@geminixiang/mikan 1.0.0-beta.4 → 1.0.0-beta.41

package/dist/agent.js

@@ -1,24 +1,104 @@
-import { DEFAULT_EVENT_BUDGET, defaultExtensionDirs, formatSkillsForPrompt, loadExtensions, loadSkillsFromDir, MikanAgentSession, MikanModels, } from "./harness/index.js";
-import { createHash } from "crypto";
-import { existsSync, readFileSync } from "fs";
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { join, posix } from "path";
+/**
+ * Agent runner: prompt construction, path translation, run lifecycle, and createRunner.
+ * Single module — do not split helpers that only this file uses.
+ */
+import {} from "@earendil-works/pi-ai";
+import { DEFAULT_EVENT_BUDGET, formatSkillsForPrompt, loadExtensions, loadSkillsFromDir, MikanAgentSession, MikanModels, parseCommandInput, } from "./harness/index.js";
+import { runSubagent } from "./harness/subagent-runner.js";
+import { loadSubagentProfiles } from "./harness/subagent-profiles.js";
+import { mergeSubagentProgress, parseSubagentProgressSnapshot, renderSubagentDashboard, settleSubagentProgress, } from "./subagent-progress.js";
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync } from "node:fs";
+import { chmod, mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { resolveConversationSettings } from "./config.js";
-import { readEnv } from "./utils/env.js";
+import { resolveWorkspaceProjection } from "./workspace-projection/index.js";
+import { packageSkillRuntimeDir, resolveConversationPackages } from "./packages/index.js";
 import { ActorExecutionResolver } from "./execution-resolver.js";
 import * as log from "./log.js";
-import { reportUserFacingError } from "./observability/sentry.js";
-import { createExecutor, } from "./sandbox/index.js";
-import { createMountedRuntimePathContext } from "./sandbox/path-context.js";
-import { addLifecycleBreadcrumb, metricAttributes, updateActiveSpanAttribution, } from "./observability/sentry.js";
-import { AgentMemoryFileManager } from "./sessions/agent-memory-file-manager.js";
+import { assertSandboxSupportsWorkspacePolicy, createExecutor, getUnresolvedSandboxPathContext, } from "./sandbox/index.js";
+import { addLifecycleBreadcrumb, metricAttributes, reportUserFacingError, updateActiveSpanAttribution, } from "./observability/sentry.js";
+import { ChatHistorySync } from "./sessions/chat-history-sync.js";
+import { formatHistoryLine } from "./sessions/history-line.js";
+import { conversationIdOf, isThreadSessionKey } from "./sessions/session-key.js";
 import { extractSessionUuid, openManagedSession, } from "./sessions/store.js";
 import { HostEventStore } from "./tools/event.js";
-import { createMikanTools } from "./tools/index.js";
+import { createMikanTools, createSubagentTool, DEFAULT_GLOBAL_SUBAGENT_SLOTS, SubagentSlotPool, } from "./tools/index.js";
+// One process-wide fan-out account: per-conversation queues serialize runs,
+// but each run can fan out up to the per-run cap — without this shared
+// ceiling, N busy conversations hold N × cap live subagent sessions.
+const globalSubagentSlots = new SubagentSlotPool(DEFAULT_GLOBAL_SUBAGENT_SLOTS);
 import * as Sentry from "@sentry/node";
-import { formatLocalTimestamp } from "./utils/date.js";
-import { resolveConfiguredModel } from "./model-registry.js";
 import { emitAgentEvent } from "./agent-events.js";
+export function translateRuntimePathToHost(runtimePath, pathContext) {
+    return pathContext.runtimeToHostPath?.(runtimePath) ?? runtimePath;
+}
+function isWithinPathRoot(path, root) {
+    const pathRelative = relative(root, path);
+    return (pathRelative === "" ||
+        (pathRelative !== ".." && !pathRelative.startsWith(`..${sep}`) && !isAbsolute(pathRelative)));
+}
+function hasParentTraversal(path) {
+    return path.split(/[\\/]/).some((segment) => segment === "..");
+}
+export function translateAttachPathToHost(filePath, pathContext) {
+    if (!pathContext.runtimeToHostPath) {
+        throw new Error("Cannot attach files: this sandbox has no host-backed runtime path mapping; attachments are unavailable for remote sandboxes such as Cloudflare or Firecracker");
+    }
+    if (hasParentTraversal(filePath)) {
+        throw new Error("Cannot attach files: parent-directory traversal is not allowed");
+    }
+    const runtimeRoot = resolve(pathContext.runtimeWorkspaceRoot);
+    const runtimePath = posix.isAbsolute(filePath)
+        ? filePath
+        : posix.join(pathContext.runtimeWorkspaceRoot, filePath);
+    const normalizedRuntimePath = resolve(runtimePath);
+    if (!isWithinPathRoot(normalizedRuntimePath, runtimeRoot)) {
+        throw new Error("Cannot attach files: path must be within the runtime workspace");
+    }
+    const hostRoot = resolve(pathContext.hostWorkspaceRoot);
+    const translatedPath = pathContext.runtimeToHostPath(runtimePath);
+    const hostPath = resolve(translatedPath);
+    if (!isWithinPathRoot(hostPath, hostRoot)) {
+        throw new Error("Cannot attach files: path must be within the host workspace");
+    }
+    return hostPath;
+}
+/**
+ * Normalize an attachment path using runtime lexical semantics only. The
+ * executor remains the authority for reading the resulting runtime path.
+ */
+function normalizeAttachRuntimePath(filePath, runtimeWorkspaceRoot) {
+    if (hasParentTraversal(filePath)) {
+        throw new Error("Cannot attach files: parent-directory traversal is not allowed");
+    }
+    const runtimeRoot = posix.resolve(runtimeWorkspaceRoot);
+    const runtimePath = posix.resolve(runtimeRoot, filePath);
+    const runtimeRelativePath = posix.relative(runtimeRoot, runtimePath);
+    if (runtimeRelativePath === ".." ||
+        runtimeRelativePath.startsWith("../") ||
+        posix.isAbsolute(runtimeRelativePath)) {
+        throw new Error("Cannot attach files: path must be within the runtime workspace");
+    }
+    return runtimePath;
+}
+async function withStagedRuntimeFile(executor, runtimePath, upload) {
+    const content = Buffer.from(await executor.readFileBase64(runtimePath), "base64");
+    let stagingDir;
+    try {
+        stagingDir = await mkdtemp(join(tmpdir(), "mikan-upload-"));
+        await chmod(stagingDir, 0o700);
+        const stagedPath = join(stagingDir, basename(runtimePath));
+        await writeFile(stagedPath, content, { mode: 0o600, flag: "wx" });
+        await chmod(stagedPath, 0o600);
+        await upload(stagedPath);
+    }
+    finally {
+        if (stagingDir)
+            await rm(stagingDir, { recursive: true, force: true });
+    }
+}
 const IMAGE_MIME_TYPES = {
     jpg: "image/jpeg",
     jpeg: "image/jpeg",
@@ -29,18 +109,51 @@ const IMAGE_MIME_TYPES = {
 function getImageMimeType(filename) {
     return IMAGE_MIME_TYPES[filename.toLowerCase().split(".").pop() || ""];
 }
-function buildThreadSessionName(message) {
-    const text = message?.text?.trim();
-    if (!text)
-        return undefined;
-    const userLabel = message?.userName || message?.user || "unknown";
-    return `[${userLabel}]: ${text}`;
+function formatTimestampedUserMessage(message) {
+    return formatHistoryLine({
+        date: new Date(),
+        userName: message.userName,
+        threadTs: message.threadTs,
+        text: message.text,
+    });
+}
+async function collectMessageAttachments(message, workspacePath, pathContext, readAttachment) {
+    const imageAttachments = [];
+    const nonImagePaths = [];
+    for (const attachment of message.attachments || []) {
+        const runtimePath = `${workspacePath}/${attachment.localPath}`;
+        const hostPath = pathContext?.runtimeToHostPath?.(runtimePath) ?? runtimePath;
+        const mimeType = getImageMimeType(attachment.localPath);
+        if (mimeType && existsSync(hostPath) && readAttachment) {
+            try {
+                imageAttachments.push({
+                    type: "image",
+                    mimeType,
+                    data: await readAttachment(runtimePath),
+                });
+            }
+            catch {
+                nonImagePaths.push(runtimePath);
+            }
+        }
+        else {
+            nonImagePaths.push(runtimePath);
+        }
+    }
+    return { imageAttachments, nonImagePaths };
+}
+export async function buildPromptPayload(message, workspacePath, pathContext, readAttachment) {
+    let userMessage = formatTimestampedUserMessage(message);
+    const { imageAttachments, nonImagePaths } = await collectMessageAttachments(message, workspacePath, pathContext, readAttachment);
+    if (nonImagePaths.length > 0) {
+        userMessage += `\n\n<slack_attachments>\n${nonImagePaths.join("\n")}\n</slack_attachments>`;
+    }
+    return { userMessage, imageAttachments };
 }
-async function getMemory(conversationDir) {
+async function getMemory(projection) {
     const parts = [];
-    // Read workspace-level memory (shared across all conversations)
-    const workspaceMemoryPath = join(conversationDir, "..", "MEMORY.md");
-    if (existsSync(workspaceMemoryPath)) {
+    const workspaceMemoryPath = projection.promptSources.globalMemoryPath;
+    if (workspaceMemoryPath && isRegularFile(workspaceMemoryPath)) {
         try {
             const content = (await readFile(workspaceMemoryPath, "utf-8")).trim();
             if (content) {
@@ -51,9 +164,8 @@ async function getMemory(conversationDir) {
             log.logWarning("Failed to read workspace memory", `${workspaceMemoryPath}: ${error}`);
         }
     }
-    // Read conversation-specific memory
-    const conversationMemoryPath = join(conversationDir, "MEMORY.md");
-    if (existsSync(conversationMemoryPath)) {
+    const conversationMemoryPath = projection.promptSources.conversationMemoryPath;
+    if (isRegularFile(conversationMemoryPath)) {
         try {
             const content = (await readFile(conversationMemoryPath, "utf-8")).trim();
             if (content) {
@@ -69,12 +181,20 @@ async function getMemory(conversationDir) {
     }
     return parts.join("\n\n");
 }
-function loadMikanSkills(conversationDir, workspacePath) {
+function isRegularFile(path) {
+    try {
+        const stats = lstatSync(path);
+        return stats.isFile() && !stats.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function loadMikanSkills(office, workspacePath, projection) {
     const skillMap = new Map();
-    // conversationDir is the host path (e.g., /Users/.../data/C0A34FL8PMH)
-    // hostWorkspacePath is the parent directory on host
-    // workspacePath is the container path (e.g., /workspace)
-    const hostWorkspacePath = join(conversationDir, "..");
+    // workspacePath is the runtime-side root (e.g. /workspace); host paths under
+    // the workspace root translate onto it for prompt references.
+    const hostWorkspacePath = office.workspace.root;
     // Helper to translate host paths to container paths
     const translatePath = (hostPath) => {
         if (hostPath.startsWith(hostWorkspacePath)) {
@@ -82,26 +202,66 @@ function loadMikanSkills(conversationDir, workspacePath) {
         }
         return hostPath;
     };
-    // Load workspace-level skills (global)
-    const workspaceSkillsDir = join(hostWorkspacePath, "skills");
-    for (const skill of loadSkillsFromDir({ dir: workspaceSkillsDir, source: "workspace" }).skills) {
-        // Translate paths to container paths for system prompt
-        skill.filePath = translatePath(skill.filePath);
-        skill.baseDir = translatePath(skill.baseDir);
-        skillMap.set(skill.name, skill);
+    // Package skills first: they are the lowest precedence, so a workspace or
+    // conversation skill of the same name below overwrites them. A package can
+    // offer a capability without taking the name away from whoever wants to
+    // replace it locally.
+    //
+    // Unlike extension-shipped skills, these are NOT inlined into the prompt:
+    // conversationPackageSkillMounts exposes them read-only at a runtime path,
+    // so the agent can read the files — including any scripts or templates the
+    // skill ships alongside its SKILL.md, which inlining could never carry.
+    const mounted = workspacePath !== hostWorkspacePath;
+    for (const { slug, dir } of resolveConversationPackages({ office }).skillDirs) {
+        const runtimeDir = packageSkillRuntimeDir(slug);
+        for (const skill of loadSkillsFromDir({ dir, source: `package:${slug}` }).skills) {
+            // In host mode there is no mount, so the host path is already the path
+            // the agent will use.
+            if (mounted) {
+                skill.filePath = runtimeDir + skill.filePath.slice(dir.length);
+                skill.baseDir = runtimeDir + skill.baseDir.slice(dir.length);
+            }
+            skillMap.set(skill.name, skill);
+        }
     }
-    // Load conversation-specific skills (override workspace skills on collision)
-    const conversationSkillsDir = join(conversationDir, "skills");
-    for (const skill of loadSkillsFromDir({ dir: conversationSkillsDir, source: "channel" }).skills) {
+    // Load workspace-level skills only when the office projection authorizes it.
+    const workspaceSkillsDir = projection.promptSources.globalSkillsDir;
+    if (workspaceSkillsDir) {
+        for (const skill of loadSkillsFromDir({ dir: workspaceSkillsDir, source: "workspace" })
+            .skills) {
+            skill.filePath = translatePath(skill.filePath);
+            skill.baseDir = translatePath(skill.baseDir);
+            skillMap.set(skill.name, skill);
+        }
+    }
+    // Load conversation-specific skills (override workspace skills on collision).
+    // Host prompt construction must never follow an agent-created symlink out of
+    // the conversation office, so this load rejects symlinks per entry — on
+    // exactly the paths it reads. Vendored node_modules and dot directories are
+    // never read and never disqualify anything.
+    const conversationSkillsDir = projection.promptSources.conversationSkillsDir;
+    const conversationSkills = loadSkillsFromDir({
+        dir: conversationSkillsDir,
+        source: "channel",
+        rejectSymlinks: true,
+    });
+    const skippedSkillLinks = [];
+    for (const diagnostic of conversationSkills.diagnostics) {
+        if (diagnostic.code !== "symlink")
+            continue;
+        log.logWarning("Skipping conversation skill entry (symlink)", diagnostic.path);
+        skippedSkillLinks.push(translatePath(diagnostic.path));
+    }
+    for (const skill of conversationSkills.skills) {
         skill.filePath = translatePath(skill.filePath);
         skill.baseDir = translatePath(skill.baseDir);
         skillMap.set(skill.name, skill);
     }
-    return Array.from(skillMap.values());
+    return { skills: Array.from(skillMap.values()), skippedSkillLinks };
 }
-function buildRuntimePaths(runtimeWorkspaceRoot, conversationId) {
+function buildRuntimePaths(runtimeWorkspaceRoot, office) {
     const workspaceRoot = runtimeWorkspaceRoot.replace(/\/+$/, "") || "/";
-    const conversationPath = posix.join(workspaceRoot, conversationId);
+    const conversationPath = posix.join(workspaceRoot, office.key);
     return {
         workspaceRoot,
         conversationPath,
@@ -111,7 +271,7 @@ function buildRuntimePaths(runtimeWorkspaceRoot, conversationId) {
 function buildEnvDescription(sandboxType, workspaceRoot) {
     switch (sandboxType) {
         case "image":
-            return `You are running inside a managed per-user container.
+            return `You are running inside a managed per-conversation container.
 - Runtime workspace root: ${workspaceRoot}
 - Bash commands start in: ${workspaceRoot}
 - Install tools with the image's package manager
@@ -152,8 +312,8 @@ export function resolveTriggerAttribution(message) {
         return `@${message.userName}`;
     return undefined;
 }
-function buildSystemPrompt(workspacePath, conversationId, conversationKind, currentUserId, memory, sandboxConfig, platform, skills) {
-    const { workspaceRoot, conversationPath, scratchPath } = buildRuntimePaths(workspacePath, conversationId);
+function buildSystemPrompt(workspacePath, office, conversationKind, currentUserId, memory, sandboxConfig, platform, skills, projection, skippedSkillLinks = []) {
+    const { workspaceRoot, conversationPath, scratchPath } = buildRuntimePaths(workspacePath, office);
     const sandboxType = sandboxConfig.type;
     const isContainerLike = sandboxType === "container" || sandboxType === "image";
     const isFirecracker = sandboxType === "firecracker";
@@ -171,11 +331,26 @@ function buildSystemPrompt(workspacePath, conversationId, conversationKind, curr
     // system prompt stays byte-stable across a conversation's turns and keeps the
     // provider prompt cache warm (a changing system prefix invalidates the cache
     // for the whole request, including the far larger conversation history).
+    const workspaceLayout = projection.layout === "full"
+        ? `${workspaceRoot}/ contains the complete trusted workspace.`
+        : projection.layout === "shared-support"
+            ? `${workspaceRoot}/ contains shared MEMORY.md, skills/, events/, and this conversation's directory.`
+            : `${conversationPath}/ is the only conversation workspace mounted; global memory, skills, and events are not available.`;
+    const skillStorageGuidance = projection.doorPolicy === "trusted"
+        ? `Store shared skills in \`${workspaceRoot}/skills/<name>/\` or conversation-specific skills in \`${conversationPath}/skills/<name>/\`.`
+        : `Store skills in \`${conversationPath}/skills/<name>/\`; this office cannot access workspace-global skills.`;
+    const memoryGuidance = projection.doorPolicy === "trusted"
+        ? `Write important shared knowledge to \`${workspaceRoot}/MEMORY.md\` and conversation-specific knowledge to \`${conversationPath}/MEMORY.md\`.`
+        : `Write durable knowledge only to \`${conversationPath}/MEMORY.md\`; this office cannot access workspace-global memory.`;
+    const systemLogPath = projection.layout === "conversation"
+        ? `${conversationPath}/SYSTEM.md`
+        : `${workspaceRoot}/SYSTEM.md`;
     const slackBlockKitInstructions = platform.name === "slack"
         ? `
 ## Slack Rendering
-- The Slack adapter renders responses with Block Kit automatically. Answer normally using Slack mrkdwn.
-- Do not emit markdown pipe tables; Slack does not render them as tables. Prefer short sections or bullet lists.
+- The Slack adapter renders responses natively from standard Markdown. Answer in normal Markdown/GFM.
+- Markdown pipe tables are rendered as native Slack tables.
+- For interactive elements (buttons, select menus), use the slack_blockkit tool; user interactions arrive as "[Slack action] <action_id>: <value>" messages.
 `
         : "";
     return `You are mikan, a ${platform.name} bot assistant. Be concise. No emojis.
@@ -196,7 +371,7 @@ Channels: ${channelMappings}
 
 Users: ${userMappings}
 
-When mentioning users, use <@username> format (e.g., <@mario>).
+When mentioning users, write <@userName> using the exact userName from the Users table above (e.g., <@mario>). Never invent handles from other platforms (GitHub, email); the platform adapter converts <@userName> to the platform's native mention form.
 
 ## Environment
 ${envDescription}
@@ -204,10 +379,13 @@ ${envDescription}
 - Do not use host-only paths unless you are running in host mode and verified they exist.
 
 ## Workspace Layout
-${workspaceRoot}/
+${workspaceLayout}
+${projection.layout === "conversation"
+        ? `${conversationPath}/           # This conversation`
+        : `${workspaceRoot}/
 ├── MEMORY.md                    # Global memory (all conversations)
 ├── skills/                      # Global CLI tools you create
-└── ${conversationId}/           # This conversation
+└── ${office.key}/           # This conversation`}
     ├── MEMORY.md                # Conversation-specific memory
     ├── log.jsonl                # Human-readable message history (no tool results)
     ├── sessions/                # Structured session history used for context reconstruction
@@ -222,7 +400,7 @@ ${workspaceRoot}/
 You can create reusable CLI tools for recurring tasks (email, APIs, data processing, etc.).
 
 ### Creating Skills
-Store in \`${workspaceRoot}/skills/<name>/\` (global) or \`${conversationPath}/skills/<name>/\` (conversation-specific).
+${skillStorageGuidance}
 Each skill directory needs a \`SKILL.md\` with YAML frontmatter:
 
 \`\`\`markdown
@@ -240,7 +418,9 @@ Scripts are in: {baseDir}/
 \`name\` and \`description\` are required. Use \`{baseDir}\` as placeholder for the skill's directory path.
 
 ### Available Skills
-${skills.length > 0 ? formatSkillsForPrompt(skills) : "(no skills installed yet)"}
+${skills.length > 0 ? formatSkillsForPrompt(skills) : "(no skills installed yet)"}${skippedSkillLinks.length > 0
+        ? `\n\nNote: these skill entries were skipped because they are symlinks, which the host never follows when reading this conversation's skills: ${skippedSkillLinks.join(", ")}. Replace each with a real file or directory (for example \`cp -rL\`) to load it.`
+        : ""}
 
 ## Events
 Use the \`event\` tool to schedule immediate, one-shot, or periodic follow-ups. It writes to the host-side mikan control plane and fills routing fields for the current conversation automatically.
@@ -254,16 +434,14 @@ When events trigger, messages are prefixed like \`[EVENT:filename:type:time]\`.
 For periodic events where there's nothing to report, respond with exactly \`[SILENT]\`. Debounce external triggers; prefer one summarized event over many.
 
 ## Memory
-Write to MEMORY.md files to persist context across conversations.
-- Global (${workspaceRoot}/MEMORY.md): skills, preferences, project info
-- Conversation (${conversationPath}/MEMORY.md): conversation-specific decisions, ongoing work
-Update when you learn something important or when asked to remember something.
+${memoryGuidance}
+Update it when you learn something important or when asked to remember something.
 
 ### Current Memory
 ${memory}
 
 ## System Configuration Log
-Maintain ${workspaceRoot}/SYSTEM.md to log all environment modifications:
+Maintain ${systemLogPath} to log all environment modifications:
 - Installed packages (apt install, npm install, uv pip install)
 - Environment variables set
 - Config files modified (~/.gitconfig, cron jobs, etc.)
@@ -329,81 +507,21 @@ Do not add this to \`[SILENT]\` responses.`);
     }
     return parts.join("\n\n");
 }
-export function getUnresolvedSandboxPathContext(sandboxConfig, hostWorkspaceRoot) {
-    if (sandboxConfig.type === "image") {
-        return createMountedRuntimePathContext(hostWorkspaceRoot, "/workspace");
-    }
-    return createExecutor(sandboxConfig).getPathContext(hostWorkspaceRoot);
-}
-function createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, workspaceDir, hostWorkspacePath) {
-    const executionResolver = vaultManager && sandboxConfig.type !== "host"
-        ? new ActorExecutionResolver(sandboxConfig, vaultManager, provisioner, workspaceDir)
-        : undefined;
-    // activeExecutor is replaced at the start of each run() call when executionResolver
-    // is present, so the stable `executor` wrapper always delegates to the latest resolved value.
-    let activeExecutor = executionResolver !== undefined
-        ? createExecutor({ type: "host" })
-        : createExecutor(sandboxConfig);
-    const executor = {
-        exec(command, options) {
-            return activeExecutor.exec(command, options);
-        },
-        getWorkspacePath(hostPath) {
-            return activeExecutor.getWorkspacePath(hostPath);
-        },
-        getSandboxConfig() {
-            return activeExecutor.getSandboxConfig();
-        },
-        getPathContext(hostWorkspaceRoot) {
-            return activeExecutor.getPathContext(hostWorkspaceRoot);
-        },
-    };
-    return {
-        executionResolver,
-        executor,
-        getPathContext: () => executor.getPathContext(hostWorkspacePath),
-        async resolveExecutorForRun(context) {
-            if (!executionResolver)
-                return;
-            activeExecutor = await executionResolver.resolve(context);
-        },
-    };
-}
-/**
- * Extension host services over mikan's runtime infrastructure: schedules
- * become event files under `<workspaceDir>/events` (picked up live by
- * EventsWatcher), secrets come from `vaults/extensions/<slug>/env`, and
- * notify posts through the platform bots when main.ts provides a notifier.
- */
-function buildExtensionHostServices(params) {
-    const { workspaceDir, vaultManager, platformNotifier } = params;
-    const eventStore = HostEventStore.fromWorkspaceDir(workspaceDir);
-    return {
-        stateDir: readEnv("STATE_DIR"),
-        scheduleStore: {
-            write: async (filename, payload) => {
-                // Event files tolerate a missing platform (single-platform default),
-                // so the harness payload is a valid event payload as written.
-                await eventStore.write(filename, payload);
-            },
-            delete: async (filename) => (await eventStore.delete(filename)).deleted,
-            list: async () => (await eventStore.list()).map((entry) => ({
-                filename: entry.filename,
-                payload: entry.payload,
-            })),
-        },
-        ...(platformNotifier ? { postMessage: platformNotifier } : {}),
-        ...(vaultManager
-            ? {
-                resolveSecrets: (slug) => vaultManager.resolve(`extensions/${slug}`)?.env ?? {},
-            }
-            : {}),
-    };
+export function appendTriggerAttribution(text, triggerAttribution, sessionLink) {
+    if (!triggerAttribution)
+        return text;
+    const trimmed = text.trimEnd();
+    const legacySuffix = `_Triggered by ${triggerAttribution}_`;
+    // Slack mrkdwn italics cannot span a URL — a `_..._` wrapping a link renders
+    // the underscores literally. Keep the session link outside the italic span.
+    const suffix = sessionLink ? `${legacySuffix} · session: ${sessionLink}` : legacySuffix;
+    if (trimmed.endsWith(suffix))
+        return text;
+    const body = trimmed.endsWith(legacySuffix)
+        ? trimmed.slice(0, -legacySuffix.length).trimEnd()
+        : trimmed;
+    return `${body}\n\n${suffix}`;
 }
-/**
- * Local (workspace/conversation) skills override extension skills on name
- * collision: an admin's on-disk skill always beats an extension's.
- */
 function mergeExtensionSkills(local, extension) {
     if (extension.length === 0)
         return local;
@@ -414,37 +532,6 @@ function mergeExtensionSkills(local, extension) {
         byName.set(skill.name, skill);
     return [...byName.values()];
 }
-async function createConfiguredAgentSession(params) {
-    const { conversationId, workspaceDir, systemPrompt, model, thinkingLevel, tools, sessionStore, models, vaultManager, platformNotifier, } = params;
-    // Host-only dirs under the state dir: extension code runs in the mikan
-    // process, so it must never load from workspace paths — those are mounted
-    // into sandbox containers and agent-writable (sandbox escape otherwise).
-    const extensionsResult = await loadExtensions({
-        dirs: defaultExtensionDirs(conversationId, readEnv("STATE_DIR")),
-        context: { conversationId, workspaceDir, model, thinkingLevel },
-        services: buildExtensionHostServices({ workspaceDir, vaultManager, platformNotifier }),
-    });
-    for (const err of extensionsResult.errors) {
-        log.logWarning(`[${conversationId}] Extension load error: ${err.path}`, err.error);
-    }
-    if (extensionsResult.extensions.length > 0) {
-        log.logInfo(`[${conversationId}] Loaded ${extensionsResult.extensions.length} extension(s): ${extensionsResult.extensions.map((extension) => extension.name).join(", ")}`);
-    }
-    const session = new MikanAgentSession({
-        systemPrompt,
-        model,
-        thinkingLevel,
-        tools,
-        models,
-        sessionStore,
-        extensions: extensionsResult.registry,
-    });
-    const reloaded = session.reloadFromSession();
-    if (reloaded > 0) {
-        log.logInfo(`[${conversationId}] Reloaded ${reloaded} messages from session context`);
-    }
-    return { session, extensionSkills: extensionsResult.skills };
-}
 function createEmptyUsageTotals() {
     return {
         input: 0,
@@ -461,6 +548,13 @@ function createRunState() {
         queue: null,
         pendingTools: new Map(),
         toolProgress: new Map(),
+        subagentProgress: new Map(),
+        completedSubagentProgress: [],
+        subagentToolCalls: new Set(),
+        subagentProgressShown: false,
+        suppressResponseDeltas: false,
+        lastSubagentProgressAt: 0,
+        toolProgressTimer: undefined,
         totalUsage: createEmptyUsageTotals(),
         llmCallCount: 0,
         stopReason: "stop",
@@ -480,6 +574,15 @@ function resetRunState(runState, responder, sessionConversation, userName, sessi
     };
     runState.pendingTools.clear();
     runState.toolProgress.clear();
+    runState.subagentProgress.clear();
+    runState.completedSubagentProgress = [];
+    runState.subagentToolCalls.clear();
+    runState.subagentProgressShown = false;
+    runState.suppressResponseDeltas = false;
+    runState.lastSubagentProgressAt = 0;
+    if (runState.toolProgressTimer)
+        clearTimeout(runState.toolProgressTimer);
+    runState.toolProgressTimer = undefined;
     runState.totalUsage = createEmptyUsageTotals();
     runState.llmCallCount = 0;
     runState.stopReason = "stop";
@@ -515,53 +618,6 @@ function createRunQueue(responder, runState) {
         wait: () => queueChain,
     };
 }
-function formatTimestampedUserMessage(message) {
-    const timestamp = formatLocalTimestamp(new Date());
-    const threadContext = message.threadTs ? ` [in-thread:${message.threadTs}]` : "";
-    return `[${timestamp}] [${message.userName || "unknown"}]${threadContext}: ${message.text}`;
-}
-function collectMessageAttachments(message, workspacePath, pathContext) {
-    const imageAttachments = [];
-    const nonImagePaths = [];
-    for (const attachment of message.attachments || []) {
-        const runtimePath = `${workspacePath}/${attachment.localPath}`;
-        const hostPath = pathContext?.runtimeToHostPath?.(runtimePath) ?? runtimePath;
-        const mimeType = getImageMimeType(attachment.localPath);
-        if (mimeType && existsSync(hostPath)) {
-            try {
-                imageAttachments.push({
-                    type: "image",
-                    mimeType,
-                    data: readFileSync(hostPath).toString("base64"),
-                });
-            }
-            catch {
-                nonImagePaths.push(runtimePath);
-            }
-        }
-        else {
-            nonImagePaths.push(runtimePath);
-        }
-    }
-    return { imageAttachments, nonImagePaths };
-}
-export function buildPromptPayload(message, workspacePath, pathContext) {
-    let userMessage = formatTimestampedUserMessage(message);
-    const { imageAttachments, nonImagePaths } = collectMessageAttachments(message, workspacePath, pathContext);
-    if (nonImagePaths.length > 0) {
-        userMessage += `\n\n<slack_attachments>\n${nonImagePaths.join("\n")}\n</slack_attachments>`;
-    }
-    return { userMessage, imageAttachments };
-}
-async function writePromptDebugContext(conversationDir, systemPrompt, session, userMessage, imageAttachmentCount) {
-    const debugContext = {
-        systemPrompt,
-        messages: session.messages,
-        newUserMessage: userMessage,
-        imageAttachmentCount,
-    };
-    await writeFile(join(conversationDir, "last_prompt.jsonl"), JSON.stringify(debugContext, null, 2));
-}
 function getFinalAssistantText(session) {
     const lastAssistant = session.messages.findLast((message) => message.role === "assistant");
     return (lastAssistant?.content
@@ -569,21 +625,6 @@ function getFinalAssistantText(session) {
         .map((content) => content.text)
         .join("\n") || "");
 }
-export function appendTriggerAttribution(text, triggerAttribution, sessionLink) {
-    if (!triggerAttribution)
-        return text;
-    const trimmed = text.trimEnd();
-    const legacySuffix = `_Triggered by ${triggerAttribution}_`;
-    const suffix = sessionLink
-        ? `_Triggered by ${triggerAttribution} · session: ${sessionLink}_`
-        : legacySuffix;
-    if (trimmed.endsWith(suffix))
-        return text;
-    const body = trimmed.endsWith(legacySuffix)
-        ? trimmed.slice(0, -legacySuffix.length).trimEnd()
-        : trimmed;
-    return `${body}\n\n${suffix}`;
-}
 function isEventTriggerAttribution(triggerAttribution) {
     return triggerAttribution?.startsWith("[event:") === true;
 }
@@ -593,22 +634,86 @@ function extractToolLabel(toolName, args) {
         return toolName;
     return label.trim() || toolName;
 }
+/** Non-subagent tool activity lines; subagent calls render as the dashboard. */
 function formatToolProgress(runState) {
-    const lines = Array.from(runState.toolProgress.values()).map((item) => {
+    const lines = Array.from(runState.toolProgress.entries()).flatMap(([toolCallId, item]) => {
+        if (runState.subagentToolCalls.has(toolCallId))
+            return [];
         const marker = item.status === "running" ? "•" : item.status === "error" ? "✗" : "✓";
-        return `${marker} ${item.label}`;
+        return [`${marker} ${item.label}`];
     });
     return lines.join("\n");
 }
 function formatResponseWithToolProgress(text, runState) {
     const progress = formatToolProgress(runState);
-    return progress ? `${progress}\n\n${text}` : text;
+    return [progress, text].filter(Boolean).join("\n\n");
 }
-async function replaceResponseWithToolProgress(responder, runState) {
+/**
+ * The one dashboard render path. A responder that overrides
+ * `replaceSubagentProgress` converts the snapshot for a pipeline that is not
+ * response-source Markdown (Telegram HTML); every other platform receives the
+ * Markdown dashboard — "dashboard, blank line, answer" — through
+ * `replaceResponse`, the same conversion as any response.
+ */
+async function replaceWithSubagentDashboard(responder, snapshot, finalText, options) {
+    if (responder.replaceSubagentProgress) {
+        await responder.replaceSubagentProgress(snapshot, finalText);
+        return;
+    }
+    const dashboard = renderSubagentDashboard(snapshot);
+    await responder.replaceResponse(finalText ? `${dashboard}\n\n${finalText}` : dashboard, options);
+}
+async function replaceResponseWithToolProgress(responder, runState, subagentProgress = mergeSubagentProgress([...runState.subagentProgress.values()])) {
+    if (subagentProgress) {
+        await replaceWithSubagentDashboard(responder, subagentProgress);
+        return;
+    }
     const progress = formatToolProgress(runState);
     if (progress)
         await responder.replaceResponse(progress);
 }
+const TOOL_PROGRESS_DEBOUNCE_MS = 500;
+const SUBAGENT_PROGRESS_THROTTLE_MS = 2000;
+function subagentProgressDelay(runState) {
+    if (!runState.subagentProgressShown)
+        return 0;
+    return Math.max(0, runState.lastSubagentProgressAt + SUBAGENT_PROGRESS_THROTTLE_MS - Date.now());
+}
+function scheduleToolProgressUpdate(responder, runState) {
+    if (runState.toolProgressTimer)
+        return;
+    const subagentProgress = mergeSubagentProgress([...runState.subagentProgress.values()]);
+    const delay = subagentProgress ? subagentProgressDelay(runState) : TOOL_PROGRESS_DEBOUNCE_MS;
+    runState.toolProgressTimer = setTimeout(() => {
+        runState.toolProgressTimer = undefined;
+        const snapshot = mergeSubagentProgress([...runState.subagentProgress.values()]);
+        if (snapshot) {
+            runState.subagentProgressShown = true;
+            runState.lastSubagentProgressAt = Date.now();
+        }
+        runState.queue?.enqueue(() => replaceResponseWithToolProgress(responder, runState, snapshot), "tool progress update");
+    }, delay);
+    runState.toolProgressTimer.unref();
+}
+function flushToolProgressUpdate(responder, runState) {
+    if (runState.toolProgressTimer)
+        clearTimeout(runState.toolProgressTimer);
+    runState.toolProgressTimer = undefined;
+    const subagentProgress = mergeSubagentProgress([...runState.subagentProgress.values()]);
+    if (subagentProgress) {
+        runState.subagentProgressShown = true;
+        runState.lastSubagentProgressAt = Date.now();
+    }
+    runState.queue?.enqueue(() => replaceResponseWithToolProgress(responder, runState, subagentProgress), "tool progress update");
+}
+function extractSubagentProgress(partialResult) {
+    if (!partialResult || typeof partialResult !== "object")
+        return undefined;
+    const details = partialResult.details;
+    if (!details || typeof details !== "object")
+        return undefined;
+    return parseSubagentProgressSnapshot(details.progress);
+}
 async function finalizeRunResponse(responder, session, runState, options) {
     if (runState.stopReason === "error" && runState.errorMessage) {
         if (!runState.reportedLlmError) {
@@ -673,7 +778,17 @@ async function finalizeRunResponse(responder, session, runState, options) {
     if (!finalText.trim())
         return;
     try {
-        await responder.replaceResponse(appendTriggerAttribution(formatResponseWithToolProgress(finalText, runState), options?.triggerAttribution, options?.triggerSessionLink), { createOverflowLink: options?.createOverflowLink });
+        const finalResponse = appendTriggerAttribution(finalText, options?.triggerAttribution, options?.triggerSessionLink);
+        const finalDashboard = mergeSubagentProgress(runState.completedSubagentProgress);
+        if (finalDashboard) {
+            await replaceWithSubagentDashboard(responder, finalDashboard, finalResponse, {
+                createOverflowLink: options?.createOverflowLink,
+            });
+            return;
+        }
+        await responder.replaceResponse(formatResponseWithToolProgress(finalResponse, runState), {
+            createOverflowLink: options?.createOverflowLink,
+        });
     }
     catch (err) {
         const errMsg = err instanceof Error ? err.message : String(err);
@@ -739,6 +854,226 @@ async function reportUsageSummary(ctx) {
         await waitForQueue();
     }
 }
+function extractToolResultText(result) {
+    if (typeof result === "string") {
+        return result;
+    }
+    if (result &&
+        typeof result === "object" &&
+        "content" in result &&
+        Array.isArray(result.content)) {
+        const content = result.content;
+        const textParts = [];
+        for (const part of content) {
+            if (part.type === "text" && part.text) {
+                textParts.push(part.text);
+            }
+        }
+        if (textParts.length > 0) {
+            return textParts.join("\n");
+        }
+    }
+    return JSON.stringify(result);
+}
+function buildThreadSessionName(message) {
+    const text = message?.text?.trim();
+    if (!text)
+        return undefined;
+    const userLabel = message?.userName || message?.user || "unknown";
+    return `[${userLabel}]: ${text}`;
+}
+function createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, workspace) {
+    const executionResolver = vaultManager && sandboxConfig.type !== "host"
+        ? new ActorExecutionResolver(sandboxConfig, vaultManager, provisioner, workspace)
+        : undefined;
+    // activeExecutor is replaced at the start of each run() call when executionResolver
+    // is present, so the stable `executor` wrapper always delegates to the latest resolved value.
+    let activeExecutor = executionResolver !== undefined
+        ? createExecutor({ type: "host" })
+        : createExecutor(sandboxConfig);
+    const executor = {
+        exec(command, options) {
+            return activeExecutor.exec(command, options);
+        },
+        readFile(path, options) {
+            return activeExecutor.readFile(path, options);
+        },
+        readFileBase64(path, options) {
+            return activeExecutor.readFileBase64(path, options);
+        },
+        writeFile(path, content, options) {
+            return activeExecutor.writeFile(path, content, options);
+        },
+        getWorkspacePath(hostPath) {
+            return activeExecutor.getWorkspacePath(hostPath);
+        },
+        getSandboxConfig() {
+            return activeExecutor.getSandboxConfig();
+        },
+        getPathContext(hostWorkspaceRoot) {
+            return activeExecutor.getPathContext(hostWorkspaceRoot);
+        },
+    };
+    return {
+        executionResolver,
+        executor,
+        getPathContext: () => executor.getPathContext(workspace.root),
+        async resolveExecutorForRun(context) {
+            if (!executionResolver)
+                return;
+            activeExecutor = await executionResolver.resolve(context);
+        },
+    };
+}
+/**
+ * Extension host services over mikan's runtime infrastructure: schedules
+ * become event files under `<workspaceDir>/events` (picked up live by
+ * EventsWatcher), secrets come from `vaults/extensions/<slug>/env`, and
+ * notify posts through the platform bots when main.ts provides a notifier.
+ */
+function buildExtensionHostServices(params) {
+    const { workspace, address, vaultManager, platformNotifier, platformReactor, platformUploader, platformBlockKit, platformDmOpener, platformHistoryFetcher, platformUserLister, extensionScheduleEngine, runSubagentService, } = params;
+    const eventStore = HostEventStore.fromWorkspaceDir(workspace.root);
+    return {
+        stateDir: workspace.stateDir,
+        scheduleStore: {
+            write: async (filename, payload) => {
+                await eventStore.write(filename, payload);
+            },
+            delete: async (filename) => (await eventStore.delete(filename)).deleted,
+            list: async () => (await eventStore.list()).flatMap((entry) => entry.payload ? [{ filename: entry.filename, payload: entry.payload }] : []),
+        },
+        ...(platformNotifier ? { postMessage: platformNotifier } : {}),
+        ...(platformReactor ? { addReaction: platformReactor } : {}),
+        ...(platformUploader ? { uploadFile: platformUploader } : {}),
+        ...(platformDmOpener ? { openDirectConversation: platformDmOpener } : {}),
+        ...(platformHistoryFetcher ? { fetchHistory: platformHistoryFetcher } : {}),
+        ...(platformUserLister ? { listUsers: platformUserLister } : {}),
+        ...(extensionScheduleEngine
+            ? {
+                callbackScheduleStore: {
+                    upsert: (slug, name, spec) => extensionScheduleEngine.upsert(address, slug, name, spec),
+                    delete: (slug, name) => extensionScheduleEngine.delete(address, slug, name),
+                    list: (slug) => extensionScheduleEngine.list(address, slug),
+                },
+            }
+            : {}),
+        ...(platformBlockKit
+            ? { postBlocks: platformBlockKit.postBlocks, updateBlocks: platformBlockKit.updateBlocks }
+            : {}),
+        ...(runSubagentService ? { runSubagent: runSubagentService } : {}),
+        ...(vaultManager
+            ? {
+                resolveSecrets: (slug) => vaultManager.resolve(`extensions/${slug}`)?.env ?? {},
+            }
+            : {}),
+    };
+}
+async function createConfiguredAgentSession(params) {
+    const { office, systemPrompt, model, thinkingLevel, tools, sessionStore, models, vaultManager, platformNotifier, platformReactor, platformUploader, platformBlockKit, platformDmOpener, platformHistoryFetcher, platformUserLister, extensionScheduleEngine, } = params;
+    const { address } = office;
+    const conversationId = address.conversationId;
+    const workspaceDir = office.workspace.root;
+    // Host-only dirs under the state dir: extension code runs in the mikan
+    // process, so it must never load from workspace paths — those are mounted
+    // into sandbox containers and agent-writable (sandbox escape otherwise).
+    // resolveConversationPackages only ever returns state-dir paths (and host
+    // paths an administrator named explicitly in settings); it never reaches
+    // the network on this path, so a slow remote cannot delay a reply.
+    let session;
+    const loadedProfiles = loadSubagentProfiles(workspaceDir);
+    for (const diagnostic of loadedProfiles.diagnostics) {
+        log.logWarning(`[${conversationId}] Subagent profile ignored: ${diagnostic.path}`, diagnostic.message);
+    }
+    // Narrowed to the profiles whose tools actually exist once extensions have
+    // contributed theirs. Both subagent entry points read this at call time, so
+    // they always agree on which profiles are launchable.
+    let runnableSubagentProfiles = loadedProfiles.profiles;
+    const resolvedPackages = resolveConversationPackages({ office });
+    for (const error of resolvedPackages.errors) {
+        log.logWarning(`Package unavailable: ${error.source}`, error.message);
+    }
+    const extensionsResult = await loadExtensions({
+        dirs: resolvedPackages.extensionDirs,
+        roots: resolvedPackages.extensionRoots,
+        context: { address, conversationId, workspaceDir, model, thinkingLevel },
+        services: buildExtensionHostServices({
+            workspace: office.workspace,
+            address,
+            vaultManager,
+            platformNotifier,
+            platformReactor,
+            platformUploader,
+            platformBlockKit,
+            platformDmOpener,
+            platformHistoryFetcher,
+            platformUserLister,
+            extensionScheduleEngine,
+            runSubagentService: (request, extensionTools) => {
+                const activeParent = session?.isActiveRun ? session : undefined;
+                return runSubagent({
+                    request,
+                    defaultModel: model,
+                    thinkingLevel,
+                    models,
+                    workspaceDir,
+                    availableTools: [...tools, ...extensionTools],
+                    profiles: runnableSubagentProfiles,
+                    slots: globalSubagentSlots,
+                    ...(activeParent
+                        ? {
+                            parentMessages: [...activeParent.messages],
+                            onUsage: activeParent.captureExternalUsageSink(),
+                        }
+                        : {}),
+                });
+            },
+        }),
+    });
+    const contributedTools = extensionsResult.registry.getContributedTools();
+    const subagentAvailableTools = [...tools, ...contributedTools];
+    const availableToolNames = new Set(subagentAvailableTools.map((tool) => tool.name));
+    runnableSubagentProfiles = new Map([...loadedProfiles.profiles].filter(([, profile]) => profile.tools.every((tool) => availableToolNames.has(tool))));
+    for (const err of extensionsResult.errors) {
+        log.logWarning(`[${conversationId}] Extension load error: ${err.path}`, err.error);
+    }
+    if (extensionsResult.extensions.length > 0) {
+        log.logInfo(`[${conversationId}] Loaded ${extensionsResult.extensions.length} extension(s): ${extensionsResult.extensions.map((extension) => extension.name).join(", ")}`);
+    }
+    const subagentTool = createSubagentTool((request, hooks) => runSubagent({
+        request,
+        ...(hooks?.onActivity ? { onActivity: hooks.onActivity } : {}),
+        defaultModel: model,
+        thinkingLevel,
+        models,
+        workspaceDir,
+        availableTools: subagentAvailableTools,
+        profiles: runnableSubagentProfiles,
+        slots: globalSubagentSlots,
+        parentMessages: [...session.messages],
+        onUsage: session.captureExternalUsageSink(),
+    }), runnableSubagentProfiles);
+    session = new MikanAgentSession({
+        systemPrompt,
+        model,
+        thinkingLevel,
+        tools: [...tools, subagentTool],
+        models,
+        sessionStore,
+        extensions: extensionsResult.registry,
+    });
+    const activeSession = session;
+    const reloaded = activeSession.reloadFromSession();
+    if (reloaded > 0) {
+        log.logInfo(`[${conversationId}] Reloaded ${reloaded} messages from session context`);
+    }
+    return {
+        session: activeSession,
+        extensionSkills: extensionsResult.skills,
+        extensionRegistry: extensionsResult.registry,
+        disposeExtensions: extensionsResult.dispose,
+    };
+}
 function reloadSessionMessages(session, conversationId) {
     const reloaded = session.reloadFromSession();
     if (reloaded > 0) {
@@ -746,31 +1081,36 @@ function reloadSessionMessages(session, conversationId) {
     }
 }
 async function prepareRunContext(params) {
-    const { message, responder, platform, conversationId, conversationDir, sessionUuid, runState, executor, executionResolver, resolveExecutorForRun, getPathContext, session, setEventContext, setSandboxContext, setUploadFunction, } = params;
+    const { message, responder, platform, office, sessionUuid, runState, executor, executionResolver, resolveExecutorForRun, getPathContext, session, setEventContext, setSandboxContext, setUploadFunction, setImageUploadFunction, setReactFunction, bindPlatformToolPacks, } = params;
+    const conversationId = office.address.conversationId;
     let pathContext = params.pathContext;
-    const sessionConversation = message.sessionKey.split(":")[0];
-    await mkdir(join(conversationDir, "scratch"), { recursive: true });
+    const sessionConversation = conversationIdOf(message.sessionKey);
+    await mkdir(join(office.dir, "scratch"), { recursive: true });
     if (executionResolver) {
         await resolveExecutorForRun({
-            platform: platform.name,
+            address: message.address,
             userId: message.userId,
-            conversationId,
+            trustModel: platform.trustModel,
         });
         pathContext = getPathContext();
     }
     reloadSessionMessages(session, conversationId);
-    const memory = await getMemory(conversationDir);
-    const skills = mergeExtensionSkills(loadMikanSkills(conversationDir, pathContext.runtimeWorkspaceRoot), params.extensionSkills ?? []);
+    const projection = resolveWorkspaceProjection(office);
+    const memory = await getMemory(projection);
+    const conversationSkillLoad = loadMikanSkills(office, pathContext.runtimeWorkspaceRoot, projection);
+    const skills = mergeExtensionSkills(conversationSkillLoad.skills, params.extensionSkills ?? []);
     const triggerAttribution = resolveTriggerAttribution(message);
-    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, conversationId, message.conversationKind, message.userId, memory, executor.getSandboxConfig(), platform, skills);
+    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, office, message.conversationKind, message.userId, memory, executor.getSandboxConfig(), platform, skills, projection, conversationSkillLoad.skippedSkillLinks);
     session.agent.state.systemPrompt = systemPrompt;
     // Cache diagnosis: a byte-stable system prompt is the precondition for
     // provider prompt caching. If this hash changes between turns of one
     // conversation, something turn-varying leaked into the prompt; if it is
     // stable and cacheRead stays 0, the miss is provider-side (e.g. OpenRouter
-    // routing the model across upstream hosts).
+    // routing the model across upstream hosts). This is the base prompt mikan
+    // builds; a `before_agent_start` extension may still rewrite it per turn
+    // (logged separately by the runner).
     const promptHash = createHash("sha256").update(systemPrompt).digest("hex").slice(0, 8);
-    log.logInfo(`[${conversationId}] System prompt: ${systemPrompt.length} chars, sha ${promptHash}`);
+    log.logInfo(`[${conversationId}] System prompt (base): ${systemPrompt.length} chars, sha ${promptHash}`);
     setEventContext({
         platform: platform.name,
         conversationId,
@@ -779,18 +1119,33 @@ async function prepareRunContext(params) {
     });
     setSandboxContext({ conversationId, userId: message.userId });
     setUploadFunction(async (filePath, title) => {
-        const hostPath = translateAttachPathToHost(filePath, pathContext);
+        const runtimePath = normalizeAttachRuntimePath(filePath, pathContext.runtimeWorkspaceRoot);
+        await withStagedRuntimeFile(executor, runtimePath, (stagedPath) => responder.uploadFile(stagedPath, title));
+    });
+    // generate_image writes its file host-side, so it uploads by host path —
+    // no staging through the sandbox, where the file may not be mounted.
+    setImageUploadFunction(async (hostPath, title) => {
         await responder.uploadFile(hostPath, title);
     });
+    // The react tool is available only when the responder supports reactions
+    // (interactive turns on platforms with reaction support); otherwise unset
+    // so the tool reports it is unavailable rather than silently no-op'ing.
+    setReactFunction(responder.react ? async (emoji) => responder.react(emoji) : null);
+    // Platform capability packs (e.g. GitHub PR/CI) enable themselves per run;
+    // core does not branch on platform name here.
+    bindPlatformToolPacks({
+        conversationId,
+        platformName: platform.name,
+        threadTs: message.threadTs,
+    });
     resetRunState(runState, responder, sessionConversation, message.userName, sessionUuid, triggerAttribution);
     const runQueue = createRunQueue(responder, runState);
     runState.queue = runQueue.queue;
     log.logInfo(`Context sizes - system: ${systemPrompt.length} chars, memory: ${memory.length} chars`);
     log.logInfo(`Channels: ${platform.channels.length}, Users: ${platform.users.length}`);
-    const { userMessage, imageAttachments } = buildPromptPayload(message, pathContext.runtimeWorkspaceRoot, pathContext);
+    const { userMessage, imageAttachments } = await buildPromptPayload(message, pathContext.runtimeWorkspaceRoot, pathContext, (runtimePath) => executor.readFileBase64(runtimePath));
     const turnInstructions = buildTurnInstructions(message.id.startsWith("event:"), triggerAttribution, platform.name);
     const finalUserMessage = turnInstructions ? `${turnInstructions}\n\n${userMessage}` : userMessage;
-    await writePromptDebugContext(conversationDir, systemPrompt, session, finalUserMessage, imageAttachments.length);
     return {
         sessionConversation,
         runQueue,
@@ -800,6 +1155,62 @@ async function prepareRunContext(params) {
         pathContext,
     };
 }
+/**
+ * The dream run reads a transcript in which the agent held its full tool set,
+ * but `sessionDreamTools` has since narrowed it. Left to infer its grant from
+ * the transcript, the model calls a tool it no longer holds and burns one of
+ * its five turns on the failure — so the grant is stated, and derived from the
+ * tools actually handed to the run rather than restated by hand.
+ */
+function sessionDreamPrompt(conversationMemoryPath, toolNames) {
+    // read/edit/write are core tools, so an empty grant does not arise today;
+    // the fallback only keeps this sentence coherent if that ever changes.
+    const grant = toolNames.length === 0
+        ? "You have no tools in this run and cannot change memory. Say so and stop."
+        : `Your tools this run: ${toolNames.join(", ")}. Nothing else will execute, including tools used earlier in this transcript. ${conversationMemoryPath} is the only path you may write.`;
+    return [
+        "Before this conversation is reset or rotated, preserve only durable information worth carrying into future sessions of this same conversation.",
+        `Review the existing transcript and update only the conversation-specific MEMORY.md at ${conversationMemoryPath}.`,
+        grant,
+        "Do not modify the workspace-level global MEMORY.md. Information from one DM or channel must not be promoted into memory shared with other conversations by this maintenance run.",
+        "Preserve durable decisions, preferences, facts, and ongoing work specific to this conversation. Preserve the concrete values and details needed to resume the work; do not replace them with abstract categories, summaries of retention rules, or statements that merely say a kind of information is durable. An explicit user statement that a fact, preference, or decision should persist is strong evidence that its exact content is worth preserving.",
+        "Deduplicate against existing conversation memory. Do not preserve transient discussion, tool noise, secrets, speculative details, or test scaffolding. If there is nothing new worth preserving, make no changes. Do no unrelated work.",
+    ].join("\n");
+}
+const SESSION_DREAM_BUDGET = {
+    maxDurationMs: 2 * 60 * 1000,
+    maxLlmCalls: 10,
+};
+function sessionDreamTools(tools, conversationMemoryPath) {
+    return tools
+        .filter((tool) => tool.name === "read" || tool.name === "edit" || tool.name === "write")
+        .map((tool) => {
+        if (tool.name === "read")
+            return tool;
+        return Object.assign({}, tool, {
+            execute: async (...args) => {
+                const params = args[1];
+                if (params.path !== conversationMemoryPath) {
+                    throw new Error(`Session Dream may only modify ${conversationMemoryPath}`);
+                }
+                return tool.execute(...args);
+            },
+        });
+    });
+}
+async function noopResponderMethod() { }
+function createNoopResponder() {
+    return {
+        respond: noopResponderMethod,
+        replaceResponse: noopResponderMethod,
+        respondDiagnostic: noopResponderMethod,
+        respondToolResult: noopResponderMethod,
+        setTyping: noopResponderMethod,
+        setWorking: noopResponderMethod,
+        uploadFile: noopResponderMethod,
+        deleteResponse: noopResponderMethod,
+    };
+}
 function formatAgentActorName(userName, fallback) {
     return userName ? `DM:${userName}` : fallback;
 }
@@ -837,7 +1248,12 @@ function attachSessionEventHandlers(params) {
                 label: extractToolLabel(event.toolName, event.args),
                 status: "running",
             });
-            queue.enqueue(() => replaceResponseWithToolProgress(responder, runState), "tool progress update");
+            if (event.toolName === "subagent") {
+                runState.subagentToolCalls.add(event.toolCallId);
+            }
+            else {
+                queue.enqueue(() => replaceResponseWithToolProgress(responder, runState), "tool progress update");
+            }
             addLifecycleBreadcrumb("agent.tool.started", {
                 tool: event.toolName,
                 ...baseAttrs,
@@ -845,6 +1261,16 @@ function attachSessionEventHandlers(params) {
             log.logToolStart(logCtx, event.toolName, label, event.args);
             return;
         }
+        if (event.type === "tool_execution_update") {
+            const subagentProgress = extractSubagentProgress(event.partialResult);
+            if (subagentProgress) {
+                runState.subagentProgress.set(event.toolCallId, subagentProgress);
+                runState.subagentToolCalls.add(event.toolCallId);
+                runState.suppressResponseDeltas = true;
+                scheduleToolProgressUpdate(responder, runState);
+            }
+            return;
+        }
         if (event.type === "tool_execution_end") {
             const resultStr = extractToolResultText(event.result);
             const pending = pendingTools.get(event.toolCallId);
@@ -856,7 +1282,15 @@ function attachSessionEventHandlers(params) {
             const progress = runState.toolProgress.get(event.toolCallId);
             if (progress)
                 progress.status = event.isError ? "error" : "done";
-            queue.enqueue(() => replaceResponseWithToolProgress(responder, runState), "tool progress update");
+            const subagentProgress = runState.subagentProgress.get(event.toolCallId);
+            if (subagentProgress) {
+                runState.subagentProgress.set(event.toolCallId, settleSubagentProgress(subagentProgress, event.isError));
+            }
+            flushToolProgressUpdate(responder, runState);
+            const completedProgress = runState.subagentProgress.get(event.toolCallId);
+            if (completedProgress)
+                runState.completedSubagentProgress.push(completedProgress);
+            runState.subagentProgress.delete(event.toolCallId);
             pendingTools.delete(event.toolCallId);
             const durationMs = pending ? Date.now() - pending.startTime : 0;
             Sentry.metrics.count("agent.tool.calls", 1, {
@@ -884,6 +1318,9 @@ function attachSessionEventHandlers(params) {
             }
             else {
                 log.logToolSuccess(logCtx, event.toolName, durationMs, resultStr);
+                if (event.toolName === "slack_blockkit") {
+                    runState.finalResponseHandledByTool = true;
+                }
             }
             return;
         }
@@ -913,7 +1350,7 @@ function attachSessionEventHandlers(params) {
                     actorName: formatAgentActorName(logCtx.userName, logCtx.conversationId),
                     event: { kind: "responseDelta", delta: assistantMessageEvent.delta },
                 });
-                if (responder.appendResponseDelta) {
+                if (responder.appendResponseDelta && !runState.suppressResponseDeltas) {
                     queue.enqueue(async () => {
                         await responder.appendResponseDelta?.(assistantMessageEvent.delta ?? "");
                     }, "response delta");
@@ -1010,6 +1447,12 @@ function attachSessionEventHandlers(params) {
                         actorName: formatAgentActorName(logCtx.userName, logCtx.conversationId),
                         event: { kind: "turnEnd" },
                     });
+                    // A run that produced a subagent dashboard finalizes through it:
+                    // finalizeRunResponse renders "dashboard, blank line, answer", and a
+                    // finish here would first overwrite the dashboard with the bare
+                    // answer on every platform.
+                    if (runState.completedSubagentProgress.length > 0)
+                        return;
                     if (responder.finishResponse) {
                         queue.enqueue(async () => {
                             await responder.finishResponse?.(finalText);
@@ -1069,27 +1512,6 @@ function attachSessionEventHandlers(params) {
         }
     });
 }
-function extractToolResultText(result) {
-    if (typeof result === "string") {
-        return result;
-    }
-    if (result &&
-        typeof result === "object" &&
-        "content" in result &&
-        Array.isArray(result.content)) {
-        const content = result.content;
-        const textParts = [];
-        for (const part of content) {
-            if (part.type === "text" && part.text) {
-                textParts.push(part.text);
-            }
-        }
-        if (textParts.length > 0) {
-            return textParts.join("\n");
-        }
-    }
-    return JSON.stringify(result);
-}
 /**
  * Create a new PiAgentWrapper for a channel.
  * Sets up the session and subscribes to events once.
@@ -1097,32 +1519,45 @@ function extractToolResultText(result) {
  * Runner caching is handled by the caller (channelStates in main.ts).
  * This is a stateless factory function.
  */
-export async function createRunner(sandboxConfig, sessionKey, conversationId, conversationDir, workspaceDir, sessionScope, vaultManager, provisioner, sessionView, platformNotifier) {
-    const agentConfig = resolveConversationSettings(conversationDir);
-    const workspaceBase = join(conversationDir, "..");
-    const { executionResolver, executor, getPathContext, resolveExecutorForRun } = createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, workspaceDir, workspaceBase);
-    let pathContext = getUnresolvedSandboxPathContext(sandboxConfig, workspaceBase);
-    // Create tools (per-runner, with per-runner upload function setter)
-    const { tools, setUploadFunction, setEventContext, setSandboxContext } = createMikanTools(executor, workspaceDir, { sandbox: sandboxConfig, provisioner });
-    const modelRegistry = MikanModels.create();
+export async function createRunner(options) {
+    const { sandboxConfig, sessionKey, office, sessionScope, vaultManager, provisioner, resourceController, sessionView, platformNotifier, platformReactor, platformUploader, platformBlockKit, platformDmOpener, platformHistoryFetcher, platformUserLister, extensionScheduleEngine, platformToolPackFactories, } = options;
+    const conversationId = office.address.conversationId;
+    const conversationDir = office.dir;
+    const workspaceDir = office.workspace.root;
+    const agentConfig = resolveConversationSettings(office);
+    const projection = resolveWorkspaceProjection(office);
+    assertSandboxSupportsWorkspacePolicy(sandboxConfig, projection.doorPolicy);
+    const { executionResolver, executor, getPathContext, resolveExecutorForRun } = createRunnerExecutionContext(sandboxConfig, vaultManager, provisioner, office.workspace);
+    let pathContext = getUnresolvedSandboxPathContext(sandboxConfig, workspaceDir);
+    const modelRegistry = options.models ?? MikanModels.create();
     if (modelRegistry.getError()) {
         log.logWarning("models.json load error", modelRegistry.getError());
     }
-    const model = resolveConfiguredModel(modelRegistry, agentConfig.provider, agentConfig.model);
+    const model = modelRegistry.resolve(agentConfig.provider, agentConfig.model);
+    // Create tools (per-runner, with per-runner upload function setter)
+    const { tools, setUploadFunction, setImageUploadFunction, setReactFunction, bindPlatformToolPacks, setEventContext, setSandboxContext, } = createMikanTools(executor, workspaceDir, { sandbox: sandboxConfig, resourceController: resourceController ?? provisioner }, platformToolPackFactories ?? [], {
+        model,
+        getApiKey: () => modelRegistry.getApiKeyForProvider(model.provider),
+        // The conversation's own office dir: mounted into the sandbox, unlike
+        // the workspace base — generated images must land somewhere the agent
+        // (and a future run) can still reach.
+        outputDir: conversationDir,
+    });
     // Initial system prompt (will be updated each run with fresh memory/channels/users/skills)
-    const memory = await getMemory(conversationDir);
-    const skills = loadMikanSkills(conversationDir, pathContext.runtimeWorkspaceRoot);
+    const memory = await getMemory(projection);
+    const { skills, skippedSkillLinks } = loadMikanSkills(office, pathContext.runtimeWorkspaceRoot, projection);
     const emptyPlatform = {
         name: "chat",
         formattingGuide: "",
         channels: [],
         users: [],
+        trustModel: "membership",
     };
-    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, conversationId, "shared", undefined, memory, sandboxConfig, emptyPlatform, skills);
+    const systemPrompt = buildSystemPrompt(pathContext.runtimeWorkspaceRoot, office, "shared", undefined, memory, sandboxConfig, emptyPlatform, skills, projection, skippedSkillLinks);
     // Create session manager and settings manager. Top-level/private sessions
     // use the conversation's current pointer; scoped sessions use fixed files.
     // Platform-specific scope behavior is resolved before runner creation.
-    const isThread = sessionKey.includes(":");
+    const isThread = isThreadSessionKey(sessionKey);
     const { contextFile, threadRootMessage } = sessionScope;
     const sessionManager = openManagedSession(contextFile, pathContext.runtimeWorkspaceRoot);
     const threadSessionName = buildThreadSessionName(threadRootMessage);
@@ -1130,10 +1565,9 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
         sessionManager.appendSessionInfo(threadSessionName);
     }
     const sessionUuid = extractSessionUuid(contextFile);
-    const chatSessionManager = new AgentMemoryFileManager();
-    const { session, extensionSkills } = await createConfiguredAgentSession({
-        conversationId,
-        workspaceDir,
+    const chatSessionManager = new ChatHistorySync();
+    const { session, extensionSkills, extensionRegistry, disposeExtensions } = await createConfiguredAgentSession({
+        office,
         systemPrompt,
         model,
         thinkingLevel: agentConfig.thinkingLevel,
@@ -1142,6 +1576,13 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
         models: modelRegistry,
         vaultManager,
         platformNotifier,
+        platformReactor,
+        platformUploader,
+        platformBlockKit,
+        platformDmOpener,
+        platformHistoryFetcher,
+        platformUserLister,
+        extensionScheduleEngine,
     });
     // Mutable per-run state - event handler references this
     const runState = createRunState();
@@ -1160,8 +1601,7 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
                 message,
                 responder,
                 platform,
-                conversationId,
-                conversationDir,
+                office,
                 sessionUuid,
                 runState,
                 executor,
@@ -1173,6 +1613,9 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
                 setEventContext,
                 setSandboxContext,
                 setUploadFunction,
+                setImageUploadFunction,
+                setReactFunction,
+                bindPlatformToolPacks,
                 pathContext,
             });
             pathContext = prepared.pathContext;
@@ -1201,10 +1644,39 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
             // Autonomous (event/trigger) runs get an explicit resource ceiling since
             // no human is watching the loop; interactive turns stay human-gated.
             const isEventRun = message.id.startsWith("event:");
-            await session.prompt(prepared.userMessage, {
+            // Event runs have no triggering platform message, so identity fields
+            // stay unset and extensions must null-check them.
+            const origin = isEventRun
+                ? { kind: "event", platform: platform.name }
+                : {
+                    kind: "interactive",
+                    platform: platform.name,
+                    messageTs: message.id,
+                    userId: message.userId,
+                    userName: message.userName,
+                    threadTs: message.threadTs,
+                    attachments: message.attachments,
+                };
+            const outcome = await session.prompt(prepared.userMessage, {
+                origin,
                 ...(prepared.imageAttachments.length > 0 ? { images: prepared.imageAttachments } : {}),
                 ...(isEventRun ? { budget: DEFAULT_EVENT_BUDGET } : {}),
             });
+            if (outcome?.blocked) {
+                const text = outcome.reason
+                    ? `_Turn blocked by an extension: ${outcome.reason}_`
+                    : "_Turn blocked by an extension._";
+                sendAgentEvent({
+                    sessionId: sessionUuid,
+                    actorName: formatAgentActorName(message.userName, prepared.sessionConversation),
+                    event: { kind: "diagnostic", text },
+                });
+                await responder.respondDiagnostic(text, { style: "muted" });
+                runState.responder = null;
+                runState.logCtx = null;
+                runState.queue = null;
+                return { stopReason: "blocked" };
+            }
             // Wait for queued messages
             await prepared.runQueue.wait();
             const sessionViewTokenStore = sessionView?.tokenStore;
@@ -1247,9 +1719,89 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
             runState.queue = null;
             return { stopReason: runState.stopReason, errorMessage: runState.errorMessage };
         },
+        async dreamSessionMemory(message, platform) {
+            const responder = createNoopResponder();
+            const prepared = await prepareRunContext({
+                message,
+                responder,
+                platform,
+                office,
+                sessionUuid,
+                runState,
+                executor,
+                executionResolver,
+                resolveExecutorForRun,
+                getPathContext,
+                session,
+                extensionSkills,
+                setEventContext,
+                setSandboxContext,
+                setUploadFunction,
+                setImageUploadFunction,
+                setReactFunction,
+                bindPlatformToolPacks,
+                pathContext,
+            });
+            pathContext = prepared.pathContext;
+            try {
+                const conversationMemoryPath = posix.join(prepared.pathContext.runtimeWorkspaceRoot, office.key, "MEMORY.md");
+                const dreamTools = sessionDreamTools(session.agent.state.tools, conversationMemoryPath);
+                const outcome = await session.prompt(sessionDreamPrompt(conversationMemoryPath, dreamTools.map((tool) => tool.name)), {
+                    origin: {
+                        kind: "interactive",
+                        platform: platform.name,
+                        messageTs: message.id,
+                        userId: message.userId,
+                        userName: message.userName,
+                        threadTs: message.threadTs,
+                        attachments: message.attachments,
+                    },
+                    budget: SESSION_DREAM_BUDGET,
+                    tools: dreamTools,
+                });
+                if (outcome?.blocked) {
+                    return { stopReason: "blocked", errorMessage: outcome.reason };
+                }
+                await prepared.runQueue.wait();
+                // A budget abort carries its reason in the tally, not in errorMessage,
+                // and that reason is the only thing that tells the user why memory was
+                // not preserved.
+                return {
+                    stopReason: runState.stopReason,
+                    errorMessage: runState.errorMessage ?? session.getLastRunStats().budgetExceededReason,
+                };
+            }
+            finally {
+                runState.responder = null;
+                runState.logCtx = null;
+                runState.queue = null;
+            }
+        },
         abort() {
             session.abort();
         },
+        async tryExtensionCommand(message, responder) {
+            const parsed = parseCommandInput(message.text);
+            if (!parsed)
+                return false;
+            return extensionRegistry.dispatchCommand(parsed.name, {
+                args: parsed.args,
+                conversationId,
+                userId: message.userId,
+                userName: message.userName,
+                threadTs: message.threadTs,
+                respond: (text) => responder.respond(text),
+            });
+        },
+        async tryExtensionAction(slug, action) {
+            return extensionRegistry.dispatchAction(slug, action);
+        },
+        async tryExtensionScheduleCallback(slug, callback, event) {
+            return extensionRegistry.dispatchScheduleCallback(slug, callback, event);
+        },
+        async dispose() {
+            await disposeExtensions();
+        },
         getCurrentStep() {
             const pending = runState.pendingTools;
             if (pending.size === 0)
@@ -1265,13 +1817,4 @@ export async function createRunner(sandboxConfig, sessionKey, conversationId, co
         },
     };
 }
-export function translateRuntimePathToHost(runtimePath, pathContext) {
-    return pathContext.runtimeToHostPath?.(runtimePath) ?? runtimePath;
-}
-export function translateAttachPathToHost(filePath, pathContext) {
-    const runtimePath = posix.isAbsolute(filePath)
-        ? filePath
-        : posix.join(pathContext.runtimeWorkspaceRoot, filePath);
-    return translateRuntimePathToHost(runtimePath, pathContext);
-}
 //# sourceMappingURL=agent.js.map