@hasna/conversations 0.2.42 → 0.2.44

package/bin/index.js

@@ -6,39 +6,60 @@ var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: () => mod[key],
+        get: __accessProp.bind(mod, key),
         enumerable: true
       });
+  if (canCache)
+    cache.set(mod, to);
   return to;
 };
-var __moduleCache = /* @__PURE__ */ new WeakMap;
 var __toCommonJS = (from) => {
-  var entry = __moduleCache.get(from), desc;
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
   if (entry)
     return entry;
   entry = __defProp({}, "__esModule", { value: true });
-  if (from && typeof from === "object" || typeof from === "function")
-    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    }));
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
   __moduleCache.set(from, entry);
   return entry;
 };
+var __moduleCache;
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name] = () => newValue
+      set: __exportSetter.bind(all, name)
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -2235,7 +2256,7 @@ var init_names = __esm(() => {
   ];
 });
 
-// ../../../../node_modules/@hasna/cloud/dist/index.js
+// node_modules/@hasna/cloud/dist/index.js
 var exports_dist = {};
 __export(exports_dist, {
   translateSql: () => translateSql,
@@ -2330,11 +2351,11 @@ import { join as join5 } from "path";
 import { join as join6, dirname } from "path";
 import { existsSync as existsSync6, writeFileSync as writeFileSync2, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
 import { homedir as homedir5, platform } from "os";
-function __accessProp(key) {
+function __accessProp2(key) {
   return this[key];
 }
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
+function __exportSetter2(name, newValue) {
+  this[name] = __returnValue2.bind(null, newValue);
 }
 function translateSql(sql, dialect) {
   if (dialect === "sqlite")
@@ -3647,9 +3668,9 @@ async function syncTransfer(source, target, options, _direction) {
           const batch = rows.slice(offset, offset + batchSize);
           try {
             if (isAsyncAdapter(target)) {
-              await batchUpsertPg(target, table, columns, updateCols, pkColumns, batch, columns.includes(conflictColumn) ? conflictColumn : undefined);
+              await batchUpsertPg(target, table, columns, updateCols, pkColumns, batch);
             } else {
-              batchUpsertSqlite(target, table, columns, updateCols, pkColumns, batch, columns.includes(conflictColumn) ? conflictColumn : undefined);
+              batchUpsertSqlite(target, table, columns, updateCols, pkColumns, batch);
             }
             result.rowsWritten += batch.length;
           } catch (err) {
@@ -3696,7 +3717,7 @@ async function syncTransfer(source, target, options, _direction) {
   }
   return results;
 }
-async function batchUpsertPg(target, table, columns, updateCols, primaryKeys, batch, conflictColumn) {
+async function batchUpsertPg(target, table, columns, updateCols, primaryKeys, batch) {
   if (batch.length === 0)
     return;
   const colList = columns.map((c) => `"${c}"`).join(", ");
@@ -3706,22 +3727,20 @@ async function batchUpsertPg(target, table, columns, updateCols, primaryKeys, ba
   }).join(", ");
   const pkList = primaryKeys.map((c) => `"${c}"`).join(", ");
   const setClause = updateCols.length > 0 ? updateCols.map((c) => `"${c}" = EXCLUDED."${c}"`).join(", ") : `"${primaryKeys[0]}" = EXCLUDED."${primaryKeys[0]}"`;
-  const whereClause = conflictColumn && updateCols.includes(conflictColumn) ? ` WHERE "${table}"."${conflictColumn}" IS NULL OR EXCLUDED."${conflictColumn}" >= "${table}"."${conflictColumn}"` : "";
   const sql = `INSERT INTO "${table}" (${colList}) VALUES ${valuePlaceholders}
-    ON CONFLICT (${pkList}) DO UPDATE SET ${setClause}${whereClause}`;
+    ON CONFLICT (${pkList}) DO UPDATE SET ${setClause}`;
   const params = batch.flatMap((row) => columns.map((c) => row[c] ?? null));
   await target.run(sql, ...params);
 }
-function batchUpsertSqlite(target, table, columns, updateCols, primaryKeys, batch, conflictColumn) {
+function batchUpsertSqlite(target, table, columns, updateCols, primaryKeys, batch) {
   if (batch.length === 0)
     return;
   const colList = columns.map((c) => `"${c}"`).join(", ");
   const valuePlaceholders = batch.map(() => `(${columns.map(() => "?").join(", ")})`).join(", ");
   const pkList = primaryKeys.map((c) => `"${c}"`).join(", ");
   const setClause = updateCols.length > 0 ? updateCols.map((c) => `"${c}" = EXCLUDED."${c}"`).join(", ") : `"${primaryKeys[0]}" = EXCLUDED."${primaryKeys[0]}"`;
-  const whereClause = conflictColumn && updateCols.includes(conflictColumn) ? ` WHERE "${table}"."${conflictColumn}" IS NULL OR EXCLUDED."${conflictColumn}" >= "${table}"."${conflictColumn}"` : "";
   const sql = `INSERT INTO "${table}" (${colList}) VALUES ${valuePlaceholders}
-    ON CONFLICT (${pkList}) DO UPDATE SET ${setClause}${whereClause}`;
+    ON CONFLICT (${pkList}) DO UPDATE SET ${setClause}`;
   const params = batch.flatMap((row) => columns.map((c) => coerceForSqlite(row[c])));
   target.run(sql, ...params);
 }
@@ -4791,7 +4810,7 @@ async function ensureAllPgDatabases() {
   }
   return results;
 }
-function registerCloudTools(server, serviceName, opts = {}) {
+function registerCloudTools(server, serviceName) {
   server.tool(`${serviceName}_cloud_status`, "Show cloud configuration and connection health", {}, async () => {
     const config = getCloudConfig();
     const lines = [
@@ -4824,13 +4843,8 @@ function registerCloudTools(server, serviceName, opts = {}) {
         isError: true
       };
     }
-    const local = new SqliteAdapter(opts.dbPath ?? getDbPath(serviceName));
+    const local = new SqliteAdapter(getDbPath(serviceName));
     const cloud = new PgAdapterAsync(getConnectionString(serviceName));
-    if (opts.migrations?.length) {
-      for (const sql of opts.migrations) {
-        await cloud.run(sql);
-      }
-    }
     const tableList = tablesStr ? tablesStr.split(",").map((t) => t.trim()) : listSqliteTables(local);
     const results = await syncPush(local, cloud, { tables: tableList });
     local.close();
@@ -4852,7 +4866,7 @@ function registerCloudTools(server, serviceName, opts = {}) {
         isError: true
       };
     }
-    const local = new SqliteAdapter(opts.dbPath ?? getDbPath(serviceName));
+    const local = new SqliteAdapter(getDbPath(serviceName));
     const cloud = new PgAdapterAsync(getConnectionString(serviceName));
     let tableList;
     if (tablesStr) {
@@ -4975,10 +4989,10 @@ function registerCloudCommands(program2, serviceName) {
     }
   });
 }
-var __create2, __getProtoOf2, __defProp2, __getOwnPropNames2, __hasOwnProp2, __toESMCache_node, __toESMCache_esm, __toESM2 = (mod, isNodeMode, target) => {
+var __create2, __getProtoOf2, __defProp2, __getOwnPropNames2, __hasOwnProp2, __toESMCache_node2, __toESMCache_esm2, __toESM2 = (mod, isNodeMode, target) => {
   var canCache = mod != null && typeof mod === "object";
   if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cache = isNodeMode ? __toESMCache_node2 ??= new WeakMap : __toESMCache_esm2 ??= new WeakMap;
     var cached = cache.get(mod);
     if (cached)
       return cached;
@@ -4988,19 +5002,19 @@ var __create2, __getProtoOf2, __defProp2, __getOwnPropNames2, __hasOwnProp2, __t
   for (let key of __getOwnPropNames2(mod))
     if (!__hasOwnProp2.call(to, key))
       __defProp2(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: __accessProp2.bind(mod, key),
         enumerable: true
       });
   if (canCache)
     cache.set(mod, to);
   return to;
-}, __commonJS2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports), __returnValue = (v) => v, __export2 = (target, all) => {
+}, __commonJS2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports), __returnValue2 = (v) => v, __export2 = (target, all) => {
   for (var name in all)
     __defProp2(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: __exportSetter2.bind(all, name)
     });
 }, __esm2 = (fn, res) => () => (fn && (res = fn(fn = 0)), res), __require2, require_postgres_array, require_arrayParser, require_postgres_date, require_mutable, require_postgres_interval, require_postgres_bytea, require_textParsers, require_pg_int8, require_binaryParsers, require_builtins, require_pg_types, require_defaults, require_utils, require_utils_legacy, require_utils_webcrypto, require_utils2, require_cert_signatures, require_sasl, require_type_overrides, require_pg_connection_string, require_connection_parameters, require_result, require_query, require_messages, require_buffer_writer, require_serializer, require_buffer_reader, require_parser, require_dist, require_empty, require_stream, require_connection, require_split2, require_helper, require_lib, require_client, require_pg_pool, require_query2, require_client2, require_lib2, import_lib, Client, Pool, Connection, types, Query, DatabaseError, escapeIdentifier, escapeLiteral, Result, TypeOverrides, defaults, esm_default, init_esm, init_adapter, util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
@@ -13357,6 +13371,137 @@ function getDbPath2() {
     return process.env.CONVERSATIONS_DB_PATH;
   return join7(getDataDir2(), "messages.db");
 }
+function parsePresenceTimestamp(value) {
+  if (typeof value !== "string" || !value)
+    return 0;
+  return new Date(`${value}Z`).getTime() || 0;
+}
+function normalizePresenceText(value) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = value.trim();
+  return normalized ? normalized : null;
+}
+function shouldRebuildAgentPresenceTable(columns) {
+  const byName = new Map(columns.map((column) => [column.name, column]));
+  const agentCol = byName.get("agent");
+  const projectCol = byName.get("project_id");
+  if (!agentCol)
+    return false;
+  if (!projectCol)
+    return true;
+  return agentCol.pk !== 1 || projectCol.pk !== 2 || projectCol.notnull !== 1 || byName.has("pid");
+}
+function rebuildLegacyAgentPresenceTable(db2) {
+  const fallbackNow = db2.prepare("SELECT strftime('%Y-%m-%dT%H:%M:%f', 'now') AS now").get().now;
+  const legacyRows = db2.prepare("SELECT rowid AS _rowid, * FROM agent_presence").all();
+  legacyRows.sort((left, right) => {
+    const lastSeenDelta = parsePresenceTimestamp(right.last_seen_at) - parsePresenceTimestamp(left.last_seen_at);
+    if (lastSeenDelta !== 0)
+      return lastSeenDelta;
+    const createdDelta = parsePresenceTimestamp(right.created_at) - parsePresenceTimestamp(left.created_at);
+    if (createdDelta !== 0)
+      return createdDelta;
+    const projectDelta = Number(Boolean(normalizePresenceText(right.project_id))) - Number(Boolean(normalizePresenceText(left.project_id)));
+    if (projectDelta !== 0)
+      return projectDelta;
+    return right._rowid - left._rowid;
+  });
+  const dedupedRows = new Map;
+  for (const row of legacyRows) {
+    const normalizedAgent = normalizePresenceText(row.agent)?.toLowerCase();
+    if (!normalizedAgent)
+      continue;
+    const storedProjectId = normalizePresenceText(row.project_id) ?? "";
+    const dedupeKey = `${normalizedAgent}\x00${storedProjectId}`;
+    if (dedupedRows.has(dedupeKey))
+      continue;
+    dedupedRows.set(dedupeKey, row);
+  }
+  db2.exec("BEGIN");
+  try {
+    db2.exec(`
+      CREATE TABLE agent_presence_new (
+        id TEXT NOT NULL,
+        agent TEXT NOT NULL,
+        session_id TEXT,
+        role TEXT NOT NULL DEFAULT 'agent',
+        project_id TEXT NOT NULL DEFAULT '',
+        status TEXT NOT NULL DEFAULT 'online',
+        last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%f', 'now')),
+        created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%f', 'now')),
+        metadata TEXT,
+        PRIMARY KEY (agent, project_id)
+      )
+    `);
+    const insertPresence = db2.prepare(`
+      INSERT INTO agent_presence_new (id, agent, session_id, role, project_id, status, last_seen_at, created_at, metadata)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+    for (const [dedupeKey, row] of dedupedRows) {
+      const [agent, projectKey] = dedupeKey.split("\x00");
+      const id = normalizePresenceText(row.id) ?? crypto.randomUUID().slice(0, 8);
+      const sessionId = normalizePresenceText(row.session_id);
+      const role = normalizePresenceText(row.role) ?? "agent";
+      const projectId = projectKey;
+      const status = normalizePresenceText(row.status) ?? "online";
+      const lastSeenAt = normalizePresenceText(row.last_seen_at) ?? fallbackNow;
+      const createdAt = normalizePresenceText(row.created_at) ?? lastSeenAt;
+      const metadata = typeof row.metadata === "string" ? row.metadata : row.metadata == null ? null : JSON.stringify(row.metadata);
+      insertPresence.run(id, agent, sessionId, role, projectId, status, lastSeenAt, createdAt, metadata);
+    }
+    db2.exec("DROP TABLE agent_presence");
+    db2.exec("ALTER TABLE agent_presence_new RENAME TO agent_presence");
+    db2.exec("COMMIT");
+  } catch (error) {
+    db2.exec("ROLLBACK");
+    throw error;
+  }
+}
+function collapseDuplicateAgentPresenceRows(db2) {
+  const rows = db2.prepare("SELECT rowid AS _rowid, * FROM agent_presence").all();
+  rows.sort((left, right) => {
+    const lastSeenDelta = parsePresenceTimestamp(right.last_seen_at) - parsePresenceTimestamp(left.last_seen_at);
+    if (lastSeenDelta !== 0)
+      return lastSeenDelta;
+    const createdDelta = parsePresenceTimestamp(right.created_at) - parsePresenceTimestamp(left.created_at);
+    if (createdDelta !== 0)
+      return createdDelta;
+    const projectDelta = Number(Boolean(normalizePresenceText(right.project_id))) - Number(Boolean(normalizePresenceText(left.project_id)));
+    if (projectDelta !== 0)
+      return projectDelta;
+    return right._rowid - left._rowid;
+  });
+  const rowIdsToDelete = [];
+  const seenAgents = new Set;
+  for (const row of rows) {
+    const normalizedAgent = normalizePresenceText(row.agent)?.toLowerCase();
+    if (!normalizedAgent)
+      continue;
+    if (seenAgents.has(normalizedAgent)) {
+      rowIdsToDelete.push(row._rowid);
+      continue;
+    }
+    seenAgents.add(normalizedAgent);
+  }
+  if (rowIdsToDelete.length === 0)
+    return;
+  db2.exec("BEGIN");
+  try {
+    const deleteRow = db2.prepare("DELETE FROM agent_presence WHERE rowid = ?");
+    for (const rowId of rowIdsToDelete) {
+      deleteRow.run(rowId);
+    }
+    db2.exec("COMMIT");
+  } catch (error) {
+    db2.exec("ROLLBACK");
+    throw error;
+  }
+}
+function ensureAgentPresenceAgentUniqueIndex(db2) {
+  collapseDuplicateAgentPresenceRows(db2);
+  db2.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_presence_agent_unique ON agent_presence(agent)");
+}
 function getDb() {
   if (db)
     return db;
@@ -13429,16 +13574,18 @@ function getDb() {
   db.exec(`
     CREATE TABLE IF NOT EXISTS agent_presence (
       id TEXT NOT NULL,
-      agent TEXT PRIMARY KEY,
+      agent TEXT NOT NULL,
       session_id TEXT,
       role TEXT NOT NULL DEFAULT 'agent',
-      project_id TEXT,
+      project_id TEXT NOT NULL DEFAULT '',
       status TEXT NOT NULL DEFAULT 'online',
       last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%f', 'now')),
       created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%f', 'now')),
-      metadata TEXT
+      metadata TEXT,
+      PRIMARY KEY (agent, project_id)
     )
   `);
+  ensureAgentPresenceAgentUniqueIndex(db);
   db.exec(`
     CREATE TABLE IF NOT EXISTS resource_locks (
       resource_type TEXT NOT NULL,
@@ -13540,8 +13687,13 @@ function getDb() {
     db.exec("UPDATE messages SET uuid = lower(hex(randomblob(16))) WHERE uuid IS NULL");
     db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_messages_uuid ON messages(uuid)");
   }
-  const presenceCols = db.prepare("PRAGMA table_info(agent_presence)").all();
-  const presenceColNames = presenceCols.map((c) => c.name);
+  let presenceCols = db.prepare("PRAGMA table_info(agent_presence)").all();
+  let presenceColNames = presenceCols.map((c) => c.name);
+  if (shouldRebuildAgentPresenceTable(presenceCols)) {
+    rebuildLegacyAgentPresenceTable(db);
+    presenceCols = db.prepare("PRAGMA table_info(agent_presence)").all();
+    presenceColNames = presenceCols.map((c) => c.name);
+  }
   if (!presenceColNames.includes("id")) {
     db.exec("ALTER TABLE agent_presence ADD COLUMN id TEXT NOT NULL DEFAULT ''");
     const rows = db.prepare("SELECT agent FROM agent_presence").all();
@@ -13562,7 +13714,9 @@ function getDb() {
   }
   if (!presenceColNames.includes("project_id")) {
     db.exec("ALTER TABLE agent_presence ADD COLUMN project_id TEXT");
+    db.exec("UPDATE agent_presence SET project_id = '' WHERE project_id IS NULL");
   }
+  ensureAgentPresenceAgentUniqueIndex(db);
   db.exec(`
     CREATE TABLE IF NOT EXISTS message_read_receipts (
       message_id INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
@@ -13969,6 +14123,8 @@ var init_spaces = __esm(() => {
 // src/lib/webhooks.ts
 import { readFileSync as readFileSync5 } from "fs";
 import { join as join10 } from "path";
+import dns from "dns";
+import net from "net";
 function getConfigPath2() {
   return process.env.CONVERSATIONS_CONFIG_PATH || join10(getDataDir2(), "config.json");
 }
@@ -14000,6 +14156,44 @@ function matchesEvent(webhook, msg) {
   }
   return false;
 }
+function isPrivateIP(ip) {
+  if (net.isIPv4(ip)) {
+    const parts = ip.split(".").map(Number);
+    if (parts[0] === 10)
+      return true;
+    if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31)
+      return true;
+    if (parts[0] === 192 && parts[1] === 168)
+      return true;
+    if (parts[0] === 127)
+      return true;
+    if (parts[0] === 169 && parts[1] === 254)
+      return true;
+    if (parts[0] === 0)
+      return true;
+  } else if (net.isIPv6(ip)) {
+    const lower = ip.toLowerCase();
+    if (lower === "::1" || lower.startsWith("::ffff:") || lower.startsWith("fc") || lower.startsWith("fd"))
+      return true;
+  }
+  return false;
+}
+async function validateWebhookUrl(urlStr) {
+  try {
+    const url = new URL(urlStr);
+    if (url.protocol !== "https:")
+      return false;
+    const hostname2 = url.hostname;
+    if (hostname2 === "localhost" || hostname2 === "0.0.0.0" || hostname2 === "127.0.0.1" || hostname2 === "::1")
+      return false;
+    const addresses = await dns.promises.lookup(hostname2, { all: true });
+    if (!Array.isArray(addresses))
+      return false;
+    return !addresses.some((a) => isPrivateIP(a.address));
+  } catch {
+    return false;
+  }
+}
 function fireWebhooks(msg) {
   const config = loadConfig();
   if (!config.webhooks || config.webhooks.length === 0)
@@ -14009,20 +14203,24 @@ function fireWebhooks(msg) {
       continue;
     if (!matchesEvent(webhook, msg))
       continue;
-    fetch(webhook.url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        id: msg.id,
-        from: msg.from_agent,
-        to: msg.to_agent,
-        space: msg.space,
-        content: msg.content,
-        priority: msg.priority,
-        blocking: msg.blocking,
-        created_at: msg.created_at
-      })
-    }).catch(() => {});
+    validateWebhookUrl(webhook.url).then((valid) => {
+      if (!valid)
+        return;
+      fetch(webhook.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: msg.id,
+          from: msg.from_agent,
+          to: msg.to_agent,
+          space: msg.space,
+          content: msg.content,
+          priority: msg.priority,
+          blocking: msg.blocking,
+          created_at: msg.created_at
+        })
+      }).catch(() => {});
+    });
   }
 }
 var cachedConfig = null, configLoadedAt = 0, CONFIG_CACHE_MS = 1e4;
@@ -14032,8 +14230,8 @@ var init_webhooks = __esm(() => {
 
 // src/lib/messages.ts
 import { randomUUID } from "crypto";
-import { mkdirSync as mkdirSync7, copyFileSync as copyFileSync3, statSync as statSync2 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync7, copyFileSync as copyFileSync3, statSync as statSync2, existsSync as existsSync9, realpathSync } from "fs";
+import { join as join11, basename, resolve } from "path";
 function compactMessage(msg) {
   const result = {};
   for (const key of Object.keys(msg)) {
@@ -14074,6 +14272,22 @@ function getAttachmentsDir() {
     return process.env.CONVERSATIONS_ATTACHMENTS_DIR;
   return join11(getDataDir2(), "attachments");
 }
+function validateAttachment(sourcePath, name) {
+  const absolute = resolve(sourcePath);
+  if (!existsSync9(absolute)) {
+    throw new Error(`Attachment source not found: ${sourcePath}`);
+  }
+  const real = realpathSync(absolute);
+  const stat = statSync2(real);
+  if (!stat.isFile()) {
+    throw new Error(`Attachment source must be a regular file: ${sourcePath}`);
+  }
+  const safeName = basename(name.replace(/\0/g, ""));
+  if (!safeName || safeName.startsWith(".")) {
+    throw new Error(`Invalid attachment name: ${name}`);
+  }
+  return { safeSource: real, safeName };
+}
 function guessMimeType(name) {
   const ext = name.split(".").pop()?.toLowerCase();
   const mimeMap = {
@@ -14141,14 +14355,15 @@ function sendMessage(opts) {
     mkdirSync7(attachmentsDir, { recursive: true });
     const attachmentInfos = [];
     for (const att of opts.attachments) {
-      const destPath = join11(attachmentsDir, att.name);
-      copyFileSync3(att.source_path, destPath);
+      const { safeSource, safeName } = validateAttachment(att.source_path, att.name);
+      const destPath = join11(attachmentsDir, safeName);
+      copyFileSync3(safeSource, destPath);
       const stat = statSync2(destPath);
       attachmentInfos.push({
-        name: att.name,
+        name: safeName,
         path: destPath,
         size: stat.size,
-        mime_type: guessMimeType(att.name)
+        mime_type: guessMimeType(safeName)
       });
     }
     const attachmentsJson = JSON.stringify(attachmentInfos);
@@ -14210,8 +14425,10 @@ function readMessages(opts = {}) {
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
   const resolvedLimit = isLatest ? Math.floor(opts.latest) : Number.isFinite(opts.limit) && opts.limit > 0 ? Math.floor(opts.limit) : 20;
   const order = isLatest ? "DESC" : opts.order?.toLowerCase() === "desc" ? "DESC" : "ASC";
-  const resolvedOffset = opts.offset && opts.offset > 0 ? Math.floor(opts.offset) : 0;
-  const rows = db2.prepare(`SELECT * FROM messages ${where} ORDER BY created_at ${order}, id ${order} LIMIT ${resolvedLimit} OFFSET ${resolvedOffset}`).all(...params);
+  const resolvedOffset = Number.isFinite(opts.offset) ? Math.floor(opts.offset) : 0;
+  const safeLimit = Math.max(1, Math.min(resolvedLimit, 1e4));
+  const safeOffset = Math.max(0, Math.floor(resolvedOffset));
+  const rows = db2.prepare(`SELECT * FROM messages ${where} ORDER BY created_at ${order}, id ${order} LIMIT ${safeLimit} OFFSET ${safeOffset}`).all(...params);
   let messages = rows.map(parseMessage);
   if (opts.include_reply_counts && messages.length > 0) {
     const db22 = getDb();
@@ -14257,10 +14474,20 @@ function getMessageById(id) {
   const row = db2.prepare("SELECT * FROM messages WHERE id = ?").get(id);
   return row ? parseMessage(row) : null;
 }
-function markReadByIds(ids) {
+function markReadByIds(ids, agent) {
   const db2 = getDb();
   if (ids.length === 0)
     return 0;
+  if (agent) {
+    const stmt2 = db2.prepare(`INSERT OR REPLACE INTO message_read_receipts (message_id, agent, read_at)
+       VALUES (?, ?, strftime('%Y-%m-%dT%H:%M:%f', 'now'))`);
+    const normalized = agent.toLowerCase();
+    for (const id of ids)
+      stmt2.run(id, normalized);
+    const placeholders2 = ids.map(() => "?").join(", ");
+    const update = db2.prepare(`UPDATE messages SET read_at = strftime('%Y-%m-%dT%H:%M:%f', 'now') WHERE id IN (${placeholders2}) AND read_at IS NULL`);
+    return update.run(...ids).changes;
+  }
   const placeholders = ids.map(() => "?").join(", ");
   const stmt = db2.prepare(`UPDATE messages SET read_at = strftime('%Y-%m-%dT%H:%M:%f', 'now') WHERE id IN (${placeholders}) AND read_at IS NULL`);
   const result = stmt.run(...ids);
@@ -14408,8 +14635,9 @@ function getPinnedMessages(opts) {
     params.push(opts.session_id);
   }
   const where = `WHERE ${conditions.join(" AND ")}`;
-  const limit = Number.isFinite(opts?.limit) && opts.limit > 0 ? `LIMIT ${Math.floor(opts.limit)}` : "";
-  const rows = db2.prepare(`SELECT * FROM messages ${where} ORDER BY pinned_at DESC, id DESC ${limit}`).all(...params);
+  const safeLimit = Number.isFinite(opts?.limit) && opts.limit > 0 ? Math.floor(opts.limit) : 0;
+  const limitClause = safeLimit > 0 ? `LIMIT ${safeLimit}` : "";
+  const rows = db2.prepare(`SELECT * FROM messages ${where} ORDER BY pinned_at DESC, id DESC ${limitClause}`).all(...params);
   return rows.map(parseMessage);
 }
 function getUnreadBlockers(agent) {
@@ -14598,11 +14826,11 @@ function getMessagesForAgent(agent, opts) {
   if (opts?.unread_only) {
     conditions.push("mm.notified_at IS NULL");
   }
-  const limit = opts?.limit ?? 50;
+  const safeLimit = Math.max(1, Math.min(Math.floor(opts?.limit ?? 50), 1000));
   const rows = db2.prepare(`SELECT m.*, mm.id AS mention_id FROM messages m
      JOIN message_mentions mm ON mm.message_id = m.id
      WHERE ${conditions.join(" AND ")}
-     ORDER BY m.created_at DESC LIMIT ${limit}`).all(...params);
+     ORDER BY m.created_at DESC LIMIT ${safeLimit}`).all(...params);
   return rows.map(({ mention_id, ...row }) => ({ message: parseMessage(row), mention_id }));
 }
 function markMentionsRead(agent, space) {
@@ -14797,6 +15025,33 @@ var renderInline = (text) => {
 var init_terminal_markdown = () => {};
 
 // src/lib/presence.ts
+function normalizeAgentName(name) {
+  return name.trim().toLowerCase();
+}
+function toStoredProjectId(projectId) {
+  const normalized = projectId?.trim() ?? "";
+  return normalized || "";
+}
+function fromStoredProjectId(projectId) {
+  const normalized = typeof projectId === "string" ? projectId.trim() : "";
+  return normalized || null;
+}
+function getPresenceByAgent(db2, agent) {
+  return db2.prepare(`
+    SELECT * FROM agent_presence
+    WHERE LOWER(agent) = ?
+    ORDER BY last_seen_at DESC
+    LIMIT 1
+  `).get(agent);
+}
+function getPresenceByAgentAndProject(db2, agent, projectId) {
+  return db2.prepare(`
+    SELECT * FROM agent_presence
+    WHERE LOWER(agent) = ? AND COALESCE(project_id, '') = ?
+    ORDER BY last_seen_at DESC
+    LIMIT 1
+  `).get(agent, projectId);
+}
 function parsePresence(row) {
   let metadata = null;
   if (row.metadata) {
@@ -14815,7 +15070,7 @@ function parsePresence(row) {
     agent: row.agent,
     session_id: row.session_id ?? null,
     role: row.role || "agent",
-    project_id: row.project_id ?? null,
+    project_id: fromStoredProjectId(row.project_id),
     status: row.status,
     last_seen_at: lastSeenAt,
     created_at: row.created_at || lastSeenAt,
@@ -14833,9 +15088,10 @@ function isAgentConflict(result) {
 }
 function registerAgent(name, sessionId, role, projectId) {
   const db2 = getDb();
-  const normalizedName = name.trim().toLowerCase();
+  const normalizedName = normalizeAgentName(name);
   const result = db2.transaction(() => {
-    const existing = db2.prepare("SELECT * FROM agent_presence WHERE agent = ?").get(normalizedName);
+    const existing = getPresenceByAgent(db2, normalizedName);
+    const storedProjectId = toStoredProjectId(projectId ?? existing?.project_id);
     if (existing) {
       const lastSeenAt = existing.last_seen_at;
       const existingSessionId = existing.session_id;
@@ -14853,12 +15109,26 @@ function registerAgent(name, sessionId, role, projectId) {
         };
       }
       const tookOver = existingSessionId !== sessionId;
-      db2.prepare(`
-        UPDATE agent_presence
-        SET session_id = ?, role = ?, project_id = ?, last_seen_at = strftime('%Y-%m-%dT%H:%M:%f', 'now')
-        WHERE agent = ?
-      `).run(sessionId, role || existing.role || "agent", projectId ?? existing.project_id ?? null, normalizedName);
-      const updated = db2.prepare("SELECT * FROM agent_presence WHERE agent = ?").get(normalizedName);
+      const existingId = existing.id;
+      const target = getPresenceByAgentAndProject(db2, normalizedName, storedProjectId);
+      if (target && target.id !== existingId) {
+        db2.prepare(`
+          UPDATE agent_presence
+          SET session_id = ?, role = ?, status = 'online', last_seen_at = strftime('%Y-%m-%dT%H:%M:%f', 'now')
+          WHERE id = ?
+        `).run(sessionId, role || existing.role || "agent", target.id);
+        db2.prepare("DELETE FROM agent_presence WHERE id = ?").run(existingId);
+      } else {
+        db2.prepare(`
+          UPDATE agent_presence
+          SET session_id = ?, role = ?, project_id = ?, status = 'online', last_seen_at = strftime('%Y-%m-%dT%H:%M:%f', 'now')
+          WHERE id = ?
+        `).run(sessionId, role || existing.role || "agent", storedProjectId, existingId);
+      }
+      const updated = getPresenceByAgentAndProject(db2, normalizedName, storedProjectId) ?? getPresenceByAgent(db2, normalizedName);
+      if (!updated) {
+        throw new Error(`Failed to update presence for agent "${normalizedName}"`);
+      }
       return { agent: parsePresence(updated), created: false, took_over: tookOver };
     }
     const id = crypto.randomUUID().slice(0, 8);
@@ -14866,33 +15136,60 @@ function registerAgent(name, sessionId, role, projectId) {
     db2.prepare(`
       INSERT INTO agent_presence (id, agent, session_id, role, project_id, status, last_seen_at, created_at)
       VALUES (?, ?, ?, ?, ?, 'online', strftime('%Y-%m-%dT%H:%M:%f', 'now'), strftime('%Y-%m-%dT%H:%M:%f', 'now'))
-    `).run(id, normalizedName, sessionId, resolvedRole, projectId ?? null);
-    const created = db2.prepare("SELECT * FROM agent_presence WHERE agent = ?").get(normalizedName);
+    `).run(id, normalizedName, sessionId, resolvedRole, storedProjectId);
+    const created = getPresenceByAgentAndProject(db2, normalizedName, storedProjectId) ?? getPresenceByAgent(db2, normalizedName);
+    if (!created) {
+      throw new Error(`Failed to create presence for agent "${normalizedName}"`);
+    }
     return { agent: parsePresence(created), created: true, took_over: false };
   });
   return result;
 }
-function heartbeat(agent, status, metadata, sessionId) {
+function heartbeat(agent, status, metadata, sessionId, projectId) {
   const db2 = getDb();
   const metadataJson = metadata ? JSON.stringify(metadata) : null;
   const resolvedStatus = status || "online";
-  const normalizedAgent = agent.trim().toLowerCase();
-  const existing = db2.prepare("SELECT id FROM agent_presence WHERE agent = ?").get(agent);
-  const id = existing?.id || crypto.randomUUID().slice(0, 8);
-  db2.prepare(`
-    INSERT INTO agent_presence (id, agent, session_id, role, status, last_seen_at, created_at, metadata)
-    VALUES (?, ?, ?, 'agent', ?, strftime('%Y-%m-%dT%H:%M:%f', 'now'), strftime('%Y-%m-%dT%H:%M:%f', 'now'), ?)
-    ON CONFLICT(agent) DO UPDATE SET
-      status = excluded.status,
-      last_seen_at = excluded.last_seen_at,
-      session_id = COALESCE(excluded.session_id, agent_presence.session_id),
-      metadata = excluded.metadata
-  `).run(id, normalizedAgent, sessionId ?? null, resolvedStatus, metadataJson);
+  const normalizedAgent = normalizeAgentName(agent);
+  db2.transaction(() => {
+    const existing = getPresenceByAgent(db2, normalizedAgent);
+    const storedProjectId = toStoredProjectId(projectId ?? existing?.project_id);
+    const id = existing?.id || crypto.randomUUID().slice(0, 8);
+    if (existing) {
+      const existingId = existing.id;
+      const target = getPresenceByAgentAndProject(db2, normalizedAgent, storedProjectId);
+      if (target && target.id !== existingId) {
+        db2.prepare(`
+          UPDATE agent_presence
+          SET status = ?,
+              last_seen_at = strftime('%Y-%m-%dT%H:%M:%f', 'now'),
+              session_id = COALESCE(?, session_id),
+              metadata = ?
+          WHERE id = ?
+        `).run(resolvedStatus, sessionId ?? null, metadataJson, target.id);
+        db2.prepare("DELETE FROM agent_presence WHERE id = ?").run(existingId);
+        return;
+      }
+      db2.prepare(`
+        UPDATE agent_presence
+        SET status = ?,
+            last_seen_at = strftime('%Y-%m-%dT%H:%M:%f', 'now'),
+            session_id = COALESCE(?, session_id),
+            metadata = ?,
+            project_id = ?
+        WHERE id = ?
+      `).run(resolvedStatus, sessionId ?? null, metadataJson, storedProjectId, existingId);
+      return;
+    }
+    db2.prepare(`
+      INSERT INTO agent_presence (id, agent, session_id, role, project_id, status, last_seen_at, created_at, metadata)
+      VALUES (?, ?, ?, 'agent', ?, ?, strftime('%Y-%m-%dT%H:%M:%f', 'now'), strftime('%Y-%m-%dT%H:%M:%f', 'now'), ?)
+    `).run(id, normalizedAgent, sessionId ?? null, storedProjectId, resolvedStatus, metadataJson);
+  });
 }
 function getPresence(agent) {
   const db2 = getDb();
-  const normalizedAgent = agent.trim().toLowerCase();
-  const row = db2.prepare("SELECT * FROM agent_presence WHERE LOWER(agent) = ?").get(normalizedAgent);
+  const normalizedAgent = normalizeAgentName(agent);
+  const row = getPresenceByAgent(db2, normalizedAgent);
   return row ? parsePresence(row) : null;
 }
 function listAgents(opts) {
@@ -14907,14 +15204,14 @@ function listAgents(opts) {
 }
 function removePresence(agent) {
   const db2 = getDb();
-  const normalizedAgent = agent.trim().toLowerCase();
+  const normalizedAgent = normalizeAgentName(agent);
   const result = db2.prepare("DELETE FROM agent_presence WHERE LOWER(agent) = ?").run(normalizedAgent);
   return result.changes > 0;
 }
 function renameAgent(oldName, newName) {
   const db2 = getDb();
-  const normalizedOld = oldName.trim().toLowerCase();
-  const normalizedNew = newName.trim().toLowerCase();
+  const normalizedOld = normalizeAgentName(oldName);
+  const normalizedNew = normalizeAgentName(newName);
   const existing = db2.prepare("SELECT agent FROM agent_presence WHERE LOWER(agent) = ?").get(normalizedOld);
   if (!existing)
     return false;
@@ -14924,6 +15221,40 @@ function renameAgent(oldName, newName) {
   db2.prepare("UPDATE agent_presence SET agent = ? WHERE LOWER(agent) = ?").run(normalizedNew, normalizedOld);
   return true;
 }
+function setPresenceProject(agent, projectId) {
+  const db2 = getDb();
+  const normalizedAgent = normalizeAgentName(agent);
+  const desiredProjectId = toStoredProjectId(projectId);
+  const latest = getPresenceByAgent(db2, normalizedAgent);
+  if (!latest) {
+    heartbeat(normalizedAgent, "online", undefined, undefined, projectId);
+    return;
+  }
+  const currentProjectId = toStoredProjectId(latest.project_id);
+  if (currentProjectId === desiredProjectId)
+    return;
+  db2.transaction(() => {
+    const latestId = latest.id;
+    const target = getPresenceByAgentAndProject(db2, normalizedAgent, desiredProjectId);
+    if (target && target.id !== latestId) {
+      db2.prepare(`
+        UPDATE agent_presence
+        SET status = ?,
+            last_seen_at = strftime('%Y-%m-%dT%H:%M:%f', 'now'),
+            session_id = COALESCE(?, session_id),
+            metadata = COALESCE(?, metadata)
+        WHERE LOWER(agent) = ? AND COALESCE(project_id, '') = ?
+      `).run(latest.status || target.status || "online", latest.session_id ?? null, latest.metadata ?? null, normalizedAgent, desiredProjectId);
+      db2.prepare("DELETE FROM agent_presence WHERE id = ?").run(latestId);
+      return;
+    }
+    db2.prepare(`
+      UPDATE agent_presence
+      SET project_id = ?, last_seen_at = strftime('%Y-%m-%dT%H:%M:%f', 'now')
+      WHERE id = ?
+    `).run(desiredProjectId, latestId);
+  });
+}
 var ONLINE_THRESHOLD_SECONDS = 60, CONFLICT_THRESHOLD_SECONDS;
 var init_presence = __esm(() => {
   init_db();
@@ -14934,7 +15265,7 @@ var init_presence = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/conversations",
-    version: "0.2.42",
+    version: "0.2.44",
     description: "Real-time CLI messaging for AI agents",
     type: "module",
     bin: {
@@ -15732,7 +16063,7 @@ var init_graph = __esm(() => {
 import chalk9 from "chalk";
 import { execSync } from "child_process";
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function countLines(message) {
   const matches = message.match(/\r?\n/g);
@@ -36508,7 +36839,7 @@ class Protocol {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error48) {
@@ -36520,7 +36851,7 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const earlyReject = (error48) => {
         reject(error48);
       };
@@ -36598,7 +36929,7 @@ class Protocol {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve(parseResult.data);
+            resolve2(parseResult.data);
           }
         } catch (error48) {
           reject(error48);
@@ -36789,12 +37120,12 @@ class Protocol {
         interval = task.pollInterval;
       }
     } catch {}
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve, interval);
+      const timeoutId = setTimeout(resolve2, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -39779,7 +40110,7 @@ var require_compile = __commonJS((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve.call(this, root, ref);
+    let _sch = resolve2.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a2 = root.localRefs) === null || _a2 === undefined ? undefined : _a2[ref];
       const { schemaId } = this.opts;
@@ -39806,7 +40137,7 @@ var require_compile = __commonJS((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve(root, ref) {
+  function resolve2(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -40336,7 +40667,7 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return uri;
   }
-  function resolve(baseURI, relativeURI, options) {
+  function resolve2(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse6(baseURI, schemelessOptions), parse6(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -40564,7 +40895,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   var fastUri = {
     SCHEMES,
     normalize,
-    resolve,
+    resolve: resolve2,
     resolveComponent,
     equal,
     serialize,
@@ -43152,7 +43483,7 @@ var require_formats = __commonJS((exports) => {
   }
   var TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
   function getTime(strictTimeZone) {
-    return function time(str) {
+    return function time3(str) {
       const matches = TIME.exec(str);
       if (!matches)
         return false;
@@ -44090,7 +44421,7 @@ class McpServer {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5000;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -44714,12 +45045,12 @@ class StdioServerTransport {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve();
+        resolve2();
       } else {
-        this._stdout.once("drain", resolve);
+        this._stdout.once("drain", resolve2);
       }
     });
   }
@@ -44730,6 +45061,7 @@ var init_stdio2 = __esm(() => {
 
 // src/mcp/tools/messaging.ts
 function registerMessagingTools(server, resolveProjectId) {
+  const _sessionInjectRate = new Map;
   server.registerTool("send_message", {
     description: "Send a DM to an agent by name, or to a specific agent-claude session by ID. When target_session_id is provided, the message is routed to that exact session and auto-injected into its conversation.",
     inputSchema: {
@@ -44769,6 +45101,22 @@ function registerMessagingTools(server, resolveProjectId) {
   }, async (args) => {
     const { target_session_id, content, from: fromParam, priority } = args;
     const from = resolveIdentity(fromParam);
+    const rateKey = `session:${from}:${target_session_id}`;
+    const now = Date.now();
+    const windowMs = 60000;
+    const maxPerWindow = 10;
+    const rateEntry = _sessionInjectRate.get(rateKey);
+    if (rateEntry && now - rateEntry.start < windowMs && rateEntry.count >= maxPerWindow) {
+      return {
+        content: [{ type: "text", text: `Rate limit: max ${maxPerWindow} session injections per minute. Try again soon.` }],
+        isError: true
+      };
+    }
+    if (!rateEntry || now - rateEntry.start >= windowMs) {
+      _sessionInjectRate.set(rateKey, { count: 1, start: now });
+    } else {
+      rateEntry.count++;
+    }
     const msg = sendMessage({
       from,
       to: `session:${target_session_id}`,
@@ -44806,7 +45154,7 @@ function registerMessagingTools(server, resolveProjectId) {
       project_id: args.project_id ?? resolveProjectId(undefined, agent)
     });
     if (args.mark_read !== false && messages.length > 0) {
-      markReadByIds(messages.map((m) => m.id));
+      markReadByIds(messages.map((m) => m.id), agent);
     }
     return {
       content: [{ type: "text", text: JSON.stringify({ messages, count: messages.length, offset: args.offset ?? 0 }) }]
@@ -45850,8 +46198,7 @@ function registerAgentTools(server, agentFocus, getAgentFocus) {
     const { project_id, from: fromParam } = args;
     const agent = resolveIdentity(fromParam);
     agentFocus.set(agent, { project_id });
-    const db2 = (await Promise.resolve().then(() => (init_db(), exports_db))).getDb();
-    db2.prepare("UPDATE agent_presence SET project_id = ? WHERE agent = ?").run(project_id, agent);
+    setPresenceProject(agent, project_id);
     return {
       content: [{ type: "text", text: JSON.stringify({ agent, focused: true, project_id }) }]
     };
@@ -45886,8 +46233,7 @@ function registerAgentTools(server, agentFocus, getAgentFocus) {
   }, async (args) => {
     const agent = resolveIdentity(args.from);
     agentFocus.delete(agent);
-    const db2 = (await Promise.resolve().then(() => (init_db(), exports_db))).getDb();
-    db2.prepare("UPDATE agent_presence SET project_id = NULL WHERE agent = ?").run(agent);
+    setPresenceProject(agent, null);
     return {
       content: [{ type: "text", text: JSON.stringify({ agent, focused: false, project_id: null }) }]
     };
@@ -46674,15 +47020,17 @@ var init_pg_migrations = __esm(() => {
 
   CREATE TABLE IF NOT EXISTS agent_presence (
     id TEXT NOT NULL DEFAULT '',
-    agent TEXT PRIMARY KEY,
+    agent TEXT NOT NULL,
     session_id TEXT,
     role TEXT NOT NULL DEFAULT 'agent',
-    project_id TEXT,
+    project_id TEXT NOT NULL DEFAULT '',
     status TEXT NOT NULL DEFAULT 'online',
     last_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-    metadata TEXT
+    metadata TEXT,
+    PRIMARY KEY (agent, project_id)
   );
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_presence_agent_unique ON agent_presence(agent);
 
   CREATE TABLE IF NOT EXISTS resource_locks (
     resource_type TEXT NOT NULL,
@@ -47160,7 +47508,7 @@ var init_telegram_channel = __esm(() => {
 
 // src/mcp/tools/tmux.ts
 function sleep2(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function parseOptionalDelayMs(value) {
   return typeof value === "number" && value >= 0 ? value : undefined;
@@ -47328,8 +47676,8 @@ var exports_serve = {};
 __export(exports_serve, {
   startDashboardServer: () => startDashboardServer
 });
-import { join as join14, resolve, sep } from "path";
-import { existsSync as existsSync10 } from "fs";
+import { join as join14, resolve as resolve2, sep } from "path";
+import { existsSync as existsSync11 } from "fs";
 function securityHeaders(base) {
   const headers = new Headers(base);
   if (!headers.has("X-Content-Type-Options"))
@@ -47427,7 +47775,7 @@ function startDashboardServer(port = 0, host) {
   const resolvedPort = normalizePort(port, 0);
   const resolvedHost = normalizeHost(host ?? process.env.CONVERSATIONS_DASHBOARD_HOST);
   const dashboardDist = join14(import.meta.dir, "../../dashboard/dist");
-  const hasDist = existsSync10(dashboardDist);
+  const hasDist = existsSync11(dashboardDist);
   const server2 = Bun.serve({
     port: resolvedPort,
     hostname: resolvedHost,
@@ -47835,9 +48183,9 @@ function startDashboardServer(port = 0, host) {
         }
       }
       if (hasDist) {
-        const baseDir = resolve(dashboardDist);
+        const baseDir = resolve2(dashboardDist);
         const safePath = path === "/" ? "index.html" : path.replace(/^\/+/, "");
-        const filePath = resolve(baseDir, safePath);
+        const filePath = resolve2(baseDir, safePath);
         if (!filePath.startsWith(baseDir + sep)) {
           return new Response("Not Found", { status: 404 });
         }
@@ -48906,13 +49254,13 @@ var gatherTrainingData = async (options = {}) => {
 
 // src/lib/model-config.ts
 init_db();
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync8, existsSync as existsSync9 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync8, existsSync as existsSync10 } from "fs";
 import { join as join12 } from "path";
 var DEFAULT_MODEL = "gpt-4o-mini";
 var CONFIG_DIR3 = getDataDir2();
 var CONFIG_PATH2 = join12(CONFIG_DIR3, "config.json");
 function readConfig() {
-  if (!existsSync9(CONFIG_PATH2))
+  if (!existsSync10(CONFIG_PATH2))
     return {};
   try {
     return JSON.parse(readFileSync6(CONFIG_PATH2, "utf-8"));
@@ -48921,7 +49269,7 @@ function readConfig() {
   }
 }
 function writeConfig(config) {
-  if (!existsSync9(CONFIG_DIR3)) {
+  if (!existsSync10(CONFIG_DIR3)) {
     mkdirSync8(CONFIG_DIR3, { recursive: true });
   }
   writeFileSync5(CONFIG_PATH2, JSON.stringify(config, null, 2), "utf-8");
@@ -50140,7 +50488,7 @@ function registerAgentCommands(program2) {
       console.error(chalk7.red(`Project "${projectArg}" not found.`));
       process.exit(1);
     }
-    getDb().prepare("UPDATE agent_presence SET project_id = ? WHERE agent = ?").run(project.id, agent);
+    setPresenceProject(agent, project.id);
     if (opts.json) {
       console.log(JSON.stringify({ agent, project_id: project.id, project_name: project.name, focused: true }));
     } else {
@@ -50150,7 +50498,7 @@ function registerAgentCommands(program2) {
   });
   focus.command("clear").description("Clear your project focus").option("--from <agent>", "Agent identity").option("-j, --json", "Output as JSON").action((opts) => {
     const agent = resolveIdentity(opts.from);
-    getDb().prepare("UPDATE agent_presence SET project_id = NULL WHERE agent = ?").run(agent);
+    setPresenceProject(agent, null);
     if (opts.json) {
       console.log(JSON.stringify({ agent, project_id: null, focused: false }));
     } else {