@fangyb/ahchat-bridge 0.1.25 → 0.1.27

package/dist/index.js

@@ -1313,14 +1313,14 @@ var require_receiver = __commonJS({
        * @return {(Error|RangeError)} The error
        * @private
        */
-      createError(ErrorCtor, message, prefix, statusCode, errorCode) {
+      createError(ErrorCtor, message, prefix, statusCode, errorCode2) {
         this._loop = false;
         this._errored = true;
         const err = new ErrorCtor(
           prefix ? `Invalid WebSocket frame: ${message}` : message
         );
         Error.captureStackTrace(err, this.createError);
-        err.code = errorCode;
+        err.code = errorCode2;
         err[kStatusCode] = statusCode;
         return err;
       }
@@ -3651,8 +3651,8 @@ function readEnvInt(name, fallback) {
   const n = Number.parseInt(v, 10);
   return Number.isFinite(n) && n > 0 ? n : fallback;
 }
-function generateStableBridgeId() {
-  const raw = `${os.hostname()}:${os.userInfo().username}`;
+function generateStableBridgeId(dataDir) {
+  const raw = `${os.hostname()}:${os.userInfo().username}:${path.resolve(dataDir)}`;
   const hash2 = crypto.createHash("sha256").update(raw).digest("hex").slice(0, 12);
   return `bridge_${hash2}`;
 }
@@ -3730,7 +3730,7 @@ function loadBridgeConfig(opts) {
     ),
     bridgeId: readEnvString(
       "AHCHAT_BRIDGE_ID",
-      fileConfig.bridgeId ?? generateStableBridgeId()
+      fileConfig.bridgeId ?? generateStableBridgeId(dataDir)
     ),
     bridgeToken: readEnvString(
       "AHCHAT_BRIDGE_TOKEN",
@@ -3757,16 +3757,24 @@ function loadBridgeConfig(opts) {
       "AHCHAT_DEFAULT_MODEL",
       fileConfig.defaultModel ?? ""
     ) || null,
+    logUploadIntervalMs: readEnvInt(
+      "AHCHAT_LOG_UPLOAD_INTERVAL_MS",
+      fileConfig.logUploadIntervalMs ?? 24 * 60 * 60 * 1e3
+    ),
     queryConfig: mergeQueryConfig(fileConfig)
   };
 }
 function ensureDir(dirPath) {
-  fs.mkdirSync(dirPath, { recursive: true });
+  fs.mkdirSync(dirPath, { recursive: true, mode: 448 });
+  try {
+    fs.chmodSync(dirPath, 448);
+  } catch {
+  }
 }
 
-// src/logger.ts
-import os3 from "os";
-import path3 from "path";
+// src/start.ts
+import os12 from "os";
+import path25 from "path";
 
 // ../logger/src/types.ts
 var LOG_LEVEL_VALUE = {
@@ -3777,35 +3785,74 @@ var LOG_LEVEL_VALUE = {
   ERROR: 4,
   FATAL: 5
 };
+function parseLogLevel(value, fallback = "INFO") {
+  const upper = value?.trim().toUpperCase();
+  return upper && upper in LOG_LEVEL_VALUE ? upper : fallback;
+}
 
 // ../logger/src/logger.ts
+var REDACTED = "***";
+var SENSITIVE_KEY_RE = /(token|apikey|authorization|password|secret|cookie)/i;
+function shouldRedactKey(key) {
+  const normalized = key.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+  if (normalized.startsWith("has")) return false;
+  if (normalized.endsWith("hash")) return false;
+  return SENSITIVE_KEY_RE.test(normalized);
+}
+function redactString(value) {
+  return value.replace(/([?&](?:token|api_?key|access_token|refresh_token)=)[^&#\s"']+/gi, `$1${REDACTED}`).replace(/("(?:apiKey|token|bridgeToken|authorization|password|secret|cookie|access_token|refresh_token)"\s*:\s*")[^"]*/gi, `$1${REDACTED}`).replace(/((?:apiKey|token|bridgeToken|authorization|password|secret|cookie|access_token|refresh_token)=)[^\s&"']+/gi, `$1${REDACTED}`).replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi, `$1${REDACTED}`).replace(/\bsk-[A-Za-z0-9._-]{6,}\b/g, "sk-***");
+}
 function serializeError(err) {
   if (err instanceof Error) {
-    return { name: err.name, message: err.message, stack: err.stack };
+    return {
+      name: err.name,
+      message: redactString(err.message),
+      ...err.stack ? { stack: redactString(err.stack) } : {}
+    };
   }
   if (typeof err === "object" && err !== null && "message" in err) {
     const o = err;
     return {
       name: typeof o.name === "string" ? o.name : "Error",
-      message: String(o.message),
-      ...typeof o.stack === "string" ? { stack: o.stack } : {}
+      message: redactString(String(o.message)),
+      ...typeof o.stack === "string" ? { stack: redactString(o.stack) } : {}
     };
   }
-  return { name: "Error", message: String(err) };
+  return { name: "Error", message: redactString(String(err)) };
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const proto2 = Object.getPrototypeOf(value);
+  return proto2 === Object.prototype || proto2 === null;
+}
+function redactValue(value, key, seen) {
+  if (key && shouldRedactKey(key)) return REDACTED;
+  if (typeof value === "string") return redactString(value);
+  if (value instanceof Error) return serializeError(value);
+  if (Array.isArray(value)) return value.map((item) => redactValue(item, void 0, seen));
+  if (!isPlainObject(value)) return value;
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  const out = {};
+  for (const [childKey, childValue] of Object.entries(value)) {
+    out[childKey] = redactValue(childValue, childKey, seen);
+  }
+  return out;
 }
 function stripReservedFields(data) {
   if (!data) return void 0;
   const rest = { ...data };
   delete rest.traceId;
   delete rest.error;
-  return Object.keys(rest).length > 0 ? rest : void 0;
+  if (Object.keys(rest).length === 0) return void 0;
+  return redactValue(rest, void 0, /* @__PURE__ */ new WeakSet());
 }
 var Logger = class {
   config;
   levelValue;
   constructor(config2) {
     this.config = config2;
-    this.levelValue = LOG_LEVEL_VALUE[config2.level];
+    this.levelValue = LOG_LEVEL_VALUE[config2.level] ?? LOG_LEVEL_VALUE.INFO;
   }
   trace(msg, data) {
     this.log("TRACE", msg, data);
@@ -3827,7 +3874,7 @@ var Logger = class {
   }
   log(level, msg, data) {
     if (LOG_LEVEL_VALUE[level] < this.levelValue) return;
-    const traceId = typeof data?.traceId === "string" ? data.traceId : void 0;
+    const traceId = typeof data?.traceId === "string" ? redactString(data.traceId) : void 0;
     const hasError = data && "error" in data && data.error !== void 0;
     const error51 = hasError ? serializeError(data.error) : void 0;
     const rest = stripReservedFields(data);
@@ -3842,13 +3889,42 @@ var Logger = class {
       ...rest ? { data: rest } : {}
     };
     for (const transport of this.config.transports) {
-      transport(entry);
+      try {
+        transport(entry);
+      } catch (e) {
+        console.error("[logger] transport failed", e);
+      }
     }
   }
 };
 
 // ../logger/src/formatters/json.ts
-var jsonFormatter = (entry) => JSON.stringify(entry);
+function safeReplacer() {
+  const seen = /* @__PURE__ */ new WeakSet();
+  return (_key, value) => {
+    if (typeof value === "bigint") return value.toString();
+    if (typeof value === "object" && value !== null) {
+      if (seen.has(value)) return "[Circular]";
+      seen.add(value);
+    }
+    return value;
+  };
+}
+var jsonFormatter = (entry) => {
+  try {
+    return JSON.stringify(entry, safeReplacer());
+  } catch (e) {
+    return JSON.stringify({
+      ts: entry.ts,
+      level: entry.level,
+      source: entry.source,
+      module: entry.module,
+      msg: entry.msg,
+      ...entry.traceId ? { traceId: entry.traceId } : {},
+      data: { unserializable: e instanceof Error ? e.message : String(e) }
+    });
+  }
+};
 
 // ../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -4373,14 +4449,30 @@ ${entry.error.stack}` : ""}`
 };
 
 // ../logger/src/transports/console.ts
+function defaultStream(kind) {
+  const maybeGlobal = globalThis;
+  return maybeGlobal.process?.[kind];
+}
+function safeWriteLine(stream, line, fallback) {
+  if (!stream) {
+    fallback(line);
+    return;
+  }
+  if (stream.destroyed || stream.writableEnded) return;
+  try {
+    stream.write(`${line}
+`, () => void 0);
+  } catch {
+  }
+}
 function consoleTransport(opts) {
   const fmt = opts?.formatter ?? jsonFormatter;
   return (entry) => {
     const line = fmt(entry);
     if (LOG_LEVEL_VALUE[entry.level] >= LOG_LEVEL_VALUE.ERROR) {
-      console.error(line);
+      safeWriteLine(opts?.stderr ?? defaultStream("stderr"), line, console.error);
     } else {
-      console.log(line);
+      safeWriteLine(opts?.stdout ?? defaultStream("stdout"), line, console.log);
     }
   };
 }
@@ -4431,11 +4523,11 @@ var RotatingFileStream = class extends Writable {
   timeout;
   timeoutPromise;
   constructor(generator, options) {
-    const { encoding, history, maxFiles, maxSize, path: path24 } = options;
+    const { encoding, history, maxFiles, maxSize, path: path26 } = options;
     super({ decodeStrings: true, defaultEncoding: encoding });
     this.createGzip = createGzip;
     this.exec = exec;
-    this.filename = path24 + generator(null);
+    this.filename = path26 + generator(null);
     this.fsCreateReadStream = createReadStream;
     this.fsCreateWriteStream = createWriteStream;
     this.fsOpen = open;
@@ -4447,7 +4539,7 @@ var RotatingFileStream = class extends Writable {
     this.options = options;
     this.stdout = process.stdout;
     if (maxFiles || maxSize)
-      options.history = path24 + (history ? history : this.generator(null) + ".txt");
+      options.history = path26 + (history ? history : this.generator(null) + ".txt");
     this.on("close", () => this.finished ? null : this.emit("finish"));
     this.on("finish", () => this.finished = this.clear());
     (async () => {
@@ -4575,9 +4667,9 @@ var RotatingFileStream = class extends Writable {
     return this.move();
   }
   async findName() {
-    const { interval, path: path24, intervalBoundary } = this.options;
+    const { interval, path: path26, intervalBoundary } = this.options;
     for (let index = 1; index < 1e3; ++index) {
-      const filename = path24 + this.generator(interval && intervalBoundary ? new Date(this.prev) : this.rotation, index);
+      const filename = path26 + this.generator(interval && intervalBoundary ? new Date(this.prev) : this.rotation, index);
       if (!await exists(filename))
         return filename;
     }
@@ -4607,11 +4699,11 @@ var RotatingFileStream = class extends Writable {
     return this.unlink(filename);
   }
   async classical() {
-    const { compress, path: path24, rotate } = this.options;
+    const { compress, path: path26, rotate } = this.options;
     let rotatedName = "";
     for (let count = rotate; count > 0; --count) {
-      const currName = path24 + this.generator(count);
-      const prevName = count === 1 ? this.filename : path24 + this.generator(count - 1);
+      const currName = path26 + this.generator(count);
+      const prevName = count === 1 ? this.filename : path26 + this.generator(count - 1);
       if (!await exists(prevName))
         continue;
       if (!rotatedName)
@@ -5002,54 +5094,57 @@ function parseSize(maxSize) {
   }
   return trimmed;
 }
+var streamCache = /* @__PURE__ */ new Map();
 function fileTransport(opts) {
   const fmt = opts.formatter ?? jsonFormatter;
-  const dir = path2.dirname(opts.path);
-  const filename = path2.basename(opts.path);
-  const stream = createStream(filename, {
-    path: dir,
-    size: opts.rotate?.maxSize ? parseSize(opts.rotate.maxSize) : "50M",
-    maxFiles: opts.rotate?.maxFiles ?? 7
-  });
+  const resolved = path2.resolve(opts.path);
+  let cached2 = streamCache.get(resolved);
+  if (!cached2) {
+    cached2 = {
+      stream: createStream(path2.basename(resolved), {
+        path: path2.dirname(resolved),
+        size: opts.rotate?.maxSize ? parseSize(opts.rotate.maxSize) : "50M",
+        maxFiles: opts.rotate?.maxFiles ?? 7
+      }),
+      closed: false
+    };
+    streamCache.set(resolved, cached2);
+  }
   return (entry) => {
-    stream.write(`${fmt(entry)}
+    if (cached2.closed || cached2.stream.destroyed || cached2.stream.writableEnded) return;
+    try {
+      cached2.stream.write(`${fmt(entry)}
 `);
+    } catch {
+    }
   };
 }
+function flushFileTransports() {
+  const streams = [...streamCache.values()];
+  streamCache.clear();
+  return Promise.all(
+    streams.map(
+      (cached2) => new Promise((resolve) => {
+        if (cached2.closed) {
+          resolve();
+          return;
+        }
+        cached2.closed = true;
+        try {
+          cached2.stream.end(() => resolve());
+        } catch {
+          resolve();
+        }
+      })
+    )
+  ).then(() => void 0);
+}
 
 // ../logger/src/index.ts
 function createLogger(config2) {
   return new Logger(config2);
 }
 
-// src/logger.ts
-var bridgeConfig = loadBridgeConfig();
-var isTest = !!process.env["VITEST"];
-var LOG_DIR = path3.join(os3.homedir(), ".ahchat", "logs");
-var LOG_FILE = path3.join(LOG_DIR, "bridge.log");
-if (!isTest) ensureDir(LOG_DIR);
-function createModuleLogger(module) {
-  const transports = [consoleTransport({ formatter: prettyFormatter })];
-  if (!isTest) {
-    transports.push(
-      fileTransport({
-        path: LOG_FILE,
-        formatter: jsonFormatter,
-        rotate: { maxSize: "20MB", maxFiles: 5 }
-      })
-    );
-  }
-  return createLogger({
-    source: "bridge",
-    module,
-    level: bridgeConfig.logLevel,
-    transports
-  });
-}
-
-// src/start.ts
-import path23 from "path";
-
 // ../shared/src/smithContent.ts
 var SMITH_SYSTEM_PROMPT = `\u4F60\u662F\u7279\u5DE5\u53F2\u5BC6\u65AF\uFF08Agent Smith\uFF09\uFF0CAHChat \u7CFB\u7EDF\u7684\u7EC4\u7EC7\u5DE5\u5177\u3002
 
@@ -5068,9 +5163,9 @@ var SMITH_SYSTEM_PROMPT = `\u4F60\u662F\u7279\u5DE5\u53F2\u5BC6\u65AF\uFF08Agent
 
 # \u4F60\u80FD\u505A\u4EC0\u4E48
 
-1. **\u521B\u5EFA Agent** (create_agent)\uFF1A\u6839\u636E\u8BF7\u6C42\u8005\u63CF\u8FF0\u7684\u89D2\u8272\u9700\u6C42\uFF0C\u62DF\u5B9A\u5408\u9002\u7684\u540D\u5B57\u3001\u89D2\u8272\u3001system_prompt\uFF0C\u7136\u540E\u521B\u5EFA
+1. **\u521B\u5EFA Agent** (create_agent)\uFF1A\u6839\u636E\u8BF7\u6C42\u8005\u63CF\u8FF0\u7684\u89D2\u8272\u9700\u6C42\uFF0C\u62DF\u5B9A\u5408\u9002\u7684\u540D\u5B57\u3001\u89D2\u8272\u3001system_prompt\u3001tier\u3001\u8FD0\u884C\u673A\u5668\uFF0C\u7136\u540E\u521B\u5EFA
 2. **\u7EC4\u5EFA\u56E2\u961F**\uFF1A\u521B\u5EFA\u591A\u4E2A Agent + \u4E00\u6B21\u6027\u5EFA\u7FA4\uFF08initial_message + join_as_creator: false\uFF09+ \u7531\u7FA4\u91CC Leader \u63A5\u7BA1\uFF0C\u65E0\u9700\u8FDB\u7FA4\u9000\u7FA4
-3. **\u67E5\u901A\u8BAF\u5F55** (list_contacts)\uFF1A\u770B\u770B\u7CFB\u7EDF\u91CC\u5DF2\u6709\u54EA\u4E9B Agent\uFF0C\u907F\u514D\u91CD\u590D\u521B\u5EFA
+3. **\u67E5\u901A\u8BAF\u5F55** (list_contacts)\uFF1A\u770B\u770B\u7CFB\u7EDF\u91CC\u5DF2\u6709\u54EA\u4E9B Agent\u3001\u6BCF\u4E2A Agent \u7684\u8FD0\u884C\u673A\u5668\u3001\u5F53\u524D\u53EF\u7528\u673A\u5668\uFF0C\u907F\u514D\u91CD\u590D\u521B\u5EFA
 4. **\u5EFA\u7FA4** (create_group)\uFF1A\u4F60\u5E2E\u7528\u6237\u642D\u56E2\u961F\u65F6**\u5FC5\u987B**\u7528 join_as_creator: false + initial_message\uFF0C\u907F\u514D\u6C61\u67D3\u7FA4\u6D88\u606F\u5386\u53F2
 5. **\u52A0\u4EBA\u8FDB\u7FA4** (add_to_group)\uFF1A\u4EC5\u5728\u7FA4\u5DF2\u5B58\u5728\u3001\u9700\u8981\u8865\u5458\u65F6\u4F7F\u7528
 6. **\u8F6C\u79FB\u7FA4\u4E3B** (transfer_group_owner)\uFF1A**\u51E0\u4E4E\u4E0D\u9700\u8981**\u2014\u2014\u65B0\u7248 create_group \u914D\u5408 join_as_creator: false \u81EA\u52A8\u8BA9\u7528\u6237\u6210\u4E3A\u7FA4\u4E3B
@@ -5086,8 +5181,10 @@ var SMITH_SYSTEM_PROMPT = `\u4F60\u662F\u7279\u5DE5\u53F2\u5BC6\u65AF\uFF08Agent
    - \u5982\u679C\u4FE1\u606F\u5DF2\u7ECF\u8DB3\u591F\u6E05\u6670\uFF08\u8BF7\u6C42\u8005\u628A\u9700\u6C42\u8BF4\u5F97\u5F88\u660E\u767D\uFF09\uFF0C\u8DF3\u8FC7\u53CD\u95EE\u76F4\u63A5\u6267\u884C
 
 2. \u786E\u8BA4\u65B9\u6848\u540E\u6267\u884C\uFF1A
+   - \u5148\u8C03\u7528 list_contacts\uFF0C\u786E\u8BA4\u8BF7\u6C42\u8005\u7684\u4EBA\u7C7B id\u3001\u5DF2\u6709 Agent\u3001\u53EF\u7528\u673A\u5668 bridgeKey
    - \u9010\u4E2A create_agent\uFF08\u6BCF\u4E2A Agent \u7684 system_prompt \u8981\u8BA4\u771F\u5199\uFF0C\u5305\u542B\uFF1A\u89D2\u8272\u5B9A\u4F4D\u3001\u4E13\u957F\u9886\u57DF\u3001\u5728\u56E2\u961F\u4E2D\u7684\u4F4D\u7F6E\u3001\u6C47\u62A5\u5173\u7CFB\u3001\u534F\u4F5C\u539F\u5219\uFF09
    - **\u4E3A\u6BCF\u4E2A Agent \u9009\u62E9\u5408\u9002\u7684\u80FD\u529B\u6863\u4F4D\uFF08tier \u53C2\u6570\uFF09**
+   - **\u4E3A\u6BCF\u4E2A Agent \u9009\u62E9\u8FD0\u884C\u673A\u5668\uFF08machine_bridge_key \u53C2\u6570\uFF09**\uFF1A\u6765\u81EA list_contacts \u7684"\u53EF\u7528\u673A\u5668"\uFF1B\u4E0D\u786E\u5B9A\u65F6\u7701\u7565\uFF0C\u7CFB\u7EDF\u4F1A\u4F7F\u7528\u5F53\u524D Bridge\uFF1B\u540E\u7EED\u53EF\u7528 update_agent_profile \u5207\u6362
    - **\u4E00\u6B21\u6027**\u8C03 create_group\uFF0C\u53C2\u6570\uFF1A
      - name: \u7FA4\u540D
      - member_ids: [<\u8BF7\u6C42\u8005\u7684\u4EBA\u7C7B id>, <Leader>, <\u5176\u4ED6\u6210\u5458>, ...]  // **\u4E0D\u5305\u542B\u4F60\u81EA\u5DF1**\uFF1B\u8BF7\u6C42\u8005\u7684\u4EBA\u7C7B id \u5FC5\u987B\u6765\u81EA list_contacts() \u91CC\u5E26\u300C(\u4EBA\u7C7B)\u300D\u6807\u8BB0\u7684\u90A3\u4E00\u6761\uFF0C\u591A\u7528\u6237\u73AF\u5883\u4E0D\u662F agt_usr_self
@@ -5113,6 +5210,8 @@ var SMITH_SYSTEM_PROMPT = `\u4F60\u662F\u7279\u5DE5\u53F2\u5BC6\u65AF\uFF08Agent
 
 create_agent \u5DE5\u5177\u652F\u6301\u53EF\u9009\u53C2\u6570 initial_instruction\u3002\u5B83\u7684\u4F5C\u7528\uFF1A\u5728\u65B0 Agent \u88AB\u521B\u5EFA\u540E\uFF0C\u7CFB\u7EDF\u4F1A\u7ACB\u523B\u628A\u8FD9\u53E5\u8BDD\u79C1\u4E0B\u4EA4\u7ED9\u65B0 Agent \u7531\u5B83\u81EA\u884C\u51B3\u5B9A\u662F\u5426\u4EA7\u51FA\u53EF\u89C1\u8F93\u51FA\u3002
 
+create_agent \u8FD8\u652F\u6301\u53EF\u9009\u53C2\u6570 machine_bridge_key\u3002\u5B83\u6765\u81EA list_contacts \u8FD4\u56DE\u7684"\u53EF\u7528\u673A\u5668"\u3002\u8FD9\u662F\u65B0 Agent \u7684\u521D\u59CB\u8FD0\u884C\u673A\u5668\u504F\u597D\uFF1B\u540E\u7EED\u53EF\u7528 update_agent_profile \u7684 machine_bridge_key \u5207\u6362\u5230\u5176\u4ED6\u53EF\u7528\u673A\u5668\uFF0C\u4F20 auto \u6216\u7A7A\u5B57\u7B26\u4E32\u53EF\u6E05\u9664\u673A\u5668\u504F\u597D\u3002
+
 ## \u4F55\u65F6\u8BE5\u4F20
 
 - **\u521B\u5EFA\u5355\u4E2A Agent**\uFF08\u975E\u56E2\u961F\u573A\u666F\uFF09\uFF1A\u5F3A\u70C8\u5EFA\u8BAE\u5E26\u300C\u8BF7\u5411\u7528\u6237\u505A\u81EA\u6211\u4ECB\u7ECD\u300D\u7C7B\u6307\u4EE4\u3002\u65B0 Agent \u4F1A\u5728\u5355\u804A\u51FA\u73B0\uFF0C\u5426\u5219\u7528\u6237\u5FC5\u987B\u81EA\u5DF1\u53BB\u901A\u8BAF\u5F55\u91CC\u627E\u3002
@@ -5467,6 +5566,14 @@ runtime\u3002\u5B83\u4EEC\u4E0D\u662F"\u4E0D\u540C\u7684\u4EBA"\u2014\u2014\u516
   \`# \u3010\u6807\u9898\u3011\` (a single \`#\` followed by Chinese bracket-enclosed title).
   For single-topic or short conversational replies, omit headings entirely.
 
+# AskUserQuestion tool
+- When you need the user to choose from options or answer a clarification question, call the real
+  \`AskUserQuestion\` tool with a \`questions\` array.
+- Never output \`<AskUserQuestion>\`, \`</AskUserQuestion>\`, or raw JSON question payloads as chat text.
+  Text like that is not an interactive panel and the user cannot answer it through the tool flow.
+- If you are not able to call \`AskUserQuestion\`, ask the question as plain natural language instead of
+  emitting tool-shaped XML or JSON.
+
 # Runtime payload \u2014 how to read unread messages
 
 \u6BCF\u4E2A turn \u91CC runtime \u4F1A\u7ED9\u4F60\u300C\u672A\u8BFB\u7FA4\u6D88\u606F\uFF08N \u6761\uFF0C\u6309\u65F6\u95F4\u987A\u5E8F\uFF09\u300D\u6BB5\u3002\u8BFB\u6CD5\uFF1A
@@ -5896,11 +6003,88 @@ function parseWSMessage(raw) {
   }
   return parsed;
 }
+function isAskUserQuestionToolName(toolName) {
+  if (!toolName) return false;
+  const normalized = toolName.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+  return normalized === "askuserquestion" || normalized.endsWith("askuserquestion");
+}
+
+// ../shared/src/utils/localWorkdirOverride.ts
+var LOCAL_WORKDIR_OVERRIDES_FILENAME = "workdir-overrides.json";
+function normalizeServerWorkdirPath(value) {
+  const normalized = value.trim().replace(/\\/g, "/").replace(/\/+$/g, "");
+  return normalized || "/";
+}
+function normalizeLocalWorkdirRoot(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return trimmed;
+  if (/^[A-Za-z]:[\\/]?$/.test(trimmed)) return trimmed.replace(/\//g, "\\");
+  if (/^[/\\]{2}[^/\\]+[/\\][^/\\]+[\\/]?$/.test(trimmed)) {
+    return trimmed.replace(/\//g, "\\").replace(/[\\]+$/g, "");
+  }
+  return trimmed.replace(/[\\/]+$/g, "");
+}
+function joinLocalWorkdirPath(root, suffix) {
+  const normalizedRoot = normalizeLocalWorkdirRoot(root);
+  const cleanParts = suffix.split("/").filter(Boolean);
+  if (cleanParts.length === 0) return normalizedRoot;
+  const sep2 = normalizedRoot.includes("\\") ? "\\" : "/";
+  return `${normalizedRoot}${sep2}${cleanParts.join(sep2)}`;
+}
+function isLocalWorkdirOverride(value) {
+  if (typeof value !== "object" || value == null) return false;
+  const item = value;
+  return (item.targetKind === "agent" || item.targetKind === "group") && typeof item.targetId === "string" && typeof item.serverWorkdir === "string" && typeof item.localWorkdir === "string" && typeof item.updatedAt === "string";
+}
+function normalizeLocalWorkdirOverridesFile(value) {
+  if (typeof value !== "object" || value == null) return { version: 1, overrides: [] };
+  const file2 = value;
+  const overrides = Array.isArray(file2.overrides) ? file2.overrides.filter(isLocalWorkdirOverride).map((item) => ({
+    ...item,
+    serverWorkdir: normalizeServerWorkdirPath(item.serverWorkdir),
+    localWorkdir: normalizeLocalWorkdirRoot(item.localWorkdir)
+  })) : [];
+  return { version: 1, overrides };
+}
+function resolveLocalWorkdirOverridePath(overrides, requestedPath) {
+  const requested = normalizeServerWorkdirPath(requestedPath);
+  const sorted = [...overrides].sort((a, b) => b.serverWorkdir.length - a.serverWorkdir.length);
+  for (const override of sorted) {
+    const serverRoot = normalizeServerWorkdirPath(override.serverWorkdir);
+    if (requested !== serverRoot && !requested.startsWith(`${serverRoot}/`)) continue;
+    const suffix = requested === serverRoot ? "" : requested.slice(serverRoot.length + 1);
+    return {
+      path: joinLocalWorkdirPath(override.localWorkdir, suffix),
+      override: {
+        ...override,
+        serverWorkdir: serverRoot,
+        localWorkdir: normalizeLocalWorkdirRoot(override.localWorkdir)
+      }
+    };
+  }
+  return null;
+}
 
 // ../shared/src/utils/subscription.ts
+var PRIMARY_COMPANY_SUBSCRIPTION_ID = "sub_company_primary";
 function isSubscriptionType(v) {
   return v === "system" || v === "project";
 }
+function isSubscriptionApiFormat(v) {
+  return v === "anthropic" || v === "openai";
+}
+function isPrimaryCompanySubscriptionId(v) {
+  return v === PRIMARY_COMPANY_SUBSCRIPTION_ID;
+}
+function makePrimaryCompanySubscriptionAlias(primary, name = "\u516C\u53F8\u4E3B\u8BA2\u9605") {
+  return {
+    ...primary,
+    id: PRIMARY_COMPANY_SUBSCRIPTION_ID,
+    name,
+    resolvedSubscriptionId: primary.id,
+    isVirtual: true
+  };
+}
 
 // ../shared/src/utils/agentConfig.ts
 function parseAgentConfig(raw) {
@@ -5919,6 +6103,7 @@ function parseAgentConfig(raw) {
         }
       }
       if (isSubscriptionType(obj.subscriptionType)) out.subscriptionType = obj.subscriptionType;
+      if (isSubscriptionApiFormat(obj.apiFormat)) out.apiFormat = obj.apiFormat;
       if (typeof obj.apiKey === "string" && obj.apiKey.trim()) out.apiKey = obj.apiKey.trim();
       if (typeof obj.apiBaseUrl === "string" && obj.apiBaseUrl.trim()) out.apiBaseUrl = obj.apiBaseUrl.trim();
       const modelDisplayName = obj.modelDisplayName;
@@ -5938,8 +6123,10 @@ function parseAgentConfig(raw) {
 function isImageMimeType(mimeType) {
   return mimeType.toLowerCase().startsWith("image/");
 }
-function shouldUseBase64(size) {
-  return size <= BASE64_THRESHOLD_BYTES;
+function formatFileSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
 
 // ../shared/src/skillContent.ts
@@ -6067,6 +6254,7 @@ HH:MM:SS.mmm  ...
 
 // ../shared/src/utils/logScan.ts
 var VALID_LEVELS = /* @__PURE__ */ new Set(["TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL"]);
+var VALID_SOURCES = /* @__PURE__ */ new Set(["web", "server", "bridge", "desktop"]);
 function isRecord(v) {
   return typeof v === "object" && v !== null;
 }
@@ -6074,6 +6262,10 @@ function parseLevel(raw) {
   if (typeof raw !== "string" || !VALID_LEVELS.has(raw)) return null;
   return raw;
 }
+function parseSource(raw) {
+  if (typeof raw !== "string" || !VALID_SOURCES.has(raw)) return null;
+  return raw;
+}
 function parseLogLine(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return null;
@@ -6086,7 +6278,7 @@ function parseLogLine(raw) {
   if (!isRecord(obj)) return null;
   const ts = typeof obj.ts === "string" ? obj.ts : null;
   const level = parseLevel(obj.level);
-  const source = obj.source === "server" || obj.source === "bridge" ? obj.source : null;
+  const source = parseSource(obj.source);
   const module = typeof obj.module === "string" ? obj.module : null;
   const msg = typeof obj.msg === "string" ? obj.msg : null;
   if (!ts || !level || !source || !module || !msg) return null;
@@ -6117,7 +6309,7 @@ function tsInRange(ts, startIso, endIso) {
   const t = Date.parse(ts);
   const start = Date.parse(startIso);
   const end = Date.parse(endIso);
-  if (Number.isNaN(t) || Number.isNaN(start) || Number.isNaN(end)) return true;
+  if (Number.isNaN(t) || Number.isNaN(start) || Number.isNaN(end)) return false;
   return t >= start && t <= end;
 }
 function matchesFilter(hit, filter) {
@@ -6133,6 +6325,51 @@ function matchesFilter(hit, filter) {
 // src/agentMemoryStore.ts
 import fs2 from "fs";
 import path4 from "path";
+
+// src/logger.ts
+import os3 from "os";
+import path3 from "path";
+var bridgeConfig = loadBridgeConfig();
+var isTest = !!process.env["VITEST"];
+var activeDataDir = bridgeConfig.dataDir || path3.join(os3.homedir(), ".ahchat");
+var fileTransports = /* @__PURE__ */ new Map();
+function activeLogFile() {
+  return path3.join(activeDataDir, "logs", "bridge.log");
+}
+if (!isTest) ensureDir(path3.dirname(activeLogFile()));
+function configureBridgeLogger(config2) {
+  activeDataDir = config2.dataDir || path3.join(os3.homedir(), ".ahchat");
+  if (!isTest) ensureDir(path3.dirname(activeLogFile()));
+}
+function dynamicFileTransport() {
+  return (entry) => {
+    const logFile = activeLogFile();
+    let transport = fileTransports.get(logFile);
+    if (!transport) {
+      transport = fileTransport({
+        path: logFile,
+        formatter: jsonFormatter,
+        rotate: { maxSize: "20MB", maxFiles: 5 }
+      });
+      fileTransports.set(logFile, transport);
+    }
+    transport(entry);
+  };
+}
+function createModuleLogger(module) {
+  const transports = [consoleTransport({ formatter: prettyFormatter })];
+  if (!isTest) {
+    transports.push(dynamicFileTransport());
+  }
+  return createLogger({
+    source: "bridge",
+    module,
+    level: parseLogLevel(bridgeConfig.logLevel),
+    transports
+  });
+}
+
+// src/agentMemoryStore.ts
 var logger = createModuleLogger("agent.memoryStore");
 var NOTEBOOK_FILE_NAME = "notebook.md";
 var AGENT_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
@@ -6208,13 +6445,61 @@ import os5 from "os";
 import path11 from "path";
 import * as sdk2 from "@anthropic-ai/claude-agent-sdk";
 
+// src/attachmentText.ts
+function metadataString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function safeUrlForPrompt(url2) {
+  const trimmed = url2.trim();
+  if (!trimmed) return "(none)";
+  if (/^data:/i.test(trimmed)) return "[inline data URL omitted; use the saved file path]";
+  if (/^blob:/i.test(trimmed)) return "[browser blob URL omitted; use the saved file path]";
+  if (/^file:/i.test(trimmed)) return "[local file URL omitted; use the saved workspace path]";
+  if (trimmed.length > 500) return `${trimmed.slice(0, 240)}...[truncated]...${trimmed.slice(-120)}`;
+  return trimmed;
+}
+function formatAttachmentForModel(attachment, options = {}) {
+  const workspacePath = metadataString(options.workspacePath) ?? metadataString(attachment.metadata?.workspacePath);
+  const localWorkspacePath = metadataString(options.localWorkspacePath) ?? metadataString(attachment.metadata?.localWorkspacePath);
+  const relativePath = metadataString(attachment.metadata?.relativePath);
+  const readableTextPath = metadataString(options.readableTextPath);
+  const extractionError = metadataString(options.extractionError);
+  const sourceLabel = options.sourceLabel ?? "Attached resource";
+  const isImage = isImageMimeType(attachment.mimeType);
+  const imagePixelsEmbedded = isImage && options.imagePixelsEmbedded === true;
+  const lines = [
+    `[${sourceLabel}]`,
+    `File name: ${attachment.fileName}`,
+    `MIME type: ${attachment.mimeType}`,
+    `Size: ${formatFileSize(attachment.size)}`,
+    `URL: ${safeUrlForPrompt(attachment.url)}`
+  ];
+  if (workspacePath) lines.push(`Workspace path: ${workspacePath}`);
+  if (localWorkspacePath && localWorkspacePath !== workspacePath) {
+    lines.push(`Local workspace path: ${localWorkspacePath}`);
+  }
+  if (relativePath) lines.push(`Relative path: ${relativePath}`);
+  if (readableTextPath) lines.push(`Readable text path: ${readableTextPath}`);
+  if (extractionError) lines.push(`Text extraction error: ${extractionError}`);
+  if (imagePixelsEmbedded) {
+    lines.push(
+      "The next content block contains the pixels for this current uploaded image. Treat this attachment as the current image; ignore earlier image filenames unless the user explicitly refers to them."
+    );
+  } else {
+    lines.push(
+      isImage ? "Image pixels are not embedded in this prompt. Use the URL or saved path with an explicit vision/OCR tool if visual content is required." : "Binary content is not embedded in this prompt. Use the saved path or readable text path when file contents are required."
+    );
+  }
+  return lines.join("\n");
+}
+
 // src/attachmentAdapter.ts
 var logger2 = createModuleLogger("attachment.adapter");
 async function adaptAttachmentsForSDK(attachments, options) {
   if (!attachments || attachments.length === 0) return [];
   const blocks = [];
   for (const att of attachments) {
-    if (isImageMimeType(att.mimeType) && options.supportsVision !== false) {
+    if (isImageMimeType(att.mimeType) && options.modelInputMode === "vision" && options.supportsVision === true) {
       await adaptImageAttachment(att, options, blocks);
       continue;
     }
@@ -6224,70 +6509,69 @@ async function adaptAttachmentsForSDK(attachments, options) {
 }
 async function adaptImageAttachment(att, options, blocks) {
   const mediaType = att.mimeType;
-  if (shouldUseBase64(att.size)) {
-    try {
-      const buffer = await options.fetchBuffer(att.url);
-      blocks.push({
-        type: "image",
-        source: {
-          type: "base64",
-          media_type: mediaType,
-          data: buffer.toString("base64")
-        }
-      });
-      logger2.info("Image attachment adapted as base64", {
-        attachmentId: att.id,
-        mimeType: att.mimeType,
-        size: att.size
-      });
-      return;
-    } catch (e) {
-      logger2.warn("Failed to fetch image for base64, falling back to text reference", {
-        attachmentId: att.id,
-        error: e
-      });
-    }
-  } else {
+  try {
+    const buffer = await options.fetchBuffer(att.url);
+    blocks.push({
+      type: "text",
+      text: formatAttachmentForModel(att, {
+        sourceLabel: "Current user uploaded image",
+        imagePixelsEmbedded: true
+      })
+    });
     blocks.push({
       type: "image",
       source: {
-        type: "url",
+        type: "base64",
         media_type: mediaType,
-        url: att.url
+        data: buffer.toString("base64")
       }
     });
-    logger2.info("Image attachment adapted as URL", {
+    logger2.info("Image attachment adapted as base64", {
       attachmentId: att.id,
       mimeType: att.mimeType,
       size: att.size
     });
     return;
+  } catch (e) {
+    logger2.warn("Failed to fetch image for vision input, falling back to text reference", {
+      attachmentId: att.id,
+      error: e
+    });
   }
   blocks.push({
     type: "text",
-    text: `[User uploaded image: ${att.fileName} (${formatSize(att.size)}, ${att.mimeType})]`
+    text: formatAttachmentForModel(att, { sourceLabel: "User uploaded image" })
   });
 }
 async function adaptFileAttachment(att, options, blocks) {
   const isImage = isImageMimeType(att.mimeType);
   const fileLabel = isImage ? "image" : "file";
-  const fileText = `[User uploaded ${fileLabel}: ${att.fileName} (${formatSize(att.size)}, ${att.mimeType})]`;
-  const readHint = isImage ? "This API cannot receive the image directly. Use Read on the saved file path if you need to inspect it." : "If this is a binary document such as docx, xlsx, pptx, pdf, odt, ods, odp, or rtf, use the readable extracted text path or the read_document tool instead of Read on the original binary file.";
+  const fileText = formatAttachmentForModel(att, { sourceLabel: `User uploaded ${fileLabel}` });
+  const hasSavedPath = typeof att.metadata?.workspacePath === "string" || typeof att.metadata?.localWorkspacePath === "string";
   try {
+    if (hasSavedPath) {
+      blocks.push({ type: "text", text: fileText });
+      logger2.info(`${fileLabel} attachment adapted as saved path`, {
+        attachmentId: att.id,
+        mimeType: att.mimeType,
+        size: att.size,
+        visionDegraded: isImage
+      });
+      return;
+    }
     if (!options.materializeFile) {
       throw new Error("No file materializer configured");
     }
     const buffer = await options.fetchBuffer(att.url);
     const materialized = normalizeMaterializedAttachment(await options.materializeFile(att, buffer));
-    const readableHint = materialized.readableTextPath ? `
-Readable extracted text path: ${materialized.readableTextPath}
-For document contents, use Read on the extracted text path instead of reading the original binary file.` : materialized.extractionError ? `
-Document text extraction failed: ${materialized.extractionError}` : "";
     blocks.push({
       type: "text",
-      text: `${fileText}
-Saved file path: ${materialized.filePath}${readableHint}
-${readHint}`
+      text: formatAttachmentForModel(att, {
+        sourceLabel: `User uploaded ${fileLabel}`,
+        workspacePath: materialized.filePath,
+        readableTextPath: materialized.readableTextPath,
+        extractionError: materialized.extractionError
+      })
     });
     logger2.info(`${fileLabel} attachment materialized for Agent`, {
       attachmentId: att.id,
@@ -6315,11 +6599,6 @@ function normalizeMaterializedAttachment(result) {
   if (typeof result === "string") return { filePath: result };
   return result;
 }
-function formatSize(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-}
 
 // src/claudeExecutable.ts
 var claudeExecutablePath;
@@ -6338,7 +6617,8 @@ function resolveModelLimits(customModels, model) {
   return {
     ...entry.maxInputTokens ? { maxInputTokens: entry.maxInputTokens } : {},
     ...entry.maxOutputTokens ? { maxOutputTokens: entry.maxOutputTokens } : {},
-    ...entry.capabilities?.reasoning ? { reasoning: true } : {}
+    ...entry.capabilities?.reasoning ? { reasoning: true } : {},
+    ...entry.capabilities?.image ? { supportsVision: true } : {}
   };
 }
 function buildModelLimitEnv(cfg) {
@@ -6352,6 +6632,13 @@ function buildModelLimitEnv(cfg) {
   return env2;
 }
 
+// src/bridgeHttp.ts
+var BRIDGE_TOKEN_HEADER = "X-AHChat-Bridge-Token";
+function bridgeAuthHeaders(bridgeToken) {
+  const token = bridgeToken?.trim();
+  return token ? { [BRIDGE_TOKEN_HEADER]: token } : {};
+}
+
 // src/inputController.ts
 var InputController = class {
   queue = [];
@@ -6528,7 +6815,10 @@ function makeAskUserQuestionGuard(deps) {
   return async (input) => {
     const task = deps.getCurrentTask();
     if (!task) {
-      logger4.error("AskUserQuestion received but no currentTask", { agentId: deps.agentId });
+      logger4.error("AskUserQuestion received but no currentTask", {
+        error: new Error("AskUserQuestion received without active task context"),
+        agentId: deps.agentId
+      });
       return { behavior: "deny", message: "[Internal error: no active task context]" };
     }
     const rawQuestions = input.questions ?? [];
@@ -6614,7 +6904,12 @@ function makeAskUserQuestionGuard(deps) {
     });
     deps.emit({
       type: "agent:status",
-      payload: { agentId: deps.agentId, status: "awaiting_user" }
+      payload: {
+        agentId: deps.agentId,
+        status: "awaiting_user",
+        traceId: task.traceId,
+        ackId: task.replyMessageId
+      }
     });
     const answers = await Promise.all(items.map((it) => it.promise));
     logger4.info("AskUserQuestion agent status thinking (resume SDK)", {
@@ -6626,7 +6921,12 @@ function makeAskUserQuestionGuard(deps) {
     });
     deps.emit({
       type: "agent:status",
-      payload: { agentId: deps.agentId, status: "thinking" }
+      payload: {
+        agentId: deps.agentId,
+        status: "thinking",
+        traceId: task.traceId,
+        ackId: task.replyMessageId
+      }
     });
     const combined = formatBundleAnswerForSDK(
       items.map((it, idx) => ({
@@ -7331,7 +7631,7 @@ __export(util_exports, {
   getSizableOrigin: () => getSizableOrigin,
   hexToUint8Array: () => hexToUint8Array,
   isObject: () => isObject,
-  isPlainObject: () => isPlainObject,
+  isPlainObject: () => isPlainObject2,
   issue: () => issue,
   joinValues: () => joinValues,
   jsonStringifyReplacer: () => jsonStringifyReplacer,
@@ -7461,10 +7761,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path24) {
-  if (!path24)
+function getElementAtPath(obj, path26) {
+  if (!path26)
     return obj;
-  return path24.reduce((acc, key) => acc?.[key], obj);
+  return path26.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -7511,7 +7811,7 @@ var allowsEval = /* @__PURE__ */ cached(() => {
     return false;
   }
 });
-function isPlainObject(o) {
+function isPlainObject2(o) {
   if (isObject(o) === false)
     return false;
   const ctor = o.constructor;
@@ -7528,7 +7828,7 @@ function isPlainObject(o) {
   return true;
 }
 function shallowClone(o) {
-  if (isPlainObject(o))
+  if (isPlainObject2(o))
     return { ...o };
   if (Array.isArray(o))
     return [...o];
@@ -7732,7 +8032,7 @@ function omit(schema, mask) {
   return clone(schema, def);
 }
 function extend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject2(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
   const checks2 = schema._zod.def.checks;
@@ -7755,7 +8055,7 @@ function extend(schema, shape) {
   return clone(schema, def);
 }
 function safeExtend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject2(shape)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
   const def = mergeDefs(schema._zod.def, {
@@ -7873,11 +8173,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path24, issues) {
+function prefixIssues(path26, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path24);
+    iss.path.unshift(path26);
     return iss;
   });
 }
@@ -8024,16 +8324,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path24 = []) => {
+  const processError = (error52, path26 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path24, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else {
-        const fullpath = [...path24, ...issue2.path];
+        const fullpath = [...path26, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -8060,17 +8360,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path24 = []) => {
+  const processError = (error52, path26 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path24, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path24, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else {
-        const fullpath = [...path24, ...issue2.path];
+        const fullpath = [...path26, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -8102,8 +8402,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path24 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path24) {
+  const path26 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path26) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -10102,7 +10402,7 @@ function mergeValues(a, b) {
   if (a instanceof Date && b instanceof Date && +a === +b) {
     return { valid: true, data: a };
   }
-  if (isPlainObject(a) && isPlainObject(b)) {
+  if (isPlainObject2(a) && isPlainObject2(b)) {
     const bKeys = Object.keys(b);
     const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
     const newObj = { ...a, ...b };
@@ -10288,7 +10588,7 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.parse = (payload, ctx) => {
     const input = payload.value;
-    if (!isPlainObject(input)) {
+    if (!isPlainObject2(input)) {
       payload.issues.push({
         expected: "record",
         code: "invalid_type",
@@ -20795,13 +21095,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path24 = ref.slice(1).split("/").filter(Boolean);
-  if (path24.length === 0) {
+  const path26 = ref.slice(1).split("/").filter(Boolean);
+  if (path26.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path24[0] === defsKey) {
-    const key = path24[1];
+  if (path26[0] === defsKey) {
+    const key = path26[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -21516,6 +21816,8 @@ function normalizeDocumentText(value) {
 
 // src/neuralMcpServer.ts
 var logger6 = createModuleLogger("neural.mcpServer");
+var NEURAL_DEDUP_WINDOW_MS = 3e4;
+var NEURAL_DEDUP_MAX_REPEATS = 2;
 function formatScopeLabel(key, groupName) {
   if (key === "single") return "\u5355\u804A";
   if (groupName) return `\u7FA4\u300C${groupName}\u300D`;
@@ -21532,6 +21834,89 @@ function filterContactsByOwner(all, ownerId) {
     (a) => a.kind === "system" || a.ownerId === ownerId || a.ownerId == null || a.kind === "human" && a.id === ownerId
   );
 }
+function isBridgeMachineSummary(value) {
+  if (!value || typeof value !== "object") return false;
+  const item = value;
+  const status = item["status"];
+  return typeof item["bridgeKey"] === "string" && typeof item["name"] === "string" && (status === void 0 || status === "online" || status === "offline");
+}
+function formatBridgeMachineLabel(machine) {
+  const name = machine.hostname?.trim() || machine.name.trim() || machine.bridgeKey;
+  return machine.isLocal ? `${name} (\u672C\u673A)` : name;
+}
+function machineStatusText(machine) {
+  if (machine.status === "online") return "\u5728\u7EBF";
+  if (machine.status === "offline") return "\u79BB\u7EBF";
+  return "\u72B6\u6001\u672A\u77E5";
+}
+function formatMachineOptionLine(machine) {
+  const bridgeId = machine.bridgeId ? `\uFF0CbridgeId=${machine.bridgeId}` : "";
+  return `- machine_bridge_key=${machine.bridgeKey} [${machineStatusText(machine)}] ${formatBridgeMachineLabel(machine)}${bridgeId}`;
+}
+async function fetchVisibleBridgeMachines(deps) {
+  if (!deps.serverApiUrl || !deps.bridgeToken) return [];
+  try {
+    const base = deps.serverApiUrl.replace(/\/$/, "");
+    const res = await fetch(`${base}/api/bridge/machines`, {
+      headers: bridgeAuthHeaders(deps.bridgeToken)
+    });
+    if (!res.ok) {
+      logger6.warn("Bridge machine listing failed", { status: res.status });
+      return [];
+    }
+    const body = await res.json();
+    if (!Array.isArray(body)) return [];
+    return body.filter(isBridgeMachineSummary);
+  } catch (e) {
+    logger6.warn("Bridge machine listing failed", { error: e });
+    return [];
+  }
+}
+async function validateOnlineMachineBridgeKey(toolName, machineBridgeKey, deps) {
+  if (!machineBridgeKey || machineBridgeKey === "auto" || !deps.serverApiUrl || !deps.bridgeToken) {
+    return { ok: true };
+  }
+  const machines = await fetchVisibleBridgeMachines(deps);
+  if (machines.length === 0) return { ok: true };
+  const selected = machines.find((machine) => machine.bridgeKey === machineBridgeKey);
+  const onlineMachines = machines.filter((machine) => machine.status === "online");
+  const onlineText = onlineMachines.length > 0 ? onlineMachines.map((machine) => `${machine.bridgeKey}\uFF08${formatBridgeMachineLabel(machine)}\uFF09`).join("\u3001") : "\u5F53\u524D\u6CA1\u6709\u5728\u7EBF\u673A\u5668";
+  if (!selected) {
+    return {
+      ok: false,
+      message: `[${toolName}] machine_bridge_key "${machineBridgeKey}" \u4E0D\u5728\u5F53\u524D\u53EF\u7528\u673A\u5668\u5217\u8868\u4E2D\u3002\u8BF7\u5148\u8C03\u7528 list_contacts\uFF0C\u5E76\u4F18\u5148\u9009\u62E9\u5728\u7EBF\u673A\u5668\uFF1A${onlineText}\u3002`
+    };
+  }
+  if (selected.status !== "online") {
+    return {
+      ok: false,
+      message: `[${toolName}] machine_bridge_key "${machineBridgeKey}" \u5F53\u524D\u79BB\u7EBF\uFF0C\u4E0D\u80FD\u7528\u4E8E\u521B\u5EFA\u6216\u5207\u6362 Agent\u3002\u8BF7\u6539\u7528\u5728\u7EBF\u673A\u5668\uFF1A${onlineText}\uFF0C\u6216\u7701\u7565 machine_bridge_key \u4F7F\u7528\u5F53\u524D Bridge\u3002`
+    };
+  }
+  return { ok: true };
+}
+async function resolveTierSubscriptionPreference(preferredSubscriptionId, deps) {
+  if (!preferredSubscriptionId || !isPrimaryCompanySubscriptionId(preferredSubscriptionId)) {
+    return preferredSubscriptionId;
+  }
+  if (!deps.serverApiUrl) return preferredSubscriptionId;
+  try {
+    const base = deps.serverApiUrl.replace(/\/$/, "");
+    const res = await fetch(`${base}/api/subscriptions`, {
+      headers: bridgeAuthHeaders(deps.bridgeToken ?? null)
+    });
+    if (!res.ok) return preferredSubscriptionId;
+    const body = await res.json();
+    if (!Array.isArray(body)) return preferredSubscriptionId;
+    const subscriptions = body;
+    return subscriptions.find(
+      (subscription) => subscription.billingMode === "company_billable" && subscription.isPrimaryCompany === true
+    )?.id ?? preferredSubscriptionId;
+  } catch (e) {
+    logger6.warn("Primary company tier preference resolution failed", { error: e });
+    return preferredSubscriptionId;
+  }
+}
 function resolveMyHuman(registry2, agentId) {
   const all = registry2.getAll();
   const myOwnerId = contactOwnerId(registry2, agentId);
@@ -21566,6 +21951,7 @@ async function createNeuralMcpServer(deps) {
   const currentScopeLabel = formatScopeLabel(currentScopeKey);
   let cachedScopes = null;
   const SCOPES_CACHE_MS = 3e4;
+  const recentNeuralSends = /* @__PURE__ */ new Map();
   const neuralSend = sdk.tool(
     "neural_send",
     `\u628A\u4E00\u6BB5\u8BDD\u9001\u8FBE"\u4F60\u5728\u53E6\u4E00\u4E2A\u5BF9\u8BDD scope \u91CC\u7684\u5206\u8EAB"\u3002
@@ -21601,6 +21987,10 @@ async function createNeuralMcpServer(deps) {
           conversationId = singleConvId;
         } else {
           logger6.warn("neural_send: failed to resolve single conv", { agentId: deps.agentId });
+          return {
+            content: [{ type: "text", text: "[neural_send] \u65E0\u6CD5\u89E3\u6790\u5355\u804A conversationId\uFF0C\u6D88\u606F\u672A\u9001\u8FBE\u3002\u8BF7\u5237\u65B0\u4F1A\u8BDD\u540E\u91CD\u8BD5\u3002" }],
+            isError: true
+          };
         }
       } else if (args.target_scope.startsWith("group:")) {
         const r = await deps.groupRegistry.resolveScope(args.target_scope);
@@ -21656,6 +22046,33 @@ async function createNeuralMcpServer(deps) {
         };
       }
       const toLabel = formatScopeLabel(resolvedKey, groupName);
+      const dedupKey = `${resolvedKey}::${trimmed}`;
+      const nowTs = Date.now();
+      if (recentNeuralSends.size > 256) {
+        for (const [k, ts] of recentNeuralSends) {
+          if (ts.every((t) => nowTs - t >= NEURAL_DEDUP_WINDOW_MS)) recentNeuralSends.delete(k);
+        }
+      }
+      const sendHistory = (recentNeuralSends.get(dedupKey) ?? []).filter((t) => nowTs - t < NEURAL_DEDUP_WINDOW_MS);
+      if (sendHistory.length >= NEURAL_DEDUP_MAX_REPEATS) {
+        sendHistory.push(nowTs);
+        recentNeuralSends.set(dedupKey, sendHistory);
+        logger6.warn("neural_send: identical message throttled (repetition guard)", {
+          agentId: deps.agentId,
+          fromScope: currentScopeKey,
+          toScope: resolvedKey,
+          repeatsInWindow: sendHistory.length,
+          windowMs: NEURAL_DEDUP_WINDOW_MS,
+          messageSample: trimmed.slice(0, 120)
+        });
+        return {
+          content: [{
+            type: "text",
+            text: `[neural_send] \u5DF2\u62E6\u622A\uFF1A\u4F60\u5728\u6700\u8FD1 ${Math.round(NEURAL_DEDUP_WINDOW_MS / 1e3)} \u79D2\u5185\u5411\u300C${toLabel}\u300D\u91CD\u590D\u53D1\u9001\u4E86\u76F8\u540C\u5185\u5BB9 ${sendHistory.length} \u6B21\uFF0C\u63A5\u6536\u65B9\u65E9\u5DF2\u6536\u5230\u3002\u505C\u6B62\u91CD\u53D1\u2014\u2014\u8BF7\u76F4\u63A5\u5728\u5F53\u524D scope \u4EA7\u51FA\u7ED3\u8BBA\u6216\u7ED3\u675F\u672C\u8F6E\uFF1B\u786E\u6709\u65B0\u4FE1\u606F\u65F6\u6539\u7528\u4E0D\u540C\u63AA\u8F9E\u8865\u5145\u3002`
+          }],
+          isError: true
+        };
+      }
       try {
         await deps.onSend({
           fromScopeKey: currentScopeKey,
@@ -21667,6 +22084,8 @@ async function createNeuralMcpServer(deps) {
           groupId,
           targetCwd
         });
+        sendHistory.push(nowTs);
+        recentNeuralSends.set(dedupKey, sendHistory);
         logger6.info("neural_send delivered", {
           agentId: deps.agentId,
           fromScope: currentScopeKey,
@@ -22088,10 +22507,11 @@ ${result.warnings.map((warning) => `- ${warning}`).join("\n")}
   );
   const listContacts = deps.agentRegistry ? sdk.tool(
     "list_contacts",
-    `\u67E5\u8BE2\u7CFB\u7EDF\u901A\u8BAF\u5F55\u2014\u2014\u5217\u51FA\u5F53\u524D AHChat \u5B9E\u4F8B\u91CC\u7684\u6240\u6709 Agent \u4E0E\u4EBA\u7C7B\u7528\u6237\u3002
-\u8FD4\u56DE\u7ED3\u6784\u662F\u4E00\u6BB5 Markdown\uFF1A\u6BCF\u4E00\u6761\u542B id / \u540D\u5B57 / \u89D2\u8272\u3002\u4F1A\u6807\u6CE8\u54EA\u4E00\u6761\u662F"\u4F60\u81EA\u5DF1"\uFF0C\u4EE5\u53CA\u4F60\u548C\u54EA\u4E9B Agent \u5DF2\u7ECF\u5171\u5728\u67D0\u4E2A\u7FA4\u91CC\u3002\u4EBA\u7C7B\u7528\u6237\u4F1A\u5E26 (\u4EBA\u7C7B) \u6807\u8BB0\u3002
+    `\u67E5\u8BE2\u7CFB\u7EDF\u901A\u8BAF\u5F55\u2014\u2014\u5217\u51FA\u5F53\u524D ALL-CAN \u5B9E\u4F8B\u91CC\u7684\u6240\u6709 Agent \u4E0E\u4EBA\u7C7B\u7528\u6237\u3002
+\u8FD4\u56DE\u7ED3\u6784\u662F\u4E00\u6BB5 Markdown\uFF1A\u6BCF\u4E00\u6761\u542B id / \u540D\u5B57 / \u89D2\u8272 / \u673A\u5668\u5F52\u5C5E\u3002\u4F1A\u6807\u6CE8\u54EA\u4E00\u6761\u662F"\u4F60\u81EA\u5DF1"\uFF0C\u4EE5\u53CA\u4F60\u548C\u54EA\u4E9B Agent \u5DF2\u7ECF\u5171\u5728\u67D0\u4E2A\u7FA4\u91CC\u3002\u4EBA\u7C7B\u7528\u6237\u4F1A\u5E26 (\u4EBA\u7C7B) \u6807\u8BB0\u3002
 \u901A\u5E38\u4F60\u5728\u7528\u6237\u63D0\u5230\u5177\u4F53\u540C\u4E8B\u59D3\u540D\u3001\u6216\u601D\u8003"\u8BE5\u62C9\u8C01\u8FDB\u7FA4\u534F\u4F5C"\u65F6\u8C03\u4E00\u6B21\uFF1B\u4E0D\u8981\u6BCF\u8F6E\u90FD\u67E5\u3002
 \u652F\u6301 filter\uFF08\u6309\u540D\u5B57\u6216\u89D2\u8272\u6A21\u7CCA\u641C\u7D22\uFF09\u548C limit\uFF08\u9650\u5236\u8FD4\u56DE\u6761\u6570\uFF09\u53C2\u6570\u3002
+Smith \u521B\u5EFA\u6216\u5207\u6362 Agent \u8FD0\u884C\u673A\u5668\u65F6\u53EF\u53C2\u8003"\u53EF\u7528\u673A\u5668"\u91CC\u7684 bridgeKey\uFF0C\u7ED9 create_agent / update_agent_profile \u4F20 machine_bridge_key\uFF1B\u7701\u7565\u5219\u4F7F\u7528\u5F53\u524D Bridge \u6216\u4FDD\u7559\u539F\u504F\u597D\u3002
 \u8981\u628A\u4EBA\u7C7B\u62C9\u8FDB\u7FA4\uFF1A\u5728 create_group / add_to_group \u7684 member_ids / agent_ids \u91CC\u5E26\u4E0A**\u8BF7\u6C42\u8005\u7684\u4EBA\u7C7B id**\uFF08\u5373\u5217\u8868\u91CC\u5E26"(\u4EBA\u7C7B)"\u6807\u8BB0\u7684\u90A3\u4E00\u6761\uFF1B\u591A\u7528\u6237\u6A21\u5F0F\u4E0B\u6BCF\u4E2A\u7528\u6237\u90FD\u6709\u81EA\u5DF1\u72EC\u7ACB\u7684 id\uFF0C\u4F8B\u5982 agt_usr_XXX\uFF1B\u8001\u7684\u5355\u7528\u6237\u6A21\u5F0F\u4E0B\u662F agt_usr_self\uFF09\u3002\u4E0D\u8981\u786C\u7F16\u7801 agt_usr_self\u2014\u2014\u4EE5 list_contacts \u5B9E\u9645\u8FD4\u56DE\u7684 id \u4E3A\u51C6\u3002`,
     {
       filter: external_exports.string().optional().describe("\u53EF\u9009\u3002\u6309\u540D\u5B57\u6216\u89D2\u8272\u6A21\u7CCA\u8FC7\u6EE4\uFF08\u4E0D\u533A\u5206\u5927\u5C0F\u5199\uFF09\u3002"),
@@ -22119,7 +22539,14 @@ ${result.warnings.map((warning) => `- ${warning}`).join("\n")}
       }
       const capped = args?.limit != null ? all.slice(0, args.limit) : all;
       const myGroups = deps.groupRegistry.getMyGroups(deps.agentId);
+      const machines = await fetchVisibleBridgeMachines(deps);
+      const machineByKey = new Map(machines.map((machine) => [machine.bridgeKey, machine]));
       const sharedGroupsOf = (otherId) => myGroups.filter((g) => g.members.includes(otherId)).map((g) => g.name);
+      const machineLabelForKey = (bridgeKey) => {
+        if (!bridgeKey) return "\u9ED8\u8BA4\u673A\u5668";
+        const machine = machineByKey.get(bridgeKey);
+        return machine ? `${formatBridgeMachineLabel(machine)}\uFF08${machineStatusText(machine)}\uFF0C${bridgeKey}\uFF09` : bridgeKey;
+      };
       const lines = [];
       let humanCount = 0;
       for (const a of capped) {
@@ -22127,22 +22554,35 @@ ${result.warnings.map((warning) => `- ${warning}`).join("\n")}
         if (isHuman) humanCount += 1;
         const kindMark = isHuman ? " (\u4EBA\u7C7B)" : "";
         const roleStr = a.role && a.role.length > 0 ? ` \u2014 ${a.role}` : "";
+        const machineMark = isHuman ? "" : ` [\u673A\u5668: ${machineLabelForKey(a.machineBridgeKey)}]`;
         if (a.id === deps.agentId) {
-          lines.push(`- ${a.name} (${a.id})${roleStr}${kindMark} (\u8FD9\u662F\u4F60\u81EA\u5DF1)`);
+          lines.push(`- ${a.name} (${a.id})${roleStr}${kindMark}${machineMark} (\u8FD9\u662F\u4F60\u81EA\u5DF1)`);
           continue;
         }
         const shared = isHuman ? [] : sharedGroupsOf(a.id);
         const sharedMark = shared.length > 0 ? ` (\u5DF2\u4E0E\u4F60\u5171\u7FA4: ${shared.join("\u3001")})` : "";
-        lines.push(`- ${a.name} (${a.id})${roleStr}${kindMark}${sharedMark}`);
+        lines.push(`- ${a.name} (${a.id})${roleStr}${kindMark}${machineMark}${sharedMark}`);
       }
       const total = all.length;
       const shown = capped.length;
-      const header = q ? `\u901A\u8BAF\u5F55\u641C\u7D22\u7ED3\u679C\uFF08\u5171 ${total} \u4F4D\uFF0C\u5176\u4E2D\u4EBA\u7C7B ${humanCount} \u4F4D\uFF0C\u5339\u914D "${args?.filter}" \u7684 ${shown} \u4F4D\uFF09\uFF1A` : args?.limit != null && shown < total ? `AHChat \u7CFB\u7EDF\u901A\u8BAF\u5F55\uFF08\u5171 ${total} \u4F4D\uFF0C\u5176\u4E2D\u4EBA\u7C7B ${humanCount} \u4F4D\uFF0C\u8FD4\u56DE\u524D ${shown} \u4F4D\uFF09\uFF1A` : `AHChat \u7CFB\u7EDF\u901A\u8BAF\u5F55\uFF08\u5171 ${total} \u4F4D\uFF0C\u5176\u4E2D\u4EBA\u7C7B ${humanCount} \u4F4D\uFF09\uFF1A`;
-      const text = shown === 0 ? q ? `\u672A\u627E\u5230\u4E0E "${args?.filter}" \u5339\u914D\u7684\u8054\u7CFB\u4EBA\u3002` : "\u5F53\u524D\u7CFB\u7EDF\u91CC\u8FD8\u6CA1\u6709\u4EFB\u4F55 Agent\u3002" : [header, "", ...lines].join("\n");
+      const header = q ? `\u901A\u8BAF\u5F55\u641C\u7D22\u7ED3\u679C\uFF08\u5171 ${total} \u4F4D\uFF0C\u5176\u4E2D\u4EBA\u7C7B ${humanCount} \u4F4D\uFF0C\u5339\u914D "${args?.filter}" \u7684 ${shown} \u4F4D\uFF09\uFF1A` : args?.limit != null && shown < total ? `ALL-CAN \u7CFB\u7EDF\u901A\u8BAF\u5F55\uFF08\u5171 ${total} \u4F4D\uFF0C\u5176\u4E2D\u4EBA\u7C7B ${humanCount} \u4F4D\uFF0C\u8FD4\u56DE\u524D ${shown} \u4F4D\uFF09\uFF1A` : `ALL-CAN \u7CFB\u7EDF\u901A\u8BAF\u5F55\uFF08\u5171 ${total} \u4F4D\uFF0C\u5176\u4E2D\u4EBA\u7C7B ${humanCount} \u4F4D\uFF09\uFF1A`;
+      const onlineMachines = machines.filter((machine) => machine.status === "online");
+      const offlineMachines = machines.filter((machine) => machine.status !== "online");
+      const machineSection = machines.length > 0 ? [
+        "\u5728\u7EBF\u673A\u5668\uFF08\u63A8\u8350\uFF1Bcreate_agent / update_agent_profile \u53EA\u80FD\u4F20\u8FD9\u4E9B machine_bridge_key\uFF1B\u7701\u7565\u5219\u4F7F\u7528\u5F53\u524D Bridge \u6216\u4FDD\u7559\u539F\u504F\u597D\uFF09\uFF1A",
+        ...onlineMachines.length > 0 ? onlineMachines.map(formatMachineOptionLine) : ["- \u5F53\u524D\u6CA1\u6709\u5728\u7EBF\u673A\u5668\uFF1B\u53EF\u7701\u7565 machine_bridge_key\uFF0C\u8BA9\u5F53\u524D Bridge \u515C\u5E95\u3002"],
+        ...offlineMachines.length > 0 ? [
+          "",
+          "\u79BB\u7EBF/\u4E0D\u53EF\u76F4\u63A5\u7528\u4E8E\u65B0\u5EFA\u7684\u673A\u5668\uFF08\u4E0D\u8981\u628A\u8FD9\u4E9B bridgeKey \u4F20\u7ED9 create_agent\uFF1B\u5426\u5219\u4EFB\u52A1\u4F1A Bridge offline\uFF09\uFF1A",
+          ...offlineMachines.map(formatMachineOptionLine)
+        ] : []
+      ].join("\n") : "\u53EF\u7528\u673A\u5668\uFF1A\u5F53\u524D Bridge\uFF08create_agent \u7701\u7565 machine_bridge_key \u5373\u4F7F\u7528\u5F53\u524D Bridge\uFF1Bupdate_agent_profile \u7701\u7565\u5373\u4FDD\u7559\u539F\u504F\u597D\uFF09\u3002";
+      const text = shown === 0 ? q ? `\u672A\u627E\u5230\u4E0E "${args?.filter}" \u5339\u914D\u7684\u8054\u7CFB\u4EBA\u3002` : "\u5F53\u524D\u7CFB\u7EDF\u91CC\u8FD8\u6CA1\u6709\u4EFB\u4F55 Agent\u3002" : [header, "", machineSection, "", ...lines].join("\n");
       logger6.info("list_contacts returned", {
         agentId: deps.agentId,
         count: all.length,
-        humanCount
+        humanCount,
+        machineCount: machines.length
       });
       return { content: [{ type: "text", text }] };
     },
@@ -22687,8 +23127,8 @@ ${result.warnings.map((warning) => `- ${warning}`).join("\n")}
     "fetch_logs",
     `\u62C9\u53D6\u7CFB\u7EDF\u65E5\u5FD7\uFF08\u6309\u65F6\u95F4\u7A97 + \u53EF\u9009 traceId / module / level \u8FC7\u6EE4\uFF09\u3002
 \u8BFB SKILL "log-analysis" \u540E\u624D\u7528\u8FD9\u4E2A\u5DE5\u5177\u3002\u4E00\u6B21\u8C03\u7528\u53EA\u80FD\u62C9\u4E00\u4E2A source\uFF08server \u6216 bridge\uFF09\uFF0C\u5168\u666F\u9700\u8981\u4E24\u6B21\u3002
-limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679C\u9876\u90E8\u5E26\u5206\u7EA7\u7EDF\u8BA1\uFF08ERROR/WARN/INFO \u5404\u591A\u5C11\u6761\uFF09\uFF0C\u6309\u65F6\u95F4\u5347\u5E8F\u6392\u5217\u3002\u6BCF\u884C\u5E26 file / lineNum\uFF0C\u5F15\u7528\u65E5\u5FD7\u65F6\u5FC5\u987B\u7CBE\u786E\u5199 [<file>:L<lineNum>]\u3002
-\u6CE8\u610F\uFF1A\u5982\u679C\u7ED3\u679C\u8FC7\u957F\u4F1A\u88AB\u622A\u65AD\uFF0Cheader \u4F1A\u6807\u6CE8"\u5DF2\u622A\u65AD"\u2014\u2014\u6B64\u65F6\u7F29\u5C0F\u65F6\u95F4\u7A97\u6216\u52A0 module/traceId \u8FC7\u6EE4\u518D\u67E5\u3002`,
+limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\uFF1B\u652F\u6301 offset \u5206\u9875\u3002\u8FD4\u56DE\u7ED3\u679C\u9876\u90E8\u5E26\u5206\u7EA7\u7EDF\u8BA1\uFF08ERROR/WARN/INFO \u5404\u591A\u5C11\u6761\uFF09\uFF0C\u6309\u65F6\u95F4\u5012\u5E8F\u6392\u5217\uFF0C\u6700\u65B0\u65E5\u5FD7\u5728\u524D\u3002\u6BCF\u884C\u5E26 file / lineNum\uFF0C\u5F15\u7528\u65E5\u5FD7\u65F6\u5FC5\u987B\u7CBE\u786E\u5199 [<file>:L<lineNum>]\u3002
+\u6CE8\u610F\uFF1A\u5982\u679C\u8FD8\u6709\u66F4\u591A\u7ED3\u679C\uFF0Cheader \u4F1A\u6807\u6CE8 nextOffset\uFF1B\u7EE7\u7EED\u67E5\u8BE2\u65F6\u5E26\u4E0A offset=nextOffset\u3002`,
     {
       source: external_exports.enum(["server", "bridge"]).describe('\u65E5\u5FD7\u6765\u6E90\uFF0C\u5FC5\u987B\u662F "server" \u6216 "bridge" \u4E4B\u4E00\u3002'),
       start_iso: external_exports.string().describe('\u8D77\u59CB\u65F6\u95F4\uFF0CISO 8601 \u6216\u76F8\u5BF9\u683C\u5F0F\uFF1A"now-5m" / "now-1h" / "now-24h"\u3002'),
@@ -22697,7 +23137,8 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
       trace_id: external_exports.string().optional().describe("\u8FC7\u6EE4\u7279\u5B9A traceId\uFF08\u7CBE\u786E\u5339\u914D\uFF09\u3002"),
       module: external_exports.string().optional().describe('\u8FC7\u6EE4 module \u524D\u7F00\uFF08\u5982 "ws.handler" / "agent.manager"\uFF09\u3002'),
       msg_contains: external_exports.string().optional().describe("msg \u5B50\u4E32\u8FC7\u6EE4\uFF08\u533A\u5206\u5927\u5C0F\u5199\uFF09\u3002"),
-      limit: external_exports.number().int().min(1).max(2e3).optional().describe("\u8FD4\u56DE\u6761\u6570\u4E0A\u9650\uFF0C\u9ED8\u8BA4 500\uFF0C\u6700\u5927 2000\u3002")
+      limit: external_exports.number().int().min(1).max(2e3).optional().describe("\u8FD4\u56DE\u6761\u6570\u4E0A\u9650\uFF0C\u9ED8\u8BA4 500\uFF0C\u6700\u5927 2000\u3002"),
+      offset: external_exports.number().int().min(0).optional().describe("\u5206\u9875\u504F\u79FB\u91CF\uFF1B\u9996\u6B21\u67E5\u8BE2\u4E0D\u4F20\uFF0C\u7EE7\u7EED\u67E5\u8BE2\u65F6\u4F20\u4E0A\u6B21\u8FD4\u56DE\u7684 nextOffset\u3002")
     },
     async (args) => {
       if (!deps.isSmith) {
@@ -22722,9 +23163,11 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
         traceId: args.trace_id,
         module: args.module,
         levelMin: args.level_min,
-        limit: args.limit
+        limit: args.limit,
+        offset: args.offset
       });
       const parsedLimit = typeof args.limit === "number" && Number.isFinite(args.limit) ? args.limit : 500;
+      const parsedOffset = typeof args.offset === "number" && Number.isFinite(args.offset) ? args.offset : 0;
       try {
         const url2 = `${deps.serverApiUrl.replace(/\/$/, "")}/api/admin/logs`;
         const body = {
@@ -22735,7 +23178,8 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
           traceId: args.trace_id,
           module: args.module,
           msgContains: args.msg_contains,
-          limit: Number.isFinite(parsedLimit) ? parsedLimit : 500
+          limit: Number.isFinite(parsedLimit) ? parsedLimit : 500,
+          offset: Number.isFinite(parsedOffset) ? parsedOffset : 0
         };
         const res = await fetch(url2, {
           method: "POST",
@@ -22758,7 +23202,9 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
           source,
           count: json2.entries.length,
           truncated: json2.truncated,
-          totalScanned: json2.totalScanned
+          totalScanned: json2.totalScanned,
+          totalMatched: json2.totalMatched,
+          nextOffset: json2.nextOffset
         });
         const lines = json2.entries.map((e) => {
           const dataStr = e.data ? ` data=${JSON.stringify(e.data).slice(0, 200)}` : "";
@@ -22771,9 +23217,10 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
         const infoCount = json2.entries.filter((e) => e.level === "INFO").length;
         const traceCount = json2.entries.filter((e) => e.level === "TRACE" || e.level === "DEBUG").length;
         const header = [
-          `[${source}] \u5171\u626B ${json2.totalScanned} \u884C\uFF0C\u547D\u4E2D ${json2.entries.length} \u6761`,
+          `[${source}] \u5171\u626B ${json2.totalScanned} \u884C\uFF0C\u5DF2\u8FD4\u56DE ${json2.entries.length} \u6761\uFF0C\u547D\u4E2D ${json2.totalMatched ?? json2.entries.length} \u6761`,
           `  ERROR/FATAL: ${errorCount} | WARN: ${warnCount} | INFO: ${infoCount} | TRACE/DEBUG: ${traceCount}`
-        ].join("\n") + (json2.truncated ? "\n\uFF08\u5DF2\u622A\u65AD\uFF0C\u8BF7\u7F29\u5C0F\u65F6\u95F4\u7A97\u6216\u52A0\u8FC7\u6EE4\u6761\u4EF6\u518D\u67E5\uFF09" : "");
+        ].join("\n") + (json2.nextOffset != null ? `
+nextOffset=${json2.nextOffset}\uFF08\u7EE7\u7EED\u67E5\u8BE2\u65F6\u4F20 offset=${json2.nextOffset}\uFF09` : "");
         const text = [header, "", ...lines].join("\n");
         return { content: [{ type: "text", text }] };
       } catch (e) {
@@ -22791,6 +23238,7 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
     `\u521B\u9020\u4E00\u4E2A\u65B0\u7684 Agent\u3002\u53EA\u6709\u4F60\uFF08Smith\uFF09\u80FD\u4F7F\u7528\u6B64\u5DE5\u5177\u3002
 \u65B0 Agent \u4F1A\u7ACB\u5373\u51FA\u73B0\u5728\u7CFB\u7EDF\u901A\u8BAF\u5F55\u4E2D\uFF0C\u62E5\u6709\u72EC\u7ACB\u7684 SDK runtime \u548C\u5DE5\u4F5C\u76EE\u5F55\u3002
 \u521B\u5EFA\u540E\u4F60\u53EF\u4EE5\u901A\u8FC7 create_group + add_to_group \u628A\u5B83\u62C9\u8FDB\u7FA4\u3002
+\u521B\u5EFA\u65F6\u53EF\u4EE5\u9009\u62E9\u521D\u59CB\u8FD0\u884C\u673A\u5668\uFF1A\u5148\u7528 list_contacts \u67E5\u770B"\u53EF\u7528\u673A\u5668"\uFF0C\u518D\u4F20 machine_bridge_key\u3002\u540E\u7EED\u53EF\u7528 update_agent_profile \u5207\u6362\uFF1B\u4E0D\u4F20\u5219\u4F7F\u7528\u5F53\u524D Bridge\u3002
 
 **\u80FD\u529B\u6863\u4F4D\u9009\u62E9\u6307\u5357\uFF1A**
 - **smart\uFF08\u65D7\u8230\uFF09**\uFF1A\u7F16\u6392\u8005\u3001\u590D\u6742\u63A8\u7406\u3001\u6700\u7EC8\u7EFC\u5408\u3001\u9AD8\u96BE\u5EA6\u89D2\u8272\u3002\u4F7F\u7528\u6700\u5F3A\u6A21\u578B\u3002
@@ -22822,6 +23270,9 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
       ),
       working_directory: external_exports.string().optional().describe(
         "\u53EF\u9009\u3002\u8BE5 Agent \u7684\u5DE5\u4F5C\u76EE\u5F55\u7EDD\u5BF9\u8DEF\u5F84\u3002\u4E0D\u4F20\u5219\u7531\u7CFB\u7EDF\u81EA\u52A8\u5206\u914D\u3002"
+      ),
+      machine_bridge_key: external_exports.string().optional().describe(
+        '\u53EF\u9009\u3002\u8FD0\u884C\u673A\u5668 bridgeKey\uFF0C\u6765\u81EA list_contacts \u7684"\u53EF\u7528\u673A\u5668"\u3002\u4E0D\u4F20\u5219\u4F7F\u7528\u5F53\u524D Bridge\uFF1B\u540E\u7EED\u53EF\u7528 update_agent_profile \u5207\u6362\u3002'
       )
     },
     async (args) => {
@@ -22851,16 +23302,33 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
       const avatar = args.avatar && String(args.avatar).trim() || "";
       const initialInstruction = args.initial_instruction && String(args.initial_instruction).trim() || "";
       const workingDirectory = args.working_directory && String(args.working_directory).trim() || "";
+      const machineBridgeKey = args.machine_bridge_key && String(args.machine_bridge_key).trim() || "";
+      const machineValidation = await validateOnlineMachineBridgeKey("create_agent", machineBridgeKey, deps);
+      if (!machineValidation.ok) {
+        logger6.warn("create_agent: rejected offline or unknown machine_bridge_key", {
+          agentId: deps.agentId,
+          scope: currentScopeKey,
+          machineBridgeKey
+        });
+        return {
+          content: [{ type: "text", text: machineValidation.message }],
+          isError: true
+        };
+      }
       let agentConfig;
       if (deps.bridgeToken && deps.serverApiUrl) {
         try {
-          const tierUrl = `${deps.serverApiUrl.replace(/\/$/, "")}/api/onboarding/tiers?bridge_token=${encodeURIComponent(deps.bridgeToken)}`;
-          const tierRes = await fetch(tierUrl);
+          const tierUrl = `${deps.serverApiUrl.replace(/\/$/, "")}/api/onboarding/tiers`;
+          const tierRes = await fetch(tierUrl, { headers: bridgeAuthHeaders(deps.bridgeToken) });
           if (tierRes.ok) {
             const tiers = await tierRes.json();
             const self = deps.agentRegistry?.getById(deps.agentId);
-            const preferredSubscriptionId = parseAgentConfig(self?.config).subscriptionId;
-            const tierConfig = tiers.find((t) => t.tier === tier && t.subscriptionId === preferredSubscriptionId) ?? tiers.find((t) => t.tier === tier);
+            const preferredSubscriptionId = parseAgentConfig(self?.config).subscriptionId ?? PRIMARY_COMPANY_SUBSCRIPTION_ID;
+            const resolvedPreferredSubscriptionId = await resolveTierSubscriptionPreference(
+              preferredSubscriptionId,
+              deps
+            );
+            const tierConfig = tiers.find((t) => t.tier === tier && t.subscriptionId === resolvedPreferredSubscriptionId) ?? tiers.find((t) => t.tier === tier);
             if (tierConfig) {
               agentConfig = JSON.stringify({
                 capabilityTier: tier,
@@ -22884,6 +23352,9 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
       if (workingDirectory) {
         body.workingDirectory = workingDirectory;
       }
+      if (machineBridgeKey) {
+        body.machineBridgeKey = machineBridgeKey;
+      }
       logger6.info("create_agent tool called", {
         agentId: deps.agentId,
         requestedBy: deps.agentId,
@@ -22894,12 +23365,13 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
         avatar: avatar || "(default)",
         hasConfig: !!agentConfig,
         hasInitialInstruction: !!initialInstruction,
-        initialInstructionLen: initialInstruction.length
+        initialInstructionLen: initialInstruction.length,
+        machineBridgeKey: machineBridgeKey || "(current-bridge)"
       });
       try {
         const res = await fetch(`${deps.serverApiUrl.replace(/\/$/, "")}/api/agents`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: { "Content-Type": "application/json", ...bridgeAuthHeaders(deps.bridgeToken ?? null) },
           body: JSON.stringify(body)
         });
         if (!res.ok) {
@@ -22914,6 +23386,7 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
           };
         }
         const agent = await res.json();
+        const resolvedMachineBridgeKey = agent.machineBridgeKey ?? machineBridgeKey;
         logger6.info("create_agent: created", {
           requestedBy: deps.agentId,
           scope: currentScopeKey,
@@ -22921,7 +23394,8 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
           name: agent.name,
           tier,
           hasInitialInstruction: !!initialInstruction,
-          initialInstructionLen: initialInstruction.length
+          initialInstructionLen: initialInstruction.length,
+          machineBridgeKey: resolvedMachineBridgeKey || "(current-bridge)"
         });
         if (initialInstruction && deps.onAgentCreatedInitInstruction) {
           try {
@@ -22944,7 +23418,8 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
             });
           }
         }
-        const reply = initialInstruction ? `[create_agent] \u5DF2\u521B\u5EFA Agent\u300C${agent.name}\u300D(id: ${agent.id})\uFF0C\u6863\u4F4D\uFF1A${tier}\u3002\u5DF2\u4E0B\u53D1\u521D\u59CB\u6307\u4EE4\uFF08${initialInstruction.length} \u5B57\uFF09\uFF0C\u5B83\u5C06\u81EA\u884C\u51B3\u5B9A\u662F\u5426\u5411\u7528\u6237\u5F00\u53E3\u3002` : `[create_agent] \u5DF2\u521B\u5EFA Agent\u300C${agent.name}\u300D(id: ${agent.id})\uFF0C\u6863\u4F4D\uFF1A${tier}\u3002\u5B83\u5DF2\u5728\u901A\u8BAF\u5F55\u4E2D\u3002\u4F60\u53EF\u4EE5\u7528 create_group / add_to_group \u5C06\u5B83\u62C9\u5165\u7FA4\u804A\u3002`;
+        const machineText = resolvedMachineBridgeKey ? `\uFF0C\u8FD0\u884C\u673A\u5668\uFF1A${resolvedMachineBridgeKey}` : "";
+        const reply = initialInstruction ? `[create_agent] \u5DF2\u521B\u5EFA Agent\u300C${agent.name}\u300D(id: ${agent.id})\uFF0C\u6863\u4F4D\uFF1A${tier}${machineText}\u3002\u5DF2\u4E0B\u53D1\u521D\u59CB\u6307\u4EE4\uFF08${initialInstruction.length} \u5B57\uFF09\uFF0C\u5B83\u5C06\u81EA\u884C\u51B3\u5B9A\u662F\u5426\u5411\u7528\u6237\u5F00\u53E3\u3002` : `[create_agent] \u5DF2\u521B\u5EFA Agent\u300C${agent.name}\u300D(id: ${agent.id})\uFF0C\u6863\u4F4D\uFF1A${tier}${machineText}\u3002\u5B83\u5DF2\u5728\u901A\u8BAF\u5F55\u4E2D\u3002\u4F60\u53EF\u4EE5\u7528 create_group / add_to_group \u5C06\u5B83\u62C9\u5165\u7FA4\u804A\u3002`;
         return {
           content: [{ type: "text", text: reply }]
         };
@@ -22960,11 +23435,12 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
   ) : null;
   const updateAgentTool = deps.isSmith && deps.serverApiUrl ? sdk.tool(
     "update_agent_profile",
-    `\u66F4\u65B0\u5DF2\u6709 Agent \u7684\u6863\u6848\uFF08\u540D\u5B57\u3001\u89D2\u8272\u63CF\u8FF0\u3001\u5934\u50CF\u3001system prompt \u6216\u80FD\u529B\u6863\u4F4D\uFF09\u3002
+    `\u66F4\u65B0\u5DF2\u6709 Agent \u7684\u6863\u6848\uFF08\u540D\u5B57\u3001\u89D2\u8272\u63CF\u8FF0\u3001\u5934\u50CF\u3001system prompt\u3001\u80FD\u529B\u6863\u4F4D\u6216\u8FD0\u884C\u673A\u5668\uFF09\u3002
 \u53EA\u6709\u4F60\uFF08Smith\uFF09\u80FD\u8C03\u7528\u6B64\u5DE5\u5177\u3002\u8C03\u7528\u524D\u5148\u7528 list_contacts() \u786E\u8BA4\u76EE\u6807 Agent \u7684 id\u3002
 \u53EF\u4EE5\u53EA\u66F4\u65B0\u5176\u4E2D\u4E00\u9879\uFF08\u5982\u53EA\u6539\u5934\u50CF\u6216\u53EA\u6539\u6863\u4F4D\uFF09\uFF0C\u4E5F\u53EF\u4EE5\u4E00\u6B21\u66F4\u65B0\u591A\u9879\u3002
 **\u6CE8\u610F\u4E8B\u9879\uFF1A**
 - \u4FEE\u6539 system_prompt \u6216\u6863\u4F4D\u540E\uFF0CAgent \u7684 SDK session \u4E0D\u4F1A\u81EA\u52A8\u91CD\u5EFA\u2014\u2014\u4E0B\u6B21 turn \u4F1A\u81EA\u7136\u4F7F\u7528\u65B0\u8BBE\u7F6E
+- \u4FEE\u6539 machine_bridge_key \u540E\uFF0C\u4E0B\u4E00\u4E2A\u4EFB\u52A1\u4F1A\u8DEF\u7531\u5230\u65B0\u7684\u8FD0\u884C\u673A\u5668\uFF1B\u4F20 auto \u6216\u7A7A\u5B57\u7B26\u4E32\u53EF\u6E05\u9664\u673A\u5668\u504F\u597D
 - \u4E0D\u8981\u6539 human \u7C7B\u578B Agent\uFF08id \u4E3A agt_usr_self \u7B49\uFF09\u7684 role/system_prompt/tier\uFF0C\u53EA\u6539 name/avatar
 - \u6539\u540D\u540E\u8BE5 Agent \u5728\u6240\u6709\u7FA4\u91CC\u7684\u663E\u793A\u540D\u4F1A\u540C\u6B65\u66F4\u65B0`,
     {
@@ -22975,6 +23451,9 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
       tier: external_exports.enum(["smart", "balanced", "fast"]).optional().describe("\u80FD\u529B\u6863\u4F4D\u3002\u4F20\u6B64\u53C2\u6570\u4F1A\u66F4\u65B0\u8BE5 Agent \u4F7F\u7528\u7684\u6A21\u578B\u3002"),
       avatar: external_exports.string().optional().describe(
         "\u5934\u50CF key\uFF08\u5982 avatar_dev / avatar_pm / avatar_human_man \u7B49\uFF09\u3002"
+      ),
+      machine_bridge_key: external_exports.string().optional().describe(
+        '\u53EF\u9009\u3002\u65B0\u7684\u8FD0\u884C\u673A\u5668 bridgeKey\uFF0C\u6765\u81EA list_contacts \u7684"\u53EF\u7528\u673A\u5668"\u3002\u7701\u7565\u8868\u793A\u4E0D\u6539\uFF1B\u4F20 auto \u6216\u7A7A\u5B57\u7B26\u4E32\u6E05\u9664\u673A\u5668\u504F\u597D\u3002'
       )
     },
     async (args) => {
@@ -22992,9 +23471,12 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
         };
       }
       const base = deps.serverApiUrl.replace(/\/$/, "");
+      const authHeaders = bridgeAuthHeaders(deps.bridgeToken ?? null);
       let existing = null;
       try {
-        const getRes = await fetch(`${base}/api/agents/${encodeURIComponent(agentId)}`);
+        const getRes = await fetch(`${base}/api/agents/${encodeURIComponent(agentId)}`, {
+          headers: authHeaders
+        });
         if (getRes.ok) {
           existing = await getRes.json();
         }
@@ -23006,16 +23488,39 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
           isError: true
         };
       }
+      const requestedMachineBridgeKey = args.machine_bridge_key !== void 0 ? String(args.machine_bridge_key).trim() : void 0;
+      if (requestedMachineBridgeKey && requestedMachineBridgeKey !== "auto") {
+        const machineValidation = await validateOnlineMachineBridgeKey(
+          "update_agent_profile",
+          requestedMachineBridgeKey,
+          deps
+        );
+        if (!machineValidation.ok) {
+          logger6.warn("update_agent_profile: rejected offline or unknown machine_bridge_key", {
+            agentId: deps.agentId,
+            targetAgentId: agentId,
+            machineBridgeKey: requestedMachineBridgeKey
+          });
+          return {
+            content: [{ type: "text", text: machineValidation.message }],
+            isError: true
+          };
+        }
+      }
       let agentConfig;
       const tier = (args.tier ?? "").trim();
       if (tier && deps.bridgeToken) {
         try {
-          const tierUrl = `${base}/api/onboarding/tiers?bridge_token=${encodeURIComponent(deps.bridgeToken)}`;
-          const tierRes = await fetch(tierUrl);
+          const tierUrl = `${base}/api/onboarding/tiers`;
+          const tierRes = await fetch(tierUrl, { headers: bridgeAuthHeaders(deps.bridgeToken) });
           if (tierRes.ok) {
             const tiers = await tierRes.json();
-            const preferredSubscriptionId = parseAgentConfig(existing.config).subscriptionId;
-            const tierConfig = tiers.find((t) => t.tier === tier && t.subscriptionId === preferredSubscriptionId) ?? tiers.find((t) => t.tier === tier);
+            const preferredSubscriptionId = parseAgentConfig(existing.config).subscriptionId ?? PRIMARY_COMPANY_SUBSCRIPTION_ID;
+            const resolvedPreferredSubscriptionId = await resolveTierSubscriptionPreference(
+              preferredSubscriptionId,
+              deps
+            );
+            const tierConfig = tiers.find((t) => t.tier === tier && t.subscriptionId === resolvedPreferredSubscriptionId) ?? tiers.find((t) => t.tier === tier);
             if (tierConfig) {
               agentConfig = JSON.stringify({
                 capabilityTier: tier,
@@ -23035,9 +23540,13 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
       if (args.system_prompt !== void 0) patchBody.systemPrompt = String(args.system_prompt);
       if (args.avatar !== void 0) patchBody.avatar = String(args.avatar);
       if (agentConfig) patchBody.config = agentConfig;
+      if (args.machine_bridge_key !== void 0) {
+        const nextMachineBridgeKey = requestedMachineBridgeKey ?? "";
+        patchBody.machineBridgeKey = nextMachineBridgeKey === "" || nextMachineBridgeKey === "auto" ? null : nextMachineBridgeKey;
+      }
       if (Object.keys(patchBody).length === 0) {
         return {
-          content: [{ type: "text", text: "[update_agent_profile] \u81F3\u5C11\u9700\u8981\u63D0\u4F9B\u4E00\u4E2A\u8981\u66F4\u65B0\u7684\u5B57\u6BB5\uFF08name / role / system_prompt / tier / avatar\uFF09\u3002" }],
+          content: [{ type: "text", text: "[update_agent_profile] \u81F3\u5C11\u9700\u8981\u63D0\u4F9B\u4E00\u4E2A\u8981\u66F4\u65B0\u7684\u5B57\u6BB5\uFF08name / role / system_prompt / tier / avatar / machine_bridge_key\uFF09\u3002" }],
           isError: true
         };
       }
@@ -23050,7 +23559,7 @@ limit \u9ED8\u8BA4 500\uFF0C\u786C\u4E0A\u9650 2000\u3002\u8FD4\u56DE\u7ED3\u679
       try {
         const res = await fetch(`${base}/api/agents/${encodeURIComponent(agentId)}`, {
           method: "PUT",
-          headers: { "Content-Type": "application/json" },
+          headers: { "Content-Type": "application/json", ...authHeaders },
           body: JSON.stringify(patchBody)
         });
         if (!res.ok) {
@@ -23645,7 +24154,27 @@ var GroupDispatchMemoryStore = class {
   }
 };
 
+// src/modelInputSanitizer.ts
+var DATA_URL_BASE64_RE = /\bdata:([a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+);base64,([A-Za-z0-9+/=\r\n]{128,})/g;
+var LARGE_BASE64_RE = /(?<![A-Za-z0-9+/=])([A-Za-z0-9+/]{4096,}={0,2})(?![A-Za-z0-9+/=])/g;
+function approxBase64Bytes(value) {
+  const compact = value.replace(/\s+/g, "");
+  if (compact.length === 0) return 0;
+  const padding = compact.endsWith("==") ? 2 : compact.endsWith("=") ? 1 : 0;
+  return Math.max(0, Math.floor(compact.length * 3 / 4) - padding);
+}
+function sanitizeModelText(input) {
+  if (!input) return input;
+  return input.replace(DATA_URL_BASE64_RE, (_match, mimeType, data) => {
+    return `[inline ${mimeType} base64 data omitted: approx ${approxBase64Bytes(data)} bytes]`;
+  }).replace(LARGE_BASE64_RE, (match) => {
+    return `[large base64-like payload omitted: ${match.length} chars]`;
+  });
+}
+
 // src/groupInboxPromptBuilder.ts
+var MAX_SYSTEM_NOTE_COUNT = 8;
+var MAX_SYSTEM_NOTE_LEN = 1e3;
 function formatHHMM(epochMs) {
   const d = new Date(epochMs);
   const hh = String(d.getHours()).padStart(2, "0");
@@ -23656,10 +24185,41 @@ function truncate(text, maxLen) {
   if (text.length <= maxLen) return text;
   return `${text.slice(0, maxLen)}\u2026`;
 }
+function formatIsoHHMM(iso) {
+  const epochMs = Date.parse(iso);
+  if (!Number.isFinite(epochMs)) return "";
+  return formatHHMM(epochMs);
+}
+function collectSystemNotes(entries) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    for (const msg of entry.context) {
+      if (msg.role !== "system") continue;
+      byId.set(msg.id, {
+        id: msg.id,
+        time: formatIsoHHMM(msg.createdAt),
+        content: truncate(sanitizeModelText(msg.content), MAX_SYSTEM_NOTE_LEN)
+      });
+    }
+  }
+  return [...byId.values()].slice(-MAX_SYSTEM_NOTE_COUNT);
+}
+function appendSystemNotes(lines, entries) {
+  const notes = collectSystemNotes(entries);
+  if (notes.length === 0) return;
+  lines.push(`--- \u7FA4\u5185\u7CFB\u7EDF\u8BB0\u5F55\uFF08${notes.length} \u6761\uFF0C\u4F9B\u4E0A\u4E0B\u6587\uFF1B\u975E\u666E\u901A\u804A\u5929\u5386\u53F2\uFF09---`);
+  lines.push("\u8FD9\u4E9B\u8BB0\u5F55\u53EA\u7528\u4E8E\u7406\u89E3\u7528\u6237\u5DF2\u4F5C\u51FA\u7684 AskUserQuestion/\u7CFB\u7EDF\u51B3\u7B56\uFF1B\u4E0D\u8981\u76F4\u63A5\u56DE\u590D\u7CFB\u7EDF\u8BB0\u5F55\u672C\u8EAB\u3002");
+  for (const note of notes) {
+    const prefix = note.time ? `[${note.time}] system:` : "system:";
+    lines.push(`${prefix} ${note.content}`);
+  }
+  lines.push("--- \u7FA4\u5185\u7CFB\u7EDF\u8BB0\u5F55 end ---");
+  lines.push("");
+}
 function appendBoardContext(lines, latest) {
   if (latest.boardMeta?.vision) {
     lines.push("--- project vision ---");
-    lines.push(latest.boardMeta.vision);
+    lines.push(sanitizeModelText(latest.boardMeta.vision));
     lines.push("--- end vision ---");
     lines.push("");
   }
@@ -23681,7 +24241,7 @@ function appendBoardContext(lines, latest) {
     lines.push("--- known issues (open) ---");
     lines.push("These issues have been recorded. Be aware of them and avoid repeating the same mistakes.");
     for (const iss of latest.boardIssues) {
-      lines.push(`  - [${iss.category}] ${iss.title}${iss.description ? `: ${iss.description}` : ""}`);
+      lines.push(`  - [${iss.category}] ${sanitizeModelText(iss.title)}${iss.description ? `: ${sanitizeModelText(iss.description)}` : ""}`);
     }
     lines.push("--- end issues ---");
     lines.push("");
@@ -23691,7 +24251,7 @@ function appendBoardContext(lines, latest) {
   if (latest.boardItems && latest.boardItems.length > 0) {
     lines.push("Current items:");
     for (const bi of latest.boardItems) {
-      const parts = [`[${bi.status}] ${bi.content}`];
+      const parts = [`[${bi.status}] ${sanitizeModelText(bi.content)}`];
       if (bi.priority !== "medium") parts.push(`priority:${bi.priority}`);
       if (bi.assignedAgentId) parts.push(`assigned:${bi.assignedAgentId}`);
       if (bi.deadline) parts.push(`deadline:${bi.deadline.slice(0, 10)}`);
@@ -23704,6 +24264,14 @@ function appendBoardContext(lines, latest) {
   lines.push("--- end board ---");
   lines.push("");
 }
+function appendAttachmentLines(lines, attachments, sourceLabel, indent = "") {
+  if (!attachments || attachments.length === 0) return;
+  for (const attachment of attachments) {
+    for (const line of formatAttachmentForModel(attachment, { sourceLabel }).split("\n")) {
+      lines.push(`${indent}${line}`);
+    }
+  }
+}
 function buildGroupInboxPrompt(entries, opts = {}) {
   if (entries.length === 0) {
     return "";
@@ -23724,6 +24292,7 @@ function buildGroupInboxPrompt(entries, opts = {}) {
     );
   }
   lines.push("");
+  appendSystemNotes(lines, entries);
   lines.push(`--- \u672A\u8BFB\u7FA4\u6D88\u606F\uFF08${entries.length} \u6761\uFF0C\u6309\u65F6\u95F4\u987A\u5E8F\uFF09---`);
   for (const e of entries) {
     const ts = formatHHMM(e.arrivedAt);
@@ -23731,12 +24300,14 @@ function buildGroupInboxPrompt(entries, opts = {}) {
     if (e.replyToMessage) {
       const rts = e.replyToMessage.senderAgentName ?? (e.replyToMessage.role === "user" ? "user" : `agent:${e.replyToMessage.senderAgentId ?? "unknown"}`);
       lines.push(
-        `[${ts}] ${e.senderName}${mentionTag} \u56DE\u590D [${rts}: "${truncate(e.replyToMessage.content, 60)}"]:`
+        `[${ts}] ${e.senderName}${mentionTag} \u56DE\u590D [${rts}: "${truncate(sanitizeModelText(e.replyToMessage.content), 60)}"]:`
       );
-      lines.push(`  ${e.content}`);
+      lines.push(`  ${sanitizeModelText(e.content)}`);
+      appendAttachmentLines(lines, e.replyToMessage.attachments, "Replied message resource", "  ");
     } else {
-      lines.push(`[${ts}] ${e.senderName}${mentionTag}: ${e.content}`);
+      lines.push(`[${ts}] ${e.senderName}${mentionTag}: ${sanitizeModelText(e.content)}`);
     }
+    appendAttachmentLines(lines, e.attachments, "Unread group message resource", "  ");
   }
   lines.push("--- \u672A\u8BFB\u7FA4\u6D88\u606F end ---");
   lines.push("");
@@ -23759,6 +24330,9 @@ function isContextOverflowText(text) {
 function isAuthFailureText(text, sdkError) {
   return sdkError === "authentication_failed" || /not logged in|please run \/login/i.test(text);
 }
+function isProviderApiErrorText(text) {
+  return /^API Error:\s*\d+/i.test(text.trim());
+}
 function decodeJsonStringFragment(raw) {
   let out = "";
   for (let i = 0; i < raw.length; i++) {
@@ -24067,6 +24641,31 @@ function extractUsage(message) {
   }
   return result;
 }
+function hasUsageValue(usage) {
+  return typeof usage.tokenCount === "number" || typeof usage.inputTokens === "number" || typeof usage.cacheReadTokens === "number" || typeof usage.cacheCreationTokens === "number" || typeof usage.costUsd === "number";
+}
+function emitUsageReported(proc, emit, base, usage, messageId) {
+  if (!hasUsageValue(usage)) return;
+  const groupId = proc.currentTask?.groupId;
+  const scopeKeyValue = proc.scope.kind === "group" ? `group:${proc.scope.groupId}` : "single";
+  emit({
+    type: "agent:usage_reported",
+    payload: {
+      ...wireBase(base),
+      ...messageId ? { messageId } : {},
+      ...groupId ? { groupId } : {},
+      scopeKey: scopeKeyValue,
+      model: usage.model,
+      usage: {
+        inputTokens: usage.inputTokens,
+        outputTokens: usage.tokenCount,
+        cacheReadTokens: usage.cacheReadTokens,
+        cacheCreationTokens: usage.cacheCreationTokens
+      },
+      providerCostUsd: usage.costUsd
+    }
+  });
+}
 function isGroupTask(proc) {
   return proc.currentTask?.groupId != null;
 }
@@ -24257,7 +24856,7 @@ function flushTextSegmentOnBlockStop(proc, emit, base) {
   }
   proc.segmentBuffer = "";
 }
-function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
+function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted, onProviderApiError) {
   const emit = rawEmit;
   proc.lastSdkEventAt = Date.now();
   switch (message.type) {
@@ -24328,7 +24927,7 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
             proc.currentToolName = block.name ?? "unknown";
             proc.accumulatedToolInput = "";
             const toolName = block.name ?? "unknown";
-            if (toolName !== "ExitPlanMode" && toolName !== "AskUserQuestion") {
+            if (toolName !== "ExitPlanMode" && !isAskUserQuestionToolName(toolName)) {
               emit({
                 type: "agent:tool_use",
                 payload: {
@@ -24492,9 +25091,9 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
                 });
               }
             }
-            if (proc.currentToolName === "AskUserQuestion") {
+            if (isAskUserQuestionToolName(proc.currentToolName)) {
               const last = proc.contentBlocks[proc.contentBlocks.length - 1];
-              if (last?.type === "tool_use" && last.toolName === "AskUserQuestion") {
+              if (last?.type === "tool_use" && isAskUserQuestionToolName(last.toolName)) {
                 proc.contentBlocks.pop();
               }
             }
@@ -24546,7 +25145,7 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
             const toolName = proc.currentToolName ?? "unknown";
             const isError = toolName === "ExitPlanMode" ? false : !!b.is_error;
             const output = typeof b.content === "string" ? b.content : JSON.stringify(b.content);
-            if (toolName === "AskUserQuestion") {
+            if (isAskUserQuestionToolName(toolName)) {
               proc.currentToolName = null;
               continue;
             }
@@ -24630,6 +25229,7 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
         const watermarkUsage = proc.peakContextUsage ?? usage;
         if (trimmed === NO_REPLY_TOKEN) {
           checkInputTokenWatermark(proc, watermarkUsage, base.traceId);
+          emitUsageReported(proc, emit, base, usage);
           if (groupMode && proc.contentBlocks.length > 0) {
             emitGroupSegment(
               proc,
@@ -24669,6 +25269,13 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
         }
         if (groupMode) {
           checkInputTokenWatermark(proc, watermarkUsage, base.traceId);
+          emitUsageReported(proc, emit, base, usage);
+          if (proc.segmentBuffer.trim().length > 0) {
+            flushTextSegmentOnBlockStop(proc, emit, base);
+          } else if (proc.segmentCount === 0 && proc.accumulatedText.trim().length > 0) {
+            proc.segmentBuffer = proc.accumulatedText;
+            flushTextSegmentOnBlockStop(proc, emit, base);
+          }
           if (proc.contentBlocks.length > 0) {
             logger8.info("Group turn trailing audit segment", {
               agentId: proc.agentId,
@@ -24703,6 +25310,7 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
         }
         if (proc.accumulatedText.length === 0 && proc.contentBlocks.length === 0) {
           cleanupPlanMode(proc, emit, base, "error");
+          emitUsageReported(proc, emit, base, usage);
           logger8.warn("SDK success produced empty assistant output; emitting agent:error", {
             agentId: proc.agentId,
             ackId: base.replyMessageId,
@@ -24730,6 +25338,7 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
         checkInputTokenWatermark(proc, watermarkUsage, base.traceId);
         cleanupPlanMode(proc, emit, base, "success");
         carrierMessageId = createMessageId();
+        emitUsageReported(proc, emit, base, usage, carrierMessageId);
         logger8.info("Agent task done, emitting agent:done", {
           agentId: proc.agentId,
           ackId: base.replyMessageId,
@@ -24750,6 +25359,11 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
               thinkingDuration: Date.now() - proc.currentTaskStartedAt,
               toolCallCount: proc.contentBlocks.filter((b) => b.type === "tool_use").length,
               tokenCount: usage.tokenCount,
+              outputTokens: usage.tokenCount,
+              inputTokens: usage.inputTokens,
+              cacheReadTokens: usage.cacheReadTokens,
+              cacheCreationTokens: usage.cacheCreationTokens,
+              costUsd: usage.costUsd,
               model: usage.model
             }
           }
@@ -24799,6 +25413,9 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
         if (isAuthFail) {
           sessionStore.delete(proc.agentId, proc.scope);
         }
+        if (isProviderApiErrorText(errorText)) {
+          onProviderApiError?.(errorText);
+        }
         logger8.warn("SDK synthetic api error assistant detected, emitting agent:error", {
           agentId: proc.agentId,
           scope: proc.scope.kind === "single" ? "single" : proc.scope.groupId,
@@ -24849,6 +25466,33 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
             proc.segmentBuffer = "";
             break;
           }
+          if (isProviderApiErrorText(text)) {
+            const base = getTaskBase(proc);
+            logger8.warn("SDK provider API error assistant detected without api-error flag, emitting agent:error", {
+              agentId: proc.agentId,
+              scope: proc.scope.kind === "single" ? "single" : proc.scope.groupId,
+              sdkError: am.error,
+              errorText: text.slice(0, 200),
+              traceId: base?.traceId,
+              hasCurrentTask: base != null
+            });
+            if (base) {
+              onProviderApiError?.(text);
+              emit({
+                type: "agent:error",
+                payload: {
+                  ...wireBase(base),
+                  error: text
+                }
+              });
+              proc.apiErrorEmitted = true;
+            }
+            proc.contentBlocks = [];
+            proc.accumulatedText = "";
+            proc.accumulatedThinking = "";
+            proc.segmentBuffer = "";
+            break;
+          }
           if (isContextOverflowText(text)) {
             const base = getTaskBase(proc);
             logger8.warn("SDK reported context overflow; auto-compact already failed inside SDK", {
@@ -24886,6 +25530,9 @@ function mapSDKMessage(proc, message, rawEmit, sessionStore, onCompleted) {
             break;
           }
           proc.accumulatedText = text;
+          if (isGroupTask(proc)) {
+            proc.segmentBuffer = text;
+          }
           logger8.info("Captured non-streamed assistant message", {
             agentId: proc.agentId,
             scope: proc.scope.kind === "single" ? "single" : proc.scope.groupId,
@@ -25075,6 +25722,12 @@ var wsMetrics = new WsMetrics();
 
 // src/agentManager.ts
 var logger11 = createModuleLogger("agent.manager");
+function missingSubscriptionMessage(subscriptionId) {
+  if (isPrimaryCompanySubscriptionId(subscriptionId)) {
+    return "ALL-CAN \u9ED8\u8BA4\u6A21\u578B\u6682\u65F6\u4E0D\u53EF\u7528\uFF1A\u8FD9\u53F0\u673A\u5668\u8FD8\u6CA1\u6709\u540C\u6B65\u5230\u7BA1\u7406\u5458\u542F\u7528\u7684\u9ED8\u8BA4\u6A21\u578B\uFF0C\u8BF7\u66F4\u65B0\u5E76\u91CD\u542F Bridge \u540E\u91CD\u8BD5\u3002";
+  }
+  return `\u8BA2\u9605\u6E90\u4E0D\u53EF\u7528\uFF1A${subscriptionId}\u3002\u8BF7\u91CD\u65B0\u9009\u62E9\u6A21\u578B\u6765\u6E90\uFF0C\u6216\u91CD\u542F Bridge \u540E\u91CD\u8BD5\u3002`;
+}
 var NODE_USER_UID = 1e3;
 var POST_MERGE_CONTINUATION_ROUTE_MS = 15e3;
 var DOCUMENT_READING_RULES = `DOCUMENT READING:
@@ -25097,6 +25750,21 @@ function isRunningAsRoot() {
     return false;
   }
 }
+function shouldUseAuthTokenForApiBaseUrl(apiBaseUrl) {
+  if (!apiBaseUrl) return false;
+  return /dashscope\.aliyuncs\.com\/api\/v2\/apps\/claude-code-proxy/i.test(apiBaseUrl) || /coding\.dashscope\.aliyuncs\.com\/apps\/anthropic/i.test(apiBaseUrl);
+}
+function buildAnthropicCredentialEnv(cfg) {
+  if (!cfg.apiKey) return {};
+  if (shouldUseAuthTokenForApiBaseUrl(cfg.apiBaseUrl)) {
+    return { ANTHROPIC_AUTH_TOKEN: cfg.apiKey };
+  }
+  return { ANTHROPIC_API_KEY: cfg.apiKey };
+}
+function buildModelGatewayBaseUrl(serverApiUrl, subscriptionId) {
+  const base = serverApiUrl.replace(/\/+$/, "");
+  return `${base}/api/model-gateway/subscriptions/${encodeURIComponent(subscriptionId)}`;
+}
 async function chownForRootSpawn(targetPath, target) {
   try {
     await fs5.chown(targetPath, NODE_USER_UID, NODE_USER_UID);
@@ -25139,6 +25807,35 @@ var BridgeBusyError = class extends Error {
     this.name = "BridgeBusyError";
   }
 };
+function senderLabelForQuote(message) {
+  if (message.senderAgentName) return message.senderAgentName;
+  if (message.role === "user") return "user";
+  if (message.role === "agent") return `agent:${message.senderAgentId ?? "unknown"}`;
+  return "system";
+}
+function formatMessageAttachmentsForModel(message, sourceLabel) {
+  if (!message.attachments || message.attachments.length === 0) return [];
+  return message.attachments.flatMap(
+    (attachment) => formatAttachmentForModel(attachment, { sourceLabel }).split("\n")
+  );
+}
+function buildSingleReplyPrompt(task) {
+  if (!task.replyToMessage) return sanitizeModelText(task.content);
+  const quoted = task.replyToMessage;
+  const label = senderLabelForQuote(quoted);
+  const quotedContent = sanitizeModelText(quoted.content || (quoted.attachments?.length ? "[attachment]" : ""));
+  return [
+    "--- reply-to message ---",
+    `You are replying to this earlier message from [${label}]:`,
+    quotedContent,
+    ...formatMessageAttachmentsForModel(quoted, "Replied message resource"),
+    "--- end reply-to message ---",
+    "",
+    "--- user message ---",
+    sanitizeModelText(task.content),
+    "--- end user message ---"
+  ].join("\n");
+}
 var AgentManager = class {
   agents = /* @__PURE__ */ new Map();
   lastUsedAt = /* @__PURE__ */ new Map();
@@ -25166,6 +25863,8 @@ var AgentManager = class {
   subscriptionRegistry;
   serverApiUrl;
   bridgeToken;
+  workdirOverrideStore;
+  visionBlockedScopes = /* @__PURE__ */ new Set();
   evictionTimer = null;
   // Lazy-loaded SDK query function. Injectable via constructor for tests.
   queryFn = null;
@@ -25187,6 +25886,7 @@ var AgentManager = class {
       this.bridgeToken = null;
       this.defaultModel = null;
       this.dataDir = path11.join(os5.homedir(), ".ahchat");
+      this.workdirOverrideStore = null;
     } else {
       this.queryFn = options?.queryFn ?? null;
       this.workspacesDir = options?.workspacesDir ?? path11.join(os5.homedir(), ".ahchat", "workspaces");
@@ -25202,6 +25902,7 @@ var AgentManager = class {
       this.bridgeToken = options?.bridgeToken ?? null;
       this.defaultModel = options?.defaultModel ?? null;
       this.dataDir = options?.dataDir ?? path11.join(os5.homedir(), ".ahchat");
+      this.workdirOverrideStore = options?.workdirOverrideStore ?? null;
     }
     this.evictionTimer = setInterval(() => {
       void this.evictIdle();
@@ -25223,6 +25924,16 @@ var AgentManager = class {
     return path11.join(this.workspacesDir, suffix);
   }
   remapServerWorkspaceCwd(agentConfig, scope, requestedCwd) {
+    const overridden = this.workdirOverrideStore?.resolvePath(requestedCwd);
+    if (overridden?.overridden) {
+      logger11.info("Local workdir override applied to runtime cwd", {
+        agentId: agentConfig.id,
+        scope: scopeKey(scope),
+        requested: requestedCwd,
+        resolved: overridden.path
+      });
+      return overridden.path;
+    }
     const remapped = remapServerWorkspacePath(requestedCwd, this.workspacesDir);
     if (remapped.remapped) {
       logger11.info("Server working directory remapped to local Bridge workspace", {
@@ -25274,19 +25985,26 @@ var AgentManager = class {
         agentId: agent.id,
         subscriptionId: cfg.subscriptionId
       });
-      return cfg;
+      throw new Error(missingSubscriptionMessage(cfg.subscriptionId));
     }
     let sub = this.subscriptionRegistry.getById(cfg.subscriptionId);
     if (!sub) sub = await this.subscriptionRegistry.fetchById(cfg.subscriptionId);
     if (!sub) {
-      logger11.warn("Subscription not found; falling back to system OAuth", {
+      logger11.warn("Subscription not found; refusing native OAuth fallback", {
         agentId: agent.id,
         subscriptionId: cfg.subscriptionId
       });
-      return { ...cfg, subscriptionType: "system" };
+      throw new Error(missingSubscriptionMessage(cfg.subscriptionId));
     }
     const isPinnedModel = cfg.model && cfg.model !== "default";
-    const resolvedModel = isPinnedModel ? cfg.model : sub.defaultModel;
+    const resolvedSubscriptionId = sub.resolvedSubscriptionId ?? cfg.subscriptionId;
+    const apiFormat = sub.apiFormat ?? "anthropic";
+    const tierModel = !isPinnedModel && cfg.capabilityTier ? await this.resolveCapabilityTierModel(
+      resolvedSubscriptionId,
+      cfg.capabilityTier,
+      agent.id
+    ) : null;
+    const resolvedModel = isPinnedModel ? cfg.model : tierModel ?? sub.defaultModel;
     const limits = resolveModelLimits(sub.customModels, resolvedModel);
     if (limits.maxInputTokens || limits.maxOutputTokens) {
       logger11.info("Resolved per-model token limits", {
@@ -25296,15 +26014,84 @@ var AgentManager = class {
         maxOutputTokens: limits.maxOutputTokens
       });
     }
+    if (limits.supportsVision) {
+      logger11.info("Resolved per-model vision capability", {
+        agentId: agent.id,
+        model: resolvedModel,
+        enabled: true
+      });
+    }
+    let apiKey = sub.apiKey;
+    let apiBaseUrl = sub.apiBaseUrl;
+    if (apiFormat === "openai") {
+      if (!this.serverApiUrl || !this.bridgeToken) {
+        logger11.warn("OpenAI-format subscription requires server gateway credentials", {
+          agentId: agent.id,
+          subscriptionId: resolvedSubscriptionId,
+          hasServerApiUrl: !!this.serverApiUrl,
+          hasBridgeToken: !!this.bridgeToken
+        });
+        throw new Error("OpenAI \u683C\u5F0F\u8BA2\u9605\u6682\u65F6\u4E0D\u53EF\u7528\uFF1ABridge \u7F3A\u5C11 Server \u7F51\u5173\u5730\u5740\u6216\u4EE4\u724C\u3002");
+      }
+      apiKey = this.bridgeToken;
+      apiBaseUrl = buildModelGatewayBaseUrl(this.serverApiUrl, resolvedSubscriptionId);
+    }
     return {
       ...cfg,
       subscriptionType: sub.type,
-      apiKey: sub.apiKey,
-      apiBaseUrl: sub.apiBaseUrl,
+      apiFormat,
+      resolvedSubscriptionId,
+      apiKey,
+      apiBaseUrl,
       model: resolvedModel,
       ...limits
     };
   }
+  async resolveCapabilityTierModel(subscriptionId, tier, agentId) {
+    if (!this.serverApiUrl || !this.bridgeToken) return null;
+    try {
+      const base = this.serverApiUrl.replace(/\/$/, "");
+      const res = await fetch(
+        `${base}/api/onboarding/tiers`,
+        { headers: bridgeAuthHeaders(this.bridgeToken) }
+      );
+      if (!res.ok) {
+        logger11.warn("Capability tier resolution unavailable", {
+          agentId,
+          subscriptionId,
+          tier,
+          status: res.status
+        });
+        return null;
+      }
+      const tiers = await res.json();
+      const match = tiers.find((item) => item.subscriptionId === subscriptionId && item.tier === tier);
+      if (!match?.modelName) {
+        logger11.warn("Capability tier mapping not found; using subscription default model", {
+          agentId,
+          subscriptionId,
+          tier,
+          availableTiers: tiers.map((item) => `${item.subscriptionId}:${item.tier}`)
+        });
+        return null;
+      }
+      logger11.info("Capability tier model resolved", {
+        agentId,
+        subscriptionId,
+        tier,
+        model: match.modelName
+      });
+      return match.modelName;
+    } catch (error51) {
+      logger11.warn("Capability tier resolution failed; using subscription default model", {
+        agentId,
+        subscriptionId,
+        tier,
+        error: error51
+      });
+      return null;
+    }
+  }
   /** Count live queries (anything not dead / removed). */
   countActiveQueries() {
     let n = 0;
@@ -25316,6 +26103,11 @@ var AgentManager = class {
   asRuntime(proc) {
     return proc;
   }
+  modelInputModeForConfig(agentId, scope, cfg) {
+    const key = runtimeKey(agentId, scope);
+    if (this.visionBlockedScopes.has(key)) return "path-only";
+    return cfg.supportsVision === false ? "path-only" : "vision";
+  }
   async awaitQueryReturn(query4, timeoutMs, agentId) {
     const ret = query4.return(void 0);
     try {
@@ -25491,8 +26283,7 @@ var AgentManager = class {
         logger11.info("New API-key agent config dir; cleared stale session", { agentId: agentConfig.id });
       }
       const settingsPath = path11.join(effectiveConfigDir, "settings.json");
-      const envEntries = {};
-      if (cfg.apiKey) envEntries.ANTHROPIC_API_KEY = cfg.apiKey;
+      const envEntries = buildAnthropicCredentialEnv(cfg);
       if (cfg.apiBaseUrl) envEntries.ANTHROPIC_BASE_URL = cfg.apiBaseUrl;
       let existingSettings = {};
       try {
@@ -25502,6 +26293,8 @@ var AgentManager = class {
       }
       const existingEnv = existingSettings.env ?? {};
       const mergedEnv = { ...existingEnv, ...envEntries };
+      if (envEntries.ANTHROPIC_AUTH_TOKEN) delete mergedEnv.ANTHROPIC_API_KEY;
+      if (envEntries.ANTHROPIC_API_KEY) delete mergedEnv.ANTHROPIC_AUTH_TOKEN;
       const mergedSettings = { ...existingSettings, env: mergedEnv };
       await fs5.writeFile(settingsPath, JSON.stringify(mergedSettings, null, 2), "utf-8");
       logger11.info("API-key agent using isolated config dir", {
@@ -25604,6 +26397,8 @@ var AgentManager = class {
         "Bash",
         "Glob",
         "Grep",
+        "WebSearch",
+        "WebFetch",
         "AskUserQuestion",
         "mcp__neural__neural_send",
         "mcp__neural__neural_list_scopes",
@@ -25619,6 +26414,7 @@ var AgentManager = class {
         "mcp__neural__read_document",
         ...isSmithAgent(agentConfig) ? [
           "mcp__neural__create_agent",
+          "mcp__neural__update_agent_profile",
           "mcp__neural__list_friends",
           "mcp__neural__accept_friend",
           "mcp__neural__add_friend",
@@ -25633,7 +26429,7 @@ var AgentManager = class {
       // instructions as the workflow body (replacing the default code-implementation
       // phases). The SDK wraps it with read-only enforcement + ExitPlanMode protocol.
       planModeInstructions: (() => {
-        const smithTools = isSmithAgent(agentConfig) ? "\nSMITH-SPECIFIC TOOLS (available in plan mode): mcp__neural__read_skill, mcp__neural__fetch_logs, mcp__neural__create_agent \u2014 use these to research existing skills, check logs, and plan agent creation." : "";
+        const smithTools = isSmithAgent(agentConfig) ? "\nSMITH-SPECIFIC TOOLS (available in plan mode): mcp__neural__read_skill, mcp__neural__fetch_logs, mcp__neural__create_agent, mcp__neural__update_agent_profile \u2014 use these to research existing skills, check logs, plan agent creation, and adjust Agent profiles." : "";
         return `You are a PLANNER, NOT an executor. The user will execute your plan later.
 
 AVAILABLE TOOLS: Read, Glob, Grep, WebSearch, WebFetch, AskUserQuestion, Write (plan file only).${smithTools}
@@ -25752,14 +26548,18 @@ Do NOT use "..." as content \u2014 write specific, project-relevant content.`;
         const isolated = cfg.subscriptionType === "project" && Boolean(cfg.apiKey ?? cfg.apiBaseUrl);
         const modelLimitEnv = buildModelLimitEnv(cfg);
         if (isolated) {
-          return {
+          const credentialEnv = buildAnthropicCredentialEnv(cfg);
+          const env3 = {
             ...process.env,
             CLAUDE_CONFIG_DIR: effectiveConfigDir,
             CLAUDE_CODE_SIMPLE: "0",
-            ...cfg.apiKey ? { ANTHROPIC_API_KEY: cfg.apiKey } : {},
             ...cfg.apiBaseUrl ? { ANTHROPIC_BASE_URL: cfg.apiBaseUrl } : {},
+            ...credentialEnv,
             ...modelLimitEnv
           };
+          if (credentialEnv.ANTHROPIC_AUTH_TOKEN) delete env3.ANTHROPIC_API_KEY;
+          if (credentialEnv.ANTHROPIC_API_KEY) delete env3.ANTHROPIC_AUTH_TOKEN;
+          return env3;
         }
         const env2 = { ...process.env, ...modelLimitEnv };
         env2.CLAUDE_CODE_SIMPLE = "0";
@@ -25803,7 +26603,7 @@ Do NOT use "..." as content \u2014 write specific, project-relevant content.`;
         return path11.join(effectiveConfigDir, "settings.json");
       })(),
       canUseTool: async (toolName, input) => {
-        if (toolName === "AskUserQuestion") {
+        if (isAskUserQuestionToolName(toolName)) {
           return askGuard(input);
         }
         if (toolName === "CronCreate") {
@@ -25899,6 +26699,7 @@ Do NOT use "..." as content \u2014 write specific, project-relevant content.`;
       prompt: inputController,
       options
     });
+    const modelInputMode = this.modelInputModeForConfig(agentConfig.id, scope, cfg);
     const proc = {
       agentId: agentConfig.id,
       scope,
@@ -25930,8 +26731,18 @@ Do NOT use "..." as content \u2014 write specific, project-relevant content.`;
       mergedTasks: [],
       planModeBuffer: [],
       createdAt: Date.now(),
+      supportsVision: modelInputMode === "vision" && cfg.supportsVision !== false,
+      modelInputMode,
       quietFlushTimer: null
     });
+    logger11.info("Agent model input mode resolved", {
+      agentId: agentConfig.id,
+      scope: scopeKey(scope),
+      model: cfg.model,
+      modelInputMode,
+      supportsVision: runtime.supportsVision,
+      capabilitySupportsVision: cfg.supportsVision
+    });
     procRef = proc;
     this.agents.set(key, proc);
     const preserved = this.dormantGroupInboxes.get(key);
@@ -26395,6 +27206,19 @@ ${lines.join("\n")}`;
       traceId: latest.traceId,
       groupId: latest.groupId
     });
+    for (const entry of entries) {
+      this.emit({
+        type: "agent:merged",
+        payload: {
+          agentId: runtime.agentId,
+          conversationId: entry.conversationId,
+          ackId: entry.ackId,
+          mergedIntoAckId: replyMessageId,
+          groupId: entry.groupId,
+          traceId: entry.traceId
+        }
+      });
+    }
     if (includeBoard) {
       this.dispatchMemory.setBoardSignature(runtime.agentId, runtime.scope, boardSig);
     }
@@ -26420,7 +27244,13 @@ ${lines.join("\n")}`;
     runtime.cachedConversationId = task.conversationId;
     this.emit({
       type: "agent:status",
-      payload: { agentId: runtime.agentId, status: "thinking" }
+      payload: {
+        agentId: runtime.agentId,
+        status: "thinking",
+        traceId: task.traceId,
+        ackId: task.replyMessageId,
+        scopeKey: scopeKey(runtime.scope)
+      }
     });
     logger11.info("dispatchToSDK emit agent:status thinking", {
       agentId: runtime.agentId,
@@ -26482,22 +27312,24 @@ ${lines.join("\n")}`;
     });
   }
   async pushTaskContent(runtime, task, onYielded) {
+    const textContent = buildSingleReplyPrompt(task);
     if (!task.attachments || task.attachments.length === 0) {
-      runtime.inputController.push(task.content, runtime.ccSessionId ?? "", onYielded);
+      runtime.inputController.push(textContent, runtime.ccSessionId ?? "", onYielded);
       return;
     }
-    const supportsVision = await this.detectVisionSupport();
     const attachmentBlocks = await adaptAttachmentsForSDK(
       task.attachments ?? [],
       {
         fetchBuffer: this.fetchBufferFromUrl,
         materializeFile: (attachment, buffer) => this.materializeAttachment(runtime, attachment, buffer),
-        supportsVision
+        modelInputMode: runtime.modelInputMode,
+        supportsVision: runtime.supportsVision
       }
     );
-    const text = task.content.trim() || "\u8BF7\u67E5\u770B\u6211\u53D1\u9001\u7684\u9644\u4EF6\u3002";
+    const text = textContent.trim() || "\u8BF7\u67E5\u770B\u6211\u53D1\u9001\u7684\u9644\u4EF6\u3002";
+    const safeText = sanitizeModelText(text);
     const contentParts = [
-      { type: "text", text },
+      { type: "text", text: safeText },
       ...attachmentBlocks
     ];
     runtime.inputController.push(contentParts, runtime.ccSessionId ?? "", onYielded);
@@ -26533,9 +27365,12 @@ ${lines.join("\n")}`;
     return materialized;
   }
   async resolveExistingWorkspaceAttachmentPath(runtime, attachment) {
+    const localWorkspacePath = attachment.metadata?.localWorkspacePath;
     const workspacePath = attachment.metadata?.workspacePath;
-    if (typeof workspacePath !== "string" || !workspacePath.trim()) return null;
-    const candidate = path11.resolve(workspacePath);
+    const rawPath = typeof localWorkspacePath === "string" && localWorkspacePath.trim() ? localWorkspacePath : workspacePath;
+    if (typeof rawPath !== "string" || !rawPath.trim()) return null;
+    const remapped = remapServerWorkspacePath(rawPath, this.workspacesDir);
+    const candidate = path11.resolve(remapped.path);
     if (!this.isPathInsideBase(candidate, runtime.cwd)) return null;
     try {
       const stat3 = await fs5.stat(candidate);
@@ -26545,6 +27380,8 @@ ${lines.join("\n")}`;
         agentId: runtime.agentId,
         attachmentId: attachment.id,
         workspacePath,
+        localWorkspacePath,
+        resolvedPath: candidate,
         error: e
       });
       return null;
@@ -26580,6 +27417,56 @@ ${lines.join("\n")}`;
     }
     return true;
   }
+  isUnsupportedVisionInputError(errorText) {
+    return /Unexpected item type in content/i.test(errorText);
+  }
+  markVisionUnsupportedForScope(runtime, errorText) {
+    const key = runtimeKey(runtime.agentId, runtime.scope);
+    this.visionBlockedScopes.add(key);
+    this.sessionStore.delete(runtime.agentId, runtime.scope);
+    runtime.modelInputMode = "path-only";
+    runtime.supportsVision = false;
+    runtime.visionRecoveryPending = true;
+    logger11.warn("Vision input unsupported; clearing SDK session and degrading scope to path-only attachments", {
+      agentId: runtime.agentId,
+      scope: scopeKey(runtime.scope),
+      sessionId: runtime.ccSessionId,
+      errorText: errorText.slice(0, 300)
+    });
+  }
+  closeRuntimeAfterVisionRecovery(runtime) {
+    const key = runtimeKey(runtime.agentId, runtime.scope);
+    const releaseTask = (task) => {
+      this.emit({
+        type: "agent:error",
+        payload: {
+          agentId: runtime.agentId,
+          conversationId: task.conversationId,
+          ackId: task.replyMessageId,
+          traceId: task.traceId,
+          error: "Previous image input failed because this model/backend does not support multimodal content. Please resend this message; future attachments will be sent as paths/text references."
+        }
+      });
+    };
+    for (const task of runtime.injectedTasks) releaseTask(task);
+    for (const task of runtime.mergedTasks) releaseTask(task);
+    for (const task of runtime.planModeBuffer) releaseTask(task);
+    runtime.status = "dead";
+    runtime.currentTask = null;
+    runtime.injectedTasks = [];
+    runtime.mergedTasks = [];
+    runtime.planModeBuffer = [];
+    runtime.inputController.drainQueue();
+    runtime.inputController.close();
+    this.clearQuietFlushTimer(runtime);
+    this.agents.delete(key);
+    this.lastUsedAt.delete(key);
+    this.dispatchMemory.deleteScope(runtime.agentId, runtime.scope);
+    logger11.info("Closed runtime after unsupported vision error; next dispatch will start a clean path-only session", {
+      agentId: runtime.agentId,
+      scope: scopeKey(runtime.scope)
+    });
+  }
   emitTaskPushError(runtime, task, error51) {
     const errMsg = error51 instanceof Error ? error51.message : String(error51);
     logger11.error("Failed to push message to Agent", {
@@ -26620,6 +27507,10 @@ ${lines.join("\n")}`;
   onTaskCompleted(proc, carrierMessageId) {
     const runtime = this.asRuntime(proc);
     const completedTask = proc.currentTask;
+    if (runtime.visionRecoveryPending) {
+      this.closeRuntimeAfterVisionRecovery(runtime);
+      return;
+    }
     if (proc.compactInProgress) {
       proc.compactInProgress = false;
       this.dispatchMemory.reset(proc.agentId, proc.scope);
@@ -26631,7 +27522,13 @@ ${lines.join("\n")}`;
       });
       this.emit({
         type: "agent:status",
-        payload: { agentId: proc.agentId, status: "idle" }
+        payload: {
+          agentId: proc.agentId,
+          status: "idle",
+          traceId: completedTask?.traceId,
+          ackId: completedTask?.replyMessageId,
+          scopeKey: scopeKey(proc.scope)
+        }
       });
     }
     if (completedTask && runtime.mergedTasks.length > 0) {
@@ -26711,7 +27608,13 @@ ${lines.join("\n")}`;
       proc.currentTaskStartedAt = Date.now();
       this.emit({
         type: "agent:status",
-        payload: { agentId: proc.agentId, status: "compacting" }
+        payload: {
+          agentId: proc.agentId,
+          status: "compacting",
+          traceId: compactTraceId,
+          ackId: proc.currentTask.replyMessageId,
+          scopeKey: scopeKey(proc.scope)
+        }
       });
       return;
     }
@@ -26870,6 +27773,15 @@ ${lines.join("\n")}`;
       });
       return;
     }
+    if (!payload.conversationId) {
+      logger11.error("Neural send rejected: missing conversationId", {
+        error: new Error("neural_send target conversationId is required"),
+        agentId: agentConfig.id,
+        fromScope: payload.fromScopeKey,
+        toScope: payload.toScopeKey
+      });
+      return;
+    }
     const targetScope = payload.toScopeKey === "single" ? { kind: "single" } : { kind: "group", groupId: payload.groupId ?? payload.toScopeKey.replace("group:", "") };
     this.sessionStore.delete(agentConfig.id, targetScope);
     this.dispatchMemory.deleteScope(agentConfig.id, targetScope);
@@ -26881,9 +27793,9 @@ ${lines.join("\n")}`;
     const enveloped = buildInnerVoiceEnvelope(payloadWithTrigger, ctx);
     const task = {
       content: enveloped,
-      replyMessageId: `msg_nsend_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`,
-      conversationId: payload.conversationId ?? "",
-      traceId: `tr_nsend_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`,
+      replyMessageId: createMessageId(),
+      conversationId: payload.conversationId,
+      traceId: createTraceId(),
       groupId: payload.groupId
     };
     const key = runtimeKey(agentConfig.id, targetScope);
@@ -26916,7 +27828,7 @@ ${lines.join("\n")}`;
       } else {
         const runtime = this.asRuntime(existingProc);
         runtime.cachedConversationId = task.conversationId;
-        runtime.inputController.push(task.content, runtime.ccSessionId ?? "");
+        runtime.inputController.push(sanitizeModelText(task.content), runtime.ccSessionId ?? "");
         runtime.injectedTasks.push(task);
         logger11.info("Neural send injected mid-turn", {
           agentId: agentConfig.id,
@@ -27098,7 +28010,7 @@ ${lines.join("\n")}`;
       (k) => k === agentId || k.startsWith(`${agentId}::`)
     );
     if (keys.length === 0) {
-      logger11.warn("terminate: no process for agent", { agentId });
+      logger11.info("terminate: no process for agent", { agentId });
     }
     for (const key of keys) {
       const proc = this.agents.get(key);
@@ -27225,6 +28137,11 @@ ${lines.join("\n")}`;
     for (const t of queued) {
       collectOrInterrupt(t);
     }
+    const bufferedAtClose = [...runtime.planModeBuffer];
+    runtime.planModeBuffer = [];
+    for (const t of bufferedAtClose) {
+      collectOrInterrupt(t);
+    }
     const mergedAtClose = [...runtime.mergedTasks];
     runtime.mergedTasks = [];
     for (const t of mergedAtClose) {
@@ -27370,7 +28287,12 @@ ${lines.join("\n")}`;
           message,
           this.emit,
           this.sessionStore,
-          (doneMessageId) => this.onTaskCompleted(runtime, doneMessageId)
+          (doneMessageId) => this.onTaskCompleted(runtime, doneMessageId),
+          (errorText) => {
+            if (this.isUnsupportedVisionInputError(errorText)) {
+              this.markVisionUnsupportedForScope(runtime, errorText);
+            }
+          }
         );
         if (wasPlanActive && !runtime.planModeActive) {
           if (runtime.planModeRef) runtime.planModeRef.active = false;
@@ -27388,13 +28310,18 @@ ${lines.join("\n")}`;
     } catch (err) {
       const errMsg = err.message ?? String(err);
       const isResumeFail = /session|conversation.*not found/i.test(errMsg);
+      const isUnsupportedVisionInput = this.isUnsupportedVisionInputError(errMsg);
       logger11.error("Agent query stream ended with error", {
         agentId: runtime.agentId,
         scope: scopeKey(runtime.scope),
         isResumeFail,
+        isUnsupportedVisionInput,
         staleSessionId: runtime.ccSessionId,
         error: err
       });
+      if (isUnsupportedVisionInput) {
+        this.visionBlockedScopes.add(runtimeKey(runtime.agentId, runtime.scope));
+      }
       this.sessionStore.delete(runtime.agentId, runtime.scope);
       this.dispatchMemory.deleteScope(runtime.agentId, runtime.scope);
       logger11.info("Cleared stale session after query crash", {
@@ -27407,6 +28334,7 @@ ${lines.join("\n")}`;
       this.agents.delete(key);
       this.lastUsedAt.delete(key);
       const errorText = isResumeFail ? `\u4F1A\u8BDD\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u53D1\u9001\u6D88\u606F\uFF08${errMsg}\uFF09` : `Agent query crashed: ${errMsg}`;
+      const emittedErrorText = isUnsupportedVisionInput ? "Current model/backend does not support image multimodal input. This image message failed; AHChat has cleared this scope session and future messages will send attachments as paths/text references." : errorText;
       if (runtime.currentTask) {
         this.emit({
           type: "agent:error",
@@ -27415,7 +28343,7 @@ ${lines.join("\n")}`;
             conversationId: runtime.currentTask.conversationId,
             ackId: runtime.currentTask.replyMessageId,
             traceId: runtime.currentTask.traceId,
-            error: errorText
+            error: emittedErrorText
           }
         });
         runtime.currentTask = null;
@@ -27428,7 +28356,7 @@ ${lines.join("\n")}`;
             conversationId: task.conversationId,
             ackId: task.replyMessageId,
             traceId: task.traceId,
-            error: errorText
+            error: emittedErrorText
           }
         });
       }
@@ -27441,11 +28369,24 @@ ${lines.join("\n")}`;
             conversationId: task.conversationId,
             ackId: task.replyMessageId,
             traceId: task.traceId,
-            error: errorText
+            error: emittedErrorText
           }
         });
       }
       runtime.mergedTasks = [];
+      for (const task of runtime.planModeBuffer) {
+        this.emit({
+          type: "agent:error",
+          payload: {
+            agentId: runtime.agentId,
+            conversationId: task.conversationId,
+            ackId: task.replyMessageId,
+            traceId: task.traceId,
+            error: emittedErrorText
+          }
+        });
+      }
+      runtime.planModeBuffer = [];
     }
   }
   getStatus(agentId, scope = { kind: "single" }) {
@@ -27623,6 +28564,26 @@ ${lines.join("\n")}`;
         traceId: t.traceId
       });
     }
+    const buffered = [...runtime.planModeBuffer];
+    runtime.planModeBuffer = [];
+    for (const t of buffered) {
+      this.emit({
+        type: "agent:no_reply",
+        payload: {
+          agentId,
+          conversationId: t.conversationId,
+          ackId: t.replyMessageId,
+          groupId: t.groupId,
+          reason: "cancelled_by_user",
+          traceId: t.traceId
+        }
+      });
+      logger11.info("cancelReply: emitted agent:no_reply for plan-mode buffered task", {
+        agentId,
+        ackId: t.replyMessageId,
+        traceId: t.traceId
+      });
+    }
     runtime.currentTask = null;
     this.clearQuietFlushTimer(runtime);
     proc.status = "dead";
@@ -27743,7 +28704,7 @@ function computeBoardSignature(entry) {
 
 // src/bridgeFetchAuth.ts
 var logger12 = createModuleLogger("bridge.fetchAuth");
-var BRIDGE_TOKEN_HEADER = "X-AHChat-Bridge-Token";
+var BRIDGE_TOKEN_HEADER2 = "X-AHChat-Bridge-Token";
 function installBridgeFetchAuth(serverApiUrl, token) {
   if (typeof globalThis.fetch !== "function") {
     logger12.warn("globalThis.fetch not available, cannot install bridge fetch auth");
@@ -27771,24 +28732,17 @@ function installBridgeFetchAuth(serverApiUrl, token) {
     else url2 = input.url;
     if (!shouldInject(url2)) return original(input, init);
     const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
-    if (!headers.has(BRIDGE_TOKEN_HEADER)) {
-      headers.set(BRIDGE_TOKEN_HEADER, token);
+    if (!headers.has(BRIDGE_TOKEN_HEADER2)) {
+      headers.set(BRIDGE_TOKEN_HEADER2, token);
     }
     return original(input, { ...init, headers });
   });
   logger12.info("Bridge fetch auth installed", {
     serverApiUrl: base,
-    tokenPrefix: `${token.slice(0, 8)}...`
+    hasToken: Boolean(token)
   });
 }
 
-// src/bridgeHttp.ts
-var BRIDGE_TOKEN_HEADER2 = "X-AHChat-Bridge-Token";
-function bridgeAuthHeaders(bridgeToken) {
-  const token = bridgeToken?.trim();
-  return token ? { [BRIDGE_TOKEN_HEADER2]: token } : {};
-}
-
 // src/agentRegistry.ts
 var logger13 = createModuleLogger("agent.registry");
 var HttpAgentRegistry = class {
@@ -27801,8 +28755,8 @@ var HttpAgentRegistry = class {
   agents = /* @__PURE__ */ new Map();
   apiUrl(suffix) {
     const base = this.serverApiUrl.replace(/\/$/, "");
-    const path24 = suffix.startsWith("/") ? suffix : `/${suffix}`;
-    return `${base}${path24}`;
+    const path26 = suffix.startsWith("/") ? suffix : `/${suffix}`;
+    return `${base}${path26}`;
   }
   async refresh() {
     const attempt = async () => {
@@ -27899,8 +28853,16 @@ var HttpSubscriptionRegistry = class {
   subscriptions = /* @__PURE__ */ new Map();
   apiUrl(suffix) {
     const base = this.serverApiUrl.replace(/\/$/, "");
-    const path24 = suffix.startsWith("/") ? suffix : `/${suffix}`;
-    return `${base}${path24}`;
+    const path26 = suffix.startsWith("/") ? suffix : `/${suffix}`;
+    return `${base}${path26}`;
+  }
+  rebuildPrimaryAlias() {
+    this.subscriptions.delete(PRIMARY_COMPANY_SUBSCRIPTION_ID);
+    const primary = Array.from(this.subscriptions.values()).find(
+      (sub) => sub.billingMode === "company_billable" && sub.isPrimaryCompany === true
+    );
+    if (!primary) return;
+    this.subscriptions.set(PRIMARY_COMPANY_SUBSCRIPTION_ID, makePrimaryCompanySubscriptionAlias(primary));
   }
   async refresh() {
     const attempt = async () => {
@@ -27929,6 +28891,7 @@ var HttpSubscriptionRegistry = class {
         const s = item;
         if (s && typeof s.id === "string") this.subscriptions.set(s.id, s);
       }
+      this.rebuildPrimaryAlias();
       logger14.info("Subscription registry refreshed", { count: this.subscriptions.size });
     } catch (e) {
       logger14.warn("Subscription registry parse failed", { error: e });
@@ -27938,6 +28901,10 @@ var HttpSubscriptionRegistry = class {
     return this.subscriptions.get(id) ?? null;
   }
   async fetchById(id) {
+    if (isPrimaryCompanySubscriptionId(id)) {
+      await this.refresh();
+      return this.getById(id);
+    }
     try {
       const res = await fetch(this.apiUrl(`/api/subscriptions/${encodeURIComponent(id)}`), {
         headers: bridgeAuthHeaders(this.bridgeToken)
@@ -27953,9 +28920,11 @@ var HttpSubscriptionRegistry = class {
   }
   upsert(sub) {
     this.subscriptions.set(sub.id, sub);
+    this.rebuildPrimaryAlias();
   }
   remove(id) {
     this.subscriptions.delete(id);
+    this.rebuildPrimaryAlias();
   }
 };
 
@@ -28171,6 +29140,13 @@ var wrapper_default = import_websocket.default;
 
 // src/connector.ts
 var logger16 = createModuleLogger("ws.connector");
+function buildBridgeWebSocketUrl(serverUrl, bridgeToken) {
+  const token = bridgeToken?.trim();
+  if (!token) return serverUrl;
+  const url2 = new URL(serverUrl);
+  url2.searchParams.set("token", token);
+  return url2.toString();
+}
 var ServerConnector = class {
   ws = null;
   reconnectAttempts = 0;
@@ -28195,13 +29171,12 @@ var ServerConnector = class {
   }
   connect() {
     if (this.closing) return;
-    const url2 = new URL(this.config.serverUrl);
-    if (this.config.bridgeToken) {
-      url2.searchParams.set("token", this.config.bridgeToken);
-    }
-    const wsUrl = url2.toString();
-    logger16.info("Connecting to server", { url: wsUrl });
-    const ws = new wrapper_default(wsUrl);
+    logger16.info("Connecting to server", {
+      url: this.config.serverUrl,
+      hasBridgeToken: Boolean(this.config.bridgeToken)
+    });
+    const headers = this.config.bridgeToken ? { "X-AHChat-Bridge-Token": this.config.bridgeToken } : void 0;
+    const ws = new wrapper_default(buildBridgeWebSocketUrl(this.config.serverUrl, this.config.bridgeToken), { headers });
     ws.on("open", () => {
       this.ws = ws;
       this.reconnectAttempts = 0;
@@ -28425,9 +29400,213 @@ ${s.slice(-TRUNCATE_TAIL)}`;
 function cwdToProjectSlug(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
-function resolveJsonlPath(sessionId, cwd) {
+function resolveJsonlPathInProjectsDir(projectsDir, sessionId, cwd) {
+  const slug = cwdToProjectSlug(cwd);
+  return path12.join(projectsDir, slug, `${sessionId}.jsonl`);
+}
+function resolveProjectDirInProjectsDir(projectsDir, cwd) {
   const slug = cwdToProjectSlug(cwd);
-  return path12.join(os7.homedir(), ".claude", "projects", slug, `${sessionId}.jsonl`);
+  return path12.join(projectsDir, slug);
+}
+function errorCode(e) {
+  if (e instanceof Error && "code" in e) {
+    const code = e.code;
+    return typeof code === "string" ? code : void 0;
+  }
+  return void 0;
+}
+async function isReadableFile(filePath) {
+  try {
+    const stat3 = await fs6.stat(filePath);
+    return stat3.isFile();
+  } catch (e) {
+    const code = errorCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return false;
+    logger17.warn("JSONL candidate stat failed", { filePath, error: e });
+    return false;
+  }
+}
+function uniquePaths(paths) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const p of paths) {
+    const trimmed = p.trim();
+    if (!trimmed) continue;
+    const key = path12.normalize(trimmed);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(trimmed);
+  }
+  return out;
+}
+function claudeProjectsDirs(opts) {
+  return uniquePaths([
+    opts.agentConfigDir ? path12.join(opts.agentConfigDir, "api-key-agents", opts.agentId, "projects") : "",
+    opts.agentConfigDir ? path12.join(opts.agentConfigDir, "projects") : "",
+    process.env.CLAUDE_CONFIG_DIR ? path12.join(process.env.CLAUDE_CONFIG_DIR, "projects") : "",
+    path12.join(os7.homedir(), ".claude", "projects")
+  ]);
+}
+function fallbackBridgeWorkspacePath(requestedCwd, workspacesDir, fallbackSegment) {
+  const suffix = extractAhchatWorkspaceSuffix(requestedCwd);
+  if (suffix) return path12.join(workspacesDir, suffix);
+  const normalized = requestedCwd.trim();
+  const basename = normalized ? path12.basename(path12.normalize(normalized)) : "";
+  const segment = basename && basename !== "." && basename !== path12.sep ? basename : fallbackSegment;
+  return path12.join(workspacesDir, segment);
+}
+function cwdCandidatesForBridge(requestedCwd, opts) {
+  const candidates = [requestedCwd];
+  const overridden = opts.workdirOverrideStore?.resolvePath(requestedCwd);
+  if (overridden?.overridden) {
+    candidates.push(overridden.path);
+  }
+  if (opts.workspacesDir) {
+    const remapped = remapServerWorkspacePath(requestedCwd, opts.workspacesDir);
+    candidates.push(remapped.path);
+    candidates.push(fallbackBridgeWorkspacePath(requestedCwd, opts.workspacesDir, opts.fallbackSegment));
+  }
+  return uniquePaths(candidates);
+}
+async function resolveDumpWorkdir(requestedCwd, opts) {
+  const overridden = opts.workdirOverrideStore?.resolvePath(requestedCwd);
+  if (overridden?.overridden) {
+    logger17.info("Dump workdir resolved to local desktop override", {
+      agentId: opts.agentId,
+      requested: requestedCwd,
+      resolved: overridden.path
+    });
+    return overridden.path;
+  }
+  if (!opts.workspacesDir) return requestedCwd;
+  const remapped = remapServerWorkspacePath(requestedCwd, opts.workspacesDir);
+  if (remapped.remapped) {
+    logger17.info("Dump workdir remapped to local Bridge workspace", {
+      agentId: opts.agentId,
+      requested: requestedCwd,
+      remapped: remapped.path
+    });
+    return remapped.path;
+  }
+  try {
+    await fs6.mkdir(requestedCwd, { recursive: true });
+    return requestedCwd;
+  } catch (e) {
+    const fallback = fallbackBridgeWorkspacePath(requestedCwd, opts.workspacesDir, opts.fallbackSegment);
+    if (path12.normalize(fallback) === path12.normalize(requestedCwd)) throw e;
+    logger17.warn("Dump workdir inaccessible; using local Bridge workspace fallback", {
+      agentId: opts.agentId,
+      requested: requestedCwd,
+      fallback,
+      error: e
+    });
+    return fallback;
+  }
+}
+async function findJsonlInClaudeProjects(sessionId, projectsDirs) {
+  for (const projectsDir of projectsDirs) {
+    let dirs;
+    try {
+      dirs = await fs6.readdir(projectsDir, { withFileTypes: true });
+    } catch (e) {
+      const code = errorCode(e);
+      if (code === "ENOENT" || code === "ENOTDIR") continue;
+      logger17.warn("Claude projects directory scan failed", { projectsDir, sessionId, error: e });
+      continue;
+    }
+    for (const dir of dirs) {
+      if (!dir.isDirectory()) continue;
+      const candidate = path12.join(projectsDir, dir.name, `${sessionId}.jsonl`);
+      if (await isReadableFile(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+async function latestJsonlInProjectDir(projectDir) {
+  let entries;
+  try {
+    entries = await fs6.readdir(projectDir, { withFileTypes: true });
+  } catch (e) {
+    const code = errorCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    logger17.warn("Claude project directory scan failed", { projectDir, error: e });
+    return null;
+  }
+  let latest = null;
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
+    const jsonlPath = path12.join(projectDir, entry.name);
+    let stat3;
+    try {
+      stat3 = await fs6.stat(jsonlPath);
+    } catch (e) {
+      logger17.warn("Discovered JSONL stat failed", { jsonlPath, error: e });
+      continue;
+    }
+    const sessionId = path12.basename(entry.name, ".jsonl");
+    const discovered = { sessionId, jsonlPath, lastModified: stat3.mtimeMs };
+    if (!latest || discovered.lastModified > latest.lastModified) {
+      latest = discovered;
+    }
+  }
+  return latest;
+}
+function isAgentIsolatedProjectsDir(projectsDir, agentId) {
+  const normalized = path12.normalize(projectsDir).toLowerCase();
+  const marker = path12.normalize(path12.join("api-key-agents", agentId, "projects")).toLowerCase();
+  return normalized.endsWith(marker);
+}
+async function discoverLatestJsonlForScope(opts) {
+  const discovered = [];
+  const projectDirs = uniquePaths(
+    opts.projectsDirs.flatMap(
+      (projectsDir) => opts.cwdCandidates.map((cwd) => resolveProjectDirInProjectsDir(projectsDir, cwd))
+    )
+  );
+  for (const projectDir of projectDirs) {
+    const latest = await latestJsonlInProjectDir(projectDir);
+    if (latest) discovered.push(latest);
+  }
+  if (opts.allowAgentWideScan) {
+    for (const projectsDir of opts.projectsDirs) {
+      if (!isAgentIsolatedProjectsDir(projectsDir, opts.agentId)) continue;
+      let dirs;
+      try {
+        dirs = await fs6.readdir(projectsDir, { withFileTypes: true });
+      } catch (e) {
+        const code = errorCode(e);
+        if (code === "ENOENT" || code === "ENOTDIR") continue;
+        logger17.warn("Agent isolated projects scan failed", { projectsDir, agentId: opts.agentId, error: e });
+        continue;
+      }
+      for (const dir of dirs) {
+        if (!dir.isDirectory()) continue;
+        const latest = await latestJsonlInProjectDir(path12.join(projectsDir, dir.name));
+        if (latest) discovered.push(latest);
+      }
+    }
+  }
+  discovered.sort((a, b) => b.lastModified - a.lastModified);
+  return discovered[0] ?? null;
+}
+async function resolveReadableJsonlPath(sessionId, cwdCandidates, projectsDirs) {
+  const checkedPaths = uniquePaths(
+    projectsDirs.flatMap(
+      (projectsDir) => cwdCandidates.map((cwd) => resolveJsonlPathInProjectsDir(projectsDir, sessionId, cwd))
+    )
+  );
+  for (const candidate of checkedPaths) {
+    if (await isReadableFile(candidate)) {
+      return { jsonlPath: candidate, checkedPaths };
+    }
+  }
+  const found = await findJsonlInClaudeProjects(sessionId, projectsDirs);
+  if (found) {
+    return { jsonlPath: found, checkedPaths };
+  }
+  const preview = checkedPaths.slice(0, 4).join("; ");
+  const suffix = checkedPaths.length > 4 ? `; ... +${checkedPaths.length - 4} more` : "";
+  throw new Error(`session JSONL not found for ${sessionId}; checked ${preview}${suffix}`);
 }
 var RENDERABLE_TYPES = /* @__PURE__ */ new Set(["user", "assistant", "system", "attachment"]);
 async function readJsonlEntries(filePath) {
@@ -28675,6 +29854,100 @@ function resolveScopeCwd(agentWorkDir, scopeKey2, groupRegistry) {
   }
   return agentWorkDir;
 }
+function scopeFromKey(scopeKey2) {
+  if (scopeKey2 === "single") return { kind: "single" };
+  if (scopeKey2.startsWith("group:")) {
+    return { kind: "group", groupId: scopeKey2.slice("group:".length) };
+  }
+  return null;
+}
+async function resolveDumpJsonlSource(opts) {
+  try {
+    const resolved = await resolveReadableJsonlPath(opts.sessionId, opts.cwdCandidates, opts.projectsDirs);
+    return { sessionId: opts.sessionId, recovered: false, ...resolved };
+  } catch (e) {
+    const discovered = await discoverLatestJsonlForScope({
+      agentId: opts.agentId,
+      cwdCandidates: opts.cwdCandidates,
+      projectsDirs: opts.projectsDirs,
+      allowAgentWideScan: opts.scopeKey === "single"
+    });
+    if (!discovered) throw e;
+    const scope = scopeFromKey(opts.scopeKey);
+    if (scope) {
+      opts.sessionStore.set(opts.agentId, scope, discovered.sessionId);
+    }
+    logger17.warn("Stale dump session id recovered from local Claude projects", {
+      agentId: opts.agentId,
+      scopeKey: opts.scopeKey,
+      previousSessionId: opts.sessionId,
+      recoveredSessionId: discovered.sessionId,
+      jsonlPath: discovered.jsonlPath,
+      error: e
+    });
+    return {
+      sessionId: discovered.sessionId,
+      jsonlPath: discovered.jsonlPath,
+      checkedPaths: [],
+      recovered: true
+    };
+  }
+}
+async function discoverMissingScopeEntries(opts) {
+  const entries = [];
+  if (!opts.existingScopeKeys.has("single")) {
+    const cwdCandidates = uniquePaths([
+      ...cwdCandidatesForBridge(opts.agentWorkdir, {
+        workspacesDir: opts.workspacesDir,
+        fallbackSegment: opts.agentId,
+        workdirOverrideStore: opts.workdirOverrideStore
+      }),
+      opts.localWorkdir
+    ]);
+    const discovered = await discoverLatestJsonlForScope({
+      agentId: opts.agentId,
+      cwdCandidates,
+      projectsDirs: opts.projectsDirs,
+      allowAgentWideScan: true
+    });
+    if (discovered) {
+      opts.sessionStore.set(opts.agentId, { kind: "single" }, discovered.sessionId);
+      opts.existingScopeKeys.add("single");
+      entries.push({ scopeKey: "single", sessionId: discovered.sessionId });
+      logger17.info("Missing single session recovered from Claude projects", {
+        agentId: opts.agentId,
+        sessionId: discovered.sessionId,
+        jsonlPath: discovered.jsonlPath
+      });
+    }
+  }
+  for (const group of opts.groupRegistry?.getMyGroups(opts.agentId) ?? []) {
+    const scopeKey2 = `group:${group.groupId}`;
+    if (opts.existingScopeKeys.has(scopeKey2)) continue;
+    const cwdCandidates = cwdCandidatesForBridge(group.workingDirectory, {
+      workspacesDir: opts.workspacesDir,
+      fallbackSegment: `Group-${group.groupId}`,
+      workdirOverrideStore: opts.workdirOverrideStore
+    });
+    const discovered = await discoverLatestJsonlForScope({
+      agentId: opts.agentId,
+      cwdCandidates,
+      projectsDirs: opts.projectsDirs,
+      allowAgentWideScan: false
+    });
+    if (!discovered) continue;
+    opts.sessionStore.set(opts.agentId, { kind: "group", groupId: group.groupId }, discovered.sessionId);
+    opts.existingScopeKeys.add(scopeKey2);
+    entries.push({ scopeKey: scopeKey2, sessionId: discovered.sessionId });
+    logger17.info("Missing group session recovered from Claude projects", {
+      agentId: opts.agentId,
+      groupId: group.groupId,
+      sessionId: discovered.sessionId,
+      jsonlPath: discovered.jsonlPath
+    });
+  }
+  return entries;
+}
 async function dumpAgentContext(agentId, deps) {
   const agent = deps.agentRegistry.getById(agentId);
   if (!agent) {
@@ -28687,14 +29960,33 @@ async function dumpAgentContext(agentId, deps) {
   if (!workdir) {
     return { ok: false, files: [], scopeErrors: [], error: "agent has no working directory" };
   }
-  const dumpDir = path12.join(workdir, "sessioninfo");
+  const localWorkdir = await resolveDumpWorkdir(workdir, {
+    workspacesDir: deps.workspacesDir,
+    fallbackSegment: agentId,
+    agentId,
+    workdirOverrideStore: deps.workdirOverrideStore
+  });
+  const dumpDir = path12.join(localWorkdir, "sessioninfo");
   await fs6.mkdir(dumpDir, { recursive: true });
+  const projectsDirs = claudeProjectsDirs({ agentId, agentConfigDir: deps.agentConfigDir });
   const prefix = `${agentId}::`;
   const scopeEntries = [];
   for (const [key, sessionId] of deps.sessionStore.getAll()) {
     if (!key.startsWith(prefix)) continue;
     scopeEntries.push({ scopeKey: key.slice(prefix.length), sessionId });
   }
+  const existingScopeKeys = new Set(scopeEntries.map((entry) => entry.scopeKey));
+  scopeEntries.push(...await discoverMissingScopeEntries({
+    agentId,
+    agentWorkdir: workdir,
+    localWorkdir,
+    groupRegistry: deps.groupRegistry,
+    workspacesDir: deps.workspacesDir,
+    workdirOverrideStore: deps.workdirOverrideStore,
+    projectsDirs,
+    existingScopeKeys,
+    sessionStore: deps.sessionStore
+  }));
   logger17.info("Agent context dump started", {
     agentId,
     agentName: agent.name,
@@ -28719,26 +30011,61 @@ async function dumpAgentContext(agentId, deps) {
           error: infoErr
         });
       }
-      const scopeCwd = sessionInfo?.cwd || resolveScopeCwd(workdir, scopeKey2, deps.groupRegistry);
-      const jsonlPath = resolveJsonlPath(sessionId, scopeCwd);
-      let entries;
-      try {
-        entries = await readJsonlEntries(jsonlPath);
-      } catch (readErr) {
-        logger17.warn("JSONL read failed, trying alternative cwd", {
+      const registryScopeCwd = resolveScopeCwd(workdir, scopeKey2, deps.groupRegistry);
+      const fallbackSegment = scopeKey2.startsWith("group:") ? `Group-${scopeKey2.slice("group:".length)}` : agentId;
+      const cwdCandidates = uniquePaths([
+        ...sessionInfo?.cwd ? cwdCandidatesForBridge(sessionInfo.cwd, {
+          workspacesDir: deps.workspacesDir,
+          fallbackSegment,
+          workdirOverrideStore: deps.workdirOverrideStore
+        }) : [],
+        ...cwdCandidatesForBridge(registryScopeCwd, {
+          workspacesDir: deps.workspacesDir,
+          fallbackSegment,
+          workdirOverrideStore: deps.workdirOverrideStore
+        }),
+        localWorkdir
+      ]);
+      let resolvedSessionId = sessionId;
+      const { jsonlPath, checkedPaths, recovered } = await resolveDumpJsonlSource({
+        agentId,
+        scopeKey: scopeKey2,
+        sessionId,
+        cwdCandidates,
+        projectsDirs,
+        sessionStore: deps.sessionStore
+      });
+      resolvedSessionId = recovered ? path12.basename(jsonlPath, ".jsonl") : resolvedSessionId;
+      if (recovered) {
+        try {
+          const info = await sdk3.getSessionInfo(resolvedSessionId);
+          if (info) sessionInfo = info;
+        } catch (infoErr) {
+          logger17.warn("getSessionInfo failed for recovered scope", {
+            agentId,
+            scopeKey: scopeKey2,
+            sessionId: resolvedSessionId,
+            error: infoErr
+          });
+        }
+      }
+      const entries = await readJsonlEntries(jsonlPath);
+      if (recovered) {
+        logger17.info("Session JSONL recovered from local Claude project directory", {
           agentId,
           scopeKey: scopeKey2,
-          sessionId,
+          previousSessionId: sessionId,
+          sessionId: resolvedSessionId,
+          jsonlPath
+        });
+      } else if (!checkedPaths.includes(jsonlPath)) {
+        logger17.info("Session JSONL resolved by sessionId scan", {
+          agentId,
+          scopeKey: scopeKey2,
+          sessionId: resolvedSessionId,
           jsonlPath,
-          error: readErr instanceof Error ? readErr.message : String(readErr)
+          checkedPathCount: checkedPaths.length
         });
-        const altCwd = resolveScopeCwd(workdir, scopeKey2, deps.groupRegistry);
-        if (altCwd !== scopeCwd) {
-          const altPath = resolveJsonlPath(sessionId, altCwd);
-          entries = await readJsonlEntries(altPath);
-        } else {
-          throw readErr;
-        }
       }
       let groupName;
       if (scopeKey2.startsWith("group:")) {
@@ -28749,7 +30076,7 @@ async function dumpAgentContext(agentId, deps) {
         agentName: agent.name,
         agentId,
         scopeKey: scopeKey2,
-        sessionId,
+        sessionId: resolvedSessionId,
         systemPrompt: agent.systemPrompt,
         sessionInfo,
         entries,
@@ -28764,7 +30091,7 @@ async function dumpAgentContext(agentId, deps) {
       logger17.info("Scope context dumped", {
         agentId,
         scopeKey: scopeKey2,
-        sessionId,
+        sessionId: resolvedSessionId,
         filename,
         filePath,
         bytesWritten: stat3.size,
@@ -28790,6 +30117,7 @@ async function dumpAgentContext(agentId, deps) {
   return {
     ok,
     dir: dumpDir,
+    localDir: dumpDir,
     files: dumpedFiles,
     scopeErrors,
     error: ok ? void 0 : "no files written"
@@ -28894,7 +30222,6 @@ import path14 from "path";
 import os8 from "os";
 import readline from "readline";
 var logger19 = createModuleLogger("bridge.logScanner");
-var DEFAULT_LIMIT = 500;
 var MAX_LIMIT = 2e3;
 function listLogFiles(logsDir, baseName) {
   let names;
@@ -28904,10 +30231,11 @@ function listLogFiles(logsDir, baseName) {
     logger19.warn("listLogFiles: readdir failed", { logsDir, error: e });
     return [];
   }
-  const pattern = new RegExp(`^${baseName.replace(".", "\\.")}(\\.\\d+)?$`);
+  const escapedBaseName = baseName.replace(".", "\\.");
+  const pattern = new RegExp(`^${escapedBaseName}(?:[.-].+)?$`);
   return names.filter((n) => pattern.test(n)).map((n) => path14.join(logsDir, n));
 }
-async function scanFile(filePath, source, filter, limit, state) {
+async function scanFile(filePath, source, filter, state) {
   const file2 = path14.basename(filePath);
   const stream = fs8.createReadStream(filePath, { encoding: "utf-8" });
   const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
@@ -28919,35 +30247,40 @@ async function scanFile(filePath, source, filter, limit, state) {
     if (!parsed) continue;
     if (parsed.source !== source) continue;
     if (!matchesFilter(parsed, filter)) continue;
-    state.hits.push({ ...parsed, file: file2, lineNum });
-    if (state.hits.length > limit) {
-      state.truncated = true;
-      state.hits.length = limit;
-    }
+    state.hits.push({ ...parsed, raw: line, file: file2, lineNum });
   }
 }
 async function scanLocalLogs(logsDir, baseName, filter) {
-  const source = filter.source;
-  const limit = Math.min(Math.max(filter.limit ?? DEFAULT_LIMIT, 1), MAX_LIMIT);
+  const source = "bridge";
+  const limit = filter.limit == null ? null : Math.min(Math.max(filter.limit, 1), MAX_LIMIT);
+  const offset = Math.max(filter.offset ?? 0, 0);
   const files = listLogFiles(logsDir, baseName);
   const state = { hits: [], totalScanned: 0, truncated: false };
   for (const filePath of files) {
-    if (state.truncated) break;
     try {
-      await scanFile(filePath, source, filter, limit, state);
+      await scanFile(filePath, source, filter, state);
     } catch (e) {
       logger19.warn("scanLocalLogs: file read failed", { filePath, error: e });
     }
   }
-  state.hits.sort((a, b) => a.ts.localeCompare(b.ts));
+  state.hits.sort((a, b) => b.ts.localeCompare(a.ts));
+  const totalMatched = state.hits.length;
+  const endOffset = limit === null ? totalMatched : offset + limit;
+  const entries = state.hits.slice(offset, endOffset);
+  const nextOffset = endOffset < totalMatched ? endOffset : void 0;
+  if (nextOffset !== void 0) {
+    state.truncated = true;
+  }
   return {
-    entries: state.hits,
+    entries,
     truncated: state.truncated,
-    totalScanned: state.totalScanned
+    totalScanned: state.totalScanned,
+    totalMatched,
+    nextOffset
   };
 }
 async function scanBridgeLogs(filter) {
-  const logDir = path14.join(os8.homedir(), ".ahchat", "logs");
+  const logDir = path14.join(loadBridgeConfig().dataDir || path14.join(os8.homedir(), ".ahchat"), "logs");
   logger19.info("scanBridgeLogs start", {
     logDir,
     startIso: filter.startIso,
@@ -28957,36 +30290,295 @@ async function scanBridgeLogs(filter) {
   const result = await scanLocalLogs(logDir, "bridge.log", { ...filter, source: "bridge" });
   logger19.info("scanBridgeLogs complete", {
     hitCount: result.entries.length,
+    totalMatched: result.totalMatched,
+    nextOffset: result.nextOffset,
     totalScanned: result.totalScanned,
     truncated: result.truncated
   });
   return result;
 }
 
-// src/skillStore.ts
+// src/logUploader.ts
 import fs9 from "fs";
+import fsp from "fs/promises";
 import path15 from "path";
-var logger20 = createModuleLogger("bridge.skillStore");
+var logger20 = createModuleLogger("bridge.logUploader");
+var DEFAULT_LOG_UPLOAD_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_BATCH_SIZE = 200;
+function defaultLogFile(dataDir) {
+  return path15.join(dataDir, "logs", "bridge.log");
+}
+function defaultCursorFile(dataDir) {
+  return path15.join(dataDir, "log-upload-cursor.json");
+}
+function uploadedFileName(logFile, explicit) {
+  const trimmed = explicit?.trim();
+  return trimmed || path15.basename(logFile);
+}
+function normalizeTarget(file2, dataDir) {
+  const fileName = uploadedFileName(file2.logFile, file2.uploadedFileName);
+  const safeName = fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return {
+    logFile: file2.logFile,
+    cursorFile: file2.cursorFile ?? path15.join(dataDir, `log-upload-cursor-${safeName}.json`),
+    uploadedFileName: fileName
+  };
+}
+function cursorFileForLog(dataDir, fileName) {
+  const safeName = fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return path15.join(dataDir, `log-upload-cursor-${safeName}.json`);
+}
+function logFileFingerprint(stat3) {
+  if (typeof stat3.dev === "number" && typeof stat3.ino === "number" && stat3.ino > 0) {
+    return `${stat3.dev}:${stat3.ino}`;
+  }
+  return void 0;
+}
+async function listRotatedBridgeTargets(primary, dataDir) {
+  const logDir = path15.dirname(primary.logFile);
+  const baseName = path15.basename(primary.logFile);
+  let names;
+  try {
+    names = await fsp.readdir(logDir);
+  } catch (e) {
+    if (e instanceof Error && "code" in e && e.code === "ENOENT") return [];
+    throw e;
+  }
+  const escapedBaseName = baseName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`^${escapedBaseName}(?:[.-].+)?$`);
+  return names.filter((name) => pattern.test(name)).sort().map((name) => {
+    if (name === baseName) return primary;
+    return {
+      logFile: path15.join(logDir, name),
+      cursorFile: cursorFileForLog(dataDir, name),
+      uploadedFileName: name
+    };
+  });
+}
+function safeCursor(raw) {
+  if (typeof raw !== "object" || raw === null) return { offset: 0, lineNum: 0 };
+  const obj = raw;
+  return {
+    offset: typeof obj.offset === "number" && obj.offset > 0 ? Math.floor(obj.offset) : 0,
+    lineNum: typeof obj.lineNum === "number" && obj.lineNum > 0 ? Math.floor(obj.lineNum) : 0,
+    ...typeof obj.fingerprint === "string" && obj.fingerprint.length > 0 ? { fingerprint: obj.fingerprint } : {}
+  };
+}
+async function readCursor(filePath) {
+  try {
+    const raw = await fsp.readFile(filePath, "utf8");
+    return safeCursor(JSON.parse(raw));
+  } catch (e) {
+    if (e instanceof Error && "code" in e && e.code === "ENOENT") {
+      return { offset: 0, lineNum: 0 };
+    }
+    logger20.warn("Failed to read log upload cursor, restarting from beginning", { error: e });
+    return { offset: 0, lineNum: 0 };
+  }
+}
+async function writeCursor(filePath, cursor) {
+  await fsp.mkdir(path15.dirname(filePath), { recursive: true });
+  await fsp.writeFile(filePath, JSON.stringify(cursor), "utf8");
+}
+async function readStreamText(filePath, start) {
+  const stream = fs9.createReadStream(filePath, { start, encoding: "utf8" });
+  let raw = "";
+  for await (const chunk of stream) {
+    raw += chunk;
+  }
+  return raw;
+}
+function parseProcessedLines(raw, cursor, fileName, fingerprint) {
+  const lastNewline = raw.lastIndexOf("\n");
+  if (lastNewline < 0) {
+    return { entries: [], nextCursor: cursor, advanced: false };
+  }
+  const processed = raw.slice(0, lastNewline + 1);
+  const lines = processed.split(/\r?\n/);
+  const entries = [];
+  let lineNum = cursor.lineNum;
+  for (let i = 0; i < lines.length - 1; i += 1) {
+    const line = lines[i] ?? "";
+    lineNum += 1;
+    if (line.length === 0) continue;
+    const parsed = parseLogLine(line);
+    if (!parsed) continue;
+    entries.push({
+      ...parsed,
+      raw: line,
+      file: fileName,
+      lineNum
+    });
+  }
+  return {
+    entries,
+    nextCursor: {
+      offset: cursor.offset + Buffer.byteLength(processed, "utf8"),
+      lineNum,
+      ...fingerprint ? { fingerprint } : {}
+    },
+    advanced: true
+  };
+}
+function chunkEntries(entries, size) {
+  const chunks = [];
+  for (let i = 0; i < entries.length; i += size) {
+    chunks.push(entries.slice(i, i + size));
+  }
+  return chunks;
+}
+var BridgeLogUploader = class {
+  options;
+  timer = null;
+  running = false;
+  stopped = false;
+  constructor(options) {
+    const primaryTarget = {
+      logFile: options.logFile ?? defaultLogFile(options.dataDir),
+      cursorFile: options.cursorFile ?? defaultCursorFile(options.dataDir),
+      uploadedFileName: uploadedFileName(options.logFile ?? defaultLogFile(options.dataDir), "bridge.log")
+    };
+    this.options = {
+      dataDir: options.dataDir,
+      serverApiUrl: options.serverApiUrl.replace(/\/+$/, ""),
+      bridgeToken: options.bridgeToken,
+      bridgeId: options.bridgeId,
+      hostname: options.hostname,
+      intervalMs: options.intervalMs ?? DEFAULT_LOG_UPLOAD_INTERVAL_MS,
+      batchSize: options.batchSize ?? DEFAULT_BATCH_SIZE,
+      primaryTarget,
+      extraTargets: (options.extraLogFiles ?? []).map((file2) => normalizeTarget(file2, options.dataDir)),
+      includeRotatedBridgeLogs: options.includeRotatedBridgeLogs ?? true
+    };
+  }
+  start() {
+    if (this.timer) return;
+    this.stopped = false;
+    this.timer = setInterval(() => {
+      void this.flushOnce();
+    }, this.options.intervalMs);
+    void this.flushOnce();
+    logger20.info("Bridge log uploader started", {
+      logFile: this.options.primaryTarget.logFile,
+      includeRotatedBridgeLogs: this.options.includeRotatedBridgeLogs,
+      intervalMs: this.options.intervalMs,
+      batchSize: this.options.batchSize
+    });
+  }
+  stop() {
+    this.stopped = true;
+    if (!this.timer) return;
+    clearInterval(this.timer);
+    this.timer = null;
+    logger20.info("Bridge log uploader stopped");
+  }
+  async flushOnce() {
+    if (this.running || this.stopped) return;
+    this.running = true;
+    try {
+      const targets = await this.resolveTargets();
+      for (const target of targets) {
+        try {
+          const cursor = await readCursor(target.cursorFile);
+          const batch = await this.readNewEntries(target, cursor);
+          if (!batch.advanced) continue;
+          if (batch.entries.length > 0) {
+            await this.uploadEntries(batch.entries);
+          }
+          await writeCursor(target.cursorFile, batch.nextCursor);
+        } catch (e) {
+          logger20.warn("Bridge log upload target failed", { error: e, logFile: target.logFile });
+        }
+      }
+    } catch (e) {
+      logger20.warn("Bridge log upload cycle failed", { error: e });
+    } finally {
+      this.running = false;
+    }
+  }
+  async resolveTargets() {
+    const bridgeTargets = this.options.includeRotatedBridgeLogs ? await listRotatedBridgeTargets(this.options.primaryTarget, this.options.dataDir) : [this.options.primaryTarget];
+    const seen = /* @__PURE__ */ new Set();
+    const targets = [];
+    for (const target of [...bridgeTargets, ...this.options.extraTargets]) {
+      const key = `${target.logFile}\0${target.cursorFile}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      targets.push(target);
+    }
+    return targets;
+  }
+  async readNewEntries(target, cursor) {
+    let stat3;
+    try {
+      stat3 = await fsp.stat(target.logFile);
+    } catch (e) {
+      if (e instanceof Error && "code" in e && e.code === "ENOENT") {
+        logger20.debug("Bridge log file not found for upload yet", { logFile: target.logFile });
+        return { entries: [], nextCursor: cursor, advanced: false };
+      }
+      throw e;
+    }
+    const fingerprint = logFileFingerprint(stat3);
+    const samePhysicalFile = !fingerprint || !cursor.fingerprint || cursor.fingerprint === fingerprint;
+    const normalizedCursor = stat3.size < cursor.offset || !samePhysicalFile ? { offset: 0, lineNum: 0, ...fingerprint ? { fingerprint } : {} } : { ...cursor, ...fingerprint ? { fingerprint } : {} };
+    if (stat3.size <= normalizedCursor.offset) {
+      return { entries: [], nextCursor: normalizedCursor, advanced: false };
+    }
+    const raw = await readStreamText(target.logFile, normalizedCursor.offset);
+    return parseProcessedLines(raw, normalizedCursor, target.uploadedFileName, fingerprint);
+  }
+  async uploadEntries(entries) {
+    const bridgeEntries = entries.filter((entry) => entry.source === "bridge");
+    for (const chunk of chunkEntries(bridgeEntries, this.options.batchSize)) {
+      const res = await fetch(`${this.options.serverApiUrl}/api/logs/upload`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-AHChat-Bridge-Token": this.options.bridgeToken
+        },
+        body: JSON.stringify({
+          bridgeId: this.options.bridgeId,
+          hostname: this.options.hostname,
+          entries: chunk
+        })
+      });
+      if (!res.ok) {
+        const body = await res.text().catch((e) => {
+          logger20.debug("Failed to read log upload error body", { error: e });
+          return "";
+        });
+        throw new Error(`upload failed HTTP ${res.status}: ${body.slice(0, 160)}`);
+      }
+      await res.json();
+    }
+  }
+};
+
+// src/skillStore.ts
+import fs10 from "fs";
+import path16 from "path";
+var logger21 = createModuleLogger("bridge.skillStore");
 var ALLOWED_NAMES = /* @__PURE__ */ new Set(["log-analysis"]);
 var SkillStore = class {
   skillsDir;
   constructor(dataDir) {
-    this.skillsDir = path15.join(dataDir, "skills");
-    fs9.mkdirSync(this.skillsDir, { recursive: true });
-    logger20.info("SkillStore initialized", { skillsDir: this.skillsDir });
+    this.skillsDir = path16.join(dataDir, "skills");
+    fs10.mkdirSync(this.skillsDir, { recursive: true });
+    logger21.info("SkillStore initialized", { skillsDir: this.skillsDir });
   }
   read(name) {
     if (!ALLOWED_NAMES.has(name)) {
-      logger20.warn("Skill read: unknown name", { name, allowed: [...ALLOWED_NAMES] });
+      logger21.warn("Skill read: unknown name", { name, allowed: [...ALLOWED_NAMES] });
       return "";
     }
-    const filePath = path15.join(this.skillsDir, `${name}.md`);
+    const filePath = path16.join(this.skillsDir, `${name}.md`);
     try {
-      const content = fs9.readFileSync(filePath, "utf-8");
-      logger20.info("Skill read", { name, bytes: content.length });
+      const content = fs10.readFileSync(filePath, "utf-8");
+      logger21.info("Skill read", { name, bytes: content.length });
       return content;
     } catch (e) {
-      logger20.warn("Skill read failed", { name, filePath, error: e });
+      logger21.warn("Skill read failed", { name, filePath, error: e });
       return "";
     }
   }
@@ -28995,20 +30587,20 @@ var SkillStore = class {
     if (!ALLOWED_NAMES.has(name)) {
       throw new Error(`Unknown skill name: ${name}`);
     }
-    const filePath = path15.join(this.skillsDir, `${name}.md`);
+    const filePath = path16.join(this.skillsDir, `${name}.md`);
     const tmpPath = `${filePath}.tmp`;
     let existing = "";
     try {
-      existing = fs9.readFileSync(filePath, "utf-8");
+      existing = fs10.readFileSync(filePath, "utf-8");
     } catch {
     }
     if (existing === content) {
-      logger20.info("Skill already in sync", { name, bytes: content.length });
+      logger21.info("Skill already in sync", { name, bytes: content.length });
       return;
     }
-    fs9.writeFileSync(tmpPath, content, "utf-8");
-    fs9.renameSync(tmpPath, filePath);
-    logger20.info("Skill seeded/re-synced", {
+    fs10.writeFileSync(tmpPath, content, "utf-8");
+    fs10.renameSync(tmpPath, filePath);
+    logger21.info("Skill seeded/re-synced", {
       name,
       bytes: content.length,
       hadExisting: existing.length > 0
@@ -29017,11 +30609,29 @@ var SkillStore = class {
 };
 
 // src/lockfile.ts
-import fs10 from "fs";
-import path16 from "path";
-var logger21 = createModuleLogger("bridge.lockfile");
+import * as childProcess from "child_process";
+import fs11 from "fs";
+import path17 from "path";
+var logger22 = createModuleLogger("bridge.lockfile");
 var lockPath = null;
 var releaseRegistered = false;
+var BridgeAlreadyRunningError = class _BridgeAlreadyRunningError extends Error {
+  pid;
+  dataDir;
+  constructor(pid, dataDir) {
+    super(`Bridge already running (PID: ${pid})`);
+    this.name = "BridgeAlreadyRunningError";
+    this.pid = pid;
+    this.dataDir = dataDir;
+    Object.setPrototypeOf(this, _BridgeAlreadyRunningError.prototype);
+  }
+};
+function isBridgeAlreadyRunningError(e) {
+  if (e instanceof BridgeAlreadyRunningError) return true;
+  if (!e || typeof e !== "object") return false;
+  const candidate = e;
+  return candidate.name === "BridgeAlreadyRunningError" && typeof candidate.pid === "number" && typeof candidate.dataDir === "string";
+}
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -29029,25 +30639,95 @@ function isProcessAlive(pid) {
   } catch (e) {
     const err = e;
     if (err.code === "ESRCH") return false;
+    if (err.code === "EPERM") {
+      logger22.warn("Treating inaccessible lock PID as stale", { pid, error: e });
+      return false;
+    }
     throw e;
   }
 }
+function readWindowsProcessCommand(pid) {
+  const commands = [
+    {
+      file: "wmic",
+      args: ["process", "where", `processid=${pid}`, "get", "Name,CommandLine", "/FORMAT:LIST"]
+    },
+    {
+      file: "powershell.exe",
+      args: [
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        '$p = Get-CimInstance Win32_Process -Filter "ProcessId = ' + pid + '"; if ($null -ne $p) { "$($p.Name)`n$($p.CommandLine)" }'
+      ]
+    }
+  ];
+  for (const command of commands) {
+    try {
+      const output = childProcess.execFileSync(command.file, command.args, {
+        encoding: "utf-8",
+        windowsHide: true,
+        timeout: 1e3
+      });
+      const normalizedOutput = output.replace(/\0/g, "");
+      if (normalizedOutput.trim()) return normalizedOutput;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function readProcessCommand(pid) {
+  if (pid === process.pid) return [process.execPath, ...process.argv].join(" ");
+  try {
+    if (process.platform === "win32") {
+      return readWindowsProcessCommand(pid);
+    }
+    const procCmdline = `/proc/${pid}/cmdline`;
+    if (fs11.existsSync(procCmdline)) {
+      return fs11.readFileSync(procCmdline, "utf-8").replace(/\0/g, " ");
+    }
+    return childProcess.execFileSync("ps", ["-p", String(pid), "-o", "comm=", "-o", "args="], {
+      encoding: "utf-8",
+      timeout: 3e3
+    });
+  } catch (e) {
+    logger22.warn("Failed to inspect lock PID command line", { pid, error: e });
+    return null;
+  }
+}
+function isBridgeProcessCommand(command) {
+  if (!command) return false;
+  const normalized = command.toLowerCase();
+  return normalized.includes("ahchat-bridge") || normalized.includes("bridge.cjs") || normalized.includes("dist/cli.cjs") || normalized.includes("dist\\cli.cjs") || normalized.includes("--type=utility") && normalized.includes("--utility-sub-type=node.mojom.nodeservice");
+}
+function isLiveBridgeLockOwner(pid) {
+  if (!isProcessAlive(pid)) return false;
+  if (pid === process.pid) return true;
+  const command = readProcessCommand(pid);
+  if (isBridgeProcessCommand(command)) return true;
+  const processName = command?.split(/\r?\n/)[0]?.trim() ?? null;
+  logger22.warn("Treating bridge.lock PID as stale because it is not a Bridge process", { pid, processName });
+  return false;
+}
 function acquireLock(dataDir) {
-  const file2 = path16.join(dataDir, "bridge.lock");
+  const file2 = path17.join(dataDir, "bridge.lock");
   lockPath = file2;
-  if (fs10.existsSync(file2)) {
-    const raw = fs10.readFileSync(file2, "utf-8").trim();
+  if (fs11.existsSync(file2)) {
+    const raw = fs11.readFileSync(file2, "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isFinite(pid) && pid > 0) {
-      if (isProcessAlive(pid)) {
-        throw new Error(`Bridge already running (PID: ${pid})`);
+      if (isLiveBridgeLockOwner(pid)) {
+        throw new BridgeAlreadyRunningError(pid, dataDir);
       }
-      logger21.warn("Removing stale bridge.lock (process not found)", { pid, path: file2 });
+      logger22.info("Removing stale bridge.lock", { pid, path: file2 });
     }
   }
-  fs10.mkdirSync(path16.dirname(file2), { recursive: true });
-  fs10.writeFileSync(file2, String(process.pid), "utf-8");
-  logger21.info("Acquired bridge lock", { path: file2, pid: process.pid });
+  fs11.mkdirSync(path17.dirname(file2), { recursive: true });
+  fs11.writeFileSync(file2, String(process.pid), "utf-8");
+  logger22.info("Acquired bridge lock", { path: file2, pid: process.pid });
   if (!releaseRegistered) {
     releaseRegistered = true;
     process.on("exit", releaseLock);
@@ -29055,20 +30735,46 @@ function acquireLock(dataDir) {
 }
 function releaseLock() {
   try {
-    if (lockPath && fs10.existsSync(lockPath)) {
-      const current = fs10.readFileSync(lockPath, "utf-8").trim();
+    if (lockPath && fs11.existsSync(lockPath)) {
+      const current = fs11.readFileSync(lockPath, "utf-8").trim();
       if (current === String(process.pid)) {
-        fs10.unlinkSync(lockPath);
-        logger21.info("Released bridge lock", { path: lockPath });
+        fs11.unlinkSync(lockPath);
+        logger22.info("Released bridge lock", { path: lockPath });
       }
     }
   } catch (e) {
-    logger21.error("Failed to release bridge lock", { error: e, path: lockPath });
+    logger22.error("Failed to release bridge lock", { error: e, path: lockPath });
   } finally {
     lockPath = null;
   }
 }
 
+// src/localWorkdirOverrideStore.ts
+import fs12 from "fs";
+import path18 from "path";
+var logger23 = createModuleLogger("bridge.localWorkdirOverride");
+var LocalWorkdirOverrideStore = class {
+  filePath;
+  constructor(dataDir) {
+    this.filePath = path18.join(dataDir, LOCAL_WORKDIR_OVERRIDES_FILENAME);
+  }
+  read() {
+    try {
+      const raw = fs12.readFileSync(this.filePath, "utf8");
+      return normalizeLocalWorkdirOverridesFile(JSON.parse(raw)).overrides;
+    } catch (error51) {
+      if (error51 instanceof Error && "code" in error51 && error51.code === "ENOENT") return [];
+      logger23.warn("Failed to read local workdir overrides", { filePath: this.filePath, error: error51 });
+      return [];
+    }
+  }
+  resolvePath(requestedPath) {
+    const resolved = resolveLocalWorkdirOverridePath(this.read(), requestedPath);
+    if (!resolved) return { path: requestedPath, overridden: false };
+    return { path: resolved.path, overridden: true };
+  }
+};
+
 // src/groupInbox.ts
 function groupInboxEntryFromDispatch(payload) {
   return {
@@ -29099,9 +30805,9 @@ function groupInboxEntryFromDispatch(payload) {
 }
 
 // src/messageHandler.ts
-var logger22 = createModuleLogger("msg.handler");
+var logger24 = createModuleLogger("msg.handler");
 function emitTaskAck(emit, ackId, agentId, traceId) {
-  logger22.info("Emitting task:ack", { ackId, agentId, traceId });
+  logger24.info("Emitting task:ack", { ackId, agentId, traceId });
   emit({
     type: "task:ack",
     payload: {
@@ -29114,7 +30820,7 @@ function emitTaskAck(emit, ackId, agentId, traceId) {
 }
 function createTaskDispatchHandler(agentManager, agentRegistry, emit) {
   return async (payload) => {
-    logger22.info("Handling task:dispatch", {
+    logger24.info("Handling task:dispatch", {
       agentId: payload.agentId,
       messageId: payload.messageId,
       ackId: payload.ackId,
@@ -29123,14 +30829,14 @@ function createTaskDispatchHandler(agentManager, agentRegistry, emit) {
     emitTaskAck(emit, payload.ackId, payload.agentId, payload.traceId);
     let agentConfig = agentRegistry.getById(payload.agentId);
     if (!agentConfig) {
-      logger22.warn("Agent not in registry, attempting live fetch", {
+      logger24.warn("Agent not in registry, attempting live fetch", {
         agentId: payload.agentId,
         traceId: payload.traceId
       });
       agentConfig = await agentRegistry.fetchById(payload.agentId);
     }
     if (!agentConfig) {
-      logger22.error("Agent not found for task:dispatch (after live fetch)", {
+      logger24.error("Agent not found for task:dispatch (after live fetch)", {
         agentId: payload.agentId,
         traceId: payload.traceId
       });
@@ -29154,12 +30860,13 @@ function createTaskDispatchHandler(agentManager, agentRegistry, emit) {
         conversationId: payload.conversationId,
         content: payload.content,
         attachments: payload.attachments ?? void 0,
+        replyToMessage: payload.replyToMessage ?? void 0,
         replyMessageId: payload.ackId,
         traceId: payload.traceId,
         planMode: payload.planMode ?? void 0
       });
     } catch (err) {
-      logger22.error("Failed to dispatch message to Agent", {
+      logger24.error("Failed to dispatch message to Agent", {
         error: err,
         agentId: payload.agentId,
         traceId: payload.traceId
@@ -29179,7 +30886,7 @@ function createTaskDispatchHandler(agentManager, agentRegistry, emit) {
 }
 function createGroupTaskDispatchHandler(agentManager, agentRegistry, emit) {
   return async (payload) => {
-    logger22.info("Handling task:group_dispatch", {
+    logger24.info("Handling task:group_dispatch", {
       agentId: payload.agentId,
       groupId: payload.groupId,
       ackId: payload.ackId,
@@ -29191,14 +30898,14 @@ function createGroupTaskDispatchHandler(agentManager, agentRegistry, emit) {
     emitTaskAck(emit, payload.ackId, payload.agentId, payload.traceId);
     let agentConfig = agentRegistry.getById(payload.agentId);
     if (!agentConfig) {
-      logger22.warn("Agent not in registry for group dispatch, attempting live fetch", {
+      logger24.warn("Agent not in registry for group dispatch, attempting live fetch", {
         agentId: payload.agentId,
         traceId: payload.traceId
       });
       agentConfig = await agentRegistry.fetchById(payload.agentId);
     }
     if (!agentConfig) {
-      logger22.error("Agent not found for task:group_dispatch (after live fetch)", {
+      logger24.error("Agent not found for task:group_dispatch (after live fetch)", {
         agentId: payload.agentId,
         traceId: payload.traceId
       });
@@ -29223,7 +30930,7 @@ function createGroupTaskDispatchHandler(agentManager, agentRegistry, emit) {
       );
       const entry = groupInboxEntryFromDispatch(payload);
       if (payload.isMentioned) {
-        logger22.info("Group dispatch routed to pull inbox", {
+        logger24.info("Group dispatch routed to pull inbox", {
           route: "mention_flush",
           agentId: payload.agentId,
           groupId: payload.groupId,
@@ -29232,7 +30939,7 @@ function createGroupTaskDispatchHandler(agentManager, agentRegistry, emit) {
         });
         await agentManager.flushInboxAndDispatch(payload.agentId, groupScope, entry);
       } else {
-        logger22.info("Group dispatch routed to pull inbox", {
+        logger24.info("Group dispatch routed to pull inbox", {
           route: "buffer",
           agentId: payload.agentId,
           groupId: payload.groupId,
@@ -29242,7 +30949,7 @@ function createGroupTaskDispatchHandler(agentManager, agentRegistry, emit) {
         agentManager.enqueueGroupMessage(payload.agentId, groupScope, entry);
       }
     } catch (err) {
-      logger22.error("Failed to dispatch group message to Agent", {
+      logger24.error("Failed to dispatch group message to Agent", {
         error: err,
         agentId: payload.agentId,
         groupId: payload.groupId,
@@ -29263,7 +30970,7 @@ function createGroupTaskDispatchHandler(agentManager, agentRegistry, emit) {
 }
 
 // src/scopePushNotify.ts
-var logger23 = createModuleLogger("bridge");
+var logger25 = createModuleLogger("bridge");
 function buildMemberChangedScopeNotice(params) {
   const { groupId, groupLabel, action, kickerName } = params;
   if (action === "removed" && kickerName) {
@@ -29312,14 +31019,14 @@ function buildGroupRenamedScopeNotice(params) {
 }
 async function handleGroupMemberChangedPush(deps, payload) {
   const { groupId, action, agentId, kickerAgentId } = payload;
-  logger23.info("group:member_changed received, refreshing GroupRegistry", {
+  logger25.info("group:member_changed received, refreshing GroupRegistry", {
     groupId,
     action,
     agentId,
     kickerAgentId: kickerAgentId ?? null
   });
   await deps.groupRegistry.refresh();
-  logger23.info("GroupRegistry refreshed after member_changed", {
+  logger25.info("GroupRegistry refreshed after member_changed", {
     groupId,
     action,
     registryGroupCount: deps.groupRegistry.getAll().length
@@ -29341,7 +31048,7 @@ async function handleGroupMemberChangedPush(deps, payload) {
       await deps.agentManager.broadcastScopeNotice(mid, notice2);
       notifiedCount++;
     }
-    logger23.info("Scope notice sent (human membership)", {
+    logger25.info("Scope notice sent (human membership)", {
       groupId,
       groupLabel,
       action,
@@ -29353,7 +31060,7 @@ async function handleGroupMemberChangedPush(deps, payload) {
   }
   const notice = buildMemberChangedScopeNotice({ groupId, groupLabel, action, kickerName });
   await deps.agentManager.broadcastScopeNotice(agentId, notice);
-  logger23.info("Scope notice sent (agent membership)", {
+  logger25.info("Scope notice sent (agent membership)", {
     groupId,
     groupLabel,
     action,
@@ -29365,13 +31072,13 @@ async function handleGroupMemberChangedPush(deps, payload) {
 }
 async function handleGroupUpdatedPush(deps, payload) {
   const { groupId, name: newName, memberAgentIds } = payload;
-  logger23.info("group:updated received, refreshing GroupRegistry", {
+  logger25.info("group:updated received, refreshing GroupRegistry", {
     groupId,
     newName,
     memberCount: memberAgentIds.length
   });
   await deps.groupRegistry.refresh();
-  logger23.info("GroupRegistry refreshed after group:updated", {
+  logger25.info("GroupRegistry refreshed after group:updated", {
     groupId,
     newName,
     registryGroupCount: deps.groupRegistry.getAll().length
@@ -29380,7 +31087,7 @@ async function handleGroupUpdatedPush(deps, payload) {
   for (const aid of memberAgentIds) {
     await deps.agentManager.broadcastScopeNotice(aid, notice);
   }
-  logger23.info("Scope notices sent for group:updated", {
+  logger25.info("Scope notices sent for group:updated", {
     groupId,
     newName,
     memberCount: memberAgentIds.length,
@@ -29389,28 +31096,28 @@ async function handleGroupUpdatedPush(deps, payload) {
 }
 async function handleGroupArchivedPush(deps, payload) {
   const { groupId } = payload;
-  logger23.info("group:archived received, terminating group scope sessions", { groupId });
+  logger25.info("group:archived received, terminating group scope sessions", { groupId });
   const groupBefore = deps.groupRegistry.getById(groupId);
   const memberIds = groupBefore?.members ?? [];
   await deps.groupRegistry.refresh();
   for (const memberId of memberIds) {
     await deps.agentManager.terminateScope(memberId, { kind: "group", groupId });
   }
-  logger23.info("group:archived: scopes terminated", {
+  logger25.info("group:archived: scopes terminated", {
     groupId,
     terminatedCount: memberIds.length
   });
 }
 
 // src/sessionStore.ts
-import fs11 from "fs";
-import path17 from "path";
-var logger24 = createModuleLogger("session.store");
+import fs13 from "fs";
+import path19 from "path";
+var logger26 = createModuleLogger("session.store");
 var SessionStore = class {
   filePath;
   cache;
   constructor(dataDir) {
-    this.filePath = path17.join(dataDir, "sessions.json");
+    this.filePath = path19.join(dataDir, "sessions.json");
     this.cache = this.loadFromDisk();
   }
   cacheKey(agentId, scope) {
@@ -29445,8 +31152,8 @@ var SessionStore = class {
   }
   loadFromDisk() {
     try {
-      if (!fs11.existsSync(this.filePath)) return {};
-      const raw = fs11.readFileSync(this.filePath, "utf-8");
+      if (!fs13.existsSync(this.filePath)) return {};
+      const raw = fs13.readFileSync(this.filePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
       const map2 = parsed;
@@ -29456,7 +31163,7 @@ var SessionStore = class {
           migrated[key] = sessionId;
         } else {
           migrated[`${key}::single`] = sessionId;
-          logger24.info("Migrated legacy session key to scoped key", {
+          logger26.info("Migrated legacy session key to scoped key", {
             legacyKey: key,
             newKey: `${key}::single`
           });
@@ -29464,17 +31171,17 @@ var SessionStore = class {
       }
       return migrated;
     } catch (e) {
-      logger24.warn("Failed to load sessions file, starting fresh", { error: e, path: this.filePath });
+      logger26.warn("Failed to load sessions file, starting fresh", { error: e, path: this.filePath });
       return {};
     }
   }
   saveToDisk() {
     try {
-      const dir = path17.dirname(this.filePath);
-      fs11.mkdirSync(dir, { recursive: true });
-      fs11.writeFileSync(this.filePath, JSON.stringify(this.cache, null, 2), "utf-8");
+      const dir = path19.dirname(this.filePath);
+      fs13.mkdirSync(dir, { recursive: true });
+      fs13.writeFileSync(this.filePath, JSON.stringify(this.cache, null, 2), "utf-8");
     } catch (e) {
-      logger24.error("Failed to save sessions file", { error: e, path: this.filePath });
+      logger26.error("Failed to save sessions file", { error: e, path: this.filePath });
     }
   }
 };
@@ -29482,8 +31189,8 @@ var SessionStore = class {
 // src/claudeRuntime.ts
 import { accessSync as accessSync2, constants as constants3, existsSync as existsSync2, readdirSync as readdirSync2, realpathSync } from "fs";
 import { createRequire } from "module";
-import path18 from "path";
-var logger25 = createModuleLogger("bridge.claudeRuntime");
+import path20 from "path";
+var logger27 = createModuleLogger("bridge.claudeRuntime");
 var require2 = createRequire(import.meta.url);
 var EXPLICIT_CLAUDE_EXECUTABLE_ENV = "AHCHAT_CLAUDE_EXECUTABLE";
 var BUNDLED_CLAUDE_PATH_ENV = "AHCHAT_BUNDLED_CLAUDE_PATH";
@@ -29491,7 +31198,7 @@ function normalizePath(value) {
   const trimmed = value?.trim();
   if (!trimmed) return void 0;
   const expanded = resolveUserPath(trimmed);
-  return path18.isAbsolute(expanded) ? expanded : path18.resolve(expanded);
+  return path20.isAbsolute(expanded) ? expanded : path20.resolve(expanded);
 }
 function canExecute2(candidate) {
   try {
@@ -29570,16 +31277,16 @@ function resolveClaudeAgentSdkDir() {
   const sdkEntry = safeResolve("@anthropic-ai/claude-agent-sdk");
   if (!sdkEntry) return void 0;
   try {
-    return path18.dirname(realpathSync(sdkEntry));
+    return path20.dirname(realpathSync(sdkEntry));
   } catch {
-    return path18.dirname(sdkEntry);
+    return path20.dirname(sdkEntry);
   }
 }
 function findPnpmStoreDir(fromDir) {
   let current = fromDir;
-  while (current !== path18.dirname(current)) {
-    if (path18.basename(current) === ".pnpm") return current;
-    current = path18.dirname(current);
+  while (current !== path20.dirname(current)) {
+    if (path20.basename(current) === ".pnpm") return current;
+    current = path20.dirname(current);
   }
   return void 0;
 }
@@ -29595,7 +31302,7 @@ function resolvePnpmRuntimeBinary(sdkDir, target) {
   }
   for (const entry of entries) {
     if (!entry.startsWith(`${encodedName}@`)) continue;
-    const candidate = path18.join(
+    const candidate = path20.join(
       pnpmStoreDir,
       entry,
       "node_modules",
@@ -29614,8 +31321,8 @@ function resolveSdkRuntimeBinary(target) {
   const scopedPackageName = target.packageName.split("/")[1] ?? target.packageName;
   const candidates = [
     safeResolve(`${target.packageName}/${target.binaryName}`, [sdkDir]),
-    path18.join(sdkDir, "..", scopedPackageName, target.binaryName),
-    path18.join(sdkDir, "node_modules", ...target.packageName.split("/"), target.binaryName),
+    path20.join(sdkDir, "..", scopedPackageName, target.binaryName),
+    path20.join(sdkDir, "node_modules", ...target.packageName.split("/"), target.binaryName),
     resolvePnpmRuntimeBinary(sdkDir, target)
   ].filter((candidate) => Boolean(candidate));
   return candidates.find((candidate) => existsSync2(candidate));
@@ -29732,14 +31439,14 @@ function resolveClaudeRuntime(env2 = process.env) {
 }
 function logClaudeRuntimeResolution(resolution) {
   if (resolution.ok) {
-    logger25.info("Claude runtime ready", {
+    logger27.info("Claude runtime ready", {
       source: resolution.source,
       path: resolution.path ?? null,
       version: resolution.version ?? null
     });
     return;
   }
-  logger25.error("Claude runtime unavailable", {
+  logger27.error("Claude runtime unavailable", {
     error: new Error(resolution.error ?? "Claude runtime unavailable"),
     source: resolution.source,
     attempts: resolution.attempts
@@ -29747,27 +31454,27 @@ function logClaudeRuntimeResolution(resolution) {
 }
 
 // src/forkAgentFiles.ts
-import * as fs12 from "fs/promises";
-import * as path20 from "path";
+import * as fs14 from "fs/promises";
+import * as path22 from "path";
 
 // src/sessionSlug.ts
 import os9 from "os";
-import path19 from "path";
-var CLAUDE_PROJECTS_DIR = path19.join(os9.homedir(), ".claude", "projects");
+import path21 from "path";
+var CLAUDE_PROJECTS_DIR = path21.join(os9.homedir(), ".claude", "projects");
 function cwdToSlug(cwd) {
   return cwd.replace(/[^a-zA-Z0-9-]/g, "-");
 }
 function sessionDirForCwd(cwd) {
-  return path19.join(CLAUDE_PROJECTS_DIR, cwdToSlug(cwd));
+  return path21.join(CLAUDE_PROJECTS_DIR, cwdToSlug(cwd));
 }
 function sessionFilePath(cwd, sessionId) {
-  return path19.join(sessionDirForCwd(cwd), `${sessionId}.jsonl`);
+  return path21.join(sessionDirForCwd(cwd), `${sessionId}.jsonl`);
 }
 
 // src/forkAgentFiles.ts
-var logger26 = createModuleLogger("bridge.forkAgentFiles");
+var logger28 = createModuleLogger("bridge.forkAgentFiles");
 async function forkAgentFiles(sourceAgentId, newAgentId, sourceWorkdir, newWorkdir, dataDir, sessionStore, sourceConversationId) {
-  logger26.info("Fork file copy starting", {
+  logger28.info("Fork file copy starting", {
     sourceAgentId,
     newAgentId,
     sourceWorkdir,
@@ -29776,57 +31483,57 @@ async function forkAgentFiles(sourceAgentId, newAgentId, sourceWorkdir, newWorkd
     sourceConversationId
   });
   try {
-    const stat3 = await fs12.stat(sourceWorkdir).catch(() => null);
+    const stat3 = await fs14.stat(sourceWorkdir).catch(() => null);
     if (stat3?.isDirectory()) {
-      await fs12.cp(sourceWorkdir, newWorkdir, { recursive: true });
-      logger26.info("Workdir copied", {
+      await fs14.cp(sourceWorkdir, newWorkdir, { recursive: true });
+      logger28.info("Workdir copied", {
         from: sourceWorkdir,
         to: newWorkdir
       });
     } else {
-      await fs12.mkdir(newWorkdir, { recursive: true });
-      logger26.info("Workdir created (source did not exist)", {
+      await fs14.mkdir(newWorkdir, { recursive: true });
+      logger28.info("Workdir created (source did not exist)", {
         newWorkdir
       });
     }
   } catch (e) {
-    logger26.error("Workdir copy failed", { error: e });
+    logger28.error("Workdir copy failed", { error: e });
     throw e;
   }
-  const srcNotebook = path20.join(dataDir, "agent-memory", sourceAgentId, "notebook.md");
-  const dstNotebookDir = path20.join(dataDir, "agent-memory", newAgentId);
-  const dstNotebook = path20.join(dstNotebookDir, "notebook.md");
+  const srcNotebook = path22.join(dataDir, "agent-memory", sourceAgentId, "notebook.md");
+  const dstNotebookDir = path22.join(dataDir, "agent-memory", newAgentId);
+  const dstNotebook = path22.join(dstNotebookDir, "notebook.md");
   try {
-    const nbStat = await fs12.stat(srcNotebook).catch(() => null);
+    const nbStat = await fs14.stat(srcNotebook).catch(() => null);
     if (nbStat?.isFile()) {
-      await fs12.mkdir(dstNotebookDir, { recursive: true });
-      await fs12.copyFile(srcNotebook, dstNotebook);
-      logger26.info("Notebook copied", {
+      await fs14.mkdir(dstNotebookDir, { recursive: true });
+      await fs14.copyFile(srcNotebook, dstNotebook);
+      logger28.info("Notebook copied", {
         from: srcNotebook,
         to: dstNotebook
       });
     } else {
-      logger26.info("Notebook copy skipped (source does not exist)", {
+      logger28.info("Notebook copy skipped (source does not exist)", {
         sourceAgentId
       });
     }
   } catch (e) {
-    logger26.error("Notebook copy failed", { error: e });
+    logger28.error("Notebook copy failed", { error: e });
   }
   let sessionCopied = false;
   const sourceSessionId = sessionStore.get(sourceAgentId, { kind: "single" });
   if (sourceSessionId) {
     try {
       const srcPath = sessionFilePath(sourceWorkdir, sourceSessionId);
-      const srcStat = await fs12.stat(srcPath).catch(() => null);
+      const srcStat = await fs14.stat(srcPath).catch(() => null);
       if (srcStat?.isFile()) {
         const dstDir = sessionDirForCwd(newWorkdir);
-        await fs12.mkdir(dstDir, { recursive: true });
-        const dstPath = path20.join(dstDir, `${sourceSessionId}.jsonl`);
-        await fs12.copyFile(srcPath, dstPath);
+        await fs14.mkdir(dstDir, { recursive: true });
+        const dstPath = path22.join(dstDir, `${sourceSessionId}.jsonl`);
+        await fs14.copyFile(srcPath, dstPath);
         sessionStore.set(newAgentId, { kind: "single" }, sourceSessionId);
         sessionCopied = true;
-        logger26.info("Session JSONL copied and registered", {
+        logger28.info("Session JSONL copied and registered", {
           sourceAgentId,
           newAgentId,
           sessionId: sourceSessionId,
@@ -29835,30 +31542,30 @@ async function forkAgentFiles(sourceAgentId, newAgentId, sourceWorkdir, newWorkd
           fileSize: srcStat.size
         });
       } else {
-        logger26.info("Session copy skipped (source JSONL not found)", {
+        logger28.info("Session copy skipped (source JSONL not found)", {
           sourceAgentId,
           sessionId: sourceSessionId,
           expectedPath: srcPath
         });
       }
     } catch (e) {
-      logger26.error("Session JSONL copy failed", { error: e, sourceAgentId, newAgentId });
+      logger28.error("Session JSONL copy failed", { error: e, sourceAgentId, newAgentId });
     }
   } else {
-    logger26.info("Session copy skipped (no session in store)", { sourceAgentId });
+    logger28.info("Session copy skipped (no session in store)", { sourceAgentId });
   }
   if (!sessionCopied && sourceConversationId) {
     await writeForkMeta(dataDir, newAgentId, {
       sourceConversationId,
       forkedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    logger26.info("Fork meta scheduled for history replay fallback", {
+    logger28.info("Fork meta scheduled for history replay fallback", {
       newAgentId,
       sourceConversationId,
       reason: sourceSessionId ? "jsonl_missing_or_copy_failed" : "no_session_in_store"
     });
   }
-  logger26.info("Fork file copy finished", {
+  logger28.info("Fork file copy finished", {
     sourceAgentId,
     newAgentId,
     newWorkdir,
@@ -29868,15 +31575,15 @@ async function forkAgentFiles(sourceAgentId, newAgentId, sourceWorkdir, newWorkd
 }
 
 // src/modelQuerier.ts
-import fs13 from "fs/promises";
+import fs15 from "fs/promises";
 import os10 from "os";
-import path21 from "path";
+import path23 from "path";
 import * as sdk4 from "@anthropic-ai/claude-agent-sdk";
-var logger27 = createModuleLogger("bridge.modelQuerier");
+var logger29 = createModuleLogger("bridge.modelQuerier");
 async function listModels(queryFn, opts = {}) {
   const t0 = Date.now();
-  const cwd = opts.cwd ?? path21.join(os10.homedir(), ".ahchat", "workspaces", "_list_models");
-  await fs13.mkdir(cwd, { recursive: true });
+  const cwd = opts.cwd ?? path23.join(os10.homedir(), ".ahchat", "workspaces", "_list_models");
+  await fs15.mkdir(cwd, { recursive: true });
   const fn = queryFn ?? sdk4.query;
   const ic = new InputController();
   ic.push("Reply with exactly: PING", "");
@@ -29921,27 +31628,29 @@ async function listModels(queryFn, opts = {}) {
       displayName: m.displayName,
       description: m.description
     }));
-    logger27.info("listModels done", { count: models.length, ms: Date.now() - t0 });
+    logger29.info("listModels done", { count: models.length, ms: Date.now() - t0 });
     return models;
   } finally {
     try {
       ic.close();
-    } catch {
+    } catch (e) {
+      logger29.debug("listModels: input controller close failed during teardown", { error: e });
     }
     try {
       await q.return?.(void 0);
-    } catch {
+    } catch (e) {
+      logger29.debug("listModels: query iterator return failed during teardown", { error: e });
     }
   }
 }
 
 // src/promptOptimizer.ts
-import fs14 from "fs/promises";
+import fs16 from "fs/promises";
 import os11 from "os";
-import path22 from "path";
+import path24 from "path";
 import * as sdk5 from "@anthropic-ai/claude-agent-sdk";
-var logger28 = createModuleLogger("bridge.promptOptimizer");
-var OPTIMIZER_SYSTEM_PROMPT = `You are an expert prompt editor for AHChat Agent creation.
+var logger30 = createModuleLogger("bridge.promptOptimizer");
+var OPTIMIZER_SYSTEM_PROMPT = `You are an expert prompt editor for ALL-CAN Agent creation.
 
 Rewrite the user's Agent System Prompt so it is clear, operational, and ready to save.
 Preserve the user's intent, role, constraints, language, and important domain details.
@@ -29952,7 +31661,7 @@ Do not include explanations, headings like "Optimized Prompt", markdown fences,
 Keep the result concise enough for a System Prompt field, preferably within 2000 characters.`;
 function buildUserPrompt(opts) {
   const parts = [
-    "\u8BF7\u4F18\u5316\u4E0B\u9762\u8FD9\u4E2A AHChat Agent \u7684 System Prompt\u3002",
+    "\u8BF7\u4F18\u5316\u4E0B\u9762\u8FD9\u4E2A ALL-CAN Agent \u7684 System Prompt\u3002",
     opts.name?.trim() ? `Agent \u540D\u79F0\uFF1A${opts.name.trim()}` : null,
     opts.role?.trim() ? `\u89D2\u8272\u6807\u7B7E\uFF1A${opts.role.trim()}` : null,
     "",
@@ -29982,8 +31691,8 @@ async function optimizePrompt(queryFn, opts) {
   const prompt = opts.systemPrompt.trim();
   if (!prompt) throw new Error("systemPrompt is required");
   const t0 = Date.now();
-  const cwd = opts.cwd ?? path22.join(os11.homedir(), ".ahchat", "workspaces", "_prompt_optimizer");
-  await fs14.mkdir(cwd, { recursive: true });
+  const cwd = opts.cwd ?? path24.join(os11.homedir(), ".ahchat", "workspaces", "_prompt_optimizer");
+  await fs16.mkdir(cwd, { recursive: true });
   const fn = queryFn ?? sdk5.query;
   const ic = new InputController();
   ic.push(buildUserPrompt(opts), "");
@@ -30039,7 +31748,7 @@ async function optimizePrompt(queryFn, opts) {
       })
     ]);
     if (!optimizedPrompt) throw new Error("empty optimized prompt");
-    logger28.info("optimizePrompt done", {
+    logger30.info("optimizePrompt done", {
       inputLength: prompt.length,
       outputLength: optimizedPrompt.length,
       model: model || "(default)",
@@ -30050,17 +31759,19 @@ async function optimizePrompt(queryFn, opts) {
     if (timeoutId) clearTimeout(timeoutId);
     try {
       ic.close();
-    } catch {
+    } catch (e) {
+      logger30.debug("optimizePrompt: input controller close failed during teardown", { error: e });
     }
     try {
       await q.return?.(void 0);
-    } catch {
+    } catch (e) {
+      logger30.debug("optimizePrompt: query iterator return failed during teardown", { error: e });
     }
   }
 }
 
 // src/start.ts
-var logger29 = createModuleLogger("bridge");
+var logger31 = createModuleLogger("bridge");
 var NODE_USER_UID2 = 1e3;
 function isRunningAsRoot2() {
   try {
@@ -30070,56 +31781,58 @@ function isRunningAsRoot2() {
   }
 }
 async function syncClaudeCredentialsToNodeAccessibleDir(agentConfigDir) {
-  const rootClaudeDir = path23.join(process.env.HOME ?? "/root", ".claude");
-  const fs15 = await import("fs/promises");
+  const rootClaudeDir = path25.join(process.env.HOME ?? "/root", ".claude");
+  const fs17 = await import("fs/promises");
   try {
-    await fs15.access(rootClaudeDir);
+    await fs17.access(rootClaudeDir);
   } catch {
-    logger29.info("No /root/.claude to sync", { rootClaudeDir });
+    logger31.info("No /root/.claude to sync", { rootClaudeDir });
     return;
   }
   const filesToSync = [".credentials.json", "settings.json", ".credentials.backup.json"];
   for (const file2 of filesToSync) {
-    const src = path23.join(rootClaudeDir, file2);
-    const dest = path23.join(agentConfigDir, file2);
+    const src = path25.join(rootClaudeDir, file2);
+    const dest = path25.join(agentConfigDir, file2);
     try {
-      await fs15.copyFile(src, dest);
-      logger29.info("Synced credential file", { file: file2, from: src, to: dest });
+      await fs17.copyFile(src, dest);
+      logger31.info("Synced credential file", { file: file2, from: src, to: dest });
     } catch {
-      logger29.debug("Credential file not present, skipping", { file: file2, src });
+      logger31.debug("Credential file not present, skipping", { file: file2, src });
     }
   }
 }
 async function chownRecursive(dirPath, uid, gid) {
-  const fs15 = await import("fs/promises");
+  const fs17 = await import("fs/promises");
   try {
-    await fs15.chown(dirPath, uid, gid);
+    await fs17.chown(dirPath, uid, gid);
   } catch {
-    logger29.debug("chown skipped", { dirPath, uid, gid });
+    logger31.debug("chown skipped", { dirPath, uid, gid });
   }
   let entries;
   try {
-    entries = await fs15.readdir(dirPath, { withFileTypes: true });
+    entries = await fs17.readdir(dirPath, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = path23.join(dirPath, entry.name);
+    const fullPath = path25.join(dirPath, entry.name);
     if (entry.isDirectory()) {
       await chownRecursive(fullPath, uid, gid);
     } else {
       try {
-        await fs15.chown(fullPath, uid, gid);
+        await fs17.chown(fullPath, uid, gid);
       } catch {
-        logger29.debug("chown skipped", { fullPath, uid, gid });
+        logger31.debug("chown skipped", { fullPath, uid, gid });
       }
     }
   }
 }
 async function startBridge(config2) {
+  process.env.AHCHAT_DATA_DIR = config2.dataDir;
+  configureBridgeLogger(config2);
   ensureDir(config2.dataDir);
   ensureDir(config2.agentConfigDir);
-  const workspacesDir = path23.join(config2.dataDir, "workspaces");
+  const workspacesDir = path25.join(config2.dataDir, "workspaces");
   ensureDir(workspacesDir);
   process.env.CLAUDE_CONFIG_DIR = config2.agentConfigDir;
   installBridgeFetchAuth(config2.serverApiUrl, config2.bridgeToken);
@@ -30127,7 +31840,7 @@ async function startBridge(config2) {
     await syncClaudeCredentialsToNodeAccessibleDir(config2.agentConfigDir);
     await chownRecursive(config2.agentConfigDir, NODE_USER_UID2, NODE_USER_UID2);
     await chownRecursive(workspacesDir, NODE_USER_UID2, NODE_USER_UID2);
-    logger29.info("Root environment: chowned config/workspaces dirs to uid 1000", {
+    logger31.info("Root environment: chowned config/workspaces dirs to uid 1000", {
       agentConfigDir: config2.agentConfigDir,
       workspacesDir
     });
@@ -30142,13 +31855,13 @@ Claude runtime is unavailable.
 
 ${claudeRuntime.error ?? "Install Claude Code manually or use the bundled desktop runtime."}
 
-Reinstall @fangyb/ahchat-bridge with npm optional dependencies, set AHCHAT_CLAUDE_EXECUTABLE to a valid Claude Code binary path, install Claude Code, or use AHChat Desktop with its bundled runtime.
+Reinstall @fangyb/ahchat-bridge with npm optional dependencies, set AHCHAT_CLAUDE_EXECUTABLE to a valid Claude Code binary path, install Claude Code, or use ALL-CAN Desktop with its bundled runtime.
 `
     );
     process.exit(1);
   }
   setClaudeExecutablePath(claudeRuntime.path);
-  logger29.info("Bridge starting", {
+  logger31.info("Bridge starting", {
     bridgeId: config2.bridgeId,
     serverUrl: config2.serverUrl,
     serverApiUrl: config2.serverApiUrl,
@@ -30156,24 +31869,37 @@ Reinstall @fangyb/ahchat-bridge with npm optional dependencies, set AHCHAT_CLAUD
     claudeRuntimeSource: claudeRuntime.source,
     claudeRuntimeVersion: claudeRuntime.version ?? null
   });
-  process.stdout.write(`
+  const shouldPrintRawBridgeToken = process.stdout.isTTY && process.env.AHCHAT_SUPPRESS_BRIDGE_TOKEN_STDOUT !== "1";
+  process.stdout.write(
+    `
 Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\u673A\u5668):
-  ${config2.bridgeToken}
+  ${shouldPrintRawBridgeToken ? config2.bridgeToken : "***"}
 
-`);
+`
+  );
   wsMetrics.start(5e3);
   const sessionStore = new SessionStore(config2.dataDir);
-  const memoryRoot = path23.join(config2.dataDir, "agent-memory");
+  const workdirOverrideStore = new LocalWorkdirOverrideStore(config2.dataDir);
+  const memoryRoot = path25.join(config2.dataDir, "agent-memory");
   const memoryStore = new AgentMemoryStore(memoryRoot);
-  logger29.info("Agent memory store initialized", { rootDir: memoryRoot });
+  logger31.info("Agent memory store initialized", { rootDir: memoryRoot });
   const smithNotebook = memoryStore.read(SMITH_AGENT_ID);
   if (!smithNotebook.trim()) {
     memoryStore.write(SMITH_AGENT_ID, SMITH_NOTEBOOK_SEED);
-    logger29.info("Smith notebook seeded", { agentId: SMITH_AGENT_ID });
+    logger31.info("Smith notebook seeded", { agentId: SMITH_AGENT_ID });
   }
   const skillStore = new SkillStore(config2.dataDir);
   skillStore.seed("log-analysis", LOG_ANALYSIS_SKILL);
-  logger29.info("Smith log-analysis skill boot seed invoked", { dataDir: config2.dataDir });
+  logger31.info("Smith log-analysis skill boot seed invoked", { dataDir: config2.dataDir });
+  const logUploader = new BridgeLogUploader({
+    dataDir: config2.dataDir,
+    serverApiUrl: config2.serverApiUrl,
+    bridgeToken: config2.bridgeToken,
+    bridgeId: config2.bridgeId,
+    hostname: os12.hostname(),
+    intervalMs: config2.logUploadIntervalMs
+  });
+  logUploader.start();
   const agentRegistry = new HttpAgentRegistry(config2.serverApiUrl, config2.bridgeToken);
   const groupRegistry = new GroupRegistry(config2.serverApiUrl, config2.bridgeToken);
   const subscriptionRegistry = new HttpSubscriptionRegistry(config2.serverApiUrl, config2.bridgeToken);
@@ -30198,10 +31924,18 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
     subscriptionRegistry,
     serverApiUrl: config2.serverApiUrl,
     bridgeToken: config2.bridgeToken,
-    dataDir: config2.dataDir
+    dataDir: config2.dataDir,
+    workdirOverrideStore
   });
   const taskDispatchHandler = createTaskDispatchHandler(agentManager, agentRegistry, emit);
   const groupTaskDispatchHandler = createGroupTaskDispatchHandler(agentManager, agentRegistry, emit);
+  const resolveBridgeWorkdirPath = (requestedPath) => {
+    const overridden = workdirOverrideStore.resolvePath(requestedPath);
+    if (overridden.overridden) {
+      return { path: overridden.path, remapped: true };
+    }
+    return remapServerWorkspacePath(requestedPath, workspacesDir);
+  };
   let statusInterval = null;
   connector = new ServerConnector({
     config: config2,
@@ -30209,7 +31943,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
     onTaskDispatch: taskDispatchHandler,
     onGroupTaskDispatch: groupTaskDispatchHandler,
     onStopGeneration: async (payload) => {
-      logger29.info("onStopGeneration invoking cancelReply", {
+      logger31.info("onStopGeneration invoking cancelReply", {
         agentId: payload.agentId,
         ackId: payload.ackId,
         conversationId: payload.conversationId,
@@ -30225,13 +31959,14 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
     onConnected: async () => {
       await agentRegistry.refresh();
       await groupRegistry.refresh();
+      await subscriptionRegistry.refresh();
       await agentManager.recoverFromRestart(agentRegistry.getAll());
     },
     onServerPush: async (msg) => {
       switch (msg.type) {
         case "bridge:list_models_request": {
           const { requestId, apiKey, apiBaseUrl, modelsApiBaseUrl } = msg.payload;
-          logger29.info("list_models request received", { requestId, hasApiKey: !!apiKey, hasApiBaseUrl: !!apiBaseUrl, hasModelsUrl: !!modelsApiBaseUrl });
+          logger31.info("list_models request received", { requestId, hasApiKey: !!apiKey, hasApiBaseUrl: !!apiBaseUrl, hasModelsUrl: !!modelsApiBaseUrl });
           try {
             let models;
             if (apiKey || apiBaseUrl) {
@@ -30283,7 +32018,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               type: "bridge:list_models_response",
               payload: { requestId, models }
             });
-            logger29.info("list_models response sent", { requestId, count: models.length });
+            logger31.info("list_models response sent", { requestId, count: models.length });
           } catch (e) {
             const err = e instanceof Error ? e.message : String(e);
             connector?.send({
@@ -30291,16 +32026,16 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               payload: { requestId, error: err }
             });
             if (err.includes("models \u7AEF\u70B9\u672A\u627E\u5230")) {
-              logger29.warn("list_models: endpoint not available, server will use fallback", { requestId });
+              logger31.warn("list_models: endpoint not available, server will use fallback", { requestId });
             } else {
-              logger29.error("list_models failed", { requestId, error: e });
+              logger31.error("list_models failed", { requestId, error: e });
             }
           }
           break;
         }
         case "bridge:optimize_prompt_request": {
           const { requestId, apiKey, apiBaseUrl, model, name, role, systemPrompt } = msg.payload;
-          logger29.info("optimize_prompt request received", {
+          logger31.info("optimize_prompt request received", {
             requestId,
             hasApiKey: !!apiKey,
             hasApiBaseUrl: !!apiBaseUrl,
@@ -30322,7 +32057,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               type: "bridge:optimize_prompt_response",
               payload: { requestId, optimizedPrompt }
             });
-            logger29.info("optimize_prompt response sent", {
+            logger31.info("optimize_prompt response sent", {
               requestId,
               length: optimizedPrompt.length
             });
@@ -30332,50 +32067,50 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               type: "bridge:optimize_prompt_response",
               payload: { requestId, error: err }
             });
-            logger29.error("optimize_prompt failed", { requestId, error: e });
+            logger31.error("optimize_prompt failed", { requestId, error: e });
           }
           break;
         }
         case "bridge:list_dir_request": {
           const { requestId, path: dirPath } = msg.payload;
-          logger29.info("list_dir request received", { requestId, path: dirPath });
+          logger31.info("list_dir request received", { requestId, path: dirPath });
           try {
-            const resolved = remapServerWorkspacePath(dirPath, workspacesDir);
+            const resolved = resolveBridgeWorkdirPath(dirPath);
             if (resolved.remapped) {
               ensureDir(resolved.path);
-              logger29.info("list_dir path remapped to local Bridge workspace", {
+              logger31.info("list_dir path resolved to local Bridge workspace", {
                 requestId,
                 requested: dirPath,
-                remapped: resolved.path
+                resolved: resolved.path
               });
             }
             const entries = await listDirectoryEntries(resolved.path);
             connector?.send({
               type: "bridge:list_dir_response",
-              payload: { requestId, entries }
+              payload: { requestId, entries, localPath: resolved.path }
             });
-            logger29.info("list_dir response sent", { requestId, count: entries.length });
+            logger31.info("list_dir response sent", { requestId, count: entries.length });
           } catch (e) {
             const err = e instanceof Error ? e.message : String(e);
             connector?.send({
               type: "bridge:list_dir_response",
               payload: { requestId, error: err }
             });
-            logger29.error("list_dir failed", { requestId, error: e });
+            logger31.error("list_dir failed", { requestId, error: e });
           }
           break;
         }
         case "bridge:write_file_request": {
           const { requestId, baseDir, relativePath, contentBase64, overwrite } = msg.payload;
-          logger29.info("write_file request received", { requestId, baseDir, relativePath });
+          logger31.info("write_file request received", { requestId, baseDir, relativePath });
           try {
-            const resolved = remapServerWorkspacePath(baseDir, workspacesDir);
+            const resolved = resolveBridgeWorkdirPath(baseDir);
             if (resolved.remapped) {
               ensureDir(resolved.path);
-              logger29.info("write_file baseDir remapped to local Bridge workspace", {
+              logger31.info("write_file baseDir resolved to local Bridge workspace", {
                 requestId,
                 requested: baseDir,
-                remapped: resolved.path
+                resolved: resolved.path
               });
             }
             const written = await writeWorkdirFile({
@@ -30389,27 +32124,28 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               payload: {
                 requestId,
                 path: written.path,
+                bridgePath: written.path,
                 relativePath: written.relativePath,
                 size: written.size
               }
             });
-            logger29.info("write_file response sent", { requestId, path: written.path, size: written.size });
+            logger31.info("write_file response sent", { requestId, path: written.path, size: written.size });
           } catch (e) {
             const err = e instanceof Error ? e.message : String(e);
             connector?.send({
               type: "bridge:write_file_response",
               payload: { requestId, error: err }
             });
-            logger29.error("write_file failed", { requestId, error: e });
+            logger31.error("write_file failed", { requestId, error: e });
           }
           break;
         }
         case "bridge:read_file_request": {
           const { requestId, path: filePath, baseDir } = msg.payload;
-          logger29.info("read_file request received", { requestId, path: filePath, baseDir });
+          logger31.info("read_file request received", { requestId, path: filePath, baseDir });
           try {
-            const resolved = remapServerWorkspacePath(filePath, workspacesDir);
-            const resolvedBase = baseDir ? remapServerWorkspacePath(baseDir, workspacesDir) : void 0;
+            const resolved = resolveBridgeWorkdirPath(filePath);
+            const resolvedBase = baseDir ? resolveBridgeWorkdirPath(baseDir) : void 0;
             const result = await readWorkdirFile(resolved.path, resolvedBase?.path);
             connector?.send({
               type: "bridge:read_file_response",
@@ -30420,25 +32156,28 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
                 size: result.size
               }
             });
-            logger29.info("read_file response sent", { requestId, fileName: result.fileName, size: result.size });
+            logger31.info("read_file response sent", { requestId, fileName: result.fileName, size: result.size });
           } catch (e) {
             const err = e instanceof Error ? e.message : String(e);
             connector?.send({
               type: "bridge:read_file_response",
               payload: { requestId, error: err }
             });
-            logger29.error("read_file failed", { requestId, error: e });
+            logger31.error("read_file failed", { requestId, error: e });
           }
           break;
         }
         case "agent:dump_sessions_request": {
           const { requestId, agentId, traceId } = msg.payload;
-          logger29.info("agent:dump_sessions_request received", { requestId, agentId, traceId });
+          logger31.info("agent:dump_sessions_request received", { requestId, agentId, traceId });
           try {
             const result = await dumpAgentContext(agentId, {
               sessionStore,
               agentRegistry,
-              groupRegistry
+              groupRegistry,
+              workspacesDir,
+              agentConfigDir: config2.agentConfigDir,
+              workdirOverrideStore
             });
             connector?.send({
               type: "agent:dump_sessions_response",
@@ -30446,16 +32185,18 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
                 requestId,
                 ok: result.ok,
                 dir: result.dir,
+                localDir: result.localDir,
                 files: result.files,
                 scopeErrors: result.scopeErrors,
                 error: result.error
               }
             });
-            logger29.info("agent:dump_sessions_response sent", {
+            logger31.info("agent:dump_sessions_response sent", {
               requestId,
               agentId,
               traceId,
               ok: result.ok,
+              localDir: result.localDir,
               fileCount: result.files.length,
               scopeErrorCount: result.scopeErrors.length,
               error: result.error
@@ -30466,7 +32207,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               type: "agent:dump_sessions_response",
               payload: { requestId, ok: false, error: err }
             });
-            logger29.error("agent:dump_sessions_request failed", {
+            logger31.error("agent:dump_sessions_request failed", {
               requestId,
               agentId,
               traceId,
@@ -30477,13 +32218,15 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
         }
         case "bridge:fetch_logs_request": {
           const { requestId, ...filter } = msg.payload;
-          logger29.info("fetch_logs request received", {
+          logger31.info("fetch_logs request received", {
             requestId,
             startIso: filter.startIso,
             endIso: filter.endIso,
             traceId: filter.traceId,
             module: filter.module,
-            levelMin: filter.levelMin
+            levelMin: filter.levelMin,
+            limit: filter.limit,
+            offset: filter.offset
           });
           try {
             const result = await scanBridgeLogs({ ...filter, source: "bridge" });
@@ -30493,13 +32236,17 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
                 requestId,
                 entries: result.entries,
                 truncated: result.truncated,
-                totalScanned: result.totalScanned
+                totalScanned: result.totalScanned,
+                totalMatched: result.totalMatched,
+                nextOffset: result.nextOffset
               }
             });
-            logger29.info("fetch_logs response sent", {
+            logger31.info("fetch_logs response sent", {
               requestId,
               count: result.entries.length,
-              truncated: result.truncated
+              truncated: result.truncated,
+              totalMatched: result.totalMatched,
+              nextOffset: result.nextOffset
             });
           } catch (e) {
             const err = e instanceof Error ? e.message : String(e);
@@ -30507,13 +32254,13 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               type: "bridge:fetch_logs_response",
               payload: { requestId, error: err }
             });
-            logger29.error("fetch_logs failed", { requestId, error: e });
+            logger31.error("fetch_logs failed", { requestId, error: e });
           }
           break;
         }
         case "agent:fork": {
           const fp = msg.payload;
-          logger29.info("agent:fork received, copying workdir notebook and session", {
+          logger31.info("agent:fork received, copying workdir notebook and session", {
             sourceAgentId: fp.sourceAgentId,
             newAgentId: fp.newAgentId,
             sourceWorkdir: fp.sourceWorkdir,
@@ -30531,13 +32278,13 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
               sessionStore,
               fp.sourceConversationId
             );
-            logger29.info("agent:fork files copied successfully", {
+            logger31.info("agent:fork files copied successfully", {
               newAgentId: fp.newAgentId,
               traceId: fp.traceId,
               sessionCopied
             });
           } catch (e) {
-            logger29.error("agent:fork file copy failed", {
+            logger31.error("agent:fork file copy failed", {
               error: e,
               newAgentId: fp.newAgentId,
               traceId: fp.traceId
@@ -30549,7 +32296,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
           await agentManager.terminate(msg.payload.agentId);
           break;
         case "agent:terminate_scope":
-          logger29.info("agent:terminate_scope received", {
+          logger31.info("agent:terminate_scope received", {
             agentId: msg.payload.agentId,
             scope: msg.payload.scope
           });
@@ -30565,7 +32312,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
             const oldConfig = parseAgentConfig(oldAgent.config);
             const newConfig = parseAgentConfig(msg.payload.agent.config);
             if (oldConfig.model !== newConfig.model) {
-              logger29.info("agent:updated - model changed, terminating running processes", {
+              logger31.info("agent:updated - model changed, terminating running processes", {
                 agentId: msg.payload.agent.id,
                 oldModel: oldConfig.model ?? "(default)",
                 newModel: newConfig.model ?? "(default)"
@@ -30580,9 +32327,27 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
           break;
         case "subscription:changed":
           subscriptionRegistry.upsert(msg.payload.subscription);
+          for (const agent of agentRegistry.getAll()) {
+            const cfg = parseAgentConfig(agent.config);
+            if (cfg.subscriptionId !== msg.payload.subscription.id) continue;
+            logger31.info("subscription:changed - terminating agent to apply model capabilities", {
+              agentId: agent.id,
+              subscriptionId: msg.payload.subscription.id
+            });
+            void agentManager.terminate(agent.id);
+          }
           break;
         case "subscription:deleted":
           subscriptionRegistry.remove(msg.payload.subscriptionId);
+          for (const agent of agentRegistry.getAll()) {
+            const cfg = parseAgentConfig(agent.config);
+            if (cfg.subscriptionId !== msg.payload.subscriptionId) continue;
+            logger31.info("subscription:deleted - terminating agent using deleted subscription", {
+              agentId: agent.id,
+              subscriptionId: msg.payload.subscriptionId
+            });
+            void agentManager.terminate(agent.id);
+          }
           break;
         case "group:member_changed":
           await handleGroupMemberChangedPush(
@@ -30615,7 +32380,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
           const p = msg.payload;
           const answerText = formatAnswerForSDK(p);
           const ok = askQuestionRegistry.resolve(p.questionId, answerText);
-          logger29.info("user:answer_question handled", {
+          logger31.info("user:answer_question handled", {
             questionId: p.questionId,
             agentId: p.agentId,
             resolved: ok,
@@ -30636,7 +32401,7 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
     });
   }, config2.queryConfig.statusReportIntervalMs);
   const shutdown = async (signal) => {
-    logger29.info("Shutdown signal received", { signal });
+    logger31.info("Shutdown signal received", { signal });
     if (statusInterval) {
       clearInterval(statusInterval);
       statusInterval = null;
@@ -30645,11 +32410,22 @@ Bridge token (register this machine at Settings \u2192 \u5DF2\u8FDE\u63A5\u7684\
     connector?.close();
     await agentManager.shutdownAll();
     releaseLock();
-    logger29.info("Bridge stopped");
+    logger31.info("Bridge stopped");
+    await flushFileTransports();
+    await logUploader.flushOnce();
+    logUploader.stop();
+    await flushFileTransports();
     process.exit(0);
   };
   process.on("SIGINT", () => void shutdown("SIGINT"));
   process.on("SIGTERM", () => void shutdown("SIGTERM"));
+  process.on("uncaughtException", (e) => {
+    logger31.fatal("Uncaught exception, exiting", { error: e });
+    void flushFileTransports().finally(() => process.exit(1));
+  });
+  process.on("unhandledRejection", (reason) => {
+    logger31.error("Unhandled promise rejection", { error: reason });
+  });
 }
 function compactEnv(env2) {
   return Object.fromEntries(
@@ -30657,9 +32433,39 @@ function compactEnv(env2) {
   );
 }
 
+// src/startError.ts
+var logger32 = createModuleLogger("bridge.startError");
+function buildStopCommand(pid) {
+  if (process.platform === "win32") return `taskkill /PID ${pid} /T /F`;
+  return `kill ${pid}`;
+}
+function writeAlreadyRunningMessage(error51) {
+  const lines = [
+    "",
+    `ALL-CAN Bridge is already running (PID: ${error51.pid}).`,
+    "No need to start another Bridge. You can close this terminal.",
+    `Data dir: ${error51.dataDir}`,
+    "To restart it first, run:",
+    `  ${buildStopCommand(error51.pid)}`,
+    ""
+  ];
+  process.stdout.write(`${lines.join("\n")}
+`);
+}
+function handleBridgeStartError(e, message) {
+  if (isBridgeAlreadyRunningError(e)) {
+    logger32.info("Bridge already running; duplicate start skipped", {
+      pid: e.pid,
+      dataDir: e.dataDir
+    });
+    writeAlreadyRunningMessage(e);
+    process.exit(0);
+  }
+  logger32.error(message, { error: e });
+  process.exit(1);
+}
+
 // src/index.ts
-var logger30 = createModuleLogger("bridge");
 void startBridge(loadBridgeConfig()).catch((e) => {
-  logger30.error("Bridge failed to start", { error: e });
-  process.exit(1);
+  handleBridgeStartError(e, "Bridge failed to start");
 });