@moxt-ai/mobius 0.0.167 → 0.0.168

package/dist/index.js

@@ -31949,13 +31949,13 @@ var AgentSession = class _AgentSession {
   };
   #processUpdate = async (notification) => {
     this.assertNativeSession(notification.sessionId);
-    const update = notification.update;
     const externalized = await this.#contentExternalizer.update(
       this.#mobiusSessionId,
-      update,
+      notification.update,
       AbortSignal.timeout(3e4)
     );
-    const rawUpdate = decodeAcpSessionUpdateV2(JSON.stringify(externalized));
+    const update = externalized.agent;
+    const rawUpdate = decodeAcpSessionUpdateV2(JSON.stringify(externalized.event));
     if (this.#sessionLoad.kind === "capturing") {
       await this.#sessionLoad.history.record(update, rawUpdate);
     } else {
@@ -32381,7 +32381,19 @@ function decodeBase64(data) {
   if (data.length > MAXIMUM_ENCODED_CONTENT_CHARACTERS || data.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(data)) {
     throw new Error("The ACP embedded content is not valid bounded base64");
   }
-  return Buffer.from(data, "base64");
+  const bytes = Buffer.from(data, "base64");
+  if (bytes.toString("base64") !== data) {
+    throw new Error("The ACP embedded content is not canonical base64");
+  }
+  return bytes;
+}
+var embeddedImageSchema = external_exports.looseObject({
+  type: external_exports.literal("image"),
+  data: external_exports.string(),
+  mimeType: external_exports.string()
+});
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var AcpContentExternalizer = class {
   #store;
@@ -32392,32 +32404,45 @@ var AcpContentExternalizer = class {
     switch (content.type) {
       case "text":
       case "resource_link":
-        return content;
+        return { agent: content, event: content };
       case "image": {
         if (content.data.length === 0) {
-          return content;
+          return { agent: content, event: content };
+        }
+        try {
+          const bytes = decodeBase64(content.data);
+          if (sniffRasterMime(bytes) !== content.mimeType) {
+            throw new Error("Embedded image bytes do not match a supported image MIME type");
+          }
+          const stored = await this.#store.put({
+            bytes,
+            kind: "image",
+            mediaType: content.mimeType,
+            name: "image",
+            sessionId,
+            signal
+          });
+          return {
+            agent: { ...content, data: "", uri: `mobius-content:image:${stored.key}` },
+            event: {
+              _meta: content._meta,
+              annotations: content.annotations,
+              byteLength: stored.byteLength,
+              imageKey: stored.key,
+              mimeType: content.mimeType,
+              type: "external_image",
+              uri: content.uri
+            }
+          };
+        } catch {
+          signal.throwIfAborted();
+          const unavailable = { type: "text", text: "[Image unavailable]" };
+          return { agent: unavailable, event: unavailable };
         }
-        const stored = await this.#store.put({
-          bytes: decodeBase64(content.data),
-          kind: "image",
-          mediaType: content.mimeType,
-          name: "image",
-          sessionId,
-          signal
-        });
-        return {
-          _meta: content._meta,
-          annotations: content.annotations,
-          byteLength: stored.byteLength,
-          imageKey: stored.key,
-          mimeType: content.mimeType,
-          type: "external_image",
-          uri: content.uri
-        };
       }
       case "audio": {
         if (content.data.length === 0) {
-          return content;
+          return { agent: content, event: content };
         }
         const stored = await this.#store.put({
           bytes: decodeBase64(content.data),
@@ -32428,12 +32453,15 @@ var AcpContentExternalizer = class {
           signal
         });
         return {
-          _meta: content._meta,
-          annotations: content.annotations,
-          audioKey: stored.key,
-          byteLength: stored.byteLength,
-          mimeType: content.mimeType,
-          type: "external_audio"
+          agent: content,
+          event: {
+            _meta: content._meta,
+            annotations: content.annotations,
+            audioKey: stored.key,
+            byteLength: stored.byteLength,
+            mimeType: content.mimeType,
+            type: "external_audio"
+          }
         };
       }
       case "resource": {
@@ -32441,7 +32469,7 @@ var AcpContentExternalizer = class {
         const encoding = "text" in embedded ? "text" : "binary";
         const bytes = "text" in embedded ? Buffer.from(embedded.text, "utf8") : decodeBase64(embedded.blob);
         if (bytes.byteLength === 0) {
-          return content;
+          return { agent: content, event: content };
         }
         const mediaType = embedded.mimeType ?? "application/octet-stream";
         const stored = await this.#store.put({
@@ -32453,43 +32481,111 @@ var AcpContentExternalizer = class {
           signal
         });
         return {
-          _meta: content._meta,
-          annotations: content.annotations,
-          byteLength: stored.byteLength,
-          encoding,
-          mimeType: embedded.mimeType,
-          resourceKey: stored.key,
-          type: "external_resource",
-          uri: embedded.uri
+          agent: content,
+          event: {
+            _meta: content._meta,
+            annotations: content.annotations,
+            byteLength: stored.byteLength,
+            encoding,
+            mimeType: embedded.mimeType,
+            resourceKey: stored.key,
+            type: "external_resource",
+            uri: embedded.uri
+          }
         };
       }
     }
   }
-  async #toolContent(sessionId, item, signal) {
-    return item.type === "content" ? { ...item, content: await this.#content(sessionId, item.content, signal) } : item;
+  async #rawOutput(sessionId, value, images, signal, depth = 0) {
+    signal.throwIfAborted();
+    if (depth > 16) {
+      throw new Error("ACP tool output exceeds the maximum nesting depth");
+    }
+    if (Array.isArray(value)) {
+      const result2 = [];
+      for (const item of value) {
+        result2.push(await this.#rawOutput(sessionId, item, images, signal, depth + 1));
+      }
+      return result2;
+    }
+    if (!isRecord6(value)) {
+      return value;
+    }
+    const image = embeddedImageSchema.safeParse(value);
+    if (image.success && image.data.data.length > 0) {
+      const prepared = await this.#content(sessionId, image.data, signal);
+      if (isRecord6(prepared.event) && typeof prepared.event["imageKey"] === "string") {
+        images.set(prepared.event["imageKey"], prepared);
+      } else {
+        images.set(`unavailable:${images.size}`, prepared);
+      }
+      return prepared.event;
+    }
+    const result = {};
+    for (const [key, item] of Object.entries(value)) {
+      result[key] = await this.#rawOutput(sessionId, item, images, signal, depth + 1);
+    }
+    return result;
+  }
+  async #toolUpdate(sessionId, update, signal) {
+    const images = /* @__PURE__ */ new Map();
+    const rawOutput = update.rawOutput === void 0 ? void 0 : await this.#rawOutput(sessionId, update.rawOutput, images, signal);
+    const originalJson = images.size === 0 ? void 0 : JSON.stringify(update.rawOutput);
+    const rewrittenJson = images.size === 0 ? void 0 : JSON.stringify(rawOutput);
+    const agentContent = [];
+    const eventContent = [];
+    for (const item of update.content ?? []) {
+      if (item.type !== "content") {
+        agentContent.push(item);
+        eventContent.push(item);
+        continue;
+      }
+      const content = item.content.type === "text" && item.content.text === originalJson && rewrittenJson !== void 0 ? { ...item.content, text: rewrittenJson } : item.content;
+      const prepared = await this.#content(sessionId, content, signal);
+      agentContent.push({ ...item, content: prepared.agent });
+      eventContent.push({ ...item, content: prepared.event });
+      if (isRecord6(prepared.event) && typeof prepared.event["imageKey"] === "string") {
+        images.delete(prepared.event["imageKey"]);
+      }
+    }
+    for (const prepared of images.values()) {
+      agentContent.push({ type: "content", content: prepared.agent });
+      eventContent.push({ type: "content", content: prepared.event });
+    }
+    const output2 = update.rawOutput === void 0 ? {} : { rawOutput };
+    const hasContent = update.content !== void 0 && update.content !== null || agentContent.length > 0;
+    return {
+      agent: { ...update, ...output2, ...hasContent ? { content: agentContent } : {} },
+      event: { ...update, ...output2, ...hasContent ? { content: eventContent } : {} }
+    };
   }
   update = async (sessionId, update, signal) => {
     switch (update.sessionUpdate) {
       case "user_message_chunk":
       case "agent_message_chunk":
       case "agent_thought_chunk":
-      case "compaction_summary_chunk":
-        return { ...update, content: await this.#content(sessionId, update.content, signal) };
+      case "compaction_summary_chunk": {
+        const content = await this.#content(sessionId, update.content, signal);
+        return {
+          agent: { ...update, content: content.agent },
+          event: { ...update, content: content.event }
+        };
+      }
       case "tool_call":
       case "tool_call_update":
-        return update.content === void 0 || update.content === null ? update : {
-          ...update,
-          content: await Promise.all(
-            update.content.map(async (item) => await this.#toolContent(sessionId, item, signal))
-          )
-        };
-      case "compaction_update":
-        return update.summary === void 0 || update.summary === null ? update : {
-          ...update,
-          summary: await Promise.all(
-            update.summary.map(async (content) => await this.#content(sessionId, content, signal))
-          )
+        return await this.#toolUpdate(sessionId, update, signal);
+      case "compaction_update": {
+        if (update.summary === void 0 || update.summary === null) {
+          return { agent: update, event: update };
+        }
+        const content = await Promise.all(
+          update.summary.map(async (item) => await this.#content(sessionId, item, signal))
+        );
+        return {
+          agent: { ...update, summary: content.map((item) => item.agent) },
+          event: { ...update, summary: content.map((item) => item.event) }
         };
+      }
       case "plan":
       case "plan_update":
       case "plan_removed":
@@ -32498,16 +32594,17 @@ var AcpContentExternalizer = class {
       case "config_option_update":
       case "session_info_update":
       case "usage_update":
-        return update;
+        return { agent: update, event: update };
     }
   };
 };
 
 // src/external-content/local-external-content-store.ts
 import { createHash, randomUUID } from "node:crypto";
-import { lstat, mkdir, readFile as readFile3, realpath as realpath3, rename, rm, stat as stat3, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readdir as readdir2, realpath as realpath3, rename, rm, stat as stat3, utimes, writeFile } from "node:fs/promises";
 import { dirname as dirname2, join as join4 } from "node:path";
 var contentRequest = /^mobius-content:(image|audio|resource):([a-f0-9]{64})$/u;
+var CONTENT_LIFETIME_MILLISECONDS = 24 * 60 * 60 * 1e3;
 var metadataSchema2 = external_exports.strictObject({
   kind: external_exports.enum(["image", "audio", "resource"]),
   mediaType: external_exports.string().min(1).max(2048).regex(/^[\u0020-\u007e]+$/u),
@@ -32523,9 +32620,6 @@ var UnretainedExternalContentStore = class {
     return Promise.resolve(null);
   };
 };
-function sessionScope(sessionId) {
-  return createHash("sha256").update(sessionId).digest("hex");
-}
 async function atomicWrite(path2, bytes, signal) {
   const temporary = `${path2}.${randomUUID()}.tmp`;
   try {
@@ -32538,55 +32632,134 @@ async function atomicWrite(path2, bytes, signal) {
 }
 var LocalExternalContentStore = class {
   #root;
+  #entries = /* @__PURE__ */ new Map();
+  #operations = /* @__PURE__ */ new Set();
+  #lifetime = new AbortController();
+  #expirationTimer;
+  #cleanup = Promise.resolve();
   constructor(stateDirectory) {
-    this.#root = join4(stateDirectory, "tmp", "session-content");
-  }
-  put = async ({ bytes, kind, mediaType, name, sessionId, signal }) => {
-    signal.throwIfAborted();
+    this.#root = join4(stateDirectory, "tmp", "session-content", randomUUID());
+    this.#expirationTimer = setInterval(() => {
+      void this.#expire().catch(() => void 0);
+    }, 6e4);
+    this.#expirationTimer.unref();
+  }
+  #expire = () => {
+    this.#cleanup = this.#cleanup.catch(() => void 0).then(async () => {
+      await mkdir(this.#root, { mode: 448, recursive: true });
+      const now = /* @__PURE__ */ new Date();
+      await utimes(this.#root, now, now);
+      for (const directory of await readdir2(dirname2(this.#root), { withFileTypes: true })) {
+        if (!directory.isDirectory() || !/^[a-f0-9-]{36}$/u.test(directory.name)) {
+          continue;
+        }
+        const path2 = join4(dirname2(this.#root), directory.name);
+        if (path2 === this.#root) {
+          continue;
+        }
+        const modified = await stat3(path2).then(
+          (entry) => entry.mtimeMs,
+          () => Date.now()
+        );
+        if (modified + CONTENT_LIFETIME_MILLISECONDS <= Date.now()) {
+          await rm(path2, { force: true, recursive: true });
+        }
+      }
+      for (const [request, entry] of this.#entries) {
+        if (entry.expiresAt > Date.now()) {
+          continue;
+        }
+        await rm(entry.path, { force: true });
+        this.#entries.delete(request);
+      }
+    });
+    return this.#cleanup;
+  };
+  #track = async (operation) => {
+    this.#lifetime.signal.throwIfAborted();
+    const pending = operation();
+    this.#operations.add(pending);
+    try {
+      return await pending;
+    } finally {
+      this.#operations.delete(pending);
+    }
+  };
+  put = (input2) => this.#track(() => this.#put(input2));
+  #put = async ({ bytes, kind, mediaType, name, sessionId, signal }) => {
+    const active = AbortSignal.any([signal, this.#lifetime.signal]);
+    active.throwIfAborted();
+    const metadata = metadataSchema2.parse({ kind, mediaType, name });
     const key = createHash("sha256").update(bytes).digest("hex");
-    const directory = join4(this.#root, sessionScope(sessionId), kind);
+    const request = `mobius-content:${kind}:${key}`;
+    const existing = this.#entries.get(request);
+    if (existing !== void 0 && existing.expiresAt > Date.now()) {
+      this.#entries.set(request, {
+        ...existing,
+        expiresAt: Date.now() + CONTENT_LIFETIME_MILLISECONDS,
+        sessions: /* @__PURE__ */ new Set([...existing.sessions, sessionId])
+      });
+      return { byteLength: existing.byteLength, key };
+    }
+    await this.#expire();
+    active.throwIfAborted();
+    const directory = join4(this.#root, kind);
     await mkdir(directory, { mode: 448, recursive: true });
-    signal.throwIfAborted();
+    active.throwIfAborted();
     const path2 = join4(directory, key);
-    await atomicWrite(path2, bytes, signal);
-    await atomicWrite(
-      `${path2}.json`,
-      Buffer.from(JSON.stringify(metadataSchema2.parse({ kind, mediaType, name })), "utf8"),
-      signal
-    );
+    const write = atomicWrite(path2, bytes, active);
+    await write;
+    active.throwIfAborted();
+    const retained = this.#entries.get(request);
+    this.#entries.set(request, {
+      byteLength: bytes.byteLength,
+      expiresAt: Date.now() + CONTENT_LIFETIME_MILLISECONDS,
+      mediaType: metadata.mediaType,
+      name: metadata.name,
+      path: path2,
+      sessions: /* @__PURE__ */ new Set([...retained?.sessions ?? [], sessionId])
+    });
     return { byteLength: bytes.byteLength, key };
   };
-  resolve = async (sessionId, request, signal) => {
-    const matched = contentRequest.exec(request);
-    if (matched === null) {
+  resolve = (sessionId, request, signal) => this.#track(() => this.#resolve(sessionId, request, AbortSignal.any([signal, this.#lifetime.signal])));
+  #resolve = async (sessionId, request, signal) => {
+    signal.throwIfAborted();
+    this.#lifetime.signal.throwIfAborted();
+    if (!contentRequest.test(request)) {
       return null;
     }
-    const kind = matched[1];
-    const key = matched[2];
-    if (kind !== "image" && kind !== "audio" && kind !== "resource" || key === void 0) {
+    const entry = this.#entries.get(request);
+    if (entry === void 0 || !entry.sessions.has(sessionId)) {
+      return null;
+    }
+    if (entry.expiresAt <= Date.now()) {
+      await this.#expire();
+      signal.throwIfAborted();
       return null;
     }
-    const directory = join4(this.#root, sessionScope(sessionId), kind);
-    const path2 = join4(directory, key);
     try {
-      const [resolvedDirectory, resolvedPath, file2, metadata] = await Promise.all([
-        realpath3(directory),
-        realpath3(path2),
-        lstat(path2),
-        readFile3(`${path2}.json`, "utf8").then((value) => metadataSchema2.parse(JSON.parse(value)))
+      const [resolvedDirectory, resolvedPath, file2] = await Promise.all([
+        realpath3(dirname2(entry.path)),
+        realpath3(entry.path),
+        lstat(entry.path)
       ]);
       signal.throwIfAborted();
-      if (!file2.isFile() || dirname2(resolvedPath) !== resolvedDirectory || metadata.kind !== kind) {
+      if (!file2.isFile() || file2.isSymbolicLink() || dirname2(resolvedPath) !== resolvedDirectory) {
         return null;
       }
-      await stat3(resolvedPath);
-      signal.throwIfAborted();
-      return { mediaType: metadata.mediaType, name: metadata.name, path: resolvedPath };
+      return { mediaType: entry.mediaType, name: entry.name, path: resolvedPath };
     } catch {
       signal.throwIfAborted();
       return null;
     }
   };
+  [Symbol.asyncDispose] = async () => {
+    clearInterval(this.#expirationTimer);
+    this.#lifetime.abort();
+    await Promise.allSettled([...this.#operations, this.#cleanup]);
+    this.#entries.clear();
+    await rm(this.#root, { force: true, recursive: true });
+  };
 };
 
 // src/native-sessions/chat-agent.ts
@@ -33722,7 +33895,7 @@ var ManagedNpmPackageError = class extends Error {
     this.name = "ManagedNpmPackageError";
   }
 };
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function packagePath(root, packageName) {
@@ -33744,7 +33917,7 @@ async function readJsonRecord(path2, maximumBytes) {
         );
       }
       const value = JSON.parse(await handle.readFile({ encoding: "utf8" }));
-      if (!isRecord6(value)) {
+      if (!isRecord7(value)) {
         throw new ManagedNpmPackageError(
           "managed_package_verification_failed",
           "The managed npm package metadata is invalid"
@@ -33770,7 +33943,7 @@ function readBinPath(packageMetadata, executableName) {
   if (typeof bin === "string") {
     return bin;
   }
-  if (isRecord6(bin) && typeof bin[executableName] === "string") {
+  if (isRecord7(bin) && typeof bin[executableName] === "string") {
     return bin[executableName];
   }
   throw new ManagedNpmPackageError(
@@ -33786,7 +33959,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
     );
   }
   const packages = lock["packages"];
-  if (!isRecord6(packages)) {
+  if (!isRecord7(packages)) {
     throw new ManagedNpmPackageError(
       "managed_package_verification_failed",
       "The managed npm package lockfile is invalid"
@@ -33800,7 +33973,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
     if (verifyDependencyClosure && normalizedKey.length > 0) {
       let resolved;
       try {
-        if (!normalizedKey.split("/").includes("node_modules") || !isRecord6(candidate) || typeof candidate["version"] !== "string" || candidate["version"].length === 0 || typeof candidate["integrity"] !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(candidate["integrity"]) || typeof candidate["resolved"] !== "string") {
+        if (!normalizedKey.split("/").includes("node_modules") || !isRecord7(candidate) || typeof candidate["version"] !== "string" || candidate["version"].length === 0 || typeof candidate["integrity"] !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(candidate["integrity"]) || typeof candidate["resolved"] !== "string") {
           throw new Error("Invalid locked dependency");
         }
         resolved = new URL(candidate["resolved"]);
@@ -33823,7 +33996,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
       matches += 1;
     }
   }
-  if (matches !== 1 || !isRecord6(entry) || entry["integrity"] !== definition.integrity || entry["resolved"] !== definition.tarballUrl || entry["version"] !== definition.version) {
+  if (matches !== 1 || !isRecord7(entry) || entry["integrity"] !== definition.integrity || entry["resolved"] !== definition.tarballUrl || entry["version"] !== definition.version) {
     throw new ManagedNpmPackageError(
       "managed_package_verification_failed",
       "The managed npm package lockfile does not match the pinned artifact"
@@ -36513,7 +36686,7 @@ var ManagedAgentArchiveError = class extends Error {
     this.name = "ManagedAgentArchiveError";
   }
 };
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isContainedPath3(root, candidate) {
@@ -36570,7 +36743,7 @@ async function readManifest(path2) {
       );
     }
     const parsed = JSON.parse(await handle.readFile({ encoding: "utf8" }));
-    if (!isRecord7(parsed)) {
+    if (!isRecord8(parsed)) {
       throw new ManagedAgentArchiveError(
         "managed_archive_verification_failed",
         "The managed Agent archive manifest is invalid"
@@ -37721,7 +37894,7 @@ async function discoverLocalAgentInventory(options) {
 
 // src/storage/runtime-installation-store.ts
 import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
-import { mkdir as mkdir5, open as open5, readdir as readdir2, rename as rename4, unlink, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir5, open as open5, readdir as readdir3, rename as rename4, unlink, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname5, join as join16, resolve as resolve4 } from "node:path";
 var APPLICATION_ID_PATTERN = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+){1,31}$/;
 var CONNECTION_ID_PATTERN = /^mcn_[a-f0-9]{32}$/;
@@ -37786,7 +37959,7 @@ var VerifiedRuntimeConnection = class {
     this.runtimeId = runtimeId;
   }
 };
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
@@ -37859,7 +38032,7 @@ function channelIndexFileName(channelId) {
   return `mci_${createHash3("sha256").update(channelId).digest("hex")}.json`;
 }
 function decodeInstallationPointer(value) {
-  if (!isRecord8(value) || !hasExactKeys(value, INSTALLATION_POINTER_KEYS) || value["version"] !== 1) {
+  if (!isRecord9(value) || !hasExactKeys(value, INSTALLATION_POINTER_KEYS) || value["version"] !== 1) {
     throw new RuntimeInstallationStoreError("invalid_installation", "The local installation record is invalid");
   }
   const storedInstallationId = value["installationId"];
@@ -37869,7 +38042,7 @@ function decodeInstallationPointer(value) {
   return { installationId: validateInstallationId(storedInstallationId) };
 }
 function decodeChannelIndex(value) {
-  if (!isRecord8(value) || !hasExactKeys(value, CHANNEL_INDEX_KEYS) || value["version"] !== 1) {
+  if (!isRecord9(value) || !hasExactKeys(value, CHANNEL_INDEX_KEYS) || value["version"] !== 1) {
     throw new RuntimeInstallationStoreError("invalid_connection", "The saved Runtime connection is invalid");
   }
   const applicationId = value["applicationId"];
@@ -37919,7 +38092,7 @@ function decodeVerifiedConnection(value) {
   );
 }
 function decodeConnection(value) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     throw new RuntimeInstallationStoreError("invalid_connection", "The saved Runtime connection is invalid");
   }
   return decodeVerifiedConnection(value);
@@ -38100,7 +38273,7 @@ var RuntimeInstallationStore = class _RuntimeInstallationStore {
     signal.throwIfAborted();
     let entries;
     try {
-      entries = await readdir2(this.#connectionDirectory);
+      entries = await readdir3(this.#connectionDirectory);
     } catch (cause) {
       if (isNodeError(cause, "ENOENT")) {
         return [];
@@ -38237,7 +38410,7 @@ var PairingClientError = class extends Error {
     this.name = "PairingClientError";
   }
 };
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys2(value, expectedKeys) {
@@ -38360,9 +38533,9 @@ async function readJsonResponse(response) {
   }
 }
 function readRelayError(value) {
-  if (isRecord9(value)) {
+  if (isRecord10(value)) {
     const error62 = value["error"];
-    if (isRecord9(error62)) {
+    if (isRecord10(error62)) {
       const code = error62["code"];
       const message = error62["message"];
       if (typeof code === "string" && typeof message === "string") {
@@ -38373,7 +38546,7 @@ function readRelayError(value) {
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
 function decodePairingResponse(value, credentialField, expectedKeys) {
-  if (!isRecord9(value) || !hasExactKeys2(value, expectedKeys)) {
+  if (!isRecord10(value) || !hasExactKeys2(value, expectedKeys)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const appId = value["appId"];
@@ -38588,7 +38761,7 @@ var AgentCatalogPublishError = class extends Error {
     this.name = "AgentCatalogPublishError";
   }
 };
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isSafeRelayErrorMessage(value) {
@@ -38601,7 +38774,7 @@ async function rejectedCatalogError(response) {
   } catch {
     return new AgentCatalogPublishError("The Relay rejected the Agent catalog update");
   }
-  if (!isRecord10(value) || !isRecord10(value["error"])) {
+  if (!isRecord11(value) || !isRecord11(value["error"])) {
     return new AgentCatalogPublishError("The Relay rejected the Agent catalog update");
   }
   const code = value["error"]["code"];
@@ -39132,7 +39305,7 @@ var FixedInstallationExecutor = class {
 };
 
 // src/authorization/workspace-directory.ts
-import { readdir as readdir3, realpath as realpath9, stat as stat8 } from "node:fs/promises";
+import { readdir as readdir4, realpath as realpath9, stat as stat8 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute9, join as join17, normalize as normalize3, relative as relative4 } from "node:path";
 var WorkspaceDirectoryListing = class {
@@ -39241,7 +39414,7 @@ var WorkspaceDirectoryService = class {
   list = async (bindingId, id, signal) => {
     const target = await this.resolve(bindingId, id, signal);
     try {
-      const children = await readdir3(target, { withFileTypes: true });
+      const children = await readdir4(target, { withFileTypes: true });
       signal.throwIfAborted();
       const entries = [];
       for (const child2 of children) {
@@ -44920,7 +45093,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer, opti
   const sessionStore = new SqliteAcpSessionStore(
     join19(stateDirectory, "sessions", `${createHash8("sha256").update(config2.channelId).digest("hex")}.sqlite`)
   );
-  const externalContent = new LocalExternalContentStore(stateDirectory);
+  await using externalContent = new LocalExternalContentStore(stateDirectory);
   const operations = new DaemonOperationState();
   const publisher = new DaemonSessionEventPublisher(sessionStore);
   const eventLogV2 = new DaemonSessionEventLogV2(publisher, sessionStore);