@controlflow-ai/daemon 0.1.1 → 0.1.3

package/src/db.ts

@@ -1,10 +1,14 @@
 import { Database, type SQLQueryBindings } from 'bun:sqlite';
 import { createHash, randomBytes } from 'node:crypto';
-import { ensureParentDir } from './config.js';
+import { isAbsolute } from 'node:path';
+import { ensureParentDir, homeDir as defaultPalHomeDir } from './config.js';
 import { runMigrations } from './migrations.js';
 import { artifactExpiry, generateArtifactToken, hashArtifactToken, validateArtifactContent } from './artifacts.js';
+import { storeMessageAttachmentFile, validateMessageAttachment } from './message-attachments.js';
 import { palIdentityHandle } from './provider-identity.js';
-import type { AgentDefinition, AgentRun, AgentSession, AgentValidationResult, Artifact, ArtifactMetadata, ChannelAccount, ChannelConversation, ChannelMessageMapping, ChannelOutboxRecord, Chat, ChatKind, Computer, ComputerAgentAssignment, ComputerConnection, DaemonInstance, LarkAuthorizedUser, LarkGroupRoomMapping, LockProviderEvidence, LockTranscriptMessage, Message, MessageDelivery, MessageType, AgentRoomSubscription, AgentRoomSubscriptionMode, PendingInboundEvent, ProvisionedComputer, ProviderExternalType, ProviderIdentityBinding, PalIdentity, RoomChannel, RoomParticipant, RoomParticipantKind, RoomParticipantSource, RoomProvider, RunAction, RunStatus, TranscriptReadModel, WorkbenchArtifact } from './types.js';
+import type { AgentActivityEvent, AgentActivityKind, AgentDefinition, AgentDeletionImpact, AgentDeletionLarkBindingImpact, AgentDeletionResult, AgentDeletionRoomImpact, AgentPermissionProfile, AgentRun, AgentSession, AgentValidationResult, AgentWorkbench, AgentWorkbenchCollaboration, AgentWorkbenchLarkBinding, AgentWorkbenchRoom, Artifact, ArtifactMetadata, ChannelAccount, ChannelConversation, ChannelMessageMapping, ChannelOutboxRecord, Chat, ChatKind, ChatStatus, Computer, ComputerAgentAssignment, ComputerConnection, ComputerDeletionImpact, ComputerDeletionResult, ComputerWorkload, DaemonInstance, DeliveryContext, EnabledSkill, HeldDraftStatus, HeldMessageDraft, LarkAuthorizedUser, LarkGroupRoomMapping, LockProviderEvidence, LockTranscriptMessage, Message, MessageAttachment, MessageAttachmentKind, MessageAttachmentMetadata, MessageDelivery, MessageType, AgentRoomSubscription, AgentRoomSubscriptionMode, PendingInboundEvent, Project, ProjectAgentDefault, ProjectStatus, ProvisionedComputer, ProviderExternalType, ProviderIdentityBinding, PalIdentity, RoomAgentActivityStatus, RoomChannel, RoomParticipant, RoomParticipantKind, RoomParticipantSource, RoomProvider, RoomReminder, RoomReminderStatus, RoomSavedMessage, RoomMode, RoomSystemEvent, RoomSystemEventActorKind, RoomSystemEventType, RoomTask, RoomTaskStatus, RunAction, RunStatus, SkillBinding, SkillBindingScope, SkillDefinition, SkillSource, TranscriptReadModel, WorkbenchArtifact, WorkflowNode, WorkflowNodeKind, WorkflowNodeStatus, WorkflowRun, WorkflowRunRecord, WorkflowRunStatus } from './types.js';
+import { defaultAgentPermissionProfile, normalizeExtraWritableRoots, validateAgentPermissionProfile, type AgentPermissionProfile as RuntimeAgentPermissionProfile } from './agent-permissions.js';
+import { normalizeAgentAvatar } from './agent-avatar.js';
 
 export const ALL_AGENTS_MENTION = '__pal_all_agents__';
 
@@ -20,6 +24,16 @@ export interface CreateMessageInput {
   channelId?: string | null;
   provider?: RoomProvider;
   mentions?: string[];
+  attachments?: CreateMessageAttachmentInput[];
+}
+
+export interface CreateMessageAttachmentInput {
+  kind: MessageAttachmentKind;
+  mimeType: string;
+  filename?: string | null;
+  content: Uint8Array;
+  sourceProvider?: RoomProvider | null;
+  sourceRef?: string | null;
 }
 
 export interface ListMessagesInput {
@@ -27,10 +41,36 @@ export interface ListMessagesInput {
   chatName?: string;
   parentId?: number | null;
   after?: number;
+  before?: number;
   limit?: number;
   q?: string;
 }
 
+export interface UpdateAgentRoomSubscriptionInput {
+  roomId: string;
+  agent: string;
+  mode: AgentRoomSubscriptionMode;
+  actorKind?: RoomSystemEventActorKind;
+  actorId?: string | null;
+}
+
+export interface RecordRoomSystemEventInput {
+  roomId: string;
+  eventType: RoomSystemEventType;
+  actorKind?: RoomSystemEventActorKind;
+  actorId?: string | null;
+  subjectAgent?: string | null;
+  metadata?: Record<string, unknown> | null;
+  content?: string;
+  deliveryAgents?: string[];
+}
+
+export interface MarkAgentRoomReadInput {
+  roomId: string;
+  agent: string;
+  messageId?: number;
+}
+
 export interface StartRunInput {
   messageId: number;
   agent: string;
@@ -53,6 +93,14 @@ export interface FinishRunInput {
   output?: string;
 }
 
+export interface RecordAgentActivityInput {
+  runId: string;
+  kind: AgentActivityKind;
+  title: string;
+  detail?: string | null;
+  metadata?: Record<string, unknown> | null;
+}
+
 export interface RegisterDaemonInput {
   id?: string;
   name: string;
@@ -85,6 +133,7 @@ export interface ConnectComputerResult {
   computer: Computer;
   connection: ComputerConnection;
   token: string;
+  localControlToken: string;
   daemon: DaemonInstance;
   agents: ComputerAgentAssignment[];
 }
@@ -95,16 +144,155 @@ export interface ProvisionComputerInput {
   packageName?: string;
 }
 
+export interface RegenerateComputerCommandInput {
+  serverUrl?: string;
+  packageName?: string;
+}
+
 export interface CreateDeliveryInput {
   messageId: number;
   agent: string;
 }
 
+function daemonCommandPrefix(input?: string): string {
+  const raw = input?.trim() || 'bun run daemon';
+  if (/\s/.test(raw) || raw.startsWith('./') || raw.startsWith('/') || raw.startsWith('node ')) return raw;
+  return `npx ${raw}`;
+}
+
+function shellValue(value: string): string {
+  if (/^[A-Za-z0-9_./:@-]+$/.test(value)) return value;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+function daemonStartCommand(input: { commandPrefix?: string; serverUrl: string; apiKey: string; name: string }): string {
+  return `PAL_SERVER=${shellValue(input.serverUrl)} PAL_API_KEY=${shellValue(input.apiKey)} ${daemonCommandPrefix(input.commandPrefix)} # ${input.name}`;
+}
+
+export interface CreateHeldMessageDraftInput {
+  chatId: string;
+  agent: string;
+  sender: string;
+  content: string;
+  mentions?: string[];
+  baseMessageId: number;
+  latestMessageIdAtHold: number;
+  holdReason: string;
+}
+
+export interface CreateRoomTasksInput {
+  roomId: string;
+  titles: string[];
+  createdBy?: string | null;
+  sourceMessageId?: number | null;
+}
+
+export interface ClaimRoomTaskInput {
+  roomId: string;
+  taskNumber: number;
+  assignee: string;
+}
+
+export interface UpdateRoomTaskInput {
+  roomId: string;
+  taskNumber: number;
+  status: RoomTaskStatus;
+}
+
+export interface CreateRoomReminderInput {
+  sourceMessageId: number;
+  title: string;
+  createdBy?: string | null;
+  fireAt?: string | null;
+  delaySeconds?: number | null;
+  repeat?: string | null;
+}
+
+export interface ListRoomRemindersInput {
+  roomId?: string | null;
+  status?: RoomReminderStatus | 'all';
+  createdBy?: string | null;
+  limit?: number;
+}
+
+export interface CreateRoomSavedMessageInput {
+  sourceMessageId: number;
+  savedBy: string;
+  note?: string | null;
+}
+
+export interface ListRoomSavedMessagesInput {
+  roomId?: string | null;
+  savedBy?: string | null;
+  limit?: number;
+}
+
+export interface CreateWorkflowRunInput {
+  filePath: string;
+  goal?: string | null;
+  createdBy?: string | null;
+}
+
+export interface FinishWorkflowRunInput {
+  status: WorkflowRunStatus;
+  finalOutput?: Record<string, unknown> | null;
+  error?: string | null;
+}
+
+export interface CreateWorkflowNodeInput {
+  runId: string;
+  parentId?: string | null;
+  kind: WorkflowNodeKind;
+  title: string;
+  role?: string | null;
+  status?: WorkflowNodeStatus;
+  context?: Record<string, unknown> | null;
+  instruction?: string | null;
+  capabilities?: string[];
+  outputContract?: Record<string, unknown> | null;
+  output?: Record<string, unknown> | null;
+  evidence?: Record<string, unknown> | null;
+  taskId?: string | null;
+  messageId?: number | null;
+}
+
+export interface UpdateWorkflowNodeInput {
+  status?: WorkflowNodeStatus;
+  output?: Record<string, unknown> | null;
+  evidence?: Record<string, unknown> | null;
+  taskId?: string | null;
+  messageId?: number | null;
+}
+
+export interface SaveRoomMessageResult {
+  savedMessage: RoomSavedMessage;
+  created: boolean;
+}
+
+export interface FireDueRoomRemindersInput {
+  now?: string | Date | null;
+  limit?: number;
+}
+
+export interface FiredRoomReminder {
+  reminder: RoomReminder;
+  message: Message;
+  deliveries: MessageDelivery[];
+}
+
+export interface FireDueRoomRemindersResult {
+  reminders: RoomReminder[];
+  messages: Message[];
+  deliveries: MessageDelivery[];
+  fired: FiredRoomReminder[];
+}
+
 export interface ClaimDeliveryInput {
   daemonId: string;
   connectionId?: string | null;
   computerId?: string | null;
   leaseMs?: number;
+  steerRunId?: string | null;
 }
 
 export interface FinishDeliveryInput {
@@ -115,6 +303,22 @@ export interface FinishDeliveryInput {
   error?: string;
 }
 
+export interface DeliveryBacklogSummary {
+  agent: string;
+  pending: number;
+  claimed: number;
+  processing_completed: number;
+  expired_active: number;
+}
+
+export interface LarkWebsocketRestartState {
+  app_id: string;
+  restart_count: number;
+  last_restart_at: string | null;
+  last_restart_reason: string | null;
+  updated_at: string;
+}
+
 export interface CreateArtifactInput {
   title?: string;
   filename?: string;
@@ -250,7 +454,7 @@ export interface UpsertRoomParticipantInput {
   source: RoomParticipantSource;
 }
 
-const agentFieldAllowlist = new Set(['id', 'agent_key', 'display_name', 'description', 'runtime', 'created_at', 'updated_at']);
+const agentFieldAllowlist = new Set(['id', 'agent_key', 'display_name', 'description', 'runtime', 'model', 'created_at', 'updated_at']);
 const forbiddenAgentFieldPattern = /provider|adapter|enabled|disabled|status|state|mode|config|capabilities|route|routing|binding|permission|owner|workspace|daemon|delivery|channel|lark|acl|authz/i;
 
 export type ChannelMessageConflictCode =
@@ -313,6 +517,156 @@ function normalizeChatName(name?: string): string {
   return stripped;
 }
 
+const roomTaskStatuses: RoomTaskStatus[] = ['todo', 'in_progress', 'in_review', 'done', 'closed'];
+const roomReminderStatuses: RoomReminderStatus[] = ['scheduled', 'fired', 'canceled'];
+const roomModes: RoomMode[] = ['standard', 'idea_development'];
+const skillSources: SkillSource[] = ['system', 'user', 'project'];
+const skillBindingScopes: SkillBindingScope[] = ['project', 'room', 'agent'];
+const skillStatuses: SkillDefinition['status'][] = ['active', 'disabled'];
+const workflowRunStatuses: WorkflowRunStatus[] = ['running', 'completed', 'failed'];
+const workflowNodeKinds: WorkflowNodeKind[] = ['phase', 'agent', 'task', 'message', 'final'];
+const workflowNodeStatuses: WorkflowNodeStatus[] = ['pending', 'running', 'done', 'failed'];
+
+function assertRoomMode(value: string): RoomMode {
+  if (!roomModes.includes(value as RoomMode)) throw new Error('INVALID_ROOM_MODE');
+  return value as RoomMode;
+}
+
+function assertSkillBindingScope(value: string): SkillBindingScope {
+  if (!skillBindingScopes.includes(value as SkillBindingScope)) throw new Error('INVALID_SKILL_BINDING_SCOPE');
+  return value as SkillBindingScope;
+}
+
+function assertSkillSource(value: string): SkillSource {
+  if (!skillSources.includes(value as SkillSource)) throw new Error('INVALID_SKILL_SOURCE');
+  return value as SkillSource;
+}
+
+function assertSkillStatus(value: string): SkillDefinition['status'] {
+  if (!skillStatuses.includes(value as SkillDefinition['status'])) throw new Error('INVALID_SKILL_STATUS');
+  return value as SkillDefinition['status'];
+}
+
+function assertRoomTaskStatus(value: string): RoomTaskStatus {
+  if (!roomTaskStatuses.includes(value as RoomTaskStatus)) throw new Error('INVALID_TASK_STATUS');
+  return value as RoomTaskStatus;
+}
+
+function assertRoomReminderStatus(value: string): RoomReminderStatus {
+  if (!roomReminderStatuses.includes(value as RoomReminderStatus)) throw new Error('INVALID_REMINDER_STATUS');
+  return value as RoomReminderStatus;
+}
+
+function assertWorkflowRunStatus(value: string): WorkflowRunStatus {
+  if (!workflowRunStatuses.includes(value as WorkflowRunStatus)) throw new Error('INVALID_WORKFLOW_RUN_STATUS');
+  return value as WorkflowRunStatus;
+}
+
+function assertWorkflowNodeKind(value: string): WorkflowNodeKind {
+  if (!workflowNodeKinds.includes(value as WorkflowNodeKind)) throw new Error('INVALID_WORKFLOW_NODE_KIND');
+  return value as WorkflowNodeKind;
+}
+
+function assertWorkflowNodeStatus(value: string): WorkflowNodeStatus {
+  if (!workflowNodeStatuses.includes(value as WorkflowNodeStatus)) throw new Error('INVALID_WORKFLOW_NODE_STATUS');
+  return value as WorkflowNodeStatus;
+}
+
+function jsonRecordOrNull(value: unknown): Record<string, unknown> | null {
+  if (value === null || value === undefined || value === '') return null;
+  try {
+    const parsed = JSON.parse(String(value)) as unknown;
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+    return parsed as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+function jsonStringArray(value: unknown): string[] {
+  if (value === null || value === undefined || value === '') return [];
+  try {
+    const parsed = JSON.parse(String(value)) as unknown;
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((entry): entry is string => typeof entry === 'string');
+  } catch {
+    return [];
+  }
+}
+
+function normalizeReminderFireAt(input: { fireAt?: string | null; delaySeconds?: number | null }): string {
+  if (input.fireAt?.trim()) {
+    const date = new Date(input.fireAt);
+    if (Number.isNaN(date.getTime())) throw new Error('INVALID_REMINDER_TIME');
+    return date.toISOString();
+  }
+  if (input.delaySeconds !== undefined && input.delaySeconds !== null) {
+    if (!Number.isFinite(input.delaySeconds) || input.delaySeconds < 0) throw new Error('INVALID_REMINDER_TIME');
+    return new Date(Date.now() + input.delaySeconds * 1000).toISOString();
+  }
+  throw new Error('INVALID_REMINDER_TIME');
+}
+
+function normalizeReminderFireNow(value?: string | Date | null): string {
+  if (value === undefined || value === null) return new Date().toISOString();
+  const date = value instanceof Date ? value : new Date(value);
+  if (Number.isNaN(date.getTime())) throw new Error('INVALID_REMINDER_TIME');
+  return date.toISOString();
+}
+
+const reminderRepeatAliases = new Map<string, string>([
+  ['hourly', 'every:1h'],
+  ['daily', 'every:1d'],
+  ['weekly', 'every:1w'],
+]);
+
+const reminderRepeatUnitMs: Record<string, number> = {
+  s: 1000,
+  m: 60 * 1000,
+  h: 60 * 60 * 1000,
+  d: 24 * 60 * 60 * 1000,
+  w: 7 * 24 * 60 * 60 * 1000,
+};
+
+function normalizeReminderRepeat(value?: string | null): string | null {
+  const raw = value?.trim().toLowerCase() || '';
+  if (!raw || raw === 'none' || raw === 'off') return null;
+  const aliased = reminderRepeatAliases.get(raw) ?? raw;
+  const match = aliased.match(/^every:(\d+)([smhdw])$/);
+  if (!match) throw new Error('INVALID_REMINDER_REPEAT');
+  const count = Number(match[1]);
+  const unit = match[2]!;
+  if (!Number.isInteger(count) || count < 1) throw new Error('INVALID_REMINDER_REPEAT');
+  return `every:${count}${unit}`;
+}
+
+function reminderRepeatMs(repeat: string): number {
+  const normalized = normalizeReminderRepeat(repeat);
+  if (!normalized) throw new Error('INVALID_REMINDER_REPEAT');
+  const match = normalized.match(/^every:(\d+)([smhdw])$/)!;
+  return Number(match[1]) * reminderRepeatUnitMs[match[2]!]!;
+}
+
+function nextReminderFireAt(reminder: RoomReminder, now: string): string {
+  const fireMs = new Date(reminder.fire_at).getTime();
+  const nowMs = new Date(now).getTime();
+  const intervalMs = reminderRepeatMs(reminder.repeat ?? '');
+  if (Number.isNaN(fireMs) || Number.isNaN(nowMs)) throw new Error('INVALID_REMINDER_TIME');
+  const periods = Math.max(1, Math.floor((nowMs - fireMs) / intervalMs) + 1);
+  return new Date(fireMs + periods * intervalMs).toISOString();
+}
+
+function reminderFireIdempotencyKey(reminder: RoomReminder): string {
+  return reminder.repeat ? `room-reminder:${reminder.id}:fire:${reminder.fire_at}` : `room-reminder:${reminder.id}:fire`;
+}
+
+function reminderFireMessageContent(reminder: RoomReminder, source: Message | null): string {
+  const sourceLine = source
+    ? `Source message #${source.id} from @${source.sender}: ${source.content}`
+    : `Source message #${reminder.source_message_id}`;
+  return `Reminder: ${reminder.title}\n${sourceLine}`;
+}
+
 function parseCapabilities(value: unknown): { topics: 'native' | 'unsupported' } {
   if (typeof value !== 'string') return { topics: 'native' };
   try {
@@ -332,12 +686,32 @@ function generateConnectionToken(): string {
 }
 
 function rowToAgent(row: Record<string, unknown>): AgentDefinition {
+  const agentKey = String(row.agent_key);
+  const displayName = String(row.display_name);
   return {
     id: String(row.id),
-    agent_key: String(row.agent_key),
-    display_name: String(row.display_name),
+    agent_key: agentKey,
+    display_name: displayName,
     description: row.description === null ? null : String(row.description),
     runtime: row.runtime === null ? null : String(row.runtime),
+    model: row.model === null || row.model === undefined ? null : String(row.model),
+    avatar: normalizeAgentAvatar(row.avatar, agentKey, displayName),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+  };
+}
+
+function rowToAgentPermissionProfile(row: Record<string, unknown>): AgentPermissionProfile {
+  let roots: string[] = [];
+  try {
+    roots = normalizeExtraWritableRoots(JSON.parse(String(row.extra_writable_roots_json ?? '[]')));
+  } catch {
+    roots = [];
+  }
+  return {
+    agent_key: String(row.agent_key),
+    filesystem_mode: String(row.filesystem_mode) as AgentPermissionProfile['filesystem_mode'],
+    extra_writable_roots: roots,
     created_at: String(row.created_at),
     updated_at: String(row.updated_at),
   };
@@ -348,6 +722,7 @@ function rowToComputerAgentAssignment(row: Record<string, unknown>): ComputerAge
     agent: String(row.agent),
     display_name: String(row.display_name),
     runtime: row.runtime === null ? null : String(row.runtime),
+    model: row.model === null || row.model === undefined ? null : String(row.model),
     computer_id: String(row.computer_id),
     cwd: String(row.cwd ?? ''),
     status: String(row.status) as ComputerAgentAssignment['status'],
@@ -356,6 +731,71 @@ function rowToComputerAgentAssignment(row: Record<string, unknown>): ComputerAge
   };
 }
 
+function rowToProject(row: Record<string, unknown>): Project {
+  return {
+    id: String(row.id),
+    name: String(row.name),
+    computer_id: String(row.computer_id),
+    computer_name: row.computer_name === null || row.computer_name === undefined ? null : String(row.computer_name),
+    root_path: String(row.root_path),
+    status: row.status === null || row.status === undefined ? 'active' : String(row.status) as Project['status'],
+    room_count: Number(row.room_count ?? 0),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+  };
+}
+
+function rowToProjectAgentDefault(row: Record<string, unknown>): ProjectAgentDefault {
+  return {
+    id: String(row.id),
+    project_id: String(row.project_id),
+    agent: String(row.agent),
+    display_name: row.display_name === null || row.display_name === undefined ? null : String(row.display_name),
+    mode: String(row.mode) as AgentRoomSubscriptionMode,
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+  };
+}
+
+function rowToSkillDefinition(row: Record<string, unknown>): SkillDefinition {
+  return {
+    key: String(row.key),
+    name: String(row.name),
+    description: String(row.description),
+    instruction_content: String(row.instruction_content),
+    status: String(row.status) as SkillDefinition['status'],
+    version: String(row.version),
+    source: String(row.source ?? 'system') as SkillSource,
+    owner_user_id: row.owner_user_id === null || row.owner_user_id === undefined ? null : String(row.owner_user_id),
+    project_id: row.project_id === null || row.project_id === undefined ? null : String(row.project_id),
+    repository_path: row.repository_path === null || row.repository_path === undefined ? null : String(row.repository_path),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+  };
+}
+
+function rowToSkillBinding(row: Record<string, unknown>): SkillBinding {
+  return {
+    id: String(row.id),
+    scope: String(row.scope) as SkillBindingScope,
+    scope_id: String(row.scope_id),
+    skill_key: String(row.skill_key),
+    enabled: Number(row.enabled) === 1,
+    priority: Number(row.priority),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+  };
+}
+
+function rowToEnabledSkill(row: Record<string, unknown>): EnabledSkill {
+  return {
+    ...rowToSkillDefinition(row),
+    binding_scope: String(row.binding_scope) as SkillBindingScope,
+    binding_scope_id: String(row.binding_scope_id),
+    binding_priority: Number(row.binding_priority),
+  };
+}
+
 function rowToMessage(row: Record<string, unknown>): Message {
   return {
     id: Number(row.id),
@@ -372,6 +812,161 @@ function rowToMessage(row: Record<string, unknown>): Message {
     channel_id: row.channel_id === null || row.channel_id === undefined ? null : String(row.channel_id),
     provider: row.provider === null || row.provider === undefined ? undefined : String(row.provider) as RoomProvider,
     mentions: parseMentionsJson(row.mentions_json),
+    attachments: [],
+  };
+}
+
+function rowToRoomSystemEvent(row: Record<string, unknown>): RoomSystemEvent {
+  let metadata: Record<string, unknown> = {};
+  try {
+    const parsed = JSON.parse(String(row.metadata_json ?? '{}')) as unknown;
+    metadata = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed as Record<string, unknown> : {};
+  } catch {
+    metadata = {};
+  }
+  return {
+    id: String(row.id),
+    room_id: String(row.room_id),
+    message_id: Number(row.message_id),
+    event_type: String(row.event_type) as RoomSystemEventType,
+    actor_kind: String(row.actor_kind) as RoomSystemEventActorKind,
+    actor_id: row.actor_id === null || row.actor_id === undefined ? null : String(row.actor_id),
+    subject_agent: row.subject_agent === null || row.subject_agent === undefined ? null : String(row.subject_agent),
+    metadata,
+    created_at: String(row.created_at),
+  };
+}
+
+function rowToMessageAttachmentMetadata(row: Record<string, unknown>): MessageAttachmentMetadata {
+  return {
+    id: String(row.id),
+    message_id: Number(row.message_id),
+    kind: String(row.kind) as MessageAttachmentKind,
+    mime_type: String(row.mime_type),
+    filename: String(row.filename ?? ''),
+    size_bytes: Number(row.size_bytes),
+    path: String(row.path ?? ''),
+    source_provider: row.source_provider === null || row.source_provider === undefined ? null : String(row.source_provider) as RoomProvider,
+    created_at: String(row.created_at),
+  };
+}
+
+function rowToMessageAttachment(row: Record<string, unknown>): MessageAttachment {
+  return {
+    ...rowToMessageAttachmentMetadata(row),
+    source_ref: row.source_ref === null || row.source_ref === undefined ? null : String(row.source_ref),
+  };
+}
+
+function rowToHeldMessageDraft(row: Record<string, unknown>): HeldMessageDraft {
+  return {
+    id: String(row.id),
+    chat_id: String(row.chat_id),
+    chat_name: String(row.chat_name ?? ''),
+    chat_display_name: row.chat_display_name === null || row.chat_display_name === undefined ? null : String(row.chat_display_name),
+    agent: String(row.agent),
+    sender: String(row.sender),
+    content: String(row.content),
+    mentions: parseMentionsJson(row.mentions_json),
+    base_message_id: Number(row.base_message_id),
+    latest_message_id_at_hold: Number(row.latest_message_id_at_hold),
+    status: String(row.status) as HeldDraftStatus,
+    hold_reason: String(row.hold_reason),
+    hold_count: Number(row.hold_count),
+    intervening_message_count: Number(row.intervening_message_count ?? 0),
+    resolved_message_id: row.resolved_message_id === null || row.resolved_message_id === undefined ? null : Number(row.resolved_message_id),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+    resolved_at: row.resolved_at === null || row.resolved_at === undefined ? null : String(row.resolved_at),
+  };
+}
+
+function rowToRoomTask(row: Record<string, unknown>): RoomTask {
+  return {
+    id: String(row.id),
+    room_id: String(row.room_id),
+    room_name: String(row.room_name ?? ''),
+    task_number: Number(row.task_number),
+    title: String(row.title),
+    status: String(row.status) as RoomTaskStatus,
+    assignee: row.assignee === null || row.assignee === undefined ? null : String(row.assignee),
+    created_by: row.created_by === null || row.created_by === undefined ? null : String(row.created_by),
+    source_message_id: row.source_message_id === null || row.source_message_id === undefined ? null : Number(row.source_message_id),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+    completed_at: row.completed_at === null || row.completed_at === undefined ? null : String(row.completed_at),
+  };
+}
+
+function rowToRoomReminder(row: Record<string, unknown>): RoomReminder {
+  return {
+    id: String(row.id),
+    room_id: String(row.room_id),
+    room_name: String(row.room_name ?? ''),
+    source_message_id: Number(row.source_message_id),
+    title: String(row.title),
+    status: String(row.status) as RoomReminderStatus,
+    created_by: row.created_by === null || row.created_by === undefined ? null : String(row.created_by),
+    fire_at: String(row.fire_at),
+    repeat: row.repeat === null || row.repeat === undefined ? null : String(row.repeat),
+    fired_at: row.fired_at === null || row.fired_at === undefined ? null : String(row.fired_at),
+    canceled_at: row.canceled_at === null || row.canceled_at === undefined ? null : String(row.canceled_at),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+  };
+}
+
+function rowToRoomSavedMessage(row: Record<string, unknown>): RoomSavedMessage {
+  return {
+    id: String(row.id),
+    room_id: String(row.room_id),
+    room_name: String(row.room_name ?? ''),
+    message_id: Number(row.message_id),
+    message_sender: String(row.message_sender),
+    message_content: String(row.message_content),
+    message_created_at: String(row.message_created_at),
+    saved_by: String(row.saved_by),
+    note: row.note === null || row.note === undefined ? null : String(row.note),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+  };
+}
+
+function rowToWorkflowRun(row: Record<string, unknown>): WorkflowRun {
+  return {
+    id: String(row.id),
+    file_path: String(row.file_path),
+    goal: row.goal === null || row.goal === undefined ? null : String(row.goal),
+    status: String(row.status) as WorkflowRunStatus,
+    created_by: row.created_by === null || row.created_by === undefined ? null : String(row.created_by),
+    final_output: jsonRecordOrNull(row.final_output_json),
+    error: row.error === null || row.error === undefined ? null : String(row.error),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+    completed_at: row.completed_at === null || row.completed_at === undefined ? null : String(row.completed_at),
+  };
+}
+
+function rowToWorkflowNode(row: Record<string, unknown>): WorkflowNode {
+  return {
+    id: String(row.id),
+    run_id: String(row.run_id),
+    parent_id: row.parent_id === null || row.parent_id === undefined ? null : String(row.parent_id),
+    kind: String(row.kind) as WorkflowNodeKind,
+    title: String(row.title),
+    role: row.role === null || row.role === undefined ? null : String(row.role),
+    status: String(row.status) as WorkflowNodeStatus,
+    context: jsonRecordOrNull(row.context_json),
+    instruction: row.instruction === null || row.instruction === undefined ? null : String(row.instruction),
+    capabilities: jsonStringArray(row.capabilities_json),
+    output_contract: jsonRecordOrNull(row.output_contract_json),
+    output: jsonRecordOrNull(row.output_json),
+    evidence: jsonRecordOrNull(row.evidence_json),
+    task_id: row.task_id === null || row.task_id === undefined ? null : String(row.task_id),
+    message_id: row.message_id === null || row.message_id === undefined ? null : Number(row.message_id),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at),
+    completed_at: row.completed_at === null || row.completed_at === undefined ? null : String(row.completed_at),
   };
 }
 
@@ -401,6 +996,28 @@ function rowToRun(row: Record<string, unknown>): AgentRun {
   };
 }
 
+function rowToActivityEvent(row: Record<string, unknown>): AgentActivityEvent {
+  let metadata: Record<string, unknown> = {};
+  try {
+    const parsed = JSON.parse(String(row.metadata ?? '{}')) as unknown;
+    metadata = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed as Record<string, unknown> : {};
+  } catch {
+    metadata = {};
+  }
+  return {
+    id: String(row.id),
+    run_id: String(row.run_id),
+    session_id: row.session_id === null || row.session_id === undefined ? null : String(row.session_id),
+    agent: String(row.agent),
+    room_id: String(row.room_id ?? row.chat_id),
+    kind: String(row.kind) as AgentActivityKind,
+    title: String(row.title),
+    detail: String(row.detail ?? ''),
+    metadata,
+    created_at: String(row.created_at),
+  };
+}
+
 function rowToSession(row: Record<string, unknown>): AgentSession {
   return {
     id: String(row.id),
@@ -460,6 +1077,7 @@ function rowToDelivery(row: Record<string, unknown>): MessageDelivery {
     id: String(row.id),
     message_id: Number(row.message_id),
     chat_id: String(row.chat_id),
+    ...(row.chat_name === undefined ? {} : { chat_name: row.chat_name === null ? null : String(row.chat_name) }),
     agent: String(row.agent),
     status: String(row.status) as MessageDelivery['status'],
     daemon_id: row.daemon_id === null ? null : String(row.daemon_id),
@@ -603,6 +1221,8 @@ function rowToAgentRoomSubscription(row: Record<string, unknown>): AgentRoomSubs
     room_id: String(row.room_id),
     channel_id: row.channel_id === null || row.channel_id === undefined ? null : String(row.channel_id),
     mode: String(row.mode) as AgentRoomSubscriptionMode,
+    last_read_message_id: row.last_read_message_id === null || row.last_read_message_id === undefined ? 0 : Number(row.last_read_message_id),
+    last_read_at: row.last_read_at === null || row.last_read_at === undefined ? null : String(row.last_read_at),
     created_at: String(row.created_at),
     updated_at: String(row.updated_at),
   };
@@ -703,7 +1323,41 @@ function normalizeMentionsInput(value: string[] | undefined): string[] {
     seen.add(trimmed);
     result.push(trimmed);
   }
-  return result;
+  return result;
+}
+
+function normalizeSystemEventActorKind(value?: RoomSystemEventActorKind): RoomSystemEventActorKind {
+  if (value === 'user' || value === 'agent' || value === 'system') return value;
+  return 'system';
+}
+
+function normalizeSystemEventMetadata(value?: Record<string, unknown> | null): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  return value;
+}
+
+function systemEventContent(input: {
+  eventType: RoomSystemEventType;
+  actorKind: RoomSystemEventActorKind;
+  actorId: string | null;
+  subjectAgent: string | null;
+  metadata: Record<string, unknown>;
+}): string {
+  const actor = input.actorId ? ` by ${input.actorKind}:${input.actorId}` : '';
+  const agent = input.subjectAgent ? `@${input.subjectAgent}` : 'An agent';
+  switch (input.eventType) {
+    case 'agent_invited': {
+      const mode = typeof input.metadata.mode === 'string' ? input.metadata.mode : 'mentions';
+      return `System event: ${agent} was invited to this room with receive mode "${mode}"${actor}.`;
+    }
+    case 'agent_removed':
+      return `System event: ${agent} was removed from this room${actor}.`;
+    case 'agent_receive_mode_changed': {
+      const oldMode = typeof input.metadata.old_mode === 'string' ? input.metadata.old_mode : 'unknown';
+      const newMode = typeof input.metadata.new_mode === 'string' ? input.metadata.new_mode : 'unknown';
+      return `System event: ${agent} changed room receive mode from "${oldMode}" to "${newMode}"${actor}.`;
+    }
+  }
 }
 
 function rowToTranscriptReadModel(row: Record<string, unknown>): TranscriptReadModel {
@@ -788,8 +1442,10 @@ function limitValue(value: number | undefined, fallback: number): number {
 
 export class MessageStore {
   readonly db: Database;
+  private readonly palHome: string;
 
-  constructor(path: string) {
+  constructor(path: string, options: { palHome?: string } = {}) {
+    this.palHome = options.palHome ?? defaultPalHomeDir();
     ensureParentDir(path);
     this.db = new Database(path);
     this.db.exec('PRAGMA journal_mode = WAL');
@@ -802,6 +1458,43 @@ export class MessageStore {
     this.db.close();
   }
 
+  getLarkWebsocketRestartState(appId: string): LarkWebsocketRestartState | null {
+    const key = appId.trim();
+    if (!key) return null;
+    const row = this.db.query(`
+      SELECT app_id, restart_count, last_restart_at, last_restart_reason, updated_at
+      FROM lark_websocket_restart_state
+      WHERE app_id = ?
+      LIMIT 1
+    `).get(key) as LarkWebsocketRestartState | null;
+    if (!row) return null;
+    return {
+      app_id: String(row.app_id),
+      restart_count: Number(row.restart_count),
+      last_restart_at: row.last_restart_at === null ? null : String(row.last_restart_at),
+      last_restart_reason: row.last_restart_reason === null ? null : String(row.last_restart_reason),
+      updated_at: String(row.updated_at),
+    };
+  }
+
+  recordLarkWebsocketRestart(input: { appId: string; restartedAt: string; reason: string }): LarkWebsocketRestartState {
+    const appId = input.appId.trim();
+    if (!appId) throw new Error('appId is required');
+    const restartedAt = input.restartedAt.trim();
+    if (!restartedAt) throw new Error('restartedAt is required');
+    const reason = input.reason.trim() || 'unknown';
+    this.db.query(`
+      INSERT INTO lark_websocket_restart_state (app_id, restart_count, last_restart_at, last_restart_reason, updated_at)
+      VALUES (?, 1, ?, ?, datetime('now'))
+      ON CONFLICT(app_id) DO UPDATE SET
+        restart_count = lark_websocket_restart_state.restart_count + 1,
+        last_restart_at = excluded.last_restart_at,
+        last_restart_reason = excluded.last_restart_reason,
+        updated_at = datetime('now')
+    `).run(appId, restartedAt, reason);
+    return this.getLarkWebsocketRestartState(appId)!;
+  }
+
   getOrCreateChat(name: string, kind: ChatKind = 'group'): Chat {
     const chatName = normalizeChatName(name);
     const existing = this.db.query('SELECT * FROM chat_stats WHERE name = ?').get(chatName) as Chat | null;
@@ -812,6 +1505,448 @@ export class MessageStore {
     return this.getChatById(id)!;
   }
 
+  createProject(input: { name: string; computerId: string; rootPath: string }): Project {
+    const name = input.name.trim();
+    const computerId = input.computerId.trim();
+    const rootPath = input.rootPath.trim();
+    if (!name) throw new Error('project name is required');
+    if (!computerId) throw new Error('computer_id is required');
+    if (!rootPath) throw new Error('root_path is required');
+    if (!isAbsolute(rootPath)) throw new Error('root_path must be absolute');
+    const computer = this.getComputer(computerId);
+    if (!computer) throw new Error(`computer ${computerId} not found`);
+
+    const id = crypto.randomUUID();
+    this.db.query(`
+      INSERT INTO projects (id, name, computer_id, root_path, created_at, updated_at)
+      VALUES (?, ?, ?, ?, datetime('now'), datetime('now'))
+    `).run(id, name, computerId, rootPath);
+    return this.getProject(id)!;
+  }
+
+  deleteProject(projectId: string): Project | null {
+    const project = this.getProject(projectId);
+    if (!project) return null;
+    if (project.status !== 'archived') throw new Error('PROJECT_NOT_ARCHIVED: project must be archived before deletion');
+    this.db.transaction(() => {
+      this.db.query('DELETE FROM chats WHERE project_id = ?').run(project.id);
+      this.db.query('DELETE FROM projects WHERE id = ?').run(project.id);
+    })();
+    return project;
+  }
+
+  getOrCreateAgentDm(agentKey: string): Chat {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent is required');
+    const agent = this.getAgent(key);
+    if (!agent) throw new Error(`agent ${key} not found`);
+    const chatName = normalizeChatName(`dm-owner-${key}`);
+    const existing = this.getChatByName(chatName);
+    if (existing && (existing.provider !== 'web' || existing.kind !== 'dm')) {
+      throw new Error(`room ${chatName} already exists and is not a web DM`);
+    }
+
+    let room = existing;
+    if (!room) {
+      const id = crypto.randomUUID();
+      this.db.query(`
+        INSERT INTO chats (id, name, display_name, kind, provider, dm_type, capabilities_json)
+        VALUES (?, ?, ?, 'dm', 'web', 'user_agent', '{"topics":"unsupported"}')
+      `).run(id, chatName, agent.display_name);
+      room = this.getChatById(id)!;
+    } else {
+      this.db.query(`
+        UPDATE chats
+        SET display_name = ?, status = 'active'
+        WHERE id = ?
+      `).run(agent.display_name, room.id);
+      room = this.getChatById(room.id)!;
+    }
+
+    this.inviteAgentToRoom({ roomId: room.id, agent: key, mode: 'all' });
+    return this.getChatById(room.id)!;
+  }
+
+  getProject(id: string): Project | null {
+    const row = this.db.query(`
+      SELECT p.*, c.name AS computer_name, COUNT(ch.id) AS room_count
+      FROM projects p
+      LEFT JOIN computers c ON c.id = p.computer_id
+      LEFT JOIN chats ch ON ch.project_id = p.id
+      WHERE p.id = ?
+      GROUP BY p.id
+    `).get(id.trim()) as Record<string, unknown> | null;
+    return row ? rowToProject(row) : null;
+  }
+
+  private getWorkbenchProjectForAgent(agentKey: string, assignment: ComputerAgentAssignment | null): Project | null {
+    const roomProject = this.db.query(`
+      SELECT p.*, c.name AS computer_name, COUNT(ch.id) AS room_count
+      FROM room_participants rp
+      JOIN chats agent_room ON agent_room.id = rp.room_id
+      JOIN projects p ON p.id = agent_room.project_id
+      LEFT JOIN computers c ON c.id = p.computer_id
+      LEFT JOIN chats ch ON ch.project_id = p.id
+      WHERE rp.participant_id = ? AND rp.kind = 'agent' AND rp.status = 'active' AND p.status = 'active'
+      GROUP BY p.id
+      ORDER BY datetime(p.updated_at) DESC, p.name ASC
+      LIMIT 1
+    `).get(agentKey.trim()) as Record<string, unknown> | null;
+    if (roomProject) return rowToProject(roomProject);
+    if (!assignment) return null;
+    const assignedProject = this.db.query(`
+      SELECT p.*, c.name AS computer_name, COUNT(ch.id) AS room_count
+      FROM projects p
+      LEFT JOIN computers c ON c.id = p.computer_id
+      LEFT JOIN chats ch ON ch.project_id = p.id
+      WHERE p.computer_id = ? AND p.status = 'active'
+      GROUP BY p.id
+      ORDER BY datetime(p.updated_at) DESC, p.name ASC
+      LIMIT 1
+    `).get(assignment.computer_id) as Record<string, unknown> | null;
+    return assignedProject ? rowToProject(assignedProject) : null;
+  }
+
+  listProjects(limit = 50): Project[] {
+    const rows = this.db.query(`
+      SELECT p.*, c.name AS computer_name, COUNT(ch.id) AS room_count
+      FROM projects p
+      LEFT JOIN computers c ON c.id = p.computer_id
+      LEFT JOIN chats ch ON ch.project_id = p.id
+      GROUP BY p.id
+      ORDER BY p.updated_at DESC, p.created_at DESC
+      LIMIT ?
+    `).all(limitValue(limit, 50)) as Record<string, unknown>[];
+    return rows.map(rowToProject);
+  }
+
+  listProjectsForComputer(computerId: string): Project[] {
+    const rows = this.db.query(`
+      SELECT p.*, c.name AS computer_name, COUNT(ch.id) AS room_count
+      FROM projects p
+      LEFT JOIN computers c ON c.id = p.computer_id
+      LEFT JOIN chats ch ON ch.project_id = p.id
+      WHERE p.computer_id = ?
+      GROUP BY p.id
+      ORDER BY p.status ASC, p.updated_at DESC, p.created_at DESC
+    `).all(computerId.trim()) as Record<string, unknown>[];
+    return rows.map(rowToProject);
+  }
+
+  updateProjectStatus(projectId: string, status: ProjectStatus): Project {
+    if (status !== 'active' && status !== 'archived') throw new Error('project status must be active or archived');
+    const project = this.getProject(projectId);
+    if (!project) throw new Error(`project ${projectId} was not found`);
+    this.db.query(`UPDATE projects SET status = ?, updated_at = datetime('now') WHERE id = ?`).run(status, project.id);
+    return this.getProject(project.id)!;
+  }
+
+  listProjectAgentDefaults(projectId: string): ProjectAgentDefault[] {
+    const project = this.getProject(projectId);
+    if (!project) throw new Error(`project ${projectId} was not found`);
+    const rows = this.db.query(`
+      SELECT pad.*, a.display_name
+      FROM project_agent_defaults pad
+      LEFT JOIN agents a ON a.agent_key = pad.agent
+      WHERE pad.project_id = ?
+      ORDER BY pad.agent ASC
+    `).all(project.id) as Record<string, unknown>[];
+    return rows.map(rowToProjectAgentDefault);
+  }
+
+  setProjectAgentDefaults(projectId: string, defaults: Array<{ agent: string; mode: AgentRoomSubscriptionMode }>): ProjectAgentDefault[] {
+    const project = this.getProject(projectId);
+    if (!project) throw new Error(`project ${projectId} was not found`);
+    const normalized = new Map<string, AgentRoomSubscriptionMode>();
+    for (const item of defaults) {
+      const agent = item.agent.trim();
+      if (!agent) continue;
+      if (!this.getAgent(agent)) throw new Error(`agent ${agent} not found`);
+      normalized.set(agent, item.mode);
+    }
+
+    this.db.transaction(() => {
+      const agents = [...normalized.keys()];
+      if (agents.length) {
+        const placeholders = agents.map(() => '?').join(', ');
+        this.db.query(`DELETE FROM project_agent_defaults WHERE project_id = ? AND agent NOT IN (${placeholders})`).run(project.id, ...agents);
+      } else {
+        this.db.query(`DELETE FROM project_agent_defaults WHERE project_id = ?`).run(project.id);
+      }
+      for (const [agent, mode] of normalized) {
+        this.db.query(`
+          INSERT INTO project_agent_defaults (id, project_id, agent, mode, created_at, updated_at)
+          VALUES (?, ?, ?, ?, datetime('now'), datetime('now'))
+          ON CONFLICT(project_id, agent) DO UPDATE SET
+            mode = excluded.mode,
+            updated_at = datetime('now')
+        `).run(crypto.randomUUID(), project.id, agent, mode);
+      }
+      this.db.query(`UPDATE projects SET updated_at = datetime('now') WHERE id = ?`).run(project.id);
+    })();
+
+    return this.listProjectAgentDefaults(project.id);
+  }
+
+  getSkillDefinition(key: string): SkillDefinition | null {
+    const row = this.db.query('SELECT * FROM skill_definitions WHERE key = ?').get(key.trim()) as Record<string, unknown> | null;
+    return row ? rowToSkillDefinition(row) : null;
+  }
+
+  listSkillDefinitions(input: { source?: SkillSource; ownerUserId?: string | null; projectId?: string | null; includeDisabled?: boolean } = {}): SkillDefinition[] {
+    const where: string[] = [];
+    const params: SQLQueryBindings[] = [];
+    if (input.source) {
+      where.push('source = ?');
+      params.push(assertSkillSource(input.source));
+    }
+    if (input.ownerUserId !== undefined) {
+      if (input.ownerUserId === null) {
+        where.push('owner_user_id IS NULL');
+      } else {
+        where.push('owner_user_id = ?');
+        params.push(input.ownerUserId.trim());
+      }
+    }
+    if (input.projectId !== undefined) {
+      if (input.projectId === null) {
+        where.push('project_id IS NULL');
+      } else {
+        where.push('project_id = ?');
+        params.push(input.projectId.trim());
+      }
+    }
+    if (!input.includeDisabled) where.push("status = 'active'");
+    const rows = this.db.query(`
+      SELECT * FROM skill_definitions
+      ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+      ORDER BY source ASC, owner_user_id ASC, project_id ASC, key ASC
+    `).all(...params) as Record<string, unknown>[];
+    return rows.map(rowToSkillDefinition);
+  }
+
+  upsertSkillDefinition(input: {
+    key: string;
+    name: string;
+    description?: string;
+    instructionContent: string;
+    status?: SkillDefinition['status'];
+    version?: string;
+    source?: SkillSource;
+    ownerUserId?: string | null;
+    projectId?: string | null;
+    repositoryPath?: string | null;
+  }): SkillDefinition {
+    const key = input.key.trim();
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{1,80}$/.test(key)) throw new Error('INVALID_SKILL_KEY');
+    const name = input.name.trim();
+    if (!name) throw new Error('skill name is required');
+    const instructionContent = input.instructionContent.trim();
+    if (!instructionContent) throw new Error('skill instruction_content is required');
+    const source = assertSkillSource(input.source ?? 'user');
+    const status = assertSkillStatus(input.status ?? 'active');
+    const version = input.version?.trim() || '1';
+    const ownerUserId = input.ownerUserId?.trim() || null;
+    const projectId = input.projectId?.trim() || null;
+    if (source === 'user' && !ownerUserId) throw new Error('owner_user_id is required for user skills');
+    if (source === 'project' && !projectId) throw new Error('project_id is required for project skills');
+    const repositoryPath = input.repositoryPath?.trim() || (source === 'user' ? `user/${ownerUserId}/${key}` : source === 'project' ? `project/${projectId}/${key}` : null);
+    const existing = this.getSkillDefinition(key);
+    if (existing) {
+      if (existing.source !== source) throw new Error('SKILL_SOURCE_IMMUTABLE');
+      if (existing.source === 'system' && (ownerUserId || projectId || repositoryPath)) {
+        throw new Error('SYSTEM_SKILL_OWNERSHIP_IMMUTABLE');
+      }
+      if (existing.source === 'user' && existing.owner_user_id !== ownerUserId) throw new Error('SKILL_OWNER_IMMUTABLE');
+      if (existing.source === 'project' && existing.project_id !== projectId) throw new Error('SKILL_PROJECT_IMMUTABLE');
+    }
+    this.db.query(`
+      INSERT INTO skill_definitions (
+        key, name, description, instruction_content, status, version, source, owner_user_id, project_id, repository_path, created_at, updated_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+      ON CONFLICT(key) DO UPDATE SET
+        name = excluded.name,
+        description = excluded.description,
+        instruction_content = excluded.instruction_content,
+        status = excluded.status,
+        version = excluded.version,
+        source = excluded.source,
+        owner_user_id = excluded.owner_user_id,
+        project_id = excluded.project_id,
+        repository_path = excluded.repository_path,
+        updated_at = datetime('now')
+    `).run(
+      key,
+      name,
+      input.description?.trim() || '',
+      instructionContent,
+      status,
+      version,
+      source,
+      ownerUserId,
+      projectId,
+      repositoryPath,
+    );
+    const skill = this.getSkillDefinition(key);
+    if (!skill) throw new Error('SKILL_NOT_FOUND');
+    return skill;
+  }
+
+  createSkillDefinition(input: {
+    key: string;
+    name: string;
+    description?: string;
+    instructionContent: string;
+    status?: SkillDefinition['status'];
+    source?: SkillSource;
+    ownerUserId?: string | null;
+    projectId?: string | null;
+    repositoryPath?: string | null;
+  }): SkillDefinition {
+    const key = input.key.trim();
+    if (this.getSkillDefinition(key)) throw new Error('SKILL_ALREADY_EXISTS');
+    if ((input.source ?? 'user') === 'system') throw new Error('SYSTEM_SKILL_CREATE_FORBIDDEN');
+    return this.upsertSkillDefinition(input);
+  }
+
+  updateSkillDefinition(key: string, input: {
+    name?: string;
+    description?: string;
+    instructionContent?: string;
+    status?: SkillDefinition['status'];
+    ownerUserId?: string | null;
+    projectId?: string | null;
+    repositoryPath?: string | null;
+  }): SkillDefinition {
+    const existing = this.getSkillDefinition(key);
+    if (!existing) throw new Error(`skill ${key} was not found`);
+    if (existing.source === 'system') throw new Error('SYSTEM_SKILL_READ_ONLY');
+    return this.upsertSkillDefinition({
+      key: existing.key,
+      name: input.name ?? existing.name,
+      description: input.description ?? existing.description,
+      instructionContent: input.instructionContent ?? existing.instruction_content,
+      status: input.status ?? existing.status,
+      version: existing.version,
+      source: existing.source,
+      ownerUserId: input.ownerUserId === undefined ? existing.owner_user_id : input.ownerUserId,
+      projectId: input.projectId === undefined ? existing.project_id : input.projectId,
+      repositoryPath: input.repositoryPath === undefined ? existing.repository_path : input.repositoryPath,
+    });
+  }
+
+  upsertSkillBinding(input: { scope: SkillBindingScope; scopeId: string; skillKey: string; enabled?: boolean; priority?: number }): SkillBinding {
+    const scope = assertSkillBindingScope(input.scope);
+    const scopeId = input.scopeId.trim();
+    const skillKey = input.skillKey.trim();
+    if (!scopeId) throw new Error('scope_id is required');
+    if (!skillKey) throw new Error('skill_key is required');
+    if (!this.getSkillDefinition(skillKey)) throw new Error(`skill ${skillKey} was not found`);
+    const enabled = input.enabled === false ? 0 : 1;
+    const priority = Number.isInteger(input.priority) ? Number(input.priority) : 100;
+    const id = crypto.randomUUID();
+    this.db.query(`
+      INSERT INTO skill_bindings (id, scope, scope_id, skill_key, enabled, priority, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+      ON CONFLICT(scope, scope_id, skill_key) DO UPDATE SET
+        enabled = excluded.enabled,
+        priority = excluded.priority,
+        updated_at = datetime('now')
+    `).run(id, scope, scopeId, skillKey, enabled, priority);
+    const row = this.db.query(`
+      SELECT * FROM skill_bindings
+      WHERE scope = ? AND scope_id = ? AND skill_key = ?
+    `).get(scope, scopeId, skillKey) as Record<string, unknown> | null;
+    if (!row) throw new Error('SKILL_BINDING_NOT_FOUND');
+    return rowToSkillBinding(row);
+  }
+
+  listSkillBindings(input: { scope?: SkillBindingScope; scopeId?: string } = {}): SkillBinding[] {
+    const params: SQLQueryBindings[] = [];
+    let where = '';
+    if (input.scope) {
+      where += ' WHERE scope = ?';
+      params.push(assertSkillBindingScope(input.scope));
+    }
+    if (input.scopeId?.trim()) {
+      where += where ? ' AND scope_id = ?' : ' WHERE scope_id = ?';
+      params.push(input.scopeId.trim());
+    }
+    const rows = this.db.query(`
+      SELECT * FROM skill_bindings
+      ${where}
+      ORDER BY scope ASC, scope_id ASC, priority ASC, skill_key ASC
+    `).all(...params) as Record<string, unknown>[];
+    return rows.map(rowToSkillBinding);
+  }
+
+  deleteSkillBinding(input: { scope: SkillBindingScope; scopeId: string; skillKey: string }): boolean {
+    const scope = assertSkillBindingScope(input.scope);
+    const scopeId = input.scopeId.trim();
+    const skillKey = input.skillKey.trim();
+    if (!scopeId) throw new Error('scope_id is required');
+    if (!skillKey) throw new Error('skill_key is required');
+    const result = this.db.query('DELETE FROM skill_bindings WHERE scope = ? AND scope_id = ? AND skill_key = ?').run(scope, scopeId, skillKey);
+    return result.changes > 0;
+  }
+
+  listEnabledSkills(input: { projectId?: string | null; roomId?: string | null; agent?: string | null }): EnabledSkill[] {
+    const orderedScopes: Array<{ scope: SkillBindingScope; scopeId: string; rank: number }> = [];
+    if (input.projectId?.trim()) orderedScopes.push({ scope: 'project', scopeId: input.projectId.trim(), rank: 0 });
+    if (input.roomId?.trim()) orderedScopes.push({ scope: 'room', scopeId: input.roomId.trim(), rank: 1 });
+    if (input.agent?.trim()) orderedScopes.push({ scope: 'agent', scopeId: input.agent.trim(), rank: 2 });
+    if (orderedScopes.length === 0) return [];
+
+    const rows: EnabledSkill[] = [];
+    for (const scope of orderedScopes) {
+      const scopeRows = this.db.query(`
+        SELECT
+          sd.*,
+          sb.scope AS binding_scope,
+          sb.scope_id AS binding_scope_id,
+          sb.priority AS binding_priority
+        FROM skill_bindings sb
+        JOIN skill_definitions sd ON sd.key = sb.skill_key
+        WHERE sb.scope = ?
+          AND sb.scope_id = ?
+          AND sb.enabled = 1
+          AND sd.status = 'active'
+        ORDER BY sb.priority ASC, sd.key ASC
+      `).all(scope.scope, scope.scopeId) as Record<string, unknown>[];
+      rows.push(...scopeRows.map(rowToEnabledSkill));
+    }
+    return rows;
+  }
+
+  createProjectRoom(input: { projectId: string; name: string; kind?: ChatKind; mode?: RoomMode }): Chat {
+    const project = this.getProject(input.projectId);
+    if (!project) throw new Error(`project ${input.projectId} was not found`);
+    if (project.status === 'archived') throw new Error('PROJECT_ARCHIVED: archived projects cannot create rooms');
+    const kind = input.kind ?? 'group';
+    if (kind !== 'group' && kind !== 'dm') throw new Error('kind must be group or dm');
+    const mode = assertRoomMode(input.mode ?? 'standard');
+    const chatName = normalizeChatName(input.name);
+    if (!chatName) throw new Error('room name is required');
+    if (this.getChatByName(chatName)) throw new Error(`room ${chatName} already exists`);
+
+    const id = crypto.randomUUID();
+    this.db.transaction(() => {
+      this.db.query(`
+        INSERT INTO chats (id, name, kind, provider, capabilities_json, project_id, mode)
+        VALUES (?, ?, ?, 'web', ?, ?, ?)
+      `).run(id, chatName, kind, kind === 'dm' ? '{"topics":"unsupported"}' : '{"topics":"native"}', project.id, mode);
+      if (mode === 'idea_development') {
+        this.upsertSkillBinding({ scope: 'room', scopeId: id, skillKey: 'idea_development', enabled: true, priority: 100 });
+      }
+      for (const defaultMember of this.listProjectAgentDefaults(project.id)) {
+        this.inviteAgentToRoom({ roomId: id, agent: defaultMember.agent, mode: defaultMember.mode });
+      }
+      this.db.query(`UPDATE projects SET updated_at = datetime('now') WHERE id = ?`).run(project.id);
+    })();
+    return this.getChatById(id)!;
+  }
+
   updateRoomDisplayName(roomId: string, displayName: string | null): Chat {
     const room = this.getChatById(roomId);
     if (!room) throw new Error(`room ${roomId} was not found`);
@@ -820,11 +1955,20 @@ export class MessageStore {
     return this.getChatById(room.id)!;
   }
 
+  updateRoomStatus(roomId: string, status: ChatStatus): Chat {
+    if (status !== 'active' && status !== 'archived') throw new Error('room status must be active or archived');
+    const room = this.getChatById(roomId);
+    if (!room) throw new Error(`room ${roomId} was not found`);
+    if (room.provider !== 'web') throw new Error('EXTERNAL_ROOM_STATUS_READ_ONLY: external provider rooms cannot be archived from Web');
+    this.db.query('UPDATE chats SET status = ? WHERE id = ?').run(status, room.id);
+    return this.getChatById(room.id)!;
+  }
+
   backfillLarkDmDisplayNames(): number {
     const result = this.db.query(`
       UPDATE chats
       SET display_name = (
-        SELECT 'DM with ' || rp.display_name
+        SELECT rp.display_name
         FROM room_participants rp
         WHERE rp.room_id = chats.id
           AND rp.kind = 'bot'
@@ -836,7 +1980,7 @@ export class MessageStore {
       )
       WHERE provider = 'lark'
         AND kind = 'dm'
-        AND (display_name IS NULL OR trim(display_name) = '' OR display_name LIKE 'lark:%')
+        AND (display_name IS NULL OR trim(display_name) = '' OR display_name LIKE 'lark:%' OR display_name LIKE 'DM with %')
         AND EXISTS (
           SELECT 1
           FROM room_participants rp
@@ -850,6 +1994,15 @@ export class MessageStore {
     return result.changes;
   }
 
+  deleteRoom(roomId: string): Chat | null {
+    const room = this.getChatById(roomId);
+    if (!room) return null;
+    if (room.provider !== 'web') throw new Error('EXTERNAL_ROOM_DELETE_READ_ONLY: external provider rooms cannot be deleted from Web');
+    if (room.status !== 'archived') throw new Error('ROOM_NOT_ARCHIVED: room must be archived before deletion');
+    this.db.query('DELETE FROM chats WHERE id = ?').run(room.id);
+    return room;
+  }
+
   getChatById(id: string): Chat | null {
     const row = this.db.query('SELECT * FROM chat_stats WHERE id = ?').get(id) as Chat | null;
     return row ?? null;
@@ -864,6 +2017,10 @@ export class MessageStore {
     return this.db.query('SELECT * FROM chat_stats ORDER BY COALESCE(last_message_at, created_at) DESC').all() as Chat[];
   }
 
+  listChatsForAgent(agent: string): Chat[] {
+    return this.listChats().filter((room) => this.canAgentParticipateInRoom(agent.trim(), room));
+  }
+
   listLarkAuthorizedUsers(): LarkAuthorizedUser[] {
     const rows = this.db.query('SELECT * FROM lark_authorized_users ORDER BY COALESCE(display_name, user_id), user_id').all() as Record<string, unknown>[];
     return rows.map(rowToLarkAuthorizedUser);
@@ -1012,24 +2169,115 @@ export class MessageStore {
     return Number(row.id ?? 0);
   }
 
+  private systemEventDeliveryAgents(room: Chat, extraAgents: string[] = []): string[] {
+    const candidates = new Set<string>();
+    for (const agent of this.listRoomAgents(room)) {
+      const mode = this.getAgentRoomSubscription(agent, room.id)?.mode ?? 'mentions';
+      if (mode !== 'off' && mode !== 'muted') candidates.add(agent);
+    }
+    for (const agent of extraAgents) {
+      const normalized = agent.trim();
+      if (normalized && this.getAgent(normalized)) candidates.add(normalized);
+    }
+    return [...candidates].sort((left, right) => left.localeCompare(right));
+  }
+
+  recordRoomSystemEvent(input: RecordRoomSystemEventInput): { event: RoomSystemEvent; message: Message; deliveries: MessageDelivery[] } {
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    const actorKind = normalizeSystemEventActorKind(input.actorKind);
+    const actorId = input.actorId?.trim() || null;
+    const subjectAgent = input.subjectAgent?.trim() || null;
+    const metadata = normalizeSystemEventMetadata(input.metadata);
+    const content = input.content?.trim() || systemEventContent({
+      eventType: input.eventType,
+      actorKind,
+      actorId,
+      subjectAgent,
+      metadata,
+    });
+
+    return this.db.transaction(() => {
+      const message = this.createMessage({
+        chatId: room.id,
+        sender: 'system',
+        content,
+        type: 'system',
+        mentions: subjectAgent ? [subjectAgent] : [],
+      });
+      const id = crypto.randomUUID();
+      this.db.query(`
+        INSERT INTO room_system_events (id, room_id, message_id, event_type, actor_kind, actor_id, subject_agent, metadata_json, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
+      `).run(id, room.id, message.id, input.eventType, actorKind, actorId, subjectAgent, JSON.stringify(metadata));
+
+      const deliveryAgents = input.deliveryAgents ?? this.systemEventDeliveryAgents(room);
+      const deliveries: MessageDelivery[] = [];
+      for (const agent of normalizeMentionsInput(deliveryAgents)) {
+        if (agent === message.sender) continue;
+        try {
+          deliveries.push(this.createDelivery({ messageId: message.id, agent }));
+        } catch {
+          // Delivery eligibility is best-effort here; the event record and message remain the source of truth.
+        }
+      }
+      return { event: this.getRoomSystemEvent(id)!, message, deliveries };
+    })();
+  }
+
+  getRoomSystemEvent(id: string): RoomSystemEvent | null {
+    const row = this.db.query('SELECT * FROM room_system_events WHERE id = ?').get(id) as Record<string, unknown> | null;
+    return row ? rowToRoomSystemEvent(row) : null;
+  }
+
+  getRoomSystemEventForMessage(messageId: number): RoomSystemEvent | null {
+    const row = this.db.query('SELECT * FROM room_system_events WHERE message_id = ?').get(messageId) as Record<string, unknown> | null;
+    return row ? rowToRoomSystemEvent(row) : null;
+  }
+
   inviteAgentToRoom(input: { roomId: string; agent: string; mode?: AgentRoomSubscriptionMode }): { participant: RoomParticipant; subscription: AgentRoomSubscription } {
     const room = this.getChatById(input.roomId);
     if (!room) throw new Error(`room ${input.roomId} was not found`);
     const agent = input.agent.trim();
     if (!agent) throw new Error('agent is required');
-    const participant = this.upsertRoomParticipant({
-      roomId: room.id,
-      participantId: agent,
-      kind: 'agent',
-      displayName: this.getAgent(agent)?.display_name ?? agent,
-      source: 'local_agent',
-    });
-    this.db.query(`
-      UPDATE room_participants
-      SET delivery_cursor_message_id = COALESCE(delivery_cursor_message_id, ?), updated_at = datetime('now')
-      WHERE room_id = ? AND participant_id = ?
-    `).run(this.getLatestMessageId(room.id), room.id, agent);
-    return { participant, subscription: this.upsertAgentRoomSubscription({ agent, roomId: room.id, mode: input.mode ?? 'mentions' }) };
+    const mode = input.mode ?? 'mentions';
+    let result!: { participant: RoomParticipant; subscription: AgentRoomSubscription };
+    this.db.transaction(() => {
+      const existingParticipant = this.getRoomParticipant(room.id, agent);
+      const existingSubscription = this.getAgentRoomSubscription(agent, room.id);
+      const participant = this.upsertRoomParticipant({
+        roomId: room.id,
+        participantId: agent,
+        kind: 'agent',
+        displayName: this.getAgent(agent)?.display_name ?? agent,
+        source: 'local_agent',
+      });
+      this.db.query(`
+        UPDATE room_participants
+        SET delivery_cursor_message_id = COALESCE(delivery_cursor_message_id, ?), updated_at = datetime('now')
+        WHERE room_id = ? AND participant_id = ?
+      `).run(this.getLatestMessageId(room.id), room.id, agent);
+      const subscription = this.upsertAgentRoomSubscription({ agent, roomId: room.id, mode });
+      if (existingParticipant?.status !== 'active') {
+        this.recordRoomSystemEvent({
+          roomId: room.id,
+          eventType: 'agent_invited',
+          subjectAgent: agent,
+          metadata: { mode },
+          deliveryAgents: [],
+        });
+      } else if (existingSubscription && existingSubscription.mode !== mode) {
+        this.recordRoomSystemEvent({
+          roomId: room.id,
+          eventType: 'agent_receive_mode_changed',
+          subjectAgent: agent,
+          metadata: { old_mode: existingSubscription.mode, new_mode: mode },
+          deliveryAgents: this.systemEventDeliveryAgents(room),
+        });
+      }
+      result = { participant: this.getRoomParticipant(room.id, agent) ?? participant, subscription };
+    })();
+    return result;
   }
 
   upsertAgentRoomSubscription(input: { agent: string; roomId: string; mode: AgentRoomSubscriptionMode; channelId?: string | null }): AgentRoomSubscription {
@@ -1048,10 +2296,11 @@ export class MessageStore {
       return this.getAgentRoomSubscription(agent, room.id)!;
     }
     const id = crypto.randomUUID();
+    const latestMessageId = this.getLatestMessageId(room.id);
     this.db.query(`
-      INSERT INTO agent_room_subscriptions (id, agent, room_id, channel_id, mode, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, datetime('now'), datetime('now'))
-    `).run(id, agent, room.id, channelId, input.mode);
+      INSERT INTO agent_room_subscriptions (id, agent, room_id, channel_id, mode, last_read_message_id, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+    `).run(id, agent, room.id, channelId, input.mode, latestMessageId);
     const row = this.db.query('SELECT * FROM agent_room_subscriptions WHERE id = ?').get(id) as Record<string, unknown>;
     return rowToAgentRoomSubscription(row);
   }
@@ -1065,6 +2314,208 @@ export class MessageStore {
     return row ? rowToAgentRoomSubscription(row) : null;
   }
 
+  listAgentRoomSubscriptions(roomId: string): AgentRoomSubscription[] {
+    const rows = this.db.query(`
+      SELECT *
+      FROM agent_room_subscriptions
+      WHERE room_id = ? AND channel_id IS NULL
+      ORDER BY agent ASC
+    `).all(roomId) as Record<string, unknown>[];
+    return rows.map(rowToAgentRoomSubscription);
+  }
+
+  private unreadCountForAgentRoom(agent: string, roomId: string, lastReadMessageId: number): number {
+    const row = this.db.query(`
+      SELECT COUNT(*) AS count
+      FROM messages
+      WHERE chat_id = ? AND id > ? AND sender != ?
+    `).get(roomId, lastReadMessageId, agent.trim()) as { count: number };
+    return Number(row.count ?? 0);
+  }
+
+  private taskCountsForRoom(roomId: string): { task_count: number; open_task_count: number } {
+    const row = this.db.query(`
+      SELECT
+        COUNT(*) AS task_count,
+        SUM(CASE WHEN status NOT IN ('done', 'closed') THEN 1 ELSE 0 END) AS open_task_count
+      FROM room_tasks
+      WHERE room_id = ?
+    `).get(roomId) as { task_count: number; open_task_count: number | null };
+    return {
+      task_count: Number(row.task_count ?? 0),
+      open_task_count: Number(row.open_task_count ?? 0),
+    };
+  }
+
+  private scheduledReminderCountForAgentRoom(agent: string, roomId: string): number {
+    const row = this.db.query(`
+      SELECT COUNT(*) AS count
+      FROM room_reminders
+      WHERE room_id = ? AND created_by = ? AND status = 'scheduled'
+    `).get(roomId, agent.trim()) as { count: number };
+    return Number(row.count ?? 0);
+  }
+
+  private savedMessageCountForAgentRoom(agent: string, roomId: string): number {
+    const row = this.db.query(`
+      SELECT COUNT(*) AS count
+      FROM room_saved_messages
+      WHERE room_id = ? AND saved_by = ?
+    `).get(roomId, agent.trim()) as { count: number };
+    return Number(row.count ?? 0);
+  }
+
+  private buildAgentWorkbenchRoom(agentKey: string, row: Record<string, unknown>): AgentWorkbenchRoom {
+    const key = agentKey.trim();
+    const room = row as unknown as Chat;
+    const participant = this.getRoomParticipant(room.id, key);
+    const subscription = this.getAgentRoomSubscription(key, room.id);
+    const latestMessageId = this.getLatestMessageId(room.id);
+    const lastReadMessageId = subscription?.last_read_message_id ?? participant?.delivery_cursor_message_id ?? 0;
+    const heldDraftCount = this.db.query(`
+      SELECT COUNT(*) AS count
+      FROM held_message_drafts
+      WHERE agent = ? AND chat_id = ? AND status = 'held'
+    `).get(key, room.id) as { count: number };
+    const taskCounts = this.taskCountsForRoom(room.id);
+    return {
+      ...room,
+      participant,
+      subscription,
+      held_draft_count: Number(heldDraftCount.count ?? 0),
+      latest_message_id: latestMessageId,
+      last_read_message_id: lastReadMessageId,
+      last_read_at: subscription?.last_read_at ?? null,
+      unread_count: this.unreadCountForAgentRoom(key, room.id, lastReadMessageId),
+      is_followed: subscription ? !['muted', 'off'].includes(subscription.mode) : false,
+      task_count: taskCounts.task_count,
+      open_task_count: taskCounts.open_task_count,
+      scheduled_reminder_count: this.scheduledReminderCountForAgentRoom(key, room.id),
+      saved_message_count: this.savedMessageCountForAgentRoom(key, room.id),
+    };
+  }
+
+  getAgentWorkbenchRoom(agentKey: string, roomId: string): AgentWorkbenchRoom | null {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent is required');
+    const row = this.db.query('SELECT * FROM chat_stats WHERE id = ?').get(roomId) as Record<string, unknown> | null;
+    return row ? this.buildAgentWorkbenchRoom(key, row) : null;
+  }
+
+  listAgentWorkbenchRooms(agentKey: string): AgentWorkbenchRoom[] {
+    const key = agentKey.trim();
+    const rows = this.db.query(`
+      SELECT c.*
+      FROM room_participants rp
+      JOIN chat_stats c ON c.id = rp.room_id
+      WHERE rp.participant_id = ? AND rp.kind = 'agent' AND rp.status = 'active'
+      ORDER BY COALESCE(c.display_name, c.name) ASC
+    `).all(key) as Record<string, unknown>[];
+    return rows.map((row) => this.buildAgentWorkbenchRoom(key, row));
+  }
+
+  updateAgentRoomSubscriptionMode(input: UpdateAgentRoomSubscriptionInput): { subscription: AgentRoomSubscription; room: AgentWorkbenchRoom } {
+    const agent = input.agent.trim();
+    if (!agent) throw new Error('agent is required');
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    if (!this.getAgent(agent)) throw new Error(`agent ${agent} not found`);
+    if (!this.canAgentParticipateInRoom(agent, room)) throw new Error('ROOM_ACCESS_DENIED');
+    const existing = this.getAgentRoomSubscription(agent, room.id);
+    const subscription = this.upsertAgentRoomSubscription({ agent, roomId: room.id, mode: input.mode });
+    if ((existing?.mode ?? null) !== subscription.mode) {
+      this.recordRoomSystemEvent({
+        roomId: room.id,
+        eventType: 'agent_receive_mode_changed',
+        actorKind: input.actorKind,
+        actorId: input.actorId,
+        subjectAgent: agent,
+        metadata: { old_mode: existing?.mode ?? null, new_mode: subscription.mode },
+        deliveryAgents: this.systemEventDeliveryAgents(room),
+      });
+    }
+    return { subscription, room: this.getAgentWorkbenchRoom(agent, room.id)! };
+  }
+
+  markAgentRoomRead(input: MarkAgentRoomReadInput): AgentWorkbenchRoom {
+    const agent = input.agent.trim();
+    if (!agent) throw new Error('agent is required');
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    if (!this.getAgent(agent)) throw new Error(`agent ${agent} not found`);
+    if (!this.canAgentParticipateInRoom(agent, room)) throw new Error('ROOM_ACCESS_DENIED');
+
+    const existing = this.getAgentRoomSubscription(agent, room.id)
+      ?? this.upsertAgentRoomSubscription({ agent, roomId: room.id, mode: 'mentions' });
+    const latestMessageId = this.getLatestMessageId(room.id);
+    const requestedMessageId = input.messageId === undefined ? latestMessageId : Number(input.messageId);
+    if (!Number.isInteger(requestedMessageId) || requestedMessageId < 0) {
+      throw new Error('INVALID_READ_MESSAGE_ID');
+    }
+    const nextReadMessageId = Math.max(existing.last_read_message_id, Math.min(requestedMessageId, latestMessageId));
+    this.db.query(`
+      UPDATE agent_room_subscriptions
+      SET last_read_message_id = ?, last_read_at = datetime('now'), updated_at = datetime('now')
+      WHERE id = ?
+    `).run(nextReadMessageId, existing.id);
+    return this.getAgentWorkbenchRoom(agent, room.id)!;
+  }
+
+  leaveAgentRoom(input: { roomId: string; agent: string }): { room: Chat; agent: string; participant_removed: boolean; subscriptions_removed: number; active_deliveries_canceled: number } {
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    const agent = input.agent.trim();
+    if (!agent) throw new Error('agent is required');
+    if (!this.getAgent(agent)) throw new Error(`agent ${agent} not found`);
+
+    let participantRemoved = false;
+    let subscriptionsRemoved = 0;
+    let activeDeliveriesCanceled = 0;
+    let removalMessageId = 0;
+
+    this.db.transaction(() => {
+      const existingParticipant = this.getRoomParticipant(room.id, agent);
+      if (existingParticipant?.status === 'active') {
+        const eventResult = this.recordRoomSystemEvent({
+          roomId: room.id,
+          eventType: 'agent_removed',
+          subjectAgent: agent,
+          deliveryAgents: this.systemEventDeliveryAgents(room, [agent]),
+        });
+        removalMessageId = eventResult.message.id;
+      }
+
+      const participantResult = this.db.query(`
+        UPDATE room_participants
+        SET status = 'removed', updated_at = datetime('now')
+        WHERE room_id = ? AND participant_id = ? AND kind = 'agent' AND status = 'active'
+      `).run(room.id, agent);
+      participantRemoved = participantResult.changes > 0;
+
+      const subscriptionResult = this.db.query(`
+        DELETE FROM agent_room_subscriptions
+        WHERE room_id = ? AND agent = ?
+      `).run(room.id, agent);
+      subscriptionsRemoved = subscriptionResult.changes;
+
+      const deliveryResult = this.db.query(`
+        UPDATE message_deliveries
+        SET status = 'canceled', last_error = CASE WHEN last_error = '' THEN 'agent left room' ELSE last_error END
+        WHERE chat_id = ? AND agent = ? AND status IN ('pending', 'claimed', 'processing_completed')
+          AND message_id != ?
+      `).run(room.id, agent, removalMessageId);
+      activeDeliveriesCanceled = deliveryResult.changes;
+    })();
+
+    return {
+      room,
+      agent,
+      participant_removed: participantRemoved,
+      subscriptions_removed: subscriptionsRemoved,
+      active_deliveries_canceled: activeDeliveriesCanceled,
+    };
+  }
+
   createRoomChannel(input: { roomId: string; name: string; createdBy?: string | null; externalRef?: string | null }): RoomChannel {
     const room = this.getChatById(input.roomId);
     if (!room) throw new Error(`room ${input.roomId} was not found`);
@@ -1085,7 +2536,7 @@ export class MessageStore {
 
   listAgents(limit = 50): AgentDefinition[] {
     const rows = this.db.query(`
-      SELECT id, agent_key, display_name, description, runtime, created_at, updated_at
+      SELECT id, agent_key, display_name, description, runtime, model, avatar, created_at, updated_at
       FROM agents
       ORDER BY agent_key ASC
       LIMIT ?
@@ -1097,7 +2548,7 @@ export class MessageStore {
     const key = identifier.trim();
     if (!key) return null;
     const row = this.db.query(`
-      SELECT id, agent_key, display_name, description, runtime, created_at, updated_at
+      SELECT id, agent_key, display_name, description, runtime, model, avatar, created_at, updated_at
       FROM agents
       WHERE id = ? OR agent_key = ?
       LIMIT 1
@@ -1112,39 +2563,316 @@ export class MessageStore {
     return row?.runtime ?? null;
   }
 
-  upsertAgent(input: { id?: string; agent_key: string; display_name: string; description?: string | null; runtime?: string | null }): AgentDefinition {
+  getAgentPermissionProfile(agentKey: string): AgentPermissionProfile {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent_key is required');
+    if (!this.getAgent(key)) throw new Error(`agent ${key} not found`);
+    const row = this.db.query(`
+      SELECT * FROM agent_permission_profiles WHERE agent_key = ? LIMIT 1
+    `).get(key) as Record<string, unknown> | null;
+    if (row) return rowToAgentPermissionProfile(row);
+    const now = new Date().toISOString();
+    return {
+      agent_key: key,
+      filesystem_mode: defaultAgentPermissionProfile.filesystemMode,
+      extra_writable_roots: [...defaultAgentPermissionProfile.extraWritableRoots],
+      created_at: now,
+      updated_at: now,
+    };
+  }
+
+  upsertAgentPermissionProfile(agentKey: string, input: RuntimeAgentPermissionProfile): AgentPermissionProfile {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent_key is required');
+    if (!this.getAgent(key)) throw new Error(`agent ${key} not found`);
+    const validation = validateAgentPermissionProfile(input);
+    if (!validation.ok) {
+      throw new Error(validation.diagnostics.filter((diagnostic) => diagnostic.level === 'error').map((diagnostic) => diagnostic.message).join('; '));
+    }
+    this.db.query(`
+      INSERT INTO agent_permission_profiles (agent_key, filesystem_mode, extra_writable_roots_json, created_at, updated_at)
+      VALUES (?, ?, ?, datetime('now'), datetime('now'))
+      ON CONFLICT(agent_key) DO UPDATE SET
+        filesystem_mode = excluded.filesystem_mode,
+        extra_writable_roots_json = excluded.extra_writable_roots_json,
+        updated_at = datetime('now')
+    `).run(key, validation.profile.filesystemMode, JSON.stringify(validation.profile.extraWritableRoots));
+    return this.getAgentPermissionProfile(key);
+  }
+
+  upsertAgent(input: { id?: string; agent_key: string; display_name: string; description?: string | null; runtime?: string | null; model?: string | null; avatar?: string | null }): AgentDefinition {
     const id = input.id?.trim() || crypto.randomUUID();
     const agentKey = input.agent_key.trim();
     const displayName = input.display_name.trim();
     if (!agentKey) throw new Error('agent_key is required');
     if (!displayName) throw new Error('display_name is required');
 
+    const avatar = normalizeAgentAvatar(input.avatar, agentKey, displayName);
+
     this.db.query(`
-      INSERT INTO agents (id, agent_key, display_name, description, runtime, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+      INSERT INTO agents (id, agent_key, display_name, description, runtime, model, avatar, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
       ON CONFLICT(agent_key) DO UPDATE SET
         display_name = excluded.display_name,
         description = COALESCE(excluded.description, agents.description),
         runtime = COALESCE(excluded.runtime, agents.runtime),
+        model = COALESCE(excluded.model, agents.model),
+        avatar = COALESCE(NULLIF(agents.avatar, ''), excluded.avatar),
         updated_at = datetime('now')
-    `).run(id, agentKey, displayName, input.description ?? null, input.runtime ?? null);
+    `).run(id, agentKey, displayName, input.description ?? null, input.runtime ?? null, input.model ?? null, avatar);
 
     return this.getAgent(agentKey)!;
   }
 
   updateAgentRuntime(agentKey: string, runtime: string | null): AgentDefinition | null {
+    return this.updateAgentRuntimeConfig(agentKey, { runtime });
+  }
+
+  updateAgentRuntimeConfig(agentKey: string, input: { runtime?: string | null; model?: string | null }): AgentDefinition | null {
     const key = agentKey.trim();
     if (!key) throw new Error('agent_key is required');
     const existing = this.getAgent(key);
     if (!existing) return null;
 
+    const runtime = Object.prototype.hasOwnProperty.call(input, 'runtime') ? input.runtime ?? null : existing.runtime;
+    const model = Object.prototype.hasOwnProperty.call(input, 'model') ? input.model ?? null : existing.model;
     this.db.query(`
-      UPDATE agents SET runtime = ?, updated_at = datetime('now') WHERE agent_key = ?
-    `).run(runtime, key);
+      UPDATE agents SET runtime = ?, model = ?, updated_at = datetime('now') WHERE agent_key = ?
+    `).run(runtime, model, key);
 
     return this.getAgent(key);
   }
 
+  listAgentWorkbenchLarkBindings(agentKey: string): AgentWorkbenchLarkBinding[] {
+    const key = agentKey.trim();
+    const rows = this.db.query(`
+      SELECT 'provider_account' AS source,
+             external_account_id AS app_id,
+             NULL AS label,
+             bot_external_user_id AS bot_open_id,
+             status
+      FROM provider_accounts
+      WHERE provider = 'lark' AND agent = ?
+      UNION ALL
+      SELECT 'channel_account' AS source,
+             app_id,
+             name AS label,
+             bot_open_id,
+             status
+      FROM channel_accounts
+      WHERE channel = 'lark' AND agent = ?
+      ORDER BY app_id ASC, source ASC
+    `).all(key, key) as Array<Record<string, unknown>>;
+    return rows.map((row): AgentWorkbenchLarkBinding => ({
+      source: String(row.source) as AgentWorkbenchLarkBinding['source'],
+      app_id: String(row.app_id),
+      label: row.label === null || row.label === undefined ? null : String(row.label),
+      bot_open_id: row.bot_open_id === null || row.bot_open_id === undefined ? null : String(row.bot_open_id),
+      status: String(row.status) as AgentWorkbenchLarkBinding['status'],
+    }));
+  }
+
+  getAgentWorkbenchCollaboration(agentKey: string, limit = 20): AgentWorkbenchCollaboration {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent_key is required');
+    const cappedLimit = limitValue(limit, 20);
+    const taskRows = this.db.query(`
+      SELECT rt.*, c.name AS room_name
+      FROM room_tasks rt
+      JOIN chats c ON c.id = rt.room_id
+      JOIN room_participants rp ON rp.room_id = rt.room_id
+      WHERE rp.participant_id = ?
+        AND rp.kind = 'agent'
+        AND rp.status = 'active'
+        AND rt.status NOT IN ('done', 'closed')
+        AND (rt.assignee = ? OR rt.created_by = ?)
+      ORDER BY CASE WHEN rt.assignee = ? THEN 0 ELSE 1 END, rt.updated_at DESC, rt.task_number ASC
+      LIMIT ?
+    `).all(key, key, key, key, cappedLimit) as Record<string, unknown>[];
+    const reminderRows = this.db.query(`
+      SELECT rr.*, c.name AS room_name
+      FROM room_reminders rr
+      JOIN chats c ON c.id = rr.room_id
+      JOIN room_participants rp ON rp.room_id = rr.room_id
+      WHERE rp.participant_id = ?
+        AND rp.kind = 'agent'
+        AND rp.status = 'active'
+        AND rr.created_by = ?
+        AND rr.status = 'scheduled'
+      ORDER BY rr.fire_at ASC, rr.created_at ASC
+      LIMIT ?
+    `).all(key, key, cappedLimit) as Record<string, unknown>[];
+    const savedRows = this.db.query(`
+      SELECT
+        rsm.*,
+        c.name AS room_name,
+        m.sender AS message_sender,
+        m.content AS message_content,
+        m.created_at AS message_created_at
+      FROM room_saved_messages rsm
+      JOIN chats c ON c.id = rsm.room_id
+      JOIN messages m ON m.id = rsm.message_id
+      JOIN room_participants rp ON rp.room_id = rsm.room_id
+      WHERE rp.participant_id = ?
+        AND rp.kind = 'agent'
+        AND rp.status = 'active'
+        AND rsm.saved_by = ?
+      ORDER BY rsm.updated_at DESC, rsm.created_at DESC
+      LIMIT ?
+    `).all(key, key, cappedLimit) as Record<string, unknown>[];
+
+    return {
+      tasks: taskRows.map(rowToRoomTask),
+      reminders: reminderRows.map(rowToRoomReminder),
+      saved_messages: savedRows.map(rowToRoomSavedMessage),
+    };
+  }
+
+  getAgentWorkbench(agentKey: string): AgentWorkbench | null {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent_key is required');
+    const agent = this.getAgent(key);
+    if (!agent) return null;
+    const assignment = this.getComputerAgentAssignment(agent.agent_key);
+    return {
+      agent,
+      permissions: this.getAgentPermissionProfile(agent.agent_key),
+      assignment,
+      machine: assignment ? this.getComputer(assignment.computer_id) : null,
+      project: this.getWorkbenchProjectForAgent(agent.agent_key, assignment),
+      rooms: this.listAgentWorkbenchRooms(agent.agent_key),
+      inbox: this.listInbox(agent.agent_key, 0, 20),
+      deliveries: this.listRecentDeliveriesForAgent(agent.agent_key, 20),
+      runs: this.listRunsForAgent(agent.agent_key, 10),
+      activity: this.listActivityForAgent(agent.agent_key, 80),
+      sessions: this.listSessionsForAgent(agent.agent_key, 10),
+      held_drafts: this.listHeldMessageDrafts(agent.agent_key, 'held', 20),
+      collaboration: this.getAgentWorkbenchCollaboration(agent.agent_key),
+      lark_bindings: this.listAgentWorkbenchLarkBindings(agent.agent_key),
+    };
+  }
+
+  getAgentDeletionImpact(agentKey: string): AgentDeletionImpact | null {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent_key is required');
+    const agent = this.getAgent(key);
+    if (!agent) return null;
+    const rooms = this.db.query(`
+      SELECT c.id, c.name, c.display_name, c.kind, c.provider, c.status
+      FROM room_participants rp
+      INNER JOIN chat_stats c ON c.id = rp.room_id
+      WHERE rp.participant_id = ? AND rp.kind = 'agent' AND rp.status = 'active'
+      ORDER BY COALESCE(c.display_name, c.name) ASC
+    `).all(key) as Array<Record<string, unknown>>;
+    const providerBindings = this.db.query(`
+      SELECT 'provider_account' AS source, external_account_id AS app_id, NULL AS label
+      FROM provider_accounts
+      WHERE provider = 'lark' AND agent = ? AND status = 'active'
+      UNION ALL
+      SELECT 'channel_account' AS source, app_id, name AS label
+      FROM channel_accounts
+      WHERE channel = 'lark' AND agent = ? AND status = 'active'
+      ORDER BY app_id ASC, source ASC
+    `).all(key, key) as Array<Record<string, unknown>>;
+    return {
+      agent,
+      rooms: rooms.map((row): AgentDeletionRoomImpact => ({
+        id: String(row.id),
+        name: String(row.name),
+        display_name: row.display_name === null || row.display_name === undefined ? null : String(row.display_name),
+        kind: String(row.kind) as ChatKind,
+        provider: String(row.provider) as RoomProvider,
+        status: String(row.status) as ChatStatus,
+      })),
+      lark_bindings: providerBindings.map((row): AgentDeletionLarkBindingImpact => ({
+        source: String(row.source) as AgentDeletionLarkBindingImpact['source'],
+        app_id: String(row.app_id),
+        label: row.label === null || row.label === undefined ? null : String(row.label),
+      })),
+    };
+  }
+
+  deleteAgent(agentKey: string): AgentDeletionResult | null {
+    const key = agentKey.trim();
+    if (!key) throw new Error('agent_key is required');
+    const existing = this.getAgent(key);
+    if (!existing) return null;
+
+    const result: AgentDeletionResult = {
+      agent: existing,
+      rooms_left: 0,
+      subscriptions_removed: 0,
+      assignments_removed: 0,
+      daemon_registrations_removed: 0,
+      provider_accounts_disabled: 0,
+      channel_accounts_disabled: 0,
+      active_deliveries_canceled: 0,
+      running_runs_marked_kill: 0,
+    };
+
+    this.db.transaction(() => {
+      const roomsResult = this.db.query(`
+        UPDATE room_participants
+        SET status = 'removed', updated_at = datetime('now')
+        WHERE participant_id = ? AND kind = 'agent' AND status = 'active'
+      `).run(key);
+      result.rooms_left = roomsResult.changes;
+
+      const subscriptionsResult = this.db.query(`
+        DELETE FROM agent_room_subscriptions
+        WHERE agent = ?
+      `).run(key);
+      result.subscriptions_removed = subscriptionsResult.changes;
+
+      const assignmentsResult = this.db.query(`
+        DELETE FROM computer_agent_assignments
+        WHERE agent = ?
+      `).run(key);
+      result.assignments_removed = assignmentsResult.changes;
+
+      const daemonResult = this.db.query(`
+        DELETE FROM daemon_agents
+        WHERE agent = ?
+      `).run(key);
+      result.daemon_registrations_removed = daemonResult.changes;
+
+      const providerResult = this.db.query(`
+        UPDATE provider_accounts
+        SET status = 'disabled', updated_at = datetime('now')
+        WHERE agent = ? AND status = 'active'
+      `).run(key);
+      result.provider_accounts_disabled = providerResult.changes;
+
+      const channelResult = this.db.query(`
+        UPDATE channel_accounts
+        SET status = 'disabled', updated_at = datetime('now')
+        WHERE agent = ? AND status = 'active'
+      `).run(key);
+      result.channel_accounts_disabled = channelResult.changes;
+
+      const deliveryResult = this.db.query(`
+        UPDATE message_deliveries
+        SET status = 'canceled', last_error = CASE WHEN last_error = '' THEN 'agent deleted' ELSE last_error END
+        WHERE agent = ? AND status IN ('pending', 'claimed', 'processing_completed')
+      `).run(key);
+      result.active_deliveries_canceled = deliveryResult.changes;
+
+      const runResult = this.db.query(`
+        UPDATE agent_runs
+        SET action = 'kill', updated_at = datetime('now')
+        WHERE agent = ? AND status = 'running'
+      `).run(key);
+      result.running_runs_marked_kill = runResult.changes;
+
+      this.db.query(`
+        DELETE FROM agents
+        WHERE agent_key = ?
+      `).run(key);
+    })();
+
+    return result;
+  }
+
   assignAgentToComputer(input: { agent: string; computerId: string }): ComputerAgentAssignment {
     const agent = input.agent.trim();
     const computerId = input.computerId.trim();
@@ -1166,9 +2894,19 @@ export class MessageStore {
     return this.getComputerAgentAssignment(agent)!;
   }
 
+  unassignAgentFromComputer(agent: string): boolean {
+    const key = agent.trim();
+    if (!key) throw new Error('agent is required');
+    const result = this.db.query(`
+      DELETE FROM computer_agent_assignments
+      WHERE agent = ?
+    `).run(key);
+    return result.changes > 0;
+  }
+
   getComputerAgentAssignment(agent: string): ComputerAgentAssignment | null {
     const row = this.db.query(`
-      SELECT caa.*, a.display_name, a.runtime
+      SELECT caa.*, a.display_name, a.runtime, a.model
       FROM computer_agent_assignments caa
       JOIN agents a ON a.agent_key = caa.agent
       WHERE caa.agent = ?
@@ -1179,7 +2917,7 @@ export class MessageStore {
 
   listComputerAgentAssignments(computerId: string): ComputerAgentAssignment[] {
     const rows = this.db.query(`
-      SELECT caa.*, a.display_name, a.runtime
+      SELECT caa.*, a.display_name, a.runtime, a.model
       FROM computer_agent_assignments caa
       JOIN agents a ON a.agent_key = caa.agent
       WHERE caa.computer_id = ? AND caa.status = 'active'
@@ -1220,6 +2958,10 @@ export class MessageStore {
       diagnostics.push({ level: 'error', code: 'INVALID_FIELD', message: 'runtime must be a string or null' });
     }
 
+    if ('model' in input && input.model !== null && typeof input.model !== 'string') {
+      diagnostics.push({ level: 'error', code: 'INVALID_FIELD', message: 'model must be a string or null' });
+    }
+
     for (const key of ['created_at', 'updated_at']) {
       if (key in input && typeof input[key] !== 'string') {
         diagnostics.push({ level: 'error', code: 'INVALID_FIELD', message: `${key} must be a string when provided` });
@@ -2028,9 +3770,13 @@ export class MessageStore {
 
   createMessage(input: CreateMessageInput): Message {
     const sender = input.sender.trim();
-    const content = input.content.trim();
+    const attachments = input.attachments ?? [];
+    const content = input.content.trim() || (attachments.length > 0 ? (attachments.some((attachment) => attachment.kind === 'image') ? '[image]' : '[file]') : '');
     if (!sender) throw new Error('sender is required');
     if (!content) throw new Error('content is required');
+    for (const attachment of attachments) {
+      validateMessageAttachment({ kind: attachment.kind, mimeType: attachment.mimeType, content: attachment.content });
+    }
 
     let chat: Chat | null = null;
     let parentId: number | null = null;
@@ -2061,7 +3807,7 @@ export class MessageStore {
         JOIN chats c ON c.id = m.chat_id
         WHERE m.idempotency_key = ?
       `).get(idempotencyKey) as Record<string, unknown> | null;
-      if (existing) return rowToMessage(existing);
+      if (existing) return this.attachMessageAttachments([rowToMessage(existing)])[0]!;
     }
 
     const mentions = normalizeMentionsInput(input.mentions);
@@ -2072,79 +3818,863 @@ export class MessageStore {
       if (channel.room_id !== chat.id) throw new Error(`channel ${channelId} does not belong to room ${chat.id}`);
     }
     const provider = input.provider ?? chat.provider ?? 'web';
-    const result = this.db.query(`
-      INSERT INTO messages (chat_id, parent_id, depth, sender, recipient, content, type, idempotency_key, channel_id, provider, mentions_json)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    const id = this.db.transaction(() => {
+      const result = this.db.query(`
+        INSERT INTO messages (chat_id, parent_id, depth, sender, recipient, content, type, idempotency_key, channel_id, provider, mentions_json)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        chat.id,
+        parentId,
+        depth,
+        sender,
+        input.recipient?.trim() || null,
+        content,
+        input.type ?? 'message',
+        idempotencyKey,
+        channelId,
+        provider,
+        JSON.stringify(mentions),
+      );
+      const messageId = Number(result.lastInsertRowid);
+      for (const attachment of attachments) {
+        const attachmentId = crypto.randomUUID();
+        const stored = storeMessageAttachmentFile({
+          palHome: this.palHome,
+          roomId: chat.id,
+          messageId,
+          attachmentId,
+          filename: attachment.filename,
+          mimeType: attachment.mimeType,
+          content: attachment.content,
+        });
+        this.db.query(`
+          INSERT INTO message_attachments (id, message_id, kind, mime_type, filename, size_bytes, path, source_provider, source_ref)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(
+          attachmentId,
+          messageId,
+          attachment.kind,
+          attachment.mimeType,
+          stored.filename,
+          attachment.content.length,
+          stored.path,
+          attachment.sourceProvider ?? provider,
+          attachment.sourceRef?.trim() || null,
+        );
+      }
+      return messageId;
+    })();
+    return this.getMessage(id)!;
+  }
+
+  private attachMessageAttachments(messages: Message[]): Message[] {
+    if (messages.length === 0) return messages;
+    const ids = messages.map((message) => message.id);
+    const placeholders = ids.map(() => '?').join(', ');
+    const rows = this.db.query(`
+      SELECT id, message_id, kind, mime_type, filename, size_bytes, path, source_provider, created_at
+      FROM message_attachments
+      WHERE message_id IN (${placeholders})
+      ORDER BY message_id ASC, id ASC
+    `).all(...ids) as Record<string, unknown>[];
+    const byMessage = new Map<number, MessageAttachmentMetadata[]>();
+    for (const row of rows) {
+      const attachment = rowToMessageAttachmentMetadata(row);
+      const list = byMessage.get(attachment.message_id) ?? [];
+      list.push(attachment);
+      byMessage.set(attachment.message_id, list);
+    }
+    return messages.map((message) => ({ ...message, attachments: byMessage.get(message.id) ?? [] }));
+  }
+
+  listMessageAttachments(messageId: number): MessageAttachmentMetadata[] {
+    const rows = this.db.query(`
+      SELECT id, message_id, kind, mime_type, filename, size_bytes, path, source_provider, created_at
+      FROM message_attachments
+      WHERE message_id = ?
+      ORDER BY id ASC
+    `).all(messageId) as Record<string, unknown>[];
+    return rows.map(rowToMessageAttachmentMetadata);
+  }
+
+  addMessageAttachment(messageId: number, attachment: CreateMessageAttachmentInput): MessageAttachmentMetadata {
+    const message = this.getMessage(messageId);
+    if (!message) throw new Error(`message ${messageId} was not found`);
+    validateMessageAttachment({ kind: attachment.kind, mimeType: attachment.mimeType, content: attachment.content });
+    const id = crypto.randomUUID();
+    const stored = storeMessageAttachmentFile({
+      palHome: this.palHome,
+      roomId: message.chat_id,
+      messageId,
+      attachmentId: id,
+      filename: attachment.filename,
+      mimeType: attachment.mimeType,
+      content: attachment.content,
+    });
+    this.db.query(`
+      INSERT INTO message_attachments (id, message_id, kind, mime_type, filename, size_bytes, path, source_provider, source_ref)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      id,
+      messageId,
+      attachment.kind,
+      attachment.mimeType,
+      stored.filename,
+      attachment.content.length,
+      stored.path,
+      attachment.sourceProvider ?? message.provider ?? null,
+      attachment.sourceRef?.trim() || null,
+    );
+    return this.listMessageAttachments(messageId).find((item) => item.id === id)!;
+  }
+
+  getMessageAttachment(id: string): MessageAttachment | null {
+    const row = this.db.query('SELECT * FROM message_attachments WHERE id = ?').get(id.trim()) as Record<string, unknown> | null;
+    return row ? rowToMessageAttachment(row) : null;
+  }
+
+  getMessage(id: number): Message | null {
+    const row = this.db.query(`
+      SELECT m.*, c.name AS chat_name
+      FROM messages m
+      JOIN chats c ON c.id = m.chat_id
+      WHERE m.id = ?
+    `).get(id) as Record<string, unknown> | null;
+    return row ? this.attachMessageAttachments([rowToMessage(row)])[0]! : null;
+  }
+
+  listMessages(input: ListMessagesInput = {}): Message[] {
+    const conditions: string[] = [];
+    const params: SQLQueryBindings[] = [];
+
+    if (input.chatId) {
+      conditions.push('m.chat_id = ?');
+      params.push(input.chatId);
+    } else if (input.chatName) {
+      conditions.push('c.name = ?');
+      params.push(normalizeChatName(input.chatName));
+    }
+
+    if (input.parentId !== undefined) {
+      if (input.parentId === null) {
+        conditions.push('m.parent_id IS NULL');
+      } else {
+        conditions.push('(m.id = ? OR m.parent_id = ?)');
+        params.push(input.parentId, input.parentId);
+      }
+    }
+
+    if (input.after !== undefined) {
+      conditions.push('m.id > ?');
+      params.push(input.after);
+    }
+
+    if (input.before !== undefined) {
+      conditions.push('m.id < ?');
+      params.push(input.before);
+    }
+
+    if (input.q) {
+      conditions.push('m.content LIKE ?');
+      params.push(`%${input.q}%`);
+    }
+
+    const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
+    const limit = limitValue(input.limit, 50);
+    const useLatestWindow = input.after === undefined && input.q === undefined;
+    const rows = useLatestWindow
+      ? this.db.query(`
+          SELECT *
+          FROM (
+            SELECT m.*, c.name AS chat_name
+            FROM messages m
+            JOIN chats c ON c.id = m.chat_id
+            ${where}
+            ORDER BY m.id DESC
+            LIMIT ?
+          )
+          ORDER BY id ASC
+        `).all(...params, limit) as Record<string, unknown>[]
+      : this.db.query(`
+          SELECT m.*, c.name AS chat_name
+          FROM messages m
+          JOIN chats c ON c.id = m.chat_id
+          ${where}
+          ORDER BY m.id ASC
+          LIMIT ?
+        `).all(...params, limit) as Record<string, unknown>[];
+
+    return this.attachMessageAttachments(rows.map(rowToMessage));
+  }
+
+  getLatestMessageIdForFreshness(chatId: string, sender: string): number {
+    const row = this.db.query(`
+      SELECT COALESCE(MAX(id), 0) AS latest
+      FROM messages
+      WHERE chat_id = ? AND sender != ?
+    `).get(chatId, sender.trim()) as { latest: number } | null;
+    return Number(row?.latest ?? 0);
+  }
+
+  listInterveningMessagesForFreshness(input: { chatId: string; baseMessageId: number; sender: string; limit?: number }): Message[] {
+    const rows = this.db.query(`
+      SELECT m.*, c.name AS chat_name
+      FROM messages m
+      JOIN chats c ON c.id = m.chat_id
+      WHERE m.chat_id = ?
+        AND m.id > ?
+        AND m.sender != ?
+      ORDER BY m.id ASC
+      LIMIT ?
+    `).all(input.chatId, input.baseMessageId, input.sender.trim(), limitValue(input.limit, 50)) as Record<string, unknown>[];
+    return this.attachMessageAttachments(rows.map(rowToMessage));
+  }
+
+  listRoomTasks(roomId: string, status: RoomTaskStatus | 'all' = 'all', limit = 50): RoomTask[] {
+    const room = this.getChatById(roomId);
+    if (!room) throw new Error(`room ${roomId} was not found`);
+    const conditions = ['rt.room_id = ?'];
+    const params: SQLQueryBindings[] = [room.id];
+    if (status !== 'all') {
+      conditions.push('rt.status = ?');
+      params.push(assertRoomTaskStatus(status));
+    }
+    const rows = this.db.query(`
+      SELECT rt.*, c.name AS room_name
+      FROM room_tasks rt
+      JOIN chats c ON c.id = rt.room_id
+      WHERE ${conditions.join(' AND ')}
+      ORDER BY rt.task_number ASC
+      LIMIT ?
+    `).all(...params, limitValue(limit, 50)) as Record<string, unknown>[];
+    return rows.map(rowToRoomTask);
+  }
+
+  getRoomTask(roomId: string, taskNumber: number): RoomTask | null {
+    const row = this.db.query(`
+      SELECT rt.*, c.name AS room_name
+      FROM room_tasks rt
+      JOIN chats c ON c.id = rt.room_id
+      WHERE rt.room_id = ? AND rt.task_number = ?
+    `).get(roomId, taskNumber) as Record<string, unknown> | null;
+    return row ? rowToRoomTask(row) : null;
+  }
+
+  createRoomTasks(input: CreateRoomTasksInput): RoomTask[] {
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    const titles = input.titles.map((title) => title.trim()).filter(Boolean);
+    if (!titles.length) throw new Error('task title is required');
+
+    const sourceMessageId = input.sourceMessageId === undefined ? null : input.sourceMessageId;
+    if (sourceMessageId !== null) {
+      if (!Number.isInteger(sourceMessageId) || sourceMessageId < 1) throw new Error('INVALID_SOURCE_MESSAGE_ID');
+      const sourceMessage = this.getMessage(sourceMessageId);
+      if (!sourceMessage || sourceMessage.chat_id !== room.id) throw new Error('SOURCE_MESSAGE_NOT_FOUND');
+    }
+    const createdBy = input.createdBy?.trim() || null;
+
+    return this.db.transaction(() => {
+      const nextRow = this.db.query(`
+        SELECT COALESCE(MAX(task_number), 0) + 1 AS task_number
+        FROM room_tasks
+        WHERE room_id = ?
+      `).get(room.id) as { task_number: number };
+      let taskNumber = Number(nextRow.task_number ?? 1);
+      const created: RoomTask[] = [];
+      for (const title of titles) {
+        const id = crypto.randomUUID();
+        this.db.query(`
+          INSERT INTO room_tasks (id, room_id, task_number, title, status, assignee, created_by, source_message_id, created_at, updated_at)
+          VALUES (?, ?, ?, ?, 'todo', NULL, ?, ?, datetime('now'), datetime('now'))
+        `).run(id, room.id, taskNumber, title, createdBy, sourceMessageId);
+        created.push(this.getRoomTask(room.id, taskNumber)!);
+        taskNumber += 1;
+      }
+      return created;
+    })();
+  }
+
+  claimRoomTask(input: ClaimRoomTaskInput): RoomTask | null {
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    const assignee = input.assignee.trim();
+    if (!assignee) throw new Error('assignee is required');
+    if (!Number.isInteger(input.taskNumber) || input.taskNumber < 1) throw new Error('INVALID_TASK_NUMBER');
+    const existing = this.getRoomTask(room.id, input.taskNumber);
+    if (!existing) return null;
+    this.db.query(`
+      UPDATE room_tasks
+      SET assignee = ?, status = 'in_progress', completed_at = NULL, updated_at = datetime('now')
+      WHERE room_id = ? AND task_number = ?
+    `).run(assignee, room.id, input.taskNumber);
+    return this.getRoomTask(room.id, input.taskNumber);
+  }
+
+  unclaimRoomTask(roomId: string, taskNumber: number): RoomTask | null {
+    const room = this.getChatById(roomId);
+    if (!room) throw new Error(`room ${roomId} was not found`);
+    if (!Number.isInteger(taskNumber) || taskNumber < 1) throw new Error('INVALID_TASK_NUMBER');
+    const existing = this.getRoomTask(room.id, taskNumber);
+    if (!existing) return null;
+    this.db.query(`
+      UPDATE room_tasks
+      SET assignee = NULL, status = 'todo', completed_at = NULL, updated_at = datetime('now')
+      WHERE room_id = ? AND task_number = ?
+    `).run(room.id, taskNumber);
+    return this.getRoomTask(room.id, taskNumber);
+  }
+
+  updateRoomTaskStatus(input: UpdateRoomTaskInput): RoomTask | null {
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    if (!Number.isInteger(input.taskNumber) || input.taskNumber < 1) throw new Error('INVALID_TASK_NUMBER');
+    const status = assertRoomTaskStatus(input.status);
+    const existing = this.getRoomTask(room.id, input.taskNumber);
+    if (!existing) return null;
+    const completedAtSql = status === 'done' || status === 'closed'
+      ? "COALESCE(completed_at, datetime('now'))"
+      : 'NULL';
+    this.db.query(`
+      UPDATE room_tasks
+      SET status = ?, completed_at = ${completedAtSql}, updated_at = datetime('now')
+      WHERE room_id = ? AND task_number = ?
+    `).run(status, room.id, input.taskNumber);
+    return this.getRoomTask(room.id, input.taskNumber);
+  }
+
+  getRoomReminder(id: string): RoomReminder | null {
+    const row = this.db.query(`
+      SELECT rr.*, c.name AS room_name
+      FROM room_reminders rr
+      JOIN chats c ON c.id = rr.room_id
+      WHERE rr.id = ?
+    `).get(id) as Record<string, unknown> | null;
+    return row ? rowToRoomReminder(row) : null;
+  }
+
+  listRoomReminders(input: ListRoomRemindersInput = {}): RoomReminder[] {
+    const conditions: string[] = [];
+    const params: SQLQueryBindings[] = [];
+    if (input.roomId?.trim()) {
+      const room = this.resolveRoom(input.roomId);
+      if (!room) throw new Error(`room ${input.roomId} was not found`);
+      conditions.push('rr.room_id = ?');
+      params.push(room.id);
+    }
+    if ((input.status ?? 'scheduled') !== 'all') {
+      conditions.push('rr.status = ?');
+      params.push(assertRoomReminderStatus(input.status ?? 'scheduled'));
+    }
+    if (input.createdBy?.trim()) {
+      conditions.push('rr.created_by = ?');
+      params.push(input.createdBy.trim());
+    }
+    const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
+    const rows = this.db.query(`
+      SELECT rr.*, c.name AS room_name
+      FROM room_reminders rr
+      JOIN chats c ON c.id = rr.room_id
+      ${where}
+      ORDER BY rr.fire_at ASC, rr.created_at ASC
+      LIMIT ?
+    `).all(...params, limitValue(input.limit, 50)) as Record<string, unknown>[];
+    return rows.map(rowToRoomReminder);
+  }
+
+  createRoomReminder(input: CreateRoomReminderInput): RoomReminder {
+    if (!Number.isInteger(input.sourceMessageId) || input.sourceMessageId < 1) throw new Error('INVALID_SOURCE_MESSAGE_ID');
+    const sourceMessage = this.getMessage(input.sourceMessageId);
+    if (!sourceMessage) throw new Error('SOURCE_MESSAGE_NOT_FOUND');
+    const title = input.title.trim();
+    if (!title) throw new Error('reminder title is required');
+    const fireAt = normalizeReminderFireAt(input);
+    const createdBy = input.createdBy?.trim() || null;
+    const repeat = normalizeReminderRepeat(input.repeat);
+    const id = crypto.randomUUID();
+    this.db.query(`
+      INSERT INTO room_reminders (id, room_id, source_message_id, title, status, created_by, fire_at, repeat, created_at, updated_at)
+      VALUES (?, ?, ?, ?, 'scheduled', ?, ?, ?, datetime('now'), datetime('now'))
+    `).run(id, sourceMessage.chat_id, sourceMessage.id, title, createdBy, fireAt, repeat);
+    return this.getRoomReminder(id)!;
+  }
+
+  cancelRoomReminder(id: string): RoomReminder | null {
+    const reminderId = id.trim();
+    if (!reminderId) return null;
+    const existing = this.getRoomReminder(reminderId);
+    if (!existing) return null;
+    if (existing.status === 'scheduled') {
+      this.db.query(`
+        UPDATE room_reminders
+        SET status = 'canceled', canceled_at = datetime('now'), updated_at = datetime('now')
+        WHERE id = ?
+      `).run(reminderId);
+    }
+    return this.getRoomReminder(reminderId);
+  }
+
+  getRoomSavedMessage(id: string): RoomSavedMessage | null {
+    const savedMessageId = id.trim();
+    if (!savedMessageId) return null;
+    const row = this.db.query(`
+      SELECT
+        rsm.*,
+        c.name AS room_name,
+        m.sender AS message_sender,
+        m.content AS message_content,
+        m.created_at AS message_created_at
+      FROM room_saved_messages rsm
+      JOIN chats c ON c.id = rsm.room_id
+      JOIN messages m ON m.id = rsm.message_id
+      WHERE rsm.id = ?
+    `).get(savedMessageId) as Record<string, unknown> | null;
+    return row ? rowToRoomSavedMessage(row) : null;
+  }
+
+  listRoomSavedMessages(input: ListRoomSavedMessagesInput = {}): RoomSavedMessage[] {
+    const conditions: string[] = [];
+    const params: SQLQueryBindings[] = [];
+    if (input.roomId?.trim()) {
+      const room = this.resolveRoom(input.roomId);
+      if (!room) throw new Error(`room ${input.roomId} was not found`);
+      conditions.push('rsm.room_id = ?');
+      params.push(room.id);
+    }
+    if (input.savedBy?.trim()) {
+      conditions.push('rsm.saved_by = ?');
+      params.push(input.savedBy.trim());
+    }
+    const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
+    const rows = this.db.query(`
+      SELECT
+        rsm.*,
+        c.name AS room_name,
+        m.sender AS message_sender,
+        m.content AS message_content,
+        m.created_at AS message_created_at
+      FROM room_saved_messages rsm
+      JOIN chats c ON c.id = rsm.room_id
+      JOIN messages m ON m.id = rsm.message_id
+      ${where}
+      ORDER BY rsm.created_at DESC, rsm.updated_at DESC
+      LIMIT ?
+    `).all(...params, limitValue(input.limit, 50)) as Record<string, unknown>[];
+    return rows.map(rowToRoomSavedMessage);
+  }
+
+  saveRoomMessage(input: CreateRoomSavedMessageInput): SaveRoomMessageResult {
+    if (!Number.isInteger(input.sourceMessageId) || input.sourceMessageId < 1) throw new Error('INVALID_SOURCE_MESSAGE_ID');
+    const sourceMessage = this.getMessage(input.sourceMessageId);
+    if (!sourceMessage) throw new Error('SOURCE_MESSAGE_NOT_FOUND');
+    const savedBy = input.savedBy.trim();
+    if (!savedBy) throw new Error('saved_by is required');
+    const note = input.note?.trim() || null;
+    const existing = this.db.query(`
+      SELECT id
+      FROM room_saved_messages
+      WHERE message_id = ? AND saved_by = ?
+    `).get(sourceMessage.id, savedBy) as { id: string } | null;
+    if (existing) {
+      this.db.query(`
+        UPDATE room_saved_messages
+        SET note = ?, updated_at = datetime('now')
+        WHERE id = ?
+      `).run(note, existing.id);
+      return { savedMessage: this.getRoomSavedMessage(existing.id)!, created: false };
+    }
+    const id = crypto.randomUUID();
+    this.db.query(`
+      INSERT INTO room_saved_messages (id, room_id, message_id, saved_by, note, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+    `).run(id, sourceMessage.chat_id, sourceMessage.id, savedBy, note);
+    return { savedMessage: this.getRoomSavedMessage(id)!, created: true };
+  }
+
+  removeRoomSavedMessage(id: string): RoomSavedMessage | null {
+    const savedMessage = this.getRoomSavedMessage(id);
+    if (!savedMessage) return null;
+    this.db.query('DELETE FROM room_saved_messages WHERE id = ?').run(savedMessage.id);
+    return savedMessage;
+  }
+
+  createWorkflowRun(input: CreateWorkflowRunInput): WorkflowRun {
+    const filePath = input.filePath.trim();
+    if (!filePath) throw new Error('workflow file_path is required');
+    const id = crypto.randomUUID();
+    this.db.query(`
+      INSERT INTO workflow_runs (id, file_path, goal, status, created_by, created_at, updated_at)
+      VALUES (?, ?, ?, 'running', ?, datetime('now'), datetime('now'))
+    `).run(id, filePath, input.goal?.trim() || null, input.createdBy?.trim() || null);
+    return this.getWorkflowRun(id)!;
+  }
+
+  getWorkflowRun(id: string): WorkflowRun | null {
+    const row = this.db.query('SELECT * FROM workflow_runs WHERE id = ?').get(id.trim()) as Record<string, unknown> | null;
+    return row ? rowToWorkflowRun(row) : null;
+  }
+
+  listWorkflowRuns(input: { status?: WorkflowRunStatus | 'all'; limit?: number } = {}): WorkflowRun[] {
+    const status = input.status ?? 'all';
+    const rows = status === 'all'
+      ? this.db.query(`
+          SELECT * FROM workflow_runs
+          ORDER BY datetime(updated_at) DESC, datetime(created_at) DESC
+          LIMIT ?
+        `).all(limitValue(input.limit, 50)) as Record<string, unknown>[]
+      : this.db.query(`
+          SELECT * FROM workflow_runs
+          WHERE status = ?
+          ORDER BY datetime(updated_at) DESC, datetime(created_at) DESC
+          LIMIT ?
+        `).all(assertWorkflowRunStatus(status), limitValue(input.limit, 50)) as Record<string, unknown>[];
+    return rows.map(rowToWorkflowRun);
+  }
+
+  finishWorkflowRun(id: string, input: FinishWorkflowRunInput): WorkflowRun {
+    const run = this.getWorkflowRun(id);
+    if (!run) throw new Error(`workflow run ${id} was not found`);
+    const status = assertWorkflowRunStatus(input.status);
+    const finalOutput = input.finalOutput === undefined ? run.final_output : input.finalOutput;
+    const error = input.error === undefined ? run.error : input.error;
+    const completedAtSql = status === 'running' ? 'NULL' : "COALESCE(completed_at, datetime('now'))";
+    this.db.query(`
+      UPDATE workflow_runs
+      SET status = ?,
+          final_output_json = ?,
+          error = ?,
+          completed_at = ${completedAtSql},
+          updated_at = datetime('now')
+      WHERE id = ?
+    `).run(status, finalOutput ? JSON.stringify(finalOutput) : null, error?.trim() || null, run.id);
+    return this.getWorkflowRun(run.id)!;
+  }
+
+  createWorkflowNode(input: CreateWorkflowNodeInput): WorkflowNode {
+    const run = this.getWorkflowRun(input.runId);
+    if (!run) throw new Error(`workflow run ${input.runId} was not found`);
+    const parentId = input.parentId?.trim() || null;
+    if (parentId) {
+      const parent = this.getWorkflowNode(parentId);
+      if (!parent) throw new Error(`workflow parent node ${parentId} was not found`);
+      if (parent.run_id !== run.id) throw new Error('WORKFLOW_PARENT_RUN_MISMATCH');
+    }
+    const title = input.title.trim();
+    if (!title) throw new Error('workflow node title is required');
+    const status = assertWorkflowNodeStatus(input.status ?? 'pending');
+    const id = crypto.randomUUID();
+    const completedAtSql = status === 'done' || status === 'failed' ? "datetime('now')" : 'NULL';
+    this.db.query(`
+      INSERT INTO workflow_nodes (
+        id, run_id, parent_id, kind, title, role, status, context_json, instruction,
+        capabilities_json, output_contract_json, output_json, evidence_json, task_id,
+        message_id, created_at, updated_at, completed_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'), ${completedAtSql})
     `).run(
-      chat.id,
+      id,
+      run.id,
       parentId,
-      depth,
-      sender,
-      input.recipient?.trim() || null,
-      content,
-      input.type ?? 'message',
-      idempotencyKey,
-      channelId,
-      provider,
-      JSON.stringify(mentions),
+      assertWorkflowNodeKind(input.kind),
+      title,
+      input.role?.trim() || null,
+      status,
+      input.context ? JSON.stringify(input.context) : null,
+      input.instruction?.trim() || null,
+      JSON.stringify(input.capabilities ?? []),
+      input.outputContract ? JSON.stringify(input.outputContract) : null,
+      input.output ? JSON.stringify(input.output) : null,
+      input.evidence ? JSON.stringify(input.evidence) : null,
+      input.taskId?.trim() || null,
+      input.messageId ?? null,
     );
+    return this.getWorkflowNode(id)!;
+  }
 
-    const id = Number(result.lastInsertRowid);
-    return this.getMessage(id)!;
+  getWorkflowNode(id: string): WorkflowNode | null {
+    const row = this.db.query('SELECT * FROM workflow_nodes WHERE id = ?').get(id.trim()) as Record<string, unknown> | null;
+    return row ? rowToWorkflowNode(row) : null;
   }
 
-  getMessage(id: number): Message | null {
-    const row = this.db.query(`
-      SELECT m.*, c.name AS chat_name
-      FROM messages m
-      JOIN chats c ON c.id = m.chat_id
-      WHERE m.id = ?
-    `).get(id) as Record<string, unknown> | null;
-    return row ? rowToMessage(row) : null;
+  updateWorkflowNode(id: string, input: UpdateWorkflowNodeInput): WorkflowNode {
+    const node = this.getWorkflowNode(id);
+    if (!node) throw new Error(`workflow node ${id} was not found`);
+    const status = input.status ? assertWorkflowNodeStatus(input.status) : node.status;
+    const completedAtSql = status === 'done' || status === 'failed'
+      ? "COALESCE(completed_at, datetime('now'))"
+      : 'NULL';
+    const output = input.output === undefined ? node.output : input.output;
+    const evidence = input.evidence === undefined ? node.evidence : input.evidence;
+    const taskId = input.taskId === undefined ? node.task_id : input.taskId;
+    const messageId = input.messageId === undefined ? node.message_id : input.messageId;
+    this.db.query(`
+      UPDATE workflow_nodes
+      SET status = ?,
+          output_json = ?,
+          evidence_json = ?,
+          task_id = ?,
+          message_id = ?,
+          completed_at = ${completedAtSql},
+          updated_at = datetime('now')
+      WHERE id = ?
+    `).run(
+      status,
+      output ? JSON.stringify(output) : null,
+      evidence ? JSON.stringify(evidence) : null,
+      taskId?.trim() || null,
+      messageId ?? null,
+      node.id,
+    );
+    return this.getWorkflowNode(node.id)!;
   }
 
-  listMessages(input: ListMessagesInput = {}): Message[] {
-    const conditions: string[] = [];
-    const params: SQLQueryBindings[] = [];
+  listWorkflowNodes(runId: string): WorkflowNode[] {
+    const run = this.getWorkflowRun(runId);
+    if (!run) throw new Error(`workflow run ${runId} was not found`);
+    const rows = this.db.query(`
+      SELECT *
+      FROM workflow_nodes
+      WHERE run_id = ?
+      ORDER BY datetime(created_at) ASC, rowid ASC
+    `).all(run.id) as Record<string, unknown>[];
+    return rows.map(rowToWorkflowNode);
+  }
 
-    if (input.chatId) {
-      conditions.push('m.chat_id = ?');
-      params.push(input.chatId);
-    } else if (input.chatName) {
-      conditions.push('c.name = ?');
-      params.push(normalizeChatName(input.chatName));
-    }
+  getWorkflowRunRecord(id: string): WorkflowRunRecord | null {
+    const run = this.getWorkflowRun(id);
+    if (!run) return null;
+    return { run, nodes: this.listWorkflowNodes(run.id) };
+  }
 
-    if (input.parentId !== undefined) {
-      if (input.parentId === null) {
-        conditions.push('m.parent_id IS NULL');
-      } else {
-        conditions.push('(m.id = ? OR m.parent_id = ?)');
-        params.push(input.parentId, input.parentId);
+  fireDueRoomReminders(input: FireDueRoomRemindersInput = {}): FireDueRoomRemindersResult {
+    const now = normalizeReminderFireNow(input.now);
+    const due = this.db.query(`
+      SELECT rr.*, c.name AS room_name
+      FROM room_reminders rr
+      JOIN chats c ON c.id = rr.room_id
+      WHERE rr.status = 'scheduled' AND rr.fire_at <= ?
+      ORDER BY rr.fire_at ASC, rr.created_at ASC
+      LIMIT ?
+    `).all(now, limitValue(input.limit, 25)) as Record<string, unknown>[];
+
+    return this.db.transaction(() => {
+      const fired: FiredRoomReminder[] = [];
+      const messages: Message[] = [];
+      const deliveries: MessageDelivery[] = [];
+
+      for (const row of due) {
+        const reminder = this.getRoomReminder(String(row.id));
+        if (!reminder || reminder.status !== 'scheduled' || reminder.fire_at > now) continue;
+        const source = this.getMessage(reminder.source_message_id);
+        const recipient = reminder.created_by?.trim() || null;
+        const message = this.createMessage({
+          chatId: reminder.room_id,
+          sender: 'pal',
+          recipient,
+          content: reminderFireMessageContent(reminder, source),
+          type: 'system',
+          idempotencyKey: reminderFireIdempotencyKey(reminder),
+          mentions: recipient ? [recipient] : [],
+        });
+        const reminderDeliveries = this.resolveDeliveriesForMessage(message.id);
+        const updated = reminder.repeat
+          ? this.db.query(`
+              UPDATE room_reminders
+              SET fire_at = ?, fired_at = ?, updated_at = ?
+              WHERE id = ? AND status = 'scheduled'
+            `).run(nextReminderFireAt(reminder, now), now, now, reminder.id)
+          : this.db.query(`
+              UPDATE room_reminders
+              SET status = 'fired', fired_at = ?, updated_at = ?
+              WHERE id = ? AND status = 'scheduled'
+            `).run(now, now, reminder.id);
+        if (updated.changes === 0) continue;
+        const firedReminder = this.getRoomReminder(reminder.id)!;
+        fired.push({ reminder: firedReminder, message, deliveries: reminderDeliveries });
+        messages.push(message);
+        deliveries.push(...reminderDeliveries);
       }
-    }
 
-    if (input.after !== undefined) {
-      conditions.push('m.id > ?');
-      params.push(input.after);
-    }
+      return {
+        fired,
+        reminders: fired.map((item) => item.reminder),
+        messages,
+        deliveries,
+      };
+    })();
+  }
 
-    if (input.q) {
-      conditions.push('m.content LIKE ?');
-      params.push(`%${input.q}%`);
-    }
+  createHeldMessageDraft(input: CreateHeldMessageDraftInput): HeldMessageDraft {
+    const room = this.getChatById(input.chatId);
+    if (!room) throw new Error(`chat ${input.chatId} was not found`);
+    const agent = input.agent.trim();
+    const sender = input.sender.trim();
+    const content = input.content.trim();
+    if (!agent) throw new Error('agent is required');
+    if (!sender) throw new Error('sender is required');
+    if (!content) throw new Error('content is required');
+    if (!this.getAgent(agent)) throw new Error(`agent ${agent} not found`);
+    const id = crypto.randomUUID();
+    this.db.query(`
+      INSERT INTO held_message_drafts (id, chat_id, agent, sender, content, mentions_json, base_message_id, latest_message_id_at_hold, status, hold_reason)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'held', ?)
+    `).run(
+      id,
+      room.id,
+      agent,
+      sender,
+      content,
+      JSON.stringify(normalizeMentionsInput(input.mentions)),
+      input.baseMessageId,
+      input.latestMessageIdAtHold,
+      input.holdReason,
+    );
+    return this.getHeldMessageDraft(id)!;
+  }
 
-    const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
+  getHeldMessageDraft(id: string): HeldMessageDraft | null {
+    const row = this.db.query(`
+      SELECT hmd.*, c.name AS chat_name, c.display_name AS chat_display_name,
+        (
+          SELECT COUNT(*)
+          FROM messages m
+          WHERE m.chat_id = hmd.chat_id
+            AND m.id > hmd.base_message_id
+            AND m.id <= hmd.latest_message_id_at_hold
+            AND m.sender != hmd.sender
+        ) AS intervening_message_count
+      FROM held_message_drafts hmd
+      JOIN chats c ON c.id = hmd.chat_id
+      WHERE hmd.id = ?
+      LIMIT 1
+    `).get(id.trim()) as Record<string, unknown> | null;
+    return row ? rowToHeldMessageDraft(row) : null;
+  }
+
+  listHeldMessageDrafts(agent: string, status: HeldDraftStatus = 'held', limit = 50): HeldMessageDraft[] {
     const rows = this.db.query(`
-      SELECT m.*, c.name AS chat_name
-      FROM messages m
-      JOIN chats c ON c.id = m.chat_id
-      ${where}
-      ORDER BY m.id ASC
+      SELECT hmd.*, c.name AS chat_name, c.display_name AS chat_display_name,
+        (
+          SELECT COUNT(*)
+          FROM messages m
+          WHERE m.chat_id = hmd.chat_id
+            AND m.id > hmd.base_message_id
+            AND m.id <= hmd.latest_message_id_at_hold
+            AND m.sender != hmd.sender
+        ) AS intervening_message_count
+      FROM held_message_drafts hmd
+      JOIN chats c ON c.id = hmd.chat_id
+      WHERE hmd.agent = ? AND hmd.status = ?
+      ORDER BY datetime(hmd.created_at) DESC, hmd.id ASC
       LIMIT ?
-    `).all(...params, limitValue(input.limit, 50)) as Record<string, unknown>[];
+    `).all(agent.trim(), status, limitValue(limit, 50)) as Record<string, unknown>[];
+    return rows.map(rowToHeldMessageDraft);
+  }
+
+  abandonHeldMessageDraft(id: string): HeldMessageDraft | null {
+    const existing = this.getHeldMessageDraft(id);
+    if (!existing) return null;
+    if (existing.status !== 'held') throw new Error('HELD_DRAFT_ALREADY_RESOLVED');
+    const result = this.db.query(`
+      UPDATE held_message_drafts
+      SET status = 'abandoned', updated_at = datetime('now'), resolved_at = datetime('now')
+      WHERE id = ? AND status = 'held'
+    `).run(existing.id);
+    if (result.changes === 0) throw new Error('HELD_DRAFT_ALREADY_RESOLVED');
+    return this.getHeldMessageDraft(existing.id)!;
+  }
+
+  sendHeldMessageDraftAnyway(id: string): { draft: HeldMessageDraft; message: Message } | null {
+    return this.db.transaction(() => {
+      const existing = this.getHeldMessageDraft(id);
+      if (!existing) return null;
+      if (existing.status !== 'held') throw new Error('HELD_DRAFT_ALREADY_RESOLVED');
+      const message = this.createMessage({
+        chatId: existing.chat_id,
+        sender: existing.sender,
+        content: existing.content,
+        mentions: existing.mentions,
+      });
+      const result = this.db.query(`
+        UPDATE held_message_drafts
+        SET status = 'sent_anyway',
+            resolved_message_id = ?,
+            updated_at = datetime('now'),
+            resolved_at = datetime('now')
+        WHERE id = ? AND status = 'held'
+      `).run(message.id, existing.id);
+      if (result.changes === 0) throw new Error('HELD_DRAFT_ALREADY_RESOLVED');
+      return { draft: this.getHeldMessageDraft(existing.id)!, message };
+    })();
+  }
+
+  reviseHeldMessageDraft(id: string, content: string): { draft: HeldMessageDraft; message: Message } | null {
+    const revisedContent = content.trim();
+    if (!revisedContent) throw new Error('content is required');
+    return this.db.transaction(() => {
+      const existing = this.getHeldMessageDraft(id);
+      if (!existing) return null;
+      if (existing.status !== 'held') throw new Error('HELD_DRAFT_ALREADY_RESOLVED');
+      const message = this.createMessage({
+        chatId: existing.chat_id,
+        sender: existing.sender,
+        content: revisedContent,
+        mentions: existing.mentions,
+      });
+      const result = this.db.query(`
+        UPDATE held_message_drafts
+        SET status = 'sent_anyway',
+            resolved_message_id = ?,
+            updated_at = datetime('now'),
+            resolved_at = datetime('now')
+        WHERE id = ? AND status = 'held'
+      `).run(message.id, existing.id);
+      if (result.changes === 0) throw new Error('HELD_DRAFT_ALREADY_RESOLVED');
+      return { draft: this.getHeldMessageDraft(existing.id)!, message };
+    })();
+  }
 
-    return rows.map(rowToMessage);
+  getDeliveryContext(input: { agent: string; chatId: string; messageId: number; limit?: number }): DeliveryContext {
+    const room = this.getChatById(input.chatId);
+    if (!room) throw new Error(`room ${input.chatId} was not found`);
+    const trigger = this.getMessage(input.messageId);
+    if (!trigger) throw new Error(`message ${input.messageId} was not found`);
+    if (trigger.chat_id !== room.id) throw new Error(`message ${input.messageId} does not belong to room ${room.id}`);
+
+    const participant = this.getRoomParticipant(room.id, input.agent);
+    const cursor = participant?.delivery_cursor_message_id ?? 0;
+    const previous = this.db.query(`
+      SELECT COALESCE(MAX(message_id), 0) AS message_id
+      FROM message_deliveries
+      WHERE agent = ? AND chat_id = ? AND message_id < ?
+    `).get(input.agent, room.id, trigger.id) as { message_id: number } | null;
+    const startMessageId = Math.max(Number(cursor ?? 0), Number(previous?.message_id ?? 0), 0);
+    const total = this.db.query(`
+      SELECT COUNT(*) AS count
+      FROM messages
+      WHERE chat_id = ? AND id > ? AND id <= ?
+    `).get(room.id, startMessageId, trigger.id) as { count: number };
+    const limit = limitValue(input.limit, 50);
+    const rows = this.db.query(`
+      SELECT *
+      FROM (
+        SELECT m.*, c.name AS chat_name
+        FROM messages m
+        JOIN chats c ON c.id = m.chat_id
+        WHERE m.chat_id = ? AND m.id > ? AND m.id <= ?
+        ORDER BY m.id DESC
+        LIMIT ?
+      )
+      ORDER BY id ASC
+    `).all(room.id, startMessageId, trigger.id, limit) as Record<string, unknown>[];
+    const totalCount = Number(total.count ?? 0);
+    return {
+      startMessageId,
+      totalCount,
+      omittedCount: Math.max(0, totalCount - rows.length),
+      messages: this.attachMessageAttachments(rows.map(rowToMessage)),
+      savedMessages: this.listRoomSavedMessages({ roomId: room.id, limit: 10 }),
+    };
   }
 
   listInbox(agent: string, after = 0, limit = 50): Message[] {
@@ -2159,7 +4689,7 @@ export class MessageStore {
       LIMIT ?
     `).all(after, agent, agent, limitValue(limit, 50)) as Record<string, unknown>[];
 
-    return rows.map(rowToMessage);
+    return this.attachMessageAttachments(rows.map(rowToMessage));
   }
 
   getComputer(id: string): Computer | null {
@@ -2176,6 +4706,79 @@ export class MessageStore {
     return rows.map(rowToComputer);
   }
 
+  updateComputerName(id: string, name: string): Computer {
+    const computerId = id.trim();
+    const displayName = name.trim();
+    if (!computerId) throw new Error('computer id is required');
+    if (!displayName) throw new Error('computer name is required');
+    this.db.query(`
+      UPDATE computers
+      SET name = ?, updated_at = datetime('now')
+      WHERE id = ?
+    `).run(displayName, computerId);
+    const computer = this.getComputer(computerId);
+    if (!computer) throw new Error('computer not found');
+    return computer;
+  }
+
+  regenerateComputerCommand(id: string, input: RegenerateComputerCommandInput = {}): ProvisionedComputer {
+    const computer = this.getComputer(id);
+    if (!computer) throw new Error('computer not found');
+    const apiKey = `sk_machine_${randomBytes(32).toString('hex')}`;
+    this.db.query(`
+      UPDATE computers
+      SET credential_hash = ?, updated_at = datetime('now')
+      WHERE id = ?
+    `).run(hashSecret(apiKey), computer.id);
+    const serverUrl = input.serverUrl?.trim() || 'http://127.0.0.1:4127';
+    const command = daemonStartCommand({ commandPrefix: input.packageName, serverUrl, apiKey, name: computer.name });
+    return { computer: this.getComputer(computer.id)!, api_key: apiKey, command };
+  }
+
+  getComputerDeletionImpact(id: string): ComputerDeletionImpact | null {
+    const computer = this.getComputer(id);
+    if (!computer) return null;
+    return {
+      computer,
+      projects: this.listProjectsForComputer(computer.id),
+      assignments: this.listComputerAgentAssignments(computer.id),
+    };
+  }
+
+  deleteComputer(id: string, options: { removeProjects?: boolean; removeAssignments?: boolean } = {}): ComputerDeletionResult {
+    const computer = this.getComputer(id);
+    if (!computer) throw new Error('computer not found');
+    const impact = this.getComputerDeletionImpact(computer.id)!;
+    if (impact.projects.length > 0 && options.removeProjects !== true) throw new Error('COMPUTER_HAS_PROJECTS');
+    if (impact.assignments.length > 0 && options.removeAssignments !== true) throw new Error('COMPUTER_HAS_ASSIGNMENTS');
+    let projectsRemoved = 0;
+    let assignmentsRemoved = 0;
+    let connectionsRemoved = 0;
+    this.db.transaction(() => {
+      if (options.removeProjects === true) {
+        const projectIds = impact.projects.map((project) => project.id);
+        for (const projectId of projectIds) {
+          this.db.query('DELETE FROM chats WHERE project_id = ?').run(projectId);
+          const result = this.db.query('DELETE FROM projects WHERE id = ?').run(projectId);
+          projectsRemoved += result.changes;
+        }
+      }
+      if (options.removeAssignments === true) {
+        const result = this.db.query('DELETE FROM computer_agent_assignments WHERE computer_id = ?').run(computer.id);
+        assignmentsRemoved += result.changes;
+      }
+      const connectionsResult = this.db.query('DELETE FROM computer_connections WHERE computer_id = ?').run(computer.id);
+      connectionsRemoved += connectionsResult.changes;
+      this.db.query('DELETE FROM computers WHERE id = ?').run(computer.id);
+    })();
+    return {
+      computer,
+      projects_removed: projectsRemoved,
+      assignments_removed: assignmentsRemoved,
+      connections_removed: connectionsRemoved,
+    };
+  }
+
   private getComputerByCredential(secret: string): Computer | null {
     const row = this.db.query('SELECT * FROM computers WHERE credential_hash = ? ORDER BY created_at DESC LIMIT 1').get(hashSecret(secret.trim())) as Record<string, unknown> | null;
     return row ? rowToComputer(row) : null;
@@ -2186,6 +4789,17 @@ export class MessageStore {
     return row ? rowToComputerConnection(row) : null;
   }
 
+  listActiveComputerConnections(): ComputerConnection[] {
+    const rows = this.db.query(`
+      SELECT cc.*
+      FROM computer_connections cc
+      JOIN computers c ON c.active_connection_id = cc.id
+      WHERE cc.status = 'active' AND c.status = 'online'
+      ORDER BY datetime(cc.last_heartbeat_at) DESC, cc.id ASC
+    `).all() as Record<string, unknown>[];
+    return rows.map(rowToComputerConnection);
+  }
+
   provisionComputer(input: ProvisionComputerInput = {}): ProvisionedComputer {
     const id = `machine_${randomBytes(8).toString('hex')}`;
     const apiKey = `sk_machine_${randomBytes(32).toString('hex')}`;
@@ -2195,9 +4809,8 @@ export class MessageStore {
       VALUES (?, ?, ?, 'offline', NULL, NULL, datetime('now'))
     `).run(id, name, hashSecret(apiKey));
 
-    const packageName = input.packageName?.trim() || '@controlflow-ai/daemon@latest';
     const serverUrl = input.serverUrl?.trim() || 'http://127.0.0.1:4127';
-    const command = `npx ${packageName} --server-url ${serverUrl} --api-key ${apiKey} # ${name}`;
+    const command = daemonStartCommand({ commandPrefix: input.packageName, serverUrl, apiKey, name });
     return { computer: this.getComputer(id)!, api_key: apiKey, command };
   }
 
@@ -2209,13 +4822,14 @@ export class MessageStore {
     if (!computerId) throw new Error('computer_id is required');
     if (!secret) throw new Error('computer secret is required');
     const credentialHash = hashSecret(secret);
-    const existing = this.db.query('SELECT credential_hash FROM computers WHERE id = ?').get(computerId) as { credential_hash: string } | null;
+    const existing = this.db.query('SELECT credential_hash, name FROM computers WHERE id = ?').get(computerId) as { credential_hash: string; name: string } | null;
     if (existing && existing.credential_hash !== credentialHash) {
       throw new Error('invalid computer credential');
     }
 
     const connectionId = crypto.randomUUID();
     const token = generateConnectionToken();
+    const localControlToken = generateConnectionToken();
     const tokenHash = hashSecret(token);
     const revokedRows = this.db.query(`
       SELECT id FROM computer_connections
@@ -2224,7 +4838,8 @@ export class MessageStore {
     const revokedConnectionIds = revokedRows.map((row) => row.id);
     const epochRow = this.db.query('SELECT COALESCE(MAX(epoch), 0) + 1 AS epoch FROM computer_connections WHERE computer_id = ?').get(computerId) as { epoch: number };
     const epoch = Number(epochRow.epoch);
-    const name = input.name?.trim() || computerId;
+    const providedName = input.name?.trim() || null;
+    const name = providedName ?? existing?.name ?? computerId;
 
     this.db.transaction(() => {
       if (!existing) {
@@ -2235,9 +4850,13 @@ export class MessageStore {
       } else {
         this.db.query(`
           UPDATE computers
-          SET name = ?, status = 'online', active_connection_id = ?, last_seen_at = datetime('now'), updated_at = datetime('now')
+          SET name = CASE WHEN ? IS NOT NULL THEN ? ELSE name END,
+              status = 'online',
+              active_connection_id = ?,
+              last_seen_at = datetime('now'),
+              updated_at = datetime('now')
           WHERE id = ?
-        `).run(name, connectionId, computerId);
+        `).run(providedName, providedName, connectionId, computerId);
       }
       this.db.query(`
         UPDATE computer_connections
@@ -2270,9 +4889,9 @@ export class MessageStore {
         }
       }
       this.db.query(`
-        INSERT INTO computer_connections (id, computer_id, token_hash, epoch, status, connected_at, last_heartbeat_at)
-        VALUES (?, ?, ?, ?, 'active', datetime('now'), datetime('now'))
-      `).run(connectionId, computerId, tokenHash, epoch);
+        INSERT INTO computer_connections (id, computer_id, token_hash, local_control_token, epoch, status, connected_at, last_heartbeat_at)
+        VALUES (?, ?, ?, ?, ?, 'active', datetime('now'), datetime('now'))
+      `).run(connectionId, computerId, tokenHash, localControlToken, epoch);
       this.db.query(`
         INSERT INTO daemon_instances (id, name, host, local_url, server_url, status, last_seen_at)
         VALUES (?, ?, ?, ?, ?, 'online', datetime('now'))
@@ -2303,11 +4922,45 @@ export class MessageStore {
       computer: this.getComputer(computerId)!,
       connection: this.getComputerConnection(connectionId)!,
       token,
+      localControlToken,
       daemon: this.getDaemon(connectionId)!,
       agents: this.listComputerAgentAssignments(computerId),
     };
   }
 
+  getComputerLocalControl(computerId: string): { computer: Computer; connection: ComputerConnection; daemon: DaemonInstance; token: string } | null {
+    const computer = this.getComputer(computerId);
+    if (!computer || computer.status !== 'online' || !computer.active_connection_id) return null;
+    const connection = this.getComputerConnection(computer.active_connection_id);
+    if (!connection || connection.status !== 'active') return null;
+    const row = this.db.query(`
+      SELECT local_control_token
+      FROM computer_connections
+      WHERE id = ? AND computer_id = ? AND status = 'active'
+      LIMIT 1
+    `).get(connection.id, computer.id) as { local_control_token: string | null } | null;
+    const token = row?.local_control_token?.trim();
+    if (!token) return null;
+    const daemon = this.getDaemon(connection.id);
+    if (!daemon || daemon.status !== 'online' || !daemon.local_url.trim()) return null;
+    return { computer, connection, daemon, token };
+  }
+
+  getComputerWorkload(computerId: string): ComputerWorkload | null {
+    const computer = this.getComputer(computerId);
+    if (!computer) return null;
+    const connection = computer.active_connection_id ? this.getComputerConnection(computer.active_connection_id) : null;
+    const daemon = connection ? this.getDaemon(connection.id) : null;
+    return {
+      computer,
+      connection,
+      daemon,
+      assignments: this.listComputerAgentAssignments(computer.id),
+      runs: this.listRunsForComputer(computer.id, 20),
+      deliveries: this.listActiveDeliveriesForComputer(computer.id, 20),
+    };
+  }
+
   closeStaleComputerConnections(timeoutMs: number, now = new Date()): number {
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0) throw new Error('timeoutMs must be non-negative');
     const cutoff = new Date(now.getTime() - timeoutMs).toISOString();
@@ -2317,7 +4970,6 @@ export class MessageStore {
       JOIN computers c ON c.active_connection_id = cc.id
       WHERE cc.status = 'active' AND datetime(cc.last_heartbeat_at) < datetime(?)
     `).all(cutoff) as Array<{ id: string; computer_id: string }>;
-    if (staleRows.length === 0) return 0;
     this.db.transaction(() => {
       for (const row of staleRows) {
         this.db.query(`
@@ -2330,7 +4982,103 @@ export class MessageStore {
           SET status = 'offline', active_connection_id = NULL, updated_at = datetime('now')
           WHERE id = ? AND active_connection_id = ?
         `).run(row.computer_id, row.id);
+        this.db.query(`
+          UPDATE agent_runs
+          SET status = 'killed',
+              action = NULL,
+              ended_at = COALESCE(ended_at, datetime('now')),
+              updated_at = datetime('now'),
+              output = CASE WHEN output = '' THEN 'computer connection heartbeat timed out' ELSE output END
+          WHERE computer_id = ? AND status = 'running'
+        `).run(row.computer_id);
+        this.db.query(`
+          UPDATE message_deliveries
+          SET status = 'pending',
+              daemon_id = NULL,
+              connection_id = NULL,
+              claim_token = NULL,
+              lease_until = NULL,
+              run_id = NULL,
+              last_error = '',
+              claimed_at = NULL
+          WHERE status IN ('claimed', 'processing_completed')
+            AND (
+              connection_id = ?
+              OR (connection_id IS NULL AND daemon_id = ?)
+            )
+        `).run(row.id, row.id);
       }
+      this.db.query(`
+        UPDATE agent_runs
+        SET status = 'killed',
+            action = NULL,
+            ended_at = COALESCE(ended_at, datetime('now')),
+            updated_at = datetime('now'),
+            output = CASE WHEN output = '' THEN 'computer connection is no longer active' ELSE output END
+        WHERE status = 'running'
+          AND (
+            (
+              connection_id IS NOT NULL
+              AND NOT EXISTS (
+                SELECT 1
+                FROM computer_connections cc
+                JOIN computers c ON c.active_connection_id = cc.id
+                WHERE cc.id = agent_runs.connection_id
+                  AND cc.status = 'active'
+                  AND c.status = 'online'
+              )
+            )
+            OR (
+              connection_id IS NULL
+              AND computer_id IS NOT NULL
+              AND NOT EXISTS (
+                SELECT 1
+                FROM computers c
+                JOIN computer_connections cc ON cc.id = c.active_connection_id
+                WHERE c.id = agent_runs.computer_id
+                  AND c.status = 'online'
+                  AND cc.status = 'active'
+              )
+            )
+          )
+      `).run();
+      this.db.query(`
+        UPDATE message_deliveries
+        SET status = 'pending',
+            daemon_id = NULL,
+            connection_id = NULL,
+            claim_token = NULL,
+            lease_until = NULL,
+            run_id = NULL,
+            last_error = '',
+            claimed_at = NULL
+        WHERE status IN ('claimed', 'processing_completed')
+          AND (
+            (
+              connection_id IS NOT NULL
+              AND NOT EXISTS (
+                SELECT 1
+                FROM computer_connections cc
+                JOIN computers c ON c.active_connection_id = cc.id
+                WHERE cc.id = message_deliveries.connection_id
+                  AND cc.status = 'active'
+                  AND c.status = 'online'
+              )
+            )
+            OR (
+              connection_id IS NULL
+              AND daemon_id IN (SELECT id FROM computer_connections)
+              AND NOT EXISTS (
+                SELECT 1
+                FROM computer_connections cc
+                JOIN computers c ON c.active_connection_id = cc.id
+                WHERE cc.id = message_deliveries.daemon_id
+                  AND cc.status = 'active'
+                  AND c.status = 'online'
+              )
+            )
+          )
+      `).run();
     })();
     return staleRows.length;
   }
@@ -2420,6 +5168,114 @@ export class MessageStore {
     return row !== null;
   }
 
+  listDaemonAgents(daemonId: string): string[] {
+    const rows = this.db.query(`
+      SELECT agent FROM daemon_agents
+      WHERE daemon_id = ? AND status = 'online'
+      ORDER BY agent ASC
+    `).all(daemonId) as Array<{ agent: string }>;
+    return rows.map((row) => row.agent);
+  }
+
+  listPendingDeliveryAgentsForConnection(connectionId: string): Array<{ agent: string; pending: number }> {
+    this.releaseExpiredDeliveries();
+    const rows = this.db.query(`
+      SELECT md.agent AS agent, COUNT(*) AS pending
+      FROM message_deliveries md
+      JOIN daemon_agents da ON da.agent = md.agent
+      JOIN computer_connections cc ON cc.id = da.daemon_id
+      JOIN computers c ON c.active_connection_id = cc.id
+      WHERE da.daemon_id = ?
+        AND da.status = 'online'
+        AND cc.status = 'active'
+        AND c.status = 'online'
+        AND md.status = 'pending'
+      GROUP BY md.agent
+      ORDER BY MIN(datetime(md.created_at)) ASC, md.agent ASC
+    `).all(connectionId.trim()) as Array<{ agent: string; pending: number }>;
+    return rows.map((row) => ({ agent: row.agent, pending: Number(row.pending) }));
+  }
+
+  listDeliveryBacklogForConnection(connectionId: string): DeliveryBacklogSummary[] {
+    this.releaseExpiredDeliveries();
+    const rows = this.db.query(`
+      SELECT
+        md.agent AS agent,
+        SUM(CASE WHEN md.status = 'pending' THEN 1 ELSE 0 END) AS pending,
+        SUM(CASE WHEN md.status = 'claimed' THEN 1 ELSE 0 END) AS claimed,
+        SUM(CASE WHEN md.status = 'processing_completed' THEN 1 ELSE 0 END) AS processing_completed,
+        SUM(CASE
+          WHEN md.status IN ('claimed', 'processing_completed')
+            AND md.lease_until IS NOT NULL
+            AND datetime(md.lease_until) <= datetime('now')
+          THEN 1 ELSE 0
+        END) AS expired_active
+      FROM message_deliveries md
+      JOIN daemon_agents da ON da.agent = md.agent
+      JOIN computer_connections cc ON cc.id = da.daemon_id
+      JOIN computers c ON c.active_connection_id = cc.id
+      WHERE da.daemon_id = ?
+        AND da.status = 'online'
+        AND cc.status = 'active'
+        AND c.status = 'online'
+        AND md.status IN ('pending', 'claimed', 'processing_completed')
+      GROUP BY md.agent
+      ORDER BY MIN(datetime(md.created_at)) ASC, md.agent ASC
+    `).all(connectionId.trim()) as Array<{
+      agent: string;
+      pending: number;
+      claimed: number;
+      processing_completed: number;
+      expired_active: number;
+    }>;
+    return rows.map((row) => ({
+      agent: row.agent,
+      pending: Number(row.pending),
+      claimed: Number(row.claimed),
+      processing_completed: Number(row.processing_completed),
+      expired_active: Number(row.expired_active),
+    }));
+  }
+
+  releaseExpiredDeliveries(now = new Date()): number {
+    const result = this.db.query(`
+      UPDATE message_deliveries
+      SET status = 'pending',
+          daemon_id = NULL,
+          connection_id = NULL,
+          claim_token = NULL,
+          lease_until = NULL,
+          run_id = NULL,
+          last_error = '',
+          claimed_at = NULL
+      WHERE status IN ('claimed', 'processing_completed')
+        AND lease_until IS NOT NULL
+        AND datetime(lease_until) <= datetime(?)
+        AND NOT EXISTS (
+          SELECT 1
+          FROM agent_runs r
+          WHERE r.delivery_id = message_deliveries.id
+            AND r.status = 'running'
+        )
+    `).run(now.toISOString());
+    return result.changes;
+  }
+
+  listOnlineDaemonConnectionsForAgent(agent: string): string[] {
+    const rows = this.db.query(`
+      SELECT da.daemon_id AS connection_id
+      FROM daemon_agents da
+      JOIN computer_connections cc ON cc.id = da.daemon_id
+      JOIN computers c ON c.active_connection_id = cc.id
+      WHERE da.agent = ?
+        AND da.status = 'online'
+        AND cc.status = 'active'
+        AND c.status = 'online'
+      ORDER BY datetime(da.last_seen_at) DESC
+    `).all(agent.trim()) as Array<{ connection_id: string }>;
+    return rows.map((row) => row.connection_id);
+  }
+
   hasDaemonAgent(agent: string): boolean {
     const row = this.db.query(`
       SELECT 1 FROM daemon_agents
@@ -2429,13 +5285,90 @@ export class MessageStore {
     return row !== null;
   }
 
-  listDeliveries(agent: string, status = 'pending', limit = 50): MessageDelivery[] {
+  listDeliveries(agent: string, status = 'pending', limit = 50, options: { distinctChat?: boolean; excludeRunningComputerId?: string | null; connectionId?: string | null } = {}): MessageDelivery[] {
+    if (status === 'pending') this.releaseExpiredDeliveries();
+    const excludeRunningComputerId = options.excludeRunningComputerId?.trim() || null;
+    const rows = options.distinctChat
+      ? excludeRunningComputerId
+        ? this.db.query(`
+        SELECT md.*
+        FROM message_deliveries md
+        INNER JOIN (
+          SELECT pending.chat_id, MIN(pending.rowid) AS first_rowid
+          FROM message_deliveries pending
+          WHERE pending.agent = ? AND pending.status = ?
+            AND NOT EXISTS (
+              SELECT 1
+              FROM agent_runs ar
+              WHERE ar.computer_id = ?
+                AND ar.agent = pending.agent
+                AND ar.status = 'running'
+                AND EXISTS (
+                  SELECT 1
+                  FROM messages running_message
+                  WHERE running_message.id = ar.message_id
+                    AND running_message.chat_id = pending.chat_id
+                )
+            )
+          GROUP BY pending.chat_id
+        ) first ON md.rowid = first.first_rowid
+        WHERE md.agent = ? AND md.status = ?
+        ORDER BY datetime(md.created_at) ASC, md.rowid ASC
+        LIMIT ?
+      `).all(agent, status, excludeRunningComputerId, agent, status, limitValue(limit, 50)) as Record<string, unknown>[]
+        : this.db.query(`
+        SELECT md.*
+        FROM message_deliveries md
+        INNER JOIN (
+          SELECT chat_id, MIN(rowid) AS first_rowid
+          FROM message_deliveries
+          WHERE agent = ? AND status = ?
+          GROUP BY chat_id
+        ) first ON md.rowid = first.first_rowid
+        WHERE md.agent = ? AND md.status = ?
+        ORDER BY datetime(md.created_at) ASC, md.rowid ASC
+        LIMIT ?
+      `).all(agent, status, agent, status, limitValue(limit, 50)) as Record<string, unknown>[]
+      : this.db.query(`
+        SELECT * FROM message_deliveries
+        WHERE agent = ? AND status = ?
+        ORDER BY datetime(created_at) ASC, rowid ASC
+        LIMIT ?
+      `).all(agent, status, limitValue(limit, 50)) as Record<string, unknown>[];
+    return rows.map(rowToDelivery);
+  }
+
+  listRecentDeliveriesForAgent(agent: string, limit = 20): MessageDelivery[] {
+    this.releaseExpiredDeliveries();
     const rows = this.db.query(`
-      SELECT * FROM message_deliveries
-      WHERE agent = ? AND status = ?
-      ORDER BY datetime(created_at) ASC
+      SELECT *
+      FROM message_deliveries
+      WHERE agent = ?
+      ORDER BY datetime(created_at) DESC, rowid DESC
+      LIMIT ?
+    `).all(agent.trim(), limitValue(limit, 20)) as Record<string, unknown>[];
+    return rows.map(rowToDelivery);
+  }
+
+  listActiveDeliveriesForComputer(computerId: string, limit = 20): MessageDelivery[] {
+    this.releaseExpiredDeliveries();
+    const rows = this.db.query(`
+      SELECT md.*, c.name AS chat_name
+      FROM message_deliveries md
+      JOIN chats c ON c.id = md.chat_id
+      WHERE md.status IN ('pending', 'claimed', 'processing_completed')
+        AND (
+          md.connection_id IN (SELECT id FROM computer_connections WHERE computer_id = ?)
+          OR md.daemon_id IN (SELECT id FROM computer_connections WHERE computer_id = ?)
+          OR (md.status = 'pending' AND md.agent IN (
+            SELECT agent
+            FROM computer_agent_assignments
+            WHERE computer_id = ? AND status = 'active'
+          ))
+        )
+      ORDER BY datetime(md.created_at) DESC, md.rowid DESC
       LIMIT ?
-    `).all(agent, status, limitValue(limit, 50)) as Record<string, unknown>[];
+    `).all(computerId.trim(), computerId.trim(), computerId.trim(), limitValue(limit, 20)) as Record<string, unknown>[];
     return rows.map(rowToDelivery);
   }
 
@@ -2567,11 +5500,22 @@ export class MessageStore {
   }
 
   canSendWebMessageToRoom(input: { room: Chat; sender: string }): boolean {
+    if (input.room.status === 'archived') return false;
     if (input.room.provider === 'web') return true;
     if (!this.getAgent(input.sender)) return false;
     if (input.room.provider === 'lark') {
-      const route = this.findLarkChannelForChat(input.room.id);
-      return route?.account.agent === input.sender;
+      const row = this.db.query(`
+        SELECT 1
+        FROM channel_conversations cc
+        JOIN channel_accounts ca ON ca.id = cc.channel_account_id
+        WHERE cc.lock_chat_id = ?
+          AND cc.audit_only = 0
+          AND ca.channel = 'lark'
+          AND ca.status = 'active'
+          AND ca.agent = ?
+        LIMIT 1
+      `).get(input.room.id, input.sender) as Record<string, unknown> | null;
+      return row !== null;
     }
     return false;
   }
@@ -2655,6 +5599,17 @@ export class MessageStore {
     return rows.map(rowToSession);
   }
 
+  listSessionsForAgent(agent: string, limit = 10): AgentSession[] {
+    const rows = this.db.query(`
+      SELECT *
+      FROM agent_sessions
+      WHERE agent = ?
+      ORDER BY datetime(updated_at) DESC, datetime(created_at) DESC
+      LIMIT ?
+    `).all(agent.trim(), limitValue(limit, 10)) as Record<string, unknown>[];
+    return rows.map(rowToSession);
+  }
+
   listRunsForSession(sessionId: string, limit = 50): AgentRun[] {
     const rows = this.db.query(`
       SELECT * FROM agent_runs
@@ -2665,7 +5620,108 @@ export class MessageStore {
     return rows.map(rowToRun);
   }
 
+  recordAgentActivity(input: RecordAgentActivityInput): AgentActivityEvent {
+    const run = this.getRun(input.runId);
+    if (!run) throw new Error(`run ${input.runId} was not found`);
+    const message = this.getMessage(run.message_id);
+    if (!message) throw new Error(`message ${run.message_id} was not found`);
+    const id = crypto.randomUUID();
+    this.db.query(`
+      INSERT INTO agent_activity_events (id, run_id, session_id, agent, room_id, kind, title, detail, metadata)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      id,
+      run.id,
+      run.session_id,
+      run.agent,
+      message.chat_id,
+      input.kind,
+      input.title.trim().slice(0, 160) || input.kind,
+      (input.detail ?? '').trim().slice(0, 4000),
+      JSON.stringify(input.metadata ?? {}),
+    );
+    return this.getAgentActivityEvent(id)!;
+  }
+
+  getAgentActivityEvent(id: string): AgentActivityEvent | null {
+    const row = this.db.query('SELECT * FROM agent_activity_events WHERE id = ?').get(id) as Record<string, unknown> | null;
+    return row ? rowToActivityEvent(row) : null;
+  }
+
+  listActivityForRun(runId: string, limit = 100): AgentActivityEvent[] {
+    const rows = this.db.query(`
+      SELECT * FROM agent_activity_events
+      WHERE run_id = ?
+      ORDER BY datetime(created_at) ASC, rowid ASC
+      LIMIT ?
+    `).all(runId, limitValue(limit, 100)) as Record<string, unknown>[];
+    return rows.map(rowToActivityEvent);
+  }
+
+  listActivityForAgent(agent: string, limit = 100): AgentActivityEvent[] {
+    const rows = this.db.query(`
+      SELECT * FROM agent_activity_events
+      WHERE agent = ?
+      ORDER BY datetime(created_at) DESC, rowid DESC
+      LIMIT ?
+    `).all(agent.trim(), limitValue(limit, 100)) as Record<string, unknown>[];
+    return rows.map(rowToActivityEvent);
+  }
+
+  listActivityForRoomAgent(roomId: string, agent: string, limit = 100): AgentActivityEvent[] {
+    const room = this.getChatById(roomId);
+    if (!room) return [];
+    const rows = this.db.query(`
+      SELECT *
+      FROM agent_activity_events
+      WHERE room_id = ? AND agent = ?
+      ORDER BY datetime(created_at) DESC, rowid DESC
+      LIMIT ?
+    `).all(room.id, agent.trim(), limitValue(limit, 100)) as Record<string, unknown>[];
+    return rows.map(rowToActivityEvent);
+  }
+
+  listRoomAgentActivity(roomId: string): RoomAgentActivityStatus[] {
+    const room = this.getChatById(roomId);
+    if (!room) return [];
+    const rows = this.db.query(`
+      SELECT
+        ar.id AS run_id,
+        ar.agent,
+        COALESCE(ae.kind, 'running') AS kind,
+        COALESCE(ae.title, 'Working') AS title,
+        COALESCE(ae.created_at, ar.updated_at) AS updated_at
+      FROM agent_runs ar
+      INNER JOIN messages m ON m.id = ar.message_id
+      LEFT JOIN agent_activity_events ae ON ae.id = (
+        SELECT latest.id
+        FROM agent_activity_events latest
+        WHERE latest.run_id = ar.id AND latest.room_id = m.chat_id
+        ORDER BY datetime(latest.created_at) DESC, latest.rowid DESC
+        LIMIT 1
+      )
+      WHERE m.chat_id = ? AND ar.status = 'running'
+        AND (
+          ae.id IS NULL
+          OR NOT (
+            ae.kind = 'lifecycle'
+            AND lower(trim(ae.title)) IN ('step completed', 'runtime completed', 'run completed')
+          )
+        )
+      ORDER BY datetime(updated_at) DESC, ar.agent ASC
+    `).all(room.id) as Record<string, unknown>[];
+    return rows.map((row) => ({
+      agent: String(row.agent),
+      run_id: String(row.run_id),
+      status: 'working',
+      kind: String(row.kind) as RoomAgentActivityStatus['kind'],
+      title: String(row.title),
+      updated_at: String(row.updated_at),
+    }));
+  }
+
   claimDelivery(id: string, input: ClaimDeliveryInput): MessageDelivery {
+    this.releaseExpiredDeliveries();
     const claimToken = crypto.randomUUID();
     const leaseMs = input.leaseMs ?? 30_000;
     const leaseUntil = new Date(Date.now() + leaseMs).toISOString();
@@ -2673,13 +5729,19 @@ export class MessageStore {
     if (!delivery) throw new Error(`pending delivery ${id} was not found`);
     if (input.computerId) {
       const busy = this.db.query(`
-        SELECT 1
+        SELECT r.id, r.connection_id
         FROM agent_runs r
         JOIN agent_sessions s ON s.id = r.session_id
         WHERE r.computer_id = ? AND r.agent = ? AND s.chat_id = ? AND r.status = 'running'
         LIMIT 1
       `).get(input.computerId, delivery.agent, delivery.chat_id) as Record<string, unknown> | null;
-      if (busy) throw new Error(`runtime invocation already running for computer ${input.computerId} agent ${delivery.agent} chat ${delivery.chat_id}`);
+      if (busy) {
+        const matchesSteerRun = input.steerRunId && String(busy.id) === input.steerRunId;
+        const matchesConnection = !input.connectionId || !busy.connection_id || String(busy.connection_id) === input.connectionId;
+        if (!matchesSteerRun || !matchesConnection) {
+          throw new Error(`runtime invocation already running for computer ${input.computerId} agent ${delivery.agent} chat ${delivery.chat_id}`);
+        }
+      }
     }
     const connectionId = input.connectionId ?? null;
     const result = this.db.query(`
@@ -2803,6 +5865,25 @@ export class MessageStore {
     return this.getRun(runId)!;
   }
 
+  requestRoomAgentRunAction(input: { roomId: string; agent: string; action: RunAction }): AgentRun {
+    const room = this.getChatById(input.roomId);
+    if (!room) throw new Error(`room ${input.roomId} was not found`);
+    const agent = input.agent.trim();
+    if (!agent) throw new Error('agent is required');
+    const row = this.db.query(`
+      SELECT ar.*
+      FROM agent_runs ar
+      JOIN messages m ON m.id = ar.message_id
+      WHERE ar.status = 'running'
+        AND ar.agent = ?
+        AND m.chat_id = ?
+      ORDER BY datetime(ar.updated_at) DESC, datetime(ar.started_at) DESC, ar.rowid DESC
+      LIMIT 1
+    `).get(agent, room.id) as Record<string, unknown> | null;
+    if (!row) throw new Error(`running run for agent ${agent} in room ${room.id} was not found`);
+    return this.requestRunAction(String(row.id), input.action);
+  }
+
   clearRunAction(runId: string): void {
     this.db.query(`
       UPDATE agent_runs
@@ -2825,6 +5906,28 @@ export class MessageStore {
     return rows.map(rowToRun);
   }
 
+  listRunsForAgent(agent: string, limit = 10): AgentRun[] {
+    const rows = this.db.query(`
+      SELECT *
+      FROM agent_runs
+      WHERE agent = ?
+      ORDER BY datetime(updated_at) DESC, datetime(started_at) DESC
+      LIMIT ?
+    `).all(agent.trim(), limitValue(limit, 10)) as Record<string, unknown>[];
+    return rows.map(rowToRun);
+  }
+
+  listRunsForComputer(computerId: string, limit = 20): AgentRun[] {
+    const rows = this.db.query(`
+      SELECT *
+      FROM agent_runs
+      WHERE computer_id = ?
+      ORDER BY datetime(updated_at) DESC, datetime(started_at) DESC
+      LIMIT ?
+    `).all(computerId.trim(), limitValue(limit, 20)) as Record<string, unknown>[];
+    return rows.map(rowToRun);
+  }
+
   createArtifact(input: CreateArtifactInput): { artifact: ArtifactMetadata; token: string } {
     validateArtifactContent(input.mimeType, input.content);
     const id = crypto.randomUUID();