@mono-agent/agent-app 0.3.0 → 0.4.1

package/dist/app.js

@@ -1,104 +1,117 @@
 import { resolve } from "node:path";
-import { startOperatorConsole } from "@mono-agent/operator-console";
-import { createConfiguredAgentResponder, createConfiguredAgentRuntime, createConfiguredMemory, } from "@mono-agent/agent-host";
-import { registerTraceSource } from "@mono-agent/observability";
-import { isAppCoreConfigError, loadAppCoreConfig, MONO_AGENT_APP_FIELD_GROUPS, resolveAppArtifactDir, resolveAppConsoleSettings, resolveAppTraceHeartbeatMs, resolveAppTraceRegistryDir, resolveAppTraceSourceId, resolveAppTraceSourceLabel, resolveAppTraceStaleAfterMs, } from "./app-config.js";
-import { defaultChannelDrivers } from "./channels.js";
+import { createLiveEventBus } from "@mono-agent/agent-contracts";
+import { pruneTraceSources, reconcileStaleRunArtifacts, registerTraceSource } from "@mono-agent/observability";
+import { modelReferenceKey } from "@mono-agent/runtime-adapter";
+import { describeSandboxEffectiveState, resolveSandboxEffectiveState, sandboxEffectiveStateWarning, } from "@mono-agent/runtime-adapter";
+import { isAppCoreConfigError, loadAppCoreConfig, resolveAppArtifactDir, resolveAppObservabilityExporters, resolveAppTraceGlobalDiscovery, resolveAppTraceHeartbeatMs, resolveAppTraceRegistryDir, resolveAppTraceSourceId, resolveAppTraceSourceLabel, resolveAppTraceStaleAfterMs, resolveGlobalTraceRegistryDir, resolveTraceTmpdirRoot, shouldMirrorTraceSourceGlobally, } from "./app-config.js";
+import { createConfiguredAgentResponder, createConfiguredAgentRuntime, createConfiguredMemory, } from "./configured-agent.js";
+import { resolveChannelDrivers } from "./channels.js";
+import { routeProactiveNotification } from "./proactive-notify.js";
+import { adapterSendToolNames, createAdapterSendToolsRuntimeExtension, isAdapterSendToolAllowed, resolveAdapterSendToolsSettings, } from "./adapter-send-tools.js";
+import { loadInteractionSettings, startInteractionBridge } from "./interaction-bridge.js";
 import { startMemoryRituals } from "./memory-rituals.js";
+import { startArtifactRetentionScheduler } from "./artifact-retention.js";
+import { createMemoryRecallRuntimeExtension, resolveMemoryRecallSettings, } from "./memory-recall.js";
+import { createRequestModelOverrideRuntimeExtension } from "./request-model-override.js";
+import { resolveNotifyDestinations } from "./notify-destinations.js";
+import { resolvePostedMessageIndexPath } from "./posted-message-index.js";
 /**
- * Starts a config-first mono-agent host in `cwd`: operator console first (so
- * an incomplete config can be fixed in the browser), then traceability, then
- * every configured channel in parallel. Channels with incomplete config report
- * `waiting_for_config` instead of blocking the rest.
+ * Starts a config-first mono-agent host in `cwd`: traceability first, then every
+ * configured channel in parallel. Channels with incomplete config report
+ * `waiting_for_config` instead of blocking the rest. The host runs headless;
+ * config changes take effect on the next restart.
  */
 export async function startMonoAgentApp(options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const configPath = resolve(cwd, options.configPath ?? "mono-agent.config.json");
     const env = options.env ?? process.env;
-    const drivers = options.drivers ?? defaultChannelDrivers();
-    const input = { env, cwd, configPath };
-    let controller;
-    let consoleServer;
-    const consoleSettings = await resolveAppConsoleSettings(input);
-    const consolePort = options.operatorConsolePort ?? consoleSettings.port;
-    if (options.operatorConsole !== false && consoleSettings.enabled) {
-        const consoleFactory = options.operatorConsoleFactory ?? startOperatorConsole;
-        consoleServer = await consoleFactory({
-            configPath,
-            cwd,
-            fieldGroups: options.fieldGroups ?? MONO_AGENT_APP_FIELD_GROUPS,
-            observability: {
-                artifactDir: () => resolveAppArtifactDir(input),
-                maxRuns: 100,
-                maxEventsPerRun: 750,
-            },
-            traceability: {
-                registryDir: () => resolveAppTraceRegistryDir(input),
-                staleAfterMs: () => resolveAppTraceStaleAfterMs(input),
-                maxRuns: 100,
-                maxEventsPerRun: 750,
-            },
-            applyConfigWrite: async () => {
-                if (controller === undefined) {
-                    return {
-                        kind: "failed",
-                        message: "Mono agent app lifecycle is not ready to apply config changes.",
-                        transports: [],
-                    };
-                }
-                return await controller.applyConfigChange("operator-console-write");
-            },
-            ...(consolePort === undefined ? {} : { port: consolePort }),
-            log: (event) => {
-                logOperatorConsoleEvent(options.logger, event);
-            },
-        });
-    }
-    controller = new MonoAgentAppController({
-        consoleServer,
+    const drivers = options.drivers ?? await resolveChannelDrivers({ env, cwd, configPath });
+    const controller = new MonoAgentAppController({
         cwd,
         configPath,
         env,
         drivers,
         ...(options.logger === undefined ? {} : { logger: options.logger }),
         ...(options.runtime === undefined ? {} : { runtime: options.runtime }),
+        ...(options.sandboxEngine === undefined ? {} : { sandboxEngine: options.sandboxEngine }),
         ...(options.traceDefaults === undefined ? {} : { traceDefaults: options.traceDefaults }),
     });
+    await controller.refreshSandboxStatus("startup");
     await controller.startTraceability("startup");
+    await controller.startExporters("startup");
     await Promise.all(drivers.map((driver) => controller?.startChannelIfConfigured(driver.id, "startup")));
     await controller.startMemoryRitualsIfConfigured("startup");
     await controller.refreshTraceSource("startup-complete");
     return controller;
 }
+const DEFAULT_SANDBOX_STATUS = sandboxStatusFromState({
+    configured: false,
+    configuredMode: undefined,
+    effective: "off",
+    engine: undefined,
+    engineAvailable: undefined,
+    fallback: undefined,
+    fallbackActive: false,
+    unsafeAllowHostProcess: false,
+});
 class MonoAgentAppController {
-    operatorConsole;
     configPath;
-    consoleServer;
     cwd;
     env;
     drivers;
     driversById;
     logger;
     runtime;
+    sandboxEngine;
     traceDefaults;
     activeRuntimes = [];
     statuses = new Map();
     running = new Map();
     startsInFlight = new Map();
+    /** Captured at construction (~process start): the cutoff for reclaiming orphaned "running" runs. */
+    processStartMs = Date.now();
+    staleRunsReconciled = false;
     traceabilityStatusValue = {
         kind: "disabled",
         reason: "Traceability has not started yet.",
     };
+    exporterStatusValue = {
+        kind: "disabled",
+        reason: "No observability exporter configured.",
+    };
+    sandboxStatusValue = DEFAULT_SANDBOX_STATUS;
+    selectedSkillsValue;
+    sessionMetadataValue;
+    /** The exporter the responder threads into agent-host (first configured exporter). */
+    resolvedExporter;
     traceSource;
+    traceRefreshTail = Promise.resolve();
+    // Best-effort mirror of `traceSource` into the machine-wide global registry,
+    // present only when `shouldMirrorTraceSourceGlobally` gates it on (see
+    // `startTraceability`). Kept in lockstep with `traceSource` on every
+    // refresh/stop so both manifests describe the same instance identically.
+    globalTraceSource;
+    artifactRetentionScheduler;
+    artifactRetentionGeneration = 0;
     memoryRituals;
     // One shared memory store across all channel responders + the ritual scheduler, so there is a single
     // memory.db handle (not one per channel plus one for rituals). Rebuilt on config reload, closed on stop.
     sharedMemory = undefined;
     sharedMemoryBuilt = false;
+    sharedMemoryBuild;
     configApplyTail = Promise.resolve();
     stopped = false;
+    // Interaction bridge (ask_user + tool progress): lazily started once, shared
+    // by every channel; the exported env keys are tracked for cleanup on stop.
+    interactionBridge;
+    interactionBridgeStart;
+    interactionBridgeEnvKeys = [];
+    // Shared in-process run-event bus: every run's recorder publishes to it (via the
+    // broadcast recorder threaded as `runEventSink`), and the `live` channel relays
+    // it over SSE. One instance for the app's lifetime — cheap, bounded ring buffer,
+    // and it must exist before any responder is built (like the interaction bridge).
+    liveEventBus = createLiveEventBus();
     constructor(input) {
-        this.consoleServer = input.consoleServer;
         this.cwd = input.cwd;
         this.configPath = input.configPath;
         this.env = input.env;
@@ -106,6 +119,7 @@ class MonoAgentAppController {
         this.driversById = new Map(input.drivers.map((driver) => [driver.id, driver]));
         this.logger = input.logger;
         this.runtime = input.runtime;
+        this.sandboxEngine = input.sandboxEngine;
         this.traceDefaults = input.traceDefaults;
         for (const driver of input.drivers) {
             this.statuses.set(driver.id, {
@@ -113,18 +127,19 @@ class MonoAgentAppController {
                 reason: `${driver.label} has not been configured yet.`,
             });
         }
-        this.operatorConsole = input.consoleServer === undefined
-            ? undefined
-            : {
-                url: input.consoleServer.url,
-                appUrl: `${input.consoleServer.url}/?t=${input.consoleServer.token}`,
-                token: input.consoleServer.token,
-                configPath: input.configPath,
-            };
     }
     get traceabilityStatus() {
         return this.traceabilityStatusValue;
     }
+    get exporterStatus() {
+        return this.exporterStatusValue;
+    }
+    get sandboxStatus() {
+        return this.sandboxStatusValue;
+    }
+    get selectedSkills() {
+        return this.selectedSkillsValue;
+    }
     channelStatus(id) {
         const status = this.statuses.get(id);
         if (status === undefined) {
@@ -148,9 +163,12 @@ class MonoAgentAppController {
                 await this.stopChannel(driver.id, `${reason}:reload`);
             }
             this.stopMemoryRituals();
+            this.stopArtifactRetentionScheduler();
             await this.resetSharedMemory();
             await this.stopTraceSource(`${reason}:reload`);
+            await this.refreshSandboxStatus(reason);
             await this.startTraceability(reason);
+            await this.startExporters(reason);
             await Promise.all(this.drivers.map((driver) => this.startChannelIfConfigured(driver.id, reason)));
             await this.startMemoryRitualsIfConfigured(reason);
             await this.refreshTraceSource(`${reason}:complete`);
@@ -166,11 +184,6 @@ class MonoAgentAppController {
             return this.channelStatus(id);
         }
         if (this.running.has(id)) {
-            if (reason === "operator-console-write") {
-                this.logger?.info?.(`${driver.label} is already running; restart the app to apply later config changes.`, {
-                    status: "running",
-                });
-            }
             await this.refreshTraceSource(reason);
             return this.channelStatus(id);
         }
@@ -190,16 +203,20 @@ class MonoAgentAppController {
         if (this.stopped) {
             return this.traceabilityStatusValue;
         }
+        let artifactDirForRetention;
         try {
             const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
-            const [registryDir, artifactDir, sourceId, label, heartbeatMs] = await Promise.all([
+            await this.refreshSelectedSkillsSnapshot(reason);
+            const [registryDir, artifactDir, sourceId, label, heartbeatMs, globalDiscovery] = await Promise.all([
                 resolveAppTraceRegistryDir(input),
                 resolveAppArtifactDir(input),
                 resolveAppTraceSourceId(input, this.traceDefaults),
                 resolveAppTraceSourceLabel(input, this.traceDefaults),
                 resolveAppTraceHeartbeatMs(input),
+                resolveAppTraceGlobalDiscovery(input),
             ]);
-            this.traceSource = await registerTraceSource({
+            artifactDirForRetention = artifactDir;
+            const registerOptions = {
                 registryDir,
                 sourceId,
                 label,
@@ -209,30 +226,238 @@ class MonoAgentAppController {
                 configPath: this.configPath,
                 metadata: this.traceMetadata(reason),
                 heartbeatMs,
-            });
+            };
+            this.traceSource = await registerTraceSource(registerOptions);
             this.traceabilityStatusValue = { kind: "running", sourceId, registryDir, artifactDir };
             this.logger?.info?.("Traceability source registered.", { reason, sourceId, registryDir, artifactDir });
+            void pruneTraceSources({ registryDir });
+            // Best-effort global mirror: makes this agent discoverable by `mono-agent
+            // tui` run anywhere on the machine, even when its own registryDir is a
+            // config-local override (e.g. `mono-agent init`'s scaffold). A mirror
+            // failure must never affect the primary registration above.
+            const globalRegistryDir = resolveGlobalTraceRegistryDir(this.env);
+            const tmpdirRoot = resolveTraceTmpdirRoot(this.env);
+            if (shouldMirrorTraceSourceGlobally({ registryDir, globalRegistryDir, globalDiscovery, tmpdirRoot })) {
+                try {
+                    this.globalTraceSource = await registerTraceSource({ ...registerOptions, registryDir: globalRegistryDir });
+                    void pruneTraceSources({ registryDir: globalRegistryDir });
+                }
+                catch (error) {
+                    this.globalTraceSource = undefined;
+                    this.logger?.warn?.("Global trace-source mirror registration failed.", { reason: reasonOf(error) });
+                }
+            }
+            else {
+                this.globalTraceSource = undefined;
+            }
         }
         catch (error) {
             const failure = reasonOf(error);
             this.traceabilityStatusValue = { kind: "failed", reason: failure };
             this.logger?.error?.("Traceability source registration failed.", { reason: failure });
         }
+        finally {
+            if (artifactDirForRetention !== undefined) {
+                // Fire-and-forget: orphan reclamation and retention are best-effort cleanup
+                // and must not gate startup readiness. Keep them independent from trace
+                // source registration; a broken registry should not disable artifact GC.
+                this.restartArtifactRetentionScheduler(artifactDirForRetention, reason);
+            }
+        }
         return this.traceabilityStatusValue;
     }
-    async refreshTraceSource(reason) {
-        if (this.traceSource === undefined) {
+    async refreshSandboxStatus(reason) {
+        try {
+            const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+            const coreConfig = await loadAppCoreConfig(input);
+            const state = await resolveSandboxEffectiveState({
+                ...(coreConfig.sandbox === undefined ? {} : { policy: coreConfig.sandbox }),
+                ...(this.sandboxEngine === undefined ? {} : { engine: this.sandboxEngine }),
+            });
+            const status = sandboxStatusFromState(state);
+            this.sandboxStatusValue = status;
+            if (status.warning !== undefined) {
+                this.logger?.warn?.(status.warning, { reason, detail: status.detail });
+            }
+            return status;
+        }
+        catch (error) {
+            const resolutionError = reasonOf(error);
+            const status = {
+                ...DEFAULT_SANDBOX_STATUS,
+                detail: `Sandbox status unavailable until agent config loads: ${resolutionError}`,
+                resolutionError,
+            };
+            this.sandboxStatusValue = status;
+            this.logger?.info?.("Sandbox status unavailable until agent config loads.", { reason, detail: resolutionError });
+            return status;
+        }
+    }
+    /**
+     * One-shot at startup: a process that crashed mid-run leaves its summary stuck at "running"
+     * forever (a ghost run in `status`/observability). Reclaim those — any "running" summary that
+     * began before THIS process started — by rewriting them to "interrupted". Gated so a config
+     * reload (which re-runs startTraceability) does not repeat the scan. Best-effort: never fatal.
+     */
+    async reconcileStaleRunsOnce(artifactDir) {
+        if (this.staleRunsReconciled) {
             return;
         }
+        this.staleRunsReconciled = true;
         try {
-            await this.traceSource.update({
-                transports: this.activeTransports(),
-                metadata: this.traceMetadata(reason),
+            const { reconciled, warnings } = await reconcileStaleRunArtifacts(artifactDir, {
+                startedBeforeMs: this.processStartMs,
             });
+            for (const warning of warnings) {
+                this.logger?.warn?.(`Stale-run reconciliation: ${warning}`);
+            }
+            if (reconciled.length > 0) {
+                this.logger?.info?.('Reclaimed orphaned runs left as "running" by a prior process.', {
+                    count: reconciled.length,
+                    runIds: reconciled.slice(0, 20),
+                });
+            }
+        }
+        catch (error) {
+            this.logger?.warn?.("Stale-run reconciliation failed.", { reason: reasonOf(error) });
+        }
+    }
+    /**
+     * Resolve the configured observability exporter(s) and publish the export
+     * status. No reachability probe runs here — Phoenix may start after the agent,
+     * so an unreachable endpoint must not block startup (that probe runs in
+     * `validate`). A present-but-invalid exporter config surfaces as `failed`.
+     */
+    async startExporters(reason) {
+        if (this.stopped) {
+            return this.exporterStatusValue;
+        }
+        const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+        let exporters;
+        try {
+            exporters = await resolveAppObservabilityExporters(input);
         }
         catch (error) {
-            this.logger?.warn?.("Traceability source update failed.", { reason: reasonOf(error) });
+            this.resolvedExporter = undefined;
+            this.exporterStatusValue = { kind: "failed", reason: reasonOf(error) };
+            this.logger?.error?.("Observability exporter config is invalid.", { reason: reasonOf(error) });
+            return this.exporterStatusValue;
+        }
+        const exporter = exporters[0];
+        if (exporter === undefined) {
+            this.resolvedExporter = undefined;
+            this.exporterStatusValue = { kind: "disabled", reason: "No observability exporter configured." };
+            return this.exporterStatusValue;
+        }
+        this.resolvedExporter = exporter;
+        this.exporterStatusValue = {
+            kind: "configured",
+            endpoint: exporter.endpoint,
+            includeSensitiveData: exporter.includeSensitiveData ?? false,
+        };
+        this.logger?.info?.("Observability exporter configured.", {
+            reason,
+            endpoint: exporter.endpoint,
+            includeSensitiveData: exporter.includeSensitiveData ?? false,
+        });
+        return this.exporterStatusValue;
+    }
+    /** Record a best-effort export warning so `status` can surface it without failing the run. */
+    recordExporterWarning(warning) {
+        const current = this.exporterStatusValue;
+        if (current.kind !== "configured") {
+            return;
+        }
+        const message = `${warning.phase}: ${warning.message}`;
+        // The "fail" phase fires only when export fails on the run-failure path;
+        // surface it as lastError so operators can tell it apart from a transient
+        // best-effort warning. The run outcome is unchanged either way.
+        this.exporterStatusValue =
+            warning.phase === "fail" ? { ...current, lastError: message } : { ...current, lastWarning: message };
+        this.logger?.warn?.("Observability export warning.", { phase: warning.phase, message: warning.message });
+        // Persist to the trace-source manifest so the detached `mono-agent status`
+        // (which reads the manifest, not this live object) can surface it too.
+        void this.refreshTraceSource("exporter-warning").catch(() => undefined);
+    }
+    async refreshTraceSource(reason) {
+        const run = async () => {
+            if (this.traceSource === undefined) {
+                return;
+            }
+            const patch = { transports: this.activeTransports(), metadata: this.traceMetadata(reason) };
+            try {
+                await this.traceSource.update(patch);
+            }
+            catch (error) {
+                this.logger?.warn?.("Traceability source update failed.", { reason: reasonOf(error) });
+            }
+            if (this.globalTraceSource !== undefined) {
+                try {
+                    await this.globalTraceSource.update(patch);
+                }
+                catch (error) {
+                    this.logger?.warn?.("Global trace-source mirror update failed.", { reason: reasonOf(error) });
+                }
+            }
+        };
+        const next = this.traceRefreshTail.then(run, run);
+        this.traceRefreshTail = next.then(() => undefined, () => undefined);
+        await next;
+    }
+    /**
+     * Start the interaction bridge once, when the ask_user tool is allowed by the
+     * tool policy or the operator configured the `interaction` block. Exports the
+     * bridge env into the app env AND process env so settings resolution and
+     * spawned stdio tool children (which inherit process.env) can reach it.
+     */
+    ensureInteractionBridge(coreConfig) {
+        this.interactionBridgeStart ??= (async () => {
+            const askUserAllowed = isAdapterSendToolAllowed("ask_user", {
+                allowedTools: coreConfig.tools.allowedTools,
+                disallowedTools: coreConfig.tools.disallowedTools,
+            });
+            const settings = await loadInteractionSettings({ env: this.env, configPath: this.configPath });
+            if (!askUserAllowed && !settings.configured) {
+                return undefined;
+            }
+            try {
+                const bridge = await startInteractionBridge({
+                    host: settings.host,
+                    port: settings.port,
+                    askTimeoutMs: settings.askTimeoutMs,
+                    ...(this.logger === undefined ? {} : { logger: this.logger }),
+                });
+                const bridgeEnv = bridge.env();
+                this.interactionBridgeEnvKeys = Object.keys(bridgeEnv);
+                Object.assign(this.env, bridgeEnv);
+                if (this.env !== process.env) {
+                    Object.assign(process.env, bridgeEnv);
+                }
+                this.interactionBridge = bridge;
+                this.logger?.info?.("Interaction bridge started.", { url: bridge.url });
+                return bridge;
+            }
+            catch (error) {
+                this.logger?.warn?.("Interaction bridge failed to start; ask_user and tool progress are unavailable.", {
+                    reason: reasonOf(error),
+                });
+                return undefined;
+            }
+        })();
+        return this.interactionBridgeStart;
+    }
+    async stopInteractionBridge() {
+        const bridge = this.interactionBridge;
+        this.interactionBridge = undefined;
+        this.interactionBridgeStart = undefined;
+        for (const key of this.interactionBridgeEnvKeys) {
+            delete this.env[key];
+            if (this.env !== process.env) {
+                delete process.env[key];
+            }
         }
+        this.interactionBridgeEnvKeys = [];
+        await bridge?.stop().catch(() => undefined);
     }
     async stop() {
         if (this.stopped) {
@@ -242,10 +467,11 @@ class MonoAgentAppController {
         for (const driver of this.drivers) {
             await this.stopChannel(driver.id, "stop");
         }
+        await this.stopInteractionBridge();
         this.stopMemoryRituals();
+        this.stopArtifactRetentionScheduler();
         await this.resetSharedMemory();
         await this.stopTraceSource("stop");
-        await this.consoleServer?.stop();
         for (const runtime of this.activeRuntimes.splice(0)) {
             await runtime.disposeAllSessions?.().catch(() => undefined);
         }
@@ -258,22 +484,30 @@ class MonoAgentAppController {
         try {
             const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
             coreConfig = await loadAppCoreConfig(input);
+            this.rememberSelectedSkills(coreConfig);
         }
         catch {
-            // Config not ready yet — rituals will start on the next applyConfigChange.
+            // Config not ready yet — consolidation will start on the next applyConfigChange.
             return;
         }
         if (coreConfig.memory?.mode !== "bujo") {
             return;
         }
-        const store = this.memoryStore(coreConfig);
-        // Duck-type: only bujo-tier BujoMemoryStore has reflect/migrate.
+        const runtime = this.runtime ?? createConfiguredAgentRuntime({
+            config: coreConfig,
+            ...(this.sandboxEngine === undefined ? {} : { sandboxEngine: this.sandboxEngine }),
+        });
+        if (!this.activeRuntimes.includes(runtime)) {
+            this.activeRuntimes.push(runtime);
+        }
+        const store = await this.memoryStore(coreConfig);
+        // Duck-type: only bujo-tier BujoMemoryStore has consolidate().
         // Cast through unknown to bypass the MemoryStore contract's type mismatch.
         const storeAsAny = store;
         if (store === undefined ||
-            typeof storeAsAny["reflect"] !== "function" ||
-            typeof storeAsAny["migrate"] !== "function" ||
+            typeof storeAsAny["consolidate"] !== "function" ||
             typeof storeAsAny["tier"] !== "function") {
+            this.logger?.info?.("Memory consolidation scheduler skipped — store does not support consolidate().", { reason });
             return;
         }
         const bujoStore = store;
@@ -282,13 +516,12 @@ class MonoAgentAppController {
         // scheduler started in that case — log an accurate skip instead.
         const tier = bujoStore.tier();
         if (tier !== "bujo") {
-            this.logger?.info?.("Memory ritual scheduler skipped — store tier is not bujo (reflect/migrate need a local chat LLM).", { reason, tier });
+            this.logger?.info?.("Memory consolidation scheduler skipped — configured bujo mode resolved to the journal tier because memory.llm is missing.", { reason, tier });
             return;
         }
         this.memoryRituals = startMemoryRituals({
             store: bujoStore,
-            ...(coreConfig.memory.reflection !== undefined && { reflection: coreConfig.memory.reflection }),
-            ...(coreConfig.memory.migration !== undefined && { migration: coreConfig.memory.migration }),
+            ...(coreConfig.memory.consolidation !== undefined && { consolidation: coreConfig.memory.consolidation }),
             ...(this.logger !== undefined && {
                 logger: {
                     info: (m) => this.logger?.info?.(m),
@@ -296,7 +529,7 @@ class MonoAgentAppController {
                 },
             }),
         });
-        this.logger?.info?.("Memory ritual scheduler started.", { reason, mode: "bujo" });
+        this.logger?.info?.("Memory consolidation scheduler started.", { reason, mode: "bujo" });
     }
     stopMemoryRituals() {
         const rituals = this.memoryRituals;
@@ -305,7 +538,94 @@ class MonoAgentAppController {
         }
         this.memoryRituals = undefined;
         rituals.stop();
-        this.logger?.info?.("Memory ritual scheduler stopped.");
+        this.logger?.info?.("Memory consolidation scheduler stopped.");
+    }
+    restartArtifactRetentionScheduler(artifactDir, reason) {
+        this.stopArtifactRetentionScheduler();
+        const generation = ++this.artifactRetentionGeneration;
+        void (async () => {
+            let coreConfig;
+            try {
+                const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+                coreConfig = await loadAppCoreConfig(input);
+                this.rememberSelectedSkills(coreConfig);
+            }
+            catch (error) {
+                this.logger?.warn?.("Artifact retention scheduler skipped until core config loads.", { reason: reasonOf(error) });
+                void this.reconcileStaleRunsOnce(artifactDir);
+                return;
+            }
+            if (this.stopped || generation !== this.artifactRetentionGeneration) {
+                return;
+            }
+            this.artifactRetentionScheduler = startArtifactRetentionScheduler({
+                artifactDir,
+                retention: coreConfig.artifacts.retention,
+                memoryRetention: coreConfig.artifacts.memoryRetention,
+                ...(this.logger === undefined ? {} : { logger: this.logger }),
+                beforeFirstRun: () => this.reconcileStaleRunsOnce(artifactDir),
+            });
+            this.logger?.info?.("Artifact retention scheduler started.", {
+                reason,
+                artifactDir,
+                agent: {
+                    maxAgeDays: coreConfig.artifacts.retention.maxAgeDays,
+                    maxCount: coreConfig.artifacts.retention.maxCount,
+                    dryRun: coreConfig.artifacts.retention.dryRun,
+                },
+                memory: {
+                    maxAgeDays: coreConfig.artifacts.memoryRetention.maxAgeDays,
+                    maxCount: coreConfig.artifacts.memoryRetention.maxCount,
+                    dryRun: coreConfig.artifacts.memoryRetention.dryRun,
+                },
+            });
+        })();
+    }
+    stopArtifactRetentionScheduler() {
+        this.artifactRetentionGeneration += 1;
+        const scheduler = this.artifactRetentionScheduler;
+        if (scheduler === undefined) {
+            return;
+        }
+        this.artifactRetentionScheduler = undefined;
+        scheduler.stop();
+        this.logger?.info?.("Artifact retention scheduler stopped.");
+    }
+    /**
+     * Deliver a native cron/webhook notification to whichever running channel owns
+     * the destination conversationId. With `verbatim`, the channel posts `text`
+     * unchanged (no model call) and records it to history; otherwise it runs `text`
+     * as a turn. Best-effort: an unavailable/unsupported destination is warned and
+     * skipped, never thrown back to the cron/webhook trigger.
+     */
+    async notifyDestination(conversationId, text, options) {
+        const result = await routeProactiveNotification({
+            conversationId,
+            text,
+            running: this.running,
+            ...(options?.verbatim === undefined ? {} : { verbatim: options.verbatim }),
+            ...(this.logger === undefined ? {} : { logger: this.logger }),
+        });
+        // Make the delivery outcome inspectable (the failure cases already warn inside
+        // the router / channel hooks; log the success path too so a notify is auditable).
+        if (result.delivered) {
+            this.logger?.info?.("Proactive notification delivered.", { conversationId });
+        }
+        return result;
+    }
+    /**
+     * Candidate destinations for native cron/webhook notification delivery, used to
+     * infer a target when a job/endpoint sets no explicit `notifyConversationId`.
+     */
+    async listNotifyDestinations() {
+        const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+        const artifactDir = await resolveAppArtifactDir(input);
+        return await resolveNotifyDestinations({
+            input,
+            artifactDir,
+            isRunning: (id) => this.running.has(id),
+            ...(this.logger === undefined ? {} : { logger: this.logger }),
+        });
     }
     async startChannel(driver, reason) {
         const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
@@ -327,9 +647,16 @@ class MonoAgentAppController {
         if (waitingReason !== undefined) {
             return this.setStatus(driver.id, { kind: "waiting_for_config", reason: waitingReason });
         }
+        // Structural issues (e.g. an invalid per-trigger model override) fail
+        // `validate` but only WARN here: the run-time override path ignores the
+        // bad value and falls back, so starting is still the safe choice.
+        for (const issue of driver.configIssues?.(config) ?? []) {
+            this.logger?.warn?.("Channel config issue (run `mono-agent validate`).", { channel: driver.id, issue });
+        }
         let coreConfig;
         try {
             coreConfig = await loadAppCoreConfig(input);
+            this.rememberSelectedSkills(coreConfig);
         }
         catch (error) {
             if (isAppCoreConfigError(error)) {
@@ -338,21 +665,82 @@ class MonoAgentAppController {
             }
             throw error;
         }
+        // Resolve the posted-message index path once so the Slack driver can link
+        // posted messages to their producing conversation (in-thread reply continuity).
+        const postedMessageIndexPath = resolvePostedMessageIndexPath(await resolveAppArtifactDir(input));
+        // The bridge must exist BEFORE the responder is built (ask_user settings
+        // resolution reads the exported bridge env) and before driver.start (sink
+        // registration + pending-ask interception).
+        const interactionBridge = await this.ensureInteractionBridge(coreConfig);
         try {
-            const responder = this.buildResponder(coreConfig);
+            const responder = await this.buildResponder(coreConfig);
+            // The AgentResponder contract has no dispose(), but the configured responder
+            // (createAgentResponder) exposes one that tears down the harness + live-session
+            // manager. Read it LAZILY (at teardown time) off the `responder` so both the
+            // normal stop/reload path AND the onFailure (transport-death) path retire the
+            // per-channel harness rather than orphan it, and any wrapper applied to the
+            // responder is honored. Duck-typed, consistent with the resetSharedMemory /
+            // bujo-store patterns elsewhere in this file.
+            const disposeResponder = () => responder.dispose?.();
+            const hasDispose = typeof responder.dispose === "function";
             const runningChannel = await driver.start({
                 config,
                 coreConfig,
                 responder,
                 cwd: this.cwd,
+                notifyDestination: (conversationId, text, options) => this.notifyDestination(conversationId, text, options),
+                listNotifyDestinations: () => this.listNotifyDestinations(),
+                postedMessageIndexPath,
+                ...(interactionBridge === undefined ? {} : { interaction: interactionBridge }),
+                liveEventBus: this.liveEventBus,
                 ...(this.logger === undefined ? {} : { logger: this.logger }),
                 onFailure: (failureReason) => {
                     this.running.delete(driver.id);
                     this.setStatus(driver.id, { kind: "failed", reason: failureReason });
                     this.logger?.error?.(`${driver.label} channel stopped with an error.`, { reason: failureReason });
+                    // The running-channel entry (which holds the stop/reload dispose handle)
+                    // was just deleted, so dispose the responder here too — otherwise a
+                    // transport death orphans the per-channel harness/live-session manager
+                    // (the stop/reload path early-returns on the now-missing entry).
+                    void disposeResponder()?.catch((error) => {
+                        this.logger?.warn?.(`${driver.label} responder did not dispose cleanly after failure.`, {
+                            reason: failureReason,
+                            error: reasonOf(error),
+                        });
+                    });
+                },
+                // A self-recovering transport (e.g. telegram poll crash on a network blip).
+                // Unlike onFailure, this must NOT delete the running entry or dispose the
+                // responder: the channel owns its own restart, so the harness stays alive
+                // for the restarted transport to deliver into, and a later stop/reload still
+                // finds the entry and disposes it exactly once.
+                onDegraded: (reason) => {
+                    if (this.statuses.get(driver.id)?.kind === "degraded") {
+                        return;
+                    }
+                    this.setStatus(driver.id, { kind: "degraded", reason });
+                    this.logger?.warn?.(`${driver.label} channel degraded; transport is recovering.`, { reason });
+                },
+                // The transport's self-recovery succeeded. Flip back to running, reusing the
+                // preserved entry's summary. Guard on the entry: a recovery that races a
+                // stop/reload must not resurrect a torn-down channel's status.
+                onRecovered: () => {
+                    const entry = this.running.get(driver.id);
+                    if (entry === undefined) {
+                        return;
+                    }
+                    if (this.statuses.get(driver.id)?.kind !== "degraded") {
+                        return;
+                    }
+                    this.setStatus(driver.id, { kind: "running", summary: entry.summary });
+                    this.logger?.info?.(`${driver.label} channel recovered.`, {});
                 },
             });
-            this.running.set(driver.id, runningChannel);
+            this.running.set(driver.id, {
+                ...runningChannel,
+                stop: () => runningChannel.stop(),
+                ...(hasDispose ? { dispose: () => disposeResponder() ?? Promise.resolve() } : {}),
+            });
             const status = this.setStatus(driver.id, { kind: "running", summary: runningChannel.summary });
             this.logger?.info?.(`${driver.label} channel is running.`, { reason, ...runningChannel.summary });
             return status;
@@ -373,6 +761,12 @@ class MonoAgentAppController {
         await runningChannel.stop().catch((error) => {
             this.logger?.warn?.(`${driver.label} channel did not stop cleanly.`, { reason, error: reasonOf(error) });
         });
+        // Stop the transport first (so no new turns arrive), then dispose the responder
+        // so the harness/live-session manager and warm provider sessions are retired
+        // rather than lingering against stale config across a reload.
+        await runningChannel.dispose?.().catch((error) => {
+            this.logger?.warn?.(`${driver.label} responder did not dispose cleanly.`, { reason, error: reasonOf(error) });
+        });
         if (!this.stopped) {
             this.setStatus(id, {
                 kind: "waiting_for_config",
@@ -380,35 +774,210 @@ class MonoAgentAppController {
             });
         }
     }
-    buildResponder(coreConfig) {
+    async buildResponder(coreConfig) {
         const runtime = this.runtime ?? createConfiguredAgentRuntime(coreConfig);
         if (!this.activeRuntimes.includes(runtime)) {
             this.activeRuntimes.push(runtime);
         }
-        const memory = this.memoryStore(coreConfig);
-        return createConfiguredAgentResponder({
+        const memory = await this.memoryStore(coreConfig);
+        const memoryRecall = this.memoryRecallRuntimeOptions(coreConfig);
+        const supermemoryMcp = this.supermemoryMcpRuntimeOptions(coreConfig);
+        const adapterSendTools = await this.adapterSendToolsRuntimeOptions(coreConfig);
+        // Always active: a no-op for interactive turns (which carry no cron/webhook
+        // metadata), it applies the per-trigger model/effort override otherwise.
+        const requestModelOverride = this.requestModelOverrideRuntimeOptions(coreConfig);
+        const runtimeOptionsForRequest = composeRuntimeOptionExtensions([
+            memoryRecall,
+            supermemoryMcp,
+            adapterSendTools,
+            requestModelOverride,
+        ]);
+        // The override factory is only needed when fallbacks are configured: the
+        // fallback router freezes the model chain, so an override must run on a runtime
+        // whose chain has it as primary. With no fallbacks the shared (plain) runtime
+        // honors the per-run model directly, so building a separate runtime would be
+        // redundant. Omit the factory there and the harness uses the shared runtime.
+        const runtimeForModel = (coreConfig.runtime.fallbackModels?.length ?? 0) > 0
+            ? this.buildRuntimeForModel(coreConfig)
+            : undefined;
+        const observabilityContext = await this.observabilityContext();
+        const responder = await createConfiguredAgentResponder({
             config: coreConfig,
             runtime,
+            ...(runtimeForModel === undefined ? {} : { runtimeForModel }),
+            ...(this.sandboxEngine === undefined ? {} : { sandboxEngine: this.sandboxEngine }),
             ...(memory !== undefined && { memory }),
+            ...(runtimeOptionsForRequest === undefined ? {} : { runtimeOptionsForRequest }),
+            // Thread run-identifying context onto exported spans and surface per-run
+            // export warnings to `exporterStatus` (agent-host only builds the exporter
+            // when config.observability.exporters is non-empty).
+            observabilityContext,
+            exporterWarn: (warning) => this.recordExporterWarning(warning),
+            onSessionEvent: (event) => this.recordSessionEvent(event, coreConfig),
+            // Publish every run's start/event/finish to the shared bus so the `live`
+            // channel can relay it. Best-effort + additive (see broadcast recorder).
+            runEventSink: this.liveEventBus,
+        });
+        return responder;
+    }
+    /**
+     * Per-request extension that applies a cron/webhook/tui per-trigger model +
+     * effort override (validated, warn-and-ignore on bad input). Threads the
+     * configured local providers so a LOCAL-model override recomputes its endpoint
+     * block for the OVERRIDE model (see request-model-override doc). Composed
+     * alongside the memory/adapter extensions.
+     */
+    requestModelOverrideRuntimeOptions(coreConfig) {
+        const extension = createRequestModelOverrideRuntimeExtension({
+            ...(this.logger === undefined ? {} : { logger: this.logger }),
+            ...(coreConfig.providers?.local === undefined ? {} : { localProviders: coreConfig.providers.local }),
+        });
+        return async (input) => extension({ request: input.request });
+    }
+    /**
+     * Memoized factory for runtimes bound to a per-request override model. Reuses
+     * createConfiguredAgentRuntime so the override becomes the fallback-chain
+     * primary with the configured backups after it (override + keep fallbacks).
+     * Built runtimes register in `activeRuntimes`, which is disposed on `stop()`
+     * (config reload rebuilds the responder but does not drain prior runtimes —
+     * same lifetime as the base runtime built in `buildResponder`).
+     */
+    buildRuntimeForModel(coreConfig) {
+        const cache = new Map();
+        return (model, executionMode) => {
+            const key = `${modelReferenceKey(model)}|${executionMode ?? ""}`;
+            const cached = cache.get(key);
+            if (cached !== undefined) {
+                return cached;
+            }
+            const runtime = createConfiguredAgentRuntime({
+                config: coreConfig,
+                model,
+                ...(executionMode === undefined ? {} : { executionMode }),
+                ...(this.sandboxEngine === undefined ? {} : { sandboxEngine: this.sandboxEngine }),
+            });
+            cache.set(key, runtime);
+            this.activeRuntimes.push(runtime);
+            return runtime;
+        };
+    }
+    /**
+     * Run-identifying context threaded onto exported spans (Phoenix shows the same
+     * source/run identifiers as the local trace-source registry, so local artifact
+     * lookup stays possible). Resolved with the same source-id/label resolvers the
+     * trace source uses.
+     */
+    async observabilityContext() {
+        const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+        const [sourceId, sourceLabel] = await Promise.all([
+            resolveAppTraceSourceId(input, this.traceDefaults),
+            resolveAppTraceSourceLabel(input, this.traceDefaults),
+        ]);
+        return { sourceId, sourceLabel, configPath: this.configPath };
+    }
+    memoryRecallRuntimeOptions(coreConfig) {
+        const settings = resolveMemoryRecallSettings(coreConfig);
+        if (settings === undefined) {
+            return undefined;
+        }
+        this.logger?.info?.("Read-only memory_recall tool enabled.", {
+            provider: "supermemory" in settings ? "supermemory" : settings.embeddings?.provider ?? "fts-only",
+        });
+        return createMemoryRecallRuntimeExtension(settings, this.cwd);
+    }
+    /**
+     * Optional CLOUD-ONLY escape hatch: when `memory.supermemory.exposeMcpServer` is on, ALSO inject
+     * Supermemory's hosted MCP server alongside the in-app `memory_recall` tool. The hosted MCP cannot
+     * point at a self-hosted instance, so self-hosters rely on the in-app recall tool; this just adds
+     * the cloud server's richer tools for cloud deployments. Requires an apiKey (skipped + warned if
+     * absent).
+     */
+    supermemoryMcpRuntimeOptions(coreConfig) {
+        const memory = coreConfig.memory;
+        if (memory?.backend !== "supermemory" || memory.supermemory?.exposeMcpServer !== true) {
+            return undefined;
+        }
+        const apiKey = memory.supermemory.apiKey;
+        if (apiKey === undefined) {
+            this.logger?.warn?.("memory.supermemory.exposeMcpServer is on but no apiKey is set; the hosted Supermemory MCP server (cloud-only) was not injected.");
+            return undefined;
+        }
+        this.logger?.info?.("Supermemory hosted MCP server injected (cloud-only).");
+        const entry = {
+            supermemory: {
+                type: "http",
+                url: "https://mcp.supermemory.ai/mcp",
+                headers: { Authorization: `Bearer ${apiKey}` },
+            },
+        };
+        return async () => ({ runtimeOptions: { mcpServers: entry }, cleanup: async () => { } });
+    }
+    async adapterSendToolsRuntimeOptions(coreConfig) {
+        const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+        const settings = await resolveAdapterSendToolsSettings(input, {
+            allowedTools: coreConfig.tools.allowedTools,
+            disallowedTools: coreConfig.tools.disallowedTools,
+            logger: this.logger,
         });
+        if (settings === undefined) {
+            return undefined;
+        }
+        const toolNames = adapterSendToolNames(settings);
+        this.logger?.info?.("Adapter send tools enabled.", { tools: toolNames });
+        // Forward the posted-message index path so `slack_send_message` links each post
+        // back to the producing conversation (so a later in-thread reply resumes it).
+        const indexPath = resolvePostedMessageIndexPath(await resolveAppArtifactDir(input));
+        return createAdapterSendToolsRuntimeExtension(this.configPath, this.cwd, toolNames, indexPath);
     }
     /** Build the configured memory store once and share it across responders + the ritual scheduler. */
-    memoryStore(coreConfig) {
-        if (!this.sharedMemoryBuilt) {
+    async memoryStore(coreConfig) {
+        if (this.sharedMemoryBuilt) {
+            return this.sharedMemory;
+        }
+        if (this.sharedMemoryBuild !== undefined) {
+            return await this.sharedMemoryBuild;
+        }
+        this.sharedMemoryBuild = (async () => {
             const appLogger = this.logger;
             const logger = appLogger?.warn !== undefined
                 ? { warn: (message) => { appLogger.warn?.(message); } }
                 : undefined;
-            this.sharedMemory = createConfiguredMemory(coreConfig, ...(logger !== undefined ? [{ logger }] : []));
+            // Thread the per-app observability context so the bujo memory LLM records
+            // capture and consolidation runs through the same JSONL + Phoenix pipeline
+            // as channel runs (gated by `memory.llm.trace`, default on). The context is
+            // per-app (not per-request), so caching it into the shared store is correct.
+            //
+            // The channel runtime is intentionally NOT passed: the memory LLM must run
+            // on `config.memory.llm.model`, but the channel runtime carries the channel
+            // fallback chain whose primary is `config.runtime.model` and the fallback
+            // router overrides each run's per-call model. createConfiguredMemory builds
+            // the memory LLM its own fallback-free runtime when no `memoryRuntime` is set.
+            const observabilityContext = await this.observabilityContext();
+            const observability = {
+                observabilityContext,
+                exporterWarn: (warning) => this.recordExporterWarning(warning),
+                runEventSink: this.liveEventBus,
+            };
+            this.sharedMemory = await createConfiguredMemory(coreConfig, {
+                ...(logger === undefined ? {} : { logger }),
+                observability,
+            });
             this.sharedMemoryBuilt = true;
+            return this.sharedMemory;
+        })();
+        try {
+            return await this.sharedMemoryBuild;
+        }
+        finally {
+            this.sharedMemoryBuild = undefined;
         }
-        return this.sharedMemory;
     }
     /** Close + clear the shared memory store (on config reload or stop) so the next build is fresh. */
     async resetSharedMemory() {
         const mem = this.sharedMemory;
         this.sharedMemory = undefined;
         this.sharedMemoryBuilt = false;
+        this.sharedMemoryBuild = undefined;
         if (mem?.flush !== undefined) {
             await Promise.resolve(mem.flush()).catch(() => undefined);
         }
@@ -427,7 +996,8 @@ class MonoAgentAppController {
     }
     applyResult() {
         const transports = this.activeTransports();
-        const statuses = [...this.statuses.values()];
+        const statusEntries = [...this.statuses.entries()];
+        const statuses = statusEntries.map(([, status]) => status);
         const failedChannel = statuses.find((status) => status.kind === "failed");
         const failure = failedChannel?.kind === "failed"
             ? failedChannel.reason
@@ -441,8 +1011,10 @@ class MonoAgentAppController {
                 transports,
             };
         }
-        const hasRunningChannel = statuses.some((status) => status.kind === "running");
-        if (!hasRunningChannel && statuses.some((status) => status.kind === "waiting_for_config")) {
+        // A degraded channel is still serving (transport self-recovering, harness alive),
+        // so it counts as running for the "is anything live?" check.
+        const hasServingChannel = statusEntries.some(([id, status]) => id !== "live" && (status.kind === "running" || status.kind === "degraded"));
+        if (!hasServingChannel && statuses.some((status) => status.kind === "waiting_for_config")) {
             return {
                 kind: "waiting_for_config",
                 message: "Saved config, but no agent channel is running yet.",
@@ -457,32 +1029,77 @@ class MonoAgentAppController {
     }
     async stopTraceSource(reason) {
         const traceSource = this.traceSource;
-        if (traceSource === undefined) {
+        const globalTraceSource = this.globalTraceSource;
+        if (traceSource === undefined && globalTraceSource === undefined) {
             return;
         }
         this.traceSource = undefined;
-        await traceSource.stop({
-            metadata: this.traceMetadata(reason),
-            transports: this.activeTransports(),
-        }).catch((error) => {
+        this.globalTraceSource = undefined;
+        const patch = { metadata: this.traceMetadata(reason), transports: this.activeTransports() };
+        await traceSource?.stop(patch).catch((error) => {
             this.logger?.warn?.("Traceability source stop update failed.", { reason: reasonOf(error) });
         });
+        await globalTraceSource?.stop(patch).catch((error) => {
+            this.logger?.warn?.("Global trace-source mirror stop update failed.", { reason: reasonOf(error) });
+        });
         if (!this.stopped) {
             this.traceabilityStatusValue = { kind: "disabled", reason: "Traceability source stopped while applying config." };
         }
     }
     activeTransports() {
         const transports = [];
-        if (this.consoleServer !== undefined) {
-            transports.push("operator-console");
-        }
         for (const driver of this.drivers) {
-            if (this.statuses.get(driver.id)?.kind === "running") {
+            const kind = this.statuses.get(driver.id)?.kind;
+            // A degraded channel is still an active transport (self-recovering, serving).
+            if (kind === "running" || kind === "degraded") {
                 transports.push(driver.id);
             }
         }
         return transports;
     }
+    async refreshSelectedSkillsSnapshot(reason) {
+        try {
+            const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+            this.rememberSelectedSkills(await loadAppCoreConfig(input));
+        }
+        catch (error) {
+            this.selectedSkillsValue = undefined;
+            this.logger?.info?.("Selected skills unavailable until agent config loads.", { reason, detail: reasonOf(error) });
+        }
+    }
+    rememberSelectedSkills(coreConfig) {
+        this.selectedSkillsValue = [...coreConfig.context.selectedSkills];
+    }
+    recordSessionEvent(event, coreConfig) {
+        const now = new Date();
+        const nextRolloverAt = coreConfig.runtime.session.rollover === "daily"
+            ? nextDailyRolloverAt(now, coreConfig.runtime.session.rolloverTimezone)
+            : undefined;
+        const snapshot = event.snapshot ?? [];
+        const current = snapshot.find((entry) => entry.conversationId === event.conversationId);
+        const providerSessionId = current?.providerSessionId ?? event.providerSessionId;
+        this.sessionMetadataValue = {
+            currentBucketId: event.conversationId,
+            state: current === undefined ? "cold" : "warm",
+            event: event.kind,
+            updatedAt: now.toISOString(),
+            ...(snapshot.length === 0 ? {} : { snapshot }),
+            ...(providerSessionId === undefined ? {} : { providerSessionId }),
+            ...(current?.createdAt === undefined ? {} : { createdAt: current.createdAt }),
+            ...(current?.lastActivityAt === undefined ? {} : { lastActivityAt: current.lastActivityAt }),
+            ...(current?.busy === undefined ? {} : { busy: current.busy }),
+            ...(event.reason === undefined ? {} : { reason: event.reason }),
+            ...(nextRolloverAt === undefined ? {} : { nextRolloverAt }),
+        };
+        if (event.kind === "evicted") {
+            this.logger?.info?.("Provider session evicted.", {
+                conversationId: event.conversationId,
+                providerSessionId: event.providerSessionId,
+                reason: event.reason,
+            });
+        }
+        void this.refreshTraceSource(`session-${event.kind}`).catch(() => undefined);
+    }
     traceMetadata(reason) {
         const channels = {};
         for (const driver of this.drivers) {
@@ -496,29 +1113,182 @@ class MonoAgentAppController {
         }
         return {
             reason,
-            ...(this.operatorConsole === undefined
+            ...(this.exporterStatusValue.kind === "configured"
+                ? {
+                    observability: {
+                        // Persist only the endpoint + warning/error strings (never headers
+                        // or secrets) so the detached `status` reader can surface exporter
+                        // state. JSONL artifacts always remain local.
+                        endpoint: this.exporterStatusValue.endpoint,
+                        includeSensitiveData: this.exporterStatusValue.includeSensitiveData,
+                        jsonlArtifactsLocal: true,
+                        ...(this.exporterStatusValue.lastWarning === undefined
+                            ? {}
+                            : { lastWarning: this.exporterStatusValue.lastWarning }),
+                        ...(this.exporterStatusValue.lastError === undefined
+                            ? {}
+                            : { lastError: this.exporterStatusValue.lastError }),
+                    },
+                }
+                : {}),
+            sandbox: {
+                configured: this.sandboxStatusValue.configured,
+                configuredMode: this.sandboxStatusValue.configuredMode,
+                effective: this.sandboxStatusValue.effective,
+                engine: this.sandboxStatusValue.engine,
+                engineAvailable: this.sandboxStatusValue.engineAvailable,
+                fallback: this.sandboxStatusValue.fallback,
+                fallbackActive: this.sandboxStatusValue.fallbackActive,
+                unsafeAllowHostProcess: this.sandboxStatusValue.unsafeAllowHostProcess,
+                detail: this.sandboxStatusValue.detail,
+                ...(this.sandboxStatusValue.warning === undefined ? {} : { warning: this.sandboxStatusValue.warning }),
+                ...(this.sandboxStatusValue.resolutionError === undefined
+                    ? {}
+                    : { resolutionError: this.sandboxStatusValue.resolutionError }),
+            },
+            ...(this.selectedSkillsValue === undefined
                 ? {}
                 : {
-                    operatorConsole: {
-                        // Only the base loopback URL is persisted — never the per-boot
-                        // access token. A detached `status`/`start` reader surfaces this
-                        // URL and points at the logs for the tokenized link.
-                        url: this.operatorConsole.url,
-                        configPath: this.operatorConsole.configPath,
+                    context: {
+                        selectedSkills: [...this.selectedSkillsValue],
                     },
                 }),
+            ...(this.sessionMetadataValue === undefined ? {} : { session: this.sessionMetadataValue }),
             channels,
         };
     }
 }
-function logOperatorConsoleEvent(logger, event) {
-    if (event.kind === "validation_failed" || event.kind === "unauthorized") {
-        logger?.warn?.("Operator Console event.", { event });
-        return;
+function nextDailyRolloverAt(now, timezone) {
+    if (timezone === undefined || timezone.trim().length === 0) {
+        const next = new Date(now);
+        next.setHours(24, 0, 0, 0);
+        return next.toISOString();
     }
-    logger?.debug?.("Operator Console event.", { event });
+    try {
+        const parts = datePartsInTimeZone(now, timezone);
+        return new Date(zonedDateTimeToUtcMs({
+            year: parts.year,
+            month: parts.month,
+            day: parts.day + 1,
+            hour: 0,
+            minute: 0,
+            second: 0,
+        }, timezone)).toISOString();
+    }
+    catch {
+        const next = new Date(now);
+        next.setHours(24, 0, 0, 0);
+        return next.toISOString();
+    }
+}
+function zonedDateTimeToUtcMs(parts, timezone) {
+    const targetAsUtc = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+    let utcMs = targetAsUtc - timeZoneOffsetMs(new Date(targetAsUtc), timezone);
+    utcMs = targetAsUtc - timeZoneOffsetMs(new Date(utcMs), timezone);
+    return utcMs;
+}
+function timeZoneOffsetMs(date, timezone) {
+    const parts = datePartsInTimeZone(date, timezone);
+    const asUtc = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+    return asUtc - date.getTime();
+}
+function datePartsInTimeZone(date, timezone) {
+    const formatter = new Intl.DateTimeFormat("en-CA", {
+        timeZone: timezone,
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        second: "2-digit",
+        hourCycle: "h23",
+    });
+    const entries = new Map(formatter.formatToParts(date).map((part) => [part.type, part.value]));
+    return {
+        year: Number(entries.get("year")),
+        month: Number(entries.get("month")),
+        day: Number(entries.get("day")),
+        hour: Number(entries.get("hour")),
+        minute: Number(entries.get("minute")),
+        second: Number(entries.get("second")),
+    };
+}
+function sandboxStatusFromState(state) {
+    const warning = sandboxEffectiveStateWarning(state);
+    return {
+        ...state,
+        detail: describeSandboxEffectiveState(state),
+        ...(warning === undefined ? {} : { warning }),
+    };
 }
 function reasonOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * Compose several per-request runtime-options extensions into one. Each extension is invoked per
+ * request; mergeable runtime option maps/lists are unioned and their cleanups are chained. Returns
+ * `undefined` when no extension is active, so the host omits `runtimeOptionsForRequest` entirely.
+ */
+function composeRuntimeOptionExtensions(extensions) {
+    const active = extensions.filter((extension) => extension !== undefined);
+    if (active.length === 0) {
+        return undefined;
+    }
+    if (active.length === 1) {
+        return active[0];
+    }
+    return async (input) => {
+        const results = await Promise.all(active.map((extension) => extension(input)));
+        const runtimeOptions = {};
+        for (const result of results) {
+            mergeRuntimeOptions(runtimeOptions, result.runtimeOptions);
+        }
+        return {
+            runtimeOptions,
+            cleanup: async () => {
+                // Chain every cleanup; run them all even if one rejects so no extension leaks resources.
+                await Promise.all(results.map(async (result) => result.cleanup?.()));
+            },
+        };
+    };
+}
+function mergeRuntimeOptions(target, next) {
+    if (next === undefined) {
+        return;
+    }
+    for (const [key, value] of Object.entries(next)) {
+        if (value === undefined) {
+            continue;
+        }
+        if (key === "allowedTools" || key === "disallowedTools") {
+            target[key] = mergeStringLists(target[key], value);
+            continue;
+        }
+        if (key === "mcpServers") {
+            target[key] = {
+                ...(isRecord(target[key]) ? target[key] : {}),
+                ...(isRecord(value) ? value : {}),
+            };
+            continue;
+        }
+        target[key] = value;
+    }
+}
+function mergeStringLists(current, next) {
+    const out = [];
+    for (const list of [current, next]) {
+        if (!Array.isArray(list)) {
+            continue;
+        }
+        for (const item of list) {
+            if (typeof item === "string" && !out.includes(item)) {
+                out.push(item);
+            }
+        }
+    }
+    return out;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //# sourceMappingURL=app.js.map