@clawos-dev/clawd 0.2.77-beta.145.522509b → 0.2.77

package/dist/cli.cjs

@@ -87,15 +87,16 @@ var init_methods = __esm({
       "git:branches",
       "capabilities:get",
       // ---- persona:* (persona 管理) ----
+      // persona:list 响应 shape 不分流（统一返 PersonaFile[]），但 daemon handler 按
+      // ConnectionContext 投影不同子集：
+      //   owner ctx → 返全量 personas（含 private）
+      //   guest ctx → persona.public === true ∧ assertGrant(ctx.grants, {persona,p.id}, 'read')
+      // method-grants.ts: persona:list 是 CAPABILITY_SCOPED；其它 persona:* 仍 ADMIN_ANY。
       "persona:create",
       "persona:list",
       "persona:get",
       "persona:update",
       "persona:delete",
-      // token 颁发 / 吊销：file-sharing HTTP Bearer 鉴权用（PersonaRegistry.findByToken
-      // 反查 personaId / label）。owner UI 在 PersonaSettingsDrawer "分享 Token" section 管理。
-      "persona:issueToken",
-      "persona:revokeToken",
       // ---- session:pty 双向透传（仅 CLAWD_CC_MODE=tui 才生效，对应 session:pty push 帧的上行） ----
       // session:pty:input — UI 把用户键盘字节（base64 UTF-8）发给 daemon，daemon 直写 pty stdin。
       //   高频帧（每次按键 1 帧），不入 reducer / 不广播。response 是 fire-and-forget 风格 ack。
@@ -106,14 +107,45 @@ var init_methods = __esm({
       // ---- attachment.* file-sharing（详见 attachment-schemas.ts） ----
       // 命名警告：这里的 `attachment.*` RPC 与 CC v2.x 上行 `type:"attachment"` 系统行
       // （attachment-skills / attachment-deferred-tools / attachment_memories）是不同概念。
-      // 全部管理类 RPC handler 入口 requireOwner（personal token 调任意一个都 403）；
-      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，签名验证），不在白名单内。
+      // 全部管理类 RPC dispatcher grant 限 owner（capability admin-only）；
+      // 实际文件传输走 HTTP 路由（GET /files?p=&e=&s=，HMAC 签名自包含，不在白名单内）。
       "attachment.signUrl",
       "attachment.groupAdd",
       "attachment.groupRemove",
       "attachment.groupList",
-      // v2：跨 session 聚合（本期 UI 不调，保留槽位用于 HTTP ACL 内部判定 / 未来 "All files" tab）
-      "attachment.groupListPersona",
+      // ---- capability:* (capability platform 鉴权底座) ----
+      // owner 颁发 / 列出 / 删除给 guest 的 capability。三者均需 admin 权限（METHOD_GRANT_MAP
+      // 在 daemon 端固定为 `{ resource: '*', action: 'admin' }`，owner 自动满足）。
+      // 颁发后 daemon 推 'capability:tokenIssued' 帧；删除推 'capability:tokenDeleted' 帧。
+      // 删除是 hard delete：CapabilityStore 物理移除 + 关该 cap 的所有活跃 ws + rm
+      // personas/<pid>/.clawd/sessions/guests/<capId>/ guest sessions 目录。
+      "capability:issue",
+      "capability:list",
+      "capability:delete",
+      // bidirectional cap 视角 B 2026-05-23: owner 主动告诉 daemon "我颁的某 cap 给了谁"
+      // (UI 在 accept dialog 4 步流程里调; 等价于 recordPeerHello 但不经 ws auth path).
+      // 否则 B 端颁回的 cap 因为 A 不连 B → peerOwnerId 永不回写 → useContacts 派生 pending.
+      "capability:bindPeer",
+      // ---- inbox:* (capability platform Phase 3 跨用户通知 + Phase 4 DM) ----
+      // owner 接 guest 的 cross-principal 消息事件 + DM 双向私聊.
+      // inbox:list / markRead: admin-only (Phase 3); inbox:postMessage: DM 自带能力,
+      // 任何 principal (owner/guest) 可调 (Phase 4).
+      "inbox:list",
+      "inbox:markRead",
+      "inbox:postMessage",
+      // ---- received-capability:* (对方颁给我的 cap, 视角 B 双向授权模型, 2026-05-23) ----
+      // owner 入口: list / add / remove
+      // guest 端: autoAttach (B 接 A 的 token 后通过 cap channel ws 推 cap 给 A)
+      // 详见 received-capability.ts JSDoc + spec 2026-05-23-bidirectional-cap-design.md
+      "received-capability:list",
+      "received-capability:add",
+      "received-capability:remove",
+      "received-capability:autoAttach",
+      // ---- whoami (v2 capability platform) ----
+      // 任何 authed connection 都能调；返回 owner 显示名 + 当前 capability wire 形态 +
+      // grants 对应的 persona 元数据 (id + displayName)。UI 端 AddRemotePersonaDialog
+      // 的 preview 一次性临时 client 用它判定身份和可用 persona。
+      "whoami",
       "info",
       "ping"
     ];
@@ -609,8 +641,8 @@ var init_parseUtil = __esm({
     init_errors2();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path32, errorMaps, issueData } = params;
-      const fullPath = [...path32, ...issueData.path || []];
+      const { data, path: path39, errorMaps, issueData } = params;
+      const fullPath = [...path39, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -921,11 +953,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path32, key) {
+      constructor(parent, value, path39, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path32;
+        this._path = path39;
         this._key = key;
       }
       get path() {
@@ -4309,12 +4341,12 @@ var init_zod = __esm({
 });
 
 // ../protocol/src/attachment-schemas.ts
-var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema, AttachmentGroupListPersonaArgs, AttachmentGroupListPersonaResponseSchema;
+var TOKEN_ROLES, GROUP_FILE_SOURCES, GroupFileEntrySchema, AttachmentSignUrlArgs, AttachmentSignUrlResponseSchema, AttachmentGroupAddArgs, AttachmentGroupAddResponseSchema, AttachmentGroupRemoveArgs, AttachmentGroupRemoveResponseSchema, AttachmentGroupListArgs, AttachmentGroupListResponseSchema;
 var init_attachment_schemas = __esm({
   "../protocol/src/attachment-schemas.ts"() {
     "use strict";
     init_zod();
-    TOKEN_ROLES = ["owner", "personal"];
+    TOKEN_ROLES = ["owner"];
     GROUP_FILE_SOURCES = ["agent", "owner"];
     GroupFileEntrySchema = external_exports.object({
       /** daemon 派发的稳定 id（用于 RPC remove / UI key） */
@@ -4370,31 +4402,15 @@ var init_attachment_schemas = __esm({
     AttachmentGroupListResponseSchema = external_exports.object({
       entries: external_exports.array(GroupFileEntrySchema)
     });
-    AttachmentGroupListPersonaArgs = external_exports.object({
-      personaId: external_exports.string().min(1)
-    });
-    AttachmentGroupListPersonaResponseSchema = external_exports.object({
-      perSession: external_exports.array(
-        external_exports.object({
-          sessionId: external_exports.string().min(1),
-          entries: external_exports.array(GroupFileEntrySchema)
-        })
-      )
-    });
   }
 });
 
 // ../protocol/src/persona-schemas.ts
-var PersonaTokenEntrySchema, PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema, PersonaIssueTokenArgsSchema, PersonaRevokeTokenArgsSchema;
+var PersonaFileSchema, PersonaSkillSummarySchema, PersonaPluginSummarySchema, PersonaSandboxSettingsSchema, PersonaInfoResponseSchema, PersonaCreateArgsSchema, PersonaIdArgsSchema, PersonaUpdateArgsSchema;
 var init_persona_schemas = __esm({
   "../protocol/src/persona-schemas.ts"() {
     "use strict";
     init_zod();
-    PersonaTokenEntrySchema = external_exports.object({
-      label: external_exports.string(),
-      issuedAt: external_exports.number(),
-      revoked: external_exports.boolean()
-    });
     PersonaFileSchema = external_exports.object({
       personaId: external_exports.string(),
       label: external_exports.string(),
@@ -4403,13 +4419,6 @@ var init_persona_schemas = __esm({
       // 8-key set defined UI-side in `lib/session-icons.ts`; protocol stays plain string
       // for forward compatibility, consumer fallbacks to default when key not found.
       iconKey: external_exports.string().optional(),
-      /**
-       * Persona token 列表：file-sharing HTTP Bearer 鉴权用。
-       * - 写：`PersonaManager.issueToken` / `revokeToken`
-       * - 读：`PersonaRegistry.findByToken` 反向查表（需 persona.public === true）
-       * - optional：兼容历史 persona.json 不含此字段的情形（旧 daemon 写文件时省略）
-       */
-      tokenMap: external_exports.record(external_exports.string(), PersonaTokenEntrySchema).optional(),
       createdAt: external_exports.number(),
       updatedAt: external_exports.number()
     }).strict();
@@ -4468,14 +4477,6 @@ var init_persona_schemas = __esm({
         iconKey: external_exports.string().nullable().optional()
       }).strict()
     }).strict();
-    PersonaIssueTokenArgsSchema = external_exports.object({
-      personaId: external_exports.string().min(1),
-      label: external_exports.string().min(1)
-    });
-    PersonaRevokeTokenArgsSchema = external_exports.object({
-      personaId: external_exports.string().min(1),
-      token: external_exports.string().min(1)
-    });
   }
 });
 
@@ -4582,6 +4583,15 @@ var init_schemas = __esm({
       // 才能让 alice 重连同一 sub-session（持久化在 alice localStorage 之外，由 daemon push 同步）。
       // optional 是因为 owner-mode session 不带；只要写入就是 listener-mode 必填三元组。
       chatId: external_exports.string().min(1).optional(),
+      /**
+       * 创建该 session 的 principal id（owner uuid 或 guest cap.id），从 session:create handler
+       * 的 ctx.principal.id 派生。Person identity Q2「按对端人聚合 sessions」需要它：
+       * UI 端按 `creatorPrincipalId === ownerPrincipalId` 区分「我自己」vs「别人接入」，
+       * 后者再通过 PersonAlias 表反查 personId 二级分组。
+       *
+       * optional：兼容 2026-05-21 之前的老 session 数据，新建一定有值。
+       */
+      creatorPrincipalId: external_exports.string().min(1).optional(),
       createdAt: external_exports.string().min(1),
       updatedAt: external_exports.string().min(1)
     });
@@ -4991,7 +5001,20 @@ var init_schemas = __esm({
     AuthRequestFrameSchema = external_exports.object({
       type: external_exports.literal("auth"),
       token: external_exports.string().min(1),
-      scheme: external_exports.literal("bearer").optional()
+      scheme: external_exports.literal("bearer").optional(),
+      /**
+       * guest 端 ws 接入时自报对端稳定 ownerPrincipalId。AuthGate.authenticate 收到
+       * 后调 capabilityManager.recordPeerHello(capId, ownerPrincipalId, displayName)
+       * 把 cap.peerOwnerId / firstUsedByPeerAt 字段回写，让 owner 端 UI 在 People
+       * tab 顶层 PeerOwner 视图 + Personas tab 二级分组拿到对端身份。
+       */
+      selfPrincipalId: external_exports.string().min(1).optional(),
+      /**
+       * 同 selfPrincipalId：自报 owner displayName（人类可读），让对端 daemon 把
+       * 显示名写入 cap.peerOwnerDisplayName（cap.displayName 本来就是 owner 颁时填
+       * 的"颁给谁/用途"，hello 收到的 displayName 是辅助）。
+       */
+      selfDisplayName: external_exports.string().optional()
     });
     AuthOkFrameSchema = external_exports.object({
       type: external_exports.literal("auth:ok"),
@@ -5029,10 +5052,9 @@ var init_schemas = __esm({
       // PR 2 daemon 实现 single HTTP server + auth-context 后，daemon 必返这五个字段，
       // 届时可考虑改成 required。spec §11 第 3 条："tokenRole 是协议字段，daemon 查 token
       // 表后显式下发，UI 不自行推导"——所以 UI 一律读这里，禁止本地推导。
-      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）；'personal' = persona 派发的访客 token。来源 TOKEN_ROLES（spec §11 #1 中央真理源） */
+      /** 'owner' = 拿到 owner-token 的连接（不限来源 IP）。来源 TOKEN_ROLES（spec §11 #1 中央真理源）。
+       *  历史 'personal' role（persona file-sharing token）在 2026-05-21 删除；tokenPersonaId 一同移除。 */
       tokenRole: external_exports.enum(TOKEN_ROLES).optional(),
-      /** tokenRole='personal' 时携带（绑定到具体 persona）；owner 不携带 */
-      tokenPersonaId: external_exports.string().min(1).optional(),
       /** socket.remoteAddress 是否落在 127.0.0.1 / ::1；本期无 RPC 消费，保留协议槽位给未来 "Reveal in Finder" 等本机动作 */
       isLoopback: external_exports.boolean().optional(),
       /** UI 拼 file-sharing HTTP 路由的前缀（http(s)://host:port），不含尾斜杠；frpc 反代时返反代地址 */
@@ -5059,6 +5081,194 @@ var init_persona_mode = __esm({
   }
 });
 
+// ../protocol/src/principal.ts
+function makeOwnerPrincipal(id, displayName) {
+  return PrincipalSchema.parse({ id, kind: "owner", displayName });
+}
+var PrincipalKindSchema, PrincipalSchema;
+var init_principal = __esm({
+  "../protocol/src/principal.ts"() {
+    "use strict";
+    init_zod();
+    PrincipalKindSchema = external_exports.enum(["owner", "guest"]);
+    PrincipalSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      kind: PrincipalKindSchema,
+      displayName: external_exports.string()
+    }).strict();
+  }
+});
+
+// ../protocol/src/capability.ts
+function stripSecretHash(cap) {
+  const { secretHash: _hash, ...wire } = cap;
+  return wire;
+}
+var ResourceSchema, ActionSchema, GrantSchema, CapabilitySchema, CapabilityWireSchema, CapabilityErrorCodeSchema, WhoamiResponseSchema, CapabilityIssueArgsSchema, CapabilityBindPeerArgsSchema;
+var init_capability = __esm({
+  "../protocol/src/capability.ts"() {
+    "use strict";
+    init_zod();
+    ResourceSchema = external_exports.discriminatedUnion("type", [
+      external_exports.object({ type: external_exports.literal("persona"), id: external_exports.string().min(1) }).strict(),
+      external_exports.object({ type: external_exports.literal("chat"), id: external_exports.string().min(1) }).strict(),
+      external_exports.object({ type: external_exports.literal("*") }).strict()
+    ]);
+    ActionSchema = external_exports.enum(["read", "send", "admin"]);
+    GrantSchema = external_exports.object({
+      resource: ResourceSchema,
+      actions: external_exports.array(ActionSchema).min(1)
+    }).strict();
+    CapabilitySchema = external_exports.object({
+      id: external_exports.string().min(1),
+      // sha256(token) hex 64
+      secretHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      displayName: external_exports.string(),
+      // 空数组合法 = 纯访客（只能 DM）
+      grants: external_exports.array(GrantSchema),
+      issuedAt: external_exports.number().int().nonnegative(),
+      expiresAt: external_exports.number().int().positive().optional(),
+      maxUses: external_exports.number().int().positive().optional(),
+      usedCount: external_exports.number().int().nonnegative(),
+      /**
+       * guest 在 auth 帧捎带 selfPrincipalId 时由 AuthGate.authenticate 回写；
+       * 未被消费的 cap 此字段缺失。
+       */
+      peerOwnerId: external_exports.string().min(1).optional(),
+      /** 首次 client hello 时间戳（与 peerOwnerId 同步写入） */
+      firstUsedByPeerAt: external_exports.number().int().positive().optional(),
+      /**
+       * 对方 daemon owner 的 displayName，guest auth 帧 selfDisplayName 触发
+       * recordPeerHello 时同步回写。视角 B (2026-05-23) UI 派生联系人列表用此字段
+       * 显示对方名字（避免 fallback 到我颁 cap 时填的 displayName）。
+       */
+      peerDisplayName: external_exports.string().optional()
+    }).strict();
+    CapabilityWireSchema = CapabilitySchema.omit({ secretHash: true });
+    CapabilityErrorCodeSchema = external_exports.enum([
+      "TOKEN_INVALID",
+      "TOKEN_REVOKED",
+      "TOKEN_EXPIRED",
+      "TOKEN_EXHAUSTED"
+    ]);
+    WhoamiResponseSchema = external_exports.object({
+      type: external_exports.literal("whoami:ok"),
+      owner: external_exports.object({
+        id: external_exports.string(),
+        kind: external_exports.enum(["owner", "guest"]),
+        displayName: external_exports.string()
+      }).strict(),
+      capability: CapabilityWireSchema,
+      grantedPersonas: external_exports.array(
+        external_exports.object({
+          id: external_exports.string().min(1),
+          displayName: external_exports.string()
+        }).strict()
+      )
+    }).strict();
+    CapabilityIssueArgsSchema = external_exports.object({
+      displayName: external_exports.string().min(1),
+      grants: external_exports.array(GrantSchema),
+      expiresAt: external_exports.number().int().positive().optional(),
+      maxUses: external_exports.number().int().positive().optional()
+    }).strict();
+    CapabilityBindPeerArgsSchema = external_exports.object({
+      capabilityId: external_exports.string().min(1),
+      peerOwnerId: external_exports.string().min(1),
+      peerDisplayName: external_exports.string()
+    }).strict();
+  }
+});
+
+// ../protocol/src/inbox.ts
+var InboxMessageSchema, InboxPostMessageArgsSchema, InboxListArgsSchema, InboxMarkReadArgsSchema;
+var init_inbox = __esm({
+  "../protocol/src/inbox.ts"() {
+    "use strict";
+    init_zod();
+    InboxMessageSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      peerOwnerId: external_exports.string().min(1),
+      senderPrincipalId: external_exports.string().min(1),
+      text: external_exports.string().min(1),
+      createdAt: external_exports.number().int().nonnegative(),
+      readBy: external_exports.record(external_exports.string().min(1), external_exports.number().int().positive()).default({})
+    }).strict();
+    InboxPostMessageArgsSchema = external_exports.object({
+      peerOwnerId: external_exports.string().min(1).optional(),
+      id: external_exports.string().min(1),
+      text: external_exports.string().min(1),
+      createdAt: external_exports.number().int().nonnegative()
+    }).strict();
+    InboxListArgsSchema = external_exports.object({
+      peerOwnerId: external_exports.string().min(1),
+      sinceCreatedAt: external_exports.number().int().nonnegative().optional()
+    }).strict();
+    InboxMarkReadArgsSchema = external_exports.object({
+      peerOwnerId: external_exports.string().min(1),
+      upToCreatedAt: external_exports.number().int().nonnegative()
+    }).strict();
+  }
+});
+
+// ../protocol/src/received-capability.ts
+var ReceivedCapabilitySchema, ReceivedCapabilityWireSchema, ReceivedCapabilityAddArgsSchema, ReceivedCapabilityAddOkSchema, ReceivedCapabilityRemoveArgsSchema, ReceivedCapabilityRemoveOkSchema, ReceivedCapabilityListOkSchema, ReceivedCapabilityAutoAttachArgsSchema, ReceivedCapabilityAutoAttachOkSchema, ReceivedCapabilityAddedFrameSchema, ReceivedCapabilityRemovedFrameSchema;
+var init_received_capability = __esm({
+  "../protocol/src/received-capability.ts"() {
+    "use strict";
+    init_zod();
+    init_capability();
+    ReceivedCapabilitySchema = external_exports.object({
+      ownerPrincipalId: external_exports.string().min(1),
+      ownerDisplayName: external_exports.string(),
+      remoteUrl: external_exports.string().min(1),
+      capabilityId: external_exports.string().min(1),
+      capabilityToken: external_exports.string().min(1),
+      grants: external_exports.array(GrantSchema),
+      receivedAt: external_exports.number().int().nonnegative()
+    }).strict();
+    ReceivedCapabilityWireSchema = ReceivedCapabilitySchema;
+    ReceivedCapabilityAddArgsSchema = external_exports.object({
+      remoteUrl: external_exports.string().min(1),
+      token: external_exports.string().min(1)
+    }).strict();
+    ReceivedCapabilityAddOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:add:ok"),
+      receivedCap: ReceivedCapabilityWireSchema
+    }).strict();
+    ReceivedCapabilityRemoveArgsSchema = external_exports.object({
+      ownerPrincipalId: external_exports.string().min(1)
+    }).strict();
+    ReceivedCapabilityRemoveOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:remove:ok"),
+      ownerPrincipalId: external_exports.string().min(1)
+    }).strict();
+    ReceivedCapabilityListOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:list:ok"),
+      receivedCaps: external_exports.array(ReceivedCapabilityWireSchema)
+    }).strict();
+    ReceivedCapabilityAutoAttachArgsSchema = external_exports.object({
+      ownerPrincipalId: external_exports.string().min(1),
+      ownerDisplayName: external_exports.string(),
+      remoteUrl: external_exports.string().min(1),
+      capabilityId: external_exports.string().min(1),
+      token: external_exports.string().min(1),
+      grants: external_exports.array(GrantSchema)
+    }).strict();
+    ReceivedCapabilityAutoAttachOkSchema = external_exports.object({
+      type: external_exports.literal("received-capability:autoAttach:ok")
+    }).strict();
+    ReceivedCapabilityAddedFrameSchema = external_exports.object({
+      type: external_exports.literal("received-capability:added"),
+      receivedCap: ReceivedCapabilityWireSchema
+    }).strict();
+    ReceivedCapabilityRemovedFrameSchema = external_exports.object({
+      type: external_exports.literal("received-capability:removed"),
+      ownerPrincipalId: external_exports.string().min(1)
+    }).strict();
+  }
+});
+
 // ../protocol/src/runtime.ts
 var init_runtime = __esm({
   "../protocol/src/runtime.ts"() {
@@ -5071,6 +5281,10 @@ var init_runtime = __esm({
     init_persona_schemas();
     init_persona_mode();
     init_attachment_schemas();
+    init_principal();
+    init_capability();
+    init_inbox();
+    init_received_capability();
   }
 });
 
@@ -5345,8 +5559,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path32 = req.path;
-        _req.url = typeof path32 === "string" ? path32 : req.url ? req.url.path || req.url : void 0;
+        const path39 = req.path;
+        _req.url = typeof path39 === "string" ? path39 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -5511,14 +5725,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path32) {
+    function parsePath(path39) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path39.length; i++) {
+        const char = path39[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -5649,10 +5863,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path32 of paths) {
-        const parts = parsePath(path32);
+      for (const path39 of paths) {
+        const parts = parsePath(path39);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path32, remove);
+          redactWildcardPath(obj, parts, censor, path39, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -5737,8 +5951,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path32];
+            const wrappedCensor = typeof censor === "function" ? (value, path39) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path39];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -5773,8 +5987,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path32 of pathsToClone) {
-        const parts = parsePath(path32);
+      for (const path39 of pathsToClone) {
+        const parts = parsePath(path39);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -5826,24 +6040,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path32) {
-      if (typeof path32 !== "string") {
+    function validatePath(path39) {
+      if (typeof path39 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path32 === "") {
+      if (path39 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path32.includes("..")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path39.includes("..")) {
+        throw new Error(`Invalid redaction path (${path39})`);
       }
-      if (path32.includes(",")) {
-        throw new Error(`Invalid redaction path (${path32})`);
+      if (path39.includes(",")) {
+        throw new Error(`Invalid redaction path (${path39})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path32.length; i++) {
-        const char = path32[i];
+      for (let i = 0; i < path39.length; i++) {
+        const char = path39[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -5857,20 +6071,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path32})`);
+            throw new Error(`Invalid redaction path (${path39})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path32})`);
+        throw new Error(`Invalid redaction path (${path39})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path32 of paths) {
-        validatePath(path32);
+      for (const path39 of paths) {
+        validatePath(path39);
       }
     }
     function slowRedact(options = {}) {
@@ -6038,8 +6252,8 @@ var require_redaction = __commonJS({
         if (shape[k2] === null) {
           o[k2] = (value) => topCensor(value, [k2]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path32) => {
-            return censor(value, [k2, ...path32]);
+          const wrappedCensor = typeof censor === "function" ? (value, path39) => {
+            return censor(value, [k2, ...path39]);
           } : censor;
           o[k2] = Redact({
             paths: shape[k2],
@@ -6257,10 +6471,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs28 = require("fs");
+    var fs34 = require("fs");
     var EventEmitter2 = require("events");
     var inherits = require("util").inherits;
-    var path32 = require("path");
+    var path39 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -6314,20 +6528,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs28.mkdirSync(path32.dirname(file), { recursive: true });
-          const fd = fs28.openSync(file, flags, mode);
+          if (sonic.mkdir) fs34.mkdirSync(path39.dirname(file), { recursive: true });
+          const fd = fs34.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs28.mkdir(path32.dirname(file), { recursive: true }, (err) => {
+        fs34.mkdir(path39.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs28.open(file, flags, mode, fileOpened);
+          fs34.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs28.open(file, flags, mode, fileOpened);
+        fs34.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -6368,8 +6582,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs28.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs28.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs34.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs34.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -6378,15 +6592,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs28.writeSync(this.fd, this._writingBuf);
+            return fs34.writeSync(this.fd, this._writingBuf);
           }
-          return fs28.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs34.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs28.write(this.fd, this._writingBuf, this.release);
+            return fs34.write(this.fd, this._writingBuf, this.release);
           }
-          return fs28.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs34.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -6443,7 +6657,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs28.fsyncSync(this.fd);
+          fs34.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -6557,7 +6771,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs28.fsync(this.fd, (err) => {
+            fs34.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -6659,7 +6873,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs28.close(fd, (err) => {
+          fs34.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -6708,7 +6922,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs28.writeSync(this.fd, buf) : fs28.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs34.writeSync(this.fd, buf) : fs34.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -6724,7 +6938,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs28.fsyncSync(this.fd);
+        fs34.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -6745,7 +6959,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs28.writeSync(this.fd, buf);
+          const n = fs34.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -6773,13 +6987,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs28.writeSync(this.fd, this._writingBuf) : fs28.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs34.writeSync(this.fd, this._writingBuf) : fs34.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs28.write(this.fd, this._writingBuf, release);
+        fs34.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -6788,7 +7002,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs28.writeSync(this.fd, this._writingBuf);
+          const written = fs34.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -6797,7 +7011,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs28.write(this.fd, this._writingBuf, release);
+        fs34.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -6813,12 +7027,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs28.fsync(sonic.fd, closeWrapped);
+        fs34.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs28.close(sonic.fd, done);
+          fs34.close(sonic.fd, done);
         } else {
           done();
         }
@@ -7075,7 +7289,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Worker } = require("worker_threads");
-    var { join: join4 } = require("path");
+    var { join: join11 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -7111,7 +7325,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join4(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join11(__dirname, "lib", "worker.js");
       const worker = new Worker(toExecute, {
         ...opts.workerOpts,
         trackUnmanagedFds: false,
@@ -7497,7 +7711,7 @@ var require_transport = __commonJS({
     "use strict";
     var { createRequire } = require("module");
     var getCallers = require_caller();
-    var { join: join4, isAbsolute, sep } = require("path");
+    var { join: join11, isAbsolute, sep: sep2 } = require("path");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
     var ThreadStream = require_thread_stream();
@@ -7560,7 +7774,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -7578,7 +7792,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join4(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -7600,12 +7814,12 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join4(__dirname, "..", "file.js");
+          return join11(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
           try {
-            const context = filePath === "node:repl" ? process.cwd() + sep : filePath;
+            const context = filePath === "node:repl" ? process.cwd() + sep2 : filePath;
             fixTarget2 = createRequire(context).resolve(origin);
             break;
           } catch (err) {
@@ -8590,7 +8804,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join4 = ",";
+            let join11 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -8604,7 +8818,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join4 = `,
+                join11 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8612,13 +8826,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join4;
+                res += join11;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8639,7 +8853,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join4 = `,
+              join11 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8653,13 +8867,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join4;
+                separator = join11;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join4;
+              separator = join11;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -8700,7 +8914,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join4 = ",";
+            let join11 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -8713,7 +8927,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join4 = `,
+                join11 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -8721,13 +8935,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join4;
+                res += join11;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join4}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -8740,7 +8954,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join4 = `,
+              join11 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -8749,7 +8963,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join4;
+                separator = join11;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -8807,20 +9021,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join5 = `,
+              const join12 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join5;
+                res2 += join12;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join5}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join12}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -8836,16 +9050,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join4 = `,
+            const join11 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join4, maximumBreadth);
+              res += stringifyTypedArray(value, join11, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join4;
+              separator = join11;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -8856,13 +9070,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join4;
+                separator = join11;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join4;
+              separator = join11;
             }
             if (separator !== "") {
               res = `
@@ -9953,11 +10167,11 @@ var init_lib = __esm({
           }
         }
       },
-      addToPath: function addToPath(path32, added, removed, oldPosInc, options) {
-        var last = path32.lastComponent;
+      addToPath: function addToPath(path39, added, removed, oldPosInc, options) {
+        var last = path39.lastComponent;
         if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path39.oldPos + oldPosInc,
             lastComponent: {
               count: last.count + 1,
               added,
@@ -9967,7 +10181,7 @@ var init_lib = __esm({
           };
         } else {
           return {
-            oldPos: path32.oldPos + oldPosInc,
+            oldPos: path39.oldPos + oldPosInc,
             lastComponent: {
               count: 1,
               added,
@@ -10025,7 +10239,7 @@ var init_lib = __esm({
       tokenize: function tokenize(value) {
         return Array.from(value);
       },
-      join: function join3(chars) {
+      join: function join4(chars) {
         return chars.join("");
       },
       postProcess: function postProcess(changeObjects) {
@@ -10398,10 +10612,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path39 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const entry = { path: path32, content };
+      if (!path39 || content == null) return null;
+      const entry = { path: path39, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m2) => m2 !== null);
@@ -10861,6 +11075,27 @@ var init_claude_history = __esm({
   }
 });
 
+// src/tools/sandbox.ts
+function shouldSandbox(cwd, personaRoot) {
+  if (!personaRoot) return false;
+  const sep2 = personaRoot.endsWith(path12.sep) ? "" : path12.sep;
+  return cwd.startsWith(personaRoot + sep2) && cwd !== personaRoot;
+}
+function inferSandboxSettingsPath(cwd, personaRoot) {
+  if (!shouldSandbox(cwd, personaRoot)) return null;
+  const rel = path12.relative(personaRoot, cwd);
+  const personaId = rel.split(path12.sep)[0];
+  if (!personaId) return null;
+  return path12.join(personaRoot, personaId, ".clawd", "sandbox-settings.json");
+}
+var path12;
+var init_sandbox = __esm({
+  "src/tools/sandbox.ts"() {
+    "use strict";
+    path12 = __toESM(require("path"), 1);
+  }
+});
+
 // src/tools/claude.ts
 function macOSDesktopCandidates(home) {
   return [
@@ -10910,7 +11145,7 @@ function buildSpawnArgs(ctx) {
   ];
   if (ctx.model) args.push("--model", ctx.model);
   switch (ctx.personaMode) {
-    case "listener":
+    case "guest":
       args.push("--setting-sources", "project,local");
       break;
     case "owner":
@@ -10925,7 +11160,8 @@ function buildSpawnArgs(ctx) {
       throw new Error(`unexpected personaMode: ${String(_exhaustive)}`);
     }
   }
-  if (ctx.extraSettings) args.push("--settings", ctx.extraSettings);
+  const sandboxSettings = ctx.extraSettings ?? inferSandboxSettingsPath(ctx.cwd, ctx.personaRoot);
+  if (sandboxSettings) args.push("--settings", sandboxSettings);
   if (ctx.extraSystemPrompt) args.push("--append-system-prompt", ctx.extraSystemPrompt);
   if (ctx.effort) args.push("--effort", ctx.effort);
   if (ctx.toolSessionId) args.push("--resume", ctx.toolSessionId);
@@ -11205,10 +11441,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m2) => {
       if (!m2 || typeof m2 !== "object") return null;
       const rec = m2;
-      const path32 = typeof rec.path === "string" ? rec.path : null;
+      const path39 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path32 || content == null) return null;
-      const out = { path: path32, content };
+      if (!path39 || content == null) return null;
+      const out = { path: path39, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m2) => m2 !== null);
@@ -11324,6 +11560,7 @@ var init_claude = __esm({
     init_protocol();
     init_claude_history();
     init_tool_result_extra();
+    init_sandbox();
     ATTACHMENT_SILENT_SUBTYPES2 = /* @__PURE__ */ new Set([
       "hook_additional_context",
       "hook_success",
@@ -18706,7 +18943,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash3 } = require("crypto");
     var { Duplex, Readable: Readable3 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -19236,7 +19473,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes2(16).toString("base64");
       const request = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -19366,7 +19603,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -19733,7 +19970,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash } = require("crypto");
+    var { createHash: createHash3 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -20034,7 +20271,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -20653,6 +20890,9 @@ function createLogger(opts = {}) {
   return wrap(base);
 }
 
+// src/session/store-factory.ts
+var path5 = __toESM(require("path"), 1);
+
 // src/session/store.ts
 var import_node_fs3 = __toESM(require("fs"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
@@ -20661,10 +20901,14 @@ init_protocol();
 // src/session/scope.ts
 var import_node_path3 = __toESM(require("path"), 1);
 function scopeKey(scope) {
-  return scope.kind === "default" ? "default" : `persona:${scope.personaId}:${scope.mode}`;
+  if (scope.kind === "default") return "default";
+  if (scope.mode === "guest") return `persona:${scope.personaId}:guest:${scope.capId}`;
+  return `persona:${scope.personaId}:${scope.mode}`;
 }
 function scopeSubPath(scope) {
-  return scope.kind === "default" ? ["default"] : [scope.personaId, scope.mode];
+  if (scope.kind === "default") return ["default"];
+  if (scope.mode === "guest") return [scope.personaId, "guests", scope.capId];
+  return [scope.personaId, scope.mode];
 }
 function metaFromScope(scope, personaRoot) {
   if (scope.kind === "default") return void 0;
@@ -20673,10 +20917,18 @@ function metaFromScope(scope, personaRoot) {
   }
   return {
     idleKillEnabled: true,
-    personaMode: "listener",
+    personaMode: "guest",
     extraSettings: import_node_path3.default.join(personaRoot, scope.personaId, ".clawd", "sandbox-settings.json")
   };
 }
+function scopeForFile(file, ownerPrincipalId) {
+  if (!file.ownerPersonaId) return { kind: "default" };
+  const creator = file.creatorPrincipalId;
+  if (ownerPrincipalId && creator && creator !== ownerPrincipalId) {
+    return { kind: "persona", personaId: file.ownerPersonaId, mode: "guest", capId: creator };
+  }
+  return { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" };
+}
 
 // src/session/store.ts
 function safeFileName(sessionId) {
@@ -20690,12 +20942,16 @@ function safeFileName(sessionId) {
 var SessionStore = class {
   root;
   constructor(opts) {
-    const scope = opts.scope ?? { kind: "default" };
-    this.root = import_node_path4.default.join(
-      opts.dataDir,
-      "sessions",
-      ...scopeSubPath(scope).map(safeFileName)
-    );
+    if ("root" in opts) {
+      this.root = opts.root;
+    } else {
+      const scope = opts.scope ?? { kind: "default" };
+      this.root = import_node_path4.default.join(
+        opts.dataDir,
+        "sessions",
+        ...scopeSubPath(scope).map(safeFileName)
+      );
+    }
   }
   filePath(sessionId) {
     return import_node_path4.default.join(this.root, `${safeFileName(sessionId)}.json`);
@@ -20760,6 +21016,66 @@ var SessionStore = class {
   }
 };
 
+// src/session/store-factory.ts
+var SessionStoreFactory = class {
+  dataDir;
+  bareStore = null;
+  vmOwnerStores = /* @__PURE__ */ new Map();
+  // vmGuest 索引 key = `${pid}::${capId}`（按 cap.id 隔离，一张 cap 一个目录）
+  vmGuestStores = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dataDir = opts.dataDir;
+  }
+  // ---- root path 派生（暴露给 migration / revoke cascade 等外部消费方） ----
+  bareRoot() {
+    return path5.join(this.dataDir, "sessions");
+  }
+  vmOwnerRoot(personaId) {
+    return path5.join(
+      this.dataDir,
+      "personas",
+      safeFileName(personaId),
+      ".clawd",
+      "sessions",
+      "owner"
+    );
+  }
+  vmGuestRoot(personaId, capId) {
+    return path5.join(
+      this.dataDir,
+      "personas",
+      safeFileName(personaId),
+      ".clawd",
+      "sessions",
+      "guests",
+      safeFileName(capId)
+    );
+  }
+  // ---- SessionStore 工厂（缓存） ----
+  forBare() {
+    if (!this.bareStore) {
+      this.bareStore = new SessionStore({ root: this.bareRoot() });
+    }
+    return this.bareStore;
+  }
+  forVmOwner(personaId) {
+    const key = personaId;
+    const cached = this.vmOwnerStores.get(key);
+    if (cached) return cached;
+    const st = new SessionStore({ root: this.vmOwnerRoot(personaId) });
+    this.vmOwnerStores.set(key, st);
+    return st;
+  }
+  forVmGuest(personaId, capId) {
+    const key = `${personaId}::${capId}`;
+    const cached = this.vmGuestStores.get(key);
+    if (cached) return cached;
+    const st = new SessionStore({ root: this.vmGuestRoot(personaId, capId) });
+    this.vmGuestStores.set(key, st);
+    return st;
+  }
+};
+
 // src/session/manager.ts
 var import_node_fs5 = __toESM(require("fs"), 1);
 var import_node_path6 = __toESM(require("path"), 1);
@@ -20881,7 +21197,7 @@ function cloneState(s) {
     pendingSend: s.pendingSend
   };
 }
-var IDLE_KILL_DELAY_MS = 5e3;
+var IDLE_KILL_DELAY_MS = 6e4;
 var SEEN_UUID_CAP = 2e3;
 function applyEventBatch(state, events, deps) {
   if (events.length === 0) return { state, effects: [] };
@@ -20921,7 +21237,10 @@ function buildSpawnContext(state, deps) {
     toolSessionId: file.toolSessionId,
     model: file.model,
     permissionMode: file.permissionMode,
-    effort: file.effort
+    effort: file.effort,
+    // Phase 2 capability platform (plan §3): personaRoot 透传给 buildSpawnArgs;
+    // 内部 shouldSandbox(cwd, personaRoot) 决定是否注入 --settings sandbox-settings.
+    personaRoot: deps.personaRoot
   };
   const meta = state.subSessionMeta;
   if (meta?.personaMode) {
@@ -21706,6 +22025,7 @@ var SessionRunner = class {
       resolveContextWindow: this.hooks.resolveContextWindow,
       genUuid: this.hooks.genUuid ?? v4_default,
       ownerDisplayName: this.hooks.ownerDisplayName,
+      personaRoot: this.hooks.personaRoot,
       mode: this.hooks.mode ?? "sdk"
     };
     const { state, effects } = reduceSession(this.state, inputMsg, deps);
@@ -22137,9 +22457,18 @@ var SessionManager = class {
   attachObserver(observer) {
     this.attachedObserver = observer;
   }
-  // 按 scope 拿对应的 SessionStore。default scope 复用 deps.store（保证与
-  // bootstrap 注入的 store 一致）；persona scope 第一次访问时按需创建并缓存。
+  // 按 scope 拿对应的 SessionStore.
+  // Phase 2 (capability platform plan §1) 路由切到 SessionStoreFactory:
+  //   default              → factory.forBare()                  <dataDir>/sessions/
+  //   persona/<pid>/owner  → factory.forVmOwner(pid)            <dataDir>/personas/<pid>/.clawd/sessions/owner/
+  //   persona/<pid>/guest  → factory.forVmGuest(pid, capId)     <dataDir>/personas/<pid>/.clawd/sessions/guests/<capId>/
+  // 缺省 (无 factory 注入): 回退 dataDir+scope 老路径 (向后兼容旧 spec).
   storeFor(scope) {
+    if (this.deps.storeFactory) {
+      if (scope.kind === "default") return this.deps.storeFactory.forBare();
+      if (scope.mode === "owner") return this.deps.storeFactory.forVmOwner(scope.personaId);
+      return this.deps.storeFactory.forVmGuest(scope.personaId, scope.capId);
+    }
     if (scope.kind === "default") return this.deps.store;
     const key = scopeKey(scope);
     const cached = this.storesByScope.get(key);
@@ -22159,19 +22488,18 @@ var SessionManager = class {
     this.capabilitiesCache.set(tool, caps);
     return caps;
   }
-  // 由 SessionFile.ownerPersonaId schema 字段推回写入 scope。
-  // ownerPersonaId 由 create({ownerPersonaId}) 在 schema 落盘时记入，永远只反映
-  // session 出身（不可变）；此函数只用于 SessionStore 的写入路由，不参与运行时行为
-  // 决策（personaMode='owner' 等由路径 → scope → metaFromScope 派生）。
-  // 仅覆盖 owner + default 两类——listener sub-session 不会从 default RPC 路径进来。
+  // 由 SessionFile 反推 scope 的 thin wrapper —— 决策矩阵收敛到 scope.scopeForFile
+  // free function（scope.spec.ts transition 表驱动测试），manager 只负责注入 deps.
   scopeForFile(file) {
-    return file.ownerPersonaId ? { kind: "persona", personaId: file.ownerPersonaId, mode: "owner" } : { kind: "default" };
+    return scopeForFile(file, this.deps.ownerPrincipalId);
   }
-  // 扫 <dataDir>/sessions/ 列出所有 persona 命名空间（不含 'default'）。
-  // 用于 findOwnedSession / listAllOwned 跨 scope 查询。
+  // 扫所有 persona 命名空间. 用于 findOwnedSession / listAllOwned 跨 scope 查询.
+  // Phase 2 capability platform: 新布局下 persona 资产在 <dataDir>/personas/<pid>/,
+  // 直接 readdir 这个目录拿所有 personaId. 老布局 (无 storeFactory) fallback 扫
+  // <dataDir>/sessions/ 列子目录 (排除 'default').
   listPersonaIdsOnDisk() {
     if (!this.deps.dataDir) return [];
-    const root = import_node_path6.default.join(this.deps.dataDir, "sessions");
+    const root = this.deps.storeFactory ? import_node_path6.default.join(this.deps.dataDir, "personas") : import_node_path6.default.join(this.deps.dataDir, "sessions");
     let entries;
     try {
       entries = import_node_fs5.default.readdirSync(root, { withFileTypes: true });
@@ -22182,13 +22510,37 @@ var SessionManager = class {
     }
     return entries.filter((e) => e.isDirectory() && e.name !== "default").map((e) => e.name);
   }
-  // owner / default 两个分类下按 sessionId 找文件——前端只传 sessionId 不带 scope，
-  // SessionManager 在这里定位。三层快慢路径：
+  // 扫某 persona 下 guests/ 子目录, 拿所有 capId.
+  // 路径: <dataDir>/personas/<pid>/.clawd/sessions/guests/<capId>/
+  // 只在 storeFactory 注入 (新布局) 下生效, 老布局无 guest 目录.
+  listGuestCapIdsForPersona(personaId) {
+    if (!this.deps.dataDir || !this.deps.storeFactory) return [];
+    const root = import_node_path6.default.join(
+      this.deps.dataDir,
+      "personas",
+      personaId,
+      ".clawd",
+      "sessions",
+      "guests"
+    );
+    let entries;
+    try {
+      entries = import_node_fs5.default.readdirSync(root, { withFileTypes: true });
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      throw err;
+    }
+    return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+  }
+  // owner / default + persona guests 三大分类下按 sessionId 找文件——前端只传 sessionId 不带 scope，
+  // SessionManager 在这里定位。四层快慢路径：
   //   1) active runner（用户当前在用的 session）：runner.state.file 是 SessionFile 内存权威副本，
   //      直接返回，零磁盘 I/O。覆盖 attachment / file-sharing 等"用户操作 → 紧接着 RPC"的
   //      绝大多数场景
   //   2) default scope 磁盘：inactive default session 命中
   //   3) 所有 persona owner 目录扫盘：inactive persona owner session 命中
+  //   4) 每个 persona 的 guests/<capId>/ 扫盘：guest 通过我颁发 token 接进来创建的 session
   // listener sub-session 不走这条——transport 始终明确传 (personaId, sessionId)。
   //
   // 公开方法：attachment / file-sharing handler 通过 deps 闭包消费，不应直接持 SessionStore
@@ -22200,8 +22552,13 @@ var SessionManager = class {
     if (dflt) return dflt;
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
-      const file = ownerStore.read(sessionId);
-      if (file) return file;
+      const found = ownerStore.read(sessionId);
+      if (found) return found;
+      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
+        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
+        const g2 = guestStore.read(sessionId);
+        if (g2) return g2;
+      }
     }
     return null;
   }
@@ -22212,30 +22569,40 @@ var SessionManager = class {
     const file = this.findOwnedSession(sessionId);
     return file ? this.scopeForFile(file) : null;
   }
-  // 合并 default + 所有 persona owner 的 SessionFile —— 桌面 App 主 session 列表入口。
-  // 同样不含 listener sub-session（listener 走 persona:listSubSessions RPC 单独入口）。
+  // 合并 default + 每个 persona 的 owner/ + guests/<capId>/ —— 桌面 App 主 session 列表入口.
+  // guest sessions 由 handlers/session.ts list 处按 ctx.principal.kind === 'guest' 做权限过滤
+  // (creatorPrincipalId === capId), 这里仅负责数据源汇总.
+  // listener sub-session 不走这条（listener 走 persona:listSubSessions RPC 单独入口）。
   listAllOwned() {
     const out = [];
     out.push(...this.deps.store.list());
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
       out.push(...ownerStore.list());
+      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
+        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
+        out.push(...guestStore.list());
+      }
     }
     return out.sort(
       (a, b2) => a.updatedAt > b2.updatedAt ? -1 : a.updatedAt < b2.updatedAt ? 1 : 0
     );
   }
-  // 写回 SessionFile，自动根据 ownerPersonaId 派生写入 scope。
-  // 调用方原先都是 `deps.store.write(updated)`，全部走这里收口路由。
+  // 写回 SessionFile，自动根据 ownerPersonaId / creatorPrincipalId 派生写入 scope.
+  // 调用方原先都是 `deps.store.write(updated)`，全部走这里收口路由.
   writeOwned(file) {
     return this.storeFor(this.scopeForFile(file)).write(file);
   }
-  // 删除 owned SessionFile（default 或 persona/owner），与 findOwnedSession 对称扫盘。
+  // 删除 owned SessionFile（default / persona owner / persona guest），与 findOwnedSession 对称扫盘.
   deleteOwned(sessionId) {
     if (this.deps.store.delete(sessionId)) return true;
     for (const personaId of this.listPersonaIdsOnDisk()) {
       const ownerStore = this.storeFor({ kind: "persona", personaId, mode: "owner" });
       if (ownerStore.delete(sessionId)) return true;
+      for (const capId of this.listGuestCapIdsForPersona(personaId)) {
+        const guestStore = this.storeFor({ kind: "persona", personaId, mode: "guest", capId });
+        if (guestStore.delete(sessionId)) return true;
+      }
     }
     return false;
   }
@@ -22243,8 +22610,8 @@ var SessionManager = class {
   // 经过 compressFrameForWire 后决定是 push collector 还是走 deps.broadcastFrame。
   // scope 决定两件事：SessionStore 路由 + SubSessionMeta 派生（metaFromScope）。
   //   - default → 复用 deps.store，无 subSessionMeta（普通 session）
-  //   - persona/owner → <dataDir>/sessions/<personaId>/owner/，meta={idleKillEnabled:false, personaMode:'owner'}
-  //   - persona/listener → <dataDir>/sessions/<personaId>/listener/，meta={idleKillEnabled:true, personaMode:'listener', extraSettings:<sandbox>}
+  //   - persona/owner → personas/<pid>/.clawd/sessions/owner/，meta={idleKillEnabled:false, personaMode:'owner'}
+  //   - persona/guest → personas/<pid>/.clawd/sessions/guests/<capId>/，meta={idleKillEnabled:true, personaMode:'guest', extraSettings:<sandbox>}
   newRunner(file, scope) {
     const adapter = this.deps.getAdapter(file.tool ?? "claude");
     const store = this.storeFor(scope);
@@ -22263,6 +22630,9 @@ var SessionManager = class {
       dataDir: this.deps.dataDir,
       personaStore: this.deps.personaStore,
       ownerDisplayName: this.deps.ownerDisplayName,
+      // Phase 2 capability platform (plan §3): 透传 personaRoot, buildSpawnArgs 据
+      // cwd 是否在 personaRoot 下自动决定是否注入 --settings sandbox-settings.json.
+      personaRoot: this.deps.personaRoot,
       // 透传给 ReducerDeps.mode：reducer send !procAlive spawn 路径据此判断要不要把
       // readyForSend 翻 false（TUI 翻 false 让 user_text 走 pendingSend 暂存；SDK 不动保持直写）
       mode: this.deps.mode,
@@ -22360,7 +22730,7 @@ var SessionManager = class {
     }
   }
   // ---- 命令方法：均返回 { response, broadcast[] }，由 dispatcher 聚合 ----
-  create(args) {
+  create(args, creatorPrincipalId) {
     let cwd;
     if (args.ownerPersonaId) {
       cwd = derivePersonaSpawnCwd(
@@ -22401,10 +22771,11 @@ var SessionManager = class {
       iconKey: args.iconKey,
       forkedFromSessionId: args.forkedFromSessionId,
       ownerPersonaId: args.ownerPersonaId,
+      creatorPrincipalId,
       createdAt: iso,
       updatedAt: iso
     };
-    const scope = args.ownerPersonaId ? { kind: "persona", personaId: args.ownerPersonaId, mode: "owner" } : { kind: "default" };
+    const scope = this.scopeForFile(file);
     const written = this.storeFor(scope).write(file);
     return { response: written, broadcast: [] };
   }
@@ -22845,28 +23216,18 @@ var SessionManager = class {
     this.runners.set(file.sessionId, r);
     return r;
   }
-  // ---------------- persona / listener sub-session 专用 API ----------------
+  // ---------------- scope-explicit sub-session API ----------------
   //
-  // PersonaManager 是 SessionManager 之上的薄编排层，listener sub-session 的持久化
-  // （SessionFile）仍由 SessionManager 持有。区别于普通 / owner session：
-  //   - SessionFile 落到 <dataDir>/sessions/<personaId>/listener/（拓扑分类）
-  //   - reducer state.subSessionMeta.idleKillEnabled = true（turn_end 自动 idle-kill）
-  //   - sessionId 由 PersonaManager 派生（personaId-<tokenHash>），不走自动 newSessionId
+  // 区别于 owner / default 单 sessionId 入口，这些 API 接 SessionScope 参数 ——
+  // 调用方（PersonaManager / observer 等）明确传 scope，由 storeFor 路由到正确目录:
+  //   - {kind:'persona', personaId, mode:'guest', capId} → guests/<capId>/，meta={idleKill:true, sandbox}
+  //   - {kind:'persona', personaId, mode:'owner'}       → owner/，meta={idleKill:false}
   //
-  // 这些 API 接 SessionScope 参数（不再是单参 agentId）—— transport 始终明确传
-  // {kind:'persona', personaId, mode:'listener'}，与 owner / default 分类隔离。
+  // SubSessionMeta 由 scope → metaFromScope 派生，不进 SessionFile schema。
   /** 按 scope 读取 SessionFile；不存在返回 null */
   readForScope(sessionId, scope) {
     return this.storeFor(scope).read(sessionId);
   }
-  /**
-   * 列出指定 persona 在指定 mode 下的所有 SessionFile。
-   * persona:listSubSessions RPC 入口（mode='listener'）；
-   * 路径下还未写过任何 session 时 list() 返回空数组（SessionStore.list 内部 ENOENT 处理）
-   */
-  listPersonaSessions(personaId, mode) {
-    return this.storeFor({ kind: "persona", personaId, mode }).list();
-  }
   /**
    * 创建 sub-session 的 SessionFile + 准备 runner（不 spawn）。
    * SubSessionMeta 不进 SessionFile schema，运行时由 scope → metaFromScope 派生。
@@ -23011,7 +23372,7 @@ var SessionManager = class {
     return { response: { ok: true }, broadcast };
   }
   /**
-   * 改 SessionFile.label（用于 listener-bound chat:rename RPC）。
+   * 改 SessionFile.label（scope-explicit sub-session 重命名入口）。
    * 不存在抛 SESSION_NOT_FOUND。
    */
   renameForScope(args) {
@@ -23026,7 +23387,7 @@ var SessionManager = class {
     store.write({ ...file, label: args.label });
   }
   /**
-   * 删除 listener-scope sub-session（用于 chat:delete RPC）。
+   * 删除 scope-explicit sub-session。
    * - 若 runner 存在：走 reducer 'delete' command 收尾（SIGKILL + 文件 unlink + broadcast）
    * - 若 runner 不存在：直接删 scope store 文件 + 广播 session:deleted
    * 不存在抛 SESSION_NOT_FOUND。
@@ -23297,7 +23658,7 @@ var SessionManager = class {
 
 // src/persona/store.ts
 var fs6 = __toESM(require("fs"), 1);
-var path7 = __toESM(require("path"), 1);
+var path8 = __toESM(require("path"), 1);
 init_protocol();
 var DEFAULT_SETTINGS = {
   permissions: {
@@ -23326,13 +23687,13 @@ var PersonaStore = class {
   }
   root;
   personaDir(personaId) {
-    return path7.join(this.root, safeFileName(personaId));
+    return path8.join(this.root, safeFileName(personaId));
   }
   metaPath(personaId) {
-    return path7.join(this.personaDir(personaId), ".clawd", "persona.json");
+    return path8.join(this.personaDir(personaId), ".clawd", "persona.json");
   }
   claudeMdPath(personaId) {
-    return path7.join(this.personaDir(personaId), "CLAUDE.md");
+    return path8.join(this.personaDir(personaId), "CLAUDE.md");
   }
   /**
    * Sandbox settings 落盘路径 —— 故意放在 `.clawd/` 而不是 `.claude/`，让 CC 的
@@ -23342,11 +23703,11 @@ var PersonaStore = class {
    * 加载 persona 人格，只有 listener 多一层 OS sandbox。
    */
   sandboxSettingsPath(personaId) {
-    return path7.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
+    return path8.join(this.personaDir(personaId), ".clawd", "sandbox-settings.json");
   }
   write(persona, personality) {
     const dir = this.personaDir(persona.personaId);
-    fs6.mkdirSync(path7.join(dir, ".clawd"), { recursive: true });
+    fs6.mkdirSync(path8.join(dir, ".clawd"), { recursive: true });
     this.atomicWrite(this.claudeMdPath(persona.personaId), personality);
     this.atomicWrite(
       this.sandboxSettingsPath(persona.personaId),
@@ -23364,6 +23725,10 @@ var PersonaStore = class {
     const p2 = this.metaPath(personaId);
     if (!fs6.existsSync(p2)) return null;
     const raw = JSON.parse(fs6.readFileSync(p2, "utf8"));
+    if (raw && typeof raw === "object" && "tokenMap" in raw) {
+      delete raw.tokenMap;
+      this.atomicWrite(p2, JSON.stringify(raw, null, 2));
+    }
     return PersonaFileSchema.parse(raw);
   }
   has(personaId) {
@@ -23389,14 +23754,14 @@ var PersonaStore = class {
   }
   /** Persona 私有 skills 目录路径：<personaDir>/.claude/skills */
   skillsDir(personaId) {
-    return path7.join(this.personaDir(personaId), ".claude", "skills");
+    return path8.join(this.personaDir(personaId), ".claude", "skills");
   }
   /**
    * Claude Code 项目级 settings 路径：`<personaDir>/.claude/settings.json`。
    * 这里只读 `enabledPlugins` 字段，由 owner 通过 CC `/plugin` 之类命令维护，daemon 不写。
    */
   claudeSettingsPath(personaId) {
-    return path7.join(this.personaDir(personaId), ".claude", "settings.json");
+    return path8.join(this.personaDir(personaId), ".claude", "settings.json");
   }
   /**
    * 读取 persona 的 `.claude/settings.json` 中 `enabledPlugins` map，把 value === true
@@ -23430,7 +23795,7 @@ var PersonaStore = class {
   list() {
     if (!fs6.existsSync(this.root)) return [];
     return fs6.readdirSync(this.root).filter((name) => {
-      return fs6.existsSync(path7.join(this.root, name, ".clawd", "persona.json"));
+      return fs6.existsSync(path8.join(this.root, name, ".clawd", "persona.json"));
     });
   }
   remove(personaId) {
@@ -23455,12 +23820,19 @@ var PersonaRegistry = class {
   }
   store;
   cache = /* @__PURE__ */ new Map();
-  /** 从 store 全量重建缓存（boot 时 + 测试 setup 时） */
+  /**
+   * 从 store 全量重建缓存（boot 时 + 测试 setup 时）。
+   * 单个 persona 读失败（损坏的 persona.json / schema 不匹配）不应阻塞 daemon 启动 ——
+   * try/catch 隔离，让其它 persona 仍能加载。
+   */
   reload() {
     this.cache.clear();
     for (const id of this.store.list()) {
-      const p2 = this.store.read(id);
-      if (p2) this.cache.set(p2.personaId, p2);
+      try {
+        const p2 = this.store.read(id);
+        if (p2) this.cache.set(p2.personaId, p2);
+      } catch {
+      }
     }
   }
   get(personaId) {
@@ -23476,21 +23848,6 @@ var PersonaRegistry = class {
   list() {
     return Array.from(this.cache.values());
   }
-  /**
-   * file-sharing HTTP auth-context 用的逆向查表：只有 Bearer token，没有 personaId。
-   * 线性扫所有 persona.tokenMap 找到第一条 ok 命中的；revoked / non-public persona 跳过。
-   * persona 数量通常 < 100，性能可忽略。
-   */
-  findByToken(token) {
-    if (!token) return null;
-    for (const persona of this.cache.values()) {
-      if (!persona.public) continue;
-      const entry = persona.tokenMap?.[token];
-      if (!entry || entry.revoked) continue;
-      return { personaId: persona.personaId, label: entry.label };
-    }
-    return null;
-  }
 };
 
 // src/persona/manager.ts
@@ -23784,9 +24141,6 @@ var PersonaManager = class {
       model: args.model,
       public: args.public ?? false,
       iconKey: args.iconKey,
-      // 初始化空 token 集合；后续由 issueToken / revokeToken 维护，
-      // file-sharing HTTP Bearer 鉴权用 PersonaRegistry.findByToken 反查
-      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -23836,52 +24190,22 @@ var PersonaManager = class {
   }
   /**
    * 删除 persona。
-   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录。
+   * PersonaStore.remove(personaId) 已级联删除整个 <personaRoot>/<personaId>/ 目录,
+   * Phase 2 capability platform 新布局下含 .clawd/sessions/owner/ +
+   * .clawd/sessions/guests/<capId>/, rmSync recursive force 一锅清.
+   *
+   * ⚠️ TODO (Phase 3+ design gap, reviewer P1 flagged):
+   * ~/.clawd/capabilities.json 里若有 cap.grants 含本 personaId, grant 会变成
+   * 悬空引用 (guest 仍能持 token 接入, 但调依赖该 persona 的 RPC 会 fail).
+   * 选项: (A) 这里扫所有 cap 过滤掉该 personaId 的 grant; (B) revoke 所有 grant
+   * 含该 personaId 的 cap. 当前因 cleanupGuestSessionsForCapability 用 rmSync
+   * force=true 吞 ENOENT 不会 crash, 但 UI CapabilityManagerDrawer 会展示
+   * "无效的 persona" grant. Phase 3 加 cross-reference 矩阵后正式实现.
    */
   delete(personaId) {
     this.deps.store.remove(personaId);
     this.deps.registry.remove(personaId);
   }
-  /**
-   * 生成 32-char base64url token 并写入 tokenMap，给 file-sharing HTTP Bearer
-   * 鉴权用（PersonaRegistry.findByToken 反查 personaId/label）。
-   */
-  issueToken(personaId, label) {
-    const existing = this.deps.registry.get(personaId);
-    if (!existing) throw new Error(`persona not found: ${personaId}`);
-    const token = import_node_crypto3.default.randomBytes(24).toString("base64url");
-    const entry = {
-      label,
-      issuedAt: Date.now(),
-      revoked: false
-    };
-    const updated = {
-      ...existing,
-      tokenMap: { ...existing.tokenMap ?? {}, [token]: entry },
-      updatedAt: Date.now()
-    };
-    this.deps.store.writeMeta(updated);
-    this.deps.registry.set(updated);
-    return { token, persona: updated };
-  }
-  /** 标记 token 为 revoked（保留条目用于审计）；不存在的 token 抛错。 */
-  revokeToken(personaId, token) {
-    const existing = this.deps.registry.get(personaId);
-    if (!existing) throw new Error(`persona not found: ${personaId}`);
-    const tokenEntry = existing.tokenMap?.[token];
-    if (!tokenEntry) throw new Error(`token not found in persona ${personaId}`);
-    const updated = {
-      ...existing,
-      tokenMap: {
-        ...existing.tokenMap ?? {},
-        [token]: { ...tokenEntry, revoked: true }
-      },
-      updatedAt: Date.now()
-    };
-    this.deps.store.writeMeta(updated);
-    this.deps.registry.set(updated);
-    return updated;
-  }
   /**
    * label 转 4-16 char slug。优先用 `persona-<slug>`；若 slug 已被占用，追加 4 char
    * base64url 随机后缀直到不撞为止（最多 5 次，理论冲突 ≈ 2^-24，留个 panic 上限）。
@@ -23901,7 +24225,7 @@ var PersonaManager = class {
 
 // src/persona/seed.ts
 var fs8 = __toESM(require("fs"), 1);
-var path9 = __toESM(require("path"), 1);
+var path10 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var import_meta = {};
 var DEFAULT_PERSONAS = [
@@ -23937,14 +24261,14 @@ var DEFAULT_PERSONAS = [
 function findDefaultsRoot() {
   const candidates = [];
   try {
-    const here = path9.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-    candidates.push(path9.resolve(here, "defaults"));
-    candidates.push(path9.resolve(here, "persona-defaults"));
+    const here = path10.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
+    candidates.push(path10.resolve(here, "defaults"));
+    candidates.push(path10.resolve(here, "persona-defaults"));
   } catch {
   }
   if (process.argv[1]) {
-    const argvDir = path9.dirname(process.argv[1]);
-    candidates.push(path9.resolve(argvDir, "persona-defaults"));
+    const argvDir = path10.dirname(process.argv[1]);
+    candidates.push(path10.resolve(argvDir, "persona-defaults"));
   }
   for (const c of candidates) {
     try {
@@ -23961,7 +24285,7 @@ function seedDefaultPersonas(args) {
       args.logger.info("persona.seed.skip", { personaId: entry.personaId, reason: "exists" });
       continue;
     }
-    const bundleDir = path9.join(args.defaultsRoot, entry.personaId);
+    const bundleDir = path10.join(args.defaultsRoot, entry.personaId);
     if (!fs8.existsSync(bundleDir)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -23970,7 +24294,7 @@ function seedDefaultPersonas(args) {
       });
       continue;
     }
-    const claudeMdPath = path9.join(bundleDir, "CLAUDE.md");
+    const claudeMdPath = path10.join(bundleDir, "CLAUDE.md");
     if (!fs8.existsSync(claudeMdPath)) {
       args.logger.warn("persona.seed.skip", {
         personaId: entry.personaId,
@@ -23987,7 +24311,6 @@ function seedDefaultPersonas(args) {
       model: entry.model,
       public: entry.public,
       iconKey: entry.iconKey,
-      tokenMap: {},
       createdAt: now,
       updatedAt: now
     };
@@ -23999,8 +24322,8 @@ function seedDefaultPersonas(args) {
 function copyBundleExtras(srcDir, dstDir) {
   for (const entry of fs8.readdirSync(srcDir, { withFileTypes: true })) {
     if (entry.name === "CLAUDE.md" || entry.name === ".clawd") continue;
-    const srcPath = path9.join(srcDir, entry.name);
-    const dstPath = path9.join(dstDir, entry.name);
+    const srcPath = path10.join(srcDir, entry.name);
+    const dstPath = path10.join(dstDir, entry.name);
     if (entry.isDirectory()) {
       fs8.cpSync(srcPath, dstPath, { recursive: true, dereference: true });
     } else if (entry.isFile()) {
@@ -25341,6 +25664,7 @@ var import_sender = __toESM(require_sender(), 1);
 var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
+var wrapper_default = import_websocket.default;
 
 // src/transport/local-ws-server.ts
 var import_node_http = __toESM(require("http"), 1);
@@ -25355,6 +25679,9 @@ var LocalWsServer = class {
   httpServer = null;
   frameHandler = null;
   clients = /* @__PURE__ */ new Map();
+  // Task 1.7 capability platform：capId → Set<clientId>，撤销时 O(1) 找到该 cap 的
+  // 所有活跃连接做关闭级联（Task 1.10）。同一 cap 可能多端同时连（多设备 / 多 tab）。
+  capabilityIdToClients = /* @__PURE__ */ new Map();
   logger;
   pingIntervalMs;
   async start() {
@@ -25445,6 +25772,49 @@ var LocalWsServer = class {
       this.safeSend(c.ws, frame);
     }
   }
+  // Task 1.9 capability platform：仅广播给 owner 连接（跳过 guest ws）。
+  // 用于 capability:tokenIssued / capability:tokenDeleted 等 owner-only push frame——
+  // guest 没必要也无法消费这类管理帧。noAuth localhost ws 没有 ctx, 视作 owner.
+  broadcastToOwners(frame) {
+    const gate = this.opts.authGate;
+    for (const c of this.clients.values()) {
+      if (gate && !gate.isAuthed(c.handle.id)) continue;
+      if (c.ctx && c.ctx.principal.kind !== "owner") continue;
+      this.safeSend(c.ws, frame);
+    }
+  }
+  // capability platform v3 inbox 重写: 推给某条 cap channel 的两端 ws.
+  //   - 所有 owner ws (owner 看自家所有 channel)
+  //   - 该 capabilityId 的所有 guest ws (该 cap 持有人的多端/多 tab)
+  // 一次调用同时推两端, inbox:event push 帧由此走.
+  broadcastToCapabilityChannel(capabilityId, frame) {
+    this.broadcastToOwners(frame);
+    const set = this.capabilityIdToClients.get(capabilityId);
+    if (!set) return;
+    for (const id of set) {
+      const c = this.clients.get(id);
+      if (!c) continue;
+      this.safeSend(c.ws, frame);
+    }
+  }
+  // Phase 4 capability platform DM: 广播到指定 principal 的所有活跃 ws.
+  //   principalId === ownerPrincipalId  → 同 broadcastToOwners (所有 owner ws)
+  //   principalId === 'owner' sentinel  → 同上（向后兼容遗留 caller / 协议层 sentinel）
+  //   principalId === 'cap_xxx'         → 该 capability 的所有 guest ws (多端 / 多 tab)
+  // 用于 DM inbox:event 路由: from + to 两侧各播一次, 让双方 UI 实时看到 thread 更新.
+  broadcastToPrincipal(principalId, frame) {
+    if (principalId === "owner" || principalId === this.opts.ownerPrincipalId) {
+      this.broadcastToOwners(frame);
+      return;
+    }
+    const set = this.capabilityIdToClients.get(principalId);
+    if (!set) return;
+    for (const id of set) {
+      const c = this.clients.get(id);
+      if (!c) continue;
+      this.safeSend(c.ws, frame);
+    }
+  }
   firstSubscriber(sessionId) {
     for (const c of this.clients.values()) {
       if (c.handle.subscribedSessions.has(sessionId)) return c.handle;
@@ -25466,6 +25836,40 @@ var LocalWsServer = class {
     if (!c) return;
     this.safeSend(c.ws, frame);
   }
+  // Task 1.7 capability platform：AuthGate.onAuthed 回调里调本方法，把 ConnectionContext
+  // 绑到 client；guest 连接同时进 capId 索引（Task 1.10 撤销级联用）。
+  attachClientContext(clientId, ctx) {
+    const c = this.clients.get(clientId);
+    if (!c) return;
+    c.ctx = ctx;
+    if (ctx.capabilityId) {
+      let set = this.capabilityIdToClients.get(ctx.capabilityId);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        this.capabilityIdToClients.set(ctx.capabilityId, set);
+      }
+      set.add(clientId);
+    }
+  }
+  // 测试 / Task 1.8 dispatcher 用：拿 client 当前 ConnectionContext（null = 未鉴权 / noAuth）
+  getClientContext(clientId) {
+    return this.clients.get(clientId)?.ctx ?? null;
+  }
+  // Task 1.10 撤销级联：关闭某 capability 的所有活跃 ws 连接。close code 4401
+  // 让客户端识别 'capability revoked' 而非普通断连。
+  closeConnectionsByCapability(capabilityId, code = 4401, reason = "TOKEN_REVOKED") {
+    const set = this.capabilityIdToClients.get(capabilityId);
+    if (!set) return;
+    const ids = [...set];
+    for (const id of ids) {
+      const c = this.clients.get(id);
+      if (!c) continue;
+      try {
+        c.ws.close(code, reason);
+      } catch {
+      }
+    }
+  }
   // URL path 路由：'/' → 主连接路径；其他 → close 4404
   routeConnection(socket, req) {
     const remoteAddress = req?.socket?.remoteAddress;
@@ -25500,7 +25904,7 @@ var LocalWsServer = class {
       } catch {
       }
     }, this.pingIntervalMs);
-    this.clients.set(id, { handle, ws: socket, pingTimer });
+    this.clients.set(id, { handle, ws: socket, pingTimer, ctx: null });
     this.logger?.info("client connected", { clientId: id, total: this.clients.size, remoteAddress });
     const authGate = this.opts.authGate;
     let authed = true;
@@ -25524,6 +25928,12 @@ var LocalWsServer = class {
     socket.on("close", () => {
       const c = this.clients.get(id);
       if (c?.pingTimer) clearInterval(c.pingTimer);
+      const capId = c?.ctx?.capabilityId;
+      if (capId) {
+        const set = this.capabilityIdToClients.get(capId);
+        set?.delete(id);
+        if (set && set.size === 0) this.capabilityIdToClients.delete(capId);
+      }
       this.clients.delete(id);
       authGate?.unregister(id);
       this.logger?.info("client disconnected", { clientId: id, remaining: this.clients.size });
@@ -25556,6 +25966,17 @@ var LocalWsServer = class {
         return;
       }
     } else if (frame.type === "auth") {
+      const token = typeof frame.token === "string" ? frame.token ?? "" : "";
+      const selfPrincipalId = typeof frame.selfPrincipalId === "string" ? frame.selfPrincipalId ?? "" : "";
+      const selfDisplayName = typeof frame.selfDisplayName === "string" ? frame.selfDisplayName ?? "" : "";
+      if (token && this.opts.tryVerifyCapabilityToken) {
+        const guestCtx = this.opts.tryVerifyCapabilityToken(
+          token,
+          selfPrincipalId || void 0,
+          selfDisplayName || void 0
+        );
+        if (guestCtx) this.attachClientContext(client.id, guestCtx);
+      }
       this.safeSend(this.clients.get(client.id).ws, { type: "auth:ok" });
       return;
     }
@@ -25672,15 +26093,31 @@ var AuthGate = class {
       this.markFailed(handle.id);
       return frame.type === "auth" ? "consumed" : "reject";
     }
-    if (!this.opts.expectedToken) {
-      this.opts.closeConnection(handle, 1008, "auth not configured");
-      this.markFailed(handle.id);
-      return "consumed";
-    }
-    if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
-      this.opts.closeConnection(handle, 1008, "auth failed");
-      this.markFailed(handle.id);
-      return "consumed";
+    let ctx = null;
+    if (this.opts.authenticate) {
+      const r = this.opts.authenticate(
+        parsed.data.token,
+        parsed.data.selfPrincipalId,
+        parsed.data.selfDisplayName
+      );
+      if (!r.ok) {
+        this.opts.closeConnection(handle, 4401, r.code);
+        this.markFailed(handle.id);
+        return "consumed";
+      }
+      ctx = r.context;
+    } else {
+      if (!this.opts.expectedToken) {
+        this.opts.closeConnection(handle, 1008, "auth not configured");
+        this.markFailed(handle.id);
+        return "consumed";
+      }
+      if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
+        this.opts.closeConnection(handle, 1008, "auth failed");
+        this.markFailed(handle.id);
+        return "consumed";
+      }
+      ctx = this.opts.buildOwnerContext?.() ?? null;
     }
     if (st.timer != null) {
       const clear = this.opts.clearTimer ?? ((h) => clearTimeout(h));
@@ -25688,6 +26125,7 @@ var AuthGate = class {
     }
     st.authed = true;
     st.timer = null;
+    if (ctx && this.opts.onAuthed) this.opts.onAuthed(handle, ctx);
     this.opts.sendOk(handle, { type: "auth:ok" });
     return "consumed";
   }
@@ -25723,7 +26161,7 @@ var AuthContextResolver = class {
   }
   opts;
   /**
-   * 从 `Authorization` 头解析。null = 无凭证 / 不识别 / revoked，调用方一律 401。
+   * 从 `Authorization` 头解析。null = 无凭证 / 不识别，调用方一律 401。
    * remoteAddress 用于 isLoopback 判定（loopback = 127.0.0.1 / ::1 / ::ffff:127.0.0.1）。
    */
   resolveFromHeader(authHeader, remoteAddress) {
@@ -25733,15 +26171,6 @@ var AuthContextResolver = class {
     if (this.opts.ownerToken && constantTimeEqual2(token, this.opts.ownerToken)) {
       return { role: "owner", isLoopback };
     }
-    const personalHit = this.opts.personaRegistry.findByToken(token);
-    if (personalHit) {
-      return {
-        role: "personal",
-        personaId: personalHit.personaId,
-        label: personalHit.label,
-        isLoopback
-      };
-    }
     return null;
   }
 };
@@ -25763,206 +26192,753 @@ function constantTimeEqual2(a, b2) {
   return diff2 === 0;
 }
 
-// src/transport/http-router.ts
-var import_node_fs14 = __toESM(require("fs"), 1);
-var import_node_path16 = __toESM(require("path"), 1);
+// ../protocol/src/index.ts
+init_runtime();
 
-// src/attachment/group.ts
-var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path14 = __toESM(require("path"), 1);
-var import_node_crypto4 = __toESM(require("crypto"), 1);
-init_protocol();
-var GroupFileStore = class {
+// src/transport/connection-context.ts
+function ownerContext(ownerPrincipalId, displayName) {
+  return {
+    principal: makeOwnerPrincipal(ownerPrincipalId, displayName),
+    grants: [{ resource: { type: "*" }, actions: ["admin"] }]
+  };
+}
+function guestContext(cap) {
+  return {
+    principal: { id: cap.id, kind: "guest", displayName: cap.displayName },
+    grants: cap.grants,
+    capabilityId: cap.id
+  };
+}
+function authenticate(token, deps) {
+  if (!token) return { ok: false, code: "NO_TOKEN" };
+  if (deps.isOwnerToken(token)) {
+    return { ok: true, context: ownerContext(deps.ownerPrincipalId, deps.ownerDisplayName) };
+  }
+  if (!deps.capabilityRegistry) return { ok: false, code: "BAD_TOKEN" };
+  const v2 = deps.capabilityRegistry.verifyToken(token);
+  if (!v2.ok) {
+    if (v2.code === "TOKEN_INVALID") return { ok: false, code: "BAD_TOKEN" };
+    return { ok: false, code: v2.code };
+  }
+  if (deps.selfPrincipalId && deps.selfDisplayName && deps.onGuestHello) {
+    try {
+      deps.onGuestHello(v2.capability.id, deps.selfPrincipalId, deps.selfDisplayName);
+    } catch (e) {
+      if (e.message === "TOKEN_SHARED_LEAK") {
+        return { ok: false, code: "TOKEN_REVOKED" };
+      }
+      throw e;
+    }
+  }
+  return { ok: true, context: guestContext(v2.capability) };
+}
+
+// src/permission/capability-store.ts
+var fs15 = __toESM(require("fs"), 1);
+var path18 = __toESM(require("path"), 1);
+var CAPABILITIES_FILE_NAME = "capabilities.json";
+var FILE_VERSION = 1;
+var CapabilityStore = class {
+  constructor(dataDir) {
+    this.dataDir = dataDir;
+    fs15.mkdirSync(dataDir, { recursive: true });
+    this.cache = this.readFromDisk();
+  }
   dataDir;
-  logger;
-  cache = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.dataDir = opts.dataDir;
-    this.logger = opts.logger;
+  cache;
+  list() {
+    return [...this.cache];
   }
-  rootForScope(scope) {
-    return import_node_path14.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
+  upsert(cap) {
+    const idx = this.cache.findIndex((c) => c.id === cap.id);
+    if (idx >= 0) {
+      this.cache[idx] = cap;
+    } else {
+      this.cache.push(cap);
+    }
+    this.flush();
   }
-  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
-  filePath(scope, sessionId) {
-    return import_node_path14.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
+  remove(id) {
+    const next = this.cache.filter((c) => c.id !== id);
+    if (next.length === this.cache.length) return;
+    this.cache = next;
+    this.flush();
   }
-  cacheKey(scope, sessionId) {
-    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
+  filePath() {
+    return path18.join(this.dataDir, CAPABILITIES_FILE_NAME);
   }
-  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
-  readFile(scope, sessionId) {
-    const file = this.filePath(scope, sessionId);
+  readFromDisk() {
+    const file = this.filePath();
+    let raw;
     try {
-      const raw = import_node_fs13.default.readFileSync(file, "utf8");
-      const parsed = JSON.parse(raw);
-      if (!Array.isArray(parsed)) {
-        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
-          file
-        });
-        return [];
-      }
-      const out = [];
-      for (const entry of parsed) {
-        const r = GroupFileEntrySchema.safeParse(entry);
-        if (r.success) out.push(r.data);
-      }
-      return out;
+      raw = fs15.readFileSync(file, "utf8");
     } catch (err) {
-      const code = err?.code;
-      if (code === "ENOENT") return [];
-      this.logger?.warn("GroupFileStore.readFile failed", {
-        file,
-        err: err.message
-      });
+      if (err?.code === "ENOENT") return [];
       return [];
     }
+    if (!raw.trim()) return [];
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return [];
+    }
+    if (!parsed || typeof parsed !== "object") return [];
+    const arr = parsed.capabilities;
+    if (!Array.isArray(arr)) return [];
+    const out = [];
+    for (const item of arr) {
+      const r = CapabilitySchema.safeParse(item);
+      if (r.success) out.push(r.data);
+    }
+    return out;
   }
-  writeFile(scope, sessionId, entries) {
-    const file = this.filePath(scope, sessionId);
-    import_node_fs13.default.mkdirSync(import_node_path14.default.dirname(file), { recursive: true });
-    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
-    import_node_fs13.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
-    import_node_fs13.default.renameSync(tmp, file);
+  flush() {
+    const content = { version: FILE_VERSION, capabilities: this.cache };
+    this.atomicWrite(this.filePath(), JSON.stringify(content, null, 2));
   }
-  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
-  list(scope, sessionId) {
-    const key = this.cacheKey(scope, sessionId);
-    const cached = this.cache.get(key);
-    if (cached) return cached.entries;
-    const entries = this.readFile(scope, sessionId);
-    this.cache.set(key, { entries, scope });
-    return entries;
+  atomicWrite(file, content) {
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    fs15.writeFileSync(tmp, content, { mode: 384 });
+    fs15.renameSync(tmp, file);
+    try {
+      fs15.chmodSync(file, 384);
+    } catch {
+    }
+  }
+};
+
+// src/permission/capability-registry.ts
+var crypto4 = __toESM(require("crypto"), 1);
+var CapabilityRegistry = class {
+  constructor(store, now = () => Date.now()) {
+    this.store = store;
+    this.now = now;
+    for (const cap of store.list()) {
+      this.bySecretHash.set(cap.secretHash, cap);
+    }
+  }
+  store;
+  now;
+  // sha256(token) → Capability
+  bySecretHash = /* @__PURE__ */ new Map();
+  list() {
+    return this.store.list();
+  }
+  verifyToken(token) {
+    if (!token) return { ok: false, code: "TOKEN_INVALID" };
+    const hash = sha256Hex(token);
+    const cap = this.bySecretHash.get(hash);
+    if (!cap) return { ok: false, code: "TOKEN_INVALID" };
+    if (cap.expiresAt && this.now() >= cap.expiresAt) {
+      return { ok: false, code: "TOKEN_EXPIRED" };
+    }
+    if (cap.maxUses && cap.usedCount >= cap.maxUses) {
+      return { ok: false, code: "TOKEN_EXHAUSTED" };
+    }
+    const updated = { ...cap, usedCount: cap.usedCount + 1 };
+    this.bySecretHash.set(hash, updated);
+    this.store.upsert(updated);
+    return { ok: true, capability: updated };
+  }
+  upsertCapability(cap) {
+    this.bySecretHash.set(cap.secretHash, cap);
+    this.store.upsert(cap);
   }
   /**
-   * upsert：
-   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
-   *     （保留首次入群人 / 入群时刻）
-   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
-   *
-   * 返回最新 entry（caller 可用来 broadcast 通知）。
+   * Hard delete：从 store 物理移除 + 从 Map 清掉 secretHash 索引。
+   * 后续 verifyToken 该 token 走 'TOKEN_INVALID' 分支（secretHash 已不在 Map）。
+   * idempotent：不存在 → null。
    */
-  upsert(scope, sessionId, input, now = Date.now()) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === input.relPath);
-    let next;
-    if (idx >= 0) {
-      const prev = entries[idx];
-      next = {
-        ...prev,
-        size: input.size,
-        mime: input.mime,
-        lastEditedAt: now,
-        stale: false
-        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
-      };
-      entries[idx] = next;
-    } else {
-      next = {
-        id: `gf-${import_node_crypto4.default.randomBytes(6).toString("base64url")}`,
-        relPath: input.relPath,
-        from: input.from,
-        label: input.label,
-        size: input.size,
-        mime: input.mime,
-        addedAt: now
-        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
-      };
-      entries.push(next);
+  delete(id) {
+    const current = this.store.list().find((c) => c.id === id);
+    if (!current) return null;
+    this.bySecretHash.delete(current.secretHash);
+    this.store.remove(id);
+    return current;
+  }
+  findById(id) {
+    return this.store.list().find((c) => c.id === id) ?? null;
+  }
+};
+function sha256Hex(s) {
+  return crypto4.createHash("sha256").update(s).digest("hex");
+}
+
+// src/permission/capability-manager.ts
+var crypto5 = __toESM(require("crypto"), 1);
+var CapabilityManager = class {
+  constructor(registry2, hooks = {}) {
+    this.registry = registry2;
+    this.hooks = hooks;
+  }
+  registry;
+  hooks;
+  list() {
+    return this.registry.list();
+  }
+  // whoami handler 用：根据 capabilityId 反查 caller 的 capability 实体。
+  // 返回 Capability 持久化形态；handler 调 stripSecretHash 后再上 wire。
+  findById(id) {
+    return this.registry.findById(id);
+  }
+  issue(args) {
+    if (!args.displayName.trim()) {
+      throw new Error("CapabilityManager.issue: displayName must be non-empty");
     }
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
-    return next;
+    const token = (this.hooks.generateToken ?? defaultGenerateToken)();
+    const id = (this.hooks.generateId ?? defaultGenerateId)();
+    const now = (this.hooks.now ?? Date.now)();
+    const cap = {
+      id,
+      secretHash: sha256Hex2(token),
+      displayName: args.displayName,
+      grants: args.grants,
+      issuedAt: now,
+      usedCount: 0,
+      ...args.expiresAt !== void 0 ? { expiresAt: args.expiresAt } : {},
+      ...args.maxUses !== void 0 ? { maxUses: args.maxUses } : {}
+    };
+    this.registry.upsertCapability(cap);
+    this.hooks.onIssued?.(cap, token);
+    return { token, capability: cap };
   }
   /**
-   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
-   * - 命中 → stale=true，UI 灰显
-   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
-   *
-   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
+   * guest 端 auth 帧捎带 selfPrincipalId/selfDisplayName 时，AuthGate.authenticate
+   * 校验 cap token 通过后调本方法把 peer 字段写回 cap：
+   *   - 首次（cap.firstUsedByPeerAt 未设）→ 写盘 + 触发 onIssued 复用 push 频道
+   *     让 owner UI 通过 capability:updated 实时拿到 peer 字段
+   *   - 重复（同 peerOwnerId）→ noop
+   *   - 冲突（不同 peerOwnerId）→ throw TOKEN_SHARED_LEAK，AuthGate 转 close 4401
    */
-  markStale(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return;
-    if (entries[idx].stale) return;
-    entries[idx] = { ...entries[idx], stale: true };
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
+  recordPeerHello(capId, args) {
+    const cap = this.registry.findById(capId);
+    if (!cap) return { changed: false };
+    if (cap.firstUsedByPeerAt != null) {
+      if (cap.peerOwnerId !== args.ownerPrincipalId) {
+        throw new Error("TOKEN_SHARED_LEAK");
+      }
+      return { changed: false };
+    }
+    const updated = {
+      ...cap,
+      peerOwnerId: args.ownerPrincipalId,
+      firstUsedByPeerAt: args.now,
+      peerDisplayName: args.displayName
+    };
+    this.registry.upsertCapability(updated);
+    this.hooks.onIssued?.(updated, "__peer_hello__");
+    return { changed: true };
   }
   /**
-   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
-   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
-   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
-   *
-   * 返回值：true=命中并删除；false=relPath 不在群里。
+   * Hard delete：从 registry / store 物理移除 capability。
+   * idempotent：不存在 → null（handler 翻译成 VALIDATION_ERROR）
+   * onDeleted hook 在 daemon/index.ts wire 负责 close 连接 + cleanup 文件 + 广播
    */
-  remove(scope, sessionId, relPath) {
-    const entries = this.list(scope, sessionId).slice();
-    const idx = entries.findIndex((e) => e.relPath === relPath);
-    if (idx < 0) return false;
-    entries.splice(idx, 1);
-    this.writeFile(scope, sessionId, entries);
-    this.cache.set(this.cacheKey(scope, sessionId), { entries, scope });
-    return true;
+  delete(id) {
+    const removed = this.registry.delete(id);
+    if (!removed) return null;
+    this.hooks.onDeleted?.(removed);
+    return { capability: removed };
   }
+};
+function defaultGenerateToken() {
+  return crypto5.randomBytes(24).toString("base64url");
+}
+function defaultGenerateId() {
+  return "cap_" + crypto5.randomBytes(6).toString("base64url");
+}
+function sha256Hex2(s) {
+  return crypto5.createHash("sha256").update(s).digest("hex");
+}
+
+// src/permission/cleanup.ts
+var fs16 = __toESM(require("fs"), 1);
+function cleanupGuestSessionsForCapability(cap, factory) {
+  const removed = [];
+  for (const g2 of cap.grants) {
+    if (g2.resource.type !== "persona") continue;
+    const dir = factory.vmGuestRoot(g2.resource.id, cap.id);
+    try {
+      fs16.rmSync(dir, { recursive: true, force: true });
+      removed.push(dir);
+    } catch {
+    }
+  }
+  return { removed };
+}
+
+// src/inbox/inbox-store.ts
+var fs17 = __toESM(require("fs"), 1);
+var path19 = __toESM(require("path"), 1);
+var INBOX_SUBDIR = "inbox";
+var InboxStore = class {
+  constructor(dataDir) {
+    this.dataDir = dataDir;
+    fs17.mkdirSync(this.dirPath(), { recursive: true });
+  }
+  dataDir;
   /**
-   * 跨 session 聚合查询（spec §4 HTTP ACL：personal 视野并集）。
-   *
-   * 扫 <dataDir>/sessions/<personaId>/owner/*.group-files.json 和
-   * <dataDir>/sessions/<personaId>/listener/*.group-files.json，每文件读一份。
+   * 列出某 peer 的消息, 按 createdAt 升序.
+   * sinceCreatedAt 缺省时返回全量; 提供时仅返回 createdAt > sinceCreatedAt 的增量.
+   * 文件不存在时返回 [] (不抛, 不创建).
+   */
+  list(peerOwnerId, sinceCreatedAt) {
+    const file = this.filePath(peerOwnerId);
+    let raw;
+    try {
+      raw = fs17.readFileSync(file, "utf8");
+    } catch (err) {
+      if (err?.code === "ENOENT") return [];
+      return [];
+    }
+    const all = parseAllLines(raw);
+    if (sinceCreatedAt === void 0) return all;
+    return all.filter((m2) => m2.createdAt > sinceCreatedAt);
+  }
+  /**
+   * 列出所有 peer 的 peerOwnerId (扫目录所有 *.jsonl 文件名).
+   */
+  listAllPeerOwnerIds() {
+    const dir = this.dirPath();
+    let entries;
+    try {
+      entries = fs17.readdirSync(dir);
+    } catch (err) {
+      if (err?.code === "ENOENT") return [];
+      return [];
+    }
+    return entries.filter((name) => name.endsWith(".jsonl")).map((name) => name.slice(0, -".jsonl".length));
+  }
+  /**
+   * 追加一条消息，按 message.id 幂等去重。
+   * 双投 + 重试场景下保护 — 同 id 已存在则 no-op，不重写不覆盖。
+   */
+  append(message) {
+    const existing = this.list(message.peerOwnerId);
+    if (existing.some((m2) => m2.id === message.id)) return;
+    const file = this.filePath(message.peerOwnerId);
+    const line = JSON.stringify(message) + "\n";
+    fs17.appendFileSync(file, line, { mode: 384 });
+    try {
+      fs17.chmodSync(file, 384);
+    } catch {
+    }
+  }
+  /**
+   * 把该 peer 所有 createdAt<=upToCreatedAt 且 sender!=principalId 的消息
+   * readBy[principalId] 写成 upToCreatedAt. O(N) rewrite 整个文件.
+   * 返写入了几条.
+   */
+  markRead(peerOwnerId, principalId, upToCreatedAt) {
+    const messages = this.list(peerOwnerId);
+    let changed = 0;
+    const next = messages.map((m2) => {
+      if (m2.senderPrincipalId === principalId) return m2;
+      if (m2.createdAt > upToCreatedAt) return m2;
+      const cur = m2.readBy[principalId];
+      if (cur !== void 0 && cur >= upToCreatedAt) return m2;
+      changed++;
+      return { ...m2, readBy: { ...m2.readBy, [principalId]: upToCreatedAt } };
+    });
+    if (changed === 0) return 0;
+    this.rewriteFile(peerOwnerId, next);
+    return changed;
+  }
+  /**
+   * 删整个 peer 的 jsonl (peer:remove cascade). 不存在 no-op.
+   */
+  removeByPeerOwnerId(peerOwnerId) {
+    const file = this.filePath(peerOwnerId);
+    try {
+      fs17.unlinkSync(file);
+    } catch (err) {
+      if (err?.code === "ENOENT") return;
+    }
+  }
+  rewriteFile(peerOwnerId, messages) {
+    const file = this.filePath(peerOwnerId);
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const content = messages.map((m2) => JSON.stringify(m2)).join("\n") + (messages.length > 0 ? "\n" : "");
+    fs17.writeFileSync(tmp, content, { mode: 384 });
+    fs17.renameSync(tmp, file);
+    try {
+      fs17.chmodSync(file, 384);
+    } catch {
+    }
+  }
+  dirPath() {
+    return path19.join(this.dataDir, INBOX_SUBDIR);
+  }
+  filePath(peerOwnerId) {
+    return path19.join(this.dirPath(), `${peerOwnerId}.jsonl`);
+  }
+};
+function parseAllLines(raw) {
+  const out = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const r = InboxMessageSchema.safeParse(parsed);
+    if (r.success) out.push(r.data);
+  }
+  return out;
+}
+
+// src/inbox/inbox-manager.ts
+var InboxManager = class {
+  constructor(store, broadcast) {
+    this.store = store;
+    this.broadcast = broadcast;
+  }
+  store;
+  broadcast;
+  /**
+   * 写一条消息到 peer.jsonl + broadcast 给本机所有 owner ws。
+   * 按 id 幂等：同 id 已落盘则 no-op（不广播、不重写）。
    *
-   * 复杂度 O(N sessions × N entries)，N 通常 < 100，可接受。
+   * caller 必须已通过 handler 鉴权
+   * （owner ctx 必填 args.peerOwnerId；guest ctx 由 handler 反查 peer-store）。
    */
-  listByPersona(personaId) {
-    const out = [];
-    for (const mode of ["owner", "listener"]) {
-      const scope = { kind: "persona", personaId, mode };
-      const root = this.rootForScope(scope);
-      let names;
+  postMessage(args) {
+    const beforeLen = this.store.list(args.peerOwnerId).length;
+    const msg = {
+      id: args.id,
+      peerOwnerId: args.peerOwnerId,
+      senderPrincipalId: args.senderPrincipalId,
+      text: args.text,
+      createdAt: args.createdAt,
+      readBy: {}
+    };
+    this.store.append(msg);
+    const afterLen = this.store.list(args.peerOwnerId).length;
+    if (afterLen === beforeLen) return msg;
+    this.broadcast(args.peerOwnerId, {
+      type: "inbox:event",
+      peerOwnerId: args.peerOwnerId,
+      message: msg
+    });
+    return msg;
+  }
+  list(peerOwnerId, sinceCreatedAt) {
+    return this.store.list(peerOwnerId, sinceCreatedAt);
+  }
+  /**
+   * 标已读. 返写入了几条 (sender !== self 且 createdAt <= upToCreatedAt 的消息).
+   * broadcast 已更新 readBy 的每条消息 (单帧一消息, 复用 inbox:event 通道).
+   */
+  markRead(args) {
+    const before = this.store.list(args.peerOwnerId);
+    const changed = this.store.markRead(args.peerOwnerId, args.principalId, args.upToCreatedAt);
+    if (changed === 0) return 0;
+    const after = this.store.list(args.peerOwnerId);
+    const beforeById = new Map(before.map((m2) => [m2.id, m2]));
+    for (const m2 of after) {
+      const prev = beforeById.get(m2.id);
+      if (!prev) continue;
+      if (prev.readBy[args.principalId] === m2.readBy[args.principalId]) continue;
+      this.broadcast(args.peerOwnerId, {
+        type: "inbox:event",
+        peerOwnerId: args.peerOwnerId,
+        message: m2
+      });
+    }
+    return changed;
+  }
+  /** peer:remove cascade. 删整个 peer 的 jsonl. */
+  removeChannel(peerOwnerId) {
+    this.store.removeByPeerOwnerId(peerOwnerId);
+  }
+};
+
+// src/state/received-capability-store.ts
+var fs18 = __toESM(require("fs"), 1);
+var path20 = __toESM(require("path"), 1);
+var FILE_NAME = "received-capabilities.json";
+var ReceivedCapabilityStore = class {
+  constructor(dataDir) {
+    this.dataDir = dataDir;
+  }
+  dataDir;
+  caps = /* @__PURE__ */ new Map();
+  load() {
+    this.caps.clear();
+    const file = path20.join(this.dataDir, FILE_NAME);
+    let raw;
+    try {
+      raw = fs18.readFileSync(file, "utf8");
+    } catch (err) {
+      if (err?.code !== "ENOENT") this.renameBak(file);
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      this.renameBak(file);
+      return;
+    }
+    const arr = parsed?.receivedCaps;
+    if (!Array.isArray(arr)) return;
+    for (const entry of arr) {
+      const r = ReceivedCapabilitySchema.safeParse(entry);
+      if (r.success) this.caps.set(r.data.ownerPrincipalId, r.data);
+    }
+  }
+  list() {
+    return Array.from(this.caps.values());
+  }
+  get(ownerPrincipalId) {
+    return this.caps.get(ownerPrincipalId) ?? null;
+  }
+  hasOwner(ownerPrincipalId) {
+    return this.caps.has(ownerPrincipalId);
+  }
+  upsert(cap) {
+    this.caps.set(cap.ownerPrincipalId, cap);
+    this.flush();
+  }
+  remove(ownerPrincipalId) {
+    if (!this.caps.delete(ownerPrincipalId)) return;
+    this.flush();
+  }
+  flush() {
+    const file = path20.join(this.dataDir, FILE_NAME);
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    const content = JSON.stringify(
+      { receivedCaps: Array.from(this.caps.values()) },
+      null,
+      2
+    );
+    fs18.mkdirSync(this.dataDir, { recursive: true });
+    fs18.writeFileSync(tmp, content, { mode: 384 });
+    fs18.renameSync(tmp, file);
+  }
+  renameBak(file) {
+    try {
+      fs18.renameSync(file, `${file}.bak`);
+    } catch {
+    }
+  }
+};
+
+// src/state/legacy-migration.ts
+var fs19 = __toESM(require("fs"), 1);
+var path21 = __toESM(require("path"), 1);
+var TARGETS = [
+  { src: "capabilities.json", bak: "capabilities.legacy.bak" },
+  { src: "remote-personas", bak: "remote-personas.legacy.bak" },
+  { src: "peers.json", bak: "peers.legacy.bak" }
+];
+function migrateLegacyFiles(dataDir) {
+  for (const t of TARGETS) {
+    const srcPath = path21.join(dataDir, t.src);
+    const bakPath = path21.join(dataDir, t.bak);
+    if (!fs19.existsSync(srcPath)) continue;
+    if (fs19.existsSync(bakPath)) continue;
+    try {
+      fs19.renameSync(srcPath, bakPath);
+    } catch {
+    }
+  }
+}
+
+// src/received-capability/connect-remote.ts
+var crypto6 = __toESM(require("crypto"), 1);
+var HANDSHAKE_TIMEOUT_MS = 5e3;
+var RPC_TIMEOUT_MS = 5e3;
+async function connectRemote(args) {
+  const ws = new wrapper_default(args.url);
+  await new Promise((resolve2, reject) => {
+    const onError = (e) => reject(e);
+    ws.once("open", () => {
+      ws.off("error", onError);
+      resolve2();
+    });
+    ws.once("error", onError);
+  });
+  ws.send(
+    JSON.stringify({
+      type: "auth",
+      token: args.token,
+      selfPrincipalId: args.selfPrincipalId,
+      selfDisplayName: args.selfDisplayName
+    })
+  );
+  await new Promise((resolve2, reject) => {
+    const onMessage = (raw) => {
+      let f;
       try {
-        names = import_node_fs13.default.readdirSync(root);
-      } catch (err) {
-        const code = err?.code;
-        if (code === "ENOENT") continue;
-        continue;
+        f = JSON.parse(raw.toString());
+      } catch {
+        return;
+      }
+      if (f.type === "auth:ok" || f.type === "ready") {
+        ws.off("message", onMessage);
+        resolve2();
+        return;
       }
-      for (const name of names) {
-        if (!name.endsWith(".group-files.json")) continue;
-        const sessionId = name.slice(0, -".group-files.json".length);
-        if (!sessionId) continue;
-        const entries = this.list(scope, sessionId);
-        out.push({ sessionId, entries });
+      if (f.type === "auth:error" || f.code === 4401) {
+        ws.off("message", onMessage);
+        reject(new Error(`auth failed: ${f.message ?? f.type ?? "unknown"}`));
+      }
+    };
+    ws.on("message", onMessage);
+    setTimeout(() => {
+      ws.off("message", onMessage);
+      reject(new Error("auth handshake timeout"));
+    }, HANDSHAKE_TIMEOUT_MS);
+  });
+  function call(method, payload) {
+    const requestId = crypto6.randomUUID();
+    return new Promise((resolve2, reject) => {
+      const onMessage = (raw) => {
+        let f;
+        try {
+          f = JSON.parse(raw.toString());
+        } catch {
+          return;
+        }
+        if (f.requestId !== requestId) return;
+        ws.off("message", onMessage);
+        if (f.error || f.type?.endsWith(":error")) {
+          reject(new Error(f.message ?? f.error ?? "rpc error"));
+        } else {
+          resolve2(f);
+        }
+      };
+      ws.on("message", onMessage);
+      ws.send(JSON.stringify({ type: method, requestId, ...payload }));
+      setTimeout(() => {
+        ws.off("message", onMessage);
+        reject(new Error(`${method} timeout`));
+      }, RPC_TIMEOUT_MS);
+    });
+  }
+  return {
+    whoami: async () => {
+      const f = await call("whoami", {});
+      return {
+        ownerId: f.owner.id,
+        displayName: f.owner.displayName,
+        capabilityId: f.capability.id,
+        grants: f.capability.grants
+      };
+    },
+    close: () => {
+      try {
+        ws.close();
+      } catch {
       }
     }
-    return out;
+  };
+}
+
+// src/migrations/2026-05-20-flatten-sessions.ts
+var fs20 = __toESM(require("fs"), 1);
+var path22 = __toESM(require("path"), 1);
+var MIGRATION_FLAG_NAME = ".migration.v1.done";
+function migrateFlattenSessions(opts) {
+  const dataDir = opts.dataDir;
+  const now = opts.now ?? Date.now;
+  const sessionsDir = path22.join(dataDir, "sessions");
+  const flagPath = path22.join(sessionsDir, MIGRATION_FLAG_NAME);
+  if (existsSync4(flagPath)) {
+    return { skipped: true, flagWritten: false, movedBare: 0, movedVmOwner: 0, archivedListener: 0 };
+  }
+  let movedBare = 0;
+  let movedVmOwner = 0;
+  let archivedListener = 0;
+  const defaultDir = path22.join(sessionsDir, "default");
+  if (existsSync4(defaultDir)) {
+    for (const entry of readdirSafe(defaultDir)) {
+      if (!entry.endsWith(".json")) continue;
+      const src = path22.join(defaultDir, entry);
+      const dst = path22.join(sessionsDir, entry);
+      fs20.renameSync(src, dst);
+      movedBare += 1;
+    }
+    rmdirIfEmpty(defaultDir);
+  }
+  for (const pid of readdirSafe(sessionsDir)) {
+    const personaDir = path22.join(sessionsDir, pid);
+    if (!isDir(personaDir)) continue;
+    if (pid === "default") continue;
+    const ownerSrc = path22.join(personaDir, "owner");
+    if (existsSync4(ownerSrc) && isDir(ownerSrc)) {
+      const ownerDst = path22.join(dataDir, "personas", pid, ".clawd", "sessions", "owner");
+      fs20.mkdirSync(ownerDst, { recursive: true });
+      for (const file of readdirSafe(ownerSrc)) {
+        if (!file.endsWith(".json")) continue;
+        fs20.renameSync(path22.join(ownerSrc, file), path22.join(ownerDst, file));
+        movedVmOwner += 1;
+      }
+      rmdirIfEmpty(ownerSrc);
+    }
+    const listenerSrc = path22.join(personaDir, "listener");
+    if (existsSync4(listenerSrc) && isDir(listenerSrc)) {
+      const archiveDst = path22.join(dataDir, ".legacy", `listener-${pid}`);
+      fs20.mkdirSync(archiveDst, { recursive: true });
+      for (const file of readdirSafe(listenerSrc)) {
+        if (!file.endsWith(".json")) continue;
+        fs20.renameSync(path22.join(listenerSrc, file), path22.join(archiveDst, file));
+        archivedListener += 1;
+      }
+      rmdirIfEmpty(listenerSrc);
+    }
+    rmdirIfEmpty(personaDir);
+  }
+  fs20.mkdirSync(sessionsDir, { recursive: true });
+  fs20.writeFileSync(flagPath, JSON.stringify({ migratedAt: now() }, null, 2));
+  return {
+    skipped: false,
+    flagWritten: true,
+    movedBare,
+    movedVmOwner,
+    archivedListener
+  };
+}
+function existsSync4(p2) {
+  try {
+    fs20.statSync(p2);
+    return true;
+  } catch {
+    return false;
   }
-};
-function personalViewable(groupStore, personaDir, personaId, absPath) {
-  const realTarget = safeRealpath(absPath);
-  if (!realTarget) {
+}
+function isDir(p2) {
+  try {
+    return fs20.statSync(p2).isDirectory();
+  } catch {
     return false;
   }
-  const personasUnion = groupStore.listByPersona(personaId);
-  for (const { entries } of personasUnion) {
-    for (const e of entries) {
-      if (e.stale) continue;
-      const realEntry = safeRealpath(import_node_path14.default.join(personaDir, e.relPath));
-      if (realEntry && realEntry === realTarget) return true;
-    }
+}
+function readdirSafe(p2) {
+  try {
+    return fs20.readdirSync(p2);
+  } catch {
+    return [];
   }
-  return false;
 }
-function safeRealpath(p2) {
+function rmdirIfEmpty(p2) {
   try {
-    return import_node_fs13.default.realpathSync(p2);
+    fs20.rmdirSync(p2);
   } catch {
-    return null;
   }
 }
 
-// src/attachment/mime.ts
+// src/transport/http-router.ts
+var import_node_fs13 = __toESM(require("fs"), 1);
 var import_node_path15 = __toESM(require("path"), 1);
+
+// src/attachment/mime.ts
+var import_node_path14 = __toESM(require("path"), 1);
 var TEXT_PLAIN = "text/plain; charset=utf-8";
 var EXT_TO_NATIVE_MIME = {
   // 图片
@@ -26069,14 +27045,14 @@ var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mk"
 ]);
 function lookupMime(filePathOrName) {
-  const ext = import_node_path15.default.extname(filePathOrName).toLowerCase();
+  const ext = import_node_path14.default.extname(filePathOrName).toLowerCase();
   if (EXT_TO_NATIVE_MIME[ext]) return EXT_TO_NATIVE_MIME[ext];
   if (TEXT_EXTENSIONS.has(ext)) return TEXT_PLAIN;
   return "application/octet-stream";
 }
 
 // src/attachment/sign-url.ts
-var import_node_crypto5 = __toESM(require("crypto"), 1);
+var import_node_crypto4 = __toESM(require("crypto"), 1);
 var HMAC_ALGO = "sha256";
 function base64urlEncode(buf) {
   const b2 = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
@@ -26093,7 +27069,7 @@ function decodeAbsPathFromUrl(encoded) {
 }
 function computeSig(secret, absPath, e) {
   const msg = e === null ? absPath : `${absPath}|${e}`;
-  return import_node_crypto5.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
+  return import_node_crypto4.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
 }
 function signUrlParts(secret, absPath, ttlSeconds, now = Date.now) {
   const e = ttlSeconds === null ? null : Math.floor(now() / 1e3) + ttlSeconds;
@@ -26128,7 +27104,7 @@ function verifySignedUrl(secret, absPath, eRaw, s, now = Date.now) {
   if (provided.length !== expected.length) {
     return { ok: false, code: "BAD_SIG" };
   }
-  if (!import_node_crypto5.default.timingSafeEqual(provided, expected)) {
+  if (!import_node_crypto4.default.timingSafeEqual(provided, expected)) {
     return { ok: false, code: "BAD_SIG" };
   }
   if (e !== null && now() / 1e3 > e) {
@@ -26149,7 +27125,7 @@ function createHttpRouter(deps) {
       sendJson(res, 200, { ok: true, version: deps.daemonVersion });
       return true;
     }
-    if (!url.pathname.startsWith("/persona/") && !url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
+    if (!url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/")) {
       return false;
     }
     if (url.pathname.startsWith("/files/") && req.method === "GET") {
@@ -26189,43 +27165,8 @@ function createHttpRouter(deps) {
       sendJson(res, 401, { code: "UNAUTHORIZED", message: "missing or invalid bearer token" });
       return true;
     }
-    const personaFilesMatch = url.pathname.match(/^\/persona\/([^/]+)\/files$/);
-    if (personaFilesMatch && req.method === "GET") {
-      const pid = personaFilesMatch[1];
-      const pathParam = url.searchParams.get("path");
-      if (!pathParam) {
-        sendJson(res, 400, { code: "INVALID_PARAM", message: "missing `path` query" });
-        return true;
-      }
-      if (!deps.personaStore || !deps.groupFileStore) {
-        sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "files endpoint not wired" }));
-        return true;
-      }
-      const personaDir = deps.personaStore.personaDirPath(pid);
-      const absPath = import_node_path16.default.isAbsolute(pathParam) ? pathParam : import_node_path16.default.join(personaDir, pathParam);
-      if (!import_node_path16.default.isAbsolute(pathParam) && !isContainedIn(absPath, personaDir)) {
-        sendJson(res, 400, { code: "PATH_TRAVERSAL", message: "rel path escapes personaDir" });
-        return true;
-      }
-      if (ctx.role === "personal") {
-        if (ctx.personaId !== pid) {
-          sendJson(res, 403, { code: "FORBIDDEN", message: "personal token bound to other persona" });
-          return true;
-        }
-        if (!personalViewable(deps.groupFileStore, personaDir, pid, absPath)) {
-          sendJson(res, 403, { code: "FORBIDDEN", message: "path not in personal viewable scope" });
-          return true;
-        }
-      }
-      streamFile(res, absPath, deps.logger);
-      return true;
-    }
     const sessionFilesMatch = url.pathname.match(/^\/session\/([^/]+)\/files$/);
     if (sessionFilesMatch && req.method === "GET") {
-      if (ctx.role !== "owner") {
-        sendJson(res, 403, { code: "FORBIDDEN", message: "direct session files are owner-only" });
-        return true;
-      }
       const sid = sessionFilesMatch[1];
       const pathParam = url.searchParams.get("path");
       if (!pathParam) {
@@ -26233,7 +27174,7 @@ function createHttpRouter(deps) {
         return true;
       }
       let absPath;
-      if (import_node_path16.default.isAbsolute(pathParam)) {
+      if (import_node_path15.default.isAbsolute(pathParam)) {
         absPath = pathParam;
       } else if (deps.sessionStore) {
         const file = deps.sessionStore.read(sid);
@@ -26241,7 +27182,7 @@ function createHttpRouter(deps) {
           sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sid} not found` });
           return true;
         }
-        absPath = import_node_path16.default.join(file.cwd, pathParam);
+        absPath = import_node_path15.default.join(file.cwd, pathParam);
       } else {
         sendJson(res, 501, withCtx(ctx, { code: "NOT_IMPLEMENTED", message: "sessionStore not wired" }));
         return true;
@@ -26266,18 +27207,12 @@ function sendJson(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function withCtx(ctx, body) {
-  return { ...body, role: ctx.role, personaId: ctx.personaId };
-}
-function isContainedIn(abs, root) {
-  const normalized = import_node_path16.default.resolve(abs);
-  const normalizedRoot = import_node_path16.default.resolve(root);
-  if (normalized === normalizedRoot) return true;
-  return normalized.startsWith(normalizedRoot + import_node_path16.default.sep);
+  return { ...body, role: ctx.role };
 }
 function streamFile(res, absPath, logger) {
   let stat;
   try {
-    stat = import_node_fs14.default.statSync(absPath);
+    stat = import_node_fs13.default.statSync(absPath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -26287,26 +27222,167 @@ function streamFile(res, absPath, logger) {
     }
     return;
   }
-  if (!stat.isFile()) {
-    sendJson(res, 400, { code: "NOT_A_FILE", message: "path is not a regular file" });
-    return;
+  if (!stat.isFile()) {
+    sendJson(res, 400, { code: "NOT_A_FILE", message: "path is not a regular file" });
+    return;
+  }
+  const mime = lookupMime(absPath);
+  const basename = import_node_path15.default.basename(absPath);
+  res.writeHead(200, {
+    "Content-Type": mime,
+    "Content-Length": String(stat.size),
+    "Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(basename)}`,
+    // 防止浏览器把任意 mime 当 html 渲染
+    "X-Content-Type-Options": "nosniff"
+  });
+  const stream = import_node_fs13.default.createReadStream(absPath);
+  stream.on("error", (err) => {
+    logger?.warn("streamFile read error", { absPath, err: err.message });
+    res.destroy();
+  });
+  stream.pipe(res);
+}
+
+// src/attachment/group.ts
+var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
+init_protocol();
+var GroupFileStore = class {
+  dataDir;
+  logger;
+  cache = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dataDir = opts.dataDir;
+    this.logger = opts.logger;
+  }
+  rootForScope(scope) {
+    return import_node_path16.default.join(this.dataDir, "sessions", ...scopeSubPath(scope).map(safeFileName));
+  }
+  /** 与 SessionStore.filePath 平级，扩展名 .group-files.json */
+  filePath(scope, sessionId) {
+    return import_node_path16.default.join(this.rootForScope(scope), `${safeFileName(sessionId)}.group-files.json`);
+  }
+  cacheKey(scope, sessionId) {
+    return scope.kind === "default" ? `default::${sessionId}` : `persona:${scope.personaId}:${scope.mode}::${sessionId}`;
+  }
+  /** 从磁盘读一份；不存在 → 空数组；schema 不匹配的条目 → 跳过（防腐） */
+  readFile(scope, sessionId) {
+    const file = this.filePath(scope, sessionId);
+    try {
+      const raw = import_node_fs14.default.readFileSync(file, "utf8");
+      const parsed = JSON.parse(raw);
+      if (!Array.isArray(parsed)) {
+        this.logger?.warn("GroupFileStore.readFile: not an array; resetting session entries", {
+          file
+        });
+        return [];
+      }
+      const out = [];
+      for (const entry of parsed) {
+        const r = GroupFileEntrySchema.safeParse(entry);
+        if (r.success) out.push(r.data);
+      }
+      return out;
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return [];
+      this.logger?.warn("GroupFileStore.readFile failed", {
+        file,
+        err: err.message
+      });
+      return [];
+    }
+  }
+  writeFile(scope, sessionId, entries) {
+    const file = this.filePath(scope, sessionId);
+    import_node_fs14.default.mkdirSync(import_node_path16.default.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+    import_node_fs14.default.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    import_node_fs14.default.renameSync(tmp, file);
+  }
+  /** 拉一份当前 session 的清单。读盘 → cache；之后调用复用 cache */
+  list(scope, sessionId) {
+    const key = this.cacheKey(scope, sessionId);
+    const cached = this.cache.get(key);
+    if (cached) return cached.entries;
+    const entries = this.readFile(scope, sessionId);
+    this.cache.set(key, { entries });
+    return entries;
+  }
+  /**
+   * upsert：
+   *   - 同 relPath 已存在 → 更新 lastEditedAt + clear stale；不动 from / addedAt / id
+   *     （保留首次入群人 / 入群时刻）
+   *   - 不存在 → append，id 派生稳定 uuid，addedAt = now
+   *
+   * 返回最新 entry（caller 可用来 broadcast 通知）。
+   */
+  upsert(scope, sessionId, input, now = Date.now()) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === input.relPath);
+    let next;
+    if (idx >= 0) {
+      const prev = entries[idx];
+      next = {
+        ...prev,
+        size: input.size,
+        mime: input.mime,
+        lastEditedAt: now,
+        stale: false
+        // label 不在 upsert 路径覆盖（owner +Add 走另一条路径）
+      };
+      entries[idx] = next;
+    } else {
+      next = {
+        id: `gf-${import_node_crypto5.default.randomBytes(6).toString("base64url")}`,
+        relPath: input.relPath,
+        from: input.from,
+        label: input.label,
+        size: input.size,
+        mime: input.mime,
+        addedAt: now
+        // agent 第一次 upsert 时不写 lastEditedAt（语义上 = 首次"编辑" = addedAt）
+      };
+      entries.push(next);
+    }
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries });
+    return next;
+  }
+  /**
+   * 标记一个 relPath stale（agent rm / mv 后文件不在）。
+   * - 命中 → stale=true，UI 灰显
+   * - 未命中 → noop（不需要为不在群里的文件创建 stale 条目）
+   *
+   * 注：spec §6 "Bash 命令是 rm 形态"启发式不强求 — runner 暂不调，留给后续优化
+   */
+  markStale(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return;
+    if (entries[idx].stale) return;
+    entries[idx] = { ...entries[idx], stale: true };
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries });
+  }
+  /**
+   * 真删一条群文件条目（用于 owner 撤销自己 +Add 的入群操作）。
+   * agent 自动入群的不应走这条 —— 用 markStale 表达"文件不在了"语义；
+   * owner 手动加错了，应该能彻底从列表移除而不是留个 stale 占位。
+   *
+   * 返回值：true=命中并删除；false=relPath 不在群里。
+   */
+  remove(scope, sessionId, relPath) {
+    const entries = this.list(scope, sessionId).slice();
+    const idx = entries.findIndex((e) => e.relPath === relPath);
+    if (idx < 0) return false;
+    entries.splice(idx, 1);
+    this.writeFile(scope, sessionId, entries);
+    this.cache.set(this.cacheKey(scope, sessionId), { entries });
+    return true;
   }
-  const mime = lookupMime(absPath);
-  const basename = import_node_path16.default.basename(absPath);
-  res.writeHead(200, {
-    "Content-Type": mime,
-    "Content-Length": String(stat.size),
-    "Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(basename)}`,
-    // 防止浏览器把任意 mime 当 html 渲染
-    "X-Content-Type-Options": "nosniff"
-  });
-  const stream = import_node_fs14.default.createReadStream(absPath);
-  stream.on("error", (err) => {
-    logger?.warn("streamFile read error", { absPath, err: err.message });
-    res.destroy();
-  });
-  stream.pipe(res);
-}
+};
 
 // src/discovery/state-file.ts
 var import_node_fs15 = __toESM(require("fs"), 1);
@@ -26986,26 +28062,32 @@ function authFilePath(dataDir) {
 }
 function loadOrCreateAuthFile(opts) {
   const file = authFilePath(opts.dataDir);
-  const generate = opts.generate ?? defaultGenerate;
+  const generate = opts.generate ?? defaultGenerateToken2;
+  const genId = opts.genOwnerPrincipalId ?? defaultGenerateOwnerPrincipalId;
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const existing = readAuthFile(file);
-  if (existing && existing.token && existing.signSecret) {
+  if (existing && existing.token && existing.signSecret && existing.ownerPrincipalId) {
     return {
       token: existing.token,
       signSecret: existing.signSecret,
+      ownerPrincipalId: existing.ownerPrincipalId,
       createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
     };
   }
   const token = existing?.token || generate();
   const signSecret = existing?.signSecret || generate();
+  const ownerPrincipalId = existing?.ownerPrincipalId || genId();
   const createdAt = existing?.createdAt || now().toISOString();
-  const next = { token, signSecret, createdAt };
+  const next = { token, signSecret, ownerPrincipalId, createdAt };
   writeAuthFile(file, next);
   return next;
 }
-function defaultGenerate() {
+function defaultGenerateToken2() {
   return import_node_crypto8.default.randomBytes(32).toString("base64url");
 }
+function defaultGenerateOwnerPrincipalId() {
+  return `owner-${import_node_crypto8.default.randomUUID()}`;
+}
 function readAuthFile(file) {
   try {
     const raw = import_node_fs20.default.readFileSync(file, "utf8");
@@ -27016,6 +28098,7 @@ function readAuthFile(file) {
     return {
       token: parsed.token,
       signSecret: typeof parsed.signSecret === "string" && parsed.signSecret.length > 0 ? parsed.signSecret : void 0,
+      ownerPrincipalId: typeof parsed.ownerPrincipalId === "string" && parsed.ownerPrincipalId.length > 0 ? parsed.ownerPrincipalId : void 0,
       createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0
     };
   } catch (err) {
@@ -27129,10 +28212,63 @@ function forkSession(input) {
   return { forkedToolSessionId, forkedFilePath };
 }
 
+// src/permission/capability.ts
+function matchResource(grant, target) {
+  if (grant.type === "*") return true;
+  if (grant.type !== target.type) return false;
+  if (grant.id === "*") return true;
+  return grant.id === target.id;
+}
+function assertGrant(grants, resource, action) {
+  for (const g2 of grants) {
+    if (!matchResource(g2.resource, resource)) continue;
+    if (g2.actions.includes(action)) return true;
+    if (g2.actions.includes("admin")) return true;
+  }
+  return false;
+}
+
+// src/permission/session-access.ts
+function canAccessSession(ctx, sessionId, action, deps) {
+  if (ctx.principal.kind === "owner") return true;
+  const file = deps.readSession(sessionId);
+  if (!file) return true;
+  return canAccessPersona(ctx.grants, file.ownerPersonaId, action);
+}
+function canAccessPersona(grants, personaId, action) {
+  if (!personaId) return false;
+  const resource = { type: "persona", id: personaId };
+  return assertGrant(grants, resource, action);
+}
+
 // src/handlers/session.ts
+init_protocol();
 function buildSessionHandlers(deps) {
-  const { manager, observer, getAdapter: getAdapter2 } = deps;
-  const create = async (frame) => {
+  const { manager, observer, getAdapter: getAdapter2, store, ownerPrincipalId } = deps;
+  const ensureSessionAccess = (ctx, sessionId, action) => {
+    if (!ctx) return;
+    const ok = canAccessSession(ctx, sessionId, action, {
+      readSession: (sid) => store.read(sid)
+    });
+    if (!ok) {
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} session ${sessionId}`
+      );
+    }
+  };
+  const ensurePersonaAccess = (ctx, personaId, action) => {
+    if (!ctx) return;
+    if (ctx.principal.kind === "owner") return;
+    const ok = canAccessPersona(ctx.grants, personaId, action);
+    if (!ok) {
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${action} on persona:${personaId ?? "<none>"}`
+      );
+    }
+  };
+  const create = async (frame, _client, ctx) => {
     const args = SessionCreateArgs.parse(frame);
     if (args.ownerPersonaId) {
       const persona = deps.personaRegistry.get(args.ownerPersonaId);
@@ -27140,58 +28276,75 @@ function buildSessionHandlers(deps) {
         throw new Error(`persona not found: ${args.ownerPersonaId}`);
       }
     }
-    const { response, broadcast } = manager.create(args);
+    ensurePersonaAccess(ctx, args.ownerPersonaId, "send");
+    const creatorPrincipalId = ctx?.principal.id ?? ownerPrincipalId;
+    const { response, broadcast } = manager.create(args, creatorPrincipalId);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const list = async () => {
+  const list = async (_frame, _client, ctx) => {
     const { response } = manager.list();
+    if (ctx && ctx.principal.kind === "guest") {
+      const sessions = response.sessions ?? [];
+      const capId = ctx.capabilityId;
+      const filtered = sessions.filter((s) => canAccessPersona(ctx.grants, s.ownerPersonaId, "read")).filter((s) => s.creatorPrincipalId === capId);
+      return { response: { type: "session:list", sessions: filtered } };
+    }
     return { response: { type: "session:list", ...response } };
   };
-  const get = async (frame) => {
+  const get = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.get(args);
     return { response: { type: "session:info", ...response } };
   };
-  const update = async (frame) => {
+  const update = async (frame, _client, ctx) => {
     const args = SessionUpdateArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.update(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const del = async (frame) => {
+  const del = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.delete(args);
     return {
       response: { type: "session:deleted", sessionId: args.sessionId },
       broadcast
     };
   };
-  const send = async (frame) => {
+  const send = async (frame, _client, ctx) => {
     const args = SessionSendArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = manager.send(args);
     return { response: { type: "session:send", ok: true }, broadcast };
   };
-  const stop = async (frame) => {
+  const stop = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.stop(args);
     return { response: { type: "session:stop", ok: true }, broadcast };
   };
-  const interrupt = async (frame) => {
+  const interrupt = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { broadcast } = await manager.interrupt(args);
     return { response: { type: "session:interrupt", ok: true }, broadcast };
   };
-  const rewind = async (frame) => {
+  const rewind = async (frame, _client, ctx) => {
     const args = SessionRewindArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.rewind(args);
     return { response: { type: "session:rewind", ...response }, broadcast };
   };
-  const rewindDiff = async (frame) => {
+  const rewindDiff = async (frame, _client, ctx) => {
     const args = SessionRewindDiffArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = await manager.rewindDiff(args);
     return { response: { type: "session:rewind-diff", ...response } };
   };
-  const rewindableMessageIds = async (frame) => {
+  const rewindableMessageIds = async (frame, _client, ctx) => {
     const args = SessionRewindableMessageIdsArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.rewindableMessageIds(args);
     return {
       response: { type: "session:rewindable-message-ids", ...response }
@@ -27202,19 +28355,22 @@ function buildSessionHandlers(deps) {
     const result = forkSession(args);
     return { response: { type: "session:fork", ...result } };
   };
-  const newSession = async (frame) => {
+  const newSession = async (frame, _client, ctx) => {
     const args = SessionIdArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     observer.stop(args.sessionId);
     const { response, broadcast } = manager.newSession(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const resume = async (frame) => {
+  const resume = async (frame, _client, ctx) => {
     const args = SessionResumeArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.resume(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
-  const observe = async (frame) => {
+  const observe = async (frame, _client, ctx) => {
     const args = SessionObserveArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response: file } = manager.get({ sessionId: args.sessionId });
     const sessionFile = file;
     manager.ensureSession(sessionFile);
@@ -27228,14 +28384,17 @@ function buildSessionHandlers(deps) {
     });
     return { response: { type: "session:observe", ok: true } };
   };
-  const events = async (frame) => {
+  const events = async (frame, _client, ctx) => {
     const args = SessionEventsArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "read");
     const { response } = manager.getEvents(args);
     return { response: { type: "session:events", ...response } };
   };
-  const subscribe = async (frame, client) => {
-    if (typeof frame.sessionId === "string")
+  const subscribe = async (frame, client, ctx) => {
+    if (typeof frame.sessionId === "string") {
+      ensureSessionAccess(ctx, frame.sessionId, "read");
       addSubscription(client, frame.sessionId);
+    }
     return {
       response: { type: "subscribed", sessionId: frame.sessionId }
     };
@@ -27247,8 +28406,9 @@ function buildSessionHandlers(deps) {
       response: { type: "unsubscribed", sessionId: frame.sessionId }
     };
   };
-  const pin = async (frame) => {
+  const pin = async (frame, _client, ctx) => {
     const args = SessionPinArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.pin(args);
     return { response: { type: "session:info", ...response }, broadcast };
   };
@@ -27257,13 +28417,15 @@ function buildSessionHandlers(deps) {
     const { response, broadcast } = manager.reorderPins(args);
     return { response: { type: "session:reorderPins", ...response }, broadcast };
   };
-  const answerQuestion = async (frame) => {
+  const answerQuestion = async (frame, _client, ctx) => {
     const args = AnswerQuestionArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = manager.answerQuestion(args);
     return { response: { type: "session:answerQuestion", ...response }, broadcast };
   };
-  const cancelQuestion = async (frame) => {
+  const cancelQuestion = async (frame, _client, ctx) => {
     const args = CancelQuestionArgs.parse(frame);
+    ensureSessionAccess(ctx, args.sessionId, "send");
     const { response, broadcast } = await manager.cancelQuestion(args);
     return { response: { type: "session:cancelQuestion", ...response }, broadcast };
   };
@@ -27358,6 +28520,7 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/handlers/history.ts
+init_protocol();
 function buildHistoryHandlers(deps) {
   const { manager, history, store } = deps;
   const projects = async () => {
@@ -27369,17 +28532,27 @@ function buildHistoryHandlers(deps) {
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
-  const read = async (frame) => {
+  const read = async (frame, _client, ctx) => {
     const args = HistoryReadArgs.parse(frame);
     const { response: file } = manager.get({ sessionId: args.sessionId });
-    if (!file.toolSessionId) {
+    const f = file;
+    if (ctx && ctx.principal.kind === "guest") {
+      const ok = canAccessPersona(ctx.grants, f.ownerPersonaId, "read") && f.creatorPrincipalId === ctx.capabilityId;
+      if (!ok) {
+        throw new ClawdError(
+          ERROR_CODES.UNAUTHORIZED,
+          `principal guest:${ctx.principal.id} cannot read history of session ${args.sessionId}`
+        );
+      }
+    }
+    if (!f.toolSessionId) {
       return {
         response: { type: "history:read", messages: [], total: 0, offset: 0 }
       };
     }
     const res = await history.read({
-      cwd: file.cwd,
-      toolSessionId: file.toolSessionId,
+      cwd: f.cwd,
+      toolSessionId: f.toolSessionId,
       limit: args.limit,
       offset: args.offset
     });
@@ -27561,6 +28734,345 @@ function buildCapabilitiesHandlers(deps) {
   };
 }
 
+// src/handlers/capability.ts
+init_zod();
+init_protocol();
+var DeleteArgsSchema = external_exports.object({
+  capabilityId: external_exports.string().min(1)
+}).strict();
+function buildCapabilityHandlers(deps) {
+  const { manager, getShareBaseUrl } = deps;
+  const issue = async (frame) => {
+    const { type: _type, requestId: _requestId, ...rest } = frame;
+    const args = CapabilityIssueArgsSchema.parse(rest);
+    const { token, capability } = manager.issue({
+      displayName: args.displayName,
+      grants: args.grants,
+      ...args.expiresAt !== void 0 ? { expiresAt: args.expiresAt } : {},
+      ...args.maxUses !== void 0 ? { maxUses: args.maxUses } : {}
+    });
+    const base = getShareBaseUrl().replace(/\/$/, "");
+    const shareUrl = `${base}/?token=${encodeURIComponent(token)}`;
+    return {
+      response: {
+        type: "capability:issued",
+        token,
+        shareUrl,
+        capability: stripSecretHash(capability)
+      }
+    };
+  };
+  const list = async () => {
+    return {
+      response: {
+        type: "capability:list",
+        capabilities: manager.list().map(stripSecretHash)
+      }
+    };
+  };
+  const del = async (frame) => {
+    const { type: _type, requestId: _requestId, ...rest } = frame;
+    const args = DeleteArgsSchema.parse(rest);
+    const result = manager.delete(args.capabilityId);
+    if (!result) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `capability not found: ${args.capabilityId}`
+      );
+    }
+    return {
+      response: {
+        type: "capability:deleted",
+        capabilityId: args.capabilityId
+      }
+    };
+  };
+  const bindPeer = async (frame) => {
+    const { type: _type, requestId: _requestId, ...rest } = frame;
+    const args = CapabilityBindPeerArgsSchema.parse(rest);
+    try {
+      manager.recordPeerHello(args.capabilityId, {
+        ownerPrincipalId: args.peerOwnerId,
+        displayName: args.peerDisplayName,
+        now: Date.now()
+      });
+    } catch (e) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `capability:bindPeer: ${e.message}`
+      );
+    }
+    return {
+      response: { type: "capability:bindPeer:ok", capabilityId: args.capabilityId }
+    };
+  };
+  return {
+    "capability:issue": issue,
+    "capability:list": list,
+    "capability:delete": del,
+    "capability:bindPeer": bindPeer
+  };
+}
+
+// src/handlers/inbox.ts
+init_protocol();
+function resolvePeerOwnerId(ctx, argsPeerOwnerId, capManager) {
+  if (ctx.principal.kind === "owner") {
+    if (!argsPeerOwnerId) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        "inbox: owner ctx requires peerOwnerId"
+      );
+    }
+    return argsPeerOwnerId;
+  }
+  if (!ctx.capabilityId) {
+    throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "inbox: guest ctx missing capabilityId");
+  }
+  const cap = capManager.findById(ctx.capabilityId);
+  if (!cap?.peerOwnerId) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `inbox: guest cap ${ctx.capabilityId} has no peerOwnerId (recordPeerHello not yet)`
+    );
+  }
+  if (argsPeerOwnerId && argsPeerOwnerId !== cap.peerOwnerId) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      `inbox: guest args.peerOwnerId mismatch (cap.peerOwnerId=${cap.peerOwnerId}, args=${argsPeerOwnerId})`
+    );
+  }
+  return cap.peerOwnerId;
+}
+function buildInboxHandlers(deps) {
+  const { manager, capManager } = deps;
+  const postMessage = async (frame, _client, ctx) => {
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = InboxPostMessageArgsSchema.parse(rest);
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:postMessage: missing ConnectionContext");
+    }
+    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
+    const message = manager.postMessage({
+      peerOwnerId,
+      senderPrincipalId: ctx.principal.id,
+      text: args.text,
+      id: args.id,
+      createdAt: args.createdAt
+    });
+    return {
+      response: { type: "inbox:postMessage:ok", message }
+    };
+  };
+  const list = async (frame, _client, ctx) => {
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = InboxListArgsSchema.parse(rest);
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:list: missing ConnectionContext");
+    }
+    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
+    const messages = manager.list(peerOwnerId, args.sinceCreatedAt);
+    return {
+      response: { type: "inbox:list:ok", peerOwnerId, messages }
+    };
+  };
+  const markRead = async (frame, _client, ctx) => {
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = InboxMarkReadArgsSchema.parse(rest);
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "inbox:markRead: missing ConnectionContext");
+    }
+    const peerOwnerId = resolvePeerOwnerId(ctx, args.peerOwnerId, capManager);
+    const updated = manager.markRead({
+      peerOwnerId,
+      principalId: ctx.principal.id,
+      upToCreatedAt: args.upToCreatedAt
+    });
+    return {
+      response: {
+        type: "inbox:markRead:ok",
+        peerOwnerId,
+        upToCreatedAt: args.upToCreatedAt,
+        updated
+      }
+    };
+  };
+  return {
+    "inbox:postMessage": postMessage,
+    "inbox:list": list,
+    "inbox:markRead": markRead
+  };
+}
+
+// src/handlers/received-capability.ts
+init_protocol();
+function ensureOwner(ctx) {
+  if (!ctx || ctx.principal.kind !== "owner") {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      "UNAUTHORIZED: received-capability:* requires owner ctx"
+    );
+  }
+}
+function ensureGuestCtx(ctx) {
+  if (!ctx || ctx.principal.kind !== "guest" || !ctx.capabilityId) {
+    throw new ClawdError(
+      ERROR_CODES.UNAUTHORIZED,
+      "UNAUTHORIZED: received-capability:autoAttach requires guest cap ctx"
+    );
+  }
+}
+function buildReceivedCapabilityHandlers(deps) {
+  const now = deps.now ?? Date.now;
+  const list = async (_frame, _client, ctx) => {
+    ensureOwner(ctx);
+    return {
+      response: {
+        type: "received-capability:list:ok",
+        receivedCaps: deps.store.list()
+      }
+    };
+  };
+  const add = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = ReceivedCapabilityAddArgsSchema.parse(rest);
+    let conn;
+    try {
+      conn = await deps.connectRemote({
+        url: args.remoteUrl,
+        token: args.token,
+        selfPrincipalId: deps.selfPrincipalId(),
+        selfDisplayName: deps.selfDisplayName()
+      });
+    } catch (e) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `INVITE_REMOTE_UNREACHABLE: ${e.message}`
+      );
+    }
+    try {
+      const wh = await conn.whoami();
+      const rc = {
+        ownerPrincipalId: wh.ownerId,
+        ownerDisplayName: wh.displayName,
+        remoteUrl: args.remoteUrl,
+        capabilityId: wh.capabilityId,
+        capabilityToken: args.token,
+        grants: wh.grants,
+        receivedAt: now()
+      };
+      deps.store.upsert(rc);
+      deps.broadcast({ type: "received-capability:added", receivedCap: rc });
+      return {
+        response: { type: "received-capability:add:ok", receivedCap: rc }
+      };
+    } finally {
+      try {
+        conn.close();
+      } catch {
+      }
+    }
+  };
+  const remove = async (frame, _client, ctx) => {
+    ensureOwner(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = ReceivedCapabilityRemoveArgsSchema.parse(rest);
+    deps.store.remove(args.ownerPrincipalId);
+    deps.broadcast({
+      type: "received-capability:removed",
+      ownerPrincipalId: args.ownerPrincipalId
+    });
+    return {
+      response: {
+        type: "received-capability:remove:ok",
+        ownerPrincipalId: args.ownerPrincipalId
+      }
+    };
+  };
+  const autoAttach = async (frame, _client, ctx) => {
+    ensureGuestCtx(ctx);
+    const { type: _t, requestId: _r, ...rest } = frame;
+    const args = ReceivedCapabilityAutoAttachArgsSchema.parse(rest);
+    const rc = {
+      ownerPrincipalId: args.ownerPrincipalId,
+      ownerDisplayName: args.ownerDisplayName,
+      remoteUrl: args.remoteUrl,
+      capabilityId: args.capabilityId,
+      capabilityToken: args.token,
+      grants: args.grants,
+      receivedAt: now()
+    };
+    deps.store.upsert(rc);
+    deps.broadcast({ type: "received-capability:added", receivedCap: rc });
+    return {
+      response: { type: "received-capability:autoAttach:ok" }
+    };
+  };
+  return {
+    "received-capability:list": list,
+    "received-capability:add": add,
+    "received-capability:remove": remove,
+    "received-capability:autoAttach": autoAttach
+  };
+}
+
+// src/handlers/whoami.ts
+init_protocol();
+function buildWhoamiHandler(deps) {
+  return async (_frame, _client, ctx) => {
+    if (!ctx) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "whoami: missing ConnectionContext");
+    }
+    const owner = makeOwnerPrincipal(deps.ownerPrincipalId, deps.ownerDisplayName);
+    let capability;
+    if (ctx.principal.kind === "owner") {
+      capability = {
+        id: deps.ownerPrincipalId,
+        displayName: deps.ownerDisplayName,
+        grants: ctx.grants,
+        issuedAt: 0,
+        usedCount: 0
+      };
+    } else {
+      if (!ctx.capabilityId) {
+        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, "whoami: guest ctx without capabilityId");
+      }
+      const cap = deps.capabilityManager.findById(ctx.capabilityId);
+      if (!cap) {
+        throw new ClawdError(ERROR_CODES.UNAUTHORIZED, `whoami: capability not found: ${ctx.capabilityId}`);
+      }
+      capability = stripSecretHash(cap);
+    }
+    const grantedPersonas = [];
+    const isGuest = ctx.principal.kind === "guest";
+    const hasWildcard = capability.grants.some((g2) => g2.resource.type === "*");
+    if (hasWildcard) {
+      for (const id of deps.personaStore.list()) {
+        const file = deps.personaStore.read(id);
+        if (!file) continue;
+        if (isGuest && !file.public) continue;
+        grantedPersonas.push({ id: file.personaId, displayName: file.label });
+      }
+    } else {
+      for (const g2 of capability.grants) {
+        if (g2.resource.type !== "persona") continue;
+        const file = deps.personaStore.read(g2.resource.id);
+        if (!file) continue;
+        grantedPersonas.push({ id: file.personaId, displayName: file.label });
+      }
+    }
+    return {
+      response: {
+        type: "whoami:ok",
+        owner,
+        capability,
+        grantedPersonas
+      }
+    };
+  };
+}
+
 // src/handlers/meta.ts
 var import_node_os13 = __toESM(require("os"), 1);
 init_protocol();
@@ -27624,9 +29136,14 @@ function buildPersonaHandlers(deps) {
     const persona = personaManager.create(args);
     return { response: { type: "persona:info", ...persona } };
   };
-  const list = async () => {
+  const list = async (_frame, _client, ctx) => {
+    const all = personaRegistry.list();
+    const isGuest = ctx?.principal.kind === "guest";
+    const personas = isGuest ? all.filter(
+      (p2) => p2.public && assertGrant(ctx.grants, { type: "persona", id: p2.personaId }, "read")
+    ) : all;
     return {
-      response: { type: "persona:list", personas: personaRegistry.list() }
+      response: { type: "persona:list", personas }
     };
   };
   const get = async (frame) => {
@@ -27664,26 +29181,12 @@ function buildPersonaHandlers(deps) {
       response: { type: "persona:deleted", personaId: args.personaId }
     };
   };
-  const issueToken = async (frame) => {
-    const args = PersonaIssueTokenArgsSchema.parse(frame);
-    const { token, persona } = personaManager.issueToken(args.personaId, args.label);
-    return {
-      response: { type: "persona:tokenIssued", token, persona }
-    };
-  };
-  const revokeToken = async (frame) => {
-    const args = PersonaRevokeTokenArgsSchema.parse(frame);
-    const persona = personaManager.revokeToken(args.personaId, args.token);
-    return { response: { type: "persona:info", ...persona } };
-  };
   return {
     "persona:create": create,
     "persona:list": list,
     "persona:get": get,
     "persona:update": update,
-    "persona:delete": del,
-    "persona:issueToken": issueToken,
-    "persona:revokeToken": revokeToken
+    "persona:delete": del
   };
 }
 
@@ -27814,23 +29317,11 @@ function buildAttachmentHandlers(deps) {
     const entries = deps.groupFileStore.list(scope, parsed.data.sessionId);
     return { response: { type: "attachment.groupList", entries } };
   };
-  const groupListPersona = async (frame) => {
-    if (!deps.groupFileStore) {
-      throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "groupFileStore not wired");
-    }
-    const parsed = AttachmentGroupListPersonaArgs.safeParse(frame);
-    if (!parsed.success) {
-      throw new ClawdError(ERROR_CODES.VALIDATION_ERROR, parsed.error.message);
-    }
-    const perSession = deps.groupFileStore.listByPersona(parsed.data.personaId);
-    return { response: { type: "attachment.groupListPersona", perSession } };
-  };
   return {
     "attachment.signUrl": signUrl,
     "attachment.groupAdd": groupAdd,
     "attachment.groupRemove": groupRemove,
-    "attachment.groupList": groupList,
-    "attachment.groupListPersona": groupListPersona
+    "attachment.groupList": groupList
   };
 }
 
@@ -27848,10 +29339,136 @@ function buildMethodHandlers(deps) {
       personaManager: deps.personaManager,
       personaRegistry: deps.personaRegistry
     }),
+    ...buildCapabilityHandlers({
+      manager: deps.capabilityManager,
+      getShareBaseUrl: deps.getShareBaseUrl
+    }),
+    ...buildInboxHandlers({
+      manager: deps.inboxManager,
+      capManager: deps.capabilityManager
+    }),
+    ...buildReceivedCapabilityHandlers({
+      store: deps.receivedCapabilityStore,
+      connectRemote: deps.connectRemote,
+      broadcast: deps.broadcastToOwners,
+      selfPrincipalId: () => deps.ownerPrincipalId,
+      selfDisplayName: () => deps.ownerDisplayName
+    }),
+    whoami: buildWhoamiHandler({
+      ownerDisplayName: deps.ownerDisplayName,
+      ownerPrincipalId: deps.ownerPrincipalId,
+      personaStore: deps.personaStore,
+      capabilityManager: deps.capabilityManager
+    }),
     ...deps.attachment ? buildAttachmentHandlers(deps.attachment) : {}
   };
 }
 
+// src/handlers/method-grants.ts
+var ADMIN_ANY = {
+  kind: "fixed",
+  resource: { type: "*" },
+  action: "admin"
+};
+var CAPABILITY_SCOPED = { kind: "capability-scoped" };
+var METHOD_GRANT_MAP = {
+  // ---- public（meta-only，guest 也能调） ----
+  "info": { kind: "public" },
+  "ping": { kind: "public" },
+  // v2 Phase 6: whoami 是身份反查，任何 authed connection (owner / guest) 都能调；
+  // handler 内部按 ctx.principal.kind 决定返回 "合成 owner self capability" 还是
+  // "查 capabilityManager 拿 caller 的 guest capability"。
+  "whoami": { kind: "public" },
+  // ---- capability platform（admin-only，本 PR 新增） ----
+  "capability:issue": ADMIN_ANY,
+  "capability:list": ADMIN_ANY,
+  "capability:delete": ADMIN_ANY,
+  "capability:bindPeer": ADMIN_ANY,
+  // ---- inbox: channel-based IM (capability platform v3) ----
+  // 三条都 'public' — capability 本身就是授权凭证. handler 内额外校验
+  // guest ctx.capabilityId === args.capabilityId, 防 guest 越权操作别的 channel.
+  "inbox:list": { kind: "public" },
+  "inbox:markRead": { kind: "public" },
+  "inbox:postMessage": { kind: "public" },
+  // ---- received-capability:* (bidirectional cap 视角 B 2026-05-23) ----
+  // owner-only: list / add / remove；guest-only: autoAttach (capability 本身是凭证)
+  "received-capability:list": ADMIN_ANY,
+  "received-capability:add": ADMIN_ANY,
+  "received-capability:remove": ADMIN_ANY,
+  "received-capability:autoAttach": { kind: "public" },
+  // ---- session:* / chat:* 业务方法（v2 Phase 8 两层模型）----
+  // dispatcher 不验资源，handler 内按 ctx + frame.args 反查 ownerPersonaId 调 assertGrant。
+  // owner 自动通过（ctx 自带 '*':'admin' grant 一切 match）；guest 在被授权 persona 内可调。
+  "session:create": CAPABILITY_SCOPED,
+  "session:list": CAPABILITY_SCOPED,
+  "session:get": CAPABILITY_SCOPED,
+  "session:update": CAPABILITY_SCOPED,
+  "session:delete": CAPABILITY_SCOPED,
+  "session:send": CAPABILITY_SCOPED,
+  "session:stop": CAPABILITY_SCOPED,
+  "session:interrupt": CAPABILITY_SCOPED,
+  "session:rewind": CAPABILITY_SCOPED,
+  "session:rewind-diff": CAPABILITY_SCOPED,
+  "session:rewindable-message-ids": CAPABILITY_SCOPED,
+  "session:fork": CAPABILITY_SCOPED,
+  "session:new": CAPABILITY_SCOPED,
+  "session:resume": CAPABILITY_SCOPED,
+  "session:observe": CAPABILITY_SCOPED,
+  "session:events": CAPABILITY_SCOPED,
+  "session:subscribe": CAPABILITY_SCOPED,
+  "session:unsubscribe": CAPABILITY_SCOPED,
+  "session:pin": CAPABILITY_SCOPED,
+  "session:reorderPins": ADMIN_ANY,
+  // owner 全局操作，无 personaId 维度
+  "permission:respond": CAPABILITY_SCOPED,
+  "session:answerQuestion": CAPABILITY_SCOPED,
+  "session:cancelQuestion": CAPABILITY_SCOPED,
+  "history:projects": ADMIN_ANY,
+  "history:list": ADMIN_ANY,
+  // history:read 取一条 session 的 CC JSONL 历史。guest 进 persona VM 后必须能读自己
+  // 创建的 session 历史（chat view 加载历史消息走这条），所以下沉到 capability-scoped；
+  // handler 内按 ctx.capabilityId === file.creatorPrincipalId 拦越权。
+  "history:read": CAPABILITY_SCOPED,
+  "history:subagents": ADMIN_ANY,
+  "history:subagent-read": ADMIN_ANY,
+  "history:recentDirs": ADMIN_ANY,
+  "workspace:list": ADMIN_ANY,
+  "workspace:read": ADMIN_ANY,
+  "skills:list": ADMIN_ANY,
+  "agents:list": ADMIN_ANY,
+  "git:root": ADMIN_ANY,
+  "git:branch": ADMIN_ANY,
+  "git:branches": ADMIN_ANY,
+  "capabilities:get": ADMIN_ANY,
+  "persona:create": ADMIN_ANY,
+  // persona:list 下沉到 CAPABILITY_SCOPED：guest 调用合法（用于 People 面板展开
+  // 对方分享的 personas），handler 端按 ctx + persona.public + assertGrant 过滤。
+  "persona:list": CAPABILITY_SCOPED,
+  "persona:get": ADMIN_ANY,
+  "persona:update": ADMIN_ANY,
+  "persona:delete": ADMIN_ANY,
+  "session:pty:input": ADMIN_ANY,
+  "session:pty:resize": ADMIN_ANY,
+  // file-sharing attachment.* RPC：dispatcher 用 admin-only 兜底（wire-level 拦），
+  // 实际只有 owner 能调（personal token 链路 2026-05-21 删除，HTTP Bearer 只识别 owner）
+  "attachment.signUrl": ADMIN_ANY,
+  "attachment.groupAdd": ADMIN_ANY,
+  "attachment.groupRemove": ADMIN_ANY,
+  "attachment.groupList": ADMIN_ANY
+};
+function computeGrantForFrame(method, frame) {
+  const rule = METHOD_GRANT_MAP[method];
+  if (!rule) return { kind: "public" };
+  if (rule.kind === "public") return { kind: "public" };
+  if (rule.kind === "capability-scoped") return { kind: "public" };
+  if (rule.kind === "fixed") {
+    return { kind: "check", resource: rule.resource, action: rule.action };
+  }
+  const picked = rule.pick(frame);
+  if (!picked) return { kind: "public" };
+  return { kind: "check", resource: picked.resource, action: picked.action };
+}
+
 // src/index.ts
 async function startDaemon(config) {
   const logger = createLogger({
@@ -27867,24 +29484,90 @@ async function startDaemon(config) {
   if (pre.status === "stale") {
     logger.warn("stale state file detected, overwriting", { pid: pre.existing.pid });
   }
+  const authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
   let resolvedAuthToken = null;
-  let authFile = null;
   if (config.authToken && config.authToken.trim()) {
     resolvedAuthToken = config.authToken.trim();
   } else if (config.tunnel) {
-    authFile = loadOrCreateAuthFile({ dataDir: config.dataDir });
     resolvedAuthToken = authFile.token;
   }
+  const ownerPrincipalId = authFile.ownerPrincipalId;
+  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const authMode = resolvedAuthToken == null ? "none" : "first-message";
+  migrateLegacyFiles(config.dataDir);
+  const inboxStore = new InboxStore(config.dataDir);
+  const inboxManager = new InboxManager(inboxStore, (_peerOwnerId, frame) => {
+    wsServer?.broadcastToOwners(frame);
+  });
+  const receivedCapabilityStore = new ReceivedCapabilityStore(config.dataDir);
+  receivedCapabilityStore.load();
+  const capabilityStore = new CapabilityStore(config.dataDir);
+  const capabilityRegistry = new CapabilityRegistry(capabilityStore);
+  const capabilityManager = new CapabilityManager(capabilityRegistry, {
+    onIssued: (cap, token) => {
+      wsServer?.broadcastToOwners({
+        type: "capability:tokenIssued",
+        capability: stripSecretHash(cap),
+        token
+      });
+    },
+    onDeleted: (cap) => {
+      const deletedAt = Date.now();
+      wsServer?.broadcastToOwners({
+        type: "capability:tokenDeleted",
+        capabilityId: cap.id,
+        deletedAt
+      });
+      wsServer?.closeConnectionsByCapability(cap.id);
+      const cleanup = cleanupGuestSessionsForCapability(cap, sessionStoreFactory);
+      if (cleanup.removed.length > 0) {
+        logger.info("capability delete cascade: guest sessions removed", {
+          capabilityId: cap.id,
+          removedDirs: cleanup.removed
+        });
+      }
+    }
+  });
+  migrateDropPersonsDir(config.dataDir);
   let wsServer = null;
   const authGate = authMode === "first-message" ? new AuthGate({
     shouldEnforce: buildShouldEnforce({ tunnel: config.tunnel }),
+    // Task 1.7：authenticate 注入路径替代 expectedToken 单 token 比对。
+    // owner 路径 constantTimeEqual 防侧信道；guest 路径走 capabilityRegistry.
     expectedToken: resolvedAuthToken,
+    authenticate: (t, selfPrincipalId, selfDisplayName) => {
+      return authenticate(t, {
+        isOwnerToken: (x) => resolvedAuthToken != null && constantTimeEqual(x, resolvedAuthToken),
+        ownerPrincipalId,
+        ownerDisplayName,
+        capabilityRegistry,
+        selfPrincipalId,
+        selfDisplayName,
+        onGuestHello: (capId, ownerId, name) => {
+          capabilityManager.recordPeerHello(capId, {
+            ownerPrincipalId: ownerId,
+            displayName: name,
+            now: Date.now()
+          });
+        }
+      });
+    },
+    onAuthed: (h, ctx) => wsServer?.attachClientContext(h.id, ctx),
+    buildOwnerContext: () => ownerContext(ownerPrincipalId, ownerDisplayName),
     closeConnection: (h, code, reason) => wsServer?.closeClient(h.id, code, reason),
     sendOk: (h, payload) => wsServer?.sendToClient(h.id, payload)
   }) : null;
   resetRegistry();
-  const store = new SessionStore({ dataDir: config.dataDir });
+  const migrateResult = migrateFlattenSessions({ dataDir: config.dataDir });
+  if (!migrateResult.skipped && (migrateResult.movedBare || migrateResult.movedVmOwner || migrateResult.archivedListener)) {
+    logger.info("sessions migration applied", {
+      movedBare: migrateResult.movedBare,
+      movedVmOwner: migrateResult.movedVmOwner,
+      archivedListener: migrateResult.archivedListener
+    });
+  }
+  const sessionStoreFactory = new SessionStoreFactory({ dataDir: config.dataDir });
+  const store = sessionStoreFactory.forBare();
   const workspace = new WorkspaceBrowser();
   const skills = new SkillsScanner();
   const agents = new AgentsScanner();
@@ -27897,10 +29580,12 @@ async function startDaemon(config) {
   } else {
     logger.warn("persona.seed.skip", { reason: "defaults-root-not-found" });
   }
-  const ownerDisplayName = loadOwnerDisplayName(config.dataDir);
   const groupFileStore = new GroupFileStore({ dataDir: config.dataDir, logger });
   const manager = new SessionManager({
     store,
+    // Phase 2 (capability platform plan §1): factory 注入后 manager.storeFor 走
+    // 新布局派生 (sessions/* + personas/<pid>/.clawd/sessions/owner/*)
+    storeFactory: sessionStoreFactory,
     logger,
     getAdapter,
     historyReader: history,
@@ -27908,6 +29593,7 @@ async function startDaemon(config) {
     personaRoot: import_node_path27.default.join(config.dataDir, "personas"),
     personaStore,
     ownerDisplayName,
+    ownerPrincipalId,
     mode: config.mode,
     broadcastFrame: (frame, target) => {
       if (target === "all") {
@@ -28043,18 +29729,37 @@ async function startDaemon(config) {
       // group RPC + sign 都用：根据 sessionId 反查 scope。owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid)
-    }
+    },
+    // Task 1.9: capability:issue/list/revoke handler 依赖
+    capabilityManager,
+    // v2 Phase 5: capability:issue 返回的 shareUrl 用此 base URL 拼接。
+    // tunnel 拉起后切到反代 wss://... 地址；否则本机 ws://host:port。
+    getShareBaseUrl: () => currentTunnelUrl ?? `ws://${config.host}:${config.port}`,
+    // v2 Phase 6: whoami handler 装在 owner principal.displayName + persona 解析
+    ownerDisplayName,
+    // owner-id stabilization: whoami 用稳定 ownerPrincipalId 替代 'owner' 字面量
+    ownerPrincipalId,
+    personaStore,
+    // capability handler 也用 (capability:issue 走 registry / capability:list)
+    capabilityRegistry,
+    // capability platform v3 inbox: handler 接 manager (post/list/markRead),
+    // cascade 接 store (list 统计 deletedInboxEvents).
+    inboxManager,
+    inboxStore,
+    // bidirectional cap 视角 B: 对方颁给我的 cap 走这个 store
+    receivedCapabilityStore,
+    // received-capability:added / removed broadcast；复用 capability:tokenIssued 同款通路
+    broadcastToOwners: (frame) => wsServer?.broadcastToOwners(frame),
+    // received-capability:add 临时 ws 连远端跑 whoami — 直连 ws (不走 transport listener)
+    connectRemote
   });
   const authResolver = new AuthContextResolver({
-    ownerToken: resolvedAuthToken,
-    personaRegistry
+    ownerToken: resolvedAuthToken
   });
   const httpRouter = createHttpRouter({
     authResolver,
     daemonVersion: version,
     logger,
-    personaStore,
-    groupFileStore,
     sessionStore: store,
     // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
     // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
@@ -28064,6 +29769,8 @@ async function startDaemon(config) {
     host: config.host,
     port: config.port,
     logger,
+    // broadcastToPrincipal 用此 id 路由 owner-targeted 帧（替代字面量 'owner' sentinel）
+    ownerPrincipalId,
     readyFrameBuilder: (ctx) => buildReadyFrame(
       {
         manager,
@@ -28079,6 +29786,29 @@ async function startDaemon(config) {
     ),
     protocolVersion: PROTOCOL_VERSION,
     authGate: authGate ?? void 0,
+    // noAuth 模式下仍验 capability token: 修 capability platform 漏洞 — 远端 client
+    // 用 cap token 连 noAuth daemon 时若无此 hook 会 fallback owner ctx, whoami 错返
+    // capability.id = ownerPrincipalId, 导致 myCapabilityId 写错 → inbox channel 写错.
+    // 命中 cap → attach guest ctx; 空 token / 未命中 → 保持 noAuth 行为 (handler fallback owner).
+    tryVerifyCapabilityToken: (token, selfPrincipalId, selfDisplayName) => {
+      const v2 = capabilityRegistry.verifyToken(token);
+      if (!v2.ok) return null;
+      if (selfPrincipalId && selfDisplayName) {
+        try {
+          capabilityManager.recordPeerHello(v2.capability.id, {
+            ownerPrincipalId: selfPrincipalId,
+            displayName: selfDisplayName,
+            now: Date.now()
+          });
+        } catch {
+        }
+      }
+      return {
+        principal: { id: v2.capability.id, kind: "guest", displayName: v2.capability.displayName },
+        grants: v2.capability.grants,
+        capabilityId: v2.capability.id
+      };
+    },
     // file-sharing HTTP 路由复用 daemon 同端口（spec §5 第 3 条）；router 自己处理 auth + 404
     httpRequestHandler: httpRouter,
     // 订阅成功后给该 client 重放 in-flight pendingQuestions（plan: clawd-question-server-truth）。
@@ -28131,7 +29861,18 @@ async function startDaemon(config) {
     const requestId = typeof frame.requestId === "string" ? frame.requestId : void 0;
     const handler = handlers[type];
     if (!handler) throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, `not implemented: ${type}`);
-    const result = await handler(frame, client);
+    const ctx = wsServer.getClientContext(client.id) ?? ownerContext(ownerPrincipalId, ownerDisplayName);
+    const verdict = computeGrantForFrame(type, frame);
+    if (verdict.kind === "check") {
+      const ok = assertGrant(ctx.grants, verdict.resource, verdict.action);
+      if (!ok) {
+        throw new ClawdError(
+          ERROR_CODES.UNAUTHORIZED,
+          `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${verdict.action} on ${verdict.resource.type}${"id" in verdict.resource ? ":" + verdict.resource.id : ""}`
+        );
+      }
+    }
+    const result = await handler(frame, client, ctx);
     if (requestId && result.response) {
       client.send({ ...result.response, requestId });
     }
@@ -28254,6 +29995,13 @@ ${bar}
     manager
   };
 }
+function migrateDropPersonsDir(dataDir) {
+  const dir = import_node_path27.default.join(dataDir, "persons");
+  try {
+    import_node_fs24.default.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
 
 // src/cli.ts
 async function main() {