@geminixiang/mikan 1.0.0-beta.3 → 1.0.0-beta.30

package/dist/agent.js

@@ -1,24 +1,129 @@
-import { DEFAULT_EVENT_BUDGET, defaultExtensionDirs, formatSkillsForPrompt, loadExtensions, loadSkillsFromDir, MikanAgentSession, MikanModels, } from "./harness/index.js";
+/**
+ * Agent runner: prompt construction, path translation, run lifecycle, and createRunner.
+ * Single module — do not split helpers that only this file uses.
+ */
+import { DEFAULT_EVENT_BUDGET, formatSkillsForPrompt, loadExtensions, loadSkillsFromDir, MikanAgentSession, MikanModels, parseCommandInput, } from "./harness/index.js";
+import { runSubagent } from "./harness/subagent-runner.js";
+import { loadSubagentProfiles } from "./harness/subagent-profiles.js";
+import { mergeSubagentProgress, parseSubagentProgressSnapshot, renderSubagentDashboard, settleSubagentProgress, } from "./subagent-progress.js";
 import { createHash } from "crypto";
-import { existsSync, readFileSync } from "fs";
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { join, posix } from "path";
+import { existsSync, lstatSync } from "fs";
+import { chmod, mkdtemp, mkdir, readFile, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { basename, isAbsolute, join, posix, relative, resolve, sep } from "path";
 import { resolveConversationSettings } from "./config.js";
-import { readEnv } from "./utils/env.js";
+import { effectiveStateDir } from "./cli/arg-grammar.js";
+import { packageSkillRuntimeDir, resolveConversationPackages } from "./packages/index.js";
 import { ActorExecutionResolver } from "./execution-resolver.js";
 import * as log from "./log.js";
-import { reportUserFacingError } from "./observability/sentry.js";
-import { createExecutor, } from "./sandbox/index.js";
-import { createMountedRuntimePathContext } from "./sandbox/path-context.js";
-import { addLifecycleBreadcrumb, metricAttributes, updateActiveSpanAttribution, } from "./observability/sentry.js";
-import { AgentMemoryFileManager } from "./sessions/agent-memory-file-manager.js";
+import { createExecutor, getUnresolvedSandboxPathContext, } from "./sandbox/index.js";
+import { addLifecycleBreadcrumb, metricAttributes, reportUserFacingError, updateActiveSpanAttribution, } from "./observability/sentry.js";
+import { ChatHistorySync } from "./sessions/chat-history-sync.js";
+import { formatHistoryLine } from "./sessions/history-line.js";
+import { conversationIdOf, isThreadSessionKey } from "./sessions/session-key.js";
 import { extractSessionUuid, openManagedSession, } from "./sessions/store.js";
 import { HostEventStore } from "./tools/event.js";
-import { createMikanTools } from "./tools/index.js";
+import { createMikanTools, createSubagentTool, DEFAULT_GLOBAL_SUBAGENT_SLOTS, SubagentSlotPool, } from "./tools/index.js";
+// One process-wide fan-out account: per-conversation queues serialize runs,
+// but each run can fan out up to the per-run cap — without this shared
+// ceiling, N busy conversations hold N × cap live subagent sessions.
+const globalSubagentSlots = new SubagentSlotPool(DEFAULT_GLOBAL_SUBAGENT_SLOTS);
 import * as Sentry from "@sentry/node";
-import { formatLocalTimestamp } from "./utils/date.js";
-import { resolveConfiguredModel } from "./model-registry.js";
 import { emitAgentEvent } from "./agent-events.js";
+export function translateRuntimePathToHost(runtimePath, pathContext) {
+    return pathContext.runtimeToHostPath?.(runtimePath) ?? runtimePath;
+}
+function isWithinPathRoot(path, root) {
+    const pathRelative = relative(root, path);
+    return (pathRelative === "" ||
+        (pathRelative !== ".." && !pathRelative.startsWith(`..${sep}`) && !isAbsolute(pathRelative)));
+}
+function hasParentTraversal(path) {
+    return path.split(/[\\/]/).some((segment) => segment === "..");
+}
+export function translateAttachPathToHost(filePath, pathContext) {
+    if (!pathContext.runtimeToHostPath) {
+        throw new Error("Cannot attach files: this sandbox has no host-backed runtime path mapping; attachments are unavailable for remote sandboxes such as Cloudflare or Firecracker");
+    }
+    if (hasParentTraversal(filePath)) {
+        throw new Error("Cannot attach files: parent-directory traversal is not allowed");
+    }
+    const runtimeRoot = resolve(pathContext.runtimeWorkspaceRoot);
+    const runtimePath = posix.isAbsolute(filePath)
+        ? filePath
+        : posix.join(pathContext.runtimeWorkspaceRoot, filePath);
+    const normalizedRuntimePath = resolve(runtimePath);
+    if (!isWithinPathRoot(normalizedRuntimePath, runtimeRoot)) {
+        throw new Error("Cannot attach files: path must be within the runtime workspace");
+    }
+    const hostRoot = resolve(pathContext.hostWorkspaceRoot);
+    const translatedPath = pathContext.runtimeToHostPath(runtimePath);
+    const hostPath = resolve(translatedPath);
+    if (!isWithinPathRoot(hostPath, hostRoot)) {
+        throw new Error("Cannot attach files: path must be within the host workspace");
+    }
+    // Reject symlinks in every existing component. Missing files are left for
+    // the uploader's normal error, but a present attachment must be a regular
+    // non-symlink path all the way from the workspace root.
+    if (existsSync(hostPath)) {
+        let current = hostRoot;
+        const pathParts = relative(hostRoot, hostPath).split(sep).filter(Boolean);
+        for (const [index, part] of pathParts.entries()) {
+            current = join(current, part);
+            let stat;
+            try {
+                stat = lstatSync(current);
+            }
+            catch {
+                break;
+            }
+            if (stat.isSymbolicLink()) {
+                throw new Error("Cannot attach files: symlink components are not allowed");
+            }
+            if (index === pathParts.length - 1 && !stat.isFile()) {
+                throw new Error("Cannot attach files: path must be a regular file");
+            }
+        }
+    }
+    return hostPath;
+}
+/**
+ * Normalize an attachment path using runtime lexical semantics only. The
+ * executor remains the authority for reading the resulting runtime path.
+ */
+function normalizeAttachRuntimePath(filePath, runtimeWorkspaceRoot) {
+    if (hasParentTraversal(filePath)) {
+        throw new Error("Cannot attach files: parent-directory traversal is not allowed");
+    }
+    const runtimeRoot = posix.resolve(runtimeWorkspaceRoot);
+    const runtimePath = posix.resolve(runtimeRoot, filePath);
+    const runtimeRelativePath = posix.relative(runtimeRoot, runtimePath);
+    if (runtimeRelativePath === ".." ||
+        runtimeRelativePath.startsWith("../") ||
+        posix.isAbsolute(runtimeRelativePath)) {
+        throw new Error("Cannot attach files: path must be within the runtime workspace");
+    }
+    return runtimePath;
+}
+async function withStagedRuntimeFile(executor, runtimePath, upload) {
+    if (!executor.readFileBase64NoSymlinks) {
+        throw new Error("Attachments are unavailable: this sandbox cannot guarantee symlink-free path traversal");
+    }
+    const content = Buffer.from(await executor.readFileBase64NoSymlinks(runtimePath), "base64");
+    let stagingDir;
+    try {
+        stagingDir = await mkdtemp(join(tmpdir(), "mikan-upload-"));
+        await chmod(stagingDir, 0o700);
+        const stagedPath = join(stagingDir, basename(runtimePath));
+        await writeFile(stagedPath, content, { mode: 0o600, flag: "wx" });
+        await chmod(stagedPath, 0o600);
+        await upload(stagedPath);
+    }
+    finally {
+        if (stagingDir)
+            await rm(stagingDir, { recursive: true, force: true });
+    }
+}
 const IMAGE_MIME_TYPES = {
     jpg: "image/jpeg",
     jpeg: "image/jpeg",
@@ -29,12 +134,46 @@ const IMAGE_MIME_TYPES = {
 function getImageMimeType(filename) {
     return IMAGE_MIME_TYPES[filename.toLowerCase().split(".").pop() || ""];
 }
-function buildThreadSessionName(message) {
-    const text = message?.text?.trim();
-    if (!text)
-        return undefined;
-    const userLabel = message?.userName || message?.user || "unknown";
-    return `[${userLabel}]: ${text}`;
+function formatTimestampedUserMessage(message) {
+    return formatHistoryLine({
+        date: new Date(),
+        userName: message.userName,
+        threadTs: message.threadTs,
+        text: message.text,
+    });
+}
+async function collectMessageAttachments(message, workspacePath, pathContext, readAttachment) {
+    const imageAttachments = [];
+    const nonImagePaths = [];
+    for (const attachment of message.attachments || []) {
+        const runtimePath = `${workspacePath}/${attachment.localPath}`;
+        const hostPath = pathContext?.runtimeToHostPath?.(runtimePath) ?? runtimePath;
+        const mimeType = getImageMimeType(attachment.localPath);
+        if (mimeType && existsSync(hostPath) && readAttachment) {
+            try {
+                imageAttachments.push({
+                    type: "image",
+                    mimeType,
+                    data: await readAttachment(runtimePath),
+                });
+            }
+            catch {
+                nonImagePaths.push(runtimePath);
+            }
+        }
+        else {
+            nonImagePaths.push(runtimePath);
+        }
+    }
+    return { imageAttachments, nonImagePaths };
+}
+export async function buildPromptPayload(message, workspacePath, pathContext, readAttachment) {
+    let userMessage = formatTimestampedUserMessage(message);
+    const { imageAttachments, nonImagePaths } = await collectMessageAttachments(message, workspacePath, pathContext, readAttachment);
+    if (nonImagePaths.length > 0) {
+        userMessage += `\n\n<slack_attachments>\n${nonImagePaths.join("\n")}\n</slack_attachments>`;
+    }
+    return { userMessage, imageAttachments };
 }
 async function getMemory(conversationDir) {
     const parts = [];
@@ -82,6 +221,32 @@ function loadMikanSkills(conversationDir, workspacePath) {
         }
         return hostPath;
     };
+    // Package skills first: they are the lowest precedence, so a workspace or
+    // conversation skill of the same name below overwrites them. A package can
+    // offer a capability without taking the name away from whoever wants to
+    // replace it locally.
+    //
+    // Unlike extension-shipped skills, these are NOT inlined into the prompt:
+    // conversationPackageSkillMounts exposes them read-only at a runtime path,
+    // so the agent can read the files — including any scripts or templates the
+    // skill ships alongside its SKILL.md, which inlining could never carry.
+    const mounted = workspacePath !== hostWorkspacePath;
+    for (const { slug, dir } of resolveConversationPackages({
+        conversationId: basename(conversationDir),
+        stateDir: effectiveStateDir(),
+        conversationDir,
+    }).skillDirs) {
+        const runtimeDir = packageSkillRuntimeDir(slug);
+        for (const skill of loadSkillsFromDir({ dir, source: `package:${slug}` }).skills) {
+            // In host mode there is no mount, so the host path is already the path
+            // the agent will use.
+            if (mounted) {
+                skill.filePath = runtimeDir + skill.filePath.slice(dir.length);
+                skill.baseDir = runtimeDir + skill.baseDir.slice(dir.length);
+            }
+            skillMap.set(skill.name, skill);
+        }
+    }
     // Load workspace-level skills (global)
     const workspaceSkillsDir = join(hostWorkspacePath, "skills");
     for (const skill of loadSkillsFromDir({ dir: workspaceSkillsDir, source: "workspace" }).skills) {
@@ -174,8 +339,9 @@ function buildSystemPrompt(workspacePath, conversationId, conversationKind, curr
     const slackBlockKitInstructions = platform.name === "slack"
         ? `
 ## Slack Rendering
-- The Slack adapter renders responses with Block Kit automatically. Answer normally using Slack mrkdwn.
-- Do not emit markdown pipe tables; Slack does not render them as tables. Prefer short sections or bullet lists.
+- The Slack adapter renders responses natively from standard Markdown. Answer in normal Markdown/GFM.
+- Markdown pipe tables are rendered as native Slack tables.
+- For interactive elements (buttons, select menus), use the slack_blockkit tool; user interactions arrive as "[Slack action] <action_id>: <value>" messages.
 `
         : "";
     return `You are mikan, a ${platform.name} bot assistant. Be concise. No emojis.
@@ -329,81 +495,21 @@ Do not add this to \`[SILENT]\` responses.`);
     }
     return parts.join("\n\n");
 }
-export function getUnresolvedSandboxPathContext(sandboxConfig, hostWorkspaceRoot) {
-    if (sandboxConfig.type === "image") {
-        return createMountedRuntimePathContext(hostWorkspaceRoot, "/workspace");
-    }
-    return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);
-}
-function createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, workspaceDir, hostWorkspacePath) {
-    const executionResolver = vaultManager && sandboxConfig.type !== "host"
-        ? new ActorExecutionResolver(sandboxConfig, vaultManager, provisioner, workspaceDir)
-        : undefined;
-    // activeExecutor is replaced at the start of each run() call when executionResolver
-    // is present, so the stable `executor` wrapper always delegates to the latest resolved value.
-    let activeExecutor = executionResolver !== undefined
-        ? createExecutor({ type: "host" })
-        : createExecutor(sandboxConfig);
-    const executor = {
-        exec(command, options) {
-            return activeExecutor.exec(command, options);
-        },
-        getWorkspacePath(hostPath) {
-            return activeExecutor.getWorkspacePath(hostPath);
-        },
-        getSandboxConfig() {
-            return activeExecutor.getSandboxConfig();
-        },
-        getPathContext(hostWorkspaceRoot) {
-            return activeExecutor.getPathContext(hostWorkspaceRoot);
-        },
-    };
-    return {
-        executionResolver,
-        executor,
-        getPathContext: () => executor.getPathContext(hostWorkspacePath),
-        async resolveExecutorForRun(context) {
-            if (!executionResolver)
-                return;
-            activeExecutor = await executionResolver.resolve(context);
-        },
-    };
-}
-/**
- * Extension host services over mikan's runtime infrastructure: schedules
- * become event files under `<workspaceDir>/events` (picked up live by
- * EventsWatcher), secrets come from `vaults/extensions/<slug>/env`, and
- * notify posts through the platform bots when main.ts provides a notifier.
- */
-function buildExtensionHostServices(params) {
-    const { workspaceDir, vaultManager, platformNotifier } = params;
-    const eventStore = HostEventStore.fromWorkspaceDir(workspaceDir);
-    return {
-        stateDir: readEnv("STATE_DIR"),
-        scheduleStore: {
-            write: async (filename, payload) => {
-                // Event files tolerate a missing platform (single-platform default),
-                // so the harness payload is a valid event payload as written.
-                await eventStore.write(filename, payload);
-            },
-            delete: async (filename) => (await eventStore.delete(filename)).deleted,
-            list: async () => (await eventStore.list()).map((entry) => ({
-                filename: entry.filename,
-                payload: entry.payload,
-            })),
-        },
-        ...(platformNotifier ? { postMessage: platformNotifier } : {}),
-        ...(vaultManager
-            ? {
-                resolveSecrets: (slug) => vaultManager.resolve(`extensions/${slug}`)?.env ?? {},
-            }
-            : {}),
-    };
+export function appendTriggerAttribution(text, triggerAttribution, sessionLink) {
+    if (!triggerAttribution)
+        return text;
+    const trimmed = text.trimEnd();
+    const legacySuffix = `_Triggered by ${triggerAttribution}_`;
+    // Slack mrkdwn italics cannot span a URL — a `_..._` wrapping a link renders
+    // the underscores literally. Keep the session link outside the italic span.
+    const suffix = sessionLink ? `${legacySuffix} · session: ${sessionLink}` : legacySuffix;
+    if (trimmed.endsWith(suffix))
+        return text;
+    const body = trimmed.endsWith(legacySuffix)
+        ? trimmed.slice(0, -legacySuffix.length).trimEnd()
+        : trimmed;
+    return `${body}\n\n${suffix}`;
 }
-/**
- * Local (workspace/conversation) skills override extension skills on name
- * collision: an admin's on-disk skill always beats an extension's.
- */
 function mergeExtensionSkills(local, extension) {
     if (extension.length === 0)
         return local;
@@ -414,37 +520,6 @@ function mergeExtensionSkills(local, extension) {
         byName.set(skill.name, skill);
     return [...byName.values()];
 }
-async function createConfiguredAgentSession(params) {
-    const { conversationId, workspaceDir, systemPrompt, model, thinkingLevel, tools, sessionStore, models, vaultManager, platformNotifier, } = params;
-    // Host-only dirs under the state dir: extension code runs in the mikan
-    // process, so it must never load from workspace paths — those are mounted
-    // into sandbox containers and agent-writable (sandbox escape otherwise).
-    const extensionsResult = await loadExtensions({
-        dirs: defaultExtensionDirs(conversationId, readEnv("STATE_DIR")),
-        context: { conversationId, workspaceDir, model, thinkingLevel },
-        services: buildExtensionHostServices({ workspaceDir, vaultManager, platformNotifier }),
-    });
-    for (const err of extensionsResult.errors) {
-        log.logWarning(`[${conversationId}] Extension load error: ${err.path}`, err.error);
-    }
-    if (extensionsResult.extensions.length > 0) {
-        log.logInfo(`[${conversationId}] Loaded ${extensionsResult.extensions.length} extension(s): ${extensionsResult.extensions.map((extension) => extension.name).join(", ")}`);
-    }
-    const session = new MikanAgentSession({
-        systemPrompt,
-        model,
-        thinkingLevel,
-        tools,
-        models,
-        sessionStore,
-        extensions: extensionsResult.registry,
-    });
-    const reloaded = session.reloadFromSession();
-    if (reloaded > 0) {
-        log.logInfo(`[${conversationId}] Reloaded ${reloaded} messages from session context`);
-    }
-    return { session, extensionSkills: extensionsResult.skills };
-}
 function createEmptyUsageTotals() {
     return {
         input: 0,
@@ -461,6 +536,13 @@ function createRunState() {
         queue: null,
         pendingTools: new Map(),
         toolProgress: new Map(),
+        subagentProgress: new Map(),
+        completedSubagentProgress: [],
+        subagentToolCalls: new Set(),
+        subagentProgressShown: false,
+        suppressResponseDeltas: false,
+        lastSubagentProgressAt: 0,
+        toolProgressTimer: undefined,
         totalUsage: createEmptyUsageTotals(),
         llmCallCount: 0,
         stopReason: "stop",
@@ -480,6 +562,15 @@ function resetRunState(runState, responder, sessionConversation, userName, sessi
     };
     runState.pendingTools.clear();
     runState.toolProgress.clear();
+    runState.subagentProgress.clear();
+    runState.completedSubagentProgress = [];
+    runState.subagentToolCalls.clear();
+    runState.subagentProgressShown = false;
+    runState.suppressResponseDeltas = false;
+    runState.lastSubagentProgressAt = 0;
+    if (runState.toolProgressTimer)
+        clearTimeout(runState.toolProgressTimer);
+    runState.toolProgressTimer = undefined;
     runState.totalUsage = createEmptyUsageTotals();
     runState.llmCallCount = 0;
     runState.stopReason = "stop";
@@ -515,53 +606,6 @@ function createRunQueue(responder, runState) {
         wait: () => queueChain,
     };
 }
-function formatTimestampedUserMessage(message) {
-    const timestamp = formatLocalTimestamp(new Date());
-    const threadContext = message.threadTs ? ` [in-thread:${message.threadTs}]` : "";
-    return `[${timestamp}] [${message.userName || "unknown"}]${threadContext}: ${message.text}`;
-}
-function collectMessageAttachments(message, workspacePath, pathContext) {
-    const imageAttachments = [];
-    const nonImagePaths = [];
-    for (const attachment of message.attachments || []) {
-        const runtimePath = `${workspacePath}/${attachment.localPath}`;
-        const hostPath = pathContext?.runtimeToHostPath?.(runtimePath) ?? runtimePath;
-        const mimeType = getImageMimeType(attachment.localPath);
-        if (mimeType && existsSync(hostPath)) {
-            try {
-                imageAttachments.push({
-                    type: "image",
-                    mimeType,
-                    data: readFileSync(hostPath).toString("base64"),
-                });
-            }
-            catch {
-                nonImagePaths.push(runtimePath);
-            }
-        }
-        else {
-            nonImagePaths.push(runtimePath);
-        }
-    }
-    return { imageAttachments, nonImagePaths };
-}
-export function buildPromptPayload(message, workspacePath, pathContext) {
-    let userMessage = formatTimestampedUserMessage(message);
-    const { imageAttachments, nonImagePaths } = collectMessageAttachments(message, workspacePath, pathContext);
-    if (nonImagePaths.length > 0) {
-        userMessage += `\n\n<slack_attachments>\n${nonImagePaths.join("\n")}\n</slack_attachments>`;
-    }
-    return { userMessage, imageAttachments };
-}
-async function writePromptDebugContext(conversationDir, systemPrompt, session, userMessage, imageAttachmentCount) {
-    const debugContext = {
-        systemPrompt,
-        messages: session.messages,
-        newUserMessage: userMessage,
-        imageAttachmentCount,
-    };
-    await writeFile(join(conversationDir, "last_prompt.jsonl"), JSON.stringify(debugContext, null, 2));
-}
 function getFinalAssistantText(session) {
     const lastAssistant = session.messages.findLast((message) => message.role === "assistant");
     return (lastAssistant?.content
@@ -569,21 +613,6 @@ function getFinalAssistantText(session) {
         .map((content) => content.text)
         .join("\n") || "");
 }
-export function appendTriggerAttribution(text, triggerAttribution, sessionLink) {
-    if (!triggerAttribution)
-        return text;
-    const trimmed = text.trimEnd();
-    const legacySuffix = `_Triggered by ${triggerAttribution}_`;
-    const suffix = sessionLink
-        ? `_Triggered by ${triggerAttribution} · session: ${sessionLink}_`
-        : legacySuffix;
-    if (trimmed.endsWith(suffix))
-        return text;
-    const body = trimmed.endsWith(legacySuffix)
-        ? trimmed.slice(0, -legacySuffix.length).trimEnd()
-        : trimmed;
-    return `${body}\n\n${suffix}`;
-}
 function isEventTriggerAttribution(triggerAttribution) {
     return triggerAttribution?.startsWith("[event:") === true;
 }
@@ -593,22 +622,86 @@ function extractToolLabel(toolName, args) {
         return toolName;
     return label.trim() || toolName;
 }
+/** Non-subagent tool activity lines; subagent calls render as the dashboard. */
 function formatToolProgress(runState) {
-    const lines = Array.from(runState.toolProgress.values()).map((item) => {
+    const lines = Array.from(runState.toolProgress.entries()).flatMap(([toolCallId, item]) => {
+        if (runState.subagentToolCalls.has(toolCallId))
+            return [];
         const marker = item.status === "running" ? "•" : item.status === "error" ? "✗" : "✓";
-        return `${marker} ${item.label}`;
+        return [`${marker} ${item.label}`];
     });
     return lines.join("\n");
 }
 function formatResponseWithToolProgress(text, runState) {
     const progress = formatToolProgress(runState);
-    return progress ? `${progress}\n\n${text}` : text;
+    return [progress, text].filter(Boolean).join("\n\n");
+}
+/**
+ * The one dashboard render path. A responder that overrides
+ * `replaceSubagentProgress` converts the snapshot for a pipeline that is not
+ * response-source Markdown (Telegram HTML); every other platform receives the
+ * Markdown dashboard — "dashboard, blank line, answer" — through
+ * `replaceResponse`, the same conversion as any response.
+ */
+async function replaceWithSubagentDashboard(responder, snapshot, finalText, options) {
+    if (responder.replaceSubagentProgress) {
+        await responder.replaceSubagentProgress(snapshot, finalText);
+        return;
+    }
+    const dashboard = renderSubagentDashboard(snapshot);
+    await responder.replaceResponse(finalText ? `${dashboard}\n\n${finalText}` : dashboard, options);
 }
-async function replaceResponseWithToolProgress(responder, runState) {
+async function replaceResponseWithToolProgress(responder, runState, subagentProgress = mergeSubagentProgress([...runState.subagentProgress.values()])) {
+    if (subagentProgress) {
+        await replaceWithSubagentDashboard(responder, subagentProgress);
+        return;
+    }
     const progress = formatToolProgress(runState);
     if (progress)
         await responder.replaceResponse(progress);
 }
+const TOOL_PROGRESS_DEBOUNCE_MS = 500;
+const SUBAGENT_PROGRESS_THROTTLE_MS = 2000;
+function subagentProgressDelay(runState) {
+    if (!runState.subagentProgressShown)
+        return 0;
+    return Math.max(0, runState.lastSubagentProgressAt + SUBAGENT_PROGRESS_THROTTLE_MS - Date.now());
+}
+function scheduleToolProgressUpdate(responder, runState) {
+    if (runState.toolProgressTimer)
+        return;
+    const subagentProgress = mergeSubagentProgress([...runState.subagentProgress.values()]);
+    const delay = subagentProgress ? subagentProgressDelay(runState) : TOOL_PROGRESS_DEBOUNCE_MS;
+    runState.toolProgressTimer = setTimeout(() => {
+        runState.toolProgressTimer = undefined;
+        const snapshot = mergeSubagentProgress([...runState.subagentProgress.values()]);
+        if (snapshot) {
+            runState.subagentProgressShown = true;
+            runState.lastSubagentProgressAt = Date.now();
+        }
+        runState.queue?.enqueue(() => replaceResponseWithToolProgress(responder, runState, snapshot), "tool progress update");
+    }, delay);
+    runState.toolProgressTimer.unref();
+}
+function flushToolProgressUpdate(responder, runState) {
+    if (runState.toolProgressTimer)
+        clearTimeout(runState.toolProgressTimer);
+    runState.toolProgressTimer = undefined;
+    const subagentProgress = mergeSubagentProgress([...runState.subagentProgress.values()]);
+    if (subagentProgress) {
+        runState.subagentProgressShown = true;
+        runState.lastSubagentProgressAt = Date.now();
+    }
+    runState.queue?.enqueue(() => replaceResponseWithToolProgress(responder, runState, subagentProgress), "tool progress update");
+}
+function extractSubagentProgress(partialResult) {
+    if (!partialResult || typeof partialResult !== "object")
+        return undefined;
+    const details = partialResult.details;
+    if (!details || typeof details !== "object")
+        return undefined;
+    return parseSubagentProgressSnapshot(details.progress);
+}
 async function finalizeRunResponse(responder, session, runState, options) {
     if (runState.stopReason === "error" && runState.errorMessage) {
         if (!runState.reportedLlmError) {
@@ -673,7 +766,17 @@ async function finalizeRunResponse(responder, session, runState, options) {
     if (!finalText.trim())
         return;
     try {
-        await responder.replaceResponse(appendTriggerAttribution(formatResponseWithToolProgress(finalText, runState), options?.triggerAttribution, options?.triggerSessionLink), { createOverflowLink: options?.createOverflowLink });
+        const finalResponse = appendTriggerAttribution(finalText, options?.triggerAttribution, options?.triggerSessionLink);
+        const finalDashboard = mergeSubagentProgress(runState.completedSubagentProgress);
+        if (finalDashboard) {
+            await replaceWithSubagentDashboard(responder, finalDashboard, finalResponse, {
+                createOverflowLink: options?.createOverflowLink,
+            });
+            return;
+        }
+        await responder.replaceResponse(formatResponseWithToolProgress(finalResponse, runState), {
+            createOverflowLink: options?.createOverflowLink,
+        });
     }
     catch (err) {
         const errMsg = err instanceof Error ? err.message : String(err);
@@ -739,6 +842,215 @@ async function reportUsageSummary(ctx) {
         await waitForQueue();
     }
 }
+function extractToolResultText(result) {
+    if (typeof result === "string") {
+        return result;
+    }
+    if (result &&
+        typeof result === "object" &&
+        "content" in result &&
+        Array.isArray(result.content)) {
+        const content = result.content;
+        const textParts = [];
+        for (const part of content) {
+            if (part.type === "text" && part.text) {
+                textParts.push(part.text);
+            }
+        }
+        if (textParts.length > 0) {
+            return textParts.join("\n");
+        }
+    }
+    return JSON.stringify(result);
+}
+function buildThreadSessionName(message) {
+    const text = message?.text?.trim();
+    if (!text)
+        return undefined;
+    const userLabel = message?.userName || message?.user || "unknown";
+    return `[${userLabel}]: ${text}`;
+}
+function createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, workspaceDir, hostWorkspacePath) {
+    const executionResolver = vaultManager && sandboxConfig.type !== "host"
+        ? new ActorExecutionResolver(sandboxConfig, vaultManager, provisioner, workspaceDir, hostWorkspacePath)
+        : undefined;
+    // activeExecutor is replaced at the start of each run() call when executionResolver
+    // is present, so the stable `executor` wrapper always delegates to the latest resolved value.
+    let activeExecutor = executionResolver !== undefined
+        ? createExecutor({ type: "host" })
+        : createExecutor(sandboxConfig);
+    const executor = {
+        exec(command, options) {
+            return activeExecutor.exec(command, options);
+        },
+        readFile(path, options) {
+            return activeExecutor.readFile(path, options);
+        },
+        readFileBase64(path, options) {
+            return activeExecutor.readFileBase64(path, options);
+        },
+        readFileBase64NoSymlinks(path, options) {
+            if (!activeExecutor.readFileBase64NoSymlinks) {
+                throw new Error("Attachments are unavailable: this sandbox cannot guarantee symlink-free path traversal");
+            }
+            return activeExecutor.readFileBase64NoSymlinks(path, options);
+        },
+        writeFile(path, content, options) {
+            return activeExecutor.writeFile(path, content, options);
+        },
+        getWorkspacePath(hostPath) {
+            return activeExecutor.getWorkspacePath(hostPath);
+        },
+        getSandboxConfig() {
+            return activeExecutor.getSandboxConfig();
+        },
+        getPathContext(hostWorkspaceRoot) {
+            return activeExecutor.getPathContext(hostWorkspaceRoot);
+        },
+    };
+    return {
+        executionResolver,
+        executor,
+        getPathContext: () => executor.getPathContext(hostWorkspacePath),
+        async resolveExecutorForRun(context) {
+            if (!executionResolver)
+                return;
+            activeExecutor = await executionResolver.resolve(context);
+        },
+    };
+}
+/**
+ * Extension host services over mikan's runtime infrastructure: schedules
+ * become event files under `<workspaceDir>/events` (picked up live by
+ * EventsWatcher), secrets come from `vaults/extensions/<slug>/env`, and
+ * notify posts through the platform bots when main.ts provides a notifier.
+ */
+function buildExtensionHostServices(params) {
+    const { workspaceDir, vaultManager, platformNotifier, platformReactor, platformUploader, platformBlockKit, runSubagentService, } = params;
+    const eventStore = HostEventStore.fromWorkspaceDir(workspaceDir);
+    return {
+        stateDir: effectiveStateDir(),
+        scheduleStore: {
+            write: async (filename, payload) => {
+                await eventStore.write(filename, payload);
+            },
+            delete: async (filename) => (await eventStore.delete(filename)).deleted,
+            list: async () => (await eventStore.list()).flatMap((entry) => entry.payload ? [{ filename: entry.filename, payload: entry.payload }] : []),
+        },
+        ...(platformNotifier ? { postMessage: platformNotifier } : {}),
+        ...(platformReactor ? { addReaction: platformReactor } : {}),
+        ...(platformUploader ? { uploadFile: platformUploader } : {}),
+        ...(platformBlockKit
+            ? { postBlocks: platformBlockKit.postBlocks, updateBlocks: platformBlockKit.updateBlocks }
+            : {}),
+        ...(runSubagentService ? { runSubagent: runSubagentService } : {}),
+        ...(vaultManager
+            ? {
+                resolveSecrets: (slug) => vaultManager.resolve(`extensions/${slug}`)?.env ?? {},
+            }
+            : {}),
+    };
+}
+async function createConfiguredAgentSession(params) {
+    const { conversationId, workspaceDir, systemPrompt, model, thinkingLevel, tools, sessionStore, models, vaultManager, platformNotifier, platformReactor, platformUploader, platformBlockKit, } = params;
+    // Host-only dirs under the state dir: extension code runs in the mikan
+    // process, so it must never load from workspace paths — those are mounted
+    // into sandbox containers and agent-writable (sandbox escape otherwise).
+    // resolveConversationPackages only ever returns state-dir paths (and host
+    // paths an administrator named explicitly in settings); it never reaches
+    // the network on this path, so a slow remote cannot delay a reply.
+    let session;
+    const loadedProfiles = loadSubagentProfiles(workspaceDir);
+    for (const diagnostic of loadedProfiles.diagnostics) {
+        log.logWarning(`[${conversationId}] Subagent profile ignored: ${diagnostic.path}`, diagnostic.message);
+    }
+    // Narrowed to the profiles whose tools actually exist once extensions have
+    // contributed theirs. Both subagent entry points read this at call time, so
+    // they always agree on which profiles are launchable.
+    let runnableSubagentProfiles = loadedProfiles.profiles;
+    const resolvedPackages = resolveConversationPackages({
+        conversationId,
+        stateDir: effectiveStateDir(),
+        conversationDir: join(workspaceDir, conversationId),
+    });
+    for (const error of resolvedPackages.errors) {
+        log.logWarning(`Package unavailable: ${error.source}`, error.message);
+    }
+    const extensionsResult = await loadExtensions({
+        dirs: resolvedPackages.extensionDirs,
+        roots: resolvedPackages.extensionRoots,
+        context: { conversationId, workspaceDir, model, thinkingLevel },
+        services: buildExtensionHostServices({
+            workspaceDir,
+            vaultManager,
+            platformNotifier,
+            platformReactor,
+            platformUploader,
+            platformBlockKit,
+            runSubagentService: (request, extensionTools) => {
+                const activeParent = session?.isActiveRun ? session : undefined;
+                return runSubagent({
+                    request,
+                    defaultModel: model,
+                    thinkingLevel,
+                    models,
+                    workspaceDir,
+                    availableTools: [...tools, ...extensionTools],
+                    profiles: runnableSubagentProfiles,
+                    slots: globalSubagentSlots,
+                    ...(activeParent
+                        ? {
+                            parentMessages: [...activeParent.messages],
+                            onUsage: activeParent.captureExternalUsageSink(),
+                        }
+                        : {}),
+                });
+            },
+        }),
+    });
+    const contributedTools = extensionsResult.registry.getContributedTools();
+    const subagentAvailableTools = [...tools, ...contributedTools];
+    const availableToolNames = new Set(subagentAvailableTools.map((tool) => tool.name));
+    runnableSubagentProfiles = new Map([...loadedProfiles.profiles].filter(([, profile]) => profile.tools.every((tool) => availableToolNames.has(tool))));
+    for (const err of extensionsResult.errors) {
+        log.logWarning(`[${conversationId}] Extension load error: ${err.path}`, err.error);
+    }
+    if (extensionsResult.extensions.length > 0) {
+        log.logInfo(`[${conversationId}] Loaded ${extensionsResult.extensions.length} extension(s): ${extensionsResult.extensions.map((extension) => extension.name).join(", ")}`);
+    }
+    const subagentTool = createSubagentTool((request) => runSubagent({
+        request,
+        defaultModel: model,
+        thinkingLevel,
+        models,
+        workspaceDir,
+        availableTools: subagentAvailableTools,
+        profiles: runnableSubagentProfiles,
+        slots: globalSubagentSlots,
+        parentMessages: [...session.messages],
+        onUsage: session.captureExternalUsageSink(),
+    }), runnableSubagentProfiles);
+    session = new MikanAgentSession({
+        systemPrompt,
+        model,
+        thinkingLevel,
+        tools: [...tools, subagentTool],
+        models,
+        sessionStore,
+        extensions: extensionsResult.registry,
+    });
+    const activeSession = session;
+    const reloaded = activeSession.reloadFromSession();
+    if (reloaded > 0) {
+        log.logInfo(`[${conversationId}] Reloaded ${reloaded} messages from session context`);
+    }
+    return {
+        session: activeSession,
+        extensionSkills: extensionsResult.skills,
+        extensionRegistry: extensionsResult.registry,
+        disposeExtensions: extensionsResult.dispose,
+    };
+}
 function reloadSessionMessages(session, conversationId) {
     const reloaded = session.reloadFromSession();
     if (reloaded > 0) {
@@ -746,15 +1058,16 @@ function reloadSessionMessages(session, conversationId) {
     }
 }
 async function prepareRunContext(params) {
-    const { message, responder, platform, conversationId, conversationDir, sessionUuid, runState, executor, executionResolver, resolveExecutorForRun, getPathContext, session, setEventContext, setSandboxContext, setUploadFunction, } = params;
+    const { message, responder, platform, conversationId, conversationDir, sessionUuid, runState, executor, executionResolver, resolveExecutorForRun, getPathContext, session, setEventContext, setSandboxContext, setUploadFunction, setReactFunction, bindPlatformToolPacks, } = params;
     let pathContext = params.pathContext;
-    const sessionConversation = message.sessionKey.split(":")[0];
+    const sessionConversation = conversationIdOf(message.sessionKey);
     await mkdir(join(conversationDir, "scratch"), { recursive: true });
     if (executionResolver) {
         await resolveExecutorForRun({
             platform: platform.name,
             userId: message.userId,
             conversationId,
+            trustModel: platform.trustModel,
         });
         pathContext = getPathContext();
     }
@@ -768,9 +1081,11 @@ async function prepareRunContext(params) {
     // provider prompt caching. If this hash changes between turns of one
     // conversation, something turn-varying leaked into the prompt; if it is
     // stable and cacheRead stays 0, the miss is provider-side (e.g. OpenRouter
-    // routing the model across upstream hosts).
+    // routing the model across upstream hosts). This is the base prompt mikan
+    // builds; a `before_agent_start` extension may still rewrite it per turn
+    // (logged separately by the runner).
     const promptHash = createHash("sha256").update(systemPrompt).digest("hex").slice(0, 8);
-    log.logInfo(`[${conversationId}] System prompt: ${systemPrompt.length} chars, sha ${promptHash}`);
+    log.logInfo(`[${conversationId}] System prompt (base): ${systemPrompt.length} chars, sha ${promptHash}`);
     setEventContext({
         platform: platform.name,
         conversationId,
@@ -779,18 +1094,30 @@ async function prepareRunContext(params) {
     });
     setSandboxContext({ conversationId, userId: message.userId });
     setUploadFunction(async (filePath, title) => {
-        const hostPath = translateAttachPathToHost(filePath, pathContext);
-        await responder.uploadFile(hostPath, title);
+        const runtimePath = normalizeAttachRuntimePath(filePath, pathContext.runtimeWorkspaceRoot);
+        await withStagedRuntimeFile(executor, runtimePath, (stagedPath) => responder.uploadFile(stagedPath, title));
+    });
+    // The react tool is available only when the responder supports reactions
+    // (interactive turns on platforms with reaction support); otherwise unset
+    // so the tool reports it is unavailable rather than silently no-op'ing.
+    setReactFunction(responder.react ? async (emoji) => responder.react(emoji) : null);
+    // Platform capability packs (e.g. GitHub PR/CI) enable themselves per run;
+    // core does not branch on platform name here.
+    bindPlatformToolPacks({
+        conversationId,
+        platformName: platform.name,
+        threadTs: message.threadTs,
     });
     resetRunState(runState, responder, sessionConversation, message.userName, sessionUuid, triggerAttribution);
     const runQueue = createRunQueue(responder, runState);
     runState.queue = runQueue.queue;
     log.logInfo(`Context sizes - system: ${systemPrompt.length} chars, memory: ${memory.length} chars`);
     log.logInfo(`Channels: ${platform.channels.length}, Users: ${platform.users.length}`);
-    const { userMessage, imageAttachments } = buildPromptPayload(message, pathContext.runtimeWorkspaceRoot, pathContext);
+    const { userMessage, imageAttachments } = await buildPromptPayload(message, pathContext.runtimeWorkspaceRoot, pathContext, executor.readFileBase64NoSymlinks
+        ? (runtimePath) => executor.readFileBase64NoSymlinks(runtimePath)
+        : undefined);
     const turnInstructions = buildTurnInstructions(message.id.startsWith("event:"), triggerAttribution, platform.name);
     const finalUserMessage = turnInstructions ? `${turnInstructions}\n\n${userMessage}` : userMessage;
-    await writePromptDebugContext(conversationDir, systemPrompt, session, finalUserMessage, imageAttachments.length);
     return {
         sessionConversation,
         runQueue,
@@ -800,6 +1127,63 @@ async function prepareRunContext(params) {
         pathContext,
     };
 }
+/**
+ * The dream run reads a transcript in which the agent held its full tool set,
+ * but `sessionDreamTools` has since narrowed it. Left to infer its grant from
+ * the transcript, the model calls a tool it no longer holds and burns one of
+ * its five turns on the failure — so the grant is stated, and derived from the
+ * tools actually handed to the run rather than restated by hand.
+ */
+function sessionDreamPrompt(conversationMemoryPath, toolNames) {
+    // read/edit/write are core tools, so an empty grant does not arise today;
+    // the fallback only keeps this sentence coherent if that ever changes.
+    const grant = toolNames.length === 0
+        ? "You have no tools in this run and cannot change memory. Say so and stop."
+        : `Your tools this run: ${toolNames.join(", ")}. Nothing else will execute, including tools used earlier in this transcript. ${conversationMemoryPath} is the only path you may write.`;
+    return [
+        "Before this conversation is reset or rotated, preserve only durable information worth carrying into future sessions of this same conversation.",
+        `Review the existing transcript and update only the conversation-specific MEMORY.md at ${conversationMemoryPath}.`,
+        grant,
+        "Do not modify the workspace-level global MEMORY.md. Information from one DM or channel must not be promoted into memory shared with other conversations by this maintenance run.",
+        "Preserve durable decisions, preferences, facts, and ongoing work specific to this conversation. Preserve the concrete values and details needed to resume the work; do not replace them with abstract categories, summaries of retention rules, or statements that merely say a kind of information is durable. An explicit user statement that a fact, preference, or decision should persist is strong evidence that its exact content is worth preserving.",
+        "Deduplicate against existing conversation memory. Do not preserve transient discussion, tool noise, secrets, speculative details, or test scaffolding. If there is nothing new worth preserving, make no changes. Do no unrelated work.",
+    ].join("\n");
+}
+const SESSION_DREAM_BUDGET = {
+    maxDurationMs: 2 * 60 * 1000,
+    maxLlmCalls: 5,
+    maxCostUsd: 0.25,
+};
+function sessionDreamTools(tools, conversationMemoryPath) {
+    return tools
+        .filter((tool) => tool.name === "read" || tool.name === "edit" || tool.name === "write")
+        .map((tool) => {
+        if (tool.name === "read")
+            return tool;
+        return Object.assign({}, tool, {
+            execute: async (...args) => {
+                const params = args[1];
+                if (params.path !== conversationMemoryPath) {
+                    throw new Error(`Session Dream may only modify ${conversationMemoryPath}`);
+                }
+                return tool.execute(...args);
+            },
+        });
+    });
+}
+async function noopResponderMethod() { }
+function createNoopResponder() {
+    return {
+        respond: noopResponderMethod,
+        replaceResponse: noopResponderMethod,
+        respondDiagnostic: noopResponderMethod,
+        respondToolResult: noopResponderMethod,
+        setTyping: noopResponderMethod,
+        setWorking: noopResponderMethod,
+        uploadFile: noopResponderMethod,
+        deleteResponse: noopResponderMethod,
+    };
+}
 function formatAgentActorName(userName, fallback) {
     return userName ? `DM:${userName}` : fallback;
 }
@@ -837,7 +1221,12 @@ function attachSessionEventHandlers(params) {
                 label: extractToolLabel(event.toolName, event.args),
                 status: "running",
             });
-            queue.enqueue(() => replaceResponseWithToolProgress(responder, runState), "tool progress update");
+            if (event.toolName === "subagent") {
+                runState.subagentToolCalls.add(event.toolCallId);
+            }
+            else {
+                queue.enqueue(() => replaceResponseWithToolProgress(responder, runState), "tool progress update");
+            }
             addLifecycleBreadcrumb("agent.tool.started", {
                 tool: event.toolName,
                 ...baseAttrs,
@@ -845,6 +1234,16 @@ function attachSessionEventHandlers(params) {
             log.logToolStart(logCtx, event.toolName, label, event.args);
             return;
         }
+        if (event.type === "tool_execution_update") {
+            const subagentProgress = extractSubagentProgress(event.partialResult);
+            if (subagentProgress) {
+                runState.subagentProgress.set(event.toolCallId, subagentProgress);
+                runState.subagentToolCalls.add(event.toolCallId);
+                runState.suppressResponseDeltas = true;
+                scheduleToolProgressUpdate(responder, runState);
+            }
+            return;
+        }
         if (event.type === "tool_execution_end") {
             const resultStr = extractToolResultText(event.result);
             const pending = pendingTools.get(event.toolCallId);
@@ -856,7 +1255,15 @@ function attachSessionEventHandlers(params) {
             const progress = runState.toolProgress.get(event.toolCallId);
             if (progress)
                 progress.status = event.isError ? "error" : "done";
-            queue.enqueue(() => replaceResponseWithToolProgress(responder, runState), "tool progress update");
+            const subagentProgress = runState.subagentProgress.get(event.toolCallId);
+            if (subagentProgress) {
+                runState.subagentProgress.set(event.toolCallId, settleSubagentProgress(subagentProgress, event.isError));
+            }
+            flushToolProgressUpdate(responder, runState);
+            const completedProgress = runState.subagentProgress.get(event.toolCallId);
+            if (completedProgress)
+                runState.completedSubagentProgress.push(completedProgress);
+            runState.subagentProgress.delete(event.toolCallId);
             pendingTools.delete(event.toolCallId);
             const durationMs = pending ? Date.now() - pending.startTime : 0;
             Sentry.metrics.count("agent.tool.calls", 1, {
@@ -884,6 +1291,9 @@ function attachSessionEventHandlers(params) {
             }
             else {
                 log.logToolSuccess(logCtx, event.toolName, durationMs, resultStr);
+                if (event.toolName === "slack_blockkit") {
+                    runState.finalResponseHandledByTool = true;
+                }
             }
             return;
         }
@@ -913,7 +1323,7 @@ function attachSessionEventHandlers(params) {
                     actorName: formatAgentActorName(logCtx.userName, logCtx.conversationId),
                     event: { kind: "responseDelta", delta: assistantMessageEvent.delta },
                 });
-                if (responder.appendResponseDelta) {
+                if (responder.appendResponseDelta && !runState.suppressResponseDeltas) {
                     queue.enqueue(async () => {
                         await responder.appendResponseDelta?.(assistantMessageEvent.delta ?? "");
                     }, "response delta");
@@ -1010,6 +1420,12 @@ function attachSessionEventHandlers(params) {
                         actorName: formatAgentActorName(logCtx.userName, logCtx.conversationId),
                         event: { kind: "turnEnd" },
                     });
+                    // A run that produced a subagent dashboard finalizes through it:
+                    // finalizeRunResponse renders "dashboard, blank line, answer", and a
+                    // finish here would first overwrite the dashboard with the bare
+                    // answer on every platform.
+                    if (runState.completedSubagentProgress.length > 0)
+                        return;
                     if (responder.finishResponse) {
                         queue.enqueue(async () => {
                             await responder.finishResponse?.(finalText);
@@ -1069,27 +1485,6 @@ function attachSessionEventHandlers(params) {
         }
     });
 }
-function extractToolResultText(result) {
-    if (typeof result === "string") {
-        return result;
-    }
-    if (result &&
-        typeof result === "object" &&
-        "content" in result &&
-        Array.isArray(result.content)) {
-        const content = result.content;
-        const textParts = [];
-        for (const part of content) {
-            if (part.type === "text" && part.text) {
-                textParts.push(part.text);
-            }
-        }
-        if (textParts.length > 0) {
-            return textParts.join("\n");
-        }
-    }
-    return JSON.stringify(result);
-}
 /**
  * Create a new PiAgentWrapper for a channel.
  * Sets up the session and subscribes to events once.
@@ -1097,18 +1492,22 @@ function extractToolResultText(result) {
  * Runner caching is handled by the caller (channelStates in main.ts).
  * This is a stateless factory function.
  */
-export async function createRunner(sandboxConfig, sessionKey, conversationId, conversationDir, workspaceDir, sessionScope, vaultManager, provisioner, sessionView, platformNotifier) {
+export async function createRunner(options) {
+    const { sandboxConfig, sessionKey, conversationId, conversationDir, workspaceDir, sessionScope, vaultManager, provisioner, resourceController, sessionView, platformNotifier, platformReactor, platformUploader, platformBlockKit, platformToolPackFactories, } = options;
     const agentConfig = resolveConversationSettings(conversationDir);
     const workspaceBase = join(conversationDir, "..");
     const { executionResolver, executor, getPathContext, resolveExecutorForRun } = createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, workspaceDir, workspaceBase);
     let pathContext = getUnresolvedSandboxPathContext(sandboxConfig, workspaceBase);
-    // Create tools (per-runner, with per-runner upload function setter)
-    const { tools, setUploadFunction, setEventContext, setSandboxContext } = createMikanTools(executor, workspaceDir, { sandbox: sandboxConfig, provisioner });
-    const modelRegistry = MikanModels.create();
+    const modelRegistry = options.models ?? MikanModels.create();
     if (modelRegistry.getError()) {
         log.logWarning("models.json load error", modelRegistry.getError());
     }
-    const model = resolveConfiguredModel(modelRegistry, agentConfig.provider, agentConfig.model);
+    const model = modelRegistry.resolve(agentConfig.provider, agentConfig.model);
+    // Create tools (per-runner, with per-runner upload function setter)
+    const { tools, setUploadFunction, setReactFunction, bindPlatformToolPacks, setEventContext, setSandboxContext, } = createMikanTools(executor, workspaceDir, { sandbox: sandboxConfig, resourceController: resourceController ?? provisioner }, platformToolPackFactories ?? [], {
+        model,
+        getApiKey: () => modelRegistry.getApiKeyForProvider(model.provider),
+    });
     // Initial system prompt (will be updated each run with fresh memory/channels/users/skills)
     const memory = await getMemory(conversationDir);
     const skills = loadMikanSkills(conversationDir, pathContext.runtimeWorkspaceRoot);
@@ -1117,12 +1516,13 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
         formattingGuide: "",
         channels: [],
         users: [],
+        trustModel: "membership",
     };
     const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, conversationId, "shared", undefined, memory, sandboxConfig, emptyPlatform, skills);
     // Create session manager and settings manager. Top-level/private sessions
     // use the conversation's current pointer; scoped sessions use fixed files.
     // Platform-specific scope behavior is resolved before runner creation.
-    const isThread = sessionKey.includes(":");
+    const isThread = isThreadSessionKey(sessionKey);
     const { contextFile, threadRootMessage } = sessionScope;
     const sessionManager = openManagedSession(contextFile, pathContext.runtimeWorkspaceRoot);
     const threadSessionName = buildThreadSessionName(threadRootMessage);
@@ -1130,8 +1530,8 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
         sessionManager.appendSessionInfo(threadSessionName);
     }
     const sessionUuid = extractSessionUuid(contextFile);
-    const chatSessionManager = new AgentMemoryFileManager();
-    const { session, extensionSkills } = await createConfiguredAgentSession({
+    const chatSessionManager = new ChatHistorySync();
+    const { session, extensionSkills, extensionRegistry, disposeExtensions } = await createConfiguredAgentSession({
         conversationId,
         workspaceDir,
         systemPrompt,
@@ -1142,6 +1542,9 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
         models: modelRegistry,
         vaultManager,
         platformNotifier,
+        platformReactor,
+        platformUploader,
+        platformBlockKit,
     });
     // Mutable per-run state - event handler references this
     const runState = createRunState();
@@ -1173,6 +1576,8 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
                 setEventContext,
                 setSandboxContext,
                 setUploadFunction,
+                setReactFunction,
+                bindPlatformToolPacks,
                 pathContext,
             });
             pathContext = prepared.pathContext;
@@ -1201,10 +1606,39 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
             // Autonomous (event/trigger) runs get an explicit resource ceiling since
             // no human is watching the loop; interactive turns stay human-gated.
             const isEventRun = message.id.startsWith("event:");
-            await session.prompt(prepared.userMessage, {
+            // Event runs have no triggering platform message, so identity fields
+            // stay unset and extensions must null-check them.
+            const origin = isEventRun
+                ? { kind: "event", platform: platform.name }
+                : {
+                    kind: "interactive",
+                    platform: platform.name,
+                    messageTs: message.id,
+                    userId: message.userId,
+                    userName: message.userName,
+                    threadTs: message.threadTs,
+                    attachments: message.attachments,
+                };
+            const outcome = await session.prompt(prepared.userMessage, {
+                origin,
                 ...(prepared.imageAttachments.length > 0 ? { images: prepared.imageAttachments } : {}),
                 ...(isEventRun ? { budget: DEFAULT_EVENT_BUDGET } : {}),
             });
+            if (outcome?.blocked) {
+                const text = outcome.reason
+                    ? `_Turn blocked by an extension: ${outcome.reason}_`
+                    : "_Turn blocked by an extension._";
+                sendAgentEvent({
+                    sessionId: sessionUuid,
+                    actorName: formatAgentActorName(message.userName, prepared.sessionConversation),
+                    event: { kind: "diagnostic", text },
+                });
+                await responder.respondDiagnostic(text, { style: "muted" });
+                runState.responder = null;
+                runState.logCtx = null;
+                runState.queue = null;
+                return { stopReason: "blocked" };
+            }
             // Wait for queued messages
             await prepared.runQueue.wait();
             const sessionViewTokenStore = sessionView?.tokenStore;
@@ -1247,9 +1681,86 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
             runState.queue = null;
             return { stopReason: runState.stopReason, errorMessage: runState.errorMessage };
         },
+        async dreamSessionMemory(message, platform) {
+            const responder = createNoopResponder();
+            const prepared = await prepareRunContext({
+                message,
+                responder,
+                platform,
+                conversationId,
+                conversationDir,
+                sessionUuid,
+                runState,
+                executor,
+                executionResolver,
+                resolveExecutorForRun,
+                getPathContext,
+                session,
+                extensionSkills,
+                setEventContext,
+                setSandboxContext,
+                setUploadFunction,
+                setReactFunction,
+                bindPlatformToolPacks,
+                pathContext,
+            });
+            pathContext = prepared.pathContext;
+            try {
+                const conversationMemoryPath = posix.join(prepared.pathContext.runtimeWorkspaceRoot, conversationId, "MEMORY.md");
+                const dreamTools = sessionDreamTools(session.agent.state.tools, conversationMemoryPath);
+                const outcome = await session.prompt(sessionDreamPrompt(conversationMemoryPath, dreamTools.map((tool) => tool.name)), {
+                    origin: {
+                        kind: "interactive",
+                        platform: platform.name,
+                        messageTs: message.id,
+                        userId: message.userId,
+                        userName: message.userName,
+                        threadTs: message.threadTs,
+                        attachments: message.attachments,
+                    },
+                    budget: SESSION_DREAM_BUDGET,
+                    tools: dreamTools,
+                });
+                if (outcome?.blocked) {
+                    return { stopReason: "blocked", errorMessage: outcome.reason };
+                }
+                await prepared.runQueue.wait();
+                // A budget abort carries its reason in the tally, not in errorMessage,
+                // and that reason is the only thing that tells the user why memory was
+                // not preserved.
+                return {
+                    stopReason: runState.stopReason,
+                    errorMessage: runState.errorMessage ?? session.getLastRunStats().budgetExceededReason,
+                };
+            }
+            finally {
+                runState.responder = null;
+                runState.logCtx = null;
+                runState.queue = null;
+            }
+        },
         abort() {
             session.abort();
         },
+        async tryExtensionCommand(message, responder) {
+            const parsed = parseCommandInput(message.text);
+            if (!parsed)
+                return false;
+            return extensionRegistry.dispatchCommand(parsed.name, {
+                args: parsed.args,
+                conversationId,
+                userId: message.userId,
+                userName: message.userName,
+                threadTs: message.threadTs,
+                respond: (text) => responder.respond(text),
+            });
+        },
+        async tryExtensionAction(slug, action) {
+            return extensionRegistry.dispatchAction(slug, action);
+        },
+        async dispose() {
+            await disposeExtensions();
+        },
         getCurrentStep() {
             const pending = runState.pendingTools;
             if (pending.size === 0)
@@ -1265,13 +1776,4 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
         },
     };
 }
-export function translateRuntimePathToHost(runtimePath, pathContext) {
-    return pathContext.runtimeToHostPath?.(runtimePath) ?? runtimePath;
-}
-export function translateAttachPathToHost(filePath, pathContext) {
-    const runtimePath = posix.isAbsolute(filePath)
-        ? filePath
-        : posix.join(pathContext.runtimeWorkspaceRoot, filePath);
-    return translateRuntimePathToHost(runtimePath, pathContext);
-}
 //# sourceMappingURL=agent.js.map