@moxt-ai/mobius 0.0.1

package/dist/cli.js

@@ -0,0 +1,1792 @@
+#!/usr/bin/env node
+
+// src/audit/audit-store.ts
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var AuditStore = class {
+  database;
+  constructor(path) {
+    mkdirSync(dirname(path), { recursive: true });
+    this.database = new DatabaseSync(path);
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS audit_events (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        recorded_at TEXT NOT NULL,
+        event TEXT NOT NULL,
+        command_id TEXT NOT NULL,
+        session_id TEXT NOT NULL
+      ) STRICT
+    `);
+  }
+  record(record) {
+    this.database.prepare(
+      `
+          INSERT INTO audit_events (
+            recorded_at,
+            event,
+            command_id,
+            session_id
+          ) VALUES (?, ?, ?, ?)
+        `
+    ).run(
+      (/* @__PURE__ */ new Date()).toISOString(),
+      record.event,
+      record.commandId,
+      record.sessionId
+    );
+  }
+  close() {
+    this.database.close();
+  }
+};
+
+// src/pairing/pair-local-machine.ts
+import { randomUUID } from "node:crypto";
+import {
+  mkdir,
+  open,
+  realpath,
+  rename,
+  stat,
+  writeFile
+} from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { basename, join, resolve } from "node:path";
+
+// src/config.ts
+import { fileURLToPath } from "node:url";
+var repositoryRoot = fileURLToPath(new URL("../../../", import.meta.url));
+function adapterEntrypoint(packageName) {
+  return fileURLToPath(new URL("./index.js", import.meta.resolve(packageName)));
+}
+var LocalAgentDefinition = class {
+  arguments;
+  command;
+  id;
+  label;
+  constructor(id, label, command, arguments_) {
+    this.id = id;
+    this.label = label;
+    this.command = command;
+    this.arguments = arguments_;
+  }
+};
+function loadLocalAgents() {
+  const overridePath = process.env["MOBIUS_ACP_AGENT_PATH"]?.trim();
+  if (overridePath !== void 0 && overridePath.length > 0) {
+    return [
+      new LocalAgentDefinition("codex", "Codex", process.execPath, [
+        overridePath,
+        "--agent-name",
+        "Codex"
+      ]),
+      new LocalAgentDefinition("claude", "Claude Code", process.execPath, [
+        overridePath,
+        "--agent-name",
+        "Claude Code"
+      ])
+    ];
+  }
+  return [
+    new LocalAgentDefinition("codex", "Codex", process.execPath, [
+      adapterEntrypoint("@agentclientprotocol/codex-acp")
+    ]),
+    new LocalAgentDefinition("claude", "Claude Code", process.execPath, [
+      adapterEntrypoint("@agentclientprotocol/claude-agent-acp")
+    ])
+  ];
+}
+function createDaemonConfig(connection) {
+  return {
+    agents: loadLocalAgents(),
+    approvedRoot: connection.approvedRoot,
+    auditDatabasePath: connection.auditDatabasePath,
+    bindingId: "workspace",
+    channelId: connection.channelId,
+    relayUrl: connection.relayUrl
+  };
+}
+function findLocalAgent(agents, agentId) {
+  for (const agent of agents) {
+    if (agent.id === agentId) {
+      return agent;
+    }
+  }
+  throw new Error("The requested local agent is not approved");
+}
+
+// src/pairing/pair-local-machine.ts
+var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
+var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
+var IDENTIFIER_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
+var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken"];
+var SAVED_CONNECTION_KEYS = [
+  "approvedRoot",
+  "channelId",
+  "daemonToken",
+  "relayOrigin"
+];
+var PairingClientError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "PairingClientError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, expectedKeys) {
+  const keys = Object.keys(value);
+  return keys.length === expectedKeys.length && expectedKeys.every((key) => Object.hasOwn(value, key));
+}
+function readSingleOption(arguments_, option) {
+  const values = [];
+  for (let index = 0; index < arguments_.length; index += 1) {
+    if (arguments_[index] !== option) {
+      continue;
+    }
+    const value = arguments_[index + 1];
+    if (value === void 0 || value.startsWith("--")) {
+      throw new PairingClientError(
+        "invalid_arguments",
+        `${option} requires a value`
+      );
+    }
+    values.push(value);
+    index += 1;
+  }
+  if (values.length !== 1) {
+    throw new PairingClientError(
+      "invalid_arguments",
+      `${option} must be provided exactly once`
+    );
+  }
+  return values[0] ?? "";
+}
+function assertKnownArguments(arguments_) {
+  for (let index = 0; index < arguments_.length; index += 2) {
+    const option = arguments_[index];
+    if (option !== "--url" && option !== "--code" && option !== "--root") {
+      throw new PairingClientError(
+        "invalid_arguments",
+        `Unknown pairing option: ${option ?? "missing option"}`
+      );
+    }
+  }
+}
+function parseRelayOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL is invalid",
+      { cause: error }
+    );
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL must use http or https"
+    );
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "The relay URL cannot contain credentials"
+    );
+  }
+  if (url.protocol === "http:" && url.hostname !== "127.0.0.1" && url.hostname !== "localhost") {
+    throw new PairingClientError(
+      "invalid_relay_url",
+      "A remote relay must use https"
+    );
+  }
+  url.hash = "";
+  url.pathname = "/";
+  url.search = "";
+  return url;
+}
+function parsePairingCode(value) {
+  const code = value.trim().toUpperCase();
+  if (!PAIRING_CODE_PATTERN.test(code)) {
+    throw new PairingClientError(
+      "invalid_pairing_code",
+      "The pairing code must match the code shown in the browser"
+    );
+  }
+  return code;
+}
+function parsePairCommand(arguments_) {
+  assertKnownArguments(arguments_);
+  return {
+    code: parsePairingCode(readSingleOption(arguments_, "--code")),
+    relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
+    root: readSingleOption(arguments_, "--root")
+  };
+}
+function parseChannelArgument(arguments_) {
+  if (arguments_.length !== 2 || arguments_[0] !== "--channel") {
+    throw new PairingClientError(
+      "invalid_arguments",
+      "Usage: mobius start --channel <channel-id>"
+    );
+  }
+  const channelId = arguments_[1] ?? "";
+  if (!IDENTIFIER_PATTERN.test(channelId)) {
+    throw new PairingClientError(
+      "invalid_channel_id",
+      "The saved channel ID is invalid"
+    );
+  }
+  return channelId;
+}
+async function resolveApprovedRoot(path) {
+  const requestedRoot = resolve(path);
+  try {
+    const approvedRoot = await realpath(requestedRoot);
+    const metadata = await stat(approvedRoot);
+    if (!metadata.isDirectory()) {
+      throw new PairingClientError(
+        "invalid_workspace",
+        "The approved workspace root is not a directory"
+      );
+    }
+    return approvedRoot;
+  } catch (error) {
+    if (error instanceof PairingClientError) {
+      throw error;
+    }
+    throw new PairingClientError(
+      "invalid_workspace",
+      "The approved workspace root cannot be resolved",
+      { cause: error }
+    );
+  }
+}
+async function readJsonResponse(response) {
+  if (response.headers.get("cf-mitigated") === "challenge") {
+    throw new PairingClientError(
+      "relay_challenge",
+      "Cloudflare is protecting this temporary preview. Claim the deployment or use an authenticated deployment, then pair again"
+    );
+  }
+  const encoded = await response.text();
+  try {
+    return JSON.parse(encoded);
+  } catch (error) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid response",
+      { cause: error }
+    );
+  }
+}
+function readRelayError(value) {
+  if (isRecord(value)) {
+    const error = value["error"];
+    if (isRecord(error)) {
+      const code = error["code"];
+      const message = error["message"];
+      if (typeof code === "string" && typeof message === "string") {
+        return new PairingClientError(code, message);
+      }
+    }
+  }
+  return new PairingClientError(
+    "pairing_failed",
+    "The relay could not pair this machine"
+  );
+}
+function decodeClaimResponse(value) {
+  if (!isRecord(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid pairing response"
+    );
+  }
+  const channelId = value["channelId"];
+  const daemonToken = value["daemonToken"];
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken)) {
+    throw new PairingClientError(
+      "invalid_relay_response",
+      "The relay returned an invalid pairing response"
+    );
+  }
+  return { channelId, daemonToken };
+}
+async function claimPairing(options, approvedRoot) {
+  const agents = loadLocalAgents().map((agent) => ({
+    id: agent.id,
+    label: agent.label
+  }));
+  const endpoint = new URL("/v1/pairings/claim", options.relayOrigin);
+  let response;
+  try {
+    response = await fetch(endpoint, {
+      body: JSON.stringify({
+        agents,
+        machineName: hostname(),
+        pairingCode: options.code,
+        workspaceName: basename(approvedRoot) || "Local workspace"
+      }),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+      signal: AbortSignal.timeout(PAIRING_TIMEOUT_MILLISECONDS)
+    });
+  } catch (error) {
+    throw new PairingClientError(
+      "relay_unavailable",
+      "The pairing relay could not be reached",
+      { cause: error }
+    );
+  }
+  const value = await readJsonResponse(response);
+  if (!response.ok) {
+    throw readRelayError(value);
+  }
+  return decodeClaimResponse(value);
+}
+function readStateDirectory() {
+  const configured = process.env["MOBIUS_STATE_DIRECTORY"]?.trim();
+  if (configured !== void 0 && configured.length > 0) {
+    return resolve(configured);
+  }
+  return join(homedir(), ".mobius");
+}
+async function persistConnection(channelId, relayOrigin, daemonToken, approvedRoot) {
+  const connectionsDirectory = join(readStateDirectory(), "connections");
+  await mkdir(connectionsDirectory, { mode: 448, recursive: true });
+  const connectionPath = join(connectionsDirectory, `${channelId}.json`);
+  const temporaryPath = join(
+    connectionsDirectory,
+    `.${channelId}.${randomUUID()}.tmp`
+  );
+  await writeFile(
+    temporaryPath,
+    `${JSON.stringify(
+      {
+        approvedRoot,
+        channelId,
+        daemonToken,
+        relayOrigin: relayOrigin.toString()
+      },
+      null,
+      2
+    )}
+`,
+    { flag: "wx", mode: 384 }
+  );
+  await rename(temporaryPath, connectionPath);
+  return connectionPath;
+}
+function decodeSavedConnection(value, expectedChannelId) {
+  if (!isRecord(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid"
+    );
+  }
+  const approvedRoot = value["approvedRoot"];
+  const channelId = value["channelId"];
+  const daemonToken = value["daemonToken"];
+  const relayOrigin = value["relayOrigin"];
+  if (typeof approvedRoot !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid"
+    );
+  }
+  return {
+    approvedRoot,
+    channelId,
+    daemonToken,
+    relayOrigin: parseRelayOrigin(relayOrigin)
+  };
+}
+async function readSavedConnection(channelId) {
+  const connectionPath = join(
+    readStateDirectory(),
+    "connections",
+    `${channelId}.json`
+  );
+  let encoded = "";
+  const handle = await open(connectionPath, "r");
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile() || metadata.size > MAX_CONNECTION_FILE_LENGTH) {
+      throw new PairingClientError(
+        "invalid_connection",
+        "The saved connection is invalid"
+      );
+    }
+    encoded = await handle.readFile({ encoding: "utf8" });
+  } finally {
+    await handle.close();
+  }
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (error) {
+    throw new PairingClientError(
+      "invalid_connection",
+      "The saved connection is invalid",
+      { cause: error }
+    );
+  }
+  const connection = decodeSavedConnection(value, channelId);
+  return {
+    approvedRoot: await resolveApprovedRoot(connection.approvedRoot),
+    channelId: connection.channelId,
+    daemonToken: connection.daemonToken,
+    relayOrigin: connection.relayOrigin
+  };
+}
+function buildPairedDaemon(connection, connectionPath) {
+  const relayUrl = new URL(
+    `/v1/channels/${encodeURIComponent(connection.channelId)}/daemon`,
+    connection.relayOrigin
+  );
+  relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
+  relayUrl.searchParams.set("token", connection.daemonToken);
+  const auditDatabasePath = join(
+    readStateDirectory(),
+    "audit",
+    `${connection.channelId}.sqlite`
+  );
+  return {
+    channelUrl: new URL(
+      `/channels/${encodeURIComponent(connection.channelId)}`,
+      connection.relayOrigin
+    ).toString(),
+    config: createDaemonConfig({
+      approvedRoot: connection.approvedRoot,
+      auditDatabasePath,
+      channelId: connection.channelId,
+      relayUrl
+    }),
+    connectionPath
+  };
+}
+async function pairLocalMachine(arguments_) {
+  const options = parsePairCommand(arguments_);
+  const approvedRoot = await resolveApprovedRoot(options.root);
+  const claim = await claimPairing(options, approvedRoot);
+  const connectionPath = await persistConnection(
+    claim.channelId,
+    options.relayOrigin,
+    claim.daemonToken,
+    approvedRoot
+  );
+  return buildPairedDaemon(
+    {
+      approvedRoot,
+      channelId: claim.channelId,
+      daemonToken: claim.daemonToken,
+      relayOrigin: options.relayOrigin
+    },
+    connectionPath
+  );
+}
+async function resumeLocalMachine(arguments_) {
+  const channelId = parseChannelArgument(arguments_);
+  const connectionPath = join(
+    readStateDirectory(),
+    "connections",
+    `${channelId}.json`
+  );
+  return buildPairedDaemon(
+    await readSavedConnection(channelId),
+    connectionPath
+  );
+}
+
+// src/run-daemon.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// ../protocol/src/messages.ts
+var SESSION_PROMPT_KIND = "session.prompt";
+var SESSION_CANCEL_KIND = "session.cancel";
+var SESSION_STARTED_KIND = "session.started";
+var AGENT_MESSAGE_DELTA_KIND = "agent.message.delta";
+var AGENT_ACTIVITY_KIND = "agent.activity";
+var AGENT_ACTIVITY_DETAIL_LIMIT = 24e3;
+var AGENT_ACTIVITY_LOCATION_LIMIT = 12;
+var AGENT_ACTIVITY_LOCATION_LENGTH_LIMIT = 1024;
+var SESSION_COMPLETED_KIND = "session.completed";
+var SESSION_FAILED_KIND = "session.failed";
+
+// ../protocol/src/version.ts
+var MOBIUS_PROTOCOL_VERSION = 1;
+
+// ../protocol/src/codecs/messages.ts
+var IDENTIFIER_PATTERN2 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var MAX_PROMPT_LENGTH = 1e4;
+var ProtocolMessageError = class extends Error {
+  code = "invalid_protocol_message";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "ProtocolMessageError";
+  }
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJson(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (error) {
+    throw new ProtocolMessageError("Message is not valid JSON", {
+      cause: error
+    });
+  }
+  if (!isRecord2(value)) {
+    throw new ProtocolMessageError("Message must be a JSON object");
+  }
+  return value;
+}
+function assertExactKeys(value, allowedKeys) {
+  for (const key of Object.keys(value)) {
+    if (!allowedKeys.includes(key)) {
+      throw new ProtocolMessageError(`Unexpected message field: ${key}`);
+    }
+  }
+}
+function readString(value, key, maximumLength) {
+  const field = value[key];
+  if (typeof field !== "string" || field.length === 0 || field.length > maximumLength) {
+    throw new ProtocolMessageError(`Invalid string field: ${key}`);
+  }
+  return field;
+}
+function readIdentifier(value, key) {
+  const field = readString(value, key, 128);
+  if (!IDENTIFIER_PATTERN2.test(field)) {
+    throw new ProtocolMessageError(`Invalid identifier field: ${key}`);
+  }
+  return field;
+}
+function assertProtocolVersion(value) {
+  if (value["protocolVersion"] !== MOBIUS_PROTOCOL_VERSION) {
+    throw new ProtocolMessageError("Unsupported protocol version");
+  }
+}
+function assertKind(value, expectedKind) {
+  if (value["kind"] !== expectedKind) {
+    throw new ProtocolMessageError(`Expected message kind: ${expectedKind}`);
+  }
+}
+function decodeMessageKind(encoded) {
+  return readString(parseJson(encoded), "kind", 64);
+}
+function decodeSessionPromptCommand(encoded) {
+  const value = parseJson(encoded);
+  assertExactKeys(value, [
+    "agentId",
+    "bindingId",
+    "commandId",
+    "kind",
+    "prompt",
+    "protocolVersion",
+    "sessionId"
+  ]);
+  assertProtocolVersion(value);
+  assertKind(value, SESSION_PROMPT_KIND);
+  const prompt = readString(value, "prompt", MAX_PROMPT_LENGTH);
+  if (prompt.trim().length === 0) {
+    throw new ProtocolMessageError("Prompt must contain visible text");
+  }
+  return {
+    agentId: readIdentifier(value, "agentId"),
+    bindingId: readIdentifier(value, "bindingId"),
+    commandId: readIdentifier(value, "commandId"),
+    kind: SESSION_PROMPT_KIND,
+    prompt,
+    protocolVersion: MOBIUS_PROTOCOL_VERSION,
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
+function decodeSessionCancelCommand(encoded) {
+  const value = parseJson(encoded);
+  assertExactKeys(value, ["commandId", "kind", "protocolVersion", "sessionId"]);
+  assertProtocolVersion(value);
+  assertKind(value, SESSION_CANCEL_KIND);
+  return {
+    commandId: readIdentifier(value, "commandId"),
+    kind: SESSION_CANCEL_KIND,
+    protocolVersion: MOBIUS_PROTOCOL_VERSION,
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
+function encodeSessionStartedEvent(message) {
+  return JSON.stringify(message);
+}
+function encodeAgentMessageDeltaEvent(message) {
+  return JSON.stringify(message);
+}
+function encodeAgentActivityEvent(message) {
+  return JSON.stringify(message);
+}
+function encodeSessionCompletedEvent(message) {
+  return JSON.stringify(message);
+}
+function encodeSessionFailedEvent(message) {
+  return JSON.stringify(message);
+}
+
+// src/acp/session-manager.ts
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import {
+  methods,
+  ndJsonStream,
+  PROTOCOL_VERSION
+} from "@agentclientprotocol/sdk";
+
+// src/acp/activity.ts
+var TRUNCATION_MARKER = "\n\u2026 output truncated by Mobius";
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var AcpActivity = class _AcpActivity {
+  activityId;
+  activityType;
+  input;
+  locations;
+  name;
+  output;
+  sequence;
+  status;
+  title;
+  toolKind;
+  constructor(activityId, activityType, input, locations, name, output, sequence, status, title, toolKind) {
+    this.activityId = activityId;
+    this.activityType = activityType;
+    this.input = input;
+    this.locations = locations;
+    this.name = name;
+    this.output = output;
+    this.sequence = sequence;
+    this.status = status;
+    this.title = title;
+    this.toolKind = toolKind;
+  }
+  complete = () => (this.activityType === "progress" || this.activityType === "reasoning") && (this.status === "pending" || this.status === "running") ? new _AcpActivity(
+    this.activityId,
+    this.activityType,
+    this.input,
+    this.locations,
+    this.name,
+    this.output,
+    this.sequence,
+    "completed",
+    this.title,
+    this.toolKind
+  ) : this;
+};
+var ActivityIdentity = class {
+  id;
+  sequence;
+  constructor(id, sequence) {
+    this.id = id;
+    this.sequence = sequence;
+  }
+};
+function truncate(value, maximumLength) {
+  if (value.length <= maximumLength) {
+    return value;
+  }
+  return `${value.slice(0, maximumLength - TRUNCATION_MARKER.length)}${TRUNCATION_MARKER}`;
+}
+function formatUnknown(value) {
+  if (typeof value === "string") {
+    return truncate(value, AGENT_ACTIVITY_DETAIL_LIMIT);
+  }
+  try {
+    const encoded = JSON.stringify(value, null, 2);
+    return truncate(encoded ?? "", AGENT_ACTIVITY_DETAIL_LIMIT);
+  } catch {
+    return truncate(String(value), AGENT_ACTIVITY_DETAIL_LIMIT);
+  }
+}
+function readContentOutput(content) {
+  if (!Array.isArray(content) || content.length === 0) {
+    return "";
+  }
+  return formatUnknown(content);
+}
+function normalizeLocations(locations) {
+  const normalized = [];
+  const unique = /* @__PURE__ */ new Set();
+  for (const location of locations) {
+    if (normalized.length === AGENT_ACTIVITY_LOCATION_LIMIT) {
+      break;
+    }
+    const suffix = typeof location.line === "number" ? `:${location.line.toString()}` : "";
+    const value = truncate(
+      `${location.path}${suffix}`,
+      AGENT_ACTIVITY_LOCATION_LENGTH_LIMIT
+    );
+    if (value.length > 0 && !unique.has(value)) {
+      unique.add(value);
+      normalized.push(value);
+    }
+  }
+  return normalized;
+}
+function normalizeToolStatus(status, fallback) {
+  if (status === "pending") {
+    return "pending";
+  }
+  if (status === "in_progress") {
+    return "running";
+  }
+  if (status === "completed" || status === "failed") {
+    return status;
+  }
+  return fallback;
+}
+function normalizeTitle(title, fallback) {
+  const normalized = title.trim();
+  return truncate(normalized.length === 0 ? fallback : normalized, 500);
+}
+function formatPlanEntries(entries) {
+  const lines = [];
+  for (const entry of entries) {
+    lines.push(`[${entry.status}] ${entry.content}`);
+  }
+  return truncate(lines.join("\n"), AGENT_ACTIVITY_DETAIL_LIMIT);
+}
+function planStatus(entries) {
+  if (entries.length === 0) {
+    return "completed";
+  }
+  if (entries.every((entry) => entry.status === "completed")) {
+    return "completed";
+  }
+  if (entries.some((entry) => entry.status === "in_progress")) {
+    return "running";
+  }
+  return "pending";
+}
+function contentPhase(content) {
+  const metadata = content._meta;
+  if (metadata === void 0 || metadata === null) {
+    return "";
+  }
+  const codex = metadata["codex"];
+  if (!isRecord3(codex)) {
+    return "";
+  }
+  const phase = codex["phase"];
+  return typeof phase === "string" ? phase : "";
+}
+function isProgressMessage(content) {
+  return contentPhase(content) === "commentary";
+}
+var AcpActivityTracker = class {
+  #activities = /* @__PURE__ */ new Map();
+  #identities = /* @__PURE__ */ new Map();
+  #onActivity;
+  #activeNarrativeKey = "";
+  #nextSequence = 0;
+  constructor(onActivity) {
+    this.#onActivity = onActivity;
+  }
+  recordNarrative = async (activityType, messageId, text) => {
+    const key = `${activityType}:${messageId}`;
+    if (this.#activeNarrativeKey !== key) {
+      await this.finishNarrative();
+    }
+    const previous = this.#activities.get(key);
+    const identity = this.#identity(key);
+    const activity = new AcpActivity(
+      identity.id,
+      activityType,
+      "",
+      [],
+      "",
+      truncate(`${previous?.output ?? ""}${text}`, AGENT_ACTIVITY_DETAIL_LIMIT),
+      identity.sequence,
+      "running",
+      activityType === "reasoning" ? "Reasoning" : "Progress update",
+      activityType === "reasoning" ? "think" : ""
+    );
+    await this.#record(key, activity);
+    this.#activeNarrativeKey = key;
+  };
+  recordPlan = async (plan) => {
+    await this.finishNarrative();
+    await this.#recordPlanEntries("plan:default", plan.entries);
+  };
+  recordPlanUpdate = async (update) => {
+    await this.finishNarrative();
+    const plan = update.plan;
+    const key = `plan:${plan.planId}`;
+    if (plan.type === "items") {
+      await this.#recordPlanEntries(key, plan.entries);
+      return;
+    }
+    const identity = this.#identity(key);
+    const output = plan.type === "markdown" ? plan.content : `Plan file: ${plan.uri}`;
+    await this.#record(
+      key,
+      new AcpActivity(
+        identity.id,
+        "plan",
+        "",
+        [],
+        "",
+        truncate(output, AGENT_ACTIVITY_DETAIL_LIMIT),
+        identity.sequence,
+        "running",
+        "Plan",
+        ""
+      )
+    );
+  };
+  removePlan = async (update) => {
+    await this.finishNarrative();
+    const key = `plan:${update.planId}`;
+    const previous = this.#activities.get(key);
+    if (previous !== void 0) {
+      await this.#record(
+        key,
+        new AcpActivity(
+          previous.activityId,
+          previous.activityType,
+          previous.input,
+          previous.locations,
+          previous.name,
+          previous.output,
+          previous.sequence,
+          "completed",
+          previous.title,
+          previous.toolKind
+        )
+      );
+    }
+  };
+  recordToolCall = async (update) => {
+    await this.finishNarrative();
+    const key = `tool:${update.toolCallId}`;
+    const identity = this.#identity(key);
+    const output = update.rawOutput === void 0 ? readContentOutput(update.content) : formatUnknown(update.rawOutput);
+    await this.#record(
+      key,
+      new AcpActivity(
+        identity.id,
+        "tool",
+        update.rawInput === void 0 ? "" : formatUnknown(update.rawInput),
+        normalizeLocations(update.locations ?? []),
+        truncate(update.name ?? "", 128),
+        output,
+        identity.sequence,
+        normalizeToolStatus(update.status ?? "pending", "pending"),
+        normalizeTitle(update.title, "Tool call"),
+        update.kind ?? "other"
+      )
+    );
+  };
+  recordToolCallUpdate = async (update) => {
+    await this.finishNarrative();
+    const key = `tool:${update.toolCallId}`;
+    const previous = this.#activities.get(key);
+    const identity = this.#identity(key);
+    const output = update.rawOutput !== void 0 ? formatUnknown(update.rawOutput) : update.content !== void 0 && update.content !== null ? readContentOutput(update.content) : previous?.output ?? "";
+    await this.#record(
+      key,
+      new AcpActivity(
+        identity.id,
+        "tool",
+        update.rawInput === void 0 ? previous?.input ?? "" : formatUnknown(update.rawInput),
+        update.locations === void 0 || update.locations === null ? previous?.locations ?? [] : normalizeLocations(update.locations),
+        update.name === void 0 || update.name === null ? previous?.name ?? "" : truncate(update.name, 128),
+        output,
+        identity.sequence,
+        update.status === void 0 || update.status === null ? previous?.status ?? "pending" : normalizeToolStatus(update.status, previous?.status ?? "pending"),
+        update.title === void 0 || update.title === null ? previous?.title ?? "Tool call" : normalizeTitle(update.title, "Tool call"),
+        update.kind === void 0 || update.kind === null ? previous?.toolKind ?? "other" : update.kind
+      )
+    );
+  };
+  finishNarrative = async () => {
+    const key = this.#activeNarrativeKey;
+    if (key.length === 0) {
+      return;
+    }
+    this.#activeNarrativeKey = "";
+    const activity = this.#activities.get(key);
+    if (activity === void 0) {
+      return;
+    }
+    const completed = activity.complete();
+    if (completed !== activity) {
+      await this.#record(key, completed);
+    }
+  };
+  finish = async () => {
+    await this.finishNarrative();
+    const entries = [...this.#activities.entries()].sort(
+      (left, right) => left[1].sequence - right[1].sequence
+    );
+    for (const [key, activity] of entries) {
+      const completed = activity.complete();
+      if (completed !== activity) {
+        await this.#record(key, completed);
+      }
+    }
+  };
+  #identity = (key) => {
+    const existing = this.#identities.get(key);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const identity = new ActivityIdentity(
+      `activity-${crypto.randomUUID()}`,
+      this.#nextSequence
+    );
+    this.#nextSequence += 1;
+    this.#identities.set(key, identity);
+    return identity;
+  };
+  #record = async (key, activity) => {
+    this.#activities.set(key, activity);
+    await this.#onActivity(activity);
+  };
+  #recordPlanEntries = async (key, entries) => {
+    const identity = this.#identity(key);
+    await this.#record(
+      key,
+      new AcpActivity(
+        identity.id,
+        "plan",
+        "",
+        [],
+        "",
+        formatPlanEntries(entries),
+        identity.sequence,
+        planStatus(entries),
+        "Plan",
+        ""
+      )
+    );
+  };
+};
+
+// src/acp/create-client.ts
+import { client } from "@agentclientprotocol/sdk";
+var createAcpClient = () => client({ name: "mobius" });
+
+// src/acp/session-manager.ts
+var PROCESS_STOP_TIMEOUT_MILLISECONDS = 1e3;
+var AcpExecutionError = class extends Error {
+  code = "acp_execution_failed";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "AcpExecutionError";
+  }
+};
+function readableWebStream(input) {
+  let streamOpen = true;
+  return new ReadableStream({
+    start(controller) {
+      input.on("data", (chunk) => {
+        if (!streamOpen) {
+          return;
+        }
+        if (chunk instanceof Uint8Array) {
+          controller.enqueue(new Uint8Array(chunk));
+          return;
+        }
+        streamOpen = false;
+        controller.error(new Error("ACP process produced a non-binary chunk"));
+      });
+      input.once("end", () => {
+        if (!streamOpen) {
+          return;
+        }
+        streamOpen = false;
+        controller.close();
+      });
+      input.once("error", (error) => {
+        if (!streamOpen) {
+          return;
+        }
+        streamOpen = false;
+        controller.error(error);
+      });
+    },
+    cancel() {
+      streamOpen = false;
+    }
+  });
+}
+function writableWebStream(output) {
+  return new WritableStream({
+    write(chunk) {
+      return new Promise((resolve2, reject) => {
+        output.write(chunk, (error) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+          resolve2();
+        });
+      });
+    }
+  });
+}
+async function stopAgentProcess(child) {
+  child.stdin?.end();
+  if (child.exitCode !== null) {
+    return;
+  }
+  child.kill("SIGTERM");
+  try {
+    await once(child, "exit", {
+      signal: AbortSignal.timeout(PROCESS_STOP_TIMEOUT_MILLISECONDS)
+    });
+  } catch {
+    if (child.exitCode === null) {
+      child.kill("SIGKILL");
+      await once(child, "exit");
+    }
+  }
+}
+function rejectWhenAborted(signal) {
+  return new Promise((_resolve, reject) => {
+    const rejectAbort = () => {
+      reject(signal.reason ?? new Error("ACP request was cancelled"));
+    };
+    signal.addEventListener("abort", rejectAbort, { once: true });
+    if (signal.aborted) {
+      rejectAbort();
+    }
+  });
+}
+var AcpProcessSession = class _AcpProcessSession {
+  #agentId;
+  #child;
+  #connection;
+  #processExit;
+  #session;
+  #turnRunning = false;
+  constructor(agentId, child, connection, session, processExit) {
+    this.#agentId = agentId;
+    this.#child = child;
+    this.#connection = connection;
+    this.#session = session;
+    this.#processExit = processExit;
+  }
+  static async start(agent, cwd, signal) {
+    signal.throwIfAborted();
+    const child = spawn(agent.command, [...agent.arguments], {
+      cwd,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      process.stderr.write(`[${agent.id}-acp] ${chunk}`);
+    });
+    const processExit = new Promise((resolve2) => {
+      child.once("error", resolve2);
+      child.once("exit", resolve2);
+    });
+    const stream = ndJsonStream(
+      writableWebStream(child.stdin),
+      readableWebStream(child.stdout)
+    );
+    const connection = createAcpClient().connect(stream);
+    try {
+      await Promise.race([
+        connection.agent.request(
+          methods.agent.initialize,
+          {
+            clientCapabilities: {},
+            protocolVersion: PROTOCOL_VERSION
+          },
+          { cancellationSignal: signal }
+        ),
+        processExit.then(() => {
+          throw new AcpExecutionError("ACP agent exited during initialization");
+        }),
+        rejectWhenAborted(signal)
+      ]);
+      const session = await Promise.race([
+        connection.agent.buildSession(cwd).start({ cancellationSignal: signal }),
+        processExit.then(() => {
+          throw new AcpExecutionError(
+            "ACP agent exited while starting a session"
+          );
+        }),
+        rejectWhenAborted(signal)
+      ]);
+      return new _AcpProcessSession(
+        agent.id,
+        child,
+        connection,
+        session,
+        processExit
+      );
+    } catch (error) {
+      connection.close(error);
+      await stopAgentProcess(child);
+      throw new AcpExecutionError("ACP agent initialization failed", {
+        cause: error
+      });
+    }
+  }
+  belongsTo = (agentId) => this.#agentId === agentId;
+  cancel = async () => {
+    if (!this.#turnRunning) {
+      return;
+    }
+    await this.#connection.agent.notify(methods.agent.session.cancel, {
+      sessionId: this.#session.sessionId
+    });
+  };
+  prompt = async (prompt, onActivity, onText, signal) => {
+    if (this.#turnRunning) {
+      throw new AcpExecutionError(
+        "Another prompt is already running in this conversation"
+      );
+    }
+    this.#turnRunning = true;
+    const activities = new AcpActivityTracker(onActivity);
+    const runTurn = async () => {
+      const completion = this.#session.prompt(prompt, {
+        cancellationSignal: signal
+      });
+      for (; ; ) {
+        const message = await this.#session.nextUpdate();
+        if (message.kind === "stop") {
+          await completion;
+          await activities.finish();
+          return { stopReason: message.stopReason };
+        }
+        const update = message.update;
+        if (update.sessionUpdate === "agent_message_chunk") {
+          if (update.content.type === "text") {
+            if (isProgressMessage(update)) {
+              await activities.recordNarrative(
+                "progress",
+                update.messageId ?? "current",
+                update.content.text
+              );
+            } else {
+              await activities.finishNarrative();
+              await onText(update.content.text);
+            }
+          }
+          continue;
+        }
+        if (update.sessionUpdate === "agent_thought_chunk") {
+          if (update.content.type === "text") {
+            await activities.recordNarrative(
+              "reasoning",
+              update.messageId ?? "current",
+              update.content.text
+            );
+          }
+          continue;
+        }
+        if (update.sessionUpdate === "tool_call") {
+          await activities.recordToolCall(update);
+          continue;
+        }
+        if (update.sessionUpdate === "tool_call_update") {
+          await activities.recordToolCallUpdate(update);
+          continue;
+        }
+        if (update.sessionUpdate === "plan") {
+          await activities.recordPlan(update);
+          continue;
+        }
+        if (update.sessionUpdate === "plan_update") {
+          await activities.recordPlanUpdate(update);
+          continue;
+        }
+        if (update.sessionUpdate === "plan_removed") {
+          await activities.removePlan(update);
+        }
+      }
+    };
+    try {
+      return await Promise.race([
+        runTurn(),
+        this.#processExit.then(() => {
+          throw new AcpExecutionError("ACP agent exited during a prompt");
+        }),
+        rejectWhenAborted(signal)
+      ]);
+    } catch (error) {
+      await activities.finish();
+      throw new AcpExecutionError("ACP agent execution failed", {
+        cause: error
+      });
+    } finally {
+      this.#turnRunning = false;
+    }
+  };
+  close = async () => {
+    this.#session.dispose();
+    this.#connection.close();
+    await stopAgentProcess(this.#child);
+  };
+};
+var AcpSessionManager = class {
+  #activeSessionIds = /* @__PURE__ */ new Set();
+  #cancellationRequests = /* @__PURE__ */ new Set();
+  #sessions = /* @__PURE__ */ new Map();
+  cancelPrompt = async (sessionId) => {
+    this.#cancellationRequests.add(sessionId);
+    const runtime = this.#sessions.get(sessionId);
+    if (runtime !== void 0) {
+      await runtime.cancel();
+    }
+  };
+  runPrompt = async (options) => {
+    if (this.#activeSessionIds.has(options.sessionId)) {
+      throw new AcpExecutionError(
+        "Another prompt is already running in this conversation"
+      );
+    }
+    this.#activeSessionIds.add(options.sessionId);
+    let runtime = this.#sessions.get(options.sessionId);
+    if (runtime !== void 0 && !runtime.belongsTo(options.agent.id)) {
+      this.#activeSessionIds.delete(options.sessionId);
+      throw new AcpExecutionError(
+        "The agent cannot change after a conversation has started"
+      );
+    }
+    try {
+      if (this.#cancellationRequests.has(options.sessionId)) {
+        return { stopReason: "cancelled" };
+      }
+      if (runtime === void 0) {
+        runtime = await AcpProcessSession.start(
+          options.agent,
+          options.cwd,
+          options.signal
+        );
+        this.#sessions.set(options.sessionId, runtime);
+      }
+      if (this.#cancellationRequests.has(options.sessionId)) {
+        return { stopReason: "cancelled" };
+      }
+      return await runtime.prompt(
+        options.prompt,
+        options.onActivity,
+        options.onText,
+        options.signal
+      );
+    } catch (error) {
+      if (runtime !== void 0) {
+        this.#sessions.delete(options.sessionId);
+        await runtime.close();
+      }
+      if (error instanceof AcpExecutionError) {
+        throw error;
+      }
+      throw new AcpExecutionError("ACP agent execution failed", {
+        cause: error
+      });
+    } finally {
+      this.#activeSessionIds.delete(options.sessionId);
+      this.#cancellationRequests.delete(options.sessionId);
+    }
+  };
+  close = async () => {
+    const sessions = [...this.#sessions.values()];
+    this.#sessions.clear();
+    await Promise.all(sessions.map(async (session) => await session.close()));
+  };
+};
+
+// src/authorization/authorize-binding.ts
+import { realpath as realpath2, stat as stat2 } from "node:fs/promises";
+var LocalAuthorizationError = class extends Error {
+  code = "local_authorization_failed";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "LocalAuthorizationError";
+  }
+};
+async function authorizeBinding(requestedBindingId, approvedBindingId, approvedRoot) {
+  if (requestedBindingId !== approvedBindingId) {
+    throw new LocalAuthorizationError("The runtime binding is not authorized");
+  }
+  try {
+    const resolvedRoot = await realpath2(approvedRoot);
+    const metadata = await stat2(resolvedRoot);
+    if (!metadata.isDirectory()) {
+      throw new LocalAuthorizationError("The approved root is not a directory");
+    }
+    return resolvedRoot;
+  } catch (error) {
+    if (error instanceof LocalAuthorizationError) {
+      throw error;
+    }
+    throw new LocalAuthorizationError("The approved root cannot be resolved", {
+      cause: error
+    });
+  }
+}
+
+// src/relay-connection/connect.ts
+var CONNECTION_TIMEOUT_MILLISECONDS = 15e3;
+var RelayConnectionError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "RelayConnectionError";
+  }
+};
+function connectRelay(url, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve2, reject) => {
+    const socket = new WebSocket(url);
+    let finished = false;
+    const timeout = setTimeout(onTimeout, CONNECTION_TIMEOUT_MILLISECONDS);
+    const cleanup = () => {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", onAbort);
+      socket.removeEventListener("close", onClose);
+      socket.removeEventListener("error", onError);
+      socket.removeEventListener("open", onOpen);
+    };
+    const fail = (error) => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      cleanup();
+      socket.close();
+      reject(error);
+    };
+    const onAbort = () => {
+      fail(
+        new RelayConnectionError(
+          "relay_connection_cancelled",
+          "Relay connection was cancelled",
+          { cause: signal.reason }
+        )
+      );
+    };
+    const onClose = () => {
+      fail(
+        new RelayConnectionError(
+          "relay_connection_closed",
+          "Relay connection closed before it was ready"
+        )
+      );
+    };
+    const onError = () => {
+      fail(
+        new RelayConnectionError(
+          "relay_connection_failed",
+          "Relay connection failed"
+        )
+      );
+    };
+    const onOpen = () => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      cleanup();
+      resolve2(socket);
+    };
+    function onTimeout() {
+      fail(
+        new RelayConnectionError(
+          "relay_connection_timeout",
+          "Relay connection timed out"
+        )
+      );
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+    socket.addEventListener("close", onClose, { once: true });
+    socket.addEventListener("error", onError, { once: true });
+    socket.addEventListener("open", onOpen, { once: true });
+    if (signal.aborted) {
+      onAbort();
+    }
+  });
+}
+
+// src/run-daemon.ts
+var RELAY_RECONNECT_DELAY_MILLISECONDS = 500;
+var ActiveDaemonTurn = class {
+  command;
+  #connectionController;
+  #cancellationRequested = false;
+  constructor(command, connectionController) {
+    this.command = command;
+    this.#connectionController = connectionController;
+  }
+  abortConnection = () => {
+    this.#connectionController.abort();
+  };
+  matches = (cancellation) => cancellation.commandId === this.command.commandId && cancellation.sessionId === this.command.sessionId;
+  requestCancellation = () => {
+    if (this.#cancellationRequested) {
+      return false;
+    }
+    this.#cancellationRequested = true;
+    return true;
+  };
+  get signal() {
+    return this.#connectionController.signal;
+  }
+};
+function send(socket, message) {
+  if (socket.readyState !== WebSocket.OPEN) {
+    throw new Error("Relay connection is not open");
+  }
+  socket.send(message);
+}
+function reportFailure(socket, command, code, message) {
+  if (socket.readyState !== WebSocket.OPEN) {
+    return;
+  }
+  send(
+    socket,
+    encodeSessionFailedEvent({
+      code,
+      commandId: command.commandId,
+      kind: SESSION_FAILED_KIND,
+      message,
+      protocolVersion: MOBIUS_PROTOCOL_VERSION,
+      sessionId: command.sessionId
+    })
+  );
+}
+async function executePrompt(socket, command, config, audit, sessions, signal) {
+  try {
+    const approvedRoot = await authorizeBinding(
+      command.bindingId,
+      config.bindingId,
+      config.approvedRoot
+    );
+    const agent = findLocalAgent(config.agents, command.agentId);
+    const processAttemptId = randomUUID2();
+    audit.record({
+      commandId: command.commandId,
+      event: "session_authorized",
+      sessionId: command.sessionId
+    });
+    send(
+      socket,
+      encodeSessionStartedEvent({
+        commandId: command.commandId,
+        kind: SESSION_STARTED_KIND,
+        processAttemptId,
+        protocolVersion: MOBIUS_PROTOCOL_VERSION,
+        sessionId: command.sessionId
+      })
+    );
+    const result = await sessions.runPrompt({
+      agent,
+      cwd: approvedRoot,
+      onActivity: (activity) => {
+        send(
+          socket,
+          encodeAgentActivityEvent({
+            activityId: activity.activityId,
+            activityType: activity.activityType,
+            commandId: command.commandId,
+            input: activity.input,
+            kind: AGENT_ACTIVITY_KIND,
+            locations: activity.locations,
+            name: activity.name,
+            output: activity.output,
+            protocolVersion: MOBIUS_PROTOCOL_VERSION,
+            sequence: activity.sequence,
+            sessionId: command.sessionId,
+            status: activity.status,
+            title: activity.title,
+            toolKind: activity.toolKind
+          })
+        );
+        return Promise.resolve();
+      },
+      onText: (text) => {
+        send(
+          socket,
+          encodeAgentMessageDeltaEvent({
+            commandId: command.commandId,
+            kind: AGENT_MESSAGE_DELTA_KIND,
+            protocolVersion: MOBIUS_PROTOCOL_VERSION,
+            sessionId: command.sessionId,
+            text
+          })
+        );
+        return Promise.resolve();
+      },
+      prompt: command.prompt,
+      sessionId: command.sessionId,
+      signal
+    });
+    send(
+      socket,
+      encodeSessionCompletedEvent({
+        commandId: command.commandId,
+        kind: SESSION_COMPLETED_KIND,
+        protocolVersion: MOBIUS_PROTOCOL_VERSION,
+        sessionId: command.sessionId,
+        stopReason: result.stopReason
+      })
+    );
+    audit.record({
+      commandId: command.commandId,
+      event: result.stopReason === "cancelled" ? "session_cancelled" : "session_completed",
+      sessionId: command.sessionId
+    });
+  } catch (error) {
+    audit.record({
+      commandId: command.commandId,
+      event: "session_failed",
+      sessionId: command.sessionId
+    });
+    reportFailure(
+      socket,
+      command,
+      "agent_execution_failed",
+      "The local agent could not complete the request"
+    );
+    console.error("Mobius daemon command failed", error);
+  }
+}
+function waitForRelayRetry(signal) {
+  if (signal.aborted) {
+    return Promise.resolve();
+  }
+  return new Promise((resolve2) => {
+    const timeout = setTimeout(finish, RELAY_RECONNECT_DELAY_MILLISECONDS);
+    function finish() {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", finish);
+      resolve2();
+    }
+    signal.addEventListener("abort", finish, { once: true });
+  });
+}
+async function runRelayConnection(config, audit, sessions, signal) {
+  const socket = await connectRelay(config.relayUrl, signal);
+  const activeTurns = /* @__PURE__ */ new Map();
+  await new Promise((resolve2, reject) => {
+    let finished = false;
+    const cleanup = () => {
+      signal.removeEventListener("abort", stop);
+      socket.removeEventListener("close", handleClose);
+      socket.removeEventListener("error", handleError);
+      socket.removeEventListener("message", handleMessage);
+      for (const turn of activeTurns.values()) {
+        turn.abortConnection();
+      }
+      activeTurns.clear();
+    };
+    const resolveConnection = () => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      cleanup();
+      resolve2();
+    };
+    const rejectConnection = () => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      cleanup();
+      reject(new Error("Relay WebSocket failed"));
+    };
+    const stop = () => {
+      socket.close(1e3, "Daemon stopped");
+      resolveConnection();
+    };
+    signal.addEventListener("abort", stop, { once: true });
+    const handleClose = () => {
+      resolveConnection();
+    };
+    const handleError = () => {
+      if (signal.aborted) {
+        resolveConnection();
+        return;
+      }
+      rejectConnection();
+    };
+    const handleMessage = (event) => {
+      const encoded = event.data;
+      if (typeof encoded !== "string") {
+        socket.close(1003, "Text message required");
+        return;
+      }
+      try {
+        const kind = decodeMessageKind(encoded);
+        if (kind === SESSION_CANCEL_KIND) {
+          const cancellation = decodeSessionCancelCommand(encoded);
+          const turn2 = activeTurns.get(cancellation.commandId);
+          if (turn2 === void 0 || !turn2.matches(cancellation)) {
+            console.warn(
+              "Mobius daemon ignored cancellation for an inactive turn"
+            );
+            return;
+          }
+          if (!turn2.requestCancellation()) {
+            return;
+          }
+          audit.record({
+            commandId: cancellation.commandId,
+            event: "session_cancellation_requested",
+            sessionId: cancellation.sessionId
+          });
+          void sessions.cancelPrompt(cancellation.sessionId).catch((error) => {
+            console.error(
+              "Mobius daemon could not cancel the agent turn",
+              error
+            );
+          });
+          return;
+        }
+        if (kind !== SESSION_PROMPT_KIND) {
+          socket.close(1008, "Unsupported protocol message");
+          return;
+        }
+        const command = decodeSessionPromptCommand(encoded);
+        if (activeTurns.has(command.commandId)) {
+          reportFailure(
+            socket,
+            command,
+            "duplicate_command",
+            "The command is already running"
+          );
+          return;
+        }
+        const turn = new ActiveDaemonTurn(command, new AbortController());
+        activeTurns.set(command.commandId, turn);
+        void executePrompt(
+          socket,
+          command,
+          config,
+          audit,
+          sessions,
+          turn.signal
+        ).catch((error) => {
+          console.error("Mobius daemon turn failed", error);
+        }).finally(() => {
+          activeTurns.delete(command.commandId);
+        });
+      } catch (error) {
+        console.error("Mobius daemon rejected a message", error);
+        socket.close(1008, "Invalid protocol message");
+      }
+    };
+    socket.addEventListener("close", handleClose);
+    socket.addEventListener("error", handleError);
+    socket.addEventListener("message", handleMessage);
+    if (signal.aborted) {
+      stop();
+    }
+  });
+}
+async function runDaemon(config, audit, signal) {
+  const sessions = new AcpSessionManager();
+  let retryAnnounced = false;
+  try {
+    while (!signal.aborted) {
+      try {
+        await runRelayConnection(config, audit, sessions, signal);
+        retryAnnounced = false;
+      } catch {
+        if (signal.aborted) {
+          return;
+        }
+        if (!retryAnnounced) {
+          console.warn("Mobius daemon is waiting for the relay");
+          retryAnnounced = true;
+        }
+      }
+      await waitForRelayRetry(signal);
+    }
+  } finally {
+    await sessions.close();
+  }
+}
+
+// src/cli.ts
+var shutdown = new AbortController();
+process.once("SIGINT", () => shutdown.abort());
+process.once("SIGTERM", () => shutdown.abort());
+var USAGE = `Mobius CLI
+
+Usage:
+  mobius pair --url <relay-url> --code <pairing-code> --root <workspace>
+  mobius start --channel <channel-id>
+
+Commands:
+  pair   Pair this machine and start its local daemon
+  start  Start the local daemon for a saved channel
+`;
+async function main() {
+  const command = process.argv[2];
+  if (command === void 0 || command === "--help" || command === "-h") {
+    process.stdout.write(USAGE);
+    return;
+  }
+  let config;
+  if (command === "pair") {
+    const paired = await pairLocalMachine(process.argv.slice(3));
+    config = paired.config;
+    process.stdout.write("\nLocal machine paired.\n");
+    process.stdout.write(`Channel: ${paired.channelUrl}
+`);
+    process.stdout.write(
+      "Open this channel in any browser while the daemon is running.\n"
+    );
+    process.stdout.write(`Connection saved to ${paired.connectionPath}
+`);
+  } else if (command === "start") {
+    const paired = await resumeLocalMachine(process.argv.slice(3));
+    config = paired.config;
+    process.stdout.write("\nSaved local machine channel loaded.\n");
+    process.stdout.write(`Channel: ${paired.channelUrl}
+`);
+    process.stdout.write(
+      "Open this channel in any browser while the daemon is running.\n"
+    );
+  } else {
+    throw new Error(USAGE.trimEnd());
+  }
+  process.stdout.write(
+    "Starting the local daemon. Keep this terminal open.\n\n"
+  );
+  const audit = new AuditStore(config.auditDatabasePath);
+  try {
+    await runDaemon(config, audit, shutdown.signal);
+  } finally {
+    audit.close();
+  }
+}
+try {
+  await main();
+} catch (error) {
+  if (!shutdown.signal.aborted) {
+    const message = error instanceof Error ? error.message : "Unknown failure";
+    process.stderr.write(`Mobius daemon failed: ${message}
+`);
+    process.exitCode = 1;
+  }
+}
+//# sourceMappingURL=cli.js.map