@moxt-ai/mobius 0.0.25 → 0.0.27

package/dist/cli.js

@@ -11,7 +11,7 @@ import { mkdir as mkdir5 } from "node:fs/promises";
 // package.json
 var package_default = {
   name: "@moxt-ai/mobius",
-  version: "0.0.25",
+  version: "0.0.27",
   description: "Mobius CLI for pairing and running local AI agent services.",
   type: "module",
   bin: {
@@ -1578,7 +1578,53 @@ import { fetch } from "undici";
 
 // src/network/environment-proxy.ts
 import { EnvHttpProxyAgent } from "undici";
+var configuredHttpProxy = process.env["http_proxy"] ?? process.env["HTTP_PROXY"] ?? "";
+var configuredHttpsProxy = process.env["https_proxy"] ?? process.env["HTTPS_PROXY"] ?? configuredHttpProxy;
 var environmentProxyDispatcher = new EnvHttpProxyAgent();
+function bypassesProxy(target) {
+  const noProxy = process.env["no_proxy"] ?? process.env["NO_PROXY"] ?? "";
+  if (noProxy === "*") {
+    return true;
+  }
+  const hostname4 = target.hostname.replace(/^\[|\]$/gu, "").toLowerCase();
+  const defaultPort = target.protocol === "wss:" || target.protocol === "https:" ? 443 : 80;
+  const port = Number.parseInt(target.port, 10) || defaultPort;
+  for (const rawEntry of noProxy.split(/[,\s]/u)) {
+    if (rawEntry.length === 0) {
+      continue;
+    }
+    const parsed = rawEntry.match(/^(.+):(\d+)$/u);
+    const entryHostname = (parsed?.[1] ?? rawEntry).replace(/^\*?\./u, "").toLowerCase();
+    const entryPort = parsed?.[2] === void 0 ? 0 : Number.parseInt(parsed[2], 10);
+    if (entryPort !== 0 && entryPort !== port) {
+      continue;
+    }
+    if (hostname4 === entryHostname || hostname4.endsWith(`.${entryHostname}`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function sanitizedProxyOrigin(proxyUrl) {
+  try {
+    return new URL(proxyUrl).origin;
+  } catch {
+    return "configured-invalid-url";
+  }
+}
+function describeEnvironmentProxyRoute(target) {
+  if (bypassesProxy(target)) {
+    return { proxyRoute: "direct" };
+  }
+  const proxyUrl = target.protocol === "wss:" || target.protocol === "https:" ? configuredHttpsProxy : configuredHttpProxy;
+  if (proxyUrl.length === 0) {
+    return { proxyRoute: "direct" };
+  }
+  return {
+    proxyOrigin: sanitizedProxyOrigin(proxyUrl),
+    proxyRoute: "proxy"
+  };
+}
 
 // src/agent-installation/managed-agent-archive.ts
 var ARCHIVE_DOWNLOAD_LIMIT_BYTES = 128 * 1024 * 1024;
@@ -22048,6 +22094,9 @@ var SESSION_CANCEL_KIND = "session.cancel";
 var RUNTIME_LIVENESS_READY_KIND = "runtime.liveness.ready";
 var RUNTIME_HEARTBEAT_KIND = "runtime.heartbeat";
 var RUNTIME_HEARTBEAT_ACK_KIND = "runtime.heartbeat.ack";
+var RUNTIME_DELIVERY_KIND = "runtime.delivery";
+var RUNTIME_DELIVERY_RECEIVED_KIND = "runtime.delivery.received";
+var RUNTIME_DELIVERY_COMMITTED_KIND = "runtime.delivery.committed";
 var SESSION_STARTED_KIND = "session.started";
 var AGENT_MESSAGE_DELTA_KIND = "agent.message.delta";
 var AGENT_ACTIVITY_KIND = "agent.activity";
@@ -22070,6 +22119,7 @@ var DIRECTORY_IDENTIFIER_PATTERN2 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,2047}$/;
 var MAX_PROMPT_LENGTH = 1e4;
 var MAX_PROMPT_ATTACHMENT_LENGTH = 6e6;
 var MAX_EVENT_TEXT_LENGTH = 1e5;
+var MAX_RUNTIME_DELIVERY_PAYLOAD_LENGTH = 8 * 1024 * 1024;
 var ACTIVITY_TYPES = /* @__PURE__ */ new Set(["plan", "progress", "reasoning", "tool"]);
 var ACTIVITY_STATUSES = /* @__PURE__ */ new Set(["pending", "running", "completed", "failed"]);
 var TOOL_KINDS = /* @__PURE__ */ new Set([
@@ -22348,6 +22398,37 @@ function decodeRuntimeHeartbeatAckEvent(encoded) {
     kind: RUNTIME_HEARTBEAT_ACK_KIND
   };
 }
+function decodeRuntimeDelivery(encoded) {
+  const value = parseJson2(encoded);
+  assertExactKeys(value, ["deliveryId", "kind", "payload", "sessionId"]);
+  assertKind(value, RUNTIME_DELIVERY_KIND);
+  return {
+    deliveryId: readIdentifier(value, "deliveryId"),
+    kind: RUNTIME_DELIVERY_KIND,
+    payload: readString(value, "payload", MAX_RUNTIME_DELIVERY_PAYLOAD_LENGTH),
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
+function decodeRuntimeDeliveryReceived(encoded) {
+  const value = parseJson2(encoded);
+  assertExactKeys(value, ["deliveryId", "kind", "sessionId"]);
+  assertKind(value, RUNTIME_DELIVERY_RECEIVED_KIND);
+  return {
+    deliveryId: readIdentifier(value, "deliveryId"),
+    kind: RUNTIME_DELIVERY_RECEIVED_KIND,
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
+function decodeRuntimeDeliveryCommitted(encoded) {
+  const value = parseJson2(encoded);
+  assertExactKeys(value, ["deliveryId", "kind", "sessionId"]);
+  assertKind(value, RUNTIME_DELIVERY_COMMITTED_KIND);
+  return {
+    deliveryId: readIdentifier(value, "deliveryId"),
+    kind: RUNTIME_DELIVERY_COMMITTED_KIND,
+    sessionId: readIdentifier(value, "sessionId")
+  };
+}
 function decodeSessionStartedEvent(encoded) {
   const value = parseJson2(encoded);
   assertExactKeys(value, ["commandId", "kind", "attemptId", "sessionId"]);
@@ -22435,6 +22516,9 @@ function decodeSessionFailedEvent(encoded) {
 function encodeRuntimeHeartbeatEvent(message) {
   return JSON.stringify(decodeRuntimeHeartbeatEvent(JSON.stringify(message)));
 }
+function encodeRuntimeDeliveryReceived(message) {
+  return JSON.stringify(decodeRuntimeDeliveryReceived(JSON.stringify(message)));
+}
 function encodeSessionStartedEvent(message) {
   return JSON.stringify(decodeSessionStartedEvent(JSON.stringify(message)));
 }
@@ -23133,7 +23217,8 @@ var SESSION_EVENT_COMMITTED_KIND = "session.event.committed";
 var SESSION_EVENT_REJECTED_KIND = "session.event.rejected";
 var SessionEventRejectionCode = {
   SessionDeleted: "session_deleted",
-  SessionNotFound: "session_not_found"
+  SessionNotFound: "session_not_found",
+  SessionRejected: "session_rejected"
 };
 var IDENTIFIER_PATTERN4 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var CURSOR_PATTERN = /^[A-Za-z0-9_-]{1,512}$/;
@@ -23205,6 +23290,7 @@ var encode4 = (message, schema) => {
   }
   return JSON.stringify(decoded.data);
 };
+var decodeSessionEventEnvelope = (encoded) => decode5(encoded, eventEnvelopeSchema);
 var encodeSessionEventEnvelope = (message) => encode4(message, eventEnvelopeSchema);
 var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAcknowledgementSchema);
 var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSchema);
@@ -23390,12 +23476,12 @@ function decodePairingResponse(value, credentialField, expectedKeys) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
-  const runtimeCredential = value[credentialField];
+  const runtimeCredential2 = value[credentialField];
   const runtimeId = value["runtimeId"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential2 !== "string" || !TOKEN_PATTERN2.test(runtimeCredential2) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
-  return { channelId, runtimeCredential, runtimeId };
+  return { channelId, runtimeCredential: runtimeCredential2, runtimeId };
 }
 async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
   const agents = localAgents.map((agent) => ({
@@ -23430,7 +23516,7 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   }
   return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
-async function persistConnection(channelId, relayOrigin, runtimeCredential, defaultWorkspace, environment) {
+async function persistConnection(channelId, relayOrigin, runtimeCredential2, defaultWorkspace, environment) {
   const connectionsDirectory = join14(readStateDirectory(environment), "connections");
   await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
   const connectionPath = join14(connectionsDirectory, `${channelId}.json`);
@@ -23442,7 +23528,7 @@ async function persistConnection(channelId, relayOrigin, runtimeCredential, defa
         defaultWorkspace,
         channelId,
         relayOrigin: relayOrigin.toString(),
-        runtimeCredential
+        runtimeCredential: runtimeCredential2
       },
       null,
       2
@@ -23459,16 +23545,16 @@ function decodeSavedConnection(value, expectedChannelId) {
   }
   const defaultWorkspace = value["defaultWorkspace"];
   const channelId = value["channelId"];
-  const runtimeCredential = value["runtimeCredential"] ?? value["daemonToken"];
+  const runtimeCredential2 = value["runtimeCredential"] ?? value["daemonToken"];
   const relayOrigin = value["relayOrigin"];
-  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof relayOrigin !== "string") {
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential2 !== "string" || !TOKEN_PATTERN2.test(runtimeCredential2) || typeof relayOrigin !== "string") {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   return {
     defaultWorkspace,
     channelId,
     relayOrigin: parseRelayOrigin(relayOrigin),
-    runtimeCredential
+    runtimeCredential: runtimeCredential2
   };
 }
 async function readSavedConnection(channelId, environment) {
@@ -27001,6 +27087,23 @@ var AcpSessionManager = class {
 
 // src/agent-catalog/publish-agent-catalog.ts
 import { fetch as fetch3 } from "undici";
+
+// src/relay-connection/runtime-authentication.ts
+function runtimeCredential(relayUrl) {
+  return relayUrl.searchParams.get("token") ?? "";
+}
+function runtimeAuthorization(relayUrl) {
+  const credential = runtimeCredential(relayUrl);
+  return credential.length === 0 ? {} : { authorization: `Bearer ${credential}` };
+}
+function relayHttpEndpoint(relayUrl) {
+  const endpoint = new URL(relayUrl);
+  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  endpoint.search = "";
+  return endpoint;
+}
+
+// src/agent-catalog/publish-agent-catalog.ts
 var CATALOG_UPDATE_TIMEOUT_MILLISECONDS = 2e4;
 var AgentCatalogPublishError = class extends Error {
   code = "agent_catalog_update_failed";
@@ -27010,8 +27113,7 @@ var AgentCatalogPublishError = class extends Error {
   }
 };
 function catalogEndpoint(config2) {
-  const endpoint = new URL(config2.relayUrl);
-  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  const endpoint = relayHttpEndpoint(config2.relayUrl);
   if (endpoint.pathname.endsWith("/daemon")) {
     endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
     return endpoint;
@@ -27042,7 +27144,7 @@ async function publishAgentCatalog(config2, signal) {
         installableAgents: catalog.installableAgents
       }),
       dispatcher: environmentProxyDispatcher,
-      headers: { "content-type": "application/json" },
+      headers: { ...runtimeAuthorization(config2.relayUrl), "content-type": "application/json" },
       method: "PUT",
       signal: requestSignal
     });
@@ -29084,8 +29186,7 @@ function parseReference(resource) {
   return new PromptArtifactReference(artifactId, byteLength, sha256, resource);
 }
 function downloadUrl(config2, command, reference) {
-  const url2 = new URL(config2.relayUrl);
-  url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
+  const url2 = relayHttpEndpoint(config2.relayUrl);
   let channelPath = "";
   if (url2.pathname.endsWith("/daemon")) {
     channelPath = url2.pathname.slice(0, -"/daemon".length);
@@ -29097,7 +29198,6 @@ function downloadUrl(config2, command, reference) {
     channelPath = `${url2.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
   url2.pathname = `${channelPath}/sessions/${encodeURIComponent(command.sessionId)}/commands/${encodeURIComponent(command.commandId)}/artifacts/${encodeURIComponent(reference.artifactId)}/content`;
-  url2.searchParams.delete("liveness");
   return url2;
 }
 async function responseBytes(response, expectedByteLength, signal) {
@@ -29148,7 +29248,11 @@ async function download(config2, command, reference, signal) {
   try {
     response = await fetch5(downloadUrl(config2, command, reference), {
       dispatcher: environmentProxyDispatcher,
-      headers: { accept: reference.resource.mimeType },
+      headers: {
+        accept: reference.resource.mimeType,
+        "accept-encoding": "identity",
+        ...runtimeAuthorization(config2.relayUrl)
+      },
       signal: requestSignal
     });
     if (!response.ok) {
@@ -29246,9 +29350,11 @@ import { WebSocket } from "undici";
 var CONNECTION_TIMEOUT_MILLISECONDS = 15e3;
 var RelayConnectionError = class extends Error {
   code;
-  constructor(code, message, options = {}) {
+  diagnosticDetails;
+  constructor(code, message, diagnosticDetails = {}, options = {}) {
     super(message, options);
     this.code = code;
+    this.diagnosticDetails = diagnosticDetails;
     this.name = "RelayConnectionError";
   }
 };
@@ -29256,12 +29362,8 @@ function connectRelay(url2, signal) {
   signal.throwIfAborted();
   return new Promise((resolve5, reject) => {
     const endpoint = new URL(url2);
-    const headers = {};
-    if (endpoint.pathname.endsWith("/v1/runtimes/connect")) {
-      const runtimeCredential = endpoint.searchParams.get("token") ?? "";
-      endpoint.searchParams.delete("token");
-      headers["authorization"] = `Bearer ${runtimeCredential}`;
-    }
+    const headers = runtimeAuthorization(endpoint);
+    endpoint.searchParams.delete("token");
     const socket = new WebSocket(endpoint, {
       dispatcher: environmentProxyDispatcher,
       headers
@@ -29286,16 +29388,34 @@ function connectRelay(url2, signal) {
     };
     const onAbort = () => {
       fail(
-        new RelayConnectionError("relay_connection_cancelled", "Relay connection was cancelled", {
-          cause: signal.reason
-        })
+        new RelayConnectionError(
+          "relay_connection_cancelled",
+          "Relay connection was cancelled",
+          {
+            cancellation: "requested"
+          },
+          { cause: signal.reason }
+        )
       );
     };
-    const onClose = () => {
-      fail(new RelayConnectionError("relay_connection_closed", "Relay connection closed before it was ready"));
+    const onClose = (event) => {
+      fail(
+        new RelayConnectionError("relay_connection_closed", "Relay connection closed before it was ready", {
+          closeCode: event.code.toString(),
+          closeReason: event.reason
+        })
+      );
     };
-    const onError = () => {
-      fail(new RelayConnectionError("relay_connection_failed", "Relay connection failed"));
+    const onError = (event) => {
+      const cause = Reflect.get(event, "error");
+      fail(
+        new RelayConnectionError(
+          "relay_connection_failed",
+          "Relay connection failed",
+          {},
+          { cause: cause ?? event }
+        )
+      );
     };
     const onOpen = () => {
       if (finished) {
@@ -29306,7 +29426,11 @@ function connectRelay(url2, signal) {
       resolve5(socket);
     };
     function onTimeout() {
-      fail(new RelayConnectionError("relay_connection_timeout", "Relay connection timed out"));
+      fail(
+        new RelayConnectionError("relay_connection_timeout", "Relay connection timed out", {
+          timeoutMilliseconds: CONNECTION_TIMEOUT_MILLISECONDS.toString()
+        })
+      );
     }
     signal.addEventListener("abort", onAbort, { once: true });
     socket.addEventListener("close", onClose, { once: true });
@@ -29318,6 +29442,142 @@ function connectRelay(url2, signal) {
   });
 }
 
+// src/relay-connection/diagnostics.ts
+var MAX_DIAGNOSTIC_TEXT_LENGTH = 256;
+function sanitizeDiagnosticText(value) {
+  const printable = Array.from(value, (character) => {
+    const code = character.charCodeAt(0);
+    return code < 32 || code === 127 ? " " : character;
+  }).join("");
+  const withoutSecrets = printable.replace(/([?&](?:access_token|authorization|credential|key|secret|token)=)[^&\s]*/giu, "$1[redacted]").replace(/(?:https?|wss?):\/\/[^\s)]+/giu, (encodedUrl) => {
+    try {
+      return new URL(encodedUrl).origin;
+    } catch {
+      return "[redacted-url]";
+    }
+  });
+  return withoutSecrets.slice(0, MAX_DIAGNOSTIC_TEXT_LENGTH);
+}
+function addFailureDetails(details, failure) {
+  let current = failure;
+  for (let depth = 0; depth < 3 && current instanceof Error; depth += 1) {
+    const prefix = depth === 0 ? "failure" : `cause${depth.toString()}`;
+    details[`${prefix}Name`] = current.name;
+    details[`${prefix}Message`] = sanitizeDiagnosticText(current.message);
+    const code = Reflect.get(current, "code");
+    if (typeof code === "string" || typeof code === "number") {
+      details[`${prefix}Code`] = String(code);
+    }
+    const statusCode = Reflect.get(current, "statusCode");
+    if (typeof statusCode === "string" || typeof statusCode === "number") {
+      details[`${prefix}StatusCode`] = String(statusCode);
+    }
+    const diagnosticDetails = Reflect.get(current, "diagnosticDetails");
+    if (typeof diagnosticDetails === "object" && diagnosticDetails !== null) {
+      for (const [key, value] of Object.entries(diagnosticDetails)) {
+        if (typeof value === "string") {
+          details[key] = sanitizeDiagnosticText(value);
+        }
+      }
+    }
+    current = current.cause;
+  }
+}
+var RelayConnectionDiagnostics = class {
+  #audit;
+  #channelId;
+  #lastClosedEpoch = 0;
+  #lastFailedEpoch = 0;
+  #relayOrigin;
+  #route;
+  constructor(audit, channelId, relayUrl) {
+    this.#audit = audit;
+    this.#channelId = channelId;
+    this.#relayOrigin = relayUrl.origin;
+    this.#route = describeEnvironmentProxyRoute(relayUrl);
+  }
+  catalogFailed = (failure) => {
+    const details = { ...this.#route, relayOrigin: this.#relayOrigin };
+    addFailureDetails(details, failure);
+    this.#record("agent_catalog_publish_failed", "catalog", details, true);
+  };
+  connectionClosed = (connectionEpoch, code, reason, source) => {
+    if (this.#lastClosedEpoch === connectionEpoch) {
+      return;
+    }
+    this.#lastClosedEpoch = connectionEpoch;
+    this.#record(
+      "relay_connection_closed",
+      connectionEpoch.toString(),
+      {
+        closeCode: code.toString(),
+        closeReason: sanitizeDiagnosticText(reason),
+        connectionEpoch: connectionEpoch.toString(),
+        relayOrigin: this.#relayOrigin,
+        source,
+        ...this.#route
+      },
+      true
+    );
+  };
+  connectionFailed = (connectionEpoch, failure, source) => {
+    if (this.#lastFailedEpoch === connectionEpoch) {
+      return;
+    }
+    this.#lastFailedEpoch = connectionEpoch;
+    const details = {
+      connectionEpoch: connectionEpoch.toString(),
+      relayOrigin: this.#relayOrigin,
+      source,
+      ...this.#route
+    };
+    addFailureDetails(details, failure);
+    this.#record("relay_connection_failed", connectionEpoch.toString(), details, true);
+  };
+  connectionOpened = (connectionEpoch) => {
+    this.#record(
+      "relay_connection_opened",
+      connectionEpoch.toString(),
+      {
+        connectionEpoch: connectionEpoch.toString(),
+        relayOrigin: this.#relayOrigin,
+        ...this.#route
+      },
+      false
+    );
+  };
+  heartbeatTimedOut = (connectionEpoch, heartbeatId, timeoutMilliseconds) => {
+    this.#record(
+      "relay_heartbeat_timed_out",
+      connectionEpoch.toString(),
+      {
+        connectionEpoch: connectionEpoch.toString(),
+        heartbeatId,
+        relayOrigin: this.#relayOrigin,
+        timeoutMilliseconds: timeoutMilliseconds.toString(),
+        ...this.#route
+      },
+      true
+    );
+  };
+  #record = (event, commandId, details, warning) => {
+    this.#audit.record({
+      commandId,
+      details,
+      event,
+      sessionId: this.#channelId
+    });
+    const encoded = JSON.stringify({ channelId: this.#channelId, event, ...details });
+    if (warning) {
+      process.stderr.write(`Mobius relay diagnostic ${encoded}
+`);
+      return;
+    }
+    process.stdout.write(`Mobius relay diagnostic ${encoded}
+`);
+  };
+};
+
 // src/relay-connection/liveness.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 var HEARTBEAT_ACK_TIMEOUT_MILLISECONDS = 1e4;
@@ -29394,9 +29654,10 @@ var RelayConnectionLiveness = class {
     if (!(this.#state instanceof AwaitingHeartbeatAckState)) {
       throw new Error("Heartbeat timeout occurred in an invalid state");
     }
+    const heartbeatId = this.#state.heartbeatId;
     this.#state.timeout.cancel();
     this.#state = new FinishedRelayLivenessState();
-    this.#transport.unresponsive();
+    this.#transport.unresponsive(heartbeatId, HEARTBEAT_ACK_TIMEOUT_MILLISECONDS);
   };
   #sendHeartbeat = () => {
     if (this.#state instanceof WaitingForHeartbeatState) {
@@ -29425,6 +29686,42 @@ var RelayConnectionLiveness = class {
 import { mkdirSync as mkdirSync3 } from "node:fs";
 import { dirname as dirname7 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
+var DEFAULT_OUTBOX_LIMITS = {
+  criticalEventBytes: 136 * 1024 * 1024,
+  criticalEventCount: 10128,
+  runtimeDeliveryBytes: 64 * 1024 * 1024,
+  runtimeDeliveryCount: 64,
+  standardEventBytes: 128 * 1024 * 1024,
+  standardEventCount: 1e4
+};
+var SessionEventOutboxCapacityError = class extends Error {
+  code = "session_event_outbox_full";
+  constructor() {
+    super("The durable Session event outbox is full");
+    this.name = "SessionEventOutboxCapacityError";
+  }
+};
+var RuntimeDeliveryInboxCapacityError = class extends Error {
+  code = "runtime_delivery_inbox_full";
+  constructor() {
+    super("The durable Runtime delivery inbox is full");
+    this.name = "RuntimeDeliveryInboxCapacityError";
+  }
+};
+var StoredRuntimeDelivery = class {
+  deliveryId;
+  duplicate;
+  payload;
+  sessionId;
+  state;
+  constructor(deliveryId, sessionId, payload, state, duplicate) {
+    this.deliveryId = deliveryId;
+    this.duplicate = duplicate;
+    this.payload = payload;
+    this.sessionId = sessionId;
+    this.state = state;
+  }
+};
 function readPendingEnvelope(row) {
   if (typeof row !== "object" || row === null || Array.isArray(row)) {
     throw new Error("SQLite returned an invalid session event outbox row");
@@ -29435,9 +29732,26 @@ function readPendingEnvelope(row) {
   }
   return envelope2;
 }
+function rowNumber(row, field) {
+  const value = typeof row === "object" && row !== null ? Reflect.get(row, field) : void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`SQLite returned an invalid ${field} value`);
+  }
+  return value;
+}
+function rowString2(row, field) {
+  const value = typeof row === "object" && row !== null ? Reflect.get(row, field) : void 0;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`SQLite returned an invalid ${field} value`);
+  }
+  return value;
+}
 var SessionEventOutbox = class {
   #database;
-  constructor(path2) {
+  #limits;
+  constructor(path2, limits = DEFAULT_OUTBOX_LIMITS) {
+    validateLimits(limits);
+    this.#limits = limits;
     mkdirSync3(dirname7(path2), { recursive: true });
     this.#database = new DatabaseSync4(path2);
     this.#database.exec(`
@@ -29445,6 +29759,8 @@ var SessionEventOutbox = class {
         ordinal INTEGER PRIMARY KEY AUTOINCREMENT,
         event_id TEXT NOT NULL UNIQUE,
         session_id TEXT NOT NULL,
+        source_key TEXT NOT NULL,
+        byte_length INTEGER NOT NULL,
         envelope_json TEXT NOT NULL
       ) STRICT;
       CREATE INDEX IF NOT EXISTS relay_session_event_outbox_order
@@ -29455,7 +29771,7 @@ var SessionEventOutbox = class {
         session_id TEXT NOT NULL,
         envelope_json TEXT NOT NULL,
         rejection_code TEXT NOT NULL CHECK (
-          rejection_code IN ('session_deleted', 'session_not_found')
+          rejection_code IN ('session_deleted', 'session_not_found', 'session_rejected')
         )
       ) STRICT;
       CREATE TABLE IF NOT EXISTS relay_session_event_sources (
@@ -29471,6 +29787,92 @@ var SessionEventOutbox = class {
           state IN ('dispatching', 'running', 'succeeded', 'failed', 'cancelled')
         )
       ) STRICT;
+      CREATE TABLE IF NOT EXISTS relay_session_event_outbox_state (
+        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+        event_count INTEGER NOT NULL,
+        total_bytes INTEGER NOT NULL
+      ) STRICT;
+      INSERT OR IGNORE INTO relay_session_event_outbox_state (
+        singleton, event_count, total_bytes
+      ) VALUES (1, 0, 0);
+      CREATE TABLE IF NOT EXISTS relay_runtime_deliveries (
+        delivery_id TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        payload_json TEXT NOT NULL,
+        payload_bytes INTEGER NOT NULL,
+        state TEXT NOT NULL CHECK (
+          state IN ('received', 'relay_committed', 'processed')
+        ),
+        received_at INTEGER NOT NULL
+      ) STRICT;
+    `);
+    const deadLetterTable = this.#database.prepare(
+      `SELECT sql FROM sqlite_master
+                 WHERE type = 'table' AND name = 'relay_session_event_dead_letters'`
+    ).get();
+    const deadLetterSql = typeof deadLetterTable === "object" && deadLetterTable !== null ? Reflect.get(deadLetterTable, "sql") : void 0;
+    if (typeof deadLetterSql !== "string" || !deadLetterSql.includes("'session_rejected'")) {
+      this.#database.exec(`
+        BEGIN IMMEDIATE;
+        ALTER TABLE relay_session_event_dead_letters
+          RENAME TO relay_session_event_dead_letters_legacy;
+        CREATE TABLE relay_session_event_dead_letters (
+          ordinal INTEGER PRIMARY KEY,
+          event_id TEXT NOT NULL UNIQUE,
+          session_id TEXT NOT NULL,
+          envelope_json TEXT NOT NULL,
+          rejection_code TEXT NOT NULL CHECK (
+            rejection_code IN ('session_deleted', 'session_not_found', 'session_rejected')
+          )
+        ) STRICT;
+        INSERT INTO relay_session_event_dead_letters (
+          ordinal, event_id, session_id, envelope_json, rejection_code
+        )
+        SELECT ordinal, event_id, session_id, envelope_json, rejection_code
+        FROM relay_session_event_dead_letters_legacy;
+        DROP TABLE relay_session_event_dead_letters_legacy;
+        COMMIT;
+      `);
+    }
+    const outboxColumns = this.#database.prepare("PRAGMA table_info(relay_session_event_outbox)").all();
+    const hasSourceKey = outboxColumns.some(
+      (column) => typeof column === "object" && column !== null && Reflect.get(column, "name") === "source_key"
+    );
+    if (!hasSourceKey) {
+      this.#database.exec(`
+        ALTER TABLE relay_session_event_outbox
+          ADD COLUMN source_key TEXT NOT NULL DEFAULT '';
+      `);
+    }
+    const hasByteLength = outboxColumns.some(
+      (column) => typeof column === "object" && column !== null && Reflect.get(column, "name") === "byte_length"
+    );
+    if (!hasByteLength) {
+      this.#database.exec(`
+        ALTER TABLE relay_session_event_outbox
+          ADD COLUMN byte_length INTEGER NOT NULL DEFAULT 0;
+      `);
+    }
+    this.#database.exec(`
+      UPDATE relay_session_event_outbox
+      SET source_key = CASE json_extract(envelope_json, '$.source.kind')
+        WHEN 'attempt' THEN
+          'attempt:' || session_id || ':' || json_extract(envelope_json, '$.source.attemptId')
+        ELSE 'runtime:' || session_id
+      END
+      WHERE source_key = '';
+      UPDATE relay_session_event_outbox
+      SET byte_length = length(CAST(envelope_json AS BLOB))
+      WHERE byte_length = 0;
+      UPDATE relay_session_event_outbox_state
+      SET event_count = (SELECT COUNT(*) FROM relay_session_event_outbox),
+          total_bytes = (
+            SELECT COALESCE(SUM(byte_length), 0)
+            FROM relay_session_event_outbox
+          )
+      WHERE singleton = 1;
+      CREATE INDEX IF NOT EXISTS relay_session_event_outbox_source_order
+        ON relay_session_event_outbox(source_key, ordinal);
     `);
   }
   claimExecution = (commandId, sessionId, commandJson) => {
@@ -29529,15 +29931,19 @@ var SessionEventOutbox = class {
     const state = typeof row === "object" && row !== null ? Reflect.get(row, "state") : void 0;
     return state === "succeeded" || state === "failed" || state === "cancelled";
   };
-  acknowledge = (acknowledgement) => {
-    this.#database.prepare(
-      `DELETE FROM relay_session_event_outbox
-         WHERE event_id = ? AND session_id = ?`
-    ).run(acknowledgement.eventId, acknowledgement.sessionId);
-  };
+  acknowledge = (acknowledgement) => this.#removeAcknowledgedEvent(acknowledgement.eventId, acknowledgement.sessionId);
   quarantine = (rejection) => {
     this.#database.exec("BEGIN IMMEDIATE");
     try {
+      const stored = this.#database.prepare(
+        `SELECT byte_length FROM relay_session_event_outbox
+                     WHERE event_id = ? AND session_id = ?`
+      ).get(rejection.eventId, rejection.sessionId);
+      if (stored === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const byteLength = rowNumber(stored, "byte_length");
       const insertion = this.#database.prepare(
         `INSERT INTO relay_session_event_dead_letters (
              ordinal, event_id, session_id, envelope_json, rejection_code
@@ -29557,6 +29963,7 @@ var SessionEventOutbox = class {
       if (deletion.changes !== 1) {
         throw new Error("The rejected session event could not be removed from the durable outbox");
       }
+      this.#decrementEventState(byteLength);
       this.#database.exec("COMMIT");
       return true;
     } catch (error61) {
@@ -29568,7 +29975,129 @@ var SessionEventOutbox = class {
     this.#database.close();
   };
   enqueue = (sessionId, payload, attemptId = null) => {
-    const sourceKey = attemptId === null ? `runtime:${sessionId}` : `attempt:${sessionId}:${attemptId}`;
+    return this.#enqueueBounded(
+      sessionId,
+      payload,
+      attemptId ?? "",
+      this.#limits.standardEventCount,
+      this.#limits.standardEventBytes
+    );
+  };
+  enqueueCritical = (sessionId, payload, attemptId = "") => this.#enqueueBounded(
+    sessionId,
+    payload,
+    attemptId,
+    this.#limits.criticalEventCount,
+    this.#limits.criticalEventBytes
+  );
+  claimRuntimeDelivery = (delivery) => {
+    const payloadBytes = new TextEncoder().encode(delivery.payload).byteLength;
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const existing = this.#database.prepare(
+        `SELECT session_id, payload_json, state
+                     FROM relay_runtime_deliveries
+                     WHERE delivery_id = ?`
+      ).get(delivery.deliveryId);
+      if (existing !== void 0) {
+        const sessionId = rowString2(existing, "session_id");
+        const payload = rowString2(existing, "payload_json");
+        const state = runtimeDeliveryState(existing);
+        if (sessionId !== delivery.sessionId || payload !== delivery.payload) {
+          throw new Error("The Runtime delivery identity conflicts with its durable receipt");
+        }
+        this.#database.exec("COMMIT");
+        return new StoredRuntimeDelivery(delivery.deliveryId, sessionId, payload, state, true);
+      }
+      const usage = this.#database.prepare(
+        `SELECT COUNT(*) AS delivery_count,
+                            COALESCE(SUM(payload_bytes), 0) AS delivery_bytes
+                     FROM relay_runtime_deliveries`
+      ).get();
+      if (rowNumber(usage, "delivery_count") + 1 > this.#limits.runtimeDeliveryCount || rowNumber(usage, "delivery_bytes") + payloadBytes > this.#limits.runtimeDeliveryBytes) {
+        throw new RuntimeDeliveryInboxCapacityError();
+      }
+      this.#database.prepare(
+        `INSERT INTO relay_runtime_deliveries (
+                       delivery_id, session_id, payload_json, payload_bytes, state, received_at
+                     ) VALUES (?, ?, ?, ?, 'received', ?)`
+      ).run(delivery.deliveryId, delivery.sessionId, delivery.payload, payloadBytes, Date.now());
+      this.#database.exec("COMMIT");
+      return new StoredRuntimeDelivery(
+        delivery.deliveryId,
+        delivery.sessionId,
+        delivery.payload,
+        "received",
+        false
+      );
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  markRuntimeDeliveryCommitted = (deliveryId, sessionId) => {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const row = this.#database.prepare(
+        `SELECT state FROM relay_runtime_deliveries
+                     WHERE delivery_id = ? AND session_id = ?`
+      ).get(deliveryId, sessionId);
+      if (row === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const state = runtimeDeliveryState(row);
+      if (state === "processed") {
+        this.#database.prepare(`DELETE FROM relay_runtime_deliveries WHERE delivery_id = ?`).run(deliveryId);
+      } else if (state === "received") {
+        this.#database.prepare(`UPDATE relay_runtime_deliveries SET state = 'relay_committed' WHERE delivery_id = ?`).run(deliveryId);
+      }
+      this.#database.exec("COMMIT");
+      return true;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  markRuntimeDeliveryProcessed = (deliveryId, sessionId) => {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const row = this.#database.prepare(
+        `SELECT state FROM relay_runtime_deliveries
+                     WHERE delivery_id = ? AND session_id = ?`
+      ).get(deliveryId, sessionId);
+      if (row === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const state = runtimeDeliveryState(row);
+      if (state === "relay_committed") {
+        this.#database.prepare(`DELETE FROM relay_runtime_deliveries WHERE delivery_id = ?`).run(deliveryId);
+      } else if (state === "received") {
+        this.#database.prepare(`UPDATE relay_runtime_deliveries SET state = 'processed' WHERE delivery_id = ?`).run(deliveryId);
+      }
+      this.#database.exec("COMMIT");
+      return true;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  runtimeDeliveries = () => this.#database.prepare(
+    `SELECT delivery_id, session_id, payload_json, state
+                 FROM relay_runtime_deliveries
+                 ORDER BY received_at, delivery_id`
+  ).all().map(
+    (row) => new StoredRuntimeDelivery(
+      rowString2(row, "delivery_id"),
+      rowString2(row, "session_id"),
+      rowString2(row, "payload_json"),
+      runtimeDeliveryState(row),
+      true
+    )
+  );
+  #enqueueBounded = (sessionId, payload, attemptId, maximumEventCount, maximumEventBytes) => {
+    const sourceKey = attemptId.length === 0 ? `runtime:${sessionId}` : `attempt:${sessionId}:${attemptId}`;
     this.#database.exec("BEGIN IMMEDIATE");
     try {
       const row = this.#database.prepare(
@@ -29585,13 +30114,22 @@ var SessionEventOutbox = class {
         kind: SESSION_EVENT_KIND,
         payload,
         sessionId,
-        source: attemptId === null ? { kind: "runtime", sourceSeq: nextSourceSeq.toString() } : {
+        source: attemptId.length === 0 ? { kind: "runtime", sourceSeq: nextSourceSeq.toString() } : {
           attemptId,
           kind: "attempt",
           sourceSeq: nextSourceSeq.toString()
         }
       };
       const encoded = encodeSessionEventEnvelope(envelope2);
+      const byteLength = new TextEncoder().encode(encoded).byteLength;
+      const state = this.#database.prepare(
+        `SELECT event_count, total_bytes
+                     FROM relay_session_event_outbox_state
+                     WHERE singleton = 1`
+      ).get();
+      if (rowNumber(state, "event_count") + 1 > maximumEventCount || rowNumber(state, "total_bytes") + byteLength > maximumEventBytes) {
+        throw new SessionEventOutboxCapacityError();
+      }
       this.#database.prepare(
         `INSERT INTO relay_session_event_sources (
              source_key, next_source_seq
@@ -29601,9 +30139,15 @@ var SessionEventOutbox = class {
       ).run(sourceKey, nextSourceSeq + 1);
       this.#database.prepare(
         `INSERT INTO relay_session_event_outbox (
-             event_id, session_id, envelope_json
-           ) VALUES (?, ?, ?)`
-      ).run(envelope2.eventId, envelope2.sessionId, encoded);
+             event_id, session_id, source_key, byte_length, envelope_json
+           ) VALUES (?, ?, ?, ?, ?)`
+      ).run(envelope2.eventId, envelope2.sessionId, sourceKey, byteLength, encoded);
+      this.#database.prepare(
+        `UPDATE relay_session_event_outbox_state
+                     SET event_count = event_count + 1,
+                         total_bytes = total_bytes + ?
+                     WHERE singleton = 1`
+      ).run(byteLength);
       this.#database.exec("COMMIT");
       return encoded;
     } catch (error61) {
@@ -29611,12 +30155,132 @@ var SessionEventOutbox = class {
       throw error61;
     }
   };
+  #removeAcknowledgedEvent = (eventId, sessionId) => {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const stored = this.#database.prepare(
+        `SELECT byte_length FROM relay_session_event_outbox
+                     WHERE event_id = ? AND session_id = ?`
+      ).get(eventId, sessionId);
+      if (stored === void 0) {
+        this.#database.exec("COMMIT");
+        return false;
+      }
+      const byteLength = rowNumber(stored, "byte_length");
+      const deletion = this.#database.prepare(
+        `DELETE FROM relay_session_event_outbox
+                     WHERE event_id = ? AND session_id = ?`
+      ).run(eventId, sessionId);
+      if (deletion.changes !== 1) {
+        throw new Error("The acknowledged session event could not be removed from the durable outbox");
+      }
+      this.#decrementEventState(byteLength);
+      this.#database.exec("COMMIT");
+      return true;
+    } catch (error61) {
+      this.#database.exec("ROLLBACK");
+      throw error61;
+    }
+  };
+  #decrementEventState = (byteLength) => {
+    const result = this.#database.prepare(
+      `UPDATE relay_session_event_outbox_state
+                 SET event_count = event_count - 1,
+                     total_bytes = total_bytes - ?
+                 WHERE singleton = 1 AND event_count > 0 AND total_bytes >= ?`
+    ).run(byteLength, byteLength);
+    if (result.changes !== 1) {
+      throw new Error("The Session event outbox capacity state is inconsistent");
+    }
+  };
   pending = () => this.#database.prepare(
     `SELECT envelope_json
          FROM relay_session_event_outbox
          ORDER BY ordinal`
   ).all().map(readPendingEnvelope);
-};
+  pendingBatch = (limit) => {
+    if (!Number.isSafeInteger(limit) || limit < 1) {
+      throw new Error("Session event replay batch limit must be a positive integer");
+    }
+    return this.#database.prepare(
+      `WITH ranked_events AS (
+                   SELECT ordinal,
+                          ROW_NUMBER() OVER (
+                            PARTITION BY source_key
+                            ORDER BY ordinal
+                          ) AS source_position
+                   FROM relay_session_event_outbox
+                 )
+                 SELECT outbox.envelope_json
+                 FROM ranked_events AS ranked
+                 INNER JOIN relay_session_event_outbox AS outbox
+                   ON outbox.ordinal = ranked.ordinal
+                 ORDER BY ranked.source_position, outbox.ordinal
+                 LIMIT ?`
+    ).all(limit).map(readPendingEnvelope);
+  };
+  pendingSourceHeads = (limit, excludedEventIds, excludedSourceKeys) => {
+    if (!Number.isSafeInteger(limit) || limit < 1) {
+      throw new Error("Session event replay batch limit must be a positive integer");
+    }
+    const exclusions = [];
+    const parameters = [];
+    if (excludedEventIds.length > 0) {
+      exclusions.push(`event_id NOT IN (${excludedEventIds.map(() => "?").join(", ")})`);
+      parameters.push(...excludedEventIds);
+    }
+    if (excludedSourceKeys.length > 0) {
+      exclusions.push(`source_key NOT IN (${excludedSourceKeys.map(() => "?").join(", ")})`);
+      parameters.push(...excludedSourceKeys);
+    }
+    parameters.push(limit.toString());
+    const where = exclusions.length === 0 ? "" : `WHERE ${exclusions.join(" AND ")}`;
+    return this.#database.prepare(
+      `WITH available_events AS (
+                   SELECT ordinal, source_key
+                   FROM relay_session_event_outbox
+                   ${where}
+                 ), ranked_events AS (
+                   SELECT ordinal,
+                          ROW_NUMBER() OVER (
+                            PARTITION BY source_key
+                            ORDER BY ordinal
+                          ) AS source_position
+                   FROM available_events
+                 )
+                 SELECT outbox.envelope_json
+                 FROM ranked_events AS ranked
+                 INNER JOIN relay_session_event_outbox AS outbox
+                   ON outbox.ordinal = ranked.ordinal
+                 WHERE ranked.source_position = 1
+                 ORDER BY outbox.ordinal
+                 LIMIT ?`
+    ).all(...parameters).map(readPendingEnvelope);
+  };
+};
+function validateLimits(limits) {
+  const values = [
+    limits.criticalEventBytes,
+    limits.criticalEventCount,
+    limits.runtimeDeliveryBytes,
+    limits.runtimeDeliveryCount,
+    limits.standardEventBytes,
+    limits.standardEventCount
+  ];
+  if (values.some((value) => !Number.isSafeInteger(value) || value < 1)) {
+    throw new Error("Session event outbox limits must be positive integers");
+  }
+  if (limits.criticalEventBytes < limits.standardEventBytes || limits.criticalEventCount < limits.standardEventCount) {
+    throw new Error("Critical Session event capacity must include the standard capacity");
+  }
+}
+function runtimeDeliveryState(row) {
+  const state = rowString2(row, "state");
+  if (state !== "received" && state !== "relay_committed" && state !== "processed") {
+    throw new Error("SQLite returned an invalid Runtime delivery state");
+  }
+  return state;
+}
 function isDaemonExecutionState(value) {
   return value === "cancelled" || value === "dispatching" || value === "failed" || value === "running" || value === "succeeded";
 }
@@ -29632,7 +30296,7 @@ var systemDaemonTimer = new SystemDaemonTimer();
 
 // src/run-daemon.ts
 var RELAY_RECONNECT_DELAY_MILLISECONDS = 500;
-var RELAY_CONNECTION_REFRESH_MILLISECONDS = 20 * 60 * 1e3;
+var AGENT_ACTIVITY_COALESCING_MILLISECONDS = 100;
 var ACTIVE_TURN_RECONCILIATION_TIMEOUT_MILLISECONDS = 2e4;
 var ACTIVE_TURN_RECONCILIATION_CLOSE_CODE = 4009;
 function botIpcSocketPath() {
@@ -29641,54 +30305,6 @@ function botIpcSocketPath() {
   }
   return join16("/tmp", `mobius-bot-${randomUUID6()}.sock`);
 }
-var RelayConnectionRefreshState = class {
-};
-var ScheduledRelayConnectionRefreshState = class extends RelayConnectionRefreshState {
-};
-var DueRelayConnectionRefreshState = class extends RelayConnectionRefreshState {
-};
-var FinishedRelayConnectionRefreshState = class extends RelayConnectionRefreshState {
-};
-var RelayConnectionRefresh = class {
-  #isSafe;
-  #refresh;
-  #scheduledTask;
-  #state = new ScheduledRelayConnectionRefreshState();
-  constructor(timer, isSafe, refresh) {
-    this.#isSafe = isSafe;
-    this.#refresh = refresh;
-    this.#scheduledTask = timer.schedule(this.#request, RELAY_CONNECTION_REFRESH_MILLISECONDS);
-  }
-  afterTurnFinished = () => {
-    if (this.#state instanceof DueRelayConnectionRefreshState) {
-      this.#request();
-      return;
-    }
-    if (this.#state instanceof ScheduledRelayConnectionRefreshState || this.#state instanceof FinishedRelayConnectionRefreshState) {
-      return;
-    }
-    throw new Error("Unknown relay connection refresh state");
-  };
-  close = () => {
-    this.#scheduledTask.cancel();
-    this.#state = new FinishedRelayConnectionRefreshState();
-  };
-  #request = () => {
-    if (this.#state instanceof FinishedRelayConnectionRefreshState) {
-      return;
-    }
-    if (!(this.#state instanceof ScheduledRelayConnectionRefreshState) && !(this.#state instanceof DueRelayConnectionRefreshState)) {
-      throw new Error("Unknown relay connection refresh state");
-    }
-    if (!this.#isSafe()) {
-      this.#state = new DueRelayConnectionRefreshState();
-      return;
-    }
-    this.#state = new FinishedRelayConnectionRefreshState();
-    this.#scheduledTask.cancel();
-    this.#refresh();
-  };
-};
 var DaemonAcpObserver = class {
   #record;
   constructor(record2) {
@@ -29883,8 +30499,7 @@ var ActiveTurnReconciliationError = class extends Error {
   }
 };
 function activeTurnReconciliationEndpoint(config2, turn) {
-  const endpoint = new URL(config2.relayUrl);
-  endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
+  const endpoint = relayHttpEndpoint(config2.relayUrl);
   let channelPath = "";
   if (endpoint.pathname.endsWith("/daemon")) {
     channelPath = endpoint.pathname.slice(0, -"/daemon".length);
@@ -29896,7 +30511,6 @@ function activeTurnReconciliationEndpoint(config2, turn) {
     channelPath = `${endpoint.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
   endpoint.pathname = `${channelPath}/sessions/${encodeURIComponent(turn.command.sessionId)}/attempts/${encodeURIComponent(turn.attemptId)}/reconciliation`;
-  endpoint.searchParams.delete("liveness");
   return endpoint;
 }
 async function reconcileActiveTurn(config2, turn, signal) {
@@ -29908,7 +30522,7 @@ async function reconcileActiveTurn(config2, turn, signal) {
     response = await fetch6(activeTurnReconciliationEndpoint(config2, turn), {
       body: JSON.stringify({ outcome: { kind: "running" } }),
       dispatcher: environmentProxyDispatcher,
-      headers: { "content-type": "application/json" },
+      headers: { ...runtimeAuthorization(config2.relayUrl), "content-type": "application/json" },
       method: "POST",
       signal: requestSignal
     });
@@ -29953,7 +30567,8 @@ var DaemonSessionEventConnectionState = class {
 };
 var DisconnectedDaemonSessionEventState = class extends DaemonSessionEventConnectionState {
   disconnect = () => this;
-  send = () => void 0;
+  matches = () => false;
+  send = () => false;
 };
 var ConnectedDaemonSessionEventState = class extends DaemonSessionEventConnectionState {
   #socket;
@@ -29962,38 +30577,210 @@ var ConnectedDaemonSessionEventState = class extends DaemonSessionEventConnectio
     this.#socket = socket;
   }
   disconnect = (socket) => socket === this.#socket ? new DisconnectedDaemonSessionEventState() : this;
+  matches = (socket) => socket === this.#socket;
   send = (message) => {
-    if (this.#socket.readyState === WebSocket2.OPEN) {
-      try {
-        this.#socket.send(message);
-      } catch {
-      }
+    if (this.#socket.readyState !== WebSocket2.OPEN) {
+      return false;
+    }
+    try {
+      this.#socket.send(message);
+      return true;
+    } catch {
+      return false;
     }
   };
 };
+var SESSION_EVENT_REPLAY_WINDOW = 16;
+var SESSION_EVENT_SOURCE_REPLAY_WINDOW = 4;
+var SESSION_EVENT_REPLAY_BYTE_LIMIT = 32 * 1024 * 1024;
+var InFlightSessionEvent = class {
+  byteLength;
+  sourceKey;
+  constructor(sourceKey, byteLength) {
+    this.byteLength = byteLength;
+    this.sourceKey = sourceKey;
+  }
+};
+function sessionEventSourceKey(envelope2) {
+  return envelope2.source.kind === "attempt" ? `attempt:${envelope2.sessionId}:${envelope2.source.attemptId}` : `runtime:${envelope2.sessionId}`;
+}
 var DaemonSessionEventPublisher = class {
   #outbox;
+  #inFlightEvents = /* @__PURE__ */ new Map();
+  #inFlightBytes = 0;
   #connection = new DisconnectedDaemonSessionEventState();
   constructor(outbox) {
     this.#outbox = outbox;
   }
   connect = (socket) => {
-    const connection = new ConnectedDaemonSessionEventState(socket);
-    this.#connection = connection;
-    for (const pending of this.#outbox.pending()) {
-      connection.send(pending);
-    }
+    this.#connection = new ConnectedDaemonSessionEventState(socket);
+    this.#clearInFlight();
+    this.#publishNextBatch();
   };
   disconnect = (socket) => {
+    if (!this.#connection.matches(socket)) {
+      return;
+    }
     this.#connection = this.#connection.disconnect(socket);
+    this.#clearInFlight();
   };
   recordAttempt = (sessionId, payload, attemptId) => {
-    this.#connection.send(this.#outbox.enqueue(sessionId, payload, attemptId));
+    const kind = decodeMessageKind(payload);
+    if (kind === SESSION_COMPLETED_KIND || kind === SESSION_FAILED_KIND) {
+      this.#outbox.enqueueCritical(sessionId, payload, attemptId);
+    } else {
+      this.#outbox.enqueue(sessionId, payload, attemptId);
+    }
+    this.#publishNextBatch();
   };
   recordRuntime = (sessionId, payload) => {
-    this.#connection.send(this.#outbox.enqueue(sessionId, payload));
+    this.#outbox.enqueue(sessionId, payload);
+    this.#publishNextBatch();
+  };
+  acknowledge = (acknowledgement) => {
+    if (!this.#outbox.acknowledge(acknowledgement)) {
+      return;
+    }
+    this.#removeInFlight(acknowledgement.eventId);
+    this.#publishNextBatch();
+  };
+  quarantine = (rejection) => {
+    const quarantined = this.#outbox.quarantine(rejection);
+    if (!quarantined) {
+      return false;
+    }
+    this.#removeInFlight(rejection.eventId);
+    this.#publishNextBatch();
+    return true;
+  };
+  #publishNextBatch = () => {
+    while (this.#inFlightEvents.size < SESSION_EVENT_REPLAY_WINDOW) {
+      const sourceCounts = /* @__PURE__ */ new Map();
+      for (const inFlight of this.#inFlightEvents.values()) {
+        sourceCounts.set(inFlight.sourceKey, (sourceCounts.get(inFlight.sourceKey) ?? 0) + 1);
+      }
+      const saturatedSources = [...sourceCounts.entries()].filter(([, count]) => count >= SESSION_EVENT_SOURCE_REPLAY_WINDOW).map(([sourceKey]) => sourceKey);
+      const batch = this.#outbox.pendingSourceHeads(
+        SESSION_EVENT_REPLAY_WINDOW - this.#inFlightEvents.size,
+        [...this.#inFlightEvents.keys()],
+        saturatedSources
+      );
+      let sent = 0;
+      for (const encoded of batch) {
+        const envelope2 = decodeSessionEventEnvelope(encoded);
+        const sourceKey = sessionEventSourceKey(envelope2);
+        const sourceCount = sourceCounts.get(sourceKey) ?? 0;
+        if (sourceCount >= SESSION_EVENT_SOURCE_REPLAY_WINDOW) {
+          continue;
+        }
+        const byteLength = new TextEncoder().encode(encoded).byteLength;
+        if (this.#inFlightBytes + byteLength > SESSION_EVENT_REPLAY_BYTE_LIMIT) {
+          continue;
+        }
+        if (!this.#connection.send(encoded)) {
+          this.#clearInFlight();
+          return;
+        }
+        this.#inFlightEvents.set(envelope2.eventId, new InFlightSessionEvent(sourceKey, byteLength));
+        this.#inFlightBytes += byteLength;
+        sourceCounts.set(sourceKey, sourceCount + 1);
+        sent += 1;
+      }
+      if (sent === 0) {
+        return;
+      }
+    }
+  };
+  #removeInFlight = (eventId) => {
+    const inFlight = this.#inFlightEvents.get(eventId);
+    if (inFlight === void 0) {
+      return;
+    }
+    this.#inFlightEvents.delete(eventId);
+    this.#inFlightBytes -= inFlight.byteLength;
+  };
+  #clearInFlight = () => {
+    this.#inFlightEvents.clear();
+    this.#inFlightBytes = 0;
   };
 };
+var CoalescingDaemonActivityPublisher = class {
+  #pending = /* @__PURE__ */ new Map();
+  #publish;
+  #publishedActivityIds = /* @__PURE__ */ new Set();
+  #scheduled = /* @__PURE__ */ new Map();
+  #timer;
+  constructor(timer, publish) {
+    this.#publish = publish;
+    this.#timer = timer;
+  }
+  flush = () => {
+    const activities = [...this.#pending.values()].sort((left, right) => left.sequence - right.sequence);
+    for (const task of this.#scheduled.values()) {
+      task.cancel();
+    }
+    this.#pending.clear();
+    this.#scheduled.clear();
+    for (const activity of activities) {
+      this.#publish(activity);
+    }
+  };
+  record = (activity) => {
+    if (activity.status !== "pending" && activity.status !== "running") {
+      this.#discardPending(activity.activityId);
+      this.#publishedActivityIds.add(activity.activityId);
+      this.#publish(activity);
+      return Promise.resolve();
+    }
+    if (!this.#publishedActivityIds.has(activity.activityId)) {
+      this.#publishedActivityIds.add(activity.activityId);
+      this.#publish(activity);
+      return Promise.resolve();
+    }
+    this.#pending.set(activity.activityId, activity);
+    if (!this.#scheduled.has(activity.activityId)) {
+      this.#scheduled.set(
+        activity.activityId,
+        this.#timer.schedule(
+          () => this.#flushActivity(activity.activityId),
+          AGENT_ACTIVITY_COALESCING_MILLISECONDS
+        )
+      );
+    }
+    return Promise.resolve();
+  };
+  #discardPending = (activityId) => {
+    this.#scheduled.get(activityId)?.cancel();
+    this.#scheduled.delete(activityId);
+    this.#pending.delete(activityId);
+  };
+  #flushActivity = (activityId) => {
+    const activity = this.#pending.get(activityId);
+    this.#discardPending(activityId);
+    if (activity !== void 0) {
+      this.#publish(activity);
+    }
+  };
+};
+function encodeDaemonActivity(command, activity) {
+  return encodeAgentActivityEvent({
+    activityId: activity.activityId,
+    activityType: activity.activityType,
+    commandId: command.commandId,
+    content: activity.content,
+    detail: activity.detail,
+    input: activity.input,
+    kind: AGENT_ACTIVITY_KIND,
+    locations: activity.locations,
+    name: activity.name,
+    output: activity.output,
+    sequence: activity.sequence,
+    sessionId: command.sessionId,
+    status: activity.status,
+    title: activity.title,
+    toolKind: activity.toolKind
+  });
+}
 function reportFailure(publisher, command, code, message, attemptId) {
   publisher.recordAttempt(
     command.sessionId,
@@ -30167,10 +30954,16 @@ async function executeSessionConfigure(publisher, socket, command, config2, dire
       })
     );
   } catch (error61) {
+    if (signal.aborted) {
+      signal.throwIfAborted();
+    }
     reportOperationFailure(socket, command.requestId, command.sessionId, error61);
   }
 }
-async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, signal) {
+async function executePrompt(outbox, publisher, command, config2, directories, audit, sessions, attemptId, timer, signal) {
+  const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
+    publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
+  });
   try {
     const resolved = await resolveSessionDirectories(
       directories,
@@ -30227,30 +31020,7 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
         cwd: resolved.cwd,
         disposition: command.disposition,
         images: attachments.images,
-        onActivity: (activity) => {
-          publisher.recordAttempt(
-            command.sessionId,
-            encodeAgentActivityEvent({
-              activityId: activity.activityId,
-              activityType: activity.activityType,
-              commandId: command.commandId,
-              content: activity.content,
-              detail: activity.detail,
-              input: activity.input,
-              kind: AGENT_ACTIVITY_KIND,
-              locations: activity.locations,
-              name: activity.name,
-              output: activity.output,
-              sequence: activity.sequence,
-              sessionId: command.sessionId,
-              status: activity.status,
-              title: activity.title,
-              toolKind: activity.toolKind
-            }),
-            attemptId
-          );
-          return Promise.resolve();
-        },
+        onActivity: activities.record,
         onText: (text, messageId) => {
           publisher.recordAttempt(
             command.sessionId,
@@ -30273,6 +31043,7 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
       });
       stopReason = result.stopReason;
     }
+    activities.flush();
     publisher.recordAttempt(
       command.sessionId,
       encodeSessionCompletedEvent({
@@ -30290,6 +31061,7 @@ async function executePrompt(outbox, publisher, command, config2, directories, a
       sessionId: command.sessionId
     });
   } catch (error61) {
+    activities.flush();
     audit.record({
       commandId: command.commandId,
       event: "session_failed",
@@ -30328,7 +31100,10 @@ function botExecutionAgent(agent, contextHandle, socketPath) {
     agent.capabilities
   );
 }
-async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, signal) {
+async function executeBotPrompt(outbox, publisher, command, config2, directories, audit, sessions, grants, contexts, applicator, ipc, attemptId, timer, signal) {
+  const activities = new CoalescingDaemonActivityPublisher(timer, (activity) => {
+    publisher.recordAttempt(command.sessionId, encodeDaemonActivity(command, activity), attemptId);
+  });
   try {
     const deadline = Date.parse(command.executionDeadlineAt);
     const remaining = deadline - Date.now();
@@ -30412,30 +31187,7 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
         commandId: command.commandId,
         cwd: resolved.cwd,
         images: attachments.images,
-        onActivity: (activity) => {
-          publisher.recordAttempt(
-            command.sessionId,
-            encodeAgentActivityEvent({
-              activityId: activity.activityId,
-              activityType: activity.activityType,
-              commandId: command.commandId,
-              content: activity.content,
-              detail: activity.detail,
-              input: activity.input,
-              kind: AGENT_ACTIVITY_KIND,
-              locations: activity.locations,
-              name: activity.name,
-              output: activity.output,
-              sequence: activity.sequence,
-              sessionId: command.sessionId,
-              status: activity.status,
-              title: activity.title,
-              toolKind: activity.toolKind
-            }),
-            attemptId
-          );
-          return Promise.resolve();
-        },
+        onActivity: activities.record,
         onText: (text, messageId) => {
           publisher.recordAttempt(
             command.sessionId,
@@ -30455,6 +31207,7 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
         sessionId: command.sessionId,
         signal: executionSignal
       });
+      activities.flush();
       publisher.recordAttempt(
         command.sessionId,
         encodeSessionCompletedEvent({
@@ -30479,6 +31232,7 @@ async function executeBotPrompt(outbox, publisher, command, config2, directories
       lease.release();
     }
   } catch (error61) {
+    activities.flush();
     const failure = Date.parse(command.executionDeadlineAt) <= Date.now() ? new LocalBotAuthorizationError("turn_expired", "The Bot execution deadline has expired", {
       cause: error61
     }) : error61;
@@ -30518,15 +31272,15 @@ function waitForRelayRetry(signal, timer) {
     signal.addEventListener("abort", finish, { once: true });
   });
 }
-async function publishAgentCatalogUntilAvailable(config2, signal, timer) {
+async function publishAgentCatalogUntilAvailable(config2, diagnostics, signal, timer) {
   try {
     await publishAgentCatalog(config2, signal);
     return;
-  } catch {
+  } catch (error61) {
     if (signal.aborted) {
       return;
     }
-    console.warn("Mobius daemon is waiting to publish its Agent catalog");
+    diagnostics.catalogFailed(error61);
   }
   while (!signal.aborted) {
     await waitForRelayRetry(signal, timer);
@@ -30540,11 +31294,13 @@ async function publishAgentCatalogUntilAvailable(config2, signal, timer) {
     }
   }
 }
-async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, publisher, grants, contexts, applicator, ipc, activeTurns, activeAttemptIds, onConnected, signal, timer) {
+async function runRelayConnection(config2, directories, audit, sessions, installations, installationObserver, nativeSessions, outbox, publisher, grants, contexts, applicator, ipc, activeTurns, activeAttemptIds, connectionEpoch, diagnostics, onConnected, signal, timer) {
   const relayUrl = new URL(config2.relayUrl);
+  relayUrl.searchParams.set("deliveryReceipts", "1");
   relayUrl.searchParams.set("liveness", "1");
   const socket = await connectRelay(relayUrl, signal);
   const reconnectingTurns = [...activeTurns.values()];
+  diagnostics.connectionOpened(connectionEpoch);
   onConnected();
   const connectionController = new AbortController();
   const nativeRequests = /* @__PURE__ */ new Map();
@@ -30553,7 +31309,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
     await new Promise((resolve5, reject) => {
       let finished = false;
       const cleanup = () => {
-        connectionRefresh.close();
         connectionLiveness.close();
         signal.removeEventListener("abort", stop);
         socket.removeEventListener("close", handleClose);
@@ -30571,61 +31326,282 @@ async function runRelayConnection(config2, directories, audit, sessions, install
         cleanup();
         resolve5();
       };
-      const rejectConnection = () => {
+      const rejectConnection = (failure) => {
         if (finished) {
           return;
         }
         finished = true;
         cleanup();
-        reject(new Error("Relay WebSocket failed"));
+        reject(failure);
       };
       const stop = () => {
+        diagnostics.connectionClosed(connectionEpoch, 1e3, "Daemon stopped", "daemon_stop");
         closeRelaySocket(socket, 1e3, "Daemon stopped");
         resolveConnection();
       };
-      const refreshConnection = () => {
-        closeRelaySocket(socket, 1e3, "Refreshing idle relay connection");
-        resolveConnection();
+      const failAndClose = (failure, code, reason, source) => {
+        diagnostics.connectionFailed(connectionEpoch, failure, source);
+        diagnostics.connectionClosed(connectionEpoch, code, reason, source);
+        closeRelaySocket(socket, code, reason);
+        rejectConnection(failure);
+      };
+      const processingDeliveryIds = /* @__PURE__ */ new Set();
+      const processDeliveredPrompt = async (delivery) => {
+        const command = decodeSessionPromptCommand(delivery.payload);
+        if (command.sessionId !== delivery.sessionId) {
+          throw new Error("Runtime delivery Session identity does not match its payload");
+        }
+        const active = activeTurns.get(command.commandId);
+        if (active !== void 0) {
+          await active.completion;
+          return;
+        }
+        const receipt = outbox.claimExecution(command.commandId, command.sessionId, delivery.payload);
+        if (receipt.kind === "duplicate") {
+          if (receipt.state === "running") {
+            reportFailure(
+              publisher,
+              command,
+              "agent_execution_interrupted",
+              "The local Agent execution was interrupted before it completed",
+              receipt.attemptId
+            );
+            outbox.transitionExecution(command.commandId, "failed");
+            return;
+          }
+          if (receipt.state !== "dispatching") {
+            return;
+          }
+        }
+        const turn = new ActiveDaemonTurn(command, receipt.attemptId);
+        activeTurns.set(command.commandId, turn);
+        if (command.disposition !== SessionPromptDisposition.Steer) {
+          activeAttemptIds.set(command.sessionId, receipt.attemptId);
+        }
+        try {
+          await executePrompt(
+            outbox,
+            publisher,
+            command,
+            config2,
+            directories,
+            audit,
+            sessions,
+            receipt.attemptId,
+            timer,
+            turn.signal
+          );
+        } finally {
+          activeTurns.delete(command.commandId);
+          if (activeAttemptIds.get(command.sessionId) === receipt.attemptId) {
+            activeAttemptIds.delete(command.sessionId);
+          }
+          turn.finish();
+        }
+      };
+      const processDeliveredPayload = async (delivery) => {
+        const kind = decodeMessageKind(delivery.payload);
+        if (kind === SESSION_CANCEL_KIND) {
+          const cancellation = decodeSessionCancelCommand(delivery.payload);
+          if (cancellation.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          const turn = activeTurns.get(cancellation.commandId);
+          if (turn === void 0 || !turn.matches(cancellation) || !turn.requestCancellation()) {
+            return;
+          }
+          audit.record({
+            commandId: cancellation.commandId,
+            event: "session_cancellation_requested",
+            sessionId: cancellation.sessionId
+          });
+          await sessions.cancelPrompt(cancellation.sessionId);
+          return;
+        }
+        if (kind === SESSION_CONFIGURE_KIND) {
+          const command = decodeSessionConfigureCommand(delivery.payload);
+          if (command.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          await executeSessionConfigure(
+            publisher,
+            socket,
+            command,
+            config2,
+            directories,
+            audit,
+            sessions,
+            connectionController.signal
+          );
+          return;
+        }
+        if (kind === SESSION_PERMISSION_RESPOND_KIND) {
+          const command = decodeSessionPermissionRespondCommand(delivery.payload);
+          if (command.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          try {
+            await sessions.respondPermission(command);
+            audit.record({
+              commandId: command.interactionId,
+              event: "session_permission_resolved",
+              sessionId: command.sessionId
+            });
+          } catch (error61) {
+            reportOperationFailure(socket, command.interactionId, command.sessionId, error61);
+          }
+          return;
+        }
+        if (kind === SESSION_ELICITATION_RESPOND_KIND) {
+          const command = decodeSessionElicitationRespondCommand(delivery.payload);
+          if (command.sessionId !== delivery.sessionId) {
+            throw new Error("Runtime delivery Session identity does not match its payload");
+          }
+          try {
+            await sessions.respondElicitation(command);
+            audit.record({
+              commandId: command.interactionId,
+              event: "session_elicitation_resolved",
+              sessionId: command.sessionId
+            });
+          } catch (error61) {
+            reportOperationFailure(socket, command.interactionId, command.sessionId, error61);
+          }
+          return;
+        }
+        if (kind === SESSION_PROMPT_KIND) {
+          await processDeliveredPrompt(delivery);
+          return;
+        }
+        throw new Error("Runtime delivery contains an unsupported protocol message");
+      };
+      const processRuntimeDelivery = (delivery, state) => {
+        if (state === "processed" || processingDeliveryIds.has(delivery.deliveryId)) {
+          return;
+        }
+        processingDeliveryIds.add(delivery.deliveryId);
+        void processDeliveredPayload(delivery).then(() => {
+          outbox.markRuntimeDeliveryProcessed(delivery.deliveryId, delivery.sessionId);
+        }).catch((error61) => {
+          if (connectionController.signal.aborted) {
+            return;
+          }
+          console.error("Mobius daemon could not process a durable Runtime delivery", error61);
+          failAndClose(
+            new Error("Runtime delivery processing failed", { cause: error61 }),
+            4008,
+            "Invalid Runtime delivery",
+            "delivery"
+          );
+        }).finally(() => processingDeliveryIds.delete(delivery.deliveryId));
+      };
+      const receiveRuntimeDelivery = (delivery) => {
+        const payloadKind = decodeMessageKind(delivery.payload);
+        let payloadSessionId = "";
+        if (payloadKind === SESSION_CANCEL_KIND) {
+          payloadSessionId = decodeSessionCancelCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_CONFIGURE_KIND) {
+          payloadSessionId = decodeSessionConfigureCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_PERMISSION_RESPOND_KIND) {
+          payloadSessionId = decodeSessionPermissionRespondCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_ELICITATION_RESPOND_KIND) {
+          payloadSessionId = decodeSessionElicitationRespondCommand(delivery.payload).sessionId;
+        } else if (payloadKind === SESSION_PROMPT_KIND) {
+          payloadSessionId = decodeSessionPromptCommand(delivery.payload).sessionId;
+        } else {
+          throw new Error("Runtime delivery contains an unsupported protocol message");
+        }
+        if (payloadSessionId !== delivery.sessionId) {
+          throw new Error("Runtime delivery Session identity does not match its payload");
+        }
+        const stored = outbox.claimRuntimeDelivery(delivery);
+        send(
+          socket,
+          encodeRuntimeDeliveryReceived({
+            deliveryId: delivery.deliveryId,
+            kind: RUNTIME_DELIVERY_RECEIVED_KIND,
+            sessionId: delivery.sessionId
+          })
+        );
+        processRuntimeDelivery(delivery, stored.state);
+      };
+      const resumeRuntimeDeliveries = () => {
+        for (const stored of outbox.runtimeDeliveries()) {
+          const delivery = {
+            deliveryId: stored.deliveryId,
+            kind: RUNTIME_DELIVERY_KIND,
+            payload: stored.payload,
+            sessionId: stored.sessionId
+          };
+          if (stored.state !== "relay_committed") {
+            send(
+              socket,
+              encodeRuntimeDeliveryReceived({
+                deliveryId: stored.deliveryId,
+                kind: RUNTIME_DELIVERY_RECEIVED_KIND,
+                sessionId: stored.sessionId
+              })
+            );
+          }
+          processRuntimeDelivery(delivery, stored.state);
+        }
       };
       const connectionLiveness = new RelayConnectionLiveness(timer, {
         send: (message) => send(socket, message),
-        unresponsive: () => {
+        unresponsive: (heartbeatId, timeoutMilliseconds) => {
+          diagnostics.heartbeatTimedOut(connectionEpoch, heartbeatId, timeoutMilliseconds);
+          diagnostics.connectionClosed(
+            connectionEpoch,
+            4001,
+            "Relay liveness check timed out",
+            "heartbeat_timeout"
+          );
           closeRelaySocket(socket, 4001, "Relay liveness check timed out");
           resolveConnection();
         }
       });
-      const connectionRefresh = new RelayConnectionRefresh(
-        timer,
-        () => activeTurns.size === 0,
-        refreshConnection
-      );
       signal.addEventListener("abort", stop, { once: true });
-      const handleClose = () => {
+      const handleClose = (event) => {
+        diagnostics.connectionClosed(connectionEpoch, event.code, event.reason, "relay");
         resolveConnection();
       };
-      const handleError = () => {
+      const handleError = (event) => {
         if (signal.aborted) {
           resolveConnection();
           return;
         }
-        rejectConnection();
+        const cause = Reflect.get(event, "error");
+        const failure = new Error("Relay WebSocket emitted an error", { cause: cause ?? event });
+        diagnostics.connectionFailed(connectionEpoch, failure, "socket_error");
+        diagnostics.connectionClosed(connectionEpoch, 1006, "WebSocket error", "socket_error");
+        rejectConnection(failure);
       };
       const handleMessage = (event) => {
         const encoded = event.data;
         if (typeof encoded !== "string") {
-          closeRelaySocket(socket, 4003, "Text message required");
-          rejectConnection();
+          failAndClose(new Error("Relay sent a non-text message"), 4003, "Text message required", "protocol");
           return;
         }
         try {
           const kind = decodeMessageKind(encoded);
+          if (kind === RUNTIME_DELIVERY_COMMITTED_KIND) {
+            const committed = decodeRuntimeDeliveryCommitted(encoded);
+            if (!outbox.markRuntimeDeliveryCommitted(committed.deliveryId, committed.sessionId)) {
+              console.warn("Mobius daemon ignored confirmation for an unknown Runtime delivery");
+            }
+            return;
+          }
+          if (kind === RUNTIME_DELIVERY_KIND) {
+            receiveRuntimeDelivery(decodeRuntimeDelivery(encoded));
+            return;
+          }
           if (kind === SESSION_EVENT_ACK_KIND) {
-            outbox.acknowledge(decodeSessionEventAcknowledgement(encoded));
+            publisher.acknowledge(decodeSessionEventAcknowledgement(encoded));
             return;
           }
           if (kind === SESSION_EVENT_REJECTED_KIND) {
             const rejection = decodeSessionEventRejection(encoded);
-            if (outbox.quarantine(rejection)) {
+            if (publisher.quarantine(rejection)) {
               audit.record({
                 commandId: rejection.eventId,
                 details: { code: rejection.code },
@@ -31004,6 +31980,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               applicator,
               ipc,
               receipt2.attemptId,
+              timer,
               turn2.signal
             ).catch((error61) => {
               console.error("Mobius daemon Bot turn failed", error61);
@@ -31013,7 +31990,6 @@ async function runRelayConnection(config2, directories, audit, sessions, install
                 activeAttemptIds.delete(command2.sessionId);
               }
               turn2.finish();
-              connectionRefresh.afterTurnFinished();
             });
             return;
           }
@@ -31042,6 +32018,7 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             audit,
             sessions,
             receipt.attemptId,
+            timer,
             turn.signal
           ).catch((error61) => {
             console.error("Mobius daemon turn failed", error61);
@@ -31051,12 +32028,19 @@ async function runRelayConnection(config2, directories, audit, sessions, install
               activeAttemptIds.delete(command.sessionId);
             }
             turn.finish();
-            connectionRefresh.afterTurnFinished();
           });
         } catch (error61) {
           console.error("Mobius daemon rejected a message", error61);
-          closeRelaySocket(socket, 4008, "Invalid protocol message");
-          rejectConnection();
+          if (error61 instanceof RuntimeDeliveryInboxCapacityError) {
+            failAndClose(error61, 4013, "Runtime delivery queue full", "delivery_backpressure");
+            return;
+          }
+          failAndClose(
+            new Error("Relay sent an invalid protocol message", { cause: error61 }),
+            4008,
+            "Invalid protocol message",
+            "protocol"
+          );
         }
       };
       socket.addEventListener("close", handleClose);
@@ -31068,21 +32052,19 @@ async function runRelayConnection(config2, directories, audit, sessions, install
             return;
           }
           publisher.connect(socket);
-          void Promise.all(reconnectingTurns.map((turn) => turn.completion)).then(
-            connectionRefresh.afterTurnFinished
-          );
+          resumeRuntimeDeliveries();
         },
         (error61) => {
           if (finished) {
             return;
           }
           console.error("Mobius daemon could not reconcile active Agent turns", error61);
-          closeRelaySocket(
-            socket,
+          failAndClose(
+            new Error("Active Agent turn reconciliation failed", { cause: error61 }),
             ACTIVE_TURN_RECONCILIATION_CLOSE_CODE,
-            "Active Agent turn reconciliation failed"
+            "Active Agent turn reconciliation failed",
+            "reconciliation"
           );
-          rejectConnection();
         }
       );
       if (signal.aborted) {
@@ -31126,6 +32108,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   const sessions = new AcpSessionManager(new DaemonAcpObserver(recordSessionEvent), sessionStore);
   const directories = new WorkspaceDirectoryService(config2.bindingId, config2.defaultWorkspace);
   const installationObserver = new DaemonInstallationObserver();
+  const diagnostics = new RelayConnectionDiagnostics(audit, config2.channelId, config2.relayUrl);
   const nativeSessions = new NativeSessionService(config2, directories, sessions, audit);
   const installations = new AgentInstallationManager(
     specifications,
@@ -31133,7 +32116,7 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
     installationObserver,
     installationAudit
   );
-  let retryAnnounced = false;
+  let connectionEpoch = 0;
   let connectionAnnounced = false;
   const announceConnection = () => {
     if (connectionAnnounced) {
@@ -31149,10 +32132,11 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
 `
     );
   };
-  const catalogPublication = publishAgentCatalogUntilAvailable(config2, signal, timer);
+  const catalogPublication = publishAgentCatalogUntilAvailable(config2, diagnostics, signal, timer);
   try {
     await ipc.listen(signal);
     while (!signal.aborted) {
+      connectionEpoch += 1;
       try {
         await runRelayConnection(
           config2,
@@ -31170,19 +32154,17 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
           ipc,
           activeTurns,
           activeAttemptIds,
+          connectionEpoch,
+          diagnostics,
           announceConnection,
           signal,
           timer
         );
-        retryAnnounced = false;
-      } catch {
+      } catch (error61) {
         if (signal.aborted) {
           return;
         }
-        if (!retryAnnounced) {
-          console.warn("Mobius daemon is waiting for the relay");
-          retryAnnounced = true;
-        }
+        diagnostics.connectionFailed(connectionEpoch, error61, "connection");
       }
       await waitForRelayRetry(signal, timer);
     }
@@ -31290,12 +32272,14 @@ process.once("SIGTERM", () => shutdown.abort());
 var USAGE = `Mobius CLI
 
 Usage:
+  mobius --version
   mobius pair --url <relay-url> --pairing <runtime-pairing-id> --code <pairing-code> [--workspace <directory>]
   mobius start --channel <channel-id>
   mobius agents [--json]
   mobius bot message send --target <current|alias> --text <message>
 
 Commands:
+  --version  Print the installed Mobius CLI version
   pair   Pair this machine and start its local daemon
   start  Start the local daemon for a saved channel
   agents Show detected, missing, and integration-ready Agents
@@ -31310,6 +32294,11 @@ async function main() {
     process.stdout.write(USAGE);
     return;
   }
+  if (command === "--version" || command === "-v" || command === "version") {
+    process.stdout.write(`${package_default.version}
+`);
+    return;
+  }
   if (command === "agents") {
     const arguments_ = process.argv.slice(3);
     if (arguments_.length > 1 || arguments_.length === 1 && arguments_[0] !== "--json") {