami handler 装在 owner principal.displayName + persona 解析
+    ownerDisplayName,
+    // owner-id stabilization: whoami 用稳定 ownerPrincipalId 替代 'owner' 字面量
+    ownerPrincipalId,
+    personaStore,
+    // capability handler 也用 (capability:issue 走 registry / capability:list)
+    capabilityRegistry,
+    // capability platform v3 inbox: handler 接 manager (post/list/markRead),
+    // cascade 接 store (list 统计 deletedInboxEvents).
+    inboxManager,
+    inboxStore,
+    // bidirectional cap 视角 B: 对方颁给我的 cap 走这个 store
+    receivedCapabilityStore,
+    // received-capability:added / removed broadcast；复用 capability:tokenIssued 同款通路
+    broadcastToOwners: (frame) => wsServer?.broadcastToOwners(frame),
+    // received-capability:add 临时 ws 连远端跑 whoami — 直连 ws (不走 transport listener)
+    connectRemote
   });
   const authResolver = new AuthContextResolver({
-    ownerToken: resolvedAuthToken,
-    personaRegistry
+    ownerToken: resolvedAuthToken
   });
   const httpRouter = createHttpRouter({
     authResolver,
     daemonVersion: version,
     logger,
-    personaStore,
-    groupFileStore,
     sessionStore: store,
-    // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
-    // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
-    getSignSecret: () => authFile?.signSecret ?? null
+    // /files HMAC verify 用同一份 owner token 做 secret（与 attachment.signUrl 同源）
+    getSignSecret: () => resolvedAuthToken ?? null
   });
   wsServer = new LocalWsServer({
     host: config.host,
     port: config.port,
     logger,
+    // broadcastToPrincipal 用此 id 路由 owner-targeted 帧（替代字面量 'owner' sentinel）
+    ownerPrincipalId,
     readyFrameBuilder: (ctx) => buildReadyFrame(
       {
         manager,
@@ -28013,6 +29605,29 @@ async function startDaemon(config) {
     ),
     protocolVersion: PROTOCOL_VERSION,
     authGate: authGate ?? void 0,
+    // noAuth 模式下仍验 capability token: 修 capability platform 漏洞 — 远端 client
+    // 用 cap token 连 noAuth daemon 时若无此 hook 会 fallback owner ctx, whoami 错返
+    // capability.id = ownerPrincipalId, 导致 myCapabilityId 写错 → inbox channel 写错.
+    // 命中 cap → attach guest ctx; 空 token / 未命中 → 保持 noAuth 行为 (handler fallback owner).
+    tryVerifyCapabilityToken: (token, selfPrincipalId, selfDisplayName) => {
+      const v2 = capabilityRegistry.verifyToken(token);
+      if (!v2.ok) return null;
+      if (selfPrincipalId && selfDisplayName) {
+        try {
+          capabilityManager.recordPeerHello(v2.capability.id, {
+            ownerPrincipalId: selfPrincipalId,
+            displayName: selfDisplayName,
+            now: Date.now()
+          });
+        } catch {
+        }
+      }
+      return {
+        principal: { id: v2.capability.id, kind: "guest", displayName: v2.capability.displayName },
+        grants: v2.capability.grants,
+        capabilityId: v2.capability.id
+      };
+    },
     // file-sharing HTTP 路由复用 daemon 同端口（spec §5 第 3 条）；router 自己处理 auth + 404
     httpRequestHandler: httpRouter,
     // 订阅成功后给该 client 重放 in-flight pendingQuestions（plan: clawd-question-server-truth）。
@@ -28065,7 +29680,18 @@ async function startDaemon(config) {
     const requestId = typeof frame.requestId === "string" ? frame.requestId : void 0;
     const handler = handlers[type];
     if (!handler) throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, `not implemented: ${type}`);
-    const result = await handler(frame, client);
+    const ctx = wsServer.getClientContext(client.id) ?? ownerContext(ownerPrincipalId, ownerDisplayName);
+    const verdict = computeGrantForFrame(type, frame);
+    if (verdict.kind === "check") {
+      const ok = assertGrant(ctx.grants, verdict.resource, verdict.action);
+      if (!ok) {
+        throw new ClawdError(
+          ERROR_CODES.UNAUTHORIZED,
+          `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${verdict.action} on ${verdict.resource.type}${"id" in verdict.resource ? ":" + verdict.resource.id : ""}`
+        );
+      }
+    }
+    const result = await handler(frame, client, ctx);
     if (requestId && result.response) {
       client.send({ ...result.response, requestId });
     }
@@ -28123,15 +29749,15 @@ async function startDaemon(config) {
     });
     try {
       const r = await tunnelMgr.start({ localPort: config.port });
-      stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url, tunnelError: void 0 };
+      stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url };
       stateMgr.write(stateSnapshot);
       currentTunnelUrl = r.url;
       const connectUrl = resolvedAuthToken ? `${r.url}#token=${resolvedAuthToken}` : r.url;
       const lines = [
         `Tunnel:      ${r.url}`,
         ...resolvedAuthToken ? [`Connect:     ${connectUrl}`] : [],
-        `Frpc config: ${import_node_path27.default.join(config.dataDir, "frpc.toml")}`,
-        `Frpc log:    ${import_node_path27.default.join(config.dataDir, "frpc.log")}`
+        `Frpc config: ${import_node_path26.default.join(config.dataDir, "frpc.toml")}`,
+        `Frpc log:    ${import_node_path26.default.join(config.dataDir, "frpc.log")}`
       ];
       const width = Math.max(...lines.map((l) => l.length));
       const bar = "\u2550".repeat(width + 4);
@@ -28144,30 +29770,19 @@ ${bar}
 
 `);
       try {
-        const connectPath = import_node_path27.default.join(config.dataDir, "connect.txt");
+        const connectPath = import_node_path26.default.join(config.dataDir, "connect.txt");
         import_node_fs24.default.writeFileSync(connectPath, lines.join("\n") + "\n", { mode: 384 });
       } catch {
       }
     } catch (err) {
-      const tunnelError = err?.message ?? String(err);
       try {
         await tunnelMgr.stop();
       } catch {
       }
       tunnelMgr = null;
-      stateSnapshot = { ...stateSnapshot, tunnelUrl: void 0, tunnelError };
-      try {
-        stateMgr.write(stateSnapshot);
-      } catch {
-      }
-      wss.broadcastAll({
-        type: "tunnel:unavailable",
-        reason: tunnelError,
-        failedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      process.stdout.write(`Tunnel:      unavailable (local mode) \u2014 ${tunnelError}
-`);
-      logger.warn("tunnel unavailable, degraded to local mode", { reason: tunnelError });
+      stateMgr.delete();
+      await wss.stop();
+      throw err;
     }
   }
   const shutdown = async () => {
@@ -28188,6 +29803,13 @@ ${bar}
     manager
   };
 }
+function migrateDropPersonsDir(dataDir) {
+  const dir = import_node_path26.default.join(dataDir, "persons");
+  try {
+    import_node_fs24.default.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
 
 // src/cli.ts
 async function main() {