@moxt-ai/mobius 0.0.21 → 0.0.22

package/dist/cli.js

@@ -6,12 +6,12 @@ var __export = (target, all) => {
 };
 
 // src/cli.ts
-import { mkdir as mkdir4 } from "node:fs/promises";
+import { mkdir as mkdir5 } from "node:fs/promises";
 
 // package.json
 var package_default = {
   name: "@moxt-ai/mobius",
-  version: "0.0.21",
+  version: "0.0.22",
   description: "Mobius CLI for pairing and running local AI agent services.",
   type: "module",
   bin: {
@@ -1616,7 +1616,7 @@ function isContainedPath3(root, candidate) {
 }
 async function hashFile(path2, signal) {
   signal.throwIfAborted();
-  const digest = createHash("sha256");
+  const digest2 = createHash("sha256");
   const stream = createReadStream(path2, { signal });
   try {
     for await (const chunk of stream) {
@@ -1627,9 +1627,9 @@ async function hashFile(path2, signal) {
           "The managed Agent archive produced invalid bytes"
         );
       }
-      digest.update(chunk);
+      digest2.update(chunk);
     }
-    return digest.digest("hex");
+    return digest2.digest("hex");
   } catch (error61) {
     if (signal.aborted) {
       signal.throwIfAborted();
@@ -2611,6 +2611,164 @@ var AuditStore = class {
   }
 };
 
+// src/bots/bot-message-command.ts
+import { randomUUID } from "node:crypto";
+import { createConnection } from "node:net";
+var BOT_IPC_RESPONSE_LIMIT = 64 * 1024;
+var BOT_IPC_TIMEOUT_MILLISECONDS = 2e4;
+var BotMessageCommandError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "BotMessageCommandError";
+  }
+};
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiredEnvironment(environment, name) {
+  const value = environment[name]?.trim();
+  if (value === void 0 || value.length === 0) {
+    throw new BotMessageCommandError(
+      "execution_context_required",
+      "This command is available only inside an active Mobius Bot execution"
+    );
+  }
+  return value;
+}
+function option(arguments_, name) {
+  const index = arguments_.indexOf(name);
+  if (index < 0 || index + 1 >= arguments_.length || arguments_[index + 1]?.startsWith("--") === true) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const value = arguments_[index + 1];
+  if (value === void 0) {
+    throw new BotMessageCommandError("invalid_request", "The Bot message option is missing");
+  }
+  return value;
+}
+function validateArguments(arguments_) {
+  if (arguments_.length !== 4) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+  const names = [arguments_[0], arguments_[2]];
+  if (!names.includes("--target") || !names.includes("--text") || names[0] === names[1]) {
+    throw new BotMessageCommandError(
+      "invalid_request",
+      "Usage: mobius bot message send --target <current|alias> --text <message>"
+    );
+  }
+}
+function decodeResponse(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data", {
+      cause
+    });
+  }
+  if (!isRecord3(value) || typeof value["ok"] !== "boolean") {
+    throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+  }
+  if (value["ok"] === true && typeof value["outboundMessageId"] === "string") {
+    return value["outboundMessageId"];
+  }
+  const error61 = value["error"];
+  if (value["ok"] === false && isRecord3(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
+    throw new BotMessageCommandError(error61["code"], error61["message"]);
+  }
+  throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
+}
+async function requestLocalBotService(socketPath, payload, signal) {
+  signal.throwIfAborted();
+  return await new Promise((resolve5, reject) => {
+    const socket = createConnection(socketPath);
+    const chunks = [];
+    let length = 0;
+    let finished = false;
+    const finish = () => {
+      socket.removeAllListeners();
+      socket.destroy();
+    };
+    const fail = (error61) => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      finish();
+      if (error61 instanceof BotMessageCommandError) {
+        reject(error61);
+        return;
+      }
+      reject(
+        new BotMessageCommandError(
+          "execution_context_required",
+          "The active Mobius Bot execution is unavailable",
+          { cause: error61 }
+        )
+      );
+    };
+    const abort = () => fail(signal.reason);
+    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS, () => {
+      fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot service timed out"));
+    });
+    socket.once("error", fail);
+    socket.once("connect", () => socket.end(`${payload}
+`));
+    socket.on("data", (chunk) => {
+      length += chunk.byteLength;
+      if (length > BOT_IPC_RESPONSE_LIMIT) {
+        fail(new BotMessageCommandError("bot_service_unavailable", "The local Bot response is too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.once("end", () => {
+      if (finished) {
+        return;
+      }
+      finished = true;
+      signal.removeEventListener("abort", abort);
+      try {
+        resolve5(decodeResponse(Buffer.concat(chunks).toString("utf8")));
+      } catch (error61) {
+        reject(error61);
+      } finally {
+        finish();
+      }
+    });
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+async function executeBotMessageCommand(arguments_, environment, signal) {
+  validateArguments(arguments_);
+  const contextHandle = requiredEnvironment(environment, "MOBIUS_BOT_CONTEXT");
+  const socketPath = requiredEnvironment(environment, "MOBIUS_BOT_SOCKET");
+  const target = option(arguments_, "--target");
+  const text = option(arguments_, "--text");
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(target) || text.trim().length === 0 || text.length > 1e4) {
+    throw new BotMessageCommandError("invalid_request", "The Bot outbound message is invalid");
+  }
+  return await requestLocalBotService(
+    socketPath,
+    JSON.stringify({
+      contextHandle,
+      idempotencyKey: `cli_${randomUUID()}`,
+      target,
+      text
+    }),
+    signal
+  );
+}
+
 // src/config.ts
 import { join as join13 } from "node:path";
 
@@ -6287,7 +6445,7 @@ var $ZodUnion = /* @__PURE__ */ $constructor("$ZodUnion", (inst, def) => {
   defineLazyInternal(inst, "optout", (zod) => zod.def.options.some((o) => o._zod.optout === "optional") ? "optional" : void 0);
   defineLazyInternal(inst, "values", (zod) => {
     if (zod.def.options.every((o) => o._zod.values)) {
-      return new Set(zod.def.options.flatMap((option) => Array.from(option._zod.values)));
+      return new Set(zod.def.options.flatMap((option2) => Array.from(option2._zod.values)));
     }
     return void 0;
   });
@@ -6305,8 +6463,8 @@ var $ZodUnion = /* @__PURE__ */ $constructor("$ZodUnion", (inst, def) => {
     }
     let async = false;
     const results = [];
-    for (const option of def.options) {
-      const result = option._zod.run({
+    for (const option2 of def.options) {
+      const result = option2._zod.run({
         value: payload.value,
         issues: []
       }, ctx);
@@ -6365,8 +6523,8 @@ var $ZodXor = /* @__PURE__ */ $constructor("$ZodXor", (inst, def) => {
     }
     let async = false;
     const results = [];
-    for (const option of def.options) {
-      const result = option._zod.run({
+    for (const option2 of def.options) {
+      const result = option2._zod.run({
         value: payload.value,
         issues: []
       }, ctx);
@@ -6390,10 +6548,10 @@ function getDiscriminatedOption(union2, value) {
   if (!map2) {
     map2 = /* @__PURE__ */ new Map();
     const { options, discriminator } = internals.def;
-    for (const option of options) {
-      for (const v of option._zod.propValues?.[discriminator] ?? [])
+    for (const option2 of options) {
+      for (const v of option2._zod.propValues?.[discriminator] ?? [])
         if (!map2.has(v))
-          map2.set(v, option);
+          map2.set(v, option2);
     }
     internals.bag.optionsMap = map2;
   }
@@ -6405,10 +6563,10 @@ var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnio
   const _super = inst._zod.parse;
   defineLazyInternal(inst, "propValues", (zod) => {
     const propValues = {};
-    for (const option of zod.def.options) {
-      const pv = option._zod.propValues;
+    for (const option2 of zod.def.options) {
+      const pv = option2._zod.propValues;
       if (!pv || Object.keys(pv).length === 0)
-        throw new Error(`Invalid discriminated union option at index "${zod.def.options.indexOf(option)}"`);
+        throw new Error(`Invalid discriminated union option at index "${zod.def.options.indexOf(option2)}"`);
       for (const [k, v] of Object.entries(pv)) {
         if (!Object.prototype.hasOwnProperty.call(propValues, k)) {
           assignProp(propValues, k, /* @__PURE__ */ new Set());
@@ -6420,8 +6578,8 @@ var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnio
     }
     return propValues;
   });
-  def.options.forEach((option, i) => {
-    const propShape = propShapes.get(option._zod.def);
+  def.options.forEach((option2, i) => {
+    const propShape = propShapes.get(option2._zod.def);
     if (propShape && !Object.prototype.hasOwnProperty.call(propShape, def.discriminator)) {
       throw new Error(`Invalid discriminated union option at index "${i}"`);
     }
@@ -16352,8 +16510,8 @@ function generateDiscriminatedUnionCheck(doc, ctx, def, accessor) {
   doc.write(`let ${outputVar};`);
   let firstBranch = true;
   const claimed = /* @__PURE__ */ new Set();
-  for (const option of def.options) {
-    const values = option._zod.propValues?.[def.discriminator];
+  for (const option2 of def.options) {
+    const values = option2._zod.propValues?.[def.discriminator];
     if (!values || values.size === 0) {
       throw new ZodCompileUnsupportedError("discriminated union option without static discriminator values");
     }
@@ -16367,7 +16525,7 @@ function generateDiscriminatedUnionCheck(doc, ctx, def, accessor) {
     const prefix = firstBranch ? "if" : "else if";
     doc.write(`${prefix} (${conditions.join(" || ")}) {`);
     doc.indented((d) => {
-      const branchOutput = generateCheck(d, ctx, option, accessor);
+      const branchOutput = generateCheck(d, ctx, option2, accessor);
       d.write(`${outputVar} = ${branchOutput};`);
     });
     doc.write(`}`);
@@ -17917,14 +18075,14 @@ function compactTypeUnion(schema) {
   if (!Array.isArray(options) || options.length === 0 || schema.type !== void 0)
     return;
   const types = [];
-  for (const option of options) {
-    if (!option || typeof option !== "object")
+  for (const option2 of options) {
+    if (!option2 || typeof option2 !== "object")
       return;
-    compactTypeUnion(option);
-    const keys = Object.keys(option);
+    compactTypeUnion(option2);
+    const keys = Object.keys(option2);
     if (keys.length !== 1 || keys[0] !== "type")
       return;
-    const type = option.type;
+    const type = option2.type;
     for (const member of Array.isArray(type) ? type : [type]) {
       if (typeof member !== "string")
         return;
@@ -18214,8 +18372,8 @@ function isTransforming(_schema, _ctx) {
     return false;
   }
   if (def.type === "union") {
-    for (const option of def.options) {
-      if (isTransforming(option, ctx))
+    for (const option2 of def.options) {
+      if (isTransforming(option2, ctx))
         return true;
     }
     return false;
@@ -21956,7 +22114,7 @@ var ProtocolMessageError = class extends Error {
     this.name = "ProtocolMessageError";
   }
 };
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson2(encoded) {
@@ -21968,7 +22126,7 @@ function parseJson2(encoded) {
       cause: error61
     });
   }
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22052,7 +22210,7 @@ function readActivityContent(value) {
 }
 function readActivityDetail(value) {
   const field = value["detail"];
-  if (!isRecord3(field)) {
+  if (!isRecord4(field)) {
     throw new ProtocolMessageError("Invalid activity detail field");
   }
   const kind = readString(field, "kind", 32);
@@ -22291,6 +22449,487 @@ function encodeSessionFailedEvent(message) {
   return JSON.stringify(decodeSessionFailedEvent(JSON.stringify(message)));
 }
 
+// ../protocol/src/bot.ts
+var BOT_BINDING_APPROVAL_REQUEST_KIND = "bot.binding.approval.request";
+var BOT_BINDING_APPROVED_KIND = "bot.binding.approved";
+var BOT_BINDING_UNAVAILABLE_KIND = "bot.binding.unavailable";
+var BOT_SESSION_PROMPT_KIND = "bot.session.prompt";
+var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var DIRECTORY_IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/;
+var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var SHA256_PATTERN = /^[a-f0-9]{64}$/;
+var MAX_INSTRUCTIONS_LENGTH = 1e5;
+var BotDeliveryTargetReference = class {
+  alias;
+  deliveryTargetId;
+  constructor(alias, deliveryTargetId) {
+    this.alias = alias;
+    this.deliveryTargetId = deliveryTargetId;
+  }
+};
+var BotCompletionDeliveryPolicy = class {
+};
+var NoBotCompletionDeliveryPolicy = class extends BotCompletionDeliveryPolicy {
+  kind = "none";
+};
+var RequiredBotCompletionDeliveryPolicy = class extends BotCompletionDeliveryPolicy {
+  deliveryTargetId;
+  kind = "required";
+  messageTemplate;
+  constructor(deliveryTargetId, messageTemplate) {
+    super();
+    this.deliveryTargetId = deliveryTargetId;
+    this.messageTemplate = messageTemplate;
+  }
+};
+var BotReplyRoute = class {
+};
+var OwnerBotReplyRoute = class extends BotReplyRoute {
+  kind = "owner";
+};
+var BotConnectionReplyRoute = class extends BotReplyRoute {
+  connectionId;
+  deliveryTargetId;
+  kind = "connection";
+  constructor(connectionId, deliveryTargetId) {
+    super();
+    this.connectionId = connectionId;
+    this.deliveryTargetId = deliveryTargetId;
+  }
+};
+var BotExecutionBindingApprovalRequest = class {
+  agentConfigRevision;
+  agentRef;
+  allowedDeliveryTargets;
+  behaviorDigest;
+  behaviorInstructions;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  completionPolicy;
+  kind = BOT_BINDING_APPROVAL_REQUEST_KIND;
+  requestId;
+  requiredCapabilities;
+  runtimeId;
+  workspaceRef;
+  constructor(requestId, botId, behaviorRevisionId, bindingId, bindingRevision, runtimeId, agentRef, workspaceRef, agentConfigRevision, behaviorInstructions, behaviorDigest, requiredCapabilities, allowedDeliveryTargets, completionPolicy) {
+    this.requestId = requestId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.runtimeId = runtimeId;
+    this.agentRef = agentRef;
+    this.workspaceRef = workspaceRef;
+    this.agentConfigRevision = agentConfigRevision;
+    this.behaviorInstructions = behaviorInstructions;
+    this.behaviorDigest = behaviorDigest;
+    this.requiredCapabilities = Object.freeze([...requiredCapabilities]);
+    this.allowedDeliveryTargets = Object.freeze(
+      allowedDeliveryTargets.map(
+        (target) => new BotDeliveryTargetReference(target.alias, target.deliveryTargetId)
+      )
+    );
+    this.completionPolicy = completionPolicy;
+  }
+};
+var BotExecutionBindingApprovedEvent = class {
+  agentIdentityDigest;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  kind = BOT_BINDING_APPROVED_KIND;
+  localGrantId;
+  requestId;
+  workspaceIdentityDigest;
+  constructor(requestId, botId, behaviorRevisionId, bindingId, bindingRevision, localGrantId, agentIdentityDigest, workspaceIdentityDigest) {
+    this.requestId = requestId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.localGrantId = localGrantId;
+    this.agentIdentityDigest = agentIdentityDigest;
+    this.workspaceIdentityDigest = workspaceIdentityDigest;
+  }
+};
+var BotExecutionBindingUnavailableEvent = class {
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  code;
+  kind = BOT_BINDING_UNAVAILABLE_KIND;
+  message;
+  requestId;
+  constructor(requestId, botId, behaviorRevisionId, bindingId, bindingRevision, code, message) {
+    this.requestId = requestId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.code = code;
+    this.message = message;
+  }
+};
+var BotSessionPromptCommand = class {
+  additionalDirectoryIds;
+  agentId;
+  allowedDeliveryTargets;
+  behaviorDigest;
+  behaviorInstructions;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  commandId;
+  conversationId;
+  directoryId;
+  executionCapabilityId;
+  executionCapabilitySecret;
+  executionDeadlineAt;
+  executionId;
+  images;
+  kind = BOT_SESSION_PROMPT_KIND;
+  localGrantId;
+  prompt;
+  replyRoute;
+  resources;
+  sessionId;
+  turnId;
+  constructor(sessionId, commandId, agentId, bindingId, directoryId2, additionalDirectoryIds, images, resources, prompt, executionId, executionCapabilityId, executionCapabilitySecret, executionDeadlineAt, botId, conversationId, turnId, behaviorRevisionId, bindingRevision, localGrantId, behaviorInstructions, behaviorDigest, allowedDeliveryTargets, replyRoute) {
+    this.sessionId = sessionId;
+    this.commandId = commandId;
+    this.agentId = agentId;
+    this.bindingId = bindingId;
+    this.directoryId = directoryId2;
+    this.additionalDirectoryIds = Object.freeze([...additionalDirectoryIds]);
+    this.images = Object.freeze([...images]);
+    this.resources = Object.freeze([...resources]);
+    this.prompt = prompt;
+    this.executionId = executionId;
+    this.executionCapabilityId = executionCapabilityId;
+    this.executionCapabilitySecret = executionCapabilitySecret;
+    this.executionDeadlineAt = executionDeadlineAt;
+    this.botId = botId;
+    this.conversationId = conversationId;
+    this.turnId = turnId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.bindingRevision = bindingRevision;
+    this.localGrantId = localGrantId;
+    this.behaviorInstructions = behaviorInstructions;
+    this.behaviorDigest = behaviorDigest;
+    this.allowedDeliveryTargets = Object.freeze(
+      allowedDeliveryTargets.map(
+        (target) => new BotDeliveryTargetReference(target.alias, target.deliveryTargetId)
+      )
+    );
+    this.replyRoute = replyRoute;
+  }
+};
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJson3(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new ProtocolMessageError("Message is not valid JSON", { cause });
+  }
+  if (!isRecord5(value)) {
+    throw new ProtocolMessageError("Message must be a JSON object");
+  }
+  return value;
+}
+function assertExactKeys2(value, expected) {
+  const keys = Object.keys(value);
+  if (keys.length !== expected.length || keys.some((key) => !expected.includes(key))) {
+    throw new ProtocolMessageError("Message fields do not match the Bot protocol");
+  }
+}
+function readText2(value, key, maximumLength, allowEmpty) {
+  const field = value[key];
+  if (typeof field !== "string" || field.length > maximumLength || !allowEmpty && field.length === 0) {
+    throw new ProtocolMessageError(`Invalid Bot protocol field: ${key}`);
+  }
+  return field;
+}
+function readIdentifier2(value, key) {
+  const field = readText2(value, key, 128, false);
+  if (!IDENTIFIER_PATTERN3.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot identifier field: ${key}`);
+  }
+  return field;
+}
+function readDirectoryIdentifier2(value, key) {
+  const field = readText2(value, key, 2048, false);
+  if (!DIRECTORY_IDENTIFIER_PATTERN3.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot directory field: ${key}`);
+  }
+  return field;
+}
+function readInteger(value, key) {
+  const field = value[key];
+  if (typeof field !== "number" || !Number.isSafeInteger(field) || field < 1) {
+    throw new ProtocolMessageError(`Invalid Bot integer field: ${key}`);
+  }
+  return field;
+}
+function readTimestamp(value, key) {
+  const field = readText2(value, key, 64, false);
+  if (Number.isNaN(Date.parse(field))) {
+    throw new ProtocolMessageError(`Invalid Bot timestamp field: ${key}`);
+  }
+  return field;
+}
+function readDigest(value, key) {
+  const field = readText2(value, key, 64, false);
+  if (!SHA256_PATTERN.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot digest field: ${key}`);
+  }
+  return field;
+}
+function readToken(value, key) {
+  const field = readText2(value, key, 256, false);
+  if (!TOKEN_PATTERN.test(field)) {
+    throw new ProtocolMessageError(`Invalid Bot token field: ${key}`);
+  }
+  return field;
+}
+function readIdentifiers(value, key, maximumCount) {
+  const field = value[key];
+  if (!Array.isArray(field) || field.length > maximumCount) {
+    throw new ProtocolMessageError(`Invalid Bot identifier list: ${key}`);
+  }
+  const identifiers = [];
+  const unique = /* @__PURE__ */ new Set();
+  for (const candidate of field) {
+    if (typeof candidate !== "string" || !IDENTIFIER_PATTERN3.test(candidate) || unique.has(candidate)) {
+      throw new ProtocolMessageError(`Invalid Bot identifier list: ${key}`);
+    }
+    unique.add(candidate);
+    identifiers.push(candidate);
+  }
+  return Object.freeze(identifiers);
+}
+function readTargets(value, key) {
+  const field = value[key];
+  if (!Array.isArray(field) || field.length > 64) {
+    throw new ProtocolMessageError(`Invalid Bot delivery targets: ${key}`);
+  }
+  const targets = [];
+  const identifiers = /* @__PURE__ */ new Set();
+  const aliases = /* @__PURE__ */ new Set();
+  for (const candidate of field) {
+    if (!isRecord5(candidate)) {
+      throw new ProtocolMessageError(`Invalid Bot delivery targets: ${key}`);
+    }
+    assertExactKeys2(candidate, ["alias", "deliveryTargetId"]);
+    const alias = readIdentifier2(candidate, "alias");
+    const deliveryTargetId = readIdentifier2(candidate, "deliveryTargetId");
+    if (aliases.has(alias) || identifiers.has(deliveryTargetId)) {
+      throw new ProtocolMessageError(`Duplicate Bot delivery target: ${key}`);
+    }
+    aliases.add(alias);
+    identifiers.add(deliveryTargetId);
+    targets.push(new BotDeliveryTargetReference(alias, deliveryTargetId));
+  }
+  return Object.freeze(targets);
+}
+function readCompletionPolicy(value) {
+  if (!isRecord5(value)) {
+    throw new ProtocolMessageError("Invalid Bot completion policy");
+  }
+  const kind = readText2(value, "kind", 32, false);
+  if (kind === "none") {
+    assertExactKeys2(value, ["kind"]);
+    return new NoBotCompletionDeliveryPolicy();
+  }
+  if (kind === "required") {
+    assertExactKeys2(value, ["deliveryTargetId", "kind", "messageTemplate"]);
+    return new RequiredBotCompletionDeliveryPolicy(
+      readIdentifier2(value, "deliveryTargetId"),
+      readText2(value, "messageTemplate", 1e4, false)
+    );
+  }
+  throw new ProtocolMessageError("Invalid Bot completion policy");
+}
+function readReplyRoute(value) {
+  if (!isRecord5(value)) {
+    throw new ProtocolMessageError("Invalid Bot reply route");
+  }
+  const kind = readText2(value, "kind", 32, false);
+  if (kind === "owner") {
+    assertExactKeys2(value, ["kind"]);
+    return new OwnerBotReplyRoute();
+  }
+  if (kind === "connection") {
+    assertExactKeys2(value, ["connectionId", "deliveryTargetId", "kind"]);
+    return new BotConnectionReplyRoute(
+      readIdentifier2(value, "connectionId"),
+      readIdentifier2(value, "deliveryTargetId")
+    );
+  }
+  throw new ProtocolMessageError("Invalid Bot reply route");
+}
+function decodeBotExecutionBindingApprovalRequest(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "agentConfigRevision",
+    "agentRef",
+    "allowedDeliveryTargets",
+    "behaviorDigest",
+    "behaviorInstructions",
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "completionPolicy",
+    "kind",
+    "requestId",
+    "requiredCapabilities",
+    "runtimeId",
+    "workspaceRef"
+  ]);
+  if (value["kind"] !== BOT_BINDING_APPROVAL_REQUEST_KIND) {
+    throw new ProtocolMessageError("Invalid Bot binding approval request kind");
+  }
+  return new BotExecutionBindingApprovalRequest(
+    readIdentifier2(value, "requestId"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readIdentifier2(value, "bindingId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "runtimeId"),
+    readIdentifier2(value, "agentRef"),
+    readDirectoryIdentifier2(value, "workspaceRef"),
+    readInteger(value, "agentConfigRevision"),
+    readText2(value, "behaviorInstructions", MAX_INSTRUCTIONS_LENGTH, true),
+    readDigest(value, "behaviorDigest"),
+    readIdentifiers(value, "requiredCapabilities", 32),
+    readTargets(value, "allowedDeliveryTargets"),
+    readCompletionPolicy(value["completionPolicy"])
+  );
+}
+function decodeBotExecutionBindingApprovedEvent(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "agentIdentityDigest",
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "kind",
+    "localGrantId",
+    "requestId",
+    "workspaceIdentityDigest"
+  ]);
+  if (value["kind"] !== BOT_BINDING_APPROVED_KIND) {
+    throw new ProtocolMessageError("Invalid Bot binding approval event kind");
+  }
+  return new BotExecutionBindingApprovedEvent(
+    readIdentifier2(value, "requestId"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readIdentifier2(value, "bindingId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "localGrantId"),
+    readDigest(value, "agentIdentityDigest"),
+    readDigest(value, "workspaceIdentityDigest")
+  );
+}
+function encodeBotExecutionBindingApprovedEvent(event) {
+  return JSON.stringify(decodeBotExecutionBindingApprovedEvent(JSON.stringify(event)));
+}
+function decodeBotExecutionBindingUnavailableEvent(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "code",
+    "kind",
+    "message",
+    "requestId"
+  ]);
+  if (value["kind"] !== BOT_BINDING_UNAVAILABLE_KIND) {
+    throw new ProtocolMessageError("Invalid Bot binding unavailable event kind");
+  }
+  return new BotExecutionBindingUnavailableEvent(
+    readIdentifier2(value, "requestId"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readIdentifier2(value, "bindingId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "code"),
+    readText2(value, "message", 500, false)
+  );
+}
+function encodeBotExecutionBindingUnavailableEvent(event) {
+  return JSON.stringify(decodeBotExecutionBindingUnavailableEvent(JSON.stringify(event)));
+}
+function decodeBotSessionPromptCommand(encoded) {
+  const value = parseJson3(encoded);
+  assertExactKeys2(value, [
+    "additionalDirectoryIds",
+    "agentId",
+    "allowedDeliveryTargets",
+    "behaviorDigest",
+    "behaviorInstructions",
+    "behaviorRevisionId",
+    "bindingId",
+    "bindingRevision",
+    "botId",
+    "commandId",
+    "conversationId",
+    "directoryId",
+    "executionCapabilityId",
+    "executionCapabilitySecret",
+    "executionDeadlineAt",
+    "executionId",
+    "images",
+    "kind",
+    "localGrantId",
+    "prompt",
+    "replyRoute",
+    "resources",
+    "sessionId",
+    "turnId"
+  ]);
+  if (value["kind"] !== BOT_SESSION_PROMPT_KIND) {
+    throw new ProtocolMessageError("Invalid Bot Session prompt kind");
+  }
+  return new BotSessionPromptCommand(
+    readIdentifier2(value, "sessionId"),
+    readIdentifier2(value, "commandId"),
+    readIdentifier2(value, "agentId"),
+    readIdentifier2(value, "bindingId"),
+    readDirectoryIdentifier2(value, "directoryId"),
+    readIdentifiers(value, "additionalDirectoryIds", 16),
+    decodePromptImagesValue(value["images"]),
+    decodePromptResourcesValue(value["resources"]),
+    readText2(value, "prompt", 1e4, false),
+    readIdentifier2(value, "executionId"),
+    readIdentifier2(value, "executionCapabilityId"),
+    readToken(value, "executionCapabilitySecret"),
+    readTimestamp(value, "executionDeadlineAt"),
+    readIdentifier2(value, "botId"),
+    readIdentifier2(value, "conversationId"),
+    readIdentifier2(value, "turnId"),
+    readIdentifier2(value, "behaviorRevisionId"),
+    readInteger(value, "bindingRevision"),
+    readIdentifier2(value, "localGrantId"),
+    readText2(value, "behaviorInstructions", MAX_INSTRUCTIONS_LENGTH, true),
+    readDigest(value, "behaviorDigest"),
+    readTargets(value, "allowedDeliveryTargets"),
+    readReplyRoute(value["replyRoute"])
+  );
+}
+
 // ../protocol/src/mobius-api.ts
 var MOBIUS_API_PREFIX = "/mobius/api";
 var API_PREFIX_PATTERN = /^\/[a-zA-Z0-9._~-]+(?:\/[a-zA-Z0-9._~-]+)*$/;
@@ -22469,13 +23108,13 @@ var SessionEventRejectionCode = {
   SessionDeleted: "session_deleted",
   SessionNotFound: "session_not_found"
 };
-var IDENTIFIER_PATTERN3 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var CURSOR_PATTERN = /^[A-Za-z0-9_-]{1,512}$/;
 var MAX_RECORDED_EVENT_LENGTH = 8 * 1024 * 1024;
 var DECIMAL_SEQUENCE_PATTERN = /^(?:0|[1-9][0-9]*)$/;
 var eventSourceSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({
-    attemptId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+    attemptId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
     kind: external_exports.literal("attempt"),
     sourceSeq: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN)
   }).readonly(),
@@ -22485,35 +23124,35 @@ var eventSourceSchema = external_exports.discriminatedUnion("kind", [
   }).readonly()
 ]);
 var eventEnvelopeSchema = external_exports.strictObject({
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_KIND),
   payload: external_exports.string().min(2).max(MAX_RECORDED_EVENT_LENGTH),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   source: eventSourceSchema
 }).readonly();
 var committedEventSchema = external_exports.strictObject({
   cursor: external_exports.string().min(1).max(512).regex(CURSOR_PATTERN),
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_COMMITTED_KIND),
   payload: external_exports.string().min(2).max(MAX_RECORDED_EVENT_LENGTH),
   recordedAt: external_exports.string().datetime({ offset: true }),
   sequence: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   source: eventSourceSchema
 }).readonly();
 var eventAcknowledgementSchema = external_exports.strictObject({
   cursor: external_exports.string().min(1).max(512).regex(CURSOR_PATTERN),
   duplicate: external_exports.boolean(),
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_ACK_KIND),
   sequence: external_exports.string().min(1).max(40).regex(DECIMAL_SEQUENCE_PATTERN),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3)
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4)
 }).readonly();
 var eventRejectionSchema = external_exports.strictObject({
   code: external_exports.enum(SessionEventRejectionCode),
-  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3),
+  eventId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4),
   kind: external_exports.literal(SESSION_EVENT_REJECTED_KIND),
-  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN3)
+  sessionId: external_exports.string().min(1).max(128).regex(IDENTIFIER_PATTERN4)
 }).readonly();
 function decode5(encoded, schema) {
   let value;
@@ -22562,15 +23201,15 @@ function createDaemonConfig(connection, agents = [], installableAgents = []) {
 }
 
 // src/pairing/pair-local-machine.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir3, open as open4, realpath as realpath6, rename as rename3, stat as stat5, writeFile as writeFile2 } from "node:fs/promises";
 import { hostname as hostname3 } from "node:os";
 import { basename, join as join14, resolve as resolve3 } from "node:path";
 import { fetch as fetch2 } from "undici";
 var PAIRING_TIMEOUT_MILLISECONDS = 2e4;
 var PAIRING_CODE_PATTERN = /^[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){4}$/;
-var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
-var TOKEN_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var TOKEN_PATTERN2 = /^[a-zA-Z0-9_-]{32,256}$/;
 var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
 var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken", "runtimeId"];
 var SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "daemonToken", "relayOrigin"];
@@ -22582,36 +23221,36 @@ var PairingClientError = class extends Error {
     this.name = "PairingClientError";
   }
 };
-function isRecord4(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
   const keys = Object.keys(value);
   return keys.length === expectedKeys.length && expectedKeys.every((key) => Object.hasOwn(value, key));
 }
-function readSingleOption(arguments_, option) {
+function readSingleOption(arguments_, option2) {
   const values = [];
   for (let index = 0; index < arguments_.length; index += 1) {
-    if (arguments_[index] !== option) {
+    if (arguments_[index] !== option2) {
       continue;
     }
     const value = arguments_[index + 1];
     if (value === void 0 || value.startsWith("--")) {
-      throw new PairingClientError("invalid_arguments", `${option} requires a value`);
+      throw new PairingClientError("invalid_arguments", `${option2} requires a value`);
     }
     values.push(value);
     index += 1;
   }
   if (values.length !== 1) {
-    throw new PairingClientError("invalid_arguments", `${option} must be provided exactly once`);
+    throw new PairingClientError("invalid_arguments", `${option2} must be provided exactly once`);
   }
   return values[0] ?? "";
 }
 function assertKnownArguments(arguments_) {
   for (let index = 0; index < arguments_.length; index += 2) {
-    const option = arguments_[index];
-    if (option !== "--url" && option !== "--code" && option !== "--workspace") {
-      throw new PairingClientError("invalid_arguments", `Unknown pairing option: ${option ?? "missing option"}`);
+    const option2 = arguments_[index];
+    if (option2 !== "--url" && option2 !== "--code" && option2 !== "--workspace") {
+      throw new PairingClientError("invalid_arguments", `Unknown pairing option: ${option2 ?? "missing option"}`);
     }
   }
 }
@@ -22659,7 +23298,7 @@ function parseChannelArgument(arguments_) {
     throw new PairingClientError("invalid_arguments", "Usage: mobius start --channel <channel-id>");
   }
   const channelId = arguments_[1] ?? "";
-  if (!IDENTIFIER_PATTERN4.test(channelId)) {
+  if (!IDENTIFIER_PATTERN5.test(channelId)) {
     throw new PairingClientError("invalid_channel_id", "The saved channel ID is invalid");
   }
   return channelId;
@@ -22698,9 +23337,9 @@ async function readJsonResponse(response) {
   }
 }
 function readRelayError(value) {
-  if (isRecord4(value)) {
+  if (isRecord6(value)) {
     const error61 = value["error"];
-    if (isRecord4(error61)) {
+    if (isRecord6(error61)) {
       const code = error61["code"];
       const message = error61["message"];
       if (typeof code === "string" && typeof message === "string") {
@@ -22711,16 +23350,16 @@ function readRelayError(value) {
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
 function decodeClaimResponse(value) {
-  if (!isRecord4(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
+  if (!isRecord6(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
+  const daemonToken2 = value["daemonToken"];
   const runtimeId = value["runtimeId"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN4.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN4.test(runtimeId)) {
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
-  return { channelId, daemonToken, runtimeId };
+  return { channelId, daemonToken: daemonToken2, runtimeId };
 }
 async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
   const agents = localAgents.map((agent) => ({
@@ -22755,18 +23394,18 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   }
   return decodeClaimResponse(value);
 }
-async function persistConnection(channelId, relayOrigin, daemonToken, defaultWorkspace) {
+async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWorkspace) {
   const connectionsDirectory = join14(readStateDirectory(), "connections");
   await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
   const connectionPath = join14(connectionsDirectory, `${channelId}.json`);
-  const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID()}.tmp`);
+  const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID2()}.tmp`);
   await writeFile2(
     temporaryPath,
     `${JSON.stringify(
       {
         defaultWorkspace,
         channelId,
-        daemonToken,
+        daemonToken: daemonToken2,
         relayOrigin: relayOrigin.toString()
       },
       null,
@@ -22779,20 +23418,20 @@ async function persistConnection(channelId, relayOrigin, daemonToken, defaultWor
   return connectionPath;
 }
 function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord4(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
+  if (!isRecord6(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   const defaultWorkspace = value["defaultWorkspace"];
   const channelId = value["channelId"];
-  const daemonToken = value["daemonToken"];
+  const daemonToken2 = value["daemonToken"];
   const relayOrigin = value["relayOrigin"];
-  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN4.test(channelId) || typeof daemonToken !== "string" || !TOKEN_PATTERN.test(daemonToken) || typeof relayOrigin !== "string") {
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof relayOrigin !== "string") {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   return {
     defaultWorkspace,
     channelId,
-    daemonToken,
+    daemonToken: daemonToken2,
     relayOrigin: parseRelayOrigin(relayOrigin)
   };
 }
@@ -22893,9 +23532,10 @@ async function resumeLocalMachine(arguments_, signal = new AbortController().sig
 }
 
 // src/run-daemon.ts
-import { basename as basename3 } from "node:path";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { basename as basename3, join as join16 } from "node:path";
 import { styleText } from "node:util";
-import { fetch as fetch5, WebSocket as WebSocket2 } from "undici";
+import { fetch as fetch6, WebSocket as WebSocket2 } from "undici";
 
 // src/acp/session-manager.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -22908,7 +23548,7 @@ import {
 
 // src/acp/activity.ts
 var TRUNCATION_MARKER = "\n\u2026 output truncated by Mobius";
-function isRecord5(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var AcpActivity = class _AcpActivity {
@@ -23175,7 +23815,7 @@ function contentPhase(content) {
     return "";
   }
   const codex = metadata["codex"];
-  if (!isRecord5(codex)) {
+  if (!isRecord7(codex)) {
     return "";
   }
   const phase = codex["phase"];
@@ -23413,7 +24053,7 @@ var SessionConfigProtocolError = class extends Error {
     this.name = "SessionConfigProtocolError";
   }
 };
-function isRecord6(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString2(value, fallback = "") {
@@ -23425,13 +24065,13 @@ function truncate2(value, maximum) {
 function readBoolean(value, fallback = false) {
   return typeof value === "boolean" ? value : fallback;
 }
-function normalizeConfigValue(option, groupId = "", groupName = "") {
+function normalizeConfigValue(option2, groupId = "", groupName = "") {
   return {
-    description: truncate2(readString2(option["description"]), 500),
+    description: truncate2(readString2(option2["description"]), 500),
     groupId: truncate2(groupId, 128),
     groupName: truncate2(groupName, 255),
-    name: truncate2(readString2(option["name"], readString2(option["value"])), 255),
-    value: truncate2(readString2(option["value"]), 500)
+    name: truncate2(readString2(option2["name"], readString2(option2["value"])), 255),
+    value: truncate2(readString2(option2["value"]), 500)
   };
 }
 function normalizeConfigValues(value) {
@@ -23440,7 +24080,7 @@ function normalizeConfigValues(value) {
   }
   const normalized = [];
   for (const entry of value) {
-    if (!isRecord6(entry)) {
+    if (!isRecord8(entry)) {
       continue;
     }
     const groupedOptions = entry["options"];
@@ -23448,7 +24088,7 @@ function normalizeConfigValues(value) {
       const groupId = readString2(entry["group"]);
       const groupName = readString2(entry["name"]);
       for (const groupedOption of groupedOptions) {
-        if (isRecord6(groupedOption)) {
+        if (isRecord8(groupedOption)) {
           normalized.push(normalizeConfigValue(groupedOption, groupId, groupName));
         }
       }
@@ -23461,21 +24101,21 @@ function normalizeConfigValues(value) {
 function normalizeConfigOptions(value, modes) {
   const normalized = [];
   if (Array.isArray(value)) {
-    for (const option of value) {
-      if (!isRecord6(option)) {
+    for (const option2 of value) {
+      if (!isRecord8(option2)) {
         continue;
       }
-      const id = truncate2(readString2(option["id"]), 128);
-      const name = truncate2(readString2(option["name"], id), 255);
+      const id = truncate2(readString2(option2["id"]), 128);
+      const name = truncate2(readString2(option2["name"], id), 255);
       if (id.length === 0 || name.length === 0) {
         continue;
       }
-      if (option["type"] === "boolean") {
+      if (option2["type"] === "boolean") {
         normalized.push({
-          booleanValue: readBoolean(option["currentValue"]),
-          category: truncate2(readString2(option["category"]), 128),
+          booleanValue: readBoolean(option2["currentValue"]),
+          category: truncate2(readString2(option2["category"]), 128),
           currentValue: "",
-          description: truncate2(readString2(option["description"]), 500),
+          description: truncate2(readString2(option2["description"]), 500),
           id,
           name,
           type: "boolean",
@@ -23483,15 +24123,15 @@ function normalizeConfigOptions(value, modes) {
         });
         continue;
       }
-      if (option["type"] === "select") {
-        const values = normalizeConfigValues(option["options"]);
-        const currentValue = truncate2(readString2(option["currentValue"]), 500);
+      if (option2["type"] === "select") {
+        const values = normalizeConfigValues(option2["options"]);
+        const currentValue = truncate2(readString2(option2["currentValue"]), 500);
         if (currentValue.length > 0 && values.some((entry) => entry.value === currentValue)) {
           normalized.push({
             booleanValue: false,
-            category: truncate2(readString2(option["category"]), 128),
+            category: truncate2(readString2(option2["category"]), 128),
             currentValue,
-            description: truncate2(readString2(option["description"]), 500),
+            description: truncate2(readString2(option2["description"]), 500),
             id,
             name,
             type: "select",
@@ -23501,12 +24141,12 @@ function normalizeConfigOptions(value, modes) {
       }
     }
   }
-  if (isRecord6(modes)) {
+  if (isRecord8(modes)) {
     const values = [];
     const availableModes = modes["availableModes"];
     if (Array.isArray(availableModes)) {
       for (const mode of availableModes) {
-        if (!isRecord6(mode)) {
+        if (!isRecord8(mode)) {
           continue;
         }
         const id = truncate2(readString2(mode["id"]), 500);
@@ -23539,7 +24179,7 @@ function normalizeConfigOptions(value, modes) {
   return normalized.slice(0, 100);
 }
 function ensureReasoningEffortOption(current) {
-  if (current.some((option) => option.category === "thought_level")) {
+  if (current.some((option2) => option2.category === "thought_level")) {
     return current;
   }
   const unavailable = {
@@ -23560,7 +24200,7 @@ function ensureReasoningEffortOption(current) {
       }
     ]
   };
-  const modelIndex = current.findIndex((option) => option.category === "model");
+  const modelIndex = current.findIndex((option2) => option2.category === "model");
   if (current.length < MAXIMUM_CONFIG_OPTIONS) {
     if (modelIndex < 0) {
       return [...current, unavailable];
@@ -23584,20 +24224,20 @@ function ensureReasoningEffortOption(current) {
   return [...current.slice(0, MAXIMUM_CONFIG_OPTIONS - 2), model, unavailable];
 }
 function normalizeStandardLifecycle(response) {
-  const lifecycle = isRecord6(response) ? response : {};
+  const lifecycle = isRecord8(response) ? response : {};
   return ensureReasoningEffortOption(normalizeConfigOptions(lifecycle["configOptions"], lifecycle["modes"]));
 }
 function replaceStandardConfigOptions(current, value) {
   const next = normalizeConfigOptions(value, void 0);
-  const withMode = next.some((option) => option.category === "mode") ? next : [...current.filter((option) => option.category === "mode"), ...next].slice(0, 100);
+  const withMode = next.some((option2) => option2.category === "mode") ? next : [...current.filter((option2) => option2.category === "mode"), ...next].slice(0, 100);
   return ensureReasoningEffortOption(withMode);
 }
 function updateCurrentValue(current, configId, value) {
-  return current.map((option) => option.id === configId ? { ...option, currentValue: value } : option);
+  return current.map((option2) => option2.id === configId ? { ...option2, currentValue: value } : option2);
 }
 var StandardSessionConfigProtocol = class {
   configure = async (current, change, nativeSessionId, transport) => {
-    const existing = current.find((option) => option.id === change.configId);
+    const existing = current.find((option2) => option2.id === change.configId);
     if (existing === void 0) {
       return current;
     }
@@ -23626,7 +24266,7 @@ var StandardSessionConfigProtocol = class {
       "ACP agent exited while changing session configuration",
       change.signal
     );
-    if (!isRecord6(response) || !Array.isArray(response["configOptions"])) {
+    if (!isRecord8(response) || !Array.isArray(response["configOptions"])) {
       throw new SessionConfigProtocolError("The Agent returned an invalid session configuration response");
     }
     return replaceStandardConfigOptions(current, response["configOptions"]);
@@ -23640,31 +24280,31 @@ var standardSessionConfigProtocol = new StandardSessionConfigProtocol();
 var LEGACY_MODEL_CONFIG_ID = "grok_build_legacy_model";
 var LEGACY_REASONING_EFFORT_CONFIG_ID = "grok_build_legacy_reasoning_effort";
 function legacyOptions(response) {
-  if (!isRecord6(response)) {
+  if (!isRecord8(response)) {
     return [];
   }
   const metadata = response["_meta"];
-  if (!isRecord6(metadata)) {
+  if (!isRecord8(metadata)) {
     return [];
   }
   const sessionConfig = metadata["x.ai/sessionConfig"];
-  if (!isRecord6(sessionConfig) || !Array.isArray(sessionConfig["options"])) {
+  if (!isRecord8(sessionConfig) || !Array.isArray(sessionConfig["options"])) {
     return [];
   }
-  return sessionConfig["options"].slice(0, 500).filter(isRecord6);
+  return sessionConfig["options"].slice(0, 500).filter(isRecord8);
 }
-function legacyValue(option) {
-  const value = readString2(option["id"]);
+function legacyValue(option2) {
+  const value = readString2(option2["id"]);
   return {
-    description: readString2(option["description"]).slice(0, 500),
+    description: readString2(option2["description"]).slice(0, 500),
     groupId: "",
     groupName: "",
-    name: readString2(option["label"], value).slice(0, 255),
+    name: readString2(option2["label"], value).slice(0, 255),
     value: value.slice(0, 500)
   };
 }
 function modelsRecord(response) {
-  if (!isRecord6(response) || !isRecord6(response["models"])) {
+  if (!isRecord8(response) || !isRecord8(response["models"])) {
     return {};
   }
   return response["models"];
@@ -23673,9 +24313,9 @@ function legacyModelOptions(response) {
   const options = legacyOptions(response);
   const models = modelsRecord(response);
   const values = [];
-  for (const option of options) {
-    if (option["category"] === "model") {
-      const value = legacyValue(option);
+  for (const option2 of options) {
+    if (option2["category"] === "model") {
+      const value = legacyValue(option2);
       if (value.value.length > 0 && !values.some((existing) => existing.value === value.value)) {
         values.push(value);
       }
@@ -23683,7 +24323,7 @@ function legacyModelOptions(response) {
   }
   if (values.length === 0 && Array.isArray(models["availableModels"])) {
     for (const model of models["availableModels"]) {
-      if (!isRecord6(model)) {
+      if (!isRecord8(model)) {
         continue;
       }
       const value = readString2(model["modelId"]).slice(0, 500);
@@ -23701,7 +24341,7 @@ function legacyModelOptions(response) {
       }
     }
   }
-  const selected = options.find((option) => option["category"] === "model" && option["selected"] === true);
+  const selected = options.find((option2) => option2["category"] === "model" && option2["selected"] === true);
   const currentValue = readString2(
     models["currentModelId"],
     selected === void 0 ? "" : readString2(selected["id"])
@@ -23724,11 +24364,11 @@ function legacyModelOptions(response) {
 function legacyReasoningEffortOptions(response) {
   const options = legacyOptions(response);
   const values = [];
-  for (const option of options) {
-    if (option["category"] !== "mode") {
+  for (const option2 of options) {
+    if (option2["category"] !== "mode") {
       continue;
     }
-    const value = legacyValue(option);
+    const value = legacyValue(option2);
     if (value.value.length > 0 && !values.some((existing) => existing.value === value.value)) {
       values.push(value);
     }
@@ -23736,7 +24376,7 @@ function legacyReasoningEffortOptions(response) {
   if (values.length === 0) {
     return [];
   }
-  const selected = options.find((option) => option["category"] === "mode" && option["selected"] === true);
+  const selected = options.find((option2) => option2["category"] === "mode" && option2["selected"] === true);
   if (selected === void 0) {
     values.unshift({
       description: "Use the selected model's default reasoning effort",
@@ -23763,41 +24403,41 @@ function legacyReasoningEffortOptions(response) {
   return [result];
 }
 function normalizeGrokLifecycle(response) {
-  const lifecycle = isRecord6(response) ? response : {};
+  const lifecycle = isRecord8(response) ? response : {};
   const standard = normalizeConfigOptions(lifecycle["configOptions"], lifecycle["modes"]);
   const normalized = [...standard];
-  if (!normalized.some((option) => option.category === "model")) {
+  if (!normalized.some((option2) => option2.category === "model")) {
     normalized.push(...legacyModelOptions(response));
   }
-  if (!normalized.some((option) => option.category === "thought_level")) {
+  if (!normalized.some((option2) => option2.category === "thought_level")) {
     const efforts = legacyReasoningEffortOptions(response);
     if (efforts.length > 0) {
-      const modelIndex = normalized.findIndex((option) => option.category === "model");
+      const modelIndex = normalized.findIndex((option2) => option2.category === "model");
       normalized.splice(modelIndex < 0 ? normalized.length : modelIndex + 1, 0, ...efforts);
     }
   }
   return ensureReasoningEffortOption(normalized.slice(0, 100));
 }
 function updateCurrentValue2(current, category, value) {
-  return current.map((option) => option.category === category ? { ...option, currentValue: value } : option);
+  return current.map((option2) => option2.category === category ? { ...option2, currentValue: value } : option2);
 }
 function validateGrokResponse(response, modelId) {
-  if (!isRecord6(response) || !isRecord6(response["_meta"])) {
+  if (!isRecord8(response) || !isRecord8(response["_meta"])) {
     throw new SessionConfigProtocolError("Grok Build returned an invalid session configuration response");
   }
   const model = response["_meta"]["model"];
-  const appliedModel = isRecord6(model) ? model["Ok"] : model;
+  const appliedModel = isRecord8(model) ? model["Ok"] : model;
   if (appliedModel !== modelId) {
     throw new SessionConfigProtocolError("Grok Build returned an invalid session configuration response");
   }
 }
 var GrokBuildSessionConfigProtocol = class {
   configure = async (current, change, nativeSessionId, transport) => {
-    const existing = current.find((option) => option.id === change.configId);
+    const existing = current.find((option2) => option2.id === change.configId);
     if (existing === void 0 || existing.id !== LEGACY_MODEL_CONFIG_ID && existing.id !== LEGACY_REASONING_EFFORT_CONFIG_ID) {
       return await standardSessionConfigProtocol.configure(current, change, nativeSessionId, transport);
     }
-    const model = current.find((option) => option.category === "model");
+    const model = current.find((option2) => option2.category === "model");
     if (model === void 0) {
       return current;
     }
@@ -23823,10 +24463,10 @@ var GrokBuildSessionConfigProtocol = class {
     validateGrokResponse(response, modelId);
     const updated = updateCurrentValue2(current, existing.category, change.value);
     return existing.category === "thought_level" ? updated.map(
-      (option) => option.category === "thought_level" ? {
-        ...option,
-        values: option.values.filter((value) => value.value !== AGENT_DEFAULT_REASONING_EFFORT)
-      } : option
+      (option2) => option2.category === "thought_level" ? {
+        ...option2,
+        values: option2.values.filter((value) => value.value !== AGENT_DEFAULT_REASONING_EFFORT)
+      } : option2
     ) : updated;
   };
   normalizeLifecycle = (response) => normalizeGrokLifecycle(response);
@@ -24229,7 +24869,7 @@ function createWritableAcpStream(output2) {
 function truncate3(value, maximumLength) {
   return value.length <= maximumLength ? value : `${value.slice(0, Math.max(0, maximumLength - 1))}\u2026`;
 }
-function isRecord7(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString4(value, fallback = "") {
@@ -24257,12 +24897,12 @@ function normalizeElicitationOptions(schema) {
   const normalized = [];
   const oneOf = schema["oneOf"];
   if (Array.isArray(oneOf)) {
-    for (const option of oneOf) {
-      if (isRecord7(option) && typeof option["const"] === "string") {
+    for (const option2 of oneOf) {
+      if (isRecord9(option2) && typeof option2["const"] === "string") {
         normalized.push({
-          description: truncate3(readString4(option["description"]), 500),
-          label: truncate3(readString4(option["title"], option["const"]), 255),
-          value: truncate3(option["const"], 500)
+          description: truncate3(readString4(option2["description"]), 500),
+          label: truncate3(readString4(option2["title"], option2["const"]), 255),
+          value: truncate3(option2["const"], 500)
         });
       }
     }
@@ -24278,7 +24918,7 @@ function normalizeElicitationOptions(schema) {
     return normalized.slice(0, 200);
   }
   const items = schema["items"];
-  if (!isRecord7(items)) {
+  if (!isRecord9(items)) {
     return normalized;
   }
   const anyOf = items["anyOf"];
@@ -24291,7 +24931,7 @@ function numericString(value) {
   return typeof value === "number" && Number.isFinite(value) ? value.toString() : "";
 }
 function normalizeElicitationFields(requestedSchema) {
-  if (!isRecord7(requestedSchema) || !isRecord7(requestedSchema["properties"])) {
+  if (!isRecord9(requestedSchema) || !isRecord9(requestedSchema["properties"])) {
     return [];
   }
   const properties = requestedSchema["properties"];
@@ -24301,7 +24941,7 @@ function normalizeElicitationFields(requestedSchema) {
   );
   const normalized = [];
   for (const [name, property] of Object.entries(properties)) {
-    if (!isRecord7(property)) {
+    if (!isRecord9(property)) {
       continue;
     }
     const type = elicitationFieldType(property["type"]);
@@ -24392,7 +25032,7 @@ function validateElicitationContent(encoded, requestedSchema) {
       "invalid_elicitation_response"
     );
   }
-  if (!isRecord7(decoded) || !isRecord7(requestedSchema) || !isRecord7(requestedSchema["properties"])) {
+  if (!isRecord9(decoded) || !isRecord9(requestedSchema) || !isRecord9(requestedSchema["properties"])) {
     throw new AcpExecutionError(
       "Elicitation response does not match the requested form",
       {},
@@ -24412,7 +25052,7 @@ function validateElicitationContent(encoded, requestedSchema) {
   const validated = {};
   for (const [name, value] of Object.entries(decoded)) {
     const property = properties[name];
-    if (!isRecord7(property)) {
+    if (!isRecord9(property)) {
       throw new AcpExecutionError(
         `Elicitation field ${name} was not requested`,
         {},
@@ -24449,7 +25089,7 @@ function validateElicitationContent(encoded, requestedSchema) {
         );
       }
       const allowed = normalizeElicitationOptions(property);
-      if (allowed.length > 0 && value.some((entry) => !allowed.some((option) => option.value === entry))) {
+      if (allowed.length > 0 && value.some((entry) => !allowed.some((option2) => option2.value === entry))) {
         throw new AcpExecutionError(
           `Elicitation field ${name} contains an invalid selection`,
           {},
@@ -24946,7 +25586,7 @@ var AcpProcessSession = class _AcpProcessSession {
   };
   nativeSessionId = () => this.#nativeSessionId;
   configure = async (options) => {
-    const existing = this.#configOptions.find((option) => option.id === options.configId);
+    const existing = this.#configOptions.find((option2) => option2.id === options.configId);
     if (existing === void 0 || existing.type !== options.valueType) {
       throw new AcpExecutionError(
         "The requested ACP configuration option is unavailable",
@@ -25196,10 +25836,10 @@ var AcpProcessSession = class _AcpProcessSession {
   onPermission = async (request, signal) => {
     this.assertNativeSession(request.sessionId);
     const interactionId = `permission-${crypto.randomUUID()}`;
-    const options = request.options.slice(0, 20).map((option) => ({
-      kind: option.kind,
-      name: truncate3(option.name, 255),
-      optionId: truncate3(option.optionId, 255)
+    const options = request.options.slice(0, 20).map((option2) => ({
+      kind: option2.kind,
+      name: truncate3(option2.name, 255),
+      optionId: truncate3(option2.optionId, 255)
     }));
     if (options.length === 0) {
       throw new AcpExecutionError(
@@ -25208,7 +25848,7 @@ var AcpProcessSession = class _AcpProcessSession {
         "invalid_agent_permission_request"
       );
     }
-    const pending = new PendingPermission(interactionId, new Set(options.map((option) => option.optionId)));
+    const pending = new PendingPermission(interactionId, new Set(options.map((option2) => option2.optionId)));
     this.#pendingPermissions.set(interactionId, pending);
     const abort = () => {
       void this.cancelPermission(interactionId);
@@ -25418,7 +26058,7 @@ var AcpProcessSession = class _AcpProcessSession {
     }
     if (update.sessionUpdate === "current_mode_update") {
       this.#configOptions = this.#configOptions.map(
-        (option) => option.category === "mode" ? { ...option, currentValue: update.currentModeId } : option
+        (option2) => option2.category === "mode" ? { ...option2, currentValue: update.currentModeId } : option2
       );
       this.#configRevision += 1;
       await this.emitConfigUpdate();
@@ -26650,47 +27290,757 @@ var WorkspaceDirectoryService = class {
   };
 };
 
-// src/native-sessions/service.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-
-// src/native-sessions/codex-history.ts
-import { spawn as spawn4 } from "node:child_process";
-var responseSchema = external_exports.union([
-  external_exports.object({
-    id: external_exports.number(),
-    error: external_exports.object({ code: external_exports.number(), message: external_exports.string() })
-  }),
-  external_exports.object({ id: external_exports.number(), result: external_exports.unknown() }),
-  external_exports.object({ method: external_exports.string() })
-]);
-var threadSchema = external_exports.object({
-  thread: external_exports.object({
-    id: nativeSessionIdSchema,
-    cwd: external_exports.string().min(1).max(2048).refine((path2) => !path2.includes("\0"))
-  })
-});
-var turnsSchema = external_exports.object({
-  data: external_exports.array(external_exports.object({ items: external_exports.array(external_exports.unknown()).max(1e5) })).max(SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT),
-  nextCursor: external_exports.string().nullish()
-});
-var itemTypeSchema = external_exports.object({ type: external_exports.string().min(1).max(80) });
-var userMessageSchema = external_exports.object({
-  content: external_exports.array(external_exports.unknown()).max(1e4)
-});
-var textSchema = external_exports.object({ text: external_exports.string() });
-var imageSchema = external_exports.object({ url: external_exports.string() });
-var agentMessageSchema = textSchema.extend({ phase: external_exports.string().nullish() });
-function decodeHistory(thread, value) {
-  const page = turnsSchema.parse(value);
-  const messages = [];
-  let characters = 0;
-  let imageCharacters = 0;
-  let truncated = page.nextCursor != null;
-  for (const turn of page.data.toReversed()) {
-    for (const item of turn.items) {
-      const { type } = itemTypeSchema.parse(item);
-      let message;
-      if (type === "userMessage") {
+// src/bots/local-bot-grant-store.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
+import { stat as stat7 } from "node:fs/promises";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+var LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS = 90 * 24 * 60 * 60 * 1e3;
+var LocalBotAuthorizationError = class extends Error {
+  code;
+  constructor(code, message, options = {}) {
+    super(message, options);
+    this.code = code;
+    this.name = "LocalBotAuthorizationError";
+  }
+};
+var LocalBotGrant = class {
+  agent;
+  agentIdentityDigest;
+  allowedDeliveryTargetIds;
+  behaviorDigest;
+  behaviorRevisionId;
+  bindingId;
+  bindingRevision;
+  botId;
+  expiresAt;
+  localGrantId;
+  revocationEpoch;
+  workspaceIdentityDigest;
+  workspacePath;
+  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
+    this.localGrantId = localGrantId;
+    this.botId = botId;
+    this.behaviorRevisionId = behaviorRevisionId;
+    this.behaviorDigest = behaviorDigest;
+    this.bindingId = bindingId;
+    this.bindingRevision = bindingRevision;
+    this.agent = agent;
+    this.agentIdentityDigest = agentIdentityDigest;
+    this.workspacePath = workspacePath;
+    this.workspaceIdentityDigest = workspaceIdentityDigest;
+    this.allowedDeliveryTargetIds = Object.freeze([...allowedDeliveryTargetIds]);
+    this.expiresAt = expiresAt;
+    this.revocationEpoch = revocationEpoch;
+  }
+};
+function digest(value) {
+  return createHash2("sha256").update(value, "utf8").digest("hex");
+}
+function agentDigest(agent) {
+  return digest(
+    JSON.stringify({
+      adapter: agent.adapterIdentity,
+      agent: agent.agentIdentity,
+      agentVersion: agent.agentVersion,
+      arguments: agent.arguments,
+      id: agent.id
+    })
+  );
+}
+async function workspaceDigest(path2) {
+  const metadata = await stat7(path2);
+  if (!metadata.isDirectory()) {
+    throw new LocalBotAuthorizationError("binding_incompatible", "The Bot workspace is not a directory");
+  }
+  return digest(
+    JSON.stringify({
+      changedAtMilliseconds: metadata.ctimeMs,
+      device: metadata.dev,
+      inode: metadata.ino,
+      path: path2
+    })
+  );
+}
+function exactTargets(left, right) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  const expected = [...left].sort();
+  const actual = [...right].sort();
+  return expected.every((target, index) => target === actual[index]);
+}
+function rowString(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "string") {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function rowInteger(row, key) {
+  const value = Reflect.get(row, key);
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value;
+}
+function parseTargets(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid", { cause });
+  }
+  if (!Array.isArray(value) || value.some((target) => typeof target !== "string")) {
+    throw new LocalBotAuthorizationError("local_grant_invalid", "The local Bot grant is invalid");
+  }
+  return value.filter((target) => typeof target === "string");
+}
+var LocalBotGrantStore = class {
+  #database;
+  constructor(path2) {
+    this.#database = new DatabaseSync3(path2);
+    this.#database.exec(`
+          CREATE TABLE IF NOT EXISTS local_bot_grants (
+            local_grant_id TEXT PRIMARY KEY,
+            bot_id TEXT NOT NULL,
+            behavior_revision_id TEXT NOT NULL,
+            behavior_digest TEXT NOT NULL,
+            binding_id TEXT NOT NULL UNIQUE,
+            binding_revision INTEGER NOT NULL,
+            agent_ref TEXT NOT NULL,
+            agent_identity_digest TEXT NOT NULL,
+            workspace_ref TEXT NOT NULL,
+            workspace_path TEXT NOT NULL,
+            workspace_identity_digest TEXT NOT NULL,
+            allowed_delivery_target_ids_json TEXT NOT NULL,
+            unattended_policy_json TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL,
+            revocation_epoch INTEGER NOT NULL DEFAULT 0,
+            revoked_at INTEGER
+          ) STRICT;
+          CREATE TABLE IF NOT EXISTS local_bot_binding_resolutions (
+            request_id TEXT PRIMARY KEY,
+            binding_id TEXT NOT NULL,
+            local_grant_id TEXT NOT NULL,
+            resolved_at INTEGER NOT NULL,
+            result TEXT NOT NULL CHECK (result IN ('approved', 'unavailable')),
+            error_code TEXT,
+            error_message TEXT
+          ) STRICT;
+        `);
+  }
+  approve = async (request, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const existing = this.#database.prepare(
+      `SELECT grants.* FROM local_bot_binding_resolutions AS resolutions
+                   INNER JOIN local_bot_grants AS grants
+                     ON grants.local_grant_id = resolutions.local_grant_id
+                  WHERE resolutions.request_id = ? AND resolutions.binding_id = ?
+                    AND resolutions.result = 'approved'`
+    ).get(request.requestId, request.bindingId);
+    if (existing !== void 0) {
+      return new BotExecutionBindingApprovedEvent(
+        request.requestId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.bindingId,
+        request.bindingRevision,
+        rowString(existing, "local_grant_id"),
+        rowString(existing, "agent_identity_digest"),
+        rowString(existing, "workspace_identity_digest")
+      );
+    }
+    const resolved = await this.resolveProposal(request, catalog, directories, bindingAuthorityId, signal);
+    const localGrantId = `lbg_${randomUUID3()}`;
+    const expiresAt = now + LOCAL_BOT_GRANT_LIFETIME_MILLISECONDS;
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#database.prepare(
+        `INSERT INTO local_bot_grants (
+                       local_grant_id, bot_id, behavior_revision_id, behavior_digest,
+                       binding_id, binding_revision, agent_ref,
+                       agent_identity_digest, workspace_ref, workspace_path,
+                       workspace_identity_digest, allowed_delivery_target_ids_json,
+                       unattended_policy_json, created_at, expires_at
+                     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(
+        localGrantId,
+        request.botId,
+        request.behaviorRevisionId,
+        request.behaviorDigest,
+        request.bindingId,
+        request.bindingRevision,
+        request.agentRef,
+        resolved.agentIdentityDigest,
+        request.workspaceRef,
+        resolved.workspacePath,
+        resolved.workspaceIdentityDigest,
+        JSON.stringify(request.allowedDeliveryTargets.map((target) => target.deliveryTargetId)),
+        JSON.stringify({ localSideEffects: "owner-approval-required" }),
+        now,
+        expiresAt
+      );
+      this.#database.prepare(
+        `INSERT INTO local_bot_binding_resolutions (
+                       request_id, binding_id, local_grant_id, resolved_at, result
+                     ) VALUES (?, ?, ?, ?, 'approved')`
+      ).run(request.requestId, request.bindingId, localGrantId, now);
+      this.#database.exec("COMMIT");
+    } catch (cause) {
+      this.#database.exec("ROLLBACK");
+      throw cause;
+    }
+    signal.throwIfAborted();
+    return new BotExecutionBindingApprovedEvent(
+      request.requestId,
+      request.botId,
+      request.behaviorRevisionId,
+      request.bindingId,
+      request.bindingRevision,
+      localGrantId,
+      resolved.agentIdentityDigest,
+      resolved.workspaceIdentityDigest
+    );
+  };
+  resolveExecution = async (command, catalog, directories, bindingAuthorityId, now, signal) => {
+    signal.throwIfAborted();
+    const row = this.#database.prepare(
+      `SELECT * FROM local_bot_grants
+                  WHERE local_grant_id = ? AND bot_id = ?
+                    AND behavior_revision_id = ? AND behavior_digest = ?
+                    AND binding_id = ? AND binding_revision = ?
+                    AND agent_ref = ? AND workspace_ref = ?
+                    AND revoked_at IS NULL AND expires_at > ?`
+    ).get(
+      command.localGrantId,
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      command.agentId,
+      command.directoryId,
+      now
+    );
+    if (row === void 0) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution binding is not locally approved"
+      );
+    }
+    const approvedTargets = parseTargets(rowString(row, "allowed_delivery_target_ids_json"));
+    const requestedTargets = command.allowedDeliveryTargets.map((target) => target.deliveryTargetId);
+    if (!exactTargets(approvedTargets, requestedTargets)) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target policy changed after local approval"
+      );
+    }
+    const agent = catalog.find(command.agentId);
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    const workspacePath = await directories.resolve(bindingAuthorityId, command.directoryId, signal);
+    const currentAgentDigest = agentDigest(agent);
+    const currentWorkspaceDigest = await workspaceDigest(workspacePath);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged || currentAgentDigest !== rowString(row, "agent_identity_digest") || currentWorkspaceDigest !== rowString(row, "workspace_identity_digest") || workspacePath !== rowString(row, "workspace_path")) {
+      this.revoke(rowString(row, "local_grant_id"), now);
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution target changed and requires local approval"
+      );
+    }
+    if (command.behaviorInstructions.length > 0 && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply the approved Bot behavior"
+      );
+    }
+    return new LocalBotGrant(
+      rowString(row, "local_grant_id"),
+      command.botId,
+      command.behaviorRevisionId,
+      command.behaviorDigest,
+      command.bindingId,
+      command.bindingRevision,
+      agent,
+      currentAgentDigest,
+      workspacePath,
+      currentWorkspaceDigest,
+      approvedTargets,
+      rowInteger(row, "expires_at"),
+      rowInteger(row, "revocation_epoch")
+    );
+  };
+  recordUnavailable = (request, code, message, now) => {
+    this.#database.prepare(
+      `INSERT OR IGNORE INTO local_bot_binding_resolutions (
+                   request_id, binding_id, local_grant_id, resolved_at,
+                   result, error_code, error_message
+                 ) VALUES (?, ?, '', ?, 'unavailable', ?, ?)`
+    ).run(request.requestId, request.bindingId, now, code, message);
+  };
+  close = () => {
+    this.#database.close();
+  };
+  resolveProposal = async (request, catalog, directories, bindingAuthorityId, signal) => {
+    const agent = catalog.find(request.agentRef);
+    if (request.requiredCapabilities.includes("embedded-context") && !agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot apply embedded Bot context"
+      );
+    }
+    if (request.requiredCapabilities.some((capability) => capability !== "embedded-context")) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The Bot requires an unsupported local Agent capability"
+      );
+    }
+    const [adapterUnchanged, agentUnchanged] = await Promise.all([
+      revalidateExecutable(agent.adapterIdentity),
+      revalidateExecutable(agent.agentIdentity)
+    ]);
+    signal.throwIfAborted();
+    if (!adapterUnchanged || !agentUnchanged) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent executable changed before approval"
+      );
+    }
+    const workspacePath = await directories.resolve(bindingAuthorityId, request.workspaceRef, signal);
+    return {
+      agent,
+      agentIdentityDigest: agentDigest(agent),
+      workspaceIdentityDigest: await workspaceDigest(workspacePath),
+      workspacePath
+    };
+  };
+  revoke = (localGrantId, now) => {
+    this.#database.prepare(
+      `UPDATE local_bot_grants
+                    SET revoked_at = COALESCE(revoked_at, ?), revocation_epoch = revocation_epoch + 1
+                  WHERE local_grant_id = ? AND revoked_at IS NULL`
+    ).run(now, localGrantId);
+  };
+};
+
+// src/bots/bot-context-applicator.ts
+var AppliedBotContext = class {
+  resources;
+  constructor(resources) {
+    this.resources = Object.freeze([...resources]);
+  }
+};
+var EmbeddedBotContextApplicator = class {
+  apply = async (command, grant, resources, signal) => {
+    signal.throwIfAborted();
+    if (grant.botId !== command.botId || grant.behaviorRevisionId !== command.behaviorRevisionId || grant.behaviorDigest !== command.behaviorDigest) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot behavior does not match its local authorization"
+      );
+    }
+    if (command.behaviorInstructions.length === 0) {
+      return new AppliedBotContext(resources);
+    }
+    if (!grant.agent.capabilities.embeddedContextPrompt) {
+      throw new LocalBotAuthorizationError(
+        "binding_incompatible",
+        "The local Agent cannot enforce the Bot behavior context"
+      );
+    }
+    const trustedContext = {
+      mimeType: "text/markdown",
+      name: "Mobius Bot behavior",
+      text: command.behaviorInstructions,
+      type: "embedded",
+      uri: `mobius://bots/${encodeURIComponent(command.botId)}/behavior-revisions/${encodeURIComponent(command.behaviorRevisionId)}?sha256=${command.behaviorDigest}`
+    };
+    return new AppliedBotContext([trustedContext, ...resources]);
+  };
+};
+
+// src/bots/bot-execution-context.ts
+import { randomBytes } from "node:crypto";
+var ActiveBotExecutionContext = class {
+  command;
+  contextHandle;
+  constructor(contextHandle, command) {
+    this.contextHandle = contextHandle;
+    this.command = command;
+  }
+  resolveTarget = (target) => {
+    if (target === "current") {
+      if (!(this.command.replyRoute instanceof BotConnectionReplyRoute)) {
+        throw new LocalBotAuthorizationError(
+          "delivery_target_not_allowed",
+          "This Bot conversation has no external reply target"
+        );
+      }
+      return this.command.replyRoute.deliveryTargetId;
+    }
+    const resolved = this.command.allowedDeliveryTargets.find((candidate) => candidate.alias === target);
+    if (resolved === void 0) {
+      throw new LocalBotAuthorizationError(
+        "delivery_target_not_allowed",
+        "The named Bot delivery target is not approved"
+      );
+    }
+    return resolved.deliveryTargetId;
+  };
+};
+var BotExecutionContextLease = class {
+  context;
+  #release;
+  #released = false;
+  constructor(context, release) {
+    this.context = context;
+    this.#release = release;
+  }
+  release = () => {
+    if (this.#released) {
+      return;
+    }
+    this.#released = true;
+    this.#release();
+  };
+};
+var BotExecutionContextRegistry = class {
+  #activeByHandle = /* @__PURE__ */ new Map();
+  #handlesBySession = /* @__PURE__ */ new Map();
+  #inactiveHandles = /* @__PURE__ */ new Set();
+  #now;
+  constructor(now = Date.now) {
+    this.#now = now;
+  }
+  activate = (command) => {
+    let handle = this.#handlesBySession.get(command.sessionId);
+    if (handle === void 0) {
+      handle = `ctx_${randomBytes(32).toString("base64url")}`;
+      this.#handlesBySession.set(command.sessionId, handle);
+    }
+    if (this.#activeByHandle.has(handle)) {
+      throw new LocalBotAuthorizationError("session_busy", "The Bot execution context is already active");
+    }
+    const context = new ActiveBotExecutionContext(handle, command);
+    this.#inactiveHandles.delete(handle);
+    this.#activeByHandle.set(handle, context);
+    return new BotExecutionContextLease(context, () => {
+      if (this.#activeByHandle.get(handle) === context) {
+        this.#activeByHandle.delete(handle);
+        this.#inactiveHandles.add(handle);
+      }
+    });
+  };
+  read = (handle) => {
+    const context = this.#activeByHandle.get(handle);
+    if (context === void 0) {
+      if (this.#inactiveHandles.has(handle)) {
+        throw new LocalBotAuthorizationError(
+          "execution_capability_expired",
+          "The Bot execution capability has expired"
+        );
+      }
+      throw new LocalBotAuthorizationError(
+        "execution_context_required",
+        "An active Bot execution context is required"
+      );
+    }
+    if (Date.parse(context.command.executionDeadlineAt) <= this.#now()) {
+      throw new LocalBotAuthorizationError(
+        "execution_capability_expired",
+        "The Bot execution capability has expired"
+      );
+    }
+    return context;
+  };
+};
+
+// src/bots/bot-outbound-ipc.ts
+import { chmod as chmod2, mkdir as mkdir4, unlink } from "node:fs/promises";
+import { createServer } from "node:net";
+import { dirname as dirname6, isAbsolute as isAbsolute8 } from "node:path";
+import { fetch as fetch4 } from "undici";
+var BOT_IPC_REQUEST_LIMIT = 32 * 1024;
+var BOT_IPC_TIMEOUT_MILLISECONDS2 = 2e4;
+var BOT_RELAY_TIMEOUT_MILLISECONDS = 2e4;
+var IDENTIFIER_PATTERN6 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var WINDOWS_NAMED_PIPE_PREFIX = "\\\\.\\pipe\\";
+var BotOutboundIpcRequest = class {
+  contextHandle;
+  idempotencyKey;
+  target;
+  text;
+  constructor(contextHandle, idempotencyKey, target, text) {
+    this.contextHandle = contextHandle;
+    this.idempotencyKey = idempotencyKey;
+    this.target = target;
+    this.text = text;
+  }
+};
+function isRecord10(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeRequest(encoded) {
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid", { cause });
+  }
+  if (!isRecord10(value)) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 4 || !keys.every((key) => ["contextHandle", "idempotencyKey", "target", "text"].includes(key))) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request fields are invalid");
+  }
+  const contextHandle = value["contextHandle"];
+  const idempotencyKey = value["idempotencyKey"];
+  const target = value["target"];
+  const text = value["text"];
+  if (typeof contextHandle !== "string" || !/^ctx_[a-zA-Z0-9_-]{43}$/.test(contextHandle) || typeof idempotencyKey !== "string" || !IDENTIFIER_PATTERN6.test(idempotencyKey) || typeof target !== "string" || !IDENTIFIER_PATTERN6.test(target) || typeof text !== "string" || text.trim().length === 0 || text.length > 1e4) {
+    throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
+  }
+  return new BotOutboundIpcRequest(contextHandle, idempotencyKey, target, text);
+}
+function relayEndpoint(relayUrl, context, target) {
+  const endpoint = new URL(relayUrl);
+  if (endpoint.protocol !== "ws:" && endpoint.protocol !== "wss:") {
+    throw new LocalBotAuthorizationError("bot_service_unavailable", "The Mobius Relay URL is invalid");
+  }
+  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  endpoint.search = "";
+  const execution = encodeURIComponent(context.command.executionId);
+  if (target === "current") {
+    context.resolveTarget(target);
+    endpoint.pathname = `${MOBIUS_API_PREFIX}/v1/bot-executions/${execution}/reply-messages`;
+    return endpoint;
+  }
+  const deliveryTargetId = context.resolveTarget(target);
+  endpoint.pathname = `${MOBIUS_API_PREFIX}/v1/bot-executions/${execution}/delivery-targets/${encodeURIComponent(deliveryTargetId)}/messages`;
+  return endpoint;
+}
+function daemonToken(relayUrl) {
+  const token = relayUrl.searchParams.get("token") ?? "";
+  if (!/^[a-zA-Z0-9_-]{32,256}$/.test(token)) {
+    throw new LocalBotAuthorizationError("bot_service_unavailable", "The Runtime credential is unavailable");
+  }
+  return token;
+}
+async function decodeRelayResponse(response) {
+  const encoded = await response.text();
+  let value;
+  try {
+    value = JSON.parse(encoded);
+  } catch (cause) {
+    throw new LocalBotAuthorizationError("bot_service_unavailable", "The Mobius Relay returned invalid data", {
+      cause
+    });
+  }
+  if (response.status === 202 && isRecord10(value) && typeof value["outboundMessageId"] === "string") {
+    return value["outboundMessageId"];
+  }
+  if (isRecord10(value) && isRecord10(value["error"])) {
+    const error61 = value["error"];
+    if (typeof error61["code"] === "string" && typeof error61["message"] === "string") {
+      throw new LocalBotAuthorizationError(error61["code"], error61["message"]);
+    }
+  }
+  throw new LocalBotAuthorizationError("bot_service_unavailable", "The Mobius Relay rejected the Bot action");
+}
+var BotOutboundIpcServer = class {
+  #registry;
+  #relayUrl;
+  #server;
+  #socketPath;
+  #usesFilesystemSocket;
+  constructor(socketPath, relayUrl, registry2) {
+    const usesFilesystemSocket = !socketPath.startsWith(WINDOWS_NAMED_PIPE_PREFIX);
+    if (usesFilesystemSocket && !isAbsolute8(socketPath)) {
+      throw new Error("The Bot IPC path must be absolute");
+    }
+    this.#registry = registry2;
+    this.#relayUrl = new URL(relayUrl);
+    this.#server = createServer({ allowHalfOpen: true }, (socket) => this.accept(socket));
+    this.#socketPath = socketPath;
+    this.#usesFilesystemSocket = usesFilesystemSocket;
+  }
+  get socketPath() {
+    return this.#socketPath;
+  }
+  listen = async (signal) => {
+    signal.throwIfAborted();
+    if (this.#usesFilesystemSocket) {
+      await mkdir4(dirname6(this.#socketPath), { mode: 448, recursive: true });
+      await unlink(this.#socketPath).catch((error61) => {
+        if (!isRecord10(error61) || error61["code"] !== "ENOENT") {
+          throw error61;
+        }
+      });
+    }
+    await new Promise((resolve5, reject) => {
+      const fail = (error61) => reject(error61);
+      this.#server.once("error", fail);
+      this.#server.listen(this.#socketPath, () => {
+        this.#server.removeListener("error", fail);
+        resolve5();
+      });
+    });
+    if (this.#usesFilesystemSocket) {
+      await chmod2(this.#socketPath, 384);
+    }
+    signal.addEventListener("abort", this.abort, { once: true });
+    if (signal.aborted) {
+      this.abort();
+    }
+  };
+  close = async () => {
+    if (this.#server.listening) {
+      await new Promise((resolve5, reject) => {
+        this.#server.close((error61) => {
+          if (error61 === void 0) {
+            resolve5();
+            return;
+          }
+          reject(error61);
+        });
+      });
+    }
+    if (this.#usesFilesystemSocket) {
+      await unlink(this.#socketPath).catch((error61) => {
+        if (!isRecord10(error61) || error61["code"] !== "ENOENT") {
+          throw error61;
+        }
+      });
+    }
+  };
+  #abort = () => {
+    this.#server.close();
+  };
+  abort = () => this.#abort();
+  accept = (socket) => {
+    const chunks = [];
+    let length = 0;
+    let rejected = false;
+    const controller = new AbortController();
+    socket.setTimeout(BOT_IPC_TIMEOUT_MILLISECONDS2, () => {
+      controller.abort(new Error("Bot IPC request timed out"));
+      socket.destroy();
+    });
+    socket.on("data", (chunk) => {
+      length += chunk.byteLength;
+      if (length > BOT_IPC_REQUEST_LIMIT) {
+        rejected = true;
+        controller.abort(new Error("Bot IPC request is too large"));
+        socket.end(
+          JSON.stringify({
+            error: { code: "invalid_request", message: "The local Bot request is too large" },
+            ok: false
+          })
+        );
+        return;
+      }
+      chunks.push(chunk);
+    });
+    socket.once("error", () => controller.abort());
+    socket.once("close", () => controller.abort());
+    socket.once("end", () => {
+      if (rejected) {
+        return;
+      }
+      void this.handle(Buffer.concat(chunks).toString("utf8").trim(), controller.signal).then(
+        (outboundMessageId) => {
+          if (!socket.destroyed) {
+            socket.end(JSON.stringify({ ok: true, outboundMessageId }));
+          }
+        },
+        (error61) => {
+          if (socket.destroyed) {
+            return;
+          }
+          const code = error61 instanceof LocalBotAuthorizationError ? error61.code : "bot_service_unavailable";
+          const message = error61 instanceof LocalBotAuthorizationError ? error61.message : "The local Bot action could not be completed";
+          socket.end(JSON.stringify({ error: { code, message }, ok: false }));
+        }
+      );
+    });
+  };
+  handle = async (encoded, signal) => {
+    const request = decodeRequest(encoded);
+    const context = this.#registry.read(request.contextHandle);
+    const timeout = AbortSignal.timeout(BOT_RELAY_TIMEOUT_MILLISECONDS);
+    const requestSignal = AbortSignal.any([signal, timeout]);
+    let response;
+    try {
+      response = await fetch4(relayEndpoint(this.#relayUrl, context, request.target), {
+        body: JSON.stringify({ idempotencyKey: request.idempotencyKey, text: request.text }),
+        headers: {
+          authorization: `Bearer ${daemonToken(this.#relayUrl)}`,
+          "content-type": "application/json",
+          "x-mobius-bot-execution-capability": context.command.executionCapabilitySecret
+        },
+        method: "POST",
+        signal: requestSignal
+      });
+    } catch (cause) {
+      signal.throwIfAborted();
+      throw new LocalBotAuthorizationError(
+        timeout.aborted ? "bot_service_timeout" : "bot_service_unavailable",
+        timeout.aborted ? "The Mobius Bot action timed out" : "The Mobius Relay is unavailable",
+        { cause }
+      );
+    }
+    return await decodeRelayResponse(response);
+  };
+};
+
+// src/native-sessions/service.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+
+// src/native-sessions/codex-history.ts
+import { spawn as spawn4 } from "node:child_process";
+var responseSchema = external_exports.union([
+  external_exports.object({
+    id: external_exports.number(),
+    error: external_exports.object({ code: external_exports.number(), message: external_exports.string() })
+  }),
+  external_exports.object({ id: external_exports.number(), result: external_exports.unknown() }),
+  external_exports.object({ method: external_exports.string() })
+]);
+var threadSchema = external_exports.object({
+  thread: external_exports.object({
+    id: nativeSessionIdSchema,
+    cwd: external_exports.string().min(1).max(2048).refine((path2) => !path2.includes("\0"))
+  })
+});
+var turnsSchema = external_exports.object({
+  data: external_exports.array(external_exports.object({ items: external_exports.array(external_exports.unknown()).max(1e5) })).max(SESSION_HISTORY_PREVIEW_MESSAGE_LIMIT),
+  nextCursor: external_exports.string().nullish()
+});
+var itemTypeSchema = external_exports.object({ type: external_exports.string().min(1).max(80) });
+var userMessageSchema = external_exports.object({
+  content: external_exports.array(external_exports.unknown()).max(1e4)
+});
+var textSchema = external_exports.object({ text: external_exports.string() });
+var imageSchema = external_exports.object({ url: external_exports.string() });
+var agentMessageSchema = textSchema.extend({ phase: external_exports.string().nullish() });
+function decodeHistory(thread, value) {
+  const page = turnsSchema.parse(value);
+  const messages = [];
+  let characters = 0;
+  let imageCharacters = 0;
+  let truncated = page.nextCursor != null;
+  for (const turn of page.data.toReversed()) {
+    for (const item of turn.items) {
+      const { type } = itemTypeSchema.parse(item);
+      let message;
+      if (type === "userMessage") {
         const { content } = userMessageSchema.parse(item);
         const parsed = parseNativeHistoryText(
           content.map((block) => {
@@ -26967,7 +28317,7 @@ var NativeSessionService = class {
         if (authorized === null) {
           continue;
         }
-        const entryId = randomUUID2();
+        const entryId = randomUUID4();
         if (this.#entries.size >= 5e3) {
           this.#entries.clear();
         }
@@ -26995,7 +28345,7 @@ var NativeSessionService = class {
             "invalid_native_session_response"
           );
         }
-        nextCursor = randomUUID2();
+        nextCursor = randomUUID4();
         if (this.#cursors.size >= 500) {
           this.#cursors.clear();
         }
@@ -27213,13 +28563,13 @@ var NativeSessionService = class {
 };
 
 // src/prompt-artifact-resolver.ts
-import { createHash as createHash2 } from "node:crypto";
-import { fetch as fetch4 } from "undici";
+import { createHash as createHash3 } from "node:crypto";
+import { fetch as fetch5 } from "undici";
 var ARTIFACT_SCHEME = "mobius-artifact:";
 var ARTIFACT_DOWNLOAD_TIMEOUT_MILLISECONDS = 2e4;
 var MAX_AGENT_IMAGE_BASE64_LENGTH = 4e6;
 var MAX_AGENT_RESOURCE_BYTE_LENGTH = 1e6;
-var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+var IDENTIFIER_PATTERN7 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var PromptArtifactError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -27262,7 +28612,7 @@ function parseReference(resource) {
   const encodedByteLength2 = url2.searchParams.get("byteLength") ?? "";
   const sha256 = url2.searchParams.get("sha256") ?? "";
   const byteLength = Number(encodedByteLength2);
-  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN5.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
+  if (url2.protocol !== ARTIFACT_SCHEME || url2.hash.length > 0 || resource.type !== "link" || resource.text.length > 0 || !IDENTIFIER_PATTERN7.test(artifactId) || keys.length !== 2 || keys[0] !== "byteLength" || keys[1] !== "sha256" || !/^[1-9][0-9]*$/.test(encodedByteLength2) || !Number.isSafeInteger(byteLength) || !/^[a-f0-9]{64}$/.test(sha256)) {
     throw new PromptArtifactError("artifact_reference_invalid", "The prompt artifact reference is invalid");
   }
   return new PromptArtifactReference(artifactId, byteLength, sha256, resource);
@@ -27323,7 +28673,7 @@ async function download(config2, command, reference, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch4(downloadUrl(config2, command, reference), {
+    response = await fetch5(downloadUrl(config2, command, reference), {
       dispatcher: environmentProxyDispatcher,
       headers: { accept: reference.resource.mimeType },
       signal: requestSignal
@@ -27343,7 +28693,7 @@ async function download(config2, command, reference, signal) {
       );
     }
     const bytes = await responseBytes(response, reference.byteLength, requestSignal);
-    if (createHash2("sha256").update(bytes).digest("hex") !== reference.sha256) {
+    if (createHash3("sha256").update(bytes).digest("hex") !== reference.sha256) {
       throw new PromptArtifactError(
         "artifact_integrity_failed",
         "The prompt artifact failed integrity validation"
@@ -27488,7 +28838,7 @@ function connectRelay(url2, signal) {
 }
 
 // src/relay-connection/liveness.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var HEARTBEAT_ACK_TIMEOUT_MILLISECONDS = 1e4;
 var HEARTBEAT_INTERVAL_MILLISECONDS = 2e4;
 var RelayLivenessState = class {
@@ -27576,7 +28926,7 @@ var RelayConnectionLiveness = class {
       }
       throw new Error("Heartbeat was scheduled in an invalid state");
     }
-    const heartbeatId = randomUUID3();
+    const heartbeatId = randomUUID5();
     this.#state = new AwaitingHeartbeatAckState(
       heartbeatId,
       this.#timer.schedule(this.#handleTimeout, HEARTBEAT_ACK_TIMEOUT_MILLISECONDS)
@@ -27592,8 +28942,8 @@ var RelayConnectionLiveness = class {
 
 // src/relay-connection/session-event-outbox.ts
 import { mkdirSync as mkdirSync3 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
-import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+import { dirname as dirname7 } from "node:path";
+import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 function readPendingEnvelope(row) {
   if (typeof row !== "object" || row === null || Array.isArray(row)) {
     throw new Error("SQLite returned an invalid session event outbox row");
@@ -27607,8 +28957,8 @@ function readPendingEnvelope(row) {
 var SessionEventOutbox = class {
   #database;
   constructor(path2) {
-    mkdirSync3(dirname6(path2), { recursive: true });
-    this.#database = new DatabaseSync3(path2);
+    mkdirSync3(dirname7(path2), { recursive: true });
+    this.#database = new DatabaseSync4(path2);
     this.#database.exec(`
       CREATE TABLE IF NOT EXISTS relay_session_event_outbox (
         ordinal INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -27799,6 +29149,12 @@ var RELAY_RECONNECT_DELAY_MILLISECONDS = 500;
 var RELAY_CONNECTION_REFRESH_MILLISECONDS = 20 * 60 * 1e3;
 var ACTIVE_TURN_RECONCILIATION_TIMEOUT_MILLISECONDS = 2e4;
 var ACTIVE_TURN_RECONCILIATION_CLOSE_CODE = 4009;
+function botIpcSocketPath() {
+  if (process.platform === "win32") {
+    return `\\\\.\\pipe\\mobius-bot-${randomUUID6()}`;
+  }
+  return join16("/tmp", `mobius-bot-${randomUUID6()}.sock`);
+}
 var RelayConnectionRefreshState = class {
 };
 var ScheduledRelayConnectionRefreshState = class extends RelayConnectionRefreshState {
@@ -28056,7 +29412,7 @@ async function reconcileActiveTurn(config2, turn, signal) {
   const requestSignal = AbortSignal.any([signal, timeoutSignal]);
   let response;
   try {
-    response = await fetch5(activeTurnReconciliationEndpoint(config2, turn), {
+    response = await fetch6(activeTurnReconciliationEndpoint(config2, turn), {
       body: JSON.stringify({ outcome: { kind: "running" } }),
       dispatcher: environmentProxyDispatcher,
       headers: { "content-type": "application/json" },
@@ -28159,13 +29515,13 @@ function reportFailure(publisher, command, code, message, attemptId) {
   );
 }
 function operationErrorCode(error61) {
-  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof PromptArtifactError) {
+  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof LocalBotAuthorizationError || error61 instanceof PromptArtifactError) {
     return error61.code;
   }
   return "session_operation_failed";
 }
 function operationErrorMessage(error61) {
-  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof PromptArtifactError) {
+  if (error61 instanceof AcpExecutionError || error61 instanceof LocalAuthorizationError || error61 instanceof LocalAgentCatalogError || error61 instanceof LocalBotAuthorizationError || error61 instanceof PromptArtifactError) {
     return error61.message;
   }
   return "The local agent operation could not be completed";
@@ -28430,6 +29786,175 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
     console.error("Mobius daemon command failed", error61);
   }
 }
+function botExecutionAgent(agent, contextHandle, socketPath) {
+  return new LocalAgentDefinition(
+    agent.id,
+    agent.label,
+    agent.command,
+    agent.arguments,
+    {
+      ...agent.environment,
+      MOBIUS_BOT_CONTEXT: contextHandle,
+      MOBIUS_BOT_SOCKET: socketPath,
+      MOBIUS_RELAY_TOKEN: "",
+      MOBIUS_RELAY_URL: ""
+    },
+    agent.adapterVersion,
+    agent.agentVersion,
+    agent.adapterIdentity,
+    agent.agentIdentity,
+    agent.promptTimeoutMilliseconds,
+    agent.capabilities
+  );
+}
+async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, signal) {
+  try {
+    if (command.additionalDirectoryIds.length > 0) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "The Bot execution requested unapproved additional directories"
+      );
+    }
+    const deadline = Date.parse(command.executionDeadlineAt);
+    const remaining = deadline - Date.now();
+    if (!Number.isSafeInteger(deadline) || remaining <= 0) {
+      throw new LocalBotAuthorizationError("turn_expired", "The Bot execution deadline has expired");
+    }
+    const grant = await grants.resolveExecution(
+      command,
+      config2.catalog,
+      directories,
+      config2.bindingId,
+      Date.now(),
+      signal
+    );
+    const attachments = await resolvePromptArtifacts(config2, command, signal);
+    const applied = await applicator.apply(command, grant, attachments.resources, signal);
+    const lease = contexts.activate(command);
+    try {
+      const deadlineSignal = AbortSignal.timeout(remaining);
+      const executionSignal = AbortSignal.any([signal, deadlineSignal]);
+      const agent = botExecutionAgent(grant.agent, lease.context.contextHandle, ipc.socketPath);
+      audit.record({
+        commandId: command.commandId,
+        details: {
+          behaviorRevisionId: command.behaviorRevisionId,
+          bindingId: command.bindingId,
+          botId: command.botId,
+          executionId: command.executionId,
+          localGrantId: command.localGrantId
+        },
+        event: "bot_session_authorized",
+        sessionId: command.sessionId
+      });
+      outbox.transitionExecution(command.commandId, "running");
+      publisher.recordAttempt(
+        command.sessionId,
+        encodeSessionStartedEvent({
+          attemptId,
+          commandId: command.commandId,
+          kind: SESSION_STARTED_KIND,
+          sessionId: command.sessionId
+        }),
+        attemptId
+      );
+      const result = await sessions.runPrompt({
+        additionalDirectories: [],
+        agent,
+        commandId: command.commandId,
+        cwd: grant.workspacePath,
+        images: attachments.images,
+        onActivity: (activity) => {
+          publisher.recordAttempt(
+            command.sessionId,
+            encodeAgentActivityEvent({
+              activityId: activity.activityId,
+              activityType: activity.activityType,
+              commandId: command.commandId,
+              content: activity.content,
+              detail: activity.detail,
+              input: activity.input,
+              kind: AGENT_ACTIVITY_KIND,
+              locations: activity.locations,
+              name: activity.name,
+              output: activity.output,
+              sequence: activity.sequence,
+              sessionId: command.sessionId,
+              status: activity.status,
+              title: activity.title,
+              toolKind: activity.toolKind
+            }),
+            attemptId
+          );
+          return Promise.resolve();
+        },
+        onText: (text) => {
+          publisher.recordAttempt(
+            command.sessionId,
+            encodeAgentMessageDeltaEvent({
+              commandId: command.commandId,
+              kind: AGENT_MESSAGE_DELTA_KIND,
+              sessionId: command.sessionId,
+              text
+            }),
+            attemptId
+          );
+          return Promise.resolve();
+        },
+        prompt: command.prompt,
+        resources: applied.resources,
+        sessionId: command.sessionId,
+        signal: executionSignal
+      });
+      publisher.recordAttempt(
+        command.sessionId,
+        encodeSessionCompletedEvent({
+          commandId: command.commandId,
+          kind: SESSION_COMPLETED_KIND,
+          sessionId: command.sessionId,
+          stopReason: result.stopReason
+        }),
+        attemptId
+      );
+      outbox.transitionExecution(
+        command.commandId,
+        result.stopReason === "cancelled" ? "cancelled" : "succeeded"
+      );
+      audit.record({
+        commandId: command.commandId,
+        details: { botId: command.botId, executionId: command.executionId },
+        event: result.stopReason === "cancelled" ? "bot_session_cancelled" : "bot_session_completed",
+        sessionId: command.sessionId
+      });
+    } finally {
+      lease.release();
+    }
+  } catch (error61) {
+    const failure = Date.parse(command.executionDeadlineAt) <= Date.now() ? new LocalBotAuthorizationError("turn_expired", "The Bot execution deadline has expired", {
+      cause: error61
+    }) : error61;
+    audit.record({
+      commandId: command.commandId,
+      details: {
+        botId: command.botId,
+        code: operationErrorCode(failure),
+        executionId: command.executionId
+      },
+      event: "bot_session_failed",
+      sessionId: command.sessionId
+    });
+    const code = operationErrorCode(failure);
+    reportFailure(
+      publisher,
+      command,
+      code === "session_operation_failed" ? "agent_execution_failed" : code,
+      code === "session_operation_failed" ? "The local agent could not complete the Bot request" : operationErrorMessage(failure),
+      attemptId
+    );
+    outbox.transitionExecution(command.commandId, "failed");
+    console.error("Mobius daemon Bot command failed", failure);
+  }
+}
 function waitForRelayRetry(signal, timer) {
   if (signal.aborted) {
     return Promise.resolve();
@@ -28466,7 +29991,7 @@ async function publishAgentCatalogUntilAvailable(config2, signal, timer) {
     }
   }
 }
-async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, publisher, activeTurns, activeAttemptIds, onConnected, signal, timer) {
+async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, publisher, grants, contexts, applicator, ipc, activeTurns, activeAttemptIds, onConnected, signal, timer) {
   const relayUrl = new URL(config2.relayUrl);
   relayUrl.searchParams.set("liveness", "1");
   const socket = await connectRelay(relayUrl, signal);
@@ -28563,6 +30088,62 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             }
             return;
           }
+          if (kind === BOT_BINDING_APPROVAL_REQUEST_KIND) {
+            const request = decodeBotExecutionBindingApprovalRequest(encoded);
+            void grants.approve(
+              request,
+              config2.catalog,
+              directories,
+              config2.bindingId,
+              Date.now(),
+              connectionController.signal
+            ).then((approved) => {
+              audit.record({
+                commandId: request.requestId,
+                details: {
+                  behaviorRevisionId: request.behaviorRevisionId,
+                  bindingId: request.bindingId,
+                  botId: request.botId,
+                  localGrantId: approved.localGrantId
+                },
+                event: "bot_binding_approved",
+                sessionId: `bot-binding:${request.bindingId}`
+              });
+              if (socket.readyState === WebSocket2.OPEN) {
+                send(socket, encodeBotExecutionBindingApprovedEvent(approved));
+              }
+            }).catch((error61) => {
+              if (connectionController.signal.aborted) {
+                return;
+              }
+              const code = error61 instanceof LocalBotAuthorizationError ? error61.code : "binding_incompatible";
+              const message = error61 instanceof LocalBotAuthorizationError ? error61.message : "The local execution target is incompatible";
+              grants.recordUnavailable(request, code, message, Date.now());
+              audit.record({
+                commandId: request.requestId,
+                details: { bindingId: request.bindingId, botId: request.botId, code },
+                event: "bot_binding_unavailable",
+                sessionId: `bot-binding:${request.bindingId}`
+              });
+              if (socket.readyState === WebSocket2.OPEN) {
+                send(
+                  socket,
+                  encodeBotExecutionBindingUnavailableEvent(
+                    new BotExecutionBindingUnavailableEvent(
+                      request.requestId,
+                      request.botId,
+                      request.behaviorRevisionId,
+                      request.bindingId,
+                      request.bindingRevision,
+                      code,
+                      message
+                    )
+                  )
+                );
+              }
+            });
+            return;
+          }
           if (kind === NATIVE_SESSION_CANCEL_KIND) {
             const command2 = decodeNativeSessionCancel(encoded);
             const pending = nativeRequests.get(command2.requestId);
@@ -28761,6 +30342,44 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             });
             return;
           }
+          if (kind === BOT_SESSION_PROMPT_KIND) {
+            const command2 = decodeBotSessionPromptCommand(encoded);
+            if (activeTurns.has(command2.commandId)) {
+              return;
+            }
+            const receipt2 = outbox.claimExecution(command2.commandId, command2.sessionId, encoded);
+            if (receipt2.kind === "duplicate") {
+              return;
+            }
+            const turn2 = new ActiveDaemonTurn(command2, receipt2.attemptId);
+            activeTurns.set(command2.commandId, turn2);
+            activeAttemptIds.set(command2.sessionId, receipt2.attemptId);
+            void executeBotPrompt(
+              outbox,
+              publisher,
+              command2,
+              config2,
+              directories,
+              audit,
+              sessions,
+              grants,
+              contexts,
+              applicator,
+              ipc,
+              receipt2.attemptId,
+              turn2.signal
+            ).catch((error61) => {
+              console.error("Mobius daemon Bot turn failed", error61);
+            }).finally(() => {
+              activeTurns.delete(command2.commandId);
+              if (activeAttemptIds.get(command2.sessionId) === receipt2.attemptId) {
+                activeAttemptIds.delete(command2.sessionId);
+              }
+              turn2.finish();
+              connectionRefresh.afterTurnFinished();
+            });
+            return;
+          }
           if (kind !== SESSION_PROMPT_KIND) {
             throw new Error("Unsupported protocol message");
           }
@@ -28851,6 +30470,10 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   const sessionStore = new SqliteAcpSessionStore(config2.auditDatabasePath);
   const outbox = new SessionEventOutbox(config2.auditDatabasePath);
   const publisher = new DaemonSessionEventPublisher(outbox);
+  const grants = new LocalBotGrantStore(config2.auditDatabasePath);
+  const contexts = new BotExecutionContextRegistry();
+  const applicator = new EmbeddedBotContextApplicator();
+  const ipc = new BotOutboundIpcServer(botIpcSocketPath(), config2.relayUrl, contexts);
   const activeTurns = /* @__PURE__ */ new Map();
   const activeAttemptIds = /* @__PURE__ */ new Map();
   const recordSessionEvent = (sessionId, payload) => {
@@ -28889,6 +30512,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   };
   const catalogPublication = publishAgentCatalogUntilAvailable(config2, signal, timer);
   try {
+    await ipc.listen(signal);
     while (!signal.aborted) {
       try {
         await runRelayConnection(
@@ -28901,6 +30525,10 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
           nativeSessions,
           outbox,
           publisher,
+          grants,
+          contexts,
+          applicator,
+          ipc,
           activeTurns,
           activeAttemptIds,
           announceConnection,
@@ -28932,12 +30560,20 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
         await installations.close();
       } finally {
         try {
-          await sessions.close();
+          await ipc.close();
         } finally {
           try {
-            sessionStore.close();
+            await sessions.close();
           } finally {
-            outbox.close();
+            try {
+              sessionStore.close();
+            } finally {
+              try {
+                grants.close();
+              } finally {
+                outbox.close();
+              }
+            }
           }
         }
       }
@@ -28955,11 +30591,13 @@ Usage:
   mobius pair --url <relay-url> --code <pairing-code> [--workspace <directory>]
   mobius start --channel <channel-id>
   mobius agents [--json]
+  mobius bot message send --target <current|alias> --text <message>
 
 Commands:
   pair   Pair this machine and start its local daemon
   start  Start the local daemon for a saved channel
   agents Show detected, missing, and integration-ready Agents
+  bot    Invoke Bot-scoped actions from an active local execution
 
 Pairing grants this browser access to the machine with your user account's permissions.
 New conversations default to ~/.mobius/workspace; choose other directories in the browser.
@@ -28975,7 +30613,7 @@ async function main() {
     if (arguments_.length > 1 || arguments_.length === 1 && arguments_[0] !== "--json") {
       throw new Error("Usage: mobius agents [--json]");
     }
-    await mkdir4(loadDefaultWorkspace(), { recursive: true, mode: 448 });
+    await mkdir5(loadDefaultWorkspace(), { recursive: true, mode: 448 });
     const inventory = await discoverLocalAgentInventory({
       defaultWorkspace: loadDefaultWorkspace(),
       environment: process.env,
@@ -28984,6 +30622,18 @@ async function main() {
     process.stdout.write(formatAgentDiagnostics(inventory, arguments_[0] === "--json"));
     return;
   }
+  if (command === "bot") {
+    if (process.argv[3] !== "message" || process.argv[4] !== "send") {
+      throw new BotMessageCommandError(
+        "invalid_request",
+        "Usage: mobius bot message send --target <current|alias> --text <message>"
+      );
+    }
+    const outboundMessageId = await executeBotMessageCommand(process.argv.slice(5), process.env, shutdown.signal);
+    process.stdout.write(`${JSON.stringify({ outboundMessageId })}
+`);
+    return;
+  }
   let config2;
   if (command === "pair") {
     process.stdout.write(`mobius version: ${package_default.version}
@@ -29023,7 +30673,8 @@ try {
 } catch (error61) {
   if (!shutdown.signal.aborted) {
     const message = error61 instanceof Error ? error61.message : "Unknown failure";
-    process.stderr.write(`Mobius daemon failed: ${message}
+    const code = error61 instanceof BotMessageCommandError ? `${error61.code}: ` : "";
+    process.stderr.write(`Mobius daemon failed: ${code}${message}
 `);
     process.exitCode = 1;
   }