@hermespilot/link 0.1.4 → 0.1.6

package/dist/{chunk-T35GPRKF.js → chunk-VCQJ5DSN.js}

@@ -4,7 +4,7 @@ import Router from "@koa/router";
 import { Readable } from "stream";
 
 // src/constants.ts
-var LINK_VERSION = "0.1.4";
+var LINK_VERSION = "0.1.6";
 var LINK_COMMAND = "hermeslink";
 var LINK_DEFAULT_PORT = 52379;
 var LINK_RUNTIME_DIR_NAME = ".hermeslink";
@@ -23,6 +23,9 @@ function resolveRuntimePaths(homeDir = resolveRuntimeHome()) {
     stateFile: path.join(homeDir, "state.json"),
     credentialsFile: path.join(homeDir, "credentials.json"),
     databaseFile: path.join(homeDir, "link.db"),
+    conversationsDir: path.join(homeDir, "conversations"),
+    blobsDir: path.join(homeDir, "blobs"),
+    indexesDir: path.join(homeDir, "indexes"),
     logsDir: path.join(homeDir, "logs"),
     runDir: path.join(homeDir, "run"),
     pairingDir: path.join(homeDir, "pairing")
@@ -91,19 +94,11 @@ function normalizeConfiguredLanguage(language) {
   return defaultLinkConfig.language;
 }
 
-// src/http/errors.ts
-var LinkHttpError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-  }
-  status;
-  code;
-};
-function isLinkHttpError(error) {
-  return error instanceof LinkHttpError;
-}
+// src/conversations/conversation-service.ts
+import { EventEmitter } from "events";
+import { appendFile, mkdir as mkdir3, readdir, readFile as readFile3, rm as rm2, stat, writeFile as writeFile2 } from "fs/promises";
+import path4 from "path";
+import { createHash, randomUUID as randomUUID2 } from "crypto";
 
 // src/hermes/api-server.ts
 import { randomUUID } from "crypto";
@@ -205,6 +200,20 @@ function isNodeError2(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 
+// src/http/errors.ts
+var LinkHttpError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+function isLinkHttpError(error) {
+  return error instanceof LinkHttpError;
+}
+
 // src/hermes/api-server.ts
 var fallbackRuns = /* @__PURE__ */ new Map();
 async function listHermesModels(options = {}) {
@@ -270,7 +279,7 @@ async function cancelHermesRun(runId, options = {}) {
   }
   fallbackRuns.delete(runId);
 }
-async function callHermesApi(path6, init, options) {
+async function callHermesApi(path8, init, options) {
   const config = await readHermesApiServerConfig();
   if (!config.port || !config.key) {
     return new Response(null, { status: 503 });
@@ -280,7 +289,7 @@ async function callHermesApi(path6, init, options) {
   headers.set("accept", headers.get("accept") ?? "application/json");
   headers.set("x-api-key", config.key);
   headers.set("authorization", `Bearer ${config.key}`);
-  return await fetcher(`http://127.0.0.1:${config.port}${path6}`, {
+  return await fetcher(`http://127.0.0.1:${config.port}${path8}`, {
     ...init,
     headers
   }).catch(() => new Response(null, { status: 503 }));
@@ -314,19 +323,991 @@ function readString(payload, key) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 
+// src/hermes/cli.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+async function deleteHermesSession(sessionId) {
+  if (!sessionId.trim()) {
+    throw new LinkHttpError(400, "hermes_session_id_required", "Hermes session id is required");
+  }
+  try {
+    await execFileAsync(hermesBin(), ["sessions", "delete", sessionId, "--yes"], {
+      timeout: 1e4,
+      windowsHide: true
+    });
+  } catch (error) {
+    throw new LinkHttpError(
+      502,
+      "hermes_session_delete_failed",
+      error instanceof Error ? error.message : "Hermes session delete failed"
+    );
+  }
+}
+function hermesBin() {
+  return process.env.HERMES_BIN?.trim() || "hermes";
+}
+
+// src/conversations/conversation-service.ts
+var MAX_IMPORTED_BLOB_BYTES = 100 * 1024 * 1024;
+var MAX_UPLOADED_BLOB_BYTES = 50 * 1024 * 1024;
+var CONVERSATION_ID_PATTERN = /^conv_[a-f0-9]{32}$/u;
+var BLOB_ID_PATTERN = /^blob_[a-f0-9]{32}$/u;
+var MEDIA_TAG_PATTERN = /[`"']?MEDIA:\s*(`[^`\n]+`|"[^"\n]+"|'[^'\n]+'|(?:~\/|\/)\S+(?:[^\S\n]+\S+)*?\.(?:png|jpe?g|gif|webp|heic|pdf|txt|md|json|csv|mp4|mov|avi|mkv|webm|ogg|opus|mp3|wav|m4a)(?=[\s`"',;:)\]}]|$)|\S+)[`"']?/giu;
+var ConversationService = class {
+  constructor(paths, logger) {
+    this.paths = paths;
+    this.logger = logger;
+    this.emitter.setMaxListeners(0);
+  }
+  paths;
+  logger;
+  emitter = new EventEmitter();
+  async listConversations() {
+    await mkdir3(this.paths.conversationsDir, { recursive: true, mode: 448 });
+    const entries = await readdir(this.paths.conversationsDir, { withFileTypes: true }).catch((error) => {
+      if (isNodeError3(error, "ENOENT")) {
+        return [];
+      }
+      throw error;
+    });
+    const summaries = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      const manifest = await this.readManifest(entry.name).catch(() => null);
+      if (!manifest || manifest.status !== "active") {
+        continue;
+      }
+      const snapshot = await this.readSnapshot(entry.name).catch(() => emptySnapshot());
+      summaries.push(toSummary(manifest, snapshot));
+    }
+    return summaries.sort((left, right) => Date.parse(right.updated_at) - Date.parse(left.updated_at));
+  }
+  async createConversation(input = {}) {
+    await mkdir3(this.paths.conversationsDir, { recursive: true, mode: 448 });
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const id = `conv_${randomUUID2().replaceAll("-", "")}`;
+    const title = input.title?.trim() || "Untitled";
+    const manifest = {
+      id,
+      schema_version: 1,
+      kind: "direct",
+      title,
+      status: "active",
+      hermes_session_id: `hp_${id}`,
+      created_at: now,
+      updated_at: now,
+      last_event_seq: 0
+    };
+    await mkdir3(this.conversationDir(id), { recursive: true, mode: 448 });
+    await this.writeManifest(manifest);
+    await this.writeSnapshot(id, emptySnapshot());
+    const event = await this.appendEvent(manifest.id, {
+      type: "conversation.created",
+      payload: { title }
+    });
+    return { ...toSummary({ ...manifest, last_event_seq: event.seq }, emptySnapshot()), last_event_seq: event.seq };
+  }
+  async getMessages(conversationId) {
+    const manifest = await this.readActiveManifest(conversationId);
+    const snapshot = await this.readSnapshot(conversationId);
+    return {
+      messages: snapshot.messages,
+      last_event_seq: manifest.last_event_seq
+    };
+  }
+  async listEvents(conversationId, after = 0) {
+    await this.readManifest(conversationId);
+    const eventsPath = this.eventsPath(conversationId);
+    const raw = await readFile3(eventsPath, "utf8").catch((error) => {
+      if (isNodeError3(error, "ENOENT")) {
+        return "";
+      }
+      throw error;
+    });
+    return raw.split("\n").filter(Boolean).map((line) => JSON.parse(line)).filter((event) => event.seq > after);
+  }
+  subscribe(conversationId, listener) {
+    const eventName = this.liveEventName(conversationId);
+    this.emitter.on(eventName, listener);
+    return () => this.emitter.off(eventName, listener);
+  }
+  async sendMessage(input) {
+    const manifest = await this.readActiveManifest(input.conversationId);
+    const content = input.content.trim();
+    const userAttachmentParts = await this.resolveMessageAttachmentParts(
+      manifest.id,
+      input.attachments ?? []
+    );
+    if (!content && userAttachmentParts.length === 0) {
+      throw new LinkHttpError(400, "message_content_required", "message content is required");
+    }
+    const idempotencyKey = input.clientMessageId ?? input.idempotencyKey;
+    const snapshot = await this.readSnapshot(input.conversationId);
+    if (idempotencyKey) {
+      const existingUser = snapshot.messages.find((message) => message.client_message_id === idempotencyKey);
+      if (existingUser) {
+        const existingRun = snapshot.runs.find((run2) => run2.trigger_message_id === existingUser.id);
+        const existingAssistant = existingRun ? snapshot.messages.find((message) => message.id === existingRun.assistant_message_id) : null;
+        return {
+          conversation_id: manifest.id,
+          user_message: { id: existingUser.id, status: existingUser.status },
+          assistant_message: { id: existingAssistant?.id ?? "", status: existingAssistant?.status ?? "failed" },
+          run: { id: existingRun?.id ?? "", status: existingRun?.status ?? "unknown" },
+          last_event_seq: manifest.last_event_seq
+        };
+      }
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const userMessage = {
+      id: `msg_${randomUUID2().replaceAll("-", "")}`,
+      schema_version: 1,
+      conversation_id: manifest.id,
+      role: "user",
+      status: "completed",
+      client_message_id: idempotencyKey,
+      created_at: now,
+      updated_at: now,
+      sender: { id: "app_user", type: "human", display_name: "Me" },
+      parts: [{ type: "text", text: content }, ...userAttachmentParts],
+      attachments: userAttachmentParts.map((part) => ({
+        blob_id: part.blob,
+        mime: part.mime,
+        size: part.size,
+        filename: part.filename
+      })),
+      raw: { format: "hermes-link-user-message", payload: { content, attachments: input.attachments ?? [] } }
+    };
+    const assistantMessage = {
+      id: `msg_${randomUUID2().replaceAll("-", "")}`,
+      schema_version: 1,
+      conversation_id: manifest.id,
+      role: "assistant",
+      status: "streaming",
+      created_at: now,
+      updated_at: now,
+      sender: { id: "agent_default", type: "agent", display_name: "Hermes", profile: "default" },
+      parts: [{ type: "text", text: "" }],
+      attachments: []
+    };
+    const run = {
+      id: `run_${randomUUID2().replaceAll("-", "")}`,
+      conversation_id: manifest.id,
+      trigger_message_id: userMessage.id,
+      assistant_message_id: assistantMessage.id,
+      hermes_session_id: manifest.hermes_session_id,
+      status: "running",
+      started_at: now
+    };
+    snapshot.messages.push(userMessage, assistantMessage);
+    snapshot.runs.push(run);
+    await this.writeSnapshot(manifest.id, snapshot);
+    await this.appendEvent(manifest.id, {
+      type: "message.created",
+      message_id: userMessage.id,
+      payload: { message: userMessage }
+    });
+    await this.appendEvent(manifest.id, {
+      type: "message.created",
+      message_id: assistantMessage.id,
+      run_id: run.id,
+      payload: { message: assistantMessage }
+    });
+    const runEvent = await this.appendEvent(manifest.id, {
+      type: "run.started",
+      message_id: assistantMessage.id,
+      run_id: run.id,
+      payload: { run }
+    });
+    void this.startRunWorker(manifest.id, run.id, this.buildHermesInput(content, userAttachmentParts)).catch((error) => {
+      void this.failRun(manifest.id, run.id, error instanceof Error ? error.message : String(error));
+    });
+    return {
+      conversation_id: manifest.id,
+      user_message: { id: userMessage.id, status: userMessage.status },
+      assistant_message: { id: assistantMessage.id, status: assistantMessage.status },
+      run: { id: run.id, status: run.status },
+      last_event_seq: runEvent.seq
+    };
+  }
+  async deleteConversation(conversationId) {
+    const manifest = await this.readActiveManifest(conversationId);
+    const snapshot = await this.readSnapshot(conversationId).catch(() => emptySnapshot());
+    const referencedBlobIds = /* @__PURE__ */ new Set([
+      ...collectBlobIds(snapshot),
+      ...await this.listConversationBlobIds(conversationId)
+    ]);
+    await deleteHermesSession(manifest.hermes_session_id);
+    const deletedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const next = {
+      ...manifest,
+      status: "deleted_soft",
+      updated_at: deletedAt,
+      deleted_at: deletedAt
+    };
+    await this.writeManifest(next);
+    const deleteEvent = await this.appendEvent(conversationId, {
+      type: "conversation.deleted",
+      payload: { deleted_at: deletedAt, hermes_session_id: manifest.hermes_session_id }
+    });
+    await this.writeSnapshot(conversationId, emptySnapshot());
+    await writeFile2(this.eventsPath(conversationId), `${JSON.stringify(deleteEvent)}
+`, { mode: 384 });
+    await this.pruneConversationBlobReferences(conversationId, [...referencedBlobIds]);
+    return { conversation_id: conversationId, hermes_deleted: true, deleted_at: deletedAt };
+  }
+  async writeBlob(conversationId, input) {
+    await this.readActiveManifest(conversationId);
+    if (input.bytes.byteLength > MAX_UPLOADED_BLOB_BYTES) {
+      throw new LinkHttpError(413, "blob_too_large", "Blob is too large");
+    }
+    const id = `blob_${randomUUID2().replaceAll("-", "")}`;
+    const filePath = this.blobPath(id);
+    await mkdir3(path4.dirname(filePath), { recursive: true, mode: 448 });
+    await writeFile2(filePath, input.bytes, { mode: 384 });
+    const manifestPath = `${filePath}.json`;
+    const blob = {
+      id,
+      size: input.bytes.byteLength,
+      mime: input.mime || "application/octet-stream",
+      filename: sanitizeFilename(input.filename, id),
+      created_at: (/* @__PURE__ */ new Date()).toISOString(),
+      conversation_ids: [conversationId]
+    };
+    await writeJsonFile(manifestPath, blob);
+    await this.appendEvent(conversationId, {
+      type: "blob.created",
+      payload: blob
+    });
+    return blob;
+  }
+  async readBlob(conversationId, blobId) {
+    await this.readActiveManifest(conversationId);
+    const filePath = this.blobPath(blobId);
+    const manifest = await this.readBlobManifest(conversationId, blobId);
+    const bytes = await readFile3(filePath).catch((error) => {
+      if (isNodeError3(error, "ENOENT")) {
+        throw new LinkHttpError(404, "blob_not_found", "Blob was not found");
+      }
+      throw error;
+    });
+    return {
+      bytes,
+      mime: manifest.mime || "application/octet-stream",
+      filename: manifest.filename || blobId,
+      size: manifest.size || bytes.byteLength
+    };
+  }
+  async resolveMessageAttachmentParts(conversationId, attachments) {
+    const parts = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const attachment of attachments) {
+      const blobId = attachment.blob_id ?? attachment.blobId;
+      if (!blobId || seen.has(blobId)) {
+        continue;
+      }
+      seen.add(blobId);
+      const manifest = await this.readBlobManifest(conversationId, blobId);
+      const mime = manifest.mime || "application/octet-stream";
+      parts.push({
+        type: mediaKindForMime(mime),
+        blob: blobId,
+        mime,
+        size: manifest.size,
+        filename: manifest.filename || blobId,
+        url: `/api/v1/conversations/${encodeURIComponent(conversationId)}/blobs/${encodeURIComponent(blobId)}`
+      });
+    }
+    return parts;
+  }
+  buildHermesInput(content, parts) {
+    const attachmentLines = parts.filter((part) => part.blob).map((part) => {
+      const label = part.filename ?? part.blob;
+      const mime = part.mime ? `, ${part.mime}` : "";
+      const size = part.size ? `, ${part.size} bytes` : "";
+      return `- ${label}${mime}${size}: ${this.blobPath(part.blob)}`;
+    });
+    if (attachmentLines.length === 0) {
+      return content;
+    }
+    const prefix = content ? `${content}
+
+` : "";
+    return `${prefix}Attachments available on this computer:
+${attachmentLines.join("\n")}`;
+  }
+  async readBlobManifest(conversationId, blobId) {
+    assertValidConversationId(conversationId);
+    assertValidBlobId(blobId);
+    const manifest = await readJsonFile(
+      `${this.blobPath(blobId)}.json`
+    );
+    if (!manifest?.conversation_ids?.includes(conversationId)) {
+      throw new LinkHttpError(404, "blob_not_found", "Blob was not found");
+    }
+    return manifest;
+  }
+  async writeBlobFromFile(conversationId, source) {
+    const sourcePath = resolveMediaSourcePath(source.path);
+    const fileStat = await stat(sourcePath).catch((error) => {
+      if (isNodeError3(error, "ENOENT")) {
+        throw new LinkHttpError(404, "media_source_not_found", "Hermes output file was not found");
+      }
+      throw error;
+    });
+    if (!fileStat.isFile()) {
+      throw new LinkHttpError(400, "media_source_not_file", "Hermes output media source is not a file");
+    }
+    if (fileStat.size > MAX_IMPORTED_BLOB_BYTES) {
+      throw new LinkHttpError(413, "media_source_too_large", "Hermes output media source is too large");
+    }
+    return this.writeBlob(conversationId, {
+      bytes: await readFile3(sourcePath),
+      filename: path4.basename(sourcePath),
+      mime: source.mime ?? inferMimeType(sourcePath)
+    });
+  }
+  async startRunWorker(conversationId, runId, input) {
+    const snapshot = await this.readSnapshot(conversationId);
+    const run = snapshot.runs.find((item) => item.id === runId);
+    if (!run) {
+      return;
+    }
+    const runResponse = await createHermesRun({
+      input,
+      session_id: run.hermes_session_id,
+      conversation_history: buildConversationHistory(snapshot, run)
+    });
+    await this.updateRun(conversationId, runId, { hermes_run_id: runResponse.run_id });
+    const response = await streamHermesRunEvents(runResponse.run_id);
+    for await (const event of parseSseResponse(response)) {
+      if (!await this.isConversationActive(conversationId)) {
+        return;
+      }
+      const type = event.payloadType;
+      if (type === "run.completed") {
+        await this.importMediaReferencesForEvent(conversationId, runId, event);
+        await this.completeRun(conversationId, runId, event);
+        return;
+      }
+      if (type === "run.failed") {
+        await this.importMediaReferencesForEvent(conversationId, runId, event);
+        await this.failRun(conversationId, runId, readErrorMessage(event.payload) ?? "Hermes run failed", event);
+        return;
+      }
+      await this.persistHermesEvent(conversationId, runId, event);
+    }
+    await this.completeRun(conversationId, runId);
+  }
+  async persistHermesEvent(conversationId, runId, event) {
+    if (!await this.isConversationActive(conversationId)) {
+      return;
+    }
+    const type = event.payloadType;
+    if (type === "message.delta") {
+      const delta = readDelta(event.payload);
+      if (delta) {
+        await this.appendAssistantDelta(conversationId, runId, delta, event.payload);
+      }
+      return;
+    }
+    const messageId = await this.assistantMessageIdForRun(conversationId, runId);
+    await this.appendEvent(conversationId, {
+      type,
+      message_id: messageId,
+      run_id: runId,
+      payload: event.payload,
+      raw: { format: "hermes-run-event", payload: event.rawPayload }
+    });
+    if (messageId) {
+      await this.importMediaReferences(conversationId, runId, messageId, collectMediaReferences(event.payload));
+    }
+  }
+  async importMediaReferencesForEvent(conversationId, runId, event) {
+    const messageId = await this.assistantMessageIdForRun(conversationId, runId);
+    if (!messageId) {
+      return;
+    }
+    await this.importMediaReferences(conversationId, runId, messageId, collectMediaReferences(event.payload));
+  }
+  async appendAssistantDelta(conversationId, runId, delta, rawPayload) {
+    const snapshot = await this.readSnapshot(conversationId);
+    const run = snapshot.runs.find((item) => item.id === runId);
+    if (!run) {
+      return;
+    }
+    const assistant = snapshot.messages.find((message) => message.id === run.assistant_message_id);
+    if (!assistant) {
+      return;
+    }
+    const textPart = assistant.parts.find((part) => part.type === "text");
+    if (textPart) {
+      textPart.text = `${textPart.text ?? ""}${delta}`;
+    } else {
+      assistant.parts.push({ type: "text", text: delta });
+    }
+    assistant.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    assistant.raw = { format: "hermes-run-event", payload: rawPayload };
+    await this.writeSnapshot(conversationId, snapshot);
+    await this.appendEvent(conversationId, {
+      type: "message.delta",
+      message_id: assistant.id,
+      run_id: runId,
+      payload: { delta },
+      raw: { format: "hermes-run-event", payload: rawPayload }
+    });
+  }
+  async completeRun(conversationId, runId, source) {
+    let snapshot = await this.readSnapshot(conversationId);
+    let run = snapshot.runs.find((item) => item.id === runId);
+    if (!run) {
+      return;
+    }
+    const initialRun = run;
+    let assistant = snapshot.messages.find((message) => message.id === initialRun.assistant_message_id);
+    if (assistant) {
+      await this.importMediaReferences(conversationId, runId, assistant.id, collectMediaTags(messageText(assistant)));
+      snapshot = await this.readSnapshot(conversationId);
+      const refreshedRun = snapshot.runs.find((item) => item.id === runId);
+      if (!refreshedRun) {
+        return;
+      }
+      run = refreshedRun;
+      assistant = snapshot.messages.find((message) => message.id === refreshedRun.assistant_message_id);
+    }
+    const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+    run.status = "completed";
+    run.completed_at = completedAt;
+    if (assistant) {
+      assistant.status = "completed";
+      assistant.updated_at = completedAt;
+      cleanMessageTextParts(assistant);
+    }
+    await this.writeSnapshot(conversationId, snapshot);
+    if (assistant) {
+      await this.appendEvent(conversationId, {
+        type: "message.completed",
+        message_id: assistant.id,
+        run_id: runId,
+        payload: { message: assistant }
+      });
+    }
+    await this.appendEvent(conversationId, {
+      type: "run.completed",
+      message_id: assistant?.id,
+      run_id: runId,
+      payload: { run, ...source ? { hermes: source.payload } : {} },
+      ...source ? { raw: { format: "hermes-run-event", payload: source.rawPayload } } : {}
+    });
+  }
+  async failRun(conversationId, runId, message, source) {
+    const snapshot = await this.readSnapshot(conversationId).catch(() => null);
+    if (!snapshot) {
+      return;
+    }
+    const run = snapshot.runs.find((item) => item.id === runId);
+    if (!run) {
+      return;
+    }
+    run.status = "failed";
+    run.completed_at = (/* @__PURE__ */ new Date()).toISOString();
+    run.error_message = message;
+    const assistant = snapshot.messages.find((item) => item.id === run.assistant_message_id);
+    if (assistant) {
+      assistant.status = "failed";
+      assistant.updated_at = run.completed_at;
+      const textPart = assistant.parts.find((part) => part.type === "text");
+      if (textPart && !textPart.text) {
+        textPart.text = message;
+      }
+    }
+    await this.writeSnapshot(conversationId, snapshot);
+    await this.appendEvent(conversationId, {
+      type: "run.failed",
+      message_id: assistant?.id,
+      run_id: runId,
+      payload: { error: { message }, run, ...source ? { hermes: source.payload } : {} },
+      ...source ? { raw: { format: "hermes-run-event", payload: source.rawPayload } } : {}
+    });
+    void this.logger.warn("conversation_run_failed", { conversation_id: conversationId, run_id: runId, error: message });
+  }
+  async updateRun(conversationId, runId, patch) {
+    const snapshot = await this.readSnapshot(conversationId);
+    const run = snapshot.runs.find((item) => item.id === runId);
+    if (!run) {
+      return;
+    }
+    Object.assign(run, patch);
+    await this.writeSnapshot(conversationId, snapshot);
+  }
+  async assistantMessageIdForRun(conversationId, runId) {
+    const snapshot = await this.readSnapshot(conversationId).catch(() => null);
+    return snapshot?.runs.find((item) => item.id === runId)?.assistant_message_id;
+  }
+  async importMediaReferences(conversationId, runId, messageId, references) {
+    if (references.length === 0) {
+      return;
+    }
+    const snapshot = await this.readSnapshot(conversationId);
+    const assistant = snapshot.messages.find((message) => message.id === messageId);
+    if (!assistant) {
+      return;
+    }
+    const importedSourceKeys = readImportedMediaSourceKeys(assistant);
+    const importedParts = [];
+    for (const reference of references.slice(0, 10)) {
+      try {
+        const sourceKey = mediaSourceKey(reference.path);
+        if (importedSourceKeys.has(sourceKey)) {
+          continue;
+        }
+        const blob = await this.writeBlobFromFile(conversationId, reference);
+        const part = {
+          type: reference.kind ?? mediaKindForMime(blob.mime),
+          blob: blob.id,
+          mime: blob.mime,
+          size: blob.size,
+          filename: blob.filename,
+          url: `/api/v1/conversations/${encodeURIComponent(conversationId)}/blobs/${encodeURIComponent(blob.id)}`
+        };
+        assistant.parts.push(part);
+        assistant.attachments.push({
+          blob_id: blob.id,
+          mime: blob.mime,
+          size: blob.size,
+          filename: blob.filename,
+          source: "hermes_output"
+        });
+        importedSourceKeys.add(sourceKey);
+        importedParts.push(part);
+      } catch (error) {
+        void this.logger.warn("conversation_media_import_failed", {
+          conversation_id: conversationId,
+          run_id: runId,
+          message_id: messageId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    if (importedParts.length === 0) {
+      return;
+    }
+    assistant.hermes = {
+      ...toRecord2(assistant.hermes),
+      imported_media_source_keys: [...importedSourceKeys]
+    };
+    assistant.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    await this.writeSnapshot(conversationId, snapshot);
+    await this.appendEvent(conversationId, {
+      type: "message.parts.created",
+      message_id: messageId,
+      run_id: runId,
+      payload: { parts: importedParts }
+    });
+  }
+  async appendEvent(conversationId, input) {
+    const manifest = await this.readManifest(conversationId);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const event = {
+      ...input,
+      seq: manifest.last_event_seq + 1,
+      conversation_id: conversationId,
+      created_at: now
+    };
+    await mkdir3(this.conversationDir(conversationId), { recursive: true, mode: 448 });
+    await appendFile(this.eventsPath(conversationId), `${JSON.stringify(event)}
+`, { mode: 384 });
+    await this.writeManifest({
+      ...manifest,
+      last_event_seq: event.seq,
+      updated_at: now
+    });
+    this.emitter.emit(this.liveEventName(conversationId), event);
+    return event;
+  }
+  async readActiveManifest(conversationId) {
+    const manifest = await this.readManifest(conversationId);
+    if (manifest.status !== "active") {
+      throw new LinkHttpError(404, "conversation_not_found", "Conversation was not found");
+    }
+    return manifest;
+  }
+  async isConversationActive(conversationId) {
+    const manifest = await this.readManifest(conversationId).catch(() => null);
+    return manifest?.status === "active";
+  }
+  async readManifest(conversationId) {
+    const manifest = await readJsonFile(this.manifestPath(conversationId));
+    if (!manifest) {
+      throw new LinkHttpError(404, "conversation_not_found", "Conversation was not found");
+    }
+    return manifest;
+  }
+  writeManifest(manifest) {
+    return writeJsonFile(this.manifestPath(manifest.id), manifest);
+  }
+  async readSnapshot(conversationId) {
+    return await readJsonFile(this.snapshotPath(conversationId)) ?? emptySnapshot();
+  }
+  writeSnapshot(conversationId, snapshot) {
+    return writeJsonFile(this.snapshotPath(conversationId), snapshot);
+  }
+  conversationDir(conversationId) {
+    assertValidConversationId(conversationId);
+    return path4.join(this.paths.conversationsDir, conversationId);
+  }
+  manifestPath(conversationId) {
+    return path4.join(this.conversationDir(conversationId), "manifest.json");
+  }
+  snapshotPath(conversationId) {
+    return path4.join(this.conversationDir(conversationId), "snapshot.json");
+  }
+  eventsPath(conversationId) {
+    return path4.join(this.conversationDir(conversationId), "events.ndjson");
+  }
+  blobPath(blobId) {
+    assertValidBlobId(blobId);
+    return path4.join(this.paths.blobsDir, `${blobId}.bin`);
+  }
+  liveEventName(conversationId) {
+    return `conversation:${conversationId}`;
+  }
+  async pruneConversationBlobReferences(conversationId, blobIds) {
+    for (const blobId of blobIds) {
+      try {
+        const manifestPath = `${this.blobPath(blobId)}.json`;
+        const manifest = await readJsonFile(manifestPath);
+        const nextConversationIds = (manifest?.conversation_ids ?? []).filter((id) => id !== conversationId);
+        if (nextConversationIds.length > 0) {
+          await writeJsonFile(manifestPath, { ...manifest, conversation_ids: nextConversationIds });
+          continue;
+        }
+        await rm2(this.blobPath(blobId), { force: true });
+        await rm2(manifestPath, { force: true });
+      } catch (error) {
+        void this.logger.warn("conversation_blob_gc_failed", {
+          conversation_id: conversationId,
+          blob_id: blobId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  }
+  async listConversationBlobIds(conversationId) {
+    await mkdir3(this.paths.blobsDir, { recursive: true, mode: 448 });
+    const entries = await readdir(this.paths.blobsDir, { withFileTypes: true }).catch((error) => {
+      if (isNodeError3(error, "ENOENT")) {
+        return [];
+      }
+      throw error;
+    });
+    const blobIds = [];
+    for (const entry of entries) {
+      if (!entry.isFile() || !entry.name.endsWith(".bin.json")) {
+        continue;
+      }
+      const blobId = entry.name.slice(0, -".bin.json".length);
+      if (!BLOB_ID_PATTERN.test(blobId)) {
+        continue;
+      }
+      const manifest = await readJsonFile(
+        path4.join(this.paths.blobsDir, entry.name)
+      ).catch(() => null);
+      if (manifest?.conversation_ids?.includes(conversationId)) {
+        blobIds.push(blobId);
+      }
+    }
+    return blobIds;
+  }
+};
+async function* parseSseResponse(response) {
+  if (!response.body) {
+    return;
+  }
+  const decoder = new TextDecoder();
+  let buffer = "";
+  for await (const chunk of response.body) {
+    buffer += decoder.decode(chunk, { stream: true });
+    let separatorIndex = buffer.indexOf("\n\n");
+    while (separatorIndex >= 0) {
+      const block = buffer.slice(0, separatorIndex);
+      buffer = buffer.slice(separatorIndex + 2);
+      const parsed = parseSseBlock(block);
+      if (parsed) {
+        yield parsed;
+      }
+      separatorIndex = buffer.indexOf("\n\n");
+    }
+  }
+  const trailing = parseSseBlock(buffer);
+  if (trailing) {
+    yield trailing;
+  }
+}
+function parseSseBlock(block) {
+  const lines = block.split("\n");
+  let eventName = "";
+  const data = [];
+  for (const rawLine of lines) {
+    const line = rawLine.trimEnd();
+    if (line.startsWith("event:")) {
+      eventName = line.slice(6).trim();
+    } else if (line.startsWith("data:")) {
+      data.push(line.slice(5).trimStart());
+    }
+  }
+  if (!eventName && data.length === 0) {
+    return null;
+  }
+  const raw = data.join("\n");
+  const decoded = decodeJson(raw);
+  const payload = toRecord2(decoded);
+  const payloadType = (readString2(payload, "type") ?? readString2(payload, "event") ?? eventName) || "message";
+  return { eventName, payloadType, payload, rawPayload: decoded ?? raw };
+}
+function decodeJson(value) {
+  if (!value.trim()) {
+    return {};
+  }
+  try {
+    return JSON.parse(value);
+  } catch {
+    return { type: "message.delta", delta: value };
+  }
+}
+function emptySnapshot() {
+  return { schema_version: 1, messages: [], runs: [] };
+}
+function toSummary(manifest, snapshot) {
+  const lastMessage = [...snapshot.messages].reverse().find((message) => message.parts.some((part) => part.type === "text" && part.text));
+  return {
+    id: manifest.id,
+    title: manifest.title,
+    created_at: manifest.created_at,
+    updated_at: manifest.updated_at,
+    last_event_seq: manifest.last_event_seq,
+    last_message: lastMessage ? {
+      id: lastMessage.id,
+      role: lastMessage.role,
+      content_preview: previewText(lastMessage)
+    } : null
+  };
+}
+function previewText(message) {
+  return messageText(message).slice(0, 160);
+}
+function messageText(message) {
+  return message.parts.filter((part) => part.type === "text" && part.text).map((part) => part.text).join("").trim();
+}
+function buildConversationHistory(snapshot, run) {
+  const triggerIndex = snapshot.messages.findIndex((message) => message.id === run.trigger_message_id);
+  const previousMessages = triggerIndex >= 0 ? snapshot.messages.slice(0, triggerIndex) : snapshot.messages;
+  return previousMessages.filter((message) => (message.role === "user" || message.role === "assistant") && message.status === "completed").map((message) => ({
+    role: message.role,
+    content: messageText(message)
+  })).filter((message) => message.content);
+}
+function readDelta(payload) {
+  return readString2(payload, "delta") ?? readString2(payload, "text") ?? readString2(payload, "content");
+}
+function readErrorMessage(payload) {
+  const error = toRecord2(payload.error);
+  return readString2(error, "message") ?? readString2(payload, "message");
+}
+function collectMediaReferences(payload) {
+  const references = [];
+  collectStructuredMediaReferences(payload, references);
+  for (const key of ["output", "content", "message", "text"]) {
+    const value = payload[key];
+    if (typeof value === "string") {
+      references.push(...collectMediaTags(value));
+    }
+  }
+  const unique2 = /* @__PURE__ */ new Set();
+  return references.filter((reference) => {
+    const key = `${reference.path}|${reference.mime ?? ""}|${reference.kind ?? ""}`;
+    if (unique2.has(key)) {
+      return false;
+    }
+    unique2.add(key);
+    return true;
+  });
+}
+function collectStructuredMediaReferences(value, references, depth = 0) {
+  if (depth > 4 || value === null || typeof value !== "object") {
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      collectStructuredMediaReferences(item, references, depth + 1);
+    }
+    return;
+  }
+  const record = value;
+  for (const [key, item] of Object.entries(record)) {
+    if (typeof item === "string" && isExplicitMediaPathKey(key)) {
+      references.push({
+        path: item,
+        kind: mediaKindForMime(readString2(record, "mime") ?? readString2(record, "mime_type") ?? inferMimeType(item)),
+        mime: readString2(record, "mime") ?? readString2(record, "mime_type") ?? void 0
+      });
+      continue;
+    }
+    if (Array.isArray(item) || item !== null && typeof item === "object") {
+      collectStructuredMediaReferences(item, references, depth + 1);
+    }
+  }
+}
+function collectMediaTags(text) {
+  const references = [];
+  for (const match of text.matchAll(MEDIA_TAG_PATTERN)) {
+    const rawPath = match[1]?.trim();
+    const mediaPath = rawPath?.replace(/^["'`]|["'`]$/gu, "").replace(/["'`,.;:)}\]]+$/gu, "");
+    if (mediaPath) {
+      references.push({
+        path: mediaPath,
+        kind: mediaKindForMime(inferMimeType(mediaPath))
+      });
+    }
+  }
+  return references;
+}
+function cleanMessageTextParts(message) {
+  for (const part of message.parts) {
+    if (part.type === "text" && part.text) {
+      part.text = cleanHermesDisplayText(part.text);
+    }
+  }
+}
+function cleanHermesDisplayText(text) {
+  if (!text.includes("MEDIA:") && !text.includes("[[audio_as_voice]]")) {
+    return text;
+  }
+  return text.replaceAll("[[audio_as_voice]]", "").replace(MEDIA_TAG_PATTERN, "").replace(/\n{3,}/gu, "\n\n").trimEnd();
+}
+function isExplicitMediaPathKey(key) {
+  return [
+    "file_path",
+    "screenshot_path",
+    "image_path",
+    "audio_path",
+    "video_path",
+    "media_path",
+    "artifact_path"
+  ].includes(key);
+}
+function inferMimeType(filePath) {
+  const extension = path4.extname(filePath).toLowerCase();
+  return {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".heic": "image/heic",
+    ".pdf": "application/pdf",
+    ".txt": "text/plain",
+    ".md": "text/markdown",
+    ".json": "application/json",
+    ".csv": "text/csv",
+    ".mp3": "audio/mpeg",
+    ".wav": "audio/wav",
+    ".m4a": "audio/mp4",
+    ".ogg": "audio/ogg",
+    ".opus": "audio/ogg",
+    ".mp4": "video/mp4",
+    ".mov": "video/quicktime",
+    ".webm": "video/webm"
+  }[extension] ?? "application/octet-stream";
+}
+function mediaKindForMime(mime) {
+  if (mime.startsWith("image/")) {
+    return "image";
+  }
+  if (mime.startsWith("audio/")) {
+    return "audio";
+  }
+  return "file";
+}
+function collectBlobIds(snapshot) {
+  const blobIds = /* @__PURE__ */ new Set();
+  for (const message of snapshot.messages) {
+    for (const part of message.parts) {
+      if (part.blob) {
+        blobIds.add(part.blob);
+      }
+    }
+    for (const attachment of message.attachments) {
+      const record = toRecord2(attachment);
+      const blobId = readString2(record, "blob_id") ?? readString2(record, "blobId");
+      if (blobId) {
+        blobIds.add(blobId);
+      }
+    }
+  }
+  return [...blobIds];
+}
+function readImportedMediaSourceKeys(message) {
+  const hermes = toRecord2(message.hermes);
+  const keys = hermes.imported_media_source_keys;
+  if (!Array.isArray(keys)) {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(keys.filter((key) => typeof key === "string" && key.length > 0));
+}
+function mediaSourceKey(sourcePath) {
+  return createHash("sha256").update(resolveMediaSourcePath(sourcePath)).digest("hex").slice(0, 32);
+}
+function sanitizeFilename(value, fallback) {
+  const base = path4.basename((value ?? "").replace(/[\r\n\t]/gu, " ").trim());
+  const safe = base.replace(/[/:\\]/gu, "_").slice(0, 200).trim();
+  return safe || fallback;
+}
+function resolveMediaSourcePath(sourcePath) {
+  const trimmed = sourcePath.trim();
+  const expanded = trimmed.startsWith("~/") ? path4.join(process.env.HOME ?? "", trimmed.slice(2)) : trimmed;
+  const resolved = path4.resolve(expanded);
+  if (!path4.isAbsolute(expanded)) {
+    throw new LinkHttpError(400, "media_source_path_not_absolute", "Hermes output media source must be an absolute path");
+  }
+  return resolved;
+}
+function assertValidConversationId(conversationId) {
+  if (!CONVERSATION_ID_PATTERN.test(conversationId)) {
+    throw new LinkHttpError(404, "conversation_not_found", "Conversation was not found");
+  }
+}
+function assertValidBlobId(blobId) {
+  if (!BLOB_ID_PATTERN.test(blobId)) {
+    throw new LinkHttpError(404, "blob_not_found", "Blob was not found");
+  }
+}
+function readString2(payload, key) {
+  const value = payload[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function toRecord2(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function isNodeError3(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
 // src/hermes/profiles.ts
-import { mkdir as mkdir3, readdir, rename as rename2, rm as rm2, stat } from "fs/promises";
+import { mkdir as mkdir4, readdir as readdir2, rename as rename2, rm as rm3, stat as stat2 } from "fs/promises";
 import os3 from "os";
-import path4 from "path";
+import path5 from "path";
 var DEFAULT_PROFILE = "default";
 var PROFILE_NAME_PATTERN = /^[a-zA-Z0-9._-]{1,64}$/;
 async function listHermesProfiles(paths = resolveRuntimePaths()) {
   const activeProfile = await getActiveProfile(paths);
   const profiles = /* @__PURE__ */ new Map();
   profiles.set(DEFAULT_PROFILE, profileInfo(DEFAULT_PROFILE, activeProfile));
-  const profilesDir = path4.join(os3.homedir(), ".hermes", "profiles");
-  const entries = await readdir(profilesDir, { withFileTypes: true }).catch((error) => {
-    if (isNodeError3(error, "ENOENT")) {
+  const profilesDir = path5.join(os3.homedir(), ".hermes", "profiles");
+  const entries = await readdir2(profilesDir, { withFileTypes: true }).catch((error) => {
+    if (isNodeError4(error, "ENOENT")) {
       return [];
     }
     throw error;
@@ -349,8 +1330,8 @@ async function listHermesProfiles(paths = resolveRuntimePaths()) {
 async function getHermesProfileStatus(name, paths = resolveRuntimePaths()) {
   assertProfileName(name);
   const profile = profileInfo(name, await getActiveProfile(paths));
-  const exists = await stat(profile.path).then((value) => value.isDirectory()).catch((error) => {
-    if (isNodeError3(error, "ENOENT")) {
+  const exists = await stat2(profile.path).then((value) => value.isDirectory()).catch((error) => {
+    if (isNodeError4(error, "ENOENT")) {
       return false;
     }
     throw error;
@@ -371,14 +1352,14 @@ async function createHermesProfile(name) {
   if (await pathExists(profile.path)) {
     throw new Error("profile already exists");
   }
-  await mkdir3(profile.path, { recursive: true, mode: 448 });
+  await mkdir4(profile.path, { recursive: true, mode: 448 });
   await ensureHermesApiServerKey(name, profile.configPath);
   return profile;
 }
 async function useHermesProfile(name, paths = resolveRuntimePaths()) {
   assertProfileName(name);
   const profile = profileInfo(name, name);
-  await mkdir3(profile.path, { recursive: true, mode: 448 });
+  await mkdir4(profile.path, { recursive: true, mode: 448 });
   const current = await readJsonFile(paths.stateFile) ?? {};
   await writeJsonFile(paths.stateFile, { ...current, activeProfile: name });
   return profile;
@@ -393,7 +1374,7 @@ async function renameHermesProfile(oldName, newName) {
 }
 async function deleteHermesProfile(name) {
   assertMutableProfile(name);
-  await rm2(resolveHermesProfileDir(name), { recursive: true, force: true });
+  await rm3(resolveHermesProfileDir(name), { recursive: true, force: true });
 }
 async function getActiveProfile(paths) {
   const state = await readJsonFile(paths.stateFile);
@@ -419,20 +1400,20 @@ function assertProfileName(name) {
   }
 }
 async function pathExists(targetPath) {
-  return await stat(targetPath).then(() => true).catch((error) => {
-    if (isNodeError3(error, "ENOENT")) {
+  return await stat2(targetPath).then(() => true).catch((error) => {
+    if (isNodeError4(error, "ENOENT")) {
       return false;
     }
     throw error;
   });
 }
-function isNodeError3(error, code) {
+function isNodeError4(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 
 // src/identity/identity.ts
-import { generateKeyPairSync, randomUUID as randomUUID2, sign } from "crypto";
-import { mkdir as mkdir4, chmod } from "fs/promises";
+import { generateKeyPairSync, randomUUID as randomUUID3, sign } from "crypto";
+import { mkdir as mkdir5, chmod } from "fs/promises";
 import { z } from "zod";
 var linkIdentitySchema = z.object({
   install_id: z.string().min(1),
@@ -454,12 +1435,12 @@ async function ensureIdentity(paths = resolveRuntimePaths()) {
   if (existing) {
     return existing;
   }
-  await mkdir4(paths.homeDir, { recursive: true, mode: 448 });
+  await mkdir5(paths.homeDir, { recursive: true, mode: 448 });
   await chmod(paths.homeDir, 448).catch(() => void 0);
   const { publicKey, privateKey } = generateKeyPairSync("ed25519");
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const identity = {
-    install_id: `install_${randomUUID2().replaceAll("-", "")}`,
+    install_id: `install_${randomUUID3().replaceAll("-", "")}`,
     link_id: null,
     public_key_pem: publicKey.export({ type: "spki", format: "pem" }).toString(),
     private_key_pem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
@@ -492,8 +1473,12 @@ function getIdentityStatus(identity) {
   };
 }
 
+// src/pairing/pairing.ts
+import path6 from "path";
+import { rm as rm4 } from "fs/promises";
+
 // src/security/devices.ts
-import { randomBytes as randomBytes2, randomUUID as randomUUID3, timingSafeEqual, createHash } from "crypto";
+import { randomBytes as randomBytes2, randomUUID as randomUUID4, timingSafeEqual, createHash as createHash2 } from "crypto";
 var ACCESS_TOKEN_TTL_MS = 15 * 60 * 1e3;
 var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
 async function createDeviceSession(input, paths = resolveRuntimePaths()) {
@@ -502,7 +1487,7 @@ async function createDeviceSession(input, paths = resolveRuntimePaths()) {
   const accessToken = randomToken("hpat_");
   const refreshToken = randomToken("hprt_");
   const device = {
-    id: `dev_${randomUUID3().replaceAll("-", "")}`,
+    id: `dev_${randomUUID4().replaceAll("-", "")}`,
     label: input.label,
     platform: input.platform,
     scope: "admin",
@@ -591,7 +1576,7 @@ function randomToken(prefix) {
   return `${prefix}${randomBytes2(24).toString("base64url")}`;
 }
 function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
+  return createHash2("sha256").update(value).digest("hex");
 }
 function safeEqual(left, right) {
   const leftBytes = Buffer.from(left);
@@ -650,7 +1635,7 @@ async function postJson(fetcher, url, token, body) {
   });
   const payload = await response.json().catch(() => null);
   if (!response.ok) {
-    const message = readErrorMessage(payload) ?? `Relay request failed with HTTP ${response.status}`;
+    const message = readErrorMessage2(payload) ?? `Relay request failed with HTTP ${response.status}`;
     throw new Error(message);
   }
   if (!payload) {
@@ -658,7 +1643,7 @@ async function postJson(fetcher, url, token, body) {
   }
   return payload;
 }
-function readErrorMessage(payload) {
+function readErrorMessage2(payload) {
   if (typeof payload !== "object" || payload === null) {
     return null;
   }
@@ -887,6 +1872,33 @@ async function preparePairing(paths = resolveRuntimePaths()) {
     qrPayload
   };
 }
+async function recordPairingClaim(input, paths = resolveRuntimePaths()) {
+  const record = {
+    session_id: input.sessionId,
+    device_id: input.deviceId,
+    device_label: input.deviceLabel,
+    device_platform: input.devicePlatform,
+    claimed_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeJsonFile(pairingClaimPath(input.sessionId, paths), record);
+  return record;
+}
+async function readPairingClaim(sessionId, paths = resolveRuntimePaths()) {
+  const record = await readJsonFile(pairingClaimPath(sessionId, paths));
+  if (!record || record.session_id !== sessionId || typeof record.device_id !== "string") {
+    return null;
+  }
+  return {
+    session_id: record.session_id,
+    device_id: record.device_id,
+    device_label: typeof record.device_label === "string" ? record.device_label : "",
+    device_platform: typeof record.device_platform === "string" ? record.device_platform : "unknown",
+    claimed_at: typeof record.claimed_at === "string" ? record.claimed_at : ""
+  };
+}
+async function clearPairingClaim(sessionId, paths = resolveRuntimePaths()) {
+  await rm4(pairingClaimPath(sessionId, paths), { force: true }).catch(() => void 0);
+}
 async function claimPairing(input) {
   const paths = input.paths ?? resolveRuntimePaths();
   const [identity, config] = await Promise.all([loadRequiredIdentity(paths), loadConfig(paths)]);
@@ -930,8 +1942,8 @@ async function loadRequiredIdentity(paths) {
   }
   return identity;
 }
-async function postServerJson(serverBaseUrl, path6, body) {
-  const response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path6}`, {
+async function postServerJson(serverBaseUrl, path8, body) {
+  const response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path8}`, {
     method: "POST",
     headers: {
       accept: "application/json",
@@ -941,8 +1953,8 @@ async function postServerJson(serverBaseUrl, path6, body) {
   });
   return readJsonResponse2(response);
 }
-async function patchServerJson(serverBaseUrl, path6, token, body) {
-  const response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path6}`, {
+async function patchServerJson(serverBaseUrl, path8, token, body) {
+  const response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path8}`, {
     method: "PATCH",
     headers: {
       accept: "application/json",
@@ -956,12 +1968,12 @@ async function patchServerJson(serverBaseUrl, path6, token, body) {
 async function readJsonResponse2(response) {
   const payload = await response.json().catch(() => null);
   if (!response.ok || !payload) {
-    const message = readErrorMessage2(payload) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
+    const message = readErrorMessage3(payload) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
     throw new LinkHttpError(response.status, "server_request_failed", message);
   }
   return payload;
 }
-function readErrorMessage2(payload) {
+function readErrorMessage3(payload) {
   if (typeof payload !== "object" || payload === null) {
     return null;
   }
@@ -975,6 +1987,9 @@ function readErrorMessage2(payload) {
 function defaultDisplayName() {
   return `Hermes Link ${process.platform}`;
 }
+function pairingClaimPath(sessionId, paths) {
+  return path6.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.claimed.json`);
+}
 function qrPreferredUrls(routes) {
   return routes.preferredUrls.filter((url) => !url.includes("/api/v1/relay/links/")).slice(0, 1);
 }
@@ -997,8 +2012,8 @@ async function verifyAppConnectToken(token, options) {
     throw new LinkHttpError(401, "app_connect_token_invalid", "App connect token is malformed");
   }
   const [encodedHeader, encodedPayload, encodedSignature] = segments;
-  const header = decodeJson(encodedHeader);
-  const payload = decodeJson(encodedPayload);
+  const header = decodeJson2(encodedHeader);
+  const payload = decodeJson2(encodedPayload);
   if (header.alg !== "ES256" || header.typ !== "JWT") {
     throw new LinkHttpError(401, "app_connect_token_invalid", "App connect token algorithm is unsupported");
   }
@@ -1040,7 +2055,7 @@ async function getJwks(config, fetcher) {
   };
   return keys;
 }
-function decodeJson(value) {
+function decodeJson2(value) {
   return JSON.parse(Buffer.from(base64UrlToBase64(value), "base64").toString("utf8"));
 }
 function base64UrlToBase64(value) {
@@ -1049,8 +2064,8 @@ function base64UrlToBase64(value) {
 }
 
 // src/runtime/logger.ts
-import { appendFile, mkdir as mkdir5, open as open2, readFile as readFile3, rename as rename3, rm as rm3, stat as stat2 } from "fs/promises";
-import path5 from "path";
+import { appendFile as appendFile2, mkdir as mkdir6, open as open2, readFile as readFile4, rename as rename3, rm as rm5, stat as stat3 } from "fs/promises";
+import path7 from "path";
 var DEFAULT_LOG_FILE = "hermeslink.log";
 var DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
 var DEFAULT_MAX_FILES = 5;
@@ -1098,22 +2113,22 @@ var FileLogger = class {
     return this.queue;
   }
   async appendEntry(entry) {
-    await mkdir5(this.paths.logsDir, { recursive: true, mode: 448 });
+    await mkdir6(this.paths.logsDir, { recursive: true, mode: 448 });
     const line = `${JSON.stringify(entry)}
 `;
     await this.rotateIfNeeded(Buffer.byteLength(line, "utf8"));
-    await appendFile(this.filePath, line, { mode: 384 });
+    await appendFile2(this.filePath, line, { mode: 384 });
   }
   async rotateIfNeeded(nextBytes) {
-    const current = await stat2(this.filePath).catch(() => null);
+    const current = await stat3(this.filePath).catch(() => null);
     if (!current || current.size === 0 || current.size + nextBytes <= this.maxFileBytes) {
       return;
     }
     if (this.maxFiles === 0) {
-      await rm3(this.filePath, { force: true }).catch(() => void 0);
+      await rm5(this.filePath, { force: true }).catch(() => void 0);
       return;
     }
-    await rm3(rotatedLogFile(this.filePath, this.maxFiles), { force: true }).catch(() => void 0);
+    await rm5(rotatedLogFile(this.filePath, this.maxFiles), { force: true }).catch(() => void 0);
     for (let index = this.maxFiles - 1; index >= 1; index -= 1) {
       await moveIfExists(rotatedLogFile(this.filePath, index), rotatedLogFile(this.filePath, index + 1));
     }
@@ -1124,7 +2139,7 @@ function createFileLogger(options = {}) {
   return new FileLogger(options);
 }
 function getLinkLogFile(paths = resolveRuntimePaths(), fileName = DEFAULT_LOG_FILE) {
-  return path5.join(paths.logsDir, fileName);
+  return path7.join(paths.logsDir, fileName);
 }
 async function readRecentLogEntries(options = {}) {
   const paths = options.paths ?? resolveRuntimePaths();
@@ -1219,12 +2234,12 @@ function isLogLevel(value) {
   return value === "debug" || value === "info" || value === "warn" || value === "error";
 }
 async function readTail(filePath, maxBytes) {
-  const info = await stat2(filePath).catch(() => null);
+  const info = await stat3(filePath).catch(() => null);
   if (!info || info.size <= 0) {
     return null;
   }
   if (info.size <= maxBytes) {
-    return await readFile3(filePath, "utf8").catch(() => null);
+    return await readFile4(filePath, "utf8").catch(() => null);
   }
   const handle = await open2(filePath, "r").catch(() => null);
   if (!handle) {
@@ -1240,7 +2255,7 @@ async function readTail(filePath, maxBytes) {
   }
 }
 async function moveIfExists(from, to) {
-  await rm3(to, { force: true }).catch(() => void 0);
+  await rm5(to, { force: true }).catch(() => void 0);
   await rename3(from, to).catch((error) => {
     if (error.code !== "ENOENT") {
       throw error;
@@ -1252,9 +2267,12 @@ function rotatedLogFile(filePath, index) {
 }
 
 // src/http/app.ts
+var MAX_JSON_BODY_BYTES = 1024 * 1024;
+var MAX_BLOB_UPLOAD_BYTES = 50 * 1024 * 1024;
 async function createApp(options = {}) {
   const paths = options.paths ?? resolveRuntimePaths();
   const logger = options.logger ?? createFileLogger({ paths });
+  const conversations = new ConversationService(paths, logger);
   const app = new Koa();
   const router = new Router();
   app.use(async (ctx, next) => {
@@ -1312,22 +2330,25 @@ async function createApp(options = {}) {
         sse: true,
         relay: true,
         profiles: true,
-        logs: true
+        logs: true,
+        conversations: true,
+        conversation_delete: true,
+        blobs: true
       }
     };
   });
   router.post("/api/v1/pairing/claim", async (ctx) => {
     const body = await readJsonBody(ctx.req);
-    const sessionId = readString2(body, "session_id") ?? readString2(body, "sessionId");
-    const claimToken = readString2(body, "claim_token") ?? readString2(body, "claimToken");
+    const sessionId = readString3(body, "session_id") ?? readString3(body, "sessionId");
+    const claimToken = readString3(body, "claim_token") ?? readString3(body, "claimToken");
     if (!sessionId || !claimToken) {
       throw new LinkHttpError(400, "pairing_claim_invalid", "session_id and claim_token are required");
     }
     const claimed = await claimPairing({
       sessionId,
       claimToken,
-      deviceLabel: readString2(body, "device_label") ?? readString2(body, "deviceLabel") ?? "HermesPilot App",
-      devicePlatform: readString2(body, "device_platform") ?? readString2(body, "devicePlatform") ?? "unknown",
+      deviceLabel: readString3(body, "device_label") ?? readString3(body, "deviceLabel") ?? "HermesPilot App",
+      devicePlatform: readString3(body, "device_platform") ?? readString3(body, "devicePlatform") ?? "unknown",
       paths
     });
     ctx.body = claimed;
@@ -1335,12 +2356,24 @@ async function createApp(options = {}) {
       device_id: claimed.device.device_id,
       device_platform: claimed.device.platform
     });
-    if (options.onPairingClaimed) {
-      const timer = setTimeout(() => {
-        void options.onPairingClaimed?.();
-      }, 250);
-      timer.unref?.();
-    }
+    const timer = setTimeout(() => {
+      void recordPairingClaim(
+        {
+          sessionId,
+          deviceId: claimed.device.device_id,
+          deviceLabel: claimed.device.label,
+          devicePlatform: claimed.device.platform
+        },
+        paths
+      ).catch((error) => {
+        void logger.warn("pairing_claim_record_failed", {
+          session_id: sessionId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+      void options.onPairingClaimed?.();
+    }, 250);
+    timer.unref?.();
   });
   router.get("/api/v1/auth/me", async (ctx) => {
     const auth = await authenticateRequest(ctx, paths);
@@ -1363,7 +2396,7 @@ async function createApp(options = {}) {
   });
   router.post("/api/v1/auth/refresh", async (ctx) => {
     const body = await readJsonBody(ctx.req);
-    const refreshToken = readString2(body, "refresh_token") ?? readString2(body, "refreshToken");
+    const refreshToken = readString3(body, "refresh_token") ?? readString3(body, "refreshToken");
     if (!refreshToken) {
       throw new LinkHttpError(400, "refresh_token_required", "refresh_token is required");
     }
@@ -1383,7 +2416,7 @@ async function createApp(options = {}) {
   });
   router.post("/api/v1/auth/logout", async (ctx) => {
     const body = await readJsonBody(ctx.req);
-    const refreshToken = readString2(body, "refresh_token") ?? readString2(body, "refreshToken");
+    const refreshToken = readString3(body, "refresh_token") ?? readString3(body, "refreshToken");
     if (refreshToken) {
       await revokeDeviceRefreshToken(refreshToken, paths);
     }
@@ -1415,10 +2448,116 @@ async function createApp(options = {}) {
     await authenticateRequest(ctx, paths);
     ctx.body = await listHermesModels();
   });
+  router.get("/api/v1/conversations", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    ctx.set("cache-control", "no-store");
+    ctx.body = {
+      ok: true,
+      conversations: await conversations.listConversations()
+    };
+  });
+  router.post("/api/v1/conversations", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    const body = await readJsonBody(ctx.req);
+    ctx.status = 201;
+    ctx.body = {
+      ok: true,
+      conversation: await conversations.createConversation({
+        title: readString3(body, "title") ?? void 0
+      })
+    };
+  });
+  router.get("/api/v1/conversations/:conversationId/messages", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    ctx.set("cache-control", "no-store");
+    const result = await conversations.getMessages(ctx.params.conversationId);
+    ctx.body = {
+      ok: true,
+      conversation_id: ctx.params.conversationId,
+      ...result
+    };
+  });
+  router.get("/api/v1/conversations/:conversationId/events", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    const after = readInteger(ctx.query.after) ?? 0;
+    const history = await conversations.listEvents(ctx.params.conversationId, after);
+    ctx.respond = false;
+    const response = ctx.res;
+    response.statusCode = 200;
+    response.setHeader("content-type", "text/event-stream; charset=utf-8");
+    response.setHeader("cache-control", "no-store");
+    response.setHeader("connection", "keep-alive");
+    for (const event of history) {
+      writeSseEvent(response, event);
+    }
+    const unsubscribe = conversations.subscribe(ctx.params.conversationId, (event) => {
+      writeSseEvent(response, event);
+    });
+    const cleanup = () => {
+      unsubscribe();
+      response.end();
+    };
+    ctx.req.on("close", cleanup);
+  });
+  router.post("/api/v1/conversations/:conversationId/messages", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    const body = await readJsonBody(ctx.req);
+    const content = readString3(body, "content") ?? readString3(body, "text") ?? readString3(body, "input") ?? "";
+    const attachments = readMessageAttachments(body.attachments ?? body.blobs);
+    if (!content && attachments.length === 0) {
+      throw new LinkHttpError(400, "message_content_required", "message content is required");
+    }
+    ctx.status = 202;
+    ctx.body = {
+      ok: true,
+      ...await conversations.sendMessage({
+        conversationId: ctx.params.conversationId,
+        content,
+        attachments,
+        clientMessageId: readString3(body, "client_message_id") ?? readString3(body, "clientMessageId") ?? void 0,
+        idempotencyKey: readHeader(ctx, "idempotency-key") ?? void 0
+      })
+    };
+  });
+  router.post("/api/v1/conversations/:conversationId/ack", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    ctx.body = { ok: true };
+  });
+  router.delete("/api/v1/conversations/:conversationId", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    ctx.body = {
+      ok: true,
+      ...await conversations.deleteConversation(ctx.params.conversationId),
+      blob_gc_completed: true
+    };
+  });
+  router.post("/api/v1/conversations/:conversationId/blobs", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    const bytes = await readRawBody(ctx.req, MAX_BLOB_UPLOAD_BYTES);
+    if (bytes.byteLength === 0) {
+      throw new LinkHttpError(400, "blob_empty", "Blob body is empty");
+    }
+    const blob = await conversations.writeBlob(ctx.params.conversationId, {
+      bytes,
+      filename: readHeader(ctx, "x-filename") ?? void 0,
+      mime: ctx.get("content-type") || void 0
+    });
+    ctx.status = 201;
+    ctx.body = { ok: true, blob };
+  });
+  router.get("/api/v1/conversations/:conversationId/blobs/:blobId", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    const blob = await conversations.readBlob(ctx.params.conversationId, ctx.params.blobId);
+    ctx.set("content-type", blob.mime);
+    ctx.set("content-length", String(blob.size));
+    ctx.set("cache-control", "private, max-age=86400");
+    ctx.set("content-disposition", `inline; filename="${blob.filename.replaceAll('"', "")}"`);
+    ctx.body = blob.bytes;
+  });
   router.post("/api/v1/runs", async (ctx) => {
     await authenticateRequest(ctx, paths);
     const body = await readJsonBody(ctx.req);
-    const input = readString2(body, "input");
+    const input = readString3(body, "input");
     if (!input) {
       throw new LinkHttpError(400, "run_input_required", "input is required");
     }
@@ -1426,7 +2565,7 @@ async function createApp(options = {}) {
     ctx.body = await createHermesRun({
       input,
       conversation_history: readConversationHistory(body.conversation_history ?? body.conversationHistory),
-      session_id: readString2(body, "session_id") ?? readString2(body, "sessionId") ?? void 0
+      session_id: readString3(body, "session_id") ?? readString3(body, "sessionId") ?? void 0
     });
   });
   router.get("/api/v1/runs/:runId/events", async (ctx) => {
@@ -1505,14 +2644,28 @@ async function createApp(options = {}) {
   return app;
 }
 async function readJsonBody(request) {
+  const raw = await readRawBody(request, MAX_JSON_BODY_BYTES);
+  if (raw.byteLength === 0) {
+    return {};
+  }
+  try {
+    return JSON.parse(Buffer.from(raw).toString("utf8"));
+  } catch {
+    throw new LinkHttpError(400, "invalid_json", "Request body must be valid JSON");
+  }
+}
+async function readRawBody(request, maxBytes) {
   const chunks = [];
+  let totalBytes = 0;
   for await (const chunk of request) {
-    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-  }
-  if (chunks.length === 0) {
-    return {};
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalBytes += buffer.byteLength;
+    if (totalBytes > maxBytes) {
+      throw new LinkHttpError(413, "request_body_too_large", "Request body is too large");
+    }
+    chunks.push(buffer);
   }
-  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  return Buffer.concat(chunks);
 }
 function readProfileName(body) {
   if (typeof body.name !== "string") {
@@ -1551,7 +2704,7 @@ function readBearerToken(value) {
   const token = trimmed.slice(7).trim();
   return token || null;
 }
-function readString2(body, key) {
+function readString3(body, key) {
   const value = body[key];
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
@@ -1563,6 +2716,25 @@ function readLimit(value) {
   const parsed = Number.parseInt(raw, 10);
   return Number.isFinite(parsed) ? parsed : void 0;
 }
+function readInteger(value) {
+  const raw = Array.isArray(value) ? value[0] : value;
+  if (typeof raw !== "string") {
+    return void 0;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) ? Math.max(0, parsed) : void 0;
+}
+function readHeader(ctx, name) {
+  const value = ctx.get(name).trim();
+  return value ? value : null;
+}
+function writeSseEvent(response, event) {
+  response.write(`event: ${event.type}
+`);
+  response.write(`data: ${JSON.stringify(event)}
+
+`);
+}
 function readConversationHistory(value) {
   if (!Array.isArray(value)) {
     return [];
@@ -1579,6 +2751,22 @@ function readConversationHistory(value) {
     return { role, content };
   }).filter((item) => Boolean(item));
 }
+function readMessageAttachments(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.map((item) => {
+    if (typeof item === "string" && item.trim()) {
+      return { blob_id: item.trim() };
+    }
+    if (typeof item !== "object" || item === null) {
+      return null;
+    }
+    const record = item;
+    const blobId = typeof record.blob_id === "string" ? record.blob_id.trim() : typeof record.blobId === "string" ? record.blobId.trim() : "";
+    return blobId ? { blob_id: blobId } : null;
+  }).filter((item) => Boolean(item));
+}
 function routeObjects(urls) {
   return urls.map((url) => ({
     kind: url.includes("/api/v1/relay/links/") ? "relay" : "lan",
@@ -1597,8 +2785,10 @@ export {
   ensureIdentity,
   getIdentityStatus,
   preparePairing,
+  readPairingClaim,
+  clearPairingClaim,
   createFileLogger,
   getLinkLogFile,
   createApp
 };
-//# sourceMappingURL=chunk-T35GPRKF.js.map
+//# sourceMappingURL=chunk-VCQJ5DSN.js.map