@controlflow-ai/daemon 0.1.2 → 0.1.4

package/src/codex.ts

@@ -1,4 +1,5 @@
-import { buildPalPrompt, runtimeCwd, type AgentRuntime, type AgentRuntimeRunInput } from './agent-runtime.js';
+import { buildPalPrompt, runtimeLaunchRoot, runtimeCwd, type AgentRuntime, type AgentRuntimeRunInput } from './agent-runtime.js';
+import { buildCodexPermissionArgs, buildRuntimeLaunchContext, effectivePermissionProfile, normalizeWritableRoot, writableRootsForProfile, type AgentPermissionProfile, type RuntimeLaunchContext } from './agent-permissions.js';
 export { runAgentRuntime } from './agent-runtime.js';
 
 function extractThreadId(stdout: string): string | null {
@@ -17,19 +18,46 @@ function extractThreadId(stdout: string): string | null {
   return null;
 }
 
-export function makeCodexRuntime(_agentUuid: string): AgentRuntime {
+function tomlString(value: string): string {
+  return JSON.stringify(value);
+}
+
+function codexResumeConfigArgs(profile: AgentPermissionProfile, context: RuntimeLaunchContext): string[] {
+  if (profile.filesystemMode === 'full-access') {
+    return ['-c', 'sandbox_mode="danger-full-access"'];
+  }
+
+  const writableRoots = writableRootsForProfile(profile, context)
+    .filter((root) => normalizeWritableRoot(root) !== normalizeWritableRoot(context.runtimeRoot));
+  const args = [
+    '-c',
+    'sandbox_mode="workspace-write"',
+    '-c',
+    'sandbox_workspace_write.network_access=true',
+  ];
+  if (writableRoots.length > 0) {
+    args.push('-c', `sandbox_workspace_write.writable_roots=[${writableRoots.map(tomlString).join(',')}]`);
+  }
+  return args;
+}
+
+export function makeCodexRuntime(_agentUuid: string, model?: string | null): AgentRuntime {
+  const modelArgs = model?.trim() ? ['--model', model.trim()] : [];
   return {
     name: 'codex',
-    capabilities: { protocol: 'json-stream', resume: 'runtime-session-id', busyDeliveryMode: 'queue', supportsMcp: false },
+    capabilities: { protocol: 'json-stream', resume: 'runtime-session-id', busyDeliveryMode: 'queue', supportsMcp: false, supportsSteer: false },
     command: 'codex',
     buildPrompt: buildPalPrompt,
     buildCwd: runtimeCwd,
     buildArgs(input: AgentRuntimeRunInput): string[] {
       const prompt = buildPalPrompt(input);
+      const context = input.launchContext ?? buildRuntimeLaunchContext(input);
+      const permissionProfile = effectivePermissionProfile(input);
+      const permissionArgs = buildCodexPermissionArgs(permissionProfile, context);
       if (input.runtimeSessionId) {
-        return ['exec', 'resume', '--json', '--dangerously-bypass-approvals-and-sandbox', ...input.extraArgs, input.runtimeSessionId, prompt];
+        return ['exec', 'resume', '--json', '--skip-git-repo-check', ...codexResumeConfigArgs(permissionProfile, context), ...modelArgs, ...input.extraArgs, input.runtimeSessionId, prompt];
       }
-      return ['exec', '--json', '--dangerously-bypass-approvals-and-sandbox', '--cd', runtimeCwd(input), ...input.extraArgs, prompt];
+      return ['exec', '--json', ...permissionArgs, '--skip-git-repo-check', '--cd', runtimeLaunchRoot(input), ...modelArgs, ...input.extraArgs, prompt];
     },
     parseOutput({ stdout, stderr, input }) {
       return {

package/src/config.ts

@@ -96,11 +96,35 @@ export function privatePalCliBinDir(): string {
   return join(homeDir(), 'bin');
 }
 
-export function ensurePrivatePalCliBin(): string {
+export interface EnsurePrivatePalCliBinOptions {
+  platform?: NodeJS.Platform;
+}
+
+function cmdQuoted(path: string): string {
+  return `"${path.replace(/"/g, '""')}"`;
+}
+
+function psQuoted(path: string): string {
+  return `'${path.replace(/'/g, "''")}'`;
+}
+
+export function privatePalCliExecutableName(platform: NodeJS.Platform = process.platform): string {
+  return platform === 'win32' ? 'pal.cmd' : 'pal';
+}
+
+export function ensurePrivatePalCliBin(options: EnsurePrivatePalCliBinOptions = {}): string {
+  const platform = options.platform ?? process.platform;
   const binDir = privatePalCliBinDir();
   ensureDir(binDir);
-  const linkPath = join(binDir, 'pal');
-  rmSync(linkPath, { force: true });
-  symlinkSync(repoCliPath(), linkPath);
+  const cliPath = repoCliPath();
+  for (const name of ['pal', 'pal.cmd', 'pal.ps1']) {
+    rmSync(join(binDir, name), { force: true });
+  }
+  if (platform === 'win32') {
+    writeFileSync(join(binDir, 'pal.cmd'), `@echo off\r\nbun ${cmdQuoted(cliPath)} %*\r\n`);
+    writeFileSync(join(binDir, 'pal.ps1'), `& bun ${psQuoted(cliPath)} @args\r\n`);
+  } else {
+    symlinkSync(cliPath, join(binDir, 'pal'));
+  }
   return binDir;
 }

package/src/console.ts

@@ -6,8 +6,10 @@ import { defaultServerUrl } from './config.js';
 import { formatMessages } from './format.js';
 import { defaultLarkConfigPath, findCredentialByAgent, loadLarkCredentials, saveLarkCredentials, unbindCredentialAgent, upsertCredential } from './lark/credentials.js';
 import { registerLarkAppFromDeviceFlow, resolveLarkBotInfo, type LarkBotInfoResult } from './lark/setup.js';
+import { runtimeModelOptions, validateRuntimeModel } from './runtime-registry.js';
 import type { LarkRegistrationComplete } from './lark/app-registration.js';
 import type { Computer, ProvisionedComputer } from './types.js';
+import { runMessagingCommand } from './messaging-cli.js';
 
 interface Prompt {
   askLine(label: string): Promise<string>;
@@ -26,14 +28,27 @@ Usage:
   bun run src/console.ts run-action <run-id> kill|restart
   bun run src/console.ts computers list [--json]
   bun run src/console.ts computer onboard [--interactive] [--name <display-name>] [--server-url <url>] [--package-name <npm-package>]
+  bun run src/console.ts computers reconnect-command [--interactive] [--computer-id <machine>] [--server-url <url>] [--package-name <npm-package>] [--json]
+  bun run src/console.ts computers delete [--interactive] [--computer-id <machine>] [--json]
   bun run src/console.ts agents list [--json]
-  bun run src/console.ts agents onboard [--interactive] [--key <agent-key>] [--name <display-name>] [--runtime codex] [--computer-id <machine>]
-  bun run src/console.ts agents create --key <agent-key> --name <display-name> [--runtime neeko|coco|coco-stream-json|codex] [--desc <description>]
-  bun run src/console.ts agents update [--interactive] --key <agent-key> [--runtime neeko|coco|coco-stream-json|codex]
+  bun run src/console.ts agents onboard [--interactive] [--key <agent-key>] [--name <display-name>] [--runtime codex] [--model <model>] [--computer-id <machine>]
+  bun run src/console.ts agents create --key <agent-key> --name <display-name> [--runtime neeko|coco|codex] [--model <model>] [--desc <description>]
+  bun run src/console.ts agents update [--interactive] --key <agent-key> [--runtime neeko|coco|codex] [--model <model>]
       [--lark-app-id <id> --lark-app-secret <secret>] [--lark-label <name>] [--lark-config <path>] [--rebind-lark] [--unbind-lark] [--no-reload]
+  bun run src/console.ts agents delete --key <agent-key> [--yes] [--lark-config <path>] [--no-reload] [--json]
   bun run src/console.ts lark-users list [--json]
   bun run src/console.ts lark-users add [--interactive] --user-id <union-id> [--name <display-name>]
   bun run src/console.ts lark-users delete --user-id <union-id>
+  bun run src/console.ts messaging health [--json]
+  bun run src/console.ts messaging status [--verbose] [--json]
+  bun run src/console.ts messaging restart-lark [--app-id <id>] [--json]
+  bun run src/console.ts messaging repair-lark [--dry-run] [--json]
+  bun run src/console.ts messaging doctor-lark [--app-id <id>] [--config <path>] [--budget-ms 10000] [--json]
+  bun run src/console.ts messaging watch-lark [--app-id <id>] [--timeout-ms 60000] [--interval-ms 1000] [--json]
+  bun run src/console.ts messaging verify-lark-ingress [--app-id <id>] [--timeout-ms 60000] [--interval-ms 1000] [--json]
+  bun run src/console.ts messaging recent-lark [--limit 20] [--json]
+  bun run src/console.ts messaging probe-lark --app-id <id> --sender-user-id <union-id> --chat-id <chat-id> [--mention-open-id <open-id>] [--text <message>] [--json]
+  bun run src/console.ts messaging probe-delivery [--agent lock] [--room <room>] [--timeout-ms 120000] [--json]
   bun run src/console.ts lark <list|daemon|events|send> [flags]
 
 Environment:
@@ -62,11 +77,11 @@ async function reloadLarkIntegration(serverUrl: string): Promise<void> {
   console.log('Lark integration reloaded.');
 }
 
-async function resolveBotInfoForConsole(appId: string, appSecret: string): Promise<LarkBotInfoResult> {
+async function resolveBotInfoForConsole(appId: string, appSecret: string, options: { budgetMs?: number } = {}): Promise<LarkBotInfoResult> {
   if (process.env.NODE_ENV === 'test' && process.env.PAL_TEST_LARK_BOT_OPEN_ID) {
     return { ok: true, openId: process.env.PAL_TEST_LARK_BOT_OPEN_ID };
   }
-  return resolveLarkBotInfo(appId, appSecret);
+  return resolveLarkBotInfo(appId, appSecret, options);
 }
 
 async function registerLarkAppForConsole(): Promise<LarkRegistrationComplete | null> {
@@ -167,7 +182,7 @@ async function askRequired(prompt: Prompt, label: string, defaultValue = ''): Pr
 }
 
 async function askRuntime(prompt: Prompt, defaultValue: string): Promise<string> {
-  const runtimes = ['codex', 'neeko', 'coco', 'coco-stream-json'];
+  const runtimes = ['codex', 'neeko', 'coco'];
   const fallback = runtimes.includes(defaultValue) ? defaultValue : 'codex';
   console.log('Runtime:');
   runtimes.forEach((runtime, index) => {
@@ -183,6 +198,29 @@ async function askRuntime(prompt: Prompt, defaultValue: string): Promise<string>
   }
 }
 
+async function askModel(prompt: Prompt, runtime: string, defaultValue = ''): Promise<string> {
+  const models = await runtimeModelOptions(runtime);
+  if (models.length === 0) {
+    console.log(`Model: ${runtime} has no built-in model list; using runtime default.`);
+    return '';
+  }
+  const fallback = models.includes(defaultValue) ? defaultValue : models[0]!;
+  console.log('Model:');
+  console.log('  0. Runtime default');
+  models.forEach((model, index) => {
+    const marker = model === fallback ? ' (default)' : '';
+    console.log(`  ${index + 1}. ${model}${marker}`);
+  });
+
+  while (true) {
+    const answer = await ask(prompt, `Choose ${runtime} model`, fallback);
+    if (answer === '0') return '';
+    const selected = models[Number(answer) - 1] ?? answer;
+    if (models.includes(selected)) return selected;
+    console.log(`Model must be one of: ${models.join(', ')}`);
+  }
+}
+
 async function askYesNo(prompt: Prompt, label: string, defaultValue = false): Promise<boolean> {
   const fallback = defaultValue ? 'Y/n' : 'y/N';
   while (true) {
@@ -241,7 +279,7 @@ async function collectComputerOnboardInput(serverClient: LockClient, flags: Reco
   const interactive = boolFlag(flags, 'interactive') || (!hasAnyProvisionFlag && process.stdin.isTTY === true);
   const defaultName = flag(flags, 'name') ?? 'Local computer';
   const defaultServerUrl = flag(flags, 'server-url') ?? serverClient.baseUrl;
-  const defaultPackageName = flag(flags, 'package-name') ?? '@controlflow-ai/daemon@latest';
+  const defaultPackageName = flag(flags, 'package-name') ?? 'bun run daemon';
 
   if (!interactive) {
     return {
@@ -257,12 +295,12 @@ async function collectComputerOnboardInput(serverClient: LockClient, flags: Reco
     console.log('Provision a computer credential and daemon start command.');
     const name = await askRequired(prompt, 'Computer display name', defaultName);
     const serverUrl = await askRequired(prompt, 'Server URL', defaultServerUrl);
-    const packageName = await askRequired(prompt, 'Daemon package', defaultPackageName);
+    const packageName = await askRequired(prompt, 'Daemon command/package', defaultPackageName);
     console.log('');
     console.log('Summary:');
     console.log(`  name: ${name}`);
     console.log(`  server_url: ${serverUrl}`);
-    console.log(`  package_name: ${packageName}`);
+    console.log(`  command_prefix: ${packageName}`);
     if (!await askYesNo(prompt, 'Provision this computer?', true)) throw new Error('computer onboarding cancelled');
     return { name, serverUrl, packageName };
   } finally {
@@ -329,7 +367,7 @@ async function collectLarkBindFlags(prompt: Prompt, flags: Record<string, string
   };
 }
 
-async function collectOnboardInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<{ agentKey: string; displayName: string; runtime: string; desc: string | null; computerId: string | undefined; larkFlags?: Record<string, string | boolean> }> {
+async function collectOnboardInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<{ agentKey: string; displayName: string; runtime: string; model: string | null; desc: string | null; computerId: string | undefined; larkFlags?: Record<string, string | boolean> }> {
   const hasRequiredFlags = Boolean(flag(flags, 'key') && flag(flags, 'name'));
   const interactive = boolFlag(flags, 'interactive') || (!hasRequiredFlags && process.stdin.isTTY === true);
   if (!interactive) {
@@ -338,6 +376,7 @@ async function collectOnboardInput(serverClient: LockClient, flags: Record<strin
       agentKey: flag(flags, 'key')!,
       displayName: flag(flags, 'name')!,
       runtime: flag(flags, 'runtime') ?? 'codex',
+      model: await validateRuntimeModel(flag(flags, 'runtime') ?? 'codex', flag(flags, 'model')),
       desc: flag(flags, 'desc') ?? null,
       computerId: flag(flags, 'computer-id'),
       larkFlags: flag(flags, 'lark-app-id') || flag(flags, 'app-id') ? flags : undefined,
@@ -351,6 +390,7 @@ async function collectOnboardInput(serverClient: LockClient, flags: Record<strin
     const agentKey = await askRequired(prompt, 'Agent key', flag(flags, 'key') ?? 'codex');
     const displayName = await askRequired(prompt, 'Display name', flag(flags, 'name') ?? agentKey);
     const runtime = await askRuntime(prompt, flag(flags, 'runtime') ?? 'codex');
+    const model = await askModel(prompt, runtime, flag(flags, 'model') ?? '');
     const desc = await ask(prompt, 'Description (optional)', flag(flags, 'desc') ?? '');
     const shouldAssign = Boolean(flag(flags, 'computer-id')) || await askYesNo(prompt, 'Assign this agent to a computer?', false);
     const computerId = shouldAssign
@@ -361,6 +401,7 @@ async function collectOnboardInput(serverClient: LockClient, flags: Record<strin
     console.log(`  agent_key: ${agentKey}`);
     console.log(`  display_name: ${displayName}`);
     console.log(`  runtime: ${runtime}`);
+    console.log(`  model: ${model || '-'}`);
     console.log(`  description: ${desc || '-'}`);
     console.log(`  computer_id: ${computerId || '-'}`);
     if (!await askYesNo(prompt, 'Create/update this agent?', true)) throw new Error('onboarding cancelled');
@@ -370,6 +411,7 @@ async function collectOnboardInput(serverClient: LockClient, flags: Record<strin
       agentKey,
       displayName,
       runtime,
+      model: model || null,
       desc: desc || null,
       computerId: computerId || undefined,
       larkFlags,
@@ -380,13 +422,47 @@ async function collectOnboardInput(serverClient: LockClient, flags: Record<strin
 }
 
 async function collectAgentUpdateInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<{ agentKey: string; flags: Record<string, string | boolean> }> {
-  if (flag(flags, 'runtime')) throw new Error('agents update --interactive currently supports only Lark bot binding or unbinding');
-
   const prompt = await createPrompt();
   try {
-    console.log('Agent Lark settings');
+    console.log('Agent settings');
     const agents = await listAgentRecords(serverClient);
     const agentKey = await askAgentKey(prompt, agents, flag(flags, 'key') ?? (agents.length === 1 ? '1' : ''));
+    const agent = agents.find((candidate) => candidate.agent_key === agentKey);
+    if (!agent) throw new Error(`agent ${agentKey} not found`);
+
+    if (flag(flags, 'model')) return { agentKey, flags };
+
+    const requestedLarkUpdate = Boolean(
+      boolFlag(flags, 'unbind-lark') ||
+      flag(flags, 'lark-app-id') ||
+      flag(flags, 'app-id') ||
+      flag(flags, 'lark-app-secret') ||
+      flag(flags, 'app-secret'),
+    );
+    let updateAction = requestedLarkUpdate ? (boolFlag(flags, 'unbind-lark') ? '3' : '2') : '';
+    if (!updateAction) {
+      console.log('Update:');
+      console.log('  1. Model');
+      console.log('  2. Bind/rebind Lark bot');
+      console.log('  3. Unbind Lark bot');
+      updateAction = await ask(prompt, 'Choose update', '1');
+    }
+
+    if (updateAction === '1' || updateAction.toLowerCase() === 'model') {
+      const runtime = typeof agent.runtime === 'string' ? agent.runtime : '';
+      if (!runtime) throw new Error(`agent ${agentKey} has no runtime configured`);
+      const model = await askModel(prompt, runtime, typeof agent.model === 'string' ? agent.model : '');
+      console.log('');
+      console.log('Summary:');
+      console.log(`  agent_key: ${agentKey}`);
+      console.log(`  runtime: ${runtime}`);
+      console.log(`  model: ${model || '-'}`);
+      if (!await askYesNo(prompt, 'Update this agent model?', true)) throw new Error('agent update cancelled');
+      return { agentKey, flags: { ...flags, model } };
+    }
+
+    if (updateAction !== '2' && updateAction !== '3') throw new Error('Choose 1, 2, or 3.');
+
     const configPath = larkConfigPath(flags);
     const store = loadLarkCredentials(configPath);
     const existing = findCredentialByAgent(store, agentKey);
@@ -396,7 +472,20 @@ async function collectAgentUpdateInput(serverClient: LockClient, flags: Record<s
       console.log('Current Lark bot: -');
     }
 
-    const defaultAction = existing ? '1' : '1';
+    if (updateAction === '3') {
+      if (!existing) throw new Error(`agent ${agentKey} has no Lark bot binding`);
+      if (!await askYesNo(prompt, `Unbind ${existing.appId} from ${agentKey}?`, false)) throw new Error('Lark bot unbind cancelled');
+      return {
+        agentKey,
+        flags: {
+          ...flags,
+          'lark-config': configPath,
+          'unbind-lark': true,
+        },
+      };
+    }
+
+    const defaultAction = '1';
     console.log('Lark action:');
     console.log(`  1. ${existing ? 'Bind/rebind bot' : 'Bind bot'}`);
     if (existing) console.log('  2. Unbind bot');
@@ -432,6 +521,32 @@ async function collectAgentUpdateInput(serverClient: LockClient, flags: Record<s
   }
 }
 
+async function collectAgentDeleteInput(serverClient: LockClient, flags: Record<string, string | boolean>): Promise<string> {
+  const agents = await listAgentRecords(serverClient);
+  const explicitKey = flag(flags, 'key') ?? flag(flags, 'agent');
+  const interactive = boolFlag(flags, 'interactive') || (!explicitKey && process.stdin.isTTY === true);
+  if (!interactive) {
+    if (!explicitKey) throw new Error('agents delete requires --key when not running interactively');
+    if (!boolFlag(flags, 'yes') && !boolFlag(flags, 'force')) throw new Error('agents delete requires --yes to confirm non-interactively');
+    return explicitKey;
+  }
+
+  const prompt = await createPrompt();
+  try {
+    console.log('Delete agent');
+    const agentKey = await askAgentKey(prompt, agents, explicitKey ?? (agents.length === 1 ? '1' : ''));
+    const agent = agents.find((candidate) => candidate.agent_key === agentKey);
+    console.log('');
+    console.log('This will remove the agent record, computer assignment, room memberships, room delivery subscriptions, provider bindings, and active deliveries.');
+    console.log(`  agent_key: ${agentKey}`);
+    console.log(`  display_name: ${agent?.display_name ?? '-'}`);
+    if (!await askYesNo(prompt, `Delete ${agentKey}?`, false)) throw new Error('agent delete cancelled');
+    return agentKey;
+  } finally {
+    prompt.close();
+  }
+}
+
 async function collectLarkUserInput(flags: Record<string, string | boolean>): Promise<{ userId: string; displayName: string | null }> {
   const userIdFlag = flag(flags, 'user-id') ?? flag(flags, 'id');
   const interactive = boolFlag(flags, 'interactive') || (!userIdFlag && process.stdin.isTTY === true);
@@ -569,6 +684,52 @@ async function main(): Promise<void> {
       return;
     }
 
+    if (sub === 'reconnect-command') {
+      let computerId = flag(args.flags, 'computer-id');
+      const interactive = boolFlag(args.flags, 'interactive') || (!computerId && process.stdin.isTTY === true);
+      if (interactive) {
+        const prompt = await createPrompt();
+        try {
+          computerId = await askComputerId(prompt, await serverClient.listComputers());
+        } finally {
+          prompt.close();
+        }
+      }
+      if (!computerId) throw new Error('--computer-id is required');
+      const provisioned = await serverClient.regenerateComputerCommand(computerId, {
+        server_url: flag(args.flags, 'server-url') ?? serverClient.baseUrl,
+        package_name: flag(args.flags, 'package-name') ?? 'bun run daemon',
+      });
+      if (args.flags.json) {
+        printJson(provisioned);
+      } else {
+        console.log('Computer reconnect command generated');
+        printProvisionedComputer(provisioned);
+      }
+      return;
+    }
+
+    if (sub === 'delete') {
+      let computerId = flag(args.flags, 'computer-id');
+      const interactive = boolFlag(args.flags, 'interactive') || (!computerId && process.stdin.isTTY === true);
+      if (interactive) {
+        const prompt = await createPrompt();
+        try {
+          computerId = await askComputerId(prompt, await serverClient.listComputers());
+        } finally {
+          prompt.close();
+        }
+      }
+      if (!computerId) throw new Error('--computer-id is required');
+      const result = await serverClient.deleteComputer(computerId);
+      if (args.flags.json) {
+        printJson(result);
+      } else {
+        console.log(`Computer deleted: ${result.computer.id}`);
+      }
+      return;
+    }
+
     throw new Error(`unknown ${args.command} subcommand: ${sub ?? '(none)'}\n\n${usage()}`);
   }
 
@@ -581,7 +742,7 @@ async function main(): Promise<void> {
         printJson(agents);
       } else {
         for (const agent of agents) {
-          console.log(`${agent.agent_key} name="${agent.display_name}" runtime=${agent.runtime ?? '-'} desc=${agent.description ?? '-'}`);
+          console.log(`${agent.agent_key} name="${agent.display_name}" runtime=${agent.runtime ?? '-'} model=${agent.model ?? '-'} desc=${agent.description ?? '-'}`);
         }
       }
       return;
@@ -591,6 +752,7 @@ async function main(): Promise<void> {
       const agentKey = flag(args.flags, 'key');
       const displayName = flag(args.flags, 'name');
       const runtime = flag(args.flags, 'runtime');
+      const model = flag(args.flags, 'model');
       const desc = flag(args.flags, 'desc');
       if (!agentKey) throw new Error('--key is required');
       if (!displayName) throw new Error('--name is required');
@@ -602,6 +764,7 @@ async function main(): Promise<void> {
           agent_key: agentKey,
           display_name: displayName,
           runtime: runtime ?? null,
+          model: await validateRuntimeModel(runtime ?? '', model),
           description: desc ?? null,
         }),
       });
@@ -612,7 +775,7 @@ async function main(): Promise<void> {
     }
 
     if (sub === 'onboard') {
-      const { agentKey, displayName, runtime, desc, computerId, larkFlags } = await collectOnboardInput(serverClient, args.flags);
+      const { agentKey, displayName, runtime, model, desc, computerId, larkFlags } = await collectOnboardInput(serverClient, args.flags);
       if (!agentKey) throw new Error('agent key is required');
       if (!displayName) throw new Error('display name is required');
 
@@ -623,6 +786,7 @@ async function main(): Promise<void> {
           agent_key: agentKey,
           display_name: displayName,
           runtime,
+          model,
           description: desc,
           computer_id: computerId,
         }),
@@ -640,18 +804,29 @@ async function main(): Promise<void> {
         : { agentKey: flag(args.flags, 'key') ?? '', flags: args.flags };
       const agentKey = updateInput.agentKey;
       const updateFlags = updateInput.flags;
-      const runtime = flag(args.flags, 'runtime');
+      const runtime = flag(updateFlags, 'runtime');
+      const hasModel = Object.prototype.hasOwnProperty.call(updateFlags, 'model');
+      const model = flag(updateFlags, 'model');
       if (!agentKey) throw new Error('--key is required');
       const hasLarkBinding = Boolean(flag(updateFlags, 'lark-app-id') || flag(updateFlags, 'app-id') || flag(updateFlags, 'lark-app-secret') || flag(updateFlags, 'app-secret'));
       const hasLarkUnbind = boolFlag(updateFlags, 'unbind-lark');
-      if (!runtime && !hasLarkBinding && !hasLarkUnbind) throw new Error('--runtime, --lark-app-id/--lark-app-secret, or --unbind-lark is required');
+      if (!runtime && !hasModel && !hasLarkBinding && !hasLarkUnbind) throw new Error('--runtime, --model, --lark-app-id/--lark-app-secret, or --unbind-lark is required');
 
       let agent: Record<string, unknown> | undefined;
-      if (runtime) {
+      if (runtime || hasModel) {
+        if (hasModel && typeof model !== 'string') throw new Error('--model requires a value');
+        const existingAgent = hasModel && !runtime
+          ? (await listAgentRecords(serverClient)).find((candidate) => candidate.agent_key === agentKey)
+          : undefined;
+        if (hasModel && !runtime && !existingAgent) throw new Error(`agent ${agentKey} not found`);
+        const runtimeForModel = runtime ?? (typeof existingAgent?.runtime === 'string' ? existingAgent.runtime : '');
         const response = await fetch(`${serverClient.baseUrl}/api/agents/${encodeURIComponent(agentKey)}`, {
           method: 'PATCH',
           headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ runtime }),
+          body: JSON.stringify({
+            ...(runtime ? { runtime } : {}),
+            ...(hasModel ? { model: await validateRuntimeModel(runtimeForModel, model) } : {}),
+          }),
         });
         const payload = await response.json() as { data?: { agent: Record<string, unknown> }; message?: string };
         if (!response.ok) throw new Error(payload.message ?? `update failed: ${response.status}`);
@@ -667,6 +842,36 @@ async function main(): Promise<void> {
       return;
     }
 
+    if (sub === 'delete' || sub === 'remove') {
+      const agentKey = await collectAgentDeleteInput(serverClient, args.flags);
+      const params = new URLSearchParams();
+      const configPath = larkConfigPath(args.flags);
+      if (configPath) params.set('lark_config', configPath);
+      const suffix = params.toString() ? `?${params}` : '';
+      const data = await requestJson<{ deletion: Record<string, unknown>; lark: { unbound: boolean; app_id: string | null; error?: string | null } }>(
+        `${serverClient.baseUrl}/api/agents/${encodeURIComponent(agentKey)}${suffix}`,
+        {
+          method: 'DELETE',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ confirm_delete: true, leave_rooms: true, unbind_lark: true }),
+        },
+      );
+      if (data.lark.unbound && !boolFlag(args.flags, 'no-reload')) await reloadLarkIntegration(serverClient.baseUrl);
+      if (args.flags.json) {
+        printJson(data);
+      } else {
+        const deletion = data.deletion;
+        console.log(`Deleted agent ${agentKey}.`);
+        console.log(`  rooms_left: ${deletion.rooms_left}`);
+        console.log(`  subscriptions_removed: ${deletion.subscriptions_removed}`);
+        console.log(`  active_deliveries_canceled: ${deletion.active_deliveries_canceled}`);
+        console.log(`  running_runs_marked_kill: ${deletion.running_runs_marked_kill}`);
+        if (data.lark.unbound) console.log(`  lark_unbound: ${data.lark.app_id}`);
+        if (data.lark.error) console.log(`  lark_unbind_error: ${data.lark.error}`);
+      }
+      return;
+    }
+
     throw new Error(`unknown agents subcommand: ${sub ?? '(none)'}\n\n${usage()}`);
   }
 
@@ -710,6 +915,11 @@ async function main(): Promise<void> {
     throw new Error(`unknown lark-users subcommand: ${sub ?? '(none)'}\n\n${usage()}`);
   }
 
+  if (args.command === 'messaging') {
+    await runMessagingCommand(serverClient, args, usage);
+    return;
+  }
+
   if (args.command === 'lark') {
     const { runLarkCli } = await import('./lark/cli.js');
     const code = await runLarkCli({