@clawos-dev/clawd 0.2.73-beta.141.0c5abdc → 0.2.73-beta.142.96910a0

package/dist/cli.cjs

@@ -87,16 +87,15 @@ var init_methods = __esm({
       "git:branches",
       "capabilities:get",
       // ---- persona:* (persona 管理) ----
-      // persona:list 响应 shape 不分流（统一返 PersonaFile[]），但 daemon handler 按
-      // ConnectionContext 投影不同子集：
-      //   owner ctx → 返全量 personas（含 private）
-      //   guest ctx → persona.public === true ∧ assertGrant(ctx.grants, {persona,p.id}, 'read')
-      // method-grants.ts: persona:list 是 CAPABILITY_SCOPED；其它 persona:* 仍 ADMIN_ANY。
       "persona:create",
       "persona:list",
       "persona:get",
       "persona:update",
       "persona:delete",
+      // token 颁发 / 吊销：file-sharing HTTP Bearer 鉴权用（PersonaRegistry.findByToken
+      // 反查 personaId / label）。owner UI 在 PersonaSettingsDrawer "分享 Token" section 管理。
+      "persona:issueToken",
+      "persona:revokeToken",
       // ---- session:pty 双向透传（仅 CLAWD_CC_MODE=tui 才生效，对应 session:pty push 帧的上行） ----
       // session:pty:input — UI 把用户键盘字节（base64 UTF-8）发给 daemon，daemon 直写 pty stdin。
       //   高频帧（每次按键 1 帧），不入 reducer / 不广播。response 是 fire-and-forget 风格 ack。
@@ -107,45 +106,14 @@ var init_methods = __esm({
       // ---- attachment.* file-sharing（详见 attachment-schemas.ts） ----
       // 命名警告：这里的 `attachment.*` RPC 与 CC v2.x 上行 `type:"attachment"` 系统行
       // （attachment-skills / attachment-deferred-tools / attachment_memories）是不同概念。
-      // 全部管理类 RPC dispatcher grant 限 owner（capability admin-only）；
-      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，HMAC 签名自包含，不在白名单内）。
+      // 全部管理类 RPC handler 入口 requireOwner（personal token 调任意一个都 403）；
+      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，签名验证），不在白名单内。
       "attachment.signUrl",
       "attachment.groupAdd",
       "attachment.groupRemove",
       "attachment.groupList",
-      // ---- capability:* (capability platform 鉴权底座) ----
-      // owner 颁发 / 列出 / 删除给 guest 的 capability。三者均需 admin 权限（METHOD_GRANT_MAP
-      // 在 daemon 端固定为 `{ resource: '*', action: 'admin' }`，owner 自动满足）。
-      // 颁发后 daemon 推 'capability:tokenIssued' 帧；删除推 'capability:tokenDeleted' 帧。
-      // 删除是 hard delete：CapabilityStore 物理移除 + 关该 cap 的所有活跃 ws + rm
-      // personas/<pid>/.clawd/sessions/guests/<capId>/ guest sessions 目录。
-      "capability:issue",
-      "capability:list",
-      "capability:delete",
-      // bidirectional cap 视角 B 2026-05-23: owner 主动告诉 daemon "我颁的某 cap 给了谁"
-      // (UI 在 accept dialog 4 步流程里调; 等价于 recordPeerHello 但不经 ws auth path).
-      // 否则 B 端颁回的 cap 因为 A 不连 B → peerOwnerId 永不回写 → useContacts 派生 pending.
-      "capability:bindPeer",
-      // ---- inbox:* (capability platform Phase 3 跨用户通知 + Phase 4 DM) ----
-      // owner 接 guest 的 cross-principal 消息事件 + DM 双向私聊.
-      // inbox:list / markRead: admin-only (Phase 3); inbox:postMessage: DM 自带能力,
-      // 任何 principal (owner/guest) 可调 (Phase 4).
-      "inbox:list",
-      "inbox:markRead",
-      "inbox:postMessage",
-      // ---- received-capability:* (对方颁给我的 cap, 视角 B 双向授权模型, 2026-05-23) ----
-      // owner 入口: list / add / remove
-      // guest 端: autoAttach (B 接 A 的 token 后通过 cap channel ws 推 cap 给 A)
-      // 详见 received-capability.ts JSDoc + spec 2026-05-23-bidirectional-cap-design.md
-      "received-capability:list",
-      "received-capability:add",
-      "received-capability:remove",
-      "received-capability:autoAttach",
-      // ---- whoami (v2 capability platform) ----
-      // 任何 authed connection 都能调；返回 owner 显示名 + 当前 capability wire 形态 +
-      // grants 对应的 persona 元数据 (id + displayName)。UI 端 AddRemotePersonaDialog
-      // 的 preview 一次性临时 client 用它判定身份和可用 persona。
-      "whoami",
+      // v2：跨 session 聚合（本期 UI 不调，保留槽位用于 HTTP ACL 内部判定 / 未来 "All files" tab）
+      "attachment.groupListPersona",
       "info",
       "ping"
     ];
@@ -641,8 +609,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path39, errorMaps, issueData } = params;
-      const fullPath = [...path39, ...issueData.path || []];
+      const { data, path: path32, errorMaps, issueData } = params;
+      const fullPath = [...path32, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -953,11 +921,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path39, key) {
+      constructor(parent, value, path32, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path39;
+        this._path = path32;
         this._key = key;
       }
       get path() {
@@ -4341,12 +4309,12 @@ var init_zod = __esm({
 });
 
 // ../protocol/src/attachment-schemas.ts
-var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema;
+var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema, AttachmentGroupListPersonaArgs, AttachmentGroupListPersonaResponseSchema;
 var init_attachment_schemas = __esm({
   "../protocol/src/attachment-schemas.ts"() {
     "use strict";
     init_zod();
-    TOKEN_ROLES = ["owner"];
+    TOKEN_ROLES = ["owner", "personal"];
     GROUP_FILE_SOURCES = ["agent", "owner"];
     GroupFileEntrySchema = external_exports.object({
       /** daemon 派发的稳定 id（用于 RPC remove / UI key） */
@@ -4402,15 +4370,31 @@ var init_attachment_schemas = __esm({
     AttachmentGroupListResponseSchema = external_exports.object({
       entries: external_exports.array(GroupFileEntrySchema)
     });
+    AttachmentGroupListPersonaArgs = external_exports.object({
+      personaId: external_exports.string().min(1)
+    });
+    AttachmentGroupListPersonaResponseSchema = external_exports.object({
+      perSession: external_exports.array(
+        external_exports.object({
+          sessionId: external_exports.string().min(1),
+          entries: external_exports.array(GroupFileEntrySchema)
+        })
+      )
+    });
   }
 });
 
 // ../protocol/src/persona-schemas.ts
-var PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema;
+var PersonaTokenEntrySchema, PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema, PersonaIssueTokenArgsSchema, PersonaRevokeTokenArgsSchema;
 var init_persona_schemas = __esm({
   "../protocol/src/persona-schemas.ts"() {
     "use strict";
     init_zod();
+    PersonaTokenEntrySchema = external_exports.object({
+      label: external_exports.string(),
+      issuedAt: external_exports.number(),
+      revoked: external_exports.boolean()
+    });
     PersonaFileSchema = external_exports.object({
       personaId: external_exports.string(),
       label: external_exports.string(),
@@ -4419,6 +4403,13 @@ var init_persona_schemas = __esm({
       // 8-key set defined UI-side in `lib/session-icons.ts`; protocol stays plain string
       // for forward compatibility, consumer fallbacks to default when key not found.
       iconKey: external_exports.string().optional(),
+      /**
+       * Persona token 列表：file-sharing HTTP Bearer 鉴权用。
+       * - 写：`PersonaManager.issueToken` / `revokeToken`
+       * - 读：`PersonaRegistry.findByToken` 反向查表（需 persona.public === true）
+       * - optional：兼容历史 persona.json 不含此字段的情形（旧 daemon 写文件时省略）
+       */
+      tokenMap: external_exports.record(external_exports.string(), PersonaTokenEntrySchema).optional(),
       createdAt: external_exports.number(),
       updatedAt: external_exports.number()
     }).strict();
@@ -4477,6 +4468,14 @@ var init_persona_schemas = __esm({
         iconKey: external_exports.string().nullable().optional()
       }).strict()
     }).strict();
+    PersonaIssueTokenArgsSchema = external_exports.object({
+      personaId: external_exports.string().min(1),
+      label: external_exports.string().min(1)
+    });
+    PersonaRevokeTokenArgsSchema = external_exports.object({
+      personaId: external_exports.string().min(1),
+      token: external_exports.string().min(1)
+    });
   }
 });
 
@@ -4583,15 +4582,6 @@ var init_schemas = __esm({
       // 才能让 alice 重连同一 sub-session（持久化在 alice localStorage 之外，由 daemon push 同步）。
       // optional 是因为 owner-mode session 不带；只要写入就是 listener-mode 必填三元组。
       chatId: external_exports.string().min(1).optional(),
-      /**
-       * 创建该 session 的 principal id（owner uuid 或 guest cap.id），从 session:create handler
-       * 的 ctx.principal.id 派生。Person identity Q2「按对端人聚合 sessions」需要它：
-       * UI 端按 `creatorPrincipalId === ownerPrincipalId` 区分「我自己」vs「别人接入」，
-       * 后者再通过 PersonAlias 表反查 personId 二级分组。
-       *
-       * optional：兼容 2026-05-21 之前的老 session 数据，新建一定有值。
-       */
-      creatorPrincipalId: external_exports.string().min(1).optional(),
       createdAt: external_exports.string().min(1),
       updatedAt: external_exports.string().min(1)
     });
@@ -5001,20 +4991,7 @@ var init_schemas = __esm({
     AuthRequestFrameSchema = external_exports.object({
       type: external_exports.literal("auth"),
       token: external_exports.string().min(1),
-      scheme: external_exports.literal("bearer").optional(),
-      /**
-       * guest 端 ws 接入时自报对端稳定 ownerPrincipalId。AuthGate.authenticate 收到
-       * 后调 capabilityManager.recordPeerHello(capId, ownerPrincipalId, displayName)
-       * 把 cap.peerOwnerId / firstUsedByPeerAt 字段回写，让 owner 端 UI 在 People
-       * tab 顶层 PeerOwner 视图 + Personas tab 二级分组拿到对端身份。
-       */
-      selfPrincipalId: external_exports.string().min(1).optional(),
-      /**
-       * 同 selfPrincipalId：自报 owner displayName（人类可读），让对端 daemon 把
-       * 显示名写入 cap.peerOwnerDisplayName（cap.displayName 本来就是 owner 颁时填
-       * 的"颁给谁/用途"，hello 收到的 displayName 是辅助）。
-       */
-      selfDisplayName: external_exports.string().optional()
+      scheme: external_exports.literal("bearer").optional()
     });
     AuthOkFrameSchema = external_exports.object({
       type: external_exports.literal("auth:ok"),
@@ -5052,9 +5029,10 @@ var init_schemas = __esm({
       // PR 2 daemon 实现 single HTTP server + auth-context 后，daemon 必返这五个字段，
       // 届时可考虑改成 required。spec §11 第 3 条："tokenRole 是协议字段，daemon 查 token
       // 表后显式下发，UI 不自行推导"——所以 UI 一律读这里，禁止本地推导。
-      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）。来源 TOKEN_ROLES（spec §11 #1 中央真理源）。
-       *  历史 'personal' role（persona file-sharing token）在 2026-05-21 删除；tokenPersonaId 一同移除。 */
+      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）；'personal' = persona 派发的访客 token。来源 TOKEN_ROLES（spec §11 #1 中央真理源） */
       tokenRole: external_exports.enum(TOKEN_ROLES).optional(),
+      /** tokenRole='personal' 时携带（绑定到具体 persona）；owner 不携带 */
+      tokenPersonaId: external_exports.string().min(1).optional(),
       /** socket.remoteAddress 是否落在 127.0.0.1 / ::1；本期无 RPC 消费，保留协议槽位给未来 "Reveal in Finder" 等本机动作 */
       isLoopback: external_exports.boolean().optional(),
       /** UI 拼 file-sharing HTTP 路由的前缀（http(s)://host:port），不含尾斜杠；frpc 反代时返反代地址 */
@@ -5081,194 +5059,6 @@ var init_persona_mode = __esm({
   }
 });
 
-// ../protocol/src/principal.ts
-function makeOwnerPrincipal(id, displayName) {
-  return PrincipalSchema.parse({ id, kind: "owner", displayName });
-}
-var PrincipalKindSchema, PrincipalSchema;
-var init_principal = __esm({
-  "../protocol/src/principal.ts"() {
-    "use strict";
-    init_zod();
-    PrincipalKindSchema = external_exports.enum(["owner", "guest"]);
-    PrincipalSchema = external_exports.object({
-      id: external_exports.string().min(1),
-      kind: PrincipalKindSchema,
-      displayName: external_exports.string()
-    }).strict();
-  }
-});
-
-// ../protocol/src/capability.ts
-function stripSecretHash(cap) {
-  const { secretHash: _hash, ...wire } = cap;
-  return wire;
-}
-var ResourceSchema, ActionSchema, GrantSchema, CapabilitySchema, CapabilityWireSchema, CapabilityErrorCodeSchema, WhoamiResponseSchema, CapabilityIssueArgsSchema, CapabilityBindPeerArgsSchema;
-var init_capability = __esm({
-  "../protocol/src/capability.ts"() {
-    "use strict";
-    init_zod();
-    ResourceSchema = external_exports.discriminatedUnion("type", [
-      external_exports.object({ type: external_exports.literal("persona"), id: external_exports.string().min(1) }).strict(),
-      external_exports.object({ type: external_exports.literal("chat"), id: external_exports.string().min(1) }).strict(),
-      external_exports.object({ type: external_exports.literal("*") }).strict()
-    ]);
-    ActionSchema = external_exports.enum(["read", "send", "admin"]);
-    GrantSchema = external_exports.object({
-      resource: ResourceSchema,
-      actions: external_exports.array(ActionSchema).min(1)
-    }).strict();
-    CapabilitySchema = external_exports.object({
-      id: external_exports.string().min(1),
-      // sha256(token) hex 64
-      secretHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
-      displayName: external_exports.string(),
-      // 空数组合法 = 纯访客（只能 DM）
-      grants: external_exports.array(GrantSchema),
-      issuedAt: external_exports.number().int().nonnegative(),
-      expiresAt: external_exports.number().int().positive().optional(),
-      maxUses: external_exports.number().int().positive().optional(),
-      usedCount: external_exports.number().int().nonnegative(),
-      /**
-       * guest 在 auth 帧捎带 selfPrincipalId 时由 AuthGate.authenticate 回写；
-       * 未被消费的 cap 此字段缺失。
-       */
-      peerOwnerId: external_exports.string().min(1).optional(),
-      /** 首次 client hello 时间戳（与 peerOwnerId 同步写入） */
-      firstUsedByPeerAt: external_exports.number().int().positive().optional(),
-      /**
-       * 对方 daemon owner 的 displayName，guest auth 帧 selfDisplayName 触发
-       * recordPeerHello 时同步回写。视角 B (2026-05-23) UI 派生联系人列表用此字段
-       * 显示对方名字（避免 fallback 到我颁 cap 时填的 displayName）。
-       */
-      peerDisplayName: external_exports.string().optional()
-    }).strict();
-    CapabilityWireSchema = CapabilitySchema.omit({ secretHash: true });
-    CapabilityErrorCodeSchema = external_exports.enum([
-      "TOKEN_INVALID",
-      "TOKEN_REVOKED",
-      "TOKEN_EXPIRED",
-      "TOKEN_EXHAUSTED"
-    ]);
-    WhoamiResponseSchema = external_exports.object({
-      type: external_exports.literal("whoami:ok"),
-      owner: external_exports.object({
-        id: external_exports.string(),
-        kind: external_exports.enum(["owner", "guest"]),
-        displayName: external_exports.string()
-      }).strict(),
-      capability: CapabilityWireSchema,
-      grantedPersonas: external_exports.array(
-        external_exports.object({
-          id: external_exports.string().min(1),
-          displayName: external_exports.string()
-        }).strict()
-      )
-    }).strict();
-    CapabilityIssueArgsSchema = external_exports.object({
-      displayName: external_exports.string().min(1),
-      grants: external_exports.array(GrantSchema),
-      expiresAt: external_exports.number().int().positive().optional(),
-      maxUses: external_exports.number().int().positive().optional()
-    }).strict();
-    CapabilityBindPeerArgsSchema = external_exports.object({
-      capabilityId: external_exports.string().min(1),
-      peerOwnerId: external_exports.string().min(1),
-      peerDisplayName: external_exports.string()
-    }).strict();
-  }
-});
-
-// ../protocol/src/inbox.ts
-var InboxMessageSchema, InboxPostMessageArgsSchema, InboxListArgsSchema, InboxMarkReadArgsSchema;
-var init_inbox = __esm({
-  "../protocol/src/inbox.ts"() {
-    "use strict";
-    init_zod();
-    InboxMessageSchema = external_exports.object({
-      id: external_exports.string().min(1),
-      peerOwnerId: external_exports.string().min(1),
-      senderPrincipalId: external_exports.string().min(1),
-      text: external_exports.string().min(1),
-      createdAt: external_exports.number().int().nonnegative(),
-      readBy: external_exports.record(external_exports.string().min(1), external_exports.number().int().positive()).default({})
-    }).strict();
-    InboxPostMessageArgsSchema = external_exports.object({
-      peerOwnerId: external_exports.string().min(1).optional(),
-      id: external_exports.string().min(1),
-      text: external_exports.string().min(1),
-      createdAt: external_exports.number().int().nonnegative()
-    }).strict();
-    InboxListArgsSchema = external_exports.object({
-      peerOwnerId: external_exports.string().min(1),
-      sinceCreatedAt: external_exports.number().int().nonnegative().optional()
-    }).strict();
-    InboxMarkReadArgsSchema = external_exports.object({
-      peerOwnerId: external_exports.string().min(1),
-      upToCreatedAt: external_exports.number().int().nonnegative()
-    }).strict();
-  }
-});
-
-// ../protocol/src/received-capability.ts
-var ReceivedCapabilitySchema, ReceivedCapabilityWireSchema, ReceivedCapabilityAddArgsSchema, ReceivedCapabilityAddOkSchema, ReceivedCapabilityRemoveArgsSchema, ReceivedCapabilityRemoveOkSchema, ReceivedCapabilityListOkSchema, ReceivedCapabilityAutoAttachArgsSchema, ReceivedCapabilityAutoAttachOkSchema, ReceivedCapabilityAddedFrameSchema, ReceivedCapabilityRemovedFrameSchema;
-var init_received_capability = __esm({
-  "../protocol/src/received-capability.ts"() {
-    "use strict";
-    init_zod();
-    init_capability();
-    ReceivedCapabilitySchema = external_exports.object({
-      ownerPrincipalId: external_exports.string().min(1),
-      ownerDisplayName: external_exports.string(),
-      remoteUrl: external_exports.string().min(1),
-      capabilityId: external_exports.string().min(1),
-      capabilityToken: external_exports.string().min(1),
-      grants: external_exports.array(GrantSchema),
-      receivedAt: external_exports.number().int().nonnegative()
-    }).strict();
-    ReceivedCapabilityWireSchema = ReceivedCapabilitySchema;
-    ReceivedCapabilityAddArgsSchema = external_exports.object({
-      remoteUrl: external_exports.string().min(1),
-      token: external_exports.string().min(1)
-    }).strict();
-    ReceivedCapabilityAddOkSchema = external_exports.object({
-      type: external_exports.literal("received-capability:add:ok"),
-      receivedCap: ReceivedCapabilityWireSchema
-    }).strict();
-    ReceivedCapabilityRemoveArgsSchema = external_exports.object({
-      ownerPrincipalId: external_exports.string().min(1)
-    }).strict();
-    ReceivedCapabilityRemoveOkSchema = external_exports.object({
-      type: external_exports.literal("received-capability:remove:ok"),
-      ownerPrincipalId: external_exports.string().min(1)
-    }).strict();
-    ReceivedCapabilityListOkSchema = external_exports.object({
-      type: external_exports.literal("received-capability:list:ok"),
-      receivedCaps: external_exports.array(ReceivedCapabilityWireSchema)
-    }).strict();
-    ReceivedCapabilityAutoAttachArgsSchema = external_exports.object({
-      ownerPrincipalId: external_exports.string().min(1),
-      ownerDisplayName: external_exports.string(),
-      remoteUrl: external_exports.string().min(1),
-      capabilityId: external_exports.string().min(1),
-      token: external_exports.string().min(1),
-      grants: external_exports.array(GrantSchema)
-    }).strict();
-    ReceivedCapabilityAutoAttachOkSchema = external_exports.object({
-      type: external_exports.literal("received-capability:autoAttach:ok")
-    }).strict();
-    ReceivedCapabilityAddedFrameSchema = external_exports.object({
-      type: external_exports.literal("received-capability:added"),
-      receivedCap: ReceivedCapabilityWireSchema
-    }).strict();
-    ReceivedCapabilityRemovedFrameSchema = external_exports.object({
-      type: external_exports.literal("received-capability:removed"),
-      ownerPrincipalId: external_exports.string().min(1)
-    }).strict();
-  }
-});
-
 // ../protocol/src/runtime.ts
 var init_runtime = __esm({
   "../protocol/src/runtime.ts"() {
@@ -5281,10 +5071,6 @@ var init_runtime = __esm({
     init_persona_schemas();
     init_persona_mode();
     init_attachment_schemas();
-    init_principal();
-    init_capability();
-    init_inbox();
-    init_received_capability();
   }
 });
 
@@ -5559,8 +5345,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path39 = req.path;
-        _req.url = typeof path39 === "string" ? path39 : req.url ? req.url.path || req.url : void 0;
+        const path32 = req.path;
+        _req.url = typeof path32 === "string" ? path32 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -5725,14 +5511,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path39) {
+    function parsePath(path32) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path39.length; i++) {
-        const char = path39[i];
+      for (let i = 0; i < path32.length; i++) {
+        const char = path32[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -5863,10 +5649,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path39 of paths) {
-        const parts = parsePath(path39);
+      for (const path32 of paths) {
+        const parts = parsePath(path32);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path39, remove);
+          redactWildcardPath(obj, parts, censor, path32, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -5951,8 +5737,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path39) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path39];
+            const wrappedCensor = typeof censor === "function" ? (value, path32) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path32];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -5987,8 +5773,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path39 of pathsToClone) {
-        const parts = parsePath(path39);
+      for (const path32 of pathsToClone) {
+        const parts = parsePath(path32);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -6040,24 +5826,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path39) {
-      if (typeof path39 !== "string") {
+    function validatePath(path32) {
+      if (typeof path32 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path39 === "") {
+      if (path32 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path39.includes("..")) {
-        throw new Error(`Invalid redaction path (${path39})`);
+      if (path32.includes("..")) {
+        throw new Error(`Invalid redaction path (${path32})`);
       }
-      if (path39.includes(",")) {
-        throw new Error(`Invalid redaction path (${path39})`);
+      if (path32.includes(",")) {
+        throw new Error(`Invalid redaction path (${path32})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path39.length; i++) {
-        const char = path39[i];
+      for (let i = 0; i < path32.length; i++) {
+        const char = path32[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -6071,20 +5857,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path39})`);
+            throw new Error(`Invalid redaction path (${path32})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path39})`);
+        throw new Error(`Invalid redaction path (${path32})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path39 of paths) {
-        validatePath(path39);
+      for (const path32 of paths) {
+        validatePath(path32);
       }
     }
     function slowRedact(options = {}) {
@@ -6252,8 +6038,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path39) => {
-            return censor(value, [k2, ...path39]);
+          const wrappedCensor = typeof censor === "function" ? (value, path32) => {
+            return censor(value, [k2, ...path32]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6471,10 +6257,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs34 = require("fs");
+    var fs28 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path39 = require("path");
+    var path32 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6528,20 +6314,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs34.mkdirSync(path39.dirname(file), { recursive: true });
-          const fd = fs34.openSync(file, flags, mode);
+          if (sonic.mkdir) fs28.mkdirSync(path32.dirname(file), { recursive: true });
+          const fd = fs28.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs34.mkdir(path39.dirname(file), { recursive: true }, (err) => {
+        fs28.mkdir(path32.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs34.open(file, flags, mode, fileOpened);
+          fs28.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs34.open(file, flags, mode, fileOpened);
+        fs28.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -6582,8 +6368,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs34.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs34.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs28.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs28.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -6592,15 +6378,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs34.writeSync(this.fd, this._writingBuf);
+            return fs28.writeSync(this.fd, this._writingBuf);
           }
-          return fs34.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs28.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs34.write(this.fd, this._writingBuf, this.release);
+            return fs28.write(this.fd, this._writingBuf, this.release);
           }
-          return fs34.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs28.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -6657,7 +6443,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs34.fsyncSync(this.fd);
+          fs28.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -6771,7 +6557,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs34.fsync(this.fd, (err) => {
+            fs28.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -6873,7 +6659,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs34.close(fd, (err) => {
+          fs28.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -6922,7 +6708,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs34.writeSync(this.fd, buf) : fs34.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs28.writeSync(this.fd, buf) : fs28.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -6938,7 +6724,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs34.fsyncSync(this.fd);
+        fs28.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -6959,7 +6745,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs34.writeSync(this.fd, buf);
+          const n = fs28.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -6987,13 +6773,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs34.writeSync(this.fd, this._writingBuf) : fs34.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs28.writeSync(this.fd, this._writingBuf) : fs28.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs34.write(this.fd, this._writingBuf, release);
+        fs28.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -7002,7 +6788,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs34.writeSync(this.fd, this._writingBuf);
+          const written = fs28.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -7011,7 +6797,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs34.write(this.fd, this._writingBuf, release);
+        fs28.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -7027,12 +6813,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs34.fsync(sonic.fd, closeWrapped);
+        fs28.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs34.close(sonic.fd, done);
+          fs28.close(sonic.fd, done);
         } else {
           done();
         }
@@ -7289,7 +7075,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join11 } = require("path");
+    var { join: join4 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -7325,7 +7111,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join11(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join4(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         trackUnmanagedFds: false,
@@ -7711,7 +7497,7 @@ var require_transport = __commonJS({
     "use strict";
     var { createRequire } = require("module");
     var getCallers = require_caller();
-    var { join: join11, isAbsolute, sep: sep2 } = require("path");
+    var { join: join4, isAbsolute, sep } = require("path");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
     var ThreadStream = require_thread_stream();
@@ -7774,7 +7560,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -7792,7 +7578,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -7814,12 +7600,12 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join11(__dirname, "..", "file.js");
+          return join4(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
           try {
-            const context = filePath === "node:repl" ? process.cwd() + sep2 : filePath;
+            const context = filePath === "node:repl" ? process.cwd() + sep : filePath;
             fixTarget2 = createRequire(context).resolve(origin);
             break;
           } catch (err) {
@@ -8804,7 +8590,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join11 = ",";
+            let join4 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -8818,7 +8604,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join11 = `,
+                join4 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8826,13 +8612,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join11;
+                res += join4;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8853,7 +8639,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join11 = `,
+              join4 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8867,13 +8653,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join11;
+                separator = join4;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join11;
+              separator = join4;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -8914,7 +8700,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join11 = ",";
+            let join4 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -8927,7 +8713,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join11 = `,
+                join4 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8935,13 +8721,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join11;
+                res += join4;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8954,7 +8740,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join11 = `,
+              join4 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8963,7 +8749,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join11;
+                separator = join4;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -9021,20 +8807,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join12 = `,
+              const join5 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join12;
+                res2 += join5;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join12}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join5}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -9050,16 +8836,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join11 = `,
+            const join4 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join11, maximumBreadth);
+              res += stringifyTypedArray(value, join4, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join11;
+              separator = join4;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -9070,13 +8856,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join11;
+                separator = join4;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join11;
+              separator = join4;
             }
             if (separator !== "") {
               res = `
@@ -10167,11 +9953,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path39, added, removed, oldPosInc, options) {
-        var last = path39.lastComponent;
+      addToPath: function addToPath(path32, added, removed, oldPosInc, options) {
+        var last = path32.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path39.oldPos + oldPosInc,
+            oldPos: path32.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -10181,7 +9967,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path39.oldPos + oldPosInc,
+            oldPos: path32.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10239,7 +10025,7 @@ var init_lib = __esm({
       tokenize: function tokenize(value) {
         return Array.from(value);
       },
-      join: function join4(chars) {
+      join: function join3(chars) {
         return chars.join("");
       },
       postProcess: function postProcess(changeObjects) {
@@ -10612,10 +10398,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path39 = typeof rec.path === "string" ? rec.path : null;
+      const path32 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path39 || content == null) return null;
-      const entry = { path: path39, content };
+      if (!path32 || content == null) return null;
+      const entry = { path: path32, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -11075,27 +10861,6 @@ var init_claude_history = __esm({
   }
 });
 
-// src/tools/sandbox.ts
-function shouldSandbox(cwd, personaRoot) {
-  if (!personaRoot) return false;
-  const sep2 = personaRoot.endsWith(path12.sep) ? "" : path12.sep;
-  return cwd.startsWith(personaRoot + sep2) && cwd !== personaRoot;
-}
-function inferSandboxSettingsPath(cwd, personaRoot) {
-  if (!shouldSandbox(cwd, personaRoot)) return null;
-  const rel = path12.relative(personaRoot, cwd);
-  const personaId = rel.split(path12.sep)[0];
-  if (!personaId) return null;
-  return path12.join(personaRoot, personaId, ".clawd", "sandbox-settings.json");
-}
-var path12;
-var init_sandbox = __esm({
-  "src/tools/sandbox.ts"() {
-    "use strict";
-    path12 = __toESM(require("path"), 1);
-  }
-});
-
 // src/tools/claude.ts
 function macOSDesktopCandidates(home) {
   return [
@@ -11145,7 +10910,7 @@ function buildSpawnArgs(ctx) {
   ];
   if (ctx.model) args.push("--model", ctx.model);
   switch (ctx.personaMode) {
-    case "guest":
+    case "listener":
       args.push("--setting-sources", "project,local");
       break;
     case "owner":
@@ -11160,8 +10925,7 @@ function buildSpawnArgs(ctx) {
       throw new Error(`unexpected personaMode: ${String(_exhaustive)}`);
     }
   }
-  const sandboxSettings = ctx.extraSettings ?? inferSandboxSettingsPath(ctx.cwd, ctx.personaRoot);
-  if (sandboxSettings) args.push("--settings", sandboxSettings);
+  if (ctx.extraSettings) args.push("--settings", ctx.extraSettings);
   if (ctx.extraSystemPrompt) args.push("--append-system-prompt", ctx.extraSystemPrompt);
   if (ctx.effort) args.push("--effort", ctx.effort);
   if (ctx.toolSessionId) args.push("--resume", ctx.toolSessionId);
@@ -11441,10 +11205,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path39 = typeof rec.path === "string" ? rec.path : null;
+      const path32 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path39 || content == null) return null;
-      const out = { path: path39, content };
+      if (!path32 || content == null) return null;
+      const out = { path: path32, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -11560,7 +11324,6 @@ var init_claude = __esm({
     init_protocol();
     init_claude_history();
     init_tool_result_extra();
-    init_sandbox();
     ATTACHMENT_SILENT_SUBTYPES2 = /* @__PURE__ */ new Set([
       "hook_additional_context",
       "hook_success",
@@ -18943,7 +18706,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash3 } = require("crypto");
+    var { randomBytes, createHash } = require("crypto");
     var { Duplex, Readable: Readable3 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -19473,7 +19236,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes2(16).toString("base64");
+      const key = randomBytes(16).toString("base64");
       const request = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -19603,7 +19366,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -19970,7 +19733,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash3 } = require("crypto");
+    var { createHash } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -20271,7 +20034,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -20890,9 +20653,6 @@ function createLogger(opts = {}) {
   return wrap(base);
 }
 
-// src/session/store-factory.ts
-var path5 = __toESM(require("path"), 1);
-
 // src/session/store.ts
 var import_node_fs3 = __toESM(require("fs"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
@@ -20901,14 +20661,10 @@ init_protocol();
 // src/session/scope.ts
 var import_node_path3 = __toESM(require("path"), 1);
 function scopeKey(scope) {
-  if (scope.kind === "default") return "default";
-  if (scope.mode === "guest") return `persona:${scope.personaId}:guest:${scope.capId}`;
-  return `persona:${scope.personaId}:${scope.mode}`;
+  return scope.kind === "default" ? "default" : `persona:${scope.personaId}:${scope.mode}`;
 }
 function scopeSubPath(scope) {
-  if (scope.kind === "default") return ["default"];
-  if (scope.mode === "guest") return [scope.personaId, "guests", scope.capId];
-  return [scope.personaId, scope.mode];
+  return scope.kind === "default" ? ["default"] : [scope.personaId, scope.mode];
 }
 function metaFromScope(scope, personaRoot) {
   if (scope.kind === "default") return void 0;
@@ -20917,18 +20673,10 @@ function metaFromScope(scope, personaRoot) {
   }
   return {
     idleKillEnabled: true,
-    personaMode: "guest",
+    personaMode: "listener",
     extraSettings: import_node_path3.default.join(personaRoot, scope.personaId, ".clawd", "sandbox-settings.json")
   };
 }
-function scopeForFile(file, ownerPrincipalId) {
-  if (!file.ownerPersonaId) return { kind: "default" };
-  const creator = file.creatorPrincipalId;
-  if (ownerPrincipalId && creator && creator !== ownerPrincipalId) {
-    return { kind: "persona", personaId: file.ownerPersonaId, mode: "guest", capId: creator };
-  }
-  return { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" };
-}
 
 // src/session/store.ts
 function safeFileName(sessionId) {
@@ -20942,16 +20690,12 @@ function safeFileName(sessionId) {
 var SessionStore = class {
   root;
   constructor(opts) {
-    if ("root" in opts) {
-      this.root = opts.root;
-    } else {
-      const scope = opts.scope ?? { kind: "default" };
-      this.root = import_node_path4.default.join(
-        opts.dataDir,
-        "sessions",
-        ...scopeSubPath(scope).map(safeFileName)
-      );
-    }
+    const scope = opts.scope ?? { kind: "default" };
+    this.root = import_node_path4.default.join(
+      opts.dataDir,
+      "sessions",
+      ...scopeSubPath(scope).map(safeFileName)
+    );
   }
   filePath(sessionId) {
     return import_node_path4.default.join(this.root, `${safeFileName(sessionId)}.json`);
@@ -21016,66 +20760,6 @@ var SessionStore = class {
   }
 };
 
-// src/session/store-factory.ts
-var SessionStoreFactory = class {
-  dataDir;
-  bareStore = null;
-  vmOwnerStores = /* @__PURE__ */ new Map();
-  // vmGuest 索引 key = `${pid}::${capId}`（按 cap.id 隔离，一张 cap 一个目录）
-  vmGuestStores = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.dataDir = opts.dataDir;
-  }
-  // ---- root path 派生（暴露给 migration / revoke cascade 等外部消费方） ----
-  bareRoot() {
-    return path5.join(this.dataDir, "sessions");
-  }
-  vmOwnerRoot(personaId) {
-    return path5.join(
-      this.dataDir,
-      "personas",
-      safeFileName(personaId),
-      ".clawd",
-      "sessions",
-      "owner"
-    );
-  }
-  vmGuestRoot(personaId, capId) {
-    return path5.join(
-      this.dataDir,
-      "personas",
-      safeFileName(personaId),
-      ".clawd",
-      "sessions",
-      "guests",
-      safeFileName(capId)
-    );
-  }
-  // ---- SessionStore 工厂（缓存） ----
-  forBare() {
-    if (!this.bareStore) {
-      this.bareStore = new SessionStore({ root: this.bareRoot() });
-    }
-    return this.bareStore;
-  }
-  forVmOwner(personaId) {
-    const key = personaId;
-    const cached = this.vmOwnerStores.get(key);
-    if (cached) return cached;
-    const st = new SessionStore({ root: this.vmOwnerRoot(personaId) });
-    this.vmOwnerStores.set(key, st);
-    return st;
-  }
-  forVmGuest(personaId, capId) {
-    const key = `${personaId}::${capId}`;
-    const cached = this.vmGuestStores.get(key);
-    if (cached) return cached;
-    const st = new SessionStore({ root: this.vmGuestRoot(personaId, capId) });
-    this.vmGuestStores.set(key, st);
-    return st;
-  }
-};
-
 // src/session/manager.ts
 var import_node_fs5 = __toESM(require("fs"), 1);
 var import_node_path6 = __toESM(require("path"), 1);
@@ -21197,7 +20881,7 @@ function cloneState(s) {
     pendingSend: s.pendingSend
   };
 }
-var IDLE_KILL_DELAY_MS = 6e4;
+var IDLE_KILL_DELAY_MS = 5e3;
 var SEEN_UUID_CAP = 2e3;
 function applyEventBatch(state, events, deps) {
   if (events.length === 0) return { state, effects: [] };
@@ -21237,10 +20921,7 @@ function buildSpawnContext(state, deps) {
     toolSessionId: file.toolSessionId,
     model: file.model,
     permissionMode: file.permissionMode,
-    effort: file.effort,
-    // Phase 2 capability platform (plan §3): personaRoot 透传给 buildSpawnArgs;
-    // 内部 shouldSandbox(cwd, personaRoot) 决定是否注入 --settings sandbox-settings.
-    personaRoot: deps.personaRoot
+    effort: file.effort
   };
   const meta = state.subSessionMeta;
   if (meta?.personaMode) {
@@ -22025,7 +21706,6 @@ var SessionRunner = class {
       resolveContextWindow: this.hooks.resolveContextWindow,
       genUuid: this.hooks.genUuid ?? v4_default,
       ownerDisplayName: this.hooks.ownerDisplayName,
-      personaRoot: this.hooks.personaRoot,
       mode: this.hooks.mode ?? "sdk"
     };
     const { state, effects } = reduceSession(this.state, inputMsg, deps);
@@ -22457,18 +22137,9 @@ var SessionManager = class {
   attachObserver(observer) {
     this.attachedObserver = observer;
   }
-  // 按 scope 拿对应的 SessionStore.
-  // Phase 2 (capability platform plan §1) 路由切到 SessionStoreFactory:
-  //   default              → factory.forBare()                  <dataDir>/sessions/
-  //   persona/<pid>/owner  → factory.forVmOwner(pid)            <dataDir>/personas/<pid>/.clawd/sessions/owner/
-  //   persona/<pid>/guest  → factory.forVmGuest(pid, capId)     <dataDir>/personas/<pid>/.clawd/sessions/guests/<capId>/
-  // 缺省 (无 factory 注入): 回退 dataDir+scope 老路径 (向后兼容旧 spec).
+  // 按 scope 拿对应的 SessionStore。default scope 复用 deps.store（保证与
+  // bootstrap 注入的 store 一致）；persona scope 第一次访问时按需创建并缓存。
   storeFor(scope) {
-    if (this.deps.storeFactory) {
-      if (scope.kind === "default") return this.deps.storeFactory.forBare();
-      if (scope.mode === "owner") return this.deps.storeFactory.forVmOwner(scope.personaId);
-      return this.deps.storeFactory.forVmGuest(scope.personaId, scope.capId);
-    }
     if (scope.kind === "default") return this.deps.store;
     const key = scopeKey(scope);
     const cached = this.storesByScope.get(key);
@@ -22488,18 +22159,19 @@ var SessionManager = class {
     this.capabilitiesCache.set(tool, caps);
     return caps;
   }
-  // 由 SessionFile 反推 scope 的 thin wrapper —— 决策矩阵收敛到 scope.scopeForFile
-  // free function（scope.spec.ts transition 表驱动测试），manager 只负责注入 deps.
+  // 由 SessionFile.ownerPersonaId schema 字段推回写入 scope。
+  // ownerPersonaId 由 create({ownerPersonaId}) 在 schema 落盘时记入，永远只反映
+  // session 出身（不可变）；此函数只用于 SessionStore 的写入路由，不参与运行时行为
+  // 决策（personaMode='owner' 等由路径 → scope → metaFromScope 派生）。
+  // 仅覆盖 owner + default 两类——listener sub-session 不会从 default RPC 路径进来。
   scopeForFile(file) {
-    return scopeForFile(file, this.deps.ownerPrincipalId);
+    return file.ownerPersonaId ? { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" } : { kind: "default" };
   }
-  // 扫所有 persona 命名空间. 用于 findOwnedSession / listAllOwned 跨 scope 查询.
-  // Phase 2 capability platform: 新布局下 persona 资产在 <dataDir>/personas/<pid>/,
-  // 直接 readdir 这个目录拿所有 personaId. 老布局 (无 storeFactory) fallback 扫
-  // <dataDir>/sessions/ 列子目录 (排除 'default').
+  // 扫 <dataDir>/sessions/ 列出所有 persona 命名空间（不含 'default'）。
+  // 用于 findOwnedSession / listAllOwned 跨 scope 查询。
   listPersonaIdsOnDisk() {
     if (!this.deps.dataDir) return [];
-    const root = this.deps.storeFactory ? import_node_path6.default.join(this.deps.dataDir, "personas") : import_node_path6.default.join(this.deps.dataDir, "sessions");
+    const root = import_node_path6.default.join(this.deps.dataDir, "sessions");
     let entries;
     try {
       entries = import_node_fs5.default.readdirSync(root, { withFileTypes: true });
@@ -22510,37 +22182,13 @@ var SessionManager = class {
     }
     return entries.filter((e) => e.isDirectory() && e.name !== "default").map((e) => e.name);
   }
-  // 扫某 persona 下 guests/ 子目录, 拿所有 capId.
-  // 路径: <dataDir>/personas/<pid>/.clawd/sessions/guests/<capId>/
-  // 只在 storeFactory 注入 (新布局) 下生效, 老布局无 guest 目录.
-  listGuestCapIdsForPersona(personaId) {
-    if (!this.deps.dataDir || !this.deps.storeFactory) return [];
-    const root = import_node_path6.default.join(
-      this.deps.dataDir,
-      "personas",
-      personaId,
-      ".clawd",
-      "sessions",
-      "guests"
-    );
-    let entries;
-    try {
-      entries = import_node_fs5.default.readdirSync(root, { withFileTypes: true });
-    } catch (err) {
-      const code = err?.code;
-      if (code === "ENOENT") return [];
-      throw err;
-    }
-    return entries.filter((e) => e.isDirectory()).map((e) => e.name);
-  }
-  // owner / default + persona guests 三大分类下按 sessionId 找文件——前端只传 sessionId 不带 scope，
-  // SessionManager 在这里定位。四层快慢路径：
+  // owner / default 两个分类下按 sessionId 找文件——前端只传 sessionId 不带 scope，
+  // SessionManager 在这里定位。三层快慢路径：
   //   1) active runner（用户当前在用的 session）：runner.state.file 是 SessionFile 内存权威副本，
   //      直接返回，零磁盘 I/O。覆盖 attachment / file-sharing 等"用户操作 → 紧接着 RPC"的
   //      绝大多数场景
   //   2) default scope 磁盘：inactive default session 命中
   //   3) 所有 persona owner 目录扫盘：inactive persona owner session 命中
-  //   4) 每个 persona 的 guests/<capId>/ 扫盘：guest 通过我颁发 token 接进来创建的 session
   // listener sub-session 不走这条——transport 始终明确传 (personaId, sessionId)。
   //
   // 公开方法：attachment / file-sharing handler 通过 deps 闭包消费，不应直接持 SessionStore
@@ -22552,13 +22200,8 @@ var SessionManager = class {
     if (dflt) return dflt;
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
-      const found = ownerStore.read(sessionId);
-      if (found) return found;
-      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
-        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
-        const g2 = guestStore.read(sessionId);
-        if (g2) return g2;
-      }
+      const file = ownerStore.read(sessionId);
+      if (file) return file;
     }
     return null;
   }
@@ -22569,40 +22212,30 @@ var SessionManager = class {
     const file = this.findOwnedSession(sessionId);
     return file ? this.scopeForFile(file) : null;
   }
-  // 合并 default + 每个 persona 的 owner/ + guests/<capId>/ —— 桌面 App 主 session 列表入口.
-  // guest sessions 由 handlers/session.ts list 处按 ctx.principal.kind === 'guest' 做权限过滤
-  // (creatorPrincipalId === capId), 这里仅负责数据源汇总.
-  // listener sub-session 不走这条（listener 走 persona:listSubSessions RPC 单独入口）。
+  // 合并 default + 所有 persona owner 的 SessionFile —— 桌面 App 主 session 列表入口。
+  // 同样不含 listener sub-session（listener 走 persona:listSubSessions RPC 单独入口）。
   listAllOwned() {
     const out = [];
     out.push(...this.deps.store.list());
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
       out.push(...ownerStore.list());
-      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
-        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
-        out.push(...guestStore.list());
-      }
     }
     return out.sort(
       (a, b2) => a.updatedAt > b2.updatedAt ? -1 : a.updatedAt < b2.updatedAt ? 1 : 0
     );
   }
-  // 写回 SessionFile，自动根据 ownerPersonaId / creatorPrincipalId 派生写入 scope.
-  // 调用方原先都是 `deps.store.write(updated)`，全部走这里收口路由.
+  // 写回 SessionFile，自动根据 ownerPersonaId 派生写入 scope。
+  // 调用方原先都是 `deps.store.write(updated)`，全部走这里收口路由。
   writeOwned(file) {
     return this.storeFor(this.scopeForFile(file)).write(file);
   }
-  // 删除 owned SessionFile（default / persona owner / persona guest），与 findOwnedSession 对称扫盘.
+  // 删除 owned SessionFile（default 或 persona/owner），与 findOwnedSession 对称扫盘。
   deleteOwned(sessionId) {
     if (this.deps.store.delete(sessionId)) return true;
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
       if (ownerStore.delete(sessionId)) return true;
-      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
-        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
-        if (guestStore.delete(sessionId)) return true;
-      }
     }
     return false;
   }
@@ -22610,8 +22243,8 @@ var SessionManager = class {
   // 经过 compressFrameForWire 后决定是 push collector 还是走 deps.broadcastFrame。
   // scope 决定两件事：SessionStore 路由 + SubSessionMeta 派生（metaFromScope）。
   //   - default → 复用 deps.store，无 subSessionMeta（普通 session）
-  //   - persona/owner → personas/<pid>/.clawd/sessions/owner/，meta={idleKillEnabled:false, personaMode:'owner'}
-  //   - persona/guest → personas/<pid>/.clawd/sessions/guests/<capId>/，meta={idleKillEnabled:true, personaMode:'guest', extraSettings:<sandbox>}
+  //   - persona/owner → <dataDir>/sessions/<personaId>/owner/，meta={idleKillEnabled:false, personaMode:'owner'}
+  //   - persona/listener → <dataDir>/sessions/<personaId>/listener/，meta={idleKillEnabled:true, personaMode:'listener', extraSettings:<sandbox>}
   newRunner(file, scope) {
     const adapter = this.deps.getAdapter(file.tool ?? "claude");
     const store = this.storeFor(scope);
@@ -22630,9 +22263,6 @@ var SessionManager = class {
       dataDir: this.deps.dataDir,
       personaStore: this.deps.personaStore,
       ownerDisplayName: this.deps.ownerDisplayName,
-      // Phase 2 capability platform (plan §3): 透传 personaRoot, buildSpawnArgs 据
-      // cwd 是否在 personaRoot 下自动决定是否注入 --settings sandbox-settings.json.
-      personaRoot: this.deps.personaRoot,
       // 透传给 ReducerDeps.mode：reducer send !procAlive spawn 路径据此判断要不要把
       // readyForSend 翻 false（TUI 翻 false 让 user_text 走 pendingSend 暂存；SDK 不动保持直写）
       mode: this.deps.mode,
@@ -22730,7 +22360,7 @@ var SessionManager = class {
     }
   }
   // ---- 命令方法：均返回 { response, broadcast[] }，由 dispatcher 聚合 ----
-  create(args, creatorPrincipalId) {
+  create(args) {
     let cwd;
     if (args.ownerPersonaId) {
       cwd = derivePersonaSpawnCwd(
@@ -22771,11 +22401,10 @@ var SessionManager = class {
       iconKey: args.iconKey,
       forkedFromSessionId: args.forkedFromSessionId,
       ownerPersonaId: args.ownerPersonaId,
-      creatorPrincipalId,
       createdAt: iso,
       updatedAt: iso
     };
-    const scope = this.scopeForFile(file);
+    const scope = args.ownerPersonaId ? { kind: "persona", personaId: args.ownerPersonaId, mode: "owner" } : { kind: "default" };
     const written = this.storeFor(scope).write(file);
     return { response: written, broadcast: [] };
   }
@@ -23200,18 +22829,28 @@ var SessionManager = class {
     this.runners.set(file.sessionId, r);
     return r;
   }
-  // ---------------- scope-explicit sub-session API ----------------
+  // ---------------- persona / listener sub-session 专用 API ----------------
   //
-  // 区别于 owner / default 单 sessionId 入口，这些 API 接 SessionScope 参数 ——
-  // 调用方（PersonaManager / observer 等）明确传 scope，由 storeFor 路由到正确目录:
-  //   - {kind:'persona', personaId, mode:'guest', capId} → guests/<capId>/，meta={idleKill:true, sandbox}
-  //   - {kind:'persona', personaId, mode:'owner'}       → owner/，meta={idleKill:false}
+  // PersonaManager 是 SessionManager 之上的薄编排层，listener sub-session 的持久化
+  // （SessionFile）仍由 SessionManager 持有。区别于普通 / owner session：
+  //   - SessionFile 落到 <dataDir>/sessions/<personaId>/listener/（拓扑分类）
+  //   - reducer state.subSessionMeta.idleKillEnabled = true（turn_end 自动 idle-kill）
+  //   - sessionId 由 PersonaManager 派生（personaId-<tokenHash>），不走自动 newSessionId
   //
-  // SubSessionMeta 由 scope → metaFromScope 派生，不进 SessionFile schema。
+  // 这些 API 接 SessionScope 参数（不再是单参 agentId）—— transport 始终明确传
+  // {kind:'persona', personaId, mode:'listener'}，与 owner / default 分类隔离。
   /** 按 scope 读取 SessionFile；不存在返回 null */
   readForScope(sessionId, scope) {
     return this.storeFor(scope).read(sessionId);
   }
+  /**
+   * 列出指定 persona 在指定 mode 下的所有 SessionFile。
+   * persona:listSubSessions RPC 入口（mode='listener'）；
+   * 路径下还未写过任何 session 时 list() 返回空数组（SessionStore.list 内部 ENOENT 处理）
+   */
+  listPersonaSessions(personaId, mode) {
+    return this.storeFor({ kind: "persona", personaId, mode }).list();
+  }
   /**
    * 创建 sub-session 的 SessionFile + 准备 runner（不 spawn）。
    * SubSessionMeta 不进 SessionFile schema，运行时由 scope → metaFromScope 派生。
@@ -23356,7 +22995,7 @@ var SessionManager = class {
     return { response: { ok: true }, broadcast };
   }
   /**
-   * 改 SessionFile.label（scope-explicit sub-session 重命名入口）。
+   * 改 SessionFile.label（用于 listener-bound chat:rename RPC）。
    * 不存在抛 SESSION_NOT_FOUND。
    */
   renameForScope(args) {
@@ -23371,7 +23010,7 @@ var SessionManager = class {
     store.write({ ...file, label: args.label });
   }
   /**
-   * 删除 scope-explicit sub-session。
+   * 删除 listener-scope sub-session（用于 chat:delete RPC）。
    * - 若 runner 存在：走 reducer 'delete' command 收尾（SIGKILL + 文件 unlink + broadcast）
    * - 若 runner 不存在：直接删 scope store 文件 + 广播 session:deleted
    * 不存在抛 SESSION_NOT_FOUND。
@@ -23642,7 +23281,7 @@ var SessionManager = class {
 
 // src/persona/store.ts
 var fs6 = __toESM(require("fs"), 1);
-var path8 = __toESM(require("path"), 1);
+var path7 = __toESM(require("path"), 1);
 init_protocol();
 var DEFAULT_SETTINGS = {
   permissions: {
@@ -23671,13 +23310,13 @@ var PersonaStore = class {
   }
   root;
   personaDir(personaId) {
-    return path8.join(this.root, safeFileName(personaId));
+    return path7.join(this.root, safeFileName(personaId));
   }
   metaPath(personaId) {
-    return path8.join(this.personaDir(personaId), ".clawd", "persona.json");
+    return path7.join(this.personaDir(personaId), ".clawd", "persona.json");
   }
   claudeMdPath(personaId) {
-    return path8.join(this.personaDir(personaId), "CLAUDE.md");
+    return path7.join(this.personaDir(personaId), "CLAUDE.md");
   }
   /**
    * Sandbox settings 落盘路径 —— 故意放在 `.clawd/` 而不是 `.claude/`，让 CC 的
@@ -23687,11 +23326,11 @@ var PersonaStore = class {
    * 加载 persona 人格，只有 listener 多一层 OS sandbox。
    */
   sandboxSettingsPath(personaId) {
-    return path8.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
+    return path7.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
   }
   write(persona, personality) {
     const dir = this.personaDir(persona.personaId);
-    fs6.mkdirSync(path8.join(dir, ".clawd"), { recursive: true });
+    fs6.mkdirSync(path7.join(dir, ".clawd"), { recursive: true });
     this.atomicWrite(this.claudeMdPath(persona.personaId), personality);
     this.atomicWrite(
       this.sandboxSettingsPath(persona.personaId),
@@ -23709,10 +23348,6 @@ var PersonaStore = class {
     const p2 = this.metaPath(personaId);
     if (!fs6.existsSync(p2)) return null;
     const raw = JSON.parse(fs6.readFileSync(p2, "utf8"));
-    if (raw && typeof raw === "object" && "tokenMap" in raw) {
-      delete raw.tokenMap;
-      this.atomicWrite(p2, JSON.stringify(raw, null, 2));
-    }
     return PersonaFileSchema.parse(raw);
   }
   has(personaId) {
@@ -23738,14 +23373,14 @@ var PersonaStore = class {
   }
   /** Persona 私有 skills 目录路径：<personaDir>/.claude/skills */
   skillsDir(personaId) {
-    return path8.join(this.personaDir(personaId), ".claude", "skills");
+    return path7.join(this.personaDir(personaId), ".claude", "skills");
   }
   /**
    * Claude Code 项目级 settings 路径：`<personaDir>/.claude/settings.json`。
    * 这里只读 `enabledPlugins` 字段，由 owner 通过 CC `/plugin` 之类命令维护，daemon 不写。
    */
   claudeSettingsPath(personaId) {
-    return path8.join(this.personaDir(personaId), ".claude", "settings.json");
+    return path7.join(this.personaDir(personaId), ".claude", "settings.json");
   }
   /**
    * 读取 persona 的 `.claude/settings.json` 中 `enabledPlugins` map，把 value === true
@@ -23779,7 +23414,7 @@ var PersonaStore = class {
   list() {
     if (!fs6.existsSync(this.root)) return [];
     return fs6.readdirSync(this.root).filter((name) => {
-      return fs6.existsSync(path8.join(this.root, name, ".clawd", "persona.json"));
+      return fs6.existsSync(path7.join(this.root, name, ".clawd", "persona.json"));
     });
   }
   remove(personaId) {
@@ -23804,19 +23439,12 @@ var PersonaRegistry = class {
   }
   store;
   cache = /* @__PURE__ */ new Map();
-  /**
-   * 从 store 全量重建缓存（boot 时 + 测试 setup 时）。
-   * 单个 persona 读失败（损坏的 persona.json / schema 不匹配）不应阻塞 daemon 启动 ——
-   * try/catch 隔离，让其它 persona 仍能加载。
-   */
+  /** 从 store 全量重建缓存（boot 时 + 测试 setup 时） */
   reload() {
     this.cache.clear();
     for (const id of this.store.list()) {
-      try {
-        const p2 = this.store.read(id);
-        if (p2) this.cache.set(p2.personaId, p2);
-      } catch {
-      }
+      const p2 = this.store.read(id);
+      if (p2) this.cache.set(p2.personaId, p2);
     }
   }
   get(personaId) {
@@ -23832,6 +23460,21 @@ var PersonaRegistry = class {
   list() {
     return Array.from(this.cache.values());
   }
+  /**
+   * file-sharing HTTP auth-context 用的逆向查表：只有 Bearer token，没有 personaId。
+   * 线性扫所有 persona.tokenMap 找到第一条 ok 命中的；revoked / non-public persona 跳过。
+   * persona 数量通常 < 100，性能可忽略。
+   */
+  findByToken(token) {
+    if (!token) return null;
+    for (const persona of this.cache.values()) {
+      if (!persona.public) continue;
+      const entry = persona.tokenMap?.[token];
+      if (!entry || entry.revoked) continue;
+      return { personaId: persona.personaId, label: entry.label };
+    }
+    return null;
+  }
 };
 
 // src/persona/manager.ts
@@ -24125,6 +23768,9 @@ var PersonaManager = class {
       model: args.model,
       public: args.public ?? false,
       iconKey: args.iconKey,
+      // 初始化空 token 集合；后续由 issueToken / revokeToken 维护，
+      // file-sharing HTTP Bearer 鉴权用 PersonaRegistry.findByToken 反查
+      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -24174,22 +23820,52 @@ var PersonaManager = class {
   }
   /**
    * 删除 persona。
-   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录,
-   * Phase 2 capability platform 新布局下含 .clawd/sessions/owner/ +
-   * .clawd/sessions/guests/<capId>/, rmSync recursive force 一锅清.
-   *
-   * ⚠️ TODO (Phase 3+ design gap, reviewer P1 flagged):
-   * ~/.clawd/capabilities.json 里若有 cap.grants 含本 personaId, grant 会变成
-   * 悬空引用 (guest 仍能持 token 接入, 但调依赖该 persona 的 RPC 会 fail).
-   * 选项: (A) 这里扫所有 cap 过滤掉该 personaId 的 grant; (B) revoke 所有 grant
-   * 含该 personaId 的 cap. 当前因 cleanupGuestSessionsForCapability 用 rmSync
-   * force=true 吞 ENOENT 不会 crash, 但 UI CapabilityManagerDrawer 会展示
-   * "无效的 persona" grant. Phase 3 加 cross-reference 矩阵后正式实现.
+   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录。
    */
   delete(personaId) {
     this.deps.store.remove(personaId);
     this.deps.registry.remove(personaId);
   }
+  /**
+   * 生成 32-char base64url token 并写入 tokenMap，给 file-sharing HTTP Bearer
+   * 鉴权用（PersonaRegistry.findByToken 反查 personaId/label）。
+   */
+  issueToken(personaId, label) {
+    const existing = this.deps.registry.get(personaId);
+    if (!existing) throw new Error(`persona not found: ${personaId}`);
+    const token = import_node_crypto3.default.randomBytes(24).toString("base64url");
+    const entry = {
+      label,
+      issuedAt: Date.now(),
+      revoked: false
+    };
+    const updated = {
+      ...existing,
+      tokenMap: { ...existing.tokenMap ?? {}, [token]: entry },
+      updatedAt: Date.now()
+    };
+    this.deps.store.writeMeta(updated);
+    this.deps.registry.set(updated);
+    return { token, persona: updated };
+  }
+  /** 标记 token 为 revoked（保留条目用于审计）；不存在的 token 抛错。 */
+  revokeToken(personaId, token) {
+    const existing = this.deps.registry.get(personaId);
+    if (!existing) throw new Error(`persona not found: ${personaId}`);
+    const tokenEntry = existing.tokenMap?.[token];
+    if (!tokenEntry) throw new Error(`token not found in persona ${personaId}`);
+    const updated = {
+      ...existing,
+      tokenMap: {
+        ...existing.tokenMap ?? {},
+        [token]: { ...tokenEntry, revoked: true }
+      },
+      updatedAt: Date.now()
+    };
+    this.deps.store.writeMeta(updated);
+    this.deps.registry.set(updated);
+    return updated;
+  }
   /**
    * label 转 4-16 char slug。优先用 `persona-<slug>`；若 slug 已被占用，追加 4 char
    * base64url 随机后缀直到不撞为止（最多 5 次，理论冲突 ≈ 2^-24，留个 panic 上限）。
@@ -24209,7 +23885,7 @@ var PersonaManager = class {
 
 // src/persona/seed.ts
 var fs8 = __toESM(require("fs"), 1);
-var path10 = __toESM(require("path"), 1);
+var path9 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var import_meta = {};
 var DEFAULT_PERSONAS = [
@@ -24245,14 +23921,14 @@ var DEFAULT_PERSONAS = [
 function findDefaultsRoot() {
   const candidates = [];
   try {
-    const here = path10.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    candidates.push(path10.resolve(here, "defaults"));
-    candidates.push(path10.resolve(here, "persona-defaults"));
+    const here = path9.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    candidates.push(path9.resolve(here, "defaults"));
+    candidates.push(path9.resolve(here, "persona-defaults"));
   } catch {
   }
   if (process.argv[1]) {
-    const argvDir = path10.dirname(process.argv[1]);
-    candidates.push(path10.resolve(argvDir, "persona-defaults"));
+    const argvDir = path9.dirname(process.argv[1]);
+    candidates.push(path9.resolve(argvDir, "persona-defaults"));
   }
   for (const c of candidates) {
     try {
@@ -24269,7 +23945,7 @@ function seedDefaultPersonas(args) {
       args.logger.info("persona.seed.skip", { personaId: entry.personaId, reason: "exists" });
       continue;
     }
-    const bundleDir = path10.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path9.join(args.defaultsRoot, entry.personaId);
     if (!fs8.existsSync(bundleDir)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -24278,7 +23954,7 @@ function seedDefaultPersonas(args) {
       });
       continue;
     }
-    const claudeMdPath = path10.join(bundleDir, "CLAUDE.md");
+    const claudeMdPath = path9.join(bundleDir, "CLAUDE.md");
     if (!fs8.existsSync(claudeMdPath)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -24295,6 +23971,7 @@ function seedDefaultPersonas(args) {
       model: entry.model,
       public: entry.public,
       iconKey: entry.iconKey,
+      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -24306,8 +23983,8 @@ function seedDefaultPersonas(args) {
 function copyBundleExtras(srcDir, dstDir) {
   for (const entry of fs8.readdirSync(srcDir, { withFileTypes: true })) {
     if (entry.name === "CLAUDE.md" || entry.name === ".clawd") continue;
-    const srcPath = path10.join(srcDir, entry.name);
-    const dstPath = path10.join(dstDir, entry.name);
+    const srcPath = path9.join(srcDir, entry.name);
+    const dstPath = path9.join(dstDir, entry.name);
     if (entry.isDirectory()) {
       fs8.cpSync(srcPath, dstPath, { recursive: true, dereference: true });
     } else if (entry.isFile()) {
@@ -24910,6 +24587,16 @@ function spawnPty(opts) {
 
 // src/tools/claude-tui.ts
 var { Terminal } = import_headless.default;
+var POPUP_FOOTER_PATTERNS = [
+  { kind: "permission", regex: /Tab to amend|Do you want to proceed/i },
+  { kind: "question", regex: /Enter to select|↑\/↓ to navigate/i }
+];
+function matchPopupFooterKind(bufferText) {
+  for (const p2 of POPUP_FOOTER_PATTERNS) {
+    if (p2.regex.test(bufferText)) return p2.kind;
+  }
+  return null;
+}
 function hasInputFrame(bufferText) {
   const lines = bufferText.split("\n");
   for (let i = 1; i < lines.length; i++) {
@@ -24924,6 +24611,7 @@ var READY_SIGNATURE_PATTERNS = [
   { name: "input-frame", match: hasInputFrame }
 ];
 function isReadySignature(bufferText) {
+  if (matchPopupFooterKind(bufferText) !== null) return false;
   return READY_SIGNATURE_PATTERNS.some((p2) => p2.match(bufferText));
 }
 function createPopupDetector(opts) {
@@ -24939,7 +24627,7 @@ function createPopupDetector(opts) {
   let pendingClear = null;
   let quietTimer = null;
   const QUIET_MS = opts.quietMs ?? 300;
-  const scanReady = () => {
+  const scanScreen = () => {
     const buf = term.buffer.active;
     const lines = [];
     for (let i = 0; i < buf.length; i++) {
@@ -24947,16 +24635,20 @@ function createPopupDetector(opts) {
       if (!line) continue;
       lines.push(line.translateToString(true));
     }
-    return isReadySignature(lines.join("\n"));
+    const text = lines.join("\n");
+    return { ready: isReadySignature(text), footerKind: matchPopupFooterKind(text) };
   };
   const tick = () => {
     if (quietTimer) clearTimeout(quietTimer);
     quietTimer = setTimeout(() => {
       quietTimer = null;
-      const ready = scanReady();
+      const { ready, footerKind } = scanScreen();
+      const popupKind = footerKind ?? "unknown";
+      console.log("[BUGHUNT-READYGATE] quietTick", { ready, prevVisible: visible, popupKind });
       if (!ready && visible === null) {
-        visible = "unknown";
-        opts.onTransition("unknown", true);
+        visible = popupKind;
+        console.log("[BUGHUNT-READYGATE] emit popup_open", { popupKind });
+        opts.onTransition(popupKind, true);
       } else if (!ready && visible !== null) {
         if (pendingClear) {
           clearTimeout(pendingClear);
@@ -25635,7 +25327,6 @@ var import_sender = __toESM(require_sender(), 1);
 var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
-var wrapper_default = import_websocket.default;
 
 // src/transport/local-ws-server.ts
 var import_node_http = __toESM(require("http"), 1);
@@ -25650,9 +25341,6 @@ var LocalWsServer = class {
   httpServer = null;
   frameHandler = null;
   clients = /* @__PURE__ */ new Map();
-  // Task 1.7 capability platform：capId → Set<clientId>，撤销时 O(1) 找到该 cap 的
-  // 所有活跃连接做关闭级联（Task 1.10）。同一 cap 可能多端同时连（多设备 / 多 tab）。
-  capabilityIdToClients = /* @__PURE__ */ new Map();
   logger;
   pingIntervalMs;
   async start() {
@@ -25743,49 +25431,6 @@ var LocalWsServer = class {
       this.safeSend(c.ws, frame);
     }
   }
-  // Task 1.9 capability platform：仅广播给 owner 连接（跳过 guest ws）。
-  // 用于 capability:tokenIssued / capability:tokenDeleted 等 owner-only push frame——
-  // guest 没必要也无法消费这类管理帧。noAuth localhost ws 没有 ctx, 视作 owner.
-  broadcastToOwners(frame) {
-    const gate = this.opts.authGate;
-    for (const c of this.clients.values()) {
-      if (gate && !gate.isAuthed(c.handle.id)) continue;
-      if (c.ctx && c.ctx.principal.kind !== "owner") continue;
-      this.safeSend(c.ws, frame);
-    }
-  }
-  // capability platform v3 inbox 重写: 推给某条 cap channel 的两端 ws.
-  //   - 所有 owner ws (owner 看自家所有 channel)
-  //   - 该 capabilityId 的所有 guest ws (该 cap 持有人的多端/多 tab)
-  // 一次调用同时推两端, inbox:event push 帧由此走.
-  broadcastToCapabilityChannel(capabilityId, frame) {
-    this.broadcastToOwners(frame);
-    const set = this.capabilityIdToClients.get(capabilityId);
-    if (!set) return;
-    for (const id of set) {
-      const c = this.clients.get(id);
-      if (!c) continue;
-      this.safeSend(c.ws, frame);
-    }
-  }
-  // Phase 4 capability platform DM: 广播到指定 principal 的所有活跃 ws.
-  //   principalId === ownerPrincipalId  → 同 broadcastToOwners (所有 owner ws)
-  //   principalId === 'owner' sentinel  → 同上（向后兼容遗留 caller / 协议层 sentinel）
-  //   principalId === 'cap_xxx'         → 该 capability 的所有 guest ws (多端 / 多 tab)
-  // 用于 DM inbox:event 路由: from + to 两侧各播一次, 让双方 UI 实时看到 thread 更新.
-  broadcastToPrincipal(principalId, frame) {
-    if (principalId === "owner" || principalId === this.opts.ownerPrincipalId) {
-      this.broadcastToOwners(frame);
-      return;
-    }
-    const set = this.capabilityIdToClients.get(principalId);
-    if (!set) return;
-    for (const id of set) {
-      const c = this.clients.get(id);
-      if (!c) continue;
-      this.safeSend(c.ws, frame);
-    }
-  }
   firstSubscriber(sessionId) {
     for (const c of this.clients.values()) {
       if (c.handle.subscribedSessions.has(sessionId)) return c.handle;
@@ -25807,40 +25452,6 @@ var LocalWsServer = class {
     if (!c) return;
     this.safeSend(c.ws, frame);
   }
-  // Task 1.7 capability platform：AuthGate.onAuthed 回调里调本方法，把 ConnectionContext
-  // 绑到 client；guest 连接同时进 capId 索引（Task 1.10 撤销级联用）。
-  attachClientContext(clientId, ctx) {
-    const c = this.clients.get(clientId);
-    if (!c) return;
-    c.ctx = ctx;
-    if (ctx.capabilityId) {
-      let set = this.capabilityIdToClients.get(ctx.capabilityId);
-      if (!set) {
-        set = /* @__PURE__ */ new Set();
-        this.capabilityIdToClients.set(ctx.capabilityId, set);
-      }
-      set.add(clientId);
-    }
-  }
-  // 测试 / Task 1.8 dispatcher 用：拿 client 当前 ConnectionContext（null = 未鉴权 / noAuth）
-  getClientContext(clientId) {
-    return this.clients.get(clientId)?.ctx ?? null;
-  }
-  // Task 1.10 撤销级联：关闭某 capability 的所有活跃 ws 连接。close code 4401
-  // 让客户端识别 'capability revoked' 而非普通断连。
-  closeConnectionsByCapability(capabilityId, code = 4401, reason = "TOKEN_REVOKED") {
-    const set = this.capabilityIdToClients.get(capabilityId);
-    if (!set) return;
-    const ids = [...set];
-    for (const id of ids) {
-      const c = this.clients.get(id);
-      if (!c) continue;
-      try {
-        c.ws.close(code, reason);
-      } catch {
-      }
-    }
-  }
   // URL path 路由：'/' → 主连接路径；其他 → close 4404
   routeConnection(socket, req) {
     const remoteAddress = req?.socket?.remoteAddress;
@@ -25875,7 +25486,7 @@ var LocalWsServer = class {
       } catch {
       }
     }, this.pingIntervalMs);
-    this.clients.set(id, { handle, ws: socket, pingTimer, ctx: null });
+    this.clients.set(id, { handle, ws: socket, pingTimer });
     this.logger?.info("client connected", { clientId: id, total: this.clients.size, remoteAddress });
     const authGate = this.opts.authGate;
     let authed = true;
@@ -25899,12 +25510,6 @@ var LocalWsServer = class {
     socket.on("close", () => {
       const c = this.clients.get(id);
       if (c?.pingTimer) clearInterval(c.pingTimer);
-      const capId = c?.ctx?.capabilityId;
-      if (capId) {
-        const set = this.capabilityIdToClients.get(capId);
-        set?.delete(id);
-        if (set && set.size === 0) this.capabilityIdToClients.delete(capId);
-      }
       this.clients.delete(id);
       authGate?.unregister(id);
       this.logger?.info("client disconnected", { clientId: id, remaining: this.clients.size });
@@ -25937,17 +25542,6 @@ var LocalWsServer = class {
         return;
       }
     } else if (frame.type === "auth") {
-      const token = typeof frame.token === "string" ? frame.token ?? "" : "";
-      const selfPrincipalId = typeof frame.selfPrincipalId === "string" ? frame.selfPrincipalId ?? "" : "";
-      const selfDisplayName = typeof frame.selfDisplayName === "string" ? frame.selfDisplayName ?? "" : "";
-      if (token && this.opts.tryVerifyCapabilityToken) {
-        const guestCtx = this.opts.tryVerifyCapabilityToken(
-          token,
-          selfPrincipalId || void 0,
-          selfDisplayName || void 0
-        );
-        if (guestCtx) this.attachClientContext(client.id, guestCtx);
-      }
       this.safeSend(this.clients.get(client.id).ws, { type: "auth:ok" });
       return;
     }
@@ -26064,31 +25658,15 @@ var AuthGate = class {
       this.markFailed(handle.id);
       return frame.type === "auth" ? "consumed" : "reject";
     }
-    let ctx = null;
-    if (this.opts.authenticate) {
-      const r = this.opts.authenticate(
-        parsed.data.token,
-        parsed.data.selfPrincipalId,
-        parsed.data.selfDisplayName
-      );
-      if (!r.ok) {
-        this.opts.closeConnection(handle, 4401, r.code);
-        this.markFailed(handle.id);
-        return "consumed";
-      }
-      ctx = r.context;
-    } else {
-      if (!this.opts.expectedToken) {
-        this.opts.closeConnection(handle, 1008, "auth not configured");
-        this.markFailed(handle.id);
-        return "consumed";
-      }
-      if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
-        this.opts.closeConnection(handle, 1008, "auth failed");
-        this.markFailed(handle.id);
-        return "consumed";
-      }
-      ctx = this.opts.buildOwnerContext?.() ?? null;
+    if (!this.opts.expectedToken) {
+      this.opts.closeConnection(handle, 1008, "auth not configured");
+      this.markFailed(handle.id);
+      return "consumed";
+    }
+    if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
+      this.opts.closeConnection(handle, 1008, "auth failed");
+      this.markFailed(handle.id);
+      return "consumed";
     }
     if (st.timer != null) {
       const clear = this.opts.clearTimer ?? ((h) => clearTimeout(h));
@@ -26096,7 +25674,6 @@ var AuthGate = class {
     }
     st.authed = true;
     st.timer = null;
-    if (ctx && this.opts.onAuthed) this.opts.onAuthed(handle, ctx);
     this.opts.sendOk(handle, { type: "auth:ok" });
     return "consumed";
   }
@@ -26132,7 +25709,7 @@ var AuthContextResolver = class {
   }
   opts;
   /**
-   * 从 `Authorization` 头解析。null = 无凭证 / 不识别，调用方一律 401。
+   * 从 `Authorization` 头解析。null = 无凭证 / 不识别 / revoked，调用方一律 401。
    * remoteAddress 用于 isLoopback 判定（loopback = 127.0.0.1 / ::1 / ::ffff:127.0.0.1）。
    */
   resolveFromHeader(authHeader, remoteAddress) {
@@ -26142,6 +25719,15 @@ var AuthContextResolver = class {
     if (this.opts.ownerToken && constantTimeEqual2(token, this.opts.ownerToken)) {
       return { role: "owner", isLoopback };
     }
+    const personalHit = this.opts.personaRegistry.findByToken(token);
+    if (personalHit) {
+      return {
+        role: "personal",
+        personaId: personalHit.personaId,
+        label: personalHit.label,
+        isLoopback
+      };
+    }
     return null;
   }
 };
@@ -26163,753 +25749,206 @@ function constantTimeEqual2(a, b2) {
   return diff2 === 0;
 }
 
-// ../protocol/src/index.ts
-init_runtime();
-
-// src/transport/connection-context.ts
-function ownerContext(ownerPrincipalId, displayName) {
-  return {
-    principal: makeOwnerPrincipal(ownerPrincipalId, displayName),
-    grants: [{ resource: { type: "*" }, actions: ["admin"] }]
-  };
-}
-function guestContext(cap) {
-  return {
-    principal: { id: cap.id, kind: "guest", displayName: cap.displayName },
-    grants: cap.grants,
-    capabilityId: cap.id
-  };
-}
-function authenticate(token, deps) {
-  if (!token) return { ok: false, code: "NO_TOKEN" };
-  if (deps.isOwnerToken(token)) {
-    return { ok: true, context: ownerContext(deps.ownerPrincipalId, deps.ownerDisplayName) };
-  }
-  if (!deps.capabilityRegistry) return { ok: false, code: "BAD_TOKEN" };
-  const v2 = deps.capabilityRegistry.verifyToken(token);
-  if (!v2.ok) {
-    if (v2.code === "TOKEN_INVALID") return { ok: false, code: "BAD_TOKEN" };
-    return { ok: false, code: v2.code };
-  }
-  if (deps.selfPrincipalId && deps.selfDisplayName && deps.onGuestHello) {
-    try {
-      deps.onGuestHello(v2.capability.id, deps.selfPrincipalId, deps.selfDisplayName);
-    } catch (e) {
-      if (e.message === "TOKEN_SHARED_LEAK") {
-        return { ok: false, code: "TOKEN_REVOKED" };
-      }
-      throw e;
-    }
-  }
-  return { ok: true, context: guestContext(v2.capability) };
-}
+// src/transport/http-router.ts
+var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
 
-// src/permission/capability-store.ts
-var fs15 = __toESM(require("fs"), 1);
-var path18 = __toESM(require("path"), 1);
-var CAPABILITIES_FILE_NAME = "capabilities.json";
-var FILE_VERSION = 1;
-var CapabilityStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    fs15.mkdirSync(dataDir, { recursive: true });
-    this.cache = this.readFromDisk();
-  }
+// src/attachment/group.ts
+var import_node_fs13 = __toESM(require("fs"), 1);
+var import_node_path14 = __toESM(require("path"), 1);
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+init_protocol();
+var GroupFileStore = class {
   dataDir;
-  cache;
-  list() {
-    return [...this.cache];
+  logger;
+  cache = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dataDir = opts.dataDir;
+    this.logger = opts.logger;
   }
-  upsert(cap) {
-    const idx = this.cache.findIndex((c) => c.id === cap.id);
-    if (idx >= 0) {
-      this.cache[idx] = cap;
-    } else {
-      this.cache.push(cap);
-    }
-    this.flush();
+  rootForScope(scope) {
+    return import_node_path14.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
   }
-  remove(id) {
-    const next = this.cache.filter((c) => c.id !== id);
-    if (next.length === this.cache.length) return;
-    this.cache = next;
-    this.flush();
+  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
+  filePath(scope, sessionId) {
+    return import_node_path14.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
   }
-  filePath() {
-    return path18.join(this.dataDir, CAPABILITIES_FILE_NAME);
+  cacheKey(scope, sessionId) {
+    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
   }
-  readFromDisk() {
-    const file = this.filePath();
-    let raw;
+  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
+  readFile(scope, sessionId) {
+    const file = this.filePath(scope, sessionId);
     try {
-      raw = fs15.readFileSync(file, "utf8");
-    } catch (err) {
-      if (err?.code === "ENOENT") return [];
-      return [];
-    }
-    if (!raw.trim()) return [];
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      return [];
-    }
-    if (!parsed || typeof parsed !== "object") return [];
-    const arr = parsed.capabilities;
-    if (!Array.isArray(arr)) return [];
-    const out = [];
-    for (const item of arr) {
-      const r = CapabilitySchema.safeParse(item);
-      if (r.success) out.push(r.data);
-    }
-    return out;
-  }
-  flush() {
-    const content = { version: FILE_VERSION, capabilities: this.cache };
-    this.atomicWrite(this.filePath(), JSON.stringify(content, null, 2));
-  }
-  atomicWrite(file, content) {
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    fs15.writeFileSync(tmp, content, { mode: 384 });
-    fs15.renameSync(tmp, file);
-    try {
-      fs15.chmodSync(file, 384);
-    } catch {
-    }
-  }
-};
-
-// src/permission/capability-registry.ts
-var crypto4 = __toESM(require("crypto"), 1);
-var CapabilityRegistry = class {
-  constructor(store, now = () => Date.now()) {
-    this.store = store;
-    this.now = now;
-    for (const cap of store.list()) {
-      this.bySecretHash.set(cap.secretHash, cap);
-    }
-  }
-  store;
-  now;
-  // sha256(token) → Capability
-  bySecretHash = /* @__PURE__ */ new Map();
-  list() {
-    return this.store.list();
-  }
-  verifyToken(token) {
-    if (!token) return { ok: false, code: "TOKEN_INVALID" };
-    const hash = sha256Hex(token);
-    const cap = this.bySecretHash.get(hash);
-    if (!cap) return { ok: false, code: "TOKEN_INVALID" };
-    if (cap.expiresAt && this.now() >= cap.expiresAt) {
-      return { ok: false, code: "TOKEN_EXPIRED" };
-    }
-    if (cap.maxUses && cap.usedCount >= cap.maxUses) {
-      return { ok: false, code: "TOKEN_EXHAUSTED" };
-    }
-    const updated = { ...cap, usedCount: cap.usedCount + 1 };
-    this.bySecretHash.set(hash, updated);
-    this.store.upsert(updated);
-    return { ok: true, capability: updated };
-  }
-  upsertCapability(cap) {
-    this.bySecretHash.set(cap.secretHash, cap);
-    this.store.upsert(cap);
-  }
-  /**
-   * Hard delete：从 store 物理移除 + 从 Map 清掉 secretHash 索引。
-   * 后续 verifyToken 该 token 走 'TOKEN_INVALID' 分支（secretHash 已不在 Map）。
-   * idempotent：不存在 → null。
-   */
-  delete(id) {
-    const current = this.store.list().find((c) => c.id === id);
-    if (!current) return null;
-    this.bySecretHash.delete(current.secretHash);
-    this.store.remove(id);
-    return current;
-  }
-  findById(id) {
-    return this.store.list().find((c) => c.id === id) ?? null;
-  }
-};
-function sha256Hex(s) {
-  return crypto4.createHash("sha256").update(s).digest("hex");
-}
-
-// src/permission/capability-manager.ts
-var crypto5 = __toESM(require("crypto"), 1);
-var CapabilityManager = class {
-  constructor(registry2, hooks = {}) {
-    this.registry = registry2;
-    this.hooks = hooks;
-  }
-  registry;
-  hooks;
-  list() {
-    return this.registry.list();
-  }
-  // whoami handler 用：根据 capabilityId 反查 caller 的 capability 实体。
-  // 返回 Capability 持久化形态；handler 调 stripSecretHash 后再上 wire。
-  findById(id) {
-    return this.registry.findById(id);
-  }
-  issue(args) {
-    if (!args.displayName.trim()) {
-      throw new Error("CapabilityManager.issue: displayName must be non-empty");
-    }
-    const token = (this.hooks.generateToken ?? defaultGenerateToken)();
-    const id = (this.hooks.generateId ?? defaultGenerateId)();
-    const now = (this.hooks.now ?? Date.now)();
-    const cap = {
-      id,
-      secretHash: sha256Hex2(token),
-      displayName: args.displayName,
-      grants: args.grants,
-      issuedAt: now,
-      usedCount: 0,
-      ...args.expiresAt !== void 0 ? { expiresAt: args.expiresAt } : {},
-      ...args.maxUses !== void 0 ? { maxUses: args.maxUses } : {}
-    };
-    this.registry.upsertCapability(cap);
-    this.hooks.onIssued?.(cap, token);
-    return { token, capability: cap };
-  }
-  /**
-   * guest 端 auth 帧捎带 selfPrincipalId/selfDisplayName 时，AuthGate.authenticate
-   * 校验 cap token 通过后调本方法把 peer 字段写回 cap：
-   *   - 首次（cap.firstUsedByPeerAt 未设）→ 写盘 + 触发 onIssued 复用 push 频道
-   *     让 owner UI 通过 capability:updated 实时拿到 peer 字段
-   *   - 重复（同 peerOwnerId）→ noop
-   *   - 冲突（不同 peerOwnerId）→ throw TOKEN_SHARED_LEAK，AuthGate 转 close 4401
-   */
-  recordPeerHello(capId, args) {
-    const cap = this.registry.findById(capId);
-    if (!cap) return { changed: false };
-    if (cap.firstUsedByPeerAt != null) {
-      if (cap.peerOwnerId !== args.ownerPrincipalId) {
-        throw new Error("TOKEN_SHARED_LEAK");
+      const raw = import_node_fs13.default.readFileSync(file, "utf8");
+      const parsed = JSON.parse(raw);
+      if (!Array.isArray(parsed)) {
+        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
+          file
+        });
+        return [];
       }
-      return { changed: false };
-    }
-    const updated = {
-      ...cap,
-      peerOwnerId: args.ownerPrincipalId,
-      firstUsedByPeerAt: args.now,
-      peerDisplayName: args.displayName
-    };
-    this.registry.upsertCapability(updated);
-    this.hooks.onIssued?.(updated, "__peer_hello__");
-    return { changed: true };
-  }
-  /**
-   * Hard delete：从 registry / store 物理移除 capability。
-   * idempotent：不存在 → null（handler 翻译成 VALIDATION_ERROR）
-   * onDeleted hook 在 daemon/index.ts wire 负责 close 连接 + cleanup 文件 + 广播
-   */
-  delete(id) {
-    const removed = this.registry.delete(id);
-    if (!removed) return null;
-    this.hooks.onDeleted?.(removed);
-    return { capability: removed };
-  }
-};
-function defaultGenerateToken() {
-  return crypto5.randomBytes(24).toString("base64url");
-}
-function defaultGenerateId() {
-  return "cap_" + crypto5.randomBytes(6).toString("base64url");
-}
-function sha256Hex2(s) {
-  return crypto5.createHash("sha256").update(s).digest("hex");
-}
-
-// src/permission/cleanup.ts
-var fs16 = __toESM(require("fs"), 1);
-function cleanupGuestSessionsForCapability(cap, factory) {
-  const removed = [];
-  for (const g2 of cap.grants) {
-    if (g2.resource.type !== "persona") continue;
-    const dir = factory.vmGuestRoot(g2.resource.id, cap.id);
-    try {
-      fs16.rmSync(dir, { recursive: true, force: true });
-      removed.push(dir);
-    } catch {
-    }
-  }
-  return { removed };
-}
-
-// src/inbox/inbox-store.ts
-var fs17 = __toESM(require("fs"), 1);
-var path19 = __toESM(require("path"), 1);
-var INBOX_SUBDIR = "inbox";
-var InboxStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-    fs17.mkdirSync(this.dirPath(), { recursive: true });
-  }
-  dataDir;
-  /**
-   * 列出某 peer 的消息, 按 createdAt 升序.
-   * sinceCreatedAt 缺省时返回全量; 提供时仅返回 createdAt > sinceCreatedAt 的增量.
-   * 文件不存在时返回 [] (不抛, 不创建).
-   */
-  list(peerOwnerId, sinceCreatedAt) {
-    const file = this.filePath(peerOwnerId);
-    let raw;
-    try {
-      raw = fs17.readFileSync(file, "utf8");
+      const out = [];
+      for (const entry of parsed) {
+        const r = GroupFileEntrySchema.safeParse(entry);
+        if (r.success) out.push(r.data);
+      }
+      return out;
     } catch (err) {
-      if (err?.code === "ENOENT") return [];
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      this.logger?.warn("GroupFileStore.readFile failed", {
+        file,
+        err: err.message
+      });
       return [];
     }
-    const all = parseAllLines(raw);
-    if (sinceCreatedAt === void 0) return all;
-    return all.filter((m2) => m2.createdAt > sinceCreatedAt);
   }
-  /**
-   * 列出所有 peer 的 peerOwnerId (扫目录所有 *.jsonl 文件名).
-   */
-  listAllPeerOwnerIds() {
-    const dir = this.dirPath();
-    let entries;
-    try {
-      entries = fs17.readdirSync(dir);
-    } catch (err) {
-      if (err?.code === "ENOENT") return [];
-      return [];
-    }
-    return entries.filter((name) => name.endsWith(".jsonl")).map((name) => name.slice(0, -".jsonl".length));
+  writeFile(scope, sessionId, entries) {
+    const file = this.filePath(scope, sessionId);
+    import_node_fs13.default.mkdirSync(import_node_path14.default.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    import_node_fs13.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    import_node_fs13.default.renameSync(tmp, file);
   }
-  /**
-   * 追加一条消息，按 message.id 幂等去重。
-   * 双投 + 重试场景下保护 — 同 id 已存在则 no-op，不重写不覆盖。
-   */
-  append(message) {
-    const existing = this.list(message.peerOwnerId);
-    if (existing.some((m2) => m2.id === message.id)) return;
-    const file = this.filePath(message.peerOwnerId);
-    const line = JSON.stringify(message) + "\n";
-    fs17.appendFileSync(file, line, { mode: 384 });
-    try {
-      fs17.chmodSync(file, 384);
-    } catch {
-    }
+  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
+  list(scope, sessionId) {
+    const key = this.cacheKey(scope, sessionId);
+    const cached = this.cache.get(key);
+    if (cached) return cached.entries;
+    const entries = this.readFile(scope, sessionId);
+    this.cache.set(key, { entries, scope });
+    return entries;
   }
   /**
-   * 把该 peer 所有 createdAt<=upToCreatedAt 且 sender!=principalId 的消息
-   * readBy[principalId] 写成 upToCreatedAt. O(N) rewrite 整个文件.
-   * 返写入了几条.
+   * upsert：
+   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
+   *     （保留首次入群人 / 入群时刻）
+   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
+   *
+   * 返回最新 entry（caller 可用来 broadcast 通知）。
    */
-  markRead(peerOwnerId, principalId, upToCreatedAt) {
-    const messages = this.list(peerOwnerId);
-    let changed = 0;
-    const next = messages.map((m2) => {
-      if (m2.senderPrincipalId === principalId) return m2;
-      if (m2.createdAt > upToCreatedAt) return m2;
-      const cur = m2.readBy[principalId];
-      if (cur !== void 0 && cur >= upToCreatedAt) return m2;
-      changed++;
-      return { ...m2, readBy: { ...m2.readBy, [principalId]: upToCreatedAt } };
-    });
-    if (changed === 0) return 0;
-    this.rewriteFile(peerOwnerId, next);
-    return changed;
+  upsert(scope, sessionId, input, now = Date.now()) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === input.relPath);
+    let next;
+    if (idx >= 0) {
+      const prev = entries[idx];
+      next = {
+        ...prev,
+        size: input.size,
+        mime: input.mime,
+        lastEditedAt: now,
+        stale: false
+        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
+      };
+      entries[idx] = next;
+    } else {
+      next = {
+        id: `gf-${import_node_crypto4.default.randomBytes(6).toString("base64url")}`,
+        relPath: input.relPath,
+        from: input.from,
+        label: input.label,
+        size: input.size,
+        mime: input.mime,
+        addedAt: now
+        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
+      };
+      entries.push(next);
+    }
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
+    return next;
   }
   /**
-   * 删整个 peer 的 jsonl (peer:remove cascade). 不存在 no-op.
+   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
+   * - 命中 → stale=true，UI 灰显
+   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
+   *
+   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
    */
-  removeByPeerOwnerId(peerOwnerId) {
-    const file = this.filePath(peerOwnerId);
-    try {
-      fs17.unlinkSync(file);
-    } catch (err) {
-      if (err?.code === "ENOENT") return;
-    }
-  }
-  rewriteFile(peerOwnerId, messages) {
-    const file = this.filePath(peerOwnerId);
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-    const content = messages.map((m2) => JSON.stringify(m2)).join("\n") + (messages.length > 0 ? "\n" : "");
-    fs17.writeFileSync(tmp, content, { mode: 384 });
-    fs17.renameSync(tmp, file);
-    try {
-      fs17.chmodSync(file, 384);
-    } catch {
-    }
-  }
-  dirPath() {
-    return path19.join(this.dataDir, INBOX_SUBDIR);
-  }
-  filePath(peerOwnerId) {
-    return path19.join(this.dirPath(), `${peerOwnerId}.jsonl`);
-  }
-};
-function parseAllLines(raw) {
-  const out = [];
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(trimmed);
-    } catch {
-      continue;
-    }
-    const r = InboxMessageSchema.safeParse(parsed);
-    if (r.success) out.push(r.data);
-  }
-  return out;
-}
-
-// src/inbox/inbox-manager.ts
-var InboxManager = class {
-  constructor(store, broadcast) {
-    this.store = store;
-    this.broadcast = broadcast;
+  markStale(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return;
+    if (entries[idx].stale) return;
+    entries[idx] = { ...entries[idx], stale: true };
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
   }
-  store;
-  broadcast;
   /**
-   * 写一条消息到 peer.jsonl + broadcast 给本机所有 owner ws。
-   * 按 id 幂等：同 id 已落盘则 no-op（不广播、不重写）。
+   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
+   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
+   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
    *
-   * caller 必须已通过 handler 鉴权
-   * （owner ctx 必填 args.peerOwnerId；guest ctx 由 handler 反查 peer-store）。
+   * 返回值：true=命中并删除；false=relPath 不在群里。
    */
-  postMessage(args) {
-    const beforeLen = this.store.list(args.peerOwnerId).length;
-    const msg = {
-      id: args.id,
-      peerOwnerId: args.peerOwnerId,
-      senderPrincipalId: args.senderPrincipalId,
-      text: args.text,
-      createdAt: args.createdAt,
-      readBy: {}
-    };
-    this.store.append(msg);
-    const afterLen = this.store.list(args.peerOwnerId).length;
-    if (afterLen === beforeLen) return msg;
-    this.broadcast(args.peerOwnerId, {
-      type: "inbox:event",
-      peerOwnerId: args.peerOwnerId,
-      message: msg
-    });
-    return msg;
-  }
-  list(peerOwnerId, sinceCreatedAt) {
-    return this.store.list(peerOwnerId, sinceCreatedAt);
+  remove(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return false;
+    entries.splice(idx, 1);
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
+    return true;
   }
   /**
-   * 标已读. 返写入了几条 (sender !== self 且 createdAt <= upToCreatedAt 的消息).
-   * broadcast 已更新 readBy 的每条消息 (单帧一消息, 复用 inbox:event 通道).
+   * 跨 session 聚合查询（spec §4 HTTP ACL：personal 视野并集）。
+   *
+   * 扫 <dataDir>/sessions/<personaId>/owner/*.group-files.json 和
+   * <dataDir>/sessions/<personaId>/listener/*.group-files.json，每文件读一份。
+   *
+   * 复杂度 O(N sessions × N entries)，N 通常 < 100，可接受。
    */
-  markRead(args) {
-    const before = this.store.list(args.peerOwnerId);
-    const changed = this.store.markRead(args.peerOwnerId, args.principalId, args.upToCreatedAt);
-    if (changed === 0) return 0;
-    const after = this.store.list(args.peerOwnerId);
-    const beforeById = new Map(before.map((m2) => [m2.id, m2]));
-    for (const m2 of after) {
-      const prev = beforeById.get(m2.id);
-      if (!prev) continue;
-      if (prev.readBy[args.principalId] === m2.readBy[args.principalId]) continue;
-      this.broadcast(args.peerOwnerId, {
-        type: "inbox:event",
-        peerOwnerId: args.peerOwnerId,
-        message: m2
-      });
-    }
-    return changed;
-  }
-  /** peer:remove cascade. 删整个 peer 的 jsonl. */
-  removeChannel(peerOwnerId) {
-    this.store.removeByPeerOwnerId(peerOwnerId);
-  }
-};
-
-// src/state/received-capability-store.ts
-var fs18 = __toESM(require("fs"), 1);
-var path20 = __toESM(require("path"), 1);
-var FILE_NAME = "received-capabilities.json";
-var ReceivedCapabilityStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-  }
-  dataDir;
-  caps = /* @__PURE__ */ new Map();
-  load() {
-    this.caps.clear();
-    const file = path20.join(this.dataDir, FILE_NAME);
-    let raw;
-    try {
-      raw = fs18.readFileSync(file, "utf8");
-    } catch (err) {
-      if (err?.code !== "ENOENT") this.renameBak(file);
-      return;
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      this.renameBak(file);
-      return;
-    }
-    const arr = parsed?.receivedCaps;
-    if (!Array.isArray(arr)) return;
-    for (const entry of arr) {
-      const r = ReceivedCapabilitySchema.safeParse(entry);
-      if (r.success) this.caps.set(r.data.ownerPrincipalId, r.data);
-    }
-  }
-  list() {
-    return Array.from(this.caps.values());
-  }
-  get(ownerPrincipalId) {
-    return this.caps.get(ownerPrincipalId) ?? null;
-  }
-  hasOwner(ownerPrincipalId) {
-    return this.caps.has(ownerPrincipalId);
-  }
-  upsert(cap) {
-    this.caps.set(cap.ownerPrincipalId, cap);
-    this.flush();
-  }
-  remove(ownerPrincipalId) {
-    if (!this.caps.delete(ownerPrincipalId)) return;
-    this.flush();
-  }
-  flush() {
-    const file = path20.join(this.dataDir, FILE_NAME);
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-    const content = JSON.stringify(
-      { receivedCaps: Array.from(this.caps.values()) },
-      null,
-      2
-    );
-    fs18.mkdirSync(this.dataDir, { recursive: true });
-    fs18.writeFileSync(tmp, content, { mode: 384 });
-    fs18.renameSync(tmp, file);
-  }
-  renameBak(file) {
-    try {
-      fs18.renameSync(file, `${file}.bak`);
-    } catch {
-    }
-  }
-};
-
-// src/state/legacy-migration.ts
-var fs19 = __toESM(require("fs"), 1);
-var path21 = __toESM(require("path"), 1);
-var TARGETS = [
-  { src: "capabilities.json", bak: "capabilities.legacy.bak" },
-  { src: "remote-personas", bak: "remote-personas.legacy.bak" },
-  { src: "peers.json", bak: "peers.legacy.bak" }
-];
-function migrateLegacyFiles(dataDir) {
-  for (const t of TARGETS) {
-    const srcPath = path21.join(dataDir, t.src);
-    const bakPath = path21.join(dataDir, t.bak);
-    if (!fs19.existsSync(srcPath)) continue;
-    if (fs19.existsSync(bakPath)) continue;
-    try {
-      fs19.renameSync(srcPath, bakPath);
-    } catch {
-    }
-  }
-}
-
-// src/received-capability/connect-remote.ts
-var crypto6 = __toESM(require("crypto"), 1);
-var HANDSHAKE_TIMEOUT_MS = 5e3;
-var RPC_TIMEOUT_MS = 5e3;
-async function connectRemote(args) {
-  const ws = new wrapper_default(args.url);
-  await new Promise((resolve2, reject) => {
-    const onError = (e) => reject(e);
-    ws.once("open", () => {
-      ws.off("error", onError);
-      resolve2();
-    });
-    ws.once("error", onError);
-  });
-  ws.send(
-    JSON.stringify({
-      type: "auth",
-      token: args.token,
-      selfPrincipalId: args.selfPrincipalId,
-      selfDisplayName: args.selfDisplayName
-    })
-  );
-  await new Promise((resolve2, reject) => {
-    const onMessage = (raw) => {
-      let f;
+  listByPersona(personaId) {
+    const out = [];
+    for (const mode of ["owner", "listener"]) {
+      const scope = { kind: "persona", personaId, mode };
+      const root = this.rootForScope(scope);
+      let names;
       try {
-        f = JSON.parse(raw.toString());
-      } catch {
-        return;
-      }
-      if (f.type === "auth:ok" || f.type === "ready") {
-        ws.off("message", onMessage);
-        resolve2();
-        return;
-      }
-      if (f.type === "auth:error" || f.code === 4401) {
-        ws.off("message", onMessage);
-        reject(new Error(`auth failed: ${f.message ?? f.type ?? "unknown"}`));
+        names = import_node_fs13.default.readdirSync(root);
+      } catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") continue;
+        continue;
       }
-    };
-    ws.on("message", onMessage);
-    setTimeout(() => {
-      ws.off("message", onMessage);
-      reject(new Error("auth handshake timeout"));
-    }, HANDSHAKE_TIMEOUT_MS);
-  });
-  function call(method, payload) {
-    const requestId = crypto6.randomUUID();
-    return new Promise((resolve2, reject) => {
-      const onMessage = (raw) => {
-        let f;
-        try {
-          f = JSON.parse(raw.toString());
-        } catch {
-          return;
-        }
-        if (f.requestId !== requestId) return;
-        ws.off("message", onMessage);
-        if (f.error || f.type?.endsWith(":error")) {
-          reject(new Error(f.message ?? f.error ?? "rpc error"));
-        } else {
-          resolve2(f);
-        }
-      };
-      ws.on("message", onMessage);
-      ws.send(JSON.stringify({ type: method, requestId, ...payload }));
-      setTimeout(() => {
-        ws.off("message", onMessage);
-        reject(new Error(`${method} timeout`));
-      }, RPC_TIMEOUT_MS);
-    });
-  }
-  return {
-    whoami: async () => {
-      const f = await call("whoami", {});
-      return {
-        ownerId: f.owner.id,
-        displayName: f.owner.displayName,
-        capabilityId: f.capability.id,
-        grants: f.capability.grants
-      };
-    },
-    close: () => {
-      try {
-        ws.close();
-      } catch {
+      for (const name of names) {
+        if (!name.endsWith(".group-files.json")) continue;
+        const sessionId = name.slice(0, -".group-files.json".length);
+        if (!sessionId) continue;
+        const entries = this.list(scope, sessionId);
+        out.push({ sessionId, entries });
       }
     }
-  };
-}
-
-// src/migrations/2026-05-20-flatten-sessions.ts
-var fs20 = __toESM(require("fs"), 1);
-var path22 = __toESM(require("path"), 1);
-var MIGRATION_FLAG_NAME = ".migration.v1.done";
-function migrateFlattenSessions(opts) {
-  const dataDir = opts.dataDir;
-  const now = opts.now ?? Date.now;
-  const sessionsDir = path22.join(dataDir, "sessions");
-  const flagPath = path22.join(sessionsDir, MIGRATION_FLAG_NAME);
-  if (existsSync4(flagPath)) {
-    return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
-  }
-  let movedBare = 0;
-  let movedVmOwner = 0;
-  let archivedListener = 0;
-  const defaultDir = path22.join(sessionsDir, "default");
-  if (existsSync4(defaultDir)) {
-    for (const entry of readdirSafe(defaultDir)) {
-      if (!entry.endsWith(".json")) continue;
-      const src = path22.join(defaultDir, entry);
-      const dst = path22.join(sessionsDir, entry);
-      fs20.renameSync(src, dst);
-      movedBare += 1;
-    }
-    rmdirIfEmpty(defaultDir);
-  }
-  for (const pid of readdirSafe(sessionsDir)) {
-    const personaDir = path22.join(sessionsDir, pid);
-    if (!isDir(personaDir)) continue;
-    if (pid === "default") continue;
-    const ownerSrc = path22.join(personaDir, "owner");
-    if (existsSync4(ownerSrc) && isDir(ownerSrc)) {
-      const ownerDst = path22.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
-      fs20.mkdirSync(ownerDst, { recursive: true });
-      for (const file of readdirSafe(ownerSrc)) {
-        if (!file.endsWith(".json")) continue;
-        fs20.renameSync(path22.join(ownerSrc, file), path22.join(ownerDst, file));
-        movedVmOwner += 1;
-      }
-      rmdirIfEmpty(ownerSrc);
-    }
-    const listenerSrc = path22.join(personaDir, "listener");
-    if (existsSync4(listenerSrc) && isDir(listenerSrc)) {
-      const archiveDst = path22.join(dataDir, ".legacy", `listener-${pid}`);
-      fs20.mkdirSync(archiveDst, { recursive: true });
-      for (const file of readdirSafe(listenerSrc)) {
-        if (!file.endsWith(".json")) continue;
-        fs20.renameSync(path22.join(listenerSrc, file), path22.join(archiveDst, file));
-        archivedListener += 1;
-      }
-      rmdirIfEmpty(listenerSrc);
-    }
-    rmdirIfEmpty(personaDir);
-  }
-  fs20.mkdirSync(sessionsDir, { recursive: true });
-  fs20.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
-  return {
-    skipped: false,
-    flagWritten: true,
-    movedBare,
-    movedVmOwner,
-    archivedListener
-  };
-}
-function existsSync4(p2) {
-  try {
-    fs20.statSync(p2);
-    return true;
-  } catch {
-    return false;
+    return out;
   }
-}
-function isDir(p2) {
-  try {
-    return fs20.statSync(p2).isDirectory();
-  } catch {
+};
+function personalViewable(groupStore, personaDir, personaId, absPath) {
+  const realTarget = safeRealpath(absPath);
+  if (!realTarget) {
     return false;
   }
-}
-function readdirSafe(p2) {
-  try {
-    return fs20.readdirSync(p2);
-  } catch {
-    return [];
+  const personasUnion = groupStore.listByPersona(personaId);
+  for (const { entries } of personasUnion) {
+    for (const e of entries) {
+      if (e.stale) continue;
+      const realEntry = safeRealpath(import_node_path14.default.join(personaDir, e.relPath));
+      if (realEntry && realEntry === realTarget) return true;
+    }
   }
+  return false;
 }
-function rmdirIfEmpty(p2) {
+function safeRealpath(p2) {
   try {
-    fs20.rmdirSync(p2);
+    return import_node_fs13.default.realpathSync(p2);
   } catch {
+    return null;
   }
 }
 
-// src/transport/http-router.ts
-var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path15 = __toESM(require("path"), 1);
-
 // src/attachment/mime.ts
-var import_node_path14 = __toESM(require("path"), 1);
+var import_node_path15 = __toESM(require("path"), 1);
 var TEXT_PLAIN = "text/plain; charset=utf-8";
 var EXT_TO_NATIVE_MIME = {
   // 图片
@@ -27016,14 +26055,14 @@ var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mk"
 ]);
 function lookupMime(filePathOrName) {
-  const ext = import_node_path14.default.extname(filePathOrName).toLowerCase();
+  const ext = import_node_path15.default.extname(filePathOrName).toLowerCase();
   if (EXT_TO_NATIVE_MIME[ext]) return EXT_TO_NATIVE_MIME[ext];
   if (TEXT_EXTENSIONS.has(ext)) return TEXT_PLAIN;
   return "application/octet-stream";
 }
 
 // src/attachment/sign-url.ts
-var import_node_crypto4 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 var HMAC_ALGO = "sha256";
 function base64urlEncode(buf) {
   const b2 = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
@@ -27040,7 +26079,7 @@ function decodeAbsPathFromUrl(encoded) {
 }
 function computeSig(secret, absPath, e) {
   const msg = e === null ? absPath : `${absPath}|${e}`;
-  return import_node_crypto4.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
+  return import_node_crypto5.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
 }
 function signUrlParts(secret, absPath, ttlSeconds, now = Date.now) {
   const e = ttlSeconds === null ? null : Math.floor(now() / 1e3) + ttlSeconds;
@@ -27075,7 +26114,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
   if (provided.length !== expected.length) {
     return { ok: false, code: "BAD_SIG" };
   }
-  if (!import_node_crypto4.default.timingSafeEqual(provided, expected)) {
+  if (!import_node_crypto5.default.timingSafeEqual(provided, expected)) {
     return { ok: false, code: "BAD_SIG" };
   }
   if (e !== null && now() / 1e3 > e) {
@@ -27096,7 +26135,7 @@ function createHttpRouter(deps) {
       sendJson(res, 200, { ok: true, version: deps.daemonVersion });
       return true;
     }
-    if (!url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
+    if (!url.pathname.startsWith("/persona/") && !url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
       return false;
     }
     if (url.pathname.startsWith("/files/") && req.method === "GET") {
@@ -27136,8 +26175,43 @@ function createHttpRouter(deps) {
       sendJson(res, 401, { code: "UNAUTHORIZED", message: "missing or invalid bearer token" });
       return true;
     }
+    const personaFilesMatch = url.pathname.match(/^\/persona\/([^/]+)\/files$/);
+    if (personaFilesMatch && req.method === "GET") {
+      const pid = personaFilesMatch[1];
+      const pathParam = url.searchParams.get("path");
+      if (!pathParam) {
+        sendJson(res, 400, { code: "INVALID_PARAM", message: "missing `path` query" });
+        return true;
+      }
+      if (!deps.personaStore || !deps.groupFileStore) {
+        sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "files endpoint not wired" }));
+        return true;
+      }
+      const personaDir = deps.personaStore.personaDirPath(pid);
+      const absPath = import_node_path16.default.isAbsolute(pathParam) ? pathParam : import_node_path16.default.join(personaDir, pathParam);
+      if (!import_node_path16.default.isAbsolute(pathParam) && !isContainedIn(absPath, personaDir)) {
+        sendJson(res, 400, { code: "PATH_TRAVERSAL", message: "rel path escapes personaDir" });
+        return true;
+      }
+      if (ctx.role === "personal") {
+        if (ctx.personaId !== pid) {
+          sendJson(res, 403, { code: "FORBIDDEN", message: "personal token bound to other persona" });
+          return true;
+        }
+        if (!personalViewable(deps.groupFileStore, personaDir, pid, absPath)) {
+          sendJson(res, 403, { code: "FORBIDDEN", message: "path not in personal viewable scope" });
+          return true;
+        }
+      }
+      streamFile(res, absPath, deps.logger);
+      return true;
+    }
     const sessionFilesMatch = url.pathname.match(/^\/session\/([^/]+)\/files$/);
     if (sessionFilesMatch && req.method === "GET") {
+      if (ctx.role !== "owner") {
+        sendJson(res, 403, { code: "FORBIDDEN", message: "direct session files are owner-only" });
+        return true;
+      }
       const sid = sessionFilesMatch[1];
       const pathParam = url.searchParams.get("path");
       if (!pathParam) {
@@ -27145,7 +26219,7 @@ function createHttpRouter(deps) {
         return true;
       }
       let absPath;
-      if (import_node_path15.default.isAbsolute(pathParam)) {
+      if (import_node_path16.default.isAbsolute(pathParam)) {
         absPath = pathParam;
       } else if (deps.sessionStore) {
         const file = deps.sessionStore.read(sid);
@@ -27153,7 +26227,7 @@ function createHttpRouter(deps) {
           sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sid} not found` });
           return true;
         }
-        absPath = import_node_path15.default.join(file.cwd, pathParam);
+        absPath = import_node_path16.default.join(file.cwd, pathParam);
       } else {
         sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "sessionStore not wired" }));
         return true;
@@ -27178,182 +26252,47 @@ function sendJson(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function withCtx(ctx, body) {
-  return { ...body, role: ctx.role };
+  return { ...body, role: ctx.role, personaId: ctx.personaId };
+}
+function isContainedIn(abs, root) {
+  const normalized = import_node_path16.default.resolve(abs);
+  const normalizedRoot = import_node_path16.default.resolve(root);
+  if (normalized === normalizedRoot) return true;
+  return normalized.startsWith(normalizedRoot + import_node_path16.default.sep);
 }
 function streamFile(res, absPath, logger) {
   let stat;
   try {
-    stat = import_node_fs13.default.statSync(absPath);
+    stat = import_node_fs14.default.statSync(absPath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
       sendJson(res, 404, { code: "NOT_FOUND", message: "file not found" });
     } else {
       sendJson(res, 500, { code: "STAT_FAILED", message: err.message });
-    }
-    return;
-  }
-  if (!stat.isFile()) {
-    sendJson(res, 400, { code: "NOT_A_FILE", message: "path is not a regular file" });
-    return;
-  }
-  const mime = lookupMime(absPath);
-  const basename = import_node_path15.default.basename(absPath);
-  res.writeHead(200, {
-    "Content-Type": mime,
-    "Content-Length": String(stat.size),
-    "Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(basename)}`,
-    // 防止浏览器把任意 mime 当 html 渲染
-    "X-Content-Type-Options": "nosniff"
-  });
-  const stream = import_node_fs13.default.createReadStream(absPath);
-  stream.on("error", (err) => {
-    logger?.warn("streamFile read error", { absPath, err: err.message });
-    res.destroy();
-  });
-  stream.pipe(res);
-}
-
-// src/attachment/group.ts
-var import_node_fs14 = __toESM(require("fs"), 1);
-var import_node_path16 = __toESM(require("path"), 1);
-var import_node_crypto5 = __toESM(require("crypto"), 1);
-init_protocol();
-var GroupFileStore = class {
-  dataDir;
-  logger;
-  cache = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.dataDir = opts.dataDir;
-    this.logger = opts.logger;
-  }
-  rootForScope(scope) {
-    return import_node_path16.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
-  }
-  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
-  filePath(scope, sessionId) {
-    return import_node_path16.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
-  }
-  cacheKey(scope, sessionId) {
-    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
-  }
-  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
-  readFile(scope, sessionId) {
-    const file = this.filePath(scope, sessionId);
-    try {
-      const raw = import_node_fs14.default.readFileSync(file, "utf8");
-      const parsed = JSON.parse(raw);
-      if (!Array.isArray(parsed)) {
-        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
-          file
-        });
-        return [];
-      }
-      const out = [];
-      for (const entry of parsed) {
-        const r = GroupFileEntrySchema.safeParse(entry);
-        if (r.success) out.push(r.data);
-      }
-      return out;
-    } catch (err) {
-      const code = err?.code;
-      if (code === "ENOENT") return [];
-      this.logger?.warn("GroupFileStore.readFile failed", {
-        file,
-        err: err.message
-      });
-      return [];
-    }
-  }
-  writeFile(scope, sessionId, entries) {
-    const file = this.filePath(scope, sessionId);
-    import_node_fs14.default.mkdirSync(import_node_path16.default.dirname(file), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-    import_node_fs14.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
-    import_node_fs14.default.renameSync(tmp, file);
-  }
-  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
-  list(scope, sessionId) {
-    const key = this.cacheKey(scope, sessionId);
-    const cached = this.cache.get(key);
-    if (cached) return cached.entries;
-    const entries = this.readFile(scope, sessionId);
-    this.cache.set(key, { entries });
-    return entries;
-  }
-  /**
-   * upsert：
-   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
-   *     （保留首次入群人 / 入群时刻）
-   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
-   *
-   * 返回最新 entry（caller 可用来 broadcast 通知）。
-   */
-  upsert(scope, sessionId, input, now = Date.now()) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === input.relPath);
-    let next;
-    if (idx >= 0) {
-      const prev = entries[idx];
-      next = {
-        ...prev,
-        size: input.size,
-        mime: input.mime,
-        lastEditedAt: now,
-        stale: false
-        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
-      };
-      entries[idx] = next;
-    } else {
-      next = {
-        id: `gf-${import_node_crypto5.default.randomBytes(6).toString("base64url")}`,
-        relPath: input.relPath,
-        from: input.from,
-        label: input.label,
-        size: input.size,
-        mime: input.mime,
-        addedAt: now
-        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
-      };
-      entries.push(next);
-    }
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries });
-    return next;
-  }
-  /**
-   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
-   * - 命中 → stale=true，UI 灰显
-   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
-   *
-   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
-   */
-  markStale(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return;
-    if (entries[idx].stale) return;
-    entries[idx] = { ...entries[idx], stale: true };
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries });
+    }
+    return;
   }
-  /**
-   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
-   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
-   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
-   *
-   * 返回值：true=命中并删除；false=relPath 不在群里。
-   */
-  remove(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return false;
-    entries.splice(idx, 1);
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries });
-    return true;
+  if (!stat.isFile()) {
+    sendJson(res, 400, { code: "NOT_A_FILE", message: "path is not a regular file" });
+    return;
   }
-};
+  const mime = lookupMime(absPath);
+  const basename = import_node_path16.default.basename(absPath);
+  res.writeHead(200, {
+    "Content-Type": mime,
+    "Content-Length": String(stat.size),
+    "Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(basename)}`,
+    // 防止浏览器把任意 mime 当 html 渲染
+    "X-Content-Type-Options": "nosniff"
+  });
+  const stream = import_node_fs14.default.createReadStream(absPath);
+  stream.on("error", (err) => {
+    logger?.warn("streamFile read error", { absPath, err: err.message });
+    res.destroy();
+  });
+  stream.pipe(res);
+}
 
 // src/discovery/state-file.ts
 var import_node_fs15 = __toESM(require("fs"), 1);
@@ -28033,32 +26972,26 @@ function authFilePath(dataDir) {
 }
 function loadOrCreateAuthFile(opts) {
   const file = authFilePath(opts.dataDir);
-  const generate = opts.generate ?? defaultGenerateToken2;
-  const genId = opts.genOwnerPrincipalId ?? defaultGenerateOwnerPrincipalId;
+  const generate = opts.generate ?? defaultGenerate;
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const existing = readAuthFile(file);
-  if (existing && existing.token && existing.signSecret && existing.ownerPrincipalId) {
+  if (existing && existing.token && existing.signSecret) {
     return {
       token: existing.token,
       signSecret: existing.signSecret,
-      ownerPrincipalId: existing.ownerPrincipalId,
       createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
     };
   }
   const token = existing?.token || generate();
   const signSecret = existing?.signSecret || generate();
-  const ownerPrincipalId = existing?.ownerPrincipalId || genId();
   const createdAt = existing?.createdAt || now().toISOString();
-  const next = { token, signSecret, ownerPrincipalId, createdAt };
+  const next = { token, signSecret, createdAt };
   writeAuthFile(file, next);
   return next;
 }
-function defaultGenerateToken2() {
+function defaultGenerate() {
   return import_node_crypto8.default.randomBytes(32).toString("base64url");
 }
-function defaultGenerateOwnerPrincipalId() {
-  return `owner-${import_node_crypto8.default.randomUUID()}`;
-}
 function readAuthFile(file) {
   try {
     const raw = import_node_fs20.default.readFileSync(file, "utf8");
@@ -28069,7 +27002,6 @@ function readAuthFile(file) {
     return {
       token: parsed.token,
       signSecret: typeof parsed.signSecret === "string" && parsed.signSecret.length > 0 ? parsed.signSecret : void 0,
-      ownerPrincipalId: typeof parsed.ownerPrincipalId === "string" && parsed.ownerPrincipalId.length > 0 ? parsed.ownerPrincipalId : void 0,
       createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0
     };
   } catch (err) {
@@ -28183,63 +27115,10 @@ function forkSession(input) {
   return { forkedToolSessionId, forkedFilePath };
 }
 
-// src/permission/capability.ts
-function matchResource(grant, target) {
-  if (grant.type === "*") return true;
-  if (grant.type !== target.type) return false;
-  if (grant.id === "*") return true;
-  return grant.id === target.id;
-}
-function assertGrant(grants, resource, action) {
-  for (const g2 of grants) {
-    if (!matchResource(g2.resource, resource)) continue;
-    if (g2.actions.includes(action)) return true;
-    if (g2.actions.includes("admin")) return true;
-  }
-  return false;
-}
-
-// src/permission/session-access.ts
-function canAccessSession(ctx, sessionId, action, deps) {
-  if (ctx.principal.kind === "owner") return true;
-  const file = deps.readSession(sessionId);
-  if (!file) return true;
-  return canAccessPersona(ctx.grants, file.ownerPersonaId, action);
-}
-function canAccessPersona(grants, personaId, action) {
-  if (!personaId) return false;
-  const resource = { type: "persona", id: personaId };
-  return assertGrant(grants, resource, action);
-}
-
 // src/handlers/session.ts
-init_protocol();
 function buildSessionHandlers(deps) {
-  const { manager, observer, getAdapter: getAdapter2, store, ownerPrincipalId } = deps;
-  const ensureSessionAccess = (ctx, sessionId, action) => {
-    if (!ctx) return;
-    const ok = canAccessSession(ctx, sessionId, action, {
-      readSession: (sid) => store.read(sid)
-    });
-    if (!ok) {
-      throw new ClawdError(
-        ERROR_CODES.UNAUTHORIZED,
-        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} session ${sessionId}`
-      );
-    }
-  };
-  const ensurePersonaAccess = (ctx, personaId, action) => {
-    if (!ctx) return;
-    if (ctx.principal.kind === "owner") return;
-    const ok = canAccessPersona(ctx.grants, personaId, action);
-    if (!ok) {
-      throw new ClawdError(
-        ERROR_CODES.UNAUTHORIZED,
-        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} on persona:${personaId ?? "<none>"}`
-      );
-    }
-  };
-  const create = async (frame, _client, ctx) => {
+  const { manager, observer, getAdapter: getAdapter2 } = deps;
+  const create = async (frame) => {
     const args = SessionCreateArgs.parse(frame);
     if (args.ownerPersonaId) {
       const persona = deps.personaRegistry.get(args.ownerPersonaId);
@@ -28247,75 +27126,58 @@ function buildSessionHandlers(deps) {
         throw new Error(`persona not found: ${args.ownerPersonaId}`);
       }
     }
-    ensurePersonaAccess(ctx, args.ownerPersonaId, "send");
-    const creatorPrincipalId = ctx?.principal.id ?? ownerPrincipalId;
-    const { response, broadcast } = manager.create(args, creatorPrincipalId);
+    const { response, broadcast } = manager.create(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const list = async (_frame, _client, ctx) => {
+  const list = async () => {
     const { response } = manager.list();
-    if (ctx && ctx.principal.kind === "guest") {
-      const sessions = response.sessions ?? [];
-      const capId = ctx.capabilityId;
-      const filtered = sessions.filter((s) => canAccessPersona(ctx.grants, s.ownerPersonaId, "read")).filter((s) => s.creatorPrincipalId === capId);
-      return { response: { type: "session:list", sessions: filtered } };
-    }
     return { response: { type: "session:list", ...response } };
   };
-  const get = async (frame, _client, ctx) => {
+  const get = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.get(args);
     return { response: { type: "session:info", ...response } };
   };
-  const update = async (frame, _client, ctx) => {
+  const update = async (frame) => {
     const args = SessionUpdateArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.update(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const del = async (frame, _client, ctx) => {
+  const del = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.delete(args);
     return {
       response: { type: "session:deleted", sessionId: args.sessionId },
       broadcast
     };
   };
-  const send = async (frame, _client, ctx) => {
+  const send = async (frame) => {
     const args = SessionSendArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.send(args);
     return { response: { type: "session:send", ok: true }, broadcast };
   };
-  const stop = async (frame, _client, ctx) => {
+  const stop = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.stop(args);
     return { response: { type: "session:stop", ok: true }, broadcast };
   };
-  const interrupt = async (frame, _client, ctx) => {
+  const interrupt = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.interrupt(args);
     return { response: { type: "session:interrupt", ok: true }, broadcast };
   };
-  const rewind = async (frame, _client, ctx) => {
+  const rewind = async (frame) => {
     const args = SessionRewindArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.rewind(args);
     return { response: { type: "session:rewind", ...response }, broadcast };
   };
-  const rewindDiff = async (frame, _client, ctx) => {
+  const rewindDiff = async (frame) => {
     const args = SessionRewindDiffArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = await manager.rewindDiff(args);
     return { response: { type: "session:rewind-diff", ...response } };
   };
-  const rewindableMessageIds = async (frame, _client, ctx) => {
+  const rewindableMessageIds = async (frame) => {
     const args = SessionRewindableMessageIdsArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.rewindableMessageIds(args);
     return {
       response: { type: "session:rewindable-message-ids", ...response }
@@ -28326,22 +27188,19 @@ function buildSessionHandlers(deps) {
     const result = forkSession(args);
     return { response: { type: "session:fork", ...result } };
   };
-  const newSession = async (frame, _client, ctx) => {
+  const newSession = async (frame) => {
     const args = SessionIdArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     observer.stop(args.sessionId);
     const { response, broadcast } = manager.newSession(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const resume = async (frame, _client, ctx) => {
+  const resume = async (frame) => {
     const args = SessionResumeArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.resume(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const observe = async (frame, _client, ctx) => {
+  const observe = async (frame) => {
     const args = SessionObserveArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response: file } = manager.get({ sessionId: args.sessionId });
     const sessionFile = file;
     manager.ensureSession(sessionFile);
@@ -28355,17 +27214,14 @@ function buildSessionHandlers(deps) {
     });
     return { response: { type: "session:observe", ok: true } };
   };
-  const events = async (frame, _client, ctx) => {
+  const events = async (frame) => {
     const args = SessionEventsArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.getEvents(args);
     return { response: { type: "session:events", ...response } };
   };
-  const subscribe = async (frame, client, ctx) => {
-    if (typeof frame.sessionId === "string") {
-      ensureSessionAccess(ctx, frame.sessionId, "read");
+  const subscribe = async (frame, client) => {
+    if (typeof frame.sessionId === "string")
       addSubscription(client, frame.sessionId);
-    }
     return {
       response: { type: "subscribed", sessionId: frame.sessionId }
     };
@@ -28377,9 +27233,8 @@ function buildSessionHandlers(deps) {
       response: { type: "unsubscribed", sessionId: frame.sessionId }
     };
   };
-  const pin = async (frame, _client, ctx) => {
+  const pin = async (frame) => {
     const args = SessionPinArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.pin(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
@@ -28388,15 +27243,13 @@ function buildSessionHandlers(deps) {
     const { response, broadcast } = manager.reorderPins(args);
     return { response: { type: "session:reorderPins", ...response }, broadcast };
   };
-  const answerQuestion = async (frame, _client, ctx) => {
+  const answerQuestion = async (frame) => {
     const args = AnswerQuestionArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.answerQuestion(args);
     return { response: { type: "session:answerQuestion", ...response }, broadcast };
   };
-  const cancelQuestion = async (frame, _client, ctx) => {
+  const cancelQuestion = async (frame) => {
     const args = CancelQuestionArgs.parse(frame);
-    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.cancelQuestion(args);
     return { response: { type: "session:cancelQuestion", ...response }, broadcast };
   };
@@ -28491,7 +27344,6 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/handlers/history.ts
-init_protocol();
 function buildHistoryHandlers(deps) {
   const { manager, history, store } = deps;
   const projects = async () => {
@@ -28503,27 +27355,17 @@ function buildHistoryHandlers(deps) {
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
-  const read = async (frame, _client, ctx) => {
+  const read = async (frame) => {
     const args = HistoryReadArgs.parse(frame);
     const { response: file } = manager.get({ sessionId: args.sessionId });
-    const f = file;
-    if (ctx && ctx.principal.kind === "guest") {
-      const ok = canAccessPersona(ctx.grants, f.ownerPersonaId, "read") && f.creatorPrincipalId === ctx.capabilityId;
-      if (!ok) {
-        throw new ClawdError(
-          ERROR_CODES.UNAUTHORIZED,
-          `principal guest:${ctx.principal.id} cannot read history of session ${args.sessionId}`
-        );
-      }
-    }
-    if (!f.toolSessionId) {
+    if (!file.toolSessionId) {
       return {
         response: { type: "history:read", messages: [], total: 0, offset: 0 }
       };
     }
     const res = await history.read({
-      cwd: f.cwd,
-      toolSessionId: f.toolSessionId,
+      cwd: file.cwd,
+      toolSessionId: file.toolSessionId,
       limit: args.limit,
       offset: args.offset
     });
@@ -28705,345 +27547,6 @@ function buildCapabilitiesHandlers(deps) {
   };
 }
 
-// src/handlers/capability.ts
-init_zod();
-init_protocol();
-var DeleteArgsSchema = external_exports.object({
-  capabilityId: external_exports.string().min(1)
-}).strict();
-function buildCapabilityHandlers(deps) {
-  const { manager, getShareBaseUrl } = deps;
-  const issue = async (frame) => {
-    const { type: _type, requestId: _requestId, ...rest } = frame;
-    const args = CapabilityIssueArgsSchema.parse(rest);
-    const { token, capability } = manager.issue({
-      displayName: args.displayName,
-      grants: args.grants,
-      ...args.expiresAt !== void 0 ? { expiresAt: args.expiresAt } : {},
-      ...args.maxUses !== void 0 ? { maxUses: args.maxUses } : {}
-    });
-    const base = getShareBaseUrl().replace(/\/$/, "");
-    const shareUrl = `${base}/?token=${encodeURIComponent(token)}`;
-    return {
-      response: {
-        type: "capability:issued",
-        token,
-        shareUrl,
-        capability: stripSecretHash(capability)
-      }
-    };
-  };
-  const list = async () => {
-    return {
-      response: {
-        type: "capability:list",
-        capabilities: manager.list().map(stripSecretHash)
-      }
-    };
-  };
-  const del = async (frame) => {
-    const { type: _type, requestId: _requestId, ...rest } = frame;
-    const args = DeleteArgsSchema.parse(rest);
-    const result = manager.delete(args.capabilityId);
-    if (!result) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `capability not found: ${args.capabilityId}`
-      );
-    }
-    return {
-      response: {
-        type: "capability:deleted",
-        capabilityId: args.capabilityId
-      }
-    };
-  };
-  const bindPeer = async (frame) => {
-    const { type: _type, requestId: _requestId, ...rest } = frame;
-    const args = CapabilityBindPeerArgsSchema.parse(rest);
-    try {
-      manager.recordPeerHello(args.capabilityId, {
-        ownerPrincipalId: args.peerOwnerId,
-        displayName: args.peerDisplayName,
-        now: Date.now()
-      });
-    } catch (e) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `capability:bindPeer: ${e.message}`
-      );
-    }
-    return {
-      response: { type: "capability:bindPeer:ok", capabilityId: args.capabilityId }
-    };
-  };
-  return {
-    "capability:issue": issue,
-    "capability:list": list,
-    "capability:delete": del,
-    "capability:bindPeer": bindPeer
-  };
-}
-
-// src/handlers/inbox.ts
-init_protocol();
-function resolvePeerOwnerId(ctx, argsPeerOwnerId, capManager) {
-  if (ctx.principal.kind === "owner") {
-    if (!argsPeerOwnerId) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        "inbox: owner ctx requires peerOwnerId"
-      );
-    }
-    return argsPeerOwnerId;
-  }
-  if (!ctx.capabilityId) {
-    throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "inbox: guest ctx missing capabilityId");
-  }
-  const cap = capManager.findById(ctx.capabilityId);
-  if (!cap?.peerOwnerId) {
-    throw new ClawdError(
-      ERROR_CODES.UNAUTHORIZED,
-      `inbox: guest cap ${ctx.capabilityId} has no peerOwnerId (recordPeerHello not yet)`
-    );
-  }
-  if (argsPeerOwnerId && argsPeerOwnerId !== cap.peerOwnerId) {
-    throw new ClawdError(
-      ERROR_CODES.UNAUTHORIZED,
-      `inbox: guest args.peerOwnerId mismatch (cap.peerOwnerId=${cap.peerOwnerId}, args=${argsPeerOwnerId})`
-    );
-  }
-  return cap.peerOwnerId;
-}
-function buildInboxHandlers(deps) {
-  const { manager, capManager } = deps;
-  const postMessage = async (frame, _client, ctx) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = InboxPostMessageArgsSchema.parse(rest);
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:postMessage: missing ConnectionContext");
-    }
-    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
-    const message = manager.postMessage({
-      peerOwnerId,
-      senderPrincipalId: ctx.principal.id,
-      text: args.text,
-      id: args.id,
-      createdAt: args.createdAt
-    });
-    return {
-      response: { type: "inbox:postMessage:ok", message }
-    };
-  };
-  const list = async (frame, _client, ctx) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = InboxListArgsSchema.parse(rest);
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:list: missing ConnectionContext");
-    }
-    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
-    const messages = manager.list(peerOwnerId, args.sinceCreatedAt);
-    return {
-      response: { type: "inbox:list:ok", peerOwnerId, messages }
-    };
-  };
-  const markRead = async (frame, _client, ctx) => {
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = InboxMarkReadArgsSchema.parse(rest);
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:markRead: missing ConnectionContext");
-    }
-    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
-    const updated = manager.markRead({
-      peerOwnerId,
-      principalId: ctx.principal.id,
-      upToCreatedAt: args.upToCreatedAt
-    });
-    return {
-      response: {
-        type: "inbox:markRead:ok",
-        peerOwnerId,
-        upToCreatedAt: args.upToCreatedAt,
-        updated
-      }
-    };
-  };
-  return {
-    "inbox:postMessage": postMessage,
-    "inbox:list": list,
-    "inbox:markRead": markRead
-  };
-}
-
-// src/handlers/received-capability.ts
-init_protocol();
-function ensureOwner(ctx) {
-  if (!ctx || ctx.principal.kind !== "owner") {
-    throw new ClawdError(
-      ERROR_CODES.UNAUTHORIZED,
-      "UNAUTHORIZED: received-capability:* requires owner ctx"
-    );
-  }
-}
-function ensureGuestCtx(ctx) {
-  if (!ctx || ctx.principal.kind !== "guest" || !ctx.capabilityId) {
-    throw new ClawdError(
-      ERROR_CODES.UNAUTHORIZED,
-      "UNAUTHORIZED: received-capability:autoAttach requires guest cap ctx"
-    );
-  }
-}
-function buildReceivedCapabilityHandlers(deps) {
-  const now = deps.now ?? Date.now;
-  const list = async (_frame, _client, ctx) => {
-    ensureOwner(ctx);
-    return {
-      response: {
-        type: "received-capability:list:ok",
-        receivedCaps: deps.store.list()
-      }
-    };
-  };
-  const add = async (frame, _client, ctx) => {
-    ensureOwner(ctx);
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = ReceivedCapabilityAddArgsSchema.parse(rest);
-    let conn;
-    try {
-      conn = await deps.connectRemote({
-        url: args.remoteUrl,
-        token: args.token,
-        selfPrincipalId: deps.selfPrincipalId(),
-        selfDisplayName: deps.selfDisplayName()
-      });
-    } catch (e) {
-      throw new ClawdError(
-        ERROR_CODES.VALIDATION_ERROR,
-        `INVITE_REMOTE_UNREACHABLE: ${e.message}`
-      );
-    }
-    try {
-      const wh = await conn.whoami();
-      const rc = {
-        ownerPrincipalId: wh.ownerId,
-        ownerDisplayName: wh.displayName,
-        remoteUrl: args.remoteUrl,
-        capabilityId: wh.capabilityId,
-        capabilityToken: args.token,
-        grants: wh.grants,
-        receivedAt: now()
-      };
-      deps.store.upsert(rc);
-      deps.broadcast({ type: "received-capability:added", receivedCap: rc });
-      return {
-        response: { type: "received-capability:add:ok", receivedCap: rc }
-      };
-    } finally {
-      try {
-        conn.close();
-      } catch {
-      }
-    }
-  };
-  const remove = async (frame, _client, ctx) => {
-    ensureOwner(ctx);
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = ReceivedCapabilityRemoveArgsSchema.parse(rest);
-    deps.store.remove(args.ownerPrincipalId);
-    deps.broadcast({
-      type: "received-capability:removed",
-      ownerPrincipalId: args.ownerPrincipalId
-    });
-    return {
-      response: {
-        type: "received-capability:remove:ok",
-        ownerPrincipalId: args.ownerPrincipalId
-      }
-    };
-  };
-  const autoAttach = async (frame, _client, ctx) => {
-    ensureGuestCtx(ctx);
-    const { type: _t, requestId: _r, ...rest } = frame;
-    const args = ReceivedCapabilityAutoAttachArgsSchema.parse(rest);
-    const rc = {
-      ownerPrincipalId: args.ownerPrincipalId,
-      ownerDisplayName: args.ownerDisplayName,
-      remoteUrl: args.remoteUrl,
-      capabilityId: args.capabilityId,
-      capabilityToken: args.token,
-      grants: args.grants,
-      receivedAt: now()
-    };
-    deps.store.upsert(rc);
-    deps.broadcast({ type: "received-capability:added", receivedCap: rc });
-    return {
-      response: { type: "received-capability:autoAttach:ok" }
-    };
-  };
-  return {
-    "received-capability:list": list,
-    "received-capability:add": add,
-    "received-capability:remove": remove,
-    "received-capability:autoAttach": autoAttach
-  };
-}
-
-// src/handlers/whoami.ts
-init_protocol();
-function buildWhoamiHandler(deps) {
-  return async (_frame, _client, ctx) => {
-    if (!ctx) {
-      throw new ClawdError(ERROR_CODES.INTERNAL, "whoami: missing ConnectionContext");
-    }
-    const owner = makeOwnerPrincipal(deps.ownerPrincipalId, deps.ownerDisplayName);
-    let capability;
-    if (ctx.principal.kind === "owner") {
-      capability = {
-        id: deps.ownerPrincipalId,
-        displayName: deps.ownerDisplayName,
-        grants: ctx.grants,
-        issuedAt: 0,
-        usedCount: 0
-      };
-    } else {
-      if (!ctx.capabilityId) {
-        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "whoami: guest ctx without capabilityId");
-      }
-      const cap = deps.capabilityManager.findById(ctx.capabilityId);
-      if (!cap) {
-        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, `whoami: capability not found: ${ctx.capabilityId}`);
-      }
-      capability = stripSecretHash(cap);
-    }
-    const grantedPersonas = [];
-    const isGuest = ctx.principal.kind === "guest";
-    const hasWildcard = capability.grants.some((g2) => g2.resource.type === "*");
-    if (hasWildcard) {
-      for (const id of deps.personaStore.list()) {
-        const file = deps.personaStore.read(id);
-        if (!file) continue;
-        if (isGuest && !file.public) continue;
-        grantedPersonas.push({ id: file.personaId, displayName: file.label });
-      }
-    } else {
-      for (const g2 of capability.grants) {
-        if (g2.resource.type !== "persona") continue;
-        const file = deps.personaStore.read(g2.resource.id);
-        if (!file) continue;
-        grantedPersonas.push({ id: file.personaId, displayName: file.label });
-      }
-    }
-    return {
-      response: {
-        type: "whoami:ok",
-        owner,
-        capability,
-        grantedPersonas
-      }
-    };
-  };
-}
-
 // src/handlers/meta.ts
 var import_node_os13 = __toESM(require("os"), 1);
 init_protocol();
@@ -29107,14 +27610,9 @@ function buildPersonaHandlers(deps) {
     const persona = personaManager.create(args);
     return { response: { type: "persona:info", ...persona } };
   };
-  const list = async (_frame, _client, ctx) => {
-    const all = personaRegistry.list();
-    const isGuest = ctx?.principal.kind === "guest";
-    const personas = isGuest ? all.filter(
-      (p2) => p2.public && assertGrant(ctx.grants, { type: "persona", id: p2.personaId }, "read")
-    ) : all;
+  const list = async () => {
     return {
-      response: { type: "persona:list", personas }
+      response: { type: "persona:list", personas: personaRegistry.list() }
     };
   };
   const get = async (frame) => {
@@ -29152,12 +27650,26 @@ function buildPersonaHandlers(deps) {
       response: { type: "persona:deleted", personaId: args.personaId }
     };
   };
+  const issueToken = async (frame) => {
+    const args = PersonaIssueTokenArgsSchema.parse(frame);
+    const { token, persona } = personaManager.issueToken(args.personaId, args.label);
+    return {
+      response: { type: "persona:tokenIssued", token, persona }
+    };
+  };
+  const revokeToken = async (frame) => {
+    const args = PersonaRevokeTokenArgsSchema.parse(frame);
+    const persona = personaManager.revokeToken(args.personaId, args.token);
+    return { response: { type: "persona:info", ...persona } };
+  };
   return {
     "persona:create": create,
     "persona:list": list,
     "persona:get": get,
     "persona:update": update,
-    "persona:delete": del
+    "persona:delete": del,
+    "persona:issueToken": issueToken,
+    "persona:revokeToken": revokeToken
   };
 }
 
@@ -29288,11 +27800,23 @@ function buildAttachmentHandlers(deps) {
     const entries = deps.groupFileStore.list(scope, parsed.data.sessionId);
     return { response: { type: "attachment.groupList", entries } };
   };
+  const groupListPersona = async (frame) => {
+    if (!deps.groupFileStore) {
+      throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "groupFileStore not wired");
+    }
+    const parsed = AttachmentGroupListPersonaArgs.safeParse(frame);
+    if (!parsed.success) {
+      throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
+    }
+    const perSession = deps.groupFileStore.listByPersona(parsed.data.personaId);
+    return { response: { type: "attachment.groupListPersona", perSession } };
+  };
   return {
     "attachment.signUrl": signUrl,
     "attachment.groupAdd": groupAdd,
     "attachment.groupRemove": groupRemove,
-    "attachment.groupList": groupList
+    "attachment.groupList": groupList,
+    "attachment.groupListPersona": groupListPersona
   };
 }
 
@@ -29310,136 +27834,10 @@ function buildMethodHandlers(deps) {
       personaManager: deps.personaManager,
       personaRegistry: deps.personaRegistry
     }),
-    ...buildCapabilityHandlers({
-      manager: deps.capabilityManager,
-      getShareBaseUrl: deps.getShareBaseUrl
-    }),
-    ...buildInboxHandlers({
-      manager: deps.inboxManager,
-      capManager: deps.capabilityManager
-    }),
-    ...buildReceivedCapabilityHandlers({
-      store: deps.receivedCapabilityStore,
-      connectRemote: deps.connectRemote,
-      broadcast: deps.broadcastToOwners,
-      selfPrincipalId: () => deps.ownerPrincipalId,
-      selfDisplayName: () => deps.ownerDisplayName
-    }),
-    whoami: buildWhoamiHandler({
-      ownerDisplayName: deps.ownerDisplayName,
-      ownerPrincipalId: deps.ownerPrincipalId,
-      personaStore: deps.personaStore,
-      capabilityManager: deps.capabilityManager
-    }),
     ...deps.attachment ? buildAttachmentHandlers(deps.attachment) : {}
   };
 }
 
-// src/handlers/method-grants.ts
-var ADMIN_ANY = {
-  kind: "fixed",
-  resource: { type: "*" },
-  action: "admin"
-};
-var CAPABILITY_SCOPED = { kind: "capability-scoped" };
-var METHOD_GRANT_MAP = {
-  // ---- public（meta-only，guest 也能调） ----
-  "info": { kind: "public" },
-  "ping": { kind: "public" },
-  // v2 Phase 6: whoami 是身份反查，任何 authed connection (owner / guest) 都能调；
-  // handler 内部按 ctx.principal.kind 决定返回 "合成 owner self capability" 还是
-  // "查 capabilityManager 拿 caller 的 guest capability"。
-  "whoami": { kind: "public" },
-  // ---- capability platform（admin-only，本 PR 新增） ----
-  "capability:issue": ADMIN_ANY,
-  "capability:list": ADMIN_ANY,
-  "capability:delete": ADMIN_ANY,
-  "capability:bindPeer": ADMIN_ANY,
-  // ---- inbox: channel-based IM (capability platform v3) ----
-  // 三条都 'public' — capability 本身就是授权凭证. handler 内额外校验
-  // guest ctx.capabilityId === args.capabilityId, 防 guest 越权操作别的 channel.
-  "inbox:list": { kind: "public" },
-  "inbox:markRead": { kind: "public" },
-  "inbox:postMessage": { kind: "public" },
-  // ---- received-capability:* (bidirectional cap 视角 B 2026-05-23) ----
-  // owner-only: list / add / remove；guest-only: autoAttach (capability 本身是凭证)
-  "received-capability:list": ADMIN_ANY,
-  "received-capability:add": ADMIN_ANY,
-  "received-capability:remove": ADMIN_ANY,
-  "received-capability:autoAttach": { kind: "public" },
-  // ---- session:* / chat:* 业务方法（v2 Phase 8 两层模型）----
-  // dispatcher 不验资源，handler 内按 ctx + frame.args 反查 ownerPersonaId 调 assertGrant。
-  // owner 自动通过（ctx 自带 '*':'admin' grant 一切 match）；guest 在被授权 persona 内可调。
-  "session:create": CAPABILITY_SCOPED,
-  "session:list": CAPABILITY_SCOPED,
-  "session:get": CAPABILITY_SCOPED,
-  "session:update": CAPABILITY_SCOPED,
-  "session:delete": CAPABILITY_SCOPED,
-  "session:send": CAPABILITY_SCOPED,
-  "session:stop": CAPABILITY_SCOPED,
-  "session:interrupt": CAPABILITY_SCOPED,
-  "session:rewind": CAPABILITY_SCOPED,
-  "session:rewind-diff": CAPABILITY_SCOPED,
-  "session:rewindable-message-ids": CAPABILITY_SCOPED,
-  "session:fork": CAPABILITY_SCOPED,
-  "session:new": CAPABILITY_SCOPED,
-  "session:resume": CAPABILITY_SCOPED,
-  "session:observe": CAPABILITY_SCOPED,
-  "session:events": CAPABILITY_SCOPED,
-  "session:subscribe": CAPABILITY_SCOPED,
-  "session:unsubscribe": CAPABILITY_SCOPED,
-  "session:pin": CAPABILITY_SCOPED,
-  "session:reorderPins": ADMIN_ANY,
-  // owner 全局操作，无 personaId 维度
-  "permission:respond": CAPABILITY_SCOPED,
-  "session:answerQuestion": CAPABILITY_SCOPED,
-  "session:cancelQuestion": CAPABILITY_SCOPED,
-  "history:projects": ADMIN_ANY,
-  "history:list": ADMIN_ANY,
-  // history:read 取一条 session 的 CC JSONL 历史。guest 进 persona VM 后必须能读自己
-  // 创建的 session 历史（chat view 加载历史消息走这条），所以下沉到 capability-scoped；
-  // handler 内按 ctx.capabilityId === file.creatorPrincipalId 拦越权。
-  "history:read": CAPABILITY_SCOPED,
-  "history:subagents": ADMIN_ANY,
-  "history:subagent-read": ADMIN_ANY,
-  "history:recentDirs": ADMIN_ANY,
-  "workspace:list": ADMIN_ANY,
-  "workspace:read": ADMIN_ANY,
-  "skills:list": ADMIN_ANY,
-  "agents:list": ADMIN_ANY,
-  "git:root": ADMIN_ANY,
-  "git:branch": ADMIN_ANY,
-  "git:branches": ADMIN_ANY,
-  "capabilities:get": ADMIN_ANY,
-  "persona:create": ADMIN_ANY,
-  // persona:list 下沉到 CAPABILITY_SCOPED：guest 调用合法（用于 People 面板展开
-  // 对方分享的 personas），handler 端按 ctx + persona.public + assertGrant 过滤。
-  "persona:list": CAPABILITY_SCOPED,
-  "persona:get": ADMIN_ANY,
-  "persona:update": ADMIN_ANY,
-  "persona:delete": ADMIN_ANY,
-  "session:pty:input": ADMIN_ANY,
-  "session:pty:resize": ADMIN_ANY,
-  // file-sharing attachment.* RPC：dispatcher 用 admin-only 兜底（wire-level 拦），
-  // 实际只有 owner 能调（personal token 链路 2026-05-21 删除，HTTP Bearer 只识别 owner）
-  "attachment.signUrl": ADMIN_ANY,
-  "attachment.groupAdd": ADMIN_ANY,
-  "attachment.groupRemove": ADMIN_ANY,
-  "attachment.groupList": ADMIN_ANY
-};
-function computeGrantForFrame(method, frame) {
-  const rule = METHOD_GRANT_MAP[method];
-  if (!rule) return { kind: "public" };
-  if (rule.kind === "public") return { kind: "public" };
-  if (rule.kind === "capability-scoped") return { kind: "public" };
-  if (rule.kind === "fixed") {
-    return { kind: "check", resource: rule.resource, action: rule.action };
-  }
-  const picked = rule.pick(frame);
-  if (!picked) return { kind: "public" };
-  return { kind: "check", resource: picked.resource, action: picked.action };
-}
-
 // src/index.ts
 async function startDaemon(config) {
   const logger = createLogger({
@@ -29455,90 +27853,24 @@ async function startDaemon(config) {
   if (pre.status === "stale") {
     logger.warn("stale state file detected, overwriting", { pid: pre.existing.pid });
   }
-  const authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
   let resolvedAuthToken = null;
+  let authFile = null;
   if (config.authToken && config.authToken.trim()) {
     resolvedAuthToken = config.authToken.trim();
   } else if (config.tunnel) {
+    authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
     resolvedAuthToken = authFile.token;
   }
-  const ownerPrincipalId = authFile.ownerPrincipalId;
-  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
-  migrateLegacyFiles(config.dataDir);
-  const inboxStore = new InboxStore(config.dataDir);
-  const inboxManager = new InboxManager(inboxStore, (_peerOwnerId, frame) => {
-    wsServer?.broadcastToOwners(frame);
-  });
-  const receivedCapabilityStore = new ReceivedCapabilityStore(config.dataDir);
-  receivedCapabilityStore.load();
-  const capabilityStore = new CapabilityStore(config.dataDir);
-  const capabilityRegistry = new CapabilityRegistry(capabilityStore);
-  const capabilityManager = new CapabilityManager(capabilityRegistry, {
-    onIssued: (cap, token) => {
-      wsServer?.broadcastToOwners({
-        type: "capability:tokenIssued",
-        capability: stripSecretHash(cap),
-        token
-      });
-    },
-    onDeleted: (cap) => {
-      const deletedAt = Date.now();
-      wsServer?.broadcastToOwners({
-        type: "capability:tokenDeleted",
-        capabilityId: cap.id,
-        deletedAt
-      });
-      wsServer?.closeConnectionsByCapability(cap.id);
-      const cleanup = cleanupGuestSessionsForCapability(cap, sessionStoreFactory);
-      if (cleanup.removed.length > 0) {
-        logger.info("capability delete cascade: guest sessions removed", {
-          capabilityId: cap.id,
-          removedDirs: cleanup.removed
-        });
-      }
-    }
-  });
-  migrateDropPersonsDir(config.dataDir);
   let wsServer = null;
   const authGate = authMode === "first-message" ? new AuthGate({
     shouldEnforce: buildShouldEnforce({ tunnel: config.tunnel }),
-    // Task 1.7：authenticate 注入路径替代 expectedToken 单 token 比对。
-    // owner 路径 constantTimeEqual 防侧信道；guest 路径走 capabilityRegistry.
     expectedToken: resolvedAuthToken,
-    authenticate: (t, selfPrincipalId, selfDisplayName) => {
-      return authenticate(t, {
-        isOwnerToken: (x) => resolvedAuthToken != null && constantTimeEqual(x, resolvedAuthToken),
-        ownerPrincipalId,
-        ownerDisplayName,
-        capabilityRegistry,
-        selfPrincipalId,
-        selfDisplayName,
-        onGuestHello: (capId, ownerId, name) => {
-          capabilityManager.recordPeerHello(capId, {
-            ownerPrincipalId: ownerId,
-            displayName: name,
-            now: Date.now()
-          });
-        }
-      });
-    },
-    onAuthed: (h, ctx) => wsServer?.attachClientContext(h.id, ctx),
-    buildOwnerContext: () => ownerContext(ownerPrincipalId, ownerDisplayName),
     closeConnection: (h, code, reason) => wsServer?.closeClient(h.id, code, reason),
     sendOk: (h, payload) => wsServer?.sendToClient(h.id, payload)
   }) : null;
   resetRegistry();
-  const migrateResult = migrateFlattenSessions({ dataDir: config.dataDir });
-  if (!migrateResult.skipped && (migrateResult.movedBare || migrateResult.movedVmOwner || migrateResult.archivedListener)) {
-    logger.info("sessions migration applied", {
-      movedBare: migrateResult.movedBare,
-      movedVmOwner: migrateResult.movedVmOwner,
-      archivedListener: migrateResult.archivedListener
-    });
-  }
-  const sessionStoreFactory = new SessionStoreFactory({ dataDir: config.dataDir });
-  const store = sessionStoreFactory.forBare();
+  const store = new SessionStore({ dataDir: config.dataDir });
   const workspace = new WorkspaceBrowser();
   const skills = new SkillsScanner();
   const agents = new AgentsScanner();
@@ -29551,12 +27883,10 @@ async function startDaemon(config) {
   } else {
     logger.warn("persona.seed.skip", { reason: "defaults-root-not-found" });
   }
+  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const manager = new SessionManager({
     store,
-    // Phase 2 (capability platform plan §1): factory 注入后 manager.storeFor 走
-    // 新布局派生 (sessions/* + personas/<pid>/.clawd/sessions/owner/*)
-    storeFactory: sessionStoreFactory,
     logger,
     getAdapter,
     historyReader: history,
@@ -29564,7 +27894,6 @@ async function startDaemon(config) {
     personaRoot: import_node_path27.default.join(config.dataDir, "personas"),
     personaStore,
     ownerDisplayName,
-    ownerPrincipalId,
     mode: config.mode,
     broadcastFrame: (frame, target) => {
       if (target === "all") {
@@ -29700,37 +28029,18 @@ async function startDaemon(config) {
       // group RPC + sign 都用：根据 sessionId 反查 scope。owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid)
-    },
-    // Task 1.9: capability:issue/list/revoke handler 依赖
-    capabilityManager,
-    // v2 Phase 5: capability:issue 返回的 shareUrl 用此 base URL 拼接。
-    // tunnel 拉起后切到反代 wss://... 地址；否则本机 ws://host:port。
-    getShareBaseUrl: () => currentTunnelUrl ?? `ws://${config.host}:${config.port}`,
-    // v2 Phase 6: whoami handler 装在 owner principal.displayName + persona 解析
-    ownerDisplayName,
-    // owner-id stabilization: whoami 用稳定 ownerPrincipalId 替代 'owner' 字面量
-    ownerPrincipalId,
-    personaStore,
-    // capability handler 也用 (capability:issue 走 registry / capability:list)
-    capabilityRegistry,
-    // capability platform v3 inbox: handler 接 manager (post/list/markRead),
-    // cascade 接 store (list 统计 deletedInboxEvents).
-    inboxManager,
-    inboxStore,
-    // bidirectional cap 视角 B: 对方颁给我的 cap 走这个 store
-    receivedCapabilityStore,
-    // received-capability:added / removed broadcast；复用 capability:tokenIssued 同款通路
-    broadcastToOwners: (frame) => wsServer?.broadcastToOwners(frame),
-    // received-capability:add 临时 ws 连远端跑 whoami — 直连 ws (不走 transport listener)
-    connectRemote
+    }
   });
   const authResolver = new AuthContextResolver({
-    ownerToken: resolvedAuthToken
+    ownerToken: resolvedAuthToken,
+    personaRegistry
   });
   const httpRouter = createHttpRouter({
     authResolver,
     daemonVersion: version,
     logger,
+    personaStore,
+    groupFileStore,
     sessionStore: store,
     // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
     // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
@@ -29740,8 +28050,6 @@ async function startDaemon(config) {
     host: config.host,
     port: config.port,
     logger,
-    // broadcastToPrincipal 用此 id 路由 owner-targeted 帧（替代字面量 'owner' sentinel）
-    ownerPrincipalId,
     readyFrameBuilder: (ctx) => buildReadyFrame(
       {
         manager,
@@ -29757,29 +28065,6 @@ async function startDaemon(config) {
     ),
     protocolVersion: PROTOCOL_VERSION,
     authGate: authGate ?? void 0,
-    // noAuth 模式下仍验 capability token: 修 capability platform 漏洞 — 远端 client
-    // 用 cap token 连 noAuth daemon 时若无此 hook 会 fallback owner ctx, whoami 错返
-    // capability.id = ownerPrincipalId, 导致 myCapabilityId 写错 → inbox channel 写错.
-    // 命中 cap → attach guest ctx; 空 token / 未命中 → 保持 noAuth 行为 (handler fallback owner).
-    tryVerifyCapabilityToken: (token, selfPrincipalId, selfDisplayName) => {
-      const v2 = capabilityRegistry.verifyToken(token);
-      if (!v2.ok) return null;
-      if (selfPrincipalId && selfDisplayName) {
-        try {
-          capabilityManager.recordPeerHello(v2.capability.id, {
-            ownerPrincipalId: selfPrincipalId,
-            displayName: selfDisplayName,
-            now: Date.now()
-          });
-        } catch {
-        }
-      }
-      return {
-        principal: { id: v2.capability.id, kind: "guest", displayName: v2.capability.displayName },
-        grants: v2.capability.grants,
-        capabilityId: v2.capability.id
-      };
-    },
     // file-sharing HTTP 路由复用 daemon 同端口（spec §5 第 3 条）；router 自己处理 auth + 404
     httpRequestHandler: httpRouter,
     // 订阅成功后给该 client 重放 in-flight pendingQuestions（plan: clawd-question-server-truth）。
@@ -29832,18 +28117,7 @@ async function startDaemon(config) {
     const requestId = typeof frame.requestId === "string" ? frame.requestId : void 0;
     const handler = handlers[type];
     if (!handler) throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, `not implemented: ${type}`);
-    const ctx = wsServer.getClientContext(client.id) ?? ownerContext(ownerPrincipalId, ownerDisplayName);
-    const verdict = computeGrantForFrame(type, frame);
-    if (verdict.kind === "check") {
-      const ok = assertGrant(ctx.grants, verdict.resource, verdict.action);
-      if (!ok) {
-        throw new ClawdError(
-          ERROR_CODES.UNAUTHORIZED,
-          `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${verdict.action} on ${verdict.resource.type}${"id" in verdict.resource ? ":" + verdict.resource.id : ""}`
-        );
-      }
-    }
-    const result = await handler(frame, client, ctx);
+    const result = await handler(frame, client);
     if (requestId && result.response) {
       client.send({ ...result.response, requestId });
     }
@@ -29966,13 +28240,6 @@ ${bar}
     manager
   };
 }
-function migrateDropPersonsDir(dataDir) {
-  const dir = import_node_path27.default.join(dataDir, "persons");
-  try {
-    import_node_fs24.default.rmSync(dir, { recursive: true, force: true });
-  } catch {
-  }
-}
 
 // src/cli.ts
 async function main() {