@mono-agent/agent-app 0.4.0 → 0.5.0

package/dist/app.js

@@ -1,11 +1,20 @@
 import { resolve } from "node:path";
-import { createConfiguredAgentResponder, createConfiguredAgentRuntime, createConfiguredMemory, } from "@mono-agent/agent-host";
-import { registerTraceSource } from "@mono-agent/observability";
-import { isAppCoreConfigError, loadAppCoreConfig, resolveAppArtifactDir, resolveAppObservabilityExporters, resolveAppTraceHeartbeatMs, resolveAppTraceRegistryDir, resolveAppTraceSourceId, resolveAppTraceSourceLabel, resolveAppTraceStaleAfterMs, } from "./app-config.js";
-import { defaultChannelDrivers } from "./channels.js";
-import { adapterSendToolNames, createAdapterSendToolsRuntimeExtension, resolveAdapterSendToolsSettings, } from "./adapter-send-tools.js";
+import { createLiveEventBus } from "@mono-agent/agent-contracts";
+import { pruneTraceSources, reconcileStaleRunArtifacts, registerTraceSource } from "@mono-agent/observability";
+import { modelReferenceKey } from "@mono-agent/runtime-adapter";
+import { describeSandboxEffectiveState, resolveSandboxEffectiveState, sandboxEffectiveStateWarning, } from "@mono-agent/runtime-adapter";
+import { isAppCoreConfigError, loadAppCoreConfig, resolveAppArtifactDir, resolveAppObservabilityExporters, resolveAppTraceGlobalDiscovery, resolveAppTraceHeartbeatMs, resolveAppTraceRegistryDir, resolveAppTraceSourceId, resolveAppTraceSourceLabel, resolveAppTraceStaleAfterMs, resolveGlobalTraceRegistryDir, resolveTraceTmpdirRoot, shouldMirrorTraceSourceGlobally, } from "./app-config.js";
+import { createConfiguredAgentResponder, createConfiguredAgentRuntime, createConfiguredMemory, } from "./configured-agent.js";
+import { resolveChannelDrivers } from "./channels.js";
+import { routeProactiveNotification } from "./proactive-notify.js";
+import { adapterSendToolNames, createAdapterSendToolsRuntimeExtension, isAdapterSendToolAllowed, resolveAdapterSendToolsSettings, } from "./adapter-send-tools.js";
+import { loadInteractionSettings, startInteractionBridge } from "./interaction-bridge.js";
 import { startMemoryRituals } from "./memory-rituals.js";
+import { startArtifactRetentionScheduler } from "./artifact-retention.js";
 import { createMemoryRecallRuntimeExtension, resolveMemoryRecallSettings, } from "./memory-recall.js";
+import { createRequestModelOverrideRuntimeExtension } from "./request-model-override.js";
+import { resolveNotifyDestinations } from "./notify-destinations.js";
+import { resolvePostedMessageIndexPath } from "./posted-message-index.js";
 /**
  * Starts a config-first mono-agent host in `cwd`: traceability first, then every
  * configured channel in parallel. Channels with incomplete config report
@@ -16,7 +25,7 @@ export async function startMonoAgentApp(options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const configPath = resolve(cwd, options.configPath ?? "mono-agent.config.json");
     const env = options.env ?? process.env;
-    const drivers = options.drivers ?? defaultChannelDrivers();
+    const drivers = options.drivers ?? await resolveChannelDrivers({ env, cwd, configPath });
     const controller = new MonoAgentAppController({
         cwd,
         configPath,
@@ -24,8 +33,10 @@ export async function startMonoAgentApp(options = {}) {
         drivers,
         ...(options.logger === undefined ? {} : { logger: options.logger }),
         ...(options.runtime === undefined ? {} : { runtime: options.runtime }),
+        ...(options.sandboxEngine === undefined ? {} : { sandboxEngine: options.sandboxEngine }),
         ...(options.traceDefaults === undefined ? {} : { traceDefaults: options.traceDefaults }),
     });
+    await controller.refreshSandboxStatus("startup");
     await controller.startTraceability("startup");
     await controller.startExporters("startup");
     await Promise.all(drivers.map((driver) => controller?.startChannelIfConfigured(driver.id, "startup")));
@@ -33,6 +44,16 @@ export async function startMonoAgentApp(options = {}) {
     await controller.refreshTraceSource("startup-complete");
     return controller;
 }
+const DEFAULT_SANDBOX_STATUS = sandboxStatusFromState({
+    configured: false,
+    configuredMode: undefined,
+    effective: "off",
+    engine: undefined,
+    engineAvailable: undefined,
+    fallback: undefined,
+    fallbackActive: false,
+    unsafeAllowHostProcess: false,
+});
 class MonoAgentAppController {
     configPath;
     cwd;
@@ -41,11 +62,15 @@ class MonoAgentAppController {
     driversById;
     logger;
     runtime;
+    sandboxEngine;
     traceDefaults;
     activeRuntimes = [];
     statuses = new Map();
     running = new Map();
     startsInFlight = new Map();
+    /** Captured at construction (~process start): the cutoff for reclaiming orphaned "running" runs. */
+    processStartMs = Date.now();
+    staleRunsReconciled = false;
     traceabilityStatusValue = {
         kind: "disabled",
         reason: "Traceability has not started yet.",
@@ -54,16 +79,38 @@ class MonoAgentAppController {
         kind: "disabled",
         reason: "No observability exporter configured.",
     };
+    sandboxStatusValue = DEFAULT_SANDBOX_STATUS;
+    selectedSkillsValue;
+    sessionMetadataValue;
     /** The exporter the responder threads into agent-host (first configured exporter). */
     resolvedExporter;
     traceSource;
+    traceRefreshTail = Promise.resolve();
+    // Best-effort mirror of `traceSource` into the machine-wide global registry,
+    // present only when `shouldMirrorTraceSourceGlobally` gates it on (see
+    // `startTraceability`). Kept in lockstep with `traceSource` on every
+    // refresh/stop so both manifests describe the same instance identically.
+    globalTraceSource;
+    artifactRetentionScheduler;
+    artifactRetentionGeneration = 0;
     memoryRituals;
     // One shared memory store across all channel responders + the ritual scheduler, so there is a single
     // memory.db handle (not one per channel plus one for rituals). Rebuilt on config reload, closed on stop.
     sharedMemory = undefined;
     sharedMemoryBuilt = false;
+    sharedMemoryBuild;
     configApplyTail = Promise.resolve();
     stopped = false;
+    // Interaction bridge (ask_user + tool progress): lazily started once, shared
+    // by every channel; the exported env keys are tracked for cleanup on stop.
+    interactionBridge;
+    interactionBridgeStart;
+    interactionBridgeEnvKeys = [];
+    // Shared in-process run-event bus: every run's recorder publishes to it (via the
+    // broadcast recorder threaded as `runEventSink`), and the `live` channel relays
+    // it over SSE. One instance for the app's lifetime — cheap, bounded ring buffer,
+    // and it must exist before any responder is built (like the interaction bridge).
+    liveEventBus = createLiveEventBus();
     constructor(input) {
         this.cwd = input.cwd;
         this.configPath = input.configPath;
@@ -72,6 +119,7 @@ class MonoAgentAppController {
         this.driversById = new Map(input.drivers.map((driver) => [driver.id, driver]));
         this.logger = input.logger;
         this.runtime = input.runtime;
+        this.sandboxEngine = input.sandboxEngine;
         this.traceDefaults = input.traceDefaults;
         for (const driver of input.drivers) {
             this.statuses.set(driver.id, {
@@ -86,6 +134,12 @@ class MonoAgentAppController {
     get exporterStatus() {
         return this.exporterStatusValue;
     }
+    get sandboxStatus() {
+        return this.sandboxStatusValue;
+    }
+    get selectedSkills() {
+        return this.selectedSkillsValue;
+    }
     channelStatus(id) {
         const status = this.statuses.get(id);
         if (status === undefined) {
@@ -109,8 +163,10 @@ class MonoAgentAppController {
                 await this.stopChannel(driver.id, `${reason}:reload`);
             }
             this.stopMemoryRituals();
+            this.stopArtifactRetentionScheduler();
             await this.resetSharedMemory();
             await this.stopTraceSource(`${reason}:reload`);
+            await this.refreshSandboxStatus(reason);
             await this.startTraceability(reason);
             await this.startExporters(reason);
             await Promise.all(this.drivers.map((driver) => this.startChannelIfConfigured(driver.id, reason)));
@@ -147,16 +203,20 @@ class MonoAgentAppController {
         if (this.stopped) {
             return this.traceabilityStatusValue;
         }
+        let artifactDirForRetention;
         try {
             const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
-            const [registryDir, artifactDir, sourceId, label, heartbeatMs] = await Promise.all([
+            await this.refreshSelectedSkillsSnapshot(reason);
+            const [registryDir, artifactDir, sourceId, label, heartbeatMs, globalDiscovery] = await Promise.all([
                 resolveAppTraceRegistryDir(input),
                 resolveAppArtifactDir(input),
                 resolveAppTraceSourceId(input, this.traceDefaults),
                 resolveAppTraceSourceLabel(input, this.traceDefaults),
                 resolveAppTraceHeartbeatMs(input),
+                resolveAppTraceGlobalDiscovery(input),
             ]);
-            this.traceSource = await registerTraceSource({
+            artifactDirForRetention = artifactDir;
+            const registerOptions = {
                 registryDir,
                 sourceId,
                 label,
@@ -166,17 +226,102 @@ class MonoAgentAppController {
                 configPath: this.configPath,
                 metadata: this.traceMetadata(reason),
                 heartbeatMs,
-            });
+            };
+            this.traceSource = await registerTraceSource(registerOptions);
             this.traceabilityStatusValue = { kind: "running", sourceId, registryDir, artifactDir };
             this.logger?.info?.("Traceability source registered.", { reason, sourceId, registryDir, artifactDir });
+            void pruneTraceSources({ registryDir });
+            // Best-effort global mirror: makes this agent discoverable by `mono-agent
+            // tui` run anywhere on the machine, even when its own registryDir is a
+            // config-local override (e.g. `mono-agent init`'s scaffold). A mirror
+            // failure must never affect the primary registration above.
+            const globalRegistryDir = resolveGlobalTraceRegistryDir(this.env);
+            const tmpdirRoot = resolveTraceTmpdirRoot(this.env);
+            if (shouldMirrorTraceSourceGlobally({ registryDir, globalRegistryDir, globalDiscovery, tmpdirRoot })) {
+                try {
+                    this.globalTraceSource = await registerTraceSource({ ...registerOptions, registryDir: globalRegistryDir });
+                    void pruneTraceSources({ registryDir: globalRegistryDir });
+                }
+                catch (error) {
+                    this.globalTraceSource = undefined;
+                    this.logger?.warn?.("Global trace-source mirror registration failed.", { reason: reasonOf(error) });
+                }
+            }
+            else {
+                this.globalTraceSource = undefined;
+            }
         }
         catch (error) {
             const failure = reasonOf(error);
             this.traceabilityStatusValue = { kind: "failed", reason: failure };
             this.logger?.error?.("Traceability source registration failed.", { reason: failure });
         }
+        finally {
+            if (artifactDirForRetention !== undefined) {
+                // Fire-and-forget: orphan reclamation and retention are best-effort cleanup
+                // and must not gate startup readiness. Keep them independent from trace
+                // source registration; a broken registry should not disable artifact GC.
+                this.restartArtifactRetentionScheduler(artifactDirForRetention, reason);
+            }
+        }
         return this.traceabilityStatusValue;
     }
+    async refreshSandboxStatus(reason) {
+        try {
+            const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+            const coreConfig = await loadAppCoreConfig(input);
+            const state = await resolveSandboxEffectiveState({
+                ...(coreConfig.sandbox === undefined ? {} : { policy: coreConfig.sandbox }),
+                ...(this.sandboxEngine === undefined ? {} : { engine: this.sandboxEngine }),
+            });
+            const status = sandboxStatusFromState(state);
+            this.sandboxStatusValue = status;
+            if (status.warning !== undefined) {
+                this.logger?.warn?.(status.warning, { reason, detail: status.detail });
+            }
+            return status;
+        }
+        catch (error) {
+            const resolutionError = reasonOf(error);
+            const status = {
+                ...DEFAULT_SANDBOX_STATUS,
+                detail: `Sandbox status unavailable until agent config loads: ${resolutionError}`,
+                resolutionError,
+            };
+            this.sandboxStatusValue = status;
+            this.logger?.info?.("Sandbox status unavailable until agent config loads.", { reason, detail: resolutionError });
+            return status;
+        }
+    }
+    /**
+     * One-shot at startup: a process that crashed mid-run leaves its summary stuck at "running"
+     * forever (a ghost run in `status`/observability). Reclaim those — any "running" summary that
+     * began before THIS process started — by rewriting them to "interrupted". Gated so a config
+     * reload (which re-runs startTraceability) does not repeat the scan. Best-effort: never fatal.
+     */
+    async reconcileStaleRunsOnce(artifactDir) {
+        if (this.staleRunsReconciled) {
+            return;
+        }
+        this.staleRunsReconciled = true;
+        try {
+            const { reconciled, warnings } = await reconcileStaleRunArtifacts(artifactDir, {
+                startedBeforeMs: this.processStartMs,
+            });
+            for (const warning of warnings) {
+                this.logger?.warn?.(`Stale-run reconciliation: ${warning}`);
+            }
+            if (reconciled.length > 0) {
+                this.logger?.info?.('Reclaimed orphaned runs left as "running" by a prior process.', {
+                    count: reconciled.length,
+                    runIds: reconciled.slice(0, 20),
+                });
+            }
+        }
+        catch (error) {
+            this.logger?.warn?.("Stale-run reconciliation failed.", { reason: reasonOf(error) });
+        }
+    }
     /**
      * Resolve the configured observability exporter(s) and publish the export
      * status. No reachability probe runs here — Phoenix may start after the agent,
@@ -235,18 +380,84 @@ class MonoAgentAppController {
         void this.refreshTraceSource("exporter-warning").catch(() => undefined);
     }
     async refreshTraceSource(reason) {
-        if (this.traceSource === undefined) {
-            return;
-        }
-        try {
-            await this.traceSource.update({
-                transports: this.activeTransports(),
-                metadata: this.traceMetadata(reason),
+        const run = async () => {
+            if (this.traceSource === undefined) {
+                return;
+            }
+            const patch = { transports: this.activeTransports(), metadata: this.traceMetadata(reason) };
+            try {
+                await this.traceSource.update(patch);
+            }
+            catch (error) {
+                this.logger?.warn?.("Traceability source update failed.", { reason: reasonOf(error) });
+            }
+            if (this.globalTraceSource !== undefined) {
+                try {
+                    await this.globalTraceSource.update(patch);
+                }
+                catch (error) {
+                    this.logger?.warn?.("Global trace-source mirror update failed.", { reason: reasonOf(error) });
+                }
+            }
+        };
+        const next = this.traceRefreshTail.then(run, run);
+        this.traceRefreshTail = next.then(() => undefined, () => undefined);
+        await next;
+    }
+    /**
+     * Start the interaction bridge once, when the ask_user tool is allowed by the
+     * tool policy or the operator configured the `interaction` block. Exports the
+     * bridge env into the app env AND process env so settings resolution and
+     * spawned stdio tool children (which inherit process.env) can reach it.
+     */
+    ensureInteractionBridge(coreConfig) {
+        this.interactionBridgeStart ??= (async () => {
+            const askUserAllowed = isAdapterSendToolAllowed("ask_user", {
+                allowedTools: coreConfig.tools.allowedTools,
+                disallowedTools: coreConfig.tools.disallowedTools,
             });
+            const settings = await loadInteractionSettings({ env: this.env, configPath: this.configPath });
+            if (!askUserAllowed && !settings.configured) {
+                return undefined;
+            }
+            try {
+                const bridge = await startInteractionBridge({
+                    host: settings.host,
+                    port: settings.port,
+                    askTimeoutMs: settings.askTimeoutMs,
+                    ...(this.logger === undefined ? {} : { logger: this.logger }),
+                });
+                const bridgeEnv = bridge.env();
+                this.interactionBridgeEnvKeys = Object.keys(bridgeEnv);
+                Object.assign(this.env, bridgeEnv);
+                if (this.env !== process.env) {
+                    Object.assign(process.env, bridgeEnv);
+                }
+                this.interactionBridge = bridge;
+                this.logger?.info?.("Interaction bridge started.", { url: bridge.url });
+                return bridge;
+            }
+            catch (error) {
+                this.logger?.warn?.("Interaction bridge failed to start; ask_user and tool progress are unavailable.", {
+                    reason: reasonOf(error),
+                });
+                return undefined;
+            }
+        })();
+        return this.interactionBridgeStart;
+    }
+    async stopInteractionBridge() {
+        const bridge = this.interactionBridge;
+        this.interactionBridge = undefined;
+        this.interactionBridgeStart = undefined;
+        for (const key of this.interactionBridgeEnvKeys) {
+            delete this.env[key];
+            if (this.env !== process.env) {
+                delete process.env[key];
+            }
         }
-        catch (error) {
-            this.logger?.warn?.("Traceability source update failed.", { reason: reasonOf(error) });
-        }
+        this.interactionBridgeEnvKeys = [];
+        await bridge?.stop().catch(() => undefined);
     }
     async stop() {
         if (this.stopped) {
@@ -256,7 +467,9 @@ class MonoAgentAppController {
         for (const driver of this.drivers) {
             await this.stopChannel(driver.id, "stop");
         }
+        await this.stopInteractionBridge();
         this.stopMemoryRituals();
+        this.stopArtifactRetentionScheduler();
         await this.resetSharedMemory();
         await this.stopTraceSource("stop");
         for (const runtime of this.activeRuntimes.splice(0)) {
@@ -271,26 +484,30 @@ class MonoAgentAppController {
         try {
             const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
             coreConfig = await loadAppCoreConfig(input);
+            this.rememberSelectedSkills(coreConfig);
         }
         catch {
-            // Config not ready yet — rituals will start on the next applyConfigChange.
+            // Config not ready yet — consolidation will start on the next applyConfigChange.
             return;
         }
         if (coreConfig.memory?.mode !== "bujo") {
             return;
         }
-        const runtime = this.runtime ?? createConfiguredAgentRuntime(coreConfig);
+        const runtime = this.runtime ?? createConfiguredAgentRuntime({
+            config: coreConfig,
+            ...(this.sandboxEngine === undefined ? {} : { sandboxEngine: this.sandboxEngine }),
+        });
         if (!this.activeRuntimes.includes(runtime)) {
             this.activeRuntimes.push(runtime);
         }
-        const store = this.memoryStore(coreConfig, runtime);
-        // Duck-type: only bujo-tier BujoMemoryStore has reflect/migrate.
+        const store = await this.memoryStore(coreConfig);
+        // Duck-type: only bujo-tier BujoMemoryStore has consolidate().
         // Cast through unknown to bypass the MemoryStore contract's type mismatch.
         const storeAsAny = store;
         if (store === undefined ||
-            typeof storeAsAny["reflect"] !== "function" ||
-            typeof storeAsAny["migrate"] !== "function" ||
+            typeof storeAsAny["consolidate"] !== "function" ||
             typeof storeAsAny["tier"] !== "function") {
+            this.logger?.info?.("Memory consolidation scheduler skipped — store does not support consolidate().", { reason });
             return;
         }
         const bujoStore = store;
@@ -299,13 +516,12 @@ class MonoAgentAppController {
         // scheduler started in that case — log an accurate skip instead.
         const tier = bujoStore.tier();
         if (tier !== "bujo") {
-            this.logger?.info?.("Memory ritual scheduler skipped — store tier is not bujo (reflect/migrate need a chat LLM).", { reason, tier });
+            this.logger?.info?.("Memory consolidation scheduler skipped — configured bujo mode resolved to the journal tier because memory.llm is missing.", { reason, tier });
             return;
         }
         this.memoryRituals = startMemoryRituals({
             store: bujoStore,
-            ...(coreConfig.memory.reflection !== undefined && { reflection: coreConfig.memory.reflection }),
-            ...(coreConfig.memory.migration !== undefined && { migration: coreConfig.memory.migration }),
+            ...(coreConfig.memory.consolidation !== undefined && { consolidation: coreConfig.memory.consolidation }),
             ...(this.logger !== undefined && {
                 logger: {
                     info: (m) => this.logger?.info?.(m),
@@ -313,7 +529,7 @@ class MonoAgentAppController {
                 },
             }),
         });
-        this.logger?.info?.("Memory ritual scheduler started.", { reason, mode: "bujo" });
+        this.logger?.info?.("Memory consolidation scheduler started.", { reason, mode: "bujo" });
     }
     stopMemoryRituals() {
         const rituals = this.memoryRituals;
@@ -322,7 +538,94 @@ class MonoAgentAppController {
         }
         this.memoryRituals = undefined;
         rituals.stop();
-        this.logger?.info?.("Memory ritual scheduler stopped.");
+        this.logger?.info?.("Memory consolidation scheduler stopped.");
+    }
+    restartArtifactRetentionScheduler(artifactDir, reason) {
+        this.stopArtifactRetentionScheduler();
+        const generation = ++this.artifactRetentionGeneration;
+        void (async () => {
+            let coreConfig;
+            try {
+                const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+                coreConfig = await loadAppCoreConfig(input);
+                this.rememberSelectedSkills(coreConfig);
+            }
+            catch (error) {
+                this.logger?.warn?.("Artifact retention scheduler skipped until core config loads.", { reason: reasonOf(error) });
+                void this.reconcileStaleRunsOnce(artifactDir);
+                return;
+            }
+            if (this.stopped || generation !== this.artifactRetentionGeneration) {
+                return;
+            }
+            this.artifactRetentionScheduler = startArtifactRetentionScheduler({
+                artifactDir,
+                retention: coreConfig.artifacts.retention,
+                memoryRetention: coreConfig.artifacts.memoryRetention,
+                ...(this.logger === undefined ? {} : { logger: this.logger }),
+                beforeFirstRun: () => this.reconcileStaleRunsOnce(artifactDir),
+            });
+            this.logger?.info?.("Artifact retention scheduler started.", {
+                reason,
+                artifactDir,
+                agent: {
+                    maxAgeDays: coreConfig.artifacts.retention.maxAgeDays,
+                    maxCount: coreConfig.artifacts.retention.maxCount,
+                    dryRun: coreConfig.artifacts.retention.dryRun,
+                },
+                memory: {
+                    maxAgeDays: coreConfig.artifacts.memoryRetention.maxAgeDays,
+                    maxCount: coreConfig.artifacts.memoryRetention.maxCount,
+                    dryRun: coreConfig.artifacts.memoryRetention.dryRun,
+                },
+            });
+        })();
+    }
+    stopArtifactRetentionScheduler() {
+        this.artifactRetentionGeneration += 1;
+        const scheduler = this.artifactRetentionScheduler;
+        if (scheduler === undefined) {
+            return;
+        }
+        this.artifactRetentionScheduler = undefined;
+        scheduler.stop();
+        this.logger?.info?.("Artifact retention scheduler stopped.");
+    }
+    /**
+     * Deliver a native cron/webhook notification to whichever running channel owns
+     * the destination conversationId. With `verbatim`, the channel posts `text`
+     * unchanged (no model call) and records it to history; otherwise it runs `text`
+     * as a turn. Best-effort: an unavailable/unsupported destination is warned and
+     * skipped, never thrown back to the cron/webhook trigger.
+     */
+    async notifyDestination(conversationId, text, options) {
+        const result = await routeProactiveNotification({
+            conversationId,
+            text,
+            running: this.running,
+            ...(options?.verbatim === undefined ? {} : { verbatim: options.verbatim }),
+            ...(this.logger === undefined ? {} : { logger: this.logger }),
+        });
+        // Make the delivery outcome inspectable (the failure cases already warn inside
+        // the router / channel hooks; log the success path too so a notify is auditable).
+        if (result.delivered) {
+            this.logger?.info?.("Proactive notification delivered.", { conversationId });
+        }
+        return result;
+    }
+    /**
+     * Candidate destinations for native cron/webhook notification delivery, used to
+     * infer a target when a job/endpoint sets no explicit `notifyConversationId`.
+     */
+    async listNotifyDestinations() {
+        const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+        const artifactDir = await resolveAppArtifactDir(input);
+        return await resolveNotifyDestinations({
+            input,
+            artifactDir,
+            isRunning: (id) => this.running.has(id),
+            ...(this.logger === undefined ? {} : { logger: this.logger }),
+        });
     }
     async startChannel(driver, reason) {
         const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
@@ -344,9 +647,16 @@ class MonoAgentAppController {
         if (waitingReason !== undefined) {
             return this.setStatus(driver.id, { kind: "waiting_for_config", reason: waitingReason });
         }
+        // Structural issues (e.g. an invalid per-trigger model override) fail
+        // `validate` but only WARN here: the run-time override path ignores the
+        // bad value and falls back, so starting is still the safe choice.
+        for (const issue of driver.configIssues?.(config) ?? []) {
+            this.logger?.warn?.("Channel config issue (run `mono-agent validate`).", { channel: driver.id, issue });
+        }
         let coreConfig;
         try {
             coreConfig = await loadAppCoreConfig(input);
+            this.rememberSelectedSkills(coreConfig);
         }
         catch (error) {
             if (isAppCoreConfigError(error)) {
@@ -355,6 +665,13 @@ class MonoAgentAppController {
             }
             throw error;
         }
+        // Resolve the posted-message index path once so the Slack driver can link
+        // posted messages to their producing conversation (in-thread reply continuity).
+        const postedMessageIndexPath = resolvePostedMessageIndexPath(await resolveAppArtifactDir(input));
+        // The bridge must exist BEFORE the responder is built (ask_user settings
+        // resolution reads the exported bridge env) and before driver.start (sink
+        // registration + pending-ask interception).
+        const interactionBridge = await this.ensureInteractionBridge(coreConfig);
         try {
             const responder = await this.buildResponder(coreConfig);
             // The AgentResponder contract has no dispose(), but the configured responder
@@ -371,6 +688,11 @@ class MonoAgentAppController {
                 coreConfig,
                 responder,
                 cwd: this.cwd,
+                notifyDestination: (conversationId, text, options) => this.notifyDestination(conversationId, text, options),
+                listNotifyDestinations: () => this.listNotifyDestinations(),
+                postedMessageIndexPath,
+                ...(interactionBridge === undefined ? {} : { interaction: interactionBridge }),
+                liveEventBus: this.liveEventBus,
                 ...(this.logger === undefined ? {} : { logger: this.logger }),
                 onFailure: (failureReason) => {
                     this.running.delete(driver.id);
@@ -387,6 +709,32 @@ class MonoAgentAppController {
                         });
                     });
                 },
+                // A self-recovering transport (e.g. telegram poll crash on a network blip).
+                // Unlike onFailure, this must NOT delete the running entry or dispose the
+                // responder: the channel owns its own restart, so the harness stays alive
+                // for the restarted transport to deliver into, and a later stop/reload still
+                // finds the entry and disposes it exactly once.
+                onDegraded: (reason) => {
+                    if (this.statuses.get(driver.id)?.kind === "degraded") {
+                        return;
+                    }
+                    this.setStatus(driver.id, { kind: "degraded", reason });
+                    this.logger?.warn?.(`${driver.label} channel degraded; transport is recovering.`, { reason });
+                },
+                // The transport's self-recovery succeeded. Flip back to running, reusing the
+                // preserved entry's summary. Guard on the entry: a recovery that races a
+                // stop/reload must not resurrect a torn-down channel's status.
+                onRecovered: () => {
+                    const entry = this.running.get(driver.id);
+                    if (entry === undefined) {
+                        return;
+                    }
+                    if (this.statuses.get(driver.id)?.kind !== "degraded") {
+                        return;
+                    }
+                    this.setStatus(driver.id, { kind: "running", summary: entry.summary });
+                    this.logger?.info?.(`${driver.label} channel recovered.`, {});
+                },
             });
             this.running.set(driver.id, {
                 ...runningChannel,
@@ -431,14 +779,33 @@ class MonoAgentAppController {
         if (!this.activeRuntimes.includes(runtime)) {
             this.activeRuntimes.push(runtime);
         }
-        const memory = this.memoryStore(coreConfig, runtime);
+        const memory = await this.memoryStore(coreConfig);
         const memoryRecall = this.memoryRecallRuntimeOptions(coreConfig);
+        const supermemoryMcp = this.supermemoryMcpRuntimeOptions(coreConfig);
         const adapterSendTools = await this.adapterSendToolsRuntimeOptions(coreConfig);
-        const runtimeOptionsForRequest = composeRuntimeOptionExtensions([memoryRecall, adapterSendTools]);
+        // Always active: a no-op for interactive turns (which carry no cron/webhook
+        // metadata), it applies the per-trigger model/effort override otherwise.
+        const requestModelOverride = this.requestModelOverrideRuntimeOptions(coreConfig);
+        const runtimeOptionsForRequest = composeRuntimeOptionExtensions([
+            memoryRecall,
+            supermemoryMcp,
+            adapterSendTools,
+            requestModelOverride,
+        ]);
+        // The override factory is only needed when fallbacks are configured: the
+        // fallback router freezes the model chain, so an override must run on a runtime
+        // whose chain has it as primary. With no fallbacks the shared (plain) runtime
+        // honors the per-run model directly, so building a separate runtime would be
+        // redundant. Omit the factory there and the harness uses the shared runtime.
+        const runtimeForModel = (coreConfig.runtime.fallbackModels?.length ?? 0) > 0
+            ? this.buildRuntimeForModel(coreConfig)
+            : undefined;
         const observabilityContext = await this.observabilityContext();
-        const responder = createConfiguredAgentResponder({
+        const responder = await createConfiguredAgentResponder({
             config: coreConfig,
             runtime,
+            ...(runtimeForModel === undefined ? {} : { runtimeForModel }),
+            ...(this.sandboxEngine === undefined ? {} : { sandboxEngine: this.sandboxEngine }),
             ...(memory !== undefined && { memory }),
             ...(runtimeOptionsForRequest === undefined ? {} : { runtimeOptionsForRequest }),
             // Thread run-identifying context onto exported spans and surface per-run
@@ -446,9 +813,54 @@ class MonoAgentAppController {
             // when config.observability.exporters is non-empty).
             observabilityContext,
             exporterWarn: (warning) => this.recordExporterWarning(warning),
+            onSessionEvent: (event) => this.recordSessionEvent(event, coreConfig),
+            // Publish every run's start/event/finish to the shared bus so the `live`
+            // channel can relay it. Best-effort + additive (see broadcast recorder).
+            runEventSink: this.liveEventBus,
         });
         return responder;
     }
+    /**
+     * Per-request extension that applies a cron/webhook/tui per-trigger model +
+     * effort override (validated, warn-and-ignore on bad input). Threads the
+     * configured local providers so a LOCAL-model override recomputes its endpoint
+     * block for the OVERRIDE model (see request-model-override doc). Composed
+     * alongside the memory/adapter extensions.
+     */
+    requestModelOverrideRuntimeOptions(coreConfig) {
+        const extension = createRequestModelOverrideRuntimeExtension({
+            ...(this.logger === undefined ? {} : { logger: this.logger }),
+            ...(coreConfig.providers?.local === undefined ? {} : { localProviders: coreConfig.providers.local }),
+        });
+        return async (input) => extension({ request: input.request });
+    }
+    /**
+     * Memoized factory for runtimes bound to a per-request override model. Reuses
+     * createConfiguredAgentRuntime so the override becomes the fallback-chain
+     * primary with the configured backups after it (override + keep fallbacks).
+     * Built runtimes register in `activeRuntimes`, which is disposed on `stop()`
+     * (config reload rebuilds the responder but does not drain prior runtimes —
+     * same lifetime as the base runtime built in `buildResponder`).
+     */
+    buildRuntimeForModel(coreConfig) {
+        const cache = new Map();
+        return (model, executionMode) => {
+            const key = `${modelReferenceKey(model)}|${executionMode ?? ""}`;
+            const cached = cache.get(key);
+            if (cached !== undefined) {
+                return cached;
+            }
+            const runtime = createConfiguredAgentRuntime({
+                config: coreConfig,
+                model,
+                ...(executionMode === undefined ? {} : { executionMode }),
+                ...(this.sandboxEngine === undefined ? {} : { sandboxEngine: this.sandboxEngine }),
+            });
+            cache.set(key, runtime);
+            this.activeRuntimes.push(runtime);
+            return runtime;
+        };
+    }
     /**
      * Run-identifying context threaded onto exported spans (Phoenix shows the same
      * source/run identifiers as the local trace-source registry, so local artifact
@@ -469,10 +881,37 @@ class MonoAgentAppController {
             return undefined;
         }
         this.logger?.info?.("Read-only memory_recall tool enabled.", {
-            provider: settings.embeddings?.provider ?? "fts-only",
+            provider: "supermemory" in settings ? "supermemory" : settings.embeddings?.provider ?? "fts-only",
         });
         return createMemoryRecallRuntimeExtension(settings, this.cwd);
     }
+    /**
+     * Optional CLOUD-ONLY escape hatch: when `memory.supermemory.exposeMcpServer` is on, ALSO inject
+     * Supermemory's hosted MCP server alongside the in-app `memory_recall` tool. The hosted MCP cannot
+     * point at a self-hosted instance, so self-hosters rely on the in-app recall tool; this just adds
+     * the cloud server's richer tools for cloud deployments. Requires an apiKey (skipped + warned if
+     * absent).
+     */
+    supermemoryMcpRuntimeOptions(coreConfig) {
+        const memory = coreConfig.memory;
+        if (memory?.backend !== "supermemory" || memory.supermemory?.exposeMcpServer !== true) {
+            return undefined;
+        }
+        const apiKey = memory.supermemory.apiKey;
+        if (apiKey === undefined) {
+            this.logger?.warn?.("memory.supermemory.exposeMcpServer is on but no apiKey is set; the hosted Supermemory MCP server (cloud-only) was not injected.");
+            return undefined;
+        }
+        this.logger?.info?.("Supermemory hosted MCP server injected (cloud-only).");
+        const entry = {
+            supermemory: {
+                type: "http",
+                url: "https://mcp.supermemory.ai/mcp",
+                headers: { Authorization: `Bearer ${apiKey}` },
+            },
+        };
+        return async () => ({ runtimeOptions: { mcpServers: entry }, cleanup: async () => { } });
+    }
     async adapterSendToolsRuntimeOptions(coreConfig) {
         const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
         const settings = await resolveAdapterSendToolsSettings(input, {
@@ -485,25 +924,60 @@ class MonoAgentAppController {
         }
         const toolNames = adapterSendToolNames(settings);
         this.logger?.info?.("Adapter send tools enabled.", { tools: toolNames });
-        return createAdapterSendToolsRuntimeExtension(this.configPath, this.cwd, toolNames);
+        // Forward the posted-message index path so `slack_send_message` links each post
+        // back to the producing conversation (so a later in-thread reply resumes it).
+        const indexPath = resolvePostedMessageIndexPath(await resolveAppArtifactDir(input));
+        return createAdapterSendToolsRuntimeExtension(this.configPath, this.cwd, toolNames, indexPath);
     }
     /** Build the configured memory store once and share it across responders + the ritual scheduler. */
-    memoryStore(coreConfig, runtime) {
-        if (!this.sharedMemoryBuilt) {
+    async memoryStore(coreConfig) {
+        if (this.sharedMemoryBuilt) {
+            return this.sharedMemory;
+        }
+        if (this.sharedMemoryBuild !== undefined) {
+            return await this.sharedMemoryBuild;
+        }
+        this.sharedMemoryBuild = (async () => {
             const appLogger = this.logger;
             const logger = appLogger?.warn !== undefined
                 ? { warn: (message) => { appLogger.warn?.(message); } }
                 : undefined;
-            this.sharedMemory = createConfiguredMemory(coreConfig, { ...(logger === undefined ? {} : { logger }), runtime });
+            // Thread the per-app observability context so the bujo memory LLM records
+            // capture and consolidation runs through the same JSONL + Phoenix pipeline
+            // as channel runs (gated by `memory.llm.trace`, default on). The context is
+            // per-app (not per-request), so caching it into the shared store is correct.
+            //
+            // The channel runtime is intentionally NOT passed: the memory LLM must run
+            // on `config.memory.llm.model`, but the channel runtime carries the channel
+            // fallback chain whose primary is `config.runtime.model` and the fallback
+            // router overrides each run's per-call model. createConfiguredMemory builds
+            // the memory LLM its own fallback-free runtime when no `memoryRuntime` is set.
+            const observabilityContext = await this.observabilityContext();
+            const observability = {
+                observabilityContext,
+                exporterWarn: (warning) => this.recordExporterWarning(warning),
+                runEventSink: this.liveEventBus,
+            };
+            this.sharedMemory = await createConfiguredMemory(coreConfig, {
+                ...(logger === undefined ? {} : { logger }),
+                observability,
+            });
             this.sharedMemoryBuilt = true;
+            return this.sharedMemory;
+        })();
+        try {
+            return await this.sharedMemoryBuild;
+        }
+        finally {
+            this.sharedMemoryBuild = undefined;
         }
-        return this.sharedMemory;
     }
     /** Close + clear the shared memory store (on config reload or stop) so the next build is fresh. */
     async resetSharedMemory() {
         const mem = this.sharedMemory;
         this.sharedMemory = undefined;
         this.sharedMemoryBuilt = false;
+        this.sharedMemoryBuild = undefined;
         if (mem?.flush !== undefined) {
             await Promise.resolve(mem.flush()).catch(() => undefined);
         }
@@ -522,7 +996,8 @@ class MonoAgentAppController {
     }
     applyResult() {
         const transports = this.activeTransports();
-        const statuses = [...this.statuses.values()];
+        const statusEntries = [...this.statuses.entries()];
+        const statuses = statusEntries.map(([, status]) => status);
         const failedChannel = statuses.find((status) => status.kind === "failed");
         const failure = failedChannel?.kind === "failed"
             ? failedChannel.reason
@@ -536,8 +1011,10 @@ class MonoAgentAppController {
                 transports,
             };
         }
-        const hasRunningChannel = statuses.some((status) => status.kind === "running");
-        if (!hasRunningChannel && statuses.some((status) => status.kind === "waiting_for_config")) {
+        // A degraded channel is still serving (transport self-recovering, harness alive),
+        // so it counts as running for the "is anything live?" check.
+        const hasServingChannel = statusEntries.some(([id, status]) => id !== "live" && (status.kind === "running" || status.kind === "degraded"));
+        if (!hasServingChannel && statuses.some((status) => status.kind === "waiting_for_config")) {
             return {
                 kind: "waiting_for_config",
                 message: "Saved config, but no agent channel is running yet.",
@@ -552,16 +1029,19 @@ class MonoAgentAppController {
     }
     async stopTraceSource(reason) {
         const traceSource = this.traceSource;
-        if (traceSource === undefined) {
+        const globalTraceSource = this.globalTraceSource;
+        if (traceSource === undefined && globalTraceSource === undefined) {
             return;
         }
         this.traceSource = undefined;
-        await traceSource.stop({
-            metadata: this.traceMetadata(reason),
-            transports: this.activeTransports(),
-        }).catch((error) => {
+        this.globalTraceSource = undefined;
+        const patch = { metadata: this.traceMetadata(reason), transports: this.activeTransports() };
+        await traceSource?.stop(patch).catch((error) => {
             this.logger?.warn?.("Traceability source stop update failed.", { reason: reasonOf(error) });
         });
+        await globalTraceSource?.stop(patch).catch((error) => {
+            this.logger?.warn?.("Global trace-source mirror stop update failed.", { reason: reasonOf(error) });
+        });
         if (!this.stopped) {
             this.traceabilityStatusValue = { kind: "disabled", reason: "Traceability source stopped while applying config." };
         }
@@ -569,12 +1049,57 @@ class MonoAgentAppController {
     activeTransports() {
         const transports = [];
         for (const driver of this.drivers) {
-            if (this.statuses.get(driver.id)?.kind === "running") {
+            const kind = this.statuses.get(driver.id)?.kind;
+            // A degraded channel is still an active transport (self-recovering, serving).
+            if (kind === "running" || kind === "degraded") {
                 transports.push(driver.id);
             }
         }
         return transports;
     }
+    async refreshSelectedSkillsSnapshot(reason) {
+        try {
+            const input = { env: this.env, cwd: this.cwd, configPath: this.configPath };
+            this.rememberSelectedSkills(await loadAppCoreConfig(input));
+        }
+        catch (error) {
+            this.selectedSkillsValue = undefined;
+            this.logger?.info?.("Selected skills unavailable until agent config loads.", { reason, detail: reasonOf(error) });
+        }
+    }
+    rememberSelectedSkills(coreConfig) {
+        this.selectedSkillsValue = [...coreConfig.context.selectedSkills];
+    }
+    recordSessionEvent(event, coreConfig) {
+        const now = new Date();
+        const nextRolloverAt = coreConfig.runtime.session.rollover === "daily"
+            ? nextDailyRolloverAt(now, coreConfig.runtime.session.rolloverTimezone)
+            : undefined;
+        const snapshot = event.snapshot ?? [];
+        const current = snapshot.find((entry) => entry.conversationId === event.conversationId);
+        const providerSessionId = current?.providerSessionId ?? event.providerSessionId;
+        this.sessionMetadataValue = {
+            currentBucketId: event.conversationId,
+            state: current === undefined ? "cold" : "warm",
+            event: event.kind,
+            updatedAt: now.toISOString(),
+            ...(snapshot.length === 0 ? {} : { snapshot }),
+            ...(providerSessionId === undefined ? {} : { providerSessionId }),
+            ...(current?.createdAt === undefined ? {} : { createdAt: current.createdAt }),
+            ...(current?.lastActivityAt === undefined ? {} : { lastActivityAt: current.lastActivityAt }),
+            ...(current?.busy === undefined ? {} : { busy: current.busy }),
+            ...(event.reason === undefined ? {} : { reason: event.reason }),
+            ...(nextRolloverAt === undefined ? {} : { nextRolloverAt }),
+        };
+        if (event.kind === "evicted") {
+            this.logger?.info?.("Provider session evicted.", {
+                conversationId: event.conversationId,
+                providerSessionId: event.providerSessionId,
+                reason: event.reason,
+            });
+        }
+        void this.refreshTraceSource(`session-${event.kind}`).catch(() => undefined);
+    }
     traceMetadata(reason) {
         const channels = {};
         for (const driver of this.drivers) {
@@ -606,10 +1131,96 @@ class MonoAgentAppController {
                     },
                 }
                 : {}),
+            sandbox: {
+                configured: this.sandboxStatusValue.configured,
+                configuredMode: this.sandboxStatusValue.configuredMode,
+                effective: this.sandboxStatusValue.effective,
+                engine: this.sandboxStatusValue.engine,
+                engineAvailable: this.sandboxStatusValue.engineAvailable,
+                fallback: this.sandboxStatusValue.fallback,
+                fallbackActive: this.sandboxStatusValue.fallbackActive,
+                unsafeAllowHostProcess: this.sandboxStatusValue.unsafeAllowHostProcess,
+                detail: this.sandboxStatusValue.detail,
+                ...(this.sandboxStatusValue.warning === undefined ? {} : { warning: this.sandboxStatusValue.warning }),
+                ...(this.sandboxStatusValue.resolutionError === undefined
+                    ? {}
+                    : { resolutionError: this.sandboxStatusValue.resolutionError }),
+            },
+            ...(this.selectedSkillsValue === undefined
+                ? {}
+                : {
+                    context: {
+                        selectedSkills: [...this.selectedSkillsValue],
+                    },
+                }),
+            ...(this.sessionMetadataValue === undefined ? {} : { session: this.sessionMetadataValue }),
             channels,
         };
     }
 }
+function nextDailyRolloverAt(now, timezone) {
+    if (timezone === undefined || timezone.trim().length === 0) {
+        const next = new Date(now);
+        next.setHours(24, 0, 0, 0);
+        return next.toISOString();
+    }
+    try {
+        const parts = datePartsInTimeZone(now, timezone);
+        return new Date(zonedDateTimeToUtcMs({
+            year: parts.year,
+            month: parts.month,
+            day: parts.day + 1,
+            hour: 0,
+            minute: 0,
+            second: 0,
+        }, timezone)).toISOString();
+    }
+    catch {
+        const next = new Date(now);
+        next.setHours(24, 0, 0, 0);
+        return next.toISOString();
+    }
+}
+function zonedDateTimeToUtcMs(parts, timezone) {
+    const targetAsUtc = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+    let utcMs = targetAsUtc - timeZoneOffsetMs(new Date(targetAsUtc), timezone);
+    utcMs = targetAsUtc - timeZoneOffsetMs(new Date(utcMs), timezone);
+    return utcMs;
+}
+function timeZoneOffsetMs(date, timezone) {
+    const parts = datePartsInTimeZone(date, timezone);
+    const asUtc = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+    return asUtc - date.getTime();
+}
+function datePartsInTimeZone(date, timezone) {
+    const formatter = new Intl.DateTimeFormat("en-CA", {
+        timeZone: timezone,
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        second: "2-digit",
+        hourCycle: "h23",
+    });
+    const entries = new Map(formatter.formatToParts(date).map((part) => [part.type, part.value]));
+    return {
+        year: Number(entries.get("year")),
+        month: Number(entries.get("month")),
+        day: Number(entries.get("day")),
+        hour: Number(entries.get("hour")),
+        minute: Number(entries.get("minute")),
+        second: Number(entries.get("second")),
+    };
+}
+function sandboxStatusFromState(state) {
+    const warning = sandboxEffectiveStateWarning(state);
+    return {
+        ...state,
+        detail: describeSandboxEffectiveState(state),
+        ...(warning === undefined ? {} : { warning }),
+    };
+}
 function reasonOf(error) {
     return error instanceof Error ? error.message : String(error);
 }