@moxt-ai/mobius 0.0.23 → 0.0.25

package/dist/cli.js

@@ -11,7 +11,7 @@ import { mkdir as mkdir5 } from "node:fs/promises";
 // package.json
 var package_default = {
   name: "@moxt-ai/mobius",
-  version: "0.0.23",
+  version: "0.0.25",
   description: "Mobius CLI for pairing and running local AI agent services.",
   type: "module",
   bin: {
@@ -21,6 +21,10 @@ var package_default = {
     ".": {
       types: "./dist/index.d.ts",
       import: "./dist/index.js"
+    },
+    "./runtime": {
+      types: "./dist/runtime.d.ts",
+      import: "./dist/runtime.js"
     }
   },
   files: [
@@ -38,7 +42,7 @@ var package_default = {
     directory: "packages/cli"
   },
   scripts: {
-    build: "tsc --project tsconfig.build.json && esbuild src/cli.ts src/index.ts --bundle --platform=node --format=esm --sourcemap --outdir=dist --external:@agentclientprotocol/* --external:undici",
+    build: "tsc --project tsconfig.build.json && esbuild src/cli.ts src/index.ts src/runtime.ts --bundle --platform=node --format=esm --sourcemap --outdir=dist --external:@agentclientprotocol/* --external:undici",
     dev: "node --watch src/cli.ts",
     prepack: "pnpm build",
     start: "node dist/cli.js",
@@ -71,6 +75,16 @@ var package_default = {
 import { realpathSync, statSync } from "node:fs";
 
 // src/acp/session-capabilities.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasTrueChildField(value, childKey, fieldKey) {
+  if (!isRecord(value)) {
+    return false;
+  }
+  const child = Reflect.get(value, childKey);
+  return isRecord(child) && Reflect.get(child, fieldKey) === true;
+}
 function unsupportedSessionCapabilities() {
   return Object.freeze({
     additionalDirectories: false,
@@ -81,11 +95,14 @@ function unsupportedSessionCapabilities() {
     imagePrompt: false,
     listSessions: false,
     loadSession: false,
+    promptQueueing: false,
     resumeSession: false,
+    steering: false,
     unstableForkSession: false
   });
 }
-function normalizeAcpCapabilities(capabilities) {
+function normalizeAcpCapabilities(initialized) {
+  const capabilities = initialized.agentCapabilities ?? {};
   const session = capabilities.sessionCapabilities;
   const prompt = capabilities.promptCapabilities;
   return Object.freeze({
@@ -97,7 +114,9 @@ function normalizeAcpCapabilities(capabilities) {
     imagePrompt: prompt?.image === true,
     listSessions: session?.list != null,
     loadSession: capabilities.loadSession === true,
+    promptQueueing: hasTrueChildField(capabilities._meta, "claudeCode", "promptQueueing"),
     resumeSession: session?.resume != null,
+    steering: hasTrueChildField(initialized._meta, "steering", "supported"),
     unstableForkSession: session?.fork != null
   });
 }
@@ -865,7 +884,7 @@ var ManagedNpmPackageError = class extends Error {
     this.name = "ManagedNpmPackageError";
   }
 };
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function packagePath(root, packageName) {
@@ -887,7 +906,7 @@ async function readJsonRecord(path2, maximumBytes) {
         );
       }
       const value = JSON.parse(await handle.readFile({ encoding: "utf8" }));
-      if (!isRecord(value)) {
+      if (!isRecord2(value)) {
         throw new ManagedNpmPackageError(
           "managed_package_verification_failed",
           "The managed npm package metadata is invalid"
@@ -913,7 +932,7 @@ function readBinPath(packageMetadata, executableName) {
   if (typeof bin === "string") {
     return bin;
   }
-  if (isRecord(bin) && typeof bin[executableName] === "string") {
+  if (isRecord2(bin) && typeof bin[executableName] === "string") {
     return bin[executableName];
   }
   throw new ManagedNpmPackageError(
@@ -929,7 +948,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
     );
   }
   const packages = lock["packages"];
-  if (!isRecord(packages)) {
+  if (!isRecord2(packages)) {
     throw new ManagedNpmPackageError(
       "managed_package_verification_failed",
       "The managed npm package lockfile is invalid"
@@ -943,7 +962,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
     if (verifyDependencyClosure && normalizedKey.length > 0) {
       let resolved;
       try {
-        if (!normalizedKey.split("/").includes("node_modules") || !isRecord(candidate) || typeof candidate["version"] !== "string" || candidate["version"].length === 0 || typeof candidate["integrity"] !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(candidate["integrity"]) || typeof candidate["resolved"] !== "string") {
+        if (!normalizedKey.split("/").includes("node_modules") || !isRecord2(candidate) || typeof candidate["version"] !== "string" || candidate["version"].length === 0 || typeof candidate["integrity"] !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(candidate["integrity"]) || typeof candidate["resolved"] !== "string") {
           throw new Error("Invalid locked dependency");
         }
         resolved = new URL(candidate["resolved"]);
@@ -966,7 +985,7 @@ function verifyPackageLockEntry(lock, definition, verifyDependencyClosure) {
       matches += 1;
     }
   }
-  if (matches !== 1 || !isRecord(entry) || entry["integrity"] !== definition.integrity || entry["resolved"] !== definition.tarballUrl || entry["version"] !== definition.version) {
+  if (matches !== 1 || !isRecord2(entry) || entry["integrity"] !== definition.integrity || entry["resolved"] !== definition.tarballUrl || entry["version"] !== definition.version) {
     throw new ManagedNpmPackageError(
       "managed_package_verification_failed",
       "The managed npm package lockfile does not match the pinned artifact"
@@ -1607,7 +1626,7 @@ var ManagedAgentArchiveError = class extends Error {
     this.name = "ManagedAgentArchiveError";
   }
 };
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isContainedPath3(root, candidate) {
@@ -1664,7 +1683,7 @@ async function readManifest(path2) {
       );
     }
     const parsed = JSON.parse(await handle.readFile({ encoding: "utf8" }));
-    if (!isRecord2(parsed)) {
+    if (!isRecord3(parsed)) {
       throw new ManagedAgentArchiveError(
         "managed_archive_verification_failed",
         "The managed Agent archive manifest is invalid"
@@ -2384,7 +2403,7 @@ async function probeAcpReadiness(specification, agent, environment, defaultWorks
     await specification.verifyAcp(connection, initialized, defaultWorkspace, controller.signal);
     return new VerifiedAcpReadiness(
       normalizedVersion(initialized.agentInfo?.version ?? ""),
-      normalizeAcpCapabilities(initialized.agentCapabilities ?? {})
+      normalizeAcpCapabilities(initialized)
     );
   } catch (error61) {
     if (signal.aborted) {
@@ -2563,54 +2582,6 @@ async function discoverLocalAgentInventory(options) {
   return new LocalAgentInventory(discoveries);
 }
 
-// src/audit/audit-store.ts
-import { mkdirSync } from "node:fs";
-import { dirname as dirname3 } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-var AuditStore = class {
-  database;
-  constructor(path2) {
-    mkdirSync(dirname3(path2), { recursive: true });
-    this.database = new DatabaseSync(path2);
-    this.database.exec(`
-      CREATE TABLE IF NOT EXISTS audit_events (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        recorded_at TEXT NOT NULL,
-        event TEXT NOT NULL,
-        command_id TEXT NOT NULL,
-        session_id TEXT NOT NULL,
-        details_json TEXT NOT NULL DEFAULT '{}'
-      ) STRICT
-    `);
-    const columns = this.database.prepare("PRAGMA table_info(audit_events)").all();
-    if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
-      this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
-    }
-  }
-  record(record2) {
-    this.database.prepare(
-      `
-          INSERT INTO audit_events (
-            recorded_at,
-            event,
-            command_id,
-            session_id,
-            details_json
-          ) VALUES (?, ?, ?, ?, ?)
-        `
-    ).run(
-      (/* @__PURE__ */ new Date()).toISOString(),
-      record2.event,
-      record2.commandId,
-      record2.sessionId,
-      JSON.stringify(record2.details ?? {})
-    );
-  }
-  close() {
-    this.database.close();
-  }
-};
-
 // src/bots/bot-message-command.ts
 import { randomUUID } from "node:crypto";
 import { createConnection } from "node:net";
@@ -2624,7 +2595,7 @@ var BotMessageCommandError = class extends Error {
     this.name = "BotMessageCommandError";
   }
 };
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requiredEnvironment(environment, name) {
@@ -2675,14 +2646,14 @@ function decodeResponse(encoded) {
       cause
     });
   }
-  if (!isRecord3(value) || typeof value["ok"] !== "boolean") {
+  if (!isRecord4(value) || typeof value["ok"] !== "boolean") {
     throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
   }
   if (value["ok"] === true && typeof value["outboundMessageId"] === "string") {
     return value["outboundMessageId"];
   }
   const error61 = value["error"];
-  if (value["ok"] === false && isRecord3(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
+  if (value["ok"] === false && isRecord4(error61) && typeof error61["code"] === "string" && typeof error61["message"] === "string") {
     throw new BotMessageCommandError(error61["code"], error61["message"]);
   }
   throw new BotMessageCommandError("bot_service_unavailable", "The local Bot service returned invalid data");
@@ -21743,7 +21714,9 @@ var sessionCapabilitiesSchema = external_exports.strictObject({
   imagePrompt: external_exports.boolean(),
   listSessions: external_exports.boolean(),
   loadSession: external_exports.boolean(),
+  promptQueueing: external_exports.boolean().default(false),
   resumeSession: external_exports.boolean(),
+  steering: external_exports.boolean().default(false),
   unstableForkSession: external_exports.boolean().default(false)
 }).readonly();
 var sessionCommandSchema = external_exports.strictObject({
@@ -22085,6 +22058,11 @@ var AGENT_ACTIVITY_LOCATION_LIMIT = 12;
 var AGENT_ACTIVITY_LOCATION_LENGTH_LIMIT = 1024;
 var SESSION_COMPLETED_KIND = "session.completed";
 var SESSION_FAILED_KIND = "session.failed";
+var SessionPromptDisposition = Object.freeze({
+  Queue: "queue",
+  Reject: "reject",
+  Steer: "steer"
+});
 
 // ../protocol/src/codecs/messages.ts
 var IDENTIFIER_PATTERN2 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
@@ -22114,7 +22092,7 @@ var ProtocolMessageError = class extends Error {
     this.name = "ProtocolMessageError";
   }
 };
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson2(encoded) {
@@ -22126,7 +22104,7 @@ function parseJson2(encoded) {
       cause: error61
     });
   }
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22159,6 +22137,19 @@ function readAllowedString(value, key, allowedValues) {
   }
   return field;
 }
+function readPromptDisposition(value) {
+  const field = value["disposition"];
+  if (field === void 0 || field === SessionPromptDisposition.Reject) {
+    return SessionPromptDisposition.Reject;
+  }
+  if (field === SessionPromptDisposition.Queue) {
+    return SessionPromptDisposition.Queue;
+  }
+  if (field === SessionPromptDisposition.Steer) {
+    return SessionPromptDisposition.Steer;
+  }
+  throw new ProtocolMessageError("Invalid value field: disposition");
+}
 function readSequence(value, key) {
   const field = value[key];
   if (typeof field !== "number" || !Number.isSafeInteger(field) || field < 0) {
@@ -22210,7 +22201,7 @@ function readActivityContent(value) {
 }
 function readActivityDetail(value) {
   const field = value["detail"];
-  if (!isRecord4(field)) {
+  if (!isRecord5(field)) {
     throw new ProtocolMessageError("Invalid activity detail field");
   }
   const kind = readString(field, "kind", 32);
@@ -22283,11 +22274,13 @@ function decodeSessionPromptCommand(encoded) {
     "bindingId",
     "commandId",
     "directoryId",
+    "disposition",
     "images",
     "kind",
     "prompt",
     "resources",
-    "sessionId"
+    "sessionId",
+    "targetCommandId"
   ]);
   assertKind(value, SESSION_PROMPT_KIND);
   const prompt = readText(value, "prompt", MAX_PROMPT_LENGTH);
@@ -22300,17 +22293,25 @@ function decodeSessionPromptCommand(encoded) {
   if (prompt.trim().length === 0 && images.length === 0 && resources.length === 0) {
     throw new ProtocolMessageError("Prompt must contain content");
   }
+  const disposition = readPromptDisposition(value);
+  const rawTargetCommandId = value["targetCommandId"];
+  const targetCommandId = rawTargetCommandId === void 0 ? "" : readText(value, "targetCommandId", 128);
+  if (disposition === SessionPromptDisposition.Reject && targetCommandId.length > 0 || disposition !== SessionPromptDisposition.Reject && !IDENTIFIER_PATTERN2.test(targetCommandId)) {
+    throw new ProtocolMessageError("Prompt disposition has an invalid target command");
+  }
   return {
     additionalDirectoryIds: readDirectoryIdentifiers(value, "additionalDirectoryIds", 16),
     agentId: readIdentifier(value, "agentId"),
     bindingId: readIdentifier(value, "bindingId"),
     commandId: readIdentifier(value, "commandId"),
     directoryId: readDirectoryIdentifier(value, "directoryId"),
+    disposition,
     images,
     kind: SESSION_PROMPT_KIND,
     prompt,
     resources,
-    sessionId: readIdentifier(value, "sessionId")
+    sessionId: readIdentifier(value, "sessionId"),
+    targetCommandId
   };
 }
 function decodeSessionCancelCommand(encoded) {
@@ -22360,11 +22361,12 @@ function decodeSessionStartedEvent(encoded) {
 }
 function decodeAgentMessageDeltaEvent(encoded) {
   const value = parseJson2(encoded);
-  assertExactKeys(value, ["commandId", "kind", "sessionId", "text"]);
+  assertExactKeys(value, ["commandId", "kind", "messageId", "sessionId", "text"]);
   assertKind(value, AGENT_MESSAGE_DELTA_KIND);
   return {
     commandId: readIdentifier(value, "commandId"),
     kind: AGENT_MESSAGE_DELTA_KIND,
+    messageId: value["messageId"] === void 0 ? "" : readText(value, "messageId", 255),
     sessionId: readIdentifier(value, "sessionId"),
     text: readString(value, "text", MAX_EVENT_TEXT_LENGTH)
   };
@@ -22629,7 +22631,7 @@ var BotSessionPromptCommand = class {
     this.replyRoute = replyRoute;
   }
 };
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson3(encoded) {
@@ -22639,7 +22641,7 @@ function parseJson3(encoded) {
   } catch (cause) {
     throw new ProtocolMessageError("Message is not valid JSON", { cause });
   }
-  if (!isRecord5(value)) {
+  if (!isRecord6(value)) {
     throw new ProtocolMessageError("Message must be a JSON object");
   }
   return value;
@@ -22724,7 +22726,7 @@ function readTargets(value, key) {
   const identifiers = /* @__PURE__ */ new Set();
   const aliases = /* @__PURE__ */ new Set();
   for (const candidate of field) {
-    if (!isRecord5(candidate)) {
+    if (!isRecord6(candidate)) {
       throw new ProtocolMessageError(`Invalid Bot delivery targets: ${key}`);
     }
     assertExactKeys2(candidate, ["alias", "deliveryTargetId"]);
@@ -22740,7 +22742,7 @@ function readTargets(value, key) {
   return Object.freeze(targets);
 }
 function readCompletionPolicy(value) {
-  if (!isRecord5(value)) {
+  if (!isRecord6(value)) {
     throw new ProtocolMessageError("Invalid Bot completion policy");
   }
   const kind = readText2(value, "kind", 32, false);
@@ -22758,7 +22760,7 @@ function readCompletionPolicy(value) {
   throw new ProtocolMessageError("Invalid Bot completion policy");
 }
 function readReplyRoute(value) {
-  if (!isRecord5(value)) {
+  if (!isRecord6(value)) {
     throw new ProtocolMessageError("Invalid Bot reply route");
   }
   const kind = readText2(value, "kind", 32, false);
@@ -23010,6 +23012,8 @@ var sessionHistorySchema = external_exports.discriminatedUnion("status", [
 var NATIVE_SESSION_REQUEST_KIND = "native.session.request";
 var NATIVE_SESSION_RESULT_KIND = "native.session.result";
 var NATIVE_SESSION_CANCEL_KIND = "native.session.cancel";
+var NATIVE_SESSION_TURN_FORK_REQUEST_KIND = "native.session.turn-fork.request";
+var NATIVE_SESSION_TURN_FORK_KIND = "native.session.turn-fork";
 var identifier = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
 var directoryId = external_exports.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/);
 var envelope = {
@@ -23024,6 +23028,28 @@ var identity = {
   bindingId: identifier,
   directoryId
 };
+var turnForkIdentity = {
+  additionalDirectoryIds: external_exports.array(directoryId).max(16).readonly(),
+  agentId: identifier,
+  bindingId: identifier,
+  directoryId,
+  requestId: identifier,
+  sessionId: identifier,
+  sourceCommandId: identifier,
+  targetSessionId: identifier
+};
+var nativeSessionTurnForkRequestSchema = external_exports.strictObject({
+  ...turnForkIdentity,
+  kind: external_exports.literal(NATIVE_SESSION_TURN_FORK_REQUEST_KIND)
+}).readonly();
+var nativeSessionTurnForkCommandSchema = external_exports.strictObject({
+  ...turnForkIdentity,
+  kind: external_exports.literal(NATIVE_SESSION_TURN_FORK_KIND),
+  messageFingerprint: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/),
+  messageId: external_exports.string().min(1).max(255),
+  messageOccurrence: external_exports.number().int().positive(),
+  title: external_exports.string().max(500)
+}).readonly();
 var nativeSessionCommandSchema = external_exports.discriminatedUnion("action", [
   external_exports.strictObject({
     ...identity,
@@ -23098,6 +23124,7 @@ function decode4(schema, encoded) {
 var decodeNativeSessionCommand = (encoded) => decode4(nativeSessionCommandSchema, encoded);
 var encodeNativeSessionResult = (value) => JSON.stringify(nativeSessionResultSchema.parse(value));
 var decodeNativeSessionCancel = (encoded) => decode4(nativeSessionCancelSchema, encoded);
+var decodeNativeSessionTurnForkCommand = (encoded) => decode4(nativeSessionTurnForkCommandSchema, encoded);
 
 // ../protocol/src/session-events.ts
 var SESSION_EVENT_KIND = "session.event";
@@ -23183,9 +23210,9 @@ var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAckno
 var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSchema);
 
 // src/config.ts
-function loadDefaultWorkspace() {
-  const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = process.env;
-  return configuredWorkspace ?? join13(readStateDirectory(), "workspace");
+function loadDefaultWorkspace(environment = process.env) {
+  const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
+  return configuredWorkspace ?? join13(readStateDirectory(environment), "workspace");
 }
 function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
@@ -23212,7 +23239,9 @@ var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var TOKEN_PATTERN2 = /^[a-zA-Z0-9_-]{32,256}$/;
 var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
 var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken", "runtimeId"];
-var SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "daemonToken", "relayOrigin"];
+var REDEEM_RESPONSE_KEYS = ["channelId", "runtimeCredential", "runtimeId"];
+var LEGACY_SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "daemonToken", "relayOrigin"];
+var SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "relayOrigin", "runtimeCredential"];
 var PairingClientError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -23221,7 +23250,7 @@ var PairingClientError = class extends Error {
     this.name = "PairingClientError";
   }
 };
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasExactKeys(value, expectedKeys) {
@@ -23249,7 +23278,7 @@ function readSingleOption(arguments_, option2) {
 function assertKnownArguments(arguments_) {
   for (let index = 0; index < arguments_.length; index += 2) {
     const option2 = arguments_[index];
-    if (option2 !== "--url" && option2 !== "--code" && option2 !== "--workspace") {
+    if (option2 !== "--url" && option2 !== "--code" && option2 !== "--pairing" && option2 !== "--workspace") {
       throw new PairingClientError("invalid_arguments", `Unknown pairing option: ${option2 ?? "missing option"}`);
     }
   }
@@ -23289,10 +23318,17 @@ function parsePairCommand(arguments_) {
   assertKnownArguments(arguments_);
   return {
     code: parsePairingCode(readSingleOption(arguments_, "--code")),
+    pairingId: arguments_.includes("--pairing") ? validatePairingId(readSingleOption(arguments_, "--pairing")) : "",
     relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
     workspace: arguments_.includes("--workspace") ? readSingleOption(arguments_, "--workspace") : loadDefaultWorkspace()
   };
 }
+function validatePairingId(value) {
+  if (!IDENTIFIER_PATTERN5.test(value)) {
+    throw new PairingClientError("invalid_pairing_id", "The Runtime pairing ID is invalid");
+  }
+  return value;
+}
 function parseChannelArgument(arguments_) {
   if (arguments_.length !== 2 || arguments_[0] !== "--channel") {
     throw new PairingClientError("invalid_arguments", "Usage: mobius start --channel <channel-id>");
@@ -23337,9 +23373,9 @@ async function readJsonResponse(response) {
   }
 }
 function readRelayError(value) {
-  if (isRecord6(value)) {
+  if (isRecord7(value)) {
     const error61 = value["error"];
-    if (isRecord6(error61)) {
+    if (isRecord7(error61)) {
       const code = error61["code"];
       const message = error61["message"];
       if (typeof code === "string" && typeof message === "string") {
@@ -23349,17 +23385,17 @@ function readRelayError(value) {
   }
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
-function decodeClaimResponse(value) {
-  if (!isRecord6(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
+function decodePairingResponse(value, credentialField, expectedKeys) {
+  if (!isRecord7(value) || !hasExactKeys(value, expectedKeys)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
-  const daemonToken2 = value["daemonToken"];
+  const runtimeCredential = value[credentialField];
   const runtimeId = value["runtimeId"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
-  return { channelId, daemonToken: daemonToken2, runtimeId };
+  return { channelId, runtimeCredential, runtimeId };
 }
 async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
   const agents = localAgents.map((agent) => ({
@@ -23369,7 +23405,7 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
     id: agent.id,
     label: agent.label
   }));
-  const endpoint = mobiusApiUrl(options.relayOrigin, "/pairings/claim");
+  const endpoint = options.pairingId.length > 0 ? mobiusApiUrl(options.relayOrigin, `/v1/runtime-pairings/${encodeURIComponent(options.pairingId)}/redeem`) : mobiusApiUrl(options.relayOrigin, "/pairings/claim");
   let response;
   try {
     response = await fetch2(endpoint, {
@@ -23392,10 +23428,10 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   if (!response.ok) {
     throw readRelayError(value);
   }
-  return decodeClaimResponse(value);
+  return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
-async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWorkspace) {
-  const connectionsDirectory = join14(readStateDirectory(), "connections");
+async function persistConnection(channelId, relayOrigin, runtimeCredential, defaultWorkspace, environment) {
+  const connectionsDirectory = join14(readStateDirectory(environment), "connections");
   await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
   const connectionPath = join14(connectionsDirectory, `${channelId}.json`);
   const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID2()}.tmp`);
@@ -23405,8 +23441,8 @@ async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWo
       {
         defaultWorkspace,
         channelId,
-        daemonToken: daemonToken2,
-        relayOrigin: relayOrigin.toString()
+        relayOrigin: relayOrigin.toString(),
+        runtimeCredential
       },
       null,
       2
@@ -23418,25 +23454,25 @@ async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWo
   return connectionPath;
 }
 function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord6(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
+  if (!isRecord7(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   const defaultWorkspace = value["defaultWorkspace"];
   const channelId = value["channelId"];
-  const daemonToken2 = value["daemonToken"];
+  const runtimeCredential = value["runtimeCredential"] ?? value["daemonToken"];
   const relayOrigin = value["relayOrigin"];
-  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof relayOrigin !== "string") {
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof relayOrigin !== "string") {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   return {
     defaultWorkspace,
     channelId,
-    daemonToken: daemonToken2,
-    relayOrigin: parseRelayOrigin(relayOrigin)
+    relayOrigin: parseRelayOrigin(relayOrigin),
+    runtimeCredential
   };
 }
-async function readSavedConnection(channelId) {
-  const connectionPath = join14(readStateDirectory(), "connections", `${channelId}.json`);
+async function readSavedConnection(channelId, environment) {
+  const connectionPath = join14(readStateDirectory(environment), "connections", `${channelId}.json`);
   let encoded = "";
   const handle = await open4(connectionPath, "r");
   try {
@@ -23458,8 +23494,8 @@ async function readSavedConnection(channelId) {
   return {
     defaultWorkspace: await resolveDefaultWorkspace(connection.defaultWorkspace),
     channelId: connection.channelId,
-    daemonToken: connection.daemonToken,
-    relayOrigin: connection.relayOrigin
+    relayOrigin: connection.relayOrigin,
+    runtimeCredential: connection.runtimeCredential
   };
 }
 function assertInventoryUsable(inventory) {
@@ -23467,15 +23503,12 @@ function assertInventoryUsable(inventory) {
     throw new PairingClientError("no_supported_agent", "No supported Agent is available for local discovery");
   }
 }
-function buildPairedDaemon(connection, connectionPath, inventory) {
+function buildPairedDaemon(connection, connectionPath, inventory, environment) {
   assertInventoryUsable(inventory);
-  const relayUrl = mobiusApiUrl(
-    connection.relayOrigin,
-    `/channels/${encodeURIComponent(connection.channelId)}/daemon`
-  );
+  const relayUrl = mobiusApiUrl(connection.relayOrigin, "/v1/runtimes/connect");
   relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
-  relayUrl.searchParams.set("token", connection.daemonToken);
-  const auditDatabasePath = join14(readStateDirectory(), "audit", `${connection.channelId}.sqlite`);
+  relayUrl.searchParams.set("token", connection.runtimeCredential);
+  const auditDatabasePath = join14(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
   return {
     channelUrl: new URL(`/channels/${encodeURIComponent(connection.channelId)}`, connection.relayOrigin).toString(),
     config: createDaemonConfig(
@@ -23491,12 +23524,11 @@ function buildPairedDaemon(connection, connectionPath, inventory) {
     connectionPath
   };
 }
-async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
-  const options = parsePairCommand(arguments_);
+async function pairRuntime(options, signal, environment) {
   const defaultWorkspace = await resolveDefaultWorkspace(options.workspace);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace,
-    environment: process.env,
+    environment,
     signal
   });
   assertInventoryUsable(inventory);
@@ -23505,35 +23537,91 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
   const connectionPath = await persistConnection(
     claim2.channelId,
     options.relayOrigin,
-    claim2.daemonToken,
-    defaultWorkspace
+    claim2.runtimeCredential,
+    defaultWorkspace,
+    environment
   );
   return buildPairedDaemon(
     {
       defaultWorkspace,
       channelId: claim2.channelId,
-      daemonToken: claim2.daemonToken,
-      relayOrigin: options.relayOrigin
+      relayOrigin: options.relayOrigin,
+      runtimeCredential: claim2.runtimeCredential
     },
     connectionPath,
-    inventory
+    inventory,
+    environment
   );
 }
-async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
-  const channelId = parseChannelArgument(arguments_);
-  const connectionPath = join14(readStateDirectory(), "connections", `${channelId}.json`);
-  const connection = await readSavedConnection(channelId);
+async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
+  return await pairRuntime(parsePairCommand(arguments_), signal, process.env);
+}
+async function resumeMobiusRuntime(channelId, signal, environment = process.env) {
+  const normalizedChannelId = validatePairingId(channelId);
+  const connectionPath = join14(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
+  const connection = await readSavedConnection(normalizedChannelId, environment);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace: connection.defaultWorkspace,
-    environment: process.env,
+    environment,
     signal
   });
-  return buildPairedDaemon(connection, connectionPath, inventory);
+  return buildPairedDaemon(connection, connectionPath, inventory, environment);
+}
+async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
+  return await resumeMobiusRuntime(parseChannelArgument(arguments_), signal, process.env);
 }
 
+// src/audit/audit-store.ts
+import { mkdirSync } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var AuditStore = class {
+  database;
+  constructor(path2) {
+    mkdirSync(dirname3(path2), { recursive: true });
+    this.database = new DatabaseSync(path2);
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS audit_events (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        recorded_at TEXT NOT NULL,
+        event TEXT NOT NULL,
+        command_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        details_json TEXT NOT NULL DEFAULT '{}'
+      ) STRICT
+    `);
+    const columns = this.database.prepare("PRAGMA table_info(audit_events)").all();
+    if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
+      this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
+    }
+  }
+  record(record2) {
+    this.database.prepare(
+      `
+          INSERT INTO audit_events (
+            recorded_at,
+            event,
+            command_id,
+            session_id,
+            details_json
+          ) VALUES (?, ?, ?, ?, ?)
+        `
+    ).run(
+      (/* @__PURE__ */ new Date()).toISOString(),
+      record2.event,
+      record2.commandId,
+      record2.sessionId,
+      JSON.stringify(record2.details ?? {})
+    );
+  }
+  close() {
+    this.database.close();
+  }
+};
+
 // src/run-daemon.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { basename as basename3, join as join16 } from "node:path";
+import { basename as basename4, join as join16 } from "node:path";
 import { styleText } from "node:util";
 import { fetch as fetch6, WebSocket as WebSocket2 } from "undici";
 
@@ -23548,7 +23636,7 @@ import {
 
 // src/acp/activity.ts
 var TRUNCATION_MARKER = "\n\u2026 output truncated by Mobius";
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var AcpActivity = class _AcpActivity {
@@ -23815,7 +23903,7 @@ function contentPhase(content) {
     return "";
   }
   const codex = metadata["codex"];
-  if (!isRecord7(codex)) {
+  if (!isRecord8(codex)) {
     return "";
   }
   const phase = codex["phase"];
@@ -24053,7 +24141,7 @@ var SessionConfigProtocolError = class extends Error {
     this.name = "SessionConfigProtocolError";
   }
 };
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString2(value, fallback = "") {
@@ -24080,7 +24168,7 @@ function normalizeConfigValues(value) {
   }
   const normalized = [];
   for (const entry of value) {
-    if (!isRecord8(entry)) {
+    if (!isRecord9(entry)) {
       continue;
     }
     const groupedOptions = entry["options"];
@@ -24088,7 +24176,7 @@ function normalizeConfigValues(value) {
       const groupId = readString2(entry["group"]);
       const groupName = readString2(entry["name"]);
       for (const groupedOption of groupedOptions) {
-        if (isRecord8(groupedOption)) {
+        if (isRecord9(groupedOption)) {
           normalized.push(normalizeConfigValue(groupedOption, groupId, groupName));
         }
       }
@@ -24102,7 +24190,7 @@ function normalizeConfigOptions(value, modes) {
   const normalized = [];
   if (Array.isArray(value)) {
     for (const option2 of value) {
-      if (!isRecord8(option2)) {
+      if (!isRecord9(option2)) {
         continue;
       }
       const id = truncate2(readString2(option2["id"]), 128);
@@ -24141,12 +24229,12 @@ function normalizeConfigOptions(value, modes) {
       }
     }
   }
-  if (isRecord8(modes)) {
+  if (isRecord9(modes)) {
     const values = [];
     const availableModes = modes["availableModes"];
     if (Array.isArray(availableModes)) {
       for (const mode of availableModes) {
-        if (!isRecord8(mode)) {
+        if (!isRecord9(mode)) {
           continue;
         }
         const id = truncate2(readString2(mode["id"]), 500);
@@ -24224,7 +24312,7 @@ function ensureReasoningEffortOption(current) {
   return [...current.slice(0, MAXIMUM_CONFIG_OPTIONS - 2), model, unavailable];
 }
 function normalizeStandardLifecycle(response) {
-  const lifecycle = isRecord8(response) ? response : {};
+  const lifecycle = isRecord9(response) ? response : {};
   return ensureReasoningEffortOption(normalizeConfigOptions(lifecycle["configOptions"], lifecycle["modes"]));
 }
 function replaceStandardConfigOptions(current, value) {
@@ -24266,7 +24354,7 @@ var StandardSessionConfigProtocol = class {
       "ACP agent exited while changing session configuration",
       change.signal
     );
-    if (!isRecord8(response) || !Array.isArray(response["configOptions"])) {
+    if (!isRecord9(response) || !Array.isArray(response["configOptions"])) {
       throw new SessionConfigProtocolError("The Agent returned an invalid session configuration response");
     }
     return replaceStandardConfigOptions(current, response["configOptions"]);
@@ -24280,18 +24368,18 @@ var standardSessionConfigProtocol = new StandardSessionConfigProtocol();
 var LEGACY_MODEL_CONFIG_ID = "grok_build_legacy_model";
 var LEGACY_REASONING_EFFORT_CONFIG_ID = "grok_build_legacy_reasoning_effort";
 function legacyOptions(response) {
-  if (!isRecord8(response)) {
+  if (!isRecord9(response)) {
     return [];
   }
   const metadata = response["_meta"];
-  if (!isRecord8(metadata)) {
+  if (!isRecord9(metadata)) {
     return [];
   }
   const sessionConfig = metadata["x.ai/sessionConfig"];
-  if (!isRecord8(sessionConfig) || !Array.isArray(sessionConfig["options"])) {
+  if (!isRecord9(sessionConfig) || !Array.isArray(sessionConfig["options"])) {
     return [];
   }
-  return sessionConfig["options"].slice(0, 500).filter(isRecord8);
+  return sessionConfig["options"].slice(0, 500).filter(isRecord9);
 }
 function legacyValue(option2) {
   const value = readString2(option2["id"]);
@@ -24304,7 +24392,7 @@ function legacyValue(option2) {
   };
 }
 function modelsRecord(response) {
-  if (!isRecord8(response) || !isRecord8(response["models"])) {
+  if (!isRecord9(response) || !isRecord9(response["models"])) {
     return {};
   }
   return response["models"];
@@ -24323,7 +24411,7 @@ function legacyModelOptions(response) {
   }
   if (values.length === 0 && Array.isArray(models["availableModels"])) {
     for (const model of models["availableModels"]) {
-      if (!isRecord8(model)) {
+      if (!isRecord9(model)) {
         continue;
       }
       const value = readString2(model["modelId"]).slice(0, 500);
@@ -24403,7 +24491,7 @@ function legacyReasoningEffortOptions(response) {
   return [result];
 }
 function normalizeGrokLifecycle(response) {
-  const lifecycle = isRecord8(response) ? response : {};
+  const lifecycle = isRecord9(response) ? response : {};
   const standard = normalizeConfigOptions(lifecycle["configOptions"], lifecycle["modes"]);
   const normalized = [...standard];
   if (!normalized.some((option2) => option2.category === "model")) {
@@ -24422,11 +24510,11 @@ function updateCurrentValue2(current, category, value) {
   return current.map((option2) => option2.category === category ? { ...option2, currentValue: value } : option2);
 }
 function validateGrokResponse(response, modelId) {
-  if (!isRecord8(response) || !isRecord8(response["_meta"])) {
+  if (!isRecord9(response) || !isRecord9(response["_meta"])) {
     throw new SessionConfigProtocolError("Grok Build returned an invalid session configuration response");
   }
   const model = response["_meta"]["model"];
-  const appliedModel = isRecord8(model) ? model["Ok"] : model;
+  const appliedModel = isRecord9(model) ? model["Ok"] : model;
   if (appliedModel !== modelId) {
     throw new SessionConfigProtocolError("Grok Build returned an invalid session configuration response");
   }
@@ -24869,7 +24957,7 @@ function createWritableAcpStream(output2) {
 function truncate3(value, maximumLength) {
   return value.length <= maximumLength ? value : `${value.slice(0, Math.max(0, maximumLength - 1))}\u2026`;
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString4(value, fallback = "") {
@@ -24878,6 +24966,11 @@ function readString4(value, fallback = "") {
 function arraysEqual(left, right) {
   return left.length === right.length && left.every((value, index) => value === right[index]);
 }
+function recordsEqual(left, right) {
+  const leftEntries = Object.entries(left);
+  const rightEntries = Object.entries(right);
+  return leftEntries.length === rightEntries.length && leftEntries.every(([name, value]) => right[name] === value);
+}
 function elicitationFieldType(value) {
   if (value === "boolean") {
     return "boolean";
@@ -24898,7 +24991,7 @@ function normalizeElicitationOptions(schema) {
   const oneOf = schema["oneOf"];
   if (Array.isArray(oneOf)) {
     for (const option2 of oneOf) {
-      if (isRecord9(option2) && typeof option2["const"] === "string") {
+      if (isRecord10(option2) && typeof option2["const"] === "string") {
         normalized.push({
           description: truncate3(readString4(option2["description"]), 500),
           label: truncate3(readString4(option2["title"], option2["const"]), 255),
@@ -24918,7 +25011,7 @@ function normalizeElicitationOptions(schema) {
     return normalized.slice(0, 200);
   }
   const items = schema["items"];
-  if (!isRecord9(items)) {
+  if (!isRecord10(items)) {
     return normalized;
   }
   const anyOf = items["anyOf"];
@@ -24931,7 +25024,7 @@ function numericString(value) {
   return typeof value === "number" && Number.isFinite(value) ? value.toString() : "";
 }
 function normalizeElicitationFields(requestedSchema) {
-  if (!isRecord9(requestedSchema) || !isRecord9(requestedSchema["properties"])) {
+  if (!isRecord10(requestedSchema) || !isRecord10(requestedSchema["properties"])) {
     return [];
   }
   const properties = requestedSchema["properties"];
@@ -24941,7 +25034,7 @@ function normalizeElicitationFields(requestedSchema) {
   );
   const normalized = [];
   for (const [name, property] of Object.entries(properties)) {
-    if (!isRecord9(property)) {
+    if (!isRecord10(property)) {
       continue;
     }
     const type = elicitationFieldType(property["type"]);
@@ -25032,7 +25125,7 @@ function validateElicitationContent(encoded, requestedSchema) {
       "invalid_elicitation_response"
     );
   }
-  if (!isRecord9(decoded) || !isRecord9(requestedSchema) || !isRecord9(requestedSchema["properties"])) {
+  if (!isRecord10(decoded) || !isRecord10(requestedSchema) || !isRecord10(requestedSchema["properties"])) {
     throw new AcpExecutionError(
       "Elicitation response does not match the requested form",
       {},
@@ -25052,7 +25145,7 @@ function validateElicitationContent(encoded, requestedSchema) {
   const validated = {};
   for (const [name, value] of Object.entries(decoded)) {
     const property = properties[name];
-    if (!isRecord9(property)) {
+    if (!isRecord10(property)) {
       throw new AcpExecutionError(
         `Elicitation field ${name} was not requested`,
         {},
@@ -25194,6 +25287,7 @@ var AcpProcessSession = class _AcpProcessSession {
   #child;
   #connection;
   #cwd;
+  #environment;
   #getObserver;
   #mobiusSessionId;
   #pendingElicitations = /* @__PURE__ */ new Map();
@@ -25215,7 +25309,9 @@ var AcpProcessSession = class _AcpProcessSession {
     imagePrompt: false,
     listSessions: false,
     loadSession: false,
+    promptQueueing: false,
     resumeSession: false,
+    steering: false,
     unstableForkSession: false
   };
   #commands = [];
@@ -25235,6 +25331,7 @@ var AcpProcessSession = class _AcpProcessSession {
     this.#additionalDirectories = [...additionalDirectories];
     this.#agentId = agent.id;
     this.#cwd = cwd;
+    this.#environment = agent.environment;
     this.#getObserver = getObserver;
     this.#mobiusSessionId = mobiusSessionId;
     this.#sessionConfigProtocol = sessionConfigProtocolForAgent(agent.id);
@@ -25320,7 +25417,18 @@ var AcpProcessSession = class _AcpProcessSession {
     store,
     async (runtime) => await runtime.#initializeAgent(options.signal)
   );
+  static startSessionForkAtTurn = async (options, sourceNativeSessionId, forkPoint, getObserver, store) => await _AcpProcessSession.#start(
+    options,
+    getObserver,
+    store,
+    async (runtime) => await runtime.initialize(
+      options.signal,
+      { kind: "fork", nativeSessionId: sourceNativeSessionId },
+      forkPoint
+    )
+  );
   belongsTo = (agentId, cwd, additionalDirectories) => this.#agentId === agentId && this.#cwd === cwd && arraysEqual(this.#additionalDirectories, additionalDirectories);
+  usesEnvironment = (environment) => recordsEqual(this.#environment, environment);
   canRebind = () => !this.#prompted && !this.#turn.running;
   prepared = () => new AcpPreparedSession(
     this.#agentName,
@@ -25386,15 +25494,14 @@ var AcpProcessSession = class _AcpProcessSession {
         "unsupported_acp_protocol"
       );
     }
-    const capabilities = initialized.agentCapabilities ?? {};
-    this.#capabilities = normalizeAcpCapabilities(capabilities);
+    this.#capabilities = normalizeAcpCapabilities(initialized);
     this.#agentName = truncate3(initialized.agentInfo?.title ?? initialized.agentInfo?.name ?? this.#agentId, 255);
     this.#agentVersion = truncate3(
       this.#verifiedAgentVersion.length > 0 ? this.#verifiedAgentVersion : initialized.agentInfo?.version ?? "",
       128
     );
   }
-  initialize = async (signal, origin) => {
+  initialize = async (signal, origin, forkPoint) => {
     await this.#initializeAgent(signal);
     let stored = origin?.kind === "import" ? new FoundAcpStoredSession(
       new AcpStoredSession(
@@ -25426,6 +25533,13 @@ var AcpProcessSession = class _AcpProcessSession {
           "native_session_unsupported"
         );
       }
+      if (this.#additionalDirectories.length > 0 && !this.#capabilities.additionalDirectories) {
+        throw new AcpExecutionError(
+          "This Agent cannot restore additional working directories",
+          {},
+          "native_session_unsupported"
+        );
+      }
       const forked = await this.race(
         this.#connection.agent.request(
           methods6.agent.session.fork,
@@ -25433,7 +25547,21 @@ var AcpProcessSession = class _AcpProcessSession {
             sessionId: nativeSessionIdSchema.parse(origin.nativeSessionId),
             cwd: this.#cwd,
             additionalDirectories: [...this.#additionalDirectories],
-            mcpServers: []
+            mcpServers: [],
+            ...forkPoint === void 0 ? {} : {
+              _meta: {
+                jetbrains: {
+                  air: {
+                    fork: {
+                      version: 1,
+                      messageFingerprint: forkPoint.messageFingerprint,
+                      messageId: forkPoint.messageId,
+                      messageOccurrence: forkPoint.messageOccurrence
+                    }
+                  }
+                }
+              }
+            }
           },
           { cancellationSignal: signal }
         ),
@@ -25638,10 +25766,7 @@ var AcpProcessSession = class _AcpProcessSession {
     }
     return this.#configOptions;
   };
-  prompt = async (options) => {
-    if (this.#turn.running) {
-      throw new AcpExecutionError("Another prompt is already running in this conversation", {}, "session_busy");
-    }
+  buildPrompt = (options) => {
     if (options.images.length > 0 && !this.#capabilities.imagePrompt) {
       throw new AcpExecutionError(
         "The selected agent does not accept image prompts",
@@ -25690,6 +25815,13 @@ var AcpProcessSession = class _AcpProcessSession {
     if (prompt.length === 0) {
       throw new AcpExecutionError("A prompt must contain text or an attachment", {}, "empty_prompt");
     }
+    return prompt;
+  };
+  prompt = async (options) => {
+    if (this.#turn.running) {
+      throw new AcpExecutionError("Another prompt is already running in this conversation", {}, "session_busy");
+    }
+    const prompt = this.buildPrompt(options);
     this.#store.write(
       new AcpStoredSession(
         this.#mobiusSessionId,
@@ -25748,6 +25880,54 @@ var AcpProcessSession = class _AcpProcessSession {
       this.#turn = new IdleAcpTurn();
     }
   };
+  steer = async (options) => {
+    if (!this.#capabilities.steering) {
+      throw new AcpExecutionError(
+        "The selected agent does not support mid-turn steering",
+        {},
+        "steering_unsupported"
+      );
+    }
+    if (!this.#turn.running || this.#turn.commandId !== options.targetCommandId) {
+      throw new AcpExecutionError("The target turn is no longer active", {}, "steering_target_unavailable");
+    }
+    const prompt = this.buildPrompt(options);
+    const response = await this.race(
+      this.#connection.agent.request("_session/steering", {
+        _meta: { steering: { idleBehavior: "promptRequired" } },
+        prompt,
+        sessionId: this.#nativeSessionId
+      }),
+      "ACP agent exited during steering",
+      options.signal
+    );
+    if (!isRecord10(response)) {
+      throw new AcpExecutionError(
+        "ACP agent returned an invalid steering response",
+        {},
+        "acp_invalid_steering_response"
+      );
+    }
+    const outcome = response["outcome"];
+    if (outcome === "injected" || outcome === "startedNewTurn") {
+      return outcome;
+    }
+    if (outcome === "promptRequired") {
+      throw new AcpExecutionError(
+        "The target turn finished before steering could be injected",
+        {},
+        "steering_target_unavailable"
+      );
+    }
+    if (outcome === "failed") {
+      throw new AcpExecutionError("The Agent could not inject steering", {}, "steering_failed");
+    }
+    throw new AcpExecutionError(
+      "ACP agent returned an invalid steering response",
+      {},
+      "acp_invalid_steering_response"
+    );
+  };
   cancel = async () => {
     const capturedProcesses = await captureProcessTree(this.#child);
     try {
@@ -25988,7 +26168,7 @@ var AcpProcessSession = class _AcpProcessSession {
           );
         } else {
           await this.#turn.activities.finishNarrative();
-          await this.#turn.onText(update.content.text);
+          await this.#turn.onText(update.content.text, truncate3(update.messageId ?? "", 255));
         }
       } else {
         await this.#turn.activities.finishNarrative();
@@ -26214,6 +26394,7 @@ var AcpProcessSession = class _AcpProcessSession {
   };
 };
 var AcpSessionManager = class {
+  #activeCommandIds = /* @__PURE__ */ new Map();
   #nativeOperations = /* @__PURE__ */ new Set();
   #nativeBrowserObserver = new NullAcpSessionObserver();
   #nativeBrowserPreparing = /* @__PURE__ */ new Map();
@@ -26282,6 +26463,25 @@ var AcpSessionManager = class {
     this.#preparing.set(options.sessionId, operation);
     return await operation;
   }
+  async #startSessionForkAtTurnPreparation(options, sourceNativeSessionId, forkPoint) {
+    const operation = (async () => {
+      try {
+        const runtime = await AcpProcessSession.startSessionForkAtTurn(
+          options,
+          sourceNativeSessionId,
+          forkPoint,
+          () => this.#observer,
+          this.#store
+        );
+        this.#sessions.set(options.sessionId, runtime);
+        return runtime;
+      } finally {
+        this.#preparing.delete(options.sessionId);
+      }
+    })();
+    this.#preparing.set(options.sessionId, operation);
+    return await operation;
+  }
   async #replacePreparation(existing, options) {
     const operation = (async () => {
       try {
@@ -26298,6 +26498,58 @@ var AcpSessionManager = class {
     this.#preparing.set(options.sessionId, operation);
     return await operation;
   }
+  async #replaceExecutionPreparation(existing, options) {
+    const desiredConfigOptions = existing.prepared().configOptions;
+    const operation = (async () => {
+      try {
+        this.#sessions.delete(options.sessionId);
+        await existing.close();
+        this.#store.remove(options.sessionId);
+        const runtime = await AcpProcessSession.start(options, () => this.#observer, this.#store);
+        try {
+          for (const desired of desiredConfigOptions) {
+            const current = runtime.prepared().configOptions.find((option2) => option2.id === desired.id);
+            if (current === void 0 || current.type !== desired.type) {
+              continue;
+            }
+            if (desired.type === "boolean") {
+              if (current.booleanValue !== desired.booleanValue) {
+                await runtime.configure({
+                  ...options,
+                  booleanValue: desired.booleanValue,
+                  configId: desired.id,
+                  requestId: `execution-prepare-${desired.id}`,
+                  value: "",
+                  valueType: "boolean"
+                });
+              }
+              continue;
+            }
+            if (current.currentValue !== desired.currentValue && current.values.some((value) => value.value === desired.currentValue)) {
+              await runtime.configure({
+                ...options,
+                booleanValue: false,
+                configId: desired.id,
+                requestId: `execution-prepare-${desired.id}`,
+                value: desired.currentValue,
+                valueType: "select"
+              });
+            }
+          }
+        } catch (error61) {
+          await runtime.close();
+          this.#store.remove(options.sessionId);
+          throw error61;
+        }
+        this.#sessions.set(options.sessionId, runtime);
+        return runtime;
+      } finally {
+        this.#preparing.delete(options.sessionId);
+      }
+    })();
+    this.#preparing.set(options.sessionId, operation);
+    return await operation;
+  }
   prepareSession = async (options) => {
     const stored = this.#store.read(options.sessionId);
     if (stored instanceof DeletedAcpStoredSession) {
@@ -26336,16 +26588,45 @@ var AcpSessionManager = class {
     const runtime = await this.#startPreparation(options);
     return runtime.prepared();
   };
-  prepareNativeSessionBrowser = async (options) => {
-    const pending = this.#nativeBrowserPreparing.get(options.sessionId);
+  prepareExecutionSession = async (options) => {
+    const pending = this.#preparing.get(options.sessionId);
     if (pending !== void 0) {
-      const runtime2 = await pending;
-      if (runtime2.belongsTo(options.agent.id, options.cwd, options.additionalDirectories)) {
-        return runtime2.prepared();
-      }
-      return await this.prepareNativeSessionBrowser(options);
+      await pending;
+      return await this.prepareExecutionSession(options);
     }
-    const existing = this.#nativeBrowserSessions.get(options.sessionId);
+    const existing = this.#sessions.get(options.sessionId);
+    if (existing === void 0) {
+      return (await this.#startPreparation(options)).prepared();
+    }
+    if (!existing.belongsTo(options.agent.id, options.cwd, options.additionalDirectories)) {
+      throw new AcpExecutionError(
+        "The agent or workspace cannot change after a conversation has started",
+        {},
+        "session_identity_mismatch"
+      );
+    }
+    if (existing.usesEnvironment(options.agent.environment)) {
+      return existing.prepared();
+    }
+    if (!existing.canRebind()) {
+      throw new AcpExecutionError(
+        "The execution environment cannot change after a conversation has started",
+        {},
+        "session_identity_mismatch"
+      );
+    }
+    return (await this.#replaceExecutionPreparation(existing, options)).prepared();
+  };
+  prepareNativeSessionBrowser = async (options) => {
+    const pending = this.#nativeBrowserPreparing.get(options.sessionId);
+    if (pending !== void 0) {
+      const runtime2 = await pending;
+      if (runtime2.belongsTo(options.agent.id, options.cwd, options.additionalDirectories)) {
+        return runtime2.prepared();
+      }
+      return await this.prepareNativeSessionBrowser(options);
+    }
+    const existing = this.#nativeBrowserSessions.get(options.sessionId);
     if (existing !== void 0) {
       if (existing.belongsTo(options.agent.id, options.cwd, options.additionalDirectories)) {
         return existing.prepared();
@@ -26380,6 +26661,47 @@ var AcpSessionManager = class {
       }
     }
   };
+  steerPrompt = async (options) => {
+    if (this.#activeCommandIds.get(options.sessionId) !== options.targetCommandId) {
+      throw new AcpExecutionError("The target turn is no longer active", {}, "steering_target_unavailable");
+    }
+    const pending = this.#preparing.get(options.sessionId);
+    if (pending !== void 0) {
+      await pending;
+    }
+    if (this.#activeCommandIds.get(options.sessionId) !== options.targetCommandId) {
+      throw new AcpExecutionError("The target turn is no longer active", {}, "steering_target_unavailable");
+    }
+    const runtime = this.#sessions.get(options.sessionId);
+    if (runtime === void 0 || !runtime.belongsTo(options.agent.id, options.cwd, options.additionalDirectories)) {
+      throw new AcpExecutionError(
+        "The target turn execution context is unavailable",
+        {},
+        "steering_target_unavailable"
+      );
+    }
+    const deadlineController = new AbortController();
+    const deadline = setTimeout(
+      () => deadlineController.abort(
+        new AcpExecutionError("The steering request exceeded its deadline", {}, "steering_timeout")
+      ),
+      options.agent.promptTimeoutMilliseconds
+    );
+    deadline.unref();
+    try {
+      return await runtime.steer({
+        ...options,
+        signal: AbortSignal.any([options.signal, deadlineController.signal])
+      });
+    } catch (error61) {
+      if (error61 instanceof AcpExecutionError) {
+        throw error61;
+      }
+      throw new AcpExecutionError("ACP agent steering failed", { cause: error61 }, "steering_failed");
+    } finally {
+      clearTimeout(deadline);
+    }
+  };
   runPrompt = async (options) => {
     const stored = this.#store.read(options.sessionId);
     if (stored instanceof FoundAcpStoredSession && this.#nativeOperations.has(`${stored.session.agentId}:${stored.session.nativeSessionId}`)) {
@@ -26404,6 +26726,7 @@ var AcpSessionManager = class {
       signal: AbortSignal.any([options.signal, deadlineController.signal])
     };
     this.#activeSessionIds.add(options.sessionId);
+    this.#activeCommandIds.set(options.sessionId, options.commandId);
     try {
       if (this.#cancellationRequests.has(options.sessionId)) {
         return { stopReason: "cancelled" };
@@ -26443,6 +26766,9 @@ var AcpSessionManager = class {
     } finally {
       clearTimeout(deadline);
       this.#activeSessionIds.delete(options.sessionId);
+      if (this.#activeCommandIds.get(options.sessionId) === options.commandId) {
+        this.#activeCommandIds.delete(options.sessionId);
+      }
       this.#cancellationRequests.delete(options.sessionId);
     }
   };
@@ -26467,6 +26793,7 @@ var AcpSessionManager = class {
     this.#nativeBrowserSessions.clear();
     await Promise.all([...sessions, ...nativeBrowserSessions].map(async (session) => await session.close()));
   };
+  hasPreparedSession = (sessionId, agentId, cwd, additionalDirectories) => this.#sessions.get(sessionId)?.belongsTo(agentId, cwd, additionalDirectories) === true;
   ensureSession = async (options) => {
     const existing = this.#sessions.get(options.sessionId);
     if (existing !== void 0) {
@@ -26575,6 +26902,68 @@ var AcpSessionManager = class {
       this.#nativeOperations.delete(key);
     }
   };
+  forkSessionAtTurn = async (options, sourceSessionId, forkPoint) => {
+    if (sourceSessionId === options.sessionId) {
+      throw new AcpExecutionError(
+        "The fork destination must be a new conversation",
+        {},
+        "session_identity_mismatch"
+      );
+    }
+    const source = this.#store.read(sourceSessionId);
+    if (!(source instanceof FoundAcpStoredSession) || !source.session.prompted) {
+      throw new AcpExecutionError(
+        "The source conversation has no resumable native Agent session",
+        {},
+        "native_session_not_found"
+      );
+    }
+    if (source.session.agentId !== options.agent.id || source.session.cwd !== options.cwd || !arraysEqual(source.session.additionalDirectories, options.additionalDirectories)) {
+      throw new AcpExecutionError(
+        "The source conversation execution target does not match the fork request",
+        {},
+        "native_session_target_changed"
+      );
+    }
+    const key = `${options.agent.id}:${source.session.nativeSessionId}`;
+    const linked = this.#store.findNative(options.agent.id, source.session.nativeSessionId);
+    if (this.#nativeOperations.has(key) || linked.some((entry) => this.#activeSessionIds.has(entry.sessionId) || this.#preparing.has(entry.sessionId))) {
+      throw new AcpExecutionError(
+        "Wait for the source conversation's running operation to finish",
+        {},
+        "session_busy"
+      );
+    }
+    if (this.#sessions.has(options.sessionId) || this.#preparing.has(options.sessionId) || this.#store.read(options.sessionId) instanceof FoundAcpStoredSession || this.#store.read(options.sessionId) instanceof DeletedAcpStoredSession) {
+      throw new AcpExecutionError("The destination conversation already exists", {}, "session_identity_mismatch");
+    }
+    this.#nativeOperations.add(key);
+    try {
+      const runtime = await this.#startSessionForkAtTurnPreparation(
+        options,
+        source.session.nativeSessionId,
+        forkPoint
+      );
+      const openedKey = `${options.agent.id}:${runtime.nativeSessionId()}`;
+      this.#nativeOperations.add(openedKey);
+      try {
+        return {
+          history: await runtime.loadHistory(options.signal),
+          prepared: runtime.prepared(),
+          sessionId: options.sessionId
+        };
+      } catch (error61) {
+        this.#sessions.delete(options.sessionId);
+        this.#store.remove(options.sessionId);
+        await runtime.closeProcess();
+        throw error61;
+      } finally {
+        this.#nativeOperations.delete(openedKey);
+      }
+    } finally {
+      this.#nativeOperations.delete(key);
+    }
+  };
   deleteNativeSession = async (options, nativeSessionId) => {
     const runtime = await this.#ensureNativeSessionBrowser(options);
     const key = `${options.agent.id}:${nativeSessionId}`;
@@ -26620,14 +27009,19 @@ var AgentCatalogPublishError = class extends Error {
     this.name = "AgentCatalogPublishError";
   }
 };
-function catalogEndpoint(relayUrl) {
-  const endpoint = new URL(relayUrl);
+function catalogEndpoint(config2) {
+  const endpoint = new URL(config2.relayUrl);
   endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
-  if (!endpoint.pathname.endsWith("/daemon")) {
-    throw new AgentCatalogPublishError("The Relay URL is invalid");
+  if (endpoint.pathname.endsWith("/daemon")) {
+    endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
+    return endpoint;
   }
-  endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
-  return endpoint;
+  const runtimePath = "/v1/runtimes/connect";
+  if (endpoint.pathname.endsWith(runtimePath)) {
+    endpoint.pathname = `${endpoint.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}/catalog`;
+    return endpoint;
+  }
+  throw new AgentCatalogPublishError("The Relay URL is invalid");
 }
 async function publishAgentCatalog(config2, signal) {
   signal.throwIfAborted();
@@ -26636,7 +27030,7 @@ async function publishAgentCatalog(config2, signal) {
   let response;
   const catalog = config2.catalog.read();
   try {
-    response = await fetch3(catalogEndpoint(config2.relayUrl), {
+    response = await fetch3(catalogEndpoint(config2), {
       body: JSON.stringify({
         agents: catalog.agents.map((agent) => ({
           agentPath: agent.agentIdentity.requestedPath,
@@ -27317,7 +27711,8 @@ var LocalBotGrant = class {
   revocationEpoch;
   workspaceIdentityDigest;
   workspacePath;
-  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
+  workspaceRef;
+  constructor(localGrantId, botId, behaviorRevisionId, behaviorDigest, bindingId, bindingRevision, agent, agentIdentityDigest, workspaceRef, workspacePath, workspaceIdentityDigest, allowedDeliveryTargetIds, expiresAt, revocationEpoch) {
     this.localGrantId = localGrantId;
     this.botId = botId;
     this.behaviorRevisionId = behaviorRevisionId;
@@ -27326,6 +27721,7 @@ var LocalBotGrant = class {
     this.bindingRevision = bindingRevision;
     this.agent = agent;
     this.agentIdentityDigest = agentIdentityDigest;
+    this.workspaceRef = workspaceRef;
     this.workspacePath = workspacePath;
     this.workspaceIdentityDigest = workspaceIdentityDigest;
     this.allowedDeliveryTargetIds = Object.freeze([...allowedDeliveryTargetIds]);
@@ -27510,7 +27906,7 @@ var LocalBotGrantStore = class {
                   WHERE local_grant_id = ? AND bot_id = ?
                     AND behavior_revision_id = ? AND behavior_digest = ?
                     AND binding_id = ? AND binding_revision = ?
-                    AND agent_ref = ? AND workspace_ref = ?
+                    AND agent_ref = ?
                     AND revoked_at IS NULL AND expires_at > ?`
     ).get(
       command.localGrantId,
@@ -27520,7 +27916,6 @@ var LocalBotGrantStore = class {
       command.bindingId,
       command.bindingRevision,
       command.agentId,
-      command.directoryId,
       now
     );
     if (row === void 0) {
@@ -27543,7 +27938,8 @@ var LocalBotGrantStore = class {
       revalidateExecutable(agent.agentIdentity)
     ]);
     signal.throwIfAborted();
-    const workspacePath = await directories.resolve(bindingAuthorityId, command.directoryId, signal);
+    const workspaceRef = rowString(row, "workspace_ref");
+    const workspacePath = await directories.resolve(bindingAuthorityId, workspaceRef, signal);
     const currentAgentDigest = agentDigest(agent);
     const currentWorkspaceDigest = await workspaceDigest(workspacePath);
     signal.throwIfAborted();
@@ -27569,6 +27965,7 @@ var LocalBotGrantStore = class {
       command.bindingRevision,
       agent,
       currentAgentDigest,
+      workspaceRef,
       workspacePath,
       currentWorkspaceDigest,
       approvedTargets,
@@ -27783,7 +28180,7 @@ var BotOutboundIpcRequest = class {
     this.text = text;
   }
 };
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeRequest(encoded) {
@@ -27793,7 +28190,7 @@ function decodeRequest(encoded) {
   } catch (cause) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid", { cause });
   }
-  if (!isRecord10(value)) {
+  if (!isRecord11(value)) {
     throw new LocalBotAuthorizationError("invalid_request", "The local Bot request is invalid");
   }
   const keys = Object.keys(value);
@@ -27843,10 +28240,10 @@ async function decodeRelayResponse(response) {
       cause
     });
   }
-  if (response.status === 202 && isRecord10(value) && typeof value["outboundMessageId"] === "string") {
+  if (response.status === 202 && isRecord11(value) && typeof value["outboundMessageId"] === "string") {
     return value["outboundMessageId"];
   }
-  if (isRecord10(value) && isRecord10(value["error"])) {
+  if (isRecord11(value) && isRecord11(value["error"])) {
     const error61 = value["error"];
     if (typeof error61["code"] === "string" && typeof error61["message"] === "string") {
       throw new LocalBotAuthorizationError(error61["code"], error61["message"]);
@@ -27879,7 +28276,7 @@ var BotOutboundIpcServer = class {
     if (this.#usesFilesystemSocket) {
       await mkdir4(dirname6(this.#socketPath), { mode: 448, recursive: true });
       await unlink(this.#socketPath).catch((error61) => {
-        if (!isRecord10(error61) || error61["code"] !== "ENOENT") {
+        if (!isRecord11(error61) || error61["code"] !== "ENOENT") {
           throw error61;
         }
       });
@@ -27914,7 +28311,7 @@ var BotOutboundIpcServer = class {
     }
     if (this.#usesFilesystemSocket) {
       await unlink(this.#socketPath).catch((error61) => {
-        if (!isRecord10(error61) || error61["code"] !== "ENOENT") {
+        if (!isRecord11(error61) || error61["code"] !== "ENOENT") {
           throw error61;
         }
       });
@@ -28002,6 +28399,7 @@ var BotOutboundIpcServer = class {
 
 // src/native-sessions/service.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
+import { basename as basename3 } from "node:path";
 
 // src/native-sessions/codex-history.ts
 import { spawn as spawn4 } from "node:child_process";
@@ -28479,6 +28877,74 @@ var NativeSessionService = class {
       history: opened.history
     };
   };
+  executeTurnFork = async (command, signal) => {
+    signal.throwIfAborted();
+    const cwd = await this.#directories.resolve(this.#config.bindingId, command.directoryId, signal);
+    const additionalDirectories = [];
+    const additionalEntries = [];
+    const resolvedPaths = /* @__PURE__ */ new Set([cwd]);
+    for (const directoryId2 of command.additionalDirectoryIds) {
+      const path2 = await this.#directories.resolve(this.#config.bindingId, directoryId2, signal);
+      if (resolvedPaths.has(path2)) {
+        throw new LocalAuthorizationError("Workspace directories must resolve to distinct locations");
+      }
+      resolvedPaths.add(path2);
+      additionalDirectories.push(path2);
+      additionalEntries.push({ directoryId: directoryId2, name: basename3(path2) });
+    }
+    const listing = await this.#directories.list(this.#config.bindingId, command.directoryId, signal);
+    const opened = await this.#sessions.forkSessionAtTurn(
+      {
+        additionalDirectories,
+        agent: this.#config.catalog.find(command.agentId),
+        cwd,
+        sessionId: command.targetSessionId,
+        signal
+      },
+      command.sessionId,
+      {
+        messageFingerprint: command.messageFingerprint,
+        messageId: command.messageId,
+        messageOccurrence: command.messageOccurrence
+      }
+    );
+    signal.throwIfAborted();
+    const ready = {
+      additionalDirectories: additionalEntries,
+      agentId: command.agentId,
+      agentName: opened.prepared.agentName,
+      agentVersion: opened.prepared.agentVersion,
+      capabilities: opened.prepared.capabilities,
+      commands: opened.prepared.commands,
+      configOptions: opened.prepared.configOptions,
+      directoryId: command.directoryId,
+      directoryLabel: listing.directoryLabel,
+      kind: "session.ready",
+      requestId: command.requestId,
+      restored: true,
+      sessionId: opened.sessionId
+    };
+    this.#audit.record({
+      commandId: command.requestId,
+      details: {
+        agentId: command.agentId,
+        messageId: command.messageId,
+        sourceCommandId: command.sourceCommandId
+      },
+      event: "native_session_turn_forked",
+      sessionId: command.sessionId
+    });
+    return {
+      action: "fork",
+      history: opened.history,
+      kind: "native.session.result",
+      ready,
+      requestId: command.requestId,
+      sessionId: command.sessionId,
+      targetSessionId: command.targetSessionId,
+      title: command.title
+    };
+  };
   authorizeEntry = async (command, options, info) => {
     try {
       const primary = await this.#directories.identify(command.bindingId, info.cwd, options.signal);
@@ -28620,10 +29086,17 @@ function parseReference(resource) {
 function downloadUrl(config2, command, reference) {
   const url2 = new URL(config2.relayUrl);
   url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
-  if (!url2.pathname.endsWith("/daemon")) {
-    throw new PromptArtifactError("artifact_endpoint_invalid", "The Relay artifact endpoint is invalid");
+  let channelPath = "";
+  if (url2.pathname.endsWith("/daemon")) {
+    channelPath = url2.pathname.slice(0, -"/daemon".length);
+  } else {
+    const runtimePath = "/v1/runtimes/connect";
+    if (!url2.pathname.endsWith(runtimePath)) {
+      throw new PromptArtifactError("artifact_endpoint_invalid", "The Relay artifact endpoint is invalid");
+    }
+    channelPath = `${url2.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
-  url2.pathname = `${url2.pathname.slice(0, -"/daemon".length)}/sessions/${encodeURIComponent(command.sessionId)}/commands/${encodeURIComponent(command.commandId)}/artifacts/${encodeURIComponent(reference.artifactId)}/content`;
+  url2.pathname = `${channelPath}/sessions/${encodeURIComponent(command.sessionId)}/commands/${encodeURIComponent(command.commandId)}/artifacts/${encodeURIComponent(reference.artifactId)}/content`;
   url2.searchParams.delete("liveness");
   return url2;
 }
@@ -28782,8 +29255,16 @@ var RelayConnectionError = class extends Error {
 function connectRelay(url2, signal) {
   signal.throwIfAborted();
   return new Promise((resolve5, reject) => {
-    const socket = new WebSocket(url2, {
-      dispatcher: environmentProxyDispatcher
+    const endpoint = new URL(url2);
+    const headers = {};
+    if (endpoint.pathname.endsWith("/v1/runtimes/connect")) {
+      const runtimeCredential = endpoint.searchParams.get("token") ?? "";
+      endpoint.searchParams.delete("token");
+      headers["authorization"] = `Bearer ${runtimeCredential}`;
+    }
+    const socket = new WebSocket(endpoint, {
+      dispatcher: environmentProxyDispatcher,
+      headers
     });
     let finished = false;
     const timeout = setTimeout(onTimeout, CONNECTION_TIMEOUT_MILLISECONDS);
@@ -29043,6 +29524,11 @@ var SessionEventOutbox = class {
     }
     this.#database.prepare(`UPDATE relay_turn_receipts SET state = ? WHERE command_id = ?`).run(state, commandId);
   };
+  isTerminalExecution = (commandId, sessionId) => {
+    const row = this.#database.prepare(`SELECT state FROM relay_turn_receipts WHERE command_id = ? AND session_id = ?`).get(commandId, sessionId);
+    const state = typeof row === "object" && row !== null ? Reflect.get(row, "state") : void 0;
+    return state === "succeeded" || state === "failed" || state === "cancelled";
+  };
   acknowledge = (acknowledgement) => {
     this.#database.prepare(
       `DELETE FROM relay_session_event_outbox
@@ -29399,10 +29885,17 @@ var ActiveTurnReconciliationError = class extends Error {
 function activeTurnReconciliationEndpoint(config2, turn) {
   const endpoint = new URL(config2.relayUrl);
   endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
-  if (!endpoint.pathname.endsWith("/daemon")) {
-    throw new ActiveTurnReconciliationError("The Relay URL is invalid");
+  let channelPath = "";
+  if (endpoint.pathname.endsWith("/daemon")) {
+    channelPath = endpoint.pathname.slice(0, -"/daemon".length);
+  } else {
+    const runtimePath = "/v1/runtimes/connect";
+    if (!endpoint.pathname.endsWith(runtimePath)) {
+      throw new ActiveTurnReconciliationError("The Relay URL is invalid");
+    }
+    channelPath = `${endpoint.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
-  endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/sessions/${encodeURIComponent(turn.command.sessionId)}/attempts/${encodeURIComponent(turn.attemptId)}/reconciliation`;
+  endpoint.pathname = `${channelPath}/sessions/${encodeURIComponent(turn.command.sessionId)}/attempts/${encodeURIComponent(turn.attemptId)}/reconciliation`;
   endpoint.searchParams.delete("liveness");
   return endpoint;
 }
@@ -29555,7 +30048,7 @@ async function resolveSessionDirectories(directories, bindingId, directoryId2, a
     additionalDirectories.push(directory);
     additionalDirectoryEntries.push({
       directoryId: additionalDirectoryId,
-      name: basename3(directory)
+      name: basename4(directory)
     });
   }
   return new ResolvedSessionDirectories(cwd, additionalDirectories, additionalDirectoryEntries);
@@ -29704,68 +30197,96 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
       attemptId
     );
     const attachments = await resolvePromptArtifacts(config2, command, signal);
-    const result = await sessions.runPrompt({
-      additionalDirectories: resolved.additionalDirectories,
-      agent,
-      commandId: command.commandId,
-      cwd: resolved.cwd,
-      images: attachments.images,
-      onActivity: (activity) => {
-        publisher.recordAttempt(
-          command.sessionId,
-          encodeAgentActivityEvent({
-            activityId: activity.activityId,
-            activityType: activity.activityType,
-            commandId: command.commandId,
-            content: activity.content,
-            detail: activity.detail,
-            input: activity.input,
-            kind: AGENT_ACTIVITY_KIND,
-            locations: activity.locations,
-            name: activity.name,
-            output: activity.output,
-            sequence: activity.sequence,
-            sessionId: command.sessionId,
-            status: activity.status,
-            title: activity.title,
-            toolKind: activity.toolKind
-          }),
-          attemptId
-        );
-        return Promise.resolve();
-      },
-      onText: (text) => {
-        publisher.recordAttempt(
-          command.sessionId,
-          encodeAgentMessageDeltaEvent({
-            commandId: command.commandId,
-            kind: AGENT_MESSAGE_DELTA_KIND,
-            sessionId: command.sessionId,
-            text
-          }),
-          attemptId
+    let stopReason;
+    if (command.disposition === SessionPromptDisposition.Steer) {
+      await sessions.steerPrompt({
+        additionalDirectories: resolved.additionalDirectories,
+        agent,
+        commandId: command.commandId,
+        cwd: resolved.cwd,
+        images: attachments.images,
+        prompt: command.prompt,
+        resources: attachments.resources,
+        sessionId: command.sessionId,
+        signal,
+        targetCommandId: command.targetCommandId
+      });
+      stopReason = "steered";
+    } else {
+      if (command.disposition === SessionPromptDisposition.Queue && !outbox.isTerminalExecution(command.targetCommandId, command.sessionId)) {
+        throw new AcpExecutionError(
+          "The queued prompt target is unavailable",
+          {},
+          "prompt_queue_target_unavailable"
         );
-        return Promise.resolve();
-      },
-      prompt: command.prompt,
-      resources: attachments.resources,
-      sessionId: command.sessionId,
-      signal
-    });
+      }
+      const result = await sessions.runPrompt({
+        additionalDirectories: resolved.additionalDirectories,
+        agent,
+        commandId: command.commandId,
+        cwd: resolved.cwd,
+        disposition: command.disposition,
+        images: attachments.images,
+        onActivity: (activity) => {
+          publisher.recordAttempt(
+            command.sessionId,
+            encodeAgentActivityEvent({
+              activityId: activity.activityId,
+              activityType: activity.activityType,
+              commandId: command.commandId,
+              content: activity.content,
+              detail: activity.detail,
+              input: activity.input,
+              kind: AGENT_ACTIVITY_KIND,
+              locations: activity.locations,
+              name: activity.name,
+              output: activity.output,
+              sequence: activity.sequence,
+              sessionId: command.sessionId,
+              status: activity.status,
+              title: activity.title,
+              toolKind: activity.toolKind
+            }),
+            attemptId
+          );
+          return Promise.resolve();
+        },
+        onText: (text, messageId) => {
+          publisher.recordAttempt(
+            command.sessionId,
+            encodeAgentMessageDeltaEvent({
+              commandId: command.commandId,
+              kind: AGENT_MESSAGE_DELTA_KIND,
+              messageId,
+              sessionId: command.sessionId,
+              text
+            }),
+            attemptId
+          );
+          return Promise.resolve();
+        },
+        prompt: command.prompt,
+        resources: attachments.resources,
+        sessionId: command.sessionId,
+        signal,
+        targetCommandId: command.targetCommandId
+      });
+      stopReason = result.stopReason;
+    }
     publisher.recordAttempt(
       command.sessionId,
       encodeSessionCompletedEvent({
         commandId: command.commandId,
         kind: SESSION_COMPLETED_KIND,
         sessionId: command.sessionId,
-        stopReason: result.stopReason
+        stopReason
       }),
       attemptId
     );
-    outbox.transitionExecution(command.commandId, result.stopReason === "cancelled" ? "cancelled" : "succeeded");
+    outbox.transitionExecution(command.commandId, stopReason === "cancelled" ? "cancelled" : "succeeded");
     audit.record({
       commandId: command.commandId,
-      event: result.stopReason === "cancelled" ? "session_cancelled" : "session_completed",
+      event: stopReason === "cancelled" ? "session_cancelled" : "session_completed",
       sessionId: command.sessionId
     });
   } catch (error61) {
@@ -29809,12 +30330,6 @@ function botExecutionAgent(agent, contextHandle, socketPath) {
 }
 async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, signal) {
   try {
-    if (command.additionalDirectoryIds.length > 0) {
-      throw new LocalBotAuthorizationError(
-        "binding_not_approved",
-        "The Bot execution requested unapproved additional directories"
-      );
-    }
     const deadline = Date.parse(command.executionDeadlineAt);
     const remaining = deadline - Date.now();
     if (!Number.isSafeInteger(deadline) || remaining <= 0) {
@@ -29828,6 +30343,32 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
       Date.now(),
       signal
     );
+    const requestedExecutionTargetOverridden = command.directoryId !== grant.workspaceRef || command.additionalDirectoryIds.length > 0;
+    if (requestedExecutionTargetOverridden && !(command.replyRoute instanceof OwnerBotReplyRoute)) {
+      throw new LocalBotAuthorizationError(
+        "binding_not_approved",
+        "Only a paired owner conversation can override the approved Bot workspace"
+      );
+    }
+    const resolved = await resolveSessionDirectories(
+      directories,
+      config2.bindingId,
+      command.directoryId,
+      command.additionalDirectoryIds,
+      signal
+    );
+    const executionTargetOverridden = resolved.cwd !== grant.workspacePath || resolved.additionalDirectories.length > 0;
+    if (executionTargetOverridden && !sessions.hasPreparedSession(
+      command.sessionId,
+      grant.agent.id,
+      resolved.cwd,
+      resolved.additionalDirectories
+    )) {
+      throw new LocalBotAuthorizationError(
+        "local_approval_required",
+        "Open this Bot conversation in the paired local Web app before using the selected workspace"
+      );
+    }
     const attachments = await resolvePromptArtifacts(config2, command, signal);
     const applied = await applicator.apply(command, grant, attachments.resources, signal);
     const lease = contexts.activate(command);
@@ -29835,6 +30376,13 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
       const deadlineSignal = AbortSignal.timeout(remaining);
       const executionSignal = AbortSignal.any([signal, deadlineSignal]);
       const agent = botExecutionAgent(grant.agent, lease.context.contextHandle, ipc.socketPath);
+      await sessions.prepareExecutionSession({
+        additionalDirectories: resolved.additionalDirectories,
+        agent,
+        cwd: resolved.cwd,
+        sessionId: command.sessionId,
+        signal: executionSignal
+      });
       audit.record({
         commandId: command.commandId,
         details: {
@@ -29859,10 +30407,10 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
         attemptId
       );
       const result = await sessions.runPrompt({
-        additionalDirectories: [],
+        additionalDirectories: resolved.additionalDirectories,
         agent,
         commandId: command.commandId,
-        cwd: grant.workspacePath,
+        cwd: resolved.cwd,
         images: attachments.images,
         onActivity: (activity) => {
           publisher.recordAttempt(
@@ -29888,12 +30436,13 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
           );
           return Promise.resolve();
         },
-        onText: (text) => {
+        onText: (text, messageId) => {
           publisher.recordAttempt(
             command.sessionId,
             encodeAgentMessageDeltaEvent({
               commandId: command.commandId,
               kind: AGENT_MESSAGE_DELTA_KIND,
+              messageId,
               sessionId: command.sessionId,
               text
             }),
@@ -30248,6 +30797,86 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             });
             return;
           }
+          if (kind === NATIVE_SESSION_TURN_FORK_KIND) {
+            const command2 = decodeNativeSessionTurnForkCommand(encoded);
+            const previous = [...nativeRequests.values()].filter(
+              (request) => request.agentId === command2.agentId
+            );
+            if (nativeRequests.has(command2.requestId) || nativeRequests.size >= 4 || previous.some((request) => !request.controller.signal.aborted)) {
+              reportOperationFailure(
+                socket,
+                command2.requestId,
+                command2.sessionId,
+                new AcpExecutionError(
+                  "Another native session operation is running",
+                  {},
+                  "native_session_busy"
+                )
+              );
+              return;
+            }
+            const controller = new AbortController();
+            const operationSignal = AbortSignal.any([connectionController.signal, controller.signal]);
+            const timeout = timer.schedule(
+              () => controller.abort(
+                new AcpExecutionError(
+                  "Native session operation timed out",
+                  {},
+                  "native_session_timeout"
+                )
+              ),
+              9e4
+            );
+            const completion = (async () => {
+              try {
+                operationSignal.throwIfAborted();
+                if (previous.length > 0) {
+                  await new Promise((resolve6, reject2) => {
+                    const cancel = () => reject2(operationSignal.reason);
+                    operationSignal.addEventListener("abort", cancel, { once: true });
+                    void Promise.all(previous.map((request) => request.completion)).then(
+                      () => {
+                        operationSignal.removeEventListener("abort", cancel);
+                        resolve6();
+                      },
+                      (error61) => {
+                        operationSignal.removeEventListener("abort", cancel);
+                        reject2(error61);
+                      }
+                    );
+                  });
+                }
+                operationSignal.throwIfAborted();
+                const result = await nativeSessions.executeTurnFork(command2, operationSignal);
+                if (socket.readyState === WebSocket2.OPEN) {
+                  send(socket, encodeNativeSessionResult(result));
+                }
+              } catch (error61) {
+                const failure = operationSignal.aborted ? controller.signal.reason ?? new AcpExecutionError(
+                  "Native session operation cancelled",
+                  {},
+                  "native_session_cancelled"
+                ) : error61;
+                audit.record({
+                  commandId: command2.requestId,
+                  details: { code: operationErrorCode(failure) },
+                  event: "native_session_turn_fork_failed",
+                  sessionId: command2.sessionId
+                });
+                reportOperationFailure(socket, command2.requestId, command2.sessionId, failure);
+              } finally {
+                timeout.cancel();
+                nativeRequests.delete(command2.requestId);
+              }
+            })();
+            nativeRequests.set(command2.requestId, {
+              agentId: command2.agentId,
+              completion,
+              controller,
+              sessionId: command2.sessionId
+            });
+            return;
+          }
           if (kind === RUNTIME_LIVENESS_READY_KIND) {
             decodeRuntimeLivenessReadyEvent(encoded);
             connectionLiveness.start();
@@ -30401,7 +31030,9 @@ async function runRelayConnection(config2, directories, audit, sessions, install
           }
           const turn = new ActiveDaemonTurn(command, receipt.attemptId);
           activeTurns.set(command.commandId, turn);
-          activeAttemptIds.set(command.sessionId, receipt.attemptId);
+          if (command.disposition !== SessionPromptDisposition.Steer) {
+            activeAttemptIds.set(command.sessionId, receipt.attemptId);
+          }
           void executePrompt(
             outbox,
             publisher,
@@ -30589,6 +31220,69 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   }
 }
 
+// src/runtime.ts
+var APP_CREDENTIAL_PATTERN = /^mapp_[a-zA-Z0-9_-]{22}_[a-zA-Z0-9_-]{43}$/;
+var CONVERSATION_CREDENTIAL_PATTERN = /^mconv_[a-zA-Z0-9_-]{22}_[a-zA-Z0-9_-]{43}$/;
+var RUNTIME_CREDENTIAL_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var MobiusRuntimeConfigurationError = class extends Error {
+  code = "runtime_configuration_invalid";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "MobiusRuntimeConfigurationError";
+  }
+};
+var MobiusRuntimeState = class {
+};
+var IdleMobiusRuntimeState = class extends MobiusRuntimeState {
+};
+var RunningMobiusRuntimeState = class extends MobiusRuntimeState {
+};
+var FinishedMobiusRuntimeState = class extends MobiusRuntimeState {
+};
+function validateRuntimeRelay(relayUrl) {
+  if (relayUrl.protocol !== "ws:" && relayUrl.protocol !== "wss:") {
+    throw new MobiusRuntimeConfigurationError("The Runtime relay URL must use WebSocket transport");
+  }
+  const credential = relayUrl.searchParams.get("token") ?? "";
+  if (credential.length === 0) {
+    throw new MobiusRuntimeConfigurationError("The Runtime relay credential is required");
+  }
+  if (APP_CREDENTIAL_PATTERN.test(credential)) {
+    throw new MobiusRuntimeConfigurationError("An AppCredential cannot be held by a local Runtime");
+  }
+  if (CONVERSATION_CREDENTIAL_PATTERN.test(credential)) {
+    throw new MobiusRuntimeConfigurationError("A ConversationAccessToken cannot be held by a local Runtime");
+  }
+  if (!RUNTIME_CREDENTIAL_PATTERN.test(credential)) {
+    throw new MobiusRuntimeConfigurationError("The Runtime relay credential is invalid");
+  }
+}
+function validateRuntimeConfiguration(config2) {
+  validateRuntimeRelay(config2.relayUrl);
+}
+var MobiusRuntimeEngine = class {
+  #config;
+  #state = new IdleMobiusRuntimeState();
+  constructor(config2) {
+    validateRuntimeConfiguration(config2);
+    this.#config = config2;
+  }
+  run = async (signal) => {
+    if (!(this.#state instanceof IdleMobiusRuntimeState)) {
+      throw new MobiusRuntimeConfigurationError("A Mobius Runtime engine can only be started once");
+    }
+    signal.throwIfAborted();
+    this.#state = new RunningMobiusRuntimeState();
+    const audit = new AuditStore(this.#config.auditDatabasePath);
+    try {
+      await runDaemon(this.#config, audit, signal);
+    } finally {
+      audit.close();
+      this.#state = new FinishedMobiusRuntimeState();
+    }
+  };
+};
+
 // src/cli.ts
 var shutdown = new AbortController();
 process.once("SIGINT", () => shutdown.abort());
@@ -30596,7 +31290,7 @@ process.once("SIGTERM", () => shutdown.abort());
 var USAGE = `Mobius CLI
 
 Usage:
-  mobius pair --url <relay-url> --code <pairing-code> [--workspace <directory>]
+  mobius pair --url <relay-url> --pairing <runtime-pairing-id> --code <pairing-code> [--workspace <directory>]
   mobius start --channel <channel-id>
   mobius agents [--json]
   mobius bot message send --target <current|alias> --text <message>
@@ -30669,12 +31363,7 @@ async function main() {
   process.stdout.write(`Default workspace: ${config2.defaultWorkspace}
 
 `);
-  const audit = new AuditStore(config2.auditDatabasePath);
-  try {
-    await runDaemon(config2, audit, shutdown.signal);
-  } finally {
-    audit.close();
-  }
+  await new MobiusRuntimeEngine(config2).run(shutdown.signal);
 }
 try {
   await main();