@moxt-ai/mobius 0.0.20 → 0.0.22

package/dist/index.js

@@ -3708,7 +3708,7 @@ var $ZodUnion = /* @__PURE__ */ $constructor("$ZodUnion", (inst, def) => {
   defineLazyInternal(inst, "optout", (zod) => zod.def.options.some((o) => o._zod.optout === "optional") ? "optional" : void 0);
   defineLazyInternal(inst, "values", (zod) => {
     if (zod.def.options.every((o) => o._zod.values)) {
-      return new Set(zod.def.options.flatMap((option) => Array.from(option._zod.values)));
+      return new Set(zod.def.options.flatMap((option2) => Array.from(option2._zod.values)));
     }
     return void 0;
   });
@@ -3726,8 +3726,8 @@ var $ZodUnion = /* @__PURE__ */ $constructor("$ZodUnion", (inst, def) => {
     }
     let async = false;
     const results = [];
-    for (const option of def.options) {
-      const result = option._zod.run({
+    for (const option2 of def.options) {
+      const result = option2._zod.run({
         value: payload.value,
         issues: []
       }, ctx);
@@ -3786,8 +3786,8 @@ var $ZodXor = /* @__PURE__ */ $constructor("$ZodXor", (inst, def) => {
     }
     let async = false;
     const results = [];
-    for (const option of def.options) {
-      const result = option._zod.run({
+    for (const option2 of def.options) {
+      const result = option2._zod.run({
         value: payload.value,
         issues: []
       }, ctx);
@@ -3811,10 +3811,10 @@ function getDiscriminatedOption(union2, value) {
   if (!map2) {
     map2 = /* @__PURE__ */ new Map();
     const { options, discriminator } = internals.def;
-    for (const option of options) {
-      for (const v of option._zod.propValues?.[discriminator] ?? [])
+    for (const option2 of options) {
+      for (const v of option2._zod.propValues?.[discriminator] ?? [])
         if (!map2.has(v))
-          map2.set(v, option);
+          map2.set(v, option2);
     }
     internals.bag.optionsMap = map2;
   }
@@ -3826,10 +3826,10 @@ var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnio
   const _super = inst._zod.parse;
   defineLazyInternal(inst, "propValues", (zod) => {
     const propValues = {};
-    for (const option of zod.def.options) {
-      const pv = option._zod.propValues;
+    for (const option2 of zod.def.options) {
+      const pv = option2._zod.propValues;
       if (!pv || Object.keys(pv).length === 0)
-        throw new Error(`Invalid discriminated union option at index "${zod.def.options.indexOf(option)}"`);
+        throw new Error(`Invalid discriminated union option at index "${zod.def.options.indexOf(option2)}"`);
       for (const [k, v] of Object.entries(pv)) {
         if (!Object.prototype.hasOwnProperty.call(propValues, k)) {
           assignProp(propValues, k, /* @__PURE__ */ new Set());
@@ -3841,8 +3841,8 @@ var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnio
     }
     return propValues;
   });
-  def.options.forEach((option, i) => {
-    const propShape = propShapes.get(option._zod.def);
+  def.options.forEach((option2, i) => {
+    const propShape = propShapes.get(option2._zod.def);
     if (propShape && !Object.prototype.hasOwnProperty.call(propShape, def.discriminator)) {
       throw new Error(`Invalid discriminated union option at index "${i}"`);
     }
@@ -13773,8 +13773,8 @@ function generateDiscriminatedUnionCheck(doc, ctx, def, accessor) {
   doc.write(`let ${outputVar};`);
   let firstBranch = true;
   const claimed = /* @__PURE__ */ new Set();
-  for (const option of def.options) {
-    const values = option._zod.propValues?.[def.discriminator];
+  for (const option2 of def.options) {
+    const values = option2._zod.propValues?.[def.discriminator];
     if (!values || values.size === 0) {
       throw new ZodCompileUnsupportedError("discriminated union option without static discriminator values");
     }
@@ -13788,7 +13788,7 @@ function generateDiscriminatedUnionCheck(doc, ctx, def, accessor) {
     const prefix = firstBranch ? "if" : "else if";
     doc.write(`${prefix} (${conditions.join(" || ")}) {`);
     doc.indented((d) => {
-      const branchOutput = generateCheck(d, ctx, option, accessor);
+      const branchOutput = generateCheck(d, ctx, option2, accessor);
       d.write(`${outputVar} = ${branchOutput};`);
     });
     doc.write(`}`);
@@ -15338,14 +15338,14 @@ function compactTypeUnion(schema) {
   if (!Array.isArray(options) || options.length === 0 || schema.type !== void 0)
     return;
   const types = [];
-  for (const option of options) {
-    if (!option || typeof option !== "object")
+  for (const option2 of options) {
+    if (!option2 || typeof option2 !== "object")
       return;
-    compactTypeUnion(option);
-    const keys = Object.keys(option);
+    compactTypeUnion(option2);
+    const keys = Object.keys(option2);
     if (keys.length !== 1 || keys[0] !== "type")
       return;
-    const type = option.type;
+    const type = option2.type;
     for (const member of Array.isArray(type) ? type : [type]) {
       if (typeof member !== "string")
         return;
@@ -15635,8 +15635,8 @@ function isTransforming(_schema, _ctx) {
     return false;
   }
   if (def.type === "union") {
-    for (const option of def.options) {
-      if (isTransforming(option, ctx))
+    for (const option2 of def.options) {
+      if (isTransforming(option2, ctx))
         return true;
     }
     return false;
@@ -19712,6 +19712,487 @@ function encodeSessionFailedEvent(message) {
   return JSON.stringify(decodeSessionFailedEvent(JSON.stringify(message)));
 }
 
+// ../protocol/src/bot.ts
+var BOT_BINDING_APPROVAL_REQUEST_KIND = "bot.binding.approval.request";
+var BOT_BINDING_APPROVED_KIND = "bot.binding.approved";
+var BOT_BINDING_UNAVAILABLE_KIND = "bot.binding.unavailable";
+var BOT_SESSION_PROMPT_KIND = "bot.session.prompt";
+var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var DIRECTORY_IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/;
+var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var SHA256_PATTERN = /^[a-f0-9]{64}$/;
+var MAX_INSTRUCTIONS_LENGTH = 1e5;
+var BotDeliveryTargetReference = class {
+  alias;
+  deliveryTargetId;
+  constructor(alias, deliveryTargetId) {
+    this.alias = alias;
+    this.deliveryTargetId = deliveryTargetId;
+  }
+};
+var BotCompletionDeliveryPolicy = class {
+};
+var NoBotCompletionDeliveryPolicy = class extends BotCompletionDeliveryPolicy {
+  kind = "none";
+};
+var RequiredBotCompletionDeliveryPolicy = class extends BotCompletionDeliveryPolicy {
+  deliveryTargetId;
+  kind = "required";
+  messageTemplate;
+  constructor(deliveryTargetId, messageTemplate) {
+    super();
+    this.deliveryTargetId = deliveryTargetId;
+    this.messageTemplate = messageTemplate;
+  }
+};
+var BotReplyRoute = class {
+};
+var OwnerBotReplyRoute = class extends BotReplyRoute {
+  kind = "owner";
+};
+var BotConnectionReplyRoute = class extends BotReplyRoute {
+  connectionId;
+  deliveryTargetId;
+  kind = "connection";
+  constructor(connectionId, deliveryTargetId) {
+    super();
+    this.connectionId = connectionId;
+    this.deliveryTargetId = deliveryTargetId;
+  }
+};
+var BotExecutionBindingApprovalRequest = class {
+  agentConfigRevision;
+  agentRef;
+  allowedDeliveryTargets;
+  behaviorDigest;
+  behaviorInstructions;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  completionPolicy;
+  kind = BOT_BINDING_APPROVAL_REQUEST_KIND;
+  requestId;
+  requiredCapabilities;
+  runtimeId;
+  workspaceRef;
+  constructor(requestId, botId, behaviorRevisionId, bindingId, bindingRevision, runtimeId, agentRef, workspaceRef, agentConfigRevision, behaviorInstructions, behaviorDigest, requiredCapabilities, allowedDeliveryTargets, completionPolicy) {
+    this.requestId = requestId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.runtimeId = runtimeId;
+    this.agentRef = agentRef;
+    this.workspaceRef = workspaceRef;
+    this.agentConfigRevision = agentConfigRevision;
+    this.behaviorInstructions = behaviorInstructions;
+    this.behaviorDigest = behaviorDigest;
+    this.requiredCapabilities = Object.freeze([...requiredCapabilities]);
+    this.allowedDeliveryTargets = Object.freeze(
+      allowedDeliveryTargets.map(
+        (target) => new BotDeliveryTargetReference(target.alias, target.deliveryTargetId)
+      )
+    );
+    this.completionPolicy = completionPolicy;
+  }
+};
+var BotExecutionBindingApprovedEvent = class {
+  agentIdentityDigest;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  kind = BOT_BINDING_APPROVED_KIND;
+  localGrantId;
+  requestId;
+  workspaceIdentityDigest;
+  constructor(requestId, botId, behaviorRevisionId, bindingId, bindingRevision, localGrantId, agentIdentityDigest, workspaceIdentityDigest) {
+    this.requestId = requestId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.localGrantId = localGrantId;
+    this.agentIdentityDigest = agentIdentityDigest;
+    this.workspaceIdentityDigest = workspaceIdentityDigest;
+  }
+};
+var BotExecutionBindingUnavailableEvent = class {
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  code;
+  kind = BOT_BINDING_UNAVAILABLE_KIND;
+  message;
+  requestId;
+  constructor(requestId, botId, behaviorRevisionId, bindingId, bindingRevision, code, message) {
+    this.requestId = requestId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.code = code;
+    this.message = message;
+  }
+};
+var BotSessionPromptCommand = class {
+  additionalDirectoryIds;
+  agentId;
+  allowedDeliveryTargets;
+  behaviorDigest;
+  behaviorInstructions;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  commandId;
+  conversationId;
+  directoryId;
+  executionCapabilityId;
+  executionCapabilitySecret;
+  executionDeadlineAt;
+  executionId;
+  images;
+  kind = BOT_SESSION_PROMPT_KIND;
+  localGrantId;
+  prompt;
+  replyRoute;
+  resources;
+  sessionId;
+  turnId;
+  constructor(sessionId, commandId, agentId, bindingId, directoryId2, additionalDirectoryIds, images, resources, prompt, executionId, executionCapabilityId, executionCapabilitySecret, executionDeadlineAt, botId, conversationId, turnId, behaviorRevisionId, bindingRevision, localGrantId, behaviorInstructions, behaviorDigest, allowedDeliveryTargets, replyRoute) {
+    this.sessionId = sessionId;
+    this.commandId = commandId;
+    this.agentId = agentId;
+    this.bindingId = bindingId;
+    this.directoryId = directoryId2;
+    this.additionalDirectoryIds = Object.freeze([...additionalDirectoryIds]);
+    this.images = Object.freeze([...images]);
+    this.resources = Object.freeze([...resources]);
+    this.prompt = prompt;
+    this.executionId = executionId;
+    this.executionCapabilityId = executionCapabilityId;
+    this.executionCapabilitySecret = executionCapabilitySecret;
+    this.executionDeadlineAt = executionDeadlineAt;
+    this.botId = botId;
+    this.conversationId = conversationId;
+    this.turnId = turnId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingRevision = bindingRevision;
+    this.localGrantId = localGrantId;
+    this.behaviorInstructions = behaviorInstructions;
+    this.behaviorDigest = behaviorDigest;
+    this.allowedDeliveryTargets = Object.freeze(
+      allowedDeliveryTargets.map(
+        (target) => new BotDeliveryTargetReference(target.alias, target.deliveryTargetId)
+      )
+    );
+    this.replyRoute = replyRoute;
+  }
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJson3(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new ProtocolMessageError("Message is not valid JSON", { cause });
+  }
+  if (!isRecord2(value)) {
+    throw new ProtocolMessageError("Message must be a JSON object");
+  }
+  return value;
+}
+function assertExactKeys2(value, expected) {
+  const keys = Object.keys(value);
+  if (keys.length !== expected.length || keys.some((key) => !expected.includes(key))) {
+    throw new ProtocolMessageError("Message fields do not match the Bot protocol");
+  }
+}
+function readText2(value, key, maximumLength, allowEmpty) {
+  const field = value[key];
+  if (typeof field !== "string" || field.length > maximumLength || !allowEmpty && field.length === 0) {
+    throw new ProtocolMessageError(`Invalid Bot protocol field: ${key}`);
+  }
+  return field;
+}
+function readIdentifier2(value, key) {
+  const field = readText2(value, key, 128, false);
+  if (!IDENTIFIER_PATTERN3.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot identifier field: ${key}`);
+  }
+  return field;
+}
+function readDirectoryIdentifier2(value, key) {
+  const field = readText2(value, key, 2048, false);
+  if (!DIRECTORY_IDENTIFIER_PATTERN3.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot directory field: ${key}`);
+  }
+  return field;
+}
+function readInteger(value, key) {
+  const field = value[key];
+  if (typeof field !== "number" || !Number.isSafeInteger(field) || field < 1) {
+    throw new ProtocolMessageError(`Invalid Bot integer field: ${key}`);
+  }
+  return field;
+}
+function readTimestamp(value, key) {
+  const field = readText2(value, key, 64, false);
+  if (Number.isNaN(Date.parse(field))) {
+    throw new ProtocolMessageError(`Invalid Bot timestamp field: ${key}`);
+  }
+  return field;
+}
+function readDigest(value, key) {
+  const field = readText2(value, key, 64, false);
+  if (!SHA256_PATTERN.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot digest field: ${key}`);
+  }
+  return field;
+}
+function readToken(value, key) {
+  const field = readText2(value, key, 256, false);
+  if (!TOKEN_PATTERN.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot token field: ${key}`);
+  }
+  return field;
+}
+function readIdentifiers(value, key, maximumCount) {
+  const field = value[key];
+  if (!Array.isArray(field) || field.length > maximumCount) {
+    throw new ProtocolMessageError(`Invalid Bot identifier list: ${key}`);
+  }
+  const identifiers = [];
+  const unique = /* @__PURE__ */ new Set();
+  for (const candidate of field) {
+    if (typeof candidate !== "string" || !IDENTIFIER_PATTERN3.test(candidate) || unique.has(candidate)) {
+      throw new ProtocolMessageError(`Invalid Bot identifier list: ${key}`);
+    }
+    unique.add(candidate);
+    identifiers.push(candidate);
+  }
+  return Object.freeze(identifiers);
+}
+function readTargets(value, key) {
+  const field = value[key];
+  if (!Array.isArray(field) || field.length > 64) {
+    throw new ProtocolMessageError(`Invalid Bot delivery targets: ${key}`);
+  }
+  const targets = [];
+  const identifiers = /* @__PURE__ */ new Set();
+  const aliases = /* @__PURE__ */ new Set();
+  for (const candidate of field) {
+    if (!isRecord2(candidate)) {
+      throw new ProtocolMessageError(`Invalid Bot delivery targets: ${key}`);
+    }
+    assertExactKeys2(candidate, ["alias", "deliveryTargetId"]);
+    const alias = readIdentifier2(candidate, "alias");
+    const deliveryTargetId = readIdentifier2(candidate, "deliveryTargetId");
+    if (aliases.has(alias) || identifiers.has(deliveryTargetId)) {
+      throw new ProtocolMessageError(`Duplicate Bot delivery target: ${key}`);
+    }
+    aliases.add(alias);
+    identifiers.add(deliveryTargetId);
+    targets.push(new BotDeliveryTargetReference(alias, deliveryTargetId));
+  }
+  return Object.freeze(targets);
+}
+function readCompletionPolicy(value) {
+  if (!isRecord2(value)) {
+    throw new ProtocolMessageError("Invalid Bot completion policy");
+  }
+  const kind = readText2(value, "kind", 32, false);
+  if (kind === "none") {
+    assertExactKeys2(value, ["kind"]);
+    return new NoBotCompletionDeliveryPolicy();
+  }
+  if (kind === "required") {
+    assertExactKeys2(value, ["deliveryTargetId", "kind", "messageTemplate"]);
+    return new RequiredBotCompletionDeliveryPolicy(
+      readIdentifier2(value, "deliveryTargetId"),
+      readText2(value, "messageTemplate", 1e4, false)
+    );
+  }
+  throw new ProtocolMessageError("Invalid Bot completion policy");
+}
+function readReplyRoute(value) {
+  if (!isRecord2(value)) {
+    throw new ProtocolMessageError("Invalid Bot reply route");
+  }
+  const kind = readText2(value, "kind", 32, false);
+  if (kind === "owner") {
+    assertExactKeys2(value, ["kind"]);
+    return new OwnerBotReplyRoute();
+  }
+  if (kind === "connection") {
+    assertExactKeys2(value, ["connectionId", "deliveryTargetId", "kind"]);
+    return new BotConnectionReplyRoute(
+      readIdentifier2(value, "connectionId"),
+      readIdentifier2(value, "deliveryTargetId")
+    );
+  }
+  throw new ProtocolMessageError("Invalid Bot reply route");
+}
+function decodeBotExecutionBindingApprovalRequest(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "agentConfigRevision",
+    "agentRef",
+    "allowedDeliveryTargets",
+    "behaviorDigest",
+    "behaviorInstructions",
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "completionPolicy",
+    "kind",
+    "requestId",
+    "requiredCapabilities",
+    "runtimeId",
+    "workspaceRef"
+  ]);
+  if (value["kind"] !== BOT_BINDING_APPROVAL_REQUEST_KIND) {
+    throw new ProtocolMessageError("Invalid Bot binding approval request kind");
+  }
+  return new BotExecutionBindingApprovalRequest(
+    readIdentifier2(value, "requestId"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readIdentifier2(value, "bindingId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "runtimeId"),
+    readIdentifier2(value, "agentRef"),
+    readDirectoryIdentifier2(value, "workspaceRef"),
+    readInteger(value, "agentConfigRevision"),
+    readText2(value, "behaviorInstructions", MAX_INSTRUCTIONS_LENGTH, true),
+    readDigest(value, "behaviorDigest"),
+    readIdentifiers(value, "requiredCapabilities", 32),
+    readTargets(value, "allowedDeliveryTargets"),
+    readCompletionPolicy(value["completionPolicy"])
+  );
+}
+function decodeBotExecutionBindingApprovedEvent(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "agentIdentityDigest",
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "kind",
+    "localGrantId",
+    "requestId",
+    "workspaceIdentityDigest"
+  ]);
+  if (value["kind"] !== BOT_BINDING_APPROVED_KIND) {
+    throw new ProtocolMessageError("Invalid Bot binding approval event kind");
+  }
+  return new BotExecutionBindingApprovedEvent(
+    readIdentifier2(value, "requestId"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readIdentifier2(value, "bindingId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "localGrantId"),
+    readDigest(value, "agentIdentityDigest"),
+    readDigest(value, "workspaceIdentityDigest")
+  );
+}
+function encodeBotExecutionBindingApprovedEvent(event) {
+  return JSON.stringify(decodeBotExecutionBindingApprovedEvent(JSON.stringify(event)));
+}
+function decodeBotExecutionBindingUnavailableEvent(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "code",
+    "kind",
+    "message",
+    "requestId"
+  ]);
+  if (value["kind"] !== BOT_BINDING_UNAVAILABLE_KIND) {
+    throw new ProtocolMessageError("Invalid Bot binding unavailable event kind");
+  }
+  return new BotExecutionBindingUnavailableEvent(
+    readIdentifier2(value, "requestId"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readIdentifier2(value, "bindingId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "code"),
+    readText2(value, "message", 500, false)
+  );
+}
+function encodeBotExecutionBindingUnavailableEvent(event) {
+  return JSON.stringify(decodeBotExecutionBindingUnavailableEvent(JSON.stringify(event)));
+}
+function decodeBotSessionPromptCommand(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "additionalDirectoryIds",
+    "agentId",
+    "allowedDeliveryTargets",
+    "behaviorDigest",
+    "behaviorInstructions",
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "commandId",
+    "conversationId",
+    "directoryId",
+    "executionCapabilityId",
+    "executionCapabilitySecret",
+    "executionDeadlineAt",
+    "executionId",
+    "images",
+    "kind",
+    "localGrantId",
+    "prompt",
+    "replyRoute",
+    "resources",
+    "sessionId",
+    "turnId"
+  ]);
+  if (value["kind"] !== BOT_SESSION_PROMPT_KIND) {
+    throw new ProtocolMessageError("Invalid Bot Session prompt kind");
+  }
+  return new BotSessionPromptCommand(
+    readIdentifier2(value, "sessionId"),
+    readIdentifier2(value, "commandId"),
+    readIdentifier2(value, "agentId"),
+    readIdentifier2(value, "bindingId"),
+    readDirectoryIdentifier2(value, "directoryId"),
+    readIdentifiers(value, "additionalDirectoryIds", 16),
+    decodePromptImagesValue(value["images"]),
+    decodePromptResourcesValue(value["resources"]),
+    readText2(value, "prompt", 1e4, false),
+    readIdentifier2(value, "executionId"),
+    readIdentifier2(value, "executionCapabilityId"),
+    readToken(value, "executionCapabilitySecret"),
+    readTimestamp(value, "executionDeadlineAt"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "conversationId"),
+    readIdentifier2(value, "turnId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "localGrantId"),
+    readText2(value, "behaviorInstructions", MAX_INSTRUCTIONS_LENGTH, true),
+    readDigest(value, "behaviorDigest"),
+    readTargets(value, "allowedDeliveryTargets"),
+    readReplyRoute(value["replyRoute"])
+  );
+}
+
 // ../protocol/src/mobius-api.ts
 var MOBIUS_API_PREFIX = "/mobius/api";
 var API_PREFIX_PATTERN = /^\/[a-zA-Z0-9._~-]+(?:\/[a-zA-Z0-9._~-]+)*$/;
@@ -19885,13 +20366,18 @@ var decodeNativeSessionCancel = (encoded) => decode4(nativeSessionCancelSchema,
 var SESSION_EVENT_KIND = "session.event";
 var SESSION_EVENT_ACK_KIND = "session.event.ack";
 var SESSION_EVENT_COMMITTED_KIND = "session.event.committed";
-var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var SESSION_EVENT_REJECTED_KIND = "session.event.rejected";
+var SessionEventRejectionCode = {
+  SessionDeleted: "session_deleted",
+  SessionNotFound: "session_not_found"
+};
+var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var CURSOR_PATTERN = /^[A-Za-z0-9_-]{1,512}$/;
 var MAX_RECORDED_EVENT_LENGTH = 8 * 1024 * 1024;
 var DECIMAL_SEQUENCE_PATTERN = /^(?:0|[1-9][0-9]*)$/;
 var eventSourceSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
-    attemptId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+    attemptId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
     kind: external_exports.literal("attempt"),
     sourceSeq: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN)
   }).readonly(),
@@ -19901,29 +20387,35 @@ var eventSourceSchema = external_exports.discriminatedUnion("kind", [
   }).readonly()
 ]);
 var eventEnvelopeSchema = external_exports.strictObject({
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_KIND),
   payload: external_exports.string().min(2).max(MAX_RECORDED_EVENT_LENGTH),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   source: eventSourceSchema
 }).readonly();
 var committedEventSchema = external_exports.strictObject({
   cursor: external_exports.string().min(1).max(512).regex(CURSOR_PATTERN),
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_COMMITTED_KIND),
   payload: external_exports.string().min(2).max(MAX_RECORDED_EVENT_LENGTH),
   recordedAt: external_exports.string().datetime({ offset: true }),
   sequence: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   source: eventSourceSchema
 }).readonly();
 var eventAcknowledgementSchema = external_exports.strictObject({
   cursor: external_exports.string().min(1).max(512).regex(CURSOR_PATTERN),
   duplicate: external_exports.boolean(),
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_ACK_KIND),
   sequence: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3)
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4)
+}).readonly();
+var eventRejectionSchema = external_exports.strictObject({
+  code: external_exports.enum(SessionEventRejectionCode),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
+  kind: external_exports.literal(SESSION_EVENT_REJECTED_KIND),
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4)
 }).readonly();
 function decode5(encoded, schema) {
   let value;
@@ -19951,6 +20443,7 @@ var encode4 = (message, schema) => {
 };
 var encodeSessionEventEnvelope = (message) => encode4(message, eventEnvelopeSchema);
 var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAcknowledgementSchema);
+var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSchema);
 
 // src/agent-catalog/local-agent.ts
 import { realpathSync, statSync } from "node:fs";
@@ -20599,7 +21092,7 @@ import {
 
 // src/acp/activity.ts
 var TRUNCATION_MARKER = "\n\u2026 output truncated by Mobius";
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var AcpActivity = class _AcpActivity {
@@ -20866,7 +21359,7 @@ function contentPhase(content) {
     return "";
   }
   const codex = metadata["codex"];
-  if (!isRecord2(codex)) {
+  if (!isRecord3(codex)) {
     return "";
   }
   const phase = codex["phase"];
@@ -21104,7 +21597,7 @@ var SessionConfigProtocolError = class extends Error {
     this.name = "SessionConfigProtocolError";
   }
 };
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString2(value, fallback = "") {
@@ -21116,13 +21609,13 @@ function truncate2(value, maximum) {
 function readBoolean(value, fallback = false) {
   return typeof value === "boolean" ? value : fallback;
 }
-function normalizeConfigValue(option, groupId = "", groupName = "") {
+function normalizeConfigValue(option2, groupId = "", groupName = "") {
   return {
-    description: truncate2(readString2(option["description"]), 500),
+    description: truncate2(readString2(option2["description"]), 500),
     groupId: truncate2(groupId, 128),
     groupName: truncate2(groupName, 255),
-    name: truncate2(readString2(option["name"], readString2(option["value"])), 255),
-    value: truncate2(readString2(option["value"]), 500)
+    name: truncate2(readString2(option2["name"], readString2(option2["value"])), 255),
+    value: truncate2(readString2(option2["value"]), 500)
   };
 }
 function normalizeConfigValues(value) {
@@ -21131,7 +21624,7 @@ function normalizeConfigValues(value) {
   }
   const normalized = [];
   for (const entry of value) {
-    if (!isRecord3(entry)) {
+    if (!isRecord4(entry)) {
       continue;
     }
     const groupedOptions = entry["options"];
@@ -21139,7 +21632,7 @@ function normalizeConfigValues(value) {
       const groupId = readString2(entry["group"]);
       const groupName = readString2(entry["name"]);
       for (const groupedOption of groupedOptions) {
-        if (isRecord3(groupedOption)) {
+        if (isRecord4(groupedOption)) {
           normalized.push(normalizeConfigValue(groupedOption, groupId, groupName));
         }
       }
@@ -21152,21 +21645,21 @@ function normalizeConfigValues(value) {
 function normalizeConfigOptions(value, modes) {
   const normalized = [];
   if (Array.isArray(value)) {
-    for (const option of value) {
-      if (!isRecord3(option)) {
+    for (const option2 of value) {
+      if (!isRecord4(option2)) {
         continue;
       }
-      const id = truncate2(readString2(option["id"]), 128);
-      const name = truncate2(readString2(option["name"], id), 255);
+      const id = truncate2(readString2(option2["id"]), 128);
+      const name = truncate2(readString2(option2["name"], id), 255);
       if (id.length === 0 || name.length === 0) {
         continue;
       }
-      if (option["type"] === "boolean") {
+      if (option2["type"] === "boolean") {
         normalized.push({
-          booleanValue: readBoolean(option["currentValue"]),
-          category: truncate2(readString2(option["category"]), 128),
+          booleanValue: readBoolean(option2["currentValue"]),
+          category: truncate2(readString2(option2["category"]), 128),
           currentValue: "",
-          description: truncate2(readString2(option["description"]), 500),
+          description: truncate2(readString2(option2["description"]), 500),
           id,
           name,
           type: "boolean",
@@ -21174,15 +21667,15 @@ function normalizeConfigOptions(value, modes) {
         });
         continue;
       }
-      if (option["type"] === "select") {
-        const values = normalizeConfigValues(option["options"]);
-        const currentValue = truncate2(readString2(option["currentValue"]), 500);
+      if (option2["type"] === "select") {
+        const values = normalizeConfigValues(option2["options"]);
+        const currentValue = truncate2(readString2(option2["currentValue"]), 500);
         if (currentValue.length > 0 && values.some((entry) => entry.value === currentValue)) {
           normalized.push({
             booleanValue: false,
-            category: truncate2(readString2(option["category"]), 128),
+            category: truncate2(readString2(option2["category"]), 128),
             currentValue,
-            description: truncate2(readString2(option["description"]), 500),
+            description: truncate2(readString2(option2["description"]), 500),
             id,
             name,
             type: "select",
@@ -21192,12 +21685,12 @@ function normalizeConfigOptions(value, modes) {
       }
     }
   }
-  if (isRecord3(modes)) {
+  if (isRecord4(modes)) {
     const values = [];
     const availableModes = modes["availableModes"];
     if (Array.isArray(availableModes)) {
       for (const mode of availableModes) {
-        if (!isRecord3(mode)) {
+        if (!isRecord4(mode)) {
           continue;
         }
         const id = truncate2(readString2(mode["id"]), 500);
@@ -21230,7 +21723,7 @@ function normalizeConfigOptions(value, modes) {
   return normalized.slice(0, 100);
 }
 function ensureReasoningEffortOption(current) {
-  if (current.some((option) => option.category === "thought_level")) {
+  if (current.some((option2) => option2.category === "thought_level")) {
     return current;
   }
   const unavailable = {
@@ -21251,7 +21744,7 @@ function ensureReasoningEffortOption(current) {
       }
     ]
   };
-  const modelIndex = current.findIndex((option) => option.category === "model");
+  const modelIndex = current.findIndex((option2) => option2.category === "model");
   if (current.length < MAXIMUM_CONFIG_OPTIONS) {
     if (modelIndex < 0) {
       return [...current, unavailable];
@@ -21275,20 +21768,20 @@ function ensureReasoningEffortOption(current) {
   return [...current.slice(0, MAXIMUM_CONFIG_OPTIONS - 2), model, unavailable];
 }
 function normalizeStandardLifecycle(response) {
-  const lifecycle = isRecord3(response) ? response : {};
+  const lifecycle = isRecord4(response) ? response : {};
   return ensureReasoningEffortOption(normalizeConfigOptions(lifecycle["configOptions"], lifecycle["modes"]));
 }
 function replaceStandardConfigOptions(current, value) {
   const next = normalizeConfigOptions(value, void 0);
-  const withMode = next.some((option) => option.category === "mode") ? next : [...current.filter((option) => option.category === "mode"), ...next].slice(0, 100);
+  const withMode = next.some((option2) => option2.category === "mode") ? next : [...current.filter((option2) => option2.category === "mode"), ...next].slice(0, 100);
   return ensureReasoningEffortOption(withMode);
 }
 function updateCurrentValue(current, configId, value) {
-  return current.map((option) => option.id === configId ? { ...option, currentValue: value } : option);
+  return current.map((option2) => option2.id === configId ? { ...option2, currentValue: value } : option2);
 }
 var StandardSessionConfigProtocol = class {
   configure = async (current, change, nativeSessionId, transport) => {
-    const existing = current.find((option) => option.id === change.configId);
+    const existing = current.find((option2) => option2.id === change.configId);
     if (existing === void 0) {
       return current;
     }
@@ -21317,7 +21810,7 @@ var StandardSessionConfigProtocol = class {
       "ACP agent exited while changing session configuration",
       change.signal
     );
-    if (!isRecord3(response) || !Array.isArray(response["configOptions"])) {
+    if (!isRecord4(response) || !Array.isArray(response["configOptions"])) {
       throw new SessionConfigProtocolError("The Agent returned an invalid session configuration response");
     }
     return replaceStandardConfigOptions(current, response["configOptions"]);
@@ -21331,31 +21824,31 @@ var standardSessionConfigProtocol = new StandardSessionConfigProtocol();
 var LEGACY_MODEL_CONFIG_ID = "grok_build_legacy_model";
 var LEGACY_REASONING_EFFORT_CONFIG_ID = "grok_build_legacy_reasoning_effort";
 function legacyOptions(response) {
-  if (!isRecord3(response)) {
+  if (!isRecord4(response)) {
     return [];
   }
   const metadata = response["_meta"];
-  if (!isRecord3(metadata)) {
+  if (!isRecord4(metadata)) {
     return [];
   }
   const sessionConfig = metadata["x.ai/sessionConfig"];
-  if (!isRecord3(sessionConfig) || !Array.isArray(sessionConfig["options"])) {
+  if (!isRecord4(sessionConfig) || !Array.isArray(sessionConfig["options"])) {
     return [];
   }
-  return sessionConfig["options"].slice(0, 500).filter(isRecord3);
+  return sessionConfig["options"].slice(0, 500).filter(isRecord4);
 }
-function legacyValue(option) {
-  const value = readString2(option["id"]);
+function legacyValue(option2) {
+  const value = readString2(option2["id"]);
   return {
-    description: readString2(option["description"]).slice(0, 500),
+    description: readString2(option2["description"]).slice(0, 500),
     groupId: "",
     groupName: "",
-    name: readString2(option["label"], value).slice(0, 255),
+    name: readString2(option2["label"], value).slice(0, 255),
     value: value.slice(0, 500)
   };
 }
 function modelsRecord(response) {
-  if (!isRecord3(response) || !isRecord3(response["models"])) {
+  if (!isRecord4(response) || !isRecord4(response["models"])) {
     return {};
   }
   return response["models"];
@@ -21364,9 +21857,9 @@ function legacyModelOptions(response) {
   const options = legacyOptions(response);
   const models = modelsRecord(response);
   const values = [];
-  for (const option of options) {
-    if (option["category"] === "model") {
-      const value = legacyValue(option);
+  for (const option2 of options) {
+    if (option2["category"] === "model") {
+      const value = legacyValue(option2);
       if (value.value.length > 0 && !values.some((existing) => existing.value === value.value)) {
         values.push(value);
       }
@@ -21374,7 +21867,7 @@ function legacyModelOptions(response) {
   }
   if (values.length === 0 && Array.isArray(models["availableModels"])) {
     for (const model of models["availableModels"]) {
-      if (!isRecord3(model)) {
+      if (!isRecord4(model)) {
         continue;
       }
       const value = readString2(model["modelId"]).slice(0, 500);
@@ -21392,7 +21885,7 @@ function legacyModelOptions(response) {
       }
     }
   }
-  const selected = options.find((option) => option["category"] === "model" && option["selected"] === true);
+  const selected = options.find((option2) => option2["category"] === "model" && option2["selected"] === true);
   const currentValue = readString2(
     models["currentModelId"],
     selected === void 0 ? "" : readString2(selected["id"])
@@ -21415,11 +21908,11 @@ function legacyModelOptions(response) {
 function legacyReasoningEffortOptions(response) {
   const options = legacyOptions(response);
   const values = [];
-  for (const option of options) {
-    if (option["category"] !== "mode") {
+  for (const option2 of options) {
+    if (option2["category"] !== "mode") {
       continue;
     }
-    const value = legacyValue(option);
+    const value = legacyValue(option2);
     if (value.value.length > 0 && !values.some((existing) => existing.value === value.value)) {
       values.push(value);
     }
@@ -21427,7 +21920,7 @@ function legacyReasoningEffortOptions(response) {
   if (values.length === 0) {
     return [];
   }
-  const selected = options.find((option) => option["category"] === "mode" && option["selected"] === true);
+  const selected = options.find((option2) => option2["category"] === "mode" && option2["selected"] === true);
   if (selected === void 0) {
     values.unshift({
       description: "Use the selected model's default reasoning effort",
@@ -21454,41 +21947,41 @@ function legacyReasoningEffortOptions(response) {
   return [result];
 }
 function normalizeGrokLifecycle(response) {
-  const lifecycle = isRecord3(response) ? response : {};
+  const lifecycle = isRecord4(response) ? response : {};
   const standard = normalizeConfigOptions(lifecycle["configOptions"], lifecycle["modes"]);
   const normalized = [...standard];
-  if (!normalized.some((option) => option.category === "model")) {
+  if (!normalized.some((option2) => option2.category === "model")) {
     normalized.push(...legacyModelOptions(response));
   }
-  if (!normalized.some((option) => option.category === "thought_level")) {
+  if (!normalized.some((option2) => option2.category === "thought_level")) {
     const efforts = legacyReasoningEffortOptions(response);
     if (efforts.length > 0) {
-      const modelIndex = normalized.findIndex((option) => option.category === "model");
+      const modelIndex = normalized.findIndex((option2) => option2.category === "model");
       normalized.splice(modelIndex < 0 ? normalized.length : modelIndex + 1, 0, ...efforts);
     }
   }
   return ensureReasoningEffortOption(normalized.slice(0, 100));
 }
 function updateCurrentValue2(current, category, value) {
-  return current.map((option) => option.category === category ? { ...option, currentValue: value } : option);
+  return current.map((option2) => option2.category === category ? { ...option2, currentValue: value } : option2);
 }
 function validateGrokResponse(response, modelId) {
-  if (!isRecord3(response) || !isRecord3(response["_meta"])) {
+  if (!isRecord4(response) || !isRecord4(response["_meta"])) {
     throw new SessionConfigProtocolError("Grok Build returned an invalid session configuration response");
   }
   const model = response["_meta"]["model"];
-  const appliedModel = isRecord3(model) ? model["Ok"] : model;
+  const appliedModel = isRecord4(model) ? model["Ok"] : model;
   if (appliedModel !== modelId) {
     throw new SessionConfigProtocolError("Grok Build returned an invalid session configuration response");
   }
 }
 var GrokBuildSessionConfigProtocol = class {
   configure = async (current, change, nativeSessionId, transport) => {
-    const existing = current.find((option) => option.id === change.configId);
+    const existing = current.find((option2) => option2.id === change.configId);
     if (existing === void 0 || existing.id !== LEGACY_MODEL_CONFIG_ID && existing.id !== LEGACY_REASONING_EFFORT_CONFIG_ID) {
       return await standardSessionConfigProtocol.configure(current, change, nativeSessionId, transport);
     }
-    const model = current.find((option) => option.category === "model");
+    const model = current.find((option2) => option2.category === "model");
     if (model === void 0) {
       return current;
     }
@@ -21514,10 +22007,10 @@ var GrokBuildSessionConfigProtocol = class {
     validateGrokResponse(response, modelId);
     const updated = updateCurrentValue2(current, existing.category, change.value);
     return existing.category === "thought_level" ? updated.map(
-      (option) => option.category === "thought_level" ? {
-        ...option,
-        values: option.values.filter((value) => value.value !== AGENT_DEFAULT_REASONING_EFFORT)
-      } : option
+      (option2) => option2.category === "thought_level" ? {
+        ...option2,
+        values: option2.values.filter((value) => value.value !== AGENT_DEFAULT_REASONING_EFFORT)
+      } : option2
     ) : updated;
   };
   normalizeLifecycle = (response) => normalizeGrokLifecycle(response);
@@ -21920,7 +22413,7 @@ function createWritableAcpStream(output2) {
 function truncate3(value, maximumLength) {
   return value.length <= maximumLength ? value : `${value.slice(0, Math.max(0, maximumLength - 1))}\u2026`;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString4(value, fallback = "") {
@@ -21948,12 +22441,12 @@ function normalizeElicitationOptions(schema) {
   const normalized = [];
   const oneOf = schema["oneOf"];
   if (Array.isArray(oneOf)) {
-    for (const option of oneOf) {
-      if (isRecord4(option) && typeof option["const"] === "string") {
+    for (const option2 of oneOf) {
+      if (isRecord5(option2) && typeof option2["const"] === "string") {
         normalized.push({
-          description: truncate3(readString4(option["description"]), 500),
-          label: truncate3(readString4(option["title"], option["const"]), 255),
-          value: truncate3(option["const"], 500)
+          description: truncate3(readString4(option2["description"]), 500),
+          label: truncate3(readString4(option2["title"], option2["const"]), 255),
+          value: truncate3(option2["const"], 500)
         });
       }
     }
@@ -21969,7 +22462,7 @@ function normalizeElicitationOptions(schema) {
     return normalized.slice(0, 200);
   }
   const items = schema["items"];
-  if (!isRecord4(items)) {
+  if (!isRecord5(items)) {
     return normalized;
   }
   const anyOf = items["anyOf"];
@@ -21982,7 +22475,7 @@ function numericString(value) {
   return typeof value === "number" && Number.isFinite(value) ? value.toString() : "";
 }
 function normalizeElicitationFields(requestedSchema) {
-  if (!isRecord4(requestedSchema) || !isRecord4(requestedSchema["properties"])) {
+  if (!isRecord5(requestedSchema) || !isRecord5(requestedSchema["properties"])) {
     return [];
   }
   const properties = requestedSchema["properties"];
@@ -21992,7 +22485,7 @@ function normalizeElicitationFields(requestedSchema) {
   );
   const normalized = [];
   for (const [name, property] of Object.entries(properties)) {
-    if (!isRecord4(property)) {
+    if (!isRecord5(property)) {
       continue;
     }
     const type = elicitationFieldType(property["type"]);
@@ -22083,7 +22576,7 @@ function validateElicitationContent(encoded, requestedSchema) {
       "invalid_elicitation_response"
     );
   }
-  if (!isRecord4(decoded) || !isRecord4(requestedSchema) || !isRecord4(requestedSchema["properties"])) {
+  if (!isRecord5(decoded) || !isRecord5(requestedSchema) || !isRecord5(requestedSchema["properties"])) {
     throw new AcpExecutionError(
       "Elicitation response does not match the requested form",
       {},
@@ -22103,7 +22596,7 @@ function validateElicitationContent(encoded, requestedSchema) {
   const validated = {};
   for (const [name, value] of Object.entries(decoded)) {
     const property = properties[name];
-    if (!isRecord4(property)) {
+    if (!isRecord5(property)) {
       throw new AcpExecutionError(
         `Elicitation field ${name} was not requested`,
         {},
@@ -22140,7 +22633,7 @@ function validateElicitationContent(encoded, requestedSchema) {
         );
       }
       const allowed = normalizeElicitationOptions(property);
-      if (allowed.length > 0 && value.some((entry) => !allowed.some((option) => option.value === entry))) {
+      if (allowed.length > 0 && value.some((entry) => !allowed.some((option2) => option2.value === entry))) {
         throw new AcpExecutionError(
           `Elicitation field ${name} contains an invalid selection`,
           {},
@@ -22637,7 +23130,7 @@ var AcpProcessSession = class _AcpProcessSession {
   };
   nativeSessionId = () => this.#nativeSessionId;
   configure = async (options) => {
-    const existing = this.#configOptions.find((option) => option.id === options.configId);
+    const existing = this.#configOptions.find((option2) => option2.id === options.configId);
     if (existing === void 0 || existing.type !== options.valueType) {
       throw new AcpExecutionError(
         "The requested ACP configuration option is unavailable",
@@ -22887,10 +23380,10 @@ var AcpProcessSession = class _AcpProcessSession {
   onPermission = async (request, signal) => {
     this.assertNativeSession(request.sessionId);
     const interactionId = `permission-${crypto.randomUUID()}`;
-    const options = request.options.slice(0, 20).map((option) => ({
-      kind: option.kind,
-      name: truncate3(option.name, 255),
-      optionId: truncate3(option.optionId, 255)
+    const options = request.options.slice(0, 20).map((option2) => ({
+      kind: option2.kind,
+      name: truncate3(option2.name, 255),
+      optionId: truncate3(option2.optionId, 255)
     }));
     if (options.length === 0) {
       throw new AcpExecutionError(
@@ -22899,7 +23392,7 @@ var AcpProcessSession = class _AcpProcessSession {
         "invalid_agent_permission_request"
       );
     }
-    const pending = new PendingPermission(interactionId, new Set(options.map((option) => option.optionId)));
+    const pending = new PendingPermission(interactionId, new Set(options.map((option2) => option2.optionId)));
     this.#pendingPermissions.set(interactionId, pending);
     const abort = () => {
       void this.cancelPermission(interactionId);
@@ -23109,7 +23602,7 @@ var AcpProcessSession = class _AcpProcessSession {
     }
     if (update.sessionUpdate === "current_mode_update") {
       this.#configOptions = this.#configOptions.map(
-        (option) => option.category === "mode" ? { ...option, currentValue: update.currentModeId } : option
+        (option2) => option2.category === "mode" ? { ...option2, currentValue: update.currentModeId } : option2
       );
       this.#configRevision += 1;
       await this.emitConfigUpdate();
@@ -23681,71 +24174,905 @@ async function runAcpPrompt(options) {
   } finally {
     await sessions.close();
   }
-}
-
-// src/audit/audit-store.ts
-import { mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
-import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-var AuditStore = class {
-  database;
-  constructor(path2) {
-    mkdirSync2(dirname2(path2), { recursive: true });
-    this.database = new DatabaseSync2(path2);
-    this.database.exec(`
-      CREATE TABLE IF NOT EXISTS audit_events (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        recorded_at TEXT NOT NULL,
-        event TEXT NOT NULL,
-        command_id TEXT NOT NULL,
-        session_id TEXT NOT NULL,
-        details_json TEXT NOT NULL DEFAULT '{}'
-      ) STRICT
-    `);
-    const columns = this.database.prepare("PRAGMA table_info(audit_events)").all();
-    if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
-      this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
-    }
+}
+
+// src/audit/audit-store.ts
+import { mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+var AuditStore = class {
+  database;
+  constructor(path2) {
+    mkdirSync2(dirname2(path2), { recursive: true });
+    this.database = new DatabaseSync2(path2);
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS audit_events (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        recorded_at TEXT NOT NULL,
+        event TEXT NOT NULL,
+        command_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        details_json TEXT NOT NULL DEFAULT '{}'
+      ) STRICT
+    `);
+    const columns = this.database.prepare("PRAGMA table_info(audit_events)").all();
+    if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
+      this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
+    }
+  }
+  record(record2) {
+    this.database.prepare(
+      `
+          INSERT INTO audit_events (
+            recorded_at,
+            event,
+            command_id,
+            session_id,
+            details_json
+          ) VALUES (?, ?, ?, ?, ?)
+        `
+    ).run(
+      (/* @__PURE__ */ new Date()).toISOString(),
+      record2.event,
+      record2.commandId,
+      record2.sessionId,
+      JSON.stringify(record2.details ?? {})
+    );
+  }
+  close() {
+    this.database.close();
+  }
+};
+
+// src/authorization/local-authorization-error.ts
+var LocalAuthorizationError = class extends Error {
+  code = "local_authorization_failed";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "LocalAuthorizationError";
+  }
+};
+
+// src/bots/bot-execution-context.ts
+import { randomBytes } from "node:crypto";
+
+// src/bots/local-bot-grant-store.ts
+import { createHash, randomUUID } from "node:crypto";
+import { stat as stat2 } from "node:fs/promises";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
+var LocalBotAuthorizationError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "LocalBotAuthorizationError";
+  }
+};
+var LocalBotGrant = class {
+  agent;
+  agentIdentityDigest;
+  allowedDeliveryTargetIds;
+  behaviorDigest;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  expiresAt;
+  localGrantId;
+  revocationEpoch;
+  workspaceIdentityDigest;
+  workspacePath;
+  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
+    this.localGrantId = localGrantId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.behaviorDigest = behaviorDigest;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.agent = agent;
+    this.agentIdentityDigest = agentIdentityDigest;
+    this.workspacePath = workspacePath;
+    this.workspaceIdentityDigest = workspaceIdentityDigest;
+    this.allowedDeliveryTargetIds = Object.freeze([...allowedDeliveryTargetIds]);
+    this.expiresAt = expiresAt;
+    this.revocationEpoch = revocationEpoch;
+  }
+};
+function digest(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function agentDigest(agent) {
+  return digest(
+    JSON.stringify({
+      adapter: agent.adapterIdentity,
+      agent: agent.agentIdentity,
+      agentVersion: agent.agentVersion,
+      arguments: agent.arguments,
+      id: agent.id
+    })
+  );
+}
+async function workspaceDigest(path2) {
+  const metadata = await stat2(path2);
+  if (!metadata.isDirectory()) {
+    throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
+  }
+  return digest(
+    JSON.stringify({
+      changedAtMilliseconds: metadata.ctimeMs,
+      device: metadata.dev,
+      inode: metadata.ino,
+      path: path2
+    })
+  );
+}
+function exactTargets(left, right) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  const expected = [...left].sort();
+  const actual = [...right].sort();
+  return expected.every((target, index) => target === actual[index]);
+}
+function rowString(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "string") {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function rowInteger(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function parseTargets(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid", { cause });
+  }
+  if (!Array.isArray(value) || value.some((target) => typeof target !== "string")) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value.filter((target) => typeof target === "string");
+}
+var LocalBotGrantStore = class {
+  #database;
+  constructor(path2) {
+    this.#database = new DatabaseSync3(path2);
+    this.#database.exec(`
+          CREATE TABLE IF NOT EXISTS local_bot_grants (
+            local_grant_id TEXT PRIMARY KEY,
+            bot_id TEXT NOT NULL,
+            behavior_revision_id TEXT NOT NULL,
+            behavior_digest TEXT NOT NULL,
+            binding_id TEXT NOT NULL UNIQUE,
+            binding_revision INTEGER NOT NULL,
+            agent_ref TEXT NOT NULL,
+            agent_identity_digest TEXT NOT NULL,
+            workspace_ref TEXT NOT NULL,
+            workspace_path TEXT NOT NULL,
+            workspace_identity_digest TEXT NOT NULL,
+            allowed_delivery_target_ids_json TEXT NOT NULL,
+            unattended_policy_json TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL,
+            revocation_epoch INTEGER NOT NULL DEFAULT 0,
+            revoked_at INTEGER
+          ) STRICT;
+          CREATE TABLE IF NOT EXISTS local_bot_binding_resolutions (
+            request_id TEXT PRIMARY KEY,
+            binding_id TEXT NOT NULL,
+            local_grant_id TEXT NOT NULL,
+            resolved_at INTEGER NOT NULL,
+            result TEXT NOT NULL CHECK (result IN ('approved', 'unavailable')),
+            error_code TEXT,
+            error_message TEXT
+          ) STRICT;
+        `);
+  }
+  approve = async (request, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const existing = this.#database.prepare(
+      `SELECT grants.* FROM local_bot_binding_resolutions AS resolutions
+                   INNER JOIN local_bot_grants AS grants
+                     ON grants.local_grant_id = resolutions.local_grant_id
+                  WHERE resolutions.request_id = ? AND resolutions.binding_id = ?
+                    AND resolutions.result = 'approved'`
+    ).get(request.requestId, request.bindingId);
+    if (existing !== void 0) {
+      return new BotExecutionBindingApprovedEvent(
+        request.requestId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.bindingId,
+        request.bindingRevision,
+        rowString(existing, "local_grant_id"),
+        rowString(existing, "agent_identity_digest"),
+        rowString(existing, "workspace_identity_digest")
+      );
+    }
+    const resolved = await this.resolveProposal(request, catalog, directories, bindingAuthorityId, signal);
+    const localGrantId = `lbg_${randomUUID()}`;
+    const expiresAt = now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS;
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#database.prepare(
+        `INSERT INTO local_bot_grants (
+                       local_grant_id, bot_id, behavior_revision_id, behavior_digest,
+                       binding_id, binding_revision, agent_ref,
+                       agent_identity_digest, workspace_ref, workspace_path,
+                       workspace_identity_digest, allowed_delivery_target_ids_json,
+                       unattended_policy_json, created_at, expires_at
+                     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(
+        localGrantId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.behaviorDigest,
+        request.bindingId,
+        request.bindingRevision,
+        request.agentRef,
+        resolved.agentIdentityDigest,
+        request.workspaceRef,
+        resolved.workspacePath,
+        resolved.workspaceIdentityDigest,
+        JSON.stringify(request.allowedDeliveryTargets.map((target) => target.deliveryTargetId)),
+        JSON.stringify({ localSideEffects: "owner-approval-required" }),
+        now,
+        expiresAt
+      );
+      this.#database.prepare(
+        `INSERT INTO local_bot_binding_resolutions (
+                       request_id, binding_id, local_grant_id, resolved_at, result
+                     ) VALUES (?, ?, ?, ?, 'approved')`
+      ).run(request.requestId, request.bindingId, localGrantId, now);
+      this.#database.exec("COMMIT");
+    } catch (cause) {
+      this.#database.exec("ROLLBACK");
+      throw cause;
+    }
+    signal.throwIfAborted();
+    return new BotExecutionBindingApprovedEvent(
+      request.requestId,
+      request.botId,
+      request.behaviorRevisionId,
+      request.bindingId,
+      request.bindingRevision,
+      localGrantId,
+      resolved.agentIdentityDigest,
+      resolved.workspaceIdentityDigest
+    );
+  };
+  resolveExecution = async (command, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const row = this.#database.prepare(
+      `SELECT * FROM local_bot_grants
+                  WHERE local_grant_id = ? AND bot_id = ?
+                    AND behavior_revision_id = ? AND behavior_digest = ?
+                    AND binding_id = ? AND binding_revision = ?
+                    AND agent_ref = ? AND workspace_ref = ?
+                    AND revoked_at IS NULL AND expires_at > ?`
+    ).get(
+      command.localGrantId,
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      command.agentId,
+      command.directoryId,
+      now
+    );
+    if (row === void 0) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution binding is not locally approved"
+      );
+    }
+    const approvedTargets = parseTargets(rowString(row, "allowed_delivery_target_ids_json"));
+    const requestedTargets = command.allowedDeliveryTargets.map((target) => target.deliveryTargetId);
+    if (!exactTargets(approvedTargets, requestedTargets)) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target policy changed after local approval"
+      );
+    }
+    const agent = catalog.find(command.agentId);
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    const workspacePath = await directories.resolve(bindingAuthorityId, command.directoryId, signal);
+    const currentAgentDigest = agentDigest(agent);
+    const currentWorkspaceDigest = await workspaceDigest(workspacePath);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged || currentAgentDigest !== rowString(row, "agent_identity_digest") || currentWorkspaceDigest !== rowString(row, "workspace_identity_digest") || workspacePath !== rowString(row, "workspace_path")) {
+      this.revoke(rowString(row, "local_grant_id"), now);
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target changed and requires local approval"
+      );
+    }
+    if (command.behaviorInstructions.length > 0 && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply the approved Bot behavior"
+      );
+    }
+    return new LocalBotGrant(
+      rowString(row, "local_grant_id"),
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      agent,
+      currentAgentDigest,
+      workspacePath,
+      currentWorkspaceDigest,
+      approvedTargets,
+      rowInteger(row, "expires_at"),
+      rowInteger(row, "revocation_epoch")
+    );
+  };
+  recordUnavailable = (request, code, message, now) => {
+    this.#database.prepare(
+      `INSERT OR IGNORE INTO local_bot_binding_resolutions (
+                   request_id, binding_id, local_grant_id, resolved_at,
+                   result, error_code, error_message
+                 ) VALUES (?, ?, '', ?, 'unavailable', ?, ?)`
+    ).run(request.requestId, request.bindingId, now, code, message);
+  };
+  close = () => {
+    this.#database.close();
+  };
+  resolveProposal = async (request, catalog, directories, bindingAuthorityId, signal) => {
+    const agent = catalog.find(request.agentRef);
+    if (request.requiredCapabilities.includes("embedded-context") && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply embedded Bot context"
+      );
+    }
+    if (request.requiredCapabilities.some((capability) => capability !== "embedded-context")) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The Bot requires an unsupported local Agent capability"
+      );
+    }
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent executable changed before approval"
+      );
+    }
+    const workspacePath = await directories.resolve(bindingAuthorityId, request.workspaceRef, signal);
+    return {
+      agent,
+      agentIdentityDigest: agentDigest(agent),
+      workspaceIdentityDigest: await workspaceDigest(workspacePath),
+      workspacePath
+    };
+  };
+  revoke = (localGrantId, now) => {
+    this.#database.prepare(
+      `UPDATE local_bot_grants
+                    SET revoked_at = COALESCE(revoked_at, ?), revocation_epoch = revocation_epoch + 1
+                  WHERE local_grant_id = ? AND revoked_at IS NULL`
+    ).run(now, localGrantId);
+  };
+};
+
+// src/bots/bot-execution-context.ts
+var ActiveBotExecutionContext = class {
+  command;
+  contextHandle;
+  constructor(contextHandle, command) {
+    this.contextHandle = contextHandle;
+    this.command = command;
+  }
+  resolveTarget = (target) => {
+    if (target === "current") {
+      if (!(this.command.replyRoute instanceof BotConnectionReplyRoute)) {
+        throw new LocalBotAuthorizationError(
+          "delivery_target_not_allowed",
+          "This Bot conversation has no external reply target"
+        );
+      }
+      return this.command.replyRoute.deliveryTargetId;
+    }
+    const resolved = this.command.allowedDeliveryTargets.find((candidate) => candidate.alias === target);
+    if (resolved === void 0) {
+      throw new LocalBotAuthorizationError(
+        "delivery_target_not_allowed",
+        "The named Bot delivery target is not approved"
+      );
+    }
+    return resolved.deliveryTargetId;
+  };
+};
+var BotExecutionContextLease = class {
+  context;
+  #release;
+  #released = false;
+  constructor(context, release) {
+    this.context = context;
+    this.#release = release;
+  }
+  release = () => {
+    if (this.#released) {
+      return;
+    }
+    this.#released = true;
+    this.#release();
+  };
+};
+var BotExecutionContextRegistry = class {
+  #activeByHandle = /* @__PURE__ */ new Map();
+  #handlesBySession = /* @__PURE__ */ new Map();
+  #inactiveHandles = /* @__PURE__ */ new Set();
+  #now;
+  constructor(now = Date.now) {
+    this.#now = now;
+  }
+  activate = (command) => {
+    let handle = this.#handlesBySession.get(command.sessionId);
+    if (handle === void 0) {
+      handle = `ctx_${randomBytes(32).toString("base64url")}`;
+      this.#handlesBySession.set(command.sessionId, handle);
+    }
+    if (this.#activeByHandle.has(handle)) {
+      throw new LocalBotAuthorizationError("session_busy", "The Bot execution context is already active");
+    }
+    const context = new ActiveBotExecutionContext(handle, command);
+    this.#inactiveHandles.delete(handle);
+    this.#activeByHandle.set(handle, context);
+    return new BotExecutionContextLease(context, () => {
+      if (this.#activeByHandle.get(handle) === context) {
+        this.#activeByHandle.delete(handle);
+        this.#inactiveHandles.add(handle);
+      }
+    });
+  };
+  read = (handle) => {
+    const context = this.#activeByHandle.get(handle);
+    if (context === void 0) {
+      if (this.#inactiveHandles.has(handle)) {
+        throw new LocalBotAuthorizationError(
+          "execution_capability_expired",
+          "The Bot execution capability has expired"
+        );
+      }
+      throw new LocalBotAuthorizationError(
+        "execution_context_required",
+        "An active Bot execution context is required"
+      );
+    }
+    if (Date.parse(context.command.executionDeadlineAt) <= this.#now()) {
+      throw new LocalBotAuthorizationError(
+        "execution_capability_expired",
+        "The Bot execution capability has expired"
+      );
+    }
+    return context;
+  };
+};
+
+// src/bots/bot-message-command.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { createConnection } from "node:net";
+var BOT_IPC_RESPONSE_LIMIT = 64 * 1024;
+var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
+var BotMessageCommandError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "BotMessageCommandError";
+  }
+};
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiredEnvironment(environment, name) {
+  const value = environment[name]?.trim();
+  if (value === void 0 || value.length === 0) {
+    throw new BotMessageCommandError(
+      "execution_context_required",
+      "This command is available only inside an active Mobius Bot execution"
+    );
+  }
+  return value;
+}
+function option(arguments_, name) {
+  const index = arguments_.indexOf(name);
+  if (index < 0 || index + 1 >= arguments_.length || arguments_[index + 1]?.startsWith("--") === true) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const value = arguments_[index + 1];
+  if (value === void 0) {
+    throw new BotMessageCommandError("invalid_request", "The Bot message option is missing");
+  }
+  return value;
+}
+function validateArguments(arguments_) {
+  if (arguments_.length !== 4) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const names = [arguments_[0], arguments_[2]];
+  if (!names.includes("--target") || !names.includes("--text") || names[0] === names[1]) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+}
+function decodeResponse(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data", {
+      cause
+    });
+  }
+  if (!isRecord6(value) || typeof value["ok"] !== "boolean") {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+  }
+  if (value["ok"] === true && typeof value["outboundMessageId"] === "string") {
+    return value["outboundMessageId"];
+  }
+  const error61 = value["error"];
+  if (value["ok"] === false && isRecord6(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
+    throw new BotMessageCommandError(error61["code"], error61["message"]);
+  }
+  throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+}
+async function requestLocalBotService(socketPath, payload, signal) {
+  signal.throwIfAborted();
+  return await new Promise((resolve5, reject) => {
+    const socket = createConnection(socketPath);
+    const chunks = [];
+    let length = 0;
+    let finished = false;
+    const finish = () => {
+      socket.removeAllListeners();
+      socket.destroy();
+    };
+    const fail = (error61) => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      finish();
+      if (error61 instanceof BotMessageCommandError) {
+        reject(error61);
+        return;
+      }
+      reject(
+        new BotMessageCommandError(
+          "execution_context_required",
+          "The active Mobius Bot execution is unavailable",
+          { cause: error61 }
+        )
+      );
+    };
+    const abort = () => fail(signal.reason);
+    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS, () => {
+      fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot service timed out"));
+    });
+    socket.once("error", fail);
+    socket.once("connect", () => socket.end(`${payload}
+`));
+    socket.on("data", (chunk) => {
+      length += chunk.byteLength;
+      if (length > BOT_IPC_RESPONSE_LIMIT) {
+        fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot response is too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.once("end", () => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      signal.removeEventListener("abort", abort);
+      try {
+        resolve5(decodeResponse(Buffer.concat(chunks).toString("utf8")));
+      } catch (error61) {
+        reject(error61);
+      } finally {
+        finish();
+      }
+    });
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+async function executeBotMessageCommand(arguments_, environment, signal) {
+  validateArguments(arguments_);
+  const contextHandle = requiredEnvironment(environment, "MOBIUS_BOT_CONTEXT");
+  const socketPath = requiredEnvironment(environment, "MOBIUS_BOT_SOCKET");
+  const target = option(arguments_, "--target");
+  const text = option(arguments_, "--text");
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(target) || text.trim().length === 0 || text.length > 1e4) {
+    throw new BotMessageCommandError("invalid_request", "The Bot outbound message is invalid");
+  }
+  return await requestLocalBotService(
+    socketPath,
+    JSON.stringify({
+      contextHandle,
+      idempotencyKey: `cli_${randomUUID2()}`,
+      target,
+      text
+    }),
+    signal
+  );
+}
+
+// src/bots/bot-outbound-ipc.ts
+import { chmod, mkdir, unlink } from "node:fs/promises";
+import { createServer } from "node:net";
+import { dirname as dirname3, isAbsolute } from "node:path";
+import { fetch } from "undici";
+var BOT_IPC_REQUEST_LIMIT = 32 * 1024;
+var BOT_IPC_TIMEOUT_MILLISECONDS2 = 2e4;
+var BOT_RELAY_TIMEOUT_MILLISECONDS = 2e4;
+var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var WINDOWS_NAMED_PIPE_PREFIX = "\\\\.\\pipe\\";
+var BotOutboundIpcRequest = class {
+  contextHandle;
+  idempotencyKey;
+  target;
+  text;
+  constructor(contextHandle, idempotencyKey, target, text) {
+    this.contextHandle = contextHandle;
+    this.idempotencyKey = idempotencyKey;
+    this.target = target;
+    this.text = text;
+  }
+};
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeRequest(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid", { cause });
+  }
+  if (!isRecord7(value)) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 4 || !keys.every((key) => ["contextHandle", "idempotencyKey", "target", "text"].includes(key))) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request fields are invalid");
+  }
+  const contextHandle = value["contextHandle"];
+  const idempotencyKey = value["idempotencyKey"];
+  const target = value["target"];
+  const text = value["text"];
+  if (typeof contextHandle !== "string" || !/^ctx_[a-zA-Z0-9_-]{43}$/.test(contextHandle) || typeof idempotencyKey !== "string" || !IDENTIFIER_PATTERN5.test(idempotencyKey) || typeof target !== "string" || !IDENTIFIER_PATTERN5.test(target) || typeof text !== "string" || text.trim().length === 0 || text.length > 1e4) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
+  }
+  return new BotOutboundIpcRequest(contextHandle, idempotencyKey, target, text);
+}
+function relayEndpoint(relayUrl, context, target) {
+  const endpoint = new URL(relayUrl);
+  if (endpoint.protocol !== "ws:" && endpoint.protocol !== "wss:") {
+    throw new LocalBotAuthorizationError("bot_service_unavailable", "The Mobius Relay URL is invalid");
+  }
+  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  endpoint.search = "";
+  const execution = encodeURIComponent(context.command.executionId);
+  if (target === "current") {
+    context.resolveTarget(target);
+    endpoint.pathname = `${MOBIUS_API_PREFIX}/v1/bot-executions/${execution}/reply-messages`;
+    return endpoint;
+  }
+  const deliveryTargetId = context.resolveTarget(target);
+  endpoint.pathname = `${MOBIUS_API_PREFIX}/v1/bot-executions/${execution}/delivery-targets/${encodeURIComponent(deliveryTargetId)}/messages`;
+  return endpoint;
+}
+function daemonToken(relayUrl) {
+  const token = relayUrl.searchParams.get("token") ?? "";
+  if (!/^[a-zA-Z0-9_-]{32,256}$/.test(token)) {
+    throw new LocalBotAuthorizationError("bot_service_unavailable", "The Runtime credential is unavailable");
+  }
+  return token;
+}
+async function decodeRelayResponse(response) {
+  const encoded = await response.text();
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("bot_service_unavailable", "The Mobius Relay returned invalid data", {
+      cause
+    });
+  }
+  if (response.status === 202 && isRecord7(value) && typeof value["outboundMessageId"] === "string") {
+    return value["outboundMessageId"];
   }
-  record(record2) {
-    this.database.prepare(
-      `
-          INSERT INTO audit_events (
-            recorded_at,
-            event,
-            command_id,
-            session_id,
-            details_json
-          ) VALUES (?, ?, ?, ?, ?)
-        `
-    ).run(
-      (/* @__PURE__ */ new Date()).toISOString(),
-      record2.event,
-      record2.commandId,
-      record2.sessionId,
-      JSON.stringify(record2.details ?? {})
-    );
+  if (isRecord7(value) && isRecord7(value["error"])) {
+    const error61 = value["error"];
+    if (typeof error61["code"] === "string" && typeof error61["message"] === "string") {
+      throw new LocalBotAuthorizationError(error61["code"], error61["message"]);
+    }
   }
-  close() {
-    this.database.close();
+  throw new LocalBotAuthorizationError("bot_service_unavailable", "The Mobius Relay rejected the Bot action");
+}
+var BotOutboundIpcServer = class {
+  #registry;
+  #relayUrl;
+  #server;
+  #socketPath;
+  #usesFilesystemSocket;
+  constructor(socketPath, relayUrl, registry2) {
+    const usesFilesystemSocket = !socketPath.startsWith(WINDOWS_NAMED_PIPE_PREFIX);
+    if (usesFilesystemSocket && !isAbsolute(socketPath)) {
+      throw new Error("The Bot IPC path must be absolute");
+    }
+    this.#registry = registry2;
+    this.#relayUrl = new URL(relayUrl);
+    this.#server = createServer({ allowHalfOpen: true }, (socket) => this.accept(socket));
+    this.#socketPath = socketPath;
+    this.#usesFilesystemSocket = usesFilesystemSocket;
   }
-};
-
-// src/authorization/local-authorization-error.ts
-var LocalAuthorizationError = class extends Error {
-  code = "local_authorization_failed";
-  constructor(message, options = {}) {
-    super(message, options);
-    this.name = "LocalAuthorizationError";
+  get socketPath() {
+    return this.#socketPath;
   }
+  listen = async (signal) => {
+    signal.throwIfAborted();
+    if (this.#usesFilesystemSocket) {
+      await mkdir(dirname3(this.#socketPath), { mode: 448, recursive: true });
+      await unlink(this.#socketPath).catch((error61) => {
+        if (!isRecord7(error61) || error61["code"] !== "ENOENT") {
+          throw error61;
+        }
+      });
+    }
+    await new Promise((resolve5, reject) => {
+      const fail = (error61) => reject(error61);
+      this.#server.once("error", fail);
+      this.#server.listen(this.#socketPath, () => {
+        this.#server.removeListener("error", fail);
+        resolve5();
+      });
+    });
+    if (this.#usesFilesystemSocket) {
+      await chmod(this.#socketPath, 384);
+    }
+    signal.addEventListener("abort", this.abort, { once: true });
+    if (signal.aborted) {
+      this.abort();
+    }
+  };
+  close = async () => {
+    if (this.#server.listening) {
+      await new Promise((resolve5, reject) => {
+        this.#server.close((error61) => {
+          if (error61 === void 0) {
+            resolve5();
+            return;
+          }
+          reject(error61);
+        });
+      });
+    }
+    if (this.#usesFilesystemSocket) {
+      await unlink(this.#socketPath).catch((error61) => {
+        if (!isRecord7(error61) || error61["code"] !== "ENOENT") {
+          throw error61;
+        }
+      });
+    }
+  };
+  #abort = () => {
+    this.#server.close();
+  };
+  abort = () => this.#abort();
+  accept = (socket) => {
+    const chunks = [];
+    let length = 0;
+    let rejected = false;
+    const controller = new AbortController();
+    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS2, () => {
+      controller.abort(new Error("Bot IPC request timed out"));
+      socket.destroy();
+    });
+    socket.on("data", (chunk) => {
+      length += chunk.byteLength;
+      if (length > BOT_IPC_REQUEST_LIMIT) {
+        rejected = true;
+        controller.abort(new Error("Bot IPC request is too large"));
+        socket.end(
+          JSON.stringify({
+            error: { code: "invalid_request", message: "The local Bot request is too large" },
+            ok: false
+          })
+        );
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.once("error", () => controller.abort());
+    socket.once("close", () => controller.abort());
+    socket.once("end", () => {
+      if (rejected) {
+        return;
+      }
+      void this.handle(Buffer.concat(chunks).toString("utf8").trim(), controller.signal).then(
+        (outboundMessageId) => {
+          if (!socket.destroyed) {
+            socket.end(JSON.stringify({ ok: true, outboundMessageId }));
+          }
+        },
+        (error61) => {
+          if (socket.destroyed) {
+            return;
+          }
+          const code = error61 instanceof LocalBotAuthorizationError ? error61.code : "bot_service_unavailable";
+          const message = error61 instanceof LocalBotAuthorizationError ? error61.message : "The local Bot action could not be completed";
+          socket.end(JSON.stringify({ error: { code, message }, ok: false }));
+        }
+      );
+    });
+  };
+  handle = async (encoded, signal) => {
+    const request = decodeRequest(encoded);
+    const context = this.#registry.read(request.contextHandle);
+    const timeout = AbortSignal.timeout(BOT_RELAY_TIMEOUT_MILLISECONDS);
+    const requestSignal = AbortSignal.any([signal, timeout]);
+    let response;
+    try {
+      response = await fetch(relayEndpoint(this.#relayUrl, context, request.target), {
+        body: JSON.stringify({ idempotencyKey: request.idempotencyKey, text: request.text }),
+        headers: {
+          authorization: `Bearer ${daemonToken(this.#relayUrl)}`,
+          "content-type": "application/json",
+          "x-mobius-bot-execution-capability": context.command.executionCapabilitySecret
+        },
+        method: "POST",
+        signal: requestSignal
+      });
+    } catch (cause) {
+      signal.throwIfAborted();
+      throw new LocalBotAuthorizationError(
+        timeout.aborted ? "bot_service_timeout" : "bot_service_unavailable",
+        timeout.aborted ? "The Mobius Bot action timed out" : "The Mobius Relay is unavailable",
+        { cause }
+      );
+    }
+    return await decodeRelayResponse(response);
+  };
 };
 
 // src/pairing/pair-local-machine.ts
-import { randomUUID } from "node:crypto";
-import { mkdir as mkdir3, open as open4, realpath as realpath6, rename as rename3, stat as stat5, writeFile as writeFile2 } from "node:fs/promises";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { mkdir as mkdir4, open as open4, realpath as realpath6, rename as rename3, stat as stat6, writeFile as writeFile2 } from "node:fs/promises";
 import { hostname as hostname3 } from "node:os";
 import { basename, join as join14, resolve as resolve3 } from "node:path";
-import { fetch as fetch2 } from "undici";
+import { fetch as fetch3 } from "undici";
 
 // src/agent-catalog/agent-discovery.ts
 var AgentDiscovery = class {
@@ -23853,8 +25180,8 @@ var LocalAgentInventory = class {
 };
 
 // src/agent-installation/managed-npm-package.ts
-import { mkdir, mkdtemp, open as open2, realpath as realpath2, rename, rm, stat as stat2 } from "node:fs/promises";
-import { delimiter, dirname as dirname3, isAbsolute, join as join4, relative, sep } from "node:path";
+import { mkdir as mkdir2, mkdtemp, open as open2, realpath as realpath2, rename, rm, stat as stat3 } from "node:fs/promises";
+import { delimiter, dirname as dirname4, isAbsolute as isAbsolute2, join as join4, relative, sep } from "node:path";
 var INSTALL_TIMEOUT_MILLISECONDS = 5 * 60 * 1e3;
 var PACKAGE_METADATA_LIMIT_BYTES = 64 * 1024;
 var PACKAGE_LOCK_LIMIT_BYTES = 8 * 1024 * 1024;
@@ -23901,7 +25228,7 @@ var ManagedNpmPackageError = class extends Error {
     this.name = "ManagedNpmPackageError";
   }
 };
-function isRecord5(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function packagePath(root, packageName) {
@@ -23909,7 +25236,7 @@ function packagePath(root, packageName) {
 }
 function isContainedPath(root, candidate) {
   const difference = relative(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep}`) && !isAbsolute(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep}`) && !isAbsolute2(difference);
 }
 async function readJsonRecord(path2, maximumBytes) {
   try {
@@ -23923,7 +25250,7 @@ async function readJsonRecord(path2, maximumBytes) {
         );
       }
       const value = JSON.parse(await handle.readFile({ encoding: "utf8" }));
-      if (!isRecord5(value)) {
+      if (!isRecord8(value)) {
         throw new ManagedNpmPackageError(
           "managed_package_verification_failed",
           "The managed npm package metadata is invalid"
@@ -23949,7 +25276,7 @@ function readBinPath(packageMetadata, executableName) {
   if (typeof bin === "string") {
     return bin;
   }
-  if (isRecord5(bin) && typeof bin[executableName] === "string") {
+  if (isRecord8(bin) && typeof bin[executableName] === "string") {
     return bin[executableName];
   }
   throw new ManagedNpmPackageError(
@@ -23965,7 +25292,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
     );
   }
   const packages = lock["packages"];
-  if (!isRecord5(packages)) {
+  if (!isRecord8(packages)) {
     throw new ManagedNpmPackageError(
       "managed_package_verification_failed",
       "The managed npm package lockfile is invalid"
@@ -23979,7 +25306,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
     if (verifyDependencyClosure && normalizedKey.length > 0) {
       let resolved;
       try {
-        if (!normalizedKey.split("/").includes("node_modules") || !isRecord5(candidate) || typeof candidate["version"] !== "string" || candidate["version"].length === 0 || typeof candidate["integrity"] !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(candidate["integrity"]) || typeof candidate["resolved"] !== "string") {
+        if (!normalizedKey.split("/").includes("node_modules") || !isRecord8(candidate) || typeof candidate["version"] !== "string" || candidate["version"].length === 0 || typeof candidate["integrity"] !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(candidate["integrity"]) || typeof candidate["resolved"] !== "string") {
           throw new Error("Invalid locked dependency");
         }
         resolved = new URL(candidate["resolved"]);
@@ -24002,7 +25329,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
       matches += 1;
     }
   }
-  if (matches !== 1 || !isRecord5(entry) || entry["integrity"] !== definition.integrity || entry["resolved"] !== definition.tarballUrl || entry["version"] !== definition.version) {
+  if (matches !== 1 || !isRecord8(entry) || entry["integrity"] !== definition.integrity || entry["resolved"] !== definition.tarballUrl || entry["version"] !== definition.version) {
     throw new ManagedNpmPackageError(
       "managed_package_verification_failed",
       "The managed npm package lockfile does not match the pinned artifact"
@@ -24075,7 +25402,7 @@ var ManagedNpmPackageInstaller = class {
   install = async (root, definition, environment, signal) => {
     signal.throwIfAborted();
     try {
-      const metadata = await stat2(root);
+      const metadata = await stat3(root);
       if (metadata.isDirectory()) {
         return await validateManagedNpmPackage(root, definition);
       }
@@ -24084,8 +25411,8 @@ var ManagedNpmPackageInstaller = class {
         throw error61;
       }
     }
-    const parent = dirname3(root);
-    await mkdir(parent, { mode: 448, recursive: true });
+    const parent = dirname4(root);
+    await mkdir2(parent, { mode: 448, recursive: true });
     const staging = await mkdtemp(join4(parent, `.${definition.version}.staging-`));
     try {
       const npm = await findExecutableOnPath(process.platform === "win32" ? "npm.cmd" : "npm", environment);
@@ -24119,7 +25446,7 @@ var ManagedNpmPackageInstaller = class {
         NPM_CONFIG_IGNORE_SCRIPTS: "true",
         NPM_CONFIG_PACKAGE_LOCK: "true",
         NPM_CONFIG_REGISTRY: "https://registry.npmjs.org/",
-        PATH: `${dirname3(process.execPath)}${delimiter}/usr/bin${delimiter}/bin`
+        PATH: `${dirname4(process.execPath)}${delimiter}/usr/bin${delimiter}/bin`
       };
       if (definition.includeOptionalDependencies) {
         installEnvironment["NPM_CONFIG_INCLUDE"] = "optional";
@@ -24342,8 +25669,8 @@ var CursorCliAgentSpecification = class extends DirectAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
-import { realpath as realpath3, stat as stat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join6, normalize } from "node:path";
+import { realpath as realpath3, stat as stat4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join6, normalize } from "node:path";
 
 // src/agent-installation/deepseek-managed-package.ts
 var DeepSeekHarnessManagedPackage = class extends SriManagedNpmPackageDefinition {
@@ -24361,12 +25688,12 @@ var DEEPSEEK_HARNESS_PACKAGE = new DeepSeekHarnessManagedPackage(
 
 // src/agent-catalog/agents/deepseek-harness-agent.ts
 async function validateAgentHome(path2) {
-  if (!isAbsolute2(path2) || normalize(path2) !== path2) {
+  if (!isAbsolute3(path2) || normalize(path2) !== path2) {
     throw new AgentProbeError("agent_environment_invalid", "The configured Agent home is invalid");
   }
   try {
     const resolved = await realpath3(path2);
-    const metadata = await stat3(resolved);
+    const metadata = await stat4(resolved);
     if (!metadata.isDirectory() || typeof process.getuid === "function" && metadata.uid !== process.getuid()) {
       throw new Error("Agent home is not a user-owned directory");
     }
@@ -24449,7 +25776,7 @@ var DeepSeekHarnessAgentSpecification = class extends DirectAcpAgentDefinition {
 
 // src/agent-catalog/agents/grok-build-agent.ts
 import { realpath as realpath4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join7, relative as relative2, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join7, relative as relative2, sep as sep2 } from "node:path";
 
 // src/agent-installation/grok-managed-package.ts
 var GROK_BUILD_MANAGED_VERSION = "1.0.21";
@@ -24512,7 +25839,7 @@ function grokBuildManagedPackage(platform, architecture) {
 // src/agent-catalog/agents/grok-build-agent.ts
 function isContainedPath2(root, candidate) {
   const difference = relative2(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute3(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep2}`) && !isAbsolute4(difference);
 }
 var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
   adapterVersion = GROK_BUILD_MANAGED_VERSION;
@@ -24574,13 +25901,13 @@ var GrokBuildAgentSpecification = class extends DirectAcpAgentDefinition {
 import { join as join9 } from "node:path";
 
 // src/agent-installation/managed-agent-archive.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { chmod, copyFile, mkdir as mkdir2, mkdtemp as mkdtemp2, open as open3, realpath as realpath5, rename as rename2, rm as rm2, stat as stat4, writeFile } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join8, relative as relative3, sep as sep3 } from "node:path";
+import { chmod as chmod2, copyFile, mkdir as mkdir3, mkdtemp as mkdtemp2, open as open3, realpath as realpath5, rename as rename2, rm as rm2, stat as stat5, writeFile } from "node:fs/promises";
+import { dirname as dirname5, isAbsolute as isAbsolute5, join as join8, relative as relative3, sep as sep3 } from "node:path";
 
 // src/agent-installation/verified-download.ts
-import { fetch } from "undici";
+import { fetch as fetch2 } from "undici";
 
 // src/network/environment-proxy.ts
 import { EnvHttpProxyAgent } from "undici";
@@ -24632,16 +25959,16 @@ var ManagedAgentArchiveError = class extends Error {
     this.name = "ManagedAgentArchiveError";
   }
 };
-function isRecord6(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isContainedPath3(root, candidate) {
   const difference = relative3(root, candidate);
-  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute4(difference);
+  return difference.length > 0 && difference !== ".." && !difference.startsWith(`..${sep3}`) && !isAbsolute5(difference);
 }
 async function hashFile(path2, signal) {
   signal.throwIfAborted();
-  const digest = createHash("sha256");
+  const digest2 = createHash2("sha256");
   const stream = createReadStream(path2, { signal });
   try {
     for await (const chunk of stream) {
@@ -24652,9 +25979,9 @@ async function hashFile(path2, signal) {
           "The managed Agent archive produced invalid bytes"
         );
       }
-      digest.update(chunk);
+      digest2.update(chunk);
     }
-    return digest.digest("hex");
+    return digest2.digest("hex");
   } catch (error61) {
     if (signal.aborted) {
       signal.throwIfAborted();
@@ -24689,7 +26016,7 @@ async function readManifest(path2) {
       );
     }
     const parsed = JSON.parse(await handle.readFile({ encoding: "utf8" }));
-    if (!isRecord6(parsed)) {
+    if (!isRecord9(parsed)) {
       throw new ManagedAgentArchiveError(
         "managed_archive_verification_failed",
         "The managed Agent archive manifest is invalid"
@@ -24712,7 +26039,7 @@ async function readManifest(path2) {
 async function validateManagedAgentArchive(root, definition, signal) {
   try {
     const rootPath = await realpath5(root);
-    const rootMetadata = await stat4(rootPath);
+    const rootMetadata = await stat5(rootPath);
     if (!rootMetadata.isDirectory() || typeof process.getuid === "function" && rootMetadata.uid !== process.getuid()) {
       throw new Error("Managed Agent root is not user-owned");
     }
@@ -24927,7 +26254,7 @@ var PiAgentSpecification = class extends BridgedAcpAgentDefinition {
 };
 
 // src/agent-catalog/agents/workbuddy-agent.ts
-import { isAbsolute as isAbsolute5, join as join11 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
 
 // src/agent-installation/workbuddy-managed-package.ts
 var WORKBUDDY_MANAGED_VERSION = "2.146.0";
@@ -24993,7 +26320,7 @@ var WorkBuddyAgentSpecification = class extends DirectAcpAgentDefinition {
     }
     const requestedPaths = [join11("/Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH)];
     const homeDirectory = context.environment["HOME"];
-    if (homeDirectory !== void 0 && isAbsolute5(homeDirectory)) {
+    if (homeDirectory !== void 0 && isAbsolute6(homeDirectory)) {
       requestedPaths.unshift(join11(homeDirectory, "Applications", ...WORKBUDDY_MACOS_EXECUTABLE_PATH));
     }
     const executables = [];
@@ -25039,7 +26366,7 @@ import {
 } from "@agentclientprotocol/sdk";
 
 // src/agent-catalog/executable-discovery.ts
-import { isAbsolute as isAbsolute6, join as join13 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join13 } from "node:path";
 
 // src/agent-installation/managed-adapter-installer.ts
 import { join as join12 } from "node:path";
@@ -25144,7 +26471,7 @@ async function resolveManagedAdapterExecutable(specification, context) {
 async function resolveSpecificationExecutables(executableName, overrideVariable, resolveInstalled, resolveManaged, context) {
   const override = context.environment[overrideVariable];
   if (override !== void 0) {
-    if (override.length === 0 || !isAbsolute6(override)) {
+    if (override.length === 0 || !isAbsolute7(override)) {
       return [];
     }
     const executable = await resolveExecutablePath(override, context.platform);
@@ -25564,8 +26891,8 @@ async function discoverLocalAgentInventory(options) {
 // src/pairing/pair-local-machine.ts
 var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
 var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
-var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
-var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var IDENTIFIER_PATTERN6 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var TOKEN_PATTERN2 = /^[a-zA-Z0-9_-]{32,256}$/;
 var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
 var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken", "runtimeId"];
 var SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "daemonToken", "relayOrigin"];
@@ -25577,36 +26904,36 @@ var PairingClientError = class extends Error {
     this.name = "PairingClientError";
   }
 };
-function isRecord7(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
   const keys = Object.keys(value);
   return keys.length === expectedKeys.length && expectedKeys.every((key) => Object.hasOwn(value, key));
 }
-function readSingleOption(arguments_, option) {
+function readSingleOption(arguments_, option2) {
   const values = [];
   for (let index = 0; index < arguments_.length; index += 1) {
-    if (arguments_[index] !== option) {
+    if (arguments_[index] !== option2) {
       continue;
     }
     const value = arguments_[index + 1];
     if (value === void 0 || value.startsWith("--")) {
-      throw new PairingClientError("invalid_arguments", `${option} requires a value`);
+      throw new PairingClientError("invalid_arguments", `${option2} requires a value`);
     }
     values.push(value);
     index += 1;
   }
   if (values.length !== 1) {
-    throw new PairingClientError("invalid_arguments", `${option} must be provided exactly once`);
+    throw new PairingClientError("invalid_arguments", `${option2} must be provided exactly once`);
   }
   return values[0] ?? "";
 }
 function assertKnownArguments(arguments_) {
   for (let index = 0; index < arguments_.length; index += 2) {
-    const option = arguments_[index];
-    if (option !== "--url" && option !== "--code" && option !== "--workspace") {
-      throw new PairingClientError("invalid_arguments", `Unknown pairing option: ${option ?? "missing option"}`);
+    const option2 = arguments_[index];
+    if (option2 !== "--url" && option2 !== "--code" && option2 !== "--workspace") {
+      throw new PairingClientError("invalid_arguments", `Unknown pairing option: ${option2 ?? "missing option"}`);
     }
   }
 }
@@ -25654,7 +26981,7 @@ function parseChannelArgument(arguments_) {
     throw new PairingClientError("invalid_arguments", "Usage: mobius start --channel <channel-id>");
   }
   const channelId = arguments_[1] ?? "";
-  if (!IDENTIFIER_PATTERN4.test(channelId)) {
+  if (!IDENTIFIER_PATTERN6.test(channelId)) {
     throw new PairingClientError("invalid_channel_id", "The saved channel ID is invalid");
   }
   return channelId;
@@ -25662,9 +26989,9 @@ function parseChannelArgument(arguments_) {
 async function resolveDefaultWorkspace(path2) {
   const requestedWorkspace = resolve3(path2);
   try {
-    await mkdir3(requestedWorkspace, { recursive: true, mode: 448 });
+    await mkdir4(requestedWorkspace, { recursive: true, mode: 448 });
     const defaultWorkspace = await realpath6(requestedWorkspace);
-    const metadata = await stat5(defaultWorkspace);
+    const metadata = await stat6(defaultWorkspace);
     if (!metadata.isDirectory()) {
       throw new PairingClientError("invalid_workspace", "The default workspace is not a directory");
     }
@@ -25693,9 +27020,9 @@ async function readJsonResponse(response) {
   }
 }
 function readRelayError(value) {
-  if (isRecord7(value)) {
+  if (isRecord10(value)) {
     const error61 = value["error"];
-    if (isRecord7(error61)) {
+    if (isRecord10(error61)) {
       const code = error61["code"];
       const message = error61["message"];
       if (typeof code === "string" && typeof message === "string") {
@@ -25706,16 +27033,16 @@ function readRelayError(value) {
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
 function decodeClaimResponse(value) {
-  if (!isRecord7(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
+  if (!isRecord10(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
+  const daemonToken2 = value["daemonToken"];
   const runtimeId = value["runtimeId"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN4.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN4.test(runtimeId)) {
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN6.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN6.test(runtimeId)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
-  return { channelId, daemonToken, runtimeId };
+  return { channelId, daemonToken: daemonToken2, runtimeId };
 }
 async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
   const agents = localAgents.map((agent) => ({
@@ -25728,7 +27055,7 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   const endpoint = mobiusApiUrl(options.relayOrigin, "/pairings/claim");
   let response;
   try {
-    response = await fetch2(endpoint, {
+    response = await fetch3(endpoint, {
       body: JSON.stringify({
         agents,
         installableAgents,
@@ -25750,18 +27077,18 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   }
   return decodeClaimResponse(value);
 }
-async function persistConnection(channelId, relayOrigin, daemonToken, defaultWorkspace) {
+async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWorkspace) {
   const connectionsDirectory = join14(readStateDirectory(), "connections");
-  await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
+  await mkdir4(connectionsDirectory, { mode: 448, recursive: true });
   const connectionPath = join14(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID()}.tmp`);
+  const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID3()}.tmp`);
   await writeFile2(
     temporaryPath,
     `${JSON.stringify(
       {
         defaultWorkspace,
         channelId,
-        daemonToken,
+        daemonToken: daemonToken2,
         relayOrigin: relayOrigin.toString()
       },
       null,
@@ -25774,20 +27101,20 @@ async function persistConnection(channelId, relayOrigin, daemonToken, defaultWor
   return connectionPath;
 }
 function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord7(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
+  if (!isRecord10(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   const defaultWorkspace = value["defaultWorkspace"];
   const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
+  const daemonToken2 = value["daemonToken"];
   const relayOrigin = value["relayOrigin"];
-  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN4.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN6.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof relayOrigin !== "string") {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   return {
     defaultWorkspace,
     channelId,
-    daemonToken,
+    daemonToken: daemonToken2,
     relayOrigin: parseRelayOrigin(relayOrigin)
   };
 }
@@ -25888,12 +27215,13 @@ async function resumeLocalMachine(arguments_, signal = new AbortController().sig
 }
 
 // src/run-daemon.ts
-import { basename as basename3 } from "node:path";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { basename as basename3, join as join16 } from "node:path";
 import { styleText } from "node:util";
-import { fetch as fetch5, WebSocket as WebSocket2 } from "undici";
+import { fetch as fetch6, WebSocket as WebSocket2 } from "undici";
 
 // src/agent-catalog/publish-agent-catalog.ts
-import { fetch as fetch3 } from "undici";
+import { fetch as fetch4 } from "undici";
 var CATALOG_UPDATE_TIMEOUT_MILLISECONDS = 2e4;
 var AgentCatalogPublishError = class extends Error {
   code = "agent_catalog_update_failed";
@@ -25918,7 +27246,7 @@ async function publishAgentCatalog(config2, signal) {
   let response;
   const catalog = config2.catalog.read();
   try {
-    response = await fetch3(catalogEndpoint(config2.relayUrl), {
+    response = await fetch4(catalogEndpoint(config2.relayUrl), {
       body: JSON.stringify({
         agents: catalog.agents.map((agent) => ({
           agentPath: agent.agentIdentity.requestedPath,
@@ -26413,9 +27741,9 @@ var FixedInstallationExecutor = class {
 };
 
 // src/authorization/workspace-directory.ts
-import { readdir, realpath as realpath7, stat as stat6 } from "node:fs/promises";
+import { readdir, realpath as realpath7, stat as stat7 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute7, join as join15, normalize as normalize2, relative as relative4 } from "node:path";
+import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute8, join as join15, normalize as normalize2, relative as relative4 } from "node:path";
 var WorkspaceDirectoryListing = class {
   directoryId;
   directoryLabel;
@@ -26467,7 +27795,7 @@ var WorkspaceDirectoryService = class {
     }
     if (id.startsWith("path-")) {
       const path2 = decodePath(id, "path-");
-      if (isAbsolute7(path2)) {
+      if (isAbsolute8(path2)) {
         return path2;
       }
     }
@@ -26475,15 +27803,15 @@ var WorkspaceDirectoryService = class {
   };
   resolvePath = async (requested, signal) => {
     signal.throwIfAborted();
-    if (!isAbsolute7(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
+    if (!isAbsolute8(requested) || requested.includes("\0") || normalize2(requested) !== requested) {
       throw new LocalAuthorizationError("The local directory path is invalid");
     }
     try {
       const target = await realpath7(requested);
       signal.throwIfAborted();
-      const metadata = await stat6(target);
+      const metadata = await stat7(target);
       signal.throwIfAborted();
-      if (!isAbsolute7(target) || normalize2(target) !== target || !metadata.isDirectory()) {
+      if (!isAbsolute8(target) || normalize2(target) !== target || !metadata.isDirectory()) {
         throw new LocalAuthorizationError("The selected location is not a directory");
       }
       return target;
@@ -26499,7 +27827,7 @@ var WorkspaceDirectoryService = class {
   };
   label = (path2) => {
     const suffix = relative4(homedir2(), path2);
-    return suffix === "" ? "~" : !isAbsolute7(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
+    return suffix === "" ? "~" : !isAbsolute8(suffix) && suffix !== ".." && !suffix.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) ? `~/${suffix.replaceAll("\\", "/")}` : path2;
   };
   identify = async (bindingId, requestedPath, signal) => {
     this.authorizeMachine(bindingId);
@@ -26539,7 +27867,7 @@ var WorkspaceDirectoryService = class {
         }
       }
       entries.sort((a, b) => a.name.localeCompare(b.name));
-      const parent = dirname5(target);
+      const parent = dirname6(target);
       return new WorkspaceDirectoryListing(
         id,
         this.label(target),
@@ -26563,8 +27891,44 @@ var WorkspaceDirectoryService = class {
   };
 };
 
+// src/bots/bot-context-applicator.ts
+var AppliedBotContext = class {
+  resources;
+  constructor(resources) {
+    this.resources = Object.freeze([...resources]);
+  }
+};
+var EmbeddedBotContextApplicator = class {
+  apply = async (command, grant, resources, signal) => {
+    signal.throwIfAborted();
+    if (grant.botId !== command.botId || grant.behaviorRevisionId !== command.behaviorRevisionId || grant.behaviorDigest !== command.behaviorDigest) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot behavior does not match its local authorization"
+      );
+    }
+    if (command.behaviorInstructions.length === 0) {
+      return new AppliedBotContext(resources);
+    }
+    if (!grant.agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot enforce the Bot behavior context"
+      );
+    }
+    const trustedContext = {
+      mimeType: "text/markdown",
+      name: "Mobius Bot behavior",
+      text: command.behaviorInstructions,
+      type: "embedded",
+      uri: `mobius://bots/${encodeURIComponent(command.botId)}/behavior-revisions/${encodeURIComponent(command.behaviorRevisionId)}?sha256=${command.behaviorDigest}`
+    };
+    return new AppliedBotContext([trustedContext, ...resources]);
+  };
+};
+
 // src/native-sessions/service.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/native-sessions/codex-history.ts
 import { spawn as spawn4 } from "node:child_process";
@@ -26880,7 +28244,7 @@ var NativeSessionService = class {
         if (authorized === null) {
           continue;
         }
-        const entryId = randomUUID2();
+        const entryId = randomUUID4();
         if (this.#entries.size >= 5e3) {
           this.#entries.clear();
         }
@@ -26908,7 +28272,7 @@ var NativeSessionService = class {
             "invalid_native_session_response"
           );
         }
-        nextCursor = randomUUID2();
+        nextCursor = randomUUID4();
         if (this.#cursors.size >= 500) {
           this.#cursors.clear();
         }
@@ -27126,13 +28490,13 @@ var NativeSessionService = class {
 };
 
 // src/prompt-artifact-resolver.ts
-import { createHash as createHash2 } from "node:crypto";
-import { fetch as fetch4 } from "undici";
+import { createHash as createHash3 } from "node:crypto";
+import { fetch as fetch5 } from "undici";
 var ARTIFACT_SCHEME = "mobius-artifact:";
 var ARTIFACT_DOWNLOAD_TIMEOUT_MILLISECONDS = 2e4;
 var MAX_AGENT_IMAGE_BASE64_LENGTH = 4e6;
 var MAX_AGENT_RESOURCE_BYTE_LENGTH = 1e6;
-var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN7 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var PromptArtifactError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -27175,7 +28539,7 @@ function parseReference(resource) {
   const encodedByteLength2 = url2.searchParams.get("byteLength") ?? "";
   const sha256 = url2.searchParams.get("sha256") ?? "";
   const byteLength = Number(encodedByteLength2);
-  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN5.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
+  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN7.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
     throw new PromptArtifactError("artifact_reference_invalid", "The prompt artifact reference is invalid");
   }
   return new PromptArtifactReference(artifactId, byteLength, sha256, resource);
@@ -27236,7 +28600,7 @@ async function download(config2, command, reference, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch4(downloadUrl(config2, command, reference), {
+    response = await fetch5(downloadUrl(config2, command, reference), {
       dispatcher: environmentProxyDispatcher,
       headers: { accept: reference.resource.mimeType },
       signal: requestSignal
@@ -27256,7 +28620,7 @@ async function download(config2, command, reference, signal) {
       );
     }
     const bytes = await responseBytes(response, reference.byteLength, requestSignal);
-    if (createHash2("sha256").update(bytes).digest("hex") !== reference.sha256) {
+    if (createHash3("sha256").update(bytes).digest("hex") !== reference.sha256) {
       throw new PromptArtifactError(
         "artifact_integrity_failed",
         "The prompt artifact failed integrity validation"
@@ -27401,7 +28765,7 @@ function connectRelay(url2, signal) {
 }
 
 // src/relay-connection/liveness.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var HEARTBEAT_ACK_TIMEOUT_MILLISECONDS = 1e4;
 var HEARTBEAT_INTERVAL_MILLISECONDS = 2e4;
 var RelayLivenessState = class {
@@ -27489,7 +28853,7 @@ var RelayConnectionLiveness = class {
       }
       throw new Error("Heartbeat was scheduled in an invalid state");
     }
-    const heartbeatId = randomUUID3();
+    const heartbeatId = randomUUID5();
     this.#state = new AwaitingHeartbeatAckState(
       heartbeatId,
       this.#timer.schedule(this.#handleTimeout, HEARTBEAT_ACK_TIMEOUT_MILLISECONDS)
@@ -27505,8 +28869,8 @@ var RelayConnectionLiveness = class {
 
 // src/relay-connection/session-event-outbox.ts
 import { mkdirSync as mkdirSync3 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
-import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+import { dirname as dirname7 } from "node:path";
+import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 function readPendingEnvelope(row) {
   if (typeof row !== "object" || row === null || Array.isArray(row)) {
     throw new Error("SQLite returned an invalid session event outbox row");
@@ -27520,8 +28884,8 @@ function readPendingEnvelope(row) {
 var SessionEventOutbox = class {
   #database;
   constructor(path2) {
-    mkdirSync3(dirname6(path2), { recursive: true });
-    this.#database = new DatabaseSync3(path2);
+    mkdirSync3(dirname7(path2), { recursive: true });
+    this.#database = new DatabaseSync4(path2);
     this.#database.exec(`
       CREATE TABLE IF NOT EXISTS relay_session_event_outbox (
         ordinal INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -27531,6 +28895,15 @@ var SessionEventOutbox = class {
       ) STRICT;
       CREATE INDEX IF NOT EXISTS relay_session_event_outbox_order
         ON relay_session_event_outbox(ordinal);
+      CREATE TABLE IF NOT EXISTS relay_session_event_dead_letters (
+        ordinal INTEGER PRIMARY KEY,
+        event_id TEXT NOT NULL UNIQUE,
+        session_id TEXT NOT NULL,
+        envelope_json TEXT NOT NULL,
+        rejection_code TEXT NOT NULL CHECK (
+          rejection_code IN ('session_deleted', 'session_not_found')
+        )
+      ) STRICT;
       CREATE TABLE IF NOT EXISTS relay_session_event_sources (
         source_key TEXT PRIMARY KEY,
         next_source_seq INTEGER NOT NULL
@@ -27603,6 +28976,35 @@ var SessionEventOutbox = class {
          WHERE event_id = ? AND session_id = ?`
     ).run(acknowledgement.eventId, acknowledgement.sessionId);
   };
+  quarantine = (rejection) => {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const insertion = this.#database.prepare(
+        `INSERT INTO relay_session_event_dead_letters (
+             ordinal, event_id, session_id, envelope_json, rejection_code
+           )
+           SELECT ordinal, event_id, session_id, envelope_json, ?
+           FROM relay_session_event_outbox
+           WHERE event_id = ? AND session_id = ?`
+      ).run(rejection.code, rejection.eventId, rejection.sessionId);
+      if (insertion.changes !== 1) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const deletion = this.#database.prepare(
+        `DELETE FROM relay_session_event_outbox
+           WHERE event_id = ? AND session_id = ?`
+      ).run(rejection.eventId, rejection.sessionId);
+      if (deletion.changes !== 1) {
+        throw new Error("The rejected session event could not be removed from the durable outbox");
+      }
+      this.#database.exec("COMMIT");
+      return true;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
   close = () => {
     this.#database.close();
   };
@@ -27674,6 +29076,12 @@ var RELAY_RECONNECT_DELAY_MILLISECONDS = 500;
 var RELAY_CONNECTION_REFRESH_MILLISECONDS = 20 * 60 * 1e3;
 var ACTIVE_TURN_RECONCILIATION_TIMEOUT_MILLISECONDS = 2e4;
 var ACTIVE_TURN_RECONCILIATION_CLOSE_CODE = 4009;
+function botIpcSocketPath() {
+  if (process.platform === "win32") {
+    return `\\\\.\\pipe\\mobius-bot-${randomUUID6()}`;
+  }
+  return join16("/tmp", `mobius-bot-${randomUUID6()}.sock`);
+}
 var RelayConnectionRefreshState = class {
 };
 var ScheduledRelayConnectionRefreshState = class extends RelayConnectionRefreshState {
@@ -27931,7 +29339,7 @@ async function reconcileActiveTurn(config2, turn, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch5(activeTurnReconciliationEndpoint(config2, turn), {
+    response = await fetch6(activeTurnReconciliationEndpoint(config2, turn), {
       body: JSON.stringify({ outcome: { kind: "running" } }),
       dispatcher: environmentProxyDispatcher,
       headers: { "content-type": "application/json" },
@@ -28034,13 +29442,13 @@ function reportFailure(publisher, command, code, message, attemptId) {
   );
 }
 function operationErrorCode(error61) {
-  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof PromptArtifactError) {
+  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof LocalBotAuthorizationError || error61 instanceof PromptArtifactError) {
     return error61.code;
   }
   return "session_operation_failed";
 }
 function operationErrorMessage(error61) {
-  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof PromptArtifactError) {
+  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof LocalBotAuthorizationError || error61 instanceof PromptArtifactError) {
     return error61.message;
   }
   return "The local agent operation could not be completed";
@@ -28305,6 +29713,175 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
     console.error("Mobius daemon command failed", error61);
   }
 }
+function botExecutionAgent(agent, contextHandle, socketPath) {
+  return new LocalAgentDefinition(
+    agent.id,
+    agent.label,
+    agent.command,
+    agent.arguments,
+    {
+      ...agent.environment,
+      MOBIUS_BOT_CONTEXT: contextHandle,
+      MOBIUS_BOT_SOCKET: socketPath,
+      MOBIUS_RELAY_TOKEN: "",
+      MOBIUS_RELAY_URL: ""
+    },
+    agent.adapterVersion,
+    agent.agentVersion,
+    agent.adapterIdentity,
+    agent.agentIdentity,
+    agent.promptTimeoutMilliseconds,
+    agent.capabilities
+  );
+}
+async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, signal) {
+  try {
+    if (command.additionalDirectoryIds.length > 0) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution requested unapproved additional directories"
+      );
+    }
+    const deadline = Date.parse(command.executionDeadlineAt);
+    const remaining = deadline - Date.now();
+    if (!Number.isSafeInteger(deadline) || remaining <= 0) {
+      throw new LocalBotAuthorizationError("turn_expired", "The Bot execution deadline has expired");
+    }
+    const grant = await grants.resolveExecution(
+      command,
+      config2.catalog,
+      directories,
+      config2.bindingId,
+      Date.now(),
+      signal
+    );
+    const attachments = await resolvePromptArtifacts(config2, command, signal);
+    const applied = await applicator.apply(command, grant, attachments.resources, signal);
+    const lease = contexts.activate(command);
+    try {
+      const deadlineSignal = AbortSignal.timeout(remaining);
+      const executionSignal = AbortSignal.any([signal, deadlineSignal]);
+      const agent = botExecutionAgent(grant.agent, lease.context.contextHandle, ipc.socketPath);
+      audit.record({
+        commandId: command.commandId,
+        details: {
+          behaviorRevisionId: command.behaviorRevisionId,
+          bindingId: command.bindingId,
+          botId: command.botId,
+          executionId: command.executionId,
+          localGrantId: command.localGrantId
+        },
+        event: "bot_session_authorized",
+        sessionId: command.sessionId
+      });
+      outbox.transitionExecution(command.commandId, "running");
+      publisher.recordAttempt(
+        command.sessionId,
+        encodeSessionStartedEvent({
+          attemptId,
+          commandId: command.commandId,
+          kind: SESSION_STARTED_KIND,
+          sessionId: command.sessionId
+        }),
+        attemptId
+      );
+      const result = await sessions.runPrompt({
+        additionalDirectories: [],
+        agent,
+        commandId: command.commandId,
+        cwd: grant.workspacePath,
+        images: attachments.images,
+        onActivity: (activity) => {
+          publisher.recordAttempt(
+            command.sessionId,
+            encodeAgentActivityEvent({
+              activityId: activity.activityId,
+              activityType: activity.activityType,
+              commandId: command.commandId,
+              content: activity.content,
+              detail: activity.detail,
+              input: activity.input,
+              kind: AGENT_ACTIVITY_KIND,
+              locations: activity.locations,
+              name: activity.name,
+              output: activity.output,
+              sequence: activity.sequence,
+              sessionId: command.sessionId,
+              status: activity.status,
+              title: activity.title,
+              toolKind: activity.toolKind
+            }),
+            attemptId
+          );
+          return Promise.resolve();
+        },
+        onText: (text) => {
+          publisher.recordAttempt(
+            command.sessionId,
+            encodeAgentMessageDeltaEvent({
+              commandId: command.commandId,
+              kind: AGENT_MESSAGE_DELTA_KIND,
+              sessionId: command.sessionId,
+              text
+            }),
+            attemptId
+          );
+          return Promise.resolve();
+        },
+        prompt: command.prompt,
+        resources: applied.resources,
+        sessionId: command.sessionId,
+        signal: executionSignal
+      });
+      publisher.recordAttempt(
+        command.sessionId,
+        encodeSessionCompletedEvent({
+          commandId: command.commandId,
+          kind: SESSION_COMPLETED_KIND,
+          sessionId: command.sessionId,
+          stopReason: result.stopReason
+        }),
+        attemptId
+      );
+      outbox.transitionExecution(
+        command.commandId,
+        result.stopReason === "cancelled" ? "cancelled" : "succeeded"
+      );
+      audit.record({
+        commandId: command.commandId,
+        details: { botId: command.botId, executionId: command.executionId },
+        event: result.stopReason === "cancelled" ? "bot_session_cancelled" : "bot_session_completed",
+        sessionId: command.sessionId
+      });
+    } finally {
+      lease.release();
+    }
+  } catch (error61) {
+    const failure = Date.parse(command.executionDeadlineAt) <= Date.now() ? new LocalBotAuthorizationError("turn_expired", "The Bot execution deadline has expired", {
+      cause: error61
+    }) : error61;
+    audit.record({
+      commandId: command.commandId,
+      details: {
+        botId: command.botId,
+        code: operationErrorCode(failure),
+        executionId: command.executionId
+      },
+      event: "bot_session_failed",
+      sessionId: command.sessionId
+    });
+    const code = operationErrorCode(failure);
+    reportFailure(
+      publisher,
+      command,
+      code === "session_operation_failed" ? "agent_execution_failed" : code,
+      code === "session_operation_failed" ? "The local agent could not complete the Bot request" : operationErrorMessage(failure),
+      attemptId
+    );
+    outbox.transitionExecution(command.commandId, "failed");
+    console.error("Mobius daemon Bot command failed", failure);
+  }
+}
 function waitForRelayRetry(signal, timer) {
   if (signal.aborted) {
     return Promise.resolve();
@@ -28341,7 +29918,7 @@ async function publishAgentCatalogUntilAvailable(config2, signal, timer) {
     }
   }
 }
-async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, publisher, activeTurns, activeAttemptIds, onConnected, signal, timer) {
+async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, publisher, grants, contexts, applicator, ipc, activeTurns, activeAttemptIds, onConnected, signal, timer) {
   const relayUrl = new URL(config2.relayUrl);
   relayUrl.searchParams.set("liveness", "1");
   const socket = await connectRelay(relayUrl, signal);
@@ -28424,6 +30001,76 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             outbox.acknowledge(decodeSessionEventAcknowledgement(encoded));
             return;
           }
+          if (kind === SESSION_EVENT_REJECTED_KIND) {
+            const rejection = decodeSessionEventRejection(encoded);
+            if (outbox.quarantine(rejection)) {
+              audit.record({
+                commandId: rejection.eventId,
+                details: { code: rejection.code },
+                event: "session_event_rejected",
+                sessionId: rejection.sessionId
+              });
+            } else {
+              console.warn("Mobius daemon ignored a rejection for an unknown session event");
+            }
+            return;
+          }
+          if (kind === BOT_BINDING_APPROVAL_REQUEST_KIND) {
+            const request = decodeBotExecutionBindingApprovalRequest(encoded);
+            void grants.approve(
+              request,
+              config2.catalog,
+              directories,
+              config2.bindingId,
+              Date.now(),
+              connectionController.signal
+            ).then((approved) => {
+              audit.record({
+                commandId: request.requestId,
+                details: {
+                  behaviorRevisionId: request.behaviorRevisionId,
+                  bindingId: request.bindingId,
+                  botId: request.botId,
+                  localGrantId: approved.localGrantId
+                },
+                event: "bot_binding_approved",
+                sessionId: `bot-binding:${request.bindingId}`
+              });
+              if (socket.readyState === WebSocket2.OPEN) {
+                send(socket, encodeBotExecutionBindingApprovedEvent(approved));
+              }
+            }).catch((error61) => {
+              if (connectionController.signal.aborted) {
+                return;
+              }
+              const code = error61 instanceof LocalBotAuthorizationError ? error61.code : "binding_incompatible";
+              const message = error61 instanceof LocalBotAuthorizationError ? error61.message : "The local execution target is incompatible";
+              grants.recordUnavailable(request, code, message, Date.now());
+              audit.record({
+                commandId: request.requestId,
+                details: { bindingId: request.bindingId, botId: request.botId, code },
+                event: "bot_binding_unavailable",
+                sessionId: `bot-binding:${request.bindingId}`
+              });
+              if (socket.readyState === WebSocket2.OPEN) {
+                send(
+                  socket,
+                  encodeBotExecutionBindingUnavailableEvent(
+                    new BotExecutionBindingUnavailableEvent(
+                      request.requestId,
+                      request.botId,
+                      request.behaviorRevisionId,
+                      request.bindingId,
+                      request.bindingRevision,
+                      code,
+                      message
+                    )
+                  )
+                );
+              }
+            });
+            return;
+          }
           if (kind === NATIVE_SESSION_CANCEL_KIND) {
             const command2 = decodeNativeSessionCancel(encoded);
             const pending = nativeRequests.get(command2.requestId);
@@ -28622,6 +30269,44 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             });
             return;
           }
+          if (kind === BOT_SESSION_PROMPT_KIND) {
+            const command2 = decodeBotSessionPromptCommand(encoded);
+            if (activeTurns.has(command2.commandId)) {
+              return;
+            }
+            const receipt2 = outbox.claimExecution(command2.commandId, command2.sessionId, encoded);
+            if (receipt2.kind === "duplicate") {
+              return;
+            }
+            const turn2 = new ActiveDaemonTurn(command2, receipt2.attemptId);
+            activeTurns.set(command2.commandId, turn2);
+            activeAttemptIds.set(command2.sessionId, receipt2.attemptId);
+            void executeBotPrompt(
+              outbox,
+              publisher,
+              command2,
+              config2,
+              directories,
+              audit,
+              sessions,
+              grants,
+              contexts,
+              applicator,
+              ipc,
+              receipt2.attemptId,
+              turn2.signal
+            ).catch((error61) => {
+              console.error("Mobius daemon Bot turn failed", error61);
+            }).finally(() => {
+              activeTurns.delete(command2.commandId);
+              if (activeAttemptIds.get(command2.sessionId) === receipt2.attemptId) {
+                activeAttemptIds.delete(command2.sessionId);
+              }
+              turn2.finish();
+              connectionRefresh.afterTurnFinished();
+            });
+            return;
+          }
           if (kind !== SESSION_PROMPT_KIND) {
             throw new Error("Unsupported protocol message");
           }
@@ -28712,6 +30397,10 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   const sessionStore = new SqliteAcpSessionStore(config2.auditDatabasePath);
   const outbox = new SessionEventOutbox(config2.auditDatabasePath);
   const publisher = new DaemonSessionEventPublisher(outbox);
+  const grants = new LocalBotGrantStore(config2.auditDatabasePath);
+  const contexts = new BotExecutionContextRegistry();
+  const applicator = new EmbeddedBotContextApplicator();
+  const ipc = new BotOutboundIpcServer(botIpcSocketPath(), config2.relayUrl, contexts);
   const activeTurns = /* @__PURE__ */ new Map();
   const activeAttemptIds = /* @__PURE__ */ new Map();
   const recordSessionEvent = (sessionId, payload) => {
@@ -28750,6 +30439,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   };
   const catalogPublication = publishAgentCatalogUntilAvailable(config2, signal, timer);
   try {
+    await ipc.listen(signal);
     while (!signal.aborted) {
       try {
         await runRelayConnection(
@@ -28762,6 +30452,10 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
           nativeSessions,
           outbox,
           publisher,
+          grants,
+          contexts,
+          applicator,
+          ipc,
           activeTurns,
           activeAttemptIds,
           announceConnection,
@@ -28793,12 +30487,20 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
         await installations.close();
       } finally {
         try {
-          await sessions.close();
+          await ipc.close();
         } finally {
           try {
-            sessionStore.close();
+            await sessions.close();
           } finally {
-            outbox.close();
+            try {
+              sessionStore.close();
+            } finally {
+              try {
+                grants.close();
+              } finally {
+                outbox.close();
+              }
+            }
           }
         }
       }
@@ -28808,9 +30510,13 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
 export {
   AcpExecutionError,
   AuditStore,
+  BotExecutionContextRegistry,
+  BotMessageCommandError,
+  BotOutboundIpcServer,
   LocalAuthorizationError,
   PairingClientError,
   createAcpClient,
+  executeBotMessageCommand,
   loadDaemonConfig,
   pairLocalMachine,
   resumeLocalMachine,